API Documentation

This documentation is generated directly from the source code.

Upload Sets

class flask_uploads.UploadSet(name: str = 'files', extensions: Iterable[str] = ('txt', 'rtf', 'odf', 'ods', 'gnumeric', 'abw', 'doc', 'docx', 'xls', 'xlsx', 'pdf', 'jpg', 'jpe', 'jpeg', 'png', 'gif', 'svg', 'bmp', 'webp', 'csv', 'ini', 'json', 'plist', 'xml', 'yaml', 'yml'), default_dest: Callable[[Flask], str] | None = None)

This represents a single set of uploaded files. Each upload set is independent of the others. This can be reused across multiple application instances, as all configuration is stored on the application object itself and found with flask.current_app.

Parameters:

  • name – The name of this upload set. It defaults to files, but you can pick any alphanumeric name you want. (For simplicity, it’s best to use a plural noun.)

  • extensions – The extensions to allow uploading in this set. The easiest way to do this is to add together the extension presets (for example, TEXT + DOCUMENTS + IMAGES). It can be overridden by the configuration with the UPLOADED_X_ALLOW and UPLOADED_X_DENY configuration parameters. The default is DEFAULTS.

  • default_dest – If given, this should be a callable. If you call it with the app, it should return the default upload destination path for that app.

property config: UploadConfiguration

This gets the current configuration. By default, it looks up the current application and gets the configuration from there. But if you don’t want to go to the full effort of setting an application, or it’s otherwise outside of a request context, set the _config attribute to an UploadConfiguration instance, then set it back to None when you’re done.

extension_allowed(ext: str) → bool

This determines whether a specific extension is allowed. It is called by file_allowed, so if you override that but still want to check extensions, call back into this.

Parameters:

ext – The extension to check, without the dot.

file_allowed(storage: FileStorage, basename: str) → bool

This tells whether a file is allowed.

It should return True if the given werkzeug.datastructures.FileStorage object can be saved with the given basename, and False if it can’t.

The default implementation just checks the extension, so you can override this if you want.

Parameters:

  • storage – The werkzeug.datastructures.FileStorage to check.

  • basename – The basename it will be saved under.

path(filename: str, folder: str | None = None) → str

This returns the absolute path of a file uploaded to this set. It doesn’t actually check whether said file exists.

Parameters:

  • filename – The filename to return the path for.

  • folder – The subfolder within the upload set previously used to save to.

resolve_conflict(target_folder: str, basename: str) → str

If a file with the selected name already exists in the target folder, this method is called to resolve the conflict. It should return a new basename for the file.

The default implementation splits the name and extension and adds a suffix to the name consisting of an underscore and a number, and tries that until it finds one that doesn’t exist.

Parameters:

  • target_folder – The absolute path to the target.

  • basename – The file’s original basename.

save(storage: FileStorage, folder: str | None = None, name: str | None = None) → str

This saves the storage into this upload set.

A storage is a werkzeug.datastructures.FileStorage.

If the upload is not allowed, an UploadNotAllowed error will be raised.

Otherwise, the file will be saved and its name (including the folder) will be returned.

Parameters:

  • storage – The uploaded file to save.

  • folder – The subfolder within the upload set to save to.

  • name – The name to save the file as. If it ends with a dot, the file’s extension will be appended to the end. (If you are using name, you can include the folder in the name instead of explicitly using folder, i.e. uset.save(file, name="someguy/photo_123.")

url(filename: str) → str

This function gets the URL a file uploaded to this set would be accessed at. It doesn’t check whether said file exists.

Parameters:

filename – The filename to return the URL for.

class flask_uploads.UploadConfiguration(destination: str, base_url: str | None = None, allow: Tuple | Tuple[str, ...] = (), deny: Tuple | Tuple[str, ...] = ())

This holds the configuration for a single UploadSet. The constructor’s arguments are also the attributes.

Parameters:

  • destination – The directory to save files to.

  • base_url – The URL (ending with a /) that files can be downloaded from. If this is None, Flask-Reuploaded will serve the files itself.

  • allow – A list of extensions to allow, even if they’re not in the UploadSet extensions list.

  • deny – A list of extensions to deny, even if they are in the UploadSet extensions list.

Application Setup

flask_uploads.configure_uploads(app: Flask, upload_sets: UploadSet | Iterable[UploadSet]) → None

Call this after the app has been configured. It will go through all the upload sets, get their configuration, and store the configuration on the app. It will also register the uploads module if it hasn’t been set. This can be called multiple times with different upload sets.

