0
@@ -107,14 +107,4 @@ class MessagesController < ApplicationController
0
       render :text => 'You are not authorized to delete this message.', :status => 500
0
     end
0
   end
0
-  
0
-  def view_attachment
0
-    attachment = Attachment.find params[:id]
0
-    unless attachment.message and attachment.message.group and @logged_in.sees? attachment.message.group
0
-      render :text => 'You are not authorized to view this attachment.', :layout => true
0
-      return
0
-    end
0
-    # TODO: routes this file serve through regular web server
0
-    send_data File.read(attachment.file_path), :filename => attachment.name, :type => attachment.content_type, :disposition => 'inline'
0
-  end
0
 end

0
@@ -19,4 +19,9 @@ class Attachment < ActiveRecord::Base
0
   belongs_to :site
0
   acts_as_scoped_globally 'site_id', "(Site.current ? Site.current.id : 'site-not-set')"
0
   acts_as_file DB_ATTACHMENTS_PATH
0
+  
0
+  def visible_to?(person)
0
+    (message and person.can_see?(message)) or
0
+    (song and person.can_see?(song))
0
+  end
0
 end

0
@@ -226,9 +226,13 @@ class Person < ActiveRecord::Base
0
         not what.hidden? or self.member_of?(what) or what.admin?(self)
0
       elsif what.is_a? Message
0
         what.can_see?(self)
0
+      elsif what.is_a? Attachment
0
+        what.visible_to?(self)
0
       elsif what.is_a? PrayerRequest
0
         what.person == self or
0
           (what.group and (self.member_of?(what.group) or what.group.admin?(self)))
0
+      elsif what.is_a? Song
0
+        what.visible_to?(self)
0
       else
0
         raise 'unknown "what"'
0
       end

0
@@ -78,6 +78,10 @@ class Song < ActiveRecord::Base
0
     tags
0
   end
0
   
0
+  def visible_to?(person)
0
+    person.music_access? or person.admin?(:manage_music)
0
+  end
0
+  
0
   class << self
0
     def search(query)
0
       req = Amazon::Search::Request.new(Setting.get(:services, :amazon))

0
@@ -2,8 +2,8 @@
0
   <p>
0
     <strong>Attachments:</strong><br/>
0
     <% message.attachments.each do |attachment| %>
0
-      <%= link_to image_tag('attachment.gif', :alt => 'Attachment', :class => 'icon'), view_message_attachment_path(attachment) %>
0
-      <%= link_to attachment.name, view_message_attachment_path(attachment) %>
0
+      <%= link_to image_tag('attachment.gif', :alt => 'Attachment', :class => 'icon'), attachment %>
0
+      <%= link_to attachment.name, attachment %>
0
       (<%= number_to_human_size attachment.file_size %>)
0
       <br/>
0
     <% end %>

0
@@ -1,8 +1,11 @@
0
 ActionController::Routing::Routes.draw do |map|
0
 
0
+  map.resource :feed
0
+  
0
   map.resources :blogs
0
   map.resources :walls
0
-  map.resource :feed
0
+  map.resources :messages
0
+  map.resources :attachments
0
   
0
   map.with_options :controller => 'setup/dashboard' do |m|
0
     m.setup 'setup', :action => 'index'
0
@@ -268,13 +271,6 @@ ActionController::Routing::Routes.draw do |map|
0
     m.news_item 'news/view/:id', :action => 'view'
0
   end
0
   
0
-  map.resources :messages
0
-  
0
-  # TODO: Remove this as we refactor MessagesController to be fully RESTful
0
-  map.with_options :controller => 'messages' do |m|
0
-    m.view_message_attachment 'messages/:id/view_attachment', :action => 'view_attachment'
0
-  end
0
-  
0
   map.with_options :controller => 'pictures' do |m|
0
     m.pictures 'pictures', :action => 'index'
0
     m.picture 'pictures/view/:id', :action => 'view', :requirements => { :id => /.*/ }