Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>I'm currently using this code in a separated <code>s3utils</code> module:</p> <pre><code>from django.core.exceptions import SuspiciousOperation from django.utils.encoding import force_unicode from storages.backends.s3boto import S3BotoStorage def safe_join(base, *paths): """ A version of django.utils._os.safe_join for S3 paths. Joins one or more path components to the base path component intelligently. Returns a normalized version of the final path. The final path must be located inside of the base path component (otherwise a ValueError is raised). Paths outside the base path indicate a possible security sensitive operation. """ from urlparse import urljoin base_path = force_unicode(base) paths = map(lambda p: force_unicode(p), paths) final_path = urljoin(base_path + ("/" if not base_path.endswith("/") else ""), *paths) # Ensure final_path starts with base_path and that the next character after # the final path is '/' (or nothing, in which case final_path must be # equal to base_path). base_path_len = len(base_path) - 1 if not final_path.startswith(base_path) \ or final_path[base_path_len:base_path_len + 1] not in ('', '/'): raise ValueError('the joined path is located outside of the base path' ' component') return final_path class StaticRootS3BotoStorage(S3BotoStorage): def __init__(self, *args, **kwargs): super(StaticRootS3BotoStorage, self).__init__(*args, **kwargs) self.location = kwargs.get('location', '') self.location = 'static/' + self.location.lstrip('/') def _normalize_name(self, name): try: return safe_join(self.location, name).lstrip('/') except ValueError: raise SuspiciousOperation("Attempted access to '%s' denied." % name) class MediaRootS3BotoStorage(S3BotoStorage): def __init__(self, *args, **kwargs): super(MediaRootS3BotoStorage, self).__init__(*args, **kwargs) self.location = kwargs.get('location', '') self.location = 'media/' + self.location.lstrip('/') def _normalize_name(self, name): try: return safe_join(self.location, name).lstrip('/') except ValueError: raise SuspiciousOperation("Attempted access to '%s' denied." % name) </code></pre> <p>Then, in my settings module:</p> <pre><code>DEFAULT_FILE_STORAGE = 'myproyect.s3utils.MediaRootS3BotoStorage' STATICFILES_STORAGE = 'myproyect.s3utils.StaticRootS3BotoStorage' </code></pre> <p>I got to redefine the <code>_normalize_name()</code> private method to use a "fixed" version of the <code>safe_join()</code> function, since the original code is giving me <code>SuspiciousOperation</code> exceptions for legal paths.</p> <p>I'm posting this for consideration, if anyone can give a better answer or improve this one, it will be very welcome.</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload