discourse/app/jobs/regular/download_backup_email.rb
Guo Xiang Tan 97ceebb570 SECURITY: Don't pass email backup token to sidekiq as a parameter.
* This exposes the token in the Sidekiq dashboard which can be
  viewed by an admin and defeats the purpose of using a token
  in the download backup email ink.
2017-12-18 11:25:22 +08:00

28 lines
774 B
Ruby

require_dependency 'email/sender'
require_dependency "email_backup_token"
module Jobs
class DownloadBackupEmail < Jobs::Base
sidekiq_options queue: 'critical'
def execute(args)
user_id = args[:user_id]
user = User.find_by(id: user_id)
raise Discourse::InvalidParameters.new(:user_id) unless user
backup_file_path = args[:backup_file_path]
raise Discourse::InvalidParameters.new(:backup_file_path) if backup_file_path.blank?
backup_file_path = URI(backup_file_path)
backup_file_path.query = URI.encode_www_form(token: EmailBackupToken.set(user.id))
message = DownloadBackupMailer.send_email(user.email, backup_file_path.to_s)
Email::Sender.new(message, :download_backup_message).send
end
end
end