Skip to content
Snippets Groups Projects

Fix upload redirections when project has moved

Merged Stan Hu requested to merge sh-disable-formats-in-uploads-routes into master
All threads resolved!

Previously if a user attempted to click on a link to an attachment for a renamed project (e.g. https://gitlab-org/gitlab-ce/uploads/123.png), Rails would redirect the user to an erroneous URL (e.g. https://gitlab-org/gitlab-foss/uploads/123.png.png). Notice the redirect URL contains a redundant extension.

It turns out Rails 5 parses the extension of a route as the format (https://github.com/rails/rails/issues/28901#issuecomment-297747521), and the URL generator appends the format to the redirected route.

To fix this, we need to disable the format path parameter and explicitly set the format to nil. If we do not set the format to nil, the URL generator will append a query string (e.g ?format=png), which would still work but not necessary.

Closes #196232 (closed)

Edited by Stan Hu

Merge request reports

Loading
Loading

Activity

Filter activity
  • Approvals
  • Assignees & reviewers
  • Comments (from bots)
  • Comments (from users)
  • Commits & branches
  • Edits
  • Labels
  • Lock status
  • Mentions
  • Merge request status
  • Tracking
  • Stan Hu added 1 commit

    added 1 commit

    • ac09ef5c - Redirect to the canonical project upload path

    Compare with previous version

  • Stan Hu resolved all threads

    resolved all threads

  • Stan Hu added 1 commit

    added 1 commit

    • ca2bc292 - Redirect to the canonical project upload path

    Compare with previous version

  • Author Owner

    I think this also affects group uploads since they can be redirected. These are the routes that have a :filename:

                                                                       GET                   /uploads/-/system/:model/:mounted_as/:id/:filename(.:format)                                                    uploads#show {:model=>/note|user|group|project/, :mounted_as=>/avatar|attachment/, :filename=>/[^\/]+/}
                                                                       GET                   /uploads/-/system/:model/:id/:secret/:filename(.:format)                                                        uploads#show {:model=>/personal_snippet|user/, :id=>/\d+/, :filename=>/[^\/]+/}
                                                                       GET                   /uploads/-/system/temp/:secret/:filename(.:format)                                                              uploads#show {:filename=>/[^\/]+/}
                                                     appearance_upload GET                   /uploads/-/system/:model/:mounted_as/:id/:filename(.:format)                                                    uploads#show {:model=>/appearance/, :mounted_as=>/logo|header_logo|favicon/, :filename=>/.+/}
                                                                       GET                   /uploads/:namespace_id/:project_id/:secret/:filename(.:format)                                                  projects/uploads#show {:namespace_id=>/[a-zA-Z.0-9_\-]+/, :project_id=>/[a-zA-Z.0-9_\-]+/, :filename=>/[^\/]+/}
                                                                       GET                   /files/note/:id/:filename(.:format)                                                                             redirect(301, uploads/note/attachment/%{id}/%{filename}) {:filename=>/[^\/]+/}
                                                    show_group_uploads GET                   /groups/*group_id/-/uploads/:secret/:filename(.:format)                                                         groups/uploads#show {:filename=>/[^\/]+/}
                                        show_namespace_project_uploads GET                   /*namespace_id/:project_id/uploads/:secret/:filename(.:format)                                                  projects/uploads#show {:project_id=>/(?!((?i-mx:\-|badges|blame|blob|builds|commits|create|create_dir|edit|environments\/folders|files|find_file|gitlab\-lfs\/objects|info\/lfs\/objects|new|preview|raw|refs|tree|update|wikis))\/)(?-mix:(?:[a-zA-Z0-9_\.][a-zA-Z0-9_\-\.]*)(?-mix:(?<!\.git|\.atom)))/, :namespace_id=>/(?-mix:(?!((?i-mx:\-|\.well\-known|404\.html|422\.html|500\.html|502\.html|503\.html|abuse_reports|admin|api|apple\-touch\-icon\-precomposed\.png|apple\-touch\-icon\.png|assets|autocomplete|ci|dashboard|deploy\.html|explore|favicon\.ico|favicon\.png|files|groups|health_check|help|import|invites|jwt|login|notification_settings|oauth|profile|projects|public|robots\.txt|s|search|sent_notifications|slash\-command\-logo\.png|snippets|unsubscribes|uploads|users|v2))\/)(?-mix:(?:[a-zA-Z0-9_\.][a-zA-Z0-9_\-\.]*[a-zA-Z0-9_\-]|[a-zA-Z0-9_])(?-mix:(?<!\.git|\.atom))))(?:\/(?!(?i-mx:\-|badges|blame|blob|builds|commits|create|create_dir|edit|environments\/folders|files|find_file|gitlab\-lfs\/objects|info\/lfs\/objects|new|preview|raw|refs|tree|update|wikis)\/)(?-mix:(?:[a-zA-Z0-9_\.][a-zA-Z0-9_\-\.]*[a-zA-Z0-9_\-]|[a-zA-Z0-9_])(?-mix:(?<!\.git|\.atom))))*/, :filename=>/[^\/]+/}
  • Stan Hu added 1 commit

    added 1 commit

    • 13ae2784 - Fix redirection of group uploads

    Compare with previous version

  • Stan Hu added 14 commits

    added 14 commits

    Compare with previous version

  • Michael Kozono
  • Michael Kozono
  • Michael Kozono approved this merge request

    approved this merge request

  • @stanhu Just a couple thoughts. Also thanks for the tests!!

    Ready for maintainer review.

  • Michael Kozono assigned to @stanhu and unassigned @mkozono

    assigned to @stanhu and unassigned @mkozono

  • mentioned in issue #196396 (closed)

  • Stan Hu added 1 commit

    added 1 commit

    • 98440121 - Deprecate legacy /uploads route

    Compare with previous version

  • Stan Hu resolved all threads

    resolved all threads

  • Stan Hu assigned to @ashmckenzie and unassigned @stanhu

    assigned to @ashmckenzie and unassigned @stanhu

  • Retrying failed CI jobs.. I also kicked off the QA tests :pray:

  • Stan Hu added 10 commits

    added 10 commits

    Compare with previous version

  • Author Owner

    I think 2 / 3 of the failures were due to #196398 (closed).

  • Ash McKenzie approved this merge request

    approved this merge request

  • LGTM, thanks @stanhu :thumbsup: thanks also @mkozono :bow:

  • merged

  • Ash McKenzie mentioned in commit 7465e2d1

    mentioned in commit 7465e2d1

  • Heinrich Lee Yu mentioned in merge request !96323 (merged)

    mentioned in merge request !96323 (merged)

  • Please register or sign in to reply
    Loading