Discourse/discourse
Discourse/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-09-07 12:02:53 +08:00
Code Packages Activity Actions 5

add server-side filesize check on uploads

Browse source
This commit is contained in:
Régis Hanol 2013-07-24 00:54:18 +02:00
parent 75491d2cf6
commit be9217d4c8
34 changed files with 114 additions and 97 deletions
Download patch file Download diff file Expand all files Collapse all files

15
app/controllers/uploads_controller.rb
View file

@ -4,21 +4,28 @@ class UploadsController < ApplicationController
def create
file = params[:file] || params[:files].first
# check if the extension is allowed
unless SiteSetting.authorized_upload?(file)
text = I18n.t("upload.unauthorized", authorized_extensions: SiteSetting.authorized_extensions.gsub("|", ", "))
return render status: 415, text: text
end
upload = Upload.create_for(current_user.id, file)
# check the file size (note: this might also be done in the web server)
filesize = File.size(file.tempfile)
type = SiteSetting.authorized_image?(file) ? "image" : "attachment"
max_size_kb = SiteSetting.send("max_#{type}_size_kb") * 1024
return render status: 413, text: I18n.t("upload.#{type}s.too_large", max_size_kb: max_size_kb) if filesize > max_size_kb
upload = Upload.create_for(current_user.id, file, filesize)
render_serialized(upload, UploadSerializer, root: false)
rescue FastImage::ImageFetchFailure
render status: 422, text: I18n.t("upload.image.fetch_failure")
render status: 422, text: I18n.t("upload.images.fetch_failure")
rescue FastImage::UnknownImageType
render status: 422, text: I18n.t("upload.image.unknown_image_type")
render status: 422, text: I18n.t("upload.images.unknown_image_type")
rescue FastImage::SizeNotFound
render status: 422, text: I18n.t("upload.image.size_not_found")
render status: 422, text: I18n.t("upload.images.size_not_found")
end
end