security: fix CVE-2024-42485 for 1.x

pxlrbt · Sep 13, 2024 · af36f93 · af36f93
1 parent 771952c
commit af36f93
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/routes/web.php b/routes/web.php
@@ -1,10 +1,17 @@
 <?php
 
+use Illuminate\Support\Facades\Route;
+use Illuminate\Support\Facades\Storage;
+
 Route::get('filament-excel/{path}', function (string $path) {
+    $filename = substr($path, 37);
+    $path = Storage::disk('filament-excel')->path($path);
+
     return
         response()
-            ->download(Storage::disk('filament-excel')->path($path), substr($path, 37))
+            ->download($path, $filename)
             ->deleteFileAfterSend();
 })
+    ->middleware(['web', 'signed'])
     ->where('path', '.*')
     ->name('filament-excel-download');