Merge pull request #718 from MITLibraries/add_json_gem

Recover from virus detected during Transfer process

Gemfile

@@ -13,6 +13,7 @@ gem 'cancancan'
 gem 'cocoon'
 gem 'delayed_job_active_record'
 gem 'devise'
+gem 'json'
 gem 'kaminari'
 gem 'lograge'
 gem 'mitlibraries-theme'

Gemfile.lock

@@ -141,6 +141,7 @@ GEM
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
+    json (2.5.1)
     kaminari (1.2.1)
       activesupport (>= 4.1.0)
       kaminari-actionview (= 1.2.1)
@@ -333,6 +334,7 @@ DEPENDENCIES
   delayed_job_active_record
   devise
   dotenv-rails
+  json
   kaminari
   listen
   lograge

README.md

@@ -57,6 +57,7 @@ this automatically. It is often nice in development as well.
 
 ### Development
 
+`MAINTAINER_EMAIL` - used for `to` field of virus detected emails.
 `THESIS_ADMIN_EMAIL` - used for `from` field of receipt emails.
 
 ### Production

app.json

@@ -27,6 +27,9 @@
     "LANG": {
       "required": true
     },
+    "MAINTAINER_EMAIL": {
+      "required": true
+    },
     "RACK_ENV": {
       "required": true
     },

app/controllers/transfer_controller.rb

@@ -24,6 +24,17 @@ def create
       flash[:error] = "Error saving transfer: #{@transfer.errors.full_messages}"
       render 'new'
     end
+
+    # A virus detected prior to the Transfer being saved throws this error but
+    # our application and the files in s3 are in a state where it is safe to
+    # continue and investigate which file was problematic asynchronously
+    rescue Aws::S3::Errors::AccessDenied
+      flash[:error] = "We detected a potential problem with a file in your upload. Library staff will contact you with details when we have more details."
+      ReceiptMailer.transfer_receipt_email(@transfer, current_user).deliver_later
+
+      ReceiptMailer.virus_detected_email(@transfer).deliver_later
+      redirect_to transfer_confirm_path
+
   end
 
   def files

app/mailers/receipt_mailer.rb

@@ -17,4 +17,13 @@ def transfer_receipt_email(transfer, user)
          cc: ENV['THESIS_ADMIN_EMAIL'],
          subject: 'Thesis files transferred')
   end
+
+  def virus_detected_email(transfer)
+    return unless ENV.fetch('DISABLE_ALL_EMAIL', 'true') == 'false' # allows PR builds to disable emails
+    @transfer = transfer
+    mail(from: "MIT Libraries <#{ENV['THESIS_ADMIN_EMAIL']}>",
+      to: ENV['MAINTAINER_EMAIL'],
+      cc: ENV['THESIS_ADMIN_EMAIL'],
+      subject: 'Thesis files with virus detected')
+  end
 end

app/views/receipt_mailer/virus_detected_email.html.erb

@@ -0,0 +1,9 @@
+<p>A file was flagged with a virus during Transfer <%= @transfer.created_at.in_time_zone("America/New_York").strftime('%b %-d, %Y at %l:%M %p %Z') %>.</p>
+
+<p>Files transferred:</p>
+
+<ol>
+  <% @transfer.files.each do |file| %>
+    <li><%= file.filename %></li>
+  <% end %>
+</ol>