mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-10-28 00:16:48 +09:00
Jeremy Daer
9c8f4cd272
The nonce generator runs for every response that carries the policy, so the nonce_id cookie was set on QR codes, logos, avatars and disk-served blobs — all public, shared-cacheable. Those endpoints now opt out of the policy, so no cache can replay one client's identifier and nonce.
42 lines
1.0 KiB
Ruby
42 lines
1.0 KiB
Ruby
class Users::AvatarsController < ApplicationController
|
|
include ActiveStorage::Streaming
|
|
|
|
content_security_policy false, only: :show
|
|
|
|
rescue_from(ActiveSupport::MessageVerifier::InvalidSignature) { head :not_found }
|
|
|
|
def show
|
|
@user = User.from_avatar_token(params[:user_id])
|
|
|
|
if stale?(etag: @user)
|
|
expires_in 30.minutes, public: true, stale_while_revalidate: 1.week
|
|
|
|
if (avatar_variant = @user.avatar_variant)
|
|
send_webp_blob_file avatar_variant.key
|
|
elsif @user.bot?
|
|
render_default_bot
|
|
else
|
|
render_initials
|
|
end
|
|
end
|
|
end
|
|
|
|
def destroy
|
|
Current.user.avatar.destroy
|
|
redirect_to user_profile_url
|
|
end
|
|
|
|
private
|
|
def send_webp_blob_file(key)
|
|
send_file ActiveStorage::Blob.service.path_for(key), content_type: "image/webp", disposition: :inline
|
|
end
|
|
|
|
def render_default_bot
|
|
send_file Rails.root.join("app/assets/images/default-bot-avatar.svg"), content_type: "image/svg+xml", disposition: :inline
|
|
end
|
|
|
|
def render_initials
|
|
render formats: :svg
|
|
end
|
|
end
|