Question

First time posting so I hope I’m doing this right.

I’m creating a custom admin form in “myapp/admin.py”, and I’m using the line : default_storage.exists('/usr/tmp/somefile.txt').

However, exists() is throwing a SuspiciousOperation exception. I took a look into it and the problem seems to be coming from safe_join(base, *paths) in “_os.py”.

It turns out the base paramenter is being set to '/' and this breaks the following code in safe_join() :

if not normcase(final_path).startswith(normcase(base_path)) \
  or final_path[base_path_len:base_path_len+1] not in ('', sep):
    raise ValueError('The joined path (%s) is located outside of the base '
                     'path component (%s)' % (final_path, base_path))

I don’t run into this problem when I use default_storage.exists() in manage.py shell. Also, I’m using Django 1.4 and Python 2.7.

Any help is appreciated! Thanks in advance!

Answer 1

It sounds to me like something is not set up correctly in your settings.py
The possible reason you are seeing that SuspiciousOperation exception is because your default_storage.location is set to / root, and I would think having access to the root of your filesystem is definitely suspicious.

You may want to check that you have set MEDIA_ROOT in your settings.py to something reasonable as a location for storage:
https://docs.djangoproject.com/en/1.4/ref/settings/#media-root

It seems that default_storage.location value derives from the MEDIA_ROOT? For me, it is equal to that value. When I try to do default_storage.exists() on a path that lives higher than the location, it raises that exception as well.