aljaz/CTFd
1
0
Fork 0
mirror of https://github.com/aljazceru/CTFd.git synced 2025-12-19 06:54:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix file deletion. Related to #1393 (#1396)

Browse Source 
* Delete files when the database reference is also deleted Related to #1393
This commit is contained in:
Ernesto Serrano
2020-05-14 03:35:46 +02:00
committed by GitHub
parent 2769dc6367
commit 912016f6f8
2 changed files with 34 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
CTFd/api/v1/files.py
View File

@@ -61,6 +61,7 @@ class FilesDetail(Resource):
def delete(self, file_id): def delete(self, file_id):
f = Files.query.filter_by(id=file_id).first_or_404() f = Files.query.filter_by(id=file_id).first_or_404()
uploads.delete_file(file_id=f.id)
db.session.delete(f) db.session.delete(f)
db.session.commit() db.session.commit()
db.session.close() db.session.close()

19
tests/api/v1/test_files.py
View File

@@ -2,6 +2,7 @@
# -*- coding: utf-8 -*- # -*- coding: utf-8 -*-
import os import os
import shutil
from io import BytesIO from io import BytesIO
from CTFd.models import ChallengeFiles, Challenges, Files from CTFd.models import ChallengeFiles, Challenges, Files
@@ -101,6 +102,13 @@ def test_api_file_delete_admin():
app = create_ctfd() app = create_ctfd()
with app.app_context(): with app.app_context():
chal = gen_challenge(app.db) chal = gen_challenge(app.db)
path = os.path.join(
app.config["UPLOAD_FOLDER"], "0bf1a55a5cd327c07af15df260979668", "bird.swf"
)
try:
# Create a fake file
os.makedirs(os.path.dirname(path))
open(path, "a").close()
f = gen_file( f = gen_file(
app.db, app.db,
location="0bf1a55a5cd327c07af15df260979668/bird.swf", location="0bf1a55a5cd327c07af15df260979668/bird.swf",
@@ -109,6 +117,10 @@ def test_api_file_delete_admin():
assert Files.query.count() == 1 assert Files.query.count() == 1
assert ChallengeFiles.query.count() == 1 assert ChallengeFiles.query.count() == 1
assert f in chal.files assert f in chal.files
# Make sure the file was created
assert os.path.exists(path)
with login_as_user(app, "admin") as client: with login_as_user(app, "admin") as client:
r = client.delete("/api/v1/files/1", json="") r = client.delete("/api/v1/files/1", json="")
assert r.status_code == 200 assert r.status_code == 200
@@ -116,4 +128,11 @@ def test_api_file_delete_admin():
assert ChallengeFiles.query.count() == 0 assert ChallengeFiles.query.count() == 0
chal = Challenges.query.filter_by(id=1).first() chal = Challenges.query.filter_by(id=1).first()
assert f not in chal.files assert f not in chal.files
# Make sure the API call deleted the file
assert os.path.exists(path) is False
finally:
# Always make sure the file is deleted
shutil.rmtree(os.path.dirname(path), ignore_errors=True)
destroy_ctfd(app) destroy_ctfd(app)