jro_apps/redmine Commit - r2600:15a14e55cdb9

Returns a 404 error when trying to view/download an attachment that can't be read from disk....

Jean-Philippe Lang -

r2600:15a14e55cdb9

parent child

Context file:

r2600:15a14e55cdb9

app/controllers/attachments_controller.rb +6 -1

             class AttachmentsController < ApplicationController
               before_filter :find_project
-              before_filter :read_authorize, :except => :destroy
+              before_filter :file_readable, :read_authorize, :except => :destroy
               before_filter :delete_authorize, :only => :destroy
               verify :method => :post, :only => :destroy
                 render_404
               end
+              # Checks that the file exists and is readable
+              def file_readable
+                @attachment.readable? ? true : render_404
+              end
               def read_authorize
                 @attachment.visible? ? true : deny_access
               end

app/models/attachment.rb +5 0

                 self.filename =~ /\.(patch|diff)$/i
               end
+              # Returns true if the file is readable
+              def readable?
+                File.readable?(diskfile)
+              end
             private
               def sanitize_filename(value)
                 # get only the filename, not the whole path

test/functional/attachments_controller_test.rb +7 -2

             class AttachmentsControllerTest < Test::Unit::TestCase
-              fixtures :users, :projects, :roles, :members, :enabled_modules, :issues, :attachments,
+              fixtures :users, :projects, :roles, :members, :enabled_modules, :issues, :trackers, :attachments,
-                       :versions, :wiki_pages, :wikis
+                       :versions, :wiki_pages, :wikis, :documents
               def setup
                 @controller = AttachmentsController.new
                 assert_equal 'application/x-ruby', @response.content_type
               end
+              def test_download_missing_file
+                get :download, :id => 2
+                assert_response 404
+              end
               def test_anonymous_on_private_private
                 get :download, :id => 7
                 assert_redirected_to '/login?back_url=http%3A%2F%2Ftest.host%2Fattachments%2Fdownload%2F7'

General Comments 0

You need to be logged in to leave comments. Login now

No TODOs yet

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages