9a2869ab46
The only major difference with the EE version is the change from a light and dark logo to only a header logo The dark logo wasn't used anyway, so it seemed to make sense to me to rename the field to the actual function of it
72 lines
1.5 KiB
Ruby
72 lines
1.5 KiB
Ruby
class UploadsController < ApplicationController
|
|
skip_before_action :authenticate_user!
|
|
before_action :find_model, :authorize_access!
|
|
|
|
def show
|
|
uploader = @model.send(upload_mount)
|
|
|
|
unless uploader.file_storage?
|
|
return redirect_to uploader.url
|
|
end
|
|
|
|
unless uploader.file && uploader.file.exists?
|
|
return render_404
|
|
end
|
|
|
|
disposition = uploader.image? ? 'inline' : 'attachment'
|
|
send_file uploader.file.path, disposition: disposition
|
|
end
|
|
|
|
private
|
|
|
|
def find_model
|
|
unless upload_model && upload_mount
|
|
return render_404
|
|
end
|
|
|
|
@model = upload_model.find(params[:id])
|
|
end
|
|
|
|
def authorize_access!
|
|
authorized =
|
|
case @model
|
|
when Project
|
|
can?(current_user, :read_project, @model)
|
|
when Group
|
|
can?(current_user, :read_group, @model)
|
|
when Note
|
|
can?(current_user, :read_project, @model.project)
|
|
else
|
|
# No authentication required for user avatars.
|
|
true
|
|
end
|
|
|
|
return if authorized
|
|
|
|
if current_user
|
|
render_404
|
|
else
|
|
authenticate_user!
|
|
end
|
|
end
|
|
|
|
def upload_model
|
|
upload_models = {
|
|
"user" => User,
|
|
"project" => Project,
|
|
"note" => Note,
|
|
"group" => Group,
|
|
"appearance" => Appearance
|
|
}
|
|
|
|
upload_models[params[:model]]
|
|
end
|
|
|
|
def upload_mount
|
|
upload_mounts = %w(avatar attachment file logo header_logo)
|
|
|
|
if upload_mounts.include?(params[:mounted_as])
|
|
params[:mounted_as]
|
|
end
|
|
end
|
|
end
|