recaptime.dev / phorge
@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.) hq.recaptime.dev/wiki/Phorge
phorge phabricator
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Use predictable filenames when downloading raw diffs from a revision

Summary:
To prevent spammers from abusing this feature on a public server, do not include query parameters in the generated filenames. See <https://github.com/mozilla-conduit/phabricator/commit/d8bb7d91b7d219902afed1ae7a8ae5e33862a842>.

Ref T15665.

Test Plan: Download raw diff from a revision and check filename in URL.

Reviewers: O1 Blessed Committers, valerio.bozzolan

Reviewed By: O1 Blessed Committers, valerio.bozzolan

Subscribers: speck, tobiaswiese, valerio.bozzolan, Matthew, Cigaryno

Maniphest Tasks: T15665

Differential Revision: https://we.phorge.it/D25478

Signed-off-by: Zero King <l2dy@icloud.com>

authored by

David Lawrence and committed by
Zero King 10a3f4fa 179f866d

+7 -14
+7 -14
src/applications/differential/controller/DifferentialRevisionViewController.php
··· 1090 1090 1091 1091 $request_uri = $this->getRequest()->getRequestURI(); 1092 1092 1093 - // this ends up being something like 1094 - // D123.diff 1095 - // or the verbose 1096 - // D123.vs123.id123.highlightjs.diff 1097 - // lame but nice to include these options 1098 - $file_name = ltrim($request_uri->getPath(), '/').'.'; 1099 - foreach ($request_uri->getQueryParamsAsPairList() as $pair) { 1100 - list($key, $value) = $pair; 1101 - if ($key == 'download') { 1102 - continue; 1103 - } 1104 - $file_name .= $key.$value.'.'; 1105 - } 1106 - $file_name .= 'diff'; 1093 + // Filename ends up being something like D123.1692295858.diff 1094 + // This discards some options in the query string that may affect the diff 1095 + // response, but is intentional to avoid spammy titles from bot requests. 1096 + $timestamp = 1097 + PhabricatorTime::getNow() + 1098 + phutil_units('24 hours in seconds'); 1099 + $file_name = ltrim($request_uri->getPath(), '/').'.'.$timestamp.'.diff'; 1107 1100 1108 1101 $iterator = new ArrayIterator(array($raw_diff)); 1109 1102