scinote-eln/scinote-web
1
1
Fork 0
mirror of https://github.com/scinote-eln/scinote-web.git synced 2025-11-13 01:41:09 +08:00
Code Issues Projects Releases Packages Wiki Activity

Fix WOPI proof verification [SCI-12096] (#8637)

Browse source
This commit is contained in:
Alex Kriuchykhin 2025-07-07 14:15:22 +02:00 • committed by GitHub
parent 35dbfa5d17
commit 62c48ccf33
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 13 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
app/models/asset.rb
View file

@ -358,6 +358,7 @@ class Asset < ApplicationRecord
end end
def put_wopi_contents(new_file) def put_wopi_contents(new_file)
new_file.rewind
if file_size.zero? && version.zero? if file_size.zero? && version.zero?
# wopi client puts initial blanc file therefore skipping version creation # wopi client puts initial blanc file therefore skipping version creation
file.attach(io: new_file, filename: file_name) file.attach(io: new_file, filename: file_name)

15
app/models/concerns/versioned_attachments.rb
View file

@ -10,19 +10,20 @@ module VersionedAttachments
define_method :"attach_#{name}_version" do |*args, **options| define_method :"attach_#{name}_version" do |*args, **options|
ActiveRecord::Base.transaction(requires_new: true) do ActiveRecord::Base.transaction(requires_new: true) do
__send__(:"previous_#{name.to_s.pluralize}").attach([__send__(name).blob.signed_id]) if __send__(name).attached? __send__(:"previous_#{name.to_s.pluralize}").attach(__send__(name).blob) if __send__(name).attached?
__send__(name).attach(*args, **options) __send__(name).attach(*args, **options)
new_blob = __send__(name).blob new_blob = __send__(name).blob
new_blob.metadata['created_by_id'] ||= last_modified_by_id metadata = new_blob.metadata
metadata['created_by_id'] ||= last_modified_by_id
# set version of current latest file if previous versions exist # set version of current latest file if previous versions exist
new_blob.save! and next unless __send__(:"previous_#{name.to_s.pluralize}").any? if __send__(:"previous_#{name.to_s.pluralize}").any?
new_version = (__send__(:"previous_#{name.to_s.pluralize}").last.blob.metadata['version'] || 1) + 1
metadata['version'] = new_version
end
new_version = new_blob.persisted? ? new_blob.update_column(:metadata, metadata) : new_blob.metadata = metadata
(__send__(:"previous_#{name.to_s.pluralize}").last.blob.metadata['version'] || 1) + 1
new_blob.metadata['version'] = new_version
new_blob.save!
end end
end end

8
app/utilities/wopi_util.rb
View file

@ -30,10 +30,10 @@ module WopiUtil
# with this discovery public key (two key possible old/new) # with this discovery public key (two key possible old/new)
def wopi_verify_proof(token, timestamp, signed_proof, signed_proof_old, url) def wopi_verify_proof(token, timestamp, signed_proof, signed_proof_old, url)
discovery = current_wopi_discovery discovery = current_wopi_discovery
token_length = [token.length].pack('>N').bytes token_length = [token.length].pack('N').bytes
timestamp_bytes = [timestamp.to_i].pack('>Q').bytes.reverse timestamp_bytes = [timestamp.to_i].pack('Q').bytes.reverse
timestamp_length = [timestamp_bytes.length].pack('>N').bytes timestamp_length = [timestamp_bytes.length].pack('N').bytes
url_length = [url.length].pack('>N').bytes url_length = [url.length].pack('N').bytes
expected_proof = token_length + token.bytes + expected_proof = token_length + token.bytes +
url_length + url.upcase.bytes + url_length + url.upcase.bytes +

14
config/initializers/active_storage.rb
View file

@ -3,7 +3,6 @@
require 'active_storage/previewer/libreoffice_previewer' require 'active_storage/previewer/libreoffice_previewer'
require 'active_storage/analyzer/image_analyzer/custom_image_magick' require 'active_storage/analyzer/image_analyzer/custom_image_magick'
require 'active_storage/analyzer/text_extraction_analyzer' require 'active_storage/analyzer/text_extraction_analyzer'
require 'active_storage/downloader'
# Enable PDF previews for files # Enable PDF previews for files
Rails.application.config.x.enable_pdf_previews = ENV['ACTIVESTORAGE_ENABLE_PDF_PREVIEWS'] == 'true' Rails.application.config.x.enable_pdf_previews = ENV['ACTIVESTORAGE_ENABLE_PDF_PREVIEWS'] == 'true'
@ -18,16 +17,3 @@ Rails.application.config.active_storage.variable_content_types << 'image/svg+xml
Rails.application.config.active_storage.variant_processor = :vips if ENV['ACTIVESTORAGE_ENABLE_VIPS'] == 'true' Rails.application.config.active_storage.variant_processor = :vips if ENV['ACTIVESTORAGE_ENABLE_VIPS'] == 'true'
ActiveStorage::Downloader.class_eval do
def open(key, checksum: nil, verify: true, name: 'ActiveStorage-', tmpdir: nil)
open_tempfile(name, tmpdir) do |file|
download key, file
if checksum == 'dummy' || checksum.nil?
ActiveStorage::Blob.find_by(key: key).update(checksum: Digest::MD5.file(file).base64digest)
else
verify_integrity_of(file, checksum: checksum) if verify
end
yield file
end
end
end