##// END OF EJS Templates
jro_apps » redmine
RSS
AttachmentsController now handles attachments deletion....
Jean-Philippe Lang -
r2114:5d2899ee1b3e
parent child
Show More
Side by Side Unified
Context file:
r2114:5d2899ee1b3e Loading diff...:
Show file before | Show file after | Hide comments
@@ -0,0 +1,2
1 require File.dirname(__FILE__) + '/lib/acts_as_attachable'
2 ActiveRecord::Base.send(:include, Redmine::Acts::Attachable)
Show file before | Show file after | Hide comments
@@ -0,0 +1,57
1 # Redmine - project management software
2 # Copyright (C) 2006-2008 Jean-Philippe Lang
3 #
4 # This program is free software; you can redistribute it and/or
5 # modify it under the terms of the GNU General Public License
6 # as published by the Free Software Foundation; either version 2
7 # of the License, or (at your option) any later version.
8 #
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
13 #
14 # You should have received a copy of the GNU General Public License
15 # along with this program; if not, write to the Free Software
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17
18 module Redmine
19 module Acts
20 module Attachable
21 def self.included(base)
22 base.extend ClassMethods
23 end
24
25 module ClassMethods
26 def acts_as_attachable(options = {})
27 cattr_accessor :attachable_options
28 self.attachable_options = {}
29 attachable_options[:view_permission] = options.delete(:view_permission) || "view_#{self.name.pluralize.underscore}".to_sym
30 attachable_options[:delete_permission] = options.delete(:delete_permission) || "edit_#{self.name.pluralize.underscore}".to_sym
31
32 has_many :attachments, options.merge(:as => :container,
33 :order => "#{Attachment.table_name}.created_on",
34 :dependent => :destroy)
35 send :include, Redmine::Acts::Attachable::InstanceMethods
36 end
37 end
38
39 module InstanceMethods
40 def self.included(base)
41 base.extend ClassMethods
42 end
43
44 def attachments_visible?(user=User.current)
45 user.allowed_to?(self.class.attachable_options[:view_permission], self.project)
46 end
47
48 def attachments_deletable?(user=User.current)
49 user.allowed_to?(self.class.attachable_options[:delete_permission], self.project)
50 end
51
52 module ClassMethods
53 end
54 end
55 end
56 end
57 end
Show file before | Show file after | Hide comments
@@ -1,5 +1,5
1 # redMine - project management software
2 # Copyright (C) 2006-2007 Jean-Philippe Lang
1 # Redmine - project management software
2 # Copyright (C) 2006-2008 Jean-Philippe Lang
3 3 #
4 4 # This program is free software; you can redistribute it and/or
5 5 # modify it under the terms of the GNU General Public License
@@ -17,7 +17,11
17 17
18 18 class AttachmentsController < ApplicationController
19 19 before_filter :find_project
20
20 before_filter :read_authorize, :except => :destroy
21 before_filter :delete_authorize, :only => :destroy
22
23 verify :method => :post, :only => :destroy
24
21 25 def show
22 26 if @attachment.is_diff?
23 27 @diff = File.new(@attachment.diskfile, "rb").read
@@ -37,19 +41,32 class AttachmentsController < ApplicationController
37 41 send_file @attachment.diskfile, :filename => filename_for_content_disposition(@attachment.filename),
38 42 :type => @attachment.content_type,
39 43 :disposition => (@attachment.image? ? 'inline' : 'attachment')
44
40 45 end
41
46
47 def destroy
48 # Make sure association callbacks are called
49 @attachment.container.attachments.delete(@attachment)
50 redirect_to :back
51 rescue ::ActionController::RedirectBackError
52 redirect_to :controller => 'projects', :action => 'show', :id => @project
53 end
54
42 55 private
43 56 def find_project
44 57 @attachment = Attachment.find(params[:id])
45 58 # Show 404 if the filename in the url is wrong
46 59 raise ActiveRecord::RecordNotFound if params[:filename] && params[:filename] != @attachment.filename
47
48 60 @project = @attachment.project
49 permission = @attachment.container.is_a?(Version) ? :view_files : "view_#{@attachment.container.class.name.underscore.pluralize}".to_sym
50 allowed = User.current.allowed_to?(permission, @project)
51 allowed ? true : (User.current.logged? ? render_403 : require_login)
52 61 rescue ActiveRecord::RecordNotFound
53 62 render_404
54 63 end
64
65 def read_authorize
66 @attachment.visible? ? true : deny_access
67 end
68
69 def delete_authorize
70 @attachment.deletable? ? true : deny_access
71 end
55 72 end
Show file before | Show file after | Hide comments
@@ -70,11 +70,6 class DocumentsController < ApplicationController
70 70 Mailer.deliver_attachments_added(attachments) if !attachments.empty? && Setting.notified_events.include?('document_added')
71 71 redirect_to :action => 'show', :id => @document
72 72 end
73
74 def destroy_attachment
75 @document.attachments.find(params[:attachment_id]).destroy
76 redirect_to :action => 'show', :id => @document
77 end
78 73
79 74 private
80 75 def find_project
Show file before | Show file after | Hide comments
@@ -18,7 +18,7
18 18 class IssuesController < ApplicationController
19 19 menu_item :new_issue, :only => :new
20 20
21 before_filter :find_issue, :only => [:show, :edit, :reply, :destroy_attachment]
21 before_filter :find_issue, :only => [:show, :edit, :reply]
22 22 before_filter :find_issues, :only => [:bulk_edit, :move, :destroy]
23 23 before_filter :find_project, :only => [:new, :update_form, :preview]
24 24 before_filter :authorize, :except => [:index, :changes, :gantt, :calendar, :preview, :update_form, :context_menu]
@@ -313,17 +313,6 class IssuesController < ApplicationController
313 313 @issues.each(&:destroy)
314 314 redirect_to :action => 'index', :project_id => @project
315 315 end
316
317 def destroy_attachment
318 a = @issue.attachments.find(params[:attachment_id])
319 a.destroy
320 journal = @issue.init_journal(User.current)
321 journal.details << JournalDetail.new(:property => 'attachment',
322 :prop_key => a.id,
323 :old_value => a.filename)
324 journal.save
325 redirect_to :action => 'show', :id => @issue
326 end
327 316
328 317 def gantt
329 318 @gantt = Redmine::Helpers::Gantt.new(params)
Show file before | Show file after | Hide comments
@@ -37,12 +37,6 class VersionsController < ApplicationController
37 37 redirect_to :controller => 'projects', :action => 'settings', :tab => 'versions', :id => @project
38 38 end
39 39
40 def destroy_file
41 @version.attachments.find(params[:attachment_id]).destroy
42 flash[:notice] = l(:notice_successful_delete)
43 redirect_to :controller => 'projects', :action => 'list_files', :id => @project
44 end
45
46 40 def status_by
47 41 respond_to do |format|
48 42 format.html { render :action => 'show' }
Show file before | Show file after | Hide comments
@@ -20,7 +20,7 require 'diff'
20 20 class WikiController < ApplicationController
21 21 before_filter :find_wiki, :authorize
22 22
23 verify :method => :post, :only => [:destroy, :destroy_attachment, :protect], :redirect_to => { :action => :index }
23 verify :method => :post, :only => [:destroy, :protect], :redirect_to => { :action => :index }
24 24
25 25 helper :attachments
26 26 include AttachmentsHelper
@@ -187,13 +187,6 class WikiController < ApplicationController
187 187 redirect_to :action => 'index', :page => @page.title
188 188 end
189 189
190 def destroy_attachment
191 @page = @wiki.find_page(params[:page])
192 return render_403 unless editable?
193 @page.attachments.find(params[:attachment_id]).destroy
194 redirect_to :action => 'index', :page => @page.title
195 end
196
197 190 private
198 191
199 192 def find_wiki
Show file before | Show file after | Hide comments
@@ -16,10 +16,15
16 16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17 17
18 18 module AttachmentsHelper
19 # displays the links to a collection of attachments
20 def link_to_attachments(attachments, options = {})
21 if attachments.any?
22 render :partial => 'attachments/links', :locals => {:attachments => attachments, :options => options}
19 # Displays view/delete links to the attachments of the given object
20 # Options:
21 # :author -- author names are not displayed if set to false
22 def link_to_attachments(container, options = {})
23 options.assert_valid_keys(:author)
24
25 if container.attachments.any?
26 options = {:deletable => container.attachments_deletable?, :author => true}.merge(options)
27 render :partial => 'attachments/links', :locals => {:attachments => container.attachments, :options => options}
23 28 end
24 29 end
25 30
Show file before | Show file after | Hide comments
@@ -98,6 +98,14 class Attachment < ActiveRecord::Base
98 98 container.project
99 99 end
100 100
101 def visible?(user=User.current)
102 container.attachments_visible?(user)
103 end
104
105 def deletable?(user=User.current)
106 container.attachments_deletable?(user)
107 end
108
101 109 def image?
102 110 self.filename =~ /\.(jpe?g|gif|png)$/i
103 111 end
Show file before | Show file after | Hide comments
@@ -18,7 +18,7
18 18 class Document < ActiveRecord::Base
19 19 belongs_to :project
20 20 belongs_to :category, :class_name => "Enumeration", :foreign_key => "category_id"
21 has_many :attachments, :as => :container, :dependent => :destroy
21 acts_as_attachable :delete_permission => :manage_documents
22 22
23 23 acts_as_searchable :columns => ['title', "#{table_name}.description"], :include => :project
24 24 acts_as_event :title => Proc.new {|o| "#{l(:label_document)}: #{o.title}"},
Show file before | Show file after | Hide comments
@@ -26,13 +26,13 class Issue < ActiveRecord::Base
26 26 belongs_to :category, :class_name => 'IssueCategory', :foreign_key => 'category_id'
27 27
28 28 has_many :journals, :as => :journalized, :dependent => :destroy
29 has_many :attachments, :as => :container, :dependent => :destroy
30 29 has_many :time_entries, :dependent => :delete_all
31 30 has_and_belongs_to_many :changesets, :order => "#{Changeset.table_name}.committed_on ASC, #{Changeset.table_name}.id ASC"
32 31
33 32 has_many :relations_from, :class_name => 'IssueRelation', :foreign_key => 'issue_from_id', :dependent => :delete_all
34 33 has_many :relations_to, :class_name => 'IssueRelation', :foreign_key => 'issue_to_id', :dependent => :delete_all
35 34
35 acts_as_attachable :after_remove => :attachment_removed
36 36 acts_as_customizable
37 37 acts_as_watchable
38 38 acts_as_searchable :columns => ['subject', "#{table_name}.description", "#{Journal.table_name}.notes"],
@@ -261,4 +261,15 class Issue < ActiveRecord::Base
261 261 def to_s
262 262 "#{tracker} ##{id}: #{subject}"
263 263 end
264
265 private
266
267 # Callback on attachment deletion
268 def attachment_removed(obj)
269 journal = init_journal(User.current)
270 journal.details << JournalDetail.new(:property => 'attachment',
271 :prop_key => obj.id,
272 :old_value => obj.filename)
273 journal.save
274 end
264 275 end
Show file before | Show file after | Hide comments
