diff --git a/app/controllers/files_controller.rb b/app/controllers/files_controller.rb new file mode 100644 index 00000000..3cd2e773 --- /dev/null +++ b/app/controllers/files_controller.rb @@ -0,0 +1,13 @@ +class FilesController < ApplicationController + def download + note = Note.find(params[:id]) + + if can?(current_user, :read_project, note.project) + uploader = note.attachment + send_file uploader.file.path, disposition: 'attachment' + else + not_found! + end + end +end + diff --git a/app/uploaders/attachment_uploader.rb b/app/uploaders/attachment_uploader.rb index 3dbf2860..200700b8 100644 --- a/app/uploaders/attachment_uploader.rb +++ b/app/uploaders/attachment_uploader.rb @@ -19,4 +19,12 @@ class AttachmentUploader < CarrierWave::Uploader::Base rescue false end + + def secure_url + if self.class.storage == CarrierWave::Storage::File + "/files/#{model.class.to_s.underscore}/#{model.id}/#{file.filename}" + else + url + end + end end diff --git a/app/views/events/event/_note.html.haml b/app/views/events/event/_note.html.haml index 20c3b927..19665ce0 100644 --- a/app/views/events/event/_note.html.haml +++ b/app/views/events/event/_note.html.haml @@ -26,7 +26,7 @@ = markdown truncate(event.target.note, length: 70) - note = event.target - if note.attachment.url - = link_to note.attachment.url, target: "_blank", class: 'note-file-attach' do + = link_to note.attachment.secure_url, target: "_blank", class: 'note-file-attach' do - if note.attachment.image? = image_tag note.attachment.url, class: 'note-image-attach' - else diff --git a/app/views/notes/_note.html.haml b/app/views/notes/_note.html.haml index 4d3007a0..b355e2a0 100644 --- a/app/views/notes/_note.html.haml +++ b/app/views/notes/_note.html.haml @@ -31,7 +31,7 @@ - if note.attachment.image? = image_tag note.attachment.url, class: 'note-image-attach' .attachment.pull-right - = link_to note.attachment.url, target: "_blank" do + = link_to note.attachment.secure_url, target: "_blank" do %i.icon-paper-clip = note.attachment_identifier .clear diff --git a/config/routes.rb b/config/routes.rb index 88667db1..7537a11d 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -45,6 +45,11 @@ Gitlab::Application.routes.draw do root to: "projects#index" end + # + # Attachments serving + # + get 'files/:type/:id/:filename' => 'files#download', constraints: { id: /\d+/, type: /[a-z]+/, filename: /[a-zA-Z.0-9_\-\+]+/ } + # # Admin Area #