Fix a possible security issue with spoofing#2

Open

psergus wants to merge 1050 commits intov.2.7.0from

This pull request is big! We're only showing the most recent 250 commits

Commits on Oct 3, 2015

update README.me: add missing 'end'
kesha-antonov
committed

Commits on Oct 9, 2015

Merge pull request #2019 from kesha-antonov/master
tute
committed
Output shorter but still useful error message

ajh
authored and
tute
committed

Commits on Oct 21, 2015

Commits on Oct 22, 2015

Commits on Oct 23, 2015

Original file could be unlinked in post_process_style

tiegz
authored and
tute
committed

Commits on Nov 10, 2015

Fix typo: erroneous apostrophe in possessive pronoun.
airblade
committed

Commits on Nov 12, 2015

Fix typo [fixes #2043]

alxgsv
authored and
tute
committed

Commits on Nov 15, 2015

Commits on Nov 16, 2015

Commits on Nov 17, 2015

Commits on Nov 18, 2015

Merge pull request #2056 from dgynn/pr_interpolations_tuning_v4.3
tute
committed

Commits on Nov 20, 2015

Merge pull request #2059 from thiagogabriel/patch-1
Jon Yurek
committed

Commits on Nov 21, 2015

Fix condition to include Schema, using 'ActiveRecord::Base' instead of 'ActiveRecord' solo
tonidas
committed

Commits on Nov 22, 2015

Revert "Update README with version requirement for aws-sdk"
tute
committed

Commits on Nov 25, 2015

upgrading aws-sdk to v2 requires changing 'public_read' to 'public-read'

betesh
authored and
tute
committed

Commits on Dec 23, 2015

Merge pull request #2075 from thoughtbot/tc-remove-aws-v1
tute
committed

Commits on Jan 2, 2016

Commits on Jan 4, 2016

Relax mimemagic version constraint to ~> 0.3.0
jaredbeck
committed

Commits on Jan 13, 2016

Commits on Jan 14, 2016

Merge pull request #2061 from halostatue/allow-mime-types-3
maclover7
committed

Commits on Jan 15, 2016

Skip calculating fingerprint when it is not used
mattbrictson
committed

Commits on Jan 16, 2016

Merge pull request #2091 from mattbrictson/lazy-fingerprint
maclover7
committed

Commits on Jan 26, 2016

Commits on Feb 26, 2016

Drop support for Ruby 2.0 as it's EOLd
tute
committed

Commits on Mar 12, 2016

Link v4.3 release notes to that branch
tute
committed

Commits on Mar 23, 2016

Commits on Mar 24, 2016

Commits on Mar 30, 2016

Commits on Apr 4, 2016

Add link to screencast for upgrading from v4 to 5

melissawahnish
authored and
tute
committed

Commits on Apr 12, 2016

De-duplicates cocaine command line path per run

christophed
authored and
tute
committed
Release version 5.0.0.beta2
tute
committed

Commits on Apr 28, 2016

Bugfix for when file is not present on cloud

vimutter
authored and
tute
committed
Present the NEWS file in our CONTRIBUTING document
tute
committed

Commits on Apr 29, 2016

Commits on Apr 30, 2016

Commits on May 5, 2016

Clarify semantics of the only_process option (documentation-only)
cfinucane
committed

Commits on May 6, 2016

Merge pull request #2194 from cfinucane/patch-1
tute
committed

Commits on May 9, 2016

Improve deployment instructions

wynksaiddestroy
authored and
tute
committed
Saving images from url with special characters #1921

Piioo
authored and
tute
committed

Commits on May 18, 2016

Add changelog entry for 5c96b4c and a test for desired logging behaviour to prevent regressions.
bdewater
committed

Commits on Jun 10, 2016

Merge pull request #2131 from bdewater/add_log_test
tute
authored

Commits on Jun 14, 2016

replaced 3 if-not-blank checks with if-present checks (#2230)

humzashah
authored and
tute
committed
Use Paperclip namespace as Capistrano task (#2227)

Victor Ng KP
authored and
tute
committed
Update deployment sequence to paperclip namespace (#2231)

Victor Ng KP
authored and
tute
committed

Commits on Jun 16, 2016

Add read_timeout option to UriAdapter download_content method (#2232)

droptheplot
authored and
tute
committed

Commits on Jul 1, 2016

Test against Rails 5 final (#2238)

bdewater
authored and
tute
committed
Release v5.0.0
tute
committed
Merge pull request #2239 from thoughtbot/tc-rel-v5
tute
authored

Commits on Jul 8, 2016

Update accepted server_side_encryption value (#2243)

nickrivadeneira
authored and
tute
committed

Commits on Jul 9, 2016

Added link for paperclip-azure gem for using paperclip with Azure (#2242) (#2246)

preetpalS
authored and
tute
committed

Commits on Jul 23, 2016

Update README preserve_files to be a boolean (#2262)

unixmonkey
authored and
tute
committed
The uri io adapter should use the content-disposition filename (#2250)

netmask
authored and
tute
committed

Commits on Aug 3, 2016

Support for readbyte in Paperclip attachments; better documentation of custom processors.
creature
committed

Commits on Aug 16, 2016

There is no need to pass options argument to UrlGenerator (#2273)

poporul
authored and
tute
committed

Commits on Aug 17, 2016

Don't allow trailing newlines in various checks. (#2266)

benpickles
authored and
tute
committed

Commits on Aug 19, 2016

Updated documentation (#2279)

codyrobbins
authored and
tute
committed
Don't write original file if it wasn't reprocessed

sashazykov
authored and
tute
committed
Update NEWS file [ci skip]
tute
committed
Default S3 protocol to empty string
tute
committed
Add note on file? vs exists? in the README
tute
committed
Fix CI
tute
committed
Default to Paperclip::ContentTypeDetector (#2270)

ivanoblomov
authored and
tute
committed
Release v5.1.0
tute
committed
README and NEWS update
tute
committed

Commits on Aug 23, 2016

Add Code Climate Config (#2275)

pbrisbin
authored and
tute
committed
Allow user to specify frame_index for videos or PDFs

jacobbullock
authored and
tute
committed
Add note on using S3's url option

andyatkinson
authored and
tute
committed

Commits on Aug 24, 2016

Ignore invalid Content-Disposition header (#2284)

Anton Smirnov
authored and
tute
committed
Make fingerprint digest configurable (#2229)

bdewater
authored and
tute
committed
S3 specs fixes

betesh
authored and
tute
committed

Commits on Aug 28, 2016

Commits on Aug 30, 2016

Fix CI: use aws-sdk ~> 2.3.0
tute
committed
Support s3 host alias with prefixes

cjcaj
authored and
tute
committed

Commits on Sep 5, 2016

fix broken anchor (#2297)

jbmeerkat
authored and
tute
committed

Commits on Sep 12, 2016

Add support for proc arg for fog_public (#2302)

johnnyshields
authored and
tute
committed

Commits on Sep 13, 2016

Update docs to mention ImageMagick resource limits (#2305)

bladealslayer
authored and
tute
committed

Commits on Sep 28, 2016

Update docs for s3_permissions (#2310)

HormyAJP
authored and
tute
committed

Commits on Oct 14, 2016

Fix typo in README (#2323)

sdogruyol
authored and
tute
committed

Commits on Nov 3, 2016

Commits on Nov 11, 2016

Remove old Tempfile tests from Thumbnail spec
Jake Faris
committed

Commits on Nov 14, 2016

Move Tempfile tests to tempfile_spec.rb
Jake Faris
committed
(hound) Use double quotes
Jake Faris
committed
Remove Tempfile tests from Thumbnail spec (#2338)
tute
authored

Commits on Nov 29, 2016

Fix JRuby binary operator warning
Jánvári Bálint József
committed

Commits on Dec 2, 2016

Merge branch 'master' of https://github.com/thoughtbot/paperclip
Jánvári Bálint József
committed
Fix JRuby binary operator warning (#2352)
tute
authored
Updated the capitalization in the titles

elliefichtelman
authored and
tute
committed

Commits on Jan 15, 2017

Use consistent code style in README examples
johnnymugs
authored

Commits on Mar 10, 2017

Update thoughtbot logo
tysongach
authored

Commits on Mar 23, 2017

Fix Homebrew hyperlink
Willibaur
authored

Commits on Apr 20, 2017

Update README.md
brchristian
authored

Commits on Jun 29, 2017

Update copyright in README
geoffharcourt
authored

Commits on Sep 27, 2017

Fix build by adding missing package in new distro, added more Ruby versions to test
morgoth
committed

Commits on Sep 28, 2017

Bring back old bundler version to fix CI
morgoth
committed

Commits on Oct 18, 2017

removed extra space char from UPGRADING

gfranco93
authored and
geoffharcourt
committed
Fixed a build by freezeing cucumber-expressions gem to a known working version.

morgoth
authored and
geoffharcourt
committed

Commits on Oct 25, 2017

Remove bad exception handling!

gaurish
authored and
geoffharcourt
committed
Be more explicit

gaurish
authored and
geoffharcourt
committed

Commits on Oct 26, 2017

Rename FactoryGirl to FactoryBot
itsdawnbois
authored

Commits on Jan 23, 2018

Remove the automatic loading of URI Adapters

Jon Yurek
authored and
mike-burns
committed
Prepare release 5.2.0
mike-burns
committed

Commits on Jan 24, 2018

Add Errno::EEXIST as possible exception that happens on linking
hron
committed

Commits on Jan 25, 2018

Bump to 5.2.1
mike-burns
committed

Commits on Jan 30, 2018

Updated the Readme (#2417)

CorinneKelly
authored and
sidraval
committed
Ruby 2.4 compatibility (don't use Fixnum anymore) (#2401)

ledermann
authored and
sidraval
committed
Add migration_version variable to migration generator for rails 5 compatibility (#2470)

jackellenberger
authored and
sidraval
committed
Updated Post Processing Documentation to mention convert_options and source_file_options (#2381)

wassona
authored and
sidraval
committed
Docs: Provide example for s3_host_name (#2379)

dijonkitchen
authored and
sidraval
committed
fix missing dependency when running require paperclip in irb (#2369)

istana
authored and
sidraval
committed
Update the README Installation section (#2536)

febeling
authored and
sidraval
committed
MIME type detection of Paperclip::MediaTypeSpoofDetector doesn't work with old versions of file.

Clemens Fuchslocher
authored and
sidraval
committed

Commits on Mar 2, 2018

Also open destination file in symlink failure case

kevgrig
authored and
sidraval
committed
Also close @destination like the normal path

kevgrig
authored and
sidraval
committed
fix fallback when symlink in AbstractAdapter#link_or_copy_file fails

mraidel
authored and
sidraval
committed
Update spec, since implementation now calls `@destination.close`

Sid Raval
authored and
sidraval
committed

Commits on Mar 9, 2018

Rewind file in Storage::Fog if bucket does not exist

natesholland
authored and
sidraval
committed
Replace cocaine to terrapin

ykzts
authored and
sidraval
committed
Bump to 5.3.0
Sid Raval
committed
aws-sdk-s3 instead of aws-sdk (#2481)

morgoth
authored and
sidraval
committed
6.0.0
Sid Raval
committed
A migration guide from Paperclip to ActiveStorage
mike-burns
committed
Updates from review
mike-burns
committed
Remove stray newline
mike-burns
committed

Commits on Mar 18, 2018

Use v6.0.0 in installation section

vfonic
authored and
sidraval
committed

Commits on May 2, 2018

Create issue template explaining deprecation
sidraval
authored

Commits on May 4, 2018

Fix newlines in issue_template.md [ci skip]
sidraval
authored

Commits on May 7, 2018

Test coverage for filenames with multiple periods

ivanoblomov
authored and
sidraval
committed
Include Cocaine error when there was an error processing thumbnails (#2415)

ball-hayden
authored and
sidraval
committed
Update UPGRADING (#2579)

yskkin
authored and
sidraval
committed
Handle already encoded URLs

ivanoblomov
authored and
sidraval
committed
Remove duplicate content_type in README [ci skip]

dwaite498
authored and
sidraval
committed
Fix method syntax in logger [ci skip]

abhikanojia
authored and
sidraval
committed

Commits on May 8, 2018

Fix markdown typo (#2580) [ci skip]

VikiAnn
authored and
sidraval
committed
Test coverage for preserving params in file URLs

ivanoblomov
authored and
sidraval
committed
Reopen file even when copying instead of linking (#2545)

akihikodaki
authored and
sidraval
committed

Commits on May 14, 2018

Add deprecation notice to README (#2599)

mike-burns
authored and
Derek Prior
committed

Commits on May 18, 2018

Fix bug in migration instructions on MariaDB

banjerluke
authored and
mike-burns
committed
Add Spanish translation to MIGRATING

Horacio Chávez
authored and
mike-burns
committed
Link to the Spanish migration guide
mike-burns
committed
Instructions for migrating assets on a remote host

kylekeesling
authored and
mike-burns
committed
Add ID_PARTITION_LIMIT with id above 999_999_999

spk
authored and
mike-burns
committed
Remove magic comment

hash52
authored and
mike-burns
committed
Ignore empty filename from content-disposition

Hasan Kumar
authored and
mike-burns
committed
Better handling of the content-disposition header

Whyves
authored and
mike-burns
committed

Commits on May 25, 2018

Skip validity check when reprocess attachment

Amanda Munoz and Prem Sichanugrist
authored and
mike-burns
committed
Update geometry_detector_factory.rb

aboutqx
authored and
mike-burns
committed
Update processor.rb

aboutqx
authored and
mike-burns
committed
Update geometry_detector_factory.rb

aboutqx
authored and
mike-burns
committed
Update processor.rb

aboutqx
authored and
mike-burns
committed
Update geometry_detector_factory.rb

aboutqx
authored and
mike-burns
committed
Update processor.rb

aboutqx
authored and
mike-burns
committed
Update geometry_detector_factory.rb

aboutqx
authored and
mike-burns
committed
Update geometry_detector_factory.rb

aboutqx
authored and
mike-burns
committed
Update processor.rb

aboutqx
authored and
mike-burns
committed
Update processor.rb

aboutqx
authored and
mike-burns
committed
Update processor.rb

aboutqx
authored and
mike-burns
committed
Update processor.rb

aboutqx
authored and
mike-burns
committed
add is_windows to option

aboutqx
authored and
mike-burns
committed
Check for spoofing of files without an extension

George Walters II
authored and
mike-burns
committed
Rely on URI content_type only when provided.

j15e
authored and
mike-burns
committed

Commits on Jun 12, 2018

Fix a possible security issue with spoofing
Sergey Petrenko
committed

Commits on Jun 5, 2024