From d22c389ba23f6e906fdd98867cf2d555e4ea2ba5 Mon Sep 17 00:00:00 2001 From: Go MAEDA Date: Fri, 16 Apr 2021 01:45:15 +0000 Subject: [PATCH] Merged r20946 from trunk to 4.1-stable (#34367). git-svn-id: http://svn.redmine.org/redmine/branches/4.1-stable@20948 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- app/models/attachment.rb | 11 +++++------ .../acts_as_attachable/lib/acts_as_attachable.rb | 2 +- test/unit/attachment_test.rb | 13 +++++++++++++ 3 files changed, 19 insertions(+), 7 deletions(-) diff --git a/app/models/attachment.rb b/app/models/attachment.rb index e91d7f8c4..ae39bfa97 100644 --- a/app/models/attachment.rb +++ b/app/models/attachment.rb @@ -29,7 +29,8 @@ class Attachment < ActiveRecord::Base validates_length_of :filename, :maximum => 255 validates_length_of :disk_filename, :maximum => 255 validates_length_of :description, :maximum => 255 - validate :validate_max_file_size, :validate_file_extension + validate :validate_max_file_size + validate :validate_file_extension, :if => :filename_changed? acts_as_event :title => :filename, :url => Proc.new {|o| {:controller => 'attachments', :action => 'show', :id => o.id, :filename => o.filename}} @@ -76,11 +77,9 @@ class Attachment < ActiveRecord::Base end def validate_file_extension - if @temp_file - extension = File.extname(filename) - unless self.class.valid_extension?(extension) - errors.add(:base, l(:error_attachment_extension_not_allowed, :extension => extension)) - end + extension = File.extname(filename) + unless self.class.valid_extension?(extension) + errors.add(:base, l(:error_attachment_extension_not_allowed, :extension => extension)) end end diff --git a/lib/plugins/acts_as_attachable/lib/acts_as_attachable.rb b/lib/plugins/acts_as_attachable/lib/acts_as_attachable.rb index 4df4b6ad4..e0969f24f 100644 --- a/lib/plugins/acts_as_attachable/lib/acts_as_attachable.rb +++ b/lib/plugins/acts_as_attachable/lib/acts_as_attachable.rb @@ -107,7 +107,7 @@ module Redmine end next unless a a.description = attachment['description'].to_s.strip - if a.new_record? + if a.new_record? || a.invalid? unsaved_attachments << a else saved_attachments << a diff --git a/test/unit/attachment_test.rb b/test/unit/attachment_test.rb index e2b6bb85e..3c1500d70 100644 --- a/test/unit/attachment_test.rb +++ b/test/unit/attachment_test.rb @@ -152,6 +152,19 @@ class AttachmentTest < ActiveSupport::TestCase end end + def test_extension_update_should_be_validated_against_denied_extensions + with_settings :attachment_extensions_denied => "txt, png" do + a = Attachment.new(:container => Issue.find(1), + :file => mock_file_with_options(:original_filename => "test.jpeg"), + :author => User.find(1)) + assert_save a + + b = Attachment.find(a.id) + b.filename = "test.png" + assert !b.save + end + end + def test_valid_extension_should_be_case_insensitive with_settings :attachment_extensions_allowed => "txt, Png" do assert Attachment.valid_extension?(".pnG") -- 2.39.5