Function upload_backup

apps/backups/api_views.py:260–308

Upload a backup file for restoration.

(request)

@permission_classes([IsAdmin])
@parser_classes([MultiPartParser, FormParser])
def upload_backup(request):
    """Upload a backup file for restoration."""
    uploaded = request.FILES.get("file")
    if not uploaded:
        return Response(
            {"detail": "No file uploaded"},
            status=status.HTTP_400_BAD_REQUEST,
        )

    try:
        backup_dir = services.get_backup_dir()
        # Sanitize filename: strip directory components to prevent path traversal
        filename = Path(uploaded.name or "uploaded-backup.zip").name
        if not filename:
            filename = "uploaded-backup.zip"

        try:
            safe_upload_path(filename, str(backup_dir))
        except ValueError:
            return Response({"detail": "Invalid filename."}, status=status.HTTP_400_BAD_REQUEST)

        # Ensure unique filename
        backup_file = (backup_dir / filename).resolve()
        counter = 1
        while backup_file.exists():
            name_parts = filename.rsplit(".", 1)
            if len(name_parts) == 2:
                backup_file = backup_dir / f"{name_parts[0]}-{counter}.{name_parts[1]}"
            else:
                backup_file = backup_dir / f"{filename}-{counter}"
            counter += 1

        # Save uploaded file
        with backup_file.open("wb") as f:
            for chunk in uploaded.chunks():
                f.write(chunk)

        return Response(
            {
                "detail": "Backup uploaded successfully",
                "filename": backup_file.name,
            },
            status=status.HTTP_201_CREATED,
        )
    except Exception as e:
        return Response(
            {"detail": f"Upload failed: {str(e)}"},
            status=status.HTTP_500_INTERNAL_SERVER_ERROR,
        )


@api_view(["POST"])