From e623c45da65b61bd455e356c8bf9692ee4354037 Mon Sep 17 00:00:00 2001
From: Ferry Boender <ferry.boender@gmail.com>
Date: Tue, 26 May 2015 22:34:51 +0200
Subject: [PATCH] Allow serving of static files through 'static_dir' directive.

---
 doc/MANUAL.md                               |  27 +++++++++++++++++
 examples/static_serve/job_serve.sh          |   5 ++++
 examples/static_serve/static/ssh_server.png | Bin 0 -> 3015 bytes
 examples/static_serve/static_serve.json     |  15 ++++++++++
 src/scriptform.py                           |  31 ++++++++++++++++++--
 5 files changed, 76 insertions(+), 2 deletions(-)
 create mode 100755 examples/static_serve/job_serve.sh
 create mode 100644 examples/static_serve/static/ssh_server.png
 create mode 100644 examples/static_serve/static_serve.json

diff --git a/doc/MANUAL.md b/doc/MANUAL.md
index b67e4de..295fcc5 100644
--- a/doc/MANUAL.md
+++ b/doc/MANUAL.md
@@ -115,6 +115,10 @@ Structurally, they are made up of the following elements:
 
 - **`title`**: Text to show at the top of each page. **Required**, **String**.
 
+- **`static_dir`**: Path to a directory from which static files should be
+  served. See also "[Serving static files](#output_static_files)".
+  **Optional**, **String**.
+
 - **`forms`**: A list of dictionaries of form definitions. **Required**, **List
     of dictionaries**.
 
@@ -370,6 +374,29 @@ and shown to the user in the browser.
 If a script's exit code is not 0, it is assumed an error occured. Scriptform
 will show the script's stderr output (in red) to the user instead of stdin.
 
+### <a name="output_static_files">Serving static files</a>
+
+Scriptform can serve static files. It is disabled by default. To enable it,
+provide a `static_dir` option in the top section of the form configuration:
+
+    {
+        "title": "Static serve",
+        "static_dir": "static",
+        "forms": [
+        ...
+
+This tells Scriptform to serve static files from that location. To refer to a
+static file, use the `/static` URL:
+
+    https://example.com/static?fname=foobar.png
+
+Will refer to the `static/foobar.png` file. If `static_dir` is a relative path,
+it will be relative to the form configuration (.json) file you're running.
+
+Scriptform does not provide the browser with a content-type of the file, since
+it is impossible to guess.  Generally, browsers do a decent job at figuring it
+out themselves.
+
 ## <a name="script_executing">Script execution</a>
 
 When the user submits the form, scriptform will validate the provided values.
diff --git a/examples/static_serve/job_serve.sh b/examples/static_serve/job_serve.sh
new file mode 100755
index 0000000..61cbf72
--- /dev/null
+++ b/examples/static_serve/job_serve.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+cat <<ENDOFTEXT
+<img src="static?fname=ssh_server.png" />
+ENDOFTEXT
diff --git a/examples/static_serve/static/ssh_server.png b/examples/static_serve/static/ssh_server.png
new file mode 100644
index 0000000000000000000000000000000000000000..f79c801a49a9cced361a9c9076fa5126ce547c0b
GIT binary patch
literal 3015
zcmaJ@dpy(oA70oRQm$bqnx#T!o941LV~lLETvjZ^Y>UM%w#nRzR6?ET;&Mz!64K43
ziw+S&<WzFWaS)PAmqS7v%x^l?`Tg<h_kF#--_PasJkR^~{P9h4qwG{sf+zt102Pum
z(L=UES6(nk_7z4&P0JQtk)yZBlXpNAK^L$91ST(#1toFlK`ajzof#R{%)$Wx@-Q~l
zTjcHPf@SbHX7m+|nV7?uu>k;_t(Z?|gs?==Kvoc&YXh68tbsw<OdFV&g)7pP@4yOX
zJ4Xpvo>3GkBPxV}VZv<jP@EVm6X38!bf}mU$`xY8Hn1<cSlNE%8UcfTfrvtEVE-iL
z?dk?~;0ahz3o|5~fwV+HEzxEuG!lcxm_p5wC?o=9jzC($QAn(X6&8ttetlrFXaeQ|
ztOwEQYb@Ex1{N$5@v#U*L_~yH#C9{DAP9lNU@!=zIl|l=E<?bDkz5g74Ce|reN!N^
zgbV?jFJkk!&=o~`ATL~G1CwR?PYE3UcUi9RYnx;ZLx|~o1j-D#Qqnh|tLy)VayZ}7
zLXijS-+ce4u#g(bXCXXTLSDFlAsgI*O)H`JSO)=%F5(HOJYMLxF1iKtL_A?Ij}LY5
zv@k<Kz1UnPFGBbQ@9K&rafKo}m%$<tZD2A5Gd7!vwQ_PoTHD)ix3Y9_M4=qbt?dch
z3D!t!2PY?c2aL7#H!hLK2<Nc4qHkR0zg+YWxhq!S@MV#SECKrvi|HibaiCvH#<G8$
z3+jh@U%AX5=VJatE<%<JVr8)ZHRx|wGWV=(zuQ)J_-=d_SLSws%+?G2S6=}D;2k6)
zfhz8~?xpNT9o3TlCEWP_W&qL9y;jFSp{N09fzwo@Ur;4I(#&>w*HJ*}B(^_g76j@Q
zQhL~D354RtrrTF;mHvYMaO`cWQ}gB1iq0jLvuYY!RX`gRA@MBw#O2ZDiN51+(!wOt
z)~x8yi_12nJC-A1fK;o{{=duEd3DG&r+nqo6c=BK^Nj3OpI6<JHtm`AWZ<$MH=Lj7
zmfFO09nqM6x;719VA62gvCj+v6OtwCb{wX9)r!<-oB-BYZxS5nw<ThY`;mXBj!#GH
zjn40M8Lo=V^5ySrT5x~DP1@NiiTqrfn=yM==)H#qT1d~?w5p^WDUvVF3wU)=JGV%Q
zoDQs@5>&&+0yJ!?Rkt+@=u^Ab>IDz^n;9GE8>@mp3?|g$a&k6F<ChXq#73?4@DZ$&
z7_0_}884_kejd1Y;AKr{-HGsbByc5J?W~bqI&g7tECn301>JX+5V~Qh4<%)m0i(i9
z<n|W`FA)-avi(a`&)ir7fsPVxGNzN|kfgC*Nwk{wXv2s~5TC!(q|5ZP`*6va8vi|U
zW0$Q^Z}mY9H&6Yh$k2(gk9b^l`RWG~t;03vQYxWmKgJ%(etJ`@e?Dk3W@)$DnpuI~
z<qRF5-4x`|(wfQ$3wx?$Zr}ZkAvwNj)u~NQ2}L)j>r^#yWvz@)m6#(l3Hq6NN^oYK
z4#1X?tR(vT#&HGbVvQNYbIq2=5vu}Jd#2uKffY=~e%tex*9b4MJ{}%!(CRyj>7`s)
zusGr0BcHJgm;ygN2Qv<O<eS${qj{)8@4HyGqYMCkKlO_+hE*Mq5!z(rE*zwKV-xVc
zpVIy)n{<S_f11`sE+l20!(Hd{IC5EQIsNv}nK}Vhj1mCqMns`c?Yi0WdeGkWisF)!
z*Uu6=s&j?a>|}Sm@(Z{MgcbxGy<i(%F;KlqBU!;YIka<i`wIh?F*$5%dRp@BXwO_D
z6UkaFpLI%^Ghi`!k5<yK1F#tK#Ge!cHo4~kJ8s;$W$WzP+Wb#z^9u_Ff1JR$ujwwC
zErDJSF}zG&d<~xL1*IQWsu3h)Y}cLGh+@pOq8;gngVtwHMlvbyb2cX@07{_DGRC%t
zMQA3*XU5G!Lea+VkS2Li6pKtcO3LhBuj-1~cgZKMt(QEST<0#`#@jYoVQ9T4K{*0r
znpUhHXs;-75qQy&=(x5ATR?FIx;S!ukLrbIp^KA~ksbOT0X@0K=>u-)(B=EiW_;qj
zI_)jB{xPjk@N@C8`&E+gwI=e|MX5{hpn)LcX}F8;Nh7;%c)9ZpaRAW7YwuKnx;r|r
zrrQ;?w|GkRUbgBy@g&+H`pi#`0GE0lE0x4m&ohj#wpXO?M#MVVHRkDoLKI&%*VXmj
zcMss*4TrH?n7tPyE>;G$4&xg(fC=F{o`=sso@usk(2je!3_0Wz?@>PDZnpRYfIPB(
zu13xgS&}a`rQk8zz+r5cmF1FDKIVnSke6lW<-mTl#^<f$k6T)XxmhLZ<_)J#+!C77
zT3m-0$}gQ=e)3t;@buP#S}<-G${u9^IlrKE2>(msc>Badjdje|_BG1S?k0gDCL;%~
zoL(L0SJ?Rgmex{`(Z(FrQxcR9=Hu3-PH`*_<6cb}90AQP=GZwKW$7iJ8#NnD+FahI
z-Bo(mS|!U^v3o9CSb^9Siv!5rOZI8*d2ii<X_GEVO|6^5SSmT<-+Io(@)ouC7fasH
zPam`;M??&j0!iT3Ljw)>Y==KR;{91!TKB8c>O0f-@QP<9<n~&eE!Ye-#$5E+1rg4q
zDdjz1@bD;Ob;h9Y_!so#x|O=mm0$f}elf;+UCO)udYdHf`M%eUO<oJB7vI-r-OTnr
zAFka~d8ZTr8=^H77m^<XPL=KtOh^iDSe4VaTzE*Kva%FAN;yf@x;BpKZcm6k5;~gm
z{7Q>arj4%NM!$N=RlM(eU1DP^u~!GZrRbQZZ%EC|hcR(OEdHQwj6j|L_Ns41@Dy#|
z%M-a2&s6ew0qyEy&wAUx>p^wcJE5e9+Di`L?7f~4bR#uTIgb787>?w+!x-4sUz(iK
z8LA+XEXN&wUNqAw>OTcyhh`581cMYB@#OHaq+6*qeoBt`c=}~O=b%q@-E=>Fww~wP
zoct+=2mWh5zI`m#|Fz|rH||<y3FO(nQVM{Tyol^Ob?$`bh4W>1eSW(p&&3YSG!nKd
zcemz-?PBvrleV>9f%`n!P>-_9Hdo~22X<6MBfK645(cXtxL-8&>6m&;GJMXD{n)Pm
zsM4>3!02h!ZJ$gTiI^WCXT(eDfSKoV;v*0$ZZ1aR!Vm!M)6!$#)Q}ARBUGQK75C<Y
zvXN{HYPkg&^yKq(b*CZ1(C@LCP27>cbV=4>(k(xS`w~6|+Hw^V2QGQfeXhaRHO}LQ
ze@|}88|_K+m+Y=DYOJA`(M(0s88n6KU!6*nCdzkDcidG*<0ENMr=y1E4bUn77hrvP
zwVg9dms$Xas@hU^s24&vg{*ZYf^4G)hc@TG^D80?2P)z6MkerKD3R1S?#UaR`S2#i
zxz{o8nu`F})~BqTtc-Tu9=7etL8pR%w+9|u)n|B5<@{<mhjY%_uH1i20l&IBs!HqS
z;XC7Dj_LW$7U2uKOvquy^9WQ+(g__v@xY|{kw=;ZKK|T1<H&aroaz3oS>(J6y_OB0
z`n`*DW&U;(*?;Oq(7t{C*WfAcc!8aI=$m`;ajX}Hprb~$mM3q#BW~0HCaHhOuEu-J
zTWj=i5Y5uWc6Lqu-WR-AaR=p<&rqLsEi32%n)0vw8K#t|z4B{Ka-<M%+6Nr{53TAP
A;Q#;t

literal 0
HcmV?d00001

diff --git a/examples/static_serve/static_serve.json b/examples/static_serve/static_serve.json
new file mode 100644
index 0000000..6406920
--- /dev/null
+++ b/examples/static_serve/static_serve.json
@@ -0,0 +1,15 @@
+{
+    "title": "Static serve",
+    "static_dir": "static",
+    "forms": [
+        {
+            "name": "static_serve",
+            "title": "Serve static files",
+            "description": "This example has a script that serves a HTML page. The HTML page refers to some static files that are served by Scriptform",
+            "submit_title": "Serve",
+            "script": "job_serve.sh",
+            "output": "html",
+            "fields": []
+        }
+    ]
+}
diff --git a/src/scriptform.py b/src/scriptform.py
index 378a975..a5a46c1 100755
--- a/src/scriptform.py
+++ b/src/scriptform.py
@@ -230,11 +230,14 @@ class ScriptForm:
 
         config = json.load(file(self.config_file, 'r'))
 
+        static_dir = None
         forms = []
         users = None
 
         if 'users' in config:
             users = config['users']
+        if 'static_dir' in config:
+            static_dir = config['static_dir']
         for form in config['forms']:
             form_name = form['name']
             script = form['script']
@@ -253,7 +256,8 @@ class ScriptForm:
         form_config = FormConfig(
             config['title'],
             forms,
-            users
+            users,
+            static_dir
         )
         self.form_config_singleton = form_config
         return form_config
@@ -290,10 +294,11 @@ class FormConfig:
     file. It holds information (title, users, the form definitions) on the
     form configuration being served by this instance of ScriptForm.
     """
-    def __init__(self, title, forms, users={}):
+    def __init__(self, title, forms, users={}, static_dir=None):
         self.title = title
         self.users = users
         self.forms = forms
+        self.static_dir = static_dir
         self.log = logging.getLogger('FORMCONFIG')
 
         # Validate scripts
@@ -1001,6 +1006,28 @@ class ScriptFormWebApp(WebAppHandler):
             if os.path.exists(file_name):
                 os.unlink(file_name)
 
+    def h_static(self, fname):
+        """Serve static files"""
+        form_config = self.scriptform.get_form_config()
+
+        if not form_config.static_dir:
+            self.send_error(501, "Static file serving not enabled")
+            return
+
+        if '..' in fname:
+            self.send_error(403, "Invalid file name")
+            return
+
+        path = os.path.join(form_config.static_dir, fname)
+        print path
+        if not os.path.exists(path):
+            self.send_error(404, "Not found")
+            return
+
+        f = file(path, 'r')
+        self.send_response(200)
+        self.end_headers()
+        self.wfile.write(f.read())
 
 class Daemon: # pragma: no cover 
     """