jro_apps/redmine Commit - r1669:9b579de9e234

Appends the filename to the attachment url so that clients that ignore content-disposition http header get the real filename (#1649)....

Jean-Philippe Lang -

r1669:9b579de9e234

parent child

Context file:

r1669:9b579de9e234

Collapse all files

app/controllers/attachments_controller.rb +3 0

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class AttachmentsController < ApplicationController
               layout 'base'
               before_filter :find_project
               def show
                 if @attachment.is_diff?
                   @diff = File.new(@attachment.diskfile, "rb").read
                   render :action => 'diff'
                 elsif @attachment.is_text?
                   @content = File.new(@attachment.diskfile, "rb").read
                   render :action => 'file'
                 elsif
                   download
                 end
               end
               def download
                 @attachment.increment_download if @attachment.container.is_a?(Version)
                 # images are sent inline
                 send_file @attachment.diskfile, :filename => filename_for_content_disposition(@attachment.filename),
                                                 :type => @attachment.content_type,
                                                 :disposition => (@attachment.image? ? 'inline' : 'attachment')
               end
             private
               def find_project
                 @attachment = Attachment.find(params[:id])
+                # Show 404 if the filename in the url is wrong
+                raise ActiveRecord::RecordNotFound if params[:filename] && params[:filename] != @attachment.filename
                 @project = @attachment.project
                 permission = @attachment.container.is_a?(Version) ? :view_files : "view_#{@attachment.container.class.name.underscore.pluralize}".to_sym
                 allowed = User.current.allowed_to?(permission, @project)
                 allowed ? true : (User.current.logged? ? render_403 : require_login)
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
             end

