From 784b3a615d57e7b77b1ec2cafe27ae59281cbc6b Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Mon, 29 Oct 2018 17:26:15 +0000
Subject: [PATCH] utils: fix another possible leak with private S3 backends
 using mediaproxy

same rationale as the other mediaproxy changes
---
 lib/pleroma/web/common_api/utils.ex | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/pleroma/web/common_api/utils.ex b/lib/pleroma/web/common_api/utils.ex
index 4cbbd0c7d..ed1fe1ad9 100644
--- a/lib/pleroma/web/common_api/utils.ex
+++ b/lib/pleroma/web/common_api/utils.ex
@@ -2,6 +2,7 @@ defmodule Pleroma.Web.CommonAPI.Utils do
   alias Pleroma.{Repo, Object, Formatter, Activity}
   alias Pleroma.Web.ActivityPub.Utils
   alias Pleroma.Web.Endpoint
+  alias Pleroma.Web.MediaProxy
   alias Pleroma.User
   alias Calendar.Strftime
   alias Comeonin.Pbkdf2
@@ -90,6 +91,7 @@ def add_attachments(text, attachments) do
       Enum.map(attachments, fn
         %{"url" => [%{"href" => href} | _]} ->
           name = URI.decode(Path.basename(href))
+          href = MediaProxy.url(href)
           "<a href=\"#{href}\" class='attachment'>#{shortname(name)}</a>"
 
         _ ->