copyparty 1.19.16__py3-none-any.whl → 1.19.18__py3-none-any.whl

copyparty/httpcli.py

@@ -30,7 +30,7 @@ try:
 except:
     pass
 
-from .__init__ import ANYWIN, RES, TYPE_CHECKING, EnvParams, unicode
+from .__init__ import ANYWIN, RES, RESM, TYPE_CHECKING, EnvParams, unicode
 from .__version__ import S_VERSION
 from .authsrv import LEELOO_DALLAS, VFS  # typechk
 from .bos import bos
@@ -161,6 +161,12 @@ RE_MDV = re.compile(r"(.*)\.([0-9]+\.[0-9]{3})(\.[Mm][Dd])$")
 
 UPARAM_CC_OK = set("doc move tree".split())
 
+PERMS_rwh = [
+    [True, False],
+    [False, True],
+    [False, False, False, False, False, False, True],
+]
+
 
 class HttpCli(object):
     """
@@ -224,6 +230,7 @@ class HttpCli(object):
         self.can_delete = False
         self.can_get = False
         self.can_upget = False
+        self.can_html = False
         self.can_admin = False
         self.can_dot = False
         self.out_headerlist   = []
@@ -270,7 +277,7 @@ class HttpCli(object):
         tpl = self.conn.hsrv.j2[name]
         ka["r"] = self.args.SR if self.is_vproxied else ""
         ka["ts"] = self.conn.hsrv.cachebuster()
-        ka["lang"] = self.args.lang
+        ka["lang"] = self.cookies.get("cplng") or self.args.lang
         ka["favico"] = self.args.favico
         ka["s_doctitle"] = self.args.doctitle
         ka["tcolor"] = self.vn.flags["tcolor"]
@@ -732,18 +739,21 @@ class HttpCli(object):
         if "bcasechk" in vn.flags and not vn.casechk(rem, True):
             return self.tx_404() and False
 
-        (
-            self.can_read,
-            self.can_write,
-            self.can_move,
-            self.can_delete,
-            self.can_get,
-            self.can_upget,
-            self.can_admin,
-            self.can_dot,
-        ) = (
-            avn.can_access("", self.uname) if avn else [False] * 8
-        )
+        try:
+            (
+                self.can_read,
+                self.can_write,
+                self.can_move,
+                self.can_delete,
+                self.can_get,
+                self.can_upget,
+                self.can_html,
+                self.can_admin,
+                self.can_dot,
+            ) = avn.uaxs[self.uname]
+        except:
+            pass  # default is all-false
+
         self.avn = avn
         self.vn = vn  # note: do not dbv due to walk/zipgen
         self.rem = rem
@@ -857,6 +867,16 @@ class HttpCli(object):
             return self.conn.iphash.s(self.ip)
 
     def cbonk(self, g , v , reason , descr )  :
+        cond = self.args.dont_ban
+        if (
+            cond == "any"
+            or (cond == "auth" and self.uname != "*")
+            or (cond == "aa" and self.avol)
+            or (cond == "av" and self.can_admin)
+            or (cond == "rw" and self.can_read and self.can_write)
+        ):
+            return False
+
         self.conn.hsrv.nsus += 1
         if not g.lim:
             return False
@@ -881,7 +901,7 @@ class HttpCli(object):
             0,
             self.ip,
             time.time(),
-            reason,
+            [reason, reason],
         ):
             self.log("client banned: %s" % (descr,), 1)
             self.conn.hsrv.bans[ip] = bonk
@@ -1260,6 +1280,20 @@ class HttpCli(object):
                 else:
                     return self.tx_res(res_path)
 
+            if res_path in RESM:
+                ap = self.E.mod_ + RESM[res_path]
+                if (
+                    "txt" not in self.uparam
+                    and "mime" not in self.uparam
+                    and not self.ouparam.get("dl")
+                ):
+                    # return mimetype matching request extension
+                    self.ouparam["dl"] = res_path.split("/")[-1]
+                if bos.path.exists(ap) or bos.path.exists(ap + ".gz"):
+                    return self.tx_file(ap)
+                else:
+                    return self.tx_res(res_path)
+
             self.tx_404()
             return False
 
@@ -1516,6 +1550,64 @@ class HttpCli(object):
         self.log("rss: %d hits, %d bytes" % (len(hits), len(bret)))
         return True
 
+    def tx_zls(self, abspath)  :
+        if self.do_log:
+            self.log("zls %s @%s" % (self.req, self.uname))
+        if self.args.no_zls:
+            raise Pebkac(405, "zip browsing is disabled in server config")
+
+        import zipfile
+
+        try:
+            with zipfile.ZipFile(abspath, "r") as zf:
+                filelist = [{"fn": f.filename} for f in zf.infolist()]
+                ret = json.dumps(filelist).encode("utf-8", "replace")
+                self.reply(ret, mime="application/json")
+                return True
+        except (zipfile.BadZipfile, RuntimeError):
+            raise Pebkac(404, "requested file is not a valid zip file")
+
+    def tx_zget(self, abspath)  :
+        maxsz = 1024 * 1024 * 64
+
+        inner_path = self.uparam.get("zget")
+        if not inner_path:
+            raise Pebkac(405, "inner path is required")
+        if self.do_log:
+            self.log(
+                "zget %s \033[35m%s\033[0m @%s" % (self.req, inner_path, self.uname)
+            )
+        if self.args.no_zls:
+            raise Pebkac(405, "zip browsing is disabled in server config")
+
+        import zipfile
+
+        try:
+            with zipfile.ZipFile(abspath, "r") as zf:
+                zi = zf.getinfo(inner_path)
+                if zi.file_size >= maxsz:
+                    raise Pebkac(404, "zip bomb defused")
+                with zf.open(zi, "r") as fi:
+                    self.send_headers(length=zi.file_size, mime=guess_mime(inner_path))
+
+                    sendfile_py(
+                        self.log,
+                        0,
+                        zi.file_size,
+                        fi,
+                        self.s,
+                        self.args.s_wr_sz,
+                        self.args.s_wr_slp,
+                        not self.args.no_poll,
+                        {},
+                        "",
+                    )
+        except KeyError:
+            raise Pebkac(404, "no such file in archive")
+        except (zipfile.BadZipfile, RuntimeError):
+            raise Pebkac(404, "requested file is not a valid zip file")
+        return True
+
     def handle_propfind(self)  :
         if self.do_log:
             self.log("PFIND %s @%s" % (self.req, self.uname))
@@ -2079,7 +2171,7 @@ class HttpCli(object):
                     t = "urlform_raw %d @ %r\n  %r\n"
                     self.log(t % (len(orig), "/" + self.vpath, orig))
                     try:
-                        zb = unquote(buf.replace(b"+", b" "))
+                        zb = unquote(buf.replace(b"+", b" ").replace(b"&", b"\n"))
                         plain = zb.decode("utf-8", "replace")
                         if buf.startswith(b"msg="):
                             plain = plain[4:]
@@ -2100,7 +2192,7 @@ class HttpCli(object):
                                     len(buf),
                                     self.ip,
                                     time.time(),
-                                    plain,
+                                    [plain, orig],
                                 )
 
                         t = "urlform_dec %d @ %r\n  %r\n"
@@ -2259,7 +2351,7 @@ class HttpCli(object):
                 remains,
                 self.ip,
                 at,
-                "",
+                None,
             )
             t = hr.get("rejectmsg") or ""
             if t or not hr:
@@ -2394,7 +2486,7 @@ class HttpCli(object):
                 post_sz,
                 self.ip,
                 at,
-                "",
+                None,
             )
             t = hr.get("rejectmsg") or ""
             if t or not hr:
@@ -3226,7 +3318,7 @@ class HttpCli(object):
                     0,
                     self.ip,
                     time.time(),
-                    "",
+                    None,
                 )
                 t = hr.get("rejectmsg") or ""
                 if t or not hr:
@@ -3398,7 +3490,7 @@ class HttpCli(object):
                         0,
                         self.ip,
                         at,
-                        "",
+                        None,
                     )
                     t = hr.get("rejectmsg") or ""
                     if t or not hr:
@@ -3505,7 +3597,7 @@ class HttpCli(object):
                             sz,
                             self.ip,
                             at,
-                            "",
+                            None,
                         )
                         t = hr.get("rejectmsg") or ""
                         if t or not hr:
@@ -3816,7 +3908,7 @@ class HttpCli(object):
                 0,
                 self.ip,
                 time.time(),
-                "",
+                None,
             )
             t = hr.get("rejectmsg") or ""
             if t or not hr:
@@ -3864,7 +3956,7 @@ class HttpCli(object):
                 sz,
                 self.ip,
                 new_lastmod,
-                "",
+                None,
             )
             t = hr.get("rejectmsg") or ""
             if t or not hr:
@@ -4093,8 +4185,11 @@ class HttpCli(object):
         # force download
 
         if "dl" in self.ouparam:
-            cdis = gen_content_disposition(os.path.basename(req_path))
-            self.out_headers["Content-Disposition"] = cdis
+            cdis = self.ouparam["dl"] or req_path
+            zs = gen_content_disposition(os.path.basename(cdis))
+            self.out_headers["Content-Disposition"] = zs
+        else:
+            cdis = req_path
 
         #
         # if-modified
@@ -4160,7 +4255,7 @@ class HttpCli(object):
         elif "mime" in self.uparam:
             mime = str(self.uparam.get("mime"))
         else:
-            mime = guess_mime(req_path)
+            mime = guess_mime(cdis)
 
         logmsg += unicode(status) + logtail
 
@@ -4267,8 +4362,11 @@ class HttpCli(object):
         # force download
 
         if "dl" in self.ouparam:
-            cdis = gen_content_disposition(os.path.basename(req_path))
-            self.out_headers["Content-Disposition"] = cdis
+            cdis = self.ouparam["dl"] or req_path
+            zs = gen_content_disposition(os.path.basename(cdis))
+            self.out_headers["Content-Disposition"] = zs
+        else:
+            cdis = req_path
 
         #
         # if-modified
@@ -4396,7 +4494,7 @@ class HttpCli(object):
         elif "rmagic" in self.vn.flags:
             mime = guess_mime(req_path, fs_path)
         else:
-            mime = guess_mime(req_path)
+            mime = guess_mime(cdis)
 
         if "nohtml" in self.vn.flags and "html" in mime:
             mime = "text/plain; charset=utf-8"
@@ -4998,7 +5096,7 @@ class HttpCli(object):
             "edit": "edit" in self.uparam,
             "title": html_escape(self.vpath, crlf=True),
             "lastmod": int(ts_md * 1000),
-            "lang": self.args.lang,
+            "lang": self.cookies.get("cplng") or self.args.lang,
             "favico": self.args.favico,
             "have_emp": int(self.args.emp),
             "md_no_br": int(vn.flags.get("md_no_br") or 0),
@@ -5170,7 +5268,7 @@ class HttpCli(object):
             dls.append((perc, hsent, spd, eta, idle, usr, erd, rds, fn))
 
         if self.args.have_unlistc:
-            allvols = self.asrv.vfs.all_vols
+            allvols = self.asrv.vfs.all_nodes
             rvol = [x for x in rvol if "unlistcr" not in allvols[x[1:-1]].flags]
             wvol = [x for x in wvol if "unlistcw" not in allvols[x[1:-1]].flags]
 
@@ -5383,13 +5481,20 @@ class HttpCli(object):
         return self.redirect("", "?h", x.get(), "return to", False)
 
     def tx_stack(self)  :
-        if not self.avol and not [x for x in self.wvol if x in self.rvol]:
+        zs = self.args.stack_who
+        if zs == "all" or (
+            (zs == "a" and self.avol)
+            or (zs == "rw" and [x for x in self.wvol if x in self.rvol])
+        ):
+            pass
+        else:
             raise Pebkac(403, "'stack' not allowed for user " + self.uname)
 
-        if self.args.no_stack:
-            raise Pebkac(403, "the stackdump feature is disabled in server config")
-
-        ret = "<pre>{}\n{}".format(time.time(), html_escape(alltrace()))
+        ret = html_escape(alltrace(self.args.stack_v))
+        if self.args.stack_v:
+            ret = "<pre>%s\n%s" % (time.time(), ret)
+        else:
+            ret = "<pre>%s" % (ret,)
         self.reply(ret.encode("utf-8"))
         return True
 
@@ -5442,7 +5547,7 @@ class HttpCli(object):
                 rem,
                 self.uname,
                 not self.args.no_scandir,
-                [[True, False], [False, True]],
+                PERMS_rwh,
             )
             dots = self.uname in vn.axs.udot
             dk_sz = vn.flags.get("dk")
@@ -5474,7 +5579,13 @@ class HttpCli(object):
         for x in vfs_virt:
             if x != excl:
                 try:
-                    dvn, drem = vfs.get(vjoin(top, x), self.uname, True, False)
+                    dvn, drem = vfs.get(vjoin(top, x), self.uname, False, False)
+                    if (
+                        self.uname not in dvn.axs.uread
+                        and self.uname not in dvn.axs.uwrite
+                        and self.uname not in dvn.axs.uhtml
+                    ):
+                        raise Exception()
                     bos.stat(dvn.canonical(drem, False))
                 except:
                     x += "\n"
@@ -6399,8 +6510,7 @@ class HttpCli(object):
             return self.tx_svg("upload\nonly")
 
         if not self.can_read and self.can_get and self.avn:
-            axs = self.avn.axs
-            if self.uname not in axs.uhtml:
+            if not self.can_html:
                 pass
             elif is_dir:
                 for fn in ("index.htm", "index.html"):
@@ -6421,6 +6531,7 @@ class HttpCli(object):
 
                     fk_pass = True
                     is_dir = False
+                    add_og = False
                     rem = vjoin(rem, fn)
                     vrem = vjoin(vrem, fn)
                     abspath = ap2
@@ -6456,14 +6567,23 @@ class HttpCli(object):
             ):
                 return self.tx_md(vn, abspath)
 
+            if "zls" in self.uparam:
+                return self.tx_zls(abspath)
+            if "zget" in self.uparam:
+                return self.tx_zget(abspath)
+
             if not add_og or not og_fn:
-                return self.tx_file(
-                    abspath, None if st.st_size or "nopipe" in vn.flags else vn.realpath
-                )
+                if st.st_size or "nopipe" in vn.flags:
+                    return self.tx_file(abspath, None)
+                else:
+                    return self.tx_file(abspath, vn.get_dbv("")[0].realpath)
 
         elif is_dir and not self.can_read:
             if use_dirkey:
                 is_dk = True
+            elif self.can_get and "doc" in self.uparam:
+                zs = vjoin(self.vpath, self.uparam["doc"]) + "?v"
+                return self.redirect(zs, flavor="redirecting to", use302=True)
             elif not self.can_write:
                 return self.tx_404(True)
 
@@ -6545,6 +6665,7 @@ class HttpCli(object):
             "acct": self.uname,
             "perms": perms,
         }
+        # also see `js_htm` in authsrv.py
         j2a = {
             "cgv1": vn.js_htm,
             "cgv": cgv,
@@ -6604,7 +6725,7 @@ class HttpCli(object):
             rem,
             self.uname,
             not self.args.no_scandir,
-            [[True, False], [False, True]],
+            PERMS_rwh,
             lstat="lt" in self.uparam,
             throw=True,
         )

copyparty/httpsrv.py

@@ -378,8 +378,8 @@ class HttpSrv(object):
                 if nloris < nconn / 2:
                     continue
 
-                t = "slowloris (idle-conn): {} banned for {} min"
-                self.log(self.name, t.format(ip, self.args.loris, nclose), 1)
+                t = "slow%s (idle-conn): %s banned for %d min"  # slowloris
+                self.log(self.name, t % ("loris", ip, self.args.loris), 1)
                 self.bans[ip] = int(time.time() + self.args.loris * 60)
 
             if self.args.log_conn:

copyparty/mtag.py

@@ -162,12 +162,12 @@ def au_unpk(
             znil = [x for x in znil if "cover" in x[0]] or znil
             znil = [x for x in znil if CBZ_01.search(x[0])] or znil
             t = "cbz: %d files, %d hits" % (nf, len(znil))
+            if not znil:
+                raise Exception("no images inside cbz")
             using = sorted(znil)[0][1].filename
             if znil:
                 t += ", using " + using
             log(t)
-            if not znil:
-                raise Exception("no images inside cbz")
             fi = zf.open(using)
 
         elif pk == "epub":

copyparty/smbd.py

@@ -259,7 +259,7 @@ class SMB(object):
                     0,
                     "1.7.6.2",
                     time.time(),
-                    "",
+                    None,
                 )
                 t = hr.get("rejectmsg") or ""
                 if t or not hr:

copyparty/svchub.py

@@ -285,6 +285,9 @@ class SvcHub(object):
         ch = "abcdefghijklmnopqrstuvwx"[int(args.theme / 2)]
         args.theme = "{0}{1} {0} {1}".format(ch, bri)
 
+        if args.no_stack:
+            args.stack_who = "no"
+
         if args.nid:
             args.du_who = "no"
         args.du_iwho = n_du_who(args.du_who)

copyparty/tftpd.py

@@ -376,7 +376,7 @@ class Tftpd(object):
                     0,
                     "8.3.8.7",
                     time.time(),
-                    "",
+                    None,
                 )
                 t = hr.get("rejectmsg") or ""
                 if t or not hr:

copyparty/up2k.py

@@ -10,6 +10,7 @@ import re
 import shutil
 import stat
 import subprocess as sp
+import sys
 import tempfile
 import threading
 import time
@@ -27,6 +28,7 @@ from .mtag import MParser, MTag
 from .util import (
     E_FS_CRIT,
     E_FS_MEH,
+    HAVE_FICLONE,
     HAVE_SQLITE3,
     SYMTIME,
     VF_CAREFUL,
@@ -85,6 +87,10 @@ DB_VER = 6
 if TYPE_CHECKING:
     from .svchub import SvcHub
 
+USE_FICLONE = HAVE_FICLONE and sys.version_info < (3, 14)
+if USE_FICLONE:
+    import fcntl
+
 zsg = "avif,avifs,bmp,gif,heic,heics,heif,heifs,ico,j2p,j2k,jp2,jpeg,jpg,jpx,png,tga,tif,tiff,webp"
 ICV_EXTS = set(zsg.split(","))
 
@@ -3282,7 +3288,7 @@ class Up2k(object):
                                 job["size"],
                                 job["addr"],
                                 job["at"],
-                                "",
+                                None,
                             )
                             t = hr.get("rejectmsg") or ""
                             if t or not hr:
@@ -3514,11 +3520,26 @@ class Up2k(object):
 
         linked = False
         try:
-            if "reflink" in flags:
-                raise Exception("reflink")
+            if rm and bos.path.exists(dst):
+                wunlink(self.log, dst, flags)
+
             if not is_mv and not flags.get("dedup"):
                 raise Exception("dedup is disabled in config")
 
+            if "reflink" in flags:
+                if not USE_FICLONE:
+                    raise Exception("reflink")  # python 3.14 or newer; no need
+                try:
+                    with open(fsenc(src), "rb") as fi, open(fsenc(dst), "wb") as fo:
+                        fcntl.ioctl(fo.fileno(), fcntl.FICLONE, fi.fileno())
+                except:
+                    if bos.path.exists(dst):
+                        wunlink(self.log, dst, flags)
+                    raise
+                if lmod:
+                    bos.utime_c(self.log, dst, int(lmod), False)
+                return
+
             lsrc = src
             ldst = dst
             fs1 = bos.stat(os.path.dirname(src)).st_dev
@@ -3545,9 +3566,6 @@ class Up2k(object):
                 lsrc = lsrc.replace("/", "\\")
                 ldst = ldst.replace("/", "\\")
 
-            if rm and bos.path.exists(dst):
-                wunlink(self.log, dst, flags)
-
             try:
                 if "hardlink" in flags:
                     os.link(fsenc(absreal(src)), fsenc(dst))
@@ -3962,7 +3980,7 @@ class Up2k(object):
                 sz,
                 ip,
                 at or time.time(),
-                "",
+                None,
             )
             t = hr.get("rejectmsg") or ""
             if t or not hr:
@@ -4197,7 +4215,7 @@ class Up2k(object):
                         st.st_size,
                         ip,
                         time.time(),
-                        "",
+                        None,
                     ):
                         t = "delete blocked by xbd server config: %r"
                         self.log(t % (abspath,), 1)
@@ -4237,7 +4255,7 @@ class Up2k(object):
                         st.st_size,
                         ip,
                         time.time(),
-                        "",
+                        None,
                     )
 
         if is_dir:
@@ -4365,7 +4383,7 @@ class Up2k(object):
                 fsize,
                 ip,
                 time.time(),
-                "",
+                None,
             ):
                 t = "copy blocked by xbr server config: %r" % (svp,)
                 self.log(t, 1)
@@ -4465,7 +4483,7 @@ class Up2k(object):
                 fsize,
                 ip,
                 time.time(),
-                "",
+                None,
             )
 
         return "k"
@@ -4616,7 +4634,7 @@ class Up2k(object):
                 fsize,
                 ip,
                 time.time(),
-                "",
+                None,
             ):
                 t = "move blocked by xbr server config: %r" % (svp,)
                 self.log(t, 1)
@@ -4656,7 +4674,7 @@ class Up2k(object):
                     fsize,
                     ip,
                     time.time(),
-                    "",
+                    None,
                 )
 
             return "k"
@@ -4667,6 +4685,12 @@ class Up2k(object):
         has_dupes = False
         if w:
             if c2 and c2 != c1:
+                if "nodupem" in dvn.flags:
+                    q = "select w from up where substr(w,1,16) = ?"
+                    for (w2,) in c2.execute(q, (w[:16],)):
+                        if w == w2:
+                            t = "file exists in target volume, and dupes are forbidden in config"
+                            raise Pebkac(400, t)
                 self._copy_tags(c1, c2, w)
 
             xlink = bool(svn.flags.get("xlink"))
@@ -4775,7 +4799,7 @@ class Up2k(object):
                 fsize,
                 ip,
                 time.time(),
-                "",
+                None,
             )
 
         return "k"
@@ -5112,7 +5136,7 @@ class Up2k(object):
                 job["size"],
                 job["addr"],
                 job["t0"],
-                "",
+                None,
             )
             t = hr.get("rejectmsg") or ""
             if t or not hr: