onionshare_cli 2.6.1__tar.gz → 2.6.3__tar.gz

{onionshare_cli-2.6.1 → onionshare_cli-2.6.3}/PKG-INFO

@@ -1,11 +1,11 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.3
 Name: onionshare_cli
-Version: 2.6.1
+Version: 2.6.3
 Summary: OnionShare lets you securely and anonymously send and receive files. It works by starting a web server, making it accessible as a Tor onion service, and generating an unguessable web address so others can download files from you, or upload files to you. It does _not_ require setting up a separate server or using a third party file-sharing service.
 License: GPLv3+
 Author: Micah Lee
 Author-email: micah@micahflee.com
-Requires-Python: >=3.8,<3.12
+Requires-Python: >=3.10,<3.13
 Classifier: Environment :: Web Environment
 Classifier: Framework :: Flask
 Classifier: Intended Audience :: End Users/Desktop
@@ -13,10 +13,9 @@ Classifier: License :: OSI Approved :: GNU General Public License v3 or later (G
 Classifier: License :: Other/Proprietary License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.8
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Communications :: File Sharing
 Classifier: Topic :: Security :: Cryptography
 Requires-Dist: cffi (>=1.15.1,<2.0.0)
@@ -29,16 +28,16 @@ Requires-Dist: flask-compress (>=1.13,<2.0)
 Requires-Dist: flask-socketio (==5.3.4)
 Requires-Dist: gevent (>=23.9.1,<24.0.0)
 Requires-Dist: gevent-websocket
-Requires-Dist: packaging (>=23.1,<24.0)
+Requires-Dist: packaging (>=24)
 Requires-Dist: psutil
 Requires-Dist: pynacl
 Requires-Dist: pysocks
 Requires-Dist: qrcode (>=7.4.2,<8.0.0)
 Requires-Dist: requests[socks]
-Requires-Dist: setuptools
+Requires-Dist: setuptools (>=70.0.0)
 Requires-Dist: stem (==1.8.1)
 Requires-Dist: unidecode
-Requires-Dist: urllib3
-Requires-Dist: waitress (>=2.1.2,<3.0.0)
-Requires-Dist: werkzeug (>=2.3.4)
+Requires-Dist: urllib3 (>=2.2.2,<3.0.0)
+Requires-Dist: waitress (>=3.0.1,<4.0.0)
+Requires-Dist: werkzeug (==3.0.6)
 Requires-Dist: wheel (>=0.41.2,<0.42.0)

{onionshare_cli-2.6.1 → onionshare_cli-2.6.3}/onionshare_cli/__init__.py

@@ -119,6 +119,13 @@ def main(cwd=None):
         default=False,
         help="Share files: Continue sharing after files have been sent (default is to stop sharing)",
     )
+    parser.add_argument(
+        "--log-filenames",
+        action="store_true",
+        dest="log_filenames",
+        default=False,
+        help="Log file download activity to stdout"
+    )
     parser.add_argument(
         "--qr",
         action="store_true",
@@ -204,6 +211,7 @@ def main(cwd=None):
     disable_files = args.disable_files
     disable_csp = bool(args.disable_csp)
     custom_csp = args.custom_csp
+    log_filenames = bool(args.log_filenames)
     verbose = bool(args.verbose)
 
     # Verbose mode?
@@ -242,6 +250,7 @@ def main(cwd=None):
             mode_settings.set("persistent", "mode", mode)
         if mode == "share":
             mode_settings.set("share", "autostop_sharing", autostop_sharing)
+            mode_settings.set("share", "log_filenames", log_filenames)
         if mode == "receive":
             if data_dir:
                 mode_settings.set("receive", "data_dir", data_dir)
@@ -259,6 +268,7 @@ def main(cwd=None):
             if custom_csp:
                 mode_settings.set("website", "custom_csp", custom_csp)
                 mode_settings.set("website", "disable_csp", False)
+            mode_settings.set("website", "log_filenames", log_filenames)
     else:
         # See what the persistent mode was
         mode = mode_settings.get("persistent", "mode")
@@ -505,7 +515,7 @@ def main(cwd=None):
                 if not app.autostop_timer_thread.is_alive():
                     if mode == "share":
                         # If there were no attempts to download the share, or all downloads are done, we can stop
-                        if web.share_mode.cur_history_id == 0 or web.done:
+                        if not web.share_mode.download_in_progress or web.share_mode.cur_history_id == 0 or web.done:
                             print("Stopped because auto-stop timer ran out")
                             web.stop(app.port)
                             break
@@ -531,6 +541,7 @@ def main(cwd=None):
     finally:
         # Shutdown
         web.cleanup()
+        t.join()
         onion.cleanup()
 
 

{onionshare_cli-2.6.1 → onionshare_cli-2.6.3}/onionshare_cli/censorship.py

@@ -238,21 +238,23 @@ class CensorshipCircumvention(object):
         bridges_ok = False
         self.settings = settings
 
-        # @TODO there might be several bridge types recommended.
-        # Should we attempt to iterate over each type if one of them fails to connect?
-        # But if so, how to stop it starting 3 separate Tor connection threads?
-        # for bridges in request_bridges["settings"]:
-        bridges = bridge_settings["settings"][0]["bridges"]
-        bridge_strings = bridges["bridge_strings"]
-
-        self.settings.set("bridges_type", "custom")
-
-        # Sanity check the bridges provided from the Tor API before saving
-        bridges_checked = self.common.check_bridges_valid(bridge_strings)
-
-        if bridges_checked:
-            self.settings.set("bridges_custom", "\n".join(bridges_checked))
-            bridges_ok = True
+        # We iterate over each group of bridges returned in settings.
+        # The first set of valid bridges are the ones we use.
+        if bridge_settings.get("settings", False):
+            for returned_bridge_settings in bridge_settings["settings"]:
+                if returned_bridge_settings.get("bridges", False):
+                    bridges = returned_bridge_settings["bridges"]
+                    bridge_strings = bridges["bridge_strings"]
+
+                    self.settings.set("bridges_type", "custom")
+
+                    # Sanity check the bridges provided from the Tor API before saving
+                    bridges_checked = self.common.check_bridges_valid(bridge_strings)
+
+                    if bridges_checked:
+                        self.settings.set("bridges_custom", "\n".join(bridges_checked))
+                        bridges_ok = True
+                        break
 
         # If we got any good bridges, save them to settings and return.
         if bridges_ok:

{onionshare_cli-2.6.1 → onionshare_cli-2.6.3}/onionshare_cli/common.py

@@ -19,6 +19,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 """
 import base64
 import hashlib
+import importlib.resources as importlib_resources
 import os
 import platform
 import random
@@ -29,7 +30,6 @@ import threading
 import time
 import shutil
 import re
-from pkg_resources import resource_filename
 
 import colorama
 from colorama import Fore, Back, Style
@@ -313,9 +313,10 @@ class Common:
         """
         Returns the absolute path of a resource
         """
-        path = resource_filename("onionshare_cli", os.path.join("resources", filename))
-        self.log("Common", "get_resource_path", f"filename={filename}, path={path}")
-        return path
+        ref = importlib_resources.files("onionshare_cli.resources") / filename
+        with importlib_resources.as_file(ref) as path:
+            self.log("Common", "get_resource_path", f"filename={filename}, path={str(path)}")
+            return str(path)
 
     def get_tor_paths(self):
         if self.platform == "Linux":
@@ -484,16 +485,16 @@ class Common:
             if bridge != "":
                 # Check the syntax of the custom bridge to make sure it looks legitimate
                 ipv4_pattern = re.compile(
-                    "(obfs4\s+)?(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):([0-9]+)(\s+)([A-Z0-9]+)(.+)$"
+                    r"(obfs4\s+)?(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]):([0-9]+)(\s+)([A-Z0-9]+)(.+)$"
                 )
                 ipv6_pattern = re.compile(
-                    "(obfs4\s+)?\[(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\]:[0-9]+\s+[A-Z0-9]+(.+)$"
+                    r"(obfs4\s+)?\[(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\]:[0-9]+\s+[A-Z0-9]+(.+)$"
                 )
                 meek_lite_pattern = re.compile(
-                    "(meek_lite)(\s)+([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+)(\s)+([0-9A-Z]+)(\s)+url=(.+)(\s)+front=(.+)"
+                    r"(meek_lite)(\s)+([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+)(\s)+([0-9A-Z]+)(\s)+url=(.+)(\s)+front=(.+)"
                 )
                 snowflake_pattern = re.compile(
-                    "(snowflake)(\s)+([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+)(\s)+([0-9A-Z]+)"
+                    r"(snowflake)(\s)+([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+)(\s)+([0-9A-Z]+)"
                 )
                 if (
                     ipv4_pattern.match(bridge)

{onionshare_cli-2.6.1 → onionshare_cli-2.6.3}/onionshare_cli/meek.py

@@ -51,8 +51,8 @@ class Meek(object):
         ) = get_tor_paths()
 
         self.meek_proxies = {}
-        self.meek_url = "https://moat.torproject.org.global.prod.fastly.net/"
-        self.meek_front = "cdn.sstatic.net"
+        self.meek_url = "https://1723079976.rsc.cdn77.org/"
+        self.meek_front = "www.phpmyadmin.net"
         self.meek_env = {
             "TOR_PT_MANAGED_TRANSPORT_VER": "1",
             "TOR_PT_CLIENT_TRANSPORTS": "meek",

{onionshare_cli-2.6.1 → onionshare_cli-2.6.3}/onionshare_cli/mode_settings.py

@@ -40,7 +40,11 @@ class ModeSettings:
                 "client_auth_priv_key": None,
                 "client_auth_pub_key": None,
             },
-            "persistent": {"mode": None, "enabled": False},
+            "persistent": {
+                "mode": None,
+                "enabled": False,
+                "autostart_on_launch": False
+            },
             "general": {
                 "title": None,
                 "public": False,
@@ -48,14 +52,23 @@ class ModeSettings:
                 "autostop_timer": False,
                 "service_id": None,
             },
-            "share": {"autostop_sharing": True, "filenames": []},
+            "share": {
+                "autostop_sharing": True,
+                "filenames": [],
+                "log_filenames": False,
+            },
             "receive": {
                 "data_dir": self.build_default_receive_data_dir(),
                 "webhook_url": None,
                 "disable_text": False,
                 "disable_files": False,
             },
-            "website": {"disable_csp": False, "custom_csp": None, "filenames": []},
+            "website": {
+                "disable_csp": False,
+                "custom_csp": None,
+                "log_filenames": False,
+                "filenames": []
+            },
             "chat": {},
         }
         self._settings = {}

{onionshare_cli-2.6.1 → onionshare_cli-2.6.3}/onionshare_cli/onion.py

@@ -27,13 +27,14 @@ import base64
 import nacl.public
 import os
 import psutil
+import re
 import shlex
 import subprocess
 import tempfile
 import time
 import traceback
 
-from distutils.version import LooseVersion as Version
+from packaging.version import Version
 
 
 class TorErrorAutomatic(Exception):
@@ -658,7 +659,8 @@ class Onion(object):
         # Does this version of Tor support next-gen ('v3') onions?
         # Note, this is the version of Tor where this bug was fixed:
         # https://trac.torproject.org/projects/tor/ticket/28619
-        self.supports_v3_onions = self.tor_version >= Version("0.3.5.7")
+        cleaned_tor_version = re.sub(r"\s*\(.*\)", "", self.tor_version)
+        self.supports_v3_onions = Version(cleaned_tor_version) >= Version("0.3.5.7")
 
         # Now that we are connected to Tor, if we are using built-in bridges,
         # update them with the latest copy available from the Tor API

{onionshare_cli-2.6.1 → onionshare_cli-2.6.3}/onionshare_cli/resources/templates/receive.html

@@ -53,7 +53,7 @@
       <p><input type="file" id="file-select" name="file[]" multiple /></p>
       {% endif %}
       {% if not disable_text %}
-      <p><textarea id="text" name="text" placeholder="Write a message"></textarea></p>
+      <p><textarea id="text" name="text" placeholder="Write a message (max length 524288 characters)" maxlength="524288"></textarea></p>
       {% endif %}
       <p><button type="submit" id="send-button" class="button">Submit</button></p>
     </form>

onionshare_cli-2.6.3/onionshare_cli/resources/torrc_template-meek_lite_azure

@@ -0,0 +1,2 @@
+# Enable built-in meek-azure bridge
+Bridge meek_lite 192.0.2.20:80 url=https://1314488750.rsc.cdn77.org front=www.phpmyadmin.net utls=HelloRandomizedALPN

onionshare_cli-2.6.3/onionshare_cli/resources/torrc_template-snowflake

@@ -0,0 +1,3 @@
+# Enable built-in snowflake bridge
+Bridge snowflake 192.0.2.3:80 2B280B23E1107BB62ABFC40DDCC8824814F80A72 fingerprint=2B280B23E1107BB62ABFC40DDCC8824814F80A72 url=https://1098762253.rsc.cdn77.org/ fronts=www.cdn77.com,www.phpmyadmin.net ice=stun:stun.antisip.com:3478,stun:stun.epygi.com:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.mixvoip.com:3478,stun:stun.nextcloud.com:3478,stun:stun.bethesda.net:3478,stun:stun.nextcloud.com:443 utls-imitate=hellorandomizedalpn
+Bridge snowflake 192.0.2.4:80 8838024498816A039FCBBAB14E6F40A0843051FA fingerprint=8838024498816A039FCBBAB14E6F40A0843051FA url=https://1098762253.rsc.cdn77.org/ fronts=www.cdn77.com,www.phpmyadmin.net ice=stun:stun.antisip.com:3478,stun:stun.epygi.com:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.mixvoip.com:3478,stun:stun.nextcloud.com:3478,stun:stun.bethesda.net:3478,stun:stun.nextcloud.com:443 utls-imitate=hellorandomizedalpn

onionshare_cli-2.6.3/onionshare_cli/resources/version.txt

@@ -0,0 +1 @@
+2.6.3

{onionshare_cli-2.6.1 → onionshare_cli-2.6.3}/onionshare_cli/settings.py

@@ -66,7 +66,7 @@ class Settings(object):
             "zh_Hans": "中文 (简体)",  # Simplified Chinese
             "hr": "Hrvatski",  # Croatian
             "cs": "čeština",  # Czech
-            # "da": "Dansk",  # Danish
+            "da": "Dansk",  # Danish
             # "nl": "Nederlands",  # Dutch
             "en": "English",  # English
             "fi": "Suomi",  # Finnish
@@ -76,7 +76,7 @@ class Settings(object):
             "el": "Ελληνικά",  # Greek
             "is": "Íslenska",  # Icelandic
             # "id": "Bahasa Indonesia",  # Indonesian
-            # "ga": "Gaeilge",  # Irish
+            "ga": "Gaeilge",  # Irish
             "it": "Italiano",  # Italian
             "ja": "日本語",  # Japanese
             "km": "ខ្មែរ",  # Khmer(Central)
@@ -91,10 +91,11 @@ class Settings(object):
             "ru": "Русский",  # Russian
             "sn": "chiShona",  # Shona
             # "sr_Latn": "Srpska (latinica)",  # Serbian (latin)
-            # "sk": "Slovenčina",  # Slovak
+            "sk": "Slovenčina",  # Slovak
             "es": "Español",  # Spanish
             "sw": "Kiswahili",  # Swahili
             "sv": "Svenska",  # Swedish
+            "ta": "Tamil",    # Tamil
             # "te": "తెలుగు",  # Telugu
             "tr": "Türkçe",  # Turkish
             "uk": "Українська",  # Ukrainian

{onionshare_cli-2.6.1 → onionshare_cli-2.6.3}/onionshare_cli/web/chat_mode.py

@@ -17,6 +17,7 @@ GNU General Public License for more details.
 You should have received a copy of the GNU General Public License
 along with this program.  If not, see <http://www.gnu.org/licenses/>.
 """
+import unicodedata
 
 from flask import request, render_template, make_response, jsonify, session
 from flask_socketio import emit, ConnectionRefusedError
@@ -47,15 +48,45 @@ class ChatModeWeb:
 
         self.define_routes()
 
-    def validate_username(self, username):
-        username = username.strip()
-        return (
-            username
-            and username.isascii()
-            and username not in self.connected_users
-            and len(username) < 128
+    def remove_unallowed_characters(self, text):
+        """
+        Sanitize username to remove unwanted characters.
+        Allowed characters right now are:
+            - all ASCII numbers
+            - all ASCII letters
+            - dash, underscore and single space
+        """
+
+        def allowed_character(ch):
+            allowed_unicode_categories = [
+                'L',    # All letters
+                'N',    # All numbers
+            ]
+            allowed_special_characters = [
+                '-',    # dash
+                '_',    # underscore
+                ' ',    # single space
+            ]
+            return (
+                unicodedata.category(ch)[0] in allowed_unicode_categories and ord(ch) < 128
+             ) or ch in allowed_special_characters
+
+        return "".join(
+            ch for ch in text if allowed_character(ch)
         )
 
+    def validate_username(self, username):
+        try:
+            username = self.remove_unallowed_characters(username.strip())
+            return (
+                username
+                and username not in self.connected_users
+                and len(username) < 128
+            )
+        except Exception as e:
+            self.common.log("ChatModeWeb", "validate_username", e)
+            return False
+
     def define_routes(self):
         """
         The web app routes for chatting
@@ -77,13 +108,17 @@ class ChatModeWeb:
 
             self.web.add_request(self.web.REQUEST_LOAD, request.path)
             return render_template(
-                    "chat.html",
-                    static_url_path=self.web.static_url_path,
-                    username=session.get("name"),
-                    title=self.web.settings.get("general", "title"),
+                "chat.html",
+                static_url_path=self.web.static_url_path,
+                username=session.get("name"),
+                title=self.web.settings.get("general", "title"),
             )
 
-        @self.web.app.route("/update-session-username", methods=["POST"], provide_automatic_options=False)
+        @self.web.app.route(
+            "/update-session-username",
+            methods=["POST"],
+            provide_automatic_options=False,
+        )
         def update_session_username():
             history_id = self.cur_history_id
             data = request.get_json()
@@ -122,6 +157,8 @@ class ChatModeWeb:
             A status message is broadcast to all people in the room."""
             if self.validate_username(session.get("name")):
                 self.connected_users.append(session.get("name"))
+                # Store the session id for the user
+                session["socketio_session_id"] = request.sid
                 emit(
                     "status",
                     {
@@ -133,7 +170,7 @@ class ChatModeWeb:
                     broadcast=True,
                 )
             else:
-                raise ConnectionRefusedError('You are active from another session!')
+                raise ConnectionRefusedError('Invalid session')
 
