Andreas/wekan
1
0
Fork 0
mirror of https://github.com/wekan/wekan.git synced 2026-03-10 07:32:35 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Fix GHSL-2026-045_Wekan.

Browse source 
Thanks to GHSL and xet7 !
This commit is contained in:
Lauri Ojansivu 2026-02-19 23:47:56 +02:00
parent 73eb98c57a
commit 62216e36c1
3 changed files with 191 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
models/trelloCreator.js
View file

@ -22,6 +22,7 @@ import {
calendar
} from '/imports/lib/dateUtils';
import getSlug from 'limax';
import { validateAttachmentUrl } from './lib/attachmentUrlValidation';
const DateString = Match.Where(function(dateAsString) {
check(dateAsString, String);
@ -471,6 +472,17 @@ export class TrelloCreator {
}
};
if (att.url) {
const validation = validateAttachmentUrl(att.url);
if (!validation.valid) {
if (process.env.DEBUG === 'true') {
console.warn(
'Blocked attachment URL during Trello import:',
validation.reason,
att.url,
);
}
return;
}
Attachments.load(att.url, opts, cb, true);
} else if (att.file) {
Attachments.insert(att.file, opts, cb, true);