Fix for issue #462

[rmhasan]

Modified uploadCompose action to send media ids of attached
media when sending a request. Modified create method in MediaController
to check if when posting a video, there are no other media attached
to the status by looking at the media ids sent from the uploadCompose
action. This is a fix for #462.

[Gargron]

Hey! Thank you for taking the time to investigate this issue. I am not sure if this approach is ultimately correct - client apps could simply choose not to send other media IDs along. If it can be faked then it might as well be a client-side check (in so far as it would be possible to check the mime type of the selected file).

The final validation happens here: https://github.com/tootsuite/mastodon/blob/master/app/services/post_status_service.rb#L39 This is where it could really be fixed, as currently the only thing it does is ensure at most 4 media attachments.

You also don't need to worry about instantly deleting uploaded attachments. There is a cronjob that peridocally purges unattached media.

[rmhasan]

Hi @Gargron, good point on client apps choosing not to send media ids. I moved the validation check to post_status_service.rb. Please take a look at my latest commit.

[Gargron]

Okay, final suggestion: attach_media happens after the status is created, so instead of raising an error I suggest silently discarding invalid media, i.e. if a video is present, discard the other media items.

[rmhasan]

Hi @Gargron, In my last commit I moved the validation check before creating the status. What do you think about that? Or do you want me to implement what you suggested?

[rmhasan]

Hi @Gargon, I added a new commit to this PR, to use the exception handlers in api_controller.rb