66 lines
2.2 KiB
Plaintext
66 lines
2.2 KiB
Plaintext
from PDAPI import *
|
|
import os
|
|
|
|
RESOURCE_ROOT = os.path.join(os.path.abspath(os.path.join(os.getcwd(), "resource")))
|
|
|
|
|
|
def _sha1_path(sha1_hex):
|
|
return os.path.join(RESOURCE_ROOT, sha1_hex[0:2], sha1_hex[2:4], sha1_hex[4:6], sha1_hex)
|
|
|
|
|
|
__metadata__ = {
|
|
"route": "{DEFAULT_ROUTE}/<sha1>",
|
|
"methods": ["GET"],
|
|
"blueprint": "GERP",
|
|
"permission": 1.0,
|
|
"attributes": [],
|
|
"limit": "60 per minute",
|
|
}
|
|
|
|
def HandleRequest(_CleanedData):
|
|
sha1 = _CleanedData["params"].get("sha1", "").strip()
|
|
if not sha1 or len(sha1) != 40:
|
|
return {"code": 1, "msg": "无效的SHA1"}, 400
|
|
|
|
asset = GERPFileAsset.query.filter(GERPFileAsset.FileSHA1 == sha1).first()
|
|
if not asset:
|
|
return {"code": 404, "msg": "文件不存在"}, 404
|
|
|
|
if asset.CompanyUUID:
|
|
current_user = UGM.GetELTUser()
|
|
if not current_user:
|
|
return {"code": 401, "msg": "未登录"}, 401
|
|
current_role_uuid_str = flask.request.cookies.get("CurrentRoleUUID")
|
|
if current_role_uuid_str:
|
|
try:
|
|
role_uuid_bytes = UUIDObj(current_role_uuid_str).bytes
|
|
current_role = GERPRole.query.filter(GERPRole.RoleUUID == role_uuid_bytes).first()
|
|
if not current_role or not current_role.CompanyUUID or current_role.CompanyUUID != asset.CompanyUUID:
|
|
return {"code": 403, "msg": "无权访问其他公司的文件"}, 403
|
|
except:
|
|
return {"code": 403, "msg": "无权访问此文件"}, 403
|
|
else:
|
|
return {"code": 403, "msg": "无权访问此文件"}, 403
|
|
|
|
file_path = _sha1_path(sha1)
|
|
if not os.path.exists(file_path):
|
|
return {"code": 404, "msg": "文件存储不存在"}, 404
|
|
|
|
download = flask.request.args.get("download", "0") == "1"
|
|
|
|
if download:
|
|
return flask.send_file(
|
|
file_path,
|
|
mimetype=asset.MimeType or "application/octet-stream",
|
|
as_attachment=True,
|
|
download_name=asset.FileName,
|
|
)
|
|
|
|
response = flask.send_file(
|
|
file_path,
|
|
mimetype=asset.MimeType or "application/octet-stream",
|
|
)
|
|
response.headers["Cache-Control"] = "public, max-age=31536000"
|
|
response.headers["ETag"] = sha1
|
|
return response
|