diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 3ab894c69..0d9fe62a8 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -257,12 +257,12 @@ class ApplicationController < ActionController::Base def authorize_attachment_download(ctrl = params[:controller], action = params[:action], global = false) if @attachment.container_type == "Memo" allowed = User.current.allowed_to?(:memos_attachments_download,nil,:global => true) - elsif @attachment.container_type == "Project" - return true - elsif @attachment.container_type == "course" - return true + elsif @attachment.container_type == "Message" && !@project.nil? + allowed = User.current.allowed_to?(:projects_attachments_download,@project,:global => false) + elsif @attachment.container_type == "Message" && !@course.nil? + allowed = User.current.allowed_to?(:course_attachments_download, @course, :global => false) elsif @attachment.container_type == "contest" - return true + return true else return true end diff --git a/app/controllers/attachments_controller.rb b/app/controllers/attachments_controller.rb index c511b5ace..08469ac48 100644 --- a/app/controllers/attachments_controller.rb +++ b/app/controllers/attachments_controller.rb @@ -22,7 +22,7 @@ class AttachmentsController < ApplicationController before_filter :delete_authorize, :only => :destroy before_filter :authorize_global, :only => :upload before_filter :authorize_attachment_download, :only => :download - before_filter :login_without_softapplication, only: [:download] + #before_filter :login_without_softapplication, only: [:download] accept_api_auth :show, :download, :upload require 'iconv' @@ -68,12 +68,20 @@ class AttachmentsController < ApplicationController elsif @attachment.container.is_a?(Project) project = @attachment.container candown= User.current.member_of?(project) || (project.is_public && @attachment.is_public == 1) + elsif (@attachment.container.has_attribute?(:board) || @attachment.container.has_attribute?(:board_id)) && @attachment.container.board && + @attachment.container.board.project + project = @attachment.container.board.project + candown = User.current.member_of?(project) || (project.is_public && @attachment.is_public == 1) elsif (@attachment.container.has_attribute?(:course) ||@attachment.container.has_attribute?(:course_id) ) && @attachment.container.course course = @attachment.container.course candown= User.current.member_of_course?(course) || (course.is_public==1 && @attachment.is_public == 1) elsif @attachment.container.is_a?(Course) course = @attachment.container candown= User.current.member_of_course?(course) || (course.is_public==1 && @attachment.is_public == 1) + elsif (@attachment.container.has_attribute?(:board) || @attachment.container.has_attribute?(:board_id)) && @attachment.container.board && + @attachment.container.board.course + course = @attachment.container.board.course + candown= User.current.member_of_course?(course) || (course.is_public==1 && @attachment.is_public == 1) elsif @attachment.container.class.to_s=="HomeworkAttach" && @attachment.container.bid.reward_type == 3 candown = true else @@ -321,8 +329,11 @@ private raise ActiveRecord::RecordNotFound if params[:filename] && params[:filename] != @attachment.filename if @attachment.container_type == 'Course' @course = @attachment.course - elsif !@attachment.container.nil? && (@attachment.container.has_attribute?(:course) || @attachment.container.has_attribute?(:course)) && @attachment.container.course + elsif !@attachment.container.nil? && (@attachment.container.has_attribute?(:course) || @attachment.container.has_attribute?(:course_id)) && @attachment.container.course @course = @attachment.container.course + elsif !@attachment.container.nil? && ((@attachment.container.has_attribute?(:board) || @attachment.container.has_attribute?(:board_id)) && @attachment.container.board && + @attachment.container.board.course) + @course = @attachment.container.board.course else unless @attachment.container_type == 'Bid' || @attachment.container_type == 'HomeworkAttach' || @attachment.container_type == 'Memo' || @attachment.container_type == 'Softapplication' @project = @attachment.project