gitlab-org--gitlab-foss/app/controllers/uploads_controller.rb

72 lines
1.4 KiB
Ruby
Raw Normal View History

class UploadsController < ApplicationController
skip_before_filter :authenticate_user!
before_filter :find_model, :authorize_access!
def show
uploader = @model.send(upload_mount)
unless uploader.file_storage?
return redirect_to uploader.url
end
unless uploader.file && uploader.file.exists?
return not_found!
end
disposition = uploader.image? ? 'inline' : 'attachment'
send_file uploader.file.path, disposition: disposition
end
private
def find_model
unless upload_model && upload_mount
return not_found!
end
@model = upload_model.find(params[:id])
end
def authorize_access!
authorized =
case @model
when Project
can?(current_user, :read_project, @model)
when Group
can?(current_user, :read_group, @model)
when Note
can?(current_user, :read_project, @model.project)
else
# No authentication required for user avatars.
true
end
return if authorized
if current_user
not_found!
else
authenticate_user!
end
end
def upload_model
upload_models = {
user: User,
project: Project,
note: Note,
group: Group
}
upload_models[params[:model].to_sym]
end
def upload_mount
upload_mounts = %w(avatar attachment file)
if upload_mounts.include?(params[:mounted_as])
params[:mounted_as]
end
end
end