Merge 1096dbf into 698554d

.gitignore

@@ -89,7 +89,6 @@ Gemfile.lock
 
 # Local Gemfile for developing without sharing dependencies
 .gemfile
-*.txt
 
 *.orig
 

resources/app/models/refinery/resource.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'dragonfly'
 
 module Refinery
@@ -7,33 +9,37 @@ class Resource < Refinery::Core::BaseModel
     extend Mobility
     translates :resource_title
 
-    dragonfly_accessor :file, :app => :refinery_resources
+    dragonfly_accessor :file, app: :refinery_resources
 
-    validates :file, :presence => true
+    validates :file, presence: true
     validates_with FileSizeValidator
+    validates_property :mime_type,
+                       of: :file,
+                       in: ::Refinery::Resources.whitelisted_mime_types,
+                       message: :incorrect_format
 
-    delegate :ext, :size, :mime_type, :url, :to => :file
+    delegate :ext, :size, :mime_type, :url, to: :file
 
-    before_destroy :cached_mime_type, :prepend => true
+    before_destroy :cached_mime_type, prepend: true
 
     def cached_mime_type
       @cached_mime_type ||= mime_type
     end
 
     # used for searching
     def type_of_content
-      cached_mime_type.split("/").join(" ")
+      cached_mime_type.split('/').join(' ')
     end
 
     # Returns a titleized version of the filename
     # my_file.pdf returns My File
     def title
-      resource_title.presence || CGI::unescape(file_name.to_s).gsub(/\.\w+$/, '').titleize
+      resource_title.presence || CGI.unescape(file_name.to_s).gsub(/\.\w+$/, '').titleize
     end
 
     def update_index
-      return if self.aai_config.disable_auto_indexing
-      copy = self.dup.tap{ |r| r.file_uid = r.file_uid_was}
+      return if aai_config.disable_auto_indexing
+      copy = dup.tap { |r| r.file_uid = r.file_uid_was }
       self.class.index_remove(copy)
       self.class.index_add(self)
     end
@@ -47,9 +53,9 @@ def per_page(dialog = false)
       def create_resources(params)
         resources = []
 
-        if params.present? and params[:file].is_a?(Array)
+        if params.present? && params[:file].is_a?(Array)
           params[:file].each do |resource|
-            resources << create({:file => resource}.merge(params.except(:file).to_h))
+            resources << create({ file: resource }.merge(params.except(:file).to_h))
           end
         else
           resources << create(params)

resources/config/locales/en.yml

@@ -36,4 +36,5 @@ en:
       models:
         refinery/resource:
           blank: You must specify file for upload
+          incorrect_format: Your file must be a PDF
           too_big: File should be smaller than %{size} bytes in size

resources/config/locales/fr.yml

@@ -36,4 +36,5 @@ fr:
       models:
         refinery/resource:
           blank: Vous devez spécifier un fichier à télécharger
+          incorrect_format: Votre fichier doit être un PDF
           too_big: Le poids maximal des fichiers est de %{size} megaoctets

resources/lib/generators/refinery/resources/templates/config/initializers/refinery/resources.rb.erb

@@ -9,6 +9,9 @@ Refinery::Resources.configure do |config|
   # Configure how many resources per page should be displayed in the list of resources in the admin area
   # config.pages_per_admin_index = <%= Refinery::Resources.pages_per_admin_index.inspect %>
 
+  # Configure white-listed mime types for validation
+  # config.whitelisted_mime_types = <%= Refinery::Resources.whitelisted_mime_types.inspect %>
+
   # Configure Dragonfly.
   # Refer to config/initializers/refinery/dragonfly.rb for the full list of dragonfly configurations which can be used.
   # This includes all dragonfly config for Dragonfly v 1.1.1

resources/lib/refinery/resources/configuration.rb

@@ -1,10 +1,12 @@
+# frozen_string_literal: true
+
 module Refinery
   module Resources
-
     extend Refinery::Dragonfly::ExtensionConfiguration
     include ActiveSupport::Configurable
 
-    config_accessor :max_file_size, :pages_per_dialog, :pages_per_admin_index, :content_disposition
+    config_accessor :max_file_size, :pages_per_dialog, :pages_per_admin_index,
+                    :content_disposition, :whitelisted_mime_types
 
     self.content_disposition = :attachment
     self.max_file_size = 52_428_800
@@ -13,6 +15,6 @@ module Resources
 
     self.dragonfly_name = :refinery_resources
 
+    self.whitelisted_mime_types = %w[application/pdf]
   end
-end
-
+end

resources/spec/factories/resource.rb

@@ -1,5 +1,7 @@
+# frozen_string_literal: true
+
 FactoryBot.define do
-  factory :resource, :class => Refinery::Resource do
-    file Refinery.roots('refinery/resources').join("spec/fixtures/refinery_is_awesome.txt")
+  factory :resource, class: Refinery::Resource do
+    file Refinery.roots('refinery/resources').join('spec/fixtures/cape-town-tide-table.pdf')
   end
 end

resources/spec/features/refinery/admin/resources_spec.rb

@@ -1,170 +1,188 @@
-# Encoding: UTF-8
-require "spec_helper"
+# frozen_string_literal: true
+
+require 'spec_helper'
 
 module Refinery
   module Admin
-    describe "Resources", :type => :feature do
+    describe 'Resources', type: :feature do
       refinery_login
 
-      context "when no files" do
-        it "invites to upload file" do
+      context 'when no files' do
+        it 'invites to upload file' do
           visit refinery.admin_resources_path
-          expect(page).to have_content(%q{There are no files yet. Click "Upload new file" to add your first file.})
+          expect(page).to have_content('There are no files yet. Click "Upload new file" to add your first file.')
         end
       end
 
-      it "shows upload file link" do
+      it 'shows upload file link' do
         visit refinery.admin_resources_path
-        expect(page).to have_content("Upload new file")
-        expect(page).to have_selector("a[href*='/refinery/resources/new']")
+        expect(page).to have_content('Upload new file')
+        expect(page).to have_selector('a[href*="/refinery/resources/new"]')
       end
 
-      context "new/create" do
-        it "uploads file", :js => true do
-          visit refinery.admin_resources_path
-          find('a', text: 'Upload new file').click
+      context 'new/create' do
+        let(:uploading_a_file) do
+          lambda do
+            visit refinery.admin_resources_path
+            find('a', text: 'Upload new file').click
 
-          expect(page).to have_selector 'iframe#dialog_iframe'
+            expect(page).to have_selector 'iframe#dialog_iframe'
 
-          page.within_frame('dialog_iframe') do
-            attach_file "resource_file", Refinery.roots('refinery/resources').
-                                                  join("spec/fixtures/refinery_is_awesome.txt")
-            click_button ::I18n.t('save', :scope => 'refinery.admin.form_actions')
+            page.within_frame('dialog_iframe') do
+              attach_file 'resource_file', file_path
+              click_button ::I18n.t('save', scope: 'refinery.admin.form_actions')
+            end
           end
+        end
 
-          expect(page).to have_content("Refinery Is Awesome")
-          expect(Refinery::Resource.count).to eq(1)
+        context 'when the file mime_type is acceptable' do
+          let(:file_path) { Refinery.roots('refinery/resources').join('spec/fixtures/cape-town-tide-table.pdf') }
+
+          it 'the file is uploaded', js: true do
+            expect(uploading_a_file).to change(Refinery::Resource, :count).by(1)
+          end
         end
 
-        describe "max file size" do
+        context 'when the file mime_type is not acceptable' do
+          let(:file_path) { Refinery.roots('refinery/resources').join('spec/fixtures/refinery_is_secure.txt') }
+
+          it 'the file is rejected', js: true do
+            expect(uploading_a_file).to_not change(Refinery::Resource, :count)
+
+            page.within_frame('dialog_iframe') do
+              expect(page).to have_content(::I18n.t('incorrect_format', scope: 'activerecord.errors.models.refinery/resource'))
+            end
+          end
+        end
+
+        describe 'max file size' do
           before do
             allow(Refinery::Resources).to receive(:max_file_size).and_return('1224')
           end
 
-          context "in english" do
+          context 'in english' do
             before do
               allow(Refinery::I18n).to receive(:current_locale).and_return(:en)
             end
 
-            it "is shown" do
+            it 'is shown' do
               visit refinery.admin_resources_path
-              click_link "Upload new file"
+              click_link 'Upload new file'
 
               within('#file') do
-                expect(page).to have_selector("a[tooltip='The maximum file size is 1.2 KB.']")
+                expect(page).to have_selector('a[tooltip="The maximum file size is 1.2 KB."]')
               end
             end
           end
 
-          context "in danish" do
+          context 'in danish' do
             before do
               allow(Refinery::I18n).to receive(:current_locale).and_return(:da)
             end
 
-            it "is shown" do
+            it 'is shown' do
               visit refinery.admin_resources_path
 
-              click_link "Tilføj en ny fil"
-              within "#file" do
-                expect(page).to have_selector("a[tooltip='Filen må maksimalt fylde 1,2 KB.']")
+              click_link 'Tilføj en ny fil'
+              within '#file' do
+                expect(page).to have_selector('a[tooltip="Filen må maksimalt fylde 1,2 KB."]')
               end
             end
           end
         end
       end
 
-      context "edit/update" do
+      context 'edit/update' do
         let!(:resource) { FactoryBot.create(:resource) }
 
-        it "updates file" do
+        it 'updates file' do
           visit refinery.admin_resources_path
-          expect(page).to have_content("Refinery Is Awesome")
+          expect(page).to have_content('Cape Town Tide Table')
           expect(page).to have_selector("a[href='/refinery/resources/#{resource.id}/edit']")
 
-          click_link "Edit this file"
+          click_link 'Edit this file'
 
-          expect(page).to have_content("Refinery Is Awesome or replace it with this one...")
+          expect(page).to have_content('Cape Town Tide Table or replace it with this one...')
           expect(page).to have_selector("a[href*='/refinery/resources']")
 
-          attach_file "resource_file", Refinery.roots('refinery/resources').join("spec/fixtures/refinery_is_awesome2.txt")
-          click_button "Save"
+          attach_file 'resource_file', Refinery.roots('refinery/resources').join('spec/fixtures/cape-town-tide-table2.pdf')
+          click_button 'Save'
 
-          expect(page).to have_content("Refinery Is Awesome2")
+          expect(page).to have_content('Cape Town Tide Table2')
           expect(Refinery::Resource.count).to eq(1)
         end
 
-        describe "translate" do
+        describe 'translate' do
           before do
-            allow(Refinery::I18n).to receive(:frontend_locales).and_return([:en, :fr])
+            allow(Refinery::I18n).to receive(:frontend_locales).and_return(%i[en fr])
           end
 
-          it "can have a second locale added to it" do
+          it 'can have a second locale added to it' do
             visit refinery.admin_resources_path
-            expect(page).to have_content("Refinery Is Awesome")
+            expect(page).to have_content('Cape Town Tide Table')
             expect(page).to have_selector("a[href='/refinery/resources/#{resource.id}/edit']")
 
-            click_link "Edit this file"
+            click_link 'Edit this file'
 
-            within "#switch_locale_picker" do
-              click_link "FR"
+            within '#switch_locale_picker' do
+              click_link 'FR'
             end
 
-            fill_in "Title", :with => "Premier fichier"
-            click_button "Save"
+            fill_in 'Title', with: 'Premier fichier'
+            click_button 'Save'
 
             expect(page).to have_content("'Premier fichier' was successfully updated.")
             expect(Resource::Translation.count).to eq(1)
           end
         end
       end
 
-      context "destroy" do
+      context 'destroy' do
         let!(:resource) { FactoryBot.create(:resource) }
 
-        it "removes file" do
+        it 'removes file' do
           visit refinery.admin_resources_path
           expect(page).to have_selector("a[href='/refinery/resources/#{resource.id}']")
 
-          click_link "Remove this file forever"
+          click_link 'Remove this file forever'
 
-          expect(page).to have_content("'Refinery Is Awesome' was successfully removed.")
+          expect(page).to have_content("'Cape Town Tide Table' was successfully removed.")
           expect(Refinery::Resource.count).to eq(0)
         end
       end
 
-      context "download" do
+      context 'download' do
         let!(:resource) { FactoryBot.create(:resource) }
 
-        it "succeeds" do
+        it 'succeeds' do
           visit refinery.admin_resources_path
 
-          click_link "Download this file"
+          click_link 'Download this file'
 
-          expect(page).to have_content("http://www.refineryhq.com/")
+          expect(page.body[0, 4]).to eq('%PDF')
         end
 
         context 'when the extension is mounted with a named space' do
           before do
             Rails.application.routes.draw do
-              mount Refinery::Core::Engine, :at => "/about"
+              mount Refinery::Core::Engine, at: '/about'
             end
             Rails.application.routes_reloader.reload!
           end
 
           after do
             Rails.application.routes.draw do
-              mount Refinery::Core::Engine, :at => "/"
+              mount Refinery::Core::Engine, at: '/'
             end
           end
 
-          it "succeeds" do
+          it 'succeeds' do
             visit refinery.admin_resources_path
 
-            click_link "Download this file"
+            click_link 'Download this file'
 
-            expect(page).to have_content("http://www.refineryhq.com/")
+            expect(page.body[0, 4]).to eq('%PDF')
           end
-
         end
       end
     end