Project

General

Profile

0001-misc-add-settings-to-block-some-extensions-58982.patch

Frédéric Péters [parti], 29 November 2021 01:38 PM

Download (2.55 KB)

View differences: 

Subject: [PATCH] misc: add settings to block some extensions (#58982)


 fargo/fargo/forms.py |  6 ++++++
 fargo/settings.py    |  2 ++
 tests/test_public.py | 15 +++++++++++++++
 3 files changed, 23 insertions(+)
fargo/fargo/forms.py
# You should have received a copy of the GNU Affero General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
import os
from django import forms
from django.utils.translation import ugettext_lazy as _
from django.conf import settings
......
_('Uploaded file is too big (limit is %s)')
% filesizeformat(settings.FARGO_MAX_DOCUMENT_SIZE)
)
if settings.FARGO_FORBIDDEN_EXTENSIONS:
ext = os.path.splitext(content.name)[-1]
if ext in settings.FARGO_FORBIDDEN_EXTENSIONS:
raise forms.ValidationError(_('Uploaded file is not allowed.'))
return content
def clean(self):
fargo/settings.py
# Fargo settings
FARGO_FORBIDDEN_EXTENSIONS = None
FARGO_MAX_DOCUMENT_SIZE = 4 * 1024 * 1024 # 4 Mo
FARGO_MAX_DOCUMENT_BOX_SIZE = 20 * 1024 * 1024 # 20 Mo
tests/test_public.py
response = app.get('/upload/')
assert response.location == '/'
def test_forbidden_extension(app, private_settings, john_doe):
private_settings.FARGO_FORBIDDEN_EXTENSIONS = ['.txt']
login(app, user=john_doe)
resp = app.get('/')
resp.form['content'] = Upload('monfichier.pdf', b'coin', 'application/pdf')
resp = resp.form.submit().follow()
assert UserDocument.objects.count() == 1
resp = app.get('/')
resp.form['content'] = Upload('monfichier.txt', b'coin', 'text/plain')
resp = resp.form.submit()
assert 'Uploaded file is not allowed.' in resp.text
assert UserDocument.objects.count() == 1