move shrine files out of public. use x-sendfile to send files for security.
This commit is contained in:
parent
8e66fb28db
commit
b601b2bbb6
11 changed files with 164 additions and 140 deletions
|
|
@ -74,6 +74,15 @@ Rails.application.configure do
|
|||
# routes, locales, etc. This feature depends on the listen gem.
|
||||
config.file_watcher = ActiveSupport::EventedFileUpdateChecker
|
||||
|
||||
# Let the "thrust" web server handle sending images. It allows to route all
|
||||
# images through the Rails application and prevent unauthorized access to
|
||||
# images that are pending moderation. (A common problem with spammers uploading
|
||||
# smartphone screenshots of card games.)
|
||||
config.action_dispatch.x_sendfile_header = 'X-Sendfile'
|
||||
|
||||
# Where Shrine stores the screenshots
|
||||
config.shrine_storage_path = ENV.fetch('SHRINE_STORAGE_PATH', 'shrine')
|
||||
|
||||
config.package_sources = [
|
||||
{
|
||||
description: 'Debian Unstable (Sid)', type: 'apt', url: 'http://ftp.de.debian.org/debian/dists/sid',
|
||||
|
|
|
|||
|
|
@ -85,6 +85,15 @@ Rails.application.configure do
|
|||
# Do not dump schema after migrations.
|
||||
config.active_record.dump_schema_after_migration = false
|
||||
|
||||
# Let the "thrust" web server handle sending images. It allows to route all
|
||||
# images through the Rails application and prevent unauthorized access to
|
||||
# images that are pending moderation. (A common problem with spammers uploading
|
||||
# smartphone screenshots of card games.)
|
||||
config.action_dispatch.x_sendfile_header = 'X-Sendfile'
|
||||
|
||||
# Where Shrine stores the screenshots
|
||||
config.shrine_storage_path = ENV.fetch('SHRINE_STORAGE_PATH', 'shrine')
|
||||
|
||||
config.package_sources = [
|
||||
{
|
||||
description: 'Debian Unstable (Sid)', type: 'apt', url: 'http://ftp.de.debian.org/debian/dists/sid',
|
||||
|
|
|
|||
|
|
@ -1,13 +1,15 @@
|
|||
# See also: https://github.com/erikdahlstrand/shrine-rails-example/blob/master/config/initializers/shrine.rb
|
||||
|
||||
require "shrine"
|
||||
require "shrine/storage/file_system"
|
||||
require 'shrine'
|
||||
require 'shrine/storage/file_system'
|
||||
|
||||
# both `cache` and `store` storages are needed
|
||||
Shrine.storages = {
|
||||
# Saves to ./public/screenshot/ID/image/…
|
||||
cache: Shrine::Storage::FileSystem.new("public", prefix: "cache"),
|
||||
store: Shrine::Storage::FileSystem.new("public", prefix: "shrine"),
|
||||
# Saves to ./shrine/files/screenshot/ID/image/…
|
||||
cache: Shrine::Storage::FileSystem.new(Rails.application.config.shrine_storage_path,
|
||||
prefix: 'cache'),
|
||||
store: Shrine::Storage::FileSystem.new(Rails.application.config.shrine_storage_path,
|
||||
prefix: 'files')
|
||||
}
|
||||
|
||||
# See plugin documentation at https://shrinerb.com/docs/plugins/activerecord
|
||||
|
|
@ -18,6 +20,6 @@ Shrine.plugin :instrumentation
|
|||
Shrine.plugin :determine_mime_type, analyzer: :marcel, log_subscriber: nil
|
||||
Shrine.plugin :cached_attachment_data
|
||||
Shrine.plugin :restore_cached_data
|
||||
Shrine.plugin :derivatives # up front processing
|
||||
Shrine.plugin :derivatives # up front processing
|
||||
# Shrine.plugin :derivation_endpoint, # on-the-fly processing
|
||||
# secret_key: Rails.application.secret_key_base
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ Rails.application.routes.draw do
|
|||
|
||||
# Reveal health status on /up that returns 200 if the app boots with no exceptions, otherwise 500.
|
||||
# Can be used by load balancers and uptime monitors to verify that the app is live.
|
||||
get "up" => "rails/health#show", as: :rails_health_check
|
||||
get 'up' => 'rails/health#show', as: :rails_health_check
|
||||
|
||||
Healthcheck.routes(self)
|
||||
get 'admin/status'
|
||||
|
|
@ -19,8 +19,8 @@ Rails.application.routes.draw do
|
|||
devise_for :users, controllers: {
|
||||
# registrations: "users/registrations",
|
||||
# passwords: "users/passwords",
|
||||
omniauth_callbacks: "users/omniauth_callbacks",
|
||||
sessions: "users/my_sessions"
|
||||
omniauth_callbacks: 'users/omniauth_callbacks',
|
||||
sessions: 'users/my_sessions'
|
||||
}
|
||||
|
||||
get 'packages' => 'packages#grid', as: :packages_grid
|
||||
|
|
@ -34,29 +34,49 @@ Rails.application.routes.draw do
|
|||
get 'my/screenshots'
|
||||
get 'my/moderate_list', as: :moderate_list
|
||||
get 'my/logs', as: :logs
|
||||
get 'package/:name' => 'packages#details', as: :package, name: /[^\/]+/
|
||||
get 'package/:name' => 'packages#details', as: :package, name: %r{[^/]+}
|
||||
# get 'package_reviews/:name' => 'packages#reviews', as: :package_reviews, name: /[^\/]+/
|
||||
get 'upload', to: redirect('/packages'), as: :upload_legacy # legacy upload form
|
||||
post 'uploadfile' => 'packages#legacy_uploadfile', name: /[^\/]+/
|
||||
get 'upload/:name' => 'packages#upload', as: :upload, name: /[^\/]+/
|
||||
get 'upload/:name/json' => 'packages#upload', as: :upload_json, name: /[^\/]+/, returns: :json
|
||||
post 'upload/:name' => 'packages#upload_receive', as: :upload_receive, name: /[^\/]+/
|
||||
post 'upload/:name/json' => 'packages#upload_receive', as: :upload_receive_json, name: /[^\/]+/, returns: :json
|
||||
post 'uploadfile' => 'packages#legacy_uploadfile', name: %r{[^/]+}
|
||||
get 'upload/:name' => 'packages#upload', as: :upload, name: %r{[^/]+}
|
||||
get 'upload/:name/json' => 'packages#upload', as: :upload_json, name: %r{[^/]+}, returns: :json
|
||||
post 'upload/:name' => 'packages#upload_receive', as: :upload_receive, name: %r{[^/]+}
|
||||
post 'upload/:name/json' => 'packages#upload_receive', as: :upload_receive_json, name: %r{[^/]+},
|
||||
returns: :json
|
||||
# TODO: "get" is probably the wrong method to delete a screenshot
|
||||
get 'delete_screenshot/:id' => 'packages#delete_screenshot', as: :delete_screenshot
|
||||
get 'hide_screenshot/:id' => 'packages#hide_screenshot', as: :hide_screenshot
|
||||
get 'unhide_screenshot/:id' => 'packages#unhide_screenshot', as: :unhide_screenshot
|
||||
patch 'update_screenshot_description/:id' => 'packages#update_screenshot_description', as: :update_screenshot_description
|
||||
#post 'report_screenshot/:id' => 'packages#report_screenshot', as: :report_screenshot
|
||||
patch 'update_screenshot_description/:id' => 'packages#update_screenshot_description',
|
||||
as: :update_screenshot_description
|
||||
# post 'report_screenshot/:id' => 'packages#report_screenshot', as: :report_screenshot
|
||||
# TODO: "get" is probably the wrong method to delete a screenshot
|
||||
get 'approve_screenshot/:id' => 'packages#approve_screenshot', as: :approve_screenshot
|
||||
get 'about' => 'welcome#about'
|
||||
get 'thumbnail/:name' => 'packages#thumbnail', as: :thumbnail_image, name: /[^\/]+/
|
||||
get 'thumbnail-404/:name' => 'packages#thumbnail', name: /[^\/]+/
|
||||
get 'thumbnail-with-version/:name/:version' => 'packages#thumbnail', name: /[^\/]+/, version: /\d.*/
|
||||
get 'screenshot/:name' => 'packages#screenshot', as: :screenshot_image, name: /[^\/]+/
|
||||
get 'screenshot-404/:name' => 'packages#screenshot', name: /[^\/]+/
|
||||
get 'screenshot-with-version/:name/:version' => 'packages#screenshot', name: /[^\/]+/, version: /\d.*/
|
||||
|
||||
get 'thumbnail/:name' => 'packages#send_image', as: :thumbnail_image, name: %r{[^/]+},
|
||||
defaults: { size: :thumb }
|
||||
get 'thumbnail-404/:name' => 'packages#send_image', name: %r{[^/]+}
|
||||
get 'thumbnail-with-version/:name/:version' => 'packages#send_image', name: %r{[^/]+},
|
||||
version: /\d.*/
|
||||
|
||||
# Return small image for a specific package
|
||||
# TODO: needed at all?
|
||||
get 'small/:name' => 'packages#send_image', as: :small_image, name: %r{[^/]+},
|
||||
defaults: { size: :small }
|
||||
# Return small image by specific screenshot_id
|
||||
get 'small/:name/:screenshot_id' => 'packages#send_image', as: :small_image_with_id, name: %r{[^/]+},
|
||||
defaults: { size: :small }
|
||||
|
||||
# Return large image for a specific package
|
||||
get 'screenshot/:name' => 'packages#send_image', as: :screenshot_image, name: %r{[^/]+},
|
||||
defaults: { size: :large }
|
||||
# Return large image by specific screenshot_id
|
||||
get 'screenshot/:name/:screenshot_id' => 'packages#send_image', as: :screenshot_image_with_id, name: %r{[^/]+},
|
||||
defaults: { size: :large }
|
||||
get 'screenshot-404/:name' => 'packages#send_image', name: %r{[^/]+}
|
||||
get 'screenshot-with-version/:name/:version' => 'packages#send_image', name: %r{[^/]+},
|
||||
version: /\d.*/
|
||||
|
||||
# Legacy URLs
|
||||
get 'with_screenshots', to: redirect('/packages?show=with')
|
||||
|
|
@ -65,14 +85,15 @@ Rails.application.routes.draw do
|
|||
get 'json/package/:name' => 'json#package', as: :json_package, defaults: { format: :json }
|
||||
get 'json/packages' => 'json#packages', as: :json_packages, defaults: { format: :json }
|
||||
get 'json/screenshots' => 'json#screenshots', as: :json_screenshots, defaults: { format: :json }
|
||||
get 'json/packages-without-screenshots' => 'json#packages_without_screenshots', defaults: { format: :json }
|
||||
get 'json/packages-without-screenshots' => 'json#packages_without_screenshots',
|
||||
defaults: { format: :json }
|
||||
|
||||
# The priority is based upon order of creation: first created -> highest priority.
|
||||
# See how all your routes lay out with "rake routes".
|
||||
|
||||
# You can have the root of your site routed with "root"
|
||||
root 'welcome#home'
|
||||
#root to: 'packages#home'
|
||||
# root to: 'packages#home'
|
||||
|
||||
# Example of regular route:
|
||||
# get 'products/:id' => 'catalog#view'
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue