django-pfx 1.7.6.dev19__tar.gz → 1.7.6.dev23__tar.gz

{django_pfx-1.7.6.dev19 → django_pfx-1.7.6.dev23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-pfx
-Version: 1.7.6.dev19
+Version: 1.7.6.dev23
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com

{django_pfx-1.7.6.dev19 → django_pfx-1.7.6.dev23}/django_pfx.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-pfx
-Version: 1.7.6.dev19
+Version: 1.7.6.dev23
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com

django_pfx-1.7.6.dev23/django_pfx.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "1.7.5",
+  "distance": 23,
+  "node": "g844445a9b16ab6666628821913df2ba5050b36d4",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-10-05"
+}

{django_pfx-1.7.6.dev19 → django_pfx-1.7.6.dev23}/pfx/pfxcore/default_settings.py

@@ -35,6 +35,15 @@ STORAGE_S3_AWS_GET_URL_EXPIRE = None
 
 STORAGE_LOCAL_ROOT = None
 STORAGE_LOCAL_X_ACCEL_REDIRECT = False
+# Served from the application domain, so a type the browser renders as a
+# document (text/html, image/svg+xml, …) would run its scripts there.
+STORAGE_INLINE_CONTENT_TYPES = [
+    'application/pdf',
+    'image/gif',
+    'image/jpeg',
+    'image/png',
+    'image/webp',
+]
 
 PFX_TEST_MODE = False
 

{django_pfx-1.7.6.dev19 → django_pfx-1.7.6.dev23}/pfx/pfxcore/fields/media_field.py

@@ -1,7 +1,9 @@
+import base64
+import binascii
 import io
 import logging
 from importlib import import_module
-from urllib.request import urlopen
+from urllib.parse import unquote_to_bytes
 
 from django.core.exceptions import ValidationError
 from django.db import models
@@ -15,6 +17,30 @@ logger = logging.getLogger(__name__)
 DEFAULT_KEYS = {"key", "name", "content-type", "content-length"}
 
 
+def decode_data_uri(value):
+    """Return the bytes carried by a ``data:`` URI, and only that.
+
+    The uploaded content reaches the server as this string. It used to be
+    handed to ``urlopen``, which also opens ``file://`` and ``http://``:
+    a client could then have the server read a local file or reach the
+    internal network. Only the ``data:`` scheme is accepted here, and it
+    is decoded in place, never opened.
+
+    :raises ValidationError: when the value is not a valid ``data:`` URI
+    """
+    if not isinstance(value, str) or not value.startswith('data:'):
+        raise ValidationError("Le contenu doit être une URI « data: ».")
+    header, sep, data = value[len('data:'):].partition(',')
+    if not sep:
+        raise ValidationError("URI « data: » invalide.")
+    if ';base64' in header:
+        try:
+            return base64.b64decode(data, validate=True)
+        except (binascii.Error, ValueError):
+            raise ValidationError("URI « data: » invalide.")
+    return unquote_to_bytes(data)
+
+
 def get_storage_class(class_path):
     ps = class_path.split('.')
     return getattr(import_module('.'.join(ps[:-1])), ps[-1])()
@@ -91,8 +117,10 @@ class MediaField(models.JSONField):
             after_save.append(lambda: self.delete(self._db_value))
             setattr(obj, self.name, None)
         if b64:
-            with urlopen(b64) as response:
-                file = response.read()
+            try:
+                file = decode_data_uri(b64)
+            except ValidationError as e:
+                raise ValidationError({self.name: e.messages})
             setattr(obj, self.name, dict(key=self.get_key(obj, name)))
             after_save.append(lambda: save_file(obj, file, name))
         return after_save

{django_pfx-1.7.6.dev19 → django_pfx-1.7.6.dev23}/pfx/pfxcore/locale/fr/LC_MESSAGES/django.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-09-28 18:07+0200\n"
+"POT-Creation-Date: 2026-10-01 06:30+0200\n"
 "PO-Revision-Date: 2021-06-22 23:31+0200\n"
 "Last-Translator: \n"
 "Language-Team: \n"
@@ -22,7 +22,7 @@ msgstr ""
 msgid "An internal server error occured."
 msgstr "Une erreur interne du serveur est survenue."
 
-#: default_settings.py:56
+#: default_settings.py:65
 msgid "A system error occurred. Our support team has been notified."
 msgstr ""
 "Une erreur système s’est produite. Notre équipe d’assistance en a été "
@@ -328,7 +328,7 @@ msgstr ""
 msgid "Invalid value for {filter} filter"
 msgstr "Valeur invalide pour le filtre {filter}"
 
-#: views/media_rest_view_mixin.py:38 views/media_rest_view_mixin.py:126
+#: views/media_rest_view_mixin.py:43 views/media_rest_view_mixin.py:133
 msgid "Unexpected storage error"
 msgstr "Erreur de stockage inattendue"
 

{django_pfx-1.7.6.dev19 → django_pfx-1.7.6.dev23}/pfx/pfxcore/views/media_rest_view_mixin.py

@@ -29,6 +29,11 @@ def get_medial_field(model, field):
     return model_field
 
 
+def is_inline_content_type(content_type):
+    mime = (content_type or '').split(';')[0].strip().lower()
+    return mime in settings.STORAGE_INLINE_CONTENT_TYPES
+
+
 def get_media_field_response(obj, field, request):
     mediaField = get_medial_field(obj, field)
     try:
@@ -40,7 +45,9 @@ def get_media_field_response(obj, field, request):
     if mediaField.storage.direct:
         attr = getattr(obj, field)
         filename = attr.get('name')
-        inline = get_bool(request.GET, "inline")
+        inline = (
+            get_bool(request.GET, "inline") and
+            is_inline_content_type(attr.get('content-type')))
         if settings.STORAGE_LOCAL_X_ACCEL_REDIRECT:
             response = HttpResponse()
             response["Content-Disposition"] = content_disposition_header(

{django_pfx-1.7.6.dev19 → django_pfx-1.7.6.dev23}/tests/tests/basic_api_test.py

@@ -847,6 +847,37 @@ class BasicAPITest(TestAssertMixin, TestCase):
         self.assertJE(response, 'local_file', None)
         self.assertFalse(Path(f'/tmp/django-pfx-filestore/{key2}').exists())
 
+    def test_create_file_rejects_non_data_uri(self):
+        """A media upload only accepts a ``data:`` URI.
+
+        The content used to be handed to ``urlopen``, so ``file://`` made
+        the server read a local file and ``http://`` reach the network.
+        Both are refused now, with a field error, before anything is read.
+        """
+        for uri in (
+                'file:///etc/hostname',
+                'http://169.254.169.254/latest/meta-data/',
+                'not a uri at all'):
+            response = self.client.post('/api/books', dict(
+                name="Test Book",
+                author=self.author1.pk,
+                pub_date='2000-01-01',
+                local_file=dict(name='x.txt', base64=uri)))
+            self.assertRC(response, 422)
+            self.assertJEExists(response, 'local_file')
+
+    def test_create_file_url_encoded_data_uri(self):
+        """A ``data:`` URI without ``;base64`` is percent-decoded, as
+        ``urlopen`` did, so that path keeps working without it."""
+        response = self.client.post('/api/books', dict(
+            name="Test Book",
+            author=self.author1.pk,
+            pub_date='2000-01-01',
+            local_file=dict(
+                name='test.txt', base64='data:text/plain,Hello%20world')))
+        self.assertRC(response, 200)
+        self.assertJE(response, 'local_file.content-length', '11')
+
     def test_get_file_content_disposition(self):
         """The file name must survive both local serving paths.
 
@@ -855,20 +886,20 @@ class BasicAPITest(TestAssertMixin, TestCase):
         (`=?utf-8?q?…?=`), which browsers cannot read, so "inline" was
         lost. The ";" would also have cut the unquoted name short.
         FileResponse is checked too, as both paths must agree.
+        A PDF, so that "inline" is honoured.
         """
         response = self.client.post('/api/books', dict(
             name="Test Book",
             author=self.author1.pk,
             pub_date='2000-01-01',
             local_file=dict(
-                name='Crédit; école[…].txt',
-                base64='data:text/plain;charset=utf-8;'
-                'base64,VGVzdCBjb250ZW50')))
+                name='Crédit; école[…].pdf',
+                base64='data:application/pdf;base64,VGVzdCBjb250ZW50')))
         self.assertRC(response, 200)
         url = f"/api/books/{self.get_val(response, 'pk')}/local_file"
         name = (
             "filename*=utf-8''"
-            "Cr%C3%A9dit%3B%20%C3%A9cole%5B%E2%80%A6%5D.txt")
+            "Cr%C3%A9dit%3B%20%C3%A9cole%5B%E2%80%A6%5D.pdf")
 
         for x_accel in (True, False):
             with override_settings(STORAGE_LOCAL_X_ACCEL_REDIRECT=x_accel):
@@ -882,6 +913,36 @@ class BasicAPITest(TestAssertMixin, TestCase):
                 self.assertEqual(
                     response['Content-Disposition'], f"inline; {name}")
 
+    def test_get_file_inline_unsafe_type(self):
+        """A file the browser would render as a page is never inline.
+
+        Served from the application domain, an HTML or SVG file opened
+        with "?inline=true" would run its scripts with the session of
+        whoever follows the link. The type is guessed from the name at
+        upload, so the name alone decides; both serving paths are checked.
+        """
+        for filename, inline in (
+                ('page.html', False), ('image.svg', False),
+                ('note.txt', False), ('photo.png', True)):
+            response = self.client.post('/api/books', dict(
+                name=f"Book {filename}",
+                author=self.author1.pk,
+                pub_date='2000-01-01',
+                local_file=dict(
+                    name=filename,
+                    base64='data:text/html;base64,'
+                    'PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==')))
+            self.assertRC(response, 200)
+            url = f"/api/books/{self.get_val(response, 'pk')}/local_file"
+            for x_accel in (True, False):
+                with self.subTest(filename=filename, x_accel=x_accel), \
+                        override_settings(
+                            STORAGE_LOCAL_X_ACCEL_REDIRECT=x_accel):
+                    response = self.client.get(f"{url}?inline=true")
+                    self.assertRC(response, 200)
+                    self.assertTrue(response['Content-Disposition'].startswith(
+                        'inline;' if inline else 'attachment;'))
+
     def test_create_null_values(self):
         response = self.client.post(
             '/api/books', dict(

django_pfx-1.7.6.dev19/django_pfx.egg-info/scm_version.json

@@ -1,8 +0,0 @@
-{
-  "tag": "1.7.5",
-  "distance": 19,
-  "node": "g6a7661ad6478b59ebe1bd7310ec3c072f901e77e",
-  "dirty": false,
-  "branch": "HEAD",
-  "node_date": "2026-09-30"
-}