Repository: Cloud-CV/EvalAI

Issue:
Enforce unique random file name for files being uploaded
Currently, the files being uploaded are having simple name and we don't want them to serve to anyone who knows the pattern. Hence, we should store the files with name as uuid that will to secure it to some extent. 

For reference, see this http://stackoverflow.com/questions/2673647/enforce-unique-upload-file-names-using-django?answertab=active#tab-top



Discussion:
@deshraj Can I work on this?
@deshraj Can I also change the file name for [these](https://github.com/Cloud-CV/EvalAI/blob/master/apps/jobs/models.py#L69) models also?
Yes @RishabhJain2018, that is also a part of the issue. 
@RishabhJain2018 Any updates on this? We need this feature ASAP since we are planning to launch the beta really soon. 
@deshraj I had discussed this with @TroJan & I will fix this asap.
Sounds good. 
Reopening this issues since a fix has to be added in this as discussed with @RishabhJain2018 . 

@deshraj yeah sure. I will fix this asap.

@deshraj @RishabhJain2018 : can you please explain here what fix ?
@TroJan Please refer [this](https://github.com/Cloud-CV/EvalAI/commit/d01d29fa54367e0b8fc55e141672e23dc1539e56#commitcomment-20969490) link.

Resolving patch:
diff --git a/apps/base/utils.py b/apps/base/utils.py
--- a/apps/base/utils.py
+++ b/apps/base/utils.py
@@ -24,9 +24,8 @@ def __init__(self, path):
 
     def __call__(self, instance, filename):
         extension = os.path.splitext(filename)[1]
-        if instance.pk:
-            filename = '{}_{}{}'.format(instance.pk, uuid.uuid4(), extension)
-        else:
-            filename = '{}{}'.format(uuid.uuid4(), extension)
+        if 'id' in self.path and instance.pk:
+            self.path = self.path.format(id=instance.pk)
+        filename = '{}{}'.format(uuid.uuid4(), extension)
         filename = os.path.join(self.path, filename)
         return filename
diff --git a/apps/jobs/migrations/0002_path_fix_for_submission_files.py b/apps/jobs/migrations/0002_path_fix_for_submission_files.py
new file mode 100644
--- /dev/null
+++ b/apps/jobs/migrations/0002_path_fix_for_submission_files.py
@@ -0,0 +1,31 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.10.2 on 2017-02-25 10:34
+from __future__ import unicode_literals
+
+import base.utils
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('jobs', '0001_squashed_0005_upload_unique_random_filename'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='submission',
+            name='input_file',
+            field=models.FileField(upload_to=base.utils.RandomFileName('submission_files/submission_{id}')),
+        ),
+        migrations.AlterField(
+            model_name='submission',
+            name='stderr_file',
+            field=models.FileField(blank=True, null=True, upload_to=base.utils.RandomFileName('submission_files/submission_{id}')),
+        ),
+        migrations.AlterField(
+            model_name='submission',
+            name='stdout_file',
+            field=models.FileField(blank=True, null=True, upload_to=base.utils.RandomFileName('submission_files/submission_{id}')),
+        ),
+    ]
diff --git a/apps/jobs/models.py b/apps/jobs/models.py
--- a/apps/jobs/models.py
+++ b/apps/jobs/models.py
@@ -70,9 +70,9 @@ class Submission(TimeStampedModel):
     started_at = models.DateTimeField(null=True, blank=True)
     completed_at = models.DateTimeField(null=True, blank=True)
     when_made_public = models.DateTimeField(null=True, blank=True)
-    input_file = models.FileField(upload_to=RandomFileName("submission_files/submission"))
-    stdout_file = models.FileField(upload_to=RandomFileName("submission_files/submission"), null=True, blank=True)
-    stderr_file = models.FileField(upload_to=RandomFileName("submission_files/submission"), null=True, blank=True)
+    input_file = models.FileField(upload_to=RandomFileName("submission_files/submission_{id}"))
+    stdout_file = models.FileField(upload_to=RandomFileName("submission_files/submission_{id}"), null=True, blank=True)
+    stderr_file = models.FileField(upload_to=RandomFileName("submission_files/submission_{id}"), null=True, blank=True)
     execution_time_limit = models.PositiveIntegerField(default=300)
 
     def __unicode__(self):


Test patch: