Route for downloading slide image #26
Conversation
|
This is used in caMicroscope #345 |
| if(os.path.isfile("/images/"+image_name)): | ||
| return flask.send_from_directory(app.config["UPLOAD_FOLDER"], filename=image_name, as_attachment=True) |
There was a problem hiding this comment.
I think this idea is workable, since we can ask users/admins concerned about having private slides to mount them in a different directory, or otherwise not mount them to this container. For the former:
It looks like isfile can be fooled by path traversal
>>> os.path.isfile("/home/ryan/Documents/Distro/images" + "/../README.md")
True
Can you confirm that this doesn't work with send_from_directory? (e.g. put a slide file somewhere in the container outside of /images and its children, and see if you can force the server into downloading it)
There was a problem hiding this comment.
As to my knowledge send_from_directory() is secure for passing file names.
send_file() should not be used in such cases so I used this.
There was a problem hiding this comment.
This may be used to get inside of the if statement but I don't think that send_from_directory() will fall into this.
Co-Authored-By: Ryan Birmingham <birm@rbirm.us>
A new route
/getSlide/<image_name>is created which returns the image file.