Allow file upload paths on attachments URLs (#15121)

app/file-upload/server/lib/FileUpload.js

@@ -39,6 +39,10 @@ settings.get('FileUpload_MaxFileSize', function(key, value) {
 export const FileUpload = {
 	handlers: {},
 
+	getPath(path = '') {
+		return `/file-upload/${ path }`;
+	},
+
 	configureUploadsStore(store, name, options) {
 		const type = name.split(':').pop();
 		const stores = UploadFS.getStores();

app/file-upload/server/lib/requests.js

@@ -3,7 +3,7 @@ import { WebApp } from 'meteor/webapp';
 import { FileUpload } from './FileUpload';
 import { Uploads } from '../../../models';
 
-WebApp.connectHandlers.use('/file-upload/',	function(req, res, next) {
+WebApp.connectHandlers.use(FileUpload.getPath(), function(req, res, next) {
 	const match = /^\/([^\/]+)\/(.*)/.exec(req.url);
 
 	if (match && match[1]) {

app/file-upload/server/methods/sendFileMessage.js

@@ -30,7 +30,7 @@ Meteor.methods({
 
 		Uploads.updateFileComplete(file._id, Meteor.userId(), _.omit(file, '_id'));
 
-		const fileUrl = `/file-upload/${ file._id }/${ encodeURI(file.name) }`;
+		const fileUrl = FileUpload.getPath(`${ file._id }/${ encodeURI(file.name) }`);
 
 		const attachment = {
 			title: file.name,

app/lib/server/functions/sendMessage.js

@@ -7,6 +7,7 @@ import { Messages } from '../../../models';
 import { Apps } from '../../../apps/server';
 import { Markdown } from '../../../markdown/server';
 import { isURL } from '../../../utils/lib/isURL';
+import { FileUpload } from '../../../file-upload/server';
 
 /**
  * IMPORTANT
@@ -20,7 +21,7 @@ import { isURL } from '../../../utils/lib/isURL';
 const ValidLinkParam = Match.Where((value) => {
 	check(value, String);
 
-	if (!isURL(value)) {
+	if (!isURL(value) && !value.startsWith(FileUpload.getPath())) {
 		throw new Error('Invalid href value provided');
 	}
 

app/livechat/server/methods/sendFileLivechatMessage.js

@@ -3,7 +3,7 @@ import { Match, check } from 'meteor/check';
 import { Random } from 'meteor/random';
 
 import { Rooms, LivechatVisitors } from '../../../models';
-import { FileUpload } from '../../../file-upload';
+import { FileUpload } from '../../../file-upload/server';
 
 Meteor.methods({
 	async 'sendFileLivechatMessage'(roomId, visitorToken, file, msgData = {}) {
@@ -27,7 +27,7 @@ Meteor.methods({
 			msg: Match.Optional(String),
 		});
 
-		const fileUrl = `/file-upload/${ file._id }/${ encodeURI(file.name) }`;
+		const fileUrl = FileUpload.getPath(`${ file._id }/${ encodeURI(file.name) }`);
 
 		const attachment = {
 			title: file.name,

tests/end-to-end/api/05-chat.js

@@ -304,6 +304,7 @@ describe('[Chat]', function() {
 					})
 					.end(done)
 			);
+
 			it('attachment.image_url', (done) =>
 				request.post(api('chat.postMessage'))
 					.set(credentials)