refs #10078

[arvados.git] / apps / workbench / app / controllers / collections_controller.rb

diff --git a/apps/workbench/app/controllers/collections_controller.rb b/apps/workbench/app/controllers/collections_controller.rb
index 847e5eedab728185f8b438d4ddb8f57f1e6819ba..20b227c3c7277d491c74b96c0f5de7bc415c0f4c 100644 (file)
--- a/apps/workbench/app/controllers/collections_controller.rb
+++ b/apps/workbench/app/controllers/collections_controller.rb
@@ -1,6 +1,5 @@
 require "arvados/keep"
 require "uri"
-require "cgi"
 
 class CollectionsController < ApplicationController
   include ActionController::Live
@@ -137,6 +136,8 @@ class CollectionsController < ApplicationController
       return
     end
 
+    # If we are configured to use a keep-web server, just redirect to
+    # the appropriate URL.
     if Rails.configuration.keep_web_url or
         Rails.configuration.keep_web_download_url
       opts = {}
@@ -153,6 +154,9 @@ class CollectionsController < ApplicationController
       return redirect_to keep_web_url(params[:uuid], params[:file], opts)
     end
 
+    # No keep-web server available. Get the file data with arv-get,
+    # and serve it through Rails.
+
     file_name = params[:file].andand.sub(/^(\.\/|\/|)/, './')
     if file_name.nil? or not coll.manifest.has_file?(file_name)
       return render_not_found
@@ -249,13 +253,6 @@ class CollectionsController < ApplicationController
         @permissions = Link.limit(RELATION_LIMIT).order("modified_at DESC")
           .where(head_uuid: @object.uuid, link_class: 'permission',
                  name: 'can_read').results
-        @logs = Log.limit(RELATION_LIMIT).order("created_at DESC")
-          .select(%w(uuid event_type object_uuid event_at summary))
-          .where(object_uuid: @object.uuid).results
-        @is_persistent = Link.limit(1)
-          .where(head_uuid: @object.uuid, tail_uuid: current_user.uuid,
-                 link_class: 'resources', name: 'wants')
-          .results.any?
         @search_sharing = search_scopes
 
         if params["tab_pane"] == "Used_by"
@@ -335,11 +332,11 @@ class CollectionsController < ApplicationController
       # Prefer the attachment-only-host when we want an attachment
       # (and when there is no preview link configured)
       tmpl = Rails.configuration.keep_web_download_url
-    else
-      test_uri = URI.parse(tmpl % fmt)
+    elsif not Rails.configuration.trust_all_content
+      check_uri = URI.parse(tmpl % fmt)
       if opts[:query_token] and
-          not test_uri.host.start_with?(munged_id + "--") and
-          not test_uri.host.start_with?(munged_id + ".")
+          not check_uri.host.start_with?(munged_id + "--") and
+          not check_uri.host.start_with?(munged_id + ".")
         # We're about to pass a token in the query string, but
         # keep-web can't accept that safely at a single-origin URL
         # template (unless it's -attachment-only-host).
@@ -348,7 +345,7 @@ class CollectionsController < ApplicationController
           raise ArgumentError, "Download precluded by site configuration"
         end
         logger.warn("Using download link, even though inline content " \
-                    "was requested: #{test_uri.to_s}")
+                    "was requested: #{check_uri.to_s}")
       end
     end
 
@@ -364,9 +361,9 @@ class CollectionsController < ApplicationController
       uri.path += 't=' + opts[:path_token] + '/'
     end
     uri.path += '_/'
-    uri.path += CGI::escape(file)
+    uri.path += URI.escape(file)
 
-    query = CGI::parse(uri.query || '')
+    query = Hash[URI.decode_www_form(uri.query || '')]
     { query_token: 'api_token',
       disposition: 'disposition' }.each do |opt, param|
       if opts.include? opt
@@ -374,7 +371,7 @@ class CollectionsController < ApplicationController
       end
     end
     unless query.empty?
-      uri.query = query.to_query
+      uri.query = URI.encode_www_form(query)
     end
 
     uri.to_s