提交: f51dc21e52c9db7f46fd39dbb1b59867f1c6730f - allura (git)

allura

Commit MetaInfo

• 修訂: f51dc21e52c9db7f46fd39dbb1b59867f1c6730f (tree)
• 時間: 2012-05-15 00:09:13
• 作者: Cory Johns <johnsca@geek...>
• Commiter: Yaroslav Luzin

Log Message

[#4193] Changed attachments to always download to fix security hole

Signed-off-by: Cory Johns <[e-mail]>

Change Summary

• modified: Allura/allura/controllers/attachments.py

差異

--- a/Allura/allura/controllers/attachments.py
+++ b/Allura/allura/controllers/attachments.py
@@ -53,7 +53,7 @@ class AttachmentController(BaseController):
         return attachment
         
     @expose()
-    def index(self, delete=False, embed=True, **kw):
+    def index(self, delete=False, **kw):
         if request.method == 'POST':
             require_access(self.artifact, self.edit_perm)
             if delete:
@@ -64,7 +64,7 @@ class AttachmentController(BaseController):
                 except exc.HTTPNotFound:
                     pass
             redirect(request.referer)
-        return self.attachment.serve(embed)
+        return self.attachment.serve(False)
 
     @expose()
     def thumb(self, embed=True):