Commit d285dbb8 authored by Dmitriy Zaporozhets's avatar Dmitriy Zaporozhets
Browse files

Per project protection

parent db6b9254e22c
class FilesController < ApplicationController class FilesController < ApplicationController
def download def download
uploader = Note.find(params[:id]).attachment note = Note.find(params[:id])
send_file uploader.file.path, disposition: 'attachment'
if can?(current_user, :read_project, note.project)
uploader = note.attachment
send_file uploader.file.path, disposition: 'attachment'
end end
end end
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment