paperclip 5.1.0 → 5.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 70e53f15c9fc9e1ffd3097f25a2fd58de617aa80
-  data.tar.gz: 5c2d008914407061d105a5b18d97e9c4e0c88c74
+  metadata.gz: 569debc832514cb262986c31782d4590065f944b
+  data.tar.gz: b65dbae4e73cddd0c685e0c1bd4fc101ef09d251
 SHA512:
-  metadata.gz: 368a451123ff0522cf60676a0925d2b69b6529db7ad4ef91ff03f41ef08910016a9d1715c618d90f451754982395259264be9869f290fd91591c7723b3a23f7b
-  data.tar.gz: b69604376b66abe5a599fef4c72be3771822d6bb9f05a3732b2e5a91853ff61fc659f77541bafcb219bd5d5f15fcd61f79134ee654714e36b2a795d7da9c8198
+  metadata.gz: f0890bb495c49f763d1765015e5e7818c3d7ae6e50fbb33281226c6ccf3a316dd39b6c7e0df20fbe559522fb0c1fdc8b61c824fd954a8c5699920dcd2db88992
+  data.tar.gz: 7913049f0c5cbdd2b3912dfea1121fce81ea002bcdee5924ad2e48c2fc03fa5dc391922666d48310957444123d495a6e6266b6433fb51c7b512980322d527485

data/.codeclimate.yml

@@ -0,0 +1,17 @@
+---
+engines:
+  duplication:
+    enabled: true
+    config:
+      languages:
+      - ruby
+  fixme:
+    enabled: true
+  rubocop:
+    enabled: true
+ratings:
+  paths:
+  - "**.rb"
+exclude_paths:
+- features/
+- spec/

data/.hound.yml

@@ -20,7 +20,8 @@ AllCops:
     - "db/schema.rb"
     - 'vendor/**/*'
     - 'gemfiles/vendor/**/*'
-  RunRailsCops: false
+  Rails:
+    Enabled: false
   DisplayCopNames: false
   StyleGuideCopsOnly: false
 Style/AccessModifierIndentation:
@@ -434,7 +435,7 @@ Style/TrailingBlankLines:
   SupportedStyles:
   - final_newline
   - final_blank_line
-Style/TrailingComma:
+Style/TrailingCommaInLiteral:
   Description: Checks for trailing comma in parameter lists and literals.
   StyleGuide: https://github.com/bbatsov/ruby-style-guide#no-trailing-array-commas
   Enabled: false
@@ -560,11 +561,6 @@ Rails/ActionFilter:
   - filter
   Include:
   - app/controllers/**/*.rb
-Rails/DefaultScope:
-  Description: Checks if the argument passed to default_scope is a block.
-  Enabled: true
-  Include:
-  - app/models/**/*.rb
 Rails/HasAndBelongsToMany:
   Description: Prefer has_many :through to has_and_belongs_to_many.
   Enabled: true
@@ -685,10 +681,6 @@ Style/DefWithParentheses:
   Description: Use def with parentheses when there are arguments.
   StyleGuide: https://github.com/bbatsov/ruby-style-guide#method-parens
   Enabled: true
-Style/DeprecatedHashMethods:
-  Description: Checks for use of deprecated Hash methods.
-  StyleGuide: https://github.com/bbatsov/ruby-style-guide#hash-key
-  Enabled: false
 Style/Documentation:
   Description: Document classes and non-namespace modules.
   Enabled: false
@@ -840,7 +832,7 @@ Style/SelfAssignment:
     used.
   StyleGuide: https://github.com/bbatsov/ruby-style-guide#self-assignment
   Enabled: false
-Style/SingleSpaceBeforeFirstArg:
+Style/SpaceBeforeFirstArg:
   Description: Checks that exactly one space is used between a method name and the
     first argument for method calls without parentheses.
   Enabled: true
@@ -852,7 +844,7 @@ Style/SpaceAfterComma:
   Description: Use spaces after commas.
   StyleGuide: https://github.com/bbatsov/ruby-style-guide#spaces-operators
   Enabled: true
-Style/SpaceAfterControlKeyword:
+Style/SpaceAroundKeyword:
   Description: Use spaces after if/elsif/unless/while/until/case/when.
   Enabled: true
 Style/SpaceAfterMethodName:
@@ -881,9 +873,6 @@ Style/SpaceAroundOperators:
   Description: Use spaces around operators.
   StyleGuide: https://github.com/bbatsov/ruby-style-guide#spaces-operators
   Enabled: true
-Style/SpaceBeforeModifierKeyword:
-  Description: Put a space before the modifier keyword.
-  Enabled: true
 Style/SpaceInsideBrackets:
   Description: No spaces after [ or before ].
   StyleGuide: https://github.com/bbatsov/ruby-style-guide#no-spaces-braces

data/.travis.yml

@@ -1,26 +1,25 @@
+language: ruby
+sudo: false
+
 rvm:
   - 2.1
-  - 2.2.2
+  - 2.2
+  - 2.3
+  - 2.4
 
 script: "bundle exec rake clean spec cucumber"
 
+addons:
+  apt:
+    packages:
+    - ghostscript
+
 gemfile:
-  - gemfiles/4.2.awsv2.0.gemfile
-  - gemfiles/4.2.awsv2.1.gemfile
-  - gemfiles/5.0.awsv2.0.gemfile
-  - gemfiles/5.0.awsv2.1.gemfile
+  - gemfiles/4.2.gemfile
+  - gemfiles/5.0.gemfile
 
 matrix:
   fast_finish: true
   exclude:
-    - gemfile: gemfiles/5.0.awsv2.0.gemfile
-      rvm: 2.0
-    - gemfile: gemfiles/5.0.awsv2.1.gemfile
-      rvm: 2.0
-    - gemfile: gemfiles/5.0.awsv2.0.gemfile
+    - gemfile: gemfiles/5.0.gemfile
       rvm: 2.1
-    - gemfile: gemfiles/5.0.awsv2.1.gemfile
-      rvm: 2.1
-
-sudo: false
-cache: bundler

data/Appraisals

@@ -1,27 +1,7 @@
-appraise "4.2.awsv2.0" do
+appraise "4.2" do
   gem "rails", "~> 4.2.0"
-  gem "aws-sdk", "~> 2.0.0"
 end
 
-appraise "4.2.awsv2.1" do
-  gem "rails", "~> 4.2.0"
-  gem "aws-sdk", "~> 2.1.0"
-
-  group :development, :test do
-    gem 'mime-types', '>= 1.16', '< 4'
-  end
-end
-
-appraise "5.0.awsv2.0" do
-  gem "rails", "5.0.0.beta3"
-  gem "aws-sdk", "~> 2.0.0"
-
-  group :development, :test do
-    gem 'mime-types', '>= 1.16', '< 4'
-  end
-end
-
-appraise "5.0.awsv2.1" do
-  gem "rails", "5.0.0.beta3"
-  gem "aws-sdk", "~> 2.1.0"
+appraise "5.0" do
+  gem "rails", "~> 5.0.0"
 end

data/Gemfile

@@ -12,4 +12,5 @@ group :development, :test do
   gem 'mime-types'
   gem 'builder'
   gem 'rubocop', require: false
+  gem 'rspec'
 end

data/NEWS

@@ -1,4 +1,39 @@
-master:
+5.2.0 (2018-01-23):
+
+* Security: Remove the automatic loading of URI adapters. Some of these
+  adapters can be specially crafted to expose your network topology. (#2435)
+* Bugfix: The rake task no longer rescues `Exception`. (#2476)
+* Bugfix: Handle malformed `Content-Disposition` headers (#2283)
+* Bugfix: The `:only_process` option works when passed a lambda again. (#2289)
+* Improvement: Added `:use_accelerate_endpoint` option when using S3 to enable
+  [Amazon S3 Transfer Acceleration](http://docs.aws.amazon.com/AmazonS3/latest/dev/transfer-acceleration.html)
+  (#2291)
+* Improvement: Make the fingerprint digest configurable per attachment. The
+  default remains MD5. Making this configurable means it can change in a future
+  version because it is not considered secure anymore against intentional file
+  corruption. For more info, see https://en.wikipedia.org/wiki/MD5#Security
+
+  You can change the digest used for an attachment by adding the
+  `:adapter_options` parameter to the `has_attached_file` options like this:
+  `has_attached_file :avatar, adapter_options: { hash_digest: Digest::SHA256 }`
+
+  Use the rake task to regenerate fingerprints with the new digest for a given
+  class. Note that this does **not** check the file integrity using the old
+  fingerprint. Run the following command to regenerate fingerprints for all
+  User attachments:
+  `CLASS=User rake paperclip:refresh:fingerprints`
+  You can optionally limit the attachment that will be processed, e.g:
+  `CLASS=User ATTACHMENT=avatar rake paperclip:refresh:fingerprints` (#2229)
+* Improvement: The new `frame_index` option on the thumbnail processor allows
+  you to select a specific frame from an animated upload to use as a thumbnail.
+  Initial support is for mkv, avi, MP4, mov, MPEG, and GIF. (#2155)
+* Improvement: Instead of copying files, use hard links. This is an
+  optimization. (#2120)
+* Improvement: S3 storage option `:s3_prefixes_in_alias`. (#2287)
+* Improvement: Fog option `:fog_public` can be a lambda. (#2302)
+* Improvement: One fewer warning on JRuby. (#2352)
+
+5.1.0 (2016-08-19):
 
 * Add default `content_type_detector` to `UploadedFileAdapter` (#2270)
 * Default S3 protocol to empty string (#2038)

data/README.md

@@ -17,7 +17,6 @@ https://github.com/thoughtbot/paperclip/releases
 <!-- START doctoc generated TOC please keep comment here to allow auto update -->
 <!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
 
-
 - [Requirements](#requirements)
   - [Ruby and Rails](#ruby-and-rails)
   - [Image Processor](#image-processor)
@@ -30,6 +29,7 @@ https://github.com/thoughtbot/paperclip/releases
   - [Edit and New Views with Simple Form](#edit-and-new-views-with-simple-form)
   - [Controller](#controller)
   - [View Helpers](#view-helpers)
+  - [Checking a File Exists](#checking-a-file-exists)
   - [Deleting an Attachment](#deleting-an-attachment)
 - [Usage](#usage)
 - [Validations](#validations)
@@ -39,14 +39,15 @@ https://github.com/thoughtbot/paperclip/releases
 - [Migrations](#migrations-1)
   - [Add Attachment Column To A Table](#add-attachment-column-to-a-table)
   - [Schema Definition](#schema-definition)
-  - [Vintage syntax](#vintage-syntax)
+  - [Vintage Syntax](#vintage-syntax)
 - [Storage](#storage)
   - [Understanding Storage](#understanding-storage)
+- [IO Adapters](#io-adapters)
 - [Post Processing](#post-processing)
 - [Custom Attachment Processors](#custom-attachment-processors)
 - [Events](#events)
 - [URI Obfuscation](#uri-obfuscation)
-- [MD5 Checksum / Fingerprint](#md5-checksum--fingerprint)
+- [Checksum / Fingerprint](#checksum--fingerprint)
 - [File Preservation for Soft-Delete](#file-preservation-for-soft-delete)
 - [Dynamic Configuration](#dynamic-configuration)
   - [Dynamic Styles:](#dynamic-styles)
@@ -260,7 +261,7 @@ end
 <%= image_tag @user.avatar.url(:thumb) %>
 ```
 
-### Checking a file exists
+### Checking a File Exists
 
 There are two methods for checking if a file exists:
 
@@ -549,7 +550,7 @@ class AddAttachmentColumnsToUsers < ActiveRecord::Migration
 end
 ```
 
-### Vintage syntax
+### Vintage Syntax
 
 Vintage syntax (such as `t.has_attached_file` and `drop_attached_file`) is still supported in
 Paperclip 3.x, but you're advised to update those migration files to use this new syntax.
@@ -591,7 +592,7 @@ You may also choose to store your files using Amazon's S3 service. To do so, inc
 the `aws-sdk` gem in your Gemfile:
 
 ```ruby
-gem 'aws-sdk', '>= 2.0.34'
+gem 'aws-sdk', '~> 2.3.0'
 ```
 
 And then you can specify using S3 from `has_attached_file`.
@@ -607,6 +608,34 @@ variables.
 
