fix breach in award points that allows user to award infinite points

[osqa.git] / forum_modules / exporter / views.py

diff --git a/forum_modules/exporter/views.py b/forum_modules/exporter/views.py
index defd6e01bc3710fc52f78f64984a6d4a3301e390..c7b3904dae76a70ab916b94babf884d28f1b2409 100644 (file)
--- a/forum_modules/exporter/views.py
+++ b/forum_modules/exporter/views.py
@@ -1,9 +1,11 @@
+from __future__ import with_statement
+
 import os, tarfile, ConfigParser, datetime
+import json
 
 from StringIO import StringIO
 from django.http import HttpResponse, HttpResponseRedirect, Http404
 from django.utils.translation import ugettext as _
-from django.utils import simplejson
 from django.core.cache import cache
 from django.core.urlresolvers import reverse
 from forum.views.admin import admin_tools_page, admin_page
@@ -13,16 +15,15 @@ from threading import Thread
 import settings as selsettings
 from forum import settings
 
-from exporter import export, CACHE_KEY, EXPORT_STEPS, LAST_BACKUP, DATE_AND_AUTHOR_INF_SECTION, DATETIME_FORMAT
+from exporter import export, CACHE_KEY, EXPORT_STEPS, DATE_AND_AUTHOR_INF_SECTION, DATETIME_FORMAT
 from importer import start_import
 
-
 @admin_tools_page(_('exporter'), _('XML data export'))
 def exporter(request):
     state = cache.get(CACHE_KEY)
 
     if state and state['running']:
-        return HttpResponseRedirect(reverse('exporter_running'))
+        return HttpResponseRedirect(reverse('exporter_running', kwargs=dict(mode='exporter')))
 
     if request.method == 'POST':
         form = ExporterForm(request.POST)
@@ -73,31 +74,29 @@ def running(request, mode):
     })
 
 def state(request):
-    return HttpResponse(simplejson.dumps(cache.get(CACHE_KEY)), mimetype="application/json")
+    return HttpResponse(json.dumps(cache.get(CACHE_KEY)), mimetype="application/json")
 
 @admin_page
 def download(request):
-    fname = LAST_BACKUP
+    if request.GET and request.GET.get('file', None):
+        fname = os.path.join(selsettings.EXPORTER_BACKUP_STORAGE, request.GET.get('file'))
+    else:
+        raise Http404
 
     if not os.path.exists(fname):
         raise Http404
 
-    response = HttpResponse(open(fname, 'rb').read(), content_type='application/x-gzip')
+    if fname.endswith('.gz'):
+        content_type='application/x-gzip'
+        filename = 'backup.tar.gz'
+    else:
+        content_type='application/zip'
+        filename = 'backup.zip'
+
+    response = HttpResponse(open(fname, 'rb').read(), content_type=content_type)
     response['Content-Length'] = os.path.getsize(fname)
-    response['Content-Disposition'] = 'attachment; filename=backup.tar.gz'
+    response['Content-Disposition'] = 'attachment; filename=%s' % filename
     return response
 
 
-@admin_page
-def importer(request):
-    thread = Thread(target=start_import, args=['/Users/admin/dev/pyenv/osqa/maintain/forum_modules/exporter/backups/localhost-201010121118.tar.gz', request.user])
-    thread.setDaemon(True)
-    thread.start()
-
-    return HttpResponseRedirect(reverse('exporter_running', kwargs=dict(mode='importer')))
-
-    #return ('modules/exporter/importer.html', {
-
-    #})
 
-