Commit d2f83a10 authored by Nick Thomas's avatar Nick Thomas

Ensure that emails contain absolute, rather than relative, links to user uploads

parent 0a51eae5
---
title: Ensure that emails contain absolute, rather than relative, links to user uploads
merge_request: 16364
author:
type: fixed
...@@ -50,15 +50,22 @@ module Banzai ...@@ -50,15 +50,22 @@ module Banzai
end end
def process_link_to_upload_attr(html_attr) def process_link_to_upload_attr(html_attr)
uri_parts = [html_attr.value] path_parts = [html_attr.value]
if group if group
uri_parts.unshift(relative_url_root, 'groups', group.full_path, '-') path_parts.unshift(relative_url_root, 'groups', group.full_path, '-')
elsif project elsif project
uri_parts.unshift(relative_url_root, project.full_path) path_parts.unshift(relative_url_root, project.full_path)
end end
html_attr.value = File.join(*uri_parts) path = File.join(*path_parts)
html_attr.value =
if context[:only_path]
path
else
URI.join(Gitlab.config.gitlab.base_url, path).to_s
end
end end
def process_link_to_repository_attr(html_attr) def process_link_to_repository_attr(html_attr)
......
...@@ -8,7 +8,8 @@ describe Banzai::Filter::RelativeLinkFilter do ...@@ -8,7 +8,8 @@ describe Banzai::Filter::RelativeLinkFilter do
group: group, group: group,
project_wiki: project_wiki, project_wiki: project_wiki,
ref: ref, ref: ref,
requested_path: requested_path requested_path: requested_path,
only_path: only_path
}) })
described_class.call(doc, contexts) described_class.call(doc, contexts)
...@@ -37,6 +38,7 @@ describe Banzai::Filter::RelativeLinkFilter do ...@@ -37,6 +38,7 @@ describe Banzai::Filter::RelativeLinkFilter do
let(:commit) { project.commit(ref) } let(:commit) { project.commit(ref) }
let(:project_wiki) { nil } let(:project_wiki) { nil }
let(:requested_path) { '/' } let(:requested_path) { '/' }
let(:only_path) { true }
shared_examples :preserve_unchanged do shared_examples :preserve_unchanged do
it 'does not modify any relative URL in anchor' do it 'does not modify any relative URL in anchor' do
...@@ -240,26 +242,35 @@ describe Banzai::Filter::RelativeLinkFilter do ...@@ -240,26 +242,35 @@ describe Banzai::Filter::RelativeLinkFilter do
let(:commit) { nil } let(:commit) { nil }
let(:ref) { nil } let(:ref) { nil }
let(:requested_path) { nil } let(:requested_path) { nil }
let(:upload_path) { '/uploads/e90decf88d8f96fe9e1389afc2e4a91f/test.jpg' }
let(:relative_path) { "/#{project.full_path}#{upload_path}" }
context 'to a project upload' do context 'to a project upload' do
context 'with an absolute URL' do
let(:absolute_path) { Gitlab.config.gitlab.url + relative_path }
let(:only_path) { false }
it 'rewrites the link correctly' do
doc = filter(link(upload_path))
expect(doc.at_css('a')['href']).to eq(absolute_path)
end
end
it 'rebuilds relative URL for a link' do it 'rebuilds relative URL for a link' do
doc = filter(link('/uploads/e90decf88d8f96fe9e1389afc2e4a91f/test.jpg')) doc = filter(link(upload_path))
expect(doc.at_css('a')['href']) expect(doc.at_css('a')['href']).to eq(relative_path)
.to eq "/#{project.full_path}/uploads/e90decf88d8f96fe9e1389afc2e4a91f/test.jpg"
doc = filter(nested(link('/uploads/e90decf88d8f96fe9e1389afc2e4a91f/test.jpg'))) doc = filter(nested(link(upload_path)))
expect(doc.at_css('a')['href']) expect(doc.at_css('a')['href']).to eq(relative_path)
.to eq "/#{project.full_path}/uploads/e90decf88d8f96fe9e1389afc2e4a91f/test.jpg"
end end
it 'rebuilds relative URL for an image' do it 'rebuilds relative URL for an image' do
doc = filter(image('/uploads/e90decf88d8f96fe9e1389afc2e4a91f/test.jpg')) doc = filter(image(upload_path))
expect(doc.at_css('img')['src']) expect(doc.at_css('img')['src']).to eq(relative_path)
.to eq "/#{project.full_path}/uploads/e90decf88d8f96fe9e1389afc2e4a91f/test.jpg"
doc = filter(nested(image('/uploads/e90decf88d8f96fe9e1389afc2e4a91f/test.jpg'))) doc = filter(nested(image(upload_path)))
expect(doc.at_css('img')['src']) expect(doc.at_css('img')['src']).to eq(relative_path)
.to eq "/#{project.full_path}/uploads/e90decf88d8f96fe9e1389afc2e4a91f/test.jpg"
end end
it 'does not modify absolute URL' do it 'does not modify absolute URL' do
...@@ -288,6 +299,17 @@ describe Banzai::Filter::RelativeLinkFilter do ...@@ -288,6 +299,17 @@ describe Banzai::Filter::RelativeLinkFilter do
let(:project) { nil } let(:project) { nil }
let(:relative_path) { "/groups/#{group.full_path}/-/uploads/e90decf88d8f96fe9e1389afc2e4a91f/test.jpg" } let(:relative_path) { "/groups/#{group.full_path}/-/uploads/e90decf88d8f96fe9e1389afc2e4a91f/test.jpg" }
context 'with an absolute URL' do
let(:absolute_path) { Gitlab.config.gitlab.url + relative_path }
let(:only_path) { false }
it 'rewrites the link correctly' do
doc = filter(upload_link)
expect(doc.at_css('a')['href']).to eq(absolute_path)
end
end
it 'rewrites the link correctly' do it 'rewrites the link correctly' do
doc = filter(upload_link) doc = filter(upload_link)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment