From 7d5f86f6cbd187e75a6ba164ad6bfd036977dd07 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Hannes=20Rosen=C3=B6gger?= Date: Mon, 9 Feb 2015 14:35:48 +0100 Subject: Fix broken access control and refactor avatar upload This commit moves the note folder from /public/uploads/note to /uploads/note and changes the uploader accordingly. Now it's no longer possible to avoid the access control by modifing the url. The Avatar upload has been refactored to use an own uploader as well to cleanly seperate the two upload types. --- db/migrate/20150213111727_move_note_folder.rb | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 db/migrate/20150213111727_move_note_folder.rb (limited to 'db/migrate') diff --git a/db/migrate/20150213111727_move_note_folder.rb b/db/migrate/20150213111727_move_note_folder.rb new file mode 100644 index 00000000000..ca7f87d984f --- /dev/null +++ b/db/migrate/20150213111727_move_note_folder.rb @@ -0,0 +1,19 @@ +class MoveNoteFolder < ActiveRecord::Migration + def up + system( + "if [ -d '#{Rails.root}/public/uploads/note' ]; + then mv #{Rails.root}/public/uploads/note #{Rails.root}/uploads/note; + echo 'note folder has been moved successfully'; + else + echo 'note folder has already been moved or does not exist yet. Nothing to do here.'; fi") + end + + def down + system( + "if [ -d '#{Rails.root}/uploads/note' ]; + then mv #{Rails.root}/uploads/note #{Rails.root}/public/uploads/note; + echo 'note folder has been moved successfully'; + else + echo 'note folder has already been moved or does not exist yet. Nothing to do here.'; fi") + end +end -- cgit v1.2.3