diff options
author | Thibaut Girka <thib@sitedethib.com> | 2019-06-24 14:47:48 +0200 |
---|---|---|
committer | Thibaut Girka <thib@sitedethib.com> | 2019-06-24 15:02:59 +0200 |
commit | ddd875ad9940c4c7ef53a31af23cd5fe89fcf0c9 (patch) | |
tree | 7926abdec378339ee622a1f09b9a52178f4d0600 /app/controllers/media_controller.rb | |
parent | 38d28824475056766c97385b66f4e04a5123e3a2 (diff) | |
parent | 66ac1bd063882f5a2f828c1c702089e37f36f217 (diff) |
Merge branch 'master' into glitch-soc/merge-upstream
Conflicts: - app/models/media_attachment.rb Upstream added audio attachment support - app/serializers/initial_state_serializer.rb Upstream added audio attachment support and how mimetypes are returned - app/serializers/rest/instance_serializer.rb Upstream added a few fields - config/application.rb Upstream added a different paperclip transcoder
Diffstat (limited to 'app/controllers/media_controller.rb')
-rw-r--r-- | app/controllers/media_controller.rb | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/app/controllers/media_controller.rb b/app/controllers/media_controller.rb index a245db2d1..d44b52d26 100644 --- a/app/controllers/media_controller.rb +++ b/app/controllers/media_controller.rb @@ -7,6 +7,8 @@ class MediaController < ApplicationController before_action :set_media_attachment before_action :verify_permitted_status! + before_action :check_playable, only: :player + before_action :allow_iframing, only: :player content_security_policy only: :player do |p| p.frame_ancestors(false) @@ -18,8 +20,6 @@ class MediaController < ApplicationController def player @body_classes = 'player' - response.headers['X-Frame-Options'] = 'ALLOWALL' - raise ActiveRecord::RecordNotFound unless @media_attachment.video? || @media_attachment.gifv? end private @@ -34,4 +34,12 @@ class MediaController < ApplicationController # Reraise in order to get a 404 instead of a 403 error code raise ActiveRecord::RecordNotFound end + + def check_playable + not_found unless @media_attachment.larger_media_format? + end + + def allow_iframing + response.headers['X-Frame-Options'] = 'ALLOWALL' + end end |