Question

道歉，如果这已经得到回答而且我找不到它。任何方向都将不胜感激。

使用Rails 4.1.4，Paperclip 4.2.0和Simple Form 3.0.2。

在Submit之后，我在表单错误消息中输出has an extension that does not match its contents。

在服务器窗口中：

Started POST "/routes" for 127.0.0.1 at 2014-08-28 15:18:25 +0700
Processing by RoutesController#create as HTML
Parameters: {"utf8"=>"✓", "authenticity_token"=>"5BCHGBkwQH4mlnTVjy/PpD53mJKJpSmBXwXT/oul7yY=", "route"=>{"track_attributes"=>{"gpx"=>#<ActionDispatch::Http::UploadedFile:0x007fa89c9cd348 @tempfile=#<Tempfile:/var/folders/_g/6shs5yrj36n960wpt880ysl80000gn/T/RackMultipart20140828-42106-vi71nb>, @original_filename="Serge's tracks.gpx", @content_type="application/octet-stream", @headers="Content-Disposition: form-data; name=\"route[track_attributes][gpx]\"; filename=\"Serge's tracks.gpx\"\r\nContent-Type: application/octet-stream\r\n">}, "title"=>"Serge track", "description"=>"loop of hang dong", "distance"=>"", "total_ascent"=>""}, "commit"=>"Create Route"}
Command :: file -b --mime '/var/folders/_g/6shs5yrj36n960wpt880ysl80000gn/T/f55fe48e09c9cc3ee6c6271fe94f407520140828-42106-1hgpby7.gpx'
[paperclip] Content Type Spoof: Filename Serge's_tracks.gpx ([]), content type discovered from file command: application/xml. See documentation to allow this combination.
(0.3ms)  BEGIN
Command :: file -b --mime '/var/folders/_g/6shs5yrj36n960wpt880ysl80000gn/T/f55fe48e09c9cc3ee6c6271fe94f407520140828-42106-62bkvh.gpx'
[paperclip] Content Type Spoof: Filename Serge's_tracks.gpx ([]), content type discovered from file command: application/xml. See documentation to allow this combination.
(0.8ms)  ROLLBACK

我无法在Paperclip文档中找到所述文档。正在运行file Serge\'s\ tracks.gpx --mime-type -b会产生application/xml

我的MVC看起来像这样：

class Track < ActiveRecord::Base
  belongs_to :route
  has_attached_file :gpx
  validates_attachment_content_type :gpx, :content_type => /application\/xml/
end

class Route < ActiveRecord::Base
  has_one :track, dependent: :destroy
  accepts_nested_attributes_for :track
  validates :title, presence: true
end

内部RoutesController

def new
  @route       = Route.new
  @route.track = Track.new
end

def create
  @route = Route.new(route_params)
end

def route_params
  params.require(:route).permit(:title, :description, :distance, :total_ascent, track_attributes: [:gpx])
end

simple_form：

= simple_form_for @route do |r|
  = r.simple_fields_for :track do |t|
    = t.input :gpx
  = r.input :title
  = r.input :description
  = r.input :distance
  = r.input :total_ascent
  = r.button :submit

Answer 1

正如本文中提到的：Paperclip gem spoofing error?和本文http://robots.thoughtbot.com/prevent-spoofing-with-paperclip，显然绕过Paperclip调用的命令file -b --mime-type解决了问题。

为此，我在paperclip.rb中创建了一个config/initializers文件。

Paperclip.options[:content_type_mappings] = {
  :gpx => 'application/xml'
}

虽然问题已经解决，但我仍然感到困惑的是，当file命令返回正确结果时问题存在的原因，以及对参数中的@content_type="application/octet-stream"来自哪里感到好奇。

Paperclip：内容类型欺骗尝试上传.gpx文件

1 个答案: