jro_apps/redmine Commit - r8808:77626ef6fbf2

Adds support for adding attachments to issues through the REST API (#8171)....

Jean-Philippe Lang -

r8808:77626ef6fbf2

parent child

Context file:

r8808:77626ef6fbf2

Collapse all files

app/views/attachments/upload.api.rsb created 644 +3 0

@@ -0,0 +1,3
	1	api.upload do
	2	api.token @attachment.token
	3	end

app/controllers/attachments_controller.rb +27 -3

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class AttachmentsController < ApplicationController
-              before_filter :find_project
+              before_filter :find_project, :except => :upload
-              before_filter :file_readable, :read_authorize, :except => :destroy
+              before_filter :file_readable, :read_authorize, :only => [:show, :download]
               before_filter :delete_authorize, :only => :destroy
+              before_filter :authorize_global, :only => :upload
-              accept_api_auth :show, :download
+              accept_api_auth :show, :download, :upload
               def show
                 respond_to do |format|
                   format.html {
                     if @attachment.is_diff?
                       @diff = File.new(@attachment.diskfile, "rb").read
                       @diff_type = params[:type] || User.current.pref[:diff_type] || 'inline'
                       @diff_type = 'inline' unless %w(inline sbs).include?(@diff_type)
                       # Save diff type as user preference
                       if User.current.logged? && @diff_type != User.current.pref[:diff_type]
                         User.current.pref[:diff_type] = @diff_type
                         User.current.preference.save
                       end
                       render :action => 'diff'
                     elsif @attachment.is_text? && @attachment.filesize <= Setting.file_max_size_displayed.to_i.kilobyte
                       @content = File.new(@attachment.diskfile, "rb").read
                       render :action => 'file'
                     else
                       download
                     end
                   }
                   format.api
                 end
               end
               def download
                 if @attachment.container.is_a?(Version) || @attachment.container.is_a?(Project)
                   @attachment.increment_download
                 end
                 # images are sent inline
                 send_file @attachment.diskfile, :filename => filename_for_content_disposition(@attachment.filename),
                                                 :type => detect_content_type(@attachment),
                                                 :disposition => (@attachment.image? ? 'inline' : 'attachment')
               end
+              def upload
+                # Make sure that API users get used to set this content type
+                # as it won't trigger Rails' automatic parsing of the request body for parameters
+                unless request.content_type == 'application/octet-stream'
+                  render :nothing => true, :status => 406
+                  return
+                end
+                @attachment = Attachment.new(:file => request.body)
+                @attachment.author = User.current
+                @attachment.filename = "test" #ActiveSupport::SecureRandom.hex(16)
+                if @attachment.save
+                  respond_to do |format|
+                    format.api { render :action => 'upload', :status => :created }
+                  end
+                else
+                  respond_to do |format|
+                    format.api { render_validation_errors(@attachment) }
+                  end
+                end
+              end
               verify :method => :delete, :only => :destroy
               def destroy
                 # Make sure association callbacks are called
                 @attachment.container.attachments.delete(@attachment)
                 redirect_to :back
               rescue ::ActionController::RedirectBackError
                 redirect_to :controller => 'projects', :action => 'show', :id => @project
               end
             private
               def find_project
                 @attachment = Attachment.find(params[:id])
                 # Show 404 if the filename in the url is wrong
                 raise ActiveRecord::RecordNotFound if params[:filename] && params[:filename] != @attachment.filename
                 @project = @attachment.project
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               # Checks that the file exists and is readable
               def file_readable
                 @attachment.readable? ? true : render_404
               end
               def read_authorize
                 @attachment.visible? ? true : deny_access
               end
               def delete_authorize
                 @attachment.deletable? ? true : deny_access
               end
               def detect_content_type(attachment)
                 content_type = attachment.content_type
                 if content_type.blank?
                   content_type = Redmine::MimeType.of(attachment.filename)
                 end
                 content_type.to_s
               end
             end

app/controllers/issues_controller.rb +2 -2

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class IssuesController < ApplicationController
               menu_item :new_issue, :only => [:new, :create]
               default_search_scope :issues
               before_filter :find_issue, :only => [:show, :edit, :update]
               before_filter :find_issues, :only => [:bulk_edit, :bulk_update, :move, :perform_move, :destroy]
               before_filter :check_project_uniqueness, :only => [:move, :perform_move]
               before_filter :find_project, :only => [:new, :create]
               before_filter :authorize, :except => [:index]
               before_filter :find_optional_project, :only => [:index]
               before_filter :check_for_default_issue_status, :only => [:new, :create]
               before_filter :build_new_issue_from_params, :only => [:new, :create]
               accept_rss_auth :index, :show
               accept_api_auth :index, :show, :create, :update, :destroy
               rescue_from Query::StatementInvalid, :with => :query_statement_invalid
               helper :journals
               helper :projects
               include ProjectsHelper
               helper :custom_fields
               include CustomFieldsHelper
               helper :issue_relations
               include IssueRelationsHelper
               helper :watchers
               include WatchersHelper
               helper :attachments
               include AttachmentsHelper
               helper :queries
               include QueriesHelper
               helper :repositories
               include RepositoriesHelper
               helper :sort
               include SortHelper
               include IssuesHelper
               helper :timelog
               helper :gantt
               include Redmine::Export::PDF
               verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
               verify :method => :post, :only => :bulk_update, :render => {:nothing => true, :status => :method_not_allowed }
               verify :method => :put, :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
               def index
                 retrieve_query
                 sort_init(@query.sort_criteria.empty? ? [['id', 'desc']] : @query.sort_criteria)
                 sort_update(@query.sortable_columns)
                 if @query.valid?
                   case params[:format]
                   when 'csv', 'pdf'
                     @limit = Setting.issues_export_limit.to_i
                   when 'atom'
                     @limit = Setting.feeds_limit.to_i
                   when 'xml', 'json'
                     @offset, @limit = api_offset_and_limit
                   else
                     @limit = per_page_option
                   end
                   @issue_count = @query.issue_count
                   @issue_pages = Paginator.new self, @issue_count, @limit, params['page']
                   @offset ||= @issue_pages.current.offset
                   @issues = @query.issues(:include => [:assigned_to, :tracker, :priority, :category, :fixed_version],
                                           :order => sort_clause,
                                           :offset => @offset,
                                           :limit => @limit)
                   @issue_count_by_group = @query.issue_count_by_group
                   respond_to do |format|
                     format.html { render :template => 'issues/index', :layout => !request.xhr? }
                     format.api  {
                       Issue.load_relations(@issues) if include_in_api_response?('relations')
                     }
                     format.atom { render_feed(@issues, :title => "#{@project || Setting.app_title}: #{l(:label_issue_plural)}") }
                     format.csv  { send_data(issues_to_csv(@issues, @project, @query, params), :type => 'text/csv; header=present', :filename => 'export.csv') }
                     format.pdf  { send_data(issues_to_pdf(@issues, @project, @query), :type => 'application/pdf', :filename => 'export.pdf') }
                   end
                 else
                   respond_to do |format|
                     format.html { render(:template => 'issues/index', :layout => !request.xhr?) }
                     format.any(:atom, :csv, :pdf) { render(:nothing => true) }
                     format.api { render_validation_errors(@query) }
                   end
                 end
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def show
                 @journals = @issue.journals.find(:all, :include => [:user, :details], :order => "#{Journal.table_name}.created_on ASC")
                 @journals.each_with_index {|j,i| j.indice = i+1}
                 @journals.reverse! if User.current.wants_comments_in_reverse_order?
                 @changesets = @issue.changesets.visible.all
                 @changesets.reverse! if User.current.wants_comments_in_reverse_order?
                 @relations = @issue.relations.select {|r| r.other_issue(@issue) && r.other_issue(@issue).visible? }
                 @allowed_statuses = @issue.new_statuses_allowed_to(User.current)
                 @edit_allowed = User.current.allowed_to?(:edit_issues, @project)
                 @priorities = IssuePriority.active
                 @time_entry = TimeEntry.new(:issue => @issue, :project => @issue.project)
                 respond_to do |format|
                   format.html {
                     retrieve_previous_and_next_issue_ids
                     render :template => 'issues/show'
                   }
                   format.api
                   format.atom { render :template => 'journals/index', :layout => false, :content_type => 'application/atom+xml' }
                   format.pdf  { send_data(issue_to_pdf(@issue), :type => 'application/pdf', :filename => "#{@project.identifier}-#{@issue.id}.pdf") }
                 end
               end
               # Add a new issue
               # The new issue will be created from an existing one if copy_from parameter is given
               def new
                 respond_to do |format|
                   format.html { render :action => 'new', :layout => !request.xhr? }
                   format.js {
                     render(:update) { |page|
                       if params[:project_change]
                         page.replace_html 'all_attributes', :partial => 'form'
                       else
                         page.replace_html 'attributes', :partial => 'attributes'
                       end
                       m = User.current.allowed_to?(:log_time, @issue.project) ? 'show' : 'hide'
                       page << "if ($('log_time')) {Element.#{m}('log_time');}"
                     }
                   }
                 end
               end
               def create
                 call_hook(:controller_issues_new_before_save, { :params => params, :issue => @issue })
-                @issue.save_attachments(params[:attachments])
+                @issue.save_attachments(params[:attachments] || (params[:issue] && params[:issue][:uploads]))
                 if @issue.save
                   call_hook(:controller_issues_new_after_save, { :params => params, :issue => @issue})
                   respond_to do |format|
                     format.html {
                       render_attachment_warning_if_needed(@issue)
                       flash[:notice] = l(:notice_issue_successful_create, :id => "<a href='#{issue_path(@issue)}'>##{@issue.id}</a>")
                       redirect_to(params[:continue] ?  { :action => 'new', :project_id => @issue.project, :issue => {:tracker_id => @issue.tracker, :parent_issue_id => @issue.parent_issue_id}.reject {|k,v| v.nil?} } :
                                   { :action => 'show', :id => @issue })
                     }
                     format.api  { render :action => 'show', :status => :created, :location => issue_url(@issue) }
                   end
                   return
                 else
                   respond_to do |format|
                     format.html { render :action => 'new' }
                     format.api  { render_validation_errors(@issue) }
                   end
                 end
               end
               def edit
                 return unless update_issue_from_params
                 respond_to do |format|
                   format.html { }
                   format.xml  { }
                 end
               end
               def update
                 return unless update_issue_from_params
-                @issue.save_attachments(params[:attachments])
+                @issue.save_attachments(params[:attachments] || (params[:issue] && params[:issue][:uploads]))
                 saved = false
                 begin
                   saved = @issue.save_issue_with_child_records(params, @time_entry)
                 rescue ActiveRecord::StaleObjectError
                   @conflict = true
                   if params[:last_journal_id]
                     if params[:last_journal_id].present?
                       last_journal_id = params[:last_journal_id].to_i
                       @conflict_journals = @issue.journals.all(:conditions => ["#{Journal.table_name}.id > ?", last_journal_id])
                     else
                       @conflict_journals = @issue.journals.all
                     end
                   end
                 end
                 if saved
                   render_attachment_warning_if_needed(@issue)
                   flash[:notice] = l(:notice_successful_update) unless @issue.current_journal.new_record?
                   respond_to do |format|
                     format.html { redirect_back_or_default({:action => 'show', :id => @issue}) }
                     format.api  { head :ok }
                   end
                 else
                   respond_to do |format|
                     format.html { render :action => 'edit' }
                     format.api  { render_validation_errors(@issue) }
                   end
                 end
               end
               # Bulk edit/copy a set of issues
               def bulk_edit
                 @issues.sort!
                 @copy = params[:copy].present?
                 @notes = params[:notes]
                 if User.current.allowed_to?(:move_issues, @projects)
                   @allowed_projects = Issue.allowed_target_projects_on_move
                   if params[:issue]
                     @target_project = @allowed_projects.detect {|p| p.id.to_s == params[:issue][:project_id]}
                     if @target_project
                       target_projects = [@target_project]
                     end
                   end
                 end
                 target_projects ||= @projects
                 @available_statuses = @issues.map(&:new_statuses_allowed_to).reduce(:&)
                 @custom_fields = target_projects.map{|p|p.all_issue_custom_fields}.reduce(:&)
                 @assignables = target_projects.map(&:assignable_users).reduce(:&)
                 @trackers = target_projects.map(&:trackers).reduce(:&)
                 @safe_attributes = @issues.map(&:safe_attribute_names).reduce(:&)
                 render :layout => false if request.xhr?
               end
               def bulk_update
                 @issues.sort!
                 @copy = params[:copy].present?
                 attributes = parse_params_for_bulk_issue_attributes(params)
                 unsaved_issue_ids = []
                 moved_issues = []
                 @issues.each do |issue|
                   issue.reload
                   if @copy
                     issue = issue.copy
                   end
                   journal = issue.init_journal(User.current, params[:notes])
                   issue.safe_attributes = attributes
                   call_hook(:controller_issues_bulk_edit_before_save, { :params => params, :issue => issue })
                   if issue.save
                     moved_issues << issue
                   else
                     # Keep unsaved issue ids to display them in flash error
                     unsaved_issue_ids << issue.id
                   end
                 end
                 set_flash_from_bulk_issue_save(@issues, unsaved_issue_ids)
                 if params[:follow]
                   if @issues.size == 1 && moved_issues.size == 1
                     redirect_to :controller => 'issues', :action => 'show', :id => moved_issues.first
                   elsif moved_issues.map(&:project).uniq.size == 1
                     redirect_to :controller => 'issues', :action => 'index', :project_id => moved_issues.map(&:project).first
                   end
                 else
                   redirect_back_or_default({:controller => 'issues', :action => 'index', :project_id => @project})
                 end
               end
               verify :method => :delete, :only => :destroy, :render => { :nothing => true, :status => :method_not_allowed }
               def destroy
                 @hours = TimeEntry.sum(:hours, :conditions => ['issue_id IN (?)', @issues]).to_f
                 if @hours > 0
                   case params[:todo]
                   when 'destroy'
                     # nothing to do
                   when 'nullify'
                     TimeEntry.update_all('issue_id = NULL', ['issue_id IN (?)', @issues])
                   when 'reassign'
                     reassign_to = @project.issues.find_by_id(params[:reassign_to_id])
                     if reassign_to.nil?
                       flash.now[:error] = l(:error_issue_not_found_in_project)
                       return
                     else
                       TimeEntry.update_all("issue_id = #{reassign_to.id}", ['issue_id IN (?)', @issues])
                     end
                   else
                     # display the destroy form if it's a user request
                     return unless api_request?
                   end
                 end
                 @issues.each do |issue|
                   begin
                     issue.reload.destroy
                   rescue ::ActiveRecord::RecordNotFound # raised by #reload if issue no longer exists
                     # nothing to do, issue was already deleted (eg. by a parent)
                   end
                 end
                 respond_to do |format|
                   format.html { redirect_back_or_default(:action => 'index', :project_id => @project) }
                   format.api  { head :ok }
                 end
               end
             private
               def find_issue
                 # Issue.visible.find(...) can not be used to redirect user to the login form
                 # if the issue actually exists but requires authentication
                 @issue = Issue.find(params[:id], :include => [:project, :tracker, :status, :author, :priority, :category])
                 unless @issue.visible?
                   deny_access
                   return
                 end
                 @project = @issue.project
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def find_project
                 project_id = params[:project_id] || (params[:issue] && params[:issue][:project_id])
                 @project = Project.find(project_id)
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def retrieve_previous_and_next_issue_ids
                 retrieve_query_from_session
                 if @query
                   sort_init(@query.sort_criteria.empty? ? [['id', 'desc']] : @query.sort_criteria)
                   sort_update(@query.sortable_columns, 'issues_index_sort')
                   limit = 500
                   issue_ids = @query.issue_ids(:order => sort_clause, :limit => (limit + 1), :include => [:assigned_to, :tracker, :priority, :category, :fixed_version])
                   if (idx = issue_ids.index(@issue.id)) && idx < limit
                     if issue_ids.size < 500
                       @issue_position = idx + 1
                       @issue_count = issue_ids.size
                     end
                     @prev_issue_id = issue_ids[idx - 1] if idx > 0
                     @next_issue_id = issue_ids[idx + 1] if idx < (issue_ids.size - 1)
                   end
                 end
               end
               # Used by #edit and #update to set some common instance variables
               # from the params
               # TODO: Refactor, not everything in here is needed by #edit
               def update_issue_from_params
                 @allowed_statuses = @issue.new_statuses_allowed_to(User.current)
                 @priorities = IssuePriority.active
                 @edit_allowed = User.current.allowed_to?(:edit_issues, @project)
                 @time_entry = TimeEntry.new(:issue => @issue, :project => @issue.project)
                 @time_entry.attributes = params[:time_entry]
                 @notes = params[:notes] || (params[:issue].present? ? params[:issue][:notes] : nil)
                 @issue.init_journal(User.current, @notes)
                 issue_attributes = params[:issue]
                 if issue_attributes && params[:conflict_resolution]
                   case params[:conflict_resolution]
                   when 'overwrite'
                     issue_attributes = issue_attributes.dup
                     issue_attributes.delete(:lock_version)
                   when 'add_notes'
                     issue_attributes = {}
                   when 'cancel'
                     redirect_to issue_path(@issue)
                     return false
                   end
                 end
                 @issue.safe_attributes = issue_attributes
                 true
               end
               # TODO: Refactor, lots of extra code in here
               # TODO: Changing tracker on an existing issue should not trigger this
               def build_new_issue_from_params
                 if params[:id].blank?
                   @issue = Issue.new
                   if params[:copy_from]
                     begin
                       @copy_from = Issue.visible.find(params[:copy_from])
                       @copy_attachments = params[:copy_attachments].present? || request.get?
                       @issue.copy_from(@copy_from, :attachments => @copy_attachments)
                     rescue ActiveRecord::RecordNotFound
                       render_404
                       return
                     end
                   end
                   @issue.project = @project
                 else
                   @issue = @project.issues.visible.find(params[:id])
                 end
                 @issue.project = @project
                 @issue.author = User.current
                 # Tracker must be set before custom field values
                 @issue.tracker ||= @project.trackers.find((params[:issue] && params[:issue][:tracker_id]) || params[:tracker_id] || :first)
                 if @issue.tracker.nil?
                   render_error l(:error_no_tracker_in_project)
                   return false
                 end
                 @issue.start_date ||= Date.today if Setting.default_issue_start_date_to_creation_date?
                 @issue.safe_attributes = params[:issue]
                 @priorities = IssuePriority.active
                 @allowed_statuses = @issue.new_statuses_allowed_to(User.current, true)
               end
               def check_for_default_issue_status
                 if IssueStatus.default.nil?
                   render_error l(:error_no_default_issue_status)
                   return false
                 end
               end
               def parse_params_for_bulk_issue_attributes(params)
                 attributes = (params[:issue] || {}).reject {|k,v| v.blank?}
                 attributes.keys.each {|k| attributes[k] = '' if attributes[k] == 'none'}
                 attributes[:custom_field_values].reject! {|k,v| v.blank?} if attributes[:custom_field_values]
                 attributes
               end
             end

app/models/attachment.rb +16 -5

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require "digest/md5"
             class Attachment < ActiveRecord::Base
               belongs_to :container, :polymorphic => true
               belongs_to :author, :class_name => "User", :foreign_key => "author_id"
               validates_presence_of :filename, :author
               validates_length_of :filename, :maximum => 255
               validates_length_of :disk_filename, :maximum => 255
               validate :validate_max_file_size
               acts_as_event :title => :filename,
                             :url => Proc.new {|o| {:controller => 'attachments', :action => 'download', :id => o.id, :filename => o.filename}}
               acts_as_activity_provider :type => 'files',
                                         :permission => :view_files,
                                         :author_key => :author_id,
                                         :find_options => {:select => "#{Attachment.table_name}.*",
                                                           :joins => "LEFT JOIN #{Version.table_name} ON #{Attachment.table_name}.container_type='Version' AND #{Version.table_name}.id = #{Attachment.table_name}.container_id " +
                                                                     "LEFT JOIN #{Project.table_name} ON #{Version.table_name}.project_id = #{Project.table_name}.id OR ( #{Attachment.table_name}.container_type='Project' AND #{Attachment.table_name}.container_id = #{Project.table_name}.id )"}
               acts_as_activity_provider :type => 'documents',
                                         :permission => :view_documents,
                                         :author_key => :author_id,
                                         :find_options => {:select => "#{Attachment.table_name}.*",
                                                           :joins => "LEFT JOIN #{Document.table_name} ON #{Attachment.table_name}.container_type='Document' AND #{Document.table_name}.id = #{Attachment.table_name}.container_id " +
                                                                     "LEFT JOIN #{Project.table_name} ON #{Document.table_name}.project_id = #{Project.table_name}.id"}
               cattr_accessor :storage_path
               @@storage_path = Redmine::Configuration['attachments_storage_path'] || "#{Rails.root}/files"
               before_save :files_to_final_location
               after_destroy :delete_from_disk
               def container_with_blank_type_check
                 if container_type.blank?
                   nil
                 else
                   container_without_blank_type_check
                 end
               end
               alias_method_chain :container, :blank_type_check unless method_defined?(:container_without_blank_type_check)
               # Returns an unsaved copy of the attachment
               def copy(attributes=nil)
                 copy = self.class.new
                 copy.attributes = self.attributes.dup.except("id", "downloads")
                 copy.attributes = attributes if attributes
                 copy
               end
               def validate_max_file_size
                 if @temp_file && self.filesize > Setting.attachment_max_size.to_i.kilobytes
                   errors.add(:base, :too_long, :count => Setting.attachment_max_size.to_i.kilobytes)
                 end
               end
               def file=(incoming_file)
                 unless incoming_file.nil?
                   @temp_file = incoming_file
                   if @temp_file.size > 0
-                    self.filename = sanitize_filename(@temp_file.original_filename)
+                    if @temp_file.respond_to?(:original_filename)
-                    self.disk_filename = Attachment.disk_filename(filename)
+                      self.filename = @temp_file.original_filename
-                    self.content_type = @temp_file.content_type.to_s.chomp
+                    end
-                    if content_type.blank?
+                    if @temp_file.respond_to?(:content_type)
+                      self.content_type = @temp_file.content_type.to_s.chomp
+                    end
+                    if content_type.blank? && filename.present?
                       self.content_type = Redmine::MimeType.of(filename)
                     end
                     self.filesize = @temp_file.size
                   end
                 end
               end
               def file
                 nil
               end
+              def filename=(arg)
+                write_attribute :filename, sanitize_filename(arg.to_s)
+                if new_record? && disk_filename.blank?
+                  self.disk_filename = Attachment.disk_filename(filename)
+                end
+                filename
+              end
               # Copies the temporary file to its final location
               # and computes its MD5 hash
               def files_to_final_location
                 if @temp_file && (@temp_file.size > 0)
                   logger.info("Saving attachment '#{self.diskfile}' (#{@temp_file.size} bytes)")
                   md5 = Digest::MD5.new
                   File.open(diskfile, "wb") do |f|
                     buffer = ""
                     while (buffer = @temp_file.read(8192))
                       f.write(buffer)
                       md5.update(buffer)
                     end
                   end
                   self.digest = md5.hexdigest
                 end
                 @temp_file = nil
                 # Don't save the content type if it's longer than the authorized length
                 if self.content_type && self.content_type.length > 255
                   self.content_type = nil
                 end
               end
               # Deletes the file from the file system if it's not referenced by other attachments
               def delete_from_disk
                 if Attachment.first(:conditions => ["disk_filename = ? AND id <> ?", disk_filename, id]).nil?
                   delete_from_disk!
                 end
               end
               # Returns file's location on disk
               def diskfile
                 "#{@@storage_path}/#{self.disk_filename}"
               end
               def increment_download
                 increment!(:downloads)
               end
               def project
                 container.try(:project)
               end
               def visible?(user=User.current)
                 container && container.attachments_visible?(user)
               end
               def deletable?(user=User.current)
                 container && container.attachments_deletable?(user)
               end
               def image?
                 self.filename =~ /\.(bmp|gif|jpg|jpe|jpeg|png)$/i
               end
               def is_text?
                 Redmine::MimeType.is_type?('text', filename)
               end
               def is_diff?
                 self.filename =~ /\.(patch|diff)$/i
               end
               # Returns true if the file is readable
               def readable?
                 File.readable?(diskfile)
               end
               # Returns the attachment token
               def token
                 "#{id}.#{digest}"
               end
               # Finds an attachment that matches the given token and that has no container
               def self.find_by_token(token)
                 if token.to_s =~ /^(\d+)\.([0-9a-f]+)$/
                   attachment_id, attachment_digest = $1, $2
                   attachment = Attachment.first(:conditions => {:id => attachment_id, :digest => attachment_digest})
                   if attachment && attachment.container.nil?
                     attachment
                   end
                 end
               end
               # Bulk attaches a set of files to an object
               #
               # Returns a Hash of the results:
               # :files => array of the attached files
               # :unsaved => array of the files that could not be attached
               def self.attach_files(obj, attachments)
                 result = obj.save_attachments(attachments, User.current)
                 obj.attach_saved_attachments
                 result
               end
               def self.latest_attach(attachments, filename)
                 attachments.sort_by(&:created_on).reverse.detect {
                   |att| att.filename.downcase == filename.downcase
                  }
               end
               def self.prune(age=1.day)
                 attachments = Attachment.all(:conditions => ["created_on < ? AND (container_type IS NULL OR container_type = '')", Time.now - age])
                 attachments.each(&:destroy)
               end
               private
               # Physically deletes the file from the file system
               def delete_from_disk!
                 if disk_filename.present? && File.exist?(diskfile)
                   File.delete(diskfile)
                 end
               end
               def sanitize_filename(value)
                 # get only the filename, not the whole path
                 just_filename = value.gsub(/^.*(\\|\/)/, '')
                 # Finally, replace invalid characters with underscore
                 @filename = just_filename.gsub(/[\/\?\%\*\:\|\"\'<>]+/, '_')
               end
               # Returns an ASCII or hashed filename
               def self.disk_filename(filename)
                 timestamp = DateTime.now.strftime("%y%m%d%H%M%S")
                 ascii = ''
                 if filename =~ %r{^[a-zA-Z0-9_\.\-]*$}
                   ascii = filename
                 else
                   ascii = Digest::MD5.hexdigest(filename)
                   # keep the extension if any
                   ascii << $1 if filename =~ %r{(\.[a-zA-Z0-9]+)$}
                 end
                 while File.exist?(File.join(@@storage_path, "#{timestamp}_#{ascii}"))
                   timestamp.succ!
                 end
                 "#{timestamp}_#{ascii}"
               end
             end

config/routes.rb +2 0

             ActionController::Routing::Routes.draw do |map|
               # Add your own custom routes here.
               # The priority is based upon order of creation: first created -> highest priority.
               # Here's a sample route:
               # map.connect 'products/:id', :controller => 'catalog', :action => 'view'
               # Keep in mind you can assign values other than :controller and :action
               map.home '', :controller => 'welcome', :conditions => {:method => :get}
               map.signin 'login', :controller => 'account', :action => 'login',
                          :conditions => {:method => [:get, :post]}
               map.signout 'logout', :controller => 'account', :action => 'logout',
                           :conditions => {:method => :get}
               map.connect 'account/register', :controller => 'account', :action => 'register',
                           :conditions => {:method => [:get, :post]}
               map.connect 'account/lost_password', :controller => 'account', :action => 'lost_password',
                           :conditions => {:method => [:get, :post]}
               map.connect 'account/activate', :controller => 'account', :action => 'activate',
                           :conditions => {:method => :get}
               map.connect 'projects/:id/wiki', :controller => 'wikis',
                           :action => 'edit', :conditions => {:method => :post}
               map.connect 'projects/:id/wiki/destroy', :controller => 'wikis',
                           :action => 'destroy', :conditions => {:method => [:get, :post]}
               map.with_options :controller => 'messages' do |messages_routes|
                 messages_routes.with_options :conditions => {:method => :get} do |messages_views|
                   messages_views.connect 'boards/:board_id/topics/new', :action => 'new'
                   messages_views.connect 'boards/:board_id/topics/:id', :action => 'show'
                   messages_views.connect 'boards/:board_id/topics/:id/edit', :action => 'edit'
                 end
                 messages_routes.with_options :conditions => {:method => :post} do |messages_actions|
                   messages_actions.connect 'boards/:board_id/topics/new', :action => 'new'
                   messages_actions.connect 'boards/:board_id/topics/preview', :action => 'preview'
                   messages_actions.connect 'boards/:board_id/topics/quote/:id', :action => 'quote'
                   messages_actions.connect 'boards/:board_id/topics/:id/replies', :action => 'reply'
                   messages_actions.connect 'boards/:board_id/topics/:id/edit', :action => 'edit'
                   messages_actions.connect 'boards/:board_id/topics/:id/destroy', :action => 'destroy'
                 end
               end
               # Misc issue routes. TODO: move into resources
               map.auto_complete_issues '/issues/auto_complete', :controller => 'auto_completes',
                                        :action => 'issues', :conditions => { :method => :get }
               # TODO: would look nicer as /issues/:id/preview
               map.preview_new_issue '/issues/preview/new/:project_id', :controller => 'previews',
                                     :action => 'issue'
               map.preview_edit_issue '/issues/preview/edit/:id', :controller => 'previews',
                                      :action => 'issue'
               map.issues_context_menu '/issues/context_menu',
                                       :controller => 'context_menus', :action => 'issues'
               map.issue_changes '/issues/changes', :controller => 'journals', :action => 'index'
               map.quoted_issue '/issues/:id/quoted', :controller => 'journals', :action => 'new',
                                :id => /\d+/, :conditions => { :method => :post }
               map.connect '/journals/diff/:id', :controller => 'journals', :action => 'diff',
                           :id => /\d+/, :conditions => { :method => :get }
               map.connect '/journals/edit/:id', :controller => 'journals', :action => 'edit',
                           :id => /\d+/, :conditions => { :method => [:get, :post] }
               map.with_options :controller => 'gantts', :action => 'show' do |gantts_routes|
                 gantts_routes.connect '/projects/:project_id/issues/gantt'
                 gantts_routes.connect '/projects/:project_id/issues/gantt.:format'
                 gantts_routes.connect '/issues/gantt.:format'
               end
               map.with_options :controller => 'calendars', :action => 'show' do |calendars_routes|
                 calendars_routes.connect '/projects/:project_id/issues/calendar'
                 calendars_routes.connect '/issues/calendar'
               end
               map.with_options :controller => 'reports', :conditions => {:method => :get} do |reports|
                 reports.connect 'projects/:id/issues/report', :action => 'issue_report'
                 reports.connect 'projects/:id/issues/report/:detail', :action => 'issue_report_details'
               end
               map.connect 'my/account', :controller => 'my', :action => 'account',
                           :conditions => {:method => [:get, :post]}
               map.connect 'my/page', :controller => 'my', :action => 'page',
                           :conditions => {:method => :get}
               # Redirects to my/page
               map.connect 'my', :controller => 'my', :action => 'index',
                           :conditions => {:method => :get}
               map.connect 'my/reset_rss_key', :controller => 'my', :action => 'reset_rss_key',
                           :conditions => {:method => :post}
               map.connect 'my/reset_api_key', :controller => 'my', :action => 'reset_api_key',
                           :conditions => {:method => :post}
               map.connect 'my/password', :controller => 'my', :action => 'password',
                           :conditions => {:method => [:get, :post]}
               map.connect 'my/page_layout', :controller => 'my', :action => 'page_layout',
                           :conditions => {:method => :get}
               map.connect 'my/add_block', :controller => 'my', :action => 'add_block',
                           :conditions => {:method => :post}
               map.connect 'my/remove_block', :controller => 'my', :action => 'remove_block',
                           :conditions => {:method => :post}
               map.connect 'my/order_blocks', :controller => 'my', :action => 'order_blocks',
                           :conditions => {:method => :post}
               map.with_options :controller => 'users' do |users|
                 users.user_membership 'users/:id/memberships/:membership_id',
                                       :action => 'edit_membership',
                                       :conditions => {:method => :put}
                 users.connect 'users/:id/memberships/:membership_id',
                               :action => 'destroy_membership',
                               :conditions => {:method => :delete}
                 users.user_memberships 'users/:id/memberships',
                                        :action => 'edit_membership',
                                        :conditions => {:method => :post}
               end
               map.resources :users
               # For nice "roadmap" in the url for the index action
               map.connect 'projects/:project_id/roadmap', :controller => 'versions', :action => 'index'
               map.preview_news '/news/preview', :controller => 'previews', :action => 'news'
               map.connect 'news/:id/comments', :controller => 'comments',
                           :action => 'create', :conditions => {:method => :post}
               map.connect 'news/:id/comments/:comment_id', :controller => 'comments',
                           :action => 'destroy', :conditions => {:method => :delete}
               map.connect 'watchers/new', :controller=> 'watchers', :action => 'new',
                           :conditions => {:method => :get}
               map.connect 'watchers', :controller=> 'watchers', :action => 'create',
                           :conditions => {:method => :post}
               map.connect 'watchers/destroy', :controller=> 'watchers', :action => 'destroy',
                           :conditions => {:method => :post}
               map.connect 'watchers/watch', :controller=> 'watchers', :action => 'watch',
                           :conditions => {:method => :post}
               map.connect 'watchers/unwatch', :controller=> 'watchers', :action => 'unwatch',
                           :conditions => {:method => :post}
               map.connect 'watchers/autocomplete_for_user', :controller=> 'watchers', :action => 'autocomplete_for_user',
                           :conditions => {:method => :get}
               # TODO: port to be part of the resources route(s)
               map.with_options :conditions => {:method => :get} do |project_views|
                 project_views.connect 'projects/:id/settings/:tab',
                                       :controller => 'projects', :action => 'settings'
                 project_views.connect 'projects/:project_id/issues/:copy_from/copy',
                                       :controller => 'issues', :action => 'new'
               end
               map.resources :projects, :member => {
                 :copy => [:get, :post],
                 :settings => :get,
                 :modules => :post,
                 :archive => :post,
                 :unarchive => :post
               } do |project|
                 project.resource :enumerations, :controller => 'project_enumerations',
                                  :only => [:update, :destroy]
                 # issue form update
                 project.issue_form 'issues/new', :controller => 'issues',
                                    :action => 'new', :conditions => {:method => [:post, :put]}
                 project.resources :issues, :only => [:index, :new, :create] do |issues|
                   issues.resources :time_entries, :controller => 'timelog',
                                    :collection => {:report => :get}
                 end
                 project.resources :files, :only => [:index, :new, :create]
                 project.resources :versions, :shallow => true,
                                   :collection => {:close_completed => :put},
                                   :member => {:status_by => :post}
                 project.resources :news, :shallow => true
                 project.resources :time_entries, :controller => 'timelog',
                                   :collection => {:report => :get}
                 project.resources :queries, :only => [:new, :create]
                 project.resources :issue_categories, :shallow => true
                 project.resources :documents, :shallow => true, :member => {:add_attachment => :post}
                 project.resources :boards
                 project.resources :repositories, :shallow => true, :except => [:index, :show],
                                   :member => {:committers => [:get, :post]}
                 project.resources :memberships, :shallow => true, :controller => 'members',
                                   :only => [:index, :show, :create, :update, :destroy],
                                   :collection => {:autocomplete => :get}
                 project.wiki_start_page 'wiki', :controller => 'wiki', :action => 'show', :conditions => {:method => :get}
                 project.wiki_index 'wiki/index', :controller => 'wiki', :action => 'index', :conditions => {:method => :get}
                 project.wiki_diff 'wiki/:id/diff/:version', :controller => 'wiki', :action => 'diff', :version => nil
                 project.wiki_diff 'wiki/:id/diff/:version/vs/:version_from', :controller => 'wiki', :action => 'diff'
                 project.wiki_annotate 'wiki/:id/annotate/:version', :controller => 'wiki', :action => 'annotate'
                 project.resources :wiki, :except => [:new, :create], :member => {
                   :rename => [:get, :post],
                   :history => :get,
                   :preview => :any,
                   :protect => :post,
                   :add_attachment => :post
                 }, :collection => {
                   :export => :get,
                   :date_index => :get
                 }
               end
               map.connect 'news', :controller => 'news', :action => 'index'
               map.connect 'news.:format', :controller => 'news', :action => 'index'
               map.resources :queries, :except => [:show]
               map.resources :issues,
                             :collection => {:bulk_edit => [:get, :post], :bulk_update => :post} do |issues|
                 issues.resources :time_entries, :controller => 'timelog',
                                  :collection => {:report => :get}
                 issues.resources :relations, :shallow => true,
                                  :controller => 'issue_relations',
                                  :only => [:index, :show, :create, :destroy]
               end
               # Bulk deletion
               map.connect '/issues', :controller => 'issues', :action => 'destroy',
                           :conditions => {:method => :delete}
               map.connect '/time_entries/destroy',
                           :controller => 'timelog', :action => 'destroy',
                           :conditions => { :method => :delete }
               map.time_entries_context_menu '/time_entries/context_menu',
                                :controller => 'context_menus', :action => 'time_entries'
               map.resources :time_entries, :controller => 'timelog',
                             :collection => {:report => :get, :bulk_edit => :get, :bulk_update => :post}
               map.with_options :controller => 'activities', :action => 'index',
                                :conditions => {:method => :get} do |activity|
                 activity.connect 'projects/:id/activity'
                 activity.connect 'projects/:id/activity.:format'
                 activity.connect 'activity', :id => nil
                 activity.connect 'activity.:format', :id => nil
               end
               map.with_options :controller => 'repositories' do |repositories|
                 repositories.with_options :conditions => {:method => :get} do |repository_views|
                   repository_views.connect 'projects/:id/repository',
                                            :action => 'show'
                   repository_views.connect 'projects/:id/repository/:repository_id/statistics',
                                            :action => 'stats'
                   repository_views.connect 'projects/:id/repository/:repository_id/graph',
                                            :action => 'graph'
                   repository_views.connect 'projects/:id/repository/statistics',
                                            :action => 'stats'
                   repository_views.connect 'projects/:id/repository/graph',
                                            :action => 'graph'
                   repository_views.connect 'projects/:id/repository/:repository_id/revisions',
                                            :action => 'revisions'
                   repository_views.connect 'projects/:id/repository/:repository_id/revisions.:format',
                                            :action => 'revisions'
                   repository_views.connect 'projects/:id/repository/:repository_id/revisions/:rev',
                                            :action => 'revision'
                   repository_views.connect 'projects/:id/repository/:repository_id/revisions/:rev/issues',
                                             :action => 'add_related_issue', :conditions => {:method => :post}
                   repository_views.connect 'projects/:id/repository/:repository_id/revisions/:rev/issues/:issue_id',
                                             :action => 'remove_related_issue', :conditions => {:method => :delete}
                   repository_views.connect 'projects/:id/repository/:repository_id/revisions/:rev/diff',
                                            :action => 'diff'
                   repository_views.connect 'projects/:id/repository/:repository_id/revisions/:rev/diff.:format',
                                            :action => 'diff'
                   repository_views.connect 'projects/:id/repository/:repository_id/revisions/:rev/raw/*path',
                                            :action => 'entry', :format => 'raw'
                   repository_views.connect 'projects/:id/repository/:repository_id/revisions/:rev/:action/*path',
                                            :requirements => {
                                                :action => /(browse|show|entry|changes|annotate|diff)/,
                                                :rev    => /[a-z0-9\.\-_]+/
                                              }
                   repository_views.connect 'projects/:id/repository/:repository_id/raw/*path',
                                            :action => 'entry', :format => 'raw'
                   repository_views.connect 'projects/:id/repository/:repository_id/:action/*path',
                                            :requirements => { :action => /(browse|show|entry|changes|annotate|diff)/ }
                   repository_views.connect 'projects/:id/repository/revisions',
                                            :action => 'revisions'
                   repository_views.connect 'projects/:id/repository/revisions.:format',
                                            :action => 'revisions'
                   repository_views.connect 'projects/:id/repository/revisions/:rev',
                                            :action => 'revision'
                   repository_views.connect 'projects/:id/repository/revisions/:rev/issues',
                                             :action => 'add_related_issue', :conditions => {:method => :post}
                   repository_views.connect 'projects/:id/repository/revisions/:rev/issues/:issue_id',
                                             :action => 'remove_related_issue', :conditions => {:method => :delete}
                   repository_views.connect 'projects/:id/repository/revisions/:rev/diff',
                                            :action => 'diff'
                   repository_views.connect 'projects/:id/repository/revisions/:rev/diff.:format',
                                            :action => 'diff'
                   repository_views.connect 'projects/:id/repository/revisions/:rev/raw/*path',
                                            :action => 'entry', :format => 'raw'
                   repository_views.connect 'projects/:id/repository/revisions/:rev/:action/*path',
                                            :requirements => {
                                                :action => /(browse|show|entry|changes|annotate|diff)/,
                                                :rev    => /[a-z0-9\.\-_]+/
                                              }
                   repository_views.connect 'projects/:id/repository/raw/*path',
                                            :action => 'entry', :format => 'raw'
                   repository_views.connect 'projects/:id/repository/:action/*path',
                                            :requirements => { :action => /(browse|show|entry|changes|annotate|diff)/ }
                   repository_views.connect 'projects/:id/repository/:repository_id',
                                            :action => 'show'
                 end
                 repositories.connect 'projects/:id/repository/revision',
                                      :action => 'revision',
                                      :conditions => {:method => [:get, :post]}
               end
               # additional routes for having the file name at the end of url
               map.connect 'attachments/:id/:filename', :controller => 'attachments',
                           :action => 'show', :id => /\d+/, :filename => /.*/,
                           :conditions => {:method => :get}
               map.connect 'attachments/download/:id/:filename', :controller => 'attachments',
                           :action => 'download', :id => /\d+/, :filename => /.*/,
                           :conditions => {:method => :get}
               map.connect 'attachments/download/:id', :controller => 'attachments',
                           :action => 'download', :id => /\d+/,
                           :conditions => {:method => :get}
               map.resources :attachments, :only => [:show, :destroy]
               map.resources :groups, :member => {:autocomplete_for_user => :get}
               map.group_users 'groups/:id/users', :controller => 'groups',
                               :action => 'add_users', :id => /\d+/,
                               :conditions => {:method => :post}
               map.group_user  'groups/:id/users/:user_id', :controller => 'groups',
                               :action => 'remove_user', :id => /\d+/,
                               :conditions => {:method => :delete}
               map.connect 'groups/destroy_membership/:id', :controller => 'groups',
                           :action => 'destroy_membership', :id => /\d+/,
                           :conditions => {:method => :post}
               map.connect 'groups/edit_membership/:id', :controller => 'groups',
                           :action => 'edit_membership', :id => /\d+/,
                           :conditions => {:method => :post}
               map.resources :trackers, :except => :show
               map.resources :issue_statuses, :except => :show, :collection => {:update_issue_done_ratio => :post}
               map.resources :custom_fields, :except => :show
               map.resources :roles, :except => :show, :collection => {:permissions => [:get, :post]}
               map.resources :enumerations, :except => :show
               map.connect 'search', :controller => 'search', :action => 'index', :conditions => {:method => :get}
               map.connect 'mail_handler', :controller => 'mail_handler',
                           :action => 'index', :conditions => {:method => :post}
               map.connect 'admin', :controller => 'admin', :action => 'index',
                           :conditions => {:method => :get}
               map.connect 'admin/projects', :controller => 'admin', :action => 'projects',
                           :conditions => {:method => :get}
               map.connect 'admin/plugins', :controller => 'admin', :action => 'plugins',
                           :conditions => {:method => :get}
               map.connect 'admin/info', :controller => 'admin', :action => 'info',
                           :conditions => {:method => :get}
               map.connect 'admin/test_email', :controller => 'admin', :action => 'test_email',
                           :conditions => {:method => :get}
               map.connect 'admin/default_configuration', :controller => 'admin',
                           :action => 'default_configuration', :conditions => {:method => :post}
               # Used by AuthSourcesControllerTest
               # TODO : refactor *AuthSourcesController to remove these routes
               map.connect 'auth_sources', :controller => 'auth_sources',
                           :action => 'index', :conditions => {:method => :get}
               map.connect 'auth_sources/new', :controller => 'auth_sources',
                           :action => 'new', :conditions => {:method => :get}
               map.connect 'auth_sources/create', :controller => 'auth_sources',
                           :action => 'create', :conditions => {:method => :post}
               map.connect 'auth_sources/destroy/:id', :controller => 'auth_sources',
                           :action => 'destroy', :id => /\d+/, :conditions => {:method => :post}
               map.connect 'auth_sources/test_connection/:id', :controller => 'auth_sources',
                           :action => 'test_connection', :conditions => {:method => :get}
               map.connect 'auth_sources/edit/:id', :controller => 'auth_sources',
                           :action => 'edit', :id => /\d+/, :conditions => {:method => :get}
               map.connect 'auth_sources/update/:id', :controller => 'auth_sources',
                           :action => 'update', :id => /\d+/, :conditions => {:method => :post}
               map.connect 'ldap_auth_sources', :controller => 'ldap_auth_sources',
                           :action => 'index', :conditions => {:method => :get}
               map.connect 'ldap_auth_sources/new', :controller => 'ldap_auth_sources',
                           :action => 'new', :conditions => {:method => :get}
               map.connect 'ldap_auth_sources/create', :controller => 'ldap_auth_sources',
                           :action => 'create', :conditions => {:method => :post}
               map.connect 'ldap_auth_sources/destroy/:id', :controller => 'ldap_auth_sources',
                           :action => 'destroy', :id => /\d+/, :conditions => {:method => :post}
               map.connect 'ldap_auth_sources/test_connection/:id', :controller => 'ldap_auth_sources',
                           :action => 'test_connection', :conditions => {:method => :get}
               map.connect 'ldap_auth_sources/edit/:id', :controller => 'ldap_auth_sources',
                           :action => 'edit', :id => /\d+/, :conditions => {:method => :get}
               map.connect 'ldap_auth_sources/update/:id', :controller => 'ldap_auth_sources',
                           :action => 'update', :id => /\d+/, :conditions => {:method => :post}
               map.connect 'workflows', :controller => 'workflows',
                           :action => 'index', :conditions => {:method => :get}
               map.connect 'workflows/edit', :controller => 'workflows',
                           :action => 'edit', :conditions => {:method => [:get, :post]}
               map.connect 'workflows/copy', :controller => 'workflows',
                           :action => 'copy', :conditions => {:method => [:get, :post]}
               map.connect 'settings', :controller => 'settings',
                           :action => 'index', :conditions => {:method => :get}
               map.connect 'settings/edit', :controller => 'settings',
                           :action => 'edit', :conditions => {:method => [:get, :post]}
               map.connect 'settings/plugin/:id', :controller => 'settings',
                           :action => 'plugin', :conditions => {:method => [:get, :post]}
               map.with_options :controller => 'sys' do |sys|
                 sys.connect 'sys/projects.:format',
                             :action => 'projects',
                             :conditions => {:method => :get}
                 sys.connect 'sys/projects/:id/repository.:format',
                             :action => 'create_project_repository',
                             :conditions => {:method => :post}
                 sys.connect 'sys/fetch_changesets',
                             :action => 'fetch_changesets',
                             :conditions => {:method => :get}
               end
+              map.connect 'uploads.:format', :controller => 'attachments', :action => 'upload', :conditions => {:method => :post}
               map.connect 'robots.txt', :controller => 'welcome',
                           :action => 'robots', :conditions => {:method => :get}
               # Used for OpenID
               map.root :controller => 'account', :action => 'login'
             end

