views.py 文件源码

def get(self, request, *args, **kwargs):

        path = kwargs.get("path")

        # No path?  You're boned.  Move along.
        if not path:
            raise Http404

        if self._is_url(path):

            content = requests.get(path, stream=True).raw.read()

        else:

            # Normalise the path to strip out naughty attempts
            path = os.path.normpath(path).replace(
                settings.MEDIA_URL, settings.MEDIA_ROOT, 1)

            # Evil path request!
            if not path.startswith(settings.MEDIA_ROOT):
                raise Http404

            # The file requested doesn't exist locally.  A legit 404
            if not os.path.exists(path):
                raise Http404

            with open(path, "rb") as f:
                content = f.read()

        content = Cryptographer.decrypted(content)
        return HttpResponse(
            content, content_type=magic.Magic(mime=True).from_buffer(content))