Skip to content

Commit

Permalink
[api] Change error message for new upload public API (#3889)
Browse files Browse the repository at this point in the history
  • Loading branch information
Harshg999 authored Nov 25, 2024
1 parent a104a75 commit 6948861
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 5 deletions.
8 changes: 5 additions & 3 deletions apps/filebrowser/src/filebrowser/api.py
Original file line number Diff line number Diff line change
Expand Up @@ -405,12 +405,14 @@ def upload_file(request):
# Check if the file type is restricted
_, file_type = os.path.splitext(uploaded_file.name)
if RESTRICT_FILE_EXTENSIONS.get() and file_type.lower() in [ext.lower() for ext in RESTRICT_FILE_EXTENSIONS.get()]:
return HttpResponse(f'File type "{file_type}" is not allowed. Please choose a file with a different type.', status=400)
return HttpResponse(f'Uploading files with type "{file_type}" is not allowed. Hue is configured to restrict this type.', status=400)

# Check if the file size exceeds the maximum allowed size
max_size = MAX_FILE_SIZE_UPLOAD_LIMIT.get()
if max_size >= 0 and uploaded_file.size >= max_size:
return HttpResponse(f'File exceeds maximum allowed size of {max_size} bytes. Please upload a smaller file.', status=413)
return HttpResponse(
f'File exceeds maximum allowed size of {max_size} bytes. Hue is configured to restrict uploads larger than this limit.', status=413
)

# Check if the destination path is a directory and the file name contains a path separator
# This prevents directory traversal attacks
Expand Down Expand Up @@ -509,7 +511,7 @@ def rename(request):
if dest_path_ext.lower() in restricted_file_types and (source_path_ext.lower() != dest_path_ext.lower()):
return HttpResponse(f'Cannot rename file to a restricted file type: "{dest_path_ext}"', status=403)

# Check if destination path contains a hash character
# Check if destination path contains a hash character
if "#" in destination_path:
return HttpResponse("Hashes are not allowed in file or directory names. Please choose a different name.", status=400)

Expand Down
6 changes: 4 additions & 2 deletions apps/filebrowser/src/filebrowser/api_test.py
Original file line number Diff line number Diff line change
Expand Up @@ -110,9 +110,10 @@ def test_upload_invalid_file_type(self):
]
try:
response = upload_file(request)
res_content = response.content.decode('utf-8')

assert response.status_code == 400
assert response.content.decode('utf-8') == 'File type ".txt" is not allowed. Please choose a file with a different type.'
assert res_content == 'Uploading files with type ".txt" is not allowed. Hue is configured to restrict this type.'
finally:
for reset in resets:
reset()
Expand All @@ -139,9 +140,10 @@ def test_upload_file_exceeds_max_size(self):
]
try:
response = upload_file(request)
res_content = response.content.decode('utf-8')

assert response.status_code == 413
assert response.content.decode('utf-8') == 'File exceeds maximum allowed size of 5 bytes. Please upload a smaller file.'
assert res_content == 'File exceeds maximum allowed size of 5 bytes. Hue is configured to restrict uploads larger than this limit.'
finally:
for reset in resets:
reset()
Expand Down

0 comments on commit 6948861

Please sign in to comment.