add webdav #217
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,26 +1,32 @@ | ||
| module github.com/codeskyblue/gohttpserver | ||
|
|
||
| go 1.23.0 | ||
|
|
||
| require ( | ||
| github.com/alecthomas/kingpin v2.2.6+incompatible | ||
| github.com/codeskyblue/dockerignore v0.0.0-20151214070507-de82dee623d9 | ||
| github.com/codeskyblue/go-accesslog v0.0.0-20171215023101-6188d3bd9371 | ||
| github.com/codeskyblue/openid-go v0.0.0-20160923065855-0d30842b2fb4 | ||
| github.com/fork2fix/go-plist v0.0.0-20181126021357-36960be5e636 | ||
| github.com/go-yaml/yaml v2.1.0+incompatible | ||
| github.com/goji/httpauth v0.0.0-20160601135302-2da839ab0f4d | ||
| github.com/gorilla/handlers v1.4.0 | ||
| github.com/gorilla/mux v1.6.2 | ||
| github.com/gorilla/sessions v1.2.0 | ||
| github.com/shogo82148/androidbinary v0.0.0-20180627093851-01c4bfa8b3b5 | ||
| github.com/stretchr/testify v1.3.0 | ||
| golang.org/x/net v0.38.0 | ||
| golang.org/x/text v0.23.0 | ||
| ) | ||
|
|
||
| require ( | ||
| github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc // indirect | ||
| github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf // indirect | ||
| github.com/davecgh/go-spew v1.1.0 // indirect | ||
| github.com/gorilla/context v1.1.2 // indirect | ||
| github.com/gorilla/securecookie v1.1.1 // indirect | ||
| github.com/pkg/errors v0.8.0 // indirect | ||
| github.com/pmezard/go-difflib v1.0.0 // indirect | ||
| github.com/smartystreets/goconvey v1.6.4 // indirect | ||
| howett.net/plist v0.0.0-20201203080718-1454fab16a06 // indirect | ||
| ) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -24,6 +24,7 @@ import ( | |
| "github.com/go-yaml/yaml" | ||
| "github.com/gorilla/mux" | ||
| "github.com/shogo82148/androidbinary/apk" | ||
| "golang.org/x/net/webdav" | ||
| ) | ||
|
|
||
| const YAMLCONF = ".ghs.yml" | ||
|
|
@@ -62,6 +63,7 @@ type HTTPStaticServer struct { | |
|
|
||
| indexes []IndexFileItem | ||
| m *mux.Router | ||
| Handler *webdav.Handler | ||
| bufPool sync.Pool // use sync.Pool caching buf to reduce gc ratio | ||
| } | ||
|
|
||
|
|
@@ -75,11 +77,16 @@ func NewHTTPStaticServer(root string, noIndex bool) *HTTPStaticServer { | |
| root = root + "/" | ||
| } | ||
| log.Printf("root path: %s\n", root) | ||
| fs := &webdav.Handler{ | ||
| FileSystem: webdav.Dir(root), | ||
| LockSystem: webdav.NewMemLS(), | ||
| } | ||
| m := mux.NewRouter() | ||
| s := &HTTPStaticServer{ | ||
| Root: root, | ||
| Theme: "black", | ||
| m: m, | ||
| Handler: fs, | ||
| bufPool: sync.Pool{ | ||
| New: func() interface{} { return make([]byte, 32*1024) }, | ||
| }, | ||
|
|
@@ -108,13 +115,31 @@ func NewHTTPStaticServer(root string, noIndex bool) *HTTPStaticServer { | |
| m.HandleFunc("/{path:.*}", s.hIndex).Methods("GET", "HEAD") | ||
| m.HandleFunc("/{path:.*}", s.hUploadOrMkdir).Methods("POST") | ||
| m.HandleFunc("/{path:.*}", s.hDelete).Methods("DELETE") | ||
| m.HandleFunc("/{path:.*}", s.hWebdav).Methods("OPTIONS", "PROPFIND", "PUT", "LOCK", "UNLOCK", "MKCOL", "MOVE", "PROPPATCH") | ||
| return s | ||
| } | ||
|
|
||
| func (s *HTTPStaticServer) ServeHTTP(w http.ResponseWriter, r *http.Request) { | ||
| s.m.ServeHTTP(w, r) | ||
| } | ||
|
|
||
| func (s *HTTPStaticServer) hWebdav(w http.ResponseWriter, r *http.Request) { | ||
| path := mux.Vars(r)["path"] | ||
| realPath := s.getRealPath(r) | ||
| auth := s.readAccessConf(realPath) | ||
|
|
||
| if filepath.Base(path) == YAMLCONF { | ||
| http.Error(w, "Security warning, not allowed to rw", http.StatusForbidden) | ||
| return | ||
| } | ||
| if !auth.canWebdavAccess(w, r) { | ||
| http.Error(w, "Not authorized", http.StatusUnauthorized) | ||
| return | ||
| } | ||
|
|
||
| s.Handler.ServeHTTP(w, r) | ||
| } | ||
|
|
||
| // Return real path with Seperator(/) | ||