lib/redmine.rb +3 -3

             require 'redmine/access_control'
             require 'redmine/menu_manager'
             require 'redmine/activity'
             require 'redmine/search'
             require 'redmine/custom_field_format'
             require 'redmine/mime_type'
             require 'redmine/core_ext'
             require 'redmine/themes'
             require 'redmine/hook'
             require 'redmine/plugin'
             require 'redmine/notifiable'
             require 'redmine/wiki_formatting'
             require 'redmine/scm/base'
             begin
               require_library_or_gem 'RMagick' unless Object.const_defined?(:Magick)
             rescue LoadError
               # RMagick is not available
             end
             if RUBY_VERSION < '1.9'
               require 'fastercsv'
             else
               require 'csv'
               FCSV = CSV
             end
             Redmine::Scm::Base.add "Subversion"
             Redmine::Scm::Base.add "Darcs"
             Redmine::Scm::Base.add "Mercurial"
             Redmine::Scm::Base.add "Cvs"
             Redmine::Scm::Base.add "Bazaar"
             Redmine::Scm::Base.add "Git"
             Redmine::Scm::Base.add "Filesystem"
             Redmine::CustomFieldFormat.map do |fields|
               fields.register Redmine::CustomFieldFormat.new('string', :label => :label_string, :order => 1)
               fields.register Redmine::CustomFieldFormat.new('text', :label => :label_text, :order => 2)
               fields.register Redmine::CustomFieldFormat.new('int', :label => :label_integer, :order => 3)
               fields.register Redmine::CustomFieldFormat.new('float', :label => :label_float, :order => 4)
               fields.register Redmine::CustomFieldFormat.new('list', :label => :label_list, :order => 5)
               fields.register Redmine::CustomFieldFormat.new('date', :label => :label_date, :order => 6)
               fields.register Redmine::CustomFieldFormat.new('bool', :label => :label_boolean, :order => 7)
               fields.register Redmine::CustomFieldFormat.new('user', :label => :label_user, :only => %w(Issue TimeEntry Version Project), :edit_as => 'list', :order => 8)
               fields.register Redmine::CustomFieldFormat.new('version', :label => :label_version, :only => %w(Issue TimeEntry Version Project), :edit_as => 'list', :order => 9)
             end
             # Permissions
             Redmine::AccessControl.map do |map|
               map.permission :view_project, {:projects => [:show], :activities => [:index]}, :public => true
               map.permission :search_project, {:search => :index}, :public => true
               map.permission :add_project, {:projects => [:new, :create]}, :require => :loggedin
               map.permission :edit_project, {:projects => [:settings, :edit, :update]}, :require => :member
               map.permission :select_project_modules, {:projects => :modules}, :require => :member
               map.permission :manage_members, {:projects => :settings, :members => [:index, :show, :create, :update, :destroy, :autocomplete]}, :require => :member
               map.permission :manage_versions, {:projects => :settings, :versions => [:new, :create, :edit, :update, :close_completed, :destroy]}, :require => :member
               map.permission :add_subprojects, {:projects => [:new, :create]}, :require => :member
               map.project_module :issue_tracking do |map|
                 # Issue categories
                 map.permission :manage_categories, {:projects => :settings, :issue_categories => [:index, :show, :new, :create, :edit, :update, :destroy]}, :require => :member
                 # Issues
                 map.permission :view_issues, {:issues => [:index, :show],
                                               :auto_complete => [:issues],
                                               :context_menus => [:issues],
                                               :versions => [:index, :show, :status_by],
                                               :journals => [:index, :diff],
                                               :queries => :index,
                                               :reports => [:issue_report, :issue_report_details]}
-                map.permission :add_issues, {:issues => [:new, :create, :update_form]}
+                map.permission :add_issues, {:issues => [:new, :create, :update_form], :attachments => :upload}
-                map.permission :edit_issues, {:issues => [:edit, :update, :bulk_edit, :bulk_update, :update_form], :journals => [:new]}
+                map.permission :edit_issues, {:issues => [:edit, :update, :bulk_edit, :bulk_update, :update_form], :journals => [:new], :attachments => :upload}
                 map.permission :manage_issue_relations, {:issue_relations => [:index, :show, :create, :destroy]}
                 map.permission :manage_subtasks, {}
                 map.permission :set_issues_private, {}
                 map.permission :set_own_issues_private, {}, :require => :loggedin
-                map.permission :add_issue_notes, {:issues => [:edit, :update], :journals => [:new]}
+                map.permission :add_issue_notes, {:issues => [:edit, :update], :journals => [:new], :attachments => :upload}
                 map.permission :edit_issue_notes, {:journals => :edit}, :require => :loggedin
                 map.permission :edit_own_issue_notes, {:journals => :edit}, :require => :loggedin
                 map.permission :move_issues, {:issues => [:bulk_edit, :bulk_update]}, :require => :loggedin
                 map.permission :delete_issues, {:issues => :destroy}, :require => :member
                 # Queries
                 map.permission :manage_public_queries, {:queries => [:new, :create, :edit, :update, :destroy]}, :require => :member
                 map.permission :save_queries, {:queries => [:new, :create, :edit, :update, :destroy]}, :require => :loggedin
                 # Watchers
                 map.permission :view_issue_watchers, {}
                 map.permission :add_issue_watchers, {:watchers => :new}
                 map.permission :delete_issue_watchers, {:watchers => :destroy}
               end
               map.project_module :time_tracking do |map|
                 map.permission :log_time, {:timelog => [:new, :create]}, :require => :loggedin
                 map.permission :view_time_entries, :timelog => [:index, :report, :show]
                 map.permission :edit_time_entries, {:timelog => [:edit, :update, :destroy, :bulk_edit, :bulk_update]}, :require => :member
                 map.permission :edit_own_time_entries, {:timelog => [:edit, :update, :destroy,:bulk_edit, :bulk_update]}, :require => :loggedin
                 map.permission :manage_project_activities, {:project_enumerations => [:update, :destroy]}, :require => :member
               end
               map.project_module :news do |map|
                 map.permission :manage_news, {:news => [:new, :create, :edit, :update, :destroy], :comments => [:destroy]}, :require => :member
                 map.permission :view_news, {:news => [:index, :show]}, :public => true
                 map.permission :comment_news, {:comments => :create}
               end
               map.project_module :documents do |map|
                 map.permission :manage_documents, {:documents => [:new, :create, :edit, :update, :destroy, :add_attachment]}, :require => :loggedin
                 map.permission :view_documents, :documents => [:index, :show, :download]
               end
               map.project_module :files do |map|
                 map.permission :manage_files, {:files => [:new, :create]}, :require => :loggedin
                 map.permission :view_files, :files => :index, :versions => :download
               end
               map.project_module :wiki do |map|
                 map.permission :manage_wiki, {:wikis => [:edit, :destroy]}, :require => :member
                 map.permission :rename_wiki_pages, {:wiki => :rename}, :require => :member
                 map.permission :delete_wiki_pages, {:wiki => :destroy}, :require => :member
                 map.permission :view_wiki_pages, :wiki => [:index, :show, :special, :date_index]
                 map.permission :export_wiki_pages, :wiki => [:export]
                 map.permission :view_wiki_edits, :wiki => [:history, :diff, :annotate]
                 map.permission :edit_wiki_pages, :wiki => [:edit, :update, :preview, :add_attachment]
                 map.permission :delete_wiki_pages_attachments, {}
                 map.permission :protect_wiki_pages, {:wiki => :protect}, :require => :member
               end
               map.project_module :repository do |map|
                 map.permission :manage_repository, {:repositories => [:new, :create, :edit, :update, :committers, :destroy]}, :require => :member
                 map.permission :browse_repository, :repositories => [:show, :browse, :entry, :annotate, :changes, :diff, :stats, :graph]
                 map.permission :view_changesets, :repositories => [:show, :revisions, :revision]
                 map.permission :commit_access, {}
                 map.permission :manage_related_issues, {:repositories => [:add_related_issue, :remove_related_issue]}
               end
               map.project_module :boards do |map|
                 map.permission :manage_boards, {:boards => [:new, :create, :edit, :update, :destroy]}, :require => :member
                 map.permission :view_messages, {:boards => [:index, :show], :messages => [:show]}, :public => true
                 map.permission :add_messages, {:messages => [:new, :reply, :quote]}
                 map.permission :edit_messages, {:messages => :edit}, :require => :member
                 map.permission :edit_own_messages, {:messages => :edit}, :require => :loggedin
                 map.permission :delete_messages, {:messages => :destroy}, :require => :member
                 map.permission :delete_own_messages, {:messages => :destroy}, :require => :loggedin
               end
               map.project_module :calendar do |map|
                 map.permission :view_calendar, :calendars => [:show, :update]
               end
               map.project_module :gantt do |map|
                 map.permission :view_gantt, :gantts => [:show, :update]
               end
             end
             Redmine::MenuManager.map :top_menu do |menu|
               menu.push :home, :home_path
               menu.push :my_page, { :controller => 'my', :action => 'page' }, :if => Proc.new { User.current.logged? }
               menu.push :projects, { :controller => 'projects', :action => 'index' }, :caption => :label_project_plural
               menu.push :administration, { :controller => 'admin', :action => 'index' }, :if => Proc.new { User.current.admin? }, :last => true
               menu.push :help, Redmine::Info.help_url, :last => true
             end
             Redmine::MenuManager.map :account_menu do |menu|
               menu.push :login, :signin_path, :if => Proc.new { !User.current.logged? }
               menu.push :register, { :controller => 'account', :action => 'register' }, :if => Proc.new { !User.current.logged? && Setting.self_registration? }
               menu.push :my_account, { :controller => 'my', :action => 'account' }, :if => Proc.new { User.current.logged? }
               menu.push :logout, :signout_path, :if => Proc.new { User.current.logged? }
             end
             Redmine::MenuManager.map :application_menu do |menu|
               # Empty
             end
             Redmine::MenuManager.map :admin_menu do |menu|
               menu.push :projects, {:controller => 'admin', :action => 'projects'}, :caption => :label_project_plural
               menu.push :users, {:controller => 'users'}, :caption => :label_user_plural
               menu.push :groups, {:controller => 'groups'}, :caption => :label_group_plural
               menu.push :roles, {:controller => 'roles'}, :caption => :label_role_and_permissions
               menu.push :trackers, {:controller => 'trackers'}, :caption => :label_tracker_plural
               menu.push :issue_statuses, {:controller => 'issue_statuses'}, :caption => :label_issue_status_plural,
                         :html => {:class => 'issue_statuses'}
               menu.push :workflows, {:controller => 'workflows', :action => 'edit'}, :caption => :label_workflow
               menu.push :custom_fields, {:controller => 'custom_fields'},  :caption => :label_custom_field_plural,
                         :html => {:class => 'custom_fields'}
               menu.push :enumerations, {:controller => 'enumerations'}
               menu.push :settings, {:controller => 'settings'}
               menu.push :ldap_authentication, {:controller => 'ldap_auth_sources', :action => 'index'},
                         :html => {:class => 'server_authentication'}
               menu.push :plugins, {:controller => 'admin', :action => 'plugins'}, :last => true
               menu.push :info, {:controller => 'admin', :action => 'info'}, :caption => :label_information_plural, :last => true
             end
             Redmine::MenuManager.map :project_menu do |menu|
               menu.push :overview, { :controller => 'projects', :action => 'show' }
               menu.push :activity, { :controller => 'activities', :action => 'index' }
               menu.push :roadmap, { :controller => 'versions', :action => 'index' }, :param => :project_id,
                           :if => Proc.new { |p| p.shared_versions.any? }
               menu.push :issues, { :controller => 'issues', :action => 'index' }, :param => :project_id, :caption => :label_issue_plural
               menu.push :new_issue, { :controller => 'issues', :action => 'new' }, :param => :project_id, :caption => :label_issue_new,
                           :html => { :accesskey => Redmine::AccessKeys.key_for(:new_issue) }
               menu.push :gantt, { :controller => 'gantts', :action => 'show' }, :param => :project_id, :caption => :label_gantt
               menu.push :calendar, { :controller => 'calendars', :action => 'show' }, :param => :project_id, :caption => :label_calendar
               menu.push :news, { :controller => 'news', :action => 'index' }, :param => :project_id, :caption => :label_news_plural
               menu.push :documents, { :controller => 'documents', :action => 'index' }, :param => :project_id, :caption => :label_document_plural
               menu.push :wiki, { :controller => 'wiki', :action => 'show', :id => nil }, :param => :project_id,
                           :if => Proc.new { |p| p.wiki && !p.wiki.new_record? }
               menu.push :boards, { :controller => 'boards', :action => 'index', :id => nil }, :param => :project_id,
                           :if => Proc.new { |p| p.boards.any? }, :caption => :label_board_plural
               menu.push :files, { :controller => 'files', :action => 'index' }, :caption => :label_file_plural, :param => :project_id
               menu.push :repository, { :controller => 'repositories', :action => 'show' },
                           :if => Proc.new { |p| p.repository && !p.repository.new_record? }
               menu.push :settings, { :controller => 'projects', :action => 'settings' }, :last => true
             end
             Redmine::Activity.map do |activity|
               activity.register :issues, :class_name => %w(Issue Journal)
               activity.register :changesets
               activity.register :news
               activity.register :documents, :class_name => %w(Document Attachment)
               activity.register :files, :class_name => 'Attachment'
               activity.register :wiki_edits, :class_name => 'WikiContent::Version', :default => false
               activity.register :messages, :default => false
               activity.register :time_entries, :default => false
             end
             Redmine::Search.map do |search|
               search.register :issues
               search.register :news
               search.register :documents
               search.register :changesets
               search.register :wiki_pages
               search.register :messages
               search.register :projects
             end
             Redmine::WikiFormatting.map do |format|
               format.register :textile, Redmine::WikiFormatting::Textile::Formatter, Redmine::WikiFormatting::Textile::Helper
             end
             ActionView::Template.register_template_handler :rsb, Redmine::Views::ApiTemplateHandler

test/integration/api_test/attachments_test.rb +35 0

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.expand_path('../../../test_helper', __FILE__)
             class ApiTest::AttachmentsTest < ActionController::IntegrationTest
               fixtures :projects, :trackers, :issue_statuses, :issues,
                        :enumerations, :users, :issue_categories,
                        :projects_trackers,
                        :roles,
                        :member_roles,
                        :members,
                        :enabled_modules,
                        :workflows,
                        :attachments
               def setup
                 Setting.rest_api_enabled = '1'
                 set_fixtures_attachments_directory
               end
               def teardown
                 set_tmp_attachments_directory
               end
               context "/attachments/:id" do
                 context "GET" do
                   should "return the attachment" do
                     get '/attachments/7.xml', {}, credentials('jsmith')
                     assert_response :success
                     assert_equal 'application/xml', @response.content_type
                     assert_tag :tag => 'attachment',
                       :child => {
                         :tag => 'id',
                         :content => '7',
                         :sibling => {
                           :tag => 'filename',
                           :content => 'archive.zip',
                           :sibling => {
                             :tag => 'content_url',
                             :content => 'http://www.example.com/attachments/download/7/archive.zip'
                           }
                         }
                       }
                   end
                   should "deny access without credentials" do
                     get '/attachments/7.xml'
                     assert_response 401
                     set_tmp_attachments_directory
                   end
                 end
               end
               context "/attachments/download/:id/:filename" do
                 context "GET" do
                   should "return the attachment content" do
                     get '/attachments/download/7/archive.zip', {}, credentials('jsmith')
                     assert_response :success
                     assert_equal 'application/octet-stream', @response.content_type
                     set_tmp_attachments_directory
                   end
                   should "deny access without credentials" do
                     get '/attachments/download/7/archive.zip'
                     assert_response 302
                     set_tmp_attachments_directory
                   end
                 end
               end
+              context "POST /uploads" do
+                should "return the token" do
+                  set_tmp_attachments_directory
+                  assert_difference 'Attachment.count' do
+                    post '/uploads.xml', 'File content', {'Content-Type' => 'application/octet-stream'}.merge(credentials('jsmith'))
+                    assert_response :created
+                    assert_equal 'application/xml', response.content_type
+                    xml = Hash.from_xml(response.body)
+                    assert_kind_of Hash, xml['upload']
+                    token = xml['upload']['token']
+                    assert_not_nil token
+                    attachment = Attachment.first(:order => 'id DESC')
+                    assert_equal token, attachment.token
+                    assert_nil attachment.container
+                    assert_equal 2, attachment.author_id
+                    assert_equal 'File content'.size, attachment.filesize
+                    assert attachment.content_type.blank?
+                    assert attachment.filename.present?
+                    assert_match /\d+_[0-9a-z]+/, attachment.diskfile
+                    assert File.exist?(attachment.diskfile)
+                    assert_equal 'File content', File.read(attachment.diskfile)
+                  end
+                end
+                should "not accept other content types" do
+                  set_tmp_attachments_directory
+                  assert_no_difference 'Attachment.count' do
+                    post '/uploads.xml', 'PNG DATA', {'Content-Type' => 'image/png'}.merge(credentials('jsmith'))
+                    assert_response 406
+                  end
+                end
+              end
             end

test/integration/api_test/issues_test.rb +68 0

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.expand_path('../../../test_helper', __FILE__)
             class ApiTest::IssuesTest < ActionController::IntegrationTest
               fixtures :projects,
                 :users,
                 :roles,
                 :members,
                 :member_roles,
                 :issues,
                 :issue_statuses,
                 :versions,
                 :trackers,
                 :projects_trackers,
                 :issue_categories,
                 :enabled_modules,
                 :enumerations,
                 :attachments,
                 :workflows,
                 :custom_fields,
                 :custom_values,
                 :custom_fields_projects,
                 :custom_fields_trackers,
                 :time_entries,
                 :journals,
                 :journal_details,
                 :queries,
                 :attachments
               def setup
                 Setting.rest_api_enabled = '1'
               end
               context "/issues" do
                 # Use a private project to make sure auth is really working and not just
                 # only showing public issues.
                 should_allow_api_authentication(:get, "/projects/private-child/issues.xml")
                 should "contain metadata" do
                   get '/issues.xml'
                   assert_tag :tag => 'issues',
                     :attributes => {
                       :type => 'array',
                       :total_count => assigns(:issue_count),
                       :limit => 25,
                       :offset => 0
                     }
                 end
                 context "with offset and limit" do
                   should "use the params" do
                     get '/issues.xml?offset=2&limit=3'
                     assert_equal 3, assigns(:limit)
                     assert_equal 2, assigns(:offset)
                     assert_tag :tag => 'issues', :children => {:count => 3, :only => {:tag => 'issue'}}
                   end
                 end
                 context "with nometa param" do
                   should "not contain metadata" do
                     get '/issues.xml?nometa=1'
                     assert_tag :tag => 'issues',
                       :attributes => {
                         :type => 'array',
                         :total_count => nil,
                         :limit => nil,
                         :offset => nil
                       }
                   end
                 end
                 context "with nometa header" do
                   should "not contain metadata" do
                     get '/issues.xml', {}, {'X-Redmine-Nometa' => '1'}
                     assert_tag :tag => 'issues',
                       :attributes => {
                         :type => 'array',
                         :total_count => nil,
                         :limit => nil,
                         :offset => nil
                       }
                   end
                 end
                 context "with relations" do
                   should "display relations" do
                     get '/issues.xml?include=relations'
                     assert_response :success
                     assert_equal 'application/xml', @response.content_type
                     assert_tag 'relations',
                       :parent => {:tag => 'issue', :child => {:tag => 'id', :content => '3'}},
                       :children => {:count => 1},
                       :child => {
                         :tag => 'relation',
                         :attributes => {:id => '2', :issue_id => '2', :issue_to_id => '3', :relation_type => 'relates'}
                       }
                     assert_tag 'relations',
                       :parent => {:tag => 'issue', :child => {:tag => 'id', :content => '1'}},
                       :children => {:count => 0}
                   end
                 end
                 context "with invalid query params" do
                   should "return errors" do
                     get '/issues.xml', {:f => ['start_date'], :op => {:start_date => '='}}
                     assert_response :unprocessable_entity
                     assert_equal 'application/xml', @response.content_type
                     assert_tag 'errors', :child => {:tag => 'error', :content => "Start date can't be blank"}
                   end
                 end
                 context "with custom field filter" do
                   should "show only issues with the custom field value" do
                     get '/issues.xml', { :set_filter => 1, :f => ['cf_1'], :op => {:cf_1 => '='}, :v => {:cf_1 => ['MySQL']}}
                     expected_ids = Issue.visible.all(
                         :include => :custom_values,
                         :conditions => {:custom_values => {:custom_field_id => 1, :value => 'MySQL'}}).map(&:id)
                     assert_select 'issues > issue > id', :count => expected_ids.count do |ids|
                        ids.each { |id| assert expected_ids.delete(id.children.first.content.to_i) }
                     end
                   end
                 end
                 context "with custom field filter (shorthand method)" do
                   should "show only issues with the custom field value" do
                     get '/issues.xml', { :cf_1 => 'MySQL' }
                     expected_ids = Issue.visible.all(
                         :include => :custom_values,
                         :conditions => {:custom_values => {:custom_field_id => 1, :value => 'MySQL'}}).map(&:id)
                     assert_select 'issues > issue > id', :count => expected_ids.count do |ids|
                       ids.each { |id| assert expected_ids.delete(id.children.first.content.to_i) }
                     end
                   end
                 end
               end
               context "/index.json" do
                 should_allow_api_authentication(:get, "/projects/private-child/issues.json")
               end
               context "/index.xml with filter" do
                 should "show only issues with the status_id" do
                   get '/issues.xml?status_id=5'
                   expected_ids = Issue.visible.all(:conditions => {:status_id => 5}).map(&:id)
                   assert_select 'issues > issue > id', :count => expected_ids.count do |ids|
                      ids.each { |id| assert expected_ids.delete(id.children.first.content.to_i) }
                   end
                 end
               end
               context "/index.json with filter" do
                 should "show only issues with the status_id" do
                   get '/issues.json?status_id=5'
                   json = ActiveSupport::JSON.decode(response.body)
                   status_ids_used = json['issues'].collect {|j| j['status']['id'] }
                   assert_equal 3, status_ids_used.length
                   assert status_ids_used.all? {|id| id == 5 }
                 end
               end
               # Issue 6 is on a private project
               context "/issues/6.xml" do
                 should_allow_api_authentication(:get, "/issues/6.xml")
               end
               context "/issues/6.json" do
                 should_allow_api_authentication(:get, "/issues/6.json")
               end
               context "GET /issues/:id" do
                 context "with journals" do
                   context ".xml" do
                     should "display journals" do
                       get '/issues/1.xml?include=journals'
                       assert_tag :tag => 'issue',
                         :child => {
                           :tag => 'journals',
                           :attributes => { :type => 'array' },
                           :child => {
                             :tag => 'journal',
                             :attributes => { :id => '1'},
                             :child => {
                               :tag => 'details',
                               :attributes => { :type => 'array' },
                               :child => {
                                 :tag => 'detail',
                                 :attributes => { :name => 'status_id' },
                                 :child => {
                                   :tag => 'old_value',
                                   :content => '1',
                                   :sibling => {
                                     :tag => 'new_value',
                                     :content => '2'
                                   }
                                 }
                               }
                             }
                           }
                         }
                     end
                   end
                 end
                 context "with custom fields" do
                   context ".xml" do
                     should "display custom fields" do
                       get '/issues/3.xml'
                       assert_tag :tag => 'issue',
                         :child => {
                           :tag => 'custom_fields',
                           :attributes => { :type => 'array' },
                           :child => {
                             :tag => 'custom_field',
                             :attributes => { :id => '1'},
                             :child => {
                               :tag => 'value',
                               :content => 'MySQL'
                             }
                           }
                         }
                       assert_nothing_raised do
                         Hash.from_xml(response.body).to_xml
                       end
                     end
                   end
                 end
                 context "with multi custom fields" do
                   setup do
                     field = CustomField.find(1)
                     field.update_attribute :multiple, true
                     issue = Issue.find(3)
                     issue.custom_field_values = {1 => ['MySQL', 'Oracle']}
                     issue.save!
                   end
                   context ".xml" do
                     should "display custom fields" do
                       get '/issues/3.xml'
                       assert_response :success
                       assert_tag :tag => 'issue',
                         :child => {
                           :tag => 'custom_fields',
                           :attributes => { :type => 'array' },
                           :child => {
                             :tag => 'custom_field',
                             :attributes => { :id => '1'},
                             :child => {
                               :tag => 'value',
                               :attributes => { :type => 'array' },
                               :children => { :count => 2 }
                             }
                           }
                         }
                       xml = Hash.from_xml(response.body)
                       custom_fields = xml['issue']['custom_fields']
                       assert_kind_of Array, custom_fields
                       field = custom_fields.detect {|f| f['id'] == '1'}
                       assert_kind_of Hash, field
                       assert_equal ['MySQL', 'Oracle'], field['value'].sort
                     end
                   end
                   context ".json" do
                     should "display custom fields" do
                       get '/issues/3.json'
                       assert_response :success
                       json = ActiveSupport::JSON.decode(response.body)
                       custom_fields = json['issue']['custom_fields']
                       assert_kind_of Array, custom_fields
                       field = custom_fields.detect {|f| f['id'] == 1}
                       assert_kind_of Hash, field
                       assert_equal ['MySQL', 'Oracle'], field['value'].sort
                     end
                   end
                 end
                 context "with empty value for multi custom field" do
                   setup do
                     field = CustomField.find(1)
                     field.update_attribute :multiple, true
                     issue = Issue.find(3)
                     issue.custom_field_values = {1 => ['']}
                     issue.save!
                   end
                   context ".xml" do
                     should "display custom fields" do
                       get '/issues/3.xml'
                       assert_response :success
                       assert_tag :tag => 'issue',
                         :child => {
                           :tag => 'custom_fields',
                           :attributes => { :type => 'array' },
                           :child => {
                             :tag => 'custom_field',
                             :attributes => { :id => '1'},
                             :child => {
                               :tag => 'value',
                               :attributes => { :type => 'array' },
                               :children => { :count => 0 }
                             }
                           }
                         }
                       xml = Hash.from_xml(response.body)
                       custom_fields = xml['issue']['custom_fields']
                       assert_kind_of Array, custom_fields
                       field = custom_fields.detect {|f| f['id'] == '1'}
                       assert_kind_of Hash, field
                       assert_equal [], field['value']
                     end
                   end
                   context ".json" do
                     should "display custom fields" do
                       get '/issues/3.json'
                       assert_response :success
                       json = ActiveSupport::JSON.decode(response.body)
                       custom_fields = json['issue']['custom_fields']
                       assert_kind_of Array, custom_fields
                       field = custom_fields.detect {|f| f['id'] == 1}
                       assert_kind_of Hash, field
                       assert_equal [], field['value'].sort
                     end
                   end
                 end
                 context "with attachments" do
                   context ".xml" do
                     should "display attachments" do
                       get '/issues/3.xml?include=attachments'
                       assert_tag :tag => 'issue',
                         :child => {
                           :tag => 'attachments',
                           :children => {:count => 5},
                           :child => {
                             :tag => 'attachment',
                             :child => {
                               :tag => 'filename',
                               :content => 'source.rb',
                               :sibling => {
                                 :tag => 'content_url',
                                 :content => 'http://www.example.com/attachments/download/4/source.rb'
                               }
                             }
                           }
                         }
                     end
                   end
                 end
                 context "with subtasks" do
                   setup do
                     @c1 = Issue.generate!(:status_id => 1, :subject => "child c1", :tracker_id => 1, :project_id => 1, :parent_issue_id => 1)
                     @c2 = Issue.generate!(:status_id => 1, :subject => "child c2", :tracker_id => 1, :project_id => 1, :parent_issue_id => 1)
                     @c3 = Issue.generate!(:status_id => 1, :subject => "child c3", :tracker_id => 1, :project_id => 1, :parent_issue_id => @c1.id)
                   end
                   context ".xml" do
                     should "display children" do
                       get '/issues/1.xml?include=children'
                       assert_tag :tag => 'issue',
                         :child => {
                           :tag => 'children',
                           :children => {:count => 2},
                           :child => {
                             :tag => 'issue',
                             :attributes => {:id => @c1.id.to_s},
                             :child => {
                               :tag => 'subject',
                               :content => 'child c1',
                               :sibling => {
                                 :tag => 'children',
                                 :children => {:count => 1},
                                 :child => {
                                   :tag => 'issue',
                                   :attributes => {:id => @c3.id.to_s}
                                 }
                               }
                             }
                           }
                         }
                     end
                     context ".json" do
                       should "display children" do
                         get '/issues/1.json?include=children'
                         json = ActiveSupport::JSON.decode(response.body)
                         assert_equal([
                           {
                             'id' => @c1.id, 'subject' => 'child c1', 'tracker' => {'id' => 1, 'name' => 'Bug'},
                             'children' => [{ 'id' => @c3.id, 'subject' => 'child c3', 'tracker' => {'id' => 1, 'name' => 'Bug'} }]
                           },
                           { 'id' => @c2.id, 'subject' => 'child c2', 'tracker' => {'id' => 1, 'name' => 'Bug'} }
                           ],
                           json['issue']['children'])
                       end
                     end
                   end
                 end
               end
               context "POST /issues.xml" do
                 should_allow_api_authentication(:post,
                                                 '/issues.xml',
                                                 {:issue => {:project_id => 1, :subject => 'API test', :tracker_id => 2, :status_id => 3}},
                                                 {:success_code => :created})
                 should "create an issue with the attributes" do
                   assert_difference('Issue.count') do
                     post '/issues.xml', {:issue => {:project_id => 1, :subject => 'API test', :tracker_id => 2, :status_id => 3}}, credentials('jsmith')
                   end
                   issue = Issue.first(:order => 'id DESC')
                   assert_equal 1, issue.project_id
                   assert_equal 2, issue.tracker_id
                   assert_equal 3, issue.status_id
                   assert_equal 'API test', issue.subject
                   assert_response :created
                   assert_equal 'application/xml', @response.content_type
                   assert_tag 'issue', :child => {:tag => 'id', :content => issue.id.to_s}
                 end
               end
               context "POST /issues.xml with failure" do
                 should "have an errors tag" do
                   assert_no_difference('Issue.count') do
                     post '/issues.xml', {:issue => {:project_id => 1}}, credentials('jsmith')
                   end
                   assert_tag :errors, :child => {:tag => 'error', :content => "Subject can't be blank"}
                 end
               end
               context "POST /issues.json" do
                 should_allow_api_authentication(:post,
                                                 '/issues.json',
                                                 {:issue => {:project_id => 1, :subject => 'API test', :tracker_id => 2, :status_id => 3}},
                                                 {:success_code => :created})
                 should "create an issue with the attributes" do
                   assert_difference('Issue.count') do
                     post '/issues.json', {:issue => {:project_id => 1, :subject => 'API test', :tracker_id => 2, :status_id => 3}}, credentials('jsmith')
                   end
                   issue = Issue.first(:order => 'id DESC')
                   assert_equal 1, issue.project_id
                   assert_equal 2, issue.tracker_id
                   assert_equal 3, issue.status_id
                   assert_equal 'API test', issue.subject
                 end
               end
               context "POST /issues.json with failure" do
                 should "have an errors element" do
                   assert_no_difference('Issue.count') do
                     post '/issues.json', {:issue => {:project_id => 1}}, credentials('jsmith')
                   end
                   json = ActiveSupport::JSON.decode(response.body)
                   assert json['errors'].include?(['subject', "can't be blank"])
                 end
               end
               # Issue 6 is on a private project
               context "PUT /issues/6.xml" do
                 setup do
                   @parameters = {:issue => {:subject => 'API update', :notes => 'A new note'}}
                 end
                 should_allow_api_authentication(:put,
                                                 '/issues/6.xml',
                                                 {:issue => {:subject => 'API update', :notes => 'A new note'}},
                                                 {:success_code => :ok})
                 should "not create a new issue" do
                   assert_no_difference('Issue.count') do
                     put '/issues/6.xml', @parameters, credentials('jsmith')
                   end
                 end
                 should "create a new journal" do
                   assert_difference('Journal.count') do
                     put '/issues/6.xml', @parameters, credentials('jsmith')
                   end
                 end
                 should "add the note to the journal" do
                   put '/issues/6.xml', @parameters, credentials('jsmith')
                   journal = Journal.last
                   assert_equal "A new note", journal.notes
                 end
                 should "update the issue" do
                   put '/issues/6.xml', @parameters, credentials('jsmith')
                   issue = Issue.find(6)
                   assert_equal "API update", issue.subject
                 end
               end
               context "PUT /issues/3.xml with custom fields" do
                 setup do
                   @parameters = {:issue => {:custom_fields => [{'id' => '1', 'value' => 'PostgreSQL' }, {'id' => '2', 'value' => '150'}]}}
                 end
                 should "update custom fields" do
                   assert_no_difference('Issue.count') do
                     put '/issues/3.xml', @parameters, credentials('jsmith')
                   end
                   issue = Issue.find(3)
                   assert_equal '150', issue.custom_value_for(2).value
                   assert_equal 'PostgreSQL', issue.custom_value_for(1).value
                 end
               end
               context "PUT /issues/3.xml with multi custom fields" do
                 setup do
                   field = CustomField.find(1)
                   field.update_attribute :multiple, true
                   @parameters = {:issue => {:custom_fields => [{'id' => '1', 'value' => ['MySQL', 'PostgreSQL'] }, {'id' => '2', 'value' => '150'}]}}
                 end
                 should "update custom fields" do
                   assert_no_difference('Issue.count') do
                     put '/issues/3.xml', @parameters, credentials('jsmith')
                   end
                   issue = Issue.find(3)
                   assert_equal '150', issue.custom_value_for(2).value
                   assert_equal ['MySQL', 'PostgreSQL'], issue.custom_field_value(1).sort
                 end
               end
               context "PUT /issues/3.xml with project change" do
                 setup do
                   @parameters = {:issue => {:project_id => 2, :subject => 'Project changed'}}
                 end
                 should "update project" do
                   assert_no_difference('Issue.count') do
                     put '/issues/3.xml', @parameters, credentials('jsmith')
                   end
                   issue = Issue.find(3)
                   assert_equal 2, issue.project_id
                   assert_equal 'Project changed', issue.subject
                 end
               end
               context "PUT /issues/6.xml with failed update" do
                 setup do
                   @parameters = {:issue => {:subject => ''}}
                 end
                 should "not create a new issue" do
                   assert_no_difference('Issue.count') do
                     put '/issues/6.xml', @parameters, credentials('jsmith')
                   end
                 end
                 should "not create a new journal" do
                   assert_no_difference('Journal.count') do
                     put '/issues/6.xml', @parameters, credentials('jsmith')
                   end
                 end
                 should "have an errors tag" do
                   put '/issues/6.xml', @parameters, credentials('jsmith')
                   assert_tag :errors, :child => {:tag => 'error', :content => "Subject can't be blank"}
                 end
               end
               context "PUT /issues/6.json" do
                 setup do
                   @parameters = {:issue => {:subject => 'API update', :notes => 'A new note'}}
                 end
                 should_allow_api_authentication(:put,
                                                 '/issues/6.json',
                                                 {:issue => {:subject => 'API update', :notes => 'A new note'}},
                                                 {:success_code => :ok})
                 should "not create a new issue" do
                   assert_no_difference('Issue.count') do
                     put '/issues/6.json', @parameters, credentials('jsmith')
                   end
                 end
                 should "create a new journal" do
                   assert_difference('Journal.count') do
                     put '/issues/6.json', @parameters, credentials('jsmith')
                   end
                 end
                 should "add the note to the journal" do
                   put '/issues/6.json', @parameters, credentials('jsmith')
                   journal = Journal.last
                   assert_equal "A new note", journal.notes
                 end
                 should "update the issue" do
                   put '/issues/6.json', @parameters, credentials('jsmith')
                   issue = Issue.find(6)
                   assert_equal "API update", issue.subject
                 end
               end
               context "PUT /issues/6.json with failed update" do
                 setup do
                   @parameters = {:issue => {:subject => ''}}
                 end
                 should "not create a new issue" do
                   assert_no_difference('Issue.count') do
                     put '/issues/6.json', @parameters, credentials('jsmith')
                   end
                 end
                 should "not create a new journal" do
                   assert_no_difference('Journal.count') do
                     put '/issues/6.json', @parameters, credentials('jsmith')
                   end
                 end
                 should "have an errors attribute" do
                   put '/issues/6.json', @parameters, credentials('jsmith')
                   json = ActiveSupport::JSON.decode(response.body)
                   assert json['errors'].include?(['subject', "can't be blank"])
                 end
               end
               context "DELETE /issues/1.xml" do
                 should_allow_api_authentication(:delete,
                                                 '/issues/6.xml',
                                                 {},
                                                 {:success_code => :ok})
                 should "delete the issue" do
                   assert_difference('Issue.count',-1) do
                     delete '/issues/6.xml', {}, credentials('jsmith')
                   end
                   assert_nil Issue.find_by_id(6)
                 end
               end
               context "DELETE /issues/1.json" do
                 should_allow_api_authentication(:delete,
                                                 '/issues/6.json',
                                                 {},
                                                 {:success_code => :ok})
                 should "delete the issue" do
                   assert_difference('Issue.count',-1) do
                     delete '/issues/6.json', {}, credentials('jsmith')
                   end
                   assert_nil Issue.find_by_id(6)
                 end
               end
+              def test_create_issue_with_uploaded_file
+                set_tmp_attachments_directory
+                # upload the file
+                assert_difference 'Attachment.count' do
+                  post '/uploads.xml', 'test_create_with_upload', {'Content-Type' => 'application/octet-stream'}.merge(credentials('jsmith'))
+                  assert_response :created
+                end
+                xml = Hash.from_xml(response.body)
+                token = xml['upload']['token']
+                attachment = Attachment.first(:order => 'id DESC')
+                # create the issue with the upload's token
+                assert_difference 'Issue.count' do
+                  post '/issues.xml',
+                    {:issue => {:project_id => 1, :subject => 'Uploaded file', :uploads => [{:token => token, :filename => 'test.txt', :content_type => 'text/plain'}]}},
+                    credentials('jsmith')
+                  assert_response :created
+                end
+                issue = Issue.first(:order => 'id DESC')
+                assert_equal 1, issue.attachments.count
+                assert_equal attachment, issue.attachments.first
+                attachment.reload
+                assert_equal 'test.txt', attachment.filename
+                assert_equal 'text/plain', attachment.content_type
+                assert_equal 'test_create_with_upload'.size, attachment.filesize
+                assert_equal 2, attachment.author_id
+                # get the issue with its attachments
+                get "/issues/#{issue.id}.xml", :include => 'attachments'
+                assert_response :success
+                xml = Hash.from_xml(response.body)
+                attachments = xml['issue']['attachments']
+                assert_kind_of Array, attachments
+                assert_equal 1, attachments.size
+                url = attachments.first['content_url']
+                assert_not_nil url
+                # download the attachment
+                get url
+                assert_response :success
+              end
+              def test_update_issue_with_uploaded_file
+                set_tmp_attachments_directory
+                # upload the file
+                assert_difference 'Attachment.count' do
+                  post '/uploads.xml', 'test_upload_with_upload', {'Content-Type' => 'application/octet-stream'}.merge(credentials('jsmith'))
+                  assert_response :created
+                end
+                xml = Hash.from_xml(response.body)
+                token = xml['upload']['token']
+                attachment = Attachment.first(:order => 'id DESC')
+                # update the issue with the upload's token
+                assert_difference 'Journal.count' do
+                  put '/issues/1.xml',
+                    {:issue => {:notes => 'Attachment added', :uploads => [{:token => token, :filename => 'test.txt', :content_type => 'text/plain'}]}},
+                    credentials('jsmith')
+                  assert_response :ok
+                end
+                issue = Issue.find(1)
+                assert_include attachment, issue.attachments
+              end
             end

