github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-09-08 13:09:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

🐛 Fix share-link viewers unable to load file fragments (#11484)

Browse Source
This commit is contained in:
Elena Torró 2026-09-03 12:15:35 +02:00 committed by GitHub
parent 7c762d8a98
commit 80dea409c6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 20 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
backend/src/app/rpc/commands/files.clj
View File

@ -241,6 +241,18 @@
(some-> (db/get cfg :file-data {:file-id file-id :id fragment-id :type "fragment"}) (some-> (db/get cfg :file-data {:file-id file-id :id fragment-id :type "fragment"})
(update :data blob/decode))) (update :data blob/decode)))
(defn- check-fragment-scope!
"Checks that the fragment is reachable from the pages authorized by
the share-link. Raises a :not-found exception if the fragment is not reachable."
[cfg file-id fragment-id pages]
(let [fdata (-> (bfc/get-file cfg file-id :read-only? true)
(get :data)
(update :pages-index select-keys pages))]
(when-not (contains? (feat.fdata/get-used-pointer-ids fdata) fragment-id)
(ex/raise :type :not-found
:code :object-not-found
:hint "object not found"))))
(sv/defmethod ::get-file-fragment (sv/defmethod ::get-file-fragment
"Retrieve a file fragment by its ID. Only authenticated users." "Retrieve a file fragment by its ID. Only authenticated users."
{::doc/added "1.17" {::doc/added "1.17"
@ -250,11 +262,9 @@
[cfg {:keys [::rpc/profile-id file-id fragment-id share-id]}] [cfg {:keys [::rpc/profile-id file-id fragment-id share-id]}]
(db/run! cfg (fn [cfg] (db/run! cfg (fn [cfg]
(let [perms (perms/get-file-read-permissions cfg profile-id file-id share-id)] (let [perms (perms/get-file-read-permissions cfg profile-id file-id share-id)]
(when (= :share-link (:type perms))
(ex/raise :type :not-found
:code :object-not-found
:hint "object not found"))
(check-read-permissions! perms) (check-read-permissions! perms)
(when (= :share-link (:type perms))
(check-fragment-scope! cfg file-id fragment-id (:pages perms)))
(-> (get-file-fragment cfg file-id fragment-id) (-> (get-file-fragment cfg file-id fragment-id)
(rph/with-http-cache long-cache-duration)))))) (rph/with-http-cache long-cache-duration))))))

11
frontend/src/app/main/data/viewer.cljs
View File

@ -326,11 +326,12 @@
(filter #(= page-id (:page-id %))) (filter #(= page-id (:page-id %)))
(d/index-by :id) (d/index-by :id)
(assoc state :comment-threads))) (assoc state :comment-threads)))
(on-error [{:keys [type] :as err}] (on-error [cause]
(if (or (= :authentication type) (let [{:keys [type]} (ex-data cause)]
(= :not-found type)) (if (or (= :authentication type)
(rx/empty) (= :not-found type))
(rx/throw err)))] (rx/empty)
(rx/throw cause))))]
(ptk/reify ::fetch-comment-threads (ptk/reify ::fetch-comment-threads
ptk/WatchEvent ptk/WatchEvent