0001-Defect-44358-Fix-images-in-markdownized-previews.patch - Redmine

     class AttachmentsController < ApplicationController
       include ActionView::Helpers::NumberHelper
       before_action :find_attachment, :only => [:show, :download, :thumbnail, :update, :destroy]
       before_action :find_attachment, :only => [:show, :download, :thumbnail, :update, :destroy, :preview_media]
       before_action :find_container, :only => [:edit_all, :update_all, :download_all]
       before_action :find_downloadable_attachments, :only => :download_all
       before_action :find_editable_attachments, :only => [:edit_all, :update_all]
       before_action :file_readable, :read_authorize, :only => [:show, :download, :thumbnail]
       before_action :file_readable, :read_authorize, :only => [:show, :download, :thumbnail, :preview_media]
       before_action :update_authorize, :only => :update
       before_action :delete_authorize, :only => :destroy
       before_action :authorize_global, :only => :upload
-...
       # MIME type text/javascript.
       skip_after_action :verify_same_origin_request, :only => :download
       accept_api_auth :show, :download, :thumbnail, :upload, :update, :destroy
       accept_api_auth :show, :download, :thumbnail, :upload, :update, :destroy, :preview_media
       def show
         respond_to do |format|
-...
         end
       end
       def preview_media
         if (media = @attachment.preview_media(params[:path]))
           if stale?(etag: media, template: false)
             send_file(media,
               :type => Redmine::MimeType.of(media).presence || 'application/octet-stream',
               :filename => "preview_#{@attachment.id}_#{File.basename(media)}",
               :disposition => 'inline')
           end
         else
           head :not_found
         end
       end
       def upload
         # Make sure that API users get used to set this content type
         # as it won't trigger Rails' automatic parsing of the request body for parameters

       end
       def self.clear_markdownized_previews
         Dir.glob(File.join(markdownized_previews_storage_path, "*.md")).each do |file|
           File.delete file
         end
         FileUtils.rm_rf(Dir.glob(File.join(markdownized_previews_storage_path, '*')))
       end
       def is_text?
-...
         return nil unless markdownized_previewable?
         target = markdownized_preview_cache_path
         if Redmine::Markdownizer.convert(diskfile, target)
         if Redmine::Markdownizer.convert(diskfile, target, id)
           File.read(target, :mode => "rb")
         end
       rescue => e
-...
         nil
       end
       def preview_media(path)
         base_path = File.expand_path(File.join(self.class.markdownized_previews_storage_path, id.to_s))
         file_path = File.expand_path(path, base_path)
         return nil unless file_path.start_with?(base_path)
         return nil unless File.file?(file_path)
         file_path
       end
       def markdownized_preview_directory
         File.join(self.class.markdownized_previews_storage_path, id.to_s)
       end
       def markdownized_preview_cache_path
         File.join(self.class.markdownized_previews_storage_path, "#{digest}_#{filesize}.md")
         File.join(markdownized_preview_directory, "preview.md")
       end
       def previewable?
-...
         Dir[thumbnail_path("*")].each do |thumb|
           File.delete(thumb)
         end
         FileUtils.rm_f(markdownized_preview_cache_path)
         FileUtils.rm_rf(markdownized_preview_directory)
       end
       def thumbnail_path(size)

config/routes.rb
328	328	get 'attachments/download/:id/:filename', :to => 'attachments#download', :id => /\d+/, :filename => /.*/, :as => 'download_named_attachment', :format => 'html'
329	329	get 'attachments/download/:id', :to => 'attachments#download', :id => /\d+/
330	330	get 'attachments/thumbnail/:id(/:size)', :to => 'attachments#thumbnail', :id => /\d+/, :size => /\d+/, :as => 'thumbnail'
	331	get 'attachments/markdownized_previews/:id/*path', :to => 'attachments#preview_media', :id => /\d+/, :format => false
331	332	resources :attachments, :only => [:show, :update, :destroy]
332	333
333	334	# register plugin object types with ObjectTypeConstraint.register_object_type(PluginModel.name.underscore.pluralize')

           markdownizable_extensions.include?(File.extname(filename.to_s).downcase)
         end
         def self.convert(source, target)
         def self.convert(source, target, attachment_id)
           return nil unless available?
           return target if File.exist?(target)
-...
           end
           directory = File.dirname(target)
           basedir = File.dirname(Attachment.markdownized_previews_storage_path)
           FileUtils.mkdir_p(directory)
           args = [COMMAND, source, "-t", "gfm"]
           args = [COMMAND, source, "-t", "gfm", "--extract-media=markdownized_previews/#{attachment_id}/"]
           pid = nil
           output = Tempfile.new('markdownized-preview')
           begin
             Timeout.timeout(PREVIEW_GENERATION_TIMEOUT) do
               pid = Process.spawn(*args, out: output.path)
               pid = Process.spawn(*args, chdir: basedir, out: output.path)
               _, status = Process.wait2(pid)
               unless status.success?
                 logger.error("Markdownized preview generation failed (#{status.exitstatus}):\nCommand: #{args.shelljoin}")

