move shrine files out of public. use x-sendfile to send files for security.

config/routes.rb

@@ -3,7 +3,7 @@ Rails.application.routes.draw do
 
   # Reveal health status on /up that returns 200 if the app boots with no exceptions, otherwise 500.
   # Can be used by load balancers and uptime monitors to verify that the app is live.
-  get "up" => "rails/health#show", as: :rails_health_check
+  get 'up' => 'rails/health#show', as: :rails_health_check
 
   Healthcheck.routes(self)
   get 'admin/status'
@@ -19,8 +19,8 @@ Rails.application.routes.draw do
   devise_for :users, controllers: {
     # registrations: "users/registrations",
     # passwords: "users/passwords",
-    omniauth_callbacks: "users/omniauth_callbacks",
-    sessions: "users/my_sessions"
+    omniauth_callbacks: 'users/omniauth_callbacks',
+    sessions: 'users/my_sessions'
   }
 
   get 'packages' => 'packages#grid', as: :packages_grid
@@ -34,29 +34,49 @@ Rails.application.routes.draw do
   get 'my/screenshots'
   get 'my/moderate_list', as: :moderate_list
   get 'my/logs', as: :logs
-  get 'package/:name' => 'packages#details', as: :package, name: /[^\/]+/
+  get 'package/:name' => 'packages#details', as: :package, name: %r{[^/]+}
   # get 'package_reviews/:name' => 'packages#reviews', as: :package_reviews, name: /[^\/]+/
   get 'upload', to: redirect('/packages'), as: :upload_legacy # legacy upload form
-  post 'uploadfile' => 'packages#legacy_uploadfile', name: /[^\/]+/
-  get 'upload/:name' => 'packages#upload', as: :upload, name: /[^\/]+/
-  get 'upload/:name/json' => 'packages#upload', as: :upload_json, name: /[^\/]+/, returns: :json
-  post 'upload/:name' => 'packages#upload_receive', as: :upload_receive, name: /[^\/]+/
-  post 'upload/:name/json' => 'packages#upload_receive', as: :upload_receive_json, name: /[^\/]+/, returns: :json
+  post 'uploadfile' => 'packages#legacy_uploadfile', name: %r{[^/]+}
+  get 'upload/:name' => 'packages#upload', as: :upload, name: %r{[^/]+}
+  get 'upload/:name/json' => 'packages#upload', as: :upload_json, name: %r{[^/]+}, returns: :json
+  post 'upload/:name' => 'packages#upload_receive', as: :upload_receive, name: %r{[^/]+}
+  post 'upload/:name/json' => 'packages#upload_receive', as: :upload_receive_json, name: %r{[^/]+},
+       returns: :json
   # TODO: "get" is probably the wrong method to delete a screenshot
   get 'delete_screenshot/:id' => 'packages#delete_screenshot', as: :delete_screenshot
   get 'hide_screenshot/:id' => 'packages#hide_screenshot', as: :hide_screenshot
   get 'unhide_screenshot/:id' => 'packages#unhide_screenshot', as: :unhide_screenshot
-  patch 'update_screenshot_description/:id' => 'packages#update_screenshot_description', as: :update_screenshot_description
-  #post 'report_screenshot/:id' => 'packages#report_screenshot', as: :report_screenshot
+  patch 'update_screenshot_description/:id' => 'packages#update_screenshot_description',
+        as: :update_screenshot_description
+  # post 'report_screenshot/:id' => 'packages#report_screenshot', as: :report_screenshot
   # TODO: "get" is probably the wrong method to delete a screenshot
   get 'approve_screenshot/:id' => 'packages#approve_screenshot', as: :approve_screenshot
   get 'about' => 'welcome#about'
-  get 'thumbnail/:name' => 'packages#thumbnail', as: :thumbnail_image, name: /[^\/]+/
-  get 'thumbnail-404/:name' => 'packages#thumbnail', name: /[^\/]+/
-  get 'thumbnail-with-version/:name/:version' => 'packages#thumbnail', name: /[^\/]+/, version: /\d.*/
-  get 'screenshot/:name' => 'packages#screenshot', as: :screenshot_image, name: /[^\/]+/
-  get 'screenshot-404/:name' => 'packages#screenshot', name: /[^\/]+/
-  get 'screenshot-with-version/:name/:version' => 'packages#screenshot', name: /[^\/]+/, version: /\d.*/
+
+  get 'thumbnail/:name' => 'packages#send_image', as: :thumbnail_image, name: %r{[^/]+},
+      defaults: { size: :thumb }
+  get 'thumbnail-404/:name' => 'packages#send_image', name: %r{[^/]+}
+  get 'thumbnail-with-version/:name/:version' => 'packages#send_image', name: %r{[^/]+},
+      version: /\d.*/
+
+  # Return small image for a specific package
+  # TODO: needed at all?
+  get 'small/:name' => 'packages#send_image', as: :small_image, name: %r{[^/]+},
+      defaults: { size: :small }
+  # Return small image by specific screenshot_id
+  get 'small/:name/:screenshot_id' => 'packages#send_image', as: :small_image_with_id, name: %r{[^/]+},
+      defaults: { size: :small }
+
+  # Return large image for a specific package
+  get 'screenshot/:name' => 'packages#send_image', as: :screenshot_image, name: %r{[^/]+},
+      defaults: { size: :large }
+  # Return large image by specific screenshot_id
+  get 'screenshot/:name/:screenshot_id' => 'packages#send_image', as: :screenshot_image_with_id, name: %r{[^/]+},
+      defaults: { size: :large }
+  get 'screenshot-404/:name' => 'packages#send_image', name: %r{[^/]+}
+  get 'screenshot-with-version/:name/:version' => 'packages#send_image', name: %r{[^/]+},
+      version: /\d.*/
 
   # Legacy URLs
   get 'with_screenshots', to: redirect('/packages?show=with')
@@ -65,14 +85,15 @@ Rails.application.routes.draw do
   get 'json/package/:name' => 'json#package', as: :json_package, defaults: { format: :json }
   get 'json/packages' => 'json#packages', as: :json_packages, defaults: { format: :json }
   get 'json/screenshots' => 'json#screenshots', as: :json_screenshots, defaults: { format: :json }
-  get 'json/packages-without-screenshots' => 'json#packages_without_screenshots', defaults: { format: :json }
+  get 'json/packages-without-screenshots' => 'json#packages_without_screenshots',
+      defaults: { format: :json }
 
   # The priority is based upon order of creation: first created -> highest priority.
   # See how all your routes lay out with "rake routes".
 
   # You can have the root of your site routed with "root"
   root 'welcome#home'
-  #root to: 'packages#home'
+  # root to: 'packages#home'
 
   # Example of regular route:
   #   get 'products/:id' => 'catalog#view'