Check attachment name when downloading attachments

2026-04-06 06:16:27 -07:00
parent 269e5ad424
commit 1eb0469bd0
1 changed files with 5 additions and 0 deletions
--- a/app/Http/Controllers/OpenController.php
+++ b/app/Http/Controllers/OpenController.php
@@ -171,6 +171,11 @@ class OpenController extends Controller
                ->firstOrFail();
        }

+        // Check attachment name.
+        if (trim($attachment->file_name) != trim($file_name)) {
+            return \Helper::denyAccess();
+        }
+
        // Only allow download if the attachment is public or if the token matches the hash of the contents
        if ($token != $attachment->getToken() && $attachment->token_type != Attachment::TOKEN_TYPE_LEGACY) {
            return \Helper::denyAccess();