diff --git a/apps/filebrowser/src/filebrowser/api.py b/apps/filebrowser/src/filebrowser/api.py index b7e5dc0d8c5..d8f24b24427 100644 --- a/apps/filebrowser/src/filebrowser/api.py +++ b/apps/filebrowser/src/filebrowser/api.py @@ -405,12 +405,14 @@ def upload_file(request): # Check if the file type is restricted _, file_type = os.path.splitext(uploaded_file.name) if RESTRICT_FILE_EXTENSIONS.get() and file_type.lower() in [ext.lower() for ext in RESTRICT_FILE_EXTENSIONS.get()]: - return HttpResponse(f'File type "{file_type}" is not allowed. Please choose a file with a different type.', status=400) + return HttpResponse(f'Uploading files with type "{file_type}" is not allowed. Hue is configured to restrict this type.', status=400) # Check if the file size exceeds the maximum allowed size max_size = MAX_FILE_SIZE_UPLOAD_LIMIT.get() if max_size >= 0 and uploaded_file.size >= max_size: - return HttpResponse(f'File exceeds maximum allowed size of {max_size} bytes. Please upload a smaller file.', status=413) + return HttpResponse( + f'File exceeds maximum allowed size of {max_size} bytes. Hue is configured to restrict uploads larger than this limit.', status=413 + ) # Check if the destination path is a directory and the file name contains a path separator # This prevents directory traversal attacks @@ -509,7 +511,7 @@ def rename(request): if dest_path_ext.lower() in restricted_file_types and (source_path_ext.lower() != dest_path_ext.lower()): return HttpResponse(f'Cannot rename file to a restricted file type: "{dest_path_ext}"', status=403) - # Check if destination path contains a hash character + # Check if destination path contains a hash character if "#" in destination_path: return HttpResponse("Hashes are not allowed in file or directory names. Please choose a different name.", status=400) diff --git a/apps/filebrowser/src/filebrowser/api_test.py b/apps/filebrowser/src/filebrowser/api_test.py index 54c2dfd498f..346d5d25c6e 100644 --- a/apps/filebrowser/src/filebrowser/api_test.py +++ b/apps/filebrowser/src/filebrowser/api_test.py @@ -110,9 +110,10 @@ def test_upload_invalid_file_type(self): ] try: response = upload_file(request) + res_content = response.content.decode('utf-8') assert response.status_code == 400 - assert response.content.decode('utf-8') == 'File type ".txt" is not allowed. Please choose a file with a different type.' + assert res_content == 'Uploading files with type ".txt" is not allowed. Hue is configured to restrict this type.' finally: for reset in resets: reset() @@ -139,9 +140,10 @@ def test_upload_file_exceeds_max_size(self): ] try: response = upload_file(request) + res_content = response.content.decode('utf-8') assert response.status_code == 413 - assert response.content.decode('utf-8') == 'File exceeds maximum allowed size of 5 bytes. Please upload a smaller file.' + assert res_content == 'File exceeds maximum allowed size of 5 bytes. Hue is configured to restrict uploads larger than this limit.' finally: for reset in resets: reset()