tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Do not let caches keep queued or hidden images.

Browse Source
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent 3df88e0b4c
commit fe30a0aaa1
3 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
display.php
+6 -1
View File
@@ -59,7 +59,8 @@ function display_img($id) {
$hidden = $is_admin ? "" : " AND hidden IS NOT TRUE";
}
$query = "SELECT img, mime FROM $table WHERE 1 AND ID = ?".$hidden." LIMIT 0, 1";
$columns = $queue ? "img, mime" : "img, mime, hidden";
$query = "SELECT $columns FROM $table WHERE 1 AND ID = ?".$hidden." LIMIT 0, 1";
$result = $db->execute_query($query, array((int)$id)) or db_fail();
$row = $result->fetch_assoc();
@@ -78,6 +79,10 @@ function display_img($id) {
header("Content-type: ".$info['mime']);
header("Content-length: ".strlen($img_data));
header("X-Content-Type-Options: nosniff");
// Only this session can see a queued or hidden image: no cache may keep it
if ($queue || !empty($row['hidden'])) {
header("Cache-Control: private, no-store");
}
print $img_data;
} else {
tests/php/Pages/FeedAndImageTest.php
+7
View File
@@ -84,6 +84,13 @@ class FeedAndImageTest extends PageTestCase {
$this->assertSame(200, $this->get('/display?id=9&queue=1')['status']);
}
public function testRestrictedImagesAreNotCached(): void {
$this->assertNull($this->header($this->get('/display?id=2'), 'Cache-Control'));
$this->loginAs();
$this->assertSame('private, no-store', $this->header($this->get('/display?id=3'), 'Cache-Control'));
$this->assertSame('private, no-store', $this->header($this->get('/display?id=9&queue=1'), 'Cache-Control'));
}
public function testThePendingUploadIsShownToItsSession(): void {
$name = bin2hex(random_bytes(16));
mkdir(self::$state . '/tmp/uploads', 0700);
tests/php/Support/SiteData.php
+3 -2
View File
@@ -30,9 +30,10 @@ class SiteData {
$dates = array_column(self::$tables['xxx'], 'date');
return array(array('MAX(`date`)' => $dates ? max($dates) : NULL));
});
FakeDb::on("/^SELECT img, mime FROM $stories\\b/i", function ($sql, $params) {
FakeDb::on("/^SELECT img, mime(, hidden)? FROM $stories\\b/i", function ($sql, $params) {
$rows = self::filterStories($sql, $params);
return array_map(function ($row) { return array('img' => $row['img'], 'mime' => $row['mime']); }, array_slice($rows, 0, 1));
$columns = str_starts_with($sql, 'SELECT img, mime, hidden') ? array('img', 'mime', 'hidden') : array('img', 'mime');
return array_map(function ($row) use ($columns) { return array_intersect_key($row, array_flip($columns)); }, array_slice($rows, 0, 1));
});
FakeDb::on("/^INSERT INTO $stories SET /", array(self::class, 'insertStory'));
FakeDb::on("/^UPDATE $stories SET /", array(self::class, 'updateStory'));