media assets: fix md5 leak in media assets.

Fix unprivileged users being able to see images and MD5 hashes of media assets belonging to censored posts.
2022-01-30 23:23:55 -06:00
parent 2fe058eccf
commit 0132c5f0a5
5 changed files with 34 additions and 7 deletions
--- a/app/controllers/media_assets_controller.rb
+++ b/app/controllers/media_assets_controller.rb
@@ -5,7 +5,7 @@ class MediaAssetsController < ApplicationController

  def index
    @media_assets = authorize MediaAsset.visible(CurrentUser.user).paginated_search(params, count_pages: false)
-    @media_assets = @media_assets.joins(:media_metadata)
+    @media_assets = @media_assets.joins(:media_metadata).includes(:post)
    respond_with(@media_assets)
  end