| @@ -17,7 +17,7 | |||
|
|
17 | 17 | |
|
|
18 | 18 | class AttachmentsController < ApplicationController |
|
|
19 | 19 | layout 'base' |
|
|
20 |
before_filter :find_project |
|
|
|
20 | before_filter :find_project | |
|
|
21 | 21 | |
|
|
22 | 22 | def show |
|
|
23 | 23 | if @attachment.is_diff? |
| @@ -32,6 +32,8 class AttachmentsController < ApplicationController | |||
|
|
32 | 32 | end |
|
|
33 | 33 | |
|
|
34 | 34 | def download |
|
|
35 | @attachment.increment_download if @attachment.container.is_a?(Version) | |
|
|
36 | ||
|
|
35 | 37 | # images are sent inline |
|
|
36 | 38 | send_file @attachment.diskfile, :filename => filename_for_content_disposition(@attachment.filename), |
|
|
37 | 39 | :type => @attachment.content_type, |
| @@ -41,9 +43,11 class AttachmentsController < ApplicationController | |||
|
|
41 | 43 | private |
|
|
42 | 44 | def find_project |
|
|
43 | 45 | @attachment = Attachment.find(params[:id]) |
|
|
44 | #render_404 and return false unless File.readable?(@attachment.diskfile) | |
|
|
45 | 46 | @project = @attachment.project |
|
|
46 | #rescue | |
|
|
47 | # render_404 | |
|
|
47 | permission = @attachment.container.is_a?(Version) ? :view_files : "view_#{@attachment.container.class.name.underscore.pluralize}".to_sym | |
|
|
48 | allowed = User.current.allowed_to?(permission, @project) | |
|
|
49 | allowed ? true : (User.current.logged? ? render_403 : require_login) | |
|
|
50 | rescue ActiveRecord::RecordNotFound | |
|
|
51 | render_404 | |
|
|
48 | 52 | end |
|
|
49 | 53 | end |
| @@ -65,15 +65,6 class DocumentsController < ApplicationController | |||
|
|
65 | 65 | @document.destroy |
|
|
66 | 66 | redirect_to :controller => 'documents', :action => 'index', :project_id => @project |
|
|
67 | 67 | end |
|
|
68 | ||
|
|
69 | def download | |
|
|
70 | @attachment = @document.attachments.find(params[:attachment_id]) | |
|
|
71 | @attachment.increment_download | |
|
|
72 | send_file @attachment.diskfile, :filename => filename_for_content_disposition(@attachment.filename), | |
|
|
73 | :type => @attachment.content_type | |
|
|
74 | rescue | |
|
|
75 | render_404 | |
|
|
76 | end | |
|
|
77 | 68 | |
|
|
78 | 69 | def add_attachment |
|
|
79 | 70 | attachments = attach_files(@document, params[:attachments]) |
| @@ -37,15 +37,6 class VersionsController < ApplicationController | |||
|
|
37 | 37 | flash[:error] = "Unable to delete version" |
|
|
38 | 38 | redirect_to :controller => 'projects', :action => 'settings', :tab => 'versions', :id => @project |
|
|
39 | 39 | end |
|
|
40 | ||
|
|
41 | def download | |
|
|
42 | @attachment = @version.attachments.find(params[:attachment_id]) | |
|
|
43 | @attachment.increment_download | |
|
|
44 | send_file @attachment.diskfile, :filename => filename_for_content_disposition(@attachment.filename), | |
|
|
45 | :type => @attachment.content_type | |
|
|
46 | rescue | |
|
|
47 | render_404 | |
|
|
48 | end | |
|
|
49 | 40 | |
|
|
50 | 41 | def destroy_file |
|
|
51 | 42 | @version.attachments.find(params[:attachment_id]).destroy |
| @@ -23,8 +23,8 | |||
|
|
23 | 23 | <% for file in version.attachments %> |
|
|
24 | 24 | <tr class="<%= cycle("odd", "even") %>"> |
|
|
25 | 25 | <td></td> |
|
|
26 |
<td><%= link_to(file.filename, {:controller => ' |
|
|
|
27 | :title => file.description) %></td> | |
|
|
26 | <td><%= link_to(h(file.filename), {:controller => 'attachments', :action => 'download', :id => file}, | |
|
|
27 | :title => file.description) %></td> | |
|
|
28 | 28 | <td align="center"><%= format_time(file.created_on) %></td> |
|
|
29 | 29 | <td align="center"><%= number_to_human_size(file.filesize) %></td> |
|
|
30 | 30 | <td align="center"><%= file.downloads %></td> |
| @@ -73,3 +73,16 attachments_006: | |||
|
|
73 | 73 | filename: archive.zip |
|
|
74 | 74 | author_id: 2 |
|
|
75 | 75 | content_type: application/octet-stream |
|
|
76 | attachments_007: | |
|
|
77 | created_on: 2006-07-19 21:07:27 +02:00 | |
|
|
78 | container_type: Issue | |
|
|
79 | container_id: 4 | |
|
|
80 | downloads: 0 | |
|
|
81 | disk_filename: 060719210727_archive.zip | |
|
|
82 | digest: b91e08d0cf966d5c6ff411bd8c4cc3a2 | |
|
|
83 | id: 7 | |
|
|
84 | filesize: 157 | |
|
|
85 | filename: archive.zip | |
|
|
86 | author_id: 1 | |
|
|
87 | content_type: application/octet-stream | |
|
|
88 | No newline at end of file | |
| @@ -56,4 +56,9 class AttachmentsControllerTest < Test::Unit::TestCase | |||
|
|
56 | 56 | assert_response :success |
|
|
57 | 57 | assert_equal 'application/x-ruby', @response.content_type |
|
|
58 | 58 | end |
|
|
59 | ||
|
|
60 | def test_anonymous_on_private_private | |
|
|
61 | get :download, :id => 7 | |
|
|
62 | assert_redirected_to 'account/login' | |
|
|
63 | end | |
|
|
59 | 64 | end |
General Comments 0
You need to be logged in to leave comments.
Login now