Fix #416 - Generate random unique 14-byte (19 characters) shortcodes

for local attachments, use them in URLs. Check status privacy
before redirecting to actual file.

1 files changed, 2 insertions, 1 deletions

diff --git a/app/controllers/media_controller.rb b/app/controllers/media_controller.rb
index 6f1f7ec48..488c4f944 100644
--- a/app/controllers/media_controller.rb
+++ b/app/controllers/media_controller.rb
@@ -10,6 +10,7 @@ class MediaController < ApplicationController
   private
 
   def set_media_attachment
-    @media_attachment = MediaAttachment.where.not(status_id: nil).find(params[:id])
+    @media_attachment = MediaAttachment.where.not(status_id: nil).find_by!(shortcode: params[:id])
+    raise ActiveRecord::RecordNotFound unless @media_attachment.status.permitted?(current_account)
   end
 end