1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-12-24 14:30:56 +01:00
phorge-phorge/src/applications/celerity
epriestley 439821c7b2 Don't require one-time tokens to view file resources
Summary:
Ref T10262. This removes one-time tokens and makes file data responses always-cacheable (for 30 days).

The URI will stop working once any attached object changes its view policy, or the file view policy itself changes.

Files with `canCDN` (totally public data like profile images, CSS, JS, etc) use "cache-control: public" so they can be CDN'd.

Files without `canCDN` use "cache-control: private" so they won't be cached by the CDN. They could still be cached by a misbehaving local cache, but if you don't want your users seeing one anothers' secret files you should configure your local network properly.

Our "Cache-Control" headers were also from 1999 or something, update them to be more modern/sane. I can't find any evidence that any browser has done the wrong thing with this simpler ruleset in the last ~10 years.

Test Plan:
  - Configured alternate file domain.
  - Viewed site: stuff worked.
  - Accessed a file on primary domain, got redirected to alternate domain.
  - Verified proper cache headers for `canCDN` (public) and non-`canCDN` (private) files.
  - Uploaded a file to a task, edited task policy, verified it scrambled the old URI.
  - Reloaded task, new URI generated transparently.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T10262

Differential Revision: https://secure.phabricator.com/D15642
2016-04-06 14:14:36 -07:00
..
__tests__ Modularize Celerity postprocessors 2015-06-20 06:10:42 -07:00
application Push construction of routing maps into Sites 2015-08-31 04:01:01 -07:00
controller Don't require one-time tokens to view file resources 2016-04-06 14:14:36 -07:00
management Various translation improvements 2015-11-03 07:02:46 +11:00
postprocessor Polish up timeline for PHIUTwoColumnView 2016-03-08 17:51:53 -08:00
resources Add mask-icon for Safari pinned tab 2015-11-22 13:04:06 -08:00
api.php Make Celerity a real application 2014-10-13 11:17:23 -07:00
CelerityAPI.php Extend from Phobject 2015-06-15 18:02:27 +10:00
CelerityResourceGraph.php Various linter fixes 2015-05-20 07:27:41 +10:00
CelerityResourceMap.php Extend from Phobject 2015-06-15 18:02:27 +10:00
CelerityResourceMapGenerator.php Extend from Phobject 2015-06-15 18:02:27 +10:00
CelerityResourceTransformer.php Swap charts from gRaphael to D3 2016-02-01 10:36:59 -08:00
CeleritySpriteGenerator.php Remove defunt project image choices 2016-01-19 08:50:59 -08:00
CelerityStaticResourceResponse.php Modularize Celerity postprocessors 2015-06-20 06:10:42 -07:00