diff --git a/CHANGELOG.md b/CHANGELOG.md index f1707038..473b57e3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## 2.0.3 (not yet released) * FIXED: Malicious filename can be used for self-XSS / HTML injection locally for users +* FIXED: Unable to create a new paste from the cloned one when a JSON file attached (#1585) ## 2.0.2 (2025-10-28) * CHANGED: Upgrading libraries to: DOMpurify 3.3.0 diff --git a/js/privatebin.js b/js/privatebin.js index d798f908..29f2dd44 100644 --- a/js/privatebin.js +++ b/js/privatebin.js @@ -5219,22 +5219,23 @@ jQuery.PrivateBin = (function($) { cipherMessage['attachment'] = attachments.map(attachment => attachment[0]); cipherMessage['attachment_name'] = attachments.map(attachment => attachment[1]); - cipherMessage['attachment'] = await Promise.all(cipherMessage['attachment'].map(async (attachment) => { + cipherMessage['attachment'] = await Promise.all(cipherMessage['attachment'].map(async (attachment, i) => { // we need to retrieve data from blob if browser already parsed it in memory if (typeof attachment === 'string' && attachment.startsWith('blob:')) { Alert.showStatus( [ 'Retrieving cloned file \'%s\' from memory...', - attachment[1] + cipherMessage['attachment_name'][i] ], 'copy' ); try { const blobData = await $.ajax({ type: 'GET', - url: `${attachment}`, + url: attachment, processData: false, timeout: 10000, + dataType: 'binary', xhrFields: { withCredentials: false, responseType: 'blob' diff --git a/lib/Configuration.php b/lib/Configuration.php index ee72c43b..2cccc342 100644 --- a/lib/Configuration.php +++ b/lib/Configuration.php @@ -121,7 +121,7 @@ class Configuration 'js/kjua-0.10.0.js' => 'sha512-BYj4xggowR7QD150VLSTRlzH62YPfhpIM+b/1EUEr7RQpdWAGKulxWnOvjFx1FUlba4m6ihpNYuQab51H6XlYg==', 'js/legacy.js' => 'sha512-rGXYUpIqbFoHAgBXZ0UlJBdNAIMOC9EQ67MG0X46D5uRB8LvwzgKirbSQRGdYfk8I2jsUcm+tvHXYboUnC6DUg==', 'js/prettify.js' => 'sha512-puO0Ogy++IoA2Pb9IjSxV1n4+kQkKXYAEUtVzfZpQepyDPyXk8hokiYDS7ybMogYlyyEIwMLpZqVhCkARQWLMg==', - 'js/privatebin.js' => 'sha512-D2cmzY2Ol+RvUvN7g6gGCYRE3CIksHOg0B/ejbYgplDA2c3CHG1l81nvChTgXWCP4+uK2N5fMoRKzwUMjEjnSA==', + 'js/privatebin.js' => 'sha512-ZwoUDxBdEE+zNoGqr9o7X7CJYS4JStEeNvcOnhz69YVbXjiibNoYSY7i3vc6MLI3M/K1K6sIUmSFm8sjoUdF5Q==', 'js/purify-3.3.0.js' => 'sha512-lsHD5zxs4lu/NDzaaibe27Vd2t7Cy9JQ3qDHUvDfb4oZvKoWDNEhwUY+4bT3R68cGgpgCYp8U1x2ifeVxqurdQ==', 'js/showdown-2.1.0.js' => 'sha512-WYXZgkTR0u/Y9SVIA4nTTOih0kXMEd8RRV6MLFdL6YU8ymhR528NLlYQt1nlJQbYz4EW+ZsS0fx1awhiQJme1Q==', 'js/zlib-1.3.1-1.js' => 'sha512-5bU9IIP4PgBrOKLZvGWJD4kgfQrkTz8Z3Iqeu058mbQzW3mCumOU6M3UVbVZU9rrVoVwaW4cZK8U8h5xjF88eQ==',