hfs 3.3.0-beta3 → 3.3.0-rc5

package/plugins/antibrute/plugin.js

@@ -16,10 +16,10 @@ exports.configDialog = {
     maxWidth: 'xs',
 }
 
-const byIp = {}
-const byAccount = {}
-const laneByIp = {}
-const laneByAccount = {}
+const byIp = new Map()
+const byAccount = new Map()
+const laneByIp = new Map()
+const laneByAccount = new Map()
 const UNKNOWN_ACCOUNT = 'unknown\t'
 
 exports.init = api => {
@@ -107,7 +107,12 @@ exports.init = api => {
     })
 
     function getRecord(container, key) {
-        return container[key] ||= { failures: 0, next: 0, waiting: 0 }
+        let rec = container.get(key)
+        if (!rec) {
+            rec = { failures: 0, next: 0, waiting: 0 }
+            container.set(key, rec)
+        }
+        return rec
     }
 
     function increasePenalty(rec, now) {
@@ -124,7 +129,7 @@ exports.init = api => {
             // keep records while there are in-flight admissions, otherwise later releases may touch deleted state
             if (rec.waiting)
                 return armCleanup(records, key, rec)
-            delete records[key]
+            records.delete(key)
         }, 24 * HOUR) // no memory leak
     }
 
@@ -138,7 +143,12 @@ exports.init = api => {
     }
 
     function getLane(container, key) {
-        return container[key] ||= makeQ(1)
+        let lane = container.get(key)
+        if (!lane) {
+            lane = makeQ(1)
+            container.set(key, lane)
+        }
+        return lane
     }
 
     function runInLane(q, job) {
@@ -151,13 +161,13 @@ exports.init = api => {
     }
 
     function dropLaneIfIdle(container, key) {
-        const q = container[key]
+        const q = container.get(key)
         if (q?.isWorking() || q?.queueSize()) return
-        delete container[key]
+        container.delete(key)
     }
 
     function resetRecord(container, key) {
-        const rec = container[key]
+        const rec = container.get(key)
         if (!rec) return
         if (rec.waiting) {
             // successful login must clear penalties without dropping admission counters still needed by concurrent requests
@@ -165,14 +175,13 @@ exports.init = api => {
             rec.next = 0
             return
         }
-        delete container[key]
+        container.delete(key)
     }
 
     function getAccountKey(username) {
         // fold unknown usernames together to avoid unbounded memory growth from random names
-        if (!username || !api.getAccount(String(username)))
-            return UNKNOWN_ACCOUNT
-        return String(username).toLowerCase()
+        const account = username && api.getAccount(String(username))
+        return account ? account.username : UNKNOWN_ACCOUNT
     }
 
     function isExcluded(ip) {

package/src/api.accounts.js

@@ -61,7 +61,7 @@ exports.default = {
             return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST);
         await (0, perm_1.updateAccount)(acc, (0, api_vfs_1.pickProps)(changes, ALLOWED_KEYS));
         if (changes.username && ctx.session?.username === (0, perm_1.normalizeUsername)(username)) // update session if necessary
-            ctx.session.username = (0, perm_1.normalizeUsername)(changes.username);
+            ctx.session.username = acc.username;
         return lodash_1.default.pick(acc, 'username');
     },
     async add_account({ overwrite, username, ...rest }) {

package/src/api.auth.js

@@ -80,6 +80,7 @@ exports.authApis = {
             const sid = (0, node_crypto_1.randomUUID)();
             ongoingLogins[sid] = srpServer;
             setTimeout(() => delete ongoingLogins[sid], 60_000); // client must complete api sequence (loginSrp2) within 1 minute or will be discarded to avoid memory leaks
+            // 60-second expiry bounded 5k challenges to ~37 MB in a local saturation test, so an additional cap isn't justified
             ctx.session.loggingIn = { username, sid }; // temporarily store until process is complete
             return rest;
         }

package/src/api.monitor.js

@@ -108,7 +108,7 @@ function inferOperation(ctx) {
             : s.uploadPath ? { op: 'upload', path: (0, misc_1.safeDecodeURIComponent)(s.uploadPath) }
                 : {
                     op: !s.considerAsGui && (ctx.state.archive || ctx.state.vfsNode) ? 'download' : undefined,
-                    path: (0, misc_1.safeDecodeURIComponent)(ctx.originalUrl),
+                    path: (0, misc_1.safeDecodeURIComponent)(s.safeUrl),
                 },
         opProgress: lodash_1.default.isNumber(s.opProgress) ? lodash_1.default.round(s.opProgress, 3) : undefined,
         opTotal: s.opTotal,

package/src/config.js

@@ -80,13 +80,13 @@ function defineConfig(k, defaultValue, compiler) {
         },
         sub(cb) {
             if (started) // initial event already passed, we'll make the first call
-                cb(getConfig(k), { k, was: defaultValue, defaultValue, version: configVersion.compiled(), object });
+                cb(getConfig(k), { k, was: defaultValue, defaultValue, version: configVersion.compiled(), set, object });
             return events_1.default.on(CONFIG_CHANGE_EVENT_PREFIX + k, (v, was, version, onlyCompileChanged) => {
                 if (stack.includes(cb))
                     return; // avoid infinite loop in case a subscriber changes the value
                 stack.push(cb);
                 try {
-                    return cb(v, { k, was, version, defaultValue, object, onlyCompileChanged });
+                    return cb(v, { k, was, version, set, defaultValue, object, onlyCompileChanged });
                 }
                 finally {
                     stack.pop();
@@ -109,7 +109,8 @@ function defineConfig(k, defaultValue, compiler) {
         },
         dontStore() { dontStore.push(k); },
     };
-    let compiled = compiler?.(defaultValue, { k, version: exports.currentVersion, defaultValue, object });
+    const set = object.set.bind(object);
+    let compiled = compiler?.(defaultValue, { k, version: exports.currentVersion, set, defaultValue, object });
     if (compiler)
         object.sub((v, more) => {
             if (!more.onlyCompileChanged)
@@ -154,13 +155,13 @@ async function setConfig(newCfg, save) {
         return;
     }
     // first time we emit also for the default values
-    await Promise.allSettled(Object.keys(configProps).map(k => newCfg.hasOwnProperty(k) || apply(k, undefined, true)));
+    await Promise.allSettled(Object.keys(configProps).map(k => newCfg.hasOwnProperty(k) || apply(k, undefined)));
     started = true;
     events_1.default.emit('configReady', startedWithoutConfig);
     if (version?.valueOf() !== const_1.VERSION) // be sure to save the new version in the file
         (0, exports.saveConfigAsap)();
-    function apply(k, newV, isDefault = false) {
-        return setConfig1(k, newV, save === undefined, argCfg && k in argCfg || isDefault ? exports.currentVersion : version);
+    function apply(k, newV) {
+        return setConfig1(k, newV, save === undefined, !lodash_1.default.has(argCfg, k) && version || exports.currentVersion);
     }
 }
 async function setConfig1(k, newV, saveChanges = true, valueVersion) {

