check signed blob data purpose

2 years ago · c81b4d855b
parent 4ad58fc285
commit c81b4d855b
1 changed files with 2 additions and 2 deletions
--- a/app/controllers/api/active_storage_blobs_proxy_controller.rb
+++ b/app/controllers/api/active_storage_blobs_proxy_controller.rb
@ -10,9 +10,9 @@ module Api
    before_action :set_cors_headers

    def show
-      blob_uuid, = ApplicationRecord.signed_id_verifier.verified(params[:signed_uuid])
+      blob_uuid, purp = ApplicationRecord.signed_id_verifier.verified(params[:signed_uuid])

-      if blob_uuid.blank?
+      if blob_uuid.blank? || purp != 'blob'
        Rollbar.error('Blob not found') if defined?(Rollbar)

        return head :not_found