From ec5a376733c6a30caf6fde4c90f32187eb89c8a7 Mon Sep 17 00:00:00 2001 From: ston1th Date: Fri, 3 May 2019 10:44:17 +0200 Subject: [PATCH] added base path filter --- pkg/core/const.go | 2 +- pkg/core/helper.go | 13 +++++-------- pkg/core/types.go | 2 ++ pkg/fs/file.go | 17 +++++++++++++++-- pkg/fs/helper.go | 31 ++++++++++++++++++++++++++++++- pkg/index/index.go | 13 ++++++------- pkg/scan/pdf.go | 6 ------ pkg/scan/scanner.go | 13 +++++++++++++ pkg/scan/tesseract.go | 9 --------- pkg/server/handler.go | 22 ++++++++++++++++++---- pkg/server/templates.go | 12 ++++++++---- templates/custom.css | 4 ++++ templates/dir.html | 2 +- templates/index.html | 2 +- templates/search.html | 4 ++-- 15 files changed, 106 insertions(+), 46 deletions(-) delete mode 100644 pkg/scan/pdf.go delete mode 100644 pkg/scan/tesseract.go diff --git a/pkg/core/const.go b/pkg/core/const.go index 8f83482..6f5e9bf 100644 --- a/pkg/core/const.go +++ b/pkg/core/const.go @@ -2,7 +2,7 @@ package core -var ( +const ( IndexURI = "/" TotpURI = "/totp" LoginURI = "/login" diff --git a/pkg/core/helper.go b/pkg/core/helper.go index 3671f0b..48b6c49 100644 --- a/pkg/core/helper.go +++ b/pkg/core/helper.go @@ -1,15 +1,12 @@ package core -import "time" - -const ( - timeFmt = "2006-01-02 15:04:05" - fileFmt = "20060102_150405" +import ( + "time" ) -func Now() string { - return time.Now().Format(timeFmt) -} +const ( + fileFmt = "20060102_150405" +) func FileName() string { return time.Now().Format(fileFmt) diff --git a/pkg/core/types.go b/pkg/core/types.go index 7ed1290..20b1802 100644 --- a/pkg/core/types.go +++ b/pkg/core/types.go @@ -18,6 +18,8 @@ type Result struct { HTML template.HTML } +type Results []Result + type Path struct { Name string Abs string diff --git a/pkg/fs/file.go b/pkg/fs/file.go index 31d777d..d0f337d 100644 --- a/pkg/fs/file.go +++ b/pkg/fs/file.go @@ -54,6 +54,10 @@ func (fs *Filesystem) NewFile(r io.Reader, path, orig, name string) (newfile str name = orig } newfile = filepath.Join(path, name) + err = checkPath(newfile) + if err != nil { + return + } f, err := os.OpenFile(filepath.Join(fs.Base, newfile), os.O_RDWR|os.O_CREATE, FileMode) if err != nil { return @@ -64,7 +68,12 @@ func (fs *Filesystem) NewFile(r io.Reader, path, orig, name string) (newfile str } func (fs *Filesystem) Mkdir(path, name string) error { - return os.Mkdir(filepath.Join(fs.Base, Clean(path), Clean(name)), DirMode) + dirpath := filepath.Join(Clean(path), Clean(name)) + err := checkPath(dirpath) + if err != nil { + return err + } + return os.Mkdir(filepath.Join(fs.Base, dirpath), DirMode) } func (fs *Filesystem) Move(path, dest, name string) (string, error) { @@ -75,7 +84,11 @@ func (fs *Filesystem) Move(path, dest, name string) (string, error) { if fullpath == fs.Base { return "", errors.New("the root path can not be moved") } - newfile := Clean(filepath.Join(dest, name)) + newfile := filepath.Join(Clean(dest), Clean(name)) + err := checkPath(newfile) + if err != nil { + return "", err + } return newfile, os.Rename(fullpath, filepath.Join(fs.Base, newfile)) } diff --git a/pkg/fs/helper.go b/pkg/fs/helper.go index 876d324..385225d 100644 --- a/pkg/fs/helper.go +++ b/pkg/fs/helper.go @@ -1,6 +1,11 @@ package fs -import "path/filepath" +import ( + "errors" + "git.giftfish.de/ston1th/docstore/pkg/core" + "path/filepath" + "strings" +) const sep = "/" @@ -12,3 +17,27 @@ func File(path string) string { _, f := filepath.Split(Clean(path)) return f } + +var reserved = []string{ + core.TotpURI, + core.LoginURI, + core.LogoutURI, + core.RawPrefix, + core.IndexPrefix, + core.UploadPrefix, + core.NewPrefix, + core.MovePrefix, + core.DeletePrefix, + core.Favicon, + core.BootstrapCSS, + core.CustomCSS, +} + +func checkPath(path string) error { + for _, p := range reserved { + if strings.HasPrefix(path, p) { + return errors.New("base path '" + p + "' is reserved") + } + } + return nil +} diff --git a/pkg/index/index.go b/pkg/index/index.go index 80613a5..dff2baf 100644 --- a/pkg/index/index.go +++ b/pkg/index/index.go @@ -80,7 +80,7 @@ func (i *Index) Delete(id string) error { return i.i.Delete(id) } -func (i *Index) Search(search string) (results []core.Result, err error) { +func (i *Index) Search(search string) (results core.Results, err error) { req := bleve.NewSearchRequest(bleve.NewQueryStringQuery(search)) req.Highlight = bleve.NewHighlightWithStyle("html") req.Size = maxSearchResult @@ -98,18 +98,17 @@ func (i *Index) Search(search string) (results []core.Result, err error) { continue } for fragField, frags := range hit.Fragments { - if fragField == "text" || fragField == "created" { - for _, f := range frags { - r.HTML += template.HTML(f) - } - break - } if fragField == "keyword" { var k string for _, f := range frags { k += f } r.Keyword = strings.ReplaceAll(strings.ReplaceAll(k, "", ""), "", "") + } + if fragField == "text" || fragField == "created" { + for _, f := range frags { + r.HTML += template.HTML(f) + } break } } diff --git a/pkg/scan/pdf.go b/pkg/scan/pdf.go deleted file mode 100644 index 6fe939f..0000000 --- a/pkg/scan/pdf.go +++ /dev/null @@ -1,6 +0,0 @@ -package scan - -type PDF struct { - cmd string - args []string -} diff --git a/pkg/scan/scanner.go b/pkg/scan/scanner.go index 46a2104..7aa0e20 100644 --- a/pkg/scan/scanner.go +++ b/pkg/scan/scanner.go @@ -17,6 +17,19 @@ import ( const pdfExt = ".pdf" +type PDF struct { + cmd string + args []string +} + +var defaultLangs = []string{"eng", "deu"} + +type Tesseract struct { + cmd string + args []string + env []string +} + var ( wsr = regexp.MustCompile(`[\t\f ]+`) nlr = regexp.MustCompile(`[\n]{3,}`) diff --git a/pkg/scan/tesseract.go b/pkg/scan/tesseract.go deleted file mode 100644 index fc667cf..0000000 --- a/pkg/scan/tesseract.go +++ /dev/null @@ -1,9 +0,0 @@ -package scan - -var defaultLangs = []string{"eng", "deu"} - -type Tesseract struct { - cmd string - args []string - env []string -} diff --git a/pkg/server/handler.go b/pkg/server/handler.go index c4f23e6..733d5e8 100644 --- a/pkg/server/handler.go +++ b/pkg/server/handler.go @@ -15,8 +15,6 @@ import ( "time" ) -//TODO add missing CSRF checks - const noSuchFile = "no such file or directory" type notFoundHandler struct { @@ -95,7 +93,6 @@ func authHandler(h ctxHandler) ctxHandler { h(ctx) return } - //ctx.Forbidden() ctx.Redirect(core.LoginURI, http.StatusFound) } } @@ -229,6 +226,9 @@ func uploadHandler(ctx *Context) { case "GET": ctx.Exec() case "POST": + if !ctx.CheckXsrf() { + return + } f, orig, err := ctx.File("file") if err != nil { ctx.Error(err) @@ -255,6 +255,9 @@ func newDirHandler(ctx *Context) { case "GET": ctx.Exec() case "POST": + if !ctx.CheckXsrf() { + return + } err := ctx.Srv.FS.Mkdir(path, ctx.Form("name")) if err != nil { ctx.Error(err) @@ -298,6 +301,9 @@ func moveHandler(ctx *Context) { case "GET": ctx.Exec() case "POST": + if !ctx.CheckXsrf() { + return + } name := ctx.Form("name") dest := ctx.Form("destination") newfile, err := ctx.Srv.FS.Move(path, dest, name) @@ -347,6 +353,9 @@ func deleteHandler(ctx *Context) { case "GET": ctx.Exec() case "POST": + if !ctx.CheckXsrf() { + return + } files, err := ctx.Srv.FS.Delete(path) if err != nil { ctx.Error(err) @@ -405,6 +414,11 @@ func dirHandler(ctx *Context) { } ctx.Data.Paths = fs.Paths(path) ctx.Exec() + default: + ctx.Data = webData{ + Title: "Viewer", + } + ctx.Error(noSuchFile) } } } @@ -638,5 +652,5 @@ func logoutHandler(ctx *Context) { log.Println("logout:", user) ctx.Srv.JWT.Invalidate(&ctx.Token) ctx.SetCookie(nil, 0) - ctx.Redirect(core.IndexURI, http.StatusFound) + ctx.Redirect(core.LoginURI, http.StatusFound) } diff --git a/pkg/server/templates.go b/pkg/server/templates.go index efa101f..697c3d7 100644 --- a/pkg/server/templates.go +++ b/pkg/server/templates.go @@ -48,7 +48,7 @@ const (
Upload - New Directory + New Move Delete
@@ -139,7 +139,7 @@ const ( DocStore | {{.Title}} - + @@ -365,7 +365,7 @@ const (
-
+
@@ -397,7 +397,7 @@ const ( 
{{$item.HTML}}
{{end}} - {{if $item.Keyword}}{{$item.Keyword}}{{end}} + {{$item.Keyword}} {{end}} {{else}} @@ -661,6 +661,10 @@ html, body, .container, .content { .full-width { width: 100%; } +.col-nopad { + padding-left: 0; + padding-right: 0; +} .relative { position: relative; } diff --git a/templates/custom.css b/templates/custom.css index fd7b383..1743254 100644 --- a/templates/custom.css +++ b/templates/custom.css @@ -143,6 +143,10 @@ html, body, .container, .content { .full-width { width: 100%; } +.col-nopad { + padding-left: 0; + padding-right: 0; +} .relative { position: relative; } diff --git a/templates/dir.html b/templates/dir.html index e9616fd..9af6773 100644 --- a/templates/dir.html +++ b/templates/dir.html @@ -10,7 +10,7 @@
Upload - New Directory + New Move Delete
diff --git a/templates/index.html b/templates/index.html index 6aaa248..7769e89 100644 --- a/templates/index.html +++ b/templates/index.html @@ -4,7 +4,7 @@ DocStore | {{.Title}} - + diff --git a/templates/search.html b/templates/search.html index c97fd31..2fa4cf1 100644 --- a/templates/search.html +++ b/templates/search.html @@ -5,7 +5,7 @@
-
+
@@ -37,7 +37,7 @@ 
{{$item.HTML}}
{{end}} - {{if $item.Keyword}}{{$item.Keyword}}{{end}} + {{$item.Keyword}} {{end}} {{else}}