You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Remove potentially dangerous names if name in {'', '.', '..'}: raise SuspiciousFileOperation("Could not derive file name from '%s'" % name)
The class ChunkedUploadView initializes the file with an empty name:
def create_chunked_upload(self, save=False, **attrs): """ Creates new chunked upload instance. Called if no 'upload_id' is found in the POST data. """ chunked_upload = self.model(**attrs) # file starts empty chunked_upload.file.save(name='', content=ContentFile(''), save=save) return chunked_upload
The name needs to be changed to something not empty to fix this issue.
Until this issue is fixed, it is possible to override create_chunked_upload with a custom class:
`
class MyChunkedUploadView(ChunkedUploadView):
"""
This view receives the posted chunk
"""
model = ChunkedUploadedFile
field_name = 'the_file'
def create_chunked_upload(self, save=False, **attrs):
"""
Creates new chunked upload instance. Called if no 'upload_id' is
found in the POST data.
"""
chunked_upload = self.model(**attrs)
# file starts empty
chunked_upload.file.save(name='tmp', content=ContentFile(''), save=save)
return chunked_upload`
The text was updated successfully, but these errors were encountered:
steverecio
added a commit
to steverecio/django-chunked-upload
that referenced
this issue
May 6, 2021
A new file security checkup in Django 2.2.21 throws SuspiciousFileOperation.
For reference see:
https://docs.djangoproject.com/en/dev/releases/2.2.21/
django/django@04ac162
Django now prevents empty file name:
# Remove potentially dangerous names if name in {'', '.', '..'}: raise SuspiciousFileOperation("Could not derive file name from '%s'" % name)
The class ChunkedUploadView initializes the file with an empty name:
def create_chunked_upload(self, save=False, **attrs): """ Creates new chunked upload instance. Called if no 'upload_id' is found in the POST data. """ chunked_upload = self.model(**attrs) # file starts empty chunked_upload.file.save(name='', content=ContentFile(''), save=save) return chunked_upload
The name needs to be changed to something not empty to fix this issue.
Until this issue is fixed, it is possible to override create_chunked_upload with a custom class:
`
class MyChunkedUploadView(ChunkedUploadView):
"""
This view receives the posted chunk
"""
The text was updated successfully, but these errors were encountered: