Mercurial > hg > uploader
annotate uploader/handlers.py @ 18:cc5f567ce840
make it safe
| author | Jeff Hammel <jhammel@mozilla.com> |
|---|---|
| date | Sat, 16 Jul 2011 17:41:53 -0700 |
| parents | d15f85eb2ab9 |
| children | 4da97e040145 |
| rev | line source |
|---|---|
| 0 | 1 import os |
| 2 from urlparse import urlparse | |
| 3 from webob import Response, exc | |
| 4 | |
| 5 class Handler(object): | |
| 6 def __init__(self, app, request): | |
| 7 self.app = app | |
| 8 self.request = request | |
| 9 self.application_path = urlparse(request.application_url)[2] | |
| 10 | |
| 11 def link(self, path=(), permanant=False): | |
| 12 if isinstance(path, basestring): | |
| 13 path = [ path ] | |
| 14 path = [ i.strip('/') for i in path ] | |
| 15 if permanant: | |
| 16 application_url = [ self.request.application_url ] | |
| 17 else: | |
| 18 application_url = [ self.application_path ] | |
| 19 path = application_url + path | |
| 20 return '/'.join(path) | |
| 21 | |
| 22 def redirect(self, location): | |
|
13
b8c636b0b567
make work for non pastescript frameworks
Jeff Hammel <jhammel@mozilla.com>
parents:
11
diff
changeset
|
23 return exc.HTTPSeeOther(location=location) |
| 0 | 24 |
| 25 class Get(Handler): | |
| 26 | |
|
13
b8c636b0b567
make work for non pastescript frameworks
Jeff Hammel <jhammel@mozilla.com>
parents:
11
diff
changeset
|
27 form = """<form name="upload_form" method="post" enctype="multipart/form-data"> |
| 2 | 28 <input type="file" name="file"/><input type="submit" value="upload"/></form></body></html>""" |
| 29 | |
| 0 | 30 @classmethod |
| 2 | 31 def match(cls, app, request): |
|
7
a8c60480fce0
make query_string argument more universal
k0s <k0scist@gmail.com>
parents:
6
diff
changeset
|
32 if app.query_string and (app.query_string not in request.GET): |
|
a8c60480fce0
make query_string argument more universal
k0s <k0scist@gmail.com>
parents:
6
diff
changeset
|
33 return False |
| 0 | 34 return request.method == 'GET' |
| 35 | |
| 36 def __call__(self): | |
|
13
b8c636b0b567
make work for non pastescript frameworks
Jeff Hammel <jhammel@mozilla.com>
parents:
11
diff
changeset
|
37 form = "<html><body>" |
|
b8c636b0b567
make work for non pastescript frameworks
Jeff Hammel <jhammel@mozilla.com>
parents:
11
diff
changeset
|
38 if 'uploaded' in self.request.GET: |
|
b8c636b0b567
make work for non pastescript frameworks
Jeff Hammel <jhammel@mozilla.com>
parents:
11
diff
changeset
|
39 form += '<div>%s uploaded successfully</div>' % self.request.GET['uploaded'] |
|
17
d15f85eb2ab9
optionally display upload directory contents
Jeff Hammel <jhammel@mozilla.com>
parents:
15
diff
changeset
|
40 form += self.form |
|
d15f85eb2ab9
optionally display upload directory contents
Jeff Hammel <jhammel@mozilla.com>
parents:
15
diff
changeset
|
41 if self.app.display_contents: |
|
d15f85eb2ab9
optionally display upload directory contents
Jeff Hammel <jhammel@mozilla.com>
parents:
15
diff
changeset
|
42 contents = os.listdir(self.app.directory) |
|
d15f85eb2ab9
optionally display upload directory contents
Jeff Hammel <jhammel@mozilla.com>
parents:
15
diff
changeset
|
43 if contents: |
|
d15f85eb2ab9
optionally display upload directory contents
Jeff Hammel <jhammel@mozilla.com>
parents:
15
diff
changeset
|
44 contents.sort() |
|
d15f85eb2ab9
optionally display upload directory contents
Jeff Hammel <jhammel@mozilla.com>
parents:
15
diff
changeset
|
45 form += '<div><i>Currently uploaded:<ul><li>' + '</li><li>'.join(contents) + '</li></ul></i></div>' |
|
d15f85eb2ab9
optionally display upload directory contents
Jeff Hammel <jhammel@mozilla.com>
parents:
15
diff
changeset
|
46 else: |
|
d15f85eb2ab9
optionally display upload directory contents
Jeff Hammel <jhammel@mozilla.com>
parents:
15
diff
changeset
|
47 form += '<div><i>No files in upload directory</i></div>' |
|
d15f85eb2ab9
optionally display upload directory contents
Jeff Hammel <jhammel@mozilla.com>
parents:
15
diff
changeset
|
48 form += '</body></html>' |
|
13
b8c636b0b567
make work for non pastescript frameworks
Jeff Hammel <jhammel@mozilla.com>
parents:
11
diff
changeset
|
49 return Response(content_type='text/html', body=form) |
| 0 | 50 |
| 51 class Post(Handler): | |
| 52 | |
| 53 @classmethod | |
| 2 | 54 def match(cls, app, request): |
| 0 | 55 return request.method == 'POST' |
| 56 | |
| 2 | 57 def write(self, fin, path): |
| 58 fout = file(path, 'w') | |
| 59 fout.write(fin.file.read()) | |
| 60 fout.close() | |
| 61 | |
| 0 | 62 def __call__(self): |
| 18 | 63 |
| 64 # get the file | |
| 0 | 65 fin = self.request.POST['file'] |
|
15
1ee374416987
handle more gracefully when no file is uploaded
Jeff Hammel <jhammel@mozilla.com>
parents:
14
diff
changeset
|
66 try: |
| 18 | 67 _path = fin.filename: |
|
15
1ee374416987
handle more gracefully when no file is uploaded
Jeff Hammel <jhammel@mozilla.com>
parents:
14
diff
changeset
|
68 except AttributeError: # no file uploaded |
|
1ee374416987
handle more gracefully when no file is uploaded
Jeff Hammel <jhammel@mozilla.com>
parents:
14
diff
changeset
|
69 return self.redirect(self.link('/')) |
| 18 | 70 |
| 71 # don't allow bad filenames | |
| 72 illegal = ['..', '<', '&', '>'] | |
| 73 illegal.append(os.path.sep) | |
| 74 for i in illegal: | |
| 75 _path = _path.replace(i, '_') | |
| 76 | |
| 77 # write the file + redirect | |
|
14
916d45d4f921
dont just die on questionable filenames
Jeff Hammel <jhammel@mozilla.com>
parents:
13
diff
changeset
|
78 _path = os.path.join(self.app.directory, _path) |
| 11 | 79 self.write(fin, _path) |
|
13
b8c636b0b567
make work for non pastescript frameworks
Jeff Hammel <jhammel@mozilla.com>
parents:
11
diff
changeset
|
80 return self.redirect(self.link('/?uploaded=' + fin.filename)) |
| 2 | 81 |
| 82 def path(directory, request): | |
| 83 if os.sep == '/': | |
| 84 return os.path.join(directory, request.path_info.strip('/')) | |
| 85 return os.path.join(directory, *request.path_info.strip('/').split('/')) | |
| 86 | |
| 87 class SubpathGet(Get): | |
| 88 | |
| 89 @classmethod | |
| 90 def match(cls, app, request): | |
| 9 | 91 if not Get.match(app, request): |
| 2 | 92 return False |
| 93 _path = path(app.directory, request) | |
| 94 if os.path.exists(_path) and os.path.isdir(_path): | |
| 95 return True | |
| 0 | 96 |
| 2 | 97 class SubpathPost(Post): |
| 98 | |
| 99 @classmethod | |
| 100 def match(cls, app, request): | |
| 101 if request.method != 'POST': | |
| 102 return False | |
| 103 _path = path(app.directory, request) | |
| 104 if os.path.exists(_path) and os.path.isdir(_path): | |
| 105 return True | |
| 106 | |
| 107 def __call__(self): | |
| 108 fin = self.request.POST['file'] | |
| 10 | 109 _path = path(self.app.directory, self.request) |
| 110 _path = os.path.join(_path, fin.filename) | |
| 111 self.write(fin, _path) | |
|
13
b8c636b0b567
make work for non pastescript frameworks
Jeff Hammel <jhammel@mozilla.com>
parents:
11
diff
changeset
|
112 return self.redirect(self.link(self.request.path_info)) |
| 2 | 113 |