Chris@1295: # Redmine - project management software
Chris@1295: # Copyright (C) 2006-2013  Jean-Philippe Lang
Chris@1295: #
Chris@1295: # This program is free software; you can redistribute it and/or
Chris@1295: # modify it under the terms of the GNU General Public License
Chris@1295: # as published by the Free Software Foundation; either version 2
Chris@1295: # of the License, or (at your option) any later version.
Chris@1295: #
Chris@1295: # This program is distributed in the hope that it will be useful,
Chris@1295: # but WITHOUT ANY WARRANTY; without even the implied warranty of
Chris@1295: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
Chris@1295: # GNU General Public License for more details.
Chris@1295: #
Chris@1295: # You should have received a copy of the GNU General Public License
Chris@1295: # along with this program; if not, write to the Free Software
Chris@1295: # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
Chris@1295: 
Chris@1295: class AttachmentsController < ApplicationController
Chris@1295:   before_filter :find_project, :except => :upload
Chris@1295:   before_filter :file_readable, :read_authorize, :only => [:show, :download, :thumbnail]
Chris@1295:   before_filter :delete_authorize, :only => :destroy
Chris@1295:   before_filter :authorize_global, :only => :upload
Chris@1295: 
Chris@1295:   accept_api_auth :show, :download, :upload
Chris@1295: 
Chris@1295:   def show
Chris@1295:     respond_to do |format|
Chris@1295:       format.html {
Chris@1295:         if @attachment.is_diff?
Chris@1295:           @diff = File.new(@attachment.diskfile, "rb").read
Chris@1295:           @diff_type = params[:type] || User.current.pref[:diff_type] || 'inline'
Chris@1295:           @diff_type = 'inline' unless %w(inline sbs).include?(@diff_type)
Chris@1295:           # Save diff type as user preference
Chris@1295:           if User.current.logged? && @diff_type != User.current.pref[:diff_type]
Chris@1295:             User.current.pref[:diff_type] = @diff_type
Chris@1295:             User.current.preference.save
Chris@1295:           end
Chris@1295:           render :action => 'diff'
Chris@1295:         elsif @attachment.is_text? && @attachment.filesize <= Setting.file_max_size_displayed.to_i.kilobyte
Chris@1295:           @content = File.new(@attachment.diskfile, "rb").read
Chris@1295:           render :action => 'file'
Chris@1295:         else
Chris@1295:           download
Chris@1295:         end
Chris@1295:       }
Chris@1295:       format.api
Chris@1295:     end
Chris@1295:   end
Chris@1295: 
Chris@1295:   def download
Chris@1295:     if @attachment.container.is_a?(Version) || @attachment.container.is_a?(Project)
Chris@1295:       @attachment.increment_download
Chris@1295:     end
Chris@1295: 
Chris@1295:     if stale?(:etag => @attachment.digest)
Chris@1295:       # images are sent inline
Chris@1295:       send_file @attachment.diskfile, :filename => filename_for_content_disposition(@attachment.filename),
Chris@1295:                                       :type => detect_content_type(@attachment),
Chris@1295:                                       :disposition => (@attachment.image? ? 'inline' : 'attachment')
Chris@1295:     end
Chris@1295:   end
Chris@1295: 
Chris@1295:   def thumbnail
Chris@1295:     if @attachment.thumbnailable? && thumbnail = @attachment.thumbnail(:size => params[:size])
Chris@1295:       if stale?(:etag => thumbnail)
Chris@1295:         send_file thumbnail,
Chris@1295:           :filename => filename_for_content_disposition(@attachment.filename),
Chris@1295:           :type => detect_content_type(@attachment),
Chris@1295:           :disposition => 'inline'
Chris@1295:       end
Chris@1295:     else
Chris@1295:       # No thumbnail for the attachment or thumbnail could not be created
Chris@1295:       render :nothing => true, :status => 404
Chris@1295:     end
Chris@1295:   end
Chris@1295: 
Chris@1295:   def upload
Chris@1295:     # Make sure that API users get used to set this content type
Chris@1295:     # as it won't trigger Rails' automatic parsing of the request body for parameters
Chris@1295:     unless request.content_type == 'application/octet-stream'
Chris@1295:       render :nothing => true, :status => 406
Chris@1295:       return
Chris@1295:     end
Chris@1295: 
Chris@1295:     @attachment = Attachment.new(:file => request.raw_post)
Chris@1295:     @attachment.author = User.current
Chris@1295:     @attachment.filename = params[:filename].presence || Redmine::Utils.random_hex(16)
Chris@1295:     saved = @attachment.save
Chris@1295: 
Chris@1295:     respond_to do |format|
Chris@1295:       format.js
Chris@1295:       format.api {
Chris@1295:         if saved
Chris@1295:           render :action => 'upload', :status => :created
Chris@1295:         else
Chris@1295:           render_validation_errors(@attachment)
Chris@1295:         end
Chris@1295:       }
Chris@1295:     end
Chris@1295:   end
Chris@1295: 
Chris@1295:   def destroy
Chris@1295:     if @attachment.container.respond_to?(:init_journal)
Chris@1295:       @attachment.container.init_journal(User.current)
Chris@1295:     end
Chris@1295:     if @attachment.container
Chris@1295:       # Make sure association callbacks are called
Chris@1295:       @attachment.container.attachments.delete(@attachment)
Chris@1295:     else
Chris@1295:       @attachment.destroy
Chris@1295:     end
Chris@1295: 
Chris@1295:     respond_to do |format|
Chris@1295:       format.html { redirect_to_referer_or project_path(@project) }
Chris@1295:       format.js
Chris@1295:     end
Chris@1295:   end
Chris@1295: 
Chris@1295: private
Chris@1295:   def find_project
Chris@1295:     @attachment = Attachment.find(params[:id])
Chris@1295:     # Show 404 if the filename in the url is wrong
Chris@1295:     raise ActiveRecord::RecordNotFound if params[:filename] && params[:filename] != @attachment.filename
Chris@1295:     @project = @attachment.project
Chris@1295:   rescue ActiveRecord::RecordNotFound
Chris@1295:     render_404
Chris@1295:   end
Chris@1295: 
Chris@1295:   # Checks that the file exists and is readable
Chris@1295:   def file_readable
Chris@1295:     if @attachment.readable?
Chris@1295:       true
Chris@1295:     else
Chris@1295:       logger.error "Cannot send attachment, #{@attachment.diskfile} does not exist or is unreadable."
Chris@1295:       render_404
Chris@1295:     end
Chris@1295:   end
Chris@1295: 
Chris@1295:   def read_authorize
Chris@1295:     @attachment.visible? ? true : deny_access
Chris@1295:   end
Chris@1295: 
Chris@1295:   def delete_authorize
Chris@1295:     @attachment.deletable? ? true : deny_access
Chris@1295:   end
Chris@1295: 
Chris@1295:   def detect_content_type(attachment)
Chris@1295:     content_type = attachment.content_type
Chris@1295:     if content_type.blank?
Chris@1295:       content_type = Redmine::MimeType.of(attachment.filename)
Chris@1295:     end
Chris@1295:     content_type.to_s
Chris@1295:   end
Chris@1295: end