carrierwave 1.3.1 → 2.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (35) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +102 -43
  3. data/lib/carrierwave/downloader/base.rb +87 -0
  4. data/lib/carrierwave/downloader/remote_file.rb +65 -0
  5. data/lib/carrierwave/locale/en.yml +5 -4
  6. data/lib/carrierwave/mount.rb +25 -19
  7. data/lib/carrierwave/mounter.rb +71 -48
  8. data/lib/carrierwave/orm/activerecord.rb +14 -8
  9. data/lib/carrierwave/processing/mini_magick.rb +100 -117
  10. data/lib/carrierwave/processing/rmagick.rb +11 -5
  11. data/lib/carrierwave/processing/vips.rb +284 -0
  12. data/lib/carrierwave/processing.rb +1 -0
  13. data/lib/carrierwave/sanitized_file.rb +45 -23
  14. data/lib/carrierwave/storage/file.rb +2 -2
  15. data/lib/carrierwave/storage/fog.rb +42 -14
  16. data/lib/carrierwave/storage.rb +1 -0
  17. data/lib/carrierwave/uploader/cache.rb +24 -16
  18. data/lib/carrierwave/uploader/configuration.rb +28 -15
  19. data/lib/carrierwave/uploader/content_type_blacklist.rb +17 -8
  20. data/lib/carrierwave/uploader/content_type_whitelist.rb +20 -8
  21. data/lib/carrierwave/uploader/download.rb +2 -80
  22. data/lib/carrierwave/uploader/extension_blacklist.rb +18 -10
  23. data/lib/carrierwave/uploader/extension_whitelist.rb +19 -10
  24. data/lib/carrierwave/uploader/mountable.rb +6 -0
  25. data/lib/carrierwave/uploader/proxy.rb +2 -2
  26. data/lib/carrierwave/uploader/serialization.rb +1 -1
  27. data/lib/carrierwave/uploader/store.rb +5 -3
  28. data/lib/carrierwave/uploader/url.rb +6 -3
  29. data/lib/carrierwave/uploader/versions.rb +43 -13
  30. data/lib/carrierwave/uploader.rb +0 -9
  31. data/lib/carrierwave/validations/active_model.rb +3 -3
  32. data/lib/carrierwave/version.rb +1 -1
  33. data/lib/carrierwave.rb +4 -0
  34. data/lib/generators/templates/uploader.rb +2 -2
  35. metadata +93 -21
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 13d4923726d7eb20e4ce86366a5c538621fcf7041f508c91a49d18110836e1b8
4
- data.tar.gz: b28de2ffce2e7febf02bab5366d30e2cb5b9a0bd2d1399d05aebddddcdd8192f
3
+ metadata.gz: a6e511db9d3eebc43bd42613884cf42ba2ad5f236a438a609cccc67c6ce3d192
4
+ data.tar.gz: 20cef424394b5a40d27e73e8677161870c6d35f60734fd05cf2d0666f461b834
5
5
  SHA512:
6
- metadata.gz: 70d982a8de3b08806f7a059033cec1df699005a9817435ea0b7f05fd284139578f73c80909ba97e9534a44978862298ac6fde43870856b73d9da0db28fb4be99
7
- data.tar.gz: bcbae13bc47d3b03a521c136b0b5d2183e022eb4750720df9618933de56bf7b2cce89eec80c9584fd88b00caba992432bc6d7c47f2cab324667a7bb7fd1851ee
6
+ metadata.gz: 28aeace46926db2716ac4600a67cb3a318c553f8f04f533fcf19afaddbafc46489bc3df5d523bc878f5b77164d4110c69ddfe346944caeb46b0dd83df39d7ac9
7
+ data.tar.gz: dc271f6fdfd5a515295185265a53b0b894ecef7e1d72bdcaa062357dacd5c7e9bca54a818ffcd344a95b341628451f5b6e579b62587845148075f9db9de949f7
data/README.md CHANGED
@@ -3,7 +3,7 @@
3
3
  This gem provides a simple and extremely flexible way to upload files from Ruby applications.
4
4
  It works well with Rack based web applications, such as Ruby on Rails.
5
5
 
6
- [![Build Status](https://travis-ci.org/carrierwaveuploader/carrierwave.svg?branch=master)](http://travis-ci.org/carrierwaveuploader/carrierwave)
6
+ [![Build Status](https://github.com/carrierwaveuploader/carrierwave/workflows/Test/badge.svg)](https://github.com/carrierwaveuploader/carrierwave/actions)
7
7
  [![Code Climate](https://codeclimate.com/github/carrierwaveuploader/carrierwave.svg)](https://codeclimate.com/github/carrierwaveuploader/carrierwave)
8
8
  [![SemVer](https://api.dependabot.com/badges/compatibility_score?dependency-name=carrierwave&package-manager=bundler&version-scheme=semver)](https://dependabot.com/compatibility-score.html?dependency-name=carrierwave&package-manager=bundler&version-scheme=semver)
9
9
 
@@ -30,13 +30,13 @@ $ gem install carrierwave
30
30
  In Rails, add it to your Gemfile:
31
31
 
32
32
  ```ruby
33
- gem 'carrierwave', '~> 1.0'
33
+ gem 'carrierwave', '~> 2.0'
34
34
  ```
35
35
 
36
36
  Finally, restart the server to apply the changes.
37
37
 
38
- As of version 1.0, CarrierWave requires Rails 4.0 or higher and Ruby 2.0
39
- or higher. If you're on Rails 3, you should use v0.11.0.
38
+ As of version 2.0, CarrierWave requires Rails 5.0 or higher and Ruby 2.2
39
+ or higher. If you're on Rails 4, you should use 1.x.
40
40
 
41
41
  ## Getting Started
42
42
 
@@ -94,7 +94,7 @@ a migration:
94
94
  Open your model file and mount the uploader:
95
95
 
96
96
  ```ruby
97
- class User < ActiveRecord::Base
97
+ class User < ApplicationRecord
98
98
  mount_uploader :avatar, AvatarUploader
99
99
  end
100
100
  ```
@@ -157,12 +157,15 @@ Open your model file and mount the uploader:
157
157
 
158
158
 
159
159
  ```ruby
160
- class User < ActiveRecord::Base
160
+ class User < ApplicationRecord
161
161
  mount_uploaders :avatars, AvatarUploader
162
162
  serialize :avatars, JSON # If you use SQLite, add this line.
163
163
  end
164
164
  ```
165
165
 
166
+ Make sure that you mount the uploader with write (mount_uploaders) with `s` not (mount_uploader)
167
+ in order to avoid errors when uploading multiple files
168
+
166
169
  Make sure your file input fields are set up as multiple file fields. For
167
170
  example in Rails you'll want to do something like this:
168
171
 
@@ -187,6 +190,17 @@ u.avatars[0].current_path # => 'path/to/file.png'
187
190
  u.avatars[0].identifier # => 'file.png'
188
191
  ```
189
192
 
193
+ If you want to preserve existing files on uploading new one, you can go like:
194
+
195
+ ```erb
196
+ <% user.avatars.each do |avatar| %>
197
+ <%= hidden_field :user, :avatars, multiple: true, value: avatar.identifier %>
198
+ <% end %>
199
+ <%= form.file_field :avatars, multiple: true %>
200
+ ```
201
+
202
+ Sorting avatars is supported as well by reordering `hidden_field`, an example using jQuery UI Sortable is available [here](https://github.com/carrierwaveuploader/carrierwave/wiki/How-to%3A-Add%2C-remove-and-reorder-images-using-multiple-file-upload).
203
+
190
204
  ## Changing the storage directory
191
205
 
192
206
  In order to change where uploaded files are put, just override the `store_dir`
@@ -216,7 +230,7 @@ end
216
230
  ## Securing uploads
217
231
 
218
232
  Certain files might be dangerous if uploaded to the wrong location, such as PHP
219
- files or other script files. CarrierWave allows you to specify a whitelist of
233
+ files or other script files. CarrierWave allows you to specify an allowlist of
220
234
  allowed extensions or content types.
221
235
 
222
236
  If you're mounting the uploader, uploading a file with the wrong extension will
@@ -224,7 +238,7 @@ make the record invalid instead. Otherwise, an error is raised.
224
238
 
225
239
  ```ruby
226
240
  class MyUploader < CarrierWave::Uploader::Base
227
- def extension_whitelist
241
+ def extension_allowlist
228
242
  %w(jpg jpeg gif png)
229
243
  end
230
244
  end
@@ -235,29 +249,45 @@ Let's say we need an uploader that accepts only images. This can be done like th
235
249
 
236
250
  ```ruby
237
251
  class MyUploader < CarrierWave::Uploader::Base
238
- def content_type_whitelist
252
+ def content_type_allowlist
239
253
  /image\//
240
254
  end
241
255
  end
242
256
  ```
243
257
 
244
- You can use a blacklist to reject content types.
258
+ You can use a denylist to reject content types.
245
259
  Let's say we need an uploader that reject JSON files. This can be done like this
246
260
 
247
261
  ```ruby
248
262
  class NoJsonUploader < CarrierWave::Uploader::Base
249
- def content_type_blacklist
263
+ def content_type_denylist
250
264
  ['application/text', 'application/json']
251
265
  end
252
266
  end
253
267
  ```
254
268
 
269
+ ### CVE-2016-3714 (ImageTragick)
270
+ This version of CarrierWave has the ability to mitigate CVE-2016-3714. However, you **MUST** set a content_type_allowlist in your uploaders for this protection to be effective, and you **MUST** either disable ImageMagick's default SVG delegate or use the RSVG delegate for SVG processing.
271
+
272
+
273
+ A valid allowlist that will restrict your uploader to images only, and mitigate the CVE is:
274
+
275
+ ```ruby
276
+ class MyUploader < CarrierWave::Uploader::Base
277
+ def content_type_allowlist
278
+ [/image\//]
279
+ end
280
+ end
281
+ ```
282
+
283
+ **WARNING**: A `content_type_allowlist` is the only form of allowlist or denylist supported by CarrierWave that can effectively mitigate against CVE-2016-3714. Use of `extension_allowlist` will not inspect the file headers, and thus still leaves your application open to the vulnerability.
284
+
255
285
  ### Filenames and unicode chars
256
286
 
257
287
  Another security issue you should care for is the file names (see
258
288
  [Ruby On Rails Security Guide](http://guides.rubyonrails.org/security.html#file-uploads)).
259
289
  By default, CarrierWave provides only English letters, arabic numerals and some symbols as
260
- white-listed characters in the file name. If you want to support local scripts (Cyrillic letters, letters with diacritics and so on), you
290
+ allowlisted characters in the file name. If you want to support local scripts (Cyrillic letters, letters with diacritics and so on), you
261
291
  have to override `sanitize_regexp` method. It should return regular expression which would match
262
292
  all *non*-allowed symbols.
263
293
 
@@ -277,7 +307,7 @@ You no longer need to do this manually.
277
307
 
278
308
  Often you'll want to add different versions of the same file. The classic example is image thumbnails. There is built in support for this*:
279
309
 
280
- *Note:* You must have Imagemagick and MiniMagick installed to do image resizing. MiniMagick is a Ruby interface for Imagemagick which is a C program. This is why MiniMagick fails on 'bundle install' without Imagemagick installed.
310
+ *Note:* You must have Imagemagick installed to do image resizing.
281
311
 
282
312
  Some documentation refers to RMagick instead of MiniMagick but MiniMagick is recommended.
283
313
 
@@ -302,15 +332,13 @@ end
302
332
 
303
333
  When this uploader is used, an uploaded image would be scaled to be no larger
304
334
  than 800 by 800 pixels. The original aspect ratio will be kept.
305
- A version called thumb is then created, which is scaled
306
- to exactly 200 by 200 pixels.
307
335
 
308
- If you would like to crop images to a specific height and width you
309
- can use the alternative option of '''resize_to_fill'''. It will make sure
336
+ A version called `:thumb` is then created, which is scaled
337
+ to exactly 200 by 200 pixels. The thumbnail uses `resize_to_fill` which makes sure
310
338
  that the width and height specified are filled, only cropping
311
339
  if the aspect ratio requires it.
312
340
 
313
- The uploader could be used like this:
341
+ The above uploader could be used like this:
314
342
 
315
343
  ```ruby
316
344
  uploader = AvatarUploader.new
@@ -323,6 +351,18 @@ uploader.thumb.url # => '/url/to/thumb_my_file.png' # size: 200x200
323
351
  One important thing to remember is that process is called *before* versions are
324
352
  created. This can cut down on processing cost.
325
353
 
354
+ ### Processing Methods: mini_magick
355
+
356
+ - `convert` - Changes the image encoding format to the given format, eg. jpg
357
+ - `resize_to_limit` - Resize the image to fit within the specified dimensions while retaining the original aspect ratio. Will only resize the image if it is larger than the specified dimensions. The resulting image may be shorter or narrower than specified in the smaller dimension but will not be larger than the specified values.
358
+ - `resize_to_fit` - Resize the image to fit within the specified dimensions while retaining the original aspect ratio. The image may be shorter or narrower than specified in the smaller dimension but will not be larger than the specified values.
359
+ - `resize_to_fill` - Resize the image to fit within the specified dimensions while retaining the aspect ratio of the original image. If necessary, crop the image in the larger dimension. Optionally, a "gravity" may be specified, for example "Center", or "NorthEast".
360
+ - `resize_and_pad` - Resize the image to fit within the specified dimensions while retaining the original aspect ratio. If necessary, will pad the remaining area with the given color, which defaults to transparent (for gif and png, white for jpeg). Optionally, a "gravity" may be specified, as above.
361
+
362
+ See `carrierwave/processing/mini_magick.rb` for details.
363
+
364
+ ### Nested versions
365
+
326
366
  It is possible to nest versions within versions:
327
367
 
328
368
  ```ruby
@@ -359,7 +399,7 @@ private
359
399
  end
360
400
 
361
401
  def is_landscape? picture
362
- image = MiniMagick::Image.open(picture.path)
402
+ image = MiniMagick::Image.new(picture.path)
363
403
  image[:width] > image[:height]
364
404
  end
365
405
 
@@ -648,7 +688,6 @@ If you want to use fog you must add in your CarrierWave initializer the
648
688
  following lines
649
689
 
650
690
  ```ruby
651
- config.fog_provider = 'fog' # 'fog/aws' etc. Defaults to 'fog'
652
691
  config.fog_credentials = { ... } # Provider specific credentials
653
692
  ```
654
693
 
@@ -666,7 +705,6 @@ You can also pass in additional options, as documented fully in lib/carrierwave/
666
705
 
667
706
  ```ruby
668
707
  CarrierWave.configure do |config|
669
- config.fog_provider = 'fog/aws' # required
670
708
  config.fog_credentials = {
671
709
  provider: 'AWS', # required
672
710
  aws_access_key_id: 'xxx', # required unless using use_iam_profile
@@ -679,6 +717,9 @@ CarrierWave.configure do |config|
679
717
  config.fog_directory = 'name_of_bucket' # required
680
718
  config.fog_public = false # optional, defaults to true
681
719
  config.fog_attributes = { cache_control: "public, max-age=#{365.days.to_i}" } # optional, defaults to {}
720
+ # For an application which utilizes multiple servers but does not need caches persisted across requests,
721
+ # uncomment the line :file instead of the default :storage. Otherwise, it will use AWS as the temp cache store.
722
+ # config.cache_storage = :file
682
723
  end
683
724
  ```
684
725
 
@@ -692,6 +733,14 @@ end
692
733
 
693
734
  That's it! You can still use the `CarrierWave::Uploader#url` method to return the url to the file on Amazon S3.
694
735
 
736
+ **Note**: for Carrierwave to work properly it needs credentials with the following permissions:
737
+
738
+ * `s3:ListBucket`
739
+ * `s3:PutObject`
740
+ * `s3:GetObject`
741
+ * `s3:DeleteObject`
742
+ * `s3:PutObjectAcl`
743
+
695
744
  ## Using Rackspace Cloud Files
696
745
 
697
746
  [Fog](http://github.com/fog/fog) is used to support Rackspace Cloud Files. Ensure you have it in your Gemfile:
@@ -707,7 +756,6 @@ Using a US-based account:
707
756
 
708
757
  ```ruby
709
758
  CarrierWave.configure do |config|
710
- config.fog_provider = "fog/rackspace/storage" # optional, defaults to "fog"
711
759
  config.fog_credentials = {
712
760
  provider: 'Rackspace',
713
761
  rackspace_username: 'xxxxxx',
@@ -722,7 +770,6 @@ Using a UK-based account:
722
770
 
723
771
  ```ruby
724
772
  CarrierWave.configure do |config|
725
- config.fog_provider = "fog/rackspace/storage" # optional, defaults to "fog"
726
773
  config.fog_credentials = {
727
774
  provider: 'Rackspace',
728
775
  rackspace_username: 'xxxxxx',
@@ -753,31 +800,43 @@ end
753
800
  That's it! You can still use the `CarrierWave::Uploader#url` method to return
754
801
  the url to the file on Rackspace Cloud Files.
755
802
 
756
- ## Using Google Storage for Developers
803
+ ## Using Google Cloud Storage
757
804
 
758
- [Fog](http://github.com/fog/fog-google) is used to support Google Storage for Developers. Ensure you have it in your Gemfile:
805
+ [Fog](http://github.com/fog/fog-google) is used to support Google Cloud Storage. Ensure you have it in your Gemfile:
759
806
 
760
807
  ```ruby
761
808
  gem "fog-google"
762
- gem "google-api-client", "> 0.8.5", "< 0.9"
763
- gem "mime-types"
764
809
  ```
765
810
 
766
- You'll need to configure a directory (also known as a bucket), access key id and secret access key in the initializer.
811
+ You'll need to configure a directory (also known as a bucket) and the credentials in the initializer.
767
812
  For the sake of performance it is assumed that the directory already exists, so please create it if need be.
768
813
 
769
814
  Please read the [fog-google README](https://github.com/fog/fog-google/blob/master/README.md) on how to get credentials.
770
815
 
816
+ For Google Storage JSON API (recommended):
817
+ ```ruby
818
+ CarrierWave.configure do |config|
819
+ config.fog_provider = 'fog/google'
820
+ config.fog_credentials = {
821
+ provider: 'Google',
822
+ google_project: 'my-project',
823
+ google_json_key_string: 'xxxxxx'
824
+ # or use google_json_key_location if using an actual file
825
+ }
826
+ config.fog_directory = 'google_cloud_storage_bucket_name'
827
+ end
828
+ ```
771
829
 
830
+ For Google Storage XML API:
772
831
  ```ruby
773
832
  CarrierWave.configure do |config|
774
- config.fog_provider = 'fog/google' # required
775
- config.fog_credentials = {
776
- provider: 'Google',
777
- google_storage_access_key_id: 'xxxxxx',
778
- google_storage_secret_access_key: 'yyyyyy'
779
- }
780
- config.fog_directory = 'name_of_directory'
833
+ config.fog_provider = 'fog/google'
834
+ config.fog_credentials = {
835
+ provider: 'Google',
836
+ google_storage_access_key_id: 'xxxxxx',
837
+ google_storage_secret_access_key: 'yyyyyy'
838
+ }
839
+ config.fog_directory = 'google_cloud_storage_bucket_name'
781
840
  end
782
841
  ```
783
842
 
@@ -868,8 +927,8 @@ manipulation methods.
868
927
 
869
928
  ## Using MiniMagick
870
929
 
871
- MiniMagick is similar to RMagick but performs all the operations using the 'mogrify'
872
- command which is part of the standard ImageMagick kit. This allows you to have the power
930
+ MiniMagick is similar to RMagick but performs all the operations using the 'convert'
931
+ CLI which is part of the standard ImageMagick kit. This allows you to have the power
873
932
  of ImageMagick without having to worry about installing all the RMagick libraries.
874
933
 
875
934
  See the MiniMagick site for more details:
@@ -921,10 +980,10 @@ errors:
921
980
  carrierwave_processing_error: failed to be processed
922
981
  carrierwave_integrity_error: is not of an allowed file type
923
982
  carrierwave_download_error: could not be downloaded
924
- extension_whitelist_error: "You are not allowed to upload %{extension} files, allowed types: %{allowed_types}"
925
- extension_blacklist_error: "You are not allowed to upload %{extension} files, prohibited types: %{prohibited_types}"
926
- content_type_whitelist_error: "You are not allowed to upload %{content_type} files, allowed types: %{allowed_types}"
927
- content_type_blacklist_error: "You are not allowed to upload %{content_type} files"
983
+ extension_allowlist_error: "You are not allowed to upload %{extension} files, allowed types: %{allowed_types}"
984
+ extension_denylist_error: "You are not allowed to upload %{extension} files, prohibited types: %{prohibited_types}"
985
+ content_type_allowlist_error: "You are not allowed to upload %{content_type} files, allowed types: %{allowed_types}"
986
+ content_type_denylist_error: "You are not allowed to upload %{content_type} files"
928
987
  rmagick_processing_error: "Failed to manipulate with rmagick, maybe it is not an image?"
929
988
  mini_magick_processing_error: "Failed to manipulate with MiniMagick, maybe it is not an image? Original Error: %{e}"
930
989
  min_size_error: "File size should be greater than %{min_size}"
@@ -972,12 +1031,12 @@ end
972
1031
  Will add these callbacks:
973
1032
 
974
1033
  ```ruby
975
- after_save :store_avatar!
976
1034
  before_save :write_avatar_identifier
1035
+ after_save :store_previous_changes_for_avatar
977
1036
  after_commit :remove_avatar!, on: :destroy
978
1037
  after_commit :mark_remove_avatar_false, on: :update
979
- after_save :store_previous_changes_for_avatar
980
1038
  after_commit :remove_previously_stored_avatar, on: :update
1039
+ after_commit :store_avatar!, on: [:create, :update]
981
1040
  ```
982
1041
 
983
1042
  If you want to skip any of these callbacks (eg. you want to keep the existing
@@ -0,0 +1,87 @@
1
+ require 'open-uri'
2
+ require 'ssrf_filter'
3
+ require 'addressable'
4
+ require 'carrierwave/downloader/remote_file'
5
+
6
+ module CarrierWave
7
+ module Downloader
8
+ class Base
9
+ attr_reader :uploader
10
+
11
+ def initialize(uploader)
12
+ @uploader = uploader
13
+ end
14
+
15
+ ##
16
+ # Downloads a file from given URL and returns a RemoteFile.
17
+ #
18
+ # === Parameters
19
+ #
20
+ # [url (String)] The URL where the remote file is stored
21
+ # [remote_headers (Hash)] Request headers
22
+ #
23
+ def download(url, remote_headers = {})
24
+ headers = remote_headers.
25
+ reverse_merge('User-Agent' => "CarrierWave/#{CarrierWave::VERSION}")
26
+ uri = process_uri(url.to_s)
27
+ begin
28
+ if skip_ssrf_protection?(uri)
29
+ response = OpenURI.open_uri(process_uri(url.to_s), headers)
30
+ else
31
+ request = nil
32
+ response = SsrfFilter.get(uri, headers: headers) do |req|
33
+ request = req
34
+ end
35
+ response.uri = request.uri
36
+ response.value
37
+ end
38
+ rescue StandardError => e
39
+ raise CarrierWave::DownloadError, "could not download file: #{e.message}"
40
+ end
41
+ CarrierWave::Downloader::RemoteFile.new(response)
42
+ end
43
+
44
+ ##
45
+ # Processes the given URL by parsing it, and escaping if necessary. Public to allow overriding.
46
+ #
47
+ # === Parameters
48
+ #
49
+ # [url (String)] The URL where the remote file is stored
50
+ #
51
+ def process_uri(uri)
52
+ uri_parts = uri.split('?')
53
+ encoded_uri = Addressable::URI.parse(uri_parts.shift).normalize.to_s
54
+ query = uri_parts.any? ? "?#{uri_parts.join('?')}" : ''
55
+ begin
56
+ URI.parse("#{encoded_uri}#{query}")
57
+ rescue URI::InvalidURIError
58
+ URI.parse("#{encoded_uri}#{URI::DEFAULT_PARSER.escape(query)}")
59
+ end
60
+ rescue URI::InvalidURIError, Addressable::URI::InvalidURIError
61
+ raise CarrierWave::DownloadError, "couldn't parse URL: #{uri}"
62
+ end
63
+
64
+ ##
65
+ # If this returns true, SSRF protection will be bypassed.
66
+ # You can override this if you want to allow accessing specific local URIs that are not SSRF exploitable.
67
+ #
68
+ # === Parameters
69
+ #
70
+ # [uri (URI)] The URI where the remote file is stored
71
+ #
72
+ # === Examples
73
+ #
74
+ # class CarrierWave::Downloader::CustomDownloader < CarrierWave::Downloader::Base
75
+ # def skip_ssrf_protection?(uri)
76
+ # uri.hostname == 'localhost' && uri.port == 80
77
+ # end
78
+ # end
79
+ #
80
+ # my_uploader.downloader = CarrierWave::Downloader::CustomDownloader
81
+ #
82
+ def skip_ssrf_protection?(uri)
83
+ false
84
+ end
85
+ end
86
+ end
87
+ end
@@ -0,0 +1,65 @@
1
+ module CarrierWave
2
+ module Downloader
3
+ class RemoteFile
4
+ attr_reader :file, :uri
5
+
6
+ def initialize(file)
7
+ case file
8
+ when String
9
+ @file = StringIO.new(file)
10
+ when Net::HTTPResponse
11
+ @file = StringIO.new(file.body)
12
+ @content_type = file.content_type
13
+ @headers = file
14
+ @uri = file.uri
15
+ else
16
+ @file = file
17
+ @content_type = file.content_type
18
+ @headers = file.meta
19
+ @uri = file.base_uri
20
+ end
21
+ end
22
+
23
+ def content_type
24
+ @content_type || 'application/octet-stream'
25
+ end
26
+
27
+ def headers
28
+ @headers || {}
29
+ end
30
+
31
+ def original_filename
32
+ filename = filename_from_header || filename_from_uri
33
+ mime_type = MiniMime.lookup_by_content_type(content_type)
34
+ unless File.extname(filename).present? || mime_type.blank?
35
+ filename = "#{filename}.#{mime_type.extension}"
36
+ end
37
+ filename
38
+ end
39
+
40
+ def respond_to?(*args)
41
+ super || file.respond_to?(*args)
42
+ end
43
+
44
+ private
45
+
46
+ def filename_from_header
47
+ return nil unless headers['content-disposition']
48
+
49
+ match = headers['content-disposition'].match(/filename=(?:"([^"]+)"|([^";]+))/)
50
+ return nil unless match
51
+
52
+ match[1].presence || match[2].presence
53
+ end
54
+
55
+ def filename_from_uri
56
+ CGI.unescape(File.basename(uri.path))
57
+ end
58
+
59
+ def method_missing(*args, &block)
60
+ file.send(*args, &block)
61
+ end
62
+ end
63
+ end
64
+ end
65
+
@@ -4,11 +4,12 @@ en:
4
4
  carrierwave_processing_error: failed to be processed
5
5
  carrierwave_integrity_error: is not of an allowed file type
6
6
  carrierwave_download_error: could not be downloaded
7
- extension_whitelist_error: "You are not allowed to upload %{extension} files, allowed types: %{allowed_types}"
8
- extension_blacklist_error: "You are not allowed to upload %{extension} files, prohibited types: %{prohibited_types}"
9
- content_type_whitelist_error: "You are not allowed to upload %{content_type} files, allowed types: %{allowed_types}"
10
- content_type_blacklist_error: "You are not allowed to upload %{content_type} files"
7
+ extension_allowlist_error: "You are not allowed to upload %{extension} files, allowed types: %{allowed_types}"
8
+ extension_denylist_error: "You are not allowed to upload %{extension} files, prohibited types: %{prohibited_types}"
9
+ content_type_allowlist_error: "You are not allowed to upload %{content_type} files, allowed types: %{allowed_types}"
10
+ content_type_denylist_error: "You are not allowed to upload %{content_type} files"
11
11
  rmagick_processing_error: "Failed to manipulate with rmagick, maybe it is not an image?"
12
12
  mini_magick_processing_error: "Failed to manipulate with MiniMagick, maybe it is not an image? Original Error: %{e}"
13
+ vips_processing_error: "Failed to manipulate with vips, maybe it is not an image? Original Error: %{e}"
13
14
  min_size_error: "File size should be greater than %{min_size}"
14
15
  max_size_error: "File size should be less than %{max_size}"
@@ -174,17 +174,26 @@ module CarrierWave
174
174
  return if frozen?
175
175
  mounter = _mounter(:#{column})
176
176
 
177
- if mounter.remove?
178
- write_uploader(mounter.serialization_column, nil)
179
- elsif mounter.identifiers.first
180
- write_uploader(mounter.serialization_column, mounter.identifiers.first)
181
- end
177
+ mounter.clear! if mounter.remove?
178
+ write_uploader(mounter.serialization_column, mounter.identifiers.first)
182
179
  end
183
180
 
184
181
  def #{column}_identifier
185
182
  _mounter(:#{column}).read_identifiers[0]
186
183
  end
187
184
 
185
+ def #{column}_integrity_error
186
+ #{column}_integrity_errors.last
187
+ end
188
+
189
+ def #{column}_processing_error
190
+ #{column}_processing_errors.last
191
+ end
192
+
193
+ def #{column}_download_error
194
+ #{column}_download_errors.last
195
+ end
196
+
188
197
  def store_previous_changes_for_#{column}
189
198
  attribute_changes = ::ActiveRecord.version.to_s.to_f >= 5.1 ? saved_changes : changes
190
199
  @_previous_changes_for_#{column} = attribute_changes[_mounter(:#{column}).serialization_column]
@@ -240,9 +249,9 @@ module CarrierWave
240
249
  # [store_images!] Stores all files that have been assigned with +images=+
241
250
  # [remove_images!] Removes the uploaded file from the filesystem.
242
251
  #
243
- # [images_integrity_error] Returns an error object if the last files to be assigned caused an integrity error
244
- # [images_processing_error] Returns an error object if the last files to be assigned caused a processing error
245
- # [images_download_error] Returns an error object if the last files to be remotely assigned caused a download error
252
+ # [image_integrity_errors] Returns error objects of files which failed to pass integrity check
253
+ # [image_processing_errors] Returns error objects of files which failed to be processed
254
+ # [image_download_errors] Returns error objects of files which failed to be downloaded
246
255
  #
247
256
  # [image_identifiers] Reads out the identifiers of the files
248
257
  #
@@ -329,11 +338,8 @@ module CarrierWave
329
338
  return if frozen?
330
339
  mounter = _mounter(:#{column})
331
340
 
332
- if mounter.remove?
333
- write_uploader(mounter.serialization_column, nil)
334
- elsif mounter.identifiers.any?
335
- write_uploader(mounter.serialization_column, mounter.identifiers)
336
- end
341
+ mounter.clear! if mounter.remove?
342
+ write_uploader(mounter.serialization_column, mounter.identifiers.presence)
337
343
  end
338
344
 
339
345
  def #{column}_identifiers
@@ -395,16 +401,16 @@ module CarrierWave
395
401
  _mounter(:#{column}).store!
396
402
  end
397
403
 
398
- def #{column}_integrity_error
399
- _mounter(:#{column}).integrity_error
404
+ def #{column}_integrity_errors
405
+ _mounter(:#{column}).integrity_errors
400
406
  end
401
407
 
402
- def #{column}_processing_error
403
- _mounter(:#{column}).processing_error
408
+ def #{column}_processing_errors
409
+ _mounter(:#{column}).processing_errors
404
410
  end
405
411
 
406
- def #{column}_download_error
407
- _mounter(:#{column}).download_error
412
+ def #{column}_download_errors
413
+ _mounter(:#{column}).download_errors
408
414
  end
409
415
 
410
416
  def mark_remove_#{column}_false