Chris@0: # Redmine - project management software
Chris@1115: # Copyright (C) 2006-2012  Jean-Philippe Lang
Chris@0: #
Chris@0: # This program is free software; you can redistribute it and/or
Chris@0: # modify it under the terms of the GNU General Public License
Chris@0: # as published by the Free Software Foundation; either version 2
Chris@0: # of the License, or (at your option) any later version.
Chris@441: #
Chris@0: # This program is distributed in the hope that it will be useful,
Chris@0: # but WITHOUT ANY WARRANTY; without even the implied warranty of
Chris@0: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
Chris@0: # GNU General Public License for more details.
Chris@441: #
Chris@0: # You should have received a copy of the GNU General Public License
Chris@0: # along with this program; if not, write to the Free Software
Chris@0: # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
Chris@0: 
Chris@0: class AttachmentsController < ApplicationController
Chris@1115:   before_filter :find_project, :except => :upload
Chris@1115:   before_filter :file_readable, :read_authorize, :only => [:show, :download, :thumbnail]
Chris@0:   before_filter :delete_authorize, :only => :destroy
Chris@1115:   before_filter :authorize_global, :only => :upload
Chris@441: 
Chris@1115:   accept_api_auth :show, :download, :upload
Chris@441: 
Chris@0:   def show
Chris@909:     respond_to do |format|
Chris@909:       format.html {
Chris@909:         if @attachment.is_diff?
Chris@909:           @diff = File.new(@attachment.diskfile, "rb").read
Chris@909:           @diff_type = params[:type] || User.current.pref[:diff_type] || 'inline'
Chris@909:           @diff_type = 'inline' unless %w(inline sbs).include?(@diff_type)
Chris@909:           # Save diff type as user preference
Chris@909:           if User.current.logged? && @diff_type != User.current.pref[:diff_type]
Chris@909:             User.current.pref[:diff_type] = @diff_type
Chris@909:             User.current.preference.save
Chris@909:           end
Chris@909:           render :action => 'diff'
Chris@909:         elsif @attachment.is_text? && @attachment.filesize <= Setting.file_max_size_displayed.to_i.kilobyte
Chris@909:           @content = File.new(@attachment.diskfile, "rb").read
Chris@909:           render :action => 'file'
Chris@909:         else
Chris@909:           download
Chris@909:         end
Chris@909:       }
Chris@909:       format.api
Chris@0:     end
Chris@0:   end
Chris@441: 
Chris@0:   def download
Chris@0:     if @attachment.container.is_a?(Version) || @attachment.container.is_a?(Project)
Chris@0:       @attachment.increment_download
Chris@0:     end
Chris@441: 
Chris@1115:     if stale?(:etag => @attachment.digest)
Chris@1115:       # images are sent inline
Chris@1115:       send_file @attachment.diskfile, :filename => filename_for_content_disposition(@attachment.filename),
Chris@1115:                                       :type => detect_content_type(@attachment),
Chris@1115:                                       :disposition => (@attachment.image? ? 'inline' : 'attachment')
Chris@1115:     end
Chris@0:   end
Chris@441: 
Chris@1115:   def thumbnail
Chris@1115:     if @attachment.thumbnailable? && thumbnail = @attachment.thumbnail(:size => params[:size])
Chris@1115:       if stale?(:etag => thumbnail)
Chris@1115:         send_file thumbnail,
Chris@1115:           :filename => filename_for_content_disposition(@attachment.filename),
Chris@1115:           :type => detect_content_type(@attachment),
Chris@1115:           :disposition => 'inline'
Chris@1115:       end
Chris@1115:     else
Chris@1115:       # No thumbnail for the attachment or thumbnail could not be created
Chris@1115:       render :nothing => true, :status => 404
Chris@1115:     end
Chris@1115:   end
Chris@1115: 
Chris@1115:   def upload
Chris@1115:     # Make sure that API users get used to set this content type
Chris@1115:     # as it won't trigger Rails' automatic parsing of the request body for parameters
Chris@1115:     unless request.content_type == 'application/octet-stream'
Chris@1115:       render :nothing => true, :status => 406
Chris@1115:       return
Chris@1115:     end
Chris@1115: 
Chris@1115:     @attachment = Attachment.new(:file => request.raw_post)
Chris@1115:     @attachment.author = User.current
Chris@1115:     @attachment.filename = params[:filename].presence || Redmine::Utils.random_hex(16)
Chris@1115: 
Chris@1115:     if @attachment.save
Chris@1115:       respond_to do |format|
Chris@1115:         format.api { render :action => 'upload', :status => :created }
Chris@1115:       end
Chris@1115:     else
Chris@1115:       respond_to do |format|
Chris@1115:         format.api { render_validation_errors(@attachment) }
Chris@1115:       end
Chris@1115:     end
Chris@1115:   end
Chris@1115: 
Chris@0:   def destroy
Chris@1115:     if @attachment.container.respond_to?(:init_journal)
Chris@1115:       @attachment.container.init_journal(User.current)
Chris@1115:     end
Chris@0:     # Make sure association callbacks are called
Chris@0:     @attachment.container.attachments.delete(@attachment)
Chris@1115:     redirect_to_referer_or project_path(@project)
Chris@0:   end
Chris@441: 
Chris@0: private
Chris@0:   def find_project
Chris@0:     @attachment = Attachment.find(params[:id])
Chris@0:     # Show 404 if the filename in the url is wrong
Chris@0:     raise ActiveRecord::RecordNotFound if params[:filename] && params[:filename] != @attachment.filename
Chris@0:     @project = @attachment.project
Chris@0:   rescue ActiveRecord::RecordNotFound
Chris@0:     render_404
Chris@0:   end
Chris@441: 
Chris@0:   # Checks that the file exists and is readable
Chris@0:   def file_readable
Chris@0:     @attachment.readable? ? true : render_404
Chris@0:   end
Chris@441: 
Chris@0:   def read_authorize
Chris@0:     @attachment.visible? ? true : deny_access
Chris@0:   end
Chris@441: 
Chris@0:   def delete_authorize
Chris@0:     @attachment.deletable? ? true : deny_access
Chris@0:   end
Chris@441: 
Chris@0:   def detect_content_type(attachment)
Chris@0:     content_type = attachment.content_type
Chris@0:     if content_type.blank?
Chris@0:       content_type = Redmine::MimeType.of(attachment.filename)
Chris@0:     end
Chris@0:     content_type.to_s
Chris@0:   end
Chris@0: end