From c0c5ba48a075c3940b18d24cacd80b43919cd2fd Mon Sep 17 00:00:00 2001
From: Pete Matsyburka <pete@docuseal.com>
Date: Wed, 4 Nov 2026 00:05:39 +0200
Subject: [PATCH] block active storage routes

---
 config/initializers/active_storage.rb | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/config/initializers/active_storage.rb b/config/initializers/active_storage.rb
index be1236ac9..d00137bc2 100644
--- a/config/initializers/active_storage.rb
+++ b/config/initializers/active_storage.rb
@@ -62,11 +62,32 @@ end
 
 ActiveStorage::LogSubscriber.detach_from(:active_storage) if Rails.env.production?
 
+# rubocop:disable-next Metrics/BlockLength
 Rails.configuration.to_prepare do
   ActiveStorage::DiskController.after_action do
     response.set_header('cache-control', 'public, max-age=31536000') if action_name == 'show'
   end
 
+  ActiveStorage::DiskController.prepend_before_action(only: :update) do
+    head :forbidden
+  end
+
+  ActiveStorage::Blobs::RedirectController.prepend_before_action do
+    head :forbidden
+  end
+
+  ActiveStorage::Representations::RedirectController.prepend_before_action do
+    head :forbidden
+  end
+
+  ActiveStorage::Representations::ProxyController.prepend_before_action do
+    head :forbidden
+  end
+
+  ActiveStorage::Blobs::ProxyController.prepend_before_action do
+    head :forbidden
+  end
+
   ActiveStorage::Blobs::ProxyController.before_action do
     response.set_header('Access-Control-Allow-Origin', '*')
     response.set_header('Access-Control-Allow-Methods', 'GET')