b8ecb06436
- Validate filename returned by FileField.upload_to() not a filename passed to the FileField.generate_filename() (upload_to() may completely ignored passed filename). - Allow relative paths (without dot segments) in the generated filename. Thanks to Jakub Kleň for the report and review. Thanks to all folks for checking this patch on existing projects. Thanks Florian Apolloner and Markus Holtermann for the discussion and implementation idea. Regression in 0b79eb36915d178aef5c6a7bbce71b1e76d376d3. Backport of b55699968fc9ee985384c64e37f6cc74a0a23683 from main.
108 lines
4.0 KiB
Python
108 lines
4.0 KiB
Python
import os
|
|
import sys
|
|
import tempfile
|
|
import unittest
|
|
|
|
from django.core.exceptions import SuspiciousFileOperation
|
|
from django.core.files import File, temp
|
|
from django.core.files.base import ContentFile
|
|
from django.core.files.uploadedfile import TemporaryUploadedFile
|
|
from django.db.utils import IntegrityError
|
|
from django.test import TestCase, override_settings
|
|
|
|
from .models import Document
|
|
|
|
|
|
class FileFieldTests(TestCase):
|
|
|
|
def test_clearable(self):
|
|
"""
|
|
FileField.save_form_data() will clear its instance attribute value if
|
|
passed False.
|
|
"""
|
|
d = Document(myfile='something.txt')
|
|
self.assertEqual(d.myfile, 'something.txt')
|
|
field = d._meta.get_field('myfile')
|
|
field.save_form_data(d, False)
|
|
self.assertEqual(d.myfile, '')
|
|
|
|
def test_unchanged(self):
|
|
"""
|
|
FileField.save_form_data() considers None to mean "no change" rather
|
|
than "clear".
|
|
"""
|
|
d = Document(myfile='something.txt')
|
|
self.assertEqual(d.myfile, 'something.txt')
|
|
field = d._meta.get_field('myfile')
|
|
field.save_form_data(d, None)
|
|
self.assertEqual(d.myfile, 'something.txt')
|
|
|
|
def test_changed(self):
|
|
"""
|
|
FileField.save_form_data(), if passed a truthy value, updates its
|
|
instance attribute.
|
|
"""
|
|
d = Document(myfile='something.txt')
|
|
self.assertEqual(d.myfile, 'something.txt')
|
|
field = d._meta.get_field('myfile')
|
|
field.save_form_data(d, 'else.txt')
|
|
self.assertEqual(d.myfile, 'else.txt')
|
|
|
|
def test_delete_when_file_unset(self):
|
|
"""
|
|
Calling delete on an unset FileField should not call the file deletion
|
|
process, but fail silently (#20660).
|
|
"""
|
|
d = Document()
|
|
d.myfile.delete()
|
|
|
|
def test_refresh_from_db(self):
|
|
d = Document.objects.create(myfile='something.txt')
|
|
d.refresh_from_db()
|
|
self.assertIs(d.myfile.instance, d)
|
|
|
|
@unittest.skipIf(sys.platform == 'win32', "Crashes with OSError on Windows.")
|
|
def test_save_without_name(self):
|
|
with tempfile.NamedTemporaryFile(suffix='.txt') as tmp:
|
|
document = Document.objects.create(myfile='something.txt')
|
|
document.myfile = File(tmp)
|
|
msg = f"Detected path traversal attempt in '{tmp.name}'"
|
|
with self.assertRaisesMessage(SuspiciousFileOperation, msg):
|
|
document.save()
|
|
|
|
def test_defer(self):
|
|
Document.objects.create(myfile='something.txt')
|
|
self.assertEqual(Document.objects.defer('myfile')[0].myfile, 'something.txt')
|
|
|
|
def test_unique_when_same_filename(self):
|
|
"""
|
|
A FileField with unique=True shouldn't allow two instances with the
|
|
same name to be saved.
|
|
"""
|
|
Document.objects.create(myfile='something.txt')
|
|
with self.assertRaises(IntegrityError):
|
|
Document.objects.create(myfile='something.txt')
|
|
|
|
@unittest.skipIf(sys.platform.startswith('win'), "Windows doesn't support moving open files.")
|
|
# The file's source and destination must be on the same filesystem.
|
|
@override_settings(MEDIA_ROOT=temp.gettempdir())
|
|
def test_move_temporary_file(self):
|
|
"""
|
|
The temporary uploaded file is moved rather than copied to the
|
|
destination.
|
|
"""
|
|
with TemporaryUploadedFile('something.txt', 'text/plain', 0, 'UTF-8') as tmp_file:
|
|
tmp_file_path = tmp_file.temporary_file_path()
|
|
Document.objects.create(myfile=tmp_file)
|
|
self.assertFalse(os.path.exists(tmp_file_path), 'Temporary file still exists')
|
|
|
|
def test_open_returns_self(self):
|
|
"""
|
|
FieldField.open() returns self so it can be used as a context manager.
|
|
"""
|
|
d = Document.objects.create(myfile='something.txt')
|
|
# Replace the FileField's file with an in-memory ContentFile, so that
|
|
# open() doesn't write to disk.
|
|
d.myfile.file = ContentFile(b'', name='bla')
|
|
self.assertEqual(d.myfile, d.myfile.open())
|