jro_apps/redmine Commit - r1668:8a7bfc72b20a

Move VersionsController#download to AttachmentsController....

Jean-Philippe Lang -

r1668:8a7bfc72b20a

parent child

Context file:

r1668:8a7bfc72b20a

Collapse all files

app/controllers/attachments_controller.rb +8 -4

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class AttachmentsController < ApplicationController
               layout 'base'
-              before_filter :find_project, :check_project_privacy
+              before_filter :find_project
               def show
                 if @attachment.is_diff?
                   @diff = File.new(@attachment.diskfile, "rb").read
                   render :action => 'diff'
                 elsif @attachment.is_text?
                   @content = File.new(@attachment.diskfile, "rb").read
                   render :action => 'file'
                 elsif
                   download
                 end
               end
               def download
+                @attachment.increment_download if @attachment.container.is_a?(Version)
                 # images are sent inline
                 send_file @attachment.diskfile, :filename => filename_for_content_disposition(@attachment.filename),
                                                 :type => @attachment.content_type,
                                                 :disposition => (@attachment.image? ? 'inline' : 'attachment')
               end
             private
               def find_project
                 @attachment = Attachment.find(params[:id])
-                #render_404 and return false unless File.readable?(@attachment.diskfile)
                 @project = @attachment.project
-              #rescue
+                permission = @attachment.container.is_a?(Version) ? :view_files : "view_#{@attachment.container.class.name.underscore.pluralize}".to_sym
-              #  render_404
+                allowed = User.current.allowed_to?(permission, @project)
+                allowed ? true : (User.current.logged? ? render_403 : require_login)
+              rescue ActiveRecord::RecordNotFound
+                render_404
               end
             end

app/controllers/documents_controller.rb 0 -9

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class DocumentsController < ApplicationController
               layout 'base'
               before_filter :find_project, :only => [:index, :new]
               before_filter :find_document, :except => [:index, :new]
               before_filter :authorize
               helper :attachments
               def index
                 @sort_by = %w(category date title author).include?(params[:sort_by]) ? params[:sort_by] : 'category'
                 documents = @project.documents.find :all, :include => [:attachments, :category]
                 case @sort_by
                 when 'date'
                   @grouped = documents.group_by {|d| d.created_on.to_date }
                 when 'title'
                   @grouped = documents.group_by {|d| d.title.first.upcase}
                 when 'author'
                   @grouped = documents.select{|d| d.attachments.any?}.group_by {|d| d.attachments.last.author}
                 else
                   @grouped = documents.group_by(&:category)
                 end
                 render :layout => false if request.xhr?
               end
               def show
                 @attachments = @document.attachments.find(:all, :order => "created_on DESC")
               end
               def new
                 @document = @project.documents.build(params[:document])
                 if request.post? and @document.save
                   attach_files(@document, params[:attachments])
                   flash[:notice] = l(:notice_successful_create)
                   Mailer.deliver_document_added(@document) if Setting.notified_events.include?('document_added')
                   redirect_to :action => 'index', :project_id => @project
                 end
               end
               def edit
                 @categories = Enumeration::get_values('DCAT')
                 if request.post? and @document.update_attributes(params[:document])
                   flash[:notice] = l(:notice_successful_update)
                   redirect_to :action => 'show', :id => @document
                 end
               end
               def destroy
                 @document.destroy
                 redirect_to :controller => 'documents', :action => 'index', :project_id => @project
               end
-              def download
-                @attachment = @document.attachments.find(params[:attachment_id])
-                @attachment.increment_download
-                send_file @attachment.diskfile, :filename => filename_for_content_disposition(@attachment.filename),
-                                                :type => @attachment.content_type
-              rescue
-                render_404
-              end
               def add_attachment
                 attachments = attach_files(@document, params[:attachments])
                 Mailer.deliver_attachments_added(attachments) if !attachments.empty? && Setting.notified_events.include?('document_added')
                 redirect_to :action => 'show', :id => @document
               end
               def destroy_attachment
                 @document.attachments.find(params[:attachment_id]).destroy
                 redirect_to :action => 'show', :id => @document
               end
             private
               def find_project
                 @project = Project.find(params[:project_id])
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def find_document
                 @document = Document.find(params[:id])
                 @project = @document.project
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
             end

app/controllers/versions_controller.rb 0 -9

             # redMine - project management software
             # Copyright (C) 2006  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class VersionsController < ApplicationController
               layout 'base'
               menu_item :roadmap
               before_filter :find_project, :authorize
               def show
               end
               def edit
                 if request.post? and @version.update_attributes(params[:version])
                   flash[:notice] = l(:notice_successful_update)
                   redirect_to :controller => 'projects', :action => 'settings', :tab => 'versions', :id => @project
                 end
               end
               def destroy
                 @version.destroy
                 redirect_to :controller => 'projects', :action => 'settings', :tab => 'versions', :id => @project
               rescue
                 flash[:error] = "Unable to delete version"
                 redirect_to :controller => 'projects', :action => 'settings', :tab => 'versions', :id => @project
               end
-              def download
-                @attachment = @version.attachments.find(params[:attachment_id])
-                @attachment.increment_download
-                send_file @attachment.diskfile, :filename => filename_for_content_disposition(@attachment.filename),
-                                                :type => @attachment.content_type
-              rescue
-                render_404
-              end
               def destroy_file
                 @version.attachments.find(params[:attachment_id]).destroy
                 flash[:notice] = l(:notice_successful_delete)
                 redirect_to :controller => 'projects', :action => 'list_files', :id => @project
               end
               def status_by
                 respond_to do |format|
                   format.html { render :action => 'show' }
                   format.js { render(:update) {|page| page.replace_html 'status_by', render_issue_status_by(@version, params[:status_by])} }
                 end
               end
             private
               def find_project
                 @version = Version.find(params[:id])
                 @project = @version.project
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
             end

app/views/projects/list_files.rhtml +2 -2

             <div class="contextual">
             <%= link_to_if_authorized l(:label_attachment_new), {:controller => 'projects', :action => 'add_file', :id => @project}, :class => 'icon icon-add' %>
             </div>
             <h2><%=l(:label_attachment_plural)%></h2>
             <% delete_allowed = authorize_for('versions', 'destroy_file') %>
             <table class="list">
               <thead><tr>
                 <th><%=l(:field_version)%></th>
                 <%= sort_header_tag("#{Attachment.table_name}.filename", :caption => l(:field_filename)) %>
                 <%= sort_header_tag("#{Attachment.table_name}.created_on", :caption => l(:label_date), :default_order => 'desc') %>
                 <%= sort_header_tag("#{Attachment.table_name}.filesize", :caption => l(:field_filesize), :default_order => 'desc') %>
                 <%= sort_header_tag("#{Attachment.table_name}.downloads", :caption => l(:label_downloads_abbr), :default_order => 'desc') %>
                 <th>MD5</th>
                 <% if delete_allowed %><th></th><% end %>
               </tr></thead>
               <tbody>
             <% for version in @versions %>
               <% unless version.attachments.empty? %>
               <tr><th colspan="7" align="left"><span class="icon icon-package"><b><%= version.name %></b></span></th></tr>
               <% for file in version.attachments %>
               <tr class="<%= cycle("odd", "even") %>">
                 <td></td>
-                <td><%= link_to(file.filename, {:controller => 'versions', :action => 'download', :id => version, :attachment_id => file},
+                <td><%= link_to(h(file.filename), {:controller => 'attachments', :action => 'download', :id => file},
-                                               :title => file.description) %></td>
+                                                  :title => file.description) %></td>
                 <td align="center"><%= format_time(file.created_on) %></td>
                 <td align="center"><%= number_to_human_size(file.filesize) %></td>
                 <td align="center"><%= file.downloads %></td>
                 <td align="center"><small><%= file.digest %></small></td>
                 <% if delete_allowed %>
                 <td align="center">
                     <%= link_to_if_authorized image_tag('delete.png'), {:controller => 'versions', :action => 'destroy_file', :id => version, :attachment_id => file}, :confirm => l(:text_are_you_sure), :method => :post %>
                 </td>
                 <% end %>
               </tr>
               <% end
               reset_cycle %>
               <% end %>
             <% end %>
               </tbody>
             </table>
             <% html_title(l(:label_attachment_plural)) -%>

test/fixtures/attachments.yml +13 0

             ---
             attachments_001:
               created_on: 2006-07-19 21:07:27 +02:00
               downloads: 0
               content_type: text/plain
               disk_filename: 060719210727_error281.txt
               container_id: 3
               digest: b91e08d0cf966d5c6ff411bd8c4cc3a2
               id: 1
               container_type: Issue
               filesize: 28
               filename: error281.txt
               author_id: 2
             attachments_002:
               created_on: 2006-07-19 21:07:27 +02:00
               downloads: 0
               content_type: text/plain
               disk_filename: 060719210727_document.txt
               container_id: 1
               digest: b91e08d0cf966d5c6ff411bd8c4cc3a2
               id: 2
               container_type: Document
               filesize: 28
               filename: document.txt
               author_id: 2
             attachments_003:
               created_on: 2006-07-19 21:07:27 +02:00
               downloads: 0
               content_type: image/gif
               disk_filename: 060719210727_logo.gif
               container_id: 4
               digest: b91e08d0cf966d5c6ff411bd8c4cc3a2
               id: 3
               container_type: WikiPage
               filesize: 280
               filename: logo.gif
               description: This is a logo
               author_id: 2
             attachments_004:
               created_on: 2006-07-19 21:07:27 +02:00
               container_type: Issue
               container_id: 3
               downloads: 0
               disk_filename: 060719210727_source.rb
               digest: b91e08d0cf966d5c6ff411bd8c4cc3a2
               id: 4
               filesize: 153
               filename: source.rb
               author_id: 2
               description: This is a Ruby source file
               content_type: application/x-ruby
             attachments_005:
               created_on: 2006-07-19 21:07:27 +02:00
               container_type: Issue
               container_id: 3
               downloads: 0
               disk_filename: 060719210727_changeset.diff
               digest: b91e08d0cf966d5c6ff411bd8c4cc3a2
               id: 5
               filesize: 687
               filename: changeset.diff
               author_id: 2
               content_type: text/x-diff
             attachments_006:
               created_on: 2006-07-19 21:07:27 +02:00
               container_type: Issue
               container_id: 3
               downloads: 0
               disk_filename: 060719210727_archive.zip
               digest: b91e08d0cf966d5c6ff411bd8c4cc3a2
               id: 6
               filesize: 157
               filename: archive.zip
               author_id: 2
               content_type: application/octet-stream
+            attachments_007:
+              created_on: 2006-07-19 21:07:27 +02:00
+              container_type: Issue
+              container_id: 4
+              downloads: 0
+              disk_filename: 060719210727_archive.zip
+              digest: b91e08d0cf966d5c6ff411bd8c4cc3a2
+              id: 7
+              filesize: 157
+              filename: archive.zip
+              author_id: 1
+              content_type: application/octet-stream
+  No newline at end of file

test/functional/attachments_controller_test.rb +5 0

             # redMine - project management software
             # Copyright (C) 2006-2008  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.dirname(__FILE__) + '/../test_helper'
             require 'attachments_controller'
             # Re-raise errors caught by the controller.
             class AttachmentsController; def rescue_action(e) raise e end; end
             class AttachmentsControllerTest < Test::Unit::TestCase
               fixtures :users, :projects, :issues, :attachments
               def setup
                 @controller = AttachmentsController.new
                 @request    = ActionController::TestRequest.new
                 @response   = ActionController::TestResponse.new
                 Attachment.storage_path = "#{RAILS_ROOT}/test/fixtures/files"
                 User.current = nil
               end
               def test_show_diff
                 get :show, :id => 5
                 assert_response :success
                 assert_template 'diff'
               end
               def test_show_text_file
                 get :show, :id => 4
                 assert_response :success
                 assert_template 'file'
               end
               def test_show_other
                 get :show, :id => 6
                 assert_response :success
                 assert_equal 'application/octet-stream', @response.content_type
               end
               def test_download_text_file
                 get :download, :id => 4
                 assert_response :success
                 assert_equal 'application/x-ruby', @response.content_type
               end
+              def test_anonymous_on_private_private
+                get :download, :id => 7
+                assert_redirected_to 'account/login'
+              end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages