fedward/distraction.party
1
0
Fork 0
forked from AkkomaGang/akkoma
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge 2024.03 stable with security fixes #11

Merged
fedward merged 48 commits from AkkomaGang/akkoma:stable into stable 2024-03-30 16:27:36 +00:00
Conversation 0 Commits 48 Files changed 56 +13 -7
1 changed files with 13 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit bdefbb8fd9 - Show all commits

20
lib/pleroma/web/plugs/uploaded_media.ex
View file

@ -28,12 +28,21 @@ def init(_opts) do
|> Keyword.put(:at, "/__unconfigured_media_plug") |> Keyword.put(:at, "/__unconfigured_media_plug")
|> Plug.Static.init() |> Plug.Static.init()
allowed_mime_types = Pleroma.Config.get([Pleroma.Upload, :allowed_mime_types]) config = Pleroma.Config.get(Pleroma.Upload)
allowed_mime_types = Keyword.fetch!(config, :allowed_mime_types)
uploader = Keyword.fetch!(config, :uploader)
%{static_plug_opts: static_plug_opts, allowed_mime_types: allowed_mime_types} %{
static_plug_opts: static_plug_opts,
allowed_mime_types: allowed_mime_types,
uploader: uploader
}
end end
def call(%{request_path: <<"/", @path, "/", file::binary>>} = conn, opts) do def call(
%{request_path: <<"/", @path, "/", file::binary>>} = conn,
%{uploader: uploader} = opts
) do
conn = conn =
case fetch_query_params(conn) do case fetch_query_params(conn) do
%{query_params: %{"name" => name}} = conn -> %{query_params: %{"name" => name}} = conn ->
@ -46,10 +55,7 @@ def call(%{request_path: <<"/", @path, "/", file::binary>>} = conn, opts) do
end end
|> merge_resp_headers([{"content-security-policy", "sandbox"}]) |> merge_resp_headers([{"content-security-policy", "sandbox"}])
config = Pleroma.Config.get(Pleroma.Upload) with {:ok, get_method} <- uploader.get_file(file),
with uploader <- Keyword.fetch!(config, :uploader),
{:ok, get_method} <- uploader.get_file(file),
false <- media_is_banned(conn, get_method) do false <- media_is_banned(conn, get_method) do
get_media(conn, get_method, opts) get_media(conn, get_method, opts)
else else