FIX: ensure a file is present when creating an upload

app/controllers/uploads_controller.rb

@@ -50,18 +50,23 @@ class UploadsController < ApplicationController
 
   def create_upload(type, file, url)
     begin
-      # API can provide a URL
+      # ensure we have a file
-      if file.nil? && url.present? && is_api?
+      if file.nil?
-        tempfile = FileHelper.download(url, 10.megabytes, "discourse-upload-#{type}") rescue nil
+        # API can provide a URL
-        filename = File.basename(URI.parse(url).path)
+        if url.present? && is_api?
+          tempfile = FileHelper.download(url, 10.megabytes, "discourse-upload-#{type}") rescue nil
+          filename = File.basename(URI.parse(url).path)
+        end
       else
         tempfile = file.tempfile
         filename = file.original_filename
         content_type = file.content_type
       end
 
+      return { errors: I18n.t("upload.file_missing") } if tempfile.nil?
+
       # allow users to upload large images that will be automatically reduced to allowed size
-      if tempfile && File.size(tempfile.path) > 0 && SiteSetting.max_image_size_kb > 0 && FileHelper.is_image?(filename)
+      if SiteSetting.max_image_size_kb > 0 && FileHelper.is_image?(filename) && File.size(tempfile.path) > 0
         attempt = 5
         while attempt > 0 && File.size(tempfile.path) > SiteSetting.max_image_size_kb.kilobytes
           OptimizedImage.downsize(tempfile.path, tempfile.path, "80%", allow_animation: SiteSetting.allow_animated_thumbnails)

config/locales/server.en.yml

@@ -2063,6 +2063,7 @@ en:
     unauthorized: "Sorry, the file you are trying to upload is not authorized (authorized extensions: %{authorized_extensions})."
     pasted_image_filename: "Pasted image"
     store_failure: "Failed to store upload #%{upload_id} for user #%{user_id}."
+    file_missing: "Sorry, you must provide a file to upload."
     attachments:
       too_large: "Sorry, the file you are trying to upload is too big (maximum size is %{max_size_kb}KB)."
     images:

spec/controllers/uploads_controller_spec.rb

@@ -82,6 +82,17 @@ describe UploadsController do
         expect(Upload.find(id).retain_hours).to eq(100)
       end
 
+      it 'requires a file' do
+        Jobs.expects(:enqueue).never
+
+        message = MessageBus.track_publish do
+          xhr :post, :create, type: "composer"
+        end.first
+
+        expect(response.status).to eq 200
+        expect(message.data["errors"]).to eq(I18n.t("upload.file_missing"))
+      end
+
       it 'properly returns errors' do
         SiteSetting.stubs(:max_attachment_size_kb).returns(1)