copyparty 1.16.0__tar.gz → 1.16.2__tar.gz

{copyparty-1.16.0 → copyparty-1.16.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: copyparty
-Version: 1.16.0
+Version: 1.16.2
 Summary:   Portable file server with accelerated resumable uploads, deduplication, WebDAV, FTP, zeroconf, media indexer, video thumbnails, audio transcoding, and write-only folders
 Author-email: ed <copyparty@ocv.me>
 License: MIT

{copyparty-1.16.0 → copyparty-1.16.2}/copyparty/__main__.py

@@ -870,8 +870,9 @@ def get_sects():
             use argon2id with timecost 3, 256 MiB, 4 threads, version 19 (0x13/v1.3)
 
             \033[36m--ah-alg scrypt\033[0m  # which is the same as:
-            \033[36m--ah-alg scrypt,13,2,8,4\033[0m
-            use scrypt with cost 2**13, 2 iterations, blocksize 8, 4 threads
+            \033[36m--ah-alg scrypt,13,2,8,4,32\033[0m
+            use scrypt with cost 2**13, 2 iterations, blocksize 8, 4 threads,
+              and allow using up to 32 MiB RAM (ram=cost*blksz roughly)
 
             \033[36m--ah-alg sha2\033[0m  # which is the same as:
             \033[36m--ah-alg sha2,424242\033[0m
@@ -1343,12 +1344,12 @@ def add_thumbnail(ap):
     # https://pillow.readthedocs.io/en/stable/handbook/image-file-formats.html
     # https://github.com/libvips/libvips
     # ffmpeg -hide_banner -demuxers | awk '/^ D  /{print$2}' | while IFS= read -r x; do ffmpeg -hide_banner -h demuxer=$x; done | grep -E '^Demuxer |extensions:'
-    ap2.add_argument("--th-r-pil", metavar="T,T", type=u, default="avif,avifs,blp,bmp,dcx,dds,dib,emf,eps,fits,flc,fli,fpx,gif,heic,heics,heif,heifs,icns,ico,im,j2p,j2k,jp2,jpeg,jpg,jpx,pbm,pcx,pgm,png,pnm,ppm,psd,qoi,sgi,spi,tga,tif,tiff,webp,wmf,xbm,xpm", help="image formats to decode using pillow")
+    ap2.add_argument("--th-r-pil", metavar="T,T", type=u, default="avif,avifs,blp,bmp,cbz,dcx,dds,dib,emf,eps,fits,flc,fli,fpx,gif,heic,heics,heif,heifs,icns,ico,im,j2p,j2k,jp2,jpeg,jpg,jpx,pbm,pcx,pgm,png,pnm,ppm,psd,qoi,sgi,spi,tga,tif,tiff,webp,wmf,xbm,xpm", help="image formats to decode using pillow")
     ap2.add_argument("--th-r-vips", metavar="T,T", type=u, default="avif,exr,fit,fits,fts,gif,hdr,heic,jp2,jpeg,jpg,jpx,jxl,nii,pfm,pgm,png,ppm,svg,tif,tiff,webp", help="image formats to decode using pyvips")
-    ap2.add_argument("--th-r-ffi", metavar="T,T", type=u, default="apng,avif,avifs,bmp,dds,dib,fit,fits,fts,gif,hdr,heic,heics,heif,heifs,icns,ico,jp2,jpeg,jpg,jpx,jxl,pbm,pcx,pfm,pgm,png,pnm,ppm,psd,qoi,sgi,tga,tif,tiff,webp,xbm,xpm", help="image formats to decode using ffmpeg")
+    ap2.add_argument("--th-r-ffi", metavar="T,T", type=u, default="apng,avif,avifs,bmp,cbz,dds,dib,fit,fits,fts,gif,hdr,heic,heics,heif,heifs,icns,ico,jp2,jpeg,jpg,jpx,jxl,pbm,pcx,pfm,pgm,png,pnm,ppm,psd,qoi,sgi,tga,tif,tiff,webp,xbm,xpm", help="image formats to decode using ffmpeg")
     ap2.add_argument("--th-r-ffv", metavar="T,T", type=u, default="3gp,asf,av1,avc,avi,flv,h264,h265,hevc,m4v,mjpeg,mjpg,mkv,mov,mp4,mpeg,mpeg2,mpegts,mpg,mpg2,mts,nut,ogm,ogv,rm,ts,vob,webm,wmv", help="video formats to decode using ffmpeg")
     ap2.add_argument("--th-r-ffa", metavar="T,T", type=u, default="aac,ac3,aif,aiff,alac,alaw,amr,apac,ape,au,bonk,dfpwm,dts,flac,gsm,ilbc,it,itgz,itxz,itz,m4a,mdgz,mdxz,mdz,mo3,mod,mp2,mp3,mpc,mptm,mt2,mulaw,ogg,okt,opus,ra,s3m,s3gz,s3xz,s3z,tak,tta,ulaw,wav,wma,wv,xm,xmgz,xmxz,xmz,xpk", help="audio formats to decode using ffmpeg")
-    ap2.add_argument("--au-unpk", metavar="E=F.C", type=u, default="mdz=mod.zip, mdgz=mod.gz, mdxz=mod.xz, s3z=s3m.zip, s3gz=s3m.gz, s3xz=s3m.xz, xmz=xm.zip, xmgz=xm.gz, xmxz=xm.xz, itz=it.zip, itgz=it.gz, itxz=it.xz", help="audio formats to decompress before passing to ffmpeg")
+    ap2.add_argument("--au-unpk", metavar="E=F.C", type=u, default="mdz=mod.zip, mdgz=mod.gz, mdxz=mod.xz, s3z=s3m.zip, s3gz=s3m.gz, s3xz=s3m.xz, xmz=xm.zip, xmgz=xm.gz, xmxz=xm.xz, itz=it.zip, itgz=it.gz, itxz=it.xz, cbz=jpg.cbz", help="audio/image formats to decompress before passing to ffmpeg")
 
 
 def add_transcoding(ap):
@@ -1448,6 +1449,7 @@ def add_ui(ap, retry):
     ap2.add_argument("--themes", metavar="NUM", type=int, default=8, help="number of themes installed")
     ap2.add_argument("--au-vol", metavar="0-100", type=int, default=50, choices=range(0, 101), help="default audio/video volume percent")
     ap2.add_argument("--sort", metavar="C,C,C", type=u, default="href", help="default sort order, comma-separated column IDs (see header tooltips), prefix with '-' for descending. Examples: \033[32mhref -href ext sz ts tags/Album tags/.tn\033[0m (volflag=sort)")
+    ap2.add_argument("--nsort", action="store_true", help="default-enable natural sort of filenames with leading numbers (volflag=nsort)")
     ap2.add_argument("--unlist", metavar="REGEX", type=u, default="", help="don't show files matching \033[33mREGEX\033[0m in file list. Purely cosmetic! Does not affect API calls, just the browser. Example: [\033[32m\\.(js|css)$\033[0m] (volflag=unlist)")
     ap2.add_argument("--favico", metavar="TXT", type=u, default="c 000 none" if retry else "🎉 000 none", help="\033[33mfavicon-text\033[0m [ \033[33mforeground\033[0m [ \033[33mbackground\033[0m ] ], set blank to disable")
     ap2.add_argument("--mpmc", metavar="URL", type=u, default="", help="change the mediaplayer-toggle mouse cursor; URL to a folder with {2..5}.png inside (or disable with [\033[32m.\033[0m])")

{copyparty-1.16.0 → copyparty-1.16.2}/copyparty/__version__.py

@@ -1,8 +1,8 @@
 # coding: utf-8
 
-VERSION = (1, 16, 0)
+VERSION = (1, 16, 2)
 CODENAME = "COPYparty"
-BUILD_DT = (2024, 11, 10)
+BUILD_DT = (2024, 11, 23)
 
 S_VERSION = ".".join(map(str, VERSION))
 S_BUILD_DT = "{0:04d}-{1:02d}-{2:02d}".format(*BUILD_DT)

{copyparty-1.16.0 → copyparty-1.16.2}/copyparty/authsrv.py

@@ -360,18 +360,21 @@ class VFS(object):
         self.ahtml   = {}
         self.aadmin   = {}
         self.adot   = {}
-        self.all_vols   = {}
+        self.js_ls = {}
+        self.js_htm = ""
 
         if realpath:
             rp = realpath + ("" if realpath.endswith(os.sep) else os.sep)
             vp = vpath + ("/" if vpath else "")
             self.histpath = os.path.join(realpath, ".hist")  # db / thumbcache
             self.all_vols = {vpath: self}  # flattened recursive
+            self.all_nodes = {vpath: self}  # also jumpvols
             self.all_aps = [(rp, self)]
             self.all_vps = [(vp, self)]
         else:
             self.histpath = ""
             self.all_vols = {}
+            self.all_nodes = {}
             self.all_aps = []
             self.all_vps = []
 
@@ -389,9 +392,11 @@ class VFS(object):
     def get_all_vols(
         self,
         vols  ,
+        nodes  ,
         aps  ,
         vps  ,
     )  :
+        nodes[self.vpath] = self
         if self.realpath:
             vols[self.vpath] = self
             rp = self.realpath
@@ -401,7 +406,7 @@ class VFS(object):
             vps.append((vp, self))
 
         for v in self.nodes.values():
-            v.get_all_vols(vols, aps, vps)
+            v.get_all_vols(vols, nodes, aps, vps)
 
     def add(self, src , dst )  :
         """get existing, or add new path to the vfs"""
@@ -1528,10 +1533,11 @@ class AuthSrv(object):
 
         assert vfs  # type: ignore
         vfs.all_vols = {}
+        vfs.all_nodes = {}
         vfs.all_aps = []
         vfs.all_vps = []
-        vfs.get_all_vols(vfs.all_vols, vfs.all_aps, vfs.all_vps)
-        for vol in vfs.all_vols.values():
+        vfs.get_all_vols(vfs.all_vols, vfs.all_nodes, vfs.all_aps, vfs.all_vps)
+        for vol in vfs.all_nodes.values():
             vol.all_aps.sort(key=lambda x: len(x[0]), reverse=True)
             vol.all_vps.sort(key=lambda x: len(x[0]), reverse=True)
             vol.root = vfs
@@ -1582,7 +1588,7 @@ class AuthSrv(object):
 
             vfs.nodes[shr] = vfs.all_vols[shr] = shv
             for vol in shv.nodes.values():
-                vfs.all_vols[vol.vpath] = vol
+                vfs.all_vols[vol.vpath] = vfs.all_nodes[vol.vpath] = vol
                 vol.get_dbv = vol._get_share_src
                 vol.ls = vol._ls_nope
 
@@ -1725,7 +1731,19 @@ class AuthSrv(object):
 
             self.log("\n\n".join(ta) + "\n", c=3)
 
-        vfs.histtab = {zv.realpath: zv.histpath for zv in vfs.all_vols.values()}
+        rhisttab = {}
+        vfs.histtab = {}
+        for zv in vfs.all_vols.values():
+            histp = zv.histpath
+            is_shr = shr and zv.vpath.split("/")[0] == shr
+            if histp and not is_shr and histp in rhisttab:
+                zv2 = rhisttab[histp]
+                t = "invalid config; multiple volumes share the same histpath (database location):\n  histpath: %s\n  volume 1: /%s  [%s]\n  volume 2: %s  [%s]"
+                t = t % (histp, zv2.vpath, zv2.realpath, zv.vpath, zv.realpath)
+                self.log(t, 1)
+                raise Exception(t)
+            rhisttab[histp] = zv
+            vfs.histtab[zv.realpath] = histp
 
         for vol in vfs.all_vols.values():
             lim = Lim(self.log_func)
@@ -1784,12 +1802,12 @@ class AuthSrv(object):
                 vol.lim = lim
 
         if self.args.no_robots:
-            for vol in vfs.all_vols.values():
+            for vol in vfs.all_nodes.values():
                 # volflag "robots" overrides global "norobots", allowing indexing by search engines for this vol
                 if not vol.flags.get("robots"):
                     vol.flags["norobots"] = True
 
-        for vol in vfs.all_vols.values():
+        for vol in vfs.all_nodes.values():
             if self.args.no_vthumb:
                 vol.flags["dvthumb"] = True
             if self.args.no_athumb:
@@ -1801,7 +1819,7 @@ class AuthSrv(object):
                 vol.flags["dithumb"] = True
 
         have_fk = False
-        for vol in vfs.all_vols.values():
+        for vol in vfs.all_nodes.values():
             fk = vol.flags.get("fk")
             fka = vol.flags.get("fka")
             if fka and not fk:
@@ -1833,7 +1851,7 @@ class AuthSrv(object):
             zs = os.path.join(E.cfg, "fk-salt.txt")
             self.log(t % (fk_len, 16, zs), 3)
 
-        for vol in vfs.all_vols.values():
+        for vol in vfs.all_nodes.values():
             if "pk" in vol.flags and "gz" not in vol.flags and "xz" not in vol.flags:
                 vol.flags["gz"] = False  # def.pk
 
@@ -1844,7 +1862,7 @@ class AuthSrv(object):
 
         all_mte = {}
         errors = False
-        for vol in vfs.all_vols.values():
+        for vol in vfs.all_nodes.values():
             if (self.args.e2ds and vol.axs.uwrite) or self.args.e2dsa:
                 vol.flags["e2ds"] = True
 
@@ -2062,7 +2080,7 @@ class AuthSrv(object):
                 errors = True
 
         have_daw = False
-        for vol in vfs.all_vols.values():
+        for vol in vfs.all_nodes.values():
             daw = vol.flags.get("daw") or self.args.daw
             if daw:
                 vol.flags["daw"] = True
@@ -2077,13 +2095,12 @@ class AuthSrv(object):
             self.log("--smb can only be used when --ah-alg is none", 1)
             errors = True
 
-        for vol in vfs.all_vols.values():
+        for vol in vfs.all_nodes.values():
             for k in list(vol.flags.keys()):
                 if re.match("^-[^-]+$", k):
                     vol.flags.pop(k[1:], None)
                     vol.flags.pop(k)
 
-        for vol in vfs.all_vols.values():
             if vol.flags.get("dots"):
                 for name in vol.axs.uread:
                     vol.axs.udot.add(name)
@@ -2225,6 +2242,11 @@ class AuthSrv(object):
                 for x, y in vfs.all_vols.items()
                 if x != shr and not x.startswith(shrs)
             }
+            vfs.all_nodes = {
+                x: y
+                for x, y in vfs.all_nodes.items()
+                if x != shr and not x.startswith(shrs)
+            }
 
             assert db and cur and cur2 and shv  # type: ignore
             for row in cur.execute("select * from sh"):
@@ -2277,6 +2299,68 @@ class AuthSrv(object):
             cur.close()
             db.close()
 
+        self.js_ls = {}
+        self.js_htm = {}
+        for vn in self.vfs.all_nodes.values():
+            vf = vn.flags
+            vn.js_ls = {
+                "idx": "e2d" in vf,
+                "itag": "e2t" in vf,
+                "dnsort": "nsort" in vf,
+                "dsort": vf["sort"],
+                "dcrop": vf["crop"],
+                "dth3x": vf["th3x"],
+                "u2ts": vf["u2ts"],
+                "frand": bool(vf.get("rand")),
+                "lifetime": vf.get("lifetime") or 0,
+                "unlist": vf.get("unlist") or "",
+            }
+            js_htm = {
+                "s_name": self.args.bname,
+                "have_up2k_idx": "e2d" in vf,
+                "have_acode": not self.args.no_acode,
+                "have_shr": self.args.shr,
+                "have_zip": not self.args.no_zip,
+                "have_mv": not self.args.no_mv,
+                "have_del": not self.args.no_del,
+                "have_unpost": int(self.args.unpost),
+                "have_emp": self.args.emp,
+                "sb_md": "" if "no_sb_md" in vf else (vf.get("md_sbf") or "y"),
+                "txt_ext": self.args.textfiles.replace(",", " "),
+                "def_hcols": list(vf.get("mth") or []),
+                "unlist0": vf.get("unlist") or "",
+                "dgrid": "grid" in vf,
+                "dgsel": "gsel" in vf,
+                "dnsort": "nsort" in vf,
+                "dsort": vf["sort"],
+                "dcrop": vf["crop"],
+                "dth3x": vf["th3x"],
+                "dvol": self.args.au_vol,
+                "idxh": int(self.args.ih),
+                "themes": self.args.themes,
+                "turbolvl": self.args.turbo,
+                "u2j": self.args.u2j,
+                "u2sz": self.args.u2sz,
+                "u2ts": vf["u2ts"],
+                "frand": bool(vf.get("rand")),
+                "lifetime": vn.js_ls["lifetime"],
+                "u2sort": self.args.u2sort,
+            }
+            vn.js_htm = json.dumps(js_htm)
+
+        vols = list(vfs.all_nodes.values())
+        if enshare:
+            vols.append(shv)
+            vols.extend(list(shv.nodes.values()))
+
+        for vol in vols:
+            dbv = vol.get_dbv("")[0]
+            vol.js_ls = vol.js_ls or dbv.js_ls or {}
+            vol.js_htm = vol.js_htm or dbv.js_htm or "{}"
+
+            zs = str(vol.flags.get("tcolor") or self.args.tcolor)
+            vol.flags["tcolor"] = zs.lstrip("#")
+
     def load_sessions(self, quiet=False)  :
         # mutex me
         if self.args.no_ses:

{copyparty-1.16.0 → copyparty-1.16.2}/copyparty/cfg.py

@@ -42,6 +42,7 @@ def vf_bmap()   :
         "magic",
         "no_sb_md",
         "no_sb_lg",
+        "nsort",
         "og",
         "og_no_head",
         "og_s_title",

{copyparty-1.16.0 → copyparty-1.16.2}/copyparty/httpcli.py

@@ -243,7 +243,6 @@ class HttpCli(object):
         ka["ts"] = self.conn.hsrv.cachebuster()
         ka["lang"] = self.args.lang
         ka["favico"] = self.args.favico
-        ka["s_name"] = self.args.bname
         ka["s_doctitle"] = self.args.doctitle
         ka["tcolor"] = self.vn.flags["tcolor"]
 
@@ -700,7 +699,7 @@ class HttpCli(object):
 
                 if pex.code != 404 or self.do_log:
                     self.log(
-                        "%s\033[0m, %s" % (msg, self.vpath),
+                        "http%d: %s\033[0m, %s" % (pex.code, msg, self.vpath),
                         6 if em.startswith("client d/c ") else 3,
                     )
 
@@ -1409,12 +1408,13 @@ class HttpCli(object):
         vst = os.stat_result((16877, -1, -1, 1, 1000, 1000, 8, zi, zi, zi))
 
         try:
-            topdir = {"vp": "", "st": bos.stat(tap)}
+            st = bos.stat(tap)
         except OSError as ex:
             if ex.errno not in (errno.ENOENT, errno.ENOTDIR):
                 raise
             raise Pebkac(404)
 
+        topdir = {"vp": "", "st": st}
         fgen   = []
 
         depth = self.headers.get("depth", "infinity").lower()
@@ -1450,6 +1450,12 @@ class HttpCli(object):
                 wrap=False,
             )
 
+        elif depth == "0" or not stat.S_ISDIR(st.st_mode):
+            # propfind on a file; return as topdir
+            if not self.can_read and not self.can_get:
+                self.log("inaccessible: [%s]" % (self.vpath,))
+                raise Pebkac(401, "authenticate")
+
         elif depth == "1":
             _, vfs_ls, vfs_virt = vn.ls(
                 rem,
@@ -1468,9 +1474,6 @@ class HttpCli(object):
             fgen = [{"vp": vp, "st": st} for vp, st in vfs_ls]
             fgen += [{"vp": v, "st": vst} for v in vfs_virt]
 
-        elif depth == "0":
-            pass
-
         else:
             t = "invalid depth value '{}' (must be either '0' or '1'{})"
             t2 = " or 'infinity'" if self.args.dav_inf else ""
@@ -5474,61 +5477,28 @@ class HttpCli(object):
             is_js = False
 
         vf = vn.flags
-        unlist = vf.get("unlist", "")
         ls_ret = {
             "dirs": [],
             "files": [],
             "taglist": [],
             "srvinf": srv_infot,
             "acct": self.uname,
-            "idx": e2d,
-            "itag": e2t,
-            "dsort": vf["sort"],
-            "dcrop": vf["crop"],
-            "dth3x": vf["th3x"],
-            "u2ts": vf["u2ts"],
-            "lifetime": vn.flags.get("lifetime") or 0,
-            "frand": bool(vn.flags.get("rand")),
-            "unlist": unlist,
             "perms": perms,
+            "cfg": vn.js_ls,
         }
         cgv = {
             "ls0": None,
             "acct": self.uname,
             "perms": perms,
-            "u2ts": vf["u2ts"],
-            "lifetime": ls_ret["lifetime"],
-            "frand": bool(vn.flags.get("rand")),
-            "def_hcols": [],
-            "have_emp": self.args.emp,
-            "have_up2k_idx": e2d,
-            "have_acode": (not self.args.no_acode),
-            "have_mv": (not self.args.no_mv),
-            "have_del": (not self.args.no_del),
-            "have_zip": (not self.args.no_zip),
-            "have_shr": self.args.shr,
-            "have_unpost": int(self.args.unpost),
-            "sb_md": "" if "no_sb_md" in vf else (vf.get("md_sbf") or "y"),
-            "dgrid": "grid" in vf,
-            "dgsel": "gsel" in vf,
-            "dsort": vf["sort"],
-            "dcrop": vf["crop"],
-            "dth3x": vf["th3x"],
-            "dvol": self.args.au_vol,
-            "themes": self.args.themes,
-            "turbolvl": self.args.turbo,
-            "u2j": self.args.u2j,
-            "u2sz": self.args.u2sz,
-            "idxh": int(self.args.ih),
-            "u2sort": self.args.u2sort,
         }
         j2a = {
+            "cgv1": vn.js_htm,
             "cgv": cgv,
             "vpnodes": vpnodes,
             "files": [],
             "ls0": None,
             "taglist": [],
-            "have_tags_idx": e2t,
+            "have_tags_idx": int(e2t),
             "have_b_u": (self.can_write and self.uparam.get("b") == "u"),
             "sb_lg": "" if "no_sb_lg" in vf else (vf.get("lg_sbf") or "y"),
             "url_suf": url_suf,
@@ -5899,17 +5869,12 @@ class HttpCli(object):
                 "dirs": dirs,
                 "files": files,
                 "taglist": taglist,
-                "unlist": unlist,
             }
             j2a["files"] = []
         else:
             j2a["files"] = dirs + files
 
         j2a["taglist"] = taglist
-        j2a["txt_ext"] = self.args.textfiles.replace(",", " ")
-
-        if "mth" in vn.flags:
-            j2a["def_hcols"] = list(vn.flags["mth"])
 
         if add_og and "raw" not in self.uparam:
             j2a["this"] = self

{copyparty-1.16.0 → copyparty-1.16.2}/copyparty/httpsrv.py

@@ -132,7 +132,7 @@ class HttpSrv(object):
         dls    = {}  # state
         self.dli = self.tdli = dli
         self.dls = self.tdls = dls
-        self.iiam = '<img src="%s.cpr/iiam.gif" />' % (self.args.SRS,)
+        self.iiam = '<img src="%s.cpr/iiam.gif?cache=i" />' % (self.args.SRS,)
 
         self.bound   = set()
         self.name = "hsrv" + nsuf
@@ -607,7 +607,7 @@ class HttpSrv(object):
         """
         dli       = {}
         for k, (a, b, c, d, e) in sdli.items():
-            vn = self.asrv.vfs.all_vols[c]
+            vn = self.asrv.vfs.all_nodes[c]
             dli[k] = (a, b, vn, d, e)
 
         self.tdli = dli

{copyparty-1.16.0 → copyparty-1.16.2}/copyparty/mtag.py

@@ -4,6 +4,7 @@ from __future__ import print_function, unicode_literals
 import argparse
 import json
 import os
+import re
 import shutil
 import subprocess as sp
 import sys
@@ -56,6 +57,9 @@ def have_ff(scmd )  :
 HAVE_FFMPEG = not os.environ.get("PRTY_NO_FFMPEG") and have_ff("ffmpeg")
 HAVE_FFPROBE = not os.environ.get("PRTY_NO_FFPROBE") and have_ff("ffprobe")
 
+CBZ_PICS = set("png jpg jpeg gif bmp tga tif tiff webp avif".split())
+CBZ_01 = re.compile(r"(^|[^0-9v])0+[01]\b")
+
 
 class MParser(object):
     def __init__(self, cmdline )  :
@@ -120,6 +124,7 @@ def au_unpk(
     log , fmt_map  , abspath , vn  = None
 )  :
     ret = ""
+    maxsz = 1024 * 1024 * 64
     try:
         ext = abspath.split(".")[-1].lower()
         au, pk = fmt_map[ext].split(".")
@@ -142,17 +147,41 @@ def au_unpk(
             zf = zipfile.ZipFile(abspath, "r")
             zil = zf.infolist()
             zil = [x for x in zil if x.filename.lower().split(".")[-1] == au]
+            if not zil:
+                raise Exception("no audio inside zip")
             fi = zf.open(zil[0])
 
+        elif pk == "cbz":
+            import zipfile
+
+            zf = zipfile.ZipFile(abspath, "r")
+            znil = [(x.filename.lower(), x) for x in zf.infolist()]
+            nf = len(znil)
+            znil = [x for x in znil if x[0].split(".")[-1] in CBZ_PICS]
+            znil = [x for x in znil if "cover" in x[0]] or znil
+            znil = [x for x in znil if CBZ_01.search(x[0])] or znil
+            t = "cbz: %d files, %d hits" % (nf, len(znil))
+            if znil:
+                t += ", using " + znil[0][1].filename
+            log(t)
+            if not znil:
+                raise Exception("no images inside cbz")
+            fi = zf.open(znil[0][1])
+
         else:
             raise Exception("unknown compression %s" % (pk,))
 
+        fsz = 0
         with os.fdopen(fd, "wb") as fo:
             while True:
                 buf = fi.read(32768)
                 if not buf:
                     break
 
+                fsz += len(buf)
+                if fsz > maxsz:
+                    raise Exception("zipbomb defused")
+
                 fo.write(buf)
 
         return ret

{copyparty-1.16.0 → copyparty-1.16.2}/copyparty/pwhash.py

@@ -24,17 +24,13 @@ class PWHash(object):
     def __init__(self, args ):
         self.args = args
 
-        try:
-            alg, ac = args.ah_alg.split(",")
-        except:
-            alg = args.ah_alg
-            ac = {}
-
+        zsl = args.ah_alg.split(",")
+        alg = zsl[0]
         if alg == "none":
             alg = ""
 
         self.alg = alg
-        self.ac = ac
+        self.ac = zsl[1:]
         if not alg:
             self.on = False
             self.hash = unicode
@@ -90,17 +86,23 @@ class PWHash(object):
         its = 2
         blksz = 8
         para = 4
+        ramcap = 0  # openssl 1.1 = 32 MiB
         try:
             cost = 2 << int(self.ac[0])
             its = int(self.ac[1])
             blksz = int(self.ac[2])
             para = int(self.ac[3])
+            ramcap = int(self.ac[4]) * 1024 * 1024
         except:
             pass
 
+        cfg = {"salt": self.salt, "n": cost, "r": blksz, "p": para, "dklen": 24}
+        if ramcap:
+            cfg["maxmem"] = ramcap
+
         ret = plain.encode("utf-8")
         for _ in range(its):
-            ret = hashlib.scrypt(ret, salt=self.salt, n=cost, r=blksz, p=para, dklen=24)
+            ret = hashlib.scrypt(ret, **cfg)
 
         return "+" + base64.urlsafe_b64encode(ret).decode("utf-8")
 

copyparty-1.16.2/copyparty/res/COPYING.txt

@@ -0,0 +1,95 @@
+                        --- server-side --- software ---
+
+https://github.com/9001/copyparty/
+Copyright (c) 2019 ed
+License: MIT
+
+https://github.com/pallets/jinja/
+Copyright (c) 2007 Pallets
+License: BSD 3-Clause
+
+https://github.com/pallets/markupsafe/
+Copyright (c) 2010 Pallets
+License: BSD 3-Clause
+
+https://github.com/paulc/dnslib/
+Copyright (c) 2010-2017 Paul Chakravarti
+License: BSD 2-Clause
+
+https://github.com/pydron/ifaddr/
+Copyright (c) 2014 Stefan C. Mueller
+License: BSD-2-Clause
+
+https://github.com/giampaolo/pyftpdlib/
+Copyright (c) 2007 Giampaolo Rodola
+License: MIT
+
+https://github.com/9001/partftpy
+Copyright (c) 2010-2021 Michael P. Soulier
+License: MIT
+
+https://github.com/nayuki/QR-Code-generator/
+Copyright (c) Project Nayuki
+License: MIT
+
+https://github.com/ahupp/python-magic/
+Copyright (c) 2001-2014 Adam Hupp
+License: MIT
+
+                        --- client-side --- software ---
+
+https://github.com/Daninet/hash-wasm/
+Copyright (c) 2020 Dani Biró
+License: MIT
+
+https://github.com/openpgpjs/asmcrypto.js/
+Copyright (c) 2013 Artem S Vybornov
+License: MIT
+
+https://github.com/feimosi/baguetteBox.js/
+Copyright (c) 2017 Marek Grzybek
+License: MIT
+
+https://github.com/markedjs/marked/
+Copyright (c) 2018+, MarkedJS
+Copyright (c) 2011-2018, Christopher Jeffrey (https://github.com/chjj/)
+License: MIT
+
+https://github.com/codemirror/codemirror5/
+Copyright (c) 2017 Marijn Haverbeke <marijnh@gmail.com> and others
+License: MIT
+
+https://github.com/Ionaru/easy-markdown-editor/
+Copyright (c) 2015 Sparksuite, Inc.
+Copyright (c) 2017 Jeroen Akkerman.
+License: MIT
+
+                         --- client-side --- fonts ---
+
+https://github.com/adobe-fonts/source-code-pro/
+Copyright (c) 2010-2019 Adobe
+License: SIL OFL 1.1
+
+https://github.com/FortAwesome/Font-Awesome/
+Copyright (c) 2022 Fonticons, Inc.
+License: SIL OFL 1.1
+
+
+                              --- MIT License ---
+
+
+
+                              --- ISC License ---
+
+
+
+                          --- BSD 2-Clause License ---
+
+
+
+                          --- BSD 3-Clause License ---
+
+
+
+                       --- SIL Open Font License v1.1 ---
+