         assert_equal 'text/html', @response.media_type
         assert_select 'div.filecontent.wiki', :text => /Redmine is a flexible project management web application/
         assert_select '.nodata', :count => 0
         assert_select 'div.filecontent.wiki img', 1
         img = css_select('div.filecontent.wiki img').first
         assert_match(%r{markdownized_previews/#{a.id}/}, img['src'])
         path = img['src'][%r{markdownized_previews/#{a.id}/(.+)$}, 1]
         get(:preview_media, :params => {:id => a.id, :path => path})
         assert_response :success
         assert_equal 'image/png', response.media_type
       end
       def test_show_libreoffice_writer
-...
         assert_equal 'text/html', @response.media_type
         assert_select 'div.filecontent.wiki', :text => /Redmine is a flexible project management web application/
         assert_select '.nodata', :count => 0
         assert_select 'div.filecontent.wiki img', 1
         img = css_select('div.filecontent.wiki img').first
         assert_match(%r{markdownized_previews/#{a.id}/}, img['src'])
         path = img['src'][%r{markdownized_previews/#{a.id}/(.+)$}, 1]
         get(:preview_media, :params => {:id => a.id, :path => path})
         assert_response :success
         assert_equal 'image/png', response.media_type
       end
       def test_preview_media_from_private_issue_without_permission
         attachment = Attachment.find(15)
         FileUtils.mkdir_p(File.join(attachment.markdownized_preview_directory, 'Pictures'))
         File.binwrite(File.join(attachment.markdownized_preview_directory, 'Pictures', 'image.png'), 'PNG')
         get(:preview_media, :params => {:id => attachment.id, :path => 'Pictures/image.png'})
         assert_response :unauthorized
       end
       def test_preview_media_from_private_issue_with_permission
         @request.session[:user_id] = 2
         attachment = Attachment.find(15)
         FileUtils.mkdir_p(File.join(attachment.markdownized_preview_directory, 'Pictures'))
         File.binwrite(File.join(attachment.markdownized_preview_directory, 'Pictures', 'image.png'), 'PNG')
         get(:preview_media, :params => {:id => attachment.id, :path => 'Pictures/image.png'})
         assert_response :success
         assert_equal 'image/png', response.media_type
       end
       def test_preview_media_should_be_denied_without_permission
         @request.session[:user_id] = 3
         attachment = Attachment.find(15)
         FileUtils.mkdir_p(File.join(attachment.markdownized_preview_directory, 'Pictures'))
         File.binwrite(File.join(attachment.markdownized_preview_directory, 'Pictures', 'image.png'), 'PNG')
         get(:preview_media, :params => {:id => attachment.id, :path => 'Pictures/image.png'})
         assert_response :forbidden
       end
       def test_preview_media_should_return_404_for_missing_file
         @request.session[:user_id] = 2
         get(:preview_media, :params => {:id => 16, :path => 'media/missing.png'})
         assert_response :not_found
       end
       def test_preview_media_should_return_404_for_invalid_path
         @request.session[:user_id] = 2
         get(:preview_media, :params => {:id => 16, :path => '../secret.txt'})
         assert_response :not_found
       end
       def test_show_other_with_no_preview

         should_route 'GET /attachments/thumbnail/1' => 'attachments#thumbnail', :id => '1'
         should_route 'GET /attachments/thumbnail/1/200' => 'attachments#thumbnail', :id => '1', :size => '200'
         should_route 'GET /attachments/markdownized_previews/1/pictures/image.png' => 'attachments#preview_media', :id => '1', :path => 'pictures/image.png'
         should_route 'DELETE /attachments/1' => 'attachments#destroy', :id => '1'
         should_route 'GET /attachments/issues/1/edit' => 'attachments#edit_all', :object_type => 'issues', :object_id => '1'

           ),
           :author => User.find(1)
+        )
         preview = attachment.markdownized_preview_cache_path
         FileUtils.mkdir_p(File.dirname(preview))
         File.write(preview, "preview")
         assert File.exist?(preview)
         preview_dir = attachment.markdownized_preview_directory
         attachment.markdownized_preview_content
         assert Dir.exist?(preview_dir)
         attachment.send(:delete_from_disk!)
         assert_not File.exist?(preview)
         assert_not Dir.exist?(preview_dir)
       end
       if convert_installed?

Project

General

Profile

Redmine

Defect #44358 » 0001-Defect-44358-Fix-images-in-markdownized-previews.patch