Skip to main content

Secure file field, which allows you to restrict uploaded file extensions.

Project description

flake8 pytest pypi pep8 MIT

Secure file field, which allows you to restrict uploaded file extensions. It may be useful for user-uploaded files (attachments).

This package adds model and forms field. What this fields does:

  • restricts allowed file extensions (for example: only *.pdf files)

  • checks file extensions is correct for sent content-type

  • checks sent content type is correct for file content (detects by libmagic)

  • checks uploaded file with anti-virus software

Installation

The package can be installed using:

pip install django-safe-filefield

Add the following settings:

INSTALLED_APPS += [
    'safe_filefield',
]

django-safe-filefield requires libmagic to be installed.

Usage

Simply add field to your model:

from safe_filefield.models import SafeFileField

class MyModel(models.Model):

    attachment = SafeFileField(
        allowed_extensions=('xls', 'xlsx', 'csv')
    )

Or directly to your form:

from safe_filefield.forms import SafeFileField

class MyForm(forms.Form):

    attachment = SafeFileField(
        allowed_extensions=('xls', 'xlsx', 'csv')
    )

Content type checking

To check actual file content type, use check_content_type argument. This will prevent attacker from uploading malicious file just by changing its extension.

class MyForm(forms.Form):
    attachment = SafeFileField(
        check_content_type=True
    )

ClamAV support

This package has ability to check uploaded file with ClamAV antivirus.

To use anti-virus protection simply enable it in your form or model definition:

from safe_filefield.forms import SafeFileField

class MyForm(forms.Form):
    attachment = SafeFileField(
        scan_viruses=True,
    )

You can configure some ClamAV settings:

CLAMAV_SOCKET = 'unix://tmp/clamav.sock'  # or tcp://127.0.0.1:3310

CLAMAV_TIMEOUT = 30  # 30 seconds timeout, None by default which means infinite

Contributing

If you have any valuable contribution, suggestion or idea, please let me know as well because I will look into it.

Pull requests are welcome.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

django-safe-filefield-1.0.0.tar.gz (5.5 kB view hashes)

Uploaded Source

Built Distribution

django_safe_filefield-1.0.0-py3-none-any.whl (6.8 kB view hashes)

Uploaded Python 3

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page