fixed 解决安全问题访问附件，id改为uuid,查看附件

2023-12-12 16:57:39 +08:00 · 2023-12-12 16:57:39 +08:00 · 60c8b25075
parent 247c5a60b1
commit 60c8b25075
1 changed files with 2 additions and 1 deletions
--- a/app/controllers/attachments_controller.rb
+++ b/app/controllers/attachments_controller.rb
@ -144,11 +144,12 @@ class AttachmentsController < ApplicationController

  private
  def find_file
+    tip_exception(404, "您访问的页面不存在或已被删除") if params[:id].blank?
    @file =
      if params[:type] == 'history'
        AttachmentHistory.find params[:id]
      else
-        Attachment.find_by(id: params[:id]) || Attachment.find_by(uuid: params[:id])
+        Attachment.where_id_or_uuid(params[:id]).first
      end
    tip_exception(404, "您访问的页面不存在或已被删除") if @file.blank?
  end