Use X-Sendfile to transmit native files and handle file uploads

2022-09-06 00:00:59 +02:00
parent dccc60b7ca
commit 0a16f589e9
9 changed files with 58 additions and 9 deletions
--- a/app/models/code_ocean/file.rb
+++ b/app/models/code_ocean/file.rb
@ -58,8 +58,7 @@ module CodeOcean

    def read
      if native_file?
-        valid = Pathname(native_file.current_path).realpath.fnmatch? ::File.join(native_file.root, '**')
-        return nil unless valid
+        return nil unless native_file_location_valid?

        native_file.read
      else
@ -67,6 +66,12 @@ module CodeOcean
      end
    end

+    def native_file_location_valid?
+      real_location = Pathname(native_file.current_path).realpath
+      upload_location = Pathname(::File.join(native_file.root, 'uploads')).realpath
+      real_location.fnmatch? ::File.join(upload_location.to_s, '**')
+    end
+
    def ancestor_id
      file_id || id
    end