2009-08-27 23:57:37 +02:00
|
|
|
require 'active_record'
|
Security: Instiki 0.16.2
On Webs with file uploads enabled, uploaded files were stored
(in version 0.16.1 and earlier) in the public/ directory.
This was a security threat. A miscreant could upload a .html file.
When a user clicked on the link to the file, it was opened (unsanitized)
in the browser.
As of version 0.16.2, uploaded files are stored in the webs/
directory. Now, when the user clicks on the link, the file is sent
with the
Content-Disposition: attachment
header set, which causes the file to be downloaded, rather than opened
in the browser. As always, files downloaded from the internets should be
treated with caution. At least, this way, they are not aoutomatically
opened in the browser.
To move your existing uploaded files to the new location, do a
rake upgrade_instiki
2009-01-26 07:21:30 +01:00
|
|
|
|
2009-08-27 23:57:37 +02:00
|
|
|
task :upgrade_instiki => :environment do
|
|
|
|
|
ActiveRecord::Base.establish_connection(:production)
|
|
|
|
|
webs = ActiveRecord::Base.connection.execute( "select * from webs" )
|
|
|
|
|
webs.each do |row|
|
|
|
|
|
if File.exists?('public/' + row[4])
|
Security: Instiki 0.16.2
On Webs with file uploads enabled, uploaded files were stored
(in version 0.16.1 and earlier) in the public/ directory.
This was a security threat. A miscreant could upload a .html file.
When a user clicked on the link to the file, it was opened (unsanitized)
in the browser.
As of version 0.16.2, uploaded files are stored in the webs/
directory. Now, when the user clicks on the link, the file is sent
with the
Content-Disposition: attachment
header set, which causes the file to be downloaded, rather than opened
in the browser. As always, files downloaded from the internets should be
treated with caution. At least, this way, they are not aoutomatically
opened in the browser.
To move your existing uploaded files to the new location, do a
rake upgrade_instiki
2009-01-26 07:21:30 +01:00
|
|
|
if File.exists?('webs/' + row[4])
|
|
|
|
|
print "Warning! The directory webs/#{row[4]} already exists. Skipping.\n"
|
|
|
|
|
else
|
|
|
|
|
File.rename('public/' + row[4], 'webs/' + row[4])
|
|
|
|
|
print "Moved: #{row[4]}\n"
|
|
|
|
|
end
|
|
|
|
|
end
|
|
|
|
|
end
|
|
|
|
|
end
|
