fix breach in award points that allows user to award infinite points

[osqa.git] / forum_modules / exporter / views.py

diff --git a/forum_modules/exporter/views.py b/forum_modules/exporter/views.py
index 37090372dbba0b86450e9d5117aacb108610f0a3..c7b3904dae76a70ab916b94babf884d28f1b2409 100644 (file)
--- a/forum_modules/exporter/views.py
+++ b/forum_modules/exporter/views.py
@@ -1,9 +1,11 @@
+from __future__ import with_statement
+
 import os, tarfile, ConfigParser, datetime
+import json
 
 from StringIO import StringIO
 from django.http import HttpResponse, HttpResponseRedirect, Http404
 from django.utils.translation import ugettext as _
-from django.utils import simplejson
 from django.core.cache import cache
 from django.core.urlresolvers import reverse
 from forum.views.admin import admin_tools_page, admin_page
@@ -13,10 +15,9 @@ from threading import Thread
 import settings as selsettings
 from forum import settings
 
-from exporter import export, CACHE_KEY, EXPORT_STEPS, LAST_BACKUP, DATE_AND_AUTHOR_INF_SECTION, DATETIME_FORMAT
+from exporter import export, CACHE_KEY, EXPORT_STEPS, DATE_AND_AUTHOR_INF_SECTION, DATETIME_FORMAT
 from importer import start_import
 
-
 @admin_tools_page(_('exporter'), _('XML data export'))
 def exporter(request):
     state = cache.get(CACHE_KEY)
@@ -73,18 +74,28 @@ def running(request, mode):
     })
 
 def state(request):
-    return HttpResponse(simplejson.dumps(cache.get(CACHE_KEY)), mimetype="application/json")
+    return HttpResponse(json.dumps(cache.get(CACHE_KEY)), mimetype="application/json")
 
 @admin_page
 def download(request):
-    fname = LAST_BACKUP
+    if request.GET and request.GET.get('file', None):
+        fname = os.path.join(selsettings.EXPORTER_BACKUP_STORAGE, request.GET.get('file'))
+    else:
+        raise Http404
 
     if not os.path.exists(fname):
         raise Http404
 
-    response = HttpResponse(open(fname, 'rb').read(), content_type='application/x-gzip')
+    if fname.endswith('.gz'):
+        content_type='application/x-gzip'
+        filename = 'backup.tar.gz'
+    else:
+        content_type='application/zip'
+        filename = 'backup.zip'
+
+    response = HttpResponse(open(fname, 'rb').read(), content_type=content_type)
     response['Content-Length'] = os.path.getsize(fname)
-    response['Content-Disposition'] = 'attachment; filename=backup.tar.gz'
+    response['Content-Disposition'] = 'attachment; filename=%s' % filename
     return response