@@ -19,7 +19,7 class Message < ActiveRecord::Base
19 19 belongs_to :board
20 20 belongs_to :author, :class_name => 'User', :foreign_key => 'author_id'
21 21 acts_as_tree :counter_cache => :replies_count, :order => "#{Message.table_name}.created_on ASC"
22 has_many :attachments, :as => :container, :dependent => :destroy
22 acts_as_attachable
23 23 belongs_to :last_reply, :class_name => 'Message', :foreign_key => 'last_reply_id'
24 24
25 25 acts_as_searchable :columns => ['subject', 'content'],
Show file before | Show file after | Hide comments
@@ -19,7 +19,8 class Version < ActiveRecord::Base
19 19 before_destroy :check_integrity
20 20 belongs_to :project
21 21 has_many :fixed_issues, :class_name => 'Issue', :foreign_key => 'fixed_version_id'
22 has_many :attachments, :as => :container, :dependent => :destroy
22 acts_as_attachable :view_permission => :view_files,
23 :delete_permission => :manage_files
23 24
24 25 validates_presence_of :name
25 26 validates_uniqueness_of :name, :scope => [:project_id]
Show file before | Show file after | Hide comments
@@ -21,7 +21,7 require 'enumerator'
21 21 class WikiPage < ActiveRecord::Base
22 22 belongs_to :wiki
23 23 has_one :content, :class_name => 'WikiContent', :foreign_key => 'page_id', :dependent => :destroy
24 has_many :attachments, :as => :container, :dependent => :destroy
24 acts_as_attachable :delete_permission => :delete_wiki_pages_attachments
25 25 acts_as_tree :order => 'title'
26 26
27 27 acts_as_event :title => Proc.new {|o| "#{l(:label_wiki)}: #{o.title}"},
@@ -111,6 +111,10 class WikiPage < ActiveRecord::Base
111 111 def editable_by?(usr)
112 112 !protected? || usr.allowed_to?(:protect_wiki_pages, wiki.project)
113 113 end
114
115 def attachments_deletable?(usr=User.current)
116 editable_by?(usr) && super(usr)
117 end
114 118
115 119 def parent_title
116 120 @parent_title || (self.parent && self.parent.pretty_title)
Show file before | Show file after | Hide comments
@@ -3,14 +3,14
3 3 <p><%= link_to_attachment attachment, :class => 'icon icon-attachment' -%>
4 4 <%= h(" - #{attachment.description}") unless attachment.description.blank? %>
5 5 <span class="size">(<%= number_to_human_size attachment.filesize %>)</span>
6 <% if options[:delete_url] %>
7 <%= link_to image_tag('delete.png'), options[:delete_url].update({:attachment_id => attachment}),
6 <% if options[:deletable] %>
7 <%= link_to image_tag('delete.png'), {:controller => 'attachments', :action => 'destroy', :id => attachment},
8 8 :confirm => l(:text_are_you_sure),
9 9 :method => :post,
10 10 :class => 'delete',
11 11 :title => l(:button_delete) %>
12 12 <% end %>
13 <% unless options[:no_author] %>
13 <% if options[:author] %>
14 14 <span class="author"><%= attachment.author %>, <%= format_time(attachment.created_on) %></span>
15 15 <% end %>
16 16 </p>
Show file before | Show file after | Hide comments
@@ -12,7 +12,7
12 12 </div>
13 13
14 14 <h3><%= l(:label_attachment_plural) %></h3>
15 <%= link_to_attachments @attachments, :delete_url => (authorize_for('documents', 'destroy_attachment') ? {:controller => 'documents', :action => 'destroy_attachment', :id => @document} : nil) %>
15 <%= link_to_attachments @document %>
16 16
17 17 <% if authorize_for('documents', 'add_attachment') %>
18 18 <p><%= link_to l(:label_attachment_new), {}, :onclick => "Element.show('add_attachment_form'); Element.hide(this); Element.scrollTo('add_attachment_form'); return false;",
Show file before | Show file after | Hide comments
@@ -67,9 +67,7 end %>
67 67 <%= textilizable @issue, :description, :attachments => @issue.attachments %>
68 68 </div>
69 69
70 <% if @issue.attachments.any? %>
71 <%= link_to_attachments @issue.attachments, :delete_url => (authorize_for('issues', 'destroy_attachment') ? {:controller => 'issues', :action => 'destroy_attachment', :id => @issue} : nil) %>
72 <% end %>
70 <%= link_to_attachments @issue %>
73 71
74 72 <% if authorize_for('issue_relations', 'new') || @issue.relations.any? %>
75 73 <hr />
Show file before | Show file after | Hide comments
@@ -15,7 +15,7
15 15 <div class="wiki">
16 16 <%= textilizable(@topic.content, :attachments => @topic.attachments) %>
17 17 </div>
18 <%= link_to_attachments @topic.attachments, :no_author => true %>
18 <%= link_to_attachments @topic, :author => false %>
19 19 </div>
20 20 <br />
21 21
@@ -31,7 +31,7
31 31 <div class="message reply">
32 32 <h4><%=h message.subject %> - <%= authoring message.created_on, message.author %></h4>
33 33 <div class="wiki"><%= textilizable message, :content, :attachments => message.attachments %></div>
34 <%= link_to_attachments message.attachments, :no_author => true %>
34 <%= link_to_attachments message, :author => false %>
35 35 </div>
36 36 <% end %>
37 37 <% end %>
Show file before | Show file after | Hide comments
@@ -4,7 +4,7
4 4
5 5 <h2><%=l(:label_attachment_plural)%></h2>
6 6
7 <% delete_allowed = authorize_for('versions', 'destroy_file') %>
7 <% delete_allowed = User.current.allowed_to?(:manage_files, @project) %>
8 8
9 9 <table class="list">
10 10 <thead><tr>
@@ -30,7 +30,8
30 30 <td align="center"><small><%= file.digest %></small></td>
31 31 <% if delete_allowed %>
32 32 <td align="center">
33 <%= link_to_if_authorized image_tag('delete.png'), {:controller => 'versions', :action => 'destroy_file', :id => version, :attachment_id => file}, :confirm => l(:text_are_you_sure), :method => :post %>
33 <%= link_to image_tag('delete.png'), {:controller => 'attachments', :action => 'destroy', :id => file},
34 :confirm => l(:text_are_you_sure), :method => :post %>
34 35 </td>
35 36 <% end %>
36 37 </tr>
Show file before | Show file after | Hide comments
@@ -28,7 +28,7
28 28
29 29 <%= render(:partial => "wiki/content", :locals => {:content => @content}) %>
30 30
31 <%= link_to_attachments @page.attachments, :delete_url => ((@editable && authorize_for('wiki', 'destroy_attachment')) ? {:controller => 'wiki', :action => 'destroy_attachment', :page => @page.title} : nil) %>
31 <%= link_to_attachments @page %>
32 32
33 33 <% if @editable && authorize_for('wiki', 'add_attachment') %>
34 34 <p><%= link_to l(:label_attachment_new), {}, :onclick => "Element.show('add_attachment_form'); Element.hide(this); Element.scrollTo('add_attachment_form'); return false;",
Show file before | Show file after | Hide comments
@@ -35,7 +35,7 Redmine::AccessControl.map do |map|
35 35 :queries => :index,
36 36 :reports => :issue_report}, :public => true
37 37 map.permission :add_issues, {:issues => :new}
38 map.permission :edit_issues, {:issues => [:edit, :reply, :bulk_edit, :destroy_attachment]}
38 map.permission :edit_issues, {:issues => [:edit, :reply, :bulk_edit]}
39 39 map.permission :manage_issue_relations, {:issue_relations => [:new, :destroy]}
40 40 map.permission :add_issue_notes, {:issues => [:edit, :reply]}
41 41 map.permission :edit_issue_notes, {:journals => :edit}, :require => :loggedin
@@ -67,12 +67,12 Redmine::AccessControl.map do |map|
67 67 end
68 68
