alphagov/whitehall — pull request #69 by tomafro (2012-11-14 14:43:47+00:00)
Title: Block inaccessible attachments

Prevents direct serving of all uploaded files, placing a controller
action between the request and file.

The majority of files are processed by the public uploads controller
which simply instructs nginx to serve the requested file.

Any uploads associated with attachments, however, are handled by the
attachments controller. This checks whether these attachments are
visible, or if an authenticated user is detected, if the user can
access the attachment. Only if one of the two is true are the
attachments shown.

In order to switch this on, the carrier wave configuration
needs to be changed to store files under
'clean-uploads/government/uploads' rather than
'public/government/uploads'. However, this isn't included in this
commit so that the functionality can be checked manually first.