dinislage/web2py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

made admin uploads more secure

Browse Source
This commit is contained in:
mdipierro
2012-07-28 20:51:18 -05:00
parent 1a20488a0d
commit c7a7890148
5 changed files with 23 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
applications/admin/views/default/design.html
+3
View File
@@ -19,6 +19,7 @@ def file_upload_form(location, anchor=None):
INPUT(_type="file",_name="file")," ",T("and rename it:")," ",
INPUT(_type="text",_name="filename",requires=IS_NOT_EMPTY),
INPUT(_type="hidden",_name="location",_value=location),
INPUT(_type="hidden",_name="token",_value=session.token),
INPUT(_type="hidden",_name="sender",_value=URL('design',args=app, anchor=anchor)),
INPUT(_type="submit",_value=T("upload")),_action=URL('upload_file'))
return form
@@ -27,6 +28,7 @@ def file_create_form(location, anchor=None):
INPUT(_type="text",_name="filename",requires=IS_NOT_EMPTY),
INPUT(_type="hidden",_name="location",_value=location),
INPUT(_type="hidden",_name="sender",_value=URL('design',args=app)),
INPUT(_type="hidden",_name="token",_value=session.token),
INPUT(_type="hidden",_name="id",_value=anchor),
INPUT(_type="submit",_value=T("Create")),_action=URL('create_file'))
return form
@@ -34,6 +36,7 @@ def upload_plugin_form(app, anchor=None):
form=FORM(T("upload plugin file:")," ",
INPUT(_type="file",_name="pluginfile"),
INPUT(_type="hidden",_name="id",_value=anchor),
INPUT(_type="hidden",_name="token",_value=session.token),
INPUT(_type="submit",_value=T("upload")))
return form
def deletefile(arglist, vars={}):
applications/admin/views/default/git_pull.html
+2 -6
View File
@@ -1,9 +1,5 @@
{{extend 'layout.html'}}
<center>
<div class="center">
<h2>{{=T('This will pull changes from the remote repo for application "%s"?', app)}}</h2>
<table><tr>
<td>{{=FORM(INPUT(_type='submit',_name='cancel',_value=T('Cancel')))}}</td>
<td>{{=FORM(INPUT(_type='submit',_name='pull',_value=T('Pull')))}}</td>
</tr></table>
</center>
{{=dialog}}
applications/admin/views/default/plugin.html
+2 -5
View File
@@ -16,6 +16,7 @@ def file_upload_form(location):
INPUT(_type="file",_name="file")," ",T("and rename it:")," ",
INPUT(_type="text",_name="filename",requires=IS_NOT_EMPTY),
INPUT(_type="hidden",_name="location",_value=location),
INPUT(_type="hidden",_name="token",_value=session.token),
INPUT(_type="hidden",_name="sender",_value=URL('design/'+app)),
INPUT(_type="submit",_value=T("submit")),_action=URL('upload_file'))
return form
@@ -23,14 +24,10 @@ def file_create_form(location):
form=FORM(T("create file with filename:")," ",
INPUT(_type="text",_name="filename",requires=IS_NOT_EMPTY),
INPUT(_type="hidden",_name="location",_value=location),
INPUT(_type="hidden",_name="token",_value=session.token),
INPUT(_type="hidden",_name="sender",_value=URL('design/'+app)),
INPUT(_type="submit",_value=T("submit")),_action=URL('create_file'))
return form
def upload_plugin_form(app):
form=FORM(T("upload plugin file:")," ",
INPUT(_type="file",_name="pluginfile"),
INPUT(_type="submit",_value=T("submit")))
return form
def deletefile(arglist):
return A(TAG[''](IMG(_src=URL('static', 'images/delete_icon.png')), SPAN(T('Delete this file (you will be asked to confirm deletion)'))), _class='icon delete tooltip', _href=URL('delete',args=arglist,vars=dict(sender=request.function+'/'+app)))
}}