@ -73,6 +73,10 @@ if UploadFS?
uid = cookie.get('rc_uid', rawCookies) if rawCookies?
token = cookie.get('rc_token', rawCookies) if rawCookies?
if not uid?
uid = req.query.rc_uid
token = req.query.rc_token
unless uid and token and RocketChat.models.Users.findOneByIdAndLoginToken(uid, token)
res.writeHead 403
return false
@ -1,7 +1,13 @@
Template.messageAttachment.helpers
fixCordova: (url) ->
if Meteor.isCordova and url?[0] is '/'
return Meteor.absoluteUrl().replace(/\/$/, '') + url
url = Meteor.absoluteUrl().replace(/\/$/, '') + url
query = "rc_uid=#{Meteor.userId()}&rc_token=#{Meteor._localStorage.getItem('Meteor.loginToken')}"
if url.indexOf('?') is -1
url = url + '?' + query
else
url = url + '&' + query
return url
showImage: ->