package/src/cross.js

@@ -356,7 +356,7 @@ function randomId(len = 10) {
         .replace(/l/g, 'L'); // avoid confusion reading l1
 }
 function objRenameKey(o, from, to) {
-    if (!o || !o.hasOwnProperty(from) || from === to)
+    if (!o || !Object.hasOwn(o, from) || from === to)
         return;
     o[to] = o[from];
     delete o[from];

package/src/customHtml.js

@@ -11,7 +11,6 @@ exports.saveCustomHtml = saveCustomHtml;
 const misc_1 = require("./misc");
 const watchLoad_1 = require("./watchLoad");
 const config_1 = require("./config");
-const promises_1 = require("fs/promises");
 const plugins_1 = require("./plugins");
 const lodash_1 = __importDefault(require("lodash"));
 const FILE = 'custom.html';
@@ -50,9 +49,5 @@ function getAllSections() {
 }
 async function saveCustomHtml(sections) {
     const text = Object.entries(sections).filter(([k, v]) => v?.trim()).map(([k, v]) => `[${k}]\n${v}\n\n`).join('');
-    await (0, promises_1.writeFile)(FILE, text);
-    exports.customHtml.sections.clear();
-    for (const [k, v] of Object.entries(sections))
-        if (v)
-            exports.customHtml.sections.set(k, v);
+    await exports.customHtml.save(text, { reparse: true });
 }

package/src/frontEndApis.js

@@ -80,6 +80,7 @@ exports.frontEndApis = {
             return new apiMiddleware_1.ApiError(err);
         try {
             await (0, promises_1.mkdir)((0, path_1.join)(parentNode.source, name));
+            await (0, uploadOwners_1.setUploadOwner)((0, misc_1.join)(uri, (0, misc_1.pathEncode)(name)), ctx);
             return {};
         }
         catch (e) {
@@ -219,7 +220,7 @@ async function requestedRename(node, newName, ctx, uri = ctx.path) {
     else {
         if (!node.source)
             throw new apiMiddleware_1.ApiError(const_1.HTTP_FAILED_DEPENDENCY);
-        const destNode = await (0, vfs_1.urlToNode)((0, misc_1.pathEncode)(newName), ctx, node.parent);
+        const destNode = await (0, vfs_1.urlToNode)((0, misc_1.pathEncode)(newName), ctx, node.parent, { includeHidden: true });
         if (destNode && (0, vfs_1.statusCodeForMissingPerm)(destNode, 'can_delete', ctx)) // if destination exists, you need delete permission
             throw new apiMiddleware_1.ApiError(ctx.status);
         try {

package/src/log.js

@@ -169,7 +169,7 @@ const logMw = async (ctx, next) => {
         const date = `${a[2]}/${a[1]}/${a[3]}:${a[4]} ${a[5]?.slice(3)}`;
         const user = (0, auth_1.getCurrentUsername)(ctx) || userAtStart;
         const length = ctx.state.length ?? ctx.length;
-        const uri = ctx.originalUrl;
+        const uri = ctx.state.safeUrl;
         const duration = (Number(reqEnd) - Number(reqStart)) / 1000;
         ctx.logExtra(ctx.vfsNode && {
             speed: Math.round(length / duration),

package/src/middlewares.js

@@ -92,6 +92,12 @@ function getProxyDetected() {
 const prepareState = async (ctx, next) => {
     // normalize once so auth, filters and logging agree on the same client address
     ctx.request.ip = (0, connections_1.normalizeIp)(ctx.ip);
+    ctx.state.safeUrl = ctx.originalUrl;
+    if (ctx.query.login) {
+        const query = new URLSearchParams(ctx.querystring);
+        query.set('login', '...');
+        ctx.state.safeUrl = `${ctx.path}?${query}`;
+    }
     const s = ctx.session;
     if (s?.username) {
         if (s.ts < auth_1.invalidateSessionBefore.get(s?.username))

package/src/multipartUpload.js

@@ -77,7 +77,7 @@ async function handleMultipartUpload(ctx, node) {
         const prefix = (0, path_1.dirname)(fn.replaceAll('\\', '/'));
         if (prefix === '.') // no subdir
             return false;
-        const subfolderNode = await (0, vfs_1.urlToNode)(prefix + '/', ctx, node, true); // final slash = explicitly a folder even if it doesn't exist on disk
+        const subfolderNode = await (0, vfs_1.urlToNode)(prefix + '/', ctx, node, { allowMissing: true }); // final slash = explicitly a folder even if it doesn't exist on disk
         return subfolderNode && !(0, vfs_1.hasPermission)(subfolderNode, 'can_upload', ctx);
     }
 }

package/src/perm.js

@@ -54,7 +54,8 @@ function getUsernames() {
 function getAccount(username, normalize = true) {
     if (normalize)
         username = normalizeUsername(username);
-    return username ? exports.accounts.get()[username] : undefined;
+    const all = exports.accounts.get();
+    return username && Object.hasOwn(all, username) ? all[username] : undefined;
 }
 function saveSrpInfo(account, salt, verifier) {
     account.srp = String(salt) + '|' + String(verifier);
@@ -79,10 +80,13 @@ async function updateAccount(account, change) {
         await change?.(account);
     else {
         const u = normalizeUsername(change.username || '');
-        if (!u)
+        if (!u || isPrototypeKey(u))
             delete change.username;
-        else if (u !== usernameWas && getAccount(u))
-            throw "username already exists";
+        else {
+            if (u !== usernameWas && getAccount(u))
+                throw "username already exists";
+            change.username = u;
+        }
         Object.assign(account, lodash_1.default.mapValues(change, x => x || undefined));
     }
     for (const [k, v] of (0, misc_1.typedEntries)(account))
@@ -98,7 +102,7 @@ async function updateAccount(account, change) {
     if (account.belongs) {
         account.belongs = (0, misc_1.wantArray)(account.belongs);
         lodash_1.default.remove(account.belongs, b => {
-            if (exports.accounts.get().hasOwnProperty(b))
+            if (Object.hasOwn(exports.accounts.get(), b))
                 return;
             console.error(`Account ${username} belongs to non-existing ${b}`);
             return true;
@@ -118,6 +122,11 @@ exports.accounts.sub(lodash_1.default.debounce(obj => {
     // consider some validation here, in case of manual edit of the config
     lodash_1.default.each(obj, (rec, k) => {
         const norm = normalizeUsername(k);
+        if (isPrototypeKey(norm)) {
+            delete obj[k];
+            saveAccountsAsap();
+            return;
+        }
         if (rec?.username !== norm) {
             if (!rec) // an empty object in yaml is parsed as null
                 rec = obj[norm] = { username: norm };
@@ -154,11 +163,14 @@ exports.accounts.sub(lodash_1.default.debounce(obj => {
 function normalizeUsername(username) {
     return username.toLocaleLowerCase();
 }
+function isPrototypeKey(username) {
+    return username === '__proto__' || username === 'constructor';
+}
 function renameAccount(from, to) {
     from = normalizeUsername(from);
     const as = exports.accounts.get();
     to = normalizeUsername(to);
-    if (!to || !as[from] || as[to])
+    if (!to || isPrototypeKey(to) || !Object.hasOwn(as, from) || Object.hasOwn(as, to))
         return false;
     if (to === from)
         return true;
@@ -177,7 +189,7 @@ function renameAccount(from, to) {
 }
 function addAccount(username, props, updateExisting = false) {
     username = normalizeUsername(username);
-    if (!username)
+    if (!username || isPrototypeKey(username))
         return;
     let account = getAccount(username, false);
     if (account && !updateExisting)

