django-pfx 1.7.6.dev19__tar.gz → 1.7.6.dev21__tar.gz

{django_pfx-1.7.6.dev19 → django_pfx-1.7.6.dev21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-pfx
-Version: 1.7.6.dev19
+Version: 1.7.6.dev21
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com

{django_pfx-1.7.6.dev19 → django_pfx-1.7.6.dev21}/django_pfx.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-pfx
-Version: 1.7.6.dev19
+Version: 1.7.6.dev21
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com

django_pfx-1.7.6.dev21/django_pfx.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "1.7.5",
+  "distance": 21,
+  "node": "g98a0193f46175f1dd1f3465750eda84d310bdbfc",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-10-05"
+}

{django_pfx-1.7.6.dev19 → django_pfx-1.7.6.dev21}/pfx/pfxcore/default_settings.py

@@ -35,6 +35,15 @@ STORAGE_S3_AWS_GET_URL_EXPIRE = None
 
 STORAGE_LOCAL_ROOT = None
 STORAGE_LOCAL_X_ACCEL_REDIRECT = False
+# Served from the application domain, so a type the browser renders as a
+# document (text/html, image/svg+xml, …) would run its scripts there.
+STORAGE_INLINE_CONTENT_TYPES = [
+    'application/pdf',
+    'image/gif',
+    'image/jpeg',
+    'image/png',
+    'image/webp',
+]
 
 PFX_TEST_MODE = False
 

{django_pfx-1.7.6.dev19 → django_pfx-1.7.6.dev21}/pfx/pfxcore/locale/fr/LC_MESSAGES/django.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-09-28 18:07+0200\n"
+"POT-Creation-Date: 2026-10-01 06:30+0200\n"
 "PO-Revision-Date: 2021-06-22 23:31+0200\n"
 "Last-Translator: \n"
 "Language-Team: \n"
@@ -22,7 +22,7 @@ msgstr ""
 msgid "An internal server error occured."
 msgstr "Une erreur interne du serveur est survenue."
 
-#: default_settings.py:56
+#: default_settings.py:65
 msgid "A system error occurred. Our support team has been notified."
 msgstr ""
 "Une erreur système s’est produite. Notre équipe d’assistance en a été "
@@ -328,7 +328,7 @@ msgstr ""
 msgid "Invalid value for {filter} filter"
 msgstr "Valeur invalide pour le filtre {filter}"
 
-#: views/media_rest_view_mixin.py:38 views/media_rest_view_mixin.py:126
+#: views/media_rest_view_mixin.py:43 views/media_rest_view_mixin.py:133
 msgid "Unexpected storage error"
 msgstr "Erreur de stockage inattendue"
 

{django_pfx-1.7.6.dev19 → django_pfx-1.7.6.dev21}/pfx/pfxcore/views/media_rest_view_mixin.py

@@ -29,6 +29,11 @@ def get_medial_field(model, field):
     return model_field
 
 
+def is_inline_content_type(content_type):
+    mime = (content_type or '').split(';')[0].strip().lower()
+    return mime in settings.STORAGE_INLINE_CONTENT_TYPES
+
+
 def get_media_field_response(obj, field, request):
     mediaField = get_medial_field(obj, field)
     try:
@@ -40,7 +45,9 @@ def get_media_field_response(obj, field, request):
     if mediaField.storage.direct:
         attr = getattr(obj, field)
         filename = attr.get('name')
-        inline = get_bool(request.GET, "inline")
+        inline = (
+            get_bool(request.GET, "inline") and
+            is_inline_content_type(attr.get('content-type')))
         if settings.STORAGE_LOCAL_X_ACCEL_REDIRECT:
             response = HttpResponse()
             response["Content-Disposition"] = content_disposition_header(

{django_pfx-1.7.6.dev19 → django_pfx-1.7.6.dev21}/tests/tests/basic_api_test.py

@@ -855,20 +855,20 @@ class BasicAPITest(TestAssertMixin, TestCase):
         (`=?utf-8?q?…?=`), which browsers cannot read, so "inline" was
         lost. The ";" would also have cut the unquoted name short.
         FileResponse is checked too, as both paths must agree.
+        A PDF, so that "inline" is honoured.
         """
         response = self.client.post('/api/books', dict(
             name="Test Book",
             author=self.author1.pk,
             pub_date='2000-01-01',
             local_file=dict(
-                name='Crédit; école[…].txt',
-                base64='data:text/plain;charset=utf-8;'
-                'base64,VGVzdCBjb250ZW50')))
+                name='Crédit; école[…].pdf',
+                base64='data:application/pdf;base64,VGVzdCBjb250ZW50')))
         self.assertRC(response, 200)
         url = f"/api/books/{self.get_val(response, 'pk')}/local_file"
         name = (
             "filename*=utf-8''"
-            "Cr%C3%A9dit%3B%20%C3%A9cole%5B%E2%80%A6%5D.txt")
+            "Cr%C3%A9dit%3B%20%C3%A9cole%5B%E2%80%A6%5D.pdf")
 
         for x_accel in (True, False):
             with override_settings(STORAGE_LOCAL_X_ACCEL_REDIRECT=x_accel):
@@ -882,6 +882,36 @@ class BasicAPITest(TestAssertMixin, TestCase):
                 self.assertEqual(
                     response['Content-Disposition'], f"inline; {name}")
 
+    def test_get_file_inline_unsafe_type(self):
+        """A file the browser would render as a page is never inline.
+
+        Served from the application domain, an HTML or SVG file opened
+        with "?inline=true" would run its scripts with the session of
+        whoever follows the link. The type is guessed from the name at
+        upload, so the name alone decides; both serving paths are checked.
+        """
+        for filename, inline in (
+                ('page.html', False), ('image.svg', False),
+                ('note.txt', False), ('photo.png', True)):
+            response = self.client.post('/api/books', dict(
+                name=f"Book {filename}",
+                author=self.author1.pk,
+                pub_date='2000-01-01',
+                local_file=dict(
+                    name=filename,
+                    base64='data:text/html;base64,'
+                    'PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==')))
+            self.assertRC(response, 200)
+            url = f"/api/books/{self.get_val(response, 'pk')}/local_file"
+            for x_accel in (True, False):
+                with self.subTest(filename=filename, x_accel=x_accel), \
+                        override_settings(
+                            STORAGE_LOCAL_X_ACCEL_REDIRECT=x_accel):
+                    response = self.client.get(f"{url}?inline=true")
+                    self.assertRC(response, 200)
+                    self.assertTrue(response['Content-Disposition'].startswith(
+                        'inline;' if inline else 'attachment;'))
+
     def test_create_null_values(self):
         response = self.client.post(
             '/api/books', dict(

django_pfx-1.7.6.dev19/django_pfx.egg-info/scm_version.json

@@ -1,8 +0,0 @@
-{
-  "tag": "1.7.5",
-  "distance": 19,
-  "node": "g6a7661ad6478b59ebe1bd7310ec3c072f901e77e",
-  "dirty": false,
-  "branch": "HEAD",
-  "node_date": "2026-09-30"
-}