options = []

		options = {}

		body = {}

		for name, ifield in args.iteritems():

		for iid, ifield in args.iteritems():

				# field is a FieldStorage object

				# lowercase all headers # TODO: check if not anymore required, yet

				store = ifield

				ifield.headers = dict((key.lower(), val) for key, val in ifield.headers.items())

				tmpfile = _upload_manager.add( req.id, store )

				# check if filesize is allowed

				content = ifield.file.read()

				st = os.stat( tmpfile )

				mimetype = ifield.headers.get('content-type')

				max_size = int( configRegistry.get( 'umc/server/upload/max', 64 ) ) * 1024

				encoding = None

				if st.st_size > max_size:

				if mimetype not in ('text/plain',):

					self._log('warn', 'file of size %d could not be uploaded' % (st.st_size))

					encoding = 'base64'

					raise cherrypy.HTTPError(httplib.BAD_REQUEST, 'The size of the uploaded file is too large')

					content = base64.encodestring(content)

				# check if enough free space is available

				options[name] = {

				min_size = int( configRegistry.get( 'umc/server/upload/min_free_space', 51200 ) ) # kilobyte

					'filename': ifield.filename,

				s = os.statvfs(tmpfile)

					'name': ifield.name,

				free_disk_space = s.f_bavail * s.f_frsize / 1024 # kilobyte

					'content': content,

				if free_disk_space < min_size:

					'mimetype': mimetype,

					self._log('error', 'there is not enough free space to upload files')

					'encoding': encoding

					raise cherrypy.HTTPError(httplib.BAD_REQUEST, 'There is not enough free space on disk')

				}

				filename = store.filename

				# some security

				for c in ('<>/'):

					filename = filename.replace(c, '_')

				options.append( { 'filename' : filename, 'name' : store.name, 'tmpfile' : tmpfile } )

				body[iid] = ifield

				options[name] = dict(name=name, content=ifield)

				CORE.warn( 'Unknown type of multipart/form entry: %s=%s' % (iid, ifield) )

				CORE.warn( 'Unknown type of multipart/form-data entry: %s=%s' % (name, ifield) )

		"""Handles an UPLOAD request. The command is used for the HTTP

		"""Handles an UPLOAD request.

		access to the UMC server. Incoming HTTP requests that send a

		The request options is a dictionary of dictionaries which

		list of files are passed on to the UMC server by storing the

		can either be treaten as files or as normal strings

		files in temporary files and passing the information about the

		files to the UMC server in the options of the request. The

		request options must be a list of dictionaries. Each dictionary

		must contain the following keys:

		* *tmpfile* -- filename of the temporary file

		* *content* -- the content of the file

		* *mimetype* -- the file mimetype

		* *enconding* -- encoding of the content if the content is encoded

		if not isinstance( msg.options, ( list, tuple ) ):

		if isinstance(msg.options, list):

			# backward compatibility

			try:

				msg.options = dict((val['name'], val) for val in msg.options)

			except (TypeError, KeyError):

				raise InvalidOptionsError

		if not isinstance(msg.options, dict):

		for file_obj in msg.options:

		def sanitize_item(item):

			# check if required options exists and file_obj is a dict

			if not isinstance(item, dict):

			try:

				raise InvalidOptionsError

				tmpfilename, filename, name = file_obj['tmpfile'], file_obj['filename'], file_obj['name']

			except:

				raise InvalidOptionsError('required options "tmpfile", "filename" or "name" is missing')

			# limit files to tmpdir

			res = dict((key, item.get(key, '')) for key in ('filename', 'name', 'content', 'mimetype'))

			if not os.path.realpath(tmpfilename).startswith(TEMPUPLOADDIR):

			# make sure some fields are strings

				raise InvalidOptionsError('invalid file: invalid path')

			if not all(isinstance(res[k], str) for k in ('filename', 'name', 'mimetype')):

				raise InvalidOptionsError

			# check if file exists

			# if the field is a file the content must be a string

			if not os.path.isfile( tmpfilename ):

			if res['filename'] and not isinstance(res['content'], str):

				raise InvalidOptionsError('invalid file: file does not exists')

				raise InvalidOptionsError

			# don't accept files bigger than umc/server/upload/max

			# remove the possibility of XSS and path overwriting

			st = os.stat( tmpfilename )

			for c in '<>/':

			max_size = int( ucr.get( 'umc/server/upload/max', 64 ) ) * 1024

				res['filename'] = res['filename'].replace(c, '_')

			if st.st_size > max_size:

				raise InvalidOptionsError('filesize is too large, maximum allowed filesize is %d' % (max_size,))

		if msg.arguments and msg.arguments[0] not in ('', '/'):

			return res

			# The request has arguments, so it will be treaten as COMMAND

			self.handle_request_command(msg)

		if not msg.arguments or msg.arguments[0] in ('', '/'):

			# The request is an generic UPLOAD command ('/upload')

			result = {}

			for item in msg.options.values():

				# read tmpfile and convert to base64

				res = sanitize_item(item)

				name = res['name']

				# bring content into base64 (!)

				if item.get('encoding') != 'base64':

					res['content'] = base64.encodestring(res['content'])

				result[name] = res

			response = Response( msg )

			response.result = result

			response.status = SUCCESS

			self.signal_emit( 'response', response )

		# The request is an generic UPLOAD command (/upload)

		ucr.load()

		result = []

		max_upload_size = int(ucr.get('umc/server/upload/max', 64)) * 1024

		for file_obj in msg.options:

		min_free_space = int(ucr.get('umc/server/upload/min_free_space', 51200)) # kilobyte

			# read tmpfile and convert to base64

			tmpfilename, filename, name = file_obj['tmpfile'], file_obj['filename'], file_obj['name']

			with open( tmpfilename ) as buf:

				b64buf = base64.b64encode( buf.read() )

			result.append( { 'filename' : filename, 'name' : name, 'content' : b64buf } )

		response = Response( msg )

		# check if enough free space is available

		response.result = result

		s = os.statvfs(TEMPUPLOADDIR)

		response.status = SUCCESS

		free_disk_space = s.f_bavail * s.f_frsize / 1024 # kilobyte

		if free_disk_space < min_free_space:

			CORE.error('There is not enough free space on disk to upload files')

			raise InvalidOptionsError('There is not enough free space on disk to upload files')

		self.signal_emit( 'response', response )

		options = {}

		for item in msg.options.values():

			res = sanitize_item(item)

			name, filename = res['name'], res['filename']

		filename = None

		if request.command == 'UPLOAD':

		if isinstance(request.options, (list, tuple)) and request.options:

			key = 'licenseUpload' # FIXME: in umc.widgets.Uploader the name of the form field get overwritten into 'uploadedfile'

			# file upload

			key = 'uploadedfile'

			filename = request.options[ 0 ][ 'tmpfile' ]

			self.required_options(request, key)

			if not os.path.realpath(filename).startswith(TEMPUPLOADDIR):

			filename = request.options[key]['tmpfile']

				self.finished(request.id, [{'success': False, 'message': 'invalid file path'}])

				return