summaryrefslogtreecommitdiff
path: root/app/controllers/uploads_controller.rb
blob: 509f4f412ca3cf738684e886149e52fbe3a66b92 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
class UploadsController < ApplicationController
  skip_before_action :authenticate_user!
  before_action :find_model, :authorize_access!

  def show
    uploader = @model.send(upload_mount)

    unless uploader.file_storage?
      return redirect_to uploader.url
    end

    unless uploader.file && uploader.file.exists?
      return render_404
    end

    disposition = uploader.image? ? 'inline' : 'attachment'
    send_file uploader.file.path, disposition: disposition
  end

  private

  def find_model
    unless upload_model && upload_mount
      return render_404
    end

    @model = upload_model.find(params[:id])
  end

  def authorize_access!
    authorized =
      case @model
      when Project
        can?(current_user, :read_project, @model)
      when Group
        can?(current_user, :read_group, @model)
      when Note
        can?(current_user, :read_project, @model.project)
      else
        # No authentication required for user avatars.
        true
      end

    return if authorized

    if current_user
      render_404
    else
      authenticate_user!
    end
  end

  def upload_model
    upload_models = {
      "user"    => User,
      "project" => Project,
      "note"    => Note,
      "group"   => Group,
      "appearance" => Appearance
    }

    upload_models[params[:model]]
  end

  def upload_mount
    upload_mounts = %w(avatar attachment file logo header_logo)

    if upload_mounts.include?(params[:mounted_as])
      params[:mounted_as]
    end
  end
end