class UploadViewMixin(object):
def get_safe_path(self, filename=""):
"""Finds absolute filesystem path of the browsed dir of file.
-
+
Makes sure it's inside MEDIA_ROOT.
-
+
"""
path = os.path.abspath(os.path.join(settings.MEDIA_ROOT, self.get_directory(), filename))
- # WTF how would that be possible?
if not path.startswith(os.path.abspath(settings.MEDIA_ROOT)):
raise Http404
if filename:
for chunk in f.chunks():
destination.write(chunk)
data.append({
- 'name': f.name,
+ 'name': f.name,
'url': self.get_url(f.name),
'thumbnail_url': thumbnail(self.get_directory() + f.name),
'delete_url': "%s?file=%s" % (
class PackageView(UploadViewMixin, RedirectView):
+ # usage of RedirectView here is really really ugly
+ permanent = False
+
def dispatch(self, request, *args, **kwargs):
self.object = self.get_object(request, *args, **kwargs)
path = self.get_safe_path()