uploadserver 5.1.1__tar.gz → 5.2.1__tar.gz

{uploadserver-5.1.1/uploadserver.egg-info → uploadserver-5.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: uploadserver
-Version: 5.1.1
+Version: 5.2.1
 Summary: Python's http.server extended to include a file upload page
 Home-page: https://github.com/Densaugeo/uploadserver
 Author: Densaugeo
@@ -64,9 +64,7 @@ Now you can upload with basic authentication. For example:
 curl -X POST http://127.0.0.1:8000/upload -F 'files=@basicauth-example.txt' -u hello:world
 ~~~
 
-Uploads without authentication will be rejected. Note that basic authentication credentials can be stolen if sent over plain HTTP, so this option is best used with HTTPS.
-
-The server checks credentials before it handles the body of the request, so this mode of operation is not susceptible to DoS attack mentioned in the previous section.
+All requests without authentication will be rejected. Note that basic authentication credentials can be stolen if sent over plain HTTP, so this option is best used with HTTPS.
 
 ## Basic Authentication (uploads only)
 
@@ -76,7 +74,7 @@ python3 -m uploadserver --basic-auth-upload hello:world
 
 The same as above, but authentication is only required for upload operations.
 
-If both --basic-auth and --basic-auth-upload are specified, first one will be used for downloads and the second one for uploads.
+If both `--basic-auth` and `--basic-auth-upload` are specified, all requests will require one of the two credentials, but only the `--basic-auth-upload` credentials will be able to upload files.
 
 ## Theme Option
 

{uploadserver-5.1.1 → uploadserver-5.2.1}/README.md

@@ -50,9 +50,7 @@ Now you can upload with basic authentication. For example:
 curl -X POST http://127.0.0.1:8000/upload -F 'files=@basicauth-example.txt' -u hello:world
 ~~~
 
-Uploads without authentication will be rejected. Note that basic authentication credentials can be stolen if sent over plain HTTP, so this option is best used with HTTPS.
-
-The server checks credentials before it handles the body of the request, so this mode of operation is not susceptible to DoS attack mentioned in the previous section.
+All requests without authentication will be rejected. Note that basic authentication credentials can be stolen if sent over plain HTTP, so this option is best used with HTTPS.
 
 ## Basic Authentication (uploads only)
 
@@ -62,7 +60,7 @@ python3 -m uploadserver --basic-auth-upload hello:world
 
 The same as above, but authentication is only required for upload operations.
 
-If both --basic-auth and --basic-auth-upload are specified, first one will be used for downloads and the second one for uploads.
+If both `--basic-auth` and `--basic-auth-upload` are specified, all requests will require one of the two credentials, but only the `--basic-auth-upload` credentials will be able to upload files.
 
 ## Theme Option
 

{uploadserver-5.1.1 → uploadserver-5.2.1}/setup.py

@@ -5,7 +5,7 @@ with open('README.md', 'r') as fh:
 
 setuptools.setup(
     name='uploadserver',
-    version='5.1.1',
+    version='5.2.1',
     author='Densaugeo',
     author_email='author@example.com',
     description='Python\'s http.server extended to include a file upload page',

{uploadserver-5.1.1 → uploadserver-5.2.1}/uploadserver/__init__.py

@@ -82,7 +82,8 @@ def get_directory_head_injection(theme):
 ''', 'utf-8')
 
 DIRECTORY_BODY_INJECTION = b'''<!-- Injected by uploadserver -->
-<a href="upload">File upload</a> (provided by uploadserver)
+<a href="/upload">File upload</a>
+(provided by uploadserver, all files go to server root)
 <hr>
 <!-- End injection by uploadserver -->
 '''
@@ -191,15 +192,31 @@ def check_http_authentication(handler):
     It validates Authorization header and sends back 401 response on failure.
     It returns False if this happens.
     """
-    if handler.path == '/upload':
-        auth = args.basic_auth or args.basic_auth_upload
+    if not args.basic_auth_upload:
+        # If no auth settings apply, check always passes
+        if not args.basic_auth:
+            return True
+        
+        # If only --basic-auth is supplied, it's used for all requests
+        valid, message = check_http_authentication_header(handler, args.basic_auth)
     else:
-        auth = args.basic_auth
-    
-    # If no auth settings apply, check always passes
-    if not auth: return True
-    
-    valid, message = check_http_authentication_header(handler, auth)
+        # If --basic-auth-upload is supplied, it's always required for /upload
+        if handler.path == '/upload':
+            valid, message = check_http_authentication_header(handler,
+                args.basic_auth_upload)
+        else:
+            # For paths outside /upload, no auth is required when --basic-auth
+            # is not supplied
+            if not args.basic_auth:
+                return True
+            
+            # For paths outise /upload, if both auths are supplied both are
+            # accepted
+            else:
+                valid, message = check_http_authentication_header(handler, args.basic_auth)
+                
+                if not valid:
+                    valid, message = check_http_authentication_header(handler, args.basic_auth_upload)
     
     if not valid:
         handler.log_message(f'Request rejected ({message})')
@@ -421,8 +438,4 @@ def main():
     args = parser.parse_args()
     if not hasattr(args, 'directory'): args.directory = os.getcwd()
     
-    if args.basic_auth and args.basic_auth_upload:
-        print('Cannot set both --basic--auth and --basic-auth-upload')
-        sys.exit(6)
-    
     serve_forever()

{uploadserver-5.1.1 → uploadserver-5.2.1/uploadserver.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: uploadserver
-Version: 5.1.1
+Version: 5.2.1
 Summary: Python's http.server extended to include a file upload page
 Home-page: https://github.com/Densaugeo/uploadserver
 Author: Densaugeo
@@ -64,9 +64,7 @@ Now you can upload with basic authentication. For example:
 curl -X POST http://127.0.0.1:8000/upload -F 'files=@basicauth-example.txt' -u hello:world
 ~~~
 
-Uploads without authentication will be rejected. Note that basic authentication credentials can be stolen if sent over plain HTTP, so this option is best used with HTTPS.
-
-The server checks credentials before it handles the body of the request, so this mode of operation is not susceptible to DoS attack mentioned in the previous section.
+All requests without authentication will be rejected. Note that basic authentication credentials can be stolen if sent over plain HTTP, so this option is best used with HTTPS.
 
 ## Basic Authentication (uploads only)
 
@@ -76,7 +74,7 @@ python3 -m uploadserver --basic-auth-upload hello:world
 
 The same as above, but authentication is only required for upload operations.
 
-If both --basic-auth and --basic-auth-upload are specified, first one will be used for downloads and the second one for uploads.
+If both `--basic-auth` and `--basic-auth-upload` are specified, all requests will require one of the two credentials, but only the `--basic-auth-upload` credentials will be able to upload files.
 
 ## Theme Option