From c9b46e4e3a394404411d6c8bb47fa80d8de3f67a Mon Sep 17 00:00:00 2001 From: guange <8863824@gmail.com> Date: Sun, 24 May 2015 13:52:27 +0800 Subject: [PATCH 1/2] =?UTF-8?q?=E5=A4=B4=E5=83=8F=E4=B8=8A=E4=BC=A0bug?= =?UTF-8?q?=E4=BF=AE=E5=A4=8D?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- app/controllers/avatar_controller.rb | 68 ++++++++++++++++------------ lib/trustie/utils/image.rb | 15 +++--- spec/requests/avatar_request_spec.rb | 15 ++++++ 3 files changed, 61 insertions(+), 37 deletions(-) create mode 100644 spec/requests/avatar_request_spec.rb diff --git a/app/controllers/avatar_controller.rb b/app/controllers/avatar_controller.rb index b6efaef0c..a7c0e7b95 100644 --- a/app/controllers/avatar_controller.rb +++ b/app/controllers/avatar_controller.rb @@ -24,48 +24,58 @@ class AvatarController < ApplicationController else @image_file=params[:filename] end + @temp_file = StringIO.new(@temp_file) end end end if @temp_file && (@temp_file.size > 0) - diskfile=disk_filename(@source_type,@source_id) - @urlfile='/' << File.join("images","avatars",avatar_directory(@source_type),avatar_filename(@source_id,@image_file)) + if @temp_file.size > Setting.upload_avatar_max_size.to_i + @status = 1 + @msg = l(:error_upload_avatar_to_large, :max_size => number_to_human_size(Setting.upload_avatar_max_size.to_i)) + elsif Trustie::Utils::Image.new(@temp_file).image? + diskfile=disk_filename(@source_type,@source_id) + @urlfile='/' << File.join("images","avatars",avatar_directory(@source_type),avatar_filename(@source_id,@image_file)) - # 用户头像上传时进行特别处理 - if @source_type == 'User' - diskfile += "temp" - @urlfile += "temp" - end - - logger.info("Saving avatar '#{diskfile}' (#{@temp_file.size} bytes)") - path = File.dirname(diskfile) - unless File.directory?(path) - FileUtils.mkdir_p(path) - end - md5 = Digest::MD5.new - File.open(diskfile, "wb") do |f| - if @temp_file.respond_to?(:read) - buffer = "" - while (buffer = @temp_file.read(8192)) - f.write(buffer) - md5.update(buffer) - end - else - f.write(@temp_file) - md5.update(@temp_file) + # 用户头像上传时进行特别处理 + if @source_type == 'User' + diskfile += "temp" + @urlfile += "temp" end + + logger.info("Saving avatar '#{diskfile}' (#{@temp_file.size} bytes)") + path = File.dirname(diskfile) + unless File.directory?(path) + FileUtils.mkdir_p(path) + end + md5 = Digest::MD5.new + File.open(diskfile, "wb") do |f| + if @temp_file.respond_to?(:read) + @temp_file.rewind + buffer = "" + while (buffer = @temp_file.read(8192)) + f.write(buffer) + md5.update(buffer) + end + else + f.write(@temp_file) + md5.update(@temp_file) + end + end + + Trustie::Utils::Image.new(diskfile,true).compress(300) + @status = 0 + @msg = '' + else + @status = 2 + @msg = l(:not_valid_image_file) end -# self.digest = md5.hexdigest end @temp_file = nil - image = Trustie::Utils::Image.new(diskfile,true) - image.compress(300) - respond_to do |format| format.json{ - render :inline => "#{@urlfile.to_s}?#{Time.now.to_i}",:content_type => 'text/html' + render :inline => {status: @status, message:@msg, url:"#{@urlfile.to_s}?#{Time.now.to_i}"}.to_json,:content_type => 'text/html' return } format.js diff --git a/lib/trustie/utils/image.rb b/lib/trustie/utils/image.rb index f4ec328b3..7e23e7b66 100644 --- a/lib/trustie/utils/image.rb +++ b/lib/trustie/utils/image.rb @@ -17,21 +17,20 @@ module Trustie end def jpeg?(data) - data[0,4]== 0xff.chr + 0xd8.chr + 0xff.chr + 0xe0.chr + data[0,3]== 0xff.chr + 0xd8.chr + 0xff.chr end def png?(data) data[0,2]==0x89.chr + 80.chr end def image? - begin - f = File.open(@file,'rb') # rb means to read using binary - return false if f.size < 9 - data = f.read(9) # magic numbers are up to 9 bytes - return bitmap?(data) || gif?(data) || jpeg?(data) || png?(data) - ensure - f.close + data = '' + if @file.respond_to?(:read) + data = @file.read(9) + @file.rewind end + return false if data.size < 9 + bitmap?(data) || gif?(data) || jpeg?(data) || png?(data) end def compress(size=300) diff --git a/spec/requests/avatar_request_spec.rb b/spec/requests/avatar_request_spec.rb new file mode 100644 index 000000000..da80e38bf --- /dev/null +++ b/spec/requests/avatar_request_spec.rb @@ -0,0 +1,15 @@ +require 'rails_helper' + +RSpec.describe "avatar request", type: :request do + describe "上传头像" do + let(:user){FactoryGirl.create(:user)} + + it "参数正确，可以成功上传头像" do + data = File.open("#{Rails.root}/spec/fixtures/test.jpg").read + binding.pry + post upload_avatar_path(source_type: 'User', source_id: user.id, filename: 'test.jpg') + expect(response).to have_http_status(:success) + expect(response.body).to include(/\/images\/avatars\/User\//) + end + end +end From 437d4e10093d3b87856cd34bb749eeefc4ead08f Mon Sep 17 00:00:00 2001 From: guange <8863824@gmail.com> Date: Sun, 24 May 2015 13:52:58 +0800 Subject: [PATCH 2/2] =?UTF-8?q?zip=E4=B8=8B=E8=BD=BD=E5=BF=85=E9=A1=BB?= =?UTF-8?q?=E5=BE=97=E7=99=BB=E5=BD=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- app/controllers/zipdown_controller.rb | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/app/controllers/zipdown_controller.rb b/app/controllers/zipdown_controller.rb index 06d69f72e..d9b900833 100644 --- a/app/controllers/zipdown_controller.rb +++ b/app/controllers/zipdown_controller.rb @@ -9,10 +9,14 @@ class ZipdownController < ApplicationController #统一下载功能 def download - begin - send_file "#{OUTPUT_FOLDER}/#{params[:file]}", :filename => params[:filename], :type => detect_content_type(params[:file]) - rescue => e - render file: 'public/no_file_found.html' + if User.current.logged? + begin + send_file "#{OUTPUT_FOLDER}/#{params[:file]}", :filename => params[:filename], :type => detect_content_type(params[:file]) + rescue => e + render file: 'public/no_file_found.html' + end + else + render_403 end end