fix crsf issue when using download controller and having found a way …

…to store files outside of public
FriendsOfFlarum · Mar 29, 2021 · f0ba29e · f0ba29e
1 parent 04c19a3
commit f0ba29e
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 5 deletions.
diff --git a/extend.php b/extend.php
@@ -26,6 +26,8 @@
         ->get('/fof/download/{uuid}/{post}/{csrf}', 'fof-upload.download', Api\Controllers\DownloadController::class)
         ->patch('/fof/upload/hide', 'fof-upload.hide', Api\Controllers\HideUploadFromMediaManagerController::class),
 
+    (new Extend\Csrf)->exemptRoute('fof-upload.download'),
+
     (new Extend\Frontend('admin'))
         ->css(__DIR__.'/resources/less/admin.less')
         ->js(__DIR__.'/js/dist/admin.js'),

diff --git a/src/Api/Controllers/DownloadController.php b/src/Api/Controllers/DownloadController.php
@@ -48,11 +48,6 @@ public function __construct(Dispatcher $bus, PostRepository $posts, SettingsRepo
         $this->settings = $settings;
     }
 
-    /**
-     * @param \Psr\Http\Message\ServerRequestInterface $request
-     *
-     * @return \Psr\Http\Message\ResponseInterface
-     */
     public function handle(ServerRequestInterface $request): ResponseInterface
     {
         $actor = $request->getAttribute('actor');