discourse/plugins/chat/app/models/chat_draft.rb
Natalie Tay 5eaf080239
SECURITY: Limit chat drafts length and preloaded count (#19987)
Only allow maximum of `50_000` characters for chat drafts. A hidden `max_chat_draft_length` setting can control this limit. A migration is also provided to delete any abusive draft in the database.

The number of drafts loaded on current user has also been limited and ordered by most recent update.

Note that spec files moved are not directly related to the fix.

Co-authored-by: Joffrey JAFFEUX <j.jaffeux@gmail.com>
Co-authored-by: Régis Hanol <regis@hanol.fr>
2023-01-25 13:50:10 +02:00

26 lines
661 B
Ruby

# frozen_string_literal: true
class ChatDraft < ActiveRecord::Base
belongs_to :user
belongs_to :chat_channel
validate :data_length
def data_length
if self.data && self.data.length > SiteSetting.max_chat_draft_length
self.errors.add(:base, I18n.t("chat.errors.draft_too_long"))
end
end
end
# == Schema Information
#
# Table name: chat_drafts
#
# id :bigint not null, primary key
# user_id :integer not null
# chat_channel_id :integer not null
# data :text not null
# created_at :datetime not null
# updated_at :datetime not null
#