DeforaNetworks/corteza
3
0
Fork 0
Code Activity

Check access to attachments

Browse Source
This commit is contained in:
Denis Arh
2018-09-27 18:24:33 +02:00
parent 5f7abc2187
commit 9b0c425390
4 changed files with 23 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
sam/rest/handlers/attachment_custom.go
View File

@@ -27,9 +27,9 @@ func NewAttachmentDownloadable(ah AttachmentAPI) *Attachment {
if err != nil {
switch true {
case err.Error() == "crust.sam.repository.AttachmentNotFound":
http.Error(w, "Attachment not found", 404)
w.WriteHeader(http.StatusNotFound)
default:
http.Error(w, err.Error(), 500)
http.Error(w, err.Error(), http.StatusInternalServerError)
}
} else if dl, ok := f.(Downloadable); ok {
if dl.Download() {
@@ -38,7 +38,7 @@ func NewAttachmentDownloadable(ah AttachmentAPI) *Attachment {
http.ServeContent(w, r, dl.Name(), dl.ModTime(), dl.Content())
} else {
http.Error(w, "Got incompatible type from controller", 500)
http.Error(w, "Got incompatible type from controller", http.StatusInternalServerError)
}
}

7
sam/rest/router.go
View File

@@ -9,11 +9,14 @@ import (
func MountRoutes() func(chi.Router) {
// Initialize handers & controllers.
return func(r chi.Router) {
handlers.NewAttachmentDownloadable(Attachment{}.New()).MountRoutes(r)
r.Group(func(r chi.Router) {
r.Use(auth.MiddlewareValidOnly404)
handlers.NewAttachmentDownloadable(Attachment{}.New()).MountRoutes(r)
})
// Protect all _private_ routes
r.Group(func(r chi.Router) {
r.Use(auth.AuthenticationMiddlewareValidOnly)
r.Use(auth.MiddlewareValidOnly)
handlers.NewChannel(Channel{}.New()).MountRoutes(r)
handlers.NewMessage(Message{}.New()).MountRoutes(r)