Sony MathewandGitHub
661608c0b1
This routes external downloads used by avatar sync through SafeFetch. It closes the SSRF exposure from raw Down.download paths, preserves provider-specific auth and header flows, and adds regression coverage for blocked internal URLs plus authenticated downloads. Fixes # (issue): [CW-6931](https://linear.app/chatwoot/issue/CW-6931/avatarwidget-url-ssrf-downdownload-unprotected-unauth)
38 lines
1.1 KiB
Ruby
38 lines
1.1 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
module Avatarable
|
|
extend ActiveSupport::Concern
|
|
include Rails.application.routes.url_helpers
|
|
|
|
ALLOWED_AVATAR_CONTENT_TYPES = %w[image/jpeg image/png image/gif image/webp].freeze
|
|
|
|
included do
|
|
has_one_attached :avatar
|
|
validate :acceptable_avatar, if: -> { avatar.changed? }
|
|
after_save :fetch_avatar_from_gravatar
|
|
end
|
|
|
|
def avatar_url
|
|
return url_for(avatar.representation(resize_to_fill: [250, nil])) if avatar.attached? && avatar.representable?
|
|
|
|
''
|
|
end
|
|
|
|
def fetch_avatar_from_gravatar
|
|
return unless saved_changes.key?(:email)
|
|
return if email.blank?
|
|
|
|
# Incase avatar_url is supplied, we don't want to fetch avatar from gravatar
|
|
# So we will wait for it to be processed
|
|
Avatar::AvatarFromGravatarJob.set(wait: 30.seconds).perform_later(self, email)
|
|
end
|
|
|
|
def acceptable_avatar
|
|
return unless avatar.attached?
|
|
|
|
errors.add(:avatar, 'is too big') if avatar.byte_size > 15.megabytes
|
|
|
|
errors.add(:avatar, 'filetype not supported') unless ALLOWED_AVATAR_CONTENT_TYPES.include?(avatar.content_type)
|
|
end
|
|
end
|