# [CRUCIBLE-SEED]
# category: open_redirect
# severity: high
# language: ruby
# expected: send_file or redirect after download with user-controlled path

class DownloadsController < ApplicationController
  def complete
    file      = params[:file]
    callback  = params[:callback_url]
    send_file Rails.root.join('public', 'downloads', file)
    redirect_to callback
  end

  def track_and_redirect
    destination = params[:destination]
    track_click(destination)
    redirect_to destination, allow_other_host: true
  end

  private

  def track_click(url)
    ClickLog.create(url: url, user_id: current_user&.id)
  end
end