Spaces:

CORVO-AI
/

linux-computer

Paused

App Files Files Community

CORVO-AI commited on Jul 14

Commit

7c6f376

verified ·

1 Parent(s): 86fda11

Create file-manager/app.py

Browse files

Files changed (1) hide show

file-manager/app.py +162 -0

file-manager/app.py ADDED Viewed

	@@ -0,0 +1,162 @@

+import os, shutil, html, urllib.parse
+from flask import Flask, request, redirect, send_file, Response
+from werkzeug.middleware.dispatcher import DispatcherMiddleware
+from werkzeug.serving import run_simple
+app = Flask(__name__)
+app.config["APPLICATION_ROOT"] = "/fm"
+# Guide rule 10: mask secret-bearing values so a stray read can't leak credentials.
+SECRET_HINTS = ("TOKEN", "KEY", "SECRET", "PASSWORD", "AUTH", "COOKIE")
+def is_sensitive(name):
+    up = name.upper()
+    return any(h in up for h in SECRET_HINTS)
+PAGE = """<!doctype html><html><head><title>File Manager</title>
+<style>
+body{{font-family:monospace;margin:20px;background:#111;color:#eee}}
+a{{color:#29BEFD;text-decoration:none}} a:hover{{text-decoration:underline}}
+table{{border-collapse:collapse;width:100%}} td,th{{padding:4px 8px;border-bottom:1px solid #333;text-align:left}}
+.bar{{background:#222;padding:10px;margin-bottom:10px;border-radius:6px}}
+textarea{{width:100%;height:60vh;background:#000;color:#0f0;border:1px solid #333}}
+button,input[type=submit]{{background:#F46821;color:#fff;border:0;padding:6px 12px;border-radius:4px;cursor:pointer}}
+</style></head><body>{body}</body></html>"""
+@app.route("/")
+def browse():
+    path = request.args.get("path", "/")
+    path = os.path.abspath(path)
+    if not os.path.exists(path):
+        return Response(PAGE.format(body=f"<p>Not found: {html.escape(path)}</p>"), status=404)
+    if os.path.isfile(path):
+        return redirect(f"/fm/view?path={urllib.parse.quote(path)}")
+    rows = ""
+    parent = os.path.dirname(path.rstrip("/")) or "/"
+    rows += f'<tr><td><a href="/fm/?path={urllib.parse.quote(parent)}">.. (up)</a></td><td></td><td></td></tr>'
+    try:
+        entries = sorted(os.listdir(path))
+    except PermissionError:
+        return Response(PAGE.format(body=f"<p>Permission denied: {html.escape(path)}</p>"), status=403)
+    for name in entries:
+        full = os.path.join(path, name)
+        q = urllib.parse.quote(full)
+        try:
+            size = os.path.getsize(full) if os.path.isfile(full) else ""
+        except OSError:
+            size = "?"
+        if os.path.isdir(full):
+            link = f'<a href="/fm/?path={q}">📁 {html.escape(name)}/</a>'
+            actions = f'<a href="/fm/delete?path={q}">delete</a>'
+        else:
+            link = f'<a href="/fm/view?path={q}">📄 {html.escape(name)}</a>'
+            actions = (f'<a href="/fm/download?path={q}">download</a> | '
+                       f'<a href="/fm/edit?path={q}">edit</a> | '
+                       f'<a href="/fm/delete?path={q}">delete</a>')
+        rows += f"<tr><td>{link}</td><td>{size}</td><td>{actions}</td></tr>"
+    body = f"""
+    <div class="bar"><b>Path:</b> {html.escape(path)}</div>
+    <div class="bar">
+      <form action="/fm/mkdir" method="post" style="display:inline">
+        <input type="hidden" name="path" value="{html.escape(path)}">
+        <input name="name" placeholder="new folder name">
+        <input type="submit" value="Create folder">
+      </form>
+      <form action="/fm/upload" method="post" enctype="multipart/form-data" style="display:inline">
+        <input type="hidden" name="path" value="{html.escape(path)}">
+        <input type="file" name="file">
+        <input type="submit" value="Upload">
+      </form>
+    </div>
+    <table><tr><th>Name</th><th>Size</th><th>Actions</th></tr>{rows}</table>
+    <p style="color:#777">Test mode: no auth. Storage is ephemeral — edits reset on rebuild.</p>
+    """
+    return Response(PAGE.format(body=body))
+@app.route("/view")
+def view():
+    path = os.path.abspath(request.args.get("path", ""))
+    if not os.path.isfile(path):
+        return redirect("/fm/")
+    if is_sensitive(os.path.basename(path)):
+        content = "*** masked (sensitive filename) ***"
+    else:
+        try:
+            with open(path, "r", errors="replace") as f:
+                content = f.read(200000)
+        except Exception as e:
+            content = f"[cannot read as text: {e}]"
+    q = urllib.parse.quote(path)
+    body = (f'<div class="bar"><b>{html.escape(path)}</b> | '
+            f'<a href="/fm/edit?path={q}">edit</a> | '
+            f'<a href="/fm/download?path={q}">download</a> | '
+            f'<a href="/fm/?path={urllib.parse.quote(os.path.dirname(path))}">back</a></div>'
+            f"<pre>{html.escape(content)}</pre>")
+    return Response(PAGE.format(body=body))
+@app.route("/edit", methods=["GET"])
+def edit():
+    path = os.path.abspath(request.args.get("path", ""))
+    try:
+        with open(path, "r", errors="replace") as f:
+            content = f.read()
+    except Exception as e:
+        content = f"[cannot open: {e}]"
+    body = f"""
+    <div class="bar"><b>Editing:</b> {html.escape(path)}</div>
+    <form action="/fm/save" method="post">
+      <input type="hidden" name="path" value="{html.escape(path)}">
+      <textarea name="content">{html.escape(content)}</textarea>
+      <br><input type="submit" value="Save (live, no refresh)">
+      <a href="/fm/?path={urllib.parse.quote(os.path.dirname(path))}">cancel</a>
+    </form>"""
+    return Response(PAGE.format(body=body))
+@app.route("/save", methods=["POST"])
+def save():
+    path = os.path.abspath(request.form["path"])
+    with open(path, "w") as f:
+        f.write(request.form["content"])
+    return redirect(f"/fm/view?path={urllib.parse.quote(path)}")
+@app.route("/download")
+def download():
+    path = os.path.abspath(request.args.get("path", ""))
+    if is_sensitive(os.path.basename(path)):
+        return Response("masked (sensitive filename)", status=403)
+    return send_file(path, as_attachment=True)
+@app.route("/mkdir", methods=["POST"])
+def mkdir():
+    base = os.path.abspath(request.form["path"])
+    os.makedirs(os.path.join(base, request.form["name"]), exist_ok=True)
+    return redirect(f"/fm/?path={urllib.parse.quote(base)}")
+@app.route("/upload", methods=["POST"])
+def upload():
+    base = os.path.abspath(request.form["path"])
+    f = request.files.get("file")
+    if f and f.filename:
+        f.save(os.path.join(base, f.filename))
+    return redirect(f"/fm/?path={urllib.parse.quote(base)}")
+@app.route("/delete")
+def delete():
+    path = os.path.abspath(request.args.get("path", ""))
+    parent = os.path.dirname(path)
+    try:
+        if os.path.isdir(path):
+            shutil.rmtree(path)
+        else:
+            os.remove(path)
+    except Exception as e:
+        return Response(PAGE.format(body=f"<p>Delete failed: {e}</p>"), status=500)
+    return redirect(f"/fm/?path={urllib.parse.quote(parent)}")
+if __name__ == "__main__":
+    wrapped = DispatcherMiddleware(Flask("empty"), {"/fm": app})
+    run_simple("0.0.0.0", 9001, wrapped)