app/helpers/application_helper.rb +11 0

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require 'coderay'
             require 'coderay/helpers/file_type'
             module ApplicationHelper
               include Redmine::WikiFormatting::Macros::Definitions
               def current_role
                 @current_role ||= User.current.role_for_project(@project)
               end
               # Return true if user is authorized for controller/action, otherwise false
               def authorize_for(controller, action)
                 User.current.allowed_to?({:controller => controller, :action => action}, @project)
               end
               # Display a link if user is authorized
               def link_to_if_authorized(name, options = {}, html_options = nil, *parameters_for_method_reference)
                 link_to(name, options, html_options, *parameters_for_method_reference) if authorize_for(options[:controller] || params[:controller], options[:action])
               end
               # Display a link to user's account page
               def link_to_user(user)
                 user ? link_to(user, :controller => 'account', :action => 'show', :id => user) : 'Anonymous'
               end
               def link_to_issue(issue, options={})
                 options[:class] ||= ''
                 options[:class] << ' issue'
                 options[:class] << ' closed' if issue.closed?
                 link_to "#{issue.tracker.name} ##{issue.id}", {:controller => "issues", :action => "show", :id => issue}, options
               end
+              # Generates a link to an attachment.
+              # Options:
+              # * :text - Link text (default to attachment filename)
+              # * :download - Force download (default: false)
+              def link_to_attachment(attachment, options={})
+                text = options.delete(:text) || attachment.filename
+                action = options.delete(:download) ? 'download' : 'show'
+                link_to(h(text), {:controller => 'attachments', :action => action, :id => attachment, :filename => attachment.filename }, options)
+              end
               def toggle_link(name, id, options={})
                 onclick = "Element.toggle('#{id}'); "
                 onclick << (options[:focus] ? "Form.Element.focus('#{options[:focus]}'); " : "this.blur(); ")
                 onclick << "return false;"
                 link_to(name, "#", :onclick => onclick)
               end
               def image_to_function(name, function, html_options = {})
                 html_options.symbolize_keys!
                 tag(:input, html_options.merge({
                     :type => "image", :src => image_path(name),
                     :onclick => (html_options[:onclick] ? "#{html_options[:onclick]}; " : "") + "#{function};"
                     }))
               end
               def prompt_to_remote(name, text, param, url, html_options = {})
                 html_options[:onclick] = "promptToRemote('#{text}', '#{param}', '#{url_for(url)}'); return false;"
                 link_to name, {}, html_options
               end
               def format_date(date)
                 return nil unless date
                 # "Setting.date_format.size < 2" is a temporary fix (content of date_format setting changed)
                 @date_format ||= (Setting.date_format.blank? || Setting.date_format.size < 2 ? l(:general_fmt_date) : Setting.date_format)
                 date.strftime(@date_format)
               end
               def format_time(time, include_date = true)
                 return nil unless time
                 time = time.to_time if time.is_a?(String)
                 zone = User.current.time_zone
                 local = zone ? time.in_time_zone(zone) : (time.utc? ? time.utc_to_local : time)
                 @date_format ||= (Setting.date_format.blank? || Setting.date_format.size < 2 ? l(:general_fmt_date) : Setting.date_format)
                 @time_format ||= (Setting.time_format.blank? ? l(:general_fmt_time) : Setting.time_format)
                 include_date ? local.strftime("#{@date_format} #{@time_format}") : local.strftime(@time_format)
               end
               # Truncates and returns the string as a single line
               def truncate_single_line(string, *args)
                 truncate(string, *args).gsub(%r{[\r\n]+}m, ' ')
               end
               def html_hours(text)
                 text.gsub(%r{(\d+)\.(\d+)}, '<span class="hours hours-int">\1</span><span class="hours hours-dec">.\2</span>')
               end
               def authoring(created, author)
                 time_tag = content_tag('acronym', distance_of_time_in_words(Time.now, created), :title => format_time(created))
                 author_tag = (author.is_a?(User) && !author.anonymous?) ? link_to(h(author), :controller => 'account', :action => 'show', :id => author) : h(author || 'Anonymous')
                 l(:label_added_time_by, author_tag, time_tag)
               end
               def l_or_humanize(s)
                 l_has_string?("label_#{s}".to_sym) ? l("label_#{s}".to_sym) : s.to_s.humanize
               end
               def day_name(day)
                 l(:general_day_names).split(',')[day-1]
               end
               def month_name(month)
                 l(:actionview_datehelper_select_month_names).split(',')[month-1]
               end
               def syntax_highlight(name, content)
                 type = CodeRay::FileType[name]
                 type ? CodeRay.scan(content, type).html : h(content)
               end
               def to_path_param(path)
                 path.to_s.split(%r{[/\\]}).select {|p| !p.blank?}
               end
               def pagination_links_full(paginator, count=nil, options={})
                 page_param = options.delete(:page_param) || :page
                 url_param = params.dup
                 # don't reuse params if filters are present
                 url_param.clear if url_param.has_key?(:set_filter)
                 html = ''
                 html << link_to_remote(('&#171; ' + l(:label_previous)),
                                         {:update => 'content',
                                          :url => url_param.merge(page_param => paginator.current.previous),
                                          :complete => 'window.scrollTo(0,0)'},
                                         {:href => url_for(:params => url_param.merge(page_param => paginator.current.previous))}) + ' ' if paginator.current.previous
                 html << (pagination_links_each(paginator, options) do |n|
                   link_to_remote(n.to_s,
                                   {:url => {:params => url_param.merge(page_param => n)},
                                    :update => 'content',
                                    :complete => 'window.scrollTo(0,0)'},
                                   {:href => url_for(:params => url_param.merge(page_param => n))})
                 end || '')
                 html << ' ' + link_to_remote((l(:label_next) + ' &#187;'),
                                              {:update => 'content',
                                               :url => url_param.merge(page_param => paginator.current.next),
                                               :complete => 'window.scrollTo(0,0)'},
                                              {:href => url_for(:params => url_param.merge(page_param => paginator.current.next))}) if paginator.current.next
                 unless count.nil?
                   html << [" (#{paginator.current.first_item}-#{paginator.current.last_item}/#{count})", per_page_links(paginator.items_per_page)].compact.join(' | ')
                 end
                 html
               end
               def per_page_links(selected=nil)
                 url_param = params.dup
                 url_param.clear if url_param.has_key?(:set_filter)
                 links = Setting.per_page_options_array.collect do |n|
                   n == selected ? n : link_to_remote(n, {:update => "content", :url => params.dup.merge(:per_page => n)},
                                                         {:href => url_for(url_param.merge(:per_page => n))})
                 end
                 links.size > 1 ? l(:label_display_per_page, links.join(', ')) : nil
               end
               def breadcrumb(*args)
                 content_tag('p', args.join(' &#187; ') + ' &#187; ', :class => 'breadcrumb')
               end
               def html_title(*args)
                 if args.empty?
                   title = []
                   title << @project.name if @project
                   title += @html_title if @html_title
                   title << Setting.app_title
                   title.compact.join(' - ')
                 else
                   @html_title ||= []
                   @html_title += args
                 end
               end
               def accesskey(s)
                 Redmine::AccessKeys.key_for s
               end
               # Formats text according to system settings.
               # 2 ways to call this method:
               # * with a String: textilizable(text, options)