package/src/serveFile.js

@@ -7,6 +7,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.forceDownload = forceDownload;
 exports.disposition = disposition;
 exports.serveFileNode = serveFileNode;
+exports.enforceDownloadLimits = enforceDownloadLimits;
 exports.serveFile = serveFile;
 exports.monitorAsDownload = monitorAsDownload;
 exports.applyRange = applyRange;
@@ -63,8 +64,11 @@ async function serveFileNode(ctx, node) {
             // legacy clients often send Accept: */* for archive downloads, so the served mime is a safer signal than request headers here
             : GUI_ASSET_MIME.test(mimeString || mime_types_1.default.lookup(source || '') || ''));
     await serveFile(ctx, source || '', mimeString);
-    if (await maxDownloadsPerAccount(ctx) === undefined) // returning false will not execute other limits
-        await maxDownloads(ctx) || await maxDownloadsPerIp(ctx);
+    await enforceDownloadLimits(ctx);
+}
+async function enforceDownloadLimits(ctx) {
+    return await maxDownloadsPerAccount(ctx)
+        ?? (await maxDownloads(ctx) || await maxDownloadsPerIp(ctx)); // a configured account limit overrides the global and IP limits
 }
 const mimeCfg = (0, config_1.defineConfig)(misc_1.CFG.mime, {}, obj => {
     const matchers = Object.keys(obj).map(k => (0, misc_1.makeMatcher)(k));

package/src/serveGuiAndSharedFiles.js

@@ -71,7 +71,7 @@ const serveSharedFiles = async (ctx, next) => {
         const decPath = (0, misc_1.safeDecodeURIComponent)(path, '');
         const fn = (0, path_1.basename)(decPath);
         const folderUri = (0, misc_1.pathEncode)((0, path_1.dirname)(decPath)); // re-encode to get readable urls
-        const folder = await (0, vfs_1.urlToNode)(folderUri, ctx, vfs_1.vfs.compiled(), true); // we don't require the folder to already exist, but to be mapped on disk AND to have proper permissions
+        const folder = await (0, vfs_1.urlToNode)(folderUri, ctx, vfs_1.vfs.compiled(), { allowMissing: true }); // we don't require the folder to already exist, but to be mapped on disk AND to have proper permissions
         if (!folder)
             return (0, errorPages_1.sendErrorPage)(ctx, cross_const_1.HTTP_NOT_FOUND);
         ctx.state.uploadPath = decPath;

package/src/serveGuiFiles.js

@@ -22,10 +22,14 @@ const lang_1 = require("./lang");
 const upload_1 = require("./upload");
 const icons_1 = require("./icons");
 const middlewares_1 = require("./middlewares");
+(0, config_1.defineConfig)(misc_1.CFG.menu_at_top, misc_1.FRONTEND_OPTIONS[misc_1.CFG.menu_at_top]).sub((v, { version, set }) => {
+    if (!v && version?.olderThan('3.3.0-alpha1')) // preserve the layout used before this option existed for upgraded installations
+        set(true);
+});
 const size1024 = (0, config_1.defineConfig)(misc_1.CFG.size_1024, false, x => misc_1.formatBytes.k = x ? 1024 : 1000); // we both configure formatBytes, and also provide a compiled version (number instead of boolean)
 const splitUploads = (0, config_1.defineConfig)(misc_1.CFG.split_uploads, 0);
 exports.logGui = (0, config_1.defineConfig)(misc_1.CFG.log_gui, false);
-lodash_1.default.each(misc_1.FRONTEND_OPTIONS, (v, k) => (0, config_1.defineConfig)(k, v)); // define default values
+lodash_1.default.each(misc_1.FRONTEND_OPTIONS, (v, k) => k !== misc_1.CFG.menu_at_top && (0, config_1.defineConfig)(k, v)); // define default values
 function serveStatic(uri) {
     const folder = (const_1.DEV ? 'dist/' : '') + uri.slice(2, -1);
     const root = (0, path_1.join)(__dirname, '..', folder);

package/src/uploadOwners.js

@@ -88,7 +88,7 @@ function getSessionId(ctx) {
     return ctx.session.sessionId ||= (0, misc_1.randomId)(30);
 }
 function cleanVfsPath(path) {
-    return '/' + path.replace(/^\/+|\/+$/g, '');
+    return (0, misc_1.pathDecodeSegments)('/' + path.replace(/^\/+|\/+$/g, ''), misc_1.pathEncode);
 }
 function isSameOrInside(parent, path) {
     return path === parent || path.startsWith(parent + '/');

package/src/vfs.js

@@ -108,8 +108,7 @@ async function applyParentToChild(child, parent, name) {
     inheritFromParent(ret);
     return ret;
 }
-async function urlToNode(url, ctx, parent = exports.vfs.compiled(), allowMissing // true means missing path segments still resolve to temporary nodes with a computed source path
-) {
+async function urlToNode(url, ctx, parent = exports.vfs.compiled(), options = {}) {
     let initialSlashes = 0;
     while (url[initialSlashes] === '/')
         initialSlashes++;
@@ -122,16 +121,16 @@ async function urlToNode(url, ctx, parent = exports.vfs.compiled(), allowMissing
         return;
     const hasTrailingSlash = url.endsWith('/');
     const rest = nextSlash < 0 ? '' : url.slice(nextSlash + 1, hasTrailingSlash ? -1 : undefined);
-    const assumeFolder = allowMissing && (rest > '' || hasTrailingSlash);
+    const assumeFolder = options.allowMissing && (rest > '' || hasTrailingSlash);
     const ret = await getNodeByName(name, parent, assumeFolder);
     if (!ret)
         return;
     setVfsPath(ret, name, parent);
     if (rest || ret?.original)
-        return urlToNode(rest, ctx, ret, allowMissing);
+        return urlToNode(rest, ctx, ret, options);
     if (ret.source)
-        if (!showHiddenFiles.get() && await isHiddenFile(ret.source)
-            || !allowMissing && await setIsFolder(ret) === undefined) // undefined = not found on disk
+        if (!options.includeHidden && !showHiddenFiles.get() && await isHiddenFile(ret.source)
+            || !options.allowMissing && await setIsFolder(ret) === undefined) // undefined = not found on disk
             return;
     return ret;
 }

package/src/webdav.js

@@ -53,20 +53,22 @@ const WINDOWS_FILE_ATTRIBUTE_FLAGS = {
 const canOverwrite = new Set();
 const locks = new Map();
 function releaseWebdavLock(path) {
-    const lock = locks.get(path);
+    const key = webdavPathKey(path);
+    const lock = locks.get(key);
     if (!lock)
         return false;
     clearTimeout(lock.timeout);
-    locks.delete(path);
+    locks.delete(key);
     return true;
 }
 async function isLocked(path, ctx) {
-    const lock = locks.get(path);
+    const key = webdavPathKey(path);
+    const lock = locks.get(key);
     if (!lock)
         return false;
     // if the resource is gone, keeping the lock only creates fake 423 responses
-    if (!await (0, vfs_1.urlToNode)(path, ctx)) {
-        releaseWebdavLock(path);
+    if (!await (0, vfs_1.urlToNode)(key, ctx)) {
+        releaseWebdavLock(key);
         return false;
     }
     const ifHeader = ctx.get('If');
@@ -81,6 +83,10 @@ function hasToken(header, token) {
         return false;
     return header.includes(`<${token}>`) || header.split(/[,;\s]+/).includes(token);
 }
+function webdavPathKey(path) {
+    const key = (0, cross_1.pathEncode)((0, cross_1.safeDecodeURIComponent)(path, ''));
+    return (0, misc_1.hasDirTraversal)(key) ? '' : key;
+}
 function getWebdavUsername(ctx) {
     return (0, auth_1.getCurrentUsername)(ctx) || '';
 }
@@ -107,6 +113,9 @@ const webdav = async (ctx, next) => {
         webdavDetectedAgents.try(webdavAgentKey(ctx, ua), () => true);
     if (isCorsPreflight)
         return next();
+    const pathKey = webdavPathKey(path); // state must converge for equivalent encodings without changing client-visible paths
+    if (!pathKey && (isWebdavAuthRequest || ctx.method === 'PUT' || ctx.method === 'DELETE'))
+        return ctx.status = cross_1.HTTP_BAD_REQUEST;
     if (isWebdavAuthRequest && shouldChallengeWebdav())
         return;
     if (ctx.method === 'OPTIONS')
@@ -143,7 +152,7 @@ const webdav = async (ctx, next) => {
     async function handlePut() {
         if (await isLocked(path, ctx))
             return;
-        const overwriteGraceKey = path + (0, cross_1.prefix)('|', (0, auth_1.getCurrentUsername)(ctx)); // bind temporary overwrite grace to the authenticated user so accounts cannot reuse each other's grace window
+        const overwriteGraceKey = pathKey + (0, cross_1.prefix)('|', (0, auth_1.getCurrentUsername)(ctx)); // bind temporary overwrite grace to the authenticated user so accounts cannot reuse each other's grace window
         // Finder first creates an empty file (a test?) then wants to overwrite it, which requires deletion permission, but the user may not have it, causing a renamed upload. To solve, so we give it special permission for a few seconds.
         const x = ctx.get('x-expected-entity-length'); // field used by Finder's webdav on actual upload, after
         if (isKnownWebdavAgent && canOverwrite.has(overwriteGraceKey)) {
@@ -160,7 +169,7 @@ const webdav = async (ctx, next) => {
         if (isKnownWebdavAgent)
             ctx.query.existing ??= 'overwrite'; // with webdav this is our default
         await next();
-        if (isKnownWebdavAgent && ctx.body?.uri === path) // the upload middleware reports the final uri that can be different from the initial request
+        if (isKnownWebdavAgent && ctx.body?.uri && webdavPathKey(ctx.body.uri) === pathKey) // the upload middleware reports the final uri that can be different from the initial request
             allowWebdavOverwrite(overwriteGraceKey);
     }
     async function handleMkcol() {
@@ -195,27 +204,33 @@ const webdav = async (ctx, next) => {
         setWebdavHeaders();
         if (await isLocked(path, ctx))
             return;
-        const node = await (0, vfs_1.urlToNode)(path, ctx);
+        const node = await (0, vfs_1.urlToNode)(pathKey, ctx);
         if (!node)
             return next();
         let dest = ctx.get('destination');
         const i = dest.indexOf('//');
         if (i >= 0)
             dest = dest.slice(dest.indexOf('/', i + 2));
-        dest = (0, cross_1.join)(ctx.state.root || '', dest); // on Windows, we must use / as the delimiter to be able to compare with `path` below
+        dest = webdavPathKey((0, cross_1.join)(ctx.state.root || '', dest)); // on Windows, we must use / as the delimiter to compare URL paths
+        if (!dest)
+            return ctx.status = cross_1.HTTP_BAD_REQUEST;
         if (await isLocked(dest, ctx))
             return;
-        if ((0, path_1.dirname)(path) === (0, path_1.dirname)(dest)) // rename case. `path` is is encoded, so we test before decoding `dest`
+        if ((0, path_1.dirname)(pathKey) === (0, path_1.dirname)(dest))
             try {
                 // decode the single path segment so reserved chars like %2C become their real name on rename
-                await (0, frontEndApis_1.requestedRename)(node, (0, cross_1.safeDecodeURIComponent)((0, path_1.basename)(dest), ''), ctx, path);
+                await (0, frontEndApis_1.requestedRename)(node, (0, cross_1.safeDecodeURIComponent)((0, path_1.basename)(dest), ''), ctx, pathKey);
                 releaseWebdavLock(path); // RFC 4918 says MOVE must not carry locks to destination, so clear source lock on success
                 return ctx.status = cross_1.HTTP_CREATED;
             }
             catch (e) {
                 return ctx.status = e.status || cross_1.HTTP_SERVER_ERROR;
             }
-        const moveRes = await (0, frontEndApis_1.moveFiles)([path], (0, path_1.dirname)(dest), ctx);
+        const actualDest = (0, cross_1.join)((0, path_1.dirname)(dest), (0, path_1.basename)(pathKey));
+        // moveFiles keeps the source basename for cross-directory moves, so check the lock it will actually touch
+        if (actualDest !== dest && await isLocked(actualDest, ctx))
+            return;
+        const moveRes = await (0, frontEndApis_1.moveFiles)([pathKey], (0, path_1.dirname)(dest), ctx);
         if (moveRes instanceof Error)
             return ctx.status = moveRes.status || cross_1.HTTP_SERVER_ERROR;
         const err = moveRes?.errors?.[0];
@@ -234,7 +249,7 @@ const webdav = async (ctx, next) => {
     async function handleUnlock() {
         setWebdavHeaders();
         const x = ctx.get(TOKEN_HEADER).slice(1, -1);
-        const lock = locks.get(path);
+        const lock = locks.get(pathKey);
         if (x !== lock?.token)
             return ctx.status = cross_1.HTTP_BAD_REQUEST;
         // with force_webdav_login disabled a client may silently fall back to anonymous; keep lock ownership on the original username
@@ -253,7 +268,7 @@ const webdav = async (ctx, next) => {
         const permissionNode = node || await (0, vfs_1.urlToNode)((0, path_1.dirname)(path), ctx);
         if (!permissionNode)
             return ctx.status = cross_1.HTTP_CONFLICT;
-        const missingWritePerm = node && canOverwrite.has(path + (0, cross_1.prefix)('|', (0, auth_1.getCurrentUsername)(ctx))) ? 0
+        const missingWritePerm = node && canOverwrite.has(pathKey + (0, cross_1.prefix)('|', (0, auth_1.getCurrentUsername)(ctx))) ? 0
             : (0, vfs_1.statusCodeForMissingPerm)(permissionNode, node ? 'can_delete' : 'can_upload', ctx);
         if (missingWritePerm) {
             if (ctx.status === cross_1.HTTP_UNAUTHORIZED)
@@ -268,7 +283,7 @@ const webdav = async (ctx, next) => {
             // Finder and similar clients refresh an existing lock by sending LOCK without a body
             if (!token)
                 return ctx.status = cross_1.HTTP_BAD_REQUEST;
-            const lock = locks.get(path);
+            const lock = locks.get(pathKey);
             if (token !== lock?.token)
                 return ctx.status = cross_1.HTTP_PRECONDITION_FAILED;
             // same-token refresh from another username would make abandoned locks effectively persistent
@@ -278,7 +293,7 @@ const webdav = async (ctx, next) => {
             clearTimeout(lock.timeout);
             lock.timeout = setTimeout(() => releaseWebdavLock(path), seconds * 1000);
             lock.seconds = seconds;
-            locks.set(path, lock);
+            locks.set(pathKey, lock);
             ctx.set(TOKEN_HEADER, lock.token);
             ctx.body = renderLockResponse(lock.token, lock.seconds);
             return;
@@ -292,11 +307,11 @@ const webdav = async (ctx, next) => {
             return ctx.status = cross_1.HTTP_CONFLICT;
         if (scope !== 'exclusive' || type !== 'write')
             return ctx.status = cross_1.HTTP_CONFLICT;
-        if (locks.has(path))
+        if (locks.has(pathKey))
             return ctx.status = cross_1.HTTP_LOCKED;
         const newToken = 'urn:uuid:' + (0, node_crypto_1.randomUUID)();
         const timeout = setTimeout(() => releaseWebdavLock(path), seconds * 1000);
-        locks.set(path, { token: newToken, timeout, seconds, username: getWebdavUsername(ctx) });
+        locks.set(pathKey, { token: newToken, timeout, seconds, username: getWebdavUsername(ctx) });
         ctx.set(TOKEN_HEADER, newToken);
         ctx.body = renderLockResponse(newToken, seconds);
     }
@@ -365,7 +380,7 @@ const webdav = async (ctx, next) => {
             return ctx.status = cross_1.HTTP_BAD_REQUEST;
         const statuses = [];
         for (const prop of props)
-            statuses.push({ prop: prop.name, status: await applyProppatchProp(prop, node, path, ctx) });
+            statuses.push({ prop: prop.name, status: await applyProppatchProp(prop, node, pathKey, ctx) });
         const outPath = webdavHrefPath(path, node, ctx);
         ctx.type = 'xml';
         ctx.status = 207;

