hfs 3.4.0-alpha1 → 3.4.0-alpha2

package/src/langs/hfs-lang-zh.json

@@ -1,191 +1,189 @@
 {
-    "author": "yx3016 & MircoH0 & CMJNB & Cheuksing",
-    "version": 1.5,
-    "hfs_version": "0.57.5",
+    "author": "Hug3O",
+    "version": 1.2,
     "translate": {
         "Select": "选择",
-        "n_files": "{n} 个文件",
-        "n_folders": "{n} 个文件夹",
-        "filter_count": "{n} 符合筛选条件",
-        "select_count": "{n} 已选中",
-        "filter_placeholder": "输入筛选内容，对以下列表进行筛选",
+        "n_files": "{n,plural,one{# 文件} other{# 文件}}",
+        "n_folders": "{n,plural,one{# 文件夹} other{# 文件夹}}",
+        "filter_count": "{n,plural, one{# 个已筛选} other{# 个已筛选}}",
+        "select_count": "{n,plural, one{# 个已选择} other{# 个已选择}}",
+        "filter_placeholder": "在此输入以筛选下方列表",
         "Select some files": "选择一些文件",
-        "zip_checkboxes": "点击复选框选择文件，然后再次使用Zip进行打包！",
-        "zip_tooltip_selected": "将所选元素下载为单个ZIP文件",
-        "zip_tooltip_whole": "将整个列表（未过滤）下载为单个ZIP文件。若已选择部分元素，则仅下载这些元素。",
-        "zip_confirm_search": "是否将此次搜索的所有结果下载为ZIP压缩包？",
-        "zip_confirm_folder": "确认将整个文件夹下载为ZIP压缩包？",
-        "select_tooltip": "选择功能适用于“Zip”和“删除”操作，也可用于筛选列表。",
-        "delete_hint": "请先单击“选择”某个项目，方可执行删除操作。",
-        "delete_confirm": "确认删除 {n} 项？",
-        "delete_completed": "删除 {n} 项成功！",
-        "delete_failed": "删除失败，{n,plural, other{# 项失败}}",
+        "zip_checkboxes": "使用复选框选择文件，然后可以再次使用 Zip",
+        "zip_tooltip_selected": "将选中的元素作为单个 zip 文件下载",
+        "zip_tooltip_whole": "将整个列表（未筛选）作为单个 zip 文件下载。如果你选择了一些元素，则只下载那些元素。",
+        "zip_confirm_search": "将此搜索的所有结果下载为 ZIP 压缩包？",
+        "zip_confirm_folder": "将整个文件夹打包为ZIP再进行下载？",
+        "select_tooltip": "选择适用于“Zip”和“删除”（如果可用），但你也可以筛选列表",
+        "delete_hint": "要删除，请先点击“选择”",
+        "delete_confirm": "删除 {n,plural, one{# 个项目} other{# 个项目}}？",
+        "delete_completed": "删除：已完成 {n} 个",
+        "delete_failed": "，{n,plural, one{# 个失败} other{# 个失败}}",
         "delete_select": "选择要删除的内容",
         "Delete": "删除",
         "Options": "选项",
         "Search": "搜索",
-        "Zip": "压缩",
-        "search_msg": "搜索当前文件夹及其子文件夹",
-        "Searching": "搜索中...",
-        "Searched": "搜索完成！",
-        "Clear search": "清除搜索条件",
-        "Interrupted": "中断",
-        "stopped_before": "已停止",
-        "empty_list": "列表为空",
-        "filter_none": "无过滤条件",
-        "Admin-panel": "管理面板",
+        "Zip": "Zip",
+        "search_msg": "搜索此文件夹及子文件夹",
+        "Searching": "正在搜索",
+        "Searched": "已搜索",
+        "Clear search": "清除搜索",
+        "Interrupted": "已中断",
+        "stopped_before": "在找到任何内容之前已停止",
+        "empty_list": "这里什么都没有",
+        "filter_none": "没有与此筛选条件匹配的内容",
+        "alpha_idx": "字母索引",
+        "alpha_idx_button": "AZ",
+        "Admin-panel": "后台管理",
         "Login": "登录",
         "Username": "用户名",
         "Password": "密码",
-        "login_untrusted": "登录中止：服务器标识不可信！",
-        "login_bad_credentials": "凭证信息有误",
-        "confirm_url_login": "此链接正尝试以“{username}”身份登录",
-        "login_bad_cookies": "Cookie错误 - 登录失败",
+        "login_untrusted": "登录已中止：无法信任服务器身份",
+        "login_bad_credentials": "凭据无效",
+        "confirm_url_login": "此链接正尝试以“{username}”身份登录你",
+        "login_bad_cookies": "Cookie 无法正常工作 - 登录失败",
         "User panel": "用户面板",
         "Change password": "更改密码",
         "enter_pass": "输入新密码",
-        "enter_pass2": "再次输入密码",
-        "pass2_mismatch": "两次输入的密码不一致，修改失败！",
-        "password_changed": "密码修改成功",
-        "Logout": "注销",
+        "enter_pass2": "再次输入相同的新密码",
+        "pass2_mismatch": "你输入的第二个密码与第一个不匹配。过程已中止。",
+        "password_changed": "密码已更改",
+        "Logout": "退出登录",
         "connection error": "连接错误",
         "Full timestamp:": "完整时间戳：",
         "Search was interrupted": "搜索已中断",
         "Stop list": "停止列表",
-        "download_starting": "开始下载",
-        "wrong_account": "用户 {u} 无访问权限，请更换用户",
-        "no_upload_here": "无上传权限",
+        "download_starting": "你的下载现在应开始",
+        "wrong_account": "账户 {u} 没有访问权限，请尝试其他账户",
+        "no_upload_here": "当前文件夹没有上传权限",
         "Create folder": "创建文件夹",
         "Pick files": "选择文件",
         "Pick folder": "选择文件夹",
-        "ready_to_upload": "{n,plural,other{# 个文件}}，{size}，准备上传",
+        "ready_to_upload": "{n,plural,one{# 个文件} other{# 个文件}}，{size}，准备上传",
         "Send": "发送",
         "Clear": "清除",
         "failed_upload": "无法上传 {name}",
-        "confirm_resume": "是否重命名？",
         "file too large": "文件过大",
         "Enter folder name": "输入文件夹名称",
         "Successfully created": "创建成功",
-        "enter_folder": "进入文件夹",
-        "folder_exists": "已存在同名文件夹",
-        "Sort by": "排序依据",
-        "name": "文件名",
-        "extension": "扩展名",
+        "enter_folder": "输入文件夹",
+        "folder_exists": "同名文件夹已存在",
+        "Sort by:": "排序：{by}",
+        "name": "文件名称",
+        "extension": "文件后缀",
         "size": "文件大小",
-        "time": "文件时间",
-        "Invert order": "倒序",
-        "Folders first": "文件夹优先",
+        "time": "修改时间",
+        "Invert order": "倒序排列",
+        "Folders first": "文件夹先",
         "Numeric names": "数字名称",
         "theme:": "主题：",
         "auto": "自动",
-        "light": "亮色",
-        "dark": "暗色",
-        "parent folder": "上级文件夹",
+        "light": "浅色",
+        "dark": "深色",
+        "parent folder": "父文件夹",
         "home": "主页",
         "Continue": "继续",
         "Confirm": "确认",
-        "Don't": "否",
+        "Don't": "不要",
         "Warning": "警告",
         "Error": "错误",
         "Info": "信息",
         "Unauthorized": "未授权",
-        "Forbidden": "禁止访问",
+        "Forbidden": "禁止",
         "Not found": "未找到",
         "Server error": "服务器错误",
         "Upload": "上传",
         "upload_concluded": "上传已结束：",
-        "upload_finished": "上传{n} 完成 ({size})",
-        "upload_errors": "上传失败{n} 次",
-        "upload_file_rejected": "部分文件被服务器拒绝接收",
-        "delete_unfinished_upload": "要移除未完成的上传吗？",
+        "upload_finished": "{n} 个已完成（{size}）",
+        "upload_errors": "{n} 个失败",
+        "upload_file_rejected": "某些文件未被接受",
+        "delete_unfinished_upload": "删除未完成的上传？",
         "File menu": "文件菜单",
         "Folder menu": "文件夹菜单",
         "Name": "名称",
         "file_open": "打开",
         "Download": "下载",
-        "Missing permission": "权限不足",
+        "Missing permission": "缺少权限",
         "Reload": "重新加载",
         "Get list": "获取列表",
-        "Skip existing files": "跳过已存在的文件",
+        "Skip existing files": "跳过现有文件",
         "Size": "大小",
-        "Timestamp": "时间戳",
-        "Show": "显示/播放",
+        "Timestamp": "修改时间",
+        "Show": "显示",
         "Loading failed": "加载失败",
+        "Download limit reached": "已达到下载数量上限",
+        "Retry": "重试",
         "Rename": "重命名",
         "Tiles mode:": "平铺模式：",
         "off": "关闭",
         "Operation successful": "操作成功",
         "Uploader": "上传者",
-        "Download counter": "下载次数",
+        "Download counter": "下载计数器",
         "Switch zoom mode": "切换缩放模式",
         "Full screen": "全屏",
         "File Show help": "文件显示帮助",
-        "showHelpMain": "您可以使用键盘执行以下操作：",
+        "showHelpMain": "你可以使用键盘执行一些操作：",
         "showHelp_←/→": "←/→",
         "showHelp_↑/↓": "↑/↓",
         "showHelp_space": "空格",
         "showHelp_←/→_body": "转到上一个/下一个文件",
-        "showHelp_↑/↓_body": "滚动长图",
-        "showHelp_space_body": "选择",
-        "showHelp_D_body": "下载",
-        "showHelp_Z_body": "缩放模式",
-        "showHelp_F_body": "全屏",
-        "Destination": "目标位置",
-        "in_queue": "{n} 个在队列中",
-        "enter_comment": "对此文件的评论",
-        "Comment": "评论",
-        "upload_dd_hint": "您可以将文件拖放到文件列表中进行上传",
+        "showHelp_↑/↓_body": "滚动长图片",
+        "Destination": "目标",
+        "in_queue": "队列中有 {n} 个",
+        "enter_comment": "为 {name} 添加注释",
+        "Comment": "注释",
+        "upload_dd_hint": "你可以通过将文件拖放到文件列表上来上传文件",
         "Upload not available": "上传不可用",
         "Cut": "剪切",
-        "n_items": "{n,plural, other{# 个项目}}",
-        "move_results": "{good} 个已移动，{bad} 个失败",
-        "after_cut": "您的选择已成功添加到剪贴板，请前往目标文件夹粘贴。",
+        "n_items": "{n,plural, one{# 个项目} other{# 个项目}}",
+        "move_results": "{good} 个已移动{bad,plural, =0{} other{，# 个失败}}",
+        "after_cut": "你的选择现在已在剪贴板中。\n转到目标文件夹进行粘贴。",
         "Cancel clipboard": "取消剪贴板",
         "to_clipboard_source": "返回源文件夹",
         "Paste": "粘贴",
-        "clipboard_list": "剪贴板文件：",
+        "clipboard_list": "剪贴板中的项目：",
         "Close": "关闭",
         "Folder": "文件夹",
         "Web page": "网页",
         "Link": "链接",
         "Auto-play": "自动播放",
-        "autoplay_seconds": "图片间隔秒数",
+        "autoplay_seconds": "图片等待秒数",
         "Select all": "全选",
-        "go_first": "跳转到第一个项目",
-        "go_last": "跳转到最后一个项目",
+        "go_first": "转到第一项",
+        "go_last": "转到最后一项",
         "Shuffle": "随机播放",
         "Repeat": "重复",
-        "showHelpListShortcut": "在文件列表中，按住 {key} 点击可快速显示",
+        "showHelpListShortcut": "在文件列表中，按住 {key} 点击可显示",
         "Invalid value": "无效值",
-        "upload_interrupted": "{n} 中断",
+        "upload_interrupted": "{n} 个已中断",
         "Overwrite policy": "覆盖策略",
         "Rename to avoid overwriting": "重命名以避免覆盖",
-        "Overwrite existing files": "覆盖已存在的文件",
+        "Overwrite existing files": "覆盖现有文件",
         "Menu": "菜单",
-        "clipboard": "剪贴板 ({content})",
-        "to_clipboard_source_tooltip": "前往剪贴板内容所在的文件夹",
+        "clipboard": "剪贴板（{content}）",
+        "to_clipboard_source_tooltip": "转到剪贴板内容所在的文件夹",
         "more_items": "还有 {n} 个项目",
-        "Show details": "显示详细信息",
+        "Show details": "显示详情",
         "upload_conflict": "已存在",
         "Logged in": "已登录",
-        "Logged out": "已注销",
+        "Logged out": "已退出登录",
         "Cancel": "取消",
-        "allow_session_ip_change": "允许会话期间IP变更",
-        "focus_hint": "您可以通过键盘输入快速搜索并选择列表中的项目。",
+        "allow_session_ip_change": "允许此会话期间 IP 变更",
+        "focus_hint": "通过在键盘上输入，你可以搜索并聚焦列表中的项目。",
         "copy_links": "复制链接",
-        "Calculate": "计算",
+        "Calculate": "统计",
         "Creation": "创建时间",
-        "creation": "创建",
-        "required_change_password": "您需要更改密码",
+        "creation": "创建时间",
+        "required_change_password": "你需要更改密码",
         "Wildcards": "通配符",
-        "Considering resume": "正在尝试恢复上传",
+        "Considering resume": "考虑恢复",
         "Yes": "是",
         "No": "否",
-        "esc_again": "按 ESC 两次关闭",
+        "esc_again": "按两次 ESC 关闭",
         "insufficient storage": "存储空间不足",
-        "Account disabled": "账户已禁用",
+        "Account disabled": "账户已停用",
         "upload_name": "使用新名称上传",
-        "Uploading": "上传中",
-        "proxy_413": "检查代理服务器上的此限制"
+        "Uploading": "正在上传",
+        "proxy_413": "请检查代理服务器上的此限制"
     }
 }

package/src/listen.js

@@ -70,10 +70,16 @@ const consoleLog_1 = require("./consoleLog");
 const first_1 = require("./first");
 const fileAttr_1 = require("./fileAttr");
 const uploadOwners_1 = require("./uploadOwners");
+const sessionStamp_1 = require("./sessionStamp");
 let httpSrv;
 let httpsSrv;
 // the update relaunch can keep a bridge process alive, so we proactively close listeners here to release ports before the next binary binds; do it before (5) the storage file is closed, because sockets write there
-(0, first_1.onProcessExit)(() => Promise.all([stopServer(httpSrv), stopServer(httpsSrv)]), 5);
+(0, first_1.onProcessExit)(() => {
+    const stopped = Promise.all([stopServer(httpSrv), stopServer(httpsSrv)]);
+    for (const { socket } of (0, connections_1.getConnections)()) // closeAllConnections misses TCP sockets awaiting TLS and connections upgraded by plugins
+        socket.destroy();
+    return stopped;
+}, 5);
 const openBrowserAtStart = (0, config_1.defineConfig)(misc_1.CFG.open_browser_at_start, true);
 exports.baseUrl = (0, config_1.defineConfig)(misc_1.CFG.base_url, '', x => /(?<=\/\/)[^\/]+/.exec(x)?.[0]); // compiled is host only
 async function getBaseUrlOrDefault() {
@@ -88,7 +94,7 @@ const commonServerOptions = {
 };
 // these are properties that can be assigned to the server object
 const commonServerAssign = { headersTimeout: 30_000, timeout: misc_1.MINUTE }; // 'headersTimeout' is not recognized by type lib, and 'timeout' is not effective when passed in parameters
-const readyToListen = Promise.all([persistence_1.storedMap.isOpening(), fileAttr_1.fileAttrDb.isOpening(), uploadOwners_1.uploadOwners.isOpening(), events_1.default.once('app')]);
+const readyToListen = Promise.all([persistence_1.storedMap.isOpening(), sessionStamp_1.sessionStampsReady, fileAttr_1.fileAttrDb.isOpening(), uploadOwners_1.uploadOwners.isOpening(), events_1.default.once('app')]);
 const considerHttp = (0, misc_1.debounceAsync)(async () => {
     await readyToListen;
     void stopServer(httpSrv);
@@ -302,8 +308,6 @@ function stopServer(srv) {
                 console.debug("Failed to stop server", String(err));
             resolve(err);
         });
-        if (first_1.quitting)
-            srv.closeAllConnections();
     });
 }
 function getCurrentPort(srv) {

package/src/middlewares.js

@@ -4,26 +4,28 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sessionMiddleware = exports.paramsDecoder = exports.prepareState = exports.someSecurity = exports.cloudflareDetected = exports.headRequests = exports.gzipper = exports.sessionDuration = void 0;
+exports.sessionMiddleware = exports.paramsDecoder = exports.prepareState = exports.blockFilter = exports.prepareConnection = exports.someSecurity = exports.cloudflareDetected = exports.gzipper = exports.sessionDuration = void 0;
 exports.getProxyDetected = getProxyDetected;
 exports.failAllowNet = failAllowNet;
 const koa_compress_1 = __importDefault(require("koa-compress"));
 const const_1 = require("./const");
 const misc_1 = require("./misc");
-const node_crypto_1 = require("node:crypto");
-const lang_1 = require("./lang");
-const i18n_1 = require("./i18n");
-const stream_1 = require("stream");
 const block_1 = require("./block");
 const perm_1 = require("./perm");
 const connections_1 = require("./connections");
 const auth_1 = require("./auth");
+const sessionStamp_1 = require("./sessionStamp");
 const zlib_1 = require("zlib");
 const listen_1 = require("./listen");
+const roots_1 = require("./roots");
+const node_net_1 = require("node:net");
 const config_1 = require("./config");
 const koa_session_1 = __importDefault(require("koa-session"));
 const index_1 = require("./index");
 const events_1 = __importDefault(require("./events"));
+const node_crypto_1 = require("node:crypto");
+const lang_1 = require("./lang");
+const i18n_1 = require("./i18n");
 const forceHttps = (0, config_1.defineConfig)(misc_1.CFG.force_https, true);
 (0, config_1.defineConfig)(misc_1.CFG.ignore_proxies, false);
