hfs 3.3.3 → 3.4.0-alpha1

package/src/log.js

@@ -48,6 +48,7 @@ const lodash_1 = __importDefault(require("lodash"));
 const util_files_1 = require("./util-files");
 const auth_1 = require("./auth");
 const misc_1 = require("./misc");
+const vfs_1 = require("./vfs");
 const path_1 = require("path");
 const yazl_1 = __importDefault(require("yazl"));
 const promises_1 = require("stream/promises");
@@ -109,6 +110,7 @@ const logRotation = (0, config_1.defineConfig)(misc_1.CFG.log_rotation, 'weekly'
 const dontLogNet = (0, config_1.defineConfig)(misc_1.CFG.dont_log_net, '127.0.0.1|::1', v => (0, misc_1.makeNetMatcher)(v));
 const logUA = (0, config_1.defineConfig)(misc_1.CFG.log_ua, false);
 const logSpam = (0, config_1.defineConfig)(misc_1.CFG.log_spam, false);
+const logSpamRegex = (0, config_1.defineConfig)(misc_1.CFG.log_spam_regex, /wlwmanifest.xml$|\.(php|asp)$|cgi|robots.txt$/.source, v => v ? new RegExp(v) : null);
 const logHost = (0, config_1.defineConfig)(misc_1.CFG.log_host, false);
 const debounce = lodash_1.default.debounce(cb => cb(), 1000); // with this technique, i'll be able to debounce some code respecting the references in its closure
 const logMw = async (ctx, next) => {
@@ -122,7 +124,9 @@ const logMw = async (ctx, next) => {
     if (!logSpam.get()
         && (ctx.querystring.includes('{.exec|') // v2's bug
             // requests generated by security scanners, other bots, and macos' finder
-            || ctx.status === misc_1.HTTP_NOT_FOUND && /wlwmanifest.xml$|\.(php)$|cgi|robots.txt$/.test(ctx.path))) {
+            || logSpamRegex.compiled()?.test(ctx.path)
+                && (ctx.status === misc_1.HTTP_NOT_FOUND
+                    || ctx.status === misc_1.HTTP_TEMPORARY_REDIRECT_KEEP_METHOD && !await (0, vfs_1.urlToNode)(ctx.path, ctx)))) {
         events_2.default.emit('spam', ctx);
         return;
     }
@@ -140,6 +144,8 @@ const logMw = async (ctx, next) => {
         let { stream, last, path } = logger;
         if (!stream)
             return;
+        if (events_2.default.emit('beforeLog', { ctx })?.isDefaultPrevented())
+            return;
         const rotate = logRotation.get()?.[0];
         const reqEnd = logger.last = new Date();
         if (rotate && last) { // rotation enabled and a file exists?

package/src/middlewares.js

@@ -10,6 +10,9 @@ exports.failAllowNet = failAllowNet;
 const koa_compress_1 = __importDefault(require("koa-compress"));
 const const_1 = require("./const");
 const misc_1 = require("./misc");
+const node_crypto_1 = require("node:crypto");
+const lang_1 = require("./lang");
+const i18n_1 = require("./i18n");
 const stream_1 = require("stream");
 const block_1 = require("./block");
 const perm_1 = require("./perm");
@@ -64,12 +67,50 @@ const someSecurity = (ctx, next) => {
         const { URL } = ctx;
         URL.protocol = 'https';
         URL.port = (0, listen_1.getHttpsWorkingPort)();
-        ctx.status = 307; // this ensures the client doesn't switch to a simpler GET request
+        ctx.status = const_1.HTTP_TEMPORARY_REDIRECT_KEEP_METHOD; // this ensures the client doesn't switch to a simpler GET request
         return ctx.redirect(URL.href);
     }
+    const page = ctx.state.urlLoginPage;
+    if (page)
+        return sendUrlLoginPage(page.cleanUrl, page.username);
     return next();
+    function sendUrlLoginPage(cleanUrl, username) {
+        return sendPage(ctx, username === undefined ? 'login_bad_credentials' : 'Confirm', t => {
+            if (username === undefined)
+                return `<script>history.replaceState(null,'',location.pathname)</script>
+                    <p><a href="${(0, misc_1.escapeHTML)(cleanUrl)}">${(0, misc_1.escapeHTML)(t('Continue'))}</a></p>`;
+            const token = (0, node_crypto_1.randomUUID)();
+            (ctx.session ??= {}).urlLoginConfirmation = {
+                token,
+                username,
+                expires: Date.now() + 5 * 60_000,
+            };
+            return `<p>${(0, misc_1.escapeHTML)(t('confirm_url_login', { username }))}</p>
+                <p><strong><a class="confirm" href="${(0, misc_1.escapeHTML)(cleanUrl)}">${(0, misc_1.escapeHTML)(t('Continue'))}</a></strong>
+                <a href="${(0, misc_1.escapeHTML)(cleanUrl)}">${(0, misc_1.escapeHTML)(t('Cancel'))}</a></p>
+                <script>
+                    const loginUrl=new URL(location.href);
+                    history.replaceState(null,'',loginUrl.pathname);
+                    document.querySelector('.confirm').onclick=ev=>{ev.preventDefault();loginUrl.searchParams.set('login_confirm','${token}');location.replace(loginUrl)}
+                </script>`;
+        });
+    }
 };
 exports.someSecurity = someSecurity;
+async function sendPage(ctx, titleKey, content) {
+    const { t } = (0, i18n_1.i18nFromTranslations)(await (0, lang_1.getLangData)(ctx));
+    const title = t(titleKey);
+    ctx.status = 200;
+    ctx.type = 'html';
+    ctx.set('cache-control', 'no-store');
+    ctx.set('referrer-policy', 'no-referrer');
+    ctx.set('content-security-policy', "frame-ancestors 'none'");
+    ctx.set('x-frame-options', 'DENY');
+    ctx.body = `<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+        <title>${(0, misc_1.escapeHTML)(title)}</title><style>
+        body{margin-top:30vh;text-align:center;font-family:sans-serif}a{margin:1em}
+        </style></head><body><h1>${(0, misc_1.escapeHTML)(title)}</h1>${content(t)}</body></html>`;
+}
 function enforceSessionIp(ctx) {
     const s = ctx.session;
     if (!s?.username || s[misc_1.ALLOW_SESSION_IP_CHANGE])
@@ -89,7 +130,7 @@ function getProxyDetected() {
 }
 const prepareState = async (ctx, next) => {
     // normalize once so auth, filters and logging agree on the same client address
-    ctx.request.ip = (0, connections_1.normalizeIp)(ctx.ip);
+    ctx.request.ip = (0, misc_1.normalizeIp)(ctx.ip);
     // invalidate before account resolution; someSecurity calls again to bind logins made below
     enforceSessionIp(ctx);
     // rootsMiddleware consults proxy-aware admin access before someSecurity runs
@@ -115,7 +156,9 @@ const prepareState = async (ctx, next) => {
     ctx.state.connection = (0, connections_1.socket2connection)(ctx.socket);
     // explicit credentials and existing sessions must take precedence, so a matching IP cannot override a chosen account
     let via;
-    let a = await urlLogin() || await getHttpAccount() || !s?.username && autoLogin();
+    const urlAccount = await urlLogin();
+    let a = ctx.state.urlLoginPage ? undefined
+        : urlAccount || await getHttpAccount() || !s?.username && autoLogin();
     const loggedInNotBySession = a;
     ctx.state.account = a ||= (0, perm_1.getAccount)(s?.username, false); // with least precedence, we consider session
     if (a)
@@ -137,14 +180,43 @@ const prepareState = async (ctx, next) => {
     ctx.state.revProxyPath = ctx.get('x-forwarded-prefix');
     (0, connections_1.updateConnectionForCtx)(ctx);
     await next();
-    function urlLogin() {
+    async function urlLogin() {
         via = 'url';
         const { login } = ctx.query;
         if (!login)
             return;
         const [u, p] = (0, misc_1.splitAt)(':', String(login));
-        ctx.redirect(ctx.originalUrl.slice(0, -ctx.querystring.length - 1)); // redirect to hide credentials
-        return u && (0, auth_1.clearTextLogin)(ctx, u, p, 'url');
+        const cleanUrl = ctx.originalUrl.slice(0, -ctx.querystring.length - 1);
+        const token = String(ctx.query.login_confirm || '');
+        const pending = s?.urlLoginConfirmation;
+        const confirmed = Boolean(token && pending?.token === token && pending.username === u
+            && pending.expires > Date.now());
+        if (token && s)
+            delete s.urlLoginConfirmation; // confirmation tokens are single-use, including failed attempts
+        if (!confirmed && needsConfirmation(u)) {
+            ctx.state.urlLoginPage = { username: u, cleanUrl };
+            return;
+        }
+        if (s)
+            delete s.urlLoginConfirmation;
+        const account = u && await (0, auth_1.clearTextLogin)(ctx, u, p, 'url');
+        if (!account && confirmed)
+            ctx.state.urlLoginPage = { cleanUrl };
+        else
+            ctx.redirect(cleanUrl); // redirect to hide credentials
+        return account;
+        function needsConfirmation(username) {
+            if (ctx.get('sec-fetch-mode') !== 'navigate' && !/^Mozilla\//.test(ctx.get('user-agent')))
+                return false;
+            const current = s?.username;
+            if (current)
+                return (0, perm_1.getAccount)(username)?.username !== (0, perm_1.getAccount)(current)?.username;
+            const fetchSite = ctx.get('sec-fetch-site');
+            if (fetchSite)
+                return fetchSite === 'same-site' || fetchSite === 'cross-site';
+            const referer = ctx.get('referer');
+            return !referer || (0, misc_1.try_)(() => new URL(referer).host.toLowerCase() !== ctx.host.toLowerCase(), () => true);
+        }
     }
     function getHttpAccount() {
         via = 'header';
@@ -167,20 +239,19 @@ const prepareState = async (ctx, next) => {
 };
 exports.prepareState = prepareState;
 function failAllowNet(ctx, a) {
-    // a cached mask is valid only for the identity that stored it
-    const sameAccount = ctx.session?.username === (0, perm_1.normalizeUsername)(a?.username || '');
-    const cached = sameAccount ? ctx.session?.allowNet : undefined;
-    const mask = cached ?? (0, perm_1.getFromAccount)(a || '', a => a.allow_net);
-    if (sameAccount && !cached && mask)
-        ctx.session.allowNet = mask; // must be deleted on logout by setLoggedIn
+    const mask = (0, perm_1.getFromAccount)(a || '', a => a.allow_net);
     const ret = mask && !(0, misc_1.netMatches)(ctx.ip, mask, true);
     if (ret)
         console.debug("Login failed: allow_net");
     return ret;
 }
 const paramsDecoder = async (ctx, next) => {
-    ctx.state.params = ctx.method === 'POST' && ctx.originalUrl.startsWith(const_1.API_URI)
-        && ((0, misc_1.tryJson)(await (0, misc_1.stream2string)(ctx.req)) || {});
+    if (ctx.method !== 'POST' || !ctx.originalUrl.startsWith(const_1.API_URI))
+        return next();
+    const body = await (0, misc_1.readRequestBodyLimited)(ctx, 10 * 1024 * 1024);
+    if (!body)
+        return;
+    ctx.state.params = (0, misc_1.tryJson)(body.text) || {};
     await next();
 };
 exports.paramsDecoder = paramsDecoder;

