+class UploadViewMixin(object):
+ def get_safe_path(self, filename=""):
+ """Finds absolute filesystem path of the browsed dir of file.
+
+ Makes sure it's inside MEDIA_ROOT.
+
+ """
+ path = os.path.abspath(os.path.join(
+ settings.MEDIA_ROOT,
+ self.get_directory(),
+ filename))
+ if not path.startswith(os.path.abspath(settings.MEDIA_ROOT)):
+ raise Http404
+ if filename:
+ if not path.startswith(self.get_safe_path()):
+ raise Http404
+ return path
+
+
+class UploadView(UploadViewMixin, FormView):