1717@app .route ('/upload/<dir>' , methods = ['POST' ])
1818def upload (dir ):
1919 apikey = request .args .get ('apikey' )
20- dirname = dir + "_" + apikey
20+ dirname = secure_filename ( dir ) + "_" + apikey
2121
2222 if 'files[]' not in request .files :
2323 resp = jsonify ({'message' : 'No file in the request' })
@@ -62,10 +62,10 @@ def upload(dir):
6262def build (dir ):
6363 graphml_file = request .args .get ('fetch' )
6464 apikey = request .args .get ('apikey' )
65- dirname = dir + "_" + apikey
65+ dirname = secure_filename ( dir ) + "_" + apikey
6666 makestudy_dir = dirname + "/" + graphml_file #for makestudy
6767 dir_path = os .path .abspath (os .path .join (concore_path , graphml_file )) #path for ./build
68- if not os .path .exists (secure_filename ( dir_path ) ):
68+ if not os .path .exists (dir_path ):
6969 proc = call (["./makestudy" , makestudy_dir ], cwd = concore_path )
7070 if (proc == 0 ):
7171 resp = jsonify ({'message' : 'Directory successfully created' })
@@ -79,6 +79,7 @@ def build(dir):
7979
8080@app .route ('/debug/<dir>' , methods = ['POST' ])
8181def debug (dir ):
82+ dir = secure_filename (dir )
8283 dir_path = os .path .abspath (os .path .join (concore_path , dir ))
8384 proc = call (["./debug" ], cwd = dir_path )
8485 if (proc == 0 ):
@@ -93,6 +94,7 @@ def debug(dir):
9394
9495@app .route ('/run/<dir>' , methods = ['POST' ])
9596def run (dir ):
97+ dir = secure_filename (dir )
9698 dir_path = os .path .abspath (os .path .join (concore_path , dir ))
9799 proc = call (["./run" ], cwd = dir_path )
98100 if (proc == 0 ):
@@ -106,6 +108,7 @@ def run(dir):
106108
107109@app .route ('/stop/<dir>' , methods = ['POST' ])
108110def stop (dir ):
111+ dir = secure_filename (dir )
109112 dir_path = os .path .abspath (os .path .join (concore_path , dir ))
110113 proc = call (["./stop" ], cwd = dir_path )
111114 if (proc == 0 ):
@@ -120,6 +123,7 @@ def stop(dir):
120123
121124@app .route ('/clear/<dir>' , methods = ['POST' ])
122125def clear (dir ):
126+ dir = secure_filename (dir )
123127 dir_path = os .path .abspath (os .path .join (concore_path , dir ))
124128 proc = call (["./clear" ], cwd = dir_path )
125129 if (proc == 0 ):
@@ -131,20 +135,17 @@ def clear(dir):
131135 resp .status_code = 500
132136 return resp
133137
134- # to download /download/<dir>?fetch=<downloadfile>. For example, /download/test?fetch=example.py.out&apikey=xyz
138+ # to download /download/<dir>?fetch=<downloadfile>. For example, /download/test?fetchDir=xyz&fetch=u
135139@app .route ('/download/<dir>' , methods = ['POST' , 'GET' ])
136140def download (dir ):
137141 download_file = request .args .get ('fetch' )
138- apikey = request .args .get ('apikey' )
139- dirname = dir + "_" + apikey
140- directory_name = os .path .abspath (os .path .join (concore_path , secure_filename (dirname )))
141-
142-
143- if not os .path .exists (secure_filename (dirname )):
142+ sub_folder = request .args .get ('fetchDir' )
143+ dirname = secure_filename (dir ) + "/" + secure_filename (sub_folder )
144+ directory_name = os .path .abspath (os .path .join (concore_path , dirname ))
145+ if not os .path .exists (directory_name ):
144146 resp = jsonify ({'message' : 'Directory not found' })
145147 resp .status_code = 400
146148 return resp
147-
148149 try :
149150 return send_from_directory (directory_name , download_file , as_attachment = True )
150151 except :
@@ -155,6 +156,7 @@ def download(dir):
155156
156157@app .route ('/destroy/<dir>' , methods = ['DELETE' ])
157158def destroy (dir ):
159+ dir = secure_filename (dir )
158160 proc = call (["./destroy" , dir ], cwd = concore_path )
159161 if (proc == 0 ):
160162 resp = jsonify ({'message' : 'Successfuly deleted Dirctory' })
@@ -167,7 +169,9 @@ def destroy(dir):
167169
168170@app .route ('/getFilesList/<dir>' , methods = ['POST' ])
169171def getFilesList (dir ):
170- dir_path = os .path .abspath (os .path .join (concore_path , dir ))
172+ sub_dir = request .args .get ('fetch' )
173+ dirname = secure_filename (dir ) + "/" + secure_filename (sub_dir )
174+ dir_path = os .path .abspath (os .path .join (concore_path , dirname ))
171175 res = []
172176 res = os .listdir (dir_path )
173177 res = json .dumps (res )
0 commit comments