From 12f6bc5f8a6ace59e9d26dd2b1be8a1e6c015672 Mon Sep 17 00:00:00 2001 From: rulingcom Date: Thu, 22 Oct 2026 14:23:04 +0800 Subject: [PATCH] Disable unused contribution routes that allowed unauthenticated file upload --- config/routes.rb | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/config/routes.rb b/config/routes.rb index e0443be..6aed0ed 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -83,14 +83,17 @@ Rails.application.routes.draw do resources :application_form_item_contents end - resources :application_forms do + # 投稿功能（從 seminar 複製而來）後台無法開啟，但以下入口未檢查登入，可直接上傳檔案，先關閉。 + # 若客戶需要投稿功能，需先比照 seminar d09fa22 補上登入/擁有者檢查與副檔名黑名單，再恢復以下路由。 + # resources :application_forms do + resources :application_forms, except: [:update] do collection do get ':slug_title-:uid', to: 'application_forms#show' - post 'con_login_proc', to: 'application_forms#con_login_proc' - post 'con_logout_proc', to: 'application_forms#con_logout_proc' - post 'add_file_proc', to: 'application_forms#add_file_proc' - post 'edit_file_proc', to: 'application_forms#edit_file_proc' - post 'del_file', to: 'application_forms#del_file' + # post 'con_login_proc', to: 'application_forms#con_login_proc' + # post 'con_logout_proc', to: 'application_forms#con_logout_proc' + # post 'add_file_proc', to: 'application_forms#add_file_proc' + # post 'edit_file_proc', to: 'application_forms#edit_file_proc' + # post 'del_file', to: 'application_forms#del_file' end end get '/xhr/application_forms/check_availability', to: 'application_forms#check_availability'