Commit Graph

294 Commits

Author SHA1 Message Date
Matt Muller
4b44d4c0e9
Fix S3 multipart uploads when threshold is larger than file 2020-12-11 16:26:40 -05:00
Daniel Colson
8ef5bd9ced
Allow custom purpose for ActiveStorage signed IDs
This commit allows passing a custom `purpose:` keyword argument to both
`find_signed!` and `signed_id`. This matches the signature of the
`super` methods in ActiveRecord, and it is already possible with the
non-bang [`find_signed`][find_signed] method, since that one doesn't
have an override in ActiveStorage (although perhaps it should, to set
the default :blob_id purpose)

This is useful in cases where you want to further isolate different
types of blobs, for example if they have different levels of
authorization.

[find_signed]: be11d1b6e8/activerecord/lib/active_record/signed_id.rb (L42-L48)
2020-12-03 12:36:52 -05:00
Alex Ghiculescu
76e432341c Always recommend config.asset_host in examples 2020-11-30 16:33:51 -06:00
Tahsin Hasan
bb148d822c
Permit hash on direct upload in active storage (#40662) 2020-11-28 10:33:44 +01:00
David Angulo
1db02b3896 Add strict loading for active storage 2020-11-16 22:09:15 +08:00
Eugene Kenny
b7eaaf73fb Update comment about reloading in development.rb [ci skip]
This comment predates the existence of `reload_classes_only_on_change`.
2020-11-02 19:36:26 +00:00
Rafael Mendonça França
62bda903be
Remove deprecated support to pass :combine_options operations to ActiveStorage::Transformers::ImageProcessing 2020-10-30 00:25:48 +00:00
Rafael Mendonça França
74476f0f90
Remove deprecated ActiveStorage::Transformers::MiniMagickTransformer
Now ActiveStorage only support mini_magick transformation through the
image_processing gem.
2020-10-30 00:25:47 +00:00
Rafael França
9492339979
Merge pull request #38443 from jonathanhefner/plugin-fix-stack-traces
Fix stack traces when testing plugins
2020-10-08 19:06:40 -04:00
Eugene Kenny
e44b3419d4 Prefix keys in Active Storage service test
Otherwise this test fails when run concurrently.

https://buildkite.com/rails/rails/builds/71999#77923632-f943-4fa0-b478-0af38001c22b/1032-1098
https://buildkite.com/rails/rails/builds/71999#01fdec79-dc1f-4a6a-b730-ac0df134a2e7/970-1062
2020-10-07 21:47:59 +01:00
Jonathan Hefner
33fdae0584 Fix backtraces for generated plugin tests
`Minitest.plugin_rails_init` sets `Minitest.backtrace_filter` to
`Rails.backtrace_cleaner` right before tests are run, overwriting the
value set in test_helper.rb.

`Rails.backtrace_cleaner` silences backtrace lines that do not start
with `Rails.root` followed by e.g. "lib/" or "test/".  Thus when
`Rails.root` is a subdirectory of the project directory -- for example,
when testing a plugin that has a dummy app -- all lines of the backtrace
are silenced.

This commit adds a fallback such that when all backtrace lines are
silenced, the original `Minitest.backtrace_filter` is used instead.

Additionally, this commit refactors and expands existing test coverage.
2020-10-07 15:40:56 -05:00
Akira Matsuda
d71291cb3c Module#include is a public method since Ruby 2.1 2020-10-06 21:19:24 +09:00
George Claghorn
a185ff86c0
Set default variant format from blob content type 2020-09-22 13:03:53 -04:00
Vincent Robert
3803671a81 Generate a preview without print margins
When a PDF is used for both printing and displaying. It will most likely
contain a crop box in order to hide print margins when displaying the PDF.

Use Poppler's parameter to automatically use the crop box (visible box)
rather than the media box (printable box) in order to remove those margins
when drawing the PDF.

See https://manpages.debian.org/testing/poppler-utils/pdftoppm.1.en.html
2020-09-17 11:59:45 -04:00
George Claghorn
b221a4dc43
Proxying: sanitize Content-Type and Content-Disposition
Prevent XSS where unsafe content is served inline on the application origin.

Follows up on #34477. References 06ab7b2 and d40284b.
2020-08-31 11:24:13 -04:00
Jonathan Hefner
a197d39e13
Fall back to video container for duration
Some video formats, such as WebM, do not store duration information at
the level of the video stream.  Instead, the duration is stored as part
of the container format information.

This commit modifies `VideoAnalyzer` to use the duration from the video
container when the duration from the video stream is not available.

Fixes #40130.
2020-08-31 08:48:06 -04:00
Jonathan Hefner
6aa26c30e2
Identify directly-uploaded blobs before saving the associated record
An Active Storage `Blob` must be identified before it can be reliably
validated.  For direct uploads, a `Blob` is identified when it is
attached, rather than when it is created.

Before this commit, the sequence of events when attaching a `Blob` was:

1. Find the `Blob`.
2. Assign the `Blob` to an `Attachment`.
3. Save the owner record.
4. Save the `Attachment`.
5. Identify the `Blob`'s true `content_type` from its file.
6. Save the `Blob`.

This meant that the owner record's validations might not see the
`Blob`'s true `content_type`.

After this commit, the sequence of events will be:

1. Find the `Blob`.
2. Identify the `Blob`'s true `content_type` from its file.
3. Assign the `Blob` to an `Attachment`.
4. Save the owner record.
5. Save the `Attachment`.
6. Save the `Blob`.

Thus the `Blob`'s true `content_type` will be available when running the
owner record's validations.
2020-08-11 18:08:09 -04:00
Lawrence Chou
eb5f5ed0be
Fix attaching blobs via nested attributes
Closes #37411.
2020-08-04 00:26:27 -04:00
Victor Perez Rodriguez
3eb48a2148 fix misleading variant test
This commit fixes the "resized variation of BMP blob" test.

By default `create_file_blob` use "image/jpeg" as content type,
since this test does not specify the correct `content_type` for
a `*.bmp` image ("image/bmp") the `ActiveStorage::Variant#specification`
consider the blob as a web image which causes the variant to return a
`*.bmp` URL and a "BMP" type, this is an incorrect behavior since if you
upload a `*.bmp` image the variant will have a PNG format with "image/png"
as content type.

After this change the test will cover the current activestorage behavior.

Changes:

* Specify correct `content_type` on "resized variation of BMP blob" test.
* Change asserts to cover the current activestorage behavior.
2020-07-29 16:32:14 -05:00
Victor Perez Rodriguez
396b43a99d touch parent model when an attachment is purged
Currently `delete` is used on the `purge` and `purge_later` methods,
that prevent any callbacks to be triggered which causes the parent
model to not be updated when an attachment is purged. This behaviour
cause issues on some caching strategies as reported here: https://github.com/rails/rails/issues/39858

Changes:

* Add `record&.touch` on `attachment#purge`
* Add `record&.touch` on `attachment#purge_later`
* Remove extra blank line on attachment.rb
* Add tests which are failing before this change and pass after the change
2020-07-26 12:22:37 -05:00
Santiago Bartesaghi
31148cd6be Use Active Record signed IDs in Active Storage 2020-07-04 21:09:00 -04:00
George Claghorn
fd61bae02c ActiveStorage::Attachment#signed_id must return a signed *blob* ID
Fixes that calling e.g. `url_for @user.avatar` would return an incorrect URL resulting in a 404. The Active Storage URL helper ends up calling ActiveStorage::Attachment#signed_id, which previously delegated to ActiveStorage::Blob#signed_id but changed to return a signed *attachment* ID in 1a3dc42.

The Active Storage controllers pass signed IDs to ActiveStorage::Blob.find_signed, so we need signed blob IDs.
2020-05-28 09:20:49 -04:00
Jonathan Hefner
d02d259b61
Fix Active Storage behavior on record dup
Prior to this commit, a `dup`ed record and its originating record would
share the same `Attached` proxy objects.  Those proxy objects, in turn,
would point to the same `Attachment` associations, causing changes made
through the proxy interface to affect both records.
2020-05-25 22:03:32 -04:00
Jonathan Hefner
03f5f57af0 Test Attached::Many in Attached::Many test
This exact test exists in `one_test.rb`.  It was probably overlooked
after being copied and pasted.
2020-05-22 22:52:38 -05:00
fatkodima
6c4f3be929 Unify raise_on_missing_translations for views and controllers 2020-05-20 02:42:59 +03:00
Rafael França
a80115b7c5
Merge pull request #39204 from prathamesh-sonpatki/template-annotation
Add the configuration option for annotating templates with file names to the generated app
2020-05-19 19:11:31 -04:00
Prathamesh Sonpatki
a673ce69e7
Rename annotate_template_file_names to annotate_rendered_view_with_filenames
- Add the configuration option for annotating templates with file names to the generated app.
- Add `annotate_rendered_view_with_filenames` option to configuring guide.
2020-05-19 09:28:14 +05:30
Travis Pew
c0ab9a7d29
Include Content-Length in signature for ActiveStorage direct upload
[CVE-2020-8162]
2020-05-15 14:32:19 -07:00
Jonathan Fleckenstein
dfb5a82b25
Active Storage: allow serving files by proxying 2020-05-11 16:21:58 -04:00
Ryuta Kamizono
6a4395f466 Deprecate starts_with? and ends_with? for String core extensions
In the past, we sometimes hit missing `Symbol#start_with?` and
`Symbol#end_with?`.

63256bc5d7
a8e812964d

So I proposed `Symbol#start_with?` and `Symbol#end_with?` to allow duck
typing that methods for String and Symbol, then now it is available in
Ruby 2.7.

https://bugs.ruby-lang.org/issues/16348

Using `String#starts_with?` and `String#ends_with?` could not be gained
that conveniency, so it is preferable to not use these in the future.
2020-05-05 15:51:24 +09:00
George Claghorn
3a38c07211 Revert "Set a public ACL for files uploaded to a public GCS service"
This reverts commit 43503bdfecb86ed7386eecc54a75ccf3744b5dc2.
2020-04-28 17:16:47 -04:00
Brendan Abbott
43503bdfec
Set a public ACL for files uploaded to a public GCS service 2020-04-28 15:44:17 -04:00
Mikel Kew
cf7c27f2ff
Ensure direct uploads to a public S3 service have a public ACL 2020-04-28 15:42:17 -04:00
William Carey
4c5e4ea476
Fix autosave association bug with ActiveStorage::Attachments
Closes #37701.
2020-04-24 13:16:16 -04:00
Joel Hawksley
a59e1de26a .annotate_template_file_names annotates HTML output with template file names
As a developer, when looking at a page in my web browser, it's sometimes
difficult to figure out which template(s) are being used to render the page.

config.action_view.annotate_template_file_names adds HTML comments to the
rendered output indicating where each template begins and ends.

Co-authored-by: Aaron Patterson <tenderlove@github.com>
2020-03-30 14:50:01 -06:00
David Heinemeier Hansson
3e0cdbeaf4
require, require_relative, load by double quotes (#38841)
* require, require_relative, load by double quotes

We're getting rid of all single quote usage, unless it serves a specific purpose, as per the general style guide.
2020-03-29 16:30:52 -07:00
Kurtis Rainbolt-Greene
ef7599fe91
Extract internal ActiveSupport::ConfigurationFile object
Rails has a number of places where a YAML configuration file is read,
then ERB is evaluated and finally the YAML is parsed.

This consolidates that into one common class.

Co-authored-by: Kasper Timm Hansen <kaspth@gmail.com>
2020-02-10 02:50:12 +01:00
Gannon McGibbon
ed81601723 Only enqueue analysis jobs when blob is analyzable 2020-01-16 14:14:28 -05:00
Haroon Ahmed
db1ae8cbb4 remove reference to global rails command and replace with bin/rails 2019-12-27 19:32:37 +00:00
Peter Zhu
4203093ad3 Store previews in the same service as the original blob 2019-12-20 15:06:03 -05:00
Peter Zhu
d0dd199206 Make sure variant is created on the same service 2019-12-06 22:02:07 -05:00
Peter Zhu
2e15092942 Remove query params in DiskService 2019-12-06 16:52:30 -05:00
Peter Zhu
fbb83d78c3 Use DiskController for both public and private files 2019-12-06 16:02:16 -05:00
George Claghorn
7d0327bbbf Track Active Storage variants in the database 2019-12-06 13:26:51 -05:00
George Claghorn
9e06289a3b Switch to the writer DB to generate ASt previews 2019-12-05 12:56:42 -05:00
Peter Zhu
235f2636cd Deprecate service_url in favour of url 2019-12-02 14:59:03 -05:00
George Claghorn
709cee9c9a
Defer Active Storage service configuration until use 2019-11-08 15:03:42 -05:00
Gannon McGibbon
1404da2649
Merge pull request #37490 from huacnlee/fix-aws-public-acl
Ensure public-read ACL for S3 service with public mode.
2019-11-05 15:53:39 -05:00
Richard Macklin
6b6e10d02e Enforce that activestorage compiled JS is in sync with source code
(Note: this is effectively the same change that we did for actioncable
in fefc304199503dbd5290e077357ac431e5fd7441 applied to activestorage.)

We have run into issues in the past where the activestorage compiled
javascript bundle got out of sync with the source code. For example, in
880f977925601c3afe125274b5cc95e150341a9f the compiled bundle was
modified in a way that was inconsistent with the results of running
`yarn build` in the activestorage directory. This meant that running
`yarn build` there would produce a dirty git status indicating changes
to the compiled bundle, despite not having made any changes to the
activestorage javascript source code. That particular inconsistency was
fixed in 0e77706dc5d2928e945c34b9ac49ff0807888ba5. However, the same
problem could reoccur.

To address this, I've added a new test to enforce that activestorage's
compiled javascript bundle is in sync with the source code. When the
compiled bundle is in sync with the source code, the test will pass.
However, if the two are not in sync, the test will fail. For example, if
you were to apply the following patch (which only updates the source
code):

```
diff --git a/activestorage/app/javascript/activestorage/index.js b/activestorage/app/javascript/activestorage/index.js
index a340008fb9..a05b7223a5 100644
--- a/activestorage/app/javascript/activestorage/index.js
+++ b/activestorage/app/javascript/activestorage/index.js
@@ -8,4 +8,4 @@ function autostart() {
   }
 }

-setTimeout(autostart, 1)
+setTimeout(autostart, 2)
```
the test would then fail. Thus, the activestorage test suite will now
prevent "the compiled bundle is out of sync" issues going forward.
2019-10-18 18:02:02 -07:00
Jason Lee
5ae3b01e97 Ensure public-read ACL for S3 service with public mode. 2019-10-17 15:24:00 +08:00