Secure file field, which allows you to restrict uploaded file extensions.
Project description
Secure file field, which allows you to restrict uploaded file extensions. It may be useful for user-uploaded files (attachments).
This package adds model and forms field. What this fields does:
restricts allowed file extensions (for example: only *.pdf files)
checks file extensions is correct for sent content-type
checks sent content type is correct for file content (detects by libmagic)
checks uploaded file with anti-virus software
This project continues https://github.com/rvause/django-safe-filefield.
Installation
The package can be installed using:
pip install django-safe-filefield-new
Add the following settings:
INSTALLED_APPS += [
'safe_filefield',
]
django-safe-filefield-new requires libmagic to be installed.
Usage
Simply add field to your model:
from safe_filefield.models import SafeFileField
class MyModel(models.Model):
attachment = SafeFileField(
allowed_extensions=('xls', 'xlsx', 'csv')
)
Or directly to your form:
from safe_filefield.forms import SafeFileField
class MyForm(forms.Form):
attachment = SafeFileField(
allowed_extensions=('xls', 'xlsx', 'csv')
)
Content type checking
To check actual file content type, use check_content_type argument. This will prevent attacker from uploading malicious file just by changing its extension.
class MyForm(forms.Form):
attachment = SafeFileField(
check_content_type=True
)
ClamAV support
This package has ability to check uploaded file with ClamAV antivirus.
To use anti-virus protection simply enable it in your form or model definition:
from safe_filefield.forms import SafeFileField
class MyForm(forms.Form):
attachment = SafeFileField(
scan_viruses=True,
)
You can configure some ClamAV settings:
CLAMAV_SOCKET = 'unix://tmp/clamav.sock' # or tcp://127.0.0.1:3310
CLAMAV_TIMEOUT = 30 # 30 seconds timeout, None by default which means infinite
Contributing
If you have any valuable contribution, suggestion or idea, please let me know as well because I will look into it.
Pull requests are welcome.
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for django-safe-filefield-new-0.4.0.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | 8314a977e4397f8bcbc3740adebfe25514cb62fa6bbc1fce6772045dc78ac5cb |
|
MD5 | 4c16195db03a2513421cec65f110751f |
|
BLAKE2b-256 | bff85ff83f32ea1d1ecd11425604e999819bc4df0cb83c6963e970b3da581053 |
Hashes for django_safe_filefield_new-0.4.0-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | d0f32461ceb3ae1ed489d26870835d9b83e740bfe62379433593ee3b243edd9b |
|
MD5 | 4b1d40f4df90134f2250b902bf869944 |
|
BLAKE2b-256 | 1a430f454347ad1b04268367c6bf1549a620a8116f7ac51153e29f0d6876c52c |