Page MenuHomePhabricator

Only require POST to fetch file data if the viewer is logged in
ClosedPublic

Authored by epriestley on Apr 4 2017, 4:10 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Jan 15, 7:53 AM
Unknown Object (File)
Sun, Jan 12, 2:31 AM
Unknown Object (File)
Sun, Jan 12, 2:31 AM
Unknown Object (File)
Sun, Jan 12, 2:30 AM
Unknown Object (File)
Sat, Jan 11, 11:37 PM
Unknown Object (File)
Thu, Jan 9, 4:25 PM
Unknown Object (File)
Fri, Jan 3, 8:53 AM
Unknown Object (File)
Sun, Dec 22, 4:38 PM
Subscribers
None

Details

Summary

Ref T11357. In D17611, I added file.search, which includes a "dataURI". Partly, this is building toward resolving T8348.

However, in some cases you can't GET this URI because of a security measure:

  • You have not configured security.alternate-file-domain.
  • The file isn't web-viewable.
  • (The request isn't an LFS request.)

The goal of this security mechanism is just to protect against session hijacking, so it's also safe to disable it if the viewer didn't present any credentials (since that means there's nothing to hijack). Add that exception, and reorganize the code a little bit.

Test Plan
  • From the browser (with a session), tried to GET a binary data file. Got redirected.
  • Got a download with POST.
  • From the CLI (without a session), tried to GET a binary data file. Go a download.

Diff Detail

Repository
rP Phabricator
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

This revision is now accepted and ready to land.Apr 4 2017, 6:00 PM
This revision was automatically updated to reflect the committed changes.