mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-09-11 11:11:35 +09:00
Jeremy Daer
79eb9a5516
Active Storage mounts its direct-upload write endpoints -- POST /rails/active_storage/direct_uploads and the disk-service PUT at /rails/active_storage/disk/:token -- on framework controllers that inherit from ActiveStorage::BaseController, so they never pass through ApplicationController's require_authentication. Anyone who can read the public login page can lift a CSRF token and Rails session cookie, POST to the metadata endpoint, and receive a signed disk PUT URL without holding a Campfire session_token. That is enough to allocate ActiveStorage::Blob rows and persist bytes to disk anonymously. The blobs stay unattached (no message can be created without an account) and nothing purges them, so an unauthenticated caller can grow storage without bound. Because the recommended self-host layout co-locates uploaded files and the SQLite database on one /rails/storage volume, that growth eventually makes database writes fail -- blocking login and messaging until an administrator frees space and purges the blobs. Campfire uploads attachments through MessagesController as a normal multipart POST and does not use direct uploads at all, so these endpoints have no legitimate anonymous caller. Require a valid Campfire session before the metadata endpoint allocates a blob or the disk endpoint accepts an upload; both return 401 to anonymous callers. Serving (disk#show, representations, blob redirects) is unchanged.
16 lines
963 B
Ruby
16 lines
963 B
Ruby
# Active Storage mounts its direct-upload write endpoints
|
|
# (POST /rails/active_storage/direct_uploads and the disk-service PUT) on
|
|
# framework controllers that inherit from ActiveStorage::BaseController, so
|
|
# they never pass through ApplicationController's require_authentication.
|
|
# Campfire uploads attachments through MessagesController instead and does not
|
|
# use direct uploads at all, leaving these endpoints reachable by anyone who
|
|
# can read the public login page. Require a valid Campfire session before an
|
|
# anonymous caller can allocate a Blob or persist bytes to disk.
|
|
Rails.application.config.to_prepare do
|
|
ActiveStorage::DirectUploadsController.include ActiveStorageAuthentication
|
|
ActiveStorage::DirectUploadsController.before_action :require_active_storage_authentication
|
|
|
|
ActiveStorage::DiskController.include ActiveStorageAuthentication
|
|
ActiveStorage::DiskController.before_action :require_active_storage_authentication, only: :update
|
|
end
|