| #!/usr/bin/env python | |
| """Simple HTTP Server With Upload. | |
| This module builds on BaseHTTPServer by implementing the standard GET | |
| and HEAD requests in a fairly straightforward manner. | |
| """ | |
| __version__ = "0.1" | |
| __all__ = ["SimpleHTTPRequestHandler"] | |
| __author__ = "bones7456" | |
| __home_page__ = "http://li2z.cn/" | |
| import os | |
| import posixpath | |
| import BaseHTTPServer | |
| import urllib | |
| import cgi | |
| import shutil | |
| import mimetypes | |
| import re | |
| try: | |
| from cStringIO import StringIO | |
| except ImportError: | |
| from StringIO import StringIO | |
| class SimpleHTTPRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler): | |
| """Simple HTTP request handler with GET/HEAD/POST commands. | |
| This serves files from the current directory and any of its | |
| subdirectories. The MIME type for files is determined by | |
| calling the .guess_type() method. And can reveive file uploaded | |
| by client. | |
| The GET/HEAD/POST requests are identical except that the HEAD | |
| request omits the actual contents of the file. | |
| """ | |
| server_version = "SimpleHTTPWithUpload/" + __version__ | |
| def do_GET(self): | |
| """Serve a GET request.""" | |
| f = self.send_head() | |
| if f: | |
| self.copyfile(f, self.wfile) | |
| f.close() | |
| def do_HEAD(self): | |
| """Serve a HEAD request.""" | |
| f = self.send_head() | |
| if f: | |
| f.close() | |
| def do_POST(self): | |
| """Serve a POST request.""" | |
| r, info = self.deal_post_data() | |
| print r, info, "by: ", self.client_address | |
| f = StringIO() | |
| f.write('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">') | |
| f.write("<html>\n<title>Upload Result Page</title>\n") | |
| f.write("<body>\n<h2>Upload Result Page</h2>\n") | |
| f.write("<hr>\n") | |
| if r: | |
| f.write("<strong>Success:</strong>") | |
| else: | |
| f.write("<strong>Failed:</strong>") | |
| f.write(info) | |
| f.write("<br><a href=\"%s\">back</a>" % self.headers['referer']) | |
| f.write("<hr><small>Powerd By: bones7456, check new version at ") | |
| f.write("<a href=\"http://li2z.cn/?s=SimpleHTTPServerWithUpload\">") | |
| f.write("here</a>.</small></body>\n</html>\n") | |
| length = f.tell() | |
| f.seek(0) | |
| self.send_response(200) | |
| self.send_header("Content-type", "text/html") | |
| self.send_header("Content-Length", str(length)) | |
| self.end_headers() | |
| if f: | |
| self.copyfile(f, self.wfile) | |
| f.close() | |
| def deal_post_data(self): | |
| boundary = self.headers.plisttext.split("=")[1] | |
| remainbytes = int(self.headers['content-length']) | |
| line = self.rfile.readline() | |
| remainbytes -= len(line) | |
| if not boundary in line: | |
| return (False, "Content NOT begin with boundary") | |
| line = self.rfile.readline() | |
| remainbytes -= len(line) | |
| fn = re.findall(r'Content-Disposition.*name="file"; filename="(.*)"', line) | |
| if not fn: | |
| return (False, "Can't find out file name...") | |
| path = self.translate_path(self.path) | |
| fn = os.path.join(path, fn[0]) | |
| line = self.rfile.readline() | |
| remainbytes -= len(line) | |
| line = self.rfile.readline() | |
| remainbytes -= len(line) | |
| try: | |
| out = open(fn, 'wb') | |
| except IOError: | |
| return (False, "Can't create file to write, do you have permission to write?") | |
| preline = self.rfile.readline() | |
| remainbytes -= len(preline) | |
| while remainbytes > 0: | |
| line = self.rfile.readline() | |
| remainbytes -= len(line) | |
| if boundary in line: | |
| preline = preline[0:-1] | |
| if preline.endswith('\r'): | |
| preline = preline[0:-1] | |
| out.write(preline) | |
| out.close() | |
| return (True, "File '%s' upload success!" % fn) | |
| else: | |
| out.write(preline) | |
| preline = line | |
| return (False, "Unexpect Ends of data.") | |
| def send_head(self): | |
| """Common code for GET and HEAD commands. | |
| This sends the response code and MIME headers. | |
| Return value is either a file object (which has to be copied | |
| to the outputfile by the caller unless the command was HEAD, | |
| and must be closed by the caller under all circumstances), or | |
| None, in which case the caller has nothing further to do. | |
| """ | |
| path = self.translate_path(self.path) | |
| f = None | |
| if os.path.isdir(path): | |
| if not self.path.endswith('/'): | |
| # redirect browser - doing basically what apache does | |
| self.send_response(301) | |
| self.send_header("Location", self.path + "/") | |
| self.end_headers() | |
| return None | |
| for index in "index.html", "index.htm": | |
| index = os.path.join(path, index) | |
| if os.path.exists(index): | |
| path = index | |
| break | |
| else: | |
| return self.list_directory(path) | |
| ctype = self.guess_type(path) | |
| try: | |
| # Always read in binary mode. Opening files in text mode may cause | |
| # newline translations, making the actual size of the content | |
| # transmitted *less* than the content-length! | |
| f = open(path, 'rb') | |
| except IOError: | |
| self.send_error(404, "File not found") | |
| return None | |
| self.send_response(200) | |
| self.send_header("Content-type", ctype) | |
| fs = os.fstat(f.fileno()) | |
| self.send_header("Content-Length", str(fs[6])) | |
| self.send_header("Last-Modified", self.date_time_string(fs.st_mtime)) | |
| self.end_headers() | |
| return f | |
| def list_directory(self, path): | |
| """Helper to produce a directory listing (absent index.html). | |
| Return value is either a file object, or None (indicating an | |
| error). In either case, the headers are sent, making the | |
| interface the same as for send_head(). | |
| """ | |
| try: | |
| list = os.listdir(path) | |
| except os.error: | |
| self.send_error(404, "No permission to list directory") | |
| return None | |
| list.sort(key=lambda a: a.lower()) | |
| f = StringIO() | |
| displaypath = cgi.escape(urllib.unquote(self.path)) | |
| f.write('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">') | |
| f.write("<html>\n<title>Directory listing for %s</title>\n" % displaypath) | |
| f.write("<body>\n<h2>Directory listing for %s</h2>\n" % displaypath) | |
| f.write("<hr>\n") | |
| f.write("<form ENCTYPE=\"multipart/form-data\" method=\"post\">") | |
| f.write("<input name=\"file\" type=\"file\"/>") | |
| f.write("<input type=\"submit\" value=\"upload\"/></form>\n") | |
| f.write("<hr>\n<ul>\n") | |
| for name in list: | |
| fullname = os.path.join(path, name) | |
| displayname = linkname = name | |
| # Append / for directories or @ for symbolic links | |
| if os.path.isdir(fullname): | |
| displayname = name + "/" | |
| linkname = name + "/" | |
| if os.path.islink(fullname): | |
| displayname = name + "@" | |
| # Note: a link to a directory displays with @ and links with / | |
| f.write('<li><a href="%s">%s</a>\n' | |
| % (urllib.quote(linkname), cgi.escape(displayname))) | |
| f.write("</ul>\n<hr>\n</body>\n</html>\n") | |
| length = f.tell() | |
| f.seek(0) | |
| self.send_response(200) | |
| self.send_header("Content-type", "text/html") | |
| self.send_header("Content-Length", str(length)) | |
| self.end_headers() | |
| return f | |
| def translate_path(self, path): | |
| """Translate a /-separated PATH to the local filename syntax. | |
| Components that mean special things to the local file system | |
| (e.g. drive or directory names) are ignored. (XXX They should | |
| probably be diagnosed.) | |
| """ | |
| # abandon query parameters | |
| path = path.split('?',1)[0] | |
| path = path.split('#',1)[0] | |
| path = posixpath.normpath(urllib.unquote(path)) | |
| words = path.split('/') | |
| words = filter(None, words) | |
| path = os.getcwd() | |
| for word in words: | |
| drive, word = os.path.splitdrive(word) | |
| head, word = os.path.split(word) | |
| if word in (os.curdir, os.pardir): continue | |
| path = os.path.join(path, word) | |
| return path | |
| def copyfile(self, source, outputfile): | |
| """Copy all data between two file objects. | |
| The SOURCE argument is a file object open for reading | |
| (or anything with a read() method) and the DESTINATION | |
| argument is a file object open for writing (or | |
| anything with a write() method). | |
| The only reason for overriding this would be to change | |
| the block size or perhaps to replace newlines by CRLF | |
| -- note however that this the default server uses this | |
| to copy binary data as well. | |
| """ | |
| shutil.copyfileobj(source, outputfile) | |
| def guess_type(self, path): | |
| """Guess the type of a file. | |
| Argument is a PATH (a filename). | |
| Return value is a string of the form type/subtype, | |
| usable for a MIME Content-type header. | |
| The default implementation looks the file's extension | |
| up in the table self.extensions_map, using application/octet-stream | |
| as a default; however it would be permissible (if | |
| slow) to look inside the data to make a better guess. | |
| """ | |
| base, ext = posixpath.splitext(path) | |
| if ext in self.extensions_map: | |
| return self.extensions_map[ext] | |
| ext = ext.lower() | |
| if ext in self.extensions_map: | |
| return self.extensions_map[ext] | |
| else: | |
| return self.extensions_map[''] | |
| if not mimetypes.inited: | |
| mimetypes.init() # try to read system mime.types | |
| extensions_map = mimetypes.types_map.copy() | |
| extensions_map.update({ | |
| '': 'application/octet-stream', # Default | |
| '.py': 'text/plain', | |
| '.c': 'text/plain', | |
| '.h': 'text/plain', | |
| }) | |
| def test(HandlerClass = SimpleHTTPRequestHandler, | |
| ServerClass = BaseHTTPServer.HTTPServer): | |
| BaseHTTPServer.test(HandlerClass, ServerClass) | |
| if __name__ == '__main__': | |
| test() |
How not to list SimpleHTTPServerWithUpload.py file itself ?
Please sanitize the upload filename, to prevent parent directory issues. This is as simple as assert os.path.abspath(fn ).startswith(os.path.abspath(self.path)), inserted after line 100.
os.path.abspath() has the effect of collapsing ../ or // in the path, to result in a canonical file-path.
As @fake-name said, the upload functionality contains a vulnerability, which has been discussed here 0 and here 1.
it will be great if these vulnerabilities are closed.
any suggestion how to delete a file ?
@shafi-codez a solution is in 1, as mentined by @gehaxelt, but it hasnt been merged apparently
how can make this to upload multiple files?
Hi, as I am new in this, please someone explain how to run this program step by step on apache2. thanks.
Great piece of code. Thank you for sharing
i forked the code too from the python3 fork and added authentication and ssl see here
its more a collection of the features then my own work.
This is a great. I am able to send file from linux(client) to linux(server) with curl. How can I send file from my windows desktop with some kind of small html page?
Perfect!!
Hi all, excuse my ignorance but how can I leverage this script to allow for the creation of a new folder within the current directory? I have googled everything I can think of but I think it's a little over my head. In its current state, you can only upload files, not create a new directory. Thanks!
Excellent!
Good job, thanks!
awesomem bro!
I use you little script to transer files with my virtual machine
This saved my day
How can it support other language? such as an folder name is Chinese
How to test this
is there any client code for this
HTTPS version with basic authentication - https://github.com/4d4c/http.server_upload
changed the code to upload multiple files - https://gist.github.com/joonahn/5c21fde633bf61087fa3faea77e1f77f
DeprecationWarning: cgi.escape is deprecated, use html.escape instead
@@ -18,7 +18,7 @@ import os
import posixpath
import http.server
import urllib.request, urllib.parse, urllib.error
-import cgi
+import html
import shutil
import mimetypes
import re
@@ -187,7 +187,7 @@ class SimpleHTTPRequestHandler(http.server.BaseHTTPRequestHandler):
return None
list.sort(key=lambda a: a.lower())
f = BytesIO()
- displaypath = cgi.escape(urllib.parse.unquote(self.path))
+ displaypath = html.escape(urllib.parse.unquote(self.path))
f.write(b'<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">')
f.write(("<html>\n<title>Directory listing for %s</title>\n" % displaypath).encode())
f.write(("<body>\n<h2>Directory listing for %s</h2>\n" % displaypath).encode())
@@ -207,7 +207,7 @@ class SimpleHTTPRequestHandler(http.server.BaseHTTPRequestHandler):
displayname = name + "@"
# Note: a link to a directory displays with @ and links with /
f.write(('<li><a href="%s">%s</a>\n'
- % (urllib.parse.quote(linkname), cgi.escape(displayname))).encode())
+ % (urllib.parse.quote(linkname), html.escape(displayname))).encode())
f.write(b"</ul>\n<hr>\n</body>\n</html>\n")
length = f.tell()
f.seek(0)
BaseHTTPServer is not accepted by my console
This is my modified version which allows for IP address, port binding, multiple uploads (thanks to joonahn) and has colourful icons.
I hope you find this code useful. This works on Python 3.
Click here for my code.
@Tallguy297 Thanks
https://github.com/xinghaixu/web_server/blob/master/SimpleHTTPServerWithUpload.py
修复支持 curl -X POST -F file=@filename http://XXXXX.com:8001 的方式上传文件
修复各个浏览器上传文件名乱码问题。
sys.stdout.flush() 强制刷新缓冲区，print的数据日志不生效
将常驻server修改成单次临时启动，避免端口扫描。
Hi all! I wrote a similar script that supports multiple-file upload and HTTPS. Click here to check it out :D
who knew the original author of this script would get only get 9stars. original post
lets give him a thanks. (took me 30 min to shell out his post from his website)
I extracted all the juice out of different sources and finally made this http server with delete and multiupload
hope you'd like it.
also @shafi-codez it solves your question (in a messy way)
@bakaiadam python SimpleHTTPServerWithUpload.py port