mirrors/Cloudreve
1
0
Fork 0
mirror of https://github.com/cloudreve/cloudreve.git synced 2025-12-15 10:04:01 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): CVE-2022-32167

Browse Source
This commit is contained in:
HFO4
2022-11-21 19:08:51 +08:00
parent f8ed4b4a5a
commit 4b85541d73
3 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
assets

Submodule assets updated: dc81a86ae8...963ac5b08e

6
middleware/common.go
View File

@@ -45,3 +45,9 @@ func CacheControl() gin.HandlerFunc {
c.Header("Cache-Control", "private, no-cache")
}
}
func Sandbox() gin.HandlerFunc {
return func(c *gin.Context) {
c.Header("Content-Security-Policy", "sandbox")
}
}

8
routers/router.go
View File

@@ -217,7 +217,7 @@ func InitMasterRouter() *gin.Engine {
file := sign.Group("file")
{
// 文件外链（直接输出文件数据）
file.GET("get/:id/:name", controllers.AnonymousGetContent)
file.GET("get/:id/:name", middleware.Sandbox(), controllers.AnonymousGetContent)
// 文件外链(301跳转)
file.GET("source/:id/:name", controllers.AnonymousPermLinkDeprecated)
// 下载文件
@@ -454,7 +454,7 @@ func InitMasterRouter() *gin.Engine {
// 列出文件
file.POST("list", controllers.AdminListFile)
// 预览文件
file.GET("preview/:id", controllers.AdminGetFile)
file.GET("preview/:id", middleware.Sandbox(), controllers.AdminGetFile)
// 删除
file.POST("delete", controllers.AdminDeleteFile)
// 列出用户或外部文件系统目录
@@ -564,9 +564,9 @@ func InitMasterRouter() *gin.Engine {
// 创建文件下载会话
file.PUT("download/:id", controllers.CreateDownloadSession)
// 预览文件
file.GET("preview/:id", controllers.Preview)
file.GET("preview/:id", middleware.Sandbox(), controllers.Preview)
// 获取文本文件内容
file.GET("content/:id", controllers.PreviewText)
file.GET("content/:id", middleware.Sandbox(), controllers.PreviewText)
// 取得Office文档预览地址
file.GET("doc/:id", controllers.GetDocPreview)
// 获取缩略图