hfs 3.2.1 → 3.2.2

package/src/middlewares.js

@@ -142,9 +142,11 @@ const prepareState = async (ctx, next) => {
 };
 exports.prepareState = prepareState;
 function failAllowNet(ctx, a) {
-    const cached = ctx.session?.allowNet; // won't reflect changes until session is terminated
+    // a cached mask is valid only for the identity that stored it
+    const sameAccount = ctx.session?.username === (0, perm_1.normalizeUsername)(a?.username || '');
+    const cached = sameAccount ? ctx.session?.allowNet : undefined;
     const mask = cached ?? (0, perm_1.getFromAccount)(a || '', a => a.allow_net);
-    if (!cached && mask && ctx.session?.username)
+    if (sameAccount && !cached && mask)
         ctx.session.allowNet = mask; // must be deleted on logout by setLoggedIn
     const ret = mask && !(0, misc_1.netMatches)(ctx.ip, mask, true);
     if (ret)

package/src/nat.js

@@ -144,8 +144,10 @@ function findGateway() {
     return new Promise((resolve, reject) => (0, child_process_1.exec)(const_1.IS_WINDOWS || const_1.IS_MAC ? 'netstat -rn' : 'route -n', (err, out) => {
         if (err)
             return reject(err);
-        if (!const_1.IS_WINDOWS)
-            return resolve(out.match(const_1.IS_MAC ? /default +([\d.]+)/ : /^0\.0\.0\.0 +([\d.]+)/)?.[1]);
+        if (!const_1.IS_WINDOWS) {
+            // linux route output starts with headers, so its default-route pattern must be multiline
+            return resolve(out.match(const_1.IS_MAC ? /default +([\d.]+)/ : /^0\.0\.0\.0 +([\d.]+)/m)?.[1]);
+        }
         const sortedByMetric = lodash_1.default.sortBy([...out.matchAll(/(?:0\.0\.0\.0 +){2}([\d.]+)\s+[\d.]+\s+(\d+)/g)], x => Number(x[2]));
         resolve(sortedByMetric[0]?.[1]); // take ip with lowest metric
     }));

package/src/outboundProxy.js

@@ -6,6 +6,7 @@ const util_os_1 = require("./util-os");
 const const_1 = require("./const");
 const cross_1 = require("./cross");
 const outboundProxy = (0, config_1.defineConfig)(cross_1.CFG.outbound_proxy, '', v => {
+    util_http_1.httpStream.defaultProxy = undefined;
     if (!v)
         return;
     try {

package/src/selfCheck.js

@@ -11,10 +11,10 @@ const net_1 = require("net");
 const lodash_1 = __importDefault(require("lodash"));
 const cross_1 = require("./cross");
 const util_http_1 = require("./util-http");
-let selfChecking = false;
+let activeSelfChecks = 0;
 const CHECK_URL = cross_const_1.SPECIAL_URI + 'self-check';
 const selfCheckMiddleware = (ctx, next) => {
-    if (!selfChecking || !ctx.url.startsWith(CHECK_URL))
+    if (!activeSelfChecks || !ctx.url.startsWith(CHECK_URL))
         return next();
     ctx.body = 'HFS';
     ctx.state.skipFilters = true;
@@ -26,7 +26,7 @@ async function selfCheck(url) {
     const parsed = new URL(url);
     const family = !(0, net_1.isIP)(parsed.hostname) ? undefined : (0, net_1.isIPv6)(parsed.hostname) ? 6 : 4;
     try {
-        selfChecking = true;
+        ++activeSelfChecks;
         for (const services of lodash_1.default.chunk(lodash_1.default.shuffle(prjInfo.selfCheckServices), 2)) {
             try {
                 const results = await Promise.allSettled(services.map(async (svc) => {
@@ -57,7 +57,7 @@ async function selfCheck(url) {
         }
     }
     finally {
-        selfChecking = false;
+        --activeSelfChecks;
     }
     function applySymbols(s) {
         return s?.replace('$IP', parsed.hostname)

package/src/serveFile.js

@@ -37,9 +37,11 @@ function forceDownload(ctx, name) {
     disposition(ctx, name, true);
 }
 function disposition(ctx, name, forceDownload = false) {
-    // ctx.attachment is not working well on Windows. Eg: for the file "èÖ.txt" it is producing `Content-Disposition: attachment; filename="??.txt"`. Koa uses module content-disposition, that actually produces a better result anyway: ``
-    ctx.set('Content-Disposition', (forceDownload ? 'attachment; ' : '')
-        + `filename="${toAsciiEquivalent(name)}"; filename*=UTF-8''${encodeURIComponent(name)}`);
+    // override Koa's question-mark fallback for decomposed Unicode filenames on Windows
+    ctx.attachment(name, {
+        type: forceDownload ? 'attachment' : 'inline',
+        fallback: toAsciiEquivalent(name),
+    });
 }
 async function serveFileNode(ctx, node) {
     const { source, mime } = node;

package/src/upload.js

@@ -132,7 +132,7 @@ function uploadWriter(base, baseUri, filename, ctx) {
         // append if resuming
         if (!resume && stats)
             fs_1.default.unlinkSync(tempName);
-        const writeStream = (0, misc_1.createStreamLimiter)(contentLength ?? Infinity);
+        const writeStream = (0, misc_1.createStreamLimiter)(isNaN(contentLength) ? Infinity : contentLength);
         const fullSize = stillToWrite + resume;
         // allow plugins to mess with the write-stream, because the read-stream can be complicated in case of multipart
         const obj = { ctx, writeStream, fullPath, tempName, resume, fullSize, uri: '' };

package/src/vfs.js

@@ -485,10 +485,14 @@ events_1.default.on('accountRenamed', ({ from, to }) => {
     })(exports.vfs);
     (0, exports.saveVfs)();
     function renameInPerm(a) {
-        if (!Array.isArray(a))
+        if ((0, misc_1.isWhoObject)(a)) {
+            renameInPerm(a.this);
+            renameInPerm(a.children);
             return;
-        for (let i = 0; i < a.length; i++)
-            if (a[i] === from)
-                a[i] = to;
+        }
+        if (Array.isArray(a))
+            for (let i = 0; i < a.length; i++)
+                if (a[i] === from)
+                    a[i] = to;
     }
 });

package/src/webdav.js

@@ -246,6 +246,18 @@ const webdav = async (ctx, next) => {
     }
     async function handleLock() {
         setWebdavHeaders();
+        // a lock reserves a future write, so authorize it against the existing resource or its parent
+        const node = await (0, vfs_1.urlToNode)(path, ctx);
+        const permissionNode = node || await (0, vfs_1.urlToNode)((0, path_1.dirname)(path), ctx);
+        if (!permissionNode)
+            return ctx.status = cross_1.HTTP_CONFLICT;
+        const missingWritePerm = node && canOverwrite.has(path + (0, cross_1.prefix)('|', (0, auth_1.getCurrentUsername)(ctx))) ? 0
+            : (0, vfs_1.statusCodeForMissingPerm)(permissionNode, node ? 'can_delete' : 'can_upload', ctx);
+        if (missingWritePerm) {
+            if (ctx.status === cross_1.HTTP_UNAUTHORIZED)
+                setWebdavHeaders(true);
+            return;
+        }
         const body = ctx.length || ctx.get('content-length') || ctx.get('transfer-encoding') ? await (0, consumers_1.text)(ctx.req) : '';
         const token = getProvidedLockToken();
         let seconds = Number(ctx.get('timeout').split(',').find(x => /^Second-\d+$/i.test(x.trim()))?.trim().split('-', 2)[1]);

package/src/zip.js

@@ -39,8 +39,9 @@ async function zipStreamFromFolder(node, ctx) {
                     continue;
                 if ((0, vfs_1.nodeIsFolder)(subNode)) { // a directory needs to be walked
                     if ((0, vfs_1.hasPermission)(subNode, 'can_list', ctx) && (0, vfs_1.hasPermission)(subNode, 'can_archive', ctx)) {
-                        yield subNode; // it could be empty
-                        yield* (0, vfs_1.walkNode)(subNode, { ctx, prefixPath: (0, misc_1.pathDecodeSegments)(uri) + '/', requiredPerm: 'can_archive' });
+                        const archivePath = (0, misc_1.pathDecodeSegments)(uri);
+                        yield { ...subNode, name: archivePath }; // keep empty selected folders at the same path used for their contents
+                        yield* (0, vfs_1.walkNode)(subNode, { ctx, prefixPath: archivePath + '/', requiredPerm: 'can_archive' });
                     }
                     continue;
                 }