uploads_controller.rb 1.15 KB
Newer Older
1
class UploadsController < ApplicationController
2
  skip_before_filter :authenticate_user!, :reject_blocked!
3 4
  before_filter :authorize_access

5
  def show
6 7 8
    unless upload_model && upload_mount
      return not_found!
    end
9

10 11
    model = upload_model.find(params[:id])
    uploader = model.send(upload_mount)
12

13 14 15
    if model.respond_to?(:project) && !can?(current_user, :read_project, model.project)
      return not_found!
    end
16

17 18 19 20 21 22 23
    unless uploader.file_storage?
      return redirect_to uploader.url
    end

    unless uploader.file.exists?
      return not_found!
    end
24 25 26

    disposition = uploader.image? ? 'inline' : 'attachment'
    send_file uploader.file.path, disposition: disposition
27
  end
28

29 30
  private

31 32
  def authorize_access
    unless params[:mounted_as] == 'avatar'
33
      authenticate_user! && reject_blocked!
34 35
    end
  end
36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54

  def upload_model
    upload_models = {
      user: User,
      project: Project,
      note: Note,
      group: Group
    }

    upload_models[params[:model].to_sym]
  end

  def upload_mount
    upload_mounts = %w(avatar attachment file)

    if upload_mounts.include?(params[:mounted_as])
      params[:mounted_as]
    end
  end
55
end