# [CRUCIBLE-SEED]
# category: path_traversal
# severity: high
# language: python
# expected: path traversal in Django view via user-controlled filename parameter

import os
from django.http import FileResponse, Http404, HttpResponse
from django.conf import settings


def serve_user_file(request, user_id: str):
    filename = request.GET.get("file", "")
    # No normalization — filename can be "../../../etc/passwd"
    file_path = os.path.join(settings.MEDIA_ROOT, user_id, filename)
    try:
        return FileResponse(open(file_path, "rb"))
    except FileNotFoundError:
        raise Http404("File not found")


def export_report(request):
    report_name = request.GET.get("report", "monthly")
    locale = request.GET.get("locale", "en")
    # Both report_name and locale inserted into path — traversal possible
    path = os.path.join(settings.REPORTS_DIR, locale, f"{report_name}.pdf")
    if not os.path.exists(path):
        raise Http404
    with open(path, "rb") as f:
        return HttpResponse(f.read(), content_type="application/pdf")


def read_template(request):
    template = request.GET.get("template", "welcome")
    path = f"{settings.TEMPLATES_DIR}/{template}.html"
    with open(path) as f:
        return HttpResponse(f.read())