diff --git a/app/controllers/packages_controller.rb b/app/controllers/packages_controller.rb index 780b074..6372312 100644 --- a/app/controllers/packages_controller.rb +++ b/app/controllers/packages_controller.rb @@ -234,7 +234,10 @@ class PackagesController < ApplicationController def approve_screenshot @screenshot = Screenshot.find(params[:id]) - return unless can? :approve, @screenshot + unless can? :approve, @screenshot + head :forbidden + return + end @screenshot.approve! auditlog 'Screenshot approved', @@ -246,8 +249,8 @@ class PackagesController < ApplicationController flash['notice'] = 'Screenshot approved.' redirect_back(fallback_location: package_path(name: @screenshot.package.name)) - elsename - head :forbidden + + # head :forbidden end # Returns either… @@ -272,15 +275,25 @@ class PackagesController < ApplicationController return end - # Called as /screenshot-with-version/:name/:version - # or /thumbnail-with-version/:name/:version - @image = if params[:version] - @package.best_screenshot_for_version(params[:version]) - # Called as /screenshot/:name - else - # @package.screenshots.approved.first - @package.screenshots.accessible_by(current_ability, :view).first - end + @image = nil + + if params[:screenshot_id] + # Called as /screenshot/:name/:screenshot_id + # TODO: 'name' is useless here + Rails.logger.debug "Called as /screenshot/#{params[:name]}/#{params[:screenshot_id]}" + @image = Screenshot.find(params[:screenshot_id]) + unless can? :view, @image + return screenshot403 + end + elsif params[:version] + # Called as /screenshot-with-version/:name/:version + # or /thumbnail-with-version/:name/:version + # TODO: permissions check!? + @image = @package.best_screenshot_for_version(params[:version]) + else + # Called as /screenshot/:name + @package.screenshots.accessible_by(current_ability, :view).first + end # Return a 404 if the package has no screenshots or the image was not found unless @image @@ -328,6 +341,12 @@ class PackagesController < ApplicationController disposition: 'inline', status: 404 end + # Send a dummy screenshot reading "No screenshot available. Sorry." + def screenshot403 + send_file Rails.root.join('public/images/dummy/screenshot403.png'), type: 'image/png', + disposition: 'inline', status: 404 + end + # Return packages matching the criteria given by parameters def query_packages packages = Package # .order(visits: :desc) diff --git a/public/images/dummy/screenshot403.png b/public/images/dummy/screenshot403.png new file mode 100644 index 0000000..d59a994 Binary files /dev/null and b/public/images/dummy/screenshot403.png differ diff --git a/public/images/dummy/screenshot403.svg b/public/images/dummy/screenshot403.svg new file mode 100644 index 0000000..9c0a3bf --- /dev/null +++ b/public/images/dummy/screenshot403.svg @@ -0,0 +1,102 @@ + + + + + + + + + + image/svg+xml + + + + + + + + + Sorry. This imageis not (yet) public. + +