mirror of
https://0xacab.org/sutty/sutty
synced 2024-11-19 07:26:22 +00:00
fix: solo validar el host de archivo subido si estamos validando hosts #13181
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
This commit is contained in:
parent
47ffb7ebca
commit
7c6f3ca8b4
1 changed files with 7 additions and 2 deletions
|
@ -56,8 +56,13 @@ class MetadataContent < MetadataTemplate
|
|||
|
||||
uri = URI element['src']
|
||||
|
||||
# No permitimos recursos externos
|
||||
raise URI::Error unless Rails.application.config.hosts.include?(uri.hostname)
|
||||
# No permitimos recursos externos, solo si sabemos cuales son
|
||||
# los recursos locales
|
||||
if Rails.application.config.hosts.present?
|
||||
unless Rails.application.config.hosts.include?(uri.hostname)
|
||||
raise URI::Error
|
||||
end
|
||||
end
|
||||
|
||||
element['src'] = convert_src_to_internal_path uri
|
||||
|
||||
|
|
Loading…
Reference in a new issue