Fix handling of user session and user-uploaded images

This commit is contained in:
Christoph Haas 2020-08-17 01:49:20 +02:00
parent b70a9f1a07
commit eb8f27d9e6
2 changed files with 9 additions and 16 deletions

View file

@ -50,27 +50,18 @@ class PackagesController < ApplicationController
# Check if the image was valid
if new_screenshot.valid?
new_screenshot.uploaderhash = session[:token]
new_screenshot.uploaderip = session[:ip]
new_screenshot.uploaderhash = session.id.to_s
new_screenshot.uploaderip = request.remote_ip
new_screenshot.version = @package.version
# Can the upload get approved automatically?
if user_signed_in?
new_screenshot.user = current_user
new_screenshot.approve! if auto_approve?
# For anonymous uploads remember which screenshots have been
# uploaded. If the user logs in later the screenshots will
# be linked to their account.
else
# Save the screenshot database record to get an ID
new_screenshot.save!
(session[:uploaded_screenshots] ||= []) << new_screenshot.id
Log.log "Anonymously uploaded screenshots #{new_screenshot.id} remembered in cookie session to assign it to a user later."
end
new_screenshot.save
Log.log "Screenshot #{new_screenshot.id} uploaded successfully from #{session[:ip]}. User has token #{session[:token]} or is #{current_user}"
Log.log "Screenshot #{new_screenshot.id} uploaded successfully. ip=#{session[:ip]}. user-token=#{session[:token]}. user-name=#{current_user}"
@valid_images.push new_screenshot
else

View file

@ -7,12 +7,14 @@ module PackagesHelper
# - all screenshots if the user is an admin
def screenshots_visible_to_user(package)
if user_signed_in? and current_user.is_admin?
# User is an admin
# User is an admin and can view all screenshots
package.screenshots
elsif user_signed_in?
package.screenshots.where(id: (current_user.screenshots.select(:id))) | \
package.screenshots.where(approved: true).order('created_at DESC')
# TODO: User logins and assigned screenshots will come in a later version
# elsif user_signed_in?
# package.screenshots.where(id: (current_user.screenshots.select(:id))) | \
# package.screenshots.where(approved: true).order('created_at DESC')
else
package.screenshots.where(uploaderhash: session.id.to_s) | \
package.screenshots.where(approved: true).order('created_at DESC')
end
end