| | 149 | |
|---|
| | 150 | def get_dir(root, dir, match="", content_types=None, index=""): |
|---|
| | 151 | request = cherrypy.request |
|---|
| | 152 | path = request.object_path |
|---|
| | 153 | |
|---|
| | 154 | if match and not re.search(match, path): |
|---|
| | 155 | return False |
|---|
| | 156 | |
|---|
| | 157 | if root == 'global': |
|---|
| | 158 | root = "/" |
|---|
| | 159 | root = root.rstrip(r"\/") |
|---|
| | 160 | |
|---|
| | 161 | branch = urllib.unquote(path[len(root) + 1:].lstrip(r"\/")) |
|---|
| | 162 | |
|---|
| | 163 | # If branch is "", file will end in a slash |
|---|
| | 164 | file = os.path.join(dir, branch) |
|---|
| | 165 | |
|---|
| | 166 | # There's a chance that the branch pulled from the URL might |
|---|
| | 167 | # have ".." or similar uplevel attacks in it. Check that the final |
|---|
| | 168 | # file is a child of dir. |
|---|
| | 169 | if not os.path.normpath(file).startswith(os.path.normpath(dir)): |
|---|
| | 170 | raise cherrypy.HTTPError(403) # Forbidden |
|---|
| | 171 | |
|---|
| | 172 | if not os.path.isabs(file): |
|---|
| | 173 | msg = "static directory requires an absolute path (got '%s')." % file |
|---|
| | 174 | raise cherrypy.WrongConfigValue(msg) |
|---|
| | 175 | |
|---|
| | 176 | def attempt(fname): |
|---|
| | 177 | # you can set the content types for a |
|---|
| | 178 | # complete directory per extension |
|---|
| | 179 | content_type = None |
|---|
| | 180 | if content_types: |
|---|
| | 181 | r, ext = os.path.splitext(fname) |
|---|
| | 182 | content_type = content_types.get(ext[1:], None) |
|---|
| | 183 | serve_file(fname, contentType=content_type) |
|---|
| | 184 | |
|---|
| | 185 | try: |
|---|
| | 186 | attempt(file) |
|---|
| | 187 | return True |
|---|
| | 188 | except cherrypy.NotFound: |
|---|
| | 189 | # If we didn't find the static file, continue handling the |
|---|
| | 190 | # request. We might find a dynamic handler instead. |
|---|
| | 191 | |
|---|
| | 192 | # But first check for an index file if a folder was requested. |
|---|
| | 193 | if index and file[-1] in (r"\/"): |
|---|
| | 194 | try: |
|---|
| | 195 | attempt(os.path.join(file, index)) |
|---|
| | 196 | return True |
|---|
| | 197 | except cherrypy.NotFound: |
|---|
| | 198 | pass |
|---|
| | 199 | return False |
|---|
| | 200 | |
|---|
| | 201 | |
|---|
| | 202 | def get_file(filename, match="", content_types=None): |
|---|
| | 203 | if not os.path.isabs(filename): |
|---|
| | 204 | msg = "static file requires an absolute path." |
|---|
| | 205 | raise cherrypy.WrongConfigValue(msg) |
|---|
| | 206 | |
|---|
| | 207 | request = cherrypy.request |
|---|
| | 208 | path = request.object_path |
|---|
| | 209 | |
|---|
| | 210 | if match and not re.search(match, path): |
|---|
| | 211 | return False |
|---|
| | 212 | |
|---|
| | 213 | try: |
|---|
| | 214 | # you can set the content types for a complete directory per extension |
|---|
| | 215 | content_type = None |
|---|
| | 216 | if content_types: |
|---|
| | 217 | root, ext = os.path.splitext(filename) |
|---|
| | 218 | content_type = content_types.get(ext[1:], None) |
|---|
| | 219 | serve_file(filename, contentType=content_type) |
|---|
| | 220 | return True |
|---|
| | 221 | except cherrypy.NotFound: |
|---|
| | 222 | # If we didn't find the static file, continue handling the |
|---|
| | 223 | # request. We might find a dynamic handler instead. |
|---|
| | 224 | return False |
|---|