Re-added support for folder with static files, refactored static file sending

flask/__init__.py

@@ -18,7 +18,8 @@ from jinja2 import Markup, escape
 from .app import Flask, Request, Response
 from .config import Config
 from .helpers import url_for, jsonify, json_available, flash, \
-    send_file, get_flashed_messages, get_template_attribute
+    send_file, send_from_directory, get_flashed_messages, \
+    get_template_attribute
 from .globals import current_app, g, request, session, _request_ctx_stack
 from .module import Module
 from .templating import render_template, render_template_string

flask/app.py

@@ -273,7 +273,7 @@ class Flask(_PackageBoundObject):
 
         # if there is a static folder, register it for the application.
         if self.has_static_folder:
-            self.add_url_rule(self.static_path + '/<filename>',
+            self.add_url_rule(self.static_path + '/<path:filename>',
                               endpoint='static',
                               view_func=self.send_static_file)
 

flask/helpers.py

@@ -291,6 +291,33 @@ def send_file(filename_or_fp, mimetype=None, as_attachment=False,
     return rv
 
 
+def send_from_directory(directory, filename, **options):
+    """Send a file from a given directory with :func:`send_file`.  This
+    is a secure way to quickly expose static files from an upload folder
+    or something similar.
+
+    Example usage::
+
+        @app.route('/uploads/<path:filename>')
+        def download_file(filename):
+            return send_from_directory(app.config['UPLOAD_FOLDER'],
+                                       filename, as_attachment=True)
+
+    :param directory: the directory where all the files are stored.
+    :param filename: the filename relative to that directory to
+                     download.
+    :param options: optional keyword arguments that are directly
+                    forwarded to :func:`send_file`.
+    """
+    filename = posixpath.normpath(filename)
+    if filename.startswith(('/', '../')):
+        raise NotFound()
+    filename = os.path.join(directory, filename)
+    if not os.path.isfile(filename):
+        raise NotFound()
+    return send_file(filename, conditional=True, **options)
+
+
 def _get_package_path(name):
     """Returns the path to a package or cwd if that cannot be found."""
     try:
@@ -334,13 +361,8 @@ class _PackageBoundObject(object):
 
         .. versionadded:: 0.5
         """
-        filename = posixpath.normpath(filename)
+        return send_from_directory(os.path.join(self.root_path, 'static'),
-        if filename.startswith(('/', '../')):
+                                   filename)
-            raise NotFound()
-        filename = os.path.join(self.root_path, 'static', filename)
-        if not os.path.isfile(filename):
-            raise NotFound()
-        return send_file(filename, conditional=True)
 
     def open_resource(self, resource):
         """Opens a resource from the application's resource folder.  To see

flask/module.py

@@ -29,7 +29,7 @@ def _register_module(module, static_path):
             path = state.app.static_path
         if state.url_prefix:
             path = state.url_prefix + path
-        state.app.add_url_rule(path + '/<filename>',
+        state.app.add_url_rule(path + '/<path:filename>',
                                '%s.static' % module.name,
                                view_func=module.send_static_file)
     return _register

tests/flask_tests.py

@@ -641,6 +641,8 @@ class ModuleTestCase(unittest.TestCase):
         assert rv.data == 'Hello from the Admin'
         rv = c.get('/admin/static/test.txt')
         assert rv.data.strip() == 'Admin File'
+        rv = c.get('/admin/static/css/test.css')
+        assert rv.data.strip() == '/* nested file */'
 
         with app.test_request_context():
             assert flask.url_for('admin.static', filename='test.txt') \

tests/moduleapp/apps/admin/static/css/test.css

@@ -0,0 +1 @@
+/* nested file */