From 499bf1ee143879885801efa5794d81eded777ae0 Mon Sep 17 00:00:00 2001
From: or-else <or.else@gmail.com>
Date: Wed, 6 Jun 2018 16:41:16 +0300
Subject: [PATCH] separate download url from preview url

---
 css/base.css |  2 +-
 drafty.js    | 18 +++++++++++++++---
 index.html   |  4 ++--
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/css/base.css b/css/base.css
index aa71025f..0d7050cd 100644
--- a/css/base.css
+++ b/css/base.css
@@ -1714,7 +1714,7 @@ ul.tabbar li.active > a:after {
   margin: 0.35rem;
   width: 6rem;
   border-radius: 0.1rem;
-  background-color: silver;
+  background-color: #cfd8dc;
 }
 /* Colored uploader progress bar of variable length */
 .uploader > div > span {
diff --git a/drafty.js b/drafty.js
index 5258c8db..369af8ab 100644
--- a/drafty.js
+++ b/drafty.js
@@ -129,7 +129,8 @@ Sample JSON representation of the text above:
     },
     IM: {
       open: function(data) {
-        var previewUrl = data.val ? base64toObjectUrl(data.val, data.mime) : data.ref;
+        // Don't use data.ref for preview: it's a security risk. 
+        var previewUrl = base64toObjectUrl(data.val, data.mime);
         var downloadUrl = data.ref ? data.ref : previewUrl;
         var res = (data.name ? '<a href="' + downloadUrl + '" download="' + data.name + '">' : '') +
           '<img src="' + previewUrl + '"' +
@@ -737,11 +738,22 @@ Sample JSON representation of the text above:
       },
 
       /**
-       * Get blob URL for a given entity.
+       * Given the entity, get URL which can be used for downloading
+       * entity data.
        *
        * @param {Object} entity to get the URl from.
        */
-      getBlobUrl: function(entity) {
+      getDownloadUrl: function(entity) {
+        return entity.ref ? entity.ref : base64toObjectUrl(entity.val, entity.mime);
+      },
+
+      /**
+       * Given the entity, get URL which can be used for previewing
+       * the entity.
+       *
+       * @param {Object} entity to get the URl from.
+       */
+      getPreviewUrl: function(entity) {
         return base64toObjectUrl(entity.val, entity.mime);
       },
 
diff --git a/index.html b/index.html
index df9275ca..44ba7fc8 100644
--- a/index.html
+++ b/index.html
@@ -3176,7 +3176,7 @@
         if (this.props.mimeType === Drafty.getContentType()) {
           Drafty.attachments(content, function(att, i) {
             attachments.push(<Message.Attachment
-              filename={att.name} blobUrl={Drafty.getBlobUrl(att)}
+              filename={att.name} downloadUrl={Drafty.getDownloadUrl(att)}
               size={Drafty.getEntitySize(att)} key={i} />);
           }, this);
           content = React.createElement('span', null, Drafty.format(content, formatter, this));
@@ -3283,7 +3283,7 @@
               {this.props.uploader ?
                 <FileUploadProgress progress={this.props.progress} />
                 :
-                <div><a href={this.props.blobUrl} download={this.props.filename}>
+                <div><a href={this.props.downloadUrl} download={this.props.filename}>
                   <i className="material-icons">file_download</i> save
                 </a></div>
               }