Defect #34367 ยป 0001-Validate-attachment-filenames-on-every-change.patch
| app/models/attachment.rb | ||
|---|---|---|
| 30 | 30 |
validates_length_of :filename, :maximum => 255 |
| 31 | 31 |
validates_length_of :disk_filename, :maximum => 255 |
| 32 | 32 |
validates_length_of :description, :maximum => 255 |
| 33 |
validate :validate_max_file_size, :validate_file_extension |
|
| 33 |
validate :validate_max_file_size |
|
| 34 |
validate :validate_file_extension, :if => :filename_changed? |
|
| 34 | 35 | |
| 35 | 36 |
acts_as_event( |
| 36 | 37 |
:title => :filename, |
| ... | ... | |
| 91 | 92 |
end |
| 92 | 93 | |
| 93 | 94 |
def validate_file_extension |
| 94 |
if @temp_file |
|
| 95 |
extension = File.extname(filename) |
|
| 96 |
unless self.class.valid_extension?(extension) |
|
| 97 |
errors.add(:base, l(:error_attachment_extension_not_allowed, :extension => extension)) |
|
| 98 |
end |
|
| 95 |
extension = File.extname(filename) |
|
| 96 |
unless self.class.valid_extension?(extension) |
|
| 97 |
errors.add(:base, l(:error_attachment_extension_not_allowed, :extension => extension)) |
|
| 99 | 98 |
end |
| 100 | 99 |
end |
| 101 | 100 | |
| lib/plugins/acts_as_attachable/lib/acts_as_attachable.rb | ||
|---|---|---|
| 107 | 107 |
end |
| 108 | 108 |
next unless a |
| 109 | 109 |
a.description = attachment['description'].to_s.strip |
| 110 |
if a.new_record? |
|
| 110 |
if a.new_record? || a.invalid?
|
|
| 111 | 111 |
unsaved_attachments << a |
| 112 | 112 |
else |
| 113 | 113 |
saved_attachments << a |
| test/unit/attachment_test.rb | ||
|---|---|---|
| 152 | 152 |
end |
| 153 | 153 |
end |
| 154 | 154 | |
| 155 |
def test_extension_update_should_be_validated_against_denied_extensions |
|
| 156 |
with_settings :attachment_extensions_denied => "txt, png" do |
|
| 157 |
a = Attachment.new(:container => Issue.find(1), |
|
| 158 |
:file => mock_file_with_options(:original_filename => "test.jpeg"), |
|
| 159 |
:author => User.find(1)) |
|
| 160 |
assert_save a |
|
| 161 | ||
| 162 |
b = Attachment.find(a.id) |
|
| 163 |
b.filename = "test.png" |
|
| 164 |
assert !b.save |
|
| 165 |
end |
|
| 166 |
end |
|
| 167 | ||
| 155 | 168 |
def test_valid_extension_should_be_case_insensitive |
| 156 | 169 |
with_settings :attachment_extensions_allowed => "txt, Png" do |
| 157 | 170 |
assert Attachment.valid_extension?(".pnG")
|