()
| 17500 | return out |
| 17501 | |
| 17502 | @app.route("/admin/files/<username>/download") |
| 17503 | @login_required |
| 17504 | def admin_user_download(username: str): |
| 17505 | """Admin-only: download any user's vault file.""" |
| 17506 | require_admin() |
| 17507 | p = request.args.get("p", "") or "" |
| 17508 | try: |
| 17509 | root = user_root(username) |
| 17510 | rel = safe_relpath(p) |
| 17511 | ap = os.path.abspath(os.path.join(root, rel)) |
| 17512 | root_abs = os.path.abspath(root) |
| 17513 | if not ap.startswith(root_abs + os.sep) and ap != root_abs: |
| 17514 | raise ValueError("Path traversal") |
| 17515 | if os.path.isdir(ap): |
| 17516 | flash("Cannot download a folder.") |
| 17517 | return redirect(url_for("admin_user_files", username=username, p="/".join(p.split("/")[:-1]))) |
| 17518 | |
| 17519 | if not os.path.exists(ap): |
| 17520 | flash("File not found.") |
| 17521 | return redirect(url_for("admin_user_files", username=username, p="/".join(p.split("/")[:-1]))) |
| 17522 | |
| 17523 | filename = os.path.basename(ap) |
| 17524 | mime = guess_mime(filename) |
| 17525 |
nothing calls this directly
no test coverage detected