package/src/multipartUpload.js

@@ -11,9 +11,15 @@ const upload_1 = require("./upload");
 const cross_const_1 = require("./cross-const");
 const first_1 = require("./first");
 const cross_1 = require("./cross");
+const config_1 = require("./config");
 async function handleMultipartUpload(ctx, node) {
     if (ctx.request.type !== 'multipart/form-data')
         return ctx.status = cross_const_1.HTTP_BAD_REQUEST;
+    if (isCrossOriginBrowserRequest()) {
+        ctx.set('Connection', 'close'); // the rejected multipart body is intentionally left unread
+        ctx.body = "Cross-origin multipart upload blocked";
+        return ctx.status = cross_const_1.HTTP_FOOL;
+    }
     ctx.state.uploads = [];
     const locks = [];
     const fileJobs = [];
@@ -73,6 +79,20 @@ async function handleMultipartUpload(ctx, node) {
         stream.resume();
         return new Promise(res => (0, first_1.onFirstEvent)(stream, ['end', 'close', 'error'], res));
     }
+    function isCrossOriginBrowserRequest() {
+        if (ctx.get('x-hfs-anti-csrf'))
+            return false;
+        const origin = ctx.get('origin');
+        if (origin && origin !== 'null' && allowedUploadOrigin.compiled()(origin))
+            return false;
+        const fetchSite = ctx.get('sec-fetch-site');
+        if (fetchSite)
+            return fetchSite !== 'same-origin' && fetchSite !== 'none';
+        if (!origin)
+            return false; // missing browser metadata preserves non-browser and legacy upload clients
+        // compare hosts because TLS termination can make the public and internal protocols differ
+        return (0, cross_1.try_)(() => new URL(origin).host.toLowerCase() !== ctx.host.toLowerCase(), () => true);
+    }
     async function subfolderBlocksUpload(fn) {
         const prefix = (0, path_1.dirname)(fn.replaceAll('\\', '/'));
         if (prefix === '.') // no subdir
@@ -81,3 +101,4 @@ async function handleMultipartUpload(ctx, node) {
         return subfolderNode && !(0, vfs_1.hasPermission)(subfolderNode, 'can_upload', ctx);
     }
 }
+const allowedUploadOrigin = (0, config_1.defineConfig)('allowed_upload_origin', '', mask => (0, cross_1.makeMatcher)(mask, false, false));

package/src/perm.js

@@ -31,17 +31,7 @@ const events_1 = __importDefault(require("./events"));
 const auth_1 = require("./auth");
 // provides the username and all other usernames it inherits based on the 'belongs' attribute. Useful to check permissions
 function expandUsername(who) {
-    const ret = new Set();
-    const q = [who];
-    for (const u of q) {
-        const a = getAccount(u);
-        if (!a || a.disabled)
-            continue;
-        ret.add(u);
-        if (a.belongs)
-            q.push(...a.belongs);
-    }
-    return ret;
+    return new Set(Array.from(walkActiveAccounts([who]), a => a.username));
 }
 // check if current username or any ancestor match the provided usernames
 function ctxBelongsTo(ctx, usernames) {
@@ -213,14 +203,29 @@ function delAccount(username) {
 }
 // get some property from account, searching in its groups if necessary. Search is breadth-first, and this determines priority of inheritance.
 function getFromAccount(account, getter) {
-    const search = [account];
+    const root = typeof account === 'string' ? getAccount(account) : account;
+    if (!root)
+        return;
+    let res = getter(root); // always consider direct properties; only inherited groups are filtered by active status
+    if (res !== undefined)
+        return res;
+    for (const a of walkActiveAccounts(root.belongs || [])) {
+        res = getter(a);
+        if (res !== undefined)
+            return res;
+    }
+}
+function* walkActiveAccounts(roots) {
+    const search = [...roots];
+    const visited = new Set();
     for (const accountOrUsername of search) {
         const a = typeof accountOrUsername === 'string' ? getAccount(accountOrUsername) : accountOrUsername;
-        if (!a)
+        if (!a || visited.has(a.username))
             continue;
-        const res = getter(a);
-        if (res !== undefined)
-            return res;
+        visited.add(a.username);
+        if (accountIsDisabled(a))
+            continue;
+        yield a;
         if (a.belongs)
             search.push(...a.belongs);
     }
@@ -235,10 +240,23 @@ function accountCanLogin(account) {
     return accountHasLoginMethod(account) && !accountIsDisabled(account);
 }
 function accountIsDisabled(account) {
-    return Boolean(account.disabled
-        || account.expire < Date.now()
-        || account.belongs?.length // don't every() on empty array, as it returns true
-            && account.belongs.map(u => getAccount(u, false)).every(a => a && accountIsDisabled(a)));
+    return check(account, new Set());
+    function check(account, visiting) {
+        if (account.disabled || account.expire < Date.now())
+            return true;
+        if (!account.belongs?.length)
+            return false;
+        // consider invalid membership cycles disabled so they cannot grant privileges
+        if (visiting.has(account.username))
+            return true;
+        visiting.add(account.username);
+        const ret = account.belongs.every(u => {
+            const a = getAccount(u, false);
+            return Boolean(a && check(a, visiting));
+        });
+        visiting.delete(account.username);
+        return ret;
+    }
 }
 function accountCanLoginAdmin(account) {
     return accountCanLogin(account) && getFromAccount(account, a => a.admin) || false;

package/src/pluginCatalog.js

@@ -0,0 +1,66 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPluginCatalog = getPluginCatalog;
+exports.searchPluginCatalog = searchPluginCatalog;
+const github_1 = require("./github");
+const persistence_1 = require("./persistence");
+const const_1 = require("./const");
+const lodash_1 = __importDefault(require("lodash"));
+const CACHE_KEY = 'pluginCatalog';
+let refreshing;
+async function* getPluginCatalog() {
+    await persistence_1.storedMap.ready();
+    const saved = await persistence_1.storedMap.get(CACHE_KEY);
+    // compatibility is determined by this HFS version, including fallback api branches
+    const previous = saved?.version === const_1.VERSION ? saved : undefined;
+    const age = previous ? Date.now() - previous.updatedAt : Infinity;
+    if (previous && age < 24 * 60 * 60_000)
+        yield { ...previous, refreshing: age >= 5 * 60_000 };
+    if (age < 5 * 60_000)
+        return;
+    // all searches share the same refresh, even if the initiating client disconnects
+    refreshing ??= refresh().finally(() => { refreshing = undefined; });
+    yield { ...await refreshing, refreshing: false };
+    async function refresh() {
+        const repositories = [];
+        for await (const repo of (0, github_1.apiGithubPaginated)('search/repositories?q=topic:hfs-plugin', { requireComplete: true }))
+            repositories.push(lodash_1.default.pick(repo, ['full_name', 'description', 'pushed_at', 'default_branch', 'stargazers_count', 'license']));
+        const old = new Map(previous?.entries.map(entry => [entry.repository.full_name, entry]));
+        const entries = await Promise.all(repositories.map(async (repository) => {
+            const cached = old.get(repository.full_name);
+            let plugin = cached?.plugin;
+            if (!cached || cached.repository.pushed_at !== repository.pushed_at
+                || cached.repository.default_branch !== repository.default_branch) {
+                plugin = await (0, github_1.readOnlineCompatiblePlugin)(repository.full_name, repository.default_branch)
+                    .catch((error) => {
+                    // repositories can carry the topic without providing a plugin at the expected path
+                    if (error.message !== '404')
+                        throw error;
+                }) ?? null;
+            }
+            return { repository, plugin: plugin ?? null };
+        }));
+        const next = { version: const_1.VERSION, updatedAt: Date.now(), entries };
+        // never replace a complete catalog with the result of a failed refresh
+        await persistence_1.storedMap.put(CACHE_KEY, next);
+        return next;
+    }
+}
+async function searchPluginCatalog(catalog, text = '', skipRepos = []) {
+    const central = await (0, github_1.getProjectInfo)();
+    const terms = text.toLowerCase().split(/\s+/).filter(Boolean);
+    return catalog.entries.flatMap(({ repository, plugin }) => {
+        const repo = repository.full_name;
+        const searchable = `${repo} ${repository.description || ''} ${plugin?.description || ''}`.toLowerCase();
+        if (!plugin || skipRepos.includes(repo) || central?.repo_blacklist?.[repo]?.message
+            || !terms.every(term => searchable.includes(term)))
+            return [];
+        // API responses add live state and dependency errors; keep the persisted metadata untouched
+        return [{ ...plugin, id: repo, repo, pushed_at: repository.pushed_at,
+                stargazers_count: repository.stargazers_count, default_branch: repository.default_branch,
+                license: repository.license?.spdx_id }];
+    });
+}

package/src/pluginUsage.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_crypto_1 = require("node:crypto");
+const misc_1 = require("./misc");
+const config_1 = require("./config");
+const plugins_1 = require("./plugins");
+const persistence_1 = require("./persistence");
+const util_http_1 = require("./util-http");
+const debounceAsync_1 = require("./debounceAsync");
+const shareUsageStats = (0, config_1.defineConfig)(misc_1.CFG.share_usage_stats, false);
+const installationId = persistence_1.storedMap.singleSync('pluginUsageId', '');
+const lastReport = persistence_1.storedMap.singleSync('lastPluginUsageReport', 0);
+const ready = Promise.all([config_1.configReady, plugins_1.pluginsScanned, installationId.ready(), lastReport.ready()]);
+const syncPluginUsage = (0, debounceAsync_1.debounceAsync)(async () => {
+    await ready;
+    let uuid = installationId.get();
+    if (!shareUsageStats.get()) {
+        if (!uuid)
+            return;
+        await send('DELETE', { uuid });
+        installationId.set('');
+        lastReport.set(0);
+        return;
+    }
+    if (Date.now() < lastReport.get() + misc_1.DAY)
+        return;
+    if (!uuid) {
+        uuid = (0, node_crypto_1.randomUUID)();
+        installationId.set(uuid);
+    }
+    const enabled = plugins_1.enablePlugins.get();
+    const plugins = selectReportedPlugins([
+        ...(0, plugins_1.mapPlugins)((plugin, id) => ({ ...plugin.getData(), id, enabled: enabled.includes(id) }), false),
+        ...(0, plugins_1.getInactivePlugins)().map(plugin => ({ ...plugin, enabled: enabled.includes(plugin.id) })),
+    ]);
+    await send('POST', { uuid, hfsVersion: String(config_1.currentVersion), plugins });
+    lastReport.set(Date.now());
+    function selectReportedPlugins(installed) {
+        const selected = new Map();
+        for (const plugin of installed) {
+            const repo = typeof plugin.repo === 'string' ? plugin.repo : plugin.repo?.main;
+            if (!repo)
+                continue;
+            const current = selected.get(repo);
+            if (!current || better(plugin, current))
+                selected.set(repo, plugin);
+        }
+        return Array.from(selected, ([repo, plugin]) => ({
+            repo,
+            version: plugin.version,
+            enabled: plugin.enabled,
+        })).sort((a, b) => a.repo.localeCompare(b.repo));
+        function better(a, b) {
+            return Number(a.enabled) > Number(b.enabled)
+                || a.enabled === b.enabled && (a.id.length < b.id.length
+                    || a.id.length === b.id.length && a.id.localeCompare(b.id) < 0);
+        }
+    }
+});
+shareUsageStats.sub(() => void syncPluginUsage().catch(() => { }));
+(0, misc_1.repeat)(misc_1.HOUR, syncPluginUsage);
+async function send(method, body) {
+    await (0, util_http_1.httpWithBody)(misc_1.PLUGIN_USAGE_URL + '/report', { method, body, timeout: 5000 });
+}

package/src/plugins.js

@@ -53,6 +53,7 @@ exports.getInactivePlugins = getInactivePlugins;
 exports.rescan = rescan;
 exports.parsePluginSource = parsePluginSource;
 exports.getMissingDependencies = getMissingDependencies;
+const acmeDns_1 = require("./acmeDns");
 const fast_glob_1 = __importDefault(require("fast-glob"));
 const watchLoad_1 = require("./watchLoad");
 const lodash_1 = __importDefault(require("lodash"));
@@ -232,6 +233,13 @@ async function initPlugin(pl, morePassedToInit, onInitError) {
                 return result;
             }
         },
+        registerAcmeDnsProvider(...args) {
+            if (unloading)
+                throw Error("Plugin is unloading");
+            const unregister = (0, acmeDns_1.registerAcmeDnsProvider)(...args);
+            cleanups.push(unregister);
+            return unregister;
+        },
         misc, _: lodash_1.default,
         customApiCall, notifyClient: frontEndApis_1.notifyClient, addBlock: block_1.addBlock, ctxBelongsTo: perm_1.ctxBelongsTo, getConnections: connections_1.getConnections, normalizeFilename: vfs_1.normalizeFilename,
         getCurrentUsername: auth_1.getCurrentUsername, getAccount: perm_1.getAccount, getUsernames: perm_1.getUsernames, addAccount: perm_1.addAccount, delAccount: perm_1.delAccount, updateAccount: perm_1.updateAccount, renameAccount: perm_1.renameAccount,
@@ -734,6 +742,10 @@ function parsePluginSource(id, source) {
     pl.depend = (0, misc_1.tryJson)(/exports.depend\s*=\s*(\[[\s\S]*?])/m.exec(source)?.[1])?.filter((x) => typeof x.repo === 'string' && x.version === undefined || typeof x.version === 'number'
         || console.warn("Plugin dependency discarded", x));
     pl.changelog = (0, misc_1.tryJson)(/exports.changelog\s*=\s*(\[[\s\S]*?])/m.exec(source)?.[1]);
+    if (!Array.isArray(pl.changelog))
+        delete pl.changelog;
+    else if (lodash_1.default.remove(pl.changelog, entry => !Number.isFinite(entry?.version) || typeof entry?.message !== 'string').length)
+        console.warn("Invalid plugin changelog entries discarded", id);
     if (Array.isArray(pl.apiRequired) && (pl.apiRequired.length !== 2 || !pl.apiRequired.every(lodash_1.default.isFinite))) // validate [from,to] form
         pl.apiRequired = undefined;
     calculateBadApi(pl);

package/src/roots.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.rootsMiddleware = exports.roots = void 0;
+exports.rootsMiddleware = exports.rootsHostGuard = exports.roots = void 0;
 const config_1 = require("./config");
 const misc_1 = require("./misc");
 const connections_1 = require("./connections");
@@ -17,6 +17,26 @@ exports.roots = (0, config_1.defineConfig)(misc_1.CFG.roots, {}, map => {
     return (host) => values[matchers.findIndex(m => m(host))];
 });
 const forceAddress = (0, config_1.defineConfig)(misc_1.CFG.force_address, false);
+const rootsHostGuard = (ctx, next) => {
+    if (!ctx.path || lodash_1.default.isEmpty(exports.roots.get()))
+        return next();
+    if (ctx.path.startsWith(misc_1.SPECIAL_URI)) {
+        if (!ctx.path.startsWith(misc_1.API_URI))
+            return next();
+        const { referer } = ctx.headers;
+        const fromAdmin = referer && (0, misc_1.try_)(() => new URL(referer).pathname.startsWith(ctx.state.revProxyPath + misc_1.ADMIN_URI));
+        // authentication must remain reachable before ctxAdminAccess can succeed
+        if (fromAdmin && ((0, adminApis_1.ctxAdminAccess)(ctx)
+            || ['login', 'loginSrp1', 'loginSrp2'].some(x => ctx.path === misc_1.API_URI + x)))
+            return next();
+    }
+    const root = ctx.state.root = exports.roots.compiled()(ctx.host);
+    return !ctx.state.skipFilters && forceAddress.get()
+        && root === undefined && !(0, misc_1.isLocalHost)(ctx) && ctx.host !== listen_1.baseUrl.compiled()
+        ? (0, connections_1.disconnect)(ctx, forceAddress.key())
+        : next();
+};
+exports.rootsHostGuard = rootsHostGuard;
 const rootsMiddleware = (ctx, next) => (() => {
     if (!ctx.path) // it was once reported "Cannot read properties of null (reading 'startsWith')" but I can't reproduce it, and it shouldn't happen anyway
         return (0, connections_1.disconnect)(ctx, 'no path'); // let's assume that such requests can't be served anyway. This will leave a trace with an ip, anyway
@@ -27,19 +47,8 @@ const rootsMiddleware = (ctx, next) => (() => {
             return; // ...unless it's an api
         params = ctx.state.params || ctx.query; // for api we'll translate params
         changeUriParams(v => (0, misc_1.removeStarting)(ctx.state.revProxyPath, v)); // this removal must be done before adding the root; this operation doesn't conceptually belong to "roots", and it may be placed in different middleware, but it's convenient to do it here
-        const { referer } = ctx.headers;
-        const fromAdmin = referer && (0, misc_1.try_)(() => new URL(referer).pathname.startsWith(ctx.state.revProxyPath + misc_1.ADMIN_URI));
-        // authentication must remain reachable before ctxAdminAccess can succeed
-        if (fromAdmin && ((0, adminApis_1.ctxAdminAccess)(ctx)
-            || ['login', 'loginSrp1', 'loginSrp2'].some(x => ctx.path === misc_1.API_URI + x)))
-            return;
     }
-    if (lodash_1.default.isEmpty(exports.roots.get()))
-        return;
-    const root = ctx.state.root = exports.roots.compiled()(ctx.host);
-    if (!ctx.state.skipFilters && forceAddress.get()
-        && root === undefined && !(0, misc_1.isLocalHost)(ctx) && ctx.host !== listen_1.baseUrl.compiled())
-        return (0, connections_1.disconnect)(ctx, forceAddress.key()); // returning truthy will not call next
+    const { root } = ctx.state;
     if (!root || root === '/')
         return; // no transformation is required
     changeUriParams(v => (0, misc_1.join)(root, v));

package/src/serveFile.js

@@ -8,6 +8,9 @@ exports.forceDownload = forceDownload;
 exports.disposition = disposition;
 exports.serveFileNode = serveFileNode;
 exports.enforceDownloadLimits = enforceDownloadLimits;
+exports.resolveFileMime = resolveFileMime;
+exports.getNodeMime = getNodeMime;
+exports.isActiveContentMime = isActiveContentMime;
 exports.serveFile = serveFile;
 exports.monitorAsDownload = monitorAsDownload;
 exports.applyRange = applyRange;
@@ -26,6 +29,7 @@ const errorPages_1 = require("./errorPages");
 const stream_1 = require("stream");
 const crypto_1 = require("crypto");
 const iconv_lite_1 = __importDefault(require("iconv-lite"));
+const upload_1 = require("./upload");
 const allowedReferer = (0, config_1.defineConfig)(misc_1.CFG.allowed_referer, '');
 const maxDownloads = downloadLimiter((0, config_1.defineConfig)(misc_1.CFG.max_downloads, 0), () => true);
 const maxDownloadsPerIp = downloadLimiter((0, config_1.defineConfig)(misc_1.CFG.max_downloads_per_ip, 0), ctx => ctx.ip);
@@ -49,6 +53,7 @@ async function serveFileNode(ctx, node) {
     const name = (0, vfs_1.getNodeName)(node);
     const mimeString = typeof mime === 'string' ? mime
         : lodash_1.default.find(mime, (_val, mask) => (0, misc_1.matches)(name, mask));
+    const effectiveMime = resolveFileMime(source || '', mimeString);
     if (allowedReferer.get()) {
         const ref = (0, misc_1.try_)(() => new URL(ctx.get('referer') || '').host);
         if (ref && ref !== ctx.host // automatically accept if the referer is basically the hosting domain
@@ -58,12 +63,17 @@ async function serveFileNode(ctx, node) {
     ctx.state.vfsNode = node; // useful to tell service files from files shared by the user
     const download = 'dl' in ctx.query;
     disposition(ctx, name, download);
+    if (!download && source && isActiveContentMime(effectiveMime)) {
+        const upload = await (0, upload_1.getUploadMeta)(source);
+        if ((0, upload_1.isUploading)(source) || upload && upload.approved !== true)
+            return (0, errorPages_1.sendErrorPage)(ctx, const_1.HTTP_FORBIDDEN);
+    }
     const fetchDest = ctx.get('sec-fetch-dest');
     ctx.state.considerAsGui ??= !download && ctx.get('referer')?.endsWith('/')
         && (fetchDest ? fetchDest !== 'document' && fetchDest !== 'empty' // modern clients
             // legacy clients often send Accept: */* for archive downloads, so the served mime is a safer signal than request headers here
-            : GUI_ASSET_MIME.test(mimeString || mime_types_1.default.lookup(source || '') || ''));
-    await serveFile(ctx, source || '', mimeString);
+            : GUI_ASSET_MIME.test(effectiveMime));
+    await serveFile(ctx, source || '', effectiveMime);
     await enforceDownloadLimits(ctx);
 }
 async function enforceDownloadLimits(ctx) {
@@ -75,14 +85,25 @@ const mimeCfg = (0, config_1.defineConfig)(misc_1.CFG.mime, {}, obj => {
     const values = Object.values(obj);
     return (name) => values[matchers.findIndex(matcher => matcher(name))];
 });
+function resolveFileMime(filePath, mime) {
+    mime ??= mimeCfg.compiled()((0, path_1.basename)(filePath));
+    return mime === undefined || mime === const_1.MIME_AUTO ? mime_types_1.default.lookup(filePath) || '' : mime;
+}
+function getNodeMime(node) {
+    const name = (0, vfs_1.getNodeName)(node);
+    const mime = typeof node.mime === 'string' ? node.mime
+        : lodash_1.default.find(node.mime, (_val, mask) => (0, misc_1.matches)(name, mask));
+    return resolveFileMime(node.source || '', mime);
+}
+function isActiveContentMime(mime) {
+    return /^(?:text\/html|application\/xhtml\+xml|image\/svg\+xml)(?:;|$)/i.test(mime);
+}
 // after this number of seconds, the browser should check the server to see if there's a newer version of the file
 const cacheControlDiskFiles = (0, config_1.defineConfig)(misc_1.CFG.cache_control_disk_files, 5);
 async function serveFile(ctx, filePath, mime, cached) {
     if (!filePath)
         return;
-    mime ??= mimeCfg.compiled()((0, path_1.basename)(filePath));
-    if (mime === undefined || mime === const_1.MIME_AUTO)
-        mime = mime_types_1.default.lookup(filePath) || '';
+    mime = resolveFileMime(filePath, mime);
     if (mime)
         ctx.type = mime;
     if (ctx.method === 'OPTIONS') {

package/src/serveGuiFiles.js

@@ -19,6 +19,7 @@ const customHtml_1 = require("./customHtml");
 const lodash_1 = __importDefault(require("lodash"));
 const config_1 = require("./config");
 const lang_1 = require("./lang");
+const adminLang_1 = require("./adminLang");
 const upload_1 = require("./upload");
 const icons_1 = require("./icons");
 const middlewares_1 = require("./middlewares");
@@ -107,7 +108,8 @@ async function treatIndex(ctx, filesUri, body) {
         return !lodash_1.default.isEmpty(configs) && [name, configs];
     })));
     const timestamp = await getFaviconTimestamp();
-    const lang = await (0, lang_1.getLangData)(ctx);
+    const adminLangs = isFrontend ? [] : await (0, adminLang_1.getAdminLangs)();
+    const lang = isFrontend ? await (0, lang_1.getLangData)(ctx) : await (0, adminLang_1.getAdminLangData)(ctx, adminLangs);
     let group = 0; // this represents the loading-group: all plugins with the same group can be loaded concurrently
     const loadScripts = (0, misc_1.onlyTruthy)((0, plugins_1.mapPlugins)((p, id) => {
         const js = p.frontend_js?.map(f => f.includes('//') ? f : pub + id + '/' + f);
@@ -148,7 +150,8 @@ async function treatIndex(ctx, filesUri, body) {
                 customHtml: lodash_1.default.omit((0, customHtml_1.getAllSections)(), ['top', 'bottom', 'htmlHead', 'style']), // exclude the sections we already apply in this phase
                 ...(0, misc_1.newObj)(misc_1.FRONTEND_OPTIONS, (v, k) => (0, config_1.getConfig)(k)),
                 icons: Object.assign({}, ...(0, plugins_1.mapPlugins)(p => iconsToObj(p.icons, p.id + '/')), iconsToObj(icons_1.customizedIcons)), // name-to-uri 
-                lang
+                lang,
+                ...(isFrontend ? {} : { adminLangs, adminLang: adminLang_1.adminLang.get() })
             }, null, 4).replace(/<(\/script)/g, '<"+"$1') /*avoid breaking our script container*/}
                     document.documentElement.setAttribute('ver', HFS.VERSION.split('-')[0])
                     document.documentElement.setAttribute('browser', ${JSON.stringify((0, misc_1.shortenAgent)(ctx.get('user-agent')))})