API: Allow to use uploaded files in settings fields

src/pretix/api/serializers/event.py

@@ -1,25 +1,29 @@
+import logging
+
 from django.conf import settings
 from django.core.exceptions import ValidationError
 from django.db import transaction
+from django.utils.crypto import get_random_string
 from django.utils.functional import cached_property
 from django.utils.translation import gettext as _
 from django_countries.serializers import CountryFieldMixin
-from hierarkey.proxy import HierarkeyProxy
 from pytz import common_timezones
-from rest_framework import serializers
 from rest_framework.fields import ChoiceField, Field
 from rest_framework.relations import SlugRelatedField
 
 from pretix.api.serializers.i18n import I18nAwareModelSerializer
+from pretix.api.serializers.settings import SettingsSerializer
 from pretix.base.models import Event, TaxRule
 from pretix.base.models.event import SubEvent
 from pretix.base.models.items import SubEventItem, SubEventItemVariation
 from pretix.base.services.seating import (
     SeatProtected, generate_seats, validate_plan_change,
 )
-from pretix.base.settings import DEFAULTS, validate_event_settings
+from pretix.base.settings import validate_event_settings
 from pretix.base.signals import api_event_settings_fields
 
+logger = logging.getLogger(__name__)
+
 
 class MetaDataField(Field):
 
@@ -558,7 +562,7 @@ class TaxRuleSerializer(CountryFieldMixin, I18nAwareModelSerializer):
         fields = ('id', 'name', 'rate', 'price_includes_tax', 'eu_reverse_charge', 'home_country')
 
 
-class EventSettingsSerializer(serializers.Serializer):
+class EventSettingsSerializer(SettingsSerializer):
     default_fields = [
         'imprint_url',
         'checkout_email_helptext',
@@ -654,6 +658,7 @@ class EventSettingsSerializer(serializers.Serializer):
         'invoice_additional_text',
         'invoice_footer_text',
         'invoice_eu_currencies',
+        'invoice_logo_image',
         'cancel_allow_user',
         'cancel_allow_user_until',
         'cancel_allow_user_paid',
@@ -674,45 +679,21 @@ class EventSettingsSerializer(serializers.Serializer):
         'theme_color_background',
         'theme_round_borders',
         'primary_font',
+        'logo_image',
+        'logo_image_large',
+        'logo_show_title',
+        'og_image',
     ]
 
     def __init__(self, *args, **kwargs):
         self.event = kwargs.pop('event')
-        self.changed_data = []
         super().__init__(*args, **kwargs)
-        for fname in self.default_fields:
-            kwargs = DEFAULTS[fname].get('serializer_kwargs', {})
-            if callable(kwargs):
-                kwargs = kwargs()
-            kwargs.setdefault('required', False)
-            kwargs.setdefault('allow_null', True)
-            form_kwargs = DEFAULTS[fname].get('form_kwargs', {})
-            if callable(form_kwargs):
-                form_kwargs = form_kwargs()
-            if 'serializer_class' not in DEFAULTS[fname]:
-                raise ValidationError('{} has no serializer class'.format(fname))
-            f = DEFAULTS[fname]['serializer_class'](
-                **kwargs
-            )
-            f._label = form_kwargs.get('label', fname)
-            f._help_text = form_kwargs.get('help_text')
-            self.fields[fname] = f
 
         for recv, resp in api_event_settings_fields.send(sender=self.event):
             for fname, field in resp.items():
                 field.required = False
                 self.fields[fname] = field
 
-    def update(self, instance: HierarkeyProxy, validated_data):
-        for attr, value in validated_data.items():
-            if value is None:
-                instance.delete(attr)
-                self.changed_data.append(attr)
-            elif instance.get(attr, as_type=type(value)) != value:
-                instance.set(attr, value)
-                self.changed_data.append(attr)
-        return instance
-
     def validate(self, data):
         data = super().validate(data)
         settings_dict = self.instance.freeze()
@@ -720,6 +701,14 @@ class EventSettingsSerializer(serializers.Serializer):
         validate_event_settings(self.event, settings_dict)
         return data
 
+    def get_new_filename(self, name: str) -> str:
+        nonce = get_random_string(length=8)
+        fname = '%s/%s/%s.%s.%s' % (
+            self.event.organizer.slug, self.event.slug, name.split('/')[-1], nonce, name.split('.')[-1]
+        )
+        # TODO: make sure pub is always correct
+        return 'pub/' + fname
+
 
 class DeviceEventSettingsSerializer(EventSettingsSerializer):
     default_fields = [

src/pretix/api/serializers/fields.py

@@ -1,5 +1,6 @@
 from collections import OrderedDict
 
+from django.core.exceptions import ValidationError
 from rest_framework import serializers
 
 
@@ -52,6 +53,8 @@ class UploadedFileField(serializers.Field):
                 file__isnull=False,
                 pk=data[len("file:"):],
             )
+        except (ValidationError, IndexError):  # invalid uuid
+            self.fail('not_found')
         except CachedFile.DoesNotExist:
             self.fail('not_found')
 
@@ -70,7 +73,5 @@ class UploadedFileField(serializers.Field):
             url = value.url
         except AttributeError:
             return None
-        request = self.context.get('request', None)
-        if request is not None:
-            return request.build_absolute_uri(url)
-        return url
+        request = self.context['request']
+        return request.build_absolute_uri(url)

src/pretix/api/serializers/organizer.py

@@ -1,13 +1,15 @@
+import logging
 from decimal import Decimal
 
 from django.db.models import Q
+from django.utils.crypto import get_random_string
 from django.utils.translation import gettext_lazy as _
-from hierarkey.proxy import HierarkeyProxy
 from rest_framework import serializers
 from rest_framework.exceptions import ValidationError
 
 from pretix.api.serializers.i18n import I18nAwareModelSerializer
 from pretix.api.serializers.order import CompatibleJSONField
+from pretix.api.serializers.settings import SettingsSerializer
 from pretix.base.auth import get_auth_backends
 from pretix.base.i18n import get_language_without_region
 from pretix.base.models import (
@@ -16,9 +18,11 @@ from pretix.base.models import (
 )
 from pretix.base.models.seating import SeatingPlanLayoutValidator
 from pretix.base.services.mail import SendMailException, mail
-from pretix.base.settings import DEFAULTS, validate_organizer_settings
+from pretix.base.settings import validate_organizer_settings
 from pretix.helpers.urls import build_absolute_uri
 
+logger = logging.getLogger(__name__)
+
 
 class OrganizerSerializer(I18nAwareModelSerializer):
     class Meta:
@@ -207,7 +211,7 @@ class TeamMemberSerializer(serializers.ModelSerializer):
         )
 
 
-class OrganizerSettingsSerializer(serializers.Serializer):
+class OrganizerSettingsSerializer(SettingsSerializer):
     default_fields = [
         'organizer_info_text',
         'event_list_type',
@@ -225,40 +229,13 @@ class OrganizerSettingsSerializer(serializers.Serializer):
         'theme_color_danger',
         'theme_color_background',
         'theme_round_borders',
-        'primary_font'
+        'primary_font',
+        'organizer_logo_image'
     ]
 
     def __init__(self, *args, **kwargs):
         self.organizer = kwargs.pop('organizer')
-        self.changed_data = []
         super().__init__(*args, **kwargs)
-        for fname in self.default_fields:
-            kwargs = DEFAULTS[fname].get('serializer_kwargs', {})
-            if callable(kwargs):
-                kwargs = kwargs()
-            kwargs.setdefault('required', False)
-            kwargs.setdefault('allow_null', True)
-            form_kwargs = DEFAULTS[fname].get('form_kwargs', {})
-            if callable(form_kwargs):
-                form_kwargs = form_kwargs()
-            if 'serializer_class' not in DEFAULTS[fname]:
-                raise ValidationError('{} has no serializer class'.format(fname))
-            f = DEFAULTS[fname]['serializer_class'](
-                **kwargs
-            )
-            f._label = form_kwargs.get('label', fname)
-            f._help_text = form_kwargs.get('help_text')
-            self.fields[fname] = f
-
-    def update(self, instance: HierarkeyProxy, validated_data):
-        for attr, value in validated_data.items():
-            if value is None:
-                instance.delete(attr)
-                self.changed_data.append(attr)
-            elif instance.get(attr, as_type=type(value)) != value:
-                instance.set(attr, value)
-                self.changed_data.append(attr)
-        return instance
 
     def validate(self, data):
         data = super().validate(data)
@@ -266,3 +243,11 @@ class OrganizerSettingsSerializer(serializers.Serializer):
         settings_dict.update(data)
         validate_organizer_settings(self.organizer, settings_dict)
         return data
+
+    def get_new_filename(self, name: str) -> str:
+        nonce = get_random_string(length=8)
+        fname = '%s/%s.%s.%s' % (
+            self.organizer.slug, name.split('/')[-1], nonce, name.split('.')[-1]
+        )
+        # TODO: make sure pub is always correct
+        return 'pub/' + fname

src/pretix/api/serializers/settings.py

@@ -0,0 +1,77 @@
+import logging
+
+from django.core.files import File
+from django.core.files.storage import default_storage
+from django.db.models.fields.files import FieldFile
+from hierarkey.proxy import HierarkeyProxy
+from rest_framework import serializers
+from rest_framework.exceptions import ValidationError
+
+from pretix.api.serializers.fields import UploadedFileField
+from pretix.base.settings import DEFAULTS
+
+logger = logging.getLogger(__name__)
+
+
+class SettingsSerializer(serializers.Serializer):
+    default_fields = []
+
+    def __init__(self, *args, **kwargs):
+        self.changed_data = []
+        super().__init__(*args, **kwargs)
+        for fname in self.default_fields:
+            kwargs = DEFAULTS[fname].get('serializer_kwargs', {})
+            if callable(kwargs):
+                kwargs = kwargs()
+            kwargs.setdefault('required', False)
+            kwargs.setdefault('allow_null', True)
+            form_kwargs = DEFAULTS[fname].get('form_kwargs', {})
+            if callable(form_kwargs):
+                form_kwargs = form_kwargs()
+            if 'serializer_class' not in DEFAULTS[fname]:
+                raise ValidationError('{} has no serializer class'.format(fname))
+            f = DEFAULTS[fname]['serializer_class'](
+                **kwargs
+            )
+            f._label = form_kwargs.get('label', fname)
+            f._help_text = form_kwargs.get('help_text')
+            f.parent = self
+            self.fields[fname] = f
+
+    def update(self, instance: HierarkeyProxy, validated_data):
+        for attr, value in validated_data.items():
+            if isinstance(value, FieldFile):
+                # Delete old file
+                fname = instance.get(attr, as_type=File)
+                if fname:
+                    try:
+                        default_storage.delete(fname.name)
+                    except OSError:  # pragma: no cover
+                        logger.error('Deleting file %s failed.' % fname.name)
+
+                # Create new file
+                newname = default_storage.save(self.get_new_filename(value.name), value)
+                instance.set(attr, File(file=value, name=newname))
+                self.changed_data.append(attr)
+            elif isinstance(self.fields[attr], UploadedFileField):
+                if value is None:
+                    fname = instance.get(attr, as_type=File)
+                    if fname:
+                        try:
+                            default_storage.delete(fname.name)
+                        except OSError:  # pragma: no cover
+                            logger.error('Deleting file %s failed.' % fname.name)
+                    instance.delete(attr)
+                else:
+                    # file is unchanged
+                    continue
+            elif value is None:
+                instance.delete(attr)
+                self.changed_data.append(attr)
+            elif instance.get(attr, as_type=type(value)) != value:
+                instance.set(attr, value)
+                self.changed_data.append(attr)
+        return instance
+
+    def get_new_filename(self, name: str) -> str:
+        raise NotImplementedError()

src/pretix/api/urls.py

@@ -7,8 +7,8 @@ from rest_framework import routers
 from pretix.api.views import cart
 
 from .views import (
-    checkin, device, event, exporters, item, oauth, order, organizer, user,
-    upload, version, voucher, waitinglist, webhooks,
+    checkin, device, event, exporters, item, oauth, order, organizer, upload,
+    user, version, voucher, waitinglist, webhooks,
 )
 
 router = routers.DefaultRouter()

src/pretix/api/views/event.py

@@ -365,9 +365,13 @@ class EventSettingsView(views.APIView):
 
     def get(self, request, *args, **kwargs):
         if isinstance(request.auth, Device):
-            s = DeviceEventSettingsSerializer(instance=request.event.settings, event=request.event)
+            s = DeviceEventSettingsSerializer(instance=request.event.settings, event=request.event, context={
+                'request': request
+            })
         elif 'can_change_event_settings' in request.eventpermset:
-            s = EventSettingsSerializer(instance=request.event.settings, event=request.event)
+            s = EventSettingsSerializer(instance=request.event.settings, event=request.event, context={
+                'request': request
+            })
         else:
             raise PermissionDenied()
         if 'explain' in request.GET:
@@ -382,7 +386,7 @@ class EventSettingsView(views.APIView):
 
     def patch(self, request, *wargs, **kwargs):
         s = EventSettingsSerializer(instance=request.event.settings, data=request.data, partial=True,
-                                    event=request.event)
+                                    event=request.event, context={'request': request})
         s.is_valid(raise_exception=True)
         with transaction.atomic():
             s.save()
@@ -393,5 +397,8 @@ class EventSettingsView(views.APIView):
             )
         if any(p in s.changed_data for p in SETTINGS_AFFECTING_CSS):
             regenerate_css.apply_async(args=(request.organizer.pk,))
-        s = EventSettingsSerializer(instance=request.event.settings, event=request.event)
+        s = EventSettingsSerializer(
+            instance=request.event.settings, event=request.event, context={
+                'request': request
+            })
         return Response(s.data)

src/pretix/api/views/organizer.py

@@ -425,7 +425,9 @@ class OrganizerSettingsView(views.APIView):
     permission = 'can_change_organizer_settings'
 
     def get(self, request, *args, **kwargs):
-        s = OrganizerSettingsSerializer(instance=request.organizer.settings, organizer=request.organizer)
+        s = OrganizerSettingsSerializer(instance=request.organizer.settings, organizer=request.organizer, context={
+            'request': request
+        })
         if 'explain' in request.GET:
             return Response({
                 fname: {
@@ -439,7 +441,9 @@ class OrganizerSettingsView(views.APIView):
     def patch(self, request, *wargs, **kwargs):
         s = OrganizerSettingsSerializer(
             instance=request.organizer.settings, data=request.data, partial=True,
-            organizer=request.organizer
+            organizer=request.organizer, context={
+                'request': request
+            }
         )
         s.is_valid(raise_exception=True)
         with transaction.atomic():
@@ -451,5 +455,7 @@ class OrganizerSettingsView(views.APIView):
             )
         if any(p in s.changed_data for p in SETTINGS_AFFECTING_CSS):
             regenerate_organizer_css.apply_async(args=(request.organizer.pk,))
-        s = OrganizerSettingsSerializer(instance=request.organizer.settings, organizer=request.organizer)
+        s = OrganizerSettingsSerializer(instance=request.organizer.settings, organizer=request.organizer, context={
+            'request': request
+        })
         return Response(s.data)