hfs 3.3.0 → 3.3.2

package/README.md

@@ -85,8 +85,10 @@ Troubleshooting
     you can [edit the config file to add your admin account](config.md#accounts)
   - If you don't want to use an editor, you can create the file with this command:
     `echo "create-admin: PASSWORD" > config.yaml`
-  - For a new Docker installation, set `HFS_CREATE_ADMIN` to **only the password**, and log in as `admin`.
-    The image uses this variable only when creating a new config file. See [Docker setup](https://github.com/rejetto/hfs/wiki/Docker).
+  - For a new Docker installation, set `HFS_INITIAL_ADMIN_PASSWORD` to **only the password**, and log in as `admin`.
+    It is used only when creating `config.yaml`; afterwards, manage the password in HFS and keep the config volume persistent.
+    The older `HFS_CREATE_ADMIN` takes precedence when non-empty and, by default, reapplies its password at every container start.
+    See [Docker setup](https://github.com/rejetto/hfs/wiki/Docker).
 
 By default, HFS does not require a login when you access the *Admin-panel* from localhost.
 If you don't like this behavior, disable it in the Admin-panel or enter this console command `config localhost_admin false`.

package/central.json

@@ -52,6 +52,9 @@
     "byVersion": {
         "^(0\\..*|3\\.[01]\\..*|3\\.2\\.0.*)$": {
             "alert": "This version is dangerous – please update"
+        },
+        "^3\\.2\\.[1-9]": {
+            "alert": "Please update. Your installation may be at risk if:\n - shared folders contain hidden subfolders: their contents can be downloaded if the folder name is known;\n - untrusted users can download folders as ZIP: they can make HFS unavailable;\n - you use WebDAV, LDAP, or `?login=` links: passwords can be exposed during login;\n - multiple users manage files in the same folders: one user can alter another's files"
         }
     }
 }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "hfs",
-  "version": "3.3.0",
+  "version": "3.3.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hfs",
-      "version": "3.3.0",
+      "version": "3.3.2",
       "license": "GPL-3.0",
       "dependencies": {
         "@gregoranders/csv": "^0.0.13",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hfs",
-  "version": "3.3.0",
+  "version": "3.3.2",
   "description": "HTTP File Server",
   "keywords": [
     "file server",

package/src/api.auth.js

@@ -46,11 +46,11 @@ exports.authApis = {
             const account = await (0, auth_1.clearTextLogin)(ctx, username, password, 'api');
             if (!account)
                 return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED);
-            await (0, auth_1.setLoggedIn)(ctx, account.username);
+            await (0, auth_1.setLoggedIn)(ctx, account.username, ctx.state.params ? 'body' : 'url');
         }
         catch (e) {
             events_1.default.emit('failedLogin', { ctx, username, via: 'api' });
-            return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED, String(e));
+            return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED, e);
         }
         return {
             redirect: ctx.state.account?.redirect,
@@ -117,7 +117,7 @@ exports.authApis = {
         try {
             const M2 = await step1.step2(BigInt(pubKey), BigInt(proof))
                 .catch(() => { throw ''; }); // falsy value for later
-            await (0, auth_1.setLoggedIn)(ctx, username);
+            await (0, auth_1.setLoggedIn)(ctx, username, 'srp');
             return {
                 proof: String(M2),
                 redirect: ctx.state.account?.redirect,
@@ -128,7 +128,7 @@ exports.authApis = {
             ctx.logExtra({ u: username });
             ctx.state.dontLog = false; // log even if log_api is false
             events_1.default.emit('failedLogin', { ctx, username });
-            return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED, e ? String(e) : undefined);
+            return new apiMiddleware_1.ApiError(const_1.HTTP_UNAUTHORIZED, e);
         }
         finally {
             delete ongoingLogins[sid];

package/src/api.vfs.js

@@ -168,8 +168,12 @@ exports.default = {
     async resolve_path({ path, closestFolder }) {
         path = (0, path_1.resolve)(path);
         if (closestFolder)
-            while (path && !await (0, misc_1.isDirectory)(path))
-                path = (0, path_1.dirname)(path);
+            while (path && !await (0, misc_1.isDirectory)(path)) {
+                const parent = (0, path_1.dirname)(path);
+                if (parent === path)
+                    break; // an unavailable root has no other parent to try
+                path = parent;
+            }
         return { path, isFolder: await (0, misc_1.isDirectory)(path) };
     },
     async mkdir({ path }) {
@@ -191,7 +195,7 @@ exports.default = {
                     }
                     return list.close();
                 }
-                const sendPropsAsap = (0, util_os_1.getDiskSpace)(path).then(x => x && list.props(x));
+                const sendPropsAsap = (0, util_os_1.getDiskSpace)(path).then(x => x && list.props(x)).catch(() => { }); // listing can fail before we await the disk-space query
                 try {
                     const matching = (0, misc_1.makeMatcher)(fileMask);
                     path = (0, misc_1.isWindowsDrive)(path) ? path + '\\' : (0, path_1.resolve)(path || '/');
@@ -215,7 +219,7 @@ exports.default = {
                         }
                         catch { } // just ignore entries we can't stat
                     });
-                    await sendPropsAsap.catch(() => { });
+                    await sendPropsAsap;
                     list.close();
                 }
                 catch (e) {

package/src/auth.js

@@ -90,7 +90,7 @@ async function clearTextLogin(ctx, u, p, via) {
     return a;
 }
 // centralized log-in state
-async function setLoggedIn(ctx, username) {
+async function setLoggedIn(ctx, username, via) {
     const s = ctx.session;
     if (!s)
         return ctx.throw(cross_const_1.HTTP_SERVER_ERROR, 'session');
@@ -106,7 +106,7 @@ async function setLoggedIn(ctx, username) {
     const a = ctx.state.account = (0, perm_1.getAccount)(username);
     if (!a)
         return;
-    const result = await events_1.default.emitAsync('finalizingLogin', { ctx, username: a.username, inputs: { ...ctx.state.params, ...ctx.query } });
+    const result = await events_1.default.emitAsync('finalizingLogin', { ctx, username: a.username, via, inputs: { ...ctx.state.params, ...ctx.query } });
     const error = result?.find(x => x && lodash_1.default.isString(x)) || result?.isDefaultPrevented() && "Login denied";
     if (error) {
         // restore the session identity: the candidate account was exposed only for plugin checks

package/src/config.js

@@ -139,7 +139,7 @@ async function setConfig(newCfg, save) {
     const version = lodash_1.default.isString(newCfg.version) ? new Version(newCfg.version) : undefined;
     const considerEnvs = !process.env['HFS_ENV_BOOTSTRAP'] || !started && lodash_1.default.isEmpty(newCfg);
     // first time we consider also CLI args
-    const argCfg = !started && lodash_1.default.pickBy((0, cross_1.newObj)(configProps, (_x, k) => (0, cross_1.tryJson)(k in argv_1.argv ? argv_1.argv[k] : considerEnvs ? process.env['HFS_' + k.toUpperCase().replaceAll('-', '_')] : '', lodash_1.default.identity)), x => x !== undefined);
+    const argCfg = !started && lodash_1.default.pickBy((0, cross_1.newObj)(configProps, (_x, k) => (0, cross_1.tryJson)(k in argv_1.argv ? argv_1.argv[k] : considerEnvs ? process.env['HFS_' + k.toUpperCase().replaceAll('-', '_')] : undefined, lodash_1.default.identity)), x => x !== undefined);
     if (!lodash_1.default.isEmpty(argCfg)) {
         (0, exports.saveConfigAsap)(); // don't set `save` argument, as it would interfere below, at check `save===false`
         Object.assign(newCfg, argCfg);

package/src/const.js

@@ -49,7 +49,7 @@ const path_1 = require("path");
 const cross_1 = require("./cross");
 const argv_1 = require("./argv");
 __exportStar(require("./cross-const"), exports);
-exports.API_VERSION = 13.4;
+exports.API_VERSION = 13.5;
 exports.COMPATIBLE_API_VERSION = 1; // the day we break with the past, we'll update this
 // you can add arguments with this file, currently used for the update process on mac/linux.
 // we are using homedir because it's the only stable path both the old and new process can agree on (open() doesn't preserve cwd)

