verify file upload extention

var/www/Flask_server.py

@@ -131,9 +131,9 @@ taxonomies = Taxonomies()
 for tag in taxonomies.get('infoleak').machinetags():
     r_serv_tags.sadd('active_tag_infoleak', tag)
 for tag in taxonomies.get('gdpr').machinetags():
-    r_serv_tags.sadd('active_tag_infoleak', tag)
+    r_serv_tags.sadd('active_tag_gdpr', tag)
 for tag in taxonomies.get('fpf').machinetags():
-    r_serv_tags.sadd('active_tag_infoleak', tag)
+    r_serv_tags.sadd('active_tag_fpf', tag)
 
 # ============ MAIN ============
 

var/www/modules/PasteSubmit/Flask_PasteSubmit.py

@@ -5,7 +5,7 @@
     Flask functions and routes for the trending modules page
 '''
 import redis
-from flask import Flask, render_template, jsonify, request, Blueprint, session
+from flask import Flask, render_template, jsonify, request, Blueprint
 
 '''import random'''
 
@@ -31,10 +31,16 @@ PasteSubmit = Blueprint('PasteSubmit', __name__, template_folder='templates')
 
 valid_filename_chars = "-_ %s%s" % (string.ascii_letters, string.digits)
 
+ALLOWED_EXTENSIONS = set(['txt', 'zip', 'gzip'])
+
 # ============ FUNCTIONS ============
 def one():
     return 1
 
+def allowed_file(filename):
+    return '.' in filename and \
+           filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS
+
 def clean_filename(filename, whitelist=valid_filename_chars, replace=' '):
     # replace characters
     for r in replace:
@@ -123,13 +129,19 @@ def submit():
     ltagsgalaxies = request.form['tags_galaxies']
     paste_content = request.form['paste_content']
 
-    if paste_content != '':
-        if sys.getsizeof(paste_content) < 900000:
-
     if ltags or ltagsgalaxies:
         if not addTagsVerification(ltags, ltagsgalaxies):
             return 'INVALID TAGS'
 
+    if 'file' not in request.files:
+
+        file = request.files['file']
+
+        if file.filename == '':
+
+            if paste_content != '':
+                if sys.getsizeof(paste_content) < 900000:
+
                     to_launch = os.environ['AIL_BIN'] + 'submit_paste.py'
                     # get id
                     id = str(r_serv_tags.get('submit_id'))
@@ -165,6 +177,11 @@ def submit():
 
             return 'submit'
 
+         if file and allowed_file(file.filename):
+            print(file.read())
+
+    return 'error'
+
 @PasteSubmit.route("/PasteSubmit/submit_status", methods=['GET'])
 def submit_status():
     id = request.args.get('id')

var/www/modules/PasteSubmit/templates/PasteSubmit.html

@@ -30,7 +30,7 @@
 				<div class="row">
 				  <!-- /.col-lg-12 -->
 
-					<form action="/PasteSubmit/submit" id="pasteSubmitForm" method="post" onsubmit="submitPaste()">
+					<form action="/PasteSubmit/submit" id="pasteSubmitForm" method="post" enctype=multipart/form-data onsubmit="submitPaste()">
 
 						<input type="hidden" id="tags_taxonomies" name="tags_taxonomies" value="test">
 						<input type="hidden" id="tags_galaxies" name="tags_galaxies" value="test">

var/www/modules/PasteSubmit/templates/submiting.html

@@ -292,6 +292,7 @@ function submitPaste(){
 						}
 					} else {
 						//error handler
+						document.getElementById('files_submitted').innerHTML = in_progress;
 						if(isError){
 							document.getElementById('error_message').innerHTML = error;
 							$("#panel_error").removeClass('hidden');