check_permission() - anonymous? when to fail? about django-file-form HOT 10 CLOSED

from django-file-form.

I'll check if the upload to the temp folder can be prevented.

About the permissions: one solution is to disable uploads. Would that be a solution? I think it's not possible at this moment to disable uploads. I'll check that.

from django-file-form.

A possible solution is to make the field disabled when the user doesn't have the permission to upload. Pr #680 adds support for disabled fields.

Another solution is to hide the field.

from django-file-form.

from django-file-form.

I'll check if it's possible to display an error message.

It's a good idea to check as early as possible if a user has permission to upload; the easiest solution is to make the check_permission function configurable.

In the settings file:

def custom_check_permission(request):
  if not request.user.is_authenticated:
    raise PermissionDenied()

FILE_FORM_CHECK_PERMISSIONS_FUNCTION = custom_check_permission

Would that work in your situation?

from django-file-form.

from django-file-form.

I have another issue: to really determine if the upload should be allowed, I would need to get values from other fields of the form... I don't see how that would be at all possible...
So, guess that part comes down to the question of how to delete temp uploads on failed (or never triggered) save...

from django-file-form.

The form has a delete_temporary_files method that removes all temporary files. So that's in the right direction.

I can have a look later if it's possible to remove files for a single field.

from django-file-form.

I added the method delete_temporary_files_for_field in pr #689.

from django-file-form.

Does pr #689 fix the issue?

from django-file-form.