upload:DropBox-1.0.py of DropBox.py

   1 # -*- coding: iso-8859-1 -*-
   2 """
   3     MoinMoin - DropBox action Version 1.0, 15.05.2011
   4     [a modification of AttachFile action]
   5 
   6     For documentation and examples see:
   7     
   8     http://rileylink.local/pb/MoinMoin_Matters
   9 
  10     @copyright: 2011 Ian Riley <ian.riley@adelaide.edu.au>
  11     @license: GNU GPL, see COPYING for details.
  12 
  13     Based on AttachFile action
  14 
  15     @copyright: 2001 by Ken Sugino (sugino@mediaone.net),
  16                 2001-2004 by Juergen Hermann <jh@web.de>,
  17                 2005 MoinMoin:AlexanderSchremmer,
  18                 2005 DiegoOngaro at ETSZONE (diego@etszone.com),
  19                 2005-2007 MoinMoin:ReimarBauer,
  20                 2007-2008 MoinMoin:ThomasWaldmann
  21     @license: GNU GPL, see COPYING for details.
  22 """
  23 
  24 from MoinMoin.action.AttachFile import *
  25 
  26 action_name = __name__.split('.')[-1]
  27 
  28 #############################################################################
  29 ### External interface - these are called from the core code
  30 #############################################################################
  31 
  32 def get_action(request, filename, do):
  33     generic_do_mapping = {
  34         # do -> action
  35         'get': action_name,
  36         'view': action_name,
  37         'del': action_name,
  38         'upload_form': action_name,
  39     }
  40     basename, ext = os.path.splitext(filename)
  41     do_mapping = request.cfg.extensions_mapping.get(ext, {})
  42     action = do_mapping.get(do, None)
  43     if action is None:
  44         # we have no special support for this,
  45         # look up whether we have generic support:
  46         action = generic_do_mapping.get(do, None)
  47     return action
  48 
  49 def getAttachUrl(pagename, filename, request, addts=0, do='get'):
  50     """ Get URL that points to attachment `filename` of page `pagename`.
  51         For upload url, call with do='upload_form'.
  52         Returns the URL to do the specified "do" action or None,
  53         if this action is not supported.
  54     """
  55     action = get_action(request, filename, do)
  56     if action:
  57         args = dict(action=action, do=do, target=filename)
  58         if do not in ['get', 'view', # harmless
  59                       'modify', # just renders the applet html, which has own ticket
  60                       'move', # renders rename form, which has own ticket
  61             ]:
  62             # create a ticket for the not so harmless operations
  63             # we need action= here because the current action (e.g. "show" page
  64             # with a macro AttachList) may not be the linked-to action, e.g.
  65             # "AttachFile". Also, AttachList can list attachments of another page,
  66             # thus we need to give pagename= also.
  67             args['ticket'] = wikiutil.createTicket(request,
  68                                                    pagename=pagename, action=action_name)
  69         url = request.href(pagename, **args)
  70         return url
  71 
  72 #############################################################################
  73 ### Internal helpers
  74 #############################################################################
  75 def _get_filesource(request, pagename, filename):
  76     """ Look up the user who attached the file
  77 
  78         Returns userid and username tuple.
  79     """
  80     from MoinMoin.logfile import editlog
  81     from MoinMoin import user
  82     
  83     log = editlog.EditLog(request, rootpagename=pagename)
  84     result = '', ''
  85     count = 0
  86     for line in log.reverse():
  87         count += 1
  88         if line.action in ('ATTNEW', 'ATTDEL', ):
  89             foundname = wikiutil.url_unquote(line.extra)
  90             if foundname == filename:
  91                 # just the user's name
  92                 result = line.userid, user.User(request, line.userid, auth_method="editlog:53").name
  93 
  94                 # link to user's homepage or email depending on preferences
  95                 # this would be OK if users all had homepages.
  96                 #result = line.userid, line.getEditor(request)
  97 
  98                 # unknown user
  99                 if '' in result:
 100                   result = None,'unknown user'
 101                 break
 102     return result
 103 
 104 def _access_file(pagename, request):
 105     """ Check form parameter `target` and return a tuple of
 106         `(pagename, filename, filepath)` for an existing attachment.
 107 
 108         Return `(pagename, None, None)` if an error occurs.
 109     """
 110     _ = request.getText
 111 
 112     error = None
 113     if not request.values.get('target'):
 114         error = _("Filename of upload not specified!")
 115     else:
 116         filename = wikiutil.taintfilename(request.values['target'])
 117         fpath = getFilename(request, pagename, filename)
 118 
 119         if os.path.isfile(fpath):
 120             return (pagename, filename, fpath)
 121         error = _("Upload '%(filename)s' does not exist!") % {'filename': filename}
 122 
 123     error_msg(pagename, request, error)
 124     return (pagename, None, None)
 125 
 126 def _build_filelist(request, pagename, sumonly, readonly, mime_type='*', owners='All'):
 127     _ = request.getText
 128     fmt = request.html_formatter
 129 
 130     user_id = request.user.valid and request.user.id or ''
 131 
 132     # access directory
 133     attach_dir = getAttachDir(request, pagename)
 134     files = _get_files(request, pagename)
 135 
 136     if mime_type != '*':
 137         files = [fname for fname in files if mime_type == mimetypes.guess_type(fname)[0]]
 138 
 139     html = []
 140     if files:
 141 
 142         label_del = _("del")
 143         label_get = _("get")
 144         label_view = _("view")
 145 
 146         may_read = request.user.may.read(pagename)
 147         may_attach = request.user.may.attach(pagename)
 148         may_delete = request.user.may.delete(pagename)
 149         may_detach = request.user.may.detach(pagename)
 150 
 151         if not sumonly:
 152             html.append(fmt.bullet_list(1))
 153         count = 0
 154         space = 0
 155         latest = None
 156         for file in files:
 157             owner_id, ownername = _get_filesource(request, pagename, file)
 158             ownersfile = owner_id == user_id
 159             if owners == "Self" and not ownersfile:
 160                 continue
 161             elif owners == "Other" and ownersfile:
 162                 continue
 163             elif owners == "All":
 164                 pass
 165             count += 1
 166             mt = wikiutil.MimeType(filename=file)
 167             fullpath = os.path.join(attach_dir, file).encode(config.charset)
 168             st = os.stat(fullpath)
 169             base, ext = os.path.splitext(file)
 170             viewfilelink = (fmt.url(1, getAttachUrl(pagename, file, request, do='view')) +
 171                             fmt.text(wikiutil.escape(file)) +
 172                             fmt.url(0))
 173             parmdict = {'file': wikiutil.escape(file),
 174                         'fsize': "%.1f" % (float(st.st_size) / 1024),
 175                         'fmtime': request.user.getFormattedDateTime(st.st_mtime),
 176                        }
 177             space += st.st_size
 178             if st.st_mtime > latest:
 179                 latest = st.st_mtime
 180 
 181             links = []
 182             if (may_delete or (may_detach and ownersfile)) and not readonly:
 183                 links.append(fmt.url(1, getAttachUrl(pagename, file, request, do='del')) +
 184                              fmt.text(label_del) +
 185                              fmt.url(0))
 186 
 187             links.append(fmt.url(1, getAttachUrl(pagename, file, request)) +
 188                          fmt.text(label_get) +
 189                          fmt.url(0))
 190 
 191             links.append(fmt.url(1, getAttachUrl(pagename, file, request, do='view')) +
 192                          fmt.text(label_view) +
 193                          fmt.url(0))
 194 
 195             if not sumonly:
 196                 html.append(fmt.listitem(1))
 197                 html.append("%s " % viewfilelink)
 198                 html.append("[%s]" % "&nbsp;| ".join(links))
 199                 html.append(" %(fmtime)s, %(fsize)s KB" % parmdict)
 200                 html.append(", uploaded by %s" % ownername)
 201                 html.append(fmt.listitem(0))
 202         if not sumonly:
 203             html.append(fmt.bullet_list(0))
 204         if count == 1:
 205             uploadtxt = 'upload'
 206         else:
 207             uploadtxt = 'uploads'
 208         if count != 0:
 209             html.append(fmt.text(_("%(count)s %(uploadtxt)s stored, \
 210                                     totalling %(fsize)s KB, \
 211                                     latest dated %(fmttime)s") % {
 212                         'count': count,
 213                         'uploadtxt': uploadtxt,
 214                         'fsize': "%.1f" % (float(space) / 1024),
 215                         'fmttime': request.user.getFormattedDateTime((latest))}))
 216         else:
 217             html.append("%s %s stored" % (0, 'uploads'))
 218     else:
 219         html.append("%s %s stored" % (0, 'uploads'))
 220 
 221     return ''.join(html)
 222 
 223 def _get_files(request, pagename):
 224     attach_dir = getAttachDir(request, pagename)
 225     if os.path.isdir(attach_dir):
 226         files = [fn.decode(config.charset) for fn in os.listdir(attach_dir)]
 227         files.sort()
 228     else:
 229         files = []
 230     return files
 231 
 232 def _get_filelist(request, pagename, mime_type='*', owners='All'):
 233     # set sumonly=0, ie false
 234     return _build_filelist(request, pagename, 0, 0, mime_type, owners)
 235 
 236 def _get_info(request, pagename, mime_type='*', owners='All'):
 237     # set sumonly=1, ie true
 238     return _build_filelist(request, pagename, 1, 0, mime_type, owners)
 239 
 240 #############################################################################
 241 ### Create parts of the Web interface
 242 #############################################################################
 243 
 244 def send_uploadform(pagename, request):
 245     """ Send the HTML code for the list of already stored attachments and
 246         the file upload form.
 247     """
 248     _ = request.getText
 249 
 250     if not request.user.may.read(pagename):
 251         request.write('<p>%s</p>' % _('You are not allowed to view this page.'))
 252         return
 253 
 254     writeable = request.user.may.attach(pagename)
 255     overwriteable = request.user.may.detach(pagename)
 256     may_delete = request.user.may.delete(pagename)
 257 
 258     # First send out the upload new attachment form on top of everything else.
 259     # This avoids usability issues if you have to scroll down a lot to upload
 260     # a new file when the page already has lots of attachments:
 261     if writeable:
 262         request.write('<h2>' + _("New Upload") + '</h2>')
 263     if writeable and not overwriteable:
 264         request.write("""
 265 <form action="%(url)s" method="POST" enctype="multipart/form-data">
 266 <dl>
 267 <dt>%(upload_label_file)s</dt>
 268 <dd><input type="file" name="file" size="50"></dd>
 269 <dt>%(upload_label_target)s</dt>
 270 <dd><input type="text" name="target" size="50" value="%(target)s"></dd>
 271 </dl>
 272 %(textcha)s
 273 <p>
 274 <input type="hidden" name="action" value="%(action_name)s">
 275 <input type="hidden" name="do" value="upload">
 276 <input type="hidden" name="ticket" value="%(ticket)s">
 277 <input type="submit" value="%(upload_button)s">
 278 </p>
 279 </form>
 280 """ % {
 281     'url': request.href(pagename),
 282     'action_name': action_name,
 283     'upload_label_file': _('File to upload'),
 284     'upload_label_target': _('Rename to'),
 285     'target': wikiutil.escape(request.values.get('target', ''), 1),
 286     'upload_button': _('Upload'),
 287     'textcha': TextCha(request).render(),
 288     'ticket': wikiutil.createTicket(request),
 289 })
 290     if overwriteable:
 291         request.write("""
 292 <form action="%(url)s" method="POST" enctype="multipart/form-data">
 293 <dl>
 294 <dt>%(upload_label_file)s</dt>
 295 <dd><input type="file" name="file" size="50"></dd>
 296 <dt>%(upload_label_target)s</dt>
 297 <dd><input type="text" name="target" size="50" value="%(target)s"></dd>
 298 <dt>%(upload_label_overwrite)s</dt>
 299 <dd><input type="checkbox" name="overwrite" value="1" %(overwrite_checked)s></dd>
 300 </dl>
 301 %(textcha)s
 302 <p>
 303 <input type="hidden" name="action" value="%(action_name)s">
 304 <input type="hidden" name="do" value="upload">
 305 <input type="hidden" name="ticket" value="%(ticket)s">
 306 <input type="submit" value="%(upload_button)s">
 307 </p>
 308 </form>
 309 """ % {
 310     'url': request.href(pagename),
 311     'action_name': action_name,
 312     'upload_label_file': _('File to upload'),
 313     'upload_label_target': _('Rename to'),
 314     'target': wikiutil.escape(request.values.get('target', ''), 1),
 315     'upload_label_overwrite': _('Overwrite existing upload of same name'),
 316     'overwrite_checked': ('', 'checked')[request.form.get('overwrite', '0') == '1'],
 317     'upload_button': _('Upload'),
 318     'textcha': TextCha(request).render(),
 319     'ticket': wikiutil.createTicket(request),
 320 })
 321 
 322     request.write('<h2>' + _("Uploaded Files") + '</h2>')
 323     if writeable and overwriteable and may_delete:
 324         request.write('<p>%s</p>' % _('You can upload, download and delete files.'))
 325         request.write('<h3>' + _("Your uploads") + '</h3>')
 326         request.write(_get_filelist(request, pagename, owners="Self"))
 327         request.write('<h3>' + _("Other uploads") + '</h3>')
 328         request.write(_get_filelist(request, pagename, owners="Other"))
 329     elif writeable and overwriteable :
 330         request.write('<p>%s</p>' % _('You can upload and download files, and delete your own files.'))
 331         request.write('<h3>' + _("Your uploads") + '</h3>')
 332         request.write(_get_filelist(request, pagename, owners="Self"))
 333         request.write('<h3>' + _("Other uploads") + '</h3>')
 334         request.write(_get_filelist(request, pagename, owners="Other"))
 335     elif writeable:
 336         request.write('<p>%s</p>' % _('You can upload and download, but not delete files.'))
 337         request.write(_get_filelist(request, pagename))
 338     elif not writeable:
 339         request.write('<p>%s</p>' % _('You can download, but not upload or delete files.'))
 340         request.write(_get_filelist(request, pagename))
 341 
 342 #############################################################################
 343 ### Web interface for file upload, viewing and deletion
 344 #############################################################################
 345 
 346 def execute(pagename, request):
 347     """ Main dispatcher for the 'DropBox' action. """
 348     _ = request.getText
 349 
 350     do = request.values.get('do', 'upload_form')
 351     handler = globals().get('_do_%s' % do)
 352     if handler:
 353         msg = handler(pagename, request)
 354     else:
 355         msg = _('Unsupported DropBox sub-action: %s') % do
 356     if msg:
 357         error_msg(pagename, request, msg)
 358 
 359 
 360 def _do_upload_form(pagename, request):
 361     upload_form(pagename, request)
 362 
 363 def upload_form(pagename, request, msg=''):
 364     if msg:
 365         msg = wikiutil.escape(msg)
 366     _ = request.getText
 367 
 368     # Use user interface language for this generated page
 369     request.setContentLanguage(request.lang)
 370     request.theme.add_msg(msg, "dialog")
 371     request.theme.send_title(_('Uploads for "%(pagename)s"') % {'pagename': pagename}, pagename=pagename)
 372     request.write('<div id="content">\n') # start content div
 373     send_uploadform(pagename, request)
 374     request.write('</div>\n') # end content div
 375     request.theme.send_footer(pagename)
 376     request.theme.send_closing_html()
 377 
 378 def _do_upload(pagename, request):
 379     _ = request.getText
 380 
 381     if not wikiutil.checkTicket(request, request.form.get('ticket', '')):
 382         return _('Please use the interactive user interface to use action %(actionname)s!') % {'actionname': 'DropBox.upload' }
 383 
 384     # Currently we only check TextCha for upload (this is what spammers ususally do),
 385     # but it could be extended to more/all attachment write access
 386     if not TextCha(request).check_answer_from_form():
 387         return _('TextCha: Wrong answer! Go back and try again...')
 388 
 389     form = request.form
 390 
 391     file_upload = request.files.get('file')
 392     if not file_upload:
 393         # This might happen when trying to upload file names
 394         # with non-ascii characters on Safari.
 395         return _("No file content. Delete non ASCII characters from the file name and try again.")
 396 
 397     try:
 398         overwrite = int(form.get('overwrite', '0'))
 399     except:
 400         overwrite = 0
 401 
 402     if not request.user.may.attach(pagename):
 403         return _('You are not allowed to upload a file to this page.')
 404 
 405     if overwrite and not request.user.may.detach(pagename):
 406         return _('You are not allowed to overwrite a file previously uploaded to this page.')
 407 
 408     target = form.get('target', u'').strip()
 409     if not target:
 410         target = file_upload.filename or u''
 411 
 412     target = wikiutil.clean_input(target)
 413 
 414     if not target:
 415         return _("Filename of upload not specified!")
 416 
 417     # add the attachment
 418     try:
 419         target, bytes = add_attachment(request, pagename, target, file_upload.stream, overwrite=overwrite)
 420         msg = _("Upload '%(target)s' (remote name '%(filename)s')"
 421                 " with %(bytes)d bytes saved.") % {
 422                 'target': target, 'filename': file_upload.filename, 'bytes': bytes}
 423     except AttachmentAlreadyExists:
 424         msg = _("Upload '%(target)s' (remote name '%(filename)s') already exists.") % {
 425             'target': target, 'filename': file_upload.filename}
 426 
 427     # return attachment list
 428     upload_form(pagename, request, msg)
 429 
 430 
 431 def _do_del(pagename, request):
 432     _ = request.getText
 433 
 434     if not wikiutil.checkTicket(request, request.args.get('ticket', '')):
 435         return _('Please use the interactive user interface to use action %(actionname)s!') % {'actionname': 'DropBox.del' }
 436 
 437     pagename, filename, fpath = _access_file(pagename, request)
 438     if not request.user.may.detach(pagename):
 439         return _('You are not allowed to delete uploads from this page.')
 440     if not filename:
 441         return # error msg already sent in _access_file
 442 
 443     remove_attachment(request, pagename, filename)
 444 
 445     upload_form(pagename, request, msg=_("Upload '%(filename)s' deleted.") % {'filename': filename})
 446 
 447 
 448 def _do_get(pagename, request):
 449     _ = request.getText
 450 
 451     pagename, filename, fpath = _access_file(pagename, request)
 452     if not request.user.may.read(pagename):
 453         return _('You are not allowed to download from this page.')
 454     if not filename:
 455         return # error msg already sent in _access_file
 456 
 457     timestamp = datetime.datetime.fromtimestamp(os.path.getmtime(fpath))
 458     if_modified = request.if_modified_since
 459     if if_modified and if_modified >= timestamp:
 460         request.status_code = 304
 461     else:
 462         mt = wikiutil.MimeType(filename=filename)
 463         content_type = mt.content_type()
 464         mime_type = mt.mime_type()
 465 
 466         # TODO: fix the encoding here, plain 8 bit is not allowed according to the RFCs
 467         # There is no solution that is compatible to IE except stripping non-ascii chars
 468         filename_enc = filename.encode(config.charset)
 469 
 470         # for dangerous files (like .html), when we are in danger of cross-site-scripting attacks,
 471         # we just let the user store them to disk ('attachment').
 472         # For safe files, we directly show them inline (this also works better for IE).
 473         dangerous = mime_type in request.cfg.mimetypes_xss_protect
 474         content_dispo = dangerous and 'attachment' or 'inline'
 475 
 476         now = time.time()
 477         request.headers['Date'] = http_date(now)
 478         request.headers['Content-Type'] = content_type
 479         request.headers['Last-Modified'] = http_date(timestamp)
 480         request.headers['Expires'] = http_date(now - 365 * 24 * 3600)
 481         request.headers['Content-Length'] = os.path.getsize(fpath)
 482         content_dispo_string = '%s; filename="%s"' % (content_dispo, filename_enc)
 483         request.headers['Content-Disposition'] = content_dispo_string
 484 
 485         # send data
 486         request.send_file(open(fpath, 'rb'))
 487 
 488 def send_viewfile(pagename, request):
 489     _ = request.getText
 490     fmt = request.html_formatter
 491 
 492     pagename, filename, fpath = _access_file(pagename, request)
 493     if not filename:
 494         return
 495 
 496     request.write('<h2>' + _("Upload '%(filename)s'") % {'filename': filename} + '</h2>')
 497     # show a download link above the content
 498     label = _('Download')
 499     link = (fmt.url(1, getAttachUrl(pagename, filename, request, do='get'), css_class="download") +
 500             fmt.text(label) +
 501             fmt.url(0))
 502     request.write('%s<br><br>' % link)
 503 
 504     if filename.endswith('.tdraw') or filename.endswith('.adraw'):
 505         request.write(fmt.attachment_drawing(filename, ''))
 506         return
 507 
 508     mt = wikiutil.MimeType(filename=filename)
 509 
 510     # destinguishs if browser need a plugin in place
 511     if mt.major == 'image' and mt.minor in config.browser_supported_images:
 512         url = getAttachUrl(pagename, filename, request)
 513         request.write('<img src="%s" alt="%s">' % (
 514             wikiutil.escape(url, 1),
 515             wikiutil.escape(filename, 1)))
 516         return
 517     elif mt.major == 'text':
 518         ext = os.path.splitext(filename)[1]
 519         Parser = wikiutil.getParserForExtension(request.cfg, ext)
 520         if Parser is not None:
 521             try:
 522                 content = file(fpath, 'r').read()
 523                 content = wikiutil.decodeUnknownInput(content)
 524                 colorizer = Parser(content, request, filename=filename)
 525                 colorizer.format(request.formatter)
 526                 return
 527             except IOError:
 528                 pass
 529 
 530         request.write(request.formatter.preformatted(1))
 531         # If we have text but no colorizing parser we try to decode file contents.
 532         content = open(fpath, 'r').read()
 533         content = wikiutil.decodeUnknownInput(content)
 534         content = wikiutil.escape(content)
 535         request.write(request.formatter.text(content))
 536         request.write(request.formatter.preformatted(0))
 537         return
 538 
 539     try:
 540         package = packages.ZipPackage(request, fpath)
 541         if package.isPackage():
 542             request.write("<pre><b>%s</b>\n%s</pre>" % (_("Package script:"), wikiutil.escape(package.getScript())))
 543             return
 544 
 545         if zipfile.is_zipfile(fpath) and mt.minor == 'zip':
 546             zf = zipfile.ZipFile(fpath, mode='r')
 547             request.write("<pre>%-46s %19s %12s\n" % (_("File Name"), _("Modified")+" "*5, _("Size")))
 548             for zinfo in zf.filelist:
 549                 date = "%d-%02d-%02d %02d:%02d:%02d" % zinfo.date_time
 550                 request.write(wikiutil.escape("%-46s %s %12d\n" % (zinfo.filename, date, zinfo.file_size)))
 551             request.write("</pre>")
 552             return
 553     except RuntimeError:
 554         # We don't want to crash with a traceback here (an exception
 555         # here could be caused by an uploaded defective zip file - and
 556         # if we crash here, the user does not get a UI to remove the
 557         # defective zip file again).
 558         # RuntimeError is raised by zipfile stdlib module in case of
 559         # problems (like inconsistent slash and backslash usage in the
 560         # archive).
 561         logging.exception("An exception within zip file upload handling occurred:")
 562         return
 563 
 564     from MoinMoin import macro
 565     from MoinMoin.parser.text import Parser
 566 
 567     macro.request = request
 568     macro.formatter = request.html_formatter
 569     p = Parser("##\n", request)
 570     m = macro.Macro(p)
 571 
 572     # use EmbedObject to view valid mime types
 573     if mt is None:
 574         request.write('<p>' + _("Unknown file type, cannot display this upload inline.") + '</p>')
 575         link = (fmt.url(1, getAttachUrl(pagename, filename, request)) +
 576                 fmt.text(filename) +
 577                 fmt.url(0))
 578         request.write('For using an external program follow this link %s' % link)
 579         return
 580     request.write(m.execute('EmbedObject', u'target="%s", pagename="%s"' % (filename, pagename)))
 581     return
 582 
 583 def _do_view(pagename, request):
 584     _ = request.getText
 585 
 586     orig_pagename = pagename
 587     pagename, filename, fpath = _access_file(pagename, request)
 588     if not request.user.may.read(pagename):
 589         return _('You are not allowed to view uploads from this page.')
 590     if not filename:
 591         return
 592 
 593     request.formatter.page = Page(request, pagename)
 594 
 595     # send header & title
 596     # Use user interface language for this generated page
 597     request.setContentLanguage(request.lang)
 598     title = _('upload:%(filename)s of %(pagename)s') % {
 599         'filename': filename, 'pagename': pagename}
 600     request.theme.send_title(title, pagename=pagename)
 601 
 602     # send body
 603     request.write(request.formatter.startContent())
 604     send_viewfile(orig_pagename, request)
 605     send_uploadform(pagename, request)
 606     request.write(request.formatter.endContent())
 607 
 608     request.theme.send_footer(pagename)
 609     request.theme.send_closing_html()