Repository: svthalia/concrexit

Issue:
Downloading albums fills up the disk
### Describe the bug
When a user wants to download an album, the website creates a zip file containing all photos (in `/tmp` of the Docker container). If multiple albums are downloaded, multiple large zip files are created. This very quickly fills up the disk.

We should remove this functionality to prevent this. It is not used often so that should not be a problem for members.

### Additional context
This has caused website outages a few times in the past.



Discussion:

Resolving patch:
diff --git a/website/photos/urls.py b/website/photos/urls.py
--- a/website/photos/urls.py
+++ b/website/photos/urls.py
@@ -19,11 +19,6 @@
                                 "download/",
                                 include(
                                     [
-                                        path(
-                                            "",
-                                            views.album_download,
-                                            name="album-download",
-                                        ),
                                         path(
                                             "<filename>",
                                             views.download,
@@ -33,11 +28,6 @@
                                             "<token>/",
                                             include(
                                                 [
-                                                    path(
-                                                        "",
-                                                        views.shared_album_download,
-                                                        name="shared-album-download",
-                                                    ),
                                                     path(
                                                         "<filename>",
                                                         views.shared_download,
diff --git a/website/photos/views.py b/website/photos/views.py
--- a/website/photos/views.py
+++ b/website/photos/views.py
@@ -1,6 +1,4 @@
 import os
-from tempfile import gettempdir
-from zipfile import ZipFile
 
 from django.contrib.auth.decorators import login_required
 from django.core.paginator import EmptyPage, Paginator
@@ -105,21 +103,6 @@ def _download(request, obj, filename):
     return sendfile(request, photo.file.path, attachment=True)
 
 
-def _album_download(request, obj):
-    """Download an album.
-
-    This function provides a layer of indirection for shared albums.
-    """
-    albumpath = os.path.join(obj.photospath, obj.dirname)
-    zipfilename = os.path.join(gettempdir(), "{}.zip".format(obj.dirname))
-    if not os.path.exists(zipfilename):
-        with ZipFile(zipfilename, "w") as f:
-            pictures = [os.path.join(albumpath, x) for x in os.listdir(albumpath)]
-            for picture in pictures:
-                f.write(picture, arcname=os.path.basename(picture))
-    return sendfile(request, zipfilename, attachment=True)
-
-
 @login_required
 def download(request, slug, filename):
     """Download a photo if the album of the photo is accessible by the user."""
@@ -129,24 +112,8 @@ def download(request, slug, filename):
     raise Http404("Sorry, you're not allowed to view this album")
 
 
-@login_required
-def album_download(request, slug):
-    """Download an album if the album is accessible by the user."""
-    obj = get_object_or_404(Album, slug=slug)
-    if is_album_accessible(request, obj):
-        return _album_download(request, obj)
-    raise Http404("Sorry, you're not allowed to view this album")
-
-
 def shared_download(request, slug, token, filename):
     """Download a photo from a shared album if the album token is provided."""
     obj = get_object_or_404(Album, slug=slug)
     check_shared_album_token(obj, token)
     return _download(request, obj, filename)
-
-
-def shared_album_download(request, slug, token):
-    """Download a shared album if the album token is provided."""
-    obj = get_object_or_404(Album, slug=slug)
-    check_shared_album_token(obj, token)
-    return _album_download(request, obj)


Test patch:
diff --git a/website/photos/tests/test_views.py b/website/photos/tests/test_views.py
--- a/website/photos/tests/test_views.py
+++ b/website/photos/tests/test_views.py
@@ -344,28 +344,3 @@ def test_download(self):
             )
             self.assertEqual(response.status_code, 200)
             self.assertEqual(response["Content-Type"], "image/jpeg")
-
-
-@override_settings(SUSPEND_SIGNALS=True)
-class AlbumDownloadTest(_DownloadBaseTestCase):
-
-    fixtures = ["members.json"]
-
-    @classmethod
-    def setUpTestData(cls):
-        cls.member = Member.objects.filter(last_name="Wiggers").first()
-
-    def test_download(self):
-        self.client.force_login(self.member)
-
-        response = self.client.get(
-            reverse("photos:album-download", args=(self.album.slug,))
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual(response["Content-Type"], "application/zip")
-
-    def test_logged_out(self):
-        response = self.client.get(
-            reverse("photos:album-download", args=(self.album.slug,))
-        )
-        self.assertEqual(response.status_code, 302)