Merge branch 'hotfix/authenticate-and-expire-download-zips' into develop

1 files changed, 20 insertions, 11 deletions

diff --git a/app/controllers/request_controller.rb b/app/controllers/request_controller.rb
index 2c95114e6..d8c34c2dd 100644
--- a/app/controllers/request_controller.rb
+++ b/app/controllers/request_controller.rb
@@ -868,22 +868,32 @@ class RequestController < ApplicationController
     def download_entire_request
         @locale = self.locale_from_params()
         PublicBody.with_locale(@locale) do
-            info_request = InfoRequest.find_by_url_title!(params[:url_title])
+            @info_request = InfoRequest.find_by_url_title!(params[:url_title])
+            # Test for whole request being hidden or requester-only
+            if !@info_request.all_can_view?
+                render :template => 'request/hidden', :status => 410 # gone
+                return
+            end
             if authenticated?(
                               :web => _("To download the zip file"),
-                              :email => _("Then you can download a zip file of {{info_request_title}}.",:info_request_title=>info_request.title),
-                              :email_subject => _("Log in to download a zip file of {{info_request_title}}",:info_request_title=>info_request.title)
+                              :email => _("Then you can download a zip file of {{info_request_title}}.",
+                                           :info_request_title=>@info_request.title),
+                              :email_subject => _("Log in to download a zip file of {{info_request_title}}",
+                                           :info_request_title=>@info_request.title)
                               )
-                updated = Digest::SHA1.hexdigest(info_request.get_last_event.created_at.to_i.to_s + info_request.updated_at.to_i.to_s)
-                @url_path = "/download/#{updated[0..1]}/#{updated}/#{params[:url_title]}.zip"
-                file_path = File.expand_path(File.join(File.dirname(__FILE__), '../../cache/zips', @url_path))
+                updated = Digest::SHA1.hexdigest(@info_request.get_last_event.created_at.to_i.to_s + @info_request.updated_at.to_i.to_s)
+                @url_path = File.join("/download",
+                                       request_dirs(@info_request),
+                                       updated,
+                                       "#{params[:url_title]}.zip")
+                file_path = File.expand_path(File.join(download_zip_dir(), @url_path))
                 if !File.exists?(file_path)
                     FileUtils.mkdir_p(File.dirname(file_path))
                     Zip::ZipFile.open(file_path, Zip::ZipFile::CREATE) { |zipfile|
                         convert_command = Configuration::html_to_pdf_command
                         done = false
                         if !convert_command.blank? && File.exists?(convert_command)
-                            url = "http://#{Configuration::domain}#{request_url(info_request)}?print_stylesheet=1"
+                            url = "http://#{Configuration::domain}#{request_url(@info_request)}?print_stylesheet=1"
                             tempfile = Tempfile.new('foihtml2pdf')
                             output = AlaveteliExternalCommand.run(convert_command, url, tempfile.path)
                             if !output.nil?
@@ -892,22 +902,21 @@ class RequestController < ApplicationController
                                 }
                                 done = true
                             else
-                                logger.error("Could not convert info request #{info_request.id} to PDF with command '#{convert_command} #{url} #{tempfile.path}'")
+                                logger.error("Could not convert info request #{@info_request.id} to PDF with command '#{convert_command} #{url} #{tempfile.path}'")
                             end
                             tempfile.close
                         else
                             logger.warn("No HTML -> PDF converter found at #{convert_command}")
                         end
                         if !done
-                            @info_request = info_request
-                            @info_request_events = info_request.info_request_events
+                            @info_request_events = @info_request.info_request_events
                             template = File.read(File.join(File.dirname(__FILE__), "..", "views", "request", "simple_correspondence.rhtml"))
                             output = ERB.new(template).result(binding)
                             zipfile.get_output_stream("correspondence.txt") { |f|
                                 f.puts(output)
                             }
                         end
-                        for message in info_request.incoming_messages
+                        for message in @info_request.incoming_messages
                             attachments = message.get_attachments_for_display
                             for attachment in attachments
                                 filename = "#{attachment.url_part_number}_#{attachment.display_filename}"