1 files changed, 37 insertions, 13 deletions
diff --git a/app/controllers/concerns/uploads_actions.rb b/app/controllers/concerns/uploads_actions.rb
index 3dbfabcae8a..16374146ae4 100644
--- a/app/controllers/concerns/uploads_actions.rb
+++ b/app/controllers/concerns/uploads_actions.rb
@@ -1,7 +1,14 @@
 module UploadsActions
+  extend ActiveSupport::Concern
+
   include Gitlab::Utils::StrongMemoize
+  include SendFileUpload
+
+  UPLOAD_MOUNTS = %w(avatar attachment file logo header_logo favicon).freeze
 
-  UPLOAD_MOUNTS = %w(avatar attachment file logo header_logo).freeze
+  included do
+    prepend_before_action :set_html_format, only: :show
+  end
 
   def create
     link_to_file = UploadService.new(model, params[:file], uploader_class).execute
@@ -26,18 +33,27 @@ module UploadsActions
   def show
     return render_404 unless uploader&.exists?
 
-    if uploader.file_storage?
-      disposition = uploader.image_or_video? ? 'inline' : 'attachment'
-      expires_in 0.seconds, must_revalidate: true, private: true
+    expires_in 0.seconds, must_revalidate: true, private: true
 
-      send_file uploader.file.path, disposition: disposition
-    else
-      redirect_to uploader.url
-    end
+    disposition = uploader.image_or_video? ? 'inline' : 'attachment'
+
+    uploaders = [uploader, *uploader.versions.values]
+    uploader = uploaders.find { |version| version.filename == params[:filename] }
+
+    return render_404 unless uploader
+
+    send_upload(uploader, attachment: uploader.filename, disposition: disposition)
   end
 
   private
 
+  # Explicitly set the format.
+  # Otherwise rails 5 will set it from a file extension.
+  # See https://github.com/rails/rails/commit/84e8accd6fb83031e4c27e44925d7596655285f7#diff-2b8f2fbb113b55ca8e16001c393da8f1
+  def set_html_format
+    request.format = :html
+  end
+
   def uploader_class
     raise NotImplementedError
   end
@@ -62,19 +78,27 @@ module UploadsActions
   end
 
   def build_uploader_from_upload
-    return nil unless params[:secret] && params[:filename]
+    return unless uploader = build_uploader
 
-    upload_path = uploader_class.upload_path(params[:secret], params[:filename])
-    upload = Upload.find_by(uploader: uploader_class.to_s, path: upload_path)
+    upload_paths = uploader.upload_paths(params[:filename])
+    upload = Upload.find_by(uploader: uploader_class.to_s, path: upload_paths)
     upload&.build_uploader
   end
 
   def build_uploader_from_params
+    return unless uploader = build_uploader
+
+    uploader.retrieve_from_store!(params[:filename])
+    uploader
+  end
+
+  def build_uploader
+    return unless params[:secret] && params[:filename]
+
     uploader = uploader_class.new(model, secret: params[:secret])
 
-    return nil unless uploader.model_valid?
+    return unless uploader.model_valid?
 
-    uploader.retrieve_from_store!(params[:filename])
     uploader
   end