make sure that images are only delivered if the user has view permission
This commit is contained in:
parent
9aeafd07ec
commit
5ca2920d9d
3 changed files with 133 additions and 12 deletions
|
|
@ -234,7 +234,10 @@ class PackagesController < ApplicationController
|
|||
def approve_screenshot
|
||||
@screenshot = Screenshot.find(params[:id])
|
||||
|
||||
return unless can? :approve, @screenshot
|
||||
unless can? :approve, @screenshot
|
||||
head :forbidden
|
||||
return
|
||||
end
|
||||
|
||||
@screenshot.approve!
|
||||
auditlog 'Screenshot approved',
|
||||
|
|
@ -246,8 +249,8 @@ class PackagesController < ApplicationController
|
|||
|
||||
flash['notice'] = 'Screenshot approved.'
|
||||
redirect_back(fallback_location: package_path(name: @screenshot.package.name))
|
||||
elsename
|
||||
head :forbidden
|
||||
|
||||
# head :forbidden
|
||||
end
|
||||
|
||||
# Returns either…
|
||||
|
|
@ -272,15 +275,25 @@ class PackagesController < ApplicationController
|
|||
return
|
||||
end
|
||||
|
||||
# Called as /screenshot-with-version/:name/:version
|
||||
# or /thumbnail-with-version/:name/:version
|
||||
@image = if params[:version]
|
||||
@package.best_screenshot_for_version(params[:version])
|
||||
# Called as /screenshot/:name
|
||||
else
|
||||
# @package.screenshots.approved.first
|
||||
@package.screenshots.accessible_by(current_ability, :view).first
|
||||
end
|
||||
@image = nil
|
||||
|
||||
if params[:screenshot_id]
|
||||
# Called as /screenshot/:name/:screenshot_id
|
||||
# TODO: 'name' is useless here
|
||||
Rails.logger.debug "Called as /screenshot/#{params[:name]}/#{params[:screenshot_id]}"
|
||||
@image = Screenshot.find(params[:screenshot_id])
|
||||
unless can? :view, @image
|
||||
return screenshot403
|
||||
end
|
||||
elsif params[:version]
|
||||
# Called as /screenshot-with-version/:name/:version
|
||||
# or /thumbnail-with-version/:name/:version
|
||||
# TODO: permissions check!?
|
||||
@image = @package.best_screenshot_for_version(params[:version])
|
||||
else
|
||||
# Called as /screenshot/:name
|
||||
@package.screenshots.accessible_by(current_ability, :view).first
|
||||
end
|
||||
|
||||
# Return a 404 if the package has no screenshots or the image was not found
|
||||
unless @image
|
||||
|
|
@ -328,6 +341,12 @@ class PackagesController < ApplicationController
|
|||
disposition: 'inline', status: 404
|
||||
end
|
||||
|
||||
# Send a dummy screenshot reading "No screenshot available. Sorry."
|
||||
def screenshot403
|
||||
send_file Rails.root.join('public/images/dummy/screenshot403.png'), type: 'image/png',
|
||||
disposition: 'inline', status: 404
|
||||
end
|
||||
|
||||
# Return packages matching the criteria given by parameters
|
||||
def query_packages
|
||||
packages = Package # .order(visits: :desc)
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue