paulmataruso/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2025-11-02 04:53:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

upload: Include filename at the end of temporary access URLs.

Browse Source
This commit is contained in:
Mateusz Mandera
2020-04-18 16:11:13 +02:00
committed by Tim Abbott
parent e55d967f6e
commit 4018dcb8e7
4 changed files with 26 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
zerver/views/upload.py
View File

@@ -82,10 +82,12 @@ def serve_file(request: HttpRequest, user_profile: UserProfile,
return serve_s3(request, path_id, url_only)
def serve_local_file_unauthed(request: HttpRequest, token: str) -> HttpResponse:
def serve_local_file_unauthed(request: HttpRequest, token: str, filename: str) -> HttpResponse:
path_id = get_local_file_path_id_from_token(token)
if path_id is None:
return json_error(_("Invalid token"))
if path_id.split('/')[-1] != filename:
return json_error(_("Invalid filename"))
return serve_local(request, path_id, url_only=False)