diff options
author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2009-04-25 09:31:36 +0000 |
---|---|---|
committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2009-04-25 09:31:36 +0000 |
commit | 15a14e55cdb9b8c2633786fa262382b6e1f7ea9f (patch) | |
tree | c880f5159d4c76ebdd52a5ea2774fdbbc8354e59 /app/controllers/attachments_controller.rb | |
parent | 914ef1cb2551dc4e3fe5d7f544e8d16ea21a2d7d (diff) | |
download | redmine-15a14e55cdb9b8c2633786fa262382b6e1f7ea9f.tar.gz redmine-15a14e55cdb9b8c2633786fa262382b6e1f7ea9f.zip |
Returns a 404 error when trying to view/download an attachment that can't be read from disk.
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@2692 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'app/controllers/attachments_controller.rb')
-rw-r--r-- | app/controllers/attachments_controller.rb | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/app/controllers/attachments_controller.rb b/app/controllers/attachments_controller.rb index 445ae3d12..92d60ee0f 100644 --- a/app/controllers/attachments_controller.rb +++ b/app/controllers/attachments_controller.rb @@ -17,7 +17,7 @@ class AttachmentsController < ApplicationController before_filter :find_project - before_filter :read_authorize, :except => :destroy + before_filter :file_readable, :read_authorize, :except => :destroy before_filter :delete_authorize, :only => :destroy verify :method => :post, :only => :destroy @@ -64,6 +64,11 @@ private render_404 end + # Checks that the file exists and is readable + def file_readable + @attachment.readable? ? true : render_404 + end + def read_authorize @attachment.visible? ? true : deny_access end |