From f6cc71bc36283223a10f3004121be34f06547d94 Mon Sep 17 00:00:00 2001
From: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
Date: Fri, 15 Feb 2013 09:51:21 +0200
Subject: [PATCH] Per project protection

---
 app/controllers/files_controller.rb | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/app/controllers/files_controller.rb b/app/controllers/files_controller.rb
index 09f1e5512d6..3cd2e77322c 100644
--- a/app/controllers/files_controller.rb
+++ b/app/controllers/files_controller.rb
@@ -1,7 +1,13 @@
 class FilesController < ApplicationController
   def download
-    uploader = Note.find(params[:id]).attachment
-    send_file uploader.file.path, disposition: 'attachment'
+    note = Note.find(params[:id])
+
+    if can?(current_user, :read_project, note.project)
+      uploader = note.attachment
+      send_file uploader.file.path, disposition: 'attachment'
+    else
+      not_found!
+    end
   end
 end