From 9377766e520c1f578b678a0717544b098de84c7b Mon Sep 17 00:00:00 2001
From: Pete Matsyburka <pete@docuseal.com>
Date: Sat, 14 Feb 2026 07:57:53 +0200
Subject: [PATCH] fix url download

---
 app/controllers/templates_uploads_controller.rb |  2 +-
 lib/download_utils.rb                           | 10 +++++-----
 lib/submitters/normalize_values.rb              |  2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/app/controllers/templates_uploads_controller.rb b/app/controllers/templates_uploads_controller.rb
index e8c00aea..ddee4e90 100644
--- a/app/controllers/templates_uploads_controller.rb
+++ b/app/controllers/templates_uploads_controller.rb
@@ -56,7 +56,7 @@ class TemplatesUploadsController < ApplicationController
   def create_file_params_from_url
     tempfile = Tempfile.new
     tempfile.binmode
-    tempfile.write(DownloadUtils.call(params[:url]).body)
+    tempfile.write(DownloadUtils.call(params[:url], validate: true).body)
     tempfile.rewind
 
     filename = URI.decode_www_form_component(params[:filename]) if params[:filename].present?
diff --git a/lib/download_utils.rb b/lib/download_utils.rb
index dce5427a..668c6d96 100644
--- a/lib/download_utils.rb
+++ b/lib/download_utils.rb
@@ -35,16 +35,16 @@ module DownloadUtils
 
   module_function
 
-  def call(url)
+  def call(url, validate: Docuseal.multitenant?)
     uri = begin
       URI(url)
     rescue URI::Error
       Addressable::URI.parse(url).normalize
     end
 
-    validate_uri!(uri) if Docuseal.multitenant?
+    validate_uri!(uri) if validate
 
-    resp = conn.get(uri)
+    resp = conn(validate:).get(uri)
 
     raise UnableToDownload, "Error loading: #{uri}" if resp.status >= 400
 
@@ -56,10 +56,10 @@ module DownloadUtils
     raise UnableToDownload, "Error loading: #{uri}. Can't download from localhost." if uri.host.in?(LOCALHOSTS)
   end
 
-  def conn
+  def conn(validate: Docuseal.multitenant?)
     Faraday.new do |faraday|
       faraday.response :follow_redirects, callback: lambda { |_, new_env|
-        validate_uri!(new_env[:url]) if Docuseal.multitenant?
+        validate_uri!(new_env[:url]) if validate
       }
     end
   end
diff --git a/lib/submitters/normalize_values.rb b/lib/submitters/normalize_values.rb
index 16cb268c..1eee3dfd 100644
--- a/lib/submitters/normalize_values.rb
+++ b/lib/submitters/normalize_values.rb
@@ -236,7 +236,7 @@ module Submitters
 
       return blob if blob
 
-      data = DownloadUtils.call(url).body
+      data = DownloadUtils.call(url, validate: true).body
 
       checksum = Digest::MD5.base64digest(data)