paulmataruso/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2025-11-04 05:53:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

lightbox: Make the "download" link use the new download endpoint.

Browse Source 
The "download" attribute on the button only functions for same-origin
requests; thus, the download endpoint must be used in order for the
"Download" button to function for uploaded images which are stored in
S3, and thus served from a different origin.

This is only done for uploaded images; it does not address a similar
problem with Camo, when Camo is hosted on a different hostname.

Fixes: #19238.
This commit is contained in:
Alex Vandiver
2022-03-21 23:39:22 -04:00
committed by Tim Abbott
parent abed174b12
commit b9e428dd5d
1 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
static/js/lightbox.js
View File

@@ -217,7 +217,22 @@ function display_image(payload) {
.prop("data-filename", filename || "N/A");
$(".image-description .user").text(payload.user).prop("title", payload.user);
$(".image-actions .open, .image-actions .download").attr("href", payload.source);
$(".image-actions .open").attr("href", payload.source);
const url = new URL(payload.source, window.location.href);
const same_origin = url.origin === window.location.origin;
if (same_origin && url.pathname.startsWith("/user_uploads/")) {
// Switch to the "download" handler, so S3 URLs set their Content-Disposition
url.pathname = "/user_uploads/download/" + url.pathname.slice("/user_uploads/".length);
$(".image-actions .download").attr("href", url.href);
} else if (same_origin) {
$(".image-actions .download").attr("href", payload.source);
} else {
// If it's not same-origin, and we don't know how to tell the remote service to put a
// content-disposition on it, the download can't possibly download, just show -- so hide the
// element.
$(".image-actions .download").hide();
}
}
function display_video(payload) {