package/src/middlewares.js

@@ -114,6 +114,7 @@ const prepareState = async (ctx, next) => {
     // calculate these once and for all
     ctx.state.connection = (0, connections_1.socket2connection)(ctx.socket);
     // explicit credentials and existing sessions must take precedence, so a matching IP cannot override a chosen account
+    let via;
     let a = await urlLogin() || await getHttpAccount() || !s?.username && autoLogin();
     const loggedInNotBySession = a;
     ctx.state.account = a ||= (0, perm_1.getAccount)(s?.username, false); // with least precedence, we consider session
@@ -123,12 +124,12 @@ const prepareState = async (ctx, next) => {
         else if (loggedInNotBySession) {
             try {
                 if (a.username)
-                    await (0, auth_1.setLoggedIn)(ctx, a.username);
+                    await (0, auth_1.setLoggedIn)(ctx, a.username, via);
             }
             catch (e) {
                 events_1.default.emit('failedLogin', { ctx, username: a.username, via: ctx.query.login ? 'url' : ctx.get('authorization') ? 'header' : undefined });
                 ctx.status = const_1.HTTP_UNAUTHORIZED;
-                ctx.body = String(e);
+                ctx.body = e instanceof Error ? e.message : String(e);
                 return;
             }
             ctx.headers['x-username'] = a.username; // give an easier way to determine if the login was successful
@@ -137,6 +138,7 @@ const prepareState = async (ctx, next) => {
     (0, connections_1.updateConnectionForCtx)(ctx);
     await next();
     function urlLogin() {
+        via = 'url';
         const { login } = ctx.query;
         if (!login)
             return;
@@ -145,6 +147,7 @@ const prepareState = async (ctx, next) => {
         return u && (0, auth_1.clearTextLogin)(ctx, u, p, 'url');
     }
     function getHttpAccount() {
+        via = 'header';
         const b64 = allowAuthorizationHeader.get() && ctx.get('authorization')?.split(' ')[1];
         if (!b64)
             return;
@@ -157,6 +160,7 @@ const prepareState = async (ctx, next) => {
         catch { }
     }
     function autoLogin() {
+        via = 'net';
         // keep the mask direct so group inheritance cannot make identity depend on account order
         return Object.values(perm_1.accounts.get()).find(a => (0, perm_1.accountCanLogin)(a) && a.auto_login_net && (0, misc_1.netMatches)(ctx.ip, a.auto_login_net, true));
     }

package/src/update.js

@@ -28,6 +28,7 @@ const persistence_1 = require("./persistence");
 const lodash_1 = __importDefault(require("lodash"));
 const argv_1 = require("./argv");
 const promises_2 = require("stream/promises");
+const updateChangelog_1 = require("./updateChangelog");
 const updateToBeta = (0, config_1.defineConfig)(misc_1.CFG.update_to_beta, false);
 const autoCheckUpdate = (0, config_1.defineConfig)(misc_1.CFG.auto_check_update, true);
 const lastCheckUpdate = persistence_1.storedMap.singleSync('lastCheckUpdate', 0);
@@ -69,14 +70,17 @@ function prepareRelease(r) {
         assets: r.assets.map((a) => lodash_1.default.pick(a, ReleaseAssetKeys))
     });
 }
-async function getVersions(filter, max = 30) {
+async function getVersions(filter, max = 30, stopAtCurrent = false) {
     const ret = [];
     for await (const x of (0, github_1.apiGithubPaginated)(`repos/${const_1.HFS_REPO}/releases`)) {
         if (x.name.endsWith('-ignore'))
             continue;
         const rel = prepareRelease(x);
-        if (rel.versionScalar === curV)
+        if (rel.versionScalar === curV) {
+            if (stopAtCurrent)
+                break; // stop at the installed release, not at older maintenance releases published more recently
             continue;
+        }
         if (!filter || filter(rel))
             ret.push(rel);
         if (ret.length >= max)
@@ -93,6 +97,11 @@ async function getUpdates(strict = false) {
     const betas = !includeBetas ? [] : await getVersions(x => x.prerelease && x.versionScalar > stable.versionScalar && (!strict || x.isNewer));
     if (stable.isNewer || const_1.RUNNING_BETA && !strict)
         betas.push(stable);
+    if (stable.isNewer && stable.body) {
+        const history = await getVersions(r => !r.prerelease && r.isNewer && r.versionScalar <= stable.versionScalar, Infinity, true)
+            .catch(() => []); // missing history must not prevent installing an available update
+        stable.body = (0, updateChangelog_1.updateChangelog)(stable, history, curV);
+    }
     return betas;
 }
 const LOCAL_UPDATE = 'hfs-update.zip'; // update from file takes precedence over net

package/src/updateChangelog.js

@@ -0,0 +1,31 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.updateChangelog = updateChangelog;
+const lodash_1 = __importDefault(require("lodash"));
+function updateChangelog(destination, releases, currentVersion) {
+    const newer = lodash_1.default.sortBy(lodash_1.default.uniqBy([destination, ...releases], 'tag_name')
+        .filter(r => !r.prerelease && r.versionScalar > currentVersion && r.versionScalar <= destination.versionScalar), r => -r.versionScalar);
+    const level = Math.max(...newer.map(releaseLevel));
+    const seen = new Set();
+    const sections = newer.filter(r => releaseLevel(r) === level).map(r => {
+        let body = r.body.trim();
+        if (level === 0) {
+            // deduplicate complete entries, preserving continuation lines and nested lists
+            body = body.replace(/\r\n/g, '\n').split(/\n{2,}|\n(?=[*+-] )/).filter(entry => {
+                const key = entry.trim().replace(/^[*+-] /, '');
+                if (!key || seen.has(key))
+                    return false;
+                seen.add(key);
+                return true;
+            }).join('\n\n');
+        }
+        return { tag: r.tag_name, body };
+    }).filter(r => r.body);
+    return sections.map(r => r.tag === destination.tag_name ? r.body : `**${r.tag}**\n\n${r.body}`).join('\n\n') || destination.body;
+    function releaseLevel(r) {
+        return r.versionScalar % 1E6 === 0 ? 2 : r.versionScalar % 1E3 === 0 ? 1 : 0;
+    }
+}

package/src/upload.js

@@ -125,11 +125,14 @@ function uploadWriter(base, baseUri, filename, ctx) {
         if (firstCreated) {
             setUploadMeta(dir, ctx);
             // recursive mkdir returns the first created directory; existing ancestors must not receive ownership
-            const existingParent = (0, path_1.dirname)((0, path_1.resolve)(firstCreated));
+            const firstCreatedPath = (0, path_1.toNamespacedPath)((0, path_1.resolve)(firstCreated)); // Node 24 mkdir can return a namespace-prefixed Windows path
             let source = (0, path_1.resolve)(dir);
             let uri = path_1.posix.dirname(vfsUri);
-            while (source !== existingParent) {
+            while (true) {
                 createdFolders.push({ uri, source });
+                // stop before the existing parent: namespaced drive and UNC roots can differ in their trailing separator
+                if ((0, path_1.toNamespacedPath)(source) === firstCreatedPath)
+                    break;
                 source = (0, path_1.dirname)(source);
                 uri = path_1.posix.dirname(uri);
             }

package/src/util-os.js

@@ -23,8 +23,12 @@ const const_1 = require("./const");
 const promises_1 = require("node:fs/promises");
 const DF_TIMEOUT = 2000;
 function getDiskSpaceSync(path) {
-    while (path && !(0, misc_1.isWindowsDrive)(path) && !(0, fs_1.existsSync)(path))
-        path = (0, path_1.dirname)(path);
+    while (path && !(0, misc_1.isWindowsDrive)(path) && !(0, fs_1.existsSync)(path)) {
+        const parent = (0, path_1.dirname)(path);
+        if (parent === path)
+            break; // an unavailable root has no other parent to try
+        path = parent;
+    }
     const res = (0, fs_1.statfsSync)(path);
     return { free: res.bavail * res.bsize, total: res.blocks * res.bsize, name: path };
 }
@@ -35,8 +39,12 @@ function cmdEscape(par) {
     return `"${par.replaceAll('"', '\\"')}"`;
 }
 async function getDiskSpace(path) {
-    while (path && !(0, misc_1.isWindowsDrive)(path) && !await (0, misc_1.exists)(path))
-        path = (0, path_1.dirname)(path);
+    while (path && !(0, misc_1.isWindowsDrive)(path) && !await (0, misc_1.exists)(path)) {
+        const parent = (0, path_1.dirname)(path);
+        if (parent === path)
+            break; // an unavailable root has no other parent to try; this test covers UNC as well
+        path = parent;
+    }
     const res = await (0, promises_1.statfs)(path);
     return { free: res.bavail * res.bsize, total: res.blocks * res.bsize, name: path };
 }