package/src/zip.js

@@ -82,6 +82,9 @@ async function zipStreamFromFolder(node, ctx) {
         catch { }
     });
     const zip = new QuickZipStream_1.QuickZipStream(mappedWalker);
+    ctx.body = zip;
+    if (await (0, serveFile_1.enforceDownloadLimits)(ctx))
+        return;
     const time = 1000 * zipSeconds.get();
     const size = await zip.calculateSize(time);
     const range = (0, serveFile_1.applyRange)(ctx, size); // keep var size as ctx.response.length won't preserve a NaN
@@ -89,7 +92,6 @@ async function zipStreamFromFolder(node, ctx) {
         return;
     if (range)
         zip.applyRange(range.start, range.end);
-    ctx.body = zip;
     ctx.req.on('close', () => zip.destroy());
     ctx.state.archive = 'zip';
     (0, serveFile_1.monitorAsDownload)(ctx, size, range?.start);

package/admin/assets/icons-3rupj9Xr.js

@@ -1 +0,0 @@
-import{Xi as e,ga as t}from"./index-Dsq-sVu9.js";var n=t(),r=e((0,n.jsx)(`path`,{d:`M10 6 8.59 7.41 13.17 12l-4.58 4.59L10 18l6-6z`}),`ChevronRight`),i=e((0,n.jsx)(`path`,{d:`M6 19c0 1.1.9 2 2 2h8c1.1 0 2-.9 2-2V7H6zM19 4h-3.5l-1-1h-5l-1 1H5v2h14z`}),`Delete`),a=e((0,n.jsx)(`path`,{d:`M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2m0 18c-4.42 0-8-3.58-8-8 0-1.85.63-3.55 1.69-4.9L16.9 18.31C15.55 19.37 13.85 20 12 20m6.31-3.1L7.1 5.69C8.45 4.63 10.15 4 12 4c4.42 0 8 3.58 8 8 0 1.85-.63 3.55-1.69 4.9`}),`DoNotDisturb`),o=e((0,n.jsx)(`path`,{d:`M16.59 8.59 12 13.17 7.41 8.59 6 10l6 6 6-6z`}),`ExpandMore`),s=e((0,n.jsx)(`path`,{d:`M16 11c1.66 0 2.99-1.34 2.99-3S17.66 5 16 5s-3 1.34-3 3 1.34 3 3 3m-8 0c1.66 0 2.99-1.34 2.99-3S9.66 5 8 5 5 6.34 5 8s1.34 3 3 3m0 2c-2.33 0-7 1.17-7 3.5V19h14v-2.5c0-2.33-4.67-3.5-7-3.5m8 0c-.29 0-.62.02-.97.05 1.16.84 1.97 1.97 1.97 3.45V19h6v-2.5c0-2.33-4.67-3.5-7-3.5`}),`Group`),c=e((0,n.jsx)(`path`,{d:`M17 10.43V2H7v8.43c0 .35.18.68.49.86l4.18 2.51-.99 2.34-3.41.29 2.59 2.24L9.07 22 12 20.23 14.93 22l-.78-3.33 2.59-2.24-3.41-.29-.99-2.34 4.18-2.51c.3-.18.48-.5.48-.86m-4 1.8-1 .6-1-.6V3h2z`}),`MilitaryTech`),l=e((0,n.jsx)(`path`,{d:`M12 12c2.21 0 4-1.79 4-4s-1.79-4-4-4-4 1.79-4 4 1.79 4 4 4m0 2c-2.67 0-8 1.34-8 4v2h16v-2c0-2.66-5.33-4-8-4`}),`Person`),u=e((0,n.jsx)(`path`,{d:`M15 12c2.21 0 4-1.79 4-4s-1.79-4-4-4-4 1.79-4 4 1.79 4 4 4m-9-2V7H4v3H1v2h3v3h2v-3h3v-2zm9 4c-2.67 0-8 1.34-8 4v2h16v-2c0-2.66-5.33-4-8-4`}),`PersonAdd`),d=e([(0,n.jsx)(`path`,{d:`M11.99 2C6.47 2 2 6.48 2 12s4.47 10 9.99 10C17.52 22 22 17.52 22 12S17.52 2 11.99 2M12 20c-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8-3.58 8-8 8`},`0`),(0,n.jsx)(`path`,{d:`M12.5 7H11v6l5.25 3.15.75-1.23-4.5-2.67z`},`1`)],`Schedule`),f=e([(0,n.jsx)(`path`,{d:`M15 2h-3.5l-1-1h-5l-1 1H1v2h14zm1 7c-.7 0-1.37.1-2 .29V5H2v12c0 1.1.9 2 2 2h5.68c1.12 2.36 3.53 4 6.32 4 3.87 0 7-3.13 7-7s-3.13-7-7-7m0 12c-2.76 0-5-2.24-5-5s2.24-5 5-5 5 2.24 5 5-2.24 5-5 5`},`0`),(0,n.jsx)(`path`,{d:`M16.5 12H15v5l3.6 2.1.8-1.2-2.9-1.7z`},`1`)],`AutoDelete`),p=e((0,n.jsx)(`path`,{d:`M5 20h14v-2H5zm0-10h4v6h6v-6h4l-7-7z`}),`Upload`),m=e((0,n.jsx)(`path`,{d:`M3 17.25V21h3.75L17.81 9.94l-3.75-3.75zM20.71 7.04c.39-.39.39-1.02 0-1.41l-2.34-2.34a.996.996 0 0 0-1.41 0l-1.83 1.83 3.75 3.75z`}),`Edit`),h=e((0,n.jsx)(`path`,{d:`M5 20h14v-2H5zM19 9h-4V3H9v6H5l7 7z`}),`Download`),g=e((0,n.jsx)(`path`,{d:`M20 13H4c-.55 0-1 .45-1 1v6c0 .55.45 1 1 1h16c.55 0 1-.45 1-1v-6c0-.55-.45-1-1-1M7 19c-1.1 0-2-.9-2-2s.9-2 2-2 2 .9 2 2-.9 2-2 2M20 3H4c-.55 0-1 .45-1 1v6c0 .55.45 1 1 1h16c.55 0 1-.45 1-1V4c0-.55-.45-1-1-1M7 9c-1.1 0-2-.9-2-2s.9-2 2-2 2 .9 2 2-.9 2-2 2`}),`Dns`),_=e([(0,n.jsx)(`path`,{d:`M17 11h2v2h-2v2h2v2h-2v2h4V5h-9v1.4l5 3.57zm0-4h2v2h-2z`,opacity:`.3`},`0`),(0,n.jsx)(`path`,{d:`M10 3v1.97l.96.69L12 6.4V5h9v14h-4v2h6V3z`},`1`),(0,n.jsx)(`path`,{d:`M3 12v7h2v-5h6v5h2v-7L8 8.5z`,opacity:`.3`},`2`),(0,n.jsx)(`path`,{d:`M17 7h2v2h-2zm0 4h2v2h-2zm0 4h2v2h-2zM1 11v10h6v-5h2v5h6V11L8 6zm12 8h-2v-5H5v5H3v-7l5-3.5 5 3.5z`},`3`)],`HomeWorkTwoTone`),v=e((0,n.jsx)(`path`,{d:`M18 8h-1V6c0-2.76-2.24-5-5-5S7 3.24 7 6v2H6c-1.1 0-2 .9-2 2v10c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V10c0-1.1-.9-2-2-2m-6 9c-1.1 0-2-.9-2-2s.9-2 2-2 2 .9 2 2-.9 2-2 2m3.1-9H8.9V6c0-1.71 1.39-3.1 3.1-3.1s3.1 1.39 3.1 3.1z`}),`Lock`),y=e([(0,n.jsx)(`path`,{d:`M14.99 4.59V5c0 1.1-.9 2-2 2h-2v2c0 .55-.45 1-1 1h-2v2h6c.55 0 1 .45 1 1v3h1c.89 0 1.64.59 1.9 1.4C19.19 15.98 20 14.08 20 12c0-3.35-2.08-6.23-5.01-7.41M8.99 16v-1l-4.78-4.78C4.08 10.79 4 11.39 4 12c0 4.07 3.06 7.43 6.99 7.93V18c-1.1 0-2-.9-2-2`,opacity:`.3`},`0`),(0,n.jsx)(`path`,{d:`M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2m-1.01 17.93C7.06 19.43 4 16.07 4 12c0-.61.08-1.21.21-1.78L8.99 15v1c0 1.1.9 2 2 2zm6.9-2.53c-.26-.81-1-1.4-1.9-1.4h-1v-3c0-.55-.45-1-1-1h-6v-2h2c.55 0 1-.45 1-1V7h2c1.1 0 2-.9 2-2v-.41C17.92 5.77 20 8.65 20 12c0 2.08-.81 3.98-2.11 5.4`},`1`)],`PublicTwoTone`),b=e([(0,n.jsx)(`path`,{d:`M15 15H5v4h14v-4zm-7 3H6v-2h2zm3.5 0h-2v-2h2zm3.5 0h-2v-2h2z`,opacity:`.3`},`0`),(0,n.jsx)(`path`,{d:`M16 4.2c1.5 0 3 .6 4.2 1.7l.8-.8C19.6 3.7 17.8 3 16 3s-3.6.7-5 2.1l.8.8C13 4.8 14.5 4.2 16 4.2m-3.3 2.5.8.8c.7-.7 1.6-1 2.5-1s1.8.3 2.5 1l.8-.8c-.9-.9-2.1-1.4-3.3-1.4s-2.4.5-3.3 1.4M19 13h-2V9h-2v4H5c-1.1 0-2 .9-2 2v4c0 1.1.9 2 2 2h14c1.1 0 2-.9 2-2v-4c0-1.1-.9-2-2-2m0 6H5v-4h14zM6 16h2v2H6zm3.5 0h2v2h-2zm3.5 0h2v2h-2z`},`1`)],`RouterTwoTone`),x=e((0,n.jsx)(`path`,{d:`M2.01 21 23 12 2.01 3 2 10l15 2-15 2z`}),`Send`),S=e((0,n.jsx)(`path`,{d:`M2 20h20v-4H2zm2-3h2v2H4zM2 4v4h20V4zm4 3H4V5h2zm-4 7h20v-4H2zm2-3h2v2H4z`}),`Storage`),C=e((0,n.jsx)(`path`,{d:`M15.5 14h-.79l-.28-.27C15.41 12.59 16 11.11 16 9.5 16 5.91 13.09 3 9.5 3S3 5.91 3 9.5 5.91 16 9.5 16c1.61 0 3.09-.59 4.23-1.57l.27.28v.79l5 4.99L20.49 19zm-6 0C7.01 14 5 11.99 5 9.5S7.01 5 9.5 5 14 7.01 14 9.5 11.99 14 9.5 14`}),`Search`),w=e((0,n.jsx)(`path`,{d:`M19 13h-6v6h-2v-6H5v-2h6V5h2v6h6z`}),`Add`),T=e((0,n.jsx)(`path`,{d:`m4 12 1.41 1.41L11 7.83V20h2V7.83l5.58 5.59L20 12l-8-8z`}),`ArrowUpward`),E=e((0,n.jsx)(`path`,{d:`m20 12-1.41-1.41L13 16.17V4h-2v12.17l-5.58-5.59L4 12l8 8z`}),`ArrowDownward`),D=e((0,n.jsx)(`path`,{d:`M12.5 8c-2.65 0-5.05.99-6.9 2.6L2 7v9h9l-3.62-3.62c1.39-1.16 3.16-1.88 5.12-1.88 3.54 0 6.55 2.31 7.6 5.5l2.37-.78C21.08 11.03 17.15 8 12.5 8`}),`Undo`),O=e((0,n.jsx)(`path`,{d:`M4.25 5.61C6.27 8.2 10 13 10 13v6c0 .55.45 1 1 1h2c.55 0 1-.45 1-1v-6s3.72-4.8 5.74-7.39c.51-.66.04-1.61-.79-1.61H5.04c-.83 0-1.3.95-.79 1.61`}),`FilterAlt`),k=e((0,n.jsx)(`path`,{d:`M17 7h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1 0 1.43-.98 2.63-2.31 2.98l1.46 1.46C20.88 15.61 22 13.95 22 12c0-2.76-2.24-5-5-5m-1 4h-2.19l2 2H16zM2 4.27l3.11 