check signed blob data purpose

2024-02-24 13:04:14 +02:00
parent 4ad58fc285
commit c81b4d855b
1 changed files with 2 additions and 2 deletions
@@ -10,9 +10,9 @@ module Api
    before_action :set_cors_headers

    def show
-      blob_uuid, = ApplicationRecord.signed_id_verifier.verified(params[:signed_uuid])
+      blob_uuid, purp = ApplicationRecord.signed_id_verifier.verified(params[:signed_uuid])

-      if blob_uuid.blank?
+      if blob_uuid.blank? || purp != 'blob'
        Rollbar.error('Blob not found') if defined?(Rollbar)

        return head :not_found