         @self.web.socketio.on("text", namespace="/chat")
         def text(message):
@@ -153,9 +190,9 @@ class ChatModeWeb:
             new_name = message.get("username", "").strip()
             if self.validate_username(new_name):
                 session["name"] = new_name
-                self.connected_users[
-                    self.connected_users.index(current_name)
-                ] = session.get("name")
+                self.connected_users[self.connected_users.index(current_name)] = (
+                    session.get("name")
+                )
                 emit(
                     "status",
                     {
@@ -178,13 +215,23 @@ class ChatModeWeb:
         def disconnect():
             """Sent by clients when they disconnect.
             A status message is broadcast to all people in the server."""
+            user_already_disconnected = False
             if session.get("name") in self.connected_users:
                 self.connected_users.remove(session.get("name"))
-            emit(
-                "status",
-                {
-                    "msg": "{} has left the room.".format(session.get("name")),
-                    "connected_users": self.connected_users,
-                },
-                broadcast=True,
+            else:
+                user_already_disconnected = True
+
+            # Forcefully disconnect the user
+            self.web.socketio.server.disconnect(
+                sid=session.get("socketio_session_id"), namespace="/chat"
             )
+
+            if not user_already_disconnected:
+                emit(
+                    "status",
+                    {
+                        "msg": "{} has left the room.".format(session.get("name")),
+                        "connected_users": self.connected_users,
+                    },
+                    broadcast=True,
+                )

{onionshare_cli-2.6.1 → onionshare_cli-2.6.3}/onionshare_cli/web/receive_mode.py

@@ -194,7 +194,10 @@ class ReceiveModeWeb:
                 if files_received > 0:
                     msg = f"Uploaded {files_msg}"
                 else:
-                    msg = "Nothing submitted"
+                   if not self.web.settings.get("receive", "disable_text"):
+                       msg = "Nothing submitted or message was too long (> 524288 characters)"
+                   else:
+                       msg = "Nothing submitted"
 
             if ajax:
                 info_flashes.append(msg)
@@ -462,7 +465,7 @@ class ReceiveModeRequest(Request):
                 self.includes_message = False
                 if not self.web.settings.get("receive", "disable_text"):
                     text_message = self.form.get("text")
-                    if text_message:
+                    if text_message and len(text_message) <= 524288:
                         if text_message.strip() != "":
                             self.includes_message = True
 

{onionshare_cli-2.6.1 → onionshare_cli-2.6.3}/onionshare_cli/web/send_base_mode.py

@@ -25,7 +25,7 @@ import mimetypes
 import gzip
 from flask import Response, request
 from unidecode import unidecode
-from urllib.parse import quote
+from urllib.parse import quote, unquote
 
 
 class SendBaseModeWeb:
@@ -132,6 +132,9 @@ class SendBaseModeWeb:
         self.set_file_info_custom(filenames, processed_size_callback)
 
     def directory_listing(self, filenames, path="", filesystem_path=None, add_trailing_slash=False):
+        """
+        Display the front page of a share or index.html-less website, listing the files/directories.
+        """
         # Tell the GUI about the directory listing
         history_id = self.cur_history_id
         self.cur_history_id += 1
@@ -151,6 +154,11 @@ class SendBaseModeWeb:
 
         # If filesystem_path is None, this is the root directory listing
         files, dirs = self.build_directory_listing(path, filenames, filesystem_path, add_trailing_slash)
+
+        # Mark the request as done so we know we can close the share if in auto-stop mode.
+        self.web.done = True
+
+        # Render and return the response.
         return self.directory_listing_template(
             path, files, dirs, breadcrumbs, breadcrumbs_leaf
         )
@@ -170,18 +178,18 @@ class SendBaseModeWeb:
             if is_dir:
                 if add_trailing_slash:
                     dirs.append(
-                        {"link": os.path.join(f"/{path}", filename, ""), "basename": filename}
+                        {"link": os.path.join(f"/{path}", quote(filename), ""), "basename": filename}
                     )
                 else:
                     dirs.append(
-                        {"link": os.path.join(f"/{path}", filename), "basename": filename}
+                        {"link": os.path.join(f"/{path}", quote(filename)), "basename": filename}
                     )
             else:
                 size = os.path.getsize(this_filesystem_path)
                 size_human = self.common.human_readable_filesize(size)
                 files.append(
                     {
-                        "link": os.path.join(f"/{path}", filename),
+                        "link": os.path.join(f"/{path}", quote(filename)),
                         "basename": filename,
                         "size_human": size_human,
                     }
@@ -228,11 +236,11 @@ class SendBaseModeWeb:
             chunk_size = 102400  # 100kb
 
             fp = open(file_to_download, "rb")
-            done = False
-            while not done:
+            self.web.done = False
+            while not self.web.done:
                 chunk = fp.read(chunk_size)
                 if chunk == b"":
-                    done = True
+                    self.web.done = True
                 else:
                     try:
                         yield chunk
@@ -245,8 +253,17 @@ class SendBaseModeWeb:
                             or self.common.platform == "Linux"
                             or self.common.platform == "BSD"
                         ):
+                            if self.web.settings.get(self.web.mode, "log_filenames"):
+                                # Decode and sanitize the path to remove newlines
+                                decoded_path = unquote(path)
+                                decoded_path = decoded_path.replace("\r", "").replace("\n", "")
+                                filename_str = f"{decoded_path} - "
+                            else:
+                                filename_str = ""
+                            
                             sys.stdout.write(
-                                "\r{0:s}, {1:.2f}%          ".format(
+                                "\r{0}{1:s}, {2:.2f}%          ".format(
+                                    filename_str,
                                     self.common.human_readable_filesize(
                                         downloaded_bytes
                                     ),
@@ -264,10 +281,10 @@ class SendBaseModeWeb:
                                 "filesize": filesize,
                             },
                         )
-                        done = False
+                        self.web.done = False
                     except Exception:
                         # Looks like the download was canceled
-                        done = True
+                        self.web.done = True
 
                         # Tell the GUI the individual file was canceled
                         self.web.add_request(
@@ -278,8 +295,7 @@ class SendBaseModeWeb:
 
             fp.close()
 
-            if self.common.platform != "Darwin":
-                sys.stdout.write("\n")
+            sys.stdout.write("\n")
 
         basename = os.path.basename(filesystem_path)
 

{onionshare_cli-2.6.1 → onionshare_cli-2.6.3}/onionshare_cli/web/share_mode.py

@@ -29,7 +29,7 @@ from datetime import datetime, timezone
 from flask import Response, request, render_template, make_response, abort
 from unidecode import unidecode
 from werkzeug.http import parse_date, http_date
-from urllib.parse import quote
+from urllib.parse import quote, unquote
 
 from .send_base_mode import SendBaseModeWeb
 
@@ -346,8 +346,17 @@ class ShareModeWeb(SendBaseModeWeb):
                         or self.common.platform == "Linux"
                         or self.common.platform == "BSD"
                     ):
+                        if self.web.settings.get("share", "log_filenames"):
+                            # Decode and sanitize the path to remove newlines
+                            decoded_path = unquote(path)
+                            decoded_path = decoded_path.replace("\r", "").replace("\n", "")
+                            filename_str = f"{decoded_path} - "
+                        else:
+                            filename_str = ""
+
                         sys.stdout.write(
-                            "\r{0:s}, {1:.2f}%          ".format(
+                            "\r{0}{1:s}, {2:.2f}%          ".format(
+                                filename_str,
                                 self.common.human_readable_filesize(downloaded_bytes),
                                 percent,
                             )
@@ -376,8 +385,7 @@ class ShareModeWeb(SendBaseModeWeb):
 
         fp.close()
 
-        if self.common.platform != "Darwin":
-            sys.stdout.write("\n")
+        sys.stdout.write("\n")
 
         # Download is finished
         if self.web.settings.get("share", "autostop_sharing"):

{onionshare_cli-2.6.1 → onionshare_cli-2.6.3}/onionshare_cli/web/web.py

@@ -176,11 +176,17 @@ class Web:
             self.website_mode = WebsiteModeWeb(self.common, self)
         elif self.mode == "chat":
             if self.common.verbose:
-                self.socketio = SocketIO(
-                    async_mode="gevent", logger=True, engineio_logger=True
-                )
+                try:
+                    self.socketio = SocketIO(
+                        async_mode="gevent", logger=True, engineio_logger=True
+                    )
+                except ValueError:
+                    self.socketio = SocketIO(logger=True, engineio_logger=True)
             else:
-                self.socketio = SocketIO(async_mode="gevent")
+                try:
+                    self.socketio = SocketIO(async_mode="gevent")
+                except ValueError:
+                    self.socketio = SocketIO()
             self.socketio.init_app(self.app)
             self.chat_mode = ChatModeWeb(self.common, self)
 

{onionshare_cli-2.6.1 → onionshare_cli-2.6.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "onionshare_cli"
-version = "2.6.1"
+version = "2.6.3"
 description = "OnionShare lets you securely and anonymously send and receive files. It works by starting a web server, making it accessible as a Tor onion service, and generating an unguessable web address so others can download files from you, or upload files to you. It does _not_ require setting up a separate server or using a third party file-sharing service."
 authors = ["Micah Lee <micah@micahflee.com>"]
 license = "GPLv3+"
@@ -16,7 +16,7 @@ classifiers = [
 ]
 
 [tool.poetry.dependencies]
-python = ">=3.8,<3.12"
+python = ">=3.10,<3.13"
 click = "*"
 flask = "2.3.2"
 flask-compress = "^1.13"
@@ -25,23 +25,23 @@ psutil = "*"
 pysocks = "*"
 requests = {extras = ["socks"], version = "*"}
 unidecode = "*"
-urllib3 = "*"
+urllib3 = "^2.2.2"
 eventlet = "*"
-setuptools = "*"
+setuptools = ">=70.0.0"
 pynacl = "*"
 colorama = "*"
 gevent-websocket = "*"
 stem = "1.8.1"
-waitress = "^2.1.2"
-werkzeug = ">=2.3.4"
-packaging = "^23.1"
+waitress = "^3.0.1"
+werkzeug = "3.0.6"
+packaging = ">=24"
 gevent = "^23.9.1"
 wheel = "^0.41.2"
 cffi = "^1.15.1"
 cython = "^3.0.2"
 qrcode = "^7.4.2"
 
-[tool.poetry.dev-dependencies]
+[tool.poetry.group.dev.dependencies]
 pytest = ">=7.2.0"
 
 [tool.poetry.scripts]

onionshare_cli-2.6.1/onionshare_cli/resources/torrc_template-meek_lite_azure

@@ -1,2 +0,0 @@
-# Enable built-in meek-azure bridge
-Bridge meek_lite 192.0.2.18:80 BE776A53492E1E044A26F17306E1BC46A55A1625 url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com

onionshare_cli-2.6.1/onionshare_cli/resources/torrc_template-snowflake

@@ -1,3 +0,0 @@
-# Enable built-in snowflake bridge
-Bridge snowflake 192.0.2.3:80 2B280B23E1107BB62ABFC40DDCC8824814F80A72 fingerprint=2B280B23E1107BB62ABFC40DDCC8824814F80A72 url=https://snowflake-broker.torproject.net.global.prod.fastly.net/ front=foursquare.com ice=stun:stun.l.google.com:19302,stun:stun.antisip.com:3478,stun:stun.bluesip.net:3478,stun:stun.dus.net:3478,stun:stun.epygi.com:3478,stun:stun.sonetel.com:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.voys.nl:3478 utls-imitate=hellorandomizedalpn
-Bridge snowflake 192.0.2.4:80 8838024498816A039FCBBAB14E6F40A0843051FA fingerprint=8838024498816A039FCBBAB14E6F40A0843051FA url=https://snowflake-broker.torproject.net.global.prod.fastly.net/ front=foursquare.com ice=stun:stun.l.google.com:19302,stun:stun.antisip.com:3478,stun:stun.bluesip.net:3478,stun:stun.dus.net:3478,stun:stun.epygi.com:3478,stun:stun.sonetel.net:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.voys.nl:3478 utls-imitate=hellorandomizedalpn

onionshare_cli-2.6.1/onionshare_cli/resources/version.txt

@@ -1 +0,0 @@
-2.6.1