| func (s *HTTPStaticServer) getRealPath(r *http.Request) string { | ||
| path := mux.Vars(r)["path"] | ||
|
|
@@ -133,6 +158,18 @@ func (s *HTTPStaticServer) getRealPath(r *http.Request) string { | |
| func (s *HTTPStaticServer) hIndex(w http.ResponseWriter, r *http.Request) { | ||
| path := mux.Vars(r)["path"] | ||
| realPath := s.getRealPath(r) | ||
| auth := s.readAccessConf(realPath) | ||
|
|
||
| // Only apply WebDAV-specific access control for non-GET/HEAD methods. | ||
| // For standard read operations (GET/HEAD), rely on the normal authentication | ||
| // mechanism (e.g., session-based auth/middleware) instead of canWebdavAccess. | ||
| if r.Method != http.MethodGet && r.Method != http.MethodHead { | ||
| if !auth.canWebdavAccess(w, r) { | ||
| http.Error(w, "Get forbidden", http.StatusForbidden) | ||
| return | ||
| } | ||
| } | ||
|
|
||
| if r.FormValue("json") == "true" { | ||
| s.hJSONList(w, r) | ||
| return | ||
|
|
@@ -165,7 +202,7 @@ func (s *HTTPStaticServer) hIndex(w http.ResponseWriter, r *http.Request) { | |
| if r.FormValue("download") == "true" { | ||
| w.Header().Set("Content-Disposition", "attachment; filename="+strconv.Quote(filepath.Base(path))) | ||
| } | ||
| s.Handler.ServeHTTP(w, r) | ||
| } | ||
| } | ||
|
|
||
|
|
@@ -175,10 +212,13 @@ func (s *HTTPStaticServer) hDelete(w http.ResponseWriter, req *http.Request) { | |
| // path = filepath.Clean(path) // for safe reason, prevent path contain .. | ||
| auth := s.readAccessConf(realPath) | ||
| if !auth.canDelete(req) { | ||
| if !auth.canWebdavAccess(w, req) { | ||
| http.Error(w, "Delete forbidden", http.StatusForbidden) | ||
| return | ||
| } | ||
| } | ||
| s.Handler.ServeHTTP(w, req) | ||
| return | ||
| // TODO: path safe check | ||
| err := os.RemoveAll(realPath) | ||
| if err != nil { | ||
|
|
@@ -502,6 +542,21 @@ type AccessConf struct { | |
|
|
||
| var reCache = make(map[string]*regexp.Regexp) | ||
|
|
||
| func (c *AccessConf) canWebdavAccess(w http.ResponseWriter, r *http.Request) bool { | ||
| if len(c.Users) == 0 { | ||
| return true | ||
| } | ||
| w.Header().Set("WWW-Authenticate", `Basic realm="Restricted"`) | ||
|
Comment on lines
+545
to
+549
There was a problem hiding this comment. The canWebdavAccess method should only set the WWW-Authenticate header when authentication fails, not on every call. Currently, the header is set even when authentication succeeds (when Users list is empty or valid credentials are provided), which can cause clients to unnecessarily prompt for credentials. Move the header setting to just before returning false.
Owner
There was a problem hiding this comment. @copilot open a new pull request to apply changes based on this feedback |
||
|
|
||
| username, password, _ := r.BasicAuth() | ||
| for _, rule := range c.Users { | ||
| if rule.Email == username && rule.Token == password { | ||
| return true | ||
| } | ||
| } | ||
| return false | ||
| } | ||
|
|
||
| func (c *AccessConf) canAccess(fileName string) bool { | ||
| for _, table := range c.AccessTables { | ||
| pattern, ok := reCache[table.Regex] | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The authorization logic is confusing and potentially incorrect. The code checks if delete is NOT allowed, and if so, it then checks WebDAV access. This creates a fallback where if session-based delete is forbidden, WebDAV access with basic auth can still proceed. This may unintentionally allow delete operations through WebDAV when they should be forbidden. The logic should be clearer about when each authentication method applies and whether they should be alternatives or both required.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@copilot open a new pull request to apply changes based on this feedback