attache 2.2.1 → 2.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 40d8defcee67748b1a0bffcb19211ea6a784f4a0
-  data.tar.gz: 2c4448d76d29a7115f6ebec5448ab76835ba2883
+  metadata.gz: d3e6fceada01d556d51cb23682428710b64a6a4f
+  data.tar.gz: f1a1dd488a9964aaa212522fa6552776f31882af
 SHA512:
-  metadata.gz: 025d0526f38962154e8a5e4ff88973778e6ca97722d0a81310b8a8e869634d886cbcc262408a7db7fccc4ad4e5f92853f7bb69d5e5abad07ba3a0c262c2da339
-  data.tar.gz: 932a2b35ad81e8a554c94bd43fa414964d0a72d6263eefdcadb6e5f71a75b8d2f78f39757228878e59654287de7e4be74b659265d721931a63b1d389649c8895
+  metadata.gz: b71efe1bd2bb1820c32f93bd60ab6bd7ce418e804cd6738ac51d77cb78ffc9eb7e2a9d2c79ce12cb258df463033a29e9f78e253fcb7732eb20758b22e912a16d
+  data.tar.gz: b355c9cbe459befac3da3a8ec7d35f2ef2d5f10fbc3ae0c27639e2145fb4ad6f4259379ea91b803f9fdeda545a0fcc7529e47c2c3b4bd2d9907663c95a23e85d

data/config/vhost.example.yml

@@ -5,6 +5,9 @@
 "google.lvh.me:9292":
   "SECRET_KEY": CHANGEME                         # this is the shared secret between your app and this attache server
   "REMOTE_DIR": CHANGEME                         # this is the root directory to use in the `bucket`; omit to use root
+  "GEOMETRY_WHITELIST":                          # this limits the type of `geometry` we resize to; optional
+    - "100x100"
+    - "1024>"
   "FOG_CONFIG":                                  #
     "provider": Google                           # refer to `fog.io/storage` documentation
     "google_storage_access_key_id": CHANGEME     #

data/lib/attache/download.rb

@@ -16,6 +16,10 @@ class Attache::Download < Attache::Base
       vhosts[ENV.fetch('BACKUP_GEOMETRY') { 'backup' }] = config.backup
 
       parse_path_info(env['PATH_INFO']['/view/'.length..-1]) do |dirname, geometry, basename, relpath|
+        unless config.try(:geometry_whitelist).blank? || config.geometry_whitelist.include?(geometry)
+          return [415, config.download_headers, ["#{geometry} is not supported"]]
+        end
+
         if vhost = vhosts[geometry]
           headers = vhost.download_headers.merge({
                       'Location' => vhost.storage_url(relpath: relpath),

data/lib/attache/version.rb

@@ -1,3 +1,3 @@
 module Attache
-  VERSION = "2.2.1"
+  VERSION = "2.3.0"
 end

data/lib/attache/vhost.rb

@@ -6,12 +6,15 @@ class Attache::VHost
                 :storage,
                 :download_headers,
                 :headers_with_cors,
+                :geometry_whitelist,
                 :env
 
   def initialize(hash)
     self.env = hash || {}
     self.remotedir  = env['REMOTE_DIR'] # nil means no fixed top level remote directory, and that's fine.
     self.secret_key = env['SECRET_KEY'] # nil means no auth check; anyone can upload a file
+    self.geometry_whitelist = env['GEOMETRY_WHITELIST'] # nil means everything is acceptable
+
     if env['FOG_CONFIG']
       self.bucket       = env['FOG_CONFIG'].fetch('bucket')
       self.storage      = Fog::Storage.new(env['FOG_CONFIG'].except('bucket').symbolize_keys)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: attache
 version: !ruby/object:Gem::Version
-  version: 2.2.1
+  version: 2.3.0
 platform: ruby
 authors:
 - choonkeat
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-04-11 00:00:00.000000000 Z
+date: 2016-04-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack