i have looping script uploads file server , upon completion returns json object terminal on success assorted information file/upload.
is there way can have 2nd script running watches confirmation of upload can delete file locally?
edit: context looping script:
#monitor directory new files inotifywait -m -q -r -e moved_to --format '%f' /var/www/html/uploads/ | while read file #when new file detected, upload website curl -u <user:pass> -t /var/www/html/uploads/$file https://www.website.com done response on successful upload:
{ "meta": { "code": 200 }, "results": { "id": 122, "sha1sum": "3fcdbdb04baa29ce695ff36af81eaac496364e82", "status": "b" } }
while ifs= read -r file; curl \ --fail \ -u "$user:$pass" \ -t "/var/www/html/uploads/$file" \ https://www.website.com \ && rm -f "/var/www/html/uploads/$file" done < <(inotifywait -m -q -r -e moved_to --format '%f' /var/www/html/uploads/) key points:
- use
curl --failreturn successful exit status if upload accepted remote server; long exit status given in http header, opposed inmetasection, there's no need parse json response. - use
&&runrmcommand ifcurlexited successful status. - quote expansions:
$fileshould in double quotes, especially oncurlcommand line, or else user can run arbitrary curl commands on server putting whitespace inside filenames. - this still little broken, because
inotifywaitformat uses newline delimiters, newlines valid inside filenames. unfortunately, hard avoid due design flaw in inotifywait, doesn't allow nul delimiters. other stackoverflow questions exist on subject, if want workaround secure against uploaded filenames literal newlines. see this reddit post example of attack using spoofed filename.
Comments
Post a Comment