WebHost: check uploads against zip magic number instead of .zip

MultiServer.py

@@ -235,11 +235,11 @@ class Context:
             with open(multidatapath, 'rb') as f:
                 data = f.read()
 
-        self._load(self._decompress(data), use_embedded_server_options)
+        self._load(self.decompress(data), use_embedded_server_options)
         self.data_filename = multidatapath
 
     @staticmethod
-    def _decompress(data: bytes) -> dict:
+    def decompress(data: bytes) -> dict:
         format_version = data[0]
         if format_version != 1:
             raise Exception("Incompatible multidata.")

WebHostLib/customserver.py

@@ -76,7 +76,7 @@ class WebHostContext(Context):
         else:
             self.port = get_random_port()
 
-        return self._load(self._decompress(room.seed.multidata), True)
+        return self._load(self.decompress(room.seed.multidata), True)
 
     @db_session
     def init_save(self, enabled: bool = True):

WebHostLib/tracker.py

@@ -252,7 +252,7 @@ def get_static_room_data(room: Room):
     result = _multidata_cache.get(room.seed.id, None)
     if result:
         return result
-    multidata = Context._decompress(room.seed.multidata)
+    multidata = Context.decompress(room.seed.multidata)
     # in > 100 players this can take a bit of time and is the main reason for the cache
     locations: Dict[int, Dict[int, Tuple[int, int]]] = multidata['locations']
     names: Dict[int, Dict[int, str]] = multidata["names"]

WebHostLib/upload.py

@@ -67,7 +67,7 @@ def upload_zip_to_db(zfile: zipfile.ZipFile, owner=None, meta={"race": False}, s
                 multidata = None
 
     if multidata:
-        decompressed_multidata = MultiServer.Context._decompress(multidata)
+        decompressed_multidata = MultiServer.Context.decompress(multidata)
         player_names = {slot.player_name for slot in slots}
         leftover_names = [(name, index) for index, name in
                           enumerate((name for name in decompressed_multidata["names"][0]), start=1)]
@@ -100,7 +100,7 @@ def uploads():
             if file.filename == '':
                 flash('No selected file')
             elif file and allowed_file(file.filename):
-                if file.filename.endswith(".zip"):
+                if zipfile.is_zipfile(file.filename):
                     with zipfile.ZipFile(file, 'r') as zfile:
                         res = upload_zip_to_db(zfile)
                         if type(res) == str:
@@ -108,12 +108,12 @@ def uploads():
                         elif res:
                             return redirect(url_for("view_seed", seed=res.id))
                 else:
+                    # noinspection PyBroadException
                     try:
                         multidata = file.read()
-                        MultiServer.Context._decompress(multidata)
+                        MultiServer.Context.decompress(multidata)
                     except:
                         flash("Could not load multidata. File may be corrupted or incompatible.")
-                        raise
                     else:
                         seed = Seed(multidata=multidata, owner=session["_id"])
                         flush()  # place into DB and generate ids