mirror of
https://github.com/discourse/discourse.git
synced 2025-02-23 00:02:09 +08:00
5878535606
What is the problem? In `SvgSpriteController#search` and `SvgSpriteController#icon_picker_search`, the controller actions was using the `RailsMultisite::ConnectionManagement.with_hostname` API but `params[:hostname]` was always `nil` because the routes does not have a `:hostname` param component and the client does not ever pass the `:hostname` param when making the request. When `RailsMultisite::ConnectionManagement.with_hostname` is used with a `nil` argument, it ends up connecting to the default multisite database. Usually this would be bad because we're allowing a site in a multisite setup to connect to another site but thankfully no private data is being leaked here. What is the fix? Since `SvgSpriteController#search` and `SvgSpriteController#icon_picker_search` are login required route, there is no need for us to switch database connections. The fix here is to simply remove the use of `RailsMultisite::ConnectionManagement.with_hostname`.