From c8b258c6a601b8ee5ff60aa877db37d10515ad2e Mon Sep 17 00:00:00 2001
From: "holger.trampe" <htrampe@gmail.com>
Date: Sat, 15 Feb 2020 21:39:32 +0100
Subject: [PATCH] Dateivalidierung Client und Serverseitig eingebaut

---
 cloud/__pycache__/views.cpython-38.pyc | Bin 4856 -> 5152 bytes
 cloud/templates/cloud/cloud_main.html  |  47 ++++++++++++++++++++++---
 cloud/views.py                         |  17 +++++++--
 3 files changed, 57 insertions(+), 7 deletions(-)

diff --git a/cloud/__pycache__/views.cpython-38.pyc b/cloud/__pycache__/views.cpython-38.pyc
index d137defec4fbb4226aa37a07bc9990d50e5b6e0c..8ed2c763954e42b552627dfe0fc1e2de8e626367 100644
GIT binary patch
delta 640
zcmX9)&rcIU6yDjHvg?*D{Y42@s!*$~6h!eCAYP~zI7m%_z!)Wl*A_~p+wDecvKtO^
z@jxV*c=J#&UWukBFDCvMW-rEr@$Aib(bsj7_r7o5_vU*q^E=f}2Uc`llkj|9oqzmh
z=wskdPhUS?V;FN7&1ohElvk8Bvf`aG<>5DF$iu(NjEA%8n1@f*2OfS=Uwc?Q^^-C)
zD`vHYz0bB(mEhcte25k3cNB|OSyi?Pgbs+Kpn4jH2c@dN9fy%40?9$i3Bh?t!3DSo
zX~@7O7=<j1!8lxo3Ah4RVG^#vb+`dH;TB9)Von%+BX&3^J&HO}J8Fk;8Z})YPDDGT
z4cCs~@U(cZC6m(!K1Z{)wt6HHX_w(c**as(HienD@=H>bGPgTFv`Mn(l5tbVe{iYQ
zvN&B{Tjtc*t+=#sKhIg!C{<jxSh$<#v}#m1T`V9g<nCb;lsVmOKI3$*xXNj6Y0jlk
z-{cJ08fQpboG#_it`2BiD0Gbti!)@XBW-1Tu88-Jk|B}r{czUxHI3S~WkzwEOuspW
zU?#e0xtmr*pKhdFwY*&`ZIp0T{YkA>e_nzO>xEHja>WzsJ1()ro<2hM#j$P<(3m_y
z7*UBvRJn(wi6%4Igibs#L*nb`dxFvI#Uv3XCrCn8$%t&Oi$>pfQWnMFLU;?cjPie-
mdE{nAoCNRqy5&#eS8$kYbt0jC;)kx*wKTWHakxkys{ViHKc?yc

delta 338
zcmZ3W@k5m_l$V!_0SKZ4JmUUJZ{+*M#xDruvIDU*5Eq|fo-EGZ$;@21XYyipOE7((
zT^3CLXSW8^wj8=(I+r65OdsUv2h+iv&zYHv_Dr_r@|5?hVaQ@gQOIVR02E0Ptz|D^
z&SJ@8s$onK>}9NFpUls#EUVPZTFX_#wSZ$G10zF;bPZDtbBgjDre?-q22GXCq1?ud
zlUaE67-c3K^KOtR5&^nSQ?SSqNEOL}2!9X}Fqw(3VDfZ6CB~A;yZDOO88sL=n2KUH
zJM&vJN{0YdECk|W9w5QM$igJYD96OXsKithGI^%JL&mtt)q<Wv2|zhbc8I|qKz335
o<ZFU<tRUevlO=@|851^J3$-wE$AIKOMiwPZJ|!H??8m_k09(dT*Z=?k

diff --git a/cloud/templates/cloud/cloud_main.html b/cloud/templates/cloud/cloud_main.html
index da6481f..a0df428 100644
--- a/cloud/templates/cloud/cloud_main.html
+++ b/cloud/templates/cloud/cloud_main.html
@@ -197,6 +197,26 @@ a.disabled {
   </div>
 </div>
 
+<!-- FILE FORBIDDEN DELETE FILE -->
+<div class="modal fade" id="forbiddenFileType" tabindex="-1" role="dialog" data-backdrop="static" aria-labelledby="groupDelFunction" aria-hidden="true">
+  <div class="modal-dialog " role="document">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title" id="exampleModalLongTitle">Datei nicht erlaubt</h5>
+        <button type="button" class="close" data-dismiss="modal" aria-label="Schließen">
+          <span aria-hidden="true">&times;</span>
+        </button>
+      </div>
+      <div class="modal-body">        
+        Diesen Dateitypen dürfen Sie nicht hochladen.
+      </div>
+      <div class="modal-footer">        
+        <button type="button" class="btn btn-success" data-dismiss="modal">Schließen</button>
+      </div>
+    </div>
+  </div>
+</div>
+
 <!-- CONFIRMA DELETE FILE -->
 <div class="modal fade" id="delDataFile" tabindex="-1" role="dialog" data-backdrop="static" aria-labelledby="groupDelFunction" aria-hidden="true">
   <div class="modal-dialog " role="document">
@@ -481,10 +501,16 @@ $('.droppable_div').on('dragleave', function (e) {
         $("#{{parentid}}_div").removeClass('bg-secondary');         
     });    
 
+allowedtypes = "application/msword, application/vnd.ms-excel, application/vnd.ms-powerpoint, text/plain, application/pdf, image/*"
+
+
 function uploadAction(filetodo, parid){
   var formData = new FormData($("#uploadFileForm")[0]);
-  formData.append("uploadedfile", filetodo);  
-  $.ajax({
+  formData.append("uploadedfile", filetodo); 
+
+  console.log(filetodo.type);
+  if(allowedtypes.includes(filetodo.type) && filetodo.type.length > 0){
+    $.ajax({
         url: "{% url 'cloud-adddir' %}" + parid,
         headers: {
                       "X-CSRFTOKEN": "{{ csrf_token }}"
@@ -494,10 +520,21 @@ function uploadAction(filetodo, parid){
         cache: false,
         processData: false,
         contentType: false,
-        success: function() {
-          window.location = window.location;
+        success: function(data) {
+          console.log(data);
+          if(data["success"] == true){
+            window.location = window.location;  
+          }
+          else{
+            $("#forbiddenFileType").modal("toggle")
+          }
+          
         }
-     });
+     });  
+  }
+  else{
+    $("#forbiddenFileType").modal("toggle")
+  }
 }
 </script>
 {% endif %}
diff --git a/cloud/views.py b/cloud/views.py
index 36d8a3c..79b426f 100644
--- a/cloud/views.py
+++ b/cloud/views.py
@@ -152,8 +152,21 @@ def adddirbyajax(request, parent):
 	elif request.method == 'POST':
 		tempdir = False		
 		tempdir = DataDir.objects.get(pk=parent)
-		tempdatafile = DataFile(file=request.FILES['uploadedfile'], name=request.FILES['uploadedfile'].name, owner=request.user, parent=tempdir, agency=request.user.profile.agency)
-		tempdatafile.save()		
+
+		# VALIDATE FILE-TYPE
+		file_ext = request.FILES['uploadedfile'].name.split(".")[1]
+
+		allowed_types = ["txt", "TXT", "png", "PNG", "jpeg", "JPEG", "jpg", "JPG", "PDF", "pdf", "csv", "CSV", "DOC", "doc", "DOCX", "docx", "ODT", "odt", "PPT", "ppt", "PPTX", "pptx"]
+		file_ok = False
+		for t in allowed_types:
+			if t == file_ext:
+				file_ok = True
+
+		if(file_ok):
+			tempdatafile = DataFile(file=request.FILES['uploadedfile'], name=request.FILES['uploadedfile'].name, owner=request.user, parent=tempdir, agency=request.user.profile.agency)
+			tempdatafile.save()		
+		else:
+			success = False
 		
 	return JsonResponse({"success" : success, "data" : data})