Allowing Users to Upload Files via CGI Scripts

#!/usr/bin/pythonimport cgi, os, sys, string import posixpath, macpath data = cgi.FieldStorage() if data.has_key('uFile'):     saveFile(data['uFile'])     print "<B>%s</B> uploaded (%d bytes)." \         % (data['uFile'].filename, bytes)

A common task when programming web services is allowing users to upload files to the server using the web browser. This is fairly easy to accomplish with Python CGI scripts. First, create an HTML page that includes a form with a type=file INPUT tag. The name attribute of the INPUT tag will be used by the CGI script to retrieve the file information. The form should specify your Python CGI script as the action. The enctype attribute of the form element must be set to multipart/form-data.

Once you have built the HTML file, create a Python script that will parse the parameters from the POST request using the cgi.FieldStorage() function. FieldStorage() returns a dictionary of fields passed to the CGI script.

Using the dictionary returned by FieldStorage() should include the key you specified as the name of the INPUT tag in the HTML document. Use that key to obtain the file information object. The filename can be accessed by using the filename attribute of the object, and the actual data can be accessed using the file attribute. The file attribute acts similar to a read-only file that you can read using read(), readline(), or readlines().

Read the file contents from the file object and write it to a file on the server.

Note

In the example, the entire file was read at once. For larger files, you might want to break up the read into segments to reduce the load on the system.

Note

It might be a good idea in practical terms to filter the pathname to remove restricted characters and characters that might alter the path.

#!/usr/bin/pythonimport cgi, os, sys, string import posixpath, macpath saveDir = "/upload" #Send errors to browser sys.stderr = sys.stdout #Parse data from form data = cgi.FieldStorage() #Save the file to server directory def saveFile(uFile):     fPath = "%s/%s" % (saveDir, uFile.filename)     buf = uFile.file.read()     bytes = len(buf)     sFile = open(fPath, 'wb')     sFile.write(buf)     sFile.close() #Send response to browser webText = """Content-type: text/html\n" <title>CGI Upload Form</title>\n <h2>Upload File</h2><p>""" print webText if data.has_key('uFile'):     saveFile(data['uFile'])     print "<b>%s</b> uploaded (%d bytes)." % \            (data['uFile'].filename, bytes)

cgi_upload.cgi

<!DOCTYPE html> <html lang="en"> <head> <meta content="text/html; charset=utf-8"  http-equiv="content-type" /> <title>Upload Form Page</title> </head> <body> <h2>Upload File</h2><P> <form enctype="multipart/form-data" method="POST"  action="cgi_upload.cgi">     <input type="file" size="70" name="uFile">     <p><input type="SUBMIT" value="upload"> </form> </body> </html>

upload.html

Figure 10.5 shows upload.html loaded in a web browser.

Figure 10.5. Web browser view of upload.html code.

Figure 10.6 shows the web page generated by cgi_upload.cgi when the upload action is performed by form.html.

Figure 10.6. Output HTML page created by cgi_upload.cgi code.