js 첨부 파일을 다운로드할 수 없습니다

기여 버그
1

I am getting exactly the same error as this question i.e I can upload js files after allowing it in the settings but when I try to download it, the url in the browser changes to the js file url and " The change you wanted was rejected." is displayed.

Environment:-
Discourse docker running behind Nginx (nginx is using SSL)

Discourse container logs:-

    Started GET "p5ePkm5OoKveknnMjyArlS4PPwS.js" for 192.168.32.1 at 2021-02-22 05:48:52 +0000
    Processing by UploadsController#show_short as JS
      Parameters: {"base62"=>"p5ePkm5OoKveknnMjyArlS4PPwS", "extension"=>"js"}
    Sent file afcdf626f9db8d54a1fb5e8ebcab0ea214d9226a.js (2.2ms)
    Security warning: an embedded <script> tag on another site requested protected JavaScript. If you know what you're doing, go ahead and disable forgery protection on this action to permit cross-origin JavaScript embedding.
    Completed 422 Unprocessable Entity in 59ms (ActiveRecord: 0.0ms | Allocations: 17414)
    ActionController::InvalidCrossOriginRequest (Security warning: an embedded <script> tag on another site requested protected JavaScript. If you know what you're doing, go ahead and disable forgery protection on this action to permit cross-origin JavaScript embedding.)
    /opt/bitnami/discourse/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_controller/metal/request_forgery_protection.rb:266:in `verify_same_origin_request'

Nginx logs:-

    10.164.0.103 - - [22/Feb/2021:05:51:11 +0000] "GET /uploads/short-url/p5ePkm5OoKveknnMjyArlS4PPwS.js HTTP/2.0" 422 781 "getting-started-with-sftp-module/292" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36"
``

Any help or pointers is appreciated!
2개의 좋아요
2

Are you allowing *.js files to be attached to posts by users? Do you have legitimate need for javascript file attachments by your users? Just want to absolutely confirm before we proceed any further.

1개의 좋아요
3

Thank you for quick response!
Yes, it is a coding Q/A discussion, so attaching *.js code files is a legitimate use case.

2개의 좋아요
4

Hi All! I’m having the same issue. We’ve allowed .js extension to be uploaded, but no one can download it. Haven’t found yet any setting to fix this. Anyone can help?

1개의 좋아요
5

Can you describe the use case? Why is this necessary?

6

Hi Jeff

Although, now we copy and paste the code in the text section of the post.
Use case: We have a .js file with a kickstarter code or a solution to a recurring problem and we want to share it as an attachment, so that users can download and start using it in their projects.

However, if we change the file extension from .js to .txt, it again shows “The change you wanted was rejected.” (This may be due to some storage optimization on the backend, that if the file has the same content as a previous file, then the new attachment points to the previously uploaded file)
So, I changed the (.txt) extention js file’s content a little bit and uploaded again, and I was able to download the file as attachment.

@codinghorror Is there a security risk in allowing to download .js files?

1개의 좋아요
7

Yes; we’d need to do some browser research to make sure the file is always downloaded to disk and never executed.

1개의 좋아요
8

We have a developers forum at fluiggers.com.br, take a look…and we do often share .js files.

1개의 좋아요
9

Sure, there’s a lot of security issues around allowing js files, so it’s something that we have to take extreme care with.

10

The Content-Disposition header will prevent execution of downloaded JS files and we are setting it correctly:

attachment; filename="test.js"; filename*=UTF-8''test.js

It works for uploads on S3 and it should work with local uploads as well, but there seems to be a new(ish) security measure from Rails:

ActionController::InvalidCrossOriginRequest (Security warning: an embedded tag on another site requested protected JavaScript. If you know what you’re doing, go ahead and disable forgery protection on this action to permit cross-origin JavaScript embedding.)

Should be fixable…

3개의 좋아요
11

I stumbled upon this same issue, we have a coding Q/A forum and need to be able to share big js files for download

12

I have the same issue in my community. People would like to share JS files but when trying to download them, they get this error:

A rectangular box with a red border displays an error message stating that a change was rejected, possibly due to insufficient access. (Captioned by AI)
A rectangular box with a red border displays an error message stating that a change was rejected, possibly due to insufficient access. (Captioned by AI)579×149 2.71 KB

Excerpt from the rails production log:

Started GET "/uploads/short-url/qDlrltMxEIJ2aYYdt8lZ200E3wA.js" for 94.31.111.247 at 2025-07-09 05:53:30 +0000
Processing by UploadsController#show_short as JS
  Parameters: {"base62"=>"qDlrltMxEIJ2aYYdt8lZ200E3wA", "extension"=>"js"}
Sent file /var/www/discourse/public/uploads/default/original/1X/baab1fc131be960b601467333f5a690b257daeb0.js (0.3ms)
Security warning: an embedded <script> tag on another site requested protected JavaScript. If you know what you're doing, go ahead and disable forgery protection on this action to permit cross-origin JavaScript embedding.
Completed 422 Unprocessable Entity in 17ms (ActiveRecord: 0.0ms (0 queries, 0 cached) | GC: 0.0ms)

js files are in the list of allowed upload extensions:

A computer screen displays a user interface for managing authorized file extensions, listing common image, video, and document formats with options to add or remove them. (Captioned by AI)
A computer screen displays a user interface for managing authorized file extensions, listing common image, video, and document formats with options to add or remove them. (Captioned by AI)830×184 7.23 KB

13

저희도 같은 문제가 있습니다. 저희 소프트웨어에서 실행되는 js 파일들이 있는데, 브라우저에서 어떤 동작을 할 수 있는 파일들은 아닙니다.

모든 업로드 파일을 S3 버킷으로 이동하고 s3_use_cdn_url_for_all_uploads를 true로 설정함으로써 Discourse 다운로드 문제를 해결했습니다. 이는 js 파일의 치명적인 장애 요인으로 보이는 short-url 컨트롤러를 우회하는 효과가 있습니다.

상세 내용(AI가 안내해 준 내용을 바탕으로 정리):n

  1. S3 호환 스토리지 설정 (예: Cloudflare R2)

Discourse는 로컬 디스크에서 .js 파일을 안전하게 서빙할 수 없습니다. 파일을 버킷으로 이동해야 합니다.

  • 버킷: 비공개 버킷(예: my-discourse-bucket)을 생성합니다.

  • API 키: 액세스 키(Access Key)와 시크릿 키(Secret Key)를 생성합니다.

2. 커스텀 CDN 도메인 구성

Cloudflare(또는 해당 프로바이더)에서 버킷에 커스텀 도메인(예: cdn.example.com)을 연결합니다. 이를 통해 파일이 직접적인 URL을 통해 정적 자산으로 서빙되어 Discourse의 '보안 가드’를 우회하게 됩니다.

3. Discourse 설정 업데이트

관리자 → 설정에서 S3 세부 정보를 구성합니다. 중요하게는, 임시 헤더로 인해 깨질 수 있는 URL에 '서명’을 시도하지 않도록 하기 위해 다음 항목을 활성화해야 합니다:

  • s3_use_cdn_url_for_all_uploads: 이 상자를 선택하세요 (가장 중요한 단계입니다).

  • s3_cdn_url: https://cdn.example.com으로 설정합니다.

  • s3_region: R2 호환성을 위해 us-east-1을 사용합니다.

4. 기존 업로드 마이그레이션 (선택 사항)

참고: 저희는 알 수 없는 이유로 이 단계가 작동하지 않았습니다.

기존 게시물에 있는 오래된 링크를 수정하려면 컨테이너에 진입하여 다음을 실행하세요:

Bash

# /var/discourse 내부에서
./launcher enter app
rake uploads:migrate_to_s3
rake posts:rebake

이 정보가 누군가에게 도움이 되길 바랍니다.