move shrine files out of public. use x-sendfile to send files for security.

This commit is contained in:
Christoph Haas 2025-06-16 00:24:11 +02:00
parent 8e66fb28db
commit b601b2bbb6
11 changed files with 164 additions and 140 deletions

View file

@ -74,6 +74,15 @@ Rails.application.configure do
# routes, locales, etc. This feature depends on the listen gem.
config.file_watcher = ActiveSupport::EventedFileUpdateChecker
# Let the "thrust" web server handle sending images. It allows to route all
# images through the Rails application and prevent unauthorized access to
# images that are pending moderation. (A common problem with spammers uploading
# smartphone screenshots of card games.)
config.action_dispatch.x_sendfile_header = 'X-Sendfile'
# Where Shrine stores the screenshots
config.shrine_storage_path = ENV.fetch('SHRINE_STORAGE_PATH', 'shrine')
config.package_sources = [
{
description: 'Debian Unstable (Sid)', type: 'apt', url: 'http://ftp.de.debian.org/debian/dists/sid',

View file

@ -85,6 +85,15 @@ Rails.application.configure do
# Do not dump schema after migrations.
config.active_record.dump_schema_after_migration = false
# Let the "thrust" web server handle sending images. It allows to route all
# images through the Rails application and prevent unauthorized access to
# images that are pending moderation. (A common problem with spammers uploading
# smartphone screenshots of card games.)
config.action_dispatch.x_sendfile_header = 'X-Sendfile'
# Where Shrine stores the screenshots
config.shrine_storage_path = ENV.fetch('SHRINE_STORAGE_PATH', 'shrine')
config.package_sources = [
{
description: 'Debian Unstable (Sid)', type: 'apt', url: 'http://ftp.de.debian.org/debian/dists/sid',

View file

@ -1,13 +1,15 @@
# See also: https://github.com/erikdahlstrand/shrine-rails-example/blob/master/config/initializers/shrine.rb
require "shrine"
require "shrine/storage/file_system"
require 'shrine'
require 'shrine/storage/file_system'
# both `cache` and `store` storages are needed
Shrine.storages = {
# Saves to ./public/screenshot/ID/image/…
cache: Shrine::Storage::FileSystem.new("public", prefix: "cache"),
store: Shrine::Storage::FileSystem.new("public", prefix: "shrine"),
# Saves to ./shrine/files/screenshot/ID/image/…
cache: Shrine::Storage::FileSystem.new(Rails.application.config.shrine_storage_path,
prefix: 'cache'),
store: Shrine::Storage::FileSystem.new(Rails.application.config.shrine_storage_path,
prefix: 'files')
}
# See plugin documentation at https://shrinerb.com/docs/plugins/activerecord
@ -18,6 +20,6 @@ Shrine.plugin :instrumentation
Shrine.plugin :determine_mime_type, analyzer: :marcel, log_subscriber: nil
Shrine.plugin :cached_attachment_data
Shrine.plugin :restore_cached_data
Shrine.plugin :derivatives # up front processing
Shrine.plugin :derivatives # up front processing
# Shrine.plugin :derivation_endpoint, # on-the-fly processing
# secret_key: Rails.application.secret_key_base

View file

@ -3,7 +3,7 @@ Rails.application.routes.draw do
# Reveal health status on /up that returns 200 if the app boots with no exceptions, otherwise 500.
# Can be used by load balancers and uptime monitors to verify that the app is live.
get "up" => "rails/health#show", as: :rails_health_check
get 'up' => 'rails/health#show', as: :rails_health_check
Healthcheck.routes(self)
get 'admin/status'
@ -19,8 +19,8 @@ Rails.application.routes.draw do
devise_for :users, controllers: {
# registrations: "users/registrations",
# passwords: "users/passwords",
omniauth_callbacks: "users/omniauth_callbacks",
sessions: "users/my_sessions"
omniauth_callbacks: 'users/omniauth_callbacks',
sessions: 'users/my_sessions'
}
get 'packages' => 'packages#grid', as: :packages_grid
@ -34,29 +34,49 @@ Rails.application.routes.draw do
get 'my/screenshots'
get 'my/moderate_list', as: :moderate_list
get 'my/logs', as: :logs
get 'package/:name' => 'packages#details', as: :package, name: /[^\/]+/
get 'package/:name' => 'packages#details', as: :package, name: %r{[^/]+}
# get 'package_reviews/:name' => 'packages#reviews', as: :package_reviews, name: /[^\/]+/
get 'upload', to: redirect('/packages'), as: :upload_legacy # legacy upload form
post 'uploadfile' => 'packages#legacy_uploadfile', name: /[^\/]+/
get 'upload/:name' => 'packages#upload', as: :upload, name: /[^\/]+/
get 'upload/:name/json' => 'packages#upload', as: :upload_json, name: /[^\/]+/, returns: :json
post 'upload/:name' => 'packages#upload_receive', as: :upload_receive, name: /[^\/]+/
post 'upload/:name/json' => 'packages#upload_receive', as: :upload_receive_json, name: /[^\/]+/, returns: :json
post 'uploadfile' => 'packages#legacy_uploadfile', name: %r{[^/]+}
get 'upload/:name' => 'packages#upload', as: :upload, name: %r{[^/]+}
get 'upload/:name/json' => 'packages#upload', as: :upload_json, name: %r{[^/]+}, returns: :json
post 'upload/:name' => 'packages#upload_receive', as: :upload_receive, name: %r{[^/]+}
post 'upload/:name/json' => 'packages#upload_receive', as: :upload_receive_json, name: %r{[^/]+},
returns: :json
# TODO: "get" is probably the wrong method to delete a screenshot
get 'delete_screenshot/:id' => 'packages#delete_screenshot', as: :delete_screenshot
get 'hide_screenshot/:id' => 'packages#hide_screenshot', as: :hide_screenshot
get 'unhide_screenshot/:id' => 'packages#unhide_screenshot', as: :unhide_screenshot
patch 'update_screenshot_description/:id' => 'packages#update_screenshot_description', as: :update_screenshot_description
#post 'report_screenshot/:id' => 'packages#report_screenshot', as: :report_screenshot
patch 'update_screenshot_description/:id' => 'packages#update_screenshot_description',
as: :update_screenshot_description
# post 'report_screenshot/:id' => 'packages#report_screenshot', as: :report_screenshot
# TODO: "get" is probably the wrong method to delete a screenshot
get 'approve_screenshot/:id' => 'packages#approve_screenshot', as: :approve_screenshot
get 'about' => 'welcome#about'
get 'thumbnail/:name' => 'packages#thumbnail', as: :thumbnail_image, name: /[^\/]+/
get 'thumbnail-404/:name' => 'packages#thumbnail', name: /[^\/]+/
get 'thumbnail-with-version/:name/:version' => 'packages#thumbnail', name: /[^\/]+/, version: /\d.*/
get 'screenshot/:name' => 'packages#screenshot', as: :screenshot_image, name: /[^\/]+/
get 'screenshot-404/:name' => 'packages#screenshot', name: /[^\/]+/
get 'screenshot-with-version/:name/:version' => 'packages#screenshot', name: /[^\/]+/, version: /\d.*/
get 'thumbnail/:name' => 'packages#send_image', as: :thumbnail_image, name: %r{[^/]+},
defaults: { size: :thumb }
get 'thumbnail-404/:name' => 'packages#send_image', name: %r{[^/]+}
get 'thumbnail-with-version/:name/:version' => 'packages#send_image', name: %r{[^/]+},
version: /\d.*/
# Return small image for a specific package
# TODO: needed at all?
get 'small/:name' => 'packages#send_image', as: :small_image, name: %r{[^/]+},
defaults: { size: :small }
# Return small image by specific screenshot_id
get 'small/:name/:screenshot_id' => 'packages#send_image', as: :small_image_with_id, name: %r{[^/]+},
defaults: { size: :small }
# Return large image for a specific package
get 'screenshot/:name' => 'packages#send_image', as: :screenshot_image, name: %r{[^/]+},
defaults: { size: :large }
# Return large image by specific screenshot_id
get 'screenshot/:name/:screenshot_id' => 'packages#send_image', as: :screenshot_image_with_id, name: %r{[^/]+},
defaults: { size: :large }
get 'screenshot-404/:name' => 'packages#send_image', name: %r{[^/]+}
get 'screenshot-with-version/:name/:version' => 'packages#send_image', name: %r{[^/]+},
version: /\d.*/
# Legacy URLs
get 'with_screenshots', to: redirect('/packages?show=with')
@ -65,14 +85,15 @@ Rails.application.routes.draw do
get 'json/package/:name' => 'json#package', as: :json_package, defaults: { format: :json }
get 'json/packages' => 'json#packages', as: :json_packages, defaults: { format: :json }
get 'json/screenshots' => 'json#screenshots', as: :json_screenshots, defaults: { format: :json }
get 'json/packages-without-screenshots' => 'json#packages_without_screenshots', defaults: { format: :json }
get 'json/packages-without-screenshots' => 'json#packages_without_screenshots',
defaults: { format: :json }
# The priority is based upon order of creation: first created -> highest priority.
# See how all your routes lay out with "rake routes".
# You can have the root of your site routed with "root"
root 'welcome#home'
#root to: 'packages#home'
# root to: 'packages#home'
# Example of regular route:
# get 'products/:id' => 'catalog#view'