apache_secure_download 0.0.6.229 → 0.0.7.230

data/ChangeLog

@@ -1,5 +1,10 @@
 = Revision history for apache_secure_download
 
+== 0.0.7 [2008-03-31]
+
+* Fixed that token wouldn't respect query string when it should
+* Added sanity checks for arguments to Apache::SecureDownload.new
+
 == 0.0.6 [2008-03-29]
 
 * Reverted v0.0.5

data/README

@@ -2,7 +2,7 @@
 
 == VERSION
 
-This documentation refers to apache_secure_download version 0.0.6
+This documentation refers to apache_secure_download version 0.0.7
 
 
 == DESCRIPTION
@@ -12,7 +12,11 @@ Place the following snippet in your Apache config:
   # protect files by Apache Secure Download
   <IfModule mod_ruby.c>
     RubyRequire apache/ruby-run
+
     RubyRequire /path/to/apache_secure_download
+    # or
+    #RubyRequire rubygems
+    #RubyRequire apache/secure_download
 
     <Location /secure>
       # pass your shared secret string to the handler -- secret means SECRET!

data/lib/apache/secure_download/util.rb

@@ -37,9 +37,13 @@ module Apache
 
       extend self
 
+      QUERY_RE = %r{([?&])timestamp=.*?&token=.*?(&|\z)}o
+
       # Computes the token from +secret+, +path+, and +timestamp+.
       def token(secret, path, timestamp)
-        Digest::SHA1.hexdigest(secret + path + timestamp.to_s)
+        Digest::SHA1.hexdigest(
+          secret + path.sub(QUERY_RE) { $1 unless $2.empty? } + timestamp.to_s
+        )
       end
 
       # Creates a valid URL to the secured resource, identified by +url+. The

data/lib/apache/secure_download/version.rb

@@ -6,7 +6,7 @@ module Apache
 
       MAJOR = 0
       MINOR = 0
-      TINY  = 6
+      TINY  = 7
 
       class << self
 

data/lib/apache/secure_download.rb

@@ -38,11 +38,13 @@ module Apache
     # The argument +secret+ is the shared secret string that the application
     # uses to create valid URLs (tokens).
     def initialize(secret, options = {})
-      raise ArgumentError, 'secret string missing' unless secret.is_a?(String)
-
       @secret = secret
-      @allow  = options[:allow]
       @deny   = options[:deny]
+      @allow  = options[:allow]
+
+      raise ArgumentError, 'secret string missing'  unless @secret.is_a?(String)
+      raise ArgumentError, ':deny is not a regexp'  unless @deny.nil?  || @deny.is_a?(Regexp)
+      raise ArgumentError, ':allow is not a regexp' unless @allow.nil? || @allow.is_a?(Regexp)
     end
 
     # Checks whether the current +request+ satisfies the following requirements:
@@ -59,7 +61,7 @@ module Apache
       timestamp = request.param('timestamp')
 
       return FORBIDDEN if timestamp.to_i < Time.now.to_i
-      return FORBIDDEN if request.param('token') != Util.token(@secret, request.uri, timestamp)
+      return FORBIDDEN if request.param('token') != Util.token(@secret, request.unparsed_uri, timestamp)
 
       return OK
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: apache_secure_download
 version: !ruby/object:Gem::Version 
-  version: 0.0.6.229
+  version: 0.0.7.230
 platform: ruby
 authors: 
 - Jens Wille
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2008-03-29 00:00:00 +01:00
+date: 2008-03-31 00:00:00 +02:00
 default_executable: 
 dependencies: []