Möglicher Verzeichnis-Traversal: /uploads/* erlaubt dateiübergreifenden Dateizugriff

[Moin]

Vielleicht interessiert Sie die Funktion secure-uploads.

Secure Uploads

Added in the Discourse 2.4 release in February is the Secure Uploads feature, which provides a higher degree of security for ALL uploads (images, video, audio, text, pdfs, zips, and others) within a Discourse instance. Prerequisites You must have S3 uploads enabled on your site, which needs the following settings to be filled: S3 access key id S3 secret access key S3 region S3 upload bucket You also must be using an S3 bucket that does not have a Public bucket policy, and you need to make su…