amazon s3和django - 仅允许来自我网站的用户而不是匿名用户

Question

我使用amazon s3来存储上传的用户图像.我的问题是:

• 如果我允许或接受我,我无法上传或下载内容.
• 如果我允许或授予每个人,所有用户和(特别是)匿名用户将能够看到我不想要的内容.

所以,我的问题是,我该怎么办才能让我网站上的用户上传,下载和删除内容？

在那我有条件:

1. 只有跟随用户(user0)的用户(user1,user2,user3,...)才能下载/查看内容？
2. 只有上传视图的用户才能删除该内容.

models.py:

def get_upload_file_name(instance, filename):
    return "uploaded_files/%s_%s" %(str(time()).replace('.','_'), filename)

PRIVACY = (
    ('H','Hide'),
    ('F','Followers'),
    ('A','All'),
)

class Status(models.Model):
    body = models.TextField(max_length=200)
    image = models.ImageField(blank=True, null=True, upload_to=get_upload_file_name)
    privacy = models.CharField(max_length=1,choices=PRIVACY, default='F')
    pub_date = models.DateTimeField(auto_now_add=True, auto_now=False)
    user = models.ForeignKey(User)

settings.py:

DEFAULT_FILE_STORAGE = 'storages.backends.s3boto.S3BotoStorage'

AWS_ACCESS_KEY_ID = 'FAKEAMAZONKEY'

AWS_SECRET_ACCESS_KEY = 'FAKEAMAZONSECRETKEY'

AWS_STORAGE_BUCKET_NAME = 'fakebucketname'

更新

用户之间关系的模型

class Person(models.Model):
    user = models.OneToOneField(User)
    relationships = models.ManyToManyField('self', through='Relationship', 
                                           symmetrical=False, 
                                           related_name='related_to')

    def __unicode__(self):
        return self.user.username

    def add_relationship(self, person, status):
        relationship, created = Relationship.objects.get_or_create(
            from_person=self,
            to_person=person,
            status=status)
        return relationship

    def remove_relationship(self, person, status):
        Relationship.objects.filter(
            from_person=self, 
            to_person=person,
            status=status).delete()
        return

    def get_relationships(self, status):
        return self.relationships.filter(
            to_people__status=status, 
            to_people__from_person=self)

    def get_related_to(self, status):
        return self.related_to.filter(
            from_people__status=status, 
            from_people__to_person=self)

    def get_following(self):
        return self.get_relationships(RELATIONSHIP_FOLLOWING)

    def get_followers(self):
        return self.get_related_to(RELATIONSHIP_FOLLOWING)

    def get_friends(self):
        return self.relationships.filter(
            to_people__status=RELATIONSHIP_FOLLOWING, 
            to_people__from_person=self,
            from_people__status=RELATIONSHIP_FOLLOWING, 
            from_people__to_person=self)


RELATIONSHIP_FOLLOWING = 1
RELATIONSHIP_BLOCKED = 2
RELATIONSHIP_STATUSES = (
    (RELATIONSHIP_FOLLOWING, 'Following'),
    (RELATIONSHIP_BLOCKED, 'Blocked'),
)

class Relationship(models.Model):
    from_person = models.ForeignKey(Person, related_name='from_people')
    to_person = models.ForeignKey(Person, related_name='to_people')
    status = models.IntegerField(choices=RELATIONSHIP_STATUSES)

    def __unicode__(self):
        return "%s %s %s" % (self.from_person, self.get_status_display(), self.to_person)


class Activity(models.Model):
    actor = models.ForeignKey(User)
    action = models.CharField(max_length=100)
    content_type = models.ForeignKey(ContentType, related_name="content_type")
    object_id = models.PositiveIntegerField()
    content_object = generic.GenericForeignKey('content_type', 'object_id')
    element_type = models.ForeignKey(ContentType, related_name="element_type", blank=True, null=True)
    element_id = models.PositiveIntegerField(blank=True, null=True)
    element_object = generic.GenericForeignKey('element_type', 'element_id')
    pub_date = models.DateTimeField(auto_now_add=True, auto_now=False)

    class Meta:
        verbose_name = 'Activity'
        verbose_name_plural = 'Activities'
        ordering = ['-pub_date']

    def __unicode__(self):
        return ("%s %s") % (self.actor.username, self.action)

    def get_rendered_html(self, user=None):
        if self.element_type:
            template_name = '%s_activity.html' %(self.element_type.name)
        else:
            template_name = '%s_activity.html' %(self.content_type.name)

        return render_to_string(template_name, {
            'object':self.content_object,
            'actor':self.actor,
            'action':self.action,
            'element_object':self.element_object,
            'user':user,
            'pub_date':self.pub_date
            })

Answer 1

直接加载文件时,您可以使用Amazon的查询字符串身份验证,您必须在URL中包含签名以验证是否允许您获取文件.您的应用可以使用boto的Key.generate_url方法来创建这样的网址.您还应该添加一个到期时间,之后链接将不再有效.

编辑:关于如何使用boto设置此更详细的说明 ,,,

Answer 2

这是由视图和模板处理的逻辑。例如，在模板中，您可以有一个{% if user.is_authenticated %}带有上传表单的块，在视图中您还可以检查用户是否经过身份验证，然后才将您的内容加载到 s3