Mirror/filebrowser
1
0
Fork 0
mirror of https://github.com/filebrowser/filebrowser.git synced 2024-06-07 23:00:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

server-side user-based command checking #24

Browse Source
This commit is contained in:
Henrique Dias 2016-08-21 20:20:13 +01:00
parent b9ca7e2a9c
commit 8d0214f74a
2 changed files with 23 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
config/config.go
View File

@ -26,17 +26,21 @@ type Config struct {
// UserConfig contains the configuration for each user // UserConfig contains the configuration for each user
type UserConfig struct { type UserConfig struct {
PathScope string // Path the user have access PathScope string `json:"-"` // Path the user have access
Root http.FileSystem // The virtual file system the user have access Root http.FileSystem `json:"-"` // The virtual file system the user have access
StyleSheet string // Costum stylesheet StyleSheet string `json:"-"` // Costum stylesheet
FrontMatter string // Default frontmatter to save files in FrontMatter string `json:"-"` // Default frontmatter to save files in
AllowNew bool // Can create files and folders AllowNew bool // Can create files and folders
AllowEdit bool // Can edit/rename files AllowEdit bool // Can edit/rename files
AllowCommands bool // Can execute commands AllowCommands bool // Can execute commands
Commands []string // Available Commands Commands []string // Available Commands
Rules []*Rule // Access rules Rules []*Rule `json:"-"` // Access rules
} }
// TODO: USE USER StyleSheet
// TODO: USE USER FRONTMATTER
// TODO: USE USER ROOT
// Rule is a dissalow/allow rule // Rule is a dissalow/allow rule
type Rule struct { type Rule struct {
Regex bool Regex bool
@ -100,6 +104,7 @@ func Parse(c *caddy.Controller) ([]Config, error) {
} }
cCfg.PathScope = c.Val() cCfg.PathScope = c.Val()
cCfg.PathScope = strings.TrimSuffix(cCfg.PathScope, "/") cCfg.PathScope = strings.TrimSuffix(cCfg.PathScope, "/")
cCfg.Root = http.Dir(cCfg.PathScope)
case "styles": case "styles":
if !c.NextArg() { if !c.NextArg() {
return configs, c.ArgErr() return configs, c.ArgErr()
@ -200,8 +205,6 @@ func Parse(c *caddy.Controller) ([]Config, error) {
}) })
// NEW USER BLOCK? // NEW USER BLOCK?
default: default:
cCfg.Root = http.Dir(cCfg.PathScope)
val := c.Val() val := c.Val()
// Checks if it's a new user // Checks if it's a new user
if !strings.HasSuffix(val, ":") { if !strings.HasSuffix(val, ":") {

18
filemanager.go
View File

@ -136,7 +136,7 @@ func (f FileManager) ServeHTTP(w http.ResponseWriter, r *http.Request) (int, err
return http.StatusUnauthorized, nil return http.StatusUnauthorized, nil
} }
return vcsCommand(w, r, c) return command(w, r, c, user)
} }
// Creates a new folder // Creates a new folder
return newDirectory(w, r, c) return newDirectory(w, r, c)
@ -240,12 +240,20 @@ func newDirectory(w http.ResponseWriter, r *http.Request, c *config.Config) (int
return http.StatusCreated, nil return http.StatusCreated, nil
} }
// vcsCommand handles the requests for VCS related commands: git, svn and mercurial // command handles the requests for VCS related commands: git, svn and mercurial
func vcsCommand(w http.ResponseWriter, r *http.Request, c *config.Config) (int, error) { func command(w http.ResponseWriter, r *http.Request, c *config.Config, u *config.UserConfig) (int, error) {
command := strings.Split(r.Header.Get("command"), " ") command := strings.Split(r.Header.Get("command"), " ")
// Check if the command is for git, mercurial or svn // Check if the command is allowed
if command[0] != "git" && command[0] != "hg" && command[0] != "svn" { mayContinue := false
for _, cmd := range u.Commands {
if cmd == command[0] {
mayContinue = true
}
}
if !mayContinue {
return http.StatusForbidden, nil return http.StatusForbidden, nil
} }