From 6348b0f6d9e8d8da8587af6ce6ab9753d24d7cff Mon Sep 17 00:00:00 2001
From: neingeist <neingeist@bl0rg.net>
Date: Mon, 12 Nov 2018 19:37:31 +0100
Subject: [PATCH] create output files as temporary files and remove them before
 sending

---
 .gitignore     |  1 -
 prolefeeder.py | 30 ++++++++++++++++++++++++------
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/.gitignore b/.gitignore
index 7716e35..5da01bb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,3 @@
 __pycache__/
 *.pyc
 config.py
-tmp/
diff --git a/prolefeeder.py b/prolefeeder.py
index 9bf9566..a6a6d7b 100644
--- a/prolefeeder.py
+++ b/prolefeeder.py
@@ -1,11 +1,12 @@
 from flask import (Flask, render_template, flash, redirect,
-                   url_for, request, send_from_directory)
+                   url_for, request, send_file, abort)
 from flask_bootstrap import Bootstrap
 from flask_wtf import FlaskForm
 from wtforms import DateTimeField, IntegerField, SubmitField
 from wtforms.validators import InputRequired, NumberRange
 
 from datetime import datetime, timedelta
+from tempfile import mkstemp
 import os
 import random
 import re
@@ -18,6 +19,7 @@ app = Flask(__name__)
 app.config.from_object(Config)
 Bootstrap(app)
 
+attachment_filenames = {}
 
 class DownloadForm(FlaskForm):
     start_time = DateTimeField('Start time',
@@ -38,7 +40,8 @@ def download():
         form.length.data = 60
     elif form.validate_on_submit():
         try:
-            output_filename = prepare_download(form)
+            output_filename, attachment_filename = prepare_download(form)
+            attachment_filenames[output_filename] = attachment_filename
             flash('The download should start immediately.', 'success')
             return render_template('download.html', form=form, filename=output_filename)
         except ValueError as e:
@@ -50,8 +53,21 @@ def download():
 
 @app.route('/download_file/<filename>')
 def download_file(filename):
-    return send_from_directory(app.config['TMP_DIR'], filename,
-                               as_attachment=True)
+    """Download an output file"""
+
+    # Get attachment filename. This also makes sure that the user only downloads
+    # (and removes) a file generated by us.
+    try:
+        attachment_filename = attachment_filenames.pop(filename)
+    except KeyError:
+        abort(404)
+
+    fh = open(os.path.join(app.config['TMP_DIR'], filename), 'rb')
+    os.remove(os.path.join(app.config['TMP_DIR'], filename))
+
+    # XXX How to close fh?
+    return send_file(fh, as_attachment=True,
+                     attachment_filename=attachment_filename)
 
 
 def prepare_download(form):
@@ -92,7 +108,9 @@ def prepare_download(form):
     ss = (form.start_time.data - sources[0]['start_time']).total_seconds()
 
     # Let ffmpeg do the rest of the job
-    output_filename = '{}_{}.mp3'.format(form.start_time.data, form.length.data)
+    _, output_filename = mkstemp(suffix='.mp3', dir=app.config['TMP_DIR'])
+    output_filename = os.path.basename(output_filename)
+    attachment_filename = '{}_{}.mp3'.format(form.start_time.data, form.length.data)
 
     c = ['ffmpeg', '-y']
     c += ['-ss', str(ss)]
@@ -105,7 +123,7 @@ def prepare_download(form):
     app.logger.debug(' '.join(c))
     subprocess.call(c)
 
-    return output_filename
+    return output_filename, attachment_filename
 
 
 if __name__ == '__main__':