Class: Ideasbugs::ScreenshotsController

Inherits:
DashboardController show all
Includes:
ActiveStorage::Streaming
Defined in:
app/controllers/ideasbugs/screenshots_controller.rb

Overview

Serves screenshots to the dashboard under its own authorization, streaming the blob instead of linking Active Storage's public blob URLs. Feedback screenshots can contain anything a user's screen showed, so they must never be reachable without passing the same gate as the dashboard — regardless of how the host app configures (or doesn't configure) blob access.

Instance Method Summary collapse

Instance Method Details

#show ⇒ Object 



12
13
14
15
16
17
18
19
 
# File 'app/controllers/ideasbugs/screenshots_controller.rb', line 12

def show
  screenshot = Feedback.for_tenant(current_tenant)
                       .find(params[:feedback_id]).screenshots.find(params[:id])

  response.headers['X-Content-Type-Options'] = 'nosniff'
  response.headers['Cache-Control'] = 'private, no-store'
  send_blob_stream screenshot.blob, disposition: 'inline'
end