summaryrefslogtreecommitdiffstats
path: root/app/controllers/attachments_controller.rb
diff options
context:
space:
mode:
authorJean-Philippe Lang <jp_lang@yahoo.fr>2009-04-25 09:31:36 +0000
committerJean-Philippe Lang <jp_lang@yahoo.fr>2009-04-25 09:31:36 +0000
commit15a14e55cdb9b8c2633786fa262382b6e1f7ea9f (patch)
treec880f5159d4c76ebdd52a5ea2774fdbbc8354e59 /app/controllers/attachments_controller.rb
parent914ef1cb2551dc4e3fe5d7f544e8d16ea21a2d7d (diff)
downloadredmine-15a14e55cdb9b8c2633786fa262382b6e1f7ea9f.tar.gz
redmine-15a14e55cdb9b8c2633786fa262382b6e1f7ea9f.zip
Returns a 404 error when trying to view/download an attachment that can't be read from disk.
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@2692 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'app/controllers/attachments_controller.rb')
-rw-r--r--app/controllers/attachments_controller.rb7
1 files changed, 6 insertions, 1 deletions
diff --git a/app/controllers/attachments_controller.rb b/app/controllers/attachments_controller.rb
index 445ae3d12..92d60ee0f 100644
--- a/app/controllers/attachments_controller.rb
+++ b/app/controllers/attachments_controller.rb
@@ -17,7 +17,7 @@
class AttachmentsController < ApplicationController
before_filter :find_project
- before_filter :read_authorize, :except => :destroy
+ before_filter :file_readable, :read_authorize, :except => :destroy
before_filter :delete_authorize, :only => :destroy
verify :method => :post, :only => :destroy
@@ -64,6 +64,11 @@ private
render_404
end
+ # Checks that the file exists and is readable
+ def file_readable
+ @attachment.readable? ? true : render_404
+ end
+
def read_authorize
@attachment.visible? ? true : deny_access
end