Initial commit: InviteMe production redesign

app/utils/paths.py

@@ -0,0 +1,39 @@
+from pathlib import Path
+from flask import current_app
+
+
+def _base_upload_folder():
+    return Path(current_app.config["UPLOAD_FOLDER"])
+
+
+def event_photo_folder(event_id):
+    return Path(current_app.config["PHOTO_FOLDER"]) / f"event_{event_id}"
+
+
+def event_qr_folder(event_id):
+    return Path(current_app.config["QR_FOLDER"]) / f"event_{event_id}"
+
+
+def event_logo_folder(event_id):
+    return Path(current_app.config["LOGO_FOLDER"]) / f"event_{event_id}"
+
+
+def event_tickets_folder(event_id):
+    return _base_upload_folder() / "tickets" / f"event_{event_id}"
+
+
+def ensure_event_folders(event_id):
+    """Создаёт все папки для конкретного мероприятия."""
+    for folder in [event_photo_folder, event_qr_folder, event_logo_folder, event_tickets_folder]:
+        folder(event_id).mkdir(parents=True, exist_ok=True)
+
+
+def safe_child_path(folder, filename):
+    """Resolve a database filename without allowing traversal outside its folder."""
+    if not filename:
+        return None
+    folder = Path(folder).resolve()
+    candidate = (folder / filename).resolve()
+    if not candidate.is_relative_to(folder):
+        return None
+    return candidate