From dd9f8150fce34cc9a30a92a7e3de9560d5146871 Mon Sep 17 00:00:00 2001
From: "Haelwenn (lanodan) Monnier" <contact@hacktivis.me>
Date: Thu, 22 Jun 2023 21:24:58 +0200
Subject: [PATCH] Merge Revert "Merge branch 'validate-host' into 'develop'"

This reverts commit d998a114e26033e98e87778e5ca659aff91831bf, reversing
changes made to da6b4003acad84b0f60ad8da6d08cfe13564b058.
---
 changelog.d/3896.add                          |  1 -
 changelog.d/3909.skip                         |  0
 lib/pleroma/web/plugs/uploaded_media.ex       | 22 +---------------
 .../web/plugs/uploaded_media_plug_test.exs    | 26 -------------------
 4 files changed, 1 insertion(+), 48 deletions(-)
 delete mode 100644 changelog.d/3896.add
 create mode 100644 changelog.d/3909.skip

diff --git a/changelog.d/3896.add b/changelog.d/3896.add
deleted file mode 100644
index e8fde4c8a..000000000
--- a/changelog.d/3896.add
+++ /dev/null
@@ -1 +0,0 @@
-Validate Host header for Uploads and return a 302 if the base_url has changed
diff --git a/changelog.d/3909.skip b/changelog.d/3909.skip
new file mode 100644
index 000000000..e69de29bb
diff --git a/lib/pleroma/web/plugs/uploaded_media.ex b/lib/pleroma/web/plugs/uploaded_media.ex
index 9dd5eb239..8b3bc9acb 100644
--- a/lib/pleroma/web/plugs/uploaded_media.ex
+++ b/lib/pleroma/web/plugs/uploaded_media.ex
@@ -46,32 +46,12 @@ def call(%{request_path: <<"/", @path, "/", file::binary>>} = conn, opts) do
 
     config = Pleroma.Config.get(Pleroma.Upload)
 
-    %{scheme: media_scheme, host: media_host, port: media_port} =
-      Pleroma.Upload.base_url() |> URI.parse()
-
-    with {:valid_host, true} <- {:valid_host, match?(^media_host, conn.host)},
-         uploader <- Keyword.fetch!(config, :uploader),
+    with uploader <- Keyword.fetch!(config, :uploader),
          proxy_remote = Keyword.get(config, :proxy_remote, false),
          {:ok, get_method} <- uploader.get_file(file),
          false <- media_is_banned(conn, get_method) do
       get_media(conn, get_method, proxy_remote, opts)
     else
-      {:valid_host, false} ->
-        redirect_url =
-          %URI{
-            scheme: media_scheme,
-            host: media_host,
-            port: media_port,
-            path: conn.request_path,
-            query: conn.query_string
-          }
-          |> URI.to_string()
-          |> String.trim_trailing("?")
-
-        conn
-        |> Phoenix.Controller.redirect(external: redirect_url)
-        |> halt()
-
       _ ->
         conn
         |> send_resp(:internal_server_error, dgettext("errors", "Failed"))
diff --git a/test/pleroma/web/plugs/uploaded_media_plug_test.exs b/test/pleroma/web/plugs/uploaded_media_plug_test.exs
index dbf8ca5ec..8323ff6ab 100644
--- a/test/pleroma/web/plugs/uploaded_media_plug_test.exs
+++ b/test/pleroma/web/plugs/uploaded_media_plug_test.exs
@@ -40,30 +40,4 @@ test "sends Content-Disposition header when name param is set", %{
              &(&1 == {"content-disposition", ~s[inline; filename="\\"cofe\\".gif"]})
            )
   end
-
-  test "denies access to media if wrong Host", %{
-    attachment_url: attachment_url
-  } do
-    conn = get(build_conn(), attachment_url)
-
-    assert conn.status == 200
-
-    new_media_base = "http://media.localhost:8080"
-
-    %{scheme: new_media_scheme, host: new_media_host, port: new_media_port} =
-      URI.parse(new_media_base)
-
-    clear_config([Pleroma.Upload, :base_url], new_media_base)
-
-    conn = get(build_conn(), attachment_url)
-
-    expected_url =
-      URI.parse(attachment_url)
-      |> Map.put(:host, new_media_host)
-      |> Map.put(:port, new_media_port)
-      |> Map.put(:scheme, new_media_scheme)
-      |> URI.to_string()
-
-    assert redirected_to(conn, 302) == expected_url
-  end
 end