cartodb-4.42/app/models/asset.rb

require 'open-uri'
require_relative '../../lib/cartodb/image_metadata.rb'
require_relative '../helpers/file_upload'
require_dependency 'carto/configuration'

class Asset < Sequel::Model
  include Carto::Configuration

  many_to_one :user

  KIND_ORG_AVATAR = 'orgavatar'

  VALID_EXTENSIONS = %w{ .jpeg .jpg .gif .png .svg }

  attr_accessor :asset_file, :url

 def before_create
  store
  super
 end

  def after_destroy
    super
    remove unless self.public_url.blank?
  end

  def validate
    super
    errors.add(:user_id, "can't be blank") if user_id.blank?

    download_file if url.present?
    validate_file if asset_file.present?
  end

  def download_file
    dir = Dir.mktmpdir
    stdout, stderr, status = Open3.capture3('wget', '-nv', '-P', dir, '-E', url)
    self.asset_file = Dir[File.join(dir, '*')][0]
    errors.add(:url, "is invalid") unless status.exitstatus == 0
  end

  def max_size
    Cartodb::config[:assets]["max_file_size"]
  end

  def validate_file
    extension = asset_file_extension
    unless VALID_EXTENSIONS.include?(extension)
      errors.add(:file, "has invalid format")
      return
    end

    @file = open_file(asset_file)
    unless @file && File.readable?(@file.path)
      errors.add(:file, "is invalid")
      return
    end

    max_size_in_mb = (max_size.to_f / (1024 * 1024).to_f).round(2)
    if @file.size > max_size
      errors.add(:file, "is too big, #{max_size_in_mb}MB max")
      return
    end

    metadata = CartoDB::ImageMetadata.new(@file.path, extension: extension)
    errors.add(:file, "is too big, 1024x1024 max") if metadata.width > 1024 || metadata.height > 1024
    # If metadata reports no size, 99% sure not valid, so out
    errors.add(:file, "doesn't appear to be an image") if metadata.width == 0 || metadata.height == 0
  rescue StandardError => e
    errors.add(:file, "error while uploading: #{e.message}")
  end

  def asset_file_extension
    filename = asset_file.respond_to?(:original_filename) ? asset_file.original_filename : asset_file
    extension = File.extname(filename).downcase

    # Filename might include a postfix hash -- Rack::Test::UploadedFile adds it
    extension.gsub!(/\d+-\w+-\w+\z/, '') if Rails.env.test?

    extension if VALID_EXTENSIONS.include?(extension)
  end

  ##
  # Tries to open the specified file object or full path
  #
  def open_file(handle)
    (handle.respond_to?(:path) ? handle : File.open(handle.to_s))
  rescue Errno::ENOENT
    nil
  end

  def store
    return unless @file
    filename = (@file.respond_to?(:original_filename) ? @file.original_filename : File.basename(@file))
    filename = "#{Time.now.strftime("%Y%m%d%H%M%S")}#{filename}"

    remote_url = (use_s3? ? save_to_s3(filename) : save_local(filename))
    self.set(public_url: remote_url)
    self.this.update(public_url: remote_url)
  end

  def save_to_s3(filename)
    obj = s3_bucket.object("#{target_asset_path}#{filename}")
    obj.upload_file(@file.path, acl: 'public-read', content_type: MIME::Types.type_for(filename).first.to_s)

    obj.public_url.to_s
  end

  def local_dir
    @local_dir ||= Pathname.new(public_uploaded_assets_path).join(target_asset_path)
  end

  def local_filename(filename)
    local_dir.join(filename)
  end

  def save_local(filename)
    FileUtils.mkdir_p local_dir
    FileUtils.cp @file.path, local_filename(filename)

    mode = chmod_mode
    FileUtils.chmod(mode, local_filename(filename)) if mode

    File.join('/', ASSET_SUBFOLDER, target_asset_path, ERB::Util.url_encode(filename))
  end

  def use_s3?
    Cartodb.get_config(:assets, "s3_bucket_name") && Cartodb.get_config(:aws, "s3")
  end

  def remove
    unless use_s3?
      local_url = CGI.unescape(public_url.gsub(/(http:)?\/\/#{CartoDB.account_host}/, ''))
      begin
        FileUtils.rm((public_uploaded_assets_path + local_url).gsub('/uploads/uploads/', '/uploads/'))
      rescue StandardError => e
        log_error(message: "Error removing asset", current_user: self, exception: e)
      end
      return
    end
    basename = File.basename(public_url)
    obj = s3_bucket.object("#{target_asset_path}#{basename}")
    obj.delete
  end

  def target_asset_path
    "#{Rails.env}/#{self.user.username}/assets/"
  end

  def s3_bucket
    s3_config = Cartodb.get_config(:aws, 's3').symbolize_keys
    Aws.config = s3_config
    s3 = Aws::S3::Resource.new
    @s3_bucket ||= s3.bucket(Cartodb.get_config(:assets, 's3_bucket_name'))
  end

  ASSET_SUBFOLDER = 'uploads'.freeze

  def absolute_public_url
    uri = URI.parse(public_url)
    (uri.absolute? ? uri : URI.join(base_domain, uri)).to_s
  rescue URI::InvalidURIError
    public_url
  end

  private

  def base_domain
    CartoDB.base_domain_from_name(user ? user.subdomain : organization.name)
  end

  def chmod_mode
    # Example in case asset kind should change mode
    # kind == KIND_ORG_AVATAR ? 0644 : nil
    0644
  end

  def asset_protocol
    # Avatars without protocol to allow the browser pick http/https.
    # Other assets with http, because, for example, tiler needs access to landmark images.
    kind == KIND_ORG_AVATAR ? '' : 'http:'
  end

end