Flask文件详情页添加有效下载链接问题求助

Let's walk through the issues in your code and fix them step by step to get that download link working properly:

1. Fix the Download Route (Mismatched Directory & Security) #

Your current download function is pointing to UPLOAD_FOLDER, but your file details page loads files from FILE_SYSTEM_ROOT—that's why send_from_directory isn't finding the file. We'll also add a security check to block path-traversal attacks (so users can't download arbitrary files from your server).

Update your download route like this:

from flask import abort

@app.route('/download/<path:urlFilePath>')
def download(urlFilePath):
    # Build the real file path using the same root as your browser route
    nestedFilePath = os.path.join(FILE_SYSTEM_ROOT, urlFilePath)
    
    # Critical security check: Ensure the file lives within your allowed root directory
    if not os.path.abspath(nestedFilePath).startswith(os.path.abspath(FILE_SYSTEM_ROOT)):
        abort(403)  # Block access to files outside your designated root
    
    if not os.path.isfile(nestedFilePath):
        abort(404)  # Return 404 if the file doesn't exist
    
    # Split the full path into directory and filename for send_from_directory
    file_dir, file_name = os.path.split(nestedFilePath)
    
    # Use as_attachment=True to force a download (instead of displaying in browser)
    return send_from_directory(
        directory=file_dir,
        path=file_name,
        as_attachment=True
    )

2. Fix the HTML Template #

Your template has three key issues:

• Wrong url_for syntax (you used an array instead of key-value parameters)
• The download link is trapped inside the for loop (it would repeat for every file property)
• Invalid HTML: <a> tags can't sit directly inside <tr> elements (they need to be in <td>)

Update your file.html template:

{% extends 'base.html' %}
{% block header %}
<h1>{% block title %}Filebrowser{% endblock %}</h1>
{% endblock %}
{% block content %}
<p>Current file: {{ currentFile }}</p>

<table>
{% for key, value in fileProperties.items() %}
<tr>
    <td>{{ key }}</td>
    <td>{{ value }}</td>
</tr>
{% endfor %}
<!-- Add download link in a dedicated table row -->
<tr>
    <td>Download</td>
    <td><a href="{{ url_for('download', urlFilePath=urlFilePath) }}">Click to download this file</a></td>
</tr>
</table>
{% endblock %}

3. Double-Check Route Parameter Passing #

Confirm your browser route is passing the urlFilePath variable to file.html (it looks like you already do this, but it's worth verifying):

# In your browser route, when rendering the file details page
return render_template(
    'file.html',
    currentFile=nestedFilePath,
    fileProperties=fileProperties,
    urlFilePath=urlFilePath  # This variable is needed for the download link
)

Why This Works #

• The download route now uses the same FILE_SYSTEM_ROOT as your browser route, so it can locate the exact file you're viewing
• The security check prevents malicious users from accessing files outside your designated directory
• as_attachment=True tells the browser to trigger a download instead of trying to display the file inline
• The template now generates a valid link using url_for, pointing to the correct download endpoint with the right file path parameter

内容的提问来源于stack exchange，提问作者Joeri_Damian