Merge branch 'master' into mmonaco/gitlab-ce-api-user-noconfirm

Conflicts:
	lib/api/users.rb

1 files changed, 24 insertions, 0 deletions

diff --git a/app/controllers/uploads_controller.rb b/app/controllers/uploads_controller.rb
new file mode 100644
index 00000000000..b096c3913e1
--- /dev/null
+++ b/app/controllers/uploads_controller.rb
@@ -0,0 +1,24 @@
+class UploadsController < ApplicationController
+  skip_before_filter :authenticate_user!, :reject_blocked!
+  before_filter :authorize_access
+
+  def show
+    model = params[:model].camelize.constantize.find(params[:id])
+    uploader = model.send(params[:mounted_as])
+
+    return not_found! if model.respond_to?(:project) && !can?(current_user, :read_project, model.project)
+
+    return redirect_to uploader.url unless uploader.file_storage?
+
+    return not_found! unless uploader.file.exists?
+
+    disposition = uploader.image? ? 'inline' : 'attachment'
+    send_file uploader.file.path, disposition: disposition
+  end
+
+  def authorize_access
+    unless params[:mounted_as] == 'avatar'
+      authenticate_user! && reject_blocked!
+    end
+  end
+end