Fix file upload race condition - generate UUID before DB commit (INC4…

compair/api/file.py

@@ -44,27 +44,29 @@
             data={'file': uploaded_file.filename})
 
         try:
+            # Generate UUID and name BEFORE creating database record to avoid race condition
+            temp_uuid = File.generate_uuid()
+            name = temp_uuid + '.' + uploaded_file.filename.lower().rsplit('.', 1)[1]
+
             db_file = File(
                 user_id=current_user.id,
-                name='',
+                name=name,
                 alias=uploaded_file.filename
             )
             db.session.add(db_file)
-            db.session.commit()
-
-            # use uuid generated by file model for name
-            name = db_file.uuid + '.' + uploaded_file.filename.lower().rsplit('.', 1)[1]
 
             # create new file with name
             full_path = os.path.join(current_app.config['ATTACHMENT_UPLOAD_FOLDER'], name)
             uploaded_file.save(full_path)
             current_app.logger.debug("Saved attachment {}/{}".format(current_app.config['ATTACHMENT_UPLOAD_FOLDER'], name))
 
-            # update file record with name
-            db_file.name = name
+            # commit once with complete data
             db.session.commit()
         except Exception as e:
             db.session.rollback()
+            # Clean up physical file if it was created
+            if 'full_path' in locals() and os.path.exists(full_path):
+                os.remove(full_path)
             raise e
 
         return {'file': marshal(db_file, dataformat.get_file())}
@@ -111,20 +113,19 @@
             data={'upload_token_id': upload_token_id})
 
         try:
+            # Generate UUID and name BEFORE creating database record to avoid race condition
+            temp_uuid = File.generate_uuid()
+            name = temp_uuid + '.' + kaltura_media.extension
+
             db_file = File(
                 user_id=current_user.id,
-                name='',
+                name=name,
                 alias=kaltura_media.file_name,
                 kaltura_media=kaltura_media
             )
             db.session.add(db_file)
-            db.session.commit()
-
-            # use uuid generated by file model for name
-            name = db_file.uuid + '.' + kaltura_media.extension
-
-            # update file record with name
-            db_file.name = name
+
+            # commit once with complete data
             db.session.commit()
         except Exception as e:
             db.session.rollback()