ston1th/docstore
1
1
Fork 0
Code Issues 3 Releases Activity

added base path filter

Browse source
This commit is contained in:
ston1th 2019-05-03 10:44:17 +02:00
commit ec5a376733
15 changed files with 104 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

2
pkg/core/const.go
View file

@ -2,7 +2,7 @@
package core
var (
const (
IndexURI = "/"
TotpURI = "/totp"
LoginURI = "/login"

13
pkg/core/helper.go
View file

@ -1,15 +1,12 @@
package core
import "time"
const (
timeFmt = "2006-01-02 15:04:05"
fileFmt = "20060102_150405"
import (
"time"
)
func Now() string {
return time.Now().Format(timeFmt)
}
const (
fileFmt = "20060102_150405"
)
func FileName() string {
return time.Now().Format(fileFmt)

2
pkg/core/types.go
View file

@ -18,6 +18,8 @@ type Result struct {
HTML template.HTML
}
type Results []Result
type Path struct {
Name string
Abs string

17
pkg/fs/file.go
View file

@ -54,6 +54,10 @@ func (fs *Filesystem) NewFile(r io.Reader, path, orig, name string) (newfile str
name = orig
}
newfile = filepath.Join(path, name)
err = checkPath(newfile)
if err != nil {
return
}
f, err := os.OpenFile(filepath.Join(fs.Base, newfile), os.O_RDWR|os.O_CREATE, FileMode)
if err != nil {
return
@ -64,7 +68,12 @@ func (fs *Filesystem) NewFile(r io.Reader, path, orig, name string) (newfile str
}
func (fs *Filesystem) Mkdir(path, name string) error {
return os.Mkdir(filepath.Join(fs.Base, Clean(path), Clean(name)), DirMode)
dirpath := filepath.Join(Clean(path), Clean(name))
err := checkPath(dirpath)
if err != nil {
return err
}
return os.Mkdir(filepath.Join(fs.Base, dirpath), DirMode)
}
func (fs *Filesystem) Move(path, dest, name string) (string, error) {
@ -75,7 +84,11 @@ func (fs *Filesystem) Move(path, dest, name string) (string, error) {
if fullpath == fs.Base {
return "", errors.New("the root path can not be moved")
}
newfile := Clean(filepath.Join(dest, name))
newfile := filepath.Join(Clean(dest), Clean(name))
err := checkPath(newfile)
if err != nil {
return "", err
}
return newfile, os.Rename(fullpath, filepath.Join(fs.Base, newfile))
}

31
pkg/fs/helper.go
View file

@ -1,6 +1,11 @@
package fs
import "path/filepath"
import (
"errors"
"git.giftfish.de/ston1th/docstore/pkg/core"
"path/filepath"
"strings"
)
const sep = "/"
@ -12,3 +17,27 @@ func File(path string) string {
_, f := filepath.Split(Clean(path))
return f
}
var reserved = []string{
core.TotpURI,
core.LoginURI,
core.LogoutURI,
core.RawPrefix,
core.IndexPrefix,
core.UploadPrefix,
core.NewPrefix,
core.MovePrefix,
core.DeletePrefix,
core.Favicon,
core.BootstrapCSS,
core.CustomCSS,
}
func checkPath(path string) error {
for _, p := range reserved {
if strings.HasPrefix(path, p) {
return errors.New("base path '" + p + "' is reserved")
}
}
return nil
}

13
pkg/index/index.go
View file

@ -80,7 +80,7 @@ func (i *Index) Delete(id string) error {
return i.i.Delete(id)
}
func (i *Index) Search(search string) (results []core.Result, err error) {
func (i *Index) Search(search string) (results core.Results, err error) {
req := bleve.NewSearchRequest(bleve.NewQueryStringQuery(search))
req.Highlight = bleve.NewHighlightWithStyle("html")
req.Size = maxSearchResult
@ -98,18 +98,17 @@ func (i *Index) Search(search string) (results []core.Result, err error) {
continue
}
for fragField, frags := range hit.Fragments {
if fragField == "text" || fragField == "created" {
for _, f := range frags {
r.HTML += template.HTML(f)
}
break
}
if fragField == "keyword" {
var k string
for _, f := range frags {
k += f
}
r.Keyword = strings.ReplaceAll(strings.ReplaceAll(k, "<mark>", ""), "</mark>", "")
}
if fragField == "text" || fragField == "created" {
for _, f := range frags {
r.HTML += template.HTML(f)
}
break
}
}

6
pkg/scan/pdf.go
View file

@ -1,6 +0,0 @@
package scan
type PDF struct {
cmd string
args []string
}

13
pkg/scan/scanner.go
View file

@ -17,6 +17,19 @@ import (
const pdfExt = ".pdf"
type PDF struct {
cmd string
args []string
}
var defaultLangs = []string{"eng", "deu"}
type Tesseract struct {
cmd string
args []string
env []string
}
var (
wsr = regexp.MustCompile(`[\t\f ]+`)
nlr = regexp.MustCompile(`[\n]{3,}`)

9
pkg/scan/tesseract.go
View file

@ -1,9 +0,0 @@
package scan
var defaultLangs = []string{"eng", "deu"}
type Tesseract struct {
cmd string
args []string
env []string
}

22
pkg/server/handler.go
View file

@ -15,8 +15,6 @@ import (
"time"
)
//TODO add missing CSRF checks
const noSuchFile = "no such file or directory"
type notFoundHandler struct {
@ -95,7 +93,6 @@ func authHandler(h ctxHandler) ctxHandler {
h(ctx)
return
}
//ctx.Forbidden()
ctx.Redirect(core.LoginURI, http.StatusFound)
}
}
@ -229,6 +226,9 @@ func uploadHandler(ctx *Context) {
case "GET":
ctx.Exec()
case "POST":
if !ctx.CheckXsrf() {
return
}
f, orig, err := ctx.File("file")
if err != nil {
ctx.Error(err)
@ -255,6 +255,9 @@ func newDirHandler(ctx *Context) {
case "GET":
ctx.Exec()
case "POST":
if !ctx.CheckXsrf() {
return
}
err := ctx.Srv.FS.Mkdir(path, ctx.Form("name"))
if err != nil {
ctx.Error(err)
@ -298,6 +301,9 @@ func moveHandler(ctx *Context) {
case "GET":
ctx.Exec()
case "POST":
if !ctx.CheckXsrf() {
return
}
name := ctx.Form("name")
dest := ctx.Form("destination")
newfile, err := ctx.Srv.FS.Move(path, dest, name)
@ -347,6 +353,9 @@ func deleteHandler(ctx *Context) {
case "GET":
ctx.Exec()
case "POST":
if !ctx.CheckXsrf() {
return
}
files, err := ctx.Srv.FS.Delete(path)
if err != nil {
ctx.Error(err)
@ -405,6 +414,11 @@ func dirHandler(ctx *Context) {
}
ctx.Data.Paths = fs.Paths(path)
ctx.Exec()
default:
ctx.Data = webData{
Title: "Viewer",
}
ctx.Error(noSuchFile)
}
}
}
@ -638,5 +652,5 @@ func logoutHandler(ctx *Context) {
log.Println("logout:", user)
ctx.Srv.JWT.Invalidate(&ctx.Token)
ctx.SetCookie(nil, 0)
ctx.Redirect(core.IndexURI, http.StatusFound)
ctx.Redirect(core.LoginURI, http.StatusFound)
}

12
pkg/server/templates.go
View file

@ -48,7 +48,7 @@ const (
</ol>
<div class="btn-group btn-breadcrumb">
<a href="/upload{{.Path}}" class="btn btn-sm btn-success">Upload</a>
<a href="/new{{.Path}}" class="btn btn-sm btn-primary">New Directory</a>
<a href="/new{{.Path}}" class="btn btn-sm btn-primary">New</a>
<a href="/move{{.Path}}" class="btn btn-sm btn-primary">Move</a>
<a href="/delete{{.Path}}" class="btn btn-sm btn-danger">Delete</a>
</div>
@ -139,7 +139,7 @@ const (
<title>DocStore | {{.Title}}</title>
<link rel="shortcut icon" type="image/x-icon" href="/favicon.ico" integrity="sha256-bgotk/IPq4Yvt6s8AQGPTM5ZjPjQ6rrBRa2EyxpnFSc="></link>
<link rel="stylesheet" type="text/css" href="/bootstrap.css" media="screen" integrity="sha256-3YeveuySvBgp2GItUS8eV1R/9T1zcPMyvw22SyVf8qo="></link>
<link rel="stylesheet" type="text/css" href="/custom.css" media="screen" integrity="sha256-L50A9TBaaysKaYOQWW5+H5nHTNLFLH4+F7Au3o4enAM="></link>
<link rel="stylesheet" type="text/css" href="/custom.css" media="screen" integrity="sha256-VMvzVve7KY7ia4G8uBrASNEZ/Qc/5jCqVV3WWU+Y9ao="></link>
<meta name="theme-color" content="#375a7f">
<meta name="description" content="{{.Title}}">
</head>
@ -365,7 +365,7 @@ const (
</div>
</div>
<div class="row mt-3">
<div class="col">
<div class="col col-nopad">
<form class="form-horizontal" action="/search" method="post">
<input type="hidden" name="token" value="{{.Token}}">
<div class="form-group">
@ -397,7 +397,7 @@ const (
<br><pre class="wrap">{{$item.HTML}}</pre>
{{end}}
</td>
<td>{{if $item.Keyword}}<span class="badge badge-primary">{{$item.Keyword}}</span>{{end}}</td>
<td>{{$item.Keyword}}</td>
</tr>
{{end}}
{{else}}
@ -661,6 +661,10 @@ html, body, .container, .content {
.full-width {
width: 100%;
}
.col-nopad {
padding-left: 0;
padding-right: 0;
}
.relative {
position: relative;
}

4
templates/custom.css
View file

@ -143,6 +143,10 @@ html, body, .container, .content {
.full-width {
width: 100%;
}
.col-nopad {
padding-left: 0;
padding-right: 0;
}
.relative {
position: relative;
}

2
templates/dir.html
View file

@ -10,7 +10,7 @@
</ol>
<div class="btn-group btn-breadcrumb">
<a href="/upload{{.Path}}" class="btn btn-sm btn-success">Upload</a>
<a href="/new{{.Path}}" class="btn btn-sm btn-primary">New Directory</a>
<a href="/new{{.Path}}" class="btn btn-sm btn-primary">New</a>
<a href="/move{{.Path}}" class="btn btn-sm btn-primary">Move</a>
<a href="/delete{{.Path}}" class="btn btn-sm btn-danger">Delete</a>
</div>

2
templates/index.html
View file

@ -4,7 +4,7 @@
<title>DocStore | {{.Title}}</title>
<link rel="shortcut icon" type="image/x-icon" href="/favicon.ico" integrity="sha256-bgotk/IPq4Yvt6s8AQGPTM5ZjPjQ6rrBRa2EyxpnFSc="></link>
<link rel="stylesheet" type="text/css" href="/bootstrap.css" media="screen" integrity="sha256-3YeveuySvBgp2GItUS8eV1R/9T1zcPMyvw22SyVf8qo="></link>
<link rel="stylesheet" type="text/css" href="/custom.css" media="screen" integrity="sha256-L50A9TBaaysKaYOQWW5+H5nHTNLFLH4+F7Au3o4enAM="></link>
<link rel="stylesheet" type="text/css" href="/custom.css" media="screen" integrity="sha256-VMvzVve7KY7ia4G8uBrASNEZ/Qc/5jCqVV3WWU+Y9ao="></link>
<meta name="theme-color" content="#375a7f">
<meta name="description" content="{{.Title}}">
</head>

4
templates/search.html
View file

@ -5,7 +5,7 @@
</div>
</div>
<div class="row mt-3">
<div class="col">
<div class="col col-nopad">
<form class="form-horizontal" action="/search" method="post">
<input type="hidden" name="token" value="{{.Token}}">
<div class="form-group">
@ -37,7 +37,7 @@
<br><pre class="wrap">{{$item.HTML}}</pre>
{{end}}
</td>
<td>{{if $item.Keyword}}<span class="badge badge-primary">{{$item.Keyword}}</span>{{end}}</td>
<td>{{$item.Keyword}}</td>
</tr>
{{end}}
{{else}}