Add verification to authorize get images with X-user-id and X-auth-to…

…ken (#10741)
RocketChat · May 18, 2018 · d6ff269 · d6ff269
1 parent 0f5cffa
commit d6ff269
Showing 1 changed file with 4 additions and 8 deletions.
diff --git a/packages/rocketchat-file-upload/server/lib/FileUpload.js b/packages/rocketchat-file-upload/server/lib/FileUpload.js
@@ -203,17 +203,13 @@ Object.assign(FileUpload, {
 		let { rc_uid, rc_token } = query;
 
 		if (!rc_uid && headers.cookie) {
-			rc_uid = cookie.get('rc_uid', headers.cookie) ;
+			rc_uid = cookie.get('rc_uid', headers.cookie);
 			rc_token = cookie.get('rc_token', headers.cookie);
 		}
-
-		if (!rc_uid || !rc_token || !RocketChat.models.Users.findOneByIdAndLoginToken(rc_uid, rc_token)) {
-			return false;
-		}
-
-		return true;
+		const isAuthorizedByCookies = rc_uid && rc_token && RocketChat.models.Users.findOneByIdAndLoginToken(rc_uid, rc_token);
+		const isAuthorizedByHeaders = headers['x-user-id'] && headers['x-auth-token'] && RocketChat.models.Users.findOneByIdAndLoginToken(headers['x-user-id'], headers['x-auth-token']);
+		return isAuthorizedByCookies || isAuthorizedByHeaders;
 	},
-
 	addExtensionTo(file) {
 		if (mime.lookup(file.name) === file.type) {
 			return file;