From: Rico Hoppe <rico.hoppe@ipfire.org>
Date: Sat, 11 May 2024 13:57:33 +0000 (+0000)
Subject: backend: show checksum on thank-you page
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4cfc0589ce1347269cf3dc77e061e2d68d4772d4;p=ipfire.org.git

backend: show checksum on thank-you page

* this fixes bug 13652
* implemented function to get file by filename
* implemented checksum into thank-you page
* removed checksum from title of download links

Signed-off-by: Rico Hoppe <rico.hoppe@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/src/backend/releases.py b/src/backend/releases.py
index bed051d0..895c6ca3 100644
--- a/src/backend/releases.py
+++ b/src/backend/releases.py
@@ -482,3 +482,9 @@ class Releases(Object):
 
 			with self.db.transaction():
 				release.scan_files(basepath=basepath)
+
+	def get_file_by_filename(self, filename):
+		ret = self.db.get("SELECT * FROM files WHERE filename = %s", filename)
+
+		if ret:
+			return File(self.backend, None, ret.id, data=ret)
diff --git a/src/templates/downloads/release.html b/src/templates/downloads/release.html
index 06733914..9ff42de6 100644
--- a/src/templates/downloads/release.html
+++ b/src/templates/downloads/release.html
@@ -34,8 +34,7 @@
 								<ul>
 									{% for file in release.get_files_by_arch(arch) %}
 										<li>
-											<a class="download-splash" href="{{ file.url }}"
-													title="{{ "%s: %s" % ("SHA256" if file.sha256 else "SHA1", file.sha256 or file.sha1) }}">
+											<a class="download-splash" href="{{ file.url }}">
 												<span class="icon-text">
 													<span class="icon">
 														<i class="fas fa-download"></i>
@@ -87,7 +86,7 @@
 		$("a.download-splash").click(function(e) {
 			e.preventDefault();
 
-			window.location = "/downloads/thank-you?file=" + this.href;
+			window.location = "/downloads/thank-you?url=" + this.href;
 		});
 	</script>
 {% end %}
diff --git a/src/templates/downloads/thank-you.html b/src/templates/downloads/thank-you.html
index 559cc66e..33da55f9 100644
--- a/src/templates/downloads/thank-you.html
+++ b/src/templates/downloads/thank-you.html
@@ -9,10 +9,17 @@
 				<h1 class="title">
 					Thank You For Choosing IPFire<span class="has-text-primary">_</span>
 				</h1>
-				<h4 class="subtitle">{{ _("Your download will begin shortly.") }}</h4>
+				<h4 class="subtitle">{{ _("Your download will begin shortly") }}</h4>
 
 				<div class="block">
-					<p class="download-path"></p>
+					<a href="{{ file.url }}">{{ file.url }}</a>
+				</div>
+
+				<div class="block">
+					<p>
+						{{ _("After download, please verify the file has the following %s checksum:") % ("SHA-256" if file.sha256 else "SHA-1") }}
+						<span class="is-family-monospace">{{ file.sha256 or file.sha1 }}</span>
+					</p>
 				</div>
 			</div>
 		</div>
@@ -50,23 +57,8 @@
 
 {% block javascript %}
 	<script type="text/javascript">
-		$("p.download-path").ready(function() {
-			const params = new URLSearchParams(window.location.search);
-
-			var file = params.get("file");
-
-			// Avoid downloading files from other websites
-			if (!file.startsWith("https://downloads.ipfire.org/"))
-				return;
-
-			$("p.download-path").prepend($("<a>", {
-				href: encodeURI(file),
-				text: file
-			}));
-
-			setTimeout(function() {
-				window.location = file
-			}, "2000");
-		});
+		setTimeout(function() {
+			window.location = "{{ file.url }}"
+		}, "2000");
 	</script>
 {% end %}
diff --git a/src/web/downloads.py b/src/web/downloads.py
index de1c79a1..05f95994 100644
--- a/src/web/downloads.py
+++ b/src/web/downloads.py
@@ -35,7 +35,20 @@ class ReleaseHandler(base.AnalyticsMixin, base.BaseHandler):
 
 class ThankYouHandler(base.AnalyticsMixin, base.BaseHandler):
 	def get(self):
-		self.render("downloads/thank-you.html")
+		url = self.get_argument("url")
+
+		# Send 400 if URL is wrong
+		if not url.startswith("https://downloads.ipfire.org/"):
+			raise tornado.web.HTTPError(400)
+
+		filename = url.removeprefix("https://downloads.ipfire.org/")
+
+		# Get file by URL
+		file = self.backend.releases.get_file_by_filename(filename)
+		if not file:
+			raise tornado.web.HTTPError(404)
+
+		self.render("downloads/thank-you.html", file=file)
 
 
 class FileHandler(base.AnalyticsMixin, base.BaseHandler):