diff options
author | Douwe Maan <douwe@gitlab.com> | 2015-02-20 13:13:48 +0100 |
---|---|---|
committer | Douwe Maan <douwe@gitlab.com> | 2015-02-20 13:13:48 +0100 |
commit | 00ca490259de684f4240de4f61728b8eaefbb13e (patch) | |
tree | 1b27729d864898dc8c87473359ad642b7432ce3b /app/controllers/uploads_controller.rb | |
parent | 4310431ee73fdd6aa3874aaccc0a901252e7f61f (diff) | |
download | gitlab-ce-00ca490259de684f4240de4f61728b8eaefbb13e.tar.gz |
Use controllers to serve uploads, with XSS prevention and access control.
Diffstat (limited to 'app/controllers/uploads_controller.rb')
-rw-r--r-- | app/controllers/uploads_controller.rb | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/app/controllers/uploads_controller.rb b/app/controllers/uploads_controller.rb new file mode 100644 index 00000000000..d5877977258 --- /dev/null +++ b/app/controllers/uploads_controller.rb @@ -0,0 +1,17 @@ +class UploadsController < ApplicationController + def show + model = params[:model].camelize.constantize.find(params[:id]) + uploader = model.send(params[:mounted_as]) + + if uploader.file_storage? + if !model.respond_to?(:project) || can?(current_user, :read_project, model.project) + disposition = uploader.image? ? 'inline' : 'attachment' + send_file uploader.file.path, disposition: disposition + else + not_found! + end + else + redirect_to uploader.url + end + end +end |