python - 保护用户上传的文件 django

Question

如何允许用户将文件上传到他们自己的用户指定文件夹，并且只能看到他们上传的文件？我正在使用 Django 文件传输。目前它让我可以选择将媒体放入哪个文件，但我可以将它放入任何用户的文件并查看每个用户的媒体。这是我的 uploads/models.py:

from django.db import models
from django.contrib.auth.models import User, UserManager

def uploadmodel_file_upload_to(instance, filename):
    print 'instance.user.username = '+ str(instance.user.username)
    return 'uploads/%s/%s' % (instance.user.username, filename)

class UploadModel(models.Model):
    user = models.ForeignKey('auth.user')
    file = models.FileField(upload_to=uploadmodel_file_upload_to)

Answer 1

uploadmodel_file_upload_to 返回一个相对路径。为了构建完整路径，django 预先设置了 settings.MEDIA_ROOT。 MEDIA_ROOT 应该是公开可读的。

所以我们要将文件保存在MEDIA_ROOT之外。在 settings.py 中添加类似这样的内容:

import os.path
PROJECT_ROOT=os.path.abspath(os.path.dirname(__file__))
PROTECTED_MEDIA_ROOT=os.path.join(PROJECT_ROOT, 'protected_uploads')

现在您可以更新 uploadmodel_file_upload_to 以返回绝对路径:

def uploadmodel_file_upload_to(instance, filename):
    return '%s/%s/%s' % (settings.PROTECTED_MEDIA_ROOT, instance.user.username,
        filename)

既然文件保存在/project/path/protected_uploads，我们需要添加一个 View 来服务它，例如:

import os 
import mimetypes

from django import shortcuts
from django import http
from django.conf import settings
from django.views.static import was_modified_since
from django.utils.http import http_date

from .models import *

def serve_upload(request, upload_id):
    upload = shortcuts.get_object_or_404(UploadModel, pk=upload_id)
    fullpath = upload.file.path

    if request.user != upload.user:
        return http.HttpResponseForbidden()

    statobj = os.stat(fullpath)
    mimetype, encoding = mimetypes.guess_type(fullpath)
    mimetype = mimetype or 'application/octet-stream'
    if not was_modified_since(request.META.get('HTTP_IF_MODIFIED_SINCE'),
                              statobj.st_mtime, statobj.st_size):
        return http.HttpResponseNotModified(mimetype=mimetype)
    response = http.HttpResponse(open(fullpath, 'rb').read(), mimetype=mimetype)
    response["Last-Modified"] = http_date(statobj.st_mtime)
    response["Content-Length"] = statobj.st_size
    if encoding:
        response["Content-Encoding"] = encoding
    return response

还有一个网址:

url(r'serve_upload/(?P<upload_id>\d+)/$', 'serve_upload'),