github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-11-27 02:53:41 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: send 404 error when unauthorized user tries to download user archive

Browse Source
This commit is contained in:
Arpit Jalan 2015-06-08 11:09:38 +05:30
parent a09d893c0c
commit 74141cc475
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/export_csv_controller.rb
View File

@ -20,7 +20,7 @@ class ExportCsvController < ApplicationController
export_initiated_by_user_id = UserExport.where(id: export_id)[0].user_id unless UserExport.where(id: export_id).empty?
export_csv_path = UserExport.get_download_path(filename)
if export_csv_path && export_initiated_by_user_id == current_user.id
if export_csv_path && current_user.present? && export_initiated_by_user_id == current_user.id
send_file export_csv_path
else
render nothing: true, status: 404

8
spec/controllers/export_csv_controller_spec.rb
View File

@ -3,6 +3,14 @@ require "spec_helper"
describe ExportCsvController do
let(:export_filename) { "user-archive-codinghorror-150115-234817-999.csv.gz" }
context "while not logged in" do
describe ".download" do
it "returns 404 when the unauthorized user tries to export csv file" do
get :show, id: export_filename
expect(response.status).to eq(404)
end
end
end
context "while logged in as normal user" do
before { @user = log_in(:user) }