69 69 map.project_module :documents do |map|
70 map.permission :manage_documents, {:documents => [:new, :edit, :destroy, :add_attachment, :destroy_attachment]}, :require => :loggedin
70 map.permission :manage_documents, {:documents => [:new, :edit, :destroy, :add_attachment]}, :require => :loggedin
71 71 map.permission :view_documents, :documents => [:index, :show, :download]
72 72 end
73 73
74 74 map.project_module :files do |map|
75 map.permission :manage_files, {:projects => :add_file, :versions => :destroy_file}, :require => :loggedin
75 map.permission :manage_files, {:projects => :add_file}, :require => :loggedin
76 76 map.permission :view_files, :projects => :list_files, :versions => :download
77 77 end
78 78
@@ -83,7 +83,7 Redmine::AccessControl.map do |map|
83 83 map.permission :view_wiki_pages, :wiki => [:index, :special]
84 84 map.permission :view_wiki_edits, :wiki => [:history, :diff, :annotate]
85 85 map.permission :edit_wiki_pages, :wiki => [:edit, :preview, :add_attachment]
86 map.permission :delete_wiki_pages_attachments, :wiki => :destroy_attachment
86 map.permission :delete_wiki_pages_attachments, {}
87 87 map.permission :protect_wiki_pages, {:wiki => :protect}, :require => :member
88 88 end
89 89
Show file before | Show file after | Hide comments
@@ -76,4 +76,33 class AttachmentsControllerTest < Test::Unit::TestCase
76 76 get :download, :id => 7
77 77 assert_redirected_to 'account/login'
78 78 end
79
80 def test_destroy_issue_attachment
81 issue = Issue.find(3)
82 @request.session[:user_id] = 2
83
84 assert_difference 'issue.attachments.count', -1 do
85 post :destroy, :id => 1
86 end
87 # no referrer
88 assert_redirected_to 'projects/show/ecookbook'
89 assert_nil Attachment.find_by_id(1)
90 j = issue.journals.find(:first, :order => 'created_on DESC')
91 assert_equal 'attachment', j.details.first.property
92 assert_equal '1', j.details.first.prop_key
93 assert_equal 'error281.txt', j.details.first.old_value
94 end
95
96 def test_destroy_wiki_page_attachment
97 @request.session[:user_id] = 2
98 assert_difference 'Attachment.count', -1 do
99 post :destroy, :id => 3
100 end
101 end
102
103 def test_destroy_without_permission
104 post :destroy, :id => 3
105 assert_redirected_to '/login'
106 assert Attachment.find_by_id(3)
107 end
79 108 end
Show file before | Show file after | Hide comments
@@ -713,17 +713,4 class IssuesControllerTest < Test::Unit::TestCase
713 713 assert_equal 2, TimeEntry.find(1).issue_id
714 714 assert_equal 2, TimeEntry.find(2).issue_id
715 715 end
716
717 def test_destroy_attachment
718 issue = Issue.find(3)
719 a = issue.attachments.size
720 @request.session[:user_id] = 2
721 post :destroy_attachment, :id => 3, :attachment_id => 1
722 assert_redirected_to 'issues/show/3'
723 assert_nil Attachment.find_by_id(1)
724 issue.reload
725 assert_equal((a-1), issue.attachments.size)
726 j = issue.journals.find(:first, :order => 'created_on DESC')
727 assert_equal 'attachment', j.details.first.property
728 end
729 716 end
Show file before | Show file after | Hide comments
@@ -251,11 +251,4 class WikiControllerTest < Test::Unit::TestCase
251 251 assert_response :success
252 252 assert_template 'edit'
253 253 end
254
255 def test_destroy_attachment
256 @request.session[:user_id] = 2
257 assert_difference 'Attachment.count', -1 do
258 post :destroy_attachment, :id => 1, :page => 'Page_with_an_inline_image', :attachment_id => 3
259 end
260 end
261 254 end
General Comments 0
You need to be logged in to leave comments. Login now