aboutsummaryrefslogtreecommitdiffstats
path: root/activestorage/app/controllers/active_storage/variants_controller.rb
diff options
context:
space:
mode:
authorDavid Heinemeier Hansson <david@loudthinking.com>2017-08-04 18:05:13 -0500
committerGitHub <noreply@github.com>2017-08-04 18:05:13 -0500
commit552840660389e39f3ba8e47dcf35ab817c01cb48 (patch)
tree5013b2d5a1691ac1f675935eea38848639ac54bc /activestorage/app/controllers/active_storage/variants_controller.rb
parent978b3d604ab082ac0be071245646b0803b8ff382 (diff)
parent3179f089be4f631b9c0f8b431567992164f2bdb4 (diff)
downloadrails-552840660389e39f3ba8e47dcf35ab817c01cb48.tar.gz
rails-552840660389e39f3ba8e47dcf35ab817c01cb48.tar.bz2
rails-552840660389e39f3ba8e47dcf35ab817c01cb48.zip
Merge pull request #30020 from rails/active-storage-import
Add Active Storage to Rails
Diffstat (limited to 'activestorage/app/controllers/active_storage/variants_controller.rb')
-rw-r--r--activestorage/app/controllers/active_storage/variants_controller.rb26
1 files changed, 26 insertions, 0 deletions
diff --git a/activestorage/app/controllers/active_storage/variants_controller.rb b/activestorage/app/controllers/active_storage/variants_controller.rb
new file mode 100644
index 0000000000..994c57aafd
--- /dev/null
+++ b/activestorage/app/controllers/active_storage/variants_controller.rb
@@ -0,0 +1,26 @@
+# Take a signed permanent reference for a variant and turn it into an expiring service URL for download.
+# Note: These URLs are publicly accessible. If you need to enforce access protection beyond the
+# security-through-obscurity factor of the signed blob and variation reference, you'll need to implement your own
+# authenticated redirection controller.
+class ActiveStorage::VariantsController < ActionController::Base
+ def show
+ if blob = find_signed_blob
+ redirect_to ActiveStorage::Variant.new(blob, decoded_variation).processed.service_url(disposition: disposition_param)
+ else
+ head :not_found
+ end
+ end
+
+ private
+ def find_signed_blob
+ ActiveStorage::Blob.find_signed(params[:signed_blob_id])
+ end
+
+ def decoded_variation
+ ActiveStorage::Variation.decode(params[:variation_key])
+ end
+
+ def disposition_param
+ params[:disposition].presence_in(%w( inline attachment )) || "inline"
+ end
+end