Fix upload file on fielmanager (#1012)

* Custom django storage for filemanager

* Remove odl code

* Add X-FRAME-OPTION

* Reset effect for input.form-control class

---------

Co-authored-by: wlorenzetti <lorenzett@gis3w.it>

g3w-admin/base/settings/base.py

@@ -402,4 +402,7 @@
 
 SOCIALACCOUNT_ONLY = True
 SOCIALACCOUNT_USER_ROLE = 'Viewer Level 1'
-ACCOUNT_EMAIL_VERIFICATION = 'none'
+ACCOUNT_EMAIL_VERIFICATION = 'none'
+
+# For iframe
+X_FRAME_OPTIONS = 'SAMEORIGIN'

g3w-admin/core/static/css/g3wadmin.css

@@ -280,4 +280,13 @@ For general layout
 */
 .pdl10 {
     padding-left: 10px;
+}
+
+/*
+For to reset the .form-control class effect
+ */
+input.uploadwidget {
+    border: none;
+    padding: 0px;
+    height: auto;
 }

g3w-admin/filemanager/filemanager.py

@@ -6,7 +6,7 @@
 from django.core.files.base import ContentFile
 from core.utils.response import send_file
 from core.utils.request import is_ajax
-from qdjango.utils.storage import OverwriteStorage
+from .utils.storage import FileManagerOverwriteStorage
 from .filemanagerresponse import FileManagerResponse
 import os
 import shutil
@@ -31,7 +31,7 @@ def __init__(self, request, root_folder=None):
         if root_folder:
             self.root = root_folder
 
-        self.storage = OverwriteStorage(location=root_folder)
+        self.storage = FileManagerOverwriteStorage(location=root_folder)
 
     def fileManagerError(self, title='FORBIDDEN_CHAR_SLASH', path='/'):
        return self.error(title, path)

g3w-admin/filemanager/utils/storage.py

@@ -0,0 +1,40 @@
+# coding=utf-8
+""""
+File storage for filemanager module
+.. note:: This program is free software; you can redistribute it and/or modify
+    it under the terms of the Mozilla Public License 2.0.
+
+"""
+
+__author__ = 'lorenzetti@gis3w.it'
+__date__ = '2025-01-18'
+__copyright__ = 'Copyright 2015 - 2025, Gis3w'
+__license__ = 'MPL 2.0'
+
+from django.core.files import File
+from qdjango.utils.storage import OverwriteStorage
+
+
+class FileManagerOverwriteStorage(OverwriteStorage):
+    """
+    Custom storage for filemanager module
+    """
+
+    def save(self, name, content, max_length=None):
+        """
+        Override save method for bypass trasversal storage file checking
+        """
+        # Get the proper name for the file, as it will actually be saved.
+        if name is None:
+            name = content.name
+
+        if not hasattr(content, "chunks"):
+            content = File(content, name)
+
+        # Potentially find a different name depending on storage constraints.
+        name = self.get_available_name(name, max_length=max_length)
+
+        # The save operation should return the actual name of the file saved.
+        name = self._save(name, content)
+
+        return name

g3w-admin/qdjango/utils/storage.py

@@ -22,9 +22,4 @@ def get_available_name(self, name, max_length=None):
 
 
 class QgisFileOverwriteStorage(OverwriteStorage):
-
-    pass
-    '''
-    def url(self, name):
-        return reverse('qdjango-project-download', args=(name,))
-    '''
+    pass