public
Description: El Dorado is a full-stack community web application written in Ruby/Rails.
Homepage: http://almosteffortless.com/eldorado/
Clone URL: git://github.com/trevorturk/el-dorado.git
denying index files from all upload types because they interfere with the 
index action

git-svn-id: http://eldorado.googlecode.com/svn/trunk@506 
9c008b19-a030-0410-9975-d76d301b4276
trevorturk (author)
Mon Nov 05 19:35:38 -0800 2007
commit  42bc3de5791930e278a63d6fbc40804fdd6d6df9
tree    7138d0e9d506aedcdbe574597c13cdb7283fd02e
parent  6b552507cac620f3a64691604eb2ee47525cbb6a
...
3
4
5
 
6
7
8
...
37
38
39
40
 
41
42
43
...
3
4
5
6
7
8
9
...
38
39
40
 
41
42
43
44
0
@@ -3,6 +3,7 @@ class ApplicationController < ActionController::Base
0
   around_filter :set_timezone
0
   before_filter :auth_token_login, :check_bans, :update_online_at, :get_options, :get_stats, :get_reminders
0
   helper_method :current_user, :logged_in?, :is_online?, :admin?, :can_edit?, :require_login, :require_admin, :redirect_home
0
+
0
   rescue_from ActiveRecord::RecordNotFound, :with => :record_not_found
0
   
0
   session :session_key => '_eldorado_session_id'
0
@@ -37,7 +38,7 @@ class ApplicationController < ActionController::Base
0
       redirect_to logout_path and return false
0
     end
0
   end
0
-
0
+
0
   def update_online_at
0
     return unless logged_in?
0
     session[:online_at] = current_user.online_at.utc if current_user.online_at.utc + 10.minutes < Time.now.utc
...
28
29
30
 
 
31
32
33
...
35
36
37
 
 
 
 
38
39
40
...
28
29
30
31
32
33
34
35
...
37
38
39
40
41
42
43
44
45
46
0
@@ -28,6 +28,8 @@ class Avatar < ActiveRecord::Base
0
   validates_uniqueness_of :filename
0
   validates_presence_of :user_id
0
   
0
+ before_create :reject_index_files
0
+
0
   attr_protected :id, :parent_id, :user_id, :created_at, :updated_at
0
   
0
   def full_filename(thumbnail = nil)
0
@@ -35,6 +37,10 @@ class Avatar < ActiveRecord::Base
0
     File.join(RAILS_ROOT, file_system_path, thumbnail_name_for(thumbnail))
0
   end
0
   
0
+ def reject_index_files
0
+ errors.add_to_base("Invalid file name") and return false if %w(index.html index.htm).include?(filename)
0
+ end
0
+
0
   def to_s
0
     filename.to_s
0
   end
...
28
29
30
 
 
31
32
33
34
35
36
37
 
 
 
 
 
38
39
40
...
28
29
30
31
32
33
34
35
36
37
38
 
39
40
41
42
43
44
45
46
0
@@ -28,13 +28,19 @@ class Header < ActiveRecord::Base
0
   validates_uniqueness_of :filename
0
   validates_presence_of :user_id
0
   
0
+ before_create :reject_index_files
0
+
0
   attr_protected :id, :parent_id, :user_id, :created_at, :updated_at
0
   
0
   def full_filename(thumbnail = nil)
0
     file_system_path = (thumbnail ? thumbnail_class : self).attachment_options[:path_prefix].to_s
0
     File.join(RAILS_ROOT, file_system_path, thumbnail_name_for(thumbnail))
0
   end
0
-
0
+
0
+ def reject_index_files
0
+ errors.add_to_base("Invalid file name") and return false if %w(index.html index.htm).include?(filename)
0
+ end
0
+
0
   def vote_up
0
     self.votes = self.votes + 1
0
     self.save!
...
26
27
28
 
 
29
30
31
...
33
34
35
 
 
 
 
36
37
38
...
26
27
28
29
30
31
32
33
...
35
36
37
38
39
40
41
42
43
44
0
@@ -26,6 +26,8 @@ class Theme < ActiveRecord::Base
0
   validates_uniqueness_of :filename
0
   validates_presence_of :user_id
0
   
0
+ before_create :reject_index_files
0
+
0
   attr_protected :id, :parent_id, :user_id, :created_at, :updated_at
0
   
0
   def full_filename(thumbnail = nil)
0
@@ -33,6 +35,10 @@ class Theme < ActiveRecord::Base
0
     File.join(RAILS_ROOT, file_system_path, thumbnail_name_for(thumbnail))
0
   end
0
   
0
+ def reject_index_files
0
+ errors.add_to_base("Invalid file name") and return false if %w(index.html index.htm).include?(filename)
0
+ end
0
+
0
   def to_s
0
     filename.to_s
0
   end
...
39
40
41
42
 
43
44
45
...
39
40
41
 
42
43
44
45
0
@@ -39,7 +39,7 @@ class Upload < ActiveRecord::Base
0
   def reject_index_files
0
     errors.add_to_base("Invalid file name") and return false if %w(index.html index.htm).include?(filename)
0
   end
0
-
0
+
0
   def to_s
0
     filename.to_s
0
   end

Comments

    No one has commented yet.