27 lines
1.1 KiB
Plaintext
27 lines
1.1 KiB
Plaintext
# download_project.dspy - 下载项目备份 tgz 文件（/download 命令生成下载链接）
|
|
import os
|
|
from urllib.parse import quote
|
|
from aiohttp.web_fileresponse import FileResponse
|
|
|
|
path = (params_kw or {}).get('path', '').strip()
|
|
|
|
uid = await get_user()
|
|
if not uid:
|
|
return {"widgettype": "Message", "options": {"title": "错误", "message": "请先登录"}}
|
|
|
|
# 安全校验：只允许 _archive 备份归档目录下的 .tgz 文件
|
|
if not path or not path.endswith('.tgz'):
|
|
return {"widgettype": "Message", "options": {"title": "错误", "message": "非法文件（仅支持 .tgz 备份文件）"}}
|
|
|
|
real = os.path.realpath(path)
|
|
if '/_archive/' not in real:
|
|
return {"widgettype": "Message", "options": {"title": "错误", "message": "非法路径（仅允许 _archive 备份归档目录）"}}
|
|
|
|
if not os.path.isfile(path):
|
|
return {"widgettype": "Message", "options": {"title": "错误", "message": "文件不存在"}}
|
|
|
|
filename = os.path.basename(path)
|
|
safe_name = quote(filename)
|
|
headers = {'Content-Disposition': 'attachment; filename="%s"; filename*=UTF-8\'\'%s' % (filename, safe_name)}
|
|
return FileResponse(path, headers=headers)
|