haiwen/seahub
1
0
Fork 0
mirror of https://github.com/haiwen/seahub.git synced 2025-09-08 10:22:46 +00:00
Code Issues Releases Wiki Activity

fixed office preview permission check

Browse Source
This commit is contained in:
Shuai Lin
2015-07-08 10:33:07 +08:00
parent 2c246acf0f
commit cc225f3bb0
2 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
seahub/templates/snippets/office_convert_js.html
View File

@@ -20,7 +20,8 @@ var OfficePreviewer = function(file_id, preview_token) {
$.param({file_id: this.file_id, page: page}); $.param({file_id: this.file_id, page: page});
} }
this.page_content_url = function(page) { this.page_content_url = function(page) {
return "{% url 'office_convert_get_page' obj_id %}/" + page + '.page'; return "{% url 'office_convert_get_page' obj_id %}/"
+ page + '.page?office_preview_token=' + this.preview_token;
} }
var url = window.location.href; var url = window.location.href;

10
seahub/views/file.py
View File

@@ -1382,11 +1382,11 @@ def office_convert_get_page(request, path, internal=False):
return HttpResponseForbidden() return HttpResponseForbidden()
file_id = m.group(1) file_id = m.group(1)
# if path.endswith('file.css'): if path.endswith('file.css'):
# pass pass
# else: else:
# if request.office_preview_token != do_md5(file_id + settings.SECRET_KEY): if request.office_preview_token != do_md5(file_id + settings.SECRET_KEY):
# return HttpResponseForbidden() return HttpResponseForbidden()
resp = get_office_converted_page(request, path, file_id, internal=internal) resp = get_office_converted_page(request, path, file_id, internal=internal)
resp['Content-Type'] = 'text/html' resp['Content-Type'] = 'text/html'