django-whiteneuron 0.2.48.5__tar.gz → 0.3.0__tar.gz

{django_whiteneuron-0.2.48.5 → django_whiteneuron-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-whiteneuron
-Version: 0.2.48.5
+Version: 0.3.0
 Summary: A modern Django Admin extension with enhanced UI/UX, dashboard, feedback, file management, rate limiting, IP blacklisting, and advanced admin integrations built on django-unfold.
 Author-email: White Neuron <anhnt@whiteneuron.ai>
 License: MIT License
@@ -96,7 +96,7 @@ A modern Django Admin extension focused on UI/UX, dashboard, feedback, file mana
 
 ## Current Version
 
-- 0.2.48.3
+- 0.3.0
 
 ## Compatibility
 
@@ -107,7 +107,20 @@ A modern Django Admin extension focused on UI/UX, dashboard, feedback, file mana
 
 ## Changelog
 
-### v0.2.48.4 (2026-04-11) — latest
+### v0.3.0 (2026-04-13) — latest
+**Feature: File integrity protection — SHA-256 hash verification for ExcelFile & PDFFile**
+- **Added**: `compute_file_hash()` function — computes SHA-256 of a `FieldFile` via direct `storage.open()` to avoid Django internal state issues (works for both in-memory uploads and committed storage files).
+- **Added**: `BaseFile.save()` override — automatically computes and stores SHA-256 hash on every new upload; resets `status='done'` when file is replaced after an error; backfills hash for existing files with no hash.
+- **Added**: `BaseFile.verify_integrity()` — compares live storage hash against stored hash; returns `False` if missing or mismatched.
+- **Added**: `download_file` view — `@login_required` endpoint at `file-management/download/<type>/<pk>/`; enrolls legacy records on first download, blocks tampered files with `403 Forbidden`, marks them `status='error'`.
+- **Added**: `file_management/urls.py` — wired into `base/urls.py`.
+- **Added**: `FileInputNoDownload` widget — extends `UnfoldAdminFileFieldWidget` with a custom template that removes the direct download button; adds `accepted_file_types` support per admin subclass (`.xlsx,.xls,.csv` for Excel; `.pdf` for PDF).
+- **Added**: `BaseFileAdmin` enhancements — `integrity_status`, `hash_display`, `current_hash_display` readonly fields; `verified_download` smart button (primary button when OK, error badge when tampered/missing); `change_view` shows Django error message banner on integrity failure; `get_fieldsets` context-aware layout (auto/upload/new).
+- **Fixed**: `status_view` / `method_view` XSS — replaced f-string + `format_html` pattern with proper `format_html(template, *args)` escaping.
+- **Fixed**: `file.delete(save=False)` in `BaseFile.delete()` — prevents extra `save()` call after file deletion.
+- **Improved**: `accepted_file_types` class attribute on admin subclasses — browser-level file type filtering in upload dialog.
+
+### v0.2.48.4 (2026-04-11)
 **Security: Nâng cấp cbor2 5.9.0 và ujson 5.12.0**
 - **Security**: `cbor2` nâng từ `v5.8.0` lên `v5.9.0` — bản vá lỗi và cải thiện encoding/decoding CBOR.
 - **Security**: `ujson` nâng từ `v5.11.0` lên `v5.12.0` — bản vá bảo mật và cải thiện hiệu suất JSON serialization.

{django_whiteneuron-0.2.48.5 → django_whiteneuron-0.3.0}/README.md

@@ -11,7 +11,7 @@ A modern Django Admin extension focused on UI/UX, dashboard, feedback, file mana
 
 ## Current Version
 
-- 0.2.48.3
+- 0.3.0
 
 ## Compatibility
 
@@ -22,7 +22,20 @@ A modern Django Admin extension focused on UI/UX, dashboard, feedback, file mana
 
 ## Changelog
 
-### v0.2.48.4 (2026-04-11) — latest
+### v0.3.0 (2026-04-13) — latest
+**Feature: File integrity protection — SHA-256 hash verification for ExcelFile & PDFFile**
+- **Added**: `compute_file_hash()` function — computes SHA-256 of a `FieldFile` via direct `storage.open()` to avoid Django internal state issues (works for both in-memory uploads and committed storage files).
+- **Added**: `BaseFile.save()` override — automatically computes and stores SHA-256 hash on every new upload; resets `status='done'` when file is replaced after an error; backfills hash for existing files with no hash.
+- **Added**: `BaseFile.verify_integrity()` — compares live storage hash against stored hash; returns `False` if missing or mismatched.
+- **Added**: `download_file` view — `@login_required` endpoint at `file-management/download/<type>/<pk>/`; enrolls legacy records on first download, blocks tampered files with `403 Forbidden`, marks them `status='error'`.
+- **Added**: `file_management/urls.py` — wired into `base/urls.py`.
+- **Added**: `FileInputNoDownload` widget — extends `UnfoldAdminFileFieldWidget` with a custom template that removes the direct download button; adds `accepted_file_types` support per admin subclass (`.xlsx,.xls,.csv` for Excel; `.pdf` for PDF).
+- **Added**: `BaseFileAdmin` enhancements — `integrity_status`, `hash_display`, `current_hash_display` readonly fields; `verified_download` smart button (primary button when OK, error badge when tampered/missing); `change_view` shows Django error message banner on integrity failure; `get_fieldsets` context-aware layout (auto/upload/new).
+- **Fixed**: `status_view` / `method_view` XSS — replaced f-string + `format_html` pattern with proper `format_html(template, *args)` escaping.
+- **Fixed**: `file.delete(save=False)` in `BaseFile.delete()` — prevents extra `save()` call after file deletion.
+- **Improved**: `accepted_file_types` class attribute on admin subclasses — browser-level file type filtering in upload dialog.
+
+### v0.2.48.4 (2026-04-11)
 **Security: Nâng cấp cbor2 5.9.0 và ujson 5.12.0**
 - **Security**: `cbor2` nâng từ `v5.8.0` lên `v5.9.0` — bản vá lỗi và cải thiện encoding/decoding CBOR.
 - **Security**: `ujson` nâng từ `v5.11.0` lên `v5.12.0` — bản vá bảo mật và cải thiện hiệu suất JSON serialization.

{django_whiteneuron-0.2.48.5 → django_whiteneuron-0.3.0}/django_whiteneuron.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-whiteneuron
-Version: 0.2.48.5
+Version: 0.3.0
 Summary: A modern Django Admin extension with enhanced UI/UX, dashboard, feedback, file management, rate limiting, IP blacklisting, and advanced admin integrations built on django-unfold.
 Author-email: White Neuron <anhnt@whiteneuron.ai>
 License: MIT License
@@ -96,7 +96,7 @@ A modern Django Admin extension focused on UI/UX, dashboard, feedback, file mana
 
 ## Current Version
 
-- 0.2.48.3
+- 0.3.0
 
 ## Compatibility
 
@@ -107,7 +107,20 @@ A modern Django Admin extension focused on UI/UX, dashboard, feedback, file mana
 
 ## Changelog
 
-### v0.2.48.4 (2026-04-11) — latest
+### v0.3.0 (2026-04-13) — latest
+**Feature: File integrity protection — SHA-256 hash verification for ExcelFile & PDFFile**
+- **Added**: `compute_file_hash()` function — computes SHA-256 of a `FieldFile` via direct `storage.open()` to avoid Django internal state issues (works for both in-memory uploads and committed storage files).
+- **Added**: `BaseFile.save()` override — automatically computes and stores SHA-256 hash on every new upload; resets `status='done'` when file is replaced after an error; backfills hash for existing files with no hash.
+- **Added**: `BaseFile.verify_integrity()` — compares live storage hash against stored hash; returns `False` if missing or mismatched.
+- **Added**: `download_file` view — `@login_required` endpoint at `file-management/download/<type>/<pk>/`; enrolls legacy records on first download, blocks tampered files with `403 Forbidden`, marks them `status='error'`.
+- **Added**: `file_management/urls.py` — wired into `base/urls.py`.
+- **Added**: `FileInputNoDownload` widget — extends `UnfoldAdminFileFieldWidget` with a custom template that removes the direct download button; adds `accepted_file_types` support per admin subclass (`.xlsx,.xls,.csv` for Excel; `.pdf` for PDF).
+- **Added**: `BaseFileAdmin` enhancements — `integrity_status`, `hash_display`, `current_hash_display` readonly fields; `verified_download` smart button (primary button when OK, error badge when tampered/missing); `change_view` shows Django error message banner on integrity failure; `get_fieldsets` context-aware layout (auto/upload/new).
+- **Fixed**: `status_view` / `method_view` XSS — replaced f-string + `format_html` pattern with proper `format_html(template, *args)` escaping.
+- **Fixed**: `file.delete(save=False)` in `BaseFile.delete()` — prevents extra `save()` call after file deletion.
+- **Improved**: `accepted_file_types` class attribute on admin subclasses — browser-level file type filtering in upload dialog.
+
+### v0.2.48.4 (2026-04-11)
 **Security: Nâng cấp cbor2 5.9.0 và ujson 5.12.0**
 - **Security**: `cbor2` nâng từ `v5.8.0` lên `v5.9.0` — bản vá lỗi và cải thiện encoding/decoding CBOR.
 - **Security**: `ujson` nâng từ `v5.11.0` lên `v5.12.0` — bản vá bảo mật và cải thiện hiệu suất JSON serialization.

{django_whiteneuron-0.2.48.5 → django_whiteneuron-0.3.0}/django_whiteneuron.egg-info/SOURCES.txt

@@ -91,11 +91,13 @@ whiteneuron/file_management/admin.py
 whiteneuron/file_management/apps.py
 whiteneuron/file_management/models.py
 whiteneuron/file_management/tests.py
+whiteneuron/file_management/urls.py
 whiteneuron/file_management/utils.py
 whiteneuron/file_management/views.py
 whiteneuron/file_management/migrations/0001_initial.py
 whiteneuron/file_management/migrations/0002_alter_excelfile_options_alter_pdffile_options_and_more.py
 whiteneuron/file_management/migrations/0003_alter_excelfile_created_at_and_more.py
+whiteneuron/file_management/migrations/0004_excelfile_hash_pdffile_hash.py
 whiteneuron/file_management/migrations/__init__.py
 whiteneuron/locale/vi/LC_MESSAGES/django.mo
 whiteneuron/locale/vi/LC_MESSAGES/django.po
@@ -173,6 +175,7 @@ whiteneuron/templates/admin/base/userprofile_change_form.html
 whiteneuron/templates/admin/feedbacks/feedback_change_form.html
 whiteneuron/templates/base/forms/wysiwyg.html
 whiteneuron/templates/base/forms/helpers/toolbar.html
+whiteneuron/templates/file_management/widgets/clearable_file_input_no_download.html
 whiteneuron/templates/unfold/helpers/account_links.html
 whiteneuron/templates/unfold/helpers/app_list_badge.html
 whiteneuron/templates/unfold/helpers/field_password.html

{django_whiteneuron-0.2.48.5 → django_whiteneuron-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "django-whiteneuron"
-version = "0.2.48.5"
+version = "0.3.0"
 description = "A modern Django Admin extension with enhanced UI/UX, dashboard, feedback, file management, rate limiting, IP blacklisting, and advanced admin integrations built on django-unfold."
 authors = [
     {name = "White Neuron", email = "anhnt@whiteneuron.ai"}

{django_whiteneuron-0.2.48.5 → django_whiteneuron-0.3.0}/whiteneuron/base/urls.py

@@ -24,4 +24,5 @@ urlpatterns += [
     path("base/guest-login/", GuestLoginView.as_view(), name="guest_login"),
     # path("i18n/", include("django.conf.urls.i18n")),
     path("ckeditor5/", include('django_ckeditor_5.urls')),
+    path("file-management/", include('whiteneuron.file_management.urls')),
 ]

django_whiteneuron-0.3.0/whiteneuron/file_management/admin.py

@@ -0,0 +1,163 @@
+from whiteneuron.base.admin import base_admin_site, ModelAdmin
+from django.contrib import admin, messages
+from django.urls import reverse
+from django.utils.html import format_html
+from django.utils.translation import gettext_lazy as _
+from unfold.widgets import UnfoldAdminFileFieldWidget
+
+from .models import ExcelFile, PDFFile, compute_file_hash
+
+
+class FileInputNoDownload(UnfoldAdminFileFieldWidget):
+    """Unfold-styled file widget with the download button removed."""
+    template_name = "file_management/widgets/clearable_file_input_no_download.html"
+
+class BaseFileAdmin(ModelAdmin):
+    file_type = None  # Set in subclasses: 'excel' | 'pdf'
+    accepted_file_types = None  # e.g. '.xlsx,.xls' — passed as HTML accept attribute
+
+    list_display = ("title", "method_view", "status_view", "created_at", "created_by")
+    search_fields = ("title", "description")
+    filter_horizontal = ()
+    list_filter = ("status", "method")
+    readonly_fields = (
+        "created_at", "created_by", "updated_at", "updated_by",
+        "status_view", "method_view", "integrity_status", "verified_download",
+        "hash_display", "current_hash_display",
+    )
+    # fieldsets is intentionally omitted — get_fieldsets() handles all cases dynamically.
+
+    def _get_current_hash(self, obj, request=None):
+        """Compute the current SHA-256 hash of the file on storage. No caching — always fresh."""
+        try:
+            return compute_file_hash(obj.file)
+        except Exception:
+            return None
+
+    def formfield_for_dbfield(self, db_field, request, **kwargs):
+        field = super().formfield_for_dbfield(db_field, request, **kwargs)
+        if db_field.name == 'file' and field is not None:
+            attrs = dict(field.widget.attrs)
+            if self.accepted_file_types:
+                attrs['accept'] = self.accepted_file_types
+            field.widget = FileInputNoDownload(attrs=attrs)
+        return field
+
+    def get_readonly_fields(self, request, obj=None):
+        readonly = super().get_readonly_fields(request, obj)
+        if obj and obj.method == 'auto':
+            readonly = tuple(readonly) + ('file',)
+        return readonly
+
+    def get_fieldsets(self, request, obj=None):
+        # For auto-method files: replace editable 'file' with 'verified_download'.
+        # For upload-method files: show 'file' widget (for replacing) + verified_download link.
+        # For new objects (no pk): only show 'file' upload widget.
+        if obj and obj.method == 'auto':
+            file_fields = ('verified_download',)
+        elif obj and obj.pk:
+            file_fields = ('file', 'verified_download')
+        else:
+            file_fields = ('file',)
+        integrity_fields = ('integrity_status', 'hash_display', 'current_hash_display') if (obj and obj.pk) else ()
+        return (
+            (_('General Information'), {
+                'fields': ('title', 'description',
+                           'status_view',
+                           'method_view',
+                           *file_fields,
+                           *integrity_fields),
+            }),
+            (_("Meta"), {
+                'fields': ('created_at', 'created_by', 'updated_at', 'updated_by')
+            }),
+        )
+
+    def integrity_status(self, obj):
+        if not obj.pk or not obj.hash:
+            return format_html('<span style="color: #aaa;">—</span>')
+        current = self._get_current_hash(obj)
+        if current is None:
+            return format_html('<span style="color: #dd4b39;">⚠ {}</span>', _('Cannot read file'))
+        if current == obj.hash:
+            return format_html('<span style="color: #00a65a; font-weight: bold;">✓ OK</span>')
+        return format_html('<span style="color: #dd4b39; font-weight: bold;">✗ {}</span>', _('File has been modified'))
+    integrity_status.short_description = _('Integrity')
+
+    def hash_display(self, obj):
+        if not obj.pk or not obj.hash:
+            return format_html('<span style="color: #aaa;">—</span>')
+        return format_html(
+            '<code style="font-family: monospace; font-size: 0.85em; word-break: break-all;">{}</code>',
+            obj.hash
+        )
+    hash_display.short_description = _('Stored hash')
+
+    def current_hash_display(self, obj):
+        if not obj.pk or not obj.file or not obj.file.name:
+            return format_html('<span style="color: #aaa;">—</span>')
+        current = self._get_current_hash(obj)
+        if current is None:
+            return format_html('<span style="color: #dd4b39;">⚠ {}</span>', _('Cannot read file from storage'))
+        color = '#dd4b39' if (obj.hash and current != obj.hash) else '#aaa'
+        return format_html(
+            '<code style="font-family: monospace; font-size: 0.85em; word-break: break-all; color: {};">{}</code>',
+            color, current
+        )
+    current_hash_display.short_description = _('Current hash (live)')
+
+    def change_view(self, request, object_id, form_url='', extra_context=None):
+        obj = self.get_object(request, object_id)
+        if obj and obj.hash and obj.file and obj.file.name:
+            current = self._get_current_hash(obj)
+            if current is None:
+                messages.error(request, _('Cannot read the file from storage. It may have been deleted externally.'))
+            elif current != obj.hash:
+                messages.error(
+                    request,
+                    _('File integrity check failed: the file on storage does not match its stored hash. '
+                      'It may have been tampered with or corrupted.')
+                )
+        return super().change_view(request, object_id, form_url, extra_context)
+
+    def verified_download(self, obj):
+        if not obj.pk or not self.file_type:
+            return format_html('<span style="color: #aaa;">—</span>')
+        url = reverse('file_management_download', kwargs={'file_type': self.file_type, 'pk': obj.pk})
+        current = self._get_current_hash(obj)
+        if current is None:
+            return format_html(
+                '<span class="ui-badge ui-badge-error gap-1">'
+                '<span class="material-symbols-outlined" style="font-size: 14px;">error</span>'
+                '{}'
+                '</span>',
+                _('File missing')
+            )
+        if obj.hash and current != obj.hash:
+            return format_html(
+                '<span class="ui-badge ui-badge-error gap-1">'
+                '<span class="material-symbols-outlined" style="font-size: 14px;">gpp_bad</span>'
+                '{}'
+                '</span>',
+                _('Tampered — download blocked')
+            )
+        return format_html(
+            '<a href="{}" target="_blank" class="ui-btn ui-btn-primary ui-btn-sm gap-1">'
+            '<span class="material-symbols-outlined" style="font-size: 16px;">download</span>'
+            '{}'
+            '</a>',
+            url, _('Download (Verified)')
+        )
+    verified_download.short_description = _('Verified Download')
+
+
+@admin.register(ExcelFile, site=base_admin_site)
+class ExcelFileAdmin(BaseFileAdmin):
+    file_type = 'excel'
+    accepted_file_types = '.xlsx,.xls,.csv'
+
+
+@admin.register(PDFFile, site=base_admin_site)
+class PDFFileAdmin(BaseFileAdmin):
+    file_type = 'pdf'
+    accepted_file_types = '.pdf'

django_whiteneuron-0.3.0/whiteneuron/file_management/migrations/0004_excelfile_hash_pdffile_hash.py

@@ -0,0 +1,23 @@
+# Generated by Django 5.2.13 on 2026-04-13 02:45
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('file_management', '0003_alter_excelfile_created_at_and_more'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='excelfile',
+            name='hash',
+            field=models.CharField(blank=True, max_length=64, null=True, verbose_name='Hash'),
+        ),
+        migrations.AddField(
+            model_name='pdffile',
+            name='hash',
+            field=models.CharField(blank=True, max_length=64, null=True, verbose_name='Hash'),
+        ),
+    ]

django_whiteneuron-0.3.0/whiteneuron/file_management/models.py

@@ -0,0 +1,121 @@
+import hashlib
+
+from whiteneuron.base.models import BaseModel
+from django.db import models
+from django.utils.html import format_html
+from django.utils.translation import gettext_lazy as _
+
+
+def compute_file_hash(file_field):
+    """Compute SHA-256 hash of a Django FieldFile (uncommitted upload or committed storage file)."""
+    sha256 = hashlib.sha256()
+    if not file_field._committed:
+        # Newly uploaded file in memory/temp – read directly from the upload object
+        f = file_field.file
+        try:
+            f.seek(0)
+        except (AttributeError, OSError):
+            pass
+        for chunk in iter(lambda: f.read(8192), b''):
+            sha256.update(chunk)
+        try:
+            f.seek(0)  # Reset so Django can still write it to storage
+        except (AttributeError, OSError):
+            pass
+    else:
+        # File is on storage – open directly through the storage backend to avoid
+        # FieldFile internal state issues (e.g. when triggered from FieldFile.save()).
+        with file_field.storage.open(file_field.name, 'rb') as f:
+            for chunk in iter(lambda: f.read(8192), b''):
+                sha256.update(chunk)
+    return sha256.hexdigest()
+
+class BaseFile(BaseModel):
+    title = models.CharField(max_length=255)
+    description = models.TextField(blank=True, null=True, verbose_name=_('Description'))
+    status = models.CharField(max_length=25, choices=(('pending', _('Pending')),
+                                                      ('done', _('Done')),
+                                                      ('error', _('Error'))),
+                                                      default='done', verbose_name=_('Status'))
+    method= models.CharField(max_length=25, choices=(('upload', _('Upload')),
+                                                     ('auto', _('Auto'))),
+                                                     default='upload', verbose_name=_('Method'))
+    hash = models.CharField(max_length=64, blank=True, null=True, verbose_name=_('Hash'))
+
+    def status_view(self):
+        if self.status == 'pending':
+            status_color = '#f39c12'
+            status = _('Pending')
+        elif self.status == 'done':
+            status_color = '#00a65a'
+            status = _('Done')
+        else:
+            status_color = '#dd4b39'
+            status = _('Error')
+        return format_html(
+            '<span style="color: {}; font-weight: bold;">{}</span>',
+            status_color, status
+        )
+    status_view.short_description = _('Status')
+
+    def method_view(self):
+        if self.method == 'upload':
+            method_color = '#00c0ef'
+            method = _('Upload')
+        else:
+            method_color = '#00a65a'
+            method = _('Auto')
+        return format_html(
+            '<span style="color: {}; font-weight: bold;">{}</span>',
+            method_color, method
+        )
+    method_view.short_description = _('Method')
+
+    def save(self, *args, **kwargs):
+        update_fields = kwargs.get('update_fields')
+        # Skip hash logic when only specific fields are being updated (e.g. status)
+        if update_fields is None and self.file and self.file.name:
+            if not self.file._committed:
+                # New upload in memory – hash before writing to storage
+                self.hash = compute_file_hash(self.file)
+                # A new file replaces any previous error state
+                if self.status == 'error':
+                    self.status = 'done'
+            elif not self.hash:
+                # File already in storage but no hash yet (auto/programmatic creation)
+                self.hash = compute_file_hash(self.file)
+        super().save(*args, **kwargs)
+
+    def verify_integrity(self):
+        """Verify the file on storage matches its stored hash. Returns True if OK."""
+        if not self.hash or not self.file or not self.file.name:
+            return False
+        try:
+            return compute_file_hash(self.file) == self.hash
+        except Exception:
+            return False
+
+    def __str__(self):
+        return self.title
+
+    class Meta:
+        abstract = True
+
+    def delete(self, *args, **kwargs):
+        self.file.delete(save=False)
+        super().delete(*args, **kwargs)
+
+class ExcelFile(BaseFile):
+    file = models.FileField(upload_to='excels')
+
+
+    class Meta:
+        verbose_name = _('Excel File')
+        verbose_name_plural = _('Excel Files')
+
+class PDFFile(BaseFile):
+    file = models.FileField(upload_to='pdfs')
+
+    class Meta:
+        verbose_name = _('PDF File')
+        verbose_name_plural = _('PDF Files')

django_whiteneuron-0.3.0/whiteneuron/file_management/urls.py

@@ -0,0 +1,7 @@
+from django.urls import path
+
+from .views import download_file
+
+urlpatterns = [
+    path('download/<str:file_type>/<int:pk>/', download_file, name='file_management_download'),
+]

django_whiteneuron-0.3.0/whiteneuron/file_management/views.py

@@ -0,0 +1,50 @@
+import posixpath
+
+from django.contrib.auth.decorators import login_required
+from django.http import FileResponse, HttpResponseForbidden, Http404
+from django.utils.translation import gettext_lazy as _
+
+from .models import ExcelFile, PDFFile, compute_file_hash
+
+_FILE_MODEL_MAP = {
+    'excel': ExcelFile,
+    'pdf': PDFFile,
+}
+
+
+@login_required
+def download_file(request, file_type, pk):
+    """Serve a file only after verifying its SHA-256 hash integrity."""
+    model_class = _FILE_MODEL_MAP.get(file_type)
+    if model_class is None:
+        raise Http404
+
+    try:
+        instance = model_class.objects.get(pk=pk, is_deleted=False)
+    except model_class.DoesNotExist:
+        raise Http404
+
+    if not instance.hash:
+        # Legacy record: no hash yet. Enroll it now and allow download.
+        if not instance.file or not instance.file.name:
+            return HttpResponseForbidden(
+                str(_('Cannot read file from storage. The file may be missing.'))
+            )
+        try:
+            instance.hash = compute_file_hash(instance.file)
+            instance.save(update_fields=['hash'])
+        except Exception:
+            return HttpResponseForbidden(
+                str(_('Cannot read file from storage. The file may be missing.'))
+            )
+    elif not instance.verify_integrity():
+        # Hash exists but does not match – file was tampered with.
+        if instance.status != 'error':
+            instance.status = 'error'
+            instance.save(update_fields=['status'])
+        return HttpResponseForbidden(
+            str(_('File integrity check failed. This file may have been tampered with and cannot be downloaded.'))
+        )
+
+    filename = posixpath.basename(instance.file.name)
+    return FileResponse(instance.file.open('rb'), as_attachment=True, filename=filename)

{django_whiteneuron-0.2.48.5 → django_whiteneuron-0.3.0}/whiteneuron/locale/vi/LC_MESSAGES/django.po

@@ -1409,6 +1409,62 @@ msgstr "Trước"
 msgid "Next"
 msgstr "Tiếp theo"
 
+#: whiteneuron/file_management/admin.py
+msgid "Integrity"
+msgstr "Toàn vẹn"
+
+#: whiteneuron/file_management/admin.py
+msgid "Stored hash"
+msgstr "Hash lưu trữ"
+
+#: whiteneuron/file_management/admin.py
+msgid "Current hash (live)"
+msgstr "Hash hiện tại (thực tế)"
+
+#: whiteneuron/file_management/admin.py
+msgid "Cannot read file"
+msgstr "Không đọc được file"
+
+#: whiteneuron/file_management/admin.py
+msgid "Cannot read file from storage"
+msgstr "Không đọc được file từ storage"
+
+#: whiteneuron/file_management/admin.py
+msgid "File has been modified"
+msgstr "File bị thay đổi"
+
+#: whiteneuron/file_management/admin.py
+msgid "Verified Download"
+msgstr "Tải xuống (đã xác thực)"
+
+#: whiteneuron/file_management/admin.py
+msgid "Download (Verified)"
+msgstr "Tải xuống (đã xác thực)"
+
+#: whiteneuron/file_management/admin.py
+msgid "File missing"
+msgstr "File không tồn tại"
+
+#: whiteneuron/file_management/admin.py
+msgid "Tampered — download blocked"
+msgstr "File bị thay đổi — không thể tải"
+
+#: whiteneuron/file_management/admin.py
+msgid "Cannot read the file from storage. It may have been deleted externally."
+msgstr "Không đọc được file từ storage. File có thể đã bị xóa bên ngoài hệ thống."
+
+#: whiteneuron/file_management/admin.py
+msgid "File integrity check failed: the file on storage does not match its stored hash. It may have been tampered with or corrupted."
+msgstr "Kiểm tra toàn vẹn thất bại: file trên storage không khớp với hash đã lưu. File có thể đã bị thay đổi hoặc bị hỏng."
+
+#: whiteneuron/file_management/views.py
+msgid "Cannot read file from storage. The file may be missing."
+msgstr "Không đọc được file từ storage. File có thể đã bị xóa."
+
+#: whiteneuron/file_management/views.py
+msgid "File integrity check failed. This file may have been tampered with and cannot be downloaded."
+msgstr "Kiểm tra toàn vẹn thất bại. File có thể đã bị thay đổi và không thể tải xuống."
+
 #~ msgid "Feedback marked as resolved"
 #~ msgstr "Phản hồi đã được đánh dấu là đã giải quyết"