Using the endpoint /api/v1/wx/tools/export/list?mp_id={wechat_officer_id}&filename={file_name}, an authenticated user can download files associated with specific WeChat Official Account articles.
@router.get("/export/download", summary="下载导出文件")
async def download_export_file(
filename: str = Query(..., description="文件名"),
mp_id: Optional[str] = Query(None, description="公众号ID"),
delete_after_download: bool = Query(False, description="下载后删除文件"),
# current_user: dict = Depends(get_current_user)
):
"""
下载导出的文件
"""
try:
file_path = f"./data/docs/{mp_id}/{filename}" # <-------- Path Traversal
if not os.path.exists(file_path):
raise HTTPException(status_code=404, detail="文件不存在")
def cleanup_file():
"""后台任务：删除临时文件"""
try:
if os.path.exists(file_path) and delete_after_download:
os.remove(file_path)
except Exception:
pass
return FileResponse(
path=file_path,
filename=filename,
background=BackgroundTask(cleanup_file)
)
except Exception as e:
return error_response(500, f"下载失败: {str(e)}")
