make sure that images are only delivered if the user has view permission

This commit is contained in:
Christoph Haas 2025-06-18 01:36:17 +02:00
parent 9aeafd07ec
commit 5ca2920d9d
3 changed files with 133 additions and 12 deletions

View file

@ -234,7 +234,10 @@ class PackagesController < ApplicationController
def approve_screenshot
@screenshot = Screenshot.find(params[:id])
return unless can? :approve, @screenshot
unless can? :approve, @screenshot
head :forbidden
return
end
@screenshot.approve!
auditlog 'Screenshot approved',
@ -246,8 +249,8 @@ class PackagesController < ApplicationController
flash['notice'] = 'Screenshot approved.'
redirect_back(fallback_location: package_path(name: @screenshot.package.name))
elsename
head :forbidden
# head :forbidden
end
# Returns either…
@ -272,15 +275,25 @@ class PackagesController < ApplicationController
return
end
# Called as /screenshot-with-version/:name/:version
# or /thumbnail-with-version/:name/:version
@image = if params[:version]
@package.best_screenshot_for_version(params[:version])
# Called as /screenshot/:name
else
# @package.screenshots.approved.first
@package.screenshots.accessible_by(current_ability, :view).first
end
@image = nil
if params[:screenshot_id]
# Called as /screenshot/:name/:screenshot_id
# TODO: 'name' is useless here
Rails.logger.debug "Called as /screenshot/#{params[:name]}/#{params[:screenshot_id]}"
@image = Screenshot.find(params[:screenshot_id])
unless can? :view, @image
return screenshot403
end
elsif params[:version]
# Called as /screenshot-with-version/:name/:version
# or /thumbnail-with-version/:name/:version
# TODO: permissions check!?
@image = @package.best_screenshot_for_version(params[:version])
else
# Called as /screenshot/:name
@package.screenshots.accessible_by(current_ability, :view).first
end
# Return a 404 if the package has no screenshots or the image was not found
unless @image
@ -328,6 +341,12 @@ class PackagesController < ApplicationController
disposition: 'inline', status: 404
end
# Send a dummy screenshot reading "No screenshot available. Sorry."
def screenshot403
send_file Rails.root.join('public/images/dummy/screenshot403.png'), type: 'image/png',
disposition: 'inline', status: 404
end
# Return packages matching the criteria given by parameters
def query_packages
packages = Package # .order(visits: :desc)

Binary file not shown.

After

Width:  |  Height:  |  Size: 15 KiB

View file

@ -0,0 +1,102 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
width="139.17595"
height="104.08411"
id="svg4402"
version="1.1"
inkscape:version="1.2.2 (b0a8486541, 2022-12-01)"
sodipodi:docname="no-screenshots-available (Kopie).svg"
inkscape:export-filename="/home/chaas/projekte/debshots2.ror4/lab/mockups/no-screenshots-available.png"
inkscape:export-xdpi="103.46"
inkscape:export-ydpi="103.46"
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
xmlns="http://www.w3.org/2000/svg"
xmlns:svg="http://www.w3.org/2000/svg"
xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
xmlns:cc="http://creativecommons.org/ns#"
xmlns:dc="http://purl.org/dc/elements/1.1/">
<defs
id="defs4404" />
<sodipodi:namedview
id="base"
pagecolor="#ffffff"
bordercolor="#666666"
borderopacity="1.0"
inkscape:pageopacity="0.0"
inkscape:pageshadow="2"
inkscape:zoom="6.563914"
inkscape:cx="38.23938"
inkscape:cy="56.673503"
inkscape:document-units="px"
inkscape:current-layer="layer1"
showgrid="false"
fit-margin-top="0"
fit-margin-left="0"
fit-margin-right="0"
fit-margin-bottom="0"
inkscape:window-width="2560"
inkscape:window-height="1368"
inkscape:window-x="0"
inkscape:window-y="0"
inkscape:window-maximized="1"
inkscape:showpageshadow="2"
inkscape:pagecheckerboard="0"
inkscape:deskcolor="#d1d1d1" />
<metadata
id="metadata4407">
<rdf:RDF>
<cc:Work
rdf:about="">
<dc:format>image/svg+xml</dc:format>
<dc:type
rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
<dc:title />
</cc:Work>
</rdf:RDF>
</metadata>
<g
inkscape:label="Ebene 1"
inkscape:groupmode="layer"
id="layer1"
transform="translate(-280.41076,-480.31961)">
<rect
inkscape:export-ydpi="89.650002"
inkscape:export-xdpi="89.650002"
inkscape:export-filename="/home/chaas/projekte/debshots2.ror4/debshots/mockups/thumbnail-404.png"
ry="11.822797"
rx="11.822797"
y="481.63004"
x="281.71011"
height="101.4643"
width="136.57977"
id="rect4286"
style="fill:#ffffff;fill-opacity:1;stroke:#999999;stroke-width:2.59939528;stroke-linecap:round;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;stroke-dashoffset:0" />
<path
inkscape:connector-curvature="0"
id="path4288"
d="m 332.92943,528.09727 c -1.07811,-0.11046 -2.08417,-0.49714 -2.93086,-1.12647 -1.14701,-0.85255 -1.89509,-2.03803 -2.2493,-3.56443 -0.0655,-0.28228 -0.0743,-1.19939 -0.0886,-9.28478 -0.011,-6.18566 -0.001,-9.10356 0.032,-9.39665 0.25407,-2.25299 1.77031,-4.15982 3.87203,-4.86949 0.90451,-0.30542 0.68965,-0.29171 4.84375,-0.30908 l 3.76984,-0.0158 1.8e-4,-0.25539 c 2.7e-4,-0.39865 0.1183,-1.02994 0.29124,-1.55787 0.55784,-1.70293 1.90743,-3.0818 3.58422,-3.66198 0.94916,-0.32842 0.70683,-0.31556 5.9461,-0.31556 4.36178,0 4.72717,0.006 5.10104,0.0813 1.77328,0.35778 3.22003,1.43774 4.07233,3.0399 0.36101,0.67862 0.64771,1.7465 0.64818,2.41426 l 1.8e-4,0.25539 3.76985,0.0158 c 4.1541,0.0174 3.93924,0.004 4.84375,0.30908 2.10172,0.70967 3.61796,2.6165 3.87202,4.86949 0.0331,0.29309 0.043,3.21098 0.032,9.39665 -0.0144,8.08539 -0.0231,9.0025 -0.0886,9.28478 -0.28601,1.23251 -0.75189,2.11734 -1.55127,2.94623 -0.81555,0.84565 -1.78573,1.3751 -3.06956,1.67512 -0.28685,0.067 -1.75435,0.0737 -17.42855,0.0794 -9.41343,0.003 -17.1858,-0.001 -17.27193,-0.01 z m 18.72618,-4.12689 c 3.32525,-0.56542 6.11405,-2.64775 7.58698,-5.66504 1.38419,-2.83551 1.37446,-6.18632 -0.0262,-9.00876 -1.57357,-3.17097 -4.62733,-5.30752 -8.12956,-5.68785 -0.55723,-0.0605 -1.61648,-0.0605 -2.17371,0 -3.50223,0.38033 -6.55599,2.51688 -8.12956,5.68785 -1.1913,2.40061 -1.3846,5.21403 -0.53413,7.77384 1.06705,3.21171 3.74427,5.76011 6.98839,6.65214 0.52551,0.1445 1.35922,0.302 1.84486,0.34853 0.50985,0.0488 2.04727,-0.0113 2.5729,-0.10071 z m -2.46103,-4.39398 c -0.76822,-0.13367 -1.25715,-0.29251 -1.86212,-0.60496 -1.5225,-0.78635 -2.63887,-2.25056 -3.01538,-3.95493 -0.0998,-0.45156 -0.13781,-1.52123 -0.0697,-1.96027 0.31953,-2.06099 1.56942,-3.71968 3.41596,-4.53318 0.76377,-0.33648 1.48572,-0.48692 2.33671,-0.48692 0.85099,0 1.57294,0.15044 2.3367,0.48692 1.84654,0.8135 3.09644,2.47219 3.41597,4.53318 0.0681,0.43904 0.03,1.50871 -0.0697,1.96027 -0.47477,2.14917 -2.12343,3.87896 -4.22152,4.42927 -0.62898,0.16498 -1.71105,0.22733 -2.26684,0.13062 z"
style="fill:#999999;fill-opacity:1" />
<text
inkscape:export-ydpi="89.650002"
inkscape:export-xdpi="89.650002"
inkscape:export-filename="/home/chaas/projekte/debshots2.ror4/debshots/mockups/thumbnail-404.png"
id="text4290"
y="548.95715"
x="349.65613"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:9.9459px;line-height:0%;font-family:Arial;-inkscape-font-specification:Arial;letter-spacing:0px;word-spacing:0px;fill:#999999;fill-opacity:1;stroke:none;stroke-width:0.828825"
xml:space="preserve"><tspan
style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:13.2579px;line-height:1.25;font-family:sans-serif;-inkscape-font-specification:'sans-serif Bold';text-align:center;text-anchor:middle;fill:#999999;stroke-width:0.828825"
y="548.95715"
x="349.65613"
sodipodi:role="line"
id="tspan2999">Sorry. This image</tspan><tspan
style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:13.2579px;line-height:1.25;font-family:sans-serif;-inkscape-font-specification:'sans-serif Bold';text-align:center;text-anchor:middle;fill:#999999;stroke-width:0.828825"
y="565.52954"
x="349.65613"
sodipodi:role="line"
id="tspan901">is not (yet) public.</tspan></text>
</g>
</svg>

After

Width:  |  Height:  |  Size: 6 KiB