From ce45a8c257bee0aba37ecb92d3eaaefe0153091c Mon Sep 17 00:00:00 2001 From: David Svantesson Date: Sat, 24 Aug 2019 02:33:32 +0200 Subject: [PATCH] Allow token as authorization for accessing attachments (#7909) * Allow token as authorization for accessing attachments Signed-off-by: David Svantesson * Only allow token authentication for attachments if it is a download (GET) --- modules/auth/auth.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/modules/auth/auth.go b/modules/auth/auth.go index 74a596e8ef..68553941ec 100644 --- a/modules/auth/auth.go +++ b/modules/auth/auth.go @@ -29,6 +29,11 @@ func IsAPIPath(url string) bool { return strings.HasPrefix(url, "/api/") } +// IsAttachmentDownload check if request is a file download (GET) with URL to an attachment +func IsAttachmentDownload(ctx *macaron.Context) bool { + return strings.HasPrefix(ctx.Req.URL.Path, "/attachments/") && ctx.Req.Method == "GET" +} + // SignedInID returns the id of signed in user. func SignedInID(ctx *macaron.Context, sess session.Store) int64 { if !models.HasEngine { @@ -36,7 +41,7 @@ func SignedInID(ctx *macaron.Context, sess session.Store) int64 { } // Check access token. - if IsAPIPath(ctx.Req.URL.Path) { + if IsAPIPath(ctx.Req.URL.Path) || IsAttachmentDownload(ctx) { tokenSHA := ctx.Query("token") if len(tokenSHA) == 0 { tokenSHA = ctx.Query("access_token")