From 5028aaf44674a6cb6ce10726937ea742455ffdd6 Mon Sep 17 00:00:00 2001
From: Martin Brennan <mjrbrennan@gmail.com>
Date: Wed, 25 Nov 2020 14:31:31 +1000
Subject: [PATCH] FIX: Add secure media url to SERVER_SIDE_ONLY list (#11348)

---
 app/assets/javascripts/discourse/app/lib/url.js       |  1 +
 .../javascripts/discourse/tests/unit/lib/url-test.js  | 11 +++++++++++
 2 files changed, 12 insertions(+)

diff --git a/app/assets/javascripts/discourse/app/lib/url.js b/app/assets/javascripts/discourse/app/lib/url.js
index 360c7626752..3fd26166652 100644
--- a/app/assets/javascripts/discourse/app/lib/url.js
+++ b/app/assets/javascripts/discourse/app/lib/url.js
@@ -16,6 +16,7 @@ const TOPIC_REGEXP = /\/t\/([^\/]+)\/(\d+)\/?(\d+)?/;
 const SERVER_SIDE_ONLY = [
   /^\/assets\//,
   /^\/uploads\//,
+  /^\/secure-media-uploads\//,
   /^\/stylesheets\//,
   /^\/site_customizations\//,
   /^\/raw\//,
diff --git a/app/assets/javascripts/discourse/tests/unit/lib/url-test.js b/app/assets/javascripts/discourse/tests/unit/lib/url-test.js
index 6cd5790d946..adfb906f514 100644
--- a/app/assets/javascripts/discourse/tests/unit/lib/url-test.js
+++ b/app/assets/javascripts/discourse/tests/unit/lib/url-test.js
@@ -96,4 +96,15 @@ module("Unit | Utility | url", function () {
       "https://www.discourse.org/mailto:foo"
     );
   });
+
+  test("routeTo redirects secure media URLS because they are server side only", async function (assert) {
+    sinon.stub(DiscourseURL, "redirectTo");
+    sinon.stub(DiscourseURL, "handleURL");
+    DiscourseURL.routeTo("/secure-media-uploads/original/1X/test.pdf");
+    assert.ok(
+      DiscourseURL.redirectTo.calledWith(
+        "/secure-media-uploads/original/1X/test.pdf"
+      )
+    );
+  });
 });