From bdc8112e4031a17c39a570bc8fc4bb6b8c35f9aa Mon Sep 17 00:00:00 2001 From: href Date: Fri, 7 Dec 2018 21:44:04 +0100 Subject: Media proxy: fix url encoding --- lib/pleroma/web/media_proxy/controller.ex | 7 ++++++- lib/pleroma/web/media_proxy/media_proxy.ex | 9 ++++++++- 2 files changed, 14 insertions(+), 2 deletions(-) (limited to 'lib') diff --git a/lib/pleroma/web/media_proxy/controller.ex b/lib/pleroma/web/media_proxy/controller.ex index d0b92d0c1..f496fc936 100644 --- a/lib/pleroma/web/media_proxy/controller.ex +++ b/lib/pleroma/web/media_proxy/controller.ex @@ -24,7 +24,12 @@ defmodule Pleroma.Web.MediaProxy.MediaProxyController do end def filename_matches(has_filename, path, url) do - filename = MediaProxy.filename(url) + filename = + url + |> MediaProxy.filename() + |> URI.decode() + + path = URI.decode(path) cond do has_filename && filename && Path.basename(path) != filename -> {:wrong_filename, filename} diff --git a/lib/pleroma/web/media_proxy/media_proxy.ex b/lib/pleroma/web/media_proxy/media_proxy.ex index 28aacb0b1..902ab1b77 100644 --- a/lib/pleroma/web/media_proxy/media_proxy.ex +++ b/lib/pleroma/web/media_proxy/media_proxy.ex @@ -14,7 +14,14 @@ defmodule Pleroma.Web.MediaProxy do url else secret = Application.get_env(:pleroma, Pleroma.Web.Endpoint)[:secret_key_base] - base64 = Base.url_encode64(url, @base64_opts) + + # The URL is url-decoded and encoded again to ensure it is correctly encoded and not twice. + base64 = + url + |> URI.decode() + |> URI.encode() + |> Base.url_encode64(@base64_opts) + sig = :crypto.hmac(:sha, secret, base64) sig64 = sig |> Base.url_encode64(@base64_opts) -- cgit v1.2.3