attachment.rb 15.3 KB
Newer Older
1
# Redmine - project management software
jplang's avatar
jplang committed
2
# Copyright (C) 2006-2017  Jean-Philippe Lang
3
4
5
6
7
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
8
#
9
10
11
12
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
13
#
14
15
16
17
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

18
require "digest"
19
require "fileutils"
20
21

class Attachment < ActiveRecord::Base
22
  include Redmine::SafeAttributes
23
  belongs_to :container, :polymorphic => true
24
  belongs_to :author, :class_name => "User"
25

26
  validates_presence_of :filename, :author
jplang's avatar
jplang committed
27
28
  validates_length_of :filename, :maximum => 255
  validates_length_of :disk_filename, :maximum => 255
29
  validates_length_of :description, :maximum => 255
30
  validate :validate_max_file_size, :validate_file_extension
jplang's avatar
jplang committed
31
32

  acts_as_event :title => :filename,
33
                :url => Proc.new {|o| {:controller => 'attachments', :action => 'show', :id => o.id, :filename => o.filename}}
jplang's avatar
jplang committed
34

jplang's avatar
jplang committed
35
36
  acts_as_activity_provider :type => 'files',
                            :permission => :view_files,
37
                            :author_key => :author_id,
jplang's avatar
jplang committed
38
39
40
                            :scope => select("#{Attachment.table_name}.*").
                                      joins("LEFT JOIN #{Version.table_name} ON #{Attachment.table_name}.container_type='Version' AND #{Version.table_name}.id = #{Attachment.table_name}.container_id " +
                                            "LEFT JOIN #{Project.table_name} ON #{Version.table_name}.project_id = #{Project.table_name}.id OR ( #{Attachment.table_name}.container_type='Project' AND #{Attachment.table_name}.container_id = #{Project.table_name}.id )")
41

jplang's avatar
jplang committed
42
43
  acts_as_activity_provider :type => 'documents',
                            :permission => :view_documents,
44
                            :author_key => :author_id,
jplang's avatar
jplang committed
45
46
47
                            :scope => select("#{Attachment.table_name}.*").
                                      joins("LEFT JOIN #{Document.table_name} ON #{Attachment.table_name}.container_type='Document' AND #{Document.table_name}.id = #{Attachment.table_name}.container_id " +
                                            "LEFT JOIN #{Project.table_name} ON #{Document.table_name}.project_id = #{Project.table_name}.id")
jplang's avatar
jplang committed
48

49
  cattr_accessor :storage_path
jplang's avatar
jplang committed
50
  @@storage_path = Redmine::Configuration['attachments_storage_path'] || File.join(Rails.root, "files")
51

52
53
54
  cattr_accessor :thumbnails_storage_path
  @@thumbnails_storage_path = File.join(Rails.root, "tmp", "thumbnails")

55
  before_create :files_to_final_location
56
  after_rollback :delete_from_disk, :on => :create
57
  after_commit :delete_from_disk, :on => :destroy
58
  after_commit :reuse_existing_file_if_possible, :on => :create
59

60
61
  safe_attributes 'filename', 'content_type', 'description'

62
63
64
65
66
67
68
69
  # Returns an unsaved copy of the attachment
  def copy(attributes=nil)
    copy = self.class.new
    copy.attributes = self.attributes.dup.except("id", "downloads")
    copy.attributes = attributes if attributes
    copy
  end

70
  def validate_max_file_size
71
    if @temp_file && self.filesize > Setting.attachment_max_size.to_i.kilobytes
72
      errors.add(:base, l(:error_attachment_too_big, :max_size => Setting.attachment_max_size.to_i.kilobytes))
73
    end
74
75
  end

76
77
78
79
80
81
82
83
84
  def validate_file_extension
    if @temp_file
      extension = File.extname(filename)
      unless self.class.valid_extension?(extension)
        errors.add(:base, l(:error_attachment_extension_not_allowed, :extension => extension))
      end
    end
  end

85
86
87
  def file=(incoming_file)
    unless incoming_file.nil?
      @temp_file = incoming_file
88
89
        if @temp_file.respond_to?(:original_filename)
          self.filename = @temp_file.original_filename
jplang's avatar
jplang committed
90
          self.filename.force_encoding("UTF-8")
91
92
93
94
        end
        if @temp_file.respond_to?(:content_type)
          self.content_type = @temp_file.content_type.to_s.chomp
        end
95
96
97
        self.filesize = @temp_file.size
    end
  end
98

99
100
101
102
  def file
    nil
  end

103
104
105
106
107
  def filename=(arg)
    write_attribute :filename, sanitize_filename(arg.to_s)
    filename
  end

108
109
  # Copies the temporary file to its final location
  # and computes its MD5 hash
110
  def files_to_final_location
111
    if @temp_file
112
113
      self.disk_directory = target_directory
      self.disk_filename = Attachment.disk_filename(filename, disk_directory)
114
      logger.info("Saving attachment '#{self.diskfile}' (#{@temp_file.size} bytes)") if logger
115
116
117
118
      path = File.dirname(diskfile)
      unless File.directory?(path)
        FileUtils.mkdir_p(path)
      end
119
      sha = Digest::SHA256.new
120
      File.open(diskfile, "wb") do |f|
121
122
123
124
        if @temp_file.respond_to?(:read)
          buffer = ""
          while (buffer = @temp_file.read(8192))
            f.write(buffer)
125
            sha.update(buffer)
126
127
128
          end
        else
          f.write(@temp_file)
129
          sha.update(@temp_file)
130
        end
131
      end
132
      self.digest = sha.hexdigest
133
    end
134
    @temp_file = nil
135
136
137
138

    if content_type.blank? && filename.present?
      self.content_type = Redmine::MimeType.of(filename)
    end
139
140
141
142
143
144
    # Don't save the content type if it's longer than the authorized length
    if self.content_type && self.content_type.length > 255
      self.content_type = nil
    end
  end

145
  # Deletes the file from the file system if it's not referenced by other attachments
146
  def delete_from_disk
jplang's avatar
jplang committed
147
    if Attachment.where("disk_filename = ? AND id <> ?", disk_filename, id).empty?
148
149
      delete_from_disk!
    end
150
151
152
153
  end

  # Returns file's location on disk
  def diskfile
154
    File.join(self.class.storage_path, disk_directory.to_s, disk_filename.to_s)
155
  end
156

jplang's avatar
jplang committed
157
  def title
158
    title = filename.dup
jplang's avatar
jplang committed
159
160
161
162
163
164
    if description.present?
      title << " (#{description})"
    end
    title
  end

165
166
167
  def increment_download
    increment!(:downloads)
  end
168
169

  def project
170
    container.try(:project)
171
  end
172

173
  def visible?(user=User.current)
jplang's avatar
jplang committed
174
175
176
177
178
    if container_id
      container && container.attachments_visible?(user)
    else
      author == user
    end
179
  end
180

181
182
183
184
185
186
187
188
  def editable?(user=User.current)
    if container_id
      container && container.attachments_editable?(user)
    else
      author == user
    end
  end

189
  def deletable?(user=User.current)
jplang's avatar
jplang committed
190
191
192
193
194
    if container_id
      container && container.attachments_deletable?(user)
    else
      author == user
    end
195
  end
196

197
  def image?
198
199
200
201
202
203
204
205
206
    !!(self.filename =~ /\.(bmp|gif|jpg|jpe|jpeg|png)$/i)
  end

  def thumbnailable?
    image?
  end

  # Returns the full path the attachment thumbnail, or nil
  # if the thumbnail cannot be generated.
207
  def thumbnail(options={})
208
    if thumbnailable? && readable?
209
210
211
212
213
214
215
216
217
      size = options[:size].to_i
      if size > 0
        # Limit the number of thumbnails per image
        size = (size / 50) * 50
        # Maximum thumbnail size
        size = 800 if size > 800
      else
        size = Setting.thumbnails_size.to_i
      end
218
      size = 100 unless size > 0
219
      target = File.join(self.class.thumbnails_storage_path, "#{digest}_#{filesize}_#{size}.thumb")
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234

      begin
        Redmine::Thumbnail.generate(self.diskfile, target, size)
      rescue => e
        logger.error "An error occured while generating thumbnail for #{disk_filename} to #{target}\nException was: #{e.message}" if logger
        return nil
      end
    end
  end

  # Deletes all thumbnails
  def self.clear_thumbnails
    Dir.glob(File.join(thumbnails_storage_path, "*.thumb")).each do |file|
      File.delete file
    end
235
  end
236

jplang's avatar
jplang committed
237
238
239
  def is_text?
    Redmine::MimeType.is_type?('text', filename)
  end
240

241
242
243
244
  def is_image?
    Redmine::MimeType.is_type?('image', filename)
  end

245
246
247
  def is_diff?
    self.filename =~ /\.(patch|diff)$/i
  end
248

jplang's avatar
jplang committed
249
250
251
252
  def is_pdf?
    Redmine::MimeType.of(filename) == "application/pdf"
  end

253
254
255
256
257
258
259
260
  def is_video?
    Redmine::MimeType.is_type?('video', filename)
  end

  def is_audio?
    Redmine::MimeType.is_type?('audio', filename)
  end

261
  def previewable?
262
    is_text? || is_image? || is_video? || is_audio?
263
264
  end

265
266
  # Returns true if the file is readable
  def readable?
267
    disk_filename.present? && File.readable?(diskfile)
268
  end
269

270
271
272
273
274
275
276
277
278
  # Returns the attachment token
  def token
    "#{id}.#{digest}"
  end

  # Finds an attachment that matches the given token and that has no container
  def self.find_by_token(token)
    if token.to_s =~ /^(\d+)\.([0-9a-f]+)$/
      attachment_id, attachment_digest = $1, $2
279
      attachment = Attachment.find_by(:id => attachment_id, :digest => attachment_digest)
280
281
282
283
284
285
      if attachment && attachment.container.nil?
        attachment
      end
    end
  end

286
287
288
289
290
291
  # Bulk attaches a set of files to an object
  #
  # Returns a Hash of the results:
  # :files => array of the attached files
  # :unsaved => array of the files that could not be attached
  def self.attach_files(obj, attachments)
292
293
294
    result = obj.save_attachments(attachments, User.current)
    obj.attach_saved_attachments
    result
295
  end
296

297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
  # Updates the filename and description of a set of attachments
  # with the given hash of attributes. Returns true if all
  # attachments were updated.
  #
  # Example:
  #   Attachment.update_attachments(attachments, {
  #     4 => {:filename => 'foo'},
  #     7 => {:filename => 'bar', :description => 'file description'}
  #   })
  #
  def self.update_attachments(attachments, params)
    params = params.transform_keys {|key| key.to_i}

    saved = true
    transaction do
      attachments.each do |attachment|
        if p = params[attachment.id]
          attachment.filename = p[:filename] if p.key?(:filename)
          attachment.description = p[:description] if p.key?(:description)
          saved &&= attachment.save
        end
      end
      unless saved
        raise ActiveRecord::Rollback
      end
    end
    saved
  end

326
  def self.latest_attach(attachments, filename)
jplang's avatar
jplang committed
327
    attachments.sort_by(&:created_on).reverse.detect do |att|
328
      filename.casecmp(att.filename) == 0
jplang's avatar
jplang committed
329
    end
330
331
  end

332
  def self.prune(age=1.day)
jplang's avatar
jplang committed
333
    Attachment.where("created_on < ? AND (container_type IS NULL OR container_type = '')", Time.now - age).destroy_all
334
335
  end

336
  # Moves an existing attachment to its target directory
337
  def move_to_target_directory!
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
    return unless !new_record? & readable?

    src = diskfile
    self.disk_directory = target_directory
    dest = diskfile

    return if src == dest

    if !FileUtils.mkdir_p(File.dirname(dest))
      logger.error "Could not create directory #{File.dirname(dest)}" if logger
      return
    end

    if !FileUtils.mv(src, dest)
      logger.error "Could not move attachment from #{src} to #{dest}" if logger
      return
354
    end
355
356

    update_column :disk_directory, disk_directory
357
358
359
360
361
362
363
364
365
366
  end

  # Moves existing attachments that are stored at the root of the files
  # directory (ie. created before Redmine 2.3) to their target subdirectories
  def self.move_from_root_to_target_directory
    Attachment.where("disk_directory IS NULL OR disk_directory = ''").find_each do |attachment|
      attachment.move_to_target_directory!
    end
  end

367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
  # Updates digests to SHA256 for all attachments that have a MD5 digest
  # (ie. created before Redmine 3.4)
  def self.update_digests_to_sha256
    Attachment.where("length(digest) < 64").find_each do |attachment|
      attachment.update_digest_to_sha256!
    end
  end

  # Updates attachment digest to SHA256
  def update_digest_to_sha256!
    if readable?
      sha = Digest::SHA256.new
      File.open(diskfile, 'rb') do |f|
        while buffer = f.read(8192)
          sha.update(buffer)
        end
      end
      update_column :digest, sha.hexdigest
    end
  end

388
389
  # Returns true if the extension is allowed regarding allowed/denied
  # extensions defined in application settings, otherwise false
390
391
  def self.valid_extension?(extension)
    denied, allowed = [:attachment_extensions_denied, :attachment_extensions_allowed].map do |setting|
392
      Setting.send(setting)
393
    end
394
    if denied.present? && extension_in?(extension, denied)
395
396
      return false
    end
397
    if allowed.present? && !extension_in?(extension, allowed)
398
399
400
401
402
      return false
    end
    true
  end

403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
  # Returns true if extension belongs to extensions list.
  def self.extension_in?(extension, extensions)
    extension = extension.downcase.sub(/\A\.+/, '')

    unless extensions.is_a?(Array)
      extensions = extensions.to_s.split(",").map(&:strip)
    end
    extensions = extensions.map {|s| s.downcase.sub(/\A\.+/, '')}.reject(&:blank?)
    extensions.include?(extension)
  end

  # Returns true if attachment's extension belongs to extensions list.
  def extension_in?(extensions)
    self.class.extension_in?(File.extname(filename), extensions)
  end

419
420
421
422
423
  # returns either MD5 or SHA256 depending on the way self.digest was computed
  def digest_type
    digest.size < 64 ? "MD5" : "SHA256" if digest.present?
  end

424
425
  private

426
  def reuse_existing_file_if_possible
427
428
429
    original_diskfile = nil

    reused = with_lock do
430
431
432
433
434
      if existing = Attachment
                      .where(digest: self.digest, filesize: self.filesize)
                      .where('id <> ? and disk_filename <> ?',
                             self.id, self.disk_filename)
                      .first
435
        existing.with_lock do
436

437
438
          original_diskfile = self.diskfile
          existing_diskfile = existing.diskfile
439

440
441
442
          if File.readable?(original_diskfile) &&
            File.readable?(existing_diskfile) &&
            FileUtils.identical?(original_diskfile, existing_diskfile)
443

444
445
446
            self.update_columns disk_directory: existing.disk_directory,
                                disk_filename: existing.disk_filename
          end
447
        end
448
449
      end
    end
450
451
452
    if reused
      File.delete(original_diskfile)
    end
453
454
455
456
457
  rescue ActiveRecord::StatementInvalid, ActiveRecord::RecordNotFound
    # Catch and ignore lock errors. It is not critical if deduplication does
    # not happen, therefore we do not retry.
    # with_lock throws ActiveRecord::RecordNotFound if the record isnt there
    # anymore, thats why this is caught and ignored as well.
458
459
460
  end


461
462
463
464
465
466
467
  # Physically deletes the file from the file system
  def delete_from_disk!
    if disk_filename.present? && File.exist?(diskfile)
      File.delete(diskfile)
    end
  end

468
  def sanitize_filename(value)
469
    # get only the filename, not the whole path
jplang's avatar
jplang committed
470
    just_filename = value.gsub(/\A.*(\\|\/)/m, '')
471

472
    # Finally, replace invalid characters with underscore
jplang's avatar
jplang committed
473
    just_filename.gsub(/[\/\?\%\*\:\|\"\'<>\n\r]+/, '_')
474
  end
475

476
477
478
479
480
481
482
483
484
  # Returns the subdirectory in which the attachment will be saved
  def target_directory
    time = created_on || DateTime.now
    time.strftime("%Y/%m")
  end

  # Returns an ASCII or hashed filename that do not
  # exists yet in the given subdirectory
  def self.disk_filename(filename, directory=nil)
485
486
    timestamp = DateTime.now.strftime("%y%m%d%H%M%S")
    ascii = ''
487
    if filename =~ %r{^[a-zA-Z0-9_\.\-]*$} && filename.length <= 50
488
      ascii = filename
489
    else
490
      ascii = Digest::MD5.hexdigest(filename)
491
      # keep the extension if any
492
      ascii << $1 if filename =~ %r{(\.[a-zA-Z0-9]+)$}
493
    end
494
    while File.exist?(File.join(storage_path, directory.to_s, "#{timestamp}_#{ascii}"))
495
496
497
      timestamp.succ!
    end
    "#{timestamp}_#{ascii}"
498
  end
jplang's avatar
jplang committed
499
end