[BUG FIX] Guests can see attachments

* Problem was related to Devise forcing authentication on :download.

Author: peakpg

app/controllers/cms/attachments_controller.rb

@@ -1,8 +1,7 @@
 module Cms
  class AttachmentsController < Cms::BaseController
 
- skip_before_filter :redirect_to_cms_site, :only => [:download]
- skip_before_filter :cms_access_required, :only => [:download]
+ allow_guests_to [:download]
 
  include ContentRenderingSupport
  include Cms::Attachments::Serving

app/controllers/cms/base_controller.rb

@@ -13,6 +13,7 @@ class BaseController < Cms::ApplicationController
  #
  # @param [Array<Symbol>] methods List of methods to disable security for.
  def self.allow_guests_to(methods)
+ skip_before_action :redirect_to_cms_site, only: methods
  skip_before_action :authenticate_cms_user!, only: methods
  skip_before_action :cms_access_required, only: methods
  end

doc/features/design_integration.md

@@ -31,16 +31,14 @@
 * Fix remaining critical bugs before releasing alpha
 
 cucumber features/commands/generate_module.feature:10 # Scenario: Create a BrowserCMS module
-cucumber features/content_blocks/multiple_attachments.feature:23 # Scenario: A Guest accesses a public attachment
-cucumber features/content_blocks/multiple_attachments.feature:31 # Scenario: A Guest accesses a protected attachment
 cucumber features/content_pages.feature:25 # Scenario: View Older Versions
 cucumber features/portlets/portlets.feature:93 # Scenario: Portlet errors should not blow up the page
 
 ### Open Issues
 
-* [BUG] (Critical) List portlets includes portlets that have been deleted.
 * [BUG] (Critical) Versions for project specific content types don't work. (Dummy::Product)
 * [BUG] (Critical) Cannot reuse Products on pages (solution might to to just disallow?)
+* [BUG] (Critical) Cannot click on 'Browse' for products. (Can tab to select though)
 
 ### Open (but not critical) issues
 

features/content_blocks/multiple_attachments.feature

@@ -18,16 +18,12 @@ Feature: Attaching multiple assets to a block
  When I edit that block
  Then I should see the delete attachment link
 
- # Likely related to Devise security
- @known-bug
  Scenario: A Guest accesses a public attachment
  Given an attachment exists in a public section
  And I am not logged in
  When I try to view that attachment
  Then I should see the attachment content
 
- # Devise related: 403 is 'unauthorized'. 401 is unauthenticated.
- @known-bug
  Scenario: A Guest accesses a protected attachment
  Given an attachment exists in a protected section
  And I am not logged in