jaculabilis/danbooru
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

media assets: fix md5 leak in media assets.

Browse Source 
Fix unprivileged users being able to see images and MD5 hashes of media
assets belonging to censored posts.
This commit is contained in:
evazion
2022-01-30 23:23:55 -06:00
parent 2fe058eccf
commit 0132c5f0a5
5 changed files with 34 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
app/views/media_assets/show.html.erb
View File

@@ -2,7 +2,9 @@
<div id="a-show" class="fixed-width-container">
<h1 class="mb-4">Media Asset</h1>
<%= render MediaAssetComponent.new(media_asset: @media_asset) %>
<% if policy(@media_asset).can_see_image? %>
<%= render MediaAssetComponent.new(media_asset: @media_asset) %>
<% end %>
<table class="striped aligned-vertical">
<% if @post.present? %>
@@ -12,10 +14,12 @@
</tr>
<% end %>
<tr>
<th>MD5</th>
<td><%= @media_asset.md5 %></td>
</tr>
<% if policy(@media_asset).can_see_image? %>
<tr>
<th>MD5</th>
<td><%= @media_asset.md5 %></td>
</tr>
<% end %>
<% @media_asset.metadata.sort.each do |key, value| %>
<tr>