5apps/liquor-cabinet
5apps/liquor-cabinet
4
0
Fork 0
Code Issues 1 Pull Requests Packages Releases Activity

Don't allow PUTS with Content-Range header

Browse Source
This commit is contained in:
Garret Alfert 2016-03-04 19:33:00 +01:00
parent fd3293025d
commit 43ff83d26b
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
lib/remote_storage/swift.rb
View File

@ -130,6 +130,7 @@ module RemoteStorage
end end
def put_data(user, directory, key, data, content_type) def put_data(user, directory, key, data, content_type)
server.halt 400 if server.env["HTTP_CONTENT_RANGE"]
server.halt 409 if has_name_collision?(user, directory, key) server.halt 409 if has_name_collision?(user, directory, key)
existing_metadata = redis.hgetall "rs:m:#{user}:#{directory}/#{key}" existing_metadata = redis.hgetall "rs:m:#{user}:#{directory}/#{key}"

8
spec/swift/app_spec.rb
View File

@ -129,6 +129,14 @@ describe "App" do
metadata = redis.hgetall "rs:m:phil:food/aguacate/empanado" metadata = redis.hgetall "rs:m:phil:food/aguacate/empanado"
metadata.must_be_empty metadata.must_be_empty
end end
it "returns 400 when a Content-Range header is sent" do
header "Content-Range", "bytes 0-3/3"
put "/phil/food/aguacate", "si"
last_response.status.must_equal 400
end
end end
end end
end end