aboutsummaryrefslogtreecommitdiffstats
path: root/app/controllers/request_controller.rb
diff options
context:
space:
mode:
authorLouise Crow <louise.crow@gmail.com>2012-12-13 12:16:46 +0000
committerLouise Crow <louise.crow@gmail.com>2012-12-13 12:50:50 +0000
commit3910f7f545177cdb69a5ee0196ffa54a9dba0541 (patch)
tree2da09ec794193e1b08644902aa1276dbad33a8dc /app/controllers/request_controller.rb
parent2078f60edf819cae81b5f15bedf93db9bae4df53 (diff)
Don't offer or allow viewing of an HTML version of a response attachment if the request is hidden, or requester_only. Google docs viewer won't be able to access it, and our own conversion process currently can produce image files that will then be publicly viewable directly from the webserver (see config/httpd.conf). If necessary we can revisit this code to enable admins and requesters to view the HTML version created by our own conversion without adding these files to a path that is served directly by the web server.
Diffstat (limited to 'app/controllers/request_controller.rb')
-rw-r--r--app/controllers/request_controller.rb6
1 files changed, 6 insertions, 0 deletions
diff --git a/app/controllers/request_controller.rb b/app/controllers/request_controller.rb
index c732a4b32..2c95114e6 100644
--- a/app/controllers/request_controller.rb
+++ b/app/controllers/request_controller.rb
@@ -743,6 +743,12 @@ class RequestController < ApplicationController
end
def get_attachment_as_html
+
+ # The conversion process can generate files in the cache directory that can be served up
+ # directly by the webserver according to httpd.conf, so don't allow it unless that's OK.
+ if @files_can_be_cached != true
+ raise ActiveRecord::RecordNotFound.new("Attachment HTML not found.")
+ end
get_attachment_internal(true)
# images made during conversion (e.g. images in PDF files) are put in the cache directory, so