24 lines
837 B
Python
24 lines
837 B
Python
|
from pathlib import Path
|
||
|
|
|
||
|
|
from django.conf import settings
|
||
|
|
from django.http import FileResponse, Http404
|
||
|
|
from django.views.decorators.http import require_safe
|
||
|
|
|
||
|
|
|
||
|
|
@require_safe
|
||
|
|
def protected_media(request, path):
|
||
|
|
"""Download company uploads through the application authentication gate.
|
||
|
|
|
||
|
|
The invited pilot has one company per deployment. MEDIA_ROOT must contain
|
||
|
|
uploads only; operational databases and credentials live outside this root.
|
||
|
|
"""
|
||
|
|
root = Path(settings.MEDIA_ROOT).resolve()
|
||
|
|
try:
|
||
|
|
target = (root / path).resolve()
|
||
|
|
if not target.is_relative_to(root) or not target.is_file():
|
||
|
|
raise Http404
|
||
|
|
file = target.open('rb')
|
||
|
|
except (OSError, RuntimeError, ValueError) as exc:
|
||
|
|
raise Http404 from exc
|
||
|
|
return FileResponse(file, as_attachment=True, filename=target.name)
|