avo 4.1.4 → 4.1.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/Gemfile.lock +1 -1
- data/app/controllers/avo/attachments_controller.rb +30 -6
- data/lib/avo/version.rb +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 99b6cf862eafea0cfbd9d8a9f9e9b9f2a3e79aad047dc0474e940788b34dff58
|
|
4
|
+
data.tar.gz: 73432d0768b99efaec6f3db47f309776a5f01268e46b7a0f0b9f006f543154fe
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 0d9f4df10fe63c58b89682be01645b6c23c6603398cc0959d7e00aa4f56768338cbe2765ff6e1f0e9a803328d021f9eb9c7a3699fc074115e6ea5f78dc90ac77
|
|
7
|
+
data.tar.gz: d266a0f925a29505b793d17f4d1db6cd564454c8f5e80080a6d784dfde4ab367504dcb1cdb4651e11baccc9d2909f0dfcef60918a774a293003e4a6a84724cab
|
data/Gemfile.lock
CHANGED
|
@@ -27,8 +27,12 @@ module Avo
|
|
|
27
27
|
end
|
|
28
28
|
|
|
29
29
|
def destroy
|
|
30
|
-
if
|
|
31
|
-
|
|
30
|
+
if attachment_name.blank?
|
|
31
|
+
flash[:error] = t("avo.failed_to_find_attachment")
|
|
32
|
+
elsif !authorized_to(:delete)
|
|
33
|
+
flash[:notice] = t("avo.not_authorized")
|
|
34
|
+
else
|
|
35
|
+
attachment = attachment_to_destroy
|
|
32
36
|
|
|
33
37
|
if attachment.present?
|
|
34
38
|
ActiveRecord::Base.transaction do
|
|
@@ -47,10 +51,8 @@ module Avo
|
|
|
47
51
|
flash[:error] = @record.errors.full_messages.join(", ")
|
|
48
52
|
end
|
|
49
53
|
else
|
|
50
|
-
t("avo.failed_to_find_attachment")
|
|
54
|
+
flash[:error] = t("avo.failed_to_find_attachment")
|
|
51
55
|
end
|
|
52
|
-
else
|
|
53
|
-
flash[:notice] = t("avo.not_authorized")
|
|
54
56
|
end
|
|
55
57
|
|
|
56
58
|
respond_to do |format|
|
|
@@ -62,8 +64,30 @@ module Avo
|
|
|
62
64
|
|
|
63
65
|
private
|
|
64
66
|
|
|
67
|
+
# The attachment association named in the URL, validated against the record
|
|
68
|
+
# it is being requested on. Blank when the name is not an attachment on this
|
|
69
|
+
# record, which keeps `params[:attachment_name]` out of the policy method
|
|
70
|
+
# name below.
|
|
71
|
+
def attachment_name
|
|
72
|
+
return @attachment_name if defined?(@attachment_name)
|
|
73
|
+
|
|
74
|
+
@attachment_name = BaseResource.valid_attachment_name(@record, params[:attachment_name])
|
|
75
|
+
end
|
|
76
|
+
|
|
77
|
+
# Resolve the attachment through the record and association that were
|
|
78
|
+
# authorized. `params[:attachment_id]` is attacker-controlled and
|
|
79
|
+
# independent of `params[:id]`, so an unscoped lookup here would let a user
|
|
80
|
+
# authorized on one record destroy any attachment in the application.
|
|
81
|
+
def attachment_to_destroy
|
|
82
|
+
ActiveStorage::Attachment.find_by(
|
|
83
|
+
id: params[:attachment_id],
|
|
84
|
+
record: @record,
|
|
85
|
+
name: attachment_name
|
|
86
|
+
)
|
|
87
|
+
end
|
|
88
|
+
|
|
65
89
|
def authorized_to(action)
|
|
66
|
-
@resource.authorization.authorize_action("#{action}_#{
|
|
90
|
+
@resource.authorization.authorize_action("#{action}_#{attachment_name}?", record: @record, raise_exception: false)
|
|
67
91
|
end
|
|
68
92
|
|
|
69
93
|
def authorized_to_upload(attachment_name)
|
data/lib/avo/version.rb
CHANGED