0a70e51f74
Also redirect to it for download, for Amazon S3 compatibility. Prior to this patch an attacker could obtain an users export by guessing the filename with a high chance of success. Fully authenticating the download request is a lot harder due to our diverse deployment scenarios. This brings the used method in line with the photo export feature. Thanks to @tomekr for the report.
19 lines
373 B
Ruby
19 lines
373 B
Ruby
# Copyright (c) 2010-2011, Diaspora Inc. This file is
|
|
# licensed under the Affero General Public License version 3 or later. See
|
|
# the COPYRIGHT file.
|
|
|
|
class ExportedUser < SecureUploader
|
|
|
|
def store_dir
|
|
"uploads/users"
|
|
end
|
|
|
|
def extension_white_list
|
|
%w(gz)
|
|
end
|
|
|
|
def filename
|
|
"#{model.username}_diaspora_data_#{secure_token}.json.gz"
|
|
end
|
|
|
|
end
|