#!/usr/bin/env python | |
"""Simple HTTP Server With Upload. | |
This module builds on BaseHTTPServer by implementing the standard GET | |
and HEAD requests in a fairly straightforward manner. | |
""" | |
__version__ = "0.1" | |
__all__ = ["SimpleHTTPRequestHandler"] | |
__author__ = "bones7456" | |
__home_page__ = "http://li2z.cn/" | |
import os | |
import posixpath | |
import BaseHTTPServer | |
import urllib | |
import cgi | |
import shutil | |
import mimetypes | |
import re | |
try: | |
from cStringIO import StringIO | |
except ImportError: | |
from StringIO import StringIO | |
class SimpleHTTPRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler): | |
"""Simple HTTP request handler with GET/HEAD/POST commands. | |
This serves files from the current directory and any of its | |
subdirectories. The MIME type for files is determined by | |
calling the .guess_type() method. And can reveive file uploaded | |
by client. | |
The GET/HEAD/POST requests are identical except that the HEAD | |
request omits the actual contents of the file. | |
""" | |
server_version = "SimpleHTTPWithUpload/" + __version__ | |
def do_GET(self): | |
"""Serve a GET request.""" | |
f = self.send_head() | |
if f: | |
self.copyfile(f, self.wfile) | |
f.close() | |
def do_HEAD(self): | |
"""Serve a HEAD request.""" | |
f = self.send_head() | |
if f: | |
f.close() | |
def do_POST(self): | |
"""Serve a POST request.""" | |
r, info = self.deal_post_data() | |
print r, info, "by: ", self.client_address | |
f = StringIO() | |
f.write('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">') | |
f.write("<html>\n<title>Upload Result Page</title>\n") | |
f.write("<body>\n<h2>Upload Result Page</h2>\n") | |
f.write("<hr>\n") | |
if r: | |
f.write("<strong>Success:</strong>") | |
else: | |
f.write("<strong>Failed:</strong>") | |
f.write(info) | |
f.write("<br><a href=\"%s\">back</a>" % self.headers['referer']) | |
f.write("<hr><small>Powerd By: bones7456, check new version at ") | |
f.write("<a href=\"http://li2z.cn/?s=SimpleHTTPServerWithUpload\">") | |
f.write("here</a>.</small></body>\n</html>\n") | |
length = f.tell() | |
f.seek(0) | |
self.send_response(200) | |
self.send_header("Content-type", "text/html") | |
self.send_header("Content-Length", str(length)) | |
self.end_headers() | |
if f: | |
self.copyfile(f, self.wfile) | |
f.close() | |
def deal_post_data(self): | |
boundary = self.headers.plisttext.split("=")[1] | |
remainbytes = int(self.headers['content-length']) | |
line = self.rfile.readline() | |
remainbytes -= len(line) | |
if not boundary in line: | |
return (False, "Content NOT begin with boundary") | |
line = self.rfile.readline() | |
remainbytes -= len(line) | |
fn = re.findall(r'Content-Disposition.*name="file"; filename="(.*)"', line) | |
if not fn: | |
return (False, "Can't find out file name...") | |
path = self.translate_path(self.path) | |
fn = os.path.join(path, fn[0]) | |
line = self.rfile.readline() | |
remainbytes -= len(line) | |
line = self.rfile.readline() | |
remainbytes -= len(line) | |
try: | |
out = open(fn, 'wb') | |
except IOError: | |
return (False, "Can't create file to write, do you have permission to write?") | |
preline = self.rfile.readline() | |
remainbytes -= len(preline) | |
while remainbytes > 0: | |
line = self.rfile.readline() | |
remainbytes -= len(line) | |
if boundary in line: | |
preline = preline[0:-1] | |
if preline.endswith('\r'): | |
preline = preline[0:-1] | |
out.write(preline) | |
out.close() | |
return (True, "File '%s' upload success!" % fn) | |
else: | |
out.write(preline) | |
preline = line | |
return (False, "Unexpect Ends of data.") | |
def send_head(self): | |
"""Common code for GET and HEAD commands. | |
This sends the response code and MIME headers. | |
Return value is either a file object (which has to be copied | |
to the outputfile by the caller unless the command was HEAD, | |
and must be closed by the caller under all circumstances), or | |
None, in which case the caller has nothing further to do. | |
""" | |
path = self.translate_path(self.path) | |
f = None | |
if os.path.isdir(path): | |
if not self.path.endswith('/'): | |
# redirect browser - doing basically what apache does | |
self.send_response(301) | |
self.send_header("Location", self.path + "/") | |
self.end_headers() | |
return None | |
for index in "index.html", "index.htm": | |
index = os.path.join(path, index) | |
if os.path.exists(index): | |
path = index | |
break | |
else: | |
return self.list_directory(path) | |
ctype = self.guess_type(path) | |
try: | |
# Always read in binary mode. Opening files in text mode may cause | |
# newline translations, making the actual size of the content | |
# transmitted *less* than the content-length! | |
f = open(path, 'rb') | |
except IOError: | |
self.send_error(404, "File not found") | |
return None | |
self.send_response(200) | |
self.send_header("Content-type", ctype) | |
fs = os.fstat(f.fileno()) | |
self.send_header("Content-Length", str(fs[6])) | |
self.send_header("Last-Modified", self.date_time_string(fs.st_mtime)) | |
self.end_headers() | |
return f | |
def list_directory(self, path): | |
"""Helper to produce a directory listing (absent index.html). | |
Return value is either a file object, or None (indicating an | |
error). In either case, the headers are sent, making the | |
interface the same as for send_head(). | |
""" | |
try: | |
list = os.listdir(path) | |
except os.error: | |
self.send_error(404, "No permission to list directory") | |
return None | |
list.sort(key=lambda a: a.lower()) | |
f = StringIO() | |
displaypath = cgi.escape(urllib.unquote(self.path)) | |
f.write('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">') | |
f.write("<html>\n<title>Directory listing for %s</title>\n" % displaypath) | |
f.write("<body>\n<h2>Directory listing for %s</h2>\n" % displaypath) | |
f.write("<hr>\n") | |
f.write("<form ENCTYPE=\"multipart/form-data\" method=\"post\">") | |
f.write("<input name=\"file\" type=\"file\"/>") | |
f.write("<input type=\"submit\" value=\"upload\"/></form>\n") | |
f.write("<hr>\n<ul>\n") | |
for name in list: | |
fullname = os.path.join(path, name) | |
displayname = linkname = name | |
# Append / for directories or @ for symbolic links | |
if os.path.isdir(fullname): | |
displayname = name + "/" | |
linkname = name + "/" | |
if os.path.islink(fullname): | |
displayname = name + "@" | |
# Note: a link to a directory displays with @ and links with / | |
f.write('<li><a href="%s">%s</a>\n' | |
% (urllib.quote(linkname), cgi.escape(displayname))) | |
f.write("</ul>\n<hr>\n</body>\n</html>\n") | |
length = f.tell() | |
f.seek(0) | |
self.send_response(200) | |
self.send_header("Content-type", "text/html") | |
self.send_header("Content-Length", str(length)) | |
self.end_headers() | |
return f | |
def translate_path(self, path): | |
"""Translate a /-separated PATH to the local filename syntax. | |
Components that mean special things to the local file system | |
(e.g. drive or directory names) are ignored. (XXX They should | |
probably be diagnosed.) | |
""" | |
# abandon query parameters | |
path = path.split('?',1)[0] | |
path = path.split('#',1)[0] | |
path = posixpath.normpath(urllib.unquote(path)) | |
words = path.split('/') | |
words = filter(None, words) | |
path = os.getcwd() | |
for word in words: | |
drive, word = os.path.splitdrive(word) | |
head, word = os.path.split(word) | |
if word in (os.curdir, os.pardir): continue | |
path = os.path.join(path, word) | |
return path | |
def copyfile(self, source, outputfile): | |
"""Copy all data between two file objects. | |
The SOURCE argument is a file object open for reading | |
(or anything with a read() method) and the DESTINATION | |
argument is a file object open for writing (or | |
anything with a write() method). | |
The only reason for overriding this would be to change | |
the block size or perhaps to replace newlines by CRLF | |
-- note however that this the default server uses this | |
to copy binary data as well. | |
""" | |
shutil.copyfileobj(source, outputfile) | |
def guess_type(self, path): | |
"""Guess the type of a file. | |
Argument is a PATH (a filename). | |
Return value is a string of the form type/subtype, | |
usable for a MIME Content-type header. | |
The default implementation looks the file's extension | |
up in the table self.extensions_map, using application/octet-stream | |
as a default; however it would be permissible (if | |
slow) to look inside the data to make a better guess. | |
""" | |
base, ext = posixpath.splitext(path) | |
if ext in self.extensions_map: | |
return self.extensions_map[ext] | |
ext = ext.lower() | |
if ext in self.extensions_map: | |
return self.extensions_map[ext] | |
else: | |
return self.extensions_map[''] | |
if not mimetypes.inited: | |
mimetypes.init() # try to read system mime.types | |
extensions_map = mimetypes.types_map.copy() | |
extensions_map.update({ | |
'': 'application/octet-stream', # Default | |
'.py': 'text/plain', | |
'.c': 'text/plain', | |
'.h': 'text/plain', | |
}) | |
def test(HandlerClass = SimpleHTTPRequestHandler, | |
ServerClass = BaseHTTPServer.HTTPServer): | |
BaseHTTPServer.test(HandlerClass, ServerClass) | |
if __name__ == '__main__': | |
test() |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
kylelk
commented
Nov 14, 2013
Thank you, This is a very useful program. |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
chantisnake
commented
Dec 7, 2014
great |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
codefalasi
Jan 13, 2015
THANK YOU!!! Awesome code and really helped ! will always use this when i need to quickly upload stuff to my server! really appreciate it!
codefalasi
commented
Jan 13, 2015
THANK YOU!!! Awesome code and really helped ! will always use this when i need to quickly upload stuff to my server! really appreciate it! |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
gwokae
Jan 16, 2015
Thanks! And this command can upload file by curl command curl -X POST -F file=@<path-to-file> http://<host-ip>:8000
gwokae
commented
Jan 16, 2015
Thanks! And this command can upload file by curl command |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
rhmoult
Feb 6, 2015
Thanks! I've updated this to use SSL: https://github.com/rhmoult/SecurityTools/blob/master/Platform_Independent/Python/httpsWithUpload/src/httpsWithUpload.py
rhmoult
commented
Feb 6, 2015
Thanks! I've updated this to use SSL: https://github.com/rhmoult/SecurityTools/blob/master/Platform_Independent/Python/httpsWithUpload/src/httpsWithUpload.py |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
touilleMan
Mar 5, 2015
Hi,
I've forked this gist to port it to Python 3
see: https://gist.github.com/touilleMan/eb02ea40b93e52604938
touilleMan
commented
Mar 5, 2015
Hi, I've forked this gist to port it to Python 3 |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
wonjohnchoi
Aug 26, 2015
I've forked this gist and added basic authentication
https://gist.github.com/wonjohnchoi/a4cc44be5dd2f47fd97f
wonjohnchoi
commented
Aug 26, 2015
I've forked this gist and added basic authentication |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
mayank13
commented
Sep 25, 2015
Is there any upload limit ? |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
dviljoen
commented
Oct 26, 2015
Thank you for this. Excellent. |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
rctay
Dec 19, 2015
Fix curl -F 'file123=@foo.txt'
https://gist.github.com/rctay/25bed284cd4bcc1477f4/a99fc29abcbe272ad32db687c5b688cbf0c46f18
rctay
commented
Dec 19, 2015
Fix |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
amdei
Jan 29, 2016
I've forked gist and fix an issue, so absence of 'Content-Type' do not lead to stripping first line of posted data.
https://gist.github.com/amdei/7a83e61373a040697e48
amdei
commented
Jan 29, 2016
I've forked gist and fix an issue, so absence of 'Content-Type' do not lead to stripping first line of posted data. |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
WebReflection
Feb 11, 2016
mind adding <meta name='viewport' content='width=device-width,initial-scale=1.0,minimum-scale=1.0'>
after each </title>
so devices can easily tap the upload form? P.S. thanks for the hand/no-brainer script
WebReflection
commented
Feb 11, 2016
mind adding |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
mjeff7
commented
Feb 19, 2016
Thanks! This helped in a pinch. |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
RemoteEvilDragon
Mar 3, 2016
I used this scirpt,it works well except one place:
from line 100 to line 104
"line = self.rfile.readline()
remainbytes -= len(line)
line = self.rfile.readline()
remainbytes -= len(line)"
by debugging,I removed first two lines and things go well again.
RemoteEvilDragon
commented
Mar 3, 2016
I used this scirpt,it works well except one place: by debugging,I removed first two lines and things go well again. |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
louietsai
Mar 4, 2016
Hi
I would like to leverage your code.
Can I redistribute your code? What license do you use for the code?
thanks
Louie
louietsai
commented
Mar 4, 2016
Hi thanks |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
jinleileiking
commented
Jul 7, 2016
非常非常好! 可以,这很python |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
BillLucky
commented
Jul 7, 2016
简直太好了,这很python ~ |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
arulrajnet
Jul 13, 2016
This script expecting referer from header at line 73
So you have to send referer while upload using curl.
curl -F 'file=@some-data.tar.gz' -H 'referer: http://localhost/' http://localhost:8090/ -v
My fork has that validation https://gist.github.com/arulrajnet/af376482bbe95346824e419b7c9cbdd0
arulrajnet
commented
Jul 13, 2016
•
edited
edited
This script expecting referer from header at line 73
My fork has that validation https://gist.github.com/arulrajnet/af376482bbe95346824e419b7c9cbdd0 |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
samthebest
Jul 13, 2016
There is a rather strange bug where if the user clicks "upload" without first selecting a file it prints out the permissions error:
try:
out = open(fn, 'wb')
except IOError:
return (False, "Can't create file to write, do you have permission to write?")
Simple fix is to change the error message to include "or did you remember to select a file?"
samthebest
commented
Jul 13, 2016
There is a rather strange bug where if the user clicks "upload" without first selecting a file it prints out the permissions error:
Simple fix is to change the error message to include "or did you remember to select a file?" |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
vectorman1
Jul 19, 2016
The bug isn't strange and it's to be expected. An IOError exception is thrown when there is no existing file for python to read, or it can't find it. The same happens when python doesn't have permissions to read it, you can say it just doesn't see it. A simple solution would be a client-side verification with javascript.
vectorman1
commented
Jul 19, 2016
The bug isn't strange and it's to be expected. An IOError exception is thrown when there is no existing file for python to read, or it can't find it. The same happens when python doesn't have permissions to read it, you can say it just doesn't see it. A simple solution would be a client-side verification with javascript. |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
weichaoGit
Dec 23, 2016
Great work!
Here is another simple one-file server python script, with uploading, downloading, ssl, and lots of command line arguments.
https://github.com/stackp/Droopy
weichaoGit
commented
Dec 23, 2016
Great work! |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
dmorehead
Dec 23, 2016
..having trouble using it to send an image via javascript, ..my question on stackoverflow
http://stackoverflow.com/questions/41305710/simplehttpserverwithupload-py-post-image-via-javascript
dmorehead
commented
Dec 23, 2016
..having trouble using it to send an image via javascript, ..my question on stackoverflow http://stackoverflow.com/questions/41305710/simplehttpserverwithupload-py-post-image-via-javascript |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
bakaiadam
commented
Feb 2, 2017
how can i change port? |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
poplarch
commented
Apr 1, 2017
@bakaiadam python SimpleHTTPServerWithUpload.py port |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
shafi-codez
commented
Apr 18, 2017
How not to list SimpleHTTPServerWithUpload.py file itself ? |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
fake-name
May 14, 2017
Please sanitize the upload filename, to prevent parent directory issues. This is as simple as assert os.path.abspath(fn ).startswith(os.path.abspath(self.path))
, inserted after line 100.
os.path.abspath()
has the effect of collapsing ../
or //
in the path, to result in a canonical file-path.
fake-name
commented
May 14, 2017
•
edited
edited
Please sanitize the upload filename, to prevent parent directory issues. This is as simple as
|
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
gehaxelt
May 14, 2017
As @fake-name said, the upload functionality contains a vulnerability, which has been discussed here 0 and here 1.
gehaxelt
commented
May 14, 2017
•
edited
edited
As @fake-name said, the upload functionality contains a vulnerability, which has been discussed here 0 and here 1. |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
shafi-codez
commented
May 22, 2017
it will be great if these vulnerabilities are closed. |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
shafi-codez
commented
May 22, 2017
any suggestion how to delete a file ? |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
Ademord
Jul 26, 2017
@shafi-codez a solution is in 1, as mentined by @gehaxelt, but it hasnt been merged apparently
Ademord
commented
Jul 26, 2017
@shafi-codez a solution is in 1, as mentined by @gehaxelt, but it hasnt been merged apparently |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
caxton
commented
Dec 8, 2017
how can make this to upload multiple files? |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
bobarshad
Jan 6, 2018
Hi, as I am new in this, please someone explain how to run this program step by step on apache2. thanks.
bobarshad
commented
Jan 6, 2018
•
edited
edited
Hi, as I am new in this, please someone explain how to run this program step by step on apache2. thanks. |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
nheijmans
commented
Mar 9, 2018
Great piece of code. Thank you for sharing |
cpdef
commented
Apr 4, 2018
•
edited
edited
i forked the code too from the python3 fork and added authentication and ssl see here |
Thank you, This is a very useful program.