not found on wrong blob signature

2 years ago · 4ad58fc285
parent 8227dd4f6a
commit 4ad58fc285
1 changed files with 3 additions and 1 deletions
--- a/app/controllers/api/active_storage_blobs_proxy_legacy_controller.rb
+++ b/app/controllers/api/active_storage_blobs_proxy_legacy_controller.rb
@ -11,7 +11,9 @@ module Api
    def show
      Rollbar.info('Blob legacy') if defined?(Rollbar)

-      blob = ActiveStorage::Blob.find_signed!(params[:signed_blob_id] || params[:signed_id])
+      blob = ActiveStorage::Blob.find_signed(params[:signed_blob_id] || params[:signed_id])
+
+      return head :not_found unless blob

      is_permitted = blob.attachments.any? do |a|
        (current_user && a.record.account.id == current_user.account_id) ||