main -> web

lmfdb/elliptic_curves/congruent_numbers.py

@@ -8,6 +8,10 @@
 
 congruent_number_data_directory = os.path.expanduser('~/data/congruent_number_curves')
 
+# The files offered by the download buttons in templates/congruent_number_data.html.
+congruent_number_data_files = ['CN.conductor', 'CN.rank', 'CN.MWgroup', 'CN.height',
+                               'CN.regulator', 'CN.root.number', 'CN.Tate-Sha', 'CN.classes']
+
 
 def CNfilename(file_suffix):
     return os.path.join(congruent_number_data_directory, "CN.{}".format(file_suffix))

lmfdb/elliptic_curves/elliptic_curve.py

@@ -31,7 +31,7 @@
 from lmfdb.elliptic_curves.web_ec import WebEC, match_lmfdb_label, match_cremona_label, split_lmfdb_label, split_cremona_label, weierstrass_eqn_regex, short_weierstrass_eqn_regex, class_lmfdb_label, curve_lmfdb_label, EC_ainvs, latex_sha, gl2_subgroup_data, CREMONA_BOUND, match_weierstrass_polys, match_coeff_vec
 from sage.misc.cachefunc import cached_method
 from lmfdb.ecnf.ecnf_stats import latex_tor
-from .congruent_numbers import get_congruent_number_data, congruent_number_data_directory
+from .congruent_numbers import get_congruent_number_data, congruent_number_data_directory, congruent_number_data_files
 from lmfdb.sato_tate_groups.main import st_display_knowl
 
 q = ZZ['x'].gen()
@@ -968,7 +968,7 @@ def render_congruent_number_data():
     bread = [("Datasets", url_for("datasets")), (t, " ")]
     if 'filename' in info:
         filepath = os.path.join(congruent_number_data_directory,info['filename'])
-        if os.path.isfile(filepath) and os.access(filepath, os.R_OK):
+        if info['filename'] in congruent_number_data_files and os.path.isfile(filepath) and os.access(filepath, os.R_OK):
             return send_file(filepath, as_attachment=True)
         else:
             flash_error('File {} not found'.format(info['filename']))

lmfdb/elliptic_curves/test_ell_curves.py

@@ -1,3 +1,5 @@
+import os
+
 from lmfdb.tests import LmfdbTest
 
 
@@ -241,6 +243,12 @@ def test_diagram_search(self):
         assert 'my_dataviz' in data
         assert 'pointRadius' in data
 
+    def test_congruent_number_file_outside_dataset(self):
+        resp = self.tc.get('/EllipticCurve/Q/CongruentNumbers',
+                           query_string={'filename': os.path.abspath(__file__)})
+        assert resp.status_code == 302
+        assert resp.headers['Location'].endswith('/EllipticCurve/Q/CongruentNumbers')
+
     def test_dataset_files_from_beta(self):
         for url in ['/EllipticCurve/Q/stein-watkins?ctype=prime&k=0&Fetch=fetch',
                     '/EllipticCurve/Q/BHKSSW?k=0&Fetch=fetch']: