Commit 76563fb1 authored by Stephen Mustgrave's avatar Stephen Mustgrave
Browse files

Security fix for binary cache

parent 1bae8740

src/Controller/DisplayController.php

+6 −7
Changes for src/Controller/DisplayController.php: 6 added lines, 7 removed lines.
Original line number Diff line number Diff line
@@ -188,14 +188,13 @@ class DisplayController extends EntityRevisionViewController { 
      return $this->updateRenderCache(parent::__invoke($media, $view_mode), $config);

    }



    $response = new CacheableBinaryFileResponse($uri, Response::HTTP_OK, [], FALSE);

    $additional_public_schemes = array_diff(Settings::get('file_additional_public_schemes', []), [

      'private',

      'temporary',

    ]);

    in_array($scheme, $additional_public_schemes, TRUE) ? $response->setPublic() : $response->setPrivate();



    $additional_public_schemes = array_diff(

      Settings::get('file_additional_public_schemes', []),

      ['private', 'temporary'],

    );

    $is_public = $scheme === 'public' || in_array($scheme, $additional_public_schemes, TRUE);

    $response = new CacheableBinaryFileResponse($uri, Response::HTTP_OK, [], $scheme !== 'private');

    $is_public ? $response->setPublic() : $response->setPrivate();

    $response->addCacheableDependency($media);

    $response->addCacheableDependency($file);

    $response->addCacheableDependency($config);