Create a gist now

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Simple Python Http Server with Upload
#!/usr/bin/env python
"""Simple HTTP Server With Upload.
This module builds on BaseHTTPServer by implementing the standard GET
and HEAD requests in a fairly straightforward manner.
"""
__version__ = "0.1"
__all__ = ["SimpleHTTPRequestHandler"]
__author__ = "bones7456"
__home_page__ = "http://li2z.cn/"
import os
import posixpath
import BaseHTTPServer
import urllib
import cgi
import shutil
import mimetypes
import re
try:
from cStringIO import StringIO
except ImportError:
from StringIO import StringIO
class SimpleHTTPRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
"""Simple HTTP request handler with GET/HEAD/POST commands.
This serves files from the current directory and any of its
subdirectories. The MIME type for files is determined by
calling the .guess_type() method. And can reveive file uploaded
by client.
The GET/HEAD/POST requests are identical except that the HEAD
request omits the actual contents of the file.
"""
server_version = "SimpleHTTPWithUpload/" + __version__
def do_GET(self):
"""Serve a GET request."""
f = self.send_head()
if f:
self.copyfile(f, self.wfile)
f.close()
def do_HEAD(self):
"""Serve a HEAD request."""
f = self.send_head()
if f:
f.close()
def do_POST(self):
"""Serve a POST request."""
r, info = self.deal_post_data()
print r, info, "by: ", self.client_address
f = StringIO()
f.write('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">')
f.write("<html>\n<title>Upload Result Page</title>\n")
f.write("<body>\n<h2>Upload Result Page</h2>\n")
f.write("<hr>\n")
if r:
f.write("<strong>Success:</strong>")
else:
f.write("<strong>Failed:</strong>")
f.write(info)
f.write("<br><a href=\"%s\">back</a>" % self.headers['referer'])
f.write("<hr><small>Powerd By: bones7456, check new version at ")
f.write("<a href=\"http://li2z.cn/?s=SimpleHTTPServerWithUpload\">")
f.write("here</a>.</small></body>\n</html>\n")
length = f.tell()
f.seek(0)
self.send_response(200)
self.send_header("Content-type", "text/html")
self.send_header("Content-Length", str(length))
self.end_headers()
if f:
self.copyfile(f, self.wfile)
f.close()
def deal_post_data(self):
boundary = self.headers.plisttext.split("=")[1]
remainbytes = int(self.headers['content-length'])
line = self.rfile.readline()
remainbytes -= len(line)
if not boundary in line:
return (False, "Content NOT begin with boundary")
line = self.rfile.readline()
remainbytes -= len(line)
fn = re.findall(r'Content-Disposition.*name="file"; filename="(.*)"', line)
if not fn:
return (False, "Can't find out file name...")
path = self.translate_path(self.path)
fn = os.path.join(path, fn[0])
line = self.rfile.readline()
remainbytes -= len(line)
line = self.rfile.readline()
remainbytes -= len(line)
try:
out = open(fn, 'wb')
except IOError:
return (False, "Can't create file to write, do you have permission to write?")
preline = self.rfile.readline()
remainbytes -= len(preline)
while remainbytes > 0:
line = self.rfile.readline()
remainbytes -= len(line)
if boundary in line:
preline = preline[0:-1]
if preline.endswith('\r'):
preline = preline[0:-1]
out.write(preline)
out.close()
return (True, "File '%s' upload success!" % fn)
else:
out.write(preline)
preline = line
return (False, "Unexpect Ends of data.")
def send_head(self):
"""Common code for GET and HEAD commands.
This sends the response code and MIME headers.
Return value is either a file object (which has to be copied
to the outputfile by the caller unless the command was HEAD,
and must be closed by the caller under all circumstances), or
None, in which case the caller has nothing further to do.
"""
path = self.translate_path(self.path)
f = None
if os.path.isdir(path):
if not self.path.endswith('/'):
# redirect browser - doing basically what apache does
self.send_response(301)
self.send_header("Location", self.path + "/")
self.end_headers()
return None
for index in "index.html", "index.htm":
index = os.path.join(path, index)
if os.path.exists(index):
path = index
break
else:
return self.list_directory(path)
ctype = self.guess_type(path)
try:
# Always read in binary mode. Opening files in text mode may cause
# newline translations, making the actual size of the content
# transmitted *less* than the content-length!
f = open(path, 'rb')
except IOError:
self.send_error(404, "File not found")
return None
self.send_response(200)
self.send_header("Content-type", ctype)
fs = os.fstat(f.fileno())
self.send_header("Content-Length", str(fs[6]))
self.send_header("Last-Modified", self.date_time_string(fs.st_mtime))
self.end_headers()
return f
def list_directory(self, path):
"""Helper to produce a directory listing (absent index.html).
Return value is either a file object, or None (indicating an
error). In either case, the headers are sent, making the
interface the same as for send_head().
"""
try:
list = os.listdir(path)
except os.error:
self.send_error(404, "No permission to list directory")
return None
list.sort(key=lambda a: a.lower())
f = StringIO()
displaypath = cgi.escape(urllib.unquote(self.path))
f.write('<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">')
f.write("<html>\n<title>Directory listing for %s</title>\n" % displaypath)
f.write("<body>\n<h2>Directory listing for %s</h2>\n" % displaypath)
f.write("<hr>\n")
f.write("<form ENCTYPE=\"multipart/form-data\" method=\"post\">")
f.write("<input name=\"file\" type=\"file\"/>")
f.write("<input type=\"submit\" value=\"upload\"/></form>\n")
f.write("<hr>\n<ul>\n")
for name in list:
fullname = os.path.join(path, name)
displayname = linkname = name
# Append / for directories or @ for symbolic links
if os.path.isdir(fullname):
displayname = name + "/"
linkname = name + "/"
if os.path.islink(fullname):
displayname = name + "@"
# Note: a link to a directory displays with @ and links with /
f.write('<li><a href="%s">%s</a>\n'
% (urllib.quote(linkname), cgi.escape(displayname)))
f.write("</ul>\n<hr>\n</body>\n</html>\n")
length = f.tell()
f.seek(0)
self.send_response(200)
self.send_header("Content-type", "text/html")
self.send_header("Content-Length", str(length))
self.end_headers()
return f
def translate_path(self, path):
"""Translate a /-separated PATH to the local filename syntax.
Components that mean special things to the local file system
(e.g. drive or directory names) are ignored. (XXX They should
probably be diagnosed.)
"""
# abandon query parameters
path = path.split('?',1)[0]
path = path.split('#',1)[0]
path = posixpath.normpath(urllib.unquote(path))
words = path.split('/')
words = filter(None, words)
path = os.getcwd()
for word in words:
drive, word = os.path.splitdrive(word)
head, word = os.path.split(word)
if word in (os.curdir, os.pardir): continue
path = os.path.join(path, word)
return path
def copyfile(self, source, outputfile):
"""Copy all data between two file objects.
The SOURCE argument is a file object open for reading
(or anything with a read() method) and the DESTINATION
argument is a file object open for writing (or
anything with a write() method).
The only reason for overriding this would be to change
the block size or perhaps to replace newlines by CRLF
-- note however that this the default server uses this
to copy binary data as well.
"""
shutil.copyfileobj(source, outputfile)
def guess_type(self, path):
"""Guess the type of a file.
Argument is a PATH (a filename).
Return value is a string of the form type/subtype,
usable for a MIME Content-type header.
The default implementation looks the file's extension
up in the table self.extensions_map, using application/octet-stream
as a default; however it would be permissible (if
slow) to look inside the data to make a better guess.
"""
base, ext = posixpath.splitext(path)
if ext in self.extensions_map:
return self.extensions_map[ext]
ext = ext.lower()
if ext in self.extensions_map:
return self.extensions_map[ext]
else:
return self.extensions_map['']
if not mimetypes.inited:
mimetypes.init() # try to read system mime.types
extensions_map = mimetypes.types_map.copy()
extensions_map.update({
'': 'application/octet-stream', # Default
'.py': 'text/plain',
'.c': 'text/plain',
'.h': 'text/plain',
})
def test(HandlerClass = SimpleHTTPRequestHandler,
ServerClass = BaseHTTPServer.HTTPServer):
BaseHTTPServer.test(HandlerClass, ServerClass)
if __name__ == '__main__':
test()
@kylelk

This comment has been minimized.

Show comment
Hide comment
@kylelk

kylelk Nov 14, 2013

Thank you, This is a very useful program.

kylelk commented Nov 14, 2013

Thank you, This is a very useful program.

@chantisnake

This comment has been minimized.

Show comment
Hide comment

great

@codefalasi

This comment has been minimized.

Show comment
Hide comment
@codefalasi

codefalasi Jan 13, 2015

THANK YOU!!! Awesome code and really helped ! will always use this when i need to quickly upload stuff to my server! really appreciate it!

THANK YOU!!! Awesome code and really helped ! will always use this when i need to quickly upload stuff to my server! really appreciate it!

@gwokae

This comment has been minimized.

Show comment
Hide comment
@gwokae

gwokae Jan 16, 2015

Thanks! And this command can upload file by curl command curl -X POST -F file=@<path-to-file> http://<host-ip>:8000

gwokae commented Jan 16, 2015

Thanks! And this command can upload file by curl command curl -X POST -F file=@<path-to-file> http://<host-ip>:8000

@touilleMan

This comment has been minimized.

Show comment
Hide comment
@touilleMan

touilleMan Mar 5, 2015

Hi,

I've forked this gist to port it to Python 3
see: https://gist.github.com/touilleMan/eb02ea40b93e52604938

Hi,

I've forked this gist to port it to Python 3
see: https://gist.github.com/touilleMan/eb02ea40b93e52604938

@wonjohnchoi

This comment has been minimized.

Show comment
Hide comment
@wonjohnchoi

wonjohnchoi Aug 26, 2015

I've forked this gist and added basic authentication
https://gist.github.com/wonjohnchoi/a4cc44be5dd2f47fd97f

I've forked this gist and added basic authentication
https://gist.github.com/wonjohnchoi/a4cc44be5dd2f47fd97f

@mayank13

This comment has been minimized.

Show comment
Hide comment
@mayank13

mayank13 Sep 25, 2015

Is there any upload limit ?

Is there any upload limit ?

@dviljoen

This comment has been minimized.

Show comment
Hide comment
@dviljoen

dviljoen Oct 26, 2015

Thank you for this. Excellent.

Thank you for this. Excellent.

@amdei

This comment has been minimized.

Show comment
Hide comment
@amdei

amdei Jan 29, 2016

I've forked gist and fix an issue, so absence of 'Content-Type' do not lead to stripping first line of posted data.
https://gist.github.com/amdei/7a83e61373a040697e48

amdei commented Jan 29, 2016

I've forked gist and fix an issue, so absence of 'Content-Type' do not lead to stripping first line of posted data.
https://gist.github.com/amdei/7a83e61373a040697e48

@WebReflection

This comment has been minimized.

Show comment
Hide comment
@WebReflection

WebReflection Feb 11, 2016

mind adding <meta name='viewport' content='width=device-width,initial-scale=1.0,minimum-scale=1.0'> after each </title> so devices can easily tap the upload form? P.S. thanks for the hand/no-brainer script

mind adding <meta name='viewport' content='width=device-width,initial-scale=1.0,minimum-scale=1.0'> after each </title> so devices can easily tap the upload form? P.S. thanks for the hand/no-brainer script

@mjeff7

This comment has been minimized.

Show comment
Hide comment
@mjeff7

mjeff7 Feb 19, 2016

Thanks! This helped in a pinch.

mjeff7 commented Feb 19, 2016

Thanks! This helped in a pinch.

@RemoteEvilDragon

This comment has been minimized.

Show comment
Hide comment
@RemoteEvilDragon

RemoteEvilDragon Mar 3, 2016

I used this scirpt,it works well except one place:
from line 100 to line 104
"line = self.rfile.readline()
remainbytes -= len(line)
line = self.rfile.readline()
remainbytes -= len(line)"

by debugging,I removed first two lines and things go well again.

I used this scirpt,it works well except one place:
from line 100 to line 104
"line = self.rfile.readline()
remainbytes -= len(line)
line = self.rfile.readline()
remainbytes -= len(line)"

by debugging,I removed first two lines and things go well again.

@louietsai

This comment has been minimized.

Show comment
Hide comment
@louietsai

louietsai Mar 4, 2016

Hi
I would like to leverage your code.
Can I redistribute your code? What license do you use for the code?

thanks
Louie

Hi
I would like to leverage your code.
Can I redistribute your code? What license do you use for the code?

thanks
Louie

@jinleileiking

This comment has been minimized.

Show comment
Hide comment
@jinleileiking

jinleileiking Jul 7, 2016

非常非常好! 可以,这很python

非常非常好! 可以,这很python

@BillLucky

This comment has been minimized.

Show comment
Hide comment
@BillLucky

BillLucky Jul 7, 2016

简直太好了,这很python ~

简直太好了,这很python ~

@arulrajnet

This comment has been minimized.

Show comment
Hide comment
@arulrajnet

arulrajnet Jul 13, 2016

This script expecting referer from header at line 73
So you have to send referer while upload using curl.

curl -F 'file=@some-data.tar.gz' -H 'referer: http://localhost/' http://localhost:8090/ -v

My fork has that validation https://gist.github.com/arulrajnet/af376482bbe95346824e419b7c9cbdd0

arulrajnet commented Jul 13, 2016

This script expecting referer from header at line 73
So you have to send referer while upload using curl.

curl -F 'file=@some-data.tar.gz' -H 'referer: http://localhost/' http://localhost:8090/ -v

My fork has that validation https://gist.github.com/arulrajnet/af376482bbe95346824e419b7c9cbdd0

@samthebest

This comment has been minimized.

Show comment
Hide comment
@samthebest

samthebest Jul 13, 2016

There is a rather strange bug where if the user clicks "upload" without first selecting a file it prints out the permissions error:

try:
            out = open(fn, 'wb')
        except IOError:
            return (False, "Can't create file to write, do you have permission to write?")

Simple fix is to change the error message to include "or did you remember to select a file?"

There is a rather strange bug where if the user clicks "upload" without first selecting a file it prints out the permissions error:

try:
            out = open(fn, 'wb')
        except IOError:
            return (False, "Can't create file to write, do you have permission to write?")

Simple fix is to change the error message to include "or did you remember to select a file?"

@vectorman1

This comment has been minimized.

Show comment
Hide comment
@vectorman1

vectorman1 Jul 19, 2016

The bug isn't strange and it's to be expected. An IOError exception is thrown when there is no existing file for python to read, or it can't find it. The same happens when python doesn't have permissions to read it, you can say it just doesn't see it. A simple solution would be a client-side verification with javascript.

The bug isn't strange and it's to be expected. An IOError exception is thrown when there is no existing file for python to read, or it can't find it. The same happens when python doesn't have permissions to read it, you can say it just doesn't see it. A simple solution would be a client-side verification with javascript.

@weichaoGit

This comment has been minimized.

Show comment
Hide comment
@weichaoGit

weichaoGit Dec 23, 2016

Great work!
Here is another simple one-file server python script, with uploading, downloading, ssl, and lots of command line arguments.
https://github.com/stackp/Droopy

Great work!
Here is another simple one-file server python script, with uploading, downloading, ssl, and lots of command line arguments.
https://github.com/stackp/Droopy

@dmorehead

This comment has been minimized.

Show comment
Hide comment
@dmorehead

dmorehead Dec 23, 2016

..having trouble using it to send an image via javascript, ..my question on stackoverflow

http://stackoverflow.com/questions/41305710/simplehttpserverwithupload-py-post-image-via-javascript

..having trouble using it to send an image via javascript, ..my question on stackoverflow

http://stackoverflow.com/questions/41305710/simplehttpserverwithupload-py-post-image-via-javascript

@bakaiadam

This comment has been minimized.

Show comment
Hide comment
@bakaiadam

bakaiadam Feb 2, 2017

how can i change port?

how can i change port?

@poplarch

This comment has been minimized.

Show comment
Hide comment
@poplarch

poplarch Apr 1, 2017

@bakaiadam python SimpleHTTPServerWithUpload.py port

poplarch commented Apr 1, 2017

@bakaiadam python SimpleHTTPServerWithUpload.py port

@shafi-codez

This comment has been minimized.

Show comment
Hide comment
@shafi-codez

shafi-codez Apr 18, 2017

How not to list SimpleHTTPServerWithUpload.py file itself ?

How not to list SimpleHTTPServerWithUpload.py file itself ?

@fake-name

This comment has been minimized.

Show comment
Hide comment
@fake-name

fake-name May 14, 2017

Please sanitize the upload filename, to prevent parent directory issues. This is as simple as assert os.path.abspath(fn ).startswith(os.path.abspath(self.path)), inserted after line 100.

os.path.abspath() has the effect of collapsing ../ or // in the path, to result in a canonical file-path.

fake-name commented May 14, 2017

Please sanitize the upload filename, to prevent parent directory issues. This is as simple as assert os.path.abspath(fn ).startswith(os.path.abspath(self.path)), inserted after line 100.

os.path.abspath() has the effect of collapsing ../ or // in the path, to result in a canonical file-path.

@gehaxelt

This comment has been minimized.

Show comment
Hide comment
@gehaxelt

gehaxelt May 14, 2017

As @fake-name said, the upload functionality contains a vulnerability, which has been discussed here 0 and here 1.

gehaxelt commented May 14, 2017

As @fake-name said, the upload functionality contains a vulnerability, which has been discussed here 0 and here 1.

@shafi-codez

This comment has been minimized.

Show comment
Hide comment
@shafi-codez

shafi-codez May 22, 2017

it will be great if these vulnerabilities are closed.

it will be great if these vulnerabilities are closed.

@shafi-codez

This comment has been minimized.

Show comment
Hide comment
@shafi-codez

shafi-codez May 22, 2017

any suggestion how to delete a file ?

any suggestion how to delete a file ?

@Ademord

This comment has been minimized.

Show comment
Hide comment
@Ademord

Ademord Jul 26, 2017

@shafi-codez a solution is in 1, as mentined by @gehaxelt, but it hasnt been merged apparently

Ademord commented Jul 26, 2017

@shafi-codez a solution is in 1, as mentined by @gehaxelt, but it hasnt been merged apparently

@caxton

This comment has been minimized.

Show comment
Hide comment
@caxton

caxton Dec 8, 2017

how can make this to upload multiple files?

caxton commented Dec 8, 2017

how can make this to upload multiple files?

@bobarshad

This comment has been minimized.

Show comment
Hide comment
@bobarshad

bobarshad Jan 6, 2018

Hi, as I am new in this, please someone explain how to run this program step by step on apache2. thanks.

bobarshad commented Jan 6, 2018

Hi, as I am new in this, please someone explain how to run this program step by step on apache2. thanks.

@nheijmans

This comment has been minimized.

Show comment
Hide comment
@nheijmans

nheijmans Mar 9, 2018

Great piece of code. Thank you for sharing

Great piece of code. Thank you for sharing

@cpdef

This comment has been minimized.

Show comment
Hide comment
@cpdef

cpdef Apr 4, 2018

i forked the code too from the python3 fork and added authentication and ssl see here
its more a collection of the features then my own work.

cpdef commented Apr 4, 2018

i forked the code too from the python3 fork and added authentication and ssl see here
its more a collection of the features then my own work.

@akd2k6

This comment has been minimized.

Show comment
Hide comment
@akd2k6

akd2k6 Jun 4, 2018

This is a great. I am able to send file from linux(client) to linux(server) with curl. How can I send file from my windows desktop with some kind of small html page?

akd2k6 commented Jun 4, 2018

This is a great. I am able to send file from linux(client) to linux(server) with curl. How can I send file from my windows desktop with some kind of small html page?

@joshspicer

This comment has been minimized.

Show comment
Hide comment

Perfect!!

@bigman22

This comment has been minimized.

Show comment
Hide comment
@bigman22

bigman22 Jul 24, 2018

Hi all, excuse my ignorance but how can I leverage this script to allow for the creation of a new folder within the current directory? I have googled everything I can think of but I think it's a little over my head. In its current state, you can only upload files, not create a new directory. Thanks!

Hi all, excuse my ignorance but how can I leverage this script to allow for the creation of a new folder within the current directory? I have googled everything I can think of but I think it's a little over my head. In its current state, you can only upload files, not create a new directory. Thanks!

@holyhan

This comment has been minimized.

Show comment
Hide comment
@holyhan

holyhan Aug 14, 2018

Excellent!

holyhan commented Aug 14, 2018

Excellent!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment