hfs 0.53.0 → 0.54.0-alpha3

package/src/util-files.js

@@ -11,8 +11,8 @@ const fs_1 = require("fs");
 const path_1 = require("path");
 const fast_glob_1 = __importDefault(require("fast-glob"));
 const const_1 = require("./const");
-const util_os_1 = require("./util-os");
 const stream_1 = require("stream");
+const dirStream_1 = require("./dirStream");
 // @ts-ignore
 const unzip_stream_1 = __importDefault(require("unzip-stream"));
 async function isDirectory(path) {
@@ -77,36 +77,14 @@ function adjustStaticPathForGlob(path) {
     return fast_glob_1.default.escapePath(path.replace(/\\/g, '/'));
 }
 exports.adjustStaticPathForGlob = adjustStaticPathForGlob;
-async function* dirStream(path, { depth = 0, onlyFiles = false, onlyFolders = false } = {}) {
+async function* dirStream(path, { depth = 0, onlyFiles = false, onlyFolders = false, hidden = true } = {}) {
     if (!await isDirectory(path))
         throw Error('ENOTDIR');
-    const dirStream = fast_glob_1.default.stream(depth ? '**/*' : '*', {
-        cwd: path,
-        dot: true,
-        deep: depth + 1,
-        onlyFiles,
-        onlyDirectories: onlyFolders,
-        suppressErrors: true,
-        objectMode: true,
-        unique: false,
-    });
-    const skip = await getItemsToSkip(path);
-    for await (const entry of dirStream) {
-        let { path, dirent } = entry;
-        const isDir = dirent.isDirectory();
-        if (!isDir && !dirent.isFile())
+    for await (const entry of (0, dirStream_1.createDirStream)(path, { depth, hidden })) {
+        const dirent = entry;
+        if (dirent.isDirectory() ? onlyFiles : (onlyFolders || !dirent.isFile()))
             continue;
-        path = String(path);
-        if (!(skip === null || skip === void 0 ? void 0 : skip.includes(path)))
-            yield [path, isDir];
-    }
-    async function getItemsToSkip(path) {
-        if (!const_1.IS_WINDOWS)
-            return;
-        const winPath = path.replace(/\//g, '\\');
-        const out = await (0, util_os_1.runCmd)('dir', ['/ah', '/b', depth ? '/s' : '/c', winPath]) // cannot pass '', so we pass /c as a noop parameter
-            .catch(() => ''); // error in case of no matching file
-        return out.split('\n').map(x => x.slice(!depth ? 0 : winPath.length + 1).trim().replace(/\\/g, '/'));
+        yield dirent;
     }
 }
 exports.dirStream = dirStream;
@@ -154,7 +132,7 @@ function createFileWithPath(path, options) {
 }
 exports.createFileWithPath = createFileWithPath;
 function isValidFileName(name) {
-    return !/[/*?<>|\\]/.test(name) && !dirTraversal(name);
+    return !(const_1.IS_WINDOWS ? /[/:"*?<>|\\]/ : /\//).test(name) && !dirTraversal(name);
 }
 exports.isValidFileName = isValidFileName;
 function exists(path) {

package/src/vfs.js

@@ -14,6 +14,8 @@ const const_1 = require("./const");
 const events_1 = __importDefault(require("./events"));
 const perm_1 = require("./perm");
 const auth_1 = require("./auth");
+const fswin_1 = __importDefault(require("fswin"));
+const showHiddenFiles = (0, config_1.defineConfig)('show_hidden_files', false);
 function permsFromParent(parent, child) {
     const ret = {};
     for (const k of misc_1.PERM_KEYS) {
@@ -88,7 +90,9 @@ async function urlToNode(url, ctx, parent = exports.vfs, getRest) {
         return urlToNode(rest, ctx, ret, getRest);
     if (ret.source)
         try {
-            const st = await promises_1.default.stat(ret.source); // check existence
+            if (!showHiddenFiles.get() && await isHiddenFile(ret.source))
+                throw 'hiddenFile';
+            const st = ret.stats || await promises_1.default.stat(ret.source); // check existence
             ret.isFolder = st.isDirectory();
         }
         catch (_a) {
@@ -101,10 +105,12 @@ async function urlToNode(url, ctx, parent = exports.vfs, getRest) {
     return ret;
 }
 exports.urlToNode = urlToNode;
+async function isHiddenFile(path) {
+    return const_1.IS_WINDOWS ? new Promise(res => fswin_1.default.getAttributes(path, x => res(x === null || x === void 0 ? void 0 : x.IS_HIDDEN)))
+        : path[0] === '.';
+}
 async function getNodeByName(name, parent) {
     var _a;
-    if (!(0, misc_1.isValidFileName)(name))
-        return;
     // does the tree node have a child that goes by this name, otherwise attempt disk
     const child = ((_a = parent.children) === null || _a === void 0 ? void 0 : _a.find(isSameFilenameAs(name))) || childFromDisk();
     return child && applyParentToChild(child, parent, name);
@@ -121,6 +127,8 @@ async function getNodeByName(name, parent) {
                 }
             ret.rename = renameUnderPath(parent.rename, name);
         }
+        if (!(0, misc_1.isValidFileName)(onDisk))
+            return;
         ret.source = (0, path_1.join)(parent.source, onDisk);
         ret.original = undefined; // overwrite in applyParentToChild, so we know this is not part of the vfs
         return ret;
@@ -157,16 +165,16 @@ function getNodeName(node) {
 }
 exports.getNodeName = getNodeName;
 async function nodeIsDirectory(node) {
-    var _a;
+    var _a, _b, _c;
     if (node.isFolder !== undefined)
         return node.isFolder;
-    const isFolder = Boolean(((_a = node.children) === null || _a === void 0 ? void 0 : _a.length) || !nodeIsLink(node) && (!node.source || await (0, misc_1.isDirectory)(node.source)));
+    const isFolder = Boolean(((_a = node.children) === null || _a === void 0 ? void 0 : _a.length) || !nodeIsLink(node) && ((_c = (_b = node.stats) === null || _b === void 0 ? void 0 : _b.isDirectory()) !== null && _c !== void 0 ? _c : (!node.source || await (0, misc_1.isDirectory)(node.source))));
     (0, misc_1.setHidden)(node, { isFolder }); // don't make it to the storage (a node.isTemp doesn't need it to be hidden)
     return isFolder;
 }
 exports.nodeIsDirectory = nodeIsDirectory;
 async function hasDefaultFile(node, ctx) {
-    return node.default && await urlToNode(node.default, ctx, node) || undefined;
+    return node.default && await nodeIsDirectory(node) && await urlToNode(node.default, ctx, node) || undefined;
 }
 exports.hasDefaultFile = hasDefaultFile;
 function nodeIsLink(node) {
@@ -220,7 +228,7 @@ function statusCodeForMissingPerm(node, perm, ctx, assign = true) {
 exports.statusCodeForMissingPerm = statusCodeForMissingPerm;
 // it's responsibility of the caller to verify you have list permission on parent, as callers have different needs.
 async function* walkNode(parent, { ctx, depth = Infinity, prefixPath = '', requiredPerm, onlyFolders = false } = {}) {
-    var _a;
+    var _a, _b;
     const { children, source } = parent;
     const took = prefixPath ? undefined : new Set();
     const maskApplier = parentMaskApplier(parent);
@@ -239,7 +247,7 @@ async function* walkNode(parent, { ctx, depth = Infinity, prefixPath = '', requi
                 try {
                     await promises_1.default.access(item.source);
                 }
-                catch (_b) {
+                catch (_c) {
                     continue;
                 }
             yield item;
@@ -256,13 +264,15 @@ async function* walkNode(parent, { ctx, depth = Infinity, prefixPath = '', requi
         && !hasPermission(parent, requiredPerm, ctx)
         && !masksCouldGivePermission(parent.masks, requiredPerm))
         return;
+    let n = 0;
     try {
         let lastDir = prefixPath.slice(0, -1) || '.';
         parentsCache.set(lastDir, parent);
-        // it's important to keep using dirStream in deep-mode, as it is manyfold faster (it parallelizes)
-        for await (const [path, isFolder] of (0, misc_1.dirStream)(source, { depth, onlyFolders })) {
+        for await (const entry of (0, misc_1.dirStream)(source, { depth, onlyFolders, hidden: showHiddenFiles.get() })) {
             if (ctx === null || ctx === void 0 ? void 0 : ctx.req.aborted)
                 return;
+            const { path } = entry;
+            const isFolder = entry.isDirectory();
             const name = prefixPath + (((_a = parent.rename) === null || _a === void 0 ? void 0 : _a[path]) || path);
             if (took === null || took === void 0 ? void 0 : took.has(normalizeFilename(name)))
                 continue;
@@ -281,11 +291,13 @@ async function* walkNode(parent, { ctx, depth = Infinity, prefixPath = '', requi
                 parentsCache.set(name, item);
             if (canSee(item))
                 yield item;
+            (_b = entry.closingBranch) === null || _b === void 0 ? void 0 : _b.then(p => parentsCache.delete(p || '.'));
         }
     }
     catch (e) {
-        console.debug('glob', source, e); // ENOTDIR, or lacking permissions
+        console.debug('walkNode', source, e); // ENOTDIR, or lacking permissions
     }
+    parentsCache.clear(); // hoping for faster GC
     // item will be changed, so be sure to pass a temp node
     function canSee(item) {
         // we basename for depth>0 where we already have the rest of the path in the parent's url, and would be duplicated

package/src/watchLoad.js

@@ -11,7 +11,7 @@ const misc_1 = require("./misc");
 function watchLoad(path, parser, { failedOnFirstAttempt, immediateFirst } = {}) {
     let doing = false;
     let watcher;
-    const debounced = (0, misc_1.debounceAsync)(load, 500, { maxWait: 1000 });
+    const debounced = (0, misc_1.debounceAsync)(load, { wait: 500, maxWait: 1000 });
     let retry;
     let last;
     install(true);

package/src/zip.js

@@ -17,12 +17,12 @@ const const_1 = require("./const");
 // expects 'node' to have had permissions checked by caller
 async function zipStreamFromFolder(node, ctx) {
     var _a;
-    if ((0, vfs_1.statusCodeForMissingPerm)(node, 'can_archive', ctx))
+    const list = (_a = (0, misc_1.wantArray)(ctx.query.list)[0]) === null || _a === void 0 ? void 0 : _a.split('*'); // we are using * as separator because it cannot be used in a file name and doesn't need url encoding
+    if (!list && (0, vfs_1.statusCodeForMissingPerm)(node, 'can_archive', ctx))
         return;
     ctx.status = const_1.HTTP_OK;
     ctx.mime = 'zip';
     // ctx.query.list is undefined | string | string[]
-    const list = (_a = (0, misc_1.wantArray)(ctx.query.list)[0]) === null || _a === void 0 ? void 0 : _a.split('*'); // we are using * as separator because it cannot be used in a file name and doesn't need url encoding
     const name = (list === null || list === void 0 ? void 0 : list.length) === 1 ? (0, misc_1.safeDecodeURIComponent)((0, path_1.basename)(list[0])) : (0, vfs_1.getNodeName)(node);
     ctx.attachment(((0, misc_1.isWindowsDrive)(name) ? name[0] : (name || 'archive')) + '.zip');
     const filter = (0, misc_1.pattern2filter)(String(ctx.query.search || ''));
@@ -33,7 +33,7 @@ async function zipStreamFromFolder(node, ctx) {
                 if (!subNode)
                     continue;
                 if (await (0, vfs_1.nodeIsDirectory)(subNode)) { // a directory needs to walked
-                    if ((0, vfs_1.hasPermission)(subNode, 'can_list', ctx)) {
+                    if ((0, vfs_1.hasPermission)(subNode, 'can_list', ctx) && (0, vfs_1.hasPermission)(subNode, 'can_archive', ctx)) {
                         yield subNode; // it could be empty
                         yield* (0, vfs_1.walkNode)(subNode, { ctx, prefixPath: decodeURI(uri) + '/', requiredPerm: 'can_archive' });
                     }
@@ -58,7 +58,7 @@ async function zipStreamFromFolder(node, ctx) {
                 return { path: name + '/' };
             if (!source)
                 return;
-            const st = await promises_1.default.stat(source);
+            const st = el.stats || await promises_1.default.stat(source);
             if (!st || !st.isFile())
                 return;
             return {

package/README.md

@@ -1,232 +0,0 @@
-# HFS: HTTP File Server (version 3)
-
-![logo and motto](hfs-logo-color-motto.svg)
-
-## Introduction
-
-Access via web your files directly from your disk.
-
-- You be the server, share files **fresh from your disk**, with **unlimited** space and bandwidth.
-- **Fast!** Try zipping 100GB, download starts immediately!
-- **Intelligent**. HFS tries to detect problems and suggest solutions.
-- Share **even a single file** with our *virtual file system*, even with a different name, all without touching the real file. Present things the way you want!
-- **Watch** all activities in real-time.
-- **Control bandwidth**, decide how much to give.
-- **No intermediaries**, give a huge file to your friend without waiting for it to be uploaded on a server first.
-
-This is a full rewrite of [the Delphi version](https://github.com/rejetto/hfs2).
-
-## How does it work
-
-- run HFS on your computer, administration page automatically shows up
-- select what files and folders you want to be accessible
-- access those files from a phone or another computer just using a browser
-- possibly create accounts and limit access to files
-
-## Features
-
-- https
-- easy certificate generation
-- unicode
-- virtual file system
-- mobile friendly
-- search
-- accounts
-- resumable downloads & uploads
-- download folders as zip archive
-- delete, move and rename files
-- simple website serving
-- plug-ins
-- real-time monitoring of connections
-- [show some files](https://github.com/rejetto/hfs/discussions/270)
-- speed throttler
-- geographic firewall
-- admin web interface
-- multi-language front-end
-- virtual hosting
-- anti-brute-force (plug-in)
-- [reverse-proxy support](https://github.com/rejetto/hfs/wiki/Reverse-proxy)
-- comments in file descript.ion
-- integrated media player
-- [customizable with html, css and javascript](https://github.com/rejetto/hfs/wiki/Customization)
-- dynamic-dns updater
-
-## Installation
-
-NB: minimum Windows version required is 8.1 , Windows Server 2012 R2 (because of Node.js 18)
-
-1. go to https://github.com/rejetto/hfs/releases
-2. click on `Assets`
-3. **download** the right version for your system, unzip and launch `hfs` file. 
-   - Mac: if you get *"cannot be opened because it is from an unidentified developer"*,
-     you can hold `control` key while clicking, then click `open`.
-   - If you cannot find your system in the list, see next section [Other systems](#other-systems).
-4. the browser should automatically open on `localhost` address, so you can configure the rest in the Admin-panel.
-   - if a browser cannot be opened on the computer where you are installing HFS, 
-     you should enter this command in the HFS console: `create-admin <PASSWORD>`
-   - if you cannot access the console (like when you are running as a service), 
-       you can [edit the config file to add your admin account](config.md#accounts)
-   - if you don't want to use an editor you can create the file with this command: 
-     
-     `echo "create-admin: PASSWORD" > config.yaml` 
-
-If you access *Admin-panel* via localhost, by default HFS **won't** require you to login.
-If you don't like this behavior, disable it in the Admin-panel or enter this console command `config localhost_admin false`.
-
-### Other systems
-
-If your system is not Windows/Linux/Mac or you just don't want to run the binaries, you can try this alternative version:
-
-1. [install node.js](https://nodejs.org) version 18
-2. execute at command line `npx hfs@latest`
-
-The `@latest` part is optional, and ensures that you are always up to date.
-
-If this procedure fails, it may be that you are missing one of [these requirements](https://github.com/nodejs/node-gyp#installation).
-
-Configuration and other files will be stored in `%HOME%/.vfs`
-
-### Service
-
-If you want to run HFS at boot (as a service), we suggest the following methods
-
-#### On Linux 
-1. [install node.js](https://nodejs.org)
-2. create a file `/etc/systemd/system/hfs.service` with this content
-  ```
-  [Unit]
-  Description=HFS
-  After=network.target
-  
-  [Service]
-  Type=simple
-  Restart=always
-  ExecStart=/usr/bin/npx -y hfs@latest
-  
-  [Install]
-  WantedBy=multi-user.target
-  ```
-3. run `sudo systemctl daemon-reload && sudo systemctl enable hfs && sudo systemctl start hfs && sudo systemctl status hfs`
-
-NB: update will be attempted at each restart
-
-#### On Windows
-
-1. [install node.js](https://nodejs.org)
-2. run `npm -g i hfs`
-3. run `npx qckwinsvc2 install name="HFS" description="HFS" path="%APPDATA%\npm\node_modules\hfs\src\index.js" args="--cwd %HOMEPATH%\.hfs" now`
-  
-To update 
-- run `npx qckwinsvc2 uninstall name="HFS"`
-- run `npm -g update hfs`
-- run `npx qckwinsvc2 install name="HFS" description="HFS" path="%APPDATA%\npm\node_modules\hfs\src\index.js" args="--cwd %HOMEPATH%\.hfs" now`
-
-## Console commands
-
-If you have full access to HFS' console, you can enter commands. Start with `help` to have a full list.
-
-## Configuration
-
-For configuration please see [file config.md](config.md).
-
-### Where is it stored
-
-Configuration is stored in the file `config.yaml`, exception made for custom HTML which is stored in `custom.html`.
-
-These files are kept in the Current Working Directory (cwd), which is by default the same folder of `hfs.exe`
-if you are using this kind of distribution on Windows, or `USER_FOLDER/.hfs` on other systems.
-You can decide a different folder passing `--cwd SOME_FOLDER` parameter at command line.
-Any relative path provided is relative to the *cwd*.
-
-[Check details about config file format](config.md).
-
-## Internationalization
-
-It is possible to show the Front-end in other languages.
-Translation for some languages is already provided. If you find an error, consider reporting it
-or [editing the source file](https://github.com/rejetto/hfs/tree/main/src/langs). 
-
-In the Languages section of the Admin-panel you can install additional language files.
-
-If your language is missing, please consider [translating yourself](https://github.com/rejetto/hfs/wiki/Translation). 
-
-## Why you should upgrade from HFS 2.x
-
-HFS 2.x is vulnerable to important attacks, and there is no known solution at the moment.
-
-As you can see from the list of features, we already have some goods that you cannot find in HFS 2.
-Other than that, you can also consider: 
-
-- it's more robust: it was designed to be an always-running server, while HFS 1-2 was designed for occasional usage (transfer and quit) 
-- passwords are never really stored, just a non-reversible hash is
-- faster search (up to 12x)
-- more flexible permissions
-
-## Security
-
-While this project focuses on ease of use, we care about security.
-- HTTPS support
-- Passwords are not saved, and not disclosed even without https thanks to [SRP](https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol)
-- Automated tests ran on every release, including libraries audit
-- No default admin password
-
-Some actions you can take for improved security:
-- use https, better if using a proper certificate, even free with [Letsencrypt](https://letsencrypt.org/).
-- have a domain (ddns is ok too), configure it in "Internet" page, and enable "Accept requests only using domain"
-- install "antidos" plugin
-- ensure "antibrute" plugin is running
-- disable "unprotected admin on localhost"
-
-## Hidden features
-
-- Appending `#LOGIN` to address will bring up the login dialog
-- Appending ?lang=CODE to address will force a specific language
-- right/ctrl/command click on toggle-all checkbox will invert each checkbox state
-- Appending `?login=USER:PASSWORD` will automatically log in the browser
-- Appending `?overwrite` on uploads, will override the dont_overwrite_uploading configuration, provided you also have delete permission
-- Appending `?search=PATTERN` will trigger search at start 
-- Right-click on "check for updates" will let you input a URL of a version to install
-- shift+click on a file will show & play
-
-## Contribute
-
-There are several ways to contribute
-
-- [Report bugs](https://github.com/rejetto/hfs/issues/new?labels=bug&template=bug_report.md)
-
-  It's very important to report bugs, and if you are not so sure about it, don't worry, we'll discuss it.
-  If you find important security problems, please [contact us privately](mailto:a@rejetto.com) so that we can publish a fix before
-  the problem is disclosed, for the safety of other users.  
-
-- Use beta versions, and give feedback. 
-
-  While betas have more problems, you'll get more features and give a huge help to the project. 
-
-- [Translate to your language](https://github.com/rejetto/hfs/wiki/Translation).
-
-- [Suggest ideas](https://github.com/rejetto/hfs/discussions)
-
-  While the project should not become too complex, yours may be an idea for a plugin.
-
-- Write guides or make videos for other users. [We got a wiki](https://github.com/rejetto/hfs/wiki)! 
-
-- Submit your code
-
-  If you'd like to make a change yourself in the code, please first open an "issue" or "discussion" about it,
-  so we'll try to cooperate and understand what's the best path for it.
-
-- [Make a plugin](dev-plugins.md)
-
-  A plugin can change the look (a theme), and/or introduce a new functionality.
-
-## More
-
-- [APIs](https://github.com/rejetto/hfs/wiki/APIs)
-
-- [Build yourself](dev.md)
-
-- [License](https://github.com/rejetto/hfs/blob/master/LICENSE.txt)
-
-- [To-do list](todo.md) 
-
-- Flag images are public-domain, downloaded from https://flagpedia.net