revi-archive/phorge-phorge
1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-11-25 16:22:43 +01:00
Code Issues Releases Wiki Activity

Use predictable filenames when downloading raw diffs from a revision

Browse source 
Summary:
To prevent spammers from abusing this feature on a public server, do not include query parameters in the generated filenames. See <d8bb7d91b7>.

Ref T15665.

Test Plan: Download raw diff from a revision and check filename in URL.

Reviewers: O1 Blessed Committers, valerio.bozzolan

Reviewed By: O1 Blessed Committers, valerio.bozzolan

Subscribers: speck, tobiaswiese, valerio.bozzolan, Matthew, Cigaryno

Maniphest Tasks: T15665

Differential Revision: https://we.phorge.it/D25478

Signed-off-by: Zero King <l2dy@icloud.com>
This commit is contained in:
David Lawrence 2023-08-29 14:25:33 -04:00 committed by Zero King
parent 179f866deb
commit 10a3f4fa19
1 changed files with 7 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
src/applications/differential/controller/DifferentialRevisionViewController.php
View file

@ -1090,20 +1090,13 @@ final class DifferentialRevisionViewController
$request_uri = $this->getRequest()->getRequestURI();
// this ends up being something like
// D123.diff
// or the verbose
// D123.vs123.id123.highlightjs.diff
// lame but nice to include these options
$file_name = ltrim($request_uri->getPath(), '/').'.';
foreach ($request_uri->getQueryParamsAsPairList() as $pair) {
list($key, $value) = $pair;
if ($key == 'download') {
continue;
}
$file_name .= $key.$value.'.';
}
$file_name .= 'diff';
// Filename ends up being something like D123.1692295858.diff
// This discards some options in the query string that may affect the diff
// response, but is intentional to avoid spammy titles from bot requests.
$timestamp =
PhabricatorTime::getNow() +
phutil_units('24 hours in seconds');
$file_name = ltrim($request_uri->getPath(), '/').'.'.$timestamp.'.diff';
$iterator = new ArrayIterator(array($raw_diff));