 ---
 
+IO Adapters
+-----------
+
+When a file is uploaded or attached, it can be in one of a few different input
+forms, from Rails' UploadedFile object to a StringIO to a Tempfile or even a
+simple String that is a URL that points to an image.
+
+Paperclip will accept, by default, many of these sources. It also is capable of
+handling even more with a little configuration. The IO Adapters that handle
+images from non-local sources are not enabled by default. They can be enabled by
+adding a line similar to the following into `config/initializers/paperclip.rb`:
+
+```ruby
+Paperclip::DataUriAdapter.register
+```
+
+It's best to only enable a remote-loading adapter if you need it. Otherwise
+there's a chance that someone can gain insight into your internal network
+structure using it as a vector.
+
+The following adapters are *not* loaded by default:
+
+* `Paperclip::UriAdapter` - which accepts a `URI` instance.
+* `Paperclip::HttpUrlProxyAdapter` - which accepts a `http` string.
+* `Paperclip::DataUriAdapter` - which accepts a Base64-encoded `data:` string.
+
+---
+
 Post Processing
 ---------------
 
@@ -627,6 +656,14 @@ JPGs will remain JPGs). `Paperclip::Thumbnail` uses ImageMagick to process
 images; [ImageMagick's geometry documentation](http://www.imagemagick.org/script/command-line-processing.php#geometry)
 has more information on the accepted style formats.
 
+ImageMagick supports a number of environment variables for controlling its resource limits. For example, you can enforce memory or execution time limits by setting the following variables in your application's process environment:
+
+* `MAGICK_MEMORY_LIMIT=128MiB`
+* `MAGICK_MAP_LIMIT=64MiB`
+* `MAGICK_TIME_LIMIT=30`
+
+For a full list of variables and description, see [ImageMagick's resources documentation](http://www.imagemagick.org/script/resources.php).
+
 ---
 
 Custom Attachment Processors
@@ -736,10 +773,10 @@ is specified in `:hash_data`. The default value for `:hash_data` is `":class/:at
 
 For more on this feature, read [the author's own explanation](https://github.com/thoughtbot/paperclip/pull/416)
 
-MD5 Checksum / Fingerprint
+Checksum / Fingerprint
 -------
 
-An MD5 checksum of the original file assigned will be placed in the model if it
+A checksum of the original file assigned will be placed in the model if it
 has an attribute named fingerprint.  Following the user model migration example
 above, the migration would look like the following:
 
@@ -755,6 +792,17 @@ class AddAvatarFingerprintColumnToUser < ActiveRecord::Migration
 end
 ```
 
+The algorithm can be specified using a configuration option; it defaults to MD5
+for backwards compatibility with Paperclip 5 and earlier.
+
+```ruby
+has_attached_file :some_attachment, adapter_options: { hash_digest: Digest::SHA256 }
+```
+
+Run `CLASS=User ATTACHMENT=avatar rake paperclip:refresh:fingerprints` after
+changing the digest on existing attachments to update the fingerprints in the
+database.
+
 File Preservation for Soft-Delete
 -------
 
@@ -984,13 +1032,13 @@ Thank you to all [the contributors](https://github.com/thoughtbot/paperclip/grap
 License
 -------
 
-Paperclip is Copyright © 2008-2016 thoughtbot, inc. It is free software, and may be
+Paperclip is Copyright © 2008-2017 thoughtbot, inc. It is free software, and may be
 redistributed under the terms specified in the MIT-LICENSE file.
 
 About thoughtbot
 ----------------
 
-![thoughtbot](https://thoughtbot.com/logo.png)
+![thoughtbot](http://presskit.thoughtbot.com/images/thoughtbot-logo-for-readmes.svg)
 
 Paperclip is maintained and funded by thoughtbot.
 The names and logos for thoughtbot are trademarks of thoughtbot, inc.

data/Rakefile

@@ -9,7 +9,7 @@ task :default => [:clean, :all]
 desc 'Test the paperclip plugin under all supported Rails versions.'
 task :all do |t|
   if ENV['BUNDLE_GEMFILE']
-    exec('rake spec cucumber')
+    exec('rake spec && cucumber')
   else
     exec("rm -f gemfiles/*.lock")
     Rake::Task["appraisal:gemfiles"].execute

data/UPGRADING

@@ -1,5 +1,5 @@
 ##################################################
-#  NOTE FOR UPGRADING FROM 4.3.0 OR EARLIER       #
+#  NOTE FOR UPGRADING FROM 4.3.0 OR EARLIER      #
 ##################################################
 
 Paperclip is now compatible with aws-sdk >= 2.0.0.

data/features/step_definitions/attachment_steps.rb

@@ -23,7 +23,7 @@ When /^I modify my attachment definition to:$/ do |definition|
 end
 
 When /^I upload the fixture "([^"]*)"$/ do |filename|
-  run_simple %(bundle exec #{runner_command} "User.create!(:attachment => File.open('#{fixture_path(filename)}'))")
+  run_simple %(bundle exec rails runner "User.create!(:attachment => File.open('#{fixture_path(filename)}'))")
 end
 
 Then /^the attachment "([^"]*)" should have a dimension of (\d+x\d+)$/ do |filename, dimension|
@@ -56,7 +56,7 @@ Then /^the attachment should have the same content type as the fixture "([^"]*)"
       require "mime/types"
     end
 
-    attachment_content_type = `bundle exec #{runner_command} "puts User.last.attachment_content_type"`.strip
+    attachment_content_type = `bundle exec rails runner "puts User.last.attachment_content_type"`.strip
     expected = MIME::Types.type_for(filename).first.content_type
     expect(attachment_content_type).to eq(expected)
   end
@@ -64,14 +64,14 @@ end
 
 Then /^the attachment should have the same file name as the fixture "([^"]*)"$/ do |filename|
   cd(".") do
-    attachment_file_name = `bundle exec #{runner_command} "puts User.last.attachment_file_name"`.strip
+    attachment_file_name = `bundle exec rails runner "puts User.last.attachment_file_name"`.strip
     expect(attachment_file_name).to eq(File.name(fixture_path(filename)).to_s)
   end
 end
 
 Then /^the attachment should have the same file size as the fixture "([^"]*)"$/ do |filename|
   cd(".") do
-    attachment_file_size = `bundle exec #{runner_command} "puts User.last.attachment_file_size"`.strip
+    attachment_file_size = `bundle exec rails runner "puts User.last.attachment_file_size"`.strip
     expect(attachment_file_size).to eq(File.size(fixture_path(filename)).to_s)
   end
 end
@@ -84,7 +84,7 @@ end
 
 Then /^I should have attachment columns for "([^"]*)"$/ do |attachment_name|
   cd(".") do
-    columns = eval(`bundle exec #{runner_command} "puts User.columns.map{ |column| [column.name, column.type] }.inspect"`.strip)
+    columns = eval(`bundle exec rails runner "puts User.columns.map{ |column| [column.name, column.type] }.inspect"`.strip)
     expect_columns = [
       ["#{attachment_name}_file_name", :string],
       ["#{attachment_name}_content_type", :string],
@@ -97,7 +97,7 @@ end
 
 Then /^I should not have attachment columns for "([^"]*)"$/ do |attachment_name|
   cd(".") do
-    columns = eval(`bundle exec #{runner_command} "puts User.columns.map{ |column| [column.name, column.type] }.inspect"`.strip)
+    columns = eval(`bundle exec rails runner "puts User.columns.map{ |column| [column.name, column.type] }.inspect"`.strip)
     expect_columns = [
       ["#{attachment_name}_file_name", :string],
       ["#{attachment_name}_content_type", :string],

data/features/step_definitions/rails_steps.rb

@@ -1,34 +1,33 @@
 Given /^I generate a new rails application$/ do
   steps %{
-    When I run `bundle exec #{new_application_command} #{APP_NAME} --skip-bundle`
+    When I successfully run `rails new #{APP_NAME} --skip-bundle`
     And I cd to "#{APP_NAME}"
+  }
+
+  FileUtils.chdir("tmp/aruba/testapp/")
+
+  steps %{
     And I turn off class caching
-    And I fix the application.rb for 3.0.12
     And I write to "Gemfile" with:
       """
       source "http://rubygems.org"
       gem "rails", "#{framework_version}"
-      gem "sqlite3", "1.3.8", :platform => [:ruby, :rbx]
+      gem "sqlite3", :platform => [:ruby, :rbx]
       gem "activerecord-jdbcsqlite3-adapter", :platform => :jruby
       gem "jruby-openssl", :platform => :jruby
       gem "capybara"
       gem "gherkin"
-      gem "aws-sdk"
+      gem "aws-sdk", "~> 2.0.0"
       gem "racc", :platform => :rbx
       gem "rubysl", :platform => :rbx
       """
     And I remove turbolinks
+    And I comment out lines that contain "action_mailer" in "config/environments/*.rb"
     And I empty the application.js file
     And I configure the application to use "paperclip" from this project
   }
-end
 
-Given "I fix the application.rb for 3.0.12" do
-  cd(".") do
-    File.open("config/application.rb", "a") do |f|
-      f << "ActionController::Base.config.relative_url_root = ''"
-    end
-  end
+  FileUtils.chdir("../../..")
 end
 
 Given "I allow the attachment to be submitted" do
@@ -51,6 +50,16 @@ Given "I remove turbolinks" do
   end
 end
 
+Given /^I comment out lines that contain "([^"]+)" in "([^"]+)"$/ do |contains, glob|
+  cd(".") do
+    Dir.glob(glob).each do |file|
+      transform_file(file) do |content|
+        content.gsub(/^(.*?#{contains}.*?)$/) { |line| "# #{line}" }
+      end
+    end
+  end
+end
+
 Given /^I attach :attachment$/ do
   attach_attachment("attachment")
 end
@@ -60,11 +69,7 @@ Given /^I attach :attachment with:$/ do |definition|
 end
 
 def attach_attachment(name, definition = nil)
-  snippet = ""
-  if using_protected_attributes?
-    snippet += "attr_accessible :name, :#{name}\n"
-  end
-  snippet += "has_attached_file :#{name}"
+  snippet = "has_attached_file :#{name}"
   if definition
     snippet += ", \n"
     snippet += definition
@@ -86,19 +91,19 @@ Given "I empty the application.js file" do
 end
 
 Given /^I run a rails generator to generate a "([^"]*)" scaffold with "([^"]*)"$/ do |model_name, attributes|
-  step %[I successfully run `bundle exec #{generator_command} scaffold #{model_name} #{attributes}`]
+  step %[I successfully run `rails generate scaffold #{model_name} #{attributes}`]
 end
 
 Given /^I run a paperclip generator to add a paperclip "([^"]*)" to the "([^"]*)" model$/ do |attachment_name, model_name|
-  step %[I successfully run `bundle exec #{generator_command} paperclip #{model_name} #{attachment_name}`]
+  step %[I successfully run `rails generate paperclip #{model_name} #{attachment_name}`]
 end
 
 Given /^I run a migration$/ do
-  step %[I successfully run `bundle exec rake db:migrate --trace`]
+  step %[I successfully run `rake db:migrate --trace`]
 end
 
 When /^I rollback a migration$/ do
-  step %[I successfully run `bundle exec rake db:rollback STEPS=1 --trace`]
+  step %[I successfully run `rake db:rollback STEPS=1 --trace`]
 end
 
 Given /^I update my new user view to include the file upload field$/ do
@@ -144,8 +149,10 @@ end
 
 Given /^I start the rails application$/ do
   cd(".") do
+    require "rails"
     require "./config/environment"
-    require "capybara/rails"
+    require "capybara"
+    Capybara.app = Rails.application
   end
 end
 
@@ -171,7 +178,7 @@ end
 
 When /^I configure the application to use "([^\"]+)" from this project$/ do |name|
   append_to_gemfile "gem '#{name}', :path => '#{PROJECT_ROOT}'"
-  steps %{And I run `bundle install --local`}
+  steps %{And I successfully run `bundle install --local`}
 end
 
 When /^I configure the application to use "([^\"]+)"$/ do |gem_name|