D15654.id37726.diff
No OneTemporary
Actions

Size

1 KB

Referenced Files

None

Subscribers

None

D15654.id37726.diff
View Options

	diff --git a/src/applications/diffusion/controller/DiffusionServeController.php b/src/applications/diffusion/controller/DiffusionServeController.php
	--- a/src/applications/diffusion/controller/DiffusionServeController.php
	+++ b/src/applications/diffusion/controller/DiffusionServeController.php
	@@ -996,6 +996,7 @@
	'href' => $get_uri,
	'header' => array(
	'Authorization' => $no_authorization,
	+ 'X-Phabricator-Request-Type' => 'git-lfs',
	),
	);
	} else {
	diff --git a/src/applications/files/controller/PhabricatorFileDataController.php b/src/applications/files/controller/PhabricatorFileDataController.php
	--- a/src/applications/files/controller/PhabricatorFileDataController.php
	+++ b/src/applications/files/controller/PhabricatorFileDataController.php
	@@ -82,10 +82,13 @@
	$is_viewable = $file->isViewableInBrowser();
	$force_download = $request->getExists('download');

	+ $request_type = $request->getHTTPHeader('X-Phabricator-Request-Type');
	+ $is_lfs = ($request_type == 'git-lfs');
	+
	if ($is_viewable && !$force_download) {
	$response->setMimeType($file->getViewableMimeType());
	} else {
	- if (!$request->isHTTPPost() && !$is_alternate_domain) {
	+ if (!$request->isHTTPPost() && !$is_alternate_domain && !$is_lfs) {
	// NOTE: Require POST to download files from the primary domain. We'd
	// rather go full-bore and do a real CSRF check, but can't currently
	// authenticate users on the file domain. This should blunt any