Skip to content

Instantly share code, notes, and snippets.

Created August 14, 2012 04:01
Star You must be signed in to star a gist
What would you like to do?
Simple Python Http Server with Upload
#!/usr/bin/env python
"""Simple HTTP Server With Upload.
This module builds on BaseHTTPServer by implementing the standard GET
and HEAD requests in a fairly straightforward manner.
__version__ = "0.1"
__all__ = ["SimpleHTTPRequestHandler"]
__author__ = "bones7456"
__home_page__ = ""
import os
import posixpath
import BaseHTTPServer
import urllib
import cgi
import shutil
import mimetypes
import re
from cStringIO import StringIO
except ImportError:
from StringIO import StringIO
class SimpleHTTPRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
"""Simple HTTP request handler with GET/HEAD/POST commands.
This serves files from the current directory and any of its
subdirectories. The MIME type for files is determined by
calling the .guess_type() method. And can reveive file uploaded
by client.
The GET/HEAD/POST requests are identical except that the HEAD
request omits the actual contents of the file.
server_version = "SimpleHTTPWithUpload/" + __version__
def do_GET(self):
"""Serve a GET request."""
f = self.send_head()
if f:
self.copyfile(f, self.wfile)
def do_HEAD(self):
"""Serve a HEAD request."""
f = self.send_head()
if f:
def do_POST(self):
"""Serve a POST request."""
r, info = self.deal_post_data()
print r, info, "by: ", self.client_address
f = StringIO()
f.write('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">')
f.write("<html>\n<title>Upload Result Page</title>\n")
f.write("<body>\n<h2>Upload Result Page</h2>\n")
if r:
f.write("<br><a href=\"%s\">back</a>" % self.headers['referer'])
f.write("<hr><small>Powerd By: bones7456, check new version at ")
f.write("<a href=\"\">")
length = f.tell()
self.send_header("Content-type", "text/html")
self.send_header("Content-Length", str(length))
if f:
self.copyfile(f, self.wfile)
def deal_post_data(self):
boundary = self.headers.plisttext.split("=")[1]
remainbytes = int(self.headers['content-length'])
line = self.rfile.readline()
remainbytes -= len(line)
if not boundary in line:
return (False, "Content NOT begin with boundary")
line = self.rfile.readline()
remainbytes -= len(line)
fn = re.findall(r'Content-Disposition.*name="file"; filename="(.*)"', line)
if not fn:
return (False, "Can't find out file name...")
path = self.translate_path(self.path)
fn = os.path.join(path, fn[0])
line = self.rfile.readline()
remainbytes -= len(line)
line = self.rfile.readline()
remainbytes -= len(line)
out = open(fn, 'wb')
except IOError:
return (False, "Can't create file to write, do you have permission to write?")
preline = self.rfile.readline()
remainbytes -= len(preline)
while remainbytes > 0:
line = self.rfile.readline()
remainbytes -= len(line)
if boundary in line:
preline = preline[0:-1]
if preline.endswith('\r'):
preline = preline[0:-1]
return (True, "File '%s' upload success!" % fn)
preline = line
return (False, "Unexpect Ends of data.")
def send_head(self):
"""Common code for GET and HEAD commands.
This sends the response code and MIME headers.
Return value is either a file object (which has to be copied
to the outputfile by the caller unless the command was HEAD,
and must be closed by the caller under all circumstances), or
None, in which case the caller has nothing further to do.
path = self.translate_path(self.path)
f = None
if os.path.isdir(path):
if not self.path.endswith('/'):
# redirect browser - doing basically what apache does
self.send_header("Location", self.path + "/")
return None
for index in "index.html", "index.htm":
index = os.path.join(path, index)
if os.path.exists(index):
path = index
return self.list_directory(path)
ctype = self.guess_type(path)
# Always read in binary mode. Opening files in text mode may cause
# newline translations, making the actual size of the content
# transmitted *less* than the content-length!
f = open(path, 'rb')
except IOError:
self.send_error(404, "File not found")
return None
self.send_header("Content-type", ctype)
fs = os.fstat(f.fileno())
self.send_header("Content-Length", str(fs[6]))
self.send_header("Last-Modified", self.date_time_string(fs.st_mtime))
return f
def list_directory(self, path):
"""Helper to produce a directory listing (absent index.html).
Return value is either a file object, or None (indicating an
error). In either case, the headers are sent, making the
interface the same as for send_head().
list = os.listdir(path)
except os.error:
self.send_error(404, "No permission to list directory")
return None
list.sort(key=lambda a: a.lower())
f = StringIO()
displaypath = cgi.escape(urllib.unquote(self.path))
f.write('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">')
f.write("<html>\n<title>Directory listing for %s</title>\n" % displaypath)
f.write("<body>\n<h2>Directory listing for %s</h2>\n" % displaypath)
f.write("<form ENCTYPE=\"multipart/form-data\" method=\"post\">")
f.write("<input name=\"file\" type=\"file\"/>")
f.write("<input type=\"submit\" value=\"upload\"/></form>\n")
for name in list:
fullname = os.path.join(path, name)
displayname = linkname = name
# Append / for directories or @ for symbolic links
if os.path.isdir(fullname):
displayname = name + "/"
linkname = name + "/"
if os.path.islink(fullname):
displayname = name + "@"
# Note: a link to a directory displays with @ and links with /
f.write('<li><a href="%s">%s</a>\n'
% (urllib.quote(linkname), cgi.escape(displayname)))
length = f.tell()
self.send_header("Content-type", "text/html")
self.send_header("Content-Length", str(length))
return f
def translate_path(self, path):
"""Translate a /-separated PATH to the local filename syntax.
Components that mean special things to the local file system
(e.g. drive or directory names) are ignored. (XXX They should
probably be diagnosed.)
# abandon query parameters
path = path.split('?',1)[0]
path = path.split('#',1)[0]
path = posixpath.normpath(urllib.unquote(path))
words = path.split('/')
words = filter(None, words)
path = os.getcwd()
for word in words:
drive, word = os.path.splitdrive(word)
head, word = os.path.split(word)
if word in (os.curdir, os.pardir): continue
path = os.path.join(path, word)
return path
def copyfile(self, source, outputfile):
"""Copy all data between two file objects.
The SOURCE argument is a file object open for reading
(or anything with a read() method) and the DESTINATION
argument is a file object open for writing (or
anything with a write() method).
The only reason for overriding this would be to change
the block size or perhaps to replace newlines by CRLF
-- note however that this the default server uses this
to copy binary data as well.
shutil.copyfileobj(source, outputfile)
def guess_type(self, path):
"""Guess the type of a file.
Argument is a PATH (a filename).
Return value is a string of the form type/subtype,
usable for a MIME Content-type header.
The default implementation looks the file's extension
up in the table self.extensions_map, using application/octet-stream
as a default; however it would be permissible (if
slow) to look inside the data to make a better guess.
base, ext = posixpath.splitext(path)
if ext in self.extensions_map:
return self.extensions_map[ext]
ext = ext.lower()
if ext in self.extensions_map:
return self.extensions_map[ext]
return self.extensions_map['']
if not mimetypes.inited:
mimetypes.init() # try to read system mime.types
extensions_map = mimetypes.types_map.copy()
'': 'application/octet-stream', # Default
'.py': 'text/plain',
'.c': 'text/plain',
'.h': 'text/plain',
def test(HandlerClass = SimpleHTTPRequestHandler,
ServerClass = BaseHTTPServer.HTTPServer):
BaseHTTPServer.test(HandlerClass, ServerClass)
if __name__ == '__main__':
Copy link

fake-name commented May 14, 2017

Please sanitize the upload filename, to prevent parent directory issues. This is as simple as assert os.path.abspath(fn ).startswith(os.path.abspath(self.path)), inserted after line 100.

os.path.abspath() has the effect of collapsing ../ or // in the path, to result in a canonical file-path.

Copy link

gehaxelt commented May 14, 2017

As @fake-name said, the upload functionality contains a vulnerability, which has been discussed here 0 and here 1.

Copy link

it will be great if these vulnerabilities are closed.

Copy link

any suggestion how to delete a file ?

Copy link

Ademord commented Jul 26, 2017

@shafi-codez a solution is in 1, as mentined by @gehaxelt, but it hasnt been merged apparently

Copy link

caxton commented Dec 8, 2017

how can make this to upload multiple files?

Copy link

Bobarshad commented Jan 6, 2018

Hi, as I am new in this, please someone explain how to run this program step by step on apache2. thanks.

Copy link

Great piece of code. Thank you for sharing

Copy link

cpdef commented Apr 4, 2018

i forked the code too from the python3 fork and added authentication and ssl see here
its more a collection of the features then my own work.

Copy link

akd2k6 commented Jun 4, 2018

This is a great. I am able to send file from linux(client) to linux(server) with curl. How can I send file from my windows desktop with some kind of small html page?

Copy link


Copy link

Hi all, excuse my ignorance but how can I leverage this script to allow for the creation of a new folder within the current directory? I have googled everything I can think of but I think it's a little over my head. In its current state, you can only upload files, not create a new directory. Thanks!

Copy link

holyhan commented Aug 14, 2018


Copy link

brun0ne commented Oct 4, 2018

Good job, thanks!

Copy link

awesomem bro!

I use you little script to transer files with my virtual machine

Copy link

miladhub commented Nov 7, 2018

This saved my day 👍

Copy link

royoan commented Dec 15, 2018

How can it support other language? such as an folder name is Chinese

Copy link

hbk899 commented Dec 16, 2018

How to test this
is there any client code for this

Copy link

4d4c commented Feb 10, 2019

HTTPS version with basic authentication -

Copy link

joonahn commented Mar 5, 2019

changed the code to upload multiple files -

Copy link

npes87184 commented Apr 28, 2019

DeprecationWarning: cgi.escape is deprecated, use html.escape instead

@@ -18,7 +18,7 @@ import os
 import posixpath
 import http.server
 import urllib.request, urllib.parse, urllib.error
-import cgi
+import html
 import shutil
 import mimetypes
 import re
@@ -187,7 +187,7 @@ class SimpleHTTPRequestHandler(http.server.BaseHTTPRequestHandler):
             return None
         list.sort(key=lambda a: a.lower())
         f = BytesIO()
-        displaypath = cgi.escape(urllib.parse.unquote(self.path))
+        displaypath = html.escape(urllib.parse.unquote(self.path))
         f.write(b'<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">')
         f.write(("<html>\n<title>Directory listing for %s</title>\n" % displaypath).encode())
         f.write(("<body>\n<h2>Directory listing for %s</h2>\n" % displaypath).encode())
@@ -207,7 +207,7 @@ class SimpleHTTPRequestHandler(http.server.BaseHTTPRequestHandler):
                 displayname = name + "@"
                 # Note: a link to a directory displays with @ and links with /
             f.write(('<li><a href="%s">%s</a>\n'
-                    % (urllib.parse.quote(linkname), cgi.escape(displayname))).encode())
+                    % (urllib.parse.quote(linkname), html.escape(displayname))).encode())
         length = f.tell()

Copy link

BaseHTTPServer is not accepted by my console

Copy link

Tallguy297 commented Aug 21, 2019

This is my modified version which allows for IP address, port binding, multiple uploads (thanks to joonahn) and has colourful icons.
I hope you find this code useful. This works on Python 3.
Click here for my code.

Copy link

lapwat commented Feb 5, 2020

@Tallguy297 Thanks

Copy link

xinghaixu commented Jun 9, 2020
修复支持 curl -X POST -F file=@filename 的方式上传文件
sys.stdout.flush() 强制刷新缓冲区,print的数据日志不生效

Copy link

Hi all! I wrote a similar script that supports multiple-file upload and HTTPS. Click here to check it out :D

Copy link

RaSan147 commented Feb 1, 2022

who knew the original author of this script would get only get 9stars. original post
lets give him a thanks. (took me 30 min to shell out his post from his website) 🥵

Copy link

RaSan147 commented Feb 1, 2022

I extracted all the juice out of different sources and finally made this http server with delete and multiupload
hope you'd like it.
also @shafi-codez it solves your question (with post request)

Copy link

swerder commented Feb 2, 2023

I also merge all the stuff togehter, and make it more extendable (still one file):

  • extend original SimpleHTTPRequestHandler (add if-modified support, get fixes from python releases)
  • implements simple Authentication, ssl
  • full "multipart" rfc2046 handling
  • multi file upload, create folder and delete files (main upload logic)
  • TableView file listing with icon/size/date
As the different parts/features of the logic are each separate classes it can also be used/extended for other purpose.

Copy link

RaSan147 commented Feb 3, 2023

Uploaded to pip 😀(sorry for bragging but my 1st pip project, big moment😅)

I'll no longer call it the simple httpserver we know but a mutation. Supports full customization by simply adding handlers to any requests.

  • password based upload,
  • download folder as zip,
  • admin center (user based permission under work),
  • file manager like ui and functions (right click delete, recycle, file/folder info, rename etc)
  • Plyer in site video player
  • whats best, just pyrobox in shell from any folder (safe since you dont need to keep the server .py file in folder so there's no risk on getting it replaced by upload)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment