Skip to content

Commit 85e1350

Browse files
xhofexhofe
committed
fix: check password while upload (close #2444)
1 parent c098007 commit 85e1350

File tree

6 files changed

+81
-63
lines changed

6 files changed

+81
-63
lines changed

‎server/common/check.go

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
package common
2+
3+
import (
4+
"github.com/alist-org/alist/v3/internal/model"
5+
"github.com/alist-org/alist/v3/pkg/utils"
6+
)
7+
8+
func CanWrite(meta *model.Meta, path string) bool {
9+
if meta == nil || !meta.Write {
10+
return false
11+
}
12+
return meta.WSub || meta.Path == path
13+
}
14+
15+
func CanAccess(user *model.User, meta *model.Meta, path string, password string) bool {
16+
// if is not guest, can access
17+
if user.CanAccessWithoutPassword() {
18+
return true
19+
}
20+
// if meta is nil or password is empty, can access
21+
if meta == nil || meta.Password == "" {
22+
return true
23+
}
24+
// if meta doesn't apply to sub_folder, can access
25+
if !utils.PathEqual(meta.Path, path) && !meta.PSub {
26+
return true
27+
}
28+
// validate password
29+
return meta.Password == password
30+
}

‎server/handles/fsmanage.go

+1-8
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ func FsMkdir(c *gin.Context) {
3535
return
3636
}
3737
}
38-
if !canWrite(meta, req.Path) {
38+
if !common.CanWrite(meta, req.Path) {
3939
common.ErrorResp(c, errs.PermissionDenied, 403)
4040
return
4141
}
@@ -48,13 +48,6 @@ func FsMkdir(c *gin.Context) {
4848
common.SuccessResp(c)
4949
}
5050

51-
func canWrite(meta *model.Meta, path string) bool {
52-
if meta == nil || !meta.Write {
53-
return false
54-
}
55-
return meta.WSub || meta.Path == path
56-
}
57-
5851
type MoveCopyReq struct {
5952
SrcDir string `json:"src_dir"`
6053
DstDir string `json:"dst_dir"`

‎server/handles/fsread.go

+6-23
Original file line numberDiff line numberDiff line change
@@ -66,11 +66,11 @@ func FsList(c *gin.Context) {
6666
}
6767
}
6868
c.Set("meta", meta)
69-
if !canAccess(user, meta, req.Path, req.Password) {
69+
if !common.CanAccess(user, meta, req.Path, req.Password) {
7070
common.ErrorStrResp(c, "password is incorrect", 403)
7171
return
7272
}
73-
if !user.CanWrite() && !canWrite(meta, req.Path) && req.Refresh {
73+
if !user.CanWrite() && !common.CanWrite(meta, req.Path) && req.Refresh {
7474
common.ErrorStrResp(c, "Refresh without permission", 403)
7575
return
7676
}
@@ -89,7 +89,7 @@ func FsList(c *gin.Context) {
8989
Content: toObjResp(objs, req.Path, isEncrypt(meta, req.Path)),
9090
Total: int64(total),
9191
Readme: getReadme(meta, req.Path),
92-
Write: user.CanWrite() || canWrite(meta, req.Path),
92+
Write: user.CanWrite() || common.CanWrite(meta, req.Path),
9393
Provider: provider,
9494
})
9595
}
@@ -117,7 +117,7 @@ func FsDirs(c *gin.Context) {
117117
}
118118
}
119119
c.Set("meta", meta)
120-
if !canAccess(user, meta, req.Path, req.Password) {
120+
if !common.CanAccess(user, meta, req.Path, req.Password) {
121121
common.ErrorStrResp(c, "password is incorrect", 403)
122122
return
123123
}
@@ -155,23 +155,6 @@ func getReadme(meta *model.Meta, path string) string {
155155
return ""
156156
}
157157

158-
func canAccess(user *model.User, meta *model.Meta, path string, password string) bool {
159-
// if is not guest, can access
160-
if user.CanAccessWithoutPassword() {
161-
return true
162-
}
163-
// if meta is nil or password is empty, can access
164-
if meta == nil || meta.Password == "" {
165-
return true
166-
}
167-
// if meta doesn't apply to sub_folder, can access
168-
if !utils.PathEqual(meta.Path, path) && !meta.PSub {
169-
return true
170-
}
171-
// validate password
172-
return meta.Password == password
173-
}
174-
175158
func isEncrypt(meta *model.Meta, path string) bool {
176159
if meta == nil || meta.Password == "" {
177160
return false
@@ -249,7 +232,7 @@ func FsGet(c *gin.Context) {
249232
}
250233
}
251234
c.Set("meta", meta)
252-
if !canAccess(user, meta, req.Path, req.Password) {
235+
if !common.CanAccess(user, meta, req.Path, req.Password) {
253236
common.ErrorStrResp(c, "password is incorrect", 403)
254237
return
255238
}
@@ -355,7 +338,7 @@ func FsOther(c *gin.Context) {
355338
}
356339
}
357340
c.Set("meta", meta)
358-
if !canAccess(user, meta, req.Path, req.Password) {
341+
if !common.CanAccess(user, meta, req.Path, req.Password) {
359342
common.ErrorStrResp(c, "password is incorrect", 403)
360343
return
361344
}

‎server/handles/fsup.go

+1-29
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,10 @@ import (
66
"strconv"
77
"time"
88

9-
"github.com/alist-org/alist/v3/internal/db"
10-
"github.com/alist-org/alist/v3/internal/errs"
119
"github.com/alist-org/alist/v3/internal/fs"
1210
"github.com/alist-org/alist/v3/internal/model"
1311
"github.com/alist-org/alist/v3/server/common"
1412
"github.com/gin-gonic/gin"
15-
"github.com/pkg/errors"
1613
)
1714

1815
func FsStream(c *gin.Context) {
@@ -25,19 +22,6 @@ func FsStream(c *gin.Context) {
2522
asTask := c.GetHeader("As-Task") == "true"
2623
user := c.MustGet("user").(*model.User)
2724
path = stdpath.Join(user.BasePath, path)
28-
if !user.CanWrite() {
29-
meta, err := db.GetNearestMeta(stdpath.Dir(path))
30-
if err != nil {
31-
if !errors.Is(errors.Cause(err), errs.MetaNotFound) {
32-
common.ErrorResp(c, err, 500, true)
33-
return
34-
}
35-
}
36-
if !canWrite(meta, path) {
37-
common.ErrorResp(c, errs.PermissionDenied, 403)
38-
return
39-
}
40-
}
4125

4226
dir, name := stdpath.Split(path)
4327
sizeStr := c.GetHeader("Content-Length")
@@ -78,19 +62,7 @@ func FsForm(c *gin.Context) {
7862
asTask := c.GetHeader("As-Task") == "true"
7963
user := c.MustGet("user").(*model.User)
8064
path = stdpath.Join(user.BasePath, path)
81-
if !user.CanWrite() {
82-
meta, err := db.GetNearestMeta(stdpath.Dir(path))
83-
if err != nil {
84-
if !errors.Is(errors.Cause(err), errs.MetaNotFound) {
85-
common.ErrorResp(c, err, 500, true)
86-
return
87-
}
88-
}
89-
if !canWrite(meta, path) {
90-
common.ErrorResp(c, errs.PermissionDenied, 403)
91-
return
92-
}
93-
}
65+
9466
storage, err := fs.GetStorage(path)
9567
if err != nil {
9668
common.ErrorResp(c, err, 400)

‎server/middlewares/fsup.go

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
package middlewares
2+
3+
import (
4+
"net/url"
5+
stdpath "path"
6+
7+
"github.com/alist-org/alist/v3/internal/db"
8+
"github.com/alist-org/alist/v3/internal/errs"
9+
"github.com/alist-org/alist/v3/internal/model"
10+
"github.com/alist-org/alist/v3/server/common"
11+
"github.com/gin-gonic/gin"
12+
"github.com/pkg/errors"
13+
)
14+
15+
func FsUp(c *gin.Context) {
16+
path := c.GetHeader("File-Path")
17+
password := c.GetHeader("Password")
18+
path, err := url.PathUnescape(path)
19+
if err != nil {
20+
common.ErrorResp(c, err, 400)
21+
c.Abort()
22+
return
23+
}
24+
user := c.MustGet("user").(*model.User)
25+
path = stdpath.Join(user.BasePath, path)
26+
meta, err := db.GetNearestMeta(stdpath.Dir(path))
27+
if err != nil {
28+
if !errors.Is(errors.Cause(err), errs.MetaNotFound) {
29+
common.ErrorResp(c, err, 500, true)
30+
c.Abort()
31+
return
32+
}
33+
}
34+
if !(common.CanAccess(user, meta, path, password) && (user.CanWrite() || common.CanWrite(meta, path))) {
35+
common.ErrorResp(c, errs.PermissionDenied, 403)
36+
c.Abort()
37+
return
38+
}
39+
c.Next()
40+
}

‎server/router.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -119,15 +119,15 @@ func _fs(g *gin.RouterGroup) {
119119
g.POST("/move", handles.FsMove)
120120
g.POST("/copy", handles.FsCopy)
121121
g.POST("/remove", handles.FsRemove)
122-
g.PUT("/put", handles.FsStream)
123-
g.PUT("/form", handles.FsForm)
122+
g.PUT("/put", middlewares.FsUp, handles.FsStream)
123+
g.PUT("/form", middlewares.FsUp, handles.FsForm)
124124
g.POST("/link", middlewares.AuthAdmin, handles.Link)
125125
g.POST("/add_aria2", handles.AddAria2)
126126
}
127127

128128
func Cors(r *gin.Engine) {
129129
config := cors.DefaultConfig()
130130
config.AllowAllOrigins = true
131-
config.AllowHeaders = append(config.AllowHeaders, "Authorization", "range", "File-Path", "As-Task")
131+
config.AllowHeaders = append(config.AllowHeaders, "Authorization", "range", "File-Path", "As-Task", "Password")
132132
r.Use(cors.New(config))
133133
}

0 commit comments

Comments
 (0)