discourse/app/controllers/onebox_controller.rb
Sam f028ffaf29 SECURITY: correct local onebox category checks
Also removes ugly "source_topic_id" from cooked posts

Patch was authored by @zogstrip

Signed-off-by: Sam <sam.saffron@gmail.com>
2018-02-14 10:40:46 +11:00

43 lines
992 B
Ruby

require_dependency 'oneboxer'
class OneboxController < ApplicationController
requires_login
def show
unless params[:refresh] == 'true'
preview = Oneboxer.cached_preview(params[:url])
preview.strip! if preview.present?
return render(plain: preview) if preview.present?
end
# only 1 outgoing preview per user
return render(body: nil, status: 429) if Oneboxer.is_previewing?(current_user.id)
user_id = current_user.id
category_id = params[:category_id].to_i
invalidate = params[:refresh] == 'true'
url = params[:url]
hijack do
Oneboxer.preview_onebox!(user_id)
preview = Oneboxer.preview(url,
invalidate_oneboxes: invalidate,
user_id: user_id,
category_id: category_id
)
preview.strip! if preview.present?
Oneboxer.onebox_previewed!(user_id)
if preview.blank?
render body: nil, status: 404
else
render plain: preview
end
end
end
end