3.11C3.29 8.12 2 9.91 2 12c0 2.76 2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1 0-1.59 1.21-2.9 2.76-3.07L8.73 11H8v2h2.73L13 15.27V17h1.73l4.01 4L20 19.74 3.27 3z`}),`LinkOff`),A=e((0,n.jsx)(`path`,{d:`M5 13h14v-2H5zm-2 4h14v-2H3zM7 7v2h14V7z`}),`ClearAll`),ee=e((0,n.jsx)(`path`,{d:`M20 9V7c0-1.1-.9-2-2-2h-3c0-1.66-1.34-3-3-3S9 3.34 9 5H6c-1.1 0-2 .9-2 2v2c-1.66 0-3 1.34-3 3s1.34 3 3 3v4c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2v-4c1.66 0 3-1.34 3-3s-1.34-3-3-3M7.5 11.5c0-.83.67-1.5 1.5-1.5s1.5.67 1.5 1.5S9.83 13 9 13s-1.5-.67-1.5-1.5M16 17H8v-2h8zm-1-4c-.83 0-1.5-.67-1.5-1.5S14.17 10 15 10s1.5.67 1.5 1.5S15.83 13 15 13`}),`SmartToy`),j=e((0,n.jsx)(`path`,{d:`M20 4H4c-1.11 0-2 .9-2 2v12c0 1.1.89 2 2 2h16c1.1 0 2-.9 2-2V6c0-1.1-.89-2-2-2m0 14H4V8h16zm-2-1h-6v-2h6zM7.5 17l-1.41-1.41L8.67 13l-2.59-2.59L7.5 9l4 4z`}),`Terminal`),M=e((0,n.jsx)(`path`,{d:`M16 1H4c-1.1 0-2 .9-2 2v14h2V3h12zm3 4H8c-1.1 0-2 .9-2 2v14c0 1.1.9 2 2 2h11c1.1 0 2-.9 2-2V7c0-1.1-.9-2-2-2m0 16H8V7h11z`}),`ContentCopy`),N=e((0,n.jsx)(`path`,{d:`M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2M4 12c0-4.42 3.58-8 8-8 1.85 0 3.55.63 4.9 1.69L5.69 16.9C4.63 15.55 4 13.85 4 12m8 8c-1.85 0-3.55-.63-4.9-1.69L18.31 7.1C19.37 8.45 20 10.15 20 12c0 4.42-3.58 8-8 8`}),`Block`),P=e((0,n.jsx)(`path`,{d:`M20 6h-8l-2-2H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V8c0-1.1-.9-2-2-2m-2 6h-2v2h2v2h-2v2h-2v-2h2v-2h-2v-2h2v-2h-2V8h2v2h2z`}),`FolderZip`),F=e((0,n.jsx)(`path`,{d:`M15.41 7.41 14 6l-6 6 6 6 1.41-1.41L10.83 12z`}),`ChevronLeft`),I=e((0,n.jsx)(`path`,{d:`M3 10h11v2H3zm0-2h11V6H3zm0 8h7v-2H3zm15.01-3.13.71-.71c.39-.39 1.02-.39 1.41 0l.71.71c.39.39.39 1.02 0 1.41l-.71.71zm-.71.71-5.3 5.3V21h2.12l5.3-5.3z`}),`EditNote`),L=e((0,n.jsx)(`path`,{d:`M5 17h14v2H5zm7-12L5.33 15h13.34z`}),`Eject`),R=e((0,n.jsx)(`path`,{d:`M20 6h-8l-2-2H4c-1.11 0-1.99.89-1.99 2L2 18c0 1.11.89 2 2 2h16c1.11 0 2-.89 2-2V8c0-1.11-.89-2-2-2m-1 8h-3v3h-2v-3h-3v-2h3V9h2v3h3z`}),`CreateNewFolder`),z=e((0,n.jsx)(`path`,{d:`M8 11h3v10h2V11h3l-4-4zM4 3v2h16V3z`}),`VerticalAlignTop`),B=e([(0,n.jsx)(`path`,{d:`M2 16.5C2 19.54 4.46 22 7.5 22s5.5-2.46 5.5-5.5V10H2zm5.5 2C6.12 18.5 5 17.83 5 17h5c0 .83-1.12 1.5-2.5 1.5M10 13c.55 0 1 .45 1 1s-.45 1-1 1-1-.45-1-1 .45-1 1-1m-5 0c.55 0 1 .45 1 1s-.45 1-1 1-1-.45-1-1 .45-1 1-1`},`0`),(0,n.jsx)(`path`,{d:`M11 3v6h3v2.5c0-.83 1.12-1.5 2.5-1.5s2.5.67 2.5 1.5h-5v2.89c.75.38 1.6.61 2.5.61 3.04 0 5.5-2.46 5.5-5.5V3zm3 5.08c-.55 0-1-.45-1-1s.45-1 1-1 1 .45 1 1c0 .56-.45 1-1 1m5 0c-.55 0-1-.45-1-1s.45-1 1-1 1 .45 1 1c0 .56-.45 1-1 1`},`1`)],`TheaterComedy`),V=e((0,n.jsx)(`path`,{d:`M10 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V8c0-1.1-.9-2-2-2h-8z`}),`Folder`),H=e((0,n.jsx)(`path`,{d:`M3.9 12c0-1.71 1.39-3.1 3.1-3.1h4V7H7c-2.76 0-5 2.24-5 5s2.24 5 5 5h4v-1.9H7c-1.71 0-3.1-1.39-3.1-3.1M8 13h8v-2H8zm9-6h-4v1.9h4c1.71 0 3.1 1.39 3.1 3.1s-1.39 3.1-3.1 3.1h-4V17h4c2.76 0 5-2.24 5-5s-2.24-5-5-5`}),`Link`),U=e((0,n.jsx)(`path`,{d:`M14 2H6c-1.1 0-1.99.9-1.99 2L4 20c0 1.1.89 2 1.99 2H18c1.1 0 2-.9 2-2V8zM6 20V4h7v5h5v11z`}),`InsertDriveFileOutlined`),W=e((0,n.jsx)(`path`,{d:`M12 4.5C7 4.5 2.73 7.61 1 12c1.73 4.39 6 7.5 11 7.5s9.27-3.11 11-7.5c-1.73-4.39-6-7.5-11-7.5M12 17c-2.76 0-5-2.24-5-5s2.24-5 5-5 5 2.24 5 5-2.24 5-5 5m0-8c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3`}),`RemoveRedEye`),G=e((0,n.jsx)(`path`,{d:`M20 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V6c0-1.1-.9-2-2-2m-5 14H4v-4h11zm0-5H4V9h11zm5 5h-4V9h4z`}),`Web`),K=e((0,n.jsx)(`path`,{d:`M19.35 10.04C18.67 6.59 15.64 4 12 4 9.11 4 6.6 5.64 5.35 8.04 2.34 8.36 0 10.91 0 14c0 3.31 2.69 6 6 6h13c2.76 0 5-2.24 5-5 0-2.64-2.05-4.78-4.65-4.96`}),`Cloud`),q=e((0,n.jsx)(`path`,{d:`M14.59 8 12 10.59 9.41 8 8 9.41 10.59 12 8 14.59 9.41 16 12 13.41 14.59 16 16 14.59 13.41 12 16 9.41zM12 2C6.47 2 2 6.47 2 12s4.47 10 10 10 10-4.47 10-10S17.53 2 12 2m0 18c-4.41 0-8-3.59-8-8s3.59-8 8-8 8 3.59 8 8-3.59 8-8 8`}),`HighlightOff`),J=e((0,n.jsx)(`path`,{d:`M12 5.83 15.17 9l1.41-1.41L12 3 7.41 7.59 8.83 9zm0 12.34L8.83 15l-1.41 1.41L12 21l4.59-4.59L15.17 15z`}),`UnfoldMore`),Y=e((0,n.jsx)(`path`,{d:`M7.41 18.59 8.83 20 12 16.83 15.17 20l1.41-1.41L12 14zm9.18-13.18L15.17 4 12 7.17 8.83 4 7.41 5.41 12 10z`}),`UnfoldLess`),X=e((0,n.jsx)(`path`,{d:`M9.64 7.64c.23-.5.36-1.05.36-1.64 0-2.21-1.79-4-4-4S2 3.79 2 6s1.79 4 4 4c.59 0 1.14-.13 1.64-.36L10 12l-2.36 2.36C7.14 14.13 6.59 14 6 14c-2.21 0-4 1.79-4 4s1.79 4 4 4 4-1.79 4-4c0-.59-.13-1.14-.36-1.64L12 14l7 7h3v-1zM6 8c-1.1 0-2-.89-2-2s.9-2 2-2 2 .89 2 2-.9 2-2 2m0 12c-1.1 0-2-.89-2-2s.9-2 2-2 2 .89 2 2-.9 2-2 2m6-7.5c-.28 0-.5-.22-.5-.5s.22-.5.5-.5.5.22.5.5-.22.5-.5.5M19 3l-6 6 2 2 7-7V3z`}),`ContentCut`),Z=e((0,n.jsx)(`path`,{d:`M19 2h-4.18C14.4.84 13.3 0 12 0S9.6.84 9.18 2H5c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2m-7 0c.55 0 1 .45 1 1s-.45 1-1 1-1-.45-1-1 .45-1 1-1m7 18H5V4h2v3h10V4h2z`}),`ContentPaste`),Q=e((0,n.jsx)(`path`,{d:`M15 21h-2v-2h2zm-2-7h-2v5h2zm8-2h-2v4h2zm-2-2h-2v2h2zM7 12H5v2h2zm-2-2H3v2h2zm7-5h2V3h-2zm-7.5-.5v3h3v-3zM9 9H3V3h6zm-4.5 7.5v3h3v-3zM9 21H3v-6h6zm7.5-16.5v3h3v-3zM21 9h-6V3h6zm-2 10v-3h-4v2h2v3h4v-2zm-2-7h-4v2h4zm-4-2H7v2h2v2h2v-2h2zm1-1V7h-2V5h-2v4zM6.75 5.25h-1.5v1.5h1.5zm0 12h-1.5v1.5h1.5zm12-12h-1.5v1.5h1.5z`}),`QrCode2`),$=e((0,n.jsx)(`path`,{d:`M18 4V3c0-.55-.45-1-1-1H5c-.55 0-1 .45-1 1v4c0 .55.45 1 1 1h12c.55 0 1-.45 1-1V6h1v4H9v11c0 .55.45 1 1 1h2c.55 0 1-.45 1-1v-9h8V4z`}),`FormatPaint`),te=e((0,n.jsx)(`path`,{d:`M19 5v14H5V5zm1.1-2H3.9c-.5 0-.9.4-.9.9v16.2c0 .4.4.9.9.9h16.2c.4 0 .9-.5.9-.9V3.9c0-.5-.5-.9-.9-.9M11 7h6v2h-6zm0 4h6v2h-6zm0 4h6v2h-6zM7 7h2v2H7zm0 4h2v2H7zm0 4h2v2H7z`}),`ListAlt`),ne=e((0,n.jsx)(`path`,{d:`M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2m4 14H8V8h8z`}),`StopCircle`),re=e((0,n.jsx)(`path`,{d:`M16 18v2H8v-2zM11 7.99V16h2V7.99h3L12 4 8 7.99z`}),`Upgrade`),ie=e((0,n.jsx)(`path`,{d:`M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z`}),`Clear`),ae=e((0,n.jsx)(`path`,{d:`M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.41L7.83 13H20z`}),`ArrowBack`),oe=e((0,n.jsx)(`path`,{d:`m12 4-1.41 1.41L16.17 11H4v2h12.17l-5.58 5.59L12 20l8-8z`}),`ArrowForward`);export{c as $,ee as A,x as B,L as C,N as D,P as E,E as F,g as G,y as H,T as I,p as J,h as K,w as L,k as M,O as N,M as O,D as P,l as Q,C as R,R as S,F as T,v as U,b as V,_ as W,d as X,f as Y,u as Z,U as _,ne as a,B as b,Q as c,Y as d,s as et,J as f,W as g,G as h,re as i,r as it,A as j,j as k,Z as l,K as m,ae as n,a as nt,te as o,q as p,m as q,ie as r,i as rt,$ as s,oe as t,o as tt,X as u,H as v,I as w,z as x,V as y,S as z};