copyparty 1.15.9__py3-none-any.whl → 1.16.0__py3-none-any.whl

copyparty/httpcli.py

@@ -2,7 +2,6 @@
 from __future__ import print_function, unicode_literals
 
 import argparse  # typechk
-import calendar
 import copy
 import errno
 import gzip
@@ -19,7 +18,6 @@ import threading  # typechk
 import time
 import uuid
 from datetime import datetime
-from email.utils import parsedate
 from operator import itemgetter
 
 import jinja2  # typechk
@@ -107,6 +105,7 @@ from .util import (
     unquotep,
     vjoin,
     vol_san,
+    vroots,
     vsplit,
     wrename,
     wunlink,
@@ -123,6 +122,11 @@ _ = (argparse, threading)
 
 NO_CACHE = {"Cache-Control": "no-cache"}
 
+ALL_COOKIES = "k304 no304 js idxh dots cppwd cppws".split()
+
+H_CONN_KEEPALIVE = "Connection: Keep-Alive"
+H_CONN_CLOSE = "Connection: Close"
+
 LOGUES = [[0, ".prologue.html"], [1, ".epilogue.html"]]
 
 READMES = [[0, ["preadme.md", "PREADME.md"]], [1, ["readme.md", "README.md"]]]
@@ -177,6 +181,7 @@ class HttpCli(object):
         self.rem = " "
         self.vpath = " "
         self.vpaths = " "
+        self.dl_id = ""
         self.gctx = " "  # additional context for garda
         self.trailing_slash = True
         self.uname = " "
@@ -628,7 +633,7 @@ class HttpCli(object):
             avn.can_access("", self.uname) if avn else [False] * 8
         )
         self.avn = avn
-        self.vn = vn
+        self.vn = vn  # note: do not dbv due to walk/zipgen
         self.rem = rem
 
         self.s.settimeout(self.args.s_tbody or None)
@@ -717,6 +722,11 @@ class HttpCli(object):
             except Pebkac:
                 return False
 
+        finally:
+            if self.dl_id:
+                self.conn.hsrv.dli.pop(self.dl_id, None)
+                self.conn.hsrv.dls.pop(self.dl_id, None)
+
     def dip(self)  :
         if self.args.plain_ip:
             return self.ip.replace(":", ".")
@@ -787,11 +797,11 @@ class HttpCli(object):
 
     def k304(self)  :
         k304 = self.cookies.get("k304")
-        return (
-            k304 == "y"
-            or (self.args.k304 == 2 and k304 != "n")
-            or ("; Trident/" in self.ua and not k304)
-        )
+        return k304 == "y" or (self.args.k304 == 2 and k304 != "n")
+
+    def no304(self)  :
+        no304 = self.cookies.get("no304")
+        return no304 == "y" or (self.args.no304 == 2 and no304 != "n")
 
     def _build_html_head(self, maybe_html , kv  )  :
         html = str(maybe_html)
@@ -826,25 +836,28 @@ class HttpCli(object):
     )  :
         response = ["%s %s %s" % (self.http_ver, status, HTTPCODE[status])]
 
-        if length is not None:
-            response.append("Content-Length: " + unicode(length))
-
-        if status == 304 and self.k304():
-            self.keepalive = False
-
-        # close if unknown length, otherwise take client's preference
-        response.append("Connection: " + ("Keep-Alive" if self.keepalive else "Close"))
-        response.append("Date: " + formatdate())
-
         # headers{} overrides anything set previously
         if headers:
             self.out_headers.update(headers)
 
-        # default to utf8 html if no content-type is set
-        if not mime:
-            mime = self.out_headers.get("Content-Type") or "text/html; charset=utf-8"
+        if status == 304:
+            self.out_headers.pop("Content-Length", None)
+            self.out_headers.pop("Content-Type", None)
+            self.out_headerlist.clear()
+            if self.k304():
+                self.keepalive = False
+        else:
+            if length is not None:
+                response.append("Content-Length: " + unicode(length))
+
+            if mime:
+                self.out_headers["Content-Type"] = mime
+            elif "Content-Type" not in self.out_headers:
+                self.out_headers["Content-Type"] = "text/html; charset=utf-8"
 
-        self.out_headers["Content-Type"] = mime
+        # close if unknown length, otherwise take client's preference
+        response.append(H_CONN_KEEPALIVE if self.keepalive else H_CONN_CLOSE)
+        response.append("Date: " + formatdate())
 
         for k, zs in list(self.out_headers.items()) + self.out_headerlist:
             response.append("%s: %s" % (k, zs))
@@ -858,6 +871,19 @@ class HttpCli(object):
                 self.cbonk(self.conn.hsrv.gmal, zs, "cc_hdr", "Cc in out-hdr")
                 raise Pebkac(999)
 
+        if self.args.ohead and self.do_log:
+            keys = self.args.ohead
+            if "*" in keys:
+                lines = response[1:]
+            else:
+                lines = []
+                for zs in response[1:]:
+                    if zs.split(":")[0].lower() in keys:
+                        lines.append(zs)
+            for zs in lines:
+                hk, hv = zs.split(": ")
+                self.log("[O] {}: \033[33m[{}]".format(hk, hv), 5)
+
         response.append("\r\n")
         try:
             self.s.sendall("\r\n".join(response).encode("utf-8"))
@@ -937,13 +963,14 @@ class HttpCli(object):
 
         lines = [
             "%s %s %s" % (self.http_ver or "HTTP/1.1", status, HTTPCODE[status]),
-            "Connection: Close",
+            H_CONN_CLOSE,
         ]
 
         if body:
             lines.append("Content-Length: " + unicode(len(body)))
 
-        self.s.sendall("\r\n".join(lines).encode("utf-8") + b"\r\n\r\n" + body)
+        lines.append("\r\n")
+        self.s.sendall("\r\n".join(lines).encode("utf-8") + body)
 
     def urlq(self, add  , rm )  :
         """
@@ -1170,6 +1197,9 @@ class HttpCli(object):
             if "move" in self.uparam:
                 return self.handle_mv()
 
+            if "copy" in self.uparam:
+                return self.handle_cp()
+
         if not self.vpath and self.ouparam:
             if "reload" in self.uparam:
                 return self.handle_reload()
@@ -1177,12 +1207,6 @@ class HttpCli(object):
             if "stack" in self.uparam:
                 return self.tx_stack()
 
-            if "ups" in self.uparam:
-                return self.tx_ups()
-
-            if "k304" in self.uparam:
-                return self.set_k304()
-
             if "setck" in self.uparam:
                 return self.setck()
 
@@ -1195,9 +1219,16 @@ class HttpCli(object):
             if "shares" in self.uparam:
                 return self.tx_shares()
 
+            if "dls" in self.uparam:
+                return self.tx_dls()
+
         if "h" in self.uparam:
             return self.tx_mounts()
 
+        if "ups" in self.uparam:
+            # vpath is used for share translation
+            return self.tx_ups()
+
         if "rss" in self.uparam:
             return self.tx_rss()
 
@@ -1426,6 +1457,7 @@ class HttpCli(object):
                 not self.args.no_scandir,
                 [[True, False]],
                 lstat="davrt" not in vn.flags,
+                throw=True,
             )
             if not self.can_read:
                 vfs_ls = []
@@ -1763,6 +1795,9 @@ class HttpCli(object):
         if "move" in self.uparam:
             return self.handle_mv()
 
+        if "copy" in self.uparam:
+            return self.handle_cp()
+
         if "delete" in self.uparam:
             return self.handle_rm([])
 
@@ -2380,6 +2415,15 @@ class HttpCli(object):
             if "purl" in ret:
                 ret["purl"] = self.args.SR + ret["purl"]
 
+        if self.args.shr and self.vpath.startswith(self.args.shr1):
+            # strip common suffix (uploader's folder structure)
+            vp_req, vp_vfs = vroots(self.vpath, vjoin(dbv.vpath, vrem))
+            if not ret["purl"].startswith(vp_vfs):
+                t = "share-mapping failed; req=[%s] dbv=[%s] vrem=[%s] n1=[%s] n2=[%s] purl=[%s]"
+                zt = (self.vpath, dbv.vpath, vrem, vp_req, vp_vfs, ret["purl"])
+                raise Pebkac(500, t % zt)
+            ret["purl"] = vp_req + ret["purl"][len(vp_vfs) :]
+
         ret = json.dumps(ret)
         self.log(ret)
         self.reply(ret.encode("utf-8"), mime="application/json")
@@ -2472,7 +2516,11 @@ class HttpCli(object):
                 chashes.append(siblings[n : n + clen])
 
         vfs, _ = self.asrv.vfs.get(self.vpath, self.uname, False, True)
-        ptop = (vfs.dbv or vfs).realpath
+        ptop = vfs.get_dbv("")[0].realpath
+        # if this is a share, then get_dbv has been overridden to return
+        # the dbv (which does not exist as a property). And its realpath
+        # could point into the middle of its origin vfs node, meaning it
+        # is not necessarily registered with up2k, so get_dbv is crucial
 
         broker = self.conn.hsrv.broker
         x = broker.ask("up2k.handle_chunks", ptop, wark, chashes)
@@ -3378,25 +3426,29 @@ class HttpCli(object):
         self.reply(response.encode("utf-8"))
         return True
 
-    def _chk_lastmod(self, file_ts )   :
+    def _chk_lastmod(self, file_ts )    :
+        # ret: lastmod, do_send, can_range
         file_lastmod = formatdate(file_ts)
-        cli_lastmod = self.headers.get("if-modified-since")
-        if cli_lastmod:
-            try:
-                # some browser append "; length=573"
-                cli_lastmod = cli_lastmod.split(";")[0].strip()
-                cli_dt = parsedate(cli_lastmod)
-                cli_ts = calendar.timegm(cli_dt)
-                return file_lastmod, int(file_ts) > int(cli_ts)
-            except Exception as ex:
-                self.log(
-                    "lastmod {}\nremote: [{}]\n local: [{}]".format(
-                        repr(ex), cli_lastmod, file_lastmod
-                    )
-                )
-                return file_lastmod, file_lastmod != cli_lastmod
+        c_ifrange = self.headers.get("if-range")
+        c_lastmod = self.headers.get("if-modified-since")
+
+        if not c_ifrange and not c_lastmod:
+            return file_lastmod, True, True
+
+        if c_ifrange and c_ifrange != file_lastmod:
+            t = "sending entire file due to If-Range; cli(%s) file(%s)"
+            self.log(t % (c_ifrange, file_lastmod), 6)
+            return file_lastmod, True, False
+
+        do_send = c_lastmod != file_lastmod
+        if do_send and c_lastmod:
+            t = "sending body due to If-Modified-Since cli(%s) file(%s)"
+            self.log(t % (c_lastmod, file_lastmod), 6)
+        elif not do_send and self.no304():
+            do_send = True
+            self.log("sending body due to no304")
 
-        return file_lastmod, True
+        return file_lastmod, do_send, True
 
     def _use_dirkey(self, vn , ap )  :
         if self.can_read or not self.can_get:
@@ -3546,7 +3598,7 @@ class HttpCli(object):
         # if-modified
 
         if file_ts > 0:
-            file_lastmod, do_send = self._chk_lastmod(int(file_ts))
+            file_lastmod, do_send, _ = self._chk_lastmod(int(file_ts))
             self.out_headers["Last-Modified"] = file_lastmod
             if not do_send:
                 status = 304
@@ -3629,6 +3681,8 @@ class HttpCli(object):
             self.args.s_wr_sz,
             self.args.s_wr_slp,
             not self.args.no_poll,
+            {},
+            "",
         )
         res.close()
 
@@ -3708,7 +3762,7 @@ class HttpCli(object):
         #
         # if-modified
 
-        file_lastmod, do_send = self._chk_lastmod(int(file_ts))
+        file_lastmod, do_send, can_range = self._chk_lastmod(int(file_ts))
         self.out_headers["Last-Modified"] = file_lastmod
         if not do_send:
             status = 304
@@ -3752,7 +3806,14 @@ class HttpCli(object):
 
         # let's not support 206 with compression
         # and multirange / multipart is also not-impl (mostly because calculating contentlength is a pain)
-        if do_send and not is_compressed and hrange and file_sz and "," not in hrange:
+        if (
+            do_send
+            and not is_compressed
+            and hrange
+            and can_range
+            and file_sz
+            and "," not in hrange
+        ):
             try:
                 if not hrange.lower().startswith("bytes"):
                     raise Exception()
@@ -3836,6 +3897,19 @@ class HttpCli(object):
             self.send_headers(length=upper - lower, status=status, mime=mime)
             return True
 
+        dls = self.conn.hsrv.dls
+        if upper - lower > 0x400000:  # 4m
+            now = time.time()
+            self.dl_id = "%s:%s" % (self.ip, self.addr[1])
+            dls[self.dl_id] = (now, 0)
+            self.conn.hsrv.dli[self.dl_id] = (
+                now,
+                upper - lower,
+                self.vn,
+                self.vpath,
+                self.uname,
+            )
+
         if ptop is not None:
             return self.tx_pipe(
                 ptop, req_path, ap_data, job, lower, upper, status, mime, logmsg
@@ -3855,6 +3929,8 @@ class HttpCli(object):
                 self.args.s_wr_sz,
                 self.args.s_wr_slp,
                 not self.args.no_poll,
+                dls,
+                self.dl_id,
             )
 
         if remains > 0:
@@ -4005,6 +4081,8 @@ class HttpCli(object):
                     wr_sz,
                     wr_slp,
                     not self.args.no_poll,
+                    self.conn.hsrv.dls,
+                    self.dl_id,
                 )
 
         spd = self._spd((upper - lower) - remains)
@@ -4090,6 +4168,18 @@ class HttpCli(object):
                 self.log("transcoding to [{}]".format(cfmt))
                 fgen = gfilter(fgen, self.thumbcli, self.uname, vpath, cfmt)
 
+        now = time.time()
+        self.dl_id = "%s:%s" % (self.ip, self.addr[1])
+        self.conn.hsrv.dli[self.dl_id] = (
+            now,
+            0,
+            self.vn,
+            "%s :%s" % (self.vpath, ext),
+            self.uname,
+        )
+        dls = self.conn.hsrv.dls
+        dls[self.dl_id] = (time.time(), 0)
+
         bgen = packer(
             self.log,
             self.asrv,
@@ -4098,6 +4188,7 @@ class HttpCli(object):
             pre_crc="crc" in uarg,
             cmp=uarg if cancmp or uarg == "pax" else "",
         )
+        n = 0
         bsent = 0
         for buf in bgen.gen():
             if not buf:
@@ -4111,6 +4202,11 @@ class HttpCli(object):
                 bgen.stop()
                 break
 
+            n += 1
+            if n >= 4:
+                n = 0
+                dls[self.dl_id] = (time.time(), bsent)
+
         spd = self._spd(bsent)
         self.log("{},  {}".format(logmsg, spd))
         return True
@@ -4223,7 +4319,7 @@ class HttpCli(object):
             sz_md = len(lead) + len(fullfile)
 
         file_ts = int(max(ts_md, self.E.t0))
-        file_lastmod, do_send = self._chk_lastmod(file_ts)
+        file_lastmod, do_send, _ = self._chk_lastmod(file_ts)
         self.out_headers["Last-Modified"] = file_lastmod
         self.out_headers.update(NO_CACHE)
         status = 200 if do_send else 304
@@ -4367,6 +4463,32 @@ class HttpCli(object):
             }
 
 
+        dls = dl_list = []
+        if self.conn.hsrv.tdls:
+            zi = self.args.dl_list
+            if zi == 2 or (zi == 1 and self.avol):
+                dl_list = self.get_dls()
+        for t0, t1, sent, sz, vp, dl_id, uname in dl_list:
+            rem = sz - sent
+            td = max(0.1, now - t0)
+            rd, fn = vsplit(vp)
+            if not rd:
+                rd = "/"
+            erd = quotep(rd)
+            rds = rd.replace("/", " / ")
+            spd = humansize(sent / td, True) + "/s"
+            hsent = humansize(sent, True)
+            idle = s2hms(now - t1, True)
+            usr = "%s @%s" % (dl_id, uname) if dl_id else uname
+            if sz and sent and td:
+                eta = s2hms((sz - sent) / (sent / td), True)
+                perc = int(100 * sent / sz)
+            else:
+                eta = perc = "--"
+
+            fn = html_escape(fn) if fn else self.conn.hsrv.iiam
+            dls.append((perc, hsent, spd, eta, idle, usr, erd, rds, fn))
+
         fmt = self.uparam.get("ls", "")
         if not fmt and (self.ua.startswith("curl/") or self.ua.startswith("fetch")):
             fmt = "v"
@@ -4388,6 +4510,12 @@ class HttpCli(object):
                     txt += "\n%s" % (", ".join((str(x) for x in zt)),)
                 txt += "\n"
 
+            if dls:
+                txt += "\n\nactive downloads:"
+                for zt in dls:
+                    txt += "\n%s" % (", ".join((str(x) for x in zt)),)
+                txt += "\n"
+
             if rvol:
                 txt += "\nyou can browse:"
                 for v in rvol:
@@ -4409,8 +4537,9 @@ class HttpCli(object):
             rvol=rvol,
             wvol=wvol,
             avol=avol,
-            in_shr=self.args.shr and self.vpath.startswith(self.args.shr[1:]),
+            in_shr=self.args.shr and self.vpath.startswith(self.args.shr1),
             vstate=vstate,
+            dls=dls,
             ups=ups,
             scanning=vs["scanning"],
             hashq=vs["hashq"],
@@ -4419,7 +4548,9 @@ class HttpCli(object):
             dbwt=vs["dbwt"],
             url_suf=suf,
             k304=self.k304(),
+            no304=self.no304(),
             k304vis=self.args.k304 > 0,
+            no304vis=self.args.no304 > 0,
             ver=S_VERSION if self.args.ver else "",
             chpw=self.args.chpw and self.uname != "*",
             ahttps="" if self.is_https else "https://" + self.host + self.req,
@@ -4427,29 +4558,21 @@ class HttpCli(object):
         self.reply(html.encode("utf-8"))
         return True
 
-    def set_k304(self)  :
-        v = self.uparam["k304"].lower()
-        if v in "yn":
-            dur = 86400 * 299
-        else:
-            dur = 0
-            v = "x"
-
-        ck = gencookie("k304", v, self.args.R, False, dur)
-        self.out_headerlist.append(("Set-Cookie", ck))
-        self.redirect("", "?h#cc")
-        return True
-
     def setck(self)  :
         k, v = self.uparam["setck"].split("=", 1)
-        t = 0 if v == "" else 86400 * 299
+        t = 0 if v in ("", "x") else 86400 * 299
         ck = gencookie(k, v, self.args.R, False, t)
         self.out_headerlist.append(("Set-Cookie", ck))
-        self.reply(b"o7\n")
+        if "cc" in self.ouparam:
+            self.redirect("", "?h#cc")
+        else:
+            self.reply(b"o7\n")
         return True
 
     def set_cfg_reset(self)  :
-        for k in ("k304", "js", "idxh", "dots", "cppwd", "cppws"):
+        for k in ALL_COOKIES:
+            if k not in self.cookies:
+                continue
             cookie = gencookie(k, "x", self.args.R, False)
             self.out_headerlist.append(("Set-Cookie", cookie))
 
@@ -4479,8 +4602,14 @@ class HttpCli(object):
 
         t = t.format(self.args.SR)
         qv = quotep(self.vpaths) + self.ourlq()
-        in_shr = self.args.shr and self.vpath.startswith(self.args.shr[1:])
-        html = self.j2s("splash", this=self, qvpath=qv, in_shr=in_shr, msg=t)
+        html = self.j2s(
+            "splash",
+            this=self,
+            qvpath=qv,
+            msg=t,
+            in_shr=self.args.shr and self.vpath.startswith(self.args.shr1),
+            ahttps="" if self.is_https else "https://" + self.host + self.req,
+        )
         self.reply(html.encode("utf-8"), status=rc)
         return True
 
@@ -4528,7 +4657,7 @@ class HttpCli(object):
         if self.args.no_reload:
             raise Pebkac(403, "the reload feature is disabled in server config")
 
-        x = self.conn.hsrv.broker.ask("reload")
+        x = self.conn.hsrv.broker.ask("reload", True, True)
         return self.redirect("", "?h", x.get(), "return to", False)
 
     def tx_stack(self)  :
@@ -4631,6 +4760,40 @@ class HttpCli(object):
         ret["a"] = dirs
         return ret
 
+    def get_dls(self)  :
+        ret = []
+        dls = self.conn.hsrv.tdls
+        for dl_id, (t0, sz, vn, vp, uname) in self.conn.hsrv.tdli.items():
+            t1, sent = dls[dl_id]
+            if sent > 0x100000:  # 1m; buffers 2~4
+                sent -= 0x100000
+            if self.uname not in vn.axs.uread:
+                vp = ""
+            elif self.uname not in vn.axs.udot and (vp.startswith(".") or "/." in vp):
+                vp = ""
+            if self.uname not in vn.axs.uadmin:
+                dl_id = uname = ""
+
+            ret.append([t0, t1, sent, sz, vp, dl_id, uname])
+        return ret
+
+    def tx_dls(self)  :
+        ret = [
+            {
+                "t0": x[0],
+                "t1": x[1],
+                "sent": x[2],
+                "size": x[3],
+                "path": x[4],
+                "conn": x[5],
+                "uname": x[6],
+            }
+            for x in self.get_dls()
+        ]
+        zs = json.dumps(ret, separators=(",\n", ": "))
+        self.reply(zs.encode("utf-8", "replace"), mime="application/json")
+        return True
+
     def tx_ups(self)  :
         idx = self.conn.get_u2idx()
         if not idx or not hasattr(idx, "p_end"):
@@ -4642,6 +4805,11 @@ class HttpCli(object):
         lm = "ups [{}]".format(filt)
         self.log(lm)
 
+        if self.args.shr and self.vpath.startswith(self.args.shr1):
+            shr_dbv, shr_vrem = self.vn.get_dbv(self.rem)
+        else:
+            shr_dbv = None
+
         ret   = []
         t0 = time.time()
         lim = time.time() - self.args.unpost
@@ -4662,7 +4830,12 @@ class HttpCli(object):
         else:
             allvols = list(self.asrv.vfs.all_vols.values())
 
-        allvols = [x for x in allvols if "e2d" in x.flags]
+        allvols = [
+            x
+            for x in allvols
+            if "e2d" in x.flags
+            and ("*" in x.axs.uwrite or self.uname in x.axs.uwrite or x == shr_dbv)
+        ]
 
         for vol in allvols:
             cur = idx.get_cur(vol)
@@ -4712,6 +4885,15 @@ class HttpCli(object):
 
         ret = ret[:2000]
 
+        if shr_dbv:
+            # translate vpaths from share-target to share-url
+            # to satisfy access checks
+            vp_shr, vp_vfs = vroots(self.vpath, vjoin(shr_dbv.vpath, shr_vrem))
+            for v in ret:
+                vp = v["vp"]
+                if vp.startswith(vp_vfs):
+                    v["vp"] = vp_shr + vp[len(vp_vfs) :]
+
         if self.is_vproxied:
             for v in ret:
                 v["vp"] = self.args.SR + v["vp"]
@@ -4796,7 +4978,7 @@ class HttpCli(object):
 
         cur.connection.commit()
         if reload:
-            self.conn.hsrv.broker.ask("_reload_blocking", False, False).get()
+            self.conn.hsrv.broker.ask("reload", False, False).get()
             self.conn.hsrv.broker.ask("up2k.wake_rescanner").get()
 
         self.redirect(self.args.SRS + "?shares")
@@ -4841,7 +5023,7 @@ class HttpCli(object):
         if m:
             raise Pebkac(400, "sharekey has illegal character [%s]" % (m[1],))
 
-        if vp.startswith(self.args.shr[1:]):
+        if vp.startswith(self.args.shr1):
             raise Pebkac(400, "yo dawg...")
 
         cur = idx.get_shr()
@@ -4887,7 +5069,7 @@ class HttpCli(object):
             cur.execute(q, (skey, fn))
 
         cur.connection.commit()
-        self.conn.hsrv.broker.ask("_reload_blocking", False, False).get()
+        self.conn.hsrv.broker.ask("reload", False, False).get()
         self.conn.hsrv.broker.ask("up2k.wake_rescanner").get()
 
         fn = quotep(fns[0]) if len(fns) == 1 else ""
@@ -4938,16 +5120,39 @@ class HttpCli(object):
         return self._mv(self.vpath, dst.lstrip("/"))
 
     def _mv(self, vsrc , vdst )  :
-        if not self.can_move:
-            raise Pebkac(403, "not allowed for user " + self.uname)
-
         if self.args.no_mv:
             raise Pebkac(403, "the rename/move feature is disabled in server config")
 
+        self.asrv.vfs.get(vsrc, self.uname, True, False, True)
+        self.asrv.vfs.get(vdst, self.uname, False, True)
+
         x = self.conn.hsrv.broker.ask("up2k.handle_mv", self.uname, self.ip, vsrc, vdst)
         self.loud_reply(x.get(), status=201)
         return True
 
+    def handle_cp(self)  :
+        # full path of new loc (incl filename)
+        dst = self.uparam.get("copy")
+
+        if self.is_vproxied and dst and dst.startswith(self.args.SR):
+            dst = dst[len(self.args.RS) :]
+
+        if not dst:
+            raise Pebkac(400, "need dst vpath")
+
+        return self._cp(self.vpath, dst.lstrip("/"))
+
+    def _cp(self, vsrc , vdst )  :
+        if self.args.no_cp:
+            raise Pebkac(403, "the copy feature is disabled in server config")
+
+        self.asrv.vfs.get(vsrc, self.uname, True, False)
+        self.asrv.vfs.get(vdst, self.uname, False, True)
+
+        x = self.conn.hsrv.broker.ask("up2k.handle_cp", self.uname, self.ip, vsrc, vdst)
+        self.loud_reply(x.get(), status=201)
+        return True
+
     def tx_ls(self, ls  )  :
         dirs = ls["dirs"]
         files = ls["files"]
@@ -5377,6 +5582,7 @@ class HttpCli(object):
             not self.args.no_scandir,
             [[True, False], [False, True]],
             lstat="lt" in self.uparam,
+            throw=True,
         )
         stats = {k: v for k, v in vfs_ls}
         ls_names = [x[0] for x in vfs_ls]