mongrel_secure_download-redux 0.0.2.199 → 0.0.3.200

data/README

@@ -2,7 +2,7 @@
 
 == VERSION
 
-This documentation refers to mongrel_secure_download-redux version 0.0.2
+This documentation refers to mongrel_secure_download-redux version 0.0.3
 
 
 == DESCRIPTION

data/Rakefile

@@ -1,3 +1,5 @@
+require 'lib/mongrel_secure_download-redux/init'
+
 begin
   require 'hen'
 
@@ -7,7 +9,7 @@ begin
     },
 
     :gem => {
-      :version      => '0.0.2',
+      :version      => SecureDownloadRedux::VERSION,
       :summary      => 'Re-implementation of the Mongrel Secure Download Plugin',
       :files        => FileList['lib/**/*.rb'].to_a,
       :extra_files  => FileList['[A-Z]*', 'resources/*'].to_a,

data/lib/mongrel_secure_download-redux/init.rb

@@ -8,26 +8,28 @@ require 'filemagic/ext'
 
 class SecureDownloadRedux < GemPlugin::Plugin '/handlers'
 
+  # Our version ;-)
+  VERSION = '0.0.3'
+
   include Mongrel::HttpHandlerPlugin
 
   URL_RE = %r{\A(?:ht|f)tps?://}io
 
-  attr_reader :response, :secret, :base, :path, :timestamp, :token
-
   def process(request, response)
-    query = Mongrel::HttpRequest.query_parse(request.params['QUERY_STRING'])
+    @base = File.expand_path(@options[:base] || '.')
+
+    if @base == '/'
+      raise ArgumentError, 'specifying a base path of / is way too dangerous!'
+    end
 
-    @response  = response
-    @secret    = @options[:secret]
-    @base      = @options[:base] || '.'
-    @path      = query['path']
-    @timestamp = query['timestamp']
-    @token     = query['token']
+    @query = Mongrel::HttpRequest.query_parse(request.params['QUERY_STRING'])
 
     if !required_params_given? || timeout? || !authorized?
       response.start(@status) {}
     else
-      @status = 200  # OK
+      @status   = 200  # OK
+      @response = response
+
       url? ? send_url : send_file
     end
   end
@@ -36,71 +38,77 @@ class SecureDownloadRedux < GemPlugin::Plugin '/handlers'
 
   def required_params_given?
     @status = 500  # Internal Server Error
-    secret && path && timestamp && token
+
+    @secret    = @options[:secret]   and
+    @path      = @query['path']      and
+    @timestamp = @query['timestamp'] and
+    @token     = @query['token']
   end
 
   def timeout?
     @status = 408  # Request Timeout
-    timestamp.to_i < Time.now.to_i
+    @timestamp.to_i < Time.now.to_i
   end
 
   def authorized?
     @status = 403  # Forbidden
-    token == compute_token
+    @token == compute_token
   end
 
   def compute_token
-    Digest::SHA1.hexdigest(secret + path + timestamp)
+    Digest::SHA1.hexdigest(@secret + @path + @timestamp)
   end
 
   def url?
-    path =~ URL_RE
+    @path =~ URL_RE
   end
 
   def send_url_read
-    response.body = open(path) unless @header_only
-    response.send_body
+    @response.body = open(@path) unless @header_only
+    @response.send_body
   end
 
   def send_url_redirect1
     @status = 303  # See Other vs. Found (302) vs. Temporary Redirect (307)
 
-    response.start(@status, true) { |head, body|
-      head['Location'] = path
+    @response.start(@status, true) { |head, body|
+      head['Location'] = @path
       #head['Content-type'] = ???
 
-      body.write(%Q{See <a href="#{path}">#{path}</a>})
+      body.write(%Q{See <a href="#{@path}">#{@path}</a>})
     }
   end
 
   def send_url_redirect2
-    response.socket.write(Mongrel::Const::REDIRECT % path)
+    @response.socket.write(Mongrel::Const::REDIRECT % @path)
   end
 
   # Choose your alternative:
-  alias_method :send_url, :send_url_redirect2
+  alias_method :send_url, :send_url_read
+  #alias_method :send_url, :send_url_redirect1
+  #alias_method :send_url, :send_url_redirect2
 
   def send_file
-    path = File.expand_path(File.join(base, @path))
+    path = File.expand_path(File.join(@base, @path))
 
     # Prevent double-dot vulnerability!
-    return unless path =~ %r{\A#{Regexp.escape(File.expand_path(base))}}
+    return unless path =~ %r{\A#{Regexp.escape(@base)}/}
 
     file = File.stat(path)
     size = file.size
     time = file.mtime
 
-    response.status = @status
+    @response.status = @status
 
-    response.header[Mongrel::Const::LAST_MODIFIED] = time.httpdate
-    response.header[Mongrel::Const::ETAG]          = Mongrel::Const::ETAG_FORMAT % [time.to_i, size, file.ino]
-    response.header[Mongrel::Const::CONTENT_TYPE]  = File.content_type(path) || @default_content_type
-    response.header['Content-Disposition']         = %Q{inline; filename="#{File.basename(path)}"}
+    @response.header[Mongrel::Const::LAST_MODIFIED] = time.httpdate
+    @response.header[Mongrel::Const::ETAG]          = Mongrel::Const::ETAG_FORMAT % [time.to_i, size, file.ino]
+    @response.header[Mongrel::Const::CONTENT_TYPE]  = File.content_type(path) || @default_content_type
+    @response.header['Content-Disposition']         = %Q{inline; filename="#{File.basename(path)}"}
 
-    response.send_status(size)
-    response.send_header
+    @response.send_status(size)
+    @response.send_header
 
-    @header_only ? response.send_body : response.send_file(path)
+    @header_only ? @response.send_body : @response.send_file(@path)
   end
 
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: mongrel_secure_download-redux
 version: !ruby/object:Gem::Version 
-  version: 0.0.2.199
+  version: 0.0.3.200
 platform: ruby
 authors: 
 - Jens Wille
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2008-02-13 00:00:00 +01:00
+date: 2008-02-14 00:00:00 +01:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -42,22 +42,22 @@ extra_rdoc_files:
 files: 
 - lib/mongrel_secure_download-redux/init.rb
 - COPYING
-- Rakefile
 - README
+- Rakefile
 - resources/defaults.yaml
 has_rdoc: true
 homepage: http://prometheus.rubyforge.org/mongrel_secure_download-redux
 post_install_message: 
 rdoc_options: 
-- --all
+- --line-numbers
 - --main
 - README
-- --line-numbers
+- --title
+- mongrel_secure_download-redux Application documentation
 - --inline-source
 - --charset
 - UTF-8
-- --title
-- mongrel_secure_download-redux Application documentation
+- --all
 require_paths: 
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement