Merge pull request #213 from jazzband/prepare-2.4

Prepare 2.4 release

.pre-commit-config.yaml

@@ -0,0 +1,59 @@
+repos:
+-   repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+    -   id: check-toml
+    -   id: check-yaml
+    -   id: end-of-file-fixer
+    -   id: trailing-whitespace
+    -   id: mixed-line-ending
+    -   id: file-contents-sorter
+        files: docs/spelling_wordlist.txt
+-   repo: https://github.com/pycqa/doc8
+    rev: v1.1.1
+    hooks:
+    -   id: doc8
+-   repo: https://github.com/adamchainz/django-upgrade
+    rev: 1.20.0
+    hooks:
+    -   id: django-upgrade
+        args: [--target-version, "4.2"]
+-   repo: https://github.com/pre-commit/pygrep-hooks
+    rev: v1.10.0
+    hooks:
+    -   id: rst-backticks
+    -   id: rst-directive-colons
+-   repo: https://github.com/pre-commit/mirrors-prettier
+    rev: v4.0.0-alpha.8
+    hooks:
+    -   id: prettier
+        entry: env PRETTIER_LEGACY_CLI=1 prettier
+        types_or: [javascript, css]
+        args:
+        - --trailing-comma=es5
+-   repo: https://github.com/pre-commit/mirrors-eslint
+    rev: v9.8.0
+    hooks:
+    -   id: eslint
+        additional_dependencies:
+            - "eslint@v9.0.0-beta.1"
+            - "@eslint/js@v9.0.0-beta.1"
+            - "globals"
+        files: \.js?$
+        types: [file]
+        args:
+        - --fix
+-   repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: 'v0.5.5'
+    hooks:
+      - id: ruff
+        args: [--fix, --exit-non-zero-on-fix]
+      - id: ruff-format
+-   repo: https://github.com/tox-dev/pyproject-fmt
+    rev: 2.1.4
+    hooks:
+      - id: pyproject-fmt
+-   repo: https://github.com/abravalheri/validate-pyproject
+    rev: v0.18
+    hooks:
+      - id: validate-pyproject

.readthedocs.yaml

@@ -0,0 +1,18 @@
+# .readthedocs.yaml
+# Read the Docs configuration file
+# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
+
+version: 2
+
+build:
+  os: ubuntu-22.04
+  tools:
+    python: "3.10"
+
+sphinx:
+  configuration: docs/conf.py
+
+python:
+  install:
+  - method: pip
+    path: .

AUTHORS

@@ -6,22 +6,23 @@ Maintainer: Benoît Bryon <benoit@marmelune.net>
 
 Original code by `PeopleDoc <https://www.people-doc.com/>`_ team:
 
-* Nicolas Tobo <https://github.com/nicolastobo>
-* Lauréline Guérin <https://github.com/zebuline>
-* Gregory Tappero <https://github.com/gregtap>
-* Rémy Hubscher <https://github.com/natim>
+* Adam Chainz <adam@adamj.eu>
+* Aleksi Häkli <aleksi.hakli@iki.fi>
 * Benoît Bryon <benoit@marmelune.net>
-* Aleksi Häkli <https://github.com/aleksihakli>
-* Johnt Hagen <johnthagen@gmail.com>
+* CJ <cjdreiss@users.noreply.github.com>
+* David Wolf <68775926+devidw@users.noreply.github.com>
+* Davide Setti <setti.davide89@gmail.com>
+* Erik Dykema <dykema@gmail.com>
 * Fabre Florian <ffabre@hybird.org>
-* Peter Marheine <peter@taricorp.net>
 * Hasan Ramezani <hasan.r67@gmail.com>
 * Jannis Leidel <jannis@leidel.info>
-* Erik Dykema <dykema@gmail.com>
+* John Hagen <johnthagen@gmail.com>
+* Mariusz Felisiak <felisiak.mariusz@gmail.com>
+* Martin Bächtold <martin@baechtold.me>
 * Nikhil Benesch <nikhil.benesch@gmail.com>
 * Omer Katz <omer.drow@gmail.com>
+* Peter Marheine <peter@taricorp.net>
 * René Leonhardt <rene.leonhardt@gmail.com>
-* Adam Chainz <adam@adamj.eu>
-* Martin Bächtold <martin@baechtold.me>
+* Rémy HUBSCHER <hubscher.remy@gmail.com>
 * Tim Gates <tim.gates@iress.com>
 * zero13cool <zero13cool@yandex.ru>

CHANGELOG

@@ -5,10 +5,12 @@ This document describes changes between past releases. For information about
 future releases, check `milestones`_ and :doc:`/about/vision`.
 
 
-2.4 (Unreleased)
+2.4 (2024-08-05)
 ----------------
 
 - Drop support for Python 3.6
+- Escape malicious filenames
+- Handle headers in XAccel responses
 
 
 2.3 (2022-01-11)

CONTRIBUTING.rst

@@ -11,7 +11,7 @@ This is a `Jazzband <https://jazzband.co>`_ project. By contributing you agree t
 
 
 This document provides guidelines for people who want to contribute to
-`django-downloadview`.
+``django-downloadview``.
 
 
 **************
@@ -50,7 +50,7 @@ Use topic branches
 Fork, clone
 ***********
 
-Clone `django-downloadview` repository (adapt to use your own fork):
+Clone ``django-downloadview`` repository (adapt to use your own fork):
 
 .. code:: sh
 
@@ -62,15 +62,15 @@ Clone `django-downloadview` repository (adapt to use your own fork):
 Usual actions
 *************
 
-The `Makefile` is the reference card for usual actions in development
+The ``Makefile`` is the reference card for usual actions in development
 environment:
 
 * Install development toolkit with `pip`_: ``make develop``.
 
 * Run tests with `tox`_: ``make test``.
 
 * Build documentation: ``make documentation``. It builds `Sphinx`_
-  documentation in `var/docs/html/index.html`.
+  documentation in ``var/docs/html/index.html``.
 
 * Release project with `zest.releaser`_: ``make release``.
 
@@ -84,15 +84,15 @@ See also ``make help``.
 Demo project included
 *********************
 
-The `demo` included in project's repository is part of the tests and
+The ``demo`` included in project's repository is part of the tests and
 documentation. Maintain it along with code and documentation.
 
 
 .. rubric:: Notes & references
 
 .. target-notes::
 
-.. _`bugtracker`: 
+.. _`bugtracker`:
    https://github.com/jazzband/django-downloadview/issues
 .. _`rebase`: http://git-scm.com/book/en/Git-Branching-Rebasing
 .. _`merge-based rebase`: https://tech.people-doc.com/psycho-rebasing.html

README.rst

@@ -26,16 +26,16 @@ django-downloadview
     :target: https://codecov.io/gh/jazzband/django-downloadview
     :alt: Coverage
 
-`django-downloadview` makes it easy to serve files with `Django`_:
+``django-downloadview`` makes it easy to serve files with `Django`_:
 
 * you manage files with Django (permissions, filters, generation, ...);
 
 * files are stored somewhere or generated somehow (local filesystem, remote
   storage, memory...);
 
-* `django-downloadview` helps you stream the files with very little code;
+* ``django-downloadview`` helps you stream the files with very little code;
 
-* `django-downloadview` helps you improve performances with reverse proxies,
+* ``django-downloadview`` helps you improve performances with reverse proxies,
   via mechanisms such as Nginx's X-Accel or Apache's X-Sendfile.
 
 

demo/README.rst

@@ -3,7 +3,7 @@ Demo project
 ############
 
 `Demo folder in project's repository`_ contains a Django project to illustrate
-`django-downloadview` usage.
+``django-downloadview`` usage.
 
 
 *****************************************
@@ -32,7 +32,7 @@ Deploy the demo
 System requirements:
 
 * `Python`_ version 3.7+, available as ``python`` command.
-  
+
   .. note::
 
      You may use `Virtualenv`_ to make sure the active ``python`` is the right

demo/demoproject/apache/tests.py

@@ -58,4 +58,4 @@ def test_response(self):
             basename="hello-world.txt",
             file_path="/apache-modified-headers/hello-world.txt",
         )
-        self.assertEqual(response['X-Test'], 'header')
+        self.assertEqual(response["X-Test"], "header")

demo/demoproject/apache/urls.py

@@ -1,4 +1,5 @@
 """URL mapping."""
+
 from django.urls import path
 
 from demoproject.apache import views

demo/demoproject/apache/views.py

@@ -27,7 +27,7 @@
 def _modified_headers(request):
     view = StorageDownloadView.as_view(storage=storage, path="hello-world.txt")
     response = view(request)
-    response["X-Test"] = 'header'
+    response["X-Test"] = "header"
     return response
 
 

demo/demoproject/fixtures/demo.json

@@ -1,9 +1,9 @@
 [
     {
-        "pk": 1, 
-        "model": "object.document", 
+        "pk": 1,
+        "model": "object.document",
         "fields": {
-            "slug": "hello-world", 
+            "slug": "hello-world",
             "file": "object/hello-world.txt"
         }
     }

demo/demoproject/lighttpd/tests.py

@@ -58,4 +58,4 @@ def test_response(self):
             basename="hello-world.txt",
             file_path="/lighttpd-modified-headers/hello-world.txt",
         )
-        self.assertEqual(response['X-Test'], 'header')
+        self.assertEqual(response["X-Test"], "header")

demo/demoproject/lighttpd/urls.py

@@ -1,4 +1,5 @@
 """URL mapping."""
+
 from django.urls import path
 
 from demoproject.lighttpd import views

demo/demoproject/lighttpd/views.py

@@ -27,7 +27,7 @@
 def _modified_headers(request):
     view = StorageDownloadView.as_view(storage=storage, path="hello-world.txt")
     response = view(request)
-    response["X-Test"] = 'header'
+    response["X-Test"] = "header"
     return response
 
 

demo/demoproject/nginx/tests.py

@@ -70,4 +70,4 @@ def test_response(self):
             with_buffering=None,
             limit_rate=None,
         )
-        self.assertEqual(response['X-Test'], 'header')
+        self.assertEqual(response["X-Test"], "header")

demo/demoproject/nginx/views.py

@@ -27,7 +27,7 @@
 def _modified_headers(request):
     view = StorageDownloadView.as_view(storage=storage, path="hello-world.txt")
     response = view(request)
-    response["X-Test"] = 'header'
+    response["X-Test"] = "header"
     return response
 
 

demo/demoproject/settings.py

@@ -1,4 +1,5 @@
 """Django settings for django-downloadview demo project."""
+
 import os
 
 

demo/demoproject/storage/tests.py

@@ -44,8 +44,7 @@ def test_not_modified_download_response(self):
         url = reverse("storage:static_path", kwargs={"path": "1.txt"})
         year = datetime.date.today().year + 4
         response = self.client.get(
-            url,
-            HTTP_IF_MODIFIED_SINCE=f"Sat, 29 Oct {year} 19:43:31 GMT",
+            url, headers={"if-modified-since": f"Sat, 29 Oct {year} 19:43:31 GMT"}
         )
         self.assertTrue(isinstance(response, HttpResponseNotModified))
 
@@ -55,7 +54,7 @@ def test_modified_since_download_response(self):
         setup_file("1.txt")
         url = reverse("storage:static_path", kwargs={"path": "1.txt"})
         response = self.client.get(
-            url, HTTP_IF_MODIFIED_SINCE="Sat, 29 Oct 1980 19:43:31 GMT"
+            url, headers={"if-modified-since": "Sat, 29 Oct 1980 19:43:31 GMT"}
         )
         assert_download_response(
             self,

demo/demoproject/tests.py

@@ -1,4 +1,5 @@
 """Test suite for demoproject.download."""
+
 from django.test import TestCase
 from django.urls import reverse
 

demo/demoproject/wsgi.py

@@ -12,6 +12,7 @@
 framework.
 
 """
+
 import os
 
 from django.core.wsgi import get_wsgi_application

django_downloadview/__init__.py

@@ -1,4 +1,5 @@
 """Serve files with Django and reverse proxies."""
+
 from django_downloadview.api import *  # NoQA
 
 import importlib.metadata

django_downloadview/apache/__init__.py

@@ -5,6 +5,7 @@
 Apache optimizations </optimizations/apache>`.
 
 """
+
 # API shortcuts.
 from django_downloadview.apache.decorators import x_sendfile  # NoQA
 from django_downloadview.apache.middlewares import XSendfileMiddleware  # NoQA

django_downloadview/apache/decorators.py

@@ -1,4 +1,5 @@
 """Decorators to apply Apache X-Sendfile on a specific view."""
+
 from django_downloadview.apache.middlewares import XSendfileMiddleware
 from django_downloadview.decorators import DownloadDecorator
 

django_downloadview/apache/response.py

@@ -1,4 +1,5 @@
 """Apache's specific responses."""
+
 import os.path
 
 from django_downloadview.response import ProxiedDownloadResponse, content_disposition
@@ -7,11 +8,13 @@
 class XSendfileResponse(ProxiedDownloadResponse):
     "Delegates serving file to Apache via X-Sendfile header."
 
-    def __init__(self, file_path, content_type, basename=None, attachment=True, headers=None):
+    def __init__(
+        self, file_path, content_type, basename=None, attachment=True, headers=None
+    ):
         """Return a HttpResponse with headers for Apache X-Sendfile."""
         # content-type must be provided only as keyword argument to response
         if headers and content_type:
-            headers.pop('Content-Type', None)
+            headers.pop("Content-Type", None)
         super().__init__(content_type=content_type, headers=headers)
         if attachment:
             self.basename = basename or os.path.basename(file_path)

django_downloadview/api.py

@@ -1,5 +1,6 @@
 # flake8: noqa
 """Declaration of API shortcuts."""
+
 from django_downloadview.files import HTTPFile, StorageFile, VirtualFile
 from django_downloadview.io import BytesIteratorIO, TextIteratorIO
 from django_downloadview.middlewares import (

django_downloadview/files.py

@@ -1,4 +1,5 @@
 """File wrappers for use as exchange data between views and responses."""
+
 from io import BytesIO
 from urllib.parse import urlparse
 

django_downloadview/io.py

@@ -1,4 +1,5 @@
 """Low-level IO operations, for use with file wrappers."""
+
 import io
 
 from django.utils.encoding import force_bytes, force_str

django_downloadview/lighttpd/__init__.py

@@ -6,6 +6,7 @@
 </optimizations/lighttpd>`.
 
 """
+
 # API shortcuts.
 from django_downloadview.lighttpd.decorators import x_sendfile  # NoQA
 from django_downloadview.lighttpd.middlewares import XSendfileMiddleware  # NoQA