get_result() revert; use send_from_directory to ensure only files i…

…n data dir can be served.
digitalmethodsinitiative · Sep 28, 2023 · 8684719 · 8684719
1 parent 33d8ec1
commit 8684719
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/webtool/views/views_dataset.py b/webtool/views/views_dataset.py
@@ -158,7 +158,7 @@ def show_results(page):
 """
 
 
-@app.route('/result/<string:query_file>')
+@app.route('/result/<path:query_file>')
 def get_result(query_file):
     """
     Get dataset result file
@@ -167,8 +167,7 @@ def get_result(query_file):
     :return:  Result file
     :rmime: text/csv
     """
-    path = config.get('PATH_ROOT').joinpath(config.get('PATH_DATA')).joinpath(query_file)
-    return send_from_directory(directory=path.parent, path=path.name)
+    return send_from_directory(directory=config.get('PATH_ROOT').joinpath(config.get('PATH_DATA')), path=query_file)
 
 
 @app.route('/mapped-result/<string:key>/')