gitlab-org--gitlab-foss/app/controllers/uploads_controller.rb

73 lines
1.5 KiB
Ruby
Raw Normal View History

class UploadsController < ApplicationController
skip_before_action :authenticate_user!
before_action :find_model, :authorize_access!
def show
uploader = @model.send(upload_mount)
unless uploader.file_storage?
return redirect_to uploader.url
end
unless uploader.file && uploader.file.exists?
2015-10-09 13:07:29 -04:00
return render_404
end
disposition = uploader.image? ? 'inline' : 'attachment'
send_file uploader.file.path, disposition: disposition
end
private
def find_model
unless upload_model && upload_mount
2015-10-09 13:07:29 -04:00
return render_404
end
@model = upload_model.find(params[:id])
end
def authorize_access!
authorized =
case @model
when Project
can?(current_user, :read_project, @model)
when Group
can?(current_user, :read_group, @model)
when Note
can?(current_user, :read_project, @model.project)
else
# No authentication required for user avatars.
true
end
return if authorized
if current_user
2015-10-09 13:07:29 -04:00
render_404
else
authenticate_user!
end
end
def upload_model
upload_models = {
2015-05-11 05:55:02 -04:00
"user" => User,
"project" => Project,
"note" => Note,
"group" => Group,
"appearance" => Appearance
}
2015-05-11 05:55:02 -04:00
upload_models[params[:model]]
end
def upload_mount
upload_mounts = %w(avatar attachment file logo header_logo)
if upload_mounts.include?(params[:mounted_as])
params[:mounted_as]
end
end
end