move shrine files out of public. use x-sendfile to send files for security.
This commit is contained in:
parent
8e66fb28db
commit
b601b2bbb6
11 changed files with 164 additions and 140 deletions
|
|
@ -26,7 +26,10 @@ class PackagesController < ApplicationController
|
|||
render 'notfound', status: 404
|
||||
else
|
||||
@page = params[:page]
|
||||
@screenshots = screenshots_visible_to_user(@package).paginate(page: @page, per_page: 6)
|
||||
# @screenshots = screenshots_visible_to_user(@package).paginate(page: @page, per_page: 6)
|
||||
@screenshots = @package.screenshots.accessible_by(current_ability, :view).paginate(
|
||||
page: @page, per_page: 6
|
||||
)
|
||||
end
|
||||
end
|
||||
|
||||
|
|
@ -231,78 +234,64 @@ class PackagesController < ApplicationController
|
|||
def approve_screenshot
|
||||
@screenshot = Screenshot.find(params[:id])
|
||||
|
||||
if can? :approve, @screenshot
|
||||
@screenshot.approve!
|
||||
auditlog 'Screenshot approved',
|
||||
package: @screenshot.package, screenshot: @screenshot
|
||||
return unless can? :approve, @screenshot
|
||||
|
||||
# Increase the approval counter for the user (social scoring)
|
||||
@screenshot.user.approved_screenshots += 1
|
||||
@screenshot.user.save!
|
||||
@screenshot.approve!
|
||||
auditlog 'Screenshot approved',
|
||||
package: @screenshot.package, screenshot: @screenshot
|
||||
|
||||
flash['notice'] = 'Screenshot approved.'
|
||||
redirect_back(fallback_location: package_path(name: @screenshot.package.name))
|
||||
else
|
||||
head :forbidden
|
||||
end
|
||||
# Increase the approval counter for the user (social scoring)
|
||||
@screenshot.user.approved_screenshots += 1
|
||||
@screenshot.user.save!
|
||||
|
||||
flash['notice'] = 'Screenshot approved.'
|
||||
redirect_back(fallback_location: package_path(name: @screenshot.package.name))
|
||||
elsename
|
||||
head :forbidden
|
||||
end
|
||||
|
||||
# Returns a 160x120 thumbnail image if posssible.
|
||||
# Returns either…
|
||||
# - 160x120 thumbnail image
|
||||
# - 320x240 small image
|
||||
# - full-size screenshot
|
||||
#
|
||||
# If the package is not found it returns a dummy image along with status 404.
|
||||
# If the package is found but has no screenshots then it also returns a
|
||||
# dummy image along with status 404.
|
||||
def thumbnail
|
||||
@package = Package.find_by(name: params[:name])
|
||||
#
|
||||
# Return a specific screenshot (if the screenshot_id parameter is given)
|
||||
# or just the first (newest) one.
|
||||
def send_image
|
||||
size = params[:size] # :small, :large or :thumb
|
||||
@package = Package.find_by(name: params[:name]) # package name
|
||||
@screenshot_id = params[:screenshot_id] # screenshot ID (optional)
|
||||
unless @package
|
||||
logger.debug "Cannot render thumbnail for packages #{params[:name]} – no such package"
|
||||
thumbnail404
|
||||
return
|
||||
end
|
||||
|
||||
# Called as /thumbnail-with-version/:name/:version
|
||||
@screenshot = if params[:version]
|
||||
@package.best_screenshot_for_version(params[:version])
|
||||
# Called as /thumbnail/:name
|
||||
else
|
||||
@package.screenshots.approved.first
|
||||
end
|
||||
|
||||
# Return a 404 if the package has no screenshots or the image was not found
|
||||
unless @screenshot
|
||||
logger.debug "Cannot render thumbnail for packages #{params[:name]} – no screenshot found"
|
||||
thumbnail404
|
||||
return
|
||||
end
|
||||
|
||||
redirect_to @screenshot.simage_url(:thumb)
|
||||
end
|
||||
|
||||
# Returns a large screenshot image if posssible.
|
||||
# If the package is not found it returns a dummy image along with status 404.
|
||||
# If the package is found but has no screenshots then it also returns a
|
||||
# dummy image along with status 404.
|
||||
def screenshot
|
||||
@package = Package.find_by(name: params[:name])
|
||||
unless @package
|
||||
screenshot404
|
||||
Rails.logger.debug 'no such package -> 404'
|
||||
screenshot404 if %i[large small].include?(size)
|
||||
thumbnail404 if size == :thumb
|
||||
return
|
||||
end
|
||||
|
||||
# Called as /screenshot-with-version/:name/:version
|
||||
@screenshot = if params[:version]
|
||||
@package.best_screenshot_for_version(params[:version])
|
||||
# Called as /screenshot/:name
|
||||
else
|
||||
@package.screenshots.approved.first
|
||||
end
|
||||
# or /thumbnail-with-version/:name/:version
|
||||
@image = if params[:version]
|
||||
@package.best_screenshot_for_version(params[:version])
|
||||
# Called as /screenshot/:name
|
||||
else
|
||||
# @package.screenshots.approved.first
|
||||
@package.screenshots.accessible_by(current_ability, :view).first
|
||||
end
|
||||
|
||||
# Return a 404 if the package has no screenshots or the image was not found
|
||||
unless @screenshot
|
||||
screenshot404
|
||||
unless @image
|
||||
Rails.logger.debug 'no such image -> 404'
|
||||
screenshot404 if %i[large small].include?(size)
|
||||
thumbnail404 if size == :thumb
|
||||
return
|
||||
end
|
||||
|
||||
redirect_to @screenshot.simage_url(:large)
|
||||
send_file(File.join(@image.simage.storage.directory, @image.simage(size).id),
|
||||
disposition: 'inline')
|
||||
end
|
||||
|
||||
# Receives a form with a simple text field 'description' so that users can update
|
||||
|
|
@ -341,7 +330,7 @@ class PackagesController < ApplicationController
|
|||
|
||||
# Return packages matching the criteria given by parameters
|
||||
def query_packages
|
||||
packages = Package #.order(visits: :desc)
|
||||
packages = Package # .order(visits: :desc)
|
||||
|
||||
# text search
|
||||
if params[:search].present?
|
||||
|
|
@ -370,26 +359,26 @@ class PackagesController < ApplicationController
|
|||
# end
|
||||
|
||||
# Get reviews of this package from the Ubuntu API
|
||||
def get_ubuntu_reviews(packagename)
|
||||
# Use the URL defined in the configuration to get a JSON string
|
||||
url = Rails.configuration.ubuntu_reviews_api_url % packagename
|
||||
logger.debug "Loading Ubuntu reviews for package #{packagename} from #{url}"
|
||||
# def get_ubuntu_reviews(packagename)
|
||||
# # Use the URL defined in the configuration to get a JSON string
|
||||
# url = Rails.configuration.ubuntu_reviews_api_url % packagename
|
||||
# logger.debug "Loading Ubuntu reviews for package #{packagename} from #{url}"
|
||||
|
||||
body = open(url).read
|
||||
# Turn JSON into a Ruby data structure
|
||||
json = JSON.parse(body)
|
||||
# Only show english reviews
|
||||
# TODO: Support further languages
|
||||
json = json.select { |x| x['language'] == 'en' }
|
||||
# Sort by 'usefulness_total' (how many people found this review useful)
|
||||
json.sort { |x, y| y['usefulness_total'].to_i <=> x['usefulness_total'].to_i }
|
||||
end
|
||||
# body = open(url).read
|
||||
# # Turn JSON into a Ruby data structure
|
||||
# json = JSON.parse(body)
|
||||
# # Only show english reviews
|
||||
# # TODO: Support further languages
|
||||
# json = json.select { |x| x['language'] == 'en' }
|
||||
# # Sort by 'usefulness_total' (how many people found this review useful)
|
||||
# json.sort { |x, y| y['usefulness_total'].to_i <=> x['usefulness_total'].to_i }
|
||||
# end
|
||||
|
||||
def params_screenshot_description
|
||||
params.require(:screenshot).permit(:description)
|
||||
end
|
||||
# def params_screenshot_description
|
||||
# params.require(:screenshot).permit(:description)
|
||||
# end
|
||||
|
||||
def screenshots_visible_to_user(package)
|
||||
package.screenshots.accessible_by(current_ability, :view).order('created_at DESC')
|
||||
end
|
||||
# def screenshots_visible_to_user(package)
|
||||
# package.screenshots.accessible_by(current_ability, :view).order('created_at DESC')
|
||||
# end
|
||||
end
|
||||
|
|
|
|||
|
|
@ -11,10 +11,12 @@ module PackagesHelper
|
|||
end
|
||||
|
||||
def small_img(screenshot, cls: 'thumbnail')
|
||||
if screenshot && screenshot.simage(:small)
|
||||
if screenshot&.simage(:small)
|
||||
image = screenshot.simage(:small)
|
||||
# image = screenshot_image_path(name: screenshot.package.name)
|
||||
|
||||
image_tag(
|
||||
image.url,
|
||||
small_image_with_id_path(name: screenshot.package.name, screenshot_id: screenshot.id),
|
||||
width: image.width,
|
||||
height: image.height,
|
||||
alt: screenshot.caption,
|
||||
|
|
@ -40,11 +42,11 @@ module PackagesHelper
|
|||
# Return a readable status of a screenshot and a matching CSS color class
|
||||
def status(screenshot)
|
||||
if screenshot.approved && !screenshot.hidden
|
||||
[(icon('eye', class: 'icon') + ' Public'), 'public']
|
||||
["#{icon('eye', class: 'icon')} Public".html_safe, 'public']
|
||||
elsif screenshot.hidden
|
||||
[(icon('eye-closed', class: 'icon') + ' Hidden'), 'hidden']
|
||||
["#{icon('eye-closed', class: 'icon')} Hidden".html_safe, 'hidden']
|
||||
elsif !screenshot.approved
|
||||
[(icon('hourglass', class: 'icon') + ' Unapproved'), 'unapproved']
|
||||
["#{icon('hourglass', class: 'icon')} Unapproved".html_safe, 'unapproved']
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
|||
|
|
@ -4,7 +4,6 @@ class Ability
|
|||
include CanCan::Ability
|
||||
|
||||
def initialize(user)
|
||||
|
||||
# Define abilities for the passed in user here. For example:
|
||||
#
|
||||
# user ||= User.new # guest user (not logged in)
|
||||
|
|
@ -33,29 +32,29 @@ class Ability
|
|||
# https://github.com/CanCanCommunity/cancancan/wiki/Defining-Abilities
|
||||
|
||||
# Everybody can see public screenshots
|
||||
can :view, Screenshot, approved: true, hidden:false
|
||||
can :view, Screenshot, approved: true, hidden: false
|
||||
|
||||
if user.present? # Logged-in users
|
||||
# Allow to view own uploads (even not-yet-approved)
|
||||
can :view, Screenshot, user_id: user.id
|
||||
can :destroy, Screenshot, user_id: user.id
|
||||
return unless user.present? # Logged-in users
|
||||
|
||||
if user.admin_role?
|
||||
can :approve, Screenshot
|
||||
can :destroy, Screenshot
|
||||
can :hide, Screenshot
|
||||
can :unhide, Screenshot
|
||||
can :destroy, User
|
||||
can :view, Screenshot
|
||||
can :destroy, Package
|
||||
can :view, Log
|
||||
end
|
||||
if user.moderator_role?
|
||||
can :approve, Screenshot
|
||||
can :hide, Screenshot
|
||||
can :unhide, Screenshot
|
||||
can :view, Screenshot
|
||||
end
|
||||
# Allow to view own uploads (even not-yet-approved)
|
||||
can :view, Screenshot, user_id: user.id
|
||||
can :destroy, Screenshot, user_id: user.id
|
||||
|
||||
if user.admin_role?
|
||||
can :approve, Screenshot
|
||||
can :destroy, Screenshot
|
||||
can :hide, Screenshot
|
||||
can :unhide, Screenshot
|
||||
can :destroy, User
|
||||
can :view, Screenshot
|
||||
can :destroy, Package
|
||||
can :view, Log
|
||||
end
|
||||
return unless user.moderator_role?
|
||||
|
||||
can :approve, Screenshot
|
||||
can :hide, Screenshot
|
||||
can :unhide, Screenshot
|
||||
can :view, Screenshot
|
||||
end
|
||||
end
|
||||
|
|
|
|||
|
|
@ -24,7 +24,7 @@
|
|||
= render(partial: 'admin_buttons', locals: {screenshot: screenshot})
|
||||
/ Photoswipe needs to know the dimensions of the full-size image to zoom to
|
||||
a.foobar.black [
|
||||
href=url_for(screenshot.simage_url(:large))
|
||||
href=screenshot_image_with_id_path(screenshot.package, screenshot.id)
|
||||
data-pswp-width=screenshot.simage.width
|
||||
data-pswp-height=screenshot.simage.height
|
||||
]
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue