validate user data in gridftp

[qcg-portal.git] / filex / ftp.py

diff --git a/filex/ftp.py b/filex/ftp.py
index 49f470f..c9e90ff 100644 (file)
--- a/filex/ftp.py
+++ b/filex/ftp.py
@@ -4,7 +4,6 @@ from itertools import chain
 import os
 import re
 from threading import Event
-from urlparse import urlparse
 
 from django.utils.timezone import localtime, UTC
 from gridftp import FTPClient, Buffer, HandleAttr, OperationAttr
@@ -136,7 +135,7 @@ class FTPOperation:
         data = self.listing(url).next()
 
         if data['name'] == '.':
-            data['name'] = os.path.basename(urlparse(url).path.rstrip('/')) or u'/'
+            data['name'] = os.path.basename(os.path.normpath(url))
 
         return data
 
@@ -163,22 +162,28 @@ class FTPOperation:
         return False
 
     def compress(self, server, path, files, archive):
+        for value in [path, archive] + files:
+            if '#' in value:
+                raise ValueError('Illegal character `#` in {}'.format(value))
+
         if self.match_ext(archive, '.tar.gz', '.tgz'):
-            cmd, args = 'tar', ['cvzf', os.path.join(path, archive), '-C', path] + files
+            cmd, args = 'tar', ['cvzf', archive, '-C', path] + files
         elif self.match_ext(archive, '.tar.bz2', '.tbz'):
-            cmd, args = 'tar', ['cvjf', os.path.join(path, archive), '-C', path] + files
+            cmd, args = 'tar', ['cvjf', archive, '-C', path] + files
         elif self.match_ext(archive, '.zip'):
-            cmd, args = 'jar', (['cvMf', os.path.join(path, archive)] +
-                                list(chain.from_iterable(('-C', path, f) for f in files)))
+            cmd, args = 'jar', (['cvMf', archive] + list(chain.from_iterable(('-C', path, f) for f in files)))
         else:
             raise ValueError('Unknown archive type: {}'.format(archive))
 
-        # FIXME handling filename with #
         self.op_attr.set_disk_stack('#'.join(["popen:argv=", cmd] + args))
 
         return self.get(server)
 
     def extract(self, server, archive, dst):
+        for value in [archive, dst]:
+            if '#' in value:
+                raise ValueError('Illegal character `#` in {}'.format(value))
+
         if self.match_ext(archive, '.tar.gz', '.tgz'):
             cmd, args = 'tar', ('xvzf', archive, '-C', dst)
         elif self.match_ext(archive, '.tar.bz2', '.tbz'):
@@ -188,7 +193,6 @@ class FTPOperation:
         else:
             raise ValueError('Unknown archive type: {}'.format(archive))
 
-        # FIXME handling filename with #
         self.op_attr.set_disk_stack('#'.join(("popen:argv=", cmd) + args))
 
         return self.get(server)