From 360ca1941c0df71a2472fa9b1a3f3df1c12c42b3 Mon Sep 17 00:00:00 2001
From: Taka <taka@vm-linux-dev>
Date: Wed, 19 Dec 2018 15:51:26 +0000
Subject: [PATCH] Allow user files to be included in snippets.

---
 vasl_templates/webapp/files.py                |  54 +++--
 vasl_templates/webapp/static/snippets.js      |   3 +
 .../fixtures/user-files/amp=& ; plus=+.txt    |   1 +
 .../tests/fixtures/user-files/hello.txt       |   1 +
 .../user-files/subdir/placeholder.png         | Bin 0 -> 1339 bytes
 vasl_templates/webapp/tests/remote.py         |  13 ++
 vasl_templates/webapp/tests/test_files.py     | 198 ++++++++++++++++--
 vasl_templates/webapp/tests/utils.py          |   3 +-
 vasl_templates/webapp/vo_notes.py             |  25 +--
 9 files changed, 260 insertions(+), 38 deletions(-)
 create mode 100644 vasl_templates/webapp/tests/fixtures/user-files/amp=& ; plus=+.txt
 create mode 100644 vasl_templates/webapp/tests/fixtures/user-files/hello.txt
 create mode 100644 vasl_templates/webapp/tests/fixtures/user-files/subdir/placeholder.png

diff --git a/vasl_templates/webapp/files.py b/vasl_templates/webapp/files.py
index e285e5a..7b606de 100644
--- a/vasl_templates/webapp/files.py
+++ b/vasl_templates/webapp/files.py
@@ -2,8 +2,11 @@
 
 import os
 import io
+import urllib.request
+import urllib.parse
+import mimetypes
 
-from flask import send_file, jsonify, redirect, url_for, abort
+from flask import send_file, send_from_directory, jsonify, redirect, url_for, abort
 
 from vasl_templates.webapp import app
 from vasl_templates.webapp.file_server.vasl_mod import VaslMod
@@ -19,20 +22,45 @@ class FileServer:
     """Serve static files."""
 
     def __init__( self, base_dir ):
-        self.base_dir = os.path.abspath( base_dir )
+        if FileServer.is_remote_path( base_dir ):
+            self.base_dir = base_dir
+        else:
+            self.base_dir = os.path.abspath( base_dir )
 
-    def get_file( self, fname ):
+    def serve_file( self, path ):
         """Serve a file."""
-        if not fname:
-            return None
-        fname = os.path.join( self.base_dir, fname )
-        fname = os.path.abspath( fname )
-        if not os.path.isfile( fname ):
-            return None
-        prefix = os.path.commonpath( [ self.base_dir, fname ] )
-        if prefix != self.base_dir:
-            return None # nb: files must be sub-ordinate to the configured directory
-        return fname
+        if FileServer.is_remote_path( self.base_dir ):
+            url = "{}/{}".format( self.base_dir, path )
+            # NOTE: We download the target file and serve it ourself (instead of just redirecting)
+            # since VASSAL can't handle SSL :-/
+            resp = urllib.request.urlopen( url )
+            buf = io.BytesIO()
+            buf.write( resp.read() )
+            buf.seek( 0 )
+            mime_type = mimetypes.guess_type( url )[0]
+            if not mime_type:
+                # FUDGE! send_file() requires a MIME type, so we take a guess and hope the browser
+                # can figure it out if we're wrong :-/
+                mime_type = "image/png"
+            return send_file( buf, mimetype=mime_type )
+        else:
+            path = path.replace( "\\", "/" ) # nb: for Windows :-/
+            return send_from_directory( self.base_dir, path )
+
+    @staticmethod
+    def is_remote_path( path ):
+        """Check if a path is referring to a remote server."""
+        return path.startswith( ("http://","https://") )
+
+# ---------------------------------------------------------------------
+
+@app.route( "/user/<path:path>" )
+def get_user_file( path ):
+    """Get a static file."""
+    dname = app.config.get( "USER_FILES_DIR" )
+    if not dname:
+        abort( 404 )
+    return FileServer( dname ).serve_file( path )
 
 # ---------------------------------------------------------------------
 
diff --git a/vasl_templates/webapp/static/snippets.js b/vasl_templates/webapp/static/snippets.js
index 23d2edb..c12f656 100644
--- a/vasl_templates/webapp/static/snippets.js
+++ b/vasl_templates/webapp/static/snippets.js
@@ -283,6 +283,9 @@ function make_snippet( $btn, params, extra_params, show_date_warnings )
         return "[error: can't process template'" ;
     }
 
+    // fixup any user file URL's
+    snippet = snippet.replace( "{{USER_FILES}}", APP_URL_BASE + "/user" ) ;
+
     return snippet ;
 }
 
diff --git a/vasl_templates/webapp/tests/fixtures/user-files/amp=& ; plus=+.txt b/vasl_templates/webapp/tests/fixtures/user-files/amp=& ; plus=+.txt
new file mode 100644
index 0000000..15ce1ca
--- /dev/null
+++ b/vasl_templates/webapp/tests/fixtures/user-files/amp=& ; plus=+.txt	
@@ -0,0 +1 @@
+special chars
diff --git a/vasl_templates/webapp/tests/fixtures/user-files/hello.txt b/vasl_templates/webapp/tests/fixtures/user-files/hello.txt
new file mode 100644
index 0000000..2bd9a94
--- /dev/null
+++ b/vasl_templates/webapp/tests/fixtures/user-files/hello.txt
@@ -0,0 +1 @@
+Yo, wassup!
diff --git a/vasl_templates/webapp/tests/fixtures/user-files/subdir/placeholder.png b/vasl_templates/webapp/tests/fixtures/user-files/subdir/placeholder.png
new file mode 100644
index 0000000000000000000000000000000000000000..62b26786bb3c169f871ad6e5fa6f6712e0ee5a5f
GIT binary patch
literal 1339
zcmXxkeN>WH90%}6NRUTB)TfC;_T)=Fvm$V~sWiuHVlIR7nC<i;5+#<vkd|)d5%7g^
zOwDPQa|`J`OKdIQ(kO*==`m|rT3Tx6PVa9kXK(JIo&9m|@7&M*-h0kH_uTuVBq5dr
z27mwnkmAI`RcPJhY92VW*Nj&tqJ^LlugwGivcuKfDi@MzDB^W-D@6ElA_c?3Zjd2Y
zK9VR|$J?$;Q)_`^^}S-0h&q&nicGmysnIFbD!`X8FBo;u<pQ-PTdUlXrUOoR^+uyg
z{-|1o%oT-o$_xb%G37--X9%vD)#}Z<9Wt!~Sg)CJ#XUc6uFRBglc7;9&~*OyQj|Sh
zyhf%~DOFp5^R&q#)bRhU->#J_fLAldhyTX}>WmD9N(a2|-D5`$=ZYmNb=wrc(I;0I
z0KhC<oRF88Rr7c_KAz5_;Gb20g6nMUWSB<{n`Bqo!MARy-JyOq!+tKWZCden{KVej
z-am}+?%_vYh6K_vZt^7RaKV|(vRAyEM+fTa(hq;=FKU_n4);bX@dhIM%Pvx}yOv=Y
z3<it=szM0Y(j(HEZuLK%I`(j3B90nY&b8mc%Zv3+rwFNB-f-?*?$!Ic<9#h+zYh<-
zJF9MNYO)iVC(fj(R4U7eN^mmit@7mhq2b}B&8@A+B{NakD{VJ^zCAMXUYC{i&#85c
zjo)mY*Aosjj|hgRr?YovWIT?o8_?2dv^&wiBsin+t?z8ACQke5(=S^F(pv@w2EICS
z<j6v75r^^@9RW#&nN#FaE>wWKE24-9rO(4m)_f-w6iPc}M3NPeF_&SaP)_k~9^~#P
zUqlgI=%mtwQVnxH$}?17BVyi2TmqZNy*g>)E7BZUmiwn+=9R>!ut@NHmmaeUf`~+R
zS=)gWnZ+<M+uavCCq#`5QhD4L1|Li?)ugMCP<gzA)_jKtIfxX>#t}>q1QNq3Pmo0F
zL3o`MVRiGGYbEjqV9e0rW+Zt;fPTazI1#B~4(juljTK(-34y>^Vk10=tYak`Q))FA
zQ@qA$1)M?;%0|S8>B#%q9ON#5x|@-5rbAzB4k8Icx*HH5mc!6i7&KeJ?#@KYS%C)O
zj<7xvj3}$GH#Ihrud+`rS-g0sEve34T2c~I(Q~h-y}f;^r>AGZwTO~(#7qbBk|}wd
z3Y)U}oI9|0-@fUycDp@{gdGiZNc_U%CMPFz7cW}$j-GS5uP^4!9_lIBn7z8ItLy3V
zL#wvr=Ei)<;cT6h-L7h0@%|X8M!*^DI?NzX9Qw0j6SN!dq-Pwmny~)&ex2tng1RHC
zVw6ZKcYcdLp6~58em6=8f<I99t5^F-&?7H}w6QWz!*qI&e?h3&v_MynJmT_Se->$N
zz|^KOz7@!@{Gt1I^E)v4f?JiIV3Y@*n1CFFYnaWJGQGwzn#ad<_!|R4BTci2%PTB!
zIrFH*pcgwVTmmM@KbQ?hivyW_D|&^5U<eEl2eSAUOWuS(mgeM$y_rmDn*kzVJ)JbM
zH;XB0%Y*zozqsUp&0~IwAd2%@Y53=+)KN>ZyOo-S1RD_?<B}LQ>r2Dgrqq0%KPY5%
z)V6_Es!Y0JmbCa8a@m03NSA(s&Ag%)b4{uJ)}<KM#Ym?`w6D5a3ycQIi?^}^%0dX@
zIUhnJyowqWYjM|a-g4Xg>iaoim0+^#K|F}|tc)zF9oojHca<rI-V0mM(T#`RRcm^Q
dl6sqMY_4xRF7daQ&YS2T0mO+Cg!TLs!@oJB4%Pqw

literal 0
HcmV?d00001

diff --git a/vasl_templates/webapp/tests/remote.py b/vasl_templates/webapp/tests/remote.py
index e71a26c..83718e3 100644
--- a/vasl_templates/webapp/tests/remote.py
+++ b/vasl_templates/webapp/tests/remote.py
@@ -185,3 +185,16 @@ class ControlTests:
             webapp_vo_notes._cached_vo_notes = None #pylint: disable=protected-access
             webapp_vo_notes._vo_notes_file_server = None #pylint: disable=protected-access
         return self
+
+    def _set_user_files_dir( self, dtype=None ):
+        """Set the user files directory."""
+        if dtype == "test":
+            dname = os.path.join( os.path.split(__file__)[0], "fixtures/user-files" )
+        elif dtype and dtype.startswith( ("http://","https://") ):
+            dname = dtype
+        else:
+            assert dtype is None
+            dname = None
+        _logger.info( "Setting user files: %s", dname )
+        app.config["USER_FILES_DIR"] = dname
+        return self
diff --git a/vasl_templates/webapp/tests/test_files.py b/vasl_templates/webapp/tests/test_files.py
index c31d4d9..6253ea5 100644
--- a/vasl_templates/webapp/tests/test_files.py
+++ b/vasl_templates/webapp/tests/test_files.py
@@ -1,26 +1,200 @@
 """ Test serving files. """
 
 import os
+import re
+import urllib.request
+
+import pytest
+import werkzeug.exceptions
 
 from vasl_templates.webapp.files import FileServer
+from vasl_templates.webapp.tests.utils import init_webapp, find_child, wait_for_clipboard
 
 # ---------------------------------------------------------------------
 
-def test_file_server():
-    """Test serving files."""
+def test_local_file_server( webapp ):
+    """Test serving files from the local file system."""
 
     # initialize
     base_dir = os.path.normpath( os.path.join( os.path.split(__file__)[0], "fixtures/file-server" ) )
     file_server = FileServer( base_dir )
 
     # do the tests
-    assert file_server.get_file( "1.txt" ) == os.path.join( base_dir, "1.txt" )
-    assert file_server.get_file( "/1.txt" ) is None
-    assert file_server.get_file( "unknown.txt" ) is None
-    assert file_server.get_file( "subdir/2.txt" ) == os.path.normpath( os.path.join( base_dir, "subdir/2.txt" ) )
-    assert file_server.get_file( "/subdir/2.txt" ) is None
-
-    # try access a file outside the configured directory
-    fname = "../new-default-scenario.json"
-    assert os.path.isfile( os.path.join( base_dir, fname ) )
-    assert file_server.get_file( fname ) is None
+    with webapp.test_request_context():
+
+        assert _get_response_data( file_server.serve_file( "1.txt" ) ).strip() == b"file 1"
+        with pytest.raises( werkzeug.exceptions.NotFound ):
+            _get_response_data( file_server.serve_file( "/1.txt" ) )
+
+        with pytest.raises( werkzeug.exceptions.NotFound ):
+            _get_response_data( file_server.serve_file( "unknown.txt" ) )
+
+        assert _get_response_data( file_server.serve_file( "subdir/2.txt" ) ).strip() == b"file 2"
+        with pytest.raises( werkzeug.exceptions.NotFound ):
+            _get_response_data( file_server.serve_file( "/subdir/2.txt" ) )
+
+        # try to get a file outside the configured directory
+        fname = "../new-default-scenario.json"
+        assert os.path.isfile( os.path.join( base_dir, fname ) )
+        with pytest.raises( werkzeug.exceptions.NotFound ):
+            _get_response_data( file_server.serve_file( fname) )
+
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+def test_remote_file_server( webapp ):
+    """Test serving files from a remote file system."""
+
+    # initialize
+    base_url = "{}/static/images".format( _get_base_url( webapp ) )
+    file_server = FileServer( base_url )
+    base_dir = os.path.join( os.path.split(__file__)[0], "../static/images" )
+
+    def do_test( fname ):
+        """Get the specified user file from the remote server and check the response."""
+        buf = _get_response_data( file_server.serve_file( fname ) )
+        with open( os.path.join( base_dir, fname ), "rb" ) as fp:
+            assert buf == fp.read()
+
+    # do the tests
+    with webapp.test_request_context():
+        do_test( "hint.gif" )
+        do_test( "flags/german.png" )
+
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+def _get_base_url( webapp ):
+    """Get the webapp base URL."""
+    url = webapp.url_for( "get_user_file", path="unused" )
+    mo = re.search( r"^http://.+?:\d+", url )
+    return mo.group()
+
+def _get_response_data( resp ):
+    """Get the data from a Flask response."""
+    resp.direct_passthrough = False
+    return resp.get_data()
+
+# ---------------------------------------------------------------------
+
+def test_local_user_files( webapp, webdriver ):
+    """Test serving user files from the local file system."""
+
+    def do_test( enable_user_files ): #pylint: disable=missing-docstring
+
+        # initialize
+        init_webapp( webapp, webdriver,
+            reset = lambda ct:
+                ct.set_user_files_dir( dtype = "test" if enable_user_files else None )
+        )
+
+        # try getting a user file
+        try:
+            url = webapp.url_for( "get_user_file", path="hello.txt" )
+            resp = urllib.request.urlopen( url )
+            assert enable_user_files # nb: we should only get here if user files are enabled
+            assert resp.code == 200
+            assert resp.read().strip() == b"Yo, wassup!"
+            assert resp.headers[ "Content-Type" ].startswith( "text/plain" )
+        except urllib.error.HTTPError as ex:
+            assert not enable_user_files # nb: we should only get here if user files are disabled
+            assert ex.code == 404
+
+        # try getting a non-existent file (nb: should always fail, whether user files are enabled/disabled)
+        with pytest.raises( urllib.error.HTTPError ) as exc_info:
+            url = webapp.url_for( "get_user_file", path="unknown" )
+            resp = urllib.request.urlopen( url )
+        assert exc_info.value.code == 404
+
+        # try getting a file in a sub-directory
+        try:
+            url = webapp.url_for( "get_user_file", path="subdir/placeholder.png" )
+            resp = urllib.request.urlopen( url )
+            assert enable_user_files # nb: we should only get here if user files are enabled
+            assert resp.code == 200
+            assert resp.read().startswith( b"\x89PNG\r\n" )
+            assert resp.headers[ "Content-Type" ] == "image/png"
+        except urllib.error.HTTPError as ex:
+            assert not enable_user_files # nb: we should only get here if user files are disabled
+            assert ex.code == 404
+
+        # try getting a file outside the configured directory (nb: should always fail)
+        fname = os.path.join( os.path.split(__file__)[0], "fixtures/vasl-pieces.txt" )
+        assert os.path.isfile( fname )
+        with pytest.raises( urllib.error.HTTPError ) as exc_info:
+            url = webapp.url_for( "get_user_file", path="../vasl-pieces.txt" )
+            resp = urllib.request.urlopen( url )
+        assert exc_info.value.code == 404
+
+        # try getting a file with special characters in its name
+        try:
+            url = webapp.url_for( "get_user_file", path="amp=& ; plus=+.txt" )
+            resp = urllib.request.urlopen( url )
+            assert enable_user_files # nb: we should only get here if user files are enabled
+            assert resp.code == 200
+            assert resp.read().strip() == b"special chars"
+            assert resp.headers[ "Content-Type" ].startswith( "text/plain" )
+        except urllib.error.HTTPError as ex:
+            assert not enable_user_files # nb: we should only get here if user files are disabled
+            assert ex.code == 404
+
+    # do the tests with user files enabled/disabled
+    do_test( True )
+    do_test( False )
+
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+def test_remote_user_files( webapp, webdriver ):
+    """Test serving user files from a remote server."""
+
+    def do_test( enable_user_files ): #pylint: disable=missing-docstring
+
+        # initialize
+        base_url = "{}/static/images".format( _get_base_url( webapp ) )
+        init_webapp( webapp, webdriver,
+            reset = lambda ct:
+                ct.set_user_files_dir( dtype = base_url if enable_user_files else None )
+        )
+
+        # try getting a user file
+        try:
+            url = webapp.url_for( "get_user_file", path="menu.png" )
+            resp = urllib.request.urlopen( url )
+            assert enable_user_files # nb: we should only get here if user files are enabled
+            assert resp.code == 200
+            assert resp.read().startswith( b"\x89PNG\r\n" )
+            assert resp.headers[ "Content-Type" ] == "image/png"
+        except urllib.error.HTTPError as ex:
+            assert not enable_user_files # nb: we should only get here if user files are disabled
+            assert ex.code == 404
+
+    # do the tests with user files enabled/disabled
+    do_test( True )
+    do_test( False )
+
+# ---------------------------------------------------------------------
+
+def test_user_file_snippets( webapp, webdriver ):
+    """Test user files in snippets."""
+
+    def do_test( enable_user_files ): #pylint: disable=missing-docstring
+
+        # initialize
+        init_webapp( webapp, webdriver,
+            reset = lambda ct: ct.set_user_files_dir( dtype = "test" if enable_user_files else None )
+        )
+
+        # set the victory conditions
+        elem = find_child( "textarea[name='VICTORY_CONDITIONS']" )
+        elem.send_keys( "my image: {{USER_FILES}}/subdir/placeholder.png" )
+        btn = find_child( "button.generate[data-id='victory_conditions']" )
+        btn.click()
+        def get_user_file_url( clipboard ): #pylint: disable=missing-docstring
+            # nb: the test template wraps {{VICTORY_CONDITIONS}} in square brackets :-/
+            mo = re.search( r"http://.+?/([^]]+)", clipboard )
+            return "/" + mo.group(1)
+        wait_for_clipboard( 2, "/user/subdir/placeholder.png", transform=get_user_file_url )
+
+    # do the tests with user files enabled/disabled
+    # NOTE: The user file URL will be inserted into the snippet even if user files are disabled,
+    # but the URL will 404 when somebody tries to resolve it.
+    do_test( True )
+    do_test( False )
diff --git a/vasl_templates/webapp/tests/utils.py b/vasl_templates/webapp/tests/utils.py
index fe2b1ac..a0d62cf 100644
--- a/vasl_templates/webapp/tests/utils.py
+++ b/vasl_templates/webapp/tests/utils.py
@@ -57,7 +57,8 @@ def init_webapp( webapp, webdriver, **options ):
         .set_default_template_pack( dname=None ) \
         .set_vasl_mod( vmod=None ) \
         .set_vassal_engine( vengine=None ) \
-        .set_vo_notes_dir( dtype=None )
+        .set_vo_notes_dir( dtype=None ) \
+        .set_user_files_dir( dtype=None )
     if "reset" in options:
         options.pop( "reset" )( control_tests )
 
diff --git a/vasl_templates/webapp/vo_notes.py b/vasl_templates/webapp/vo_notes.py
index f3cdf87..929bbc4 100644
--- a/vasl_templates/webapp/vo_notes.py
+++ b/vasl_templates/webapp/vo_notes.py
@@ -124,28 +124,29 @@ def get_vo_note( vo_type, nat, key ):
             abort( 404 )
         vo_notes = _do_get_vo_notes( vo_type )
         fname = vo_notes.get( nat, {} ).get( key )
-        fname = _vo_notes_file_server.get_file( fname )
-    if not fname:
-        abort( 404 )
+        resp = _vo_notes_file_server.serve_file( fname )
 
     # check if we should resize the file
     scaling = request.args.get( "scaling" )  # nb: allow individual notes to set their scaling
     if not scaling:
         scaling = app.config.get( "CHAPTER_H_NOTE_SCALING", 100 )
-    if scaling != 100:
+    if scaling == 100:
+        # nope - just return the file as it is
+        return resp
+    else:
         # yup - make it so
-        with open( fname, "rb" ) as fp:
-            img = Image.open( fp )
-            width = int( img.size[0] * float(scaling) / 100 )
-            height = int( img.size[1] * float(scaling) / 100 )
-            img = img.resize( (width,height), Image.ANTIALIAS )
+        buf = io.BytesIO()
+        resp.direct_passthrough = False
+        buf.write( resp.get_data() )
+        buf.seek( 0 )
+        img = Image.open( buf )
+        width = int( img.size[0] * float(scaling) / 100 )
+        height = int( img.size[1] * float(scaling) / 100 )
+        img = img.resize( (width,height), Image.ANTIALIAS )
         buf = io.BytesIO()
         img.save( buf, format="PNG" )
         buf.seek( 0 )
         return send_file( buf, mimetype="image/png" )
-    else:
-        # nope - just return the file as it is
-        return send_file( fname )
 
 # ---------------------------------------------------------------------