Commit 183d8929 authored by Bob Van Landuyt's avatar Bob Van Landuyt

Override `file_storage` on the `ObjectStoreUploader`

Normally the storage-stype of an uploader is set on the class level of
an uploader [0] and the `storage` property is initialized from there [1].

In a security release, we were using that at the class level to
determine the path of an upload and whether or not to move it.

In the `ObjectStoreUploader` the storage method is overridden, meaning
that the storage-type set on the class could be different from the
actual storage used.

[0] https://github.com/carrierwaveuploader/carrierwave/blob/f2f8569b1013f601fe7be4b3a616359acd27240d/lib/carrierwave/uploader/configuration.rb#L8
[1] https://github.com/carrierwaveuploader/carrierwave/blob/f2f8569b1013f601fe7be4b3a616359acd27240d/lib/carrierwave/uploader/store.rb#L88
parent 460d99e3
......@@ -112,6 +112,10 @@ class ObjectStoreUploader < GitlabUploader
raise 'Object Storage feature is missing' unless subject.project.feature_available?(:object_storage)
end
def file_storage?
storage.is_a?(CarrierWave::Storage::File)
end
private
def set_default_local_store(new_file)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment