feat: v2 (#599)

Read https://github.com/filebrowser/filebrowser/pull/575.

.gitignore

@@ -1,15 +1,5 @@
-.DS_Store
-*/dist/*
 *.db
-*.db.lock
-.idea
-.vscode
-Dockerfile
-filebrowser
+*.lock
+*.bak
+_old
 rice-box.go
-vendor
-npm-debug.log*
-package-lock.json
-yarn-debug.log*
-yarn-error.log*
-yarn.lock

.goreleaser.yml

@@ -55,5 +55,3 @@ dockers:
     tag_templates:
       - "{{ .Tag }}"
       - latest
-    extra_files:
-      - Docker.json

.travis.yml

@@ -12,30 +12,27 @@ env:
   - USE_DOCKER="true"
 stages:
   - lint
-  - test
+  - build
   - release
 cache:
   directories:
-    - lib/rice-box.go
+    - http/rice-box.go
 jobs:
   include:
   - stage: lint
-    script: "./build/run_linters.sh"
-  - stage: test
-    script: "./build/build_all.sh"
+    script: ./wizard.sh -l
+  - stage: build
+    script: ./wizard.sh -b
     deploy:
       provider: script
       skip_cleanup: true
-      script: docker build -t filebrowser/filebrowser . && ./build/docker_login.sh && docker push filebrowser/filebrowser && docker logout
+      script: ./wizard.sh -p
       on:
         tags: false
         repo: filebrowser/filebrowser
         branch: master
   - stage: release
-    script:
-      - docker run --rm -itv $(pwd):/src -w /src -v /var/run/docker.sock:/var/run/docker.sock filebrowser/dev sh -c "go get ./... && goreleaser"
-      - ./build/push_images.sh
-      - ./build/push_ricebox.sh
+    script: ./wizard.sh -r
     if: tag IS present
     deploy:
       provider: releases

Docker.json

@@ -1,12 +0,0 @@
-{
-  "port": 80,
-  "address": "",
-  "database": "/database.db",
-  "defaults": {
-    "scope": "/srv",
-    "allowCommands": true,
-    "allowEdit": true,
-    "allowNew": true,
-    "commands": []
-  }
-}

Dockerfile

@@ -7,6 +7,7 @@ VOLUME /srv
 EXPOSE 80
 
 COPY filebrowser /filebrowser
-COPY Docker.json /.filebrowser.json
+COPY docker-entrypoint.sh /entrypoint.sh
 
-ENTRYPOINT ["/filebrowser"]
+ENTRYPOINT [ "/entrypoint.sh" ]
+CMD [ "run" ]

README.md

@@ -1,16 +1,8 @@
-ℹ INFO: **This project is not under active development ATM. A small group of developers keeps the project alive, but due to lack of time, we can't continue adding new features or doing deep changes. Please read [#532](https://github.com/filebrowser/filebrowser/issues/532) for more info!**
-
-ℹ INFO: in Q2 2018, this project was renamed from `filemanager` to `filebrowser`, and the main repo was moved from [hacdias/filemanager](https://github.com/hacdias/filemanager) to [filebrowser/filebrowser](https://github.com/filebrowser/filebrowser). At the same time, the official docker image was changed to [`filebrowser/filebrowser`](https://hub.docker.com/r/filebrowser/filebrowser/). Users are encouraged to check their sources and update them accordingly.
-
----
-
 <p align="center">
   <img src="https://raw.githubusercontent.com/filebrowser/logo/master/banner.png" width="550"/>
 </p>
 
-![Preview](https://user-images.githubusercontent.com/5447088/28537288-39be4288-70a2-11e7-8ce9-0813d59f46b7.gif)
-
-# filebrowser
+![Preview](https://user-images.githubusercontent.com/5447088/50716739-ebd26700-107a-11e9-9817-14230c53efd2.gif)
 
 [![Travis](https://img.shields.io/travis/com/filebrowser/filebrowser.svg?style=flat-square)](https://travis-ci.com/filebrowser/filebrowser)
 [![Go Report Card](https://goreportcard.com/badge/github.com/filebrowser/filebrowser?style=flat-square)](https://goreportcard.com/report/github.com/filebrowser/filebrowser)
@@ -18,69 +10,22 @@
 [![Version](https://img.shields.io/github/release/filebrowser/filebrowser.svg?style=flat-square)](https://github.com/filebrowser/filebrowser/releases/latest)
 [![Chat IRC](https://img.shields.io/badge/freenode-%23filebrowser-blue.svg?style=flat-square)](http://webchat.freenode.net/?channels=%23filebrowser)
 
+> ℹ INFO: **This project is not under active development ATM. A small group of developers keeps the project alive, but due to lack of time, we can't continue adding new features or doing deep changes. Please read [#532](https://github.com/filebrowser/filebrowser/issues/532) for more info!**
+
 filebrowser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit your files. It allows the creation of multiple users and each user can have its own directory. It can be used as a standalone app or as a middleware.
 
-# Table of contents
+## Features
 
-+ [Getting started](#getting-started)
-+ [Features](#features)
-  - [Users](#users)
-  - [Search](#search)
-+ [Contributing](#contributing)
-+ [Donate](#donate)
+Please refer to our docs at [docs.filebrowser.xyz/features](https://docs.filebrowser.xyz/features)
 
-# Getting started
+## Install
 
-You can find the Getting Started guide on the [documentation](https://filebrowser.github.io/quick-start/).
+Please refer to our docs at [docs.filebrowser.xyz](https://docs.filebrowser.xyz/).
 
-# Features
+## Usage
 
-Easy login system.
+Please refer to our docs at [docs.filebrowser.xyz/usage](https://docs.filebrowser.xyz/usage).
 
-![Login Page](https://user-images.githubusercontent.com/5447088/42046516-fe702976-7af5-11e8-9d72-c996150b09f5.png)
+## Contributing
 
-Listings of your files, available in two styles: mosaic and list. You can delete, move, rename, upload and create new files, as well as directories. Single files can be downloaded directly, and multiple files as *.zip*, *.tar*, *.tar.gz*, *.tar.bz2* or *.tar.xz*.
-
-![Mosaic Listing](https://user-images.githubusercontent.com/5447088/42046515-fe3f7d58-7af5-11e8-8f87-270947ed755f.png)
-
-File Browser editor is powered by [Codemirror](https://codemirror.net/) and if you're working with markdown files with metadata, both parts will be separated from each other so you can focus on the content.
-
-![Markdown Editor](https://user-images.githubusercontent.com/5447088/42046519-ff17b81c-7af5-11e8-90f3-184e0ad24b7c.png)
-
-On the settings page, a regular user can set its own custom CSS to personalize the experience and change its password. For admins, they can manage the permissions of each user, set commands which can be executed when certain events are triggered (such as before saving and after saving) and change plugin's settings.
-
-![Settings](https://user-images.githubusercontent.com/5447088/42046517-fea206e4-7af5-11e8-88fe-b88513b43f43.png)
-
-We also allow the users to search in the directories and execute commands if allowed.
-
-## Users
-
-We support multiple users and each user can have its own scope and custom stylesheet. The administrator is able to choose which permissions should be given to the users, as well as the commands they can execute. Each user also have a set of rules, in which he can be prevented or allowed to access some directories (regular expressions included!).
-
-![Users](https://user-images.githubusercontent.com/5447088/42046518-fed14440-7af5-11e8-9a57-f4a611e9598d.png)
-
-## Search
-
-File Browser allows you to search through your files and it has some options. By default, your search will be something like this:
-
-```
-this are keywords
-```
-
-If you search for that it will look at every file that contains "this", "are" or "keywords" on their name. If you want to search for an exact term, you should surround your search by double quotes:
-
-```
-"this is the name"
-```
-
-That will search for any file that contains "this is the name" on its name. It won't search for each separated term this time.
-
-By default, every search will be case insensitive. Although, you can make a case sensitive search by adding `case:sensitive` to the search terms, like this:
-
-```
-this are keywords case:sensitive
-```
-
-# Contributing
-
-The contributing guidelines can be found [here](https://github.com/filebrowser/community).
+Please refer to our docs at [docs.filebrowser.xyz/contributing](https://docs.filebrowser.xyz/contributing).

auth/auth.go

@@ -0,0 +1,15 @@
+package auth
+
+import (
+	"net/http"
+
+	"github.com/filebrowser/filebrowser/v2/users"
+)
+
+// Auther is the authentication interface.
+type Auther interface {
+	// Auth is called to authenticate a request.
+	Auth(*http.Request) (*users.User, error)
+	// SetStorage attaches the Storage instance.
+	SetStorage(*users.Storage)
+}

auth/json.go

@@ -0,0 +1,108 @@
+package auth
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+
+	"github.com/filebrowser/filebrowser/v2/settings"
+	"github.com/filebrowser/filebrowser/v2/users"
+)
+
+// MethodJSONAuth is used to identify json auth.
+const MethodJSONAuth settings.AuthMethod = "json"
+
+type jsonCred struct {
+	Password  string `json:"password"`
+	Username  string `json:"username"`
+	ReCaptcha string `json:"recaptcha"`
+}
+
+// JSONAuth is a json implementaion of an Auther.
+type JSONAuth struct {
+	ReCaptcha *ReCaptcha
+	storage   *users.Storage
+}
+
+// Auth authenticates the user via a json in content body.
+func (a *JSONAuth) Auth(r *http.Request) (*users.User, error) {
+	var cred jsonCred
+
+	if r.Body == nil {
+		return nil, os.ErrPermission
+	}
+
+	err := json.NewDecoder(r.Body).Decode(&cred)
+	if err != nil {
+		return nil, os.ErrPermission
+	}
+
+	// If ReCaptcha is enabled, check the code.
+	if a.ReCaptcha != nil && len(a.ReCaptcha.Secret) > 0 {
+		ok, err := a.ReCaptcha.Ok(cred.ReCaptcha)
+
+		if err != nil {
+			return nil, err
+		}
+
+		if !ok {
+			return nil, os.ErrPermission
+		}
+	}
+
+	u, err := a.storage.Get(cred.Username)
+	if err != nil || !users.CheckPwd(cred.Password, u.Password) {
+		return nil, os.ErrPermission
+	}
+
+	return u, nil
+}
+
+// SetStorage attaches the storage to the auther.
+func (a *JSONAuth) SetStorage(s *users.Storage) {
+	a.storage = s
+}
+
+const reCaptchaAPI = "/recaptcha/api/siteverify"
+
+// ReCaptcha identifies a recaptcha conenction.
+type ReCaptcha struct {
+	Host   string `json:"host"`
+	Key    string `json:"key"`
+	Secret string `json:"secret"`
+}
+
+// Ok checks if a reCaptcha responde is correct.
+func (r *ReCaptcha) Ok(response string) (bool, error) {
+	body := url.Values{}
+	body.Set("secret", r.Key)
+	body.Add("response", response)
+
+	client := &http.Client{}
+
+	resp, err := client.Post(
+		r.Host+reCaptchaAPI,
+		"application/x-www-form-urlencoded",
+		strings.NewReader(body.Encode()),
+	)
+	if err != nil {
+		return false, err
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return false, nil
+	}
+
+	var data struct {
+		Success bool `json:"success"`
+	}
+
+	err = json.NewDecoder(resp.Body).Decode(&data)
+	if err != nil {
+		return false, err
+	}
+
+	return data.Success, nil
+}

auth/none.go

@@ -0,0 +1,26 @@
+package auth
+
+import (
+	"net/http"
+
+	"github.com/filebrowser/filebrowser/v2/settings"
+	"github.com/filebrowser/filebrowser/v2/users"
+)
+
+// MethodNoAuth is used to identify no auth.
+const MethodNoAuth settings.AuthMethod = "noauth"
+
+// NoAuth is no auth implementation of auther.
+type NoAuth struct {
+	storage *users.Storage
+}
+
+// Auth uses authenticates user 1.
+func (a *NoAuth) Auth(r *http.Request) (*users.User, error) {
+	return a.storage.Get(1)
+}
+
+// SetStorage attaches the storage to the auther.
+func (a *NoAuth) SetStorage(s *users.Storage) {
+	a.storage = s
+}

auth/proxy.go

@@ -0,0 +1,35 @@
+package auth
+
+import (
+	"net/http"
+	"os"
+
+	"github.com/filebrowser/filebrowser/v2/settings"
+	"github.com/filebrowser/filebrowser/v2/users"
+	"github.com/filebrowser/filebrowser/v2/errors"
+)
+
+// MethodProxyAuth is used to identify no auth.
+const MethodProxyAuth settings.AuthMethod = "proxy"
+
+// ProxyAuth is a proxy implementation of an auther.
+type ProxyAuth struct {
+	Header  string
+	storage *users.Storage
+}
+
+// Auth authenticates the user via an HTTP header.
+func (a *ProxyAuth) Auth(r *http.Request) (*users.User, error) {
+	username := r.Header.Get(a.Header)
+	user, err := a.storage.Get(username)
+	if err == errors.ErrNotExist {
+		return nil, os.ErrPermission
+	}
+
+	return user, err
+}
+
+// SetStorage attaches the storage to the auther.
+func (a *ProxyAuth) SetStorage(s *users.Storage) {
+	a.storage = s
+}

auth/storage.go

@@ -0,0 +1,39 @@
+package auth
+
+import (
+	"github.com/filebrowser/filebrowser/v2/settings"
+	"github.com/filebrowser/filebrowser/v2/users"
+)
+
+// StorageBackend is a storage backend for auth storage.
+type StorageBackend interface {
+	Get(settings.AuthMethod) (Auther, error)
+	Save(Auther) error
+}
+
+// Storage is a auth storage.
+type Storage struct {
+	back  StorageBackend
+	users *users.Storage
+}
+
+// NewStorage creates a auth storage from a backend.
+func NewStorage(back StorageBackend, users *users.Storage) *Storage {
+	return &Storage{back: back, users: users}
+}
+
+// Get wraps a StorageBackend.Get and calls SetStorage on the auther.
+func (s *Storage) Get(t settings.AuthMethod) (Auther, error) {
+	auther, err := s.back.Get(t)
+	if err != nil {
+		return nil, err
+	}
+
+	auther.SetStorage(s.users)
+	return auther, nil
+}
+
+// Save wraps a StorageBackend.Save.
+func (s *Storage) Save(a Auther) error {
+	return s.back.Save(a)
+}

build/build.sh

@@ -1,20 +0,0 @@
-#!/bin/sh
-
-set -e
-
-cd $(dirname $0)/../cli
-
-go get -v ./...
-
-if [ "$COMMIT_SHA" != "" ]; then
-  echo "Set version to ($COMMIT_SHA)"
-  sed -i.bak "s|(untracked)|($COMMIT_SHA)|g" ../lib/filebrowser.go
-fi
-
-echo "Build CLI"
-go build -a -o filebrowser
-
-if [ "$COMMIT_SHA" != "" ]; then
-  echo "Reset version to (untracked)"
-  sed -i "s|($COMMIT_SHA)|(untracked)|g" ../lib/filebrowser.go
-fi

build/build_all.sh

@@ -1,37 +0,0 @@
-#!/bin/sh
-
-cd $(dirname $0)/..
-
-if [ -d lib/"rice-box.go" ]; then
-  rm -rf lib/rice-box.go
-fi
-
-if [ "$USE_DOCKER" != "" ]; then
-  if [ -d "frontend/dist" ]; then
-    rm -rf frontend/dist
-  fi;
-
-  if [ "$(command -v git)" != "" ]; then
-    COMMIT_SHA="$(git rev-parse HEAD | cut -c1-8)"
-  else
-    COMMIT_SHA="untracked"
-  fi
-
-  $(command -v winpty) docker run --rm -it \
-    -v /$(pwd):/src:z \
-    -w //src \
-    -e COMMIT_SHA=$COMMIT_SHA \
-    filebrowser/dev \
-    sh -c "\
-      cd build && \
-      dos2unix build_assets.sh && \
-      dos2unix build.sh && \
-      ./build_assets.sh && \
-      ./build.sh &&
-      mv ../cli/filebrowser ../ \
-    "
-else
-  set -e
-  ./build/build_assets.sh
-  ./build/build.sh
-fi

build/build_assets.sh

@@ -1,23 +0,0 @@
-#!/bin/sh
-
-set -e
-
-cd $(dirname $0)/..
-
-# Clean the dist folder and build the assets
-cd frontend
-if [ -d "dist" ]; then
-  rm -rf dist/*
-fi;
-yarn install
-yarn build
-cd ..
-
-# Install rice tool if not present
-if ! [ -x "$(command -v rice)" ]; then
-  go get github.com/GeertJohan/go.rice/rice
-fi
-
-# Embed the assets using rice
-cd lib
-rice embed-go

build/docker_login.sh

@@ -1,27 +0,0 @@
-#!/bin/sh
-
-set -e
-
-# init key for pass
-gpg --batch --gen-key <<-EOF
-%echo Generating a standard key
-Key-Type: DSA
-Key-Length: 1024
-Subkey-Type: ELG-E
-Subkey-Length: 1024
-Name-Real: Meshuggah Rocks
-Name-Email: meshuggah@example.com
-Expire-Date: 0
-# Do a commit here, so that we can later print "done" :-)
-%commit
-%echo done
-EOF
-
-key=$(gpg --no-auto-check-trustdb --list-secret-keys | grep ^sec | cut -d/ -f2 | cut -d" " -f1)
-pass init $key
-
-if [ "$(command -v docker-credential-pass)" = "" ]; then
-  docker run --rm -itv /usr/local/bin:/src filebrowser/dev sh -c "cp /go/bin/docker-credential-pass /src"
-fi
-
-echo "$DOCKER_PASS" | docker login -u "$DOCKER_USER" --password-stdin

build/push_images.sh

@@ -1,14 +0,0 @@
-#! /bin/sh
-
-set -e
-
-cd $(dirname $0)
-
-./docker_login.sh
-
-for tag in `echo $(docker images filebrowser/filebrowser* | awk -F ' ' '{print $1 ":" $2}') | cut -d ' ' -f2-`; do
-  if [ "$tag" = "REPOSITORY:TAG" ]; then break; fi
-  docker push $tag
-done
-
-docker logout

build/push_ricebox.sh

@@ -1,39 +0,0 @@
-#!/bin/sh
-
-set -e
-
-cd $(dirname $0)
-
-COMMIT_SHA="$(git rev-parse --verify HEAD | cut -c1-8)"
-
-eval `ssh-agent -s`
-openssl aes-256-cbc -K $encrypted_9ca81b5594f5_key -iv $encrypted_9ca81b5594f5_iv -in ./deploy_key.enc -d | ssh-add -
-
-git clone git@github.com:filebrowser/caddy caddy
-cd caddy
-cp ../../lib/rice-box.go assets/
-sed -i 's/package lib/package assets/g' assets/rice-box.go
-git checkout -b update-rice-box origin/master
-git config --local user.name "Filebrowser Bot"
-git config --local user.email "FilebrowserBot@users.noreply.github.com"
-git commit -am "update rice-box $COMMIT_SHA"
-
-if [ $(git tag | grep "$TRAVIS_TAG" | wc -l) -ne 0 ]; then
-  git tag -d "$TRAVIS_TAG"
-fi
-
-git tag "$TRAVIS_TAG"
-
-if [ "$(git ls-remote --heads origin update-rice-box)" != "" ]; then
-  git push -u origin update-rice-box
-else
-  git push origin +update-rice-box
-fi
-
-if [ "$(git ls-remote --heads origin update-rice-box)" != "" ]; then
-  git push origin "$TRAVIS_TAG"
-else
-  git push origin :"$TRAVIS_TAG"
-  git push origin "$TRAVIS_TAG"
-fi
-

build/release.sh

@@ -1,55 +0,0 @@
-#!/bin/bash
-
-set -e
-
-cd $(dirname $0)/..
-
-echo "> Checking semver format"
-
-if [ $# -ne 1 ]; then
-  echo "This release script requires a single argument corresponding to the semver to be released. See semver.org"
-  exit 1
-fi
-
-semver=$(grep -P '^v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)' <<< "$1")
-
-if [ $? -ne 0 ]; then
-  echo "Not valid semver format. See semver.org"
-  exit 1
-fi
-
-echo "> Checking matching $semver in frontend submodule"
-
-cd frontend
-git fetch --all
-
-if [ $(git tag | grep "$semver" | wc -l) -eq 0 ]; then
-  echo "Tag $semver does not exist in submodule 'frontend'. Tag it and run this script again."
-  exit 1
-fi
-
-git rev-parse --verify --quiet release
-if [ $? -ne 0 ]; then
-  git checkout -b release "$semver"
-else
-  git checkout release
-  git reset --hard "$semver"
-fi
-
-cd ..
-
-echo "> Updating submodule ref to $semver"
-
-sed -i "s|(untracked)|$1|g" filebrowser.go
-git commit -am "chore: version $semver"
-git tag "$1"
-git push
-git push --tags
-
-echo "> Commiting untracked version notice..."
-
-sed -i "s|$1|(untracked)|g" filebrowser.go
-git commit -am "chore: setting untracked version [ci skip]"
-git push
-
-echo "> Done!"

build/run_linters.sh

@@ -1,13 +0,0 @@
-#!/bin/sh
-
-set -e
-
-cd $(dirname $0)/..
-
-if [ "$USE_DOCKER" != "" ]; then
-  $(command -v winpty) docker run --rm -itv "/$(pwd)://src" -w "//src" filebrowser/dev sh -c "\
-    go get -v ./... && \
-    golangci-lint run -v"
-else
-  golangci-lint run -v
-fi

cli/cmd/db.go

@@ -1,24 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-
-	"github.com/spf13/cobra"
-)
-
-// dbCmd represents the db command
-var dbCmd = &cobra.Command{
-	Use:     "db",
-	Version: rootCmd.Version,
-	Aliases: []string{"database"},
-	Short:   "Manage a filebrowser database",
-	Long: `This is a CLI tool to ease the management of
-filebrowser database files.`,
-	Run: func(cmd *cobra.Command, args []string) {
-		fmt.Println("db called. Command not implemented, yet.")
-	},
-}
-
-func init() {
-	rootCmd.AddCommand(dbCmd)
-}

cli/cmd/root.go

@@ -1,76 +0,0 @@
-package cmd
-
-import (
-	"log"
-	"strings"
-
-	fb "github.com/filebrowser/filebrowser/lib"
-	homedir "github.com/mitchellh/go-homedir"
-	"github.com/spf13/cobra"
-	v "github.com/spf13/viper"
-)
-
-var cfgFile string
-
-// rootCmd represents the base command when called without any subcommands
-var rootCmd = &cobra.Command{
-	Use:     "filebrowser",
-	Version: fb.Version,
-	Aliases: []string{"serve"},
-	Short:   "A stylish web-based file manager",
-	Long: `Command 'serve' is the default. Filebrowser is started
-with the provided envvars, flags and/or config file. For example:
-
-filebrowser -c config.json -p 80 -s ./srv
-
-File Browser is a static binary composed of a golang backend and
-a Vue.js frontend to create, edit, copy, move, download your files
-easily, everywhere, every time.`,
-	//	Run: func(cmd *cobra.Command, args []string) {},
-}
-
-// Execute adds all child commands to the root command and sets flags appropriately.
-// This is called by main.main(). It only needs to happen once to the rootCmd.
-func Execute() {
-	checkRootAlias()
-	if err := rootCmd.Execute(); err != nil {
-		panic(err)
-	}
-}
-
-func init() {
-	cobra.OnInitialize(initConfig)
-	rootCmd.SetVersionTemplate("File Browser {{printf \"version %s\" .Version}}\n")
-
-	rootCmd.PersistentFlags().StringVarP(&cfgFile, "config", "c", "", "config file (defaults are './.filebrowser[ext]', '$HOME/.filebrowser[ext]' or '/etc/filebrowser/.filebrowser[ext]')")
-}
-
-// initConfig reads in config file and ENV variables if set.
-func initConfig() {
-	if cfgFile == "" {
-		// Find home directory.
-		home, err := homedir.Dir()
-		if err != nil {
-			panic(err)
-		}
-		v.AddConfigPath(".")
-		v.AddConfigPath(home)
-		v.AddConfigPath("/etc/filebrowser/")
-		v.SetConfigName(".filebrowser")
-	} else {
-		// Use config file from the flag.
-		v.SetConfigFile(cfgFile)
-	}
-
-	v.SetEnvPrefix("FB")
-	v.AutomaticEnv()
-	v.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
-
-	if err := v.ReadInConfig(); err != nil {
-		if _, ok := err.(v.ConfigParseError); ok {
-			panic(err)
-		}
-	} else {
-		log.Println("Using config file:", v.ConfigFileUsed())
-	}
-}

cli/cmd/rootalias.go

@@ -1,46 +0,0 @@
-package cmd
-
-import (
-	"log"
-	"os"
-)
-
-// checkRootAlias compares the first argument provided in the CLI with a list of
-// subcmds and aliases. If no match is found, the first alias of rootCmd is added.
-func checkRootAlias() {
-	l := len(rootCmd.Aliases)
-	if l == 0 {
-		return
-	}
-	if l > 1 {
-		log.Printf("rootCmd.Aliases should contain a single string. '%s' is used.\n", rootCmd.Aliases[0])
-	}
-	if len(os.Args) > 1 {
-		for _, v := range append(nonRootSubCmds(), []string{"--help", "--version"}...) {
-			if os.Args[1] == v {
-				return
-			}
-		}
-	}
-	os.Args = append([]string{os.Args[0], rootCmd.Aliases[0]}, os.Args[1:]...)
-}
-
-// nonRootSubCmds traverses the list of subcommands of rootCmd and returns a string
-// slice containing the names and aliases of all the subcmds, except the one defined
-// in the Aliases field of rootCmd.
-func nonRootSubCmds() (l []string) {
-	for _, c := range rootCmd.Commands() {
-		isAlias := false
-		for _, a := range append(c.Aliases, c.Name()) {
-			if a == rootCmd.Aliases[0] {
-				isAlias = true
-				break
-			}
-		}
-		if !isAlias {
-			l = append(l, c.Name())
-			l = append(l, c.Aliases...)
-		}
-	}
-	return
-}

cli/cmd/serve.go

@@ -1,111 +0,0 @@
-package cmd
-
-import (
-	filebrowser "github.com/filebrowser/filebrowser/lib"
-	"github.com/spf13/cobra"
-	v "github.com/spf13/viper"
-)
-
-// serveCmd represents the serve command
-var serveCmd = &cobra.Command{
-	Use:     "serve",
-	Version: rootCmd.Version,
-	Aliases: []string{"server"},
-	Short:   "Start filebrowser service",
-	Long:    rootCmd.Long,
-	Run: func(cmd *cobra.Command, args []string) {
-		Serve()
-	},
-	Args: cobra.NoArgs,
-}
-
-func init() {
-	rootCmd.AddCommand(serveCmd)
-
-	f := serveCmd.PersistentFlags()
-
-	flag := func(k string, i interface{}, u string) {
-		switch y := i.(type) {
-		case bool:
-			f.Bool(k, y, u)
-		case int:
-			f.Int(k, y, u)
-		case string:
-			f.String(k, y, u)
-		}
-		v.SetDefault(k, i)
-	}
-
-	flagP := func(k, p string, i interface{}, u string) {
-		switch y := i.(type) {
-		case bool:
-			f.BoolP(k, p, y, u)
-		case int:
-			f.IntP(k, p, y, u)
-		case string:
-			f.StringP(k, p, y, u)
-		}
-		v.SetDefault(k, i)
-	}
-
-	deprecated := func(k string, i interface{}, u, m string) {
-		switch y := i.(type) {
-		case bool:
-			f.Bool(k, y, u)
-		case int:
-			f.Int(k, y, u)
-		case string:
-			f.String(k, y, u)
-		}
-		f.MarkDeprecated(k, m)
-	}
-
-	// Global settings
-	flagP("port", "p", 0, "HTTP Port (default is random)")
-	flagP("address", "a", "", "Address to listen to (default is all of them)")
-	flagP("database", "d", "./filebrowser.db", "Database file")
-	flagP("log", "l", "stdout", "Errors logger; can use 'stdout', 'stderr' or file")
-	flagP("baseurl", "b", "", "Base URL")
-	flag("prefixurl", "", "Prefix URL")
-	flag("staticgen", "", "Static Generator you want to enable")
-
-	// User default settings
-	f.String("defaults.commands", "git svn hg", "Default commands option for new users")
-	v.SetDefault("defaults.commands", []string{"git", "svn", "hg"})
-
-	flagP("defaults.scope", "s", ".", "Default scope option for new users")
-	flag("defaults.viewMode", filebrowser.MosaicViewMode, "Default view mode for new users")
-	flag("defaults.allowCommands", true, "Default allow commands option for new users")
-	flag("defaults.allowEdit", true, "Default allow edit option for new users")
-	flag("defaults.allowNew", true, "Default allow new option for new users")
-	flag("defaults.allowPublish", true, "Default allow publish option for new users")
-	flag("defaults.locale", "", "Default locale for new users, set it empty to enable auto detect from browser")
-
-	// Recaptcha settings
-	flag("recaptcha.host", "https://www.google.com", "Use another host for ReCAPTCHA. recaptcha.net might be useful in China")
-	flag("recaptcha.key", "", "ReCaptcha site key")
-	flag("recaptcha.secret", "", "ReCaptcha secret")
-
-	// Auth settings
-	flag("auth.method", "default", "Switch between 'none', 'default' and 'proxy' authentication")
-	flag("auth.header", "X-Forwarded-User", "The header name used for proxy authentication")
-
-	// Bind the full flag set to the configuration
-	if err := v.BindPFlags(f); err != nil {
-		panic(err)
-	}
-
-	// Deprecated flags
-	deprecated("no-auth", false, "Disables authentication", "use --auth.method='none' instead")
-	deprecated("alternative-recaptcha", false, "Use recaptcha.net for serving and handling, useful in China", "use --recaptcha.host instead")
-	deprecated("recaptcha-key", "", "ReCaptcha site key", "use --recaptcha.key instead")
-	deprecated("recaptcha-secret", "", "ReCaptcha secret", "use --recaptcha.secret instead")
-	deprecated("scope", ".", "Default scope option for new users", "use --defaults.scope instead")
-	deprecated("commands", "git svn hg", "Default commands option for new users", "use --defaults.commands instead")
-	deprecated("view-mode", "mosaic", "Default view mode for new users", "use --defaults.viewMode instead")
-	deprecated("locale", "", "Default locale for new users, set it empty to enable auto detect from browser", "use --defaults.locale instead")
-	deprecated("allow-commands", true, "Default allow commands option for new users", "use --defaults.allowCommands instead")
-	deprecated("allow-edit", true, "Default allow edit option for new users", "use --defaults.allowEdit instead")
-	deprecated("allow-publish", true, "Default allow publish option for new users", "use --defaults.allowPublish instead")
-	deprecated("allow-new", true, "Default allow new option for new users", "use --defaults.allowNew instead")
-}

cli/cmd/server.go

@@ -1,150 +0,0 @@
-package cmd
-
-import (
-	"io/ioutil"
-	"log"
-	"net"
-	"net/http"
-	"os"
-	"path/filepath"
-
-	"github.com/asdine/storm"
-	filebrowser "github.com/filebrowser/filebrowser/lib"
-	"github.com/filebrowser/filebrowser/lib/bolt"
-	h "github.com/filebrowser/filebrowser/lib/http"
-	"github.com/filebrowser/filebrowser/lib/staticgen"
-	"github.com/hacdias/fileutils"
-	"github.com/spf13/viper"
-	lumberjack "gopkg.in/natefinch/lumberjack.v2"
-)
-
-func Serve() {
-	// Set up process log before anything bad happens.
-	switch l := viper.GetString("log"); l {
-	case "stdout":
-		log.SetOutput(os.Stdout)
-	case "stderr":
-		log.SetOutput(os.Stderr)
-	case "":
-		log.SetOutput(ioutil.Discard)
-	default:
-		log.SetOutput(&lumberjack.Logger{
-			Filename:   l,
-			MaxSize:    100,
-			MaxAge:     14,
-			MaxBackups: 10,
-		})
-	}
-
-	// Validate the provided config before moving forward
-	{
-		// Map of valid authentication methods, containing a boolean value to indicate the need of Auth.Header
-		validMethods := make(map[string]bool)
-		validMethods["none"] = false
-		validMethods["default"] = false
-		validMethods["proxy"] = true
-
-		m := viper.GetString("auth.method")
-		b, ok := validMethods[m]
-		if !ok {
-			log.Fatal("The property 'auth.method' needs to be set to 'none', 'default' or 'proxy'.")
-		}
-
-		if b {
-			if viper.GetString("auth.header") == "" {
-				log.Fatal("The 'auth.header' needs to be specified when '", m, "' authentication is used.")
-			}
-			log.Println("[WARN] Filebrowser authentication is configured to '", m, "' authentication. This can cause a huge security issue if the infrastructure is not configured correctly.")
-		}
-	}
-
-	// Builds the address and a listener.
-	laddr := viper.GetString("address") + ":" + viper.GetString("port")
-	listener, err := net.Listen("tcp", laddr)
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	// Tell the user the port in which is listening.
-	log.Println("Listening on", listener.Addr().String())
-
-	// Starts the server.
-	if err := http.Serve(listener, handler()); err != nil {
-		log.Fatal(err)
-	}
-}
-
-func handler() http.Handler {
-	db, err := storm.Open(viper.GetString("database"))
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	fb := &filebrowser.FileBrowser{
-		Auth: &filebrowser.Auth{
-			Method: viper.GetString("auth.method"),
-			Header: viper.GetString("auth.header"),
-		},
-		ReCaptcha: &filebrowser.ReCaptcha{
-			Host:   viper.GetString("recaptcha.host"),
-			Key:    viper.GetString("recaptcha.key"),
-			Secret: viper.GetString("recaptcha.secret"),
-		},
-		DefaultUser: &filebrowser.User{
-			AllowCommands: viper.GetBool("defaults.allowCommands"),
-			AllowEdit:     viper.GetBool("defaults.allowEdit"),
-			AllowNew:      viper.GetBool("defaults.allowNew"),
-			AllowPublish:  viper.GetBool("defaults.allowPublish"),
-			Commands:      viper.GetStringSlice("defaults.commands"),
-			Rules:         []*filebrowser.Rule{},
-			Locale:        viper.GetString("defaults.locale"),
-			CSS:           "",
-			Scope:         viper.GetString("defaults.scope"),
-			FileSystem:    fileutils.Dir(viper.GetString("defaults.scope")),
-			ViewMode:      viper.GetString("defaults.viewMode"),
-		},
-		Store: &filebrowser.Store{
-			Config: bolt.ConfigStore{DB: db},
-			Users:  bolt.UsersStore{DB: db},
-			Share:  bolt.ShareStore{DB: db},
-		},
-		NewFS: func(scope string) filebrowser.FileSystem {
-			return fileutils.Dir(scope)
-		},
-	}
-
-	fb.SetBaseURL(viper.GetString("baseurl"))
-	fb.SetPrefixURL(viper.GetString("prefixurl"))
-
-	err = fb.Setup()
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	switch viper.GetString("staticgen") {
-	case "hugo":
-		hugo := &staticgen.Hugo{
-			Root:        viper.GetString("Scope"),
-			Public:      filepath.Join(viper.GetString("Scope"), "public"),
-			Args:        []string{},
-			CleanPublic: true,
-		}
-
-		if err = fb.Attach(hugo); err != nil {
-			log.Fatal(err)
-		}
-	case "jekyll":
-		jekyll := &staticgen.Jekyll{
-			Root:        viper.GetString("Scope"),
-			Public:      filepath.Join(viper.GetString("Scope"), "_site"),
-			Args:        []string{"build"},
-			CleanPublic: true,
-		}
-
-		if err = fb.Attach(jekyll); err != nil {
-			log.Fatal(err)
-		}
-	}
-
-	return h.Handler(fb)
-}

cli/cmd/version.go

@@ -1,28 +0,0 @@
-package cmd
-
-import (
-	"text/template"
-
-	"github.com/spf13/cobra"
-)
-
-var versionCmd = &cobra.Command{
-	Use:   "version",
-	Short: "Print the version number of File Browser",
-	Long:  `All software has versions. This is File Browser's`,
-	Run: func(cmd *cobra.Command, args []string) {
-		// https://github.com/spf13/cobra/issues/724
-		t := template.New("version")
-		template.Must(t.Parse(rootCmd.VersionTemplate()))
-		err := t.Execute(rootCmd.OutOrStdout(), rootCmd)
-		if err != nil {
-			rootCmd.Println(err)
-		}
-	},
-}
-
-func init() {
-	rootCmd.AddCommand(versionCmd)
-	serveCmd.AddCommand(versionCmd)
-	dbCmd.AddCommand(versionCmd)
-}

cli/main.go

@@ -1,7 +0,0 @@
-package main
-
-import "github.com/filebrowser/filebrowser/cli/cmd"
-
-func main() {
-	cmd.Execute()
-}

cmd/cmd.go

@@ -0,0 +1,12 @@
+package cmd
+
+import (
+	"log"
+)
+
+// Execute executes the commands.
+func Execute() {
+	if err := rootCmd.Execute(); err != nil {
+		log.Fatal(err)
+	}
+}

cmd/cmds.go

@@ -0,0 +1,31 @@
+package cmd
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	rootCmd.AddCommand(cmdsCmd)
+}
+
+var cmdsCmd = &cobra.Command{
+	Use:   "cmds",
+	Short: "Command runner management utility",
+	Long:  `Command runner management utility.`,
+	Args:  cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		cmd.Help()
+		os.Exit(0)
+	},
+}
+
+func printEvents(m map[string][]string) {
+	for evt, cmds := range m {
+		for i, cmd := range cmds {
+			fmt.Printf("%s(%d): %s\n", evt, i, cmd)
+		}
+	}
+}

cmd/cmds_add.go

@@ -0,0 +1,35 @@
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	cmdsCmd.AddCommand(cmdsAddCmd)
+	cmdsAddCmd.Flags().StringP("command", "c", "", "command to add")
+	cmdsAddCmd.Flags().StringP("event", "e", "", "corresponding event")
+	cmdsAddCmd.MarkFlagRequired("command")
+	cmdsAddCmd.MarkFlagRequired("event")
+}
+
+var cmdsAddCmd = &cobra.Command{
+	Use:   "add",
+	Short: "Add a command to run on a specific event",
+	Long:  `Add a command to run on a specific event.`,
+	Args:  cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		db := getDB()
+		defer db.Close()
+		st := getStorage(db)
+		s, err := st.Settings.Get()
+		checkErr(err)
+
+		evt := mustGetString(cmd, "event")
+		command := mustGetString(cmd, "command")
+
+		s.Commands[evt] = append(s.Commands[evt], command)
+		err = st.Settings.Save(s)
+		checkErr(err)
+		printEvents(s.Commands)
+	},
+}

cmd/cmds_ls.go

@@ -0,0 +1,34 @@
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	cmdsCmd.AddCommand(cmdsLsCmd)
+	cmdsLsCmd.Flags().StringP("event", "e", "", "event name, without 'before' or 'after'")
+}
+
+var cmdsLsCmd = &cobra.Command{
+	Use:   "ls",
+	Short: "List all commands for each event",
+	Long:  `List all commands for each event.`,
+	Args:  cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		db := getDB()
+		defer db.Close()
+		st := getStorage(db)
+		s, err := st.Settings.Get()
+		checkErr(err)
+		evt := mustGetString(cmd, "event")
+
+		if evt == "" {
+			printEvents(s.Commands)
+		} else {
+			show := map[string][]string{}
+			show["before_"+evt] = s.Commands["before_"+evt]
+			show["after_"+evt] = s.Commands["after_"+evt]
+			printEvents(show)
+		}
+	},
+}

cmd/cmds_rm.go

@@ -0,0 +1,36 @@
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	cmdsCmd.AddCommand(cmdsRmCmd)
+	cmdsRmCmd.Flags().StringP("event", "e", "", "corresponding event")
+	cmdsRmCmd.Flags().UintP("index", "i", 0, "command index")
+	cmdsRmCmd.MarkFlagRequired("event")
+	cmdsRmCmd.MarkFlagRequired("index")
+}
+
+var cmdsRmCmd = &cobra.Command{
+	Use:   "rm",
+	Short: "Removes a command from an event hooker",
+	Long:  `Removes a command from an event hooker.`,
+	Args:  cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		db := getDB()
+		defer db.Close()
+		st := getStorage(db)
+		s, err := st.Settings.Get()
+		checkErr(err)
+
+		evt := mustGetString(cmd, "event")
+		i, err := cmd.Flags().GetUint("index")
+		checkErr(err)
+
+		s.Commands[evt] = append(s.Commands[evt][:i], s.Commands[evt][i+1:]...)
+		err = st.Settings.Save(s)
+		checkErr(err)
+		printEvents(s.Commands)
+	},
+}

cmd/config.go

@@ -0,0 +1,136 @@
+package cmd
+
+import (
+	"encoding/json"
+	nerrors "errors"
+	"fmt"
+	"os"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/filebrowser/filebrowser/v2/auth"
+	"github.com/filebrowser/filebrowser/v2/errors"
+	"github.com/filebrowser/filebrowser/v2/settings"
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	rootCmd.AddCommand(configCmd)
+}
+
+var configCmd = &cobra.Command{
+	Use:   "config",
+	Short: "Configuration management utility",
+	Long:  `Configuration management utility.`,
+	Args:  cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		cmd.Help()
+		os.Exit(0)
+	},
+}
+
+func addConfigFlags(cmd *cobra.Command) {
+	addUserFlags(cmd)
+	cmd.Flags().StringP("baseURL", "b", "/", "base url of this installation")
+	cmd.Flags().BoolP("signup", "s", false, "allow users to signup")
+	cmd.Flags().String("shell", "", "shell command to which other commands should be appended")
+
+	cmd.Flags().StringP("address", "a", "127.0.0.1", "default address to listen to")
+	cmd.Flags().StringP("log", "l", "stderr", "log output")
+	cmd.Flags().IntP("port", "p", 0, "default port to listen to")
+	cmd.Flags().String("tls.cert", "", "tls certificate path")
+	cmd.Flags().String("tls.key", "", "tls key path")
+
+	cmd.Flags().String("auth.method", string(auth.MethodJSONAuth), "authentication type")
+	cmd.Flags().String("auth.header", "", "HTTP header for auth.method=proxy")
+
+	cmd.Flags().String("recaptcha.host", "https://www.google.com", "use another host for ReCAPTCHA. recaptcha.net might be useful in China")
+	cmd.Flags().String("recaptcha.key", "", "ReCaptcha site key")
+	cmd.Flags().String("recaptcha.secret", "", "ReCaptcha secret")
+
+	cmd.Flags().String("branding.name", "", "replace 'File Browser' by this name")
+	cmd.Flags().String("branding.files", "", "path to directory with images and custom styles")
+	cmd.Flags().Bool("branding.disableExternal", false, "disable external links such as GitHub links")
+}
+
+func getAuthentication(cmd *cobra.Command) (settings.AuthMethod, auth.Auther) {
+	method := settings.AuthMethod(mustGetString(cmd, "auth.method"))
+
+	var auther auth.Auther
+	if method == auth.MethodProxyAuth {
+		header := mustGetString(cmd, "auth.header")
+		if header == "" {
+			panic(nerrors.New("you must set the flag 'auth.header' for method 'proxy'"))
+		}
+		auther = &auth.ProxyAuth{Header: header}
+	}
+
+	if method == auth.MethodNoAuth {
+		auther = &auth.NoAuth{}
+	}
+
+	if method == auth.MethodJSONAuth {
+		jsonAuth := &auth.JSONAuth{}
+
+		host := mustGetString(cmd, "recaptcha.host")
+		key := mustGetString(cmd, "recaptcha.key")
+		secret := mustGetString(cmd, "recaptcha.secret")
+
+		if key != "" && secret != "" {
+			jsonAuth.ReCaptcha = &auth.ReCaptcha{
+				Host:   host,
+				Key:    key,
+				Secret: secret,
+			}
+		}
+
+		auther = jsonAuth
+	}
+
+	if auther == nil {
+		panic(errors.ErrInvalidAuthMethod)
+	}
+
+	return method, auther
+}
+
+func printSettings(s *settings.Settings, auther auth.Auther) {
+	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
+
+	fmt.Fprintf(w, "\nBase URL:\t%s\n", s.BaseURL)
+	fmt.Fprintf(w, "Sign up:\t%t\n", s.Signup)
+	fmt.Fprintf(w, "Auth method:\t%s\n", s.AuthMethod)
+	fmt.Fprintf(w, "Shell:\t%s\t\n", strings.Join(s.Shell, " "))
+	fmt.Fprintf(w, "Log:\t%s\t\n", s.Log)
+	fmt.Fprintln(w, "\nServer:")
+	fmt.Fprintf(w, "\tAddress:\t%s\n", s.Server.Address)
+	fmt.Fprintf(w, "\tPort:\t%d\n", s.Server.Port)
+	fmt.Fprintf(w, "\tTLS Cert:\t%s\n", s.Server.TLSCert)
+	fmt.Fprintf(w, "\tTLS Key:\t%s\n", s.Server.TLSKey)
+	fmt.Fprintln(w, "\nBranding:")
+	fmt.Fprintf(w, "\tName:\t%s\n", s.Branding.Name)
+	fmt.Fprintf(w, "\tFiles override:\t%s\n", s.Branding.Files)
+	fmt.Fprintf(w, "\tDisable external links:\t%t\n", s.Branding.DisableExternal)
+	fmt.Fprintln(w, "\nDefaults:")
+	fmt.Fprintf(w, "\tScope:\t%s\n", s.Defaults.Scope)
+	fmt.Fprintf(w, "\tLocale:\t%s\n", s.Defaults.Locale)
+	fmt.Fprintf(w, "\tView mode:\t%s\n", s.Defaults.ViewMode)
+	fmt.Fprintf(w, "\tCommands:\t%s\n", strings.Join(s.Defaults.Commands, " "))
+	fmt.Fprintf(w, "\tSorting:\n")
+	fmt.Fprintf(w, "\t\tBy:\t%s\n", s.Defaults.Sorting.By)
+	fmt.Fprintf(w, "\t\tAsc:\t%t\n", s.Defaults.Sorting.Asc)
+	fmt.Fprintf(w, "\tPermissions:\n")
+	fmt.Fprintf(w, "\t\tAdmin:\t%t\n", s.Defaults.Perm.Admin)
+	fmt.Fprintf(w, "\t\tExecute:\t%t\n", s.Defaults.Perm.Execute)
+	fmt.Fprintf(w, "\t\tCreate:\t%t\n", s.Defaults.Perm.Create)
+	fmt.Fprintf(w, "\t\tRename:\t%t\n", s.Defaults.Perm.Rename)
+	fmt.Fprintf(w, "\t\tModify:\t%t\n", s.Defaults.Perm.Modify)
+	fmt.Fprintf(w, "\t\tDelete:\t%t\n", s.Defaults.Perm.Delete)
+	fmt.Fprintf(w, "\t\tShare:\t%t\n", s.Defaults.Perm.Share)
+	fmt.Fprintf(w, "\t\tDownload:\t%t\n", s.Defaults.Perm.Download)
+	w.Flush()
+
+	b, err := json.MarshalIndent(auther, "", "  ")
+	checkErr(err)
+	fmt.Printf("\nAuther configuration (raw):\n\n%s\n\n", string(b))
+}

cmd/config_cat.go

@@ -0,0 +1,26 @@
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	configCmd.AddCommand(configCatCmd)
+}
+
+var configCatCmd = &cobra.Command{
+	Use:   "cat",
+	Short: "Prints the configuration",
+	Long:  `Prints the configuration.`,
+	Args:  cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		db := getDB()
+		defer db.Close()
+		st := getStorage(db)
+		s, err := st.Settings.Get()
+		checkErr(err)
+		auther, err := st.Auth.Get(s.AuthMethod)
+		checkErr(err)
+		printSettings(s, auther)
+	},
+}

cmd/config_init.go

@@ -0,0 +1,76 @@
+package cmd
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/asdine/storm"
+	"github.com/filebrowser/filebrowser/v2/settings"
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	configCmd.AddCommand(configInitCmd)
+	rootCmd.AddCommand(configInitCmd)
+	addConfigFlags(configInitCmd)
+	configInitCmd.MarkFlagRequired("scope")
+}
+
+var configInitCmd = &cobra.Command{
+	Use:   "init",
+	Short: "Initialize a new database",
+	Long: `Initialize a new database to use with File Browser. All of
+this options can be changed in the future with the command
+"filebrowser config set". The user related flags apply
+to the defaults when creating new users and you don't
+override the options.`,
+	Args: cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		if _, err := os.Stat(databasePath); err == nil {
+			panic(errors.New(databasePath + " already exists"))
+		}
+
+		defaults := settings.UserDefaults{}
+		getUserDefaults(cmd, &defaults, true)
+		authMethod, auther := getAuthentication(cmd)
+
+		db, err := storm.Open(databasePath)
+		checkErr(err)
+		defer db.Close()
+		st := getStorage(db)
+		s := &settings.Settings{
+			Key:        generateRandomBytes(64), // 256 bit
+			BaseURL:    mustGetString(cmd, "baseURL"),
+			Log:        mustGetString(cmd, "log"),
+			Signup:     mustGetBool(cmd, "signup"),
+			Shell:      strings.Split(strings.TrimSpace(mustGetString(cmd, "shell")), " "),
+			AuthMethod: authMethod,
+			Defaults:   defaults,
+			Server: settings.Server{
+				Address: mustGetString(cmd, "address"),
+				Port:    mustGetInt(cmd, "port"),
+				TLSCert: mustGetString(cmd, "tls.cert"),
+				TLSKey:  mustGetString(cmd, "tls.key"),
+			},
+			Branding: settings.Branding{
+				Name:            mustGetString(cmd, "branding.name"),
+				DisableExternal: mustGetBool(cmd, "branding.disableExternal"),
+				Files:           mustGetString(cmd, "branding.files"),
+			},
+		}
+
+		err = st.Settings.Save(s)
+		checkErr(err)
+		err = st.Auth.Save(auther)
+		checkErr(err)
+
+		fmt.Printf(`
+Congratulations! You've set up your database to use with File Browser.
+Now add your first user via 'filebrowser users new' and then you just
+need to call the main command to boot up the server.
+`)
+		printSettings(s, auther)
+	},
+}

cmd/config_set.go

@@ -0,0 +1,76 @@
+package cmd
+
+import (
+	"strings"
+
+	"github.com/filebrowser/filebrowser/v2/auth"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+)
+
+func init() {
+	configCmd.AddCommand(configSetCmd)
+	addConfigFlags(configSetCmd)
+}
+
+var configSetCmd = &cobra.Command{
+	Use:   "set",
+	Short: "Updates the configuration",
+	Long: `Updates the configuration. Set the flags for the options
+you want to change.`,
+	Args: cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		db := getDB()
+		defer db.Close()
+
+		st := getStorage(db)
+		s, err := st.Settings.Get()
+		checkErr(err)
+
+		hasAuth := false
+		cmd.Flags().Visit(func(flag *pflag.Flag) {
+			switch flag.Name {
+			case "baseURL":
+				s.BaseURL = mustGetString(cmd, flag.Name)
+			case "signup":
+				s.Signup = mustGetBool(cmd, flag.Name)
+			case "auth.method":
+				hasAuth = true
+			case "shell":
+				s.Shell = strings.Split(strings.TrimSpace(mustGetString(cmd, flag.Name)), " ")
+			case "branding.name":
+				s.Branding.Name = mustGetString(cmd, flag.Name)
+			case "branding.disableExternal":
+				s.Branding.DisableExternal = mustGetBool(cmd, flag.Name)
+			case "branding.files":
+				s.Branding.Files = mustGetString(cmd, flag.Name)
+			case "log":
+				s.Log = mustGetString(cmd, flag.Name)
+			case "address":
+				s.Server.Address = mustGetString(cmd, flag.Name)
+			case "port":
+				s.Server.Port = mustGetInt(cmd, flag.Name)
+			case "tls.cert":
+				s.Server.TLSCert = mustGetString(cmd, flag.Name)
+			case "tls.key":
+				s.Server.TLSKey = mustGetString(cmd, flag.Name)
+			}
+		})
+
+		getUserDefaults(cmd, &s.Defaults, false)
+
+		var auther auth.Auther
+		if hasAuth {
+			s.AuthMethod, auther = getAuthentication(cmd)
+			err = st.Auth.Save(auther)
+			checkErr(err)
+		} else {
+			auther, err = st.Auth.Get(s.AuthMethod)
+			checkErr(err)
+		}
+
+		err = st.Settings.Save(s)
+		checkErr(err)
+		printSettings(s, auther)
+	},
+}

cmd/docs.go

@@ -0,0 +1,129 @@
+package cmd
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	rootCmd.AddCommand(docsCmd)
+	docsCmd.Flags().StringP("path", "p", "./docs", "path to save the docs")
+}
+
+func printToc(names []string) {
+	for i, name := range names {
+		name = strings.TrimSuffix(name, filepath.Ext(name))
+		name = strings.Replace(name, "-", " ", -1)
+		names[i] = name
+	}
+
+	sort.Strings(names)
+
+	toc := ""
+	for _, name := range names {
+		toc += "* [" + name + "](cli/" + strings.Replace(name, " ", "-", -1) + ".md)\n"
+	}
+
+	fmt.Println(toc)
+}
+
+var docsCmd = &cobra.Command{
+	Use:    "docs",
+	Hidden: true,
+	Args:   cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		dir := mustGetString(cmd, "path")
+		generateDocs(rootCmd, dir)
+		names := []string{}
+
+		err := filepath.Walk(dir, func(path string, info os.FileInfo, err error) error {
+			if err != nil || info.IsDir() {
+				return err
+			}
+
+			if !strings.HasPrefix(info.Name(), "filebrowser") {
+				return nil
+			}
+
+			names = append(names, info.Name())
+			return nil
+		})
+
+		checkErr(err)
+		printToc(names)
+	},
+}
+
+func generateDocs(cmd *cobra.Command, dir string) {
+	for _, c := range cmd.Commands() {
+		if !c.IsAvailableCommand() || c.IsAdditionalHelpTopicCommand() {
+			continue
+		}
+
+		generateDocs(c, dir)
+	}
+
+	basename := strings.Replace(cmd.CommandPath(), " ", "-", -1) + ".md"
+	filename := filepath.Join(dir, basename)
+	f, err := os.Create(filename)
+	checkErr(err)
+	defer f.Close()
+	generateMarkdown(cmd, f)
+}
+
+func generateMarkdown(cmd *cobra.Command, w io.Writer) {
+	cmd.InitDefaultHelpCmd()
+	cmd.InitDefaultHelpFlag()
+
+	buf := new(bytes.Buffer)
+	name := cmd.CommandPath()
+
+	short := cmd.Short
+	long := cmd.Long
+	if len(long) == 0 {
+		long = short
+	}
+
+	buf.WriteString("---\ndescription: " + short + "\n---\n\n")
+	buf.WriteString("# " + name + "\n\n")
+	buf.WriteString("## Synopsis\n\n")
+	buf.WriteString(long + "\n\n")
+
+	if cmd.Runnable() {
+		buf.WriteString(fmt.Sprintf("```\n%s\n```\n\n", cmd.UseLine()))
+	}
+
+	if len(cmd.Example) > 0 {
+		buf.WriteString("## Examples\n\n")
+		buf.WriteString(fmt.Sprintf("```\n%s\n```\n\n", cmd.Example))
+	}
+
+	printOptions(buf, cmd, name)
+	_, err := buf.WriteTo(w)
+	checkErr(err)
+}
+
+func printOptions(buf *bytes.Buffer, cmd *cobra.Command, name string) {
+	flags := cmd.NonInheritedFlags()
+	flags.SetOutput(buf)
+	if flags.HasAvailableFlags() {
+		buf.WriteString("## Options\n\n```\n")
+		flags.PrintDefaults()
+		buf.WriteString("```\n\n")
+	}
+
+	parentFlags := cmd.InheritedFlags()
+	parentFlags.SetOutput(buf)
+	if parentFlags.HasAvailableFlags() {
+		buf.WriteString("### Inherited\n\n```\n")
+		parentFlags.PrintDefaults()
+		buf.WriteString("```\n")
+	}
+}

cmd/import.go

@@ -0,0 +1,30 @@
+package cmd
+
+import (
+	"github.com/filebrowser/filebrowser/v2/storage/bolt/importer"
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	rootCmd.AddCommand(importCmd)
+
+	importCmd.Flags().String("old.database", "", "")
+	importCmd.Flags().String("old.config", "", "")
+	importCmd.MarkFlagRequired("old.database")
+}
+
+var importCmd = &cobra.Command{
+	Use:   "import",
+	Short: "Imports an old configuration",
+	Long:  `Imports an old configuration. This command DOES NOT
+import share links because they are incompatible with
+this version.`,
+	Args:  cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		oldDB := mustGetString(cmd, "old.database")
+		oldConf := mustGetString(cmd, "old.config")
+
+		err := importer.Import(oldDB, oldConf, databasePath)
+		checkErr(err)
+	},
+}

cmd/root.go

@@ -0,0 +1,203 @@
+package cmd
+
+import (
+	"crypto/rand"
+	"crypto/tls"
+	"errors"
+	"io/ioutil"
+	"log"
+	"net"
+	"net/http"
+	"os"
+	"strconv"
+
+	"github.com/asdine/storm"
+	"github.com/filebrowser/filebrowser/v2/auth"
+	"github.com/filebrowser/filebrowser/v2/settings"
+	"github.com/filebrowser/filebrowser/v2/storage"
+	"github.com/filebrowser/filebrowser/v2/users"
+
+	fbhttp "github.com/filebrowser/filebrowser/v2/http"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+	lumberjack "gopkg.in/natefinch/lumberjack.v2"
+)
+
+var (
+	databasePath string
+)
+
+func init() {
+	rootCmd.PersistentFlags().StringVarP(&databasePath, "database", "d", "./filebrowser.db", "path to the database")
+
+	rootCmd.Flags().StringP("address", "a", "", "address to listen on (default comes from database)")
+	rootCmd.Flags().StringP("log", "l", "", "log output (default comes from database)")
+	rootCmd.Flags().IntP("port", "p", 0, "port to listen on (default comes from database)")
+	rootCmd.Flags().StringP("cert", "c", "", "tls certificate (default comes from database)")
+	rootCmd.Flags().StringP("key", "k", "", "tls key (default comes from database)")
+	rootCmd.Flags().StringP("scope", "s", "", "scope for users")
+}
+
+var rootCmd = &cobra.Command{
+	Use:   "filebrowser",
+	Short: "A stylish web-based file browser",
+	Long: `File Browser CLI lets you create the database to use with File Browser,
+manage your user and all the configurations without accessing the
+web interface.
+
+If you've never run File Browser, you will need to create the database.
+See 'filebrowser help config init' for more information.
+
+This command is used to start up the server. By default it starts listening
+on localhost on a random port unless specified otherwise in the database or
+via flags.
+
+Use the available flags to override the database/default options. These flags
+values won't be persisted to the database. To persist configuration to the database
+use the command 'filebrowser config set'.`,
+	Run: func(cmd *cobra.Command, args []string) {
+		if _, err := os.Stat(databasePath); os.IsNotExist(err) {
+			quickSetup(cmd)
+		}
+
+		db := getDB()
+		defer db.Close()
+		st := getStorage(db)
+		startServer(cmd, st)
+	},
+}
+
+func setupLogger(s *settings.Settings) {
+	switch s.Log {
+	case "stdout":
+		log.SetOutput(os.Stdout)
+	case "stderr":
+		log.SetOutput(os.Stderr)
+	case "":
+		log.SetOutput(ioutil.Discard)
+	default:
+		log.SetOutput(&lumberjack.Logger{
+			Filename:   s.Log,
+			MaxSize:    100,
+			MaxAge:     14,
+			MaxBackups: 10,
+		})
+	}
+}
+
+func serverVisitAndReplace(cmd *cobra.Command, s *settings.Settings) {
+	cmd.Flags().Visit(func(flag *pflag.Flag) {
+		switch flag.Name {
+		case "log":
+			s.Log = mustGetString(cmd, flag.Name)
+		case "address":
+			s.Server.Address = mustGetString(cmd, flag.Name)
+		case "port":
+			s.Server.Port = mustGetInt(cmd, flag.Name)
+		case "cert":
+			s.Server.TLSCert = mustGetString(cmd, flag.Name)
+		case "key":
+			s.Server.TLSKey = mustGetString(cmd, flag.Name)
+		}
+	})
+}
+
+func quickSetup(cmd *cobra.Command) {
+	scope := mustGetString(cmd, "scope")
+	if scope == "" {
+		panic(errors.New("scope flag must be set for quick setup"))
+	}
+
+	db, err := storm.Open(databasePath)
+	checkErr(err)
+	defer db.Close()
+
+	set := &settings.Settings{
+		Key:        generateRandomBytes(64), // 256 bit
+		BaseURL:    "",
+		Log:        "stderr",
+		Signup:     false,
+		AuthMethod: auth.MethodJSONAuth,
+		Server: settings.Server{
+			Port:    0,
+			Address: "127.0.0.1",
+			TLSCert: mustGetString(cmd, "cert"),
+			TLSKey:  mustGetString(cmd, "key"),
+		},
+		Defaults: settings.UserDefaults{
+			Scope:  scope,
+			Locale: "en",
+			Perm: users.Permissions{
+				Admin:    false,
+				Execute:  true,
+				Create:   true,
+				Rename:   true,
+				Modify:   true,
+				Delete:   true,
+				Share:    true,
+				Download: true,
+			},
+		},
+	}
+
+	serverVisitAndReplace(cmd, set)
+	st := getStorage(db)
+
+	err = st.Settings.Save(set)
+	checkErr(err)
+
+	err = st.Auth.Save(&auth.JSONAuth{})
+	checkErr(err)
+
+	password, err := users.HashPwd("admin")
+	checkErr(err)
+
+	user := &users.User{
+		Username:     "admin",
+		Password:     password,
+		LockPassword: false,
+	}
+
+	set.Defaults.Apply(user)
+	user.Perm.Admin = true
+
+	err = st.Users.Save(user)
+	checkErr(err)
+}
+
+func startServer(cmd *cobra.Command, st *storage.Storage) {
+	settings, err := st.Settings.Get()
+	checkErr(err)
+
+	serverVisitAndReplace(cmd, settings)
+	setupLogger(settings)
+
+	handler, err := fbhttp.NewHandler(st)
+	checkErr(err)
+
+	var listener net.Listener
+
+	if settings.Server.TLSKey != "" && settings.Server.TLSCert != "" {
+		cer, err := tls.LoadX509KeyPair(settings.Server.TLSCert, settings.Server.TLSKey)
+		checkErr(err)
+		config := &tls.Config{Certificates: []tls.Certificate{cer}}
+		listener, err = tls.Listen("tcp", settings.Server.Address+":"+strconv.Itoa(settings.Server.Port), config)
+		checkErr(err)
+	} else {
+		listener, err = net.Listen("tcp", settings.Server.Address+":"+strconv.Itoa(settings.Server.Port))
+		checkErr(err)
+	}
+
+	log.Println("Listening on", listener.Addr().String())
+	if err := http.Serve(listener, handler); err != nil {
+		log.Fatal(err)
+	}
+}
+
+func generateRandomBytes(n int) []byte {
+	b := make([]byte, n)
+	_, err := rand.Read(b)
+	checkErr(err)
+	// Note that err == nil only if we read len(b) bytes.
+	return b
+}

cmd/rule_rm.go

@@ -0,0 +1,38 @@
+package cmd
+
+import (
+	"github.com/filebrowser/filebrowser/v2/settings"
+	"github.com/filebrowser/filebrowser/v2/storage"
+	"github.com/filebrowser/filebrowser/v2/users"
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	rulesCmd.AddCommand(rulesRmCommand)
+	rulesRmCommand.Flags().Uint("index", 0, "index of rule to remove")
+	rulesRmCommand.MarkFlagRequired("index")
+}
+
+var rulesRmCommand = &cobra.Command{
+	Use:   "rm",
+	Short: "Remove a global rule or user rule",
+	Long:  `Remove a global rule or user rule.`,
+	Args:  cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		index := mustGetUint(cmd, "index")
+
+		user := func(u *users.User, st *storage.Storage) {
+			u.Rules = append(u.Rules[:index], u.Rules[index+1:]...)
+			err := st.Users.Save(u)
+			checkErr(err)
+		}
+
+		global := func(s *settings.Settings, st *storage.Storage) {
+			s.Rules = append(s.Rules[:index], s.Rules[index+1:]...)
+			err := st.Settings.Save(s)
+			checkErr(err)
+		}
+
+		runRules(cmd, user, global)
+	},
+}

cmd/rules.go

@@ -0,0 +1,91 @@
+package cmd
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/filebrowser/filebrowser/v2/rules"
+	"github.com/filebrowser/filebrowser/v2/settings"
+	"github.com/filebrowser/filebrowser/v2/storage"
+	"github.com/filebrowser/filebrowser/v2/users"
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	rootCmd.AddCommand(rulesCmd)
+	rulesCmd.PersistentFlags().StringP("username", "u", "", "username of user to which the rules apply")
+	rulesCmd.PersistentFlags().UintP("id", "i", 0, "id of user to which the rules apply")
+}
+
+var rulesCmd = &cobra.Command{
+	Use:   "rules",
+	Short: "Rules management utility",
+	Long:  `On each subcommand you'll have available at least two flags:
+"username" and "id". You must either set only one of them
+or none. If you set one of them, the command will apply to
+an user, otherwise it will be applied to the global set or
+rules.`,
+	Args:  cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		cmd.Help()
+		os.Exit(0)
+	},
+}
+
+func runRules(cmd *cobra.Command, users func(*users.User, *storage.Storage), global func(*settings.Settings, *storage.Storage)) {
+	db := getDB()
+	defer db.Close()
+	st := getStorage(db)
+
+	id := getUserIdentifier(cmd)
+	if id != nil {
+		user, err := st.Users.Get(id)
+		checkErr(err)
+
+		if users != nil {
+			users(user, st)
+		}
+
+		printRules(user.Rules, id)
+		return
+	}
+
+	settings, err := st.Settings.Get()
+	checkErr(err)
+
+	if global != nil {
+		global(settings, st)
+	}
+
+	printRules(settings.Rules, id)
+}
+
+func getUserIdentifier(cmd *cobra.Command) interface{} {
+	id := mustGetUint(cmd, "id")
+	username := mustGetString(cmd, "username")
+
+	if id != 0 {
+		return id
+	} else if username != "" {
+		return username
+	}
+
+	return nil
+}
+
+func printRules(rules []rules.Rule, id interface{}) {
+	if id == nil {
+		fmt.Printf("Global Rules:\n\n")
+	} else {
+		fmt.Printf("Rules for user %v:\n\n", id)
+	}
+
+	for id, rule := range rules {
+		fmt.Printf("(%d) ", id)
+		if rule.Regex {
+			fmt.Printf("Allow: %t\tRegex: %s\n", rule.Allow, rule.Regexp.Raw)
+		} else {
+			fmt.Printf("Allow: %t\tPath: %s\n", rule.Allow, rule.Path)
+		}
+	}
+}

cmd/rules_add.go

@@ -0,0 +1,67 @@
+package cmd
+
+import (
+	"errors"
+	"regexp"
+
+	"github.com/filebrowser/filebrowser/v2/rules"
+	"github.com/filebrowser/filebrowser/v2/settings"
+	"github.com/filebrowser/filebrowser/v2/storage"
+	"github.com/filebrowser/filebrowser/v2/users"
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	rulesCmd.AddCommand(rulesAddCmd)
+	rulesAddCmd.Flags().BoolP("allow", "a", false, "allow rule instead of disallow")
+	rulesAddCmd.Flags().StringP("path", "p", "", "path to which the rule applies")
+	rulesAddCmd.Flags().StringP("regex", "r", "", "regex to which the rule applies")
+}
+
+var rulesAddCmd = &cobra.Command{
+	Use:   "add",
+	Short: "Add a global rule or user rule",
+	Long: `Add a global rule or user rule. You must
+set either path or regex.`,
+	Args: cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		allow := mustGetBool(cmd, "allow")
+		path := mustGetString(cmd, "path")
+		regex := mustGetString(cmd, "regex")
+
+		if path == "" && regex == "" {
+			panic(errors.New("you must set either --path or --regex flags"))
+		}
+
+		if path != "" && regex != "" {
+			panic(errors.New("you can't set --path and --regex flags at the same time"))
+		}
+
+		if regex != "" {
+			regexp.MustCompile(regex)
+		}
+
+		rule := rules.Rule{
+			Allow: allow,
+			Path:  path,
+			Regex: regex != "",
+			Regexp: &rules.Regexp{
+				Raw: regex,
+			},
+		}
+
+		user := func(u *users.User, st *storage.Storage) {
+			u.Rules = append(u.Rules, rule)
+			err := st.Users.Save(u)
+			checkErr(err)
+		}
+
+		global := func(s *settings.Settings, st *storage.Storage) {
+			s.Rules = append(s.Rules, rule)
+			err := st.Settings.Save(s)
+			checkErr(err)
+		}
+
+		runRules(cmd, user, global)
+	},
+}

cmd/rules_ls.go

@@ -0,0 +1,19 @@
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	rulesCmd.AddCommand(rulesLsCommand)
+}
+
+var rulesLsCommand = &cobra.Command{
+	Use:   "ls",
+	Short: "List global rules or user specific rules",
+	Long:  `List global rules or user specific rules.`,
+	Args:  cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		runRules(cmd, nil, nil)
+	},
+}

cmd/users.go

@@ -0,0 +1,134 @@
+package cmd
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"text/tabwriter"
+
+	"github.com/filebrowser/filebrowser/v2/settings"
+	"github.com/filebrowser/filebrowser/v2/users"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+)
+
+func init() {
+	rootCmd.AddCommand(usersCmd)
+}
+
+var usersCmd = &cobra.Command{
+	Use:   "users",
+	Short: "Users management utility",
+	Long:  `Users management utility.`,
+	Args:  cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		cmd.Help()
+		os.Exit(0)
+	},
+}
+
+func printUsers(users []*users.User) {
+	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
+	fmt.Fprintln(w, "ID\tUsername\tScope\tLocale\tV. Mode\tAdmin\tExecute\tCreate\tRename\tModify\tDelete\tShare\tDownload\tPwd Lock")
+
+	for _, user := range users {
+		fmt.Fprintf(w, "%d\t%s\t%s\t%s\t%s\t%t\t%t\t%t\t%t\t%t\t%t\t%t\t%t\t%t\t\n",
+			user.ID,
+			user.Username,
+			user.Scope,
+			user.Locale,
+			user.ViewMode,
+			user.Perm.Admin,
+			user.Perm.Execute,
+			user.Perm.Create,
+			user.Perm.Rename,
+			user.Perm.Modify,
+			user.Perm.Delete,
+			user.Perm.Share,
+			user.Perm.Download,
+			user.LockPassword,
+		)
+	}
+
+	w.Flush()
+}
+
+func usernameOrIDRequired(cmd *cobra.Command, args []string) error {
+	username, _ := cmd.Flags().GetString("username")
+	id, _ := cmd.Flags().GetUint("id")
+
+	if username == "" && id == 0 {
+		return errors.New("'username' of 'id' flag required")
+	}
+
+	return nil
+}
+
+func addUserFlags(cmd *cobra.Command) {
+	cmd.Flags().Bool("perm.admin", false, "admin perm for users")
+	cmd.Flags().Bool("perm.execute", true, "execute perm for users")
+	cmd.Flags().Bool("perm.create", true, "create perm for users")
+	cmd.Flags().Bool("perm.rename", true, "rename perm for users")
+	cmd.Flags().Bool("perm.modify", true, "modify perm for users")
+	cmd.Flags().Bool("perm.delete", true, "delete perm for users")
+	cmd.Flags().Bool("perm.share", true, "share perm for users")
+	cmd.Flags().Bool("perm.download", true, "download perm for users")
+	cmd.Flags().String("sorting.by", "name", "sorting mode (name, size or modified)")
+	cmd.Flags().Bool("sorting.asc", false, "sorting by ascending order")
+	cmd.Flags().Bool("lockPassword", false, "lock password")
+	cmd.Flags().StringSlice("commands", nil, "a list of the commands a user can execute")
+	cmd.Flags().String("scope", "", "scope for users")
+	cmd.Flags().String("locale", "en", "locale for users")
+	cmd.Flags().String("viewMode", string(users.ListViewMode), "view mode for users")
+}
+
+func getViewMode(cmd *cobra.Command) users.ViewMode {
+	viewMode := users.ViewMode(mustGetString(cmd, "viewMode"))
+	if viewMode != users.ListViewMode && viewMode != users.MosaicViewMode {
+		checkErr(errors.New("view mode must be \"" + string(users.ListViewMode) + "\" or \"" + string(users.MosaicViewMode) + "\""))
+	}
+	return viewMode
+}
+
+func getUserDefaults(cmd *cobra.Command, defaults *settings.UserDefaults, all bool) {
+	visit := func(flag *pflag.Flag) {
+		switch flag.Name {
+		case "scope":
+			defaults.Scope = mustGetString(cmd, "scope")
+		case "locale":
+			defaults.Locale = mustGetString(cmd, "locale")
+		case "viewMode":
+			defaults.ViewMode = getViewMode(cmd)
+		case "perm.admin":
+			defaults.Perm.Admin = mustGetBool(cmd, "perm.admin")
+		case "perm.execute":
+			defaults.Perm.Execute = mustGetBool(cmd, "perm.execute")
+		case "perm.create":
+			defaults.Perm.Create = mustGetBool(cmd, "perm.create")
+		case "perm.rename":
+			defaults.Perm.Rename = mustGetBool(cmd, "perm.rename")
+		case "perm.modify":
+			defaults.Perm.Modify = mustGetBool(cmd, "perm.modify")
+		case "perm.delete":
+			defaults.Perm.Delete = mustGetBool(cmd, "perm.delete")
+		case "perm.share":
+			defaults.Perm.Share = mustGetBool(cmd, "perm.share")
+		case "perm.download":
+			defaults.Perm.Download = mustGetBool(cmd, "perm.download")
+		case "commands":
+			commands, err := cmd.Flags().GetStringSlice("commands")
+			checkErr(err)
+			defaults.Commands = commands
+		case "sorting.by":
+			defaults.Sorting.By = mustGetString(cmd, "sorting.by")
+		case "sorting.asc":
+			defaults.Sorting.Asc = mustGetBool(cmd, "sorting.asc")
+		}
+	}
+
+	if all {
+		cmd.Flags().VisitAll(visit)
+	} else {
+		cmd.Flags().Visit(visit)
+	}
+}

cmd/users_find.go

@@ -0,0 +1,57 @@
+package cmd
+
+import (
+	"github.com/filebrowser/filebrowser/v2/users"
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	usersCmd.AddCommand(usersFindCmd)
+	usersCmd.AddCommand(usersLsCmd)
+	usersFindCmd.Flags().StringP("username", "u", "", "username to find")
+	usersFindCmd.Flags().UintP("id", "i", 0, "id to find")
+}
+
+var usersFindCmd = &cobra.Command{
+	Use:   "find",
+	Short: "Find a user by username or id",
+	Long:  `Find a user by username or id. If no flag is set, all users will be printed.`,
+	Args:  cobra.NoArgs,
+	Run:   findUsers,
+}
+
+var usersLsCmd = &cobra.Command{
+	Use:   "ls",
+	Short: "List all users.",
+	Args:  cobra.NoArgs,
+	Run:   findUsers,
+}
+
+var findUsers = func(cmd *cobra.Command, args []string) {
+	db := getDB()
+	defer db.Close()
+	st := getStorage(db)
+
+	username, _ := cmd.Flags().GetString("username")
+	id, _ := cmd.Flags().GetUint("id")
+
+	var err error
+	var list []*users.User
+	var user *users.User
+
+	if username != "" {
+		user, err = st.Users.Get(username)
+	} else if id != 0 {
+		user, err = st.Users.Get(id)
+	} else {
+		list, err = st.Users.Gets()
+	}
+
+	checkErr(err)
+
+	if user != nil {
+		list = []*users.User{user}
+	}
+
+	printUsers(list)
+}

cmd/users_new.go

@@ -0,0 +1,47 @@
+package cmd
+
+import (
+	"github.com/filebrowser/filebrowser/v2/users"
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	usersCmd.AddCommand(usersNewCmd)
+
+	addUserFlags(usersNewCmd)
+	usersNewCmd.Flags().StringP("username", "u", "", "new users's username")
+	usersNewCmd.Flags().StringP("password", "p", "", "new user's password")
+	usersNewCmd.MarkFlagRequired("username")
+	usersNewCmd.MarkFlagRequired("password")
+}
+
+var usersNewCmd = &cobra.Command{
+	Use:   "new",
+	Short: "Create a new user",
+	Long:  `Create a new user and add it to the database.`,
+	Args:  cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		db := getDB()
+		defer db.Close()
+		st := getStorage(db)
+
+		s, err := st.Settings.Get()
+		checkErr(err)
+		getUserDefaults(cmd, &s.Defaults, false)
+
+		password, _ := cmd.Flags().GetString("password")
+		password, err = users.HashPwd(password)
+		checkErr(err)
+
+		user := &users.User{
+			Username:     mustGetString(cmd, "username"),
+			Password:     password,
+			LockPassword: mustGetBool(cmd, "lockPassword"),
+		}
+
+		s.Defaults.Apply(user)
+		err = st.Users.Save(user)
+		checkErr(err)
+		printUsers([]*users.User{user})
+	},
+}

cmd/users_rm.go

@@ -0,0 +1,39 @@
+package cmd
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	usersCmd.AddCommand(usersRmCmd)
+	usersRmCmd.Flags().StringP("username", "u", "", "username to delete")
+	usersRmCmd.Flags().UintP("id", "i", 0, "id to delete")
+}
+
+var usersRmCmd = &cobra.Command{
+	Use:   "rm",
+	Short: "Delete a user by username or id",
+	Long:  `Delete a user by username or id`,
+	Args:  usernameOrIDRequired,
+	Run: func(cmd *cobra.Command, args []string) {
+		db := getDB()
+		defer db.Close()
+		st := getStorage(db)
+
+		username, _ := cmd.Flags().GetString("username")
+		id, _ := cmd.Flags().GetUint("id")
+
+		var err error
+
+		if username != "" {
+			err = st.Users.Delete(username)
+		} else {
+			err = st.Users.Delete(id)
+		}
+
+		checkErr(err)
+		fmt.Println("user deleted successfully")
+	},
+}

cmd/users_update.go

@@ -0,0 +1,74 @@
+package cmd
+
+import (
+	"github.com/filebrowser/filebrowser/v2/settings"
+	"github.com/filebrowser/filebrowser/v2/users"
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	usersCmd.AddCommand(usersUpdateCmd)
+
+	usersUpdateCmd.Flags().UintP("id", "i", 0, "id of the user")
+	usersUpdateCmd.Flags().StringP("username", "u", "", "user to change or new username if flag 'id' is set")
+	usersUpdateCmd.Flags().StringP("password", "p", "", "new password")
+	addUserFlags(usersUpdateCmd)
+}
+
+var usersUpdateCmd = &cobra.Command{
+	Use:   "update",
+	Short: "Updates an existing user",
+	Long: `Updates an existing user. Set the flags for the
+options you want to change.`,
+	Args: usernameOrIDRequired,
+	Run: func(cmd *cobra.Command, args []string) {
+		db := getDB()
+		defer db.Close()
+		st := getStorage(db)
+
+		id, _ := cmd.Flags().GetUint("id")
+		username := mustGetString(cmd, "username")
+		password := mustGetString(cmd, "password")
+
+		var user *users.User
+		var err error
+
+		if id != 0 {
+			user, err = st.Users.Get(id)
+		} else {
+			user, err = st.Users.Get(username)
+		}
+
+		checkErr(err)
+
+		defaults := settings.UserDefaults{
+			Scope:    user.Scope,
+			Locale:   user.Locale,
+			ViewMode: user.ViewMode,
+			Perm:     user.Perm,
+			Sorting:  user.Sorting,
+			Commands: user.Commands,
+		}
+		getUserDefaults(cmd, &defaults, false)
+		user.Scope = defaults.Scope
+		user.Locale = defaults.Locale
+		user.ViewMode = defaults.ViewMode
+		user.Perm = defaults.Perm
+		user.Commands = defaults.Commands
+		user.Sorting = defaults.Sorting
+		user.LockPassword = mustGetBool(cmd, "lockPassword")
+
+		if user.Username != username && username != "" {
+			user.Username = username
+		}
+
+		if password != "" {
+			user.Password, err = users.HashPwd(password)
+			checkErr(err)
+		}
+
+		err = st.Users.Update(user)
+		checkErr(err)
+		printUsers([]*users.User{user})
+	},
+}

cmd/utils.go

@@ -0,0 +1,55 @@
+package cmd
+
+import (
+	"errors"
+	"os"
+
+	"github.com/asdine/storm"
+	"github.com/filebrowser/filebrowser/v2/storage"
+	"github.com/filebrowser/filebrowser/v2/storage/bolt"
+	"github.com/spf13/cobra"
+)
+
+func checkErr(err error) {
+	if err != nil {
+		panic(err)
+	}
+}
+
+func mustGetString(cmd *cobra.Command, flag string) string {
+	s, err := cmd.Flags().GetString(flag)
+	checkErr(err)
+	return s
+}
+
+func mustGetBool(cmd *cobra.Command, flag string) bool {
+	b, err := cmd.Flags().GetBool(flag)
+	checkErr(err)
+	return b
+}
+
+func mustGetInt(cmd *cobra.Command, flag string) int {
+	b, err := cmd.Flags().GetInt(flag)
+	checkErr(err)
+	return b
+}
+
+func mustGetUint(cmd *cobra.Command, flag string) uint {
+	b, err := cmd.Flags().GetUint(flag)
+	checkErr(err)
+	return b
+}
+
+func getDB() *storm.DB {
+	if _, err := os.Stat(databasePath); err != nil {
+		panic(errors.New(databasePath + " does not exist. Please run 'filebrowser init' first."))
+	}
+
+	db, err := storm.Open(databasePath)
+	checkErr(err)
+	return db
+}
+
+func getStorage(db *storm.DB) *storage.Storage {
+	return bolt.NewStorage(db)
+}

cmd/version.go

@@ -0,0 +1,20 @@
+package cmd
+
+import (
+	"fmt"
+
+	"github.com/filebrowser/filebrowser/v2/version"
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	rootCmd.AddCommand(versionCmd)
+}
+
+var versionCmd = &cobra.Command{
+	Use:   "version",
+	Short: "Print the version number",
+	Run: func(cmd *cobra.Command, args []string) {
+		fmt.Println("File Browser Version " + version.Version)
+	},
+}

docker-entrypoint.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1" = 'run' ]; then
+  if [ ! -f "/database.db" ]; then
+    filebrowser -s /src
+  fi
+
+  exec filemanager --port 80
+fi
+
+exec filemanager --port 80 "$@"

errors/errors.go

@@ -0,0 +1,17 @@
+package errors
+
+import "errors"
+
+var (
+	ErrEmptyKey          = errors.New("empty key")
+	ErrExist             = errors.New("the resource already exists")
+	ErrNotExist          = errors.New("the resource does not exist")
+	ErrEmptyPassword     = errors.New("password is empty")
+	ErrEmptyUsername     = errors.New("username is empty")
+	ErrEmptyRequest      = errors.New("empty request")
+	ErrScopeIsRelative   = errors.New("scope is a relative path")
+	ErrInvalidDataType   = errors.New("invalid data type")
+	ErrIsDirectory       = errors.New("file is directory")
+	ErrInvalidOption     = errors.New("invalid option")
+	ErrInvalidAuthMethod = errors.New("invalid auth method")
+)

files/file.go

@@ -0,0 +1,252 @@
+package files
+
+import (
+	"crypto/md5"
+	"crypto/sha1"
+	"crypto/sha256"
+	"crypto/sha512"
+	"encoding/hex"
+	"hash"
+	"io"
+	"mime"
+	"net/http"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/filebrowser/filebrowser/v2/errors"
+	"github.com/filebrowser/filebrowser/v2/rules"
+	"github.com/spf13/afero"
+)
+
+// FileInfo describes a file.
+type FileInfo struct {
+	*Listing
+	Fs        afero.Fs          `json:"-"`
+	Path      string            `json:"path"`
+	Name      string            `json:"name"`
+	Size      int64             `json:"size"`
+	Extension string            `json:"extension"`
+	ModTime   time.Time         `json:"modified"`
+	Mode      os.FileMode       `json:"mode"`
+	IsDir     bool              `json:"isDir"`
+	Type      string            `json:"type"`
+	Subtitles []string          `json:"subtitles,omitempty"`
+	Content   string            `json:"content,omitempty"`
+	Checksums map[string]string `json:"checksums,omitempty"`
+}
+
+// FileOptions are the options when getting a file info.
+type FileOptions struct {
+	Fs      afero.Fs
+	Path    string
+	Modify  bool
+	Expand  bool
+	Checker rules.Checker
+}
+
+// NewFileInfo creates a File object from a path and a given user. This File
+// object will be automatically filled depending on if it is a directory
+// or a file. If it's a video file, it will also detect any subtitles.
+func NewFileInfo(opts FileOptions) (*FileInfo, error) {
+	if !opts.Checker.Check(opts.Path) {
+		return nil, os.ErrPermission
+	}
+
+	info, err := opts.Fs.Stat(opts.Path)
+	if err != nil {
+		return nil, err
+	}
+
+	file := &FileInfo{
+		Fs:        opts.Fs,
+		Path:      opts.Path,
+		Name:      info.Name(),
+		ModTime:   info.ModTime(),
+		Mode:      info.Mode(),
+		IsDir:     info.IsDir(),
+		Size:      info.Size(),
+		Extension: filepath.Ext(info.Name()),
+	}
+
+	if opts.Expand {
+		if file.IsDir {
+			return file, file.readListing(opts.Checker)
+		}
+
+		err = file.detectType(opts.Modify)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return file, err
+}
+
+// Checksum checksums a given File for a given User, using a specific
+// algorithm. The checksums data is saved on File object.
+func (i *FileInfo) Checksum(algo string) error {
+	if i.IsDir {
+		return errors.ErrIsDirectory
+	}
+
+	if i.Checksums == nil {
+		i.Checksums = map[string]string{}
+	}
+
+	reader, err := i.Fs.Open(i.Path)
+	if err != nil {
+		return err
+	}
+	defer reader.Close()
+
+	var h hash.Hash
+
+	switch algo {
+	case "md5":
+		h = md5.New()
+	case "sha1":
+		h = sha1.New()
+	case "sha256":
+		h = sha256.New()
+	case "sha512":
+		h = sha512.New()
+	default:
+		return errors.ErrInvalidOption
+	}
+
+	_, err = io.Copy(h, reader)
+	if err != nil {
+		return err
+	}
+
+	i.Checksums[algo] = hex.EncodeToString(h.Sum(nil))
+	return nil
+}
+
+func (i *FileInfo) detectType(modify bool) error {
+	reader, err := i.Fs.Open(i.Path)
+	if err != nil {
+		return err
+	}
+	defer reader.Close()
+
+	buffer := make([]byte, 512)
+	n, err := reader.Read(buffer)
+	if err != nil && err != io.EOF {
+		return err
+	}
+
+	mimetype := mime.TypeByExtension(i.Extension)
+	if mimetype == "" {
+		mimetype = http.DetectContentType(buffer[:n])
+	}
+
+	switch {
+	case strings.HasPrefix(mimetype, "video"):
+		i.Type = "video"
+		i.detectSubtitles()
+		return nil
+	case strings.HasPrefix(mimetype, "audio"):
+		i.Type = "audio"
+		return nil
+	case strings.HasPrefix(mimetype, "image"):
+		i.Type = "image"
+		return nil
+	case isBinary(string(buffer[:n])) || i.Size > 10*1024*1024: // 10 MB
+		i.Type = "blob"
+		return nil
+	default:
+		i.Type = "text"
+		afs := &afero.Afero{Fs: i.Fs}
+		content, err := afs.ReadFile(i.Path)
+		if err != nil {
+			return err
+		}
+
+		if !modify {
+			i.Type = "textImmutable"
+		}
+
+		i.Content = string(content)
+	}
+
+	return nil
+}
+
+func (i *FileInfo) detectSubtitles() {
+	if i.Type != "video" {
+		return
+	}
+
+	i.Subtitles = []string{}
+	ext := filepath.Ext(i.Path)
+
+	// TODO: detect multiple languages. Base.Lang.vtt
+
+	path := strings.TrimSuffix(i.Path, ext) + ".vtt"
+	if _, err := i.Fs.Stat(path); err == nil {
+		i.Subtitles = append(i.Subtitles, path)
+	}
+}
+
+func (i *FileInfo) readListing(checker rules.Checker) error {
+	afs := &afero.Afero{Fs: i.Fs}
+	dir, err := afs.ReadDir(i.Path)
+	if err != nil {
+		return err
+	}
+
+	listing := &Listing{
+		Items:    []*FileInfo{},
+		NumDirs:  0,
+		NumFiles: 0,
+	}
+
+	for _, f := range dir {
+		name := f.Name()
+		path := path.Join(i.Path, name)
+
+		if !checker.Check(path) {
+			continue
+		}
+
+		if strings.HasPrefix(f.Mode().String(), "L") {
+			// It's a symbolic link. We try to follow it. If it doesn't work,
+			// we stay with the link information instead if the target's.
+			info, err := i.Fs.Stat(path)
+			if err == nil {
+				f = info
+			}
+		}
+
+		file := &FileInfo{
+			Fs:        i.Fs,
+			Name:      name,
+			Size:      f.Size(),
+			ModTime:   f.ModTime(),
+			Mode:      f.Mode(),
+			IsDir:     f.IsDir(),
+			Extension: filepath.Ext(name),
+			Path:      path,
+		}
+
+		if file.IsDir {
+			listing.NumDirs++
+		} else {
+			listing.NumFiles++
+
+			err := file.detectType(true)
+			if err != nil {
+				return err
+			}
+		}
+
+		listing.Items = append(listing.Items, file)
+	}
+
+	i.Listing = listing
+	return nil
+}

files/listing.go

@@ -0,0 +1,107 @@
+package files
+
+import (
+	"sort"
+
+	"github.com/maruel/natural"
+)
+
+// Listing is a collection of files.
+type Listing struct {
+	Items    []*FileInfo `json:"items"`
+	NumDirs  int         `json:"numDirs"`
+	NumFiles int         `json:"numFiles"`
+	Sorting  Sorting     `json:"sorting"`
+}
+
+// ApplySort applies the sort order using .Order and .Sort
+func (l Listing) ApplySort() {
+	// Check '.Order' to know how to sort
+	if !l.Sorting.Asc {
+		switch l.Sorting.By {
+		case "name":
+			sort.Sort(sort.Reverse(byName(l)))
+		case "size":
+			sort.Sort(sort.Reverse(bySize(l)))
+		case "modified":
+			sort.Sort(sort.Reverse(byModified(l)))
+		default:
+			// If not one of the above, do nothing
+			return
+		}
+	} else { // If we had more Orderings we could add them here
+		switch l.Sorting.By {
+		case "name":
+			sort.Sort(byName(l))
+		case "size":
+			sort.Sort(bySize(l))
+		case "modified":
+			sort.Sort(byModified(l))
+		default:
+			sort.Sort(byName(l))
+			return
+		}
+	}
+}
+
+// Implement sorting for Listing
+type byName Listing
+type bySize Listing
+type byModified Listing
+
+// By Name
+func (l byName) Len() int {
+	return len(l.Items)
+}
+
+func (l byName) Swap(i, j int) {
+	l.Items[i], l.Items[j] = l.Items[j], l.Items[i]
+}
+
+// Treat upper and lower case equally
+func (l byName) Less(i, j int) bool {
+	if l.Items[i].IsDir && !l.Items[j].IsDir {
+		return true
+	}
+
+	if !l.Items[i].IsDir && l.Items[j].IsDir {
+		return false
+	}
+
+	return natural.Less(l.Items[i].Name, l.Items[j].Name)
+}
+
+// By Size
+func (l bySize) Len() int {
+	return len(l.Items)
+}
+
+func (l bySize) Swap(i, j int) {
+	l.Items[i], l.Items[j] = l.Items[j], l.Items[i]
+}
+
+const directoryOffset = -1 << 31 // = math.MinInt32
+func (l bySize) Less(i, j int) bool {
+	iSize, jSize := l.Items[i].Size, l.Items[j].Size
+	if l.Items[i].IsDir {
+		iSize = directoryOffset + iSize
+	}
+	if l.Items[j].IsDir {
+		jSize = directoryOffset + jSize
+	}
+	return iSize < jSize
+}
+
+// By Modified
+func (l byModified) Len() int {
+	return len(l.Items)
+}
+
+func (l byModified) Swap(i, j int) {
+	l.Items[i], l.Items[j] = l.Items[j], l.Items[i]
+}
+
+func (l byModified) Less(i, j int) bool {
+	iModified, jModified := l.Items[i].ModTime, l.Items[j].ModTime
+	return iModified.Sub(jModified) < 0
+}

files/sorting.go

@@ -0,0 +1,7 @@
+package files
+
+// Sorting contains a sorting order.
+type Sorting struct {
+	By  string `json:"by"`
+	Asc bool   `json:"asc"`
+}

files/utils.go

@@ -0,0 +1,12 @@
+package files
+
+func isBinary(content string) bool {
+	for _, b := range content {
+		// 65533 is the unknown char
+		// 8 and below are control chars (e.g. backspace, null, eof, etc)
+		if b <= 8 || b == 65533 {
+			return true
+		}
+	}
+	return false
+}

fileutils/copy.go

@@ -0,0 +1,39 @@
+package fileutils
+
+import (
+	"os"
+	"path"
+
+	"github.com/spf13/afero"
+)
+
+// Copy copies a file or folder from one place to another.
+func Copy(fs afero.Fs, src, dst string) error {
+	if src = path.Clean("/" + src); src == "" {
+		return os.ErrNotExist
+	}
+
+	if dst = path.Clean("/" + dst); dst == "" {
+		return os.ErrNotExist
+	}
+
+	if src == "/" || dst == "/" {
+		// Prohibit copying from or to the virtual root directory.
+		return os.ErrInvalid
+	}
+
+	if dst == src {
+		return os.ErrInvalid
+	}
+
+	info, err := fs.Stat(src)
+	if err != nil {
+		return err
+	}
+
+	if info.IsDir() {
+		return CopyDir(fs, src, dst)
+	}
+
+	return CopyFile(fs, src, dst)
+}

fileutils/dir.go

@@ -0,0 +1,62 @@
+package fileutils
+
+import (
+	"errors"
+
+	"github.com/spf13/afero"
+)
+
+// CopyDir copies a directory from source to dest and all
+// of its sub-directories. It doesn't stop if it finds an error
+// during the copy. Returns an error if any.
+func CopyDir(fs afero.Fs, source string, dest string) error {
+	// Get properties of source.
+	srcinfo, err := fs.Stat(source)
+	if err != nil {
+		return err
+	}
+
+	// Create the destination directory.
+	err = fs.MkdirAll(dest, srcinfo.Mode())
+	if err != nil {
+		return err
+	}
+
+	dir, _ := fs.Open(source)
+	obs, err := dir.Readdir(-1)
+	if err != nil {
+		return err
+	}
+
+	var errs []error
+
+	for _, obj := range obs {
+		fsource := source + "/" + obj.Name()
+		fdest := dest + "/" + obj.Name()
+
+		if obj.IsDir() {
+			// Create sub-directories, recursively.
+			err = CopyDir(fs, fsource, fdest)
+			if err != nil {
+				errs = append(errs, err)
+			}
+		} else {
+			// Perform the file copy.
+			err = CopyFile(fs, fsource, fdest)
+			if err != nil {
+				errs = append(errs, err)
+			}
+		}
+	}
+
+	var errString string
+	for _, err := range errs {
+		errString += err.Error() + "\n"
+	}
+
+	if errString != "" {
+		return errors.New(errString)
+	}
+
+	return nil
+}

fileutils/file.go

@@ -0,0 +1,51 @@
+package fileutils
+
+import (
+	"io"
+	"path/filepath"
+
+	"github.com/spf13/afero"
+)
+
+// CopyFile copies a file from source to dest and returns
+// an error if any.
+func CopyFile(fs afero.Fs, source string, dest string) error {
+	// Open the source file.
+	src, err := fs.Open(source)
+	if err != nil {
+		return err
+	}
+	defer src.Close()
+
+	// Makes the directory needed to create the dst
+	// file.
+	err = fs.MkdirAll(filepath.Dir(dest), 0666)
+	if err != nil {
+		return err
+	}
+
+	// Create the destination file.
+	dst, err := fs.Create(dest)
+	if err != nil {
+		return err
+	}
+	defer dst.Close()
+
+	// Copy the contents of the file.
+	_, err = io.Copy(dst, src)
+	if err != nil {
+		return err
+	}
+
+	// Copy the mode if the user can't
+	// open the file.
+	info, err := fs.Stat(source)
+	if err != nil {
+		err = fs.Chmod(dest, info.Mode())
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}

frontend

@@ -1 +1 @@
-Subproject commit 2642333928b21dd76c5bfb2457a19502d73d6475
+Subproject commit 95fc3dfdfbe21b1d55538add66bf0d5f38197320

go.mod

@@ -1,36 +1,47 @@
-module github.com/filebrowser/filebrowser
+module github.com/filebrowser/filebrowser/v2
 
 require (
+	github.com/BurntSushi/toml v0.3.1 // indirect
+	github.com/DataDog/zstd v1.3.4 // indirect
 	github.com/GeertJohan/go.rice v0.0.0-20170420135705-c02ca9a983da
-	github.com/Sereal/Sereal v0.0.0-20181211220259-509a78ddbda3 // indirect
+	github.com/Sereal/Sereal v0.0.0-20180905114147-563b78806e28 // indirect
 	github.com/asdine/storm v2.1.2+incompatible
 	github.com/boltdb/bolt v1.3.1 // indirect
 	github.com/daaku/go.zipexe v0.0.0-20150329023125-a5fe2436ffcb // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dgrijalva/jwt-go v3.2.0+incompatible
 	github.com/dsnet/compress v0.0.0-20171208185109-cc9eb1d7ad76 // indirect
 	github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568 // indirect
-	github.com/gohugoio/hugo v0.49.2
-	github.com/golang/protobuf v1.2.0 // indirect
 	github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db // indirect
 	github.com/google/uuid v1.1.0 // indirect
+	github.com/gorilla/context v1.1.1 // indirect
+	github.com/gorilla/mux v1.6.2
 	github.com/gorilla/websocket v1.4.0
-	github.com/hacdias/fileutils v0.0.0-20181202104838-227b317161a1
-	github.com/hacdias/varutils v0.0.0-20171121224303-82d3b57f667a
+	github.com/hacdias/fileutils v0.0.0-20171121222743-76b1c6ab9067
+	github.com/inconshreveable/mousetrap v1.0.0 // indirect
 	github.com/kardianos/osext v0.0.0-20170510131534-ae77be60afb1 // indirect
+	github.com/kr/pretty v0.1.0 // indirect
 	github.com/maruel/natural v0.0.0-20180416170133-dbcb3e2e8cf1
-	github.com/mholt/archiver v2.1.0+incompatible
+	github.com/mholt/archiver v3.1.0+incompatible
 	github.com/mholt/caddy v0.11.1
-	github.com/mitchellh/go-homedir v1.0.0
-	github.com/mitchellh/mapstructure v1.1.2
 	github.com/nwaples/rardecode v1.0.0 // indirect
+	github.com/pelletier/go-toml v1.2.0
 	github.com/pierrec/lz4 v2.0.5+incompatible // indirect
-	github.com/robfig/cron v0.0.0-20180505203441-b41be1df6967
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/spf13/afero v1.1.2
 	github.com/spf13/cobra v0.0.3
-	github.com/spf13/viper v1.3.1
+	github.com/spf13/pflag v1.0.3
+	github.com/stretchr/testify v1.2.2 // indirect
 	github.com/ulikunitz/xz v0.5.5 // indirect
 	github.com/vmihailenco/msgpack v4.0.1+incompatible // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
-	go.etcd.io/bbolt v1.3.0 // indirect
+	go.etcd.io/bbolt v1.3.0
 	golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9
+	golang.org/x/net v0.0.0-20180906233101-161cd47e91fd // indirect
+	golang.org/x/sync v0.0.0-20181108010431-42b317875d0f // indirect
+	golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a // indirect
+	google.golang.org/appengine v1.3.0 // indirect
+	gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.0.0
+	gopkg.in/yaml.v2 v2.2.2
 )

go.sum

@@ -1,167 +1,96 @@
-github.com/BurntSushi/locker v0.0.0-20171006230638-a6e239ea1c69/go.mod h1:L1AbZdiDllfyYH5l5OkAaZtk7VkWe89bPJFmnDBNHxg=
-github.com/BurntSushi/toml v0.0.0-20170626110600-a368813c5e64 h1:BuYewlQyh/jroxY8qx41SrzD8Go17GkyCyAeVmprvQI=
-github.com/BurntSushi/toml v0.0.0-20170626110600-a368813c5e64/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/DataDog/zstd v1.3.4 h1:LAGHkXuvC6yky+C2CUG2tD7w8QlrUwpue8XwIh0X4AY=
+github.com/DataDog/zstd v1.3.4/go.mod h1:1jcaCB/ufaK+sKp1NBhlGmpz41jOoPQ35bpF36t7BBo=
 github.com/GeertJohan/go.rice v0.0.0-20170420135705-c02ca9a983da h1:UVU3a9pRUyLdnBtn60WjRl0s4SEyJc2ChCY56OAR6wI=
 github.com/GeertJohan/go.rice v0.0.0-20170420135705-c02ca9a983da/go.mod h1:DgrzXonpdQbfN3uYaGz1EG4Sbhyum/MMIn6Cphlh2bw=
-github.com/PuerkitoBio/purell v1.1.0 h1:rmGxhojJlM0tuKtfdvliR84CFHljx9ag64t2xmVkjK4=
-github.com/PuerkitoBio/purell v1.1.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
-github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M=
-github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
-github.com/Sereal/Sereal v0.0.0-20181211220259-509a78ddbda3/go.mod h1:D0JMgToj/WdxCgd30Kc1UcA9E+WdZoJqeVOuYW7iTBM=
-github.com/alecthomas/assert v0.0.0-20170929043011-405dbfeb8e38/go.mod h1:r7bzyVFMNntcxPZXK3/+KdruV1H5KSlyVY0gc+NgInI=
-github.com/alecthomas/chroma v0.5.0 h1:PI0RlRSWL+8GSMuIMMA5KIND4CeJ5KXUQA60LLp/SjA=
-github.com/alecthomas/chroma v0.5.0/go.mod h1:MmozekIi2rfQSzDcdEZ2BoJ9Pxs/7uc2Y4Boh+hIeZo=
-github.com/alecthomas/colour v0.0.0-20160524082231-60882d9e2721/go.mod h1:QO9JBoKquHd+jz9nshCh40fOfO+JzsoXy8qTHF68zU0=
-github.com/alecthomas/repr v0.0.0-20180818092828-117648cd9897/go.mod h1:xTS7Pm1pD1mvyM075QCDSRqH6qRLXylzS24ZTpRiSzQ=
-github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
+github.com/Sereal/Sereal v0.0.0-20180905114147-563b78806e28 h1:KjLSBawWQq6I0p9VRX8RtHIuttTYvUCGfMgNoBBFxYs=
+github.com/Sereal/Sereal v0.0.0-20180905114147-563b78806e28/go.mod h1:D0JMgToj/WdxCgd30Kc1UcA9E+WdZoJqeVOuYW7iTBM=
 github.com/asdine/storm v2.1.2+incompatible h1:dczuIkyqwY2LrtXPz8ixMrU/OFgZp71kbKTHGrXYt/Q=
 github.com/asdine/storm v2.1.2+incompatible/go.mod h1:RarYDc9hq1UPLImuiXK3BIWPJLdIygvV3PsInK0FbVQ=
-github.com/bep/debounce v1.1.0/go.mod h1:H8yggRPQKLUhUoqrJC1bO2xNya7vanpDl7xR3ISbCJ0=
-github.com/bep/gitmap v1.0.0/go.mod h1:g9VRETxFUXNWzMiuxOwcudo6DfZkW9jOsOW0Ft4kYaY=
-github.com/bep/go-tocss v0.5.0/go.mod h1:c/+hEVoVvkufrV9Is/CPRHWGGdpcTwNuB48hfxzyYBI=
+github.com/boltdb/bolt v1.3.1 h1:JQmyP4ZBrce+ZQu0dY660FMfatumYDLun9hBCUVIkF4=
 github.com/boltdb/bolt v1.3.1/go.mod h1:clJnj/oiGkjum5o1McbSZDSLxVThjynRyGBgiAx27Ps=
-github.com/chaseadamsio/goorgeous v1.1.0 h1:J9UrYDhzucUMHXsCKG+kICvpR5dT1cqZdVFTYvSlUBk=
-github.com/chaseadamsio/goorgeous v1.1.0/go.mod h1:6QaC0vFoKWYDth94dHFNgRT2YkT5FHdQp/Yx15aAAi0=
-github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
-github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
-github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/cpuguy83/go-md2man v1.0.8/go.mod h1:N6JayAiVKtlHSnuTCeuLSQVs75hb8q+dYQLjr7cDsKY=
 github.com/daaku/go.zipexe v0.0.0-20150329023125-a5fe2436ffcb h1:tUf55Po0vzOendQ7NWytcdK0VuzQmfAgvGBUOQvN0WA=
 github.com/daaku/go.zipexe v0.0.0-20150329023125-a5fe2436ffcb/go.mod h1:U0vRfAucUOohvdCxt5MWLF+TePIL0xbCkbKIiV8TQCE=
-github.com/danwakefield/fnmatch v0.0.0-20160403171240-cbb64ac3d964 h1:y5HC9v93H5EPKqaS1UYVg1uYah5Xf51mBfIoWehClUQ=
-github.com/danwakefield/fnmatch v0.0.0-20160403171240-cbb64ac3d964/go.mod h1:Xd9hchkHSWYkEqJwUGisez3G1QY8Ryz0sdWrLPMGjLk=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
-github.com/disintegration/imaging v1.5.0/go.mod h1:9B/deIUIrliYkyMTuXJd6OUFLcrZ2tf+3Qlwnaf/CjU=
-github.com/dlclark/regexp2 v1.1.6 h1:CqB4MjHw0MFCDj+PHHjiESmHX+N7t0tJzKvC6M97BRg=
-github.com/dlclark/regexp2 v1.1.6/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
 github.com/dsnet/compress v0.0.0-20171208185109-cc9eb1d7ad76 h1:eX+pdPPlD279OWgdx7f6KqIRSONuK7egk+jDx7OM3Ac=
 github.com/dsnet/compress v0.0.0-20171208185109-cc9eb1d7ad76/go.mod h1:KjxHHirfLaw19iGT70HvVjHQsL1vq1SRQB4yOsAfy2s=
-github.com/eknkc/amber v0.0.0-20171010120322-cdade1c07385/go.mod h1:0vRUJqYpeSZifjYj7uP3BG/gKcuzL9xWVV/Y+cK33KM=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568 h1:BHsljHzVlRcyQhjrss6TZTdY2VfCqZPbv5k3iBFa2ZQ=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
-github.com/fortytw2/leaktest v1.2.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
-github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
-github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
-github.com/gohugoio/hugo v0.49.2 h1:cj62OqvM3tV12G06J9QQkN2GrO0hOq5m0xtREC7Z9NQ=
-github.com/gohugoio/hugo v0.49.2/go.mod h1:Mh0VDogJpLC4OWpv/wIE4+tJZ1wFPUfMJDNaoJ1yuFA=
+github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db h1:woRePGFeVFfLKN/pOkfl+p/TAqKOfFu+7KPlMVpok/w=
 github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/uuid v1.1.0 h1:Jf4mxPC/ziBnoPIdpQdPJ9OeiomAUHLvxmPRSPH9m4s=
 github.com/google/uuid v1.1.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/context v1.1.1 h1:AWwleXJkX/nhcU9bZSnZoi3h/qGYqQAGhq6zZe/aQW8=
+github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
+github.com/gorilla/mux v1.6.2 h1:Pgr17XVTNXAk3q/r4CpKzC5xBM/qW1uVLV+IhRZpIIk=
+github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/websocket v1.4.0 h1:WDFjx/TMzVgy9VdMMQi2K2Emtwi2QcUQsztZ/zLaH/Q=
 github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
-github.com/hacdias/fileutils v0.0.0-20181202104838-227b317161a1 h1:2MkEawJQTmAr6YI7T7j7SKxdTmYJOcaJZfzeVPr56PM=
-github.com/hacdias/fileutils v0.0.0-20181202104838-227b317161a1/go.mod h1:lwnswzFVSy7B/k81M5rOLUU0fOBKHrDRIkPIBZd7PBo=
-github.com/hacdias/varutils v0.0.0-20171121224303-82d3b57f667a h1:BAjqcm8I/EO0WVwhNcZ/Zcv0Gd/7BrhCp2zi8oqXZh4=
-github.com/hacdias/varutils v0.0.0-20171121224303-82d3b57f667a/go.mod h1:VfbRoVIe7I1Hz8CEW4K80fCz+lQ6Budq0WiI0MrqEdM=
-github.com/hashicorp/go-immutable-radix v1.0.0 h1:AKDB1HM5PWEA7i4nhcpwOrO2byshxBjXVn/J/3+z5/0=
-github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/golang-lru v0.5.0 h1:CL2msUPvZTLb5O648aiLNJw3hnBxN2+1Jq8rCOH9wdo=
-github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hacdias/fileutils v0.0.0-20171121222743-76b1c6ab9067 h1:K2ugN3B7NOrATI7GfXRrwtbyg0OYVR9oNcm1XeTIyY4=
+github.com/hacdias/fileutils v0.0.0-20171121222743-76b1c6ab9067/go.mod h1:lwnswzFVSy7B/k81M5rOLUU0fOBKHrDRIkPIBZd7PBo=
+github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/jdkato/prose v1.1.0 h1:LpvmDGwbKGTgdCH3a8VJL56sr7p/wOFPw/R4lM4PfFg=
-github.com/jdkato/prose v1.1.0/go.mod h1:jkF0lkxaX5PFSlk9l4Gh9Y+T57TqUZziWT7uZbW5ADg=
 github.com/kardianos/osext v0.0.0-20170510131534-ae77be60afb1 h1:PJPDf8OUfOK1bb/NeTKd4f1QXZItOX389VN3B6qC8ro=
 github.com/kardianos/osext v0.0.0-20170510131534-ae77be60afb1/go.mod h1:1NbS8ALrpOvjt0rHPNLyCIeMtbizbir8U//inJ+zuB8=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/kyokomi/emoji v1.5.1 h1:qp9dub1mW7C4MlvoRENH6EAENb9skEFOvIEbp1Waj38=
-github.com/kyokomi/emoji v1.5.1/go.mod h1:mZ6aGCD7yk8j6QY6KICwnZ2pxoszVseX1DNoGtU2tBA=
-github.com/magefile/mage v1.4.0/go.mod h1:IUDi13rsHje59lecXokTfGX0QIzO45uVPlXnJYsXepA=
-github.com/magiconair/properties v1.8.0 h1:LLgXmsheXeRoUOBOjtwPQCWIYqM/LU1ayDtDePerRcY=
-github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
-github.com/markbates/inflect v1.0.0/go.mod h1:oTeZL2KHA7CUX6X+fovmK9OvIOFuqu0TwdQrZjLTh88=
 github.com/maruel/natural v0.0.0-20180416170133-dbcb3e2e8cf1 h1:PEhRT94KBTY4E0KdCYmhvDGWjSFBxc68j2M6PMRix8U=
 github.com/maruel/natural v0.0.0-20180416170133-dbcb3e2e8cf1/go.mod h1:wI697HNhDFM/vBruYM3ckbszQ2+DOIeH9qdBKMdf288=
-github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-runewidth v0.0.3 h1:a+kO+98RDGEfo6asOGMmpodZq4FNtnGP54yps8BzLR4=
-github.com/mattn/go-runewidth v0.0.3/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
-github.com/mholt/archiver v2.1.0+incompatible h1:1ivm7KAHPtPere1YDOdrY6xGdbMNGRWThZbYh5lWZT0=
-github.com/mholt/archiver v2.1.0+incompatible/go.mod h1:Dh2dOXnSdiLxRiPoVfIr/fI1TwETms9B8CTWfeh7ROU=
+github.com/mholt/archiver v3.1.0+incompatible h1:S1rFZ7umHtN6cG+6cusrfoXTMPqp6u/R89iKxBYJd4w=
+github.com/mholt/archiver v3.1.0+incompatible/go.mod h1:Dh2dOXnSdiLxRiPoVfIr/fI1TwETms9B8CTWfeh7ROU=
 github.com/mholt/caddy v0.11.1 h1:oNfejqftVesLoFxw53Gh17aBPNbTxQ9xJw1pn4IiAPk=
 github.com/mholt/caddy v0.11.1/go.mod h1:Wb1PlT4DAYSqOEd03MsqkdkXnTxA8v9pKjdpxbqM1kY=
-github.com/miekg/mmark v1.3.6 h1:t47x5vThdwgLJzofNsbsAl7gmIiJ7kbDQN5BxwBmwvY=
-github.com/miekg/mmark v1.3.6/go.mod h1:w7r9mkTvpS55jlfyn22qJ618itLryxXBhA7Jp3FIlkw=
-github.com/mitchellh/go-homedir v1.0.0 h1:vKb8ShqSby24Yrqr/yDYkuFz8d0WUjys40rvnGC8aR0=
-github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/hashstructure v1.0.0/go.mod h1:QjSHrPWS+BGUVBYkbTZWEnOh3G1DutKwClXU/ABz6AQ=
-github.com/mitchellh/mapstructure v1.0.0/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQzvN1EDeE=
-github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/muesli/smartcrop v0.0.0-20180228075044-f6ebaa786a12/go.mod h1:i2fCI/UorTfgEpPPLWiFBv4pye+YAG78RwcQLUkocpI=
-github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646/go.mod h1:jpp1/29i3P1S/RLdc7JQKbRpFeM1dOBd8T9ki5s+AY8=
-github.com/nicksnyder/go-i18n v1.10.0/go.mod h1:HrK7VCrbOvQoUAQ7Vpy7i87N7JZZZ7R2xBGjv0j365Q=
 github.com/nwaples/rardecode v1.0.0 h1:r7vGuS5akxOnR4JQSkko62RJ1ReCMXxQRPtxsiFMBOs=
 github.com/nwaples/rardecode v1.0.0/go.mod h1:5DzqNKiOdpKKBH87u8VlvAnPZMXcGRhxWkRpHbbfGS0=
-github.com/olekukonko/tablewriter v0.0.0-20180506121414-d4647c9c7a84 h1:fiKJgB4JDUd43CApkmCeTSQlWjtTtABrU2qsgbuP0BI=
-github.com/olekukonko/tablewriter v0.0.0-20180506121414-d4647c9c7a84/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
 github.com/pelletier/go-toml v1.2.0 h1:T5zMGML61Wp+FlcbWjRDT7yAxhJNAiPPLOFECq181zc=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
 github.com/pierrec/lz4 v2.0.5+incompatible h1:2xWsjqPFWcplujydGg4WmhC/6fZqK42wMM8aXeqhl0I=
 github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/robfig/cron v0.0.0-20180505203441-b41be1df6967 h1:x7xEyJDP7Hv3LVgvWhzioQqbC/KtuUhTigKlH/8ehhE=
-github.com/robfig/cron v0.0.0-20180505203441-b41be1df6967/go.mod h1:JGuDeoQd7Z6yL4zQhZ3OPEVHB7fL6Ka6skscFHfmt2k=
-github.com/russross/blackfriday v0.0.0-20180804101149-46c73eb196ba h1:8Vzt8HxRjy7hp1eqPKVoAEPK9npQFW2510qlobGzvi0=
-github.com/russross/blackfriday v0.0.0-20180804101149-46c73eb196ba/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
-github.com/sanity-io/litter v1.1.0/go.mod h1:CJ0VCw2q4qKU7LaQr3n7UOSHzgEMgcGco7N/SkZQPjw=
-github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
-github.com/shurcooL/sanitized_anchor_name v0.0.0-20170918181015-86672fcb3f95 h1:/vdW8Cb7EXrkqWGufVMES1OH2sU9gKVb2n9/1y5NMBY=
-github.com/shurcooL/sanitized_anchor_name v0.0.0-20170918181015-86672fcb3f95/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/spf13/afero v1.1.2 h1:m8/z1t7/fwjysjQRYbP0RD+bUIF/8tJwPdEZsI83ACI=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
-github.com/spf13/cast v1.2.0/go.mod h1:r2rcYCSwa1IExKTDiTfzaxqT2FNHs8hODu4LnUfgKEg=
-github.com/spf13/cast v1.3.0 h1:oget//CVOEoFewqQxwr0Ej5yjygnqGkvggSE/gB35Q8=
-github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cobra v0.0.3 h1:ZlrZ4XsMRm04Fr5pSFxBgfND2EBVa1nLpiy1stUsX/8=
 github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
-github.com/spf13/fsync v0.0.0-20170320142552-12a01e648f05/go.mod h1:jdsEoy1w+v0NpuwXZEaRAH6ADTDmzfRnE2eVwshwFrM=
-github.com/spf13/jwalterweatherman v1.0.0 h1:XHEdyB+EcvlqZamSM4ZOMGlc93t6AcsBEu9Gc1vn7yk=
-github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
-github.com/spf13/nitro v0.0.0-20131003134307-24d7ef30a12d/go.mod h1:jU8A+8xL+6n1OX4XaZtCj4B3mIa64tULUsD6YegdpFo=
-github.com/spf13/pflag v1.0.2/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3 h1:zPAT6CGy6wXeQ7NtTnaTerfKOsV6V6F8agHXFiazDkg=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/viper v1.2.0/go.mod h1:P4AexN0a+C9tGAnUFNwDMYYZv3pjFuvmeiMyKRaNVlI=
-github.com/spf13/viper v1.3.1 h1:5+8j8FTpnFV4nEImW/ofkzEt8VoOiLXxdYIDsB73T38=
-github.com/spf13/viper v1.3.1/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
+github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/tdewolff/minify v2.3.5+incompatible/go.mod h1:9Ov578KJUmAWpS6NeZwRZyT56Uf6o3Mcz9CEsg8USYs=
-github.com/tdewolff/parse v2.3.3+incompatible/go.mod h1:8oBwCsVmUkgHO8M5iCzSIDtpzXOT0WXX9cWhz+bIzJQ=
-github.com/tdewolff/test v0.0.0-20171106182207-265427085153/go.mod h1:DiQUlutnqlEvdvhSn2LPGy4TFwRauAaYDsL+683RNX4=
-github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
 github.com/ulikunitz/xz v0.5.5 h1:pFrO0lVpTBXLpYw+pnLj6TbvHuyjXMfjGeCwSqCVwok=
 github.com/ulikunitz/xz v0.5.5/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
+github.com/vmihailenco/msgpack v4.0.1+incompatible h1:RMF1enSPeKTlXrXdOcqjFUElywVZjjC6pqse21bKbEU=
 github.com/vmihailenco/msgpack v4.0.1+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
-github.com/wellington/go-libsass v0.0.0-20180624165032-615eaa47ef79/go.mod h1:mxgxgam0N0E+NAUMHLcu20Ccfc3mVpDkyrLDayqfiTs=
+github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 h1:nIPpBwaJSVYIxUFsDv3M8ofmx9yWTog9BfvIu0q41lo=
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=
-github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
-github.com/yosssi/ace v0.0.5/go.mod h1:ALfIzm2vT7t5ZE7uoIZqF3TQ7SAOyupFZnkrF5id+K0=
 go.etcd.io/bbolt v1.3.0 h1:oY10fI923Q5pVCVt1GBTZMn8LHo5M+RCInFpeMnV4QI=
 go.etcd.io/bbolt v1.3.0/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9 h1:mKdxBk7AujPs8kU4m80U72y/zjbZ3UcXC7dClwKbUI0=
 golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225 h1:kNX+jCowfMYzvlSvJu5pQWEmyWFrBXJ3PBy10xKMXK8=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd h1:nTDtHvHSdCn1m6ITfMRqtOd/9+7a3s8RBNOZ3eYZzJA=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180906133057-8cf3aee42992/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f h1:Bl/8QSvNqXvPGPGXa2z5xUTmV7VDcZyvRZ+QQXkXTZQ=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a h1:1n5lsVfiQW3yfsRGu98756EH1YthsFqr/5mxHduZW2A=
 golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+google.golang.org/appengine v1.3.0 h1:FBSsiFRMz3LBeXIomRnVzrQwSDj4ibvcRexLG0LZGQk=
+google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0 h1:1Lc07Kr7qY4U2YPouBjpCLxpiyxIVoxqXgkXLknAOE8=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
-gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

http/auth.go

@@ -0,0 +1,180 @@
+package http
+
+import (
+	"encoding/json"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/dgrijalva/jwt-go"
+	"github.com/dgrijalva/jwt-go/request"
+	"github.com/filebrowser/filebrowser/v2/errors"
+	"github.com/filebrowser/filebrowser/v2/users"
+)
+
+type userInfo struct {
+	ID           uint              `json:"id"`
+	Locale       string            `json:"locale"`
+	ViewMode     users.ViewMode    `json:"viewMode"`
+	Perm         users.Permissions `json:"perm"`
+	Commands     []string          `json:"commands"`
+	LockPassword bool              `json:"lockPassword"`
+}
+
+type authToken struct {
+	User userInfo `json:"user"`
+	jwt.StandardClaims
+}
+
+type extractor []string
+
+func (e extractor) ExtractToken(r *http.Request) (string, error) {
+	token, _ := request.AuthorizationHeaderExtractor.ExtractToken(r)
+
+	// Checks if the token isn't empty and if it contains two dots.
+	// The former prevents incompatibility with URLs that previously
+	// used basic auth.
+	if token != "" && strings.Count(token, ".") == 2 {
+		return token, nil
+	}
+
+	auth := r.URL.Query().Get("auth")
+	if auth == "" {
+		return "", request.ErrNoTokenInRequest
+	}
+
+	return auth, nil
+}
+
+func withUser(fn handleFunc) handleFunc {
+	return func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+		keyFunc := func(token *jwt.Token) (interface{}, error) {
+			return d.settings.Key, nil
+		}
+
+		var tk authToken
+		token, err := request.ParseFromRequestWithClaims(r, &extractor{}, &tk, keyFunc)
+
+		if err != nil || !token.Valid {
+			return http.StatusForbidden, nil
+		}
+
+		expired := !tk.VerifyExpiresAt(time.Now().Add(time.Hour).Unix(), true)
+		updated := d.store.Users.LastUpdate(tk.User.ID) > tk.IssuedAt
+
+		if expired || updated {
+			w.Header().Add("X-Renew-Token", "true")
+		}
+
+		d.user, err = d.store.Users.Get(tk.User.ID)
+		if err != nil {
+			return http.StatusInternalServerError, err
+		}
+		return fn(w, r, d)
+	}
+}
+
+func withAdmin(fn handleFunc) handleFunc {
+	return withUser(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+		if !d.user.Perm.Admin {
+			return http.StatusForbidden, nil
+		}
+
+		return fn(w, r, d)
+	})
+}
+
+var loginHandler = func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	auther, err := d.store.Auth.Get(d.settings.AuthMethod)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	user, err := auther.Auth(r)
+	if err == os.ErrPermission {
+		return http.StatusForbidden, nil
+	} else if err != nil {
+		return http.StatusInternalServerError, err
+	} else {
+		return printToken(w, r, d, user)
+	}
+}
+
+type signupBody struct {
+	Username string `json:"username"`
+	Password string `json:"password"`
+}
+
+var signupHandler = func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	if !d.settings.Signup {
+		return http.StatusMethodNotAllowed, nil
+	}
+
+	if r.Body == nil {
+		return http.StatusBadRequest, nil
+	}
+
+	info := &signupBody{}
+	err := json.NewDecoder(r.Body).Decode(info)
+	if err != nil {
+		return http.StatusBadRequest, err
+	}
+
+	if info.Password == "" || info.Username == "" {
+		return http.StatusBadRequest, nil
+	}
+
+	user := &users.User{
+		Username: info.Username,
+	}
+
+	d.settings.Defaults.Apply(user)
+
+	pwd, err := users.HashPwd(info.Password)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	user.Password = pwd
+	err = d.store.Users.Save(user)
+	if err == errors.ErrExist {
+		return http.StatusConflict, err
+	} else if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	return http.StatusOK, nil
+}
+
+var renewHandler = withUser(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	return printToken(w, r, d, d.user)
+})
+
+func printToken(w http.ResponseWriter, r *http.Request, d *data, user *users.User) (int, error) {
+	claims := &authToken{
+		User: userInfo{
+			ID:           user.ID,
+			Locale:       user.Locale,
+			ViewMode:     user.ViewMode,
+			Perm:         user.Perm,
+			LockPassword: user.LockPassword,
+			Commands:     user.Commands,
+		},
+		StandardClaims: jwt.StandardClaims{
+			IssuedAt:  time.Now().Unix(),
+			ExpiresAt: time.Now().Add(time.Hour * 2).Unix(),
+			Issuer:    "File Browser",
+		},
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	signed, err := token.SignedString(d.settings.Key)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	w.Header().Set("Content-Type", "cty")
+	w.Write([]byte(signed))
+	return 0, nil
+}

http/commands.go

@@ -0,0 +1,104 @@
+package http
+
+import (
+	"bufio"
+	"io"
+	"log"
+	"net/http"
+	"os/exec"
+	"strings"
+	"time"
+
+	"github.com/filebrowser/filebrowser/v2/runner"
+	"github.com/gorilla/websocket"
+)
+
+var upgrader = websocket.Upgrader{
+	ReadBufferSize:  1024,
+	WriteBufferSize: 1024,
+}
+
+var (
+	cmdNotAllowed = []byte("Command not allowed.")
+)
+
+func wsErr(ws *websocket.Conn, r *http.Request, status int, err error) {
+	txt := http.StatusText(status)
+	if err != nil || status >= 400 {
+		log.Printf("%s: %v %s %v", r.URL.Path, status, r.RemoteAddr, err)
+	}
+	ws.WriteControl(websocket.CloseInternalServerErr, []byte(txt), time.Now().Add(10*time.Second))
+}
+
+var commandsHandler = withUser(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	conn, err := upgrader.Upgrade(w, r, nil)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+	defer conn.Close()
+
+	var raw string
+
+	for {
+		_, msg, err := conn.ReadMessage()
+		if err != nil {
+			wsErr(conn, r, http.StatusInternalServerError, err)
+			return 0, nil
+		}
+
+		raw = strings.TrimSpace(string(msg))
+		if raw != "" {
+			break
+		}
+	}
+
+	if !d.user.CanExecute(strings.Split(raw, " ")[0]) {
+		err := conn.WriteMessage(websocket.TextMessage, cmdNotAllowed)
+		if err != nil {
+			wsErr(conn, r, http.StatusInternalServerError, err)
+		}
+
+		return 0, nil
+	}
+
+	command, err := runner.ParseCommand(d.settings, raw)
+	if err != nil {
+		err := conn.WriteMessage(websocket.TextMessage, []byte(err.Error()))
+		if err != nil {
+			wsErr(conn, r, http.StatusInternalServerError, err)
+		}
+
+		return 0, nil
+	}
+
+	cmd := exec.Command(command[0], command[1:]...)
+	cmd.Dir = d.user.FullPath(r.URL.Path)
+
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		wsErr(conn, r, http.StatusInternalServerError, err)
+		return 0, nil
+	}
+
+	stderr, err := cmd.StderrPipe()
+	if err != nil {
+		wsErr(conn, r, http.StatusInternalServerError, err)
+		return 0, nil
+	}
+
+	if err := cmd.Start(); err != nil {
+		wsErr(conn, r, http.StatusInternalServerError, err)
+		return 0, nil
+	}
+
+	s := bufio.NewScanner(io.MultiReader(stdout, stderr))
+	for s.Scan() {
+		conn.WriteMessage(websocket.TextMessage, s.Bytes())
+	}
+
+	if err := cmd.Wait(); err != nil {
+		wsErr(conn, r, http.StatusInternalServerError, err)
+	}
+
+	return 0, nil
+})

http/data.go

@@ -0,0 +1,70 @@
+package http
+
+import (
+	"log"
+	"net/http"
+	"strconv"
+
+	"github.com/filebrowser/filebrowser/v2/runner"
+	"github.com/filebrowser/filebrowser/v2/settings"
+	"github.com/filebrowser/filebrowser/v2/storage"
+	"github.com/filebrowser/filebrowser/v2/users"
+)
+
+type handleFunc func(w http.ResponseWriter, r *http.Request, d *data) (int, error)
+
+type data struct {
+	*runner.Runner
+	settings *settings.Settings
+	store    *storage.Storage
+	user     *users.User
+	raw      interface{}
+}
+
+// Check implements rules.Checker.
+func (d *data) Check(path string) bool {
+	for _, rule := range d.user.Rules {
+		if rule.Matches(path) {
+			return rule.Allow
+		}
+	}
+
+	for _, rule := range d.settings.Rules {
+		if rule.Matches(path) {
+			return rule.Allow
+		}
+	}
+
+	return true
+}
+
+func handle(fn handleFunc, prefix string, storage *storage.Storage) http.Handler {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		settings, err := storage.Settings.Get()
+		if err != nil {
+			log.Fatalln("ERROR: couldn't get settings")
+			return
+		}
+
+		status, err := fn(w, r, &data{
+			Runner:   &runner.Runner{Settings: settings},
+			store:    storage,
+			settings: settings,
+		})
+
+		if status != 0 {
+			txt := http.StatusText(status)
+			http.Error(w, strconv.Itoa(status)+" "+txt, status)
+		}
+
+		if status >= 400 || err != nil {
+			log.Printf("%s: %v %s %v", r.URL.Path, status, r.RemoteAddr, err)
+		}
+	})
+
+	if prefix == "" {
+		return handler
+	}
+
+	return http.StripPrefix(prefix, handler)
+}

http/http.go

@@ -0,0 +1,58 @@
+package http
+
+import (
+	"net/http"
+
+	"github.com/filebrowser/filebrowser/v2/storage"
+	"github.com/gorilla/mux"
+)
+
+type modifyRequest struct {
+	What  string   `json:"what"`  // Answer to: what data type?
+	Which []string `json:"which"` // Answer to: which fields?
+}
+
+func NewHandler(storage *storage.Storage) (http.Handler, error) {
+	r := mux.NewRouter()
+
+	index, static := getStaticHandlers(storage)
+
+	r.PathPrefix("/static").Handler(static)
+	r.NotFoundHandler = index
+
+	api := r.PathPrefix("/api").Subrouter()
+
+	api.Handle("/login", handle(loginHandler, "", storage))
+	api.Handle("/signup", handle(signupHandler, "", storage))
+	api.Handle("/renew", handle(renewHandler, "", storage))
+
+	users := api.PathPrefix("/users").Subrouter()
+	users.Handle("", handle(usersGetHandler, "", storage)).Methods("GET")
+	users.Handle("", handle(userPostHandler, "", storage)).Methods("POST")
+	users.Handle("/{id:[0-9]+}", handle(userPutHandler, "", storage)).Methods("PUT")
+	users.Handle("/{id:[0-9]+}", handle(userGetHandler, "", storage)).Methods("GET")
+	users.Handle("/{id:[0-9]+}", handle(userDeleteHandler, "", storage)).Methods("DELETE")
+
+	api.PathPrefix("/resources").Handler(handle(resourceGetHandler, "/api/resources", storage)).Methods("GET")
+	api.PathPrefix("/resources").Handler(handle(resourceDeleteHandler, "/api/resources", storage)).Methods("DELETE")
+	api.PathPrefix("/resources").Handler(handle(resourcePostPutHandler, "/api/resources", storage)).Methods("POST")
+	api.PathPrefix("/resources").Handler(handle(resourcePostPutHandler, "/api/resources", storage)).Methods("PUT")
+	api.PathPrefix("/resources").Handler(handle(resourcePatchHandler, "/api/resources", storage)).Methods("PATCH")
+
+	api.PathPrefix("/share").Handler(handle(shareGetsHandler, "/api/share", storage)).Methods("GET")
+	api.PathPrefix("/share").Handler(handle(sharePostHandler, "/api/share", storage)).Methods("POST")
+	api.PathPrefix("/share").Handler(handle(shareDeleteHandler, "/api/share", storage)).Methods("DELETE")
+
+	api.Handle("/settings", handle(settingsGetHandler, "", storage)).Methods("GET")
+	api.Handle("/settings", handle(settingsPutHandler, "", storage)).Methods("PUT")
+
+	api.PathPrefix("/raw").Handler(handle(rawHandler, "/api/raw", storage)).Methods("GET")
+	api.PathPrefix("/command").Handler(handle(commandsHandler, "/api/command", storage)).Methods("GET")
+	api.PathPrefix("/search").Handler(handle(searchHandler, "/api/search", storage)).Methods("GET")
+	
+	public := api.PathPrefix("/public").Subrouter()
+	public.PathPrefix("/dl").Handler(handle(publicDlHandler, "/api/public/dl/", storage)).Methods("GET")
+	public.PathPrefix("/share").Handler(handle(publicShareHandler, "/api/public/share/", storage)).Methods("GET")
+
+	return r, nil
+}

http/public.go

@@ -0,0 +1,50 @@
+package http
+
+import (
+	"net/http"
+
+	"github.com/filebrowser/filebrowser/v2/files"
+)
+
+var withHashFile = func(fn handleFunc) handleFunc {
+	return func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+		link, err := d.store.Share.GetByHash(r.URL.Path)
+		if err != nil {
+			return errToStatus(err), err
+		}
+
+		user, err := d.store.Users.Get(link.UserID)
+		if err != nil {
+			return errToStatus(err), err
+		}
+
+		d.user = user
+
+		file, err := files.NewFileInfo(files.FileOptions{
+			Fs:      d.user.Fs,
+			Path:    link.Path,
+			Modify:  d.user.Perm.Modify,
+			Expand:  false,
+			Checker: d,
+		})
+		if err != nil {
+			return errToStatus(err), err
+		}
+
+		d.raw = file
+		return fn(w, r, d)
+	}
+}
+
+var publicShareHandler = withHashFile(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	return renderJSON(w, r, d.raw)
+})
+
+var publicDlHandler = withHashFile(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	file := d.raw.(*files.FileInfo)
+	if !file.IsDir {
+		return rawFileHandler(w, r, file)
+	}
+
+	return rawDirHandler(w, r, d, file)
+})

http/raw.go

@@ -0,0 +1,179 @@
+package http
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"path/filepath"
+	"strings"
+
+	"github.com/filebrowser/filebrowser/v2/files"
+	"github.com/filebrowser/filebrowser/v2/users"
+	"github.com/hacdias/fileutils"
+	"github.com/mholt/archiver"
+)
+
+func parseQueryFiles(r *http.Request, f *files.FileInfo, u *users.User) ([]string, error) {
+	files := []string{}
+	names := strings.Split(r.URL.Query().Get("files"), ",")
+
+	if len(names) == 0 {
+		files = append(files, f.Path)
+	} else {
+		for _, name := range names {
+			name, err := url.QueryUnescape(strings.Replace(name, "+", "%2B", -1))
+			if err != nil {
+				return nil, err
+			}
+
+			name = fileutils.SlashClean(name)
+			files = append(files, filepath.Join(f.Path, name))
+		}
+	}
+
+	return files, nil
+}
+
+func parseQueryAlgorithm(r *http.Request) (string, archiver.Writer, error) {
+	switch r.URL.Query().Get("algo") {
+	case "zip", "true", "":
+		return ".zip", archiver.NewZip(), nil
+	case "tar":
+		return ".tar", archiver.NewTar(), nil
+	case "targz":
+		return ".tar.gz", archiver.NewTarGz(), nil
+	case "tarbz2":
+		return ".tar.bz2", archiver.NewTarBz2(), nil
+	case "tarxz":
+		return ".tar.xz", archiver.NewTarXz(), nil
+	case "tarlz4":
+		return ".tar.lz4", archiver.NewTarLz4(), nil
+	case "tarsz":
+		return ".tar.sz", archiver.NewTarSz(), nil
+	default:
+		return "", nil, errors.New("format not implemented")
+	}
+}
+
+var rawHandler = withUser(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	if !d.user.Perm.Download {
+		return http.StatusAccepted, nil
+	}
+
+	file, err := files.NewFileInfo(files.FileOptions{
+		Fs:      d.user.Fs,
+		Path:    r.URL.Path,
+		Modify:  d.user.Perm.Modify,
+		Expand:  false,
+		Checker: d,
+	})
+	if err != nil {
+		return errToStatus(err), err
+	}
+
+	if !file.IsDir {
+		return rawFileHandler(w, r, file)
+	}
+
+	return rawDirHandler(w, r, d, file)
+})
+
+func addFile(ar archiver.Writer, d *data, path string) error {
+	// Checks are always done with paths with "/" as path separator.
+	path = strings.Replace(path, "\\", "/", -1)
+	fmt.Println(path)
+	if !d.Check(path) {
+		return nil
+	}
+
+	info, err := d.user.Fs.Stat(path)
+	if err != nil {
+		return err
+	}
+
+	file, err := d.user.Fs.Open(path)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	err = ar.Write(archiver.File{
+		FileInfo: archiver.FileInfo{
+			FileInfo:   info,
+			CustomName: strings.TrimPrefix(path, "/"),
+		},
+		ReadCloser: file,
+	})
+	if err != nil {
+		return err
+	}
+
+	if info.IsDir() {
+		names, err := file.Readdirnames(0)
+		if err != nil {
+			return err
+		}
+
+		for _, name := range names {
+			err = addFile(ar, d, filepath.Join(path, name))
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func rawDirHandler(w http.ResponseWriter, r *http.Request, d *data, file *files.FileInfo) (int, error) {
+	filenames, err := parseQueryFiles(r, file, d.user)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	extension, ar, err := parseQueryAlgorithm(r)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	name := file.Name
+	if name == "." || name == "" {
+		name = "archive"
+	}
+	name += extension
+	w.Header().Set("Content-Disposition", "attachment; filename*=utf-8''"+url.PathEscape(name))
+
+	err = ar.Create(w)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+	defer ar.Close()
+
+	for _, fname := range filenames {
+		err = addFile(ar, d, fname)
+		if err != nil {
+			return http.StatusInternalServerError, err
+		}
+	}
+
+	return 0, nil
+}
+
+func rawFileHandler(w http.ResponseWriter, r *http.Request, file *files.FileInfo) (int, error) {
+	fd, err := file.Fs.Open(file.Path)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+	defer fd.Close()
+
+	if r.URL.Query().Get("inline") == "true" {
+		w.Header().Set("Content-Disposition", "inline")
+	} else {
+		// As per RFC6266 section 4.3
+		w.Header().Set("Content-Disposition", "attachment; filename*=utf-8''"+url.PathEscape(file.Name))
+	}
+
+	http.ServeContent(w, r, file.Name, file.ModTime, fd)
+	return 0, nil
+}

http/resource.go

@@ -0,0 +1,158 @@
+package http
+
+import (
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+
+	"github.com/filebrowser/filebrowser/v2/files"
+
+	"github.com/filebrowser/filebrowser/v2/errors"
+	"github.com/filebrowser/filebrowser/v2/fileutils"
+)
+
+var resourceGetHandler = withUser(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	file, err := files.NewFileInfo(files.FileOptions{
+		Fs: d.user.Fs,
+		Path: r.URL.Path,
+		Modify: d.user.Perm.Modify,
+		Expand: true,
+		Checker: d,
+	})
+	if err != nil {
+		return errToStatus(err), err
+	}
+
+	if file.IsDir {
+		file.Listing.Sorting = d.user.Sorting
+		file.Listing.ApplySort()
+		return renderJSON(w, r, file)
+	}
+
+	if checksum := r.URL.Query().Get("checksum"); checksum != "" {
+		err := file.Checksum(checksum)
+		if err == errors.ErrInvalidOption {
+			return http.StatusBadRequest, nil
+		} else if err != nil {
+			return http.StatusInternalServerError, err
+		}
+
+		// do not waste bandwidth if we just want the checksum
+		file.Content = ""
+	}
+
+	return renderJSON(w, r, file)
+})
+
+var resourceDeleteHandler = withUser(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	if r.URL.Path == "/" || !d.user.Perm.Delete {
+		return http.StatusForbidden, nil
+	}
+
+	err := d.RunHook(func() error {
+		return d.user.Fs.RemoveAll(r.URL.Path)
+	}, "delete", r.URL.Path, "", d.user)
+
+	if err != nil {
+		return errToStatus(err), err
+	}
+
+	return http.StatusOK, nil
+})
+
+var resourcePostPutHandler = withUser(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	if !d.user.Perm.Create && r.Method == http.MethodPost {
+		return http.StatusForbidden, nil
+	}
+
+	if !d.user.Perm.Modify && r.Method == http.MethodPut {
+		return http.StatusForbidden, nil
+	}
+
+	defer func() {
+		io.Copy(ioutil.Discard, r.Body)
+	}()
+
+	// For directories, only allow POST for creation.
+	if strings.HasSuffix(r.URL.Path, "/") {
+		if r.Method == http.MethodPut {
+			return http.StatusMethodNotAllowed, nil
+		}
+
+		err := d.user.Fs.MkdirAll(r.URL.Path, 0775)
+		return errToStatus(err), err
+	}
+
+	if r.Method == http.MethodPost && r.URL.Query().Get("override") != "true" {
+		if _, err := d.user.Fs.Stat(r.URL.Path); err == nil {
+			return http.StatusConflict, nil
+		}
+	}
+
+	err := d.RunHook(func() error {
+		file, err := d.user.Fs.OpenFile(r.URL.Path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0775)
+		if err != nil {
+			return err
+		}
+		defer file.Close()
+
+		_, err = io.Copy(file, r.Body)
+		if err != nil {
+			return err
+		}
+
+		// Gets the info about the file.
+		info, err := file.Stat()
+		if err != nil {
+			return err
+		}
+
+		etag := fmt.Sprintf(`"%x%x"`, info.ModTime().UnixNano(), info.Size())
+		w.Header().Set("ETag", etag)
+		return nil
+	}, "upload", r.URL.Path, "", d.user)
+
+	return errToStatus(err), err
+})
+
+var resourcePatchHandler = withUser(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	src := r.URL.Path
+	dst := r.URL.Query().Get("destination")
+	action := r.URL.Query().Get("action")
+	dst, err := url.QueryUnescape(dst)
+
+	if err != nil {
+		return errToStatus(err), err
+	}
+
+	if dst == "/" || src == "/" {
+		return http.StatusForbidden, nil
+	}
+
+	switch action {
+	case "copy":
+		if !d.user.Perm.Create {
+			return http.StatusForbidden, nil
+		}
+	case "rename":
+	default:
+		action = "rename"
+		if !d.user.Perm.Rename {
+			return http.StatusForbidden, nil
+		}
+	}
+
+	err = d.RunHook(func() error {
+		if action == "copy" {
+			return fileutils.Copy(d.user.Fs, src, dst)
+		}
+
+		return d.user.Fs.Rename(src, dst)
+	}, action, src, dst, d.user)
+
+	return errToStatus(err), err
+})

http/search.go

@@ -0,0 +1,28 @@
+package http
+
+import (
+	"net/http"
+	"os"
+
+	"github.com/filebrowser/filebrowser/v2/search"
+)
+
+var searchHandler = withUser(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	response := []map[string]interface{}{}
+	query := r.URL.Query().Get("query")
+
+	err := search.Search(d.user.Fs, r.URL.Path, query, d, func(path string, f os.FileInfo) error {
+		response = append(response, map[string]interface{}{
+			"dir":  f.IsDir(),
+			"path": path,
+		})
+
+		return nil
+	})
+
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	return renderJSON(w, r, response)
+})

http/settings.go

@@ -0,0 +1,49 @@
+package http
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"github.com/filebrowser/filebrowser/v2/rules"
+	"github.com/filebrowser/filebrowser/v2/settings"
+)
+
+type settingsData struct {
+	Signup   bool                  `json:"signup"`
+	Defaults settings.UserDefaults `json:"defaults"`
+	Rules    []rules.Rule          `json:"rules"`
+	Branding settings.Branding     `json:"branding"`
+	Shell    []string              `json:"shell"`
+	Commands map[string][]string   `json:"commands"`
+}
+
+var settingsGetHandler = withAdmin(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	data := &settingsData{
+		Signup:   d.settings.Signup,
+		Defaults: d.settings.Defaults,
+		Rules:    d.settings.Rules,
+		Branding: d.settings.Branding,
+		Shell:    d.settings.Shell,
+		Commands: d.settings.Commands,
+	}
+
+	return renderJSON(w, r, data)
+})
+
+var settingsPutHandler = withAdmin(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	req := &settingsData{}
+	err := json.NewDecoder(r.Body).Decode(req)
+	if err != nil {
+		return http.StatusBadRequest, err
+	}
+
+	d.settings.Signup = req.Signup
+	d.settings.Defaults = req.Defaults
+	d.settings.Rules = req.Rules
+	d.settings.Branding = req.Branding
+	d.settings.Shell = req.Shell
+	d.settings.Commands = req.Commands
+
+	err = d.store.Settings.Save(d.settings)
+	return errToStatus(err), err
+})

http/share.go

@@ -0,0 +1,107 @@
+package http
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/filebrowser/filebrowser/v2/errors"
+	"github.com/filebrowser/filebrowser/v2/share"
+)
+
+func withPermShare(fn handleFunc) handleFunc {
+	return withUser(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+		if !d.user.Perm.Share {
+			return http.StatusForbidden, nil
+		}
+
+		return fn(w, r, d)
+	})
+}
+
+var shareGetsHandler = withPermShare(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	s, err := d.store.Share.Gets(r.URL.Path, d.user.ID)
+	if err == errors.ErrNotExist {
+		return renderJSON(w, r, []*share.Link{})
+	}
+
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	return renderJSON(w, r, s)
+})
+
+var shareDeleteHandler = withPermShare(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	hash := strings.TrimSuffix(r.URL.Path, "/")
+	hash = strings.TrimPrefix(hash, "/")
+
+	if hash == "" {
+		return http.StatusBadRequest, nil
+	}
+
+	err := d.store.Share.Delete(hash)
+	return errToStatus(err), err
+})
+
+var sharePostHandler = withPermShare(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	var s *share.Link
+	rawExpire := r.URL.Query().Get("expires")
+	unit := r.URL.Query().Get("unit")
+
+	if rawExpire == "" {
+		var err error
+		s, err = d.store.Share.GetPermanent(r.URL.Path, d.user.ID)
+		if err == nil {
+			w.Write([]byte(d.settings.BaseURL + "/share/" + s.Hash))
+			return 0, nil
+		}
+	}
+
+	bytes := make([]byte, 6)
+	_, err := rand.Read(bytes)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	str := base64.URLEncoding.EncodeToString(bytes)
+
+	var expire int64 = 0
+
+	if rawExpire != "" {
+		num, err := strconv.Atoi(rawExpire)
+		if err != nil {
+			return http.StatusInternalServerError, err
+		}
+
+		var add time.Duration
+		switch unit {
+		case "seconds":
+			add = time.Second * time.Duration(num)
+		case "minutes":
+			add = time.Minute * time.Duration(num)
+		case "days":
+			add = time.Hour * 24 * time.Duration(num)
+		default:
+			add = time.Hour * time.Duration(num)
+		}
+
+		expire = time.Now().Add(add).Unix()
+	}
+
+	s = &share.Link{
+		Path:   r.URL.Path,
+		Hash:   str,
+		Expire: expire,
+		UserID: d.user.ID,
+	}
+
+	if err := d.store.Share.Save(s); err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	return renderJSON(w, r, s)
+})

http/static.go

@@ -0,0 +1,121 @@
+package http
+
+import (
+	"encoding/json"
+	"text/template"
+	"log"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/GeertJohan/go.rice"
+	"github.com/filebrowser/filebrowser/v2/auth"
+	"github.com/filebrowser/filebrowser/v2/storage"
+	"github.com/filebrowser/filebrowser/v2/version"
+)
+
+func handleWithStaticData(w http.ResponseWriter, r *http.Request, d *data, box *rice.Box, file, contentType string) (int, error) {
+	w.Header().Set("Content-Type", contentType)
+
+	staticURL := strings.TrimPrefix(d.settings.BaseURL+"/static", "/")
+
+	data := map[string]interface{}{
+		"Name":            d.settings.Branding.Name,
+		"DisableExternal": d.settings.Branding.DisableExternal,
+		"BaseURL":         d.settings.BaseURL,
+		"Version":         version.Version,
+		"StaticURL":       staticURL,
+		"Signup":          d.settings.Signup,
+		"NoAuth":          d.settings.AuthMethod == auth.MethodNoAuth,
+		"CSS":             false,
+		"ReCaptcha":       false,
+	}
+
+	if d.settings.Branding.Files != "" {
+		path := filepath.Join(d.settings.Branding.Files, "custom.css")
+		_, err := os.Stat(path)
+
+		if err != nil && !os.IsNotExist(err) {
+			log.Printf("couldn't load custom styles: %v", err)
+		}
+
+		if err == nil {
+			data["CSS"] = true
+		}
+	}
+
+	if d.settings.AuthMethod == auth.MethodJSONAuth {
+		raw, err := d.store.Auth.Get(d.settings.AuthMethod)
+		if err != nil {
+			return http.StatusInternalServerError, err
+		}
+
+		auther := raw.(*auth.JSONAuth)
+
+		if auther.ReCaptcha != nil {
+			data["ReCaptcha"] = auther.ReCaptcha.Key != "" && auther.ReCaptcha.Secret != ""
+			data["ReCaptchaHost"] = auther.ReCaptcha.Host
+			data["ReCaptchaKey"] = auther.ReCaptcha.Key
+		}
+	}
+
+	b, err := json.MarshalIndent(data, "", "  ")
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	data["Json"] = string(b)
+
+	index := template.Must(template.New("index").Delims("[{[", "]}]").Parse(box.MustString(file)))
+	err = index.Execute(w, data)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	return 0, nil
+}
+
+func getStaticHandlers(storage *storage.Storage) (http.Handler, http.Handler) {
+	box := rice.MustFindBox("../frontend/dist")
+	handler := http.FileServer(box.HTTPBox())
+
+	index := handle(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+		if r.Method != http.MethodGet {
+			return http.StatusNotFound, nil
+		}
+
+		w.Header().Set("x-frame-options", "SAMEORIGIN")
+		w.Header().Set("x-xss-protection", "1; mode=block")
+
+		return handleWithStaticData(w, r, d, box, "index.html", "text/html; charset=utf-8")
+	}, "", storage)
+
+	static := handle(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+		if r.Method != http.MethodGet {
+			return http.StatusNotFound, nil
+		}
+
+		if d.settings.Branding.Files != "" {
+			if strings.HasPrefix(r.URL.Path, "img/") {
+				path := filepath.Join(d.settings.Branding.Files, r.URL.Path)
+				if _, err := os.Stat(path); err == nil {
+					http.ServeFile(w, r, path)
+					return 0, nil
+				}
+			} else if r.URL.Path == "custom.css" && d.settings.Branding.Files != "" {
+				http.ServeFile(w, r, filepath.Join(d.settings.Branding.Files, "custom.css"))
+				return 0, nil
+			}
+		}
+
+		if !strings.HasSuffix(r.URL.Path, ".js") {
+			handler.ServeHTTP(w, r)
+			return 0, nil
+		}
+
+		return handleWithStaticData(w, r, d, box, r.URL.Path, "application/javascript; charset=utf-8")
+	}, "/static/", storage)
+
+	return index, static
+}

http/users.go

@@ -0,0 +1,186 @@
+package http
+
+import (
+	"encoding/json"
+	"net/http"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/filebrowser/filebrowser/v2/errors"
+	"github.com/filebrowser/filebrowser/v2/users"
+	"github.com/gorilla/mux"
+)
+
+type modifyUserRequest struct {
+	modifyRequest
+	Data *users.User `json:"data"`
+}
+
+func getUserID(r *http.Request) (uint, error) {
+	vars := mux.Vars(r)
+	i, err := strconv.ParseUint(vars["id"], 10, 0)
+	if err != nil {
+		return 0, err
+	}
+	return uint(i), err
+}
+
+func getUser(w http.ResponseWriter, r *http.Request) (*modifyUserRequest, error) {
+	if r.Body == nil {
+		return nil, errors.ErrEmptyRequest
+	}
+
+	req := &modifyUserRequest{}
+	err := json.NewDecoder(r.Body).Decode(req)
+	if err != nil {
+		return nil, err
+	}
+
+	if req.What != "user" {
+		return nil, errors.ErrInvalidDataType
+	}
+
+	return req, nil
+}
+
+func withSelfOrAdmin(fn handleFunc) handleFunc {
+	return withUser(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+		id, err := getUserID(r)
+		if err != nil {
+			return http.StatusInternalServerError, err
+		}
+
+		if d.user.ID != id && !d.user.Perm.Admin {
+			return http.StatusForbidden, nil
+		}
+
+		d.raw = id
+		return fn(w, r, d)
+	})
+}
+
+var usersGetHandler = withAdmin(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	users, err := d.store.Users.Gets()
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	for _, u := range users {
+		u.Password = ""
+	}
+
+	sort.Slice(users, func(i, j int) bool {
+		return users[i].ID < users[j].ID
+	})
+
+	return renderJSON(w, r, users)
+})
+
+var userGetHandler = withSelfOrAdmin(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	u, err := d.store.Users.Get(d.raw.(uint))
+	if err == errors.ErrNotExist {
+		return http.StatusNotFound, err
+	}
+
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	u.Password = ""
+	return renderJSON(w, r, u)
+})
+
+var userDeleteHandler = withSelfOrAdmin(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	err := d.store.Users.Delete(d.raw.(uint))
+	if err == errors.ErrNotExist {
+		return http.StatusNotFound, err
+	}
+
+	return http.StatusOK, nil
+})
+
+var userPostHandler = withAdmin(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	req, err := getUser(w, r)
+	if err != nil {
+		return http.StatusBadRequest, err
+	}
+
+	if len(req.Which) != 0 {
+		return http.StatusBadRequest, nil
+	}
+
+	if req.Data.Password == "" {
+		return http.StatusBadRequest, errors.ErrEmptyPassword
+	}
+
+	req.Data.Password, err = users.HashPwd(req.Data.Password)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	err = d.store.Users.Save(req.Data)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	w.Header().Set("Location", "/settings/users/"+strconv.FormatUint(uint64(req.Data.ID), 10))
+	return http.StatusCreated, nil
+})
+
+var userPutHandler = withSelfOrAdmin(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	req, err := getUser(w, r)
+	if err != nil {
+		return http.StatusBadRequest, err
+	}
+
+	if req.Data.ID != d.raw.(uint) {
+		return http.StatusBadRequest, nil
+	}
+
+	if len(req.Which) == 1 && req.Which[0] == "all" {
+		if !d.user.Perm.Admin {
+			return http.StatusForbidden, err
+		}
+
+		if req.Data.Password != "" {
+			req.Data.Password, err = users.HashPwd(req.Data.Password)
+		} else {
+			var suser *users.User
+			suser, err = d.store.Users.Get(d.raw.(uint))
+			req.Data.Password = suser.Password
+		}
+
+		if err != nil {
+			return http.StatusInternalServerError, err
+		}
+
+		req.Which = []string{}
+	}
+
+	for k, v := range req.Which {
+		if v == "password" {
+			if !d.user.Perm.Admin && d.user.LockPassword {
+				return http.StatusForbidden, nil
+			}
+
+			req.Data.Password, err = users.HashPwd(req.Data.Password)
+			if err != nil {
+				return http.StatusInternalServerError, err
+			}
+		}
+
+		if !d.user.Perm.Admin && (v == "scope" || v == "perm" || v == "username") {
+			return http.StatusForbidden, nil
+		}
+
+		req.Which[k] = strings.Title(v)
+	}
+
+	err = d.store.Users.Update(req.Data, req.Which...)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	return http.StatusOK, nil
+})

http/utils.go

@@ -0,0 +1,39 @@
+package http
+
+import (
+	"encoding/json"
+	"net/http"
+	"os"
+
+	"github.com/filebrowser/filebrowser/v2/errors"
+)
+
+func renderJSON(w http.ResponseWriter, r *http.Request, data interface{}) (int, error) {
+	marsh, err := json.Marshal(data)
+
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	if _, err := w.Write(marsh); err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	return 0, nil
+}
+
+func errToStatus(err error) int {
+	switch {
+	case err == nil:
+		return http.StatusOK
+	case os.IsPermission(err):
+		return http.StatusForbidden
+	case os.IsNotExist(err), err == errors.ErrNotExist:
+		return http.StatusNotFound
+	case os.IsExist(err), err == errors.ErrExist:
+		return http.StatusConflict
+	default:
+		return http.StatusInternalServerError
+	}
+}

lib/bolt/config.go

@@ -1,26 +0,0 @@
-package bolt
-
-import (
-	"github.com/asdine/storm"
-	fb "github.com/filebrowser/filebrowser/lib"
-)
-
-// ConfigStore is a configuration store.
-type ConfigStore struct {
-	DB *storm.DB
-}
-
-// Get gets a configuration from the database to an interface.
-func (c ConfigStore) Get(name string, to interface{}) error {
-	err := c.DB.Get("config", name, to)
-	if err == storm.ErrNotFound {
-		return fb.ErrNotExist
-	}
-
-	return err
-}
-
-// Save saves a configuration from an interface to the database.
-func (c ConfigStore) Save(name string, from interface{}) error {
-	return c.DB.Set("config", name, from)
-}

lib/bolt/share.go

@@ -1,66 +0,0 @@
-package bolt
-
-import (
-	"github.com/asdine/storm"
-	"github.com/asdine/storm/q"
-	fb "github.com/filebrowser/filebrowser/lib"
-)
-
-// ShareStore is a shareable links store.
-type ShareStore struct {
-	DB *storm.DB
-}
-
-// Get gets a Share Link from an hash.
-func (s ShareStore) Get(hash string) (*fb.ShareLink, error) {
-	var v fb.ShareLink
-	err := s.DB.One("Hash", hash, &v)
-	if err == storm.ErrNotFound {
-		return nil, fb.ErrNotExist
-	}
-
-	return &v, err
-}
-
-// GetPermanent gets the permanent link from a path.
-func (s ShareStore) GetPermanent(path string) (*fb.ShareLink, error) {
-	var v fb.ShareLink
-	err := s.DB.Select(q.Eq("Path", path), q.Eq("Expires", false)).First(&v)
-	if err == storm.ErrNotFound {
-		return nil, fb.ErrNotExist
-	}
-
-	return &v, err
-}
-
-// GetByPath gets all the links for a specific path.
-func (s ShareStore) GetByPath(hash string) ([]*fb.ShareLink, error) {
-	var v []*fb.ShareLink
-	err := s.DB.Find("Path", hash, &v)
-	if err == storm.ErrNotFound {
-		return v, fb.ErrNotExist
-	}
-
-	return v, err
-}
-
-// Gets retrieves all the shareable links.
-func (s ShareStore) Gets() ([]*fb.ShareLink, error) {
-	var v []*fb.ShareLink
-	err := s.DB.All(&v)
-	if err == storm.ErrNotFound {
-		return v, fb.ErrNotExist
-	}
-
-	return v, err
-}
-
-// Save stores a Share Link on the database.
-func (s ShareStore) Save(l *fb.ShareLink) error {
-	return s.DB.Save(l)
-}
-
-// Delete deletes a Share Link from the database.
-func (s ShareStore) Delete(hash string) error {
-	return s.DB.DeleteStruct(&fb.ShareLink{Hash: hash})
-}

lib/bolt/users.go

@@ -1,90 +0,0 @@
-package bolt
-
-import (
-	"reflect"
-
-	"github.com/asdine/storm"
-	fb "github.com/filebrowser/filebrowser/lib"
-)
-
-// UsersStore is a users store.
-type UsersStore struct {
-	DB *storm.DB
-}
-
-// Get gets a user with a certain id from the database.
-func (u UsersStore) Get(id int, builder fb.FSBuilder) (*fb.User, error) {
-	var us fb.User
-	err := u.DB.One("ID", id, &us)
-	if err == storm.ErrNotFound {
-		return nil, fb.ErrNotExist
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	us.FileSystem = builder(us.Scope)
-	return &us, nil
-}
-
-// GetByUsername gets a user with a certain username from the database.
-func (u UsersStore) GetByUsername(username string, builder fb.FSBuilder) (*fb.User, error) {
-	var us fb.User
-	err := u.DB.One("Username", username, &us)
-	if err == storm.ErrNotFound {
-		return nil, fb.ErrNotExist
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	us.FileSystem = builder(us.Scope)
-	return &us, nil
-}
-
-// Gets gets all the users from the database.
-func (u UsersStore) Gets(builder fb.FSBuilder) ([]*fb.User, error) {
-	var us []*fb.User
-	err := u.DB.All(&us)
-	if err == storm.ErrNotFound {
-		return nil, fb.ErrNotExist
-	}
-
-	if err != nil {
-		return us, err
-	}
-
-	for _, user := range us {
-		user.FileSystem = builder(user.Scope)
-	}
-
-	return us, err
-}
-
-// Update updates the whole user object or only certain fields.
-func (u UsersStore) Update(us *fb.User, fields ...string) error {
-	if len(fields) == 0 {
-		return u.Save(us)
-	}
-
-	for _, field := range fields {
-		val := reflect.ValueOf(us).Elem().FieldByName(field).Interface()
-		if err := u.DB.UpdateField(us, field, val); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-// Save saves a user to the database.
-func (u UsersStore) Save(us *fb.User) error {
-	return u.DB.Save(us)
-}
-
-// Delete deletes a user from the database.
-func (u UsersStore) Delete(id int) error {
-	return u.DB.DeleteStruct(&fb.User{ID: id})
-}

lib/doc.go

@@ -1,77 +0,0 @@
-/*
-Package filebrowser provides a web interface to access your files
-wherever you are. To use this package as a middleware for your app,
-you'll need to import both File Browser and File Browser HTTP packages.
-
-	import (
-		fm "github.com/filebrowser/filebrowser"
-		h "github.com/filebrowser/filebrowser/http"
-	)
-
-Then, you should create a new FileBrowser object with your options. In this
-case, I'm using BoltDB (via Storm package) as a Store. So, you'll also need
-to import "github.com/filebrowser/filebrowser/bolt".
-
-	db, _ := storm.Open("bolt.db")
-
-	m := &fm.FileBrowser{
-		NoAuth: false,
-		Auth: {
-			Method: "default",
-			LoginHeader: "X-Fowarded-User"
-		},
-		DefaultUser: &fm.User{
-			AllowCommands: true,
-			AllowEdit:     true,
-			AllowNew:      true,
-			AllowPublish:  true,
-			Commands:      []string{"git"},
-			Rules:         []*fm.Rule{},
-			Locale:        "en",
-			CSS:           "",
-			Scope:         ".",
-			FileSystem:    fileutils.Dir("."),
-		},
-		Store: &fm.Store{
-			Config: bolt.ConfigStore{DB: db},
-			Users:  bolt.UsersStore{DB: db},
-			Share:  bolt.ShareStore{DB: db},
-		},
-		NewFS: func(scope string) fm.FileSystem {
-			return fileutils.Dir(scope)
-		},
-	}
-
-The credentials for the first user are always 'admin' for both the user and
-the password, and they can be changed later through the settings. The first
-user is always an Admin and has all of the permissions set to 'true'.
-
-Then, you should set the Prefix URL and the Base URL, using the following
-functions:
-
-		m.SetBaseURL("/")
-		m.SetPrefixURL("/")
-
-The Prefix URL is a part of the path that is already stripped from the
-r.URL.Path variable before the request arrives to File Browser's handler.
-This is a function that will rarely be used. You can see one example on Caddy
-filemanager plugin.
-
-The Base URL is the URL path where you want File Browser to be available in. If
-you want to be available at the root path, you should call:
-
-		m.SetBaseURL("/")
-
-But if you want to access it at '/admin', you would call:
-
-		m.SetBaseURL("/admin")
-
-Now, that you already have a File Browser instance created, you just need to
-add it to your handlers using m.ServeHTTP which is compatible to http.Handler.
-We also have a m.ServeWithErrorsHTTP that returns the status code and an error.
-
-One simple implementation for this, at port 80, in the root of the domain, would be:
-
-		http.ListenAndServe(":80", h.Handler(m))
-*/
-package lib

lib/file.go

@@ -1,491 +0,0 @@
-package lib
-
-import (
-	"bytes"
-	"crypto/md5"
-	"crypto/sha1"
-	"crypto/sha256"
-	"crypto/sha512"
-	"encoding/hex"
-	"hash"
-	"io"
-	"io/ioutil"
-	"mime"
-	"net/http"
-	"net/url"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-	"time"
-
-	"github.com/gohugoio/hugo/parser"
-	"github.com/maruel/natural"
-)
-
-// The size of the loaded text can be rendered in the browser. Avoiding files that are too large causes browsers to crash.
-// Currently set to 10MB, 10 * 1024 * 1024 = 10485760 byte
-const textExtensionsRenderMaxSize int64 = 10485760
-
-// File contains the information about a particular file or directory.
-type File struct {
-	// Indicates the Kind of view on the front-end (Listing, editor or preview).
-	Kind string `json:"kind"`
-	// The name of the file.
-	Name string `json:"name"`
-	// The Size of the file.
-	Size int64 `json:"size"`
-	// The absolute URL.
-	URL string `json:"url"`
-	// The extension of the file.
-	Extension string `json:"extension"`
-	// The last modified time.
-	ModTime time.Time `json:"modified"`
-	// The File Mode.
-	Mode os.FileMode `json:"mode"`
-	// Indicates if this file is a directory.
-	IsDir bool `json:"isDir"`
-	// Absolute path.
-	Path string `json:"path"`
-	// Relative path to user's virtual File System.
-	VirtualPath string `json:"virtualPath"`
-	// Indicates the file content type: video, text, image, music or blob.
-	Type string `json:"type"`
-	// Stores the content of a text file.
-	Content string `json:"content,omitempty"`
-
-	*Listing `json:",omitempty"`
-
-	Metadata string `json:"metadata,omitempty"`
-	Language string `json:"language,omitempty"`
-}
-
-// A Listing is the context used to fill out a template.
-type Listing struct {
-	// The items (files and folders) in the path.
-	Items []*File `json:"items"`
-	// The number of directories in the Listing.
-	NumDirs int `json:"numDirs"`
-	// The number of files (items that aren't directories) in the Listing.
-	NumFiles int `json:"numFiles"`
-	// Which sorting order is used.
-	Sort string `json:"sort"`
-	// And which order.
-	Order string `json:"order"`
-}
-
-// GetInfo gets the file information and, in case of error, returns the
-// respective HTTP error code
-func GetInfo(url *url.URL, c *FileBrowser, u *User) (*File, error) {
-	var err error
-
-	i := &File{
-		URL:         "/files" + url.String(),
-		VirtualPath: url.Path,
-		Path:        filepath.Join(u.Scope, url.Path),
-	}
-
-	info, err := u.FileSystem.Stat(url.Path)
-	if err != nil {
-		return i, err
-	}
-
-	i.Name = info.Name()
-	i.ModTime = info.ModTime()
-	i.Mode = info.Mode()
-	i.IsDir = info.IsDir()
-	i.Size = info.Size()
-	i.Extension = filepath.Ext(i.Name)
-
-	if i.IsDir && !strings.HasSuffix(i.URL, "/") {
-		i.URL += "/"
-	}
-
-	return i, nil
-}
-
-// GetListing gets the information about a specific directory and its files.
-func (i *File) GetListing(u *User, r *http.Request) error {
-	// Gets the directory information using the Virtual File System of
-	// the user configuration.
-	f, err := u.FileSystem.OpenFile(i.VirtualPath, os.O_RDONLY, 0)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-
-	// Reads the directory and gets the information about the files.
-	files, err := f.Readdir(-1)
-	if err != nil {
-		return err
-	}
-
-	var (
-		fileinfos           []*File
-		dirCount, fileCount int
-	)
-
-	baseurl, err := url.PathUnescape(i.URL)
-	if err != nil {
-		return err
-	}
-
-	for _, f := range files {
-		name := f.Name()
-		allowed := u.Allowed("/" + name)
-
-		if !allowed {
-			continue
-		}
-
-		if strings.HasPrefix(f.Mode().String(), "L") {
-			// It's a symbolic link. We try to follow it. If it doesn't work,
-			// we stay with the link information instead if the target's.
-			info, err := os.Stat(f.Name())
-			if err == nil {
-				f = info
-			}
-		}
-
-		if f.IsDir() {
-			name += "/"
-			dirCount++
-		} else {
-			fileCount++
-		}
-
-		// Absolute URL
-		url := url.URL{Path: baseurl + name}
-
-		i := &File{
-			Name:        f.Name(),
-			Size:        f.Size(),
-			ModTime:     f.ModTime(),
-			Mode:        f.Mode(),
-			IsDir:       f.IsDir(),
-			URL:         url.String(),
-			Extension:   filepath.Ext(name),
-			VirtualPath: filepath.Join(i.VirtualPath, name),
-			Path:        filepath.Join(i.Path, name),
-		}
-
-		i.GetFileType(false)
-		fileinfos = append(fileinfos, i)
-	}
-
-	i.Listing = &Listing{
-		Items:    fileinfos,
-		NumDirs:  dirCount,
-		NumFiles: fileCount,
-	}
-
-	return nil
-}
-
-// GetEditor gets the editor based on a Info struct
-func (i *File) GetEditor() error {
-	i.Language = editorLanguage(i.Extension)
-	// If the editor will hold only content, leave now.
-	if editorMode(i.Language) == "content" {
-		return nil
-	}
-
-	// If the file doesn't have any kind of metadata, leave now.
-	if !hasRune(i.Content) {
-		return nil
-	}
-
-	buffer := bytes.NewBuffer([]byte(i.Content))
-	page, err := parser.ReadFrom(buffer)
-
-	// If there is an error, just ignore it and return nil.
-	// This way, the file can be served for editing.
-	if err != nil {
-		return nil
-	}
-
-	i.Content = strings.TrimSpace(string(page.Content()))
-	i.Metadata = strings.TrimSpace(string(page.FrontMatter()))
-	return nil
-}
-
-// GetFileType obtains the mimetype and converts it to a simple
-// type nomenclature.
-func (i *File) GetFileType(checkContent bool) error {
-	var content []byte
-	var err error
-
-	// Tries to get the file mimetype using its extension.
-	mimetype := mime.TypeByExtension(i.Extension)
-
-	if mimetype == "" && checkContent {
-		file, err := os.Open(i.Path)
-		if err != nil {
-			return err
-		}
-		defer file.Close()
-
-		// Only the first 512 bytes are used to sniff the content type.
-		buffer := make([]byte, 512)
-		n, err := file.Read(buffer)
-		if err != nil && err != io.EOF {
-			return err
-		}
-
-		// Tries to get the file mimetype using its first
-		// 512 bytes.
-		mimetype = http.DetectContentType(buffer[:n])
-	}
-
-	if strings.HasPrefix(mimetype, "video") {
-		i.Type = "video"
-		return nil
-	}
-
-	if strings.HasPrefix(mimetype, "audio") {
-		i.Type = "audio"
-		return nil
-	}
-
-	if strings.HasPrefix(mimetype, "image") {
-		i.Type = "image"
-		return nil
-	}
-
-	if strings.HasPrefix(mimetype, "text") {
-		i.Type = "text"
-		goto End
-	}
-
-	if strings.HasPrefix(mimetype, "application/javascript") {
-		i.Type = "text"
-		goto End
-	}
-
-	// If the type isn't text (and is blob for example), it will check some
-	// common types that are mistaken not to be text.
-	if isInTextExtensions(i.Name) {
-		i.Type = "text"
-	} else {
-		i.Type = "blob"
-	}
-
-End:
-	// If the file type is text, save its content.
-	if i.Type == "text" && i.Size <= textExtensionsRenderMaxSize { // Avoiding files that are too large causes browsers to crash
-		if len(content) == 0 {
-			content, err = ioutil.ReadFile(i.Path)
-			if err != nil {
-				return err
-			}
-		}
-
-		i.Content = string(content)
-	}
-
-	return nil
-}
-
-// Checksum retrieves the checksum of a file.
-func (i File) Checksum(algo string) (string, error) {
-	file, err := os.Open(i.Path)
-	if err != nil {
-		return "", err
-	}
-
-	defer file.Close()
-
-	var h hash.Hash
-
-	switch algo {
-	case "md5":
-		h = md5.New()
-	case "sha1":
-		h = sha1.New()
-	case "sha256":
-		h = sha256.New()
-	case "sha512":
-		h = sha512.New()
-	default:
-		return "", ErrInvalidOption
-	}
-
-	_, err = io.Copy(h, file)
-	if err != nil {
-		return "", err
-	}
-
-	return hex.EncodeToString(h.Sum(nil)), nil
-}
-
-// CanBeEdited checks if the extension of a file is supported by the editor
-func (i File) CanBeEdited() bool {
-	return i.Type == "text"
-}
-
-// ApplySort applies the sort order using .Order and .Sort
-func (l Listing) ApplySort() {
-	// Check '.Order' to know how to sort
-	if l.Order == "desc" {
-		switch l.Sort {
-		case "name":
-			sort.Sort(sort.Reverse(byName(l)))
-		case "size":
-			sort.Sort(sort.Reverse(bySize(l)))
-		case "modified":
-			sort.Sort(sort.Reverse(byModified(l)))
-		default:
-			// If not one of the above, do nothing
-			return
-		}
-	} else { // If we had more Orderings we could add them here
-		switch l.Sort {
-		case "name":
-			sort.Sort(byName(l))
-		case "size":
-			sort.Sort(bySize(l))
-		case "modified":
-			sort.Sort(byModified(l))
-		default:
-			sort.Sort(byName(l))
-			return
-		}
-	}
-}
-
-// Implement sorting for Listing
-type byName Listing
-type bySize Listing
-type byModified Listing
-
-// By Name
-func (l byName) Len() int {
-	return len(l.Items)
-}
-
-func (l byName) Swap(i, j int) {
-	l.Items[i], l.Items[j] = l.Items[j], l.Items[i]
-}
-
-// Treat upper and lower case equally
-func (l byName) Less(i, j int) bool {
-	if l.Items[i].IsDir && !l.Items[j].IsDir {
-		return true
-	}
-
-	if !l.Items[i].IsDir && l.Items[j].IsDir {
-		return false
-	}
-
-	return natural.Less(l.Items[i].Name, l.Items[j].Name)
-}
-
-// By Size
-func (l bySize) Len() int {
-	return len(l.Items)
-}
-
-func (l bySize) Swap(i, j int) {
-	l.Items[i], l.Items[j] = l.Items[j], l.Items[i]
-}
-
-const directoryOffset = -1 << 31 // = math.MinInt32
-func (l bySize) Less(i, j int) bool {
-	iSize, jSize := l.Items[i].Size, l.Items[j].Size
-	if l.Items[i].IsDir {
-		iSize = directoryOffset + iSize
-	}
-	if l.Items[j].IsDir {
-		jSize = directoryOffset + jSize
-	}
-	return iSize < jSize
-}
-
-// By Modified
-func (l byModified) Len() int {
-	return len(l.Items)
-}
-
-func (l byModified) Swap(i, j int) {
-	l.Items[i], l.Items[j] = l.Items[j], l.Items[i]
-}
-
-func (l byModified) Less(i, j int) bool {
-	iModified, jModified := l.Items[i].ModTime, l.Items[j].ModTime
-	return iModified.Sub(jModified) < 0
-}
-
-// textExtensions is the sorted list of text extensions which
-// can be edited.
-var textExtensions = []string{
-	".ad", ".ada", ".adoc", ".asciidoc",
-	".bas", ".bash", ".bat",
-	".c", ".cc", ".cmd", ".conf", ".cpp", ".cr", ".cs", ".css", ".csv",
-	".d",
-	".f", ".f90",
-	".h", ".hh", ".hpp", ".htaccess", ".html",
-	".ini",
-	".java", ".js", ".json",
-	".markdown", ".md", ".mdown", ".mmark",
-	".nim",
-	".php", ".pl", ".ps1", ".py",
-	".rss", ".rst", ".rtf",
-	".sass", ".scss", ".sh", ".sty",
-	".tex", ".tml", ".toml", ".txt",
-	".vala", ".vapi",
-	".xml",
-	".yaml", ".yml",
-	"Caddyfile",
-}
-
-// isInTextExtensions checks if a file can be edited by its extensions.
-func isInTextExtensions(name string) bool {
-	search := filepath.Ext(name)
-	if search == "" {
-		search = name
-	}
-
-	i := sort.SearchStrings(textExtensions, search)
-	return i < len(textExtensions) && textExtensions[i] == search
-}
-
-// hasRune checks if the file has the frontmatter rune
-func hasRune(file string) bool {
-	return strings.HasPrefix(file, "---") ||
-		strings.HasPrefix(file, "+++") ||
-		strings.HasPrefix(file, "{")
-}
-
-func editorMode(language string) string {
-	switch language {
-	case "markdown", "asciidoc", "rst":
-		return "content+metadata"
-	}
-
-	return "content"
-}
-
-func editorLanguage(mode string) string {
-	mode = strings.TrimPrefix(mode, ".")
-
-	switch mode {
-	case "md", "markdown", "mdown", "mmark":
-		mode = "markdown"
-	case "yml":
-		mode = "yaml"
-	case "asciidoc", "adoc", "ad":
-		mode = "asciidoc"
-	case "rst":
-		mode = "rst"
-	case "html", "htm", "xml":
-		mode = "htmlmixed"
-	case "js":
-		mode = "javascript"
-	case "go":
-		mode = "golang"
-	case "":
-		mode = "text"
-	}
-
-	return mode
-}

lib/filebrowser.go

@@ -1,579 +0,0 @@
-package lib
-
-import (
-	"crypto/rand"
-	"errors"
-	"fmt"
-	"log"
-	"net/http"
-	"os"
-	"os/exec"
-	"reflect"
-	"regexp"
-	"strings"
-	"time"
-
-	"golang.org/x/crypto/bcrypt"
-
-	rice "github.com/GeertJohan/go.rice"
-	"github.com/hacdias/fileutils"
-	"github.com/mholt/caddy"
-	"github.com/robfig/cron"
-	"github.com/spf13/viper"
-)
-
-const (
-	// Version is the current File Browser version.
-	Version = "(untracked)"
-
-	ListViewMode   = "list"
-	MosaicViewMode = "mosaic"
-)
-
-var (
-	ErrExist              = errors.New("the resource already exists")
-	ErrNotExist           = errors.New("the resource does not exist")
-	ErrEmptyRequest       = errors.New("request body is empty")
-	ErrEmptyPassword      = errors.New("password is empty")
-	ErrEmptyUsername      = errors.New("username is empty")
-	ErrEmptyScope         = errors.New("scope is empty")
-	ErrWrongDataType      = errors.New("wrong data type")
-	ErrInvalidUpdateField = errors.New("invalid field to update")
-	ErrInvalidOption      = errors.New("invalid option")
-)
-
-// ReCaptcha settings.
-type ReCaptcha struct {
-	Host   string
-	Key    string
-	Secret string
-}
-
-// Auth settings.
-type Auth struct {
-	// Define if which of the following authentication mechansims should be used:
-	// - 'default', which requires a user and a password.
-	// - 'proxy', which requires a valid user and the user name has to be provided through an
-	//   http header.
-	// - 'none', which allows anyone to access the filebrowser instance.
-	Method string
-	// If 'Method' is set to 'proxy' the header configured below is used to identify the user.
-	Header string
-}
-
-// FileBrowser is a file manager instance. It should be creating using the
-// 'New' function and not directly.
-type FileBrowser struct {
-	// Cron job to manage schedulings.
-	Cron *cron.Cron
-
-	// The key used to sign the JWT tokens.
-	Key []byte
-
-	// The static assets.
-	Assets *rice.Box
-
-	// The Store is used to manage users, shareable links and
-	// other stuff that is saved on the database.
-	Store *Store
-
-	// PrefixURL is a part of the URL that is already trimmed from the request URL before it
-	// arrives to our handlers. It may be useful when using File Browser as a middleware
-	// such as in caddy-filemanager plugin. It is only useful in certain situations.
-	PrefixURL string
-
-	// BaseURL is the path where the GUI will be accessible. It musn't end with
-	// a trailing slash and mustn't contain PrefixURL, if set. It shouldn't be
-	// edited directly. Use SetBaseURL.
-	BaseURL string
-
-	// Authentication configuration.
-	Auth *Auth
-
-	// ReCaptcha host, key and secret.
-	ReCaptcha *ReCaptcha
-
-	// StaticGen is the static websit generator handler.
-	StaticGen StaticGen
-
-	// The Default User needed to build the New User page.
-	DefaultUser *User
-
-	// A map of events to a slice of commands.
-	Commands map[string][]string
-
-	// Global stylesheet.
-	CSS string
-
-	// NewFS should build a new file system for a given path.
-	NewFS FSBuilder
-}
-
-var commandEvents = []string{
-	"before_save",
-	"after_save",
-	"before_publish",
-	"after_publish",
-	"before_copy",
-	"after_copy",
-	"before_rename",
-	"after_rename",
-	"before_upload",
-	"after_upload",
-	"before_delete",
-	"after_delete",
-}
-
-// Command is a command function.
-type Command func(r *http.Request, m *FileBrowser, u *User) error
-
-// FSBuilder is the File System Builder.
-type FSBuilder func(scope string) FileSystem
-
-// Setup loads the configuration from the database and configures
-// the Assets and the Cron job. It must always be run after
-// creating a File Browser object.
-func (m *FileBrowser) Setup() error {
-	// Creates a new File Browser instance with the Users
-	// map and Assets box.
-	m.Assets = rice.MustFindBox("../frontend/dist")
-	m.Cron = cron.New()
-
-	// Tries to get the encryption key from the database.
-	// If it doesn't exist, create a new one of 256 bits.
-	err := m.Store.Config.Get("key", &m.Key)
-	if err != nil && err == ErrNotExist {
-		var bytes []byte
-		bytes, err = GenerateRandomBytes(64)
-		if err != nil {
-			return err
-		}
-
-		m.Key = bytes
-		err = m.Store.Config.Save("key", m.Key)
-	}
-
-	if err != nil {
-		return err
-	}
-
-	// Get the global CSS.
-	err = m.Store.Config.Get("css", &m.CSS)
-	if err != nil && err == ErrNotExist {
-		err = m.Store.Config.Save("css", "")
-	}
-
-	if err != nil {
-		return err
-	}
-
-	// Tries to get the event commands from the database.
-	// If they don't exist, initialize them.
-	err = m.Store.Config.Get("commands", &m.Commands)
-
-	if err == nil {
-		// Add hypothetically new command handlers.
-		for _, command := range commandEvents {
-			if _, ok := m.Commands[command]; ok {
-				continue
-			}
-
-			m.Commands[command] = []string{}
-		}
-	}
-
-	if err != nil && err == ErrNotExist {
-		m.Commands = map[string][]string{}
-
-		// Initialize the command handlers.
-		for _, command := range commandEvents {
-			m.Commands[command] = []string{}
-		}
-
-		err = m.Store.Config.Save("commands", m.Commands)
-	}
-
-	if err != nil {
-		return err
-	}
-
-	// Tries to fetch the users from the database.
-	users, err := m.Store.Users.Gets(m.NewFS)
-	if err != nil && err != ErrNotExist {
-		return err
-	}
-
-	// If there are no users in the database, it creates a new one
-	// based on 'base' User that must be provided by the function caller.
-	if len(users) == 0 {
-		viper.SetDefault("DEFAULT_USERNAME", "admin")
-
-		// Hashes the password.
-		defaultPassword, err := HashPassword("admin")
-		if err != nil {
-			return err
-		}
-		viper.SetDefault("DEFAULT_PASSWORD_HASH", defaultPassword)
-
-		u := *m.DefaultUser
-		u.Username = viper.GetString("DEFAULT_USERNAME")
-		u.Password = viper.GetString("DEFAULT_PASSWORD_HASH")
-
-		// The first user must be an administrator.
-		u.Admin = true
-		u.AllowCommands = true
-		u.AllowNew = true
-		u.AllowEdit = true
-		u.AllowPublish = true
-
-		// Saves the user to the database.
-		if err := m.Store.Users.Save(&u); err != nil {
-			return err
-		}
-	}
-
-	m.DefaultUser.Username = ""
-	m.DefaultUser.Password = ""
-
-	m.Cron.AddFunc("@hourly", m.ShareCleaner)
-	m.Cron.Start()
-
-	return nil
-}
-
-// RootURL returns the actual URL where
-// File Browser interface can be accessed.
-func (m FileBrowser) RootURL() string {
-	return m.PrefixURL + m.BaseURL
-}
-
-// SetPrefixURL updates the prefixURL of a File
-// Manager object.
-func (m *FileBrowser) SetPrefixURL(url string) {
-	url = strings.TrimPrefix(url, "/")
-	url = strings.TrimSuffix(url, "/")
-	url = "/" + url
-	m.PrefixURL = strings.TrimSuffix(url, "/")
-}
-
-// SetBaseURL updates the baseURL of a File Browser
-// object.
-func (m *FileBrowser) SetBaseURL(url string) {
-	url = strings.TrimPrefix(url, "/")
-	url = strings.TrimSuffix(url, "/")
-	url = "/" + url
-	m.BaseURL = strings.TrimSuffix(url, "/")
-}
-
-// Attach attaches a static generator to the current File Browser.
-func (m *FileBrowser) Attach(s StaticGen) error {
-	if reflect.TypeOf(s).Kind() != reflect.Ptr {
-		return errors.New("data should be a pointer to interface, not interface")
-	}
-
-	err := s.Setup()
-	if err != nil {
-		return err
-	}
-
-	m.StaticGen = s
-
-	err = m.Store.Config.Get("staticgen_"+s.Name(), s)
-	if err == ErrNotExist {
-		return m.Store.Config.Save("staticgen_"+s.Name(), s)
-	}
-
-	return err
-}
-
-// ShareCleaner removes sharing links that are no longer active.
-// This function is set to run periodically.
-func (m FileBrowser) ShareCleaner() {
-	// Get all links.
-	links, err := m.Store.Share.Gets()
-	if err != nil {
-		log.Print(err)
-		return
-	}
-
-	// Find the expired ones.
-	for i := range links {
-		if links[i].Expires && links[i].ExpireDate.Before(time.Now()) {
-			err = m.Store.Share.Delete(links[i].Hash)
-			if err != nil {
-				log.Print(err)
-			}
-		}
-	}
-}
-
-// Runner runs the commands for a certain event type.
-func (m FileBrowser) Runner(event string, path string, destination string, user *User) error {
-	commands := []string{}
-
-	// Get the commands from the File Browser instance itself.
-	if val, ok := m.Commands[event]; ok {
-		commands = append(commands, val...)
-	}
-
-	// Execute the commands.
-	for _, command := range commands {
-		args := strings.Split(command, " ")
-		nonblock := false
-
-		if len(args) > 1 && args[len(args)-1] == "&" {
-			// Run command in background; non-blocking
-			nonblock = true
-			args = args[:len(args)-1]
-		}
-
-		command, args, err := caddy.SplitCommandAndArgs(strings.Join(args, " "))
-		if err != nil {
-			return err
-		}
-
-		cmd := exec.Command(command, args...)
-		cmd.Env = append(os.Environ(), fmt.Sprintf("FILE=%s", path))
-		cmd.Env = append(cmd.Env, fmt.Sprintf("ROOT=%s", user.Scope))
-		cmd.Env = append(cmd.Env, fmt.Sprintf("TRIGGER=%s", event))
-		cmd.Env = append(cmd.Env, fmt.Sprintf("USERNAME=%s", user.Username))
-
-		if destination != "" {
-			cmd.Env = append(cmd.Env, fmt.Sprintf("DESTINATION=%s", destination))
-		}
-
-		cmd.Stdin = os.Stdin
-		cmd.Stdout = os.Stdout
-		cmd.Stderr = os.Stderr
-
-		if nonblock {
-			log.Printf("[INFO] Nonblocking Command:\"%s %s\"", command, strings.Join(args, " "))
-			if err := cmd.Start(); err != nil {
-				return err
-			}
-
-			continue
-		}
-
-		log.Printf("[INFO] Blocking Command:\"%s %s\"", command, strings.Join(args, " "))
-		if err := cmd.Run(); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-// DefaultUser is used on New, when no 'base' user is provided.
-var DefaultUser = User{
-	AllowCommands: true,
-	AllowEdit:     true,
-	AllowNew:      true,
-	AllowPublish:  true,
-	LockPassword:  false,
-	Commands:      []string{},
-	Rules:         []*Rule{},
-	CSS:           "",
-	Admin:         true,
-	Locale:        "",
-	Scope:         ".",
-	FileSystem:    fileutils.Dir("."),
-	ViewMode:      "mosaic",
-}
-
-// User contains the configuration for each user.
-type User struct {
-	// ID is the required primary key with auto increment0
-	ID int `storm:"id,increment"`
-
-	// Tells if this user is an admin.
-	Admin bool `json:"admin"`
-
-	// These indicate if the user can perform certain actions.
-	AllowCommands bool `json:"allowCommands"` // Execute commands
-	AllowEdit     bool `json:"allowEdit"`     // Edit/rename files
-	AllowNew      bool `json:"allowNew"`      // Create files and folders
-	AllowPublish  bool `json:"allowPublish"`  // Publish content (to use with static gen)
-
-	// Prevents the user to change its password.
-	LockPassword bool `json:"lockPassword"`
-
-	// Commands is the list of commands the user can execute.
-	Commands []string `json:"commands"`
-
-	// Custom styles for this user.
-	CSS string `json:"css"`
-
-	// FileSystem is the virtual file system the user has access.
-	FileSystem FileSystem `json:"-"`
-
-	// Locale is the language of the user.
-	Locale string `json:"locale"`
-
-	// The hashed password. This never reaches the front-end because it's temporarily
-	// emptied during JSON marshall.
-	Password string `json:"password"`
-
-	// Rules is an array of access and deny rules.
-	Rules []*Rule `json:"rules"`
-
-	// Scope is the path the user has access to.
-	Scope string `json:"filesystem"`
-
-	// Username is the user username used to login.
-	Username string `json:"username" storm:"index,unique"`
-
-	// User view mode for files and folders.
-	ViewMode string `json:"viewMode"`
-}
-
-// Allowed checks if the user has permission to access a directory/file.
-func (u User) Allowed(url string) bool {
-	var rule *Rule
-	i := len(u.Rules) - 1
-
-	for i >= 0 {
-		rule = u.Rules[i]
-
-		if rule.Regex {
-			if rule.Regexp.MatchString(url) {
-				return rule.Allow
-			}
-		} else if strings.HasPrefix(url, rule.Path) {
-			return rule.Allow
-		}
-
-		i--
-	}
-
-	return true
-}
-
-// Rule is a dissalow/allow rule.
-type Rule struct {
-	// Regex indicates if this rule uses Regular Expressions or not.
-	Regex bool `json:"regex"`
-
-	// Allow indicates if this is an allow rule. Set 'false' to be a disallow rule.
-	Allow bool `json:"allow"`
-
-	// Path is the corresponding URL path for this rule.
-	Path string `json:"path"`
-
-	// Regexp is the regular expression. Only use this when 'Regex' was set to true.
-	Regexp *Regexp `json:"regexp"`
-}
-
-// Regexp is a regular expression wrapper around native regexp.
-type Regexp struct {
-	Raw    string `json:"raw"`
-	regexp *regexp.Regexp
-}
-
-// MatchString checks if this string matches the regular expression.
-func (r *Regexp) MatchString(s string) bool {
-	if r.regexp == nil {
-		r.regexp = regexp.MustCompile(r.Raw)
-	}
-
-	return r.regexp.MatchString(s)
-}
-
-// ShareLink is the information needed to build a shareable link.
-type ShareLink struct {
-	Hash       string    `json:"hash" storm:"id,index"`
-	Path       string    `json:"path" storm:"index"`
-	Expires    bool      `json:"expires"`
-	ExpireDate time.Time `json:"expireDate"`
-}
-
-// Store is a collection of the stores needed to get
-// and save information.
-type Store struct {
-	Users  UsersStore
-	Config ConfigStore
-	Share  ShareStore
-}
-
-// UsersStore is the interface to manage users.
-type UsersStore interface {
-	Get(id int, builder FSBuilder) (*User, error)
-	GetByUsername(username string, builder FSBuilder) (*User, error)
-	Gets(builder FSBuilder) ([]*User, error)
-	Save(u *User) error
-	Update(u *User, fields ...string) error
-	Delete(id int) error
-}
-
-// ConfigStore is the interface to manage configuration.
-type ConfigStore interface {
-	Get(name string, to interface{}) error
-	Save(name string, from interface{}) error
-}
-
-// ShareStore is the interface to manage share links.
-type ShareStore interface {
-	Get(hash string) (*ShareLink, error)
-	GetPermanent(path string) (*ShareLink, error)
-	GetByPath(path string) ([]*ShareLink, error)
-	Gets() ([]*ShareLink, error)
-	Save(s *ShareLink) error
-	Delete(hash string) error
-}
-
-// StaticGen is a static website generator.
-type StaticGen interface {
-	SettingsPath() string
-	Name() string
-	Setup() error
-
-	Hook(c *Context, w http.ResponseWriter, r *http.Request) (int, error)
-	Preview(c *Context, w http.ResponseWriter, r *http.Request) (int, error)
-	Publish(c *Context, w http.ResponseWriter, r *http.Request) (int, error)
-}
-
-// FileSystem is the interface to work with the file system.
-type FileSystem interface {
-	Mkdir(name string, perm os.FileMode) error
-	OpenFile(name string, flag int, perm os.FileMode) (*os.File, error)
-	RemoveAll(name string) error
-	Rename(oldName, newName string) error
-	Stat(name string) (os.FileInfo, error)
-	Copy(src, dst string) error
-}
-
-// Context contains the needed information to make handlers work.
-type Context struct {
-	*FileBrowser
-	User *User
-	File *File
-	// On API handlers, Router is the APi handler we want.
-	Router string
-}
-
-// HashPassword generates an hash from a password using bcrypt.
-func HashPassword(password string) (string, error) {
-	bytes, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
-	return string(bytes), err
-}
-
-// CheckPasswordHash compares a password with an hash to check if they match.
-func CheckPasswordHash(password, hash string) bool {
-	err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
-	return err == nil
-}
-
-// GenerateRandomBytes returns securely generated random bytes.
-// It will return an fm.Error if the system's secure random
-// number generator fails to function correctly, in which
-// case the caller should not continue.
-func GenerateRandomBytes(n int) ([]byte, error) {
-	b := make([]byte, n)
-	_, err := rand.Read(b)
-	// Note that err == nil only if we read len(b) bytes.
-	if err != nil {
-		return nil, err
-	}
-
-	return b, nil
-}

lib/http/auth.go

@@ -1,218 +0,0 @@
-package http
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/url"
-	"strings"
-	"time"
-
-	"github.com/dgrijalva/jwt-go"
-	"github.com/dgrijalva/jwt-go/request"
-	fb "github.com/filebrowser/filebrowser/lib"
-)
-
-const reCaptchaAPI = "/recaptcha/api/siteverify"
-
-type cred struct {
-	Password  string `json:"password"`
-	Username  string `json:"username"`
-	ReCaptcha string `json:"recaptcha"`
-}
-
-// reCaptcha checks the reCaptcha code.
-func reCaptcha(host, secret, response string) (bool, error) {
-	body := url.Values{}
-	body.Set("secret", secret)
-	body.Add("response", response)
-
-	client := &http.Client{}
-
-	resp, err := client.Post(host+reCaptchaAPI, "application/x-www-form-urlencoded", strings.NewReader(body.Encode()))
-	if err != nil {
-		return false, err
-	}
-
-	if resp.StatusCode != http.StatusOK {
-		return false, nil
-	}
-
-	var data struct {
-		Success bool `json:"success"`
-	}
-
-	err = json.NewDecoder(resp.Body).Decode(&data)
-	if err != nil {
-		return false, err
-	}
-
-	return data.Success, nil
-}
-
-// authHandler processes the authentication for the user.
-func authHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	if c.Auth.Method == "none" {
-		// NoAuth instances shouldn't call this method.
-		return 0, nil
-	}
-
-	if c.Auth.Method == "proxy" {
-		// Receive the Username from the Header and check if it exists.
-		u, err := c.Store.Users.GetByUsername(r.Header.Get(c.Auth.Header), c.NewFS)
-		if err != nil {
-			return http.StatusForbidden, nil
-		}
-
-		c.User = u
-		return printToken(c, w)
-	}
-
-	// Receive the credentials from the request and unmarshal them.
-	var cred cred
-
-	if r.Body == nil {
-		return http.StatusForbidden, nil
-	}
-
-	err := json.NewDecoder(r.Body).Decode(&cred)
-	if err != nil {
-		return http.StatusForbidden, err
-	}
-
-	// If ReCaptcha is enabled, check the code.
-	if len(c.ReCaptcha.Secret) > 0 {
-		ok, err := reCaptcha(c.ReCaptcha.Host, c.ReCaptcha.Secret, cred.ReCaptcha)
-		if err != nil {
-			return http.StatusForbidden, err
-		}
-
-		if !ok {
-			return http.StatusForbidden, nil
-		}
-	}
-
-	// Checks if the user exists.
-	u, err := c.Store.Users.GetByUsername(cred.Username, c.NewFS)
-	if err != nil {
-		return http.StatusForbidden, nil
-	}
-
-	// Checks if the password is correct.
-	if !fb.CheckPasswordHash(cred.Password, u.Password) {
-		return http.StatusForbidden, nil
-	}
-
-	c.User = u
-	return printToken(c, w)
-}
-
-// renewAuthHandler is used when the front-end already has a JWT token
-// and is checking if it is up to date. If so, updates its info.
-func renewAuthHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	ok, u := validateAuth(c, r)
-	if !ok {
-		return http.StatusForbidden, nil
-	}
-
-	c.User = u
-	return printToken(c, w)
-}
-
-// claims is the JWT claims.
-type claims struct {
-	fb.User
-	jwt.StandardClaims
-}
-
-// printToken prints the final JWT token to the user.
-func printToken(c *fb.Context, w http.ResponseWriter) (int, error) {
-	// Creates a copy of the user and removes it password
-	// hash so it never arrives to the user.
-	u := fb.User{}
-	u = *c.User
-	u.Password = ""
-
-	// Builds the claims.
-	claims := claims{
-		u,
-		jwt.StandardClaims{
-			ExpiresAt: time.Now().Add(time.Hour * 24).Unix(),
-			Issuer:    "File Browser",
-		},
-	}
-
-	// Creates the token and signs it.
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
-	signed, err := token.SignedString(c.Key)
-
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	// Writes the token.
-	w.Header().Set("Content-Type", "cty")
-	w.Write([]byte(signed))
-	return 0, nil
-}
-
-type extractor []string
-
-func (e extractor) ExtractToken(r *http.Request) (string, error) {
-	token, _ := request.AuthorizationHeaderExtractor.ExtractToken(r)
-
-	// Checks if the token isn't empty and if it contains two dots.
-	// The former prevents incompatibility with URLs that previously
-	// used basic auth.
-	if token != "" && strings.Count(token, ".") == 2 {
-		return token, nil
-	}
-
-	cookie, err := r.Cookie("auth")
-	if err != nil {
-		return "", request.ErrNoTokenInRequest
-	}
-
-	return cookie.Value, nil
-}
-
-// validateAuth is used to validate the authentication and returns the
-// User if it is valid.
-func validateAuth(c *fb.Context, r *http.Request) (bool, *fb.User) {
-	if c.Auth.Method == "none" {
-		c.User = c.DefaultUser
-		return true, c.User
-	}
-
-	// If proxy auth is used do not verify the JWT token if the header is provided.
-	if c.Auth.Method == "proxy" {
-		u, err := c.Store.Users.GetByUsername(r.Header.Get(c.Auth.Header), c.NewFS)
-		if err != nil {
-			return false, nil
-		}
-		c.User = u
-		return true, c.User
-	}
-
-	keyFunc := func(token *jwt.Token) (interface{}, error) {
-		return c.Key, nil
-	}
-
-	var claims claims
-	token, err := request.ParseFromRequestWithClaims(r,
-		extractor{},
-		&claims,
-		keyFunc,
-	)
-
-	if err != nil || !token.Valid {
-		return false, nil
-	}
-
-	u, err := c.Store.Users.Get(claims.User.ID, c.NewFS)
-	if err != nil {
-		return false, nil
-	}
-
-	c.User = u
-	return true, u
-}

lib/http/download.go

@@ -1,102 +0,0 @@
-package http
-
-import (
-	"net/http"
-	"net/url"
-	"os"
-	"path/filepath"
-	"strings"
-
-	fb "github.com/filebrowser/filebrowser/lib"
-	"github.com/hacdias/fileutils"
-	"github.com/mholt/archiver"
-)
-
-// downloadHandler creates an archive in one of the supported formats (zip, tar,
-// tar.gz or tar.bz2) and sends it to be downloaded.
-func downloadHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	// If the file isn't a directory, serve it using http.ServeFile. We display it
-	// inline if it is requested.
-	if !c.File.IsDir {
-		return downloadFileHandler(c, w, r)
-	}
-
-	query := r.URL.Query().Get("format")
-	files := []string{}
-	names := strings.Split(r.URL.Query().Get("files"), ",")
-
-	// If there are files in the query, sanitize their names.
-	// Otherwise, just append the current path.
-	if len(names) != 0 {
-		for _, name := range names {
-			// Unescape the name.
-			name, err := url.QueryUnescape(strings.Replace(name, "+", "%2B", -1))
-			if err != nil {
-				return http.StatusInternalServerError, err
-			}
-
-			// Clean the slashes.
-			name = fileutils.SlashClean(name)
-			files = append(files, filepath.Join(c.File.Path, name))
-		}
-	} else {
-		files = append(files, c.File.Path)
-	}
-
-	var (
-		extension string
-		ar        archiver.Archiver
-	)
-
-	switch query {
-	// If the format is true, just set it to "zip".
-	case "zip", "true", "":
-		extension, ar = ".zip", archiver.Zip
-	case "tar":
-		extension, ar = ".tar", archiver.Tar
-	case "targz":
-		extension, ar = ".tar.gz", archiver.TarGz
-	case "tarbz2":
-		extension, ar = ".tar.bz2", archiver.TarBz2
-	case "tarxz":
-		extension, ar = ".tar.xz", archiver.TarXZ
-	default:
-		return http.StatusNotImplemented, nil
-	}
-
-	// Defines the file name.
-	name := c.File.Name
-	if name == "." || name == "" {
-		name = "archive"
-	}
-	name += extension
-
-	w.Header().Set("Content-Disposition", "attachment; filename*=utf-8''"+url.PathEscape(name))
-	err := ar.Write(w, files)
-
-	return 0, err
-}
-
-func downloadFileHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	file, err := os.Open(c.File.Path)
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-	defer file.Close()
-
-	stat, err := file.Stat()
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	if r.URL.Query().Get("inline") == "true" {
-		w.Header().Set("Content-Disposition", "inline")
-	} else {
-		// As per RFC6266 section 4.3
-		w.Header().Set("Content-Disposition", "attachment; filename*=utf-8''"+url.PathEscape(c.File.Name))
-	}
-
-	http.ServeContent(w, r, stat.Name(), stat.ModTime(), file)
-
-	return 0, nil
-}

lib/http/http.go

@@ -1,348 +0,0 @@
-package http
-
-import (
-	"encoding/json"
-	"html/template"
-	"log"
-	"net/http"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	fb "github.com/filebrowser/filebrowser/lib"
-)
-
-// Handler returns a function compatible with http.HandleFunc.
-func Handler(m *fb.FileBrowser) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		code, err := serve(&fb.Context{
-			FileBrowser: m,
-			User:        nil,
-			File:        nil,
-		}, w, r)
-
-		if code >= 400 {
-			w.WriteHeader(code)
-
-			txt := http.StatusText(code)
-			log.Printf("%v: %v %v\n", r.URL.Path, code, txt)
-			w.Write([]byte(txt + "\n"))
-		}
-
-		if err != nil {
-			log.Print(err)
-		}
-	})
-}
-
-// serve is the main entry point of this HTML application.
-func serve(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	// Checks if the URL contains the baseURL and strips it. Otherwise, it just
-	// returns a 404 fb.Error because we're not supposed to be here!
-	p := strings.TrimPrefix(r.URL.Path, c.BaseURL)
-
-	if len(p) >= len(r.URL.Path) && c.BaseURL != "" {
-		return http.StatusNotFound, nil
-	}
-
-	r.URL.Path = p
-
-	// Check if this request is made to the service worker. If so,
-	// pass it through a template to add the needed variables.
-	if r.URL.Path == "/sw.js" {
-		return renderFile(c, w, "sw.js")
-	}
-
-	// Checks if this request is made to the static assets folder. If so, and
-	// if it is a GET request, returns with the asset. Otherwise, returns
-	// a status not implemented.
-	if matchURL(r.URL.Path, "/static") {
-		if r.Method != http.MethodGet {
-			return http.StatusNotImplemented, nil
-		}
-
-		return staticHandler(c, w, r)
-	}
-
-	// Checks if this request is made to the API and directs to the
-	// API handler if so.
-	if matchURL(r.URL.Path, "/api") {
-		r.URL.Path = strings.TrimPrefix(r.URL.Path, "/api")
-		return apiHandler(c, w, r)
-	}
-
-	// If it is a request to the preview and a static website generator is
-	// active, build the preview.
-	if strings.HasPrefix(r.URL.Path, "/preview") && c.StaticGen != nil {
-		r.URL.Path = strings.TrimPrefix(r.URL.Path, "/preview")
-		return c.StaticGen.Preview(c, w, r)
-	}
-
-	if strings.HasPrefix(r.URL.Path, "/share/") {
-		r.URL.Path = strings.TrimPrefix(r.URL.Path, "/share/")
-		return sharePage(c, w, r)
-	}
-
-	// Any other request should show the index.html file.
-	w.Header().Set("x-frame-options", "SAMEORIGIN")
-	w.Header().Set("x-content-type-options", "nosniff")
-	w.Header().Set("x-xss-protection", "1; mode=block")
-
-	return renderFile(c, w, "index.html")
-}
-
-// staticHandler handles the static assets path.
-func staticHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	if r.URL.Path != "/static/manifest.json" {
-		http.FileServer(c.Assets.HTTPBox()).ServeHTTP(w, r)
-		return 0, nil
-	}
-
-	return renderFile(c, w, "static/manifest.json")
-}
-
-// apiHandler is the main entry point for the /api endpoint.
-func apiHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	if r.URL.Path == "/auth/get" {
-		return authHandler(c, w, r)
-	}
-
-	if r.URL.Path == "/auth/renew" {
-		return renewAuthHandler(c, w, r)
-	}
-
-	valid, _ := validateAuth(c, r)
-	if !valid {
-		return http.StatusForbidden, nil
-	}
-
-	c.Router, r.URL.Path = splitURL(r.URL.Path)
-
-	if !c.User.Allowed(r.URL.Path) {
-		return http.StatusForbidden, nil
-	}
-
-	if c.StaticGen != nil {
-		// If we are using the 'magic url' for the settings,
-		// we should redirect the request for the acutual path.
-		if r.URL.Path == "/settings" {
-			r.URL.Path = c.StaticGen.SettingsPath()
-		}
-
-		// Executes the Static website generator hook.
-		code, err := c.StaticGen.Hook(c, w, r)
-		if code != 0 || err != nil {
-			return code, err
-		}
-	}
-
-	if c.Router == "checksum" || c.Router == "download" || c.Router == "subtitle" || c.Router == "subtitles" {
-		var err error
-		c.File, err = fb.GetInfo(r.URL, c.FileBrowser, c.User)
-		if err != nil {
-			return ErrorToHTTP(err, false), err
-		}
-	}
-
-	var code int
-	var err error
-
-	switch c.Router {
-	case "download":
-		code, err = downloadHandler(c, w, r)
-	case "checksum":
-		code, err = checksumHandler(c, w, r)
-	case "command":
-		code, err = command(c, w, r)
-	case "search":
-		code, err = search(c, w, r)
-	case "resource":
-		code, err = resourceHandler(c, w, r)
-	case "users":
-		code, err = usersHandler(c, w, r)
-	case "settings":
-		code, err = settingsHandler(c, w, r)
-	case "share":
-		code, err = shareHandler(c, w, r)
-	case "subtitles":
-		code, err = subtitlesHandler(c, w, r)
-	case "subtitle":
-		code, err = subtitleHandler(c, w, r)
-	default:
-		code = http.StatusNotFound
-	}
-
-	return code, err
-}
-
-// serveChecksum calculates the hash of a file. Supports MD5, SHA1, SHA256 and SHA512.
-func checksumHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	query := r.URL.Query().Get("algo")
-
-	val, err := c.File.Checksum(query)
-	if err == fb.ErrInvalidOption {
-		return http.StatusBadRequest, err
-	} else if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	w.Write([]byte(val))
-	return 0, nil
-}
-
-// splitURL splits the path and returns everything that stands
-// before the first slash and everything that goes after.
-func splitURL(path string) (string, string) {
-	if path == "" {
-		return "", ""
-	}
-
-	path = strings.TrimPrefix(path, "/")
-
-	i := strings.Index(path, "/")
-	if i == -1 {
-		return "", path
-	}
-
-	return path[0:i], path[i:]
-}
-
-// renderFile renders a file using a template with some needed variables.
-func renderFile(c *fb.Context, w http.ResponseWriter, file string) (int, error) {
-	tpl := template.Must(template.New("file").Parse(c.Assets.MustString(file)))
-
-	var contentType string
-	switch filepath.Ext(file) {
-	case ".html":
-		contentType = "text/html"
-	case ".js":
-		contentType = "application/javascript"
-	case ".json":
-		contentType = "application/json"
-	default:
-		contentType = "text"
-	}
-
-	w.Header().Set("Content-Type", contentType+"; charset=utf-8")
-
-	data := map[string]interface{}{
-		"baseurl":       c.RootURL(),
-		"NoAuth":        c.Auth.Method == "none",
-		"Version":       fb.Version,
-		"CSS":           template.CSS(c.CSS),
-		"ReCaptcha":     c.ReCaptcha.Key != "" && c.ReCaptcha.Secret != "",
-		"ReCaptchaHost": c.ReCaptcha.Host,
-		"ReCaptchaKey":  c.ReCaptcha.Key,
-	}
-
-	if c.StaticGen != nil {
-		data["staticgen"] = c.StaticGen.Name()
-	}
-
-	err := tpl.Execute(w, data)
-
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	return 0, nil
-}
-
-// sharePage build the share page.
-func sharePage(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	s, err := c.Store.Share.Get(r.URL.Path)
-	if err == fb.ErrNotExist {
-		w.WriteHeader(http.StatusNotFound)
-		return renderFile(c, w, "static/share/404.html")
-	}
-
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	if s.Expires && s.ExpireDate.Before(time.Now()) {
-		c.Store.Share.Delete(s.Hash)
-		w.WriteHeader(http.StatusNotFound)
-		return renderFile(c, w, "static/share/404.html")
-	}
-
-	r.URL.Path = s.Path
-
-	info, err := os.Stat(s.Path)
-	if err != nil {
-		c.Store.Share.Delete(s.Hash)
-		return ErrorToHTTP(err, false), err
-	}
-
-	c.File = &fb.File{
-		Path:    s.Path,
-		Name:    info.Name(),
-		ModTime: info.ModTime(),
-		Mode:    info.Mode(),
-		IsDir:   info.IsDir(),
-		Size:    info.Size(),
-	}
-
-	dl := r.URL.Query().Get("dl")
-
-	if dl == "" || dl == "0" {
-		tpl := template.Must(template.New("file").Parse(c.Assets.MustString("static/share/index.html")))
-		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-
-		err := tpl.Execute(w, map[string]interface{}{
-			"baseurl": c.RootURL(),
-			"File":    c.File,
-		})
-
-		if err != nil {
-			return http.StatusInternalServerError, err
-		}
-		return 0, nil
-	}
-
-	return downloadHandler(c, w, r)
-}
-
-// renderJSON prints the JSON version of data to the browser.
-func renderJSON(w http.ResponseWriter, data interface{}) (int, error) {
-	marsh, err := json.Marshal(data)
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	w.Header().Set("Content-Type", "application/json; charset=utf-8")
-	if _, err := w.Write(marsh); err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	return 0, nil
-}
-
-// matchURL checks if the first URL matches the second.
-func matchURL(first, second string) bool {
-	first = strings.ToLower(first)
-	second = strings.ToLower(second)
-
-	return strings.HasPrefix(first, second)
-}
-
-// ErrorToHTTP converts errors to HTTP Status Code.
-func ErrorToHTTP(err error, gone bool) int {
-	switch {
-	case err == nil:
-		return http.StatusOK
-	case os.IsPermission(err):
-		return http.StatusForbidden
-	case os.IsNotExist(err):
-		if !gone {
-			return http.StatusNotFound
-		}
-
-		return http.StatusGone
-	case os.IsExist(err):
-		return http.StatusConflict
-	default:
-		return http.StatusInternalServerError
-	}
-}

lib/http/resource.go

@@ -1,386 +0,0 @@
-package http
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"log"
-	"net/http"
-	"net/url"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	fb "github.com/filebrowser/filebrowser/lib"
-	"github.com/hacdias/fileutils"
-)
-
-// sanitizeURL sanitizes the URL to prevent path transversal
-// using fileutils.SlashClean and adds the trailing slash bar.
-func sanitizeURL(url string) string {
-	path := fileutils.SlashClean(url)
-	if strings.HasSuffix(url, "/") && path != "/" {
-		return path + "/"
-	}
-	return path
-}
-
-func resourceHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	r.URL.Path = sanitizeURL(r.URL.Path)
-
-	switch r.Method {
-	case http.MethodGet:
-		return resourceGetHandler(c, w, r)
-	case http.MethodDelete:
-		return resourceDeleteHandler(c, w, r)
-	case http.MethodPut:
-		// Before save command handler.
-		path := filepath.Join(c.User.Scope, r.URL.Path)
-		if err := c.Runner("before_save", path, "", c.User); err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		code, err := resourcePostPutHandler(c, w, r)
-		if code != http.StatusOK {
-			return code, err
-		}
-
-		// After save command handler.
-		if err := c.Runner("after_save", path, "", c.User); err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		return code, err
-	case http.MethodPatch:
-		return resourcePatchHandler(c, w, r)
-	case http.MethodPost:
-		return resourcePostPutHandler(c, w, r)
-	}
-
-	return http.StatusNotImplemented, nil
-}
-
-func resourceGetHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	// Gets the information of the directory/file.
-	f, err := fb.GetInfo(r.URL, c.FileBrowser, c.User)
-	if err != nil {
-		return ErrorToHTTP(err, false), err
-	}
-
-	// If it's a dir and the path doesn't end with a trailing slash,
-	// add a trailing slash to the path.
-	if f.IsDir && !strings.HasSuffix(r.URL.Path, "/") {
-		r.URL.Path = r.URL.Path + "/"
-	}
-
-	// If it is a dir, go and serve the listing.
-	if f.IsDir {
-		c.File = f
-		return listingHandler(c, w, r)
-	}
-
-	// Tries to get the file type.
-	if err = f.GetFileType(true); err != nil {
-		return ErrorToHTTP(err, true), err
-	}
-
-	// Serve a preview if the file can't be edited or the
-	// user has no permission to edit this file. Otherwise,
-	// just serve the editor.
-	if !f.CanBeEdited() || !c.User.AllowEdit {
-		f.Kind = "preview"
-		return renderJSON(w, f)
-	}
-
-	f.Kind = "editor"
-
-	// Tries to get the editor data.
-	if err = f.GetEditor(); err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	return renderJSON(w, f)
-}
-
-func listingHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	f := c.File
-	f.Kind = "listing"
-
-	// Tries to get the listing data.
-	if err := f.GetListing(c.User, r); err != nil {
-		return ErrorToHTTP(err, true), err
-	}
-
-	listing := f.Listing
-
-	// Defines the cookie scope.
-	cookieScope := c.RootURL()
-	if cookieScope == "" {
-		cookieScope = "/"
-	}
-
-	// Copy the query values into the Listing struct
-	if sort, order, err := handleSortOrder(w, r, cookieScope); err == nil {
-		listing.Sort = sort
-		listing.Order = order
-	} else {
-		return http.StatusBadRequest, err
-	}
-
-	listing.ApplySort()
-	return renderJSON(w, f)
-}
-
-func resourceDeleteHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	// Prevent the removal of the root directory.
-	if r.URL.Path == "/" || !c.User.AllowEdit {
-		return http.StatusForbidden, nil
-	}
-
-	// Fire the before trigger.
-	if err := c.Runner("before_delete", r.URL.Path, "", c.User); err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	// Remove the file or folder.
-	err := c.User.FileSystem.RemoveAll(r.URL.Path)
-	if err != nil {
-		return ErrorToHTTP(err, true), err
-	}
-
-	// Fire the after trigger.
-	if err := c.Runner("after_delete", r.URL.Path, "", c.User); err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	return http.StatusOK, nil
-}
-
-func resourcePostPutHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	if !c.User.AllowNew && r.Method == http.MethodPost {
-		return http.StatusForbidden, nil
-	}
-
-	if !c.User.AllowEdit && r.Method == http.MethodPut {
-		return http.StatusForbidden, nil
-	}
-
-	// Discard any invalid upload before returning to avoid connection
-	// reset error.
-	defer func() {
-		io.Copy(ioutil.Discard, r.Body)
-	}()
-
-	// Checks if the current request is for a directory and not a file.
-	if strings.HasSuffix(r.URL.Path, "/") {
-		// If the method is PUT, we return 405 Method not Allowed, because
-		// POST should be used instead.
-		if r.Method == http.MethodPut {
-			return http.StatusMethodNotAllowed, nil
-		}
-
-		// Otherwise we try to create the directory.
-		err := c.User.FileSystem.Mkdir(r.URL.Path, 0775)
-		return ErrorToHTTP(err, false), err
-	}
-
-	// If using POST method, we are trying to create a new file so it is not
-	// desirable to override an already existent file. Thus, we check
-	// if the file already exists. If so, we just return a 409 Conflict.
-	if r.Method == http.MethodPost && r.Header.Get("Action") != "override" {
-		if _, err := c.User.FileSystem.Stat(r.URL.Path); err == nil {
-			return http.StatusConflict, errors.New("There is already a file on that path")
-		}
-	}
-
-	// Fire the before trigger.
-	if err := c.Runner("before_upload", r.URL.Path, "", c.User); err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	// Create/Open the file.
-	f, err := c.User.FileSystem.OpenFile(r.URL.Path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0775)
-	if err != nil {
-		return ErrorToHTTP(err, false), err
-	}
-	defer f.Close()
-
-	// Copies the new content for the file.
-	_, err = io.Copy(f, r.Body)
-	if err != nil {
-		return ErrorToHTTP(err, false), err
-	}
-
-	// Gets the info about the file.
-	fi, err := f.Stat()
-	if err != nil {
-		return ErrorToHTTP(err, false), err
-	}
-
-	// Check if this instance has a Static Generator and handles publishing
-	// or scheduling if it's the case.
-	if c.StaticGen != nil {
-		code, err := resourcePublishSchedule(c, w, r)
-		if code != 0 {
-			return code, err
-		}
-	}
-
-	// Writes the ETag Header.
-	etag := fmt.Sprintf(`"%x%x"`, fi.ModTime().UnixNano(), fi.Size())
-	w.Header().Set("ETag", etag)
-
-	// Fire the after trigger.
-	if err := c.Runner("after_upload", r.URL.Path, "", c.User); err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	return http.StatusOK, nil
-}
-
-func resourcePublishSchedule(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	publish := r.Header.Get("Publish")
-	schedule := r.Header.Get("Schedule")
-
-	if publish != "true" && schedule == "" {
-		return 0, nil
-	}
-
-	if !c.User.AllowPublish {
-		return http.StatusForbidden, nil
-	}
-
-	if publish == "true" {
-		return resourcePublish(c, w, r)
-	}
-
-	t, err := time.Parse("2006-01-02T15:04", schedule)
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	c.Cron.AddFunc(t.Format("05 04 15 02 01 *"), func() {
-		_, err := resourcePublish(c, w, r)
-		if err != nil {
-			log.Print(err)
-		}
-	})
-
-	return http.StatusOK, nil
-}
-
-func resourcePublish(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	path := filepath.Join(c.User.Scope, r.URL.Path)
-
-	// Before save command handler.
-	if err := c.Runner("before_publish", path, "", c.User); err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	code, err := c.StaticGen.Publish(c, w, r)
-	if err != nil {
-		return code, err
-	}
-
-	// Executed the before publish command.
-	if err := c.Runner("before_publish", path, "", c.User); err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	return code, nil
-}
-
-// resourcePatchHandler is the entry point for resource handler.
-func resourcePatchHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	if !c.User.AllowEdit {
-		return http.StatusForbidden, nil
-	}
-
-	dst := r.Header.Get("Destination")
-	action := r.Header.Get("Action")
-	dst, err := url.QueryUnescape(dst)
-	if err != nil {
-		return ErrorToHTTP(err, true), err
-	}
-
-	src := r.URL.Path
-
-	if dst == "/" || src == "/" {
-		return http.StatusForbidden, nil
-	}
-
-	if action == "copy" {
-		// Fire the after trigger.
-		if err := c.Runner("before_copy", src, dst, c.User); err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		// Copy the file.
-		err = c.User.FileSystem.Copy(src, dst)
-
-		// Fire the after trigger.
-		if err := c.Runner("after_copy", src, dst, c.User); err != nil {
-			return http.StatusInternalServerError, err
-		}
-	} else {
-		// Fire the after trigger.
-		if err := c.Runner("before_rename", src, dst, c.User); err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		// Rename the file.
-		err = c.User.FileSystem.Rename(src, dst)
-
-		// Fire the after trigger.
-		if err := c.Runner("after_rename", src, dst, c.User); err != nil {
-			return http.StatusInternalServerError, err
-		}
-	}
-
-	return ErrorToHTTP(err, true), err
-}
-
-// handleSortOrder gets and stores for a Listing the 'sort' and 'order',
-// and reads 'limit' if given. The latter is 0 if not given. Sets cookies.
-func handleSortOrder(w http.ResponseWriter, r *http.Request, scope string) (sort string, order string, err error) {
-	sort = r.URL.Query().Get("sort")
-	order = r.URL.Query().Get("order")
-
-	// If the query 'sort' or 'order' is empty, use defaults or any values
-	// previously saved in Cookies.
-	switch sort {
-	case "":
-		sort = "name"
-		if sortCookie, sortErr := r.Cookie("sort"); sortErr == nil {
-			sort = sortCookie.Value
-		}
-	case "name", "size":
-		http.SetCookie(w, &http.Cookie{
-			Name:   "sort",
-			Value:  sort,
-			MaxAge: 31536000,
-			Path:   scope,
-			Secure: r.TLS != nil,
-		})
-	}
-
-	switch order {
-	case "":
-		order = "asc"
-		if orderCookie, orderErr := r.Cookie("order"); orderErr == nil {
-			order = orderCookie.Value
-		}
-	case "asc", "desc":
-		http.SetCookie(w, &http.Cookie{
-			Name:   "order",
-			Value:  order,
-			MaxAge: 31536000,
-			Path:   scope,
-			Secure: r.TLS != nil,
-		})
-	}
-
-	return
-}

lib/http/settings.go

@@ -1,146 +0,0 @@
-package http
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"reflect"
-
-	fb "github.com/filebrowser/filebrowser/lib"
-	"github.com/mitchellh/mapstructure"
-)
-
-type modifySettingsRequest struct {
-	modifyRequest
-	Data struct {
-		CSS       string                 `json:"css"`
-		Commands  map[string][]string    `json:"commands"`
-		StaticGen map[string]interface{} `json:"staticGen"`
-	} `json:"data"`
-}
-
-type option struct {
-	Variable string      `json:"variable"`
-	Name     string      `json:"name"`
-	Value    interface{} `json:"value"`
-}
-
-func parsePutSettingsRequest(r *http.Request) (*modifySettingsRequest, error) {
-	// Checks if the request body is empty.
-	if r.Body == nil {
-		return nil, fb.ErrEmptyRequest
-	}
-
-	// Parses the request body and checks if it's well formed.
-	mod := &modifySettingsRequest{}
-	err := json.NewDecoder(r.Body).Decode(mod)
-	if err != nil {
-		return nil, err
-	}
-
-	// Checks if the request type is right.
-	if mod.What != "settings" {
-		return nil, fb.ErrWrongDataType
-	}
-
-	return mod, nil
-}
-
-func settingsHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	if r.URL.Path != "" && r.URL.Path != "/" {
-		return http.StatusNotFound, nil
-	}
-
-	switch r.Method {
-	case http.MethodGet:
-		return settingsGetHandler(c, w, r)
-	case http.MethodPut:
-		return settingsPutHandler(c, w, r)
-	}
-
-	return http.StatusMethodNotAllowed, nil
-}
-
-type settingsGetRequest struct {
-	CSS       string              `json:"css"`
-	Commands  map[string][]string `json:"commands"`
-	StaticGen []option            `json:"staticGen"`
-}
-
-func settingsGetHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	if !c.User.Admin {
-		return http.StatusForbidden, nil
-	}
-
-	result := &settingsGetRequest{
-		Commands:  c.Commands,
-		StaticGen: []option{},
-		CSS:       c.CSS,
-	}
-
-	if c.StaticGen != nil {
-		t := reflect.TypeOf(c.StaticGen).Elem()
-
-		for i := 0; i < t.NumField(); i++ {
-			if t.Field(i).Name[0] == bytes.ToLower([]byte{t.Field(i).Name[0]})[0] {
-				continue
-			}
-
-			result.StaticGen = append(result.StaticGen, option{
-				Variable: t.Field(i).Name,
-				Name:     t.Field(i).Tag.Get("name"),
-				Value:    reflect.ValueOf(c.StaticGen).Elem().FieldByName(t.Field(i).Name).Interface(),
-			})
-		}
-	}
-
-	return renderJSON(w, result)
-}
-
-func settingsPutHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	if !c.User.Admin {
-		return http.StatusForbidden, nil
-	}
-
-	mod, err := parsePutSettingsRequest(r)
-	if err != nil {
-		return http.StatusBadRequest, err
-	}
-
-	// Update the commands.
-	if mod.Which == "commands" {
-		if err := c.Store.Config.Save("commands", mod.Data.Commands); err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		c.Commands = mod.Data.Commands
-		return http.StatusOK, nil
-	}
-
-	// Update the global CSS.
-	if mod.Which == "css" {
-		if err := c.Store.Config.Save("css", mod.Data.CSS); err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		c.CSS = mod.Data.CSS
-		return http.StatusOK, nil
-	}
-
-	// Update the static generator options.
-	if mod.Which == "staticGen" {
-		err = mapstructure.Decode(mod.Data.StaticGen, c.StaticGen)
-		if err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		err = c.Store.Config.Save("staticgen_"+c.StaticGen.Name(), c.StaticGen)
-		if err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		return http.StatusOK, nil
-	}
-
-	return http.StatusMethodNotAllowed, nil
-}

lib/http/share.go

@@ -1,127 +0,0 @@
-package http
-
-import (
-	"encoding/base64"
-	"net/http"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"time"
-
-	fb "github.com/filebrowser/filebrowser/lib"
-)
-
-func shareHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	r.URL.Path = sanitizeURL(r.URL.Path)
-
-	switch r.Method {
-	case http.MethodGet:
-		return shareGetHandler(c, w, r)
-	case http.MethodDelete:
-		return shareDeleteHandler(c, w, r)
-	case http.MethodPost:
-		return sharePostHandler(c, w, r)
-	}
-
-	return http.StatusNotImplemented, nil
-}
-
-func shareGetHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	path := filepath.Join(c.User.Scope, r.URL.Path)
-	s, err := c.Store.Share.GetByPath(path)
-	if err == fb.ErrNotExist {
-		return http.StatusNotFound, nil
-	}
-
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	for i, link := range s {
-		if link.Expires && link.ExpireDate.Before(time.Now()) {
-			c.Store.Share.Delete(link.Hash)
-			s = append(s[:i], s[i+1:]...)
-		}
-	}
-
-	if len(s) == 0 {
-		return http.StatusNotFound, nil
-	}
-
-	return renderJSON(w, s)
-}
-
-func sharePostHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	path := filepath.Join(c.User.Scope, r.URL.Path)
-
-	var s *fb.ShareLink
-	expire := r.URL.Query().Get("expires")
-	unit := r.URL.Query().Get("unit")
-
-	if expire == "" {
-		var err error
-		s, err = c.Store.Share.GetPermanent(path)
-		if err == nil {
-			w.Write([]byte(c.RootURL() + "/share/" + s.Hash))
-			return 0, nil
-		}
-	}
-
-	bytes, err := fb.GenerateRandomBytes(6)
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	str := base64.URLEncoding.EncodeToString(bytes)
-
-	s = &fb.ShareLink{
-		Path:    path,
-		Hash:    str,
-		Expires: expire != "",
-	}
-
-	if expire != "" {
-		num, err := strconv.Atoi(expire)
-		if err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		var add time.Duration
-		switch unit {
-		case "seconds":
-			add = time.Second * time.Duration(num)
-		case "minutes":
-			add = time.Minute * time.Duration(num)
-		case "days":
-			add = time.Hour * 24 * time.Duration(num)
-		default:
-			add = time.Hour * time.Duration(num)
-		}
-
-		s.ExpireDate = time.Now().Add(add)
-	}
-
-	if err := c.Store.Share.Save(s); err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	return renderJSON(w, s)
-}
-
-func shareDeleteHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	s, err := c.Store.Share.Get(strings.TrimPrefix(r.URL.Path, "/"))
-	if err == fb.ErrNotExist {
-		return http.StatusNotFound, nil
-	}
-
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	err = c.Store.Share.Delete(s.Hash)
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	return http.StatusOK, nil
-}

lib/http/subtitle.go

@@ -1,83 +0,0 @@
-package http
-
-import (
-	"bytes"
-	"io/ioutil"
-	"net/http"
-	"os"
-	"path/filepath"
-	"regexp"
-
-	fb "github.com/filebrowser/filebrowser/lib"
-)
-
-func subtitlesHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	files, err := readDir(filepath.Dir(c.File.Path))
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-	subtitles := make([]map[string]string, 0)
-	for _, file := range files {
-		ext := filepath.Ext(file.Name())
-		if ext == ".vtt" || ext == ".srt" {
-			sub := make(map[string]string)
-			sub["src"] = filepath.Dir(c.File.Path) + "/" + file.Name()
-			sub["kind"] = "subtitles"
-			sub["label"] = file.Name()
-			subtitles = append(subtitles, sub)
-		}
-	}
-	return renderJSON(w, subtitles)
-}
-
-func subtitleHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	str, err := cleanSubtitle(c.File.Path)
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	file, err := os.Open(c.File.Path)
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-	defer file.Close()
-
-	stat, err := file.Stat()
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	w.Header().Set("Content-Disposition", "inline")
-	w.Header().Set("Content-Type", "text/vtt")
-	http.ServeContent(w, r, stat.Name(), stat.ModTime(), bytes.NewReader([]byte(str)))
-
-	return 0, nil
-
-}
-
-func cleanSubtitle(filename string) (string, error) {
-	b, err := ioutil.ReadFile(filename)
-	if err != nil {
-		return "", err
-	}
-	str := string(b) // convert content to a 'string'
-	ext := filepath.Ext(filename)
-	if ext == ".srt" {
-		re := regexp.MustCompile("([0-9]{2}:[0-9]{2}:[0-9]{2}),([0-9]{3})")
-		str = "WEBVTT\n\n" + re.ReplaceAllString(str, "$1.$2")
-	}
-	return str, err
-}
-
-func readDir(dirname string) ([]os.FileInfo, error) {
-	f, err := os.Open(dirname)
-	if err != nil {
-		return nil, err
-	}
-	list, err := f.Readdir(-1)
-	f.Close()
-	if err != nil {
-		return nil, err
-	}
-	return list, nil
-}

lib/http/users.go

@@ -1,383 +0,0 @@
-package http
-
-import (
-	"encoding/json"
-	"errors"
-	"net/http"
-	"os"
-	"sort"
-	"strconv"
-	"strings"
-
-	fb "github.com/filebrowser/filebrowser/lib"
-)
-
-type modifyRequest struct {
-	What  string `json:"what"`  // Answer to: what data type?
-	Which string `json:"which"` // Answer to: which field?
-}
-
-type modifyUserRequest struct {
-	modifyRequest
-	Data *fb.User `json:"data"`
-}
-
-// usersHandler is the entry point of the users API. It's just a router
-// to send the request to its
-func usersHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	// If the user isn't admin and isn't making a PUT
-	// request, then return forbidden.
-	if !c.User.Admin && r.Method != http.MethodPut {
-		return http.StatusForbidden, nil
-	}
-
-	switch r.Method {
-	case http.MethodGet:
-		return usersGetHandler(c, w, r)
-	case http.MethodPost:
-		return usersPostHandler(c, w, r)
-	case http.MethodDelete:
-		return usersDeleteHandler(c, w, r)
-	case http.MethodPut:
-		return usersPutHandler(c, w, r)
-	}
-
-	return http.StatusNotImplemented, nil
-}
-
-// getUserID returns the id from the user which is present
-// in the request url. If the url is invalid and doesn't
-// contain a valid ID, it returns an fb.Error.
-func getUserID(r *http.Request) (int, error) {
-	// Obtains the ID in string from the URL and converts
-	// it into an integer.
-	sid := strings.TrimPrefix(r.URL.Path, "/")
-	sid = strings.TrimSuffix(sid, "/")
-	id, err := strconv.Atoi(sid)
-	if err != nil {
-		return http.StatusBadRequest, err
-	}
-
-	return id, nil
-}
-
-// getUser returns the user which is present in the request
-// body. If the body is empty or the JSON is invalid, it
-// returns an fb.Error.
-func getUser(c *fb.Context, r *http.Request) (*fb.User, string, error) {
-	// Checks if the request body is empty.
-	if r.Body == nil {
-		return nil, "", fb.ErrEmptyRequest
-	}
-
-	// Parses the request body and checks if it's well formed.
-	mod := &modifyUserRequest{}
-	err := json.NewDecoder(r.Body).Decode(mod)
-	if err != nil {
-		return nil, "", err
-	}
-
-	// Checks if the request type is right.
-	if mod.What != "user" {
-		return nil, "", fb.ErrWrongDataType
-	}
-
-	mod.Data.FileSystem = c.NewFS(mod.Data.Scope)
-	return mod.Data, mod.Which, nil
-}
-
-func usersGetHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	// Request for the default user data.
-	if r.URL.Path == "/base" {
-		return renderJSON(w, c.DefaultUser)
-	}
-
-	// Request for the listing of users.
-	if r.URL.Path == "/" {
-		users, err := c.Store.Users.Gets(c.NewFS)
-		if err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		for _, u := range users {
-			// Removes the user password so it won't
-			// be sent to the front-end.
-			u.Password = ""
-		}
-
-		sort.Slice(users, func(i, j int) bool {
-			return users[i].ID < users[j].ID
-		})
-
-		return renderJSON(w, users)
-	}
-
-	id, err := getUserID(r)
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	u, err := c.Store.Users.Get(id, c.NewFS)
-	if err == fb.ErrExist {
-		return http.StatusNotFound, err
-	}
-
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	u.Password = ""
-	return renderJSON(w, u)
-}
-
-func usersPostHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	if r.URL.Path != "/" {
-		return http.StatusMethodNotAllowed, nil
-	}
-
-	u, _, err := getUser(c, r)
-	if err != nil {
-		return http.StatusBadRequest, err
-	}
-
-	// Checks if username isn't empty.
-	if u.Username == "" {
-		return http.StatusBadRequest, fb.ErrEmptyUsername
-	}
-
-	// Checks if scope isn't empty.
-	if u.Scope == "" {
-		return http.StatusBadRequest, fb.ErrEmptyScope
-	}
-
-	// Checks if password isn't empty.
-	if u.Password == "" {
-		return http.StatusBadRequest, fb.ErrEmptyPassword
-	}
-
-	// Initialize rules if they're not initialized.
-	if u.Rules == nil {
-		u.Rules = []*fb.Rule{}
-	}
-
-	// If the view mode is empty, initialize with the default one.
-	if u.ViewMode == "" {
-		u.ViewMode = c.DefaultUser.ViewMode
-	}
-
-	// Initialize commands if not initialized.
-	if u.Commands == nil {
-		u.Commands = []string{}
-	}
-
-	// It's a new user so the ID will be auto created.
-	if u.ID != 0 {
-		u.ID = 0
-	}
-
-	// Checks if the scope exists.
-	if code, err := checkFS(u.Scope); err != nil {
-		return code, err
-	}
-
-	// Hashes the password.
-	pw, err := fb.HashPassword(u.Password)
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	u.Password = pw
-	u.ViewMode = fb.MosaicViewMode
-
-	// Saves the user to the database.
-	err = c.Store.Users.Save(u)
-	if err == fb.ErrExist {
-		return http.StatusConflict, err
-	}
-
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	// Set the Location header and return.
-	w.Header().Set("Location", "/settings/users/"+strconv.Itoa(u.ID))
-	w.WriteHeader(http.StatusCreated)
-	return 0, nil
-}
-
-func checkFS(path string) (int, error) {
-	info, err := os.Stat(path)
-
-	if err != nil {
-		if !os.IsNotExist(err) {
-			return http.StatusInternalServerError, err
-		}
-
-		err = os.MkdirAll(path, 0666)
-		if err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		return 0, nil
-	}
-
-	if !info.IsDir() {
-		return http.StatusBadRequest, errors.New("Scope is not a dir")
-	}
-
-	return 0, nil
-}
-
-func usersDeleteHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	if r.URL.Path == "/" {
-		return http.StatusMethodNotAllowed, nil
-	}
-
-	id, err := getUserID(r)
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	// Deletes the user from the database.
-	err = c.Store.Users.Delete(id)
-	if err == fb.ErrNotExist {
-		return http.StatusNotFound, fb.ErrNotExist
-	}
-
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	return http.StatusOK, nil
-}
-
-func usersPutHandler(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	// New users should be created on /api/users.
-	if r.URL.Path == "/" {
-		return http.StatusMethodNotAllowed, nil
-	}
-
-	// Gets the user ID from the URL and checks if it's valid.
-	id, err := getUserID(r)
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	// Checks if the user has permission to access this page.
-	if !c.User.Admin && id != c.User.ID {
-		return http.StatusForbidden, nil
-	}
-
-	// Gets the user from the request body.
-	u, which, err := getUser(c, r)
-	if err != nil {
-		return http.StatusBadRequest, err
-	}
-
-	// If we're updating the default user. Only for NoAuth
-	// implementations. Used to change the viewMode.
-	if id == 0 && c.Auth.Method == "none" {
-		c.DefaultUser.ViewMode = u.ViewMode
-		return http.StatusOK, nil
-	}
-
-	// Updates the CSS and locale.
-	if which == "partial" {
-		c.User.CSS = u.CSS
-		c.User.Locale = u.Locale
-		c.User.ViewMode = u.ViewMode
-
-		err = c.Store.Users.Update(c.User, "CSS", "Locale", "ViewMode")
-		if err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		return http.StatusOK, nil
-	}
-
-	// Updates the Password.
-	if which == "password" {
-		if u.Password == "" {
-			return http.StatusBadRequest, fb.ErrEmptyPassword
-		}
-
-		if id == c.User.ID && c.User.LockPassword {
-			return http.StatusForbidden, nil
-		}
-
-		c.User.Password, err = fb.HashPassword(u.Password)
-		if err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		err = c.Store.Users.Update(c.User, "Password")
-		if err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		return http.StatusOK, nil
-	}
-
-	// If can only be all.
-	if which != "all" {
-		return http.StatusBadRequest, fb.ErrInvalidUpdateField
-	}
-
-	// Checks if username isn't empty.
-	if u.Username == "" {
-		return http.StatusBadRequest, fb.ErrEmptyUsername
-	}
-
-	// Checks if filesystem isn't empty.
-	if u.Scope == "" {
-		return http.StatusBadRequest, fb.ErrEmptyScope
-	}
-
-	// Checks if the scope exists.
-	if code, err := checkFS(u.Scope); err != nil {
-		return code, err
-	}
-
-	// Initialize rules if they're not initialized.
-	if u.Rules == nil {
-		u.Rules = []*fb.Rule{}
-	}
-
-	// Initialize commands if not initialized.
-	if u.Commands == nil {
-		u.Commands = []string{}
-	}
-
-	// Gets the current saved user from the in-memory map.
-	suser, err := c.Store.Users.Get(id, c.NewFS)
-	if err == fb.ErrNotExist {
-		return http.StatusNotFound, nil
-	}
-
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	u.ID = id
-
-	// Changes the password if the request wants it.
-	if u.Password != "" {
-		pw, err := fb.HashPassword(u.Password)
-		if err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		u.Password = pw
-	} else {
-		u.Password = suser.Password
-	}
-
-	// Updates the whole User struct because we always are supposed
-	// to send a new entire object.
-	err = c.Store.Users.Update(u)
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	return http.StatusOK, nil
-}

lib/http/websockets.go

@@ -1,349 +0,0 @@
-package http
-
-import (
-	"bytes"
-	"encoding/json"
-	"mime"
-	"net/http"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"time"
-
-	fb "github.com/filebrowser/filebrowser/lib"
-	"github.com/gorilla/websocket"
-)
-
-var upgrader = websocket.Upgrader{
-	ReadBufferSize:  1024,
-	WriteBufferSize: 1024,
-}
-
-var (
-	cmdNotImplemented = []byte("Command not implemented.")
-	cmdNotAllowed     = []byte("Command not allowed.")
-)
-
-// command handles the requests for VCS related commands: git, svn and mercurial
-func command(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	// Upgrades the connection to a websocket and checks for fb.Errors.
-	conn, err := upgrader.Upgrade(w, r, nil)
-	if err != nil {
-		return 0, err
-	}
-	defer conn.Close()
-
-	var (
-		message []byte
-		command []string
-	)
-
-	// Starts an infinite loop until a valid command is captured.
-	for {
-		_, message, err = conn.ReadMessage()
-		if err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		command = strings.Split(string(message), " ")
-		if len(command) != 0 {
-			break
-		}
-	}
-
-	// Check if the command is allowed
-	allowed := false
-
-	for _, cmd := range c.User.Commands {
-		if regexp.MustCompile(cmd).MatchString(command[0]) {
-			allowed = true
-			break
-		}
-	}
-
-	if !allowed {
-		err = conn.WriteMessage(websocket.TextMessage, cmdNotAllowed)
-		if err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		return 0, nil
-	}
-
-	// Check if the program is installed on the computer.
-	if _, err = exec.LookPath(command[0]); err != nil {
-		err = conn.WriteMessage(websocket.TextMessage, cmdNotImplemented)
-		if err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		return http.StatusNotImplemented, nil
-	}
-
-	// Gets the path and initializes a buffer.
-	path := c.User.Scope + "/" + r.URL.Path
-	path = filepath.Clean(path)
-	buff := new(bytes.Buffer)
-
-	// Sets up the command executation.
-	cmd := exec.Command(command[0], command[1:]...)
-	cmd.Dir = path
-	cmd.Stderr = buff
-	cmd.Stdout = buff
-
-	// Starts the command and checks for fb.Errors.
-	err = cmd.Start()
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	// Set a 'done' variable to check whetever the command has already finished
-	// running or not. This verification is done using a goroutine that uses the
-	// method .Wait() from the command.
-	done := false
-	go func() {
-		err = cmd.Wait()
-		done = true
-	}()
-
-	// Function to print the current information on the buffer to the connection.
-	print := func() error {
-		by := buff.Bytes()
-		if len(by) > 0 {
-			err = conn.WriteMessage(websocket.TextMessage, by)
-			if err != nil {
-				return err
-			}
-		}
-
-		return nil
-	}
-
-	// While the command hasn't finished running, continue sending the output
-	// to the client in intervals of 100 milliseconds.
-	for !done {
-		if err = print(); err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		time.Sleep(100 * time.Millisecond)
-	}
-
-	// After the command is done executing, send the output one more time to the
-	// browser to make sure it gets the latest information.
-	if err = print(); err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	return 0, nil
-}
-
-var (
-	typeRegexp = regexp.MustCompile(`type:(\w+)`)
-)
-
-type condition func(path string) bool
-
-type searchOptions struct {
-	CaseSensitive bool
-	Conditions    []condition
-	Terms         []string
-}
-
-func extensionCondition(extension string) condition {
-	return func(path string) bool {
-		return filepath.Ext(path) == "."+extension
-	}
-}
-
-func imageCondition(path string) bool {
-	extension := filepath.Ext(path)
-	mimetype := mime.TypeByExtension(extension)
-
-	return strings.HasPrefix(mimetype, "image")
-}
-
-func audioCondition(path string) bool {
-	extension := filepath.Ext(path)
-	mimetype := mime.TypeByExtension(extension)
-
-	return strings.HasPrefix(mimetype, "audio")
-}
-
-func videoCondition(path string) bool {
-	extension := filepath.Ext(path)
-	mimetype := mime.TypeByExtension(extension)
-
-	return strings.HasPrefix(mimetype, "video")
-}
-
-func parseSearch(value string) *searchOptions {
-	opts := &searchOptions{
-		CaseSensitive: strings.Contains(value, "case:sensitive"),
-		Conditions:    []condition{},
-		Terms:         []string{},
-	}
-
-	// removes the options from the value
-	value = strings.Replace(value, "case:insensitive", "", -1)
-	value = strings.Replace(value, "case:sensitive", "", -1)
-	value = strings.TrimSpace(value)
-
-	types := typeRegexp.FindAllStringSubmatch(value, -1)
-	for _, t := range types {
-		if len(t) == 1 {
-			continue
-		}
-
-		switch t[1] {
-		case "image":
-			opts.Conditions = append(opts.Conditions, imageCondition)
-		case "audio", "music":
-			opts.Conditions = append(opts.Conditions, audioCondition)
-		case "video":
-			opts.Conditions = append(opts.Conditions, videoCondition)
-		default:
-			opts.Conditions = append(opts.Conditions, extensionCondition(t[1]))
-		}
-	}
-
-	if len(types) > 0 {
-		// Remove the fields from the search value.
-		value = typeRegexp.ReplaceAllString(value, "")
-	}
-
-	// If it's canse insensitive, put everything in lowercase.
-	if !opts.CaseSensitive {
-		value = strings.ToLower(value)
-	}
-
-	// Remove the spaces from the search value.
-	value = strings.TrimSpace(value)
-
-	if value == "" {
-		return opts
-	}
-
-	// if the value starts with " and finishes what that character, we will
-	// only search for that term
-	if value[0] == '"' && value[len(value)-1] == '"' {
-		unique := strings.TrimPrefix(value, "\"")
-		unique = strings.TrimSuffix(unique, "\"")
-
-		opts.Terms = []string{unique}
-		return opts
-	}
-
-	opts.Terms = strings.Split(value, " ")
-	return opts
-}
-
-// search searches for a file or directory.
-func search(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	// Upgrades the connection to a websocket and checks for fb.Errors.
-	conn, err := upgrader.Upgrade(w, r, nil)
-	if err != nil {
-		return 0, err
-	}
-	defer conn.Close()
-
-	var (
-		value   string
-		search  *searchOptions
-		message []byte
-	)
-
-	// Starts an infinite loop until a valid command is captured.
-	for {
-		_, message, err = conn.ReadMessage()
-		if err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		if len(message) != 0 {
-			value = string(message)
-			break
-		}
-	}
-
-	search = parseSearch(value)
-	scope := strings.TrimPrefix(r.URL.Path, "/")
-	scope = "/" + scope
-	scope = c.User.Scope + scope
-	scope = strings.Replace(scope, "\\", "/", -1)
-	scope = filepath.Clean(scope)
-
-	err = filepath.Walk(scope, func(path string, f os.FileInfo, err error) error {
-		var (
-			originalPath string
-		)
-
-		path = strings.TrimPrefix(path, scope)
-		path = strings.TrimPrefix(path, "/")
-		path = strings.Replace(path, "\\", "/", -1)
-
-		originalPath = path
-
-		if !search.CaseSensitive {
-			path = strings.ToLower(path)
-		}
-
-		// Only execute if there are conditions to meet.
-		if len(search.Conditions) > 0 {
-			match := false
-
-			for _, t := range search.Conditions {
-				if t(path) {
-					match = true
-					break
-				}
-			}
-
-			// If doesn't meet the condition, go to the next.
-			if !match {
-				return nil
-			}
-		}
-
-		if len(search.Terms) > 0 {
-			is := false
-
-			// Checks if matches the terms and if it is allowed.
-			for _, term := range search.Terms {
-				if is {
-					break
-				}
-
-				if strings.Contains(path, term) {
-					if !c.User.Allowed(path) {
-						return nil
-					}
-
-					is = true
-				}
-			}
-
-			if !is {
-				return nil
-			}
-		}
-		if f.IsDir() {
-			originalPath = originalPath + "/"
-		}
-
-		response, _ := json.Marshal(map[string]interface{}{
-			"dir":  f.IsDir(),
-			"path": originalPath,
-		})
-
-		return conn.WriteMessage(websocket.TextMessage, response)
-	})
-
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	return 0, nil
-}

lib/staticgen/hugo.go

@@ -1,192 +0,0 @@
-package staticgen
-
-import (
-	"errors"
-	"io/ioutil"
-	"log"
-	"net/http"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-
-	fb "github.com/filebrowser/filebrowser/lib"
-	"github.com/hacdias/varutils"
-)
-
-var (
-	errUnsupportedFileType = errors.New("The type of the provided file isn't supported for this action")
-)
-
-// Hugo is the Hugo static website generator.
-type Hugo struct {
-	// Website root
-	Root string `name:"Website Root"`
-	// Public folder
-	Public string `name:"Public Directory"`
-	// Hugo executable path
-	Exe string `name:"Hugo Executable"`
-	// Hugo arguments
-	Args []string `name:"Hugo Arguments"`
-	// Indicates if we should clean public before a new publish.
-	CleanPublic bool `name:"Clean Public"`
-	// previewPath is the temporary path for a preview
-	previewPath string
-}
-
-// SettingsPath retrieves the correct settings path.
-func (h Hugo) SettingsPath() string {
-	var frontmatter string
-	var err error
-
-	if _, err = os.Stat(filepath.Join(h.Root, "config.yaml")); err == nil {
-		frontmatter = "yaml"
-	}
-
-	if _, err = os.Stat(filepath.Join(h.Root, "config.json")); err == nil {
-		frontmatter = "json"
-	}
-
-	if _, err = os.Stat(filepath.Join(h.Root, "config.toml")); err == nil {
-		frontmatter = "toml"
-	}
-
-	if frontmatter == "" {
-		return "/settings"
-	}
-
-	return "/config." + frontmatter
-}
-
-// Name is the plugin's name.
-func (h Hugo) Name() string {
-	return "hugo"
-}
-
-// Hook is the pre-api handler.
-func (h Hugo) Hook(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	// If we are not using HTTP Post, we shall return Method Not Allowed
-	// since we are only working with this method.
-	if r.Method != http.MethodPost {
-		return 0, nil
-	}
-
-	if c.Router != "resource" {
-		return 0, nil
-	}
-
-	// We only care about creating new files from archetypes here. So...
-	if r.Header.Get("Archetype") == "" {
-		return 0, nil
-	}
-
-	if !c.User.AllowNew {
-		return http.StatusForbidden, nil
-	}
-
-	filename := filepath.Clean(r.URL.Path)
-	filename = strings.TrimPrefix(filename, string(filepath.Separator))
-	archetype := r.Header.Get("archetype")
-
-	ext := filepath.Ext(filename)
-
-	// If the request isn't for a markdown file, we can't
-	// handle it.
-	if ext != ".markdown" && ext != ".md" {
-		return http.StatusBadRequest, errUnsupportedFileType
-	}
-
-	// Tries to create a new file based on this archetype.
-	args := []string{"new", filename, "--kind", archetype}
-	if err := runCommand(h.Exe, args, h.Root); err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	// Writes the location of the new file to the Header.
-	w.Header().Set("Location", "/files/content/"+filename)
-	return http.StatusCreated, nil
-}
-
-// Publish publishes a post.
-func (h Hugo) Publish(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	filename := filepath.Join(c.User.Scope, r.URL.Path)
-
-	// We only run undraft command if it is a file.
-	if strings.HasSuffix(filename, ".md") && strings.HasSuffix(filename, ".markdown") {
-		if err := h.undraft(filename); err != nil {
-			return http.StatusInternalServerError, err
-		}
-	}
-
-	// Regenerates the file
-	h.run(false)
-
-	return 0, nil
-}
-
-// Preview handles the preview path.
-func (h *Hugo) Preview(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	// Get a new temporary path if there is none.
-	if h.previewPath == "" {
-		path, err := ioutil.TempDir("", "")
-		if err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		h.previewPath = path
-	}
-
-	// Build the arguments to execute Hugo: change the base URL,
-	// build the drafts and update the destination.
-	args := h.Args
-	args = append(args, "--baseURL", c.RootURL()+"/preview/")
-	args = append(args, "--buildDrafts")
-	args = append(args, "--destination", h.previewPath)
-
-	// Builds the preview.
-	if err := runCommand(h.Exe, args, h.Root); err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	// Serves the temporary path with the preview.
-	http.FileServer(http.Dir(h.previewPath)).ServeHTTP(w, r)
-	return 0, nil
-}
-
-func (h Hugo) run(force bool) {
-	// If the CleanPublic option is enabled, clean it.
-	if h.CleanPublic {
-		os.RemoveAll(h.Public)
-	}
-
-	// Prevent running if watching is enabled
-	if b, pos := varutils.StringInSlice("--watch", h.Args); b && !force {
-		if len(h.Args) > pos && h.Args[pos+1] != "false" {
-			return
-		}
-
-		if len(h.Args) == pos+1 {
-			return
-		}
-	}
-
-	if err := runCommand(h.Exe, h.Args, h.Root); err != nil {
-		log.Println(err)
-	}
-}
-
-func (h Hugo) undraft(file string) error {
-	args := []string{"undraft", file}
-	if err := runCommand(h.Exe, args, h.Root); err != nil && !strings.Contains(err.Error(), "not a Draft") {
-		return err
-	}
-
-	return nil
-}
-
-// Setup sets up the plugin.
-func (h *Hugo) Setup() error {
-	var err error
-	h.Exe, err = exec.LookPath("hugo")
-	return err
-}

lib/staticgen/jekyll.go

@@ -1,125 +0,0 @@
-package staticgen
-
-import (
-	"io/ioutil"
-	"log"
-	"net/http"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-
-	fb "github.com/filebrowser/filebrowser/lib"
-)
-
-// Jekyll is the Jekyll static website generator.
-type Jekyll struct {
-	// Website root
-	Root string `name:"Website Root"`
-	// Public folder
-	Public string `name:"Public Directory"`
-	// Jekyll executable path
-	Exe string `name:"Executable"`
-	// Jekyll arguments
-	Args []string `name:"Arguments"`
-	// Indicates if we should clean public before a new publish.
-	CleanPublic bool `name:"Clean Public"`
-	// previewPath is the temporary path for a preview
-	previewPath string
-}
-
-// Name is the plugin's name.
-func (j Jekyll) Name() string {
-	return "jekyll"
-}
-
-// SettingsPath retrieves the correct settings path.
-func (j Jekyll) SettingsPath() string {
-	return "/_config.yml"
-}
-
-// Hook is the pre-api handler.
-func (j Jekyll) Hook(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	return 0, nil
-}
-
-// Publish publishes a post.
-func (j Jekyll) Publish(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	filename := filepath.Join(c.User.Scope, r.URL.Path)
-
-	// We only run undraft command if it is a file.
-	if err := j.undraft(filename); err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	// Regenerates the file
-	j.run()
-
-	return 0, nil
-}
-
-// Preview handles the preview path.
-func (j *Jekyll) Preview(c *fb.Context, w http.ResponseWriter, r *http.Request) (int, error) {
-	// Get a new temporary path if there is none.
-	if j.previewPath == "" {
-		path, err := ioutil.TempDir("", "")
-		if err != nil {
-			return http.StatusInternalServerError, err
-		}
-
-		j.previewPath = path
-	}
-
-	// Build the arguments to execute Hugo: change the base URL,
-	// build the drafts and update the destination.
-	args := j.Args
-	args = append(args, "--baseurl", c.RootURL()+"/preview/")
-	args = append(args, "--drafts")
-	args = append(args, "--destination", j.previewPath)
-
-	// Builds the preview.
-	if err := runCommand(j.Exe, args, j.Root); err != nil {
-		return http.StatusInternalServerError, err
-	}
-
-	// Serves the temporary path with the preview.
-	http.FileServer(http.Dir(j.previewPath)).ServeHTTP(w, r)
-	return 0, nil
-}
-
-func (j Jekyll) run() {
-	// If the CleanPublic option is enabled, clean it.
-	if j.CleanPublic {
-		os.RemoveAll(j.Public)
-	}
-
-	if err := runCommand(j.Exe, j.Args, j.Root); err != nil {
-		log.Println(err)
-	}
-}
-
-func (j Jekyll) undraft(file string) error {
-	if !strings.Contains(file, "_drafts") {
-		return nil
-	}
-
-	return os.Rename(file, strings.Replace(file, "_drafts", "_posts", 1))
-}
-
-// Setup sets up the plugin.
-func (j *Jekyll) Setup() error {
-	var err error
-	if j.Exe, err = exec.LookPath("jekyll"); err != nil {
-		return err
-	}
-
-	if len(j.Args) == 0 {
-		j.Args = []string{"build"}
-	}
-
-	if j.Args[0] != "build" {
-		j.Args = append([]string{"build"}, j.Args...)
-	}
-
-	return nil
-}

lib/staticgen/staticgen.go

@@ -1,19 +0,0 @@
-package staticgen
-
-import (
-	"errors"
-	"os/exec"
-)
-
-// runCommand executes an external command
-func runCommand(command string, args []string, path string) error {
-	cmd := exec.Command(command, args...)
-	cmd.Dir = path
-	out, err := cmd.CombinedOutput()
-
-	if err != nil {
-		return errors.New(string(out))
-	}
-
-	return nil
-}

main.go

@@ -0,0 +1,13 @@
+//go:generate cd http && rice embed-go
+package main
+
+import (
+	"runtime"
+
+	"github.com/filebrowser/filebrowser/v2/cmd"
+)
+
+func main() {
+	runtime.GOMAXPROCS(runtime.NumCPU())
+	cmd.Execute()
+}

rules/rules.go

@@ -0,0 +1,44 @@
+package rules
+
+import (
+	"regexp"
+	"strings"
+)
+
+// Checker is a Rules checker.
+type Checker interface {
+	Check(path string) bool
+}
+
+// Rule is a allow/disallow rule.
+type Rule struct {
+	Regex  bool    `json:"regex"`
+	Allow  bool    `json:"allow"`
+	Path   string  `json:"path"`
+	Regexp *Regexp `json:"regexp"`
+}
+
+// Matches matches a path against a rule.
+func (r *Rule) Matches(path string) bool {
+	if r.Regex {
+		return r.Regexp.MatchString(path)
+	}
+
+	return strings.HasPrefix(path, r.Path)
+}
+
+// Regexp is a wrapper to the native regexp type where we
+// save the raw expression.
+type Regexp struct {
+	Raw    string `json:"raw"`
+	regexp *regexp.Regexp
+}
+
+// MatchString checks if a string matches the regexp.
+func (r *Regexp) MatchString(s string) bool {
+	if r.regexp == nil {
+		r.regexp = regexp.MustCompile(r.Raw)
+	}
+
+	return r.regexp.MatchString(s)
+}

runner/parser.go

@@ -0,0 +1,34 @@
+package runner
+
+import (
+	"os/exec"
+
+	"github.com/mholt/caddy"
+	"github.com/filebrowser/filebrowser/v2/settings"
+)
+
+// ParseCommand parses the command taking in account if the current
+// instance uses a shell to run the commands or just calls the binary
+// directyly.
+func ParseCommand(s *settings.Settings, raw string) ([]string, error) {
+	command := []string{}
+
+	if len(s.Shell) == 0 {
+		cmd, args, err := caddy.SplitCommandAndArgs(raw)
+		if err != nil {
+			return nil, err
+		}
+
+		_, err = exec.LookPath(cmd)
+		if err != nil {
+			return nil, err
+		}
+
+		command = append(command, cmd)
+		command = append(command, args...)
+	} else {
+		command = append(s.Shell, raw)
+	}
+
+	return command, nil
+}

runner/runner.go

@@ -0,0 +1,81 @@
+package runner
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"strings"
+
+	"github.com/filebrowser/filebrowser/v2/settings"
+	"github.com/filebrowser/filebrowser/v2/users"
+)
+
+// Runner is a commands runner.
+type Runner struct {
+	*settings.Settings
+}
+
+// RunHook runs the hooks for the before and after event.
+func (r *Runner) RunHook(fn func() error, evt, path, dst string, user *users.User) error {
+	path = user.FullPath(path)
+	dst = user.FullPath(dst)
+
+	if val, ok := r.Commands["before_"+evt]; ok {
+		for _, command := range val {
+			err := r.exec(command, "before_"+evt, path, dst, user)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	err := fn()
+	if err != nil {
+		return err
+	}
+
+	if val, ok := r.Commands["after_"+evt]; ok {
+		for _, command := range val {
+			err := r.exec(command, "after_"+evt, path, dst, user)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func (r *Runner) exec(raw, evt, path, dst string, user *users.User) error {
+	blocking := true
+
+	if strings.HasSuffix(raw, "&") {
+		blocking = false
+		raw = strings.TrimSpace(strings.TrimSuffix(raw, "&"))
+	}
+
+	command, err := ParseCommand(r.Settings, raw)
+	if err != nil {
+		return err
+	}
+
+	cmd := exec.Command(command[0], command[1:]...)
+	cmd.Env = append(os.Environ(), fmt.Sprintf("FILE=%s", path))
+	cmd.Env = append(cmd.Env, fmt.Sprintf("SCOPE=%s", user.Scope))
+	cmd.Env = append(cmd.Env, fmt.Sprintf("TRIGGER=%s", evt))
+	cmd.Env = append(cmd.Env, fmt.Sprintf("USERNAME=%s", user.Username))
+	cmd.Env = append(cmd.Env, fmt.Sprintf("DESTINATION=%s", dst))
+
+	cmd.Stdin = os.Stdin
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+
+	if !blocking {
+		log.Printf("[INFO] Nonblocking Command: \"%s\"", strings.Join(command, " "))
+		return cmd.Start()
+	}
+
+	log.Printf("[INFO] Blocking Command: \"%s\"", strings.Join(command, " "))
+	return cmd.Run()
+}

search/conditions.go

@@ -0,0 +1,102 @@
+package search
+
+import (
+	"mime"
+	"path/filepath"
+	"regexp"
+	"strings"
+)
+
+var (
+	typeRegexp = regexp.MustCompile(`type:(\w+)`)
+)
+
+type condition func(path string) bool
+
+func extensionCondition(extension string) condition {
+	return func(path string) bool {
+		return filepath.Ext(path) == "."+extension
+	}
+}
+
+func imageCondition(path string) bool {
+	extension := filepath.Ext(path)
+	mimetype := mime.TypeByExtension(extension)
+
+	return strings.HasPrefix(mimetype, "image")
+}
+
+func audioCondition(path string) bool {
+	extension := filepath.Ext(path)
+	mimetype := mime.TypeByExtension(extension)
+
+	return strings.HasPrefix(mimetype, "audio")
+}
+
+func videoCondition(path string) bool {
+	extension := filepath.Ext(path)
+	mimetype := mime.TypeByExtension(extension)
+
+	return strings.HasPrefix(mimetype, "video")
+}
+
+func parseSearch(value string) *searchOptions {
+	opts := &searchOptions{
+		CaseSensitive: strings.Contains(value, "case:sensitive"),
+		Conditions:    []condition{},
+		Terms:         []string{},
+	}
+
+	// removes the options from the value
+	value = strings.Replace(value, "case:insensitive", "", -1)
+	value = strings.Replace(value, "case:sensitive", "", -1)
+	value = strings.TrimSpace(value)
+
+	types := typeRegexp.FindAllStringSubmatch(value, -1)
+	for _, t := range types {
+		if len(t) == 1 {
+			continue
+		}
+
+		switch t[1] {
+		case "image":
+			opts.Conditions = append(opts.Conditions, imageCondition)
+		case "audio", "music":
+			opts.Conditions = append(opts.Conditions, audioCondition)
+		case "video":
+			opts.Conditions = append(opts.Conditions, videoCondition)
+		default:
+			opts.Conditions = append(opts.Conditions, extensionCondition(t[1]))
+		}
+	}
+
+	if len(types) > 0 {
+		// Remove the fields from the search value.
+		value = typeRegexp.ReplaceAllString(value, "")
+	}
+
+	// If it's canse insensitive, put everything in lowercase.
+	if !opts.CaseSensitive {
+		value = strings.ToLower(value)
+	}
+
+	// Remove the spaces from the search value.
+	value = strings.TrimSpace(value)
+
+	if value == "" {
+		return opts
+	}
+
+	// if the value starts with " and finishes what that character, we will
+	// only search for that term
+	if value[0] == '"' && value[len(value)-1] == '"' {
+		unique := strings.TrimPrefix(value, "\"")
+		unique = strings.TrimSuffix(unique, "\"")
+
+		opts.Terms = []string{unique}
+		return opts
+	}
+
+	opts.Terms = strings.Split(value, " ")
+	return opts
+}

search/search.go

@@ -0,0 +1,62 @@
+package search
+
+import (
+	"os"
+	"strings"
+
+	"github.com/filebrowser/filebrowser/v2/rules"
+	"github.com/spf13/afero"
+)
+
+type searchOptions struct {
+	CaseSensitive bool
+	Conditions    []condition
+	Terms         []string
+}
+
+// Search searches for a query in a fs.
+func Search(fs afero.Fs, scope, query string, checker rules.Checker, found func(path string, f os.FileInfo) error) error {
+	search := parseSearch(query)
+
+	return afero.Walk(fs, scope, func(path string, f os.FileInfo, err error) error {
+		path = strings.TrimPrefix(path, "/")
+		path = strings.Replace(path, "\\", "/", -1)
+		
+		if !checker.Check(path) {
+			return nil
+		}
+
+		if !search.CaseSensitive {
+			path = strings.ToLower(path)
+		}
+
+		if !search.CaseSensitive {
+			path = strings.ToLower(path)
+		}
+
+		if len(search.Conditions) > 0 {
+			match := false
+
+			for _, t := range search.Conditions {
+				if t(path) {
+					match = true
+					break
+				}
+			}
+
+			if !match {
+				return nil
+			}
+		}
+
+		if len(search.Terms) > 0 {
+			for _, term := range search.Terms {
+				if strings.Contains(path, term) {
+					return found(strings.TrimPrefix(path, scope), f)
+				}
+			}
+		}
+
+		return nil
+	})
+}

settings/branding.go

@@ -0,0 +1,8 @@
+package settings
+
+// Branding contains the branding settings of the app.
+type Branding struct {
+	Name            string `json:"name"`
+	DisableExternal bool   `json:"disableExternal"`
+	Files           string `json:"files"`
+}