yuuza/outline
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: Remove ability to use GET for RPC API requests by default (#4042)

Browse Source 
* fix: Remove ability to use GET for RPC API requests by default

* tsc
This commit is contained in:
Tom Moor
2022-09-02 10:05:40 +02:00
committed by GitHub
parent 2d29f0f042
commit c85f3bd7b4
10 changed files with 85 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
server/routes/api/attachments.ts
View File

@@ -7,6 +7,7 @@ import { AuthorizationError, ValidationError } from "@server/errors";
import auth from "@server/middlewares/authentication";
import { Attachment, Document, Event } from "@server/models";
import { authorize } from "@server/policies";
import { ContextWithState } from "@server/types";
import {
getPresignedPost,
publicS3Endpoint,
@@ -145,9 +146,10 @@ router.post("attachments.delete", auth(), async (ctx) => {
};
});
router.post("attachments.redirect", auth(), async (ctx) => {
const { id } = ctx.body;
const handleAttachmentsRedirect = async (ctx: ContextWithState) => {
const { id } = ctx.body as { id?: string };
assertUuid(id, "id is required");
const { user } = ctx.state;
const attachment = await Attachment.findByPk(id, {
rejectOnEmpty: true,
@@ -163,6 +165,9 @@ router.post("attachments.redirect", auth(), async (ctx) => {
} else {
ctx.redirect(attachment.canonicalUrl);
}
});
};
router.get("attachments.redirect", auth(), handleAttachmentsRedirect);
router.post("attachments.redirect", auth(), handleAttachmentsRedirect);
export default router;