BigW Consortium Gitlab

Commit 305725f8 by Douwe Maan

Correctly handle blocked users.

parent dccd79d2
class Projects::UploadsController < Projects::ApplicationController class Projects::UploadsController < Projects::ApplicationController
layout 'project' layout 'project'
skip_before_filter :project, :repository, :authenticate_user!, only: [:show] skip_before_filter :authenticate_user!, :reject_blocked!, :project, :repository, only: [:show]
before_filter :authenticate_user!, :reject_blocked!, :project, :repository, only: [:show], unless: :image?
before_filter :authorize_uploads, only: [:show]
def create def create
link_to_file = ::Projects::UploadService.new(project, params[:file]). link_to_file = ::Projects::UploadService.new(project, params[:file]).
...@@ -23,32 +22,32 @@ class Projects::UploadsController < Projects::ApplicationController ...@@ -23,32 +22,32 @@ class Projects::UploadsController < Projects::ApplicationController
end end
def show def show
uploader = get_file
return not_found! if uploader.nil? || !uploader.file.exists? return not_found! if uploader.nil? || !uploader.file.exists?
disposition = uploader.image? ? 'inline' : 'attachment' disposition = uploader.image? ? 'inline' : 'attachment'
send_file uploader.file.path, disposition: disposition send_file uploader.file.path, disposition: disposition
end end
def get_file def uploader
return @uploader if defined?(@uploader)
namespace = params[:namespace_id] namespace = params[:namespace_id]
id = params[:project_id] id = params[:project_id]
file_project = Project.find_with_namespace("#{namespace}/#{id}") file_project = Project.find_with_namespace("#{namespace}/#{id}")
return nil if file_project.nil? if file_project.nil?
@uploader = nil
return
end
uploader = FileUploader.new(file_project, params[:secret]) @uploader = FileUploader.new(file_project, params[:secret])
uploader.retrieve_from_store!(params[:filename]) @uploader.retrieve_from_store!(params[:filename])
uploader @uploader
end end
def authorize_uploads def image?
uploader = get_file uploader && uploader.file.exists? && uploader.image?
unless uploader && uploader.image?
project
end
end end
end end
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment