increased security in appadmin

applications/examples/controllers/appadmin.py

@@ -199,17 +199,8 @@ def select():
                 _class='delete', _type='checkbox', value=False), ''),
                 TR('', '', INPUT(_type='submit', _value=T('submit')))),
                 _action=URL(r=request,args=request.args))
-    if request.vars.csvfile != None:
-        try:
-            import_csv(db[request.vars.table],
-                       request.vars.csvfile.file)
-            response.flash = T('data uploaded')
-        except Exception, e:
-            response.flash = DIV(T('unable to parse csv file'),PRE(str(e)))
     if form.accepts(request.vars, formname=None):
-#         regex = re.compile(request.args[0] + '\.(?P<table>\w+)\.id\>0')
         regex = re.compile(request.args[0] + '\.(?P<table>\w+)\..+')
-
         match = regex.match(form.vars.query.strip())
         if match:
             table = match.group('table')
@@ -230,6 +221,23 @@ def select():
         except Exception, e:
             (rows, nrows) = ([], 0)
             response.flash = DIV(T('Invalid Query'),PRE(str(e)))
+    # begin handle upload csv
+    if table:
+        formcsv = FORM(str(T('or import from csv file'))+" ",
+                       INPUT(_type='file',_name='csvfile'),
+                       INPUT(_type='hidden',_value=table,_name='table'),
+                       INPUT(_type='submit',_value=T('import')))
+    else:
+        formcsv = None
+    if formcsv and formcsv.process().accepted and request.vars.csvfile:
+        try:
+            import_csv(db[request.vars.table],
+                       request.vars.csvfile.file)
+            response.flash = T('data uploaded')
+        except Exception, e:
+            response.flash = DIV(T('unable to parse csv file'),PRE(str(e)))
+    # end handle upload csv
+
     return dict(
         form=form,
         table=table,
@@ -238,6 +246,7 @@ def select():
         nrows=nrows,
         rows=rows,
         query=request.vars.query,
+        formcsv = formcsv,
         )