Question

I have a static website on Google App Engine where a few .rar files can be downloaded.
Right now it’s handled by a static file handler definition (app.yaml):

handlers:
- url: /(.*\.(bz2|gz|rar|tar|tgz|zip))
  static_files: static/\1
  upload: static/(.*\.(bz2|gz|rar|tar|tgz|zip))

Now what I’d like to do is provide a download link like /download?MyFile.rar so I can count downloads and see who’s hotlinking.

I don’t want to prevent hotlinking as long as websites use this url (the real path would be hidden/unavailable). This way I can count downloads even if it comes from outside (which Google Analytics or Clicky doesn’t handle obviously, and logs retention is only about 90 days and not convenient for that purpose).

The question is: how to make a python handler that can launch the download of the file for the user? Like we see on a lot of php/asp websites.

After searching a lot and reading those 2 threads (How do I let Google App Engine have a download link that downloads something from a database?, google app engine download a file containing files), it seems I could have something like:

self.response.headers['Content-Type'] = 'application/octet-stream'
self.response.out.write(filecontent) # how do I get that content?
#or
self.response.headers["Content-Type"] = "application/zip"
self.response.headers['Content-Disposition'] = "attachment; filename=MyFile.rar" # does that work? how do I get the actual path?

I did read that a handler can only run for limited time so it might not work for a large file?

Any guidance would be much appreciated!

Thanks.

Romz

EDIT:
Got it working and it lets me have a single handler for all .rar files. It lets me have urls that look like direct links (example.com/File.rar) but that are actually handled in python (so I can check for the referer, count the downloads, etc.).

The files are actually located in a different subfolder, and stay protected from real direct downloads because of the way the path is generated. I don’t know if there are other characters (than ‘/’ and ‘\’) that should be filtered out but this way no one should be able to access any other file in a parent folder or whatever.

Though I don’t really know what all this mean for my quotas and file size limits.

app.yaml

handlers:
- url: /(.*\.rar)
  script: main.app

main.py

from google.appengine.ext import webapp
from google.appengine.api import memcache
from google.appengine.ext import db
import os, urlparse

class GeneralCounterShard(db.Model):
    name = db.StringProperty(required=True)
    count = db.IntegerProperty(required=True, default=0)

def CounterIncrement(name):
    def txn():
        counter = GeneralCounterShard.get_by_key_name(name)
        if counter is None:
            counter = GeneralCounterShard(key_name=name, name=name)
        counter.count += 1
        counter.put()
    db.run_in_transaction(txn)
    memcache.incr(name) # does nothing if the key does not exist

class MainPage(webapp.RequestHandler):
    def get(self):

    referer = self.request.headers.get("Referer")
    if (referer and not referer.startswith("http://www.example.com/")):
        self.redirect('http://www.example.com')
        return

    path = urlparse.urlparse(self.request.url).path.replace('/', '').replace('\\', '')
    fullpath = os.path.join(os.path.dirname(__file__), 'files/'+path)
    if os.path.exists(fullpath):
        CounterIncrement(path)
        self.response.headers['Content-Type'] = 'application/zip'
        self.response.headers["Content-Disposition"] = 'attachment; filename=' + path
        self.response.out.write(file(fullpath, 'rb').read())
    else:
        self.response.out.write('<br>The file does not exist<br>')


app = webapp.WSGIApplication([('/.*', MainPage)], debug=False)

Answer 1

You could try using the self.resquest.referer.

Heres how you could do it. Have a “click here” to download link to your file download page, then you could have a FileDownloadHandler, where the name/id/ or whaterver is passed as a parameter, in this handler, check if the referer was the ‘download page’ so you know if the request was a valid download. If it is, serve the file, if not, redirect or do some error.

Just an idea