               # * with an object and one of its attribute: textilizable(issue, :description, options)
               def textilizable(*args)
                 options = args.last.is_a?(Hash) ? args.pop : {}
                 case args.size
                 when 1
                   obj = nil
                   text = args.shift
                 when 2
                   obj = args.shift
                   text = obj.send(args.shift).to_s
                 else
                   raise ArgumentError, 'invalid arguments to textilizable'
                 end
                 return '' if text.blank?
                 only_path = options.delete(:only_path) == false ? false : true
                 # when using an image link, try to use an attachment, if possible
                 attachments = options[:attachments] || (obj && obj.respond_to?(:attachments) ? obj.attachments : nil)
                 if attachments
                   text = text.gsub(/!((\<|\=|\>)?(\([^\)]+\))?(\[[^\]]+\])?(\{[^\}]+\})?)(\S+\.(gif|jpg|jpeg|png))!/) do |m|
                     style = $1
                     filename = $6
                     rf = Regexp.new(filename,  Regexp::IGNORECASE)
                     # search for the picture in attachments
                     if found = attachments.detect { |att| att.filename =~ rf }
                       image_url = url_for :only_path => only_path, :controller => 'attachments', :action => 'download', :id => found
                       desc = found.description.to_s.gsub(/^([^\(\)]*).*$/, "\\1")
                       alt = desc.blank? ? nil : "(#{desc})"
                       "!#{style}#{image_url}#{alt}!"
                     else
                       "!#{style}#{filename}!"
                     end
                   end
                 end
                 text = (Setting.text_formatting == 'textile') ?
                   Redmine::WikiFormatting.to_html(text) { |macro, args| exec_macro(macro, obj, args) } :
                   simple_format(auto_link(h(text)))
                 # different methods for formatting wiki links
                 case options[:wiki_links]
                 when :local
                   # used for local links to html files
                   format_wiki_link = Proc.new {|project, title| "#{title}.html" }
                 when :anchor
                   # used for single-file wiki export
                   format_wiki_link = Proc.new {|project, title| "##{title}" }
                 else
                   format_wiki_link = Proc.new {|project, title| url_for(:only_path => only_path, :controller => 'wiki', :action => 'index', :id => project, :page => title) }
                 end
                 project = options[:project] || @project || (obj && obj.respond_to?(:project) ? obj.project : nil)
                 # Wiki links
                 #
                 # Examples:
                 #   [[mypage]]
                 #   [[mypage|mytext]]
                 # wiki links can refer other project wikis, using project name or identifier:
                 #   [[project:]] -> wiki starting page
                 #   [[project:|mytext]]
                 #   [[project:mypage]]
                 #   [[project:mypage|mytext]]
                 text = text.gsub(/(!)?(\[\[([^\]\n\|]+)(\|([^\]\n\|]+))?\]\])/) do |m|
                   link_project = project
                   esc, all, page, title = $1, $2, $3, $5
                   if esc.nil?
                     if page =~ /^([^\:]+)\:(.*)$/
                       link_project = Project.find_by_name($1) || Project.find_by_identifier($1)
                       page = $2
                       title ||= $1 if page.blank?
                     end
                     if link_project && link_project.wiki
                       # check if page exists
                       wiki_page = link_project.wiki.find_page(page)
                       link_to((title || page), format_wiki_link.call(link_project, Wiki.titleize(page)),
                                                :class => ('wiki-page' + (wiki_page ? '' : ' new')))
                     else
                       # project or wiki doesn't exist
                       title || page
                     end
                   else
                     all
                   end
                 end
                 # Redmine links
                 #
                 # Examples:
                 #   Issues:
                 #     #52 -> Link to issue #52
                 #   Changesets:
                 #     r52 -> Link to revision 52
                 #     commit:a85130f -> Link to scmid starting with a85130f
                 #   Documents:
                 #     document#17 -> Link to document with id 17
                 #     document:Greetings -> Link to the document with title "Greetings"
                 #     document:"Some document" -> Link to the document with title "Some document"
                 #   Versions:
                 #     version#3 -> Link to version with id 3
                 #     version:1.0.0 -> Link to version named "1.0.0"
                 #     version:"1.0 beta 2" -> Link to version named "1.0 beta 2"
                 #   Attachments:
                 #     attachment:file.zip -> Link to the attachment of the current object named file.zip
                 #   Source files:
                 #     source:some/file -> Link to the file located at /some/file in the project's repository
                 #     source:some/file@52 -> Link to the file's revision 52
                 #     source:some/file#L120 -> Link to line 120 of the file
                 #     source:some/file@52#L120 -> Link to line 120 of the file's revision 52
                 #     export:some/file -> Force the download of the file
                 text = text.gsub(%r{([\s\(,\-\>]|^)(!)?(attachment|document|version|commit|source|export)?((#|r)(\d+)|(:)([^"\s<>][^\s<>]*?|"[^"]+?"))(?=(?=[[:punct:]]\W)|\s|<|$)}) do |m|
                   leading, esc, prefix, sep, oid = $1, $2, $3, $5 || $7, $6 || $8
                   link = nil
                   if esc.nil?
                     if prefix.nil? && sep == 'r'
                       if project && (changeset = project.changesets.find_by_revision(oid))
                         link = link_to("r#{oid}", {:only_path => only_path, :controller => 'repositories', :action => 'revision', :id => project, :rev => oid},
                                                   :class => 'changeset',
                                                   :title => truncate_single_line(changeset.comments, 100))
                       end
                     elsif sep == '#'
                       oid = oid.to_i
                       case prefix
                       when nil
                         if issue = Issue.find_by_id(oid, :include => [:project, :status], :conditions => Project.visible_by(User.current))
                           link = link_to("##{oid}", {:only_path => only_path, :controller => 'issues', :action => 'show', :id => oid},
                                                     :class => (issue.closed? ? 'issue closed' : 'issue'),
                                                     :title => "#{truncate(issue.subject, 100)} (#{issue.status.name})")
                           link = content_tag('del', link) if issue.closed?
                         end
                       when 'document'
                         if document = Document.find_by_id(oid, :include => [:project], :conditions => Project.visible_by(User.current))
                           link = link_to h(document.title), {:only_path => only_path, :controller => 'documents', :action => 'show', :id => document},
                                                             :class => 'document'
                         end
                       when 'version'
                         if version = Version.find_by_id(oid, :include => [:project], :conditions => Project.visible_by(User.current))
                           link = link_to h(version.name), {:only_path => only_path, :controller => 'versions', :action => 'show', :id => version},
                                                           :class => 'version'
                         end
                       end
                     elsif sep == ':'
                       # removes the double quotes if any
                       name = oid.gsub(%r{^"(.*)"$}, "\\1")
                       case prefix
                       when 'document'
                         if project && document = project.documents.find_by_title(name)
                           link = link_to h(document.title), {:only_path => only_path, :controller => 'documents', :action => 'show', :id => document},
                                                             :class => 'document'
                         end
                       when 'version'
                         if project && version = project.versions.find_by_name(name)
                           link = link_to h(version.name), {:only_path => only_path, :controller => 'versions', :action => 'show', :id => version},
                                                           :class => 'version'
                         end
                       when 'commit'
                         if project && (changeset = project.changesets.find(:first, :conditions => ["scmid LIKE ?", "#{name}%"]))
                           link = link_to h("#{name}"), {:only_path => only_path, :controller => 'repositories', :action => 'revision', :id => project, :rev => changeset.revision},
                                                        :class => 'changeset',
                                                        :title => truncate_single_line(changeset.comments, 100)
                         end
                       when 'source', 'export'
                         if project && project.repository
                           name =~ %r{^[/\\]*(.*?)(@([0-9a-f]+))?(#(L\d+))?$}
                           path, rev, anchor = $1, $3, $5
                           link = link_to h("#{prefix}:#{name}"), {:controller => 'repositories', :action => 'entry', :id => project,
                                                                   :path => to_path_param(path),
                                                                   :rev => rev,
                                                                   :anchor => anchor,
                                                                   :format => (prefix == 'export' ? 'raw' : nil)},
                                                                  :class => (prefix == 'export' ? 'source download' : 'source')
                         end
                       when 'attachment'
                         if attachments && attachment = attachments.detect {|a| a.filename == name }
                           link = link_to h(attachment.filename), {:only_path => only_path, :controller => 'attachments', :action => 'download', :id => attachment},
                                                                  :class => 'attachment'
                         end
                       end
                     end
                   end
                   leading + (link || "#{prefix}#{sep}#{oid}")
                 end
                 text
               end
               # Same as Rails' simple_format helper without using paragraphs
               def simple_format_without_paragraph(text)
                 text.to_s.
                   gsub(/\r\n?/, "\n").                    # \r\n and \r -> \n
                   gsub(/\n\n+/, "<br /><br />").          # 2+ newline  -> 2 br
                   gsub(/([^\n]\n)(?=[^\n])/, '\1<br />')  # 1 newline   -> br
               end
               def error_messages_for(object_name, options = {})
                 options = options.symbolize_keys
                 object = instance_variable_get("@#{object_name}")
                 if object && !object.errors.empty?
                   # build full_messages here with controller current language
                   full_messages = []
                   object.errors.each do |attr, msg|
                     next if msg.nil?
                     msg = msg.first if msg.is_a? Array
                     if attr == "base"
                       full_messages << l(msg)
                     else
                       full_messages << "&#171; " + (l_has_string?("field_" + attr) ? l("field_" + attr) : object.class.human_attribute_name(attr)) + " &#187; " + l(msg) unless attr == "custom_values"
                     end
                   end
                   # retrieve custom values error messages
                   if object.errors[:custom_values]
                     object.custom_values.each do |v|
                       v.errors.each do |attr, msg|
                         next if msg.nil?
                         msg = msg.first if msg.is_a? Array
                         full_messages << "&#171; " + v.custom_field.name + " &#187; " + l(msg)
                       end
                     end
                   end
                   content_tag("div",
                     content_tag(
                       options[:header_tag] || "span", lwr(:gui_validation_error, full_messages.length) + ":"
                     ) +
                     content_tag("ul", full_messages.collect { |msg| content_tag("li", msg) }),
                     "id" => options[:id] || "errorExplanation", "class" => options[:class] || "errorExplanation"
                   )
                 else
                   ""
                 end
               end
               def lang_options_for_select(blank=true)
                 (blank ? [["(auto)", ""]] : []) +
                   GLoc.valid_languages.collect{|lang| [ ll(lang.to_s, :general_lang_name), lang.to_s]}.sort{|x,y| x.last <=> y.last }
               end
               def label_tag_for(name, option_tags = nil, options = {})
                 label_text = l(("field_"+field.to_s.gsub(/\_id$/, "")).to_sym) + (options.delete(:required) ? @template.content_tag("span", " *", :class => "required"): "")
                 content_tag("label", label_text)
               end
               def labelled_tabular_form_for(name, object, options, &proc)
                 options[:html] ||= {}
                 options[:html][:class] = 'tabular' unless options[:html].has_key?(:class)
                 form_for(name, object, options.merge({ :builder => TabularFormBuilder, :lang => current_language}), &proc)
               end
               def back_url_hidden_field_tag
                 hidden_field_tag 'back_url', (params[:back_url] || request.env['HTTP_REFERER'])
               end
               def check_all_links(form_name)
                 link_to_function(l(:button_check_all), "checkAll('#{form_name}', true)") +
                 " | " +
                 link_to_function(l(:button_uncheck_all), "checkAll('#{form_name}', false)")
               end
               def progress_bar(pcts, options={})
                 pcts = [pcts, pcts] unless pcts.is_a?(Array)
                 pcts[1] = pcts[1] - pcts[0]
                 pcts << (100 - pcts[1] - pcts[0])
                 width = options[:width] || '100px;'
                 legend = options[:legend] || ''
                 content_tag('table',
                   content_tag('tr',
                     (pcts[0] > 0 ? content_tag('td', '', :width => "#{pcts[0].floor}%;", :class => 'closed') : '') +
                     (pcts[1] > 0 ? content_tag('td', '', :width => "#{pcts[1].floor}%;", :class => 'done') : '') +
                     (pcts[2] > 0 ? content_tag('td', '', :width => "#{pcts[2].floor}%;", :class => 'todo') : '')
                   ), :class => 'progress', :style => "width: #{width};") +
                   content_tag('p', legend, :class => 'pourcent')
               end
               def context_menu_link(name, url, options={})
                 options[:class] ||= ''
                 if options.delete(:selected)
                   options[:class] << ' icon-checked disabled'
                   options[:disabled] = true
                 end
                 if options.delete(:disabled)
                   options.delete(:method)
                   options.delete(:confirm)
                   options.delete(:onclick)
                   options[:class] << ' disabled'
                   url = '#'
                 end
                 link_to name, url, options
               end
               def calendar_for(field_id)
                 include_calendar_headers_tags
                 image_tag("calendar.png", {:id => "#{field_id}_trigger",:class => "calendar-trigger"}) +
                 javascript_tag("Calendar.setup({inputField : '#{field_id}', ifFormat : '%Y-%m-%d', button : '#{field_id}_trigger' });")
               end
               def include_calendar_headers_tags
                 unless @calendar_headers_tags_included
                   @calendar_headers_tags_included = true
                   content_for :header_tags do
                     javascript_include_tag('calendar/calendar') +
                     javascript_include_tag("calendar/lang/calendar-#{current_language}.js") +
                     javascript_include_tag('calendar/calendar-setup') +
                     stylesheet_link_tag('calendar')
                   end
                 end
               end
               def wikitoolbar_for(field_id)
                 return '' unless Setting.text_formatting == 'textile'
                 help_link = l(:setting_text_formatting) + ': ' +
                   link_to(l(:label_help), compute_public_path('wiki_syntax', 'help', 'html'),
                                           :onclick => "window.open(\"#{ compute_public_path('wiki_syntax', 'help', 'html') }\", \"\", \"resizable=yes, location=no, width=300, height=640, menubar=no, status=no, scrollbars=yes\"); return false;")
                 javascript_include_tag('jstoolbar/jstoolbar') +
                   javascript_include_tag("jstoolbar/lang/jstoolbar-#{current_language}") +
                   javascript_tag("var toolbar = new jsToolBar($('#{field_id}')); toolbar.setHelpLink('#{help_link}'); toolbar.draw();")
               end
               def content_for(name, content = nil, &block)
                 @has_content ||= {}
                 @has_content[name] = true
                 super(name, content, &block)
               end
               def has_content?(name)
                 (@has_content && @has_content[name]) || false
               end
             end

