Merge branch 'master' into fix/reverse

Author: fsbraun

.github/workflows/test.yml

@@ -64,3 +64,42 @@ jobs:
       run: coverage run ./tests/settings.py
     - name: Upload Coverage to Codecov
       uses: codecov/codecov-action@v6
+
+  unit-tests-without-svg-renderer:
+    # svglib and reportlab are the optional django-filer[svg] extra. The matrix
+    # above always has them, so this job covers what a plain "pip install
+    # django-filer" gets: filer reading and thumbnailing SVGs on its own.
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v6
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: '3.13'
+    - name: library prerequisites
+      run: |
+        sudo apt-get update
+        sudo apt-get install python-dev-is-python3 libpq-dev libmagic1 gcc libxml2-dev libxslt1-dev libjpeg62 libopenjp2-7 -y
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install -r tests/requirements/django-5.2.txt
+        pip install -e .
+    - name: Remove the optional SVG renderer
+      run: pip uninstall -y svglib reportlab
+    - name: Check that it is really gone
+      # Without this the job would silently degrade into a duplicate of the
+      # matrix above if anything ever pulls the renderer back in.
+      run: |
+        python - <<'EOF'
+        import importlib.util
+        import sys
+        still_here = [name for name in ('svglib', 'reportlab')
+                      if importlib.util.find_spec(name) is not None]
+        if still_here:
+            sys.exit(f"{', '.join(still_here)} still installed: this job tests nothing")
+        EOF
+    - name: Run coverage
+      run: coverage run ./tests/settings.py
+    - name: Upload Coverage to Codecov
+      uses: codecov/codecov-action@v6

.pre-commit-config.yaml

@@ -21,7 +21,7 @@ repos:
 #        args: [--target-version, "2.2"]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.16.3
+    rev: v0.16.6
     hooks:
       - id: ruff-check
         args: [--fix]

CHANGELOG.rst

@@ -5,6 +5,36 @@ CHANGELOG
 3.6.0 (unreleased)
 ==================
 
+* feat: Support avif images. ``*.avif`` and ``*.avifs`` uploads now become
+  ``Image`` objects (with dimensions, thumbnails and use in image fields) if Pillow
+  can decode them: natively since Pillow 11.3, or through the optional
+  ``pillow-avif-plugin`` package (``pip install django-filer[avif]``) for older
+  Pillow versions.
+
+.. note::
+
+   avif files that were uploaded *before* upgrading remain regular ``File`` objects:
+   filer picks the model class when a file is uploaded. Re-upload them to turn them
+   into ``Image`` objects.
+
+* feat: SVG support no longer requires an SVG renderer. filer reads an SVG's size
+  from the document and thumbnails it by rewriting ``width``, ``height`` and
+  ``viewBox`` on the root element, which keeps the vector data intact instead of
+  re-drawing it. ``easy-thumbnails[svg]`` - and with it svglib, reportlab and lxml,
+  around 14 MB - moved from a hard dependency to the new ``django-filer[svg]``
+  extra (#1547).
+* fix: SVG thumbnails without a ``viewBox`` were scaled by growing the canvas
+  rather than the drawing.
+* fix: An SVG stating only one of ``width`` and ``height`` alongside a ``viewBox``
+  now keeps the dimension it states and derives the other from the viewBox's
+  aspect ratio, the way a browser sizes it. The renderer reported the viewBox's
+  own height instead, which does not match how the image is drawn.
+* fix: When an image's dimensions could not be read, the file object was left at
+  its end, so upload validators that inspect the content saw an empty file.
+* fix: SVG documents nesting elements more than
+  ``filer.utils.svg.MAX_NESTING_DEPTH`` (100) levels deep are refused. Writing
+  such a document out recurses once per level and would exhaust the stack while
+  a thumbnail is generated. Real documents nest a handful of levels.
 * feat: Add support for Django 6.1. The admin breadcrumbs now render as
   ``<ol class="breadcrumbs">`` on Django 6.1 and later, matching the markup its
   element-qualified CSS selectors expect, and keep the legacy
@@ -17,10 +47,34 @@ CHANGELOG
   of a file now also links to its own admin's expand view instead of always linking to
   the image admin's. The expand view now checks read permissions, just like the icon and
   change views.
+* fix: Dropping a file on the admin file widget no longer stacks the upload preview
+  on top of the widget's own markup, which left two files visible and covered the
+  widget's buttons (#1573). The widget now shows the uploaded file itself - thumbnail,
+  label, and working lookup, edit and clear buttons - as it does after a reload, and a
+  failed upload leaves the previous selection untouched. The upload response gained a
+  ``change_url`` key for this.
+* fix: The file widget's clear button works again in widgets that are added to the page
+  after it loaded, e.g. in Django admin inline formsets.
+* fix: A file dragged over the file widget now only recolors the widget's background in
+  the admin's primary color. The widget used to hide its content and grow its border,
+  which moved what was under the cursor and made the widget flicker between its drop
+  state and the file it holds.
 * fix: Send the CSRF token with uploads started from the "Upload Files" button in the
   folder view. Since 3.5.1 the upload endpoint enforces CSRF, but this uploader had not
   been updated and every upload from it failed with "CSRF token missing" (#1617).
 
+.. note::
+
+   Existing installations keep SVG support unchanged: upgrading does not always uninstall
+   svglib or reportlab. Fresh installs and re-locked dependency files no longer get
+   them. The only documents that still need them are those whose size cannot be read
+   from the markup, for example ``width="100%"`` without a ``viewBox``; install
+   ``django-filer[svg]`` if your project has such files. Thumbnails generated from
+   now on are the original document rescaled rather than a reportlab rendering of
+   it - existing cached thumbnails keep their file names and are still served.
+   Installing the extra only ever adds documents filer can size; it never accepts
+   a document filer rejects, so it cannot weaken the SVG upload checks.
+
 .. note::
 
    Projects that override one of filer's breadcrumb templates

docs/installation.rst

@@ -18,6 +18,41 @@ retrieved from iOS devices by airdrop) using an optional dependency::
 
     $ pip install django-filer\[heif\]
 
+.. _optional_svg_support:
+
+Optional SVG renderer
+---------------------
+
+django-filer reads the size of an SVG and scales or crops it by rewriting the
+document itself, so SVG uploads and thumbnails work out of the box. Documents
+that state their size only in relative units (``width="100%"`` without a
+``viewBox``, say) cannot be measured that way. If you have such files, install
+the optional SVG renderer, which derives their size by drawing them::
+
+    $ pip install django-filer\[svg\]
+
+This pulls in `svglib`_ and `reportlab`_ through ``easy-thumbnails[svg]``.
+Before version 3.6, django-filer always installed them.
+
+
+Optional avif support
+---------------------
+
+django-filer treats avif images (``*.avif``, ``*.avifs``) as images if Pillow can
+decode them. `Pillow`_ does so out of the box since Pillow 11.3 (its wheels bundle
+libaom and dav1d). With older Pillow versions install the optional
+`pillow-avif-plugin`_ dependency::
+
+    $ pip install django-filer\[avif\]
+
+If neither is available, avif uploads are kept as regular files instead of images.
+
+.. note::
+
+    avif files uploaded *before* avif support became available stay regular files:
+    django-filer decides on the model class at upload time. Re-upload them to turn
+    them into images.
+
 
 Dependencies
 ------------
@@ -37,6 +72,14 @@ If heif support is chosen, django-filer also installs
 
 * pillow-heif
 
+If avif support is chosen, django-filer also installs
+
+* pillow-avif-plugin (only needed for Pillow < 11.3)
+If the optional SVG renderer is chosen, django-filer also installs
+
+* svglib
+* reportlab
+
 
 Configuration
 -------------
@@ -163,9 +206,12 @@ generation errors,  two options are provided to help when working with ``django-
 .. _Django: http://djangoproject.com
 .. _django-polymorphic: https://github.com/bconstantin/django_polymorphic
 .. _easy_thumbnails: https://github.com/SmileyChris/easy-thumbnails
+.. _svglib: https://github.com/deeplook/svglib
+.. _reportlab: https://www.reportlab.com/
 .. _sorl.thumbnail: http://thumbnail.sorl.net/
 .. _Pillow: http://pypi.python.org/pypi/Pillow/
 .. _Pillow doc: https://pillow.readthedocs.io/en/latest/installation.html
 .. _PIL: http://www.pythonware.com/products/pil/
+.. _pillow-avif-plugin: https://pypi.org/project/pillow-avif-plugin/
 .. _pip: http://pypi.python.org/pypi/pip
 .. _South: http://south.aeracode.org/

docs/settings.rst

@@ -193,6 +193,16 @@ Defaults to ``MAX_IMAGE_PIXELS``. But when set, should always be lower than the
 
 This is useful setting to prevent decompression bomb DOS attack.
 
+The limit applies to every image whose pixel size is known, a vector image (SVG)
+included: an SVG is measured by the size it declares, and is refused just like a
+raster image if that exceeds the limit.
+
+Images whose size cannot be read are treated differently by type. For a raster
+image that is itself the signature of a decompression bomb, because Pillow
+reports no size for one, so it is refused. A vector image has no pixel count to
+compare against, so it is stored with unset dimensions and rendered with a
+generic icon in the admin.
+
 
 ``FILER_ADD_FILE_VALIDATORS``
 -----------------------------

docs/upgrading.rst

@@ -7,6 +7,34 @@ Usually upgrade procedure is straightforward: update the package and run migrati
 require special attention from the developer and here we provide upgrade instructions for such cases.
 
 
+from 3.x to 3.6
+---------------
+
+django-filer 3.6 no longer installs an SVG renderer. It reads an SVG's size from
+the document and thumbnails it by rewriting the root element, so svglib and
+reportlab (roughly 14 MB, pulled in through ``easy-thumbnails[svg]``) became the
+optional :ref:`optional_svg_support` extra.
+
+Upgrading an existing environment changes nothing: ``pip install -U django-filer``
+does not uninstall packages that are already there. Fresh installs and re-locked
+dependency files (``uv.lock``, ``poetry.lock``, ``pip-compile`` output) do drop
+them, and that is where you may notice a difference.
+
+Only documents whose size cannot be read from the markup still need the renderer,
+for example ``width="100%"`` without a ``viewBox``. Their dimensions stay unset
+and the admin shows a generic image icon instead of a preview. If your project has
+such files, install
+
+.. code-block:: shell
+
+    $ pip install django-filer\[svg\]
+
+SVG thumbnails generated from 3.6 on are the original document rescaled rather
+than a reportlab rendering of it, which preserves the vector data more faithfully.
+Thumbnail file names are unchanged, so thumbnails cached by earlier versions keep
+being served.
+
+
 from 3.x to 3.3
 ---------------
 

docs/validation.rst

@@ -257,6 +257,11 @@ To activate it, register it for the image mime types you want sanitized:
     django-filer[heif]``) and register the sanitizer for ``image/heic`` /
     ``image/heif``.
 
+    ``strip_exif`` keeps the encoding parameters of JPEG and WebP images. For
+    other lossy formats — ``image/avif`` and ``image/heic`` among them — it
+    re-encodes with Pillow's defaults, which costs image quality. Only register
+    it for those MIME types if that trade-off is acceptable.
+
 Block other MIME types
 ----------------------
 

eslint.config.js

@@ -27,6 +27,9 @@ export default [
                 setInterval: 'readonly',
                 clearInterval: 'readonly',
                 NodeList: 'readonly',
+                DataTransfer: 'readonly',
+                DragEvent: 'readonly',
+                File: 'readonly',
                 HTMLCollection: 'readonly',
                 URL: 'readonly',
                 navigator: 'readonly',

filer/admin/clipboardadmin.py

@@ -4,7 +4,7 @@
 from django.core.exceptions import ValidationError
 from django.forms.models import modelform_factory
 from django.http import JsonResponse
-from django.urls import path, reverse
+from django.urls import NoReverseMatch, path, reverse
 from django.utils.translation import gettext_lazy as _
 
 from .. import settings as filer_settings
@@ -160,6 +160,12 @@ def ajax_upload(request, folder_id=None):
                 'label': str(file_obj),
                 'file_id': file_obj.pk,
             }
+            try:
+                # Lets the file widget link its edit button to the new file
+                data['change_url'] = file_obj.get_admin_change_url()
+            except NoReverseMatch:
+                # Custom file models are not necessarily registered in the admin
+                data['change_url'] = ''
             # prepare preview thumbnail
             if isinstance(file_obj, Image):
                 data['thumbnail_180'] = reverse(

filer/apps.py

@@ -29,6 +29,38 @@ def register_optional_heif_supprt(self):
             # No heif support installed
             pass
 
+    def register_optional_avif_support(self):
+        """Pillow decodes AVIF itself since Pillow 11.3 (its wheels bundle libaom and
+        dav1d). For older Pillow versions the optional pillow-avif-plugin package
+        provides the same plugin."""
+        from PIL import Image
+
+        try:  # pragma: no cover
+            import pillow_avif  # noqa: F401
+        except (ModuleNotFoundError, ImportError):
+            # No pillow-avif-plugin installed: Pillow's own AVIF plugin (if any) is used
+            pass
+
+        # registered_extensions() imports Pillow's plugins. Pillow only registers the
+        # extensions if the AVIF codec actually is available.
+        if ".avif" not in Image.registered_extensions():  # pragma: no cover
+            # No AVIF support: leave avif files as plain files, they could not be
+            # thumbnailed anyway
+            return
+
+        from .settings import IMAGE_EXTENSIONS, IMAGE_MIME_TYPES
+
+        AVIF_EXTENSIONS = [".avif", ".avifs"]
+        # Add extensions to python mimetypes which filer uses
+        for ext in AVIF_EXTENSIONS:
+            mimetypes.add_type("image/avif", ext)
+        # Mark them as images
+        for ext in AVIF_EXTENSIONS:
+            if ext not in IMAGE_EXTENSIONS:
+                IMAGE_EXTENSIONS.append(ext)
+        if "avif" not in IMAGE_MIME_TYPES:
+            IMAGE_MIME_TYPES.append("avif")
+
     def resolve_validators(self):
         """Resolve dotted path file validators"""
 
@@ -62,6 +94,9 @@ def resolve_validators(self):
     def ready(self):
         # Make webp MIME type known to python (needed for python < 3.11)
         mimetypes.add_type("image/webp", ".webp")
+        # Make avif MIME type known to python (needed for older python versions)
+        mimetypes.add_type("image/avif", ".avif")
         #
         self.resolve_validators()
         self.register_optional_heif_supprt()
+        self.register_optional_avif_support()