make sure that images are only delivered if the user has view permission

This commit is contained in:
Christoph Haas 2025-06-18 01:36:17 +02:00
parent 9aeafd07ec
commit 5ca2920d9d
3 changed files with 133 additions and 12 deletions

View file

@ -234,7 +234,10 @@ class PackagesController < ApplicationController
def approve_screenshot
@screenshot = Screenshot.find(params[:id])
return unless can? :approve, @screenshot
unless can? :approve, @screenshot
head :forbidden
return
end
@screenshot.approve!
auditlog 'Screenshot approved',
@ -246,8 +249,8 @@ class PackagesController < ApplicationController
flash['notice'] = 'Screenshot approved.'
redirect_back(fallback_location: package_path(name: @screenshot.package.name))
elsename
head :forbidden
# head :forbidden
end
# Returns either…
@ -272,15 +275,25 @@ class PackagesController < ApplicationController
return
end
# Called as /screenshot-with-version/:name/:version
# or /thumbnail-with-version/:name/:version
@image = if params[:version]
@package.best_screenshot_for_version(params[:version])
# Called as /screenshot/:name
else
# @package.screenshots.approved.first
@package.screenshots.accessible_by(current_ability, :view).first
end
@image = nil
if params[:screenshot_id]
# Called as /screenshot/:name/:screenshot_id
# TODO: 'name' is useless here
Rails.logger.debug "Called as /screenshot/#{params[:name]}/#{params[:screenshot_id]}"
@image = Screenshot.find(params[:screenshot_id])
unless can? :view, @image
return screenshot403
end
elsif params[:version]
# Called as /screenshot-with-version/:name/:version
# or /thumbnail-with-version/:name/:version
# TODO: permissions check!?
@image = @package.best_screenshot_for_version(params[:version])
else
# Called as /screenshot/:name
@package.screenshots.accessible_by(current_ability, :view).first
end
# Return a 404 if the package has no screenshots or the image was not found
unless @image
@ -328,6 +341,12 @@ class PackagesController < ApplicationController
disposition: 'inline', status: 404
end
# Send a dummy screenshot reading "No screenshot available. Sorry."
def screenshot403
send_file Rails.root.join('public/images/dummy/screenshot403.png'), type: 'image/png',
disposition: 'inline', status: 404
end
# Return packages matching the criteria given by parameters
def query_packages
packages = Package # .order(visits: :desc)