app/helpers/issues_helper.rb +2 -2

             # redMine - project management software
             # Copyright (C) 2006  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require 'csv'
             module IssuesHelper
               include ApplicationHelper
               def render_issue_tooltip(issue)
                 @cached_label_start_date ||= l(:field_start_date)
                 @cached_label_due_date ||= l(:field_due_date)
                 @cached_label_assigned_to ||= l(:field_assigned_to)
                 @cached_label_priority ||= l(:field_priority)
                 link_to_issue(issue) + ": #{h(issue.subject)}<br /><br />" +
                   "<strong>#{@cached_label_start_date}</strong>: #{format_date(issue.start_date)}<br />" +
                   "<strong>#{@cached_label_due_date}</strong>: #{format_date(issue.due_date)}<br />" +
                   "<strong>#{@cached_label_assigned_to}</strong>: #{issue.assigned_to}<br />" +
                   "<strong>#{@cached_label_priority}</strong>: #{issue.priority.name}"
               end
               def sidebar_queries
                 unless @sidebar_queries
                   # User can see public queries and his own queries
                   visible = ARCondition.new(["is_public = ? OR user_id = ?", true, (User.current.logged? ? User.current.id : 0)])
                   # Project specific queries and global queries
                   visible << (@project.nil? ? ["project_id IS NULL"] : ["project_id IS NULL OR project_id = ?", @project.id])
                   @sidebar_queries = Query.find(:all,
                                                 :order => "name ASC",
                                                 :conditions => visible.conditions)
                 end
                 @sidebar_queries
               end
               def show_detail(detail, no_html=false)
                 case detail.property
                 when 'attr'
                   label = l(("field_" + detail.prop_key.to_s.gsub(/\_id$/, "")).to_sym)
                   case detail.prop_key
                   when 'due_date', 'start_date'
                     value = format_date(detail.value.to_date) if detail.value
                     old_value = format_date(detail.old_value.to_date) if detail.old_value
                   when 'project_id'
                     p = Project.find_by_id(detail.value) and value = p.name if detail.value
                     p = Project.find_by_id(detail.old_value) and old_value = p.name if detail.old_value
                   when 'status_id'
                     s = IssueStatus.find_by_id(detail.value) and value = s.name if detail.value
                     s = IssueStatus.find_by_id(detail.old_value) and old_value = s.name if detail.old_value
                   when 'tracker_id'
                     t = Tracker.find_by_id(detail.value) and value = t.name if detail.value
                     t = Tracker.find_by_id(detail.old_value) and old_value = t.name if detail.old_value
                   when 'assigned_to_id'
                     u = User.find_by_id(detail.value) and value = u.name if detail.value
                     u = User.find_by_id(detail.old_value) and old_value = u.name if detail.old_value
                   when 'priority_id'
                     e = Enumeration.find_by_id(detail.value) and value = e.name if detail.value
                     e = Enumeration.find_by_id(detail.old_value) and old_value = e.name if detail.old_value
                   when 'category_id'
                     c = IssueCategory.find_by_id(detail.value) and value = c.name if detail.value
                     c = IssueCategory.find_by_id(detail.old_value) and old_value = c.name if detail.old_value
                   when 'fixed_version_id'
                     v = Version.find_by_id(detail.value) and value = v.name if detail.value
                     v = Version.find_by_id(detail.old_value) and old_value = v.name if detail.old_value
                   end
                 when 'cf'
                   custom_field = CustomField.find_by_id(detail.prop_key)
                   if custom_field
                     label = custom_field.name
                     value = format_value(detail.value, custom_field.field_format) if detail.value
                     old_value = format_value(detail.old_value, custom_field.field_format) if detail.old_value
                   end
                 when 'attachment'
                   label = l(:label_attachment)
                 end
                 label ||= detail.prop_key
                 value ||= detail.value
                 old_value ||= detail.old_value
                 unless no_html
                   label = content_tag('strong', label)
                   old_value = content_tag("i", h(old_value)) if detail.old_value
                   old_value = content_tag("strike", old_value) if detail.old_value and (!detail.value or detail.value.empty?)
-                  if detail.property == 'attachment' && !value.blank? && Attachment.find_by_id(detail.prop_key)
+                  if detail.property == 'attachment' && !value.blank? && a = Attachment.find_by_id(detail.prop_key)
                     # Link to the attachment if it has not been removed
-                    value = link_to(value, :controller => 'attachments', :action => 'show', :id => detail.prop_key)
+                    value = link_to_attachment(a)
                   else
                     value = content_tag("i", h(value)) if value
                   end
                 end
                 if !detail.value.blank?
                   case detail.property
                   when 'attr', 'cf'
                     if !detail.old_value.blank?
                       label + " " + l(:text_journal_changed, old_value, value)
                     else
                       label + " " + l(:text_journal_set_to, value)
                     end
                   when 'attachment'
                     "#{label} #{value} #{l(:label_added)}"
                   end
                 else
                   case detail.property
                   when 'attr', 'cf'
                     label + " " + l(:text_journal_deleted) + " (#{old_value})"
                   when 'attachment'
                     "#{label} #{old_value} #{l(:label_deleted)}"
                   end
                 end
               end
               def issues_to_csv(issues, project = nil)
                 ic = Iconv.new(l(:general_csv_encoding), 'UTF-8')
                 decimal_separator = l(:general_csv_decimal_separator)
                 export = StringIO.new
                 CSV::Writer.generate(export, l(:general_csv_separator)) do |csv|
                   # csv header fields
                   headers = [ "#",
                               l(:field_status),
                               l(:field_project),
                               l(:field_tracker),
                               l(:field_priority),
                               l(:field_subject),
                               l(:field_assigned_to),
                               l(:field_category),
                               l(:field_fixed_version),
                               l(:field_author),
                               l(:field_start_date),
                               l(:field_due_date),
                               l(:field_done_ratio),
                               l(:field_estimated_hours),
                               l(:field_created_on),
                               l(:field_updated_on)
                               ]
                   # Export project custom fields if project is given
                   # otherwise export custom fields marked as "For all projects"
                   custom_fields = project.nil? ? IssueCustomField.for_all : project.all_issue_custom_fields
                   custom_fields.each {|f| headers << f.name}
                   # Description in the last column
                   headers << l(:field_description)
                   csv << headers.collect {|c| begin; ic.iconv(c.to_s); rescue; c.to_s; end }
                   # csv lines
                   issues.each do |issue|
                     fields = [issue.id,
                               issue.status.name,
                               issue.project.name,
                               issue.tracker.name,
                               issue.priority.name,
                               issue.subject,
                               issue.assigned_to,
                               issue.category,
                               issue.fixed_version,
                               issue.author.name,
                               format_date(issue.start_date),
                               format_date(issue.due_date),
                               issue.done_ratio,
                               issue.estimated_hours.to_s.gsub('.', decimal_separator),
                               format_time(issue.created_on),
                               format_time(issue.updated_on)
                               ]
                     custom_fields.each {|f| fields << show_value(issue.custom_value_for(f)) }
                     fields << issue.description
                     csv << fields.collect {|c| begin; ic.iconv(c.to_s); rescue; c.to_s; end }
                   end
                 end
                 export.rewind
                 export
               end
             end

app/models/attachment.rb +1 -1

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require "digest/md5"
             class Attachment < ActiveRecord::Base
               belongs_to :container, :polymorphic => true
               belongs_to :author, :class_name => "User", :foreign_key => "author_id"
               validates_presence_of :container, :filename, :author
               validates_length_of :filename, :maximum => 255
               validates_length_of :disk_filename, :maximum => 255
               acts_as_event :title => :filename,
-                            :url => Proc.new {|o| {:controller => 'attachments', :action => 'download', :id => o.id}}
+                            :url => Proc.new {|o| {:controller => 'attachments', :action => 'download', :id => o.id, :filename => o.filename}}
               cattr_accessor :storage_path
               @@storage_path = "#{RAILS_ROOT}/files"
               def validate
                 errors.add_to_base :too_long if self.filesize > Setting.attachment_max_size.to_i.kilobytes
               end
               def file=(incoming_file)
                 unless incoming_file.nil?
                   @temp_file = incoming_file
                   if @temp_file.size > 0
                     self.filename = sanitize_filename(@temp_file.original_filename)
                     self.disk_filename = Attachment.disk_filename(filename)
                     self.content_type = @temp_file.content_type.to_s.chomp
                     self.filesize = @temp_file.size
                   end
                 end
               end
               def file
                 nil
               end
               # Copy temp file to its final location
               def before_save
                 if @temp_file && (@temp_file.size > 0)
                   logger.debug("saving '#{self.diskfile}'")
                   File.open(diskfile, "wb") do |f|
                     f.write(@temp_file.read)
                   end
                   self.digest = Digest::MD5.hexdigest(File.read(diskfile))
                 end
                 # Don't save the content type if it's longer than the authorized length
                 if self.content_type && self.content_type.length > 255
                   self.content_type = nil
                 end
               end
               # Deletes file on the disk
               def after_destroy
                 File.delete(diskfile) if !filename.blank? && File.exist?(diskfile)
               end
               # Returns file's location on disk
               def diskfile
                 "#{@@storage_path}/#{self.disk_filename}"
               end
               def increment_download
                 increment!(:downloads)
               end
               def project
                 container.project
               end
               def image?
                 self.filename =~ /\.(jpe?g|gif|png)$/i
               end
               def is_text?
                 Redmine::MimeType.is_type?('text', filename)
               end
               def is_diff?
                 self.filename =~ /\.(patch|diff)$/i
               end
             private
               def sanitize_filename(value)
                 # get only the filename, not the whole path
                 just_filename = value.gsub(/^.*(\\|\/)/, '')
                 # NOTE: File.basename doesn't work right with Windows paths on Unix
                 # INCORRECT: just_filename = File.basename(value.gsub('\\\\', '/'))
                 # Finally, replace all non alphanumeric, hyphens or periods with underscore
                 @filename = just_filename.gsub(/[^\w\.\-]/,'_')
               end
               # Returns an ASCII or hashed filename
               def self.disk_filename(filename)
                 df = DateTime.now.strftime("%y%m%d%H%M%S") + "_"
                 if filename =~ %r{^[a-zA-Z0-9_\.\-]*$}
                   df << filename
                 else
                   df << Digest::MD5.hexdigest(filename)
                   # keep the extension if any
                   df << $1 if filename =~ %r{(\.[a-zA-Z0-9]+)$}
                 end
                 df
               end
             end

app/views/attachments/_links.rhtml +1 -1

             <div class="attachments">
             <% for attachment in attachments %>
-            <p><%= link_to attachment.filename, {:controller => 'attachments', :action => 'show', :id => attachment }, :class => 'icon icon-attachment' -%>
+            <p><%= link_to_attachment attachment, :class => 'icon icon-attachment' -%>
             <%= h(" - #{attachment.description}") unless attachment.description.blank? %>
               <span class="size">(<%= number_to_human_size attachment.filesize %>)</span>
               <% if options[:delete_url] %>
                 <%= link_to image_tag('delete.png'), options[:delete_url].update({:attachment_id => attachment}),
                                                      :confirm => l(:text_are_you_sure),
                                                      :method => :post,
                                                      :class => 'delete',
                                                      :title => l(:button_delete) %>
               <% end %>
               <% unless options[:no_author] %>
                 <span class="author"><%= attachment.author %>, <%= format_time(attachment.created_on) %></span>
               <% end %>
               </p>
             <% end %>
             </div>

app/views/attachments/diff.rhtml +1 -1

             <h2><%=h @attachment.filename %></h2>
             <div class="attachments">
             <p><%= h("#{@attachment.description} - ") unless @attachment.description.blank? %>
                <span class="author"><%= @attachment.author %>, <%= format_time(@attachment.created_on) %></span></p>
-            <p><%= link_to l(:button_download), {:controller => 'attachments', :action => 'download', :id => @attachment } -%>
+            <p><%= link_to_attachment @attachment, :text => l(:button_download), :download => true -%>
                <span class="size">(<%= number_to_human_size @attachment.filesize %>)</span></p>
             </div>
             &nbsp;
             <%= render :partial => 'common/diff', :locals => {:diff => @diff, :diff_type => @diff_type} %>
             <% content_for :header_tags do -%>
                 <%= stylesheet_link_tag "scm" -%>
             <% end -%>

app/views/attachments/file.rhtml +1 -1

             <h2><%=h @attachment.filename %></h2>
             <div class="attachments">
             <p><%= h("#{@attachment.description} - ") unless @attachment.description.blank? %>
                <span class="author"><%= @attachment.author %>, <%= format_time(@attachment.created_on) %></span></p>
-            <p><%= link_to l(:button_download), {:controller => 'attachments', :action => 'download', :id => @attachment } -%>
+            <p><%= link_to_attachment @attachment, :text => l(:button_download), :download => true -%>
                <span class="size">(<%= number_to_human_size @attachment.filesize %>)</span></p>
             </div>
             &nbsp;
             <%= render :partial => 'common/file', :locals => {:content => @content, :filename => @attachment.filename} %>
             <% content_for :header_tags do -%>
                 <%= stylesheet_link_tag "scm" -%>
             <% end -%>

app/views/projects/list_files.rhtml +1 -2

             <div class="contextual">
             <%= link_to_if_authorized l(:label_attachment_new), {:controller => 'projects', :action => 'add_file', :id => @project}, :class => 'icon icon-add' %>
             </div>
             <h2><%=l(:label_attachment_plural)%></h2>
             <% delete_allowed = authorize_for('versions', 'destroy_file') %>
             <table class="list">
               <thead><tr>
                 <th><%=l(:field_version)%></th>
                 <%= sort_header_tag("#{Attachment.table_name}.filename", :caption => l(:field_filename)) %>
                 <%= sort_header_tag("#{Attachment.table_name}.created_on", :caption => l(:label_date), :default_order => 'desc') %>
                 <%= sort_header_tag("#{Attachment.table_name}.filesize", :caption => l(:field_filesize), :default_order => 'desc') %>
                 <%= sort_header_tag("#{Attachment.table_name}.downloads", :caption => l(:label_downloads_abbr), :default_order => 'desc') %>
                 <th>MD5</th>
                 <% if delete_allowed %><th></th><% end %>
               </tr></thead>
               <tbody>
             <% for version in @versions %>
               <% unless version.attachments.empty? %>
               <tr><th colspan="7" align="left"><span class="icon icon-package"><b><%= version.name %></b></span></th></tr>
               <% for file in version.attachments %>
               <tr class="<%= cycle("odd", "even") %>">
                 <td></td>
-                <td><%= link_to(h(file.filename), {:controller => 'attachments', :action => 'download', :id => file},
+                <td><%= link_to_attachment file, :download => true, :title => file.description %></td>
-                                                  :title => file.description) %></td>
                 <td align="center"><%= format_time(file.created_on) %></td>
                 <td align="center"><%= number_to_human_size(file.filesize) %></td>
                 <td align="center"><%= file.downloads %></td>
                 <td align="center"><small><%= file.digest %></small></td>
                 <% if delete_allowed %>
                 <td align="center">
                     <%= link_to_if_authorized image_tag('delete.png'), {:controller => 'versions', :action => 'destroy_file', :id => version, :attachment_id => file}, :confirm => l(:text_are_you_sure), :method => :post %>
                 </td>
                 <% end %>
               </tr>
               <% end
               reset_cycle %>
               <% end %>
             <% end %>
               </tbody>
             </table>
             <% html_title(l(:label_attachment_plural)) -%>

config/routes.rb +3 -1

             ActionController::Routing::Routes.draw do |map|
               # Add your own custom routes here.
               # The priority is based upon order of creation: first created -> highest priority.
               # Here's a sample route:
               # map.connect 'products/:id', :controller => 'catalog', :action => 'view'
               # Keep in mind you can assign values other than :controller and :action
               map.home '', :controller => 'welcome'
               map.signin 'login', :controller => 'account', :action => 'login'
               map.signout 'logout', :controller => 'account', :action => 'logout'
               map.connect 'wiki/:id/:page/:action', :controller => 'wiki', :page => nil
               map.connect 'roles/workflow/:id/:role_id/:tracker_id', :controller => 'roles', :action => 'workflow'
               map.connect 'help/:ctrl/:page', :controller => 'help'
               #map.connect ':controller/:action/:id/:sort_key/:sort_order'
               map.connect 'issues/:issue_id/relations/:action/:id', :controller => 'issue_relations'
               map.connect 'projects/:project_id/issues/:action', :controller => 'issues'
               map.connect 'projects/:project_id/news/:action', :controller => 'news'
               map.connect 'projects/:project_id/documents/:action', :controller => 'documents'
               map.connect 'projects/:project_id/boards/:action/:id', :controller => 'boards'
               map.connect 'projects/:project_id/timelog/:action/:id', :controller => 'timelog'
               map.connect 'boards/:board_id/topics/:action/:id', :controller => 'messages'
               map.with_options :controller => 'repositories' do |omap|
                 omap.repositories_show 'repositories/browse/:id/*path', :action => 'browse'
                 omap.repositories_changes 'repositories/changes/:id/*path', :action => 'changes'
                 omap.repositories_diff 'repositories/diff/:id/*path', :action => 'diff'
                 omap.repositories_entry 'repositories/entry/:id/*path', :action => 'entry'
                 omap.repositories_entry 'repositories/annotate/:id/*path', :action => 'annotate'
                 omap.repositories_revision 'repositories/revision/:id/:rev', :action => 'revision'
               end
-              map.connect 'attachments/:id', :controller => 'attachments', :action => 'show'
+              map.connect 'attachments/:id', :controller => 'attachments', :action => 'show', :id => /\d+/
+              map.connect 'attachments/:id/:filename', :controller => 'attachments', :action => 'show', :id => /\d+/, :filename => /.*/
+              map.connect 'attachments/download/:id/:filename', :controller => 'attachments', :action => 'download', :id => /\d+/, :filename => /.*/
               # Allow downloading Web Service WSDL as a file with an extension
               # instead of a file named 'wsdl'
               map.connect ':controller/service.wsdl', :action => 'wsdl'
               # Install the default route as the lowest priority.
               map.connect ':controller/:action/:id'
             end

test/functional/attachments_controller_test.rb +15 0

             # redMine - project management software
             # Copyright (C) 2006-2008  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.dirname(__FILE__) + '/../test_helper'
             require 'attachments_controller'
             # Re-raise errors caught by the controller.
             class AttachmentsController; def rescue_action(e) raise e end; end
             class AttachmentsControllerTest < Test::Unit::TestCase
               fixtures :users, :projects, :issues, :attachments
               def setup
                 @controller = AttachmentsController.new
                 @request    = ActionController::TestRequest.new
                 @response   = ActionController::TestResponse.new
                 Attachment.storage_path = "#{RAILS_ROOT}/test/fixtures/files"
                 User.current = nil
               end
+              def test_routing
+                assert_routing('/attachments/1', :controller => 'attachments', :action => 'show', :id => '1')
+                assert_routing('/attachments/1/filename.ext', :controller => 'attachments', :action => 'show', :id => '1', :filename => 'filename.ext')
+                assert_routing('/attachments/download/1', :controller => 'attachments', :action => 'download', :id => '1')
+                assert_routing('/attachments/download/1/filename.ext', :controller => 'attachments', :action => 'download', :id => '1', :filename => 'filename.ext')
+              end
+              def test_recognizes
+                assert_recognizes({:controller => 'attachments', :action => 'show', :id => '1'}, '/attachments/1')
+                assert_recognizes({:controller => 'attachments', :action => 'show', :id => '1'}, '/attachments/show/1')
+                assert_recognizes({:controller => 'attachments', :action => 'show', :id => '1', :filename => 'filename.ext'}, '/attachments/1/filename.ext')
+                assert_recognizes({:controller => 'attachments', :action => 'download', :id => '1'}, '/attachments/download/1')
+                assert_recognizes({:controller => 'attachments', :action => 'download', :id => '1', :filename => 'filename.ext'},'/attachments/download/1/filename.ext')
+              end
               def test_show_diff
                 get :show, :id => 5
                 assert_response :success
                 assert_template 'diff'
               end
               def test_show_text_file
                 get :show, :id => 4
                 assert_response :success
                 assert_template 'file'
               end
               def test_show_other
                 get :show, :id => 6
                 assert_response :success
                 assert_equal 'application/octet-stream', @response.content_type
               end
               def test_download_text_file
                 get :download, :id => 4
                 assert_response :success
                 assert_equal 'application/x-ruby', @response.content_type
               end
               def test_anonymous_on_private_private
                 get :download, :id => 7
                 assert_redirected_to 'account/login'
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages