diff options
author | Douwe Maan <douwe@gitlab.com> | 2015-02-20 13:13:48 +0100 |
---|---|---|
committer | Douwe Maan <douwe@gitlab.com> | 2015-02-20 13:13:48 +0100 |
commit | 00ca490259de684f4240de4f61728b8eaefbb13e (patch) | |
tree | 1b27729d864898dc8c87473359ad642b7432ce3b /app | |
parent | 4310431ee73fdd6aa3874aaccc0a901252e7f61f (diff) | |
download | gitlab-ce-00ca490259de684f4240de4f61728b8eaefbb13e.tar.gz |
Use controllers to serve uploads, with XSS prevention and access control.
Diffstat (limited to 'app')
-rw-r--r-- | app/controllers/projects/uploads_controller.rb | 19 | ||||
-rw-r--r-- | app/controllers/uploads_controller.rb | 17 |
2 files changed, 36 insertions, 0 deletions
diff --git a/app/controllers/projects/uploads_controller.rb b/app/controllers/projects/uploads_controller.rb new file mode 100644 index 00000000000..b922b56418a --- /dev/null +++ b/app/controllers/projects/uploads_controller.rb @@ -0,0 +1,19 @@ +class Projects::UploadsController < Projects::ApplicationController + layout "project" + + before_filter :project + + def show + path = File.join(project.path_with_namespace, params[:secret]) + uploader = FileUploader.new('uploads', path) + + uploader.retrieve_from_store!(params[:filename]) + + if uploader.file.exists? + # Right now, these are always images, so we can safely render them inline. + send_file uploader.file.path, disposition: 'inline' + else + not_found! + end + end +end
\ No newline at end of file diff --git a/app/controllers/uploads_controller.rb b/app/controllers/uploads_controller.rb new file mode 100644 index 00000000000..d5877977258 --- /dev/null +++ b/app/controllers/uploads_controller.rb @@ -0,0 +1,17 @@ +class UploadsController < ApplicationController + def show + model = params[:model].camelize.constantize.find(params[:id]) + uploader = model.send(params[:mounted_as]) + + if uploader.file_storage? + if !model.respond_to?(:project) || can?(current_user, :read_project, model.project) + disposition = uploader.image? ? 'inline' : 'attachment' + send_file uploader.file.path, disposition: disposition + else + not_found! + end + else + redirect_to uploader.url + end + end +end |