discourse/app/controllers/site_controller.rb
Alan Guo Xiang Tan 17e1bfe069
SECURITY: Preload data only when rendering application layout
This commit drops the `before_action :preload_json` callback in `ApplicationController` as it adds unnecessary complexity to `ApplicationController` as well as other controllers which has to skip this callback. The source of the complexity comes mainly from the following two conditionals in the `preload_json` method:

```
    # We don't preload JSON on xhr or JSON request
    return if request.xhr? || request.format.json?

    # if we are posting in makes no sense to preload
    return if request.method != "GET"
```

Basically, the conditionals solely exists for optimization purposes to ensure that we don't run the preloading code when the request is not a GET request and the response is not expected to be HTML. The key problem here is that the conditionals are trying to expect what the content type of the response will be and this has proven to be hard to get right. Instead, we can simplify this problem by running the preloading code in a more deterministic way which is to preload only when the `application` layout is being rendered and this is main change that this commit introduces.
2025-02-04 13:32:30 -03:00

58 lines
1.8 KiB
Ruby

# frozen_string_literal: true
class SiteController < ApplicationController
layout false
skip_before_action :preload_json, :check_xhr
skip_before_action :redirect_to_login_if_required,
:redirect_to_profile_if_required,
only: %w[basic_info statistics]
def site
render json: Site.json_for(guardian)
end
def settings
render json: SiteSetting.client_settings_json
end
def custom_html
render json: @application_layout_preloader.custom_html_json
end
def banner
render json: @application_layout_preloader.banner_json
end
def emoji
render json: @application_layout_preloader.custom_emoji
end
def basic_info
results = {
logo_url: UrlHelper.absolute(SiteSetting.site_logo_url),
logo_small_url: UrlHelper.absolute(SiteSetting.site_logo_small_url),
apple_touch_icon_url: UrlHelper.absolute(SiteSetting.site_apple_touch_icon_url),
favicon_url: UrlHelper.absolute(SiteSetting.site_favicon_url),
title: SiteSetting.title,
description: SiteSetting.site_description,
header_primary_color: ColorScheme.hex_for_name("header_primary") || "333333",
header_background_color: ColorScheme.hex_for_name("header_background") || "ffffff",
login_required: SiteSetting.login_required,
locale: SiteSetting.default_locale,
include_in_discourse_discover: SiteSetting.include_in_discourse_discover,
}
if mobile_logo_url = SiteSetting.site_mobile_logo_url.presence
results[:mobile_logo_url] = UrlHelper.absolute(mobile_logo_url)
end
# this info is always available cause it can be scraped from a 404 page
render json: results
end
def statistics
return redirect_to path("/") unless SiteSetting.share_anonymized_statistics?
render json: About.fetch_cached_stats
end
end