opensource/mattermost
3
0
Fork 0
mirror of https://github.com/mattermost/mattermost.git synced 2026-09-19 10:12:47 +08:00
Code Issues Packages Projects Releases Wiki Activity

MM-64779: Upload type validation. (#33351)

Browse Source
This commit is contained in:
catalintomai
2025-07-08 00:13:02 +02:00
committed by GitHub
parent f7cb74117b
commit a8fa77f107
2 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/i18n/en.json
+4
View File
@@ -3914,6 +3914,10 @@
"id": "api.upload.get_upload.forbidden.app_error",
"translation": "Failed to get upload."
},
{
"id": "api.upload.invalid_type_for_shared_channel.app_error",
"translation": "Failed to upload file. Upload channel is not shared with remote."
},
{
"id": "api.upload.upload_data.invalid_content_length",
"translation": "Invalid Content-Length."
server/platform/services/sharedchannel/attachment.go
+6
View File
@@ -191,6 +191,12 @@ func (scs *Service) onReceiveUploadCreate(msg model.RemoteClusterMsg, rc *model.
map[string]any{"channelId": us.ChannelId}, "", http.StatusRequestEntityTooLarge)
}
// validate upload type for shared channels - only allow attachments
if us.Type != model.UploadTypeAttachment {
return model.NewAppError("onReceiveUploadCreate", "api.upload.invalid_type_for_shared_channel.app_error",
nil, "", http.StatusBadRequest)
}
us.RemoteId = rc.RemoteId // don't let remotes try to impersonate each other
// create upload session.