Changed in version 0.1.3: The uploads module/blueprint will only be registered if it is needed to serve the upload sets.

Parameters:

  • app – The ~flask.Flask instance to get the configuration from.

  • upload_sets – The UploadSet instances to configure.

Extension Constants

These are some default sets of extensions you can pass to the UploadSet constructor.

class flask_uploads.AllExcept(items: Iterable[str])

This can be used to allow all file types except certain ones. For example, to ban .exe and .iso files, pass:

AllExcept(('exe', 'iso'))

to the UploadSet constructor as extensions. You can use any container, for example:

AllExcept(SCRIPTS + EXECUTABLES)
flask_uploads.DEFAULTS = ('txt', 'rtf', 'odf', 'ods', 'gnumeric', 'abw', 'doc', 'docx', 'xls', 'xlsx', 'pdf', 'jpg', 'jpe', 'jpeg', 'png', 'gif', 'svg', 'bmp', 'webp', 'csv', 'ini', 'json', 'plist', 'xml', 'yaml', 'yml')

Built-in immutable sequence.

If no argument is given, the constructor returns an empty tuple. If iterable is specified the tuple is initialized from iterable’s items.

If the argument is a tuple, the return value is the same object.

flask_uploads.ALL = <flask_uploads.extensions.All object>

This type can be used to allow all extensions. There is a predefined instance named ALL.

flask_uploads.TEXT = ('txt',)

Built-in immutable sequence.

If no argument is given, the constructor returns an empty tuple. If iterable is specified the tuple is initialized from iterable’s items.

If the argument is a tuple, the return value is the same object.

flask_uploads.IMAGES = ('jpg', 'jpe', 'jpeg', 'png', 'gif', 'svg', 'bmp', 'webp')

Built-in immutable sequence.

If no argument is given, the constructor returns an empty tuple. If iterable is specified the tuple is initialized from iterable’s items.

If the argument is a tuple, the return value is the same object.

flask_uploads.AUDIO = ('wav', 'mp3', 'aac', 'ogg', 'oga', 'flac')

Built-in immutable sequence.

If no argument is given, the constructor returns an empty tuple. If iterable is specified the tuple is initialized from iterable’s items.

If the argument is a tuple, the return value is the same object.

flask_uploads.DOCUMENTS = ('rtf', 'odf', 'ods', 'gnumeric', 'abw', 'doc', 'docx', 'xls', 'xlsx', 'pdf')

Built-in immutable sequence.

If no argument is given, the constructor returns an empty tuple. If iterable is specified the tuple is initialized from iterable’s items.

If the argument is a tuple, the return value is the same object.

flask_uploads.DATA = ('csv', 'ini', 'json', 'plist', 'xml', 'yaml', 'yml')

Built-in immutable sequence.

If no argument is given, the constructor returns an empty tuple. If iterable is specified the tuple is initialized from iterable’s items.

If the argument is a tuple, the return value is the same object.

flask_uploads.SCRIPTS = ('js', 'php', 'pl', 'py', 'rb', 'sh')

Built-in immutable sequence.

If no argument is given, the constructor returns an empty tuple. If iterable is specified the tuple is initialized from iterable’s items.

If the argument is a tuple, the return value is the same object.

flask_uploads.ARCHIVES = ('gz', 'bz2', 'zip', 'tar', 'tgz', 'txz', '7z')

Built-in immutable sequence.

If no argument is given, the constructor returns an empty tuple. If iterable is specified the tuple is initialized from iterable’s items.

If the argument is a tuple, the return value is the same object.

flask_uploads.EXECUTABLES = ('so', 'exe', 'dll')

Built-in immutable sequence.

If no argument is given, the constructor returns an empty tuple. If iterable is specified the tuple is initialized from iterable’s items.

If the argument is a tuple, the return value is the same object.

Testing Utilities

class flask_uploads.TestingFileStorage(stream: BinaryIO | None = None, filename: str | None = None, name: str | None = None, content_type: str = 'application/octet-stream', content_length: int = -1, headers: Any | None = None)

This is a helper for testing upload behavior in your application. You can manually create it, and its save method is overloaded to set saved to the name of the file it was saved to. All of these parameters are optional, so only bother setting the ones relevant to your application.

Parameters:

  • stream – A stream. The default is an empty stream.

  • filename – The filename uploaded from the client. The default is the stream’s name.

  • name – The name of the form field it was loaded from. The default is None.

  • content_type – The content type it was uploaded as. The default is application/octet-stream.

  • content_length – How long it is. The default is -1.

  • headers – Multipart headers as a werkzeug.Headers. The default is None.