1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
rails--rails/activestorage/app/controllers/active_storage/representations_controller.rb
Rafael Mendonça França 03bd370c02
Protect all active storage controllers agains CSRF
Before it was possible to for example use the direct upload controller
without using the site.
2018-04-06 14:28:44 -04:00

14 lines
708 B
Ruby

# frozen_string_literal: true
# Take a signed permanent reference for a blob representation and turn it into an expiring service URL for download.
# Note: These URLs are publicly accessible. If you need to enforce access protection beyond the
# security-through-obscurity factor of the signed blob and variation reference, you'll need to implement your own
# authenticated redirection controller.
class ActiveStorage::RepresentationsController < ActiveStorage::BaseController
include ActiveStorage::SetBlob
def show
expires_in ActiveStorage::Blob.service.url_expires_in
redirect_to @blob.representation(params[:variation_key]).processed.service_url(disposition: params[:disposition])
end
end