@nocobase/plugin-file-manager 2.1.0-beta.47 → 2.1.0-beta.48

package/dist/server/server.d.ts

@@ -17,11 +17,13 @@ export type FileRecordOptions = {
     collectionName: string;
     filePath: string;
     storageName?: string;
+    subPath?: string;
     values?: any;
 } & Transactionable;
 export type UploadFileOptions = {
     filePath: string;
     storageName?: string;
+    subPath?: string;
     documentRoot?: string;
 };
 export declare class PluginFileManagerServer extends Plugin {

package/dist/server/server.js

@@ -100,29 +100,34 @@ class PluginFileManagerServer extends import_server.Plugin {
     this.storageTypes.register(type, Type);
   }
   async createFileRecord(options) {
-    const { values, storageName, collectionName, filePath, transaction } = options;
+    const { values, storageName, subPath, collectionName, filePath, transaction } = options;
     const collection = this.db.getCollection(collectionName);
     if (!collection) {
       throw new Error(`collection does not exist`);
     }
     const collectionRepository = this.db.getRepository(collectionName);
     const name = storageName || collection.options.storage;
-    const data = await this.uploadFile({ storageName: name, filePath });
+    const data = await this.uploadFile({ storageName: name, subPath, filePath });
     return await collectionRepository.create({ values: { ...data, ...values }, transaction });
   }
   parseStorage(instance) {
     return this.app.environment.renderJsonTemplate(instance.toJSON());
   }
   async uploadFile(options) {
-    const { storageName, filePath, documentRoot } = options;
+    const { storageName, subPath, filePath, documentRoot } = options;
     if (!this.storagesCache.size) {
       await this.loadStorages();
     }
     const storages = Array.from(this.storagesCache.values());
-    const storage = storages.find((item) => item.name === storageName) || storages.find((item) => item.default);
-    if (!storage) {
+    const cachedStorage = storages.find((item) => item.name === storageName) || storages.find((item) => item.default);
+    if (!cachedStorage) {
       throw new Error("[file-manager] no linked or default storage provided");
     }
+    const storage = {
+      ...cachedStorage,
+      options: { ...cachedStorage.options || {} },
+      path: (0, import_utils2.resolveStoragePath)(cachedStorage.path, subPath)
+    };
     const fileStream = import_fs.default.createReadStream(filePath);
     if (documentRoot) {
       storage.options["documentRoot"] = documentRoot;

package/dist/server/utils.d.ts

@@ -10,6 +10,8 @@ export declare function getFilename(req: any, file: any, cb: any): void;
 export declare const cloudFilenameGetter: (storage: any) => (req: any, file: any, cb: any) => void;
 export declare const diskFilenameGetter: (storage: any) => (req: any, file: any, cb: any) => void;
 export declare function getFileKey(record: any): any;
+export declare function normalizeStorageSubPath(subPath?: unknown): string;
+export declare function resolveStoragePath(storagePath?: unknown, subPath?: unknown): string;
 export declare function ensureUrlEncoded(value: any): any;
 export declare function encodeURL(url: any): any;
 export declare function normalizeDocumentRoot(documentRoot?: string): string;

package/dist/server/utils.js

@@ -42,7 +42,9 @@ __export(utils_exports, {
   ensureUrlEncoded: () => ensureUrlEncoded,
   getFileKey: () => getFileKey,
   getFilename: () => getFilename,
-  normalizeDocumentRoot: () => normalizeDocumentRoot
+  normalizeDocumentRoot: () => normalizeDocumentRoot,
+  normalizeStorageSubPath: () => normalizeStorageSubPath,
+  resolveStoragePath: () => resolveStoragePath
 });
 module.exports = __toCommonJS(utils_exports);
 var import_utils = require("@nocobase/utils");
@@ -129,6 +131,41 @@ const diskFilenameGetter = (storage) => (req, file, cb) => {
 function getFileKey(record) {
   return (0, import_url_join.default)(record.path || "", record.filename).replace(/^\//, "");
 }
+function pathError(message) {
+  const error = new Error(message);
+  error.code = "PATH_TRAVERSAL";
+  return error;
+}
+function normalizeStoragePathForJoin(value, message, { allowLeadingSlash = false } = {}) {
+  if (value == null || value === "") {
+    return "";
+  }
+  if (typeof value !== "string" || value.includes("\0")) {
+    throw pathError(message);
+  }
+  const normalized = value.replace(/\\/g, "/");
+  if (!allowLeadingSlash && normalized.startsWith("/")) {
+    throw pathError(message);
+  }
+  const segments = normalized.replace(/^\/+|\/+$/g, "").split("/").filter((segment) => segment && segment !== ".");
+  if (segments.some((segment) => segment === "..")) {
+    throw pathError("Access denied");
+  }
+  return segments.join("/");
+}
+function normalizeStorageSubPath(subPath) {
+  return normalizeStoragePathForJoin(subPath, "Invalid storage sub path");
+}
+function resolveStoragePath(storagePath, subPath) {
+  const normalizedSubPath = normalizeStorageSubPath(subPath);
+  if (!normalizedSubPath) {
+    return typeof storagePath === "string" ? storagePath : "";
+  }
+  const normalizedStoragePath = normalizeStoragePathForJoin(storagePath, "Invalid storage path", {
+    allowLeadingSlash: true
+  });
+  return normalizedStoragePath ? `${normalizedStoragePath}/${normalizedSubPath}` : normalizedSubPath;
+}
 function ensureUrlEncoded(value) {
   try {
     if (decodeURIComponent(value) !== value) {
@@ -176,5 +213,7 @@ function normalizeDocumentRoot(documentRoot) {
   ensureUrlEncoded,
   getFileKey,
   getFilename,
-  normalizeDocumentRoot
+  normalizeDocumentRoot,
+  normalizeStorageSubPath,
+  resolveStoragePath
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/plugin-file-manager",
-  "version": "2.1.0-beta.47",
+  "version": "2.1.0-beta.48",
   "displayName": "File manager",
   "displayName.ru-RU": "Менеджер файлов",
   "displayName.zh-CN": "文件管理器",
@@ -60,5 +60,5 @@
     "Collections",
     "Collection fields"
   ],
-  "gitHead": "bf8fc3790e3494c901b4d22861c5471a0d27c464"
+  "gitHead": "f8c27a286db015c5e433b48241f14c0412e50530"
 }

package/dist/client-v2/450.f590b4c220108742.js

@@ -1,10 +0,0 @@
-/**
- * This file is part of the NocoBase (R) project.
- * Copyright (c) 2020-2024 NocoBase Co., Ltd.
- * Authors: NocoBase Team.
- *
- * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
- * For more information, please refer to: https://www.nocobase.com/agreement.
- */
-
-"use strict";(self.webpackChunk_nocobase_plugin_file_manager_client_v2=self.webpackChunk_nocobase_plugin_file_manager_client_v2||[]).push([["450"],{177:function(e,t,n){n.r(t),n.d(t,{UploadActionModel:function(){return z},useBeforeUpload:function(){return A},useStorageCfg:function(){return B},useStorageUploadProps:function(){return _},useStorage:function(){return C},validate:function(){return I}});var r=n(375),o=n(485),i=n(694),l=n(625),a=n(59);let u="bits",c="bytes",s="jedec",p={iec:{bits:["bit","Kibit","Mibit","Gibit","Tibit","Pibit","Eibit","Zibit","Yibit"],bytes:["B","KiB","MiB","GiB","TiB","PiB","EiB","ZiB","YiB"]},jedec:{bits:["bit","Kbit","Mbit","Gbit","Tbit","Pbit","Ebit","Zbit","Ybit"],bytes:["B","KB","MB","GB","TB","PB","EB","ZB","YB"]}},f={iec:["","kibi","mebi","gibi","tebi","pebi","exbi","zebi","yobi"],jedec:["","kilo","mega","giga","tera","peta","exa","zetta","yotta"]};var d=n(484),b=n.n(d),y=n(155),g=n.n(y),m=n(953);function v(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=Array(t);n<t;n++)r[n]=e[n];return r}function h(e,t,n,r,o,i,l){try{var a=e[i](l),u=a.value}catch(e){n(e);return}a.done?t(u):Promise.resolve(u).then(r,o)}function w(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function O(e,t,n){return(O="u">typeof Reflect&&Reflect.get?Reflect.get:function(e,t,n){var r=function(e,t){for(;!Object.prototype.hasOwnProperty.call(e,t)&&null!==(e=k(e)););return e}(e,t);if(r){var o=Object.getOwnPropertyDescriptor(r,t);return o.get?o.get.call(n||e):o.value}})(e,t,n||e)}function k(e){return(k=Object.setPrototypeOf?Object.getPrototypeOf:function(e){return e.__proto__||Object.getPrototypeOf(e)})(e)}function E(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{},r=Object.keys(n);"function"==typeof Object.getOwnPropertySymbols&&(r=r.concat(Object.getOwnPropertySymbols(n).filter(function(e){return Object.getOwnPropertyDescriptor(n,e).enumerable}))),r.forEach(function(t){w(e,t,n[t])})}return e}function j(e,t){return t=null!=t?t:{},Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(t)):(function(e){var t=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t.push.apply(t,n)}return t})(Object(t)).forEach(function(n){Object.defineProperty(e,n,Object.getOwnPropertyDescriptor(t,n))}),e}function x(e,t){return(x=Object.setPrototypeOf||function(e,t){return e.__proto__=t,e})(e,t)}function P(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n,r,o=null==e?null:"u">typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=o){var i=[],l=!0,a=!1;try{for(o=o.call(e);!(l=(n=o.next()).done)&&(i.push(n.value),!t||i.length!==t);l=!0);}catch(e){a=!0,r=e}finally{try{l||null==o.return||o.return()}finally{if(a)throw r}}return i}}(e,t)||function(e,t){if(e){if("string"==typeof e)return v(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);if("Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n)return Array.from(n);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return v(e,t)}}(e,t)||function(){throw TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function S(){try{var e=!Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){}))}catch(e){}return(S=function(){return!!e})()}var T=function(e){var t,n,r=(0,i.useFlowContext)(),o=(0,y.useMemo)(function(){var t="".concat(e.context.collection.name,":create");if(null==(o=r.view)||null==(n=o.inputArgs)?void 0:n.sourceId){var n,o,i,l=P(e.context.blockModel.association.resourceName.split("."),2),a=l[0],u=l[1];t="".concat(a,"/").concat(null==(i=r.view)?void 0:i.inputArgs.sourceId,"/").concat(u,":create")}return t},[e.context.collection.name,null==(n=r.view)||null==(t=n.inputArgs)?void 0:t.sourceId]),l={},a=0,u={action:o,onChange:function(t){var n=t.fileList;n.forEach(function(t){if("uploading"!==t.status||l[t.uid]||(a++,l[t.uid]=!0),"uploading"!==t.status&&l[t.uid]&&(delete l[t.uid],0==--a)){var n,r;null==(n=(r=e.context.blockModel.resource).refresh)||n.call(r)}}),n.every(function(e){return"done"===e.status})&&r.view.close()}},c=_(u,e);return E({},u,c)};function C(e){var t=null!=e?e:"",n="storages:getBasicInfo/".concat(t),r=(0,i.useFlowContext)(),o=(0,l.useRequest)(function(){var e;return(e=function(){var e;return function(e,t){var n,r,o,i={label:0,sent:function(){if(1&o[0])throw o[1];return o[1]},trys:[],ops:[]},l=Object.create(("function"==typeof Iterator?Iterator:Object).prototype),a=Object.defineProperty;return a(l,"next",{value:u(0)}),a(l,"throw",{value:u(1)}),a(l,"return",{value:u(2)}),"function"==typeof Symbol&&a(l,Symbol.iterator,{value:function(){return this}}),l;function u(a){return function(u){var c=[a,u];if(n)throw TypeError("Generator is already executing.");for(;l&&(l=0,c[0]&&(i=0)),i;)try{if(n=1,r&&(o=2&c[0]?r.return:c[0]?r.throw||((o=r.return)&&o.call(r),0):r.next)&&!(o=o.call(r,c[1])).done)return o;switch(r=0,o&&(c=[2&c[0],o.value]),c[0]){case 0:case 1:o=c;break;case 4:return i.label++,{value:c[1],done:!1};case 5:i.label++,r=c[1],c=[0];continue;case 7:c=i.ops.pop(),i.trys.pop();continue;default:if(!(o=(o=i.trys).length>0&&o[o.length-1])&&(6===c[0]||2===c[0])){i=0;continue}if(3===c[0]&&(!o||c[1]>o[0]&&c[1]<o[3])){i.label=c[1];break}if(6===c[0]&&i.label<o[1]){i.label=o[1],o=c;break}if(o&&i.label<o[2]){i.label=o[2],i.ops.push(c);break}o[2]&&i.ops.pop(),i.trys.pop();continue}c=t.call(e,i)}catch(e){c=[6,e],r=0}finally{n=o=0}if(5&c[0])throw c[1];return{value:c[0]?c[1]:void 0,done:!0}}}}(this,function(t){switch(t.label){case 0:return[4,r.api.request({url:n,skipNotify:!0})];case 1:return[2,null==(e=t.sent())?void 0:e.data]}})},function(){var t=this,n=arguments;return new Promise(function(r,o){var i=e.apply(t,n);function l(e){h(i,r,o,l,a,"next",e)}function a(e){h(i,r,o,l,a,"throw",e)}l(void 0)})})()},{manual:!0,refreshDeps:[t],cacheKey:n}),a=o.loading,u=o.data,c=o.run;return(0,y.useEffect)(function(){c()},[c]),!a&&(null==u?void 0:u.data)||null}function B(e){var t,n=(0,i.useFlowContext)(),r=n.collectionField,o=null==(t=n.collectionField)?void 0:t.targetCollection,l=n.app.pm.get("@nocobase/plugin-file-manager"),a=e.context.blockModel.collection,u=C((null==r?void 0:r.storage)||a.storage||o.storage),c=l.getStorageType(null==u?void 0:u.type);return{storage:u,storageType:c}}function _(e,t){var n=B(t),r=n.storage,o=n.storageType,i=null==o?void 0:o.useUploadProps,l=(null==i?void 0:i(E({storage:r,rules:r.rules},e)))||{};return E({rules:null==r?void 0:r.rules},l)}var M={size:function(e,t){var n=null!=t?t:0x1400000;return 0===n||e.size<=n?null:"File size exceeds the limit"},mimetype:function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:"*",n=t.toString().trim();return n&&"*"!==n?n.split(",").filter(Boolean).some(b()(e.type))?null:"File type is not allowed":null}};function I(e,t){if(!t)return null;var n=Object.keys(t);if(!n.length)return null;var r=!0,o=!1,i=void 0;try{for(var l,a=n[Symbol.iterator]();!(r=(l=a.next()).done);r=!0){var u=l.value,c=M[u](e,t[u]);if(c)return c}}catch(e){o=!0,i=e}finally{try{r||null==a.return||a.return()}finally{if(o)throw i}}return null}function A(e){var t=(0,m.useTranslation)().t;return(0,y.useCallback)(function(n,r){var o=I(n,e);return o?(n.status="error",n.response=t(o)):"error"===n.status&&(delete n.status,delete n.response),!o&&Promise.resolve(n)},[e])}function U(e){var t,n,o,l,d,b,v=e.model,h=(0,i.useFlowContext)(),w=T(v),O=w.rules,k=null!=O?O:{},x=k.size;k.mimetype;var S=(t=null!=x?x:0x1400000,o=(n=(0,m.useTranslation)()).t,l=function(e,{bits:t=!1,pad:n=!1,base:r=-1,round:o=2,locale:i="",localeOptions:l={},separator:a="",spacer:d=" ",symbols:b={},standard:y="",output:g="string",fullform:m=!1,fullforms:v=[],exponent:h=-1,roundingMethod:w="round",precision:O=0}={}){let k=h,E=Number(e),j=[],x=0,P="";"si"===y?(r=10,y=s):"iec"===y||y===s?r=2:2===r?y="iec":(r=10,y=s);let S=10===r?1e3:1024,T=E<0,C=Math[w];if("bigint"!=typeof e&&isNaN(e))throw TypeError("Invalid number");if("function"!=typeof C)throw TypeError("Invalid rounding method");if(T&&(E=-E),(-1===k||isNaN(k))&&(k=Math.floor(Math.log(E)/Math.log(S)))<0&&(k=0),k>8&&(O>0&&(O+=8-k),k=8),"exponent"===g)return k;if(0===E)j[0]=0,P=j[1]=p[y][t?u:c][k];else{x=E/(2===r?Math.pow(2,10*k):Math.pow(1e3,k)),t&&(x*=8)>=S&&k<8&&(x/=S,k++);let e=Math.pow(10,k>0?o:0);j[0]=C(x*e)/e,j[0]===S&&k<8&&-1===h&&(j[0]=1,k++),P=j[1]=10===r&&1===k?t?"kbit":"kB":p[y][t?u:c][k]}if(T&&(j[0]=-j[0]),O>0&&(j[0]=j[0].toPrecision(O)),j[1]=b[j[1]]||j[1],!0===i?j[0]=j[0].toLocaleString():i.length>0?j[0]=j[0].toLocaleString(i,l):a.length>0&&(j[0]=j[0].toString().replace(".",a)),n&&o>0){let e=j[0].toString(),t=a||(e.match(/(\D)/g)||[]).pop()||".",n=e.toString().split(t),r=n[1]||"",i=r.length;j[0]=`${n[0]}${t}${r.padEnd(i+(o-i),"0")}`}return!0===m&&(j[1]=v[k]?v[k]:f[y][k]+(t?"bit":"byte")+(1===j[0]?"":"s")),"array"===g?j:"object"===g?{value:j[0],symbol:j[1],exponent:k,unit:P}:j.join(d)}(t,{base:2,standard:"jedec",locale:n.i18n.language}),0!==t?o("File size should not exceed {{size}}.",{size:l}):""),C=P((0,y.useState)(!1),2),B=C[0],_=C[1],M=(0,y.useCallback)(function(e){e.fileList.some(function(e){return"uploading"===e.status})?_(!0):_(!1)},[]),I=h.view.Header,U=A(O);return g().createElement("div",null,g().createElement(I,{title:h.t("Upload file")}),g().createElement("div",{style:{height:"50vh"},onClick:function(e){return e.stopPropagation()}},g().createElement(a.Upload.Dragger,E({multiple:!0,listType:"picture"},(d=j(E({},w),{handleChange:M,beforeUpload:U}),b=(0,i.useFlowContext)(),E({customRequest:function(e){var t=e.action,n=e.data,r=e.file,o=e.filename,i=e.headers,l=e.onError,a=e.onProgress,u=e.onSuccess,c=e.withCredentials,s=new FormData;return n&&Object.keys(n).forEach(function(e){s.append(e,n[e])}),s.append(o,r),b.api.axios.post(t,s,{withCredentials:c,headers:i,onUploadProgress:function(e){var t=e.total;a({percent:Math.round(e.loaded/t*100).toFixed(2)},r)}}).then(function(e){u(e.data,r)}).catch(l).finally(function(){}),{abort:function(){console.log("upload progress is aborted.")}}}},d))),g().createElement("p",{className:"ant-upload-drag-icon"},B?g().createElement(r.LoadingOutlined,{style:{fontSize:36},spin:!0}):g().createElement(r.InboxOutlined,null)),g().createElement("p",{className:"ant-upload-text"},h.t("Click or drag file to this area to upload")),g().createElement("ul",{style:{listStyleType:"none"}},g().createElement("li",{className:"ant-upload-hint"},h.t("Support for a single or bulk upload.")),g().createElement("li",{className:"ant-upload-hint"},S)))))}var z=function(e){var t;if("function"!=typeof e&&null!==e)throw TypeError("Super expression must either be null or a function");function n(){var e,t,r;if(!(this instanceof n))throw TypeError("Cannot call a class as a function");return t=n,r=arguments,t=k(t),w(e=function(e,t){var n;if(t&&("object"==((n=t)&&"u">typeof Symbol&&n.constructor===Symbol?"symbol":typeof n)||"function"==typeof t))return t;if(void 0===e)throw ReferenceError("this hasn't been initialised - super() hasn't been called");return e}(this,S()?Reflect.construct(t,r||[],k(this).constructor):t.apply(this,r)),"defaultProps",{type:"primary",title:(0,i.escapeT)("Upload"),icon:"UploadOutlined"}),e}return n.prototype=Object.create(e&&e.prototype,{constructor:{value:n,writable:!0,configurable:!0}}),e&&x(n,e),t=[{key:"getAclActionName",value:function(){return"create"}},{key:"onInit",value:function(e){var t=this;O(k(n.prototype),"onInit",this).call(this,e),this.onUploadClick=function(e){t.dispatchEvent("openView",{event:e})}}},{key:"onUploadClick",set:function(e){this.setProps({onUploadClick:e})}},{key:"render",value:function(){var e=this.props,t=e.icon?g().createElement(o.Icon,{type:e.icon}):void 0;return g().createElement(a.Button,j(E({},e),{onClick:this.props.onUploadClick,icon:t}),e.children||e.title)}}],function(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.enumerable||!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(e,r.key,r)}}(n.prototype,t),n}(o.ActionModel);w(z,"scene",o.ActionSceneEnum.collection),z.define({label:(0,i.escapeT)("Upload"),hide:function(e){var t;return(null==(t=e.collection)?void 0:t.template)!=="file"}}),z.registerFlow({key:"selectExitRecordSettings",title:(0,i.escapeT)("Selector setting"),on:{eventName:"openView"},steps:{openView:{title:(0,i.escapeT)("Edit popup"),uiSchema:function(e){return{mode:{type:"string",title:(0,i.escapeT)("Open mode"),enum:[{label:(0,i.escapeT)("Drawer"),value:"drawer"},{label:(0,i.escapeT)("Dialog"),value:"dialog"}],"x-decorator":"FormItem","x-component":"Radio.Group"},size:{type:"string",title:(0,i.escapeT)("Popup size"),enum:[{label:(0,i.escapeT)("Small"),value:"small"},{label:(0,i.escapeT)("Medium"),value:"medium"},{label:(0,i.escapeT)("Large"),value:"large"}],"x-decorator":"FormItem","x-component":"Radio.Group"}}},defaultParams:{mode:"drawer",size:"medium"},handler:function(e,t){var n,r=e.inputArgs.mode||t.mode||"drawer",o=e.inputArgs.size||t.size||"medium";e.viewer.open({type:r,width:{drawer:{small:"30%",medium:"50%",large:"70%"},dialog:{small:"40%",medium:"50%",large:"80%"},embed:{}}[r][o],inheritContext:!1,target:e.layoutContentElement,inputArgs:{sourceId:null==(n=e.resource)?void 0:n.getSourceId()},content:function(){return g().createElement(U,{model:e.model})},styles:{content:E({padding:0,backgroundColor:e.model.flowEngine.context.themeToken.colorBgLayout},"embed"===r?{position:"absolute",top:0,left:0,right:0,bottom:0}:{})}})}}}})}}]);