mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-09-11 03:01:38 +09:00
Jeremy Daer
79eb9a5516
Active Storage mounts its direct-upload write endpoints -- POST /rails/active_storage/direct_uploads and the disk-service PUT at /rails/active_storage/disk/:token -- on framework controllers that inherit from ActiveStorage::BaseController, so they never pass through ApplicationController's require_authentication. Anyone who can read the public login page can lift a CSRF token and Rails session cookie, POST to the metadata endpoint, and receive a signed disk PUT URL without holding a Campfire session_token. That is enough to allocate ActiveStorage::Blob rows and persist bytes to disk anonymously. The blobs stay unattached (no message can be created without an account) and nothing purges them, so an unauthenticated caller can grow storage without bound. Because the recommended self-host layout co-locates uploaded files and the SQLite database on one /rails/storage volume, that growth eventually makes database writes fail -- blocking login and messaging until an administrator frees space and purges the blobs. Campfire uploads attachments through MessagesController as a normal multipart POST and does not use direct uploads at all, so these endpoints have no legitimate anonymous caller. Require a valid Campfire session before the metadata endpoint allocates a blob or the disk endpoint accepts an upload; both return 401 to anonymous callers. Serving (disk#show, representations, blob redirects) is unchanged.