meineerde/redmine
1
0
Fork 0
mirror of https://github.com/meineerde/redmine.git synced 2026-02-04 08:03:23 +00:00
Code Issues Releases Wiki Activity

Allow to download javascript attachments again (#23376).

Browse Source 
Patch by Holger Just.

git-svn-id: http://svn.redmine.org/redmine/trunk@15856 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang 2016-10-01 09:24:34 +00:00
parent d478785aea
commit 76bf2404d5
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/controllers/attachments_controller.rb
View File

@ -22,6 +22,10 @@ class AttachmentsController < ApplicationController
before_action :delete_authorize, :only => :destroy
before_action :authorize_global, :only => :upload
# Disable check for same origin requests for JS files, i.e. attachments with
# MIME type text/javascript.
skip_after_filter :verify_same_origin_request, :only => :download
accept_api_auth :show, :download, :thumbnail, :upload, :destroy
def show

13
test/functional/attachments_controller_test.rb
View File

@ -252,6 +252,19 @@ class AttachmentsControllerTest < Redmine::ControllerTest
set_tmp_attachments_directory
end
def test_download_js_file
set_tmp_attachments_directory
attachment = Attachment.create!(
:file => mock_file_with_options(:original_filename => "hello.js", :content_type => "text/javascript"),
:author_id => 2,
:container => Issue.find(1)
)
get :download, :id => attachment.id
assert_response :success
assert_equal 'text/javascript', @response.content_type
end
def test_download_version_file_with_issue_tracking_disabled
Project.find(1).disable_module! :issue_tracking
get :download, :id => 9