From 5443dd5f3c5f75cd1524eb26c6d5b53df3594f9b Mon Sep 17 00:00:00 2001
From: Marko Tibold <marko@tibold.nl>
Date: Tue, 13 Nov 2012 23:26:17 +0100
Subject: [PATCH 1/7] Added a FileField and an ImageField (copied from
 django.forms.fields). Adjusted generics, mixins and serializers to take a
 `files` arg where applicable.

---
 rest_framework/fields.py      | 91 +++++++++++++++++++++++++++++++++++
 rest_framework/generics.py    |  3 +-
 rest_framework/mixins.py      |  4 +-
 rest_framework/serializers.py | 21 +++++---
 4 files changed, 108 insertions(+), 11 deletions(-)

diff --git a/rest_framework/fields.py b/rest_framework/fields.py
index 4c2064261..9cd84c0d3 100644
--- a/rest_framework/fields.py
+++ b/rest_framework/fields.py
@@ -904,3 +904,94 @@ class FloatField(WritableField):
         except (TypeError, ValueError):
             msg = self.error_messages['invalid'] % value
             raise ValidationError(msg)
+
+
+class FileField(WritableField):
+    type_name = 'FileField'
+
+    default_error_messages = {
+        'invalid': _("No file was submitted. Check the encoding type on the form."),
+        'missing': _("No file was submitted."),
+        'empty': _("The submitted file is empty."),
+        'max_length': _('Ensure this filename has at most %(max)d characters (it has %(length)d).'),
+        'contradiction': _('Please either submit a file or check the clear checkbox, not both.')
+    }
+
+    def __init__(self, *args, **kwargs):
+        self.max_length = kwargs.pop('max_length', None)
+        self.allow_empty_file = kwargs.pop('allow_empty_file', False)
+        super(FileField, self).__init__(*args, **kwargs)
+
+    def from_native(self, data):
+        if data in validators.EMPTY_VALUES:
+            return None
+
+        # UploadedFile objects should have name and size attributes.
+        try:
+            file_name = data.name
+            file_size = data.size
+        except AttributeError:
+            raise ValidationError(self.error_messages['invalid'])
+
+        if self.max_length is not None and len(file_name) > self.max_length:
+            error_values = {'max': self.max_length, 'length': len(file_name)}
+            raise ValidationError(self.error_messages['max_length'] % error_values)
+        if not file_name:
+            raise ValidationError(self.error_messages['invalid'])
+        if not self.allow_empty_file and not file_size:
+            raise ValidationError(self.error_messages['empty'])
+
+        return data
+
+    def to_native(self, value):
+        """
+        No need to return anything, the file can be accessed form its url.
+        """
+        return
+
+
+class ImageField(FileField):
+    default_error_messages = {
+        'invalid_image': _("Upload a valid image. The file you uploaded was either not an image or a corrupted image."),
+    }
+
+    def from_native(self, data):
+        """
+        Checks that the file-upload field data contains a valid image (GIF, JPG,
+        PNG, possibly others -- whatever the Python Imaging Library supports).
+        """
+        f = super(ImageField, self).from_native(data)
+        if f is None:
+            return None
+
+        # Try to import PIL in either of the two ways it can end up installed.
+        try:
+            from PIL import Image
+        except ImportError:
+            import Image
+
+        # We need to get a file object for PIL. We might have a path or we might
+        # have to read the data into memory.
+        if hasattr(data, 'temporary_file_path'):
+            file = data.temporary_file_path()
+        else:
+            if hasattr(data, 'read'):
+                file = BytesIO(data.read())
+            else:
+                file = BytesIO(data['content'])
+
+        try:
+            # load() could spot a truncated JPEG, but it loads the entire
+            # image in memory, which is a DoS vector. See #3848 and #18520.
+            # verify() must be called immediately after the constructor.
+            Image.open(file).verify()
+        except ImportError:
+            # Under PyPy, it is possible to import PIL. However, the underlying
+            # _imaging C module isn't available, so an ImportError will be
+            # raised. Catch and re-raise.
+            raise
+        except Exception: # Python Imaging Library doesn't recognize it as an image
+            raise ValidationError(self.error_messages['invalid_image'])
+        if hasattr(f, 'seek') and callable(f.seek):
+            f.seek(0)
+        return f
diff --git a/rest_framework/generics.py b/rest_framework/generics.py
index ebd06e452..d47c39cda 100644
--- a/rest_framework/generics.py
+++ b/rest_framework/generics.py
@@ -44,11 +44,10 @@ class GenericAPIView(views.APIView):
         return serializer_class
 
     def get_serializer(self, instance=None, data=None, files=None):
-        # TODO: add support for files
         # TODO: add support for seperate serializer/deserializer
         serializer_class = self.get_serializer_class()
         context = self.get_serializer_context()
-        return serializer_class(instance, data=data, context=context)
+        return serializer_class(instance, data=data, files=files, context=context)
 
 
 class MultipleObjectAPIView(MultipleObjectMixin, GenericAPIView):
diff --git a/rest_framework/mixins.py b/rest_framework/mixins.py
index c3625a88e..991f4c500 100644
--- a/rest_framework/mixins.py
+++ b/rest_framework/mixins.py
@@ -15,7 +15,7 @@ class CreateModelMixin(object):
     Should be mixed in with any `BaseView`.
     """
     def create(self, request, *args, **kwargs):
-        serializer = self.get_serializer(data=request.DATA)
+        serializer = self.get_serializer(data=request.DATA, files=request.FILES)
         if serializer.is_valid():
             self.pre_save(serializer.object)
             self.object = serializer.save()
@@ -80,7 +80,7 @@ class UpdateModelMixin(object):
             self.object = None
             success_status = status.HTTP_201_CREATED
 
-        serializer = self.get_serializer(self.object, data=request.DATA)
+        serializer = self.get_serializer(self.object, data=request.DATA, files=request.FILES)
 
         if serializer.is_valid():
             self.pre_save(serializer.object)
diff --git a/rest_framework/serializers.py b/rest_framework/serializers.py
index 46d4765e1..a46432a9c 100644
--- a/rest_framework/serializers.py
+++ b/rest_framework/serializers.py
@@ -91,7 +91,7 @@ class BaseSerializer(Field):
     _options_class = SerializerOptions
     _dict_class = SortedDictWithMetadata  # Set to unsorted dict for backwards compatability with unsorted implementations.
 
-    def __init__(self, instance=None, data=None, context=None, **kwargs):
+    def __init__(self, instance=None, data=None, files=None, context=None, **kwargs):
         super(BaseSerializer, self).__init__(**kwargs)
         self.opts = self._options_class(self.Meta)
         self.fields = copy.deepcopy(self.base_fields)
@@ -101,9 +101,11 @@ class BaseSerializer(Field):
         self.context = context or {}
 
         self.init_data = data
+        self.init_files = files
         self.object = instance
 
         self._data = None
+        self._files = None
         self._errors = None
 
     #####
@@ -187,7 +189,7 @@ class BaseSerializer(Field):
             ret.fields[key] = field
         return ret
 
-    def restore_fields(self, data):
+    def restore_fields(self, data, files):
         """
         Core of deserialization, together with `restore_object`.
         Converts a dictionary of data into a dictionary of deserialized fields.
@@ -196,7 +198,10 @@ class BaseSerializer(Field):
         reverted_data = {}
         for field_name, field in fields.items():
             try:
-                field.field_from_native(data, field_name, reverted_data)
+                if isinstance(field, (FileField, ImageField)):
+                    field.field_from_native(files, field_name, reverted_data)
+                else:
+                    field.field_from_native(data, field_name, reverted_data)
             except ValidationError as err:
                 self._errors[field_name] = list(err.messages)
 
@@ -250,7 +255,7 @@ class BaseSerializer(Field):
             return [self.convert_object(item) for item in obj]
         return self.convert_object(obj)
 
-    def from_native(self, data):
+    def from_native(self, data, files):
         """
         Deserialize primatives -> objects.
         """
@@ -259,8 +264,8 @@ class BaseSerializer(Field):
             return (self.from_native(item) for item in data)
 
         self._errors = {}
-        if data is not None:
-            attrs = self.restore_fields(data)
+        if data is not None or files is not None:
+            attrs = self.restore_fields(data, files)
             attrs = self.perform_validation(attrs)
         else:
             self._errors['non_field_errors'] = ['No input provided']
@@ -288,7 +293,7 @@ class BaseSerializer(Field):
         setting self.object if no errors occurred.
         """
         if self._errors is None:
-            obj = self.from_native(self.init_data)
+            obj = self.from_native(self.init_data, self.init_files)
             if not self._errors:
                 self.object = obj
         return self._errors
@@ -440,6 +445,8 @@ class ModelSerializer(Serializer):
             models.TextField: CharField,
             models.CommaSeparatedIntegerField: CharField,
             models.BooleanField: BooleanField,
+            models.FileField: FileField,
+            models.ImageField: ImageField,
         }
         try:
             return field_mapping[model_field.__class__](**kwargs)

From 8cdbc0a33a69f0a170e92be47189f6006c147137 Mon Sep 17 00:00:00 2001
From: Marko Tibold <marko@tibold.nl>
Date: Wed, 14 Nov 2012 00:09:39 +0100
Subject: [PATCH 2/7] Properly render file inputs in the Browsable api.

---
 rest_framework/fields.py    | 2 +-
 rest_framework/renderers.py | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/rest_framework/fields.py b/rest_framework/fields.py
index 9cd84c0d3..162d22714 100644
--- a/rest_framework/fields.py
+++ b/rest_framework/fields.py
@@ -908,7 +908,7 @@ class FloatField(WritableField):
 
 class FileField(WritableField):
     type_name = 'FileField'
-
+    widget = widgets.FileInput
     default_error_messages = {
         'invalid': _("No file was submitted. Check the encoding type on the form."),
         'missing': _("No file was submitted."),
diff --git a/rest_framework/renderers.py b/rest_framework/renderers.py
index 22fd6e740..dab973467 100644
--- a/rest_framework/renderers.py
+++ b/rest_framework/renderers.py
@@ -320,7 +320,9 @@ class BrowsableAPIRenderer(BaseRenderer):
             serializers.SlugRelatedField: forms.ChoiceField,
             serializers.ManySlugRelatedField: forms.MultipleChoiceField,
             serializers.HyperlinkedRelatedField: forms.ChoiceField,
-            serializers.ManyHyperlinkedRelatedField: forms.MultipleChoiceField
+            serializers.ManyHyperlinkedRelatedField: forms.MultipleChoiceField,
+            serializers.FileField: forms.FileField,
+            serializers.ImageField: forms.ImageField,
         }
 
         fields = {}

From c35b9eb065b2a9cacaee1dc0849f01f3483e6130 Mon Sep 17 00:00:00 2001
From: Marko Tibold <marko@tibold.nl>
Date: Wed, 14 Nov 2012 21:13:23 +0100
Subject: [PATCH 3/7] Processed review comments. No type checking in
 .restore_fields() Added missing BytesIO import.

---
 rest_framework/fields.py      | 22 ++++++++++++++++------
 rest_framework/serializers.py |  5 +----
 2 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/rest_framework/fields.py b/rest_framework/fields.py
index 162d22714..dce31c5ab 100644
--- a/rest_framework/fields.py
+++ b/rest_framework/fields.py
@@ -3,6 +3,8 @@ import datetime
 import inspect
 import warnings
 
+from io import BytesIO
+
 from django.core import validators
 from django.core.exceptions import ObjectDoesNotExist, ValidationError
 from django.core.urlresolvers import resolve, get_script_prefix
@@ -31,6 +33,7 @@ class Field(object):
     creation_counter = 0
     empty = ''
     type_name = None
+    _use_files = None
 
     def __init__(self, source=None):
         self.parent = None
@@ -51,7 +54,7 @@ class Field(object):
         self.root = parent.root or parent
         self.context = self.root.context
 
-    def field_from_native(self, data, field_name, into):
+    def field_from_native(self, data, files, field_name, into):
         """
         Given a dictionary and a field name, updates the dictionary `into`,
         with the field and it's deserialized value.
@@ -166,7 +169,7 @@ class WritableField(Field):
         if errors:
             raise ValidationError(errors)
 
-    def field_from_native(self, data, field_name, into):
+    def field_from_native(self, data, files, field_name, into):
         """
         Given a dictionary and a field name, updates the dictionary `into`,
         with the field and it's deserialized value.
@@ -175,7 +178,10 @@ class WritableField(Field):
             return
 
         try:
-            native = data[field_name]
+            if self._use_files:
+                native = files[field_name]
+            else:
+                native = data[field_name]
         except KeyError:
             if self.default is not None:
                 native = self.default
@@ -323,7 +329,7 @@ class RelatedField(WritableField):
         value = getattr(obj, self.source or field_name)
         return self.to_native(value)
 
-    def field_from_native(self, data, field_name, into):
+    def field_from_native(self, data, files, field_name, into):
         if self.read_only:
             return
 
@@ -341,7 +347,7 @@ class ManyRelatedMixin(object):
         value = getattr(obj, self.source or field_name)
         return [self.to_native(item) for item in value.all()]
 
-    def field_from_native(self, data, field_name, into):
+    def field_from_native(self, data, files, field_name, into):
         if self.read_only:
             return
 
@@ -907,8 +913,10 @@ class FloatField(WritableField):
 
 
 class FileField(WritableField):
+    _use_files = True
     type_name = 'FileField'
     widget = widgets.FileInput
+
     default_error_messages = {
         'invalid': _("No file was submitted. Check the encoding type on the form."),
         'missing': _("No file was submitted."),
@@ -951,6 +959,8 @@ class FileField(WritableField):
 
 
 class ImageField(FileField):
+    _use_files = True
+
     default_error_messages = {
         'invalid_image': _("Upload a valid image. The file you uploaded was either not an image or a corrupted image."),
     }
@@ -990,7 +1000,7 @@ class ImageField(FileField):
             # _imaging C module isn't available, so an ImportError will be
             # raised. Catch and re-raise.
             raise
-        except Exception: # Python Imaging Library doesn't recognize it as an image
+        except Exception:  # Python Imaging Library doesn't recognize it as an image
             raise ValidationError(self.error_messages['invalid_image'])
         if hasattr(f, 'seek') and callable(f.seek):
             f.seek(0)
diff --git a/rest_framework/serializers.py b/rest_framework/serializers.py
index a46432a9c..4a13a0915 100644
--- a/rest_framework/serializers.py
+++ b/rest_framework/serializers.py
@@ -198,10 +198,7 @@ class BaseSerializer(Field):
         reverted_data = {}
         for field_name, field in fields.items():
             try:
-                if isinstance(field, (FileField, ImageField)):
-                    field.field_from_native(files, field_name, reverted_data)
-                else:
-                    field.field_from_native(data, field_name, reverted_data)
+                field.field_from_native(data, files, field_name, reverted_data)
             except ValidationError as err:
                 self._errors[field_name] = list(err.messages)
 

From e112a806d863c0d6662dc3a65909ac191c02f03e Mon Sep 17 00:00:00 2001
From: Marko Tibold <marko@tibold.nl>
Date: Wed, 14 Nov 2012 21:40:52 +0100
Subject: [PATCH 4/7] .to_native() now returns the file-name.

---
 rest_framework/fields.py | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/rest_framework/fields.py b/rest_framework/fields.py
index dce31c5ab..fd57aa2c1 100644
--- a/rest_framework/fields.py
+++ b/rest_framework/fields.py
@@ -952,10 +952,7 @@ class FileField(WritableField):
         return data
 
     def to_native(self, value):
-        """
-        No need to return anything, the file can be accessed form its url.
-        """
-        return
+        return value.name
 
 
 class ImageField(FileField):

From 69a01d71256b9923aac1b8d1b91063068ecfebf7 Mon Sep 17 00:00:00 2001
From: Marko Tibold <marko@tibold.nl>
Date: Wed, 14 Nov 2012 23:04:46 +0100
Subject: [PATCH 5/7] Added a test for the FileField.

---
 rest_framework/tests/files.py | 55 +++++++++++++++++++----------------
 1 file changed, 30 insertions(+), 25 deletions(-)

diff --git a/rest_framework/tests/files.py b/rest_framework/tests/files.py
index 61d7f7b16..5dd57b7c6 100644
--- a/rest_framework/tests/files.py
+++ b/rest_framework/tests/files.py
@@ -1,34 +1,39 @@
-# from django.test import TestCase
-# from django import forms
+import StringIO
+import datetime
 
-# from django.test.client import RequestFactory
-# from rest_framework.views import View
-# from rest_framework.response import Response
+from django.test import TestCase
 
-# import StringIO
+from rest_framework import serializers
 
 
-# class UploadFilesTests(TestCase):
-#     """Check uploading of files"""
-#     def setUp(self):
-#         self.factory = RequestFactory()
+class UploadedFile(object):
+    def __init__(self, file, created=None):
+        self.file = file
+        self.created = created or datetime.datetime.now()
 
-#     def test_upload_file(self):
 
-#         class FileForm(forms.Form):
-#             file = forms.FileField()
+class UploadedFileSerializer(serializers.Serializer):
+    file = serializers.FileField()
+    created = serializers.DateTimeField()
 
-#         class MockView(View):
-#             permissions = ()
-#             form = FileForm
+    def restore_object(self, attrs, instance=None):
+        if instance:
+            instance.file = attrs['file']
+            instance.created = attrs['created']
+            return instance
+        return UploadedFile(**attrs)
 
-#             def post(self, request, *args, **kwargs):
-#                 return Response({'FILE_NAME': self.CONTENT['file'].name,
-#                         'FILE_CONTENT': self.CONTENT['file'].read()})
 
-#         file = StringIO.StringIO('stuff')
-#         file.name = 'stuff.txt'
-#         request = self.factory.post('/', {'file': file})
-#         view = MockView.as_view()
-#         response = view(request)
-#         self.assertEquals(response.raw_content, {"FILE_CONTENT": "stuff", "FILE_NAME": "stuff.txt"})
+class FileSerializerTests(TestCase):
+
+    def test_create(self):
+        now = datetime.datetime.now()
+        file = StringIO.StringIO('stuff')
+        file.name = 'stuff.txt'
+        file.size = file.len
+        serializer = UploadedFileSerializer(data={'created': now}, files={'file': file})
+        uploaded_file = UploadedFile(file=file, created=now)
+        self.assertTrue(serializer.is_valid())
+        self.assertEquals(serializer.object.created, uploaded_file.created)
+        self.assertEquals(serializer.object.file, uploaded_file.file)
+        self.assertFalse(serializer.object is uploaded_file)

From b4cfb46a56c8f7d9bc4340d5443f3a2d57ba9b58 Mon Sep 17 00:00:00 2001
From: Marko Tibold <marko@tibold.nl>
Date: Fri, 16 Nov 2012 00:22:08 +0100
Subject: [PATCH 6/7] WIP on docs for File- and ImageFileds.

---
 docs/api-guide/fields.md | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/docs/api-guide/fields.md b/docs/api-guide/fields.md
index 0485b158f..0b25a6efd 100644
--- a/docs/api-guide/fields.md
+++ b/docs/api-guide/fields.md
@@ -165,6 +165,38 @@ A floating point representation.
 
 Corresponds to `django.db.models.fields.FloatField`.
 
+## FileField
+
+A file representation. Performs Django's standard FileField validation. 
+
+Corresponds to `django.forms.fields.FileField`.
+
+### Optional arguments
+
+#### `max_length`
+
+Maximum length for the file name. This value is obtained from the model when used with a ModelSerializer.
+
+Defaults to `None`, meaning validation is skipped.
+
+#### `allow_empty_file`
+
+Determines if empty file uploads are allowed.
+
+Defaults to `False`
+
+## ImageField
+
+An image representation.
+
+Corresponds to `django.forms.fields.ImageField`.
+
+### Optional arguments
+
+Same as FileField.
+
+Requires the `PIL` package.
+
 ---
 
 # Relational Fields

From f801e5d3050591403de04fde7d18522fabc8fe49 Mon Sep 17 00:00:00 2001
From: Marko Tibold <marko@tibold.nl>
Date: Fri, 16 Nov 2012 23:44:55 +0100
Subject: [PATCH 7/7] Simplified docs a bit for FileField and ImageField. Added
 note about MultipartParser only supporting file uploads and Django's default
 upload handlers.

---
 docs/api-guide/fields.md | 28 ++++++++++++----------------
 1 file changed, 12 insertions(+), 16 deletions(-)

diff --git a/docs/api-guide/fields.md b/docs/api-guide/fields.md
index 0b25a6efd..7f42dc5e1 100644
--- a/docs/api-guide/fields.md
+++ b/docs/api-guide/fields.md
@@ -171,19 +171,11 @@ A file representation. Performs Django's standard FileField validation.
 
 Corresponds to `django.forms.fields.FileField`.
 
-### Optional arguments
+**Signature:** `FileField(max_length=None, allow_empty_file=False)`
 
-#### `max_length`
-
-Maximum length for the file name. This value is obtained from the model when used with a ModelSerializer.
-
-Defaults to `None`, meaning validation is skipped.
-
-#### `allow_empty_file`
-
-Determines if empty file uploads are allowed.
-
-Defaults to `False`
+ - `max_length` designates the maximum length for the file name.
+  
+ - `allow_empty_file` designates if empty files are allowed.
 
 ## ImageField
 
@@ -191,12 +183,15 @@ An image representation.
 
 Corresponds to `django.forms.fields.ImageField`.
 
-### Optional arguments
-
-Same as FileField.
-
 Requires the `PIL` package.
 
+Signature and validation is the same as with `FileField`.
+
+---
+
+**Note:** `FileFields` and `ImageFields` are only suitable for use with MultiPartParser, since eg json doesn't support file uploads.
+Django's regular [FILE_UPLOAD_HANDLERS] are used for handling uploaded files. 
+
 ---
 
 # Relational Fields
@@ -318,3 +313,4 @@ This field is always read-only.
 * `slug_url_kwarg` - The named url parameter for the slug field lookup. Default is to use the same value as given for `slug_field`.
 
 [cite]: http://www.python.org/dev/peps/pep-0020/
+[FILE_UPLOAD_HANDLERS]: https://docs.djangoproject.com/en/dev/ref/settings/#std:setting-FILE_UPLOAD_HANDLERS