View Raw mode can be disabled

CHANGELOG.rst

@@ -9,6 +9,7 @@ Changelog
 - Right-to-left support for text snippets.
 - dart-sass is now used for SASS compilation.
 - Updated lexer list.
+- "View Raw" feature can be disabled in app config to hinder abuse.
 
 .. _black: https://github.com/ambv/black
 

dpaste/apps.py

@@ -74,6 +74,9 @@ class dpasteAppConfig(AppConfig):
     # is from another user.
     ONETIME_LIMIT = 2
 
+    # Disable "view Raw" mode.
+    RAW_MODE_ENABLED = True
+
     # Lexers which have wordwrap enabled by default
     LEXER_WORDWRAP = ('rst',)
 

dpaste/templates/dpaste/details.html

@@ -33,7 +33,7 @@
     <li>
       <a href="#delete">{% trans "Delete Now" %}</a>
     </li>
-    {% if snippet.expire_type != 3 %}
+    {% if raw_mode and snippet.expire_type != 3 %}
       <li><a href="{% url "snippet_details_raw" snippet.secret_id %}">{% trans "View Raw" %}</a></li>
     {% endif %}
     {% if snippet.lexer != 'text' %}

dpaste/views.py

@@ -3,8 +3,13 @@ import difflib
 import json
 
 from django.apps import apps
-from django.http import (Http404, HttpResponse, HttpResponseBadRequest,
-                         HttpResponseRedirect)
+from django.http import (
+    Http404,
+    HttpResponse,
+    HttpResponseBadRequest,
+    HttpResponseRedirect,
+    HttpResponseForbidden,
+)
 from django.shortcuts import get_object_or_404
 from django.urls import reverse
 from django.utils.translation import ugettext
@@ -136,6 +141,7 @@ class SnippetDetailView(SnippetView, DetailView):
             {
                 'wordwrap': self.object.lexer in highlight.LEXER_WORDWRAP,
                 'diff': self.get_snippet_diff(),
+                'raw_mode': config.RAW_MODE_ENABLED,
             }
         )
         return ctx
@@ -146,6 +152,13 @@ class SnippetRawView(SnippetDetailView):
     Display the raw content of a snippet
     """
 
+    def dispatch(self, request, *args, **kwargs):
+        if not config.RAW_MODE_ENABLED:
+            return HttpResponseForbidden(
+                'This dpaste installation has Raw view mode disabled.'
+            )
+        return super(SnippetRawView, self).dispatch(request, *args, **kwargs)
+
     def render_to_response(self, context, **response_kwargs):
         snippet = self.get_object()
         response = HttpResponse(snippet.content)