Web2Py - Validate uploaded file by email

Question

web2py experts. The task I'm trying to accomplish is the following:

-permit a person browsing my site to upload a file to my site through a form (implemented through crud.create()) -the visitor is not required to establish an account or log in to upload a file -the user is required to provide an email address in order for the file to be uploaded

-basically, after the user uploads a file, the file is held in escrow/limbo, and a validation/verification email is sent to the user

-once the user clicks on the link in the validation email, the file is posted to the page, and is made publicly available for download

What's the best way to go about doing this? Thanks!

Answer 1

The most obvious is to use session. Keep name of uploaded file in some session variable.

Use auth.verify_email(onaccept=...)

When the user's email is verified your code will be called - then you can associate the file and user: file name from session.variable and auth.user_id
Also set any permissions

If you want user can have time to think and confirm the registration from another comp and another session, than include a field for user.email in the table for files:

db.define_table('gifts', 
Field('im', 'upload', requires=IS_EMPTY_OR(IS_IMAGE(maxsize=(200, 200))), autodelete=True, uploadfolder='static/gifts'),
Field('email', requires=IS_EMAIL()),
Field('notes','text', default='', writable=True),
Field('t0','datetime',default=request.now, readable=False, writable=False),
Field('t', 'datetime', default=request.now, update=request.now, writable=False),
Field('rating', 'integer', default=0, writable=False, readable=False),
Field('hidden', 'boolean', default=True, writable=False, readable=True),
)

Then in the callback function for onaccept include match query: db(db.gifts.email==auth.user.email).update(hidden=False)

Better make selection for any hidden files before to give proper feedback to user (may be he have uploaded several files up to the confirmation moment)

Good luck

Answer 2

In your table that contains the upload information, add a new string field called 'validation_key'. When a file is uploaded, insert a GUID or reasonably long alpha-numeric string in it. Send this key as part of the link in the email. When the user clicks the link, search for the key and if found, set the matched 'validation_key' in the database to null. A null validation_key indicates a validated upload and you can allow downloads of that file.