fix security issue

[selectricity] / app / models / picture.rb

diff --git a/app/models/picture.rb b/app/models/picture.rb
index 9ec3d5e8d9592ec279c6a1803af942924cd91f66..9f17ec4c13b6a35491e1028fd9f9c5909d368d93 100644 (file)
--- a/app/models/picture.rb
+++ b/app/models/picture.rb
@@ -19,20 +19,12 @@
 class Picture < ActiveRecord::Base
   belongs_to :candidate
  
-  def set_from_field(field)
-    unless field.content_type.match(/^image/)
-      return false
-    end
-    self.filename = base_part_of(field.original_filename)
-    self.filetype =  field.content_type.chomp
-    self.data = field.read
-    self
-  end
+  has_attachment  :storage => :file_system, 
+                  :max_size => 1.megabytes,
+                  :thumbnails => { :thumb => '70x53' },
+                  :processor => :Rmagick
 
-  def base_part_of(filename)
-    name = File.basename(filename)
-    name.gsub(/[^\w._-]/, '')
-  end
+  validates_as_attachment
 
 end