Theses days, I’ve added the ability to upload files in Aemanager for Ma Petite Auto Entreprise. Since a user may only access files he owns, a solution could have been putting them into an obfuscated directory (with a uid) in the media directory but I didn’t want to rely on such a solution which I consider not enough secure. I could have then let Apache serve theses files.
An other way to achieve this goal could be putting files in a directory not accessible by http, then in a view, read the file and stream the content with Django. It matches my goal but it isn’t efficient nor recommended to serve static files through Django.
The last solution, the better, is to use mod_xsendfile, a module for Apache. The user ask for a file represented by an arbitrary url and Django just sends a response without content, setting X-Sendfile header to tell Apache where it should read the content.
First, you need to install mod_xsendfile following these instructions :
$ sudo apxs2 -cia mod_xsendfile.c
Restart Apache when finished.
Here is a view of Aemanager which provide protected static files:
@settings_required
@subscription_required
def contract_uploaded_contract_download(request, id):
contract = get_object_or_404(Contract, pk=id, owner=request.user)
response = HttpResponse(mimetype='application/force-download')
response['Content-Disposition'] = 'attachment;filename="%s"'\
% smart_str(contract.contract_file.name)
response["X-Sendfile"] = "%s%s" % (settings.FILE_UPLOAD_DIR,
contract.contract_file.name)
response['Content-length'] = contract.contract_file.size
return response
Here the important thing is the X-Sendfile header.
However, there’s also a problem with files which have non-ascii characters in their name. The best solution I’ve found is to use:
unicodedata.normalize('NFKD', filename).encode('ascii', 'ignore')
This replaces characters such as « é » by their ascii equivalent, « e » in this case.
Here is my model to let you see how it’s done :
store = FileSystemStorage(location=settings.FILE_UPLOAD_DIR)
def contract_upload_to_handler(instance, filename):
return "%s/contract/%s" % (instance.owner.username,
unicodedata.normalize('NFKD',
filename).encode('ascii',
'ignore'))
class Contract(OwnedObject):
customer = models.ForeignKey(Contact,
verbose_name=_('Customer'),
related_name="contracts")
title = models.CharField(max_length=255,
verbose_name=_('Title'))
contract_file = models.FileField(upload_to=contract_upload_to_handler,
null=True,
blank=True,
storage=store,
verbose_name=_('Uploaded contract'))
content = models.TextField(verbose_name=_('Content'),
null=True,
blank=True)
update_date = models.DateField(verbose_name=_('Update date'),
help_text=_('format: mm/dd/yyyy'))
EDIT : The Xsendfile module also exists for nginx and charset issue in filename can be solved with header X-Accel-Charset: utf-8
