Skip to content

Commit

Permalink
Replace abspath with fullpath.
Browse files Browse the repository at this point in the history
  • Loading branch information
pelson committed Oct 13, 2017
1 parent 4269515 commit ef1a639
Showing 1 changed file with 16 additions and 16 deletions.
32 changes: 16 additions & 16 deletions nbviewer/providers/local/handlers.py
Expand Up @@ -63,23 +63,23 @@ def breadcrumbs(self, path):
return breadcrumbs

@gen.coroutine
def download(self, abspath):
def download(self, fullpath):
"""Download the file at the given absolute path.
Parameters
==========
abspath: str
fullpath: str
Absolute path to the file
"""
filename = os.path.basename(abspath)
st = os.stat(abspath)
filename = os.path.basename(fullpath)
st = os.stat(fullpath)

self.set_header('Content-Length', st.st_size)
# Escape commas to workaround Chrome issue with commas in download filenames
self.set_header('Content-Disposition',
'attachment; filename={};'.format(filename.replace(',', '_')))

content = web.StaticFileHandler.get_content(abspath)
content = web.StaticFileHandler.get_content(fullpath)
if isinstance(content, bytes):
content = [content]
for chunk in content:
Expand All @@ -96,30 +96,30 @@ def can_show(self, path):
be applied at notebook render to confirm a file may be shown.
"""
abspath = os.path.realpath(os.path.normpath(os.path.join(
fullpath = os.path.realpath(os.path.normpath(os.path.join(
self.localfile_path,
path
)))

if not abspath.startswith(self.localfile_path):
if not fullpath.startswith(self.localfile_path):
app_log.warn("directory traversal attempt: '%s'" %
abspath)
fullpath)
return False

if not os.path.exists(abspath):
if not os.path.exists(fullpath):
return False

if any(part.startswith('.') or part.startswith('_')
for part in abspath.split(os.sep)):
for part in fullpath.split(os.sep)):
return False

fstat = os.stat(abspath)
fstat = os.stat(fullpath)

# Ensure the file/directory has other read access for all.
if not fstat.st_mode & stat.S_IROTH:
return False

if os.path.isdir(abspath) and not fstat.st_mode & stat.S_IXOTH:
if os.path.isdir(fullpath) and not fstat.st_mode & stat.S_IXOTH:
# skip directories we can't execute (i.e. list)
return False

Expand Down Expand Up @@ -173,12 +173,12 @@ def get(self, path):
breadcrumbs=self.breadcrumbs(path),
title=os.path.basename(path))

def show_dir(self, abspath, path):
def show_dir(self, fullpath, path):
"""Render the directory view template for a given filesystem path.
Parameters
==========
abspath: string
fullpath: string
Absolute path on disk to show
path: string
URL path equating to the path on disk
Expand All @@ -193,14 +193,14 @@ def show_dir(self, abspath, path):
ipynbs = []

try:
contents = os.listdir(abspath)
contents = os.listdir(fullpath)
except IOError as ex:
if ex.errno == errno.EACCES:
# py2/3: can't access the dir, so don't give away its presence
raise web.HTTPError(404)

for f in contents:
absf = os.path.join(abspath, f)
absf = os.path.join(fullpath, f)

if not self.can_show(absf):
continue
Expand Down

0 comments on commit ef1a639

Please sign in to comment.