 const allowAuthorizationHeader = (0, config_1.defineConfig)(misc_1.CFG.authorization_header, true);
@@ -38,26 +40,9 @@ exports.gzipper = (0, koa_compress_1.default)({
         return /text|javascript|style/i.test(type);
     },
 });
-const headRequests = async (ctx, next) => {
-    const head = ctx.method === 'HEAD';
-    if (head)
-        ctx.method = 'GET'; // let other middlewares work, so we can collect the size at the end
-    await next();
-    if (!head || ctx.body === undefined)
-        return;
-    const { length, status } = ctx.response;
-    if (ctx.body)
-        ctx.body = stream_1.Readable.from(''); // empty the body for this is a HEAD request. Using Readable avoids koa from trying to set length to 0
-    ctx.status = status;
-    if (length)
-        ctx.response.length = length;
-};
-exports.headRequests = headRequests;
 let proxyDetected;
 const someSecurity = (ctx, next) => {
     enforceSessionIp(ctx);
-    if (!ctx.state.skipFilters && (0, block_1.applyBlock)(ctx.socket, ctx.ip))
-        return;
     const decodedPath = (0, misc_1.try_)(() => decodeURI(ctx.path));
     if (!decodedPath || (0, misc_1.hasDirTraversal)(decodedPath))
         return;
@@ -111,6 +96,16 @@ async function sendPage(ctx, titleKey, content) {
         body{margin-top:30vh;text-align:center;font-family:sans-serif}a{margin:1em}
         </style></head><body><h1>${(0, misc_1.escapeHTML)(title)}</h1>${content(t)}</body></html>`;
 }
+const prepareConnection = (ctx, next) => {
+    // normalize once so auth, filters and logging agree on the same client address
+    ctx.request.ip = (0, misc_1.normalizeIp)(ctx.ip);
+    ctx.state.connection = (0, connections_1.socket2connection)(ctx.socket);
+    (0, connections_1.updateConnectionForCtx)(ctx);
+    return next();
+};
+exports.prepareConnection = prepareConnection;
+const blockFilter = (ctx, next) => !ctx.state.skipFilters && (0, block_1.applyBlock)(ctx.socket, ctx.ip) || next();
+exports.blockFilter = blockFilter;
 function enforceSessionIp(ctx) {
     const s = ctx.session;
     if (!s?.username || s[misc_1.ALLOW_SESSION_IP_CHANGE])
@@ -129,8 +124,7 @@ function getProxyDetected() {
     return proxyDetected && { from: proxyDetected.socket.remoteAddress, for: proxyDetected.get('X-Forwarded-For') };
 }
 const prepareState = async (ctx, next) => {
-    // normalize once so auth, filters and logging agree on the same client address
-    ctx.request.ip = (0, misc_1.normalizeIp)(ctx.ip);
+    ctx.state.getOrHead = ctx.method === 'GET' || ctx.method === 'HEAD';
     // invalidate before account resolution; someSecurity calls again to bind logins made below
     enforceSessionIp(ctx);
     // rootsMiddleware consults proxy-aware admin access before someSecurity runs
@@ -148,12 +142,13 @@ const prepareState = async (ctx, next) => {
     }
     const s = ctx.session;
     if (s?.username) {
-        if (s.ts < auth_1.invalidateSessionBefore.get(s?.username))
+        const account = (0, perm_1.getAccount)(s.username, false);
+        if (!account || !s.stamp || s.stamp !== (0, sessionStamp_1.getSessionStamp)(s.username)) {
             delete s.username;
+            delete s.stamp;
+        }
         s.maxAge = exports.sessionDuration.compiled();
     }
-    // calculate these once and for all
-    ctx.state.connection = (0, connections_1.socket2connection)(ctx.socket);
     // explicit credentials and existing sessions must take precedence, so a matching IP cannot override a chosen account
     let via;
     const urlAccount = await urlLogin();
@@ -178,7 +173,7 @@ const prepareState = async (ctx, next) => {
             ctx.headers['x-username'] = a.username; // give an easier way to determine if the login was successful
         }
     ctx.state.revProxyPath = ctx.get('x-forwarded-prefix');
-    (0, connections_1.updateConnectionForCtx)(ctx);
+    (0, connections_1.updateConnectionForCtx)(ctx); // publish the resolved account after the initial pre-auth connection update
     await next();
     async function urlLogin() {
         via = 'url';
@@ -232,6 +227,14 @@ const prepareState = async (ctx, next) => {
         catch { }
     }
     function autoLogin() {
+        const host = ctx.host.toLowerCase();
+        const hostname = (0, misc_1.normalizeHost)(host);
+        // a rebinding page uses the victim's real IP, but retains the attacker's hostname
+        if (hostname !== 'localhost' && !(0, node_net_1.isIP)(hostname)
+            // URL normalization matches browsers' default-port removal and internationalized domain names
+            && host !== (listen_1.baseUrl.get() && (0, misc_1.try_)(() => new URL(listen_1.baseUrl.get()).host.toLowerCase()))
+            && roots_1.roots.compiled()(host) === undefined)
+            return;
         via = 'net';
         // keep the mask direct so group inheritance cannot make identity depend on account order
         return Object.values(perm_1.accounts.get()).find(a => (0, perm_1.accountCanLogin)(a) && a.auto_login_net && (0, misc_1.netMatches)(ctx.ip, a.auto_login_net, true));

package/src/perm.js

@@ -12,6 +12,7 @@ exports.getAccount = getAccount;
 exports.saveSrpInfo = saveSrpInfo;
 exports.createAdmin = createAdmin;
 exports.updateAccount = updateAccount;
+exports.invalidateAccountSessions = invalidateAccountSessions;
 exports.normalizeUsername = normalizeUsername;
 exports.renameAccount = renameAccount;
 exports.addAccount = addAccount;
@@ -29,6 +30,7 @@ const config_1 = require("./config");
 const tssrp6a_1 = require("tssrp6a");
 const events_1 = __importDefault(require("./events"));
 const auth_1 = require("./auth");
+const sessionStamp_1 = require("./sessionStamp");
 // provides the username and all other usernames it inherits based on the 'belongs' attribute. Useful to check permissions
 function expandUsername(who) {
     return new Set(Array.from(walkActiveAccounts([who]), a => a.username));
@@ -69,6 +71,7 @@ async function createAdmin(password, username = 'admin') {
 }
 const srp6aNimbusRoutines = new tssrp6a_1.SRPRoutines(new tssrp6a_1.SRPParameters());
 async function updateAccount(account, change) {
+    await sessionStamp_1.sessionStampsReady;
     const jsonWas = JSON.stringify(account);
     const { username: usernameWas } = account;
     if (typeof change === 'function')
@@ -111,8 +114,27 @@ async function updateAccount(account, change) {
     if (jsonWas !== JSON.stringify(account)) // this test will miss the 'username' field, because hidden, but renameAccount is already calling saveAccountsASAP
         saveAccountsAsap();
 }
-const saveAccountsAsap = config_1.saveConfigAsap;
+function reconcileAccountSessions() {
+    (0, sessionStamp_1.syncSessionStamps)(lodash_1.default.mapKeys(exports.accounts.get(), (_account, username) => normalizeUsername(username)));
+}
+function saveAccountsAsap() {
+    // API callers need the updated stamp before preserving their own session in the response
+    reconcileAccountSessions();
+    (0, config_1.saveConfigAsap)();
+}
+function invalidateAccountSessions(account) {
+    const found = typeof account === 'string' ? getAccount(account) : account;
+    if (!found)
+        return false;
+    (0, sessionStamp_1.renewSessionStamp)(found.username);
+    return true;
+}
 exports.accounts = (0, config_1.defineConfig)(misc_1.CFG.accounts, {});
+exports.accounts.sub(async () => {
+    await sessionStamp_1.sessionStampsReady;
+    // do not debounce: removing and recreating a username must not be coalesced into one change
+    reconcileAccountSessions();
+});
 exports.accounts.sub(lodash_1.default.debounce(obj => {
     // consider some validation here, in case of manual edit of the config
     lodash_1.default.each(obj, (rec, k) => {
@@ -190,14 +212,14 @@ function addAccount(username, props, updateExisting = false) {
     if (account && !updateExisting)
         return;
     account = (0, misc_1.setHidden)(account || {}, { username }); // hidden so that stringification won't include it
-    Object.assign(account, lodash_1.default.pickBy(props, Boolean));
     exports.accounts.set(was => Object.assign(was, { [username]: account }));
-    return updateAccount(account, account).then(() => account);
+    return updateAccount(account, lodash_1.default.pickBy(props, Boolean)).then(() => account);
 }
 function delAccount(username) {
     if (!getAccount(username))
         return false;
-    exports.accounts.set(was => lodash_1.default.omit(was, normalizeUsername(username)));
+    username = normalizeUsername(username);
+    exports.accounts.set(was => lodash_1.default.omit(was, username));
     saveAccountsAsap();
     return true;
 }

package/src/plugins.js

@@ -298,8 +298,8 @@ const pluginsMiddleware = async (ctx, next) => {
             const a = path.substring(const_1.PLUGINS_PUB_URI.length).split('/');
             const name = a.shift();
             if (plugins.has(name)) { // do it only if the plugin is loaded
-                if (ctx.get('referer')?.endsWith('/'))
-                    ctx.state.considerAsGui = true;
+                // this server-owned route is GUI content; client headers must not grant the exemption
+                ctx.state.considerAsGui = true;
                 await (0, serveFile_1.serveFile)(ctx, plugins.get(name).folder + '/public/' + a.join('/'), const_1.MIME_AUTO);
             }
             return;

package/src/serveFile.js

@@ -31,10 +31,10 @@ const crypto_1 = require("crypto");
 const iconv_lite_1 = __importDefault(require("iconv-lite"));
 const upload_1 = require("./upload");
 const allowedReferer = (0, config_1.defineConfig)(misc_1.CFG.allowed_referer, '');
+const requireUploadApprovalForActiveContent = (0, config_1.defineConfig)(misc_1.CFG.require_upload_approval_for_active_content, true);
 const maxDownloads = downloadLimiter((0, config_1.defineConfig)(misc_1.CFG.max_downloads, 0), () => true);
 const maxDownloadsPerIp = downloadLimiter((0, config_1.defineConfig)(misc_1.CFG.max_downloads_per_ip, 0), ctx => ctx.ip);
 const maxDownloadsPerAccount = downloadLimiter((0, config_1.defineConfig)(misc_1.CFG.max_downloads_per_account, 0), ctx => (0, auth_1.getCurrentUsername)(ctx) || undefined);
-const GUI_ASSET_MIME = /^(image\/|audio\/|video\/|font\/|text\/css$|(?:text|application)\/(?:javascript|ecmascript)$|application\/x-javascript$)/i;
 function toAsciiEquivalent(s) {
     return iconv_lite_1.default.encode(iconv_lite_1.default.decode(Buffer.from(s), 'utf-8'), 'ascii').toString().replaceAll('?', '');
 }
@@ -64,15 +64,11 @@ async function serveFileNode(ctx, node) {
     const download = 'dl' in ctx.query;
     disposition(ctx, name, download);
     if (!download && source && isActiveContentMime(effectiveMime)) {
-        const upload = await (0, upload_1.getUploadMeta)(source);
-        if ((0, upload_1.isUploading)(source) || upload && upload.approved !== true)
+        if ((0, upload_1.isUploading)(source)
+            || requireUploadApprovalForActiveContent.get() && (await (0, upload_1.getUploadMeta)(source))?.approved === false)
             return (0, errorPages_1.sendErrorPage)(ctx, const_1.HTTP_FORBIDDEN);
     }
-    const fetchDest = ctx.get('sec-fetch-dest');
-    ctx.state.considerAsGui ??= !download && ctx.get('referer')?.endsWith('/')
-        && (fetchDest ? fetchDest !== 'document' && fetchDest !== 'empty' // modern clients
-            // legacy clients often send Accept: */* for archive downloads, so the served mime is a safer signal than request headers here
-            : GUI_ASSET_MIME.test(effectiveMime));
+    // shared files count even when embedded: client headers cannot grant exemptions from limits or logging
     await serveFile(ctx, source || '', effectiveMime);
     await enforceDownloadLimits(ctx);
 }
@@ -111,7 +107,7 @@ async function serveFile(ctx, filePath, mime, cached) {
         ctx.set({ Allow: 'OPTIONS, GET, HEAD' });
         return;
     }
-    if (ctx.method !== 'GET')
+    if (!ctx.state.getOrHead)
         return ctx.status = const_1.HTTP_METHOD_NOT_ALLOWED;
     try {
         const stats = cached?.stats || await (0, util_1.promisify)(fs_1.stat)(filePath); // using fs's function instead of fs/promises, because only the former is supported by pkg

package/src/serveGuiAndSharedFiles.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.serveSharedFiles = exports.guiFilesMiddleware = void 0;
+const deletePermission_1 = require("./deletePermission");
 const path_1 = require("path");
 const vfs_1 = require("./vfs");
 const errorPages_1 = require("./errorPages");
@@ -95,7 +96,7 @@ const serveSharedFiles = async (ctx, next) => {
         }
         return;
     }
-    if (/^\/favicon.ico(\??.*)/.test(ctx.originalUrl) && adminApis_1.favicon.get() && ctx.method === 'GET') // originalUrl to not be subject to changes (vhosting plugin)
+    if (ctx.state.getOrHead && /^\/favicon.ico(\??.*)/.test(ctx.originalUrl) && adminApis_1.favicon.get()) // originalUrl to not be subject to changes (vhosting plugin)
         return (0, serveFile_1.serveFile)(ctx, adminApis_1.favicon.get());
     let node = await (0, vfs_1.urlToNode)(path, ctx);
     if (!node)
@@ -106,9 +107,9 @@ const serveSharedFiles = async (ctx, next) => {
         const { source } = node;
         if (!source)
             return ctx.status = cross_const_1.HTTP_METHOD_NOT_ALLOWED;
-        if ((0, vfs_1.statusCodeForMissingPerm)(node, 'can_delete', ctx))
-            return;
         try {
+            if (!await (0, deletePermission_1.checkDeletePermission)(node, ctx))
+                return;
             if ((await events_1.default.emitAsync('deleting', { node, ctx }))?.isDefaultPrevented())
                 return ctx.status = cross_const_1.HTTP_FAILED_DEPENDENCY;
             await (0, promises_2.rm)(source, { recursive: true });
@@ -122,11 +123,11 @@ const serveSharedFiles = async (ctx, next) => {
             return ctx.status = cross_const_1.HTTP_SERVER_ERROR;
         }
     }
-    if (path.endsWith('/') && !get) { // final slash needed on browsers to make resource urls working with html pages
-        const found = await (0, vfs_1.getDefaultFile)(node, ctx);
-        if (found && /\.html?/i.test((0, vfs_1.getNodeName)(node = found)))
-            ctx.state.considerAsGui = true;
-    }
+    if (path.endsWith('/') && !get) // final slash needed on browsers to make resource urls working with html pages
+        node = await (0, vfs_1.getDefaultFile)(node, ctx) || node;
+    // classify the resolved default so a file can override its folder's GUI status
+    if (node.gui_asset)
+        ctx.state.considerAsGui = true;
     if (get === 'icon')
         return (0, serveFile_1.serveFile)(ctx, node.icon || '|'); // pipe to cause not-found
     if (!(0, vfs_1.nodeIsFolder)(node))