test/integration/routing/attachments_test.rb +8 0

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.expand_path('../../../test_helper', __FILE__)
             class RoutingAttachmentsTest < ActionController::IntegrationTest
               def test_attachments
                 assert_routing(
                        { :method => 'get', :path => "/attachments/1" },
                        { :controller => 'attachments', :action => 'show', :id => '1' }
                      )
                 assert_routing(
                        { :method => 'get', :path => "/attachments/1.xml" },
                        { :controller => 'attachments', :action => 'show', :id => '1', :format => 'xml' }
                      )
                 assert_routing(
                        { :method => 'get', :path => "/attachments/1.json" },
                        { :controller => 'attachments', :action => 'show', :id => '1', :format => 'json' }
                      )
                 assert_routing(
                        { :method => 'get', :path => "/attachments/1/filename.ext" },
                        { :controller => 'attachments', :action => 'show', :id => '1',
                          :filename => 'filename.ext' }
                      )
                 assert_routing(
                        { :method => 'get', :path => "/attachments/download/1" },
                        { :controller => 'attachments', :action => 'download', :id => '1' }
                      )
                 assert_routing(
                        { :method => 'get', :path => "/attachments/download/1/filename.ext" },
                        { :controller => 'attachments', :action => 'download', :id => '1',
                          :filename => 'filename.ext' }
                      )
                 assert_routing(
                        { :method => 'delete', :path => "/attachments/1" },
                        { :controller => 'attachments', :action => 'destroy', :id => '1' }
                      )
+                assert_routing(
+                       { :method => 'post', :path => '/uploads.xml' },
+                       { :controller => 'attachments', :action => 'upload', :format => 'xml' }
+                )
+                assert_routing(
+                       { :method => 'post', :path => '/uploads.json' },
+                       { :controller => 'attachments', :action => 'upload', :format => 'json' }
+                )
               end
             end

vendor/plugins/acts_as_attachable/lib/acts_as_attachable.rb +11 -6

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             module Redmine
               module Acts
                 module Attachable
                   def self.included(base)
                     base.extend ClassMethods
                   end
                   module ClassMethods
                     def acts_as_attachable(options = {})
                       cattr_accessor :attachable_options
                       self.attachable_options = {}
                       attachable_options[:view_permission] = options.delete(:view_permission) || "view_#{self.name.pluralize.underscore}".to_sym
                       attachable_options[:delete_permission] = options.delete(:delete_permission) || "edit_#{self.name.pluralize.underscore}".to_sym
                       has_many :attachments, options.merge(:as => :container,
                                                            :order => "#{Attachment.table_name}.created_on",
                                                            :dependent => :destroy)
                       send :include, Redmine::Acts::Attachable::InstanceMethods
                       before_save :attach_saved_attachments
                     end
                   end
                   module InstanceMethods
                     def self.included(base)
                       base.extend ClassMethods
                     end
                     def attachments_visible?(user=User.current)
                       (respond_to?(:visible?) ? visible?(user) : true) &&
                         user.allowed_to?(self.class.attachable_options[:view_permission], self.project)
                     end
                     def attachments_deletable?(user=User.current)
                       (respond_to?(:visible?) ? visible?(user) : true) &&
                         user.allowed_to?(self.class.attachable_options[:delete_permission], self.project)
                     end
                     def saved_attachments
                       @saved_attachments ||= []
                     end
                     def unsaved_attachments
                       @unsaved_attachments ||= []
                     end
                     def save_attachments(attachments, author=User.current)
-                      if attachments && attachments.is_a?(Hash)
+                      if attachments.is_a?(Hash)
-                        attachments.each_value do |attachment|
+                        attachments = attachments.values
+                      end
+                      if attachments.is_a?(Array)
+                        attachments.each do |attachment|
                           a = nil
                           if file = attachment['file']
-                            next unless file && file.size > 0
+                            next unless file.size > 0
-                            a = Attachment.create(:file => file,
+                            a = Attachment.create(:file => file, :author => author)
-                                                  :description => attachment['description'].to_s.strip,
-                                                  :author => author)
                           elsif token = attachment['token']
                             a = Attachment.find_by_token(token)
+                            next unless a
+                            a.filename = attachment['filename'] unless attachment['filename'].blank?
+                            a.content_type = attachment['content_type']
                           end
                           next unless a
+                          a.description = attachment['description'].to_s.strip
                           if a.new_record?
                             unsaved_attachments << a
                           else
                             saved_attachments << a
                           end
                         end
                       end
                       {:files => saved_attachments, :unsaved => unsaved_attachments}
                     end
                     def attach_saved_attachments
                       saved_attachments.each do |attachment|
                         self.attachments << attachment
                       end
                     end
                     module ClassMethods
                     end
                   end
                 end
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages