• Stan Hu's avatar
    Fix multipart attachments not uploading · 7d28e39f
    Stan Hu authored
    Mixing and matching the use of Rack::Request and ActionDispatch::Request
    in Rails 5 is bad, particularly if you have middleware that
    manipulates or accesses environment variables.
    
    `Gitlab::Middleware::Multipart` attempts to rewrite request parameters
    to the proper values (e.g. replacing `data_file` with
    `UploadedFile`). It does this by calling `Rack::Request#update_params`,
    which essentially updates `env['rack.request.form_hash']`.
    
    By changing to `ActionDispatch::Request`, the Go middleware was causing
    the request parameters to be stored inside
    `env['action_dispatch.request.request_parameters']`. Later calls to
    `Rack::Request#update_params` would not have any effect because it would
    attempt to update `env['rack.request.form_has']` instead of
    `env['action_dispatch.request.request_parameters']`. As a result, the
    controller still saw the old parameters.
    
    Since the Go middleware appears to be using `ActionDispatch::Request`
    for authorization methods, we can switch the multipart middleware to
    use it too.
    
    Closes https://gitlab.com/gitlab-org/gitlab-ee/issues/9035
    7d28e39f
multipart_spec.rb 5.38 KB