mirror of
https://github.com/codeninjasllc/discourse.git
synced 2024-11-27 17:46:05 -05:00
cd2c9edb46
- FIX: make sure we set a default name to a pasted image only on Chrome (the only browser that supports it)
- FIX: use ".json" extension to uploads endpoints since IE9 doesn't pass the correct header
- FIX: pass the CSRF token in a query parameter since IE9 doesn't pass it in the headers
- FIX: display error messages comming from the server when there is one over the default error message
- FIX: HACK around IE9 security issue when clicking a file input via JavaScript (use a label and set `visibility:hidden` on the input)
- FIX: hide the "cancel" upload on IE9 since it's not supported
- FIX: return "text/plain" content-type when uploading a file for IE9 in order to prevent it from displaying the save dialog
- FIX: check the maximum file size on the server 💥
- update jQuery File Upload Plugin to v. 5.42.2
- update JQuery IFram Transport Plugin to v. 1.8.5
- update jQuery UI Widget to v. 1.11.1
52 lines
1.7 KiB
Ruby
52 lines
1.7 KiB
Ruby
class UploadsController < ApplicationController
|
|
before_filter :ensure_logged_in, except: [:show]
|
|
skip_before_filter :check_xhr, only: [:show]
|
|
|
|
def create
|
|
file = params[:file] || params[:files].first
|
|
filesize = File.size(file.tempfile)
|
|
upload = Upload.create_for(current_user.id, file.tempfile, file.original_filename, filesize, { content_type: file.content_type })
|
|
|
|
if upload.errors.empty? && current_user.admin?
|
|
retain_hours = params[:retain_hours].to_i
|
|
upload.update_columns(retain_hours: retain_hours) if retain_hours > 0
|
|
end
|
|
|
|
# HACK FOR IE9 to prevent the "download dialog"
|
|
response.headers["Content-Type"] = "text/plain" if request.user_agent =~ /MSIE 9/
|
|
|
|
if upload.errors.empty?
|
|
render_serialized(upload, UploadSerializer, root: false)
|
|
else
|
|
render status: 422, text: upload.errors.full_messages
|
|
end
|
|
end
|
|
|
|
def show
|
|
return render_404 if !RailsMultisite::ConnectionManagement.has_db?(params[:site])
|
|
|
|
RailsMultisite::ConnectionManagement.with_connection(params[:site]) do |db|
|
|
return render_404 unless Discourse.store.internal?
|
|
return render_404 if SiteSetting.prevent_anons_from_downloading_files && current_user.nil?
|
|
|
|
id = params[:id].to_i
|
|
url = request.fullpath
|
|
|
|
# the "url" parameter is here to prevent people from scanning the uploads using the id
|
|
if upload = (Upload.find_by(id: id, url: url) || Upload.find_by(sha1: params[:sha]))
|
|
opts = {filename: upload.original_filename}
|
|
opts[:disposition] = 'inline' if params[:inline]
|
|
send_file(Discourse.store.path_for(upload),opts)
|
|
else
|
|
render_404
|
|
end
|
|
end
|
|
end
|
|
|
|
protected
|
|
|
|
def render_404
|
|
render nothing: true, status: 404
|
|
end
|
|
|
|
end
|