fix validation of favorites locations

[qcg-portal.git] / filex / uploadhandler.py

diff --git a/filex/uploadhandler.py b/filex/uploadhandler.py
index 75a6cd7..600524f 100644 (file)
--- a/filex/uploadhandler.py
+++ b/filex/uploadhandler.py
@@ -1,9 +1,11 @@
 from functools import wraps
+import os
 
 from django.core.files.uploadedfile import UploadedFile
 from django.core.files.uploadhandler import FileUploadHandler, StopUpload, StopFutureHandlers
 from django.views.decorators.csrf import csrf_exempt, csrf_protect
 
+from filex.forms import HostPathForm
 from filex.ftp import FTPOperation
 
 
@@ -15,19 +17,17 @@ class FtpUploadHandler(FileUploadHandler):
     def new_file(self, file_name, *args, **kwargs):
         super(FtpUploadHandler, self).new_file(file_name, *args, **kwargs)
 
-        # TODO limit to selected request.path
-        # TODO validate host and path
-        host = self.request.GET.get('host')
-        path = self.request.GET.get('path')
+        form = HostPathForm(self.request.GET)
 
-        if self.request.user.is_anonymous() or not host or not path:
+        if self.request.user.is_anonymous() or not form.is_valid():
             raise StopUpload(connection_reset=True)
 
         if self.ftp is None:
             self.ftp = FTPOperation(self.request.session['proxy'], self.chunk_size)
 
-        self.url = 'gsiftp://' + host + path + self.file_name
-        self.tmp_url = 'gsiftp://' + host + path + self.file_name + '.part'
+        self.url = 'gsiftp://{}/{}'.format(form.cleaned_data['host'],
+                                           os.path.join(form.cleaned_data['path'], self.file_name))
+        self.tmp_url = self.url + '.part'
 
         self.ftp.put(self.tmp_url)