BigW Consortium Gitlab

help_controller.rb 2.5 KB
Newer Older
1
class HelpController < ApplicationController
2
  skip_before_action :authenticate_user!, :reject_blocked!
3

4
  layout 'help'
5

6
  def index
7
    @help_index = File.read(Rails.root.join('doc', 'README.md'))
8

9
    # Prefix Markdown links with `help/` unless they are external links
10 11 12 13
    # See http://rubular.com/r/X3baHTbPO2
    @help_index.gsub!(%r{(?<delim>\]\()(?!.+://)(?!/)(?<link>[^\)\(]+\))}) do
      "#{$~[:delim]}#{Gitlab.config.gitlab.relative_url_root}/help/#{$~[:link]}"
    end
14
  end
Dmitriy Zaporozhets committed
15

16
  def show
Connor Shea committed
17
    @path = clean_path_info(path_params[:path])
18

19 20
    respond_to do |format|
      format.any(:markdown, :md, :html) do
21
        # Note: We are purposefully NOT using `Rails.root.join`
22
        path = File.join(Rails.root, 'doc', "#{@path}.md")
23 24 25 26 27 28 29 30 31 32 33 34

        if File.exist?(path)
          @markdown = File.read(path)

          render 'show.html.haml'
        else
          # Force template to Haml
          render 'errors/not_found.html.haml', layout: 'errors', status: 404
        end
      end

      # Allow access to images in the doc folder
35
      format.any(:png, :gif, :jpeg, :mp4) do
36
        # Note: We are purposefully NOT using `Rails.root.join`
37
        path = File.join(Rails.root, 'doc', "#{@path}.#{params[:format]}")
38 39 40 41 42 43 44 45 46 47

        if File.exist?(path)
          send_file(path, disposition: 'inline')
        else
          head :not_found
        end
      end

      # Any other format we don't recognize, just respond 404
      format.any { head :not_found }
48 49 50
    end
  end

51
  def shortcuts
52
  end
53 54

  def ui
55
    @user = User.new(id: 0, name: 'John Doe', username: '@johndoe')
56
  end
57

58 59
  private

60
  def path_params
61
    params.require(:path)
62 63 64 65

    params
  end

66 67
  PATH_SEPS = Regexp.union(*[::File::SEPARATOR, ::File::ALT_SEPARATOR].compact)

68 69
  # Taken from ActionDispatch::FileHandler
  # Cleans up the path, to prevent directory traversal outside the doc folder.
70
  def clean_path_info(path_info)
71
    parts = path_info.split(PATH_SEPS)
72 73 74

    clean = []

75
    # Walk over each part of the path
76
    parts.each do |part|
77
      # Turn `one//two` or `one/./two` into `one/two`.
78
      next if part.empty? || part == '.'
79 80 81 82 83 84 85 86

      if part == '..'
        # Turn `one/two/../` into `one`
        clean.pop
      else
        # Add simple folder names to the clean path.
        clean << part
      end
87 88
    end

89 90
    # If the path was an absolute path (i.e. `/` or `/one/two`),
    # add `/` to the front of the clean path.
91 92
    clean.unshift '/' if parts.empty? || parts.first.empty?

93
    # Join all the clean path parts by the path separator.
94 95
    ::File.join(*clean)
  end
96
end