scinote-eln/scinote-web
1
1
Fork 0
mirror of https://github.com/scinote-eln/scinote-web.git synced 2025-10-30 07:58:28 +08:00
Code Issues Projects Releases Packages Wiki Activity

Add gem Down, File size validation before and during download

Browse source
This commit is contained in:
Urban Rotnik 2019-11-13 13:45:30 +01:00
parent 413100778f
commit 0dc1daa7c6
3 changed files with 10 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
Gemfile
View file

@ -62,6 +62,7 @@ gem 'bcrypt', '~> 3.1.10'
gem 'caracal-rails' # Build docx report gem 'caracal-rails' # Build docx report
gem 'commit_param_routing' # Enables different submit actions in the same form gem 'commit_param_routing' # Enables different submit actions in the same form
gem 'deface', '~> 1.0' gem 'deface', '~> 1.0'
gem 'down', '~> 5.0'
gem 'faker' # Generate fake data gem 'faker' # Generate fake data
gem 'fastimage' # Light gem to get image resolution gem 'fastimage' # Light gem to get image resolution
gem 'httparty', '~> 0.13.1' gem 'httparty', '~> 0.13.1'

3
Gemfile.lock
View file

@ -240,6 +240,8 @@ GEM
docile (1.3.2) docile (1.3.2)
doorkeeper (5.1.0) doorkeeper (5.1.0)
railties (>= 5) railties (>= 5)
down (5.0.0)
addressable (~> 2.5)
erubi (1.8.0) erubi (1.8.0)
et-orbi (1.2.2) et-orbi (1.2.2)
tzinfo tzinfo
@ -620,6 +622,7 @@ DEPENDENCIES
devise_invitable devise_invitable
discard (~> 1.0) discard (~> 1.0)
doorkeeper (>= 4.6) doorkeeper (>= 4.6)
down (~> 5.0)
factory_bot_rails factory_bot_rails
faker faker
fastimage fastimage

9
app/models/concerns/tiny_mce_images.rb
View file

@ -95,13 +95,16 @@ module TinyMceImages
next if asset && (asset.object == self || asset_team_id != asset.team_id) next if asset && (asset.object == self || asset_team_id != asset.team_id)
else else
# We need implement size and type checks here
url = image['src'] url = image['src']
image_type = FastImage.type(url).to_s image_type = FastImage.type(url).to_s
next unless image_type next unless image_type
new_image = URI.parse(url).open begin
next if new_image.size > Rails.configuration.x.file_max_size_mb.megabytes new_image = Down.download(url, max_size: Rails.configuration.x.file_max_size_mb.megabytes)
rescue Down::TooLarge => e
Rails.logger.error e.message
next
end
new_image_filename = Asset.generate_unique_secure_token + '.' + image_type new_image_filename = Asset.generate_unique_secure_token + '.' + image_type
end end