Gitlink
/
forgeplus
40
1
Fork 57
Code Issues 1 Pull Requests 1 Packages Releases 15 Wiki Activity

fixed get_file request.referer 防盗链优化处理

This commit is contained in:
xxq250 2024-10-17 16:21:19 +08:00
parent c89493d6e9
commit ba7f36c34c
1 changed files with 18 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
app/controllers/attachments_controller.rb
View File

@ -30,41 +30,34 @@ class AttachmentsController < ApplicationController
def get_file def get_file
Rails.logger.info("request.host===#{request.host},request.referer===#{request.referer}")
tip_exception(403, "你没有权限访问") if request.host.present? && !request.referer.to_s.include?(request.host.to_s.gsub("www.","")) tip_exception(403, "你没有权限访问") if request.host.present? && !request.referer.to_s.include?(request.host.to_s.gsub("www.",""))
normal_status(-1, "参数缺失") if params[:download_url].blank? normal_status(-1, "参数缺失") if params[:download_url].blank?
url = base_url.starts_with?("https:") ? params[:download_url].to_s.gsub("http:", "https:") : params[:download_url].to_s url = base_url.starts_with?("https:") ? params[:download_url].to_s.gsub("http:", "https:") : params[:download_url].to_s
md5_file = Digest::MD5.hexdigest(params[:download_url]) md5_file = Digest::MD5.hexdigest(params[:download_url])
FileUtils.mkdir_p("#{Rails.root}#{EduSetting.get("attachment_folder")}gitea/") unless Dir.exists?("#{Rails.root}#{EduSetting.get("attachment_folder")}gitea/") FileUtils.mkdir_p("#{Rails.root}#{EduSetting.get("attachment_folder")}gitea/") unless Dir.exists?("#{Rails.root}#{EduSetting.get("attachment_folder")}gitea/")
tmp_path = "#{Rails.root}#{EduSetting.get("attachment_folder")}gitea/#{Time.now.strftime('%Y%m%d')}-#{md5_file}" tmp_path = "#{Rails.root}#{EduSetting.get("attachment_folder")}gitea/#{Time.now.strftime('%Y%m%d')}-#{md5_file}"
cache_key ="get_file:#{Time.now.strftime('%Y%m%d')}:#{md5_file}"
value = Rails.cache.read(cache_key)
if value.to_i >= 5 && File.exist?(tmp_path)
filepath, ref = url.split("/")[-1].split("?")
send_file(tmp_path, filename: filepath, stream:false, type: 'application/octet-stream')
else
if url.starts_with?(base_url) && !url.starts_with?("#{base_url}/repo") if url.starts_with?(base_url) && !url.starts_with?("#{base_url}/repo")
domain = GiteaService.gitea_config[:domain] domain = GiteaService.gitea_config[:domain]
api_url = GiteaService.gitea_config[:base_url] api_url = GiteaService.gitea_config[:base_url]
url = ("/repos"+url.split(base_url + "/api")[1]) url = ("/repos"+url.split(base_url + "/api")[1])
filepath, ref = url.split("/")[-1].split("?") filepath, ref = url.split("/")[-1].split("?")
url.gsub!(url.split("/")[-1], '') url.gsub!(url.split("/")[-1], '')
Rails.logger.info("url===#{url}") # Rails.logger.info("url===#{url}")
Rails.logger.info(filepath) Rails.logger.info(filepath)
ref = ref.blank? ? "" : URI.escape(ref.split('ref=')[1]) ref = ref.blank? ? "" : URI.escape(ref.split('ref=')[1])
request_url = [domain, api_url, URI.encode(url), URI.escape(filepath), "?ref=#{ref}&access_token=#{User.where(admin: true).take&.gitea_token}"].join request_url = [domain, api_url, URI.encode(url), URI.escape(filepath), "?ref=#{ref}&access_token=#{User.where(admin: true).take&.gitea_token}"].join
Rails.logger.info("request_url===#{request_url}") Rails.logger.info("request_url===#{request_url}")
file = Util.download_file(request_url, tmp_path) File.delete(tmp_path) if File.exist?(tmp_path) # 删除之前的文件
Util.download_file(request_url, tmp_path)
filename = filepath filename = filepath
else else
file = Util.download_file(URI.encode(url), tmp_path) File.delete(tmp_path) if File.exist?(tmp_path) # 删除之前的文件
Util.download_file(URI.encode(url), tmp_path)
filename = params[:download_url].to_s.split("/").pop() filename = params[:download_url].to_s.split("/").pop()
end end
value = value.to_i + 1
Rails.cache.write(cache_key, value, expires_in: 1.day)
# send_data(response.body.force_encoding("UTF-8"), filename: filename, type: "application/octet-stream", disposition: 'attachment')
send_file(tmp_path, filename: filename, type: "application/octet-stream", disposition: 'attachment') send_file(tmp_path, filename: filename, type: "application/octet-stream", disposition: 'attachment')
end end
end
def create def create
# 1. 本地存储 # 1. 本地存储