diff --git a/.cirrus.yml b/.cirrus.yml
index 568c34d7..7c45f1fc 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -2,17 +2,17 @@ freebsd_task:
name: FreeBSD
matrix:
- - name: FreeBSD 14.3
+ - name: FreeBSD 14.1
freebsd_instance:
- image_family: freebsd-14-3
+ image_family: freebsd-14-1
pkginstall_script:
- pkg update -f
- - pkg install -y go125
+ - pkg install -y go122
- pkg install -y git
setup_script:
- - ln -s /usr/local/bin/go125 /usr/local/bin/go
+ - ln -s /usr/local/bin/go122 /usr/local/bin/go
- pw groupadd sftpgo
- pw useradd sftpgo -g sftpgo -w none -m
- mkdir /home/sftpgo/sftpgo
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index 934cc584..74b99f7a 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -7,10 +7,8 @@ body:
attributes:
value: |
### 👍 Thank you for contributing to our project!
- Before asking for help please check our [support policy](https://github.com/drakkan/sftpgo?tab=readme-ov-file#support).
- If you are a [commercial user](https://sftpgo.com/) please contact us using the dedicated [email address](mailto:support@sftpgo.com).
- If you'd like to contribute code, please make sure to read and understand our [Contributor License Agreement (CLA)](https://sftpgo.com/cla.html).
- You’ll be asked to accept it when submitting a pull request.
+ Before asking for help please check the [support policy](https://github.com/drakkan/sftpgo#support-policy).
+ If you are a commercial user or a project sponsor please contact us using the dedicated [email address](mailto:support@sftpgo.com).
- type: checkboxes
id: before-posting
attributes:
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
index 5fd83037..f0cf871b 100644
--- a/.github/ISSUE_TEMPLATE/feature_request.yml
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -2,14 +2,6 @@ name: 🚀 Feature request
description: Suggest an idea for SFTPGo
labels: ["suggestion"]
body:
- - type: markdown
- attributes:
- value: |
- ### 👍 Thank you for contributing to our project!
- Before asking for help please check our [support policy](https://github.com/drakkan/sftpgo?tab=readme-ov-file#support).
- If you are a [commercial user](https://sftpgo.com/) please contact us using the dedicated [email address](mailto:support@sftpgo.com).
- If you'd like to contribute code, please make sure to read and understand our [Contributor License Agreement (CLA)](https://sftpgo.com/cla.html).
- You’ll be asked to accept it when submitting a pull request.
- type: textarea
attributes:
label: Is your feature request related to a problem? Please describe.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index db26ed74..08edea2d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -15,22 +15,22 @@ jobs:
steps:
- name: Checkout repository
- uses: actions/checkout@v6
+ uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up Go
- uses: actions/setup-go@v6
+ uses: actions/setup-go@v5
with:
- go-version: '1.25'
+ go-version: '1.22'
- name: Initialize CodeQL
- uses: github/codeql-action/init@v4
+ uses: github/codeql-action/init@v3
with:
languages: go
- name: Autobuild
- uses: github/codeql-action/autobuild@v4
+ uses: github/codeql-action/autobuild@v3
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v4
\ No newline at end of file
+ uses: github/codeql-action/analyze@v3
\ No newline at end of file
diff --git a/.github/workflows/development.yml b/.github/workflows/development.yml
index 45769de3..4b73b415 100644
--- a/.github/workflows/development.yml
+++ b/.github/workflows/development.yml
@@ -2,7 +2,7 @@ name: CI
on:
push:
- branches: [main]
+ branches: [2.6.x]
pull_request:
permissions:
@@ -15,16 +15,16 @@ jobs:
runs-on: ${{ matrix.os }}
strategy:
matrix:
- go: ['1.26']
+ go: ['1.22']
os: [ubuntu-latest, macos-latest]
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up Go
- uses: actions/setup-go@v6
+ uses: actions/setup-go@v5
with:
go-version: ${{ matrix.go }}
@@ -50,7 +50,7 @@ jobs:
- name: Upload coverage to Codecov
uses: codecov/codecov-action@v5
with:
- files: ./coverage.txt
+ file: ./coverage.txt
fail_ci_if_error: false
token: ${{ secrets.CODECOV_TOKEN }}
@@ -93,34 +93,92 @@ jobs:
- name: Upload build artifact
if: startsWith(matrix.os, 'ubuntu-') != true
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo-${{ matrix.os }}-go-${{ matrix.go }}
path: output
test-deploy-windows:
name: Test and deploy Windows
+ environment: signing
runs-on: windows-latest
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v4
with:
fetch-depth: 0
- - name: Set up Go
- uses: actions/setup-go@v6
+ - name: Azure login
+ if: ${{ github.event_name != 'pull_request' }}
+ uses: azure/login@v2
with:
- go-version: '1.26'
+ client-id: ${{ secrets.AZURE_CLIENT_ID }}
+ tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+ subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
- - name: Run test cases using SQLite provider
+ - name: Set up Go
+ uses: actions/setup-go@v5
+ with:
+ go-version: '1.22'
+
+ - name: Build
run: |
+ $GIT_COMMIT = (git describe --always --abbrev=8 --dirty) | Out-String
+ $DATE_TIME = ([datetime]::Now.ToUniversalTime().toString("yyyy-MM-ddTHH:mm:ssZ")) | Out-String
+ $LATEST_TAG = ((git describe --tags $(git rev-list --tags --max-count=1)) | Out-String).Trim()
+ $REV_LIST=$LATEST_TAG+"..HEAD"
+ $COMMITS_FROM_TAG= ((git rev-list $REV_LIST --count) | Out-String).Trim()
+ $FILE_VERSION = $LATEST_TAG.substring(1) + "." + $COMMITS_FROM_TAG
+ go install github.com/tc-hib/go-winres@latest
+ go-winres simply --arch amd64 --product-version $LATEST_TAG-dev-$GIT_COMMIT --file-version $FILE_VERSION --file-description "SFTPGo server" --product-name SFTPGo --copyright "AGPL-3.0 with additional terms" --original-filename sftpgo.exe --icon .\windows-installer\icon.ico
+ go build -trimpath -tags nopgxregisterdefaulttypes,disable_grpc_modules -ldflags "-s -w -X github.com/drakkan/sftpgo/v2/internal/version.commit=$GIT_COMMIT -X github.com/drakkan/sftpgo/v2/internal/version.date=$DATE_TIME" -o sftpgo.exe
cd tests/eventsearcher
go build -trimpath -ldflags "-s -w" -o eventsearcher.exe
cd ../..
cd tests/ipfilter
go build -trimpath -ldflags "-s -w" -o ipfilter.exe
cd ../..
- go test -v -tags nopgxregisterdefaulttypes,disable_grpc_modules -p 1 -timeout 15m ./... -coverprofile=coverage.txt -covermode=atomic
+ mkdir arm64
+ $Env:CGO_ENABLED='0'
+ $Env:GOOS='windows'
+ $Env:GOARCH='arm64'
+ go-winres simply --arch arm64 --product-version $LATEST_TAG-dev-$GIT_COMMIT --file-version $FILE_VERSION --file-description "SFTPGo server" --product-name SFTPGo --copyright "AGPL-3.0 with additional terms" --original-filename sftpgo.exe --icon .\windows-installer\icon.ico
+ go build -trimpath -tags nopgxregisterdefaulttypes,disable_grpc_modules,nosqlite -ldflags "-s -w -X github.com/drakkan/sftpgo/v2/internal/version.commit=$GIT_COMMIT -X github.com/drakkan/sftpgo/v2/internal/version.date=$DATE_TIME" -o .\arm64\sftpgo.exe
+ mkdir x86
+ $Env:GOARCH='386'
+ go-winres simply --arch 386 --product-version $LATEST_TAG-dev-$GIT_COMMIT --file-version $FILE_VERSION --file-description "SFTPGo server" --product-name SFTPGo --copyright "AGPL-3.0 with additional terms" --original-filename sftpgo.exe --icon .\windows-installer\icon.ico
+ go build -trimpath -tags nopgxregisterdefaulttypes,disable_grpc_modules,nosqlite -ldflags "-s -w -X github.com/drakkan/sftpgo/v2/internal/version.commit=$GIT_COMMIT -X github.com/drakkan/sftpgo/v2/internal/version.date=$DATE_TIME" -o .\x86\sftpgo.exe
+ Remove-Item Env:\CGO_ENABLED
+ Remove-Item Env:\GOOS
+ Remove-Item Env:\GOARCH
+
+ - name: Sign binaries
+ if: ${{ github.event_name != 'pull_request' }}
+ uses: azure/trusted-signing-action@v0.5.0
+ with:
+ endpoint: https://eus.codesigning.azure.net/
+ trusted-signing-account-name: nicola
+ certificate-profile-name: SFTPGo
+ files: |
+ ${{ github.workspace }}\sftpgo.exe
+ ${{ github.workspace }}\arm64\sftpgo.exe
+ ${{ github.workspace }}\x86\sftpgo.exe
+ file-digest: SHA256
+ timestamp-rfc3161: http://timestamp.acs.microsoft.com
+ timestamp-digest: SHA256
+ exclude-environment-credential: true
+ exclude-workload-identity-credential: true
+ exclude-managed-identity-credential: true
+ exclude-shared-token-cache-credential: true
+ exclude-visual-studio-credential: true
+ exclude-visual-studio-code-credential: true
+ exclude-azure-cli-credential: false
+ exclude-azure-powershell-credential: true
+ exclude-azure-developer-cli-credential: true
+ exclude-interactive-browser-credential: true
+
+ - name: Run test cases using SQLite provider
+ run: go test -v -tags nopgxregisterdefaulttypes,disable_grpc_modules -p 1 -timeout 15m ./... -coverprofile=coverage.txt -covermode=atomic
- name: Run test cases using bolt provider
run: |
@@ -143,31 +201,6 @@ jobs:
SFTPGO_DATA_PROVIDER__DRIVER: memory
SFTPGO_DATA_PROVIDER__NAME: ''
- - name: Build
- run: |
- $GIT_COMMIT = (git describe --always --abbrev=8 --dirty) | Out-String
- $DATE_TIME = ([datetime]::Now.ToUniversalTime().toString("yyyy-MM-ddTHH:mm:ssZ")) | Out-String
- $LATEST_TAG = ((git describe --tags $(git rev-list --tags --max-count=1)) | Out-String).Trim()
- $REV_LIST=$LATEST_TAG+"..HEAD"
- $COMMITS_FROM_TAG= ((git rev-list $REV_LIST --count) | Out-String).Trim()
- $FILE_VERSION = $LATEST_TAG.substring(1) + "." + $COMMITS_FROM_TAG
- go install github.com/tc-hib/go-winres@latest
- go-winres simply --arch amd64 --product-version $LATEST_TAG-dev-$GIT_COMMIT --file-version "$FILE_VERSION" --file-description "SFTPGo server" --product-name SFTPGo --copyright "2019-2025 Nicola Murino" --original-filename sftpgo.exe --icon .\windows-installer\icon.ico
- go build -trimpath -tags nopgxregisterdefaulttypes,disable_grpc_modules -ldflags "-s -w -X github.com/drakkan/sftpgo/v2/internal/version.commit=$GIT_COMMIT -X github.com/drakkan/sftpgo/v2/internal/version.date=$DATE_TIME" -o sftpgo.exe
- mkdir arm64
- $Env:CGO_ENABLED='0'
- $Env:GOOS='windows'
- $Env:GOARCH='arm64'
- go-winres simply --arch arm64 --product-version $LATEST_TAG-dev-$GIT_COMMIT --file-version "$FILE_VERSION" --file-description "SFTPGo server" --product-name SFTPGo --copyright "2019-2025 Nicola Murino" --original-filename sftpgo.exe --icon .\windows-installer\icon.ico
- go build -trimpath -tags nopgxregisterdefaulttypes,disable_grpc_modules,nosqlite -ldflags "-s -w -X github.com/drakkan/sftpgo/v2/internal/version.commit=$GIT_COMMIT -X github.com/drakkan/sftpgo/v2/internal/version.date=$DATE_TIME" -o .\arm64\sftpgo.exe
- mkdir x86
- $Env:GOARCH='386'
- go-winres simply --arch 386 --product-version $LATEST_TAG-dev-$GIT_COMMIT --file-version "$FILE_VERSION" --file-description "SFTPGo server" --product-name SFTPGo --copyright "2019-2025 Nicola Murino" --original-filename sftpgo.exe --icon .\windows-installer\icon.ico
- go build -trimpath -tags nopgxregisterdefaulttypes,disable_grpc_modules,nosqlite -ldflags "-s -w -X github.com/drakkan/sftpgo/v2/internal/version.commit=$GIT_COMMIT -X github.com/drakkan/sftpgo/v2/internal/version.date=$DATE_TIME" -o .\x86\sftpgo.exe
- Remove-Item Env:\CGO_ENABLED
- Remove-Item Env:\GOOS
- Remove-Item Env:\GOARCH
-
- name: Initialize data provider
run: |
rm sftpgo.db
@@ -177,7 +210,6 @@ jobs:
- name: Prepare Windows installers
if: ${{ github.event_name != 'pull_request' }}
run: |
- choco install innosetup
Remove-Item -LiteralPath "output" -Force -Recurse -ErrorAction Ignore
mkdir output
copy .\sftpgo.exe .\output
@@ -214,23 +246,48 @@ jobs:
$Env:SFTPGO_ISS_ARCH='x86'
iscc .\windows-installer\sftpgo.iss
+ - name: Sign installers
+ if: ${{ github.event_name != 'pull_request' }}
+ uses: azure/trusted-signing-action@v0.5.0
+ with:
+ endpoint: https://eus.codesigning.azure.net/
+ trusted-signing-account-name: nicola
+ certificate-profile-name: SFTPGo
+ files: |
+ ${{ github.workspace }}\sftpgo_windows_x86_64.exe
+ ${{ github.workspace }}\sftpgo_windows_arm64.exe
+ ${{ github.workspace }}\sftpgo_windows_x86.exe
+ file-digest: SHA256
+ timestamp-rfc3161: http://timestamp.acs.microsoft.com
+ timestamp-digest: SHA256
+ exclude-environment-credential: true
+ exclude-workload-identity-credential: true
+ exclude-managed-identity-credential: true
+ exclude-shared-token-cache-credential: true
+ exclude-visual-studio-credential: true
+ exclude-visual-studio-code-credential: true
+ exclude-azure-cli-credential: false
+ exclude-azure-powershell-credential: true
+ exclude-azure-developer-cli-credential: true
+ exclude-interactive-browser-credential: true
+
- name: Upload Windows installer x86_64 artifact
if: ${{ github.event_name != 'pull_request' }}
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo_windows_installer_x86_64
path: ./sftpgo_windows_x86_64.exe
- name: Upload Windows installer arm64 artifact
if: ${{ github.event_name != 'pull_request' }}
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo_windows_installer_arm64
path: ./sftpgo_windows_arm64.exe
- name: Upload Windows installer x86 artifact
if: ${{ github.event_name != 'pull_request' }}
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo_windows_installer_x86
path: ./sftpgo_windows_x86.exe
@@ -254,7 +311,7 @@ jobs:
xcopy .\openapi .\output\openapi\ /E
- name: Upload build artifact
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo-windows-portable
path: output
@@ -264,12 +321,12 @@ jobs:
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v4
- name: Set up Go
- uses: actions/setup-go@v6
+ uses: actions/setup-go@v5
with:
- go-version: '1.26'
+ go-version: '1.22'
- name: Build
run: |
@@ -328,12 +385,12 @@ jobs:
- 3308:3306
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v4
- name: Set up Go
- uses: actions/setup-go@v6
+ uses: actions/setup-go@v5
with:
- go-version: '1.26'
+ go-version: '1.22'
- name: Build
run: |
@@ -427,7 +484,7 @@ jobs:
go: latest
go-arch: arm7
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v4
with:
fetch-depth: 0
@@ -472,7 +529,7 @@ jobs:
gzip output/man/man1/*
cp sftpgo output/
- - uses: uraimo/run-on-arch-action@v3
+ - uses: uraimo/run-on-arch-action@v2
if: ${{ matrix.arch != 'amd64' }}
name: Build for ${{ matrix.arch }}
id: build
@@ -521,7 +578,7 @@ jobs:
cp sftpgo output/
- name: Upload build artifact
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo-linux-${{ matrix.arch }}-go-${{ matrix.go }}
path: output
@@ -536,13 +593,13 @@ jobs:
echo "pkg-version=${PKG_VERSION}" >> $GITHUB_OUTPUT
- name: Upload Debian Package
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo-${{ steps.build_linux_pkgs.outputs.pkg-version }}-${{ matrix.go-arch }}-deb
path: pkgs/dist/deb/*
- name: Upload RPM Package
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo-${{ steps.build_linux_pkgs.outputs.pkg-version }}-${{ matrix.go-arch }}-rpm
path: pkgs/dist/rpm/*
@@ -552,11 +609,12 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Set up Go
- uses: actions/setup-go@v6
+ uses: actions/setup-go@v5
with:
- go-version: '1.26'
- - uses: actions/checkout@v6
+ go-version: '1.22'
+ - uses: actions/checkout@v4
- name: Run golangci-lint
- uses: golangci/golangci-lint-action@v9
+ uses: golangci/golangci-lint-action@v6
with:
+ args: --timeout=10m
version: latest
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 822c916e..33782ead 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -5,7 +5,7 @@ on:
# - cron: '0 4 * * *' # everyday at 4:00 AM UTC
push:
branches:
- - main
+ - 2.6.x
tags:
- v*
pull_request:
@@ -33,7 +33,7 @@ jobs:
optional_deps: true
steps:
- name: Checkout
- uses: actions/checkout@v6
+ uses: actions/checkout@v4
- name: Gather image information
id: info
@@ -141,21 +141,21 @@ jobs:
OPTIONAL_DEPS: ${{ matrix.optional_deps }}
- name: Set up QEMU
- uses: docker/setup-qemu-action@v4
+ uses: docker/setup-qemu-action@v3
- name: Set up builder
- uses: docker/setup-buildx-action@v4
+ uses: docker/setup-buildx-action@v3
id: builder
- name: Login to Docker Hub
- uses: docker/login-action@v4
+ uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
if: ${{ github.event_name != 'pull_request' }}
- name: Login to GitHub Container Registry
- uses: docker/login-action@v4
+ uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
@@ -163,7 +163,7 @@ jobs:
if: ${{ github.event_name != 'pull_request' }}
- name: Build and push
- uses: docker/build-push-action@v7
+ uses: docker/build-push-action@v5
with:
context: .
builder: ${{ steps.builder.outputs.name }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9ac10ee5..9d304a64 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,16 +9,16 @@ permissions:
contents: write
env:
- GO_VERSION: 1.25.8
+ GO_VERSION: 1.22.9
jobs:
prepare-sources-with-deps:
name: Prepare sources with deps
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v4
- name: Set up Go
- uses: actions/setup-go@v6
+ uses: actions/setup-go@v5
with:
go-version: ${{ env.GO_VERSION }}
@@ -36,7 +36,7 @@ jobs:
SFTPGO_VERSION: ${{ steps.get_version.outputs.VERSION }}
- name: Upload build artifact
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.VERSION }}_src_with_deps.tar.xz
path: ./sftpgo_${{ steps.get_version.outputs.VERSION }}_src_with_deps.tar.xz
@@ -44,15 +44,23 @@ jobs:
prepare-windows:
name: Prepare Windows binaries
+ environment: signing
runs-on: windows-2022
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v4
- name: Set up Go
- uses: actions/setup-go@v6
+ uses: actions/setup-go@v5
with:
go-version: ${{ env.GO_VERSION }}
+ - name: Azure login
+ uses: azure/login@v2
+ with:
+ client-id: ${{ secrets.AZURE_CLIENT_ID }}
+ tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+ subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
- name: Get SFTPGo version
id: get_version
run: echo "VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_OUTPUT
@@ -64,17 +72,17 @@ jobs:
$DATE_TIME = ([datetime]::Now.ToUniversalTime().toString("yyyy-MM-ddTHH:mm:ssZ")) | Out-String
$FILE_VERSION = $Env:SFTPGO_VERSION.substring(1) + ".0"
go install github.com/tc-hib/go-winres@latest
- go-winres simply --arch amd64 --product-version $Env:SFTPGO_VERSION-$GIT_COMMIT --file-version "$FILE_VERSION" --file-description "SFTPGo server" --product-name SFTPGo --copyright "2019-2025 Nicola Murino" --original-filename sftpgo.exe --icon .\windows-installer\icon.ico
+ go-winres simply --arch amd64 --product-version $Env:SFTPGO_VERSION-$GIT_COMMIT --file-version $FILE_VERSION --file-description "SFTPGo server" --product-name SFTPGo --copyright "AGPL-3.0 with additional terms" --original-filename sftpgo.exe --icon .\windows-installer\icon.ico
go build -trimpath -tags nopgxregisterdefaulttypes,disable_grpc_modules -ldflags "-s -w -X github.com/drakkan/sftpgo/v2/internal/version.commit=$GIT_COMMIT -X github.com/drakkan/sftpgo/v2/internal/version.date=$DATE_TIME" -o sftpgo.exe
mkdir arm64
$Env:CGO_ENABLED='0'
$Env:GOOS='windows'
$Env:GOARCH='arm64'
- go-winres simply --arch arm64 --product-version $Env:SFTPGO_VERSION-$GIT_COMMIT --file-version "$FILE_VERSION" --file-description "SFTPGo server" --product-name SFTPGo --copyright "2019-2025 Nicola Murino" --original-filename sftpgo.exe --icon .\windows-installer\icon.ico
+ go-winres simply --arch arm64 --product-version $Env:SFTPGO_VERSION-$GIT_COMMIT --file-version $FILE_VERSION --file-description "SFTPGo server" --product-name SFTPGo --copyright "AGPL-3.0 with additional terms" --original-filename sftpgo.exe --icon .\windows-installer\icon.ico
go build -trimpath -tags nopgxregisterdefaulttypes,disable_grpc_modules,nosqlite -ldflags "-s -w -X github.com/drakkan/sftpgo/v2/internal/version.commit=$GIT_COMMIT -X github.com/drakkan/sftpgo/v2/internal/version.date=$DATE_TIME" -o .\arm64\sftpgo.exe
mkdir x86
$Env:GOARCH='386'
- go-winres simply --arch 386 --product-version $Env:SFTPGO_VERSION-$GIT_COMMIT --file-version "$FILE_VERSION" --file-description "SFTPGo server" --product-name SFTPGo --copyright "2019-2025 Nicola Murino" --original-filename sftpgo.exe --icon .\windows-installer\icon.ico
+ go-winres simply --arch 386 --product-version $Env:SFTPGO_VERSION-$GIT_COMMIT --file-version $FILE_VERSION --file-description "SFTPGo server" --product-name SFTPGo --copyright "AGPL-3.0 with additional terms" --original-filename sftpgo.exe --icon .\windows-installer\icon.ico
go build -trimpath -tags nopgxregisterdefaulttypes,disable_grpc_modules,nosqlite -ldflags "-s -w -X github.com/drakkan/sftpgo/v2/internal/version.commit=$GIT_COMMIT -X github.com/drakkan/sftpgo/v2/internal/version.date=$DATE_TIME" -o .\x86\sftpgo.exe
Remove-Item Env:\CGO_ENABLED
Remove-Item Env:\GOOS
@@ -82,6 +90,30 @@ jobs:
env:
SFTPGO_VERSION: ${{ steps.get_version.outputs.VERSION }}
+ - name: Sign binaries
+ uses: azure/trusted-signing-action@v0.5.0
+ with:
+ endpoint: https://eus.codesigning.azure.net/
+ trusted-signing-account-name: nicola
+ certificate-profile-name: SFTPGo
+ files: |
+ ${{ github.workspace }}\sftpgo.exe
+ ${{ github.workspace }}\arm64\sftpgo.exe
+ ${{ github.workspace }}\x86\sftpgo.exe
+ file-digest: SHA256
+ timestamp-rfc3161: http://timestamp.acs.microsoft.com
+ timestamp-digest: SHA256
+ exclude-environment-credential: true
+ exclude-workload-identity-credential: true
+ exclude-managed-identity-credential: true
+ exclude-shared-token-cache-credential: true
+ exclude-visual-studio-credential: true
+ exclude-visual-studio-code-credential: true
+ exclude-azure-cli-credential: false
+ exclude-azure-powershell-credential: true
+ exclude-azure-developer-cli-credential: true
+ exclude-interactive-browser-credential: true
+
- name: Initialize data provider
run: ./sftpgo initprovider
shell: bash
@@ -120,6 +152,30 @@ jobs:
env:
SFTPGO_ISS_VERSION: ${{ steps.get_version.outputs.VERSION }}
+ - name: Sign installers
+ uses: azure/trusted-signing-action@v0.5.0
+ with:
+ endpoint: https://eus.codesigning.azure.net/
+ trusted-signing-account-name: nicola
+ certificate-profile-name: SFTPGo
+ files: |
+ ${{ github.workspace }}\sftpgo_windows_x86_64.exe
+ ${{ github.workspace }}\sftpgo_windows_arm64.exe
+ ${{ github.workspace }}\sftpgo_windows_x86.exe
+ file-digest: SHA256
+ timestamp-rfc3161: http://timestamp.acs.microsoft.com
+ timestamp-digest: SHA256
+ exclude-environment-credential: true
+ exclude-workload-identity-credential: true
+ exclude-managed-identity-credential: true
+ exclude-shared-token-cache-credential: true
+ exclude-visual-studio-credential: true
+ exclude-visual-studio-code-credential: true
+ exclude-azure-cli-credential: false
+ exclude-azure-powershell-credential: true
+ exclude-azure-developer-cli-credential: true
+ exclude-interactive-browser-credential: true
+
- name: Prepare Portable Release
run: |
mkdir win-portable
@@ -142,28 +198,28 @@ jobs:
Compress-Archive .\win-portable\* sftpgo_portable.zip
- name: Upload Windows installer x86_64 artifact
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.VERSION }}_windows_x86_64.exe
path: ./sftpgo_windows_x86_64.exe
retention-days: 1
- name: Upload Windows installer arm64 artifact
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.VERSION }}_windows_arm64.exe
path: ./sftpgo_windows_arm64.exe
retention-days: 1
- name: Upload Windows installer x86 artifact
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.VERSION }}_windows_x86.exe
path: ./sftpgo_windows_x86.exe
retention-days: 1
- name: Upload Windows portable artifact
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.VERSION }}_windows_portable.zip
path: ./sftpgo_portable.zip
@@ -171,12 +227,12 @@ jobs:
prepare-mac:
name: Prepare macOS binaries
- runs-on: macos-14
+ runs-on: macos-12
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v4
- name: Set up Go
- uses: actions/setup-go@v6
+ uses: actions/setup-go@v5
with:
go-version: ${{ env.GO_VERSION }}
@@ -225,14 +281,14 @@ jobs:
SFTPGO_VERSION: ${{ steps.get_version.outputs.VERSION }}
- name: Upload macOS x86_64 artifact
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.VERSION }}_macOS_x86_64.tar.xz
path: ./sftpgo_${{ steps.get_version.outputs.VERSION }}_macOS_x86_64.tar.xz
retention-days: 1
- name: Upload macOS arm64 artifact
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.VERSION }}_macOS_arm64.tar.xz
path: ./sftpgo_${{ steps.get_version.outputs.VERSION }}_macOS_arm64.tar.xz
@@ -270,7 +326,7 @@ jobs:
tar-arch: armv7
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v4
- name: Get versions
id: get_version
@@ -323,7 +379,7 @@ jobs:
env:
SFTPGO_VERSION: ${{ steps.get_version.outputs.SFTPGO_VERSION }}
- - uses: uraimo/run-on-arch-action@v3
+ - uses: uraimo/run-on-arch-action@v2
if: ${{ matrix.arch != 'amd64' }}
name: Build for ${{ matrix.arch }}
id: build
@@ -372,7 +428,7 @@ jobs:
cd ..
- name: Upload build artifact for ${{ matrix.arch }}
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_linux_${{ matrix.tar-arch }}.tar.xz
path: ./output/sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_linux_${{ matrix.tar-arch }}.tar.xz
@@ -390,14 +446,14 @@ jobs:
SFTPGO_VERSION: ${{ steps.get_version.outputs.SFTPGO_VERSION }}
- name: Upload Deb Package
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo_${{ steps.build_linux_pkgs.outputs.pkg-version }}-1_${{ matrix.deb-arch}}.deb
path: ./pkgs/dist/deb/sftpgo_${{ steps.build_linux_pkgs.outputs.pkg-version }}-1_${{ matrix.deb-arch}}.deb
retention-days: 1
- name: Upload RPM Package
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo-${{ steps.build_linux_pkgs.outputs.pkg-version }}-1.${{ matrix.rpm-arch}}.rpm
path: ./pkgs/dist/rpm/sftpgo-${{ steps.build_linux_pkgs.outputs.pkg-version }}-1.${{ matrix.rpm-arch}}.rpm
@@ -416,22 +472,22 @@ jobs:
shell: bash
- name: Download amd64 artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_linux_x86_64.tar.xz
- name: Download arm64 artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_linux_arm64.tar.xz
- name: Download ppc64le artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_linux_ppc64le.tar.xz
- name: Download armv7 artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_linux_armv7.tar.xz
@@ -454,7 +510,7 @@ jobs:
SFTPGO_VERSION: ${{ steps.get_version.outputs.SFTPGO_VERSION }}
- name: Upload Linux bundle
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_linux_bundle.tar.xz
path: ./bundle/sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_linux_bundle.tar.xz
@@ -466,7 +522,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v4
- name: Get versions
id: get_version
run: |
@@ -477,102 +533,102 @@ jobs:
shell: bash
- name: Download amd64 artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_linux_x86_64.tar.xz
- name: Download arm64 artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_linux_arm64.tar.xz
- name: Download ppc64le artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_linux_ppc64le.tar.xz
- name: Download armv7 artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_linux_armv7.tar.xz
- name: Download Linux bundle artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_linux_bundle.tar.xz
- name: Download Deb amd64 artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.PKG_VERSION }}-1_amd64.deb
- name: Download Deb arm64 artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.PKG_VERSION }}-1_arm64.deb
- name: Download Deb ppc64le artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.PKG_VERSION }}-1_ppc64el.deb
- name: Download Deb armv7 artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.PKG_VERSION }}-1_armhf.deb
- name: Download RPM x86_64 artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo-${{ steps.get_version.outputs.PKG_VERSION }}-1.x86_64.rpm
- name: Download RPM aarch64 artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo-${{ steps.get_version.outputs.PKG_VERSION }}-1.aarch64.rpm
- name: Download RPM ppc64le artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo-${{ steps.get_version.outputs.PKG_VERSION }}-1.ppc64le.rpm
- name: Download RPM armv7 artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo-${{ steps.get_version.outputs.PKG_VERSION }}-1.armv7hl.rpm
- name: Download macOS x86_64 artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_macOS_x86_64.tar.xz
- name: Download macOS arm64 artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_macOS_arm64.tar.xz
- name: Download Windows installer x86_64 artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_windows_x86_64.exe
- name: Download Windows installer arm64 artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_windows_arm64.exe
- name: Download Windows installer x86 artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_windows_x86.exe
- name: Download Windows portable artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_windows_portable.zip
- name: Download source with deps artifact
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@v4
with:
name: sftpgo_${{ steps.get_version.outputs.SFTPGO_VERSION }}_src_with_deps.tar.xz
diff --git a/.golangci.yml b/.golangci.yml
index 14f9c1f9..ac545673 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,66 +1,52 @@
-version: "2"
run:
+ timeout: 10m
issues-exit-code: 1
tests: true
+
+
+linters-settings:
+ dupl:
+ threshold: 150
+ errcheck:
+ check-type-assertions: false
+ check-blank: false
+ goconst:
+ min-len: 3
+ min-occurrences: 3
+ gocyclo:
+ min-complexity: 15
+ gofmt:
+ simplify: true
+ goimports:
+ local-prefixes: github.com/drakkan/sftpgo
+ #govet:
+ # report about shadowed variables
+ #check-shadowing: true
+ #enable:
+ # - fieldalignment
+
+issues:
+ include:
+ - EXC0002
+ - EXC0012
+ - EXC0013
+ - EXC0014
+ - EXC0015
+
linters:
enable:
- - bodyclose
- - dogsled
- - dupl
- goconst
- - gocyclo
- - misspell
- - revive
- - rowserrcheck
- - unconvert
- - unparam
- - whitespace
- settings:
- dupl:
- threshold: 150
- errcheck:
- check-type-assertions: false
- check-blank: false
- goconst:
- min-len: 3
- min-occurrences: 3
- gocyclo:
- min-complexity: 15
- # https://golangci-lint.run/usage/linters/#revive
- revive:
- rules:
- - name: var-naming
- severity: warning
- disabled: true
- exclude: [""]
- arguments:
- - ["ID"] # AllowList
- - ["VM"] # DenyList
- - - upper-case-const: true
- - - skip-package-name-checks: true
- exclusions:
- generated: lax
- presets:
- - common-false-positives
- - legacy
- - std-error-handling
- paths:
- - third_party$
- - builtin$
- - examples$
-formatters:
- enable:
+ - errcheck
- gofmt
- goimports
- settings:
- gofmt:
- simplify: true
- goimports:
- local-prefixes:
- - github.com/drakkan/sftpgo
- exclusions:
- generated: lax
- paths:
- - third_party$
- - builtin$
- - examples$
+ - revive
+ - unconvert
+ - unparam
+ - bodyclose
+ - gocyclo
+ - misspell
+ - whitespace
+ - dupl
+ - rowserrcheck
+ - dogsled
+ - govet
diff --git a/Dockerfile b/Dockerfile
index 65371870..bd26b684 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26-trixie AS builder
+FROM golang:1.22-bookworm as builder
ENV GOFLAGS="-mod=readonly"
@@ -10,7 +10,7 @@ WORKDIR /workspace
ARG GOPROXY
COPY go.mod go.sum ./
-RUN go mod download && go mod verify
+RUN go mod download
ARG COMMIT_SHA
@@ -30,14 +30,14 @@ ARG DOWNLOAD_PLUGINS=false
RUN if [ "${DOWNLOAD_PLUGINS}" = "true" ]; then apt-get update && apt-get install --no-install-recommends -y curl && ./docker/scripts/download-plugins.sh; fi
-FROM debian:trixie-slim
+FROM debian:bookworm-slim
-# Set to "true" to install jq
+# Set to "true" to install jq and the optional git and rsync dependencies
ARG INSTALL_OPTIONAL_PACKAGES=false
RUN apt-get update && apt-get -y upgrade && apt-get install --no-install-recommends -y ca-certificates media-types && rm -rf /var/lib/apt/lists/*
-RUN if [ "${INSTALL_OPTIONAL_PACKAGES}" = "true" ]; then apt-get update && apt-get install --no-install-recommends -y jq && rm -rf /var/lib/apt/lists/*; fi
+RUN if [ "${INSTALL_OPTIONAL_PACKAGES}" = "true" ]; then apt-get update && apt-get install --no-install-recommends -y jq git rsync && rm -rf /var/lib/apt/lists/*; fi
RUN mkdir -p /etc/sftpgo /var/lib/sftpgo /usr/share/sftpgo /srv/sftpgo/data /srv/sftpgo/backups
diff --git a/Dockerfile.alpine b/Dockerfile.alpine
index 494442dc..3b9f82f5 100644
--- a/Dockerfile.alpine
+++ b/Dockerfile.alpine
@@ -1,4 +1,4 @@
-FROM golang:1.26-alpine3.23 AS builder
+FROM golang:1.22-alpine3.19 AS builder
ENV GOFLAGS="-mod=readonly"
@@ -10,7 +10,7 @@ WORKDIR /workspace
ARG GOPROXY
COPY go.mod go.sum ./
-RUN go mod download && go mod verify
+RUN go mod download
ARG COMMIT_SHA
@@ -25,14 +25,14 @@ RUN set -xe && \
export COMMIT_SHA=${COMMIT_SHA:-$(git describe --always --abbrev=8 --dirty)} && \
go build $(if [ -n "${FEATURES}" ]; then echo "-tags ${FEATURES}"; fi) -trimpath -ldflags "-s -w -X github.com/drakkan/sftpgo/v2/internal/version.commit=${COMMIT_SHA} -X github.com/drakkan/sftpgo/v2/internal/version.date=`date -u +%FT%TZ`" -v -o sftpgo
-FROM alpine:3.23
+FROM alpine:3.19
-# Set to "true" to install jq
+# Set to "true" to install jq and the optional git and rsync dependencies
ARG INSTALL_OPTIONAL_PACKAGES=false
RUN apk -U upgrade --no-cache && apk add --update --no-cache ca-certificates tzdata mailcap
-RUN if [ "${INSTALL_OPTIONAL_PACKAGES}" = "true" ]; then apk add --update --no-cache jq; fi
+RUN if [ "${INSTALL_OPTIONAL_PACKAGES}" = "true" ]; then apk add --update --no-cache jq git rsync; fi
RUN mkdir -p /etc/sftpgo /var/lib/sftpgo /usr/share/sftpgo /srv/sftpgo/data /srv/sftpgo/backups
diff --git a/Dockerfile.distroless b/Dockerfile.distroless
index 36bc1406..a88e2fc4 100644
--- a/Dockerfile.distroless
+++ b/Dockerfile.distroless
@@ -1,4 +1,4 @@
-FROM golang:1.26-trixie AS builder
+FROM golang:1.22-bookworm as builder
ENV CGO_ENABLED=0 GOFLAGS="-mod=readonly"
@@ -10,7 +10,7 @@ WORKDIR /workspace
ARG GOPROXY
COPY go.mod go.sum ./
-RUN go mod download && go mod verify
+RUN go mod download
ARG COMMIT_SHA
@@ -32,7 +32,7 @@ RUN sed -i 's|"users_base_dir": "",|"users_base_dir": "/srv/sftpgo/data",|' sftp
RUN mkdir /etc/sftpgo /var/lib/sftpgo /srv/sftpgo
-FROM gcr.io/distroless/static-debian13
+FROM gcr.io/distroless/static-debian12
COPY --from=builder --chown=1000:1000 /etc/sftpgo /etc/sftpgo
COPY --from=builder --chown=1000:1000 /srv/sftpgo /srv/sftpgo
diff --git a/README.md b/README.md
index bee0bc4f..7971c843 100644
--- a/README.md
+++ b/README.md
@@ -1,51 +1,27 @@
# SFTPGo
-[](https://github.com/drakkan/sftpgo/workflows/CI/badge.svg)
+[](https://github.com/drakkan/sftpgo/workflows/CI/badge.svg?branch=main&event=push)
+[](https://codecov.io/gh/drakkan/sftpgo/branch/main)
[](https://www.gnu.org/licenses/agpl-3.0)
[](https://github.com/avelino/awesome-go)
-Full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. Storage backends: local filesystem, encrypted local filesystem, S3 (compatible) Object Storage, Google Cloud Storage, Azure Blob Storage, other SFTP servers.
+Full-featured and highly configurable event-driven file transfer solution.
+Server protocols: SFTP, HTTP/S, FTP/S, WebDAV.
+Storage backends: local filesystem, encrypted local filesystem, S3 (compatible) Object Storage, Google Cloud Storage, Azure Blob Storage, other SFTP servers.
With SFTPGo you can leverage local and cloud storage backends for exchanging and storing files internally or with business partners using the same tools and processes you are already familiar with.
-## Project Status & Editions
+The WebAdmin UI allows to easily create and manage your users, folders, groups and other resources.
-SFTPGo is an open-source project with a sustainable business model. We offer two editions to suit different requirements, ensuring the project remains healthy and maintained for everyone.
-
-### Open Source (Community)
-
-Free, Copyleft (AGPLv3), Community Supported. The Community edition is a fully functional, production-ready solution widely adopted worldwide. It includes all the core protocols, storage backends, and the WebAdmin/WebClient UIs. It is ideal for:
-
-- Standard file transfer needs.
-- Integrating storage backends (S3, GCS, Azure Blob) with legacy protocols.
-- Projects that are comfortable with AGPLv3 licensing.
-
-### SFTPGo Enterprise
-
-Commercial License, Professional Support, ISO 27001 Vendor. The Enterprise edition is built on the same core but extends it for mission-critical environments, compliance-heavy industries, and advanced workflows. It is a drop-in replacement (seamless upgrade).
-
-| Feature | Open Source (Community) | Enterprise Edition |
-| :--- | :--- | :--- |
-| **License Type** | AGPLv3 (Copyleft) | **Commercial License**
Proprietary/No Copyleft |
-| **Vendor Compliance** | Not Applicable
Community Project | **Certified Vendor**
ISO 27001 & Supply Chain Validation |
-| **Support** | Community (GitHub) | **Direct from Authors** |
-| **Cloud Storage Engine** | Standard | **High Performance & Scalable**
In-memory streaming (no local temp files) and up to 70% faster |
-| **High Availability (HA)** | Standard
Shared DB & Storage | **Advanced**
Enhanced event handling and optimized instance coordination |
-| **Automation Logic** | Simple Placeholders | **Dynamic Logic & Virtual Folders**
Conditions, loops, route data across storage backends |
-| **Data Lifecycle** | Delete / Retain | **Smart Archiving**
Move data to external Cloud/SFTP storage via Virtual Folders |
-| **Email Data Ingestion** | - | **Native IMAP Integration**
Auto-extract attachments from email to storage |
-| **Public Sharing** | Standard Links | **Advanced & Collaborative**
Email Authentication & Group Delegation |
-| **Data Protection** | - | **Encryption & Scanning**
Automated PGP, Antivirus & DLP via ICAP |
-| **Advanced Identity (SSO)** | Standard | **Extended Controls**
Advanced Single Sign-On parameters |
-| **Document Editing** | - | **Included**
View, edit, and co-author in browser |
-
-**Note**: We are committed to keeping the Open Source edition powerful and maintained. The Enterprise edition helps fund the development of the entire SFTPGo ecosystem.
+The WebClient UI allows end users to change their credentials, browse and manage their files in the browser and setup two-factor authentication which works with Microsoft Authenticator, Google Authenticator, Authy and other compatible apps.
## Sponsors
-If you rely on SFTPGo in your projects, consider becoming a [sponsor](https://github.com/sponsors/drakkan).
+We strongly believe in Open Source software model, so we decided to make SFTPGo available to everyone, but maintaining and evolving SFTPGo takes a lot of time and work. To make development and maintenance sustainable you should consider to support the project with a [sponsorship](https://github.com/sponsors/drakkan).
-Your sponsorship helps cover maintenance, security updates and ongoing development of the open-source edition.
+We love doing the work and we'd like to keep doing it - your support helps make SFTPGo possible.
+
+It is important to understand that you should support SFTPGo and any other Open Source project you rely on for ongoing maintenance, even if you don't have any questions or need new features, to mitigate the business risk of a project you depend on going unmaintained, with its security and development velocity implications.
### Thank you to our sponsors
@@ -65,39 +41,26 @@ Your sponsorship helps cover maintenance, security updates and ongoing developme
[
](https://www.7digital.com/)
-[
](https://servinga.com/)
-
-[
](https://www.reui.io/)
-
-## Documentation
-
-You can explore all supported features and configuration options at [docs.sftpgo.com](https://docs.sftpgo.com/latest/).
-
-**Note:** The link above refers to the **Community Edition**.
-For details on **Enterprise Edition**, please refer to the [Enterprise Documentation](https://docs.sftpgo.com/enterprise/).
+[
](https://www.vps2day.com/)
## Support
-- **Community Support**: use [GitHub Discussions](https://github.com/drakkan/sftpgo/discussions) to ask questions, share feedback, and engage with other users.
-- **Commercial Support**: If you require guaranteed SLAs, expert guidance, or the advanced features listed above, check out [SFTPGo Enterprise](https://sftpgo.com).
+You can use SFTPGo for free, respecting the obligations of the Open Source [license](#license), but please do not ask or expect free support as well.
-SFTPGo Enterprise is available as:
+Use [discussions](https://github.com/drakkan/sftpgo/discussions) to ask questions and get support from the community.
-- On-premises: Full control on your infrastructure. More details: [sftpgo.com/on-premises](https://sftpgo.com/on-premises)
-- Fully managed SaaS: We handle the infrastructure. More details: [sftpgo.com/saas](https://sftpgo.com/saas)
+We offer commercial support, guarantees, and advice for SFTPGo:
-## Internationalization
+- With our [plans](https://sftpgo.com/plans) you can safely install and use SFTPGo on-premise in professional environments.
+- With our [SaaS offerings](https://sftpgo.com/saas) you can use SFTPGo hosted in the cloud, fully managed and supported.
-The translations are available via [Crowdin](https://crowdin.com/project/sftpgo), who have granted us an open source license.
+## Documentation
-Before translating please take a look at our contribution [guidelines](https://docs.sftpgo.com/latest/web-interfaces/#internationalization).
+You can read more about supported features and documentation at [docs.sftpgo.com](https://docs.sftpgo.com/).
## Release Cadence
-SFTPGo follows a feature-driven release cycle.
-
-- Enterprise Edition: Receives major new features first and follows a faster [release cadence](https://docs.sftpgo.com/enterprise/changelog/).
-- Community Edition: Remains maintained, receiving bug fixes, security updates, and updates to core features.
+SFTPGo releases are feature-driven, we don't have a fixed time based schedule. As a rough estimate, you can expect 1 or 2 new major releases per year and several bug fix releases.
## Acknowledgements
@@ -107,7 +70,7 @@ We are very grateful to all the people who contributed with ideas and/or pull re
Thank you to [ysura](https://www.ysura.com/) for granting us stable access to a test AWS S3 account.
-Thank you to [KeenThemes](https://keenthemes.com/) for granting us a custom license to use their amazing [themes](https://keenthemes.com/bootstrap-templates) for the SFTPGo WebAdmin and WebClient user interfaces, across both the Open Source and Open Core versions.
+Thank you to [KeenThemes](https://keenthemes.com/) for granting us a custom license to use their amazing [Mega Bundle](https://keenthemes.com/products/templates-mega-bundle) for SFTPGo UI.
Thank you to [Crowdin](https://crowdin.com/) for granting us an Open Source License.
@@ -117,15 +80,13 @@ Thank you to [Incode](https://www.incode.it/) for helping us to improve the UI/U
SFTPGo source code is licensed under the GNU AGPL-3.0-only with [additional terms](./NOTICE).
-The [theme](https://keenthemes.com/bootstrap-templates) used in WebAdmin and WebClient user interfaces is proprietary, this means:
+The [theme](https://keenthemes.com/products/templates-mega-bundle) used in WebAdmin and WebClient user interfaces is proprietary, this means:
- KeenThemes HTML/CSS/JS components are allowed for use only within the SFTPGo product and restricted to be used in a resealable HTML template that can compete with KeenThemes products anyhow.
- The SFTPGo WebAdmin and WebClient user interfaces (HTML, CSS and JS components) based on this theme are allowed for use only within the SFTPGo product and therefore cannot be used in derivative works/products without an explicit grant from the [SFTPGo Team](mailto:support@sftpgo.com).
More information about [compliance](https://sftpgo.com/compliance.html).
-**Note:** We do not provide legal advice. If you have questions about license compliance or whether your use case is permitted under the license terms, please consult your legal team.
-
## Copyright
-Copyright (C) 2019 - 2026 Nicola Murino
+Copyright (C) 2019 Nicola Murino
diff --git a/SECURITY.md b/SECURITY.md
index 01650ca6..05e5daf7 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -2,18 +2,8 @@
## Supported Versions
-We actively maintain the latest stable release of SFTPGo. While we strive to keep the Open Source version secure and up-to-date, maintenance is performed on a best-effort basis by the community and contributors.
-
-## Scope and Dependency Policy
-
-Our security advisories focus on vulnerabilities found within the **SFTPGo codebase itself**.
-
-To ensure the long-term sustainability of the project, we handle upstream dependencies (like the Go standard library, external packages, or Docker base images) as follows:
-
-- Community Updates: For the Open Source version, vulnerabilities in upstream components (such as the Go standard library or third-party packages) are addressed during our **regular release cycles**. We generally do not provide immediate, out-of-band or ad-hoc releases to address dependency-only CVEs.
-- Empowering Users: One of the strengths of SFTPGo being open-source is that you have full control. If your security scanners require an immediate fix, you can always rebuild the project using the latest patched Go toolchain or updated dependencies.
-- Compatibility: We are committed to keeping SFTPGo compatible with the latest stable Go compiler. If an upstream fix breaks SFTPGo, fixing that becomes a priority for us.
-- Professional Needs: We understand that some organizations have strict compliance requirements or internal SLAs that require guaranteed, immediate response times and out-of-band patches. For these cases, we offer [SFTPGo Enterprise](https://sftpgo.com/on-premises) to cover the additional maintenance and support overhead.
+Only the current release of the software is actively supported.
+[Contact us](mailto:support@sftpgo.com) if you need early security patches and enterprise-grade security.
## Reporting a Vulnerability
diff --git a/docker/scripts/download-plugins.sh b/docker/scripts/download-plugins.sh
index 7638cd56..6d9cbdd0 100755
--- a/docker/scripts/download-plugins.sh
+++ b/docker/scripts/download-plugins.sh
@@ -1,13 +1,13 @@
#!/usr/bin/env bash
-set -euo pipefail
+set -e
-ARCH=$(uname -m)
+ARCH=`uname -m`
case ${ARCH} in
- x86_64)
+ "x86_64")
SUFFIX=amd64
;;
- aarch64)
+ "aarch64")
SUFFIX=arm64
;;
*)
@@ -15,21 +15,11 @@ case ${ARCH} in
;;
esac
-echo "Downloading plugins for arch ${SUFFIX}"
+echo "download plugins for arch ${SUFFIX}"
-PLUGINS=(geoipfilter kms pubsub eventstore eventsearch auth)
-
-for PLUGIN in "${PLUGINS[@]}"; do
- URL="https://github.com/sftpgo/sftpgo-plugin-${PLUGIN}/releases/latest/download/sftpgo-plugin-${PLUGIN}-linux-${SUFFIX}"
- DEST="/usr/local/bin/sftpgo-plugin-${PLUGIN}"
-
- echo "Downloading ${PLUGIN}..."
- if curl --fail --silent --show-error -L "${URL}" --output "${DEST}"; then
- chmod 755 "${DEST}"
- else
- echo "Error: Failed to download ${PLUGIN}" >&2
- exit 1
- fi
+for PLUGIN in geoipfilter kms pubsub eventstore eventsearch auth
+do
+ echo "download plugin from https://github.com/sftpgo/sftpgo-plugin-${PLUGIN}/releases/latest/download/sftpgo-plugin-${PLUGIN}-linux-${SUFFIX}"
+ curl -L "https://github.com/sftpgo/sftpgo-plugin-${PLUGIN}/releases/latest/download/sftpgo-plugin-${PLUGIN}-linux-${SUFFIX}" --output "/usr/local/bin/sftpgo-plugin-${PLUGIN}"
+ chmod 755 "/usr/local/bin/sftpgo-plugin-${PLUGIN}"
done
-
-echo "All plugins downloaded successfully"
diff --git a/examples/data-retention/README.md b/examples/data-retention/README.md
new file mode 100644
index 00000000..ca1c7679
--- /dev/null
+++ b/examples/data-retention/README.md
@@ -0,0 +1,36 @@
+# File retention policies
+
+:warning: Since v2.4.0 you can use the [EventManager](https://docs.sftpgo.com/latest/eventmanager/) to schedule data retention checks.
+
+The `checkretention` example script shows how to use the SFTPGo REST API to manage data retention.
+
+:warning: Deleting files is an irreversible action, please make sure you fully understand what you are doing before using this feature, you may have users with overlapping home directories or virtual folders shared between multiple users, it is relatively easy to inadvertently delete files you need.
+
+The example shows how to setup a really simple retention policy, for each user it sends this request:
+
+```json
+[
+ {
+ "path": "/",
+ "retention": 168,
+ "delete_empty_dirs": true,
+ "ignore_user_permissions": false
+ }
+]
+```
+
+so alls files with modification time older than 168 hours (7 days) will be deleted. Empty directories will be removed and the check will respect user's permissions, so if the user cannot delete a file/folder it will be skipped.
+
+You can define different retention policies per-user and per-folder and you can exclude a folder setting the retention to `0`.
+
+You can use this script as a starting point, please edit it according to your needs.
+
+The script is written in Python and has the following requirements:
+
+- python3 or python2
+- python [Requests](https://requests.readthedocs.io/en/master/) module
+
+The provided example tries to connect to an SFTPGo instance running on `127.0.0.1:8080` using the following credentials:
+
+- username: `admin`
+- password: `password`
diff --git a/examples/data-retention/checkretention b/examples/data-retention/checkretention
new file mode 100755
index 00000000..1474b073
--- /dev/null
+++ b/examples/data-retention/checkretention
@@ -0,0 +1,115 @@
+#!/usr/bin/env python
+
+from datetime import datetime
+import sys
+import time
+
+import pytz
+import requests
+
+try:
+ import urllib.parse as urlparse
+except ImportError:
+ import urlparse
+
+# change base_url to point to your SFTPGo installation
+base_url = "http://127.0.0.1:8080"
+# set to False if you want to skip TLS certificate validation
+verify_tls_cert = True
+# set the credentials for a valid admin here
+admin_user = "admin"
+admin_password = "password"
+
+
+class CheckRetention:
+
+ def __init__(self):
+ self.limit = 100
+ self.offset = 0
+ self.access_token = ""
+ self.access_token_expiration = None
+
+ def printLog(self, message):
+ print("{} - {}".format(datetime.now(), message))
+
+ def checkAccessToken(self):
+ if self.access_token != "" and self.access_token_expiration:
+ expire_diff = self.access_token_expiration - datetime.now(tz=pytz.UTC)
+ # we don't use total_seconds to be python 2 compatible
+ seconds_to_expire = expire_diff.days * 86400 + expire_diff.seconds
+ if seconds_to_expire > 180:
+ return
+
+ auth = requests.auth.HTTPBasicAuth(admin_user, admin_password)
+ r = requests.get(urlparse.urljoin(base_url, "api/v2/token"), auth=auth, verify=verify_tls_cert, timeout=10)
+ if r.status_code != 200:
+ self.printLog("error getting access token: {}".format(r.text))
+ sys.exit(1)
+ self.access_token = r.json()["access_token"]
+ self.access_token_expiration = pytz.timezone("UTC").localize(datetime.strptime(r.json()["expires_at"],
+ "%Y-%m-%dT%H:%M:%SZ"))
+
+ def getAuthHeader(self):
+ self.checkAccessToken()
+ return {"Authorization": "Bearer " + self.access_token}
+
+ def waitForRentionCheck(self, username):
+ while True:
+ auth_header = self.getAuthHeader()
+ r = requests.get(urlparse.urljoin(base_url, "api/v2/retention/users/checks"), headers=auth_header, verify=verify_tls_cert,
+ timeout=10)
+ if r.status_code != 200:
+ self.printLog("error getting retention checks while waiting for {}: {}".format(username, r.text))
+ sys.exit(1)
+
+ checking = False
+ for check in r.json():
+ if check["username"] == username:
+ checking = True
+ if not checking:
+ break
+ self.printLog("waiting for the retention check to complete for user {}".format(username))
+ time.sleep(2)
+
+ self.printLog("retention check for user {} finished".format(username))
+
+ def checkUserRetention(self, username):
+ self.printLog("starting retention check for user {}".format(username))
+ auth_header = self.getAuthHeader()
+ retention = [
+ {
+ "path": "/",
+ "retention": 168,
+ "delete_empty_dirs": True,
+ "ignore_user_permissions": False
+ }
+ ]
+ r = requests.post(urlparse.urljoin(base_url, "api/v2/retention/users/" + username + "/check"), headers=auth_header,
+ json=retention, verify=verify_tls_cert, timeout=10)
+ if r.status_code != 202:
+ self.printLog("error starting retention check for user {}: {}".format(username, r.text))
+ sys.exit(1)
+ self.waitForRentionCheck(username)
+
+ def checkUsersRetention(self):
+ while True:
+ self.printLog("get users, limit {} offset {}".format(self.limit, self.offset))
+ auth_header = self.getAuthHeader()
+ payload = {"limit":self.limit, "offset":self.offset}
+ r = requests.get(urlparse.urljoin(base_url, "api/v2/users"), headers=auth_header, params=payload,
+ verify=verify_tls_cert, timeout=10)
+ if r.status_code != 200:
+ self.printLog("error getting users: {}".format(r.text))
+ sys.exit(1)
+ users = r.json()
+ for user in users:
+ self.checkUserRetention(user["username"])
+
+ self.offset += len(users)
+ if len(users) < self.limit:
+ break
+
+
+if __name__ == '__main__':
+ c = CheckRetention()
+ c.checkUsersRetention()
diff --git a/examples/ldapauth/go.mod b/examples/ldapauth/go.mod
index 81df3ad5..4b04e152 100644
--- a/examples/ldapauth/go.mod
+++ b/examples/ldapauth/go.mod
@@ -1,15 +1,15 @@
module github.com/drakkan/ldapauth
-go 1.25.0
+go 1.22.2
require (
- github.com/go-ldap/ldap/v3 v3.4.12
- golang.org/x/crypto v0.45.0
+ github.com/go-ldap/ldap/v3 v3.4.8
+ golang.org/x/crypto v0.23.0
)
require (
- github.com/Azure/go-ntlmssp v0.1.0 // indirect
- github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
+ github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
+ github.com/go-asn1-ber/asn1-ber v1.5.7 // indirect
github.com/google/uuid v1.6.0 // indirect
- golang.org/x/sys v0.38.0 // indirect
+ golang.org/x/sys v0.20.0 // indirect
)
diff --git a/examples/ldapauth/go.sum b/examples/ldapauth/go.sum
index 67fe852a..6c72d1cd 100644
--- a/examples/ldapauth/go.sum
+++ b/examples/ldapauth/go.sum
@@ -1,15 +1,20 @@
-github.com/Azure/go-ntlmssp v0.1.0 h1:DjFo6YtWzNqNvQdrwEyr/e4nhU3vRiwenz5QX7sFz+A=
-github.com/Azure/go-ntlmssp v0.1.0/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
-github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e h1:4dAU9FXIyQktpoUAgOJK3OTFc/xug0PCXYCqU0FgDKI=
-github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
-github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-ldap/ldap/v3 v3.4.12 h1:1b81mv7MagXZ7+1r7cLTWmyuTqVqdwbtJSjC0DAp9s4=
-github.com/go-ldap/ldap/v3 v3.4.12/go.mod h1:+SPAGcTtOfmGsCb3h1RFiq4xpp4N636G75OEace8lNo=
+github.com/go-asn1-ber/asn1-ber v1.5.5/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-asn1-ber/asn1-ber v1.5.7 h1:DTX+lbVTWaTw1hQ+PbZPlnDZPEIs0SS/GCZAl535dDk=
+github.com/go-asn1-ber/asn1-ber v1.5.7/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-ldap/ldap/v3 v3.4.8 h1:loKJyspcRezt2Q3ZRMq2p/0v8iOurlmeXDPw6fikSvQ=
+github.com/go-ldap/ldap/v3 v3.4.8/go.mod h1:qS3Sjlu76eHfHGpUdWkAXQTw4beih+cHsco2jXlIXrk=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
+github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
+github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
@@ -26,15 +31,69 @@ github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZ
github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
-golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
-golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
-golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
-golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
+golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.22.0 h1:9sGLhx7iRIHEiX0oAJ3MRZMUCElJgy7Br1nO+AMN3Tc=
+golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
+golang.org/x/term v0.20.0 h1:VnkxpohqXaOBYJtBmEppKUG6mXpi+4O6purfc2+sMhw=
+golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/examples/ldapauthserver/go.mod b/examples/ldapauthserver/go.mod
index f65828cc..3b5fcf73 100644
--- a/examples/ldapauthserver/go.mod
+++ b/examples/ldapauthserver/go.mod
@@ -1,37 +1,43 @@
module github.com/drakkan/sftpgo/ldapauthserver
-go 1.25.0
+go 1.22.2
require (
- github.com/go-chi/chi/v5 v5.2.3
+ github.com/go-chi/chi/v5 v5.0.12
github.com/go-chi/render v1.0.3
- github.com/go-ldap/ldap/v3 v3.4.12
+ github.com/go-ldap/ldap/v3 v3.4.8
github.com/nathanaelle/password/v2 v2.0.1
- github.com/rs/zerolog v1.34.0
- github.com/spf13/cobra v1.10.1
- github.com/spf13/viper v1.21.0
- golang.org/x/crypto v0.45.0
+ github.com/rs/zerolog v1.32.0
+ github.com/spf13/cobra v1.8.0
+ github.com/spf13/viper v1.18.2
+ golang.org/x/crypto v0.23.0
gopkg.in/natefinch/lumberjack.v2 v2.2.1
)
require (
- github.com/Azure/go-ntlmssp v0.1.0 // indirect
+ github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
github.com/ajg/form v1.5.1 // indirect
- github.com/fsnotify/fsnotify v1.9.0 // indirect
- github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
- github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+ github.com/fsnotify/fsnotify v1.7.0 // indirect
+ github.com/go-asn1-ber/asn1-ber v1.5.7 // indirect
github.com/google/uuid v1.6.0 // indirect
+ github.com/hashicorp/hcl v1.0.0 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
- github.com/mattn/go-colorable v0.1.14 // indirect
+ github.com/magiconair/properties v1.8.7 // indirect
+ github.com/mattn/go-colorable v0.1.13 // indirect
github.com/mattn/go-isatty v0.0.20 // indirect
- github.com/pelletier/go-toml/v2 v2.2.4 // indirect
- github.com/sagikazarmark/locafero v0.12.0 // indirect
- github.com/spf13/afero v1.15.0 // indirect
- github.com/spf13/cast v1.10.0 // indirect
- github.com/spf13/pflag v1.0.10 // indirect
+ github.com/mitchellh/mapstructure v1.5.0 // indirect
+ github.com/pelletier/go-toml/v2 v2.2.2 // indirect
+ github.com/sagikazarmark/locafero v0.4.0 // indirect
+ github.com/sagikazarmark/slog-shim v0.1.0 // indirect
+ github.com/sourcegraph/conc v0.3.0 // indirect
+ github.com/spf13/afero v1.11.0 // indirect
+ github.com/spf13/cast v1.6.0 // indirect
+ github.com/spf13/pflag v1.0.5 // indirect
github.com/subosito/gotenv v1.6.0 // indirect
- go.yaml.in/yaml/v3 v3.0.4 // indirect
- golang.org/x/sys v0.38.0 // indirect
- golang.org/x/text v0.31.0 // indirect
- gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
+ go.uber.org/multierr v1.11.0 // indirect
+ golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 // indirect
+ golang.org/x/sys v0.20.0 // indirect
+ golang.org/x/text v0.15.0 // indirect
+ gopkg.in/ini.v1 v1.67.0 // indirect
+ gopkg.in/yaml.v3 v3.0.1 // indirect
)
diff --git a/examples/ldapauthserver/go.sum b/examples/ldapauthserver/go.sum
index 99ea3a37..a16640f3 100644
--- a/examples/ldapauthserver/go.sum
+++ b/examples/ldapauthserver/go.sum
@@ -1,34 +1,40 @@
-github.com/Azure/go-ntlmssp v0.1.0 h1:DjFo6YtWzNqNvQdrwEyr/e4nhU3vRiwenz5QX7sFz+A=
-github.com/Azure/go-ntlmssp v0.1.0/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
github.com/ajg/form v1.5.1 h1:t9c7v8JUKu/XxOGBU0yjNpaMloxGEJhUkqFRq0ibGeU=
github.com/ajg/form v1.5.1/go.mod h1:uL1WgH+h2mgNtvBq0339dVnzXdBETtL2LeUXaIv25UY=
-github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e h1:4dAU9FXIyQktpoUAgOJK3OTFc/xug0PCXYCqU0FgDKI=
-github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
-github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
-github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-chi/chi/v5 v5.2.3 h1:WQIt9uxdsAbgIYgid+BpYc+liqQZGMHRaUwp0JUcvdE=
-github.com/go-chi/chi/v5 v5.2.3/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
+github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
+github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
+github.com/go-asn1-ber/asn1-ber v1.5.5/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-asn1-ber/asn1-ber v1.5.7 h1:DTX+lbVTWaTw1hQ+PbZPlnDZPEIs0SS/GCZAl535dDk=
+github.com/go-asn1-ber/asn1-ber v1.5.7/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-chi/chi/v5 v5.0.12 h1:9euLV5sTrTNTRUU9POmDUvfxyj6LAABLUcEWO+JJb4s=
+github.com/go-chi/chi/v5 v5.0.12/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
github.com/go-chi/render v1.0.3 h1:AsXqd2a1/INaIfUSKq3G5uA8weYx20FOsM7uSoCyyt4=
github.com/go-chi/render v1.0.3/go.mod h1:/gr3hVkmYR0YlEy3LxCuVRFzEu9Ruok+gFqbIofjao0=
-github.com/go-ldap/ldap/v3 v3.4.12 h1:1b81mv7MagXZ7+1r7cLTWmyuTqVqdwbtJSjC0DAp9s4=
-github.com/go-ldap/ldap/v3 v3.4.12/go.mod h1:+SPAGcTtOfmGsCb3h1RFiq4xpp4N636G75OEace8lNo=
-github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
-github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-ldap/ldap/v3 v3.4.8 h1:loKJyspcRezt2Q3ZRMq2p/0v8iOurlmeXDPw6fikSvQ=
+github.com/go-ldap/ldap/v3 v3.4.8/go.mod h1:qS3Sjlu76eHfHGpUdWkAXQTw4beih+cHsco2jXlIXrk=
github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
+github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
+github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
+github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
@@ -47,68 +53,132 @@ github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
+github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
-github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
github.com/nathanaelle/password/v2 v2.0.1 h1:ItoCTdsuIWzilYmllQPa3DR3YoCXcpfxScWLqr8Ii2s=
github.com/nathanaelle/password/v2 v2.0.1/go.mod h1:eaoT+ICQEPNtikBRIAatN8ThWwMhVG+r1jTw60BvPJk=
-github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
-github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pelletier/go-toml/v2 v2.2.2 h1:aYUidT7k73Pcl9nb2gScu7NSrKCSHIDE89b3+6Wq+LM=
+github.com/pelletier/go-toml/v2 v2.2.2/go.mod h1:1t835xjRzz80PqgE6HHgN2JOsmgYu/h4qDAS4n929Rs=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
-github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
-github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
+github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
+github.com/rs/zerolog v1.32.0 h1:keLypqrlIjaFsbmJOBdB/qvyF8KEtCWHwobLp5l/mQ0=
+github.com/rs/zerolog v1.32.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sagikazarmark/locafero v0.12.0 h1:/NQhBAkUb4+fH1jivKHWusDYFjMOOKU88eegjfxfHb4=
-github.com/sagikazarmark/locafero v0.12.0/go.mod h1:sZh36u/YSZ918v0Io+U9ogLYQJ9tLLBmM4eneO6WwsI=
-github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
-github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
-github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
-github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
-github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s=
-github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
-github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
-github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/sagikazarmark/locafero v0.4.0 h1:HApY1R9zGo4DBgr7dqsTH/JJxLTTsOt7u6keLGt6kNQ=
+github.com/sagikazarmark/locafero v0.4.0/go.mod h1:Pe1W6UlPYUk/+wc/6KFhbORCfqzgYEpgQ3O5fPuL3H4=
+github.com/sagikazarmark/slog-shim v0.1.0 h1:diDBnUNK9N/354PgrxMywXnAwEr1QZcOr6gto+ugjYE=
+github.com/sagikazarmark/slog-shim v0.1.0/go.mod h1:SrcSrq8aKtyuqEI1uvTDTK1arOWRIczQRv+GVI1AkeQ=
+github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
+github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
+github.com/spf13/afero v1.11.0 h1:WJQKhtpdm3v2IzqG8VMqrr6Rf3UYpEF239Jy9wNepM8=
+github.com/spf13/afero v1.11.0/go.mod h1:GH9Y3pIexgf1MTIWtNGyogA5MwRIDXGUr+hbWNoBjkY=
+github.com/spf13/cast v1.6.0 h1:GEiTHELF+vaR5dhz3VqZfFSzZjYbgeKDpBxQVS4GYJ0=
+github.com/spf13/cast v1.6.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
+github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.18.2 h1:LUXCnvUvSM6FXAsj6nnfc8Q2tp1dIgUfY9Kc8GsSOiQ=
+github.com/spf13/viper v1.18.2/go.mod h1:EKmWIqdnk5lOcmR72yw6hS+8OPYcwD0jteitLMVB+yk=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20200311171314-f7b00557c8c4/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
-golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
+golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 h1:vr/HnozRka3pE4EsMEg1lgkXJkTFJCVUX+S/ZT6wYzM=
+golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842/go.mod h1:XtvwrStGgqGPLc4cjQfWqZHG1YFdYs6swckp8vpsjnc=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.22.0 h1:9sGLhx7iRIHEiX0oAJ3MRZMUCElJgy7Br1nO+AMN3Tc=
+golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
-golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
-golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
+golang.org/x/term v0.20.0 h1:VnkxpohqXaOBYJtBmEppKUG6mXpi+4O6purfc2+sMhw=
+golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
-golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.15.0 h1:h1V/4gjBv8v9cjcR6+AR5+/cIYK5N/WAgiv4xlsEtAk=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
+gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/go.mod b/go.mod
index d2fafb83..cf10d58f 100644
--- a/go.mod
+++ b/go.mod
@@ -1,185 +1,203 @@
module github.com/drakkan/sftpgo/v2
-go 1.25.0
+go 1.22.7
require (
- cloud.google.com/go/storage v1.60.0
- github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0
- github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1
- github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.4
+ cloud.google.com/go/storage v1.47.0
+ github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0
+ github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.5.0
github.com/GehirnInc/crypt v0.0.0-20230320061759-8cc1b52080c5
github.com/alexedwards/argon2id v1.0.0
github.com/amoghe/go-crypt v0.0.0-20220222110647-20eada5f5964
- github.com/aws/aws-sdk-go-v2 v1.41.3
- github.com/aws/aws-sdk-go-v2/config v1.32.11
- github.com/aws/aws-sdk-go-v2/credentials v1.19.11
- github.com/aws/aws-sdk-go-v2/service/s3 v1.96.4
- github.com/aws/aws-sdk-go-v2/service/sts v1.41.8
- github.com/bmatcuk/doublestar/v4 v4.10.0
- github.com/cockroachdb/cockroach-go/v2 v2.4.3
- github.com/coreos/go-oidc/v3 v3.17.0
+ github.com/aws/aws-sdk-go-v2 v1.32.5
+ github.com/aws/aws-sdk-go-v2/config v1.28.5
+ github.com/aws/aws-sdk-go-v2/credentials v1.17.46
+ github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.20
+ github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.41
+ github.com/aws/aws-sdk-go-v2/service/marketplacemetering v1.25.6
+ github.com/aws/aws-sdk-go-v2/service/s3 v1.69.0
+ github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.34.6
+ github.com/aws/aws-sdk-go-v2/service/sts v1.33.1
+ github.com/bmatcuk/doublestar/v4 v4.7.1
+ github.com/cockroachdb/cockroach-go/v2 v2.3.8
+ github.com/coreos/go-oidc/v3 v3.11.0
github.com/drakkan/webdav v0.0.0-20241026165615-b8b8f74ae71b
- github.com/eikenb/pipeat v0.0.0-20251030185646-385cd3c3e07b
- github.com/fclairamb/ftpserverlib v0.30.0
- github.com/go-acme/lego/v4 v4.32.0
- github.com/go-chi/chi/v5 v5.2.5
+ github.com/eikenb/pipeat v0.0.0-20210730190139-06b3e6902001
+ github.com/fclairamb/ftpserverlib v0.24.1
+ github.com/fclairamb/go-log v0.5.0
+ github.com/go-acme/lego/v4 v4.20.4
+ github.com/go-chi/chi/v5 v5.1.0
+ github.com/go-chi/jwtauth/v5 v5.3.1
github.com/go-chi/render v1.0.3
- github.com/go-jose/go-jose/v4 v4.1.3
- github.com/go-sql-driver/mysql v1.9.3
+ github.com/go-sql-driver/mysql v1.8.1
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
github.com/google/uuid v1.6.0
github.com/hashicorp/go-hclog v1.6.3
- github.com/hashicorp/go-plugin v1.7.0
- github.com/hashicorp/go-retryablehttp v0.7.8
- github.com/jackc/pgx/v5 v5.8.0
+ github.com/hashicorp/go-plugin v1.6.2
+ github.com/hashicorp/go-retryablehttp v0.7.7
+ github.com/jackc/pgx/v5 v5.7.1
github.com/jlaffaye/ftp v0.2.0
- github.com/klauspost/compress v1.18.4
- github.com/lithammer/shortuuid/v4 v4.2.0
- github.com/mattn/go-sqlite3 v1.14.34
+ github.com/klauspost/compress v1.17.11
+ github.com/lestrrat-go/jwx/v2 v2.1.3
+ github.com/lithammer/shortuuid/v3 v3.0.7
+ github.com/mattn/go-sqlite3 v1.14.24
github.com/mhale/smtpd v0.8.3
- github.com/minio/sio v0.4.3
- github.com/otiai10/copy v1.14.1
- github.com/pires/go-proxyproto v0.11.0
- github.com/pkg/sftp v1.13.10
- github.com/pquerna/otp v1.5.0
- github.com/prometheus/client_golang v1.23.2
+ github.com/minio/sio v0.4.1
+ github.com/otiai10/copy v1.14.0
+ github.com/pires/go-proxyproto v0.8.0
+ github.com/pkg/sftp v1.13.7
+ github.com/pquerna/otp v1.4.0
+ github.com/prometheus/client_golang v1.20.5
github.com/robfig/cron/v3 v3.0.1
github.com/rs/cors v1.11.1
github.com/rs/xid v1.6.0
- github.com/rs/zerolog v1.34.0
- github.com/sftpgo/sdk v0.1.9
+ github.com/rs/zerolog v1.33.0
+ github.com/sftpgo/sdk v0.1.8
github.com/shirou/gopsutil/v3 v3.24.5
- github.com/spf13/afero v1.15.0
- github.com/spf13/cobra v1.10.2
- github.com/spf13/viper v1.21.0
- github.com/stretchr/testify v1.11.1
- github.com/studio-b12/gowebdav v0.12.0
+ github.com/spf13/afero v1.11.0
+ github.com/spf13/cobra v1.8.1
+ github.com/spf13/viper v1.19.0
+ github.com/stretchr/testify v1.10.0
+ github.com/studio-b12/gowebdav v0.9.0
github.com/subosito/gotenv v1.6.0
github.com/unrolled/secure v1.17.0
github.com/wagslane/go-password-validator v0.3.0
- github.com/wneessen/go-mail v0.7.2
+ github.com/wneessen/go-mail v0.5.2
github.com/yl2chen/cidranger v1.0.3-0.20210928021809-d1cb2c52f37a
- go.etcd.io/bbolt v1.4.3
- gocloud.dev v0.45.0
- golang.org/x/crypto v0.49.0
- golang.org/x/net v0.52.0
- golang.org/x/oauth2 v0.36.0
- golang.org/x/sys v0.42.0
- golang.org/x/term v0.41.0
- golang.org/x/time v0.15.0
- google.golang.org/api v0.271.0
+ go.etcd.io/bbolt v1.3.11
+ go.uber.org/automaxprocs v1.6.0
+ gocloud.dev v0.40.0
+ golang.org/x/crypto v0.29.0
+ golang.org/x/net v0.31.0
+ golang.org/x/oauth2 v0.24.0
+ golang.org/x/sys v0.27.0
+ golang.org/x/term v0.26.0
+ golang.org/x/time v0.8.0
+ google.golang.org/api v0.209.0
gopkg.in/natefinch/lumberjack.v2 v2.2.1
)
require (
- cel.dev/expr v0.25.1 // indirect
- cloud.google.com/go v0.123.0 // indirect
- cloud.google.com/go/auth v0.18.2 // indirect
- cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
- cloud.google.com/go/compute/metadata v0.9.0 // indirect
- cloud.google.com/go/iam v1.5.3 // indirect
- cloud.google.com/go/monitoring v1.24.3 // indirect
- filippo.io/edwards25519 v1.2.0 // indirect
- github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
- github.com/AzureAD/microsoft-authentication-library-for-go v1.7.0 // indirect
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 // indirect
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
- github.com/ajg/form v1.7.1 // indirect
- github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.6 // indirect
- github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.19 // indirect
- github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.19 // indirect
- github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.19 // indirect
- github.com/aws/aws-sdk-go-v2/internal/ini v1.8.5 // indirect
- github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.20 // indirect
- github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.6 // indirect
- github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.11 // indirect
- github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.19 // indirect
- github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.19 // indirect
- github.com/aws/aws-sdk-go-v2/service/signin v1.0.7 // indirect
- github.com/aws/aws-sdk-go-v2/service/sso v1.30.12 // indirect
- github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.16 // indirect
- github.com/aws/smithy-go v1.24.2 // indirect
+ cel.dev/expr v0.18.0 // indirect
+ cloud.google.com/go v0.116.0 // indirect
+ cloud.google.com/go/auth v0.11.0 // indirect
+ cloud.google.com/go/auth/oauth2adapt v0.2.6 // indirect
+ cloud.google.com/go/compute/metadata v0.5.2 // indirect
+ cloud.google.com/go/iam v1.2.2 // indirect
+ cloud.google.com/go/monitoring v1.21.2 // indirect
+ filippo.io/edwards25519 v1.1.0 // indirect
+ github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect
+ github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.25.0 // indirect
+ github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.49.0 // indirect
+ github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.49.0 // indirect
+ github.com/ajg/form v1.5.1 // indirect
+ github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7 // indirect
+ github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.24 // indirect
+ github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.24 // indirect
+ github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 // indirect
+ github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.24 // indirect
+ github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1 // indirect
+ github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.5 // indirect
+ github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.5 // indirect
+ github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.5 // indirect
+ github.com/aws/aws-sdk-go-v2/service/sso v1.24.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.5 // indirect
+ github.com/aws/smithy-go v1.22.1 // indirect
github.com/beorn7/perks v1.0.1 // indirect
- github.com/boombuler/barcode v1.1.0 // indirect
- github.com/cenkalti/backoff/v5 v5.0.3 // indirect
+ github.com/boombuler/barcode v1.0.2 // indirect
+ github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+ github.com/census-instrumentation/opencensus-proto v0.4.1 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
- github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect
- github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
+ github.com/cncf/xds/go v0.0.0-20240905190251-b4127c9b8d78 // indirect
+ github.com/coreos/go-systemd/v22 v22.5.0 // indirect
+ github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
- github.com/envoyproxy/go-control-plane/envoy v1.37.0 // indirect
- github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
+ github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0 // indirect
+ github.com/envoyproxy/go-control-plane v0.13.1 // indirect
+ github.com/envoyproxy/protoc-gen-validate v1.1.0 // indirect
github.com/fatih/color v1.18.0 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
- github.com/fsnotify/fsnotify v1.9.0 // indirect
- github.com/go-logr/logr v1.4.3 // indirect
+ github.com/fsnotify/fsnotify v1.8.0 // indirect
+ github.com/go-jose/go-jose/v4 v4.0.4 // indirect
+ github.com/go-logr/logr v1.4.2 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-ole/go-ole v1.3.0 // indirect
- github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
- github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
+ github.com/goccy/go-json v0.10.3 // indirect
+ github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/protobuf v1.5.4 // indirect
- github.com/google/s2a-go v0.1.9 // indirect
- github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
- github.com/googleapis/gax-go/v2 v2.18.0 // indirect
+ github.com/google/s2a-go v0.1.8 // indirect
+ github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
+ github.com/googleapis/gax-go/v2 v2.14.0 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
github.com/hashicorp/go-multierror v1.1.1 // indirect
+ github.com/hashicorp/hcl v1.0.0 // indirect
github.com/hashicorp/yamux v0.1.2 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/jackc/pgpassfile v1.0.0 // indirect
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
github.com/jackc/puddle/v2 v2.2.2 // indirect
github.com/kr/fs v0.1.0 // indirect
- github.com/kylelemons/godebug v1.1.0 // indirect
- github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88 // indirect
- github.com/mattn/go-colorable v0.1.14 // indirect
+ github.com/lestrrat-go/blackmagic v1.0.2 // indirect
+ github.com/lestrrat-go/httpcc v1.0.1 // indirect
+ github.com/lestrrat-go/httprc v1.0.6 // indirect
+ github.com/lestrrat-go/iter v1.0.2 // indirect
+ github.com/lestrrat-go/option v1.0.1 // indirect
+ github.com/lufia/plan9stats v0.0.0-20240909124753-873cd0166683 // indirect
+ github.com/magiconair/properties v1.8.7 // indirect
+ github.com/mattn/go-colorable v0.1.13 // indirect
github.com/mattn/go-isatty v0.0.20 // indirect
- github.com/miekg/dns v1.1.72 // indirect
+ github.com/miekg/dns v1.1.62 // indirect
+ github.com/mitchellh/mapstructure v1.5.0 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
- github.com/oklog/run v1.2.0 // indirect
- github.com/otiai10/mint v1.6.3 // indirect
- github.com/pelletier/go-toml/v2 v2.2.4 // indirect
- github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
+ github.com/oklog/run v1.1.0 // indirect
+ github.com/pelletier/go-toml/v2 v2.2.3 // indirect
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
- github.com/prometheus/client_model v0.6.2 // indirect
- github.com/prometheus/common v0.67.5 // indirect
- github.com/prometheus/procfs v0.20.1 // indirect
+ github.com/prometheus/client_model v0.6.1 // indirect
+ github.com/prometheus/common v0.60.1 // indirect
+ github.com/prometheus/procfs v0.15.1 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
- github.com/sagikazarmark/locafero v0.12.0 // indirect
- github.com/shoenig/go-m1cpu v0.2.0 // indirect
- github.com/spf13/cast v1.10.0 // indirect
- github.com/spf13/pflag v1.0.10 // indirect
- github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
- github.com/tklauser/go-sysconf v0.3.16 // indirect
- github.com/tklauser/numcpus v0.11.0 // indirect
+ github.com/sagikazarmark/locafero v0.6.0 // indirect
+ github.com/sagikazarmark/slog-shim v0.1.0 // indirect
+ github.com/segmentio/asm v1.2.0 // indirect
+ github.com/shoenig/go-m1cpu v0.1.6 // indirect
+ github.com/sourcegraph/conc v0.3.0 // indirect
+ github.com/spf13/cast v1.7.0 // indirect
+ github.com/spf13/pflag v1.0.5 // indirect
+ github.com/tklauser/go-sysconf v0.3.14 // indirect
+ github.com/tklauser/numcpus v0.9.0 // indirect
github.com/yusufpapurcu/wmi v1.2.4 // indirect
- go.opentelemetry.io/auto/sdk v1.2.1 // indirect
- go.opentelemetry.io/contrib/detectors/gcp v1.42.0 // indirect
- go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect
- go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
- go.opentelemetry.io/otel v1.42.0 // indirect
- go.opentelemetry.io/otel/metric v1.42.0 // indirect
- go.opentelemetry.io/otel/sdk v1.42.0 // indirect
- go.opentelemetry.io/otel/sdk/metric v1.42.0 // indirect
- go.opentelemetry.io/otel/trace v1.42.0 // indirect
- go.yaml.in/yaml/v2 v2.4.4 // indirect
- go.yaml.in/yaml/v3 v3.0.4 // indirect
- golang.org/x/mod v0.34.0 // indirect
- golang.org/x/sync v0.20.0 // indirect
- golang.org/x/text v0.35.0 // indirect
- golang.org/x/tools v0.43.0 // indirect
+ go.opencensus.io v0.24.0 // indirect
+ go.opentelemetry.io/contrib/detectors/gcp v1.32.0 // indirect
+ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.57.0 // indirect
+ go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.57.0 // indirect
+ go.opentelemetry.io/otel v1.32.0 // indirect
+ go.opentelemetry.io/otel/metric v1.32.0 // indirect
+ go.opentelemetry.io/otel/sdk v1.32.0 // indirect
+ go.opentelemetry.io/otel/sdk/metric v1.32.0 // indirect
+ go.opentelemetry.io/otel/trace v1.32.0 // indirect
+ go.uber.org/multierr v1.11.0 // indirect
+ golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f // indirect
+ golang.org/x/mod v0.22.0 // indirect
+ golang.org/x/sync v0.9.0 // indirect
+ golang.org/x/text v0.20.0 // indirect
+ golang.org/x/tools v0.27.0 // indirect
golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
- google.golang.org/genproto v0.0.0-20260311181403-84a4fc48630c // indirect
- google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c // indirect
- google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c // indirect
- google.golang.org/grpc v1.79.2 // indirect
- google.golang.org/protobuf v1.36.11 // indirect
+ google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
+ google.golang.org/genproto/googleapis/api v0.0.0-20241118233622-e639e219e697 // indirect
+ google.golang.org/genproto/googleapis/rpc v0.0.0-20241118233622-e639e219e697 // indirect
+ google.golang.org/grpc v1.68.0 // indirect
+ google.golang.org/grpc/stats/opentelemetry v0.0.0-20241028142157-ada6787961b3 // indirect
+ google.golang.org/protobuf v1.35.2 // indirect
+ gopkg.in/ini.v1 v1.67.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
)
replace (
+ github.com/fclairamb/ftpserverlib => github.com/drakkan/ftpserverlib v0.0.0-20240603150004-6a8f643fbf2e
github.com/jlaffaye/ftp => github.com/drakkan/ftp v0.0.0-20240430173938-7ba8270c8e7f
github.com/robfig/cron/v3 => github.com/drakkan/cron/v3 v3.0.0-20230222140221-217a1e4d96c0
+ golang.org/x/crypto => github.com/drakkan/crypto v0.0.0-20241109174329-ca456f56018f
)
diff --git a/go.sum b/go.sum
index d81c977d..a5991389 100644
--- a/go.sum
+++ b/go.sum
@@ -1,198 +1,239 @@
-cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
-cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
-cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
-cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
-cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=
-cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=
-cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
-cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
-cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
-cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
-cloud.google.com/go/iam v1.5.3 h1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc=
-cloud.google.com/go/iam v1.5.3/go.mod h1:MR3v9oLkZCTlaqljW6Eb2d3HGDGK5/bDv93jhfISFvU=
-cloud.google.com/go/kms v1.26.0 h1:cK9mN2cf+9V63D3H1f6koxTatWy39aTI/hCjz1I+adU=
-cloud.google.com/go/kms v1.26.0/go.mod h1:pHKOdFJm63hxBsiPkYtowZPltu9dW0MWvBa6IA4HM58=
-cloud.google.com/go/logging v1.13.2 h1:qqlHCBvieJT9Cdq4QqYx1KPadCQ2noD4FK02eNqHAjA=
-cloud.google.com/go/logging v1.13.2/go.mod h1:zaybliM3yun1J8mU2dVQ1/qDzjbOqEijZCn6hSBtKak=
-cloud.google.com/go/longrunning v0.8.0 h1:LiKK77J3bx5gDLi4SMViHixjD2ohlkwBi+mKA7EhfW8=
-cloud.google.com/go/longrunning v0.8.0/go.mod h1:UmErU2Onzi+fKDg2gR7dusz11Pe26aknR4kHmJJqIfk=
-cloud.google.com/go/monitoring v1.24.3 h1:dde+gMNc0UhPZD1Azu6at2e79bfdztVDS5lvhOdsgaE=
-cloud.google.com/go/monitoring v1.24.3/go.mod h1:nYP6W0tm3N9H/bOw8am7t62YTzZY+zUeQ+Bi6+2eonI=
-cloud.google.com/go/storage v1.60.0 h1:oBfZrSOCimggVNz9Y/bXY35uUcts7OViubeddTTVzQ8=
-cloud.google.com/go/storage v1.60.0/go.mod h1:q+5196hXfejkctrnx+VYU8RKQr/L3c0cBIlrjmiAKE0=
-cloud.google.com/go/trace v1.11.7 h1:kDNDX8JkaAG3R2nq1lIdkb7FCSi1rCmsEtKVsty7p+U=
-cloud.google.com/go/trace v1.11.7/go.mod h1:TNn9d5V3fQVf6s4SCveVMIBS2LJUqo73GACmq/Tky0s=
-filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
-filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
+cel.dev/expr v0.18.0 h1:CJ6drgk+Hf96lkLikr4rFf19WrU0BOWEihyZnI2TAzo=
+cel.dev/expr v0.18.0/go.mod h1:MrpN08Q+lEBs+bGYdLxxHkZoUSsCp0nSKTs0nTymJgw=
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.116.0 h1:B3fRrSDkLRt5qSHWe40ERJvhvnQwdZiHu0bJOpldweE=
+cloud.google.com/go v0.116.0/go.mod h1:cEPSRWPzZEswwdr9BxE6ChEn01dWlTaF05LiC2Xs70U=
+cloud.google.com/go/auth v0.11.0 h1:Ic5SZz2lsvbYcWT5dfjNWgw6tTlGi2Wc8hyQSC9BstA=
+cloud.google.com/go/auth v0.11.0/go.mod h1:xxA5AqpDrvS+Gkmo9RqrGGRh6WSNKKOXhY3zNOr38tI=
+cloud.google.com/go/auth/oauth2adapt v0.2.6 h1:V6a6XDu2lTwPZWOawrAa9HUK+DB2zfJyTuciBG5hFkU=
+cloud.google.com/go/auth/oauth2adapt v0.2.6/go.mod h1:AlmsELtlEBnaNTL7jCj8VQFLy6mbZv0s4Q7NGBeQ5E8=
+cloud.google.com/go/compute/metadata v0.5.2 h1:UxK4uu/Tn+I3p2dYWTfiX4wva7aYlKixAHn3fyqngqo=
+cloud.google.com/go/compute/metadata v0.5.2/go.mod h1:C66sj2AluDcIqakBq/M8lw8/ybHgOZqin2obFxa/E5k=
+cloud.google.com/go/iam v1.2.2 h1:ozUSofHUGf/F4tCNy/mu9tHLTaxZFLOUiKzjcgWHGIA=
+cloud.google.com/go/iam v1.2.2/go.mod h1:0Ys8ccaZHdI1dEUilwzqng/6ps2YB6vRsjIe00/+6JY=
+cloud.google.com/go/kms v1.20.1 h1:og29Wv59uf2FVaZlesaiDAqHFzHaoUyHI3HYp9VUHVg=
+cloud.google.com/go/kms v1.20.1/go.mod h1:LywpNiVCvzYNJWS9JUcGJSVTNSwPwi0vBAotzDqn2nc=
+cloud.google.com/go/logging v1.12.0 h1:ex1igYcGFd4S/RZWOCU51StlIEuey5bjqwH9ZYjHibk=
+cloud.google.com/go/logging v1.12.0/go.mod h1:wwYBt5HlYP1InnrtYI0wtwttpVU1rifnMT7RejksUAM=
+cloud.google.com/go/longrunning v0.6.2 h1:xjDfh1pQcWPEvnfjZmwjKQEcHnpz6lHjfy7Fo0MK+hc=
+cloud.google.com/go/longrunning v0.6.2/go.mod h1:k/vIs83RN4bE3YCswdXC5PFfWVILjm3hpEUlSko4PiI=
+cloud.google.com/go/monitoring v1.21.2 h1:FChwVtClH19E7pJ+e0xUhJPGksctZNVOk2UhMmblmdU=
+cloud.google.com/go/monitoring v1.21.2/go.mod h1:hS3pXvaG8KgWTSz+dAdyzPrGUYmi2Q+WFX8g2hqVEZU=
+cloud.google.com/go/storage v1.47.0 h1:ajqgt30fnOMmLfWfu1PWcb+V9Dxz6n+9WKjdNg5R4HM=
+cloud.google.com/go/storage v1.47.0/go.mod h1:Ks0vP374w0PW6jOUameJbapbQKXqkjGd/OJRp2fb9IQ=
+cloud.google.com/go/trace v1.11.2 h1:4ZmaBdL8Ng/ajrgKqY5jfvzqMXbrDcBsUGXOT9aqTtI=
+cloud.google.com/go/trace v1.11.2/go.mod h1:bn7OwXd4pd5rFuAnTrzBuoZ4ax2XQeG3qNgYmfCy0Io=
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 h1:fou+2+WFTib47nS+nz/ozhEBnvU96bKHy6LjRsY4E28=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0/go.mod h1:t76Ruy8AHvUAC8GfMWJMa0ElSbuIcO03NLpynfbgsPA=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.1 h1:/Zt+cDPnpC3OVDm/JKLOs7M2DKmLRIIp3XIx9pHHiig=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.1/go.mod h1:Ng3urmn6dYe8gnbCMoHHVl5APYz2txho3koEkV2o2HA=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.4 h1:jWQK1GI+LeGGUKBADtcH2rRqPxYB1Ljwms5gFA2LqrM=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.4/go.mod h1:8mwH4klAm9DUgR2EEHyEEAQlRDvLPyg5fQry3y+cDew=
-github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
-github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.7.0 h1:4iB+IesclUXdP0ICgAabvq2FYLXrJWKx1fJQ+GxSo3Y=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.7.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0 h1:JZg6HRh6W6U4OLl6lk7BZ7BLisIzM9dG1R50zUk9C/M=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0/go.mod h1:YL1xnZ6QejvQHWJrX/AvhFl4WW4rqHVoKspWNVwFk0M=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.0 h1:B/dfvscEQtew9dVuoxqxrUKKv8Ih2f55PydknDamU+g=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.0/go.mod h1:fiPSssYvltE08HJchL04dOy+RD4hgrjph0cwGGMntdI=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 h1:ywEEhmNahHBihViHepv3xPBn1663uRv2t2q/ESv9seY=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0/go.mod h1:iZDifYGJTIgIIkYRNWPENUnqx6bJ2xnSDFI2tjwZNuY=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.6.0 h1:PiSrjRPpkQNjrM8H0WwKMnZUdu1RGMtd/LdGKUrOo+c=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.6.0/go.mod h1:oDrbWx4ewMylP7xHivfgixbfGBT6APAwsSoHRKotnIc=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.5.0 h1:mlmW46Q0B79I+Aj4azKC6xDMFN9a9SyZWESlGWYXbFs=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.5.0/go.mod h1:PXe2h+LKcWTX9afWdZoHyODqR4fBa5boUM/8uJfZ0Jo=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 h1:XHOnouVk1mxXfQidrMEnLlPk9UMeRtyBTnEFtxkV0kU=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
github.com/GehirnInc/crypt v0.0.0-20230320061759-8cc1b52080c5 h1:IEjq88XO4PuBDcvmjQJcQGg+w+UaafSy8G5Kcb5tBhI=
github.com/GehirnInc/crypt v0.0.0-20230320061759-8cc1b52080c5/go.mod h1:exZ0C/1emQJAw5tHOaUDyY1ycttqBAPcxuzf7QbY6ec=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 h1:DHa2U07rk8syqvCge0QIGMCE1WxGj9njT44GH7zNJLQ=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0/go.mod h1:P4WPRUkOhJC13W//jWpyfJNDAIpvRbAUIYLX/4jtlE0=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 h1:UnDZ/zFfG1JhH/DqxIZYU/1CUAlTUScoXD/LcM2Ykk8=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0/go.mod h1:IA1C1U7jO/ENqm/vhi7V9YYpBsp+IMyqNrEN94N7tVc=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 h1:7t/qx5Ost0s0wbA/VDrByOooURhp+ikYwv20i9Y07TQ=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0/go.mod h1:vB2GH9GAYYJTO3mEn8oYwzEdhlayZIdQz6zdzgUIRvA=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 h1:0s6TxfCu2KHkkZPnBfsQ2y5qia0jl3MMrmBhu3nCOYk=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0/go.mod h1:Mf6O40IAyB9zR/1J8nGDDPirZQQPbYJni8Yisy7NTMc=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.25.0 h1:3c8yed4lgqTt+oTQ+JNMDo+F4xprBf+O/il4ZC0nRLw=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.25.0/go.mod h1:obipzmGjfSjam60XLwGfqUkJsfiheAl+TUjG+4yzyPM=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.49.0 h1:o90wcURuxekmXrtxmYWTyNla0+ZEHhud6DI1ZTxd1vI=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.49.0/go.mod h1:6fTWu4m3jocfUZLYF5KsZC1TUfRvEjs7lM4crme/irw=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.49.0 h1:jJKWl98inONJAr/IZrdFQUWcwUO95DLY1XMD1ZIut+g=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.49.0/go.mod h1:l2fIqmwB+FKSfvn3bAD/0i+AXAxhIZjTK2svT/mgUXs=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.49.0 h1:GYUJLfvd++4DMuMhCFLgLXvFwofIxh/qOwoGuS/LTew=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.49.0/go.mod h1:wRbFgBQUVm1YXrvWKofAEmq9HNJTDphbAaJSSX01KUI=
+github.com/ajg/form v1.5.1 h1:t9c7v8JUKu/XxOGBU0yjNpaMloxGEJhUkqFRq0ibGeU=
github.com/ajg/form v1.5.1/go.mod h1:uL1WgH+h2mgNtvBq0339dVnzXdBETtL2LeUXaIv25UY=
-github.com/ajg/form v1.7.1 h1:OsnBDzTkrWdrxvEnO68I72ZVGJGNaMwPhoAm0V+llgc=
-github.com/ajg/form v1.7.1/go.mod h1:HL757PzLyNkj5AIfptT6L+iGNeXTlnrr/oDePGc/y7Q=
github.com/alexedwards/argon2id v1.0.0 h1:wJzDx66hqWX7siL/SRUmgz3F8YMrd/nfX/xHHcQQP0w=
github.com/alexedwards/argon2id v1.0.0/go.mod h1:tYKkqIjzXvZdzPvADMWOEZ+l6+BD6CtBXMj5fnJppiw=
github.com/amoghe/go-crypt v0.0.0-20220222110647-20eada5f5964 h1:I9YN9WMo3SUh7p/4wKeNvD/IQla3U3SUa61U7ul+xM4=
github.com/amoghe/go-crypt v0.0.0-20220222110647-20eada5f5964/go.mod h1:eFiR01PwTcpbzXtdMces7zxg6utvFM5puiWHpWB8D/k=
-github.com/aws/aws-sdk-go-v2 v1.41.3 h1:4kQ/fa22KjDt13QCy1+bYADvdgcxpfH18f0zP542kZA=
-github.com/aws/aws-sdk-go-v2 v1.41.3/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.6 h1:N4lRUXZpZ1KVEUn6hxtco/1d2lgYhNn1fHkkl8WhlyQ=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.6/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
-github.com/aws/aws-sdk-go-v2/config v1.32.11 h1:ftxI5sgz8jZkckuUHXfC/wMUc8u3fG1vQS0plr2F2Zs=
-github.com/aws/aws-sdk-go-v2/config v1.32.11/go.mod h1:twF11+6ps9aNRKEDimksp923o44w/Thk9+8YIlzWMmo=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.11 h1:NdV8cwCcAXrCWyxArt58BrvZJ9pZ9Fhf9w6Uh5W3Uyc=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.11/go.mod h1:30yY2zqkMPdrvxBqzI9xQCM+WrlrZKSOpSJEsylVU+8=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.19 h1:INUvJxmhdEbVulJYHI061k4TVuS3jzzthNvjqvVvTKM=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.19/go.mod h1:FpZN2QISLdEBWkayloda+sZjVJL+e9Gl0k1SyTgcswU=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.19 h1:/sECfyq2JTifMI2JPyZ4bdRN77zJmr6SrS1eL3augIA=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.19/go.mod h1:dMf8A5oAqr9/oxOfLkC/c2LU/uMcALP0Rgn2BD5LWn0=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.19 h1:AWeJMk33GTBf6J20XJe6qZoRSJo0WfUhsMdUKhoODXE=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.19/go.mod h1:+GWrYoaAsV7/4pNHpwh1kiNLXkKaSoppxQq9lbH8Ejw=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.5 h1:clHU5fm//kWS1C2HgtgWxfQbFbx4b6rx+5jzhgX9HrI=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.5/go.mod h1:O3h0IK87yXci+kg6flUKzJnWeziQUKciKrLjcatSNcY=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.20 h1:qi3e/dmpdONhj1RyIZdi6DKKpDXS5Lb8ftr3p7cyHJc=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.20/go.mod h1:V1K+TeJVD5JOk3D9e5tsX2KUdL7BlB+FV6cBhdobN8c=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.6 h1:XAq62tBTJP/85lFD5oqOOe7YYgWxY9LvWq8plyDvDVg=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.6/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.11 h1:BYf7XNsJMzl4mObARUBUib+j2tf0U//JAAtTnYqvqCw=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.11/go.mod h1:aEUS4WrNk/+FxkBZZa7tVgp4pGH+kFGW40Y8rCPqt5g=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.19 h1:X1Tow7suZk9UCJHE1Iw9GMZJJl0dAnKXXP1NaSDHwmw=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.19/go.mod h1:/rARO8psX+4sfjUQXp5LLifjUt8DuATZ31WptNJTyQA=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.19 h1:JnQeStZvPHFHeyky/7LbMlyQjUa+jIBj36OlWm0pzIk=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.19/go.mod h1:HGyasyHvYdFQeJhvDHfH7HXkHh57htcJGKDZ+7z+I24=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.96.4 h1:4ExZyubQ6LQQVuF2Qp9OsfEvsTdAWh5Gfwf6PgIdLdk=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.96.4/go.mod h1:NF3JcMGOiARAss1ld3WGORCw71+4ExDD2cbbdKS5PpA=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.7 h1:Y2cAXlClHsXkkOvWZFXATr34b0hxxloeQu/pAZz2row=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.7/go.mod h1:idzZ7gmDeqeNrSPkdbtMp9qWMgcBwykA7P7Rzh5DXVU=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.12 h1:iSsvB9EtQ09YrsmIc44Heqlx5ByGErqhPK1ZQLppias=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.12/go.mod h1:fEWYKTRGoZNl8tZ77i61/ccwOMJdGxwOhWCkp6TXAr0=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.16 h1:EnUdUqRP1CNzt2DkV67tJx6XDN4xlfBFm+bzeNOQVb0=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.16/go.mod h1:Jic/xv0Rq/pFNCh3WwpH4BEqdbSAl+IyHro8LbibHD8=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.8 h1:XQTQTF75vnug2TXS8m7CVJfC2nniYPZnO1D4Np761Oo=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.8/go.mod h1:Xgx+PR1NUOjNmQY+tRMnouRp83JRM8pRMw/vCaVhPkI=
-github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
-github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/aws-sdk-go-v2 v1.32.5 h1:U8vdWJuY7ruAkzaOdD7guwJjD06YSKmnKCJs7s3IkIo=
+github.com/aws/aws-sdk-go-v2 v1.32.5/go.mod h1:P5WJBrYqqbWVaOxgH0X/FYYD47/nooaPOZPlQdmiN2U=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7 h1:lL7IfaFzngfx0ZwUGOZdsFFnQ5uLvR0hWqqhyE7Q9M8=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7/go.mod h1:QraP0UcVlQJsmHfioCrveWOC1nbiWUl3ej08h4mXWoc=
+github.com/aws/aws-sdk-go-v2/config v1.28.5 h1:Za41twdCXbuyyWv9LndXxZZv3QhTG1DinqlFsSuvtI0=
+github.com/aws/aws-sdk-go-v2/config v1.28.5/go.mod h1:4VsPbHP8JdcdUDmbTVgNL/8w9SqOkM5jyY8ljIxLO3o=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.46 h1:AU7RcriIo2lXjUfHFnFKYsLCwgbz1E7Mm95ieIRDNUg=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.46/go.mod h1:1FmYyLGL08KQXQ6mcTlifyFXfJVCNJTVGuQP4m0d/UA=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.20 h1:sDSXIrlsFSFJtWKLQS4PUWRvrT580rrnuLydJrCQ/yA=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.20/go.mod h1:WZ/c+w0ofps+/OUqMwWgnfrgzZH1DZO1RIkktICsqnY=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.41 h1:hqcxMc2g/MwwnRMod9n6Bd+t+9Nf7d5qRg7RaXKPd6o=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.41/go.mod h1:d1eH0VrttvPmrCraU68LOyNdu26zFxQFjrVSb5vdhog=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.24 h1:4usbeaes3yJnCFC7kfeyhkdkPtoRYPa/hTmCqMpKpLI=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.24/go.mod h1:5CI1JemjVwde8m2WG3cz23qHKPOxbpkq0HaoreEgLIY=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.24 h1:N1zsICrQglfzaBnrfM0Ys00860C+QFwu6u/5+LomP+o=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.24/go.mod h1:dCn9HbJ8+K31i8IQ8EWmWj0EiIk0+vKiHNMxTTYveAg=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 h1:VaRN3TlFdd6KxX1x3ILT5ynH6HvKgqdiXoTxAF4HQcQ=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.24 h1:JX70yGKLj25+lMC5Yyh8wBtvB01GDilyRuJvXJ4piD0=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.24/go.mod h1:+Ln60j9SUTD0LEwnhEB0Xhg61DHqplBrbZpLgyjoEHg=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1 h1:iXtILhvDxB6kPvEXgsDhGaZCSC6LQET5ZHSdJozeI0Y=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1/go.mod h1:9nu0fVANtYiAePIBh2/pFUSwtJ402hLnp854CNoDOeE=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.5 h1:gvZOjQKPxFXy1ft3QnEyXmT+IqneM9QAUWlM3r0mfqw=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.5/go.mod h1:DLWnfvIcm9IET/mmjdxeXbBKmTCm0ZB8p1za9BVteM8=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.5 h1:wtpJ4zcwrSbwhECWQoI/g6WM9zqCcSpHDJIWSbMLOu4=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.5/go.mod h1:qu/W9HXQbbQ4+1+JcZp0ZNPV31ym537ZJN+fiS7Ti8E=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.5 h1:P1doBzv5VEg1ONxnJss1Kh5ZG/ewoIE4MQtKKc6Crgg=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.5/go.mod h1:NOP+euMW7W3Ukt28tAxPuoWao4rhhqJD3QEBk7oCg7w=
+github.com/aws/aws-sdk-go-v2/service/marketplacemetering v1.25.6 h1:3aPcXE6EUx7D+/mzEsp1vVBG+OVO4QsyTsyoLfAUzj4=
+github.com/aws/aws-sdk-go-v2/service/marketplacemetering v1.25.6/go.mod h1:capelnANRLuXXVcT3oPQvDhKDn6unq1Ve2k9b8M12/o=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.69.0 h1:Q2ax8S21clKOnHhhr933xm3JxdJebql+R7aNo7p7GBQ=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.69.0/go.mod h1:ralv4XawHjEMaHOWnTFushl0WRqim/gQWesAMF6hTow=
+github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.34.6 h1:1KDMKvOKNrpD667ORbZ/+4OgvUoaok1gg/MLzrHF9fw=
+github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.34.6/go.mod h1:DmtyfCfONhOyVAJ6ZMTrDSFIeyCBlEO93Qkfhxwbxu0=
+github.com/aws/aws-sdk-go-v2/service/sso v1.24.6 h1:3zu537oLmsPfDMyjnUS2g+F2vITgy5pB74tHI+JBNoM=
+github.com/aws/aws-sdk-go-v2/service/sso v1.24.6/go.mod h1:WJSZH2ZvepM6t6jwu4w/Z45Eoi75lPN7DcydSRtJg6Y=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.5 h1:K0OQAsDywb0ltlFrZm0JHPY3yZp/S9OaoLU33S7vPS8=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.5/go.mod h1:ORITg+fyuMoeiQFiVGoqB3OydVTLkClw/ljbblMq6Cc=
+github.com/aws/aws-sdk-go-v2/service/sts v1.33.1 h1:6SZUVRQNvExYlMLbHdlKB48x0fLbc2iVROyaNEwBHbU=
+github.com/aws/aws-sdk-go-v2/service/sts v1.33.1/go.mod h1:GqWyYCwLXnlUB1lOAXQyNSPqPLQJvmo8J0DWBzp9mtg=
+github.com/aws/smithy-go v1.22.1 h1:/HPHZQ0g7f4eUeK6HKglFz8uwVfZKgoI25rb/J+dnro=
+github.com/aws/smithy-go v1.22.1/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bmatcuk/doublestar/v4 v4.10.0 h1:zU9WiOla1YA122oLM6i4EXvGW62DvKZVxIe6TYWexEs=
-github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bmatcuk/doublestar/v4 v4.7.1 h1:fdDeAqgT47acgwd9bd9HxJRDmc9UAmPpc+2m0CXv75Q=
+github.com/bmatcuk/doublestar/v4 v4.7.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
-github.com/boombuler/barcode v1.1.0 h1:ChaYjBR63fr4LFyGn8E8nt7dBSt3MiU3zMOZqFvVkHo=
-github.com/boombuler/barcode v1.1.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
-github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=
-github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
-github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
-github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
+github.com/boombuler/barcode v1.0.2 h1:79yrbttoZrLGkL/oOI8hBrUKucwOL0oOjUgEguGMcJ4=
+github.com/boombuler/barcode v1.0.2/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/bufbuild/protocompile v0.4.0 h1:LbFKd2XowZvQ/kajzguUp2DC9UEIQhIq77fZZlaQsNA=
+github.com/bufbuild/protocompile v0.4.0/go.mod h1:3v93+mbWn/v3xzN+31nwkJfrEpAUwp+BagBSZWx+TP8=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/census-instrumentation/opencensus-proto v0.4.1 h1:iKLQ0xPNFxR/2hzXZMrBo8f1j86j5WHzznCCQxV/b8g=
+github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik=
-github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4=
-github.com/cockroachdb/cockroach-go/v2 v2.4.3 h1:LJO3K3jC5WXvMePRQSJE1NsIGoFGcEx1LW83W6RAlhw=
-github.com/cockroachdb/cockroach-go/v2 v2.4.3/go.mod h1:9U179XbCx4qFWtNhc7BiWLPfuyMVQ7qdAhfrwLz1vH0=
-github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=
-github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/cncf/xds/go v0.0.0-20240905190251-b4127c9b8d78 h1:QVw89YDxXxEe+l8gU8ETbOasdwEV+avkR75ZzsVV9WI=
+github.com/cncf/xds/go v0.0.0-20240905190251-b4127c9b8d78/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
+github.com/cockroachdb/cockroach-go/v2 v2.3.8 h1:53yoUo4+EtrC1NrAEgnnad4AS3ntNvGup1PAXZ7UmpE=
+github.com/cockroachdb/cockroach-go/v2 v2.3.8/go.mod h1:9uH5jK4yQ3ZQUT9IXe4I2fHzMIF5+JC/oOdzTRgJYJk=
+github.com/coreos/go-oidc/v3 v3.11.0 h1:Ia3MxdwpSw702YW0xgfmP1GVCMA9aEFWu12XUZ3/OtI=
+github.com/coreos/go-oidc/v3 v3.11.0/go.mod h1:gE3LgjOgFoHi9a4ce4/tJczr0Ai2/BoDhf0r5lltWI0=
+github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
-github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.5 h1:ZtcqGrnekaHpVLArFSe4HK5DoKx1T0rq2DwVB0alcyc=
+github.com/cpuguy83/go-md2man/v2 v2.0.5/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0 h1:rpfIENRNNilwHwZeG5+P150SMrnNEcHYvcCuK6dPZSg=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0/go.mod h1:v57UDF4pDQJcEfFUCRop3lJL149eHGSe9Jvczhzjo/0=
github.com/drakkan/cron/v3 v3.0.0-20230222140221-217a1e4d96c0 h1:EW9gIJRmt9lzk66Fhh4S8VEtURA6QHZqGeSRE9Nb2/U=
github.com/drakkan/cron/v3 v3.0.0-20230222140221-217a1e4d96c0/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
+github.com/drakkan/crypto v0.0.0-20241109174329-ca456f56018f h1:XcWqEK+oBZv7o3+JdziHprvQwgGlr9rk7sgIYPwy/C8=
+github.com/drakkan/crypto v0.0.0-20241109174329-ca456f56018f/go.mod h1:+F4F4N5hv6v38hfeYwTdx20oUvLLc+QfrE9Ax9HtgRg=
github.com/drakkan/ftp v0.0.0-20240430173938-7ba8270c8e7f h1:S9JUlrOzjK58UKoLqqb40YLyVlt0bcIFtYrvnanV3zc=
github.com/drakkan/ftp v0.0.0-20240430173938-7ba8270c8e7f/go.mod h1:4p8lUl4vQ80L598CygL+3IFtm+3nggvvW/palOlViwE=
+github.com/drakkan/ftpserverlib v0.0.0-20240603150004-6a8f643fbf2e h1:VBpqQeChkGXSV1FXCtvd3BJTyB+DcMgiu7SfkpsGuKw=
+github.com/drakkan/ftpserverlib v0.0.0-20240603150004-6a8f643fbf2e/go.mod h1:aAwyOAC6IIe+IZeeGD1QjuE3GGDzqW/c5Xtn+Dp0JUM=
github.com/drakkan/webdav v0.0.0-20241026165615-b8b8f74ae71b h1:Y1tLiQ8fnxM5f3wiBjAXsHzHNwiY9BR+mXZA75nZwrs=
github.com/drakkan/webdav v0.0.0-20241026165615-b8b8f74ae71b/go.mod h1:zOVb1QDhwwqWn2L2qZ0U3swMSO4GTSNyIwXCGO/UGWE=
-github.com/eikenb/pipeat v0.0.0-20251030185646-385cd3c3e07b h1:G2Mm3YhlyjkFrNnvu5E6LtNcPJtggXL1i5ekDV4hDD4=
-github.com/eikenb/pipeat v0.0.0-20251030185646-385cd3c3e07b/go.mod h1:XccPiThW83W5pzeOCsJAylEUtWeH+3zQVwiO402FXXc=
-github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
-github.com/envoyproxy/go-control-plane v0.14.0/go.mod h1:NcS5X47pLl/hfqxU70yPwL9ZMkUlwlKxtAohpi2wBEU=
-github.com/envoyproxy/go-control-plane/envoy v1.37.0 h1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=
-github.com/envoyproxy/go-control-plane/envoy v1.37.0/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A=
-github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
-github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
-github.com/envoyproxy/protoc-gen-validate v1.3.3 h1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds=
-github.com/envoyproxy/protoc-gen-validate v1.3.3/go.mod h1:TsndJ/ngyIdQRhMcVVGDDHINPLWB7C82oDArY51KfB0=
+github.com/eikenb/pipeat v0.0.0-20210730190139-06b3e6902001 h1:/ZshrfQzayqRSBDodmp3rhNCHJCff+utvgBuWRbiqu4=
+github.com/eikenb/pipeat v0.0.0-20210730190139-06b3e6902001/go.mod h1:kltMsfRMTHSFdMbK66XdS8mfMW77+FZA1fGY1xYMF84=
+github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/go-control-plane v0.13.1 h1:vPfJZCkob6yTMEgS+0TwfTUfbHjfy/6vOJ8hUWX/uXE=
+github.com/envoyproxy/go-control-plane v0.13.1/go.mod h1:X45hY0mufo6Fd0KW3rqsGvQMw58jvjymeCzBU3mWyHw=
+github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/envoyproxy/protoc-gen-validate v1.1.0 h1:tntQDh69XqOCOZsDz0lVJQez/2L6Uu2PdjCQwWCJ3bM=
+github.com/envoyproxy/protoc-gen-validate v1.1.0/go.mod h1:sXRDRVmzEbkM7CVcM06s9shE/m23dg3wzjl0UWqJ2q4=
github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
-github.com/fclairamb/ftpserverlib v0.30.0 h1:caB9sDn1Au//q0j2ev/icPn388qPuk4k1ajSvglDcMQ=
-github.com/fclairamb/ftpserverlib v0.30.0/go.mod h1:QmogtltTOgkihyKza0GNo37Mu4AEzbJ+sH6W9Y0MBIQ=
+github.com/fclairamb/go-log v0.5.0 h1:Gz9wSamEaA6lta4IU2cjJc2xSq5sV5VYSB5w/SUHhVc=
+github.com/fclairamb/go-log v0.5.0/go.mod h1:XoRO1dYezpsGmLLkZE9I+sHqpqY65p8JA+Vqblb7k40=
github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
-github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/go-acme/lego/v4 v4.32.0 h1:z7Ss7aa1noabhKj+DBzhNCO2SM96xhE3b0ucVW3x8Tc=
-github.com/go-acme/lego/v4 v4.32.0/go.mod h1:lI2fZNdgeM/ymf9xQ9YKbgZm6MeDuf91UrohMQE4DhI=
-github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug=
-github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
+github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
+github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/go-acme/lego/v4 v4.20.4 h1:yCQGBX9jOfMbriEQUocdYm7EBapdTp8nLXYG8k6SqSU=
+github.com/go-acme/lego/v4 v4.20.4/go.mod h1:foauPlhnhoq8WUphaWx5U04uDc+JGhk4ZZtPz/Vqsjg=
+github.com/go-chi/chi/v5 v5.1.0 h1:acVI1TYaD+hhedDJ3r54HyA6sExp3HfXq7QWEEY/xMw=
+github.com/go-chi/chi/v5 v5.1.0/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
+github.com/go-chi/jwtauth/v5 v5.3.1 h1:1ePWrjVctvp1tyBq5b/2ER8Th/+RbYc7x4qNsc5rh5A=
+github.com/go-chi/jwtauth/v5 v5.3.1/go.mod h1:6Fl2RRmWXs3tJYE1IQGX81FsPoGqDwq9c15j52R5q80=
github.com/go-chi/render v1.0.3 h1:AsXqd2a1/INaIfUSKq3G5uA8weYx20FOsM7uSoCyyt4=
github.com/go-chi/render v1.0.3/go.mod h1:/gr3hVkmYR0YlEy3LxCuVRFzEu9Ruok+gFqbIofjao0=
-github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
-github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.0.4 h1:VsjPI33J0SB9vQM6PLmNjoHqMQNGPiZ0rHL7Ni7Q6/E=
+github.com/go-jose/go-jose/v4 v4.0.4/go.mod h1:NKb5HO1EZccyMpiZNbdUw/14tiXNyUJh188dfnMCAfc=
+github.com/go-kit/log v0.2.1 h1:MRVx0/zhvdseW+Gza6N9rVzU/IVzaeE1SFI4raAhmBU=
+github.com/go-kit/log v0.2.1/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
+github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNVA=
+github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
-github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
-github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
-github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
-github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
+github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
+github.com/goccy/go-json v0.10.3 h1:KZ5WoDbxAIgm2HNbYckL0se1fHD6rz5j4ywS6ebzDqA=
+github.com/goccy/go-json v0.10.3/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
-github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
-github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
-github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
+github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
+github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
+github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
+github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/google/martian/v3 v3.3.3 h1:DIhPTQrbPkgs2yJYdXU/eNACCG5DVQjySNRNlflZ9Fc=
github.com/google/martian/v3 v3.3.3/go.mod h1:iEPrYcgCF7jA9OtScMFQyAlZZ4YXTKEtJ1E6RWzmBA0=
-github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
-github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
+github.com/google/s2a-go v0.1.8 h1:zZDs9gcbt9ZPLV0ndSyQk6Kacx2g/X+SKYovpnz3SMM=
+github.com/google/s2a-go v0.1.8/go.mod h1:6iNWHTpQ+nfNRN5E00MSdfDwVesa8hhS32PhPO8deJA=
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/wire v0.7.0 h1:JxUKI6+CVBgCO2WToKy/nQk0sS+amI9z9EjVmdaocj4=
-github.com/google/wire v0.7.0/go.mod h1:n6YbUQD9cPKTnHXEBN2DXlOp/mVADhVErcMFb0v3J18=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
-github.com/googleapis/gax-go/v2 v2.18.0 h1:jxP5Uuo3bxm3M6gGtV94P4lliVetoCB4Wk2x8QA86LI=
-github.com/googleapis/gax-go/v2 v2.18.0/go.mod h1:uSzZN4a356eRG985CzJ3WfbFSpqkLTjsnhWGJR6EwrE=
+github.com/google/wire v0.6.0 h1:HBkoIh4BdSxoyo9PveV8giw7ZsaBOvzWKfcg/6MrVwI=
+github.com/google/wire v0.6.0/go.mod h1:F4QhpQ9EDIdJ1Mbop/NZBRB+5yrR6qg3BnctaoUk6NA=
+github.com/googleapis/enterprise-certificate-proxy v0.3.4 h1:XYIDZApgAnrN1c855gTgghdIA6Stxb52D5RnLI1SLyw=
+github.com/googleapis/enterprise-certificate-proxy v0.3.4/go.mod h1:YKe7cfqYXjKGpGvmSg28/fFvhNzinZQm8DGnaburhGA=
+github.com/googleapis/gax-go/v2 v2.14.0 h1:f+jMrjBPl+DL9nI4IQzLUxMq7XrAqFYB7hBPqMNIe8o=
+github.com/googleapis/gax-go/v2 v2.14.0/go.mod h1:lhBCnjdLrWRaPvLWhmc8IS24m9mr07qSYnHncrgo+zk=
github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -202,10 +243,12 @@ github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB1
github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-plugin v1.7.0 h1:YghfQH/0QmPNc/AZMTFE3ac8fipZyZECHdDPshfk+mA=
-github.com/hashicorp/go-plugin v1.7.0/go.mod h1:BExt6KEaIYx804z8k4gRzRLEvxKVb+kn0NMcihqOqb8=
-github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
-github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
+github.com/hashicorp/go-plugin v1.6.2 h1:zdGAEd0V1lCaU0u+MxWQhtSDQmahpkwOun8U8EiRVog=
+github.com/hashicorp/go-plugin v1.6.2/go.mod h1:CkgLQ5CZqNmdL9U9JzM532t8ZiYQ35+pj3b1FD37R0Q=
+github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
+github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
+github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
+github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8=
github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
@@ -214,16 +257,14 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.8.0 h1:TYPDoleBBme0xGSAX3/+NujXXtpZn9HBONkQC7IEZSo=
-github.com/jackc/pgx/v5 v5.8.0/go.mod h1:QVeDInX2m9VyzvNeiCJVjCkNFqzsNb43204HshNSZKw=
+github.com/jackc/pgx/v5 v5.7.1 h1:x7SYsPBYDkHDksogeSmZZ5xzThcTgRz++I5E+ePFUcs=
+github.com/jackc/pgx/v5 v5.7.1/go.mod h1:e7O26IywZZ+naJtWWos6i6fvWK+29etgITqrqHLfoZA=
github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
-github.com/jhump/protoreflect v1.17.0 h1:qOEr613fac2lOuTgWN4tPAtLL7fUSbuJL5X5XumQh94=
-github.com/jhump/protoreflect v1.17.0/go.mod h1:h9+vUUL38jiBzck8ck+6G/aeMX8Z4QUY/NiJPwPNi+8=
-github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=
-github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k=
-github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c=
-github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
+github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
+github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo=
+github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
+github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -232,48 +273,63 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/lestrrat-go/blackmagic v1.0.2 h1:Cg2gVSc9h7sz9NOByczrbUvLopQmXrfFx//N+AkAr5k=
+github.com/lestrrat-go/blackmagic v1.0.2/go.mod h1:UrEqBzIR2U6CnzVyUtfM6oZNMt/7O7Vohk2J0OGSAtU=
+github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
+github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
+github.com/lestrrat-go/httprc v1.0.6 h1:qgmgIRhpvBqexMJjA/PmwSvhNk679oqD1RbovdCGW8k=
+github.com/lestrrat-go/httprc v1.0.6/go.mod h1:mwwz3JMTPBjHUkkDv/IGJ39aALInZLrhBp0X7KGUZlo=
+github.com/lestrrat-go/iter v1.0.2 h1:gMXo1q4c2pHmC3dn8LzRhJfP1ceCbgSiT9lUydIzltI=
+github.com/lestrrat-go/iter v1.0.2/go.mod h1:Momfcq3AnRlRjI5b5O8/G5/BvpzrhoFTZcn06fEOPt4=
+github.com/lestrrat-go/jwx/v2 v2.1.3 h1:Ud4lb2QuxRClYAmRleF50KrbKIoM1TddXgBrneT5/Jo=
+github.com/lestrrat-go/jwx/v2 v2.1.3/go.mod h1:q6uFgbgZfEmQrfJfrCo90QcQOcXFMfbI/fO0NqRtvZo=
+github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU=
+github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lithammer/shortuuid/v4 v4.2.0 h1:LMFOzVB3996a7b8aBuEXxqOBflbfPQAiVzkIcHO0h8c=
-github.com/lithammer/shortuuid/v4 v4.2.0/go.mod h1:D5noHZ2oFw/YaKCfGy0YxyE7M0wMbezmMjPdhyEFe6Y=
-github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88 h1:PTw+yKnXcOFCR6+8hHTyWBeQ/P4Nb7dd4/0ohEcWQuM=
-github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
+github.com/lithammer/shortuuid/v3 v3.0.7 h1:trX0KTHy4Pbwo/6ia8fscyHoGA+mf1jWbPJVuvyJQQ8=
+github.com/lithammer/shortuuid/v3 v3.0.7/go.mod h1:vMk8ke37EmiewwolSO1NLW8vP4ZaKlRuDIi8tWWmAts=
+github.com/lufia/plan9stats v0.0.0-20240909124753-873cd0166683 h1:7UMa6KCCMjZEMDtTVdcGu0B1GmmC7QJKiCCjyTAWQy0=
+github.com/lufia/plan9stats v0.0.0-20240909124753-873cd0166683/go.mod h1:ilwx/Dta8jXAgpFYFvSWEMwxmbWXyiUHkd5FwyKhb5k=
+github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
+github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
-github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-sqlite3 v1.14.34 h1:3NtcvcUnFBPsuRcno8pUtupspG/GM+9nZ88zgJcp6Zk=
-github.com/mattn/go-sqlite3 v1.14.34/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mattn/go-sqlite3 v1.14.24 h1:tpSp2G2KyMnnQu99ngJ47EIkWVmliIizyZBfPrBWDRM=
+github.com/mattn/go-sqlite3 v1.14.24/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
github.com/mhale/smtpd v0.8.3 h1:8j8YNXajksoSLZja3HdwvYVZPuJSqAxFsib3adzRRt8=
github.com/mhale/smtpd v0.8.3/go.mod h1:MQl+y2hwIEQCXtNhe5+55n0GZOjSmeqORDIXbqUL3x4=
-github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
-github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
-github.com/minio/sio v0.4.3 h1:JqyID1XM86KwBZox5RAdLD4MLPIDoCY2cke2CXCJCkg=
-github.com/minio/sio v0.4.3/go.mod h1:4ANoe4CCXqnt1FCiLM0+vlBUhhWZzVOhYCz0069KtFc=
+github.com/miekg/dns v1.1.62 h1:cN8OuEF1/x5Rq6Np+h1epln8OiyPWV+lROx9LxcGgIQ=
+github.com/miekg/dns v1.1.62/go.mod h1:mvDlcItzm+br7MToIKqkglaGhlFMHJ9DTNNWONWXbNQ=
+github.com/minio/sio v0.4.1 h1:EMe3YBC1nf+sRQia65Rutxi+Z554XPV0dt8BIBA+a/0=
+github.com/minio/sio v0.4.1/go.mod h1:oBSjJeGbBdRMZZwna07sX9EFzZy+ywu5aofRiV1g79I=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/oklog/run v1.2.0 h1:O8x3yXwah4A73hJdlrwo/2X6J62gE5qTMusH0dvz60E=
-github.com/oklog/run v1.2.0/go.mod h1:mgDbKRSwPhJfesJ4PntqFUbKQRZ50NgmZTSPlFA0YFk=
-github.com/otiai10/copy v1.14.1 h1:5/7E6qsUMBaH5AnQ0sSLzzTg1oTECmcCmT6lvF45Na8=
-github.com/otiai10/copy v1.14.1/go.mod h1:oQwrEDDOci3IM8dJF0d8+jnbfPDllW6vUjNc3DoZm9I=
-github.com/otiai10/mint v1.6.3 h1:87qsV/aw1F5as1eH1zS/yqHY85ANKVMgkDrf9rcxbQs=
-github.com/otiai10/mint v1.6.3/go.mod h1:MJm72SBthJjz8qhefc4z1PYEieWmy8Bku7CjcAqyUSM=
-github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
-github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
-github.com/pires/go-proxyproto v0.11.0 h1:gUQpS85X/VJMdUsYyEgyn59uLJvGqPhJV5YvG68wXH4=
-github.com/pires/go-proxyproto v0.11.0/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
+github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
+github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=
+github.com/otiai10/copy v1.14.0 h1:dCI/t1iTdYGtkvCuBG2BgR6KZa83PTclw4U5n2wAllU=
+github.com/otiai10/copy v1.14.0/go.mod h1:ECfuL02W+/FkTWZWgQqXPWZgW9oeKCSQ5qVfSc4qc4w=
+github.com/otiai10/mint v1.5.1 h1:XaPLeE+9vGbuyEHem1JNk3bYc7KKqyI/na0/mLd/Kks=
+github.com/otiai10/mint v1.5.1/go.mod h1:MJm72SBthJjz8qhefc4z1PYEieWmy8Bku7CjcAqyUSM=
+github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
+github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
+github.com/pires/go-proxyproto v0.8.0 h1:5unRmEAPbHXHuLjDg01CxJWf91cw3lKHc/0xzKpXEe0=
+github.com/pires/go-proxyproto v0.8.0/go.mod h1:iknsfgnH8EkjrMeMyvfKByp9TiBZCKZM0jx2xmKqnVY=
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/sftp v1.13.10 h1:+5FbKNTe5Z9aspU88DPIKJ9z2KZoaGCu6Sr6kKR/5mU=
-github.com/pkg/sftp v1.13.10/go.mod h1:bJ1a7uDhrX/4OII+agvy28lzRvQrmIQuaHrcI1HbeGA=
+github.com/pkg/sftp v1.13.7 h1:uv+I3nNJvlKZIQGSr8JVQLNHFU9YhhNpvC14Y6KgmSM=
+github.com/pkg/sftp v1.13.7/go.mod h1:KMKI0t3T6hfA+lTR/ssZdunHo+uwq7ghoN09/FSu3DY=
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -281,136 +337,165 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
-github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
-github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
-github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
-github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
-github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
-github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
-github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
-github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/pquerna/otp v1.4.0 h1:wZvl1TIVxKRThZIBiwOOHOGP/1+nZyWBil9Y2XNEDzg=
+github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
+github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
+github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
+github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
+github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
+github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/common v0.60.1 h1:FUas6GcOw66yB/73KC+BOZoFJmbo/1pojoILArPAaSc=
+github.com/prometheus/common v0.60.1/go.mod h1:h0LYf1R1deLSKtD4Vdg8gy4RuOvENW2J/h19V5NADQw=
+github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
+github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
+github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
github.com/rs/xid v1.6.0 h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=
github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
-github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
-github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
+github.com/rs/zerolog v1.33.0 h1:1cU2KZkvPxNyfgEmhHAz/1A9Bz+llsdYzklWFzgp0r8=
+github.com/rs/zerolog v1.33.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sagikazarmark/locafero v0.12.0 h1:/NQhBAkUb4+fH1jivKHWusDYFjMOOKU88eegjfxfHb4=
-github.com/sagikazarmark/locafero v0.12.0/go.mod h1:sZh36u/YSZ918v0Io+U9ogLYQJ9tLLBmM4eneO6WwsI=
+github.com/sagikazarmark/locafero v0.6.0 h1:ON7AQg37yzcRPU69mt7gwhFEBwxI6P9T4Qu3N51bwOk=
+github.com/sagikazarmark/locafero v0.6.0/go.mod h1:77OmuIc6VTraTXKXIs/uvUxKGUXjE1GbemJYHqdNjX0=
+github.com/sagikazarmark/slog-shim v0.1.0 h1:diDBnUNK9N/354PgrxMywXnAwEr1QZcOr6gto+ugjYE=
+github.com/sagikazarmark/slog-shim v0.1.0/go.mod h1:SrcSrq8aKtyuqEI1uvTDTK1arOWRIczQRv+GVI1AkeQ=
github.com/secsy/goftp v0.0.0-20200609142545-aa2de14babf4 h1:PT+ElG/UUFMfqy5HrxJxNzj3QBOf7dZwupeVC+mG1Lo=
github.com/secsy/goftp v0.0.0-20200609142545-aa2de14babf4/go.mod h1:MnkX001NG75g3p8bhFycnyIjeQoOjGL6CEIsdE/nKSY=
-github.com/sftpgo/sdk v0.1.9 h1:onBWfibCt34xHeKC2KFYPZ1DBqXGl9um/cAw+AVdgzY=
-github.com/sftpgo/sdk v0.1.9/go.mod h1:ehimvlTP+XTEiE3t1CPwWx9n7+6A6OGvMGlZ7ouvKFk=
+github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys=
+github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
+github.com/sftpgo/sdk v0.1.8 h1:HAywJl9jZnigFGztA/CWLieOW+R+HH6js6o6/qYvuSY=
+github.com/sftpgo/sdk v0.1.8/go.mod h1:Isl0IEzS/Muvh8Fr4X+NWFsOS/fZQHRD4oPQpoY7C4g=
github.com/shirou/gopsutil/v3 v3.24.5 h1:i0t8kL+kQTvpAYToeuiVk3TgDeKOFioZO3Ztz/iZ9pI=
github.com/shirou/gopsutil/v3 v3.24.5/go.mod h1:bsoOS1aStSs9ErQ1WWfxllSeS1K5D+U30r2NfcubMVk=
-github.com/shoenig/go-m1cpu v0.2.0 h1:t4GNqvPZ84Vjtpboo/kT3pIkbaK3vc+JIlD/Wz1zSFY=
-github.com/shoenig/go-m1cpu v0.2.0/go.mod h1:KkDOw6m3ZJQAPHbrzkZki4hnx+pDRR1Lo+ldA56wD5w=
-github.com/shoenig/test v1.7.0 h1:eWcHtTXa6QLnBvm0jgEabMRN/uJ4DMV3M8xUGgRkZmk=
-github.com/shoenig/test v1.7.0/go.mod h1:UxJ6u/x2v/TNs/LoLxBNJRV9DiwBBKYxXSyczsBHFoI=
-github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
-github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
-github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
-github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
-github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
-github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
-github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
-github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
-github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
-github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
+github.com/shoenig/go-m1cpu v0.1.6 h1:nxdKQNcEB6vzgA2E2bvzKIYRuNj7XNJ4S/aRSwKzFtM=
+github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg9SUEw2VQ=
+github.com/shoenig/test v0.6.4 h1:kVTaSd7WLz5WZ2IaoM0RSzRsUD+m8wRR+5qvntpn4LU=
+github.com/shoenig/test v0.6.4/go.mod h1:byHiCGXqrVaflBLAMq/srcZIHynQPQgeyvkvXnjqq0k=
+github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
+github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
+github.com/spf13/afero v1.11.0 h1:WJQKhtpdm3v2IzqG8VMqrr6Rf3UYpEF239Jy9wNepM8=
+github.com/spf13/afero v1.11.0/go.mod h1:GH9Y3pIexgf1MTIWtNGyogA5MwRIDXGUr+hbWNoBjkY=
+github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
+github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
+github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.19.0 h1:RWq5SEjt8o25SROyN3z2OrDB9l7RPd3lwTWU8EcEdcI=
+github.com/spf13/viper v1.19.0/go.mod h1:GQUN9bilAbhU/jgc1bKs99f/suXKeUMct8Adx5+Ntkg=
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/studio-b12/gowebdav v0.12.0 h1:kFRtQECt8jmVAvA6RHBz3geXUGJHUZA6/IKpOVUs5kM=
-github.com/studio-b12/gowebdav v0.12.0/go.mod h1:bHA7t77X/QFExdeAnDzK6vKM34kEZAcE1OX4MfiwjkE=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/studio-b12/gowebdav v0.9.0 h1:1j1sc9gQnNxbXXM4M/CebPOX4aXYtr7MojAVcN4dHjU=
+github.com/studio-b12/gowebdav v0.9.0/go.mod h1:bHA7t77X/QFExdeAnDzK6vKM34kEZAcE1OX4MfiwjkE=
github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=
-github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
-github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=
-github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ=
+github.com/tklauser/go-sysconf v0.3.14 h1:g5vzr9iPFFz24v2KZXs/pvpvh8/V9Fw6vQK5ZZb78yU=
+github.com/tklauser/go-sysconf v0.3.14/go.mod h1:1ym4lWMLUOhuBOPGtRcJm7tEGX4SCYNEEEtghGG/8uY=
+github.com/tklauser/numcpus v0.9.0 h1:lmyCHtANi8aRUgkckBgoDk1nHCux3n2cgkJLXdQGPDo=
+github.com/tklauser/numcpus v0.9.0/go.mod h1:SN6Nq1O3VychhC1npsWostA+oW+VOQTxZrS604NSRyI=
github.com/unrolled/secure v1.17.0 h1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=
github.com/unrolled/secure v1.17.0/go.mod h1:BmF5hyM6tXczk3MpQkFf1hpKSRqCyhqcbiQtiAF7+40=
github.com/wagslane/go-password-validator v0.3.0 h1:vfxOPzGHkz5S146HDpavl0cw1DSVP061Ry2PX0/ON6I=
github.com/wagslane/go-password-validator v0.3.0/go.mod h1:TI1XJ6T5fRdRnHqHt14pvy1tNVnrwe7m3/f1f2fDphQ=
-github.com/wneessen/go-mail v0.7.2 h1:xxPnhZ6IZLSgxShebmZ6DPKh1b6OJcoHfzy7UjOkzS8=
-github.com/wneessen/go-mail v0.7.2/go.mod h1:+TkW6QP3EVkgTEqHtVmnAE/1MRhmzb8Y9/W3pweuS+k=
+github.com/wneessen/go-mail v0.5.2 h1:MZKwgHJoRboLJ+EHMLuHpZc95wo+u1xViL/4XSswDT8=
+github.com/wneessen/go-mail v0.5.2/go.mod h1:kRroJvEq2hOSEPFRiKjN7Csrz0G1w+RpiGR3b6yo+Ck=
github.com/yl2chen/cidranger v1.0.3-0.20210928021809-d1cb2c52f37a h1:XfF01GyP+0eWCaVp0y6rNN+kFp7pt9Da4UUYrJ5XPWA=
github.com/yl2chen/cidranger v1.0.3-0.20210928021809-d1cb2c52f37a/go.mod h1:aXb8yZQEWo1XHGMf1qQfnb83GR/EJ2EBlwtUgAaNBoE=
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
-go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
-go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
-go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/detectors/gcp v1.42.0 h1:kpt2PEJuOuqYkPcktfJqWWDjTEd/FNgrxcniL7kQrXQ=
-go.opentelemetry.io/contrib/detectors/gcp v1.42.0/go.mod h1:W9zQ439utxymRrXsUOzZbFX4JhLxXU4+ZnCt8GG7yA8=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
-go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=
-go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.39.0 h1:5gn2urDL/FBnK8OkCfD1j3/ER79rUuTYmCvlXBKeYL8=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.39.0/go.mod h1:0fBG6ZJxhqByfFZDwSwpZGzJU671HkwpWaNe2t4VUPI=
-go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=
-go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=
-go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=
-go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=
-go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=
-go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=
-go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=
-go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=
-go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
-go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
-go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-gocloud.dev v0.45.0 h1:WknIK8IbRdmynDvara3Q7G6wQhmEiOGwpgJufbM39sY=
-gocloud.dev v0.45.0/go.mod h1:0kXKmkCLG6d31N7NyLZWzt7jDSQura9zD/mWgiB6THI=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
-golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
+go.etcd.io/bbolt v1.3.11 h1:yGEzV1wPz2yVCLsD8ZAiGHhHVlczyC9d1rP43/VCRJ0=
+go.etcd.io/bbolt v1.3.11/go.mod h1:dksAq7YMXoljX0xu6VF5DMZGbhYYoLUalEiSySYAS4I=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+go.opentelemetry.io/contrib/detectors/gcp v1.32.0 h1:P78qWqkLSShicHmAzfECaTgvslqHxblNE9j62Ws1NK8=
+go.opentelemetry.io/contrib/detectors/gcp v1.32.0/go.mod h1:TVqo0Sda4Cv8gCIixd7LuLwW4EylumVWfhjZJjDD4DU=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.57.0 h1:qtFISDHKolvIxzSs0gIaiPUPR0Cucb0F2coHC7ZLdps=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.57.0/go.mod h1:Y+Pop1Q6hCOnETWTW4NROK/q1hv50hM7yDaUTjG8lp8=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.57.0 h1:DheMAlT6POBP+gh8RUH19EOTnQIor5QE0uSRPtzCpSw=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.57.0/go.mod h1:wZcGmeVO9nzP67aYSLDqXNWK87EZWhi7JWj1v7ZXf94=
+go.opentelemetry.io/otel v1.32.0 h1:WnBN+Xjcteh0zdk01SVqV55d/m62NJLJdIyb4y/WO5U=
+go.opentelemetry.io/otel v1.32.0/go.mod h1:00DCVSB0RQcnzlwyTfqtxSm+DRr9hpYrHjNGiBHVQIg=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.29.0 h1:WDdP9acbMYjbKIyJUhTvtzj601sVJOqgWdUxSdR/Ysc=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.29.0/go.mod h1:BLbf7zbNIONBLPwvFnwNHGj4zge8uTCM/UPIVW1Mq2I=
+go.opentelemetry.io/otel/metric v1.32.0 h1:xV2umtmNcThh2/a/aCP+h64Xx5wsj8qqnkYZktzNa0M=
+go.opentelemetry.io/otel/metric v1.32.0/go.mod h1:jH7CIbbK6SH2V2wE16W05BHCtIDzauciCRLoc/SyMv8=
+go.opentelemetry.io/otel/sdk v1.32.0 h1:RNxepc9vK59A8XsgZQouW8ue8Gkb4jpWtJm9ge5lEG4=
+go.opentelemetry.io/otel/sdk v1.32.0/go.mod h1:LqgegDBjKMmb2GC6/PrTnteJG39I8/vJCAP9LlJXEjU=
+go.opentelemetry.io/otel/sdk/metric v1.32.0 h1:rZvFnvmvawYb0alrYkjraqJq0Z4ZUJAiyYCU9snn1CU=
+go.opentelemetry.io/otel/sdk/metric v1.32.0/go.mod h1:PWeZlq0zt9YkYAp3gjKZ0eicRYvOh1Gd+X99x6GHpCQ=
+go.opentelemetry.io/otel/trace v1.32.0 h1:WIC9mYrXf8TmY/EXuULKc8hR17vE+Hjv2cssQDe03fM=
+go.opentelemetry.io/otel/trace v1.32.0/go.mod h1:+i4rkvCraA+tG6AzwloGaCtkx53Fa+L+V8e9a7YvhT8=
+go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
+go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+gocloud.dev v0.40.0 h1:f8LgP+4WDqOG/RXoUcyLpeIAGOcAbZrZbDQCUee10ng=
+gocloud.dev v0.40.0/go.mod h1:drz+VyYNBvrMTW0KZiBAYEdl8lbNZx+OQ7oQvdrFmSQ=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f h1:XdNn9LlyWAhLVp6P/i8QYBW+hlyhrhei9uErw2B5GJo=
+golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f/go.mod h1:D5SMRVC3C2/4+F/DB1wZsLRnSNimn2Sp/NPsCrsv8ak=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
-golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
+golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/net v0.31.0 h1:68CPQngjLL0r2AlUKiSxtQFKvzRVbnzLwMUn5SzcLHo=
+golang.org/x/net v0.31.0/go.mod h1:P4fl1q7dY2hnZFxEk4pPSkDHF+QqjitcnDjUQyMM+pM=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
+golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.9.0 h1:fEo0HyrW1GIgZdpbhCRO0PkJajUS5H9IFUztCgEo2jQ=
+golang.org/x/sync v0.9.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210601080250-7ecdf8ef093b/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -421,57 +506,90 @@ golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBc
golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
+golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/term v0.26.0 h1:WEQa6V3Gja/BhNxg540hBip/kkaYtRg3cxg4oXSw4AU=
+golang.org/x/term v0.26.0/go.mod h1:Si5m1o57C5nBNQo5z1iq+XDijt21BDBDp2bK0QI8e3E=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
-golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
-golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.20.0 h1:gK/Kv2otX8gz+wn7Rmb3vT96ZwuoxnQlY+HlJVj7Qug=
+golang.org/x/text v0.20.0/go.mod h1:D4IsuqiFMhST5bX19pQ9ikHC2GsaKyk/oF+pn3ducp4=
+golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
+golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
-golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.27.0 h1:qEKojBykQkQ4EynWy4S8Weg69NumxKdn40Fce3uc/8o=
+golang.org/x/tools v0.27.0/go.mod h1:sUi0ZgbwW9ZPAq26Ekut+weQPR5eIM6GQLQ1Yjm1H0Q=
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da h1:noIWHXmPHxILtqtCOPIhSt0ABwskkZKjD3bXGnZGpNY=
golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
-gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
-gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/api v0.271.0 h1:cIPN4qcUc61jlh7oXu6pwOQqbJW2GqYh5PS6rB2C/JY=
-google.golang.org/api v0.271.0/go.mod h1:CGT29bhwkbF+i11qkRUJb2KMKqcJ1hdFceEIRd9u64Q=
-google.golang.org/genproto v0.0.0-20260311181403-84a4fc48630c h1:ZhFDeBMmFc/4g8/GwxnJ4rzB3O4GwQVNr+8Mh7Y5z4g=
-google.golang.org/genproto v0.0.0-20260311181403-84a4fc48630c/go.mod h1:hf4r/rBuzaTkLUWRO03771Xvcs6P5hwdQK3UUEJjqo0=
-google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c h1:OyQPd6I3pN/9gDxz6L13kYGJgqkpdrAohJRBeXyxlgI=
-google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c/go.mod h1:X2gu9Qwng7Nn009s/r3RUxqkzQNqOrAy79bluY7ojIg=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c h1:xgCzyF2LFIO/0X2UAoVRiXKU5Xg6VjToG4i2/ecSswk=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.79.2 h1:fRMD94s2tITpyJGtBBn7MkMseNpOZU8ZxgC3MMBaXRU=
-google.golang.org/grpc v1.79.2/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/api v0.209.0 h1:Ja2OXNlyRlWCWu8o+GgI4yUn/wz9h/5ZfFbKz+dQX+w=
+google.golang.org/api v0.209.0/go.mod h1:I53S168Yr/PNDNMi5yPnDc0/LGRZO6o7PoEbl/HY3CM=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
+google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 h1:ToEetK57OidYuqD4Q5w+vfEnPvPpuTwedCNVohYJfNk=
+google.golang.org/genproto v0.0.0-20241118233622-e639e219e697/go.mod h1:JJrvXBWRZaFMxBufik1a4RpFw4HhgVtBBWQeQgUj2cc=
+google.golang.org/genproto/googleapis/api v0.0.0-20241118233622-e639e219e697 h1:pgr/4QbFyktUv9CtQ/Fq4gzEE6/Xs7iCXbktaGzLHbQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20241118233622-e639e219e697/go.mod h1:+D9ySVjN8nY8YCVjc5O7PZDIdZporIDY3KaGfJunh88=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241118233622-e639e219e697 h1:LWZqQOEjDyONlF1H6afSWpAL/znlREo2tHfLoe+8LMA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241118233622-e639e219e697/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
+google.golang.org/grpc v1.68.0 h1:aHQeeJbo8zAkAa3pRzrVjZlbz6uSfeOXlJNQM0RAbz0=
+google.golang.org/grpc v1.68.0/go.mod h1:fmSPC5AsjSBCK54MyHRx48kpOti1/jRfOlwEWywNjWA=
+google.golang.org/grpc/stats/opentelemetry v0.0.0-20241028142157-ada6787961b3 h1:hUfOButuEtpc0UvYiaYRbNwxVYr0mQQOWq6X8beJ9Gc=
+google.golang.org/grpc/stats/opentelemetry v0.0.0-20241028142157-ada6787961b3/go.mod h1:jzYlkSMbKypzuu6xoAEijsNVo9ZeDF1u/zCfFgsx7jg=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+google.golang.org/protobuf v1.35.2 h1:8Ar7bF+apOIoThw1EdZl0p1oWvMqTHmpA2fRTyZO8io=
+google.golang.org/protobuf v1.35.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
+gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/img/logo.png b/img/logo.png
index 81b1f94b..0c320ff7 100644
Binary files a/img/logo.png and b/img/logo.png differ
diff --git a/img/reui.png b/img/reui.png
deleted file mode 100644
index 20973803..00000000
Binary files a/img/reui.png and /dev/null differ
diff --git a/img/servinga.png b/img/servinga.png
deleted file mode 100644
index c5ccb638..00000000
Binary files a/img/servinga.png and /dev/null differ
diff --git a/img/vps2day.png b/img/vps2day.png
new file mode 100644
index 00000000..faddcf15
Binary files /dev/null and b/img/vps2day.png differ
diff --git a/init/sftpgo b/init/sftpgo
deleted file mode 100755
index 6da97d15..00000000
--- a/init/sftpgo
+++ /dev/null
@@ -1,102 +0,0 @@
-#! /bin/sh
-
-### BEGIN INIT INFO
-# Provides: SFTPGo
-# Required-Start: $remote_fs $syslog
-# Required-Stop: $remote_fs $syslog
-# Default-Start: 2 3 4 5
-# Default-Stop:
-# Short-Description: SFTPGo server
-### END INIT INFO
-
-set -e
-
-# /etc/init.d/sftpgo: start and stop the SFTPGo "server" daemon
-
-SFTPGO_USER="sftpgo"
-SFTPGO_GROUP="sftpgo"
-SFTPGO_BIN_NAME="sftpgo"
-SFTPGO_BIN="/usr/bin/sftpgo"
-SFTPGO_PID="/run/sftpgo.pid"
-SFTPGO_CONF_DIR="/etc/sftpgo"
-SFTPGO_CONF_FILE="sftpgo.json"
-SFTPGO_OPTS="serve -c $SFTPGO_CONF_DIR --config-file $SFTPGO_CONF_FILE"
-
-umask 022
-
-test -x $SFTPGO_BIN || exit 0
-
-
-if test -f /etc/default/$SFTPGO_BIN_NAME; then
- . /etc/default/$SFTPGO_BIN_NAME
-fi
-
-. /lib/lsb/init-functions
-
-if [ -n "$2" ]; then
- SFTPGO_OPTS="$SFTPGO_OPTS $2"
-fi
-
-# Are we running from init?
-run_by_init() {
- ([ "$previous" ] && [ "$runlevel" ]) || [ "$runlevel" = S ]
-}
-
-check_dev_null() {
- if [ ! -c /dev/null ]; then
- if [ "$1" = log_end_msg ]; then
- log_end_msg 1 || true
- fi
- if ! run_by_init; then
- log_action_msg "/dev/null is not a character device!" || true
- fi
- exit 1
- fi
-}
-
-write_pid() {
- sleep 0.25
- echo $(/bin/pidof $SFTPGO_BIN_NAME) > $SFTPGO_PID
-}
-
-export PATH="${PATH:+$PATH:}/usr/sbin:/sbin"
-
-case "$1" in
- start)
- check_dev_null
- log_daemon_msg "Starting SFTPGo server" "$SFTPGO_BIN_NAME" || true
- if start-stop-daemon --start --background --quiet --oknodo --chuid $SFTPGO_USER:$SFTPGO_GROUP --pidfile $SFTPGO_PID --exec $SFTPGO_BIN -- $SFTPGO_OPTS; then
- log_end_msg 0 || true
- write_pid
- else
- log_end_msg 1 || true
- fi
- ;;
- stop)
- log_daemon_msg "Stopping SFTPGo server" "$SFTPGO_BIN_NAME" || true
- if start-stop-daemon --stop --quiet --oknodo --pidfile $SFTPGO_PID --exec $SFTPGO_BIN; then
- log_end_msg 0 || true
- else
- log_end_msg 1 || true
- fi
- ;;
-
- reload)
- log_daemon_msg "Reloading SFTPGo server" "$SFTPGO_BIN_NAME" || true
- if start-stop-daemon --stop --signal 1 --quiet --oknodo --pidfile $SFTPGO_PID --exec $SFTPGO_BIN; then
- log_end_msg 0 || true
- else
- log_end_msg 1 || true
- fi
- ;;
-
- status)
- status_of_proc -p $SFTPGO_PID $SFTPGO_BIN $SFTPGO_BIN_NAME && exit 0 || exit $?
- ;;
-
- *)
- log_action_msg "Usage: /etc/init.d/$SFTPGO_BIN_NAME {start|stop|reload|status}" || true
- exit 1
-esac
-
-exit 0
diff --git a/internal/acme/acme.go b/internal/acme/acme.go
index 6c4612e5..6ac395f0 100644
--- a/internal/acme/acme.go
+++ b/internal/acme/acme.go
@@ -30,7 +30,6 @@ import (
"net/url"
"os"
"path/filepath"
- "slices"
"strconv"
"strings"
"time"
@@ -44,7 +43,6 @@ import (
"github.com/go-acme/lego/v4/log"
"github.com/go-acme/lego/v4/providers/http/webroot"
"github.com/go-acme/lego/v4/registration"
- "github.com/hashicorp/go-retryablehttp"
"github.com/robfig/cron/v3"
"github.com/drakkan/sftpgo/v2/internal/common"
@@ -251,7 +249,7 @@ func (c *Configuration) Initialize(configDir string) error {
if c.RenewDays < 1 {
return fmt.Errorf("invalid number of days remaining before renewal: %d", c.RenewDays)
}
- if !slices.Contains(supportedKeyTypes, c.KeyType) {
+ if !util.Contains(supportedKeyTypes, c.KeyType) {
return fmt.Errorf("invalid key type %q", c.KeyType)
}
caURL, err := url.Parse(c.CAEndpoint)
@@ -491,16 +489,7 @@ func (c *Configuration) setup() (*account, *lego.Client, error) {
config := lego.NewConfig(&account)
config.CADirURL = c.CAEndpoint
config.Certificate.KeyType = certcrypto.KeyType(c.KeyType)
- config.Certificate.OverallRequestLimit = 6
config.UserAgent = version.GetServerVersion("/", false)
-
- retryClient := retryablehttp.NewClient()
- retryClient.Logger = &logger.LeveledLogger{Sender: "RetryableHTTPClient"}
- retryClient.RetryMax = 5
- retryClient.HTTPClient = config.HTTPClient
-
- config.HTTPClient = retryClient.StandardClient()
-
client, err := lego.NewClient(config)
if err != nil {
acmeLog(logger.LevelError, "unable to get ACME client: %v", err)
@@ -568,13 +557,6 @@ func (c *Configuration) tryRecoverRegistration(privateKey crypto.PrivateKey) (*r
config.CADirURL = c.CAEndpoint
config.UserAgent = version.GetServerVersion("/", false)
- retryClient := retryablehttp.NewClient()
- retryClient.Logger = &logger.LeveledLogger{Sender: "RetryableHTTPClient"}
- retryClient.RetryMax = 5
- retryClient.HTTPClient = config.HTTPClient
-
- config.HTTPClient = retryClient.StandardClient()
-
client, err := lego.NewClient(config)
if err != nil {
acmeLog(logger.LevelError, "unable to get the ACME client: %v", err)
@@ -767,7 +749,7 @@ func (c *Configuration) renewCertificates() error {
func isDomainValid(domain string) (string, bool) {
isValid := false
- for d := range strings.SplitSeq(domain, ",") {
+ for _, d := range strings.Split(domain, ",") {
d = strings.TrimSpace(d)
if d != "" {
isValid = true
@@ -785,7 +767,7 @@ func getDomains(domain string) []string {
delimiter = " "
}
- for d := range strings.SplitSeq(domain, delimiter) {
+ for _, d := range strings.Split(domain, delimiter) {
d = strings.TrimSpace(d)
if d != "" {
domains = append(domains, d)
diff --git a/internal/bundle/bundle.go b/internal/bundle/bundle.go
index 077fb360..70934ace 100644
--- a/internal/bundle/bundle.go
+++ b/internal/bundle/bundle.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build bundle
+// +build bundle
package bundle
diff --git a/internal/cmd/acme.go b/internal/cmd/acme.go
index e98cf515..bce51598 100644
--- a/internal/cmd/acme.go
+++ b/internal/cmd/acme.go
@@ -24,7 +24,6 @@ import (
"github.com/drakkan/sftpgo/v2/internal/config"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
"github.com/drakkan/sftpgo/v2/internal/logger"
- "github.com/drakkan/sftpgo/v2/internal/plugin"
"github.com/drakkan/sftpgo/v2/internal/util"
)
@@ -57,15 +56,6 @@ renewed by the SFTPGo service
logger.ErrorToConsole("unable to initialize KMS: %v", err)
os.Exit(1)
}
- if config.HasKMSPlugin() {
- if err := plugin.Initialize(config.GetPluginsConfig(), "debug"); err != nil {
- logger.ErrorToConsole("unable to initialize plugin system: %v", err)
- os.Exit(1)
- }
- registerSignals()
- defer plugin.Handler.Cleanup()
- }
-
mfaConfig := config.GetMFAConfig()
err = mfaConfig.Initialize()
if err != nil {
diff --git a/internal/cmd/awscontainer.go b/internal/cmd/awscontainer.go
new file mode 100644
index 00000000..72deee90
--- /dev/null
+++ b/internal/cmd/awscontainer.go
@@ -0,0 +1,34 @@
+// Copyright (C) 2019 Nicola Murino
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published
+// by the Free Software Foundation, version 3.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see .
+
+//go:build awscontainer
+// +build awscontainer
+
+package cmd
+
+import (
+ "github.com/spf13/cobra"
+ "github.com/spf13/viper"
+)
+
+func addAWSContainerFlags(cmd *cobra.Command) {
+ viper.SetDefault("disable_aws_installation_code", false)
+ viper.BindEnv("disable_aws_installation_code", "SFTPGO_DISABLE_AWS_INSTALLATION_CODE") //nolint:errcheck
+ cmd.Flags().BoolVar(&disableAWSInstallationCode, "disable-aws-installation-code", viper.GetBool("disable_aws_installation_code"),
+ `Disable installation code for the AWS container.
+This flag can be set using
+SFTPGO_DISABLE_AWS_INSTALLATION_CODE env var too.
+`)
+ viper.BindPFlag("disable_aws_installation_code", cmd.Flags().Lookup("disable-aws-installation-code")) //nolint:errcheck
+}
diff --git a/internal/cmd/signals_windows.go b/internal/cmd/awscontainer_disabled.go
similarity index 62%
rename from internal/cmd/signals_windows.go
rename to internal/cmd/awscontainer_disabled.go
index 3ea1e6ff..3dbd8599 100644
--- a/internal/cmd/signals_windows.go
+++ b/internal/cmd/awscontainer_disabled.go
@@ -1,4 +1,4 @@
-// Copyright (C) 2025 Nicola Murino
+// Copyright (C) 2019 Nicola Murino
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published
@@ -12,25 +12,13 @@
// You should have received a copy of the GNU Affero General Public License
// along with this program. If not, see .
+//go:build !awscontainer
+// +build !awscontainer
+
package cmd
import (
- "os"
- "os/signal"
-
- "github.com/drakkan/sftpgo/v2/internal/logger"
- "github.com/drakkan/sftpgo/v2/internal/plugin"
+ "github.com/spf13/cobra"
)
-func registerSignals() {
- c := make(chan os.Signal, 1)
- signal.Notify(c, os.Interrupt)
-
- go func() {
- for range c {
- logger.DebugToConsole("Received interrupt request")
- plugin.Handler.Cleanup()
- os.Exit(0)
- }
- }()
-}
+func addAWSContainerFlags(_ *cobra.Command) {}
diff --git a/internal/cmd/initprovider.go b/internal/cmd/initprovider.go
index 8862d261..c61ad228 100644
--- a/internal/cmd/initprovider.go
+++ b/internal/cmd/initprovider.go
@@ -21,11 +21,9 @@ import (
"github.com/spf13/cobra"
"github.com/spf13/viper"
- "github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/config"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
"github.com/drakkan/sftpgo/v2/internal/logger"
- "github.com/drakkan/sftpgo/v2/internal/plugin"
"github.com/drakkan/sftpgo/v2/internal/service"
"github.com/drakkan/sftpgo/v2/internal/util"
)
@@ -67,15 +65,6 @@ Please take a look at the usage below to customize the options.`,
logger.ErrorToConsole("Unable to initialize KMS: %v", err)
os.Exit(1)
}
- if config.HasKMSPlugin() {
- if err := plugin.Initialize(config.GetPluginsConfig(), "debug"); err != nil {
- logger.ErrorToConsole("unable to initialize plugin system: %v", err)
- os.Exit(1)
- }
- registerSignals()
- defer plugin.Handler.Cleanup()
- }
-
mfaConfig := config.GetMFAConfig()
err = mfaConfig.Initialize()
if err != nil {
@@ -89,20 +78,15 @@ Please take a look at the usage below to customize the options.`,
providerConf.Actions.ExecuteOn = nil
logger.InfoToConsole("Initializing provider: %q config file: %q", providerConf.Driver, viper.ConfigFileUsed())
err = dataprovider.InitializeDatabase(providerConf, configDir)
- switch err {
- case nil:
+ if err == nil {
logger.InfoToConsole("Data provider successfully initialized/updated")
- case dataprovider.ErrNoInitRequired:
+ } else if err == dataprovider.ErrNoInitRequired {
logger.InfoToConsole("%v", err.Error())
- default:
+ } else {
logger.ErrorToConsole("Unable to initialize/update the data provider: %v", err)
os.Exit(1)
}
if providerConf.Driver != dataprovider.MemoryDataProviderName && loadDataFrom != "" {
- if err := common.Initialize(config.GetCommonConfig(), providerConf.GetShared()); err != nil {
- logger.ErrorToConsole("%v", err)
- os.Exit(1)
- }
service := service.Service{
LoadDataFrom: loadDataFrom,
LoadDataMode: loadDataMode,
diff --git a/internal/cmd/portable.go b/internal/cmd/portable.go
index 356371a9..0a39fb20 100644
--- a/internal/cmd/portable.go
+++ b/internal/cmd/portable.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build !noportable
+// +build !noportable
package cmd
@@ -496,7 +497,7 @@ func getPatternsFilterValues(value string) (string, []string) {
if len(dirExts) > 1 {
dir := strings.TrimSpace(dirExts[0])
exts := []string{}
- for e := range strings.SplitSeq(dirExts[1], ",") {
+ for _, e := range strings.Split(dirExts[1], ",") {
cleanedExt := strings.TrimSpace(e)
if cleanedExt != "" {
exts = append(exts, cleanedExt)
diff --git a/internal/cmd/portable_disabled.go b/internal/cmd/portable_disabled.go
index f043ee7e..5e2b7974 100644
--- a/internal/cmd/portable_disabled.go
+++ b/internal/cmd/portable_disabled.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build noportable
+// +build noportable
package cmd
diff --git a/internal/cmd/resetpwd.go b/internal/cmd/resetpwd.go
index eb009e31..fec8c4ea 100644
--- a/internal/cmd/resetpwd.go
+++ b/internal/cmd/resetpwd.go
@@ -27,7 +27,6 @@ import (
"github.com/drakkan/sftpgo/v2/internal/config"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
"github.com/drakkan/sftpgo/v2/internal/logger"
- "github.com/drakkan/sftpgo/v2/internal/plugin"
"github.com/drakkan/sftpgo/v2/internal/util"
)
@@ -59,15 +58,6 @@ Please take a look at the usage below to customize the options.`,
logger.ErrorToConsole("unable to initialize KMS: %v", err)
os.Exit(1)
}
- if config.HasKMSPlugin() {
- if err := plugin.Initialize(config.GetPluginsConfig(), "debug"); err != nil {
- logger.ErrorToConsole("unable to initialize plugin system: %v", err)
- os.Exit(1)
- }
- registerSignals()
- defer plugin.Handler.Cleanup()
- }
-
mfaConfig := config.GetMFAConfig()
err = mfaConfig.Initialize()
if err != nil {
diff --git a/internal/cmd/revertprovider.go b/internal/cmd/revertprovider.go
index 09b8d1a8..64de3529 100644
--- a/internal/cmd/revertprovider.go
+++ b/internal/cmd/revertprovider.go
@@ -24,7 +24,6 @@ import (
"github.com/drakkan/sftpgo/v2/internal/config"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
"github.com/drakkan/sftpgo/v2/internal/logger"
- "github.com/drakkan/sftpgo/v2/internal/plugin"
"github.com/drakkan/sftpgo/v2/internal/util"
)
@@ -41,8 +40,8 @@ Please take a look at the usage below to customize the options.`,
Run: func(_ *cobra.Command, _ []string) {
logger.DisableLogger()
logger.EnableConsoleLogger(zerolog.DebugLevel)
- if revertProviderTargetVersion != 33 {
- logger.WarnToConsole("Unsupported target version, 33 is the only supported one")
+ if revertProviderTargetVersion != 28 {
+ logger.WarnToConsole("Unsupported target version, 28 is the only supported one")
os.Exit(1)
}
configDir = util.CleanDirInput(configDir)
@@ -57,21 +56,6 @@ Please take a look at the usage below to customize the options.`,
logger.ErrorToConsole("unable to initialize KMS: %v", err)
os.Exit(1)
}
- if config.HasKMSPlugin() {
- if err := plugin.Initialize(config.GetPluginsConfig(), "debug"); err != nil {
- logger.ErrorToConsole("unable to initialize plugin system: %v", err)
- os.Exit(1)
- }
- registerSignals()
- defer plugin.Handler.Cleanup()
- }
-
- mfaConfig := config.GetMFAConfig()
- err = mfaConfig.Initialize()
- if err != nil {
- logger.ErrorToConsole("Unable to initialize MFA: %v", err)
- os.Exit(1)
- }
providerConf := config.GetProviderConf()
logger.InfoToConsole("Reverting provider: %q config file: %q target version %d", providerConf.Driver,
viper.ConfigFileUsed(), revertProviderTargetVersion)
@@ -87,7 +71,7 @@ Please take a look at the usage below to customize the options.`,
func init() {
addConfigFlags(revertProviderCmd)
- revertProviderCmd.Flags().IntVar(&revertProviderTargetVersion, "to-version", 33, `33 means the version supported in v2.7.x`)
+ revertProviderCmd.Flags().IntVar(&revertProviderTargetVersion, "to-version", 28, `28 means the version supported in v2.5.x`)
rootCmd.AddCommand(revertProviderCmd)
}
diff --git a/internal/cmd/root.go b/internal/cmd/root.go
index 00759236..ba96be58 100644
--- a/internal/cmd/root.go
+++ b/internal/cmd/root.go
@@ -85,6 +85,8 @@ var (
loadDataQuotaScan int
loadDataClean bool
graceTime int
+ // used if awscontainer build tag is enabled
+ disableAWSInstallationCode bool
rootCmd = &cobra.Command{
Use: "sftpgo",
diff --git a/internal/cmd/serve.go b/internal/cmd/serve.go
index 348fb834..519fa78f 100644
--- a/internal/cmd/serve.go
+++ b/internal/cmd/serve.go
@@ -61,7 +61,7 @@ Please take a look at the usage below to customize the startup options`,
LoadDataClean: loadDataClean,
Shutdown: make(chan bool),
}
- if err := service.Start(); err == nil {
+ if err := service.Start(disableAWSInstallationCode); err == nil {
service.Wait()
if service.Error == nil {
os.Exit(0)
@@ -144,4 +144,5 @@ func checkServeParamsFromEnvFiles(configDir string) { //nolint:gocyclo
func init() {
rootCmd.AddCommand(serveCmd)
addServeFlags(serveCmd)
+ addAWSContainerFlags(serveCmd)
}
diff --git a/internal/cmd/startsubsys.go b/internal/cmd/startsubsys.go
new file mode 100644
index 00000000..6f7c5751
--- /dev/null
+++ b/internal/cmd/startsubsys.go
@@ -0,0 +1,227 @@
+// Copyright (C) 2019 Nicola Murino
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published
+// by the Free Software Foundation, version 3.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see .
+
+package cmd
+
+import (
+ "io"
+ "os"
+ "os/user"
+ "path/filepath"
+
+ "github.com/rs/xid"
+ "github.com/rs/zerolog"
+ "github.com/spf13/cobra"
+ "github.com/spf13/viper"
+
+ "github.com/drakkan/sftpgo/v2/internal/common"
+ "github.com/drakkan/sftpgo/v2/internal/config"
+ "github.com/drakkan/sftpgo/v2/internal/dataprovider"
+ "github.com/drakkan/sftpgo/v2/internal/logger"
+ "github.com/drakkan/sftpgo/v2/internal/plugin"
+ "github.com/drakkan/sftpgo/v2/internal/sftpd"
+ "github.com/drakkan/sftpgo/v2/internal/version"
+)
+
+var (
+ logJournalD = false
+ preserveHomeDir = false
+ baseHomeDir = ""
+ subsystemCmd = &cobra.Command{
+ Use: "startsubsys",
+ Short: "Use sftpgo as SFTP file transfer subsystem",
+ Long: `In this mode SFTPGo speaks the server side of SFTP protocol to stdout and
+expects client requests from stdin.
+This mode is not intended to be called directly, but from sshd using the
+Subsystem option.
+For example adding a line like this one in "/etc/ssh/sshd_config":
+
+Subsystem sftp sftpgo startsubsys
+
+Command-line flags should be specified in the Subsystem declaration.
+`,
+ Run: func(_ *cobra.Command, _ []string) {
+ logSender := "startsubsys"
+ connectionID := xid.New().String()
+ var zeroLogLevel zerolog.Level
+ switch logLevel {
+ case "info":
+ zeroLogLevel = zerolog.InfoLevel
+ case "warn":
+ zeroLogLevel = zerolog.WarnLevel
+ case "error":
+ zeroLogLevel = zerolog.ErrorLevel
+ default:
+ zeroLogLevel = zerolog.DebugLevel
+ }
+ logger.SetLogTime(logUTCTime)
+ if logJournalD {
+ logger.InitJournalDLogger(zeroLogLevel)
+ } else {
+ logger.InitStdErrLogger(zeroLogLevel)
+ }
+ osUser, err := user.Current()
+ if err != nil {
+ logger.Error(logSender, connectionID, "unable to get the current user: %v", err)
+ os.Exit(1)
+ }
+ username := osUser.Username
+ homedir := osUser.HomeDir
+ logger.Info(logSender, connectionID, "starting SFTPGo %v as subsystem, user %q home dir %q config dir %q base home dir %q",
+ version.Get(), username, homedir, configDir, baseHomeDir)
+ err = config.LoadConfig(configDir, configFile)
+ if err != nil {
+ logger.Error(logSender, connectionID, "unable to load configuration: %v", err)
+ os.Exit(1)
+ }
+ kmsConfig := config.GetKMSConfig()
+ if err := kmsConfig.Initialize(); err != nil {
+ logger.Error(logSender, connectionID, "unable to initialize KMS: %v", err)
+ os.Exit(1)
+ }
+ if err := plugin.Initialize(config.GetPluginsConfig(), logLevel); err != nil {
+ logger.Error(logSender, connectionID, "unable to initialize plugin system: %v", err)
+ os.Exit(1)
+ }
+ mfaConfig := config.GetMFAConfig()
+ err = mfaConfig.Initialize()
+ if err != nil {
+ logger.Error(logSender, "", "unable to initialize MFA: %v", err)
+ os.Exit(1)
+ }
+ dataProviderConf := config.GetProviderConf()
+ if dataProviderConf.Driver == dataprovider.SQLiteDataProviderName || dataProviderConf.Driver == dataprovider.BoltDataProviderName {
+ logger.Debug(logSender, connectionID, "data provider %q not supported in subsystem mode, using %q provider",
+ dataProviderConf.Driver, dataprovider.MemoryDataProviderName)
+ dataProviderConf.Driver = dataprovider.MemoryDataProviderName
+ dataProviderConf.Name = ""
+ }
+ config.SetProviderConf(dataProviderConf)
+ err = dataprovider.Initialize(dataProviderConf, configDir, false)
+ if err != nil {
+ logger.Error(logSender, connectionID, "unable to initialize the data provider: %v", err)
+ os.Exit(1)
+ }
+ smtpConfig := config.GetSMTPConfig()
+ err = smtpConfig.Initialize(configDir, false)
+ if err != nil {
+ logger.Error(logSender, connectionID, "unable to initialize SMTP configuration: %v", err)
+ os.Exit(1)
+ }
+ commonConfig := config.GetCommonConfig()
+ // idle connection are managed externally
+ commonConfig.IdleTimeout = 0
+ config.SetCommonConfig(commonConfig)
+ if err := common.Initialize(config.GetCommonConfig(), dataProviderConf.GetShared()); err != nil {
+ logger.Error(logSender, connectionID, "%v", err)
+ os.Exit(1)
+ }
+ httpConfig := config.GetHTTPConfig()
+ if err := httpConfig.Initialize(configDir); err != nil {
+ logger.Error(logSender, connectionID, "unable to initialize http client: %v", err)
+ os.Exit(1)
+ }
+ commandConfig := config.GetCommandConfig()
+ if err := commandConfig.Initialize(); err != nil {
+ logger.Error(logSender, connectionID, "unable to initialize commands configuration: %v", err)
+ os.Exit(1)
+ }
+ user, err := dataprovider.UserExists(username, "")
+ if err == nil {
+ if user.HomeDir != filepath.Clean(homedir) && !preserveHomeDir {
+ // update the user
+ user.HomeDir = filepath.Clean(homedir)
+ err = dataprovider.UpdateUser(&user, dataprovider.ActionExecutorSystem, "", "")
+ if err != nil {
+ logger.Error(logSender, connectionID, "unable to update user %q: %v", username, err)
+ os.Exit(1)
+ }
+ }
+ } else {
+ user.Username = username
+ if baseHomeDir != "" && filepath.IsAbs(baseHomeDir) {
+ user.HomeDir = filepath.Join(baseHomeDir, username)
+ } else {
+ user.HomeDir = filepath.Clean(homedir)
+ }
+ logger.Debug(logSender, connectionID, "home dir for new user %q", user.HomeDir)
+ user.Password = connectionID
+ user.Permissions = make(map[string][]string)
+ user.Permissions["/"] = []string{dataprovider.PermAny}
+ err = dataprovider.AddUser(&user, dataprovider.ActionExecutorSystem, "", "")
+ if err != nil {
+ logger.Error(logSender, connectionID, "unable to add user %q: %v", username, err)
+ os.Exit(1)
+ }
+ }
+ err = user.LoadAndApplyGroupSettings()
+ if err != nil {
+ logger.Error(logSender, connectionID, "unable to apply group settings for user %q: %v", username, err)
+ os.Exit(1)
+ }
+ err = sftpd.ServeSubSystemConnection(&user, connectionID, os.Stdin, os.Stdout)
+ if err != nil && err != io.EOF {
+ logger.Warn(logSender, connectionID, "serving subsystem finished with error: %v", err)
+ os.Exit(1)
+ }
+ logger.Info(logSender, connectionID, "serving subsystem finished")
+ plugin.Handler.Cleanup()
+ os.Exit(0)
+ },
+ }
+)
+
+func init() {
+ subsystemCmd.Flags().BoolVarP(&preserveHomeDir, "preserve-home", "p", false, `If the user already exists, the existing home
+directory will not be changed`)
+ subsystemCmd.Flags().StringVarP(&baseHomeDir, "base-home-dir", "d", "", `If the user does not exist specify an alternate
+starting directory. The home directory for a new
+user will be:
+
+[base-home-dir]/[username]
+
+base-home-dir must be an absolute path.`)
+ subsystemCmd.Flags().BoolVarP(&logJournalD, "log-to-journald", "j", false, `Send logs to journald. Only available on Linux.
+Use:
+
+$ journalctl -o verbose -f
+
+To see full logs.
+If not set, the logs will be sent to the standard
+error`)
+
+ addConfigFlags(subsystemCmd)
+
+ viper.SetDefault(logLevelKey, defaultLogLevel)
+ viper.BindEnv(logLevelKey, "SFTPGO_LOG_LEVEL") //nolint:errcheck
+ subsystemCmd.Flags().StringVar(&logLevel, logLevelFlag, viper.GetString(logLevelKey),
+ `Set the log level. Supported values:
+
+debug, info, warn, error.
+
+This flag can be set
+using SFTPGO_LOG_LEVEL env var too.
+`)
+ viper.BindPFlag(logLevelKey, subsystemCmd.Flags().Lookup(logLevelFlag)) //nolint:errcheck
+
+ viper.SetDefault(logUTCTimeKey, defaultLogUTCTime)
+ viper.BindEnv(logUTCTimeKey, "SFTPGO_LOG_UTC_TIME") //nolint:errcheck
+ subsystemCmd.Flags().BoolVar(&logUTCTime, logUTCTimeFlag, viper.GetBool(logUTCTimeKey),
+ `Use UTC time for logging. This flag can be set
+using SFTPGO_LOG_UTC_TIME env var too.
+`)
+ viper.BindPFlag(logUTCTimeKey, subsystemCmd.Flags().Lookup(logUTCTimeFlag)) //nolint:errcheck
+
+ rootCmd.AddCommand(subsystemCmd)
+}
diff --git a/internal/command/command.go b/internal/command/command.go
index 512c2d4e..b3d56aa3 100644
--- a/internal/command/command.go
+++ b/internal/command/command.go
@@ -17,9 +17,10 @@ package command
import (
"fmt"
- "slices"
"strings"
"time"
+
+ "github.com/drakkan/sftpgo/v2/internal/util"
)
const (
@@ -35,6 +36,7 @@ const (
HookStartup = "startup"
HookPostConnect = "post_connect"
HookPostDisconnect = "post_disconnect"
+ HookDataRetention = "data_retention"
HookCheckPassword = "check_password"
HookPreLogin = "pre_login"
HookPostLogin = "post_login"
@@ -45,7 +47,7 @@ const (
var (
config Config
supportedHooks = []string{HookFsActions, HookProviderActions, HookStartup, HookPostConnect, HookPostDisconnect,
- HookCheckPassword, HookPreLogin, HookPostLogin, HookExternalAuth, HookKeyboardInteractive}
+ HookDataRetention, HookCheckPassword, HookPreLogin, HookPostLogin, HookExternalAuth, HookKeyboardInteractive}
)
// Command define the configuration for a specific commands
@@ -115,7 +117,7 @@ func (c Config) Initialize() error {
}
// don't validate args, we allow to pass empty arguments
if cmd.Hook != "" {
- if !slices.Contains(supportedHooks, cmd.Hook) {
+ if !util.Contains(supportedHooks, cmd.Hook) {
return fmt.Errorf("invalid hook name %q, supported values: %+v", cmd.Hook, supportedHooks)
}
}
diff --git a/internal/common/actions.go b/internal/common/actions.go
index d6fd04b0..01206b93 100644
--- a/internal/common/actions.go
+++ b/internal/common/actions.go
@@ -25,7 +25,6 @@ import (
"os/exec"
"path"
"path/filepath"
- "slices"
"strings"
"sync/atomic"
"time"
@@ -38,6 +37,7 @@ import (
"github.com/drakkan/sftpgo/v2/internal/httpclient"
"github.com/drakkan/sftpgo/v2/internal/logger"
"github.com/drakkan/sftpgo/v2/internal/plugin"
+ "github.com/drakkan/sftpgo/v2/internal/util"
)
var (
@@ -86,7 +86,7 @@ func InitializeActionHandler(handler ActionHandler) {
func ExecutePreAction(conn *BaseConnection, operation, filePath, virtualPath string, fileSize int64, openFlags int) (int, error) {
var event *notifier.FsEvent
hasNotifiersPlugin := plugin.Handler.HasNotifiers()
- hasHook := slices.Contains(Config.Actions.ExecuteOn, operation)
+ hasHook := util.Contains(Config.Actions.ExecuteOn, operation)
hasRules := eventManager.hasFsRules()
if !hasHook && !hasNotifiersPlugin && !hasRules {
return 0, nil
@@ -133,7 +133,7 @@ func ExecuteActionNotification(conn *BaseConnection, operation, filePath, virtua
fileSize int64, err error, elapsed int64, metadata map[string]string,
) error {
hasNotifiersPlugin := plugin.Handler.HasNotifiers()
- hasHook := slices.Contains(Config.Actions.ExecuteOn, operation)
+ hasHook := util.Contains(Config.Actions.ExecuteOn, operation)
hasRules := eventManager.hasFsRules()
if !hasHook && !hasNotifiersPlugin && !hasRules {
return nil
@@ -175,7 +175,7 @@ func ExecuteActionNotification(conn *BaseConnection, operation, filePath, virtua
}
}
if hasHook {
- if slices.Contains(Config.Actions.ExecuteSync, operation) {
+ if util.Contains(Config.Actions.ExecuteSync, operation) {
_, err := actionHandler.Handle(notification)
return err
}
@@ -250,7 +250,7 @@ func newActionNotification(
type defaultActionHandler struct{}
func (h *defaultActionHandler) Handle(event *notifier.FsEvent) (int, error) {
- if !slices.Contains(Config.Actions.ExecuteOn, event.Action) {
+ if !util.Contains(Config.Actions.ExecuteOn, event.Action) {
return 0, nil
}
@@ -348,7 +348,7 @@ func notificationAsEnvVars(event *notifier.FsEvent) []string {
if len(event.Metadata) > 0 {
data, err := json.Marshal(event.Metadata)
if err == nil {
- result = append(result, fmt.Sprintf("SFTPGO_ACTION_METADATA=%s", data))
+ result = append(result, fmt.Sprintf("SFTPGO_ACTION_METADATA=%s", util.BytesToString(data)))
}
}
return result
diff --git a/internal/common/actions_test.go b/internal/common/actions_test.go
index 6ac0463c..02666e6c 100644
--- a/internal/common/actions_test.go
+++ b/internal/common/actions_test.go
@@ -24,7 +24,7 @@ import (
"testing"
"time"
- "github.com/lithammer/shortuuid/v4"
+ "github.com/lithammer/shortuuid/v3"
"github.com/rs/xid"
"github.com/sftpgo/sdk"
"github.com/sftpgo/sdk/plugin/notifier"
diff --git a/internal/common/common.go b/internal/common/common.go
index 99b5e8d1..9933f041 100644
--- a/internal/common/common.go
+++ b/internal/common/common.go
@@ -19,14 +19,12 @@ import (
"context"
"errors"
"fmt"
- "io"
"net"
"net/http"
"net/url"
"os"
"os/exec"
"path/filepath"
- "slices"
"strconv"
"strings"
"sync"
@@ -126,9 +124,6 @@ func init() {
Connections.clients = clientsMap{
clients: make(map[string]int),
}
- Connections.transfers = clientsMap{
- clients: make(map[string]int),
- }
Connections.perUserConns = make(map[string]int)
Connections.mapping = make(map[string]int)
Connections.sshMapping = make(map[string]int)
@@ -168,20 +163,13 @@ var (
rateLimiters map[string][]*rateLimiter
isShuttingDown atomic.Bool
ftpLoginCommands = []string{"PASS", "USER"}
- fnUpdateBranding func(*dataprovider.BrandingConfigs)
)
-// SetUpdateBrandingFn sets the function to call to update branding configs.
-func SetUpdateBrandingFn(fn func(*dataprovider.BrandingConfigs)) {
- fnUpdateBranding = fn
-}
-
// Initialize sets the common configuration
func Initialize(c Configuration, isShared int) error {
isShuttingDown.Store(false)
util.SetUmask(c.Umask)
version.SetConfig(c.ServerVersion)
- dataprovider.SetTZ(c.TZ)
Config = c
Config.Actions.ExecuteOn = util.RemoveDuplicates(Config.Actions.ExecuteOn, true)
Config.Actions.ExecuteSync = util.RemoveDuplicates(Config.Actions.ExecuteSync, true)
@@ -212,7 +200,7 @@ func Initialize(c Configuration, isShared int) error {
Config.rateLimitersList = rateLimitersList
}
if c.DefenderConfig.Enabled {
- if !slices.Contains(supportedDefenderDrivers, c.DefenderConfig.Driver) {
+ if !util.Contains(supportedDefenderDrivers, c.DefenderConfig.Driver) {
return fmt.Errorf("unsupported defender driver %q", c.DefenderConfig.Driver)
}
var defender Defender
@@ -418,23 +406,6 @@ func AddDefenderEvent(ip, protocol string, event HostEvent) bool {
return Config.defender.AddEvent(ip, protocol, event)
}
-func reloadProviderConfigs() {
- configs, err := dataprovider.GetConfigs()
- if err != nil {
- logger.Error(logSender, "", "unable to load config from provider: %v", err)
- return
- }
- configs.SetNilsToEmpty()
- if fnUpdateBranding != nil {
- fnUpdateBranding(configs.Branding)
- }
- if err := configs.SMTP.TryDecrypt(); err != nil {
- logger.Error(logSender, "", "unable to decrypt smtp config: %v", err)
- return
- }
- smtp.Activate(configs.SMTP)
-}
-
func startPeriodicChecks(duration time.Duration, isShared int) {
startEventScheduler()
spec := fmt.Sprintf("@every %s", duration)
@@ -443,7 +414,7 @@ func startPeriodicChecks(duration time.Duration, isShared int) {
logger.Info(logSender, "", "scheduled overquota transfers check, schedule %q", spec)
if isShared == 1 {
logger.Info(logSender, "", "add reload configs task")
- _, err := eventScheduler.AddFunc("@every 10m", reloadProviderConfigs)
+ _, err := eventScheduler.AddFunc("@every 10m", smtp.ReloadProviderConf)
util.PanicOnError(err)
}
if Config.IdleTimeout > 0 {
@@ -463,7 +434,6 @@ type ActiveTransfer interface {
GetDownloadedSize() int64
GetUploadedSize() int64
GetVirtualPath() string
- GetFsPath() string
GetStartTime() time.Time
SignalClose(err error)
Truncate(fsPath string, size int64) (int64, error)
@@ -616,6 +586,9 @@ type Configuration struct {
// Absolute path to an external program or an HTTP URL to invoke after an SSH/FTP connection ends.
// Leave empty do disable.
PostDisconnectHook string `json:"post_disconnect_hook" mapstructure:"post_disconnect_hook"`
+ // Absolute path to an external program or an HTTP URL to invoke after a data retention check completes.
+ // Leave empty do disable.
+ DataRetentionHook string `json:"data_retention_hook" mapstructure:"data_retention_hook"`
// Maximum number of concurrent client connections. 0 means unlimited
MaxTotalConnections int `json:"max_total_connections" mapstructure:"max_total_connections"`
// Maximum number of concurrent client connections from the same host (IP). 0 means unlimited
@@ -636,10 +609,6 @@ type Configuration struct {
Umask string `json:"umask" mapstructure:"umask"`
// Defines the server version
ServerVersion string `json:"server_version" mapstructure:"server_version"`
- // TZ defines the time zone to use for the EventManager scheduler and to
- // control time-based access restrictions. Set to "local" to use the
- // server's local time, otherwise UTC will be used.
- TZ string `json:"tz" mapstructure:"tz"`
// Metadata configuration
Metadata MetadataConfig `json:"metadata" mapstructure:"metadata"`
// EventManager configuration
@@ -676,7 +645,7 @@ func (c *Configuration) initializeProxyProtocol() error {
// GetProxyListener returns a wrapper for the given listener that supports the
// HAProxy Proxy Protocol
-func (c *Configuration) GetProxyListener(listener net.Listener) (net.Listener, error) {
+func (c *Configuration) GetProxyListener(listener net.Listener) (*proxyproto.Listener, error) {
if c.ProxyProtocol > 0 {
defaultPolicy := proxyproto.REQUIRE
if c.ProxyProtocol == 1 {
@@ -803,7 +772,7 @@ func (c *Configuration) checkPostDisconnectHook(remoteAddr, protocol, username,
if c.PostDisconnectHook == "" {
return
}
- if !slices.Contains(disconnHookProtocols, protocol) {
+ if !util.Contains(disconnHookProtocols, protocol) {
return
}
go c.executePostDisconnectHook(remoteAddr, protocol, username, connID, connectionTime)
@@ -866,7 +835,6 @@ func getProxyPolicy(allowed, skipped []func(net.IP) bool, def proxyproto.Policy)
if err != nil {
// Something is wrong with the source IP, better reject the
// connection.
- logger.Error(logSender, "", "reject connection from ip %q, err: %v", connPolicyOptions.Upstream, err)
return proxyproto.REJECT, proxyproto.ErrInvalidUpstream
}
@@ -898,12 +866,12 @@ func getProxyPolicy(allowed, skipped []func(net.IP) bool, def proxyproto.Policy)
// Each SSH connection can open several channels for SFTP or SSH commands
type SSHConnection struct {
id string
- conn io.Closer
+ conn net.Conn
lastActivity atomic.Int64
}
// NewSSHConnection returns a new SSHConnection
-func NewSSHConnection(id string, conn io.Closer) *SSHConnection {
+func NewSSHConnection(id string, conn net.Conn) *SSHConnection {
c := &SSHConnection{
id: id,
conn: conn,
@@ -936,9 +904,7 @@ func (c *SSHConnection) Close() error {
type ActiveConnections struct {
// clients contains both authenticated and estabilished connections and the ones waiting
// for authentication
- clients clientsMap
- // transfers contains active transfers, total and per-user
- transfers clientsMap
+ clients clientsMap
transfersCheckStatus atomic.Bool
sync.RWMutex
connections []ActiveConnection
@@ -989,9 +955,6 @@ func (conns *ActiveConnections) Add(c ActiveConnection) error {
if val := conns.perUserConns[username]; val >= maxSessions {
return fmt.Errorf("too many open sessions: %d/%d", val, maxSessions)
}
- if val := conns.transfers.getTotalFrom(username); val >= maxSessions {
- return fmt.Errorf("too many open transfers: %d/%d", val, maxSessions)
- }
}
conns.addUserConnection(username)
}
@@ -1053,7 +1016,7 @@ func (conns *ActiveConnections) Remove(connectionID string) {
metric.UpdateActiveConnectionsSize(lastIdx)
logger.Debug(conn.GetProtocol(), conn.GetID(), "connection removed, local address %q, remote address %q close fs error: %v, num open connections: %d",
conn.GetLocalAddress(), conn.GetRemoteAddress(), err, lastIdx)
- if conn.GetProtocol() == ProtocolFTP && conn.GetUsername() == "" && !slices.Contains(ftpLoginCommands, conn.GetCommand()) {
+ if conn.GetProtocol() == ProtocolFTP && conn.GetUsername() == "" && !util.Contains(ftpLoginCommands, conn.GetCommand()) {
ip := util.GetIPFromRemoteAddress(conn.GetRemoteAddress())
logger.ConnectionFailedLog("", ip, dataprovider.LoginMethodNoAuthTried, ProtocolFTP,
dataprovider.ErrNoAuthTried.Error())
@@ -1162,7 +1125,7 @@ func (conns *ActiveConnections) checkIdles() {
logger.Debug(conn.GetProtocol(), conn.GetID(), "close idle connection, idle time: %s, username: %q close err: %v",
time.Since(conn.GetLastActivity()), conn.GetUsername(), err)
}(c)
- } else if !isUnauthenticatedFTPUser && !c.isAccessAllowed() {
+ } else if !c.isAccessAllowed() {
defer func(conn ActiveConnection) {
err := conn.Disconnect()
logger.Info(conn.GetProtocol(), conn.GetID(), "access conditions not met for user: %q close connection err: %v",
@@ -1252,35 +1215,6 @@ func (conns *ActiveConnections) GetClientConnections() int32 {
return conns.clients.getTotal()
}
-// GetTotalTransfers returns the total number of active transfers
-func (conns *ActiveConnections) GetTotalTransfers() int32 {
- return conns.transfers.getTotal()
-}
-
-// IsNewTransferAllowed returns an error if the maximum number of concurrent allowed
-// transfers is exceeded
-func (conns *ActiveConnections) IsNewTransferAllowed(username string) error {
- if isShuttingDown.Load() {
- return ErrShuttingDown
- }
- if Config.MaxTotalConnections == 0 && Config.MaxPerHostConnections == 0 {
- return nil
- }
- if Config.MaxPerHostConnections > 0 {
- if transfers := conns.transfers.getTotalFrom(username); transfers >= Config.MaxPerHostConnections {
- logger.Info(logSender, "", "active transfers from user %q: %d/%d", username, transfers, Config.MaxPerHostConnections)
- return ErrConnectionDenied
- }
- }
- if Config.MaxTotalConnections > 0 {
- if transfers := conns.transfers.getTotal(); transfers >= int32(Config.MaxTotalConnections) {
- logger.Info(logSender, "", "active transfers %d/%d", transfers, Config.MaxTotalConnections)
- return ErrConnectionDenied
- }
- }
- return nil
-}
-
// IsNewConnectionAllowed returns an error if the maximum number of concurrent allowed
// connections is exceeded or a whitelist is defined and the specified ipAddr is not listed
// or the service is shutting down
@@ -1321,11 +1255,7 @@ func (conns *ActiveConnections) IsNewConnectionAllowed(ipAddr, protocol string)
}
// on a single SFTP connection we could have multiple SFTP channels or commands
- // so we check the estabilished connections and active uploads too
- if transfers := conns.transfers.getTotal(); transfers >= int32(Config.MaxTotalConnections) {
- logger.Info(logSender, "", "active transfers %d/%d", transfers, Config.MaxTotalConnections)
- return ErrConnectionDenied
- }
+ // so we check the estabilished connections too
conns.RLock()
defer conns.RUnlock()
diff --git a/internal/common/common_test.go b/internal/common/common_test.go
index 8566d773..46f66aec 100644
--- a/internal/common/common_test.go
+++ b/internal/common/common_test.go
@@ -23,7 +23,6 @@ import (
"os/exec"
"path/filepath"
"runtime"
- "slices"
"sync"
"testing"
"time"
@@ -64,7 +63,7 @@ func (c *fakeConnection) AddUser(user dataprovider.User) error {
if err != nil {
return err
}
- c.User = user
+ c.BaseConnection.User = user
return nil
}
@@ -653,17 +652,11 @@ func TestMaxConnections(t *testing.T) {
ipAddr := "192.168.7.8"
assert.NoError(t, Connections.IsNewConnectionAllowed(ipAddr, ProtocolFTP))
- assert.NoError(t, Connections.IsNewTransferAllowed(userTestUsername))
Config.MaxTotalConnections = 1
Config.MaxPerHostConnections = perHost
assert.NoError(t, Connections.IsNewConnectionAllowed(ipAddr, ProtocolHTTP))
- assert.NoError(t, Connections.IsNewTransferAllowed(userTestUsername))
- isShuttingDown.Store(true)
- assert.ErrorIs(t, Connections.IsNewTransferAllowed(userTestUsername), ErrShuttingDown)
- isShuttingDown.Store(false)
-
c := NewBaseConnection("id", ProtocolSFTP, "", "", dataprovider.User{})
fakeConn := &fakeConnection{
BaseConnection: c,
@@ -672,10 +665,6 @@ func TestMaxConnections(t *testing.T) {
assert.NoError(t, err)
assert.Len(t, Connections.GetStats(""), 1)
assert.Error(t, Connections.IsNewConnectionAllowed(ipAddr, ProtocolSSH))
- Connections.transfers.add(userTestUsername)
- assert.Error(t, Connections.IsNewTransferAllowed(userTestUsername))
- Connections.transfers.remove(userTestUsername)
- assert.Equal(t, int32(0), Connections.GetTotalTransfers())
res := Connections.Close(fakeConn.GetID(), "")
assert.True(t, res)
@@ -687,9 +676,6 @@ func TestMaxConnections(t *testing.T) {
assert.Error(t, Connections.IsNewConnectionAllowed(ipAddr, ProtocolSSH))
Connections.RemoveClientConnection(ipAddr)
assert.NoError(t, Connections.IsNewConnectionAllowed(ipAddr, ProtocolWebDAV))
- Connections.transfers.add(userTestUsername)
- assert.Error(t, Connections.IsNewConnectionAllowed(ipAddr, ProtocolSSH))
- Connections.transfers.remove(userTestUsername)
Connections.RemoveClientConnection(ipAddr)
Config.MaxTotalConnections = oldValue
@@ -828,7 +814,11 @@ func TestIdleConnections(t *testing.T) {
assert.NoError(t, err)
assert.Equal(t, Connections.GetActiveSessions(username), 2)
- cFTP := NewBaseConnection("id2", ProtocolFTP, "", "", dataprovider.User{})
+ cFTP := NewBaseConnection("id2", ProtocolFTP, "", "", dataprovider.User{
+ BaseUser: sdk.BaseUser{
+ Status: 1,
+ },
+ })
cFTP.lastActivity.Store(time.Now().UnixNano())
fakeConn = &fakeConnection{
BaseConnection: cFTP,
@@ -995,10 +985,9 @@ func TestConnectionStatus(t *testing.T) {
assert.Len(t, stats, 3)
for _, stat := range stats {
assert.Equal(t, stat.Username, username)
- switch stat.ConnectionID {
- case "SFTP_id1":
+ if stat.ConnectionID == "SFTP_id1" {
assert.Len(t, stat.Transfers, 2)
- case "DAV_id3":
+ } else if stat.ConnectionID == "DAV_id3" {
assert.Len(t, stat.Transfers, 1)
}
}
@@ -1155,17 +1144,13 @@ func TestProxyProtocolVersion(t *testing.T) {
assert.Contains(t, err.Error(), "proxy protocol not configured")
}
c.ProxyProtocol = 1
- listener, err := c.GetProxyListener(nil)
+ proxyListener, err := c.GetProxyListener(nil)
assert.NoError(t, err)
- proxyListener, ok := listener.(*proxyproto.Listener)
- require.True(t, ok)
assert.NotNil(t, proxyListener.ConnPolicy)
c.ProxyProtocol = 2
- listener, err = c.GetProxyListener(nil)
+ proxyListener, err = c.GetProxyListener(nil)
assert.NoError(t, err)
- proxyListener, ok = listener.(*proxyproto.Listener)
- require.True(t, ok)
assert.NotNil(t, proxyListener.ConnPolicy)
}
@@ -1296,8 +1281,8 @@ func TestFolderCopy(t *testing.T) {
folder.ID = 2
folder.Users = []string{"user3"}
require.Len(t, folderCopy.Users, 2)
- require.True(t, slices.Contains(folderCopy.Users, "user1"))
- require.True(t, slices.Contains(folderCopy.Users, "user2"))
+ require.True(t, util.Contains(folderCopy.Users, "user1"))
+ require.True(t, util.Contains(folderCopy.Users, "user2"))
require.Equal(t, int64(1), folderCopy.ID)
require.Equal(t, folder.Name, folderCopy.Name)
require.Equal(t, folder.MappedPath, folderCopy.MappedPath)
@@ -1313,7 +1298,7 @@ func TestFolderCopy(t *testing.T) {
folderCopy = folder.GetACopy()
folder.FsConfig.CryptConfig.Passphrase = kms.NewEmptySecret()
require.Len(t, folderCopy.Users, 1)
- require.True(t, slices.Contains(folderCopy.Users, "user3"))
+ require.True(t, util.Contains(folderCopy.Users, "user3"))
require.Equal(t, int64(2), folderCopy.ID)
require.Equal(t, folder.Name, folderCopy.Name)
require.Equal(t, folder.MappedPath, folderCopy.MappedPath)
diff --git a/internal/common/connection.go b/internal/common/connection.go
index 4bbc89f0..db04ab67 100644
--- a/internal/common/connection.go
+++ b/internal/common/connection.go
@@ -63,7 +63,7 @@ type BaseConnection struct {
// NewBaseConnection returns a new BaseConnection
func NewBaseConnection(id, protocol, localAddr, remoteAddr string, user dataprovider.User) *BaseConnection {
connID := id
- if slices.Contains(supportedProtocols, protocol) {
+ if util.Contains(supportedProtocols, protocol) {
connID = fmt.Sprintf("%s_%s", protocol, id)
}
user.UploadBandwidth, user.DownloadBandwidth = user.GetBandwidthForIP(util.GetIPFromRemoteAddress(remoteAddr), connID)
@@ -132,7 +132,7 @@ func (c *BaseConnection) GetRemoteIP() string {
// SetProtocol sets the protocol for this connection
func (c *BaseConnection) SetProtocol(protocol string) {
c.protocol = protocol
- if slices.Contains(supportedProtocols, c.protocol) {
+ if util.Contains(supportedProtocols, c.protocol) {
c.ID = fmt.Sprintf("%v_%v", c.protocol, c.ID)
}
}
@@ -159,8 +159,6 @@ func (c *BaseConnection) CloseFS() error {
// AddTransfer associates a new transfer to this connection
func (c *BaseConnection) AddTransfer(t ActiveTransfer) {
- Connections.transfers.add(c.User.Username)
-
c.Lock()
defer c.Unlock()
@@ -192,8 +190,6 @@ func (c *BaseConnection) AddTransfer(t ActiveTransfer) {
// RemoveTransfer removes the specified transfer from the active ones
func (c *BaseConnection) RemoveTransfer(t ActiveTransfer) {
- Connections.transfers.remove(c.User.Username)
-
c.Lock()
defer c.Unlock()
@@ -296,20 +292,6 @@ func (c *BaseConnection) setTimes(fsPath string, atime time.Time, mtime time.Tim
return false
}
-// getInfoForOngoingUpload returns upload statistics for an upload currently in
-// progress on this connection.
-func (c *BaseConnection) getInfoForOngoingUpload(fsPath string) (os.FileInfo, error) {
- c.RLock()
- defer c.RUnlock()
-
- for _, t := range c.activeTransfers {
- if t.GetType() == TransferUpload && t.GetFsPath() == fsPath {
- return vfs.NewFileInfo(t.GetVirtualPath(), false, t.GetSize(), t.GetStartTime(), false), nil
- }
- }
- return nil, os.ErrNotExist
-}
-
func (c *BaseConnection) truncateOpenHandle(fsPath string, size int64) (int64, error) {
c.RLock()
defer c.RUnlock()
@@ -467,7 +449,10 @@ func (c *BaseConnection) RemoveFile(fs vfs.Fs, fsPath, virtualPath string, info
if updateQuota && info.Mode()&os.ModeSymlink == 0 {
vfolder, err := c.User.GetVirtualFolderForPath(path.Dir(virtualPath))
if err == nil {
- dataprovider.UpdateUserFolderQuota(&vfolder, &c.User, -1, -size, false)
+ dataprovider.UpdateVirtualFolderQuota(&vfolder.BaseVirtualFolder, -1, -size, false) //nolint:errcheck
+ if vfolder.IsIncludedInUserQuota() {
+ dataprovider.UpdateUserQuota(&c.User, -1, -size, false) //nolint:errcheck
+ }
} else {
dataprovider.UpdateUserQuota(&c.User, -1, -size, false) //nolint:errcheck
}
@@ -631,15 +616,13 @@ func (c *BaseConnection) checkCopy(srcInfo, dstInfo os.FileInfo, virtualSource,
if dstInfo != nil && dstInfo.IsDir() {
return fmt.Errorf("cannot overwrite file %q with dir %q: %w", virtualSource, virtualTarget, c.GetOpUnsupportedError())
}
- if c.IsSameResource(virtualSource, virtualTarget) {
- if fsSourcePath == fsTargetPath {
- return fmt.Errorf("the copy source and target cannot be the same: %w", c.GetOpUnsupportedError())
- }
+ if fsSourcePath == fsTargetPath {
+ return fmt.Errorf("the copy source and target cannot be the same: %w", c.GetOpUnsupportedError())
}
return nil
}
-func (c *BaseConnection) copyFile(virtualSourcePath, virtualTargetPath string, srcInfo os.FileInfo) error {
+func (c *BaseConnection) copyFile(virtualSourcePath, virtualTargetPath string, srcSize int64) error {
if !c.User.HasPerm(dataprovider.PermCopy, virtualSourcePath) || !c.User.HasPerm(dataprovider.PermCopy, virtualTargetPath) {
return c.GetPermissionDeniedError()
}
@@ -657,12 +640,12 @@ func (c *BaseConnection) copyFile(virtualSourcePath, virtualTargetPath string, s
return err
}
startTime := time.Now()
- numFiles, sizeDiff, err := copier.CopyFile(fsSourcePath, fsTargetPath, srcInfo)
+ numFiles, sizeDiff, err := copier.CopyFile(fsSourcePath, fsTargetPath, srcSize)
elapsed := time.Since(startTime).Nanoseconds() / 1000000
updateUserQuotaAfterFileWrite(c, virtualTargetPath, numFiles, sizeDiff)
logger.CommandLog(copyLogSender, fsSourcePath, fsTargetPath, c.User.Username, "", c.ID, c.protocol, -1, -1,
- "", "", "", srcInfo.Size(), c.localAddr, c.remoteAddr, elapsed)
- ExecuteActionNotification(c, operationCopy, fsSourcePath, virtualSourcePath, fsTargetPath, virtualTargetPath, "", srcInfo.Size(), err, elapsed, nil) //nolint:errcheck
+ "", "", "", srcSize, c.localAddr, c.remoteAddr, elapsed)
+ ExecuteActionNotification(c, operationCopy, fsSourcePath, virtualSourcePath, fsTargetPath, virtualTargetPath, "", srcSize, err, elapsed, nil) //nolint:errcheck
return err
}
}
@@ -674,7 +657,7 @@ func (c *BaseConnection) copyFile(virtualSourcePath, virtualTargetPath string, s
defer rCancelFn()
defer reader.Close()
- writer, numFiles, truncatedSize, wCancelFn, err := getFileWriter(c, virtualTargetPath, srcInfo.Size())
+ writer, numFiles, truncatedSize, wCancelFn, err := getFileWriter(c, virtualTargetPath, srcSize)
if err != nil {
return fmt.Errorf("unable to get writer for path %q: %w", virtualTargetPath, err)
}
@@ -725,7 +708,7 @@ func (c *BaseConnection) doRecursiveCopy(virtualSourcePath, virtualTargetPath st
return nil
}
- return c.copyFile(virtualSourcePath, virtualTargetPath, srcInfo)
+ return c.copyFile(virtualSourcePath, virtualTargetPath, srcInfo.Size())
}
func (c *BaseConnection) recursiveCopyEntries(virtualSourcePath, virtualTargetPath string, entries []os.FileInfo, recursion int) error {
@@ -787,27 +770,29 @@ func (c *BaseConnection) Copy(virtualSourcePath, virtualTargetPath string) error
return err
}
}
- createTargetDir := dstInfo == nil || !dstInfo.IsDir()
+ createTargetDir := true
+ if dstInfo != nil && dstInfo.IsDir() {
+ createTargetDir = false
+ }
if err := c.checkCopy(srcInfo, dstInfo, virtualSourcePath, destPath); err != nil {
return err
}
if err := c.CheckParentDirs(path.Dir(destPath)); err != nil {
return err
}
- stopKeepAlive := keepConnectionAlive(c, 2*time.Minute)
- defer stopKeepAlive()
+ done := make(chan bool)
+ defer close(done)
+ go keepConnectionAlive(c, done, 2*time.Minute)
return c.doRecursiveCopy(virtualSourcePath, destPath, srcInfo, createTargetDir, 0)
}
// Rename renames (moves) virtualSourcePath to virtualTargetPath
func (c *BaseConnection) Rename(virtualSourcePath, virtualTargetPath string) error {
- return c.renameInternal(virtualSourcePath, virtualTargetPath, false, vfs.CheckParentDir)
+ return c.renameInternal(virtualSourcePath, virtualTargetPath, false)
}
-func (c *BaseConnection) renameInternal(virtualSourcePath, virtualTargetPath string, //nolint:gocyclo
- checkParentDestination bool, checks int,
-) error {
+func (c *BaseConnection) renameInternal(virtualSourcePath, virtualTargetPath string, checkParentDestination bool) error {
if virtualSourcePath == virtualTargetPath {
return fmt.Errorf("the rename source and target cannot be the same: %w", c.GetOpUnsupportedError())
}
@@ -828,11 +813,7 @@ func (c *BaseConnection) renameInternal(virtualSourcePath, virtualTargetPath str
return c.GetPermissionDeniedError()
}
initialSize := int64(-1)
- dstInfo, err := fsDst.Lstat(fsTargetPath)
- if err != nil && !fsDst.IsNotExist(err) {
- return err
- }
- if err == nil {
+ if dstInfo, err := fsDst.Lstat(fsTargetPath); err == nil {
checkParentDestination = false
if dstInfo.IsDir() {
c.Log(logger.LevelWarn, "attempted to rename %q overwriting an existing directory %q",
@@ -854,17 +835,18 @@ func (c *BaseConnection) renameInternal(virtualSourcePath, virtualTargetPath str
return err
}
}
- if !c.hasSpaceForRename(fsSrc, virtualSourcePath, virtualTargetPath, initialSize, fsSourcePath, srcInfo) {
+ if !c.hasSpaceForRename(fsSrc, virtualSourcePath, virtualTargetPath, initialSize, fsSourcePath) {
c.Log(logger.LevelInfo, "denying cross rename due to space limit")
return c.GetGenericError(ErrQuotaExceeded)
}
if checkParentDestination {
c.CheckParentDirs(path.Dir(virtualTargetPath)) //nolint:errcheck
}
- stopKeepAlive := keepConnectionAlive(c, 2*time.Minute)
- defer stopKeepAlive()
+ done := make(chan bool)
+ defer close(done)
+ go keepConnectionAlive(c, done, 2*time.Minute)
- files, size, err := fsDst.Rename(fsSourcePath, fsTargetPath, checks)
+ files, size, err := fsDst.Rename(fsSourcePath, fsTargetPath)
if err != nil {
c.Log(logger.LevelError, "failed to rename %q -> %q: %+v", fsSourcePath, fsTargetPath, err)
return c.GetFsError(fsSrc, err)
@@ -936,6 +918,16 @@ func (c *BaseConnection) CreateSymlink(virtualSourcePath, virtualTargetPath stri
return nil
}
+func (c *BaseConnection) getPathForSetStatPerms(fs vfs.Fs, fsPath, virtualPath string) string {
+ pathForPerms := virtualPath
+ if fi, err := fs.Lstat(fsPath); err == nil {
+ if fi.IsDir() {
+ pathForPerms = path.Dir(virtualPath)
+ }
+ }
+ return pathForPerms
+}
+
func (c *BaseConnection) doStatInternal(virtualPath string, mode int, checkFilePatterns,
convertResult bool,
) (os.FileInfo, error) {
@@ -966,19 +958,7 @@ func (c *BaseConnection) doStatInternal(virtualPath string, mode int, checkFileP
info, err = fs.Stat(c.getRealFsPath(fsPath))
}
if err != nil {
- isNotExist := fs.IsNotExist(err)
- if isNotExist {
- // This is primarily useful for atomic storage backends, where files
- // become visible only after they are closed. However, since we may
- // be proxying (for example) an SFTP server backed by atomic
- // storage, and this search only inspects transfers active on the
- // current connection (typically just one), the check is inexpensive
- // and safe to perform unconditionally.
- if info, err := c.getInfoForOngoingUpload(fsPath); err == nil {
- return info, nil
- }
- }
- if !isNotExist {
+ if !fs.IsNotExist(err) {
c.Log(logger.LevelWarn, "stat error for path %q: %+v", virtualPath, err)
}
return nil, c.GetFsError(fs, err)
@@ -1084,7 +1064,7 @@ func (c *BaseConnection) SetStat(virtualPath string, attributes *StatAttributes)
if err != nil {
return err
}
- pathForPerms := path.Dir(virtualPath)
+ pathForPerms := c.getPathForSetStatPerms(fs, fsPath, virtualPath)
if attributes.Flags&StatAttrTimes != 0 {
if err = c.handleChtimes(fs, fsPath, pathForPerms, attributes); err != nil {
@@ -1141,7 +1121,10 @@ func (c *BaseConnection) truncateFile(fs vfs.Fs, fsPath, virtualPath string, siz
sizeDiff := initialSize - size
vfolder, err := c.User.GetVirtualFolderForPath(path.Dir(virtualPath))
if err == nil {
- dataprovider.UpdateUserFolderQuota(&vfolder, &c.User, 0, -sizeDiff, false)
+ dataprovider.UpdateVirtualFolderQuota(&vfolder.BaseVirtualFolder, 0, -sizeDiff, false) //nolint:errcheck
+ if vfolder.IsIncludedInUserQuota() {
+ dataprovider.UpdateUserQuota(&c.User, 0, -sizeDiff, false) //nolint:errcheck
+ }
} else {
dataprovider.UpdateUserQuota(&c.User, 0, -sizeDiff, false) //nolint:errcheck
}
@@ -1150,11 +1133,11 @@ func (c *BaseConnection) truncateFile(fs vfs.Fs, fsPath, virtualPath string, siz
}
func (c *BaseConnection) checkRecursiveRenameDirPermissions(fsSrc, fsDst vfs.Fs, sourcePath, targetPath,
- virtualSourcePath, virtualTargetPath string, srcInfo os.FileInfo,
+ virtualSourcePath, virtualTargetPath string, fi os.FileInfo,
) error {
if !c.User.HasPermissionsInside(virtualSourcePath) &&
!c.User.HasPermissionsInside(virtualTargetPath) {
- if !c.isRenamePermitted(fsSrc, fsDst, sourcePath, targetPath, virtualSourcePath, virtualTargetPath, srcInfo) {
+ if !c.isRenamePermitted(fsSrc, fsDst, sourcePath, targetPath, virtualSourcePath, virtualTargetPath, fi) {
c.Log(logger.LevelInfo, "rename %q -> %q is not allowed, virtual destination path: %q",
sourcePath, targetPath, virtualTargetPath)
return c.GetPermissionDeniedError()
@@ -1214,7 +1197,7 @@ func (c *BaseConnection) hasRenamePerms(virtualSourcePath, virtualTargetPath str
}
func (c *BaseConnection) checkFolderRename(fsSrc, fsDst vfs.Fs, fsSourcePath, fsTargetPath, virtualSourcePath,
- virtualTargetPath string, srcInfo os.FileInfo) error {
+ virtualTargetPath string, fi os.FileInfo) error {
if util.IsDirOverlapped(virtualSourcePath, virtualTargetPath, true, "/") {
c.Log(logger.LevelDebug, "renaming the folder %q->%q is not supported: nested folders",
virtualSourcePath, virtualTargetPath)
@@ -1238,7 +1221,7 @@ func (c *BaseConnection) checkFolderRename(fsSrc, fsDst vfs.Fs, fsSourcePath, fs
return fmt.Errorf("folder %q has virtual folders inside it: %w", virtualTargetPath, c.GetOpUnsupportedError())
}
if err := c.checkRecursiveRenameDirPermissions(fsSrc, fsDst, fsSourcePath, fsTargetPath,
- virtualSourcePath, virtualTargetPath, srcInfo); err != nil {
+ virtualSourcePath, virtualTargetPath, fi); err != nil {
c.Log(logger.LevelDebug, "error checking recursive permissions before renaming %q: %+v", fsSourcePath, err)
return err
}
@@ -1246,7 +1229,7 @@ func (c *BaseConnection) checkFolderRename(fsSrc, fsDst vfs.Fs, fsSourcePath, fs
}
func (c *BaseConnection) isRenamePermitted(fsSrc, fsDst vfs.Fs, fsSourcePath, fsTargetPath, virtualSourcePath,
- virtualTargetPath string, srcInfo os.FileInfo,
+ virtualTargetPath string, fi os.FileInfo,
) bool {
if !c.IsSameResource(virtualSourcePath, virtualTargetPath) {
c.Log(logger.LevelInfo, "rename %q->%q is not allowed: the paths must be on the same resource",
@@ -1276,11 +1259,11 @@ func (c *BaseConnection) isRenamePermitted(fsSrc, fsDst vfs.Fs, fsSourcePath, fs
virtualTargetPath)
return false
}
- return c.hasRenamePerms(virtualSourcePath, virtualTargetPath, srcInfo)
+ return c.hasRenamePerms(virtualSourcePath, virtualTargetPath, fi)
}
func (c *BaseConnection) hasSpaceForRename(fs vfs.Fs, virtualSourcePath, virtualTargetPath string, initialSize int64,
- sourcePath string, srcInfo os.FileInfo) bool {
+ fsSourcePath string) bool {
if dataprovider.GetQuotaTracking() == 0 {
return true
}
@@ -1310,28 +1293,30 @@ func (c *BaseConnection) hasSpaceForRename(fs vfs.Fs, virtualSourcePath, virtual
// no quota restrictions
return true
}
- return c.hasSpaceForCrossRename(fs, quotaResult, initialSize, sourcePath, srcInfo)
+ return c.hasSpaceForCrossRename(fs, quotaResult, initialSize, fsSourcePath)
}
// hasSpaceForCrossRename checks the quota after a rename between different folders
-func (c *BaseConnection) hasSpaceForCrossRename(fs vfs.Fs, quotaResult vfs.QuotaCheckResult, initialSize int64,
- sourcePath string, srcInfo os.FileInfo,
-) bool {
+func (c *BaseConnection) hasSpaceForCrossRename(fs vfs.Fs, quotaResult vfs.QuotaCheckResult, initialSize int64, sourcePath string) bool {
if !quotaResult.HasSpace && initialSize == -1 {
// we are over quota and this is not a file replace
return false
}
+ fi, err := fs.Lstat(sourcePath)
+ if err != nil {
+ c.Log(logger.LevelError, "cross rename denied, stat error for path %q: %v", sourcePath, err)
+ return false
+ }
var sizeDiff int64
var filesDiff int
- var err error
- if srcInfo.Mode().IsRegular() {
- sizeDiff = srcInfo.Size()
+ if fi.Mode().IsRegular() {
+ sizeDiff = fi.Size()
filesDiff = 1
if initialSize != -1 {
sizeDiff -= initialSize
filesDiff = 0
}
- } else if srcInfo.IsDir() {
+ } else if fi.IsDir() {
filesDiff, sizeDiff, err = fs.GetDirSize(sourcePath)
if err != nil {
c.Log(logger.LevelError, "cross rename denied, error getting size for directory %q: %v", sourcePath, err)
@@ -1358,7 +1343,7 @@ func (c *BaseConnection) hasSpaceForCrossRename(fs vfs.Fs, quotaResult vfs.Quota
}
if quotaResult.QuotaSize > 0 {
remainingSize := quotaResult.GetRemainingSize()
- c.Log(logger.LevelDebug, "cross rename, source %q remaining size %d to add %d", srcInfo.Name(),
+ c.Log(logger.LevelDebug, "cross rename, source %q remaining size %d to add %d", sourcePath,
remainingSize, sizeDiff)
if remainingSize < sizeDiff {
return false
@@ -1533,40 +1518,61 @@ func (c *BaseConnection) updateQuotaMoveBetweenVFolders(sourceFolder, dstFolder
if sourceFolder.Name == dstFolder.Name {
// both files are inside the same virtual folder
if initialSize != -1 {
- dataprovider.UpdateUserFolderQuota(dstFolder, &c.User, -numFiles, -initialSize, false)
+ dataprovider.UpdateVirtualFolderQuota(&dstFolder.BaseVirtualFolder, -numFiles, -initialSize, false) //nolint:errcheck
+ if dstFolder.IsIncludedInUserQuota() {
+ dataprovider.UpdateUserQuota(&c.User, -numFiles, -initialSize, false) //nolint:errcheck
+ }
}
return
}
// files are inside different virtual folders
- dataprovider.UpdateUserFolderQuota(sourceFolder, &c.User, -numFiles, -filesSize, false)
- if initialSize == -1 {
- dataprovider.UpdateUserFolderQuota(dstFolder, &c.User, numFiles, filesSize, false)
- return
+ dataprovider.UpdateVirtualFolderQuota(&sourceFolder.BaseVirtualFolder, -numFiles, -filesSize, false) //nolint:errcheck
+ if sourceFolder.IsIncludedInUserQuota() {
+ dataprovider.UpdateUserQuota(&c.User, -numFiles, -filesSize, false) //nolint:errcheck
+ }
+ if initialSize == -1 {
+ dataprovider.UpdateVirtualFolderQuota(&dstFolder.BaseVirtualFolder, numFiles, filesSize, false) //nolint:errcheck
+ if dstFolder.IsIncludedInUserQuota() {
+ dataprovider.UpdateUserQuota(&c.User, numFiles, filesSize, false) //nolint:errcheck
+ }
+ } else {
+ // we cannot have a directory here, initialSize != -1 only for files
+ dataprovider.UpdateVirtualFolderQuota(&dstFolder.BaseVirtualFolder, 0, filesSize-initialSize, false) //nolint:errcheck
+ if dstFolder.IsIncludedInUserQuota() {
+ dataprovider.UpdateUserQuota(&c.User, 0, filesSize-initialSize, false) //nolint:errcheck
+ }
}
- // we cannot have a directory here, initialSize != -1 only for files
- dataprovider.UpdateUserFolderQuota(dstFolder, &c.User, 0, filesSize-initialSize, false)
}
func (c *BaseConnection) updateQuotaMoveFromVFolder(sourceFolder *vfs.VirtualFolder, initialSize, filesSize int64, numFiles int) {
// move between a virtual folder and the user home dir
- dataprovider.UpdateUserFolderQuota(sourceFolder, &c.User, -numFiles, -filesSize, false)
+ dataprovider.UpdateVirtualFolderQuota(&sourceFolder.BaseVirtualFolder, -numFiles, -filesSize, false) //nolint:errcheck
+ if sourceFolder.IsIncludedInUserQuota() {
+ dataprovider.UpdateUserQuota(&c.User, -numFiles, -filesSize, false) //nolint:errcheck
+ }
if initialSize == -1 {
dataprovider.UpdateUserQuota(&c.User, numFiles, filesSize, false) //nolint:errcheck
- return
+ } else {
+ // we cannot have a directory here, initialSize != -1 only for files
+ dataprovider.UpdateUserQuota(&c.User, 0, filesSize-initialSize, false) //nolint:errcheck
}
- // we cannot have a directory here, initialSize != -1 only for files
- dataprovider.UpdateUserQuota(&c.User, 0, filesSize-initialSize, false) //nolint:errcheck
}
func (c *BaseConnection) updateQuotaMoveToVFolder(dstFolder *vfs.VirtualFolder, initialSize, filesSize int64, numFiles int) {
// move between the user home dir and a virtual folder
dataprovider.UpdateUserQuota(&c.User, -numFiles, -filesSize, false) //nolint:errcheck
if initialSize == -1 {
- dataprovider.UpdateUserFolderQuota(dstFolder, &c.User, numFiles, filesSize, false)
- return
+ dataprovider.UpdateVirtualFolderQuota(&dstFolder.BaseVirtualFolder, numFiles, filesSize, false) //nolint:errcheck
+ if dstFolder.IsIncludedInUserQuota() {
+ dataprovider.UpdateUserQuota(&c.User, numFiles, filesSize, false) //nolint:errcheck
+ }
+ } else {
+ // we cannot have a directory here, initialSize != -1 only for files
+ dataprovider.UpdateVirtualFolderQuota(&dstFolder.BaseVirtualFolder, 0, filesSize-initialSize, false) //nolint:errcheck
+ if dstFolder.IsIncludedInUserQuota() {
+ dataprovider.UpdateUserQuota(&c.User, 0, filesSize-initialSize, false) //nolint:errcheck
+ }
}
- // we cannot have a directory here, initialSize != -1 only for files
- dataprovider.UpdateUserFolderQuota(dstFolder, &c.User, 0, filesSize-initialSize, false)
}
func (c *BaseConnection) updateQuotaAfterRename(fs vfs.Fs, virtualSourcePath, virtualTargetPath, targetPath string,
@@ -1815,8 +1821,8 @@ type DirListerAt struct {
lister vfs.DirLister
}
-// Prepend adds the given os.FileInfo as first element of the internal cache
-func (l *DirListerAt) Prepend(fi os.FileInfo) {
+// Add adds the given os.FileInfo to the internal cache
+func (l *DirListerAt) Add(fi os.FileInfo) {
l.mu.Lock()
defer l.mu.Unlock()
@@ -1893,22 +1899,18 @@ func getPermissionDeniedError(protocol string) error {
}
}
-func keepConnectionAlive(c *BaseConnection, interval time.Duration) func() {
- var timer *time.Timer
- var closed atomic.Bool
+func keepConnectionAlive(c *BaseConnection, done chan bool, interval time.Duration) {
+ ticker := time.NewTicker(interval)
+ defer func() {
+ ticker.Stop()
+ }()
- task := func() {
- c.UpdateLastActivity()
-
- if !closed.Load() {
- timer.Reset(interval)
+ for {
+ select {
+ case <-done:
+ return
+ case <-ticker.C:
+ c.UpdateLastActivity()
}
}
-
- timer = time.AfterFunc(interval, task)
-
- return func() {
- closed.Store(true)
- timer.Stop()
- }
}
diff --git a/internal/common/connection_test.go b/internal/common/connection_test.go
index 0f426858..5f3c26dc 100644
--- a/internal/common/connection_test.go
+++ b/internal/common/connection_test.go
@@ -22,7 +22,6 @@ import (
"path"
"path/filepath"
"runtime"
- "slices"
"strconv"
"testing"
"time"
@@ -198,24 +197,25 @@ func TestRecursiveRenameWalkError(t *testing.T) {
}
func TestCrossRenameFsErrors(t *testing.T) {
- if runtime.GOOS == osWindows {
- t.Skip("this test is not available on Windows")
- }
fs := vfs.NewOsFs("", os.TempDir(), "", nil)
conn := NewBaseConnection("", ProtocolWebDAV, "", "", dataprovider.User{})
- dirPath := filepath.Join(os.TempDir(), "d")
- err := os.Mkdir(dirPath, os.ModePerm)
- assert.NoError(t, err)
- err = os.Chmod(dirPath, 0001)
- assert.NoError(t, err)
- srcInfo := vfs.NewFileInfo(filepath.Base(dirPath), true, 0, time.Now(), false)
- res := conn.hasSpaceForCrossRename(fs, vfs.QuotaCheckResult{}, 1, dirPath, srcInfo)
+ res := conn.hasSpaceForCrossRename(fs, vfs.QuotaCheckResult{}, 1, "missingsource")
assert.False(t, res)
+ if runtime.GOOS != osWindows {
+ dirPath := filepath.Join(os.TempDir(), "d")
+ err := os.Mkdir(dirPath, os.ModePerm)
+ assert.NoError(t, err)
+ err = os.Chmod(dirPath, 0001)
+ assert.NoError(t, err)
- err = os.Chmod(dirPath, os.ModePerm)
- assert.NoError(t, err)
- err = os.Remove(dirPath)
- assert.NoError(t, err)
+ res = conn.hasSpaceForCrossRename(fs, vfs.QuotaCheckResult{}, 1, dirPath)
+ assert.False(t, res)
+
+ err = os.Chmod(dirPath, os.ModePerm)
+ assert.NoError(t, err)
+ err = os.Remove(dirPath)
+ assert.NoError(t, err)
+ }
}
func TestRenameVirtualFolders(t *testing.T) {
@@ -389,7 +389,7 @@ func TestErrorsMapping(t *testing.T) {
err := conn.GetFsError(fs, os.ErrNotExist)
if protocol == ProtocolSFTP {
assert.ErrorIs(t, err, sftp.ErrSSHFxNoSuchFile)
- } else if slices.Contains(osErrorsProtocols, protocol) {
+ } else if util.Contains(osErrorsProtocols, protocol) {
assert.EqualError(t, err, os.ErrNotExist.Error())
} else {
assert.EqualError(t, err, ErrNotExist.Error())
@@ -627,11 +627,12 @@ func TestErrorResolvePath(t *testing.T) {
func TestConnectionKeepAlive(t *testing.T) {
conn := NewBaseConnection("", ProtocolWebDAV, "", "", dataprovider.User{})
lastActivity := conn.GetLastActivity()
-
- stop := keepConnectionAlive(conn, 50*time.Millisecond)
- defer stop()
-
- time.Sleep(200 * time.Millisecond)
+ done := make(chan bool)
+ go func() {
+ time.Sleep(200 * time.Millisecond)
+ close(done)
+ }()
+ keepConnectionAlive(conn, done, 50*time.Millisecond)
assert.Greater(t, conn.GetLastActivity(), lastActivity)
}
@@ -1046,37 +1047,6 @@ func TestFilePatterns(t *testing.T) {
require.Len(t, filtered, 1)
}
-func TestStatForOngoingTransfers(t *testing.T) {
- user := dataprovider.User{
- BaseUser: sdk.BaseUser{
- Username: xid.New().String(),
- Password: xid.New().String(),
- HomeDir: filepath.Clean(os.TempDir()),
- Status: 1,
- Permissions: map[string][]string{
- "/": {"*"},
- },
- },
- }
- fileName := "file.txt"
- conn := NewBaseConnection(xid.New().String(), ProtocolSFTP, "", "", user)
- fs := vfs.NewOsFs("", os.TempDir(), "", nil)
- tr := NewBaseTransfer(nil, conn, nil, filepath.Join(os.TempDir(), fileName), filepath.Join(os.TempDir(), fileName),
- fileName, TransferUpload, 0, 0, 0, 0, true, fs, dataprovider.TransferQuota{})
- _, err := conn.DoStat("/file.txt", 0, false)
- assert.NoError(t, err)
- err = tr.Close()
- assert.NoError(t, err)
- tr = NewBaseTransfer(nil, conn, nil, filepath.Join(os.TempDir(), fileName), filepath.Join(os.TempDir(), fileName),
- fileName, TransferDownload, 0, 0, 0, 0, true, fs, dataprovider.TransferQuota{})
- _, err = conn.DoStat("/file.txt", 0, false)
- assert.Error(t, err)
- err = tr.Close()
- assert.NoError(t, err)
- err = conn.CloseFS()
- assert.NoError(t, err)
-}
-
func TestListerAt(t *testing.T) {
dir := t.TempDir()
user := dataprovider.User{
@@ -1164,8 +1134,8 @@ func TestListerAt(t *testing.T) {
require.Equal(t, 0, n)
lister, err = conn.ListDir("/")
require.NoError(t, err)
- lister.Prepend(vfs.NewFileInfo("..", true, 0, time.Unix(0, 0), false))
- lister.Prepend(vfs.NewFileInfo(".", true, 0, time.Unix(0, 0), false))
+ lister.Add(vfs.NewFileInfo("..", true, 0, time.Unix(0, 0), false))
+ lister.Add(vfs.NewFileInfo(".", true, 0, time.Unix(0, 0), false))
files = make([]os.FileInfo, 1)
n, err = lister.ListAt(files, 0)
require.NoError(t, err)
@@ -1189,348 +1159,3 @@ func TestListerAt(t *testing.T) {
err = lister.Close()
require.NoError(t, err)
}
-
-func TestGetFsAndResolvedPath(t *testing.T) {
- homeDir := filepath.Join(os.TempDir(), "home_test")
- localVdir := filepath.Join(os.TempDir(), "local_mount_test")
-
- err := os.MkdirAll(homeDir, 0777)
- require.NoError(t, err)
- err = os.MkdirAll(localVdir, 0777)
- require.NoError(t, err)
-
- t.Cleanup(func() {
- os.RemoveAll(homeDir)
- os.RemoveAll(localVdir)
- })
-
- user := dataprovider.User{
- BaseUser: sdk.BaseUser{
- Username: xid.New().String(),
- Status: 1,
- HomeDir: homeDir,
- },
- VirtualFolders: []vfs.VirtualFolder{
- {
- BaseVirtualFolder: vfs.BaseVirtualFolder{
- Name: "s3",
- MappedPath: "",
- FsConfig: vfs.Filesystem{
- Provider: sdk.S3FilesystemProvider,
- S3Config: vfs.S3FsConfig{
- BaseS3FsConfig: sdk.BaseS3FsConfig{
- Bucket: "my-test-bucket",
- Region: "us-east-1",
- },
- },
- },
- },
- VirtualPath: "/s3",
- },
- {
- BaseVirtualFolder: vfs.BaseVirtualFolder{
- Name: "local",
- MappedPath: localVdir,
- FsConfig: vfs.Filesystem{
- Provider: sdk.LocalFilesystemProvider,
- },
- },
- VirtualPath: "/local",
- },
- },
- }
-
- conn := NewBaseConnection(xid.New().String(), ProtocolSFTP, "", "", user)
-
- tests := []struct {
- name string
- inputVirtualPath string
- expectedFsType string
- expectedPhyPath string // The resolved path on the target FS
- expectedRelativePath string
- }{
- {
- name: "Root File",
- inputVirtualPath: "/file.txt",
- expectedFsType: "osfs",
- expectedPhyPath: filepath.Join(homeDir, "file.txt"),
- expectedRelativePath: "/file.txt",
- },
- {
- name: "Standard S3 File",
- inputVirtualPath: "/s3/image.png",
- expectedFsType: "S3Fs",
- expectedPhyPath: "image.png",
- expectedRelativePath: "/s3/image.png",
- },
- {
- name: "Standard Local Mount File",
- inputVirtualPath: "/local/config.json",
- expectedFsType: "osfs",
- expectedPhyPath: filepath.Join(localVdir, "config.json"),
- expectedRelativePath: "/local/config.json",
- },
-
- {
- name: "Backslash Separator -> Should hit S3",
- inputVirtualPath: "\\s3\\doc.txt",
- expectedFsType: "S3Fs",
- expectedPhyPath: "doc.txt",
- expectedRelativePath: "/s3/doc.txt",
- },
- {
- name: "Mixed Separators -> Should hit Local Mount",
- inputVirtualPath: "/local\\subdir/test.txt",
- expectedFsType: "osfs",
- expectedPhyPath: filepath.Join(localVdir, "subdir", "test.txt"),
- expectedRelativePath: "/local/subdir/test.txt",
- },
- {
- name: "Double Slash -> Should normalize and hit S3",
- inputVirtualPath: "//s3//dir @1/data.csv",
- expectedFsType: "S3Fs",
- expectedPhyPath: "dir @1/data.csv",
- expectedRelativePath: "/s3/dir @1/data.csv",
- },
-
- {
- name: "Local Mount Traversal (Attempt to escape)",
- inputVirtualPath: "/local/../../etc/passwd",
- expectedFsType: "osfs",
- expectedPhyPath: filepath.Join(homeDir, "/etc/passwd"),
- expectedRelativePath: "/etc/passwd",
- },
- {
- name: "Traversal Out of S3 (Valid)",
- inputVirtualPath: "/s3/../../secret.txt",
- expectedFsType: "osfs",
- expectedPhyPath: filepath.Join(homeDir, "secret.txt"),
- expectedRelativePath: "/secret.txt",
- },
- {
- name: "Traversal Inside S3",
- inputVirtualPath: "/s3/subdir/../image.png",
- expectedFsType: "S3Fs",
- expectedPhyPath: "image.png",
- expectedRelativePath: "/s3/image.png",
- },
- {
- name: "Mount Point Bypass -> Target Local Mount",
- inputVirtualPath: "/s3\\..\\local\\secret.txt",
- expectedFsType: "osfs",
- expectedPhyPath: filepath.Join(localVdir, "secret.txt"),
- expectedRelativePath: "/local/secret.txt",
- },
- {
- name: "Dirty Relative Path (Your Case)",
- inputVirtualPath: "test\\..\\..\\oops/file.txt",
- expectedFsType: "osfs",
- expectedPhyPath: filepath.Join(homeDir, "oops", "file.txt"),
- expectedRelativePath: "/oops/file.txt",
- },
- {
- name: "Relative Path targeting S3 (No leading slash)",
- inputVirtualPath: "s3//sub/../image.png",
- expectedFsType: "S3Fs",
- expectedPhyPath: "image.png",
- expectedRelativePath: "/s3/image.png",
- },
- {
- name: "Windows Path starting with Backslash",
- inputVirtualPath: "\\s3\\doc/dir\\doc.txt",
- expectedFsType: "S3Fs",
- expectedPhyPath: "doc/dir/doc.txt",
- expectedRelativePath: "/s3/doc/dir/doc.txt",
- },
- {
- name: "Filesystem Juggling (Relative)",
- inputVirtualPath: "local/../s3/file.txt",
- expectedFsType: "S3Fs",
- expectedPhyPath: "file.txt",
- expectedRelativePath: "/s3/file.txt",
- },
- {
- name: "Triple Dot Filename (Valid Name)",
- inputVirtualPath: "/...hidden/secret",
- expectedFsType: "osfs",
- expectedPhyPath: filepath.Join(homeDir, "...hidden", "secret"),
- expectedRelativePath: "/...hidden/secret",
- },
- {
- name: "Dot Slash Prefix",
- inputVirtualPath: "./local/file.txt",
- expectedFsType: "osfs",
- expectedPhyPath: filepath.Join(localVdir, "file.txt"),
- expectedRelativePath: "/local/file.txt",
- },
- {
- name: "Root of Local Mount Exactly",
- inputVirtualPath: "/local/",
- expectedFsType: "osfs",
- expectedPhyPath: localVdir,
- expectedRelativePath: "/local",
- },
- {
- name: "Root of S3 Mount Exactly",
- inputVirtualPath: "/s3/",
- expectedFsType: "S3Fs",
- expectedPhyPath: "",
- expectedRelativePath: "/s3",
- },
- }
-
- for _, tc := range tests {
- t.Run(tc.name, func(t *testing.T) {
- // The input path is sanitized by the protocol handler
- // implementations before reaching GetFsAndResolvedPath.
- cleanInput := util.CleanPath(tc.inputVirtualPath)
- fs, resolvedPath, err := conn.GetFsAndResolvedPath(cleanInput)
- if assert.NoError(t, err, "did not expect error for path: %q, got: %v", tc.inputVirtualPath, err) {
- assert.Contains(t, fs.Name(), tc.expectedFsType,
- "routing error: input %q but expected fs %q, got %q", tc.inputVirtualPath, tc.expectedFsType, fs.Name())
- assert.Equal(t, tc.expectedPhyPath, resolvedPath,
- "resolution error: input %q resolved to %q expected %q", tc.inputVirtualPath, resolvedPath, tc.expectedPhyPath)
- relativePath := fs.GetRelativePath(resolvedPath)
- assert.Equal(t, tc.expectedRelativePath, relativePath,
- "relative path error, input %q, got %q, expected %q", tc.inputVirtualPath, tc.expectedRelativePath, relativePath)
- }
- })
- }
-}
-
-func TestOsFsGetRelativePath(t *testing.T) {
- homeDir := filepath.Join(os.TempDir(), "home_test")
- localVdir := filepath.Join(os.TempDir(), "local_mount_test")
-
- err := os.MkdirAll(homeDir, 0777)
- require.NoError(t, err)
- err = os.MkdirAll(localVdir, 0777)
- require.NoError(t, err)
-
- t.Cleanup(func() {
- os.RemoveAll(homeDir)
- os.RemoveAll(localVdir)
- })
-
- user := dataprovider.User{
- BaseUser: sdk.BaseUser{
- Username: xid.New().String(),
- Status: 1,
- HomeDir: homeDir,
- },
- VirtualFolders: []vfs.VirtualFolder{
- {
- BaseVirtualFolder: vfs.BaseVirtualFolder{
- Name: "local",
- MappedPath: localVdir,
- FsConfig: vfs.Filesystem{
- Provider: sdk.LocalFilesystemProvider,
- },
- },
- VirtualPath: "/local",
- },
- },
- }
-
- connID := xid.New().String()
- rootFs, err := user.GetFilesystemForPath("/", connID)
- require.NoError(t, err)
-
- localFs, err := user.GetFilesystemForPath("/local", connID)
- require.NoError(t, err)
-
- tests := []struct {
- name string
- fs vfs.Fs
- inputPath string // The physical path to reverse-map
- expectedRel string // The expected virtual path
- }{
- {
- name: "Root FS - Inside root",
- fs: rootFs,
- inputPath: filepath.Join(homeDir, "docs", "file.txt"),
- expectedRel: "/docs/file.txt",
- },
- {
- name: "Root FS - Exact root directory",
- fs: rootFs,
- inputPath: homeDir,
- expectedRel: "/",
- },
- {
- name: "Root FS - External absolute path (Jail to /)",
- fs: rootFs,
- inputPath: "/etc/passwd",
- expectedRel: "/",
- },
- {
- name: "Root FS - Traversal escape (Jail to /)",
- fs: rootFs,
- inputPath: filepath.Join(homeDir, "..", "escaped.txt"),
- expectedRel: "/",
- },
- {
- name: "Root FS - Valid file named with triple dots",
- fs: rootFs,
- inputPath: filepath.Join(homeDir, "..."),
- expectedRel: "/...",
- },
- {
- name: "Local FS - Up path in dir",
- fs: rootFs,
- inputPath: homeDir + "/../" + filepath.Base(homeDir) + "/dir/test.txt",
- expectedRel: "/dir/test.txt",
- },
-
- {
- name: "Local FS - Inside mount",
- fs: localFs,
- inputPath: filepath.Join(localVdir, "data", "config.json"),
- expectedRel: "/local/data/config.json",
- },
- {
- name: "Local FS - Exact mount directory",
- fs: localFs,
- inputPath: localVdir,
- expectedRel: "/local",
- },
- {
- name: "Local FS - External absolute path (Jail to /local)",
- fs: localFs,
- inputPath: "/var/log/syslog",
- expectedRel: "/local",
- },
- {
- name: "Local FS - Traversal escape (Jail to /local)",
- fs: localFs,
- inputPath: filepath.Join(localVdir, "..", "..", "etc", "passwd"),
- expectedRel: "/local",
- },
- {
- name: "Local FS - Partial prefix (Jail to /local)",
- fs: localFs,
- inputPath: localVdir + "_backup",
- expectedRel: "/local",
- },
- {
- name: "Local FS - Relative traversal matching virual dir",
- fs: localFs,
- inputPath: localVdir + "/../" + filepath.Base(localVdir) + "/dir/test.txt",
- expectedRel: "/local/dir/test.txt",
- },
- {
- name: "Local FS - Valid file starting with two dots",
- fs: localFs,
- inputPath: filepath.Join(localVdir, "..hidden_file.txt"),
- expectedRel: "/local/..hidden_file.txt",
- },
- }
-
- for _, tc := range tests {
- t.Run(tc.name, func(t *testing.T) {
- actualRel := tc.fs.GetRelativePath(tc.inputPath)
- assert.Equal(t, tc.expectedRel, actualRel,
- "Failed mapping physical path %q on FS %q", tc.inputPath, tc.fs.Name())
- })
- }
-}
diff --git a/internal/common/dataretention.go b/internal/common/dataretention.go
index cbde9521..d97369c2 100644
--- a/internal/common/dataretention.go
+++ b/internal/common/dataretention.go
@@ -15,20 +15,44 @@
package common
import (
+ "bytes"
+ "context"
+ "encoding/json"
"errors"
"fmt"
"io"
+ "net/http"
+ "net/url"
"os"
+ "os/exec"
"path"
+ "path/filepath"
+ "strings"
"sync"
"time"
+ "github.com/wneessen/go-mail"
+
+ "github.com/drakkan/sftpgo/v2/internal/command"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
+ "github.com/drakkan/sftpgo/v2/internal/httpclient"
"github.com/drakkan/sftpgo/v2/internal/logger"
+ "github.com/drakkan/sftpgo/v2/internal/smtp"
"github.com/drakkan/sftpgo/v2/internal/util"
"github.com/drakkan/sftpgo/v2/internal/vfs"
)
+// RetentionCheckNotification defines the supported notification methods for a retention check result
+type RetentionCheckNotification = string
+
+// Supported notification methods
+const (
+ // notify results using the defined "data_retention_hook"
+ RetentionCheckNotificationHook = "Hook"
+ // notify results by email
+ RetentionCheckNotificationEmail = "Email"
+)
+
var (
// RetentionChecks is the list of active retention checks
RetentionChecks ActiveRetentionChecks
@@ -50,10 +74,14 @@ func (c *ActiveRetentionChecks) Get(role string) []RetentionCheck {
if role == "" || role == check.Role {
foldersCopy := make([]dataprovider.FolderRetention, len(check.Folders))
copy(foldersCopy, check.Folders)
+ notificationsCopy := make([]string, len(check.Notifications))
+ copy(notificationsCopy, check.Notifications)
checks = append(checks, RetentionCheck{
- Username: check.Username,
- StartTime: check.StartTime,
- Folders: foldersCopy,
+ Username: check.Username,
+ StartTime: check.StartTime,
+ Notifications: notificationsCopy,
+ Email: check.Email,
+ Folders: foldersCopy,
})
}
}
@@ -122,10 +150,54 @@ type RetentionCheck struct {
StartTime int64 `json:"start_time"`
// affected folders
Folders []dataprovider.FolderRetention `json:"folders"`
- Role string `json:"-"`
+ // how cleanup results will be notified
+ Notifications []RetentionCheckNotification `json:"notifications,omitempty"`
+ // email to use if the notification method is set to email
+ Email string `json:"email,omitempty"`
+ Role string `json:"-"`
// Cleanup results
results []folderRetentionCheckResult `json:"-"`
- conn *BaseConnection `json:"-"`
+ conn *BaseConnection
+}
+
+// Validate returns an error if the specified folders are not valid
+func (c *RetentionCheck) Validate() error {
+ folderPaths := make(map[string]bool)
+ nothingToDo := true
+ for idx := range c.Folders {
+ f := &c.Folders[idx]
+ if err := f.Validate(); err != nil {
+ return err
+ }
+ if f.Retention > 0 {
+ nothingToDo = false
+ }
+ if _, ok := folderPaths[f.Path]; ok {
+ return util.NewValidationError(fmt.Sprintf("duplicated folder path %q", f.Path))
+ }
+ folderPaths[f.Path] = true
+ }
+ if nothingToDo {
+ return util.NewValidationError("nothing to delete!")
+ }
+ for _, notification := range c.Notifications {
+ switch notification {
+ case RetentionCheckNotificationEmail:
+ if !smtp.IsEnabled() {
+ return util.NewValidationError("in order to notify results via email you must configure an SMTP server")
+ }
+ if c.Email == "" {
+ return util.NewValidationError("in order to notify results via email you must add a valid email address to your profile")
+ }
+ case RetentionCheckNotificationHook:
+ if Config.DataRetentionHook == "" {
+ return util.NewValidationError("in order to notify results via hook you must define a data_retention_hook")
+ }
+ default:
+ return util.NewValidationError(fmt.Sprintf("invalid notification %q", notification))
+ }
+ }
+ return nil
}
func (c *RetentionCheck) updateUserPermissions() {
@@ -287,13 +359,130 @@ func (c *RetentionCheck) Start() error {
for _, folder := range c.Folders {
if folder.Retention > 0 {
if err := c.cleanupFolder(folder.Path, 0); err != nil {
- c.conn.Log(logger.LevelError, "retention check failed, unable to cleanup folder %q, elapsed: %s",
- folder.Path, time.Since(startTime))
+ c.conn.Log(logger.LevelError, "retention check failed, unable to cleanup folder %q", folder.Path)
+ c.sendNotifications(time.Since(startTime), err)
return err
}
}
}
- c.conn.Log(logger.LevelInfo, "retention check completed, elapsed: %s", time.Since(startTime))
+ c.conn.Log(logger.LevelInfo, "retention check completed")
+ c.sendNotifications(time.Since(startTime), nil)
return nil
}
+
+func (c *RetentionCheck) sendNotifications(elapsed time.Duration, err error) {
+ for _, notification := range c.Notifications {
+ switch notification {
+ case RetentionCheckNotificationEmail:
+ c.sendEmailNotification(err) //nolint:errcheck
+ case RetentionCheckNotificationHook:
+ c.sendHookNotification(elapsed, err) //nolint:errcheck
+ }
+ }
+}
+
+func (c *RetentionCheck) sendEmailNotification(errCheck error) error {
+ params := EventParams{}
+ if len(c.results) > 0 || errCheck != nil {
+ params.retentionChecks = append(params.retentionChecks, executedRetentionCheck{
+ Username: c.conn.User.Username,
+ ActionName: "Retention check",
+ Results: c.results,
+ })
+ }
+ var files []*mail.File
+ f, err := params.getRetentionReportsAsMailAttachment()
+ if err != nil {
+ c.conn.Log(logger.LevelError, "unable to get retention report as mail attachment: %v", err)
+ return err
+ }
+ f.Name = "retention-report.zip"
+ files = append(files, f)
+
+ startTime := time.Now()
+ var subject string
+ if errCheck == nil {
+ subject = fmt.Sprintf("Successful retention check for user %q", c.conn.User.Username)
+ } else {
+ subject = fmt.Sprintf("Retention check failed for user %q", c.conn.User.Username)
+ }
+ body := "Further details attached."
+ err = smtp.SendEmail([]string{c.Email}, nil, subject, body, smtp.EmailContentTypeTextPlain, files...)
+ if err != nil {
+ c.conn.Log(logger.LevelError, "unable to notify retention check result via email: %v, elapsed: %s", err,
+ time.Since(startTime))
+ return err
+ }
+ c.conn.Log(logger.LevelInfo, "retention check result successfully notified via email, elapsed: %s", time.Since(startTime))
+ return nil
+}
+
+func (c *RetentionCheck) sendHookNotification(elapsed time.Duration, errCheck error) error {
+ startNewHook()
+ defer hookEnded()
+
+ data := make(map[string]any)
+ totalDeletedFiles := 0
+ totalDeletedSize := int64(0)
+ for _, result := range c.results {
+ totalDeletedFiles += result.DeletedFiles
+ totalDeletedSize += result.DeletedSize
+ }
+ data["username"] = c.conn.User.Username
+ data["start_time"] = c.StartTime
+ data["elapsed"] = elapsed.Milliseconds()
+ if errCheck == nil {
+ data["status"] = 1
+ } else {
+ data["status"] = 0
+ }
+ data["total_deleted_files"] = totalDeletedFiles
+ data["total_deleted_size"] = totalDeletedSize
+ data["details"] = c.results
+ jsonData, _ := json.Marshal(data)
+
+ startTime := time.Now()
+
+ if strings.HasPrefix(Config.DataRetentionHook, "http") {
+ var url *url.URL
+ url, err := url.Parse(Config.DataRetentionHook)
+ if err != nil {
+ c.conn.Log(logger.LevelError, "invalid data retention hook %q: %v", Config.DataRetentionHook, err)
+ return err
+ }
+ respCode := 0
+
+ resp, err := httpclient.RetryablePost(url.String(), "application/json", bytes.NewBuffer(jsonData))
+ if err == nil {
+ respCode = resp.StatusCode
+ resp.Body.Close()
+
+ if respCode != http.StatusOK {
+ err = errUnexpectedHTTResponse
+ }
+ }
+
+ c.conn.Log(logger.LevelDebug, "notified result to URL: %q, status code: %v, elapsed: %v err: %v",
+ url.Redacted(), respCode, time.Since(startTime), err)
+
+ return err
+ }
+ if !filepath.IsAbs(Config.DataRetentionHook) {
+ err := fmt.Errorf("invalid data retention hook %q", Config.DataRetentionHook)
+ c.conn.Log(logger.LevelError, "%v", err)
+ return err
+ }
+ timeout, env, args := command.GetConfig(Config.DataRetentionHook, command.HookDataRetention)
+ ctx, cancel := context.WithTimeout(context.Background(), timeout)
+ defer cancel()
+
+ cmd := exec.CommandContext(ctx, Config.DataRetentionHook, args...)
+ cmd.Env = append(env,
+ fmt.Sprintf("SFTPGO_DATA_RETENTION_RESULT=%s", util.BytesToString(jsonData)))
+ err := cmd.Run()
+
+ c.conn.Log(logger.LevelDebug, "notified result using command: %q, elapsed: %s err: %v",
+ Config.DataRetentionHook, time.Since(startTime), err)
+ return err
+}
diff --git a/internal/common/dataretention_test.go b/internal/common/dataretention_test.go
index b3ce46df..b0c17e3b 100644
--- a/internal/common/dataretention_test.go
+++ b/internal/common/dataretention_test.go
@@ -15,17 +15,228 @@
package common
import (
+ "errors"
"fmt"
+ "os/exec"
+ "runtime"
"testing"
+ "time"
"github.com/sftpgo/sdk"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
+ "github.com/drakkan/sftpgo/v2/internal/smtp"
"github.com/drakkan/sftpgo/v2/internal/util"
)
+func TestRetentionValidation(t *testing.T) {
+ check := RetentionCheck{}
+ check.Folders = []dataprovider.FolderRetention{
+ {
+ Path: "/",
+ Retention: -1,
+ },
+ }
+ err := check.Validate()
+ require.Error(t, err)
+ assert.Contains(t, err.Error(), "invalid folder retention")
+
+ check.Folders = []dataprovider.FolderRetention{
+ {
+ Path: "/ab/..",
+ Retention: 0,
+ },
+ }
+ err = check.Validate()
+ require.Error(t, err)
+ assert.Contains(t, err.Error(), "nothing to delete")
+ assert.Equal(t, "/", check.Folders[0].Path)
+
+ check.Folders = append(check.Folders, dataprovider.FolderRetention{
+ Path: "/../..",
+ Retention: 24,
+ })
+ err = check.Validate()
+ require.Error(t, err)
+ assert.Contains(t, err.Error(), `duplicated folder path "/"`)
+
+ check.Folders = []dataprovider.FolderRetention{
+ {
+ Path: "/dir1",
+ Retention: 48,
+ },
+ {
+ Path: "/dir2",
+ Retention: 96,
+ },
+ }
+ err = check.Validate()
+ assert.NoError(t, err)
+ assert.Len(t, check.Notifications, 0)
+ assert.Empty(t, check.Email)
+
+ check.Notifications = []RetentionCheckNotification{RetentionCheckNotificationEmail}
+ err = check.Validate()
+ require.Error(t, err)
+ assert.Contains(t, err.Error(), "you must configure an SMTP server")
+
+ smtpCfg := smtp.Config{
+ Host: "mail.example.com",
+ Port: 25,
+ From: "notification@example.com",
+ TemplatesPath: "templates",
+ }
+ err = smtpCfg.Initialize(configDir, true)
+ require.NoError(t, err)
+
+ err = check.Validate()
+ require.Error(t, err)
+ assert.Contains(t, err.Error(), "you must add a valid email address")
+
+ check.Email = "admin@example.com"
+ err = check.Validate()
+ assert.NoError(t, err)
+
+ smtpCfg = smtp.Config{}
+ err = smtpCfg.Initialize(configDir, true)
+ require.NoError(t, err)
+
+ check.Notifications = []RetentionCheckNotification{RetentionCheckNotificationHook}
+ err = check.Validate()
+ require.Error(t, err)
+ assert.Contains(t, err.Error(), "data_retention_hook")
+
+ check.Notifications = []string{"not valid"}
+ err = check.Validate()
+ require.Error(t, err)
+ assert.Contains(t, err.Error(), "invalid notification")
+}
+
+func TestRetentionEmailNotifications(t *testing.T) {
+ smtpCfg := smtp.Config{
+ Host: "127.0.0.1",
+ Port: 2525,
+ From: "notification@example.com",
+ TemplatesPath: "templates",
+ }
+ err := smtpCfg.Initialize(configDir, true)
+ require.NoError(t, err)
+
+ user := dataprovider.User{
+ BaseUser: sdk.BaseUser{
+ Username: "user1",
+ },
+ }
+ user.Permissions = make(map[string][]string)
+ user.Permissions["/"] = []string{dataprovider.PermAny}
+ check := RetentionCheck{
+ Notifications: []RetentionCheckNotification{RetentionCheckNotificationEmail},
+ Email: "notification@example.com",
+ results: []folderRetentionCheckResult{
+ {
+ Path: "/",
+ Retention: 24,
+ DeletedFiles: 10,
+ DeletedSize: 32657,
+ Elapsed: 10 * time.Second,
+ },
+ },
+ }
+ conn := NewBaseConnection("", "", "", "", user)
+ conn.SetProtocol(ProtocolDataRetention)
+ conn.ID = fmt.Sprintf("data_retention_%v", user.Username)
+ check.conn = conn
+ check.sendNotifications(1*time.Second, nil)
+ err = check.sendEmailNotification(nil)
+ assert.NoError(t, err)
+ err = check.sendEmailNotification(errors.New("test error"))
+ assert.NoError(t, err)
+
+ check.results = nil
+ err = check.sendEmailNotification(nil)
+ if assert.Error(t, err) {
+ assert.Contains(t, err.Error(), "no data retention report available")
+ }
+
+ smtpCfg.Port = 2626
+ err = smtpCfg.Initialize(configDir, true)
+ require.NoError(t, err)
+ err = check.sendEmailNotification(nil)
+ assert.Error(t, err)
+ check.results = []folderRetentionCheckResult{
+ {
+ Path: "/",
+ Retention: 24,
+ DeletedFiles: 20,
+ DeletedSize: 456789,
+ Elapsed: 12 * time.Second,
+ },
+ }
+
+ smtpCfg = smtp.Config{}
+ err = smtpCfg.Initialize(configDir, true)
+ require.NoError(t, err)
+ err = check.sendEmailNotification(nil)
+ assert.Error(t, err)
+}
+
+func TestRetentionHookNotifications(t *testing.T) {
+ dataRetentionHook := Config.DataRetentionHook
+
+ Config.DataRetentionHook = fmt.Sprintf("http://%v", httpAddr)
+ user := dataprovider.User{
+ BaseUser: sdk.BaseUser{
+ Username: "user2",
+ },
+ }
+ user.Permissions = make(map[string][]string)
+ user.Permissions["/"] = []string{dataprovider.PermAny}
+ check := RetentionCheck{
+ Notifications: []RetentionCheckNotification{RetentionCheckNotificationHook},
+ results: []folderRetentionCheckResult{
+ {
+ Path: "/",
+ Retention: 24,
+ DeletedFiles: 10,
+ DeletedSize: 32657,
+ Elapsed: 10 * time.Second,
+ },
+ },
+ }
+ conn := NewBaseConnection("", "", "", "", user)
+ conn.SetProtocol(ProtocolDataRetention)
+ conn.ID = fmt.Sprintf("data_retention_%v", user.Username)
+ check.conn = conn
+ check.sendNotifications(1*time.Second, nil)
+ err := check.sendHookNotification(1*time.Second, nil)
+ assert.NoError(t, err)
+
+ Config.DataRetentionHook = fmt.Sprintf("http://%v/404", httpAddr)
+ err = check.sendHookNotification(1*time.Second, nil)
+ assert.ErrorIs(t, err, errUnexpectedHTTResponse)
+
+ Config.DataRetentionHook = "http://foo\x7f.com/retention"
+ err = check.sendHookNotification(1*time.Second, err)
+ assert.Error(t, err)
+
+ Config.DataRetentionHook = "relativepath"
+ err = check.sendHookNotification(1*time.Second, err)
+ assert.Error(t, err)
+
+ if runtime.GOOS != osWindows {
+ hookCmd, err := exec.LookPath("true")
+ assert.NoError(t, err)
+
+ Config.DataRetentionHook = hookCmd
+ err = check.sendHookNotification(1*time.Second, err)
+ assert.NoError(t, err)
+ }
+
+ Config.DataRetentionHook = dataRetentionHook
+}
+
func TestRetentionPermissionsAndGetFolder(t *testing.T) {
user := dataprovider.User{
BaseUser: sdk.BaseUser{
@@ -100,6 +311,7 @@ func TestRetentionCheckAddRemove(t *testing.T) {
Retention: 48,
},
},
+ Notifications: []RetentionCheckNotification{RetentionCheckNotificationHook},
}
assert.NotNil(t, RetentionChecks.Add(check, &user))
checks := RetentionChecks.Get("")
@@ -109,6 +321,8 @@ func TestRetentionCheckAddRemove(t *testing.T) {
require.Len(t, checks[0].Folders, 1)
assert.Equal(t, check.Folders[0].Path, checks[0].Folders[0].Path)
assert.Equal(t, check.Folders[0].Retention, checks[0].Folders[0].Retention)
+ require.Len(t, checks[0].Notifications, 1)
+ assert.Equal(t, RetentionCheckNotificationHook, checks[0].Notifications[0])
assert.Nil(t, RetentionChecks.Add(check, &user))
assert.True(t, RetentionChecks.remove(username))
@@ -135,6 +349,7 @@ func TestRetentionCheckRole(t *testing.T) {
Retention: 48,
},
},
+ Notifications: []RetentionCheckNotification{RetentionCheckNotificationHook},
}
assert.NotNil(t, RetentionChecks.Add(check, &user))
checks := RetentionChecks.Get("")
diff --git a/internal/common/defenderdb.go b/internal/common/defenderdb.go
index 63995862..3f0a4849 100644
--- a/internal/common/defenderdb.go
+++ b/internal/common/defenderdb.go
@@ -62,7 +62,7 @@ func (d *dbDefender) GetHost(ip string) (dataprovider.DefenderEntry, error) {
// and increase ban time if the IP is found.
// This method must be called as soon as the client connects
func (d *dbDefender) IsBanned(ip, protocol string) bool {
- if d.isBanned(ip, protocol) {
+ if d.baseDefender.isBanned(ip, protocol) {
return true
}
@@ -95,15 +95,15 @@ func (d *dbDefender) AddEvent(ip, protocol string, event HostEvent) bool {
return true
}
- score := d.getScore(event)
+ score := d.baseDefender.getScore(event)
host, err := dataprovider.AddDefenderEvent(ip, score, d.getStartObservationTime())
if err != nil {
return false
}
- d.logEvent(ip, protocol, event, host.Score)
+ d.baseDefender.logEvent(ip, protocol, event, host.Score)
if host.Score > d.config.Threshold {
- d.logBan(ip, protocol)
+ d.baseDefender.logBan(ip, protocol)
banTime := time.Now().Add(time.Duration(d.config.BanTime) * time.Minute)
err = dataprovider.SetDefenderBanTime(ip, util.GetTimeAsMsSinceEpoch(banTime))
if err == nil {
diff --git a/internal/common/defendermem.go b/internal/common/defendermem.go
index 0f59b37a..b5642c4e 100644
--- a/internal/common/defendermem.go
+++ b/internal/common/defendermem.go
@@ -148,7 +148,7 @@ func (d *memoryDefender) IsBanned(ip, protocol string) bool {
defer d.RUnlock()
- return d.isBanned(ip, protocol)
+ return d.baseDefender.isBanned(ip, protocol)
}
// DeleteHost removes the specified IP from the defender lists
@@ -188,7 +188,7 @@ func (d *memoryDefender) AddEvent(ip, protocol string, event HostEvent) bool {
delete(d.banned, ip)
}
- score := d.getScore(event)
+ score := d.baseDefender.getScore(event)
ev := hostEvent{
dateTime: time.Now(),
@@ -207,11 +207,11 @@ func (d *memoryDefender) AddEvent(ip, protocol string, event HostEvent) bool {
idx++
}
}
- d.logEvent(ip, protocol, event, hs.TotalScore)
+ d.baseDefender.logEvent(ip, protocol, event, hs.TotalScore)
hs.Events = hs.Events[:idx]
if hs.TotalScore >= d.config.Threshold {
- d.logBan(ip, protocol)
+ d.baseDefender.logBan(ip, protocol)
d.banned[ip] = time.Now().Add(time.Duration(d.config.BanTime) * time.Minute)
delete(d.hosts, ip)
d.cleanupBanned()
@@ -225,7 +225,7 @@ func (d *memoryDefender) AddEvent(ip, protocol string, event HostEvent) bool {
d.hosts[ip] = hs
}
} else {
- d.logEvent(ip, protocol, event, ev.score)
+ d.baseDefender.logEvent(ip, protocol, event, ev.score)
d.hosts[ip] = hostScore{
TotalScore: ev.score,
Events: []hostEvent{ev},
diff --git a/internal/common/eventmanager.go b/internal/common/eventmanager.go
index ca0f7494..fcb517ee 100644
--- a/internal/common/eventmanager.go
+++ b/internal/common/eventmanager.go
@@ -21,7 +21,6 @@ import (
"encoding/json"
"errors"
"fmt"
- "html"
"io"
"mime"
"mime/multipart"
@@ -57,8 +56,8 @@ import (
const (
ipBlockedEventName = "IP Blocked"
maxAttachmentsSize = int64(10 * 1024 * 1024)
- objDataPlaceholder = "{{.ObjectData}}"
- objDataPlaceholderString = "{{.ObjectDataString}}"
+ objDataPlaceholder = "{{ObjectData}}"
+ objDataPlaceholderString = "{{ObjectDataString}}"
dateTimeMillisFormat = "2006-01-02T15:04:05.000"
)
@@ -72,9 +71,6 @@ var (
// eventManager handle the supported event rules actions
eventManager eventRulesContainer
multipartQuoteEscaper = strings.NewReplacer("\\", "\\\\", `"`, "\\\"")
- fsEventsWithSize = []string{operationPreDelete, OperationPreUpload, operationDelete,
- operationCopy, operationDownload, operationFirstUpload, operationFirstDownload,
- operationUpload}
)
func init() {
@@ -278,8 +274,7 @@ func (r *eventRulesContainer) addUpdateRuleInternal(rule dataprovider.EventRule)
func (r *eventRulesContainer) loadRules() {
eventManagerLog(logger.LevelDebug, "loading updated rules")
modTime := util.GetTimeAsMsSinceEpoch(time.Now())
- lastLoadTime := r.getLastLoadTime()
- rules, err := dataprovider.GetRecentlyUpdatedRules(lastLoadTime)
+ rules, err := dataprovider.GetRecentlyUpdatedRules(r.getLastLoadTime())
if err != nil {
eventManagerLog(logger.LevelError, "unable to load event rules: %v", err)
return
@@ -315,7 +310,7 @@ func (*eventRulesContainer) checkIPDLoginEventMatch(conditions *dataprovider.Eve
}
func (*eventRulesContainer) checkProviderEventMatch(conditions *dataprovider.EventConditions, params *EventParams) bool {
- if !slices.Contains(conditions.ProviderEvents, params.Event) {
+ if !util.Contains(conditions.ProviderEvents, params.Event) {
return false
}
if !checkEventConditionPatterns(params.Name, conditions.Options.Names) {
@@ -327,14 +322,14 @@ func (*eventRulesContainer) checkProviderEventMatch(conditions *dataprovider.Eve
if !checkEventConditionPatterns(params.Role, conditions.Options.RoleNames) {
return false
}
- if len(conditions.Options.ProviderObjects) > 0 && !slices.Contains(conditions.Options.ProviderObjects, params.ObjectType) {
+ if len(conditions.Options.ProviderObjects) > 0 && !util.Contains(conditions.Options.ProviderObjects, params.ObjectType) {
return false
}
return true
}
func (*eventRulesContainer) checkFsEventMatch(conditions *dataprovider.EventConditions, params *EventParams) bool {
- if !slices.Contains(conditions.FsEvents, params.Event) {
+ if !util.Contains(conditions.FsEvents, params.Event) {
return false
}
if !checkEventConditionPatterns(params.Name, conditions.Options.Names) {
@@ -349,10 +344,10 @@ func (*eventRulesContainer) checkFsEventMatch(conditions *dataprovider.EventCond
if !checkEventConditionPatterns(params.VirtualPath, conditions.Options.FsPaths) {
return false
}
- if len(conditions.Options.Protocols) > 0 && !slices.Contains(conditions.Options.Protocols, params.Protocol) {
+ if len(conditions.Options.Protocols) > 0 && !util.Contains(conditions.Options.Protocols, params.Protocol) {
return false
}
- if slices.Contains(fsEventsWithSize, params.Event) {
+ if params.Event == operationUpload || params.Event == operationDownload {
if conditions.Options.MinFileSize > 0 {
if params.FileSize < conditions.Options.MinFileSize {
return false
@@ -776,70 +771,48 @@ func (p *EventParams) getRetentionReportsAsMailAttachment() (*mail.File, error)
}, nil
}
-func (*EventParams) getStringReplacement(val string, escapeMode int) string {
- switch escapeMode {
- case 1:
+func (*EventParams) getStringReplacement(val string, jsonEscaped bool) string {
+ if jsonEscaped {
return util.JSONEscape(val)
- case 2:
- return html.EscapeString(val)
- default:
- return val
}
+ return val
}
-func (p *EventParams) getStringReplacements(addObjectData bool, escapeMode int) []string {
- var dateTimeString string
- if Config.TZ == "local" {
- dateTimeString = p.Timestamp.Local().Format(dateTimeMillisFormat)
- } else {
- dateTimeString = p.Timestamp.UTC().Format(dateTimeMillisFormat)
- }
- year := dateTimeString[0:4]
- month := dateTimeString[5:7]
- day := dateTimeString[8:10]
- hour := dateTimeString[11:13]
- minute := dateTimeString[14:16]
-
+func (p *EventParams) getStringReplacements(addObjectData, jsonEscaped bool) []string {
replacements := []string{
- "{{.Name}}", p.getStringReplacement(p.Name, escapeMode),
- "{{.Event}}", p.Event,
- "{{.Status}}", fmt.Sprintf("%d", p.Status),
- "{{.VirtualPath}}", p.getStringReplacement(p.VirtualPath, escapeMode),
- "{{.EscapedVirtualPath}}", p.getStringReplacement(url.QueryEscape(p.VirtualPath), escapeMode),
- "{{.FsPath}}", p.getStringReplacement(p.FsPath, escapeMode),
- "{{.VirtualTargetPath}}", p.getStringReplacement(p.VirtualTargetPath, escapeMode),
- "{{.FsTargetPath}}", p.getStringReplacement(p.FsTargetPath, escapeMode),
- "{{.ObjectName}}", p.getStringReplacement(p.ObjectName, escapeMode),
- "{{.ObjectBaseName}}", p.getStringReplacement(strings.TrimSuffix(p.ObjectName, p.Extension), escapeMode),
- "{{.ObjectType}}", p.ObjectType,
- "{{.FileSize}}", strconv.FormatInt(p.FileSize, 10),
- "{{.Elapsed}}", strconv.FormatInt(p.Elapsed, 10),
- "{{.Protocol}}", p.Protocol,
- "{{.IP}}", p.IP,
- "{{.Role}}", p.getStringReplacement(p.Role, escapeMode),
- "{{.Email}}", p.getStringReplacement(p.Email, escapeMode),
- "{{.Timestamp}}", strconv.FormatInt(p.Timestamp.UnixNano(), 10),
- "{{.DateTime}}", dateTimeString,
- "{{.Year}}", year,
- "{{.Month}}", month,
- "{{.Day}}", day,
- "{{.Hour}}", hour,
- "{{.Minute}}", minute,
- "{{.StatusString}}", p.getStatusString(),
- "{{.UID}}", p.getStringReplacement(p.UID, escapeMode),
- "{{.Ext}}", p.getStringReplacement(p.Extension, escapeMode),
+ "{{Name}}", p.getStringReplacement(p.Name, jsonEscaped),
+ "{{Event}}", p.Event,
+ "{{Status}}", fmt.Sprintf("%d", p.Status),
+ "{{VirtualPath}}", p.getStringReplacement(p.VirtualPath, jsonEscaped),
+ "{{EscapedVirtualPath}}", p.getStringReplacement(url.QueryEscape(p.VirtualPath), jsonEscaped),
+ "{{FsPath}}", p.getStringReplacement(p.FsPath, jsonEscaped),
+ "{{VirtualTargetPath}}", p.getStringReplacement(p.VirtualTargetPath, jsonEscaped),
+ "{{FsTargetPath}}", p.getStringReplacement(p.FsTargetPath, jsonEscaped),
+ "{{ObjectName}}", p.getStringReplacement(p.ObjectName, jsonEscaped),
+ "{{ObjectType}}", p.ObjectType,
+ "{{FileSize}}", strconv.FormatInt(p.FileSize, 10),
+ "{{Elapsed}}", strconv.FormatInt(p.Elapsed, 10),
+ "{{Protocol}}", p.Protocol,
+ "{{IP}}", p.IP,
+ "{{Role}}", p.getStringReplacement(p.Role, jsonEscaped),
+ "{{Email}}", p.getStringReplacement(p.Email, jsonEscaped),
+ "{{Timestamp}}", strconv.FormatInt(p.Timestamp.UnixNano(), 10),
+ "{{DateTime}}", p.Timestamp.UTC().Format(dateTimeMillisFormat),
+ "{{StatusString}}", p.getStatusString(),
+ "{{UID}}", p.getStringReplacement(p.UID, jsonEscaped),
+ "{{Ext}}", p.getStringReplacement(p.Extension, jsonEscaped),
}
if p.VirtualPath != "" {
- replacements = append(replacements, "{{.VirtualDirPath}}", p.getStringReplacement(path.Dir(p.VirtualPath), escapeMode))
+ replacements = append(replacements, "{{VirtualDirPath}}", p.getStringReplacement(path.Dir(p.VirtualPath), jsonEscaped))
}
if p.VirtualTargetPath != "" {
- replacements = append(replacements, "{{.VirtualTargetDirPath}}", p.getStringReplacement(path.Dir(p.VirtualTargetPath), escapeMode))
- replacements = append(replacements, "{{.TargetName}}", p.getStringReplacement(path.Base(p.VirtualTargetPath), escapeMode))
+ replacements = append(replacements, "{{VirtualTargetDirPath}}", p.getStringReplacement(path.Dir(p.VirtualTargetPath), jsonEscaped))
+ replacements = append(replacements, "{{TargetName}}", p.getStringReplacement(path.Base(p.VirtualTargetPath), jsonEscaped))
}
if len(p.errors) > 0 {
- replacements = append(replacements, "{{.ErrorString}}", p.getStringReplacement(strings.Join(p.errors, ", "), escapeMode))
+ replacements = append(replacements, "{{ErrorString}}", p.getStringReplacement(strings.Join(p.errors, ", "), jsonEscaped))
} else {
- replacements = append(replacements, "{{.ErrorString}}", "")
+ replacements = append(replacements, "{{ErrorString}}", "")
}
replacements = append(replacements, objDataPlaceholder, "{}")
replacements = append(replacements, objDataPlaceholderString, "")
@@ -847,23 +820,23 @@ func (p *EventParams) getStringReplacements(addObjectData bool, escapeMode int)
data, err := p.Object.RenderAsJSON(p.Event != operationDelete)
if err == nil {
dataString := util.BytesToString(data)
- replacements[len(replacements)-3] = p.getStringReplacement(dataString, 0)
- replacements[len(replacements)-1] = p.getStringReplacement(dataString, 1)
+ replacements[len(replacements)-3] = p.getStringReplacement(dataString, false)
+ replacements[len(replacements)-1] = p.getStringReplacement(dataString, true)
}
}
if p.IDPCustomFields != nil {
for k, v := range *p.IDPCustomFields {
- replacements = append(replacements, fmt.Sprintf("{{.IDPField%s}}", k), p.getStringReplacement(v, escapeMode))
+ replacements = append(replacements, fmt.Sprintf("{{IDPField%s}}", k), p.getStringReplacement(v, jsonEscaped))
}
}
- replacements = append(replacements, "{{.Metadata}}", "{}")
- replacements = append(replacements, "{{.MetadataString}}", "")
+ replacements = append(replacements, "{{Metadata}}", "{}")
+ replacements = append(replacements, "{{MetadataString}}", "")
if len(p.Metadata) > 0 {
data, err := json.Marshal(p.Metadata)
if err == nil {
dataString := util.BytesToString(data)
- replacements[len(replacements)-3] = p.getStringReplacement(dataString, 0)
- replacements[len(replacements)-1] = p.getStringReplacement(dataString, 1)
+ replacements[len(replacements)-3] = p.getStringReplacement(dataString, false)
+ replacements[len(replacements)-1] = p.getStringReplacement(dataString, true)
}
}
return replacements
@@ -943,7 +916,10 @@ func updateUserQuotaAfterFileWrite(conn *BaseConnection, virtualPath string, num
dataprovider.UpdateUserQuota(&conn.User, numFiles, fileSize, false) //nolint:errcheck
return
}
- dataprovider.UpdateUserFolderQuota(&vfolder, &conn.User, numFiles, fileSize, false)
+ dataprovider.UpdateVirtualFolderQuota(&vfolder.BaseVirtualFolder, numFiles, fileSize, false) //nolint:errcheck
+ if vfolder.IsIncludedInUserQuota() {
+ dataprovider.UpdateUserQuota(&conn.User, numFiles, fileSize, false) //nolint:errcheck
+ }
}
func checkWriterPermsAndQuota(conn *BaseConnection, virtualPath string, numFiles int, expectedSize, truncatedSize int64) error {
@@ -1020,7 +996,7 @@ func getFileWriter(conn *BaseConnection, virtualPath string, expectedSize int64)
return w, numFiles, truncatedSize, cancelFn, nil
}
-func addZipEntry(wr *zipWriterWrapper, conn *BaseConnection, entryPath, baseDir string, info os.FileInfo, recursion int) error { //nolint:gocyclo
+func addZipEntry(wr *zipWriterWrapper, conn *BaseConnection, entryPath, baseDir string, recursion int) error {
if entryPath == wr.Name {
// skip the archive itself
return nil
@@ -1030,13 +1006,10 @@ func addZipEntry(wr *zipWriterWrapper, conn *BaseConnection, entryPath, baseDir
return util.ErrRecursionTooDeep
}
recursion++
- var err error
- if info == nil {
- info, err = conn.DoStat(entryPath, 1, false)
- if err != nil {
- eventManagerLog(logger.LevelError, "unable to add zip entry %q, stat error: %v", entryPath, err)
- return err
- }
+ info, err := conn.DoStat(entryPath, 1, false)
+ if err != nil {
+ eventManagerLog(logger.LevelError, "unable to add zip entry %q, stat error: %v", entryPath, err)
+ return err
}
entryName, err := getZipEntryName(entryPath, baseDir)
if err != nil {
@@ -1074,7 +1047,7 @@ func addZipEntry(wr *zipWriterWrapper, conn *BaseConnection, entryPath, baseDir
}
for _, info := range contents {
fullPath := util.CleanPath(path.Join(entryPath, info.Name()))
- if err := addZipEntry(wr, conn, fullPath, baseDir, info, recursion); err != nil {
+ if err := addZipEntry(wr, conn, fullPath, baseDir, recursion); err != nil {
eventManagerLog(logger.LevelError, "unable to add zip entry: %v", err)
return err
}
@@ -1198,7 +1171,7 @@ func getMailAttachments(conn *BaseConnection, attachments []string, replacer *st
}
func replaceWithReplacer(input string, replacer *strings.Replacer) string {
- if !strings.Contains(input, "{{.") {
+ if !strings.Contains(input, "{{") {
return input
}
return replacer.Replace(input)
@@ -1285,7 +1258,7 @@ func getHTTPRuleActionEndpoint(c *dataprovider.EventActionHTTPConfig, replacer *
if err != nil {
return "", fmt.Errorf("invalid endpoint: %w", err)
}
- if strings.Contains(u.Path, "{{.") {
+ if strings.Contains(u.Path, "{{") {
pathComponents := strings.Split(u.Path, "/")
for idx := range pathComponents {
part := replaceWithReplacer(pathComponents[idx], replacer)
@@ -1319,7 +1292,7 @@ func writeHTTPPart(m *multipart.Writer, part dataprovider.HTTPPart, h textproto.
if part.Body != "" {
cType := h.Get("Content-Type")
if strings.Contains(strings.ToLower(cType), "application/json") {
- replacements := params.getStringReplacements(addObjectData, 1)
+ replacements := params.getStringReplacements(addObjectData, true)
jsonReplacer := strings.NewReplacer(replacements...)
_, err = partWriter.Write(util.StringToBytes(replaceWithReplacer(part.Body, jsonReplacer)))
} else {
@@ -1367,7 +1340,7 @@ func getHTTPRuleActionBody(c *dataprovider.EventActionHTTPConfig, replacer *stri
return bytes.NewBuffer(data), "", nil
}
if c.HasJSONBody() {
- replacements := params.getStringReplacements(addObjectData, 1)
+ replacements := params.getStringReplacements(addObjectData, true)
jsonReplacer := strings.NewReplacer(replacements...)
return bytes.NewBufferString(replaceWithReplacer(c.Body, jsonReplacer)), "", nil
}
@@ -1380,7 +1353,8 @@ func getHTTPRuleActionBody(c *dataprovider.EventActionHTTPConfig, replacer *stri
var conn *BaseConnection
if user.Username != "" {
var err error
- if err := getUserForEventAction(&user); err != nil {
+ user, err = getUserForEventAction(user)
+ if err != nil {
return body, "", err
}
connectionID := fmt.Sprintf("%s_%s", protocolEventAction, xid.New().String())
@@ -1454,7 +1428,7 @@ func executeHTTPRuleAction(c dataprovider.EventActionHTTPConfig, params *EventPa
addObjectData = c.HasObjectData()
}
- replacements := params.getStringReplacements(addObjectData, 0)
+ replacements := params.getStringReplacements(addObjectData, false)
replacer := strings.NewReplacer(replacements...)
endpoint, err := getHTTPRuleActionEndpoint(&c, replacer)
if err != nil {
@@ -1504,7 +1478,7 @@ func executeHTTPRuleAction(c dataprovider.EventActionHTTPConfig, params *EventPa
if resp.StatusCode < http.StatusOK || resp.StatusCode > http.StatusNoContent {
if rb, err := io.ReadAll(io.LimitReader(resp.Body, 2048)); err == nil {
eventManagerLog(logger.LevelDebug, "error notification response from endpoint %q: %s",
- endpoint, rb)
+ endpoint, util.BytesToString(rb))
}
return fmt.Errorf("unexpected status code: %d", resp.StatusCode)
}
@@ -1525,7 +1499,7 @@ func executeCommandRuleAction(c dataprovider.EventActionCommandConfig, params *E
}
}
}
- replacements := params.getStringReplacements(addObjectData, 0)
+ replacements := params.getStringReplacements(addObjectData, false)
replacer := strings.NewReplacer(replacements...)
args := make([]string, 0, len(c.Args))
@@ -1539,7 +1513,7 @@ func executeCommandRuleAction(c dataprovider.EventActionCommandConfig, params *E
cmd := exec.CommandContext(ctx, c.Cmd, args...)
cmd.Env = []string{}
for _, keyVal := range c.EnvVars {
- if keyVal.Value == "$" && !strings.HasPrefix(strings.ToUpper(keyVal.Key), "SFTPGO_") {
+ if keyVal.Value == "$" {
val := os.Getenv(keyVal.Key)
if val == "" {
eventManagerLog(logger.LevelDebug, "empty value for environment variable %q", keyVal.Key)
@@ -1580,16 +1554,9 @@ func executeEmailRuleAction(c dataprovider.EventActionEmailConfig, params *Event
addObjectData = true
}
}
- replacements := params.getStringReplacements(addObjectData, 0)
+ replacements := params.getStringReplacements(addObjectData, false)
replacer := strings.NewReplacer(replacements...)
- var body string
- if c.ContentType == 1 {
- replacements := params.getStringReplacements(addObjectData, 2)
- bodyReplacer := strings.NewReplacer(replacements...)
- body = replaceWithReplacer(c.Body, bodyReplacer)
- } else {
- body = replaceWithReplacer(c.Body, replacer)
- }
+ body := replaceWithReplacer(c.Body, replacer)
subject := replaceWithReplacer(c.Subject, replacer)
recipients := getEmailAddressesWithReplacer(c.Recipients, replacer)
bcc := getEmailAddressesWithReplacer(c.Bcc, replacer)
@@ -1612,7 +1579,8 @@ func executeEmailRuleAction(c dataprovider.EventActionEmailConfig, params *Event
if err != nil {
return err
}
- if err := getUserForEventAction(&user); err != nil {
+ user, err = getUserForEventAction(user)
+ if err != nil {
return err
}
connectionID := fmt.Sprintf("%s_%s", protocolEventAction, xid.New().String())
@@ -1639,11 +1607,11 @@ func executeEmailRuleAction(c dataprovider.EventActionEmailConfig, params *Event
return nil
}
-func getUserForEventAction(user *dataprovider.User) error {
+func getUserForEventAction(user dataprovider.User) (dataprovider.User, error) {
err := user.LoadAndApplyGroupSettings()
if err != nil {
eventManagerLog(logger.LevelError, "unable to get group for user %q: %+v", user.Username, err)
- return fmt.Errorf("unable to get groups for user %q", user.Username)
+ return dataprovider.User{}, fmt.Errorf("unable to get groups for user %q", user.Username)
}
user.UploadDataTransfer = 0
user.UploadBandwidth = 0
@@ -1654,7 +1622,7 @@ func getUserForEventAction(user *dataprovider.User) error {
for k := range user.Permissions {
user.Permissions[k] = []string{dataprovider.PermAny}
}
- return nil
+ return user, nil
}
func replacePathsPlaceholders(paths []string, replacer *strings.Replacer) []string {
@@ -1674,11 +1642,12 @@ func executeDeleteFileFsAction(conn *BaseConnection, item string, info os.FileIn
}
func executeDeleteFsActionForUser(deletes []string, replacer *strings.Replacer, user dataprovider.User) error {
- if err := getUserForEventAction(&user); err != nil {
+ user, err := getUserForEventAction(user)
+ if err != nil {
return err
}
connectionID := fmt.Sprintf("%s_%s", protocolEventAction, xid.New().String())
- err := user.CheckFsRoot(connectionID)
+ err = user.CheckFsRoot(connectionID)
defer user.CloseFs() //nolint:errcheck
if err != nil {
return fmt.Errorf("delete error, unable to check root fs for user %q: %w", user.Username, err)
@@ -1743,11 +1712,12 @@ func executeDeleteFsRuleAction(deletes []string, replacer *strings.Replacer,
}
func executeMkDirsFsActionForUser(dirs []string, replacer *strings.Replacer, user dataprovider.User) error {
- if err := getUserForEventAction(&user); err != nil {
+ user, err := getUserForEventAction(user)
+ if err != nil {
return err
}
connectionID := fmt.Sprintf("%s_%s", protocolEventAction, xid.New().String())
- err := user.CheckFsRoot(connectionID)
+ err = user.CheckFsRoot(connectionID)
defer user.CloseFs() //nolint:errcheck
if err != nil {
return fmt.Errorf("mkdir error, unable to check root fs for user %q: %w", user.Username, err)
@@ -1800,14 +1770,15 @@ func executeMkdirFsRuleAction(dirs []string, replacer *strings.Replacer,
return nil
}
-func executeRenameFsActionForUser(renames []dataprovider.RenameConfig, replacer *strings.Replacer,
+func executeRenameFsActionForUser(renames []dataprovider.KeyValue, replacer *strings.Replacer,
user dataprovider.User,
) error {
- if err := getUserForEventAction(&user); err != nil {
+ user, err := getUserForEventAction(user)
+ if err != nil {
return err
}
connectionID := fmt.Sprintf("%s_%s", protocolEventAction, xid.New().String())
- err := user.CheckFsRoot(connectionID)
+ err = user.CheckFsRoot(connectionID)
defer user.CloseFs() //nolint:errcheck
if err != nil {
return fmt.Errorf("rename error, unable to check root fs for user %q: %w", user.Username, err)
@@ -1818,11 +1789,7 @@ func executeRenameFsActionForUser(renames []dataprovider.RenameConfig, replacer
for _, item := range renames {
source := util.CleanPath(replaceWithReplacer(item.Key, replacer))
target := util.CleanPath(replaceWithReplacer(item.Value, replacer))
- checks := 0
- if item.UpdateModTime {
- checks += vfs.CheckUpdateModTime
- }
- if err = conn.renameInternal(source, target, true, checks); err != nil {
+ if err = conn.renameInternal(source, target, true); err != nil {
return fmt.Errorf("unable to rename %q->%q, user %q: %w", source, target, user.Username, err)
}
eventManagerLog(logger.LevelDebug, "rename %q->%q ok, user %q", source, target, user.Username)
@@ -1833,11 +1800,12 @@ func executeRenameFsActionForUser(renames []dataprovider.RenameConfig, replacer
func executeCopyFsActionForUser(keyVals []dataprovider.KeyValue, replacer *strings.Replacer,
user dataprovider.User,
) error {
- if err := getUserForEventAction(&user); err != nil {
+ user, err := getUserForEventAction(user)
+ if err != nil {
return err
}
connectionID := fmt.Sprintf("%s_%s", protocolEventAction, xid.New().String())
- err := user.CheckFsRoot(connectionID)
+ err = user.CheckFsRoot(connectionID)
defer user.CloseFs() //nolint:errcheck
if err != nil {
return fmt.Errorf("copy error, unable to check root fs for user %q: %w", user.Username, err)
@@ -1865,11 +1833,12 @@ func executeCopyFsActionForUser(keyVals []dataprovider.KeyValue, replacer *strin
func executeExistFsActionForUser(exist []string, replacer *strings.Replacer,
user dataprovider.User,
) error {
- if err := getUserForEventAction(&user); err != nil {
+ user, err := getUserForEventAction(user)
+ if err != nil {
return err
}
connectionID := fmt.Sprintf("%s_%s", protocolEventAction, xid.New().String())
- err := user.CheckFsRoot(connectionID)
+ err = user.CheckFsRoot(connectionID)
defer user.CloseFs() //nolint:errcheck
if err != nil {
return fmt.Errorf("existence check error, unable to check root fs for user %q: %w", user.Username, err)
@@ -1886,7 +1855,7 @@ func executeExistFsActionForUser(exist []string, replacer *strings.Replacer,
return nil
}
-func executeRenameFsRuleAction(renames []dataprovider.RenameConfig, replacer *strings.Replacer,
+func executeRenameFsRuleAction(renames []dataprovider.KeyValue, replacer *strings.Replacer,
conditions dataprovider.ConditionOptions, params *EventParams,
) error {
users, err := params.getUsers()
@@ -2024,11 +1993,12 @@ func estimateZipSize(conn *BaseConnection, zipPath string, paths []string) (int6
func executeCompressFsActionForUser(c dataprovider.EventActionFsCompress, replacer *strings.Replacer,
user dataprovider.User,
) error {
- if err := getUserForEventAction(&user); err != nil {
+ user, err := getUserForEventAction(user)
+ if err != nil {
return err
}
connectionID := fmt.Sprintf("%s_%s", protocolEventAction, xid.New().String())
- err := user.CheckFsRoot(connectionID)
+ err = user.CheckFsRoot(connectionID)
defer user.CloseFs() //nolint:errcheck
if err != nil {
return fmt.Errorf("compress error, unable to check root fs for user %q: %w", user.Username, err)
@@ -2069,7 +2039,7 @@ func executeCompressFsActionForUser(c dataprovider.EventActionFsCompress, replac
}
startTime := time.Now()
for _, item := range paths {
- if err := addZipEntry(zipWriter, conn, item, baseDir, nil, 0); err != nil {
+ if err := addZipEntry(zipWriter, conn, item, baseDir, 0); err != nil {
closeWriterAndUpdateQuota(writer, conn, name, "", numFiles, truncatedSize, err, operationUpload, startTime) //nolint:errcheck
return err
}
@@ -2154,7 +2124,7 @@ func executeFsRuleAction(c dataprovider.EventActionFilesystemConfig, conditions
params *EventParams,
) error {
addObjectData := false
- replacements := params.getStringReplacements(addObjectData, 0)
+ replacements := params.getStringReplacements(addObjectData, false)
replacer := strings.NewReplacer(replacements...)
switch c.Type {
case dataprovider.FilesystemActionRename:
@@ -2506,7 +2476,7 @@ func executePwdExpirationCheckForUser(user *dataprovider.User, config dataprovid
}
subject := "SFTPGo password expiration notification"
startTime := time.Now()
- if err := smtp.SendEmail(user.GetEmailAddresses(), nil, subject, body.String(), smtp.EmailContentTypeTextHTML); err != nil {
+ if err := smtp.SendEmail([]string{user.Email}, nil, subject, body.String(), smtp.EmailContentTypeTextHTML); err != nil {
eventManagerLog(logger.LevelError, "unable to notify password expiration for user %s: %v, elapsed: %s",
user.Username, err, time.Since(startTime))
return err
@@ -2554,7 +2524,7 @@ func executeAdminCheckAction(c *dataprovider.EventActionIDPAccountCheck, params
return nil, err
}
- replacements := params.getStringReplacements(false, 1)
+ replacements := params.getStringReplacements(false, true)
replacer := strings.NewReplacer(replacements...)
data := replaceWithReplacer(c.TemplateAdmin, replacer)
@@ -2601,9 +2571,6 @@ func preserveUserProfile(user, newUser *dataprovider.User) {
if user.Email != "" {
newUser.Email = user.Email
}
- if len(user.Filters.AdditionalEmails) > 0 {
- newUser.Filters.AdditionalEmails = user.Filters.AdditionalEmails
- }
}
if newUser.CanChangeAPIKeyAuth() {
newUser.Filters.AllowAPIKeyAuth = user.Filters.AllowAPIKeyAuth
@@ -2624,7 +2591,7 @@ func executeUserCheckAction(c *dataprovider.EventActionIDPAccountCheck, params *
if err != nil && !errors.Is(err, util.ErrNotFound) {
return nil, err
}
- replacements := params.getStringReplacements(false, 1)
+ replacements := params.getStringReplacements(false, true)
replacer := strings.NewReplacer(replacements...)
data := replaceWithReplacer(c.TemplateUser, replacer)
@@ -2846,16 +2813,6 @@ func (j *eventCronJob) getTask(rule *dataprovider.EventRule) (dataprovider.Task,
return dataprovider.Task{}, nil
}
-func (j *eventCronJob) getEventParams() EventParams {
- return EventParams{
- Event: "Schedule",
- Name: j.ruleName,
- Status: 1,
- Timestamp: time.Now(),
- updateStatusFromError: true,
- }
-}
-
func (j *eventCronJob) Run() {
eventManagerLog(logger.LevelDebug, "executing scheduled rule %q", j.ruleName)
rule, err := dataprovider.EventRuleExists(j.ruleName)
@@ -2906,9 +2863,9 @@ func (j *eventCronJob) Run() {
}
}(task.Name)
- executeAsyncRulesActions([]dataprovider.EventRule{rule}, j.getEventParams())
+ executeAsyncRulesActions([]dataprovider.EventRule{rule}, EventParams{Status: 1, updateStatusFromError: true})
} else {
- executeAsyncRulesActions([]dataprovider.EventRule{rule}, j.getEventParams())
+ executeAsyncRulesActions([]dataprovider.EventRule{rule}, EventParams{Status: 1, updateStatusFromError: true})
}
eventManagerLog(logger.LevelDebug, "execution for scheduled rule %q finished", j.ruleName)
}
diff --git a/internal/common/eventmanager_test.go b/internal/common/eventmanager_test.go
index d350421e..44f401d4 100644
--- a/internal/common/eventmanager_test.go
+++ b/internal/common/eventmanager_test.go
@@ -801,29 +801,14 @@ func TestEventManagerErrors(t *testing.T) {
}
func TestDateTimePlaceholder(t *testing.T) {
- oldTZ := Config.TZ
-
- Config.TZ = ""
dateTime := time.Now()
params := EventParams{
Timestamp: dateTime,
}
- replacements := params.getStringReplacements(false, 0)
+ replacements := params.getStringReplacements(false, false)
r := strings.NewReplacer(replacements...)
- res := r.Replace("{{.DateTime}}")
+ res := r.Replace("{{DateTime}}")
assert.Equal(t, dateTime.UTC().Format(dateTimeMillisFormat), res)
- res = r.Replace("{{.Year}}-{{.Month}}-{{.Day}}T{{.Hour}}:{{.Minute}}")
- assert.Equal(t, dateTime.UTC().Format(dateTimeMillisFormat)[:16], res)
-
- Config.TZ = "local"
- replacements = params.getStringReplacements(false, 0)
- r = strings.NewReplacer(replacements...)
- res = r.Replace("{{.DateTime}}")
- assert.Equal(t, dateTime.Local().Format(dateTimeMillisFormat), res)
- res = r.Replace("{{.Year}}-{{.Month}}-{{.Day}}T{{.Hour}}:{{.Minute}}")
- assert.Equal(t, dateTime.Local().Format(dateTimeMillisFormat)[:16], res)
-
- Config.TZ = oldTZ
}
func TestEventRuleActions(t *testing.T) {
@@ -845,7 +830,7 @@ func TestEventRuleActions(t *testing.T) {
HTTPConfig: dataprovider.EventActionHTTPConfig{
Endpoint: "http://foo\x7f.com/", // invalid URL
SkipTLSVerify: true,
- Body: `"data": "{{.ObjectDataString}}"`,
+ Body: `"data": "{{ObjectDataString}}"`,
Method: http.MethodPost,
QueryParameters: []dataprovider.KeyValue{
{
@@ -913,7 +898,7 @@ func TestEventRuleActions(t *testing.T) {
assert.Contains(t, getErrorString(err), "error getting user")
action.Options.HTTPConfig.Parts = nil
- action.Options.HTTPConfig.Body = "{{.ObjectData}}"
+ action.Options.HTTPConfig.Body = "{{ObjectData}}"
// test disk and transfer quota reset
username1 := "user1"
username2 := "user2"
@@ -1192,12 +1177,10 @@ func TestEventRuleActions(t *testing.T) {
action.Options = dataprovider.BaseEventActionOptions{
FsConfig: dataprovider.EventActionFilesystemConfig{
Type: dataprovider.FilesystemActionRename,
- Renames: []dataprovider.RenameConfig{
+ Renames: []dataprovider.KeyValue{
{
- KeyValue: dataprovider.KeyValue{
- Key: "/source",
- Value: "/target",
- },
+ Key: "/source",
+ Value: "/target",
},
},
},
@@ -1249,7 +1232,7 @@ func TestEventRuleActions(t *testing.T) {
Type: dataprovider.FilesystemActionCompress,
Compress: dataprovider.EventActionFsCompress{
Name: "test.zip",
- Paths: []string{"/{{.VirtualPath}}"},
+ Paths: []string{"/{{VirtualPath}}"},
},
},
}
@@ -1422,7 +1405,6 @@ func TestIDPAccountCheckRule(t *testing.T) {
// Update the profile attribute and make sure they are preserved
user.Password = "secret"
user.Email = "example@example.com"
- user.Filters.AdditionalEmails = []string{"alias@example.com"}
user.Description = "some desc"
user.Filters.TLSCerts = []string{serverCert}
user.PublicKeys = []string{"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC03jj0D+djk7pxIf/0OhrxrchJTRZklofJ1NoIu4752Sq02mdXmarMVsqJ1cAjV5LBVy3D1F5U6XW4rppkXeVtd04Pxb09ehtH0pRRPaoHHlALiJt8CoMpbKYMA8b3KXPPriGxgGomvtU2T2RMURSwOZbMtpsugfjYSWenyYX+VORYhylWnSXL961LTyC21ehd6d6QnW9G7E5hYMITMY9TuQZz3bROYzXiTsgN0+g6Hn7exFQp50p45StUMfV/SftCMdCxlxuyGny2CrN/vfjO7xxOo2uv7q1qm10Q46KPWJQv+pgZ/OfL+EDjy07n5QVSKHlbx+2nT4Q0EgOSQaCTYwn3YjtABfIxWwgAFdyj6YlPulCL22qU4MYhDcA6PSBwDdf8hvxBfvsiHdM+JcSHvv8/VeJhk6CmnZxGY0fxBupov27z3yEO8nAg8k+6PaUiW1MSUfuGMF/ktB8LOstXsEPXSszuyXiOv4DaryOXUiSn7bmRqKcEFlJusO6aZP0= nicola@p1"}
@@ -1437,7 +1419,6 @@ func TestIDPAccountCheckRule(t *testing.T) {
assert.Len(t, user.PublicKeys, 1)
assert.Len(t, user.Filters.TLSCerts, 1)
assert.NotEmpty(t, user.Email)
- assert.Len(t, user.Filters.AdditionalEmails, 1)
assert.NotEmpty(t, user.Description)
err = dataprovider.DeleteUser(username, "", "", "")
@@ -1739,12 +1720,10 @@ func TestFilesystemActionErrors(t *testing.T) {
assert.NoError(t, err)
err = dataprovider.AddUser(&user, "", "", "")
assert.NoError(t, err)
- err = executeRenameFsActionForUser([]dataprovider.RenameConfig{
+ err = executeRenameFsActionForUser([]dataprovider.KeyValue{
{
- KeyValue: dataprovider.KeyValue{
- Key: "/p1",
- Value: "/p1",
- },
+ Key: "/p1",
+ Value: "/p1",
},
}, testReplacer, user)
if assert.Error(t, err) {
@@ -1755,12 +1734,10 @@ func TestFilesystemActionErrors(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
FsConfig: dataprovider.EventActionFilesystemConfig{
Type: dataprovider.FilesystemActionRename,
- Renames: []dataprovider.RenameConfig{
+ Renames: []dataprovider.KeyValue{
{
- KeyValue: dataprovider.KeyValue{
- Key: "/p2",
- Value: "/p2",
- },
+ Key: "/p2",
+ Value: "/p2",
},
},
},
@@ -1846,7 +1823,7 @@ func TestFilesystemActionErrors(t *testing.T) {
Writer: zip.NewWriter(bytes.NewBuffer(nil)),
Entries: map[string]bool{},
}
- err = addZipEntry(wr, conn, "/adir/sub/f.dat", "/adir/sub/sub", nil, 0)
+ err = addZipEntry(wr, conn, "/adir/sub/f.dat", "/adir/sub/sub", 0)
assert.Error(t, err)
assert.Contains(t, getErrorString(err), "is outside base dir")
}
@@ -1856,7 +1833,7 @@ func TestFilesystemActionErrors(t *testing.T) {
Writer: zip.NewWriter(bytes.NewBuffer(nil)),
Entries: map[string]bool{},
}
- err = addZipEntry(wr, conn, "/p1", "/", nil, 2000)
+ err = addZipEntry(wr, conn, "/p1", "/", 2000)
assert.ErrorIs(t, err, util.ErrRecursionTooDeep)
err = dataprovider.DeleteUser(username, "", "", "")
@@ -1954,27 +1931,12 @@ func TestScheduledActions(t *testing.T) {
backupsPath := filepath.Join(os.TempDir(), "backups")
err := os.RemoveAll(backupsPath)
assert.NoError(t, err)
- now := time.Now().UTC().Format(dateTimeMillisFormat)
- // The backup action sets the home directory to the backup path.
- expectedDirPath := filepath.Join(backupsPath, fmt.Sprintf("%s_%s_%s", now[0:4], now[5:7], now[8:10]))
- action1 := &dataprovider.BaseEventAction{
- Name: "action1",
+ action := &dataprovider.BaseEventAction{
+ Name: "action",
Type: dataprovider.ActionTypeBackup,
}
- err = dataprovider.AddEventAction(action1, "", "", "")
- assert.NoError(t, err)
- action2 := &dataprovider.BaseEventAction{
- Name: "action2",
- Type: dataprovider.ActionTypeFilesystem,
- Options: dataprovider.BaseEventActionOptions{
- FsConfig: dataprovider.EventActionFilesystemConfig{
- Type: dataprovider.FilesystemActionMkdirs,
- MkDirs: []string{"{{.Year}}_{{.Month}}_{{.Day}}"},
- },
- },
- }
- err = dataprovider.AddEventAction(action2, "", "", "")
+ err = dataprovider.AddEventAction(action, "", "", "")
assert.NoError(t, err)
rule := &dataprovider.EventRule{
Name: "rule",
@@ -1993,16 +1955,10 @@ func TestScheduledActions(t *testing.T) {
Actions: []dataprovider.EventAction{
{
BaseEventAction: dataprovider.BaseEventAction{
- Name: action1.Name,
+ Name: action.Name,
},
Order: 1,
},
- {
- BaseEventAction: dataprovider.BaseEventAction{
- Name: action2.Name,
- },
- Order: 2,
- },
},
}
@@ -2017,10 +1973,9 @@ func TestScheduledActions(t *testing.T) {
job.Run()
assert.DirExists(t, backupsPath)
- assert.DirExists(t, expectedDirPath)
- action1.Type = dataprovider.ActionTypeEmail
- action1.Options = dataprovider.BaseEventActionOptions{
+ action.Type = dataprovider.ActionTypeEmail
+ action.Options = dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"example@example.com"},
Subject: "test with attachments",
@@ -2028,19 +1983,16 @@ func TestScheduledActions(t *testing.T) {
Attachments: []string{"/file1.txt"},
},
}
- err = dataprovider.UpdateEventAction(action1, "", "", "")
+ err = dataprovider.UpdateEventAction(action, "", "", "")
assert.NoError(t, err)
job.Run() // action is not compatible with a scheduled rule
err = dataprovider.DeleteEventRule(rule.Name, "", "", "")
assert.NoError(t, err)
- err = dataprovider.DeleteEventAction(action1.Name, "", "", "")
- assert.NoError(t, err)
- err = dataprovider.DeleteEventAction(action2.Name, "", "", "")
+ err = dataprovider.DeleteEventAction(action.Name, "", "", "")
assert.NoError(t, err)
err = os.RemoveAll(backupsPath)
assert.NoError(t, err)
-
stopEventScheduler()
}
@@ -2159,11 +2111,11 @@ func TestWriteHTTPPartsError(t *testing.T) {
}
func TestReplacePathsPlaceholders(t *testing.T) {
- replacer := strings.NewReplacer("{{.VirtualPath}}", "/path1")
- paths := []string{"{{.VirtualPath}}", "/path1"}
+ replacer := strings.NewReplacer("{{VirtualPath}}", "/path1")
+ paths := []string{"{{VirtualPath}}", "/path1"}
paths = replacePathsPlaceholders(paths, replacer)
assert.Equal(t, []string{"/path1"}, paths)
- paths = []string{"{{.VirtualPath}}", "/path2"}
+ paths = []string{"{{VirtualPath}}", "/path2"}
paths = replacePathsPlaceholders(paths, replacer)
assert.Equal(t, []string{"/path1", "/path2"}, paths)
}
@@ -2256,7 +2208,7 @@ func TestOnDemandRule(t *testing.T) {
Recipients: []string{"example@example.org"},
Subject: "subject",
Body: "body",
- Attachments: []string{"/{{.VirtualPath}}"},
+ Attachments: []string{"/{{VirtualPath}}"},
},
},
}
@@ -2297,21 +2249,21 @@ func getErrorString(err error) string {
func TestHTTPEndpointWithPlaceholders(t *testing.T) {
c := dataprovider.EventActionHTTPConfig{
- Endpoint: "http://127.0.0.1:8080/base/url/{{.Name}}/{{.VirtualPath}}/upload",
+ Endpoint: "http://127.0.0.1:8080/base/url/{{Name}}/{{VirtualPath}}/upload",
QueryParameters: []dataprovider.KeyValue{
{
Key: "u",
- Value: "{{.Name}}",
+ Value: "{{Name}}",
},
{
Key: "p",
- Value: "{{.VirtualPath}}",
+ Value: "{{VirtualPath}}",
},
},
}
name := "uname"
vPath := "/a dir/@ file.txt"
- replacer := strings.NewReplacer("{{.Name}}", name, "{{.VirtualPath}}", vPath)
+ replacer := strings.NewReplacer("{{Name}}", name, "{{VirtualPath}}", vPath)
u, err := getHTTPRuleActionEndpoint(&c, replacer)
assert.NoError(t, err)
expected := "http://127.0.0.1:8080/base/url/" + url.PathEscape(name) + "/" + url.PathEscape(vPath) +
@@ -2331,9 +2283,9 @@ func TestMetadataReplacement(t *testing.T) {
"key": "value",
},
}
- replacements := params.getStringReplacements(false, 0)
+ replacements := params.getStringReplacements(false, false)
replacer := strings.NewReplacer(replacements...)
- reader, _, err := getHTTPRuleActionBody(&dataprovider.EventActionHTTPConfig{Body: "{{.Metadata}} {{.MetadataString}}"}, replacer, nil, dataprovider.User{}, params, false)
+ reader, _, err := getHTTPRuleActionBody(&dataprovider.EventActionHTTPConfig{Body: "{{Metadata}} {{MetadataString}}"}, replacer, nil, dataprovider.User{}, params, false)
require.NoError(t, err)
data, err := io.ReadAll(reader)
require.NoError(t, err)
diff --git a/internal/common/eventscheduler.go b/internal/common/eventscheduler.go
index 762880f7..71315e81 100644
--- a/internal/common/eventscheduler.go
+++ b/internal/common/eventscheduler.go
@@ -19,8 +19,6 @@ import (
"github.com/robfig/cron/v3"
- "github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/logger"
"github.com/drakkan/sftpgo/v2/internal/util"
)
@@ -38,15 +36,7 @@ func stopEventScheduler() {
func startEventScheduler() {
stopEventScheduler()
- options := []cron.Option{
- cron.WithLogger(cron.DiscardLogger),
- }
- if !dataprovider.UseLocalTime() {
- eventManagerLog(logger.LevelDebug, "use UTC time for the scheduler")
- options = append(options, cron.WithLocation(time.UTC))
- }
-
- eventScheduler = cron.New(options...)
+ eventScheduler = cron.New(cron.WithLocation(time.UTC), cron.WithLogger(cron.DiscardLogger))
eventManager.loadRules()
_, err := eventScheduler.AddFunc("@every 10m", eventManager.loadRules)
util.PanicOnError(err)
diff --git a/internal/common/protocol_test.go b/internal/common/protocol_test.go
index 8147e246..7d9f13ff 100644
--- a/internal/common/protocol_test.go
+++ b/internal/common/protocol_test.go
@@ -1459,15 +1459,15 @@ func TestTruncateQuotaLimits(t *testing.T) {
expectedQuotaSize := int64(3)
fold, _, err := httpdtest.GetFolderByName(folder2.Name, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), fold.UsedQuotaSize)
- assert.Equal(t, 0, fold.UsedQuotaFiles)
+ assert.Equal(t, expectedQuotaSize, fold.UsedQuotaSize)
+ assert.Equal(t, expectedQuotaFiles, fold.UsedQuotaFiles)
err = f.Close()
assert.NoError(t, err)
expectedQuotaFiles = 1
fold, _, err = httpdtest.GetFolderByName(folder2.Name, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), fold.UsedQuotaSize)
- assert.Equal(t, 0, fold.UsedQuotaFiles)
+ assert.Equal(t, expectedQuotaSize, fold.UsedQuotaSize)
+ assert.Equal(t, expectedQuotaFiles, fold.UsedQuotaFiles)
user, _, err = httpdtest.GetUserByUsername(user.Username, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, expectedQuotaFiles, user.UsedQuotaFiles)
@@ -1779,8 +1779,8 @@ func TestVirtualFoldersQuotaValues(t *testing.T) {
assert.Equal(t, expectedQuotaSize, user.UsedQuotaSize)
f, _, err := httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize, f.UsedQuotaSize)
@@ -1887,8 +1887,8 @@ func TestQuotaRenameInsideSameVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize+testFileSize1, user.UsedQuotaSize)
f, _, err := httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize+testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 2, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize+testFileSize1, f.UsedQuotaSize)
@@ -1912,8 +1912,8 @@ func TestQuotaRenameInsideSameVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize+testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize+testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 2, f.UsedQuotaFiles)
// rename a file inside vdir2, it isn't included inside user quota, so we have:
// - vdir1/dir1/testFileName.rename
// - vdir1/dir2/testFileName1
@@ -1931,8 +1931,8 @@ func TestQuotaRenameInsideSameVirtualFolder(t *testing.T) {
assert.Equal(t, 2, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize+testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 2, f.UsedQuotaFiles)
// rename a file inside vdir2 overwriting an existing, we now have:
// - vdir1/dir1/testFileName.rename
// - vdir1/dir2/testFileName1
@@ -1949,8 +1949,8 @@ func TestQuotaRenameInsideSameVirtualFolder(t *testing.T) {
assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize+testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 2, f.UsedQuotaFiles)
// rename a file inside vdir1 overwriting an existing, we now have:
// - vdir1/dir1/testFileName.rename (initial testFileName1)
// - vdir2/dir1/testFileName.rename (initial testFileName1)
@@ -1962,8 +1962,8 @@ func TestQuotaRenameInsideSameVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize1, f.UsedQuotaSize)
@@ -1983,8 +1983,8 @@ func TestQuotaRenameInsideSameVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize1, f.UsedQuotaSize)
@@ -2089,8 +2089,8 @@ func TestQuotaRenameBetweenVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize, user.UsedQuotaSize)
f, _, err := httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize+testFileSize1+testFileSize1, f.UsedQuotaSize)
@@ -2108,8 +2108,8 @@ func TestQuotaRenameBetweenVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize*2, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize*2, f.UsedQuotaSize)
+ assert.Equal(t, 2, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize1*2, f.UsedQuotaSize)
@@ -2126,8 +2126,8 @@ func TestQuotaRenameBetweenVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize1+testFileSize, f.UsedQuotaSize)
@@ -2143,8 +2143,8 @@ func TestQuotaRenameBetweenVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize, f.UsedQuotaSize)
@@ -2174,8 +2174,8 @@ func TestQuotaRenameBetweenVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize1*3+testFileSize*2, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize1*3+testFileSize*2, f.UsedQuotaSize)
+ assert.Equal(t, 5, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, int64(0), f.UsedQuotaSize)
@@ -2189,8 +2189,8 @@ func TestQuotaRenameBetweenVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize1*2+testFileSize, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize1*2+testFileSize, f.UsedQuotaSize)
+ assert.Equal(t, 3, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize+testFileSize1, f.UsedQuotaSize)
@@ -2295,8 +2295,8 @@ func TestQuotaRenameFromVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize+testFileSize1, user.UsedQuotaSize)
f, _, err := httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize+testFileSize1, f.UsedQuotaSize)
@@ -2314,8 +2314,8 @@ func TestQuotaRenameFromVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize+testFileSize1+testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize, f.UsedQuotaSize)
@@ -2378,8 +2378,8 @@ func TestQuotaRenameFromVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize*3+testFileSize1*3, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize+testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 2, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, int64(0), f.UsedQuotaSize)
@@ -2499,8 +2499,8 @@ func TestQuotaRenameToVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize+testFileSize1, user.UsedQuotaSize)
f, _, err := httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
// rename a file from user home dir to vdir2, vdir2 is not included in user quota so we have:
// - /vdir2/dir1/testFileName
// - /vdir1/dir1/testFileName1
@@ -2539,8 +2539,8 @@ func TestQuotaRenameToVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize+testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize, f.UsedQuotaSize)
@@ -2556,8 +2556,8 @@ func TestQuotaRenameToVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize1, f.UsedQuotaSize)
@@ -2579,8 +2579,8 @@ func TestQuotaRenameToVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize*2+testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize1, f.UsedQuotaSize)
@@ -2597,8 +2597,8 @@ func TestQuotaRenameToVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize*2+testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize*2+testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 3, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize1, f.UsedQuotaSize)
@@ -2623,8 +2623,8 @@ func TestQuotaRenameToVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize*2+testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize*2+testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 3, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize1*2+testFileSize, f.UsedQuotaSize)
@@ -3784,8 +3784,8 @@ func TestEventRule(t *testing.T) {
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"test1@example.com", "test2@example.com"},
Bcc: []string{"test3@example.com"},
- Subject: `New "{{.Event}}" from "{{.Name}}" status {{.StatusString}}`,
- Body: "Fs path {{.FsPath}}, size: {{.FileSize}}, protocol: {{.Protocol}}, IP: {{.IP}} Data: {{.ObjectData}} {{.ErrorString}}",
+ Subject: `New "{{Event}}" from "{{Name}}" status {{StatusString}}`,
+ Body: "Fs path {{FsPath}}, size: {{FileSize}}, protocol: {{Protocol}}, IP: {{IP}} Data: {{ObjectData}} {{ErrorString}}",
},
},
}
@@ -3795,8 +3795,8 @@ func TestEventRule(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"failure@example.com"},
- Subject: `Failed "{{.Event}}" from "{{.Name}}"`,
- Body: "Fs path {{.FsPath}}, protocol: {{.Protocol}}, IP: {{.IP}} {{.ErrorString}}",
+ Subject: `Failed "{{Event}}" from "{{Name}}"`,
+ Body: "Fs path {{FsPath}}, protocol: {{Protocol}}, IP: {{IP}} {{ErrorString}}",
},
},
}
@@ -3941,7 +3941,7 @@ func TestEventRule(t *testing.T) {
EnvVars: []dataprovider.KeyValue{
{
Key: "SFTPGO_ACTION_PATH",
- Value: "{{.FsPath}}",
+ Value: "{{FsPath}}",
},
{
Key: "CUSTOM_ENV_VAR",
@@ -3986,9 +3986,9 @@ func TestEventRule(t *testing.T) {
}, 3000*time.Millisecond, 100*time.Millisecond)
email := lastReceivedEmail.get()
assert.Len(t, email.To, 3)
- assert.True(t, slices.Contains(email.To, "test1@example.com"))
- assert.True(t, slices.Contains(email.To, "test2@example.com"))
- assert.True(t, slices.Contains(email.To, "test3@example.com"))
+ assert.True(t, util.Contains(email.To, "test1@example.com"))
+ assert.True(t, util.Contains(email.To, "test2@example.com"))
+ assert.True(t, util.Contains(email.To, "test3@example.com"))
assert.Contains(t, email.Data, fmt.Sprintf(`Subject: New "upload" from "%s" status OK`, user.Username))
// test the failure action, we download a file that exceeds the transfer quota limit
err = writeSFTPFileNoCheck(path.Join("subdir1", testFileName), 1*1024*1024+65535, client)
@@ -4007,9 +4007,9 @@ func TestEventRule(t *testing.T) {
}, 3000*time.Millisecond, 100*time.Millisecond)
email = lastReceivedEmail.get()
assert.Len(t, email.To, 3)
- assert.True(t, slices.Contains(email.To, "test1@example.com"))
- assert.True(t, slices.Contains(email.To, "test2@example.com"))
- assert.True(t, slices.Contains(email.To, "test3@example.com"))
+ assert.True(t, util.Contains(email.To, "test1@example.com"))
+ assert.True(t, util.Contains(email.To, "test2@example.com"))
+ assert.True(t, util.Contains(email.To, "test3@example.com"))
assert.Contains(t, email.Data, fmt.Sprintf(`Subject: New "download" from "%s" status KO`, user.Username))
assert.Contains(t, email.Data, `"download" failed`)
assert.Contains(t, email.Data, common.ErrReadQuotaExceeded.Error())
@@ -4027,7 +4027,7 @@ func TestEventRule(t *testing.T) {
}, 3000*time.Millisecond, 100*time.Millisecond)
email = lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, "failure@example.com"))
+ assert.True(t, util.Contains(email.To, "failure@example.com"))
assert.Contains(t, email.Data, fmt.Sprintf(`Subject: Failed "upload" from "%s"`, user.Username))
assert.Contains(t, email.Data, fmt.Sprintf(`action %q failed`, action1.Name))
// now test the download rule
@@ -4044,13 +4044,13 @@ func TestEventRule(t *testing.T) {
}, 3000*time.Millisecond, 100*time.Millisecond)
email = lastReceivedEmail.get()
assert.Len(t, email.To, 3)
- assert.True(t, slices.Contains(email.To, "test1@example.com"))
- assert.True(t, slices.Contains(email.To, "test2@example.com"))
- assert.True(t, slices.Contains(email.To, "test3@example.com"))
+ assert.True(t, util.Contains(email.To, "test1@example.com"))
+ assert.True(t, util.Contains(email.To, "test2@example.com"))
+ assert.True(t, util.Contains(email.To, "test3@example.com"))
assert.Contains(t, email.Data, fmt.Sprintf(`Subject: New "download" from "%s"`, user.Username))
}
// test upload action command with arguments
- action1.Options.CmdConfig.Args = []string{"{{.Event}}", "{{.VirtualPath}}", "custom_arg"}
+ action1.Options.CmdConfig.Args = []string{"{{Event}}", "{{VirtualPath}}", "custom_arg"}
action1, _, err = httpdtest.UpdateEventAction(action1, http.StatusOK)
assert.NoError(t, err)
uploadLogFilePath := filepath.Join(os.TempDir(), "upload.log")
@@ -4087,9 +4087,9 @@ func TestEventRule(t *testing.T) {
}, 3000*time.Millisecond, 100*time.Millisecond)
email := lastReceivedEmail.get()
assert.Len(t, email.To, 3)
- assert.True(t, slices.Contains(email.To, "test1@example.com"))
- assert.True(t, slices.Contains(email.To, "test2@example.com"))
- assert.True(t, slices.Contains(email.To, "test3@example.com"))
+ assert.True(t, util.Contains(email.To, "test1@example.com"))
+ assert.True(t, util.Contains(email.To, "test2@example.com"))
+ assert.True(t, util.Contains(email.To, "test3@example.com"))
assert.Contains(t, email.Data, `Subject: New "delete" from "admin"`)
_, err = httpdtest.RemoveEventRule(rule3, http.StatusOK)
assert.NoError(t, err)
@@ -4128,8 +4128,8 @@ func TestEventRuleStatues(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"test6@example.com"},
- Subject: `New "{{.Event}}" error`,
- Body: "{{.ErrorString}}",
+ Subject: `New "{{Event}}" error`,
+ Body: "{{ErrorString}}",
},
},
}
@@ -4241,7 +4241,7 @@ func TestEventRuleDisabledCommand(t *testing.T) {
EnvVars: []dataprovider.KeyValue{
{
Key: "SFTPGO_OBJECT_DATA",
- Value: "{{.ObjectData}}",
+ Value: "{{ObjectData}}",
},
},
},
@@ -4253,8 +4253,8 @@ func TestEventRuleDisabledCommand(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"test3@example.com"},
- Subject: `New "{{.Event}}" from "{{.Name}}"`,
- Body: "Object name: {{.ObjectName}} object type: {{.ObjectType}} Data: {{.ObjectData}}",
+ Subject: `New "{{Event}}" from "{{Name}}"`,
+ Body: "Object name: {{ObjectName}} object type: {{ObjectType}} Data: {{ObjectData}}",
},
},
}
@@ -4265,8 +4265,8 @@ func TestEventRuleDisabledCommand(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"failure@example.com"},
- Subject: `Failed "{{.Event}}" from "{{.Name}}"`,
- Body: "Object name: {{.ObjectName}} object type: {{.ObjectType}}, IP: {{.IP}}",
+ Subject: `Failed "{{Event}}" from "{{Name}}"`,
+ Body: "Object name: {{ObjectName}} object type: {{ObjectType}}, IP: {{IP}}",
},
},
}
@@ -4390,7 +4390,7 @@ func TestEventRuleProviderEvents(t *testing.T) {
EnvVars: []dataprovider.KeyValue{
{
Key: "SFTPGO_OBJECT_DATA",
- Value: "{{.ObjectData}}",
+ Value: "{{ObjectData}}",
},
},
},
@@ -4402,8 +4402,8 @@ func TestEventRuleProviderEvents(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"test3@example.com"},
- Subject: `New "{{.Event}}" from "{{.Name}}"`,
- Body: "Object name: {{.ObjectName}} object type: {{.ObjectType}} Data: {{.ObjectData}}",
+ Subject: `New "{{Event}}" from "{{Name}}"`,
+ Body: "Object name: {{ObjectName}} object type: {{ObjectType}} Data: {{ObjectData}}",
},
},
}
@@ -4414,8 +4414,8 @@ func TestEventRuleProviderEvents(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"failure@example.com"},
- Subject: `Failed "{{.Event}}" from "{{.Name}}"`,
- Body: "Object name: {{.ObjectName}} object type: {{.ObjectType}}, IP: {{.IP}}",
+ Subject: `Failed "{{Event}}" from "{{Name}}"`,
+ Body: "Object name: {{ObjectName}} object type: {{ObjectType}}, IP: {{IP}}",
},
},
}
@@ -4494,7 +4494,7 @@ func TestEventRuleProviderEvents(t *testing.T) {
}, 3000*time.Millisecond, 100*time.Millisecond)
email := lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, "test3@example.com"))
+ assert.True(t, util.Contains(email.To, "test3@example.com"))
assert.Contains(t, email.Data, `Subject: New "update" from "admin"`)
}
// now delete the script to generate an error
@@ -4509,7 +4509,7 @@ func TestEventRuleProviderEvents(t *testing.T) {
}, 3000*time.Millisecond, 100*time.Millisecond)
email := lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, "failure@example.com"))
+ assert.True(t, util.Contains(email.To, "failure@example.com"))
assert.Contains(t, email.Data, `Subject: Failed "update" from "admin"`)
assert.Contains(t, email.Data, fmt.Sprintf("Object name: %s object type: folder", folder.Name))
lastReceivedEmail.reset()
@@ -4558,12 +4558,10 @@ func TestEventRuleFsActions(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
FsConfig: dataprovider.EventActionFilesystemConfig{
Type: dataprovider.FilesystemActionRename,
- Renames: []dataprovider.RenameConfig{
+ Renames: []dataprovider.KeyValue{
{
- KeyValue: dataprovider.KeyValue{
- Key: "/{{.VirtualDirPath}}/{{.ObjectName}}",
- Value: "/{{.ObjectName}}_renamed",
- },
+ Key: "/{{VirtualDirPath}}/{{ObjectName}}",
+ Value: "/{{ObjectName}}_renamed",
},
},
},
@@ -4575,7 +4573,7 @@ func TestEventRuleFsActions(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
FsConfig: dataprovider.EventActionFilesystemConfig{
Type: dataprovider.FilesystemActionDelete,
- Deletes: []string{"/{{.ObjectName}}_renamed"},
+ Deletes: []string{"/{{ObjectName}}_renamed"},
},
},
}
@@ -4593,7 +4591,7 @@ func TestEventRuleFsActions(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
FsConfig: dataprovider.EventActionFilesystemConfig{
Type: dataprovider.FilesystemActionExist,
- Exist: []string{"/{{.VirtualPath}}"},
+ Exist: []string{"/{{VirtualPath}}"},
},
},
}
@@ -4821,80 +4819,6 @@ func TestEventRuleFsActions(t *testing.T) {
assert.NoError(t, err)
}
-func TestEventActionObjectBaseName(t *testing.T) {
- a1 := dataprovider.BaseEventAction{
- Name: "a1",
- Type: dataprovider.ActionTypeFilesystem,
- Options: dataprovider.BaseEventActionOptions{
- FsConfig: dataprovider.EventActionFilesystemConfig{
- Type: dataprovider.FilesystemActionRename,
- Renames: []dataprovider.RenameConfig{
- {
- KeyValue: dataprovider.KeyValue{
- Key: "/{{.VirtualDirPath}}/{{.ObjectName}}",
- Value: "/{{.ObjectBaseName}}",
- },
- },
- },
- },
- },
- }
- action1, resp, err := httpdtest.AddEventAction(a1, http.StatusCreated)
- assert.NoError(t, err, string(resp))
-
- r1 := dataprovider.EventRule{
- Name: "r2",
- Status: 1,
- Trigger: dataprovider.EventTriggerFsEvent,
- Conditions: dataprovider.EventConditions{
- FsEvents: []string{"upload"},
- },
- Actions: []dataprovider.EventAction{
- {
- BaseEventAction: dataprovider.BaseEventAction{
- Name: action1.Name,
- },
- Order: 1,
- Options: dataprovider.EventActionOptions{
- ExecuteSync: true,
- },
- },
- },
- }
- rule1, _, err := httpdtest.AddEventRule(r1, http.StatusCreated)
- assert.NoError(t, err)
-
- user, _, err := httpdtest.AddUser(getTestUser(), http.StatusCreated)
- assert.NoError(t, err)
- conn, client, err := getSftpClient(user)
- if assert.NoError(t, err) {
- defer conn.Close()
- defer client.Close()
-
- testDir := "test dir name"
- err = client.Mkdir(testDir)
- fileSize := int64(32768)
- assert.NoError(t, err)
- err = writeSFTPFileNoCheck(path.Join(testDir, testFileName), fileSize, client)
- assert.NoError(t, err)
-
- _, err = client.Stat(path.Join(testDir, testFileName))
- assert.ErrorIs(t, err, os.ErrNotExist)
-
- _, err = client.Stat(strings.TrimSuffix(testFileName, path.Ext(testFileName)))
- assert.NoError(t, err)
- }
-
- _, err = httpdtest.RemoveUser(user, http.StatusOK)
- assert.NoError(t, err)
- err = os.RemoveAll(user.GetHomeDir())
- assert.NoError(t, err)
- _, err = httpdtest.RemoveEventRule(rule1, http.StatusOK)
- assert.NoError(t, err)
- _, err = httpdtest.RemoveEventAction(action1, http.StatusOK)
- assert.NoError(t, err)
-}
-
func TestUploadEventRule(t *testing.T) {
smtpCfg := smtp.Config{
Host: "127.0.0.1",
@@ -4911,8 +4835,8 @@ func TestUploadEventRule(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"test1@example.com"},
- Subject: `New "{{.Event}}" from "{{.Name}}" status {{.StatusString}}`,
- Body: "Fs path {{.FsPath}}, size: {{.FileSize}}, protocol: {{.Protocol}}, IP: {{.IP}} Data: {{.ObjectData}} {{.ErrorString}}",
+ Subject: `New "{{Event}}" from "{{Name}}" status {{StatusString}}`,
+ Body: "Fs path {{FsPath}}, size: {{FileSize}}, protocol: {{Protocol}}, IP: {{IP}} Data: {{ObjectData}} {{ErrorString}}",
},
},
}
@@ -5044,13 +4968,10 @@ func TestEventRulePreDelete(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
FsConfig: dataprovider.EventActionFilesystemConfig{
Type: dataprovider.FilesystemActionRename,
- Renames: []dataprovider.RenameConfig{
+ Renames: []dataprovider.KeyValue{
{
- KeyValue: dataprovider.KeyValue{
- Key: "/{{.VirtualPath}}",
- Value: fmt.Sprintf("/%s/{{.VirtualPath}}", movePath),
- },
- UpdateModTime: true,
+ Key: "/{{VirtualPath}}",
+ Value: fmt.Sprintf("/%s/{{VirtualPath}}", movePath),
},
},
},
@@ -5104,83 +5025,59 @@ func TestEventRulePreDelete(t *testing.T) {
QuotaFiles: 1000,
},
}
- localUser, _, err := httpdtest.AddUser(u, http.StatusCreated)
- assert.NoError(t, err)
- u = getTestSFTPUser()
- u.QuotaFiles = 1000
- sftpUser, _, err := httpdtest.AddUser(u, http.StatusCreated)
+ user, _, err := httpdtest.AddUser(u, http.StatusCreated)
assert.NoError(t, err)
+ conn, client, err := getSftpClient(user)
+ if assert.NoError(t, err) {
+ defer conn.Close()
+ defer client.Close()
- for _, user := range []dataprovider.User{localUser, sftpUser} {
- conn, client, err := getSftpClient(user)
- if assert.NoError(t, err) {
- defer conn.Close()
- defer client.Close()
-
- testDir := "sub dir"
- err = client.MkdirAll(testDir)
- assert.NoError(t, err)
- err = writeSFTPFile(testFileName, 100, client)
- assert.NoError(t, err)
- err = writeSFTPFile(path.Join(testDir, testFileName), 100, client)
- assert.NoError(t, err)
- modTime := time.Now().Add(-36 * time.Hour)
- err = client.Chtimes(testFileName, modTime, modTime)
- assert.NoError(t, err)
- err = client.Remove(testFileName)
- assert.NoError(t, err)
- err = client.Remove(path.Join(testDir, testFileName))
- assert.NoError(t, err)
- // check files
- _, err = client.Stat(testFileName)
- assert.ErrorIs(t, err, os.ErrNotExist)
- _, err = client.Stat(path.Join(testDir, testFileName))
- assert.ErrorIs(t, err, os.ErrNotExist)
- info, err := client.Stat(path.Join("/", movePath, testFileName))
- assert.NoError(t, err)
- diff := math.Abs(time.Until(info.ModTime()).Seconds())
- assert.LessOrEqual(t, diff, float64(2))
-
- _, err = client.Stat(path.Join("/", movePath, testDir, testFileName))
- assert.NoError(t, err)
- // check quota
- user, _, err = httpdtest.GetUserByUsername(user.Username, http.StatusOK)
- assert.NoError(t, err)
- if user.Username == localUser.Username {
- assert.Equal(t, 0, user.UsedQuotaFiles)
- assert.Equal(t, int64(0), user.UsedQuotaSize)
- folder, _, err := httpdtest.GetFolderByName(movePath, http.StatusOK)
- assert.NoError(t, err)
- assert.Equal(t, 2, folder.UsedQuotaFiles)
- assert.Equal(t, int64(200), folder.UsedQuotaSize)
- } else {
- assert.Equal(t, 1, user.UsedQuotaFiles)
- assert.Equal(t, int64(100), user.UsedQuotaSize)
- }
- // pre-delete action is not executed in movePath
- err = client.Remove(path.Join("/", movePath, testFileName))
- assert.NoError(t, err)
- if user.Username == localUser.Username {
- // check quota
- folder, _, err := httpdtest.GetFolderByName(movePath, http.StatusOK)
- assert.NoError(t, err)
- assert.Equal(t, 1, folder.UsedQuotaFiles)
- assert.Equal(t, int64(100), folder.UsedQuotaSize)
- err = os.RemoveAll(user.GetHomeDir())
- assert.NoError(t, err)
- }
- }
+ testDir := "sub dir"
+ err = client.MkdirAll(testDir)
+ assert.NoError(t, err)
+ err = writeSFTPFile(testFileName, 100, client)
+ assert.NoError(t, err)
+ err = writeSFTPFile(path.Join(testDir, testFileName), 100, client)
+ assert.NoError(t, err)
+ err = client.Remove(testFileName)
+ assert.NoError(t, err)
+ err = client.Remove(path.Join(testDir, testFileName))
+ assert.NoError(t, err)
+ // check files
+ _, err = client.Stat(testFileName)
+ assert.ErrorIs(t, err, os.ErrNotExist)
+ _, err = client.Stat(path.Join(testDir, testFileName))
+ assert.ErrorIs(t, err, os.ErrNotExist)
+ _, err = client.Stat(path.Join("/", movePath, testFileName))
+ assert.NoError(t, err)
+ _, err = client.Stat(path.Join("/", movePath, testDir, testFileName))
+ assert.NoError(t, err)
+ // check quota
+ user, _, err = httpdtest.GetUserByUsername(user.Username, http.StatusOK)
+ assert.NoError(t, err)
+ assert.Equal(t, 0, user.UsedQuotaFiles)
+ assert.Equal(t, int64(0), user.UsedQuotaSize)
+ folder, _, err := httpdtest.GetFolderByName(movePath, http.StatusOK)
+ assert.NoError(t, err)
+ assert.Equal(t, 2, folder.UsedQuotaFiles)
+ assert.Equal(t, int64(200), folder.UsedQuotaSize)
+ // pre-delete action is not executed in movePath
+ err = client.Remove(path.Join("/", movePath, testFileName))
+ assert.NoError(t, err)
+ // check quota
+ folder, _, err = httpdtest.GetFolderByName(movePath, http.StatusOK)
+ assert.NoError(t, err)
+ assert.Equal(t, 1, folder.UsedQuotaFiles)
+ assert.Equal(t, int64(100), folder.UsedQuotaSize)
}
_, err = httpdtest.RemoveEventRule(rule1, http.StatusOK)
assert.NoError(t, err)
_, err = httpdtest.RemoveEventAction(action1, http.StatusOK)
assert.NoError(t, err)
- _, err = httpdtest.RemoveUser(sftpUser, http.StatusOK)
+ _, err = httpdtest.RemoveUser(user, http.StatusOK)
assert.NoError(t, err)
- _, err = httpdtest.RemoveUser(localUser, http.StatusOK)
- assert.NoError(t, err)
- err = os.RemoveAll(localUser.GetHomeDir())
+ err = os.RemoveAll(user.GetHomeDir())
assert.NoError(t, err)
_, err = httpdtest.RemoveFolder(vfs.BaseVirtualFolder{Name: movePath}, http.StatusOK)
assert.NoError(t, err)
@@ -5208,12 +5105,10 @@ func TestEventRulePreDownloadUpload(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
FsConfig: dataprovider.EventActionFilesystemConfig{
Type: dataprovider.FilesystemActionRename,
- Renames: []dataprovider.RenameConfig{
+ Renames: []dataprovider.KeyValue{
{
- KeyValue: dataprovider.KeyValue{
- Key: "/missing source",
- Value: "/missing target",
- },
+ Key: "/missing source",
+ Value: "/missing target",
},
},
},
@@ -5402,7 +5297,6 @@ func TestEventActionCommandEnvVars(t *testing.T) {
}
func TestFsActionCopy(t *testing.T) {
- dirCopy := "/dircopy"
a1 := dataprovider.BaseEventAction{
Name: "a1",
Type: dataprovider.ActionTypeFilesystem,
@@ -5411,8 +5305,8 @@ func TestFsActionCopy(t *testing.T) {
Type: dataprovider.FilesystemActionCopy,
Copy: []dataprovider.KeyValue{
{
- Key: "/{{.VirtualPath}}/",
- Value: dirCopy + "/",
+ Key: "/{{VirtualPath}}/",
+ Value: "/dircopy/",
},
},
},
@@ -5442,29 +5336,7 @@ func TestFsActionCopy(t *testing.T) {
}
rule1, _, err := httpdtest.AddEventRule(r1, http.StatusCreated)
assert.NoError(t, err)
- g1 := dataprovider.Group{
- BaseGroup: sdk.BaseGroup{
- Name: "group1",
- },
- UserSettings: dataprovider.GroupUserSettings{
- BaseGroupUserSettings: sdk.BaseGroupUserSettings{
- Permissions: map[string][]string{
- // Restrict permissions in copyPath to check that action
- // will have full permissions anyway.
- dirCopy: {dataprovider.PermListItems, dataprovider.PermDelete},
- },
- },
- },
- }
- group1, resp, err := httpdtest.AddGroup(g1, http.StatusCreated)
- assert.NoError(t, err, string(resp))
u := getTestUser()
- u.Groups = []sdk.GroupMapping{
- {
- Name: group1.Name,
- Type: sdk.GroupTypePrimary,
- },
- }
user, _, err := httpdtest.AddUser(u, http.StatusCreated)
assert.NoError(t, err)
conn, client, err := getSftpClient(user)
@@ -5474,7 +5346,7 @@ func TestFsActionCopy(t *testing.T) {
err = writeSFTPFile(testFileName, 100, client)
assert.NoError(t, err)
- _, err = client.Stat(path.Join(dirCopy, testFileName))
+ _, err = client.Stat(path.Join("dircopy", testFileName))
assert.NoError(t, err)
action1.Options.FsConfig.Copy = []dataprovider.KeyValue{
@@ -5497,8 +5369,6 @@ func TestFsActionCopy(t *testing.T) {
assert.NoError(t, err)
err = os.RemoveAll(user.GetHomeDir())
assert.NoError(t, err)
- _, err = httpdtest.RemoveGroup(group1, http.StatusOK)
- assert.NoError(t, err)
}
func TestEventFsActionsGroupFilters(t *testing.T) {
@@ -5517,8 +5387,8 @@ func TestEventFsActionsGroupFilters(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"example@example.net"},
- Subject: `New "{{.Event}}" from "{{.Name}}" status {{.StatusString}}`,
- Body: "Fs path {{.FsPath}}, size: {{.FileSize}}, protocol: {{.Protocol}}, IP: {{.IP}} {{.ErrorString}}",
+ Subject: `New "{{Event}}" from "{{Name}}" status {{StatusString}}`,
+ Body: "Fs path {{FsPath}}, size: {{FileSize}}, protocol: {{Protocol}}, IP: {{IP}} {{ErrorString}}",
},
},
}
@@ -5648,8 +5518,8 @@ func TestEventProviderActionGroupFilters(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"example@example.net"},
- Subject: `New "{{.Event}}" from "{{.Name}}"`,
- Body: "IP: {{.IP}}",
+ Subject: `New "{{Event}}" from "{{Name}}"`,
+ Body: "IP: {{IP}}",
},
},
}
@@ -5775,7 +5645,7 @@ func TestBackupAsAttachment(t *testing.T) {
require.NoError(t, err)
a1 := dataprovider.BaseEventAction{
- Name: "a1 with space",
+ Name: "a1",
Type: dataprovider.ActionTypeBackup,
}
a2 := dataprovider.BaseEventAction{
@@ -5784,9 +5654,9 @@ func TestBackupAsAttachment(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"test@example.com"},
- Subject: `"{{.Event}} {{.StatusString}}"`,
- Body: "Domain: {{.Name}}",
- Attachments: []string{"/{{.VirtualPath}}"},
+ Subject: `"{{Event}} {{StatusString}}"`,
+ Body: "Domain: {{Name}}",
+ Attachments: []string{"/{{VirtualPath}}"},
},
},
}
@@ -5831,7 +5701,7 @@ func TestBackupAsAttachment(t *testing.T) {
}, 3000*time.Millisecond, 100*time.Millisecond)
email := lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, "test@example.com"))
+ assert.True(t, util.Contains(email.To, "test@example.com"))
assert.Contains(t, email.Data, fmt.Sprintf(`Subject: "%s OK"`, renewalEvent))
assert.Contains(t, email.Data, `Domain: example.com`)
assert.Contains(t, email.Data, "Content-Type: application/json")
@@ -5865,11 +5735,11 @@ func TestEventActionHTTPMultipart(t *testing.T) {
Value: "application/json",
},
},
- Body: `{"FilePath": "{{.VirtualPath}}"}`,
+ Body: `{"FilePath": "{{VirtualPath}}"}`,
},
{
Name: "file",
- Filepath: "/{{.VirtualPath}}",
+ Filepath: "/{{VirtualPath}}",
},
},
},
@@ -5945,8 +5815,8 @@ func TestEventActionCompress(t *testing.T) {
FsConfig: dataprovider.EventActionFilesystemConfig{
Type: dataprovider.FilesystemActionCompress,
Compress: dataprovider.EventActionFsCompress{
- Name: "/{{.VirtualPath}}.zip",
- Paths: []string{"/{{.VirtualPath}}"},
+ Name: "/{{VirtualPath}}.zip",
+ Paths: []string{"/{{VirtualPath}}"},
},
},
},
@@ -6116,7 +5986,7 @@ func TestEventActionCompressQuotaErrors(t *testing.T) {
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"test@example.com"},
Subject: `"Compress failed"`,
- Body: "Error: {{.ErrorString}}",
+ Body: "Error: {{ErrorString}}",
},
},
}
@@ -6201,7 +6071,7 @@ func TestEventActionCompressQuotaErrors(t *testing.T) {
}, 3*time.Second, 100*time.Millisecond)
email := lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, "test@example.com"))
+ assert.True(t, util.Contains(email.To, "test@example.com"))
assert.Contains(t, email.Data, `Subject: "Compress failed"`)
assert.Contains(t, email.Data, common.ErrQuotaExceeded.Error())
// update quota size so the user is already overquota
@@ -6216,7 +6086,7 @@ func TestEventActionCompressQuotaErrors(t *testing.T) {
}, 3*time.Second, 100*time.Millisecond)
email = lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, "test@example.com"))
+ assert.True(t, util.Contains(email.To, "test@example.com"))
assert.Contains(t, email.Data, `Subject: "Compress failed"`)
assert.Contains(t, email.Data, common.ErrQuotaExceeded.Error())
// remove the path to compress to trigger an error for size estimation
@@ -6230,7 +6100,7 @@ func TestEventActionCompressQuotaErrors(t *testing.T) {
}, 3*time.Second, 100*time.Millisecond)
email = lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, "test@example.com"))
+ assert.True(t, util.Contains(email.To, "test@example.com"))
assert.Contains(t, email.Data, `Subject: "Compress failed"`)
assert.Contains(t, email.Data, "unable to estimate archive size")
}
@@ -6260,8 +6130,8 @@ func TestEventActionCompressQuotaFolder(t *testing.T) {
FsConfig: dataprovider.EventActionFilesystemConfig{
Type: dataprovider.FilesystemActionCompress,
Compress: dataprovider.EventActionFsCompress{
- Name: "/{{.VirtualPath}}.zip",
- Paths: []string{"/{{.VirtualPath}}", testDir},
+ Name: "/{{VirtualPath}}.zip",
+ Paths: []string{"/{{VirtualPath}}", testDir},
},
},
},
@@ -6359,8 +6229,8 @@ func TestEventActionCompressQuotaFolder(t *testing.T) {
assert.Equal(t, expectedQuotaSize, user.UsedQuotaSize)
vfolder, _, err := httpdtest.GetFolderByName(folderName, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, 0, vfolder.UsedQuotaFiles)
- assert.Equal(t, int64(0), vfolder.UsedQuotaSize)
+ assert.Equal(t, 2, vfolder.UsedQuotaFiles)
+ assert.Equal(t, info.Size()+int64(len(testFileContent)), vfolder.UsedQuotaSize)
}
}
@@ -6386,8 +6256,8 @@ func TestEventActionCompressErrors(t *testing.T) {
FsConfig: dataprovider.EventActionFilesystemConfig{
Type: dataprovider.FilesystemActionCompress,
Compress: dataprovider.EventActionFsCompress{
- Name: "/{{.VirtualPath}}.zip",
- Paths: []string{"/{{.VirtualPath}}.zip"}, // cannot compress itself
+ Name: "/{{VirtualPath}}.zip",
+ Paths: []string{"/{{VirtualPath}}.zip"}, // cannot compress itself
},
},
},
@@ -6449,7 +6319,7 @@ func TestEventActionCompressErrors(t *testing.T) {
// try to overwrite a directory
testDir := "/adir"
action1.Options.FsConfig.Compress.Name = testDir
- action1.Options.FsConfig.Compress.Paths = []string{"/{{.VirtualPath}}"}
+ action1.Options.FsConfig.Compress.Paths = []string{"/{{VirtualPath}}"}
_, _, err = httpdtest.UpdateEventAction(action1, http.StatusOK)
assert.NoError(t, err)
conn, client, err = getSftpClient(user)
@@ -6494,8 +6364,8 @@ func TestEventActionEmailAttachments(t *testing.T) {
FsConfig: dataprovider.EventActionFilesystemConfig{
Type: dataprovider.FilesystemActionCompress,
Compress: dataprovider.EventActionFsCompress{
- Name: "/archive/{{.VirtualPath}}.zip",
- Paths: []string{"/{{.VirtualPath}}"},
+ Name: "/archive/{{VirtualPath}}.zip",
+ Paths: []string{"/{{VirtualPath}}"},
},
},
},
@@ -6508,9 +6378,9 @@ func TestEventActionEmailAttachments(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"test@example.com"},
- Subject: `"{{.Event}}" from "{{.Name}}"`,
- Body: "Fs path {{.FsPath}}, size: {{.FileSize}}, protocol: {{.Protocol}}, IP: {{.IP}} {{.EscapedVirtualPath}}",
- Attachments: []string{"/archive/{{.VirtualPath}}.zip"},
+ Subject: `"{{Event}}" from "{{Name}}"`,
+ Body: "Fs path {{FsPath}}, size: {{FileSize}}, protocol: {{Protocol}}, IP: {{IP}} {{EscapedVirtualPath}}",
+ Attachments: []string{"/archive/{{VirtualPath}}.zip"},
},
},
}
@@ -6566,7 +6436,7 @@ func TestEventActionEmailAttachments(t *testing.T) {
}, 1500*time.Millisecond, 100*time.Millisecond)
email := lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, "test@example.com"))
+ assert.True(t, util.Contains(email.To, "test@example.com"))
assert.Contains(t, email.Data, `Subject: "upload" from`)
assert.Contains(t, email.Data, url.QueryEscape("/"+testFileName))
assert.Contains(t, email.Data, "Content-Disposition: attachment")
@@ -6629,8 +6499,8 @@ func TestEventActionsRetentionReports(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"test@example.com"},
- Subject: `"{{.Event}}" from "{{.Name}}"`,
- Body: "Fs path {{.FsPath}}, size: {{.FileSize}}, protocol: {{.Protocol}}, IP: {{.IP}}",
+ Subject: `"{{Event}}" from "{{Name}}"`,
+ Body: "Fs path {{FsPath}}, size: {{FileSize}}, protocol: {{Protocol}}, IP: {{IP}}",
Attachments: []string{dataprovider.RetentionReportPlaceHolder},
},
},
@@ -6744,7 +6614,7 @@ func TestEventActionsRetentionReports(t *testing.T) {
email := lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, "test@example.com"))
+ assert.True(t, util.Contains(email.To, "test@example.com"))
assert.Contains(t, email.Data, fmt.Sprintf(`Subject: "upload" from "%s"`, user.Username))
assert.Contains(t, email.Data, "Content-Disposition: attachment")
_, err = client.Stat(testDir)
@@ -6857,8 +6727,8 @@ func TestEventRuleFirstUploadDownloadActions(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"test@example.com"},
- Subject: `"{{.Event}}" from "{{.Name}}"`,
- Body: "Fs path {{.FsPath}}, size: {{.FileSize}}, protocol: {{.Protocol}}, IP: {{.IP}}",
+ Subject: `"{{Event}}" from "{{Name}}"`,
+ Body: "Fs path {{FsPath}}, size: {{FileSize}}, protocol: {{Protocol}}, IP: {{IP}}",
},
},
}
@@ -6917,7 +6787,7 @@ func TestEventRuleFirstUploadDownloadActions(t *testing.T) {
}, 1500*time.Millisecond, 100*time.Millisecond)
email := lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, "test@example.com"))
+ assert.True(t, util.Contains(email.To, "test@example.com"))
assert.Contains(t, email.Data, fmt.Sprintf(`Subject: "first-upload" from "%s"`, user.Username))
lastReceivedEmail.reset()
// a new upload will not produce a new notification
@@ -6940,7 +6810,7 @@ func TestEventRuleFirstUploadDownloadActions(t *testing.T) {
}, 1500*time.Millisecond, 100*time.Millisecond)
email = lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, "test@example.com"))
+ assert.True(t, util.Contains(email.To, "test@example.com"))
assert.Contains(t, email.Data, fmt.Sprintf(`Subject: "first-download" from "%s"`, user.Username))
// download again
lastReceivedEmail.reset()
@@ -6989,9 +6859,9 @@ func TestEventRuleRenameEvent(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"test@example.com"},
- Subject: `"{{.Event}}" from "{{.Name}}"`,
+ Subject: `"{{Event}}" from "{{Name}}"`,
ContentType: 1,
- Body: `
Fs path {{.FsPath}}, Name: {{.Name}}, Target path "{{.VirtualTargetDirPath}}/{{.TargetName}}", size: {{.FileSize}}
`,
+ Body: `Fs path {{FsPath}}, Target path "{{VirtualTargetDirPath}}/{{TargetName}}", size: {{FileSize}}
`,
},
},
}
@@ -7016,9 +6886,7 @@ func TestEventRuleRenameEvent(t *testing.T) {
rule1, _, err := httpdtest.AddEventRule(r1, http.StatusCreated)
assert.NoError(t, err)
- u := getTestUser()
- u.Username = "test & chars"
- user, _, err := httpdtest.AddUser(u, http.StatusCreated)
+ user, _, err := httpdtest.AddUser(getTestUser(), http.StatusCreated)
assert.NoError(t, err)
conn, client, err := getSftpClient(user)
if assert.NoError(t, err) {
@@ -7038,11 +6906,10 @@ func TestEventRuleRenameEvent(t *testing.T) {
}, 1500*time.Millisecond, 100*time.Millisecond)
email := lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, "test@example.com"))
+ assert.True(t, util.Contains(email.To, "test@example.com"))
assert.Contains(t, email.Data, fmt.Sprintf(`Subject: "rename" from "%s"`, user.Username))
assert.Contains(t, email.Data, "Content-Type: text/html")
assert.Contains(t, email.Data, fmt.Sprintf("Target path %q", path.Join("/subdir", testFileName)))
- assert.Contains(t, email.Data, "Name: test & chars,")
}
_, err = httpdtest.RemoveEventRule(rule1, http.StatusOK)
@@ -7070,12 +6937,12 @@ func TestEventRuleIDPLogin(t *testing.T) {
require.NoError(t, err)
lastReceivedEmail.reset()
- username := `test_'idp_'login`
+ username := `test_"idp_"login`
custom1 := `cust"oa"1`
u := map[string]any{
- "username": "{{.Name}}",
+ "username": "{{Name}}",
"status": 1,
- "home_dir": filepath.Join(os.TempDir(), "{{.IDPFieldcustom1}}"),
+ "home_dir": filepath.Join(os.TempDir(), "{{IDPFieldcustom1}}"),
"permissions": map[string][]string{
"/": {dataprovider.PermAny},
},
@@ -7083,7 +6950,7 @@ func TestEventRuleIDPLogin(t *testing.T) {
userTmpl, err := json.Marshal(u)
require.NoError(t, err)
a := map[string]any{
- "username": "{{.Name}}",
+ "username": "{{Name}}",
"status": 1,
"permissions": []string{dataprovider.PermAdminAny},
}
@@ -7109,8 +6976,8 @@ func TestEventRuleIDPLogin(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"test@example.com"},
- Subject: `"{{.Event}} {{.StatusString}}"`,
- Body: "{{.Name}} Custom field: {{.IDPFieldcustom1}}",
+ Subject: `"{{Event}} {{StatusString}}"`,
+ Body: "{{Name}} Custom field: {{IDPFieldcustom1}}",
},
},
}
@@ -7173,7 +7040,7 @@ func TestEventRuleIDPLogin(t *testing.T) {
}, 3000*time.Millisecond, 100*time.Millisecond)
email := lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, "test@example.com"))
+ assert.True(t, util.Contains(email.To, "test@example.com"))
assert.Contains(t, email.Data, fmt.Sprintf(`Subject: "%s OK"`, common.IDPLoginUser))
assert.Contains(t, email.Data, username)
assert.Contains(t, email.Data, custom1)
@@ -7237,7 +7104,7 @@ func TestEventRuleIDPLogin(t *testing.T) {
}, 3000*time.Millisecond, 100*time.Millisecond)
email = lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, "test@example.com"))
+ assert.True(t, util.Contains(email.To, "test@example.com"))
assert.Contains(t, email.Data, fmt.Sprintf(`Subject: "%s OK"`, common.IDPLoginAdmin))
assert.Contains(t, email.Data, username)
assert.Contains(t, email.Data, custom1)
@@ -7355,8 +7222,8 @@ func TestEventRuleEmailField(t *testing.T) {
Type: dataprovider.ActionTypeEmail,
Options: dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
- Recipients: []string{"{{.Email}}"},
- Subject: `"{{.Event}}" from "{{.Name}}"`,
+ Recipients: []string{"{{Email}}"},
+ Subject: `"{{Event}}" from "{{Name}}"`,
Body: "Sample email body",
},
},
@@ -7370,7 +7237,7 @@ func TestEventRuleEmailField(t *testing.T) {
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"failure@example.com"},
Subject: `"Failure`,
- Body: "{{.ErrorString}}",
+ Body: "{{ErrorString}}",
},
},
}
@@ -7397,9 +7264,6 @@ func TestEventRuleEmailField(t *testing.T) {
Trigger: dataprovider.EventTriggerProviderEvent,
Conditions: dataprovider.EventConditions{
ProviderEvents: []string{"add"},
- Options: dataprovider.ConditionOptions{
- ProviderObjects: []string{"user"},
- },
},
Actions: []dataprovider.EventAction{
{
@@ -7432,7 +7296,7 @@ func TestEventRuleEmailField(t *testing.T) {
}, 3000*time.Millisecond, 100*time.Millisecond)
email := lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, user.Email))
+ assert.True(t, util.Contains(email.To, user.Email))
assert.Contains(t, email.Data, `Subject: "add" from "admin"`)
// if we add a user without email the notification will fail
@@ -7446,7 +7310,7 @@ func TestEventRuleEmailField(t *testing.T) {
}, 3000*time.Millisecond, 100*time.Millisecond)
email = lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, "failure@example.com"))
+ assert.True(t, util.Contains(email.To, "failure@example.com"))
assert.Contains(t, email.Data, `no recipient addresses set`)
conn, client, err := getSftpClient(user)
@@ -7463,7 +7327,7 @@ func TestEventRuleEmailField(t *testing.T) {
}, 3000*time.Millisecond, 100*time.Millisecond)
email := lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, user.Email))
+ assert.True(t, util.Contains(email.To, user.Email))
assert.Contains(t, email.Data, fmt.Sprintf(`Subject: "mkdir" from "%s"`, user.Username))
}
@@ -7504,9 +7368,9 @@ func TestEventRuleCertificate(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"test@example.com"},
- Subject: `"{{.Event}} {{.StatusString}}"`,
+ Subject: `"{{Event}} {{StatusString}}"`,
ContentType: 0,
- Body: "Domain: {{.Name}} Timestamp: {{.Timestamp}} {{.ErrorString}} Date time: {{.DateTime}}",
+ Body: "Domain: {{Name}} Timestamp: {{Timestamp}} {{ErrorString}} Date time: {{DateTime}}",
},
},
}
@@ -7570,7 +7434,7 @@ func TestEventRuleCertificate(t *testing.T) {
}, 3000*time.Millisecond, 100*time.Millisecond)
email := lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, "test@example.com"))
+ assert.True(t, util.Contains(email.To, "test@example.com"))
assert.Contains(t, email.Data, fmt.Sprintf(`Subject: "%s OK"`, renewalEvent))
assert.Contains(t, email.Data, "Content-Type: text/plain")
assert.Contains(t, email.Data, `Domain: example.com Timestamp`)
@@ -7591,7 +7455,7 @@ func TestEventRuleCertificate(t *testing.T) {
}, 3000*time.Millisecond, 100*time.Millisecond)
email = lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, "test@example.com"))
+ assert.True(t, util.Contains(email.To, "test@example.com"))
assert.Contains(t, email.Data, fmt.Sprintf(`Subject: "%s KO"`, renewalEvent))
assert.Contains(t, email.Data, `Domain: example.com Timestamp`)
assert.Contains(t, email.Data, dateTime.UTC().Format("2006-01-02T15:04:05.000"))
@@ -7644,8 +7508,8 @@ func TestEventRuleIPBlocked(t *testing.T) {
Options: dataprovider.BaseEventActionOptions{
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"test3@example.com", "test4@example.com"},
- Subject: `New "{{.Event}}"`,
- Body: "IP: {{.IP}} Timestamp: {{.Timestamp}}",
+ Subject: `New "{{Event}}"`,
+ Body: "IP: {{IP}} Timestamp: {{Timestamp}}",
},
},
}
@@ -7718,8 +7582,8 @@ func TestEventRuleIPBlocked(t *testing.T) {
}, 3000*time.Millisecond, 100*time.Millisecond)
email := lastReceivedEmail.get()
assert.Len(t, email.To, 2)
- assert.True(t, slices.Contains(email.To, "test3@example.com"))
- assert.True(t, slices.Contains(email.To, "test4@example.com"))
+ assert.True(t, util.Contains(email.To, "test3@example.com"))
+ assert.True(t, util.Contains(email.To, "test4@example.com"))
assert.Contains(t, email.Data, `Subject: New "IP Blocked"`)
err = dataprovider.DeleteEventRule(rule1.Name, "", "", "")
@@ -8107,7 +7971,6 @@ func TestEventRulePasswordExpiration(t *testing.T) {
_, _, err = httpdtest.UpdateEventRule(rule1, http.StatusOK)
assert.NoError(t, err)
user.Email = "user@example.net"
- user.Filters.AdditionalEmails = []string{"additional@example.net"}
_, _, err = httpdtest.UpdateUser(user, http.StatusOK, "")
assert.NoError(t, err)
conn, client, err = getSftpClient(user)
@@ -8123,9 +7986,8 @@ func TestEventRulePasswordExpiration(t *testing.T) {
return lastReceivedEmail.get().From != ""
}, 1500*time.Millisecond, 100*time.Millisecond)
email := lastReceivedEmail.get()
- assert.Len(t, email.To, 2)
+ assert.Len(t, email.To, 1)
assert.Contains(t, email.To, user.Email)
- assert.Contains(t, email.To, user.Filters.AdditionalEmails[0])
assert.Contains(t, email.Data, "your SFTPGo password expires in 5 days")
err = client.RemoveDirectory(dirName)
assert.NoError(t, err)
@@ -8346,12 +8208,7 @@ func TestRetentionAPI(t *testing.T) {
DeleteEmptyDirs: true,
},
}
- check := common.RetentionCheck{
- Folders: folderRetention,
- }
- c := common.RetentionChecks.Add(check, &user)
- assert.NotNil(t, c)
- err = c.Start()
+ _, err = httpdtest.StartRetentionCheck(user.Username, folderRetention, http.StatusAccepted)
assert.NoError(t, err)
assert.Eventually(t, func() bool {
@@ -8364,7 +8221,7 @@ func TestRetentionAPI(t *testing.T) {
err = client.Chtimes(uploadPath, time.Now().Add(-48*time.Hour), time.Now().Add(-48*time.Hour))
assert.NoError(t, err)
- err = c.Start()
+ _, err = httpdtest.StartRetentionCheck(user.Username, folderRetention, http.StatusAccepted)
assert.NoError(t, err)
assert.Eventually(t, func() bool {
@@ -8382,13 +8239,11 @@ func TestRetentionAPI(t *testing.T) {
err = writeSFTPFile(uploadPath, 32, client)
assert.NoError(t, err)
- check.Folders[0].DeleteEmptyDirs = false
+ folderRetention[0].DeleteEmptyDirs = false
err = client.Chtimes(uploadPath, time.Now().Add(-48*time.Hour), time.Now().Add(-48*time.Hour))
assert.NoError(t, err)
- c = common.RetentionChecks.Add(check, &user)
- assert.NotNil(t, c)
- err = c.Start()
+ _, err = httpdtest.StartRetentionCheck(user.Username, folderRetention, http.StatusAccepted)
assert.NoError(t, err)
assert.Eventually(t, func() bool {
@@ -8405,8 +8260,6 @@ func TestRetentionAPI(t *testing.T) {
assert.NoError(t, err)
err = client.Chtimes(uploadPath, time.Now().Add(-48*time.Hour), time.Now().Add(-48*time.Hour))
assert.NoError(t, err)
- conn.Close()
- client.Close()
}
// remove delete permissions to the user, it will be automatically granted
@@ -8417,6 +8270,9 @@ func TestRetentionAPI(t *testing.T) {
conn, client, err = getSftpClient(user)
if assert.NoError(t, err) {
+ defer conn.Close()
+ defer client.Close()
+
innerUploadFilePath := path.Join("/"+testDir, testDir, testFileName)
err = client.Mkdir(path.Join(testDir, testDir))
assert.NoError(t, err)
@@ -8441,12 +8297,7 @@ func TestRetentionAPI(t *testing.T) {
Retention: 0,
},
}
- check := common.RetentionCheck{
- Folders: folderRetention,
- }
- c := common.RetentionChecks.Add(check, &user)
- assert.NotNil(t, c)
- err = c.Start()
+ _, err = httpdtest.StartRetentionCheck(user.Username, folderRetention, http.StatusAccepted)
assert.NoError(t, err)
assert.Eventually(t, func() bool {
@@ -8467,12 +8318,7 @@ func TestRetentionAPI(t *testing.T) {
},
}
- check = common.RetentionCheck{
- Folders: folderRetention,
- }
- c = common.RetentionChecks.Add(check, &user)
- assert.NotNil(t, c)
- err = c.Start()
+ _, err = httpdtest.StartRetentionCheck(user.Username, folderRetention, http.StatusAccepted)
assert.NoError(t, err)
assert.Eventually(t, func() bool {
@@ -8481,8 +8327,6 @@ func TestRetentionAPI(t *testing.T) {
_, err = client.Stat(innerUploadFilePath)
assert.ErrorIs(t, err, os.ErrNotExist)
- conn.Close()
- client.Close()
}
// finally test some errors removing files or folders
if runtime.GOOS != osWindows {
@@ -8508,13 +8352,8 @@ func TestRetentionAPI(t *testing.T) {
},
}
- check := common.RetentionCheck{
- Folders: folderRetention,
- }
- c := common.RetentionChecks.Add(check, &user)
- assert.NotNil(t, c)
- err = c.Start()
- assert.ErrorIs(t, err, os.ErrPermission)
+ _, err = httpdtest.StartRetentionCheck(user.Username, folderRetention, http.StatusAccepted)
+ assert.NoError(t, err)
assert.Eventually(t, func() bool {
return len(common.RetentionChecks.Get("")) == 0
@@ -8523,10 +8362,8 @@ func TestRetentionAPI(t *testing.T) {
err = os.Chmod(dirPath, 0555)
assert.NoError(t, err)
- c = common.RetentionChecks.Add(check, &user)
- assert.NotNil(t, c)
- err = c.Start()
- assert.ErrorIs(t, err, os.ErrPermission)
+ _, err = httpdtest.StartRetentionCheck(user.Username, folderRetention, http.StatusAccepted)
+ assert.NoError(t, err)
assert.Eventually(t, func() bool {
return len(common.RetentionChecks.Get("")) == 0
@@ -8535,12 +8372,7 @@ func TestRetentionAPI(t *testing.T) {
err = os.Chmod(dirPath, os.ModePerm)
assert.NoError(t, err)
- check = common.RetentionCheck{
- Folders: folderRetention,
- }
- c = common.RetentionChecks.Add(check, &user)
- assert.NotNil(t, c)
- err = c.Start()
+ _, err = httpdtest.StartRetentionCheck(user.Username, folderRetention, http.StatusAccepted)
assert.NoError(t, err)
assert.Eventually(t, func() bool {
@@ -8554,93 +8386,6 @@ func TestRetentionAPI(t *testing.T) {
assert.NoError(t, err)
err = os.RemoveAll(user.GetHomeDir())
assert.NoError(t, err)
-
- assert.Eventually(t, func() bool {
- return common.Connections.GetClientConnections() == 0
- }, 1*time.Second, 50*time.Millisecond)
-}
-
-func TestPerUserTransferLimits(t *testing.T) {
- oldMaxPerHostConns := common.Config.MaxPerHostConnections
-
- common.Config.MaxPerHostConnections = 2
-
- u := getTestUser()
- u.UploadBandwidth = 32
- user, _, err := httpdtest.AddUser(u, http.StatusCreated)
- if !assert.NoError(t, err) {
- printLatestLogs(20)
- }
- conn, client, err := getSftpClient(user)
- if assert.NoError(t, err) {
- defer conn.Close()
- defer client.Close()
-
- var wg sync.WaitGroup
- numErrors := 0
- for i := 0; i <= 2; i++ {
- wg.Add(1)
- go func(counter int) {
- defer wg.Done()
-
- time.Sleep(20 * time.Millisecond)
- err := writeSFTPFile(fmt.Sprintf("%s_%d", testFileName, counter), 64*1024, client)
- if err != nil {
- numErrors++
- }
- }(i)
- }
- wg.Wait()
-
- assert.Equal(t, 1, numErrors)
- }
- _, err = httpdtest.RemoveUser(user, http.StatusOK)
- assert.NoError(t, err)
- err = os.RemoveAll(user.GetHomeDir())
- assert.NoError(t, err)
-
- common.Config.MaxPerHostConnections = oldMaxPerHostConns
-}
-
-func TestMaxSessionsSameConnection(t *testing.T) {
- u := getTestUser()
- u.UploadBandwidth = 32
- u.MaxSessions = 2
- user, _, err := httpdtest.AddUser(u, http.StatusCreated)
- assert.NoError(t, err)
- conn, client, err := getSftpClient(user)
- if assert.NoError(t, err) {
- defer conn.Close()
- defer client.Close()
-
- var wg sync.WaitGroup
- numErrors := 0
- for i := 0; i <= 2; i++ {
- wg.Add(1)
- go func(counter int) {
- defer wg.Done()
-
- var err error
- if counter < 2 {
- err = writeSFTPFile(fmt.Sprintf("%s_%d", testFileName, counter), 64*1024, client)
- } else {
- // wait for the transfers to start
- time.Sleep(50 * time.Millisecond)
- _, _, err = getSftpClient(user)
- }
- if err != nil {
- numErrors++
- }
- }(i)
- }
-
- wg.Wait()
- assert.Equal(t, 1, numErrors)
- }
- _, err = httpdtest.RemoveUser(user, http.StatusOK)
- assert.NoError(t, err)
- err = os.RemoveAll(user.GetHomeDir())
- assert.NoError(t, err)
}
func TestRenameDir(t *testing.T) {
@@ -9010,7 +8755,7 @@ func TestSFTPLoopError(t *testing.T) {
}, 3000*time.Millisecond, 100*time.Millisecond)
email := lastReceivedEmail.get()
assert.Len(t, email.To, 1)
- assert.True(t, slices.Contains(email.To, "failure@example.com"))
+ assert.True(t, util.Contains(email.To, "failure@example.com"))
assert.Contains(t, email.Data, `Subject: Failed action`)
user1.VirtualFolders[0].FsConfig.SFTPConfig.Password = kms.NewPlainSecret(defaultPassword)
diff --git a/internal/common/ratelimiter.go b/internal/common/ratelimiter.go
index 85d88092..1caa2ebf 100644
--- a/internal/common/ratelimiter.go
+++ b/internal/common/ratelimiter.go
@@ -17,7 +17,6 @@ package common
import (
"errors"
"fmt"
- "slices"
"sort"
"sync"
"sync/atomic"
@@ -95,7 +94,7 @@ func (r *RateLimiterConfig) validate() error {
}
r.Protocols = util.RemoveDuplicates(r.Protocols, true)
for _, protocol := range r.Protocols {
- if !slices.Contains(rateLimiterProtocolValues, protocol) {
+ if !util.Contains(rateLimiterProtocolValues, protocol) {
return fmt.Errorf("invalid protocol %q", protocol)
}
}
diff --git a/internal/common/tlsutils.go b/internal/common/tlsutils.go
index a7dfb0c6..c604728d 100644
--- a/internal/common/tlsutils.go
+++ b/internal/common/tlsutils.go
@@ -25,7 +25,6 @@ import (
"math/rand"
"os"
"path/filepath"
- "slices"
"sync"
"github.com/drakkan/sftpgo/v2/internal/logger"
@@ -97,7 +96,7 @@ func (m *CertManager) loadCertificates() error {
}
logger.Debug(m.logSender, "", "TLS certificate %q successfully loaded, id %v", keyPair.Cert, keyPair.ID)
certs[keyPair.ID] = &newCert
- if !slices.Contains(m.monitorList, keyPair.Cert) {
+ if !util.Contains(m.monitorList, keyPair.Cert) {
m.monitorList = append(m.monitorList, keyPair.Cert)
}
}
@@ -191,7 +190,7 @@ func (m *CertManager) LoadCRLs() error {
logger.Debug(m.logSender, "", "CRL %q successfully loaded", revocationList)
crls = append(crls, crl)
- if !slices.Contains(m.monitorList, revocationList) {
+ if !util.Contains(m.monitorList, revocationList) {
m.monitorList = append(m.monitorList, revocationList)
}
}
diff --git a/internal/common/transfer.go b/internal/common/transfer.go
index df9638b1..f4e78e30 100644
--- a/internal/common/transfer.go
+++ b/internal/common/transfer.go
@@ -35,7 +35,7 @@ var (
)
// BaseTransfer contains protocols common transfer details for an upload or a download.
-type BaseTransfer struct {
+type BaseTransfer struct { //nolint:maligned
ID int64
BytesSent atomic.Int64
BytesReceived atomic.Int64
@@ -329,21 +329,6 @@ func (t *BaseTransfer) getUploadFileSize() (int64, int, error) {
var fileSize int64
var deletedFiles int
- switch dataprovider.GetQuotaTracking() {
- case 0:
- return fileSize, deletedFiles, errors.New("quota tracking disabled")
- case 2:
- if !t.Connection.User.HasQuotaRestrictions() {
- vfolder, err := t.Connection.User.GetVirtualFolderForPath(path.Dir(t.requestPath))
- if err != nil {
- return fileSize, deletedFiles, errors.New("quota tracking disabled for this user")
- }
- if vfolder.IsIncludedInUserQuota() {
- return fileSize, deletedFiles, errors.New("quota tracking disabled for this user and folder included in user quota")
- }
- }
- }
-
info, err := t.Fs.Stat(t.fsPath)
if err == nil {
fileSize = info.Size()
@@ -409,7 +394,7 @@ func (t *BaseTransfer) Close() error {
t.effectiveFsPath, err)
} else if t.isAtomicUpload() {
if t.ErrTransfer == nil || Config.UploadMode&UploadModeAtomicWithResume != 0 {
- _, _, err = t.Fs.Rename(t.effectiveFsPath, t.fsPath, 0)
+ _, _, err = t.Fs.Rename(t.effectiveFsPath, t.fsPath)
t.Connection.Log(logger.LevelDebug, "atomic upload completed, rename: %q -> %q, error: %v",
t.effectiveFsPath, t.fsPath, err)
// the file must be removed if it is uploaded to a path outside the home dir and cannot be renamed
@@ -536,8 +521,11 @@ func (t *BaseTransfer) updateQuota(numFiles int, fileSize int64) bool {
if t.transferType == TransferUpload && (numFiles != 0 || sizeDiff != 0) {
vfolder, err := t.Connection.User.GetVirtualFolderForPath(path.Dir(t.requestPath))
if err == nil {
- dataprovider.UpdateUserFolderQuota(&vfolder, &t.Connection.User, numFiles,
+ dataprovider.UpdateVirtualFolderQuota(&vfolder.BaseVirtualFolder, numFiles, //nolint:errcheck
sizeDiff, false)
+ if vfolder.IsIncludedInUserQuota() {
+ dataprovider.UpdateUserQuota(&t.Connection.User, numFiles, sizeDiff, false) //nolint:errcheck
+ }
} else {
dataprovider.UpdateUserQuota(&t.Connection.User, numFiles, sizeDiff, false) //nolint:errcheck
}
diff --git a/internal/common/transfer_test.go b/internal/common/transfer_test.go
index 1bf0dbe1..5324484b 100644
--- a/internal/common/transfer_test.go
+++ b/internal/common/transfer_test.go
@@ -306,9 +306,8 @@ func TestRemovePartialCryptoFile(t *testing.T) {
require.NoError(t, err)
u := dataprovider.User{
BaseUser: sdk.BaseUser{
- Username: "test",
- HomeDir: os.TempDir(),
- QuotaFiles: 1000000,
+ Username: "test",
+ HomeDir: os.TempDir(),
},
}
conn := NewBaseConnection(fs.ConnectionID(), ProtocolSFTP, "", "", u)
@@ -324,9 +323,6 @@ func TestRemovePartialCryptoFile(t *testing.T) {
assert.Equal(t, int64(0), size)
assert.Equal(t, 1, deletedFiles)
assert.NoFileExists(t, testFile)
- err = transfer.Close()
- assert.Error(t, err)
- assert.Len(t, conn.GetTransfers(), 0)
}
func TestFTPMode(t *testing.T) {
@@ -438,11 +434,6 @@ func TestTransferQuota(t *testing.T) {
}
err = transfer.CheckWrite()
assert.True(t, conn.IsQuotaExceededError(err))
-
- err = transfer.Close()
- assert.NoError(t, err)
- assert.Len(t, conn.GetTransfers(), 0)
- assert.Equal(t, int32(0), Connections.GetTotalTransfers())
}
func TestUploadOutsideHomeRenameError(t *testing.T) {
diff --git a/internal/common/transferschecker_test.go b/internal/common/transferschecker_test.go
index 0528de61..443e438e 100644
--- a/internal/common/transferschecker_test.go
+++ b/internal/common/transferschecker_test.go
@@ -250,7 +250,6 @@ func TestTransfersCheckerDiskQuota(t *testing.T) {
Connections.Remove(fakeConn5.GetID())
stats := Connections.GetStats("")
assert.Len(t, stats, 0)
- assert.Equal(t, int32(0), Connections.GetTotalTransfers())
err = dataprovider.DeleteUser(user.Username, "", "", "")
assert.NoError(t, err)
@@ -369,16 +368,11 @@ func TestTransferCheckerTransferQuota(t *testing.T) {
if assert.Error(t, transfer4.errAbort) {
assert.Contains(t, transfer4.errAbort.Error(), ErrReadQuotaExceeded.Error())
}
- err = transfer3.Close()
- assert.NoError(t, err)
- err = transfer4.Close()
- assert.NoError(t, err)
Connections.Remove(fakeConn3.GetID())
Connections.Remove(fakeConn4.GetID())
stats := Connections.GetStats("")
assert.Len(t, stats, 0)
- assert.Equal(t, int32(0), Connections.GetTotalTransfers())
err = dataprovider.DeleteUser(user.Username, "", "", "")
assert.NoError(t, err)
diff --git a/internal/config/config.go b/internal/config/config.go
index 58863c6d..00f8e1ba 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -20,11 +20,9 @@ import (
"fmt"
"os"
"path/filepath"
- "slices"
"strconv"
"strings"
- kmsplugin "github.com/sftpgo/sdk/plugin/kms"
"github.com/spf13/viper"
"github.com/subosito/gotenv"
@@ -93,35 +91,30 @@ var (
TLSCipherSuites: nil,
Protocols: nil,
Prefix: "",
- ProxyMode: 0,
ProxyAllowed: nil,
ClientIPProxyHeader: "",
ClientIPHeaderDepth: 0,
DisableWWWAuthHeader: false,
}
defaultHTTPDBinding = httpd.Binding{
- Address: "",
- Port: 8080,
- EnableWebAdmin: true,
- EnableWebClient: true,
- EnableRESTAPI: true,
- EnabledLoginMethods: 0,
- DisabledLoginMethods: 0,
- EnableHTTPS: false,
- CertificateFile: "",
- CertificateKeyFile: "",
- MinTLSVersion: 12,
- ClientAuthType: 0,
- TLSCipherSuites: nil,
- Protocols: nil,
- ProxyMode: 0,
- ProxyAllowed: nil,
- ClientIPProxyHeader: "",
- ClientIPHeaderDepth: 0,
- HideLoginURL: 0,
- RenderOpenAPI: true,
- BaseURL: "",
- Languages: []string{"en"},
+ Address: "",
+ Port: 8080,
+ EnableWebAdmin: true,
+ EnableWebClient: true,
+ EnableRESTAPI: true,
+ EnabledLoginMethods: 0,
+ EnableHTTPS: false,
+ CertificateFile: "",
+ CertificateKeyFile: "",
+ MinTLSVersion: 12,
+ ClientAuthType: 0,
+ TLSCipherSuites: nil,
+ Protocols: nil,
+ ProxyAllowed: nil,
+ ClientIPProxyHeader: "",
+ ClientIPHeaderDepth: 0,
+ HideLoginURL: 0,
+ RenderOpenAPI: true,
OIDC: httpd.OIDC{
ClientID: "",
ClientSecret: "",
@@ -137,23 +130,21 @@ var (
Debug: false,
},
Security: httpd.SecurityConf{
- Enabled: false,
- AllowedHosts: nil,
- AllowedHostsAreRegex: false,
- HostsProxyHeaders: nil,
- HTTPSRedirect: false,
- HTTPSHost: "",
- HTTPSProxyHeaders: nil,
- STSSeconds: 0,
- STSIncludeSubdomains: false,
- STSPreload: false,
- ContentTypeNosniff: false,
- ContentSecurityPolicy: "",
- PermissionsPolicy: "",
- CrossOriginOpenerPolicy: "",
- CrossOriginResourcePolicy: "",
- CrossOriginEmbedderPolicy: "",
- CacheControl: "",
+ Enabled: false,
+ AllowedHosts: nil,
+ AllowedHostsAreRegex: false,
+ HostsProxyHeaders: nil,
+ HTTPSRedirect: false,
+ HTTPSHost: "",
+ HTTPSProxyHeaders: nil,
+ STSSeconds: 0,
+ STSIncludeSubdomains: false,
+ STSPreload: false,
+ ContentTypeNosniff: false,
+ ContentSecurityPolicy: "",
+ PermissionsPolicy: "",
+ CrossOriginOpenerPolicy: "",
+ CacheControl: "",
},
Branding: httpd.Branding{},
}
@@ -218,6 +209,7 @@ func Init() {
ProxySkipped: []string{},
PostConnectHook: "",
PostDisconnectHook: "",
+ DataRetentionHook: "",
MaxTotalConnections: 0,
MaxPerHostConnections: 20,
AllowListStatus: 0,
@@ -243,7 +235,6 @@ func Init() {
RateLimitersConfig: []common.RateLimiterConfig{defaultRateLimiter},
Umask: "",
ServerVersion: "",
- TZ: "",
Metadata: common.MetadataConfig{
Read: 0,
},
@@ -274,13 +265,12 @@ func Init() {
HostCertificates: []string{},
HostKeyAlgorithms: []string{},
KexAlgorithms: []string{},
+ MinDHGroupExchangeKeySize: 2048,
Ciphers: []string{},
MACs: []string{},
PublicKeyAlgorithms: []string{},
TrustedUserCAKeys: []string{},
RevokedUserCertsFile: "",
- OPKSSHPath: "",
- OPKSSHChecksum: "",
LoginBannerFile: "",
EnabledSSHCommands: []string{},
KeyboardInteractiveAuthentication: true,
@@ -409,9 +399,6 @@ func Init() {
SigningPassphrase: "",
SigningPassphraseFile: "",
TokenValidation: 0,
- CookieLifetime: 20,
- ShareCookieLifetime: 120,
- JWTLifetime: 20,
MaxUploadFileSize: 0,
Cors: httpd.CorsConfig{
Enabled: false,
@@ -590,16 +577,6 @@ func SetPluginsConfig(config []plugin.Config) {
globalConf.PluginsConfig = config
}
-// HasKMSPlugin returns true if at least one KMS plugin is configured.
-func HasKMSPlugin() bool {
- for _, c := range globalConf.PluginsConfig {
- if c.Type == kmsplugin.PluginName {
- return true
- }
- }
- return false
-}
-
// GetMFAConfig returns multi-factor authentication config
func GetMFAConfig() mfa.Config {
return globalConf.MFAConfig
@@ -646,6 +623,7 @@ func getRedactedGlobalConf() globalConfig {
conf.Common.StartupHook = util.GetRedactedURL(conf.Common.StartupHook)
conf.Common.PostConnectHook = util.GetRedactedURL(conf.Common.PostConnectHook)
conf.Common.PostDisconnectHook = util.GetRedactedURL(conf.Common.PostDisconnectHook)
+ conf.Common.DataRetentionHook = util.GetRedactedURL(conf.Common.DataRetentionHook)
conf.SFTPD.KeyboardInteractiveHook = util.GetRedactedURL(conf.SFTPD.KeyboardInteractiveHook)
conf.HTTPDConfig.SigningPassphrase = getRedactedPassword(conf.HTTPDConfig.SigningPassphrase)
conf.HTTPDConfig.Setup.InstallationCode = getRedactedPassword(conf.HTTPDConfig.Setup.InstallationCode)
@@ -662,7 +640,6 @@ func getRedactedGlobalConf() globalConfig {
binding.OIDC.ClientSecret = getRedactedPassword(binding.OIDC.ClientSecret)
conf.HTTPDConfig.Bindings = append(conf.HTTPDConfig.Bindings, binding)
}
- conf.KMSConfig.Secrets.MasterKeyString = getRedactedPassword(conf.KMSConfig.Secrets.MasterKeyString)
conf.PluginsConfig = nil
for _, plugin := range globalConf.PluginsConfig {
var args []string
@@ -742,7 +719,7 @@ func checkOverrideDefaultSettings() {
}
}
- if slices.Contains(viper.AllKeys(), "mfa.totp") {
+ if util.Contains(viper.AllKeys(), "mfa.totp") {
globalConf.MFAConfig.TOTP = nil
}
}
@@ -828,12 +805,6 @@ func resetInvalidConfigs() {
logger.WarnToConsole("Non-fatal configuration error: %v", warn)
}
}
- if globalConf.Common.RenameMode < 0 || globalConf.Common.RenameMode > 1 {
- warn := fmt.Sprintf("invalid rename mode %d, reset to 0", globalConf.Common.RenameMode)
- globalConf.Common.RenameMode = 0
- logger.Warn(logSender, "", "Non-fatal configuration error: %v", warn)
- logger.WarnToConsole("Non-fatal configuration error: %v", warn)
- }
}
func loadBindingsFromEnv() {
@@ -906,13 +877,13 @@ func getRateLimitersFromEnv(idx int) {
isSet = true
}
- burst, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_COMMON__RATE_LIMITERS__%v__BURST", idx), 32)
+ burst, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_COMMON__RATE_LIMITERS__%v__BURST", idx), 0)
if ok {
rtlConfig.Burst = int(burst)
isSet = true
}
- rtlType, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_COMMON__RATE_LIMITERS__%v__TYPE", idx), 32)
+ rtlType, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_COMMON__RATE_LIMITERS__%v__TYPE", idx), 0)
if ok {
rtlConfig.Type = int(rtlType)
isSet = true
@@ -930,13 +901,13 @@ func getRateLimitersFromEnv(idx int) {
isSet = true
}
- softLimit, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_COMMON__RATE_LIMITERS__%v__ENTRIES_SOFT_LIMIT", idx), 32)
+ softLimit, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_COMMON__RATE_LIMITERS__%v__ENTRIES_SOFT_LIMIT", idx), 0)
if ok {
rtlConfig.EntriesSoftLimit = int(softLimit)
isSet = true
}
- hardLimit, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_COMMON__RATE_LIMITERS__%v__ENTRIES_HARD_LIMIT", idx), 32)
+ hardLimit, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_COMMON__RATE_LIMITERS__%v__ENTRIES_HARD_LIMIT", idx), 0)
if ok {
rtlConfig.EntriesHardLimit = int(hardLimit)
isSet = true
@@ -972,7 +943,7 @@ func getKMSPluginFromEnv(idx int, pluginConfig *plugin.Config) bool {
func getAuthPluginFromEnv(idx int, pluginConfig *plugin.Config) bool {
isSet := false
- authScope, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_PLUGINS__%v__AUTH_OPTIONS__SCOPE", idx), 32)
+ authScope, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_PLUGINS__%v__AUTH_OPTIONS__SCOPE", idx), 0)
if ok {
pluginConfig.AuthOptions.Scope = int(authScope)
isSet = true
@@ -1017,13 +988,13 @@ func getNotifierPluginFromEnv(idx int, pluginConfig *plugin.Config) bool {
}
}
- notifierRetryMaxTime, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_PLUGINS__%v__NOTIFIER_OPTIONS__RETRY_MAX_TIME", idx), 32)
+ notifierRetryMaxTime, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_PLUGINS__%v__NOTIFIER_OPTIONS__RETRY_MAX_TIME", idx), 0)
if ok {
pluginConfig.NotifierOptions.RetryMaxTime = int(notifierRetryMaxTime)
isSet = true
}
- notifierRetryQueueMaxSize, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_PLUGINS__%v__NOTIFIER_OPTIONS__RETRY_QUEUE_MAX_SIZE", idx), 32)
+ notifierRetryQueueMaxSize, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_PLUGINS__%v__NOTIFIER_OPTIONS__RETRY_QUEUE_MAX_SIZE", idx), 0)
if ok {
pluginConfig.NotifierOptions.RetryQueueMaxSize = int(notifierRetryQueueMaxSize)
isSet = true
@@ -1111,7 +1082,7 @@ func getSFTPDBindindFromEnv(idx int) {
isSet := false
- port, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_SFTPD__BINDINGS__%v__PORT", idx), 32)
+ port, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_SFTPD__BINDINGS__%v__PORT", idx), 0)
if ok {
binding.Port = int(port)
isSet = true
@@ -1198,13 +1169,19 @@ func getFTPDBindingSecurityFromEnv(idx int, binding *ftpd.Binding) bool {
isSet = true
}
- tlsMode, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_FTPD__BINDINGS__%v__TLS_MODE", idx), 32)
+ tlsMode, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_FTPD__BINDINGS__%v__TLS_MODE", idx), 0)
if ok {
binding.TLSMode = int(tlsMode)
isSet = true
}
- tlsVer, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_FTPD__BINDINGS__%v__MIN_TLS_VERSION", idx), 32)
+ tlsSessionReuse, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_FTPD__BINDINGS__%v__TLS_SESSION_REUSE", idx), 0)
+ if ok {
+ binding.TLSSessionReuse = int(tlsSessionReuse)
+ isSet = true
+ }
+
+ tlsVer, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_FTPD__BINDINGS__%v__MIN_TLS_VERSION", idx), 0)
if ok {
binding.MinTLSVersion = int(tlsVer)
isSet = true
@@ -1216,24 +1193,30 @@ func getFTPDBindingSecurityFromEnv(idx int, binding *ftpd.Binding) bool {
isSet = true
}
- clientAuthType, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_FTPD__BINDINGS__%v__CLIENT_AUTH_TYPE", idx), 32)
+ clientAuthType, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_FTPD__BINDINGS__%v__CLIENT_AUTH_TYPE", idx), 0)
if ok {
binding.ClientAuthType = int(clientAuthType)
isSet = true
}
- pasvSecurity, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_FTPD__BINDINGS__%v__PASSIVE_CONNECTIONS_SECURITY", idx), 32)
+ pasvSecurity, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_FTPD__BINDINGS__%v__PASSIVE_CONNECTIONS_SECURITY", idx), 0)
if ok {
binding.PassiveConnectionsSecurity = int(pasvSecurity)
isSet = true
}
- activeSecurity, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_FTPD__BINDINGS__%v__ACTIVE_CONNECTIONS_SECURITY", idx), 32)
+ activeSecurity, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_FTPD__BINDINGS__%v__ACTIVE_CONNECTIONS_SECURITY", idx), 0)
if ok {
binding.ActiveConnectionsSecurity = int(activeSecurity)
isSet = true
}
+ ignoreASCIITransferType, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_FTPD__BINDINGS__%d__IGNORE_ASCII_TRANSFER_TYPE", idx), 0)
+ if ok {
+ binding.IgnoreASCIITransferType = int(ignoreASCIITransferType)
+ isSet = true
+ }
+
return isSet
}
@@ -1241,7 +1224,7 @@ func getFTPDBindingFromEnv(idx int) {
binding := getDefaultFTPDBinding(idx)
isSet := false
- port, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_FTPD__BINDINGS__%v__PORT", idx), 32)
+ port, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_FTPD__BINDINGS__%v__PORT", idx), 0)
if ok {
binding.Port = int(port)
isSet = true
@@ -1321,13 +1304,13 @@ func getWebDAVBindingHTTPSConfigsFromEnv(idx int, binding *webdavd.Binding) bool
isSet = true
}
- tlsVer, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_WEBDAVD__BINDINGS__%v__MIN_TLS_VERSION", idx), 32)
+ tlsVer, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_WEBDAVD__BINDINGS__%v__MIN_TLS_VERSION", idx), 0)
if ok {
binding.MinTLSVersion = int(tlsVer)
isSet = true
}
- clientAuthType, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_WEBDAVD__BINDINGS__%v__CLIENT_AUTH_TYPE", idx), 32)
+ clientAuthType, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_WEBDAVD__BINDINGS__%v__CLIENT_AUTH_TYPE", idx), 0)
if ok {
binding.ClientAuthType = int(clientAuthType)
isSet = true
@@ -1351,12 +1334,6 @@ func getWebDAVBindingHTTPSConfigsFromEnv(idx int, binding *webdavd.Binding) bool
func getWebDAVDBindingProxyConfigsFromEnv(idx int, binding *webdavd.Binding) bool {
isSet := false
- proxyMode, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_WEBDAVD__BINDINGS__%v__PROXY_MODE", idx), 32)
- if ok {
- binding.ProxyMode = int(proxyMode)
- isSet = true
- }
-
proxyAllowed, ok := lookupStringListFromEnv(fmt.Sprintf("SFTPGO_WEBDAVD__BINDINGS__%v__PROXY_ALLOWED", idx))
if ok {
binding.ProxyAllowed = proxyAllowed
@@ -1369,7 +1346,7 @@ func getWebDAVDBindingProxyConfigsFromEnv(idx int, binding *webdavd.Binding) boo
isSet = true
}
- clientIPHeaderDepth, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_WEBDAVD__BINDINGS__%v__CLIENT_IP_HEADER_DEPTH", idx), 32)
+ clientIPHeaderDepth, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_WEBDAVD__BINDINGS__%v__CLIENT_IP_HEADER_DEPTH", idx), 0)
if ok {
binding.ClientIPHeaderDepth = int(clientIPHeaderDepth)
isSet = true
@@ -1407,7 +1384,7 @@ func getWebDAVDBindingFromEnv(idx int) {
isSet := false
- port, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_WEBDAVD__BINDINGS__%v__PORT", idx), 32)
+ port, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_WEBDAVD__BINDINGS__%v__PORT", idx), 0)
if ok {
binding.Port = int(port)
isSet = true
@@ -1568,27 +1545,9 @@ func getHTTPDSecurityConfFromEnv(idx int) (httpd.SecurityConf, bool) { //nolint:
isSet = true
}
- crossOriginOpenerPolicy, ok := os.LookupEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__SECURITY__CROSS_ORIGIN_OPENER_POLICY", idx))
+ crossOriginOpenedPolicy, ok := os.LookupEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__SECURITY__CROSS_ORIGIN_OPENER_POLICY", idx))
if ok {
- result.CrossOriginOpenerPolicy = crossOriginOpenerPolicy
- isSet = true
- }
-
- crossOriginResourcePolicy, ok := os.LookupEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__SECURITY__CROSS_ORIGIN_RESOURCE_POLICY", idx))
- if ok {
- result.CrossOriginResourcePolicy = crossOriginResourcePolicy
- isSet = true
- }
-
- crossOriginEmbedderPolicy, ok := os.LookupEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__SECURITY__CROSS_ORIGIN_EMBEDDER_POLICY", idx))
- if ok {
- result.CrossOriginEmbedderPolicy = crossOriginEmbedderPolicy
- isSet = true
- }
-
- referredPolicy, ok := os.LookupEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__SECURITY__REFERRER_POLICY", idx))
- if ok {
- result.ReferrerPolicy = referredPolicy
+ result.CrossOriginOpenerPolicy = crossOriginOpenedPolicy
isSet = true
}
@@ -1796,12 +1755,6 @@ func getHTTPDNestedObjectsFromEnv(idx int, binding *httpd.Binding) bool {
func getHTTPDBindingProxyConfigsFromEnv(idx int, binding *httpd.Binding) bool {
isSet := false
- proxyMode, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__PROXY_MODE", idx), 32)
- if ok {
- binding.ProxyMode = int(proxyMode)
- isSet = true
- }
-
proxyAllowed, ok := lookupStringListFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__PROXY_ALLOWED", idx))
if ok {
binding.ProxyAllowed = proxyAllowed
@@ -1814,7 +1767,7 @@ func getHTTPDBindingProxyConfigsFromEnv(idx int, binding *httpd.Binding) bool {
isSet = true
}
- clientIPHeaderDepth, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__CLIENT_IP_HEADER_DEPTH", idx), 32)
+ clientIPHeaderDepth, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__CLIENT_IP_HEADER_DEPTH", idx), 0)
if ok {
binding.ClientIPHeaderDepth = int(clientIPHeaderDepth)
isSet = true
@@ -1827,7 +1780,7 @@ func getHTTPDBindingFromEnv(idx int) { //nolint:gocyclo
binding := getDefaultHTTPBinding(idx)
isSet := false
- port, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__PORT", idx), 32)
+ port, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__PORT", idx), 0)
if ok {
binding.Port = int(port)
isSet = true
@@ -1869,49 +1822,31 @@ func getHTTPDBindingFromEnv(idx int) { //nolint:gocyclo
isSet = true
}
- enabledLoginMethods, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__ENABLED_LOGIN_METHODS", idx), 32)
+ enabledLoginMethods, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__ENABLED_LOGIN_METHODS", idx), 0)
if ok {
binding.EnabledLoginMethods = int(enabledLoginMethods)
isSet = true
}
- disabledLoginMethods, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__DISABLED_LOGIN_METHODS", idx), 32)
- if ok {
- binding.DisabledLoginMethods = int(disabledLoginMethods)
- isSet = true
- }
-
renderOpenAPI, ok := lookupBoolFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__RENDER_OPENAPI", idx))
if ok {
binding.RenderOpenAPI = renderOpenAPI
isSet = true
}
- baseURL, ok := os.LookupEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%d__BASE_URL", idx))
- if ok {
- binding.BaseURL = baseURL
- isSet = true
- }
-
- languages, ok := lookupStringListFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%d__LANGUAGES", idx))
- if ok {
- binding.Languages = languages
- isSet = true
- }
-
enableHTTPS, ok := lookupBoolFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__ENABLE_HTTPS", idx))
if ok {
binding.EnableHTTPS = enableHTTPS
isSet = true
}
- tlsVer, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__MIN_TLS_VERSION", idx), 32)
+ tlsVer, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__MIN_TLS_VERSION", idx), 0)
if ok {
binding.MinTLSVersion = int(tlsVer)
isSet = true
}
- clientAuthType, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__CLIENT_AUTH_TYPE", idx), 32)
+ clientAuthType, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__CLIENT_AUTH_TYPE", idx), 0)
if ok {
binding.ClientAuthType = int(clientAuthType)
isSet = true
@@ -1933,7 +1868,7 @@ func getHTTPDBindingFromEnv(idx int) { //nolint:gocyclo
isSet = true
}
- hideLoginURL, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__HIDE_LOGIN_URL", idx), 32)
+ hideLoginURL, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_HTTPD__BINDINGS__%v__HIDE_LOGIN_URL", idx), 0)
if ok {
binding.HideLoginURL = int(hideLoginURL)
isSet = true
@@ -2022,7 +1957,7 @@ func getCommandConfigsFromEnv(idx int) {
cfg.Path = path
}
- timeout, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_COMMAND__COMMANDS__%v__TIMEOUT", idx), 32)
+ timeout, ok := lookupIntFromEnv(fmt.Sprintf("SFTPGO_COMMAND__COMMANDS__%v__TIMEOUT", idx), 0)
if ok {
cfg.Timeout = int(timeout)
}
@@ -2061,6 +1996,7 @@ func setViperDefaults() {
viper.SetDefault("common.proxy_skipped", globalConf.Common.ProxySkipped)
viper.SetDefault("common.post_connect_hook", globalConf.Common.PostConnectHook)
viper.SetDefault("common.post_disconnect_hook", globalConf.Common.PostDisconnectHook)
+ viper.SetDefault("common.data_retention_hook", globalConf.Common.DataRetentionHook)
viper.SetDefault("common.max_total_connections", globalConf.Common.MaxTotalConnections)
viper.SetDefault("common.max_per_host_connections", globalConf.Common.MaxPerHostConnections)
viper.SetDefault("common.allowlist_status", globalConf.Common.AllowListStatus)
@@ -2081,7 +2017,6 @@ func setViperDefaults() {
viper.SetDefault("common.defender.login_delay.password_failed", globalConf.Common.DefenderConfig.LoginDelay.PasswordFailed)
viper.SetDefault("common.umask", globalConf.Common.Umask)
viper.SetDefault("common.server_version", globalConf.Common.ServerVersion)
- viper.SetDefault("common.tz", globalConf.Common.TZ)
viper.SetDefault("common.metadata.read", globalConf.Common.Metadata.Read)
viper.SetDefault("common.event_manager.enabled_commands", globalConf.Common.EventManager.EnabledCommands)
viper.SetDefault("acme.email", globalConf.ACME.Email)
@@ -2099,13 +2034,12 @@ func setViperDefaults() {
viper.SetDefault("sftpd.host_certificates", globalConf.SFTPD.HostCertificates)
viper.SetDefault("sftpd.host_key_algorithms", globalConf.SFTPD.HostKeyAlgorithms)
viper.SetDefault("sftpd.kex_algorithms", globalConf.SFTPD.KexAlgorithms)
+ viper.SetDefault("sftpd.min_dh_group_exchange_key_size", globalConf.SFTPD.MinDHGroupExchangeKeySize)
viper.SetDefault("sftpd.ciphers", globalConf.SFTPD.Ciphers)
viper.SetDefault("sftpd.macs", globalConf.SFTPD.MACs)
viper.SetDefault("sftpd.public_key_algorithms", globalConf.SFTPD.PublicKeyAlgorithms)
viper.SetDefault("sftpd.trusted_user_ca_keys", globalConf.SFTPD.TrustedUserCAKeys)
viper.SetDefault("sftpd.revoked_user_certs_file", globalConf.SFTPD.RevokedUserCertsFile)
- viper.SetDefault("sftpd.opkssh_path", globalConf.SFTPD.OPKSSHPath)
- viper.SetDefault("sftpd.opkssh_checksum", globalConf.SFTPD.OPKSSHChecksum)
viper.SetDefault("sftpd.login_banner_file", globalConf.SFTPD.LoginBannerFile)
viper.SetDefault("sftpd.enabled_ssh_commands", sftpd.GetDefaultSSHCommands())
viper.SetDefault("sftpd.keyboard_interactive_authentication", globalConf.SFTPD.KeyboardInteractiveAuthentication)
@@ -2197,9 +2131,6 @@ func setViperDefaults() {
viper.SetDefault("httpd.signing_passphrase", globalConf.HTTPDConfig.SigningPassphrase)
viper.SetDefault("httpd.signing_passphrase_file", globalConf.HTTPDConfig.SigningPassphraseFile)
viper.SetDefault("httpd.token_validation", globalConf.HTTPDConfig.TokenValidation)
- viper.SetDefault("httpd.cookie_lifetime", globalConf.HTTPDConfig.CookieLifetime)
- viper.SetDefault("httpd.share_cookie_lifetime", globalConf.HTTPDConfig.ShareCookieLifetime)
- viper.SetDefault("httpd.jwt_lifetime", globalConf.HTTPDConfig.JWTLifetime)
viper.SetDefault("httpd.max_upload_file_size", globalConf.HTTPDConfig.MaxUploadFileSize)
viper.SetDefault("httpd.cors.enabled", globalConf.HTTPDConfig.Cors.Enabled)
viper.SetDefault("httpd.cors.allowed_origins", globalConf.HTTPDConfig.Cors.AllowedOrigins)
@@ -2273,7 +2204,7 @@ func lookupStringListFromEnv(envName string) ([]string, bool) {
value, ok := os.LookupEnv(envName)
if ok {
var result []string
- for v := range strings.SplitSeq(value, ",") {
+ for _, v := range strings.Split(value, ",") {
val := strings.TrimSpace(v)
if val != "" {
result = append(result, val)
diff --git a/internal/config/config_darwin.go b/internal/config/config_darwin.go
index 808c1cd3..04a31d48 100644
--- a/internal/config/config_darwin.go
+++ b/internal/config/config_darwin.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build darwin
+// +build darwin
package config
diff --git a/internal/config/config_fallback.go b/internal/config/config_fallback.go
index f841410a..5bf27b46 100644
--- a/internal/config/config_fallback.go
+++ b/internal/config/config_fallback.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build !linux && !darwin
+// +build !linux,!darwin
package config
diff --git a/internal/config/config_linux.go b/internal/config/config_linux.go
index 21e6eed5..ef19d34c 100644
--- a/internal/config/config_linux.go
+++ b/internal/config/config_linux.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build linux
+// +build linux
package config
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 668d6769..625bdcdc 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -19,7 +19,6 @@ import (
"encoding/json"
"os"
"path/filepath"
- "slices"
"testing"
"github.com/sftpgo/sdk/kms"
@@ -37,6 +36,7 @@ import (
"github.com/drakkan/sftpgo/v2/internal/plugin"
"github.com/drakkan/sftpgo/v2/internal/sftpd"
"github.com/drakkan/sftpgo/v2/internal/smtp"
+ "github.com/drakkan/sftpgo/v2/internal/util"
"github.com/drakkan/sftpgo/v2/internal/webdavd"
)
@@ -243,26 +243,6 @@ func TestInvalidInstallationHint(t *testing.T) {
assert.NoError(t, err)
}
-func TestInvalidRenameMode(t *testing.T) {
- reset()
-
- confName := tempConfigName + ".json"
- configFilePath := filepath.Join(configDir, confName)
- commonConfig := config.GetCommonConfig()
- commonConfig.RenameMode = 10
- c := make(map[string]any)
- c["common"] = commonConfig
- jsonConf, err := json.Marshal(c)
- assert.NoError(t, err)
- err = os.WriteFile(configFilePath, jsonConf, os.ModePerm)
- assert.NoError(t, err)
- err = config.LoadConfig(configDir, confName)
- assert.NoError(t, err)
- assert.Equal(t, 0, config.GetCommonConfig().RenameMode)
- err = os.Remove(configFilePath)
- assert.NoError(t, err)
-}
-
func TestDefenderProviderDriver(t *testing.T) {
if config.GetProviderConf().Driver != dataprovider.SQLiteDataProviderName {
t.Skip("this test is not supported with the current database provider")
@@ -343,18 +323,6 @@ func TestSetGetConfig(t *testing.T) {
if assert.Len(t, config.GetPluginsConfig(), 1) {
assert.Equal(t, pluginConf[0].Type, config.GetPluginsConfig()[0].Type)
}
- assert.False(t, config.HasKMSPlugin())
- pluginConf = []plugin.Config{
- {
- Type: "notifier",
- },
- {
- Type: "kms",
- },
- }
- config.SetPluginsConfig(pluginConf)
- assert.Len(t, config.GetPluginsConfig(), 2)
- assert.True(t, config.HasKMSPlugin())
}
func TestServiceToStart(t *testing.T) {
@@ -540,7 +508,7 @@ func TestOverrideSliceValues(t *testing.T) {
c = make(map[string]any)
c["httpd"] = httpd.Conf{
- Bindings: nil,
+ Bindings: []httpd.Binding{},
}
jsonConf, err = json.Marshal(c)
assert.NoError(t, err)
@@ -711,8 +679,8 @@ func TestPluginsFromEnv(t *testing.T) {
pluginConf := pluginsConf[0]
require.Equal(t, "notifier", pluginConf.Type)
require.Len(t, pluginConf.NotifierOptions.FsEvents, 2)
- require.True(t, slices.Contains(pluginConf.NotifierOptions.FsEvents, "upload"))
- require.True(t, slices.Contains(pluginConf.NotifierOptions.FsEvents, "download"))
+ require.True(t, util.Contains(pluginConf.NotifierOptions.FsEvents, "upload"))
+ require.True(t, util.Contains(pluginConf.NotifierOptions.FsEvents, "download"))
require.Len(t, pluginConf.NotifierOptions.ProviderEvents, 2)
require.Equal(t, "add", pluginConf.NotifierOptions.ProviderEvents[0])
require.Equal(t, "update", pluginConf.NotifierOptions.ProviderEvents[1])
@@ -761,8 +729,8 @@ func TestPluginsFromEnv(t *testing.T) {
pluginConf = pluginsConf[0]
require.Equal(t, "notifier", pluginConf.Type)
require.Len(t, pluginConf.NotifierOptions.FsEvents, 2)
- require.True(t, slices.Contains(pluginConf.NotifierOptions.FsEvents, "upload"))
- require.True(t, slices.Contains(pluginConf.NotifierOptions.FsEvents, "download"))
+ require.True(t, util.Contains(pluginConf.NotifierOptions.FsEvents, "upload"))
+ require.True(t, util.Contains(pluginConf.NotifierOptions.FsEvents, "download"))
require.Len(t, pluginConf.NotifierOptions.ProviderEvents, 2)
require.Equal(t, "add", pluginConf.NotifierOptions.ProviderEvents[0])
require.Equal(t, "update", pluginConf.NotifierOptions.ProviderEvents[1])
@@ -819,8 +787,8 @@ func TestRateLimitersFromEnv(t *testing.T) {
require.Equal(t, 2, limiters[0].Type)
protocols := limiters[0].Protocols
require.Len(t, protocols, 2)
- require.True(t, slices.Contains(protocols, common.ProtocolFTP))
- require.True(t, slices.Contains(protocols, common.ProtocolSSH))
+ require.True(t, util.Contains(protocols, common.ProtocolFTP))
+ require.True(t, util.Contains(protocols, common.ProtocolSSH))
require.True(t, limiters[0].GenerateDefenderEvents)
require.Equal(t, 50, limiters[0].EntriesSoftLimit)
require.Equal(t, 100, limiters[0].EntriesHardLimit)
@@ -831,10 +799,10 @@ func TestRateLimitersFromEnv(t *testing.T) {
require.Equal(t, 2, limiters[1].Type)
protocols = limiters[1].Protocols
require.Len(t, protocols, 4)
- require.True(t, slices.Contains(protocols, common.ProtocolFTP))
- require.True(t, slices.Contains(protocols, common.ProtocolSSH))
- require.True(t, slices.Contains(protocols, common.ProtocolWebDAV))
- require.True(t, slices.Contains(protocols, common.ProtocolHTTP))
+ require.True(t, util.Contains(protocols, common.ProtocolFTP))
+ require.True(t, util.Contains(protocols, common.ProtocolSSH))
+ require.True(t, util.Contains(protocols, common.ProtocolWebDAV))
+ require.True(t, util.Contains(protocols, common.ProtocolHTTP))
require.False(t, limiters[1].GenerateDefenderEvents)
require.Equal(t, 100, limiters[1].EntriesSoftLimit)
require.Equal(t, 150, limiters[1].EntriesHardLimit)
@@ -942,6 +910,7 @@ func TestFTPDBindingsFromEnv(t *testing.T) {
os.Setenv("SFTPGO_FTPD__BINDINGS__0__PORT", "2200")
os.Setenv("SFTPGO_FTPD__BINDINGS__0__APPLY_PROXY_CONFIG", "f")
os.Setenv("SFTPGO_FTPD__BINDINGS__0__TLS_MODE", "2")
+ os.Setenv("SFTPGO_FTPD__BINDINGS__0__TLS_SESSION_REUSE", "1")
os.Setenv("SFTPGO_FTPD__BINDINGS__0__FORCE_PASSIVE_IP", "127.0.1.2")
os.Setenv("SFTPGO_FTPD__BINDINGS__0__PASSIVE_IP_OVERRIDES__0__IP", "172.16.1.1")
os.Setenv("SFTPGO_FTPD__BINDINGS__0__PASSIVE_HOST", "127.0.1.3")
@@ -966,6 +935,7 @@ func TestFTPDBindingsFromEnv(t *testing.T) {
os.Unsetenv("SFTPGO_FTPD__BINDINGS__0__PORT")
os.Unsetenv("SFTPGO_FTPD__BINDINGS__0__APPLY_PROXY_CONFIG")
os.Unsetenv("SFTPGO_FTPD__BINDINGS__0__TLS_MODE")
+ os.Unsetenv("SFTPGO_FTPD__BINDINGS__0__TLS_SESSION_REUSE")
os.Unsetenv("SFTPGO_FTPD__BINDINGS__0__FORCE_PASSIVE_IP")
os.Unsetenv("SFTPGO_FTPD__BINDINGS__0__PASSIVE_IP_OVERRIDES__0__IP")
os.Unsetenv("SFTPGO_FTPD__BINDINGS__0__PASSIVE_HOST")
@@ -994,6 +964,7 @@ func TestFTPDBindingsFromEnv(t *testing.T) {
require.Equal(t, "127.0.0.1", bindings[0].Address)
require.False(t, bindings[0].ApplyProxyConfig)
require.Equal(t, 2, bindings[0].TLSMode)
+ require.Equal(t, 1, bindings[0].TLSSessionReuse)
require.Equal(t, 12, bindings[0].MinTLSVersion)
require.Equal(t, "127.0.1.2", bindings[0].ForcePassiveIP)
require.Len(t, bindings[0].PassiveIPOverrides, 0)
@@ -1005,10 +976,12 @@ func TestFTPDBindingsFromEnv(t *testing.T) {
require.False(t, bindings[0].Debug)
require.Equal(t, 1, bindings[0].PassiveConnectionsSecurity)
require.Equal(t, 0, bindings[0].ActiveConnectionsSecurity)
+ require.Equal(t, 0, bindings[0].IgnoreASCIITransferType)
require.Equal(t, 2203, bindings[1].Port)
require.Equal(t, "127.0.1.1", bindings[1].Address)
require.True(t, bindings[1].ApplyProxyConfig) // default value
require.Equal(t, 1, bindings[1].TLSMode)
+ require.Equal(t, 0, bindings[1].TLSSessionReuse)
require.Equal(t, 13, bindings[1].MinTLSVersion)
require.Equal(t, "127.0.1.1", bindings[1].ForcePassiveIP)
require.Empty(t, bindings[1].PassiveHost)
@@ -1021,6 +994,7 @@ func TestFTPDBindingsFromEnv(t *testing.T) {
require.Nil(t, bindings[1].TLSCipherSuites)
require.Equal(t, 0, bindings[1].PassiveConnectionsSecurity)
require.Equal(t, 1, bindings[1].ActiveConnectionsSecurity)
+ require.Equal(t, 1, bindings[1].IgnoreASCIITransferType)
require.True(t, bindings[1].Debug)
require.Equal(t, "cert.crt", bindings[1].CertificateFile)
require.Equal(t, "cert.key", bindings[1].CertificateKeyFile)
@@ -1100,7 +1074,6 @@ func TestWebDAVBindingsFromEnv(t *testing.T) {
os.Setenv("SFTPGO_WEBDAVD__BINDINGS__1__ENABLE_HTTPS", "0")
os.Setenv("SFTPGO_WEBDAVD__BINDINGS__1__TLS_CIPHER_SUITES", "TLS_RSA_WITH_AES_128_CBC_SHA ")
os.Setenv("SFTPGO_WEBDAVD__BINDINGS__1__TLS_PROTOCOLS", "http/1.1 ")
- os.Setenv("SFTPGO_WEBDAVD__BINDINGS__1__PROXY_MODE", "1")
os.Setenv("SFTPGO_WEBDAVD__BINDINGS__1__PROXY_ALLOWED", "192.168.10.1")
os.Setenv("SFTPGO_WEBDAVD__BINDINGS__1__CLIENT_IP_PROXY_HEADER", "X-Forwarded-For")
os.Setenv("SFTPGO_WEBDAVD__BINDINGS__1__CLIENT_IP_HEADER_DEPTH", "2")
@@ -1120,7 +1093,6 @@ func TestWebDAVBindingsFromEnv(t *testing.T) {
os.Unsetenv("SFTPGO_WEBDAVD__BINDINGS__1__ENABLE_HTTPS")
os.Unsetenv("SFTPGO_WEBDAVD__BINDINGS__1__TLS_CIPHER_SUITES")
os.Unsetenv("SFTPGO_WEBDAVD__BINDINGS__1__TLS_PROTOCOLS")
- os.Unsetenv("SFTPGO_WEBDAVD__BINDINGS__1__PROXY_MODE")
os.Unsetenv("SFTPGO_WEBDAVD__BINDINGS__1__PROXY_ALLOWED")
os.Unsetenv("SFTPGO_WEBDAVD__BINDINGS__1__CLIENT_IP_PROXY_HEADER")
os.Unsetenv("SFTPGO_WEBDAVD__BINDINGS__1__CLIENT_IP_HEADER_DEPTH")
@@ -1145,7 +1117,6 @@ func TestWebDAVBindingsFromEnv(t *testing.T) {
require.Equal(t, 12, bindings[0].MinTLSVersion)
require.Len(t, bindings[0].TLSCipherSuites, 0)
require.Len(t, bindings[0].Protocols, 0)
- require.Equal(t, 0, bindings[0].ProxyMode)
require.Empty(t, bindings[0].Prefix)
require.Equal(t, 0, bindings[0].ClientIPHeaderDepth)
require.False(t, bindings[0].DisableWWWAuthHeader)
@@ -1158,7 +1129,6 @@ func TestWebDAVBindingsFromEnv(t *testing.T) {
require.Equal(t, "TLS_RSA_WITH_AES_128_CBC_SHA", bindings[1].TLSCipherSuites[0])
require.Len(t, bindings[1].Protocols, 1)
assert.Equal(t, "http/1.1", bindings[1].Protocols[0])
- require.Equal(t, 1, bindings[1].ProxyMode)
require.Equal(t, "192.168.10.1", bindings[1].ProxyAllowed[0])
require.Equal(t, "X-Forwarded-For", bindings[1].ClientIPProxyHeader)
require.Equal(t, 2, bindings[1].ClientIPHeaderDepth)
@@ -1169,7 +1139,6 @@ func TestWebDAVBindingsFromEnv(t *testing.T) {
require.True(t, bindings[2].EnableHTTPS)
require.Equal(t, 13, bindings[2].MinTLSVersion)
require.Equal(t, 1, bindings[2].ClientAuthType)
- require.Equal(t, 0, bindings[2].ProxyMode)
require.Nil(t, bindings[2].TLSCipherSuites)
require.Equal(t, "/dav2", bindings[2].Prefix)
require.Equal(t, "webdav.crt", bindings[2].CertificateFile)
@@ -1198,16 +1167,12 @@ func TestHTTPDBindingsFromEnv(t *testing.T) {
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__ENABLE_WEB_CLIENT", "0")
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__ENABLE_REST_API", "0")
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__ENABLED_LOGIN_METHODS", "3")
- os.Setenv("SFTPGO_HTTPD__BINDINGS__2__DISABLED_LOGIN_METHODS", "12")
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__RENDER_OPENAPI", "0")
- os.Setenv("SFTPGO_HTTPD__BINDINGS__2__BASE_URL", "https://example.com")
- os.Setenv("SFTPGO_HTTPD__BINDINGS__2__LANGUAGES", "en,es")
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__ENABLE_HTTPS", "1 ")
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__MIN_TLS_VERSION", "13")
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__CLIENT_AUTH_TYPE", "1")
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__TLS_CIPHER_SUITES", " TLS_AES_256_GCM_SHA384 , TLS_CHACHA20_POLY1305_SHA256")
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__TLS_PROTOCOLS", "h2, http/1.1")
- os.Setenv("SFTPGO_HTTPD__BINDINGS__2__PROXY_MODE", "1")
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__PROXY_ALLOWED", " 192.168.9.1 , 172.16.25.0/24")
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__CLIENT_IP_PROXY_HEADER", "X-Real-IP")
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__CLIENT_IP_HEADER_DEPTH", "2")
@@ -1238,10 +1203,7 @@ func TestHTTPDBindingsFromEnv(t *testing.T) {
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__SECURITY__CONTENT_SECURITY_POLICY", "script-src $NONCE")
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__SECURITY__PERMISSIONS_POLICY", "fullscreen=(), geolocation=()")
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__SECURITY__CROSS_ORIGIN_OPENER_POLICY", "same-origin")
- os.Setenv("SFTPGO_HTTPD__BINDINGS__2__SECURITY__CROSS_ORIGIN_RESOURCE_POLICY", "same-site")
- os.Setenv("SFTPGO_HTTPD__BINDINGS__2__SECURITY__CROSS_ORIGIN_EMBEDDER_POLICY", "require-corp")
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__SECURITY__CACHE_CONTROL", "private")
- os.Setenv("SFTPGO_HTTPD__BINDINGS__2__SECURITY__REFERRER_POLICY", "no-referrer")
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__EXTRA_CSS__0__PATH", "path1")
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__EXTRA_CSS__1__PATH", "path2")
os.Setenv("SFTPGO_HTTPD__BINDINGS__2__BRANDING__WEB_ADMIN__FAVICON_PATH", "favicon.ico")
@@ -1272,14 +1234,10 @@ func TestHTTPDBindingsFromEnv(t *testing.T) {
os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__ENABLE_WEB_CLIENT")
os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__ENABLE_REST_API")
os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__ENABLED_LOGIN_METHODS")
- os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__DISABLED_LOGIN_METHODS")
os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__RENDER_OPENAPI")
- os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__BASE_URL")
- os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__LANGUAGES")
os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__CLIENT_AUTH_TYPE")
os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__TLS_CIPHER_SUITES")
os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__TLS_PROTOCOLS")
- os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__PROXY_MODE")
os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__PROXY_ALLOWED")
os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__CLIENT_IP_PROXY_HEADER")
os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__CLIENT_IP_HEADER_DEPTH")
@@ -1310,10 +1268,7 @@ func TestHTTPDBindingsFromEnv(t *testing.T) {
os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__SECURITY__CONTENT_SECURITY_POLICY")
os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__SECURITY__PERMISSIONS_POLICY")
os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__SECURITY__CROSS_ORIGIN_OPENER_POLICY")
- os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__SECURITY__CROSS_ORIGIN_RESOURCE_POLICY")
- os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__SECURITY__CROSS_ORIGIN_EMBEDDER_POLICY")
os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__SECURITY__CACHE_CONTROL")
- os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__SECURITY__REFERRER_POLICY")
os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__EXTRA_CSS__0__PATH")
os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__EXTRA_CSS__1__PATH")
os.Unsetenv("SFTPGO_HTTPD__BINDINGS__2__BRANDING__WEB_ADMIN__FAVICON_PATH")
@@ -1339,13 +1294,8 @@ func TestHTTPDBindingsFromEnv(t *testing.T) {
require.True(t, bindings[0].EnableWebClient)
require.True(t, bindings[0].EnableRESTAPI)
require.Equal(t, 0, bindings[0].EnabledLoginMethods)
- require.Equal(t, 0, bindings[0].DisabledLoginMethods)
require.True(t, bindings[0].RenderOpenAPI)
- require.Empty(t, bindings[0].BaseURL)
- require.Len(t, bindings[0].Languages, 1)
- assert.Contains(t, bindings[0].Languages, "en")
require.Len(t, bindings[0].TLSCipherSuites, 1)
- require.Equal(t, 0, bindings[0].ProxyMode)
require.Empty(t, bindings[0].OIDC.ConfigURL)
require.Equal(t, "TLS_AES_128_GCM_SHA256", bindings[0].TLSCipherSuites[0])
require.Equal(t, 0, bindings[0].HideLoginURL)
@@ -1354,7 +1304,6 @@ func TestHTTPDBindingsFromEnv(t *testing.T) {
require.Len(t, bindings[0].OIDC.Scopes, 3)
require.False(t, bindings[0].OIDC.InsecureSkipSignatureCheck)
require.False(t, bindings[0].OIDC.Debug)
- require.Empty(t, bindings[0].Security.ReferrerPolicy)
require.Equal(t, 8000, bindings[1].Port)
require.Equal(t, "127.0.0.1", bindings[1].Address)
require.False(t, bindings[1].EnableHTTPS)
@@ -1363,11 +1312,7 @@ func TestHTTPDBindingsFromEnv(t *testing.T) {
require.True(t, bindings[1].EnableWebClient)
require.True(t, bindings[1].EnableRESTAPI)
require.Equal(t, 0, bindings[1].EnabledLoginMethods)
- require.Equal(t, 0, bindings[1].DisabledLoginMethods)
require.True(t, bindings[1].RenderOpenAPI)
- require.Empty(t, bindings[1].BaseURL)
- require.Len(t, bindings[1].Languages, 1)
- assert.Contains(t, bindings[1].Languages, "en")
require.Nil(t, bindings[1].TLSCipherSuites)
require.Equal(t, 1, bindings[1].HideLoginURL)
require.Empty(t, bindings[1].OIDC.ClientID)
@@ -1377,7 +1322,6 @@ func TestHTTPDBindingsFromEnv(t *testing.T) {
require.False(t, bindings[1].Security.Enabled)
require.Equal(t, "Web Admin", bindings[1].Branding.WebAdmin.Name)
require.Equal(t, "WebClient", bindings[1].Branding.WebClient.ShortName)
- require.Equal(t, 0, bindings[1].ProxyMode)
require.Equal(t, 0, bindings[1].ClientIPHeaderDepth)
require.Equal(t, 9000, bindings[2].Port)
require.Equal(t, "127.0.1.1", bindings[2].Address)
@@ -1387,12 +1331,7 @@ func TestHTTPDBindingsFromEnv(t *testing.T) {
require.False(t, bindings[2].EnableWebClient)
require.False(t, bindings[2].EnableRESTAPI)
require.Equal(t, 3, bindings[2].EnabledLoginMethods)
- require.Equal(t, 12, bindings[2].DisabledLoginMethods)
require.False(t, bindings[2].RenderOpenAPI)
- require.Equal(t, "https://example.com", bindings[2].BaseURL)
- require.Len(t, bindings[2].Languages, 2)
- assert.Contains(t, bindings[2].Languages, "en")
- assert.Contains(t, bindings[2].Languages, "es")
require.Equal(t, 1, bindings[2].ClientAuthType)
require.Len(t, bindings[2].TLSCipherSuites, 2)
require.Equal(t, "TLS_AES_256_GCM_SHA384", bindings[2].TLSCipherSuites[0])
@@ -1400,7 +1339,6 @@ func TestHTTPDBindingsFromEnv(t *testing.T) {
require.Len(t, bindings[2].Protocols, 2)
require.Equal(t, "h2", bindings[2].Protocols[0])
require.Equal(t, "http/1.1", bindings[2].Protocols[1])
- require.Equal(t, 1, bindings[2].ProxyMode)
require.Len(t, bindings[2].ProxyAllowed, 2)
require.Equal(t, "192.168.9.1", bindings[2].ProxyAllowed[0])
require.Equal(t, "172.16.25.0/24", bindings[2].ProxyAllowed[1])
@@ -1440,10 +1378,7 @@ func TestHTTPDBindingsFromEnv(t *testing.T) {
require.Equal(t, "script-src $NONCE", bindings[2].Security.ContentSecurityPolicy)
require.Equal(t, "fullscreen=(), geolocation=()", bindings[2].Security.PermissionsPolicy)
require.Equal(t, "same-origin", bindings[2].Security.CrossOriginOpenerPolicy)
- require.Equal(t, "same-site", bindings[2].Security.CrossOriginResourcePolicy)
- require.Equal(t, "require-corp", bindings[2].Security.CrossOriginEmbedderPolicy)
require.Equal(t, "private", bindings[2].Security.CacheControl)
- require.Equal(t, "no-referrer", bindings[2].Security.ReferrerPolicy)
require.Equal(t, "favicon.ico", bindings[2].Branding.WebAdmin.FaviconPath)
require.Equal(t, "logo.png", bindings[2].Branding.WebClient.LogoPath)
require.Equal(t, "disclaimer", bindings[2].Branding.WebClient.DisclaimerName)
diff --git a/internal/dataprovider/actions.go b/internal/dataprovider/actions.go
index b61e5b0a..066b7bf7 100644
--- a/internal/dataprovider/actions.go
+++ b/internal/dataprovider/actions.go
@@ -21,7 +21,6 @@ import (
"net/url"
"os/exec"
"path/filepath"
- "slices"
"strings"
"time"
@@ -79,8 +78,8 @@ func executeAction(operation, executor, ip, objectType, objectName, role string,
if config.Actions.Hook == "" {
return
}
- if !slices.Contains(config.Actions.ExecuteOn, operation) ||
- !slices.Contains(config.Actions.ExecuteFor, objectType) {
+ if !util.Contains(config.Actions.ExecuteOn, operation) ||
+ !util.Contains(config.Actions.ExecuteFor, objectType) {
return
}
@@ -142,14 +141,14 @@ func executeNotificationCommand(operation, executor, ip, objectType, objectName,
cmd := exec.CommandContext(ctx, config.Actions.Hook, args...)
cmd.Env = append(env,
- fmt.Sprintf("SFTPGO_PROVIDER_ACTION=%s", operation),
+ fmt.Sprintf("SFTPGO_PROVIDER_ACTION=%vs", operation),
fmt.Sprintf("SFTPGO_PROVIDER_OBJECT_TYPE=%s", objectType),
fmt.Sprintf("SFTPGO_PROVIDER_OBJECT_NAME=%s", objectName),
fmt.Sprintf("SFTPGO_PROVIDER_USERNAME=%s", executor),
fmt.Sprintf("SFTPGO_PROVIDER_IP=%s", ip),
fmt.Sprintf("SFTPGO_PROVIDER_ROLE=%s", role),
fmt.Sprintf("SFTPGO_PROVIDER_TIMESTAMP=%d", util.GetTimeAsMsSinceEpoch(time.Now())),
- fmt.Sprintf("SFTPGO_PROVIDER_OBJECT=%s", objectAsJSON))
+ fmt.Sprintf("SFTPGO_PROVIDER_OBJECT=%s", util.BytesToString(objectAsJSON)))
startTime := time.Now()
err := cmd.Run()
diff --git a/internal/dataprovider/admin.go b/internal/dataprovider/admin.go
index dea4a20b..aca524f2 100644
--- a/internal/dataprovider/admin.go
+++ b/internal/dataprovider/admin.go
@@ -20,7 +20,6 @@ import (
"fmt"
"net"
"os"
- "slices"
"strconv"
"strings"
@@ -87,7 +86,7 @@ func (c *AdminTOTPConfig) validate(username string) error {
if c.ConfigName == "" {
return util.NewValidationError("totp: config name is mandatory")
}
- if !slices.Contains(mfa.GetAvailableTOTPConfigNames(), c.ConfigName) {
+ if !util.Contains(mfa.GetAvailableTOTPConfigNames(), c.ConfigName) {
return util.NewValidationError(fmt.Sprintf("totp: config name %q not found", c.ConfigName))
}
if c.Secret.IsEmpty() {
@@ -323,15 +322,15 @@ func (a *Admin) validatePermissions() error {
util.I18nErrorPermissionsRequired,
)
}
- if slices.Contains(a.Permissions, PermAdminAny) {
+ if util.Contains(a.Permissions, PermAdminAny) {
a.Permissions = []string{PermAdminAny}
}
for _, perm := range a.Permissions {
- if !slices.Contains(validAdminPerms, perm) {
+ if !util.Contains(validAdminPerms, perm) {
return util.NewValidationError(fmt.Sprintf("invalid permission: %q", perm))
}
if a.Role != "" {
- if slices.Contains(forbiddenPermsForRoleAdmins, perm) {
+ if util.Contains(forbiddenPermsForRoleAdmins, perm) {
return util.NewI18nError(
util.NewValidationError("a role admin cannot be a super admin"),
util.I18nErrorRoleAdminPerms,
@@ -364,24 +363,11 @@ func (a *Admin) validateGroups() error {
return nil
}
-func (a *Admin) applyNamingRules() {
- a.Username = config.convertName(a.Username)
- a.Role = config.convertName(a.Role)
- for idx := range a.Groups {
- a.Groups[idx].Name = config.convertName(a.Groups[idx].Name)
- }
-}
-
-func (a *Admin) validate() error { //nolint:gocyclo
+func (a *Admin) validate() error {
a.SetEmptySecretsIfNil()
- a.applyNamingRules()
- a.Password = strings.TrimSpace(a.Password)
if a.Username == "" {
return util.NewI18nError(util.NewValidationError("username is mandatory"), util.I18nErrorUsernameRequired)
}
- if !util.IsNameValid(a.Username) {
- return util.NewI18nError(errInvalidInput, util.I18nErrorInvalidInput)
- }
if err := checkReservedUsernames(a.Username); err != nil {
return util.NewI18nError(err, util.I18nErrorReservedUsername)
}
@@ -494,7 +480,7 @@ func (a *Admin) checkUserAndPass(password, ip string) error {
if err := a.CanLogin(ip); err != nil {
return err
}
- if a.Password == "" || strings.TrimSpace(password) == "" {
+ if a.Password == "" || password == "" {
return errors.New("credentials cannot be null or empty")
}
match, err := a.CheckPassword(password)
@@ -554,20 +540,10 @@ func (a *Admin) SetNilSecretsIfEmpty() {
// HasPermission returns true if the admin has the specified permission
func (a *Admin) HasPermission(perm string) bool {
- if slices.Contains(a.Permissions, PermAdminAny) {
+ if util.Contains(a.Permissions, PermAdminAny) {
return true
}
- return slices.Contains(a.Permissions, perm)
-}
-
-// HasPermissions returns true if the admin has all the specified permissions
-func (a *Admin) HasPermissions(perms ...string) bool {
- for _, perm := range perms {
- if !a.HasPermission(perm) {
- return false
- }
- }
- return len(perms) > 0
+ return util.Contains(a.Permissions, perm)
}
// GetAllowedIPAsString returns the allowed IP as comma separated string
diff --git a/internal/dataprovider/apikey.go b/internal/dataprovider/apikey.go
index b7424dd6..b6c8499d 100644
--- a/internal/dataprovider/apikey.go
+++ b/internal/dataprovider/apikey.go
@@ -148,9 +148,6 @@ func (k *APIKey) validate() error {
if k.Name == "" {
return util.NewValidationError("name is mandatory")
}
- if !util.IsNameValid(k.Name) {
- return util.NewI18nError(errInvalidInput, util.I18nErrorInvalidInput)
- }
if k.Scope != APIKeyScopeAdmin && k.Scope != APIKeyScopeUser {
return util.NewValidationError(fmt.Sprintf("invalid scope: %v", k.Scope))
}
diff --git a/internal/dataprovider/bolt.go b/internal/dataprovider/bolt.go
index 28adb25f..01ad0b3e 100644
--- a/internal/dataprovider/bolt.go
+++ b/internal/dataprovider/bolt.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build !nobolt
+// +build !nobolt
package dataprovider
@@ -24,13 +25,10 @@ import (
"fmt"
"net/netip"
"path/filepath"
- "slices"
"sort"
- "strconv"
"time"
bolt "go.etcd.io/bbolt"
- bolterrors "go.etcd.io/bbolt/errors"
"github.com/drakkan/sftpgo/v2/internal/logger"
"github.com/drakkan/sftpgo/v2/internal/util"
@@ -39,7 +37,7 @@ import (
)
const (
- boltDatabaseVersion = 34
+ boltDatabaseVersion = 29
)
var (
@@ -183,50 +181,6 @@ func (p *BoltProvider) updateAPIKeyLastUse(keyID string) error {
})
}
-func (p *BoltProvider) getAdminSignature(username string) (string, error) {
- var updatedAt int64
- err := p.dbHandle.View(func(tx *bolt.Tx) error {
- bucket, err := p.getAdminsBucket(tx)
- if err != nil {
- return err
- }
- u := bucket.Get([]byte(username))
- var admin Admin
- err = json.Unmarshal(u, &admin)
- if err != nil {
- return err
- }
- updatedAt = admin.UpdatedAt
- return nil
- })
- if err != nil {
- return "", err
- }
- return strconv.FormatInt(updatedAt, 10), nil
-}
-
-func (p *BoltProvider) getUserSignature(username string) (string, error) {
- var updatedAt int64
- err := p.dbHandle.View(func(tx *bolt.Tx) error {
- bucket, err := p.getUsersBucket(tx)
- if err != nil {
- return err
- }
- u := bucket.Get([]byte(username))
- var user User
- err = json.Unmarshal(u, &user)
- if err != nil {
- return err
- }
- updatedAt = user.UpdatedAt
- return nil
- })
- if err != nil {
- return "", err
- }
- return strconv.FormatInt(updatedAt, 10), nil
-}
-
func (p *BoltProvider) setUpdatedAt(username string) {
p.dbHandle.Update(func(tx *bolt.Tx) error { //nolint:errcheck
bucket, err := p.getUsersBucket(tx)
@@ -446,6 +400,9 @@ func (p *BoltProvider) addAdmin(admin *Admin) error {
admin.LastLogin = 0
admin.CreatedAt = util.GetTimeAsMsSinceEpoch(time.Now())
admin.UpdatedAt = util.GetTimeAsMsSinceEpoch(time.Now())
+ sort.Slice(admin.Groups, func(i, j int) bool {
+ return admin.Groups[i].Name < admin.Groups[j].Name
+ })
for idx := range admin.Groups {
err = p.addAdminToGroupMapping(admin.Username, admin.Groups[idx].Name, groupBucket)
if err != nil {
@@ -504,6 +461,9 @@ func (p *BoltProvider) updateAdmin(admin *Admin) error {
if err = p.addAdminToRole(admin.Username, admin.Role, rolesBucket); err != nil {
return err
}
+ sort.Slice(admin.Groups, func(i, j int) bool {
+ return admin.Groups[i].Name < admin.Groups[j].Name
+ })
for idx := range admin.Groups {
err = p.addAdminToGroupMapping(admin.Username, admin.Groups[idx].Name, groupBucket)
if err != nil {
@@ -715,12 +675,18 @@ func (p *BoltProvider) addUser(user *User) error {
if err := p.addUserToRole(user.Username, user.Role, rolesBucket); err != nil {
return err
}
+ sort.Slice(user.VirtualFolders, func(i, j int) bool {
+ return user.VirtualFolders[i].Name < user.VirtualFolders[j].Name
+ })
for idx := range user.VirtualFolders {
err = p.addRelationToFolderMapping(user.VirtualFolders[idx].Name, user, nil, foldersBucket)
if err != nil {
return err
}
}
+ sort.Slice(user.Groups, func(i, j int) bool {
+ return user.Groups[i].Name < user.Groups[j].Name
+ })
for idx := range user.Groups {
err = p.addUserToGroupMapping(user.Username, user.Groups[idx].Name, groupBucket)
if err != nil {
@@ -1492,6 +1458,9 @@ func (p *BoltProvider) addGroup(group *Group) error {
group.UpdatedAt = util.GetTimeAsMsSinceEpoch(time.Now())
group.Users = nil
group.Admins = nil
+ sort.Slice(group.VirtualFolders, func(i, j int) bool {
+ return group.VirtualFolders[i].Name < group.VirtualFolders[j].Name
+ })
for idx := range group.VirtualFolders {
err = p.addRelationToFolderMapping(group.VirtualFolders[idx].Name, nil, group, foldersBucket)
if err != nil {
@@ -1534,6 +1503,9 @@ func (p *BoltProvider) updateGroup(group *Group) error {
return err
}
}
+ sort.Slice(group.VirtualFolders, func(i, j int) bool {
+ return group.VirtualFolders[i].Name < group.VirtualFolders[j].Name
+ })
for idx := range group.VirtualFolders {
err = p.addRelationToFolderMapping(group.VirtualFolders[idx].Name, nil, group, foldersBucket)
if err != nil {
@@ -2116,11 +2088,11 @@ func (p *BoltProvider) addSharedSession(_ Session) error {
return ErrNotImplemented
}
-func (p *BoltProvider) deleteSharedSession(_ string, _ SessionType) error {
+func (p *BoltProvider) deleteSharedSession(_ string) error {
return ErrNotImplemented
}
-func (p *BoltProvider) getSharedSession(_ string, _ SessionType) (Session, error) {
+func (p *BoltProvider) getSharedSession(_ string) (Session, error) {
return Session{}, ErrNotImplemented
}
@@ -3162,16 +3134,15 @@ func (p *BoltProvider) migrateDatabase() error {
case version == boltDatabaseVersion:
providerLog(logger.LevelDebug, "bolt database is up to date, current version: %d", version)
return ErrNoInitRequired
- case version < 33:
- err = errSchemaVersionTooOld(version)
+ case version < 28:
+ err = fmt.Errorf("database schema version %d is too old, please see the upgrading docs", version)
providerLog(logger.LevelError, "%v", err)
logger.ErrorToConsole("%v", err)
return err
- case version == 33:
- logger.InfoToConsole("updating database schema version: %d -> 34", version)
- providerLog(logger.LevelInfo, "updating database schema version: %d -> 34", version)
- return updateBoltDatabaseVersion(p.dbHandle, 34)
-
+ case version == 28:
+ logger.InfoToConsole("updating database schema version: %d -> 29", version)
+ providerLog(logger.LevelInfo, "updating database schema version: %d -> 29", version)
+ return updateBoltDatabaseVersion(p.dbHandle, 29)
default:
if version > boltDatabaseVersion {
providerLog(logger.LevelError, "database schema version %d is newer than the supported one: %d", version,
@@ -3184,7 +3155,7 @@ func (p *BoltProvider) migrateDatabase() error {
}
}
-func (p *BoltProvider) revertDatabase(targetVersion int) error {
+func (p *BoltProvider) revertDatabase(targetVersion int) error { //nolint:gocyclo
dbVersion, err := getBoltDatabaseVersion(p.dbHandle)
if err != nil {
return err
@@ -3193,11 +3164,10 @@ func (p *BoltProvider) revertDatabase(targetVersion int) error {
return errors.New("current version match target version, nothing to do")
}
switch dbVersion.Version {
- case 34:
- logger.InfoToConsole("downgrading database schema version: %d -> 33", dbVersion.Version)
- providerLog(logger.LevelInfo, "downgrading database schema version: %d -> 33", dbVersion.Version)
- return updateBoltDatabaseVersion(p.dbHandle, 33)
-
+ case 29:
+ logger.InfoToConsole("downgrading database schema version: %d -> 28", dbVersion.Version)
+ providerLog(logger.LevelInfo, "downgrading database schema version: %d -> 28", dbVersion.Version)
+ return updateBoltDatabaseVersion(p.dbHandle, 28)
default:
return fmt.Errorf("database schema version not handled: %v", dbVersion.Version)
}
@@ -3207,7 +3177,7 @@ func (p *BoltProvider) resetDatabase() error {
return p.dbHandle.Update(func(tx *bolt.Tx) error {
for _, bucketName := range boltBuckets {
err := tx.DeleteBucket(bucketName)
- if err != nil && !errors.Is(err, bolterrors.ErrBucketNotFound) {
+ if err != nil && !errors.Is(err, bolt.ErrBucketNotFound) {
return fmt.Errorf("unable to remove bucket %v: %w", bucketName, err)
}
}
@@ -3358,7 +3328,7 @@ func (p *BoltProvider) addAdminToRole(username, roleName string, bucket *bolt.Bu
if err != nil {
return err
}
- if !slices.Contains(role.Admins, username) {
+ if !util.Contains(role.Admins, username) {
role.Admins = append(role.Admins, username)
buf, err := json.Marshal(role)
if err != nil {
@@ -3383,7 +3353,7 @@ func (p *BoltProvider) removeAdminFromRole(username, roleName string, bucket *bo
if err != nil {
return err
}
- if slices.Contains(role.Admins, username) {
+ if util.Contains(role.Admins, username) {
var admins []string
for _, admin := range role.Admins {
if admin != username {
@@ -3413,7 +3383,7 @@ func (p *BoltProvider) addUserToRole(username, roleName string, bucket *bolt.Buc
if err != nil {
return err
}
- if !slices.Contains(role.Users, username) {
+ if !util.Contains(role.Users, username) {
role.Users = append(role.Users, username)
buf, err := json.Marshal(role)
if err != nil {
@@ -3438,7 +3408,7 @@ func (p *BoltProvider) removeUserFromRole(username, roleName string, bucket *bol
if err != nil {
return err
}
- if slices.Contains(role.Users, username) {
+ if util.Contains(role.Users, username) {
var users []string
for _, user := range role.Users {
if user != username {
@@ -3466,7 +3436,7 @@ func (p *BoltProvider) addRuleToActionMapping(ruleName, actionName string, bucke
if err != nil {
return err
}
- if !slices.Contains(action.Rules, ruleName) {
+ if !util.Contains(action.Rules, ruleName) {
action.Rules = append(action.Rules, ruleName)
buf, err := json.Marshal(action)
if err != nil {
@@ -3488,7 +3458,7 @@ func (p *BoltProvider) removeRuleFromActionMapping(ruleName, actionName string,
if err != nil {
return err
}
- if slices.Contains(action.Rules, ruleName) {
+ if util.Contains(action.Rules, ruleName) {
var rules []string
for _, r := range action.Rules {
if r != ruleName {
@@ -3515,7 +3485,7 @@ func (p *BoltProvider) addUserToGroupMapping(username, groupname string, bucket
if err != nil {
return err
}
- if !slices.Contains(group.Users, username) {
+ if !util.Contains(group.Users, username) {
group.Users = append(group.Users, username)
buf, err := json.Marshal(group)
if err != nil {
@@ -3560,7 +3530,7 @@ func (p *BoltProvider) addAdminToGroupMapping(username, groupname string, bucket
if err != nil {
return err
}
- if !slices.Contains(group.Admins, username) {
+ if !util.Contains(group.Admins, username) {
group.Admins = append(group.Admins, username)
buf, err := json.Marshal(group)
if err != nil {
@@ -3631,11 +3601,11 @@ func (p *BoltProvider) addRelationToFolderMapping(folderName string, user *User,
return err
}
updated := false
- if user != nil && !slices.Contains(folder.Users, user.Username) {
+ if user != nil && !util.Contains(folder.Users, user.Username) {
folder.Users = append(folder.Users, user.Username)
updated = true
}
- if group != nil && !slices.Contains(folder.Groups, group.Name) {
+ if group != nil && !util.Contains(folder.Groups, group.Name) {
folder.Groups = append(folder.Groups, group.Name)
updated = true
}
@@ -3721,12 +3691,18 @@ func (p *BoltProvider) updateUserRelations(tx *bolt.Tx, user *User, oldUser User
if err = p.removeUserFromRole(oldUser.Username, oldUser.Role, rolesBucket); err != nil {
return err
}
+ sort.Slice(user.VirtualFolders, func(i, j int) bool {
+ return user.VirtualFolders[i].Name < user.VirtualFolders[j].Name
+ })
for idx := range user.VirtualFolders {
err = p.addRelationToFolderMapping(user.VirtualFolders[idx].Name, user, nil, foldersBucket)
if err != nil {
return err
}
}
+ sort.Slice(user.Groups, func(i, j int) bool {
+ return user.Groups[i].Name < user.Groups[j].Name
+ })
for idx := range user.Groups {
err = p.addUserToGroupMapping(user.Username, user.Groups[idx].Name, groupsBucket)
if err != nil {
@@ -3923,7 +3899,7 @@ func getBoltDatabaseVersion(dbHandle *bolt.DB) (schemaVersion, error) {
v := bucket.Get(dbVersionKey)
if v == nil {
dbVersion = schemaVersion{
- Version: 33,
+ Version: 28,
}
return nil
}
diff --git a/internal/dataprovider/bolt_disabled.go b/internal/dataprovider/bolt_disabled.go
index 0ec5030a..0116314d 100644
--- a/internal/dataprovider/bolt_disabled.go
+++ b/internal/dataprovider/bolt_disabled.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build nobolt
+// +build nobolt
package dataprovider
diff --git a/internal/dataprovider/configs.go b/internal/dataprovider/configs.go
index 22a9c5a4..a68abf72 100644
--- a/internal/dataprovider/configs.go
+++ b/internal/dataprovider/configs.go
@@ -15,12 +15,8 @@
package dataprovider
import (
- "bytes"
"encoding/json"
"fmt"
- "image/png"
- "net/url"
- "slices"
"golang.org/x/crypto/ssh"
@@ -32,18 +28,18 @@ import (
// Supported values for host keys, KEXs, ciphers, MACs
var (
supportedHostKeyAlgos = []string{ssh.KeyAlgoRSA}
- supportedPublicKeyAlgos = []string{ssh.KeyAlgoRSA, ssh.InsecureKeyAlgoDSA} //nolint:staticcheck
+ supportedPublicKeyAlgos = []string{ssh.KeyAlgoRSA, ssh.InsecureKeyAlgoDSA}
supportedKexAlgos = []string{
ssh.KeyExchangeDH16SHA512, ssh.InsecureKeyExchangeDH14SHA1, ssh.InsecureKeyExchangeDH1SHA1,
ssh.InsecureKeyExchangeDHGEXSHA1,
}
supportedCiphers = []string{
- ssh.InsecureCipherAES128CBC,
+ ssh.InsecureCipherAES128CBC, ssh.InsecureCipherAES192CBC, ssh.InsecureCipherAES256CBC,
ssh.InsecureCipherTripleDESCBC,
}
supportedMACs = []string{
ssh.HMACSHA512ETM, ssh.HMACSHA512,
- ssh.HMACSHA1, ssh.InsecureHMACSHA196,
+ ssh.InsecureHMACSHA1, ssh.InsecureHMACSHA196,
}
)
@@ -106,7 +102,7 @@ func (c *SFTPDConfigs) validate() error {
if algo == ssh.CertAlgoRSAv01 {
continue
}
- if !slices.Contains(supportedHostKeyAlgos, algo) {
+ if !util.Contains(supportedHostKeyAlgos, algo) {
return util.NewValidationError(fmt.Sprintf("unsupported host key algorithm %q", algo))
}
hostKeyAlgos = append(hostKeyAlgos, algo)
@@ -117,27 +113,24 @@ func (c *SFTPDConfigs) validate() error {
if algo == "diffie-hellman-group18-sha512" || algo == ssh.KeyExchangeDHGEXSHA256 {
continue
}
- if !slices.Contains(supportedKexAlgos, algo) {
+ if !util.Contains(supportedKexAlgos, algo) {
return util.NewValidationError(fmt.Sprintf("unsupported KEX algorithm %q", algo))
}
kexAlgos = append(kexAlgos, algo)
}
c.KexAlgorithms = kexAlgos
for _, cipher := range c.Ciphers {
- if slices.Contains([]string{"aes192-cbc", "aes256-cbc"}, cipher) {
- continue
- }
- if !slices.Contains(supportedCiphers, cipher) {
+ if !util.Contains(supportedCiphers, cipher) {
return util.NewValidationError(fmt.Sprintf("unsupported cipher %q", cipher))
}
}
for _, mac := range c.MACs {
- if !slices.Contains(supportedMACs, mac) {
+ if !util.Contains(supportedMACs, mac) {
return util.NewValidationError(fmt.Sprintf("unsupported MAC algorithm %q", mac))
}
}
for _, algo := range c.PublicKeyAlgos {
- if !slices.Contains(supportedPublicKeyAlgos, algo) {
+ if !util.Contains(supportedPublicKeyAlgos, algo) {
return util.NewValidationError(fmt.Sprintf("unsupported public key algorithm %q", algo))
}
}
@@ -200,19 +193,19 @@ func (c *SMTPOAuth2) validate() error {
if c.ClientID == "" {
return util.NewI18nError(
util.NewValidationError("smtp oauth2: client id is required"),
- util.I18nErrorClientIDRequired,
+ util.I18nErrorSMTPClientIDRequired,
)
}
- if c.ClientSecret == nil || c.ClientSecret.IsEmpty() {
+ if c.ClientSecret == nil {
return util.NewI18nError(
util.NewValidationError("smtp oauth2: client secret is required"),
- util.I18nErrorClientSecretRequired,
+ util.I18nErrorSMTPClientSecretRequired,
)
}
- if c.RefreshToken == nil || c.RefreshToken.IsEmpty() {
+ if c.RefreshToken == nil {
return util.NewI18nError(
util.NewValidationError("smtp oauth2: refresh token is required"),
- util.I18nErrorRefreshTokenRequired,
+ util.I18nErrorSMTPRefreshTokenRequired,
)
}
if err := validateSMTPSecret(c.ClientSecret, "oauth2 client secret"); err != nil {
@@ -312,27 +305,6 @@ func (c *SMTPConfigs) TryDecrypt() error {
return nil
}
-func (c *SMTPConfigs) prepareForRendering() {
- if c.Password != nil {
- c.Password.Hide()
- if c.Password.IsEmpty() {
- c.Password = nil
- }
- }
- if c.OAuth2.ClientSecret != nil {
- c.OAuth2.ClientSecret.Hide()
- if c.OAuth2.ClientSecret.IsEmpty() {
- c.OAuth2.ClientSecret = nil
- }
- }
- if c.OAuth2.RefreshToken != nil {
- c.OAuth2.RefreshToken.Hide()
- if c.OAuth2.RefreshToken.IsEmpty() {
- c.OAuth2.RefreshToken = nil
- }
- }
-}
-
func (c *SMTPConfigs) getACopy() *SMTPConfigs {
var password *kms.Secret
if c.Password != nil {
@@ -415,137 +387,13 @@ func (c *ACMEConfigs) getACopy() *ACMEConfigs {
}
}
-// BrandingConfig defines the branding configuration
-type BrandingConfig struct {
- Name string `json:"name"`
- ShortName string `json:"short_name"`
- Logo []byte `json:"logo"`
- Favicon []byte `json:"favicon"`
- DisclaimerName string `json:"disclaimer_name"`
- DisclaimerURL string `json:"disclaimer_url"`
-}
-
-func (c *BrandingConfig) isEmpty() bool {
- if c.Name != "" {
- return false
- }
- if c.ShortName != "" {
- return false
- }
- if len(c.Logo) > 0 {
- return false
- }
- if len(c.Favicon) > 0 {
- return false
- }
- if c.DisclaimerName != "" && c.DisclaimerURL != "" {
- return false
- }
- return true
-}
-
-func (*BrandingConfig) validatePNG(b []byte, maxWidth, maxHeight int) error {
- if len(b) == 0 {
- return nil
- }
- // DecodeConfig is more efficient, but I'm not sure if this would lead to
- // accepting invalid images in some edge cases and performance does not
- // matter here.
- img, err := png.Decode(bytes.NewBuffer(b))
- if err != nil {
- return util.NewI18nError(
- util.NewValidationError("invalid PNG image"),
- util.I18nErrorInvalidPNG,
- )
- }
- bounds := img.Bounds()
- if bounds.Dx() > maxWidth || bounds.Dy() > maxHeight {
- return util.NewI18nError(
- util.NewValidationError("invalid PNG image size"),
- util.I18nErrorInvalidPNGSize,
- )
- }
- return nil
-}
-
-func (c *BrandingConfig) validateDisclaimerURL() error {
- if c.DisclaimerURL == "" {
- return nil
- }
- u, err := url.Parse(c.DisclaimerURL)
- if err != nil {
- return util.NewI18nError(
- util.NewValidationError("invalid disclaimer URL"),
- util.I18nErrorInvalidDisclaimerURL,
- )
- }
- if u.Scheme != "http" && u.Scheme != "https" {
- return util.NewI18nError(
- util.NewValidationError("invalid disclaimer URL scheme"),
- util.I18nErrorInvalidDisclaimerURL,
- )
- }
- return nil
-}
-
-func (c *BrandingConfig) validate() error {
- if err := c.validateDisclaimerURL(); err != nil {
- return err
- }
- if err := c.validatePNG(c.Logo, 512, 512); err != nil {
- return err
- }
- return c.validatePNG(c.Favicon, 256, 256)
-}
-
-func (c *BrandingConfig) getACopy() BrandingConfig {
- logo := make([]byte, len(c.Logo))
- copy(logo, c.Logo)
- favicon := make([]byte, len(c.Favicon))
- copy(favicon, c.Favicon)
-
- return BrandingConfig{
- Name: c.Name,
- ShortName: c.ShortName,
- Logo: logo,
- Favicon: favicon,
- DisclaimerName: c.DisclaimerName,
- DisclaimerURL: c.DisclaimerURL,
- }
-}
-
-// BrandingConfigs defines the branding configuration for WebAdmin and WebClient UI
-type BrandingConfigs struct {
- WebAdmin BrandingConfig
- WebClient BrandingConfig
-}
-
-func (c *BrandingConfigs) isEmpty() bool {
- return c.WebAdmin.isEmpty() && c.WebClient.isEmpty()
-}
-
-func (c *BrandingConfigs) validate() error {
- if err := c.WebAdmin.validate(); err != nil {
- return err
- }
- return c.WebClient.validate()
-}
-
-func (c *BrandingConfigs) getACopy() *BrandingConfigs {
- return &BrandingConfigs{
- WebAdmin: c.WebAdmin.getACopy(),
- WebClient: c.WebClient.getACopy(),
- }
-}
-
// Configs allows to set configuration keys disabled by default without
// modifying the config file or setting env vars
type Configs struct {
- SFTPD *SFTPDConfigs `json:"sftpd,omitempty"`
- SMTP *SMTPConfigs `json:"smtp,omitempty"`
- ACME *ACMEConfigs `json:"acme,omitempty"`
- Branding *BrandingConfigs `json:"branding,omitempty"`
- UpdatedAt int64 `json:"updated_at,omitempty"`
+ SFTPD *SFTPDConfigs `json:"sftpd,omitempty"`
+ SMTP *SMTPConfigs `json:"smtp,omitempty"`
+ ACME *ACMEConfigs `json:"acme,omitempty"`
+ UpdatedAt int64 `json:"updated_at,omitempty"`
}
func (c *Configs) validate() error {
@@ -564,11 +412,6 @@ func (c *Configs) validate() error {
return err
}
}
- if c.Branding != nil {
- if err := c.Branding.validate(); err != nil {
- return err
- }
- }
return nil
}
@@ -585,11 +428,25 @@ func (c *Configs) PrepareForRendering() {
if c.ACME != nil && c.ACME.isEmpty() {
c.ACME = nil
}
- if c.Branding != nil && c.Branding.isEmpty() {
- c.Branding = nil
- }
if c.SMTP != nil {
- c.SMTP.prepareForRendering()
+ if c.SMTP.Password != nil {
+ c.SMTP.Password.Hide()
+ if c.SMTP.Password.IsEmpty() {
+ c.SMTP.Password = nil
+ }
+ }
+ if c.SMTP.OAuth2.ClientSecret != nil {
+ c.SMTP.OAuth2.ClientSecret.Hide()
+ if c.SMTP.OAuth2.ClientSecret.IsEmpty() {
+ c.SMTP.OAuth2.ClientSecret = nil
+ }
+ }
+ if c.SMTP.OAuth2.RefreshToken != nil {
+ c.SMTP.OAuth2.RefreshToken.Hide()
+ if c.SMTP.OAuth2.RefreshToken.IsEmpty() {
+ c.SMTP.OAuth2.RefreshToken = nil
+ }
+ }
}
}
@@ -613,9 +470,6 @@ func (c *Configs) SetNilsToEmpty() {
if c.ACME == nil {
c.ACME = &ACMEConfigs{}
}
- if c.Branding == nil {
- c.Branding = &BrandingConfigs{}
- }
}
// RenderAsJSON implements the renderer interface used within plugins
@@ -644,9 +498,6 @@ func (c *Configs) getACopy() Configs {
if c.ACME != nil {
result.ACME = c.ACME.getACopy()
}
- if c.Branding != nil {
- result.Branding = c.Branding.getACopy()
- }
result.UpdatedAt = c.UpdatedAt
return result
}
diff --git a/internal/dataprovider/dataprovider.go b/internal/dataprovider/dataprovider.go
index 7ecbbe2d..26cfc977 100644
--- a/internal/dataprovider/dataprovider.go
+++ b/internal/dataprovider/dataprovider.go
@@ -44,7 +44,6 @@ import (
"path/filepath"
"regexp"
"runtime"
- "slices"
"strconv"
"strings"
"sync"
@@ -90,7 +89,7 @@ const (
CockroachDataProviderName = "cockroachdb"
// DumpVersion defines the version for the dump.
// For restore/load we support the current version and the previous one
- DumpVersion = 17
+ DumpVersion = 16
argonPwdPrefix = "$argon2id$"
bcryptPwdPrefix = "$2a$"
@@ -112,6 +111,7 @@ const (
operationDelete = "delete"
sqlPrefixValidChars = "abcdefghijklmnopqrstuvwxyz_0123456789"
maxHookResponseSize = 1048576 // 1MB
+ iso8601UTCFormat = "2006-01-02T15:04:05Z"
)
// Supported algorithms for hashing passwords.
@@ -187,8 +187,6 @@ var (
ErrDuplicatedKey = errors.New("duplicated key not allowed")
// ErrForeignKeyViolated occurs when there is a foreign key constraint violation
ErrForeignKeyViolated = errors.New("violates foreign key constraint")
- errInvalidInput = util.NewValidationError("Invalid input. Slashes (/ ), colons (:), control characters, and reserved system names are not allowed")
- tz = ""
isAdminCreated atomic.Bool
validTLSUsernames = []string{string(sdk.TLSUsernameNone), string(sdk.TLSUsernameCN)}
config Config
@@ -211,7 +209,6 @@ var (
sqlTableAdmins string
sqlTableAPIKeys string
sqlTableShares string
- sqlTableSharesGroupsMapping string
sqlTableDefenderHosts string
sqlTableDefenderEvents string
sqlTableActiveTransfers string
@@ -246,7 +243,6 @@ func initSQLTables() {
sqlTableAdmins = "admins"
sqlTableAPIKeys = "api_keys"
sqlTableShares = "shares"
- sqlTableSharesGroupsMapping = "shares_groups_mapping"
sqlTableDefenderHosts = "defender_hosts"
sqlTableDefenderEvents = "defender_events"
sqlTableActiveTransfers = "active_transfers"
@@ -522,7 +518,7 @@ type Config struct {
// GetShared returns the provider share mode.
// This method is called before the provider is initialized
func (c *Config) GetShared() int {
- if !slices.Contains(sharedProviders, c.Driver) {
+ if !util.Contains(sharedProviders, c.Driver) {
return 0
}
return c.IsShared
@@ -594,16 +590,6 @@ func (c *Config) doBackup() (string, error) {
return outputFile, nil
}
-// SetTZ sets the configured timezone.
-func SetTZ(val string) {
- tz = val
-}
-
-// UseLocalTime returns true if local time should be used instead of UTC.
-func UseLocalTime() bool {
- return tz == "local"
-}
-
// ExecuteBackup executes a backup
func ExecuteBackup() (string, error) {
return config.doBackup()
@@ -773,8 +759,6 @@ type Provider interface {
updateLastLogin(username string) error
updateAdminLastLogin(username string) error
setUpdatedAt(username string)
- getAdminSignature(username string) (string, error)
- getUserSignature(username string) (string, error)
getFolders(limit, offset int, order string, minimal bool) ([]vfs.BaseVirtualFolder, error)
getFolderByName(name string) (vfs.BaseVirtualFolder, error)
addFolder(folder *vfs.BaseVirtualFolder) error
@@ -826,8 +810,8 @@ type Provider interface {
cleanupActiveTransfers(before time.Time) error
getActiveTransfers(from time.Time) ([]ActiveTransfer, error)
addSharedSession(session Session) error
- deleteSharedSession(key string, sessionType SessionType) error
- getSharedSession(key string, sessionType SessionType) (Session, error)
+ deleteSharedSession(key string) error
+ getSharedSession(key string) (Session, error)
cleanupSharedSessions(sessionType SessionType, before int64) error
getEventActions(limit, offset int, order string, minimal bool) ([]BaseEventAction, error)
dumpEventActions() ([]BaseEventAction, error)
@@ -890,7 +874,7 @@ func SetTempPath(fsPath string) {
}
func checkSharedMode() {
- if !slices.Contains(sharedProviders, config.Driver) {
+ if !util.Contains(sharedProviders, config.Driver) {
config.IsShared = 0
}
}
@@ -945,13 +929,12 @@ func checkDatabase(checkAdmins bool) error {
if config.UpdateMode == 0 {
err := provider.initializeDatabase()
if err != nil && err != ErrNoInitRequired {
- logger.WarnToConsole("unable to initialize data provider: %v", err)
- providerLog(logger.LevelError, "unable to initialize data provider: %v", err)
+ logger.WarnToConsole("Unable to initialize data provider: %v", err)
+ providerLog(logger.LevelError, "Unable to initialize data provider: %v", err)
return err
}
if err == nil {
- logger.DebugToConsole("data provider successfully initialized")
- providerLog(logger.LevelInfo, "data provider successfully initialized")
+ logger.DebugToConsole("Data provider successfully initialized")
}
err = provider.migrateDatabase()
if err != nil && err != ErrNoInitRequired {
@@ -1057,7 +1040,6 @@ func validateSQLTablesPrefix() error {
sqlTableAdmins = config.SQLTablesPrefix + sqlTableAdmins
sqlTableAPIKeys = config.SQLTablesPrefix + sqlTableAPIKeys
sqlTableShares = config.SQLTablesPrefix + sqlTableShares
- sqlTableSharesGroupsMapping = config.SQLTablesPrefix + sqlTableSharesGroupsMapping
sqlTableDefenderEvents = config.SQLTablesPrefix + sqlTableDefenderEvents
sqlTableDefenderHosts = config.SQLTablesPrefix + sqlTableDefenderHosts
sqlTableActiveTransfers = config.SQLTablesPrefix + sqlTableActiveTransfers
@@ -1079,12 +1061,12 @@ func validateSQLTablesPrefix() error {
"api keys %q shares %q defender hosts %q defender events %q transfers %q groups %q "+
"users groups mapping %q admins groups mapping %q groups folders mapping %q shared sessions %q "+
"schema version %q events actions %q events rules %q rules actions mapping %q tasks %q nodes %q roles %q"+
- "ip lists %q share groups mapping %q configs %q",
+ "ip lists %q configs %q",
sqlTableUsers, sqlTableFolders, sqlTableUsersFoldersMapping, sqlTableAdmins, sqlTableAPIKeys,
sqlTableShares, sqlTableDefenderHosts, sqlTableDefenderEvents, sqlTableActiveTransfers, sqlTableGroups,
sqlTableUsersGroupsMapping, sqlTableAdminsGroupsMapping, sqlTableGroupsFoldersMapping, sqlTableSharedSessions,
sqlTableSchemaVersion, sqlTableEventsActions, sqlTableEventsRules, sqlTableRulesActionsMapping,
- sqlTableTasks, sqlTableNodes, sqlTableRoles, sqlTableIPLists, sqlTableSharesGroupsMapping, sqlTableConfigs)
+ sqlTableTasks, sqlTableNodes, sqlTableRoles, sqlTableIPLists, sqlTableConfigs)
}
return nil
}
@@ -1521,15 +1503,6 @@ func UpdateUserQuota(user *User, filesAdd int, sizeAdd int64, reset bool) error
return nil
}
-// UpdateUserFolderQuota updates the quota for the given user and virtual folder.
-func UpdateUserFolderQuota(folder *vfs.VirtualFolder, user *User, filesAdd int, sizeAdd int64, reset bool) {
- if folder.IsIncludedInUserQuota() {
- UpdateUserQuota(user, filesAdd, sizeAdd, reset) //nolint:errcheck
- return
- }
- UpdateVirtualFolderQuota(&folder.BaseVirtualFolder, filesAdd, sizeAdd, reset) //nolint:errcheck
-}
-
// UpdateVirtualFolderQuota updates the quota for the given virtual folder adding filesAdd and sizeAdd.
// If reset is true filesAdd and sizeAdd indicates the total files and the total size instead of the difference.
func UpdateVirtualFolderQuota(vfolder *vfs.BaseVirtualFolder, filesAdd int, sizeAdd int64, reset bool) error {
@@ -1720,7 +1693,7 @@ func IPListEntryExists(ipOrNet string, listType IPListType) (IPListEntry, error)
// GetIPListEntries returns the IP list entries applying the specified criteria and search limit
func GetIPListEntries(listType IPListType, filter, from, order string, limit int) ([]IPListEntry, error) {
- if !slices.Contains(supportedIPListType, listType) {
+ if !util.Contains(supportedIPListType, listType) {
return nil, util.NewValidationError(fmt.Sprintf("invalid list type %d", listType))
}
return provider.getIPListEntries(listType, filter, from, order, limit)
@@ -2091,20 +2064,6 @@ func UserExists(username, role string) (User, error) {
return provider.userExists(username, role)
}
-// GetAdminSignature returns the signature for the admin with the specified
-// username.
-func GetAdminSignature(username string) (string, error) {
- username = config.convertName(username)
- return provider.getAdminSignature(username)
-}
-
-// GetUserSignature returns the signature for the user with the specified
-// username.
-func GetUserSignature(username string) (string, error) {
- username = config.convertName(username)
- return provider.getUserSignature(username)
-}
-
// GetUserWithGroupSettings tries to return the user with the specified username
// loading also the group settings
func GetUserWithGroupSettings(username, role string) (User, error) {
@@ -2147,6 +2106,9 @@ func UpdateUserPassword(username, plainPwd, executor, ipAddress, role string) er
return err
}
userCopy := user.getACopy()
+ if err := userCopy.LoadAndApplyGroupSettings(); err != nil {
+ return err
+ }
userCopy.Password = plainPwd
if err := createUserPasswordHash(&userCopy); err != nil {
return err
@@ -2244,8 +2206,8 @@ func AddSharedSession(session Session) error {
}
// DeleteSharedSession deletes the session with the specified key
-func DeleteSharedSession(key string, sessionType SessionType) error {
- err := provider.deleteSharedSession(key, sessionType)
+func DeleteSharedSession(key string) error {
+ err := provider.deleteSharedSession(key)
if err != nil {
providerLog(logger.LevelError, "unable to add shared session, key %q, err: %v", key, err)
}
@@ -2253,8 +2215,8 @@ func DeleteSharedSession(key string, sessionType SessionType) error {
}
// GetSharedSession retrieves the session with the specified key
-func GetSharedSession(key string, sessionType SessionType) (Session, error) {
- return provider.getSharedSession(key, sessionType)
+func GetSharedSession(key string) (Session, error) {
+ return provider.getSharedSession(key)
}
// CleanupSharedSessions removes the shared session with the specified type and
@@ -2390,7 +2352,7 @@ func GetFolders(limit, offset int, order string, minimal bool) ([]vfs.BaseVirtua
}
func dumpUsers(data *BackupData, scopes []string) error {
- if len(scopes) == 0 || slices.Contains(scopes, DumpScopeUsers) {
+ if len(scopes) == 0 || util.Contains(scopes, DumpScopeUsers) {
users, err := provider.dumpUsers()
if err != nil {
return err
@@ -2401,7 +2363,7 @@ func dumpUsers(data *BackupData, scopes []string) error {
}
func dumpFolders(data *BackupData, scopes []string) error {
- if len(scopes) == 0 || slices.Contains(scopes, DumpScopeFolders) {
+ if len(scopes) == 0 || util.Contains(scopes, DumpScopeFolders) {
folders, err := provider.dumpFolders()
if err != nil {
return err
@@ -2412,7 +2374,7 @@ func dumpFolders(data *BackupData, scopes []string) error {
}
func dumpGroups(data *BackupData, scopes []string) error {
- if len(scopes) == 0 || slices.Contains(scopes, DumpScopeGroups) {
+ if len(scopes) == 0 || util.Contains(scopes, DumpScopeGroups) {
groups, err := provider.dumpGroups()
if err != nil {
return err
@@ -2423,7 +2385,7 @@ func dumpGroups(data *BackupData, scopes []string) error {
}
func dumpAdmins(data *BackupData, scopes []string) error {
- if len(scopes) == 0 || slices.Contains(scopes, DumpScopeAdmins) {
+ if len(scopes) == 0 || util.Contains(scopes, DumpScopeAdmins) {
admins, err := provider.dumpAdmins()
if err != nil {
return err
@@ -2434,7 +2396,7 @@ func dumpAdmins(data *BackupData, scopes []string) error {
}
func dumpAPIKeys(data *BackupData, scopes []string) error {
- if len(scopes) == 0 || slices.Contains(scopes, DumpScopeAPIKeys) {
+ if len(scopes) == 0 || util.Contains(scopes, DumpScopeAPIKeys) {
apiKeys, err := provider.dumpAPIKeys()
if err != nil {
return err
@@ -2445,7 +2407,7 @@ func dumpAPIKeys(data *BackupData, scopes []string) error {
}
func dumpShares(data *BackupData, scopes []string) error {
- if len(scopes) == 0 || slices.Contains(scopes, DumpScopeShares) {
+ if len(scopes) == 0 || util.Contains(scopes, DumpScopeShares) {
shares, err := provider.dumpShares()
if err != nil {
return err
@@ -2456,7 +2418,7 @@ func dumpShares(data *BackupData, scopes []string) error {
}
func dumpActions(data *BackupData, scopes []string) error {
- if len(scopes) == 0 || slices.Contains(scopes, DumpScopeActions) {
+ if len(scopes) == 0 || util.Contains(scopes, DumpScopeActions) {
actions, err := provider.dumpEventActions()
if err != nil {
return err
@@ -2467,7 +2429,7 @@ func dumpActions(data *BackupData, scopes []string) error {
}
func dumpRules(data *BackupData, scopes []string) error {
- if len(scopes) == 0 || slices.Contains(scopes, DumpScopeRules) {
+ if len(scopes) == 0 || util.Contains(scopes, DumpScopeRules) {
rules, err := provider.dumpEventRules()
if err != nil {
return err
@@ -2478,7 +2440,7 @@ func dumpRules(data *BackupData, scopes []string) error {
}
func dumpRoles(data *BackupData, scopes []string) error {
- if len(scopes) == 0 || slices.Contains(scopes, DumpScopeRoles) {
+ if len(scopes) == 0 || util.Contains(scopes, DumpScopeRoles) {
roles, err := provider.dumpRoles()
if err != nil {
return err
@@ -2489,7 +2451,7 @@ func dumpRoles(data *BackupData, scopes []string) error {
}
func dumpIPLists(data *BackupData, scopes []string) error {
- if len(scopes) == 0 || slices.Contains(scopes, DumpScopeIPLists) {
+ if len(scopes) == 0 || util.Contains(scopes, DumpScopeIPLists) {
ipLists, err := provider.dumpIPListEntries()
if err != nil {
return err
@@ -2500,7 +2462,7 @@ func dumpIPLists(data *BackupData, scopes []string) error {
}
func dumpConfigs(data *BackupData, scopes []string) error {
- if len(scopes) == 0 || slices.Contains(scopes, DumpScopeConfigs) {
+ if len(scopes) == 0 || util.Contains(scopes, DumpScopeConfigs) {
configs, err := provider.getConfigs()
if err != nil {
return err
@@ -2557,17 +2519,6 @@ func DumpData(scopes []string) (BackupData, error) {
func ParseDumpData(data []byte) (BackupData, error) {
var dump BackupData
err := json.Unmarshal(data, &dump)
- if err != nil {
- return dump, err
- }
- if dump.Version < 17 {
- providerLog(logger.LevelInfo, "updating placeholders for actions restored from dump version %d", dump.Version)
- eventActions, err := updateEventActionPlaceholders(dump.EventActions)
- if err != nil {
- return dump, fmt.Errorf("unable to update event action placeholders for dump version %d: %w", dump.Version, err)
- }
- dump.EventActions = eventActions
- }
return dump, err
}
@@ -2732,7 +2683,7 @@ func validateUserGroups(user *User) error {
groupNames := make(map[string]bool)
for _, g := range user.Groups {
- if g.Type < sdk.GroupTypePrimary || g.Type > sdk.GroupTypeMembership {
+ if g.Type < sdk.GroupTypePrimary && g.Type > sdk.GroupTypeMembership {
return util.NewValidationError(fmt.Sprintf("invalid group type: %v", g.Type))
}
if g.Type == sdk.GroupTypePrimary {
@@ -2763,7 +2714,6 @@ func validateAssociatedVirtualFolders(vfolders []vfs.VirtualFolder) ([]vfs.Virtu
folderNames := make(map[string]bool)
for _, v := range vfolders {
- v.Name = config.convertName(v.Name)
if v.VirtualPath == "" {
return nil, util.NewI18nError(
util.NewValidationError("mount/virtual path is mandatory"),
@@ -2815,7 +2765,7 @@ func validateUserTOTPConfig(c *UserTOTPConfig, username string) error {
if c.ConfigName == "" {
return util.NewValidationError("totp: config name is mandatory")
}
- if !slices.Contains(mfa.GetAvailableTOTPConfigNames(), c.ConfigName) {
+ if !util.Contains(mfa.GetAvailableTOTPConfigNames(), c.ConfigName) {
return util.NewValidationError(fmt.Sprintf("totp: config name %q not found", c.ConfigName))
}
if c.Secret.IsEmpty() {
@@ -2831,7 +2781,7 @@ func validateUserTOTPConfig(c *UserTOTPConfig, username string) error {
return util.NewValidationError("totp: specify at least one protocol")
}
for _, protocol := range c.Protocols {
- if !slices.Contains(MFAProtocols, protocol) {
+ if !util.Contains(MFAProtocols, protocol) {
return util.NewValidationError(fmt.Sprintf("totp: invalid protocol %q", protocol))
}
}
@@ -2864,7 +2814,7 @@ func validateUserPermissions(permsToCheck map[string][]string) (map[string][]str
return permissions, util.NewValidationError("invalid permissions")
}
for _, p := range perms {
- if !slices.Contains(ValidPerms, p) {
+ if !util.Contains(ValidPerms, p) {
return permissions, util.NewValidationError(fmt.Sprintf("invalid permission: %q", p))
}
}
@@ -2878,7 +2828,7 @@ func validateUserPermissions(permsToCheck map[string][]string) (map[string][]str
if dir != cleanedDir && cleanedDir == "/" {
return permissions, util.NewValidationError(fmt.Sprintf("cannot set permissions for invalid subdirectory: %q is an alias for \"/\"", dir))
}
- if slices.Contains(perms, PermAny) {
+ if util.Contains(perms, PermAny) {
permissions[cleanedDir] = []string{PermAny}
} else {
permissions[cleanedDir] = util.RemoveDuplicates(perms, false)
@@ -2919,18 +2869,11 @@ func validatePublicKeys(user *User) error {
util.I18nErrorPubKeyInvalid,
)
}
- if out.Type() == ssh.InsecureKeyAlgoDSA { //nolint:staticcheck
- providerLog(logger.LevelError, "dsa public key not accepted, position: %d", idx)
- return util.NewI18nError(
- util.NewValidationError(fmt.Sprintf("DSA key format is insecure and it is not allowed for key at position %d", idx)),
- util.I18nErrorKeyInsecure,
- )
- }
if k, ok := out.(ssh.CryptoPublicKey); ok {
cryptoKey := k.CryptoPublicKey()
if rsaKey, ok := cryptoKey.(*rsa.PublicKey); ok {
if size := rsaKey.N.BitLen(); size < 2048 {
- providerLog(logger.LevelError, "rsa key with size %d at position %d not accepted, minimum 2048", size, idx)
+ providerLog(logger.LevelError, "rsa key with size %d not accepted, minimum 2048", size)
return util.NewI18nError(
util.NewValidationError(fmt.Sprintf("invalid size %d for rsa key at position %d, minimum 2048",
size, idx)),
@@ -2961,7 +2904,7 @@ func validateFiltersPatternExtensions(baseFilters *sdk.BaseUserFilters) error {
util.I18nErrorFilePatternPathInvalid,
)
}
- if slices.Contains(filteredPaths, cleanedPath) {
+ if util.Contains(filteredPaths, cleanedPath) {
return util.NewI18nError(
util.NewValidationError(fmt.Sprintf("duplicate file patterns filter for path %q", f.Path)),
util.I18nErrorFilePatternDuplicated,
@@ -3080,13 +3023,13 @@ func validateFilterProtocols(filters *sdk.BaseUserFilters) error {
return util.NewValidationError("invalid denied_protocols")
}
for _, p := range filters.DeniedProtocols {
- if !slices.Contains(ValidProtocols, p) {
+ if !util.Contains(ValidProtocols, p) {
return util.NewValidationError(fmt.Sprintf("invalid denied protocol %q", p))
}
}
for _, p := range filters.TwoFactorAuthProtocols {
- if !slices.Contains(MFAProtocols, p) {
+ if !util.Contains(MFAProtocols, p) {
return util.NewValidationError(fmt.Sprintf("invalid two factor protocol %q", p))
}
}
@@ -3142,7 +3085,7 @@ func validateBaseFilters(filters *sdk.BaseUserFilters) error {
return util.NewValidationError("invalid denied_login_methods")
}
for _, loginMethod := range filters.DeniedLoginMethods {
- if !slices.Contains(ValidLoginMethods, loginMethod) {
+ if !util.Contains(ValidLoginMethods, loginMethod) {
return util.NewValidationError(fmt.Sprintf("invalid login method: %q", loginMethod))
}
}
@@ -3150,7 +3093,7 @@ func validateBaseFilters(filters *sdk.BaseUserFilters) error {
return err
}
if filters.TLSUsername != "" {
- if !slices.Contains(validTLSUsernames, string(filters.TLSUsername)) {
+ if !util.Contains(validTLSUsernames, string(filters.TLSUsername)) {
return util.NewValidationError(fmt.Sprintf("invalid TLS username: %q", filters.TLSUsername))
}
}
@@ -3160,7 +3103,7 @@ func validateBaseFilters(filters *sdk.BaseUserFilters) error {
}
filters.TLSCerts = certs
for _, opts := range filters.WebClient {
- if !slices.Contains(sdk.WebClientOptions, opts) {
+ if !util.Contains(sdk.WebClientOptions, opts) {
return util.NewValidationError(fmt.Sprintf("invalid web client options %q", opts))
}
}
@@ -3228,19 +3171,19 @@ func validateAccessTimeFilters(filters *sdk.BaseUserFilters) error {
}
func validateCombinedUserFilters(user *User) error {
- if user.Filters.TOTPConfig.Enabled && slices.Contains(user.Filters.WebClient, sdk.WebClientMFADisabled) {
+ if user.Filters.TOTPConfig.Enabled && util.Contains(user.Filters.WebClient, sdk.WebClientMFADisabled) {
return util.NewI18nError(
util.NewValidationError("two-factor authentication cannot be disabled for a user with an active configuration"),
util.I18nErrorDisableActive2FA,
)
}
- if user.Filters.RequirePasswordChange && slices.Contains(user.Filters.WebClient, sdk.WebClientPasswordChangeDisabled) {
+ if user.Filters.RequirePasswordChange && util.Contains(user.Filters.WebClient, sdk.WebClientPasswordChangeDisabled) {
return util.NewI18nError(
util.NewValidationError("you cannot require password change and at the same time disallow it"),
util.I18nErrorPwdChangeConflict,
)
}
- if len(user.Filters.TwoFactorAuthProtocols) > 0 && slices.Contains(user.Filters.WebClient, sdk.WebClientMFADisabled) {
+ if len(user.Filters.TwoFactorAuthProtocols) > 0 && util.Contains(user.Filters.WebClient, sdk.WebClientMFADisabled) {
return util.NewI18nError(
util.NewValidationError("you cannot require two-factor authentication and at the same time disallow it"),
util.I18nError2FAConflict,
@@ -3249,37 +3192,19 @@ func validateCombinedUserFilters(user *User) error {
return nil
}
-func validateEmails(user *User) error {
+func validateBaseParams(user *User) error {
+ if user.Username == "" {
+ return util.NewI18nError(util.NewValidationError("username is mandatory"), util.I18nErrorUsernameRequired)
+ }
+ if err := checkReservedUsernames(user.Username); err != nil {
+ return util.NewI18nError(err, util.I18nErrorReservedUsername)
+ }
if user.Email != "" && !util.IsEmailValid(user.Email) {
return util.NewI18nError(
util.NewValidationError(fmt.Sprintf("email %q is not valid", user.Email)),
util.I18nErrorInvalidEmail,
)
}
- for _, email := range user.Filters.AdditionalEmails {
- if !util.IsEmailValid(email) {
- return util.NewI18nError(
- util.NewValidationError(fmt.Sprintf("email %q is not valid", email)),
- util.I18nErrorInvalidEmail,
- )
- }
- }
- return nil
-}
-
-func validateBaseParams(user *User) error {
- if user.Username == "" {
- return util.NewI18nError(util.NewValidationError("username is mandatory"), util.I18nErrorUsernameRequired)
- }
- if !util.IsNameValid(user.Username) {
- return util.NewI18nError(errInvalidInput, util.I18nErrorInvalidInput)
- }
- if err := checkReservedUsernames(user.Username); err != nil {
- return util.NewI18nError(err, util.I18nErrorReservedUsername)
- }
- if err := validateEmails(user); err != nil {
- return err
- }
if config.NamingRules&1 == 0 && !usernameRegex.MatchString(user.Username) {
return util.NewI18nError(
util.NewValidationError(fmt.Sprintf("username %q is not valid, the following characters are allowed: a-zA-Z0-9-_.~", user.Username)),
@@ -3340,19 +3265,6 @@ func hashPlainPassword(plainPwd string) (string, error) {
func createUserPasswordHash(user *User) error {
if user.Password != "" && !user.IsPasswordHashed() {
- for _, g := range user.Groups {
- if g.Type == sdk.GroupTypePrimary {
- group, err := GroupExists(g.Name)
- if err != nil {
- return errors.New("unable to load group password policies")
- }
- if minEntropy := group.UserSettings.Filters.PasswordStrength; minEntropy > 0 {
- if err := passwordvalidator.Validate(user.Password, float64(minEntropy)); err != nil {
- return util.NewI18nError(util.NewValidationError(err.Error()), util.I18nErrorPasswordComplexity)
- }
- }
- }
- }
if minEntropy := user.getMinPasswordEntropy(); minEntropy > 0 {
if err := passwordvalidator.Validate(user.Password, minEntropy); err != nil {
return util.NewI18nError(util.NewValidationError(err.Error()), util.I18nErrorPasswordComplexity)
@@ -3375,9 +3287,6 @@ func ValidateFolder(folder *vfs.BaseVirtualFolder) error {
if folder.Name == "" {
return util.NewI18nError(util.NewValidationError("folder name is mandatory"), util.I18nErrorNameRequired)
}
- if !util.IsNameValid(folder.Name) {
- return util.NewI18nError(errInvalidInput, util.I18nErrorInvalidInput)
- }
if config.NamingRules&1 == 0 && !usernameRegex.MatchString(folder.Name) {
return util.NewI18nError(
util.NewValidationError(fmt.Sprintf("folder name %q is not valid, the following characters are allowed: a-zA-Z0-9-_.~", folder.Name)),
@@ -3407,7 +3316,6 @@ func ValidateUser(user *User) error {
user.OIDCCustomFields = nil
user.HasPassword = false
user.SetEmptySecretsIfNil()
- user.applyNamingRules()
buildUserHomeDir(user)
if err := validateBaseParams(user); err != nil {
return err
@@ -3557,7 +3465,7 @@ func checkUserAndPass(user *User, password, ip, protocol string) (User, error) {
if err != nil {
return *user, ErrInvalidCredentials
}
- if user.Password == "" || strings.TrimSpace(password) == "" {
+ if user.Password == "" || password == "" {
return *user, errors.New("credentials cannot be null or empty")
}
if !user.Filters.Hooks.CheckPasswordDisabled {
@@ -3596,7 +3504,7 @@ func checkUserPasscode(user *User, password, protocol string) (string, error) {
if user.Filters.TOTPConfig.Enabled {
switch protocol {
case protocolFTP:
- if slices.Contains(user.Filters.TOTPConfig.Protocols, protocol) {
+ if util.Contains(user.Filters.TOTPConfig.Protocols, protocol) {
// the TOTP passcode has six digits
pwdLen := len(password)
if pwdLen < 7 {
@@ -3732,8 +3640,7 @@ func comparePbkdf2PasswordAndHash(password, hashedPassword string) (bool, error)
}
func getSSLMode() string {
- switch config.Driver {
- case PGSQLDataProviderName, CockroachDataProviderName:
+ if config.Driver == PGSQLDataProviderName || config.Driver == CockroachDataProviderName {
switch config.SSLMode {
case 0:
return "disable"
@@ -3748,7 +3655,7 @@ func getSSLMode() string {
case 5:
return "allow"
}
- case MySQLDataProviderName:
+ } else if config.Driver == MySQLDataProviderName {
if config.requireCustomTLSForMySQL() {
return "custom"
}
@@ -3803,7 +3710,7 @@ func doBuiltinKeyboardInteractiveAuth(user *User, client ssh.KeyboardInteractive
if err := user.LoadAndApplyGroupSettings(); err != nil {
return 0, err
}
- hasSecondFactor := user.Filters.TOTPConfig.Enabled && slices.Contains(user.Filters.TOTPConfig.Protocols, protocolSSH)
+ hasSecondFactor := user.Filters.TOTPConfig.Enabled && util.Contains(user.Filters.TOTPConfig.Protocols, protocolSSH)
if !isPartialAuth || !hasSecondFactor {
answers, err := client("", "", []string{"Password: "}, []bool{false})
if err != nil {
@@ -3821,7 +3728,7 @@ func doBuiltinKeyboardInteractiveAuth(user *User, client ssh.KeyboardInteractive
}
func checkKeyboardInteractiveSecondFactor(user *User, client ssh.KeyboardInteractiveChallenge, protocol string) (int, error) {
- if !user.Filters.TOTPConfig.Enabled || !slices.Contains(user.Filters.TOTPConfig.Protocols, protocolSSH) {
+ if !user.Filters.TOTPConfig.Enabled || !util.Contains(user.Filters.TOTPConfig.Protocols, protocolSSH) {
return 1, nil
}
err := user.Filters.TOTPConfig.Secret.TryDecrypt()
@@ -3945,7 +3852,7 @@ func getKeyboardInteractiveAnswers(client ssh.KeyboardInteractiveChallenge, resp
}
if len(answers) == 1 && response.CheckPwd > 0 {
if response.CheckPwd == 2 {
- if !user.Filters.TOTPConfig.Enabled || !slices.Contains(user.Filters.TOTPConfig.Protocols, protocolSSH) {
+ if !user.Filters.TOTPConfig.Enabled || !util.Contains(user.Filters.TOTPConfig.Protocols, protocolSSH) {
providerLog(logger.LevelInfo, "keyboard interactive auth error: unable to check TOTP passcode, TOTP is not enabled for user %q",
user.Username)
return answers, errors.New("TOTP not enabled for SSH protocol")
@@ -4151,7 +4058,7 @@ func getPasswordHookResponse(username, password, ip, protocol string) ([]byte, e
fmt.Sprintf("SFTPGO_AUTHD_IP=%s", ip),
fmt.Sprintf("SFTPGO_AUTHD_PROTOCOL=%s", protocol),
)
- return getCmdOutput(cmd, "check_password_hook")
+ return cmd.Output()
}
func executeCheckPasswordHook(username, password, ip, protocol string) (checkPasswordResponse, error) {
@@ -4207,17 +4114,15 @@ func getPreLoginHookResponse(loginMethod, ip, protocol string, userAsJSON []byte
cmd := exec.CommandContext(ctx, config.PreLoginHook, args...)
cmd.Env = append(env,
- fmt.Sprintf("SFTPGO_LOGIND_USER=%s", userAsJSON),
+ fmt.Sprintf("SFTPGO_LOGIND_USER=%s", util.BytesToString(userAsJSON)),
fmt.Sprintf("SFTPGO_LOGIND_METHOD=%s", loginMethod),
fmt.Sprintf("SFTPGO_LOGIND_IP=%s", ip),
fmt.Sprintf("SFTPGO_LOGIND_PROTOCOL=%s", protocol),
)
- return getCmdOutput(cmd, "pre_login_hook")
+ return cmd.Output()
}
func executePreLoginHook(username, loginMethod, ip, protocol string, oidcTokenFields *map[string]any) (User, error) {
- var user User
-
u, mergedUser, userAsJSON, err := getUserAndJSONForHook(username, oidcTokenFields)
if err != nil {
return u, err
@@ -4240,41 +4145,55 @@ func executePreLoginHook(username, loginMethod, ip, protocol string, oidcTokenFi
}
return u, nil
}
- err = json.Unmarshal(out, &user)
+
+ userID := u.ID
+ userUsedQuotaSize := u.UsedQuotaSize
+ userUsedQuotaFiles := u.UsedQuotaFiles
+ userUsedDownloadTransfer := u.UsedDownloadDataTransfer
+ userUsedUploadTransfer := u.UsedUploadDataTransfer
+ userLastQuotaUpdate := u.LastQuotaUpdate
+ userLastLogin := u.LastLogin
+ userFirstDownload := u.FirstDownload
+ userFirstUpload := u.FirstUpload
+ userLastPwdChange := u.LastPasswordChange
+ userCreatedAt := u.CreatedAt
+ totpConfig := u.Filters.TOTPConfig
+ recoveryCodes := u.Filters.RecoveryCodes
+ err = json.Unmarshal(out, &u)
if err != nil {
- return u, fmt.Errorf("invalid pre-login hook response %q, error: %v", out, err)
+ return u, fmt.Errorf("invalid pre-login hook response %q, error: %v", util.BytesToString(out), err)
}
- if u.ID > 0 {
- user.ID = u.ID
- user.UsedQuotaSize = u.UsedQuotaSize
- user.UsedQuotaFiles = u.UsedQuotaFiles
- user.UsedUploadDataTransfer = u.UsedUploadDataTransfer
- user.UsedDownloadDataTransfer = u.UsedDownloadDataTransfer
- user.LastQuotaUpdate = u.LastQuotaUpdate
- user.LastLogin = u.LastLogin
- user.LastPasswordChange = u.LastPasswordChange
- user.FirstDownload = u.FirstDownload
- user.FirstUpload = u.FirstUpload
- // preserve TOTP config and recovery codes
- user.Filters.TOTPConfig = u.Filters.TOTPConfig
- user.Filters.RecoveryCodes = u.Filters.RecoveryCodes
- if err := provider.updateUser(&user); err != nil {
- return u, err
- }
+ u.ID = userID
+ u.UsedQuotaSize = userUsedQuotaSize
+ u.UsedQuotaFiles = userUsedQuotaFiles
+ u.UsedUploadDataTransfer = userUsedUploadTransfer
+ u.UsedDownloadDataTransfer = userUsedDownloadTransfer
+ u.LastQuotaUpdate = userLastQuotaUpdate
+ u.LastLogin = userLastLogin
+ u.LastPasswordChange = userLastPwdChange
+ u.FirstDownload = userFirstDownload
+ u.FirstUpload = userFirstUpload
+ u.CreatedAt = userCreatedAt
+ if userID == 0 {
+ err = provider.addUser(&u)
} else {
- if err := provider.addUser(&user); err != nil {
- return u, err
+ u.UpdatedAt = util.GetTimeAsMsSinceEpoch(time.Now())
+ // preserve TOTP config and recovery codes
+ u.Filters.TOTPConfig = totpConfig
+ u.Filters.RecoveryCodes = recoveryCodes
+ err = provider.updateUser(&u)
+ if err == nil {
+ webDAVUsersCache.swap(&u, "")
}
}
- user, err = provider.userExists(user.Username, "")
if err != nil {
return u, err
}
- providerLog(logger.LevelDebug, "user %q added/updated from pre-login hook response, id: %d", username, u.ID)
- if u.ID > 0 {
- webDAVUsersCache.swap(&user, "")
+ providerLog(logger.LevelDebug, "user %q added/updated from pre-login hook response, id: %d", username, userID)
+ if userID == 0 {
+ return provider.userExists(username, "")
}
- return user, nil
+ return u, nil
}
// ExecutePostLoginHook executes the post login hook if defined
@@ -4337,7 +4256,7 @@ func ExecutePostLoginHook(user *User, loginMethod, ip, protocol string, err erro
cmd := exec.CommandContext(ctx, config.PostLoginHook, args...)
cmd.Env = append(env,
- fmt.Sprintf("SFTPGO_LOGIND_USER=%s", userAsJSON),
+ fmt.Sprintf("SFTPGO_LOGIND_USER=%s", util.BytesToString(userAsJSON)),
fmt.Sprintf("SFTPGO_LOGIND_IP=%s", ip),
fmt.Sprintf("SFTPGO_LOGIND_METHOD=%s", loginMethod),
fmt.Sprintf("SFTPGO_LOGIND_STATUS=%s", status),
@@ -4406,7 +4325,7 @@ func getExternalAuthResponse(username, password, pkey, keyboardInteractive, ip,
cmd := exec.CommandContext(ctx, config.ExternalAuthHook, args...)
cmd.Env = append(env,
fmt.Sprintf("SFTPGO_AUTHD_USERNAME=%s", username),
- fmt.Sprintf("SFTPGO_AUTHD_USER=%s", userAsJSON),
+ fmt.Sprintf("SFTPGO_AUTHD_USER=%s", util.BytesToString(userAsJSON)),
fmt.Sprintf("SFTPGO_AUTHD_IP=%s", ip),
fmt.Sprintf("SFTPGO_AUTHD_PASSWORD=%s", password),
fmt.Sprintf("SFTPGO_AUTHD_PUBLIC_KEY=%s", pkey),
@@ -4414,7 +4333,7 @@ func getExternalAuthResponse(username, password, pkey, keyboardInteractive, ip,
fmt.Sprintf("SFTPGO_AUTHD_TLS_CERT=%s", strings.ReplaceAll(tlsCert, "\n", "\\n")),
fmt.Sprintf("SFTPGO_AUTHD_KEYBOARD_INTERACTIVE=%v", keyboardInteractive))
- return getCmdOutput(cmd, "external_auth_hook")
+ return cmd.Output()
}
func updateUserFromExtAuthResponse(user *User, password, pkey string) {
@@ -4688,59 +4607,6 @@ func isExternalAuthConfigured(loginMethod string) bool {
}
}
-func replaceTemplateVars(input string) string {
- var result strings.Builder
- i := 0
- for i < len(input) {
- if i+2 <= len(input) && input[i:i+2] == "{{" {
- if i+2 < len(input) {
- nextChar := input[i+2]
- if nextChar == ' ' || nextChar == '.' || nextChar == '-' {
- // Don't replace if followed by space, dot or minus.
- result.WriteString("{{")
- i += 2
- continue
- }
- }
-
- // Find the closing "}}"
- closing := strings.Index(input[i:], "}}")
- if closing != -1 {
- // Replace with {{. only if it's a proper template variable.
- result.WriteString("{{.")
- result.WriteString(input[i+2 : i+closing])
- result.WriteString("}}")
- i += closing + 2
- continue
- }
- }
- result.WriteByte(input[i])
- i++
- }
- return result.String()
-}
-
-func updateEventActionPlaceholders(actions []BaseEventAction) ([]BaseEventAction, error) {
- var result []BaseEventAction
-
- for _, action := range actions {
- options, err := json.Marshal(action.Options)
- if err != nil {
- return nil, err
- }
- convertedOptions := replaceTemplateVars(string(options))
- var opts BaseEventActionOptions
- err = json.Unmarshal([]byte(convertedOptions), &opts)
- if err != nil {
- return nil, err
- }
- action.Options = opts
- result = append(result, action)
- }
-
- return result, nil
-}
-
func getConfigPath(name, configDir string) string {
if !util.IsFileInputValid(name) {
return ""
@@ -4752,47 +4618,12 @@ func getConfigPath(name, configDir string) string {
}
func checkReservedUsernames(username string) error {
- if slices.Contains(reservedUsers, username) {
+ if util.Contains(reservedUsers, username) {
return util.NewValidationError("this username is reserved")
}
return nil
}
-func errSchemaVersionTooOld(version int) error {
- return fmt.Errorf("database schema version %d is too old, please see the upgrading docs: https://docs.sftpgo.com/latest/data-provider/#upgrading", version)
-}
-
-func getCmdOutput(cmd *exec.Cmd, sender string) ([]byte, error) {
- var stdout bytes.Buffer
- cmd.Stdout = &stdout
-
- stderr, err := cmd.StderrPipe()
- if err != nil {
- return nil, err
- }
-
- err = cmd.Start()
- if err != nil {
- return nil, err
- }
-
- scanner := bufio.NewScanner(stderr)
-
- go func() {
- for scanner.Scan() {
- if out := scanner.Text(); out != "" {
- logger.Log(logger.LevelWarn, sender, "", "%s", out)
- }
- }
- if err := scanner.Err(); err != nil {
- logger.Log(logger.LevelError, sender, "", "error reading stderr: %v", err)
- }
- }()
-
- err = cmd.Wait()
- return stdout.Bytes(), err
-}
-
func providerLog(level logger.LogLevel, format string, v ...any) {
logger.Log(level, logSender, "", format, v...)
}
diff --git a/internal/dataprovider/eventrule.go b/internal/dataprovider/eventrule.go
index 959f874c..0c7d0e35 100644
--- a/internal/dataprovider/eventrule.go
+++ b/internal/dataprovider/eventrule.go
@@ -64,7 +64,7 @@ var (
)
func isActionTypeValid(action int) bool {
- return slices.Contains(supportedEventActions, action)
+ return util.Contains(supportedEventActions, action)
}
func getActionTypeAsString(action int) string {
@@ -119,7 +119,7 @@ var (
)
func isEventTriggerValid(trigger int) bool {
- return slices.Contains(supportedEventTriggers, trigger)
+ return util.Contains(supportedEventTriggers, trigger)
}
func getTriggerTypeAsString(trigger int) string {
@@ -173,7 +173,7 @@ var (
)
func isFilesystemActionValid(value int) bool {
- return slices.Contains(supportedFsActions, value)
+ return util.Contains(supportedFsActions, value)
}
func getFsActionTypeAsString(value int) string {
@@ -342,7 +342,7 @@ func (c *EventActionHTTPConfig) validateMultiparts() error {
)
}
for _, k := range c.Headers {
- if strings.EqualFold(k.Key, "content-type") {
+ if strings.ToLower(k.Key) == "content-type" {
return util.NewI18nError(
util.NewValidationError("content type is automatically set for multipart requests"),
util.I18nErrorMultipartCType,
@@ -384,7 +384,7 @@ func (c *EventActionHTTPConfig) validate(additionalData string) error {
return util.NewValidationError(fmt.Sprintf("could not encrypt HTTP password: %v", err))
}
}
- if !slices.Contains(SupportedHTTPActionMethods, c.Method) {
+ if !util.Contains(SupportedHTTPActionMethods, c.Method) {
return util.NewValidationError(fmt.Sprintf("unsupported HTTP method: %s", c.Method))
}
for _, kv := range c.QueryParameters {
@@ -671,21 +671,12 @@ func (c *EventActionFsCompress) validate() error {
return nil
}
-// RenameConfig defines the configuration for a filesystem rename
-type RenameConfig struct {
- // key is the source and target the value
- KeyValue
- // This setting only applies to storage providers that support
- // changing modification times.
- UpdateModTime bool `json:"update_modtime,omitempty"`
-}
-
// EventActionFilesystemConfig defines the configuration for filesystem actions
type EventActionFilesystemConfig struct {
// Filesystem actions, see the above enum
Type int `json:"type,omitempty"`
- // files/dirs to rename
- Renames []RenameConfig `json:"renames,omitempty"`
+ // files/dirs to rename, key is the source and target the value
+ Renames []KeyValue `json:"renames,omitempty"`
// directories to create
MkDirs []string `json:"mkdirs,omitempty"`
// files/dirs to delete
@@ -726,9 +717,9 @@ func (c *EventActionFilesystemConfig) validateRenames() error {
if len(c.Renames) == 0 {
return util.NewI18nError(util.NewValidationError("no path to rename specified"), util.I18nErrorPathRequired)
}
- for idx, cfg := range c.Renames {
- key := strings.TrimSpace(cfg.Key)
- value := strings.TrimSpace(cfg.Value)
+ for idx, kv := range c.Renames {
+ key := strings.TrimSpace(kv.Key)
+ value := strings.TrimSpace(kv.Value)
if key == "" || value == "" {
return util.NewValidationError("invalid paths to rename")
}
@@ -746,12 +737,9 @@ func (c *EventActionFilesystemConfig) validateRenames() error {
util.I18nErrorRootNotAllowed,
)
}
- c.Renames[idx] = RenameConfig{
- KeyValue: KeyValue{
- Key: key,
- Value: value,
- },
- UpdateModTime: cfg.UpdateModTime,
+ c.Renames[idx] = KeyValue{
+ Key: key,
+ Value: value,
}
}
return nil
@@ -915,7 +903,7 @@ func (c *EventActionFilesystemConfig) getACopy() EventActionFilesystemConfig {
return EventActionFilesystemConfig{
Type: c.Type,
- Renames: cloneRenameConfigs(c.Renames),
+ Renames: cloneKeyValues(c.Renames),
MkDirs: mkdirs,
Deletes: deletes,
Exist: exist,
@@ -1253,15 +1241,6 @@ func (a *BaseEventAction) validate() error {
if a.Name == "" {
return util.NewI18nError(util.NewValidationError("name is mandatory"), util.I18nErrorNameRequired)
}
- if !util.IsNameValid(a.Name) {
- return util.NewI18nError(errInvalidInput, util.I18nErrorInvalidInput)
- }
- if config.NamingRules&1 == 0 && !usernameRegex.MatchString(a.Name) {
- return util.NewI18nError(
- util.NewValidationError(fmt.Sprintf("name %q is not valid, the following characters are allowed: a-zA-Z0-9-_.~", a.Name)),
- util.I18nErrorInvalidUser,
- )
- }
if !isActionTypeValid(a.Type) {
return util.NewValidationError(fmt.Sprintf("invalid action type: %d", a.Type))
}
@@ -1313,7 +1292,7 @@ func (a *EventAction) validateAssociation(trigger int, fsEvents []string) error
}
if trigger == EventTriggerFsEvent {
for _, ev := range fsEvents {
- if !slices.Contains(allowedSyncFsEvents, ev) {
+ if !util.Contains(allowedSyncFsEvents, ev) {
return util.NewI18nError(
util.NewValidationError("sync execution is only supported for upload and pre-* events"),
util.I18nErrorEvSyncUnsupportedFs,
@@ -1407,12 +1386,12 @@ func (f *ConditionOptions) validate() error {
}
for _, p := range f.Protocols {
- if !slices.Contains(SupportedRuleConditionProtocols, p) {
+ if !util.Contains(SupportedRuleConditionProtocols, p) {
return util.NewValidationError(fmt.Sprintf("unsupported rule condition protocol: %q", p))
}
}
for _, p := range f.ProviderObjects {
- if !slices.Contains(SupporteRuleConditionProviderObjects, p) {
+ if !util.Contains(SupporteRuleConditionProviderObjects, p) {
return util.NewValidationError(fmt.Sprintf("unsupported provider object: %q", p))
}
}
@@ -1517,7 +1496,7 @@ func (c *EventConditions) validate(trigger int) error {
)
}
for _, ev := range c.FsEvents {
- if !slices.Contains(SupportedFsEvents, ev) {
+ if !util.Contains(SupportedFsEvents, ev) {
return util.NewValidationError(fmt.Sprintf("unsupported fs event: %q", ev))
}
}
@@ -1537,7 +1516,7 @@ func (c *EventConditions) validate(trigger int) error {
)
}
for _, ev := range c.ProviderEvents {
- if !slices.Contains(SupportedProviderEvents, ev) {
+ if !util.Contains(SupportedProviderEvents, ev) {
return util.NewValidationError(fmt.Sprintf("unsupported provider event: %q", ev))
}
}
@@ -1590,7 +1569,7 @@ func (c *EventConditions) validate(trigger int) error {
c.Options.MinFileSize = 0
c.Options.MaxFileSize = 0
c.Schedules = nil
- if !slices.Contains(supportedIDPLoginEvents, c.IDPLoginEvent) {
+ if !util.Contains(supportedIDPLoginEvents, c.IDPLoginEvent) {
return util.NewValidationError(fmt.Sprintf("invalid Identity Provider login event %d", c.IDPLoginEvent))
}
default:
@@ -1681,19 +1660,10 @@ func (r *EventRule) isStatusValid() bool {
return r.Status >= 0 && r.Status <= 1
}
-func (r *EventRule) validate() error { //nolint:gocyclo
+func (r *EventRule) validate() error {
if r.Name == "" {
return util.NewI18nError(util.NewValidationError("name is mandatory"), util.I18nErrorNameRequired)
}
- if !util.IsNameValid(r.Name) {
- return util.NewI18nError(errInvalidInput, util.I18nErrorInvalidInput)
- }
- if config.NamingRules&1 == 0 && !usernameRegex.MatchString(r.Name) {
- return util.NewI18nError(
- util.NewValidationError(fmt.Sprintf("name %q is not valid, the following characters are allowed: a-zA-Z0-9-_.~", r.Name)),
- util.I18nErrorInvalidUser,
- )
- }
if !r.isStatusValid() {
return util.NewValidationError(fmt.Sprintf("invalid event rule status: %d", r.Status))
}
@@ -1753,7 +1723,7 @@ func (r *EventRule) validateMandatorySyncActions() error {
return nil
}
for _, ev := range r.Conditions.FsEvents {
- if slices.Contains(mandatorySyncFsEvents, ev) {
+ if util.Contains(mandatorySyncFsEvents, ev) {
return util.NewI18nError(
util.NewValidationError(fmt.Sprintf("event %q requires at least a sync action", ev)),
util.I18nErrorRuleSyncActionRequired,
@@ -1771,7 +1741,7 @@ func (r *EventRule) checkIPBlockedAndCertificateActions() error {
ActionTypeDataRetentionCheck, ActionTypeFilesystem, ActionTypePasswordExpirationCheck,
ActionTypeUserExpirationCheck}
for _, action := range r.Actions {
- if slices.Contains(unavailableActions, action.Type) {
+ if util.Contains(unavailableActions, action.Type) {
return fmt.Errorf("action %q, type %q is not supported for event trigger %q",
action.Name, getActionTypeAsString(action.Type), getTriggerTypeAsString(r.Trigger))
}
@@ -1787,7 +1757,7 @@ func (r *EventRule) checkProviderEventActions(providerObjectType string) error {
ActionTypeDataRetentionCheck, ActionTypeFilesystem,
ActionTypePasswordExpirationCheck, ActionTypeUserExpirationCheck}
for _, action := range r.Actions {
- if slices.Contains(userSpecificActions, action.Type) && providerObjectType != actionObjectUser {
+ if util.Contains(userSpecificActions, action.Type) && providerObjectType != actionObjectUser {
return fmt.Errorf("action %q, type %q is only supported for provider user events",
action.Name, getActionTypeAsString(action.Type))
}
@@ -1895,20 +1865,6 @@ func (r *EventRule) RenderAsJSON(reload bool) ([]byte, error) {
return json.Marshal(r)
}
-func cloneRenameConfigs(renames []RenameConfig) []RenameConfig {
- res := make([]RenameConfig, 0, len(renames))
- for _, c := range renames {
- res = append(res, RenameConfig{
- KeyValue: KeyValue{
- Key: c.Key,
- Value: c.Value,
- },
- UpdateModTime: c.UpdateModTime,
- })
- }
- return res
-}
-
func cloneKeyValues(keyVals []KeyValue) []KeyValue {
res := make([]KeyValue, 0, len(keyVals))
for _, kv := range keyVals {
diff --git a/internal/dataprovider/group.go b/internal/dataprovider/group.go
index fa09fda4..8577efda 100644
--- a/internal/dataprovider/group.go
+++ b/internal/dataprovider/group.go
@@ -132,22 +132,11 @@ func (g *Group) hasRedactedSecret() bool {
return g.UserSettings.FsConfig.HasRedactedSecret()
}
-func (g *Group) applyNamingRules() {
- g.Name = config.convertName(g.Name)
- for idx := range g.VirtualFolders {
- g.VirtualFolders[idx].Name = config.convertName(g.VirtualFolders[idx].Name)
- }
-}
-
func (g *Group) validate() error {
g.SetEmptySecretsIfNil()
- g.applyNamingRules()
if g.Name == "" {
return util.NewI18nError(util.NewValidationError("name is mandatory"), util.I18nErrorNameRequired)
}
- if !util.IsNameValid(g.Name) {
- return util.NewI18nError(errInvalidInput, util.I18nErrorInvalidInput)
- }
if config.NamingRules&1 == 0 && !usernameRegex.MatchString(g.Name) {
return util.NewI18nError(
util.NewValidationError(fmt.Sprintf("name %q is not valid, the following characters are allowed: a-zA-Z0-9-_.~", g.Name)),
diff --git a/internal/dataprovider/iplist.go b/internal/dataprovider/iplist.go
index bc3b5b99..739ef472 100644
--- a/internal/dataprovider/iplist.go
+++ b/internal/dataprovider/iplist.go
@@ -19,7 +19,6 @@ import (
"fmt"
"net"
"net/netip"
- "slices"
"strings"
"sync"
"sync/atomic"
@@ -86,7 +85,7 @@ var (
// CheckIPListType returns an error if the provided IP list type is not valid
func CheckIPListType(t IPListType) error {
- if !slices.Contains(supportedIPListType, t) {
+ if !util.Contains(supportedIPListType, t) {
return util.NewValidationError(fmt.Sprintf("invalid list type %d", t))
}
return nil
@@ -418,10 +417,6 @@ func (l *IPList) IsListed(ip, protocol string) (bool, int, error) {
l.mu.RLock()
defer l.mu.RUnlock()
- if l.Ranges.Len() == 0 {
- return false, 0, nil
- }
-
parsedIP := net.ParseIP(ip)
if parsedIP == nil {
return false, 0, fmt.Errorf("invalid IP %s", ip)
diff --git a/internal/dataprovider/memory.go b/internal/dataprovider/memory.go
index e8595291..05d72352 100644
--- a/internal/dataprovider/memory.go
+++ b/internal/dataprovider/memory.go
@@ -22,9 +22,7 @@ import (
"net/netip"
"os"
"path/filepath"
- "slices"
"sort"
- "strconv"
"sync"
"time"
@@ -208,32 +206,6 @@ func (p *MemoryProvider) updateAPIKeyLastUse(keyID string) error {
return nil
}
-func (p *MemoryProvider) getAdminSignature(username string) (string, error) {
- p.dbHandle.Lock()
- defer p.dbHandle.Unlock()
- if p.dbHandle.isClosed {
- return "", errMemoryProviderClosed
- }
- admin, err := p.adminExistsInternal(username)
- if err != nil {
- return "", err
- }
- return strconv.FormatInt(admin.UpdatedAt, 10), nil
-}
-
-func (p *MemoryProvider) getUserSignature(username string) (string, error) {
- p.dbHandle.Lock()
- defer p.dbHandle.Unlock()
- if p.dbHandle.isClosed {
- return "", errMemoryProviderClosed
- }
- user, err := p.userExistsInternal(username)
- if err != nil {
- return "", err
- }
- return strconv.FormatInt(user.UpdatedAt, 10), nil
-}
-
func (p *MemoryProvider) setUpdatedAt(username string) {
p.dbHandle.Lock()
defer p.dbHandle.Unlock()
@@ -376,6 +348,9 @@ func (p *MemoryProvider) addUser(user *User) error {
if err := p.addUserToRole(user.Username, user.Role); err != nil {
return err
}
+ sort.Slice(user.Groups, func(i, j int) bool {
+ return user.Groups[i].Name < user.Groups[j].Name
+ })
var mappedGroups []string
for idx := range user.Groups {
if err = p.addUserToGroupMapping(user.Username, user.Groups[idx].Name); err != nil {
@@ -387,6 +362,9 @@ func (p *MemoryProvider) addUser(user *User) error {
}
mappedGroups = append(mappedGroups, user.Groups[idx].Name)
}
+ sort.Slice(user.VirtualFolders, func(i, j int) bool {
+ return user.VirtualFolders[i].Name < user.VirtualFolders[j].Name
+ })
var mappedFolders []string
for idx := range user.VirtualFolders {
if err = p.addUserToFolderMapping(user.Username, user.VirtualFolders[idx].Name); err != nil {
@@ -432,6 +410,9 @@ func (p *MemoryProvider) updateUser(user *User) error { //nolint:gocyclo
for idx := range u.Groups {
p.removeUserFromGroupMapping(u.Username, u.Groups[idx].Name)
}
+ sort.Slice(user.Groups, func(i, j int) bool {
+ return user.Groups[i].Name < user.Groups[j].Name
+ })
for idx := range user.Groups {
if err = p.addUserToGroupMapping(user.Username, user.Groups[idx].Name); err != nil {
// try to add old mapping
@@ -447,6 +428,9 @@ func (p *MemoryProvider) updateUser(user *User) error { //nolint:gocyclo
for _, oldFolder := range u.VirtualFolders {
p.removeRelationFromFolderMapping(oldFolder.Name, u.Username, "")
}
+ sort.Slice(user.VirtualFolders, func(i, j int) bool {
+ return user.VirtualFolders[i].Name < user.VirtualFolders[j].Name
+ })
for idx := range user.VirtualFolders {
if err = p.addUserToFolderMapping(user.Username, user.VirtualFolders[idx].Name); err != nil {
// try to add old mapping
@@ -759,6 +743,9 @@ func (p *MemoryProvider) addAdmin(admin *Admin) error {
return err
}
var mappedAdmins []string
+ sort.Slice(admin.Groups, func(i, j int) bool {
+ return admin.Groups[i].Name < admin.Groups[j].Name
+ })
for idx := range admin.Groups {
if err = p.addAdminToGroupMapping(admin.Username, admin.Groups[idx].Name); err != nil {
// try to remove group mapping
@@ -801,6 +788,9 @@ func (p *MemoryProvider) updateAdmin(admin *Admin) error {
for idx := range a.Groups {
p.removeAdminFromGroupMapping(a.Username, a.Groups[idx].Name)
}
+ sort.Slice(admin.Groups, func(i, j int) bool {
+ return admin.Groups[i].Name < admin.Groups[j].Name
+ })
for idx := range admin.Groups {
if err = p.addAdminToGroupMapping(admin.Username, admin.Groups[idx].Name); err != nil {
// try to add old mapping
@@ -1064,6 +1054,9 @@ func (p *MemoryProvider) addGroup(group *Group) error {
group.UpdatedAt = util.GetTimeAsMsSinceEpoch(time.Now())
group.Users = nil
group.Admins = nil
+ sort.Slice(group.VirtualFolders, func(i, j int) bool {
+ return group.VirtualFolders[i].Name < group.VirtualFolders[j].Name
+ })
var mappedFolders []string
for idx := range group.VirtualFolders {
if err = p.addGroupToFolderMapping(group.Name, group.VirtualFolders[idx].Name); err != nil {
@@ -1097,6 +1090,9 @@ func (p *MemoryProvider) updateGroup(group *Group) error {
for _, oldFolder := range g.VirtualFolders {
p.removeRelationFromFolderMapping(oldFolder.Name, "", g.Name)
}
+ sort.Slice(group.VirtualFolders, func(i, j int) bool {
+ return group.VirtualFolders[i].Name < group.VirtualFolders[j].Name
+ })
for idx := range group.VirtualFolders {
if err = p.addGroupToFolderMapping(group.Name, group.VirtualFolders[idx].Name); err != nil {
// try to add old mapping
@@ -1214,7 +1210,7 @@ func (p *MemoryProvider) addRuleToActionMapping(ruleName, actionName string) err
if err != nil {
return util.NewGenericError(fmt.Sprintf("action %q does not exist", actionName))
}
- if !slices.Contains(a.Rules, ruleName) {
+ if !util.Contains(a.Rules, ruleName) {
a.Rules = append(a.Rules, ruleName)
p.dbHandle.actions[actionName] = a
}
@@ -1227,7 +1223,7 @@ func (p *MemoryProvider) removeRuleFromActionMapping(ruleName, actionName string
providerLog(logger.LevelWarn, "action %q does not exist, cannot remove from mapping", actionName)
return
}
- if slices.Contains(a.Rules, ruleName) {
+ if util.Contains(a.Rules, ruleName) {
var rules []string
for _, r := range a.Rules {
if r != ruleName {
@@ -1244,7 +1240,7 @@ func (p *MemoryProvider) addAdminToGroupMapping(username, groupname string) erro
if err != nil {
return err
}
- if !slices.Contains(g.Admins, username) {
+ if !util.Contains(g.Admins, username) {
g.Admins = append(g.Admins, username)
p.dbHandle.groups[groupname] = g
}
@@ -1287,7 +1283,7 @@ func (p *MemoryProvider) addUserToGroupMapping(username, groupname string) error
if err != nil {
return err
}
- if !slices.Contains(g.Users, username) {
+ if !util.Contains(g.Users, username) {
g.Users = append(g.Users, username)
p.dbHandle.groups[groupname] = g
}
@@ -1317,7 +1313,7 @@ func (p *MemoryProvider) addAdminToRole(username, role string) error {
if err != nil {
return fmt.Errorf("%w: role %q does not exist", ErrForeignKeyViolated, role)
}
- if !slices.Contains(r.Admins, username) {
+ if !util.Contains(r.Admins, username) {
r.Admins = append(r.Admins, username)
p.dbHandle.roles[role] = r
}
@@ -1351,7 +1347,7 @@ func (p *MemoryProvider) addUserToRole(username, role string) error {
if err != nil {
return fmt.Errorf("%w: role %q does not exist", ErrForeignKeyViolated, role)
}
- if !slices.Contains(r.Users, username) {
+ if !util.Contains(r.Users, username) {
r.Users = append(r.Users, username)
p.dbHandle.roles[role] = r
}
@@ -1382,7 +1378,7 @@ func (p *MemoryProvider) addUserToFolderMapping(username, foldername string) err
if err != nil {
return util.NewGenericError(fmt.Sprintf("unable to get folder %q: %v", foldername, err))
}
- if !slices.Contains(f.Users, username) {
+ if !util.Contains(f.Users, username) {
f.Users = append(f.Users, username)
p.dbHandle.vfolders[foldername] = f
}
@@ -1394,7 +1390,7 @@ func (p *MemoryProvider) addGroupToFolderMapping(name, foldername string) error
if err != nil {
return util.NewGenericError(fmt.Sprintf("unable to get folder %q: %v", foldername, err))
}
- if !slices.Contains(f.Groups, name) {
+ if !util.Contains(f.Groups, name) {
f.Groups = append(f.Groups, name)
p.dbHandle.vfolders[foldername] = f
}
@@ -2093,11 +2089,11 @@ func (p *MemoryProvider) addSharedSession(_ Session) error {
return ErrNotImplemented
}
-func (p *MemoryProvider) deleteSharedSession(_ string, _ SessionType) error {
+func (p *MemoryProvider) deleteSharedSession(_ string) error {
return ErrNotImplemented
}
-func (p *MemoryProvider) getSharedSession(_ string, _ SessionType) (Session, error) {
+func (p *MemoryProvider) getSharedSession(_ string) (Session, error) {
return Session{}, ErrNotImplemented
}
diff --git a/internal/dataprovider/mysql.go b/internal/dataprovider/mysql.go
index f6be87b0..659637d9 100644
--- a/internal/dataprovider/mysql.go
+++ b/internal/dataprovider/mysql.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build !nomysql
+// +build !nomysql
package dataprovider
@@ -38,11 +39,11 @@ import (
const (
mysqlResetSQL = "DROP TABLE IF EXISTS `{{api_keys}}` CASCADE;" +
+ "DROP TABLE IF EXISTS `{{folders_mapping}}` CASCADE;" +
"DROP TABLE IF EXISTS `{{users_folders_mapping}}` CASCADE;" +
"DROP TABLE IF EXISTS `{{users_groups_mapping}}` CASCADE;" +
"DROP TABLE IF EXISTS `{{admins_groups_mapping}}` CASCADE;" +
"DROP TABLE IF EXISTS `{{groups_folders_mapping}}` CASCADE;" +
- "DROP TABLE IF EXISTS `{{shares_groups_mapping}}` CASCADE;" +
"DROP TABLE IF EXISTS `{{admins}}` CASCADE;" +
"DROP TABLE IF EXISTS `{{folders}}` CASCADE;" +
"DROP TABLE IF EXISTS `{{shares}}` CASCADE;" +
@@ -83,8 +84,8 @@ const (
"CREATE TABLE `{{groups}}` (`id` integer AUTO_INCREMENT NOT NULL PRIMARY KEY, " +
"`name` varchar(255) NOT NULL UNIQUE, `description` varchar(512) NULL, `created_at` bigint NOT NULL, " +
"`updated_at` bigint NOT NULL, `user_settings` longtext NULL);" +
- "CREATE TABLE `{{shared_sessions}}` (`key` varchar(128) NOT NULL, `type` integer NOT NULL, `data` longtext NOT NULL, " +
- "`timestamp` bigint NOT NULL, PRIMARY KEY (`key`, `type`));" +
+ "CREATE TABLE `{{shared_sessions}}` (`key` varchar(128) NOT NULL PRIMARY KEY, " +
+ "`data` longtext NOT NULL, `type` integer NOT NULL, `timestamp` bigint NOT NULL);" +
"CREATE TABLE `{{users}}` (`id` integer AUTO_INCREMENT NOT NULL PRIMARY KEY, `username` varchar(255) NOT NULL UNIQUE, " +
"`status` integer NOT NULL, `expiration_date` bigint NOT NULL, `description` varchar(512) NULL, `password` longtext NULL, " +
"`public_keys` longtext NULL, `home_dir` longtext NOT NULL, `uid` bigint NOT NULL, `gid` bigint NOT NULL, " +
@@ -94,41 +95,38 @@ const (
"`last_login` bigint NOT NULL, `filters` longtext NULL, `filesystem` longtext NULL, `additional_info` longtext NULL, " +
"`created_at` bigint NOT NULL, `updated_at` bigint NOT NULL, `email` varchar(255) NULL, " +
"`upload_data_transfer` integer NOT NULL, `download_data_transfer` integer NOT NULL, " +
- "`total_data_transfer` integer NOT NULL, `used_upload_data_transfer` bigint NOT NULL, " +
- "`used_download_data_transfer` bigint NOT NULL, `deleted_at` bigint NOT NULL, `first_download` bigint NOT NULL, " +
+ "`total_data_transfer` integer NOT NULL, `used_upload_data_transfer` integer NOT NULL, " +
+ "`used_download_data_transfer` integer NOT NULL, `deleted_at` bigint NOT NULL, `first_download` bigint NOT NULL, " +
"`first_upload` bigint NOT NULL, `last_password_change` bigint NOT NULL, `role_id` integer NULL);" +
"CREATE TABLE `{{groups_folders_mapping}}` (`id` integer AUTO_INCREMENT NOT NULL PRIMARY KEY, " +
"`group_id` integer NOT NULL, `folder_id` integer NOT NULL, " +
- "`virtual_path` longtext NOT NULL, `quota_size` bigint NOT NULL, `quota_files` integer NOT NULL, `sort_order` integer NOT NULL);" +
+ "`virtual_path` longtext NOT NULL, `quota_size` bigint NOT NULL, `quota_files` integer NOT NULL);" +
"CREATE TABLE `{{users_groups_mapping}}` (`id` integer AUTO_INCREMENT NOT NULL PRIMARY KEY, " +
- "`user_id` integer NOT NULL, `group_id` integer NOT NULL, `group_type` integer NOT NULL, `sort_order` integer NOT NULL);" +
+ "`user_id` integer NOT NULL, `group_id` integer NOT NULL, `group_type` integer NOT NULL);" +
"CREATE TABLE `{{users_folders_mapping}}` (`id` integer AUTO_INCREMENT NOT NULL PRIMARY KEY, `virtual_path` longtext NOT NULL, " +
- "`quota_size` bigint NOT NULL, `quota_files` integer NOT NULL, `folder_id` integer NOT NULL, `user_id` integer NOT NULL, `sort_order` integer NOT NULL);" +
+ "`quota_size` bigint NOT NULL, `quota_files` integer NOT NULL, `folder_id` integer NOT NULL, `user_id` integer NOT NULL);" +
"ALTER TABLE `{{users_folders_mapping}}` ADD CONSTRAINT `{{prefix}}unique_user_folder_mapping` " +
"UNIQUE (`user_id`, `folder_id`);" +
"ALTER TABLE `{{users_folders_mapping}}` ADD CONSTRAINT `{{prefix}}users_folders_mapping_user_id_fk_users_id` " +
"FOREIGN KEY (`user_id`) REFERENCES `{{users}}` (`id`) ON DELETE CASCADE;" +
"ALTER TABLE `{{users_folders_mapping}}` ADD CONSTRAINT `{{prefix}}users_folders_mapping_folder_id_fk_folders_id` " +
"FOREIGN KEY (`folder_id`) REFERENCES `{{folders}}` (`id`) ON DELETE CASCADE;" +
- "CREATE INDEX `{{prefix}}users_folders_mapping_sort_order_idx` ON `{{users_folders_mapping}}` (`sort_order`);" +
"ALTER TABLE `{{users_groups_mapping}}` ADD CONSTRAINT `{{prefix}}unique_user_group_mapping` UNIQUE (`user_id`, `group_id`);" +
"ALTER TABLE `{{groups_folders_mapping}}` ADD CONSTRAINT `{{prefix}}unique_group_folder_mapping` UNIQUE (`group_id`, `folder_id`);" +
"ALTER TABLE `{{users_groups_mapping}}` ADD CONSTRAINT `{{prefix}}users_groups_mapping_group_id_fk_groups_id` " +
"FOREIGN KEY (`group_id`) REFERENCES `{{groups}}` (`id`) ON DELETE NO ACTION;" +
"ALTER TABLE `{{users_groups_mapping}}` ADD CONSTRAINT `{{prefix}}users_groups_mapping_user_id_fk_users_id` " +
"FOREIGN KEY (`user_id`) REFERENCES `{{users}}` (`id`) ON DELETE CASCADE; " +
- "CREATE INDEX `{{prefix}}users_groups_mapping_sort_order_idx` ON `{{users_groups_mapping}}` (`sort_order`);" +
"ALTER TABLE `{{groups_folders_mapping}}` ADD CONSTRAINT `{{prefix}}groups_folders_mapping_folder_id_fk_folders_id` " +
"FOREIGN KEY (`folder_id`) REFERENCES `{{folders}}` (`id`) ON DELETE CASCADE;" +
"ALTER TABLE `{{groups_folders_mapping}}` ADD CONSTRAINT `{{prefix}}groups_folders_mapping_group_id_fk_groups_id` " +
"FOREIGN KEY (`group_id`) REFERENCES `{{groups}}` (`id`) ON DELETE CASCADE;" +
- "CREATE INDEX `{{prefix}}groups_folders_mapping_sort_order_idx` ON `{{groups_folders_mapping}}` (`sort_order`); " +
"CREATE TABLE `{{shares}}` (`id` integer AUTO_INCREMENT NOT NULL PRIMARY KEY, " +
"`share_id` varchar(60) NOT NULL UNIQUE, `name` varchar(255) NOT NULL, `description` varchar(512) NULL, " +
"`scope` integer NOT NULL, `paths` longtext NOT NULL, `created_at` bigint NOT NULL, " +
"`updated_at` bigint NOT NULL, `last_use_at` bigint NOT NULL, `expires_at` bigint NOT NULL, " +
"`password` longtext NULL, `max_tokens` integer NOT NULL, `used_tokens` integer NOT NULL, " +
- "`allow_from` longtext NULL, `options` longtext NULL, `user_id` integer NOT NULL);" +
+ "`allow_from` longtext NULL, `user_id` integer NOT NULL);" +
"ALTER TABLE `{{shares}}` ADD CONSTRAINT `{{prefix}}shares_user_id_fk_users_id` " +
"FOREIGN KEY (`user_id`) REFERENCES `{{users}}` (`id`) ON DELETE CASCADE;" +
"CREATE TABLE `{{api_keys}}` (`id` integer AUTO_INCREMENT NOT NULL PRIMARY KEY, `name` varchar(255) NOT NULL, `key_id` varchar(50) NOT NULL UNIQUE," +
@@ -152,14 +150,13 @@ const (
"ALTER TABLE `{{rules_actions_mapping}}` ADD CONSTRAINT `{{prefix}}rules_actions_mapping_action_id_fk_events_targets_id` " +
"FOREIGN KEY (`action_id`) REFERENCES `{{events_actions}}` (`id`) ON DELETE NO ACTION;" +
"CREATE TABLE `{{admins_groups_mapping}}` (`id` integer AUTO_INCREMENT NOT NULL PRIMARY KEY, " +
- " `admin_id` integer NOT NULL, `group_id` integer NOT NULL, `options` longtext NOT NULL, `sort_order` integer NOT NULL);" +
+ " `admin_id` integer NOT NULL, `group_id` integer NOT NULL, `options` longtext NOT NULL);" +
"ALTER TABLE `{{admins_groups_mapping}}` ADD CONSTRAINT `{{prefix}}unique_admin_group_mapping` " +
"UNIQUE (`admin_id`, `group_id`);" +
"ALTER TABLE `{{admins_groups_mapping}}` ADD CONSTRAINT `{{prefix}}admins_groups_mapping_admin_id_fk_admins_id` " +
"FOREIGN KEY (`admin_id`) REFERENCES `{{admins}}` (`id`) ON DELETE CASCADE;" +
"ALTER TABLE `{{admins_groups_mapping}}` ADD CONSTRAINT `{{prefix}}admins_groups_mapping_group_id_fk_groups_id` " +
"FOREIGN KEY (`group_id`) REFERENCES `{{groups}}` (`id`) ON DELETE CASCADE;" +
- "CREATE INDEX `{{prefix}}admins_groups_mapping_sort_order_idx` ON `{{admins_groups_mapping}}` (`sort_order`); " +
"CREATE TABLE `{{nodes}}` (`id` integer AUTO_INCREMENT NOT NULL PRIMARY KEY, " +
"`name` varchar(255) NOT NULL UNIQUE, `data` longtext NOT NULL, `created_at` bigint NOT NULL, " +
"`updated_at` bigint NOT NULL);" +
@@ -196,17 +193,11 @@ const (
"CREATE INDEX `{{prefix}}ip_lists_updated_at_idx` ON `{{ip_lists}}` (`updated_at`);" +
"CREATE INDEX `{{prefix}}ip_lists_deleted_at_idx` ON `{{ip_lists}}` (`deleted_at`);" +
"CREATE INDEX `{{prefix}}ip_lists_first_last_idx` ON `{{ip_lists}}` (`first`, `last`);" +
- "INSERT INTO {{schema_version}} (version) VALUES (33);"
- mysqlV34SQL = "CREATE TABLE `{{shares_groups_mapping}}` (`id` integer AUTO_INCREMENT NOT NULL PRIMARY KEY," +
- "`share_id` integer NOT NULL, `group_id` integer NOT NULL, `permissions` integer NOT NULL," +
- "`sort_order` integer NOT NULL," +
- "CONSTRAINT `{{prefix}}unique_share_group_mapping` UNIQUE (`share_id`, `group_id`)," +
- "CONSTRAINT `{{prefix}}shares_groups_mapping_share_id_fk` FOREIGN KEY (`share_id`) REFERENCES `{{shares}}` (`id`) ON DELETE CASCADE," +
- "CONSTRAINT `{{prefix}}shares_groups_mapping_group_id_fk` FOREIGN KEY (`group_id`) REFERENCES `{{groups}}` (`id`) ON DELETE CASCADE); " +
- "CREATE INDEX `{{prefix}}shares_groups_mapping_sort_order_idx` ON `{{shares_groups_mapping}}` (`sort_order`); " +
- "CREATE INDEX `{{prefix}}shares_groups_mapping_share_id_idx` ON `{{shares_groups_mapping}}` (`share_id`); " +
- "CREATE INDEX `{{prefix}}shares_groups_mapping_group_id_idx` ON `{{shares_groups_mapping}}` (`group_id`);"
- mysqlV34DownSQL = "DROP TABLE IF EXISTS `{{shares_groups_mapping}}`;"
+ "INSERT INTO {{schema_version}} (version) VALUES (28);"
+ mysqlV29SQL = "ALTER TABLE `{{users}}` MODIFY `used_download_data_transfer` bigint NOT NULL;" +
+ "ALTER TABLE `{{users}}` MODIFY `used_upload_data_transfer` bigint NOT NULL;"
+ mysqlV29DownSQL = "ALTER TABLE `{{users}}` MODIFY `used_upload_data_transfer` integer NOT NULL;" +
+ "ALTER TABLE `{{users}}` MODIFY `used_download_data_transfer` integer NOT NULL;"
)
// MySQLProvider defines the auth provider for MySQL/MariaDB database
@@ -338,14 +329,6 @@ func (p *MySQLProvider) getUsedQuota(username string) (int, int64, int64, int64,
return sqlCommonGetUsedQuota(username, p.dbHandle)
}
-func (p *MySQLProvider) getAdminSignature(username string) (string, error) {
- return sqlCommonGetAdminSignature(username, p.dbHandle)
-}
-
-func (p *MySQLProvider) getUserSignature(username string) (string, error) {
- return sqlCommonGetUserSignature(username, p.dbHandle)
-}
-
func (p *MySQLProvider) setUpdatedAt(username string) {
sqlCommonSetUpdatedAt(username, p.dbHandle)
}
@@ -600,12 +583,12 @@ func (p *MySQLProvider) addSharedSession(session Session) error {
return sqlCommonAddSession(session, p.dbHandle)
}
-func (p *MySQLProvider) deleteSharedSession(key string, sessionType SessionType) error {
- return sqlCommonDeleteSession(key, sessionType, p.dbHandle)
+func (p *MySQLProvider) deleteSharedSession(key string) error {
+ return sqlCommonDeleteSession(key, p.dbHandle)
}
-func (p *MySQLProvider) getSharedSession(key string, sessionType SessionType) (Session, error) {
- return sqlCommonGetSession(key, sessionType, p.dbHandle)
+func (p *MySQLProvider) getSharedSession(key string) (Session, error) {
+ return sqlCommonGetSession(key, p.dbHandle)
}
func (p *MySQLProvider) cleanupSharedSessions(sessionType SessionType, before int64) error {
@@ -793,11 +776,11 @@ func (p *MySQLProvider) initializeDatabase() error {
if errors.Is(err, sql.ErrNoRows) {
return errSchemaVersionEmpty
}
- logger.InfoToConsole("creating initial database schema, version 33")
- providerLog(logger.LevelInfo, "creating initial database schema, version 33")
+ logger.InfoToConsole("creating initial database schema, version 28")
+ providerLog(logger.LevelInfo, "creating initial database schema, version 28")
initialSQL := sqlReplaceAll(mysqlInitialSQL)
- return sqlCommonExecSQLAndUpdateDBVersion(p.dbHandle, strings.Split(initialSQL, ";"), 33, true)
+ return sqlCommonExecSQLAndUpdateDBVersion(p.dbHandle, strings.Split(initialSQL, ";"), 28, true)
}
func (p *MySQLProvider) migrateDatabase() error {
@@ -810,13 +793,13 @@ func (p *MySQLProvider) migrateDatabase() error {
case version == sqlDatabaseVersion:
providerLog(logger.LevelDebug, "sql database is up to date, current version: %d", version)
return ErrNoInitRequired
- case version < 33:
- err = errSchemaVersionTooOld(version)
+ case version < 28:
+ err = fmt.Errorf("database schema version %d is too old, please see the upgrading docs", version)
providerLog(logger.LevelError, "%v", err)
logger.ErrorToConsole("%v", err)
return err
- case version == 33:
- return updateMySQLDatabaseFromV33(p.dbHandle)
+ case version == 28:
+ return updateMySQLDatabaseFrom28To29(p.dbHandle)
default:
if version > sqlDatabaseVersion {
providerLog(logger.LevelError, "database schema version %d is newer than the supported one: %d", version,
@@ -839,8 +822,8 @@ func (p *MySQLProvider) revertDatabase(targetVersion int) error {
}
switch dbVersion.Version {
- case 34:
- return downgradeMySQLDatabaseFromV34(p.dbHandle)
+ case 29:
+ return downgradeMySQLDatabaseFrom29To28(p.dbHandle)
default:
return fmt.Errorf("database schema version not handled: %d", dbVersion.Version)
}
@@ -879,29 +862,18 @@ func (p *MySQLProvider) normalizeError(err error, fieldType int) error {
return err
}
-func updateMySQLDatabaseFromV33(dbHandle *sql.DB) error {
- return updateMySQLDatabaseFrom33To34(dbHandle)
+func updateMySQLDatabaseFrom28To29(dbHandle *sql.DB) error {
+ logger.InfoToConsole("updating database schema version: 28 -> 29")
+ providerLog(logger.LevelInfo, "updating database schema version: 28 -> 29")
+
+ sql := strings.ReplaceAll(mysqlV29SQL, "{{users}}", sqlTableUsers)
+ return sqlCommonExecSQLAndUpdateDBVersion(dbHandle, strings.Split(sql, ";"), 29, true)
}
-func downgradeMySQLDatabaseFromV34(dbHandle *sql.DB) error {
- return downgradeMySQLDatabaseFrom34To33(dbHandle)
-}
-
-func updateMySQLDatabaseFrom33To34(dbHandle *sql.DB) error {
- logger.InfoToConsole("updating database schema version: 33 -> 34")
- providerLog(logger.LevelInfo, "updating database schema version: 33 -> 34")
-
- sql := strings.ReplaceAll(mysqlV34SQL, "{{prefix}}", config.SQLTablesPrefix)
- sql = strings.ReplaceAll(sql, "{{shares}}", sqlTableShares)
- sql = strings.ReplaceAll(sql, "{{shares_groups_mapping}}", sqlTableSharesGroupsMapping)
- sql = strings.ReplaceAll(sql, "{{groups}}", sqlTableGroups)
- return sqlCommonExecSQLAndUpdateDBVersion(dbHandle, strings.Split(sql, ";"), 34, true)
-}
-
-func downgradeMySQLDatabaseFrom34To33(dbHandle *sql.DB) error {
- logger.InfoToConsole("downgrading database schema version: 34 -> 33")
- providerLog(logger.LevelInfo, "downgrading database schema version: 34 -> 33")
-
- sql := strings.ReplaceAll(mysqlV34DownSQL, "{{shares_groups_mapping}}", sqlTableSharesGroupsMapping)
- return sqlCommonExecSQLAndUpdateDBVersion(dbHandle, strings.Split(sql, ";"), 33, false)
+func downgradeMySQLDatabaseFrom29To28(dbHandle *sql.DB) error {
+ logger.InfoToConsole("downgrading database schema version: 29 -> 28")
+ providerLog(logger.LevelInfo, "downgrading database schema version: 29 -> 28")
+
+ sql := strings.ReplaceAll(mysqlV29DownSQL, "{{users}}", sqlTableUsers)
+ return sqlCommonExecSQLAndUpdateDBVersion(dbHandle, strings.Split(sql, ";"), 28, false)
}
diff --git a/internal/dataprovider/mysql_disabled.go b/internal/dataprovider/mysql_disabled.go
index 203092b2..c6c09ded 100644
--- a/internal/dataprovider/mysql_disabled.go
+++ b/internal/dataprovider/mysql_disabled.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build nomysql
+// +build nomysql
package dataprovider
diff --git a/internal/dataprovider/node.go b/internal/dataprovider/node.go
index 4b8fc803..5bdf0c25 100644
--- a/internal/dataprovider/node.go
+++ b/internal/dataprovider/node.go
@@ -17,21 +17,21 @@ package dataprovider
import (
"bytes"
"context"
- "crypto/sha256"
- "encoding/hex"
"encoding/json"
"errors"
"fmt"
+ "hash/fnv"
"io"
"net/http"
"strconv"
"strings"
"time"
- "github.com/go-jose/go-jose/v4"
+ "github.com/lestrrat-go/jwx/v2/jwa"
+ "github.com/lestrrat-go/jwx/v2/jwt"
+ "github.com/rs/xid"
"github.com/drakkan/sftpgo/v2/internal/httpclient"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/kms"
"github.com/drakkan/sftpgo/v2/internal/logger"
"github.com/drakkan/sftpgo/v2/internal/util"
@@ -45,8 +45,7 @@ const (
const (
// NodeTokenHeader defines the header to use for the node auth token
- NodeTokenHeader = "X-SFTPGO-Node"
- nodeTokenAudience = "node"
+ NodeTokenHeader = "X-SFTPGO-Node"
)
var (
@@ -109,12 +108,12 @@ func (n *NodeData) validate() error {
}
func (n *NodeData) getNodeName() string {
- h := sha256.New()
+ h := fnv.New64a()
var b bytes.Buffer
- fmt.Fprintf(&b, "%s:%d", n.Host, n.Port)
+ b.WriteString(fmt.Sprintf("%s:%d", n.Host, n.Port))
h.Write(b.Bytes())
- return hex.EncodeToString(h.Sum(nil))
+ return strconv.FormatUint(h.Sum64(), 10)
}
// Node defines a cluster node
@@ -132,26 +131,33 @@ func (n *Node) validate() error {
return n.Data.validate()
}
-func (n *Node) authenticate(token string) (*jwt.Claims, error) {
+func (n *Node) authenticate(token string) (string, string, error) {
if err := n.Data.Key.TryDecrypt(); err != nil {
providerLog(logger.LevelError, "unable to decrypt node key: %v", err)
- return nil, err
+ return "", "", err
}
if token == "" {
- return nil, ErrInvalidCredentials
+ return "", "", ErrInvalidCredentials
}
- claims, err := jwt.VerifyTokenWithKey(token, []jose.SignatureAlgorithm{jose.HS256}, []byte(n.Data.Key.GetPayload()))
+ t, err := jwt.Parse([]byte(token), jwt.WithKey(jwa.HS256, []byte(n.Data.Key.GetPayload())), jwt.WithValidate(true))
if err != nil {
- return nil, fmt.Errorf("unable to parse and validate token: %v", err)
+ return "", "", fmt.Errorf("unable to parse and validate token: %v", err)
}
- if claims.Username == "" {
- return nil, errors.New("no admin username associated with node token")
+ var adminUsername, role string
+ if admin, ok := t.Get("admin"); ok {
+ if val, ok := admin.(string); ok && val != "" {
+ adminUsername = val
+ }
}
- if !claims.Audience.Contains(nodeTokenAudience) {
- return nil, errors.New("invalid node token audience")
+ if adminUsername == "" {
+ return "", "", errors.New("no admin username associated with node token")
}
-
- return claims, nil
+ if r, ok := t.Get("role"); ok {
+ if val, ok := r.(string); ok && val != "" {
+ role = val
+ }
+ }
+ return adminUsername, role, nil
}
// getBaseURL returns the base URL for this node
@@ -168,37 +174,35 @@ func (n *Node) getBaseURL() string {
}
// generateAuthToken generates a new auth token
-func (n *Node) generateAuthToken(username, role string, permissions []string) (string, error) {
+func (n *Node) generateAuthToken(username, role string) (string, error) {
if err := n.Data.Key.TryDecrypt(); err != nil {
return "", fmt.Errorf("unable to decrypt node key: %w", err)
}
- signer, err := jwt.NewSigner(jose.HS256, []byte(n.Data.Key.GetPayload()))
- if err != nil {
- return "", fmt.Errorf("unable to create signer: %w", err)
- }
- claims := &jwt.Claims{
- Username: username,
- Role: role,
- Permissions: permissions,
- }
- claims.Audience = []string{nodeTokenAudience}
- claims.SetExpiry(time.Now().Add(1 * time.Minute))
- payload, err := signer.Sign(claims)
+ now := time.Now().UTC()
+
+ t := jwt.New()
+ t.Set("admin", username) //nolint:errcheck
+ t.Set("role", role) //nolint:errcheck
+ t.Set(jwt.JwtIDKey, xid.New().String()) //nolint:errcheck
+ t.Set(jwt.NotBeforeKey, now.Add(-30*time.Second)) //nolint:errcheck
+ t.Set(jwt.ExpirationKey, now.Add(1*time.Minute)) //nolint:errcheck
+
+ payload, err := jwt.Sign(t, jwt.WithKey(jwa.HS256, []byte(n.Data.Key.GetPayload())))
if err != nil {
return "", fmt.Errorf("unable to sign authentication token: %w", err)
}
- return payload, nil
+ return util.BytesToString(payload), nil
}
func (n *Node) prepareRequest(ctx context.Context, username, role, relativeURL, method string,
- permissions []string, body io.Reader,
+ body io.Reader,
) (*http.Request, error) {
url := fmt.Sprintf("%s%s", n.getBaseURL(), relativeURL)
req, err := http.NewRequestWithContext(ctx, method, url, body)
if err != nil {
return nil, err
}
- token, err := n.generateAuthToken(username, role, permissions)
+ token, err := n.generateAuthToken(username, role)
if err != nil {
return nil, err
}
@@ -208,11 +212,11 @@ func (n *Node) prepareRequest(ctx context.Context, username, role, relativeURL,
// SendGetRequest sends an HTTP GET request to this node.
// The responseHolder must be a pointer
-func (n *Node) SendGetRequest(username, role, relativeURL string, permissions []string, responseHolder any) error {
+func (n *Node) SendGetRequest(username, role, relativeURL string, responseHolder any) error {
ctx, cancel := context.WithTimeout(context.Background(), nodeReqTimeout)
defer cancel()
- req, err := n.prepareRequest(ctx, username, role, relativeURL, http.MethodGet, permissions, nil)
+ req, err := n.prepareRequest(ctx, username, role, relativeURL, http.MethodGet, nil)
if err != nil {
return err
}
@@ -240,11 +244,11 @@ func (n *Node) SendGetRequest(username, role, relativeURL string, permissions []
}
// SendDeleteRequest sends an HTTP DELETE request to this node
-func (n *Node) SendDeleteRequest(username, role, relativeURL string, permissions []string) error {
+func (n *Node) SendDeleteRequest(username, role, relativeURL string) error {
ctx, cancel := context.WithTimeout(context.Background(), nodeReqTimeout)
defer cancel()
- req, err := n.prepareRequest(ctx, username, role, relativeURL, http.MethodDelete, permissions, nil)
+ req, err := n.prepareRequest(ctx, username, role, relativeURL, http.MethodDelete, nil)
if err != nil {
return err
}
@@ -264,9 +268,9 @@ func (n *Node) SendDeleteRequest(username, role, relativeURL string, permissions
}
// AuthenticateNodeToken check the validity of the provided token
-func AuthenticateNodeToken(token string) (*jwt.Claims, error) {
+func AuthenticateNodeToken(token string) (string, string, error) {
if currentNode == nil {
- return nil, errNoClusterNodes
+ return "", "", errNoClusterNodes
}
return currentNode.authenticate(token)
}
diff --git a/internal/dataprovider/pgsql.go b/internal/dataprovider/pgsql.go
index c4f7c93a..3e7d69d2 100644
--- a/internal/dataprovider/pgsql.go
+++ b/internal/dataprovider/pgsql.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build !nopgsql
+// +build !nopgsql
package dataprovider
@@ -23,7 +24,6 @@ import (
"errors"
"fmt"
"net"
- "slices"
"strconv"
"strings"
"time"
@@ -40,11 +40,11 @@ import (
const (
pgsqlResetSQL = `DROP TABLE IF EXISTS "{{api_keys}}" CASCADE;
+DROP TABLE IF EXISTS "{{folders_mapping}}" CASCADE;
DROP TABLE IF EXISTS "{{users_folders_mapping}}" CASCADE;
DROP TABLE IF EXISTS "{{users_groups_mapping}}" CASCADE;
DROP TABLE IF EXISTS "{{admins_groups_mapping}}" CASCADE;
DROP TABLE IF EXISTS "{{groups_folders_mapping}}" CASCADE;
-DROP TABLE IF EXISTS "{{shares_groups_mapping}}" CASCADE;
DROP TABLE IF EXISTS "{{admins}}" CASCADE;
DROP TABLE IF EXISTS "{{folders}}" CASCADE;
DROP TABLE IF EXISTS "{{shares}}" CASCADE;
@@ -85,8 +85,8 @@ CREATE TABLE "{{folders}}" ("id" integer NOT NULL PRIMARY KEY GENERATED ALWAYS A
"filesystem" text NULL);
CREATE TABLE "{{groups}}" ("id" integer NOT NULL PRIMARY KEY GENERATED ALWAYS AS IDENTITY, "name" varchar(255) NOT NULL UNIQUE,
"description" varchar(512) NULL, "created_at" bigint NOT NULL, "updated_at" bigint NOT NULL, "user_settings" text NULL);
-CREATE TABLE "{{shared_sessions}}" ("key" varchar(128) NOT NULL, "type" integer NOT NULL,
-"data" text NOT NULL, "timestamp" bigint NOT NULL, PRIMARY KEY ("key", "type"));
+CREATE TABLE "{{shared_sessions}}" ("key" varchar(128) NOT NULL PRIMARY KEY,
+"data" text NOT NULL, "type" integer NOT NULL, "timestamp" bigint NOT NULL);
CREATE TABLE "{{users}}" ("id" integer NOT NULL PRIMARY KEY GENERATED ALWAYS AS IDENTITY, "username" varchar(255) NOT NULL UNIQUE, "status" integer NOT NULL,
"expiration_date" bigint NOT NULL, "description" varchar(512) NULL, "password" text NULL, "public_keys" text NULL,
"home_dir" text NOT NULL, "uid" bigint NOT NULL, "gid" bigint NOT NULL, "max_sessions" integer NOT NULL,
@@ -95,14 +95,14 @@ CREATE TABLE "{{users}}" ("id" integer NOT NULL PRIMARY KEY GENERATED ALWAYS AS
"download_bandwidth" integer NOT NULL, "last_login" bigint NOT NULL, "filters" text NULL, "filesystem" text NULL,
"additional_info" text NULL, "created_at" bigint NOT NULL, "updated_at" bigint NOT NULL, "email" varchar(255) NULL,
"upload_data_transfer" integer NOT NULL, "download_data_transfer" integer NOT NULL, "total_data_transfer" integer NOT NULL,
-"used_upload_data_transfer" bigint NOT NULL, "used_download_data_transfer" bigint NOT NULL, "deleted_at" bigint NOT NULL,
+"used_upload_data_transfer" integer NOT NULL, "used_download_data_transfer" integer NOT NULL, "deleted_at" bigint NOT NULL,
"first_download" bigint NOT NULL, "first_upload" bigint NOT NULL, "last_password_change" bigint NOT NULL, "role_id" integer NULL);
CREATE TABLE "{{groups_folders_mapping}}" ("id" integer NOT NULL PRIMARY KEY GENERATED ALWAYS AS IDENTITY, "group_id" integer NOT NULL,
-"folder_id" integer NOT NULL, "virtual_path" text NOT NULL, "quota_size" bigint NOT NULL, "quota_files" integer NOT NULL, "sort_order" integer NOT NULL);
+"folder_id" integer NOT NULL, "virtual_path" text NOT NULL, "quota_size" bigint NOT NULL, "quota_files" integer NOT NULL);
CREATE TABLE "{{users_groups_mapping}}" ("id" integer NOT NULL PRIMARY KEY GENERATED ALWAYS AS IDENTITY, "user_id" integer NOT NULL,
-"group_id" integer NOT NULL, "group_type" integer NOT NULL, "sort_order" integer NOT NULL);
+"group_id" integer NOT NULL, "group_type" integer NOT NULL);
CREATE TABLE "{{users_folders_mapping}}" ("id" integer NOT NULL PRIMARY KEY GENERATED ALWAYS AS IDENTITY, "virtual_path" text NOT NULL,
-"quota_size" bigint NOT NULL, "quota_files" integer NOT NULL, "sort_order" integer NOT NULL, "folder_id" integer NOT NULL, "user_id" integer NOT NULL);
+"quota_size" bigint NOT NULL, "quota_files" integer NOT NULL, "folder_id" integer NOT NULL, "user_id" integer NOT NULL);
ALTER TABLE "{{users_folders_mapping}}" ADD CONSTRAINT "{{prefix}}unique_user_folder_mapping" UNIQUE ("user_id", "folder_id");
ALTER TABLE "{{users_folders_mapping}}" ADD CONSTRAINT "{{prefix}}users_folders_mapping_folder_id_fk_folders_id"
FOREIGN KEY ("folder_id") REFERENCES "{{folders}}" ("id") MATCH SIMPLE ON UPDATE NO ACTION ON DELETE CASCADE;
@@ -112,7 +112,7 @@ CREATE TABLE "{{shares}}" ("id" integer NOT NULL PRIMARY KEY GENERATED ALWAYS AS
"share_id" varchar(60) NOT NULL UNIQUE, "name" varchar(255) NOT NULL, "description" varchar(512) NULL,
"scope" integer NOT NULL, "paths" text NOT NULL, "created_at" bigint NOT NULL, "updated_at" bigint NOT NULL,
"last_use_at" bigint NOT NULL, "expires_at" bigint NOT NULL, "password" text NULL,
-"max_tokens" integer NOT NULL, "used_tokens" integer NOT NULL, "allow_from" text NULL, "options" text NULL,
+"max_tokens" integer NOT NULL, "used_tokens" integer NOT NULL, "allow_from" text NULL,
"user_id" integer NOT NULL);
ALTER TABLE "{{shares}}" ADD CONSTRAINT "{{prefix}}shares_user_id_fk_users_id" FOREIGN KEY ("user_id")
REFERENCES "{{users}}" ("id") MATCH SIMPLE ON UPDATE NO ACTION ON DELETE CASCADE;
@@ -132,14 +132,12 @@ FOREIGN KEY ("group_id") REFERENCES "{{groups}}" ("id") MATCH SIMPLE ON UPDATE N
CREATE INDEX "{{prefix}}users_groups_mapping_user_id_idx" ON "{{users_groups_mapping}}" ("user_id");
ALTER TABLE "{{users_groups_mapping}}" ADD CONSTRAINT "{{prefix}}users_groups_mapping_user_id_fk_users_id"
FOREIGN KEY ("user_id") REFERENCES "{{users}}" ("id") MATCH SIMPLE ON UPDATE NO ACTION ON DELETE CASCADE;
-CREATE INDEX "{{prefix}}users_groups_mapping_sort_order_idx" ON "{{users_groups_mapping}}" ("sort_order");
CREATE INDEX "{{prefix}}groups_folders_mapping_folder_id_idx" ON "{{groups_folders_mapping}}" ("folder_id");
ALTER TABLE "{{groups_folders_mapping}}" ADD CONSTRAINT "{{prefix}}groups_folders_mapping_folder_id_fk_folders_id"
FOREIGN KEY ("folder_id") REFERENCES "{{folders}}" ("id") MATCH SIMPLE ON UPDATE NO ACTION ON DELETE CASCADE;
CREATE INDEX "{{prefix}}groups_folders_mapping_group_id_idx" ON "{{groups_folders_mapping}}" ("group_id");
ALTER TABLE "{{groups_folders_mapping}}" ADD CONSTRAINT "{{prefix}}groups_folders_mapping_group_id_fk_groups_id"
FOREIGN KEY ("group_id") REFERENCES "{{groups}}" ("id") MATCH SIMPLE ON UPDATE NO ACTION ON DELETE CASCADE;
-CREATE INDEX "{{prefix}}groups_folders_mapping_sort_order_idx" ON "{{groups_folders_mapping}}" ("sort_order");
CREATE TABLE "{{events_rules}}" ("id" integer NOT NULL PRIMARY KEY GENERATED ALWAYS AS IDENTITY, "name" varchar(255) NOT NULL UNIQUE,
"status" integer NOT NULL, "description" varchar(512) NULL, "created_at" bigint NOT NULL, "updated_at" bigint NOT NULL,
"trigger" integer NOT NULL, "conditions" text NOT NULL, "deleted_at" bigint NOT NULL);
@@ -155,7 +153,7 @@ FOREIGN KEY ("rule_id") REFERENCES "{{events_rules}}" ("id") MATCH SIMPLE ON UPD
ALTER TABLE "{{rules_actions_mapping}}" ADD CONSTRAINT "{{prefix}}rules_actions_mapping_action_id_fk_events_targets_id"
FOREIGN KEY ("action_id") REFERENCES "{{events_actions}}" ("id") MATCH SIMPLE ON UPDATE NO ACTION ON DELETE NO ACTION;
CREATE TABLE "{{admins_groups_mapping}}" ("id" integer NOT NULL PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-"admin_id" integer NOT NULL, "group_id" integer NOT NULL, "options" text NOT NULL, "sort_order" integer NOT NULL);
+"admin_id" integer NOT NULL, "group_id" integer NOT NULL, "options" text NOT NULL);
ALTER TABLE "{{admins_groups_mapping}}" ADD CONSTRAINT "{{prefix}}unique_admin_group_mapping" UNIQUE ("admin_id", "group_id");
ALTER TABLE "{{admins_groups_mapping}}" ADD CONSTRAINT "{{prefix}}admins_groups_mapping_admin_id_fk_admins_id"
FOREIGN KEY ("admin_id") REFERENCES "{{admins}}" ("id") MATCH SIMPLE ON UPDATE NO ACTION ON DELETE CASCADE;
@@ -178,7 +176,6 @@ CREATE TABLE "{{configs}}" ("id" integer NOT NULL PRIMARY KEY GENERATED ALWAYS A
INSERT INTO {{configs}} (configs) VALUES ('{}');
CREATE INDEX "{{prefix}}users_folders_mapping_folder_id_idx" ON "{{users_folders_mapping}}" ("folder_id");
CREATE INDEX "{{prefix}}users_folders_mapping_user_id_idx" ON "{{users_folders_mapping}}" ("user_id");
-CREATE INDEX "{{prefix}}users_folders_mapping_sort_order_idx" ON "{{users_folders_mapping}}" ("sort_order");
CREATE INDEX "{{prefix}}api_keys_admin_id_idx" ON "{{api_keys}}" ("admin_id");
CREATE INDEX "{{prefix}}api_keys_user_id_idx" ON "{{api_keys}}" ("user_id");
CREATE INDEX "{{prefix}}users_updated_at_idx" ON "{{users}}" ("updated_at");
@@ -201,7 +198,6 @@ CREATE INDEX "{{prefix}}rules_actions_mapping_action_id_idx" ON "{{rules_actions
CREATE INDEX "{{prefix}}rules_actions_mapping_order_idx" ON "{{rules_actions_mapping}}" ("order");
CREATE INDEX "{{prefix}}admins_groups_mapping_admin_id_idx" ON "{{admins_groups_mapping}}" ("admin_id");
CREATE INDEX "{{prefix}}admins_groups_mapping_group_id_idx" ON "{{admins_groups_mapping}}" ("group_id");
-CREATE INDEX "{{prefix}}admins_groups_mapping_sort_order_idx" ON "{{admins_groups_mapping}}" ("sort_order");
CREATE INDEX "{{prefix}}admins_role_id_idx" ON "{{admins}}" ("role_id");
CREATE INDEX "{{prefix}}users_role_id_idx" ON "{{users}}" ("role_id");
CREATE INDEX "{{prefix}}ip_lists_type_idx" ON "{{ip_lists}}" ("type");
@@ -209,24 +205,16 @@ CREATE INDEX "{{prefix}}ip_lists_ipornet_idx" ON "{{ip_lists}}" ("ipornet");
CREATE INDEX "{{prefix}}ip_lists_updated_at_idx" ON "{{ip_lists}}" ("updated_at");
CREATE INDEX "{{prefix}}ip_lists_deleted_at_idx" ON "{{ip_lists}}" ("deleted_at");
CREATE INDEX "{{prefix}}ip_lists_first_last_idx" ON "{{ip_lists}}" ("first", "last");
-INSERT INTO {{schema_version}} (version) VALUES (33);
+INSERT INTO {{schema_version}} (version) VALUES (28);
`
// not supported in CockroachDB
ipListsLikeIndex = `CREATE INDEX "{{prefix}}ip_lists_ipornet_like_idx" ON "{{ip_lists}}" ("ipornet" varchar_pattern_ops);`
- pgsqlV34SQL = `CREATE TABLE "{{shares_groups_mapping}}" (
-"id" integer NOT NULL PRIMARY KEY GENERATED BY DEFAULT AS IDENTITY,
-"share_id" integer NOT NULL,
-"group_id" integer NOT NULL,
-"permissions" integer NOT NULL,
-"sort_order" integer NOT NULL,
-CONSTRAINT "{{prefix}}unique_share_group_mapping" UNIQUE ("share_id", "group_id"),
-CONSTRAINT "{{prefix}}shares_groups_mapping_share_id_fk" FOREIGN KEY ("share_id") REFERENCES "{{shares}}"("id") ON DELETE CASCADE,
-CONSTRAINT "{{prefix}}shares_groups_mapping_group_id_fk" FOREIGN KEY ("group_id") REFERENCES "{{groups}}"("id") ON DELETE CASCADE);
-CREATE INDEX "{{prefix}}shares_groups_mapping_sort_order_idx" ON "{{shares_groups_mapping}}" ("sort_order");
-CREATE INDEX "{{prefix}}shares_groups_mapping_share_id_idx" ON "{{shares_groups_mapping}}" ("share_id");
-CREATE INDEX "{{prefix}}shares_groups_mapping_group_id_idx" ON "{{shares_groups_mapping}}" ("group_id");
+ pgsqlV29SQL = `ALTER TABLE "{{users}}" ALTER COLUMN "used_download_data_transfer" TYPE bigint;
+ALTER TABLE "{{users}}" ALTER COLUMN "used_upload_data_transfer" TYPE bigint;
+`
+ pgsqlV29DownSQL = `ALTER TABLE "{{users}}" ALTER COLUMN "used_upload_data_transfer" TYPE integer;
+ALTER TABLE "{{users}}" ALTER COLUMN "used_download_data_transfer" TYPE integer;
`
- pgsqlV34DownSQL = `DROP TABLE IF EXISTS "{{shares_groups_mapping}}";`
)
var (
@@ -286,7 +274,7 @@ func getPGSQLHostsAndPorts(configHost string, configPort int) (string, string) {
defaultPort = "5432"
}
- for hostport := range strings.SplitSeq(configHost, ",") {
+ for _, hostport := range strings.Split(configHost, ",") {
hostport = strings.TrimSpace(hostport)
if hostport == "" {
continue
@@ -323,7 +311,7 @@ func getPGSQLConnectionString(redactedPwd bool) string {
if config.DisableSNI {
connectionString += " sslsni=0"
}
- if slices.Contains(pgSQLTargetSessionAttrs, config.TargetSessionAttrs) {
+ if util.Contains(pgSQLTargetSessionAttrs, config.TargetSessionAttrs) {
connectionString += fmt.Sprintf(" target_session_attrs='%s'", config.TargetSessionAttrs)
}
} else {
@@ -360,14 +348,6 @@ func (p *PGSQLProvider) getUsedQuota(username string) (int, int64, int64, int64,
return sqlCommonGetUsedQuota(username, p.dbHandle)
}
-func (p *PGSQLProvider) getAdminSignature(username string) (string, error) {
- return sqlCommonGetAdminSignature(username, p.dbHandle)
-}
-
-func (p *PGSQLProvider) getUserSignature(username string) (string, error) {
- return sqlCommonGetUserSignature(username, p.dbHandle)
-}
-
func (p *PGSQLProvider) setUpdatedAt(username string) {
sqlCommonSetUpdatedAt(username, p.dbHandle)
}
@@ -622,12 +602,12 @@ func (p *PGSQLProvider) addSharedSession(session Session) error {
return sqlCommonAddSession(session, p.dbHandle)
}
-func (p *PGSQLProvider) deleteSharedSession(key string, sessionType SessionType) error {
- return sqlCommonDeleteSession(key, sessionType, p.dbHandle)
+func (p *PGSQLProvider) deleteSharedSession(key string) error {
+ return sqlCommonDeleteSession(key, p.dbHandle)
}
-func (p *PGSQLProvider) getSharedSession(key string, sessionType SessionType) (Session, error) {
- return sqlCommonGetSession(key, sessionType, p.dbHandle)
+func (p *PGSQLProvider) getSharedSession(key string) (Session, error) {
+ return sqlCommonGetSession(key, p.dbHandle)
}
func (p *PGSQLProvider) cleanupSharedSessions(sessionType SessionType, before int64) error {
@@ -815,8 +795,8 @@ func (p *PGSQLProvider) initializeDatabase() error {
if errors.Is(err, sql.ErrNoRows) {
return errSchemaVersionEmpty
}
- logger.InfoToConsole("creating initial database schema, version 33")
- providerLog(logger.LevelInfo, "creating initial database schema, version 33")
+ logger.InfoToConsole("creating initial database schema, version 28")
+ providerLog(logger.LevelInfo, "creating initial database schema, version 28")
var initialSQL string
if config.Driver == CockroachDataProviderName {
initialSQL = sqlReplaceAll(pgsqlInitial)
@@ -825,10 +805,10 @@ func (p *PGSQLProvider) initializeDatabase() error {
initialSQL = sqlReplaceAll(pgsqlInitial + ipListsLikeIndex)
}
- return sqlCommonExecSQLAndUpdateDBVersion(p.dbHandle, []string{initialSQL}, 33, true)
+ return sqlCommonExecSQLAndUpdateDBVersion(p.dbHandle, []string{initialSQL}, 28, true)
}
-func (p *PGSQLProvider) migrateDatabase() error {
+func (p *PGSQLProvider) migrateDatabase() error { //nolint:dupl
dbVersion, err := sqlCommonGetDatabaseVersion(p.dbHandle, true)
if err != nil {
return err
@@ -838,13 +818,13 @@ func (p *PGSQLProvider) migrateDatabase() error {
case version == sqlDatabaseVersion:
providerLog(logger.LevelDebug, "sql database is up to date, current version: %d", version)
return ErrNoInitRequired
- case version < 33:
- err = errSchemaVersionTooOld(version)
+ case version < 28:
+ err = fmt.Errorf("database schema version %d is too old, please see the upgrading docs", version)
providerLog(logger.LevelError, "%v", err)
logger.ErrorToConsole("%v", err)
return err
- case version == 33:
- return updatePGSQLDatabaseFromV33(p.dbHandle)
+ case version == 28:
+ return updatePGSQLDatabaseFrom28To29(p.dbHandle)
default:
if version > sqlDatabaseVersion {
providerLog(logger.LevelError, "database schema version %d is newer than the supported one: %d", version,
@@ -867,8 +847,8 @@ func (p *PGSQLProvider) revertDatabase(targetVersion int) error {
}
switch dbVersion.Version {
- case 34:
- return downgradePGSQLDatabaseFromV34(p.dbHandle)
+ case 29:
+ return downgradePGSQLDatabaseFrom29To28(p.dbHandle)
default:
return fmt.Errorf("database schema version not handled: %d", dbVersion.Version)
}
@@ -907,29 +887,18 @@ func (p *PGSQLProvider) normalizeError(err error, fieldType int) error {
return err
}
-func updatePGSQLDatabaseFromV33(dbHandle *sql.DB) error {
- return updatePGSQLDatabaseFrom33To34(dbHandle)
+func updatePGSQLDatabaseFrom28To29(dbHandle *sql.DB) error {
+ logger.InfoToConsole("updating database schema version: 28 -> 29")
+ providerLog(logger.LevelInfo, "updating database schema version: 28 -> 29")
+
+ sql := strings.ReplaceAll(pgsqlV29SQL, "{{users}}", sqlTableUsers)
+ return sqlCommonExecSQLAndUpdateDBVersion(dbHandle, []string{sql}, 29, true)
}
-func downgradePGSQLDatabaseFromV34(dbHandle *sql.DB) error {
- return downgradePGSQLDatabaseFrom34To33(dbHandle)
-}
-
-func updatePGSQLDatabaseFrom33To34(dbHandle *sql.DB) error {
- logger.InfoToConsole("updating database schema version: 33 -> 34")
- providerLog(logger.LevelInfo, "updating database schema version: 33 -> 34")
-
- sql := strings.ReplaceAll(pgsqlV34SQL, "{{prefix}}", config.SQLTablesPrefix)
- sql = strings.ReplaceAll(sql, "{{shares}}", sqlTableShares)
- sql = strings.ReplaceAll(sql, "{{shares_groups_mapping}}", sqlTableSharesGroupsMapping)
- sql = strings.ReplaceAll(sql, "{{groups}}", sqlTableGroups)
- return sqlCommonExecSQLAndUpdateDBVersion(dbHandle, []string{sql}, 34, true)
-}
-
-func downgradePGSQLDatabaseFrom34To33(dbHandle *sql.DB) error {
- logger.InfoToConsole("downgrading database schema version: 34 -> 33")
- providerLog(logger.LevelInfo, "downgrading database schema version: 34 -> 33")
-
- sql := strings.ReplaceAll(pgsqlV34DownSQL, "{{shares_groups_mapping}}", sqlTableSharesGroupsMapping)
- return sqlCommonExecSQLAndUpdateDBVersion(dbHandle, []string{sql}, 33, false)
+func downgradePGSQLDatabaseFrom29To28(dbHandle *sql.DB) error {
+ logger.InfoToConsole("downgrading database schema version: 29 -> 28")
+ providerLog(logger.LevelInfo, "downgrading database schema version: 29 -> 28")
+
+ sql := strings.ReplaceAll(pgsqlV29DownSQL, "{{users}}", sqlTableUsers)
+ return sqlCommonExecSQLAndUpdateDBVersion(dbHandle, []string{sql}, 28, false)
}
diff --git a/internal/dataprovider/pgsql_disabled.go b/internal/dataprovider/pgsql_disabled.go
index 899b5380..a561c5c9 100644
--- a/internal/dataprovider/pgsql_disabled.go
+++ b/internal/dataprovider/pgsql_disabled.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build nopgsql
+// +build nopgsql
package dataprovider
diff --git a/internal/dataprovider/role.go b/internal/dataprovider/role.go
index 5f1154e0..dffe0321 100644
--- a/internal/dataprovider/role.go
+++ b/internal/dataprovider/role.go
@@ -57,9 +57,6 @@ func (r *Role) validate() error {
if r.Name == "" {
return util.NewI18nError(util.NewValidationError("name is mandatory"), util.I18nErrorNameRequired)
}
- if !util.IsNameValid(r.Name) {
- return util.NewI18nError(errInvalidInput, util.I18nErrorInvalidInput)
- }
if len(r.Name) > 255 {
return util.NewValidationError("name is too long, 255 is the maximum length allowed")
}
diff --git a/internal/dataprovider/scheduler.go b/internal/dataprovider/scheduler.go
index 085066a5..71e9ead8 100644
--- a/internal/dataprovider/scheduler.go
+++ b/internal/dataprovider/scheduler.go
@@ -84,14 +84,11 @@ func addScheduledCacheUpdates() error {
func checkDataprovider() {
if currentNode != nil {
- err := provider.updateNodeTimestamp()
- if err != nil {
+ if err := provider.updateNodeTimestamp(); err != nil {
providerLog(logger.LevelError, "unable to update node timestamp: %v", err)
} else {
providerLog(logger.LevelDebug, "node timestamp updated")
}
- metric.UpdateDataProviderAvailability(err)
- return
}
err := provider.checkAvailability()
if err != nil {
diff --git a/internal/dataprovider/share.go b/internal/dataprovider/share.go
index 6d2881b0..7e8a4798 100644
--- a/internal/dataprovider/share.go
+++ b/internal/dataprovider/share.go
@@ -89,11 +89,6 @@ func (s *Share) GetAllowedFromAsString() string {
return strings.Join(s.AllowFrom, ",")
}
-// IsPasswordHashed returns true if the password is hashed
-func (s *Share) IsPasswordHashed() bool {
- return util.IsStringPrefixInSlice(s.Password, hashPwdPrefixes)
-}
-
func (s *Share) getACopy() Share {
allowFrom := make([]string, len(s.AllowFrom))
copy(allowFrom, s.AllowFrom)
@@ -146,7 +141,7 @@ func (s *Share) HasRedactedPassword() bool {
func (s *Share) hashPassword() error {
if s.Password != "" && !util.IsStringPrefixInSlice(s.Password, internalHashPwdPrefixes) {
- user, err := GetUserWithGroupSettings(s.Username, "")
+ user, err := UserExists(s.Username, "")
if err != nil {
return util.NewGenericError(fmt.Sprintf("unable to validate user: %v", err))
}
@@ -206,16 +201,13 @@ func (s *Share) validatePaths() error {
return nil
}
-func (s *Share) validate() error { //nolint:gocyclo
+func (s *Share) validate() error {
if s.ShareID == "" {
return util.NewValidationError("share_id is mandatory")
}
if s.Name == "" {
return util.NewI18nError(util.NewValidationError("name is mandatory"), util.I18nErrorNameRequired)
}
- if !util.IsNameValid(s.Name) {
- return util.NewI18nError(errInvalidInput, util.I18nErrorInvalidInput)
- }
if s.Scope < ShareScopeRead || s.Scope > ShareScopeReadWrite {
return util.NewI18nError(util.NewValidationError(fmt.Sprintf("invalid scope: %v", s.Scope)), util.I18nErrorShareScope)
}
diff --git a/internal/dataprovider/sqlcommon.go b/internal/dataprovider/sqlcommon.go
index 768adb31..3a5e5c1c 100644
--- a/internal/dataprovider/sqlcommon.go
+++ b/internal/dataprovider/sqlcommon.go
@@ -23,7 +23,6 @@ import (
"fmt"
"net/netip"
"runtime/debug"
- "strconv"
"strings"
"time"
@@ -36,7 +35,7 @@ import (
)
const (
- sqlDatabaseVersion = 34
+ sqlDatabaseVersion = 29
defaultSQLQueryTimeout = 10 * time.Second
longSQLQueryTimeout = 60 * time.Second
)
@@ -71,7 +70,6 @@ func sqlReplaceAll(sql string) string {
sql = strings.ReplaceAll(sql, "{{groups_folders_mapping}}", sqlTableGroupsFoldersMapping)
sql = strings.ReplaceAll(sql, "{{api_keys}}", sqlTableAPIKeys)
sql = strings.ReplaceAll(sql, "{{shares}}", sqlTableShares)
- sql = strings.ReplaceAll(sql, "{{shares_groups_mapping}}", sqlTableSharesGroupsMapping)
sql = strings.ReplaceAll(sql, "{{defender_events}}", sqlTableDefenderEvents)
sql = strings.ReplaceAll(sql, "{{defender_hosts}}", sqlTableDefenderHosts)
sql = strings.ReplaceAll(sql, "{{active_transfers}}", sqlTableActiveTransfers)
@@ -1250,32 +1248,6 @@ func sqlCommonUpdateQuota(username string, filesAdd int, sizeAdd int64, reset bo
return err
}
-func sqlCommonGetAdminSignature(username string, dbHandle *sql.DB) (string, error) {
- ctx, cancel := context.WithTimeout(context.Background(), defaultSQLQueryTimeout)
- defer cancel()
-
- q := getAdminSignatureQuery()
- var updatedAt int64
- err := dbHandle.QueryRowContext(ctx, q, username).Scan(&updatedAt)
- if err != nil {
- return "", err
- }
- return strconv.FormatInt(updatedAt, 10), nil
-}
-
-func sqlCommonGetUserSignature(username string, dbHandle *sql.DB) (string, error) {
- ctx, cancel := context.WithTimeout(context.Background(), defaultSQLQueryTimeout)
- defer cancel()
-
- q := getUserSignatureQuery()
- var updatedAt int64
- err := dbHandle.QueryRowContext(ctx, q, username).Scan(&updatedAt)
- if err != nil {
- return "", err
- }
- return strconv.FormatInt(updatedAt, 10), nil
-}
-
func sqlCommonGetUsedQuota(username string, dbHandle *sql.DB) (int, int64, int64, int64, error) {
ctx, cancel := context.WithTimeout(context.Background(), defaultSQLQueryTimeout)
defer cancel()
@@ -2524,9 +2496,9 @@ func sqlCommonClearUserGroupMapping(ctx context.Context, user *User, dbHandle sq
return err
}
-func sqlCommonAddUserFolderMapping(ctx context.Context, user *User, folder *vfs.VirtualFolder, sortOrder int, dbHandle sqlQuerier) error {
+func sqlCommonAddUserFolderMapping(ctx context.Context, user *User, folder *vfs.VirtualFolder, dbHandle sqlQuerier) error {
q := getAddUserFolderMappingQuery()
- _, err := dbHandle.ExecContext(ctx, q, folder.VirtualPath, folder.QuotaSize, folder.QuotaFiles, folder.Name, user.Username, sortOrder)
+ _, err := dbHandle.ExecContext(ctx, q, folder.VirtualPath, folder.QuotaSize, folder.QuotaFiles, folder.Name, user.Username)
return err
}
@@ -2536,29 +2508,27 @@ func sqlCommonClearAdminGroupMapping(ctx context.Context, admin *Admin, dbHandle
return err
}
-func sqlCommonAddGroupFolderMapping(ctx context.Context, group *Group, folder *vfs.VirtualFolder, sortOrder int,
- dbHandle sqlQuerier,
-) error {
+func sqlCommonAddGroupFolderMapping(ctx context.Context, group *Group, folder *vfs.VirtualFolder, dbHandle sqlQuerier) error {
q := getAddGroupFolderMappingQuery()
- _, err := dbHandle.ExecContext(ctx, q, folder.VirtualPath, folder.QuotaSize, folder.QuotaFiles, folder.Name, group.Name, sortOrder)
+ _, err := dbHandle.ExecContext(ctx, q, folder.VirtualPath, folder.QuotaSize, folder.QuotaFiles, folder.Name, group.Name)
return err
}
-func sqlCommonAddUserGroupMapping(ctx context.Context, username, groupName string, groupType, sortOrder int, dbHandle sqlQuerier) error {
+func sqlCommonAddUserGroupMapping(ctx context.Context, username, groupName string, groupType int, dbHandle sqlQuerier) error {
q := getAddUserGroupMappingQuery()
- _, err := dbHandle.ExecContext(ctx, q, username, groupName, groupType, sortOrder)
+ _, err := dbHandle.ExecContext(ctx, q, username, groupName, groupType)
return err
}
func sqlCommonAddAdminGroupMapping(ctx context.Context, username, groupName string, mappingOptions AdminGroupMappingOptions,
- sortOrder int, dbHandle sqlQuerier,
+ dbHandle sqlQuerier,
) error {
options, err := json.Marshal(mappingOptions)
if err != nil {
return err
}
q := getAddAdminGroupMappingQuery()
- _, err = dbHandle.ExecContext(ctx, q, username, groupName, options, sortOrder)
+ _, err = dbHandle.ExecContext(ctx, q, username, groupName, options)
return err
}
@@ -2569,7 +2539,7 @@ func generateGroupVirtualFoldersMapping(ctx context.Context, group *Group, dbHan
}
for idx := range group.VirtualFolders {
vfolder := &group.VirtualFolders[idx]
- err = sqlCommonAddGroupFolderMapping(ctx, group, vfolder, idx, dbHandle)
+ err = sqlCommonAddGroupFolderMapping(ctx, group, vfolder, dbHandle)
if err != nil {
return err
}
@@ -2584,7 +2554,7 @@ func generateUserVirtualFoldersMapping(ctx context.Context, user *User, dbHandle
}
for idx := range user.VirtualFolders {
vfolder := &user.VirtualFolders[idx]
- err = sqlCommonAddUserFolderMapping(ctx, user, vfolder, idx, dbHandle)
+ err = sqlCommonAddUserFolderMapping(ctx, user, vfolder, dbHandle)
if err != nil {
return err
}
@@ -2597,8 +2567,8 @@ func generateUserGroupMapping(ctx context.Context, user *User, dbHandle sqlQueri
if err != nil {
return err
}
- for idx, group := range user.Groups {
- err = sqlCommonAddUserGroupMapping(ctx, user.Username, group.Name, group.Type, idx, dbHandle)
+ for _, group := range user.Groups {
+ err = sqlCommonAddUserGroupMapping(ctx, user.Username, group.Name, group.Type, dbHandle)
if err != nil {
return err
}
@@ -2611,8 +2581,8 @@ func generateAdminGroupMapping(ctx context.Context, admin *Admin, dbHandle sqlQu
if err != nil {
return err
}
- for idx, group := range admin.Groups {
- err = sqlCommonAddAdminGroupMapping(ctx, admin.Username, group.Name, group.Options, idx, dbHandle)
+ for _, group := range admin.Groups {
+ err = sqlCommonAddAdminGroupMapping(ctx, admin.Username, group.Name, group.Options, dbHandle)
if err != nil {
return err
}
@@ -3268,14 +3238,14 @@ func sqlCommonAddSession(session Session, dbHandle *sql.DB) error {
return err
}
-func sqlCommonGetSession(key string, sessionType SessionType, dbHandle sqlQuerier) (Session, error) {
+func sqlCommonGetSession(key string, dbHandle sqlQuerier) (Session, error) {
var session Session
ctx, cancel := context.WithTimeout(context.Background(), defaultSQLQueryTimeout)
defer cancel()
q := getSessionQuery()
var data []byte // type hint, some driver will use string instead of []byte if the type is any
- err := dbHandle.QueryRowContext(ctx, q, key, sessionType).Scan(&session.Key, &data, &session.Type, &session.Timestamp)
+ err := dbHandle.QueryRowContext(ctx, q, key).Scan(&session.Key, &data, &session.Type, &session.Timestamp)
if err != nil {
if errors.Is(err, sql.ErrNoRows) {
return session, util.NewRecordNotFoundError(err.Error())
@@ -3286,12 +3256,12 @@ func sqlCommonGetSession(key string, sessionType SessionType, dbHandle sqlQuerie
return session, nil
}
-func sqlCommonDeleteSession(key string, sessionType SessionType, dbHandle *sql.DB) error {
+func sqlCommonDeleteSession(key string, dbHandle *sql.DB) error {
ctx, cancel := context.WithTimeout(context.Background(), defaultSQLQueryTimeout)
defer cancel()
q := getDeleteSessionQuery()
- res, err := dbHandle.ExecContext(ctx, q, key, sessionType)
+ res, err := dbHandle.ExecContext(ctx, q, key)
if err != nil {
return err
}
@@ -3966,22 +3936,16 @@ func sqlCommonUpdateDatabaseVersion(ctx context.Context, dbHandle sqlQuerier, ve
}
func sqlCommonExecSQLAndUpdateDBVersion(dbHandle *sql.DB, sqlQueries []string, newVersion int, isUp bool) error {
+ if err := sqlAcquireLock(dbHandle); err != nil {
+ return err
+ }
+ defer sqlReleaseLock(dbHandle)
+
ctx, cancel := context.WithTimeout(context.Background(), longSQLQueryTimeout)
defer cancel()
- conn, err := dbHandle.Conn(ctx)
- if err != nil {
- return fmt.Errorf("unable to get connection from pool: %w", err)
- }
- defer conn.Close()
-
- if err := sqlAcquireLock(conn); err != nil {
- return err
- }
- defer sqlReleaseLock(conn)
-
if newVersion > 0 {
- currentVersion, err := sqlCommonGetDatabaseVersion(conn, false)
+ currentVersion, err := sqlCommonGetDatabaseVersion(dbHandle, false)
if err == nil {
if (isUp && currentVersion.Version >= newVersion) || (!isUp && currentVersion.Version <= newVersion) {
providerLog(logger.LevelInfo, "current schema version: %v, requested: %v, did you execute simultaneous migrations?",
@@ -3991,7 +3955,7 @@ func sqlCommonExecSQLAndUpdateDBVersion(dbHandle *sql.DB, sqlQueries []string, n
}
}
- return sqlCommonExecuteTxOnConn(ctx, conn, func(tx *sql.Tx) error {
+ return sqlCommonExecuteTx(ctx, dbHandle, func(tx *sql.Tx) error {
for _, q := range sqlQueries {
if strings.TrimSpace(q) == "" {
continue
@@ -4008,7 +3972,7 @@ func sqlCommonExecSQLAndUpdateDBVersion(dbHandle *sql.DB, sqlQueries []string, n
})
}
-func sqlAcquireLock(dbHandle *sql.Conn) error {
+func sqlAcquireLock(dbHandle *sql.DB) error {
ctx, cancel := context.WithTimeout(context.Background(), longSQLQueryTimeout)
defer cancel()
@@ -4037,7 +4001,7 @@ func sqlAcquireLock(dbHandle *sql.Conn) error {
return nil
}
-func sqlReleaseLock(dbHandle *sql.Conn) {
+func sqlReleaseLock(dbHandle *sql.DB) {
ctx, cancel := context.WithTimeout(context.Background(), defaultSQLQueryTimeout)
defer cancel()
@@ -4059,20 +4023,6 @@ func sqlReleaseLock(dbHandle *sql.Conn) {
}
}
-func sqlCommonExecuteTxOnConn(ctx context.Context, conn *sql.Conn, txFn func(*sql.Tx) error) error {
- tx, err := conn.BeginTx(ctx, nil)
- if err != nil {
- return err
- }
-
- err = txFn(tx)
- if err != nil {
- tx.Rollback() //nolint:errcheck
- return err
- }
- return tx.Commit()
-}
-
func sqlCommonExecuteTx(ctx context.Context, dbHandle *sql.DB, txFn func(*sql.Tx) error) error {
if config.Driver == CockroachDataProviderName {
return crdb.ExecuteTx(ctx, dbHandle, nil, txFn)
diff --git a/internal/dataprovider/sqlite.go b/internal/dataprovider/sqlite.go
index 98d2d2b9..4a21c21c 100644
--- a/internal/dataprovider/sqlite.go
+++ b/internal/dataprovider/sqlite.go
@@ -12,7 +12,8 @@
// You should have received a copy of the GNU Affero General Public License
// along with this program. If not, see .
-//go:build !nosqlite && cgo
+//go:build !nosqlite
+// +build !nosqlite
package dataprovider
@@ -23,7 +24,6 @@ import (
"errors"
"fmt"
"path/filepath"
- "strings"
"time"
"github.com/mattn/go-sqlite3"
@@ -36,11 +36,11 @@ import (
const (
sqliteResetSQL = `DROP TABLE IF EXISTS "{{api_keys}}";
+DROP TABLE IF EXISTS "{{folders_mapping}}";
DROP TABLE IF EXISTS "{{users_folders_mapping}}";
DROP TABLE IF EXISTS "{{users_groups_mapping}}";
DROP TABLE IF EXISTS "{{admins_groups_mapping}}";
DROP TABLE IF EXISTS "{{groups_folders_mapping}}";
-DROP TABLE IF EXISTS "{{shares_groups_mapping}}";
DROP TABLE IF EXISTS "{{admins}}";
DROP TABLE IF EXISTS "{{folders}}";
DROP TABLE IF EXISTS "{{shares}}";
@@ -82,8 +82,8 @@ CREATE TABLE "{{folders}}" ("id" integer NOT NULL PRIMARY KEY, "name" varchar(25
"last_quota_update" bigint NOT NULL, "filesystem" text NULL);
CREATE TABLE "{{groups}}" ("id" integer NOT NULL PRIMARY KEY, "name" varchar(255) NOT NULL UNIQUE,
"description" varchar(512) NULL, "created_at" bigint NOT NULL, "updated_at" bigint NOT NULL, "user_settings" text NULL);
-CREATE TABLE "{{shared_sessions}}" ("key" varchar(128) NOT NULL, "type" integer NOT NULL,
-"data" text NOT NULL, "timestamp" bigint NOT NULL, PRIMARY KEY ("key", "type"));
+CREATE TABLE "{{shared_sessions}}" ("key" varchar(128) NOT NULL PRIMARY KEY, "data" text NOT NULL,
+"type" integer NOT NULL, "timestamp" bigint NOT NULL);
CREATE TABLE "{{users}}" ("id" integer NOT NULL PRIMARY KEY, "username" varchar(255) NOT NULL UNIQUE,
"status" integer NOT NULL, "expiration_date" bigint NOT NULL, "description" varchar(512) NULL, "password" text NULL,
"public_keys" text NULL, "home_dir" text NOT NULL, "uid" bigint NOT NULL, "gid" bigint NOT NULL,
@@ -98,21 +98,21 @@ CREATE TABLE "{{users}}" ("id" integer NOT NULL PRIMARY KEY, "username" varchar(
CREATE TABLE "{{groups_folders_mapping}}" ("id" integer NOT NULL PRIMARY KEY,
"folder_id" integer NOT NULL REFERENCES "{{folders}}" ("id") ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED,
"group_id" integer NOT NULL REFERENCES "{{groups}}" ("id") ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED,
-"virtual_path" text NOT NULL, "quota_size" bigint NOT NULL, "quota_files" integer NOT NULL, "sort_order" integer NOT NULL,
+"virtual_path" text NOT NULL, "quota_size" bigint NOT NULL, "quota_files" integer NOT NULL,
CONSTRAINT "{{prefix}}unique_group_folder_mapping" UNIQUE ("group_id", "folder_id"));
CREATE TABLE "{{users_groups_mapping}}" ("id" integer NOT NULL PRIMARY KEY,
"user_id" integer NOT NULL REFERENCES "{{users}}" ("id") ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED,
"group_id" integer NOT NULL REFERENCES "{{groups}}" ("id") ON DELETE NO ACTION,
-"group_type" integer NOT NULL, "sort_order" integer NOT NULL, CONSTRAINT "{{prefix}}unique_user_group_mapping" UNIQUE ("user_id", "group_id"));
+"group_type" integer NOT NULL, CONSTRAINT "{{prefix}}unique_user_group_mapping" UNIQUE ("user_id", "group_id"));
CREATE TABLE "{{users_folders_mapping}}" ("id" integer NOT NULL PRIMARY KEY,
"user_id" integer NOT NULL REFERENCES "{{users}}" ("id") ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED,
"folder_id" integer NOT NULL REFERENCES "{{folders}}" ("id") ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED,
-"virtual_path" text NOT NULL, "quota_size" bigint NOT NULL, "quota_files" integer NOT NULL, "sort_order" integer NOT NULL,
+"virtual_path" text NOT NULL, "quota_size" bigint NOT NULL, "quota_files" integer NOT NULL,
CONSTRAINT "{{prefix}}unique_user_folder_mapping" UNIQUE ("user_id", "folder_id"));
CREATE TABLE "{{shares}}" ("id" integer NOT NULL PRIMARY KEY, "share_id" varchar(60) NOT NULL UNIQUE,
"name" varchar(255) NOT NULL, "description" varchar(512) NULL, "scope" integer NOT NULL, "paths" text NOT NULL,
"created_at" bigint NOT NULL, "updated_at" bigint NOT NULL, "last_use_at" bigint NOT NULL, "expires_at" bigint NOT NULL,
-"password" text NULL, "max_tokens" integer NOT NULL, "used_tokens" integer NOT NULL, "allow_from" text NULL, "options" text NULL,
+"password" text NULL, "max_tokens" integer NOT NULL, "used_tokens" integer NOT NULL, "allow_from" text NULL,
"user_id" integer NOT NULL REFERENCES "{{users}}" ("id") ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED);
CREATE TABLE "{{api_keys}}" ("id" integer NOT NULL PRIMARY KEY, "name" varchar(255) NOT NULL,
"key_id" varchar(50) NOT NULL UNIQUE, "api_key" varchar(255) NOT NULL UNIQUE, "scope" integer NOT NULL,
@@ -134,7 +134,7 @@ CREATE TABLE "{{tasks}}" ("id" integer NOT NULL PRIMARY KEY, "name" varchar(255)
CREATE TABLE "{{admins_groups_mapping}}" ("id" integer NOT NULL PRIMARY KEY,
"admin_id" integer NOT NULL REFERENCES "{{admins}}" ("id") ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED,
"group_id" integer NOT NULL REFERENCES "{{groups}}" ("id") ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED,
-"options" text NOT NULL, "sort_order" integer NOT NULL, CONSTRAINT "{{prefix}}unique_admin_group_mapping" UNIQUE ("admin_id", "group_id"));
+"options" text NOT NULL, CONSTRAINT "{{prefix}}unique_admin_group_mapping" UNIQUE ("admin_id", "group_id"));
CREATE TABLE "{{ip_lists}}" ("id" integer NOT NULL PRIMARY KEY,
"type" integer NOT NULL, "ipornet" varchar(50) NOT NULL, "mode" integer NOT NULL, "description" varchar(512) NULL,
"first" BLOB NOT NULL, "last" BLOB NOT NULL, "ip_type" integer NOT NULL, "protocols" integer NOT NULL,
@@ -144,13 +144,10 @@ CREATE TABLE "{{configs}}" ("id" integer NOT NULL PRIMARY KEY, "configs" text NO
INSERT INTO {{configs}} (configs) VALUES ('{}');
CREATE INDEX "{{prefix}}users_folders_mapping_folder_id_idx" ON "{{users_folders_mapping}}" ("folder_id");
CREATE INDEX "{{prefix}}users_folders_mapping_user_id_idx" ON "{{users_folders_mapping}}" ("user_id");
-CREATE INDEX "{{prefix}}users_folders_mapping_sort_order_idx" ON "{{users_folders_mapping}}" ("sort_order");
CREATE INDEX "{{prefix}}users_groups_mapping_group_id_idx" ON "{{users_groups_mapping}}" ("group_id");
CREATE INDEX "{{prefix}}users_groups_mapping_user_id_idx" ON "{{users_groups_mapping}}" ("user_id");
-CREATE INDEX "{{prefix}}users_groups_mapping_sort_order_idx" ON "{{users_groups_mapping}}" ("sort_order");
CREATE INDEX "{{prefix}}groups_folders_mapping_folder_id_idx" ON "{{groups_folders_mapping}}" ("folder_id");
CREATE INDEX "{{prefix}}groups_folders_mapping_group_id_idx" ON "{{groups_folders_mapping}}" ("group_id");
-CREATE INDEX "{{prefix}}groups_folders_mapping_sort_order_idx" ON "{{groups_folders_mapping}}" ("sort_order");
CREATE INDEX "{{prefix}}api_keys_admin_id_idx" ON "{{api_keys}}" ("admin_id");
CREATE INDEX "{{prefix}}api_keys_user_id_idx" ON "{{api_keys}}" ("user_id");
CREATE INDEX "{{prefix}}users_updated_at_idx" ON "{{users}}" ("updated_at");
@@ -173,7 +170,6 @@ CREATE INDEX "{{prefix}}rules_actions_mapping_action_id_idx" ON "{{rules_actions
CREATE INDEX "{{prefix}}rules_actions_mapping_order_idx" ON "{{rules_actions_mapping}}" ("order");
CREATE INDEX "{{prefix}}admins_groups_mapping_admin_id_idx" ON "{{admins_groups_mapping}}" ("admin_id");
CREATE INDEX "{{prefix}}admins_groups_mapping_group_id_idx" ON "{{admins_groups_mapping}}" ("group_id");
-CREATE INDEX "{{prefix}}admins_groups_mapping_sort_order_idx" ON "{{admins_groups_mapping}}" ("sort_order");
CREATE INDEX "{{prefix}}users_role_id_idx" ON "{{users}}" ("role_id");
CREATE INDEX "{{prefix}}admins_role_id_idx" ON "{{admins}}" ("role_id");
CREATE INDEX "{{prefix}}ip_lists_type_idx" ON "{{ip_lists}}" ("type");
@@ -182,22 +178,8 @@ CREATE INDEX "{{prefix}}ip_lists_ip_type_idx" ON "{{ip_lists}}" ("ip_type");
CREATE INDEX "{{prefix}}ip_lists_ip_updated_at_idx" ON "{{ip_lists}}" ("updated_at");
CREATE INDEX "{{prefix}}ip_lists_ip_deleted_at_idx" ON "{{ip_lists}}" ("deleted_at");
CREATE INDEX "{{prefix}}ip_lists_first_last_idx" ON "{{ip_lists}}" ("first", "last");
-INSERT INTO {{schema_version}} (version) VALUES (33);
+INSERT INTO {{schema_version}} (version) VALUES (28);
`
- sqliteV34SQL = `
-CREATE TABLE "{{shares_groups_mapping}}" (
- "id" integer NOT NULL PRIMARY KEY AUTOINCREMENT,
- "share_id" integer NOT NULL REFERENCES "{{shares}}" ("id") ON DELETE CASCADE,
- "group_id" integer NOT NULL REFERENCES "{{groups}}" ("id") ON DELETE CASCADE,
- "permissions" integer NOT NULL,
- "sort_order" integer NOT NULL,
- CONSTRAINT "{{prefix}}unique_share_group_mapping" UNIQUE ("share_id", "group_id")
-);
-CREATE INDEX "{{prefix}}shares_groups_mapping_sort_order_idx" ON "{{shares_groups_mapping}}" ("sort_order");
-CREATE INDEX "{{prefix}}shares_groups_mapping_group_id_idx" ON "{{shares_groups_mapping}}" ("group_id");
-CREATE INDEX "{{prefix}}shares_groups_mapping_share_id_idx" ON "{{shares_groups_mapping}}" ("share_id");
-`
- sqliteV34DownSQL = `DROP TABLE IF EXISTS "{{shares_groups_mapping}}";`
)
// SQLiteProvider defines the auth provider for SQLite database
@@ -233,7 +215,7 @@ func initializeSQLiteProvider(basePath string) error {
providerLog(logger.LevelDebug, "sqlite database handle created, connection string: %q", connectionString)
dbHandle.SetMaxOpenConns(1)
provider = &SQLiteProvider{dbHandle: dbHandle}
- return executePragmaOptimize(dbHandle)
+ return nil
}
func (p *SQLiteProvider) checkAvailability() error {
@@ -264,14 +246,6 @@ func (p *SQLiteProvider) getUsedQuota(username string) (int, int64, int64, int64
return sqlCommonGetUsedQuota(username, p.dbHandle)
}
-func (p *SQLiteProvider) getAdminSignature(username string) (string, error) {
- return sqlCommonGetAdminSignature(username, p.dbHandle)
-}
-
-func (p *SQLiteProvider) getUserSignature(username string) (string, error) {
- return sqlCommonGetUserSignature(username, p.dbHandle)
-}
-
func (p *SQLiteProvider) setUpdatedAt(username string) {
sqlCommonSetUpdatedAt(username, p.dbHandle)
}
@@ -526,12 +500,12 @@ func (p *SQLiteProvider) addSharedSession(session Session) error {
return sqlCommonAddSession(session, p.dbHandle)
}
-func (p *SQLiteProvider) deleteSharedSession(key string, sessionType SessionType) error {
- return sqlCommonDeleteSession(key, sessionType, p.dbHandle)
+func (p *SQLiteProvider) deleteSharedSession(key string) error {
+ return sqlCommonDeleteSession(key, p.dbHandle)
}
-func (p *SQLiteProvider) getSharedSession(key string, sessionType SessionType) (Session, error) {
- return sqlCommonGetSession(key, sessionType, p.dbHandle)
+func (p *SQLiteProvider) getSharedSession(key string) (Session, error) {
+ return sqlCommonGetSession(key, p.dbHandle)
}
func (p *SQLiteProvider) cleanupSharedSessions(sessionType SessionType, before int64) error {
@@ -719,13 +693,13 @@ func (p *SQLiteProvider) initializeDatabase() error {
if errors.Is(err, sql.ErrNoRows) {
return errSchemaVersionEmpty
}
- logger.InfoToConsole("creating initial database schema, version 33")
- providerLog(logger.LevelInfo, "creating initial database schema, version 33")
+ logger.InfoToConsole("creating initial database schema, version 28")
+ providerLog(logger.LevelInfo, "creating initial database schema, version 28")
sql := sqlReplaceAll(sqliteInitialSQL)
- return sqlCommonExecSQLAndUpdateDBVersion(p.dbHandle, []string{sql}, 33, true)
+ return sqlCommonExecSQLAndUpdateDBVersion(p.dbHandle, []string{sql}, 28, true)
}
-func (p *SQLiteProvider) migrateDatabase() error {
+func (p *SQLiteProvider) migrateDatabase() error { //nolint:dupl
dbVersion, err := sqlCommonGetDatabaseVersion(p.dbHandle, true)
if err != nil {
return err
@@ -735,13 +709,13 @@ func (p *SQLiteProvider) migrateDatabase() error {
case version == sqlDatabaseVersion:
providerLog(logger.LevelDebug, "sql database is up to date, current version: %d", version)
return ErrNoInitRequired
- case version < 33:
- err = errSchemaVersionTooOld(version)
+ case version < 28:
+ err = fmt.Errorf("database schema version %d is too old, please see the upgrading docs", version)
providerLog(logger.LevelError, "%v", err)
logger.ErrorToConsole("%v", err)
return err
- case version == 33:
- return updateSQLiteDatabaseFromV33(p.dbHandle)
+ case version == 28:
+ return updateSQLiteDatabaseFrom28To29(p.dbHandle)
default:
if version > sqlDatabaseVersion {
providerLog(logger.LevelError, "database schema version %d is newer than the supported one: %d", version,
@@ -764,8 +738,8 @@ func (p *SQLiteProvider) revertDatabase(targetVersion int) error {
}
switch dbVersion.Version {
- case 34:
- return downgradeSQLiteDatabaseFromV34(p.dbHandle)
+ case 29:
+ return downgradeSQLiteDatabaseFrom29To28(p.dbHandle)
default:
return fmt.Errorf("database schema version not handled: %d", dbVersion.Version)
}
@@ -803,39 +777,24 @@ func (p *SQLiteProvider) normalizeError(err error, fieldType int) error {
return err
}
-func executePragmaOptimize(dbHandle *sql.DB) error {
+func updateSQLiteDatabaseFrom28To29(dbHandle *sql.DB) error {
+ logger.InfoToConsole("updating database schema version: 28 -> 29")
+ providerLog(logger.LevelInfo, "updating database schema version: 28 -> 29")
+
ctx, cancel := context.WithTimeout(context.Background(), defaultSQLQueryTimeout)
defer cancel()
- _, err := dbHandle.ExecContext(ctx, "PRAGMA optimize;")
- return err
+ return sqlCommonUpdateDatabaseVersion(ctx, dbHandle, 29)
}
-func updateSQLiteDatabaseFromV33(dbHandle *sql.DB) error {
- return updateSQLiteDatabaseFrom33To34(dbHandle)
-}
+func downgradeSQLiteDatabaseFrom29To28(dbHandle *sql.DB) error {
+ logger.InfoToConsole("downgrading database schema version: 29 -> 28")
+ providerLog(logger.LevelInfo, "downgrading database schema version: 29 -> 28")
-func downgradeSQLiteDatabaseFromV34(dbHandle *sql.DB) error {
- return downgradeSQLiteDatabaseFrom34To33(dbHandle)
-}
+ ctx, cancel := context.WithTimeout(context.Background(), defaultSQLQueryTimeout)
+ defer cancel()
-func updateSQLiteDatabaseFrom33To34(dbHandle *sql.DB) error {
- logger.InfoToConsole("updating database schema version: 33 -> 34")
- providerLog(logger.LevelInfo, "updating database schema version: 33 -> 34")
-
- sql := strings.ReplaceAll(sqliteV34SQL, "{{prefix}}", config.SQLTablesPrefix)
- sql = strings.ReplaceAll(sql, "{{shares}}", sqlTableShares)
- sql = strings.ReplaceAll(sql, "{{shares_groups_mapping}}", sqlTableSharesGroupsMapping)
- sql = strings.ReplaceAll(sql, "{{groups}}", sqlTableGroups)
- return sqlCommonExecSQLAndUpdateDBVersion(dbHandle, []string{sql}, 34, true)
-}
-
-func downgradeSQLiteDatabaseFrom34To33(dbHandle *sql.DB) error {
- logger.InfoToConsole("downgrading database schema version: 34 -> 33")
- providerLog(logger.LevelInfo, "downgrading database schema version: 34 -> 33")
-
- sql := strings.ReplaceAll(sqliteV34DownSQL, "{{shares_groups_mapping}}", sqlTableSharesGroupsMapping)
- return sqlCommonExecSQLAndUpdateDBVersion(dbHandle, []string{sql}, 33, false)
+ return sqlCommonUpdateDatabaseVersion(ctx, dbHandle, 28)
}
/*func setPragmaFK(dbHandle *sql.DB, value string) error {
diff --git a/internal/dataprovider/sqlite_disabled.go b/internal/dataprovider/sqlite_disabled.go
index 22138967..6c7ea18d 100644
--- a/internal/dataprovider/sqlite_disabled.go
+++ b/internal/dataprovider/sqlite_disabled.go
@@ -12,7 +12,8 @@
// You should have received a copy of the GNU Affero General Public License
// along with this program. If not, see .
-//go:build nosqlite || !cgo
+//go:build nosqlite
+// +build nosqlite
package dataprovider
diff --git a/internal/dataprovider/sqlqueries.go b/internal/dataprovider/sqlqueries.go
index 2d5aaf6b..2ce95b5c 100644
--- a/internal/dataprovider/sqlqueries.go
+++ b/internal/dataprovider/sqlqueries.go
@@ -81,27 +81,25 @@ func getAddSessionQuery() string {
"ON DUPLICATE KEY UPDATE `data`=VALUES(`data`), `timestamp`=VALUES(`timestamp`)",
sqlTableSharedSessions, sqlPlaceholders[0], sqlPlaceholders[1], sqlPlaceholders[2], sqlPlaceholders[3])
}
- return fmt.Sprintf(`INSERT INTO %s (key,data,type,timestamp) VALUES (%s,%s,%s,%s) ON CONFLICT(key,type) DO UPDATE SET data=
+ return fmt.Sprintf(`INSERT INTO %s (key,data,type,timestamp) VALUES (%s,%s,%s,%s) ON CONFLICT(key) DO UPDATE SET data=
EXCLUDED.data, timestamp=EXCLUDED.timestamp`,
sqlTableSharedSessions, sqlPlaceholders[0], sqlPlaceholders[1], sqlPlaceholders[2], sqlPlaceholders[3])
}
func getDeleteSessionQuery() string {
if config.Driver == MySQLDataProviderName {
- return fmt.Sprintf("DELETE FROM %s WHERE `key` = %s AND `type` = %s",
- sqlTableSharedSessions, sqlPlaceholders[0], sqlPlaceholders[1])
+ return fmt.Sprintf("DELETE FROM %s WHERE `key` = %s", sqlTableSharedSessions, sqlPlaceholders[0])
}
- return fmt.Sprintf(`DELETE FROM %s WHERE key = %s AND type = %s`,
- sqlTableSharedSessions, sqlPlaceholders[0], sqlPlaceholders[1])
+ return fmt.Sprintf(`DELETE FROM %s WHERE key = %s`, sqlTableSharedSessions, sqlPlaceholders[0])
}
func getSessionQuery() string {
if config.Driver == MySQLDataProviderName {
- return fmt.Sprintf("SELECT `key`,`data`,`type`,`timestamp` FROM %s WHERE `key` = %s AND `type` = %s",
- sqlTableSharedSessions, sqlPlaceholders[0], sqlPlaceholders[1])
+ return fmt.Sprintf("SELECT `key`,`data`,`type`,`timestamp` FROM %s WHERE `key` = %s", sqlTableSharedSessions,
+ sqlPlaceholders[0])
}
- return fmt.Sprintf(`SELECT key,data,type,timestamp FROM %s WHERE key = %s AND type = %s`,
- sqlTableSharedSessions, sqlPlaceholders[0], sqlPlaceholders[1])
+ return fmt.Sprintf(`SELECT key,data,type,timestamp FROM %s WHERE key = %s`, sqlTableSharedSessions,
+ sqlPlaceholders[0])
}
func getCleanupSessionsQuery() string {
@@ -652,14 +650,6 @@ func getUpdateQuotaQuery(reset bool) string {
WHERE username = %s`, sqlTableUsers, sqlPlaceholders[0], sqlPlaceholders[1], sqlPlaceholders[2], sqlPlaceholders[3])
}
-func getAdminSignatureQuery() string {
- return fmt.Sprintf(`SELECT updated_at FROM %s WHERE username = %s`, sqlTableAdmins, sqlPlaceholders[0])
-}
-
-func getUserSignatureQuery() string {
- return fmt.Sprintf(`SELECT updated_at FROM %s WHERE username = %s`, sqlTableUsers, sqlPlaceholders[0])
-}
-
func getSetUpdateAtQuery() string {
return fmt.Sprintf(`UPDATE %s SET updated_at = %s WHERE username = %s`, sqlTableUsers, sqlPlaceholders[0], sqlPlaceholders[1])
}
@@ -767,10 +757,10 @@ func getClearUserGroupMappingQuery() string {
}
func getAddUserGroupMappingQuery() string {
- return fmt.Sprintf(`INSERT INTO %s (user_id,group_id,group_type,sort_order) VALUES ((SELECT id FROM %s WHERE username = %s),
- (SELECT id FROM %s WHERE name = %s),%s,%s)`,
+ return fmt.Sprintf(`INSERT INTO %s (user_id,group_id,group_type) VALUES ((SELECT id FROM %s WHERE username = %s),
+ (SELECT id FROM %s WHERE name = %s),%s)`,
sqlTableUsersGroupsMapping, sqlTableUsers, sqlPlaceholders[0], getSQLQuotedName(sqlTableGroups),
- sqlPlaceholders[1], sqlPlaceholders[2], sqlPlaceholders[3])
+ sqlPlaceholders[1], sqlPlaceholders[2])
}
func getClearAdminGroupMappingQuery() string {
@@ -779,10 +769,10 @@ func getClearAdminGroupMappingQuery() string {
}
func getAddAdminGroupMappingQuery() string {
- return fmt.Sprintf(`INSERT INTO %s (admin_id,group_id,options,sort_order) VALUES ((SELECT id FROM %s WHERE username = %s),
- (SELECT id FROM %s WHERE name = %s),%s,%s)`,
+ return fmt.Sprintf(`INSERT INTO %s (admin_id,group_id,options) VALUES ((SELECT id FROM %s WHERE username = %s),
+ (SELECT id FROM %s WHERE name = %s),%s)`,
sqlTableAdminsGroupsMapping, sqlTableAdmins, sqlPlaceholders[0], getSQLQuotedName(sqlTableGroups),
- sqlPlaceholders[1], sqlPlaceholders[2], sqlPlaceholders[3])
+ sqlPlaceholders[1], sqlPlaceholders[2])
}
func getClearGroupFolderMappingQuery() string {
@@ -791,10 +781,10 @@ func getClearGroupFolderMappingQuery() string {
}
func getAddGroupFolderMappingQuery() string {
- return fmt.Sprintf(`INSERT INTO %s (virtual_path,quota_size,quota_files,folder_id,group_id,sort_order)
- VALUES (%s,%s,%s,(SELECT id FROM %s WHERE name = %s),(SELECT id FROM %s WHERE name = %s),%s)`,
+ return fmt.Sprintf(`INSERT INTO %s (virtual_path,quota_size,quota_files,folder_id,group_id)
+ VALUES (%s,%s,%s,(SELECT id FROM %s WHERE name = %s),(SELECT id FROM %s WHERE name = %s))`,
sqlTableGroupsFoldersMapping, sqlPlaceholders[0], sqlPlaceholders[1], sqlPlaceholders[2], sqlTableFolders,
- sqlPlaceholders[3], getSQLQuotedName(sqlTableGroups), sqlPlaceholders[4], sqlPlaceholders[5])
+ sqlPlaceholders[3], getSQLQuotedName(sqlTableGroups), sqlPlaceholders[4])
}
func getClearUserFolderMappingQuery() string {
@@ -803,10 +793,10 @@ func getClearUserFolderMappingQuery() string {
}
func getAddUserFolderMappingQuery() string {
- return fmt.Sprintf(`INSERT INTO %s (virtual_path,quota_size,quota_files,folder_id,user_id,sort_order)
- VALUES (%s,%s,%s,(SELECT id FROM %s WHERE name = %s),(SELECT id FROM %s WHERE username = %s),%s)`,
+ return fmt.Sprintf(`INSERT INTO %s (virtual_path,quota_size,quota_files,folder_id,user_id)
+ VALUES (%s,%s,%s,(SELECT id FROM %s WHERE name = %s),(SELECT id FROM %s WHERE username = %s))`,
sqlTableUsersFoldersMapping, sqlPlaceholders[0], sqlPlaceholders[1], sqlPlaceholders[2], sqlTableFolders,
- sqlPlaceholders[3], sqlTableUsers, sqlPlaceholders[4], sqlPlaceholders[5])
+ sqlPlaceholders[3], sqlTableUsers, sqlPlaceholders[4])
}
func getFoldersQuery(order string, minimal bool) string {
@@ -848,7 +838,7 @@ func getRelatedGroupsForUsersQuery(users []User) string {
sb.WriteString(")")
}
return fmt.Sprintf(`SELECT g.name,ug.group_type,ug.user_id FROM %s g INNER JOIN %s ug ON g.id = ug.group_id WHERE
- ug.user_id IN %s ORDER BY ug.sort_order`, getSQLQuotedName(sqlTableGroups), sqlTableUsersGroupsMapping, sb.String())
+ ug.user_id IN %s ORDER BY g.name`, getSQLQuotedName(sqlTableGroups), sqlTableUsersGroupsMapping, sb.String())
}
func getRelatedGroupsForAdminsQuery(admins []Admin) string {
@@ -865,7 +855,7 @@ func getRelatedGroupsForAdminsQuery(admins []Admin) string {
sb.WriteString(")")
}
return fmt.Sprintf(`SELECT g.name,ag.options,ag.admin_id FROM %s g INNER JOIN %s ag ON g.id = ag.group_id WHERE
- ag.admin_id IN %s ORDER BY ag.sort_order`, getSQLQuotedName(sqlTableGroups), sqlTableAdminsGroupsMapping, sb.String())
+ ag.admin_id IN %s ORDER BY g.name`, getSQLQuotedName(sqlTableGroups), sqlTableAdminsGroupsMapping, sb.String())
}
func getRelatedFoldersForUsersQuery(users []User) string {
@@ -883,7 +873,7 @@ func getRelatedFoldersForUsersQuery(users []User) string {
}
return fmt.Sprintf(`SELECT f.id,f.name,f.path,f.used_quota_size,f.used_quota_files,f.last_quota_update,fm.virtual_path,
fm.quota_size,fm.quota_files,fm.user_id,f.filesystem,f.description FROM %s f INNER JOIN %s fm ON f.id = fm.folder_id WHERE
- fm.user_id IN %s ORDER BY fm.sort_order`, sqlTableFolders, sqlTableUsersFoldersMapping, sb.String())
+ fm.user_id IN %s ORDER BY f.name`, sqlTableFolders, sqlTableUsersFoldersMapping, sb.String())
}
func getRelatedUsersForFoldersQuery(folders []vfs.BaseVirtualFolder) string {
@@ -970,7 +960,7 @@ func getRelatedFoldersForGroupsQuery(groups []Group) string {
}
return fmt.Sprintf(`SELECT f.id,f.name,f.path,f.used_quota_size,f.used_quota_files,f.last_quota_update,fm.virtual_path,
fm.quota_size,fm.quota_files,fm.group_id,f.filesystem,f.description FROM %s f INNER JOIN %s fm ON f.id = fm.folder_id WHERE
- fm.group_id IN %s ORDER BY fm.sort_order`, sqlTableFolders, sqlTableGroupsFoldersMapping, sb.String())
+ fm.group_id IN %s ORDER BY f.name`, sqlTableFolders, sqlTableGroupsFoldersMapping, sb.String())
}
func getActiveTransfersQuery() string {
diff --git a/internal/dataprovider/unixcrypt.go b/internal/dataprovider/unixcrypt.go
index 26c8f646..9799e8a4 100644
--- a/internal/dataprovider/unixcrypt.go
+++ b/internal/dataprovider/unixcrypt.go
@@ -12,7 +12,8 @@
// You should have received a copy of the GNU Affero General Public License
// along with this program. If not, see .
-//go:build unixcrypt && cgo
+//go:build unixcrypt
+// +build unixcrypt
package dataprovider
diff --git a/internal/dataprovider/unixcrypt_disabled.go b/internal/dataprovider/unixcrypt_disabled.go
index 3e865110..ecf76997 100644
--- a/internal/dataprovider/unixcrypt_disabled.go
+++ b/internal/dataprovider/unixcrypt_disabled.go
@@ -12,7 +12,8 @@
// You should have received a copy of the GNU Affero General Public License
// along with this program. If not, see .
-//go:build !unixcrypt || !cgo
+//go:build !unixcrypt
+// +build !unixcrypt
package dataprovider
diff --git a/internal/dataprovider/user.go b/internal/dataprovider/user.go
index 8cea928d..80970c26 100644
--- a/internal/dataprovider/user.go
+++ b/internal/dataprovider/user.go
@@ -22,8 +22,6 @@ import (
"net"
"os"
"path"
- "path/filepath"
- "slices"
"strconv"
"strings"
"time"
@@ -125,8 +123,6 @@ type UserFilters struct {
sdk.BaseUserFilters
// User must change password from WebClient/REST API at next login.
RequirePasswordChange bool `json:"require_password_change,omitempty"`
- // AdditionalEmails defines additional email addresses
- AdditionalEmails []string `json:"additional_emails,omitempty"`
// Time-based one time passwords configuration
TOTPConfig UserTOTPConfig `json:"totp_config,omitempty"`
// Recovery codes to use if the user loses access to their second factor auth device.
@@ -346,11 +342,7 @@ func (u *User) isTimeBasedAccessAllowed(when time.Time) bool {
if when.IsZero() {
when = time.Now()
}
- if UseLocalTime() {
- when = when.Local()
- } else {
- when = when.UTC()
- }
+ when = when.UTC()
weekDay := when.Weekday()
hhMM := when.Format("15:04")
for _, p := range u.Filters.AccessTime {
@@ -407,15 +399,6 @@ func (u *User) CheckMaxShareExpiration(expiresAt time.Time) error {
return nil
}
-// GetEmailAddresses returns all the email addresses.
-func (u *User) GetEmailAddresses() []string {
- var res []string
- if u.Email != "" {
- res = append(res, u.Email)
- }
- return slices.Concat(res, u.Filters.AdditionalEmails)
-}
-
// GetSubDirPermissions returns permissions for sub directories
func (u *User) GetSubDirPermissions() []sdk.DirectoryPermissions {
var result []sdk.DirectoryPermissions
@@ -857,20 +840,20 @@ func (u *User) HasPermissionsInside(virtualPath string) bool {
// HasPerm returns true if the user has the given permission or any permission
func (u *User) HasPerm(permission, path string) bool {
perms := u.GetPermissionsForPath(path)
- if slices.Contains(perms, PermAny) {
+ if util.Contains(perms, PermAny) {
return true
}
- return slices.Contains(perms, permission)
+ return util.Contains(perms, permission)
}
// HasAnyPerm returns true if the user has at least one of the given permissions
func (u *User) HasAnyPerm(permissions []string, path string) bool {
perms := u.GetPermissionsForPath(path)
- if slices.Contains(perms, PermAny) {
+ if util.Contains(perms, PermAny) {
return true
}
for _, permission := range permissions {
- if slices.Contains(perms, permission) {
+ if util.Contains(perms, permission) {
return true
}
}
@@ -880,11 +863,11 @@ func (u *User) HasAnyPerm(permissions []string, path string) bool {
// HasPerms returns true if the user has all the given permissions
func (u *User) HasPerms(permissions []string, path string) bool {
perms := u.GetPermissionsForPath(path)
- if slices.Contains(perms, PermAny) {
+ if util.Contains(perms, PermAny) {
return true
}
for _, permission := range permissions {
- if !slices.Contains(perms, permission) {
+ if !util.Contains(perms, permission) {
return false
}
}
@@ -944,11 +927,11 @@ func (u *User) IsLoginMethodAllowed(loginMethod, protocol string) bool {
if len(u.Filters.DeniedLoginMethods) == 0 {
return true
}
- if slices.Contains(u.Filters.DeniedLoginMethods, loginMethod) {
+ if util.Contains(u.Filters.DeniedLoginMethods, loginMethod) {
return false
}
if protocol == protocolSSH && loginMethod == LoginMethodPassword {
- if slices.Contains(u.Filters.DeniedLoginMethods, SSHLoginMethodPassword) {
+ if util.Contains(u.Filters.DeniedLoginMethods, SSHLoginMethodPassword) {
return false
}
}
@@ -982,10 +965,10 @@ func (u *User) IsPartialAuth() bool {
method == SSHLoginMethodPassword {
continue
}
- if method == LoginMethodPassword && slices.Contains(u.Filters.DeniedLoginMethods, SSHLoginMethodPassword) {
+ if method == LoginMethodPassword && util.Contains(u.Filters.DeniedLoginMethods, SSHLoginMethodPassword) {
continue
}
- if !slices.Contains(SSHMultiStepsLoginMethods, method) {
+ if !util.Contains(SSHMultiStepsLoginMethods, method) {
return false
}
}
@@ -999,7 +982,7 @@ func (u *User) GetAllowedLoginMethods() []string {
if method == SSHLoginMethodPassword {
continue
}
- if !slices.Contains(u.Filters.DeniedLoginMethods, method) {
+ if !util.Contains(u.Filters.DeniedLoginMethods, method) {
allowedMethods = append(allowedMethods, method)
}
}
@@ -1069,7 +1052,7 @@ func (u *User) IsFileAllowed(virtualPath string) (bool, int) {
// CanManageMFA returns true if the user can add a multi-factor authentication configuration
func (u *User) CanManageMFA() bool {
- if slices.Contains(u.Filters.WebClient, sdk.WebClientMFADisabled) {
+ if util.Contains(u.Filters.WebClient, sdk.WebClientMFADisabled) {
return false
}
return len(mfa.GetAvailableTOTPConfigs()) > 0
@@ -1090,39 +1073,39 @@ func (u *User) skipExternalAuth() bool {
// CanManageShares returns true if the user can add, update and list shares
func (u *User) CanManageShares() bool {
- return !slices.Contains(u.Filters.WebClient, sdk.WebClientSharesDisabled)
+ return !util.Contains(u.Filters.WebClient, sdk.WebClientSharesDisabled)
}
// CanResetPassword returns true if this user is allowed to reset its password
func (u *User) CanResetPassword() bool {
- return !slices.Contains(u.Filters.WebClient, sdk.WebClientPasswordResetDisabled)
+ return !util.Contains(u.Filters.WebClient, sdk.WebClientPasswordResetDisabled)
}
// CanChangePassword returns true if this user is allowed to change its password
func (u *User) CanChangePassword() bool {
- return !slices.Contains(u.Filters.WebClient, sdk.WebClientPasswordChangeDisabled)
+ return !util.Contains(u.Filters.WebClient, sdk.WebClientPasswordChangeDisabled)
}
// CanChangeAPIKeyAuth returns true if this user is allowed to enable/disable API key authentication
func (u *User) CanChangeAPIKeyAuth() bool {
- return !slices.Contains(u.Filters.WebClient, sdk.WebClientAPIKeyAuthChangeDisabled)
+ return !util.Contains(u.Filters.WebClient, sdk.WebClientAPIKeyAuthChangeDisabled)
}
// CanChangeInfo returns true if this user is allowed to change its info such as email and description
func (u *User) CanChangeInfo() bool {
- return !slices.Contains(u.Filters.WebClient, sdk.WebClientInfoChangeDisabled)
+ return !util.Contains(u.Filters.WebClient, sdk.WebClientInfoChangeDisabled)
}
// CanManagePublicKeys returns true if this user is allowed to manage public keys
// from the WebClient. Used in WebClient UI
func (u *User) CanManagePublicKeys() bool {
- return !slices.Contains(u.Filters.WebClient, sdk.WebClientPubKeyChangeDisabled)
+ return !util.Contains(u.Filters.WebClient, sdk.WebClientPubKeyChangeDisabled)
}
// CanManageTLSCerts returns true if this user is allowed to manage TLS certificates
// from the WebClient. Used in WebClient UI
func (u *User) CanManageTLSCerts() bool {
- return !slices.Contains(u.Filters.WebClient, sdk.WebClientTLSCertChangeDisabled)
+ return !util.Contains(u.Filters.WebClient, sdk.WebClientTLSCertChangeDisabled)
}
// CanUpdateProfile returns true if the user is allowed to update the profile.
@@ -1134,7 +1117,7 @@ func (u *User) CanUpdateProfile() bool {
// CanAddFilesFromWeb returns true if the client can add files from the web UI.
// The specified target is the directory where the files must be uploaded
func (u *User) CanAddFilesFromWeb(target string) bool {
- if slices.Contains(u.Filters.WebClient, sdk.WebClientWriteDisabled) {
+ if util.Contains(u.Filters.WebClient, sdk.WebClientWriteDisabled) {
return false
}
return u.HasPerm(PermUpload, target) || u.HasPerm(PermOverwrite, target)
@@ -1143,7 +1126,7 @@ func (u *User) CanAddFilesFromWeb(target string) bool {
// CanAddDirsFromWeb returns true if the client can add directories from the web UI.
// The specified target is the directory where the new directory must be created
func (u *User) CanAddDirsFromWeb(target string) bool {
- if slices.Contains(u.Filters.WebClient, sdk.WebClientWriteDisabled) {
+ if util.Contains(u.Filters.WebClient, sdk.WebClientWriteDisabled) {
return false
}
return u.HasPerm(PermCreateDirs, target)
@@ -1152,7 +1135,7 @@ func (u *User) CanAddDirsFromWeb(target string) bool {
// CanRenameFromWeb returns true if the client can rename objects from the web UI.
// The specified src and dest are the source and target directories for the rename.
func (u *User) CanRenameFromWeb(src, dest string) bool {
- if slices.Contains(u.Filters.WebClient, sdk.WebClientWriteDisabled) {
+ if util.Contains(u.Filters.WebClient, sdk.WebClientWriteDisabled) {
return false
}
return u.HasAnyPerm(permsRenameAny, src) && u.HasAnyPerm(permsRenameAny, dest)
@@ -1161,7 +1144,7 @@ func (u *User) CanRenameFromWeb(src, dest string) bool {
// CanDeleteFromWeb returns true if the client can delete objects from the web UI.
// The specified target is the parent directory for the object to delete
func (u *User) CanDeleteFromWeb(target string) bool {
- if slices.Contains(u.Filters.WebClient, sdk.WebClientWriteDisabled) {
+ if util.Contains(u.Filters.WebClient, sdk.WebClientWriteDisabled) {
return false
}
return u.HasAnyPerm(permsDeleteAny, target)
@@ -1170,7 +1153,7 @@ func (u *User) CanDeleteFromWeb(target string) bool {
// CanCopyFromWeb returns true if the client can copy objects from the web UI.
// The specified src and dest are the source and target directories for the copy.
func (u *User) CanCopyFromWeb(src, dest string) bool {
- if slices.Contains(u.Filters.WebClient, sdk.WebClientWriteDisabled) {
+ if util.Contains(u.Filters.WebClient, sdk.WebClientWriteDisabled) {
return false
}
if !u.HasPerm(PermListItems, src) {
@@ -1230,7 +1213,7 @@ func (u *User) MustSetSecondFactor() bool {
return true
}
for _, p := range u.Filters.TwoFactorAuthProtocols {
- if !slices.Contains(u.Filters.TOTPConfig.Protocols, p) {
+ if !util.Contains(u.Filters.TOTPConfig.Protocols, p) {
return true
}
}
@@ -1241,11 +1224,11 @@ func (u *User) MustSetSecondFactor() bool {
// MustSetSecondFactorForProtocol returns true if the user must set a second factor authentication
// for the specified protocol
func (u *User) MustSetSecondFactorForProtocol(protocol string) bool {
- if slices.Contains(u.Filters.TwoFactorAuthProtocols, protocol) {
+ if util.Contains(u.Filters.TwoFactorAuthProtocols, protocol) {
if !u.Filters.TOTPConfig.Enabled {
return true
}
- if !slices.Contains(u.Filters.TOTPConfig.Protocols, protocol) {
+ if !util.Contains(u.Filters.TOTPConfig.Protocols, protocol) {
return true
}
}
@@ -1588,7 +1571,7 @@ func (u *User) mergeCryptFsConfig(group *Group) {
func (u *User) mergeWithPrimaryGroup(group *Group, replacer *strings.Replacer) {
if group.UserSettings.HomeDir != "" {
- u.HomeDir = filepath.Clean(u.replacePlaceholder(group.UserSettings.HomeDir, replacer))
+ u.HomeDir = u.replacePlaceholder(group.UserSettings.HomeDir, replacer)
}
if group.UserSettings.FsConfig.Provider != 0 {
u.FsConfig = u.replaceFsConfigPlaceholders(group.UserSettings.FsConfig, replacer)
@@ -1765,17 +1748,6 @@ func (u *User) hasRole(role string) bool {
return role == u.Role
}
-func (u *User) applyNamingRules() {
- u.Username = config.convertName(u.Username)
- u.Role = config.convertName(u.Role)
- for idx := range u.Groups {
- u.Groups[idx].Name = config.convertName(u.Groups[idx].Name)
- }
- for idx := range u.VirtualFolders {
- u.VirtualFolders[idx].Name = config.convertName(u.VirtualFolders[idx].Name)
- }
-}
-
func (u *User) getACopy() User {
u.SetEmptySecretsIfNil()
pubKeys := make([]string, len(u.PublicKeys))
@@ -1807,8 +1779,6 @@ func (u *User) getACopy() User {
filters.TOTPConfig.Secret = u.Filters.TOTPConfig.Secret.Clone()
filters.TOTPConfig.Protocols = make([]string, len(u.Filters.TOTPConfig.Protocols))
copy(filters.TOTPConfig.Protocols, u.Filters.TOTPConfig.Protocols)
- filters.AdditionalEmails = make([]string, len(u.Filters.AdditionalEmails))
- copy(filters.AdditionalEmails, u.Filters.AdditionalEmails)
filters.RecoveryCodes = make([]RecoveryCode, 0, len(u.Filters.RecoveryCodes))
for _, code := range u.Filters.RecoveryCodes {
if code.Secret == nil {
diff --git a/internal/ftpd/cryptfs_test.go b/internal/ftpd/cryptfs_test.go
index 23567fff..c036b59a 100644
--- a/internal/ftpd/cryptfs_test.go
+++ b/internal/ftpd/cryptfs_test.go
@@ -134,7 +134,6 @@ func TestBasicFTPHandlingCryptFs(t *testing.T) {
assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 }, 1*time.Second, 50*time.Millisecond)
assert.Eventually(t, func() bool { return common.Connections.GetClientConnections() == 0 }, 1000*time.Millisecond,
50*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
}
func TestBufferedCryptFs(t *testing.T) {
@@ -180,7 +179,6 @@ func TestBufferedCryptFs(t *testing.T) {
assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 }, 1*time.Second, 50*time.Millisecond)
assert.Eventually(t, func() bool { return common.Connections.GetClientConnections() == 0 }, 1000*time.Millisecond,
50*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
}
func TestZeroBytesTransfersCryptFs(t *testing.T) {
diff --git a/internal/ftpd/ftpd.go b/internal/ftpd/ftpd.go
index 9fdfacf0..80dd1531 100644
--- a/internal/ftpd/ftpd.go
+++ b/internal/ftpd/ftpd.go
@@ -19,7 +19,6 @@ import (
"context"
"errors"
"fmt"
- "log/slog"
"net"
"os"
"path/filepath"
@@ -67,6 +66,8 @@ type Binding struct {
// Set to 1 to require TLS for both data and control connection.
// Set to 2 to enable implicit TLS
TLSMode int `json:"tls_mode" mapstructure:"tls_mode"`
+ // 0 disabled, 1 required
+ TLSSessionReuse int `json:"tls_session_reuse" mapstructure:"tls_session_reuse"`
// Certificate and matching private key for this specific binding, if empty the global
// ones will be used, if any
CertificateFile string `json:"certificate_file" mapstructure:"certificate_file"`
@@ -108,6 +109,11 @@ type Binding struct {
// Please note that disabling the security checks you will make the FTP service vulnerable to bounce attacks
// on active data connections, so change the default value only if you are on a trusted/internal network
ActiveConnectionsSecurity int `json:"active_connections_security" mapstructure:"active_connections_security"`
+ // Set to 1 to silently ignore any client requests to perform ASCII translations via the TYPE command.
+ // That is, FTP clients can request ASCII translations, and SFTPGo will respond as the client expects,
+ // but will not actually perform the translation for either uploads or downloads. This behavior can be
+ // useful in circumstances involving older/mainframe clients and EBCDIC files.
+ IgnoreASCIITransferType int `json:"ignore_ascii_transfer_type" mapstructure:"ignore_ascii_transfer_type"`
// Debug enables the FTP debug mode. In debug mode, every FTP command will be logged
Debug bool `json:"debug" mapstructure:"debug"`
ciphers []uint16
@@ -135,6 +141,10 @@ func (b *Binding) isTLSModeValid() bool {
return b.TLSMode >= 0 && b.TLSMode <= 2
}
+func (b *Binding) isTLSSessionReuseValid() bool {
+ return b.TLSSessionReuse >= 0 && b.TLSSessionReuse <= 1
+}
+
func (b *Binding) checkSecuritySettings() error {
if b.PassiveConnectionsSecurity < 0 || b.PassiveConnectionsSecurity > 1 {
return fmt.Errorf("invalid passive_connections_security: %v", b.PassiveConnectionsSecurity)
@@ -402,14 +412,9 @@ func (c *Configuration) Initialize(configDir string) error {
server := NewServer(c, configDir, binding, idx)
go func(s *Server) {
- ftpLogger := logger.NewSlogAdapter("ftpserverlib", []slog.Attr{
- {
- Key: "server_id",
- Value: slog.StringValue(fmt.Sprintf("FTP_%d", s.ID)),
- },
- })
+ ftpLogger := logger.LeveledLogger{Sender: "ftpserverlib"}
ftpServer := ftpserver.NewFtpServer(s)
- ftpServer.Logger = slog.New(ftpLogger)
+ ftpServer.Logger = ftpLogger.With("server_id", fmt.Sprintf("FTP_%v", s.ID))
logger.Info(logSender, "", "starting FTP serving, binding: %v", s.binding.GetAddress())
util.CheckTCP4Port(s.binding.Port)
exitChannel <- ftpServer.ListenAndServe()
diff --git a/internal/ftpd/ftpd_test.go b/internal/ftpd/ftpd_test.go
index aebf5f37..ffc9f3f8 100644
--- a/internal/ftpd/ftpd_test.go
+++ b/internal/ftpd/ftpd_test.go
@@ -37,7 +37,6 @@ import (
ftpserver "github.com/fclairamb/ftpserverlib"
"github.com/jlaffaye/ftp"
- "github.com/pkg/sftp"
"github.com/pquerna/otp"
"github.com/pquerna/otp/totp"
"github.com/rs/zerolog"
@@ -45,7 +44,6 @@ import (
sdkkms "github.com/sftpgo/sdk/kms"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
- "golang.org/x/crypto/ssh"
"github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/config"
@@ -443,6 +441,7 @@ func TestMain(m *testing.M) { //nolint:gocyclo
CertificateFile: certPath,
CertificateKeyFile: keyPath,
TLSMode: 1,
+ TLSSessionReuse: 1,
ClientAuthType: 2,
},
}
@@ -529,6 +528,16 @@ func TestInitializationFailure(t *testing.T) {
require.Error(t, err)
require.Contains(t, err.Error(), "the provided passive IP \"127001\" is not valid")
ftpdConf.Bindings[1].ForcePassiveIP = ""
+ ftpdConf.Bindings[1].TLSMode = 2
+ ftpdConf.Bindings[1].TLSSessionReuse = 1
+ err = ftpdConf.Initialize(configDir)
+ require.Error(t, err, "TLS session resumption should not be supported with implicit FTPS")
+ ftpdConf.Bindings[1].TLSMode = 0
+ ftpdConf.Bindings[1].TLSSessionReuse = 100
+ err = ftpdConf.Initialize(configDir)
+ require.Error(t, err)
+ assert.Contains(t, err.Error(), "unsupported TLS reuse mode")
+ ftpdConf.Bindings[1].TLSSessionReuse = 0
err = ftpdConf.Initialize(configDir)
require.Error(t, err)
@@ -629,8 +638,6 @@ func TestBasicFTPHandling(t *testing.T) {
}
err = ftpUploadFile(testFilePath, testFileName, testFileSize, client, 0)
assert.NoError(t, err)
- _, err = client.FileSize(path.Join("/", testDir))
- assert.Error(t, err)
size, err := client.FileSize(path.Join("/", testDir, testFileName))
assert.NoError(t, err)
assert.Equal(t, testFileSize, size)
@@ -664,7 +671,6 @@ func TestBasicFTPHandling(t *testing.T) {
assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 }, 1*time.Second, 50*time.Millisecond)
assert.Eventually(t, func() bool { return common.Connections.GetClientConnections() == 0 }, 1000*time.Millisecond,
50*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
}
func TestHTTPFs(t *testing.T) {
@@ -709,7 +715,6 @@ func TestHTTPFs(t *testing.T) {
assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 }, 1*time.Second, 50*time.Millisecond)
assert.Eventually(t, func() bool { return common.Connections.GetClientConnections() == 0 }, 1000*time.Millisecond,
50*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
}
func TestListDirWithWildcards(t *testing.T) {
@@ -1730,66 +1735,6 @@ func TestMaxPerHostConnections(t *testing.T) {
common.Config.MaxPerHostConnections = oldValue
}
-func TestMaxTransfers(t *testing.T) {
- oldValue := common.Config.MaxPerHostConnections
- common.Config.MaxPerHostConnections = 2
-
- assert.Eventually(t, func() bool {
- return common.Connections.GetClientConnections() == 0
- }, 1000*time.Millisecond, 50*time.Millisecond)
-
- user := getTestUser()
- err := dataprovider.AddUser(&user, "", "", "")
- assert.NoError(t, err)
- user.Password = ""
-
- testFilePath := filepath.Join(homeBasePath, testFileName)
- testFileSize := int64(65535)
- err = createTestFile(testFilePath, testFileSize)
- assert.NoError(t, err)
-
- conn, sftpClient, err := getSftpClient(user)
- assert.NoError(t, err)
- defer conn.Close()
- defer sftpClient.Close()
-
- f1, err := sftpClient.Create("file1")
- assert.NoError(t, err)
- f2, err := sftpClient.Create("file2")
- assert.NoError(t, err)
- _, err = f1.Write([]byte(" "))
- assert.NoError(t, err)
- _, err = f2.Write([]byte(" "))
- assert.NoError(t, err)
-
- client, err := getFTPClient(user, true, nil)
- if assert.NoError(t, err) {
- err = checkBasicFTP(client)
- assert.NoError(t, err)
- err = ftpUploadFile(testFilePath, testFileName, testFileSize, client, 0)
- assert.Error(t, err)
- localDownloadPath := filepath.Join(homeBasePath, testDLFileName)
- err = ftpDownloadFile(testFileName, localDownloadPath, testFileSize, client, 0)
- assert.Error(t, err)
- err := client.Quit()
- assert.NoError(t, err)
- err = os.Remove(localDownloadPath)
- assert.NoError(t, err)
- }
-
- err = f1.Close()
- assert.NoError(t, err)
- err = f2.Close()
- assert.NoError(t, err)
-
- err = dataprovider.DeleteUser(user.Username, "", "", "")
- assert.NoError(t, err)
- err = os.RemoveAll(user.GetHomeDir())
- assert.NoError(t, err)
-
- common.Config.MaxPerHostConnections = oldValue
-}
-
func TestRateLimiter(t *testing.T) {
oldConfig := config.GetCommonConfig()
@@ -2506,7 +2451,7 @@ func TestLoginWithDatabaseCredentials(t *testing.T) {
u := getTestUser()
u.FsConfig.Provider = sdk.GCSFilesystemProvider
u.FsConfig.GCSConfig.Bucket = "test"
- u.FsConfig.GCSConfig.Credentials = kms.NewPlainSecret(`{ "type": "service_account", "private_key": " ", "client_email": "example@iam.gserviceaccount.com" }`)
+ u.FsConfig.GCSConfig.Credentials = kms.NewPlainSecret(`{ "type": "service_account" }`)
user, _, err := httpdtest.AddUser(u, http.StatusCreated)
assert.NoError(t, err)
assert.Equal(t, sdkkms.SecretStatusSecretBox, user.FsConfig.GCSConfig.Credentials.GetStatus())
@@ -2773,7 +2718,6 @@ func TestStat(t *testing.T) {
func TestUploadOverwriteVfolder(t *testing.T) {
u := getTestUser()
- u.QuotaFiles = 1000
vdir := "/vdir"
mappedPath := filepath.Join(os.TempDir(), "vdir")
folderName := filepath.Base(mappedPath)
@@ -2805,24 +2749,14 @@ func TestUploadOverwriteVfolder(t *testing.T) {
assert.NoError(t, err)
folder, _, err := httpdtest.GetFolderByName(folderName, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), folder.UsedQuotaSize)
- assert.Equal(t, 0, folder.UsedQuotaFiles)
- user, _, err = httpdtest.GetUserByUsername(user.Username, http.StatusOK)
- assert.NoError(t, err)
- assert.Equal(t, testFileSize, user.UsedQuotaSize)
- assert.Equal(t, 1, user.UsedQuotaFiles)
-
+ assert.Equal(t, testFileSize, folder.UsedQuotaSize)
+ assert.Equal(t, 1, folder.UsedQuotaFiles)
err = ftpUploadFile(testFilePath, path.Join(vdir, testFileName), testFileSize, client, 0)
assert.NoError(t, err)
folder, _, err = httpdtest.GetFolderByName(folderName, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), folder.UsedQuotaSize)
- assert.Equal(t, 0, folder.UsedQuotaFiles)
- user, _, err = httpdtest.GetUserByUsername(user.Username, http.StatusOK)
- assert.NoError(t, err)
- assert.Equal(t, testFileSize, user.UsedQuotaSize)
- assert.Equal(t, 1, user.UsedQuotaFiles)
-
+ assert.Equal(t, testFileSize, folder.UsedQuotaSize)
+ assert.Equal(t, 1, folder.UsedQuotaFiles)
err = client.Quit()
assert.NoError(t, err)
err = os.Remove(testFilePath)
@@ -3154,12 +3088,12 @@ func TestMODEType(t *testing.T) {
if assert.NoError(t, err) {
code, response, err := client.SendCommand("MODE s")
assert.NoError(t, err)
- assert.Equal(t, ftp.StatusNotImplementedParameter, code)
- assert.Equal(t, "Unsupported mode", response)
+ assert.Equal(t, ftp.StatusCommandOK, code)
+ assert.Equal(t, "Transfer mode set to 'S'", response)
code, response, err = client.SendCommand("MODE S")
assert.NoError(t, err)
assert.Equal(t, ftp.StatusCommandOK, code)
- assert.Equal(t, "Using stream mode", response)
+ assert.Equal(t, "Transfer mode set to 'S'", response)
code, _, err = client.SendCommand("MODE Z")
assert.NoError(t, err)
@@ -3167,7 +3101,7 @@ func TestMODEType(t *testing.T) {
code, _, err = client.SendCommand("MODE SS")
assert.NoError(t, err)
- assert.Equal(t, ftp.StatusNotImplementedParameter, code)
+ assert.Equal(t, ftp.StatusBadArguments, code)
err = client.Quit()
assert.NoError(t, err)
@@ -3527,6 +3461,61 @@ func TestCombine(t *testing.T) {
assert.NoError(t, err)
}
+func TestTLSSessionReuse(t *testing.T) {
+ u := getTestUser()
+ user, _, err := httpdtest.AddUser(u, http.StatusCreated)
+ assert.NoError(t, err)
+
+ client, err := getFTPClientWithSessionReuse(user, nil)
+ if assert.NoError(t, err) {
+ err = checkBasicFTP(client)
+ assert.NoError(t, err)
+
+ testFilePath := filepath.Join(homeBasePath, testFileName)
+ testFileSize := int64(65535)
+ err = createTestFile(testFilePath, testFileSize)
+ assert.NoError(t, err)
+
+ err = ftpUploadFile(testFilePath, testFileName, testFileSize, client, 0)
+ assert.NoError(t, err)
+
+ localDownloadPath := filepath.Join(homeBasePath, testDLFileName)
+ err = ftpDownloadFile(testFileName, localDownloadPath, testFileSize, client, 0)
+ assert.NoError(t, err)
+
+ entries, err := client.List("/")
+ assert.NoError(t, err)
+ assert.Len(t, entries, 1)
+
+ err = client.Quit()
+ assert.NoError(t, err)
+ err = os.Remove(testFilePath)
+ assert.NoError(t, err)
+ err = os.Remove(localDownloadPath)
+ assert.NoError(t, err)
+ }
+
+ // this TLS config does not support session resumption
+ tlsConfig := &tls.Config{
+ ServerName: "localhost",
+ InsecureSkipVerify: true, // use this for tests only
+ MinVersion: tls.VersionTLS12,
+ }
+ client, err = getFTPClientWithSessionReuse(user, tlsConfig)
+ if assert.NoError(t, err) {
+ err = checkBasicFTP(client)
+ assert.Error(t, err)
+
+ err = client.Quit()
+ assert.NoError(t, err)
+ }
+
+ _, err = httpdtest.RemoveUser(user, http.StatusOK)
+ assert.NoError(t, err)
+ err = os.RemoveAll(user.GetHomeDir())
+ assert.NoError(t, err)
+}
+
func TestClientCertificateAuthRevokedCert(t *testing.T) {
u := getTestUser()
u.Username = tlsClient2Username
@@ -3962,7 +3951,6 @@ func TestNestedVirtualFolders(t *testing.T) {
assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 }, 1*time.Second, 50*time.Millisecond)
assert.Eventually(t, func() bool { return common.Connections.GetClientConnections() == 0 }, 1000*time.Millisecond,
50*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
}
func checkBasicFTP(client *ftp.ServerConn) error {
@@ -4214,30 +4202,6 @@ func getPreLoginScriptContent(user dataprovider.User, nonJSONResponse bool) []by
return content
}
-func getSftpClient(user dataprovider.User) (*ssh.Client, *sftp.Client, error) {
- var sftpClient *sftp.Client
- config := &ssh.ClientConfig{
- User: user.Username,
- HostKeyCallback: ssh.InsecureIgnoreHostKey(),
- Timeout: 5 * time.Second,
- }
- if user.Password != "" {
- config.Auth = []ssh.AuthMethod{ssh.Password(user.Password)}
- } else {
- config.Auth = []ssh.AuthMethod{ssh.Password(defaultPassword)}
- }
-
- conn, err := ssh.Dial("tcp", sftpServerAddr, config)
- if err != nil {
- return conn, sftpClient, err
- }
- sftpClient, err = sftp.NewClient(conn)
- if err != nil {
- conn.Close()
- }
- return conn, sftpClient, err
-}
-
func getExitCodeScriptContent(exitCode int) []byte {
content := []byte("#!/bin/sh\n\n")
content = append(content, []byte(fmt.Sprintf("exit %v", exitCode))...)
diff --git a/internal/ftpd/handler.go b/internal/ftpd/handler.go
index 613eaa07..036c3977 100644
--- a/internal/ftpd/handler.go
+++ b/internal/ftpd/handler.go
@@ -29,7 +29,6 @@ import (
"github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
"github.com/drakkan/sftpgo/v2/internal/logger"
- "github.com/drakkan/sftpgo/v2/internal/util"
"github.com/drakkan/sftpgo/v2/internal/vfs"
)
@@ -98,7 +97,6 @@ func (c *Connection) Create(_ string) (afero.File, error) {
// Mkdir creates a directory using the connection filesystem
func (c *Connection) Mkdir(name string, _ os.FileMode) error {
c.UpdateLastActivity()
- name = util.CleanPath(name)
return c.CreateDir(name, true)
}
@@ -122,7 +120,6 @@ func (c *Connection) OpenFile(_ string, _ int, _ os.FileMode) (afero.File, error
// We implements ClientDriverExtensionRemoveDir for directories
func (c *Connection) Remove(name string) error {
c.UpdateLastActivity()
- name = util.CleanPath(name)
fs, p, err := c.GetFsAndResolvedPath(name)
if err != nil {
@@ -150,8 +147,6 @@ func (c *Connection) RemoveAll(_ string) error {
// Rename renames a file or a directory
func (c *Connection) Rename(oldname, newname string) error {
c.UpdateLastActivity()
- oldname = util.CleanPath(oldname)
- newname = util.CleanPath(newname)
return c.BaseConnection.Rename(oldname, newname)
}
@@ -160,7 +155,6 @@ func (c *Connection) Rename(oldname, newname string) error {
// if any happens
func (c *Connection) Stat(name string) (os.FileInfo, error) {
c.UpdateLastActivity()
- name = util.CleanPath(name)
c.doWildcardListDir = false
if !c.User.HasPerm(dataprovider.PermListItems, path.Dir(name)) {
@@ -204,7 +198,6 @@ func (c *Connection) Chown(_ string, _, _ int) error {
// Chmod changes the mode of the named file/directory
func (c *Connection) Chmod(name string, mode os.FileMode) error {
c.UpdateLastActivity()
- name = util.CleanPath(name)
attrs := common.StatAttributes{
Flags: common.StatAttrPerms,
@@ -216,7 +209,6 @@ func (c *Connection) Chmod(name string, mode os.FileMode) error {
// Chtimes changes the access and modification times of the named file
func (c *Connection) Chtimes(name string, atime time.Time, mtime time.Time) error {
c.UpdateLastActivity()
- name = util.CleanPath(name)
attrs := common.StatAttributes{
Flags: common.StatAttrTimes,
@@ -229,7 +221,6 @@ func (c *Connection) Chtimes(name string, atime time.Time, mtime time.Time) erro
// GetAvailableSpace implements ClientDriverExtensionAvailableSpace interface
func (c *Connection) GetAvailableSpace(dirName string) (int64, error) {
c.UpdateLastActivity()
- dirName = util.CleanPath(dirName)
diskQuota, transferQuota := c.HasSpace(false, false, path.Join(dirName, "fakefile.txt"))
if !diskQuota.HasSpace || !transferQuota.HasUploadSpace() {
@@ -288,7 +279,6 @@ func (c *Connection) AllocateSpace(_ int) error {
// RemoveDir implements ClientDriverExtensionRemoveDir
func (c *Connection) RemoveDir(name string) error {
c.UpdateLastActivity()
- name = util.CleanPath(name)
return c.BaseConnection.RemoveDir(name)
}
@@ -296,16 +286,13 @@ func (c *Connection) RemoveDir(name string) error {
// Symlink implements ClientDriverExtensionSymlink
func (c *Connection) Symlink(oldname, newname string) error {
c.UpdateLastActivity()
- oldname = util.CleanPath(oldname)
- newname = util.CleanPath(newname)
- return c.CreateSymlink(oldname, newname)
+ return c.BaseConnection.CreateSymlink(oldname, newname)
}
// ReadDir implements ClientDriverExtensionFilelist
-func (c *Connection) ReadDir(name string) ([]os.FileInfo, error) {
+func (c *Connection) ReadDir(name string) (ftpserver.DirLister, error) {
c.UpdateLastActivity()
- name = util.CleanPath(name)
if c.doWildcardListDir {
c.doWildcardListDir = false
@@ -319,27 +306,21 @@ func (c *Connection) ReadDir(name string) ([]os.FileInfo, error) {
if err != nil {
return nil, err
}
- patternLister := &patternDirLister{
+ return &patternDirLister{
DirLister: lister,
pattern: baseName,
lastCommand: c.clientContext.GetLastCommand(),
dirName: name,
- connectionPath: util.CleanPath(c.clientContext.Path()),
- }
- return consumeDirLister(patternLister)
+ connectionPath: c.clientContext.Path(),
+ }, nil
}
- lister, err := c.ListDir(name)
- if err != nil {
- return nil, err
- }
- return consumeDirLister(lister)
+ return c.ListDir(name)
}
// GetHandle implements ClientDriverExtentionFileTransfer
func (c *Connection) GetHandle(name string, flags int, offset int64) (ftpserver.FileTransfer, error) {
c.UpdateLastActivity()
- name = util.CleanPath(name)
fs, p, err := c.GetFsAndResolvedPath(name)
if err != nil {
@@ -350,11 +331,6 @@ func (c *Connection) GetHandle(name string, flags int, offset int64) (ftpserver.
return nil, errCOMBNotSupported
}
- if err := common.Connections.IsNewTransferAllowed(c.User.Username); err != nil {
- c.Log(logger.LevelInfo, "denying transfer due to count limits")
- return nil, c.GetPermissionDeniedError()
- }
-
if flags&os.O_WRONLY != 0 {
return c.uploadFile(fs, p, name, flags)
}
@@ -489,7 +465,7 @@ func (c *Connection) handleFTPUploadToExistingFile(fs vfs.Fs, flags int, resolve
}
if common.Config.IsAtomicUploadEnabled() && fs.IsAtomicUploadSupported() {
- _, _, err = fs.Rename(resolvedPath, filePath, 0)
+ _, _, err = fs.Rename(resolvedPath, filePath)
if err != nil {
c.Log(logger.LevelError, "error renaming existing file for atomic upload, source: %q, dest: %q, err: %+v",
resolvedPath, filePath, err)
@@ -517,7 +493,10 @@ func (c *Connection) handleFTPUploadToExistingFile(fs vfs.Fs, flags int, resolve
if vfs.HasTruncateSupport(fs) {
vfolder, err := c.User.GetVirtualFolderForPath(path.Dir(requestPath))
if err == nil {
- dataprovider.UpdateUserFolderQuota(&vfolder, &c.User, 0, -fileSize, false)
+ dataprovider.UpdateVirtualFolderQuota(&vfolder.BaseVirtualFolder, 0, -fileSize, false) //nolint:errcheck
+ if vfolder.IsIncludedInUserQuota() {
+ dataprovider.UpdateUserQuota(&c.User, 0, -fileSize, false) //nolint:errcheck
+ }
} else {
dataprovider.UpdateUserQuota(&c.User, 0, -fileSize, false) //nolint:errcheck
}
@@ -602,24 +581,3 @@ func (l *patternDirLister) Next(limit int) ([]os.FileInfo, error) {
}
}
}
-
-func consumeDirLister(lister vfs.DirLister) ([]os.FileInfo, error) {
- defer lister.Close()
-
- var results []os.FileInfo
-
- for {
- files, err := lister.Next(vfs.ListerBatchSize)
- finished := errors.Is(err, io.EOF)
- results = append(results, files...)
- if err != nil && !finished {
- return results, err
- }
- if finished {
- lister.Close()
- break
- }
- }
-
- return results, nil
-}
diff --git a/internal/ftpd/internal_test.go b/internal/ftpd/internal_test.go
index 4e167524..6d9dd8f0 100644
--- a/internal/ftpd/internal_test.go
+++ b/internal/ftpd/internal_test.go
@@ -404,7 +404,7 @@ func (fs MockOsFs) Remove(name string, _ bool) error {
}
// Rename renames (moves) source to target
-func (fs MockOsFs) Rename(source, target string, _ int) (int, int64, error) {
+func (fs MockOsFs) Rename(source, target string) (int, int64, error) {
if fs.err != nil {
return -1, -1, fs.err
}
@@ -527,24 +527,15 @@ func TestServerGetSettings(t *testing.T) {
Bindings: []Binding{binding},
PassivePortRange: PortRange{
Start: 10000,
- End: 10000,
+ End: 11000,
},
}
assert.False(t, binding.HasProxy())
server := NewServer(c, configDir, binding, 0)
settings, err := server.GetSettings()
assert.NoError(t, err)
- if ranger, ok := settings.PassiveTransferPortRange.(*ftpserver.PortRange); ok {
- assert.Equal(t, 10000, ranger.Start)
- assert.Equal(t, 10000, ranger.End)
- }
- c.PassivePortRange.End = 11000
- settings, err = server.GetSettings()
- assert.NoError(t, err)
- if ranger, ok := settings.PassiveTransferPortRange.(*ftpserver.PortRange); ok {
- assert.Equal(t, 10000, ranger.Start)
- assert.Equal(t, 11000, ranger.End)
- }
+ assert.Equal(t, 10000, settings.PassiveTransferPortRange.Start)
+ assert.Equal(t, 11000, settings.PassiveTransferPortRange.End)
common.Config.ProxyProtocol = 1
_, err = server.GetSettings()
@@ -673,7 +664,6 @@ func TestClientVersion(t *testing.T) {
common.Connections.Remove(connection.GetID())
}
assert.Len(t, common.Connections.GetStats(""), 0)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
}
func TestDriverMethodsNotImplemented(t *testing.T) {
@@ -699,26 +689,16 @@ func TestDriverMethodsNotImplemented(t *testing.T) {
func TestExtraData(t *testing.T) {
mockCC := mockFTPClientContext{}
- _, ok := mockCC.Extra().(*tlsState)
+ _, ok := mockCC.Extra().(bool)
require.False(t, ok)
- mockCC.SetExtra(&tlsState{
- LoginWithMutualTLS: false,
- Version: tls.VersionName(tls.VersionTLS13),
- Cipher: tls.CipherSuiteName(tls.TLS_AES_128_GCM_SHA256),
- KEX: tls.X25519MLKEM768.String(),
- })
- state, ok := mockCC.Extra().(*tlsState)
+ mockCC.SetExtra(false)
+ val, ok := mockCC.Extra().(bool)
require.True(t, ok)
- require.False(t, state.LoginWithMutualTLS)
- require.Equal(t, tls.VersionName(tls.VersionTLS13), state.Version)
- require.Equal(t, tls.CipherSuiteName(tls.TLS_AES_128_GCM_SHA256), state.Cipher)
- require.Equal(t, tls.X25519MLKEM768.String(), state.KEX)
- mockCC.SetExtra(&tlsState{
- LoginWithMutualTLS: true,
- })
- state, ok = mockCC.Extra().(*tlsState)
+ require.False(t, val)
+ mockCC.SetExtra(true)
+ val, ok = mockCC.Extra().(bool)
require.True(t, ok)
- require.True(t, state.LoginWithMutualTLS)
+ require.True(t, val)
}
func TestResolvePathErrors(t *testing.T) {
@@ -938,7 +918,6 @@ func TestTransferErrors(t *testing.T) {
pipeWriter := vfs.NewPipeWriter(w)
baseTransfer = common.NewBaseTransfer(nil, connection.BaseConnection, nil, testfile, testfile, testfile,
common.TransferUpload, 0, 0, 0, 0, false, fs, dataprovider.TransferQuota{})
- tr.Connection.RemoveTransfer(tr)
tr = newTransfer(baseTransfer, pipeWriter, nil, 0)
err = r.Close()
@@ -954,7 +933,6 @@ func TestTransferErrors(t *testing.T) {
if assert.Error(t, err) {
assert.EqualError(t, err, common.ErrOpUnsupported.Error())
}
- tr.Connection.RemoveTransfer(tr)
err = os.Remove(testfile)
assert.NoError(t, err)
}
diff --git a/internal/ftpd/server.go b/internal/ftpd/server.go
index 2e5790ae..8baf631c 100644
--- a/internal/ftpd/server.go
+++ b/internal/ftpd/server.go
@@ -22,7 +22,6 @@ import (
"net"
"os"
"path/filepath"
- "slices"
ftpserver "github.com/fclairamb/ftpserverlib"
"github.com/sftpgo/sdk/plugin/notifier"
@@ -36,15 +35,6 @@ import (
"github.com/drakkan/sftpgo/v2/internal/version"
)
-// tlsState tracks TLS connection state for a client
-type tlsState struct {
- // LoginWithMutualTLS indicates whether the user logged in using TLS certificate authentication
- LoginWithMutualTLS bool
- Version string
- Cipher string
- KEX string
-}
-
// Server implements the ftpserverlib MainDriver interface
type Server struct {
ID int
@@ -92,7 +82,7 @@ func (s *Server) GetSettings() (*ftpserver.Settings, error) {
return nil, err
}
var portRange *ftpserver.PortRange
- if s.config.PassivePortRange.Start > 0 && s.config.PassivePortRange.End >= s.config.PassivePortRange.Start {
+ if s.config.PassivePortRange.Start > 0 && s.config.PassivePortRange.End > s.config.PassivePortRange.Start {
portRange = &ftpserver.PortRange{
Start: s.config.PassivePortRange.Start,
End: s.config.PassivePortRange.End,
@@ -119,31 +109,34 @@ func (s *Server) GetSettings() (*ftpserver.Settings, error) {
return nil, fmt.Errorf("unsupported TLS mode: %d", s.binding.TLSMode)
}
- if s.binding.TLSMode > 0 && certMgr == nil {
+ if !s.binding.isTLSSessionReuseValid() {
+ return nil, fmt.Errorf("unsupported TLS reuse mode %d", s.binding.TLSSessionReuse)
+ }
+
+ if (s.binding.TLSMode > 0 || s.binding.TLSSessionReuse > 0) && certMgr == nil {
return nil, errors.New("to enable TLS you need to provide a certificate")
}
- settings := &ftpserver.Settings{
- Listener: ftpListener,
- ListenAddr: s.binding.GetAddress(),
- PublicIPResolver: s.binding.passiveIPResolver,
- ActiveTransferPortNon20: s.config.ActiveTransfersPortNon20,
- IdleTimeout: -1,
- ConnectionTimeout: 20,
- Banner: s.statusBanner,
- TLSRequired: ftpserver.TLSRequirement(s.binding.TLSMode),
- DisableSite: !s.config.EnableSite,
- DisableActiveMode: s.config.DisableActiveMode,
- EnableHASH: s.config.HASHSupport > 0,
- EnableCOMB: s.config.CombineSupport > 0,
- DefaultTransferType: ftpserver.TransferTypeBinary,
- ActiveConnectionsCheck: ftpserver.DataConnectionRequirement(s.binding.ActiveConnectionsSecurity),
- PasvConnectionsCheck: ftpserver.DataConnectionRequirement(s.binding.PassiveConnectionsSecurity),
- }
- if portRange != nil {
- settings.PassiveTransferPortRange = portRange
- }
- return settings, nil
+ return &ftpserver.Settings{
+ Listener: ftpListener,
+ ListenAddr: s.binding.GetAddress(),
+ PublicIPResolver: s.binding.passiveIPResolver,
+ PassiveTransferPortRange: portRange,
+ ActiveTransferPortNon20: s.config.ActiveTransfersPortNon20,
+ IdleTimeout: -1,
+ ConnectionTimeout: 20,
+ Banner: s.statusBanner,
+ TLSRequired: ftpserver.TLSRequirement(s.binding.TLSMode),
+ TLSSessionReuse: ftpserver.TLSSessionReuse(s.binding.TLSSessionReuse),
+ DisableSite: !s.config.EnableSite,
+ DisableActiveMode: s.config.DisableActiveMode,
+ EnableHASH: s.config.HASHSupport > 0,
+ EnableCOMB: s.config.CombineSupport > 0,
+ DefaultTransferType: ftpserver.TransferTypeBinary,
+ IgnoreASCIITranferType: s.binding.IgnoreASCIITransferType == 1,
+ ActiveConnectionsCheck: ftpserver.DataConnectionRequirement(s.binding.ActiveConnectionsSecurity),
+ PasvConnectionsCheck: ftpserver.DataConnectionRequirement(s.binding.PassiveConnectionsSecurity),
+ }, nil
}
// ClientConnected is called to send the very first welcome message
@@ -187,26 +180,27 @@ func (s *Server) ClientDisconnected(cc ftpserver.ClientContext) {
// AuthUser authenticates the user and selects an handling driver
func (s *Server) AuthUser(cc ftpserver.ClientContext, username, password string) (ftpserver.ClientDriver, error) {
loginMethod := dataprovider.LoginMethodPassword
- tlsState, ok := cc.Extra().(*tlsState)
- if ok && tlsState != nil && tlsState.LoginWithMutualTLS {
+ if verified, ok := cc.Extra().(bool); ok && verified {
loginMethod = dataprovider.LoginMethodTLSCertificateAndPwd
}
ipAddr := util.GetIPFromRemoteAddress(cc.RemoteAddr().String())
user, err := dataprovider.CheckUserAndPass(username, password, ipAddr, common.ProtocolFTP)
if err != nil {
user.Username = username
- updateLoginMetrics(&user, ipAddr, loginMethod, err, nil)
+ updateLoginMetrics(&user, ipAddr, loginMethod, err)
return nil, dataprovider.ErrInvalidCredentials
}
connection, err := s.validateUser(user, cc, loginMethod)
- defer updateLoginMetrics(&user, ipAddr, loginMethod, err, connection)
+ defer updateLoginMetrics(&user, ipAddr, loginMethod, err)
if err != nil {
return nil, err
}
setStartDirectory(user.Filters.StartDirectory, cc)
+ connection.Log(logger.LevelInfo, "User %q logged in with %q from ip %q, TLS enabled? %t",
+ user.Username, loginMethod, ipAddr, cc.HasTLSForControl())
dataprovider.UpdateLastLogin(&user)
return connection, nil
}
@@ -240,52 +234,42 @@ func (s *Server) WrapPassiveListener(listener net.Listener) (net.Listener, error
// VerifyConnection checks whether a user should be authenticated using a client certificate without prompting for a password
func (s *Server) VerifyConnection(cc ftpserver.ClientContext, user string, tlsConn *tls.Conn) (ftpserver.ClientDriver, error) {
- if tlsConn == nil {
- return nil, nil
- }
- state := tlsConn.ConnectionState()
- cc.SetExtra(&tlsState{
- LoginWithMutualTLS: false,
- Cipher: tls.CipherSuiteName(state.CipherSuite),
- Version: tls.VersionName(state.Version),
- KEX: state.CurveID.String(),
- })
if !s.binding.isMutualTLSEnabled() {
return nil, nil
}
-
- if len(state.PeerCertificates) > 0 {
- ipAddr := util.GetIPFromRemoteAddress(cc.RemoteAddr().String())
- dbUser, err := dataprovider.CheckUserBeforeTLSAuth(user, ipAddr, common.ProtocolFTP, state.PeerCertificates[0])
- if err != nil {
- dbUser.Username = user
- updateLoginMetrics(&dbUser, ipAddr, dataprovider.LoginMethodTLSCertificate, err, nil)
- return nil, dataprovider.ErrInvalidCredentials
- }
- if dbUser.IsTLSVerificationEnabled() {
- dbUser, err = dataprovider.CheckUserAndTLSCert(user, ipAddr, common.ProtocolFTP, state.PeerCertificates[0])
+ cc.SetExtra(false)
+ if tlsConn != nil {
+ state := tlsConn.ConnectionState()
+ if len(state.PeerCertificates) > 0 {
+ ipAddr := util.GetIPFromRemoteAddress(cc.RemoteAddr().String())
+ dbUser, err := dataprovider.CheckUserBeforeTLSAuth(user, ipAddr, common.ProtocolFTP, state.PeerCertificates[0])
if err != nil {
- return nil, err
+ dbUser.Username = user
+ updateLoginMetrics(&dbUser, ipAddr, dataprovider.LoginMethodTLSCertificate, err)
+ return nil, dataprovider.ErrInvalidCredentials
}
-
- cc.SetExtra(&tlsState{
- LoginWithMutualTLS: true,
- Cipher: tls.CipherSuiteName(state.CipherSuite),
- Version: tls.VersionName(state.Version),
- KEX: state.CurveID.String(),
- })
-
- if dbUser.IsLoginMethodAllowed(dataprovider.LoginMethodTLSCertificate, common.ProtocolFTP) {
- connection, err := s.validateUser(dbUser, cc, dataprovider.LoginMethodTLSCertificate)
-
- defer updateLoginMetrics(&dbUser, ipAddr, dataprovider.LoginMethodTLSCertificate, err, connection)
-
+ if dbUser.IsTLSVerificationEnabled() {
+ dbUser, err = dataprovider.CheckUserAndTLSCert(user, ipAddr, common.ProtocolFTP, state.PeerCertificates[0])
if err != nil {
return nil, err
}
- setStartDirectory(dbUser.Filters.StartDirectory, cc)
- dataprovider.UpdateLastLogin(&dbUser)
- return connection, nil
+
+ cc.SetExtra(true)
+
+ if dbUser.IsLoginMethodAllowed(dataprovider.LoginMethodTLSCertificate, common.ProtocolFTP) {
+ connection, err := s.validateUser(dbUser, cc, dataprovider.LoginMethodTLSCertificate)
+
+ defer updateLoginMetrics(&dbUser, ipAddr, dataprovider.LoginMethodTLSCertificate, err)
+
+ if err != nil {
+ return nil, err
+ }
+ setStartDirectory(dbUser.Filters.StartDirectory, cc)
+ connection.Log(logger.LevelInfo, "User id: %d, logged in with FTP using a TLS certificate, username: %q, home_dir: %q remote addr: %q",
+ dbUser.ID, dbUser.Username, dbUser.HomeDir, ipAddr)
+ dataprovider.UpdateLastLogin(&dbUser)
+ return connection, nil
+ }
}
}
}
@@ -311,7 +295,9 @@ func (s *Server) buildTLSConfig() {
s.binding.GetAddress(), s.binding.ciphers, certID)
if s.binding.isMutualTLSEnabled() {
s.tlsConfig.ClientCAs = certMgr.GetRootCAs()
- s.tlsConfig.VerifyConnection = s.verifyTLSConnection
+ if s.binding.TLSSessionReuse != int(ftpserver.TLSSessionReuseRequired) {
+ s.tlsConfig.VerifyConnection = s.verifyTLSConnection
+ }
switch s.binding.ClientAuthType {
case 1:
s.tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
@@ -375,7 +361,7 @@ func (s *Server) validateUser(user dataprovider.User, cc ftpserver.ClientContext
user.Username, user.HomeDir)
return nil, fmt.Errorf("cannot login user with invalid home dir: %q", user.HomeDir)
}
- if slices.Contains(user.Filters.DeniedProtocols, common.ProtocolFTP) {
+ if util.Contains(user.Filters.DeniedProtocols, common.ProtocolFTP) {
logger.Info(logSender, connectionID, "cannot login user %q, protocol FTP is not allowed", user.Username)
return nil, fmt.Errorf("protocol FTP is not allowed for user %q", user.Username)
}
@@ -430,15 +416,9 @@ func setStartDirectory(startDirectory string, cc ftpserver.ClientContext) {
cc.SetPath(startDirectory)
}
-func updateLoginMetrics(user *dataprovider.User, ip, loginMethod string, err error, c *Connection) {
+func updateLoginMetrics(user *dataprovider.User, ip, loginMethod string, err error) {
metric.AddLoginAttempt(loginMethod)
if err == nil {
- info := ""
- if tlsState, ok := c.clientContext.Extra().(*tlsState); ok && tlsState != nil {
- info = fmt.Sprintf("%s - %s - %s", tlsState.Version, tlsState.Cipher, tlsState.KEX)
- }
- logger.LoginLog(user.Username, ip, loginMethod, common.ProtocolFTP, c.ID, c.GetClientVersion(),
- c.clientContext.HasTLSForControl(), info)
plugin.Handler.NotifyLogEvent(notifier.LogEventTypeLoginOK, common.ProtocolFTP, user.Username, ip, "", nil)
common.DelayLogin(nil)
} else if err != common.ErrInternalFailure {
diff --git a/internal/ftpd/transfer.go b/internal/ftpd/transfer.go
index 071f8b1e..ed0ce660 100644
--- a/internal/ftpd/transfer.go
+++ b/internal/ftpd/transfer.go
@@ -136,7 +136,7 @@ func (t *transfer) closeIO() error {
} else if t.reader != nil {
err = t.reader.Close()
if metadater, ok := t.reader.(vfs.Metadater); ok {
- t.SetMetadata(metadater.Metadata())
+ t.BaseTransfer.SetMetadata(metadater.Metadata())
}
}
return err
diff --git a/internal/httpd/api_admin.go b/internal/httpd/api_admin.go
index 2fd093a0..2a8c7ec6 100644
--- a/internal/httpd/api_admin.go
+++ b/internal/httpd/api_admin.go
@@ -21,10 +21,10 @@ import (
"net/http"
"net/url"
+ "github.com/go-chi/jwtauth/v5"
"github.com/go-chi/render"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/smtp"
"github.com/drakkan/sftpgo/v2/internal/util"
)
@@ -68,7 +68,7 @@ func renderAdmin(w http.ResponseWriter, r *http.Request, username string, status
func addAdmin(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -90,7 +90,7 @@ func addAdmin(w http.ResponseWriter, r *http.Request) {
func disableAdmin2FA(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -138,7 +138,7 @@ func updateAdmin(w http.ResponseWriter, r *http.Request) {
return
}
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -182,7 +182,7 @@ func updateAdmin(w http.ResponseWriter, r *http.Request) {
func deleteAdmin(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
username := getURLParam(r, "username")
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -202,7 +202,7 @@ func deleteAdmin(w http.ResponseWriter, r *http.Request) {
func getAdminProfile(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -224,7 +224,7 @@ func getAdminProfile(w http.ResponseWriter, r *http.Request) {
func updateAdminProfile(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -317,7 +317,7 @@ func doChangeAdminPassword(r *http.Request, currentPassword, newPassword, confir
util.I18nErrorChangePwdNoDifferent,
)
}
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil {
return util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken)
}
@@ -335,3 +335,14 @@ func doChangeAdminPassword(r *http.Request, currentPassword, newPassword, confir
return dataprovider.UpdateAdmin(&admin, dataprovider.ActionExecutorSelf, util.GetIPFromRemoteAddress(r.RemoteAddr), claims.Role)
}
+
+func getTokenClaims(r *http.Request) (jwtTokenClaims, error) {
+ tokenClaims := jwtTokenClaims{}
+ _, claims, err := jwtauth.FromContext(r.Context())
+ if err != nil {
+ return tokenClaims, err
+ }
+ tokenClaims.Decode(claims)
+
+ return tokenClaims, nil
+}
diff --git a/internal/httpd/api_configs.go b/internal/httpd/api_configs.go
index 520f81a9..399c7ad2 100644
--- a/internal/httpd/api_configs.go
+++ b/internal/httpd/api_configs.go
@@ -66,7 +66,7 @@ func testSMTPConfig(w http.ResponseWriter, r *http.Request) {
}
}
if req.AuthType == 3 {
- if err := req.OAuth2.Validate(); err != nil {
+ if err := req.Config.OAuth2.Validate(); err != nil {
sendAPIResponse(w, r, err, "", http.StatusBadRequest)
return
}
@@ -85,7 +85,7 @@ type oauth2TokenRequest struct {
BaseRedirectURL string `json:"base_redirect_url"`
}
-func (s *httpdServer) handleSMTPOAuth2TokenRequestPost(w http.ResponseWriter, r *http.Request) {
+func handleSMTPOAuth2TokenRequestPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
var req oauth2TokenRequest
@@ -106,20 +106,20 @@ func (s *httpdServer) handleSMTPOAuth2TokenRequestPost(w http.ResponseWriter, r
}
configs.SetNilsToEmpty()
if err := configs.SMTP.TryDecrypt(); err == nil {
- req.ClientSecret = configs.SMTP.OAuth2.ClientSecret.GetPayload()
+ req.OAuth2Config.ClientSecret = configs.SMTP.OAuth2.ClientSecret.GetPayload()
}
}
- cfg := req.GetOAuth2()
+ cfg := req.OAuth2Config.GetOAuth2()
cfg.RedirectURL = req.BaseRedirectURL + webOAuth2RedirectPath
clientSecret := kms.NewPlainSecret(cfg.ClientSecret)
clientSecret.SetAdditionalData(xid.New().String())
pendingAuth := newOAuth2PendingAuth(req.Provider, cfg.RedirectURL, cfg.ClientID, clientSecret)
oauth2Mgr.addPendingAuth(pendingAuth)
- stateToken := createOAuth2Token(s.csrfTokenAuth, pendingAuth.State, util.GetIPFromRemoteAddress(r.RemoteAddr))
+ stateToken := createOAuth2Token(pendingAuth.State, util.GetIPFromRemoteAddress(r.RemoteAddr))
if stateToken == "" {
sendAPIResponse(w, r, nil, "unable to create state token", http.StatusInternalServerError)
return
}
- u := cfg.AuthCodeURL(stateToken, oauth2.AccessTypeOffline, oauth2.S256ChallengeOption(pendingAuth.Verifier))
+ u := cfg.AuthCodeURL(stateToken, oauth2.AccessTypeOffline)
sendAPIResponse(w, r, nil, u, http.StatusOK)
}
diff --git a/internal/httpd/api_eventrule.go b/internal/httpd/api_eventrule.go
index b8474af4..a4daaaa6 100644
--- a/internal/httpd/api_eventrule.go
+++ b/internal/httpd/api_eventrule.go
@@ -24,7 +24,6 @@ import (
"github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/util"
)
@@ -43,7 +42,7 @@ func getEventActions(w http.ResponseWriter, r *http.Request) {
render.JSON(w, r, actions)
}
-func renderEventAction(w http.ResponseWriter, r *http.Request, name string, claims *jwt.Claims, status int) {
+func renderEventAction(w http.ResponseWriter, r *http.Request, name string, claims *jwtTokenClaims, status int) {
action, err := dataprovider.EventActionExists(name)
if err != nil {
sendAPIResponse(w, r, err, "", getRespStatus(err))
@@ -62,19 +61,19 @@ func renderEventAction(w http.ResponseWriter, r *http.Request, name string, clai
func getEventActionByName(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
}
name := getURLParam(r, "name")
- renderEventAction(w, r, name, claims, http.StatusOK)
+ renderEventAction(w, r, name, &claims, http.StatusOK)
}
func addEventAction(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -92,12 +91,12 @@ func addEventAction(w http.ResponseWriter, r *http.Request) {
return
}
w.Header().Add("Location", fmt.Sprintf("%s/%s", eventActionsPath, url.PathEscape(action.Name)))
- renderEventAction(w, r, action.Name, claims, http.StatusCreated)
+ renderEventAction(w, r, action.Name, &claims, http.StatusCreated)
}
func updateEventAction(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -137,7 +136,7 @@ func updateEventAction(w http.ResponseWriter, r *http.Request) {
func deleteEventAction(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -166,7 +165,7 @@ func getEventRules(w http.ResponseWriter, r *http.Request) {
render.JSON(w, r, rules)
}
-func renderEventRule(w http.ResponseWriter, r *http.Request, name string, claims *jwt.Claims, status int) {
+func renderEventRule(w http.ResponseWriter, r *http.Request, name string, claims *jwtTokenClaims, status int) {
rule, err := dataprovider.EventRuleExists(name)
if err != nil {
sendAPIResponse(w, r, err, "", getRespStatus(err))
@@ -185,19 +184,19 @@ func renderEventRule(w http.ResponseWriter, r *http.Request, name string, claims
func getEventRuleByName(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
}
name := getURLParam(r, "name")
- renderEventRule(w, r, name, claims, http.StatusOK)
+ renderEventRule(w, r, name, &claims, http.StatusOK)
}
func addEventRule(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -214,12 +213,12 @@ func addEventRule(w http.ResponseWriter, r *http.Request) {
return
}
w.Header().Add("Location", fmt.Sprintf("%s/%s", eventRulesPath, url.PathEscape(rule.Name)))
- renderEventRule(w, r, rule.Name, claims, http.StatusCreated)
+ renderEventRule(w, r, rule.Name, &claims, http.StatusCreated)
}
func updateEventRule(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -250,7 +249,7 @@ func updateEventRule(w http.ResponseWriter, r *http.Request) {
func deleteEventRule(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
diff --git a/internal/httpd/api_events.go b/internal/httpd/api_events.go
index a5ad1a5c..5c218271 100644
--- a/internal/httpd/api_events.go
+++ b/internal/httpd/api_events.go
@@ -27,7 +27,6 @@ import (
"github.com/sftpgo/sdk/plugin/notifier"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/plugin"
"github.com/drakkan/sftpgo/v2/internal/util"
)
@@ -69,8 +68,8 @@ func getCommonSearchParamsFromRequest(r *http.Request) (eventsearcher.CommonSear
}
c.EndTimestamp = ts
}
- c.Username = strings.TrimSpace(r.URL.Query().Get("username"))
- c.IP = strings.TrimSpace(r.URL.Query().Get("ip"))
+ c.Username = r.URL.Query().Get("username")
+ c.IP = r.URL.Query().Get("ip")
c.InstanceIDs = getCommaSeparatedQueryParam(r, "instance_ids")
c.FromID = r.URL.Query().Get("from_id")
@@ -94,9 +93,9 @@ func getFsSearchParamsFromRequest(r *http.Request) (eventsearcher.FsEventSearch,
s.FsProvider = val
}
s.Actions = getCommaSeparatedQueryParam(r, "actions")
- s.SSHCmd = strings.TrimSpace(r.URL.Query().Get("ssh_cmd"))
- s.Bucket = strings.TrimSpace(r.URL.Query().Get("bucket"))
- s.Endpoint = strings.TrimSpace(r.URL.Query().Get("endpoint"))
+ s.SSHCmd = r.URL.Query().Get("ssh_cmd")
+ s.Bucket = r.URL.Query().Get("bucket")
+ s.Endpoint = r.URL.Query().Get("endpoint")
s.Protocols = getCommaSeparatedQueryParam(r, "protocols")
statuses := getCommaSeparatedQueryParam(r, "statuses")
for _, status := range statuses {
@@ -118,7 +117,7 @@ func getProviderSearchParamsFromRequest(r *http.Request) (eventsearcher.Provider
return s, err
}
s.Actions = getCommaSeparatedQueryParam(r, "actions")
- s.ObjectName = strings.TrimSpace(r.URL.Query().Get("object_name"))
+ s.ObjectName = r.URL.Query().Get("object_name")
s.ObjectTypes = getCommaSeparatedQueryParam(r, "object_types")
return s, nil
}
@@ -144,7 +143,7 @@ func getLogSearchParamsFromRequest(r *http.Request) (eventsearcher.LogEventSearc
func searchFsEvents(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -177,7 +176,7 @@ func searchFsEvents(w http.ResponseWriter, r *http.Request) {
func searchProviderEvents(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -212,7 +211,7 @@ func searchProviderEvents(w http.ResponseWriter, r *http.Request) {
func searchLogEvents(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
diff --git a/internal/httpd/api_folder.go b/internal/httpd/api_folder.go
index c46d4ab3..debc8483 100644
--- a/internal/httpd/api_folder.go
+++ b/internal/httpd/api_folder.go
@@ -23,7 +23,6 @@ import (
"github.com/go-chi/render"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/util"
"github.com/drakkan/sftpgo/v2/internal/vfs"
)
@@ -46,7 +45,7 @@ func getFolders(w http.ResponseWriter, r *http.Request) {
func addFolder(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -63,12 +62,12 @@ func addFolder(w http.ResponseWriter, r *http.Request) {
return
}
w.Header().Add("Location", fmt.Sprintf("%s/%s", folderPath, url.PathEscape(folder.Name)))
- renderFolder(w, r, folder.Name, claims, http.StatusCreated)
+ renderFolder(w, r, folder.Name, &claims, http.StatusCreated)
}
func updateFolder(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -101,7 +100,7 @@ func updateFolder(w http.ResponseWriter, r *http.Request) {
sendAPIResponse(w, r, nil, "Folder updated", http.StatusOK)
}
-func renderFolder(w http.ResponseWriter, r *http.Request, name string, claims *jwt.Claims, status int) {
+func renderFolder(w http.ResponseWriter, r *http.Request, name string, claims *jwtTokenClaims, status int) {
folder, err := dataprovider.GetFolderByName(name)
if err != nil {
sendAPIResponse(w, r, err, "", getRespStatus(err))
@@ -120,18 +119,18 @@ func renderFolder(w http.ResponseWriter, r *http.Request, name string, claims *j
func getFolderByName(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
}
name := getURLParam(r, "name")
- renderFolder(w, r, name, claims, http.StatusOK)
+ renderFolder(w, r, name, &claims, http.StatusOK)
}
func deleteFolder(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
diff --git a/internal/httpd/api_group.go b/internal/httpd/api_group.go
index beae9ad2..125319d5 100644
--- a/internal/httpd/api_group.go
+++ b/internal/httpd/api_group.go
@@ -23,7 +23,6 @@ import (
"github.com/go-chi/render"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/util"
)
@@ -45,7 +44,7 @@ func getGroups(w http.ResponseWriter, r *http.Request) {
func addGroup(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -62,12 +61,12 @@ func addGroup(w http.ResponseWriter, r *http.Request) {
return
}
w.Header().Add("Location", fmt.Sprintf("%s/%s", groupPath, url.PathEscape(group.Name)))
- renderGroup(w, r, group.Name, claims, http.StatusCreated)
+ renderGroup(w, r, group.Name, &claims, http.StatusCreated)
}
func updateGroup(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -99,7 +98,7 @@ func updateGroup(w http.ResponseWriter, r *http.Request) {
sendAPIResponse(w, r, nil, "Group updated", http.StatusOK)
}
-func renderGroup(w http.ResponseWriter, r *http.Request, name string, claims *jwt.Claims, status int) {
+func renderGroup(w http.ResponseWriter, r *http.Request, name string, claims *jwtTokenClaims, status int) {
group, err := dataprovider.GroupExists(name)
if err != nil {
sendAPIResponse(w, r, err, "", getRespStatus(err))
@@ -118,18 +117,18 @@ func renderGroup(w http.ResponseWriter, r *http.Request, name string, claims *jw
func getGroupByName(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
}
name := getURLParam(r, "name")
- renderGroup(w, r, name, claims, http.StatusOK)
+ renderGroup(w, r, name, &claims, http.StatusOK)
}
func deleteGroup(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
diff --git a/internal/httpd/api_http_user.go b/internal/httpd/api_http_user.go
index 45bbd52f..26bc0063 100644
--- a/internal/httpd/api_http_user.go
+++ b/internal/httpd/api_http_user.go
@@ -31,13 +31,12 @@ import (
"github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/logger"
"github.com/drakkan/sftpgo/v2/internal/util"
)
func getUserConnection(w http.ResponseWriter, r *http.Request) (*Connection, error) {
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return nil, fmt.Errorf("invalid token claims %w", err)
@@ -50,12 +49,15 @@ func getUserConnection(w http.ResponseWriter, r *http.Request) (*Connection, err
connID := xid.New().String()
protocol := getProtocolFromRequest(r)
connectionID := fmt.Sprintf("%v_%v", protocol, connID)
- if err := checkHTTPClientUser(&user, r, connectionID, false, false); err != nil {
+ if err := checkHTTPClientUser(&user, r, connectionID, false); err != nil {
sendAPIResponse(w, r, err, http.StatusText(http.StatusForbidden), http.StatusForbidden)
return nil, err
}
- baseConn := common.NewBaseConnection(connID, protocol, util.GetHTTPLocalAddress(r), r.RemoteAddr, user)
- connection := newConnection(baseConn, w, r)
+ connection := &Connection{
+ BaseConnection: common.NewBaseConnection(connID, protocol, util.GetHTTPLocalAddress(r),
+ r.RemoteAddr, user),
+ request: r,
+ }
if err = common.Connections.Add(connection); err != nil {
sendAPIResponse(w, r, err, "Unable to add connection", http.StatusTooManyRequests)
return connection, err
@@ -315,13 +317,6 @@ func uploadUserFiles(w http.ResponseWriter, r *http.Request) {
}
defer common.Connections.Remove(connection.GetID())
- if err := common.Connections.IsNewTransferAllowed(connection.User.Username); err != nil {
- connection.Log(logger.LevelInfo, "denying file write due to number of transfer limits")
- sendAPIResponse(w, r, err, "Denying file write due to transfer count limits",
- http.StatusConflict)
- return
- }
-
transferQuota := connection.GetTransferQuota()
if !transferQuota.HasUploadSpace() {
connection.Log(logger.LevelInfo, "denying file write due to transfer quota limits")
@@ -458,7 +453,7 @@ func getUserFilesAsZipStream(w http.ResponseWriter, r *http.Request) {
func getUserProfile(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -474,16 +469,15 @@ func getUserProfile(w http.ResponseWriter, r *http.Request) {
Description: user.Description,
AllowAPIKeyAuth: user.Filters.AllowAPIKeyAuth,
},
- AdditionalEmails: user.Filters.AdditionalEmails,
- PublicKeys: user.PublicKeys,
- TLSCerts: user.Filters.TLSCerts,
+ PublicKeys: user.PublicKeys,
+ TLSCerts: user.Filters.TLSCerts,
}
render.JSON(w, r, resp)
}
func updateUserProfile(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -514,7 +508,6 @@ func updateUserProfile(w http.ResponseWriter, r *http.Request) {
}
if userMerged.CanChangeInfo() {
user.Email = req.Email
- user.Filters.AdditionalEmails = req.AdditionalEmails
user.Description = req.Description
}
if err := dataprovider.UpdateUser(&user, dataprovider.ActionExecutorSelf, util.GetIPFromRemoteAddress(r.RemoteAddr), user.Role); err != nil {
@@ -558,7 +551,7 @@ func doChangeUserPassword(r *http.Request, currentPassword, newPassword, confirm
util.I18nErrorChangePwdNoDifferent,
)
}
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
return util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken)
}
diff --git a/internal/httpd/api_iplist.go b/internal/httpd/api_iplist.go
index d74b68d8..5c1de975 100644
--- a/internal/httpd/api_iplist.go
+++ b/internal/httpd/api_iplist.go
@@ -25,7 +25,6 @@ import (
"github.com/go-chi/render"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/util"
)
@@ -69,7 +68,7 @@ func getIPListEntry(w http.ResponseWriter, r *http.Request) {
func addIPListEntry(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -92,7 +91,7 @@ func addIPListEntry(w http.ResponseWriter, r *http.Request) {
func updateIPListEntry(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -126,7 +125,7 @@ func updateIPListEntry(w http.ResponseWriter, r *http.Request) {
func deleteIPListEntry(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
diff --git a/internal/httpd/api_keys.go b/internal/httpd/api_keys.go
index a9a3bcb2..d95d88de 100644
--- a/internal/httpd/api_keys.go
+++ b/internal/httpd/api_keys.go
@@ -23,7 +23,6 @@ import (
"github.com/go-chi/render"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/util"
)
@@ -57,7 +56,7 @@ func getAPIKeyByID(w http.ResponseWriter, r *http.Request) {
func addAPIKey(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -88,7 +87,7 @@ func addAPIKey(w http.ResponseWriter, r *http.Request) {
func updateAPIKey(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -120,7 +119,7 @@ func updateAPIKey(w http.ResponseWriter, r *http.Request) {
func deleteAPIKey(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
keyID := getURLParam(r, "id")
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
diff --git a/internal/httpd/api_maintenance.go b/internal/httpd/api_maintenance.go
index 560c702e..10347de8 100644
--- a/internal/httpd/api_maintenance.go
+++ b/internal/httpd/api_maintenance.go
@@ -29,7 +29,6 @@ import (
"github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/logger"
"github.com/drakkan/sftpgo/v2/internal/util"
"github.com/drakkan/sftpgo/v2/internal/vfs"
@@ -116,7 +115,7 @@ func dumpData(w http.ResponseWriter, r *http.Request) {
func loadDataFromRequest(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, MaxRestoreSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -144,7 +143,7 @@ func loadDataFromRequest(w http.ResponseWriter, r *http.Request) {
func loadData(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -552,10 +551,9 @@ func RestoreUsers(users []dataprovider.User, inputFile string, mode, scanQuota i
return fmt.Errorf("unable to restore user %q: %w", user.Username, err)
}
if scanQuota == 1 || (scanQuota == 2 && user.HasQuotaRestrictions()) {
- user, err = dataprovider.GetUserWithGroupSettings(user.Username, "")
- if err == nil && common.QuotaScans.AddUserQuotaScan(user.Username, user.Role) {
+ if common.QuotaScans.AddUserQuotaScan(user.Username, user.Role) {
logger.Debug(logSender, "", "starting quota scan for restored user: %q", user.Username)
- go doUserQuotaScan(&user) //nolint:errcheck
+ go doUserQuotaScan(user) //nolint:errcheck
}
}
}
diff --git a/internal/httpd/api_mfa.go b/internal/httpd/api_mfa.go
index 73df7593..0b7e282e 100644
--- a/internal/httpd/api_mfa.go
+++ b/internal/httpd/api_mfa.go
@@ -20,14 +20,12 @@ import (
"fmt"
"io"
"net/http"
- "slices"
"strconv"
"strings"
"github.com/go-chi/render"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/kms"
"github.com/drakkan/sftpgo/v2/internal/mfa"
"github.com/drakkan/sftpgo/v2/internal/util"
@@ -67,13 +65,13 @@ func getTOTPConfigs(w http.ResponseWriter, r *http.Request) {
func generateTOTPSecret(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
}
var accountName string
- if hasUserAudience(claims) {
+ if claims.hasUserAudience() {
accountName = fmt.Sprintf("User %q", claims.Username)
} else {
accountName = fmt.Sprintf("Admin %q", claims.Username)
@@ -114,7 +112,7 @@ func getQRCode(w http.ResponseWriter, r *http.Request) {
func saveTOTPConfig(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -125,7 +123,7 @@ func saveTOTPConfig(w http.ResponseWriter, r *http.Request) {
recoveryCodes = append(recoveryCodes, dataprovider.RecoveryCode{Secret: kms.NewPlainSecret(code)})
}
baseURL := webBaseClientPath
- if hasUserAudience(claims) {
+ if claims.hasUserAudience() {
if err := saveUserTOTPConfig(claims.Username, r, recoveryCodes); err != nil {
sendAPIResponse(w, r, err, "", getRespStatus(err))
return
@@ -140,7 +138,8 @@ func saveTOTPConfig(w http.ResponseWriter, r *http.Request) {
if claims.MustSetTwoFactorAuth {
// force logout
defer func() {
- removeCookie(w, r, baseURL)
+ c := jwtTokenClaims{}
+ c.removeCookie(w, r, baseURL)
}()
}
@@ -165,14 +164,14 @@ func validateTOTPPasscode(w http.ResponseWriter, r *http.Request) {
func getRecoveryCodes(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
}
recoveryCodes := make([]recoveryCode, 0, 12)
var accountRecoveryCodes []dataprovider.RecoveryCode
- if hasUserAudience(claims) {
+ if claims.hasUserAudience() {
user, err := dataprovider.UserExists(claims.Username, "")
if err != nil {
sendAPIResponse(w, r, err, "", getRespStatus(err))
@@ -211,7 +210,7 @@ func getRecoveryCodes(w http.ResponseWriter, r *http.Request) {
func generateRecoveryCodes(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -223,7 +222,7 @@ func generateRecoveryCodes(w http.ResponseWriter, r *http.Request) {
recoveryCodes = append(recoveryCodes, code)
accountRecoveryCodes = append(accountRecoveryCodes, dataprovider.RecoveryCode{Secret: kms.NewPlainSecret(code)})
}
- if hasUserAudience(claims) {
+ if claims.hasUserAudience() {
user, err := dataprovider.UserExists(claims.Username, "")
if err != nil {
sendAPIResponse(w, r, err, "", getRespStatus(err))
@@ -277,7 +276,7 @@ func saveUserTOTPConfig(username string, r *http.Request, recoveryCodes []datapr
return util.NewValidationError("two-factor authentication must be enabled")
}
for _, p := range userMerged.Filters.TwoFactorAuthProtocols {
- if !slices.Contains(user.Filters.TOTPConfig.Protocols, p) {
+ if !util.Contains(user.Filters.TOTPConfig.Protocols, p) {
return util.NewValidationError(fmt.Sprintf("totp: the following protocols are required: %q",
strings.Join(userMerged.Filters.TwoFactorAuthProtocols, ", ")))
}
diff --git a/internal/httpd/api_quota.go b/internal/httpd/api_quota.go
index db339e39..de6ff8bb 100644
--- a/internal/httpd/api_quota.go
+++ b/internal/httpd/api_quota.go
@@ -23,7 +23,6 @@ import (
"github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/logger"
"github.com/drakkan/sftpgo/v2/internal/vfs"
)
@@ -45,7 +44,7 @@ type transferQuotaUsage struct {
func getUsersQuotaScans(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -92,7 +91,7 @@ func startFolderQuotaScan(w http.ResponseWriter, r *http.Request) {
func updateUserTransferQuotaUsage(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -133,7 +132,7 @@ func updateUserTransferQuotaUsage(w http.ResponseWriter, r *http.Request) {
}
func doUpdateUserQuotaUsage(w http.ResponseWriter, r *http.Request, username string, usage quotaUsage) {
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -205,7 +204,7 @@ func doStartUserQuotaScan(w http.ResponseWriter, r *http.Request, username strin
sendAPIResponse(w, r, nil, "Quota tracking is disabled!", http.StatusForbidden)
return
}
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -220,7 +219,7 @@ func doStartUserQuotaScan(w http.ResponseWriter, r *http.Request, username strin
http.StatusConflict)
return
}
- go doUserQuotaScan(&user) //nolint:errcheck
+ go doUserQuotaScan(user) //nolint:errcheck
sendAPIResponse(w, r, err, "Scan started", http.StatusAccepted)
}
@@ -243,14 +242,14 @@ func doStartFolderQuotaScan(w http.ResponseWriter, r *http.Request, name string)
sendAPIResponse(w, r, err, "Scan started", http.StatusAccepted)
}
-func doUserQuotaScan(user *dataprovider.User) error {
+func doUserQuotaScan(user dataprovider.User) error {
defer common.QuotaScans.RemoveUserQuotaScan(user.Username)
numFiles, size, err := user.ScanQuota()
if err != nil {
logger.Warn(logSender, "", "error scanning user quota %q: %v", user.Username, err)
return err
}
- err = dataprovider.UpdateUserQuota(user, numFiles, size, true)
+ err = dataprovider.UpdateUserQuota(&user, numFiles, size, true)
logger.Debug(logSender, "", "user quota scanned, user: %q, error: %v", user.Username, err)
return err
}
diff --git a/internal/httpd/api_retention.go b/internal/httpd/api_retention.go
index 1502a327..a47a1119 100644
--- a/internal/httpd/api_retention.go
+++ b/internal/httpd/api_retention.go
@@ -15,20 +15,67 @@
package httpd
import (
+ "fmt"
"net/http"
"github.com/go-chi/render"
"github.com/drakkan/sftpgo/v2/internal/common"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
+ "github.com/drakkan/sftpgo/v2/internal/dataprovider"
)
func getRetentionChecks(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
}
render.JSON(w, r, common.RetentionChecks.Get(claims.Role))
}
+
+func startRetentionCheck(w http.ResponseWriter, r *http.Request) {
+ r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
+ claims, err := getTokenClaims(r)
+ if err != nil || claims.Username == "" {
+ sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
+ return
+ }
+ username := getURLParam(r, "username")
+ user, err := dataprovider.GetUserWithGroupSettings(username, claims.Role)
+ if err != nil {
+ sendAPIResponse(w, r, err, "", getRespStatus(err))
+ return
+ }
+ var check common.RetentionCheck
+
+ err = render.DecodeJSON(r.Body, &check.Folders)
+ if err != nil {
+ sendAPIResponse(w, r, err, "", http.StatusBadRequest)
+ return
+ }
+
+ check.Notifications = getCommaSeparatedQueryParam(r, "notifications")
+ for _, notification := range check.Notifications {
+ if notification == common.RetentionCheckNotificationEmail {
+ admin, err := dataprovider.AdminExists(claims.Username)
+ if err != nil {
+ sendAPIResponse(w, r, err, "", getRespStatus(err))
+ return
+ }
+ check.Email = admin.Email
+ }
+ }
+ if err := check.Validate(); err != nil {
+ sendAPIResponse(w, r, err, "Invalid retention check", http.StatusBadRequest)
+ return
+ }
+ c := common.RetentionChecks.Add(check, &user)
+ if c == nil {
+ sendAPIResponse(w, r, err, fmt.Sprintf("Another check is already in progress for user %q", username),
+ http.StatusConflict)
+ return
+ }
+ go c.Start() //nolint:errcheck
+ sendAPIResponse(w, r, err, "Check started", http.StatusAccepted)
+}
diff --git a/internal/httpd/api_role.go b/internal/httpd/api_role.go
index d8840155..6e9a23ee 100644
--- a/internal/httpd/api_role.go
+++ b/internal/httpd/api_role.go
@@ -23,7 +23,6 @@ import (
"github.com/go-chi/render"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/util"
)
@@ -45,7 +44,7 @@ func getRoles(w http.ResponseWriter, r *http.Request) {
func addRole(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -68,7 +67,7 @@ func addRole(w http.ResponseWriter, r *http.Request) {
func updateRole(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -120,7 +119,7 @@ func getRoleByName(w http.ResponseWriter, r *http.Request) {
func deleteRole(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
diff --git a/internal/httpd/api_shares.go b/internal/httpd/api_shares.go
index 1ea1542e..6704a515 100644
--- a/internal/httpd/api_shares.go
+++ b/internal/httpd/api_shares.go
@@ -22,24 +22,23 @@ import (
"net/url"
"os"
"path"
- "slices"
"strings"
"time"
+ "github.com/go-chi/jwtauth/v5"
"github.com/go-chi/render"
"github.com/rs/xid"
"github.com/sftpgo/sdk"
"github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/logger"
"github.com/drakkan/sftpgo/v2/internal/util"
)
func getShares(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -59,7 +58,7 @@ func getShares(w http.ResponseWriter, r *http.Request) {
func getShareByID(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -77,7 +76,7 @@ func getShareByID(w http.ResponseWriter, r *http.Request) {
func addShare(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -108,7 +107,7 @@ func addShare(w http.ResponseWriter, r *http.Request) {
share.Name = share.ShareID
}
if share.Password == "" {
- if slices.Contains(claims.Permissions, sdk.WebClientShareNoPasswordDisabled) {
+ if util.Contains(claims.Permissions, sdk.WebClientShareNoPasswordDisabled) {
sendAPIResponse(w, r, nil, "You are not authorized to share files/folders without a password",
http.StatusForbidden)
return
@@ -126,7 +125,7 @@ func addShare(w http.ResponseWriter, r *http.Request) {
func updateShare(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -156,7 +155,7 @@ func updateShare(w http.ResponseWriter, r *http.Request) {
updatedShare.Password = share.Password
}
if updatedShare.Password == "" {
- if slices.Contains(claims.Permissions, sdk.WebClientShareNoPasswordDisabled) {
+ if util.Contains(claims.Permissions, sdk.WebClientShareNoPasswordDisabled) {
sendAPIResponse(w, r, nil, "You are not authorized to share files/folders without a password",
http.StatusForbidden)
return
@@ -177,7 +176,7 @@ func updateShare(w http.ResponseWriter, r *http.Request) {
func deleteShare(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
shareID := getURLParam(r, "id")
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -380,12 +379,6 @@ func (s *httpdServer) uploadFilesToShare(w http.ResponseWriter, r *http.Request)
if err != nil {
return
}
- if err := common.Connections.IsNewTransferAllowed(connection.User.Username); err != nil {
- connection.Log(logger.LevelInfo, "denying file write due to number of transfer limits")
- sendAPIResponse(w, r, err, "Denying file write due to transfer count limits",
- http.StatusConflict)
- return
- }
transferQuota := connection.GetTransferQuota()
if !transferQuota.HasUploadSpace() {
@@ -432,41 +425,36 @@ func (s *httpdServer) uploadFilesToShare(w http.ResponseWriter, r *http.Request)
}
}
-func (s *httpdServer) getShareClaims(r *http.Request, shareID string) (context.Context, *jwt.Claims, error) {
- token, err := jwt.VerifyRequest(s.tokenAuth, r, jwt.TokenFromCookie)
- if err != nil || token == nil {
- return nil, nil, errInvalidToken
- }
- tokenString := jwt.TokenFromCookie(r)
- if tokenString == "" || invalidatedJWTTokens.Get(tokenString) {
- return nil, nil, errInvalidToken
- }
- if !token.Audience.Contains(tokenAudienceWebShare) {
- logger.Debug(logSender, "", "invalid token audience for share %q", shareID)
- return nil, nil, errInvalidToken
- }
- ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := validateIPForToken(token, ipAddr); err != nil {
- logger.Debug(logSender, "", "token for share %q is not valid for the ip address %q", shareID, ipAddr)
- return nil, nil, err
- }
- if token.Username != shareID {
- logger.Debug(logSender, "", "token not valid for share %q", shareID)
- return nil, nil, errInvalidToken
- }
- ctx := jwt.NewContext(r.Context(), token, nil)
- return ctx, token, nil
-}
-
func (s *httpdServer) checkWebClientShareCredentials(w http.ResponseWriter, r *http.Request, share *dataprovider.Share) error {
doRedirect := func() {
redirectURL := path.Join(webClientPubSharesPath, share.ShareID, fmt.Sprintf("login?next=%s", url.QueryEscape(r.RequestURI)))
http.Redirect(w, r, redirectURL, http.StatusFound)
}
- if _, _, err := s.getShareClaims(r, share.ShareID); err != nil {
+ token, err := jwtauth.VerifyRequest(s.tokenAuth, r, jwtauth.TokenFromCookie)
+ if err != nil || token == nil {
doRedirect()
- return err
+ return errInvalidToken
+ }
+ if !util.Contains(token.Audience(), tokenAudienceWebShare) {
+ logger.Debug(logSender, "", "invalid token audience for share %q", share.ShareID)
+ doRedirect()
+ return errInvalidToken
+ }
+ if tokenValidationMode != tokenValidationNoIPMatch {
+ ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
+ if !util.Contains(token.Audience(), ipAddr) {
+ logger.Debug(logSender, "", "token for share %q is not valid for the ip address %q", share.ShareID, ipAddr)
+ doRedirect()
+ return errInvalidToken
+ }
+ }
+ ctx := jwtauth.NewContext(r.Context(), token, nil)
+ claims, err := getTokenClaims(r.WithContext(ctx))
+ if err != nil || claims.Username != share.ShareID {
+ logger.Debug(logSender, "", "token not valid for share %q", share.ShareID)
+ doRedirect()
+ return errInvalidToken
}
return nil
}
@@ -492,7 +480,7 @@ func (s *httpdServer) checkPublicShare(w http.ResponseWriter, r *http.Request, v
renderError(err, "", statusCode)
return share, nil, err
}
- if !slices.Contains(validScopes, share.Scope) {
+ if !util.Contains(validScopes, share.Scope) {
err := errors.New("invalid share scope")
renderError(util.NewI18nError(err, util.I18nErrorShareScope), "", http.StatusForbidden)
return share, nil, err
@@ -506,6 +494,7 @@ func (s *httpdServer) checkPublicShare(w http.ResponseWriter, r *http.Request, v
if share.Password != "" {
if isWebClient {
if err := s.checkWebClientShareCredentials(w, r, &share); err != nil {
+ handleDefenderEventLoginFailed(ipAddr, err) //nolint:errcheck
return share, nil, dataprovider.ErrInvalidCredentials
}
} else {
@@ -531,8 +520,11 @@ func (s *httpdServer) checkPublicShare(w http.ResponseWriter, r *http.Request, v
return share, nil, err
}
connID := xid.New().String()
- baseConn := common.NewBaseConnection(connID, common.ProtocolHTTPShare, util.GetHTTPLocalAddress(r), r.RemoteAddr, user)
- connection := newConnection(baseConn, w, r)
+ connection := &Connection{
+ BaseConnection: common.NewBaseConnection(connID, common.ProtocolHTTPShare, util.GetHTTPLocalAddress(r),
+ r.RemoteAddr, user),
+ request: r,
+ }
return share, connection, nil
}
@@ -545,7 +537,7 @@ func getUserForShare(share dataprovider.Share) (dataprovider.User, error) {
if !user.CanManageShares() {
return user, util.NewI18nError(util.NewRecordNotFoundError("this share does not exist"), util.I18nError404Message)
}
- if share.Password == "" && slices.Contains(user.Filters.WebClient, sdk.WebClientShareNoPasswordDisabled) {
+ if share.Password == "" && util.Contains(user.Filters.WebClient, sdk.WebClientShareNoPasswordDisabled) {
return user, util.NewI18nError(
fmt.Errorf("sharing without a password was disabled: %w", os.ErrPermission),
util.I18nError403Message,
diff --git a/internal/httpd/api_user.go b/internal/httpd/api_user.go
index 4af45f30..7b55082a 100644
--- a/internal/httpd/api_user.go
+++ b/internal/httpd/api_user.go
@@ -27,7 +27,6 @@ import (
"github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/logger"
"github.com/drakkan/sftpgo/v2/internal/smtp"
"github.com/drakkan/sftpgo/v2/internal/util"
@@ -40,7 +39,7 @@ func getUsers(w http.ResponseWriter, r *http.Request) {
if err != nil {
return
}
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -56,16 +55,16 @@ func getUsers(w http.ResponseWriter, r *http.Request) {
func getUserByUsername(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
}
username := getURLParam(r, "username")
- renderUser(w, r, username, claims, http.StatusOK)
+ renderUser(w, r, username, &claims, http.StatusOK)
}
-func renderUser(w http.ResponseWriter, r *http.Request, username string, claims *jwt.Claims, status int) {
+func renderUser(w http.ResponseWriter, r *http.Request, username string, claims *jwtTokenClaims, status int) {
user, err := dataprovider.UserExists(username, claims.Role)
if err != nil {
sendAPIResponse(w, r, err, "", getRespStatus(err))
@@ -85,7 +84,7 @@ func renderUser(w http.ResponseWriter, r *http.Request, username string, claims
func addUser(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -118,12 +117,12 @@ func addUser(w http.ResponseWriter, r *http.Request) {
return
}
w.Header().Add("Location", fmt.Sprintf("%s/%s", userPath, url.PathEscape(user.Username)))
- renderUser(w, r, user.Username, claims, http.StatusCreated)
+ renderUser(w, r, user.Username, &claims, http.StatusCreated)
}
func disableUser2FA(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -151,7 +150,7 @@ func disableUser2FA(w http.ResponseWriter, r *http.Request) {
func updateUser(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -203,7 +202,7 @@ func updateUser(w http.ResponseWriter, r *http.Request) {
func deleteUser(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -265,9 +264,7 @@ func disconnectUser(username, admin, role string) {
logger.Warn(logSender, "", "unable to disconnect user %q, error getting node %q: %v", username, stat.Node, err)
continue
}
- perms := []string{dataprovider.PermAdminCloseConnections}
- uri := fmt.Sprintf("%s/%s", activeConnectionsPath, stat.ConnectionID)
- if err := n.SendDeleteRequest(admin, role, uri, perms); err != nil {
+ if err := n.SendDeleteRequest(admin, role, fmt.Sprintf("%s/%s", activeConnectionsPath, stat.ConnectionID)); err != nil {
logger.Warn(logSender, "", "unable to disconnect user %q from node %q, error: %v", username, n.Name, err)
}
}
@@ -281,9 +278,6 @@ func updateEncryptedSecrets(fsConfig *vfs.Filesystem, currentFsConfig *vfs.Files
if fsConfig.S3Config.AccessSecret.IsNotPlainAndNotEmpty() {
fsConfig.S3Config.AccessSecret = currentFsConfig.S3Config.AccessSecret
}
- if fsConfig.S3Config.SSECustomerKey.IsNotPlainAndNotEmpty() {
- fsConfig.S3Config.SSECustomerKey = currentFsConfig.S3Config.SSECustomerKey
- }
case sdk.AzureBlobFilesystemProvider:
if fsConfig.AzBlobConfig.AccountKey.IsNotPlainAndNotEmpty() {
fsConfig.AzBlobConfig.AccountKey = currentFsConfig.AzBlobConfig.AccountKey
diff --git a/internal/httpd/api_utils.go b/internal/httpd/api_utils.go
index cef57b53..fa4bac08 100644
--- a/internal/httpd/api_utils.go
+++ b/internal/httpd/api_utils.go
@@ -27,7 +27,6 @@ import (
"net/url"
"os"
"path"
- "slices"
"strconv"
"strings"
"sync"
@@ -42,7 +41,6 @@ import (
"github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/logger"
"github.com/drakkan/sftpgo/v2/internal/metric"
"github.com/drakkan/sftpgo/v2/internal/plugin"
@@ -73,9 +71,8 @@ type adminProfile struct {
type userProfile struct {
baseProfile
- AdditionalEmails []string `json:"additional_emails,omitempty"`
- PublicKeys []string `json:"public_keys,omitempty"`
- TLSCerts []string `json:"tls_certs,omitempty"`
+ PublicKeys []string `json:"public_keys,omitempty"`
+ TLSCerts []string `json:"tls_certs,omitempty"`
}
func sendAPIResponse(w http.ResponseWriter, r *http.Request, err error, message string, code int) {
@@ -162,7 +159,7 @@ func getURLPath(r *http.Request) string {
func getCommaSeparatedQueryParam(r *http.Request, key string) []string {
var result []string
- for val := range strings.SplitSeq(r.URL.Query().Get(key), ",") {
+ for _, val := range strings.Split(r.URL.Query().Get(key), ",") {
val = strings.TrimSpace(val)
if val != "" {
result = append(result, val)
@@ -178,7 +175,7 @@ func getBoolQueryParam(r *http.Request, param string) bool {
func getActiveConnections(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -192,7 +189,7 @@ func getActiveConnections(w http.ResponseWriter, r *http.Request) {
func handleCloseConnection(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -218,9 +215,7 @@ func handleCloseConnection(w http.ResponseWriter, r *http.Request) {
sendAPIResponse(w, r, nil, http.StatusText(status), status)
return
}
- perms := []string{dataprovider.PermAdminCloseConnections}
- uri := fmt.Sprintf("%s/%s", activeConnectionsPath, connectionID)
- if err := n.SendDeleteRequest(claims.Username, claims.Role, uri, perms); err != nil {
+ if err := n.SendDeleteRequest(claims.Username, claims.Role, fmt.Sprintf("%s/%s", activeConnectionsPath, connectionID)); err != nil {
logger.Warn(logSender, "", "unable to delete connection id %q from node %q: %v", connectionID, n.Name, err)
sendAPIResponse(w, r, nil, "Not Found", http.StatusNotFound)
return
@@ -246,8 +241,7 @@ func getNodesConnections(admin, role string) []common.ConnectionStatus {
defer wg.Done()
var stats []common.ConnectionStatus
- perms := []string{dataprovider.PermAdminViewConnections}
- if err := node.SendGetRequest(admin, role, activeConnectionsPath, perms, &stats); err != nil {
+ if err := node.SendGetRequest(admin, role, activeConnectionsPath, &stats); err != nil {
logger.Warn(logSender, "", "unable to get connections from node %s: %v", node.Name, err)
return
}
@@ -369,16 +363,6 @@ func streamJSONArray(w http.ResponseWriter, chunkSize int, dataGetter func(limit
streamData(w, []byte("]"))
}
-func renderPNGImage(w http.ResponseWriter, r *http.Request, b []byte) {
- if len(b) == 0 {
- ctx := context.WithValue(r.Context(), render.StatusCtxKey, http.StatusNotFound)
- render.PlainText(w, r.WithContext(ctx), http.StatusText(http.StatusNotFound))
- return
- }
- w.Header().Set("Content-Type", "image/png")
- streamData(w, b)
-}
-
func getCompressedFileName(username string, files []string) string {
if len(files) == 1 {
name := path.Base(files[0])
@@ -400,7 +384,7 @@ func renderCompressedFiles(w http.ResponseWriter, conn *Connection, baseDir stri
for _, file := range files {
fullPath := util.CleanPath(path.Join(baseDir, file))
- if err := addZipEntry(wr, conn, fullPath, baseDir, nil, 0); err != nil {
+ if err := addZipEntry(wr, conn, fullPath, baseDir, 0); err != nil {
if share != nil {
dataprovider.UpdateShareLastUse(share, -1) //nolint:errcheck
}
@@ -416,19 +400,16 @@ func renderCompressedFiles(w http.ResponseWriter, conn *Connection, baseDir stri
}
}
-func addZipEntry(wr *zip.Writer, conn *Connection, entryPath, baseDir string, info os.FileInfo, recursion int) error {
+func addZipEntry(wr *zip.Writer, conn *Connection, entryPath, baseDir string, recursion int) error {
if recursion >= util.MaxRecursion {
conn.Log(logger.LevelDebug, "unable to add zip entry %q, recursion too depth: %d", entryPath, recursion)
return util.ErrRecursionTooDeep
}
recursion++
- var err error
- if info == nil {
- info, err = conn.Stat(entryPath, 1)
- if err != nil {
- conn.Log(logger.LevelDebug, "unable to add zip entry %q, stat error: %v", entryPath, err)
- return err
- }
+ info, err := conn.Stat(entryPath, 1)
+ if err != nil {
+ conn.Log(logger.LevelDebug, "unable to add zip entry %q, stat error: %v", entryPath, err)
+ return err
}
entryName, err := getZipEntryName(entryPath, baseDir)
if err != nil {
@@ -460,7 +441,7 @@ func addZipEntry(wr *zip.Writer, conn *Connection, entryPath, baseDir string, in
}
for _, info := range contents {
fullPath := util.CleanPath(path.Join(entryPath, info.Name()))
- if err := addZipEntry(wr, conn, fullPath, baseDir, info, recursion); err != nil {
+ if err := addZipEntry(wr, conn, fullPath, baseDir, recursion); err != nil {
return err
}
}
@@ -710,7 +691,7 @@ func handleDefenderEventLoginFailed(ipAddr string, err error) error {
return err
}
-func updateLoginMetrics(user *dataprovider.User, loginMethod, ip string, err error, r *http.Request) {
+func updateLoginMetrics(user *dataprovider.User, loginMethod, ip string, err error) {
metric.AddLoginAttempt(loginMethod)
var protocol string
switch loginMethod {
@@ -720,7 +701,6 @@ func updateLoginMetrics(user *dataprovider.User, loginMethod, ip string, err err
protocol = common.ProtocolHTTP
}
if err == nil {
- logger.LoginLog(user.Username, ip, loginMethod, protocol, "", r.UserAgent(), r.TLS != nil, "")
plugin.Handler.NotifyLogEvent(notifier.LogEventTypeLoginOK, protocol, user.Username, ip, "", nil)
common.DelayLogin(nil)
} else if err != common.ErrInternalFailure && err != common.ErrNoCredentials {
@@ -736,15 +716,15 @@ func updateLoginMetrics(user *dataprovider.User, loginMethod, ip string, err err
dataprovider.ExecutePostLoginHook(user, loginMethod, ip, protocol, err)
}
-func checkHTTPClientUser(user *dataprovider.User, r *http.Request, connectionID string, checkSessions, isOIDCLogin bool) error {
- if slices.Contains(user.Filters.DeniedProtocols, common.ProtocolHTTP) {
+func checkHTTPClientUser(user *dataprovider.User, r *http.Request, connectionID string, checkSessions bool) error {
+ if util.Contains(user.Filters.DeniedProtocols, common.ProtocolHTTP) {
logger.Info(logSender, connectionID, "cannot login user %q, protocol HTTP is not allowed", user.Username)
return util.NewI18nError(
fmt.Errorf("protocol HTTP is not allowed for user %q", user.Username),
util.I18nErrorProtocolForbidden,
)
}
- if !isLoggedInWithOIDC(r) && !isOIDCLogin && !user.IsLoginMethodAllowed(dataprovider.LoginMethodPassword, common.ProtocolHTTP) {
+ if !isLoggedInWithOIDC(r) && !user.IsLoginMethodAllowed(dataprovider.LoginMethodPassword, common.ProtocolHTTP) {
logger.Info(logSender, connectionID, "cannot login user %q, password login method is not allowed", user.Username)
return util.NewI18nError(
fmt.Errorf("login method password is not allowed for user %q", user.Username),
@@ -788,15 +768,14 @@ func getActiveUser(username string, r *http.Request) (dataprovider.User, error)
if err := user.CheckLoginConditions(); err != nil {
return user, util.NewRecordNotFoundError(fmt.Sprintf("user %q cannot login: %v", username, err))
}
- if err := checkHTTPClientUser(&user, r, xid.New().String(), false, false); err != nil {
+ if err := checkHTTPClientUser(&user, r, xid.New().String(), false); err != nil {
return user, util.NewRecordNotFoundError(fmt.Sprintf("user %q cannot login: %v", username, err))
}
return user, nil
}
func handleForgotPassword(r *http.Request, username string, isAdmin bool) error {
- var emails []string
- var subject string
+ var email, subject string
var err error
var admin dataprovider.Admin
var user dataprovider.User
@@ -806,13 +785,11 @@ func handleForgotPassword(r *http.Request, username string, isAdmin bool) error
}
if isAdmin {
admin, err = getActiveAdmin(username, util.GetIPFromRemoteAddress(r.RemoteAddr))
- if admin.Email != "" {
- emails = []string{admin.Email}
- }
+ email = admin.Email
subject = fmt.Sprintf("Email Verification Code for admin %q", username)
} else {
user, err = getActiveUser(username, r)
- emails = user.GetEmailAddresses()
+ email = user.Email
subject = fmt.Sprintf("Email Verification Code for user %q", username)
if err == nil {
if !isUserAllowedToResetPassword(r, &user) {
@@ -833,7 +810,7 @@ func handleForgotPassword(r *http.Request, username string, isAdmin bool) error
}
return util.NewI18nError(util.NewGenericError("Error retrieving your account, please try again later"), util.I18nErrorGetUser)
}
- if len(emails) == 0 {
+ if email == "" {
return util.NewI18nError(
util.NewValidationError("Your account does not have an email address, it is not possible to reset your password by sending an email verification code"),
util.I18nErrorPwdResetNoEmail,
@@ -848,7 +825,7 @@ func handleForgotPassword(r *http.Request, username string, isAdmin bool) error
return util.NewGenericError("Unable to render password reset template")
}
startTime := time.Now()
- if err := smtp.SendEmail(emails, nil, subject, body.String(), smtp.EmailContentTypeTextHTML); err != nil {
+ if err := smtp.SendEmail([]string{email}, nil, subject, body.String(), smtp.EmailContentTypeTextHTML); err != nil {
logger.Warn(logSender, middleware.GetReqID(r.Context()), "unable to send password reset code via email: %v, elapsed: %v",
err, time.Since(startTime))
return util.NewI18nError(
@@ -856,8 +833,8 @@ func handleForgotPassword(r *http.Request, username string, isAdmin bool) error
util.I18nErrorPwdResetSendEmail,
)
}
- logger.Debug(logSender, middleware.GetReqID(r.Context()), "reset code sent via email to %q, emails: %+v, is admin? %v, elapsed: %v",
- username, emails, isAdmin, time.Since(startTime))
+ logger.Debug(logSender, middleware.GetReqID(r.Context()), "reset code sent via email to %q, email: %q, is admin? %v, elapsed: %v",
+ username, email, isAdmin, time.Since(startTime))
return resetCodesMgr.Add(c)
}
@@ -925,7 +902,7 @@ func isUserAllowedToResetPassword(r *http.Request, user *dataprovider.User) bool
if !user.CanResetPassword() {
return false
}
- if slices.Contains(user.Filters.DeniedProtocols, common.ProtocolHTTP) {
+ if util.Contains(user.Filters.DeniedProtocols, common.ProtocolHTTP) {
return false
}
if !user.IsLoginMethodAllowed(dataprovider.LoginMethodPassword, common.ProtocolHTTP) {
@@ -944,18 +921,9 @@ func getProtocolFromRequest(r *http.Request) string {
return common.ProtocolHTTP
}
-func hideConfidentialData(claims *jwt.Claims, r *http.Request) bool {
- if !claims.HasPerm(dataprovider.PermAdminAny) {
+func hideConfidentialData(claims *jwtTokenClaims, r *http.Request) bool {
+ if !claims.hasPerm(dataprovider.PermAdminAny) {
return true
}
return r.URL.Query().Get("confidential_data") != "1"
}
-
-func responseControllerDeadlines(rc *http.ResponseController, read, write time.Time) {
- if err := rc.SetReadDeadline(read); err != nil {
- logger.Error(logSender, "", "unable to set read timeout to %s: %v", read, err)
- }
- if err := rc.SetWriteDeadline(write); err != nil {
- logger.Error(logSender, "", "unable to set write timeout to %s: %v", write, err)
- }
-}
diff --git a/internal/httpd/auth_utils.go b/internal/httpd/auth_utils.go
index ecd9ce86..3cfaeb53 100644
--- a/internal/httpd/auth_utils.go
+++ b/internal/httpd/auth_utils.go
@@ -15,14 +15,16 @@
package httpd
import (
- "crypto/rand"
"errors"
"fmt"
"net/http"
"time"
+ "github.com/go-chi/jwtauth/v5"
+ "github.com/lestrrat-go/jwx/v2/jwt"
+ "github.com/rs/xid"
+
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/logger"
"github.com/drakkan/sftpgo/v2/internal/util"
)
@@ -39,123 +41,243 @@ const (
tokenAudienceAPIUser tokenAudience = "APIUser"
tokenAudienceCSRF tokenAudience = "CSRF"
tokenAudienceOAuth2 tokenAudience = "OAuth2"
- tokenAudienceWebLogin tokenAudience = "WebLogin"
+)
+
+type tokenValidation = int
+
+const (
+ tokenValidationFull = iota
+ tokenValidationNoIPMatch tokenValidation = iota
)
const (
- tokenValidationModeDefault = 0
- tokenValidationModeNoIPMatch = 1
- tokenValidationModeUserSignature = 2
-)
-
-const (
- basicRealm = "Basic realm=\"SFTPGo\""
+ claimUsernameKey = "username"
+ claimPermissionsKey = "permissions"
+ claimRole = "role"
+ claimAPIKey = "api_key"
+ claimNodeID = "node_id"
+ claimMustChangePasswordKey = "chpwd"
+ claimMustSetSecondFactorKey = "2fa_required"
+ claimRequiredTwoFactorProtocols = "2fa_protos"
+ claimHideUserPageSection = "hus"
+ basicRealm = "Basic realm=\"SFTPGo\""
+ jwtCookieKey = "jwt"
)
var (
- apiTokenDuration = 20 * time.Minute
- cookieTokenDuration = 20 * time.Minute
- shareTokenDuration = 2 * time.Hour
+ tokenDuration = 20 * time.Minute
+ shareTokenDuration = 2 * time.Hour
// csrf token duration is greater than normal token duration to reduce issues
// with the login form
- csrfTokenDuration = 4 * time.Hour
- cookieRefreshThreshold = 10 * time.Minute
- maxTokenDuration = 12 * time.Hour
- tokenValidationMode = tokenValidationModeDefault
+ csrfTokenDuration = 6 * time.Hour
+ tokenRefreshThreshold = 10 * time.Minute
+ tokenValidationMode = tokenValidationFull
)
-func isTokenDurationValid(minutes int) bool {
- return minutes >= 1 && minutes <= 720
+type jwtTokenClaims struct {
+ Username string
+ Permissions []string
+ Role string
+ Signature string
+ Audience []string
+ APIKeyID string
+ NodeID string
+ MustSetTwoFactorAuth bool
+ MustChangePassword bool
+ RequiredTwoFactorProtocols []string
+ HideUserPageSections int
}
-func updateTokensDuration(api, cookie, share int) {
- if isTokenDurationValid(api) {
- apiTokenDuration = time.Duration(api) * time.Minute
- }
- if isTokenDurationValid(cookie) {
- cookieTokenDuration = time.Duration(cookie) * time.Minute
- cookieRefreshThreshold = cookieTokenDuration / 2
- if cookieTokenDuration > csrfTokenDuration {
- csrfTokenDuration = cookieTokenDuration
+func (c *jwtTokenClaims) hasUserAudience() bool {
+ for _, audience := range c.Audience {
+ if audience == tokenAudienceWebClient || audience == tokenAudienceAPIUser {
+ return true
}
}
- if isTokenDurationValid(share) {
- shareTokenDuration = time.Duration(share) * time.Minute
- }
- logger.Debug(logSender, "", "API token duration %s, cookie token duration %s, cookie refresh threshold %s, share token duration %s, csrf token duration %s",
- apiTokenDuration, cookieTokenDuration, cookieRefreshThreshold, shareTokenDuration, csrfTokenDuration)
+
+ return false
}
-func getTokenDuration(audience tokenAudience) time.Duration {
- switch audience {
- case tokenAudienceWebShare:
- return shareTokenDuration
- case tokenAudienceWebLogin, tokenAudienceCSRF:
- return csrfTokenDuration
- case tokenAudienceAPI, tokenAudienceAPIUser:
- return apiTokenDuration
- case tokenAudienceWebAdmin, tokenAudienceWebClient:
- return cookieTokenDuration
- case tokenAudienceWebAdminPartial, tokenAudienceWebClientPartial, tokenAudienceOAuth2:
- return 5 * time.Minute
+func (c *jwtTokenClaims) asMap() map[string]any {
+ claims := make(map[string]any)
+
+ claims[claimUsernameKey] = c.Username
+ claims[claimPermissionsKey] = c.Permissions
+ if c.Role != "" {
+ claims[claimRole] = c.Role
+ }
+ if c.APIKeyID != "" {
+ claims[claimAPIKey] = c.APIKeyID
+ }
+ if c.NodeID != "" {
+ claims[claimNodeID] = c.NodeID
+ }
+ claims[jwt.SubjectKey] = c.Signature
+ if c.MustChangePassword {
+ claims[claimMustChangePasswordKey] = c.MustChangePassword
+ }
+ if c.MustSetTwoFactorAuth {
+ claims[claimMustSetSecondFactorKey] = c.MustSetTwoFactorAuth
+ }
+ if len(c.RequiredTwoFactorProtocols) > 0 {
+ claims[claimRequiredTwoFactorProtocols] = c.RequiredTwoFactorProtocols
+ }
+ if c.HideUserPageSections > 0 {
+ claims[claimHideUserPageSection] = c.HideUserPageSections
+ }
+
+ return claims
+}
+
+func (c *jwtTokenClaims) decodeSliceString(val any) []string {
+ switch v := val.(type) {
+ case []any:
+ result := make([]string, 0, len(v))
+ for _, elem := range v {
+ switch elemValue := elem.(type) {
+ case string:
+ result = append(result, elemValue)
+ }
+ }
+ return result
+ case []string:
+ return v
default:
- logger.Error(logSender, "", "token duration not handled for audience: %q", audience)
- return 20 * time.Minute
+ return nil
}
}
-func getMaxCookieDuration() time.Duration {
- result := csrfTokenDuration
- if shareTokenDuration > result {
- result = shareTokenDuration
+func (c *jwtTokenClaims) decodeBoolean(val any) bool {
+ switch v := val.(type) {
+ case bool:
+ return v
+ default:
+ return false
}
- if cookieTokenDuration > result {
- result = cookieTokenDuration
- }
- return result
}
-func hasUserAudience(claims *jwt.Claims) bool {
- return claims.HasAnyAudience([]string{tokenAudienceWebClient, tokenAudienceAPIUser})
+func (c *jwtTokenClaims) decodeString(val any) string {
+ switch v := val.(type) {
+ case string:
+ return v
+ default:
+ return ""
+ }
}
-func createAndSetCookie(w http.ResponseWriter, r *http.Request, claims *jwt.Claims, tokenAuth *jwt.Signer,
+func (c *jwtTokenClaims) Decode(token map[string]any) {
+ c.Permissions = nil
+ c.Username = c.decodeString(token[claimUsernameKey])
+ c.Signature = c.decodeString(token[jwt.SubjectKey])
+
+ audience := token[jwt.AudienceKey]
+ switch v := audience.(type) {
+ case []string:
+ c.Audience = v
+ }
+
+ if val, ok := token[claimAPIKey]; ok {
+ c.APIKeyID = c.decodeString(val)
+ }
+
+ if val, ok := token[claimNodeID]; ok {
+ c.NodeID = c.decodeString(val)
+ }
+
+ if val, ok := token[claimRole]; ok {
+ c.Role = c.decodeString(val)
+ }
+
+ permissions := token[claimPermissionsKey]
+ c.Permissions = c.decodeSliceString(permissions)
+
+ if val, ok := token[claimMustChangePasswordKey]; ok {
+ c.MustChangePassword = c.decodeBoolean(val)
+ }
+
+ if val, ok := token[claimMustSetSecondFactorKey]; ok {
+ c.MustSetTwoFactorAuth = c.decodeBoolean(val)
+ }
+
+ if val, ok := token[claimRequiredTwoFactorProtocols]; ok {
+ c.RequiredTwoFactorProtocols = c.decodeSliceString(val)
+ }
+
+ if val, ok := token[claimHideUserPageSection]; ok {
+ switch v := val.(type) {
+ case float64:
+ c.HideUserPageSections = int(v)
+ }
+ }
+}
+
+func (c *jwtTokenClaims) hasPerm(perm string) bool {
+ if util.Contains(c.Permissions, dataprovider.PermAdminAny) {
+ return true
+ }
+
+ return util.Contains(c.Permissions, perm)
+}
+
+func (c *jwtTokenClaims) createToken(tokenAuth *jwtauth.JWTAuth, audience tokenAudience, ip string) (jwt.Token, string, error) {
+ claims := c.asMap()
+ now := time.Now().UTC()
+
+ claims[jwt.JwtIDKey] = xid.New().String()
+ claims[jwt.NotBeforeKey] = now.Add(-30 * time.Second)
+ claims[jwt.ExpirationKey] = now.Add(tokenDuration)
+ claims[jwt.AudienceKey] = []string{audience, ip}
+
+ return tokenAuth.Encode(claims)
+}
+
+func (c *jwtTokenClaims) createTokenResponse(tokenAuth *jwtauth.JWTAuth, audience tokenAudience, ip string) (map[string]any, error) {
+ token, tokenString, err := c.createToken(tokenAuth, audience, ip)
+ if err != nil {
+ return nil, err
+ }
+
+ response := make(map[string]any)
+ response["access_token"] = tokenString
+ response["expires_at"] = token.Expiration().Format(time.RFC3339)
+
+ return response, nil
+}
+
+func (c *jwtTokenClaims) createAndSetCookie(w http.ResponseWriter, r *http.Request, tokenAuth *jwtauth.JWTAuth,
audience tokenAudience, ip string,
) error {
- duration := getTokenDuration(audience)
- token, err := tokenAuth.SignWithParams(claims, audience, ip, duration)
+ resp, err := c.createTokenResponse(tokenAuth, audience, ip)
if err != nil {
return err
}
- resp := claims.BuildTokenResponse(token)
var basePath string
if audience == tokenAudienceWebAdmin || audience == tokenAudienceWebAdminPartial {
basePath = webBaseAdminPath
} else {
basePath = webBaseClientPath
}
- setCookie(w, r, basePath, resp.Token, duration)
-
- return nil
-}
-
-func setCookie(w http.ResponseWriter, r *http.Request, cookiePath, cookieValue string, duration time.Duration) {
+ duration := tokenDuration
+ if audience == tokenAudienceWebShare {
+ duration = shareTokenDuration
+ }
http.SetCookie(w, &http.Cookie{
- Name: jwt.CookieKey,
- Value: cookieValue,
- Path: cookiePath,
+ Name: jwtCookieKey,
+ Value: resp["access_token"].(string),
+ Path: basePath,
Expires: time.Now().Add(duration),
MaxAge: int(duration / time.Second),
HttpOnly: true,
Secure: isTLS(r),
SameSite: http.SameSiteStrictMode,
})
+
+ return nil
}
-func removeCookie(w http.ResponseWriter, r *http.Request, cookiePath string) {
- invalidateToken(r)
+func (c *jwtTokenClaims) removeCookie(w http.ResponseWriter, r *http.Request, cookiePath string) {
http.SetCookie(w, &http.Cookie{
- Name: jwt.CookieKey,
+ Name: jwtCookieKey,
Value: "",
Path: cookiePath,
Expires: time.Unix(0, 0),
@@ -165,9 +287,10 @@ func removeCookie(w http.ResponseWriter, r *http.Request, cookiePath string) {
SameSite: http.SameSiteStrictMode,
})
w.Header().Add("Cache-Control", `no-cache="Set-Cookie"`)
+ invalidateToken(r)
}
-func oidcTokenFromContext(r *http.Request) string {
+func tokenFromContext(r *http.Request) string {
if token, ok := r.Context().Value(oidcGeneratedToken).(string); ok {
return token
}
@@ -179,16 +302,16 @@ func isTLS(r *http.Request) bool {
return true
}
if proto, ok := r.Context().Value(forwardedProtoKey).(string); ok {
- return proto == "https" //nolint:goconst
+ return proto == "https"
}
return false
}
func isTokenInvalidated(r *http.Request) bool {
var findTokenFns []func(r *http.Request) string
- findTokenFns = append(findTokenFns, jwt.TokenFromHeader)
- findTokenFns = append(findTokenFns, jwt.TokenFromCookie)
- findTokenFns = append(findTokenFns, oidcTokenFromContext)
+ findTokenFns = append(findTokenFns, jwtauth.TokenFromHeader)
+ findTokenFns = append(findTokenFns, jwtauth.TokenFromCookie)
+ findTokenFns = append(findTokenFns, tokenFromContext)
isTokenFound := false
for _, fn := range findTokenFns {
@@ -205,78 +328,55 @@ func isTokenInvalidated(r *http.Request) bool {
}
func invalidateToken(r *http.Request) {
- tokenString := jwt.TokenFromHeader(r)
+ tokenString := jwtauth.TokenFromHeader(r)
if tokenString != "" {
- invalidateTokenString(r, tokenString, apiTokenDuration)
+ invalidatedJWTTokens.Add(tokenString, time.Now().Add(tokenDuration).UTC())
}
- tokenString = jwt.TokenFromCookie(r)
+ tokenString = jwtauth.TokenFromCookie(r)
if tokenString != "" {
- invalidateTokenString(r, tokenString, getMaxCookieDuration())
+ invalidatedJWTTokens.Add(tokenString, time.Now().Add(tokenDuration).UTC())
}
}
-func invalidateTokenString(r *http.Request, tokenString string, fallbackDuration time.Duration) {
- token, err := jwt.FromContext(r.Context())
- if err != nil {
- invalidatedJWTTokens.Add(tokenString, time.Now().Add(fallbackDuration).UTC())
- return
- }
- invalidatedJWTTokens.Add(tokenString, token.Expiry.Time().Add(1*time.Minute).UTC())
-}
-
func getUserFromToken(r *http.Request) *dataprovider.User {
user := &dataprovider.User{}
- claims, err := jwt.FromContext(r.Context())
+ _, claims, err := jwtauth.FromContext(r.Context())
if err != nil {
return user
}
- user.Username = claims.Username
- user.Filters.WebClient = claims.Permissions
- user.Role = claims.Role
+ tokenClaims := jwtTokenClaims{}
+ tokenClaims.Decode(claims)
+ user.Username = tokenClaims.Username
+ user.Filters.WebClient = tokenClaims.Permissions
+ user.Role = tokenClaims.Role
return user
}
func getAdminFromToken(r *http.Request) *dataprovider.Admin {
admin := &dataprovider.Admin{}
- claims, err := jwt.FromContext(r.Context())
+ _, claims, err := jwtauth.FromContext(r.Context())
if err != nil {
return admin
}
- admin.Username = claims.Username
- admin.Permissions = claims.Permissions
- admin.Filters.Preferences.HideUserPageSections = claims.HideUserPageSections
- admin.Role = claims.Role
+ tokenClaims := jwtTokenClaims{}
+ tokenClaims.Decode(claims)
+ admin.Username = tokenClaims.Username
+ admin.Permissions = tokenClaims.Permissions
+ admin.Filters.Preferences.HideUserPageSections = tokenClaims.HideUserPageSections
+ admin.Role = tokenClaims.Role
return admin
}
-func createLoginCookie(w http.ResponseWriter, r *http.Request, csrfTokenAuth *jwt.Signer, tokenID, basePath, ip string,
-) {
- c := jwt.NewClaims(tokenAudienceWebLogin, ip, getTokenDuration(tokenAudienceWebLogin))
- c.ID = tokenID
- resp, err := c.GenerateTokenResponse(csrfTokenAuth)
- if err != nil {
- return
- }
- setCookie(w, r, basePath, resp.Token, csrfTokenDuration)
-}
+func createCSRFToken(ip string) string {
+ claims := make(map[string]any)
+ now := time.Now().UTC()
-func createCSRFToken(w http.ResponseWriter, r *http.Request, csrfTokenAuth *jwt.Signer, tokenID,
- basePath string,
-) string {
- ip := util.GetIPFromRemoteAddress(r.RemoteAddr)
- claims := jwt.NewClaims(tokenAudienceCSRF, ip, csrfTokenDuration)
- claims.ID = rand.Text()
- if tokenID != "" {
- createLoginCookie(w, r, csrfTokenAuth, tokenID, basePath, ip)
- claims.Ref = tokenID
- } else {
- if c, err := jwt.FromContext(r.Context()); err == nil {
- claims.Ref = c.ID
- } else {
- logger.Error(logSender, "", "unable to add reference to CSRF token: %v", err)
- }
- }
- tokenString, err := csrfTokenAuth.Sign(claims)
+ claims[jwt.JwtIDKey] = xid.New().String()
+ claims[jwt.NotBeforeKey] = now.Add(-30 * time.Second)
+ claims[jwt.ExpirationKey] = now.Add(csrfTokenDuration)
+ claims[jwt.AudienceKey] = []string{tokenAudienceCSRF, ip}
+
+ _, tokenString, err := csrfTokenAuth.Encode(claims)
if err != nil {
logger.Debug(logSender, "", "unable to create CSRF token: %v", err)
return ""
@@ -284,80 +384,38 @@ func createCSRFToken(w http.ResponseWriter, r *http.Request, csrfTokenAuth *jwt.
return tokenString
}
-func verifyCSRFToken(r *http.Request, csrfTokenAuth *jwt.Signer) error {
- tokenString := r.Form.Get(csrfFormToken)
- token, err := jwt.VerifyToken(csrfTokenAuth, tokenString)
+func verifyCSRFToken(tokenString, ip string) error {
+ token, err := jwtauth.VerifyToken(csrfTokenAuth, tokenString)
if err != nil || token == nil {
logger.Debug(logSender, "", "error validating CSRF token %q: %v", tokenString, err)
return fmt.Errorf("unable to verify form token: %v", err)
}
- if !token.Audience.Contains(tokenAudienceCSRF) {
+ if !util.Contains(token.Audience(), tokenAudienceCSRF) {
logger.Debug(logSender, "", "error validating CSRF token audience")
return errors.New("the form token is not valid")
}
- if err := validateIPForToken(token, util.GetIPFromRemoteAddress(r.RemoteAddr)); err != nil {
- logger.Debug(logSender, "", "error validating CSRF token IP audience")
- return errors.New("the form token is not valid")
- }
- return checkCSRFTokenRef(r, token)
-}
-
-func checkCSRFTokenRef(r *http.Request, token *jwt.Claims) error {
- claims, err := jwt.FromContext(r.Context())
- if err != nil {
- logger.Debug(logSender, "", "error getting token claims for CSRF validation: %v", err)
- return err
- }
- if token.ID == "" {
- logger.Debug(logSender, "", "error validating CSRF token, missing reference")
- return errors.New("the form token is not valid")
- }
- if claims.ID != token.Ref {
- logger.Debug(logSender, "", "error validating CSRF reference, id %q, reference %q", claims.ID, token.ID)
- return errors.New("unexpected form token")
+ if tokenValidationMode != tokenValidationNoIPMatch {
+ if !util.Contains(token.Audience(), ip) {
+ logger.Debug(logSender, "", "error validating CSRF token IP audience")
+ return errors.New("the form token is not valid")
+ }
}
return nil
}
-func verifyLoginCookie(r *http.Request) error {
- token, err := jwt.FromContext(r.Context())
- if err != nil {
- logger.Debug(logSender, "", "error getting login token: %v", err)
- return errInvalidToken
- }
- if isTokenInvalidated(r) {
- logger.Debug(logSender, "", "the login token has been invalidated")
- return errInvalidToken
- }
- if !token.Audience.Contains(tokenAudienceWebLogin) {
- logger.Debug(logSender, "", "the token with id %q is not valid for audience %q", token.ID, tokenAudienceWebLogin)
- return errInvalidToken
- }
- ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := validateIPForToken(token, ipAddr); err != nil {
- return err
- }
- return nil
-}
+func createOAuth2Token(state, ip string) string {
+ claims := make(map[string]any)
+ now := time.Now().UTC()
-func verifyLoginCookieAndCSRFToken(r *http.Request, csrfTokenAuth *jwt.Signer) error {
- if err := verifyLoginCookie(r); err != nil {
- return err
- }
- if err := verifyCSRFToken(r, csrfTokenAuth); err != nil {
- return err
- }
- return nil
-}
+ claims[jwt.JwtIDKey] = state
+ claims[jwt.NotBeforeKey] = now.Add(-30 * time.Second)
+ claims[jwt.ExpirationKey] = now.Add(3 * time.Minute)
+ claims[jwt.AudienceKey] = []string{tokenAudienceOAuth2, ip}
-func createOAuth2Token(csrfTokenAuth *jwt.Signer, state, ip string) string {
- claims := jwt.NewClaims(tokenAudienceOAuth2, ip, getTokenDuration(tokenAudienceOAuth2))
- claims.ID = state
-
- tokenString, err := csrfTokenAuth.Sign(claims)
+ _, tokenString, err := csrfTokenAuth.Encode(claims)
if err != nil {
logger.Debug(logSender, "", "unable to create OAuth2 token: %v", err)
return ""
@@ -365,8 +423,8 @@ func createOAuth2Token(csrfTokenAuth *jwt.Signer, state, ip string) string {
return tokenString
}
-func verifyOAuth2Token(csrfTokenAuth *jwt.Signer, tokenString, ip string) (string, error) {
- token, err := jwt.VerifyToken(csrfTokenAuth, tokenString)
+func verifyOAuth2Token(tokenString, ip string) (string, error) {
+ token, err := jwtauth.VerifyToken(csrfTokenAuth, tokenString)
if err != nil || token == nil {
logger.Debug(logSender, "", "error validating OAuth2 token %q: %v", tokenString, err)
return "", util.NewI18nError(
@@ -375,62 +433,22 @@ func verifyOAuth2Token(csrfTokenAuth *jwt.Signer, tokenString, ip string) (strin
)
}
- if !token.Audience.Contains(tokenAudienceOAuth2) {
+ if !util.Contains(token.Audience(), tokenAudienceOAuth2) {
logger.Debug(logSender, "", "error validating OAuth2 token audience")
return "", util.NewI18nError(errors.New("invalid OAuth2 state"), util.I18nOAuth2InvalidState)
}
- if err := validateIPForToken(token, ip); err != nil {
- logger.Debug(logSender, "", "error validating OAuth2 token IP audience")
- return "", util.NewI18nError(errors.New("invalid OAuth2 state"), util.I18nOAuth2InvalidState)
+ if tokenValidationMode != tokenValidationNoIPMatch {
+ if !util.Contains(token.Audience(), ip) {
+ logger.Debug(logSender, "", "error validating OAuth2 token IP audience")
+ return "", util.NewI18nError(errors.New("invalid OAuth2 state"), util.I18nOAuth2InvalidState)
+ }
}
- if token.ID != "" {
- return token.ID, nil
+ if val, ok := token.Get(jwt.JwtIDKey); ok {
+ if state, ok := val.(string); ok {
+ return state, nil
+ }
}
logger.Debug(logSender, "", "jti not found in OAuth2 token")
return "", util.NewI18nError(errors.New("invalid OAuth2 state"), util.I18nOAuth2InvalidState)
}
-
-func validateIPForToken(token *jwt.Claims, ip string) error {
- if tokenValidationMode&tokenValidationModeNoIPMatch == 0 {
- if !token.Audience.Contains(ip) {
- return errInvalidToken
- }
- }
- return nil
-}
-
-func checkTokenSignature(r *http.Request, token *jwt.Claims) error {
- if _, ok := r.Context().Value(oidcTokenKey).(string); ok {
- return nil
- }
- var err error
- if tokenValidationMode&tokenValidationModeUserSignature != 0 {
- for _, audience := range token.Audience {
- switch audience {
- case tokenAudienceAPI, tokenAudienceWebAdmin:
- err = validateSignatureForToken(token, dataprovider.GetAdminSignature)
- case tokenAudienceAPIUser, tokenAudienceWebClient:
- err = validateSignatureForToken(token, dataprovider.GetUserSignature)
- }
- }
- }
- if err != nil {
- invalidateToken(r)
- }
- return err
-}
-
-func validateSignatureForToken(token *jwt.Claims, getter func(string) (string, error)) error {
- signature, err := getter(token.Username)
- if err != nil {
- logger.Debug(logSender, "", "unable to get signature for username %q: %v", token.Username, err)
- return errInvalidToken
- }
- if signature != "" && signature == token.Subject {
- return nil
- }
- logger.Debug(logSender, "", "signature mismatch for username %q, signature %q, token signature %q",
- token.Username, signature, token.Subject)
- return errInvalidToken
-}
diff --git a/internal/httpd/file.go b/internal/httpd/file.go
index daa70b49..5bc4627b 100644
--- a/internal/httpd/file.go
+++ b/internal/httpd/file.go
@@ -126,7 +126,7 @@ func (f *httpdFile) closeIO() error {
} else if f.reader != nil {
err = f.reader.Close()
if metadater, ok := f.reader.(vfs.Metadater); ok {
- f.SetMetadata(metadater.Metadata())
+ f.BaseTransfer.SetMetadata(metadater.Metadata())
}
}
return err
diff --git a/internal/httpd/handler.go b/internal/httpd/handler.go
index 15b085fe..d417cc4a 100644
--- a/internal/httpd/handler.go
+++ b/internal/httpd/handler.go
@@ -35,17 +35,6 @@ import (
type Connection struct {
*common.BaseConnection
request *http.Request
- rc *http.ResponseController
-}
-
-func newConnection(conn *common.BaseConnection, w http.ResponseWriter, r *http.Request) *Connection {
- rc := http.NewResponseController(w)
- responseControllerDeadlines(rc, time.Time{}, time.Time{})
- return &Connection{
- BaseConnection: conn,
- request: r,
- rc: rc,
- }
}
// GetClientVersion returns the connected client's version.
@@ -71,9 +60,6 @@ func (c *Connection) GetRemoteAddress() string {
// Disconnect closes the active transfer
func (c *Connection) Disconnect() (err error) {
- if c.rc != nil {
- responseControllerDeadlines(c.rc, time.Now().Add(5*time.Second), time.Now().Add(5*time.Second))
- }
return c.SignalTransfersAbort()
}
@@ -111,11 +97,6 @@ func (c *Connection) ReadDir(name string) (vfs.DirLister, error) {
func (c *Connection) getFileReader(name string, offset int64, method string) (io.ReadCloser, error) {
c.UpdateLastActivity()
- if err := common.Connections.IsNewTransferAllowed(c.User.Username); err != nil {
- c.Log(logger.LevelInfo, "denying file read due to transfer count limits")
- return nil, util.NewI18nError(c.GetPermissionDeniedError(), util.I18nError403Message)
- }
-
transferQuota := c.GetTransferQuota()
if !transferQuota.HasDownloadSpace() {
c.Log(logger.LevelInfo, "denying file read due to quota limits")
@@ -195,7 +176,7 @@ func (c *Connection) getFileWriter(name string) (io.WriteCloser, error) {
}
if common.Config.IsAtomicUploadEnabled() && fs.IsAtomicUploadSupported() {
- _, _, err = fs.Rename(p, filePath, 0)
+ _, _, err = fs.Rename(p, filePath)
if err != nil {
c.Log(logger.LevelError, "error renaming existing file for atomic upload, source: %q, dest: %q, err: %+v",
p, filePath, err)
@@ -207,10 +188,6 @@ func (c *Connection) getFileWriter(name string) (io.WriteCloser, error) {
}
func (c *Connection) handleUploadFile(fs vfs.Fs, resolvedPath, filePath, requestPath string, isNewFile bool, fileSize int64) (io.WriteCloser, error) {
- if err := common.Connections.IsNewTransferAllowed(c.User.Username); err != nil {
- c.Log(logger.LevelInfo, "denying file write due to transfer count limits")
- return nil, util.NewI18nError(c.GetPermissionDeniedError(), util.I18nError403Message)
- }
diskQuota, transferQuota := c.HasSpace(isNewFile, false, requestPath)
if !diskQuota.HasSpace || !transferQuota.HasUploadSpace() {
c.Log(logger.LevelInfo, "denying file write due to quota limits")
@@ -236,7 +213,10 @@ func (c *Connection) handleUploadFile(fs vfs.Fs, resolvedPath, filePath, request
if vfs.HasTruncateSupport(fs) {
vfolder, err := c.User.GetVirtualFolderForPath(path.Dir(requestPath))
if err == nil {
- dataprovider.UpdateUserFolderQuota(&vfolder, &c.User, 0, -fileSize, false)
+ dataprovider.UpdateVirtualFolderQuota(&vfolder.BaseVirtualFolder, 0, -fileSize, false) //nolint:errcheck
+ if vfolder.IsIncludedInUserQuota() {
+ dataprovider.UpdateUserQuota(&c.User, 0, -fileSize, false) //nolint:errcheck
+ }
} else {
dataprovider.UpdateUserQuota(&c.User, 0, -fileSize, false) //nolint:errcheck
}
@@ -343,10 +323,6 @@ func (t *throttledReader) GetRealFsPath(_ string) string {
return ""
}
-func (t *throttledReader) GetFsPath() string {
- return ""
-}
-
func (t *throttledReader) SetTimes(_ string, _ time.Time, _ time.Time) bool {
return false
}
diff --git a/internal/httpd/httpd.go b/internal/httpd/httpd.go
index 13e39206..ae81b7af 100644
--- a/internal/httpd/httpd.go
+++ b/internal/httpd/httpd.go
@@ -23,16 +23,16 @@ import (
"fmt"
"net"
"net/http"
- "net/url"
"os"
"path"
"path/filepath"
"runtime"
"strings"
- "sync"
"time"
"github.com/go-chi/chi/v5"
+ "github.com/go-chi/jwtauth/v5"
+ "github.com/lestrrat-go/jwx/v2/jwa"
"github.com/drakkan/sftpgo/v2/internal/acme"
"github.com/drakkan/sftpgo/v2/internal/common"
@@ -84,6 +84,7 @@ const (
user2FARecoveryCodesPath = "/api/v2/user/2fa/recoverycodes"
userProfilePath = "/api/v2/user/profile"
userSharesPath = "/api/v2/user/shares"
+ retentionBasePath = "/api/v2/retention/users"
retentionChecksPath = "/api/v2/retention/users/checks"
fsEventsPath = "/api/v2/events/fs"
providerEventsPath = "/api/v2/events/provider"
@@ -195,6 +196,7 @@ var (
cleanupTicker *time.Ticker
cleanupDone chan bool
invalidatedJWTTokens tokenManager
+ csrfTokenAuth *jwtauth.JWTAuth
webRootPath string
webBasePath string
webBaseAdminPath string
@@ -286,88 +288,12 @@ var (
installationCodeHint string
fnInstallationCodeResolver FnInstallationCodeResolver
configurationDir string
- dbBrandingConfig brandingCache
)
func init() {
updateWebAdminURLs("")
updateWebClientURLs("")
acme.SetReloadHTTPDCertsFn(ReloadCertificateMgr)
- common.SetUpdateBrandingFn(dbBrandingConfig.Set)
-}
-
-type brandingCache struct {
- mu sync.RWMutex
- configs *dataprovider.BrandingConfigs
-}
-
-func (b *brandingCache) Set(configs *dataprovider.BrandingConfigs) {
- b.mu.Lock()
- defer b.mu.Unlock()
-
- b.configs = configs
-}
-
-func (b *brandingCache) getWebAdminLogo() []byte {
- b.mu.RLock()
- defer b.mu.RUnlock()
-
- return b.configs.WebAdmin.Logo
-}
-
-func (b *brandingCache) getWebAdminFavicon() []byte {
- b.mu.RLock()
- defer b.mu.RUnlock()
-
- return b.configs.WebAdmin.Favicon
-}
-
-func (b *brandingCache) getWebClientLogo() []byte {
- b.mu.RLock()
- defer b.mu.RUnlock()
-
- return b.configs.WebClient.Logo
-}
-
-func (b *brandingCache) getWebClientFavicon() []byte {
- b.mu.RLock()
- defer b.mu.RUnlock()
-
- return b.configs.WebClient.Favicon
-}
-
-func (b *brandingCache) mergeBrandingConfig(branding UIBranding, isWebClient bool) UIBranding {
- b.mu.RLock()
- defer b.mu.RUnlock()
-
- var urlPrefix string
- var cfg dataprovider.BrandingConfig
- if isWebClient {
- cfg = b.configs.WebClient
- urlPrefix = "webclient"
- } else {
- cfg = b.configs.WebAdmin
- urlPrefix = "webadmin"
- }
- if cfg.Name != "" {
- branding.Name = cfg.Name
- }
- if cfg.ShortName != "" {
- branding.ShortName = cfg.ShortName
- }
- if cfg.DisclaimerName != "" {
- branding.DisclaimerName = cfg.DisclaimerName
- }
- if cfg.DisclaimerURL != "" {
- branding.DisclaimerPath = cfg.DisclaimerURL
- }
- if len(cfg.Logo) > 0 {
- branding.LogoPath = path.Join("/", "branding", urlPrefix, "logo.png")
- }
- if len(cfg.Favicon) > 0 {
- branding.FaviconPath = path.Join("/", "branding", urlPrefix, "favicon.png")
- }
- return branding
}
// FnInstallationCodeResolver defines a method to get the installation code.
@@ -414,17 +340,11 @@ type SecurityConf struct {
ContentSecurityPolicy string `json:"content_security_policy" mapstructure:"content_security_policy"`
// PermissionsPolicy allows to set the Permissions-Policy header value. Default is "".
PermissionsPolicy string `json:"permissions_policy" mapstructure:"permissions_policy"`
- // CrossOriginOpenerPolicy allows to set the Cross-Origin-Opener-Policy header value. Default is "".
+ // CrossOriginOpenerPolicy allows to set the `Cross-Origin-Opener-Policy` header value. Default is "".
CrossOriginOpenerPolicy string `json:"cross_origin_opener_policy" mapstructure:"cross_origin_opener_policy"`
- // CrossOriginResourcePolicy allows to set the Cross-Origin-Resource-Policy header value. Default is "".
- CrossOriginResourcePolicy string `json:"cross_origin_resource_policy" mapstructure:"cross_origin_resource_policy"`
- // CrossOriginEmbedderPolicy allows to set the Cross-Origin-Embedder-Policy header value. Default is "".
- CrossOriginEmbedderPolicy string `json:"cross_origin_embedder_policy" mapstructure:"cross_origin_embedder_policy"`
- // CacheControl allows to set the Cache-Control header value.
+ // CacheControl allow to set the Cache-Control header value.
CacheControl string `json:"cache_control" mapstructure:"cache_control"`
- // ReferrerPolicy allows to set the Referrer-Policy header values.
- ReferrerPolicy string `json:"referrer_policy" mapstructure:"referrer_policy"`
- proxyHeaders []string
+ proxyHeaders []string
}
func (s *SecurityConf) updateProxyHeaders() {
@@ -491,23 +411,19 @@ type UIBranding struct {
// the default CSS files
DefaultCSS []string `json:"default_css" mapstructure:"default_css"`
// Additional CSS file paths, relative to "static_files_path", to include
- ExtraCSS []string `json:"extra_css" mapstructure:"extra_css"`
- DefaultLogoPath string `json:"-" mapstructure:"-"`
- DefaultFaviconPath string `json:"-" mapstructure:"-"`
+ ExtraCSS []string `json:"extra_css" mapstructure:"extra_css"`
}
func (b *UIBranding) check() {
- b.DefaultLogoPath = "/img/logo.png"
- b.DefaultFaviconPath = "/favicon.png"
if b.LogoPath != "" {
b.LogoPath = util.CleanPath(b.LogoPath)
} else {
- b.LogoPath = b.DefaultLogoPath
+ b.LogoPath = "/img/logo.png"
}
if b.FaviconPath != "" {
b.FaviconPath = util.CleanPath(b.FaviconPath)
} else {
- b.FaviconPath = b.DefaultFaviconPath
+ b.FaviconPath = "/favicon.ico"
}
if b.DisclaimerPath != "" {
if !strings.HasPrefix(b.DisclaimerPath, "https://") && !strings.HasPrefix(b.DisclaimerPath, "http://") {
@@ -567,21 +483,7 @@ type Binding struct {
//
// You can combine the values. For example 3 means that you can only login using OIDC on
// both WebClient and WebAdmin UI.
- // Deprecated because it is not extensible, use DisabledLoginMethods
EnabledLoginMethods int `json:"enabled_login_methods" mapstructure:"enabled_login_methods"`
- // Defines the login methods disabled for the WebAdmin and WebClient UIs:
- //
- // - 1 means OIDC for the WebAdmin UI
- // - 2 means OIDC for the WebClient UI
- // - 4 means login form for the WebAdmin UI
- // - 8 means login form for the WebClient UI
- // - 16 means basic auth for admin REST API
- // - 32 means basic auth for user REST API
- // - 64 means API key auth for admins
- // - 128 means API key auth for users
- // You can combine the values. For example 12 means that you can only login using OIDC on
- // both WebClient and WebAdmin UI.
- DisabledLoginMethods int `json:"disabled_login_methods" mapstructure:"disabled_login_methods"`
// you also need to provide a certificate for enabling HTTPS
EnableHTTPS bool `json:"enable_https" mapstructure:"enable_https"`
// Certificate and matching private key for this specific binding, if empty the global
@@ -606,9 +508,6 @@ type Binding struct {
TLSCipherSuites []string `json:"tls_cipher_suites" mapstructure:"tls_cipher_suites"`
// HTTP protocols in preference order. Supported values: http/1.1, h2
Protocols []string `json:"tls_protocols" mapstructure:"tls_protocols"`
- // Defines whether to use the common proxy protocol configuration or the
- // binding-specific proxy header configuration.
- ProxyMode int `json:"proxy_mode" mapstructure:"proxy_mode"`
// List of IP addresses and IP ranges allowed to set client IP proxy headers and
// X-Forwarded-Proto header.
ProxyAllowed []string `json:"proxy_allowed" mapstructure:"proxy_allowed"`
@@ -628,12 +527,6 @@ type Binding struct {
HideLoginURL int `json:"hide_login_url" mapstructure:"hide_login_url"`
// Enable the built-in OpenAPI renderer
RenderOpenAPI bool `json:"render_openapi" mapstructure:"render_openapi"`
- // BaseURL defines the external base URL for generating public links
- // (currently share access link), bypassing the default browser-based
- // detection.
- BaseURL string `json:"base_url" mapstructure:"base_url"`
- // Languages defines the list of enabled translations for the WebAdmin and WebClient UI.
- Languages []string `json:"languages" mapstructure:"languages"`
// Defining an OIDC configuration the web admin and web client UI will use OpenID to authenticate users.
OIDC OIDC `json:"oidc" mapstructure:"oidc"`
// Security defines security headers to add to HTTP responses and allows to restrict allowed hosts
@@ -660,36 +553,6 @@ func (b *Binding) checkBranding() {
}
}
-func (b *Binding) webAdminBranding() UIBranding {
- return dbBrandingConfig.mergeBrandingConfig(b.Branding.WebAdmin, false)
-}
-
-func (b *Binding) webClientBranding() UIBranding {
- return dbBrandingConfig.mergeBrandingConfig(b.Branding.WebClient, true)
-}
-
-func (b *Binding) languages() []string {
- return b.Languages
-}
-
-func (b *Binding) validateBaseURL() error {
- if b.BaseURL == "" {
- return nil
- }
- u, err := url.ParseRequestURI(b.BaseURL)
- if err != nil {
- return err
- }
- if u.Scheme != "http" && u.Scheme != "https" {
- return fmt.Errorf("invalid base URL schema %s", b.BaseURL)
- }
- if u.Host == "" {
- return fmt.Errorf("invalid base URL host %s", b.BaseURL)
- }
- b.BaseURL = strings.TrimRight(u.String(), "/")
- return nil
-}
-
func (b *Binding) parseAllowedProxy() error {
if filepath.IsAbs(b.Address) && len(b.ProxyAllowed) > 0 {
// unix domain socket
@@ -723,90 +586,47 @@ func (b *Binding) IsValid() bool {
return false
}
-func (b *Binding) check() error {
- if err := b.parseAllowedProxy(); err != nil {
- return err
- }
- if err := b.validateBaseURL(); err != nil {
- return err
- }
- b.checkBranding()
- b.Security.updateProxyHeaders()
- return nil
-}
-
func (b *Binding) isWebAdminOIDCLoginDisabled() bool {
if b.EnableWebAdmin {
- return b.DisabledLoginMethods&1 != 0
+ if b.EnabledLoginMethods == 0 {
+ return false
+ }
+ return b.EnabledLoginMethods&1 == 0
}
return false
}
func (b *Binding) isWebClientOIDCLoginDisabled() bool {
if b.EnableWebClient {
- return b.DisabledLoginMethods&2 != 0
+ if b.EnabledLoginMethods == 0 {
+ return false
+ }
+ return b.EnabledLoginMethods&2 == 0
}
return false
}
func (b *Binding) isWebAdminLoginFormDisabled() bool {
if b.EnableWebAdmin {
- return b.DisabledLoginMethods&4 != 0
+ if b.EnabledLoginMethods == 0 {
+ return false
+ }
+ return b.EnabledLoginMethods&4 == 0
}
return false
}
func (b *Binding) isWebClientLoginFormDisabled() bool {
if b.EnableWebClient {
- return b.DisabledLoginMethods&8 != 0
+ if b.EnabledLoginMethods == 0 {
+ return false
+ }
+ return b.EnabledLoginMethods&8 == 0
}
return false
}
-func (b *Binding) isAdminTokenEndpointDisabled() bool {
- return b.DisabledLoginMethods&16 != 0
-}
-
-func (b *Binding) isUserTokenEndpointDisabled() bool {
- return b.DisabledLoginMethods&32 != 0
-}
-
-func (b *Binding) isAdminAPIKeyAuthDisabled() bool {
- return b.DisabledLoginMethods&64 != 0
-}
-
-func (b *Binding) isUserAPIKeyAuthDisabled() bool {
- return b.DisabledLoginMethods&128 != 0
-}
-
-func (b *Binding) hasLoginForAPI() bool {
- return !b.isAdminTokenEndpointDisabled() || !b.isUserTokenEndpointDisabled() ||
- !b.isAdminAPIKeyAuthDisabled() || !b.isUserAPIKeyAuthDisabled()
-}
-
-// convertLoginMethods checks if the deprecated EnabledLoginMethods is set and
-// convert the value to DisabledLoginMethods.
-func (b *Binding) convertLoginMethods() {
- if b.DisabledLoginMethods > 0 || b.EnabledLoginMethods == 0 {
- // DisabledLoginMethods already in use or EnabledLoginMethods not set.
- return
- }
- if b.EnabledLoginMethods&1 == 0 {
- b.DisabledLoginMethods++
- }
- if b.EnabledLoginMethods&2 == 0 {
- b.DisabledLoginMethods += 2
- }
- if b.EnabledLoginMethods&4 == 0 {
- b.DisabledLoginMethods += 4
- }
- if b.EnabledLoginMethods&8 == 0 {
- b.DisabledLoginMethods += 8
- }
-}
-
func (b *Binding) checkLoginMethods() error {
- b.convertLoginMethods()
if b.isWebAdminLoginFormDisabled() && b.isWebAdminOIDCLoginDisabled() {
return errors.New("no login method available for WebAdmin UI")
}
@@ -823,9 +643,6 @@ func (b *Binding) checkLoginMethods() error {
return errors.New("no login method available for WebClient UI")
}
}
- if b.EnableRESTAPI && !b.hasLoginForAPI() {
- return errors.New("no login method available for REST API")
- }
return nil
}
@@ -853,13 +670,6 @@ func (b *Binding) isMutualTLSEnabled() bool {
return b.ClientAuthType == 1
}
-func (b *Binding) listenerWrapper() func(net.Listener) (net.Listener, error) {
- if b.ProxyMode == 1 {
- return common.Config.GetProxyListener
- }
- return nil
-}
-
type defenderStatus struct {
IsActive bool `json:"is_active"`
}
@@ -953,12 +763,6 @@ type Conf struct {
// By default all the available security checks are enabled. Set to 1 to disable the requirement
// that a token must be used by the same IP for which it was issued.
TokenValidation int `json:"token_validation" mapstructure:"token_validation"`
- // CookieLifetime defines the duration of cookies for WebAdmin and WebClient
- CookieLifetime int `json:"cookie_lifetime" mapstructure:"cookie_lifetime"`
- // ShareCookieLifetime defines the duration of cookies for public shares
- ShareCookieLifetime int `json:"share_cookie_lifetime" mapstructure:"share_cookie_lifetime"`
- // JWTLifetime defines the duration of JWT tokens used in REST API
- JWTLifetime int `json:"jwt_lifetime" mapstructure:"jwt_lifetime"`
// MaxUploadFileSize Defines the maximum request body size, in bytes, for Web Client/API HTTP upload requests.
// 0 means no limit
MaxUploadFileSize int64 `json:"max_upload_file_size" mapstructure:"max_upload_file_size"`
@@ -1067,7 +871,11 @@ func (c *Conf) getKeyPairs(configDir string) []common.TLSKeyPair {
}
func (c *Conf) setTokenValidationMode() {
- tokenValidationMode = c.TokenValidation
+ if c.TokenValidation == 1 {
+ tokenValidationMode = tokenValidationNoIPMatch
+ } else {
+ tokenValidationMode = tokenValidationFull
+ }
}
func (c *Conf) loadFromProvider() error {
@@ -1076,7 +884,6 @@ func (c *Conf) loadFromProvider() error {
return fmt.Errorf("unable to load config from provider: %w", err)
}
configs.SetNilsToEmpty()
- dbBrandingConfig.Set(configs.Branding)
if configs.ACME.Domain == "" || !configs.ACME.HasProtocol(common.ProtocolHTTP) {
return nil
}
@@ -1162,6 +969,7 @@ func (c *Conf) Initialize(configDir string, isShared int) error {
c.SigningPassphrase = passphrase
}
+ csrfTokenAuth = jwtauth.New(jwa.HS256.String(), getSigningKey(c.SigningPassphrase), nil)
hideSupportLink = c.HideSupportLink
exitChannel := make(chan error, 1)
@@ -1170,9 +978,11 @@ func (c *Conf) Initialize(configDir string, isShared int) error {
if !binding.IsValid() {
continue
}
- if err := binding.check(); err != nil {
+ if err := binding.parseAllowedProxy(); err != nil {
return err
}
+ binding.checkBranding()
+ binding.Security.updateProxyHeaders()
go func(b Binding) {
if err := b.OIDC.initialize(); err != nil {
@@ -1193,8 +1003,7 @@ func (c *Conf) Initialize(configDir string, isShared int) error {
maxUploadFileSize = c.MaxUploadFileSize
installationCode = c.Setup.InstallationCode
installationCodeHint = c.Setup.InstallationCodeHint
- updateTokensDuration(c.JWTLifetime, c.CookieLifetime, c.ShareCookieLifetime)
- startCleanupTicker(10 * time.Minute)
+ startCleanupTicker(tokenDuration / 2)
c.setTokenValidationMode()
return <-exitChannel
}
@@ -1367,12 +1176,10 @@ func updateWebAdminURLs(baseURL string) {
}
// GetHTTPRouter returns an HTTP handler suitable to use for test cases
-func GetHTTPRouter(b Binding) (http.Handler, error) {
+func GetHTTPRouter(b Binding) http.Handler {
server := newHttpdServer(b, filepath.Join("..", "..", "static"), "", CorsConfig{}, filepath.Join("..", "..", "openapi"))
- if err := server.initializeRouter(); err != nil {
- return nil, err
- }
- return server.router, nil
+ server.initializeRouter()
+ return server.router
}
// the ticker cannot be started/stopped from multiple goroutines
@@ -1410,14 +1217,11 @@ func stopCleanupTicker() {
}
func getSigningKey(signingPassphrase string) []byte {
- var key []byte
if signingPassphrase != "" {
- key = []byte(signingPassphrase)
- } else {
- key = util.GenerateRandomBytes(32)
+ sk := sha256.Sum256([]byte(signingPassphrase))
+ return sk[:]
}
- sk := sha256.Sum256(key)
- return sk[:]
+ return util.GenerateRandomBytes(32)
}
// SetInstallationCodeResolver sets a function to call to resolve the installation code
diff --git a/internal/httpd/httpd_test.go b/internal/httpd/httpd_test.go
index be4f8d88..8da9018b 100644
--- a/internal/httpd/httpd_test.go
+++ b/internal/httpd/httpd_test.go
@@ -20,9 +20,6 @@ import (
"encoding/json"
"errors"
"fmt"
- "image"
- "image/color"
- "image/png"
"io"
"io/fs"
"math"
@@ -36,7 +33,6 @@ import (
"path/filepath"
"regexp"
"runtime"
- "slices"
"strconv"
"strings"
"sync"
@@ -46,10 +42,9 @@ import (
"github.com/go-chi/render"
_ "github.com/go-sql-driver/mysql"
_ "github.com/jackc/pgx/v5/stdlib"
- "github.com/lithammer/shortuuid/v4"
+ "github.com/lithammer/shortuuid/v3"
_ "github.com/mattn/go-sqlite3"
"github.com/mhale/smtpd"
- "github.com/pkg/sftp"
"github.com/pquerna/otp"
"github.com/pquerna/otp/totp"
"github.com/rs/xid"
@@ -126,6 +121,7 @@ const (
user2FARecoveryCodesPath = "/api/v2/user/2fa/recoverycodes"
userProfilePath = "/api/v2/user/profile"
userSharesPath = "/api/v2/user/shares"
+ retentionBasePath = "/api/v2/retention/users"
fsEventsPath = "/api/v2/events/fs"
providerEventsPath = "/api/v2/events/provider"
logEventsPath = "/api/v2/events/logs"
@@ -328,7 +324,7 @@ type recoveryCode struct {
Used bool `json:"used"`
}
-func TestMain(m *testing.M) { //nolint:gocyclo
+func TestMain(m *testing.M) {
homeBasePath = os.TempDir()
logfilePath := filepath.Join(configDir, "sftpgo_api_test.log")
logger.InitLogger(logfilePath, 5, 1, 28, false, false, zerolog.DebugLevel)
@@ -480,12 +476,7 @@ func TestMain(m *testing.M) { //nolint:gocyclo
waitTCPListening(httpdConf.Bindings[0].GetAddress())
httpd.ReloadCertificateMgr() //nolint:errcheck
- handler, err := httpd.GetHTTPRouter(httpdConf.Bindings[0])
- if err != nil {
- logger.ErrorToConsole("unable to get http test handler: %v", err)
- os.Exit(1)
- }
- testServer = httptest.NewServer(handler)
+ testServer = httptest.NewServer(httpd.GetHTTPRouter(httpdConf.Bindings[0]))
defer testServer.Close()
exitCode := m.Run()
@@ -580,36 +571,29 @@ func TestInitialization(t *testing.T) {
assert.Contains(t, err.Error(), "oidc")
}
httpdConf.Bindings[0].OIDC = httpd.OIDC{}
- httpdConf.Bindings[0].BaseURL = "ftp://127.0.0.1"
- err = httpdConf.Initialize(configDir, isShared)
- if assert.Error(t, err) {
- assert.Contains(t, err.Error(), "URL schema")
- }
- httpdConf.Bindings[0].BaseURL = ""
httpdConf.Bindings[0].EnableWebClient = true
httpdConf.Bindings[0].EnableWebAdmin = true
- httpdConf.Bindings[0].EnableRESTAPI = true
- httpdConf.Bindings[0].DisabledLoginMethods = 14
+ httpdConf.Bindings[0].EnabledLoginMethods = 1
err = httpdConf.Initialize(configDir, isShared)
if assert.Error(t, err) {
assert.Contains(t, err.Error(), "no login method available for WebAdmin UI")
}
- httpdConf.Bindings[0].DisabledLoginMethods = 13
+ httpdConf.Bindings[0].EnabledLoginMethods = 2
err = httpdConf.Initialize(configDir, isShared)
if assert.Error(t, err) {
assert.Contains(t, err.Error(), "no login method available for WebAdmin UI")
}
- httpdConf.Bindings[0].DisabledLoginMethods = 9
+ httpdConf.Bindings[0].EnabledLoginMethods = 6
err = httpdConf.Initialize(configDir, isShared)
if assert.Error(t, err) {
assert.Contains(t, err.Error(), "no login method available for WebClient UI")
}
- httpdConf.Bindings[0].DisabledLoginMethods = 11
+ httpdConf.Bindings[0].EnabledLoginMethods = 4
err = httpdConf.Initialize(configDir, isShared)
if assert.Error(t, err) {
assert.Contains(t, err.Error(), "no login method available for WebClient UI")
}
- httpdConf.Bindings[0].DisabledLoginMethods = 12
+ httpdConf.Bindings[0].EnabledLoginMethods = 3
err = httpdConf.Initialize(configDir, isShared)
if assert.Error(t, err) {
assert.Contains(t, err.Error(), "no login method available for WebAdmin UI")
@@ -619,12 +603,6 @@ func TestInitialization(t *testing.T) {
if assert.Error(t, err) {
assert.Contains(t, err.Error(), "no login method available for WebClient UI")
}
- httpdConf.Bindings[0].EnableWebClient = false
- httpdConf.Bindings[0].DisabledLoginMethods = 240
- err = httpdConf.Initialize(configDir, isShared)
- if assert.Error(t, err) {
- assert.Contains(t, err.Error(), "no login method available for REST API")
- }
err = dataprovider.Close()
assert.NoError(t, err)
err = httpdConf.Initialize(configDir, isShared)
@@ -641,7 +619,6 @@ func TestInitialization(t *testing.T) {
func TestBasicUserHandling(t *testing.T) {
u := getTestUser()
u.Email = "user@user.com"
- u.Filters.AdditionalEmails = []string{"email1@user.com", "email2@user.com"}
user, resp, err := httpdtest.AddUser(u, http.StatusCreated)
assert.NoError(t, err, string(resp))
_, resp, err = httpdtest.AddUser(u, http.StatusConflict)
@@ -682,12 +659,6 @@ func TestBasicUserHandling(t *testing.T) {
assert.NoError(t, err)
assert.Contains(t, string(body), "Validation error: email")
- user.Email = ""
- user.Filters.AdditionalEmails = []string{"invalid@email"}
- _, body, err = httpdtest.UpdateUser(user, http.StatusBadRequest, "")
- assert.NoError(t, err)
- assert.Contains(t, string(body), "Validation error: email")
-
_, err = httpdtest.RemoveUser(user, http.StatusOK)
assert.NoError(t, err)
}
@@ -905,289 +876,6 @@ func TestTLSCert(t *testing.T) {
assert.NoError(t, err)
}
-func TestSortRelatedFolders(t *testing.T) {
- folder1 := util.GenerateUniqueID()
- folder2 := util.GenerateUniqueID()
- folder3 := util.GenerateUniqueID()
-
- f1 := vfs.BaseVirtualFolder{
- Name: folder1,
- MappedPath: filepath.Clean(os.TempDir()),
- }
- f2 := vfs.BaseVirtualFolder{
- Name: folder2,
- MappedPath: filepath.Clean(os.TempDir()),
- }
- f3 := vfs.BaseVirtualFolder{
- Name: folder3,
- MappedPath: filepath.Clean(os.TempDir()),
- }
- _, _, err := httpdtest.AddFolder(f1, http.StatusCreated)
- assert.NoError(t, err)
- _, _, err = httpdtest.AddFolder(f2, http.StatusCreated)
- assert.NoError(t, err)
- _, _, err = httpdtest.AddFolder(f3, http.StatusCreated)
- assert.NoError(t, err)
-
- u := getTestUser()
- u.VirtualFolders = []vfs.VirtualFolder{
- {
- BaseVirtualFolder: f1,
- VirtualPath: "/" + folder1,
- },
- {
- BaseVirtualFolder: f2,
- VirtualPath: "/" + folder2,
- },
- {
- BaseVirtualFolder: f3,
- VirtualPath: "/" + folder3,
- },
- }
- user, _, err := httpdtest.AddUser(u, http.StatusCreated)
- assert.NoError(t, err)
- user, _, err = httpdtest.GetUserByUsername(user.Username, http.StatusOK)
- assert.NoError(t, err)
- if assert.Len(t, user.VirtualFolders, 3) {
- assert.Equal(t, folder1, user.VirtualFolders[0].Name)
- assert.Equal(t, folder2, user.VirtualFolders[1].Name)
- assert.Equal(t, folder3, user.VirtualFolders[2].Name)
- }
- // Update
- user.VirtualFolders = []vfs.VirtualFolder{
- {
- BaseVirtualFolder: f2,
- VirtualPath: "/" + folder2,
- },
- {
- BaseVirtualFolder: f1,
- VirtualPath: "/" + folder1,
- },
- {
- BaseVirtualFolder: f3,
- VirtualPath: "/" + folder3,
- },
- }
- user, _, err = httpdtest.UpdateUser(user, http.StatusOK, "")
- assert.NoError(t, err)
- user, _, err = httpdtest.GetUserByUsername(user.Username, http.StatusOK)
- assert.NoError(t, err)
- if assert.Len(t, user.VirtualFolders, 3) {
- assert.Equal(t, folder2, user.VirtualFolders[0].Name)
- assert.Equal(t, folder1, user.VirtualFolders[1].Name)
- assert.Equal(t, folder3, user.VirtualFolders[2].Name)
- }
-
- g := getTestGroup()
- g.VirtualFolders = []vfs.VirtualFolder{
- {
- BaseVirtualFolder: f1,
- VirtualPath: "/" + folder1,
- },
- {
- BaseVirtualFolder: f2,
- VirtualPath: "/" + folder2,
- },
- {
- BaseVirtualFolder: f3,
- VirtualPath: "/" + folder3,
- },
- }
- group, _, err := httpdtest.AddGroup(g, http.StatusCreated)
- assert.NoError(t, err)
- group, _, err = httpdtest.GetGroupByName(group.Name, http.StatusOK)
- assert.NoError(t, err)
- if assert.Len(t, group.VirtualFolders, 3) {
- assert.Equal(t, folder1, group.VirtualFolders[0].Name)
- assert.Equal(t, folder2, group.VirtualFolders[1].Name)
- assert.Equal(t, folder3, group.VirtualFolders[2].Name)
- }
- group, _, err = httpdtest.GetGroupByName(group.Name, http.StatusOK)
- assert.NoError(t, err)
- group.VirtualFolders = []vfs.VirtualFolder{
- {
- BaseVirtualFolder: f3,
- VirtualPath: "/" + folder3,
- },
- {
- BaseVirtualFolder: f1,
- VirtualPath: "/" + folder1,
- },
- {
- BaseVirtualFolder: f2,
- VirtualPath: "/" + folder2,
- },
- }
- group, _, err = httpdtest.UpdateGroup(group, http.StatusOK)
- assert.NoError(t, err)
- group, _, err = httpdtest.GetGroupByName(group.Name, http.StatusOK)
- assert.NoError(t, err)
- if assert.Len(t, group.VirtualFolders, 3) {
- assert.Equal(t, folder3, group.VirtualFolders[0].Name)
- assert.Equal(t, folder1, group.VirtualFolders[1].Name)
- assert.Equal(t, folder2, group.VirtualFolders[2].Name)
- }
-
- _, err = httpdtest.RemoveUser(user, http.StatusOK)
- assert.NoError(t, err)
- _, err = httpdtest.RemoveGroup(group, http.StatusOK)
- assert.NoError(t, err)
-
- _, err = httpdtest.RemoveFolder(f1, http.StatusOK)
- assert.NoError(t, err)
- _, err = httpdtest.RemoveFolder(f2, http.StatusOK)
- assert.NoError(t, err)
- _, err = httpdtest.RemoveFolder(f3, http.StatusOK)
- assert.NoError(t, err)
-}
-
-func TestSortRelatedGroups(t *testing.T) {
- name1 := util.GenerateUniqueID()
- name2 := util.GenerateUniqueID()
- name3 := util.GenerateUniqueID()
-
- g1 := getTestGroup()
- g1.Name = name1
- g2 := getTestGroup()
- g2.Name = name2
- g3 := getTestGroup()
- g3.Name = name3
-
- group1, _, err := httpdtest.AddGroup(g1, http.StatusCreated)
- assert.NoError(t, err)
- group2, _, err := httpdtest.AddGroup(g2, http.StatusCreated)
- assert.NoError(t, err)
- group3, _, err := httpdtest.AddGroup(g3, http.StatusCreated)
- assert.NoError(t, err)
-
- u := getTestUser()
- u.Groups = []sdk.GroupMapping{
- {
- Name: name1,
- },
- }
- _, _, err = httpdtest.AddUser(u, http.StatusBadRequest)
- assert.NoError(t, err)
- u.Groups = []sdk.GroupMapping{
- {
- Name: name1,
- Type: sdk.GroupTypePrimary,
- },
- {
- Name: name2,
- Type: sdk.GroupTypeSecondary,
- },
- {
- Name: name3,
- Type: sdk.GroupTypeMembership,
- },
- }
- user, _, err := httpdtest.AddUser(u, http.StatusCreated)
- assert.NoError(t, err)
- user, _, err = httpdtest.GetUserByUsername(user.Username, http.StatusOK)
- assert.NoError(t, err)
- if assert.Len(t, user.Groups, 3) {
- assert.Equal(t, name1, user.Groups[0].Name)
- assert.Equal(t, name2, user.Groups[1].Name)
- assert.Equal(t, name3, user.Groups[2].Name)
- }
- user.Groups = []sdk.GroupMapping{
- {
- Name: name2,
- Type: sdk.GroupTypeSecondary,
- },
- {
- Name: name3,
- Type: sdk.GroupTypeMembership,
- },
- {
- Name: name1,
- Type: sdk.GroupTypePrimary,
- },
- }
- user, _, err = httpdtest.UpdateUser(user, http.StatusOK, "")
- assert.NoError(t, err)
- user, _, err = httpdtest.GetUserByUsername(user.Username, http.StatusOK)
- assert.NoError(t, err)
- if assert.Len(t, user.Groups, 3) {
- assert.Equal(t, name2, user.Groups[0].Name)
- assert.Equal(t, name3, user.Groups[1].Name)
- assert.Equal(t, name1, user.Groups[2].Name)
- }
-
- a := getTestAdmin()
- a.Username = altAdminUsername
- a.Groups = []dataprovider.AdminGroupMapping{
- {
- Name: name3,
- Options: dataprovider.AdminGroupMappingOptions{
- AddToUsersAs: dataprovider.GroupAddToUsersAsSecondary,
- },
- },
- {
- Name: name2,
- Options: dataprovider.AdminGroupMappingOptions{
- AddToUsersAs: dataprovider.GroupAddToUsersAsPrimary,
- },
- },
- {
- Name: name1,
- Options: dataprovider.AdminGroupMappingOptions{
- AddToUsersAs: dataprovider.GroupAddToUsersAsMembership,
- },
- },
- }
- admin, _, err := httpdtest.AddAdmin(a, http.StatusCreated)
- assert.NoError(t, err)
- admin, _, err = httpdtest.GetAdminByUsername(admin.Username, http.StatusOK)
- assert.NoError(t, err)
- if assert.Len(t, admin.Groups, 3) {
- assert.Equal(t, name3, admin.Groups[0].Name)
- assert.Equal(t, name2, admin.Groups[1].Name)
- assert.Equal(t, name1, admin.Groups[2].Name)
- }
- admin.Groups = []dataprovider.AdminGroupMapping{
- {
- Name: name1,
- Options: dataprovider.AdminGroupMappingOptions{
- AddToUsersAs: dataprovider.GroupAddToUsersAsPrimary,
- },
- },
- {
- Name: name3,
- Options: dataprovider.AdminGroupMappingOptions{
- AddToUsersAs: dataprovider.GroupAddToUsersAsMembership,
- },
- },
- {
- Name: name2,
- Options: dataprovider.AdminGroupMappingOptions{
- AddToUsersAs: dataprovider.GroupAddToUsersAsSecondary,
- },
- },
- }
- admin, _, err = httpdtest.UpdateAdmin(admin, http.StatusOK)
- assert.NoError(t, err)
- admin, _, err = httpdtest.GetAdminByUsername(admin.Username, http.StatusOK)
- assert.NoError(t, err)
- if assert.Len(t, admin.Groups, 3) {
- assert.Equal(t, name1, admin.Groups[0].Name)
- assert.Equal(t, name3, admin.Groups[1].Name)
- assert.Equal(t, name2, admin.Groups[2].Name)
- }
-
- _, err = httpdtest.RemoveUser(user, http.StatusOK)
- assert.NoError(t, err)
- _, err = httpdtest.RemoveAdmin(admin, http.StatusOK)
- assert.NoError(t, err)
- _, err = httpdtest.RemoveGroup(group1, http.StatusOK)
- assert.NoError(t, err)
- _, err = httpdtest.RemoveGroup(group2, http.StatusOK)
- assert.NoError(t, err)
- _, err = httpdtest.RemoveGroup(group3, http.StatusOK)
- assert.NoError(t, err)
-}
-
func TestBasicGroupHandling(t *testing.T) {
g := getTestGroup()
g.UserSettings.Filters.TLSCerts = []string{"invalid cert"} // ignored for groups
@@ -1651,25 +1339,25 @@ func TestGroupSettingsOverride(t *testing.T) {
var folderNames []string
if assert.Len(t, user.VirtualFolders, 4) {
for _, f := range user.VirtualFolders {
- if !slices.Contains(folderNames, f.Name) {
+ if !util.Contains(folderNames, f.Name) {
folderNames = append(folderNames, f.Name)
}
switch f.Name {
case folderName1:
assert.Equal(t, mappedPath1, f.MappedPath)
- assert.Equal(t, 3, f.FsConfig.OSConfig.ReadBufferSize)
- assert.Equal(t, 5, f.FsConfig.OSConfig.WriteBufferSize)
- assert.True(t, slices.Contains([]string{"/vdir1", "/vdir2"}, f.VirtualPath))
+ assert.Equal(t, 3, f.BaseVirtualFolder.FsConfig.OSConfig.ReadBufferSize)
+ assert.Equal(t, 5, f.BaseVirtualFolder.FsConfig.OSConfig.WriteBufferSize)
+ assert.True(t, util.Contains([]string{"/vdir1", "/vdir2"}, f.VirtualPath))
case folderName2:
assert.Equal(t, mappedPath2, f.MappedPath)
assert.Equal(t, "/vdir3", f.VirtualPath)
- assert.Equal(t, 0, f.FsConfig.OSConfig.ReadBufferSize)
- assert.Equal(t, 0, f.FsConfig.OSConfig.WriteBufferSize)
+ assert.Equal(t, 0, f.BaseVirtualFolder.FsConfig.OSConfig.ReadBufferSize)
+ assert.Equal(t, 0, f.BaseVirtualFolder.FsConfig.OSConfig.WriteBufferSize)
case folderName3:
assert.Equal(t, mappedPath3, f.MappedPath)
assert.Equal(t, "/vdir4", f.VirtualPath)
- assert.Equal(t, 1, f.FsConfig.OSConfig.ReadBufferSize)
- assert.Equal(t, 2, f.FsConfig.OSConfig.WriteBufferSize)
+ assert.Equal(t, 1, f.BaseVirtualFolder.FsConfig.OSConfig.ReadBufferSize)
+ assert.Equal(t, 2, f.BaseVirtualFolder.FsConfig.OSConfig.WriteBufferSize)
}
}
}
@@ -1789,19 +1477,6 @@ func TestGroupSettingsOverride(t *testing.T) {
assert.Contains(t, user.Filters.WebClient, sdk.WebClientInfoChangeDisabled)
assert.Contains(t, user.Filters.WebClient, sdk.WebClientMFADisabled)
}
- // Attempt to create a user with a weak password and group1 as the primary group: this should fail
- u = getTestUser()
- u.Username = rand.Text()
- u.Password = defaultPassword
- u.Groups = []sdk.GroupMapping{
- {
- Name: group1.Name,
- Type: sdk.GroupTypePrimary,
- },
- }
- _, resp, err = httpdtest.AddUser(u, http.StatusBadRequest)
- assert.NoError(t, err)
- assert.Contains(t, string(resp), "insecure password")
err = os.RemoveAll(user.GetHomeDir())
assert.NoError(t, err)
@@ -2093,7 +1768,7 @@ func TestIPListEntriesValidation(t *testing.T) {
}
func TestBasicActionRulesHandling(t *testing.T) {
- actionName := "test_action"
+ actionName := "test action"
a := dataprovider.BaseEventAction{
Name: actionName,
Description: "test description",
@@ -2169,9 +1844,9 @@ func TestBasicActionRulesHandling(t *testing.T) {
EmailConfig: dataprovider.EventActionEmailConfig{
Recipients: []string{"email@example.com"},
Bcc: []string{"bcc@example.com"},
- Subject: "Event: {{.Event}}",
+ Subject: "Event: {{Event}}",
Body: "test mail body",
- Attachments: []string{"/{{.VirtualPath}}"},
+ Attachments: []string{"/{{VirtualPath}}"},
},
}
@@ -2209,7 +1884,7 @@ func TestBasicActionRulesHandling(t *testing.T) {
Value: "b",
},
},
- Body: `{"event":"{{.Event}}","name":"{{.Name}}"}`,
+ Body: `{"event":"{{Event}}","name":"{{Name}}"}`,
},
}
action, _, err = httpdtest.UpdateEventAction(a, http.StatusOK)
@@ -2233,7 +1908,7 @@ func TestBasicActionRulesHandling(t *testing.T) {
assert.Equal(t, defaultPassword, dbAction.Options.HTTPConfig.Password.GetPayload())
r := dataprovider.EventRule{
- Name: "test_rule_name",
+ Name: "test rule name",
Status: 1,
Description: "",
Trigger: dataprovider.EventTriggerFsEvent,
@@ -2432,16 +2107,16 @@ func TestActionRuleRelations(t *testing.T) {
action1, _, err = httpdtest.GetEventActionByName(action1.Name, http.StatusOK)
assert.NoError(t, err)
assert.Len(t, action1.Rules, 1)
- assert.True(t, slices.Contains(action1.Rules, rule1.Name))
+ assert.True(t, util.Contains(action1.Rules, rule1.Name))
action2, _, err = httpdtest.GetEventActionByName(action2.Name, http.StatusOK)
assert.NoError(t, err)
assert.Len(t, action2.Rules, 1)
- assert.True(t, slices.Contains(action2.Rules, rule2.Name))
+ assert.True(t, util.Contains(action2.Rules, rule2.Name))
action3, _, err = httpdtest.GetEventActionByName(action3.Name, http.StatusOK)
assert.NoError(t, err)
assert.Len(t, action3.Rules, 2)
- assert.True(t, slices.Contains(action3.Rules, rule1.Name))
- assert.True(t, slices.Contains(action3.Rules, rule2.Name))
+ assert.True(t, util.Contains(action3.Rules, rule1.Name))
+ assert.True(t, util.Contains(action3.Rules, rule2.Name))
// referenced actions cannot be removed
_, err = httpdtest.RemoveEventAction(action1, http.StatusBadRequest)
assert.NoError(t, err)
@@ -2469,7 +2144,7 @@ func TestActionRuleRelations(t *testing.T) {
action3, _, err = httpdtest.GetEventActionByName(action3.Name, http.StatusOK)
assert.NoError(t, err)
assert.Len(t, action3.Rules, 1)
- assert.True(t, slices.Contains(action3.Rules, rule1.Name))
+ assert.True(t, util.Contains(action3.Rules, rule1.Name))
_, err = httpdtest.RemoveEventRule(rule1, http.StatusOK)
assert.NoError(t, err)
@@ -2495,7 +2170,7 @@ func TestActionRuleRelations(t *testing.T) {
}
func TestOnDemandEventRules(t *testing.T) {
- ruleName := "test_on_demand_rule"
+ ruleName := "test on demand rule"
a := dataprovider.BaseEventAction{
Name: "a",
Type: dataprovider.ActionTypeBackup,
@@ -2536,7 +2211,7 @@ func TestOnDemandEventRules(t *testing.T) {
}
func TestIDPLoginEventRule(t *testing.T) {
- ruleName := "test_IDP_login_rule"
+ ruleName := "test IDP login rule"
a := dataprovider.BaseEventAction{
Name: "a",
Type: dataprovider.ActionTypeIDPAccountCheck,
@@ -2808,34 +2483,28 @@ func TestEventActionValidation(t *testing.T) {
_, resp, err = httpdtest.AddEventAction(action, http.StatusBadRequest)
assert.NoError(t, err)
assert.Contains(t, string(resp), "no path to rename specified")
- action.Options.FsConfig.Renames = []dataprovider.RenameConfig{
+ action.Options.FsConfig.Renames = []dataprovider.KeyValue{
{
- KeyValue: dataprovider.KeyValue{
- Key: "",
- Value: "/adir",
- },
+ Key: "",
+ Value: "/adir",
},
}
_, resp, err = httpdtest.AddEventAction(action, http.StatusBadRequest)
assert.NoError(t, err)
assert.Contains(t, string(resp), "invalid paths to rename")
- action.Options.FsConfig.Renames = []dataprovider.RenameConfig{
+ action.Options.FsConfig.Renames = []dataprovider.KeyValue{
{
- KeyValue: dataprovider.KeyValue{
- Key: "adir",
- Value: "/adir",
- },
+ Key: "adir",
+ Value: "/adir",
},
}
_, resp, err = httpdtest.AddEventAction(action, http.StatusBadRequest)
assert.NoError(t, err)
assert.Contains(t, string(resp), "rename source and target cannot be equal")
- action.Options.FsConfig.Renames = []dataprovider.RenameConfig{
+ action.Options.FsConfig.Renames = []dataprovider.KeyValue{
{
- KeyValue: dataprovider.KeyValue{
- Key: "/",
- Value: "/dir",
- },
+ Key: "/",
+ Value: "/dir",
},
}
_, resp, err = httpdtest.AddEventAction(action, http.StatusBadRequest)
@@ -3664,44 +3333,32 @@ func TestLoginRedirectNext(t *testing.T) {
checkResponseCode(t, http.StatusOK, rr)
assert.Contains(t, rr.Body.String(), fmt.Sprintf("action=%q", redirectURI))
// now login the user and check the redirect
- loginCookie, csrfToken, err := getCSRFTokenMock(webClientLoginPath, defaultRemoteAddr)
+ csrfToken, err := getCSRFTokenMock(webClientLoginPath, defaultRemoteAddr)
assert.NoError(t, err)
- assert.NotEmpty(t, loginCookie)
form := getLoginForm(defaultUsername, defaultPassword, csrfToken)
req, err = http.NewRequest(http.MethodPost, redirectURI, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
req.RequestURI = redirectURI
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusFound, rr)
assert.Equal(t, uri, rr.Header().Get("Location"))
// unsafe URI
- loginCookie, csrfToken, err = getCSRFTokenMock(webClientLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
- assert.NotEmpty(t, loginCookie)
- form = getLoginForm(defaultUsername, defaultPassword, csrfToken)
unsafeURI := webClientLoginPath + "?next=" + url.QueryEscape("http://example.net")
req, err = http.NewRequest(http.MethodPost, unsafeURI, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
req.RequestURI = unsafeURI
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusFound, rr)
assert.Equal(t, webClientFilesPath, rr.Header().Get("Location"))
- loginCookie, csrfToken, err = getCSRFTokenMock(webClientLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
- assert.NotEmpty(t, loginCookie)
- form = getLoginForm(defaultUsername, defaultPassword, csrfToken)
unsupportedURI := webClientLoginPath + "?next=" + url.QueryEscape(webClientProfilePath)
req, err = http.NewRequest(http.MethodPost, unsupportedURI, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
req.RequestURI = unsupportedURI
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusFound, rr)
@@ -3784,7 +3441,7 @@ func TestMustChangePasswordRequirement(t *testing.T) {
rr = executeRequest(req)
checkResponseCode(t, http.StatusForbidden, rr)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webChangeClientPwdPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webClientLoginPath)
assert.NoError(t, err)
form := make(url.Values)
form.Set(csrfFormToken, csrfToken)
@@ -4069,10 +3726,9 @@ func TestAdminMustChangePasswordRequirement(t *testing.T) {
setJWTCookieForReq(req, webToken)
rr := executeRequest(req)
checkResponseCode(t, http.StatusForbidden, rr)
- // The change password page should be accessible, we get the CSRF from it.
- csrfToken, err := getCSRFTokenFromInternalPageMock(webChangeAdminPwdPath, webToken)
- assert.NoError(t, err)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
+ assert.NoError(t, err)
form := make(url.Values)
form.Set(csrfFormToken, csrfToken)
form.Set("current_password", defaultTokenAuthPass)
@@ -5192,6 +4848,9 @@ func TestAddUserInvalidFsConfig(t *testing.T) {
u.FsConfig.AzBlobConfig.AccountName = "name"
_, _, err = httpdtest.AddUser(u, http.StatusBadRequest)
assert.NoError(t, err)
+ u.FsConfig.AzBlobConfig.Container = "container"
+ _, _, err = httpdtest.AddUser(u, http.StatusBadRequest)
+ assert.NoError(t, err)
u.FsConfig.AzBlobConfig.AccountKey = kms.NewSecret(sdkkms.SecretStatusRedacted, "key", "", "")
u.FsConfig.AzBlobConfig.KeyPrefix = "/amedir/subdir/"
_, _, err = httpdtest.AddUser(u, http.StatusBadRequest)
@@ -5295,12 +4954,6 @@ func TestUserRedactedPassword(t *testing.T) {
assert.Contains(t, err.Error(), "cannot save a user with a redacted secret")
}
u.FsConfig.S3Config.AccessSecret = kms.NewPlainSecret("secret")
- u.FsConfig.S3Config.SSECustomerKey = kms.NewSecret(sdkkms.SecretStatusRedacted, "mysecretkey", "", "")
- _, resp, err = httpdtest.AddUser(u, http.StatusBadRequest)
- assert.NoError(t, err, string(resp))
- assert.Contains(t, string(resp), "cannot save a user with a redacted secret")
-
- u.FsConfig.S3Config.SSECustomerKey = kms.NewPlainSecret("key")
user, _, err := httpdtest.AddUser(u, http.StatusCreated)
assert.NoError(t, err)
@@ -5349,13 +5002,6 @@ func TestRetentionAPI(t *testing.T) {
user, _, err := httpdtest.AddUser(getTestUser(), http.StatusCreated)
assert.NoError(t, err)
- t.Cleanup(func() {
- _, err = httpdtest.RemoveUser(user, http.StatusOK)
- assert.NoError(t, err)
- err = os.RemoveAll(user.GetHomeDir())
- assert.NoError(t, err)
- })
-
checks, _, err := httpdtest.GetRetentionChecks(http.StatusOK)
assert.NoError(t, err)
assert.Len(t, checks, 0)
@@ -5369,19 +5015,21 @@ func TestRetentionAPI(t *testing.T) {
folderRetention := []dataprovider.FolderRetention{
{
Path: "/",
- Retention: 24,
+ Retention: 0,
DeleteEmptyDirs: true,
},
}
- check := common.RetentionCheck{
- Folders: folderRetention,
- }
- c := common.RetentionChecks.Add(check, &user)
- require.NotNil(t, c)
+ _, err = httpdtest.StartRetentionCheck(altAdminUsername, folderRetention, http.StatusNotFound)
+ assert.NoError(t, err)
- err = c.Start()
- require.NoError(t, err)
+ resp, err := httpdtest.StartRetentionCheck(user.Username, folderRetention, http.StatusBadRequest)
+ assert.NoError(t, err)
+ assert.Contains(t, string(resp), "Invalid retention check")
+
+ folderRetention[0].Retention = 24
+ _, err = httpdtest.StartRetentionCheck(user.Username, folderRetention, http.StatusAccepted)
+ assert.NoError(t, err)
assert.Eventually(t, func() bool {
return len(common.RetentionChecks.Get("")) == 0
@@ -5392,8 +5040,8 @@ func TestRetentionAPI(t *testing.T) {
err = os.Chtimes(localFilePath, time.Now().Add(-48*time.Hour), time.Now().Add(-48*time.Hour))
assert.NoError(t, err)
- err = c.Start()
- require.NoError(t, err)
+ _, err = httpdtest.StartRetentionCheck(user.Username, folderRetention, http.StatusAccepted)
+ assert.NoError(t, err)
assert.Eventually(t, func() bool {
return len(common.RetentionChecks.Get("")) == 0
@@ -5402,25 +5050,54 @@ func TestRetentionAPI(t *testing.T) {
assert.NoFileExists(t, localFilePath)
assert.NoDirExists(t, filepath.Dir(localFilePath))
- c = common.RetentionChecks.Add(check, &user)
+ check := common.RetentionCheck{
+ Folders: folderRetention,
+ }
+ c := common.RetentionChecks.Add(check, &user)
assert.NotNil(t, c)
- assert.Nil(t, common.RetentionChecks.Add(check, &user)) // a check for this user is already in progress
-
- checks, _, err = httpdtest.GetRetentionChecks(http.StatusOK)
+ _, err = httpdtest.StartRetentionCheck(user.Username, folderRetention, http.StatusConflict)
assert.NoError(t, err)
- assert.Len(t, checks, 1)
err = c.Start()
assert.NoError(t, err)
+ assert.Len(t, common.RetentionChecks.Get(""), 0)
- assert.Eventually(t, func() bool {
- return len(common.RetentionChecks.Get("")) == 0
- }, 1000*time.Millisecond, 50*time.Millisecond)
-
- checks, _, err = httpdtest.GetRetentionChecks(http.StatusOK)
+ admin := getTestAdmin()
+ admin.Username = altAdminUsername
+ admin.Password = altAdminPassword
+ admin, _, err = httpdtest.AddAdmin(admin, http.StatusCreated)
+ assert.NoError(t, err)
+
+ token, err := getJWTAPITokenFromTestServer(altAdminUsername, altAdminPassword)
+ assert.NoError(t, err)
+ req, _ := http.NewRequest(http.MethodPost, retentionBasePath+"/"+user.Username+"/check",
+ bytes.NewBuffer([]byte("invalid json")))
+ setBearerForReq(req, token)
+ rr := executeRequest(req)
+ checkResponseCode(t, http.StatusBadRequest, rr)
+
+ asJSON, err := json.Marshal(folderRetention)
+ assert.NoError(t, err)
+ req, _ = http.NewRequest(http.MethodPost, retentionBasePath+"/"+user.Username+"/check?notifications=Email,",
+ bytes.NewBuffer(asJSON))
+ setBearerForReq(req, token)
+ rr = executeRequest(req)
+ checkResponseCode(t, http.StatusBadRequest, rr)
+ assert.Contains(t, rr.Body.String(), "to notify results via email")
+
+ _, err = httpdtest.RemoveAdmin(admin, http.StatusOK)
+ assert.NoError(t, err)
+ req, _ = http.NewRequest(http.MethodPost, retentionBasePath+"/"+user.Username+"/check?notifications=Email",
+ bytes.NewBuffer(asJSON))
+ setBearerForReq(req, token)
+ rr = executeRequest(req)
+ checkResponseCode(t, http.StatusNotFound, rr)
+
+ _, err = httpdtest.RemoveUser(user, http.StatusOK)
+ assert.NoError(t, err)
+ err = os.RemoveAll(user.GetHomeDir())
assert.NoError(t, err)
- assert.Len(t, checks, 0)
}
func TestAddUserInvalidVirtualFolders(t *testing.T) {
@@ -5550,13 +5227,6 @@ func TestUserPublicKey(t *testing.T) {
_, err = httpdtest.RemoveUser(user, http.StatusOK)
assert.NoError(t, err)
- // DSA keys are not accepted
- u = getTestUser()
- u.Password = ""
- u.PublicKeys = []string{"ssh-dss AAAAB3NzaC1kc3MAAACBAK+BKLZs1Vd0cWYOquKfp++0ml9hkzB7UDRozT3nhRcyHcuwASsXiVTqsg96oGjBcUUy076CXlsfJEXE2P0dF6tt1wvABPMwKpOn+kIrfJ0j93X2c2KIZNlD4YuNUJjLHu1DvgQHw8NMps6l5D0M5NFCRdD3NYhI5zFVJJ4CzikrAAAAFQCRBagw7gEbs0gd8So7OLMcSVzs/wAAAIBjuo7U9q8npchQ3otgCvj0xIwsQ+Fi9bH0SBceqbCcVzFYY6JXSQ0XmwHs+0AuvRCPIGaBdfcm+w+9YOxREtdEVjcmkYlfJpTaVljjWcWFWTQddbiamZhQ/xLU9CNLK4oYLwIGLZjCcG7nRDdLtLQdBFuzP/faEi3TD2BK114QmAAAAIEAj1n34pH2WKwbSZhzmz/OG0VzqJICFWboiM44LZl2AqcRBvEEycdHlGe2IKaj5lEtLgBKJt9NSFhBIzWh7gcEzSMlkiDecdYSFlDc4snmTiXaoiIehV59nTY6gc8GLWCzuem+WdHxvJ4yOSWF9k+a+Y+/v/35shNLkfokViOlN7k="}
- _, resp, err := httpdtest.AddUser(u, http.StatusBadRequest)
- assert.NoError(t, err)
- assert.Contains(t, string(resp), "DSA key format is insecure and it is not allowed")
}
func TestUpdateUserEmptyPassword(t *testing.T) {
@@ -6003,7 +5673,6 @@ func TestUserS3Config(t *testing.T) {
user.FsConfig.S3Config.Bucket = "test" //nolint:goconst
user.FsConfig.S3Config.AccessKey = "Server-Access-Key"
user.FsConfig.S3Config.AccessSecret = kms.NewPlainSecret("Server-Access-Secret")
- user.FsConfig.S3Config.SSECustomerKey = kms.NewPlainSecret("SSE-encryption-key")
user.FsConfig.S3Config.RoleARN = "myRoleARN"
user.FsConfig.S3Config.Endpoint = "http://127.0.0.1:9000"
user.FsConfig.S3Config.UploadPartSize = 8
@@ -6037,10 +5706,6 @@ func TestUserS3Config(t *testing.T) {
assert.NotEmpty(t, user.FsConfig.S3Config.AccessSecret.GetPayload())
assert.Empty(t, user.FsConfig.S3Config.AccessSecret.GetAdditionalData())
assert.Empty(t, user.FsConfig.S3Config.AccessSecret.GetKey())
- assert.Equal(t, sdkkms.SecretStatusSecretBox, user.FsConfig.S3Config.SSECustomerKey.GetStatus())
- assert.NotEmpty(t, user.FsConfig.S3Config.SSECustomerKey.GetPayload())
- assert.Empty(t, user.FsConfig.S3Config.SSECustomerKey.GetAdditionalData())
- assert.Empty(t, user.FsConfig.S3Config.SSECustomerKey.GetKey())
assert.Equal(t, 60, user.FsConfig.S3Config.DownloadPartMaxTime)
assert.Equal(t, 40, user.FsConfig.S3Config.UploadPartMaxTime)
assert.True(t, user.FsConfig.S3Config.SkipTLSVerify)
@@ -6065,14 +5730,13 @@ func TestUserS3Config(t *testing.T) {
user.ID = 0
user.CreatedAt = 0
user.VirtualFolders = nil
- user.FsConfig.S3Config.SSECustomerKey = kms.NewEmptySecret()
secret := kms.NewSecret(sdkkms.SecretStatusSecretBox, "Server-Access-Secret", "", "")
user.FsConfig.S3Config.AccessSecret = secret
_, _, err = httpdtest.AddUser(user, http.StatusCreated)
assert.Error(t, err)
user.FsConfig.S3Config.AccessSecret.SetStatus(sdkkms.SecretStatusPlain)
- user, resp, err := httpdtest.AddUser(user, http.StatusCreated)
- assert.NoError(t, err, string(resp))
+ user, _, err = httpdtest.AddUser(user, http.StatusCreated)
+ assert.NoError(t, err)
initialSecretPayload := user.FsConfig.S3Config.AccessSecret.GetPayload()
assert.Equal(t, sdkkms.SecretStatusSecretBox, user.FsConfig.S3Config.AccessSecret.GetStatus())
assert.NotEmpty(t, initialSecretPayload)
@@ -6449,7 +6113,6 @@ func TestUserHiddenFields(t *testing.T) {
u1.FsConfig.S3Config.Region = "us-east-1"
u1.FsConfig.S3Config.AccessKey = "S3-Access-Key"
u1.FsConfig.S3Config.AccessSecret = kms.NewPlainSecret("S3-Access-Secret")
- u1.FsConfig.S3Config.SSECustomerKey = kms.NewPlainSecret("SSE-secret-key")
user1, _, err := httpdtest.AddUser(u1, http.StatusCreated)
assert.NoError(t, err)
@@ -6522,10 +6185,6 @@ func TestUserHiddenFields(t *testing.T) {
assert.Empty(t, user1.FsConfig.S3Config.AccessSecret.GetAdditionalData())
assert.NotEmpty(t, user1.FsConfig.S3Config.AccessSecret.GetStatus())
assert.NotEmpty(t, user1.FsConfig.S3Config.AccessSecret.GetPayload())
- assert.Empty(t, user1.FsConfig.S3Config.SSECustomerKey.GetKey())
- assert.Empty(t, user1.FsConfig.S3Config.SSECustomerKey.GetAdditionalData())
- assert.NotEmpty(t, user1.FsConfig.S3Config.SSECustomerKey.GetStatus())
- assert.NotEmpty(t, user1.FsConfig.S3Config.SSECustomerKey.GetPayload())
user2, _, err = httpdtest.GetUserByUsername(user2.Username, http.StatusOK)
assert.NoError(t, err)
@@ -6580,22 +6239,12 @@ func TestUserHiddenFields(t *testing.T) {
assert.NotEmpty(t, user1.FsConfig.S3Config.AccessSecret.GetAdditionalData())
assert.NotEmpty(t, user1.FsConfig.S3Config.AccessSecret.GetStatus())
assert.NotEmpty(t, user1.FsConfig.S3Config.AccessSecret.GetPayload())
- assert.NotEmpty(t, user1.FsConfig.S3Config.SSECustomerKey.GetKey())
- assert.NotEmpty(t, user1.FsConfig.S3Config.SSECustomerKey.GetAdditionalData())
- assert.NotEmpty(t, user1.FsConfig.S3Config.SSECustomerKey.GetStatus())
- assert.NotEmpty(t, user1.FsConfig.S3Config.SSECustomerKey.GetPayload())
err = user1.FsConfig.S3Config.AccessSecret.Decrypt()
assert.NoError(t, err)
- err = user1.FsConfig.S3Config.SSECustomerKey.Decrypt()
- assert.NoError(t, err)
assert.Equal(t, sdkkms.SecretStatusPlain, user1.FsConfig.S3Config.AccessSecret.GetStatus())
assert.Equal(t, u1.FsConfig.S3Config.AccessSecret.GetPayload(), user1.FsConfig.S3Config.AccessSecret.GetPayload())
assert.Empty(t, user1.FsConfig.S3Config.AccessSecret.GetKey())
assert.Empty(t, user1.FsConfig.S3Config.AccessSecret.GetAdditionalData())
- assert.Equal(t, sdkkms.SecretStatusPlain, user1.FsConfig.S3Config.SSECustomerKey.GetStatus())
- assert.Equal(t, u1.FsConfig.S3Config.SSECustomerKey.GetPayload(), user1.FsConfig.S3Config.SSECustomerKey.GetPayload())
- assert.Empty(t, user1.FsConfig.S3Config.SSECustomerKey.GetKey())
- assert.Empty(t, user1.FsConfig.S3Config.SSECustomerKey.GetAdditionalData())
user2, err = dataprovider.UserExists(user2.Username, "")
assert.NoError(t, err)
@@ -7032,7 +6681,6 @@ func TestCloseActiveConnection(t *testing.T) {
_, err = httpdtest.CloseConnection(c.GetID(), http.StatusOK)
assert.NoError(t, err)
assert.Len(t, common.Connections.GetStats(""), 0)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
}
func TestCloseConnectionAfterUserUpdateDelete(t *testing.T) {
@@ -7065,7 +6713,6 @@ func TestCloseConnectionAfterUserUpdateDelete(t *testing.T) {
_, err = httpdtest.RemoveUser(user, http.StatusOK)
assert.NoError(t, err)
assert.Len(t, common.Connections.GetStats(""), 0)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
}
func TestAdminGenerateRecoveryCodesSaveError(t *testing.T) {
@@ -7124,57 +6771,6 @@ func TestAdminGenerateRecoveryCodesSaveError(t *testing.T) {
assert.NoError(t, err)
}
-func TestAdminCredentialsWithSpaces(t *testing.T) {
- a := getTestAdmin()
- a.Username = xid.New().String()
- a.Password = " " + xid.New().String() + " "
- admin, _, err := httpdtest.AddAdmin(a, http.StatusCreated)
- assert.NoError(t, err)
- // For admins the password is always trimmed.
- _, err = getJWTAPITokenFromTestServer(a.Username, a.Password)
- assert.Error(t, err)
- _, err = getJWTAPITokenFromTestServer(a.Username, strings.TrimSpace(a.Password))
- assert.NoError(t, err)
- // The password sent from the WebAdmin UI is automatically trimmed
- _, err = getJWTWebToken(a.Username, a.Password)
- assert.NoError(t, err)
- _, err = getJWTWebToken(a.Username, strings.TrimSpace(a.Password))
- assert.NoError(t, err)
-
- _, err = httpdtest.RemoveAdmin(admin, http.StatusOK)
- assert.NoError(t, err)
-}
-
-func TestUserCredentialsWithSpaces(t *testing.T) {
- u := getTestUser()
- u.Password = " " + xid.New().String() + " "
- user, _, err := httpdtest.AddUser(u, http.StatusCreated)
- assert.NoError(t, err)
- // For users the password is not trimmed
- _, err = getJWTAPIUserTokenFromTestServer(u.Username, u.Password)
- assert.NoError(t, err)
- _, err = getJWTAPIUserTokenFromTestServer(u.Username, strings.TrimSpace(u.Password))
- assert.Error(t, err)
-
- _, err = getJWTWebClientTokenFromTestServer(u.Username, u.Password)
- assert.NoError(t, err)
- _, err = getJWTWebClientTokenFromTestServer(u.Username, strings.TrimSpace(u.Password))
- assert.Error(t, err)
-
- user.Password = u.Password
- conn, sftpClient, err := getSftpClient(user)
- if assert.NoError(t, err) {
- conn.Close()
- sftpClient.Close()
- }
- user.Password = strings.TrimSpace(u.Password)
- _, _, err = getSftpClient(user)
- assert.Error(t, err)
-
- _, err = httpdtest.RemoveUser(user, http.StatusOK)
- assert.NoError(t, err)
-}
-
func TestNamingRules(t *testing.T) {
smtpCfg := smtp.Config{
Host: "127.0.0.1",
@@ -7270,9 +6866,9 @@ func TestNamingRules(t *testing.T) {
return
}
- token, err = getJWTWebClientTokenFromTestServer(user.Username, defaultPassword)
+ csrfToken, err := getCSRFToken(httpBaseURL + webClientLoginPath)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webClientProfilePath, token)
+ token, err = getJWTWebClientTokenFromTestServer(user.Username, defaultPassword)
assert.NoError(t, err)
form := make(url.Values)
form.Set(csrfFormToken, csrfToken)
@@ -7284,8 +6880,6 @@ func TestNamingRules(t *testing.T) {
checkResponseCode(t, http.StatusOK, rr)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidUser)
// test user reset password. Setting the new password will fail because the username is not valid
- loginCookie, csrfToken, err := getCSRFTokenMock(webClientLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
form = make(url.Values)
form.Set("username", user.Username)
form.Set(csrfFormToken, csrfToken)
@@ -7293,7 +6887,6 @@ func TestNamingRules(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webClientForgotPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
@@ -7306,7 +6899,6 @@ func TestNamingRules(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webClientResetPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -7348,7 +6940,7 @@ func TestNamingRules(t *testing.T) {
token, err = getJWTWebTokenFromTestServer(admin.Username, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err = getCSRFTokenFromInternalPageMock(webAdminProfilePath, token)
+ csrfToken, err = getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
form = make(url.Values)
form.Set(csrfFormToken, csrfToken)
@@ -7379,8 +6971,6 @@ func TestNamingRules(t *testing.T) {
checkResponseCode(t, http.StatusBadRequest, rr)
assert.Contains(t, rr.Body.String(), "the following characters are allowed")
// test admin reset password
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
form = make(url.Values)
form.Set("username", admin.Username)
form.Set(csrfFormToken, csrfToken)
@@ -7388,13 +6978,10 @@ func TestNamingRules(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webAdminForgotPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
assert.GreaterOrEqual(t, len(lastResetCode), 20)
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
form = make(url.Values)
form.Set(csrfFormToken, csrfToken)
form.Set("code", lastResetCode)
@@ -7403,7 +6990,6 @@ func TestNamingRules(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webAdminResetPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -7555,13 +7141,12 @@ func TestSaveErrors(t *testing.T) {
assert.NoError(t, err)
assert.Contains(t, string(resp), "the following characters are allowed")
- loginCookie, csrfToken, err := getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
form := getLoginForm(a.Username, a.Password, csrfToken)
req, err := http.NewRequest(http.MethodPost, webLoginPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr := executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
@@ -7569,8 +7154,6 @@ func TestSaveErrors(t *testing.T) {
cookie, err := getCookieFromResponse(rr)
assert.NoError(t, err)
- csrfToken, err = getCSRFTokenFromInternalPageMock(webAdminTwoFactorRecoveryPath, cookie)
- assert.NoError(t, err)
form = make(url.Values)
form.Set("recovery_code", recCode)
form.Set(csrfFormToken, csrfToken)
@@ -7583,13 +7166,12 @@ func TestSaveErrors(t *testing.T) {
assert.Equal(t, http.StatusInternalServerError, rr.Code)
assert.Contains(t, rr.Body.String(), util.I18nError500Message)
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
+ csrfToken, err = getCSRFToken(httpBaseURL + webClientLoginPath)
assert.NoError(t, err)
form = getLoginForm(u.Username, u.Password, csrfToken)
req, err = http.NewRequest(http.MethodPost, webClientLoginPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
@@ -7597,8 +7179,6 @@ func TestSaveErrors(t *testing.T) {
cookie, err = getCookieFromResponse(rr)
assert.NoError(t, err)
- csrfToken, err = getCSRFTokenFromInternalPageMock(webClientTwoFactorRecoveryPath, cookie)
- assert.NoError(t, err)
form = make(url.Values)
form.Set("recovery_code", recCode)
form.Set(csrfFormToken, csrfToken)
@@ -7741,7 +7321,7 @@ func TestProviderErrors(t *testing.T) {
rr = executeRequest(req)
checkResponseCode(t, http.StatusInternalServerError, rr)
// password reset errors
- loginCookie, csrfToken, err := getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
form := make(url.Values)
form.Set("username", "username")
@@ -7749,7 +7329,6 @@ func TestProviderErrors(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webClientForgotPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -7876,7 +7455,7 @@ func TestProviderErrors(t *testing.T) {
backupData = dataprovider.BackupData{
EventActions: []dataprovider.BaseEventAction{
{
- Name: "quota_reset",
+ Name: "quota reset",
Type: dataprovider.ActionTypeFolderQuotaReset,
},
},
@@ -7891,7 +7470,7 @@ func TestProviderErrors(t *testing.T) {
backupData = dataprovider.BackupData{
EventRules: []dataprovider.EventRule{
{
- Name: "quota_reset",
+ Name: "quota reset",
Trigger: dataprovider.EventTriggerSchedule,
Conditions: dataprovider.EventConditions{
Schedules: []dataprovider.Schedule{
@@ -8685,7 +8264,7 @@ func TestLoaddata(t *testing.T) {
}
action := dataprovider.BaseEventAction{
ID: 81,
- Name: "test_restore_action",
+ Name: "test restore action",
Type: dataprovider.ActionTypeHTTP,
Options: dataprovider.BaseEventActionOptions{
HTTPConfig: dataprovider.EventActionHTTPConfig{
@@ -8695,13 +8274,13 @@ func TestLoaddata(t *testing.T) {
Timeout: 10,
SkipTLSVerify: true,
Method: http.MethodPost,
- Body: `{"event":"{{.Event}}","name":"{{.Name}}"}`,
+ Body: `{"event":"{{Event}}","name":"{{Name}}"}`,
},
},
}
rule := dataprovider.EventRule{
ID: 100,
- Name: "test_rule_restore",
+ Name: "test rule restore",
Description: "",
Trigger: dataprovider.EventTriggerFsEvent,
Conditions: dataprovider.EventConditions{
@@ -8719,7 +8298,7 @@ func TestLoaddata(t *testing.T) {
configs := dataprovider.Configs{
SFTPD: &dataprovider.SFTPDConfigs{
HostKeyAlgos: []string{ssh.KeyAlgoRSA, ssh.CertAlgoRSAv01},
- PublicKeyAlgos: []string{ssh.InsecureKeyAlgoDSA}, //nolint:staticcheck
+ PublicKeyAlgos: []string{ssh.InsecureKeyAlgoDSA},
},
SMTP: &dataprovider.SMTPConfigs{
Host: "mail.example.com",
@@ -8786,7 +8365,7 @@ func TestLoaddata(t *testing.T) {
assert.NoError(t, err)
assert.Equal(t, configs.SMTP, configsGet.SMTP)
assert.Equal(t, []string{ssh.KeyAlgoRSA}, configsGet.SFTPD.HostKeyAlgos)
- assert.Equal(t, []string{ssh.InsecureKeyAlgoDSA}, configsGet.SFTPD.PublicKeyAlgos) //nolint:staticcheck
+ assert.Equal(t, []string{ssh.InsecureKeyAlgoDSA}, configsGet.SFTPD.PublicKeyAlgos)
assert.Len(t, configsGet.SFTPD.KexAlgorithms, 0)
assert.Len(t, configsGet.SFTPD.Ciphers, 0)
assert.Len(t, configsGet.SFTPD.MACs, 0)
@@ -8941,85 +8520,6 @@ func TestLoaddata(t *testing.T) {
assert.NoError(t, err)
}
-func TestLoaddataConvertActions(t *testing.T) {
- a1 := dataprovider.BaseEventAction{
- Name: xid.New().String(),
- Type: dataprovider.ActionTypeEmail,
- Options: dataprovider.BaseEventActionOptions{
- EmailConfig: dataprovider.EventActionEmailConfig{
- Recipients: []string{"failure@example.com"},
- Subject: `Failed "{{Event}}" from "{{Name}}"`,
- Body: "Object name: {{ObjectName}} object type: {{ObjectType}}, IP: {{IP}}",
- },
- },
- }
- a2 := dataprovider.BaseEventAction{
- Name: xid.New().String(),
- Type: dataprovider.ActionTypeFilesystem,
- Options: dataprovider.BaseEventActionOptions{
- FsConfig: dataprovider.EventActionFilesystemConfig{
- Type: dataprovider.FilesystemActionRename,
- Renames: []dataprovider.RenameConfig{
- {
- KeyValue: dataprovider.KeyValue{
- Key: "/{{VirtualDirPath}}/{{ObjectName}}",
- Value: "/{{ObjectName}}_renamed",
- },
- },
- },
- },
- },
- }
- backupData := dataprovider.BackupData{
- EventActions: []dataprovider.BaseEventAction{a1, a2},
- Version: 16,
- }
- backupContent, err := json.Marshal(backupData)
- assert.NoError(t, err)
- backupFilePath := filepath.Join(backupsPath, "backup.json")
- err = os.WriteFile(backupFilePath, backupContent, os.ModePerm)
- assert.NoError(t, err)
- _, resp, err := httpdtest.Loaddata(backupFilePath, "1", "2", http.StatusOK)
- assert.NoError(t, err, string(resp))
- // Check that actions are migrated.
- action1, _, err := httpdtest.GetEventActionByName(a1.Name, http.StatusOK)
- assert.NoError(t, err)
- action2, _, err := httpdtest.GetEventActionByName(a2.Name, http.StatusOK)
- assert.NoError(t, err)
- assert.Equal(t, `Failed "{{.Event}}" from "{{.Name}}"`, action1.Options.EmailConfig.Subject)
- assert.Equal(t, `Object name: {{.ObjectName}} object type: {{.ObjectType}}, IP: {{.IP}}`, action1.Options.EmailConfig.Body)
- assert.Equal(t, `/{{.VirtualDirPath}}/{{.ObjectName}}`, action2.Options.FsConfig.Renames[0].Key)
- assert.Equal(t, `/{{.ObjectName}}_renamed`, action2.Options.FsConfig.Renames[0].Value)
- // If we restore a backup from the current version actions are not migrated.
- backupData = dataprovider.BackupData{
- EventActions: []dataprovider.BaseEventAction{a1, a2},
- Version: dataprovider.DumpVersion,
- }
- backupContent, err = json.Marshal(backupData)
- assert.NoError(t, err)
- backupFilePath = filepath.Join(backupsPath, "backup.json")
- err = os.WriteFile(backupFilePath, backupContent, os.ModePerm)
- assert.NoError(t, err)
- _, resp, err = httpdtest.Loaddata(backupFilePath, "1", "2", http.StatusOK)
- assert.NoError(t, err, string(resp))
- action1, _, err = httpdtest.GetEventActionByName(a1.Name, http.StatusOK)
- assert.NoError(t, err)
- action2, _, err = httpdtest.GetEventActionByName(a2.Name, http.StatusOK)
- assert.NoError(t, err)
- assert.Equal(t, `Failed "{{Event}}" from "{{Name}}"`, action1.Options.EmailConfig.Subject)
- assert.Equal(t, `Object name: {{ObjectName}} object type: {{ObjectType}}, IP: {{IP}}`, action1.Options.EmailConfig.Body)
- assert.Equal(t, `/{{VirtualDirPath}}/{{ObjectName}}`, action2.Options.FsConfig.Renames[0].Key)
- assert.Equal(t, `/{{ObjectName}}_renamed`, action2.Options.FsConfig.Renames[0].Value)
- // Cleanup.
- _, err = httpdtest.RemoveEventAction(action1, http.StatusOK)
- assert.NoError(t, err)
- _, err = httpdtest.RemoveEventAction(action2, http.StatusOK)
- assert.NoError(t, err)
- actions, _, err := httpdtest.GetEventActions(0, 0, http.StatusOK)
- assert.NoError(t, err)
- assert.Len(t, actions, 0)
-}
-
func TestLoaddataMode(t *testing.T) {
err := dataprovider.UpdateConfigs(nil, "", "", "")
assert.NoError(t, err)
@@ -9066,7 +8566,7 @@ func TestLoaddataMode(t *testing.T) {
}
action := dataprovider.BaseEventAction{
ID: 81,
- Name: "test_restore_action_data_mode",
+ Name: "test restore action data mode",
Description: "action desc",
Type: dataprovider.ActionTypeHTTP,
Options: dataprovider.BaseEventActionOptions{
@@ -9077,13 +8577,13 @@ func TestLoaddataMode(t *testing.T) {
Timeout: 10,
SkipTLSVerify: true,
Method: http.MethodPost,
- Body: `{"event":"{{.Event}}","name":"{{.Name}}"}`,
+ Body: `{"event":"{{Event}}","name":"{{Name}}"}`,
},
},
}
rule := dataprovider.EventRule{
ID: 100,
- Name: "test_rule_restore_data_mode",
+ Name: "test rule restore data mode",
Description: "rule desc",
Trigger: dataprovider.EventTriggerFsEvent,
Conditions: dataprovider.EventConditions{
@@ -9212,7 +8712,7 @@ func TestLoaddataMode(t *testing.T) {
entry, _, err = httpdtest.UpdateIPListEntry(entry, http.StatusOK)
assert.NoError(t, err)
- configs.SFTPD.PublicKeyAlgos = append(configs.SFTPD.PublicKeyAlgos, ssh.InsecureKeyAlgoDSA) //nolint:staticcheck
+ configs.SFTPD.PublicKeyAlgos = append(configs.SFTPD.PublicKeyAlgos, ssh.InsecureKeyAlgoDSA)
err = dataprovider.UpdateConfigs(&configs, "", "", "")
assert.NoError(t, err)
backupData.Configs = &configs
@@ -9281,7 +8781,6 @@ func TestLoaddataMode(t *testing.T) {
assert.NoError(t, err)
// mode 2 will update the user and close the previous connection
assert.Len(t, common.Connections.GetStats(""), 0)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
user, _, err = httpdtest.GetUserByUsername(user.Username, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, oldUploadBandwidth, user.UploadBandwidth)
@@ -9424,7 +8923,7 @@ func TestBasicUserHandlingMock(t *testing.T) {
assert.Equal(t, user.MaxSessions, updatedUser.MaxSessions)
assert.Equal(t, user.UploadBandwidth, updatedUser.UploadBandwidth)
assert.Equal(t, 1, len(updatedUser.Permissions["/"]))
- assert.True(t, slices.Contains(updatedUser.Permissions["/"], dataprovider.PermAny))
+ assert.True(t, util.Contains(updatedUser.Permissions["/"], dataprovider.PermAny))
req, _ = http.NewRequest(http.MethodDelete, userPath+"/"+user.Username, nil)
setBearerForReq(req, token)
rr = executeRequest(req)
@@ -9590,7 +9089,7 @@ func TestEventRuleErrorsMock(t *testing.T) {
checkResponseCode(t, http.StatusBadRequest, rr)
a := dataprovider.BaseEventAction{
- Name: "action_name",
+ Name: "action name",
Description: "test description",
Type: dataprovider.ActionTypeBackup,
Options: dataprovider.BaseEventActionOptions{},
@@ -9605,7 +9104,7 @@ func TestEventRuleErrorsMock(t *testing.T) {
checkResponseCode(t, http.StatusBadRequest, rr)
r := dataprovider.EventRule{
- Name: "test_event_rule",
+ Name: "test event rule",
Trigger: dataprovider.EventTriggerSchedule,
Conditions: dataprovider.EventConditions{
Schedules: []dataprovider.Schedule{
@@ -9816,13 +9315,12 @@ func TestAdminTwoFactorLogin(t *testing.T) {
rr = executeRequest(req)
checkResponseCode(t, http.StatusNotFound, rr)
- loginCookie, csrfToken, err := getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
form := getLoginForm(altAdminUsername, altAdminPassword, csrfToken)
req, err = http.NewRequest(http.MethodPost, webLoginPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
@@ -9877,8 +9375,6 @@ func TestAdminTwoFactorLogin(t *testing.T) {
assert.Equal(t, http.StatusOK, rr.Code)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCSRF)
- csrfToken, err = getCSRFTokenFromInternalPageMock(webAdminTwoFactorRecoveryPath, cookie)
- assert.NoError(t, err)
form.Set(csrfFormToken, csrfToken)
form.Set("passcode", "invalid_passcode")
req, err = http.NewRequest(http.MethodPost, webAdminTwoFactorPath, bytes.NewBuffer([]byte(form.Encode())))
@@ -9917,13 +9413,10 @@ func TestAdminTwoFactorLogin(t *testing.T) {
rr = executeRequest(req)
assert.Equal(t, http.StatusNotFound, rr.Code)
// get a new cookie and login using a recovery code
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
form = getLoginForm(altAdminUsername, altAdminPassword, csrfToken)
req, err = http.NewRequest(http.MethodPost, webLoginPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
@@ -9944,8 +9437,6 @@ func TestAdminTwoFactorLogin(t *testing.T) {
assert.Equal(t, http.StatusOK, rr.Code)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCSRF)
- csrfToken, err = getCSRFTokenFromInternalPageMock(webAdminTwoFactorRecoveryPath, cookie)
- assert.NoError(t, err)
form.Set(csrfFormToken, csrfToken)
form.Set("recovery_code", "")
req, err = http.NewRequest(http.MethodPost, webAdminTwoFactorRecoveryPath, bytes.NewBuffer([]byte(form.Encode())))
@@ -9996,21 +9487,16 @@ func TestAdminTwoFactorLogin(t *testing.T) {
}
assert.True(t, found)
// the same recovery code cannot be reused
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
form = getLoginForm(altAdminUsername, altAdminPassword, csrfToken)
req, err = http.NewRequest(http.MethodPost, webLoginPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
assert.Equal(t, webAdminTwoFactorPath, rr.Header().Get("Location"))
cookie, err = getCookieFromResponse(rr)
assert.NoError(t, err)
- csrfToken, err = getCSRFTokenFromInternalPageMock(webAdminTwoFactorRecoveryPath, cookie)
- assert.NoError(t, err)
form = make(url.Values)
form.Set("recovery_code", recoveryCode)
form.Set(csrfFormToken, csrfToken)
@@ -10033,23 +9519,12 @@ func TestAdminTwoFactorLogin(t *testing.T) {
assert.Equal(t, http.StatusOK, rr.Code)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCredentials)
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
form = getLoginForm(altAdminUsername, altAdminPassword, csrfToken)
req, err = http.NewRequest(http.MethodPost, webLoginPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
- assert.Equal(t, http.StatusOK, rr.Code)
- assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCSRF)
-
- req, err = http.NewRequest(http.MethodPost, webLoginPath, bytes.NewBuffer([]byte(form.Encode())))
- assert.NoError(t, err)
- req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
- req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
- rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
assert.Equal(t, webAdminTwoFactorPath, rr.Header().Get("Location"))
cookie, err = getCookieFromResponse(rr)
@@ -10077,8 +9552,6 @@ func TestAdminTwoFactorLogin(t *testing.T) {
checkResponseCode(t, http.StatusBadRequest, rr)
assert.Contains(t, rr.Body.String(), "two-factor authentication is not enabled")
- csrfToken, err = getCSRFTokenFromInternalPageMock(webAdminTwoFactorRecoveryPath, cookie)
- assert.NoError(t, err)
form = make(url.Values)
form.Set("recovery_code", recoveryCode)
form.Set(csrfFormToken, csrfToken)
@@ -10352,7 +9825,7 @@ func TestSMTPConfig(t *testing.T) {
tokenHeader := "X-CSRF-TOKEN"
webToken, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webConfigsPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
req, err := http.NewRequest(http.MethodPost, smtpTestURL, bytes.NewBuffer([]byte("{")))
assert.NoError(t, err)
@@ -10436,7 +9909,7 @@ func TestOAuth2TokenRequest(t *testing.T) {
tokenHeader := "X-CSRF-TOKEN"
webToken, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webConfigsPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
req, err := http.NewRequest(http.MethodPost, webOAuth2TokenPath, bytes.NewBuffer([]byte("{")))
assert.NoError(t, err)
@@ -10577,24 +10050,14 @@ func TestWebUserTwoFactorLogin(t *testing.T) {
rr = executeRequest(req)
checkResponseCode(t, http.StatusNotFound, rr)
- loginCookie, csrfToken, err := getCSRFTokenMock(webClientLoginPath, defaultRemoteAddr)
+ csrfToken, err := getCSRFToken(httpBaseURL + webClientLoginPath)
assert.NoError(t, err)
form := getLoginForm(defaultUsername, defaultPassword, csrfToken)
- // CSRF verification fails if there is no cookie
req, err = http.NewRequest(http.MethodPost, webClientLoginPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
- assert.Equal(t, http.StatusOK, rr.Code)
- assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCSRF)
-
- req, err = http.NewRequest(http.MethodPost, webClientLoginPath, bytes.NewBuffer([]byte(form.Encode())))
- assert.NoError(t, err)
- req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
- req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
- rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
assert.Equal(t, webClientTwoFactorPath, rr.Header().Get("Location"))
cookie, err := getCookieFromResponse(rr)
@@ -10611,13 +10074,6 @@ func TestWebUserTwoFactorLogin(t *testing.T) {
assert.NoError(t, err)
rr = executeRequest(req)
checkResponseCode(t, http.StatusNotFound, rr)
- // invalid IP address
- req, err = http.NewRequest(http.MethodGet, webClientTwoFactorPath, nil)
- assert.NoError(t, err)
- setJWTCookieForReq(req, cookie)
- req.RemoteAddr = "6.7.8.9:4567"
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusNotFound, rr)
req, err = http.NewRequest(http.MethodGet, webClientTwoFactorRecoveryPath, nil)
assert.NoError(t, err)
@@ -10653,8 +10109,6 @@ func TestWebUserTwoFactorLogin(t *testing.T) {
assert.Equal(t, http.StatusOK, rr.Code)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCSRF)
- csrfToken, err = getCSRFTokenFromInternalPageMock(webClientTwoFactorPath, cookie)
- assert.NoError(t, err)
form.Set(csrfFormToken, csrfToken)
form.Set("passcode", "invalid_user_passcode")
req, err = http.NewRequest(http.MethodPost, webClientTwoFactorPath, bytes.NewBuffer([]byte(form.Encode())))
@@ -10694,13 +10148,10 @@ func TestWebUserTwoFactorLogin(t *testing.T) {
rr = executeRequest(req)
assert.Equal(t, http.StatusNotFound, rr.Code)
// get a new cookie and login using a recovery code
- loginCookie, csrfToken, err = getCSRFTokenMock(webClientLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
form = getLoginForm(defaultUsername, defaultPassword, csrfToken)
req, err = http.NewRequest(http.MethodPost, webClientLoginPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
@@ -10720,8 +10171,6 @@ func TestWebUserTwoFactorLogin(t *testing.T) {
assert.Equal(t, http.StatusOK, rr.Code)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCSRF)
- csrfToken, err = getCSRFTokenFromInternalPageMock(webClientTwoFactorRecoveryPath, cookie)
- assert.NoError(t, err)
form.Set(csrfFormToken, csrfToken)
form.Set("recovery_code", "")
req, err = http.NewRequest(http.MethodPost, webClientTwoFactorRecoveryPath, bytes.NewBuffer([]byte(form.Encode())))
@@ -10787,22 +10236,16 @@ func TestWebUserTwoFactorLogin(t *testing.T) {
}
assert.True(t, found)
// the same recovery code cannot be reused
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
form = getLoginForm(defaultUsername, defaultPassword, csrfToken)
req, err = http.NewRequest(http.MethodPost, webClientLoginPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
assert.Equal(t, webClientTwoFactorPath, rr.Header().Get("Location"))
cookie, err = getCookieFromResponse(rr)
assert.NoError(t, err)
-
- csrfToken, err = getCSRFTokenFromInternalPageMock(webClientTwoFactorRecoveryPath, cookie)
- assert.NoError(t, err)
form = make(url.Values)
form.Set("recovery_code", recoveryCode)
form.Set(csrfFormToken, csrfToken)
@@ -10825,13 +10268,10 @@ func TestWebUserTwoFactorLogin(t *testing.T) {
assert.Equal(t, http.StatusOK, rr.Code)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCredentials)
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
form = getLoginForm(defaultUsername, defaultPassword, csrfToken)
req, err = http.NewRequest(http.MethodPost, webClientLoginPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
@@ -10853,12 +10293,11 @@ func TestWebUserTwoFactorLogin(t *testing.T) {
checkResponseCode(t, http.StatusBadRequest, rr)
assert.Contains(t, rr.Body.String(), "two-factor authentication is not enabled")
- csrfToken, err = getCSRFTokenFromInternalPageMock(webClientTwoFactorRecoveryPath, cookie)
- assert.NoError(t, err)
form = make(url.Values)
form.Set("recovery_code", recoveryCode)
form.Set("passcode", passcode)
form.Set(csrfFormToken, csrfToken)
+
req, err = http.NewRequest(http.MethodPost, webClientTwoFactorRecoveryPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
setJWTCookieForReq(req, cookie)
@@ -10930,7 +10369,7 @@ func TestWebUserTwoFactoryLoginRedirect(t *testing.T) {
rr := executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
- loginCookie, csrfToken, err := getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
+ csrfToken, err := getCSRFToken(httpBaseURL + webClientLoginPath)
assert.NoError(t, err)
form := getLoginForm(defaultUsername, defaultPassword, csrfToken)
uri := webClientFilesPath + "?path=%2F"
@@ -10940,7 +10379,6 @@ func TestWebUserTwoFactoryLoginRedirect(t *testing.T) {
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
req.RequestURI = loginURI
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
@@ -10948,29 +10386,20 @@ func TestWebUserTwoFactoryLoginRedirect(t *testing.T) {
cookie, err := getCookieFromResponse(rr)
assert.NoError(t, err)
// test unsafe redirects
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
- form = getLoginForm(defaultUsername, defaultPassword, csrfToken)
externalURI := webClientLoginPath + "?next=" + url.QueryEscape("https://example.com")
req, err = http.NewRequest(http.MethodPost, externalURI, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
req.RequestURI = externalURI
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
assert.Equal(t, webClientTwoFactorPath, rr.Header().Get("Location"))
-
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
- form = getLoginForm(defaultUsername, defaultPassword, csrfToken)
internalURI := webClientLoginPath + "?next=" + url.QueryEscape(webClientMFAPath)
req, err = http.NewRequest(http.MethodPost, internalURI, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
req.RequestURI = internalURI
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
@@ -10984,8 +10413,6 @@ func TestWebUserTwoFactoryLoginRedirect(t *testing.T) {
checkResponseCode(t, http.StatusOK, rr)
assert.Contains(t, rr.Body.String(), fmt.Sprintf("action=%q", expectedURI))
// login with the passcode
- csrfToken, err = getCSRFTokenFromInternalPageMock(expectedURI, cookie)
- assert.NoError(t, err)
passcode, err := generateTOTPPasscode(key.Secret())
assert.NoError(t, err)
form = make(url.Values)
@@ -11417,22 +10844,18 @@ func TestMFAInvalidSecret(t *testing.T) {
checkResponseCode(t, http.StatusInternalServerError, rr)
assert.Contains(t, rr.Body.String(), "Unable to decrypt recovery codes")
- loginCookie, csrfToken, err := getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
+ csrfToken, err := getCSRFToken(httpBaseURL + webClientLoginPath)
assert.NoError(t, err)
form := getLoginForm(defaultUsername, defaultPassword, csrfToken)
req, err = http.NewRequest(http.MethodPost, webClientLoginPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
assert.Equal(t, webClientTwoFactorPath, rr.Header().Get("Location"))
cookie, err := getCookieFromResponse(rr)
assert.NoError(t, err)
-
- csrfToken, err = getCSRFTokenFromInternalPageMock(webClientTwoFactorPath, cookie)
- assert.NoError(t, err)
form = make(url.Values)
form.Set(csrfFormToken, csrfToken)
form.Set("passcode", "123456")
@@ -11444,8 +10867,6 @@ func TestMFAInvalidSecret(t *testing.T) {
rr = executeRequest(req)
assert.Equal(t, http.StatusInternalServerError, rr.Code)
- csrfToken, err = getCSRFTokenFromInternalPageMock(webClientTwoFactorRecoveryPath, cookie)
- assert.NoError(t, err)
form = make(url.Values)
form.Set(csrfFormToken, csrfToken)
form.Set("recovery_code", "RC-123456")
@@ -11491,22 +10912,18 @@ func TestMFAInvalidSecret(t *testing.T) {
err = dataprovider.UpdateAdmin(&admin, "", "", "")
assert.NoError(t, err)
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
+ csrfToken, err = getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
form = getLoginForm(altAdminUsername, altAdminPassword, csrfToken)
req, err = http.NewRequest(http.MethodPost, webLoginPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
assert.Equal(t, webAdminTwoFactorPath, rr.Header().Get("Location"))
cookie, err = getCookieFromResponse(rr)
assert.NoError(t, err)
-
- csrfToken, err = getCSRFTokenFromInternalPageMock(webAdminTwoFactorRecoveryPath, cookie)
- assert.NoError(t, err)
form = make(url.Values)
form.Set(csrfFormToken, csrfToken)
form.Set("passcode", "123456")
@@ -11518,8 +10935,6 @@ func TestMFAInvalidSecret(t *testing.T) {
rr = executeRequest(req)
assert.Equal(t, http.StatusInternalServerError, rr.Code)
- csrfToken, err = getCSRFTokenFromInternalPageMock(webAdminTwoFactorRecoveryPath, cookie)
- assert.NoError(t, err)
form = make(url.Values)
form.Set(csrfFormToken, csrfToken)
form.Set("recovery_code", "RC-123456")
@@ -11758,7 +11173,6 @@ func TestWebAPIChangeUserProfileMock(t *testing.T) {
checkResponseCode(t, http.StatusBadRequest, rr)
email := "userapi@example.com"
- additionalEmails := []string{"userapi1@example.com"}
description := "user API description"
profileReq := make(map[string]any)
profileReq["allow_api_key_auth"] = true
@@ -11766,7 +11180,6 @@ func TestWebAPIChangeUserProfileMock(t *testing.T) {
profileReq["description"] = description
profileReq["public_keys"] = []string{testPubKey, testPubKey1}
profileReq["tls_certs"] = []string{httpsCert}
- profileReq["additional_emails"] = additionalEmails
asJSON, err := json.Marshal(profileReq)
assert.NoError(t, err)
req, err = http.NewRequest(http.MethodPut, userProfilePath, bytes.NewBuffer(asJSON))
@@ -11784,7 +11197,6 @@ func TestWebAPIChangeUserProfileMock(t *testing.T) {
err = json.Unmarshal(rr.Body.Bytes(), &profileReq)
assert.NoError(t, err)
assert.Equal(t, email, profileReq["email"].(string))
- assert.Len(t, profileReq["additional_emails"].([]interface{}), 1)
assert.Equal(t, description, profileReq["description"].(string))
assert.True(t, profileReq["allow_api_key_auth"].(bool))
val, ok := profileReq["public_keys"].([]any)
@@ -11806,17 +11218,6 @@ func TestWebAPIChangeUserProfileMock(t *testing.T) {
rr = executeRequest(req)
checkResponseCode(t, http.StatusBadRequest, rr)
assert.Contains(t, rr.Body.String(), "Validation error: email")
- // set an invalid additional email
- profileReq = make(map[string]any)
- profileReq["additional_emails"] = []string{"not an email"}
- asJSON, err = json.Marshal(profileReq)
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPut, userProfilePath, bytes.NewBuffer(asJSON))
- assert.NoError(t, err)
- setBearerForReq(req, token)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusBadRequest, rr)
- assert.Contains(t, rr.Body.String(), "Validation error: email")
// set an invalid public key
profileReq = make(map[string]any)
profileReq["public_keys"] = []string{"not a public key"}
@@ -12666,7 +12067,7 @@ func TestUserPermissionsMock(t *testing.T) {
err = render.DecodeJSON(rr.Body, &updatedUser)
assert.NoError(t, err)
if val, ok := updatedUser.Permissions["/otherdir"]; ok {
- assert.True(t, slices.Contains(val, dataprovider.PermListItems))
+ assert.True(t, util.Contains(val, dataprovider.PermListItems))
assert.Equal(t, 1, len(val))
} else {
assert.Fail(t, "expected dir not found in permissions")
@@ -13386,6 +12787,8 @@ func TestWebClientLoginMock(t *testing.T) {
assert.NoError(t, err)
webToken, err := getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
assert.NoError(t, err)
+ csrfToken, err := getCSRFToken(httpBaseURL + webClientLoginPath)
+ assert.NoError(t, err)
// a web token is not valid for API or WebAdmin usage
req, _ := http.NewRequest(http.MethodGet, serverStatusPath, nil)
setBearerForReq(req, webToken)
@@ -13447,8 +12850,6 @@ func TestWebClientLoginMock(t *testing.T) {
assert.NoError(t, err)
apiUserToken, err := getJWTAPIUserTokenFromTestServer(defaultUsername, defaultPassword)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webClientProfilePath, webToken)
- assert.NoError(t, err)
_, err = httpdtest.RemoveUser(user, http.StatusOK)
assert.NoError(t, err)
err = os.RemoveAll(user.GetHomeDir())
@@ -13568,7 +12969,6 @@ func TestWebClientMaxConnections(t *testing.T) {
err = os.RemoveAll(user.GetHomeDir())
assert.NoError(t, err)
assert.Len(t, common.Connections.GetStats(""), 0)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
common.Config.MaxTotalConnections = oldValue
}
@@ -13664,7 +13064,7 @@ func TestDefender(t *testing.T) {
checkResponseCode(t, http.StatusForbidden, rr)
assert.Contains(t, rr.Body.String(), "your IP address is blocked")
// requests for static files should be always allowed
- req, err = http.NewRequest(http.MethodGet, "/static/favicon.png", nil)
+ req, err = http.NewRequest(http.MethodGet, "/static/favicon.ico", nil)
assert.NoError(t, err)
req.RemoteAddr = remoteAddr
rr = executeRequest(req)
@@ -13770,7 +13170,7 @@ func TestMaxSessions(t *testing.T) {
checkResponseCode(t, http.StatusTooManyRequests, rr)
assert.Contains(t, rr.Body.String(), "too many open sessions")
// web client requests
- csrfToken, err := getCSRFTokenFromInternalPageMock(webClientProfilePath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
form := make(url.Values)
form.Set(csrfFormToken, csrfToken)
@@ -13822,8 +13222,6 @@ func TestMaxSessions(t *testing.T) {
err = smtpCfg.Initialize(configDir, true)
assert.NoError(t, err)
- loginCookie, csrfToken, err := getCSRFTokenMock(webClientLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
form = make(url.Values)
form.Set(csrfFormToken, csrfToken)
form.Set("username", user.Username)
@@ -13831,14 +13229,10 @@ func TestMaxSessions(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webClientForgotPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
assert.GreaterOrEqual(t, len(lastResetCode), 20)
-
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
form = make(url.Values)
form.Set(csrfFormToken, csrfToken)
form.Set("password", defaultPassword)
@@ -13847,7 +13241,6 @@ func TestMaxSessions(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webClientResetPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -13863,129 +13256,6 @@ func TestMaxSessions(t *testing.T) {
err = os.RemoveAll(user.GetHomeDir())
assert.NoError(t, err)
assert.Len(t, common.Connections.GetStats(""), 0)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
-}
-
-func TestMaxTransfers(t *testing.T) {
- oldValue := common.Config.MaxPerHostConnections
- common.Config.MaxPerHostConnections = 2
-
- assert.Eventually(t, func() bool {
- return common.Connections.GetClientConnections() == 0
- }, 1000*time.Millisecond, 50*time.Millisecond)
- user, _, err := httpdtest.AddUser(getTestUser(), http.StatusCreated)
- assert.NoError(t, err)
-
- webToken, err := getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
- assert.NoError(t, err)
- webAPIToken, err := getJWTAPIUserTokenFromTestServer(defaultUsername, defaultPassword)
- assert.NoError(t, err)
-
- share := dataprovider.Share{
- Name: "test share",
- Scope: dataprovider.ShareScopeReadWrite,
- Paths: []string{"/"},
- Password: defaultPassword,
- }
- asJSON, err := json.Marshal(share)
- assert.NoError(t, err)
- req, err := http.NewRequest(http.MethodPost, userSharesPath, bytes.NewBuffer(asJSON))
- assert.NoError(t, err)
- setBearerForReq(req, webAPIToken)
- rr := executeRequest(req)
- checkResponseCode(t, http.StatusCreated, rr)
- objectID := rr.Header().Get("X-Object-ID")
- assert.NotEmpty(t, objectID)
-
- fileName := "testfile.txt"
- req, err = http.NewRequest(http.MethodPost, userUploadFilePath+"?path="+fileName, bytes.NewBuffer([]byte(" ")))
- assert.NoError(t, err)
- setBearerForReq(req, webAPIToken)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusCreated, rr)
-
- conn, sftpClient, err := getSftpClient(user)
- assert.NoError(t, err)
- defer conn.Close()
- defer sftpClient.Close()
-
- f1, err := sftpClient.Create("file1")
- assert.NoError(t, err)
- f2, err := sftpClient.Create("file2")
- assert.NoError(t, err)
- _, err = f1.Write([]byte(" "))
- assert.NoError(t, err)
- _, err = f2.Write([]byte(" "))
- assert.NoError(t, err)
-
- body := new(bytes.Buffer)
- writer := multipart.NewWriter(body)
- part, err := writer.CreateFormFile("filenames", "filepre")
- assert.NoError(t, err)
- _, err = part.Write([]byte("file content"))
- assert.NoError(t, err)
- err = writer.Close()
- assert.NoError(t, err)
- reader := bytes.NewReader(body.Bytes())
- _, err = reader.Seek(0, io.SeekStart)
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, userFilesPath, reader)
- assert.NoError(t, err)
- req.Header.Add("Content-Type", writer.FormDataContentType())
- setBearerForReq(req, webAPIToken)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusConflict, rr)
-
- req, err = http.NewRequest(http.MethodGet, webClientFilesPath+"?path="+fileName, nil)
- assert.NoError(t, err)
- setJWTCookieForReq(req, webToken)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusOK, rr)
- assert.Contains(t, rr.Body.String(), util.I18nError403Message)
-
- req, err = http.NewRequest(http.MethodPost, userUploadFilePath+"?path="+fileName, bytes.NewBuffer([]byte(" ")))
- assert.NoError(t, err)
- setBearerForReq(req, webAPIToken)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusForbidden, rr)
-
- body = new(bytes.Buffer)
- writer = multipart.NewWriter(body)
- part1, err := writer.CreateFormFile("filenames", "file11.txt")
- assert.NoError(t, err)
- _, err = part1.Write([]byte("file11 content"))
- assert.NoError(t, err)
- part2, err := writer.CreateFormFile("filenames", "file22.txt")
- assert.NoError(t, err)
- _, err = part2.Write([]byte("file22 content"))
- assert.NoError(t, err)
- err = writer.Close()
- assert.NoError(t, err)
- reader = bytes.NewReader(body.Bytes())
- req, err = http.NewRequest(http.MethodPost, sharesPath+"/"+objectID, reader)
- assert.NoError(t, err)
- req.Header.Add("Content-Type", writer.FormDataContentType())
- req.SetBasicAuth(defaultUsername, defaultPassword)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusConflict, rr)
-
- err = f1.Close()
- assert.NoError(t, err)
- err = f2.Close()
- assert.NoError(t, err)
-
- _, err = httpdtest.RemoveUser(user, http.StatusOK)
- assert.NoError(t, err)
- err = os.RemoveAll(user.GetHomeDir())
- assert.NoError(t, err)
- assert.Eventually(t, func() bool {
- return len(common.Connections.GetStats("")) == 0
- }, 1000*time.Millisecond, 50*time.Millisecond)
- assert.Eventually(t, func() bool {
- return common.Connections.GetTotalTransfers() == 0
- }, 1000*time.Millisecond, 50*time.Millisecond)
-
- common.Config.MaxPerHostConnections = oldValue
}
func TestWebConfigsMock(t *testing.T) {
@@ -13997,6 +13267,8 @@ func TestWebConfigsMock(t *testing.T) {
assert.NoError(t, err)
webToken, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
+ csrfToken, err := getCSRFToken(httpBaseURL + webClientLoginPath)
+ assert.NoError(t, err)
req, err := http.NewRequest(http.MethodGet, webConfigsPath, nil)
assert.NoError(t, err)
@@ -14005,17 +13277,13 @@ func TestWebConfigsMock(t *testing.T) {
checkResponseCode(t, http.StatusOK, rr)
form := make(url.Values)
- b, contentType, err := getMultipartFormData(form, "", "")
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, webConfigsPath, &b)
+ req, err = http.NewRequest(http.MethodPost, webConfigsPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
+ req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusForbidden, rr)
// parse form error
- csrfToken, err := getCSRFTokenFromInternalPageMock(webConfigsPath, webToken)
- assert.NoError(t, err)
form.Set(csrfFormToken, csrfToken)
req, err = http.NewRequest(http.MethodPost, webConfigsPath+"?p=p%C3%AO%GH", bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
@@ -14025,29 +13293,25 @@ func TestWebConfigsMock(t *testing.T) {
checkResponseCode(t, http.StatusBadRequest, rr)
// save SFTP configs
form.Set("sftp_host_key_algos", ssh.KeyAlgoRSA)
- form.Add("sftp_host_key_algos", ssh.InsecureCertAlgoDSAv01) //nolint:staticcheck
- form.Set("sftp_pub_key_algos", ssh.InsecureKeyAlgoDSA) //nolint:staticcheck
+ form.Add("sftp_host_key_algos", ssh.InsecureCertAlgoDSAv01)
+ form.Set("sftp_pub_key_algos", ssh.InsecureKeyAlgoDSA)
form.Set("form_action", "sftp_submit")
- b, contentType, err = getMultipartFormData(form, "", "")
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, webConfigsPath, &b)
+ req, err = http.NewRequest(http.MethodPost, webConfigsPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
+ req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
assert.Contains(t, rr.Body.String(), util.I18nError500Message) // invalid algo
form.Set("sftp_host_key_algos", ssh.KeyAlgoRSA)
form.Add("sftp_host_key_algos", ssh.CertAlgoRSAv01)
- form.Set("sftp_pub_key_algos", ssh.InsecureKeyAlgoDSA) //nolint:staticcheck
+ form.Set("sftp_pub_key_algos", ssh.InsecureKeyAlgoDSA)
form.Set("sftp_kex_algos", "diffie-hellman-group18-sha512")
form.Add("sftp_kex_algos", ssh.KeyExchangeDH16SHA512)
- b, contentType, err = getMultipartFormData(form, "", "")
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, webConfigsPath, &b)
+ req, err = http.NewRequest(http.MethodPost, webConfigsPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
+ req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
assert.Contains(t, rr.Body.String(), util.I18nConfigsOK)
@@ -14057,17 +13321,15 @@ func TestWebConfigsMock(t *testing.T) {
assert.Len(t, configs.SFTPD.HostKeyAlgos, 1)
assert.Contains(t, configs.SFTPD.HostKeyAlgos, ssh.KeyAlgoRSA)
assert.Len(t, configs.SFTPD.PublicKeyAlgos, 1)
- assert.Contains(t, configs.SFTPD.PublicKeyAlgos, ssh.InsecureKeyAlgoDSA) //nolint:staticcheck
+ assert.Contains(t, configs.SFTPD.PublicKeyAlgos, ssh.InsecureKeyAlgoDSA)
assert.Len(t, configs.SFTPD.KexAlgorithms, 1)
assert.Contains(t, configs.SFTPD.KexAlgorithms, ssh.KeyExchangeDH16SHA512)
// invalid form action
form.Set("form_action", "")
- b, contentType, err = getMultipartFormData(form, "", "")
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, webConfigsPath, &b)
+ req, err = http.NewRequest(http.MethodPost, webConfigsPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
+ req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusBadRequest, rr)
assert.Contains(t, rr.Body.String(), util.I18nError400Message)
@@ -14079,12 +13341,10 @@ func TestWebConfigsMock(t *testing.T) {
form.Set("smtp_password", defaultPassword)
form.Set("smtp_domain", "localdomain")
form.Set("smtp_auth", "100")
- b, contentType, err = getMultipartFormData(form, "", "")
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, webConfigsPath, &b)
+ req, err = http.NewRequest(http.MethodPost, webConfigsPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
+ req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
assert.Contains(t, rr.Body.String(), util.I18nError500Message) // invalid smtp_auth
@@ -14095,12 +13355,10 @@ func TestWebConfigsMock(t *testing.T) {
form.Set("smtp_debug", "checked")
form.Set("smtp_oauth2_provider", "1")
form.Set("smtp_oauth2_client_id", "123")
- b, contentType, err = getMultipartFormData(form, "", "")
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, webConfigsPath, &b)
+ req, err = http.NewRequest(http.MethodPost, webConfigsPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
+ req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
assert.Contains(t, rr.Body.String(), util.I18nConfigsOK)
@@ -14110,7 +13368,7 @@ func TestWebConfigsMock(t *testing.T) {
assert.Len(t, configs.SFTPD.HostKeyAlgos, 1)
assert.Contains(t, configs.SFTPD.HostKeyAlgos, ssh.KeyAlgoRSA)
assert.Len(t, configs.SFTPD.PublicKeyAlgos, 1)
- assert.Contains(t, configs.SFTPD.PublicKeyAlgos, ssh.InsecureKeyAlgoDSA) //nolint:staticcheck
+ assert.Contains(t, configs.SFTPD.PublicKeyAlgos, ssh.InsecureKeyAlgoDSA)
assert.Equal(t, "mail.example.net", configs.SMTP.Host)
assert.Equal(t, 587, configs.SMTP.Port)
assert.Equal(t, "Example ", configs.SMTP.From)
@@ -14127,12 +13385,10 @@ func TestWebConfigsMock(t *testing.T) {
form.Set("smtp_password", redactedSecret)
form.Set("smtp_auth", "")
configs.SMTP.AuthType = 0 // empty will be converted to 0
- b, contentType, err = getMultipartFormData(form, "", "")
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, webConfigsPath, &b)
+ req, err = http.NewRequest(http.MethodPost, webConfigsPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
+ req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
assert.Contains(t, rr.Body.String(), util.I18nConfigsOK)
@@ -14148,12 +13404,10 @@ func TestWebConfigsMock(t *testing.T) {
updatedConfigs.SMTP.Password = kms.NewSecret(sdkkms.SecretStatusSecretBox, encryptedPayload, secretKey, "")
err = dataprovider.UpdateConfigs(&updatedConfigs, "", "", "")
assert.NoError(t, err)
- b, contentType, err = getMultipartFormData(form, "", "")
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, webConfigsPath, &b)
+ req, err = http.NewRequest(http.MethodPost, webConfigsPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
+ req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
assert.Contains(t, rr.Body.String(), util.I18nConfigsOK)
@@ -14163,23 +13417,19 @@ func TestWebConfigsMock(t *testing.T) {
form.Add("acme_protocols", "2")
form.Add("acme_protocols", "3")
form.Set("acme_domain", "example.com")
- b, contentType, err = getMultipartFormData(form, "", "")
- assert.NoError(t, err)
// no email set, validation will fail
- req, err = http.NewRequest(http.MethodPost, webConfigsPath, &b)
+ req, err = http.NewRequest(http.MethodPost, webConfigsPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
+ req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidEmail)
form.Set("acme_domain", "")
- b, contentType, err = getMultipartFormData(form, "", "")
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, webConfigsPath, &b)
+ req, err = http.NewRequest(http.MethodPost, webConfigsPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
+ req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
assert.Contains(t, rr.Body.String(), util.I18nConfigsOK)
@@ -14189,7 +13439,7 @@ func TestWebConfigsMock(t *testing.T) {
assert.Len(t, configs.SFTPD.HostKeyAlgos, 1)
assert.Contains(t, configs.SFTPD.HostKeyAlgos, ssh.KeyAlgoRSA)
assert.Len(t, configs.SFTPD.PublicKeyAlgos, 1)
- assert.Contains(t, configs.SFTPD.PublicKeyAlgos, ssh.InsecureKeyAlgoDSA) //nolint:staticcheck
+ assert.Contains(t, configs.SFTPD.PublicKeyAlgos, ssh.InsecureKeyAlgoDSA)
assert.Equal(t, 80, configs.ACME.HTTP01Challenge.Port)
assert.Equal(t, 7, configs.ACME.Protocols)
assert.Empty(t, configs.ACME.Domain)
@@ -14210,12 +13460,10 @@ func TestWebConfigsMock(t *testing.T) {
form.Add("acme_protocols", "1000")
form.Set("acme_domain", domain)
form.Set("acme_email", "email@example.com")
- b, contentType, err = getMultipartFormData(form, "", "")
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, webConfigsPath, &b)
+ req, err = http.NewRequest(http.MethodPost, webConfigsPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
+ req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
assert.Contains(t, rr.Body.String(), util.I18nConfigsOK)
@@ -14239,201 +13487,6 @@ func TestWebConfigsMock(t *testing.T) {
assert.NoError(t, err)
}
-func TestBrandingConfigMock(t *testing.T) {
- err := dataprovider.UpdateConfigs(nil, "", "", "")
- assert.NoError(t, err)
-
- webClientLogoPath := "/static/branding/webclient/logo.png"
- webClientFaviconPath := "/static/branding/webclient/favicon.png"
- webAdminLogoPath := "/static/branding/webadmin/logo.png"
- webAdminFaviconPath := "/static/branding/webadmin/favicon.png"
- // no custom log or favicon was set
- for _, p := range []string{webClientLogoPath, webClientFaviconPath, webAdminLogoPath, webAdminFaviconPath} {
- req, err := http.NewRequest(http.MethodGet, p, nil)
- assert.NoError(t, err)
- rr := executeRequest(req)
- checkResponseCode(t, http.StatusNotFound, rr)
- }
-
- webToken, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
- assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webConfigsPath, webToken)
- assert.NoError(t, err)
- form := make(url.Values)
- form.Set(csrfFormToken, csrfToken)
- form.Set("form_action", "branding_submit")
- form.Set("branding_webadmin_name", "Custom WebAdmin")
- form.Set("branding_webadmin_short_name", "WebAdmin")
- form.Set("branding_webadmin_disclaimer_name", "Admin disclaimer")
- form.Set("branding_webadmin_disclaimer_url", "invalid, not a URL")
- form.Set("branding_webclient_name", "Custom WebClient")
- form.Set("branding_webclient_short_name", "WebClient")
- form.Set("branding_webclient_disclaimer_name", "Client disclaimer")
- form.Set("branding_webclient_disclaimer_url", "https://example.com")
- b, contentType, err := getMultipartFormData(form, "", "")
- assert.NoError(t, err)
- req, err := http.NewRequest(http.MethodPost, webConfigsPath, &b)
- assert.NoError(t, err)
- setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
- rr := executeRequest(req)
- checkResponseCode(t, http.StatusOK, rr)
- assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidDisclaimerURL)
-
- form.Set("branding_webadmin_disclaimer_url", "https://example.net")
- tmpFile := filepath.Join(os.TempDir(), util.GenerateUniqueID()+".png")
- err = createTestPNG(tmpFile, 512, 512, color.RGBA{100, 200, 200, 0xff})
- assert.NoError(t, err)
-
- b, contentType, err = getMultipartFormData(form, "branding_webadmin_logo", tmpFile)
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, webConfigsPath, &b)
- assert.NoError(t, err)
- setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusOK, rr)
- assert.Contains(t, rr.Body.String(), util.I18nConfigsOK)
- // check
- configs, err := dataprovider.GetConfigs()
- assert.NoError(t, err)
- assert.Equal(t, "Custom WebAdmin", configs.Branding.WebAdmin.Name)
- assert.Equal(t, "WebAdmin", configs.Branding.WebAdmin.ShortName)
- assert.Equal(t, "Admin disclaimer", configs.Branding.WebAdmin.DisclaimerName)
- assert.Equal(t, "https://example.net", configs.Branding.WebAdmin.DisclaimerURL)
- assert.Equal(t, "Custom WebClient", configs.Branding.WebClient.Name)
- assert.Equal(t, "WebClient", configs.Branding.WebClient.ShortName)
- assert.Equal(t, "Client disclaimer", configs.Branding.WebClient.DisclaimerName)
- assert.Equal(t, "https://example.com", configs.Branding.WebClient.DisclaimerURL)
- assert.Greater(t, len(configs.Branding.WebAdmin.Logo), 0)
- assert.Len(t, configs.Branding.WebAdmin.Favicon, 0)
- assert.Len(t, configs.Branding.WebClient.Logo, 0)
- assert.Len(t, configs.Branding.WebClient.Favicon, 0)
-
- err = createTestPNG(tmpFile, 256, 256, color.RGBA{120, 220, 220, 0xff})
- assert.NoError(t, err)
- form.Set("branding_webadmin_logo_remove", "0") // 0 preserves WebAdmin logo
- b, contentType, err = getMultipartFormData(form, "branding_webadmin_favicon", tmpFile)
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, webConfigsPath, &b)
- assert.NoError(t, err)
- setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusOK, rr)
- assert.Contains(t, rr.Body.String(), util.I18nConfigsOK)
- configs, err = dataprovider.GetConfigs()
- assert.NoError(t, err)
- assert.Equal(t, "Custom WebAdmin", configs.Branding.WebAdmin.Name)
- assert.Equal(t, "WebAdmin", configs.Branding.WebAdmin.ShortName)
- assert.Equal(t, "Admin disclaimer", configs.Branding.WebAdmin.DisclaimerName)
- assert.Equal(t, "https://example.net", configs.Branding.WebAdmin.DisclaimerURL)
- assert.Equal(t, "Custom WebClient", configs.Branding.WebClient.Name)
- assert.Equal(t, "WebClient", configs.Branding.WebClient.ShortName)
- assert.Equal(t, "Client disclaimer", configs.Branding.WebClient.DisclaimerName)
- assert.Equal(t, "https://example.com", configs.Branding.WebClient.DisclaimerURL)
- assert.Greater(t, len(configs.Branding.WebAdmin.Logo), 0)
- assert.Greater(t, len(configs.Branding.WebAdmin.Favicon), 0)
- assert.Len(t, configs.Branding.WebClient.Logo, 0)
- assert.Len(t, configs.Branding.WebClient.Favicon, 0)
-
- err = createTestPNG(tmpFile, 256, 256, color.RGBA{80, 90, 110, 0xff})
- assert.NoError(t, err)
- b, contentType, err = getMultipartFormData(form, "branding_webclient_logo", tmpFile)
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, webConfigsPath, &b)
- assert.NoError(t, err)
- setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusOK, rr)
- assert.Contains(t, rr.Body.String(), util.I18nConfigsOK)
- configs, err = dataprovider.GetConfigs()
- assert.NoError(t, err)
- assert.Greater(t, len(configs.Branding.WebClient.Logo), 0)
-
- err = createTestPNG(tmpFile, 256, 256, color.RGBA{120, 50, 120, 0xff})
- assert.NoError(t, err)
- b, contentType, err = getMultipartFormData(form, "branding_webclient_favicon", tmpFile)
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, webConfigsPath, &b)
- assert.NoError(t, err)
- setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusOK, rr)
- assert.Contains(t, rr.Body.String(), util.I18nConfigsOK)
- configs, err = dataprovider.GetConfigs()
- assert.NoError(t, err)
- assert.Greater(t, len(configs.Branding.WebClient.Favicon), 0)
-
- for _, p := range []string{webClientLogoPath, webClientFaviconPath, webAdminLogoPath, webAdminFaviconPath} {
- req, err := http.NewRequest(http.MethodGet, p, nil)
- assert.NoError(t, err)
- rr := executeRequest(req)
- checkResponseCode(t, http.StatusOK, rr)
- }
- // remove images
- form.Set("branding_webadmin_logo_remove", "1")
- form.Set("branding_webclient_logo_remove", "1")
- form.Set("branding_webadmin_favicon_remove", "1")
- form.Set("branding_webclient_favicon_remove", "1")
- b, contentType, err = getMultipartFormData(form, "", "")
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, webConfigsPath, &b)
- assert.NoError(t, err)
- setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusOK, rr)
- assert.Contains(t, rr.Body.String(), util.I18nConfigsOK)
- configs, err = dataprovider.GetConfigs()
- assert.NoError(t, err)
- assert.Len(t, configs.Branding.WebAdmin.Logo, 0)
- assert.Len(t, configs.Branding.WebAdmin.Favicon, 0)
- assert.Len(t, configs.Branding.WebClient.Logo, 0)
- assert.Len(t, configs.Branding.WebClient.Favicon, 0)
- for _, p := range []string{webClientLogoPath, webClientFaviconPath, webAdminLogoPath, webAdminFaviconPath} {
- req, err := http.NewRequest(http.MethodGet, p, nil)
- assert.NoError(t, err)
- rr := executeRequest(req)
- checkResponseCode(t, http.StatusNotFound, rr)
- }
- form.Del("branding_webadmin_logo_remove")
- form.Del("branding_webclient_logo_remove")
- form.Del("branding_webadmin_favicon_remove")
- form.Del("branding_webclient_favicon_remove")
- // image too large
- err = createTestPNG(tmpFile, 768, 512, color.RGBA{120, 50, 120, 0xff})
- assert.NoError(t, err)
- b, contentType, err = getMultipartFormData(form, "branding_webclient_logo", tmpFile)
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, webConfigsPath, &b)
- assert.NoError(t, err)
- setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusOK, rr)
- assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidPNGSize)
- // not a png image
- err = createTestFile(tmpFile, 128)
- assert.NoError(t, err)
- b, contentType, err = getMultipartFormData(form, "branding_webclient_logo", tmpFile)
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, webConfigsPath, &b)
- assert.NoError(t, err)
- setJWTCookieForReq(req, webToken)
- req.Header.Set("Content-Type", contentType)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusOK, rr)
- assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidPNG)
-
- err = os.Remove(tmpFile)
- assert.NoError(t, err)
- err = dataprovider.UpdateConfigs(nil, "", "", "")
- assert.NoError(t, err)
-}
-
func TestSFTPLoopError(t *testing.T) {
user1 := getTestUser()
user2 := getTestUser()
@@ -14475,7 +13528,7 @@ func TestSFTPLoopError(t *testing.T) {
err = smtpCfg.Initialize(configDir, true)
assert.NoError(t, err)
- loginCookie, csrfToken, err := getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
form := make(url.Values)
form.Set(csrfFormToken, csrfToken)
@@ -14484,14 +13537,10 @@ func TestSFTPLoopError(t *testing.T) {
req, err := http.NewRequest(http.MethodPost, webClientForgotPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr := executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
assert.GreaterOrEqual(t, len(lastResetCode), 20)
-
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
form = make(url.Values)
form.Set(csrfFormToken, csrfToken)
form.Set("password", defaultPassword)
@@ -14500,7 +13549,6 @@ func TestSFTPLoopError(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webClientResetPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -14560,6 +13608,8 @@ func TestWebClientChangePwd(t *testing.T) {
assert.NoError(t, err)
webToken, err := getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
assert.NoError(t, err)
+ csrfToken, err := getCSRFToken(httpBaseURL + webClientLoginPath)
+ assert.NoError(t, err)
req, err := http.NewRequest(http.MethodGet, webChangeClientPwdPath, nil)
assert.NoError(t, err)
@@ -14582,8 +13632,6 @@ func TestWebClientChangePwd(t *testing.T) {
checkResponseCode(t, http.StatusForbidden, rr)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCSRF)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webChangeClientPwdPath, webToken)
- assert.NoError(t, err)
form.Set(csrfFormToken, csrfToken)
req, _ = http.NewRequest(http.MethodPost, webChangeClientPwdPath, bytes.NewBuffer([]byte(form.Encode())))
req.RemoteAddr = defaultRemoteAddr
@@ -14638,9 +13686,6 @@ func TestWebClientChangePwd(t *testing.T) {
webToken, err = getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword+"1")
assert.NoError(t, err)
- csrfToken, err = getCSRFTokenFromInternalPageMock(webClientProfilePath, webToken)
- assert.NoError(t, err)
- form.Set(csrfFormToken, csrfToken)
form.Set("current_password", defaultPassword+"1")
form.Set("new_password1", defaultPassword)
form.Set("new_password2", defaultPassword)
@@ -15069,47 +14114,6 @@ func TestShareUsage(t *testing.T) {
executeRequest(req)
}
-func TestSharePasswordPolicy(t *testing.T) {
- g := getTestGroup()
- g.UserSettings.Filters.PasswordStrength = 70
- group, _, err := httpdtest.AddGroup(g, http.StatusCreated)
- assert.NoError(t, err)
-
- u := getTestUser()
- u.Groups = []sdk.GroupMapping{
- {
- Name: g.Name,
- Type: sdk.GroupTypePrimary,
- },
- }
- u.Password = rand.Text()
- user, _, err := httpdtest.AddUser(u, http.StatusCreated)
- assert.NoError(t, err)
-
- webAPIToken, err := getJWTAPIUserTokenFromTestServer(defaultUsername, u.Password)
- assert.NoError(t, err)
-
- share := dataprovider.Share{
- Name: util.GenerateUniqueID(),
- Scope: dataprovider.ShareScopeRead,
- Paths: []string{"/"},
- Password: defaultPassword,
- }
- asJSON, err := json.Marshal(share)
- assert.NoError(t, err)
- req, err := http.NewRequest(http.MethodPost, userSharesPath, bytes.NewBuffer(asJSON))
- assert.NoError(t, err)
- setBearerForReq(req, webAPIToken)
- rr := executeRequest(req)
- checkResponseCode(t, http.StatusBadRequest, rr)
- assert.Contains(t, rr.Body.String(), "insecure password")
-
- _, err = httpdtest.RemoveUser(user, http.StatusOK)
- assert.NoError(t, err)
- _, err = httpdtest.RemoveGroup(group, http.StatusOK)
- assert.NoError(t, err)
-}
-
func TestShareMaxExpiration(t *testing.T) {
u := getTestUser()
u.Filters.MaxSharesExpiration = 5
@@ -15126,6 +14130,8 @@ func TestShareMaxExpiration(t *testing.T) {
assert.NoError(t, err)
webClientToken, err := getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
assert.NoError(t, err)
+ csrfToken, err := getCSRFToken(httpBaseURL + webClientLoginPath)
+ assert.NoError(t, err)
s := dataprovider.Share{
Name: "test share",
@@ -15179,9 +14185,6 @@ func TestShareMaxExpiration(t *testing.T) {
rr = executeRequest(req)
checkResponseCode(t, http.StatusBadRequest, rr)
assert.Contains(t, rr.Body.String(), "share must expire before")
-
- csrfToken, err := getCSRFTokenFromInternalPageMock(webClientSharePath, webClientToken)
- assert.NoError(t, err)
form := make(url.Values)
form.Set("name", s.Name)
form.Set("scope", strconv.Itoa(int(s.Scope)))
@@ -15294,13 +14297,12 @@ func TestWebClientShareCredentials(t *testing.T) {
checkResponseCode(t, http.StatusOK, rr)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCSRF)
// set the CSRF token
- loginCookie, csrfToken, err := getCSRFTokenMock(loginURI, defaultRemoteAddr)
+ csrfToken, err := getCSRFToken(httpBaseURL + webClientLoginPath)
assert.NoError(t, err)
form.Set(csrfFormToken, csrfToken)
req, err = http.NewRequest(http.MethodPost, loginURI, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
@@ -15343,67 +14345,31 @@ func TestWebClientShareCredentials(t *testing.T) {
req.RemoteAddr = "1.2.3.4:1234"
rr = executeRequest(req)
checkResponseCode(t, http.StatusFound, rr)
- // logout to a different share, the cookie is not valid.
- req, err = http.NewRequest(http.MethodGet, path.Join(webClientPubSharesPath, shareWriteID, "logout"), nil)
- assert.NoError(t, err)
- req.RequestURI = uri
- setJWTCookieForReq(req, cookie)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusForbidden, rr)
- assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidToken)
- // logout
- req, err = http.NewRequest(http.MethodGet, path.Join(webClientPubSharesPath, shareReadID, "logout"), nil)
- assert.NoError(t, err)
- req.RequestURI = uri
- setJWTCookieForReq(req, cookie)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusFound, rr)
- // the cookie is no longer valid
- req, err = http.NewRequest(http.MethodGet, path.Join(webClientPubSharesPath, shareReadID, "download?b=c"), nil)
- assert.NoError(t, err)
- req.RequestURI = uri
- setJWTCookieForReq(req, cookie)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusFound, rr)
- assert.Contains(t, rr.Header().Get("Location"), "/login")
-
// try to login with invalid credentials
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
- form.Set(csrfFormToken, csrfToken)
form.Set("share_password", "")
req, err = http.NewRequest(http.MethodPost, loginURI, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCredentials)
// login with the next param set
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
- form.Set(csrfFormToken, csrfToken)
form.Set("share_password", defaultPassword)
nextURI := path.Join(webClientPubSharesPath, shareReadID, "browse")
loginURI = path.Join(webClientPubSharesPath, shareReadID, fmt.Sprintf("login?next=%s", url.QueryEscape(nextURI)))
req, err = http.NewRequest(http.MethodPost, loginURI, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusFound, rr)
assert.Equal(t, nextURI, rr.Header().Get("Location"))
// try to login to a missing share
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
- form.Set(csrfFormToken, csrfToken)
loginURI = path.Join(webClientPubSharesPath, "missing", "login")
req, err = http.NewRequest(http.MethodPost, loginURI, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
@@ -15546,7 +14512,7 @@ func TestShareMaxSessions(t *testing.T) {
assert.Contains(t, rr.Body.String(), "too many open sessions")
share = dataprovider.Share{
- Name: "test share max sessions read&write",
+ Name: "test share max sessions read/write",
Scope: dataprovider.ShareScopeReadWrite,
Paths: []string{"/"},
}
@@ -15572,7 +14538,6 @@ func TestShareMaxSessions(t *testing.T) {
err = os.RemoveAll(user.GetHomeDir())
assert.NoError(t, err)
assert.Len(t, common.Connections.GetStats(""), 0)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
}
func TestShareUploadSingle(t *testing.T) {
@@ -17043,7 +16008,7 @@ func TestWebClientExistenceCheck(t *testing.T) {
webToken, err := getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webClientProfilePath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
req, err := http.NewRequest(http.MethodPost, webClientExistPath, nil)
@@ -17402,7 +16367,7 @@ func TestWebGetFiles(t *testing.T) {
assert.NoError(t, err)
assert.Len(t, dirEntries, 1)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webClientProfilePath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
form := make(url.Values)
form.Set("files", fmt.Sprintf(`["%s","%s","%s"]`, testFileName, testDir, testFileName+extensions[2]))
@@ -17706,8 +16671,7 @@ func TestRenameDifferentResource(t *testing.T) {
assert.NoError(t, err)
webToken, err := getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webClientProfilePath, webToken)
- assert.NoError(t, err)
+ csrfToken, err := getCSRFToken(httpBaseURL + webClientLoginPath)
getStatusResponse := func(taskID string) int {
req, _ := http.NewRequest(http.MethodGet, webClientTasksPath+"/"+url.PathEscape(taskID), nil)
@@ -18461,7 +17425,7 @@ func TestWebClientTasksAPI(t *testing.T) {
webToken, err := getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webClientProfilePath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webClientLoginPath)
assert.NoError(t, err)
webToken1, err := getJWTWebClientTokenFromTestServer(user1.Username, defaultPassword)
assert.NoError(t, err)
@@ -19159,7 +18123,7 @@ func TestWebAPIVFolder(t *testing.T) {
folder, _, err := httpdtest.GetFolderByName(folderName, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), folder.UsedQuotaSize)
+ assert.Equal(t, int64(len(fileContents)), folder.UsedQuotaSize)
_, err = reader.Seek(0, io.SeekStart)
assert.NoError(t, err)
@@ -19176,7 +18140,7 @@ func TestWebAPIVFolder(t *testing.T) {
folder, _, err = httpdtest.GetFolderByName(folderName, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), folder.UsedQuotaSize)
+ assert.Equal(t, int64(len(fileContents)), folder.UsedQuotaSize)
_, err = httpdtest.RemoveUser(user, http.StatusOK)
assert.NoError(t, err)
@@ -19518,7 +18482,7 @@ func TestCompressionErrorMock(t *testing.T) {
webToken, err := getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webClientProfilePath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
form := make(url.Values)
@@ -19707,7 +18671,6 @@ func TestClientUserClose(t *testing.T) {
wg.Wait()
assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 },
1*time.Second, 100*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
_, err = httpdtest.RemoveUser(user, http.StatusOK)
assert.NoError(t, err)
@@ -19769,13 +18732,12 @@ func TestWebAdminSetupMock(t *testing.T) {
checkResponseCode(t, http.StatusFound, rr)
assert.Equal(t, webAdminSetupPath, rr.Header().Get("Location"))
- loginCookie, csrfToken, err := getCSRFTokenMock(webAdminSetupPath, defaultRemoteAddr)
+ csrfToken, err := getCSRFToken(httpBaseURL + webAdminSetupPath)
assert.NoError(t, err)
form := make(url.Values)
req, err = http.NewRequest(http.MethodPost, webAdminSetupPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusForbidden, rr)
@@ -19783,7 +18745,6 @@ func TestWebAdminSetupMock(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webAdminSetupPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
@@ -19792,7 +18753,6 @@ func TestWebAdminSetupMock(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webAdminSetupPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
@@ -19801,7 +18761,6 @@ func TestWebAdminSetupMock(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webAdminSetupPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
@@ -19820,7 +18779,6 @@ func TestWebAdminSetupMock(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webAdminSetupPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
@@ -19834,7 +18792,6 @@ func TestWebAdminSetupMock(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webAdminSetupPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusFound, rr)
@@ -19986,13 +18943,12 @@ func TestWebAdminLoginMock(t *testing.T) {
rr = executeRequest(req)
checkResponseCode(t, http.StatusFound, rr)
- loginCookie, csrfToken, err := getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
// now try using wrong password
form := getLoginForm(defaultTokenAuthUser, "wrong pwd", csrfToken)
req, _ = http.NewRequest(http.MethodPost, webLoginPath, bytes.NewBuffer([]byte(form.Encode())))
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
@@ -20001,7 +18957,6 @@ func TestWebAdminLoginMock(t *testing.T) {
form = getLoginForm("wrong username", defaultTokenAuthPass, csrfToken)
req, _ = http.NewRequest(http.MethodPost, webLoginPath, bytes.NewBuffer([]byte(form.Encode())))
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
@@ -20016,12 +18971,10 @@ func TestWebAdminLoginMock(t *testing.T) {
assert.NoError(t, err)
rAddr := "127.1.1.1:1234"
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, rAddr)
+ csrfToken, err = getCSRFTokenMock(webLoginPath, rAddr)
assert.NoError(t, err)
- assert.NotEmpty(t, loginCookie)
form = getLoginForm(altAdminUsername, altAdminPassword, csrfToken)
req, _ = http.NewRequest(http.MethodPost, webLoginPath, bytes.NewBuffer([]byte(form.Encode())))
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
req.RemoteAddr = rAddr
rr = executeRequest(req)
@@ -20029,24 +18982,20 @@ func TestWebAdminLoginMock(t *testing.T) {
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCredentials)
rAddr = "10.9.9.9:1234"
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, rAddr)
+ csrfToken, err = getCSRFTokenMock(webLoginPath, rAddr)
assert.NoError(t, err)
- assert.NotEmpty(t, loginCookie)
form = getLoginForm(altAdminUsername, altAdminPassword, csrfToken)
req, _ = http.NewRequest(http.MethodPost, webLoginPath, bytes.NewBuffer([]byte(form.Encode())))
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
req.RemoteAddr = rAddr
- setLoginCookie(req, loginCookie)
rr = executeRequest(req)
checkResponseCode(t, http.StatusFound, rr)
rAddr = "127.0.1.1:4567"
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, rAddr)
+ csrfToken, err = getCSRFTokenMock(webLoginPath, rAddr)
assert.NoError(t, err)
- assert.NotEmpty(t, loginCookie)
form = getLoginForm(altAdminUsername, altAdminPassword, csrfToken)
req, _ = http.NewRequest(http.MethodPost, webLoginPath, bytes.NewBuffer([]byte(form.Encode())))
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
req.RemoteAddr = rAddr
req.Header.Set("X-Forwarded-For", "10.9.9.9")
@@ -20095,9 +19044,9 @@ func TestWebUserShare(t *testing.T) {
user, _, err := httpdtest.AddUser(getTestUser(), http.StatusCreated)
assert.NoError(t, err)
- token, err := getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
+ csrfToken, err := getCSRFToken(httpBaseURL + webClientLoginPath)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webClientProfilePath, token)
+ token, err := getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
assert.NoError(t, err)
userAPItoken, err := getJWTAPIUserTokenFromTestServer(defaultUsername, defaultPassword)
assert.NoError(t, err)
@@ -20336,9 +19285,9 @@ func TestWebUserShareNoPasswordDisabled(t *testing.T) {
user.Filters.DefaultSharesExpiration = 30
user, _, err = httpdtest.UpdateUser(u, http.StatusOK, "")
assert.NoError(t, err)
- token, err := getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
+ csrfToken, err := getCSRFToken(httpBaseURL + webClientLoginPath)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webClientSharePath, token)
+ token, err := getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
assert.NoError(t, err)
userAPItoken, err := getJWTAPIUserTokenFromTestServer(defaultUsername, defaultPassword)
assert.NoError(t, err)
@@ -20420,74 +19369,13 @@ func TestWebUserShareNoPasswordDisabled(t *testing.T) {
assert.NoError(t, err)
}
-func TestInvalidCSRF(t *testing.T) {
- user, _, err := httpdtest.AddUser(getTestUser(), http.StatusCreated)
- assert.NoError(t, err)
-
- for _, loginURL := range []string{webClientLoginPath, webLoginPath} {
- // try using an invalid CSRF token
- loginCookie1, csrfToken1, err := getCSRFTokenMock(loginURL, defaultRemoteAddr)
- assert.NoError(t, err)
- assert.NotEmpty(t, loginCookie1)
- assert.NotEmpty(t, csrfToken1)
- loginCookie2, csrfToken2, err := getCSRFTokenMock(loginURL, defaultRemoteAddr)
- assert.NoError(t, err)
- assert.NotEmpty(t, loginCookie2)
- assert.NotEmpty(t, csrfToken2)
- rAddr := "1.2.3.4"
- loginCookie3, csrfToken3, err := getCSRFTokenMock(loginURL, rAddr)
- assert.NoError(t, err)
- assert.NotEmpty(t, loginCookie3)
- assert.NotEmpty(t, csrfToken3)
-
- form := getLoginForm(defaultUsername, defaultPassword, csrfToken1)
- req, err := http.NewRequest(http.MethodPost, loginURL, bytes.NewBuffer([]byte(form.Encode())))
- assert.NoError(t, err)
- req.RemoteAddr = defaultRemoteAddr
- req.RequestURI = loginURL
- setLoginCookie(req, loginCookie2)
- req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
- rr := executeRequest(req)
- checkResponseCode(t, http.StatusOK, rr)
- assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCSRF)
-
- // use a CSRF token as login cookie (invalid audience)
- form = getLoginForm(defaultUsername, defaultPassword, csrfToken1)
- req, err = http.NewRequest(http.MethodPost, loginURL, bytes.NewBuffer([]byte(form.Encode())))
- assert.NoError(t, err)
- req.RemoteAddr = defaultRemoteAddr
- req.RequestURI = loginURL
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", csrfToken1))
- req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusOK, rr)
- assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCSRF)
- // invalid IP
- form = getLoginForm(defaultUsername, defaultPassword, csrfToken3)
- req, err = http.NewRequest(http.MethodPost, loginURL, bytes.NewBuffer([]byte(form.Encode())))
- assert.NoError(t, err)
- req.RemoteAddr = defaultRemoteAddr
- req.RequestURI = loginURL
- setLoginCookie(req, loginCookie3)
- req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusOK, rr)
- assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCSRF)
- }
-
- err = os.RemoveAll(user.GetHomeDir())
- assert.NoError(t, err)
- _, err = httpdtest.RemoveUser(user, http.StatusOK)
- assert.NoError(t, err)
-}
-
func TestWebUserProfile(t *testing.T) {
user, _, err := httpdtest.AddUser(getTestUser(), http.StatusCreated)
assert.NoError(t, err)
- token, err := getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
+ csrfToken, err := getCSRFToken(httpBaseURL + webClientLoginPath)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webClientProfilePath, token)
+ token, err := getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
assert.NoError(t, err)
email := "user@user.com"
@@ -20500,7 +19388,6 @@ func TestWebUserProfile(t *testing.T) {
form.Set("public_keys[0][public_key]", testPubKey)
form.Set("public_keys[1][public_key]", testPubKey1)
form.Set("tls_certs[0][tls_cert]", httpsCert)
- form.Set("additional_emails[0][additional_email]", "email1@user.com")
// no csrf token
req, err := http.NewRequest(http.MethodPost, webClientProfilePath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
@@ -20527,9 +19414,6 @@ func TestWebUserProfile(t *testing.T) {
assert.Len(t, user.Filters.TLSCerts, 1)
assert.Equal(t, email, user.Email)
assert.Equal(t, description, user.Description)
- if assert.Len(t, user.Filters.AdditionalEmails, 1) {
- assert.Equal(t, "email1@user.com", user.Filters.AdditionalEmails[0])
- }
// set an invalid email
form.Set("email", "not an email")
@@ -20568,8 +19452,6 @@ func TestWebUserProfile(t *testing.T) {
assert.NoError(t, err)
token, err = getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
assert.NoError(t, err)
- csrfToken, err = getCSRFTokenFromInternalPageMock(webClientProfilePath, token)
- assert.NoError(t, err)
form.Set("allow_api_key_auth", "0")
form.Set(csrfFormToken, csrfToken)
@@ -20594,12 +19476,9 @@ func TestWebUserProfile(t *testing.T) {
assert.NoError(t, err)
token, err = getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
assert.NoError(t, err)
- csrfToken, err = getCSRFTokenFromInternalPageMock(webClientProfilePath, token)
- assert.NoError(t, err)
form.Set("public_keys[0][public_key]", testPubKey)
form.Set("public_keys[1][public_key]", testPubKey1)
form.Set("tls_certs[0][tls_cert]", "")
- form.Set(csrfFormToken, csrfToken)
req, _ = http.NewRequest(http.MethodPost, webClientProfilePath, bytes.NewBuffer([]byte(form.Encode())))
req.RemoteAddr = defaultRemoteAddr
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
@@ -20620,11 +19499,8 @@ func TestWebUserProfile(t *testing.T) {
assert.NoError(t, err)
token, err = getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
assert.NoError(t, err)
- csrfToken, err = getCSRFTokenFromInternalPageMock(webClientProfilePath, token)
- assert.NoError(t, err)
form.Set("email", "newemail@user.com")
form.Set("description", "new description")
- form.Set(csrfFormToken, csrfToken)
req, _ = http.NewRequest(http.MethodPost, webClientProfilePath, bytes.NewBuffer([]byte(form.Encode())))
req.RemoteAddr = defaultRemoteAddr
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
@@ -20646,9 +19522,6 @@ func TestWebUserProfile(t *testing.T) {
assert.NoError(t, err)
token, err = getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
assert.NoError(t, err)
- csrfToken, err = getCSRFTokenFromInternalPageMock(webChangeClientPwdPath, token)
- assert.NoError(t, err)
- form.Set(csrfFormToken, csrfToken)
req, _ = http.NewRequest(http.MethodPost, webClientProfilePath, bytes.NewBuffer([]byte(form.Encode())))
req.RemoteAddr = defaultRemoteAddr
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
@@ -20679,7 +19552,7 @@ func TestWebAdminProfile(t *testing.T) {
assert.NoError(t, err)
token, err := getJWTWebTokenFromTestServer(admin.Username, altAdminPassword)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webAdminProfilePath, token)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
req, err := http.NewRequest(http.MethodGet, webAdminProfilePath, nil)
assert.NoError(t, err)
@@ -20756,7 +19629,7 @@ func TestWebAdminPwdChange(t *testing.T) {
token, err := getJWTWebTokenFromTestServer(admin.Username, altAdminPassword)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webChangeAdminPwdPath, token)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
req, err := http.NewRequest(http.MethodGet, webChangeAdminPwdPath, nil)
assert.NoError(t, err)
@@ -21225,7 +20098,7 @@ func TestBasicWebUsersMock(t *testing.T) {
setJWTCookieForReq(req, webToken)
rr = executeRequest(req)
checkResponseCode(t, http.StatusNotFound, rr)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webUserPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
form := make(url.Values)
form.Set("username", user.Username)
@@ -21287,7 +20160,7 @@ func TestWebAdminBasicMock(t *testing.T) {
admin := getTestAdmin()
admin.Username = altAdminUsername
admin.Password = altAdminPassword
- csrfToken, err := getCSRFTokenFromInternalPageMock(webAdminPath, token)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
form := make(url.Values)
form.Set("username", admin.Username)
@@ -21331,6 +20204,13 @@ func TestWebAdminBasicMock(t *testing.T) {
assert.Contains(t, rr.Body.String(), util.I18nError500Message)
form.Set("default_users_expiration", "10")
+ req, _ = http.NewRequest(http.MethodPost, webAdminPath, bytes.NewBuffer([]byte(form.Encode())))
+ req.RemoteAddr = defaultRemoteAddr
+ req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+ setJWTCookieForReq(req, token)
+ rr = executeRequest(req)
+ checkResponseCode(t, http.StatusOK, rr)
+
form.Set("password", admin.Password)
req, _ = http.NewRequest(http.MethodPost, webAdminPath, bytes.NewBuffer([]byte(form.Encode())))
req.RemoteAddr = defaultRemoteAddr
@@ -21360,17 +20240,6 @@ func TestWebAdminBasicMock(t *testing.T) {
checkResponseCode(t, http.StatusForbidden, rr)
assert.Contains(t, rr.Body.String(), "Invalid token")
- req, err = http.NewRequest(http.MethodPost, webAdminTOTPSavePath, bytes.NewBuffer(asJSON))
- assert.NoError(t, err)
- setJWTCookieForReq(req, altToken)
- setCSRFHeaderForReq(req, csrfToken) // invalid CSRF token
- req.RemoteAddr = defaultRemoteAddr
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusForbidden, rr)
- assert.Contains(t, rr.Body.String(), "the token is not valid")
-
- csrfToken, err = getCSRFTokenFromInternalPageMock(webAdminPath, altToken)
- assert.NoError(t, err)
req, err = http.NewRequest(http.MethodPost, webAdminTOTPSavePath, bytes.NewBuffer(asJSON))
assert.NoError(t, err)
setJWTCookieForReq(req, altToken)
@@ -21447,7 +20316,7 @@ func TestWebAdminBasicMock(t *testing.T) {
rr = executeRequest(req)
checkResponseCode(t, http.StatusSeeOther, rr)
- form.Set(csrfFormToken, csrfToken) // associated to altToken
+ form.Set(csrfFormToken, "invalid csrf")
req, _ = http.NewRequest(http.MethodPost, path.Join(webAdminPath, altAdminUsername), bytes.NewBuffer([]byte(form.Encode())))
req.RemoteAddr = defaultRemoteAddr
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
@@ -21456,8 +20325,6 @@ func TestWebAdminBasicMock(t *testing.T) {
checkResponseCode(t, http.StatusForbidden, rr)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCSRF)
- csrfToken, err = getCSRFTokenFromInternalPageMock(webAdminPath, token)
- assert.NoError(t, err)
form.Set(csrfFormToken, csrfToken)
form.Set("email", "not-an-email")
req, _ = http.NewRequest(http.MethodPost, path.Join(webAdminPath, altAdminUsername), bytes.NewBuffer([]byte(form.Encode())))
@@ -21567,7 +20434,7 @@ func TestWebAdminGroupsMock(t *testing.T) {
admin := getTestAdmin()
admin.Username = altAdminUsername
admin.Password = altAdminPassword
- csrfToken, err := getCSRFTokenFromInternalPageMock(webAdminPath, token)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
form := make(url.Values)
form.Set(csrfFormToken, csrfToken)
@@ -21705,7 +20572,7 @@ func TestAdminUpdateSelfMock(t *testing.T) {
assert.NoError(t, err)
token, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webAdminPath, token)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
form := make(url.Values)
form.Set("username", admin.Username)
@@ -21763,8 +20630,9 @@ func TestWebMaintenanceMock(t *testing.T) {
setJWTCookieForReq(req, token)
rr := executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webMaintenancePath, token)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
+
form := make(url.Values)
form.Set("mode", "a")
b, contentType, _ := getMultipartFormData(form, "", "")
@@ -21883,7 +20751,7 @@ func TestWebUserAddMock(t *testing.T) {
assert.NoError(t, err)
apiToken, err := getJWTAPITokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webUserPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
group1 := getTestGroup()
group1.Name += "_1"
@@ -21906,7 +20774,6 @@ func TestWebUserAddMock(t *testing.T) {
user.AdditionalInfo = "info"
user.Description = "user dsc"
user.Email = "test@test.com"
- user.Filters.AdditionalEmails = []string{"example1@test.com", "example2@test.com"}
mappedDir := filepath.Join(os.TempDir(), "mapped")
folderName := filepath.Base(mappedDir)
f := vfs.BaseVirtualFolder{
@@ -21924,8 +20791,6 @@ func TestWebUserAddMock(t *testing.T) {
form.Set(csrfFormToken, csrfToken)
form.Set("username", user.Username)
form.Set("email", user.Email)
- form.Set("additional_emails[0][additional_email]", user.Filters.AdditionalEmails[0])
- form.Set("additional_emails[1][additional_email]", user.Filters.AdditionalEmails[1])
form.Set("home_dir", user.HomeDir)
form.Set("osfs_read_buffer_size", "2")
form.Set("osfs_write_buffer_size", "3")
@@ -22252,7 +21117,6 @@ func TestWebUserAddMock(t *testing.T) {
assert.True(t, newUser.Filters.DisableFsChecks)
assert.False(t, newUser.Filters.AllowAPIKeyAuth)
assert.Equal(t, user.Email, newUser.Email)
- assert.Equal(t, len(user.Filters.AdditionalEmails), len(newUser.Filters.AdditionalEmails))
assert.Equal(t, "/start/dir", newUser.Filters.StartDirectory)
assert.Equal(t, 0, newUser.Filters.FTPSecurity)
assert.Equal(t, 10, newUser.Filters.DefaultSharesExpiration)
@@ -22261,10 +21125,10 @@ func TestWebUserAddMock(t *testing.T) {
assert.Equal(t, 60, newUser.Filters.PasswordStrength)
assert.Greater(t, newUser.LastPasswordChange, int64(0))
assert.True(t, newUser.Filters.RequirePasswordChange)
- assert.True(t, slices.Contains(newUser.PublicKeys, testPubKey))
+ assert.True(t, util.Contains(newUser.PublicKeys, testPubKey))
if val, ok := newUser.Permissions["/subdir"]; ok {
- assert.True(t, slices.Contains(val, dataprovider.PermListItems))
- assert.True(t, slices.Contains(val, dataprovider.PermDownload))
+ assert.True(t, util.Contains(val, dataprovider.PermListItems))
+ assert.True(t, util.Contains(val, dataprovider.PermDownload))
} else {
assert.Fail(t, "user permissions must contain /somedir", "actual: %v", newUser.Permissions)
}
@@ -22283,20 +21147,20 @@ func TestWebUserAddMock(t *testing.T) {
case "/dir1":
assert.Len(t, filter.DeniedPatterns, 1)
assert.Len(t, filter.AllowedPatterns, 1)
- assert.True(t, slices.Contains(filter.AllowedPatterns, "*.png"))
- assert.True(t, slices.Contains(filter.DeniedPatterns, "*.zip"))
+ assert.True(t, util.Contains(filter.AllowedPatterns, "*.png"))
+ assert.True(t, util.Contains(filter.DeniedPatterns, "*.zip"))
assert.Equal(t, sdk.DenyPolicyDefault, filter.DenyPolicy)
case "/dir2":
assert.Len(t, filter.DeniedPatterns, 1)
assert.Len(t, filter.AllowedPatterns, 2)
- assert.True(t, slices.Contains(filter.AllowedPatterns, "*.jpg"))
- assert.True(t, slices.Contains(filter.AllowedPatterns, "*.png"))
- assert.True(t, slices.Contains(filter.DeniedPatterns, "*.mkv"))
+ assert.True(t, util.Contains(filter.AllowedPatterns, "*.jpg"))
+ assert.True(t, util.Contains(filter.AllowedPatterns, "*.png"))
+ assert.True(t, util.Contains(filter.DeniedPatterns, "*.mkv"))
assert.Equal(t, sdk.DenyPolicyHide, filter.DenyPolicy)
case "/dir3":
assert.Len(t, filter.DeniedPatterns, 1)
assert.Len(t, filter.AllowedPatterns, 0)
- assert.True(t, slices.Contains(filter.DeniedPatterns, "*.rar"))
+ assert.True(t, util.Contains(filter.DeniedPatterns, "*.rar"))
assert.Equal(t, sdk.DenyPolicyDefault, filter.DenyPolicy)
}
}
@@ -22342,6 +21206,8 @@ func TestWebUserUpdateMock(t *testing.T) {
assert.NoError(t, err)
apiToken, err := getJWTAPITokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
+ assert.NoError(t, err)
user := getTestUser()
user.Filters.BandwidthLimits = []sdk.BandwidthLimit{
{
@@ -22380,8 +21246,6 @@ func TestWebUserUpdateMock(t *testing.T) {
checkResponseCode(t, http.StatusForbidden, rr)
assert.Contains(t, rr.Body.String(), "Invalid token")
- csrfToken, err := getCSRFTokenFromInternalPageMock(webClientProfilePath, userToken)
- assert.NoError(t, err)
req, err = http.NewRequest(http.MethodPost, webClientTOTPSavePath, bytes.NewBuffer(asJSON))
assert.NoError(t, err)
setJWTCookieForReq(req, userToken)
@@ -22466,8 +21330,6 @@ func TestWebUserUpdateMock(t *testing.T) {
checkResponseCode(t, http.StatusForbidden, rr)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCSRF)
- csrfToken, err = getCSRFTokenFromInternalPageMock(webUserPath, webToken)
- assert.NoError(t, err)
form.Set(csrfFormToken, csrfToken)
b, contentType, _ = getMultipartFormData(form, "", "")
req, _ = http.NewRequest(http.MethodPost, path.Join(webUserPath, user.Username), &b)
@@ -22537,16 +21399,16 @@ func TestWebUserUpdateMock(t *testing.T) {
assert.Equal(t, 40, updateUser.Filters.PasswordStrength)
assert.True(t, updateUser.Filters.RequirePasswordChange)
if val, ok := updateUser.Permissions["/otherdir"]; ok {
- assert.True(t, slices.Contains(val, dataprovider.PermListItems))
- assert.True(t, slices.Contains(val, dataprovider.PermUpload))
+ assert.True(t, util.Contains(val, dataprovider.PermListItems))
+ assert.True(t, util.Contains(val, dataprovider.PermUpload))
} else {
assert.Fail(t, "user permissions must contains /otherdir", "actual: %v", updateUser.Permissions)
}
- assert.True(t, slices.Contains(updateUser.Filters.AllowedIP, "192.168.1.3/32"))
- assert.True(t, slices.Contains(updateUser.Filters.DeniedIP, "10.0.0.2/32"))
- assert.True(t, slices.Contains(updateUser.Filters.DeniedLoginMethods, dataprovider.SSHLoginMethodKeyboardInteractive))
- assert.True(t, slices.Contains(updateUser.Filters.DeniedProtocols, common.ProtocolFTP))
- assert.True(t, slices.Contains(updateUser.Filters.FilePatterns[0].DeniedPatterns, "*.zip"))
+ assert.True(t, util.Contains(updateUser.Filters.AllowedIP, "192.168.1.3/32"))
+ assert.True(t, util.Contains(updateUser.Filters.DeniedIP, "10.0.0.2/32"))
+ assert.True(t, util.Contains(updateUser.Filters.DeniedLoginMethods, dataprovider.SSHLoginMethodKeyboardInteractive))
+ assert.True(t, util.Contains(updateUser.Filters.DeniedProtocols, common.ProtocolFTP))
+ assert.True(t, util.Contains(updateUser.Filters.FilePatterns[0].DeniedPatterns, "*.zip"))
assert.Len(t, updateUser.Filters.BandwidthLimits, 0)
assert.Len(t, updateUser.Filters.TLSCerts, 1)
req, err = http.NewRequest(http.MethodDelete, path.Join(userPath, user.Username), nil)
@@ -22617,10 +21479,112 @@ func TestRenderUserTemplateMock(t *testing.T) {
assert.NoError(t, err)
}
+func TestUserTemplateWithFoldersMock(t *testing.T) {
+ folder := vfs.BaseVirtualFolder{
+ Name: "vfolder",
+ MappedPath: filepath.Join(os.TempDir(), "mapped"),
+ Description: "vfolder desc with spéciàl ch@rs",
+ }
+
+ token, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
+ assert.NoError(t, err)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
+ assert.NoError(t, err)
+ user := getTestUser()
+ form := make(url.Values)
+ form.Set("username", user.Username)
+ form.Set("home_dir", filepath.Join(os.TempDir(), "%username%"))
+ form.Set("uid", strconv.FormatInt(int64(user.UID), 10))
+ form.Set("gid", strconv.FormatInt(int64(user.GID), 10))
+ form.Set("max_sessions", strconv.FormatInt(int64(user.MaxSessions), 10))
+ form.Set("quota_size", strconv.FormatInt(user.QuotaSize, 10))
+ form.Set("quota_files", strconv.FormatInt(int64(user.QuotaFiles), 10))
+ form.Set("upload_bandwidth", "0")
+ form.Set("download_bandwidth", "0")
+ form.Set("upload_data_transfer", "0")
+ form.Set("download_data_transfer", "0")
+ form.Set("total_data_transfer", "0")
+ form.Set("permissions", "*")
+ form.Set("status", strconv.Itoa(user.Status))
+ form.Set("expiration_date", "2020-01-01 00:00:00")
+ form.Set("fs_provider", "0")
+ form.Set("max_upload_file_size", "0")
+ form.Set("default_shares_expiration", "0")
+ form.Set("max_shares_expiration", "0")
+ form.Set("password_expiration", "0")
+ form.Set("password_strength", "0")
+ form.Set("ftp_security", "1")
+ form.Set("external_auth_cache_time", "0")
+ form.Set("description", "desc %username% %password%")
+ form.Set("start_directory", "/base/%username%")
+ form.Set("vfolder_path", "/vdir%username%")
+ form.Set("vfolder_name", folder.Name)
+ form.Set("vfolder_quota_size", "-1")
+ form.Set("vfolder_quota_files", "-1")
+ form.Add("tpl_username", "auser1")
+ form.Add("tpl_password", "password1")
+ form.Add("tpl_public_keys", " ")
+ form.Add("tpl_username", "auser2")
+ form.Add("tpl_password", "password2")
+ form.Add("tpl_public_keys", testPubKey)
+ form.Add("tpl_username", "auser1")
+ form.Add("tpl_password", "password")
+ form.Add("tpl_public_keys", "")
+ form.Set("form_action", "export_from_template")
+ b, contentType, _ := getMultipartFormData(form, "", "")
+ req, _ := http.NewRequest(http.MethodPost, webTemplateUser, &b)
+ setJWTCookieForReq(req, token)
+ req.Header.Set("Content-Type", contentType)
+ rr := executeRequest(req)
+ checkResponseCode(t, http.StatusForbidden, rr)
+ require.Contains(t, rr.Body.String(), util.I18nErrorInvalidCSRF)
+
+ folder, resp, err := httpdtest.AddFolder(folder, http.StatusCreated)
+ assert.NoError(t, err, string(resp))
+
+ form.Set(csrfFormToken, csrfToken)
+ b, contentType, _ = getMultipartFormData(form, "", "")
+ req, _ = http.NewRequest(http.MethodPost, webTemplateUser, &b)
+ setJWTCookieForReq(req, token)
+ req.Header.Set("Content-Type", contentType)
+ rr = executeRequest(req)
+ checkResponseCode(t, http.StatusOK, rr)
+
+ var dump dataprovider.BackupData
+ err = json.Unmarshal(rr.Body.Bytes(), &dump)
+ assert.NoError(t, err)
+ assert.Len(t, dump.Users, 2)
+ assert.Len(t, dump.Folders, 1)
+ user1 := dump.Users[0]
+ user2 := dump.Users[1]
+ folder1 := dump.Folders[0]
+ assert.Equal(t, "auser1", user1.Username)
+ assert.Equal(t, "auser2", user2.Username)
+ assert.Equal(t, "desc auser1 password1", user1.Description)
+ assert.Equal(t, "desc auser2 password2", user2.Description)
+ assert.Equal(t, filepath.Join(os.TempDir(), user1.Username), user1.HomeDir)
+ assert.Equal(t, filepath.Join(os.TempDir(), user2.Username), user2.HomeDir)
+ assert.Equal(t, path.Join("/base", user1.Username), user1.Filters.StartDirectory)
+ assert.Equal(t, path.Join("/base", user2.Username), user2.Filters.StartDirectory)
+ assert.Equal(t, 0, user2.Filters.DefaultSharesExpiration)
+ assert.Equal(t, folder.Name, folder1.Name)
+ assert.Len(t, user1.PublicKeys, 0)
+ assert.Len(t, user2.PublicKeys, 1)
+ assert.Len(t, user1.VirtualFolders, 1)
+ assert.Len(t, user2.VirtualFolders, 1)
+ assert.Equal(t, "/vdirauser1", user1.VirtualFolders[0].VirtualPath)
+ assert.Equal(t, "/vdirauser2", user2.VirtualFolders[0].VirtualPath)
+ assert.Equal(t, 1, user1.Filters.FTPSecurity)
+ assert.Equal(t, 1, user2.Filters.FTPSecurity)
+
+ _, err = httpdtest.RemoveFolder(folder, http.StatusOK)
+ assert.NoError(t, err)
+}
+
func TestUserSaveFromTemplateMock(t *testing.T) {
token, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webTemplateFolder, token)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
user1 := "u1"
user2 := "u2"
@@ -22652,48 +21616,18 @@ func TestUserSaveFromTemplateMock(t *testing.T) {
form.Add("template_users[0][tpl_public_keys]", " ")
form.Add("template_users[1][tpl_username]", user2)
form.Add("template_users[1][tpl_public_keys]", testPubKey)
+ form.Set(csrfFormToken, csrfToken)
b, contentType, _ := getMultipartFormData(form, "", "")
req, _ := http.NewRequest(http.MethodPost, webTemplateUser, &b)
setJWTCookieForReq(req, token)
req.Header.Set("Content-Type", contentType)
rr := executeRequest(req)
- checkResponseCode(t, http.StatusForbidden, rr)
- assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCSRF)
-
- form.Set(csrfFormToken, csrfToken)
- b, contentType, _ = getMultipartFormData(form, "", "")
- req, _ = http.NewRequest(http.MethodPost, webTemplateUser, &b)
- setJWTCookieForReq(req, token)
- req.Header.Set("Content-Type", contentType)
- rr = executeRequest(req)
checkResponseCode(t, http.StatusSeeOther, rr)
u1, _, err := httpdtest.GetUserByUsername(user1, http.StatusOK)
assert.NoError(t, err)
- assert.False(t, u1.Filters.RequirePasswordChange)
u2, _, err := httpdtest.GetUserByUsername(user2, http.StatusOK)
assert.NoError(t, err)
- assert.False(t, u2.Filters.RequirePasswordChange)
-
- _, err = httpdtest.RemoveUser(u1, http.StatusOK)
- assert.NoError(t, err)
- _, err = httpdtest.RemoveUser(u2, http.StatusOK)
- assert.NoError(t, err)
-
- form.Add("tpl_require_password_change", "checked")
- b, contentType, _ = getMultipartFormData(form, "", "")
- req, _ = http.NewRequest(http.MethodPost, webTemplateUser, &b)
- setJWTCookieForReq(req, token)
- req.Header.Set("Content-Type", contentType)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusSeeOther, rr)
-
- u1, _, err = httpdtest.GetUserByUsername(user1, http.StatusOK)
- assert.NoError(t, err)
- assert.True(t, u1.Filters.RequirePasswordChange)
- u2, _, err = httpdtest.GetUserByUsername(user2, http.StatusOK)
- assert.NoError(t, err)
- assert.True(t, u2.Filters.RequirePasswordChange)
_, err = httpdtest.RemoveUser(u1, http.StatusOK)
assert.NoError(t, err)
@@ -22720,11 +21654,9 @@ func TestUserSaveFromTemplateMock(t *testing.T) {
assert.NoError(t, err)
}
-func TestUserTemplateErrors(t *testing.T) {
+func TestUserTemplateMock(t *testing.T) {
token, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webTemplateFolder, token)
- assert.NoError(t, err)
user := getTestUser()
user.FsConfig.Provider = sdk.S3FilesystemProvider
user.FsConfig.S3Config.Bucket = "test"
@@ -22735,6 +21667,8 @@ func TestUserTemplateErrors(t *testing.T) {
user.FsConfig.S3Config.UploadConcurrency = 4
user.FsConfig.S3Config.DownloadPartSize = 6
user.FsConfig.S3Config.DownloadConcurrency = 3
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
+ assert.NoError(t, err)
form := make(url.Values)
form.Set(csrfFormToken, csrfToken)
form.Set("username", user.Username)
@@ -22760,7 +21694,6 @@ func TestUserTemplateErrors(t *testing.T) {
form.Set("s3_region", user.FsConfig.S3Config.Region)
form.Set("s3_access_key", "%username%")
form.Set("s3_access_secret", "%password%")
- form.Set("s3_sse_customer_key", "%password%")
form.Set("s3_key_prefix", "base/%username%")
form.Set("max_upload_file_size", "0")
form.Set("default_shares_expiration", "0")
@@ -22785,14 +21718,13 @@ func TestUserTemplateErrors(t *testing.T) {
form.Set("s3_upload_concurrency", strconv.Itoa(user.FsConfig.S3Config.UploadConcurrency))
form.Set("s3_download_part_size", strconv.FormatInt(user.FsConfig.S3Config.DownloadPartSize, 10))
form.Set("s3_download_concurrency", strconv.Itoa(user.FsConfig.S3Config.DownloadConcurrency))
- // no user defined
+
b, contentType, _ = getMultipartFormData(form, "", "")
req, _ = http.NewRequest(http.MethodPost, webTemplateUser, &b)
setJWTCookieForReq(req, token)
req.Header.Set("Content-Type", contentType)
rr = executeRequest(req)
checkResponseCode(t, http.StatusBadRequest, rr)
- assert.Contains(t, rr.Body.String(), util.I18nErrorUserTemplate)
form.Set("template_users[0][tpl_username]", "user1")
form.Set("template_users[0][tpl_password]", "password1")
@@ -22815,141 +21747,73 @@ func TestUserTemplateErrors(t *testing.T) {
rr = executeRequest(req)
checkResponseCode(t, http.StatusBadRequest, rr)
require.Contains(t, rr.Body.String(), util.I18nErrorUserTemplate)
-}
-func TestUserTemplateRoleAndPermissions(t *testing.T) {
- r1 := getTestRole()
- r2 := getTestRole()
- r2.Name += "_mod"
- role1, resp, err := httpdtest.AddRole(r1, http.StatusCreated)
- assert.NoError(t, err, string(resp))
- role2, resp, err := httpdtest.AddRole(r2, http.StatusCreated)
- assert.NoError(t, err, string(resp))
- admin := getTestAdmin()
- admin.Username = altAdminUsername
- admin.Password = altAdminPassword
- admin.Role = role1.Name
- admin.Permissions = []string{dataprovider.PermAdminManageFolders, dataprovider.PermAdminChangeUsers,
- dataprovider.PermAdminViewUsers}
- admin, _, err = httpdtest.AddAdmin(admin, http.StatusCreated)
- assert.NoError(t, err)
-
- token, err := getJWTWebTokenFromTestServer(altAdminUsername, altAdminPassword)
- assert.NoError(t, err)
-
- req, _ := http.NewRequest(http.MethodGet, webTemplateUser, nil)
- setJWTCookieForReq(req, token)
- rr := executeRequest(req)
- checkResponseCode(t, http.StatusForbidden, rr)
-
- csrfToken, err := getCSRFTokenFromInternalPageMock(webTemplateFolder, token)
- assert.NoError(t, err)
- user1 := "u1"
- user2 := "u2"
- form := make(url.Values)
- form.Set("username", "")
- form.Set("role", role2.Name)
- form.Set("home_dir", filepath.Join(os.TempDir(), "%username%"))
- form.Set("upload_bandwidth", "0")
- form.Set("download_bandwidth", "0")
- form.Set("upload_data_transfer", "0")
- form.Set("download_data_transfer", "0")
- form.Set("total_data_transfer", "0")
- form.Set("uid", "0")
- form.Set("gid", "0")
- form.Set("max_sessions", "0")
- form.Set("quota_size", "0")
- form.Set("quota_files", "0")
- form.Set("permissions", "*")
- form.Set("status", "1")
- form.Set("expiration_date", "")
- form.Set("fs_provider", "0")
- form.Set("max_upload_file_size", "0")
- form.Set("default_shares_expiration", "0")
- form.Set("max_shares_expiration", "0")
- form.Set("password_expiration", "0")
- form.Set("password_strength", "0")
- form.Set("external_auth_cache_time", "0")
- form.Add("template_users[0][tpl_username]", user1)
- form.Add("template_users[0][tpl_password]", "password1")
- form.Add("template_users[0][tpl_public_keys]", " ")
- form.Add("template_users[1][tpl_username]", user2)
- form.Add("template_users[1][tpl_public_keys]", testPubKey)
- form.Set(csrfFormToken, csrfToken)
- b, contentType, _ := getMultipartFormData(form, "", "")
+ form.Set("template_users[0][tpl_username]", "user1")
+ form.Set("template_users[0][tpl_password]", "password1")
+ form.Set("template_users[0][tpl_public_keys]", " ")
+ form.Set("template_users[1][tpl_username]", "user2")
+ form.Set("template_users[1][tpl_password]", "password2")
+ form.Set("template_users[1][tpl_public_keys]", testPubKey)
+ form.Set("template_users[2][tpl_username]", "")
+ form.Set("template_users[2][tpl_password]", "password3")
+ form.Set("template_users[2][tpl_public_keys]", testPubKey)
+ b, contentType, _ = getMultipartFormData(form, "", "")
req, _ = http.NewRequest(http.MethodPost, webTemplateUser, &b)
setJWTCookieForReq(req, token)
req.Header.Set("Content-Type", contentType)
rr = executeRequest(req)
- checkResponseCode(t, http.StatusForbidden, rr)
- // Add the required permissions
- admin.Permissions = append(admin.Permissions, dataprovider.PermAdminAddUsers)
- _, _, err = httpdtest.UpdateAdmin(admin, http.StatusOK)
- assert.NoError(t, err)
-
- token, err = getJWTWebTokenFromTestServer(altAdminUsername, altAdminPassword)
- assert.NoError(t, err)
-
- req, _ = http.NewRequest(http.MethodGet, webTemplateUser, nil)
- setJWTCookieForReq(req, token)
- rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
- csrfToken, err = getCSRFTokenFromInternalPageMock(webTemplateUser, token)
- assert.NoError(t, err)
- form.Set(csrfFormToken, csrfToken)
+ var dump dataprovider.BackupData
+ err = json.Unmarshal(rr.Body.Bytes(), &dump)
+ require.NoError(t, err)
+ require.Len(t, dump.Users, 2)
+ require.Len(t, dump.Admins, 0)
+ require.Len(t, dump.Folders, 0)
- b, contentType, _ = getMultipartFormData(form, "", "")
- req, _ = http.NewRequest(http.MethodPost, webTemplateUser, &b)
- setJWTCookieForReq(req, token)
- req.Header.Set("Content-Type", contentType)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusSeeOther, rr)
-
- u1, _, err := httpdtest.GetUserByUsername(user1, http.StatusOK)
- assert.NoError(t, err)
- assert.Equal(t, admin.Role, u1.Role)
- u2, _, err := httpdtest.GetUserByUsername(user2, http.StatusOK)
- assert.NoError(t, err)
- assert.Equal(t, admin.Role, u2.Role)
-
- _, err = httpdtest.RemoveUser(u1, http.StatusOK)
- assert.NoError(t, err)
- _, err = httpdtest.RemoveUser(u2, http.StatusOK)
- assert.NoError(t, err)
- // Set an empty role
- form.Set("role", "")
- b, contentType, _ = getMultipartFormData(form, "", "")
- req, _ = http.NewRequest(http.MethodPost, webTemplateUser, &b)
- setJWTCookieForReq(req, token)
- req.Header.Set("Content-Type", contentType)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusSeeOther, rr)
-
- u1, _, err = httpdtest.GetUserByUsername(user1, http.StatusOK)
- assert.NoError(t, err)
- assert.Equal(t, admin.Role, u1.Role)
- u2, _, err = httpdtest.GetUserByUsername(user2, http.StatusOK)
- assert.NoError(t, err)
- assert.Equal(t, admin.Role, u2.Role)
-
- _, err = httpdtest.RemoveUser(u1, http.StatusOK)
- assert.NoError(t, err)
- _, err = httpdtest.RemoveUser(u2, http.StatusOK)
- assert.NoError(t, err)
-
- _, err = httpdtest.RemoveAdmin(admin, http.StatusOK)
- assert.NoError(t, err)
- _, err = httpdtest.RemoveRole(role1, http.StatusOK)
- assert.NoError(t, err)
- _, err = httpdtest.RemoveRole(role2, http.StatusOK)
- assert.NoError(t, err)
+ var user1, user2 dataprovider.User
+ for _, u := range dump.Users {
+ switch u.Username {
+ case "user1":
+ user1 = u
+ default:
+ user2 = u
+ }
+ }
+ require.Equal(t, "user1", user1.Username)
+ require.Equal(t, sdk.S3FilesystemProvider, user1.FsConfig.Provider)
+ require.Equal(t, "user2", user2.Username)
+ require.Equal(t, sdk.S3FilesystemProvider, user2.FsConfig.Provider)
+ require.Len(t, user1.PublicKeys, 0)
+ require.Len(t, user2.PublicKeys, 1)
+ require.Equal(t, filepath.Join(os.TempDir(), user1.Username), user1.HomeDir)
+ require.Equal(t, filepath.Join(os.TempDir(), user2.Username), user2.HomeDir)
+ require.Equal(t, user1.Username, user1.FsConfig.S3Config.AccessKey)
+ require.Equal(t, user2.Username, user2.FsConfig.S3Config.AccessKey)
+ require.Equal(t, path.Join("base", user1.Username)+"/", user1.FsConfig.S3Config.KeyPrefix)
+ require.Equal(t, path.Join("base", user2.Username)+"/", user2.FsConfig.S3Config.KeyPrefix)
+ require.True(t, user1.FsConfig.S3Config.AccessSecret.IsEncrypted())
+ err = user1.FsConfig.S3Config.AccessSecret.Decrypt()
+ require.NoError(t, err)
+ require.Equal(t, "password1", user1.FsConfig.S3Config.AccessSecret.GetPayload())
+ require.True(t, user2.FsConfig.S3Config.AccessSecret.IsEncrypted())
+ err = user2.FsConfig.S3Config.AccessSecret.Decrypt()
+ require.NoError(t, err)
+ require.Equal(t, "password2", user2.FsConfig.S3Config.AccessSecret.GetPayload())
+ require.True(t, user1.Filters.Hooks.ExternalAuthDisabled)
+ require.True(t, user1.Filters.Hooks.CheckPasswordDisabled)
+ require.False(t, user1.Filters.Hooks.PreLoginDisabled)
+ require.True(t, user2.Filters.Hooks.ExternalAuthDisabled)
+ require.True(t, user2.Filters.Hooks.CheckPasswordDisabled)
+ require.False(t, user2.Filters.Hooks.PreLoginDisabled)
+ require.True(t, user1.Filters.DisableFsChecks)
+ require.True(t, user2.Filters.DisableFsChecks)
}
func TestUserPlaceholders(t *testing.T) {
token, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webUserPath, token)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
u := getTestUser()
u.HomeDir = filepath.Join(os.TempDir(), "%username%_%password%")
@@ -23022,7 +21886,7 @@ func TestUserPlaceholders(t *testing.T) {
func TestFolderPlaceholders(t *testing.T) {
token, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webFolderPath, token)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
folderName := "folderName"
form := make(url.Values)
@@ -23066,7 +21930,7 @@ func TestFolderSaveFromTemplateMock(t *testing.T) {
folder2 := "f2"
token, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webTemplateFolder, token)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
form := make(url.Values)
form.Set("name", "name")
@@ -23112,12 +21976,12 @@ func TestFolderSaveFromTemplateMock(t *testing.T) {
assert.NoError(t, err)
}
-func TestFolderTemplateErrors(t *testing.T) {
+func TestFolderTemplateMock(t *testing.T) {
folderName := "vfolder-template"
mappedPath := filepath.Join(os.TempDir(), "%name%mapped%name%path")
token, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webTemplateFolder, token)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
form := make(url.Values)
form.Set("name", folderName)
@@ -23128,6 +21992,7 @@ func TestFolderTemplateErrors(t *testing.T) {
form.Set("template_folders[2][tpl_foldername]", "folder3")
form.Set("template_folders[3][tpl_foldername]", "folder1 ")
form.Add("template_folders[3][tpl_foldername]", " ")
+ form.Set("form_action", "export_from_template")
b, contentType, _ := getMultipartFormData(form, "", "")
req, _ := http.NewRequest(http.MethodPost, webTemplateFolder, &b)
setJWTCookieForReq(req, token)
@@ -23145,12 +22010,41 @@ func TestFolderTemplateErrors(t *testing.T) {
checkResponseCode(t, http.StatusBadRequest, rr)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidForm)
+ folder1 := "folder1"
+ folder2 := "folder2"
+ folder3 := "folder3"
+ b, contentType, _ = getMultipartFormData(form, "", "")
+ req, _ = http.NewRequest(http.MethodPost, webTemplateFolder, &b)
+ setJWTCookieForReq(req, token)
+ req.Header.Set("Content-Type", contentType)
+ rr = executeRequest(req)
+ checkResponseCode(t, http.StatusOK, rr)
+
+ var dump dataprovider.BackupData
+ err = json.Unmarshal(rr.Body.Bytes(), &dump)
+ require.NoError(t, err)
+ require.Len(t, dump.Users, 0)
+ require.Len(t, dump.Admins, 0)
+ require.Len(t, dump.Folders, 3)
+ for _, folder := range dump.Folders {
+ switch folder.Name {
+ case folder1:
+ require.Equal(t, "desc folder folder1", folder.Description)
+ require.True(t, strings.HasSuffix(folder.MappedPath, "folder1mappedfolder1path"))
+ case folder2:
+ require.Equal(t, "desc folder folder2", folder.Description)
+ require.True(t, strings.HasSuffix(folder.MappedPath, "folder2mappedfolder2path"))
+ default:
+ require.Equal(t, "desc folder folder3", folder.Description)
+ require.True(t, strings.HasSuffix(folder.MappedPath, "folder3mappedfolder3path"))
+ }
+ }
+
form.Set("fs_provider", "1")
form.Set("s3_bucket", "bucket")
form.Set("s3_region", "us-east-1")
form.Set("s3_access_key", "%name%")
form.Set("s3_access_secret", "pwd%name%")
- form.Set("s3_sse_customer_key", "key%name%")
form.Set("s3_key_prefix", "base/%name%")
b, contentType, _ = getMultipartFormData(form, "", "")
@@ -23167,6 +22061,43 @@ func TestFolderTemplateErrors(t *testing.T) {
form.Set("s3_upload_part_max_time", "0")
form.Set("s3_download_part_size", "6")
form.Set("s3_download_concurrency", "2")
+ b, contentType, _ = getMultipartFormData(form, "", "")
+ req, _ = http.NewRequest(http.MethodPost, webTemplateFolder, &b)
+ setJWTCookieForReq(req, token)
+ req.Header.Set("Content-Type", contentType)
+ rr = executeRequest(req)
+ checkResponseCode(t, http.StatusOK, rr)
+
+ dump = dataprovider.BackupData{
+ Version: dataprovider.DumpVersion,
+ }
+ err = json.Unmarshal(rr.Body.Bytes(), &dump)
+ require.NoError(t, err)
+ require.Len(t, dump.Users, 0)
+ require.Len(t, dump.Admins, 0)
+ require.Len(t, dump.Folders, 3)
+ for _, folder := range dump.Folders {
+ switch folder.Name {
+ case folder1:
+ require.Equal(t, folder1, folder.FsConfig.S3Config.AccessKey)
+ err = folder.FsConfig.S3Config.AccessSecret.Decrypt()
+ require.NoError(t, err)
+ require.Equal(t, fmt.Sprintf("pwd%s", folder1), folder.FsConfig.S3Config.AccessSecret.GetPayload())
+ require.Equal(t, path.Join("base", folder1)+"/", folder.FsConfig.S3Config.KeyPrefix)
+ case folder2:
+ require.Equal(t, folder2, folder.FsConfig.S3Config.AccessKey)
+ err = folder.FsConfig.S3Config.AccessSecret.Decrypt()
+ require.NoError(t, err)
+ require.Equal(t, "pwd"+folder2, folder.FsConfig.S3Config.AccessSecret.GetPayload())
+ require.Equal(t, "base/"+folder2+"/", folder.FsConfig.S3Config.KeyPrefix)
+ default:
+ require.Equal(t, folder3, folder.FsConfig.S3Config.AccessKey)
+ err = folder.FsConfig.S3Config.AccessSecret.Decrypt()
+ require.NoError(t, err)
+ require.Equal(t, "pwd"+folder3, folder.FsConfig.S3Config.AccessSecret.GetPayload())
+ require.Equal(t, "base/"+folder3+"/", folder.FsConfig.S3Config.KeyPrefix)
+ }
+ }
form.Set("template_folders[0][tpl_foldername]", " ")
form.Set("template_folders[1][tpl_foldername]", "")
@@ -23191,67 +22122,12 @@ func TestFolderTemplateErrors(t *testing.T) {
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidHomeDir)
}
-func TestFolderTemplatePermission(t *testing.T) {
- admin := getTestAdmin()
- admin.Username = altAdminUsername
- admin.Password = altAdminPassword
- admin.Permissions = []string{dataprovider.PermAdminChangeUsers, dataprovider.PermAdminAddUsers, dataprovider.PermAdminViewUsers}
- admin, _, err := httpdtest.AddAdmin(admin, http.StatusCreated)
- assert.NoError(t, err)
- // no permission to view or add folders from templates
- token, err := getJWTWebTokenFromTestServer(altAdminUsername, altAdminPassword)
- assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webTemplateUser, token)
- assert.NoError(t, err)
-
- req, err := http.NewRequest(http.MethodGet, webTemplateFolder, nil)
- assert.NoError(t, err)
- req.RequestURI = webTemplateFolder
- setJWTCookieForReq(req, token)
- rr := executeRequest(req)
- checkResponseCode(t, http.StatusForbidden, rr)
-
- form := make(url.Values)
- form.Set("name", "name")
- form.Set("mapped_path", filepath.Join(os.TempDir(), "%name%"))
- form.Set("description", "desc folder %name%")
- form.Set("template_folders[0][tpl_foldername]", "folder1")
- form.Set("template_folders[1][tpl_foldername]", "folder2")
- form.Set(csrfFormToken, csrfToken)
- b, contentType, _ := getMultipartFormData(form, "", "")
- req, err = http.NewRequest(http.MethodPost, webTemplateFolder, &b)
- assert.NoError(t, err)
- setJWTCookieForReq(req, token)
- req.Header.Set("Content-Type", contentType)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusForbidden, rr)
-
- admin.Permissions = append(admin.Permissions, dataprovider.PermAdminManageFolders)
- _, _, err = httpdtest.UpdateAdmin(admin, http.StatusOK)
- assert.NoError(t, err)
-
- token, err = getJWTWebTokenFromTestServer(altAdminUsername, altAdminPassword)
- assert.NoError(t, err)
- _, err = getCSRFTokenFromInternalPageMock(webTemplateUser, token)
- assert.NoError(t, err)
-
- req, err = http.NewRequest(http.MethodGet, webTemplateFolder, nil)
- assert.NoError(t, err)
- req.RequestURI = webTemplateFolder
- setJWTCookieForReq(req, token)
- rr = executeRequest(req)
- checkResponseCode(t, http.StatusOK, rr)
-
- _, err = httpdtest.RemoveAdmin(admin, http.StatusOK)
- assert.NoError(t, err)
-}
-
func TestWebUserS3Mock(t *testing.T) {
webToken, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
apiToken, err := getJWTAPITokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webUserPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
user := getTestUser()
userAsJSON := getUserAsJSON(t, user)
@@ -23268,7 +22144,6 @@ func TestWebUserS3Mock(t *testing.T) {
user.FsConfig.S3Config.Region = "eu-west-1"
user.FsConfig.S3Config.AccessKey = "access-key"
user.FsConfig.S3Config.AccessSecret = kms.NewPlainSecret("access-secret")
- user.FsConfig.S3Config.SSECustomerKey = kms.NewPlainSecret("enc-key")
user.FsConfig.S3Config.RoleARN = "arn:aws:iam::123456789012:user/Development/product_1234/*"
user.FsConfig.S3Config.Endpoint = "http://127.0.0.1:9000/path?a=b"
user.FsConfig.S3Config.StorageClass = "Standard"
@@ -23309,7 +22184,6 @@ func TestWebUserS3Mock(t *testing.T) {
form.Set("s3_region", user.FsConfig.S3Config.Region)
form.Set("s3_access_key", user.FsConfig.S3Config.AccessKey)
form.Set("s3_access_secret", user.FsConfig.S3Config.AccessSecret.GetPayload())
- form.Set("s3_sse_customer_key", user.FsConfig.S3Config.SSECustomerKey.GetPayload())
form.Set("s3_role_arn", user.FsConfig.S3Config.RoleARN)
form.Set("s3_storage_class", user.FsConfig.S3Config.StorageClass)
form.Set("s3_acl", user.FsConfig.S3Config.ACL)
@@ -23434,10 +22308,6 @@ func TestWebUserS3Mock(t *testing.T) {
assert.NotEmpty(t, updateUser.FsConfig.S3Config.AccessSecret.GetPayload())
assert.Empty(t, updateUser.FsConfig.S3Config.AccessSecret.GetKey())
assert.Empty(t, updateUser.FsConfig.S3Config.AccessSecret.GetAdditionalData())
- assert.Equal(t, sdkkms.SecretStatusSecretBox, updateUser.FsConfig.S3Config.SSECustomerKey.GetStatus())
- assert.NotEmpty(t, updateUser.FsConfig.S3Config.SSECustomerKey.GetPayload())
- assert.Empty(t, updateUser.FsConfig.S3Config.SSECustomerKey.GetKey())
- assert.Empty(t, updateUser.FsConfig.S3Config.SSECustomerKey.GetAdditionalData())
assert.Equal(t, user.Description, updateUser.Description)
assert.True(t, updateUser.Filters.Hooks.PreLoginDisabled)
assert.False(t, updateUser.Filters.Hooks.ExternalAuthDisabled)
@@ -23447,7 +22317,6 @@ func TestWebUserS3Mock(t *testing.T) {
assert.Equal(t, 1, updateUser.Filters.FTPSecurity)
// now check that a redacted password is not saved
form.Set("s3_access_secret", redactedSecret)
- form.Set("s3_sse_customer_key", redactedSecret)
b, contentType, _ = getMultipartFormData(form, "", "")
req, _ = http.NewRequest(http.MethodPost, path.Join(webUserPath, user.Username), &b)
setJWTCookieForReq(req, webToken)
@@ -23466,15 +22335,10 @@ func TestWebUserS3Mock(t *testing.T) {
assert.Equal(t, updateUser.FsConfig.S3Config.AccessSecret.GetPayload(), lastUpdatedUser.FsConfig.S3Config.AccessSecret.GetPayload())
assert.Empty(t, lastUpdatedUser.FsConfig.S3Config.AccessSecret.GetKey())
assert.Empty(t, lastUpdatedUser.FsConfig.S3Config.AccessSecret.GetAdditionalData())
- assert.Equal(t, sdkkms.SecretStatusSecretBox, lastUpdatedUser.FsConfig.S3Config.SSECustomerKey.GetStatus())
- assert.Equal(t, updateUser.FsConfig.S3Config.SSECustomerKey.GetPayload(), lastUpdatedUser.FsConfig.S3Config.SSECustomerKey.GetPayload())
- assert.Empty(t, lastUpdatedUser.FsConfig.S3Config.SSECustomerKey.GetKey())
- assert.Empty(t, lastUpdatedUser.FsConfig.S3Config.SSECustomerKey.GetAdditionalData())
assert.Equal(t, lastPwdChange, lastUpdatedUser.LastPasswordChange)
// now clear credentials
form.Set("s3_access_key", "")
form.Set("s3_access_secret", "")
- form.Set("s3_sse_customer_key", "")
b, contentType, _ = getMultipartFormData(form, "", "")
req, _ = http.NewRequest(http.MethodPost, path.Join(webUserPath, user.Username), &b)
setJWTCookieForReq(req, webToken)
@@ -23489,7 +22353,6 @@ func TestWebUserS3Mock(t *testing.T) {
err = render.DecodeJSON(rr.Body, &userGet)
assert.NoError(t, err)
assert.Nil(t, userGet.FsConfig.S3Config.AccessSecret)
- assert.Nil(t, userGet.FsConfig.S3Config.SSECustomerKey)
req, _ = http.NewRequest(http.MethodDelete, path.Join(userPath, user.Username), nil)
setBearerForReq(req, apiToken)
@@ -23502,7 +22365,7 @@ func TestWebUserGCSMock(t *testing.T) {
assert.NoError(t, err)
apiToken, err := getJWTAPITokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webUserPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
user := getTestUser()
userAsJSON := getUserAsJSON(t, user)
@@ -23630,7 +22493,7 @@ func TestWebUserHTTPFsMock(t *testing.T) {
assert.NoError(t, err)
apiToken, err := getJWTAPITokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webUserPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
user := getTestUser()
userAsJSON := getUserAsJSON(t, user)
@@ -23757,7 +22620,7 @@ func TestWebUserAzureBlobMock(t *testing.T) {
assert.NoError(t, err)
apiToken, err := getJWTAPITokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webUserPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
user := getTestUser()
userAsJSON := getUserAsJSON(t, user)
@@ -23954,7 +22817,7 @@ func TestWebUserCryptMock(t *testing.T) {
assert.NoError(t, err)
apiToken, err := getJWTAPITokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webUserPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
user := getTestUser()
userAsJSON := getUserAsJSON(t, user)
@@ -24061,7 +22924,7 @@ func TestWebUserSFTPFsMock(t *testing.T) {
assert.NoError(t, err)
apiToken, err := getJWTAPITokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webUserPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
user := getTestUser()
userAsJSON := getUserAsJSON(t, user)
@@ -24217,7 +23080,7 @@ func TestWebUserRole(t *testing.T) {
assert.NoError(t, err)
webToken, err := getJWTWebTokenFromTestServer(altAdminUsername, altAdminPassword)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webUserPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
user := getTestUser()
form := make(url.Values)
@@ -24280,7 +23143,7 @@ func TestWebEventAction(t *testing.T) {
assert.NoError(t, err)
apiToken, err := getJWTAPITokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webAdminEventActionPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
action := dataprovider.BaseEventAction{
Name: "web_action_http",
@@ -24306,7 +23169,7 @@ func TestWebEventAction(t *testing.T) {
Value: "value1",
},
},
- Body: `{"event":"{{.Event}}","name":"{{.Name}}"}`,
+ Body: `{"event":"{{Event}}","name":"{{Name}}"}`,
},
},
}
@@ -24425,12 +23288,12 @@ func TestWebEventAction(t *testing.T) {
form.Del("http_headers[0][http_header_key]")
form.Del("http_headers[0][http_header_val]")
form.Set("multipart_body[0][http_part_name]", "part1")
- form.Set("multipart_body[0][http_part_file]", "{{.VirtualPath}}")
+ form.Set("multipart_body[0][http_part_file]", "{{VirtualPath}}")
form.Set("multipart_body[0][http_part_body]", "")
form.Set("multipart_body[0][http_part_headers]", "X-MyHeader: a:b,c")
form.Set("multipart_body[12][http_part_name]", "part2")
form.Set("multipart_body[12][http_part_headers]", "Content-Type:application/json \r\n")
- form.Set("multipart_body[12][http_part_body]", "{{.ObjectData}}")
+ form.Set("multipart_body[12][http_part_body]", "{{ObjectData}}")
req, err = http.NewRequest(http.MethodPost, path.Join(webAdminEventActionPath, action.Name),
bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
@@ -24447,12 +23310,12 @@ func TestWebEventAction(t *testing.T) {
assert.Equal(t, 0, dbAction.Options.HTTPConfig.Timeout)
if assert.Len(t, dbAction.Options.HTTPConfig.Parts, 2) {
assert.Equal(t, "part1", dbAction.Options.HTTPConfig.Parts[0].Name)
- assert.Equal(t, "/{{.VirtualPath}}", dbAction.Options.HTTPConfig.Parts[0].Filepath)
+ assert.Equal(t, "/{{VirtualPath}}", dbAction.Options.HTTPConfig.Parts[0].Filepath)
assert.Empty(t, dbAction.Options.HTTPConfig.Parts[0].Body)
assert.Equal(t, "X-MyHeader", dbAction.Options.HTTPConfig.Parts[0].Headers[0].Key)
assert.Equal(t, "a:b,c", dbAction.Options.HTTPConfig.Parts[0].Headers[0].Value)
assert.Equal(t, "part2", dbAction.Options.HTTPConfig.Parts[1].Name)
- assert.Equal(t, "{{.ObjectData}}", dbAction.Options.HTTPConfig.Parts[1].Body)
+ assert.Equal(t, "{{ObjectData}}", dbAction.Options.HTTPConfig.Parts[1].Body)
assert.Empty(t, dbAction.Options.HTTPConfig.Parts[1].Filepath)
assert.Equal(t, "Content-Type", dbAction.Options.HTTPConfig.Parts[1].Headers[0].Key)
assert.Equal(t, "application/json", dbAction.Options.HTTPConfig.Parts[1].Headers[0].Value)
@@ -24685,19 +23548,16 @@ func TestWebEventAction(t *testing.T) {
action.Options.FsConfig = dataprovider.EventActionFilesystemConfig{
Type: dataprovider.FilesystemActionRename,
- Renames: []dataprovider.RenameConfig{
+ Renames: []dataprovider.KeyValue{
{
- KeyValue: dataprovider.KeyValue{
- Key: "/src",
- Value: "/target",
- },
+ Key: "/src",
+ Value: "/target",
},
},
}
form.Set("fs_action_type", fmt.Sprintf("%d", action.Options.FsConfig.Type))
form.Set("fs_rename[0][fs_rename_source]", action.Options.FsConfig.Renames[0].Key)
form.Set("fs_rename[0][fs_rename_target]", action.Options.FsConfig.Renames[0].Value)
- form.Set("fs_rename[0][fs_rename_options][]", "1")
req, err = http.NewRequest(http.MethodPost, path.Join(webAdminEventActionPath, action.Name),
bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
@@ -24709,9 +23569,7 @@ func TestWebEventAction(t *testing.T) {
actionGet, _, err = httpdtest.GetEventActionByName(action.Name, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, action.Type, actionGet.Type)
- if assert.Len(t, actionGet.Options.FsConfig.Renames, 1) {
- assert.True(t, actionGet.Options.FsConfig.Renames[0].UpdateModTime)
- }
+ assert.Len(t, actionGet.Options.FsConfig.Renames, 1)
action.Options.FsConfig = dataprovider.EventActionFilesystemConfig{
Type: dataprovider.FilesystemActionCopy,
@@ -24833,7 +23691,7 @@ func TestWebEventAction(t *testing.T) {
func TestWebEventRule(t *testing.T) {
webToken, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webAdminEventRulePath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
a := dataprovider.BaseEventAction{
Name: "web_action",
@@ -25151,7 +24009,7 @@ func TestWebEventRule(t *testing.T) {
func TestWebIPListEntries(t *testing.T) {
webToken, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webUserPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
req, err := http.NewRequest(http.MethodGet, webIPListPath+"/mode", nil)
@@ -25338,7 +24196,7 @@ func TestWebIPListEntries(t *testing.T) {
func TestWebRole(t *testing.T) {
webToken, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webAdminRolePath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
role := getTestRole()
form := make(url.Values)
@@ -25444,12 +24302,84 @@ func TestWebRole(t *testing.T) {
assert.NoError(t, err)
}
+func TestNameParamSingleSlash(t *testing.T) {
+ err := dataprovider.Close()
+ assert.NoError(t, err)
+ err = config.LoadConfig(configDir, "")
+ assert.NoError(t, err)
+ providerConf := config.GetProviderConf()
+ providerConf.NamingRules = 5
+ err = dataprovider.Initialize(providerConf, configDir, true)
+ assert.NoError(t, err)
+
+ webToken, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
+ assert.NoError(t, err)
+ apiToken, err := getJWTAPITokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
+ assert.NoError(t, err)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
+ assert.NoError(t, err)
+ group := getTestGroup()
+ group.Name = "/"
+ form := make(url.Values)
+ form.Set("name", group.Name)
+ form.Set("description", group.Description)
+ form.Set("max_sessions", "0")
+ form.Set("quota_files", "0")
+ form.Set("quota_size", "0")
+ form.Set("upload_bandwidth", "0")
+ form.Set("download_bandwidth", "0")
+ form.Set("upload_data_transfer", "0")
+ form.Set("download_data_transfer", "0")
+ form.Set("total_data_transfer", "0")
+ form.Set("max_upload_file_size", "0")
+ form.Set("default_shares_expiration", "0")
+ form.Set("max_shares_expiration", "0")
+ form.Set("password_expiration", "0")
+ form.Set("password_strength", "0")
+ form.Set("expires_in", "0")
+ form.Set("external_auth_cache_time", "0")
+ form.Set(csrfFormToken, csrfToken)
+ b, contentType, err := getMultipartFormData(form, "", "")
+ assert.NoError(t, err)
+ req, err := http.NewRequest(http.MethodPost, webGroupPath, &b)
+ assert.NoError(t, err)
+ req.Header.Set("Content-Type", contentType)
+ setJWTCookieForReq(req, webToken)
+ rr := executeRequest(req)
+ checkResponseCode(t, http.StatusSeeOther, rr)
+
+ groupGet, _, err := httpdtest.GetGroupByName(group.Name, http.StatusOK)
+ assert.NoError(t, err)
+ assert.Equal(t, "/", groupGet.Name)
+ // check strip slash
+ req, err = http.NewRequest(http.MethodGet, webGroupsPath+"/", nil)
+ assert.NoError(t, err)
+ setJWTCookieForReq(req, webToken)
+ rr = executeRequest(req)
+ checkResponseCode(t, http.StatusOK, rr)
+ // cleanup
+ req, err = http.NewRequest(http.MethodDelete, groupPath+"/"+url.PathEscape(group.Name), nil)
+ assert.NoError(t, err)
+ setBearerForReq(req, apiToken)
+ rr = executeRequest(req)
+ checkResponseCode(t, http.StatusOK, rr)
+
+ err = dataprovider.Close()
+ assert.NoError(t, err)
+ err = config.LoadConfig(configDir, "")
+ assert.NoError(t, err)
+ providerConf = config.GetProviderConf()
+ providerConf.BackupsPath = backupsPath
+ err = dataprovider.Initialize(providerConf, configDir, true)
+ assert.NoError(t, err)
+}
+
func TestAddWebGroup(t *testing.T) {
webToken, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
apiToken, err := getJWTAPITokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webGroupPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
group := getTestGroup()
group.UserSettings = dataprovider.GroupUserSettings{
@@ -25635,7 +24565,7 @@ func TestAddWebFoldersMock(t *testing.T) {
assert.NoError(t, err)
apiToken, err := getJWTAPITokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webFolderPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
mappedPath := filepath.Clean(os.TempDir())
folderName := filepath.Base(mappedPath)
@@ -25713,7 +24643,7 @@ func TestHTTPFsWebFolderMock(t *testing.T) {
assert.NoError(t, err)
apiToken, err := getJWTAPITokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webFolderPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
mappedPath := filepath.Clean(os.TempDir())
folderName := filepath.Base(mappedPath)
@@ -25808,7 +24738,7 @@ func TestS3WebFolderMock(t *testing.T) {
assert.NoError(t, err)
apiToken, err := getJWTAPITokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webFolderPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
mappedPath := filepath.Clean(os.TempDir())
folderName := filepath.Base(mappedPath)
@@ -25817,7 +24747,6 @@ func TestS3WebFolderMock(t *testing.T) {
S3Region := "eu-west-1"
S3AccessKey := "access-key"
S3AccessSecret := kms.NewPlainSecret("folder-access-secret")
- S3SSEKey := kms.NewPlainSecret("folder-sse-key")
S3SessionToken := "fake session token"
S3RoleARN := "arn:aws:iam::123456789012:user/Development/product_1234/*"
S3Endpoint := "http://127.0.0.1:9000/path?b=c"
@@ -25839,7 +24768,6 @@ func TestS3WebFolderMock(t *testing.T) {
form.Set("s3_region", S3Region)
form.Set("s3_access_key", S3AccessKey)
form.Set("s3_access_secret", S3AccessSecret.GetPayload())
- form.Set("s3_sse_customer_key", S3SSEKey.GetPayload())
form.Set("s3_session_token", S3SessionToken)
form.Set("s3_role_arn", S3RoleARN)
form.Set("s3_storage_class", S3StorageClass)
@@ -25887,7 +24815,6 @@ func TestS3WebFolderMock(t *testing.T) {
assert.Equal(t, S3Region, folder.FsConfig.S3Config.Region)
assert.Equal(t, S3AccessKey, folder.FsConfig.S3Config.AccessKey)
assert.NotEmpty(t, folder.FsConfig.S3Config.AccessSecret.GetPayload())
- assert.NotEmpty(t, folder.FsConfig.S3Config.SSECustomerKey.GetPayload())
assert.Equal(t, S3Endpoint, folder.FsConfig.S3Config.Endpoint)
assert.Equal(t, S3StorageClass, folder.FsConfig.S3Config.StorageClass)
assert.Equal(t, S3ACL, folder.FsConfig.S3Config.ACL)
@@ -25938,7 +24865,6 @@ func TestS3WebFolderMock(t *testing.T) {
assert.Equal(t, S3AccessKey, folder.FsConfig.S3Config.AccessKey)
assert.Equal(t, S3RoleARN, folder.FsConfig.S3Config.RoleARN)
assert.NotEmpty(t, folder.FsConfig.S3Config.AccessSecret.GetPayload())
- assert.NotEmpty(t, folder.FsConfig.S3Config.SSECustomerKey.GetPayload())
assert.Equal(t, S3Endpoint, folder.FsConfig.S3Config.Endpoint)
assert.Equal(t, S3StorageClass, folder.FsConfig.S3Config.StorageClass)
assert.Equal(t, S3KeyPrefix, folder.FsConfig.S3Config.KeyPrefix)
@@ -25957,7 +24883,7 @@ func TestUpdateWebGroupMock(t *testing.T) {
assert.NoError(t, err)
apiToken, err := getJWTAPITokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webGroupPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
group, _, err := httpdtest.AddGroup(getTestGroup(), http.StatusCreated)
assert.NoError(t, err)
@@ -26062,7 +24988,7 @@ func TestUpdateWebFolderMock(t *testing.T) {
assert.NoError(t, err)
apiToken, err := getJWTAPITokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webFolderPath, webToken)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
folderName := "vfolderupdate"
folderDesc := "updated desc"
@@ -26279,7 +25205,7 @@ func TestAdminForgotPassword(t *testing.T) {
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
- loginCookie, csrfToken, err := getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
form := make(url.Values)
@@ -26288,7 +25214,6 @@ func TestAdminForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webAdminForgotPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusForbidden, rr.Code)
@@ -26297,7 +25222,6 @@ func TestAdminForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webAdminForgotPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -26313,11 +25237,10 @@ func TestAdminForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webAdminForgotPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
- assert.Len(t, lastResetCode, 0)
+ assert.GreaterOrEqual(t, len(lastResetCode), 0)
admin.Status = 1
admin, _, err = httpdtest.UpdateAdmin(admin, http.StatusOK)
@@ -26326,7 +25249,6 @@ func TestAdminForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webAdminForgotPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
@@ -26336,7 +25258,6 @@ func TestAdminForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webAdminResetPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusForbidden, rr.Code)
@@ -26345,7 +25266,6 @@ func TestAdminForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webAdminResetPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -26356,7 +25276,6 @@ func TestAdminForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webAdminResetPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -26369,7 +25288,6 @@ func TestAdminForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webAdminResetPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -26382,19 +25300,14 @@ func TestAdminForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webAdminResetPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
- form.Set(csrfFormToken, csrfToken)
form.Set("username", altAdminUsername)
req, err = http.NewRequest(http.MethodPost, webAdminForgotPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
@@ -26416,7 +25329,6 @@ func TestAdminForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webAdminForgotPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -26431,7 +25343,6 @@ func TestAdminForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webAdminForgotPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -26486,25 +25397,22 @@ func TestUserForgotPassword(t *testing.T) {
rr = executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
- loginCookie, csrfToken, err := getCSRFTokenMock(webClientLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
-
form := make(url.Values)
form.Set("username", "")
// no csrf token
req, err = http.NewRequest(http.MethodPost, webClientForgotPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusForbidden, rr.Code)
// empty username
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
+ assert.NoError(t, err)
form.Set(csrfFormToken, csrfToken)
req, err = http.NewRequest(http.MethodPost, webClientForgotPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -26514,7 +25422,6 @@ func TestUserForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webClientForgotPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -26528,11 +25435,10 @@ func TestUserForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webClientForgotPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
- assert.Len(t, lastResetCode, 0)
+ assert.GreaterOrEqual(t, len(lastResetCode), 0)
user.ExpirationDate = util.GetTimeAsMsSinceEpoch(time.Now().Add(24 * time.Hour))
user, _, err = httpdtest.UpdateUser(user, http.StatusOK, "")
@@ -26540,12 +25446,11 @@ func TestUserForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webClientForgotPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
assert.GreaterOrEqual(t, len(lastResetCode), 20)
- // no login token
+ // no csrf token
form = make(url.Values)
req, err = http.NewRequest(http.MethodPost, webClientResetPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
@@ -26560,7 +25465,6 @@ func TestUserForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webClientResetPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -26571,7 +25475,6 @@ func TestUserForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webClientResetPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -26582,7 +25485,6 @@ func TestUserForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webClientResetPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -26595,7 +25497,6 @@ func TestUserForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webClientResetPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -26607,13 +25508,10 @@ func TestUserForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webClientResetPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
- loginCookie, csrfToken, err = getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
- assert.NoError(t, err)
form = make(url.Values)
form.Set(csrfFormToken, csrfToken)
form.Set("username", user.Username)
@@ -26621,7 +25519,6 @@ func TestUserForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webClientForgotPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusFound, rr.Code)
@@ -26654,7 +25551,6 @@ func TestUserForgotPassword(t *testing.T) {
req, err = http.NewRequest(http.MethodPost, webClientResetPwdPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = executeRequest(req)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -26851,7 +25747,7 @@ func TestAPIForgotPassword(t *testing.T) {
func TestProviderClosedMock(t *testing.T) {
token, err := getJWTWebTokenFromTestServer(defaultTokenAuthUser, defaultTokenAuthPass)
assert.NoError(t, err)
- csrfToken, err := getCSRFTokenFromInternalPageMock(webConfigsPath, token)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
// create a role admin
role, resp, err := httpdtest.AddRole(getTestRole(), http.StatusCreated)
@@ -27060,7 +25956,7 @@ func TestWebConnectionsMock(t *testing.T) {
checkResponseCode(t, http.StatusForbidden, rr)
assert.Contains(t, rr.Body.String(), "Invalid token")
- csrfToken, err := getCSRFTokenFromInternalPageMock(webUserPath, token)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
assert.NoError(t, err)
req, _ = http.NewRequest(http.MethodDelete, path.Join(webConnectionsPath, "id"), nil)
setJWTCookieForReq(req, token)
@@ -27098,7 +25994,7 @@ func TestGetWebStatusMock(t *testing.T) {
}
func TestStaticFilesMock(t *testing.T) {
- req, err := http.NewRequest(http.MethodGet, "/static/favicon.png", nil)
+ req, err := http.NewRequest(http.MethodGet, "/static/favicon.ico", nil)
assert.NoError(t, err)
rr := executeRequest(req)
checkResponseCode(t, http.StatusOK, rr)
@@ -27191,63 +26087,12 @@ func TestSecondFactorRequirements(t *testing.T) {
assert.False(t, user.MustSetSecondFactorForProtocol(common.ProtocolSSH))
}
-func TestIsNameValid(t *testing.T) {
- tests := []struct {
- name string
- input string
- expected bool
- }{
- {"simple name", "user", true},
- {"alphanumeric", "User123", true},
- {"unicode allowed", "你好", true},
- {"emoji allowed", "user😊", true},
- {"name with dot", "file.txt", true},
- {"name with multiple dots", "archive.tar.gz", true},
- {"control char", "abc\u0001", false},
- {"newline", "abc\n", false},
- {"tab", "abc\t", false},
- {"slash", "user/name", false},
- {"backslash", "user\\name", false},
- {"colon", "user:name", false},
- {"single dot", ".", false},
- {"double dot", "..", false},
- {"dot with suffix allowed", ".hidden", true},
- {"name ending with dot", "file.", false},
- {"name ending with space", "file ", false},
- {"CON", "CON", false},
- {"con lowercase", "con", false},
- {"con with extension", "con.txt", false},
- {"LPT1", "LPT1", false},
- {"lpt1 lowercase", "lpt1", false},
- {"COM5 uppercase", "COM5", false},
- {"com9 with extension", "com9.log", false},
- {"NUL", "NUL", false},
- {"Valid because suffix changes base", "con123", true},
- {"base name split", "aux.pdf", false},
- {"valid long name", "auxiliary", true},
- {"space only", " ", false},
- {"dot inside", "ab.cd.ef", true},
- {"unicode that ends with dot", "你好.", false},
- {"unicode that ends with space", "你好 ", false},
- }
-
- for _, tt := range tests {
- t.Run(tt.name, func(t *testing.T) {
- result := util.IsNameValid(tt.input)
- if result != tt.expected {
- t.Errorf("IsNameValid(%q) = %v, expected %v", tt.input, result, tt.expected)
- }
- })
- }
-}
-
func startOIDCMockServer() {
go func() {
http.HandleFunc("/", func(w http.ResponseWriter, _ *http.Request) {
fmt.Fprintf(w, "OK\n")
})
http.HandleFunc("/auth/realms/sftpgo/.well-known/openid-configuration", func(w http.ResponseWriter, _ *http.Request) {
- w.Header().Set("Content-Type", "application/json")
fmt.Fprintf(w, `{"issuer":"http://127.0.0.1:11111/auth/realms/sftpgo","authorization_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/auth","token_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/token","introspection_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/token/introspect","userinfo_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/userinfo","end_session_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/logout","frontchannel_logout_session_supported":true,"frontchannel_logout_supported":true,"jwks_uri":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/certs","check_session_iframe":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/login-status-iframe.html","grant_types_supported":["authorization_code","implicit","refresh_token","password","client_credentials","urn:ietf:params:oauth:grant-type:device_code","urn:openid:params:grant-type:ciba"],"response_types_supported":["code","none","id_token","token","id_token token","code id_token","code token","code id_token token"],"subject_types_supported":["public","pairwise"],"id_token_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"id_token_encryption_alg_values_supported":["RSA-OAEP","RSA-OAEP-256","RSA1_5"],"id_token_encryption_enc_values_supported":["A256GCM","A192GCM","A128GCM","A128CBC-HS256","A192CBC-HS384","A256CBC-HS512"],"userinfo_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512","none"],"request_object_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512","none"],"request_object_encryption_alg_values_supported":["RSA-OAEP","RSA-OAEP-256","RSA1_5"],"request_object_encryption_enc_values_supported":["A256GCM","A192GCM","A128GCM","A128CBC-HS256","A192CBC-HS384","A256CBC-HS512"],"response_modes_supported":["query","fragment","form_post","query.jwt","fragment.jwt","form_post.jwt","jwt"],"registration_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/clients-registrations/openid-connect","token_endpoint_auth_methods_supported":["private_key_jwt","client_secret_basic","client_secret_post","tls_client_auth","client_secret_jwt"],"token_endpoint_auth_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"introspection_endpoint_auth_methods_supported":["private_key_jwt","client_secret_basic","client_secret_post","tls_client_auth","client_secret_jwt"],"introspection_endpoint_auth_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"authorization_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"authorization_encryption_alg_values_supported":["RSA-OAEP","RSA-OAEP-256","RSA1_5"],"authorization_encryption_enc_values_supported":["A256GCM","A192GCM","A128GCM","A128CBC-HS256","A192CBC-HS384","A256CBC-HS512"],"claims_supported":["aud","sub","iss","auth_time","name","given_name","family_name","preferred_username","email","acr"],"claim_types_supported":["normal"],"claims_parameter_supported":true,"scopes_supported":["openid","phone","email","web-origins","offline_access","microprofile-jwt","profile","address","roles"],"request_parameter_supported":true,"request_uri_parameter_supported":true,"require_request_uri_registration":true,"code_challenge_methods_supported":["plain","S256"],"tls_client_certificate_bound_access_tokens":true,"revocation_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/revoke","revocation_endpoint_auth_methods_supported":["private_key_jwt","client_secret_basic","client_secret_post","tls_client_auth","client_secret_jwt"],"revocation_endpoint_auth_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"backchannel_logout_supported":true,"backchannel_logout_session_supported":true,"device_authorization_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/auth/device","backchannel_token_delivery_modes_supported":["poll","ping"],"backchannel_authentication_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/ext/ciba/auth","backchannel_authentication_request_signing_alg_values_supported":["PS384","ES384","RS384","ES256","RS256","ES512","PS256","PS512","RS512"],"require_pushed_authorization_requests":false,"pushed_authorization_request_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/ext/par/request","mtls_endpoint_aliases":{"token_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/token","revocation_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/revoke","introspection_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/token/introspect","device_authorization_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/auth/device","registration_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/clients-registrations/openid-connect","userinfo_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/userinfo","pushed_authorization_request_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/ext/par/request","backchannel_authentication_endpoint":"http://127.0.0.1:11111/auth/realms/sftpgo/protocol/openid-connect/ext/ciba/auth"}}`)
})
http.HandleFunc("/404", func(w http.ResponseWriter, _ *http.Request) {
@@ -27386,53 +26231,29 @@ func getUserAsJSON(t *testing.T, user dataprovider.User) []byte {
return json
}
-func getCSRFTokenFromInternalPageMock(urlPath, token string) (string, error) {
- req, err := http.NewRequest(http.MethodGet, urlPath, nil)
+func getCSRFTokenMock(loginURLPath, remoteAddr string) (string, error) {
+ req, err := http.NewRequest(http.MethodGet, loginURLPath, nil)
if err != nil {
return "", err
}
- req.RequestURI = urlPath
- setJWTCookieForReq(req, token)
- rr := executeRequest(req)
- if rr.Code != http.StatusOK {
- return "", fmt.Errorf("unexpected status code: %d", rr.Code)
- }
- return getCSRFTokenFromBody(rr.Body)
-}
-
-func getCSRFTokenMock(loginURLPath, remoteAddr string) (string, string, error) {
- req, err := http.NewRequest(http.MethodGet, loginURLPath, nil)
- if err != nil {
- return "", "", err
- }
req.RemoteAddr = remoteAddr
rr := executeRequest(req)
- cookie := rr.Header().Get("Set-Cookie")
- if cookie == "" {
- return "", "", errors.New("unable to get login cookie")
- }
- token, err := getCSRFTokenFromBody(bytes.NewBuffer(rr.Body.Bytes()))
- return cookie, token, err
+ return getCSRFTokenFromBody(bytes.NewBuffer(rr.Body.Bytes()))
}
-func getCSRFToken(url string) (string, string, error) {
+func getCSRFToken(url string) (string, error) {
req, err := http.NewRequest(http.MethodGet, url, nil)
if err != nil {
- return "", "", err
+ return "", err
}
resp, err := httpclient.GetHTTPClient().Do(req)
if err != nil {
- return "", "", err
- }
- cookie := resp.Header.Get("Set-Cookie")
- if cookie == "" {
- return "", "", errors.New("no login cookie")
+ return "", err
}
defer resp.Body.Close()
- token, err := getCSRFTokenFromBody(resp.Body)
- return cookie, token, err
+ return getCSRFTokenFromBody(resp.Body)
}
func getCSRFTokenFromBody(body io.Reader) (string, error) {
@@ -27468,10 +26289,6 @@ func getCSRFTokenFromBody(body io.Reader) (string, error) {
f(doc)
- if csrfToken == "" {
- return "", errors.New("CSRF token not found")
- }
-
return csrfToken, nil
}
@@ -27498,10 +26315,6 @@ func setAPIKeyForReq(req *http.Request, apiKey, username string) {
req.Header.Set("X-SFTPGO-API-KEY", apiKey)
}
-func setLoginCookie(req *http.Request, cookie string) {
- req.Header.Set("Cookie", cookie)
-}
-
func setJWTCookieForReq(req *http.Request, jwtToken string) {
req.RemoteAddr = defaultRemoteAddr
req.Header.Set("Cookie", fmt.Sprintf("jwt=%v", jwtToken))
@@ -27545,14 +26358,13 @@ func getJWTAPIUserTokenFromTestServer(username, password string) (string, error)
}
func getJWTWebToken(username, password string) (string, error) {
- loginCookie, csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
if err != nil {
return "", err
}
form := getLoginForm(username, password, csrfToken)
req, _ := http.NewRequest(http.MethodPost, httpBaseURL+webLoginPath,
bytes.NewBuffer([]byte(form.Encode())))
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
client := &http.Client{
Timeout: 10 * time.Second,
@@ -27585,14 +26397,13 @@ func getCookieFromResponse(rr *httptest.ResponseRecorder) (string, error) {
}
func getJWTWebClientTokenFromTestServerWithAddr(username, password, remoteAddr string) (string, error) {
- loginCookie, csrfToken, err := getCSRFTokenMock(webClientLoginPath, remoteAddr)
+ csrfToken, err := getCSRFTokenMock(webClientLoginPath, remoteAddr)
if err != nil {
return "", err
}
form := getLoginForm(username, password, csrfToken)
req, _ := http.NewRequest(http.MethodPost, webClientLoginPath, bytes.NewBuffer([]byte(form.Encode())))
req.RemoteAddr = remoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr := executeRequest(req)
if rr.Code != http.StatusFound {
@@ -27602,14 +26413,13 @@ func getJWTWebClientTokenFromTestServerWithAddr(username, password, remoteAddr s
}
func getJWTWebClientTokenFromTestServer(username, password string) (string, error) {
- loginCookie, csrfToken, err := getCSRFTokenMock(webClientLoginPath, defaultRemoteAddr)
+ csrfToken, err := getCSRFToken(httpBaseURL + webClientLoginPath)
if err != nil {
return "", err
}
form := getLoginForm(username, password, csrfToken)
req, _ := http.NewRequest(http.MethodPost, webClientLoginPath, bytes.NewBuffer([]byte(form.Encode())))
req.RemoteAddr = defaultRemoteAddr
- req.Header.Set("Cookie", loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr := executeRequest(req)
if rr.Code != http.StatusFound {
@@ -27619,14 +26429,13 @@ func getJWTWebClientTokenFromTestServer(username, password string) (string, erro
}
func getJWTWebTokenFromTestServer(username, password string) (string, error) {
- loginCookie, csrfToken, err := getCSRFTokenMock(webLoginPath, defaultRemoteAddr)
+ csrfToken, err := getCSRFToken(httpBaseURL + webLoginPath)
if err != nil {
return "", err
}
form := getLoginForm(username, password, csrfToken)
req, _ := http.NewRequest(http.MethodPost, webLoginPath, bytes.NewBuffer([]byte(form.Encode())))
req.RemoteAddr = defaultRemoteAddr
- setLoginCookie(req, loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr := executeRequest(req)
if rr.Code != http.StatusFound {
@@ -27645,30 +26454,6 @@ func checkResponseCode(t *testing.T, expected int, rr *httptest.ResponseRecorder
assert.Equal(t, expected, rr.Code, rr.Body.String())
}
-func getSftpClient(user dataprovider.User) (*ssh.Client, *sftp.Client, error) {
- var sftpClient *sftp.Client
- config := &ssh.ClientConfig{
- User: user.Username,
- HostKeyCallback: ssh.InsecureIgnoreHostKey(),
- Timeout: 5 * time.Second,
- }
- if user.Password != "" {
- config.Auth = []ssh.AuthMethod{ssh.Password(user.Password)}
- } else {
- config.Auth = []ssh.AuthMethod{ssh.Password(defaultPassword)}
- }
-
- conn, err := ssh.Dial("tcp", sftpServerAddr, config)
- if err != nil {
- return conn, sftpClient, err
- }
- sftpClient, err = sftp.NewClient(conn)
- if err != nil {
- conn.Close()
- }
- return conn, sftpClient, err
-}
-
func createTestFile(path string, size int64) error {
baseDir := filepath.Dir(path)
if _, err := os.Stat(baseDir); errors.Is(err, fs.ErrNotExist) {
@@ -27742,23 +26527,6 @@ func isDbDefenderSupported() bool {
}
}
-func createTestPNG(name string, width, height int, imgColor color.Color) error {
- upLeft := image.Point{0, 0}
- lowRight := image.Point{width, height}
- img := image.NewRGBA(image.Rectangle{upLeft, lowRight})
- for x := 0; x < width; x++ {
- for y := 0; y < height; y++ {
- img.Set(x, y, imgColor)
- }
- }
- f, err := os.Create(name)
- if err != nil {
- return err
- }
- defer f.Close()
- return png.Encode(f, img)
-}
-
func BenchmarkSecretDecryption(b *testing.B) {
s := kms.NewPlainSecret("test data")
s.SetAdditionalData("username")
diff --git a/internal/httpd/internal_test.go b/internal/httpd/internal_test.go
index 987f0263..782a5c84 100644
--- a/internal/httpd/internal_test.go
+++ b/internal/httpd/internal_test.go
@@ -38,21 +38,20 @@ import (
"github.com/go-chi/chi/v5"
"github.com/go-chi/chi/v5/middleware"
- "github.com/go-jose/go-jose/v4"
- josejwt "github.com/go-jose/go-jose/v4/jwt"
+ "github.com/go-chi/jwtauth/v5"
"github.com/klauspost/compress/zip"
+ "github.com/lestrrat-go/jwx/v2/jwa"
+ "github.com/lestrrat-go/jwx/v2/jwt"
"github.com/rs/xid"
"github.com/sftpgo/sdk"
sdkkms "github.com/sftpgo/sdk/kms"
"github.com/sftpgo/sdk/plugin/notifier"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
- "golang.org/x/net/html"
"github.com/drakkan/sftpgo/v2/internal/acme"
"github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/kms"
"github.com/drakkan/sftpgo/v2/internal/plugin"
"github.com/drakkan/sftpgo/v2/internal/util"
@@ -286,7 +285,6 @@ RKjnkiEZeG4+G91Xu7+HmcBLwV86k5I+tXK9O1Okomr6Zry8oqVcxU5TB6VRS+rA
ubwF00Drdvk2+kDZfxIM137nBiy7wgCJi2Ksm5ihN3dUF6Q0oNPl
-----END RSA PRIVATE KEY-----`
defaultAdminUsername = "admin"
- defaultAdminPass = "password"
defeaultUsername = "test_user"
)
@@ -307,16 +305,6 @@ func (r *failingWriter) Header() http.Header {
return make(http.Header)
}
-type failingJoseSigner struct{}
-
-func (s *failingJoseSigner) Sign(payload []byte) (*jose.JSONWebSignature, error) {
- return nil, errors.New("sign test error")
-}
-
-func (s *failingJoseSigner) Options() jose.SignerOptions {
- return jose.SignerOptions{}
-}
-
func TestShouldBind(t *testing.T) {
c := Conf{
Bindings: []Binding{
@@ -353,7 +341,7 @@ func TestBrandingValidation(t *testing.T) {
},
}
b.checkBranding()
- assert.Equal(t, "/favicon.png", b.Branding.WebAdmin.FaviconPath)
+ assert.Equal(t, "/favicon.ico", b.Branding.WebAdmin.FaviconPath)
assert.Equal(t, "/path1", b.Branding.WebAdmin.LogoPath)
assert.Equal(t, []string{"/my.css"}, b.Branding.WebAdmin.DefaultCSS)
assert.Len(t, b.Branding.WebAdmin.ExtraCSS, 0)
@@ -424,80 +412,9 @@ func TestGCSWebInvalidFormFile(t *testing.T) {
assert.EqualError(t, err, http.ErrNotMultipart.Error())
}
-func TestBrandingInvalidFormFile(t *testing.T) {
- form := make(url.Values)
- req, _ := http.NewRequest(http.MethodPost, webConfigsPath, strings.NewReader(form.Encode()))
- req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
- err := req.ParseForm()
- assert.NoError(t, err)
- _, err = getBrandingConfigFromPostFields(req, &dataprovider.BrandingConfigs{})
- assert.EqualError(t, err, http.ErrNotMultipart.Error())
-}
-
-func TestTokenDuration(t *testing.T) {
- assert.Equal(t, shareTokenDuration, getTokenDuration(tokenAudienceWebShare))
- assert.Equal(t, apiTokenDuration, getTokenDuration(tokenAudienceAPI))
- assert.Equal(t, apiTokenDuration, getTokenDuration(tokenAudienceAPIUser))
- assert.Equal(t, cookieTokenDuration, getTokenDuration(tokenAudienceWebAdmin))
- assert.Equal(t, csrfTokenDuration, getTokenDuration(tokenAudienceCSRF))
- assert.Equal(t, 20*time.Minute, getTokenDuration(""))
-
- updateTokensDuration(30, 660, 360)
- assert.Equal(t, 30*time.Minute, apiTokenDuration)
- assert.Equal(t, 11*time.Hour, cookieTokenDuration)
- assert.Equal(t, 11*time.Hour, csrfTokenDuration)
- assert.Equal(t, 6*time.Hour, shareTokenDuration)
- assert.Equal(t, 11*time.Hour, getMaxCookieDuration())
-
- csrfTokenDuration = 1 * time.Hour
- assert.Equal(t, 11*time.Hour, getMaxCookieDuration())
-}
-
-func TestVerifyCSRFToken(t *testing.T) {
- server := httpdServer{}
- err := server.initializeRouter()
- require.NoError(t, err)
- req, err := http.NewRequest(http.MethodPost, webAdminEventActionPath, nil)
- require.NoError(t, err)
- req = req.WithContext(jwt.NewContext(req.Context(), &jwt.Claims{}, fs.ErrPermission))
-
- rr := httptest.NewRecorder()
- tokenString := createCSRFToken(rr, req, server.csrfTokenAuth, "", webBaseAdminPath)
- assert.NotEmpty(t, tokenString)
-
- claims, err := jwt.VerifyToken(server.csrfTokenAuth, tokenString)
- require.NoError(t, err)
- assert.Empty(t, claims.Ref)
-
- req.Form = url.Values{}
- req.Form.Set(csrfFormToken, tokenString)
- err = verifyCSRFToken(req, server.csrfTokenAuth)
- assert.ErrorIs(t, err, fs.ErrPermission)
-
- req, err = http.NewRequest(http.MethodPost, webAdminEventActionPath, nil)
- require.NoError(t, err)
- req = req.WithContext(jwt.NewContext(req.Context(), &jwt.Claims{Claims: josejwt.Claims{ID: xid.New().String()}}, nil))
- req.Form = url.Values{}
- req.Form.Set(csrfFormToken, tokenString)
- err = verifyCSRFToken(req, server.csrfTokenAuth)
- assert.ErrorContains(t, err, "unexpected form token")
-
- claims = jwt.NewClaims(tokenAudienceCSRF, "", getTokenDuration(tokenAudienceCSRF))
- tokenString, err = josejwt.Signed(server.csrfTokenAuth.Signer()).Claims(claims).Serialize()
- assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodPost, webAdminEventActionPath, nil)
- require.NoError(t, err)
- req = req.WithContext(jwt.NewContext(req.Context(), &jwt.Claims{Claims: josejwt.Claims{ID: xid.New().String()}}, nil))
- req.Form = url.Values{}
- req.Form.Set(csrfFormToken, tokenString)
- err = verifyCSRFToken(req, server.csrfTokenAuth)
- assert.ErrorContains(t, err, "the form token is not valid")
-}
-
func TestInvalidToken(t *testing.T) {
server := httpdServer{}
- err := server.initializeRouter()
- require.NoError(t, err)
+ server.initializeRouter()
admin := dataprovider.Admin{
Username: "admin",
}
@@ -508,7 +425,7 @@ func TestInvalidToken(t *testing.T) {
rctx := chi.NewRouteContext()
rctx.URLParams.Add("username", admin.Username)
req = req.WithContext(context.WithValue(req.Context(), chi.RouteCtxKey, rctx))
- req = req.WithContext(context.WithValue(req.Context(), jwt.ErrorCtxKey, errFake))
+ req = req.WithContext(context.WithValue(req.Context(), jwtauth.ErrorCtxKey, errFake))
rr := httptest.NewRecorder()
updateAdmin(rr, req)
assert.Equal(t, http.StatusBadRequest, rr.Code)
@@ -524,7 +441,7 @@ func TestInvalidToken(t *testing.T) {
assert.NoError(t, err)
req, _ = http.NewRequest(http.MethodPut, "", bytes.NewBuffer(asJSON))
req = req.WithContext(context.WithValue(req.Context(), chi.RouteCtxKey, rctx))
- req = req.WithContext(context.WithValue(req.Context(), jwt.ErrorCtxKey, errFake))
+ req = req.WithContext(context.WithValue(req.Context(), jwtauth.ErrorCtxKey, errFake))
rr = httptest.NewRecorder()
changeAdminPassword(rr, req)
assert.Equal(t, http.StatusInternalServerError, rr.Code)
@@ -989,218 +906,78 @@ func TestInvalidToken(t *testing.T) {
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidToken)
}
-func TestTokenSignatureValidation(t *testing.T) {
- tokenValidationMode = 0
- server := httpdServer{
- binding: Binding{
- Address: "",
- Port: 8080,
- EnableWebAdmin: true,
- EnableWebClient: true,
- EnableRESTAPI: true,
- },
- enableWebAdmin: true,
- enableWebClient: true,
- enableRESTAPI: true,
- }
- err := server.initializeRouter()
- require.NoError(t, err)
- testServer := httptest.NewServer(server.router)
- defer testServer.Close()
-
- rr := httptest.NewRecorder()
- req, err := http.NewRequest(http.MethodGet, tokenPath, nil)
- require.NoError(t, err)
- req.SetBasicAuth(defaultAdminUsername, defaultAdminPass)
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusOK, rr.Code)
- var resp map[string]any
- err = json.Unmarshal(rr.Body.Bytes(), &resp)
- assert.NoError(t, err)
- accessToken := resp["access_token"]
- require.NotEmpty(t, accessToken)
-
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodGet, versionPath, nil)
- require.NoError(t, err)
- req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", accessToken))
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusOK, rr.Code)
- // change the token validation mode
- tokenValidationMode = 2
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodGet, versionPath, nil)
- require.NoError(t, err)
- req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", accessToken))
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusOK, rr.Code)
- // Now update the admin
- admin, err := dataprovider.AdminExists(defaultAdminUsername)
- assert.NoError(t, err)
- err = dataprovider.UpdateAdmin(&admin, "", "", "")
- assert.NoError(t, err)
- // token validation mode is 0, the old token is still valid
- tokenValidationMode = 0
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodGet, versionPath, nil)
- require.NoError(t, err)
- req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", accessToken))
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusOK, rr.Code)
- // change the token validation mode
- tokenValidationMode = 2
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodGet, versionPath, nil)
- require.NoError(t, err)
- req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", accessToken))
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusUnauthorized, rr.Code)
- // the token is invalidated, changing the validation mode has no effect
- tokenValidationMode = 0
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodGet, versionPath, nil)
- require.NoError(t, err)
- req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", accessToken))
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusUnauthorized, rr.Code)
-
- userPwd := "pwd"
- user := dataprovider.User{
- BaseUser: sdk.BaseUser{
- Username: defeaultUsername,
- Password: userPwd,
- HomeDir: filepath.Join(os.TempDir(), defeaultUsername),
- Status: 1,
- },
- }
- user.Permissions = make(map[string][]string)
- user.Permissions["/"] = []string{dataprovider.PermAny}
- err = dataprovider.AddUser(&user, "", "", "")
- assert.NoError(t, err)
-
- defer func() {
- dataprovider.DeleteUser(defeaultUsername, "", "", "") //nolint:errcheck
- }()
-
- tokenValidationMode = 2
- req, err = http.NewRequest(http.MethodGet, webClientLoginPath, nil)
- require.NoError(t, err)
- rr = httptest.NewRecorder()
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusOK, rr.Code)
- loginCookie := strings.Split(rr.Header().Get("Set-Cookie"), ";")[0]
- assert.NotEmpty(t, loginCookie)
- csrfToken, err := getCSRFTokenFromBody(rr.Body)
- assert.NoError(t, err)
- assert.NotEmpty(t, csrfToken)
- // Now login
- form := make(url.Values)
- form.Set(csrfFormToken, csrfToken)
- form.Set("username", defeaultUsername)
- form.Set("password", userPwd)
- req, err = http.NewRequest(http.MethodPost, webClientLoginPath, bytes.NewBuffer([]byte(form.Encode())))
- assert.NoError(t, err)
- req.Header.Set("Cookie", loginCookie)
- req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
- rr = httptest.NewRecorder()
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusFound, rr.Code)
- userCookie := strings.Split(rr.Header().Get("Set-Cookie"), ";")[0]
- assert.NotEmpty(t, userCookie)
- // Test a WebClient page and a JSON API
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodGet, webClientFilesPath, nil)
- require.NoError(t, err)
- req.Header.Set("Cookie", userCookie)
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusOK, rr.Code)
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodGet, webClientProfilePath, nil)
- require.NoError(t, err)
- req.Header.Set("Cookie", userCookie)
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusOK, rr.Code)
- csrfToken, err = getCSRFTokenFromBody(rr.Body)
- assert.NoError(t, err)
- assert.NotEmpty(t, csrfToken)
-
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodGet, webClientFilePath+"?path=missing.txt", nil)
- require.NoError(t, err)
- req.Header.Set("Cookie", userCookie)
- req.Header.Set(csrfHeaderToken, csrfToken)
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusNotFound, rr.Code)
-
- tokenValidationMode = 0
- err = dataprovider.DeleteUser(defeaultUsername, "", "", "")
- assert.NoError(t, err)
-
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodGet, webClientFilePath+"?path=missing.txt", nil)
- require.NoError(t, err)
- req.Header.Set("Cookie", userCookie)
- req.Header.Set(csrfHeaderToken, csrfToken)
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusNotFound, rr.Code)
-
- tokenValidationMode = 2
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodGet, webClientFilePath+"?path=missing.txt", nil)
- require.NoError(t, err)
- req.Header.Set("Cookie", userCookie)
- req.Header.Set(csrfHeaderToken, csrfToken)
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusFound, rr.Code)
-
- tokenValidationMode = 0
-}
-
func TestUpdateWebAdminInvalidClaims(t *testing.T) {
server := httpdServer{}
- err := server.initializeRouter()
- require.NoError(t, err)
+ server.initializeRouter()
rr := httptest.NewRecorder()
admin := dataprovider.Admin{
Username: "",
Password: "password",
}
- c := &jwt.Claims{
+ c := jwtTokenClaims{
Username: admin.Username,
Permissions: admin.Permissions,
+ Signature: admin.GetSignature(),
}
- c.Subject = admin.GetSignature()
- token, err := server.tokenAuth.SignWithParams(c, tokenAudienceWebAdmin, "", 10*time.Minute)
+ token, err := c.createTokenResponse(server.tokenAuth, tokenAudienceWebAdmin, "")
assert.NoError(t, err)
- resp := c.BuildTokenResponse(token)
-
- req, err := http.NewRequest(http.MethodGet, webAdminPath, nil)
- assert.NoError(t, err)
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", resp.Token))
- parsedToken, err := jwt.VerifyRequest(server.tokenAuth, req, jwt.TokenFromCookie)
- assert.NoError(t, err)
- ctx := req.Context()
- ctx = jwt.NewContext(ctx, parsedToken, err)
- req = req.WithContext(ctx)
form := make(url.Values)
- form.Set(csrfFormToken, createCSRFToken(rr, req, server.csrfTokenAuth, "", webBaseAdminPath))
+ form.Set(csrfFormToken, createCSRFToken(""))
form.Set("status", "1")
form.Set("default_users_expiration", "30")
- req, err = http.NewRequest(http.MethodPost, path.Join(webAdminPath, "admin"), bytes.NewBuffer([]byte(form.Encode())))
- assert.NoError(t, err)
+ req, _ := http.NewRequest(http.MethodPost, path.Join(webAdminPath, "admin"), bytes.NewBuffer([]byte(form.Encode())))
rctx := chi.NewRouteContext()
rctx.URLParams.Add("username", "admin")
- req = req.WithContext(ctx)
req = req.WithContext(context.WithValue(req.Context(), chi.RouteCtxKey, rctx))
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", resp.Token))
+ req.Header.Set("Cookie", fmt.Sprintf("jwt=%v", token["access_token"]))
server.handleWebUpdateAdminPost(rr, req)
assert.Equal(t, http.StatusOK, rr.Code)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidToken)
}
+func TestRetentionInvalidTokenClaims(t *testing.T) {
+ username := "retentionuser"
+ user := dataprovider.User{
+ BaseUser: sdk.BaseUser{
+ Username: username,
+ Password: "pwd",
+ HomeDir: filepath.Join(os.TempDir(), username),
+ Status: 1,
+ },
+ }
+ user.Permissions = make(map[string][]string)
+ user.Permissions["/"] = []string{dataprovider.PermAny}
+ user.Filters.AllowAPIKeyAuth = true
+ err := dataprovider.AddUser(&user, "", "", "")
+ assert.NoError(t, err)
+ folderRetention := []dataprovider.FolderRetention{
+ {
+ Path: "/",
+ Retention: 0,
+ DeleteEmptyDirs: true,
+ },
+ }
+ asJSON, err := json.Marshal(folderRetention)
+ assert.NoError(t, err)
+ req, _ := http.NewRequest(http.MethodPost, retentionBasePath+"/"+username+"/check?notifications=Email", bytes.NewBuffer(asJSON))
+
+ rctx := chi.NewRouteContext()
+ rctx.URLParams.Add("username", username)
+
+ req = req.WithContext(context.WithValue(req.Context(), chi.RouteCtxKey, rctx))
+ req = req.WithContext(context.WithValue(req.Context(), jwtauth.ErrorCtxKey, errors.New("error")))
+ rr := httptest.NewRecorder()
+ startRetentionCheck(rr, req)
+ assert.Equal(t, http.StatusBadRequest, rr.Code)
+ assert.Contains(t, rr.Body.String(), "Invalid token claims")
+
+ err = dataprovider.DeleteUser(username, "", "", "")
+ assert.NoError(t, err)
+}
+
func TestUpdateSMTPSecrets(t *testing.T) {
currentConfigs := &dataprovider.SMTPConfigs{
OAuth2: dataprovider.SMTPOAuth2{
@@ -1241,8 +1018,7 @@ func TestUpdateSMTPSecrets(t *testing.T) {
func TestOAuth2Redirect(t *testing.T) {
server := httpdServer{}
- err := server.initializeRouter()
- require.NoError(t, err)
+ server.initializeRouter()
rr := httptest.NewRecorder()
req, err := http.NewRequest(http.MethodGet, webOAuth2RedirectPath+"?state=invalid", nil)
@@ -1252,7 +1028,7 @@ func TestOAuth2Redirect(t *testing.T) {
assert.Contains(t, rr.Body.String(), util.I18nOAuth2ErrorTitle)
ip := "127.1.1.4"
- tokenString := createOAuth2Token(server.csrfTokenAuth, xid.New().String(), ip)
+ tokenString := createOAuth2Token(xid.New().String(), ip)
rr = httptest.NewRecorder()
req, err = http.NewRequest(http.MethodGet, webOAuth2RedirectPath+"?state="+tokenString, nil) //nolint:goconst
assert.NoError(t, err)
@@ -1263,48 +1039,57 @@ func TestOAuth2Redirect(t *testing.T) {
}
func TestOAuth2Token(t *testing.T) {
- server := httpdServer{}
- err := server.initializeRouter()
- require.NoError(t, err)
// invalid token
- _, err = verifyOAuth2Token(server.csrfTokenAuth, "token", "")
+ _, err := verifyOAuth2Token("token", "")
if assert.Error(t, err) {
assert.Contains(t, err.Error(), "unable to verify OAuth2 state")
}
// bad audience
- claims := jwt.NewClaims(tokenAudienceAPI, "", getTokenDuration(tokenAudienceAPI))
+ claims := make(map[string]any)
+ now := time.Now().UTC()
- tokenString, err := server.csrfTokenAuth.Sign(claims)
+ claims[jwt.JwtIDKey] = xid.New().String()
+ claims[jwt.NotBeforeKey] = now.Add(-30 * time.Second)
+ claims[jwt.ExpirationKey] = now.Add(tokenDuration)
+ claims[jwt.AudienceKey] = []string{tokenAudienceAPI}
+
+ _, tokenString, err := csrfTokenAuth.Encode(claims)
assert.NoError(t, err)
- _, err = verifyOAuth2Token(server.csrfTokenAuth, tokenString, "")
+ _, err = verifyOAuth2Token(tokenString, "")
if assert.Error(t, err) {
assert.Contains(t, err.Error(), "invalid OAuth2 state")
}
// bad IP
- tokenString = createOAuth2Token(server.csrfTokenAuth, "state", "127.1.1.1")
- _, err = verifyOAuth2Token(server.csrfTokenAuth, tokenString, "127.1.1.2")
+ tokenString = createOAuth2Token("state", "127.1.1.1")
+ _, err = verifyOAuth2Token(tokenString, "127.1.1.2")
if assert.Error(t, err) {
assert.Contains(t, err.Error(), "invalid OAuth2 state")
}
// ok
state := xid.New().String()
- tokenString = createOAuth2Token(server.csrfTokenAuth, state, "127.1.1.3")
- s, err := verifyOAuth2Token(server.csrfTokenAuth, tokenString, "127.1.1.3")
+ tokenString = createOAuth2Token(state, "127.1.1.3")
+ s, err := verifyOAuth2Token(tokenString, "127.1.1.3")
assert.NoError(t, err)
assert.Equal(t, state, s)
// no jti
- claims = jwt.NewClaims(tokenAudienceOAuth2, "127.1.1.4", getTokenDuration(tokenAudienceOAuth2))
- tokenString, err = josejwt.Signed(server.csrfTokenAuth.Signer()).Claims(claims).Serialize()
+ claims = make(map[string]any)
+
+ claims[jwt.NotBeforeKey] = now.Add(-30 * time.Second)
+ claims[jwt.ExpirationKey] = now.Add(tokenDuration)
+ claims[jwt.AudienceKey] = []string{tokenAudienceOAuth2, "127.1.1.4"}
+ _, tokenString, err = csrfTokenAuth.Encode(claims)
assert.NoError(t, err)
- _, err = verifyOAuth2Token(server.csrfTokenAuth, tokenString, "127.1.1.4")
+ _, err = verifyOAuth2Token(tokenString, "127.1.1.4")
if assert.Error(t, err) {
assert.Contains(t, err.Error(), "invalid OAuth2 state")
}
// encode error
- server.csrfTokenAuth.SetSigner(&failingJoseSigner{})
- tokenString = createOAuth2Token(server.csrfTokenAuth, xid.New().String(), "")
+ csrfTokenAuth = jwtauth.New("HT256", util.GenerateRandomBytes(32), nil)
+ tokenString = createOAuth2Token(xid.New().String(), "")
assert.Empty(t, tokenString)
+ server := httpdServer{}
+ server.initializeRouter()
rr := httptest.NewRecorder()
testReq := make(map[string]any)
testReq["base_redirect_url"] = "http://localhost:8082"
@@ -1312,50 +1097,50 @@ func TestOAuth2Token(t *testing.T) {
assert.NoError(t, err)
req, err := http.NewRequest(http.MethodPost, webOAuth2TokenPath, bytes.NewBuffer(asJSON))
assert.NoError(t, err)
- server.handleSMTPOAuth2TokenRequestPost(rr, req)
+ handleSMTPOAuth2TokenRequestPost(rr, req)
assert.Equal(t, http.StatusInternalServerError, rr.Code)
assert.Contains(t, rr.Body.String(), "unable to create state token")
+
+ csrfTokenAuth = jwtauth.New(jwa.HS256.String(), util.GenerateRandomBytes(32), nil)
}
func TestCSRFToken(t *testing.T) {
- server := httpdServer{}
- err := server.initializeRouter()
- require.NoError(t, err)
// invalid token
- req := &http.Request{}
- err = verifyCSRFToken(req, server.csrfTokenAuth)
+ err := verifyCSRFToken("token", "")
if assert.Error(t, err) {
assert.Contains(t, err.Error(), "unable to verify form token")
}
// bad audience
- claims := jwt.NewClaims(tokenAudienceAPI, "", getTokenDuration(tokenAudienceAPI))
- tokenString, err := server.csrfTokenAuth.Sign(claims)
+ claims := make(map[string]any)
+ now := time.Now().UTC()
+
+ claims[jwt.JwtIDKey] = xid.New().String()
+ claims[jwt.NotBeforeKey] = now.Add(-30 * time.Second)
+ claims[jwt.ExpirationKey] = now.Add(tokenDuration)
+ claims[jwt.AudienceKey] = []string{tokenAudienceAPI}
+
+ _, tokenString, err := csrfTokenAuth.Encode(claims)
assert.NoError(t, err)
- values := url.Values{}
- values.Set(csrfFormToken, tokenString)
- req.Form = values
- err = verifyCSRFToken(req, server.csrfTokenAuth)
+ err = verifyCSRFToken(tokenString, "")
if assert.Error(t, err) {
assert.Contains(t, err.Error(), "form token is not valid")
}
// bad IP
- req.RemoteAddr = "127.1.1.1"
- tokenString = createCSRFToken(httptest.NewRecorder(), req, server.csrfTokenAuth, "", webBaseAdminPath)
- values.Set(csrfFormToken, tokenString)
- req.Form = values
- req.RemoteAddr = "127.1.1.2"
- err = verifyCSRFToken(req, server.csrfTokenAuth)
+ tokenString = createCSRFToken("127.1.1.1")
+ err = verifyCSRFToken(tokenString, "127.1.1.2")
if assert.Error(t, err) {
assert.Contains(t, err.Error(), "form token is not valid")
}
- claims = jwt.NewClaims(tokenAudienceAPI, "", getTokenDuration(tokenAudienceAPI))
- tokenString, err = server.csrfTokenAuth.Sign(claims)
+ claims[jwt.JwtIDKey] = xid.New().String()
+ claims[jwt.NotBeforeKey] = now.Add(-30 * time.Second)
+ claims[jwt.ExpirationKey] = now.Add(tokenDuration)
+ claims[jwt.AudienceKey] = []string{tokenAudienceAPI}
+ _, tokenString, err = csrfTokenAuth.Encode(claims)
assert.NoError(t, err)
- assert.NotEmpty(t, tokenString)
- r, err := GetHTTPRouter(Binding{
+ r := GetHTTPRouter(Binding{
Address: "",
Port: 8080,
EnableWebAdmin: true,
@@ -1363,10 +1148,9 @@ func TestCSRFToken(t *testing.T) {
EnableRESTAPI: true,
RenderOpenAPI: true,
})
- assert.NoError(t, err)
- fn := server.verifyCSRFHeader(r)
+ fn := verifyCSRFHeader(r)
rr := httptest.NewRecorder()
- req, _ = http.NewRequest(http.MethodDelete, path.Join(userPath, "username"), nil)
+ req, _ := http.NewRequest(http.MethodDelete, path.Join(userPath, "username"), nil)
fn.ServeHTTP(rr, req)
assert.Equal(t, http.StatusForbidden, rr.Code)
assert.Contains(t, rr.Body.String(), "Invalid token")
@@ -1379,22 +1163,18 @@ func TestCSRFToken(t *testing.T) {
assert.Contains(t, rr.Body.String(), "the token is not valid")
// invalid IP
- tokenString = createCSRFToken(httptest.NewRecorder(), req, server.csrfTokenAuth, "", webBaseAdminPath)
+ tokenString = createCSRFToken("172.16.1.2")
req.Header.Set(csrfHeaderToken, tokenString)
- req.RemoteAddr = "172.16.1.2"
rr = httptest.NewRecorder()
fn.ServeHTTP(rr, req)
assert.Equal(t, http.StatusForbidden, rr.Code)
assert.Contains(t, rr.Body.String(), "the token is not valid")
- csrfTokenAuth, err := jwt.NewSigner(jose.HS256, util.GenerateRandomBytes(32))
- require.NoError(t, err)
- csrfTokenAuth.SetSigner(&failingJoseSigner{})
- tokenString = createCSRFToken(httptest.NewRecorder(), req, csrfTokenAuth, "", webBaseAdminPath)
+ csrfTokenAuth = jwtauth.New("PS256", util.GenerateRandomBytes(32), nil)
+ tokenString = createCSRFToken("")
assert.Empty(t, tokenString)
- rr = httptest.NewRecorder()
- createLoginCookie(rr, req, csrfTokenAuth, "", webBaseAdminPath, req.RemoteAddr)
- assert.Empty(t, rr.Header().Get("Set-Cookie"))
+
+ csrfTokenAuth = jwtauth.New(jwa.HS256.String(), util.GenerateRandomBytes(32), nil)
}
func TestCreateShareCookieError(t *testing.T) {
@@ -1414,7 +1194,7 @@ func TestCreateShareCookieError(t *testing.T) {
err := dataprovider.AddUser(user, "", "", "")
assert.NoError(t, err)
share := &dataprovider.Share{
- Name: "test_share_cookie_error",
+ Name: "test share cookie error",
ShareID: util.GenerateUniqueID(),
Scope: dataprovider.ShareScopeRead,
Password: pwd,
@@ -1424,44 +1204,20 @@ func TestCreateShareCookieError(t *testing.T) {
err = dataprovider.AddShare(share, "", "", "")
assert.NoError(t, err)
- tokenAuth, err := jwt.NewSigner(jose.HS256, util.GenerateRandomBytes(32))
- require.NoError(t, err)
- tokenAuth.SetSigner(&failingJoseSigner{})
- csrfTokenAuth, err := jwt.NewSigner(jose.HS256, util.GenerateRandomBytes(32))
- require.NoError(t, err)
-
server := httpdServer{
- tokenAuth: tokenAuth,
- csrfTokenAuth: csrfTokenAuth,
+ tokenAuth: jwtauth.New("TS256", util.GenerateRandomBytes(32), nil),
}
-
- c := jwt.NewClaims(tokenAudienceWebLogin, "127.0.0.1", getTokenDuration(tokenAudienceWebLogin))
- token, err := server.csrfTokenAuth.Sign(c)
- assert.NoError(t, err)
- resp := c.BuildTokenResponse(token)
- parsedToken, err := jwt.VerifyToken(server.csrfTokenAuth, resp.Token)
- assert.NoError(t, err)
-
- req, err := http.NewRequest(http.MethodGet, path.Join(webClientPubSharesPath, share.ShareID, "login"), nil)
- assert.NoError(t, err)
- req.RemoteAddr = "127.0.0.1:4567"
- ctx := req.Context()
- ctx = jwt.NewContext(ctx, parsedToken, err)
- req = req.WithContext(ctx)
-
form := make(url.Values)
form.Set("share_password", pwd)
- form.Set(csrfFormToken, createCSRFToken(httptest.NewRecorder(), req, server.csrfTokenAuth, "", webBaseClientPath))
+ form.Set(csrfFormToken, createCSRFToken("127.0.0.1"))
rctx := chi.NewRouteContext()
rctx.URLParams.Add("id", share.ShareID)
rr := httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodPost, path.Join(webClientPubSharesPath, share.ShareID, "login"),
+ req, err := http.NewRequest(http.MethodPost, path.Join(webClientPubSharesPath, share.ShareID, "login"),
bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = "127.0.0.1:2345"
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", resp.Token))
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
- req = req.WithContext(ctx)
req = req.WithContext(context.WithValue(req.Context(), chi.RouteCtxKey, rctx))
server.handleClientShareLoginPost(rr, req)
assert.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
@@ -1472,15 +1228,8 @@ func TestCreateShareCookieError(t *testing.T) {
}
func TestCreateTokenError(t *testing.T) {
- tokenAuth, err := jwt.NewSigner(jose.HS256, util.GenerateRandomBytes(32))
- require.NoError(t, err)
- tokenAuth.SetSigner(&failingJoseSigner{})
- csrfTokenAuth, err := jwt.NewSigner(jose.HS256, util.GenerateRandomBytes(32))
- require.NoError(t, err)
-
server := httpdServer{
- tokenAuth: tokenAuth,
- csrfTokenAuth: csrfTokenAuth,
+ tokenAuth: jwtauth.New("PS256", util.GenerateRandomBytes(32), nil),
}
rr := httptest.NewRecorder()
admin := dataprovider.Admin{
@@ -1504,37 +1253,14 @@ func TestCreateTokenError(t *testing.T) {
server.generateAndSendUserToken(rr, req, "", user)
assert.Equal(t, http.StatusInternalServerError, rr.Code)
- c := &jwt.Claims{}
- c.ID = xid.New().String()
- c.SetExpiry(time.Now().Add(1 * time.Minute))
- tokenString, err := server.csrfTokenAuth.SignWithParams(c, tokenAudienceAPI, "", getTokenDuration(tokenAudienceAPI))
- assert.NoError(t, err)
- token := c.BuildTokenResponse(tokenString)
-
- req, err = http.NewRequest(http.MethodGet, webAdminLoginPath, nil)
- assert.NoError(t, err)
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", token.Token))
- parsedToken, err := jwt.VerifyRequest(server.csrfTokenAuth, req, jwt.TokenFromCookie)
- assert.NoError(t, err)
- ctx := req.Context()
- ctx = jwt.NewContext(ctx, parsedToken, err)
- req = req.WithContext(ctx)
-
rr = httptest.NewRecorder()
form := make(url.Values)
form.Set("username", admin.Username)
form.Set("password", admin.Password)
- form.Set(csrfFormToken, createCSRFToken(rr, req, server.csrfTokenAuth, xid.New().String(), webBaseAdminPath))
- cookie := rr.Header().Get("Set-Cookie")
- assert.NotEmpty(t, cookie)
+ form.Set(csrfFormToken, createCSRFToken("127.0.0.1"))
req, _ = http.NewRequest(http.MethodPost, webAdminLoginPath, bytes.NewBuffer([]byte(form.Encode())))
- req.Header.Set("Cookie", cookie)
+ req.RemoteAddr = "127.0.0.1:1234"
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
- parsedToken, err = jwt.VerifyRequest(server.csrfTokenAuth, req, jwt.TokenFromCookie)
- assert.NoError(t, err)
- ctx = req.Context()
- ctx = jwt.NewContext(ctx, parsedToken, err)
- req = req.WithContext(ctx)
server.handleWebAdminLoginPost(rr, req)
assert.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
// req with no content type
@@ -1561,7 +1287,7 @@ func TestCreateTokenError(t *testing.T) {
req, _ = http.NewRequest(http.MethodGet, webAdminLoginPath+"?a=a%C3%A2%G3", nil)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
- _, err = getAdminFromPostFields(req)
+ _, err := getAdminFromPostFields(req)
assert.Error(t, err)
req, _ = http.NewRequest(http.MethodPost, webAdminEventActionPath+"?a=a%C3%A2%GG", nil)
@@ -1611,7 +1337,6 @@ func TestCreateTokenError(t *testing.T) {
assert.Equal(t, http.StatusInternalServerError, rr.Code, rr.Body.String())
req, _ = http.NewRequest(http.MethodPost, webAdminTwoFactorPath+"?a=a%C3%AO%GC", bytes.NewBuffer([]byte(form.Encode())))
- req = req.WithContext(jwt.NewContext(req.Context(), &jwt.Claims{}, nil))
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = httptest.NewRecorder()
server.handleWebAdminTwoFactorPost(rr, req)
@@ -1619,7 +1344,6 @@ func TestCreateTokenError(t *testing.T) {
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidForm)
req, _ = http.NewRequest(http.MethodPost, webAdminTwoFactorRecoveryPath+"?a=a%C3%AO%GD", bytes.NewBuffer([]byte(form.Encode())))
- req = req.WithContext(jwt.NewContext(req.Context(), &jwt.Claims{}, nil))
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = httptest.NewRecorder()
server.handleWebAdminTwoFactorRecoveryPost(rr, req)
@@ -1627,7 +1351,6 @@ func TestCreateTokenError(t *testing.T) {
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidForm)
req, _ = http.NewRequest(http.MethodPost, webClientTwoFactorPath+"?a=a%C3%AO%GC", bytes.NewBuffer([]byte(form.Encode())))
- req = req.WithContext(jwt.NewContext(req.Context(), &jwt.Claims{}, nil))
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = httptest.NewRecorder()
server.handleWebClientTwoFactorPost(rr, req)
@@ -1635,7 +1358,6 @@ func TestCreateTokenError(t *testing.T) {
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidForm)
req, _ = http.NewRequest(http.MethodPost, webClientTwoFactorRecoveryPath+"?a=a%C3%AO%GD", bytes.NewBuffer([]byte(form.Encode())))
- req = req.WithContext(jwt.NewContext(req.Context(), &jwt.Claims{}, nil))
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = httptest.NewRecorder()
server.handleWebClientTwoFactorRecoveryPost(rr, req)
@@ -1699,21 +1421,13 @@ func TestCreateTokenError(t *testing.T) {
err = dataprovider.AddUser(&user, "", "", "")
assert.NoError(t, err)
- req, err = http.NewRequest(http.MethodGet, webClientLoginPath, nil)
- assert.NoError(t, err)
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", token.Token))
- parsedToken, err = jwt.VerifyRequest(server.csrfTokenAuth, req, jwt.TokenFromCookie)
- assert.NoError(t, err)
- ctx = req.Context()
- ctx = jwt.NewContext(ctx, parsedToken, err)
- req = req.WithContext(ctx)
-
rr = httptest.NewRecorder()
form = make(url.Values)
form.Set("username", user.Username)
form.Set("password", "clientpwd")
- form.Set(csrfFormToken, createCSRFToken(rr, req, server.csrfTokenAuth, "", webBaseClientPath))
+ form.Set(csrfFormToken, createCSRFToken("127.0.0.1"))
req, _ = http.NewRequest(http.MethodPost, webClientLoginPath, bytes.NewBuffer([]byte(form.Encode())))
+ req.RemoteAddr = "127.0.0.1:4567"
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
server.handleWebClientLoginPost(rr, req)
assert.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
@@ -1741,7 +1455,7 @@ func TestCreateTokenError(t *testing.T) {
}
func TestAPIKeyAuthForbidden(t *testing.T) {
- r, err := GetHTTPRouter(Binding{
+ r := GetHTTPRouter(Binding{
Address: "",
Port: 8080,
EnableWebAdmin: true,
@@ -1749,7 +1463,6 @@ func TestAPIKeyAuthForbidden(t *testing.T) {
EnableRESTAPI: true,
RenderOpenAPI: true,
})
- require.NoError(t, err)
fn := forbidAPIKeyAuthentication(r)
rr := httptest.NewRecorder()
req, _ := http.NewRequest(http.MethodGet, versionPath, nil)
@@ -1759,14 +1472,12 @@ func TestAPIKeyAuthForbidden(t *testing.T) {
}
func TestJWTTokenValidation(t *testing.T) {
- tokenAuth, err := jwt.NewSigner(jose.HS256, util.GenerateRandomBytes(32))
- require.NoError(t, err)
- claims := &jwt.Claims{
- Username: defaultAdminUsername,
- }
- claims.SetExpiry(time.Now().UTC().Add(-1 * time.Hour))
- _, err = tokenAuth.SignWithParams(claims, tokenAudienceWebAdmin, "", getTokenDuration(tokenAudienceWebAdmin))
- require.NoError(t, err)
+ tokenAuth := jwtauth.New(jwa.HS256.String(), util.GenerateRandomBytes(32), nil)
+ claims := make(map[string]any)
+ claims["username"] = defaultAdminUsername
+ claims[jwt.ExpirationKey] = time.Now().UTC().Add(-1 * time.Hour)
+ token, _, err := tokenAuth.Encode(claims)
+ assert.NoError(t, err)
server := httpdServer{
binding: Binding{
@@ -1778,20 +1489,19 @@ func TestJWTTokenValidation(t *testing.T) {
RenderOpenAPI: true,
},
}
- err = server.initializeRouter()
- require.NoError(t, err)
+ server.initializeRouter()
r := server.router
fn := jwtAuthenticatorAPI(r)
rr := httptest.NewRecorder()
req, _ := http.NewRequest(http.MethodGet, userPath, nil)
- ctx := jwt.NewContext(req.Context(), claims, nil)
+ ctx := jwtauth.NewContext(req.Context(), token, nil)
fn.ServeHTTP(rr, req.WithContext(ctx))
assert.Equal(t, http.StatusUnauthorized, rr.Code)
fn = jwtAuthenticatorWebAdmin(r)
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodGet, webUserPath, nil)
- ctx = jwt.NewContext(req.Context(), claims, nil)
+ ctx = jwtauth.NewContext(req.Context(), token, nil)
fn.ServeHTTP(rr, req.WithContext(ctx))
assert.Equal(t, http.StatusFound, rr.Code)
assert.Equal(t, webAdminLoginPath, rr.Header().Get("Location"))
@@ -1799,26 +1509,26 @@ func TestJWTTokenValidation(t *testing.T) {
fn = jwtAuthenticatorWebClient(r)
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodGet, webClientFilesPath, nil)
- ctx = jwt.NewContext(req.Context(), claims, nil)
+ ctx = jwtauth.NewContext(req.Context(), token, nil)
fn.ServeHTTP(rr, req.WithContext(ctx))
assert.Equal(t, http.StatusFound, rr.Code)
assert.Equal(t, webClientLoginPath, rr.Header().Get("Location"))
errTest := errors.New("test error")
- permFn := server.checkPerms(dataprovider.PermAdminAny)
+ permFn := server.checkPerm(dataprovider.PermAdminAny)
fn = permFn(r)
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodGet, userPath, nil)
- ctx = jwt.NewContext(req.Context(), claims, errTest)
+ ctx = jwtauth.NewContext(req.Context(), token, errTest)
fn.ServeHTTP(rr, req.WithContext(ctx))
assert.Equal(t, http.StatusBadRequest, rr.Code)
- permFn = server.checkPerms(dataprovider.PermAdminAny)
+ permFn = server.checkPerm(dataprovider.PermAdminAny)
fn = permFn(r)
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodGet, webUserPath, nil)
req.RequestURI = webUserPath
- ctx = jwt.NewContext(req.Context(), claims, errTest)
+ ctx = jwtauth.NewContext(req.Context(), token, errTest)
fn.ServeHTTP(rr, req.WithContext(ctx))
assert.Equal(t, http.StatusBadRequest, rr.Code)
@@ -1827,14 +1537,14 @@ func TestJWTTokenValidation(t *testing.T) {
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodPost, webClientProfilePath, nil)
req.RequestURI = webClientProfilePath
- ctx = jwt.NewContext(req.Context(), claims, errTest)
+ ctx = jwtauth.NewContext(req.Context(), token, errTest)
fn.ServeHTTP(rr, req.WithContext(ctx))
assert.Equal(t, http.StatusBadRequest, rr.Code)
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodPost, userProfilePath, nil)
req.RequestURI = userProfilePath
- ctx = jwt.NewContext(req.Context(), claims, errTest)
+ ctx = jwtauth.NewContext(req.Context(), token, errTest)
fn.ServeHTTP(rr, req.WithContext(ctx))
assert.Equal(t, http.StatusBadRequest, rr.Code)
@@ -1842,7 +1552,7 @@ func TestJWTTokenValidation(t *testing.T) {
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodPost, webClientProfilePath, nil)
req.RequestURI = webClientProfilePath
- ctx = jwt.NewContext(req.Context(), claims, errTest)
+ ctx = jwtauth.NewContext(req.Context(), token, errTest)
fn.ServeHTTP(rr, req.WithContext(ctx))
assert.Equal(t, http.StatusBadRequest, rr.Code)
@@ -1850,56 +1560,50 @@ func TestJWTTokenValidation(t *testing.T) {
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodPost, webGroupsPath, nil)
req.RequestURI = webGroupsPath
- ctx = jwt.NewContext(req.Context(), claims, errTest)
+ ctx = jwtauth.NewContext(req.Context(), token, errTest)
fn.ServeHTTP(rr, req.WithContext(ctx))
assert.Equal(t, http.StatusBadRequest, rr.Code)
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodPost, userSharesPath, nil)
req.RequestURI = userSharesPath
- ctx = jwt.NewContext(req.Context(), claims, errTest)
+ ctx = jwtauth.NewContext(req.Context(), token, errTest)
fn.ServeHTTP(rr, req.WithContext(ctx))
assert.Equal(t, http.StatusBadRequest, rr.Code)
}
func TestUpdateContextFromCookie(t *testing.T) {
- tokenAuth, err := jwt.NewSigner(jose.HS256, util.GenerateRandomBytes(32))
- require.NoError(t, err)
server := httpdServer{
- tokenAuth: tokenAuth,
+ tokenAuth: jwtauth.New(jwa.HS256.String(), util.GenerateRandomBytes(32), nil),
}
req, _ := http.NewRequest(http.MethodGet, tokenPath, nil)
- claims := jwt.NewClaims(tokenAudienceWebClient, "", getTokenDuration(tokenAudienceWebClient))
- _, err = server.tokenAuth.Sign(claims)
+ claims := make(map[string]any)
+ claims["a"] = "b"
+ token, _, err := server.tokenAuth.Encode(claims)
assert.NoError(t, err)
- ctx := jwt.NewContext(req.Context(), claims, nil)
- req = server.updateContextFromCookie(req.WithContext(ctx))
- token, err := jwt.FromContext(req.Context())
- require.NoError(t, err)
- require.True(t, token.Audience.Contains(tokenAudienceWebClient))
- require.NotEmpty(t, token.ID)
+ ctx := jwtauth.NewContext(req.Context(), token, nil)
+ server.updateContextFromCookie(req.WithContext(ctx))
}
func TestCookieExpiration(t *testing.T) {
- tokenAuth, err := jwt.NewSigner(jose.HS256, util.GenerateRandomBytes(32))
- require.NoError(t, err)
server := httpdServer{
- tokenAuth: tokenAuth,
+ tokenAuth: jwtauth.New(jwa.HS256.String(), util.GenerateRandomBytes(32), nil),
}
- err = errors.New("test error")
+ err := errors.New("test error")
rr := httptest.NewRecorder()
req, _ := http.NewRequest(http.MethodGet, tokenPath, nil)
- ctx := jwt.NewContext(req.Context(), nil, err)
+ ctx := jwtauth.NewContext(req.Context(), nil, err)
server.checkCookieExpiration(rr, req.WithContext(ctx))
cookie := rr.Header().Get("Set-Cookie")
assert.Empty(t, cookie)
req, _ = http.NewRequest(http.MethodGet, tokenPath, nil)
- claims := jwt.NewClaims(tokenAudienceWebClient, "", getTokenDuration(tokenAudienceWebClient))
- _, err = server.tokenAuth.Sign(claims)
+ claims := make(map[string]any)
+ claims["a"] = "b"
+ token, _, err := server.tokenAuth.Encode(claims)
assert.NoError(t, err)
- ctx = jwt.NewContext(req.Context(), claims, nil)
+ ctx = jwtauth.NewContext(req.Context(), token, nil)
server.checkCookieExpiration(rr, req.WithContext(ctx))
cookie = rr.Header().Get("Set-Cookie")
assert.Empty(t, cookie)
@@ -1909,16 +1613,16 @@ func TestCookieExpiration(t *testing.T) {
Password: "password",
Permissions: []string{dataprovider.PermAdminAny},
}
- claims = jwt.NewClaims(tokenAudienceAPI, "", getTokenDuration(tokenAudienceAPI))
- claims.Username = admin.Username
- claims.Permissions = admin.Permissions
- claims.Subject = admin.GetSignature()
- claims.SetExpiry(time.Now().Add(1 * time.Minute))
- _, err = server.tokenAuth.Sign(claims)
+ claims = make(map[string]any)
+ claims[claimUsernameKey] = admin.Username
+ claims[claimPermissionsKey] = admin.Permissions
+ claims[jwt.SubjectKey] = admin.GetSignature()
+ claims[jwt.ExpirationKey] = time.Now().Add(1 * time.Minute)
+ claims[jwt.AudienceKey] = []string{tokenAudienceAPI}
+ token, _, err = server.tokenAuth.Encode(claims)
assert.NoError(t, err)
-
req, _ = http.NewRequest(http.MethodGet, tokenPath, nil)
- ctx = jwt.NewContext(req.Context(), claims, nil)
+ ctx = jwtauth.NewContext(req.Context(), token, nil)
server.checkCookieExpiration(rr, req.WithContext(ctx))
cookie = rr.Header().Get("Set-Cookie")
assert.Empty(t, cookie)
@@ -1927,7 +1631,7 @@ func TestCookieExpiration(t *testing.T) {
err = dataprovider.AddAdmin(&admin, "", "", "")
assert.NoError(t, err)
req, _ = http.NewRequest(http.MethodGet, tokenPath, nil)
- ctx = jwt.NewContext(req.Context(), claims, nil)
+ ctx = jwtauth.NewContext(req.Context(), token, nil)
server.checkCookieExpiration(rr, req.WithContext(ctx))
cookie = rr.Header().Get("Set-Cookie")
assert.Empty(t, cookie)
@@ -1937,41 +1641,34 @@ func TestCookieExpiration(t *testing.T) {
err = dataprovider.UpdateAdmin(&admin, "", "", "")
assert.NoError(t, err)
req, _ = http.NewRequest(http.MethodGet, tokenPath, nil)
- ctx = jwt.NewContext(req.Context(), claims, nil)
+ ctx = jwtauth.NewContext(req.Context(), token, nil)
server.checkCookieExpiration(rr, req.WithContext(ctx))
cookie = rr.Header().Get("Set-Cookie")
assert.Empty(t, cookie)
admin, err = dataprovider.AdminExists(admin.Username)
assert.NoError(t, err)
- tokenID := xid.New().String()
- claims = jwt.NewClaims(tokenAudienceAPI, "", getTokenDuration(tokenAudienceAPI))
- claims.ID = tokenID
- claims.Username = admin.Username
- claims.Permissions = admin.Permissions
- claims.Subject = admin.GetSignature()
- claims.SetExpiry(time.Now().Add(1 * time.Minute))
- _, err = server.tokenAuth.Sign(claims)
+ claims = make(map[string]any)
+ claims[claimUsernameKey] = admin.Username
+ claims[claimPermissionsKey] = admin.Permissions
+ claims[jwt.SubjectKey] = admin.GetSignature()
+ claims[jwt.ExpirationKey] = time.Now().Add(1 * time.Minute)
+ claims[jwt.AudienceKey] = []string{tokenAudienceAPI}
+ token, _, err = server.tokenAuth.Encode(claims)
assert.NoError(t, err)
-
req, _ = http.NewRequest(http.MethodGet, tokenPath, nil)
req.RemoteAddr = "192.168.8.1:1234"
- ctx = jwt.NewContext(req.Context(), claims, nil)
+ ctx = jwtauth.NewContext(req.Context(), token, nil)
server.checkCookieExpiration(rr, req.WithContext(ctx))
cookie = rr.Header().Get("Set-Cookie")
assert.Empty(t, cookie)
req, _ = http.NewRequest(http.MethodGet, tokenPath, nil)
req.RemoteAddr = "172.16.1.12:4567"
- ctx = jwt.NewContext(req.Context(), claims, nil)
+ ctx = jwtauth.NewContext(req.Context(), token, nil)
server.checkCookieExpiration(rr, req.WithContext(ctx))
cookie = rr.Header().Get("Set-Cookie")
assert.True(t, strings.HasPrefix(cookie, "jwt="))
- req.Header.Set("Cookie", cookie)
- c, err := jwt.VerifyRequest(server.tokenAuth, req, jwt.TokenFromCookie)
- if assert.NoError(t, err) {
- assert.Equal(t, tokenID, c.ID)
- }
err = dataprovider.DeleteAdmin(admin.Username, "", "", "")
assert.NoError(t, err)
@@ -1989,18 +1686,18 @@ func TestCookieExpiration(t *testing.T) {
user.Permissions = make(map[string][]string)
user.Permissions["/"] = []string{"*"}
- claims = jwt.NewClaims(tokenAudienceWebClient, "", getTokenDuration(tokenAudienceWebClient))
- claims.ID = tokenID
- claims.Username = user.Username
- claims.Permissions = user.Filters.WebClient
- claims.Subject = user.GetSignature()
- claims.SetExpiry(time.Now().Add(1 * time.Minute))
- _, err = server.tokenAuth.Sign(claims)
+ claims = make(map[string]any)
+ claims[claimUsernameKey] = user.Username
+ claims[claimPermissionsKey] = user.Filters.WebClient
+ claims[jwt.SubjectKey] = user.GetSignature()
+ claims[jwt.ExpirationKey] = time.Now().Add(1 * time.Minute)
+ claims[jwt.AudienceKey] = []string{tokenAudienceWebClient}
+ token, _, err = server.tokenAuth.Encode(claims)
assert.NoError(t, err)
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodGet, webClientFilesPath, nil)
- ctx = jwt.NewContext(req.Context(), claims, nil)
+ ctx = jwtauth.NewContext(req.Context(), token, nil)
server.checkCookieExpiration(rr, req.WithContext(ctx))
cookie = rr.Header().Get("Set-Cookie")
assert.Empty(t, cookie)
@@ -2008,7 +1705,7 @@ func TestCookieExpiration(t *testing.T) {
err = dataprovider.AddUser(&user, "", "", "")
assert.NoError(t, err)
req, _ = http.NewRequest(http.MethodGet, webClientFilesPath, nil)
- ctx = jwt.NewContext(req.Context(), claims, nil)
+ ctx = jwtauth.NewContext(req.Context(), token, nil)
server.checkCookieExpiration(rr, req.WithContext(ctx))
cookie = rr.Header().Get("Set-Cookie")
assert.Empty(t, cookie)
@@ -2021,57 +1718,28 @@ func TestCookieExpiration(t *testing.T) {
user, err = dataprovider.UserExists(user.Username, "")
assert.NoError(t, err)
- issuedAt := time.Now().Add(-1 * time.Minute)
- expiresAt := time.Now().Add(1 * time.Minute)
-
- claims = jwt.NewClaims(tokenAudienceWebClient, "", getTokenDuration(tokenAudienceWebClient))
- claims.ID = tokenID
- claims.Username = user.Username
- claims.Permissions = user.Filters.WebClient
- claims.Subject = user.GetSignature()
- claims.SetExpiry(expiresAt)
- claims.SetIssuedAt(issuedAt)
- _, err = server.tokenAuth.Sign(claims)
+ claims = make(map[string]any)
+ claims[claimUsernameKey] = user.Username
+ claims[claimPermissionsKey] = user.Filters.WebClient
+ claims[jwt.SubjectKey] = user.GetSignature()
+ claims[jwt.ExpirationKey] = time.Now().Add(1 * time.Minute)
+ claims[jwt.AudienceKey] = []string{tokenAudienceWebClient}
+ token, _, err = server.tokenAuth.Encode(claims)
assert.NoError(t, err)
req, _ = http.NewRequest(http.MethodGet, webClientFilesPath, nil)
req.RemoteAddr = "172.16.3.12:4567"
- ctx = jwt.NewContext(req.Context(), claims, nil)
+ ctx = jwtauth.NewContext(req.Context(), token, nil)
server.checkCookieExpiration(rr, req.WithContext(ctx))
cookie = rr.Header().Get("Set-Cookie")
assert.Empty(t, cookie)
req, _ = http.NewRequest(http.MethodGet, webClientFilesPath, nil)
req.RemoteAddr = "172.16.4.16:4567"
- ctx = jwt.NewContext(req.Context(), claims, nil)
+ ctx = jwtauth.NewContext(req.Context(), token, nil)
server.checkCookieExpiration(rr, req.WithContext(ctx))
cookie = rr.Header().Get("Set-Cookie")
assert.NotEmpty(t, cookie)
- req.Header.Set("Cookie", cookie)
- c, err = jwt.VerifyRequest(server.tokenAuth, req, jwt.TokenFromCookie)
- if assert.NoError(t, err) {
- assert.Equal(t, tokenID, c.ID)
- assert.Equal(t, issuedAt.Unix(), c.IssuedAt.Time().Unix())
- assert.NotEqual(t, expiresAt.Unix(), c.Expiry.Time().Unix())
- }
- // test a cookie issued more that 12 hours ago
- claims = jwt.NewClaims(tokenAudienceWebClient, "", getTokenDuration(tokenAudienceWebClient))
- claims.ID = tokenID
- claims.Username = user.Username
- claims.Permissions = user.Filters.WebClient
- claims.Subject = user.GetSignature()
- claims.SetExpiry(expiresAt)
- claims.SetIssuedAt(time.Now().Add(-24 * time.Hour))
- _, err = server.tokenAuth.Sign(claims)
- assert.NoError(t, err)
-
- rr = httptest.NewRecorder()
- req, _ = http.NewRequest(http.MethodGet, webClientFilesPath, nil)
- req.RemoteAddr = "172.16.4.16:6789"
- ctx = jwt.NewContext(req.Context(), claims, nil)
- server.checkCookieExpiration(rr, req.WithContext(ctx))
- cookie = rr.Header().Get("Set-Cookie")
- assert.Empty(t, cookie)
// test a disabled user
user.Status = 0
@@ -2080,19 +1748,18 @@ func TestCookieExpiration(t *testing.T) {
user, err = dataprovider.UserExists(user.Username, "")
assert.NoError(t, err)
- claims = jwt.NewClaims(tokenAudienceWebClient, "", getTokenDuration(tokenAudienceWebClient))
- claims.ID = tokenID
- claims.Username = user.Username
- claims.Permissions = user.Filters.WebClient
- claims.Subject = user.GetSignature()
- claims.SetExpiry(time.Now().Add(1 * time.Minute))
- claims.SetIssuedAt(issuedAt)
- _, err = server.tokenAuth.Sign(claims)
+ claims = make(map[string]any)
+ claims[claimUsernameKey] = user.Username
+ claims[claimPermissionsKey] = user.Filters.WebClient
+ claims[jwt.SubjectKey] = user.GetSignature()
+ claims[jwt.ExpirationKey] = time.Now().Add(1 * time.Minute)
+ claims[jwt.AudienceKey] = []string{tokenAudienceWebClient}
+ token, _, err = server.tokenAuth.Encode(claims)
assert.NoError(t, err)
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodGet, webClientFilesPath, nil)
- ctx = jwt.NewContext(req.Context(), claims, nil)
+ ctx = jwtauth.NewContext(req.Context(), token, nil)
server.checkCookieExpiration(rr, req.WithContext(ctx))
cookie = rr.Header().Get("Set-Cookie")
assert.Empty(t, cookie)
@@ -2122,7 +1789,6 @@ func TestChangePwdValidationErrors(t *testing.T) {
require.Error(t, err)
req, _ := http.NewRequest(http.MethodPut, adminPwdPath, nil)
- req = req.WithContext(jwt.NewContext(req.Context(), &jwt.Claims{Claims: josejwt.Claims{ID: xid.New().String()}}, nil))
err = doChangeAdminPassword(req, "currentpwd", "newpwd", "newpwd")
assert.Error(t, err)
}
@@ -2130,24 +1796,23 @@ func TestChangePwdValidationErrors(t *testing.T) {
func TestRenderUnexistingFolder(t *testing.T) {
rr := httptest.NewRecorder()
req, _ := http.NewRequest(http.MethodPost, folderPath, nil)
- renderFolder(rr, req, "path not mapped", &jwt.Claims{}, http.StatusOK)
+ renderFolder(rr, req, "path not mapped", &jwtTokenClaims{}, http.StatusOK)
assert.Equal(t, http.StatusNotFound, rr.Code)
}
func TestCloseConnectionHandler(t *testing.T) {
- tokenAuth, err := jwt.NewSigner(jose.HS256, util.GenerateRandomBytes(32))
- require.NoError(t, err)
- claims := jwt.NewClaims(tokenAudienceAPI, "", getTokenDuration(tokenAudienceAPI))
- claims.Username = defaultAdminUsername
- claims.SetExpiry(time.Now().UTC().Add(1 * time.Hour))
- _, err = tokenAuth.Sign(claims)
+ tokenAuth := jwtauth.New(jwa.HS256.String(), util.GenerateRandomBytes(32), nil)
+ claims := make(map[string]any)
+ claims["username"] = defaultAdminUsername
+ claims[jwt.ExpirationKey] = time.Now().UTC().Add(1 * time.Hour)
+ token, _, err := tokenAuth.Encode(claims)
assert.NoError(t, err)
req, err := http.NewRequest(http.MethodDelete, activeConnectionsPath+"/connectionID", nil)
assert.NoError(t, err)
rctx := chi.NewRouteContext()
rctx.URLParams.Add("connectionID", "")
req = req.WithContext(context.WithValue(req.Context(), chi.RouteCtxKey, rctx))
- req = req.WithContext(context.WithValue(req.Context(), jwt.TokenCtxKey, claims))
+ req = req.WithContext(context.WithValue(req.Context(), jwtauth.TokenCtxKey, token))
rr := httptest.NewRecorder()
handleCloseConnection(rr, req)
assert.Equal(t, http.StatusBadRequest, rr.Code)
@@ -2169,7 +1834,7 @@ func TestRenderInvalidTemplate(t *testing.T) {
}
func TestQuotaScanInvalidFs(t *testing.T) {
- user := &dataprovider.User{
+ user := dataprovider.User{
BaseUser: sdk.BaseUser{
Username: "test",
HomeDir: os.TempDir(),
@@ -2342,38 +2007,31 @@ func TestGetUserFromTemplate(t *testing.T) {
}
func TestJWTTokenCleanup(t *testing.T) {
- tokenAuth, err := jwt.NewSigner(jose.HS256, util.GenerateRandomBytes(32))
- require.NoError(t, err)
server := httpdServer{
- tokenAuth: tokenAuth,
+ tokenAuth: jwtauth.New(jwa.HS256.String(), util.GenerateRandomBytes(32), nil),
}
admin := dataprovider.Admin{
Username: "newtestadmin",
Password: "password",
Permissions: []string{dataprovider.PermAdminAny},
}
- claims := jwt.NewClaims(tokenAudienceAPI, "", getTokenDuration(tokenAudienceAPI))
- claims.Username = admin.Username
- claims.Permissions = admin.Permissions
- claims.Subject = admin.GetSignature()
- claims.SetExpiry(time.Now().Add(1 * time.Minute))
- token, err := server.tokenAuth.Sign(claims)
+ claims := make(map[string]any)
+ claims[claimUsernameKey] = admin.Username
+ claims[claimPermissionsKey] = admin.Permissions
+ claims[jwt.SubjectKey] = admin.GetSignature()
+ claims[jwt.ExpirationKey] = time.Now().Add(1 * time.Minute)
+ _, token, err := server.tokenAuth.Encode(claims)
assert.NoError(t, err)
req, _ := http.NewRequest(http.MethodGet, versionPath, nil)
assert.True(t, isTokenInvalidated(req))
- fakeToken := "abc"
- invalidateTokenString(req, fakeToken, -100*time.Millisecond)
- assert.True(t, invalidatedJWTTokens.Get(fakeToken))
+ req.Header.Set("Authorization", fmt.Sprintf("Bearer %v", token))
- req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
-
- invalidatedJWTTokens.Add(token, time.Now().Add(-getTokenDuration(tokenAudienceWebAdmin)).UTC())
+ invalidatedJWTTokens.Add(token, time.Now().Add(-tokenDuration).UTC())
require.True(t, isTokenInvalidated(req))
startCleanupTicker(100 * time.Millisecond)
assert.Eventually(t, func() bool { return !isTokenInvalidated(req) }, 1*time.Second, 200*time.Millisecond)
- assert.False(t, invalidatedJWTTokens.Get(fakeToken))
stopCleanupTicker()
}
@@ -2386,71 +2044,22 @@ func TestDbTokenManager(t *testing.T) {
testToken := "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOlsiV2ViQWRtaW4iLCI6OjEiXSwiZXhwIjoxNjk4NjYwMDM4LCJqdGkiOiJja3ZuazVrYjF1aHUzZXRmZmhyZyIsIm5iZiI6MTY5ODY1ODgwOCwicGVybWlzc2lvbnMiOlsiKiJdLCJzdWIiOiIxNjk3ODIwNDM3NTMyIiwidXNlcm5hbWUiOiJhZG1pbiJ9.LXuFFksvnSuzHqHat6r70yR0jEulNRju7m7SaWrOfy8; csrftoken=mP0C7DqjwpAXsptO2gGCaYBkYw3oNMWB"
key := dbTokenManager.getKey(testToken)
require.Len(t, key, 64)
- dbTokenManager.Add(testToken, time.Now().Add(-getTokenDuration(tokenAudienceWebClient)).UTC())
+ dbTokenManager.Add(testToken, time.Now().Add(-tokenDuration).UTC())
isInvalidated := dbTokenManager.Get(testToken)
assert.True(t, isInvalidated)
dbTokenManager.Cleanup()
isInvalidated = dbTokenManager.Get(testToken)
assert.False(t, isInvalidated)
- dbTokenManager.Add(testToken, time.Now().Add(getTokenDuration(tokenAudienceWebAdmin)).UTC())
+ dbTokenManager.Add(testToken, time.Now().Add(tokenDuration).UTC())
isInvalidated = dbTokenManager.Get(testToken)
assert.True(t, isInvalidated)
dbTokenManager.Cleanup()
isInvalidated = dbTokenManager.Get(testToken)
assert.True(t, isInvalidated)
- err := dataprovider.DeleteSharedSession(key, dataprovider.SessionTypeInvalidToken)
+ err := dataprovider.DeleteSharedSession(key)
assert.NoError(t, err)
}
-func TestDatabaseSharedSessions(t *testing.T) {
- if !isSharedProviderSupported() {
- t.Skip("this test it is not available with this provider")
- }
- session1 := dataprovider.Session{
- Key: "1",
- Data: map[string]string{"a": "b"},
- Type: dataprovider.SessionTypeOIDCAuth,
- Timestamp: 10,
- }
- err := dataprovider.AddSharedSession(session1)
- assert.NoError(t, err)
- // Adding another session with the same key but a different type should work
- session2 := session1
- session2.Type = dataprovider.SessionTypeOIDCToken
- err = dataprovider.AddSharedSession(session2)
- assert.NoError(t, err)
- err = dataprovider.DeleteSharedSession(session1.Key, dataprovider.SessionTypeInvalidToken)
- assert.ErrorIs(t, err, util.ErrNotFound)
- _, err = dataprovider.GetSharedSession(session1.Key, dataprovider.SessionTypeResetCode)
- assert.ErrorIs(t, err, util.ErrNotFound)
- session1Get, err := dataprovider.GetSharedSession(session1.Key, dataprovider.SessionTypeOIDCAuth)
- assert.NoError(t, err)
- assert.Equal(t, session1.Timestamp, session1Get.Timestamp)
- var stored map[string]string
- err = json.Unmarshal(session1Get.Data.([]byte), &stored)
- assert.NoError(t, err)
- assert.Equal(t, session1.Data, stored)
- session1.Timestamp = 20
- session1.Data = map[string]string{"c": "d"}
- err = dataprovider.AddSharedSession(session1)
- assert.NoError(t, err)
- session1Get, err = dataprovider.GetSharedSession(session1.Key, dataprovider.SessionTypeOIDCAuth)
- assert.NoError(t, err)
- assert.Equal(t, session1.Timestamp, session1Get.Timestamp)
- stored = make(map[string]string)
- err = json.Unmarshal(session1Get.Data.([]byte), &stored)
- assert.NoError(t, err)
- assert.Equal(t, session1.Data, stored)
- err = dataprovider.DeleteSharedSession(session1.Key, dataprovider.SessionTypeOIDCAuth)
- assert.NoError(t, err)
- err = dataprovider.DeleteSharedSession(session2.Key, dataprovider.SessionTypeOIDCToken)
- assert.NoError(t, err)
- _, err = dataprovider.GetSharedSession(session1.Key, dataprovider.SessionTypeOIDCAuth)
- assert.ErrorIs(t, err, util.ErrNotFound)
- _, err = dataprovider.GetSharedSession(session2.Key, dataprovider.SessionTypeOIDCToken)
- assert.ErrorIs(t, err, util.ErrNotFound)
-}
-
func TestAllowedProxyUnixDomainSocket(t *testing.T) {
b := Binding{
Address: filepath.Join(os.TempDir(), "sock"),
@@ -2463,15 +2072,6 @@ func TestAllowedProxyUnixDomainSocket(t *testing.T) {
}
}
-func TestProxyListenerWrapper(t *testing.T) {
- b := Binding{
- ProxyMode: 0,
- }
- require.Nil(t, b.listenerWrapper())
- b.ProxyMode = 1
- require.NotNil(t, b.listenerWrapper())
-}
-
func TestProxyHeaders(t *testing.T) {
username := "adminTest"
password := "testPwd"
@@ -2502,8 +2102,7 @@ func TestProxyHeaders(t *testing.T) {
err = b.parseAllowedProxy()
assert.NoError(t, err)
server := newHttpdServer(b, "", "", CorsConfig{Enabled: true}, "")
- err = server.initializeRouter()
- require.NoError(t, err)
+ server.initializeRouter()
testServer := httptest.NewServer(server.router)
defer testServer.Close()
@@ -2516,7 +2115,7 @@ func TestProxyHeaders(t *testing.T) {
rr := httptest.NewRecorder()
testServer.Config.Handler.ServeHTTP(rr, req)
assert.Equal(t, http.StatusUnauthorized, rr.Code)
- assert.NotContains(t, rr.Body.String(), "login from IP 127.0.0.1 not allowed")
+ assert.Contains(t, rr.Body.String(), "login from IP 127.0.0.1 not allowed")
req.RemoteAddr = testIP
rr = httptest.NewRecorder()
@@ -2528,95 +2127,34 @@ func TestProxyHeaders(t *testing.T) {
testServer.Config.Handler.ServeHTTP(rr, req)
assert.Equal(t, http.StatusOK, rr.Code)
- req, err = http.NewRequest(http.MethodGet, webAdminLoginPath, nil)
- assert.NoError(t, err)
- req.RemoteAddr = testIP
- rr = httptest.NewRecorder()
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
- cookie := rr.Header().Get("Set-Cookie")
- assert.NotEmpty(t, cookie)
- req.Header.Set("Cookie", cookie)
- parsedToken, err := jwt.VerifyRequest(server.csrfTokenAuth, req, jwt.TokenFromCookie)
- assert.NoError(t, err)
- ctx := req.Context()
- ctx = jwt.NewContext(ctx, parsedToken, err)
- req = req.WithContext(ctx)
-
form := make(url.Values)
form.Set("username", username)
form.Set("password", password)
- form.Set(csrfFormToken, createCSRFToken(httptest.NewRecorder(), req, server.csrfTokenAuth, "", webBaseAdminPath))
+ form.Set(csrfFormToken, createCSRFToken(testIP))
req, err = http.NewRequest(http.MethodPost, webAdminLoginPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = testIP
- req.Header.Set("Cookie", cookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
rr = httptest.NewRecorder()
testServer.Config.Handler.ServeHTTP(rr, req)
assert.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCredentials)
- req, err = http.NewRequest(http.MethodGet, webAdminLoginPath, nil)
- assert.NoError(t, err)
- req.RemoteAddr = validForwardedFor
- rr = httptest.NewRecorder()
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
- loginCookie := rr.Header().Get("Set-Cookie")
- assert.NotEmpty(t, loginCookie)
- req.Header.Set("Cookie", loginCookie)
- parsedToken, err = jwt.VerifyRequest(server.csrfTokenAuth, req, jwt.TokenFromCookie)
- assert.NoError(t, err)
- ctx = req.Context()
- ctx = jwt.NewContext(ctx, parsedToken, err)
- req = req.WithContext(ctx)
-
- form.Set(csrfFormToken, createCSRFToken(httptest.NewRecorder(), req, server.csrfTokenAuth, "", webBaseAdminPath))
+ form.Set(csrfFormToken, createCSRFToken(validForwardedFor))
req, err = http.NewRequest(http.MethodPost, webAdminLoginPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = testIP
- req.Header.Set("Cookie", loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
req.Header.Set("X-Forwarded-For", validForwardedFor)
rr = httptest.NewRecorder()
testServer.Config.Handler.ServeHTTP(rr, req)
assert.Equal(t, http.StatusFound, rr.Code, rr.Body.String())
- cookie = rr.Header().Get("Set-Cookie")
+ cookie := rr.Header().Get("Set-Cookie")
assert.NotContains(t, cookie, "Secure")
- // The login cookie is invalidated after a successful login, the same request will fail
req, err = http.NewRequest(http.MethodPost, webAdminLoginPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = testIP
- req.Header.Set("Cookie", loginCookie)
- req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
- req.Header.Set("X-Forwarded-For", validForwardedFor)
- rr = httptest.NewRecorder()
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
- assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidCSRF)
-
- req, err = http.NewRequest(http.MethodGet, webAdminLoginPath, nil)
- assert.NoError(t, err)
- req.RemoteAddr = validForwardedFor
- rr = httptest.NewRecorder()
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
- loginCookie = rr.Header().Get("Set-Cookie")
- assert.NotEmpty(t, loginCookie)
- req.Header.Set("Cookie", loginCookie)
- parsedToken, err = jwt.VerifyRequest(server.csrfTokenAuth, req, jwt.TokenFromCookie)
- assert.NoError(t, err)
- ctx = req.Context()
- ctx = jwt.NewContext(ctx, parsedToken, err)
- req = req.WithContext(ctx)
-
- form.Set(csrfFormToken, createCSRFToken(httptest.NewRecorder(), req, server.csrfTokenAuth, "", webBaseAdminPath))
- req, err = http.NewRequest(http.MethodPost, webAdminLoginPath, bytes.NewBuffer([]byte(form.Encode())))
- assert.NoError(t, err)
- req.RemoteAddr = testIP
- req.Header.Set("Cookie", loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
req.Header.Set("X-Forwarded-For", validForwardedFor)
req.Header.Set(xForwardedProto, "https")
@@ -2626,26 +2164,9 @@ func TestProxyHeaders(t *testing.T) {
cookie = rr.Header().Get("Set-Cookie")
assert.Contains(t, cookie, "Secure")
- req, err = http.NewRequest(http.MethodGet, webAdminLoginPath, nil)
- assert.NoError(t, err)
- req.RemoteAddr = validForwardedFor
- rr = httptest.NewRecorder()
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
- loginCookie = rr.Header().Get("Set-Cookie")
- assert.NotEmpty(t, loginCookie)
- req.Header.Set("Cookie", loginCookie)
- parsedToken, err = jwt.VerifyRequest(server.csrfTokenAuth, req, jwt.TokenFromCookie)
- assert.NoError(t, err)
- ctx = req.Context()
- ctx = jwt.NewContext(ctx, parsedToken, err)
- req = req.WithContext(ctx)
-
- form.Set(csrfFormToken, createCSRFToken(httptest.NewRecorder(), req, server.csrfTokenAuth, "", webBaseAdminPath))
req, err = http.NewRequest(http.MethodPost, webAdminLoginPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
req.RemoteAddr = testIP
- req.Header.Set("Cookie", loginCookie)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
req.Header.Set("X-Forwarded-For", validForwardedFor)
req.Header.Set(xForwardedProto, "http")
@@ -2669,8 +2190,7 @@ func TestRecoverer(t *testing.T) {
EnableRESTAPI: true,
}
server := newHttpdServer(b, "../static", "", CorsConfig{}, "../openapi")
- err := server.initializeRouter()
- require.NoError(t, err)
+ server.initializeRouter()
server.router.Get(recoveryPath, func(_ http.ResponseWriter, _ *http.Request) {
panic("panic")
})
@@ -2731,11 +2251,10 @@ func TestCompressorAbortHandler(t *testing.T) {
assert.Equal(t, http.ErrAbortHandler, rcv)
}()
- connection := newConnection(
- common.NewBaseConnection(xid.New().String(), common.ProtocolHTTP, "", "", dataprovider.User{}),
- nil,
- nil,
- )
+ connection := &Connection{
+ BaseConnection: common.NewBaseConnection(xid.New().String(), common.ProtocolHTTP, "", "", dataprovider.User{}),
+ request: nil,
+ }
share := &dataprovider.Share{}
renderCompressedFiles(&failingWriter{}, connection, "", nil, share)
}
@@ -2757,11 +2276,10 @@ func TestZipErrors(t *testing.T) {
}
user.Permissions = make(map[string][]string)
user.Permissions["/"] = []string{dataprovider.PermAny}
- connection := newConnection(
- common.NewBaseConnection(xid.New().String(), common.ProtocolHTTP, "", "", user),
- nil,
- nil,
- )
+ connection := &Connection{
+ BaseConnection: common.NewBaseConnection(xid.New().String(), common.ProtocolHTTP, "", "", user),
+ request: nil,
+ }
testDir := filepath.Join(os.TempDir(), "testDir")
err := os.MkdirAll(testDir, os.ModePerm)
@@ -2773,14 +2291,14 @@ func TestZipErrors(t *testing.T) {
assert.Contains(t, err.Error(), "write error")
}
- err = addZipEntry(wr, connection, "/"+filepath.Base(testDir), "/", nil, 0)
+ err = addZipEntry(wr, connection, "/"+filepath.Base(testDir), "/", 0)
if assert.Error(t, err) {
assert.Contains(t, err.Error(), "write error")
}
- err = addZipEntry(wr, connection, "/"+filepath.Base(testDir), "/", nil, 2000)
+ err = addZipEntry(wr, connection, "/"+filepath.Base(testDir), "/", 2000)
assert.ErrorIs(t, err, util.ErrRecursionTooDeep)
- err = addZipEntry(wr, connection, "/"+filepath.Base(testDir), path.Join("/", filepath.Base(testDir), "dir"), nil, 0)
+ err = addZipEntry(wr, connection, "/"+filepath.Base(testDir), path.Join("/", filepath.Base(testDir), "dir"), 0)
if assert.Error(t, err) {
assert.Contains(t, err.Error(), "is outside base dir")
}
@@ -2789,14 +2307,14 @@ func TestZipErrors(t *testing.T) {
err = os.WriteFile(testFilePath, util.GenerateRandomBytes(65535), os.ModePerm)
assert.NoError(t, err)
err = addZipEntry(wr, connection, path.Join("/", filepath.Base(testDir), filepath.Base(testFilePath)),
- "/"+filepath.Base(testDir), nil, 0)
+ "/"+filepath.Base(testDir), 0)
if assert.Error(t, err) {
assert.Contains(t, err.Error(), "write error")
}
connection.User.Permissions["/"] = []string{dataprovider.PermListItems}
err = addZipEntry(wr, connection, path.Join("/", filepath.Base(testDir), filepath.Base(testFilePath)),
- "/"+filepath.Base(testDir), nil, 0)
+ "/"+filepath.Base(testDir), 0)
assert.ErrorIs(t, err, os.ErrPermission)
// creating a virtual folder to a missing path stat is ok but readdir fails
@@ -2808,14 +2326,14 @@ func TestZipErrors(t *testing.T) {
})
connection.User = user
wr = zip.NewWriter(bytes.NewBuffer(make([]byte, 0)))
- err = addZipEntry(wr, connection, user.VirtualFolders[0].VirtualPath, "/", nil, 0)
+ err = addZipEntry(wr, connection, user.VirtualFolders[0].VirtualPath, "/", 0)
assert.Error(t, err)
user.Filters.FilePatterns = append(user.Filters.FilePatterns, sdk.PatternsFilter{
Path: "/",
DeniedPatterns: []string{"*.zip"},
})
- err = addZipEntry(wr, connection, "/"+filepath.Base(testDir), "/", nil, 0)
+ err = addZipEntry(wr, connection, "/"+filepath.Base(testDir), "/", 0)
assert.ErrorIs(t, err, os.ErrPermission)
err = os.RemoveAll(testDir)
@@ -2831,8 +2349,7 @@ func TestWebAdminRedirect(t *testing.T) {
EnableRESTAPI: true,
}
server := newHttpdServer(b, "../static", "", CorsConfig{}, "../openapi")
- err := server.initializeRouter()
- require.NoError(t, err)
+ server.initializeRouter()
testServer := httptest.NewServer(server.router)
defer testServer.Close()
@@ -2983,11 +2500,10 @@ func TestConnection(t *testing.T) {
}
user.Permissions = make(map[string][]string)
user.Permissions["/"] = []string{dataprovider.PermAny}
- connection := newConnection(
- common.NewBaseConnection(xid.New().String(), common.ProtocolHTTP, "", "", user),
- nil,
- nil,
- )
+ connection := &Connection{
+ BaseConnection: common.NewBaseConnection(xid.New().String(), common.ProtocolHTTP, "", "", user),
+ request: nil,
+ }
assert.Empty(t, connection.GetClientVersion())
assert.Empty(t, connection.GetRemoteAddress())
assert.Empty(t, connection.GetCommand())
@@ -3008,11 +2524,10 @@ func TestGetFileWriterErrors(t *testing.T) {
}
user.Permissions = make(map[string][]string)
user.Permissions["/"] = []string{dataprovider.PermAny}
- connection := newConnection(
- common.NewBaseConnection(xid.New().String(), common.ProtocolHTTP, "", "", user),
- nil,
- nil,
- )
+ connection := &Connection{
+ BaseConnection: common.NewBaseConnection(xid.New().String(), common.ProtocolHTTP, "", "", user),
+ request: nil,
+ }
_, err := connection.getFileWriter("name")
assert.Error(t, err)
@@ -3025,11 +2540,10 @@ func TestGetFileWriterErrors(t *testing.T) {
},
AccessSecret: kms.NewPlainSecret("secret"),
}
- connection = newConnection(
- common.NewBaseConnection(xid.New().String(), common.ProtocolHTTP, "", "", user),
- nil,
- nil,
- )
+ connection = &Connection{
+ BaseConnection: common.NewBaseConnection(xid.New().String(), common.ProtocolHTTP, "", "", user),
+ request: nil,
+ }
_, err = connection.getFileWriter("/path")
assert.Error(t, err)
}
@@ -3058,11 +2572,9 @@ func TestHTTPDFile(t *testing.T) {
}
user.Permissions = make(map[string][]string)
user.Permissions["/"] = []string{dataprovider.PermAny}
- connection := newConnection(
- common.NewBaseConnection(xid.New().String(), common.ProtocolHTTP, "", "", user),
- nil,
- nil,
- )
+ connection := &Connection{
+ BaseConnection: common.NewBaseConnection(xid.New().String(), common.ProtocolHTTP, "", "", user),
+ }
fs, err := user.GetFilesystem("")
assert.NoError(t, err)
@@ -3120,8 +2632,7 @@ func TestChangeUserPwd(t *testing.T) {
func TestWebUserInvalidClaims(t *testing.T) {
server := httpdServer{}
- err := server.initializeRouter()
- require.NoError(t, err)
+ server.initializeRouter()
rr := httptest.NewRecorder()
user := dataprovider.User{
@@ -3130,81 +2641,79 @@ func TestWebUserInvalidClaims(t *testing.T) {
Password: "pwd",
},
}
- c := &jwt.Claims{
+ c := jwtTokenClaims{
Username: user.Username,
Permissions: nil,
+ Signature: user.GetSignature(),
}
- c.Subject = user.GetSignature()
- c.SetExpiry(time.Now().Add(10 * time.Minute))
- c.Audience = []string{tokenAudienceAPI}
- token, err := server.tokenAuth.Sign(c)
+ token, err := c.createTokenResponse(server.tokenAuth, tokenAudienceWebClient, "")
assert.NoError(t, err)
req, _ := http.NewRequest(http.MethodGet, webClientFilesPath, nil)
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", token))
+ req.Header.Set("Cookie", fmt.Sprintf("jwt=%v", token["access_token"]))
server.handleClientGetFiles(rr, req)
assert.Equal(t, http.StatusForbidden, rr.Code)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidToken)
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodGet, webClientDirsPath, nil)
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", token))
+ req.Header.Set("Cookie", fmt.Sprintf("jwt=%v", token["access_token"]))
server.handleClientGetDirContents(rr, req)
assert.Equal(t, http.StatusForbidden, rr.Code)
assert.Contains(t, rr.Body.String(), util.I18nErrorDirList403)
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodGet, webClientDownloadZipPath, nil)
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", token))
+ req.Header.Set("Cookie", fmt.Sprintf("jwt=%v", token["access_token"]))
server.handleWebClientDownloadZip(rr, req)
assert.Equal(t, http.StatusForbidden, rr.Code)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidToken)
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodGet, webClientEditFilePath, nil)
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", token))
+ req.Header.Set("Cookie", fmt.Sprintf("jwt=%v", token["access_token"]))
server.handleClientEditFile(rr, req)
assert.Equal(t, http.StatusForbidden, rr.Code)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidToken)
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodGet, webClientSharePath, nil)
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", token))
+ req.Header.Set("Cookie", fmt.Sprintf("jwt=%v", token["access_token"]))
server.handleClientAddShareGet(rr, req)
assert.Equal(t, http.StatusForbidden, rr.Code)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidToken)
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodGet, webClientSharePath, nil)
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", token))
+ req.Header.Set("Cookie", fmt.Sprintf("jwt=%v", token["access_token"]))
server.handleClientUpdateShareGet(rr, req)
assert.Equal(t, http.StatusForbidden, rr.Code)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidToken)
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodPost, webClientSharePath, nil)
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", token))
+ req.Header.Set("Cookie", fmt.Sprintf("jwt=%v", token["access_token"]))
server.handleClientAddSharePost(rr, req)
assert.Equal(t, http.StatusForbidden, rr.Code)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidToken)
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodPost, webClientSharePath+"/id", nil)
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", token))
+ req.Header.Set("Cookie", fmt.Sprintf("jwt=%v", token["access_token"]))
server.handleClientUpdateSharePost(rr, req)
assert.Equal(t, http.StatusForbidden, rr.Code)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidToken)
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodGet, webClientSharesPath+jsonAPISuffix, nil)
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", token))
+ req.Header.Set("Cookie", fmt.Sprintf("jwt=%v", token["access_token"]))
getAllShares(rr, req)
assert.Equal(t, http.StatusForbidden, rr.Code)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidToken)
rr = httptest.NewRecorder()
req, _ = http.NewRequest(http.MethodGet, webClientViewPDFPath, nil)
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", token))
+ req.Header.Set("Cookie", fmt.Sprintf("jwt=%v", token["access_token"]))
server.handleClientGetPDF(rr, req)
assert.Equal(t, http.StatusForbidden, rr.Code)
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidToken)
@@ -3212,8 +2721,7 @@ func TestWebUserInvalidClaims(t *testing.T) {
func TestInvalidClaims(t *testing.T) {
server := httpdServer{}
- err := server.initializeRouter()
- require.NoError(t, err)
+ server.initializeRouter()
rr := httptest.NewRecorder()
user := dataprovider.User{
@@ -3222,31 +2730,19 @@ func TestInvalidClaims(t *testing.T) {
Password: "pwd",
},
}
- c := &jwt.Claims{
+ c := jwtTokenClaims{
Username: user.Username,
Permissions: nil,
+ Signature: user.GetSignature(),
}
- c.Subject = user.GetSignature()
- token, err := server.tokenAuth.SignWithParams(c, tokenAudienceWebClient, "", getTokenDuration(tokenAudienceWebClient))
+ token, err := c.createTokenResponse(server.tokenAuth, tokenAudienceWebClient, "")
assert.NoError(t, err)
-
- req, err := http.NewRequest(http.MethodGet, webClientProfilePath, nil)
- assert.NoError(t, err)
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", token))
- parsedToken, err := jwt.VerifyRequest(server.tokenAuth, req, jwt.TokenFromCookie)
- assert.NoError(t, err)
- ctx := req.Context()
- ctx = jwt.NewContext(ctx, parsedToken, err)
- req = req.WithContext(ctx)
-
form := make(url.Values)
- form.Set(csrfFormToken, createCSRFToken(rr, req, server.csrfTokenAuth, "", webBaseClientPath))
+ form.Set(csrfFormToken, createCSRFToken(""))
form.Set("public_keys", "")
- req, err = http.NewRequest(http.MethodPost, webClientProfilePath, bytes.NewBuffer([]byte(form.Encode())))
- assert.NoError(t, err)
- req = req.WithContext(ctx)
+ req, _ := http.NewRequest(http.MethodPost, webClientProfilePath, bytes.NewBuffer([]byte(form.Encode())))
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", token))
+ req.Header.Set("Cookie", fmt.Sprintf("jwt=%v", token["access_token"]))
server.handleWebClientProfilePost(rr, req)
assert.Equal(t, http.StatusForbidden, rr.Code)
@@ -3254,34 +2750,21 @@ func TestInvalidClaims(t *testing.T) {
Username: "",
Password: user.Password,
}
- c = &jwt.Claims{
+ c = jwtTokenClaims{
Username: admin.Username,
Permissions: nil,
+ Signature: admin.GetSignature(),
}
- c.Subject = admin.GetSignature()
- token, err = server.tokenAuth.SignWithParams(c, tokenAudienceWebAdmin, "", getTokenDuration(tokenAudienceWebAdmin))
+ token, err = c.createTokenResponse(server.tokenAuth, tokenAudienceWebAdmin, "")
assert.NoError(t, err)
-
- req, err = http.NewRequest(http.MethodGet, webAdminProfilePath, nil)
- assert.NoError(t, err)
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", token))
- parsedToken, err = jwt.VerifyRequest(server.tokenAuth, req, jwt.TokenFromCookie)
- assert.NoError(t, err)
- ctx = req.Context()
- ctx = jwt.NewContext(ctx, parsedToken, err)
- req = req.WithContext(ctx)
-
form = make(url.Values)
- form.Set(csrfFormToken, createCSRFToken(rr, req, server.csrfTokenAuth, "", webBaseAdminPath))
+ form.Set(csrfFormToken, createCSRFToken(""))
form.Set("allow_api_key_auth", "")
- req, err = http.NewRequest(http.MethodPost, webAdminProfilePath, bytes.NewBuffer([]byte(form.Encode())))
- assert.NoError(t, err)
- req = req.WithContext(ctx)
+ req, _ = http.NewRequest(http.MethodPost, webAdminProfilePath, bytes.NewBuffer([]byte(form.Encode())))
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", token))
+ req.Header.Set("Cookie", fmt.Sprintf("jwt=%v", token["access_token"]))
server.handleWebAdminProfilePost(rr, req)
assert.Equal(t, http.StatusForbidden, rr.Code)
- assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidToken)
}
func TestTLSReq(t *testing.T) {
@@ -3302,14 +2785,12 @@ func TestSigningKey(t *testing.T) {
server1 := httpdServer{
signingPassphrase: signingPassphrase,
}
- err := server1.initializeRouter()
- require.NoError(t, err)
+ server1.initializeRouter()
server2 := httpdServer{
signingPassphrase: signingPassphrase,
}
- err = server2.initializeRouter()
- require.NoError(t, err)
+ server2.initializeRouter()
user := dataprovider.User{
BaseUser: sdk.BaseUser{
@@ -3317,17 +2798,18 @@ func TestSigningKey(t *testing.T) {
Password: "pwd",
},
}
- c := &jwt.Claims{
+ c := jwtTokenClaims{
Username: user.Username,
Permissions: nil,
+ Signature: user.GetSignature(),
}
- c.Subject = user.GetSignature()
- token, err := server1.tokenAuth.SignWithParams(c, tokenAudienceWebClient, "", getTokenDuration(tokenAudienceWebClient))
+ token, err := c.createTokenResponse(server1.tokenAuth, tokenAudienceWebClient, "")
assert.NoError(t, err)
- assert.NotEmpty(t, token)
- _, err = jwt.VerifyToken(server1.tokenAuth, token)
+ accessToken := token["access_token"].(string)
+ assert.NotEmpty(t, accessToken)
+ _, err = server1.tokenAuth.Decode(accessToken)
assert.NoError(t, err)
- _, err = jwt.VerifyToken(server2.tokenAuth, token)
+ _, err = server2.tokenAuth.Decode(accessToken)
assert.NoError(t, err)
}
@@ -3456,15 +2938,11 @@ func TestSecureMiddlewareIntegration(t *testing.T) {
Value: "https",
},
},
- STSSeconds: 31536000,
- STSIncludeSubdomains: true,
- STSPreload: true,
- ContentTypeNosniff: true,
- CacheControl: "private",
- CrossOriginOpenerPolicy: "same-origin",
- CrossOriginResourcePolicy: "same-site",
- CrossOriginEmbedderPolicy: "require-corp",
- ReferrerPolicy: "no-referrer",
+ STSSeconds: 31536000,
+ STSIncludeSubdomains: true,
+ STSPreload: true,
+ ContentTypeNosniff: true,
+ CacheControl: "private",
},
},
enableWebAdmin: true,
@@ -3476,8 +2954,7 @@ func TestSecureMiddlewareIntegration(t *testing.T) {
assert.NoError(t, err)
assert.Equal(t, []string{forwardedHostHeader, xForwardedProto}, server.binding.Security.proxyHeaders)
assert.Equal(t, map[string]string{xForwardedProto: "https"}, server.binding.Security.getHTTPSProxyHeaders())
- err = server.initializeRouter()
- require.NoError(t, err)
+ server.initializeRouter()
rr := httptest.NewRecorder()
r, err := http.NewRequest(http.MethodGet, webClientLoginPath, nil)
@@ -3520,10 +2997,6 @@ func TestSecureMiddlewareIntegration(t *testing.T) {
assert.NotEmpty(t, r.Header.Get(forwardedHostHeader))
assert.Equal(t, "max-age=31536000; includeSubDomains; preload", rr.Header().Get("Strict-Transport-Security"))
assert.Equal(t, "nosniff", rr.Header().Get("X-Content-Type-Options"))
- assert.Equal(t, "require-corp", rr.Header().Get("Cross-Origin-Embedder-Policy"))
- assert.Equal(t, "same-origin", rr.Header().Get("Cross-Origin-Opener-Policy"))
- assert.Equal(t, "same-site", rr.Header().Get("Cross-Origin-Resource-Policy"))
- assert.Equal(t, "no-referrer", rr.Header().Get("Referrer-Policy"))
server.binding.Security.Enabled = false
server.binding.Security.updateProxyHeaders()
@@ -3553,8 +3026,7 @@ func TestRESTAPIDisabled(t *testing.T) {
enableWebClient: true,
enableRESTAPI: false,
}
- err := server.initializeRouter()
- require.NoError(t, err)
+ server.initializeRouter()
assert.False(t, server.enableRESTAPI)
rr := httptest.NewRecorder()
r, err := http.NewRequest(http.MethodGet, healthzPath, nil)
@@ -3591,34 +3063,26 @@ func TestWebAdminSetupWithInstallCode(t *testing.T) {
enableWebClient: true,
enableRESTAPI: true,
}
- err = server.initializeRouter()
- require.NoError(t, err)
-
- for _, webURL := range []string{"/", webBasePath, webBaseAdminPath, webAdminLoginPath, webClientLoginPath} {
- rr := httptest.NewRecorder()
- r, err := http.NewRequest(http.MethodGet, webURL, nil)
- assert.NoError(t, err)
- server.router.ServeHTTP(rr, r)
- assert.Equal(t, http.StatusFound, rr.Code)
- assert.Equal(t, webAdminSetupPath, rr.Header().Get("Location"))
- }
+ server.initializeRouter()
rr := httptest.NewRecorder()
r, err := http.NewRequest(http.MethodGet, webAdminSetupPath, nil)
assert.NoError(t, err)
server.router.ServeHTTP(rr, r)
assert.Equal(t, http.StatusOK, rr.Code)
- cookie := rr.Header().Get("Set-Cookie")
- r.Header.Set("Cookie", cookie)
- parsedToken, err := jwt.VerifyRequest(server.csrfTokenAuth, r, jwt.TokenFromCookie)
- assert.NoError(t, err)
- ctx := r.Context()
- ctx = jwt.NewContext(ctx, parsedToken, err)
- r = r.WithContext(ctx)
+
+ for _, webURL := range []string{"/", webBasePath, webBaseAdminPath, webAdminLoginPath, webClientLoginPath} {
+ rr = httptest.NewRecorder()
+ r, err = http.NewRequest(http.MethodGet, webURL, nil)
+ assert.NoError(t, err)
+ server.router.ServeHTTP(rr, r)
+ assert.Equal(t, http.StatusFound, rr.Code)
+ assert.Equal(t, webAdminSetupPath, rr.Header().Get("Location"))
+ }
form := make(url.Values)
- csrfToken := createCSRFToken(rr, r, server.csrfTokenAuth, "", webBaseAdminPath)
- form.Set(csrfFormToken, csrfToken)
+ csrfToken := createCSRFToken("")
+ form.Set("_form_token", csrfToken)
form.Set("install_code", installationCode+"5")
form.Set("username", defaultAdminUsername)
form.Set("password", "password")
@@ -3626,8 +3090,6 @@ func TestWebAdminSetupWithInstallCode(t *testing.T) {
rr = httptest.NewRecorder()
r, err = http.NewRequest(http.MethodPost, webAdminSetupPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
- r = r.WithContext(ctx)
- r.Header.Set("Cookie", cookie)
r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
server.router.ServeHTTP(rr, r)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -3639,8 +3101,6 @@ func TestWebAdminSetupWithInstallCode(t *testing.T) {
rr = httptest.NewRecorder()
r, err = http.NewRequest(http.MethodPost, webAdminSetupPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
- r = r.WithContext(ctx)
- r.Header.Set("Cookie", cookie)
r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
server.router.ServeHTTP(rr, r)
assert.Equal(t, http.StatusFound, rr.Code)
@@ -3662,6 +3122,12 @@ func TestWebAdminSetupWithInstallCode(t *testing.T) {
return "5678"
})
+ rr = httptest.NewRecorder()
+ r, err = http.NewRequest(http.MethodGet, webAdminSetupPath, nil)
+ assert.NoError(t, err)
+ server.router.ServeHTTP(rr, r)
+ assert.Equal(t, http.StatusOK, rr.Code)
+
for _, webURL := range []string{"/", webBasePath, webBaseAdminPath, webAdminLoginPath, webClientLoginPath} {
rr = httptest.NewRecorder()
r, err = http.NewRequest(http.MethodGet, webURL, nil)
@@ -3671,22 +3137,9 @@ func TestWebAdminSetupWithInstallCode(t *testing.T) {
assert.Equal(t, webAdminSetupPath, rr.Header().Get("Location"))
}
- rr = httptest.NewRecorder()
- r, err = http.NewRequest(http.MethodGet, webAdminSetupPath, nil)
- assert.NoError(t, err)
- server.router.ServeHTTP(rr, r)
- assert.Equal(t, http.StatusOK, rr.Code)
- cookie = rr.Header().Get("Set-Cookie")
- r.Header.Set("Cookie", cookie)
- parsedToken, err = jwt.VerifyRequest(server.csrfTokenAuth, r, jwt.TokenFromCookie)
- assert.NoError(t, err)
- ctx = r.Context()
- ctx = jwt.NewContext(ctx, parsedToken, err)
- r = r.WithContext(ctx)
-
form = make(url.Values)
- csrfToken = createCSRFToken(rr, r, server.csrfTokenAuth, "", webBaseAdminPath)
- form.Set(csrfFormToken, csrfToken)
+ csrfToken = createCSRFToken("")
+ form.Set("_form_token", csrfToken)
form.Set("install_code", installationCode)
form.Set("username", defaultAdminUsername)
form.Set("password", "password")
@@ -3694,8 +3147,6 @@ func TestWebAdminSetupWithInstallCode(t *testing.T) {
rr = httptest.NewRecorder()
r, err = http.NewRequest(http.MethodPost, webAdminSetupPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
- r = r.WithContext(ctx)
- r.Header.Set("Cookie", cookie)
r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
server.router.ServeHTTP(rr, r)
assert.Equal(t, http.StatusOK, rr.Code)
@@ -3707,8 +3158,6 @@ func TestWebAdminSetupWithInstallCode(t *testing.T) {
rr = httptest.NewRecorder()
r, err = http.NewRequest(http.MethodPost, webAdminSetupPath, bytes.NewBuffer([]byte(form.Encode())))
assert.NoError(t, err)
- r = r.WithContext(ctx)
- r.Header.Set("Cookie", cookie)
r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
server.router.ServeHTTP(rr, r)
assert.Equal(t, http.StatusFound, rr.Code)
@@ -3765,6 +3214,37 @@ func TestDbResetCodeManager(t *testing.T) {
}
}
+func TestDecodeToken(t *testing.T) {
+ nodeID := "nodeID"
+ token := map[string]any{
+ claimUsernameKey: defaultAdminUsername,
+ claimPermissionsKey: []string{dataprovider.PermAdminAny},
+ jwt.SubjectKey: "",
+ claimNodeID: nodeID,
+ claimMustChangePasswordKey: false,
+ claimMustSetSecondFactorKey: true,
+ }
+ c := jwtTokenClaims{}
+ c.Decode(token)
+ assert.Equal(t, defaultAdminUsername, c.Username)
+ assert.Equal(t, nodeID, c.NodeID)
+ assert.False(t, c.MustChangePassword)
+ assert.True(t, c.MustSetTwoFactorAuth)
+
+ token[claimMustChangePasswordKey] = 10
+ c = jwtTokenClaims{}
+ c.Decode(token)
+ assert.False(t, c.MustChangePassword)
+
+ token[claimMustChangePasswordKey] = true
+ c = jwtTokenClaims{}
+ c.Decode(token)
+ assert.True(t, c.MustChangePassword)
+
+ claims := c.asMap()
+ assert.Equal(t, token, claims)
+}
+
func TestEventRoleFilter(t *testing.T) {
defaultVal := "default"
req, err := http.NewRequest(http.MethodGet, fsEventsPath+"?role=role1", nil)
@@ -3895,8 +3375,7 @@ func TestHTTPSRedirect(t *testing.T) {
},
},
}
- err = server.initializeRouter()
- require.NoError(t, err)
+ server.initializeRouter()
rr := httptest.NewRecorder()
r, err := http.NewRequest(http.MethodGet, path.Join(acmeChallengeURI, tokenName), nil)
@@ -3935,118 +3414,6 @@ func TestHTTPSRedirect(t *testing.T) {
assert.NoError(t, err)
}
-func TestDisabledAdminLoginMethods(t *testing.T) {
- server := httpdServer{
- binding: Binding{
- Address: "",
- Port: 8080,
- EnableWebAdmin: true,
- EnableWebClient: true,
- EnableRESTAPI: true,
- DisabledLoginMethods: 20,
- },
- enableWebAdmin: true,
- enableWebClient: true,
- enableRESTAPI: true,
- }
- err := server.initializeRouter()
- require.NoError(t, err)
- testServer := httptest.NewServer(server.router)
- defer testServer.Close()
-
- rr := httptest.NewRecorder()
- req, err := http.NewRequest(http.MethodGet, tokenPath, nil)
- require.NoError(t, err)
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusNotFound, rr.Code)
-
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodPost, path.Join(adminPath, defaultAdminUsername, "forgot-password"), nil)
- require.NoError(t, err)
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusNotFound, rr.Code)
-
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodPost, path.Join(adminPath, defaultAdminUsername, "reset-password"), nil)
- require.NoError(t, err)
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusNotFound, rr.Code)
-
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodPost, webAdminLoginPath, nil)
- require.NoError(t, err)
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusMethodNotAllowed, rr.Code)
-
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodPost, webAdminResetPwdPath, nil)
- require.NoError(t, err)
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusNotFound, rr.Code)
-
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodPost, webAdminForgotPwdPath, nil)
- require.NoError(t, err)
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusNotFound, rr.Code)
-}
-
-func TestDisabledUserLoginMethods(t *testing.T) {
- server := httpdServer{
- binding: Binding{
- Address: "",
- Port: 8080,
- EnableWebAdmin: true,
- EnableWebClient: true,
- EnableRESTAPI: true,
- DisabledLoginMethods: 40,
- },
- enableWebAdmin: true,
- enableWebClient: true,
- enableRESTAPI: true,
- }
- err := server.initializeRouter()
- require.NoError(t, err)
- testServer := httptest.NewServer(server.router)
- defer testServer.Close()
-
- rr := httptest.NewRecorder()
- req, err := http.NewRequest(http.MethodGet, userTokenPath, nil)
- require.NoError(t, err)
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusNotFound, rr.Code)
-
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodPost, userPath+"/user/forgot-password", nil)
- require.NoError(t, err)
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusNotFound, rr.Code)
-
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodPost, userPath+"/user/reset-password", nil)
- require.NoError(t, err)
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusNotFound, rr.Code)
-
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodPost, webClientLoginPath, nil)
- require.NoError(t, err)
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusMethodNotAllowed, rr.Code)
-
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodPost, webClientResetPwdPath, nil)
- require.NoError(t, err)
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusNotFound, rr.Code)
-
- rr = httptest.NewRecorder()
- req, err = http.NewRequest(http.MethodPost, webClientForgotPwdPath, nil)
- require.NoError(t, err)
- testServer.Config.Handler.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusNotFound, rr.Code)
-}
-
func TestGetLogEventString(t *testing.T) {
assert.Equal(t, "Login failed", getLogEventString(notifier.LogEventTypeLoginFailed))
assert.Equal(t, "Login with non-existent user", getLogEventString(notifier.LogEventTypeLoginNoUser))
@@ -4214,153 +3581,6 @@ func TestI18NErrors(t *testing.T) {
assert.Equal(t, `{"a":"b"}`, errI18n.Args())
}
-func TestConvertEnabledLoginMethods(t *testing.T) {
- b := Binding{
- EnabledLoginMethods: 0,
- DisabledLoginMethods: 1,
- }
- b.convertLoginMethods()
- assert.Equal(t, 1, b.DisabledLoginMethods)
- b.DisabledLoginMethods = 0
- b.EnabledLoginMethods = 1
- b.convertLoginMethods()
- assert.Equal(t, 14, b.DisabledLoginMethods)
- b.DisabledLoginMethods = 0
- b.EnabledLoginMethods = 2
- b.convertLoginMethods()
- assert.Equal(t, 13, b.DisabledLoginMethods)
- b.DisabledLoginMethods = 0
- b.EnabledLoginMethods = 3
- b.convertLoginMethods()
- assert.Equal(t, 12, b.DisabledLoginMethods)
- b.DisabledLoginMethods = 0
- b.EnabledLoginMethods = 4
- b.convertLoginMethods()
- assert.Equal(t, 11, b.DisabledLoginMethods)
- b.DisabledLoginMethods = 0
- b.EnabledLoginMethods = 7
- b.convertLoginMethods()
- assert.Equal(t, 8, b.DisabledLoginMethods)
- b.DisabledLoginMethods = 0
- b.EnabledLoginMethods = 15
- b.convertLoginMethods()
- assert.Equal(t, 0, b.DisabledLoginMethods)
-}
-
-func TestValidateBaseURL(t *testing.T) {
- tests := []struct {
- name string
- inputURL string
- expectedURL string
- expectErr bool
- }{
- {
- name: "Valid HTTPS URL",
- inputURL: "https://sftp.example.com",
- expectedURL: "https://sftp.example.com",
- expectErr: false,
- },
- {
- name: "Remove trailing slash",
- inputURL: "https://sftp.example.com/",
- expectedURL: "https://sftp.example.com",
- expectErr: false,
- },
- {
- name: "Remove multiple trailing slashes",
- inputURL: "http://192.168.1.100:8080///",
- expectedURL: "http://192.168.1.100:8080",
- expectErr: false,
- },
- {
- name: "Empty BaseURL (optional case)",
- inputURL: "",
- expectedURL: "",
- expectErr: false,
- },
- {
- name: "Unsupported scheme (FTP)",
- inputURL: "ftp://files.example.com",
- expectErr: true,
- },
- {
- name: "Malformed URL string",
- inputURL: "not-a-url",
- expectErr: true,
- },
- {
- name: "Missing Host",
- inputURL: "https://",
- expectErr: true,
- },
- {
- name: "Preserve path without trailing slash",
- inputURL: "https://example.com/sftp/",
- expectedURL: "https://example.com/sftp",
- expectErr: false,
- },
- }
-
- for _, tt := range tests {
- t.Run(tt.name, func(t *testing.T) {
- b := &Binding{
- BaseURL: tt.inputURL,
- }
-
- err := b.validateBaseURL()
-
- if (err != nil) != tt.expectErr {
- t.Errorf("validateBaseURL() error = %v, expectErr %v", err, tt.expectErr)
- return
- }
-
- if !tt.expectErr && b.BaseURL != tt.expectedURL {
- t.Errorf("validateBaseURL() got = %v, want %v", b.BaseURL, tt.expectedURL)
- }
- })
- }
-}
-
-func getCSRFTokenFromBody(body io.Reader) (string, error) {
- doc, err := html.Parse(body)
- if err != nil {
- return "", err
- }
-
- var csrfToken string
- var f func(*html.Node)
-
- f = func(n *html.Node) {
- if n.Type == html.ElementNode && n.Data == "input" {
- var name, value string
- for _, attr := range n.Attr {
- if attr.Key == "value" {
- value = attr.Val
- }
- if attr.Key == "name" {
- name = attr.Val
- }
- }
- if name == csrfFormToken {
- csrfToken = value
- return
- }
- }
-
- for c := n.FirstChild; c != nil; c = c.NextSibling {
- f(c)
- }
- }
-
- f(doc)
-
- if csrfToken == "" {
- return "", errors.New("CSRF token not found")
- }
-
- return csrfToken, nil
-}
-
func isSharedProviderSupported() bool {
// SQLite shares the implementation with other SQL-based provider but it makes no sense
// to use it outside test cases
diff --git a/internal/httpd/middleware.go b/internal/httpd/middleware.go
index 199fa89f..2feea4ec 100644
--- a/internal/httpd/middleware.go
+++ b/internal/httpd/middleware.go
@@ -20,16 +20,15 @@ import (
"io/fs"
"net/http"
"net/url"
- "slices"
"strings"
- "time"
+ "github.com/go-chi/jwtauth/v5"
+ "github.com/lestrrat-go/jwx/v2/jwt"
"github.com/rs/xid"
"github.com/sftpgo/sdk"
"github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/logger"
"github.com/drakkan/sftpgo/v2/internal/util"
)
@@ -48,7 +47,7 @@ func (k *contextKey) String() string {
}
func validateJWTToken(w http.ResponseWriter, r *http.Request, audience tokenAudience) error {
- token, err := jwt.FromContext(r.Context())
+ token, _, err := jwtauth.FromContext(r.Context())
var redirectPath string
if audience == tokenAudienceWebAdmin {
@@ -70,48 +69,52 @@ func validateJWTToken(w http.ResponseWriter, r *http.Request, audience tokenAudi
}
}
- if err != nil {
+ if err != nil || token == nil {
logger.Debug(logSender, "", "error getting jwt token: %v", err)
doRedirect(http.StatusText(http.StatusUnauthorized), err)
return errInvalidToken
}
+ err = jwt.Validate(token)
+ if err != nil {
+ logger.Debug(logSender, "", "error validating jwt token: %v", err)
+ doRedirect(http.StatusText(http.StatusUnauthorized), err)
+ return errInvalidToken
+ }
if isTokenInvalidated(r) {
logger.Debug(logSender, "", "the token has been invalidated")
doRedirect("Your token is no longer valid", nil)
return errInvalidToken
}
// a user with a partial token will be always redirected to the appropriate two factor auth page
- if err := checkPartialAuth(w, r, audience, token.Audience); err != nil {
+ if err := checkPartialAuth(w, r, audience, token.Audience()); err != nil {
return err
}
- if !token.Audience.Contains(audience) {
+ if !util.Contains(token.Audience(), audience) {
logger.Debug(logSender, "", "the token is not valid for audience %q", audience)
doRedirect("Your token audience is not valid", nil)
return errInvalidToken
}
- ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := validateIPForToken(token, ipAddr); err != nil {
- logger.Debug(logSender, "", "the token with id %q is not valid for the ip address %q", token.ID, ipAddr)
- doRedirect("Your token is not valid", nil)
- return err
- }
- if err := checkTokenSignature(r, token); err != nil {
- doRedirect("Your token is no longer valid", nil)
- return err
+ if tokenValidationMode != tokenValidationNoIPMatch {
+ ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
+ if !util.Contains(token.Audience(), ipAddr) {
+ logger.Debug(logSender, "", "the token with id %q is not valid for the ip address %q", token.JwtID(), ipAddr)
+ doRedirect("Your token is not valid", nil)
+ return errInvalidToken
+ }
}
return nil
}
func (s *httpdServer) validateJWTPartialToken(w http.ResponseWriter, r *http.Request, audience tokenAudience) error {
- token, err := jwt.FromContext(r.Context())
+ token, _, err := jwtauth.FromContext(r.Context())
var notFoundFunc func(w http.ResponseWriter, r *http.Request, err error)
if audience == tokenAudienceWebAdminPartial {
notFoundFunc = s.renderNotFoundPage
} else {
notFoundFunc = s.renderClientNotFoundPage
}
- if err != nil {
+ if err != nil || token == nil || jwt.Validate(token) != nil {
notFoundFunc(w, r, nil)
return errInvalidToken
}
@@ -119,17 +122,11 @@ func (s *httpdServer) validateJWTPartialToken(w http.ResponseWriter, r *http.Req
notFoundFunc(w, r, nil)
return errInvalidToken
}
- if !token.Audience.Contains(audience) {
- logger.Debug(logSender, "", "the partial token with id %q is not valid for audience %q", token.ID, audience)
+ if !util.Contains(token.Audience(), audience) {
+ logger.Debug(logSender, "", "the token is not valid for audience %q", audience)
notFoundFunc(w, r, nil)
return errInvalidToken
}
- ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := validateIPForToken(token, ipAddr); err != nil {
- logger.Debug(logSender, "", "the partial token with id %q is not valid for the ip address %q", token.ID, ipAddr)
- notFoundFunc(w, r, nil)
- return err
- }
return nil
}
@@ -194,7 +191,7 @@ func jwtAuthenticatorWebClient(next http.Handler) http.Handler {
func (s *httpdServer) checkHTTPUserPerm(perm string) func(next http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
- claims, err := jwt.FromContext(r.Context())
+ _, claims, err := jwtauth.FromContext(r.Context())
if err != nil {
if isWebRequest(r) {
s.renderClientBadRequestPage(w, r, err)
@@ -203,8 +200,10 @@ func (s *httpdServer) checkHTTPUserPerm(perm string) func(next http.Handler) htt
}
return
}
+ tokenClaims := jwtTokenClaims{}
+ tokenClaims.Decode(claims)
// for web client perms are negated and not granted
- if claims.HasPerm(perm) {
+ if tokenClaims.hasPerm(perm) {
if isWebRequest(r) {
s.renderClientForbiddenPage(w, r, errors.New("you don't have permission for this action"))
} else {
@@ -221,7 +220,7 @@ func (s *httpdServer) checkHTTPUserPerm(perm string) func(next http.Handler) htt
// checkAuthRequirements checks if the user must set a second factor auth or change the password
func (s *httpdServer) checkAuthRequirements(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
- claims, err := jwt.FromContext(r.Context())
+ _, claims, err := jwtauth.FromContext(r.Context())
if err != nil {
if isWebRequest(r) {
if isWebClientRequest(r) {
@@ -234,11 +233,13 @@ func (s *httpdServer) checkAuthRequirements(next http.Handler) http.Handler {
}
return
}
- if claims.MustSetTwoFactorAuth || claims.MustChangePassword {
+ tokenClaims := jwtTokenClaims{}
+ tokenClaims.Decode(claims)
+ if tokenClaims.MustSetTwoFactorAuth || tokenClaims.MustChangePassword {
var err error
- if claims.MustSetTwoFactorAuth {
- if len(claims.RequiredTwoFactorProtocols) > 0 {
- protocols := strings.Join(claims.RequiredTwoFactorProtocols, ", ")
+ if tokenClaims.MustSetTwoFactorAuth {
+ if len(tokenClaims.RequiredTwoFactorProtocols) > 0 {
+ protocols := strings.Join(tokenClaims.RequiredTwoFactorProtocols, ", ")
err = util.NewI18nError(
util.NewGenericError(
fmt.Sprintf("Two-factor authentication requirements not met, please configure two-factor authentication for the following protocols: %v",
@@ -294,10 +295,10 @@ func (s *httpdServer) requireBuiltinLogin(next http.Handler) http.Handler {
})
}
-func (s *httpdServer) checkPerms(perms ...string) func(next http.Handler) http.Handler {
+func (s *httpdServer) checkPerm(perm string) func(next http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
- claims, err := jwt.FromContext(r.Context())
+ _, claims, err := jwtauth.FromContext(r.Context())
if err != nil {
if isWebRequest(r) {
s.renderBadRequestPage(w, r, err)
@@ -306,16 +307,16 @@ func (s *httpdServer) checkPerms(perms ...string) func(next http.Handler) http.H
}
return
}
+ tokenClaims := jwtTokenClaims{}
+ tokenClaims.Decode(claims)
- for _, perm := range perms {
- if !claims.HasPerm(perm) {
- if isWebRequest(r) {
- s.renderForbiddenPage(w, r, util.NewI18nError(fs.ErrPermission, util.I18nError403Message))
- } else {
- sendAPIResponse(w, r, nil, http.StatusText(http.StatusForbidden), http.StatusForbidden)
- }
- return
+ if !tokenClaims.hasPerm(perm) {
+ if isWebRequest(r) {
+ s.renderForbiddenPage(w, r, util.NewI18nError(fs.ErrPermission, util.I18nError403Message))
+ } else {
+ sendAPIResponse(w, r, nil, http.StatusText(http.StatusForbidden), http.StatusForbidden)
}
+ return
}
next.ServeHTTP(w, r)
@@ -323,82 +324,70 @@ func (s *httpdServer) checkPerms(perms ...string) func(next http.Handler) http.H
}
}
-func (s *httpdServer) verifyCSRFHeader(next http.Handler) http.Handler {
+func verifyCSRFHeader(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
tokenString := r.Header.Get(csrfHeaderToken)
- token, err := jwt.VerifyToken(s.csrfTokenAuth, tokenString)
+ token, err := jwtauth.VerifyToken(csrfTokenAuth, tokenString)
if err != nil || token == nil {
logger.Debug(logSender, "", "error validating CSRF header: %v", err)
sendAPIResponse(w, r, err, "Invalid token", http.StatusForbidden)
return
}
- if !token.Audience.Contains(tokenAudienceCSRF) {
+ if !util.Contains(token.Audience(), tokenAudienceCSRF) {
logger.Debug(logSender, "", "error validating CSRF header token audience")
sendAPIResponse(w, r, errors.New("the token is not valid"), "", http.StatusForbidden)
return
}
- if err := validateIPForToken(token, util.GetIPFromRemoteAddress(r.RemoteAddr)); err != nil {
- logger.Debug(logSender, "", "error validating CSRF header IP audience")
- sendAPIResponse(w, r, errors.New("the token is not valid"), "", http.StatusForbidden)
- return
- }
- if err := checkCSRFTokenRef(r, token); err != nil {
- sendAPIResponse(w, r, errors.New("the token is not valid"), "", http.StatusForbidden)
- return
+ if tokenValidationMode != tokenValidationNoIPMatch {
+ if !util.Contains(token.Audience(), util.GetIPFromRemoteAddress(r.RemoteAddr)) {
+ logger.Debug(logSender, "", "error validating CSRF header IP audience")
+ sendAPIResponse(w, r, errors.New("the token is not valid"), "", http.StatusForbidden)
+ return
+ }
}
next.ServeHTTP(w, r)
})
}
-func checkNodeToken(tokenAuth *jwt.Signer) func(next http.Handler) http.Handler {
+func checkNodeToken(tokenAuth *jwtauth.JWTAuth) func(next http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
- bearer := r.Header.Get(dataprovider.NodeTokenHeader)
- if bearer == "" {
+ token := r.Header.Get(dataprovider.NodeTokenHeader)
+ if token == "" {
next.ServeHTTP(w, r)
return
}
- const prefix = "Bearer "
- if len(bearer) >= len(prefix) && strings.EqualFold(bearer[:len(prefix)], prefix) {
- bearer = bearer[len(prefix):]
+ if len(token) > 7 && strings.ToUpper(token[0:6]) == "BEARER" {
+ token = token[7:]
}
- if invalidatedJWTTokens.Get(bearer) {
- logger.Debug(logSender, "", "the node token has been invalidated")
- sendAPIResponse(w, r, fmt.Errorf("the provided token is not valid"), "", http.StatusUnauthorized)
- return
- }
- claims, err := dataprovider.AuthenticateNodeToken(bearer)
+ admin, role, err := dataprovider.AuthenticateNodeToken(token)
if err != nil {
- logger.Debug(logSender, "", "unable to authenticate node token %q: %v", bearer, err)
+ logger.Debug(logSender, "", "unable to authenticate node token %q: %v", token, err)
sendAPIResponse(w, r, fmt.Errorf("the provided token cannot be authenticated"), "", http.StatusUnauthorized)
return
}
- defer invalidatedJWTTokens.Add(bearer, time.Now().Add(2*time.Minute).UTC())
-
- c := &jwt.Claims{
- Username: claims.Username,
- Permissions: claims.Permissions,
+ c := jwtTokenClaims{
+ Username: admin,
+ Permissions: []string{dataprovider.PermAdminViewConnections, dataprovider.PermAdminCloseConnections},
NodeID: dataprovider.GetNodeName(),
- Role: claims.Role,
+ Role: role,
}
-
- token, err := tokenAuth.SignWithParams(c, tokenAudienceAPI, util.GetIPFromRemoteAddress(r.RemoteAddr), getTokenDuration(tokenAudienceAPI))
+ resp, err := c.createTokenResponse(tokenAuth, tokenAudienceAPI, util.GetIPFromRemoteAddress(r.RemoteAddr))
if err != nil {
sendAPIResponse(w, r, err, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
return
}
- resp := c.BuildTokenResponse(token)
- r.Header.Set("Authorization", fmt.Sprintf("Bearer %s", resp.Token))
+ r.Header.Set("Authorization", fmt.Sprintf("Bearer %v", resp["access_token"]))
next.ServeHTTP(w, r)
})
}
}
-func checkAPIKeyAuth(tokenAuth *jwt.Signer, scope dataprovider.APIKeyScope) func(next http.Handler) http.Handler {
+func checkAPIKeyAuth(tokenAuth *jwtauth.JWTAuth, scope dataprovider.APIKeyScope) func(next http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
apiKey := r.Header.Get("X-SFTPGO-API-KEY")
@@ -422,7 +411,7 @@ func checkAPIKeyAuth(tokenAuth *jwt.Signer, scope dataprovider.APIKeyScope) func
k, err := dataprovider.APIKeyExists(keyID)
if err != nil {
handleDefenderEventLoginFailed(util.GetIPFromRemoteAddress(r.RemoteAddr), util.NewRecordNotFoundError("invalid api key")) //nolint:errcheck
- logger.Debug(logSender, "", "invalid api key %q: %v", apiKey, err)
+ logger.Debug(logSender, "invalid api key %q: %v", apiKey, err)
sendAPIResponse(w, r, errors.New("the provided api key is not valid"), "", http.StatusBadRequest)
return
}
@@ -460,7 +449,7 @@ func checkAPIKeyAuth(tokenAuth *jwt.Signer, scope dataprovider.APIKeyScope) func
logger.Debug(logSender, "", "unable to authenticate user %q associated with api key %q: %v",
apiUser, apiKey, err)
updateLoginMetrics(&dataprovider.User{BaseUser: sdk.BaseUser{Username: apiUser}},
- dataprovider.LoginMethodPassword, util.GetIPFromRemoteAddress(r.RemoteAddr), err, r)
+ dataprovider.LoginMethodPassword, util.GetIPFromRemoteAddress(r.RemoteAddr), err)
code := http.StatusUnauthorized
if errors.Is(err, common.ErrInternalFailure) {
code = http.StatusInternalServerError
@@ -470,7 +459,7 @@ func checkAPIKeyAuth(tokenAuth *jwt.Signer, scope dataprovider.APIKeyScope) func
return
}
updateLoginMetrics(&dataprovider.User{BaseUser: sdk.BaseUser{Username: apiUser}},
- dataprovider.LoginMethodPassword, util.GetIPFromRemoteAddress(r.RemoteAddr), nil, r)
+ dataprovider.LoginMethodPassword, util.GetIPFromRemoteAddress(r.RemoteAddr), nil)
}
dataprovider.UpdateAPIKeyLastUse(&k) //nolint:errcheck
@@ -481,7 +470,7 @@ func checkAPIKeyAuth(tokenAuth *jwt.Signer, scope dataprovider.APIKeyScope) func
func forbidAPIKeyAuthentication(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
@@ -495,7 +484,7 @@ func forbidAPIKeyAuthentication(next http.Handler) http.Handler {
})
}
-func authenticateAdminWithAPIKey(username, keyID string, tokenAuth *jwt.Signer, r *http.Request) error {
+func authenticateAdminWithAPIKey(username, keyID string, tokenAuth *jwtauth.JWTAuth, r *http.Request) error {
if username == "" {
return errors.New("the provided key is not associated with any admin and no username was provided")
}
@@ -510,32 +499,31 @@ func authenticateAdminWithAPIKey(username, keyID string, tokenAuth *jwt.Signer,
if err := admin.CanLogin(ipAddr); err != nil {
return err
}
- c := &jwt.Claims{
+ c := jwtTokenClaims{
Username: admin.Username,
Permissions: admin.Permissions,
+ Signature: admin.GetSignature(),
Role: admin.Role,
APIKeyID: keyID,
}
- c.Subject = admin.GetSignature()
- token, err := tokenAuth.SignWithParams(c, tokenAudienceAPI, ipAddr, getTokenDuration(tokenAudienceAPI))
+ resp, err := c.createTokenResponse(tokenAuth, tokenAudienceAPI, ipAddr)
if err != nil {
return err
}
- resp := c.BuildTokenResponse(token)
- r.Header.Set("Authorization", fmt.Sprintf("Bearer %s", resp.Token))
+ r.Header.Set("Authorization", fmt.Sprintf("Bearer %v", resp["access_token"]))
dataprovider.UpdateAdminLastLogin(&admin)
common.DelayLogin(nil)
return nil
}
-func authenticateUserWithAPIKey(username, keyID string, tokenAuth *jwt.Signer, r *http.Request) error {
+func authenticateUserWithAPIKey(username, keyID string, tokenAuth *jwtauth.JWTAuth, r *http.Request) error {
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
protocol := common.ProtocolHTTP
if username == "" {
err := errors.New("the provided key is not associated with any user and no username was provided")
updateLoginMetrics(&dataprovider.User{BaseUser: sdk.BaseUser{Username: username}},
- dataprovider.LoginMethodPassword, ipAddr, err, r)
+ dataprovider.LoginMethodPassword, ipAddr, err)
return err
}
if err := common.Config.ExecutePostConnectHook(ipAddr, protocol); err != nil {
@@ -544,56 +532,55 @@ func authenticateUserWithAPIKey(username, keyID string, tokenAuth *jwt.Signer, r
user, err := dataprovider.GetUserWithGroupSettings(username, "")
if err != nil {
updateLoginMetrics(&dataprovider.User{BaseUser: sdk.BaseUser{Username: username}},
- dataprovider.LoginMethodPassword, ipAddr, err, r)
+ dataprovider.LoginMethodPassword, ipAddr, err)
return err
}
if !user.Filters.AllowAPIKeyAuth {
err := fmt.Errorf("API key authentication disabled for user %q", user.Username)
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, err, r)
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, err)
return err
}
if err := user.CheckLoginConditions(); err != nil {
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, err, r)
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, err)
return err
}
connectionID := fmt.Sprintf("%v_%v", protocol, xid.New().String())
- if err := checkHTTPClientUser(&user, r, connectionID, true, false); err != nil {
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, err, r)
+ if err := checkHTTPClientUser(&user, r, connectionID, true); err != nil {
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, err)
return err
}
defer user.CloseFs() //nolint:errcheck
err = user.CheckFsRoot(connectionID)
if err != nil {
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, common.ErrInternalFailure, r)
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, common.ErrInternalFailure)
return common.ErrInternalFailure
}
- c := &jwt.Claims{
+ c := jwtTokenClaims{
Username: user.Username,
Permissions: user.Filters.WebClient,
+ Signature: user.GetSignature(),
Role: user.Role,
APIKeyID: keyID,
}
- c.Subject = user.GetSignature()
- token, err := tokenAuth.SignWithParams(c, tokenAudienceAPIUser, ipAddr, getTokenDuration(tokenAudienceAPIUser))
+ resp, err := c.createTokenResponse(tokenAuth, tokenAudienceAPIUser, ipAddr)
if err != nil {
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, common.ErrInternalFailure, r)
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, common.ErrInternalFailure)
return err
}
- resp := c.BuildTokenResponse(token)
- r.Header.Set("Authorization", fmt.Sprintf("Bearer %s", resp.Token))
+ r.Header.Set("Authorization", fmt.Sprintf("Bearer %v", resp["access_token"]))
dataprovider.UpdateLastLogin(&user)
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, nil, r)
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, nil)
return nil
}
func checkPartialAuth(w http.ResponseWriter, r *http.Request, audience string, tokenAudience []string) error {
- if audience == tokenAudienceWebAdmin && slices.Contains(tokenAudience, tokenAudienceWebAdminPartial) {
+ if audience == tokenAudienceWebAdmin && util.Contains(tokenAudience, tokenAudienceWebAdminPartial) {
http.Redirect(w, r, webAdminTwoFactorPath, http.StatusFound)
return errInvalidToken
}
- if audience == tokenAudienceWebClient && slices.Contains(tokenAudience, tokenAudienceWebClientPartial) {
+ if audience == tokenAudienceWebClient && util.Contains(tokenAudience, tokenAudienceWebClientPartial) {
http.Redirect(w, r, webClientTwoFactorPath, http.StatusFound)
return errInvalidToken
}
diff --git a/internal/httpd/oauth2.go b/internal/httpd/oauth2.go
index bb3e7806..88a599d3 100644
--- a/internal/httpd/oauth2.go
+++ b/internal/httpd/oauth2.go
@@ -20,8 +20,6 @@ import (
"sync"
"time"
- "golang.org/x/oauth2"
-
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
"github.com/drakkan/sftpgo/v2/internal/kms"
"github.com/drakkan/sftpgo/v2/internal/logger"
@@ -50,7 +48,6 @@ type oauth2PendingAuth struct {
ClientSecret *kms.Secret `json:"client_secret"`
RedirectURL string `json:"redirect_url"`
IssuedAt int64 `json:"issued_at"`
- Verifier string `json:"verifier"`
}
func newOAuth2PendingAuth(provider int, redirectURL, clientID string, clientSecret *kms.Secret) oauth2PendingAuth {
@@ -61,7 +58,6 @@ func newOAuth2PendingAuth(provider int, redirectURL, clientID string, clientSecr
ClientSecret: clientSecret,
RedirectURL: redirectURL,
IssuedAt: util.GetTimeAsMsSinceEpoch(time.Now()),
- Verifier: oauth2.GenerateVerifier(),
}
}
@@ -136,11 +132,11 @@ func (o *dbOAuth2Manager) addPendingAuth(pendingAuth oauth2PendingAuth) {
}
func (o *dbOAuth2Manager) removePendingAuth(state string) {
- dataprovider.DeleteSharedSession(state, dataprovider.SessionTypeOAuth2Auth) //nolint:errcheck
+ dataprovider.DeleteSharedSession(state) //nolint:errcheck
}
func (o *dbOAuth2Manager) getPendingAuth(state string) (oauth2PendingAuth, error) {
- session, err := dataprovider.GetSharedSession(state, dataprovider.SessionTypeOAuth2Auth)
+ session, err := dataprovider.GetSharedSession(state)
if err != nil {
return oauth2PendingAuth{}, errors.New("oauth2: unable to get the auth request for the specified state")
}
diff --git a/internal/httpd/oauth2_test.go b/internal/httpd/oauth2_test.go
index 0e488136..a676905d 100644
--- a/internal/httpd/oauth2_test.go
+++ b/internal/httpd/oauth2_test.go
@@ -86,7 +86,7 @@ func TestDbOAuth2Manager(t *testing.T) {
a, err := m.getPendingAuth(auth.State)
assert.NoError(t, err)
assert.Equal(t, sdkkms.SecretStatusPlain, a.ClientSecret.GetStatus())
- session, err := dataprovider.GetSharedSession(auth.State, dataprovider.SessionTypeOAuth2Auth)
+ session, err := dataprovider.GetSharedSession(auth.State)
assert.NoError(t, err)
authReq := oauth2PendingAuth{}
err = json.Unmarshal(session.Data.([]byte), &authReq)
@@ -107,10 +107,10 @@ func TestDbOAuth2Manager(t *testing.T) {
m.addPendingAuth(auth)
_, err = m.getPendingAuth(auth.State)
assert.Error(t, err)
- _, err = dataprovider.GetSharedSession(auth.State, dataprovider.SessionTypeOAuth2Auth)
+ _, err = dataprovider.GetSharedSession(auth.State)
assert.NoError(t, err)
m.cleanup()
- _, err = dataprovider.GetSharedSession(auth.State, dataprovider.SessionTypeOAuth2Auth)
+ _, err = dataprovider.GetSharedSession(auth.State)
assert.Error(t, err)
_, err = m.decodePendingAuthData("not a byte array")
require.Error(t, err)
@@ -126,7 +126,7 @@ func TestDbOAuth2Manager(t *testing.T) {
}
auth.ClientSecret.SetStatus(sdkkms.SecretStatusSecretBox)
m.addPendingAuth(auth)
- _, err = dataprovider.GetSharedSession(auth.State, dataprovider.SessionTypeOAuth2Auth)
+ _, err = dataprovider.GetSharedSession(auth.State)
assert.Error(t, err)
asJSON, err := json.Marshal(auth)
assert.NoError(t, err)
diff --git a/internal/httpd/oidc.go b/internal/httpd/oidc.go
index 7c43fac5..93068387 100644
--- a/internal/httpd/oidc.go
+++ b/internal/httpd/oidc.go
@@ -20,7 +20,6 @@ import (
"fmt"
"net/http"
"net/url"
- "slices"
"strings"
"time"
@@ -31,7 +30,6 @@ import (
"github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
"github.com/drakkan/sftpgo/v2/internal/httpclient"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/logger"
"github.com/drakkan/sftpgo/v2/internal/util"
)
@@ -39,7 +37,7 @@ import (
const (
oidcCookieKey = "oidc"
adminRoleFieldValue = "admin"
- authStateValidity = 2 * 60 * 1000 // 2 minutes
+ authStateValidity = 1 * 60 * 1000 // 1 minute
tokenUpdateInterval = 3 * 60 * 1000 // 3 minutes
tokenDeleteInterval = 2 * 3600 * 1000 // 2 hours
)
@@ -144,7 +142,7 @@ func (o *OIDC) initialize() error {
if o.RedirectBaseURL == "" {
return errors.New("oidc: redirect base URL cannot be empty")
}
- if !slices.Contains(o.Scopes, oidc.ScopeOpenID) {
+ if !util.Contains(o.Scopes, oidc.ScopeOpenID) {
return fmt.Errorf("oidc: required scope %q is not set", oidc.ScopeOpenID)
}
if o.ClientSecretFile != "" {
@@ -200,7 +198,6 @@ type oidcPendingAuth struct {
Nonce string `json:"nonce"`
Audience tokenAudience `json:"audience"`
IssuedAt int64 `json:"issued_at"`
- Verifier string `json:"verifier"`
}
func newOIDCPendingAuth(audience tokenAudience) oidcPendingAuth {
@@ -209,29 +206,25 @@ func newOIDCPendingAuth(audience tokenAudience) oidcPendingAuth {
Nonce: util.GenerateOpaqueString(),
Audience: audience,
IssuedAt: util.GetTimeAsMsSinceEpoch(time.Now()),
- Verifier: oauth2.GenerateVerifier(),
}
}
type oidcToken struct {
- AccessToken string `json:"access_token"`
- TokenType string `json:"token_type,omitempty"`
- RefreshToken string `json:"refresh_token,omitempty"`
- ExpiresAt int64 `json:"expires_at,omitempty"`
- SessionID string `json:"session_id"`
- IDToken string `json:"id_token"`
- Nonce string `json:"nonce"`
- Username string `json:"username"`
- Permissions []string `json:"permissions"`
- HideUserPageSections int `json:"hide_user_page_sections,omitempty"`
- MustSetTwoFactorAuth bool `json:"must_set_2fa,omitempty"`
- MustChangePassword bool `json:"must_change_password,omitempty"`
- RequiredTwoFactorProtocols []string `json:"required_two_factor_protocols,omitempty"`
- TokenRole string `json:"token_role,omitempty"` // SFTPGo role name
- Role any `json:"role"` // oidc user role: SFTPGo user or admin
- CustomFields *map[string]any `json:"custom_fields,omitempty"`
- Cookie string `json:"cookie"`
- UsedAt int64 `json:"used_at"`
+ AccessToken string `json:"access_token"`
+ TokenType string `json:"token_type,omitempty"`
+ RefreshToken string `json:"refresh_token,omitempty"`
+ ExpiresAt int64 `json:"expires_at,omitempty"`
+ SessionID string `json:"session_id"`
+ IDToken string `json:"id_token"`
+ Nonce string `json:"nonce"`
+ Username string `json:"username"`
+ Permissions []string `json:"permissions"`
+ HideUserPageSections int `json:"hide_user_page_sections,omitempty"`
+ TokenRole string `json:"token_role,omitempty"` // SFTPGo role name
+ Role any `json:"role"` // oidc user role: SFTPGo user or admin
+ CustomFields *map[string]any `json:"custom_fields,omitempty"`
+ Cookie string `json:"cookie"`
+ UsedAt int64 `json:"used_at"`
}
func (t *oidcToken) parseClaims(claims map[string]any, usernameField, roleField string, customFields []string,
@@ -399,14 +392,11 @@ func (t *oidcToken) refreshUser(r *http.Request) error {
if err := user.CheckLoginConditions(); err != nil {
return err
}
- if err := checkHTTPClientUser(&user, r, xid.New().String(), true, false); err != nil {
+ if err := checkHTTPClientUser(&user, r, xid.New().String(), true); err != nil {
return err
}
t.Permissions = user.Filters.WebClient
t.TokenRole = user.Role
- t.MustSetTwoFactorAuth = user.MustSetSecondFactor()
- t.MustChangePassword = user.MustChangePassword()
- t.RequiredTwoFactorProtocols = user.Filters.TwoFactorAuthProtocols
return nil
}
@@ -455,32 +445,29 @@ func (t *oidcToken) getUser(r *http.Request) error {
user = &u
}
if err := common.Config.ExecutePostConnectHook(ipAddr, common.ProtocolOIDC); err != nil {
- updateLoginMetrics(user, dataprovider.LoginMethodIDP, ipAddr, err, r)
+ updateLoginMetrics(user, dataprovider.LoginMethodIDP, ipAddr, err)
return fmt.Errorf("access denied: %w", err)
}
if err := user.CheckLoginConditions(); err != nil {
- updateLoginMetrics(user, dataprovider.LoginMethodIDP, ipAddr, err, r)
+ updateLoginMetrics(user, dataprovider.LoginMethodIDP, ipAddr, err)
return err
}
connectionID := fmt.Sprintf("%s_%s", common.ProtocolOIDC, xid.New().String())
- if err := checkHTTPClientUser(user, r, connectionID, true, true); err != nil {
- updateLoginMetrics(user, dataprovider.LoginMethodIDP, ipAddr, err, r)
+ if err := checkHTTPClientUser(user, r, connectionID, true); err != nil {
+ updateLoginMetrics(user, dataprovider.LoginMethodIDP, ipAddr, err)
return err
}
defer user.CloseFs() //nolint:errcheck
err = user.CheckFsRoot(connectionID)
if err != nil {
logger.Warn(logSender, connectionID, "unable to check fs root: %v", err)
- updateLoginMetrics(user, dataprovider.LoginMethodIDP, ipAddr, common.ErrInternalFailure, r)
+ updateLoginMetrics(user, dataprovider.LoginMethodIDP, ipAddr, common.ErrInternalFailure)
return err
}
- updateLoginMetrics(user, dataprovider.LoginMethodIDP, ipAddr, nil, r)
+ updateLoginMetrics(user, dataprovider.LoginMethodIDP, ipAddr, nil)
dataprovider.UpdateLastLogin(user)
t.Permissions = user.Filters.WebClient
t.TokenRole = user.Role
- t.MustSetTwoFactorAuth = user.MustSetSecondFactor()
- t.MustChangePassword = user.MustChangePassword()
- t.RequiredTwoFactorProtocols = user.Filters.TwoFactorAuthProtocols
return nil
}
@@ -554,20 +541,13 @@ func (s *httpdServer) oidcTokenAuthenticator(audience tokenAudience) func(next h
if err != nil {
return
}
- claims := jwt.Claims{
- Username: dataprovider.ConvertName(token.Username),
+ jwtTokenClaims := jwtTokenClaims{
+ Username: token.Username,
Permissions: token.Permissions,
Role: token.TokenRole,
HideUserPageSections: token.HideUserPageSections,
}
- claims.ID = token.Cookie
- if audience == tokenAudienceWebClient {
- claims.MustSetTwoFactorAuth = token.MustSetTwoFactorAuth
- claims.MustChangePassword = token.MustChangePassword
- claims.RequiredTwoFactorProtocols = token.RequiredTwoFactorProtocols
- }
- tokenString, err := s.tokenAuth.SignWithParams(&claims, audience, util.GetIPFromRemoteAddress(r.RemoteAddr),
- getTokenDuration(audience))
+ _, tokenString, err := jwtTokenClaims.createToken(s.tokenAuth, audience, util.GetIPFromRemoteAddress(r.RemoteAddr))
if err != nil {
setFlashMessage(w, r, newFlashMessage("Unable to create cookie", util.I18nError500Message))
if audience == tokenAudienceWebAdmin {
@@ -597,7 +577,7 @@ func (s *httpdServer) oidcLoginRedirect(w http.ResponseWriter, r *http.Request,
pendingAuth := newOIDCPendingAuth(audience)
oidcMgr.addPendingAuth(pendingAuth)
http.Redirect(w, r, s.binding.OIDC.oauth2Config.AuthCodeURL(pendingAuth.State,
- oidc.Nonce(pendingAuth.Nonce), oauth2.S256ChallengeOption(pendingAuth.Verifier)), http.StatusFound)
+ oidc.Nonce(pendingAuth.Nonce)), http.StatusFound)
}
func (s *httpdServer) debugTokenClaims(claims map[string]any, rawIDToken string) {
@@ -636,8 +616,7 @@ func (s *httpdServer) handleOIDCRedirect(w http.ResponseWriter, r *http.Request)
ctx, cancel := context.WithTimeout(r.Context(), 20*time.Second)
defer cancel()
- oauth2Token, err := s.binding.OIDC.oauth2Config.Exchange(ctx, r.URL.Query().Get("code"),
- oauth2.VerifierOption(authReq.Verifier))
+ oauth2Token, err := s.binding.OIDC.oauth2Config.Exchange(ctx, r.URL.Query().Get("code"))
if err != nil {
logger.Debug(logSender, "", "failed to exchange oidc token: %v", err)
setFlashMessage(w, r, newFlashMessage("Failed to exchange OpenID token", util.I18nOIDCErrTokenExchange))
@@ -812,7 +791,7 @@ func removeOIDCCookie(w http.ResponseWriter, r *http.Request) {
func canSkipOIDCValidation(r *http.Request) bool {
_, err := r.Cookie(oidcCookieKey)
if err != nil {
- _, err = r.Cookie(jwt.CookieKey)
+ _, err = r.Cookie(jwtCookieKey)
return err == nil
}
return false
diff --git a/internal/httpd/oidc_test.go b/internal/httpd/oidc_test.go
index 4a14c76c..636c9cfa 100644
--- a/internal/httpd/oidc_test.go
+++ b/internal/httpd/oidc_test.go
@@ -32,6 +32,8 @@ import (
"unsafe"
"github.com/coreos/go-oidc/v3/oidc"
+ "github.com/go-chi/jwtauth/v5"
+ "github.com/lestrrat-go/jwx/v2/jwa"
"github.com/rs/xid"
"github.com/sftpgo/sdk"
"github.com/stretchr/testify/assert"
@@ -40,7 +42,6 @@ import (
"github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/kms"
"github.com/drakkan/sftpgo/v2/internal/util"
"github.com/drakkan/sftpgo/v2/internal/vfs"
@@ -135,15 +136,12 @@ func TestOIDCInitialization(t *testing.T) {
}
func TestOIDCLoginLogout(t *testing.T) {
- tokenValidationMode = 2
-
oidcMgr, ok := oidcMgr.(*memoryOIDCManager)
require.True(t, ok)
server := getTestOIDCServer()
err := server.binding.OIDC.initialize()
assert.NoError(t, err)
- err = server.initializeRouter()
- require.NoError(t, err)
+ server.initializeRouter()
rr := httptest.NewRecorder()
r, err := http.NewRequest(http.MethodGet, webOIDCRedirectPath, nil)
@@ -555,8 +553,6 @@ func TestOIDCLoginLogout(t *testing.T) {
assert.NoError(t, err)
err = dataprovider.DeleteUser(username, "", "", "")
assert.NoError(t, err)
-
- tokenValidationMode = 0
}
func TestOIDCRefreshToken(t *testing.T) {
@@ -769,8 +765,7 @@ func TestValidateOIDCToken(t *testing.T) {
server := getTestOIDCServer()
err := server.binding.OIDC.initialize()
assert.NoError(t, err)
- err = server.initializeRouter()
- require.NoError(t, err)
+ server.initializeRouter()
rr := httptest.NewRecorder()
r, err := http.NewRequest(http.MethodGet, webClientLogoutPath, nil)
@@ -798,7 +793,7 @@ func TestValidateOIDCToken(t *testing.T) {
oidcMgr.removeToken(token.Cookie)
assert.Len(t, oidcMgr.tokens, 0)
- server.tokenAuth.SetSigner(&failingJoseSigner{})
+ server.tokenAuth = jwtauth.New("PS256", util.GenerateRandomBytes(32), nil)
token = oidcToken{
Cookie: util.GenerateOpaqueString(),
AccessToken: util.GenerateUniqueID(),
@@ -835,17 +830,16 @@ func TestSkipOIDCAuth(t *testing.T) {
server := getTestOIDCServer()
err := server.binding.OIDC.initialize()
assert.NoError(t, err)
- err = server.initializeRouter()
- require.NoError(t, err)
-
- claims := jwt.NewClaims(tokenAudienceWebClient, "", getTokenDuration(tokenAudienceWebClient))
- claims.Username = "user"
- tokenString, err := server.tokenAuth.Sign(claims)
+ server.initializeRouter()
+ jwtTokenClaims := jwtTokenClaims{
+ Username: "user",
+ }
+ _, tokenString, err := jwtTokenClaims.createToken(server.tokenAuth, tokenAudienceWebClient, "")
assert.NoError(t, err)
rr := httptest.NewRecorder()
r, err := http.NewRequest(http.MethodGet, webClientLogoutPath, nil)
assert.NoError(t, err)
- r.Header.Set("Cookie", fmt.Sprintf("%v=%v", jwt.CookieKey, tokenString))
+ r.Header.Set("Cookie", fmt.Sprintf("%v=%v", jwtCookieKey, tokenString))
server.router.ServeHTTP(rr, r)
assert.Equal(t, http.StatusFound, rr.Code)
assert.Equal(t, webClientLoginPath, rr.Header().Get("Location"))
@@ -909,8 +903,7 @@ func TestOIDCToken(t *testing.T) {
},
Filters: dataprovider.UserFilters{
BaseUserFilters: sdk.BaseUserFilters{
- DeniedProtocols: []string{common.ProtocolHTTP},
- DeniedLoginMethods: []string{dataprovider.LoginMethodPassword},
+ DeniedProtocols: []string{common.ProtocolHTTP},
},
},
}
@@ -971,8 +964,7 @@ func TestOIDCImplicitRoles(t *testing.T) {
server.binding.OIDC.ImplicitRoles = true
err := server.binding.OIDC.initialize()
assert.NoError(t, err)
- err = server.initializeRouter()
- require.NoError(t, err)
+ server.initializeRouter()
authReq := newOIDCPendingAuth(tokenAudienceWebAdmin)
oidcMgr.addPendingAuth(authReq)
@@ -1098,7 +1090,7 @@ func TestMemoryOIDCManager(t *testing.T) {
assert.NoError(t, err)
oidcMgr.removePendingAuth(authReq.State)
require.Len(t, oidcMgr.pendingAuths, 0)
- authReq.IssuedAt = util.GetTimeAsMsSinceEpoch(time.Now().Add(-600 * time.Second))
+ authReq.IssuedAt = util.GetTimeAsMsSinceEpoch(time.Now().Add(-61 * time.Second))
oidcMgr.addPendingAuth(authReq)
require.Len(t, oidcMgr.pendingAuths, 1)
_, err = oidcMgr.getPendingAuth(authReq.State)
@@ -1184,20 +1176,20 @@ func TestOIDCEvMgrIntegration(t *testing.T) {
err = dataprovider.Initialize(newProviderConf, configDir, true)
assert.NoError(t, err)
// add a special chars to check json replacer
- username := `test_'oidc_eventmanager`
+ username := `test_"oidc_eventmanager`
u := map[string]any{
- "username": "{{.Name}}",
+ "username": "{{Name}}",
"status": 1,
- "home_dir": filepath.Join(os.TempDir(), "{{.IDPFieldcustom1.sub}}"),
+ "home_dir": filepath.Join(os.TempDir(), "{{IDPFieldcustom1.sub}}"),
"permissions": map[string][]string{
"/": {dataprovider.PermAny},
},
- "description": "{{.IDPFieldcustom2}}",
+ "description": "{{IDPFieldcustom2}}",
}
userTmpl, err := json.Marshal(u)
require.NoError(t, err)
a := map[string]any{
- "username": "{{.Name}}",
+ "username": "{{Name}}",
"status": 1,
"permissions": []string{dataprovider.PermAdminAny},
}
@@ -1245,8 +1237,7 @@ func TestOIDCEvMgrIntegration(t *testing.T) {
server.binding.OIDC.CustomFields = []string{"custom1.sub", "custom2"}
err = server.binding.OIDC.initialize()
assert.NoError(t, err)
- err = server.initializeRouter()
- require.NoError(t, err)
+ server.initializeRouter()
// login a user with OIDC
_, err = dataprovider.UserExists(username, "")
assert.ErrorIs(t, err, util.ErrNotFound)
@@ -1383,8 +1374,7 @@ func TestOIDCPreLoginHook(t *testing.T) {
server.binding.OIDC.CustomFields = []string{"field1", "field2"}
err = server.binding.OIDC.initialize()
assert.NoError(t, err)
- err = server.initializeRouter()
- require.NoError(t, err)
+ server.initializeRouter()
_, err = dataprovider.UserExists(username, "")
assert.ErrorIs(t, err, util.ErrNotFound)
@@ -1555,13 +1545,12 @@ func TestOIDCWithLoginFormsDisabled(t *testing.T) {
server := getTestOIDCServer()
server.binding.OIDC.ImplicitRoles = true
- server.binding.DisabledLoginMethods = 12
+ server.binding.EnabledLoginMethods = 3
server.binding.EnableWebAdmin = true
server.binding.EnableWebClient = true
err := server.binding.OIDC.initialize()
assert.NoError(t, err)
- err = server.initializeRouter()
- require.NoError(t, err)
+ server.initializeRouter()
// login with an admin user
authReq := newOIDCPendingAuth(tokenAudienceWebAdmin)
oidcMgr.addPendingAuth(authReq)
@@ -1597,9 +1586,12 @@ func TestOIDCWithLoginFormsDisabled(t *testing.T) {
tokenCookie = k
}
// we should be able to create admins without setting a password
+ if csrfTokenAuth == nil {
+ csrfTokenAuth = jwtauth.New(jwa.HS256.String(), util.GenerateRandomBytes(32), nil)
+ }
adminUsername := "testAdmin"
form := make(url.Values)
- form.Set(csrfFormToken, createCSRFToken(rr, r, server.csrfTokenAuth, tokenCookie, webBaseAdminPath))
+ form.Set(csrfFormToken, createCSRFToken(""))
form.Set("username", adminUsername)
form.Set("password", "")
form.Set("status", "1")
diff --git a/internal/httpd/oidcmanager.go b/internal/httpd/oidcmanager.go
index 79336748..d0acade6 100644
--- a/internal/httpd/oidcmanager.go
+++ b/internal/httpd/oidcmanager.go
@@ -167,11 +167,11 @@ func (o *dbOIDCManager) addPendingAuth(pendingAuth oidcPendingAuth) {
}
func (o *dbOIDCManager) removePendingAuth(state string) {
- dataprovider.DeleteSharedSession(state, dataprovider.SessionTypeOIDCAuth) //nolint:errcheck
+ dataprovider.DeleteSharedSession(state) //nolint:errcheck
}
func (o *dbOIDCManager) getPendingAuth(state string) (oidcPendingAuth, error) {
- session, err := dataprovider.GetSharedSession(state, dataprovider.SessionTypeOIDCAuth)
+ session, err := dataprovider.GetSharedSession(state)
if err != nil {
return oidcPendingAuth{}, errors.New("oidc: unable to get the auth request for the specified state")
}
@@ -204,7 +204,7 @@ func (o *dbOIDCManager) addToken(token oidcToken) {
}
func (o *dbOIDCManager) removeToken(cookie string) {
- dataprovider.DeleteSharedSession(cookie, dataprovider.SessionTypeOIDCToken) //nolint:errcheck
+ dataprovider.DeleteSharedSession(cookie) //nolint:errcheck
}
func (o *dbOIDCManager) updateTokenUsage(token oidcToken) {
@@ -215,7 +215,7 @@ func (o *dbOIDCManager) updateTokenUsage(token oidcToken) {
}
func (o *dbOIDCManager) getToken(cookie string) (oidcToken, error) {
- session, err := dataprovider.GetSharedSession(cookie, dataprovider.SessionTypeOIDCToken)
+ session, err := dataprovider.GetSharedSession(cookie)
if err != nil {
return oidcToken{}, errors.New("oidc: unable to get the token for the specified session")
}
diff --git a/internal/httpd/resetcode.go b/internal/httpd/resetcode.go
index 0be7d890..6e680c02 100644
--- a/internal/httpd/resetcode.go
+++ b/internal/httpd/resetcode.go
@@ -110,7 +110,7 @@ func (m *dbResetCodeManager) Add(code *resetCode) error {
}
func (m *dbResetCodeManager) Get(code string) (*resetCode, error) {
- session, err := dataprovider.GetSharedSession(code, dataprovider.SessionTypeResetCode)
+ session, err := dataprovider.GetSharedSession(code)
if err != nil {
return nil, err
}
@@ -132,7 +132,7 @@ func (m *dbResetCodeManager) decodeData(data any) (*resetCode, error) {
}
func (m *dbResetCodeManager) Delete(code string) error {
- return dataprovider.DeleteSharedSession(code, dataprovider.SessionTypeResetCode)
+ return dataprovider.DeleteSharedSession(code)
}
func (m *dbResetCodeManager) Cleanup() {
diff --git a/internal/httpd/resources.go b/internal/httpd/resources.go
index 54bc58c9..a68a7167 100644
--- a/internal/httpd/resources.go
+++ b/internal/httpd/resources.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build !bundle
+// +build !bundle
package httpd
diff --git a/internal/httpd/resources_embedded.go b/internal/httpd/resources_embedded.go
index e15bc985..66ac0a8e 100644
--- a/internal/httpd/resources_embedded.go
+++ b/internal/httpd/resources_embedded.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build bundle
+// +build bundle
package httpd
diff --git a/internal/httpd/server.go b/internal/httpd/server.go
index 3fa54c1b..d0f9073e 100644
--- a/internal/httpd/server.go
+++ b/internal/httpd/server.go
@@ -16,7 +16,6 @@ package httpd
import (
"context"
- "crypto/rand"
"crypto/tls"
"crypto/x509"
"errors"
@@ -25,16 +24,15 @@ import (
"net"
"net/http"
"net/url"
- "path"
"path/filepath"
- "slices"
"strings"
"time"
"github.com/go-chi/chi/v5"
"github.com/go-chi/chi/v5/middleware"
+ "github.com/go-chi/jwtauth/v5"
"github.com/go-chi/render"
- "github.com/go-jose/go-jose/v4"
+ "github.com/lestrrat-go/jwx/v2/jwa"
"github.com/rs/cors"
"github.com/rs/xid"
"github.com/sftpgo/sdk"
@@ -43,7 +41,6 @@ import (
"github.com/drakkan/sftpgo/v2/internal/acme"
"github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/logger"
"github.com/drakkan/sftpgo/v2/internal/mfa"
"github.com/drakkan/sftpgo/v2/internal/smtp"
@@ -70,8 +67,7 @@ type httpdServer struct {
renderOpenAPI bool
isShared int
router *chi.Mux
- tokenAuth *jwt.Signer
- csrfTokenAuth *jwt.Signer
+ tokenAuth *jwtauth.JWTAuth
signingPassphrase string
cors CorsConfig
}
@@ -100,12 +96,12 @@ func (s *httpdServer) setShared(value int) {
}
func (s *httpdServer) listenAndServe() error {
- if err := s.initializeRouter(); err != nil {
- return err
- }
+ s.initializeRouter()
httpServer := &http.Server{
Handler: s.router,
ReadHeaderTimeout: 30 * time.Second,
+ ReadTimeout: 60 * time.Second,
+ WriteTimeout: 60 * time.Second,
IdleTimeout: 60 * time.Second,
MaxHeaderBytes: 1 << 16, // 64KB
ErrorLog: log.New(&logger.StdLoggerWrapper{Sender: logSender}, "", 0),
@@ -129,11 +125,9 @@ func (s *httpdServer) listenAndServe() error {
httpServer.TLSConfig.ClientAuth = tls.RequireAndVerifyClientCert
httpServer.TLSConfig.VerifyConnection = s.verifyTLSConnection
}
- return util.HTTPListenAndServe(httpServer, s.binding.Address, s.binding.Port, true,
- s.binding.listenerWrapper(), logSender)
+ return util.HTTPListenAndServe(httpServer, s.binding.Address, s.binding.Port, true, logSender)
}
- return util.HTTPListenAndServe(httpServer, s.binding.Address, s.binding.Port, false,
- s.binding.listenerWrapper(), logSender)
+ return util.HTTPListenAndServe(httpServer, s.binding.Address, s.binding.Port, false, logSender)
}
func (s *httpdServer) verifyTLSConnection(state tls.ConnectionState) error {
@@ -170,15 +164,14 @@ func (s *httpdServer) refreshCookie(next http.Handler) http.Handler {
})
}
-func (s *httpdServer) renderClientLoginPage(w http.ResponseWriter, r *http.Request, err *util.I18nError) {
+func (s *httpdServer) renderClientLoginPage(w http.ResponseWriter, r *http.Request, err *util.I18nError, ip string) {
data := loginPage{
commonBasePage: getCommonBasePage(r),
Title: util.I18nLoginTitle,
CurrentURL: webClientLoginPath,
Error: err,
- CSRFToken: createCSRFToken(w, r, s.csrfTokenAuth, rand.Text(), webBaseClientPath),
- Branding: s.binding.webClientBranding(),
- Languages: s.binding.languages(),
+ CSRFToken: createCSRFToken(ip),
+ Branding: s.binding.Branding.WebClient,
FormDisabled: s.binding.isWebClientLoginFormDisabled(),
CheckRedirect: true,
}
@@ -187,7 +180,7 @@ func (s *httpdServer) renderClientLoginPage(w http.ResponseWriter, r *http.Reque
}
if s.binding.showAdminLoginURL() {
data.AltLoginURL = webAdminLoginPath
- data.AltLoginName = s.binding.webAdminBranding().ShortName
+ data.AltLoginName = s.binding.Branding.WebAdmin.ShortName
}
if smtp.IsEnabled() && !data.FormDisabled {
data.ForgotPwdURL = webClientForgotPwdPath
@@ -200,7 +193,8 @@ func (s *httpdServer) renderClientLoginPage(w http.ResponseWriter, r *http.Reque
func (s *httpdServer) handleWebClientLogout(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxLoginBodySize)
- removeCookie(w, r, webBaseClientPath)
+ c := jwtTokenClaims{}
+ c.removeCookie(w, r, webBaseClientPath)
s.logoutOIDCUser(w, r)
http.Redirect(w, r, webClientLoginPath, http.StatusFound)
@@ -212,7 +206,7 @@ func (s *httpdServer) handleWebClientChangePwdPost(w http.ResponseWriter, r *htt
s.renderClientChangePasswordPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm))
return
}
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), util.GetIPFromRemoteAddress(r.RemoteAddr)); err != nil {
s.renderClientForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -232,7 +226,7 @@ func (s *httpdServer) handleClientWebLogin(w http.ResponseWriter, r *http.Reques
return
}
msg := getFlashMessage(w, r)
- s.renderClientLoginPage(w, r, msg.getI18nError())
+ s.renderClientLoginPage(w, r, msg.getI18nError(), util.GetIPFromRemoteAddress(r.RemoteAddr))
}
func (s *httpdServer) handleWebClientLoginPost(w http.ResponseWriter, r *http.Request) {
@@ -240,43 +234,44 @@ func (s *httpdServer) handleWebClientLoginPost(w http.ResponseWriter, r *http.Re
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
if err := r.ParseForm(); err != nil {
- s.renderClientLoginPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm))
+ s.renderClientLoginPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm), ipAddr)
return
}
protocol := common.ProtocolHTTP
username := strings.TrimSpace(r.Form.Get("username"))
- password := r.Form.Get("password")
+ password := strings.TrimSpace(r.Form.Get("password"))
if username == "" || password == "" {
updateLoginMetrics(&dataprovider.User{BaseUser: sdk.BaseUser{Username: username}},
- dataprovider.LoginMethodPassword, ipAddr, common.ErrNoCredentials, r)
+ dataprovider.LoginMethodPassword, ipAddr, common.ErrNoCredentials)
s.renderClientLoginPage(w, r,
- util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials))
+ util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials), ipAddr)
return
}
- if err := verifyLoginCookieAndCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
updateLoginMetrics(&dataprovider.User{BaseUser: sdk.BaseUser{Username: username}},
- dataprovider.LoginMethodPassword, ipAddr, err, r)
- s.renderClientLoginPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
+ dataprovider.LoginMethodPassword, ipAddr, err)
+ s.renderClientLoginPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF), ipAddr)
+ return
}
if err := common.Config.ExecutePostConnectHook(ipAddr, protocol); err != nil {
updateLoginMetrics(&dataprovider.User{BaseUser: sdk.BaseUser{Username: username}},
- dataprovider.LoginMethodPassword, ipAddr, err, r)
- s.renderClientLoginPage(w, r, util.NewI18nError(err, util.I18nError403Message))
+ dataprovider.LoginMethodPassword, ipAddr, err)
+ s.renderClientLoginPage(w, r, util.NewI18nError(err, util.I18nError403Message), ipAddr)
return
}
user, err := dataprovider.CheckUserAndPass(username, password, ipAddr, protocol)
if err != nil {
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, err, r)
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, err)
s.renderClientLoginPage(w, r,
- util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials))
+ util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials), ipAddr)
return
}
connectionID := fmt.Sprintf("%v_%v", protocol, xid.New().String())
- if err := checkHTTPClientUser(&user, r, connectionID, true, false); err != nil {
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, err, r)
- s.renderClientLoginPage(w, r, util.NewI18nError(err, util.I18nError403Message))
+ if err := checkHTTPClientUser(&user, r, connectionID, true); err != nil {
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, err)
+ s.renderClientLoginPage(w, r, util.NewI18nError(err, util.I18nError403Message), ipAddr)
return
}
@@ -284,8 +279,8 @@ func (s *httpdServer) handleWebClientLoginPost(w http.ResponseWriter, r *http.Re
err = user.CheckFsRoot(connectionID)
if err != nil {
logger.Warn(logSender, connectionID, "unable to check fs root: %v", err)
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, common.ErrInternalFailure, r)
- s.renderClientLoginPage(w, r, util.NewI18nError(err, util.I18nErrorFsGeneric))
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, common.ErrInternalFailure)
+ s.renderClientLoginPage(w, r, util.NewI18nError(err, util.I18nErrorFsGeneric), ipAddr)
return
}
s.loginUser(w, r, &user, connectionID, ipAddr, false, s.renderClientLoginPage)
@@ -297,10 +292,10 @@ func (s *httpdServer) handleWebClientPasswordResetPost(w http.ResponseWriter, r
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
err := r.ParseForm()
if err != nil {
- s.renderClientResetPwdPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm))
+ s.renderClientResetPwdPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm), ipAddr)
return
}
- if err := verifyLoginCookieAndCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderClientForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -309,12 +304,12 @@ func (s *httpdServer) handleWebClientPasswordResetPost(w http.ResponseWriter, r
_, user, err := handleResetPassword(r, strings.TrimSpace(r.Form.Get("code")),
newPassword, confirmPassword, false)
if err != nil {
- s.renderClientResetPwdPage(w, r, util.NewI18nError(err, util.I18nErrorChangePwdGeneric))
+ s.renderClientResetPwdPage(w, r, util.NewI18nError(err, util.I18nErrorChangePwdGeneric), ipAddr)
return
}
connectionID := fmt.Sprintf("%v_%v", getProtocolFromRequest(r), xid.New().String())
- if err := checkHTTPClientUser(user, r, connectionID, true, false); err != nil {
- s.renderClientResetPwdPage(w, r, util.NewI18nError(err, util.I18nErrorLoginAfterReset))
+ if err := checkHTTPClientUser(user, r, connectionID, true); err != nil {
+ s.renderClientResetPwdPage(w, r, util.NewI18nError(err, util.I18nErrorLoginAfterReset), ipAddr)
return
}
@@ -322,7 +317,7 @@ func (s *httpdServer) handleWebClientPasswordResetPost(w http.ResponseWriter, r
err = user.CheckFsRoot(connectionID)
if err != nil {
logger.Warn(logSender, connectionID, "unable to check fs root: %v", err)
- s.renderClientResetPwdPage(w, r, util.NewI18nError(err, util.I18nErrorLoginAfterReset))
+ s.renderClientResetPwdPage(w, r, util.NewI18nError(err, util.I18nErrorLoginAfterReset), ipAddr)
return
}
s.loginUser(w, r, user, connectionID, ipAddr, false, s.renderClientResetPwdPage)
@@ -330,25 +325,25 @@ func (s *httpdServer) handleWebClientPasswordResetPost(w http.ResponseWriter, r
func (s *httpdServer) handleWebClientTwoFactorRecoveryPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxLoginBodySize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil {
s.renderNotFoundPage(w, r, nil)
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
if err := r.ParseForm(); err != nil {
- s.renderClientTwoFactorRecoveryPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm))
+ s.renderClientTwoFactorRecoveryPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm), ipAddr)
return
}
username := claims.Username
recoveryCode := strings.TrimSpace(r.Form.Get("recovery_code"))
if username == "" || recoveryCode == "" {
s.renderClientTwoFactorRecoveryPage(w, r,
- util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials))
+ util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials), ipAddr)
return
}
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
- s.renderClientTwoFactorRecoveryPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
+ s.renderClientTwoFactorRecoveryPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF), ipAddr)
return
}
user, userMerged, err := dataprovider.GetUserVariants(username, "")
@@ -357,12 +352,12 @@ func (s *httpdServer) handleWebClientTwoFactorRecoveryPost(w http.ResponseWriter
handleDefenderEventLoginFailed(ipAddr, err) //nolint:errcheck
}
s.renderClientTwoFactorRecoveryPage(w, r,
- util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials))
+ util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials), ipAddr)
return
}
- if !userMerged.Filters.TOTPConfig.Enabled || !slices.Contains(userMerged.Filters.TOTPConfig.Protocols, common.ProtocolHTTP) {
+ if !userMerged.Filters.TOTPConfig.Enabled || !util.Contains(userMerged.Filters.TOTPConfig.Protocols, common.ProtocolHTTP) {
s.renderClientTwoFactorPage(w, r, util.NewI18nError(
- util.NewValidationError("two factory authentication is not enabled"), util.I18n2FADisabled))
+ util.NewValidationError("two factory authentication is not enabled"), util.I18n2FADisabled), ipAddr)
return
}
for idx, code := range user.Filters.RecoveryCodes {
@@ -373,7 +368,7 @@ func (s *httpdServer) handleWebClientTwoFactorRecoveryPost(w http.ResponseWriter
if code.Secret.GetPayload() == recoveryCode {
if code.Used {
s.renderClientTwoFactorRecoveryPage(w, r,
- util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials))
+ util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials), ipAddr)
return
}
user.Filters.RecoveryCodes[idx].Used = true
@@ -391,60 +386,60 @@ func (s *httpdServer) handleWebClientTwoFactorRecoveryPost(w http.ResponseWriter
}
handleDefenderEventLoginFailed(ipAddr, dataprovider.ErrInvalidCredentials) //nolint:errcheck
s.renderClientTwoFactorRecoveryPage(w, r,
- util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials))
+ util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials), ipAddr)
}
func (s *httpdServer) handleWebClientTwoFactorPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxLoginBodySize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil {
s.renderNotFoundPage(w, r, nil)
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
if err := r.ParseForm(); err != nil {
- s.renderClientTwoFactorPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm))
+ s.renderClientTwoFactorPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm), ipAddr)
return
}
username := claims.Username
passcode := strings.TrimSpace(r.Form.Get("passcode"))
if username == "" || passcode == "" {
updateLoginMetrics(&dataprovider.User{BaseUser: sdk.BaseUser{Username: username}},
- dataprovider.LoginMethodPassword, ipAddr, common.ErrNoCredentials, r)
+ dataprovider.LoginMethodPassword, ipAddr, common.ErrNoCredentials)
s.renderClientTwoFactorPage(w, r,
- util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials))
+ util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials), ipAddr)
return
}
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
updateLoginMetrics(&dataprovider.User{BaseUser: sdk.BaseUser{Username: username}},
- dataprovider.LoginMethodPassword, ipAddr, err, r)
- s.renderClientTwoFactorPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
+ dataprovider.LoginMethodPassword, ipAddr, err)
+ s.renderClientTwoFactorPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF), ipAddr)
return
}
user, err := dataprovider.GetUserWithGroupSettings(username, "")
if err != nil {
updateLoginMetrics(&dataprovider.User{BaseUser: sdk.BaseUser{Username: username}},
- dataprovider.LoginMethodPassword, ipAddr, err, r)
- s.renderClientTwoFactorPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCredentials))
+ dataprovider.LoginMethodPassword, ipAddr, err)
+ s.renderClientTwoFactorPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCredentials), ipAddr)
return
}
- if !user.Filters.TOTPConfig.Enabled || !slices.Contains(user.Filters.TOTPConfig.Protocols, common.ProtocolHTTP) {
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, common.ErrInternalFailure, r)
- s.renderClientTwoFactorPage(w, r, util.NewI18nError(common.ErrInternalFailure, util.I18n2FADisabled))
+ if !user.Filters.TOTPConfig.Enabled || !util.Contains(user.Filters.TOTPConfig.Protocols, common.ProtocolHTTP) {
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, common.ErrInternalFailure)
+ s.renderClientTwoFactorPage(w, r, util.NewI18nError(common.ErrInternalFailure, util.I18n2FADisabled), ipAddr)
return
}
err = user.Filters.TOTPConfig.Secret.Decrypt()
if err != nil {
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, common.ErrInternalFailure, r)
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, common.ErrInternalFailure)
s.renderClientInternalServerErrorPage(w, r, err)
return
}
match, err := mfa.ValidateTOTPPasscode(user.Filters.TOTPConfig.ConfigName, passcode,
user.Filters.TOTPConfig.Secret.GetPayload())
if !match || err != nil {
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, dataprovider.ErrInvalidCredentials, r)
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, dataprovider.ErrInvalidCredentials)
s.renderClientTwoFactorPage(w, r,
- util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials))
+ util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials), ipAddr)
return
}
connectionID := fmt.Sprintf("%s_%s", getProtocolFromRequest(r), xid.New().String())
@@ -454,24 +449,25 @@ func (s *httpdServer) handleWebClientTwoFactorPost(w http.ResponseWriter, r *htt
func (s *httpdServer) handleWebAdminTwoFactorRecoveryPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxLoginBodySize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil {
s.renderNotFoundPage(w, r, nil)
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
if err := r.ParseForm(); err != nil {
- s.renderTwoFactorRecoveryPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm))
+ s.renderTwoFactorRecoveryPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm), ipAddr)
return
}
username := claims.Username
recoveryCode := strings.TrimSpace(r.Form.Get("recovery_code"))
if username == "" || recoveryCode == "" {
- s.renderTwoFactorRecoveryPage(w, r, util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials))
+ s.renderTwoFactorRecoveryPage(w, r, util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials),
+ ipAddr)
return
}
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
- s.renderTwoFactorRecoveryPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
+ s.renderTwoFactorRecoveryPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF), ipAddr)
return
}
admin, err := dataprovider.AdminExists(username)
@@ -479,11 +475,12 @@ func (s *httpdServer) handleWebAdminTwoFactorRecoveryPost(w http.ResponseWriter,
if errors.Is(err, util.ErrNotFound) {
handleDefenderEventLoginFailed(ipAddr, err) //nolint:errcheck
}
- s.renderTwoFactorRecoveryPage(w, r, util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials))
+ s.renderTwoFactorRecoveryPage(w, r, util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials),
+ ipAddr)
return
}
if !admin.Filters.TOTPConfig.Enabled {
- s.renderTwoFactorRecoveryPage(w, r, util.NewI18nError(util.NewValidationError("two factory authentication is not enabled"), util.I18n2FADisabled))
+ s.renderTwoFactorRecoveryPage(w, r, util.NewI18nError(util.NewValidationError("two factory authentication is not enabled"), util.I18n2FADisabled), ipAddr)
return
}
for idx, code := range admin.Filters.RecoveryCodes {
@@ -494,7 +491,7 @@ func (s *httpdServer) handleWebAdminTwoFactorRecoveryPost(w http.ResponseWriter,
if code.Secret.GetPayload() == recoveryCode {
if code.Used {
s.renderTwoFactorRecoveryPage(w, r,
- util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials))
+ util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials), ipAddr)
return
}
admin.Filters.RecoveryCodes[idx].Used = true
@@ -509,30 +506,32 @@ func (s *httpdServer) handleWebAdminTwoFactorRecoveryPost(w http.ResponseWriter,
}
}
handleDefenderEventLoginFailed(ipAddr, dataprovider.ErrInvalidCredentials) //nolint:errcheck
- s.renderTwoFactorRecoveryPage(w, r, util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials))
+ s.renderTwoFactorRecoveryPage(w, r, util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials),
+ ipAddr)
}
func (s *httpdServer) handleWebAdminTwoFactorPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxLoginBodySize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil {
s.renderNotFoundPage(w, r, nil)
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
if err := r.ParseForm(); err != nil {
- s.renderTwoFactorPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm))
+ s.renderTwoFactorPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm), ipAddr)
return
}
username := claims.Username
passcode := strings.TrimSpace(r.Form.Get("passcode"))
if username == "" || passcode == "" {
- s.renderTwoFactorPage(w, r, util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials))
+ s.renderTwoFactorPage(w, r, util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials),
+ ipAddr)
return
}
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
- handleDefenderEventLoginFailed(ipAddr, err) //nolint:errcheck
- s.renderTwoFactorPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
+ err = handleDefenderEventLoginFailed(ipAddr, err)
+ s.renderTwoFactorPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF), ipAddr)
return
}
admin, err := dataprovider.AdminExists(username)
@@ -540,11 +539,11 @@ func (s *httpdServer) handleWebAdminTwoFactorPost(w http.ResponseWriter, r *http
if errors.Is(err, util.ErrNotFound) {
handleDefenderEventLoginFailed(ipAddr, err) //nolint:errcheck
}
- s.renderTwoFactorPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCredentials))
+ s.renderTwoFactorPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCredentials), ipAddr)
return
}
if !admin.Filters.TOTPConfig.Enabled {
- s.renderTwoFactorPage(w, r, util.NewI18nError(common.ErrInternalFailure, util.I18n2FADisabled))
+ s.renderTwoFactorPage(w, r, util.NewI18nError(common.ErrInternalFailure, util.I18n2FADisabled), ipAddr)
return
}
err = admin.Filters.TOTPConfig.Secret.Decrypt()
@@ -556,7 +555,8 @@ func (s *httpdServer) handleWebAdminTwoFactorPost(w http.ResponseWriter, r *http
admin.Filters.TOTPConfig.Secret.GetPayload())
if !match || err != nil {
handleDefenderEventLoginFailed(ipAddr, dataprovider.ErrInvalidCredentials) //nolint:errcheck
- s.renderTwoFactorPage(w, r, util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials))
+ s.renderTwoFactorPage(w, r, util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials),
+ ipAddr)
return
}
s.loginAdmin(w, r, &admin, true, s.renderTwoFactorPage, ipAddr)
@@ -567,43 +567,44 @@ func (s *httpdServer) handleWebAdminLoginPost(w http.ResponseWriter, r *http.Req
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
if err := r.ParseForm(); err != nil {
- s.renderAdminLoginPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm))
+ s.renderAdminLoginPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm), ipAddr)
return
}
username := strings.TrimSpace(r.Form.Get("username"))
password := strings.TrimSpace(r.Form.Get("password"))
if username == "" || password == "" {
- s.renderAdminLoginPage(w, r, util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials))
+ s.renderAdminLoginPage(w, r, util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials),
+ ipAddr)
return
}
- if err := verifyLoginCookieAndCSRFToken(r, s.csrfTokenAuth); err != nil {
- s.renderAdminLoginPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
+ s.renderAdminLoginPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF), ipAddr)
return
}
admin, err := dataprovider.CheckAdminAndPass(username, password, ipAddr)
if err != nil {
handleDefenderEventLoginFailed(ipAddr, err) //nolint:errcheck
- s.renderAdminLoginPage(w, r, util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials))
+ s.renderAdminLoginPage(w, r, util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials),
+ ipAddr)
return
}
s.loginAdmin(w, r, &admin, false, s.renderAdminLoginPage, ipAddr)
}
-func (s *httpdServer) renderAdminLoginPage(w http.ResponseWriter, r *http.Request, err *util.I18nError) {
+func (s *httpdServer) renderAdminLoginPage(w http.ResponseWriter, r *http.Request, err *util.I18nError, ip string) {
data := loginPage{
commonBasePage: getCommonBasePage(r),
Title: util.I18nLoginTitle,
CurrentURL: webAdminLoginPath,
Error: err,
- CSRFToken: createCSRFToken(w, r, s.csrfTokenAuth, rand.Text(), webBaseAdminPath),
- Branding: s.binding.webAdminBranding(),
- Languages: s.binding.languages(),
+ CSRFToken: createCSRFToken(ip),
+ Branding: s.binding.Branding.WebAdmin,
FormDisabled: s.binding.isWebAdminLoginFormDisabled(),
CheckRedirect: false,
}
if s.binding.showClientLoginURL() {
data.AltLoginURL = webClientLoginPath
- data.AltLoginName = s.binding.webClientBranding().ShortName
+ data.AltLoginName = s.binding.Branding.WebClient.ShortName
}
if smtp.IsEnabled() && !data.FormDisabled {
data.ForgotPwdURL = webAdminForgotPwdPath
@@ -621,12 +622,13 @@ func (s *httpdServer) handleWebAdminLogin(w http.ResponseWriter, r *http.Request
return
}
msg := getFlashMessage(w, r)
- s.renderAdminLoginPage(w, r, msg.getI18nError())
+ s.renderAdminLoginPage(w, r, msg.getI18nError(), util.GetIPFromRemoteAddress(r.RemoteAddr))
}
func (s *httpdServer) handleWebAdminLogout(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- removeCookie(w, r, webBaseAdminPath)
+ c := jwtTokenClaims{}
+ c.removeCookie(w, r, webBaseAdminPath)
s.logoutOIDCUser(w, r)
http.Redirect(w, r, webAdminLoginPath, http.StatusFound)
@@ -639,7 +641,7 @@ func (s *httpdServer) handleWebAdminChangePwdPost(w http.ResponseWriter, r *http
s.renderChangePasswordPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm))
return
}
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), util.GetIPFromRemoteAddress(r.RemoteAddr)); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -658,10 +660,10 @@ func (s *httpdServer) handleWebAdminPasswordResetPost(w http.ResponseWriter, r *
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
err := r.ParseForm()
if err != nil {
- s.renderResetPwdPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm))
+ s.renderResetPwdPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm), ipAddr)
return
}
- if err := verifyLoginCookieAndCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -670,7 +672,7 @@ func (s *httpdServer) handleWebAdminPasswordResetPost(w http.ResponseWriter, r *
admin, _, err := handleResetPassword(r, strings.TrimSpace(r.Form.Get("code")),
newPassword, confirmPassword, true)
if err != nil {
- s.renderResetPwdPage(w, r, util.NewI18nError(err, util.I18nErrorChangePwdGeneric))
+ s.renderResetPwdPage(w, r, util.NewI18nError(err, util.I18nErrorChangePwdGeneric), ipAddr)
return
}
@@ -686,10 +688,10 @@ func (s *httpdServer) handleWebAdminSetupPost(w http.ResponseWriter, r *http.Req
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
err := r.ParseForm()
if err != nil {
- s.renderAdminSetupPage(w, r, "", util.NewI18nError(err, util.I18nErrorInvalidForm))
+ s.renderAdminSetupPage(w, r, "", ipAddr, util.NewI18nError(err, util.I18nErrorInvalidForm))
return
}
- if err := verifyLoginCookieAndCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -698,7 +700,7 @@ func (s *httpdServer) handleWebAdminSetupPost(w http.ResponseWriter, r *http.Req
confirmPassword := strings.TrimSpace(r.Form.Get("confirm_password"))
installCode := strings.TrimSpace(r.Form.Get("install_code"))
if installationCode != "" && installCode != resolveInstallationCode() {
- s.renderAdminSetupPage(w, r, username,
+ s.renderAdminSetupPage(w, r, username, ipAddr,
util.NewI18nError(
util.NewValidationError(fmt.Sprintf("%v mismatch", installationCodeHint)),
util.I18nErrorSetupInstallCode),
@@ -706,17 +708,17 @@ func (s *httpdServer) handleWebAdminSetupPost(w http.ResponseWriter, r *http.Req
return
}
if username == "" {
- s.renderAdminSetupPage(w, r, username,
+ s.renderAdminSetupPage(w, r, username, ipAddr,
util.NewI18nError(util.NewValidationError("please set a username"), util.I18nError500Message))
return
}
if password == "" {
- s.renderAdminSetupPage(w, r, username,
+ s.renderAdminSetupPage(w, r, username, ipAddr,
util.NewI18nError(util.NewValidationError("please set a password"), util.I18nError500Message))
return
}
if password != confirmPassword {
- s.renderAdminSetupPage(w, r, username,
+ s.renderAdminSetupPage(w, r, username, ipAddr,
util.NewI18nError(errors.New("the two password fields do not match"), util.I18nErrorChangePwdNoMatch))
return
}
@@ -728,7 +730,7 @@ func (s *httpdServer) handleWebAdminSetupPost(w http.ResponseWriter, r *http.Req
}
err = dataprovider.AddAdmin(&admin, username, ipAddr, "")
if err != nil {
- s.renderAdminSetupPage(w, r, username, util.NewI18nError(err, util.I18nError500Message))
+ s.renderAdminSetupPage(w, r, username, ipAddr, util.NewI18nError(err, util.I18nError500Message))
return
}
s.loginAdmin(w, r, &admin, false, nil, ipAddr)
@@ -736,32 +738,34 @@ func (s *httpdServer) handleWebAdminSetupPost(w http.ResponseWriter, r *http.Req
func (s *httpdServer) loginUser(
w http.ResponseWriter, r *http.Request, user *dataprovider.User, connectionID, ipAddr string,
- isSecondFactorAuth bool, errorFunc func(w http.ResponseWriter, r *http.Request, err *util.I18nError),
+ isSecondFactorAuth bool, errorFunc func(w http.ResponseWriter, r *http.Request, err *util.I18nError, ip string),
) {
- c := &jwt.Claims{
+ c := jwtTokenClaims{
Username: user.Username,
Permissions: user.Filters.WebClient,
+ Signature: user.GetSignature(),
Role: user.Role,
MustSetTwoFactorAuth: user.MustSetSecondFactor(),
MustChangePassword: user.MustChangePassword(),
RequiredTwoFactorProtocols: user.Filters.TwoFactorAuthProtocols,
}
- c.Subject = user.GetSignature()
audience := tokenAudienceWebClient
- if user.Filters.TOTPConfig.Enabled && slices.Contains(user.Filters.TOTPConfig.Protocols, common.ProtocolHTTP) &&
+ if user.Filters.TOTPConfig.Enabled && util.Contains(user.Filters.TOTPConfig.Protocols, common.ProtocolHTTP) &&
user.CanManageMFA() && !isSecondFactorAuth {
audience = tokenAudienceWebClientPartial
}
- err := createAndSetCookie(w, r, c, s.tokenAuth, audience, ipAddr)
+ err := c.createAndSetCookie(w, r, s.tokenAuth, audience, ipAddr)
if err != nil {
logger.Warn(logSender, connectionID, "unable to set user login cookie %v", err)
- updateLoginMetrics(user, dataprovider.LoginMethodPassword, ipAddr, common.ErrInternalFailure, r)
- errorFunc(w, r, util.NewI18nError(err, util.I18nError500Message))
+ updateLoginMetrics(user, dataprovider.LoginMethodPassword, ipAddr, common.ErrInternalFailure)
+ errorFunc(w, r, util.NewI18nError(err, util.I18nError500Message), ipAddr)
return
}
- invalidateToken(r)
+ if isSecondFactorAuth {
+ invalidateToken(r)
+ }
if audience == tokenAudienceWebClientPartial {
redirectPath := webClientTwoFactorPath
if next := r.URL.Query().Get("next"); strings.HasPrefix(next, webClientFilesPath) {
@@ -770,7 +774,7 @@ func (s *httpdServer) loginUser(
http.Redirect(w, r, redirectPath, http.StatusFound)
return
}
- updateLoginMetrics(user, dataprovider.LoginMethodPassword, ipAddr, err, r)
+ updateLoginMetrics(user, dataprovider.LoginMethodPassword, ipAddr, err)
dataprovider.UpdateLastLogin(user)
if next := r.URL.Query().Get("next"); strings.HasPrefix(next, webClientFilesPath) {
http.Redirect(w, r, next, http.StatusFound)
@@ -781,35 +785,37 @@ func (s *httpdServer) loginUser(
func (s *httpdServer) loginAdmin(
w http.ResponseWriter, r *http.Request, admin *dataprovider.Admin,
- isSecondFactorAuth bool, errorFunc func(w http.ResponseWriter, r *http.Request, err *util.I18nError),
+ isSecondFactorAuth bool, errorFunc func(w http.ResponseWriter, r *http.Request, err *util.I18nError, ip string),
ipAddr string,
) {
- c := &jwt.Claims{
+ c := jwtTokenClaims{
Username: admin.Username,
Permissions: admin.Permissions,
Role: admin.Role,
+ Signature: admin.GetSignature(),
HideUserPageSections: admin.Filters.Preferences.HideUserPageSections,
MustSetTwoFactorAuth: admin.Filters.RequireTwoFactor && !admin.Filters.TOTPConfig.Enabled,
MustChangePassword: admin.Filters.RequirePasswordChange,
}
- c.Subject = admin.GetSignature()
audience := tokenAudienceWebAdmin
if admin.Filters.TOTPConfig.Enabled && admin.CanManageMFA() && !isSecondFactorAuth {
audience = tokenAudienceWebAdminPartial
}
- err := createAndSetCookie(w, r, c, s.tokenAuth, audience, ipAddr)
+ err := c.createAndSetCookie(w, r, s.tokenAuth, audience, ipAddr)
if err != nil {
logger.Warn(logSender, "", "unable to set admin login cookie %v", err)
if errorFunc == nil {
- s.renderAdminSetupPage(w, r, admin.Username, util.NewI18nError(err, util.I18nError500Message))
+ s.renderAdminSetupPage(w, r, admin.Username, ipAddr, util.NewI18nError(err, util.I18nError500Message))
return
}
- errorFunc(w, r, util.NewI18nError(err, util.I18nError500Message))
+ errorFunc(w, r, util.NewI18nError(err, util.I18nError500Message), ipAddr)
return
}
- invalidateToken(r)
+ if isSecondFactorAuth {
+ invalidateToken(r)
+ }
if audience == tokenAudienceWebAdminPartial {
http.Redirect(w, r, webAdminTwoFactorPath, http.StatusFound)
return
@@ -836,52 +842,52 @@ func (s *httpdServer) getUserToken(w http.ResponseWriter, r *http.Request) {
protocol := common.ProtocolHTTP
if !ok {
updateLoginMetrics(&dataprovider.User{BaseUser: sdk.BaseUser{Username: username}},
- dataprovider.LoginMethodPassword, ipAddr, common.ErrNoCredentials, r)
+ dataprovider.LoginMethodPassword, ipAddr, common.ErrNoCredentials)
w.Header().Set(common.HTTPAuthenticationHeader, basicRealm)
sendAPIResponse(w, r, nil, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
return
}
- if username == "" || strings.TrimSpace(password) == "" {
+ if username == "" || password == "" {
updateLoginMetrics(&dataprovider.User{BaseUser: sdk.BaseUser{Username: username}},
- dataprovider.LoginMethodPassword, ipAddr, common.ErrNoCredentials, r)
+ dataprovider.LoginMethodPassword, ipAddr, common.ErrNoCredentials)
w.Header().Set(common.HTTPAuthenticationHeader, basicRealm)
sendAPIResponse(w, r, nil, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
return
}
if err := common.Config.ExecutePostConnectHook(ipAddr, protocol); err != nil {
updateLoginMetrics(&dataprovider.User{BaseUser: sdk.BaseUser{Username: username}},
- dataprovider.LoginMethodPassword, ipAddr, err, r)
+ dataprovider.LoginMethodPassword, ipAddr, err)
sendAPIResponse(w, r, err, http.StatusText(http.StatusForbidden), http.StatusForbidden)
return
}
user, err := dataprovider.CheckUserAndPass(username, password, ipAddr, protocol)
if err != nil {
w.Header().Set(common.HTTPAuthenticationHeader, basicRealm)
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, err, r)
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, err)
sendAPIResponse(w, r, dataprovider.ErrInvalidCredentials, http.StatusText(http.StatusUnauthorized),
http.StatusUnauthorized)
return
}
connectionID := fmt.Sprintf("%v_%v", protocol, xid.New().String())
- if err := checkHTTPClientUser(&user, r, connectionID, true, false); err != nil {
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, err, r)
+ if err := checkHTTPClientUser(&user, r, connectionID, true); err != nil {
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, err)
sendAPIResponse(w, r, err, http.StatusText(http.StatusForbidden), http.StatusForbidden)
return
}
- if user.Filters.TOTPConfig.Enabled && slices.Contains(user.Filters.TOTPConfig.Protocols, common.ProtocolHTTP) {
+ if user.Filters.TOTPConfig.Enabled && util.Contains(user.Filters.TOTPConfig.Protocols, common.ProtocolHTTP) {
passcode := r.Header.Get(otpHeaderCode)
if passcode == "" {
logger.Debug(logSender, "", "TOTP enabled for user %q and not passcode provided, authentication refused", user.Username)
w.Header().Set(common.HTTPAuthenticationHeader, basicRealm)
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, dataprovider.ErrInvalidCredentials, r)
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, dataprovider.ErrInvalidCredentials)
sendAPIResponse(w, r, dataprovider.ErrInvalidCredentials, http.StatusText(http.StatusUnauthorized),
http.StatusUnauthorized)
return
}
err = user.Filters.TOTPConfig.Secret.Decrypt()
if err != nil {
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, common.ErrInternalFailure, r)
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, common.ErrInternalFailure)
sendAPIResponse(w, r, fmt.Errorf("unable to decrypt TOTP secret: %w", err), http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
return
}
@@ -890,7 +896,7 @@ func (s *httpdServer) getUserToken(w http.ResponseWriter, r *http.Request) {
if !match || err != nil {
logger.Debug(logSender, "invalid passcode for user %q, match? %v, err: %v", user.Username, match, err)
w.Header().Set(common.HTTPAuthenticationHeader, basicRealm)
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, dataprovider.ErrInvalidCredentials, r)
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, dataprovider.ErrInvalidCredentials)
sendAPIResponse(w, r, dataprovider.ErrInvalidCredentials, http.StatusText(http.StatusUnauthorized),
http.StatusUnauthorized)
return
@@ -901,7 +907,7 @@ func (s *httpdServer) getUserToken(w http.ResponseWriter, r *http.Request) {
err = user.CheckFsRoot(connectionID)
if err != nil {
logger.Warn(logSender, connectionID, "unable to check fs root: %v", err)
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, common.ErrInternalFailure, r)
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, common.ErrInternalFailure)
sendAPIResponse(w, r, err, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
return
}
@@ -910,26 +916,26 @@ func (s *httpdServer) getUserToken(w http.ResponseWriter, r *http.Request) {
}
func (s *httpdServer) generateAndSendUserToken(w http.ResponseWriter, r *http.Request, ipAddr string, user dataprovider.User) {
- c := &jwt.Claims{
+ c := jwtTokenClaims{
Username: user.Username,
Permissions: user.Filters.WebClient,
+ Signature: user.GetSignature(),
Role: user.Role,
MustSetTwoFactorAuth: user.MustSetSecondFactor(),
MustChangePassword: user.MustChangePassword(),
RequiredTwoFactorProtocols: user.Filters.TwoFactorAuthProtocols,
}
- c.Subject = user.GetSignature()
- token, err := s.tokenAuth.SignWithParams(c, tokenAudienceAPIUser, ipAddr, getTokenDuration(tokenAudienceAPIUser))
+ resp, err := c.createTokenResponse(s.tokenAuth, tokenAudienceAPIUser, ipAddr)
if err != nil {
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, common.ErrInternalFailure, r)
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, common.ErrInternalFailure)
sendAPIResponse(w, r, err, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
return
}
- updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, err, r)
+ updateLoginMetrics(&user, dataprovider.LoginMethodPassword, ipAddr, err)
dataprovider.UpdateLastLogin(&user)
- render.JSON(w, r, c.BuildTokenResponse(token))
+ render.JSON(w, r, resp)
}
func (s *httpdServer) getToken(w http.ResponseWriter, r *http.Request) {
@@ -942,10 +948,9 @@ func (s *httpdServer) getToken(w http.ResponseWriter, r *http.Request) {
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
admin, err := dataprovider.CheckAdminAndPass(username, password, ipAddr)
if err != nil {
- handleDefenderEventLoginFailed(ipAddr, err) //nolint:errcheck
+ err = handleDefenderEventLoginFailed(ipAddr, err)
w.Header().Set(common.HTTPAuthenticationHeader, basicRealm)
- sendAPIResponse(w, r, dataprovider.ErrInvalidCredentials, http.StatusText(http.StatusUnauthorized),
- http.StatusUnauthorized)
+ sendAPIResponse(w, r, err, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
return
}
if admin.Filters.TOTPConfig.Enabled {
@@ -979,16 +984,17 @@ func (s *httpdServer) getToken(w http.ResponseWriter, r *http.Request) {
}
func (s *httpdServer) generateAndSendToken(w http.ResponseWriter, r *http.Request, admin dataprovider.Admin, ip string) {
- c := &jwt.Claims{
+ c := jwtTokenClaims{
Username: admin.Username,
Permissions: admin.Permissions,
Role: admin.Role,
+ Signature: admin.GetSignature(),
MustSetTwoFactorAuth: admin.Filters.RequireTwoFactor && !admin.Filters.TOTPConfig.Enabled,
MustChangePassword: admin.Filters.RequirePasswordChange,
}
- c.Subject = admin.GetSignature()
- token, err := s.tokenAuth.SignWithParams(c, tokenAudienceAPI, ip, getTokenDuration(tokenAudienceAPI))
+ resp, err := c.createTokenResponse(s.tokenAuth, tokenAudienceAPI, ip)
+
if err != nil {
sendAPIResponse(w, r, err, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
return
@@ -996,39 +1002,38 @@ func (s *httpdServer) generateAndSendToken(w http.ResponseWriter, r *http.Reques
dataprovider.UpdateAdminLastLogin(&admin)
common.DelayLogin(nil)
- render.JSON(w, r, c.BuildTokenResponse(token))
+ render.JSON(w, r, resp)
}
func (s *httpdServer) checkCookieExpiration(w http.ResponseWriter, r *http.Request) {
if _, ok := r.Context().Value(oidcTokenKey).(string); ok {
return
}
- claims, err := jwt.FromContext(r.Context())
+ token, claims, err := jwtauth.FromContext(r.Context())
if err != nil {
return
}
- if claims.Username == "" || claims.Subject == "" {
+ tokenClaims := jwtTokenClaims{}
+ tokenClaims.Decode(claims)
+ if tokenClaims.Username == "" || tokenClaims.Signature == "" {
return
}
- if time.Until(claims.Expiry.Time()) > cookieRefreshThreshold {
+ if time.Until(token.Expiration()) > tokenRefreshThreshold {
return
}
- if (time.Since(claims.IssuedAt.Time()) + cookieTokenDuration) > maxTokenDuration {
- return
- }
- if claims.Audience.Contains(tokenAudienceWebClient) {
- s.refreshClientToken(w, r, claims)
+ if util.Contains(token.Audience(), tokenAudienceWebClient) {
+ s.refreshClientToken(w, r, tokenClaims)
} else {
- s.refreshAdminToken(w, r, claims)
+ s.refreshAdminToken(w, r, tokenClaims)
}
}
-func (s *httpdServer) refreshClientToken(w http.ResponseWriter, r *http.Request, tokenClaims *jwt.Claims) {
+func (s *httpdServer) refreshClientToken(w http.ResponseWriter, r *http.Request, tokenClaims jwtTokenClaims) {
user, err := dataprovider.GetUserWithGroupSettings(tokenClaims.Username, "")
if err != nil {
return
}
- if user.GetSignature() != tokenClaims.Subject {
+ if user.GetSignature() != tokenClaims.Signature {
logger.Debug(logSender, "", "signature mismatch for user %q, unable to refresh cookie", user.Username)
return
}
@@ -1036,7 +1041,7 @@ func (s *httpdServer) refreshClientToken(w http.ResponseWriter, r *http.Request,
logger.Debug(logSender, "", "unable to refresh cookie for user %q: %v", user.Username, err)
return
}
- if err := checkHTTPClientUser(&user, r, xid.New().String(), true, false); err != nil {
+ if err := checkHTTPClientUser(&user, r, xid.New().String(), true); err != nil {
logger.Debug(logSender, "", "unable to refresh cookie for user %q: %v", user.Username, err)
return
}
@@ -1044,15 +1049,15 @@ func (s *httpdServer) refreshClientToken(w http.ResponseWriter, r *http.Request,
tokenClaims.Permissions = user.Filters.WebClient
tokenClaims.Role = user.Role
logger.Debug(logSender, "", "cookie refreshed for user %q", user.Username)
- createAndSetCookie(w, r, tokenClaims, s.tokenAuth, tokenAudienceWebClient, util.GetIPFromRemoteAddress(r.RemoteAddr)) //nolint:errcheck
+ tokenClaims.createAndSetCookie(w, r, s.tokenAuth, tokenAudienceWebClient, util.GetIPFromRemoteAddress(r.RemoteAddr)) //nolint:errcheck
}
-func (s *httpdServer) refreshAdminToken(w http.ResponseWriter, r *http.Request, tokenClaims *jwt.Claims) {
+func (s *httpdServer) refreshAdminToken(w http.ResponseWriter, r *http.Request, tokenClaims jwtTokenClaims) {
admin, err := dataprovider.AdminExists(tokenClaims.Username)
if err != nil {
return
}
- if admin.GetSignature() != tokenClaims.Subject {
+ if admin.GetSignature() != tokenClaims.Signature {
logger.Debug(logSender, "", "signature mismatch for admin %q, unable to refresh cookie", admin.Username)
return
}
@@ -1065,18 +1070,18 @@ func (s *httpdServer) refreshAdminToken(w http.ResponseWriter, r *http.Request,
tokenClaims.Role = admin.Role
tokenClaims.HideUserPageSections = admin.Filters.Preferences.HideUserPageSections
logger.Debug(logSender, "", "cookie refreshed for admin %q", admin.Username)
- createAndSetCookie(w, r, tokenClaims, s.tokenAuth, tokenAudienceWebAdmin, ipAddr) //nolint:errcheck
+ tokenClaims.createAndSetCookie(w, r, s.tokenAuth, tokenAudienceWebAdmin, ipAddr) //nolint:errcheck
}
func (s *httpdServer) updateContextFromCookie(r *http.Request) *http.Request {
- _, err := jwt.FromContext(r.Context())
- if err != nil {
- _, err = r.Cookie(jwt.CookieKey)
+ token, _, err := jwtauth.FromContext(r.Context())
+ if token == nil || err != nil {
+ _, err = r.Cookie(jwtCookieKey)
if err != nil {
return r
}
- token, err := jwt.VerifyRequest(s.tokenAuth, r, jwt.TokenFromCookie)
- ctx := jwt.NewContext(r.Context(), token, err)
+ token, err = jwtauth.VerifyRequest(s.tokenAuth, r, jwtauth.TokenFromCookie)
+ ctx := jwtauth.NewContext(r.Context(), token, err)
return r.WithContext(ctx)
}
return r
@@ -1084,11 +1089,6 @@ func (s *httpdServer) updateContextFromCookie(r *http.Request) *http.Request {
func (s *httpdServer) parseHeaders(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
- responseControllerDeadlines(
- http.NewResponseController(w),
- time.Now().Add(60*time.Second),
- time.Now().Add(60*time.Second),
- )
w.Header().Set("Server", version.GetServerVersion("/", false))
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
var ip net.IP
@@ -1190,9 +1190,8 @@ func (s *httpdServer) badHostHandler(w http.ResponseWriter, r *http.Request) {
break
}
}
- logger.Debug(logSender, "", "the host %q is not allowed", host)
s.sendForbiddenResponse(w, r, util.NewI18nError(
- util.NewGenericError(http.StatusText(http.StatusForbidden)),
+ util.NewGenericError(fmt.Sprintf("The host %q is not allowed", host)),
util.I18nErrorConnectionForbidden,
))
}
@@ -1234,18 +1233,9 @@ func (s *httpdServer) mustCheckPath(r *http.Request) bool {
return !strings.HasPrefix(urlPath, webStaticFilesPath) && !strings.HasPrefix(urlPath, acmeChallengeURI)
}
-func (s *httpdServer) initializeRouter() error {
- signer, err := jwt.NewSigner(jose.HS256, getSigningKey(s.signingPassphrase))
- if err != nil {
- return err
- }
- csrfSigner, err := jwt.NewSigner(jose.HS256, getSigningKey(s.signingPassphrase))
- if err != nil {
- return err
- }
+func (s *httpdServer) initializeRouter() {
var hasHTTPSRedirect bool
- s.tokenAuth = signer
- s.csrfTokenAuth = csrfSigner
+ s.tokenAuth = jwtauth.New(jwa.HS256.String(), getSigningKey(s.signingPassphrase), nil)
s.router = chi.NewRouter()
s.router.Use(middleware.RequestID)
@@ -1254,20 +1244,17 @@ func (s *httpdServer) initializeRouter() error {
s.router.Use(middleware.Recoverer)
if s.binding.Security.Enabled {
secureMiddleware := secure.New(secure.Options{
- AllowedHosts: s.binding.Security.AllowedHosts,
- AllowedHostsAreRegex: s.binding.Security.AllowedHostsAreRegex,
- HostsProxyHeaders: s.binding.Security.HostsProxyHeaders,
- SSLProxyHeaders: s.binding.Security.getHTTPSProxyHeaders(),
- STSSeconds: s.binding.Security.STSSeconds,
- STSIncludeSubdomains: s.binding.Security.STSIncludeSubdomains,
- STSPreload: s.binding.Security.STSPreload,
- ContentTypeNosniff: s.binding.Security.ContentTypeNosniff,
- ContentSecurityPolicy: s.binding.Security.ContentSecurityPolicy,
- PermissionsPolicy: s.binding.Security.PermissionsPolicy,
- CrossOriginOpenerPolicy: s.binding.Security.CrossOriginOpenerPolicy,
- CrossOriginResourcePolicy: s.binding.Security.CrossOriginResourcePolicy,
- CrossOriginEmbedderPolicy: s.binding.Security.CrossOriginEmbedderPolicy,
- ReferrerPolicy: s.binding.Security.ReferrerPolicy,
+ AllowedHosts: s.binding.Security.AllowedHosts,
+ AllowedHostsAreRegex: s.binding.Security.AllowedHostsAreRegex,
+ HostsProxyHeaders: s.binding.Security.HostsProxyHeaders,
+ SSLProxyHeaders: s.binding.Security.getHTTPSProxyHeaders(),
+ STSSeconds: s.binding.Security.STSSeconds,
+ STSIncludeSubdomains: s.binding.Security.STSIncludeSubdomains,
+ STSPreload: s.binding.Security.STSPreload,
+ ContentTypeNosniff: s.binding.Security.ContentTypeNosniff,
+ ContentSecurityPolicy: s.binding.Security.ContentSecurityPolicy,
+ PermissionsPolicy: s.binding.Security.PermissionsPolicy,
+ CrossOriginOpenerPolicy: s.binding.Security.CrossOriginOpenerPolicy,
})
secureMiddleware.SetBadHostHandler(http.HandlerFunc(s.badHostHandler))
if s.binding.Security.CacheControl == "private" {
@@ -1309,57 +1296,24 @@ func (s *httpdServer) initializeRouter() error {
}
}
- s.setupRESTAPIRoutes()
-
- if s.enableWebAdmin || s.enableWebClient {
- s.router.Group(func(router chi.Router) {
- router.Use(cleanCacheControlMiddleware)
- router.Use(compressor.Handler)
- serveStaticDir(router, webStaticFilesPath, s.staticFilesPath, true)
- })
- if s.binding.OIDC.isEnabled() {
- s.router.Get(webOIDCRedirectPath, s.handleOIDCRedirect)
- }
- if s.enableWebClient {
- s.router.Get(webRootPath, func(w http.ResponseWriter, r *http.Request) {
- r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- s.redirectToWebPath(w, r, webClientLoginPath)
- })
- s.router.Get(webBasePath, func(w http.ResponseWriter, r *http.Request) {
- r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- s.redirectToWebPath(w, r, webClientLoginPath)
- })
- } else {
- s.router.Get(webRootPath, func(w http.ResponseWriter, r *http.Request) {
- r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- s.redirectToWebPath(w, r, webAdminLoginPath)
- })
- s.router.Get(webBasePath, func(w http.ResponseWriter, r *http.Request) {
- r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- s.redirectToWebPath(w, r, webAdminLoginPath)
- })
- }
- }
-
- s.setupWebClientRoutes()
- s.setupWebAdminRoutes()
- return nil
-}
-
-func (s *httpdServer) setupRESTAPIRoutes() {
if s.enableRESTAPI {
- if !s.binding.isAdminTokenEndpointDisabled() {
- s.router.Get(tokenPath, s.getToken)
- s.router.Post(adminPath+"/{username}/forgot-password", forgotAdminPassword)
- s.router.Post(adminPath+"/{username}/reset-password", resetAdminPassword)
- }
+ // share API available to external users
+ s.router.Get(sharesPath+"/{id}", s.downloadFromShare) //nolint:goconst
+ s.router.Post(sharesPath+"/{id}", s.uploadFilesToShare)
+ s.router.Post(sharesPath+"/{id}/{name}", s.uploadFileToShare)
+ s.router.With(compressor.Handler).Get(sharesPath+"/{id}/dirs", s.readBrowsableShareContents)
+ s.router.Get(sharesPath+"/{id}/files", s.downloadBrowsableSharedFile)
+
+ s.router.Get(tokenPath, s.getToken)
+ s.router.Post(adminPath+"/{username}/forgot-password", forgotAdminPassword)
+ s.router.Post(adminPath+"/{username}/reset-password", resetAdminPassword)
+ s.router.Post(userPath+"/{username}/forgot-password", forgotUserPassword)
+ s.router.Post(userPath+"/{username}/reset-password", resetUserPassword)
s.router.Group(func(router chi.Router) {
router.Use(checkNodeToken(s.tokenAuth))
- if !s.binding.isAdminAPIKeyAuthDisabled() {
- router.Use(checkAPIKeyAuth(s.tokenAuth, dataprovider.APIKeyScopeAdmin))
- }
- router.Use(jwt.Verify(s.tokenAuth, jwt.TokenFromHeader))
+ router.Use(checkAPIKeyAuth(s.tokenAuth, dataprovider.APIKeyScopeAdmin))
+ router.Use(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromHeader))
router.Use(jwtAuthenticatorAPI)
router.Get(versionPath, func(w http.ResponseWriter, r *http.Request) {
@@ -1379,116 +1333,105 @@ func (s *httpdServer) setupRESTAPIRoutes() {
router.With(forbidAPIKeyAuthentication).Get(admin2FARecoveryCodesPath, getRecoveryCodes)
router.With(forbidAPIKeyAuthentication).Post(admin2FARecoveryCodesPath, generateRecoveryCodes)
- router.With(forbidAPIKeyAuthentication, s.checkPerms(dataprovider.PermAdminAny)).
+ router.With(forbidAPIKeyAuthentication, s.checkPerm(dataprovider.PermAdminAny)).
Get(apiKeysPath, getAPIKeys)
- router.With(forbidAPIKeyAuthentication, s.checkPerms(dataprovider.PermAdminAny)).
+ router.With(forbidAPIKeyAuthentication, s.checkPerm(dataprovider.PermAdminAny)).
Post(apiKeysPath, addAPIKey)
- router.With(forbidAPIKeyAuthentication, s.checkPerms(dataprovider.PermAdminAny)).
+ router.With(forbidAPIKeyAuthentication, s.checkPerm(dataprovider.PermAdminAny)).
Get(apiKeysPath+"/{id}", getAPIKeyByID)
- router.With(forbidAPIKeyAuthentication, s.checkPerms(dataprovider.PermAdminAny)).
+ router.With(forbidAPIKeyAuthentication, s.checkPerm(dataprovider.PermAdminAny)).
Put(apiKeysPath+"/{id}", updateAPIKey)
- router.With(forbidAPIKeyAuthentication, s.checkPerms(dataprovider.PermAdminAny)).
+ router.With(forbidAPIKeyAuthentication, s.checkPerm(dataprovider.PermAdminAny)).
Delete(apiKeysPath+"/{id}", deleteAPIKey)
router.Group(func(router chi.Router) {
router.Use(s.checkAuthRequirements)
- router.With(s.checkPerms(dataprovider.PermAdminViewServerStatus)).
+ router.With(s.checkPerm(dataprovider.PermAdminViewServerStatus)).
Get(serverStatusPath, func(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
render.JSON(w, r, getServicesStatus())
})
- router.With(s.checkPerms(dataprovider.PermAdminViewConnections)).Get(activeConnectionsPath, getActiveConnections)
- router.With(s.checkPerms(dataprovider.PermAdminCloseConnections)).
+ router.With(s.checkPerm(dataprovider.PermAdminViewConnections)).Get(activeConnectionsPath, getActiveConnections)
+ router.With(s.checkPerm(dataprovider.PermAdminCloseConnections)).
Delete(activeConnectionsPath+"/{connectionID}", handleCloseConnection)
- router.With(s.checkPerms(dataprovider.PermAdminQuotaScans)).Get(quotasBasePath+"/users/scans", getUsersQuotaScans)
- router.With(s.checkPerms(dataprovider.PermAdminQuotaScans)).Post(quotasBasePath+"/users/{username}/scan", startUserQuotaScan)
- router.With(s.checkPerms(dataprovider.PermAdminQuotaScans)).Get(quotasBasePath+"/folders/scans", getFoldersQuotaScans)
- router.With(s.checkPerms(dataprovider.PermAdminQuotaScans)).Post(quotasBasePath+"/folders/{name}/scan", startFolderQuotaScan)
- router.With(s.checkPerms(dataprovider.PermAdminViewUsers)).Get(userPath, getUsers)
- router.With(s.checkPerms(dataprovider.PermAdminAddUsers)).Post(userPath, addUser)
- router.With(s.checkPerms(dataprovider.PermAdminViewUsers)).Get(userPath+"/{username}", getUserByUsername) //nolint:goconst
- router.With(s.checkPerms(dataprovider.PermAdminChangeUsers)).Put(userPath+"/{username}", updateUser)
- router.With(s.checkPerms(dataprovider.PermAdminDeleteUsers)).Delete(userPath+"/{username}", deleteUser)
- router.With(s.checkPerms(dataprovider.PermAdminDisableMFA)).Put(userPath+"/{username}/2fa/disable", disableUser2FA) //nolint:goconst
- router.With(s.checkPerms(dataprovider.PermAdminManageFolders)).Get(folderPath, getFolders)
- router.With(s.checkPerms(dataprovider.PermAdminManageFolders)).Get(folderPath+"/{name}", getFolderByName) //nolint:goconst
- router.With(s.checkPerms(dataprovider.PermAdminManageFolders)).Post(folderPath, addFolder)
- router.With(s.checkPerms(dataprovider.PermAdminManageFolders)).Put(folderPath+"/{name}", updateFolder)
- router.With(s.checkPerms(dataprovider.PermAdminManageFolders)).Delete(folderPath+"/{name}", deleteFolder)
- router.With(s.checkPerms(dataprovider.PermAdminManageGroups)).Get(groupPath, getGroups)
- router.With(s.checkPerms(dataprovider.PermAdminManageGroups)).Get(groupPath+"/{name}", getGroupByName)
- router.With(s.checkPerms(dataprovider.PermAdminManageGroups)).Post(groupPath, addGroup)
- router.With(s.checkPerms(dataprovider.PermAdminManageGroups)).Put(groupPath+"/{name}", updateGroup)
- router.With(s.checkPerms(dataprovider.PermAdminManageGroups)).Delete(groupPath+"/{name}", deleteGroup)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Get(dumpDataPath, dumpData)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Get(loadDataPath, loadData)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(loadDataPath, loadDataFromRequest)
- router.With(s.checkPerms(dataprovider.PermAdminChangeUsers)).Put(quotasBasePath+"/users/{username}/usage",
+ router.With(s.checkPerm(dataprovider.PermAdminQuotaScans)).Get(quotasBasePath+"/users/scans", getUsersQuotaScans)
+ router.With(s.checkPerm(dataprovider.PermAdminQuotaScans)).Post(quotasBasePath+"/users/{username}/scan", startUserQuotaScan)
+ router.With(s.checkPerm(dataprovider.PermAdminQuotaScans)).Get(quotasBasePath+"/folders/scans", getFoldersQuotaScans)
+ router.With(s.checkPerm(dataprovider.PermAdminQuotaScans)).Post(quotasBasePath+"/folders/{name}/scan", startFolderQuotaScan)
+ router.With(s.checkPerm(dataprovider.PermAdminViewUsers)).Get(userPath, getUsers)
+ router.With(s.checkPerm(dataprovider.PermAdminAddUsers)).Post(userPath, addUser)
+ router.With(s.checkPerm(dataprovider.PermAdminViewUsers)).Get(userPath+"/{username}", getUserByUsername) //nolint:goconst
+ router.With(s.checkPerm(dataprovider.PermAdminChangeUsers)).Put(userPath+"/{username}", updateUser)
+ router.With(s.checkPerm(dataprovider.PermAdminDeleteUsers)).Delete(userPath+"/{username}", deleteUser)
+ router.With(s.checkPerm(dataprovider.PermAdminDisableMFA)).Put(userPath+"/{username}/2fa/disable", disableUser2FA) //nolint:goconst
+ router.With(s.checkPerm(dataprovider.PermAdminManageFolders)).Get(folderPath, getFolders)
+ router.With(s.checkPerm(dataprovider.PermAdminManageFolders)).Get(folderPath+"/{name}", getFolderByName) //nolint:goconst
+ router.With(s.checkPerm(dataprovider.PermAdminManageFolders)).Post(folderPath, addFolder)
+ router.With(s.checkPerm(dataprovider.PermAdminManageFolders)).Put(folderPath+"/{name}", updateFolder)
+ router.With(s.checkPerm(dataprovider.PermAdminManageFolders)).Delete(folderPath+"/{name}", deleteFolder)
+ router.With(s.checkPerm(dataprovider.PermAdminManageGroups)).Get(groupPath, getGroups)
+ router.With(s.checkPerm(dataprovider.PermAdminManageGroups)).Get(groupPath+"/{name}", getGroupByName)
+ router.With(s.checkPerm(dataprovider.PermAdminManageGroups)).Post(groupPath, addGroup)
+ router.With(s.checkPerm(dataprovider.PermAdminManageGroups)).Put(groupPath+"/{name}", updateGroup)
+ router.With(s.checkPerm(dataprovider.PermAdminManageGroups)).Delete(groupPath+"/{name}", deleteGroup)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Get(dumpDataPath, dumpData)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Get(loadDataPath, loadData)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(loadDataPath, loadDataFromRequest)
+ router.With(s.checkPerm(dataprovider.PermAdminChangeUsers)).Put(quotasBasePath+"/users/{username}/usage",
updateUserQuotaUsage)
- router.With(s.checkPerms(dataprovider.PermAdminChangeUsers)).Put(quotasBasePath+"/users/{username}/transfer-usage",
+ router.With(s.checkPerm(dataprovider.PermAdminChangeUsers)).Put(quotasBasePath+"/users/{username}/transfer-usage",
updateUserTransferQuotaUsage)
- router.With(s.checkPerms(dataprovider.PermAdminChangeUsers)).Put(quotasBasePath+"/folders/{name}/usage",
+ router.With(s.checkPerm(dataprovider.PermAdminChangeUsers)).Put(quotasBasePath+"/folders/{name}/usage",
updateFolderQuotaUsage)
- router.With(s.checkPerms(dataprovider.PermAdminViewDefender)).Get(defenderHosts, getDefenderHosts)
- router.With(s.checkPerms(dataprovider.PermAdminViewDefender)).Get(defenderHosts+"/{id}", getDefenderHostByID)
- router.With(s.checkPerms(dataprovider.PermAdminManageDefender)).Delete(defenderHosts+"/{id}", deleteDefenderHostByID)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Get(adminPath, getAdmins)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(adminPath, addAdmin)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Get(adminPath+"/{username}", getAdminByUsername)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Put(adminPath+"/{username}", updateAdmin)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Delete(adminPath+"/{username}", deleteAdmin)
- router.With(s.checkPerms(dataprovider.PermAdminDisableMFA)).Put(adminPath+"/{username}/2fa/disable", disableAdmin2FA)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Get(retentionChecksPath, getRetentionChecks)
- router.With(s.checkPerms(dataprovider.PermAdminViewEvents), compressor.Handler).
+ router.With(s.checkPerm(dataprovider.PermAdminViewDefender)).Get(defenderHosts, getDefenderHosts)
+ router.With(s.checkPerm(dataprovider.PermAdminViewDefender)).Get(defenderHosts+"/{id}", getDefenderHostByID)
+ router.With(s.checkPerm(dataprovider.PermAdminManageDefender)).Delete(defenderHosts+"/{id}", deleteDefenderHostByID)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Get(adminPath, getAdmins)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(adminPath, addAdmin)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Get(adminPath+"/{username}", getAdminByUsername)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Put(adminPath+"/{username}", updateAdmin)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Delete(adminPath+"/{username}", deleteAdmin)
+ router.With(s.checkPerm(dataprovider.PermAdminDisableMFA)).Put(adminPath+"/{username}/2fa/disable", disableAdmin2FA)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Get(retentionChecksPath, getRetentionChecks)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(retentionBasePath+"/{username}/check",
+ startRetentionCheck)
+ router.With(s.checkPerm(dataprovider.PermAdminViewEvents), compressor.Handler).
Get(fsEventsPath, searchFsEvents)
- router.With(s.checkPerms(dataprovider.PermAdminViewEvents), compressor.Handler).
+ router.With(s.checkPerm(dataprovider.PermAdminViewEvents), compressor.Handler).
Get(providerEventsPath, searchProviderEvents)
- router.With(s.checkPerms(dataprovider.PermAdminViewEvents), compressor.Handler).
+ router.With(s.checkPerm(dataprovider.PermAdminViewEvents), compressor.Handler).
Get(logEventsPath, searchLogEvents)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Get(eventActionsPath, getEventActions)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Get(eventActionsPath+"/{name}", getEventActionByName)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(eventActionsPath, addEventAction)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Put(eventActionsPath+"/{name}", updateEventAction)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Delete(eventActionsPath+"/{name}", deleteEventAction)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Get(eventRulesPath, getEventRules)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Get(eventRulesPath+"/{name}", getEventRuleByName)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(eventRulesPath, addEventRule)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Put(eventRulesPath+"/{name}", updateEventRule)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Delete(eventRulesPath+"/{name}", deleteEventRule)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(eventRulesPath+"/run/{name}", runOnDemandRule)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Get(rolesPath, getRoles)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(rolesPath, addRole)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Get(rolesPath+"/{name}", getRoleByName)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Put(rolesPath+"/{name}", updateRole)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Delete(rolesPath+"/{name}", deleteRole)
- router.With(s.checkPerms(dataprovider.PermAdminAny), compressor.Handler).Get(ipListsPath+"/{type}", getIPListEntries) //nolint:goconst
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(ipListsPath+"/{type}", addIPListEntry)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Get(ipListsPath+"/{type}/{ipornet}", getIPListEntry) //nolint:goconst
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Put(ipListsPath+"/{type}/{ipornet}", updateIPListEntry)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Delete(ipListsPath+"/{type}/{ipornet}", deleteIPListEntry)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Get(eventActionsPath, getEventActions)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Get(eventActionsPath+"/{name}", getEventActionByName)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(eventActionsPath, addEventAction)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Put(eventActionsPath+"/{name}", updateEventAction)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Delete(eventActionsPath+"/{name}", deleteEventAction)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Get(eventRulesPath, getEventRules)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Get(eventRulesPath+"/{name}", getEventRuleByName)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(eventRulesPath, addEventRule)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Put(eventRulesPath+"/{name}", updateEventRule)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Delete(eventRulesPath+"/{name}", deleteEventRule)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(eventRulesPath+"/run/{name}", runOnDemandRule)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Get(rolesPath, getRoles)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(rolesPath, addRole)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Get(rolesPath+"/{name}", getRoleByName)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Put(rolesPath+"/{name}", updateRole)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Delete(rolesPath+"/{name}", deleteRole)
+ router.With(s.checkPerm(dataprovider.PermAdminAny), compressor.Handler).Get(ipListsPath+"/{type}", getIPListEntries) //nolint:goconst
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(ipListsPath+"/{type}", addIPListEntry)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Get(ipListsPath+"/{type}/{ipornet}", getIPListEntry) //nolint:goconst
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Put(ipListsPath+"/{type}/{ipornet}", updateIPListEntry)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Delete(ipListsPath+"/{type}/{ipornet}", deleteIPListEntry)
})
})
- // share API available to external users
- s.router.Get(sharesPath+"/{id}", s.downloadFromShare)
- s.router.Post(sharesPath+"/{id}", s.uploadFilesToShare)
- s.router.Post(sharesPath+"/{id}/{name}", s.uploadFileToShare)
- s.router.With(compressor.Handler).Get(sharesPath+"/{id}/dirs", s.readBrowsableShareContents)
- s.router.Get(sharesPath+"/{id}/files", s.downloadBrowsableSharedFile)
-
- if !s.binding.isUserTokenEndpointDisabled() {
- s.router.Get(userTokenPath, s.getUserToken)
- s.router.Post(userPath+"/{username}/forgot-password", forgotUserPassword)
- s.router.Post(userPath+"/{username}/reset-password", resetUserPassword)
- }
+ s.router.Get(userTokenPath, s.getUserToken)
s.router.Group(func(router chi.Router) {
- if !s.binding.isUserAPIKeyAuthDisabled() {
- router.Use(checkAPIKeyAuth(s.tokenAuth, dataprovider.APIKeyScopeUser))
- }
- router.Use(jwt.Verify(s.tokenAuth, jwt.TokenFromHeader))
+ router.Use(checkAPIKeyAuth(s.tokenAuth, dataprovider.APIKeyScopeUser))
+ router.Use(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromHeader))
router.Use(jwtAuthenticatorAPIUser)
router.With(forbidAPIKeyAuthentication).Get(userLogoutPath, s.logout)
@@ -1553,6 +1496,39 @@ func (s *httpdServer) setupRESTAPIRoutes() {
})
}
}
+
+ if s.enableWebAdmin || s.enableWebClient {
+ s.router.Group(func(router chi.Router) {
+ router.Use(cleanCacheControlMiddleware)
+ router.Use(compressor.Handler)
+ serveStaticDir(router, webStaticFilesPath, s.staticFilesPath, true)
+ })
+ if s.binding.OIDC.isEnabled() {
+ s.router.Get(webOIDCRedirectPath, s.handleOIDCRedirect)
+ }
+ if s.enableWebClient {
+ s.router.Get(webRootPath, func(w http.ResponseWriter, r *http.Request) {
+ r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
+ s.redirectToWebPath(w, r, webClientLoginPath)
+ })
+ s.router.Get(webBasePath, func(w http.ResponseWriter, r *http.Request) {
+ r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
+ s.redirectToWebPath(w, r, webClientLoginPath)
+ })
+ } else {
+ s.router.Get(webRootPath, func(w http.ResponseWriter, r *http.Request) {
+ r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
+ s.redirectToWebPath(w, r, webAdminLoginPath)
+ })
+ s.router.Get(webBasePath, func(w http.ResponseWriter, r *http.Request) {
+ r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
+ s.redirectToWebPath(w, r, webAdminLoginPath)
+ })
+ }
+ }
+
+ s.setupWebClientRoutes()
+ s.setupWebAdminRoutes()
}
func (s *httpdServer) setupWebClientRoutes() {
@@ -1561,48 +1537,32 @@ func (s *httpdServer) setupWebClientRoutes() {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
http.Redirect(w, r, webClientLoginPath, http.StatusFound)
})
- s.router.With(cleanCacheControlMiddleware).Get(path.Join(webStaticFilesPath, "branding/webclient/logo.png"),
- func(w http.ResponseWriter, r *http.Request) {
- r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- renderPNGImage(w, r, dbBrandingConfig.getWebClientLogo())
- })
- s.router.With(cleanCacheControlMiddleware).Get(path.Join(webStaticFilesPath, "branding/webclient/favicon.png"),
- func(w http.ResponseWriter, r *http.Request) {
- r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- renderPNGImage(w, r, dbBrandingConfig.getWebClientFavicon())
- })
s.router.Get(webClientLoginPath, s.handleClientWebLogin)
if s.binding.OIDC.isEnabled() && !s.binding.isWebClientOIDCLoginDisabled() {
s.router.Get(webClientOIDCLoginPath, s.handleWebClientOIDCLogin)
}
if !s.binding.isWebClientLoginFormDisabled() {
- s.router.With(jwt.Verify(s.csrfTokenAuth, jwt.TokenFromCookie)).
- Post(webClientLoginPath, s.handleWebClientLoginPost)
+ s.router.Post(webClientLoginPath, s.handleWebClientLoginPost)
s.router.Get(webClientForgotPwdPath, s.handleWebClientForgotPwd)
- s.router.With(jwt.Verify(s.csrfTokenAuth, jwt.TokenFromCookie)).
- Post(webClientForgotPwdPath, s.handleWebClientForgotPwdPost)
- s.router.With(jwt.Verify(s.csrfTokenAuth, jwt.TokenFromCookie)).
- Get(webClientResetPwdPath, s.handleWebClientPasswordReset)
- s.router.With(jwt.Verify(s.csrfTokenAuth, jwt.TokenFromCookie)).
- Post(webClientResetPwdPath, s.handleWebClientPasswordResetPost)
- s.router.With(jwt.Verify(s.tokenAuth, jwt.TokenFromCookie),
+ s.router.Post(webClientForgotPwdPath, s.handleWebClientForgotPwdPost)
+ s.router.Get(webClientResetPwdPath, s.handleWebClientPasswordReset)
+ s.router.Post(webClientResetPwdPath, s.handleWebClientPasswordResetPost)
+ s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
s.jwtAuthenticatorPartial(tokenAudienceWebClientPartial)).
Get(webClientTwoFactorPath, s.handleWebClientTwoFactor)
- s.router.With(jwt.Verify(s.tokenAuth, jwt.TokenFromCookie),
+ s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
s.jwtAuthenticatorPartial(tokenAudienceWebClientPartial)).
Post(webClientTwoFactorPath, s.handleWebClientTwoFactorPost)
- s.router.With(jwt.Verify(s.tokenAuth, jwt.TokenFromCookie),
+ s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
s.jwtAuthenticatorPartial(tokenAudienceWebClientPartial)).
Get(webClientTwoFactorRecoveryPath, s.handleWebClientTwoFactorRecovery)
- s.router.With(jwt.Verify(s.tokenAuth, jwt.TokenFromCookie),
+ s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
s.jwtAuthenticatorPartial(tokenAudienceWebClientPartial)).
Post(webClientTwoFactorRecoveryPath, s.handleWebClientTwoFactorRecoveryPost)
}
// share routes available to external users
s.router.Get(webClientPubSharesPath+"/{id}/login", s.handleClientShareLoginGet)
- s.router.With(jwt.Verify(s.csrfTokenAuth, jwt.TokenFromCookie)).
- Post(webClientPubSharesPath+"/{id}/login", s.handleClientShareLoginPost)
- s.router.Get(webClientPubSharesPath+"/{id}/logout", s.handleClientShareLogout)
+ s.router.Post(webClientPubSharesPath+"/{id}/login", s.handleClientShareLoginPost)
s.router.Get(webClientPubSharesPath+"/{id}", s.downloadFromShare)
s.router.Post(webClientPubSharesPath+"/{id}/partial", s.handleClientSharePartialDownload)
s.router.Get(webClientPubSharesPath+"/{id}/browse", s.handleShareGetFiles)
@@ -1619,32 +1579,32 @@ func (s *httpdServer) setupWebClientRoutes() {
if s.binding.OIDC.isEnabled() {
router.Use(s.oidcTokenAuthenticator(tokenAudienceWebClient))
}
- router.Use(jwt.Verify(s.tokenAuth, oidcTokenFromContext, jwt.TokenFromCookie))
+ router.Use(jwtauth.Verify(s.tokenAuth, tokenFromContext, jwtauth.TokenFromCookie))
router.Use(jwtAuthenticatorWebClient)
router.Get(webClientLogoutPath, s.handleWebClientLogout)
router.With(s.checkAuthRequirements, s.refreshCookie).Get(webClientFilesPath, s.handleClientGetFiles)
router.With(s.checkAuthRequirements, s.refreshCookie).Get(webClientViewPDFPath, s.handleClientViewPDF)
router.With(s.checkAuthRequirements, s.refreshCookie).Get(webClientGetPDFPath, s.handleClientGetPDF)
- router.With(s.checkAuthRequirements, s.refreshCookie, s.verifyCSRFHeader).Get(webClientFilePath, getUserFile)
- router.With(s.checkAuthRequirements, s.refreshCookie, s.verifyCSRFHeader).Get(webClientTasksPath+"/{id}",
+ router.With(s.checkAuthRequirements, s.refreshCookie, verifyCSRFHeader).Get(webClientFilePath, getUserFile)
+ router.With(s.checkAuthRequirements, s.refreshCookie, verifyCSRFHeader).Get(webClientTasksPath+"/{id}",
getWebTask)
- router.With(s.checkAuthRequirements, s.checkHTTPUserPerm(sdk.WebClientWriteDisabled), s.verifyCSRFHeader).
+ router.With(s.checkAuthRequirements, s.checkHTTPUserPerm(sdk.WebClientWriteDisabled), verifyCSRFHeader).
Post(webClientFilePath, uploadUserFile)
- router.With(s.checkAuthRequirements, s.checkHTTPUserPerm(sdk.WebClientWriteDisabled), s.verifyCSRFHeader).
+ router.With(s.checkAuthRequirements, s.checkHTTPUserPerm(sdk.WebClientWriteDisabled), verifyCSRFHeader).
Post(webClientExistPath, s.handleClientCheckExist)
router.With(s.checkAuthRequirements, s.refreshCookie).Get(webClientEditFilePath, s.handleClientEditFile)
- router.With(s.checkAuthRequirements, s.checkHTTPUserPerm(sdk.WebClientWriteDisabled), s.verifyCSRFHeader).
+ router.With(s.checkAuthRequirements, s.checkHTTPUserPerm(sdk.WebClientWriteDisabled), verifyCSRFHeader).
Delete(webClientFilesPath, deleteUserFile)
router.With(s.checkAuthRequirements, compressor.Handler, s.refreshCookie).
Get(webClientDirsPath, s.handleClientGetDirContents)
- router.With(s.checkAuthRequirements, s.checkHTTPUserPerm(sdk.WebClientWriteDisabled), s.verifyCSRFHeader).
+ router.With(s.checkAuthRequirements, s.checkHTTPUserPerm(sdk.WebClientWriteDisabled), verifyCSRFHeader).
Post(webClientDirsPath, createUserDir)
- router.With(s.checkAuthRequirements, s.checkHTTPUserPerm(sdk.WebClientWriteDisabled), s.verifyCSRFHeader).
+ router.With(s.checkAuthRequirements, s.checkHTTPUserPerm(sdk.WebClientWriteDisabled), verifyCSRFHeader).
Delete(webClientDirsPath, taskDeleteDir)
- router.With(s.checkAuthRequirements, s.checkHTTPUserPerm(sdk.WebClientWriteDisabled), s.verifyCSRFHeader).
+ router.With(s.checkAuthRequirements, s.checkHTTPUserPerm(sdk.WebClientWriteDisabled), verifyCSRFHeader).
Post(webClientFileActionsPath+"/move", taskRenameFsEntry)
- router.With(s.checkAuthRequirements, s.checkHTTPUserPerm(sdk.WebClientWriteDisabled), s.verifyCSRFHeader).
+ router.With(s.checkAuthRequirements, s.checkHTTPUserPerm(sdk.WebClientWriteDisabled), verifyCSRFHeader).
Post(webClientFileActionsPath+"/copy", taskCopyFsEntry)
router.With(s.checkAuthRequirements, s.refreshCookie).
Post(webClientDownloadZipPath, s.handleWebClientDownloadZip)
@@ -1660,15 +1620,15 @@ func (s *httpdServer) setupWebClientRoutes() {
Get(webClientMFAPath, s.handleWebClientMFA)
router.With(s.checkHTTPUserPerm(sdk.WebClientMFADisabled), s.refreshCookie).
Get(webClientMFAPath+"/qrcode", getQRCode)
- router.With(s.checkHTTPUserPerm(sdk.WebClientMFADisabled), s.verifyCSRFHeader).
+ router.With(s.checkHTTPUserPerm(sdk.WebClientMFADisabled), verifyCSRFHeader).
Post(webClientTOTPGeneratePath, generateTOTPSecret)
- router.With(s.checkHTTPUserPerm(sdk.WebClientMFADisabled), s.verifyCSRFHeader).
+ router.With(s.checkHTTPUserPerm(sdk.WebClientMFADisabled), verifyCSRFHeader).
Post(webClientTOTPValidatePath, validateTOTPPasscode)
- router.With(s.checkHTTPUserPerm(sdk.WebClientMFADisabled), s.verifyCSRFHeader).
+ router.With(s.checkHTTPUserPerm(sdk.WebClientMFADisabled), verifyCSRFHeader).
Post(webClientTOTPSavePath, saveTOTPConfig)
- router.With(s.checkHTTPUserPerm(sdk.WebClientMFADisabled), s.verifyCSRFHeader, s.refreshCookie).
+ router.With(s.checkHTTPUserPerm(sdk.WebClientMFADisabled), verifyCSRFHeader, s.refreshCookie).
Get(webClientRecoveryCodesPath, getRecoveryCodes)
- router.With(s.checkHTTPUserPerm(sdk.WebClientMFADisabled), s.verifyCSRFHeader).
+ router.With(s.checkHTTPUserPerm(sdk.WebClientMFADisabled), verifyCSRFHeader).
Post(webClientRecoveryCodesPath, generateRecoveryCodes)
router.With(s.checkAuthRequirements, s.checkHTTPUserPerm(sdk.WebClientSharesDisabled), compressor.Handler, s.refreshCookie).
Get(webClientSharesPath+jsonAPISuffix, getAllShares)
@@ -1682,7 +1642,7 @@ func (s *httpdServer) setupWebClientRoutes() {
Get(webClientSharePath+"/{id}", s.handleClientUpdateShareGet)
router.With(s.checkAuthRequirements, s.checkHTTPUserPerm(sdk.WebClientSharesDisabled)).
Post(webClientSharePath+"/{id}", s.handleClientUpdateSharePost)
- router.With(s.checkAuthRequirements, s.checkHTTPUserPerm(sdk.WebClientSharesDisabled), s.verifyCSRFHeader).
+ router.With(s.checkAuthRequirements, s.checkHTTPUserPerm(sdk.WebClientSharesDisabled), verifyCSRFHeader).
Delete(webClientSharePath+"/{id}", deleteShare)
})
}
@@ -1694,53 +1654,38 @@ func (s *httpdServer) setupWebAdminRoutes() {
r.Body = http.MaxBytesReader(w, r.Body, maxLoginBodySize)
s.redirectToWebPath(w, r, webAdminLoginPath)
})
- s.router.With(cleanCacheControlMiddleware).Get(path.Join(webStaticFilesPath, "branding/webadmin/logo.png"),
- func(w http.ResponseWriter, r *http.Request) {
- r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- renderPNGImage(w, r, dbBrandingConfig.getWebAdminLogo())
- })
- s.router.With(cleanCacheControlMiddleware).Get(path.Join(webStaticFilesPath, "branding/webadmin/favicon.png"),
- func(w http.ResponseWriter, r *http.Request) {
- r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- renderPNGImage(w, r, dbBrandingConfig.getWebAdminFavicon())
- })
s.router.Get(webAdminLoginPath, s.handleWebAdminLogin)
if s.binding.OIDC.hasRoles() && !s.binding.isWebAdminOIDCLoginDisabled() {
s.router.Get(webAdminOIDCLoginPath, s.handleWebAdminOIDCLogin)
}
s.router.Get(webOAuth2RedirectPath, s.handleOAuth2TokenRedirect)
s.router.Get(webAdminSetupPath, s.handleWebAdminSetupGet)
- s.router.With(jwt.Verify(s.csrfTokenAuth, jwt.TokenFromCookie)).
- Post(webAdminSetupPath, s.handleWebAdminSetupPost)
+ s.router.Post(webAdminSetupPath, s.handleWebAdminSetupPost)
if !s.binding.isWebAdminLoginFormDisabled() {
- s.router.With(jwt.Verify(s.csrfTokenAuth, jwt.TokenFromCookie)).
- Post(webAdminLoginPath, s.handleWebAdminLoginPost)
- s.router.With(jwt.Verify(s.tokenAuth, jwt.TokenFromCookie),
+ s.router.Post(webAdminLoginPath, s.handleWebAdminLoginPost)
+ s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
s.jwtAuthenticatorPartial(tokenAudienceWebAdminPartial)).
Get(webAdminTwoFactorPath, s.handleWebAdminTwoFactor)
- s.router.With(jwt.Verify(s.tokenAuth, jwt.TokenFromCookie),
+ s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
s.jwtAuthenticatorPartial(tokenAudienceWebAdminPartial)).
Post(webAdminTwoFactorPath, s.handleWebAdminTwoFactorPost)
- s.router.With(jwt.Verify(s.tokenAuth, jwt.TokenFromCookie),
+ s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
s.jwtAuthenticatorPartial(tokenAudienceWebAdminPartial)).
Get(webAdminTwoFactorRecoveryPath, s.handleWebAdminTwoFactorRecovery)
- s.router.With(jwt.Verify(s.tokenAuth, jwt.TokenFromCookie),
+ s.router.With(jwtauth.Verify(s.tokenAuth, jwtauth.TokenFromCookie),
s.jwtAuthenticatorPartial(tokenAudienceWebAdminPartial)).
Post(webAdminTwoFactorRecoveryPath, s.handleWebAdminTwoFactorRecoveryPost)
s.router.Get(webAdminForgotPwdPath, s.handleWebAdminForgotPwd)
- s.router.With(jwt.Verify(s.csrfTokenAuth, jwt.TokenFromCookie)).
- Post(webAdminForgotPwdPath, s.handleWebAdminForgotPwdPost)
- s.router.With(jwt.Verify(s.csrfTokenAuth, jwt.TokenFromCookie)).
- Get(webAdminResetPwdPath, s.handleWebAdminPasswordReset)
- s.router.With(jwt.Verify(s.csrfTokenAuth, jwt.TokenFromCookie)).
- Post(webAdminResetPwdPath, s.handleWebAdminPasswordResetPost)
+ s.router.Post(webAdminForgotPwdPath, s.handleWebAdminForgotPwdPost)
+ s.router.Get(webAdminResetPwdPath, s.handleWebAdminPasswordReset)
+ s.router.Post(webAdminResetPwdPath, s.handleWebAdminPasswordResetPost)
}
s.router.Group(func(router chi.Router) {
if s.binding.OIDC.isEnabled() {
router.Use(s.oidcTokenAuthenticator(tokenAudienceWebAdmin))
}
- router.Use(jwt.Verify(s.tokenAuth, oidcTokenFromContext, jwt.TokenFromCookie))
+ router.Use(jwtauth.Verify(s.tokenAuth, tokenFromContext, jwtauth.TokenFromCookie))
router.Use(jwtAuthenticatorWebAdmin)
router.Get(webLogoutPath, s.handleWebAdminLogout)
@@ -1752,168 +1697,167 @@ func (s *httpdServer) setupWebAdminRoutes() {
router.With(s.refreshCookie, s.requireBuiltinLogin).Get(webAdminMFAPath, s.handleWebAdminMFA)
router.With(s.refreshCookie, s.requireBuiltinLogin).Get(webAdminMFAPath+"/qrcode", getQRCode)
- router.With(s.verifyCSRFHeader, s.requireBuiltinLogin).Post(webAdminTOTPGeneratePath, generateTOTPSecret)
- router.With(s.verifyCSRFHeader, s.requireBuiltinLogin).Post(webAdminTOTPValidatePath, validateTOTPPasscode)
- router.With(s.verifyCSRFHeader, s.requireBuiltinLogin).Post(webAdminTOTPSavePath, saveTOTPConfig)
- router.With(s.verifyCSRFHeader, s.requireBuiltinLogin, s.refreshCookie).Get(webAdminRecoveryCodesPath,
+ router.With(verifyCSRFHeader, s.requireBuiltinLogin).Post(webAdminTOTPGeneratePath, generateTOTPSecret)
+ router.With(verifyCSRFHeader, s.requireBuiltinLogin).Post(webAdminTOTPValidatePath, validateTOTPPasscode)
+ router.With(verifyCSRFHeader, s.requireBuiltinLogin).Post(webAdminTOTPSavePath, saveTOTPConfig)
+ router.With(verifyCSRFHeader, s.requireBuiltinLogin, s.refreshCookie).Get(webAdminRecoveryCodesPath,
getRecoveryCodes)
- router.With(s.verifyCSRFHeader, s.requireBuiltinLogin).Post(webAdminRecoveryCodesPath, generateRecoveryCodes)
+ router.With(verifyCSRFHeader, s.requireBuiltinLogin).Post(webAdminRecoveryCodesPath, generateRecoveryCodes)
router.Group(func(router chi.Router) {
router.Use(s.checkAuthRequirements)
- router.With(s.checkPerms(dataprovider.PermAdminViewUsers), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminViewUsers), s.refreshCookie).
Get(webUsersPath, s.handleGetWebUsers)
- router.With(s.checkPerms(dataprovider.PermAdminViewUsers), compressor.Handler, s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminViewUsers), compressor.Handler, s.refreshCookie).
Get(webUsersPath+jsonAPISuffix, getAllUsers)
- router.With(s.checkPerms(dataprovider.PermAdminAddUsers), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAddUsers), s.refreshCookie).
Get(webUserPath, s.handleWebAddUserGet)
- router.With(s.checkPerms(dataprovider.PermAdminChangeUsers), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminChangeUsers), s.refreshCookie).
Get(webUserPath+"/{username}", s.handleWebUpdateUserGet)
- router.With(s.checkPerms(dataprovider.PermAdminAddUsers)).Post(webUserPath, s.handleWebAddUserPost)
- router.With(s.checkPerms(dataprovider.PermAdminChangeUsers)).Post(webUserPath+"/{username}",
+ router.With(s.checkPerm(dataprovider.PermAdminAddUsers)).Post(webUserPath, s.handleWebAddUserPost)
+ router.With(s.checkPerm(dataprovider.PermAdminChangeUsers)).Post(webUserPath+"/{username}",
s.handleWebUpdateUserPost)
- router.With(s.checkPerms(dataprovider.PermAdminManageGroups), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminManageGroups), s.refreshCookie).
Get(webGroupsPath, s.handleWebGetGroups)
- router.With(s.checkPerms(dataprovider.PermAdminManageGroups), compressor.Handler, s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminManageGroups), compressor.Handler, s.refreshCookie).
Get(webGroupsPath+jsonAPISuffix, getAllGroups)
- router.With(s.checkPerms(dataprovider.PermAdminManageGroups), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminManageGroups), s.refreshCookie).
Get(webGroupPath, s.handleWebAddGroupGet)
- router.With(s.checkPerms(dataprovider.PermAdminManageGroups)).Post(webGroupPath, s.handleWebAddGroupPost)
- router.With(s.checkPerms(dataprovider.PermAdminManageGroups), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminManageGroups)).Post(webGroupPath, s.handleWebAddGroupPost)
+ router.With(s.checkPerm(dataprovider.PermAdminManageGroups), s.refreshCookie).
Get(webGroupPath+"/{name}", s.handleWebUpdateGroupGet)
- router.With(s.checkPerms(dataprovider.PermAdminManageGroups)).Post(webGroupPath+"/{name}",
+ router.With(s.checkPerm(dataprovider.PermAdminManageGroups)).Post(webGroupPath+"/{name}",
s.handleWebUpdateGroupPost)
- router.With(s.checkPerms(dataprovider.PermAdminManageGroups), s.verifyCSRFHeader).
+ router.With(s.checkPerm(dataprovider.PermAdminManageGroups), verifyCSRFHeader).
Delete(webGroupPath+"/{name}", deleteGroup)
- router.With(s.checkPerms(dataprovider.PermAdminViewConnections), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminViewConnections), s.refreshCookie).
Get(webConnectionsPath, s.handleWebGetConnections)
- router.With(s.checkPerms(dataprovider.PermAdminViewConnections), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminViewConnections), s.refreshCookie).
Get(webConnectionsPath+jsonAPISuffix, getActiveConnections)
- router.With(s.checkPerms(dataprovider.PermAdminManageFolders), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminManageFolders), s.refreshCookie).
Get(webFoldersPath, s.handleWebGetFolders)
- router.With(s.checkPerms(dataprovider.PermAdminManageFolders), compressor.Handler, s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminManageFolders), compressor.Handler, s.refreshCookie).
Get(webFoldersPath+jsonAPISuffix, getAllFolders)
- router.With(s.checkPerms(dataprovider.PermAdminManageFolders), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminManageFolders), s.refreshCookie).
Get(webFolderPath, s.handleWebAddFolderGet)
- router.With(s.checkPerms(dataprovider.PermAdminManageFolders)).Post(webFolderPath, s.handleWebAddFolderPost)
- router.With(s.checkPerms(dataprovider.PermAdminViewServerStatus), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminManageFolders)).Post(webFolderPath, s.handleWebAddFolderPost)
+ router.With(s.checkPerm(dataprovider.PermAdminViewServerStatus), s.refreshCookie).
Get(webStatusPath, s.handleWebGetStatus)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), s.refreshCookie).
Get(webAdminsPath, s.handleGetWebAdmins)
- router.With(s.checkPerms(dataprovider.PermAdminAny), compressor.Handler, s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), compressor.Handler, s.refreshCookie).
Get(webAdminsPath+jsonAPISuffix, getAllAdmins)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), s.refreshCookie).
Get(webAdminPath, s.handleWebAddAdminGet)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), s.refreshCookie).
Get(webAdminPath+"/{username}", s.handleWebUpdateAdminGet)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(webAdminPath, s.handleWebAddAdminPost)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(webAdminPath+"/{username}",
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(webAdminPath, s.handleWebAddAdminPost)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(webAdminPath+"/{username}",
s.handleWebUpdateAdminPost)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.verifyCSRFHeader).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), verifyCSRFHeader).
Delete(webAdminPath+"/{username}", deleteAdmin)
- router.With(s.checkPerms(dataprovider.PermAdminDisableMFA), s.verifyCSRFHeader).
+ router.With(s.checkPerm(dataprovider.PermAdminDisableMFA), verifyCSRFHeader).
Put(webAdminPath+"/{username}/2fa/disable", disableAdmin2FA)
- router.With(s.checkPerms(dataprovider.PermAdminCloseConnections), s.verifyCSRFHeader).
+ router.With(s.checkPerm(dataprovider.PermAdminCloseConnections), verifyCSRFHeader).
Delete(webConnectionsPath+"/{connectionID}", handleCloseConnection)
- router.With(s.checkPerms(dataprovider.PermAdminManageFolders), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminManageFolders), s.refreshCookie).
Get(webFolderPath+"/{name}", s.handleWebUpdateFolderGet)
- router.With(s.checkPerms(dataprovider.PermAdminManageFolders)).Post(webFolderPath+"/{name}",
+ router.With(s.checkPerm(dataprovider.PermAdminManageFolders)).Post(webFolderPath+"/{name}",
s.handleWebUpdateFolderPost)
- router.With(s.checkPerms(dataprovider.PermAdminManageFolders), s.verifyCSRFHeader).
+ router.With(s.checkPerm(dataprovider.PermAdminManageFolders), verifyCSRFHeader).
Delete(webFolderPath+"/{name}", deleteFolder)
- router.With(s.checkPerms(dataprovider.PermAdminQuotaScans), s.verifyCSRFHeader).
+ router.With(s.checkPerm(dataprovider.PermAdminQuotaScans), verifyCSRFHeader).
Post(webScanVFolderPath+"/{name}", startFolderQuotaScan)
- router.With(s.checkPerms(dataprovider.PermAdminDeleteUsers), s.verifyCSRFHeader).
+ router.With(s.checkPerm(dataprovider.PermAdminDeleteUsers), verifyCSRFHeader).
Delete(webUserPath+"/{username}", deleteUser)
- router.With(s.checkPerms(dataprovider.PermAdminDisableMFA), s.verifyCSRFHeader).
+ router.With(s.checkPerm(dataprovider.PermAdminDisableMFA), verifyCSRFHeader).
Put(webUserPath+"/{username}/2fa/disable", disableUser2FA)
- router.With(s.checkPerms(dataprovider.PermAdminQuotaScans), s.verifyCSRFHeader).
+ router.With(s.checkPerm(dataprovider.PermAdminQuotaScans), verifyCSRFHeader).
Post(webQuotaScanPath+"/{username}", startUserQuotaScan)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Get(webMaintenancePath, s.handleWebMaintenance)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Get(webBackupPath, dumpData)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(webRestorePath, s.handleWebRestore)
- router.With(s.checkPerms(dataprovider.PermAdminAddUsers, dataprovider.PermAdminChangeUsers), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Get(webMaintenancePath, s.handleWebMaintenance)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Get(webBackupPath, dumpData)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(webRestorePath, s.handleWebRestore)
+ router.With(s.checkPerm(dataprovider.PermAdminAny), s.refreshCookie).
Get(webTemplateUser, s.handleWebTemplateUserGet)
- router.With(s.checkPerms(dataprovider.PermAdminAddUsers, dataprovider.PermAdminChangeUsers)).
- Post(webTemplateUser, s.handleWebTemplateUserPost)
- router.With(s.checkPerms(dataprovider.PermAdminManageFolders), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(webTemplateUser, s.handleWebTemplateUserPost)
+ router.With(s.checkPerm(dataprovider.PermAdminAny), s.refreshCookie).
Get(webTemplateFolder, s.handleWebTemplateFolderGet)
- router.With(s.checkPerms(dataprovider.PermAdminManageFolders)).Post(webTemplateFolder, s.handleWebTemplateFolderPost)
- router.With(s.checkPerms(dataprovider.PermAdminViewDefender)).Get(webDefenderPath, s.handleWebDefenderPage)
- router.With(s.checkPerms(dataprovider.PermAdminViewDefender)).Get(webDefenderHostsPath, getDefenderHosts)
- router.With(s.checkPerms(dataprovider.PermAdminManageDefender), s.verifyCSRFHeader).
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(webTemplateFolder, s.handleWebTemplateFolderPost)
+ router.With(s.checkPerm(dataprovider.PermAdminViewDefender)).Get(webDefenderPath, s.handleWebDefenderPage)
+ router.With(s.checkPerm(dataprovider.PermAdminViewDefender)).Get(webDefenderHostsPath, getDefenderHosts)
+ router.With(s.checkPerm(dataprovider.PermAdminManageDefender), verifyCSRFHeader).
Delete(webDefenderHostsPath+"/{id}", deleteDefenderHostByID)
- router.With(s.checkPerms(dataprovider.PermAdminAny), compressor.Handler, s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), compressor.Handler, s.refreshCookie).
Get(webAdminEventActionsPath+jsonAPISuffix, getAllActions)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), s.refreshCookie).
Get(webAdminEventActionsPath, s.handleWebGetEventActions)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), s.refreshCookie).
Get(webAdminEventActionPath, s.handleWebAddEventActionGet)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(webAdminEventActionPath,
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(webAdminEventActionPath,
s.handleWebAddEventActionPost)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), s.refreshCookie).
Get(webAdminEventActionPath+"/{name}", s.handleWebUpdateEventActionGet)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(webAdminEventActionPath+"/{name}",
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(webAdminEventActionPath+"/{name}",
s.handleWebUpdateEventActionPost)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.verifyCSRFHeader).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), verifyCSRFHeader).
Delete(webAdminEventActionPath+"/{name}", deleteEventAction)
- router.With(s.checkPerms(dataprovider.PermAdminAny), compressor.Handler, s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), compressor.Handler, s.refreshCookie).
Get(webAdminEventRulesPath+jsonAPISuffix, getAllRules)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), s.refreshCookie).
Get(webAdminEventRulesPath, s.handleWebGetEventRules)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), s.refreshCookie).
Get(webAdminEventRulePath, s.handleWebAddEventRuleGet)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(webAdminEventRulePath,
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(webAdminEventRulePath,
s.handleWebAddEventRulePost)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), s.refreshCookie).
Get(webAdminEventRulePath+"/{name}", s.handleWebUpdateEventRuleGet)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(webAdminEventRulePath+"/{name}",
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(webAdminEventRulePath+"/{name}",
s.handleWebUpdateEventRulePost)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.verifyCSRFHeader).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), verifyCSRFHeader).
Delete(webAdminEventRulePath+"/{name}", deleteEventRule)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.verifyCSRFHeader).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), verifyCSRFHeader).
Post(webAdminEventRulePath+"/run/{name}", runOnDemandRule)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), s.refreshCookie).
Get(webAdminRolesPath, s.handleWebGetRoles)
- router.With(s.checkPerms(dataprovider.PermAdminAny), compressor.Handler, s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), compressor.Handler, s.refreshCookie).
Get(webAdminRolesPath+jsonAPISuffix, getAllRoles)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), s.refreshCookie).
Get(webAdminRolePath, s.handleWebAddRoleGet)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(webAdminRolePath, s.handleWebAddRolePost)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(webAdminRolePath, s.handleWebAddRolePost)
+ router.With(s.checkPerm(dataprovider.PermAdminAny), s.refreshCookie).
Get(webAdminRolePath+"/{name}", s.handleWebUpdateRoleGet)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(webAdminRolePath+"/{name}",
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(webAdminRolePath+"/{name}",
s.handleWebUpdateRolePost)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.verifyCSRFHeader).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), verifyCSRFHeader).
Delete(webAdminRolePath+"/{name}", deleteRole)
- router.With(s.checkPerms(dataprovider.PermAdminViewEvents), s.refreshCookie).Get(webEventsPath,
+ router.With(s.checkPerm(dataprovider.PermAdminViewEvents), s.refreshCookie).Get(webEventsPath,
s.handleWebGetEvents)
- router.With(s.checkPerms(dataprovider.PermAdminViewEvents), compressor.Handler, s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminViewEvents), compressor.Handler, s.refreshCookie).
Get(webEventsFsSearchPath, searchFsEvents)
- router.With(s.checkPerms(dataprovider.PermAdminViewEvents), compressor.Handler, s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminViewEvents), compressor.Handler, s.refreshCookie).
Get(webEventsProviderSearchPath, searchProviderEvents)
- router.With(s.checkPerms(dataprovider.PermAdminViewEvents), compressor.Handler, s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminViewEvents), compressor.Handler, s.refreshCookie).
Get(webEventsLogSearchPath, searchLogEvents)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Get(webIPListsPath, s.handleWebIPListsPage)
- router.With(s.checkPerms(dataprovider.PermAdminAny), compressor.Handler, s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Get(webIPListsPath, s.handleWebIPListsPage)
+ router.With(s.checkPerm(dataprovider.PermAdminAny), compressor.Handler, s.refreshCookie).
Get(webIPListsPath+"/{type}", getIPListEntries)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.refreshCookie).Get(webIPListPath+"/{type}",
+ router.With(s.checkPerm(dataprovider.PermAdminAny), s.refreshCookie).Get(webIPListPath+"/{type}",
s.handleWebAddIPListEntryGet)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(webIPListPath+"/{type}",
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(webIPListPath+"/{type}",
s.handleWebAddIPListEntryPost)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.refreshCookie).Get(webIPListPath+"/{type}/{ipornet}",
+ router.With(s.checkPerm(dataprovider.PermAdminAny), s.refreshCookie).Get(webIPListPath+"/{type}/{ipornet}",
s.handleWebUpdateIPListEntryGet)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(webIPListPath+"/{type}/{ipornet}",
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(webIPListPath+"/{type}/{ipornet}",
s.handleWebUpdateIPListEntryPost)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.verifyCSRFHeader).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), verifyCSRFHeader).
Delete(webIPListPath+"/{type}/{ipornet}", deleteIPListEntry)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.refreshCookie).Get(webConfigsPath, s.handleWebConfigs)
- router.With(s.checkPerms(dataprovider.PermAdminAny)).Post(webConfigsPath, s.handleWebConfigsPost)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.verifyCSRFHeader, s.refreshCookie).
+ router.With(s.checkPerm(dataprovider.PermAdminAny), s.refreshCookie).Get(webConfigsPath, s.handleWebConfigs)
+ router.With(s.checkPerm(dataprovider.PermAdminAny)).Post(webConfigsPath, s.handleWebConfigsPost)
+ router.With(s.checkPerm(dataprovider.PermAdminAny), verifyCSRFHeader, s.refreshCookie).
Post(webConfigsPath+"/smtp/test", testSMTPConfig)
- router.With(s.checkPerms(dataprovider.PermAdminAny), s.verifyCSRFHeader, s.refreshCookie).
- Post(webOAuth2TokenPath, s.handleSMTPOAuth2TokenRequestPost)
+ router.With(s.checkPerm(dataprovider.PermAdminAny), verifyCSRFHeader, s.refreshCookie).
+ Post(webOAuth2TokenPath, handleSMTPOAuth2TokenRequestPost)
})
})
}
diff --git a/internal/httpd/token.go b/internal/httpd/token.go
index 4a0f9873..93413281 100644
--- a/internal/httpd/token.go
+++ b/internal/httpd/token.go
@@ -86,7 +86,7 @@ func (m *dbTokenManager) Add(token string, expiresAt time.Time) {
func (m *dbTokenManager) Get(token string) bool {
key := m.getKey(token)
- _, err := dataprovider.GetSharedSession(key, dataprovider.SessionTypeInvalidToken)
+ _, err := dataprovider.GetSharedSession(key)
return err == nil
}
diff --git a/internal/httpd/web.go b/internal/httpd/web.go
index da7e7542..35b2cd7b 100644
--- a/internal/httpd/web.go
+++ b/internal/httpd/web.go
@@ -27,20 +27,23 @@ import (
)
const (
- webDateTimeFormat = "2006-01-02 15:04:05" // YYYY-MM-DD HH:MM:SS
- redactedSecret = "[**redacted**]"
- csrfFormToken = "_form_token"
- csrfHeaderToken = "X-CSRF-TOKEN"
- templateCommonDir = "common"
- templateTwoFactor = "twofactor.html"
- templateTwoFactorRecovery = "twofactor-recovery.html"
- templateForgotPassword = "forgot-password.html"
- templateResetPassword = "reset-password.html"
- templateChangePwd = "changepassword.html"
- templateMessage = "message.html"
- templateCommonBase = "base.html"
- templateCommonBaseLogin = "baselogin.html"
- templateCommonLogin = "login.html"
+ pageMFATitle = "Two-factor authentication"
+ pageTwoFactorTitle = "Two-Factor authentication"
+ pageTwoFactorRecoveryTitle = "Two-Factor recovery"
+ webDateTimeFormat = "2006-01-02 15:04:05" // YYYY-MM-DD HH:MM:SS
+ redactedSecret = "[**redacted**]"
+ csrfFormToken = "_form_token"
+ csrfHeaderToken = "X-CSRF-TOKEN"
+ templateCommonDir = "common"
+ templateTwoFactor = "twofactor.html"
+ templateTwoFactorRecovery = "twofactor-recovery.html"
+ templateForgotPassword = "forgot-password.html"
+ templateResetPassword = "reset-password.html"
+ templateChangePwd = "changepassword.html"
+ templateMessage = "message.html"
+ templateCommonBase = "base.html"
+ templateCommonBaseLogin = "baselogin.html"
+ templateCommonLogin = "login.html"
)
var (
@@ -64,7 +67,6 @@ type loginPage struct {
OpenIDLoginURL string
Title string
Branding UIBranding
- Languages []string
FormDisabled bool
CheckRedirect bool
}
@@ -77,7 +79,6 @@ type twoFactorPage struct {
RecoveryURL string
Title string
Branding UIBranding
- Languages []string
CheckRedirect bool
}
@@ -89,7 +90,6 @@ type forgotPwdPage struct {
LoginURL string
Title string
Branding UIBranding
- Languages []string
CheckRedirect bool
}
@@ -101,13 +101,12 @@ type resetPwdPage struct {
LoginURL string
Title string
Branding UIBranding
- Languages []string
CheckRedirect bool
}
func getSliceFromDelimitedValues(values, delimiter string) []string {
result := []string{}
- for v := range strings.SplitSeq(values, delimiter) {
+ for _, v := range strings.Split(values, delimiter) {
cleaned := strings.TrimSpace(v)
if cleaned != "" {
result = append(result, cleaned)
diff --git a/internal/httpd/webadmin.go b/internal/httpd/webadmin.go
index a565c05e..c4158a6b 100644
--- a/internal/httpd/webadmin.go
+++ b/internal/httpd/webadmin.go
@@ -16,7 +16,6 @@ package httpd
import (
"context"
- "crypto/rand"
"encoding/json"
"errors"
"fmt"
@@ -26,21 +25,18 @@ import (
"net/url"
"os"
"path/filepath"
- "slices"
"sort"
"strconv"
"strings"
"time"
+ "github.com/go-chi/render"
"github.com/sftpgo/sdk"
sdkkms "github.com/sftpgo/sdk/kms"
- "golang.org/x/oauth2"
"github.com/drakkan/sftpgo/v2/internal/acme"
"github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/ftpd"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/kms"
"github.com/drakkan/sftpgo/v2/internal/logger"
"github.com/drakkan/sftpgo/v2/internal/mfa"
@@ -48,7 +44,6 @@ import (
"github.com/drakkan/sftpgo/v2/internal/smtp"
"github.com/drakkan/sftpgo/v2/internal/util"
"github.com/drakkan/sftpgo/v2/internal/vfs"
- "github.com/drakkan/sftpgo/v2/internal/webdavd"
)
type userPageMode int
@@ -75,36 +70,37 @@ const (
)
const (
- templateAdminDir = "webadmin"
- templateBase = "base.html"
- templateFsConfig = "fsconfig.html"
- templateUsers = "users.html"
- templateUser = "user.html"
- templateAdmins = "admins.html"
- templateAdmin = "admin.html"
- templateConnections = "connections.html"
- templateGroups = "groups.html"
- templateGroup = "group.html"
- templateFolders = "folders.html"
- templateFolder = "folder.html"
- templateEventRules = "eventrules.html"
- templateEventRule = "eventrule.html"
- templateEventActions = "eventactions.html"
- templateEventAction = "eventaction.html"
- templateRoles = "roles.html"
- templateRole = "role.html"
- templateEvents = "events.html"
- templateStatus = "status.html"
- templateDefender = "defender.html"
- templateIPLists = "iplists.html"
- templateIPList = "iplist.html"
- templateConfigs = "configs.html"
- templateProfile = "profile.html"
- templateMaintenance = "maintenance.html"
- templateMFA = "mfa.html"
- templateSetup = "adminsetup.html"
- defaultQueryLimit = 1000
- inversePatternType = "inverse"
+ templateAdminDir = "webadmin"
+ templateBase = "base.html"
+ templateFsConfig = "fsconfig.html"
+ templateSharedComponents = "sharedcomponents.html"
+ templateUsers = "users.html"
+ templateUser = "user.html"
+ templateAdmins = "admins.html"
+ templateAdmin = "admin.html"
+ templateConnections = "connections.html"
+ templateGroups = "groups.html"
+ templateGroup = "group.html"
+ templateFolders = "folders.html"
+ templateFolder = "folder.html"
+ templateEventRules = "eventrules.html"
+ templateEventRule = "eventrule.html"
+ templateEventActions = "eventactions.html"
+ templateEventAction = "eventaction.html"
+ templateRoles = "roles.html"
+ templateRole = "role.html"
+ templateEvents = "events.html"
+ templateStatus = "status.html"
+ templateDefender = "defender.html"
+ templateIPLists = "iplists.html"
+ templateIPList = "iplist.html"
+ templateConfigs = "configs.html"
+ templateProfile = "profile.html"
+ templateMaintenance = "maintenance.html"
+ templateMFA = "mfa.html"
+ templateSetup = "adminsetup.html"
+ defaultQueryLimit = 1000
+ inversePatternType = "inverse"
)
var (
@@ -154,9 +150,7 @@ type basePage struct {
HasSearcher bool
HasExternalLogin bool
LoggedUser *dataprovider.Admin
- IsLoggedToShare bool
Branding UIBranding
- Languages []string
}
type statusPage struct {
@@ -190,7 +184,6 @@ type userPage struct {
Roles []dataprovider.Role
CanImpersonate bool
FsWrapper fsWrapper
- CanUseTLSCerts bool
}
type adminPage struct {
@@ -264,7 +257,6 @@ type setupPage struct {
HideSupportLink bool
Title string
Branding UIBranding
- Languages []string
CheckRedirect bool
}
@@ -337,7 +329,6 @@ type configsPage struct {
RedactedSecret string
OAuth2TokenURL string
OAuth2RedirectURL string
- WebClientBranding UIBranding
Error *util.I18nError
}
@@ -349,10 +340,9 @@ type messagePage struct {
}
type userTemplateFields struct {
- Username string
- Password string
- PublicKeys []string
- RequirePwdChange bool
+ Username string
+ Password string
+ PublicKeys []string
}
func loadAdminTemplates(templatesPath string) {
@@ -624,10 +614,10 @@ func isServerManagerResource(currentURL string) bool {
currentURL == webConfigsPath
}
-func (s *httpdServer) getBasePageData(title, currentURL string, w http.ResponseWriter, r *http.Request) basePage {
+func (s *httpdServer) getBasePageData(title, currentURL string, r *http.Request) basePage {
var csrfToken string
if currentURL != "" {
- csrfToken = createCSRFToken(w, r, s.csrfTokenAuth, "", webBaseAdminPath)
+ csrfToken = createCSRFToken(util.GetIPFromRemoteAddress(r.RemoteAddr))
}
return basePage{
commonBasePage: getCommonBasePage(r),
@@ -672,8 +662,7 @@ func (s *httpdServer) getBasePageData(title, currentURL string, w http.ResponseW
HasSearcher: plugin.Handler.HasSearcher(),
HasExternalLogin: isLoggedInWithOIDC(r),
CSRFToken: csrfToken,
- Branding: s.binding.webAdminBranding(),
- Languages: s.binding.languages(),
+ Branding: s.binding.Branding.WebAdmin,
}
}
@@ -688,7 +677,7 @@ func (s *httpdServer) renderMessagePageWithString(w http.ResponseWriter, r *http
err error, message, text string,
) {
data := messagePage{
- basePage: s.getBasePageData(title, "", w, r),
+ basePage: s.getBasePageData(title, "", r),
Error: getI18nError(err),
Success: message,
Text: text,
@@ -723,64 +712,60 @@ func (s *httpdServer) renderNotFoundPage(w http.ResponseWriter, r *http.Request,
util.NewI18nError(err, util.I18nError404Message), "")
}
-func (s *httpdServer) renderForgotPwdPage(w http.ResponseWriter, r *http.Request, err *util.I18nError) {
+func (s *httpdServer) renderForgotPwdPage(w http.ResponseWriter, r *http.Request, err *util.I18nError, ip string) {
data := forgotPwdPage{
commonBasePage: getCommonBasePage(r),
CurrentURL: webAdminForgotPwdPath,
Error: err,
- CSRFToken: createCSRFToken(w, r, s.csrfTokenAuth, rand.Text(), webBaseAdminPath),
+ CSRFToken: createCSRFToken(ip),
LoginURL: webAdminLoginPath,
Title: util.I18nForgotPwdTitle,
- Branding: s.binding.webAdminBranding(),
- Languages: s.binding.languages(),
+ Branding: s.binding.Branding.WebAdmin,
}
renderAdminTemplate(w, templateForgotPassword, data)
}
-func (s *httpdServer) renderResetPwdPage(w http.ResponseWriter, r *http.Request, err *util.I18nError) {
+func (s *httpdServer) renderResetPwdPage(w http.ResponseWriter, r *http.Request, err *util.I18nError, ip string) {
data := resetPwdPage{
commonBasePage: getCommonBasePage(r),
CurrentURL: webAdminResetPwdPath,
Error: err,
- CSRFToken: createCSRFToken(w, r, s.csrfTokenAuth, "", webBaseAdminPath),
+ CSRFToken: createCSRFToken(ip),
LoginURL: webAdminLoginPath,
Title: util.I18nResetPwdTitle,
- Branding: s.binding.webAdminBranding(),
- Languages: s.binding.languages(),
+ Branding: s.binding.Branding.WebAdmin,
}
renderAdminTemplate(w, templateResetPassword, data)
}
-func (s *httpdServer) renderTwoFactorPage(w http.ResponseWriter, r *http.Request, err *util.I18nError) {
+func (s *httpdServer) renderTwoFactorPage(w http.ResponseWriter, r *http.Request, err *util.I18nError, ip string) {
data := twoFactorPage{
commonBasePage: getCommonBasePage(r),
- Title: util.I18n2FATitle,
+ Title: pageTwoFactorTitle,
CurrentURL: webAdminTwoFactorPath,
Error: err,
- CSRFToken: createCSRFToken(w, r, s.csrfTokenAuth, "", webBaseAdminPath),
+ CSRFToken: createCSRFToken(ip),
RecoveryURL: webAdminTwoFactorRecoveryPath,
- Branding: s.binding.webAdminBranding(),
- Languages: s.binding.languages(),
+ Branding: s.binding.Branding.WebAdmin,
}
renderAdminTemplate(w, templateTwoFactor, data)
}
-func (s *httpdServer) renderTwoFactorRecoveryPage(w http.ResponseWriter, r *http.Request, err *util.I18nError) {
+func (s *httpdServer) renderTwoFactorRecoveryPage(w http.ResponseWriter, r *http.Request, err *util.I18nError, ip string) {
data := twoFactorPage{
commonBasePage: getCommonBasePage(r),
- Title: util.I18n2FATitle,
+ Title: pageTwoFactorRecoveryTitle,
CurrentURL: webAdminTwoFactorRecoveryPath,
Error: err,
- CSRFToken: createCSRFToken(w, r, s.csrfTokenAuth, "", webBaseAdminPath),
- Branding: s.binding.webAdminBranding(),
- Languages: s.binding.languages(),
+ CSRFToken: createCSRFToken(ip),
+ Branding: s.binding.Branding.WebAdmin,
}
renderAdminTemplate(w, templateTwoFactorRecovery, data)
}
func (s *httpdServer) renderMFAPage(w http.ResponseWriter, r *http.Request) {
data := mfaPage{
- basePage: s.getBasePageData(util.I18n2FATitle, webAdminMFAPath, w, r),
+ basePage: s.getBasePageData(pageMFATitle, webAdminMFAPath, r),
TOTPConfigs: mfa.GetAvailableTOTPConfigNames(),
GenerateTOTPURL: webAdminTOTPGeneratePath,
ValidateTOTPURL: webAdminTOTPValidatePath,
@@ -799,7 +784,7 @@ func (s *httpdServer) renderMFAPage(w http.ResponseWriter, r *http.Request) {
func (s *httpdServer) renderProfilePage(w http.ResponseWriter, r *http.Request, err error) {
data := profilePage{
- basePage: s.getBasePageData(util.I18nProfileTitle, webAdminProfilePath, w, r),
+ basePage: s.getBasePageData(util.I18nProfileTitle, webAdminProfilePath, r),
Error: getI18nError(err),
}
admin, err := dataprovider.AdminExists(data.LoggedUser.Username)
@@ -816,7 +801,7 @@ func (s *httpdServer) renderProfilePage(w http.ResponseWriter, r *http.Request,
func (s *httpdServer) renderChangePasswordPage(w http.ResponseWriter, r *http.Request, err *util.I18nError) {
data := changePasswordPage{
- basePage: s.getBasePageData(util.I18nChangePwdTitle, webChangeAdminPwdPath, w, r),
+ basePage: s.getBasePageData(util.I18nChangePwdTitle, webChangeAdminPwdPath, r),
Error: err,
}
@@ -825,7 +810,7 @@ func (s *httpdServer) renderChangePasswordPage(w http.ResponseWriter, r *http.Re
func (s *httpdServer) renderMaintenancePage(w http.ResponseWriter, r *http.Request, err error) {
data := maintenancePage{
- basePage: s.getBasePageData(util.I18nMaintenanceTitle, webMaintenancePath, w, r),
+ basePage: s.getBasePageData(util.I18nMaintenanceTitle, webMaintenancePath, r),
BackupPath: webBackupPath,
RestorePath: webRestorePath,
Error: getI18nError(err),
@@ -847,32 +832,30 @@ func (s *httpdServer) renderConfigsPage(w http.ResponseWriter, r *http.Request,
configs.ACME.HTTP01Challenge.Port = 80
}
data := configsPage{
- basePage: s.getBasePageData(util.I18nConfigsTitle, webConfigsPath, w, r),
+ basePage: s.getBasePageData(util.I18nConfigsTitle, webConfigsPath, r),
Configs: configs,
ConfigSection: section,
RedactedSecret: redactedSecret,
OAuth2TokenURL: webOAuth2TokenPath,
OAuth2RedirectURL: webOAuth2RedirectPath,
- WebClientBranding: s.binding.webClientBranding(),
Error: getI18nError(err),
}
renderAdminTemplate(w, templateConfigs, data)
}
-func (s *httpdServer) renderAdminSetupPage(w http.ResponseWriter, r *http.Request, username string, err *util.I18nError) {
+func (s *httpdServer) renderAdminSetupPage(w http.ResponseWriter, r *http.Request, username, ip string, err *util.I18nError) {
data := setupPage{
commonBasePage: getCommonBasePage(r),
Title: util.I18nSetupTitle,
CurrentURL: webAdminSetupPath,
- CSRFToken: createCSRFToken(w, r, s.csrfTokenAuth, rand.Text(), webBaseAdminPath),
+ CSRFToken: createCSRFToken(ip),
Username: username,
HasInstallationCode: installationCode != "",
InstallationCodeHint: installationCodeHint,
HideSupportLink: hideSupportLink,
Error: err,
- Branding: s.binding.webAdminBranding(),
- Languages: s.binding.languages(),
+ Branding: s.binding.Branding.WebAdmin,
}
renderAdminTemplate(w, templateSetup, data)
@@ -895,7 +878,7 @@ func (s *httpdServer) renderAddUpdateAdminPage(w http.ResponseWriter, r *http.Re
title = util.I18nUpdateAdminTitle
}
data := adminPage{
- basePage: s.getBasePageData(title, currentURL, w, r),
+ basePage: s.getBasePageData(title, currentURL, r),
Admin: admin,
Groups: groups,
Roles: roles,
@@ -936,7 +919,7 @@ func (s *httpdServer) renderUserPage(w http.ResponseWriter, r *http.Request, use
}
}
user.FsConfig.RedactedSecret = redactedSecret
- basePage := s.getBasePageData(title, currentURL, w, r)
+ basePage := s.getBasePageData(title, currentURL, r)
if (mode == userPageModeAdd || mode == userPageModeTemplate) && len(user.Groups) == 0 && admin != nil {
for _, group := range admin.Groups {
user.Groups = append(user.Groups, sdk.GroupMapping{
@@ -976,7 +959,6 @@ func (s *httpdServer) renderUserPage(w http.ResponseWriter, r *http.Request, use
Groups: groups,
Roles: roles,
CanImpersonate: os.Getuid() == 0,
- CanUseTLSCerts: ftpd.GetStatus().IsActive || webdavd.GetStatus().IsActive,
FsWrapper: fsWrapper{
Filesystem: user.FsConfig,
IsUserPage: true,
@@ -1002,7 +984,7 @@ func (s *httpdServer) renderIPListPage(w http.ResponseWriter, r *http.Request, e
currentURL = fmt.Sprintf("%s/%d/%s", webIPListPath, entry.Type, url.PathEscape(entry.IPOrNet))
}
data := ipListPage{
- basePage: s.getBasePageData(title, currentURL, w, r),
+ basePage: s.getBasePageData(title, currentURL, r),
Error: getI18nError(err),
Entry: &entry,
Mode: mode,
@@ -1023,7 +1005,7 @@ func (s *httpdServer) renderRolePage(w http.ResponseWriter, r *http.Request, rol
currentURL = fmt.Sprintf("%s/%s", webAdminRolePath, url.PathEscape(role.Name))
}
data := rolePage{
- basePage: s.getBasePageData(title, currentURL, w, r),
+ basePage: s.getBasePageData(title, currentURL, r),
Error: getI18nError(err),
Role: &role,
Mode: mode,
@@ -1053,7 +1035,7 @@ func (s *httpdServer) renderGroupPage(w http.ResponseWriter, r *http.Request, gr
group.UserSettings.FsConfig.SetEmptySecretsIfNil()
data := groupPage{
- basePage: s.getBasePageData(title, currentURL, w, r),
+ basePage: s.getBasePageData(title, currentURL, r),
Error: getI18nError(err),
Group: &group,
Mode: mode,
@@ -1098,7 +1080,7 @@ func (s *httpdServer) renderEventActionPage(w http.ResponseWriter, r *http.Reque
}
data := eventActionPage{
- basePage: s.getBasePageData(title, currentURL, w, r),
+ basePage: s.getBasePageData(title, currentURL, r),
Action: action,
ActionTypes: dataprovider.EventActionTypes,
FsActions: dataprovider.FsActionTypes,
@@ -1129,7 +1111,7 @@ func (s *httpdServer) renderEventRulePage(w http.ResponseWriter, r *http.Request
}
data := eventRulePage{
- basePage: s.getBasePageData(title, currentURL, w, r),
+ basePage: s.getBasePageData(title, currentURL, r),
Rule: rule,
TriggerTypes: dataprovider.EventTriggerTypes,
Actions: actions,
@@ -1163,7 +1145,7 @@ func (s *httpdServer) renderFolderPage(w http.ResponseWriter, r *http.Request, f
folder.FsConfig.SetEmptySecretsIfNil()
data := folderPage{
- basePage: s.getBasePageData(title, currentURL, w, r),
+ basePage: s.getBasePageData(title, currentURL, r),
Error: getI18nError(err),
Folder: folder,
Mode: mode,
@@ -1227,10 +1209,9 @@ func getUsersForTemplate(r *http.Request) []userTemplateFields {
users[username] = true
res = append(res, userTemplateFields{
- Username: username,
- Password: password,
- PublicKeys: []string{publicKey},
- RequirePwdChange: r.Form.Get("tpl_require_password_change") != "",
+ Username: username,
+ Password: password,
+ PublicKeys: []string{publicKey},
})
}
@@ -1506,13 +1487,13 @@ func getFiltersFromUserPostFields(r *http.Request) (sdk.BaseUserFilters, error)
filters.PasswordStrength = passwordStrength
filters.AccessTime = getAccessTimeRestrictionsFromPostFields(r)
hooks := r.Form["hooks"]
- if slices.Contains(hooks, "external_auth_disabled") {
+ if util.Contains(hooks, "external_auth_disabled") {
filters.Hooks.ExternalAuthDisabled = true
}
- if slices.Contains(hooks, "pre_login_disabled") {
+ if util.Contains(hooks, "pre_login_disabled") {
filters.Hooks.PreLoginDisabled = true
}
- if slices.Contains(hooks, "check_password_disabled") {
+ if util.Contains(hooks, "check_password_disabled") {
filters.Hooks.CheckPasswordDisabled = true
}
filters.IsAnonymous = r.Form.Get("is_anonymous") != ""
@@ -1546,7 +1527,6 @@ func getS3Config(r *http.Request) (vfs.S3FsConfig, error) {
config.AccessKey = strings.TrimSpace(r.Form.Get("s3_access_key"))
config.RoleARN = strings.TrimSpace(r.Form.Get("s3_role_arn"))
config.AccessSecret = getSecretFromFormField(r, "s3_access_secret")
- config.SSECustomerKey = getSecretFromFormField(r, "s3_sse_customer_key")
config.Endpoint = strings.TrimSpace(r.Form.Get("s3_endpoint"))
config.StorageClass = strings.TrimSpace(r.Form.Get("s3_storage_class"))
config.ACL = strings.TrimSpace(r.Form.Get("s3_acl"))
@@ -1603,7 +1583,7 @@ func getGCSConfig(r *http.Request) (vfs.GCSFsConfig, error) {
config.AutomaticCredentials = 0
}
credentials, _, err := r.FormFile("gcs_credential_file")
- if errors.Is(err, http.ErrMissingFile) {
+ if err == http.ErrMissingFile {
return config, nil
}
if err != nil {
@@ -1872,10 +1852,6 @@ func getS3FsFromTemplate(fsConfig vfs.S3FsConfig, replacements map[string]string
payload := replacePlaceholders(fsConfig.AccessSecret.GetPayload(), replacements)
fsConfig.AccessSecret = kms.NewPlainSecret(payload)
}
- if fsConfig.SSECustomerKey != nil && fsConfig.SSECustomerKey.IsPlain() {
- payload := replacePlaceholders(fsConfig.SSECustomerKey.GetPayload(), replacements)
- fsConfig.SSECustomerKey = kms.NewPlainSecret(payload)
- }
return fsConfig
}
@@ -1913,7 +1889,6 @@ func getUserFromTemplate(user dataprovider.User, template userTemplateFields) da
user.Username = template.Username
user.Password = template.Password
user.PublicKeys = template.PublicKeys
- user.Filters.RequirePasswordChange = template.RequirePwdChange
replacements := make(map[string]string)
replacements["%username%"] = user.Username
if user.Password != "" && !user.IsPasswordHashed() {
@@ -1995,13 +1970,6 @@ func updateRepeaterFormFields(r *http.Request) {
}
continue
}
- if hasPrefixAndSuffix(k, "additional_emails[", "][additional_email]") {
- email := strings.TrimSpace(r.Form.Get(k))
- if email != "" {
- r.Form.Add("additional_emails", email)
- }
- continue
- }
if hasPrefixAndSuffix(k, "virtual_folders[", "][vfolder_path]") {
base, _ := strings.CutSuffix(k, "[vfolder_path]")
r.Form.Add("vfolder_path", strings.TrimSpace(r.Form.Get(k)))
@@ -2135,7 +2103,6 @@ func getUserFromPostFields(r *http.Request) (dataprovider.User, error) {
Filters: dataprovider.UserFilters{
BaseUserFilters: filters,
RequirePasswordChange: r.Form.Get("require_password_change") != "",
- AdditionalEmails: r.Form["additional_emails"],
},
VirtualFolders: getVirtualFoldersFromPostFields(r),
FsConfig: fsConfig,
@@ -2232,28 +2199,6 @@ func getKeyValsFromPostFields(r *http.Request, key, val string) []dataprovider.K
return res
}
-func getRenameConfigsFromPostFields(r *http.Request) []dataprovider.RenameConfig {
- var res []dataprovider.RenameConfig
- keys := r.Form["fs_rename_source"]
- values := r.Form["fs_rename_target"]
-
- for idx, k := range keys {
- v := values[idx]
- if k != "" && v != "" {
- opts := r.Form["fs_rename_options"+strconv.Itoa(idx)]
- res = append(res, dataprovider.RenameConfig{
- KeyValue: dataprovider.KeyValue{
- Key: k,
- Value: v,
- },
- UpdateModTime: slices.Contains(opts, "1"),
- })
- }
- }
-
- return res
-}
-
func getFoldersRetentionFromPostFields(r *http.Request) ([]dataprovider.FolderRetention, error) {
var res []dataprovider.FolderRetention
paths := r.Form["folder_retention_path"]
@@ -2269,7 +2214,7 @@ func getFoldersRetentionFromPostFields(r *http.Request) ([]dataprovider.FolderRe
res = append(res, dataprovider.FolderRetention{
Path: p,
Retention: retention,
- DeleteEmptyDirs: slices.Contains(opts, "1"),
+ DeleteEmptyDirs: util.Contains(opts, "1"),
})
}
}
@@ -2363,8 +2308,6 @@ func updateRepeaterFormActionFields(r *http.Request) {
base, _ := strings.CutSuffix(k, "[fs_rename_source]")
r.Form.Add("fs_rename_source", strings.TrimSpace(r.Form.Get(k)))
r.Form.Add("fs_rename_target", strings.TrimSpace(r.Form.Get(base+"[fs_rename_target]")))
- r.Form["fs_rename_options"+strconv.Itoa(len(r.Form["fs_rename_source"])-1)] =
- r.Form[base+"[fs_rename_options][]"]
continue
}
if hasPrefixAndSuffix(k, "fs_copy[", "][fs_copy_source]") {
@@ -2453,7 +2396,7 @@ func getEventActionOptionsFromPostFields(r *http.Request) (dataprovider.BaseEven
},
FsConfig: dataprovider.EventActionFilesystemConfig{
Type: fsActionType,
- Renames: getRenameConfigsFromPostFields(r),
+ Renames: getKeyValsFromPostFields(r, "fs_rename_source", "fs_rename_target"),
Deletes: getSliceFromDelimitedValues(r.Form.Get("fs_delete_paths"), ","),
MkDirs: getSliceFromDelimitedValues(r.Form.Get("fs_mkdir_paths"), ","),
Exist: getSliceFromDelimitedValues(r.Form.Get("fs_exist_paths"), ","),
@@ -2621,9 +2564,9 @@ func getEventRuleActionsFromPostFields(r *http.Request) []dataprovider.EventActi
},
Order: order + 1,
Options: dataprovider.EventActionOptions{
- IsFailureAction: slices.Contains(options, "1"),
- StopOnFailure: slices.Contains(options, "2"),
- ExecuteSync: slices.Contains(options, "3"),
+ IsFailureAction: util.Contains(options, "1"),
+ StopOnFailure: util.Contains(options, "2"),
+ ExecuteSync: util.Contains(options, "3"),
},
})
}
@@ -2826,95 +2769,31 @@ func getSMTPConfigsFromPostFields(r *http.Request) *dataprovider.SMTPConfigs {
}
}
-func getImageInputBytes(r *http.Request, fieldName, removeFieldName string, defaultVal []byte) ([]byte, error) {
- var result []byte
- remove := r.Form.Get(removeFieldName)
- if remove == "" || remove == "0" {
- result = defaultVal
- }
- f, _, err := r.FormFile(fieldName)
- if err != nil {
- if errors.Is(err, http.ErrMissingFile) {
- return result, nil
- }
- return nil, err
- }
- defer f.Close()
-
- return io.ReadAll(f)
-}
-
-func getBrandingConfigFromPostFields(r *http.Request, config *dataprovider.BrandingConfigs) (
- *dataprovider.BrandingConfigs, error,
-) {
- if config == nil {
- config = &dataprovider.BrandingConfigs{}
- }
- adminLogo, err := getImageInputBytes(r, "branding_webadmin_logo", "branding_webadmin_logo_remove", config.WebAdmin.Logo)
- if err != nil {
- return nil, util.NewI18nError(err, util.I18nErrorInvalidForm)
- }
- adminFavicon, err := getImageInputBytes(r, "branding_webadmin_favicon", "branding_webadmin_favicon_remove",
- config.WebAdmin.Favicon)
- if err != nil {
- return nil, util.NewI18nError(err, util.I18nErrorInvalidForm)
- }
- clientLogo, err := getImageInputBytes(r, "branding_webclient_logo", "branding_webclient_logo_remove",
- config.WebClient.Logo)
- if err != nil {
- return nil, util.NewI18nError(err, util.I18nErrorInvalidForm)
- }
- clientFavicon, err := getImageInputBytes(r, "branding_webclient_favicon", "branding_webclient_favicon_remove",
- config.WebClient.Favicon)
- if err != nil {
- return nil, util.NewI18nError(err, util.I18nErrorInvalidForm)
- }
-
- branding := &dataprovider.BrandingConfigs{
- WebAdmin: dataprovider.BrandingConfig{
- Name: strings.TrimSpace(r.Form.Get("branding_webadmin_name")),
- ShortName: strings.TrimSpace(r.Form.Get("branding_webadmin_short_name")),
- Logo: adminLogo,
- Favicon: adminFavicon,
- DisclaimerName: strings.TrimSpace(r.Form.Get("branding_webadmin_disclaimer_name")),
- DisclaimerURL: strings.TrimSpace(r.Form.Get("branding_webadmin_disclaimer_url")),
- },
- WebClient: dataprovider.BrandingConfig{
- Name: strings.TrimSpace(r.Form.Get("branding_webclient_name")),
- ShortName: strings.TrimSpace(r.Form.Get("branding_webclient_short_name")),
- Logo: clientLogo,
- Favicon: clientFavicon,
- DisclaimerName: strings.TrimSpace(r.Form.Get("branding_webclient_disclaimer_name")),
- DisclaimerURL: strings.TrimSpace(r.Form.Get("branding_webclient_disclaimer_url")),
- },
- }
- return branding, nil
-}
-
func (s *httpdServer) handleWebAdminForgotPwd(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
if !smtp.IsEnabled() {
s.renderNotFoundPage(w, r, errors.New("this page does not exist"))
return
}
- s.renderForgotPwdPage(w, r, nil)
+ s.renderForgotPwdPage(w, r, nil, util.GetIPFromRemoteAddress(r.RemoteAddr))
}
func (s *httpdServer) handleWebAdminForgotPwdPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
+ ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
err := r.ParseForm()
if err != nil {
- s.renderForgotPwdPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm))
+ s.renderForgotPwdPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm), ipAddr)
return
}
- if err := verifyLoginCookieAndCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
err = handleForgotPassword(r, r.Form.Get("username"), true)
if err != nil {
- s.renderForgotPwdPage(w, r, util.NewI18nError(err, util.I18nErrorPwdResetGeneric))
+ s.renderForgotPwdPage(w, r, util.NewI18nError(err, util.I18nErrorPwdResetGeneric), ipAddr)
return
}
http.Redirect(w, r, webAdminResetPwdPath, http.StatusFound)
@@ -2926,17 +2805,17 @@ func (s *httpdServer) handleWebAdminPasswordReset(w http.ResponseWriter, r *http
s.renderNotFoundPage(w, r, errors.New("this page does not exist"))
return
}
- s.renderResetPwdPage(w, r, nil)
+ s.renderResetPwdPage(w, r, nil, util.GetIPFromRemoteAddress(r.RemoteAddr))
}
func (s *httpdServer) handleWebAdminTwoFactor(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- s.renderTwoFactorPage(w, r, nil)
+ s.renderTwoFactorPage(w, r, nil, util.GetIPFromRemoteAddress(r.RemoteAddr))
}
func (s *httpdServer) handleWebAdminTwoFactorRecovery(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- s.renderTwoFactorRecoveryPage(w, r, nil)
+ s.renderTwoFactorRecoveryPage(w, r, nil, util.GetIPFromRemoteAddress(r.RemoteAddr))
}
func (s *httpdServer) handleWebAdminMFA(w http.ResponseWriter, r *http.Request) {
@@ -2962,11 +2841,11 @@ func (s *httpdServer) handleWebAdminProfilePost(w http.ResponseWriter, r *http.R
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderProfilePage(w, r, util.NewI18nError(err, util.I18nErrorInvalidToken))
return
@@ -2994,7 +2873,7 @@ func (s *httpdServer) handleWebMaintenance(w http.ResponseWriter, r *http.Reques
func (s *httpdServer) handleWebRestore(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, MaxRestoreSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -3007,7 +2886,7 @@ func (s *httpdServer) handleWebRestore(w http.ResponseWriter, r *http.Request) {
defer r.MultipartForm.RemoveAll() //nolint:errcheck
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -3047,7 +2926,7 @@ func (s *httpdServer) handleWebRestore(w http.ResponseWriter, r *http.Request) {
func getAllAdmins(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, nil, util.I18nErrorInvalidToken, http.StatusForbidden)
return
@@ -3068,7 +2947,7 @@ func getAllAdmins(w http.ResponseWriter, r *http.Request) {
func (s *httpdServer) handleGetWebAdmins(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- data := s.getBasePageData(util.I18nAdminsTitle, webAdminsPath, w, r)
+ data := s.getBasePageData(util.I18nAdminsTitle, webAdminsPath, r)
renderAdminTemplate(w, templateAdmins, data)
}
@@ -3078,7 +2957,7 @@ func (s *httpdServer) handleWebAdminSetupGet(w http.ResponseWriter, r *http.Requ
http.Redirect(w, r, webAdminLoginPath, http.StatusFound)
return
}
- s.renderAdminSetupPage(w, r, "", nil)
+ s.renderAdminSetupPage(w, r, "", util.GetIPFromRemoteAddress(r.RemoteAddr), nil)
}
func (s *httpdServer) handleWebAddAdminGet(w http.ResponseWriter, r *http.Request) {
@@ -3105,7 +2984,7 @@ func (s *httpdServer) handleWebUpdateAdminGet(w http.ResponseWriter, r *http.Req
func (s *httpdServer) handleWebAddAdminPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -3115,15 +2994,11 @@ func (s *httpdServer) handleWebAddAdminPost(w http.ResponseWriter, r *http.Reque
s.renderAddUpdateAdminPage(w, r, &admin, err, true)
return
}
- if admin.Password == "" {
- // Administrators can be used with OpenID Connect or for authentication
- // via API key, in these cases the password is not necessary, we create
- // a non-usable one. This feature is only useful for WebAdmin, in REST
- // API you can create an unusable password externally.
+ if admin.Password == "" && s.binding.isWebAdminLoginFormDisabled() {
admin.Password = util.GenerateUniqueID()
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -3154,7 +3029,7 @@ func (s *httpdServer) handleWebUpdateAdminPost(w http.ResponseWriter, r *http.Re
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -3165,7 +3040,7 @@ func (s *httpdServer) handleWebUpdateAdminPost(w http.ResponseWriter, r *http.Re
}
updatedAdmin.Filters.TOTPConfig = admin.Filters.TOTPConfig
updatedAdmin.Filters.RecoveryCodes = admin.Filters.RecoveryCodes
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderAddUpdateAdminPage(w, r, &updatedAdmin, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken), false)
return
@@ -3207,7 +3082,7 @@ func (s *httpdServer) handleWebUpdateAdminPost(w http.ResponseWriter, r *http.Re
func (s *httpdServer) handleWebDefenderPage(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
data := defenderHostsPage{
- basePage: s.getBasePageData(util.I18nDefenderTitle, webDefenderPath, w, r),
+ basePage: s.getBasePageData(util.I18nDefenderTitle, webDefenderPath, r),
DefenderHostsURL: webDefenderHostsPath,
}
@@ -3216,7 +3091,7 @@ func (s *httpdServer) handleWebDefenderPage(w http.ResponseWriter, r *http.Reque
func getAllUsers(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, nil, util.I18nErrorInvalidToken, http.StatusForbidden)
return
@@ -3236,12 +3111,12 @@ func getAllUsers(w http.ResponseWriter, r *http.Request) {
func (s *httpdServer) handleGetWebUsers(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
}
- data := s.getBasePageData(util.I18nUsersTitle, webUsersPath, w, r)
+ data := s.getBasePageData(util.I18nUsersTitle, webUsersPath, r)
renderAdminTemplate(w, templateUsers, data)
}
@@ -3266,7 +3141,7 @@ func (s *httpdServer) handleWebTemplateFolderGet(w http.ResponseWriter, r *http.
func (s *httpdServer) handleWebTemplateFolderPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -3280,7 +3155,7 @@ func (s *httpdServer) handleWebTemplateFolderPost(w http.ResponseWriter, r *http
defer r.MultipartForm.RemoveAll() //nolint:errcheck
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -3295,6 +3170,7 @@ func (s *httpdServer) handleWebTemplateFolderPost(w http.ResponseWriter, r *http
templateFolder.FsConfig = fsConfig
var dump dataprovider.BackupData
+ dump.Version = dataprovider.DumpVersion
foldersFields := getFoldersForTemplate(r)
for _, tmpl := range foldersFields {
@@ -3314,6 +3190,12 @@ func (s *httpdServer) handleWebTemplateFolderPost(w http.ResponseWriter, r *http
), "")
return
}
+ if r.Form.Get("form_action") == "export_from_template" {
+ w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"sftpgo-%v-folders-from-template.json\"",
+ len(dump.Folders)))
+ render.JSON(w, r, dump)
+ return
+ }
if err = RestoreFolders(dump.Folders, "", 1, 0, claims.Username, ipAddr, claims.Role); err != nil {
s.renderMessagePage(w, r, util.I18nTemplateFolderTitle, getRespStatus(err), err, "")
return
@@ -3336,7 +3218,6 @@ func (s *httpdServer) handleWebTemplateUserGet(w http.ResponseWriter, r *http.Re
user.SetEmptySecrets()
user.PublicKeys = nil
user.Email = ""
- user.Filters.AdditionalEmails = nil
user.Description = ""
if user.ExpirationDate == 0 && admin.Filters.Preferences.DefaultUsersExpiration > 0 {
user.ExpirationDate = util.GetTimeAsMsSinceEpoch(time.Now().Add(24 * time.Hour * time.Duration(admin.Filters.Preferences.DefaultUsersExpiration)))
@@ -3363,7 +3244,7 @@ func (s *httpdServer) handleWebTemplateUserGet(w http.ResponseWriter, r *http.Re
func (s *httpdServer) handleWebTemplateUserPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -3374,12 +3255,13 @@ func (s *httpdServer) handleWebTemplateUserPost(w http.ResponseWriter, r *http.R
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
var dump dataprovider.BackupData
+ dump.Version = dataprovider.DumpVersion
userTmplFields := getUsersForTemplate(r)
for _, tmpl := range userTmplFields {
@@ -3388,10 +3270,14 @@ func (s *httpdServer) handleWebTemplateUserPost(w http.ResponseWriter, r *http.R
s.renderMessagePage(w, r, util.I18nTemplateUserTitle, http.StatusBadRequest, err, "")
return
}
- if claims.Role != "" {
- u.Role = claims.Role
- }
+ // to create a template the "*" permission is required, so role admins cannot use
+ // this method, we don't need to force the role
dump.Users = append(dump.Users, u)
+ for _, folder := range u.VirtualFolders {
+ if !dump.HasFolder(folder.Name) {
+ dump.Folders = append(dump.Folders, folder.BaseVirtualFolder)
+ }
+ }
}
if len(dump.Users) == 0 {
@@ -3402,6 +3288,12 @@ func (s *httpdServer) handleWebTemplateUserPost(w http.ResponseWriter, r *http.R
), "")
return
}
+ if r.Form.Get("form_action") == "export_from_template" {
+ w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"sftpgo-%v-users-from-template.json\"",
+ len(dump.Users)))
+ render.JSON(w, r, dump)
+ return
+ }
if err = RestoreUsers(dump.Users, "", 1, 0, claims.Username, ipAddr, claims.Role); err != nil {
s.renderMessagePage(w, r, util.I18nTemplateUserTitle, getRespStatus(err), err, "")
return
@@ -3431,7 +3323,7 @@ func (s *httpdServer) handleWebAddUserGet(w http.ResponseWriter, r *http.Request
func (s *httpdServer) handleWebUpdateUserGet(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -3449,7 +3341,7 @@ func (s *httpdServer) handleWebUpdateUserGet(w http.ResponseWriter, r *http.Requ
func (s *httpdServer) handleWebAddUserPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -3460,15 +3352,14 @@ func (s *httpdServer) handleWebAddUserPost(w http.ResponseWriter, r *http.Reques
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
user = getUserFromTemplate(user, userTemplateFields{
- Username: user.Username,
- Password: user.Password,
- PublicKeys: user.PublicKeys,
- RequirePwdChange: user.Filters.RequirePasswordChange,
+ Username: user.Username,
+ Password: user.Password,
+ PublicKeys: user.PublicKeys,
})
if claims.Role != "" {
user.Role = claims.Role
@@ -3487,7 +3378,7 @@ func (s *httpdServer) handleWebAddUserPost(w http.ResponseWriter, r *http.Reques
func (s *httpdServer) handleWebUpdateUserPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -3507,7 +3398,7 @@ func (s *httpdServer) handleWebUpdateUserPost(w http.ResponseWriter, r *http.Req
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -3523,10 +3414,9 @@ func (s *httpdServer) handleWebUpdateUserPost(w http.ResponseWriter, r *http.Req
updateEncryptedSecrets(&updatedUser.FsConfig, &user.FsConfig)
updatedUser = getUserFromTemplate(updatedUser, userTemplateFields{
- Username: updatedUser.Username,
- Password: updatedUser.Password,
- PublicKeys: updatedUser.PublicKeys,
- RequirePwdChange: updatedUser.Filters.RequirePasswordChange,
+ Username: updatedUser.Username,
+ Password: updatedUser.Password,
+ PublicKeys: updatedUser.PublicKeys,
})
if claims.Role != "" {
updatedUser.Role = claims.Role
@@ -3546,7 +3436,7 @@ func (s *httpdServer) handleWebUpdateUserPost(w http.ResponseWriter, r *http.Req
func (s *httpdServer) handleWebGetStatus(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
data := statusPage{
- basePage: s.getBasePageData(util.I18nStatusTitle, webStatusPath, w, r),
+ basePage: s.getBasePageData(util.I18nStatusTitle, webStatusPath, r),
Status: getServicesStatus(),
}
renderAdminTemplate(w, templateStatus, data)
@@ -3554,13 +3444,13 @@ func (s *httpdServer) handleWebGetStatus(w http.ResponseWriter, r *http.Request)
func (s *httpdServer) handleWebGetConnections(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
}
- data := s.getBasePageData(util.I18nSessionsTitle, webConnectionsPath, w, r)
+ data := s.getBasePageData(util.I18nSessionsTitle, webConnectionsPath, r)
renderAdminTemplate(w, templateConnections, data)
}
@@ -3571,7 +3461,7 @@ func (s *httpdServer) handleWebAddFolderGet(w http.ResponseWriter, r *http.Reque
func (s *httpdServer) handleWebAddFolderPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -3585,7 +3475,7 @@ func (s *httpdServer) handleWebAddFolderPost(w http.ResponseWriter, r *http.Requ
defer r.MultipartForm.RemoveAll() //nolint:errcheck
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -3623,7 +3513,7 @@ func (s *httpdServer) handleWebUpdateFolderGet(w http.ResponseWriter, r *http.Re
func (s *httpdServer) handleWebUpdateFolderPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -3646,7 +3536,7 @@ func (s *httpdServer) handleWebUpdateFolderPost(w http.ResponseWriter, r *http.R
defer r.MultipartForm.RemoveAll() //nolint:errcheck
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -3709,7 +3599,7 @@ func getAllFolders(w http.ResponseWriter, r *http.Request) {
func (s *httpdServer) handleWebGetFolders(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- data := s.getBasePageData(util.I18nFoldersTitle, webFoldersPath, w, r)
+ data := s.getBasePageData(util.I18nFoldersTitle, webFoldersPath, r)
renderAdminTemplate(w, templateFolders, data)
}
@@ -3747,7 +3637,7 @@ func getAllGroups(w http.ResponseWriter, r *http.Request) {
func (s *httpdServer) handleWebGetGroups(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- data := s.getBasePageData(util.I18nGroupsTitle, webGroupsPath, w, r)
+ data := s.getBasePageData(util.I18nGroupsTitle, webGroupsPath, r)
renderAdminTemplate(w, templateGroups, data)
}
@@ -3758,7 +3648,7 @@ func (s *httpdServer) handleWebAddGroupGet(w http.ResponseWriter, r *http.Reques
func (s *httpdServer) handleWebAddGroupPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -3769,7 +3659,7 @@ func (s *httpdServer) handleWebAddGroupPost(w http.ResponseWriter, r *http.Reque
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -3796,7 +3686,7 @@ func (s *httpdServer) handleWebUpdateGroupGet(w http.ResponseWriter, r *http.Req
func (s *httpdServer) handleWebUpdateGroupPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -3816,7 +3706,7 @@ func (s *httpdServer) handleWebUpdateGroupPost(w http.ResponseWriter, r *http.Re
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -3869,7 +3759,7 @@ func getAllActions(w http.ResponseWriter, r *http.Request) {
func (s *httpdServer) handleWebGetEventActions(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- data := s.getBasePageData(util.I18nActionsTitle, webAdminEventActionsPath, w, r)
+ data := s.getBasePageData(util.I18nActionsTitle, webAdminEventActionsPath, r)
renderAdminTemplate(w, templateEventActions, data)
}
@@ -3883,7 +3773,7 @@ func (s *httpdServer) handleWebAddEventActionGet(w http.ResponseWriter, r *http.
func (s *httpdServer) handleWebAddEventActionPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -3894,7 +3784,7 @@ func (s *httpdServer) handleWebAddEventActionPost(w http.ResponseWriter, r *http
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -3920,7 +3810,7 @@ func (s *httpdServer) handleWebUpdateEventActionGet(w http.ResponseWriter, r *ht
func (s *httpdServer) handleWebUpdateEventActionPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -3940,7 +3830,7 @@ func (s *httpdServer) handleWebUpdateEventActionPost(w http.ResponseWriter, r *h
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -3979,7 +3869,7 @@ func getAllRules(w http.ResponseWriter, r *http.Request) {
func (s *httpdServer) handleWebGetEventRules(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- data := s.getBasePageData(util.I18nRulesTitle, webAdminEventRulesPath, w, r)
+ data := s.getBasePageData(util.I18nRulesTitle, webAdminEventRulesPath, r)
renderAdminTemplate(w, templateEventRules, data)
}
@@ -3994,7 +3884,7 @@ func (s *httpdServer) handleWebAddEventRuleGet(w http.ResponseWriter, r *http.Re
func (s *httpdServer) handleWebAddEventRulePost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -4005,7 +3895,7 @@ func (s *httpdServer) handleWebAddEventRulePost(w http.ResponseWriter, r *http.R
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- err = verifyCSRFToken(r, s.csrfTokenAuth)
+ err = verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr)
if err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
@@ -4032,7 +3922,7 @@ func (s *httpdServer) handleWebUpdateEventRuleGet(w http.ResponseWriter, r *http
func (s *httpdServer) handleWebUpdateEventRulePost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -4052,7 +3942,7 @@ func (s *httpdServer) handleWebUpdateEventRulePost(w http.ResponseWriter, r *htt
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -4099,7 +3989,7 @@ func getAllRoles(w http.ResponseWriter, r *http.Request) {
func (s *httpdServer) handleWebGetRoles(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- data := s.getBasePageData(util.I18nRolesTitle, webAdminRolesPath, w, r)
+ data := s.getBasePageData(util.I18nRolesTitle, webAdminRolesPath, r)
renderAdminTemplate(w, templateRoles, data)
}
@@ -4116,13 +4006,13 @@ func (s *httpdServer) handleWebAddRolePost(w http.ResponseWriter, r *http.Reques
s.renderRolePage(w, r, role, genericPageModeAdd, err)
return
}
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -4148,7 +4038,7 @@ func (s *httpdServer) handleWebUpdateRoleGet(w http.ResponseWriter, r *http.Requ
func (s *httpdServer) handleWebUpdateRolePost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -4168,7 +4058,7 @@ func (s *httpdServer) handleWebUpdateRolePost(w http.ResponseWriter, r *http.Req
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -4186,7 +4076,7 @@ func (s *httpdServer) handleWebGetEvents(w http.ResponseWriter, r *http.Request)
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
data := eventsPage{
- basePage: s.getBasePageData(util.I18nEventsTitle, webEventsPath, w, r),
+ basePage: s.getBasePageData(util.I18nEventsTitle, webEventsPath, r),
FsEventsSearchURL: webEventsFsSearchPath,
ProviderEventsSearchURL: webEventsProviderSearchPath,
LogEventsSearchURL: webEventsLogSearchPath,
@@ -4198,7 +4088,7 @@ func (s *httpdServer) handleWebIPListsPage(w http.ResponseWriter, r *http.Reques
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
rtlStatus, rtlProtocols := common.Config.GetRateLimitersStatus()
data := ipListsPage{
- basePage: s.getBasePageData(util.I18nIPListsTitle, webIPListsPath, w, r),
+ basePage: s.getBasePageData(util.I18nIPListsTitle, webIPListsPath, r),
RateLimitersStatus: rtlStatus,
RateLimitersProtocols: strings.Join(rtlProtocols, ", "),
IsAllowListEnabled: common.Config.IsAllowListEnabled(),
@@ -4230,13 +4120,13 @@ func (s *httpdServer) handleWebAddIPListEntryPost(w http.ResponseWriter, r *http
return
}
entry.Type = listType
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -4267,7 +4157,7 @@ func (s *httpdServer) handleWebUpdateIPListEntryGet(w http.ResponseWriter, r *ht
func (s *httpdServer) handleWebUpdateIPListEntryPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -4291,7 +4181,7 @@ func (s *httpdServer) handleWebUpdateIPListEntryPost(w http.ResponseWriter, r *h
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -4317,7 +4207,7 @@ func (s *httpdServer) handleWebConfigs(w http.ResponseWriter, r *http.Request) {
func (s *httpdServer) handleWebConfigsPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -4327,15 +4217,13 @@ func (s *httpdServer) handleWebConfigsPost(w http.ResponseWriter, r *http.Reques
s.renderInternalServerErrorPage(w, r, err)
return
}
- err = r.ParseMultipartForm(maxRequestSize)
+ err = r.ParseForm()
if err != nil {
s.renderBadRequestPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm))
return
}
- defer r.MultipartForm.RemoveAll() //nolint:errcheck
-
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -4359,15 +4247,6 @@ func (s *httpdServer) handleWebConfigsPost(w http.ResponseWriter, r *http.Reques
smtpConfigs := getSMTPConfigsFromPostFields(r)
updateSMTPSecrets(smtpConfigs, configs.SMTP)
configs.SMTP = smtpConfigs
- case "branding_submit":
- configSection = 4
- brandingConfigs, err := getBrandingConfigFromPostFields(r, configs.Branding)
- configs.Branding = brandingConfigs
- if err != nil {
- logger.Info(logSender, "", "unable to get branding config: %v", err)
- s.renderConfigsPage(w, r, configs, err, configSection)
- return
- }
default:
s.renderBadRequestPage(w, r, errors.New("unsupported form action"))
return
@@ -4378,22 +4257,15 @@ func (s *httpdServer) handleWebConfigsPost(w http.ResponseWriter, r *http.Reques
s.renderConfigsPage(w, r, configs, err, configSection)
return
}
- postConfigsUpdate(configSection, configs)
- s.renderMessagePage(w, r, util.I18nConfigsTitle, http.StatusOK, nil, util.I18nConfigsOK)
-}
-
-func postConfigsUpdate(section int, configs dataprovider.Configs) {
- switch section {
- case 3:
+ if configSection == 3 {
err := configs.SMTP.TryDecrypt()
if err == nil {
smtp.Activate(configs.SMTP)
} else {
logger.Error(logSender, "", "unable to decrypt SMTP configuration, cannot activate configuration: %v", err)
}
- case 4:
- dbBrandingConfig.Set(configs.Branding)
}
+ s.renderMessagePage(w, r, util.I18nConfigsTitle, http.StatusOK, nil, util.I18nConfigsOK)
}
func (s *httpdServer) handleOAuth2TokenRedirect(w http.ResponseWriter, r *http.Request) {
@@ -4401,7 +4273,7 @@ func (s *httpdServer) handleOAuth2TokenRedirect(w http.ResponseWriter, r *http.R
stateToken := r.URL.Query().Get("state")
- state, err := verifyOAuth2Token(s.csrfTokenAuth, stateToken, util.GetIPFromRemoteAddress(r.RemoteAddr))
+ state, err := verifyOAuth2Token(stateToken, util.GetIPFromRemoteAddress(r.RemoteAddr))
if err != nil {
s.renderMessagePage(w, r, util.I18nOAuth2ErrorTitle, http.StatusBadRequest, err, "")
return
@@ -4426,7 +4298,7 @@ func (s *httpdServer) handleOAuth2TokenRedirect(w http.ResponseWriter, r *http.R
cfg := oauth2Config.GetOAuth2()
cfg.RedirectURL = pendingAuth.RedirectURL
- token, err := cfg.Exchange(ctx, r.URL.Query().Get("code"), oauth2.VerifierOption(pendingAuth.Verifier))
+ token, err := cfg.Exchange(ctx, r.URL.Query().Get("code"))
if err != nil {
s.renderMessagePage(w, r, util.I18nOAuth2ErrorTitle, http.StatusInternalServerError,
util.NewI18nError(err, util.I18nOAuth2ErrTokenExchange), "")
diff --git a/internal/httpd/webclient.go b/internal/httpd/webclient.go
index 71aba2ce..10fd2c49 100644
--- a/internal/httpd/webclient.go
+++ b/internal/httpd/webclient.go
@@ -16,7 +16,6 @@ package httpd
import (
"bytes"
- "crypto/rand"
"encoding/json"
"errors"
"fmt"
@@ -28,7 +27,6 @@ import (
"os"
"path"
"path/filepath"
- "slices"
"strconv"
"strings"
"time"
@@ -39,7 +37,6 @@ import (
"github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
- "github.com/drakkan/sftpgo/v2/internal/jwt"
"github.com/drakkan/sftpgo/v2/internal/logger"
"github.com/drakkan/sftpgo/v2/internal/mfa"
"github.com/drakkan/sftpgo/v2/internal/smtp"
@@ -84,23 +81,21 @@ func isZeroTime(t time.Time) bool {
type baseClientPage struct {
commonBasePage
- Title string
- CurrentURL string
- FilesURL string
- SharesURL string
- ShareURL string
- ProfileURL string
- PingURL string
- ChangePwdURL string
- LogoutURL string
- LoginURL string
- EditURL string
- MFAURL string
- CSRFToken string
- LoggedUser *dataprovider.User
- IsLoggedToShare bool
- Branding UIBranding
- Languages []string
+ Title string
+ CurrentURL string
+ FilesURL string
+ SharesURL string
+ ShareURL string
+ ProfileURL string
+ PingURL string
+ ChangePwdURL string
+ LogoutURL string
+ LoginURL string
+ EditURL string
+ MFAURL string
+ CSRFToken string
+ LoggedUser *dataprovider.User
+ Branding UIBranding
}
type dirMapping struct {
@@ -110,10 +105,9 @@ type dirMapping struct {
type viewPDFPage struct {
commonBasePage
- Title string
- URL string
- Branding UIBranding
- Languages []string
+ Title string
+ URL string
+ Branding UIBranding
}
type editFilePage struct {
@@ -147,18 +141,15 @@ type filesPage struct {
Error *util.I18nError
Paths []dirMapping
QuotaUsage *userQuotaUsage
- KeepAliveInterval int
}
type shareLoginPage struct {
commonBasePage
- CurrentURL string
- Error *util.I18nError
- CSRFToken string
- Title string
- Branding UIBranding
- Languages []string
- CheckRedirect bool
+ CurrentURL string
+ Error *util.I18nError
+ CSRFToken string
+ Title string
+ Branding UIBranding
}
type shareDownloadPage struct {
@@ -181,15 +172,13 @@ type clientMessagePage struct {
type clientProfilePage struct {
baseClientPage
- PublicKeys []string
- TLSCerts []string
- CanSubmit bool
- AllowAPIKeyAuth bool
- Email string
- AdditionalEmails []string
- AdditionalEmailsString string
- Description string
- Error *util.I18nError
+ PublicKeys []string
+ TLSCerts []string
+ CanSubmit bool
+ AllowAPIKeyAuth bool
+ Email string
+ Description string
+ Error *util.I18nError
}
type changeClientPasswordPage struct {
@@ -212,7 +201,6 @@ type clientMFAPage struct {
type clientSharesPage struct {
baseClientPage
BasePublicSharesURL string
- BaseURL string
}
type clientSharePage struct {
@@ -535,30 +523,28 @@ func loadClientTemplates(templatesPath string) {
clientTemplates[templateShareDownload] = shareDownloadTmpl
}
-func (s *httpdServer) getBaseClientPageData(title, currentURL string, w http.ResponseWriter, r *http.Request) baseClientPage {
+func (s *httpdServer) getBaseClientPageData(title, currentURL string, r *http.Request) baseClientPage {
var csrfToken string
if currentURL != "" {
- csrfToken = createCSRFToken(w, r, s.csrfTokenAuth, "", webBaseClientPath)
+ csrfToken = createCSRFToken(util.GetIPFromRemoteAddress(r.RemoteAddr))
}
data := baseClientPage{
- commonBasePage: getCommonBasePage(r),
- Title: title,
- CurrentURL: currentURL,
- FilesURL: webClientFilesPath,
- SharesURL: webClientSharesPath,
- ShareURL: webClientSharePath,
- ProfileURL: webClientProfilePath,
- PingURL: webClientPingPath,
- ChangePwdURL: webChangeClientPwdPath,
- LogoutURL: webClientLogoutPath,
- EditURL: webClientEditFilePath,
- MFAURL: webClientMFAPath,
- CSRFToken: csrfToken,
- LoggedUser: getUserFromToken(r),
- IsLoggedToShare: false,
- Branding: s.binding.webClientBranding(),
- Languages: s.binding.languages(),
+ commonBasePage: getCommonBasePage(r),
+ Title: title,
+ CurrentURL: currentURL,
+ FilesURL: webClientFilesPath,
+ SharesURL: webClientSharesPath,
+ ShareURL: webClientSharePath,
+ ProfileURL: webClientProfilePath,
+ PingURL: webClientPingPath,
+ ChangePwdURL: webChangeClientPwdPath,
+ LogoutURL: webClientLogoutPath,
+ EditURL: webClientEditFilePath,
+ MFAURL: webClientMFAPath,
+ CSRFToken: csrfToken,
+ LoggedUser: getUserFromToken(r),
+ Branding: s.binding.Branding.WebClient,
}
if !strings.HasPrefix(r.RequestURI, webClientPubSharesPath) {
data.LoginURL = webClientLoginPath
@@ -566,44 +552,40 @@ func (s *httpdServer) getBaseClientPageData(title, currentURL string, w http.Res
return data
}
-func (s *httpdServer) renderClientForgotPwdPage(w http.ResponseWriter, r *http.Request, err *util.I18nError) {
+func (s *httpdServer) renderClientForgotPwdPage(w http.ResponseWriter, r *http.Request, err *util.I18nError, ip string) {
data := forgotPwdPage{
commonBasePage: getCommonBasePage(r),
CurrentURL: webClientForgotPwdPath,
Error: err,
- CSRFToken: createCSRFToken(w, r, s.csrfTokenAuth, rand.Text(), webBaseClientPath),
+ CSRFToken: createCSRFToken(ip),
LoginURL: webClientLoginPath,
Title: util.I18nForgotPwdTitle,
- Branding: s.binding.webClientBranding(),
- Languages: s.binding.languages(),
+ Branding: s.binding.Branding.WebClient,
}
renderClientTemplate(w, templateForgotPassword, data)
}
-func (s *httpdServer) renderClientResetPwdPage(w http.ResponseWriter, r *http.Request, err *util.I18nError) {
+func (s *httpdServer) renderClientResetPwdPage(w http.ResponseWriter, r *http.Request, err *util.I18nError, ip string) {
data := resetPwdPage{
commonBasePage: getCommonBasePage(r),
CurrentURL: webClientResetPwdPath,
Error: err,
- CSRFToken: createCSRFToken(w, r, s.csrfTokenAuth, "", webBaseClientPath),
+ CSRFToken: createCSRFToken(ip),
LoginURL: webClientLoginPath,
Title: util.I18nResetPwdTitle,
- Branding: s.binding.webClientBranding(),
- Languages: s.binding.languages(),
+ Branding: s.binding.Branding.WebClient,
}
renderClientTemplate(w, templateResetPassword, data)
}
-func (s *httpdServer) renderShareLoginPage(w http.ResponseWriter, r *http.Request, err *util.I18nError) {
+func (s *httpdServer) renderShareLoginPage(w http.ResponseWriter, r *http.Request, err *util.I18nError, ip string) {
data := shareLoginPage{
commonBasePage: getCommonBasePage(r),
Title: util.I18nShareLoginTitle,
CurrentURL: r.RequestURI,
Error: err,
- CSRFToken: createCSRFToken(w, r, s.csrfTokenAuth, rand.Text(), webBaseClientPath),
- Branding: s.binding.webClientBranding(),
- Languages: s.binding.languages(),
- CheckRedirect: false,
+ CSRFToken: createCSRFToken(ip),
+ Branding: s.binding.Branding.WebClient,
}
renderClientTemplate(w, templateShareLogin, data)
}
@@ -617,7 +599,7 @@ func renderClientTemplate(w http.ResponseWriter, tmplName string, data any) {
func (s *httpdServer) renderClientMessagePage(w http.ResponseWriter, r *http.Request, title string, statusCode int, err error, message string) {
data := clientMessagePage{
- baseClientPage: s.getBaseClientPageData(title, "", w, r),
+ baseClientPage: s.getBaseClientPageData(title, "", r),
Error: getI18nError(err),
Success: message,
}
@@ -645,16 +627,15 @@ func (s *httpdServer) renderClientNotFoundPage(w http.ResponseWriter, r *http.Re
util.NewI18nError(err, util.I18nError404Message), "")
}
-func (s *httpdServer) renderClientTwoFactorPage(w http.ResponseWriter, r *http.Request, err *util.I18nError) {
+func (s *httpdServer) renderClientTwoFactorPage(w http.ResponseWriter, r *http.Request, err *util.I18nError, ip string) {
data := twoFactorPage{
commonBasePage: getCommonBasePage(r),
- Title: util.I18n2FATitle,
+ Title: pageTwoFactorTitle,
CurrentURL: webClientTwoFactorPath,
Error: err,
- CSRFToken: createCSRFToken(w, r, s.csrfTokenAuth, "", webBaseClientPath),
+ CSRFToken: createCSRFToken(ip),
RecoveryURL: webClientTwoFactorRecoveryPath,
- Branding: s.binding.webClientBranding(),
- Languages: s.binding.languages(),
+ Branding: s.binding.Branding.WebClient,
}
if next := r.URL.Query().Get("next"); strings.HasPrefix(next, webClientFilesPath) {
data.CurrentURL += "?next=" + url.QueryEscape(next)
@@ -662,22 +643,21 @@ func (s *httpdServer) renderClientTwoFactorPage(w http.ResponseWriter, r *http.R
renderClientTemplate(w, templateTwoFactor, data)
}
-func (s *httpdServer) renderClientTwoFactorRecoveryPage(w http.ResponseWriter, r *http.Request, err *util.I18nError) {
+func (s *httpdServer) renderClientTwoFactorRecoveryPage(w http.ResponseWriter, r *http.Request, err *util.I18nError, ip string) {
data := twoFactorPage{
commonBasePage: getCommonBasePage(r),
- Title: util.I18n2FATitle,
+ Title: pageTwoFactorRecoveryTitle,
CurrentURL: webClientTwoFactorRecoveryPath,
Error: err,
- CSRFToken: createCSRFToken(w, r, s.csrfTokenAuth, "", webBaseClientPath),
- Branding: s.binding.webClientBranding(),
- Languages: s.binding.languages(),
+ CSRFToken: createCSRFToken(ip),
+ Branding: s.binding.Branding.WebClient,
}
renderClientTemplate(w, templateTwoFactorRecovery, data)
}
func (s *httpdServer) renderClientMFAPage(w http.ResponseWriter, r *http.Request) {
data := clientMFAPage{
- baseClientPage: s.getBaseClientPageData(util.I18n2FATitle, webClientMFAPath, w, r),
+ baseClientPage: s.getBaseClientPageData(util.I18n2FATitle, webClientMFAPath, r),
TOTPConfigs: mfa.GetAvailableTOTPConfigNames(),
GenerateTOTPURL: webClientTOTPGeneratePath,
ValidateTOTPURL: webClientTOTPValidatePath,
@@ -701,7 +681,7 @@ func (s *httpdServer) renderEditFilePage(w http.ResponseWriter, r *http.Request,
title = util.I18nEditFileTitle
}
data := editFilePage{
- baseClientPage: s.getBaseClientPageData(title, webClientEditFilePath, w, r),
+ baseClientPage: s.getBaseClientPageData(title, webClientEditFilePath, r),
Path: fileName,
Name: path.Base(fileName),
CurrentDir: path.Dir(fileName),
@@ -721,11 +701,8 @@ func (s *httpdServer) renderAddUpdateSharePage(w http.ResponseWriter, r *http.Re
currentURL = fmt.Sprintf("%v/%v", webClientSharePath, url.PathEscape(share.ShareID))
title = util.I18nShareUpdateTitle
}
- if share.IsPasswordHashed() {
- share.Password = redactedSecret
- }
data := clientSharePage{
- baseClientPage: s.getBaseClientPageData(title, currentURL, w, r),
+ baseClientPage: s.getBaseClientPageData(title, currentURL, r),
Share: share,
Error: err,
IsAdd: isAdd,
@@ -759,11 +736,9 @@ func (s *httpdServer) renderSharedFilesPage(w http.ResponseWriter, r *http.Reque
err *util.I18nError, share dataprovider.Share,
) {
currentURL := path.Join(webClientPubSharesPath, share.ShareID, "browse")
- baseData := s.getBaseClientPageData(util.I18nSharedFilesTitle, currentURL, w, r)
+ baseData := s.getBaseClientPageData(util.I18nSharedFilesTitle, currentURL, r)
baseData.FilesURL = currentURL
baseSharePath := path.Join(webClientPubSharesPath, share.ShareID)
- baseData.LogoutURL = path.Join(webClientPubSharesPath, share.ShareID, "logout")
- baseData.IsLoggedToShare = share.Password != ""
data := filesPage{
baseClientPage: baseData,
@@ -787,44 +762,32 @@ func (s *httpdServer) renderSharedFilesPage(w http.ResponseWriter, r *http.Reque
CanCopy: false,
Paths: getDirMapping(dirName, currentURL),
QuotaUsage: newUserQuotaUsage(&dataprovider.User{}),
- KeepAliveInterval: int(cookieRefreshThreshold / time.Millisecond),
}
renderClientTemplate(w, templateClientFiles, data)
}
-func (s *httpdServer) renderShareDownloadPage(w http.ResponseWriter, r *http.Request, share *dataprovider.Share,
- downloadLink string,
-) {
+func (s *httpdServer) renderShareDownloadPage(w http.ResponseWriter, r *http.Request, downloadLink string) {
data := shareDownloadPage{
- baseClientPage: s.getBaseClientPageData(util.I18nShareDownloadTitle, "", w, r),
+ baseClientPage: s.getBaseClientPageData(util.I18nShareDownloadTitle, "", r),
DownloadLink: downloadLink,
}
- data.LogoutURL = ""
- if share.Password != "" {
- data.LogoutURL = path.Join(webClientPubSharesPath, share.ShareID, "logout")
- }
-
renderClientTemplate(w, templateShareDownload, data)
}
-func (s *httpdServer) renderUploadToSharePage(w http.ResponseWriter, r *http.Request, share *dataprovider.Share) {
+func (s *httpdServer) renderUploadToSharePage(w http.ResponseWriter, r *http.Request, share dataprovider.Share) {
currentURL := path.Join(webClientPubSharesPath, share.ShareID, "upload")
data := shareUploadPage{
- baseClientPage: s.getBaseClientPageData(util.I18nShareUploadTitle, currentURL, w, r),
- Share: share,
+ baseClientPage: s.getBaseClientPageData(util.I18nShareUploadTitle, currentURL, r),
+ Share: &share,
UploadBasePath: path.Join(webClientPubSharesPath, share.ShareID),
}
- data.LogoutURL = ""
- if share.Password != "" {
- data.LogoutURL = path.Join(webClientPubSharesPath, share.ShareID, "logout")
- }
renderClientTemplate(w, templateUploadToShare, data)
}
func (s *httpdServer) renderFilesPage(w http.ResponseWriter, r *http.Request, dirName string,
err *util.I18nError, user *dataprovider.User) {
data := filesPage{
- baseClientPage: s.getBaseClientPageData(util.I18nFilesTitle, webClientFilesPath, w, r),
+ baseClientPage: s.getBaseClientPageData(util.I18nFilesTitle, webClientFilesPath, r),
Error: err,
CurrentDir: url.QueryEscape(dirName),
DownloadURL: webClientDownloadZipPath,
@@ -844,14 +807,13 @@ func (s *httpdServer) renderFilesPage(w http.ResponseWriter, r *http.Request, di
ShareUploadBaseURL: "",
Paths: getDirMapping(dirName, webClientFilesPath),
QuotaUsage: newUserQuotaUsage(user),
- KeepAliveInterval: int(cookieRefreshThreshold / time.Millisecond),
}
renderClientTemplate(w, templateClientFiles, data)
}
func (s *httpdServer) renderClientProfilePage(w http.ResponseWriter, r *http.Request, err *util.I18nError) {
data := clientProfilePage{
- baseClientPage: s.getBaseClientPageData(util.I18nProfileTitle, webClientProfilePath, w, r),
+ baseClientPage: s.getBaseClientPageData(util.I18nProfileTitle, webClientProfilePath, r),
Error: err,
}
user, userMerged, errUser := dataprovider.GetUserVariants(data.LoggedUser.Username, "")
@@ -863,8 +825,6 @@ func (s *httpdServer) renderClientProfilePage(w http.ResponseWriter, r *http.Req
data.TLSCerts = user.Filters.TLSCerts
data.AllowAPIKeyAuth = user.Filters.AllowAPIKeyAuth
data.Email = user.Email
- data.AdditionalEmails = user.Filters.AdditionalEmails
- data.AdditionalEmailsString = strings.Join(data.AdditionalEmails, ", ")
data.Description = user.Description
data.CanSubmit = userMerged.CanUpdateProfile()
renderClientTemplate(w, templateClientProfile, data)
@@ -872,7 +832,7 @@ func (s *httpdServer) renderClientProfilePage(w http.ResponseWriter, r *http.Req
func (s *httpdServer) renderClientChangePasswordPage(w http.ResponseWriter, r *http.Request, err *util.I18nError) {
data := changeClientPasswordPage{
- baseClientPage: s.getBaseClientPageData(util.I18nChangePwdTitle, webChangeClientPwdPath, w, r),
+ baseClientPage: s.getBaseClientPageData(util.I18nChangePwdTitle, webChangeClientPwdPath, r),
Error: err,
}
@@ -881,7 +841,7 @@ func (s *httpdServer) renderClientChangePasswordPage(w http.ResponseWriter, r *h
func (s *httpdServer) handleWebClientDownloadZip(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxMultipartMem)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderClientForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -890,7 +850,8 @@ func (s *httpdServer) handleWebClientDownloadZip(w http.ResponseWriter, r *http.
s.renderClientBadRequestPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm))
return
}
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderClientForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -905,12 +866,15 @@ func (s *httpdServer) handleWebClientDownloadZip(w http.ResponseWriter, r *http.
connID := xid.New().String()
protocol := getProtocolFromRequest(r)
connectionID := fmt.Sprintf("%v_%v", protocol, connID)
- if err := checkHTTPClientUser(&user, r, connectionID, false, false); err != nil {
+ if err := checkHTTPClientUser(&user, r, connectionID, false); err != nil {
s.renderClientForbiddenPage(w, r, err)
return
}
- baseConn := common.NewBaseConnection(connID, protocol, util.GetHTTPLocalAddress(r), r.RemoteAddr, user)
- connection := newConnection(baseConn, w, r)
+ connection := &Connection{
+ BaseConnection: common.NewBaseConnection(connID, protocol, util.GetHTTPLocalAddress(r),
+ r.RemoteAddr, user),
+ request: r,
+ }
if err = common.Connections.Add(connection); err != nil {
s.renderClientMessagePage(w, r, util.I18nError429Title, http.StatusTooManyRequests,
util.NewI18nError(err, util.I18nError429Message), "")
@@ -1009,7 +973,7 @@ func (s *httpdServer) handleShareGetDirContents(w http.ResponseWriter, r *http.R
}
defer lister.Close()
- dataGetter := func(limit, offset int) ([]byte, int, error) {
+ dataGetter := func(limit, _ int) ([]byte, int, error) {
contents, err := lister.Next(limit)
if errors.Is(err, io.EOF) {
err = nil
@@ -1018,12 +982,11 @@ func (s *httpdServer) handleShareGetDirContents(w http.ResponseWriter, r *http.R
return nil, 0, err
}
results := make([]map[string]any, 0, len(contents))
- for idx, info := range contents {
+ for _, info := range contents {
if !info.Mode().IsDir() && !info.Mode().IsRegular() {
continue
}
res := make(map[string]any)
- res["id"] = offset + idx + 1
if info.IsDir() {
res["type"] = "1"
res["size"] = ""
@@ -1060,7 +1023,7 @@ func (s *httpdServer) handleClientUploadToShare(w http.ResponseWriter, r *http.R
http.Redirect(w, r, path.Join(webClientPubSharesPath, share.ShareID, "browse"), http.StatusFound)
return
}
- s.renderUploadToSharePage(w, r, &share)
+ s.renderUploadToSharePage(w, r, share)
}
func (s *httpdServer) handleShareGetFiles(w http.ResponseWriter, r *http.Request) {
@@ -1125,8 +1088,7 @@ func (s *httpdServer) handleShareViewPDF(w http.ResponseWriter, r *http.Request)
Title: path.Base(name),
URL: fmt.Sprintf("%s?path=%s&_=%d", path.Join(webClientPubSharesPath, share.ShareID, "getpdf"),
url.QueryEscape(name), time.Now().UTC().Unix()),
- Branding: s.binding.webClientBranding(),
- Languages: s.binding.languages(),
+ Branding: s.binding.Branding.WebClient,
}
renderClientTemplate(w, templateClientViewPDF, data)
}
@@ -1178,7 +1140,7 @@ func (s *httpdServer) handleShareGetPDF(w http.ResponseWriter, r *http.Request)
func (s *httpdServer) handleClientGetDirContents(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, nil, util.I18nErrorDirList403, http.StatusForbidden)
return
@@ -1193,12 +1155,15 @@ func (s *httpdServer) handleClientGetDirContents(w http.ResponseWriter, r *http.
connID := xid.New().String()
protocol := getProtocolFromRequest(r)
connectionID := fmt.Sprintf("%s_%s", protocol, connID)
- if err := checkHTTPClientUser(&user, r, connectionID, false, false); err != nil {
+ if err := checkHTTPClientUser(&user, r, connectionID, false); err != nil {
sendAPIResponse(w, r, err, getI18NErrorString(err, util.I18nErrorDirList403), http.StatusForbidden)
return
}
- baseConn := common.NewBaseConnection(connID, protocol, util.GetHTTPLocalAddress(r), r.RemoteAddr, user)
- connection := newConnection(baseConn, w, r)
+ connection := &Connection{
+ BaseConnection: common.NewBaseConnection(connID, protocol, util.GetHTTPLocalAddress(r),
+ r.RemoteAddr, user),
+ request: r,
+ }
if err = common.Connections.Add(connection); err != nil {
sendAPIResponse(w, r, err, util.I18nErrorDirList429, http.StatusTooManyRequests)
return
@@ -1215,7 +1180,7 @@ func (s *httpdServer) handleClientGetDirContents(w http.ResponseWriter, r *http.
defer lister.Close()
dirTree := r.URL.Query().Get("dirtree") == "1"
- dataGetter := func(limit, offset int) ([]byte, int, error) {
+ dataGetter := func(limit, _ int) ([]byte, int, error) {
contents, err := lister.Next(limit)
if errors.Is(err, io.EOF) {
err = nil
@@ -1224,9 +1189,8 @@ func (s *httpdServer) handleClientGetDirContents(w http.ResponseWriter, r *http.
return nil, 0, err
}
results := make([]map[string]any, 0, len(contents))
- for idx, info := range contents {
+ for _, info := range contents {
res := make(map[string]any)
- res["id"] = offset + idx + 1
res["url"] = getFileObjectURL(name, info.Name(), webClientFilesPath)
if info.IsDir() {
res["type"] = "1"
@@ -1264,7 +1228,7 @@ func (s *httpdServer) handleClientGetDirContents(w http.ResponseWriter, r *http.
func (s *httpdServer) handleClientGetFiles(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderClientForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -1280,12 +1244,15 @@ func (s *httpdServer) handleClientGetFiles(w http.ResponseWriter, r *http.Reques
connID := xid.New().String()
protocol := getProtocolFromRequest(r)
connectionID := fmt.Sprintf("%v_%v", protocol, connID)
- if err := checkHTTPClientUser(&user, r, connectionID, false, false); err != nil {
+ if err := checkHTTPClientUser(&user, r, connectionID, false); err != nil {
s.renderClientForbiddenPage(w, r, err)
return
}
- baseConn := common.NewBaseConnection(connID, protocol, util.GetHTTPLocalAddress(r), r.RemoteAddr, user)
- connection := newConnection(baseConn, w, r)
+ connection := &Connection{
+ BaseConnection: common.NewBaseConnection(connID, protocol, util.GetHTTPLocalAddress(r),
+ r.RemoteAddr, user),
+ request: r,
+ }
if err = common.Connections.Add(connection); err != nil {
s.renderClientMessagePage(w, r, util.I18nError429Title, http.StatusTooManyRequests,
util.NewI18nError(err, util.I18nError429Message), "")
@@ -1322,7 +1289,7 @@ func (s *httpdServer) handleClientGetFiles(w http.ResponseWriter, r *http.Reques
func (s *httpdServer) handleClientEditFile(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderClientForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -1338,12 +1305,15 @@ func (s *httpdServer) handleClientEditFile(w http.ResponseWriter, r *http.Reques
connID := xid.New().String()
protocol := getProtocolFromRequest(r)
connectionID := fmt.Sprintf("%v_%v", protocol, connID)
- if err := checkHTTPClientUser(&user, r, connectionID, false, false); err != nil {
+ if err := checkHTTPClientUser(&user, r, connectionID, false); err != nil {
s.renderClientForbiddenPage(w, r, err)
return
}
- baseConn := common.NewBaseConnection(connID, protocol, util.GetHTTPLocalAddress(r), r.RemoteAddr, user)
- connection := newConnection(baseConn, w, r)
+ connection := &Connection{
+ BaseConnection: common.NewBaseConnection(connID, protocol, util.GetHTTPLocalAddress(r),
+ r.RemoteAddr, user),
+ request: r,
+ }
if err = common.Connections.Add(connection); err != nil {
s.renderClientMessagePage(w, r, util.I18nError429Title, http.StatusTooManyRequests,
util.NewI18nError(err, util.I18nError429Message), "")
@@ -1398,7 +1368,7 @@ func (s *httpdServer) handleClientEditFile(w http.ResponseWriter, r *http.Reques
func (s *httpdServer) handleClientAddShareGet(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderClientForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -1440,7 +1410,7 @@ func (s *httpdServer) handleClientAddShareGet(w http.ResponseWriter, r *http.Req
func (s *httpdServer) handleClientUpdateShareGet(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderClientForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -1448,6 +1418,7 @@ func (s *httpdServer) handleClientUpdateShareGet(w http.ResponseWriter, r *http.
shareID := getURLParam(r, "id")
share, err := dataprovider.ShareExists(shareID, claims.Username)
if err == nil {
+ share.HideConfidentialData()
s.renderAddUpdateSharePage(w, r, &share, nil, false)
} else if errors.Is(err, util.ErrNotFound) {
s.renderClientNotFoundPage(w, r, err)
@@ -1458,7 +1429,7 @@ func (s *httpdServer) handleClientUpdateShareGet(w http.ResponseWriter, r *http.
func (s *httpdServer) handleClientAddSharePost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderClientForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -1469,7 +1440,7 @@ func (s *httpdServer) handleClientAddSharePost(w http.ResponseWriter, r *http.Re
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderClientForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -1478,7 +1449,7 @@ func (s *httpdServer) handleClientAddSharePost(w http.ResponseWriter, r *http.Re
share.LastUseAt = 0
share.Username = claims.Username
if share.Password == "" {
- if slices.Contains(claims.Permissions, sdk.WebClientShareNoPasswordDisabled) {
+ if util.Contains(claims.Permissions, sdk.WebClientShareNoPasswordDisabled) {
s.renderAddUpdateSharePage(w, r, share,
util.NewI18nError(util.NewValidationError("You are not allowed to share files/folders without password"), util.I18nErrorShareNoPwd),
true)
@@ -1517,7 +1488,7 @@ func (s *httpdServer) handleClientAddSharePost(w http.ResponseWriter, r *http.Re
func (s *httpdServer) handleClientUpdateSharePost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderClientForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -1537,7 +1508,7 @@ func (s *httpdServer) handleClientUpdateSharePost(w http.ResponseWriter, r *http
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderClientForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
@@ -1547,7 +1518,7 @@ func (s *httpdServer) handleClientUpdateSharePost(w http.ResponseWriter, r *http
updatedShare.Password = share.Password
}
if updatedShare.Password == "" {
- if slices.Contains(claims.Permissions, sdk.WebClientShareNoPasswordDisabled) {
+ if util.Contains(claims.Permissions, sdk.WebClientShareNoPasswordDisabled) {
s.renderAddUpdateSharePage(w, r, updatedShare,
util.NewI18nError(util.NewValidationError("You are not allowed to share files/folders without password"), util.I18nErrorShareNoPwd),
false)
@@ -1586,7 +1557,7 @@ func (s *httpdServer) handleClientUpdateSharePost(w http.ResponseWriter, r *http
func getAllShares(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, nil, util.I18nErrorInvalidToken, http.StatusForbidden)
return
@@ -1608,9 +1579,8 @@ func (s *httpdServer) handleClientGetShares(w http.ResponseWriter, r *http.Reque
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
data := clientSharesPage{
- baseClientPage: s.getBaseClientPageData(util.I18nSharesTitle, webClientSharesPath, w, r),
+ baseClientPage: s.getBaseClientPageData(util.I18nSharesTitle, webClientSharesPath, r),
BasePublicSharesURL: webClientPubSharesPath,
- BaseURL: s.binding.BaseURL,
}
renderClientTemplate(w, templateClientShares, data)
}
@@ -1633,11 +1603,11 @@ func (s *httpdServer) handleWebClientProfilePost(w http.ResponseWriter, r *http.
return
}
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
- if err := verifyCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderClientForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderClientForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -1676,15 +1646,6 @@ func (s *httpdServer) handleWebClientProfilePost(w http.ResponseWriter, r *http.
if userMerged.CanChangeInfo() {
user.Email = strings.TrimSpace(r.Form.Get("email"))
user.Description = r.Form.Get("description")
- for k := range r.Form {
- if hasPrefixAndSuffix(k, "additional_emails[", "][additional_email]") {
- email := strings.TrimSpace(r.Form.Get(k))
- if email != "" {
- r.Form.Add("additional_emails", email)
- }
- }
- }
- user.Filters.AdditionalEmails = r.Form["additional_emails"]
}
err = dataprovider.UpdateUser(&user, dataprovider.ActionExecutorSelf, ipAddr, user.Role)
if err != nil {
@@ -1701,12 +1662,12 @@ func (s *httpdServer) handleWebClientMFA(w http.ResponseWriter, r *http.Request)
func (s *httpdServer) handleWebClientTwoFactor(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- s.renderClientTwoFactorPage(w, r, nil)
+ s.renderClientTwoFactorPage(w, r, nil, util.GetIPFromRemoteAddress(r.RemoteAddr))
}
func (s *httpdServer) handleWebClientTwoFactorRecovery(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
- s.renderClientTwoFactorRecoveryPage(w, r, nil)
+ s.renderClientTwoFactorRecoveryPage(w, r, nil, util.GetIPFromRemoteAddress(r.RemoteAddr))
}
func getShareFromPostFields(r *http.Request) (*dataprovider.Share, error) {
@@ -1758,25 +1719,26 @@ func (s *httpdServer) handleWebClientForgotPwd(w http.ResponseWriter, r *http.Re
s.renderClientNotFoundPage(w, r, errors.New("this page does not exist"))
return
}
- s.renderClientForgotPwdPage(w, r, nil)
+ s.renderClientForgotPwdPage(w, r, nil, util.GetIPFromRemoteAddress(r.RemoteAddr))
}
func (s *httpdServer) handleWebClientForgotPwdPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
+ ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
err := r.ParseForm()
if err != nil {
- s.renderClientForgotPwdPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm))
+ s.renderClientForgotPwdPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm), ipAddr)
return
}
- if err := verifyLoginCookieAndCSRFToken(r, s.csrfTokenAuth); err != nil {
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
s.renderClientForbiddenPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
return
}
username := strings.TrimSpace(r.Form.Get("username"))
err = handleForgotPassword(r, username, false)
if err != nil {
- s.renderClientForgotPwdPage(w, r, util.NewI18nError(err, util.I18nErrorPwdResetGeneric))
+ s.renderClientForgotPwdPage(w, r, util.NewI18nError(err, util.I18nErrorPwdResetGeneric), ipAddr)
return
}
http.Redirect(w, r, webClientResetPwdPath, http.StatusFound)
@@ -1788,7 +1750,7 @@ func (s *httpdServer) handleWebClientPasswordReset(w http.ResponseWriter, r *htt
s.renderClientNotFoundPage(w, r, errors.New("this page does not exist"))
return
}
- s.renderClientResetPwdPage(w, r, nil)
+ s.renderClientResetPwdPage(w, r, nil, util.GetIPFromRemoteAddress(r.RemoteAddr))
}
func (s *httpdServer) handleClientViewPDF(w http.ResponseWriter, r *http.Request) {
@@ -1803,15 +1765,14 @@ func (s *httpdServer) handleClientViewPDF(w http.ResponseWriter, r *http.Request
commonBasePage: getCommonBasePage(r),
Title: path.Base(name),
URL: fmt.Sprintf("%s?path=%s&_=%d", webClientGetPDFPath, url.QueryEscape(name), time.Now().UTC().Unix()),
- Branding: s.binding.webClientBranding(),
- Languages: s.binding.languages(),
+ Branding: s.binding.Branding.WebClient,
}
renderClientTemplate(w, templateClientViewPDF, data)
}
func (s *httpdServer) handleClientGetPDF(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxLoginBodySize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
s.renderClientForbiddenPage(w, r, util.NewI18nError(errInvalidTokenClaims, util.I18nErrorInvalidToken))
return
@@ -1832,12 +1793,15 @@ func (s *httpdServer) handleClientGetPDF(w http.ResponseWriter, r *http.Request)
connID := xid.New().String()
protocol := getProtocolFromRequest(r)
connectionID := fmt.Sprintf("%v_%v", protocol, connID)
- if err := checkHTTPClientUser(&user, r, connectionID, false, false); err != nil {
+ if err := checkHTTPClientUser(&user, r, connectionID, false); err != nil {
s.renderClientForbiddenPage(w, r, err)
return
}
- baseConn := common.NewBaseConnection(connID, protocol, util.GetHTTPLocalAddress(r), r.RemoteAddr, user)
- connection := newConnection(baseConn, w, r)
+ connection := &Connection{
+ BaseConnection: common.NewBaseConnection(connID, protocol, util.GetHTTPLocalAddress(r),
+ r.RemoteAddr, user),
+ request: r,
+ }
if err = common.Connections.Add(connection); err != nil {
s.renderClientMessagePage(w, r, util.I18nError429Title, http.StatusTooManyRequests,
util.NewI18nError(err, util.I18nError429Message), "")
@@ -1889,46 +1853,43 @@ func (s *httpdServer) ensurePDF(w http.ResponseWriter, r *http.Request, name str
func (s *httpdServer) handleClientShareLoginGet(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxLoginBodySize)
- s.renderShareLoginPage(w, r, nil)
+ s.renderShareLoginPage(w, r, nil, util.GetIPFromRemoteAddress(r.RemoteAddr))
}
func (s *httpdServer) handleClientShareLoginPost(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxLoginBodySize)
ipAddr := util.GetIPFromRemoteAddress(r.RemoteAddr)
if err := r.ParseForm(); err != nil {
- s.renderShareLoginPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm))
+ s.renderShareLoginPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidForm), ipAddr)
return
}
- if err := verifyLoginCookieAndCSRFToken(r, s.csrfTokenAuth); err != nil {
- s.renderShareLoginPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF))
+ if err := verifyCSRFToken(r.Form.Get(csrfFormToken), ipAddr); err != nil {
+ s.renderShareLoginPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCSRF), ipAddr)
return
}
- invalidateToken(r)
shareID := getURLParam(r, "id")
share, err := dataprovider.ShareExists(shareID, "")
if err != nil {
- s.renderShareLoginPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCredentials))
+ s.renderShareLoginPage(w, r, util.NewI18nError(err, util.I18nErrorInvalidCredentials), ipAddr)
return
}
match, err := share.CheckCredentials(strings.TrimSpace(r.Form.Get("share_password")))
if !match || err != nil {
- s.renderShareLoginPage(w, r, util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials))
+ s.renderShareLoginPage(w, r, util.NewI18nError(dataprovider.ErrInvalidCredentials, util.I18nErrorInvalidCredentials),
+ ipAddr)
+ return
+ }
+ c := jwtTokenClaims{
+ Username: shareID,
+ }
+ err = c.createAndSetCookie(w, r, s.tokenAuth, tokenAudienceWebShare, ipAddr)
+ if err != nil {
+ s.renderShareLoginPage(w, r, util.NewI18nError(err, util.I18nError500Message), ipAddr)
return
}
next := path.Clean(r.URL.Query().Get("next"))
baseShareURL := path.Join(webClientPubSharesPath, share.ShareID)
isRedirect, redirectTo := checkShareRedirectURL(next, baseShareURL)
- c := &jwt.Claims{
- Username: shareID,
- }
- if isRedirect {
- c.Ref = next
- }
- err = createAndSetCookie(w, r, c, s.tokenAuth, tokenAudienceWebShare, ipAddr)
- if err != nil {
- s.renderShareLoginPage(w, r, util.NewI18nError(err, util.I18nError500Message))
- return
- }
if isRedirect {
http.Redirect(w, r, redirectTo, http.StatusFound)
return
@@ -1936,22 +1897,6 @@ func (s *httpdServer) handleClientShareLoginPost(w http.ResponseWriter, r *http.
s.renderClientMessagePage(w, r, util.I18nSharedFilesTitle, http.StatusOK, nil, util.I18nShareLoginOK)
}
-func (s *httpdServer) handleClientShareLogout(w http.ResponseWriter, r *http.Request) {
- r.Body = http.MaxBytesReader(w, r.Body, maxLoginBodySize)
-
- shareID := getURLParam(r, "id")
- ctx, claims, err := s.getShareClaims(r, shareID)
- if err != nil {
- s.renderClientMessagePage(w, r, util.I18nShareAccessErrorTitle, http.StatusForbidden,
- util.NewI18nError(err, util.I18nErrorInvalidToken), "")
- return
- }
- removeCookie(w, r.WithContext(ctx), webBaseClientPath)
-
- redirectURL := path.Join(webClientPubSharesPath, shareID, fmt.Sprintf("login?next=%s", url.QueryEscape(claims.Ref)))
- http.Redirect(w, r, redirectURL, http.StatusFound)
-}
-
func (s *httpdServer) handleClientSharedFile(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxRequestSize)
validScopes := []dataprovider.ShareScope{dataprovider.ShareScopeRead}
@@ -1963,7 +1908,7 @@ func (s *httpdServer) handleClientSharedFile(w http.ResponseWriter, r *http.Requ
if r.URL.RawQuery != "" {
query = "?" + r.URL.RawQuery
}
- s.renderShareDownloadPage(w, r, &share, path.Join(webClientPubSharesPath, share.ShareID)+query)
+ s.renderShareDownloadPage(w, r, path.Join(webClientPubSharesPath, share.ShareID)+query)
}
func (s *httpdServer) handleClientCheckExist(w http.ResponseWriter, r *http.Request) {
@@ -2038,7 +1983,7 @@ func doCheckExist(w http.ResponseWriter, r *http.Request, connection *Connection
}
existing := make([]map[string]any, 0)
for _, info := range contents {
- if slices.Contains(filesList.Files, info.Name()) {
+ if util.Contains(filesList.Files, info.Name()) {
res := make(map[string]any)
res["name"] = info.Name()
if info.IsDir() {
@@ -2086,7 +2031,7 @@ func checkShareRedirectURL(next, base string) (bool, string) {
func getWebTask(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxLoginBodySize)
- claims, err := jwt.FromContext(r.Context())
+ claims, err := getTokenClaims(r)
if err != nil || claims.Username == "" {
sendAPIResponse(w, r, err, "Invalid token claims", http.StatusBadRequest)
return
diff --git a/internal/httpd/webtask.go b/internal/httpd/webtask.go
index 0c328c06..8375c9c0 100644
--- a/internal/httpd/webtask.go
+++ b/internal/httpd/webtask.go
@@ -93,7 +93,7 @@ func (m *dbTaskManager) Add(data webTaskData) error {
}
func (m *dbTaskManager) Get(ID string) (webTaskData, error) {
- sess, err := dataprovider.GetSharedSession(ID, dataprovider.SessionTypeWebTask)
+ sess, err := dataprovider.GetSharedSession(ID)
if err != nil {
return webTaskData{}, err
}
diff --git a/internal/httpdtest/httpdtest.go b/internal/httpdtest/httpdtest.go
index bacfa675..991e8774 100644
--- a/internal/httpdtest/httpdtest.go
+++ b/internal/httpdtest/httpdtest.go
@@ -37,6 +37,7 @@ import (
"github.com/drakkan/sftpgo/v2/internal/httpclient"
"github.com/drakkan/sftpgo/v2/internal/httpd"
"github.com/drakkan/sftpgo/v2/internal/kms"
+ "github.com/drakkan/sftpgo/v2/internal/util"
"github.com/drakkan/sftpgo/v2/internal/version"
"github.com/drakkan/sftpgo/v2/internal/vfs"
)
@@ -58,6 +59,7 @@ const (
adminPath = "/api/v2/admins"
adminPwdPath = "/api/v2/admin/changepwd"
apiKeysPath = "/api/v2/apikeys"
+ retentionBasePath = "/api/v2/retention/users"
retentionChecksPath = "/api/v2/retention/users/checks"
eventActionsPath = "/api/v2/eventactions"
eventRulesPath = "/api/v2/eventrules"
@@ -1172,6 +1174,20 @@ func GetRetentionChecks(expectedStatusCode int) ([]common.ActiveRetentionChecks,
return checks, body, err
}
+// StartRetentionCheck starts a new retention check
+func StartRetentionCheck(username string, retention []dataprovider.FolderRetention, expectedStatusCode int) ([]byte, error) {
+ var body []byte
+ asJSON, _ := json.Marshal(retention)
+ resp, err := sendHTTPRequest(http.MethodPost, buildURLRelativeToBase(retentionBasePath, username, "check"),
+ bytes.NewBuffer(asJSON), "application/json", getDefaultToken())
+ if err != nil {
+ return body, err
+ }
+ defer resp.Body.Close()
+ body, _ = getResponseBody(resp)
+ return body, checkResponse(resp.StatusCode, expectedStatusCode)
+}
+
// GetConnections returns status and stats for active SFTP/SCP connections
func GetConnections(expectedStatusCode int) ([]common.ConnectionStatus, []byte, error) {
var connections []common.ConnectionStatus
@@ -1664,7 +1680,7 @@ func checkEventConditionOptions(expected, actual dataprovider.ConditionOptions)
return errors.New("condition protocols mismatch")
}
for _, v := range expected.Protocols {
- if !slices.Contains(actual.Protocols, v) {
+ if !util.Contains(actual.Protocols, v) {
return errors.New("condition protocols content mismatch")
}
}
@@ -1680,7 +1696,7 @@ func checkEventConditionOptions(expected, actual dataprovider.ConditionOptions)
return errors.New("condition provider objects mismatch")
}
for _, v := range expected.ProviderObjects {
- if !slices.Contains(actual.ProviderObjects, v) {
+ if !util.Contains(actual.ProviderObjects, v) {
return errors.New("condition provider objects content mismatch")
}
}
@@ -1698,7 +1714,7 @@ func checkEventConditions(expected, actual dataprovider.EventConditions) error {
return errors.New("fs events mismatch")
}
for _, v := range expected.FsEvents {
- if !slices.Contains(actual.FsEvents, v) {
+ if !util.Contains(actual.FsEvents, v) {
return errors.New("fs events content mismatch")
}
}
@@ -1706,7 +1722,7 @@ func checkEventConditions(expected, actual dataprovider.EventConditions) error {
return errors.New("provider events mismatch")
}
for _, v := range expected.ProviderEvents {
- if !slices.Contains(actual.ProviderEvents, v) {
+ if !util.Contains(actual.ProviderEvents, v) {
return errors.New("provider events content mismatch")
}
}
@@ -1941,7 +1957,7 @@ func checkAdmin(expected, actual *dataprovider.Admin) error {
return errors.New("permissions mismatch")
}
for _, p := range expected.Permissions {
- if !slices.Contains(actual.Permissions, p) {
+ if !util.Contains(actual.Permissions, p) {
return errors.New("permissions content mismatch")
}
}
@@ -1959,7 +1975,7 @@ func compareAdminFilters(expected, actual dataprovider.AdminFilters) error {
return errors.New("allow list mismatch")
}
for _, v := range expected.AllowList {
- if !slices.Contains(actual.AllowList, v) {
+ if !util.Contains(actual.AllowList, v) {
return errors.New("allow list content mismatch")
}
}
@@ -2022,9 +2038,6 @@ func checkUser(expected *dataprovider.User, actual *dataprovider.User) error {
if expected.Email != actual.Email {
return errors.New("email mismatch")
}
- if !slices.Equal(expected.Filters.AdditionalEmails, actual.Filters.AdditionalEmails) {
- return errors.New("additional emails mismatch")
- }
if expected.Filters.RequirePasswordChange != actual.Filters.RequirePasswordChange {
return errors.New("require_password_change mismatch")
}
@@ -2053,7 +2066,7 @@ func compareUserPermissions(expected map[string][]string, actual map[string][]st
for dir, perms := range expected {
if actualPerms, ok := actual[dir]; ok {
for _, v := range actualPerms {
- if !slices.Contains(perms, v) {
+ if !util.Contains(perms, v) {
return errors.New("permissions contents mismatch")
}
}
@@ -2184,9 +2197,6 @@ func compareS3Config(expected *vfs.Filesystem, actual *vfs.Filesystem) error { /
if err := checkEncryptedSecret(expected.S3Config.AccessSecret, actual.S3Config.AccessSecret); err != nil {
return fmt.Errorf("fs S3 access secret mismatch: %v", err)
}
- if err := checkEncryptedSecret(expected.S3Config.SSECustomerKey, actual.S3Config.SSECustomerKey); err != nil {
- return fmt.Errorf("fs S3 SSE customer key mismatch: %v", err)
- }
if expected.S3Config.Endpoint != actual.S3Config.Endpoint {
return errors.New("fs S3 endpoint mismatch")
}
@@ -2309,7 +2319,7 @@ func compareSFTPFsConfig(expected *vfs.Filesystem, actual *vfs.Filesystem) error
return errors.New("SFTPFs fingerprints mismatch")
}
for _, value := range actual.SFTPConfig.Fingerprints {
- if !slices.Contains(expected.SFTPConfig.Fingerprints, value) {
+ if !util.Contains(expected.SFTPConfig.Fingerprints, value) {
return errors.New("SFTPFs fingerprints mismatch")
}
}
@@ -2400,27 +2410,27 @@ func checkEncryptedSecret(expected, actual *kms.Secret) error {
func compareUserFilterSubStructs(expected sdk.BaseUserFilters, actual sdk.BaseUserFilters) error {
for _, IPMask := range expected.AllowedIP {
- if !slices.Contains(actual.AllowedIP, IPMask) {
+ if !util.Contains(actual.AllowedIP, IPMask) {
return errors.New("allowed IP contents mismatch")
}
}
for _, IPMask := range expected.DeniedIP {
- if !slices.Contains(actual.DeniedIP, IPMask) {
+ if !util.Contains(actual.DeniedIP, IPMask) {
return errors.New("denied IP contents mismatch")
}
}
for _, method := range expected.DeniedLoginMethods {
- if !slices.Contains(actual.DeniedLoginMethods, method) {
+ if !util.Contains(actual.DeniedLoginMethods, method) {
return errors.New("denied login methods contents mismatch")
}
}
for _, protocol := range expected.DeniedProtocols {
- if !slices.Contains(actual.DeniedProtocols, protocol) {
+ if !util.Contains(actual.DeniedProtocols, protocol) {
return errors.New("denied protocols contents mismatch")
}
}
for _, options := range expected.WebClient {
- if !slices.Contains(actual.WebClient, options) {
+ if !util.Contains(actual.WebClient, options) {
return errors.New("web client options contents mismatch")
}
}
@@ -2429,7 +2439,7 @@ func compareUserFilterSubStructs(expected sdk.BaseUserFilters, actual sdk.BaseUs
return errors.New("TLS certs mismatch")
}
for _, cert := range expected.TLSCerts {
- if !slices.Contains(actual.TLSCerts, cert) {
+ if !util.Contains(actual.TLSCerts, cert) {
return errors.New("TLS certs content mismatch")
}
}
@@ -2526,7 +2536,7 @@ func checkFilterMatch(expected []string, actual []string) bool {
return false
}
for _, e := range expected {
- if !slices.Contains(actual, strings.ToLower(e)) {
+ if !util.Contains(actual, strings.ToLower(e)) {
return false
}
}
@@ -2569,7 +2579,7 @@ func compareUserBandwidthLimitFilters(expected sdk.BaseUserFilters, actual sdk.B
return errors.New("bandwidth filters sources mismatch")
}
for _, source := range actual.BandwidthLimits[idx].Sources {
- if !slices.Contains(l.Sources, source) {
+ if !util.Contains(l.Sources, source) {
return errors.New("bandwidth filters source mismatch")
}
}
@@ -2600,28 +2610,9 @@ func compareUserFilePatternsFilters(expected sdk.BaseUserFilters, actual sdk.Bas
return nil
}
-func compareRenameConfigs(expected, actual []dataprovider.RenameConfig) error {
- if len(expected) != len(actual) {
- return errors.New("rename configs mismatch")
- }
- for _, ex := range expected {
- found := false
- for _, ac := range actual {
- if ac.Key == ex.Key && ac.Value == ex.Value && ac.UpdateModTime == ex.UpdateModTime {
- found = true
- break
- }
- }
- if !found {
- return errors.New("rename configs mismatch")
- }
- }
- return nil
-}
-
func compareKeyValues(expected, actual []dataprovider.KeyValue) error {
if len(expected) != len(actual) {
- return errors.New("key values mismatch")
+ return errors.New("kay values mismatch")
}
for _, ex := range expected {
found := false
@@ -2632,7 +2623,7 @@ func compareKeyValues(expected, actual []dataprovider.KeyValue) error {
}
}
if !found {
- return errors.New("key values mismatch")
+ return errors.New("kay values mismatch")
}
}
return nil
@@ -2698,7 +2689,7 @@ func compareEventActionEmailConfigFields(expected, actual dataprovider.EventActi
return errors.New("email recipients mismatch")
}
for _, v := range expected.Recipients {
- if !slices.Contains(actual.Recipients, v) {
+ if !util.Contains(actual.Recipients, v) {
return errors.New("email recipients content mismatch")
}
}
@@ -2706,7 +2697,7 @@ func compareEventActionEmailConfigFields(expected, actual dataprovider.EventActi
return errors.New("email bcc mismatch")
}
for _, v := range expected.Bcc {
- if !slices.Contains(actual.Bcc, v) {
+ if !util.Contains(actual.Bcc, v) {
return errors.New("email bcc content mismatch")
}
}
@@ -2723,7 +2714,7 @@ func compareEventActionEmailConfigFields(expected, actual dataprovider.EventActi
return errors.New("email attachments mismatch")
}
for _, v := range expected.Attachments {
- if !slices.Contains(actual.Attachments, v) {
+ if !util.Contains(actual.Attachments, v) {
return errors.New("email attachments content mismatch")
}
}
@@ -2738,7 +2729,7 @@ func compareEventActionFsCompressFields(expected, actual dataprovider.EventActio
return errors.New("fs compress paths mismatch")
}
for _, v := range expected.Paths {
- if !slices.Contains(actual.Paths, v) {
+ if !util.Contains(actual.Paths, v) {
return errors.New("fs compress paths content mismatch")
}
}
@@ -2749,7 +2740,7 @@ func compareEventActionFsConfigFields(expected, actual dataprovider.EventActionF
if expected.Type != actual.Type {
return errors.New("fs type mismatch")
}
- if err := compareRenameConfigs(expected.Renames, actual.Renames); err != nil {
+ if err := compareKeyValues(expected.Renames, actual.Renames); err != nil {
return errors.New("fs renames mismatch")
}
if err := compareKeyValues(expected.Copy, actual.Copy); err != nil {
@@ -2759,7 +2750,7 @@ func compareEventActionFsConfigFields(expected, actual dataprovider.EventActionF
return errors.New("fs deletes mismatch")
}
for _, v := range expected.Deletes {
- if !slices.Contains(actual.Deletes, v) {
+ if !util.Contains(actual.Deletes, v) {
return errors.New("fs deletes content mismatch")
}
}
@@ -2767,7 +2758,7 @@ func compareEventActionFsConfigFields(expected, actual dataprovider.EventActionF
return errors.New("fs mkdirs mismatch")
}
for _, v := range expected.MkDirs {
- if !slices.Contains(actual.MkDirs, v) {
+ if !util.Contains(actual.MkDirs, v) {
return errors.New("fs mkdir content mismatch")
}
}
@@ -2775,7 +2766,7 @@ func compareEventActionFsConfigFields(expected, actual dataprovider.EventActionF
return errors.New("fs exist mismatch")
}
for _, v := range expected.Exist {
- if !slices.Contains(actual.Exist, v) {
+ if !util.Contains(actual.Exist, v) {
return errors.New("fs exist content mismatch")
}
}
@@ -2806,7 +2797,7 @@ func compareEventActionCmdConfigFields(expected, actual dataprovider.EventAction
return errors.New("cmd args mismatch")
}
for _, v := range expected.Args {
- if !slices.Contains(actual.Args, v) {
+ if !util.Contains(actual.Args, v) {
return errors.New("cmd args content mismatch")
}
}
diff --git a/internal/jwt/jwt.go b/internal/jwt/jwt.go
deleted file mode 100644
index 01493bc4..00000000
--- a/internal/jwt/jwt.go
+++ /dev/null
@@ -1,268 +0,0 @@
-// Copyright (C) 2025 Nicola Murino
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published
-// by the Free Software Foundation, version 3.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see .
-
-// Package jwt provides functionality for creating, parsing, and validating
-// JSON Web Tokens (JWT) used in authentication and authorization workflows.
-package jwt
-
-import (
- "context"
- "errors"
- "fmt"
- "net/http"
- "slices"
- "strings"
- "time"
-
- "github.com/go-jose/go-jose/v4"
- "github.com/go-jose/go-jose/v4/jwt"
- "github.com/rs/xid"
-)
-
-const (
- CookieKey = "jwt"
-)
-
-var (
- TokenCtxKey = &contextKey{"Token"}
- ErrorCtxKey = &contextKey{"Error"}
-)
-
-// contextKey is a value for use with context.WithValue. It's used as
-// a pointer so it fits in an interface{} without allocation. This technique
-// for defining context keys was copied from Go 1.7's new use of context in net/http.
-type contextKey struct {
- name string
-}
-
-func (k *contextKey) String() string {
- return "jwt context value " + k.name
-}
-
-func NewClaims(audience, ip string, duration time.Duration) *Claims {
- now := time.Now()
- claims := &Claims{}
- claims.IssuedAt = jwt.NewNumericDate(now)
- claims.NotBefore = jwt.NewNumericDate(now.Add(-10 * time.Second))
- claims.Expiry = jwt.NewNumericDate(now.Add(duration))
- claims.Audience = []string{audience, ip}
- return claims
-}
-
-type Claims struct {
- jwt.Claims
- Username string `json:"username,omitempty"`
- Permissions []string `json:"permissions,omitempty"`
- Role string `json:"role,omitempty"`
- APIKeyID string `json:"api_key,omitempty"`
- NodeID string `json:"node_id,omitempty"`
- MustSetTwoFactorAuth bool `json:"2fa_required,omitempty"`
- MustChangePassword bool `json:"chpwd,omitempty"`
- RequiredTwoFactorProtocols []string `json:"2fa_protos,omitempty"`
- HideUserPageSections int `json:"hus,omitempty"`
- Ref string `json:"ref,omitempty"`
-}
-
-func (c *Claims) SetIssuedAt(t time.Time) {
- c.IssuedAt = jwt.NewNumericDate(t)
-}
-
-func (c *Claims) SetNotBefore(t time.Time) {
- c.NotBefore = jwt.NewNumericDate(t)
-}
-
-func (c *Claims) SetExpiry(t time.Time) {
- c.Expiry = jwt.NewNumericDate(t)
-}
-
-func (c *Claims) HasPerm(perm string) bool {
- for _, p := range c.Permissions {
- if p == "*" || p == perm {
- return true
- }
- }
- return false
-}
-
-func (c *Claims) HasAnyAudience(audiences []string) bool {
- for _, a := range c.Audience {
- if slices.Contains(audiences, a) {
- return true
- }
- }
- return false
-}
-
-func (c *Claims) GenerateTokenResponse(signer *Signer) (TokenResponse, error) {
- token, err := signer.Sign(c)
- if err != nil {
- return TokenResponse{}, err
- }
- return c.BuildTokenResponse(token), nil
-}
-
-func (c *Claims) BuildTokenResponse(token string) TokenResponse {
- return TokenResponse{Token: token, Expiry: c.Expiry.Time().UTC().Format(time.RFC3339)}
-}
-
-type TokenResponse struct {
- Token string `json:"access_token"`
- Expiry string `json:"expires_at"`
-}
-
-func NewSigner(algo jose.SignatureAlgorithm, key any) (*Signer, error) {
- opts := (&jose.SignerOptions{}).WithType("JWT")
- signer, err := jose.NewSigner(jose.SigningKey{Algorithm: algo, Key: key}, opts)
- if err != nil {
- return nil, err
- }
- return &Signer{
- signer: signer,
- algo: []jose.SignatureAlgorithm{algo},
- key: key,
- }, nil
-}
-
-type Signer struct {
- algo []jose.SignatureAlgorithm
- signer jose.Signer
- key any
-}
-
-func (s *Signer) Sign(claims *Claims) (string, error) {
- if claims.ID == "" {
- claims.ID = xid.New().String()
- }
- if claims.IssuedAt == nil {
- claims.IssuedAt = jwt.NewNumericDate(time.Now())
- }
- if claims.NotBefore == nil {
- claims.NotBefore = jwt.NewNumericDate(time.Now().Add(-10 * time.Second))
- }
- if claims.Expiry == nil {
- return "", errors.New("expiration must be set")
- }
- if len(claims.Audience) == 0 {
- return "", errors.New("audience must be set")
- }
-
- return jwt.Signed(s.signer).Claims(claims).Serialize()
-}
-
-func (s *Signer) Signer() jose.Signer {
- return s.signer
-}
-
-func (s *Signer) SetSigner(signer jose.Signer) {
- s.signer = signer
-}
-
-func (s *Signer) SignWithParams(claims *Claims, audience, ip string, duration time.Duration) (string, error) {
- claims.Expiry = jwt.NewNumericDate(time.Now().Add(duration))
- claims.Audience = []string{audience, ip}
- return s.Sign(claims)
-}
-
-func NewContext(ctx context.Context, claims *Claims, err error) context.Context {
- ctx = context.WithValue(ctx, TokenCtxKey, claims)
- ctx = context.WithValue(ctx, ErrorCtxKey, err)
- return ctx
-}
-
-func FromContext(ctx context.Context) (*Claims, error) {
- val := ctx.Value(TokenCtxKey)
- token, ok := val.(*Claims)
- if !ok && val != nil {
- return nil, fmt.Errorf("invalid type for TokenCtxKey: %T", val)
- }
-
- valErr := ctx.Value(ErrorCtxKey)
- err, ok := valErr.(error)
- if !ok && valErr != nil {
- return nil, fmt.Errorf("invalid type for ErrorCtxKey: %T", valErr)
- }
- if token == nil {
- return nil, errors.New("no token found")
- }
-
- return token, err
-}
-
-func Verify(s *Signer, findTokenFns ...func(r *http.Request) string) func(http.Handler) http.Handler {
- return func(next http.Handler) http.Handler {
- hfn := func(w http.ResponseWriter, r *http.Request) {
- ctx := r.Context()
- token, err := VerifyRequest(s, r, findTokenFns...)
- ctx = NewContext(ctx, token, err)
- next.ServeHTTP(w, r.WithContext(ctx))
- }
- return http.HandlerFunc(hfn)
- }
-}
-
-func VerifyRequest(s *Signer, r *http.Request, findTokenFns ...func(r *http.Request) string) (*Claims, error) {
- var tokenString string
- for _, fn := range findTokenFns {
- tokenString = fn(r)
- if tokenString != "" {
- break
- }
- }
- if tokenString == "" {
- return nil, errors.New("no token found")
- }
- return VerifyToken(s, tokenString)
-}
-
-func VerifyToken(s *Signer, payload string) (*Claims, error) {
- return VerifyTokenWithKey(payload, s.algo, s.key)
-}
-
-func VerifyTokenWithKey(payload string, algo []jose.SignatureAlgorithm, key any) (*Claims, error) {
- token, err := jwt.ParseSigned(payload, algo)
- if err != nil {
- return nil, err
- }
- var claims Claims
- err = token.Claims(key, &claims)
- if err != nil {
- return nil, err
- }
- if err := claims.ValidateWithLeeway(jwt.Expected{Time: time.Now()}, 30*time.Second); err != nil {
- return nil, err
- }
- return &claims, nil
-}
-
-// TokenFromCookie tries to retrieve the token string from a cookie named
-// "jwt".
-func TokenFromCookie(r *http.Request) string {
- cookie, err := r.Cookie(CookieKey)
- if err != nil {
- return ""
- }
- return cookie.Value
-}
-
-// TokenFromHeader tries to retrieve the token string from the
-// "Authorization" request header: "Authorization: BEARER T".
-func TokenFromHeader(r *http.Request) string {
- // Get token from authorization header.
- bearer := r.Header.Get("Authorization")
- const prefix = "Bearer "
- if len(bearer) >= len(prefix) && strings.EqualFold(bearer[:len(prefix)], prefix) {
- return bearer[len(prefix):]
- }
- return ""
-}
diff --git a/internal/jwt/jwt_test.go b/internal/jwt/jwt_test.go
deleted file mode 100644
index cc7fcddb..00000000
--- a/internal/jwt/jwt_test.go
+++ /dev/null
@@ -1,255 +0,0 @@
-package jwt
-
-import (
- "context"
- "errors"
- "fmt"
- "io/fs"
- "net/http"
- "net/http/httptest"
- "testing"
- "time"
-
- "github.com/go-jose/go-jose/v4"
- "github.com/go-jose/go-jose/v4/jwt"
- "github.com/stretchr/testify/assert"
- "github.com/stretchr/testify/require"
-
- "github.com/drakkan/sftpgo/v2/internal/util"
-)
-
-type failingJoseSigner struct{}
-
-func (s *failingJoseSigner) Sign(payload []byte) (*jose.JSONWebSignature, error) {
- return nil, errors.New("sign test error")
-}
-
-func (s *failingJoseSigner) Options() jose.SignerOptions {
- return jose.SignerOptions{}
-}
-
-func TestJWTToken(t *testing.T) {
- s, err := NewSigner(jose.HS256, util.GenerateRandomBytes(32))
- require.NoError(t, err)
- username := util.GenerateUniqueID()
- claims := Claims{
- Username: username,
- Claims: jwt.Claims{
- Audience: jwt.Audience{"test"},
- Expiry: jwt.NewNumericDate(time.Now().Add(5 * time.Minute)),
- NotBefore: jwt.NewNumericDate(time.Now()),
- IssuedAt: jwt.NewNumericDate(time.Now()),
- },
- }
- token, err := s.Sign(&claims)
- require.NoError(t, err)
- require.NotEmpty(t, token)
-
- parsed, err := VerifyToken(s, token)
- require.NoError(t, err)
- require.Equal(t, username, parsed.Username)
-
- ja1, err := NewSigner(jose.HS256, util.GenerateRandomBytes(32))
- require.NoError(t, err)
-
- token, err = ja1.Sign(&claims)
- require.NoError(t, err)
- require.NotEmpty(t, token)
- _, err = VerifyToken(s, token)
- require.Error(t, err)
- _, err = VerifyToken(ja1, token)
- require.NoError(t, err)
-}
-
-func TestClaims(t *testing.T) {
- claims := NewClaims(util.GenerateUniqueID(), "", 10*time.Minute)
- s, err := NewSigner(jose.HS256, util.GenerateRandomBytes(32))
- require.NoError(t, err)
- token, err := s.Sign(claims)
- require.NoError(t, err)
- assert.NotEmpty(t, token)
- assert.NotNil(t, claims.Expiry)
- assert.NotNil(t, claims.IssuedAt)
- assert.NotNil(t, claims.NotBefore)
-
- claims = &Claims{
- Permissions: []string{"myperm"},
- }
- claims.SetExpiry(time.Now().Add(1 * time.Minute))
- claims.Audience = []string{"testaudience"}
- _, err = s.Sign(claims)
- assert.NoError(t, err)
- assert.NotNil(t, claims.IssuedAt)
- assert.NotNil(t, claims.NotBefore)
- assert.True(t, claims.HasAnyAudience([]string{util.GenerateUniqueID(), util.GenerateUniqueID(), "testaudience"}))
- assert.False(t, claims.HasAnyAudience([]string{util.GenerateUniqueID()}))
- assert.True(t, claims.HasPerm("myperm"))
- assert.False(t, claims.HasPerm(util.GenerateUniqueID()))
- resp, err := claims.GenerateTokenResponse(s)
- require.NoError(t, err)
- assert.NotEmpty(t, resp.Token)
- assert.Equal(t, claims.Expiry.Time().UTC().Format(time.RFC3339), resp.Expiry)
- claims.SetIssuedAt(time.Now())
- claims.SetNotBefore(time.Now().Add(10 * time.Minute))
- token, err = s.SignWithParams(claims, util.GenerateUniqueID(), "127.0.0.1", time.Minute)
- assert.NoError(t, err)
- _, err = VerifyToken(s, token)
- assert.ErrorContains(t, err, "nbf")
- claims = &Claims{}
- _, err = s.Sign(claims)
- assert.ErrorContains(t, err, "expiration must be set")
- claims.SetExpiry(time.Now())
- _, err = s.Sign(claims)
- assert.ErrorContains(t, err, "audience must be set")
- claims = &Claims{}
- _, err = s.SignWithParams(claims, util.GenerateUniqueID(), "", time.Minute)
- assert.NoError(t, err)
-}
-
-func TestClaimsPermissions(t *testing.T) {
- c := Claims{
- Permissions: []string{"*"},
- }
- assert.True(t, c.HasPerm(util.GenerateUniqueID()))
- c.Permissions = []string{"list"}
- assert.False(t, c.HasPerm(util.GenerateUniqueID()))
- assert.True(t, c.HasPerm("list"))
-}
-
-func TestErrors(t *testing.T) {
- s, err := NewSigner(jose.HS256, util.GenerateRandomBytes(32))
- require.NoError(t, err)
- _, err = VerifyToken(s, util.GenerateUniqueID())
- assert.Error(t, err)
- claims := &Claims{}
- claims.SetExpiry(time.Now().Add(-1 * time.Minute))
- token, err := jwt.Signed(s.Signer()).Claims(claims).Serialize()
- assert.NoError(t, err)
- _, err = VerifyToken(s, token)
- assert.ErrorContains(t, err, "exp")
- claims.SetExpiry(time.Now().Add(2 * time.Minute))
- claims.SetIssuedAt(time.Now().Add(1 * time.Minute))
- token, err = jwt.Signed(s.Signer()).Claims(claims).Serialize()
- assert.NoError(t, err)
- _, err = VerifyToken(s, token)
- assert.ErrorContains(t, err, "iat")
- claims.SetIssuedAt(time.Now())
- claims.SetNotBefore(time.Now().Add(1 * time.Minute))
- token, err = jwt.Signed(s.Signer()).Claims(claims).Serialize()
- assert.NoError(t, err)
- _, err = VerifyToken(s, token)
- assert.ErrorContains(t, err, "nbf")
-
- s.SetSigner(&failingJoseSigner{})
- claims = NewClaims(util.GenerateUniqueID(), "", time.Minute)
- _, err = s.Sign(claims)
- assert.Error(t, err)
- _, err = claims.GenerateTokenResponse(s)
- assert.Error(t, err)
- // Wrong algorithm
- _, err = NewSigner("PS256", util.GenerateRandomBytes(32))
- assert.Error(t, err)
-}
-
-func TestTokenFromRequest(t *testing.T) {
- claims := NewClaims(util.GenerateUniqueID(), "", 10*time.Minute)
- s, err := NewSigner(jose.HS256, util.GenerateRandomBytes(32))
- require.NoError(t, err)
- token, err := s.Sign(claims)
- require.NoError(t, err)
- assert.NotEmpty(t, token)
- req, err := http.NewRequest(http.MethodGet, "/", nil)
- require.NoError(t, err)
- req.Header.Set("Cookie", fmt.Sprintf("jwt=%s", token))
- cookie := TokenFromCookie(req)
- assert.Equal(t, token, cookie)
- req, err = http.NewRequest(http.MethodGet, "/", nil)
- require.NoError(t, err)
- req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
- _, err = VerifyRequest(s, req, TokenFromHeader)
- assert.NoError(t, err)
- req.Header.Set("Authorization", token)
- assert.Empty(t, TokenFromHeader(req))
- assert.Empty(t, TokenFromCookie(req))
- _, err = VerifyRequest(s, req, TokenFromCookie)
- assert.ErrorContains(t, err, "no token found")
-}
-
-func TestContext(t *testing.T) {
- claims := &Claims{
- Username: util.GenerateUniqueID(),
- }
- s, err := NewSigner(jose.HS256, util.GenerateRandomBytes(32))
- require.NoError(t, err)
- token, err := s.SignWithParams(claims, util.GenerateUniqueID(), "", time.Minute)
- require.NoError(t, err)
-
- req, err := http.NewRequest(http.MethodGet, "/", nil)
- require.NoError(t, err)
- req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
-
- h := Verify(s, TokenFromHeader)
- wrapped := h(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
- token, err := FromContext(r.Context())
- assert.Nil(t, err)
- assert.Equal(t, claims.Username, token.Username)
- w.WriteHeader(http.StatusOK)
- }))
- rr := httptest.NewRecorder()
- wrapped.ServeHTTP(rr, req)
- assert.Equal(t, http.StatusOK, rr.Code)
-
- _, err = FromContext(context.Background())
- assert.ErrorContains(t, err, "no token found")
-
- ctx := NewContext(context.Background(), &Claims{}, fs.ErrClosed)
- _, err = FromContext(ctx)
- assert.Equal(t, fs.ErrClosed, err)
-
- ctx = context.WithValue(context.Background(), TokenCtxKey, "1")
- _, err = FromContext(ctx)
- assert.ErrorContains(t, err, "invalid type for TokenCtxKey")
-
- ctx = context.WithValue(context.Background(), ErrorCtxKey, 2)
- _, err = FromContext(ctx)
- assert.ErrorContains(t, err, "invalid type for ErrorCtxKey")
- claims = NewClaims(util.GenerateUniqueID(), "127.1.1.1", time.Minute)
- _, err = s.Sign(claims)
- require.NoError(t, err)
- ctx = context.WithValue(context.Background(), TokenCtxKey, claims)
- claimsFromContext, err := FromContext(ctx)
- assert.NoError(t, err)
- assert.Equal(t, claims, claimsFromContext)
-
- assert.Equal(t, "jwt context value Token", TokenCtxKey.String())
-}
-
-func TestValidationLeeway(t *testing.T) {
- s, err := NewSigner(jose.HS256, util.GenerateRandomBytes(32))
- require.NoError(t, err)
- claims := &Claims{}
- claims.Audience = []string{util.GenerateUniqueID()}
- claims.SetIssuedAt(time.Now().Add(10 * time.Second)) // issued at in the future
- claims.SetExpiry(time.Now().Add(10 * time.Second))
- token, err := s.Sign(claims)
- require.NoError(t, err)
- _, err = VerifyToken(s, token)
- assert.NoError(t, err)
-
- claims = &Claims{}
- claims.Audience = []string{util.GenerateUniqueID()}
- claims.SetExpiry(time.Now().Add(-10 * time.Second)) // expired
- token, err = s.Sign(claims)
- require.NoError(t, err)
- _, err = VerifyToken(s, token)
- assert.NoError(t, err)
-
- claims = &Claims{}
- claims.Audience = []string{util.GenerateUniqueID()}
- claims.SetExpiry(time.Now().Add(30 * time.Second))
- claims.SetNotBefore(time.Now().Add(10 * time.Second)) // not before in the future
- token, err = s.Sign(claims)
- require.NoError(t, err)
- _, err = VerifyToken(s, token)
- assert.NoError(t, err)
-}
diff --git a/internal/kms/kms.go b/internal/kms/kms.go
index 914af4ea..cf6cf5ed 100644
--- a/internal/kms/kms.go
+++ b/internal/kms/kms.go
@@ -74,7 +74,7 @@ var (
ErrInvalidSecret = errors.New("invalid secret")
validSecretStatuses = []string{sdkkms.SecretStatusPlain, sdkkms.SecretStatusAES256GCM, sdkkms.SecretStatusSecretBox,
sdkkms.SecretStatusVaultTransit, sdkkms.SecretStatusAWS, sdkkms.SecretStatusGCP, sdkkms.SecretStatusAzureKeyVault,
- sdkkms.SecretStatusOracleKeyVault, sdkkms.SecretStatusRedacted}
+ "OracleKeyVault", sdkkms.SecretStatusRedacted}
config Configuration
secretProviders = make(map[string]registeredSecretProvider)
)
diff --git a/internal/logger/journald.go b/internal/logger/journald.go
new file mode 100644
index 00000000..fb63d0c2
--- /dev/null
+++ b/internal/logger/journald.go
@@ -0,0 +1,29 @@
+// Copyright (C) 2019 Nicola Murino
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published
+// by the Free Software Foundation, version 3.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see .
+
+//go:build linux
+// +build linux
+
+package logger
+
+import (
+ "github.com/rs/zerolog"
+ "github.com/rs/zerolog/journald"
+)
+
+// InitJournalDLogger configures the logger to write to journald
+func InitJournalDLogger(level zerolog.Level) {
+ logger = zerolog.New(journald.NewJournalDWriter()).Level(level)
+ consoleLogger = zerolog.Nop()
+}
diff --git a/internal/logger/journald_nolinux.go b/internal/logger/journald_nolinux.go
new file mode 100644
index 00000000..242b11d0
--- /dev/null
+++ b/internal/logger/journald_nolinux.go
@@ -0,0 +1,25 @@
+// Copyright (C) 2019 Nicola Murino
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published
+// by the Free Software Foundation, version 3.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see .
+
+//go:build !linux
+// +build !linux
+
+package logger
+
+import "github.com/rs/zerolog"
+
+// InitJournalDLogger configures the logger to write to journald
+func InitJournalDLogger(level zerolog.Level) {
+ InitStdErrLogger(level)
+}
diff --git a/internal/logger/logger.go b/internal/logger/logger.go
index 59ff863f..853c7f09 100644
--- a/internal/logger/logger.go
+++ b/internal/logger/logger.go
@@ -29,7 +29,9 @@ import (
"os"
"path/filepath"
"time"
+ "unsafe"
+ ftpserverlog "github.com/fclairamb/go-log"
"github.com/rs/zerolog"
lumberjack "gopkg.in/natefinch/lumberjack.v2"
)
@@ -266,26 +268,6 @@ func ConnectionFailedLog(user, ip, loginType, protocol, errorString string) {
Send()
}
-// LoginLog logs successful logins.
-func LoginLog(user, ip, loginMethod, protocol, connectionID, clientVersion string, encrypted bool, info string) {
- ev := logger.Info()
- ev.Timestamp().
- Str("sender", "login").
- Str("ip", ip).
- Str("username", user).
- Str("method", loginMethod).
- Str("protocol", protocol)
- if connectionID != "" {
- ev.Str("connection_id", connectionID)
- }
- ev.Str("client", clientVersion).
- Bool("encrypted", encrypted)
- if info != "" {
- ev.Str("info", info)
- }
- ev.Send()
-}
-
func isLogFilePathValid(logFilePath string) bool {
cleanInput := filepath.Clean(logFilePath)
if cleanInput == "." || cleanInput == ".." {
@@ -308,7 +290,7 @@ func (l *StdLoggerWrapper) Write(p []byte) (n int, err error) {
p = p[0 : n-1]
}
- Log(LevelError, l.Sender, "", "%s", p)
+ Log(LevelError, l.Sender, "", "%s", bytesToString(p))
return
}
@@ -380,3 +362,20 @@ func (l *LeveledLogger) Warn(msg string, keysAndValues ...any) {
func (l *LeveledLogger) Panic(msg string, keysAndValues ...any) {
l.Error(msg, keysAndValues...)
}
+
+// With returns a LeveledLogger with additional context specific keyvals
+func (l *LeveledLogger) With(keysAndValues ...any) ftpserverlog.Logger {
+ return &LeveledLogger{
+ Sender: l.Sender,
+ additionalKeyVals: append(l.additionalKeyVals, keysAndValues...),
+ }
+}
+
+func bytesToString(b []byte) string {
+ // unsafe.SliceData relies on cap whereas we want to rely on len
+ if len(b) == 0 {
+ return ""
+ }
+ // https://github.com/golang/go/blob/4ed358b57efdad9ed710be7f4fc51495a7620ce2/src/strings/builder.go#L41
+ return unsafe.String(unsafe.SliceData(b), len(b))
+}
diff --git a/internal/logger/request_logger.go b/internal/logger/request_logger.go
index 325f44b9..fa269d7e 100644
--- a/internal/logger/request_logger.go
+++ b/internal/logger/request_logger.go
@@ -15,7 +15,6 @@
package logger
import (
- "crypto/tls"
"fmt"
"net"
"net/http"
@@ -51,21 +50,17 @@ func NewStructuredLogger(logger *zerolog.Logger) func(next http.Handler) http.Ha
// NewLogEntry creates a new log entry for an HTTP request
func (l *StructuredLogger) NewLogEntry(r *http.Request) middleware.LogEntry {
scheme := "http"
- cipherSuite := ""
if r.TLS != nil {
scheme = "https"
- cipherSuite = tls.CipherSuiteName(r.TLS.CipherSuite)
}
fields := map[string]any{
- "local_addr": getLocalAddress(r),
- "remote_addr": r.RemoteAddr,
- "proto": r.Proto,
- "method": r.Method,
- "user_agent": r.UserAgent(),
- "uri": fmt.Sprintf("%s://%s%s", scheme, r.Host, r.RequestURI),
- "cipher_suite": cipherSuite,
- }
+ "local_addr": getLocalAddress(r),
+ "remote_addr": r.RemoteAddr,
+ "proto": r.Proto,
+ "method": r.Method,
+ "user_agent": r.UserAgent(),
+ "uri": fmt.Sprintf("%s://%s%s", scheme, r.Host, r.RequestURI)}
reqID := middleware.GetReqID(r.Context())
if reqID != "" {
diff --git a/internal/logger/slog.go b/internal/logger/slog.go
deleted file mode 100644
index e9a544d0..00000000
--- a/internal/logger/slog.go
+++ /dev/null
@@ -1,97 +0,0 @@
-// Copyright (C) 2025 Nicola Murino
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published
-// by the Free Software Foundation, version 3.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see .
-
-package logger
-
-import (
- "context"
- "log/slog"
- "slices"
-
- "github.com/rs/zerolog"
-)
-
-// slogAdapter is an adapter for slog.Handler
-type slogAdapter struct {
- sender string
- attrs []slog.Attr
-}
-
-// NewSlogAdapter creates a slog.Handler adapter
-func NewSlogAdapter(sender string, attrs []slog.Attr) *slogAdapter {
- return &slogAdapter{
- sender: sender,
- attrs: attrs,
- }
-}
-
-func (l *slogAdapter) Enabled(ctx context.Context, level slog.Level) bool {
- // Log level is handled by our implementation
- return true
-}
-
-func (l *slogAdapter) Handle(ctx context.Context, r slog.Record) error {
- var ev *zerolog.Event
- switch r.Level {
- case slog.LevelDebug:
- ev = logger.Debug()
- case slog.LevelInfo:
- ev = logger.Info()
- case slog.LevelWarn:
- ev = logger.Warn()
- case slog.LevelError:
- ev = logger.Error()
- default:
- ev = logger.Debug()
- }
-
- ev.Timestamp()
- if l.sender != "" {
- ev.Str("sender", l.sender)
- }
-
- addSlogAttr := func(a slog.Attr) {
- if a.Key == "time" {
- return
- }
- ev.Any(a.Key, a.Value.Any())
- }
-
- for _, a := range l.attrs {
- addSlogAttr(a)
- }
-
- r.Attrs(func(a slog.Attr) bool {
- addSlogAttr(a)
- return true
- })
-
- ev.Msg(r.Message)
-
- return nil
-}
-
-func (l *slogAdapter) WithAttrs(attrs []slog.Attr) slog.Handler {
- newHandler := *l
- newHandler.attrs = slices.Concat(l.attrs, attrs)
- return &newHandler
-}
-
-func (l *slogAdapter) WithGroup(name string) slog.Handler {
- newHandler := *l
- if name != "" {
- newHandler.sender = name
- }
- return &newHandler
-}
diff --git a/internal/metric/metric.go b/internal/metric/metric.go
index 4e3e95d8..f192225d 100644
--- a/internal/metric/metric.go
+++ b/internal/metric/metric.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build !nometrics
+// +build !nometrics
// Package metric provides Prometheus metrics support
package metric
diff --git a/internal/metric/metric_disabled.go b/internal/metric/metric_disabled.go
index 78bacfdd..63369703 100644
--- a/internal/metric/metric_disabled.go
+++ b/internal/metric/metric_disabled.go
@@ -1,18 +1,5 @@
-// Copyright (C) 2019 Nicola Murino
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published
-// by the Free Software Foundation, version 3.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see .
-
//go:build nometrics
+// +build nometrics
package metric
diff --git a/internal/plugin/kms.go b/internal/plugin/kms.go
index b4ed5be1..2da9acf9 100644
--- a/internal/plugin/kms.go
+++ b/internal/plugin/kms.go
@@ -17,7 +17,6 @@ package plugin
import (
"fmt"
"path/filepath"
- "slices"
"github.com/hashicorp/go-hclog"
"github.com/hashicorp/go-plugin"
@@ -26,13 +25,14 @@ import (
"github.com/drakkan/sftpgo/v2/internal/kms"
"github.com/drakkan/sftpgo/v2/internal/logger"
+ "github.com/drakkan/sftpgo/v2/internal/util"
)
var (
validKMSSchemes = []string{sdkkms.SchemeAWS, sdkkms.SchemeGCP, sdkkms.SchemeVaultTransit,
- sdkkms.SchemeAzureKeyVault, sdkkms.SchemeOracleKeyVault}
+ sdkkms.SchemeAzureKeyVault, "ocikeyvault"}
validKMSEncryptedStatuses = []string{sdkkms.SecretStatusVaultTransit, sdkkms.SecretStatusAWS, sdkkms.SecretStatusGCP,
- sdkkms.SecretStatusAzureKeyVault, sdkkms.SecretStatusOracleKeyVault}
+ sdkkms.SecretStatusAzureKeyVault, "OracleKeyVault"}
)
// KMSConfig defines configuration parameters for kms plugins
@@ -42,10 +42,10 @@ type KMSConfig struct {
}
func (c *KMSConfig) validate() error {
- if !slices.Contains(validKMSSchemes, c.Scheme) {
+ if !util.Contains(validKMSSchemes, c.Scheme) {
return fmt.Errorf("invalid kms scheme: %v", c.Scheme)
}
- if !slices.Contains(validKMSEncryptedStatuses, c.EncryptedStatus) {
+ if !util.Contains(validKMSEncryptedStatuses, c.EncryptedStatus) {
return fmt.Errorf("invalid kms encrypted status: %v", c.EncryptedStatus)
}
return nil
diff --git a/internal/plugin/notifier.go b/internal/plugin/notifier.go
index 2a37c462..0e9ac9ec 100644
--- a/internal/plugin/notifier.go
+++ b/internal/plugin/notifier.go
@@ -16,7 +16,6 @@ package plugin
import (
"fmt"
- "slices"
"sync"
"time"
@@ -25,6 +24,7 @@ import (
"github.com/sftpgo/sdk/plugin/notifier"
"github.com/drakkan/sftpgo/v2/internal/logger"
+ "github.com/drakkan/sftpgo/v2/internal/util"
)
// NotifierConfig defines configuration parameters for notifiers plugins
@@ -50,19 +50,97 @@ func (c *NotifierConfig) hasActions() bool {
return false
}
-type notifierPlugin struct {
- config Config
- notifier notifier.Notifier
- client *plugin.Client
- mu sync.RWMutex
+type eventsQueue struct {
+ sync.RWMutex
fsEvents []*notifier.FsEvent
providerEvents []*notifier.ProviderEvent
logEvents []*notifier.LogEvent
}
+func (q *eventsQueue) addFsEvent(event *notifier.FsEvent) {
+ q.Lock()
+ defer q.Unlock()
+
+ q.fsEvents = append(q.fsEvents, event)
+}
+
+func (q *eventsQueue) addProviderEvent(event *notifier.ProviderEvent) {
+ q.Lock()
+ defer q.Unlock()
+
+ q.providerEvents = append(q.providerEvents, event)
+}
+
+func (q *eventsQueue) addLogEvent(event *notifier.LogEvent) {
+ q.Lock()
+ defer q.Unlock()
+
+ q.logEvents = append(q.logEvents, event)
+}
+
+func (q *eventsQueue) popFsEvent() *notifier.FsEvent {
+ q.Lock()
+ defer q.Unlock()
+
+ if len(q.fsEvents) == 0 {
+ return nil
+ }
+ truncLen := len(q.fsEvents) - 1
+ ev := q.fsEvents[truncLen]
+ q.fsEvents[truncLen] = nil
+ q.fsEvents = q.fsEvents[:truncLen]
+
+ return ev
+}
+
+func (q *eventsQueue) popProviderEvent() *notifier.ProviderEvent {
+ q.Lock()
+ defer q.Unlock()
+
+ if len(q.providerEvents) == 0 {
+ return nil
+ }
+ truncLen := len(q.providerEvents) - 1
+ ev := q.providerEvents[truncLen]
+ q.providerEvents[truncLen] = nil
+ q.providerEvents = q.providerEvents[:truncLen]
+
+ return ev
+}
+
+func (q *eventsQueue) popLogEvent() *notifier.LogEvent {
+ q.Lock()
+ defer q.Unlock()
+
+ if len(q.logEvents) == 0 {
+ return nil
+ }
+ truncLen := len(q.logEvents) - 1
+ ev := q.logEvents[truncLen]
+ q.logEvents[truncLen] = nil
+ q.logEvents = q.logEvents[:truncLen]
+
+ return ev
+}
+
+func (q *eventsQueue) getSize() int {
+ q.RLock()
+ defer q.RUnlock()
+
+ return len(q.providerEvents) + len(q.fsEvents) + len(q.logEvents)
+}
+
+type notifierPlugin struct {
+ config Config
+ notifier notifier.Notifier
+ client *plugin.Client
+ queue *eventsQueue
+}
+
func newNotifierPlugin(config Config) (*notifierPlugin, error) {
p := ¬ifierPlugin{
config: config,
+ queue: &eventsQueue{},
}
if err := p.initialize(); err != nil {
logger.Warn(logSender, "", "unable to create notifier plugin: %v, config %+v", err, config)
@@ -102,7 +180,7 @@ func (p *notifierPlugin) initialize() error {
Managed: false,
Logger: &logger.HCLogAdapter{
Logger: hclog.New(&hclog.LoggerOptions{
- Name: fmt.Sprintf("%s.%s", logSender, notifier.PluginName),
+ Name: fmt.Sprintf("%v.%v", logSender, notifier.PluginName),
Level: pluginsLogLevel,
DisableTime: true,
}),
@@ -126,34 +204,6 @@ func (p *notifierPlugin) initialize() error {
return nil
}
-func (p *notifierPlugin) queueSize() int {
- p.mu.RLock()
- defer p.mu.RUnlock()
-
- return len(p.providerEvents) + len(p.fsEvents) + len(p.logEvents)
-}
-
-func (p *notifierPlugin) queueFsEvent(ev *notifier.FsEvent) {
- p.mu.Lock()
- defer p.mu.Unlock()
-
- p.fsEvents = append(p.fsEvents, ev)
-}
-
-func (p *notifierPlugin) queueProviderEvent(ev *notifier.ProviderEvent) {
- p.mu.Lock()
- defer p.mu.Unlock()
-
- p.providerEvents = append(p.providerEvents, ev)
-}
-
-func (p *notifierPlugin) queueLogEvent(ev *notifier.LogEvent) {
- p.mu.Lock()
- defer p.mu.Unlock()
-
- p.logEvents = append(p.logEvents, ev)
-}
-
func (p *notifierPlugin) canQueueEvent(timestamp int64) bool {
if p.config.NotifierOptions.RetryMaxTime == 0 {
return false
@@ -164,105 +214,107 @@ func (p *notifierPlugin) canQueueEvent(timestamp int64) bool {
return false
}
if p.config.NotifierOptions.RetryQueueMaxSize > 0 {
- return p.queueSize() < p.config.NotifierOptions.RetryQueueMaxSize
+ return p.queue.getSize() < p.config.NotifierOptions.RetryQueueMaxSize
}
return true
}
func (p *notifierPlugin) notifyFsAction(event *notifier.FsEvent) {
- if !slices.Contains(p.config.NotifierOptions.FsEvents, event.Action) {
+ if !util.Contains(p.config.NotifierOptions.FsEvents, event.Action) {
return
}
- p.sendFsEvent(event)
+
+ go func() {
+ Handler.addTask()
+ defer Handler.removeTask()
+
+ p.sendFsEvent(event)
+ }()
}
func (p *notifierPlugin) notifyProviderAction(event *notifier.ProviderEvent, object Renderer) {
- if !slices.Contains(p.config.NotifierOptions.ProviderEvents, event.Action) ||
- !slices.Contains(p.config.NotifierOptions.ProviderObjects, event.ObjectType) {
+ if !util.Contains(p.config.NotifierOptions.ProviderEvents, event.Action) ||
+ !util.Contains(p.config.NotifierOptions.ProviderObjects, event.ObjectType) {
return
}
- p.sendProviderEvent(event, object)
+
+ go func() {
+ Handler.addTask()
+ defer Handler.removeTask()
+
+ objectAsJSON, err := object.RenderAsJSON(event.Action != "delete")
+ if err != nil {
+ logger.Warn(logSender, "", "unable to render user as json for action %v: %v", event.Action, err)
+ return
+ }
+ event.ObjectData = objectAsJSON
+ p.sendProviderEvent(event)
+ }()
}
func (p *notifierPlugin) notifyLogEvent(event *notifier.LogEvent) {
- p.sendLogEvent(event)
-}
-
-func (p *notifierPlugin) sendFsEvent(ev *notifier.FsEvent) {
- go func(event *notifier.FsEvent) {
+ go func() {
Handler.addTask()
defer Handler.removeTask()
- if err := p.notifier.NotifyFsEvent(event); err != nil {
- logger.Warn(logSender, "", "unable to send fs action notification to plugin %v: %v", p.config.Cmd, err)
- if p.canQueueEvent(event.Timestamp) {
- p.queueFsEvent(event)
- }
- }
- }(ev)
+ p.sendLogEvent(event)
+ }()
}
-func (p *notifierPlugin) sendProviderEvent(ev *notifier.ProviderEvent, object Renderer) {
- go func(event *notifier.ProviderEvent) {
- Handler.addTask()
- defer Handler.removeTask()
-
- if object != nil {
- objectAsJSON, err := object.RenderAsJSON(event.Action != "delete")
- if err != nil {
- logger.Error(logSender, "", "unable to render user as json for action %q: %v", event.Action, err)
- } else {
- event.ObjectData = objectAsJSON
- }
+func (p *notifierPlugin) sendFsEvent(event *notifier.FsEvent) {
+ if err := p.notifier.NotifyFsEvent(event); err != nil {
+ logger.Warn(logSender, "", "unable to send fs action notification to plugin %v: %v", p.config.Cmd, err)
+ if p.canQueueEvent(event.Timestamp) {
+ p.queue.addFsEvent(event)
}
-
- if err := p.notifier.NotifyProviderEvent(event); err != nil {
- logger.Warn(logSender, "", "unable to send user action notification to plugin %v: %v", p.config.Cmd, err)
- if p.canQueueEvent(event.Timestamp) {
- p.queueProviderEvent(event)
- }
- }
- }(ev)
+ }
}
-func (p *notifierPlugin) sendLogEvent(ev *notifier.LogEvent) {
- go func(event *notifier.LogEvent) {
- Handler.addTask()
- defer Handler.removeTask()
-
- if err := p.notifier.NotifyLogEvent(event); err != nil {
- logger.Warn(logSender, "", "unable to send log event to plugin %v: %v", p.config.Cmd, err)
- if p.canQueueEvent(event.Timestamp) {
- p.queueLogEvent(event)
- }
+func (p *notifierPlugin) sendProviderEvent(event *notifier.ProviderEvent) {
+ if err := p.notifier.NotifyProviderEvent(event); err != nil {
+ logger.Warn(logSender, "", "unable to send user action notification to plugin %v: %v", p.config.Cmd, err)
+ if p.canQueueEvent(event.Timestamp) {
+ p.queue.addProviderEvent(event)
}
- }(ev)
+ }
+}
+
+func (p *notifierPlugin) sendLogEvent(event *notifier.LogEvent) {
+ if err := p.notifier.NotifyLogEvent(event); err != nil {
+ logger.Warn(logSender, "", "unable to send log event to plugin %v: %v", p.config.Cmd, err)
+ if p.canQueueEvent(event.Timestamp) {
+ p.queue.addLogEvent(event)
+ }
+ }
}
func (p *notifierPlugin) sendQueuedEvents() {
- queueSize := p.queueSize()
+ queueSize := p.queue.getSize()
if queueSize == 0 {
return
}
- p.mu.Lock()
- defer p.mu.Unlock()
-
- logger.Debug(logSender, "", "send queued events for notifier %q, events size: %v", p.config.Cmd, queueSize)
-
- for _, ev := range p.fsEvents {
- p.sendFsEvent(ev)
+ logger.Debug(logSender, "", "check queued events for notifier %q, events size: %v", p.config.Cmd, queueSize)
+ fsEv := p.queue.popFsEvent()
+ for fsEv != nil {
+ go func(ev *notifier.FsEvent) {
+ p.sendFsEvent(ev)
+ }(fsEv)
+ fsEv = p.queue.popFsEvent()
}
- p.fsEvents = nil
- for _, ev := range p.providerEvents {
- p.sendProviderEvent(ev, nil)
+ providerEv := p.queue.popProviderEvent()
+ for providerEv != nil {
+ go func(ev *notifier.ProviderEvent) {
+ p.sendProviderEvent(ev)
+ }(providerEv)
+ providerEv = p.queue.popProviderEvent()
}
- p.providerEvents = nil
-
- for _, ev := range p.logEvents {
- p.sendLogEvent(ev)
+ logEv := p.queue.popLogEvent()
+ for logEv != nil {
+ go func(ev *notifier.LogEvent) {
+ p.sendLogEvent(ev)
+ }(logEv)
+ logEv = p.queue.popLogEvent()
}
- p.logEvents = nil
-
- logger.Debug(logSender, "", "%d queued events sent for notifier %q,", queueSize, p.config.Cmd)
+ logger.Debug(logSender, "", "queued events sent for notifier %q, new events size: %v", p.config.Cmd, p.queue.getSize())
}
diff --git a/internal/plugin/plugin.go b/internal/plugin/plugin.go
index 94479c81..d36f0926 100644
--- a/internal/plugin/plugin.go
+++ b/internal/plugin/plugin.go
@@ -24,7 +24,6 @@ import (
"os"
"os/exec"
"path/filepath"
- "slices"
"strings"
"sync"
"sync/atomic"
@@ -337,7 +336,7 @@ func (m *Manager) NotifyLogEvent(event notifier.LogEventType, protocol, username
var e *notifier.LogEvent
for _, n := range m.notifiers {
- if slices.Contains(n.config.NotifierOptions.LogEvents, int(event)) {
+ if util.Contains(n.config.NotifierOptions.LogEvents, int(event)) {
if e == nil {
message := ""
if err != nil {
@@ -642,9 +641,7 @@ func (m *Manager) restartNotifierPlugin(config Config, idx int) {
}
m.notifLock.Lock()
- plugin.fsEvents = m.notifiers[idx].fsEvents
- plugin.providerEvents = m.notifiers[idx].providerEvents
- plugin.logEvents = m.notifiers[idx].logEvents
+ plugin.queue = m.notifiers[idx].queue
m.notifiers[idx] = plugin
m.notifLock.Unlock()
plugin.sendQueuedEvents()
diff --git a/internal/service/awscontainer.go b/internal/service/awscontainer.go
new file mode 100644
index 00000000..481085e4
--- /dev/null
+++ b/internal/service/awscontainer.go
@@ -0,0 +1,182 @@
+// Copyright (C) 2019 Nicola Murino
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published
+// by the Free Software Foundation, version 3.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see .
+
+//go:build awscontainer
+// +build awscontainer
+
+package service
+
+import (
+ "context"
+ "errors"
+ "fmt"
+ "time"
+
+ "github.com/aws/aws-sdk-go-v2/aws"
+ awsconfig "github.com/aws/aws-sdk-go-v2/config"
+ "github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
+ "github.com/aws/aws-sdk-go-v2/service/marketplacemetering"
+ "github.com/aws/aws-sdk-go-v2/service/secretsmanager"
+ "github.com/google/uuid"
+
+ "github.com/drakkan/sftpgo/v2/internal/config"
+ "github.com/drakkan/sftpgo/v2/internal/dataprovider"
+ "github.com/drakkan/sftpgo/v2/internal/httpd"
+ "github.com/drakkan/sftpgo/v2/internal/logger"
+ "github.com/drakkan/sftpgo/v2/internal/util"
+)
+
+const (
+ installCodeName = "SFTPGo_Installation_Code"
+)
+
+var (
+ awsProductCode = ""
+)
+
+func registerAWSContainer(disableAWSInstallationCode bool) error {
+ if awsProductCode == "" {
+ return errors.New("product code not set")
+ }
+ ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+ defer cancel()
+
+ cfg, err := getAWSConfig(ctx)
+ if err != nil {
+ return fmt.Errorf("unable to get config to register AWS container: %w", err)
+ }
+ if !disableAWSInstallationCode {
+ if err := setInstallationCode(cfg); err != nil {
+ return err
+ }
+ }
+ requestNonce, err := uuid.NewRandom()
+ if err != nil {
+ return fmt.Errorf("unable to generate nonce for metering API: %w", err)
+ }
+ svc := marketplacemetering.NewFromConfig(cfg)
+ result, err := svc.RegisterUsage(ctx, &marketplacemetering.RegisterUsageInput{
+ ProductCode: aws.String(awsProductCode),
+ PublicKeyVersion: aws.Int32(1),
+ Nonce: aws.String(requestNonce.String()),
+ })
+ if err != nil {
+ return fmt.Errorf("unable to register API operation for AWSMarketplace Metering: %w", err)
+ }
+ logger.Debug(logSender, "", "API operation for AWSMarketplace Metering registered, token %q",
+ util.GetStringFromPointer(result.Signature))
+ return nil
+}
+
+func getAWSConfig(ctx context.Context) (aws.Config, error) {
+ cfg, err := awsconfig.LoadDefaultConfig(ctx)
+ if err != nil {
+ return cfg, fmt.Errorf("unable to get config to register AWS container: %w", err)
+ }
+ if cfg.Region == "" {
+ svc := imds.NewFromConfig(cfg)
+ region, err := svc.GetRegion(ctx, &imds.GetRegionInput{})
+ if err == nil {
+ logger.Debug(logSender, "", "AWS region from imds %q", region.Region)
+ cfg.Region = region.Region
+ } else {
+ logger.Warn(logSender, "", "unable to get region from imds, continuing anyway, error: %v", err)
+ }
+ }
+ return cfg, nil
+}
+
+func setInstallationCode(cfg aws.Config) error {
+ if dataprovider.HasAdmin() {
+ return nil
+ }
+ installationCode := util.GenerateUniqueID()
+ requestToken, err := uuid.NewRandom()
+ if err != nil {
+ return fmt.Errorf("unable to generate client request token: %w", err)
+ }
+
+ ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+ defer cancel()
+
+ svc := secretsmanager.NewFromConfig(cfg)
+ _, err = svc.GetSecretValue(ctx, &secretsmanager.GetSecretValueInput{
+ SecretId: aws.String(installCodeName),
+ })
+ if err == nil {
+ // update existing secret
+ result, err := svc.UpdateSecret(ctx, &secretsmanager.UpdateSecretInput{
+ SecretId: aws.String(installCodeName),
+ ClientRequestToken: aws.String(requestToken.String()),
+ SecretString: aws.String(installationCode),
+ })
+ if err != nil {
+ return fmt.Errorf("unable to update installation code: %w", err)
+ }
+ logger.Debug(logSender, "", "installation code updated, secret name %q, arn %q, version id %q",
+ util.GetStringFromPointer(result.Name), util.GetStringFromPointer(result.ARN),
+ util.GetStringFromPointer(result.VersionId))
+ } else {
+ // create new secret
+ logger.Debug(logSender, "", "unable to get the current installation secret, trying to create a new one, error: %v", err)
+ result, err := svc.CreateSecret(ctx, &secretsmanager.CreateSecretInput{
+ Name: aws.String(installCodeName),
+ ClientRequestToken: aws.String(requestToken.String()),
+ SecretString: aws.String(installationCode),
+ })
+ if err != nil {
+ return fmt.Errorf("unable to create installation code: %w", err)
+ }
+ logger.Debug(logSender, "", "installation code set, secret name %q, arn %q, version id %q",
+ util.GetStringFromPointer(result.Name), util.GetStringFromPointer(result.ARN),
+ util.GetStringFromPointer(result.VersionId))
+ }
+ httpdConfig := config.GetHTTPDConfig()
+ httpdConfig.Setup.InstallationCode = installationCode
+ httpdConfig.Setup.InstallationCodeHint = "Installation code stored in Secrets Manager"
+ config.SetHTTPDConfig(httpdConfig)
+ httpd.SetInstallationCodeResolver(resolveInstallationCode)
+
+ return nil
+}
+
+// function called to validate the user provided secret
+func resolveInstallationCode(defaultInstallationCode string) string {
+ logger.Debug(logSender, "", "resolving installation code")
+ ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+ defer cancel()
+
+ cfg, err := getAWSConfig(ctx)
+ if err != nil {
+ logger.Error(logSender, "", "unable to get config to resolve installation code: %v", err)
+ return defaultInstallationCode
+ }
+
+ svc := secretsmanager.NewFromConfig(cfg)
+ result, err := svc.GetSecretValue(ctx, &secretsmanager.GetSecretValueInput{
+ SecretId: aws.String(installCodeName),
+ })
+ if err != nil {
+ logger.Error(logSender, "", "unable to resolve installation code: %v", err)
+ return defaultInstallationCode
+ }
+
+ resolvedCode := util.GetStringFromPointer(result.SecretString)
+ if resolvedCode == "" {
+ logger.Error(logSender, "", "resolved installation code is empty")
+ return defaultInstallationCode
+ }
+ logger.Debug(logSender, "", "installation code resolved")
+ return resolvedCode
+}
diff --git a/internal/service/awscontainer_disabled.go b/internal/service/awscontainer_disabled.go
new file mode 100644
index 00000000..130fa775
--- /dev/null
+++ b/internal/service/awscontainer_disabled.go
@@ -0,0 +1,22 @@
+// Copyright (C) 2019 Nicola Murino
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published
+// by the Free Software Foundation, version 3.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see .
+
+//go:build !awscontainer
+// +build !awscontainer
+
+package service
+
+func registerAWSContainer(_ bool) error {
+ return nil
+}
diff --git a/internal/service/service.go b/internal/service/service.go
index 6cb9db8b..3a8d5c81 100644
--- a/internal/service/service.go
+++ b/internal/service/service.go
@@ -39,6 +39,7 @@ const (
)
var (
+ chars = []rune("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789")
graceTime int
)
@@ -88,7 +89,7 @@ func (s *Service) initLogger() {
}
// Start initializes and starts the service
-func (s *Service) Start() error {
+func (s *Service) Start(disableAWSInstallationCode bool) error {
s.initLogger()
logger.Info(logSender, "", "starting SFTPGo %s, config dir: %s, config file: %s, log max size: %d log max backups: %d "+
"log max age: %d log level: %s, log compress: %t, log utc time: %t, load data from: %q, grace time: %d secs",
@@ -109,7 +110,7 @@ func (s *Service) Start() error {
return errors.New(infoString)
}
- if err := s.initializeServices(); err != nil {
+ if err := s.initializeServices(disableAWSInstallationCode); err != nil {
return err
}
@@ -119,7 +120,7 @@ func (s *Service) Start() error {
return nil
}
-func (s *Service) initializeServices() error {
+func (s *Service) initializeServices(disableAWSInstallationCode bool) error {
providerConf := config.GetProviderConf()
kmsConfig := config.GetKMSConfig()
err := kmsConfig.Initialize()
@@ -179,6 +180,12 @@ func (s *Service) initializeServices() error {
}
}
+ if err := registerAWSContainer(disableAWSInstallationCode); err != nil {
+ logger.Error(logSender, "", "error registering AWS container: %v", err)
+ logger.ErrorToConsole("error registering AWS container: %v", err)
+ return err
+ }
+
httpConfig := config.GetHTTPConfig()
err = httpConfig.Initialize(s.ConfigDir)
if err != nil {
diff --git a/internal/service/service_portable.go b/internal/service/service_portable.go
index 91d5fc79..06b05f7a 100644
--- a/internal/service/service_portable.go
+++ b/internal/service/service_portable.go
@@ -13,13 +13,13 @@
// along with this program. If not, see .
//go:build !noportable
+// +build !noportable
package service
import (
"fmt"
"math/rand"
- "slices"
"strings"
"github.com/sftpgo/sdk"
@@ -69,7 +69,7 @@ func (s *Service) StartPortableMode(sftpdPort, ftpPort, webdavPort, httpPort int
configurePortableWebDAVService(webdavPort, webDavCert, webDavKey)
configurePortableHTTPService(httpPort, httpsCert, httpsKey)
- err = s.Start()
+ err = s.Start(true)
if err != nil {
return err
}
@@ -95,24 +95,24 @@ func (s *Service) StartPortableMode(sftpdPort, ftpPort, webdavPort, httpPort int
func (s *Service) getServiceOptionalInfoString() string {
var info strings.Builder
if config.GetSFTPDConfig().Bindings[0].IsValid() {
- fmt.Fprintf(&info, "SFTP port: %d ", config.GetSFTPDConfig().Bindings[0].Port)
+ info.WriteString(fmt.Sprintf("SFTP port: %v ", config.GetSFTPDConfig().Bindings[0].Port))
}
if config.GetFTPDConfig().Bindings[0].IsValid() {
- fmt.Fprintf(&info, "FTP port: %d ", config.GetFTPDConfig().Bindings[0].Port)
+ info.WriteString(fmt.Sprintf("FTP port: %v ", config.GetFTPDConfig().Bindings[0].Port))
}
if config.GetWebDAVDConfig().Bindings[0].IsValid() {
scheme := "http"
if config.GetWebDAVDConfig().CertificateFile != "" && config.GetWebDAVDConfig().CertificateKeyFile != "" {
scheme = "https"
}
- fmt.Fprintf(&info, "WebDAV URL: %v://:%v/ ", scheme, config.GetWebDAVDConfig().Bindings[0].Port)
+ info.WriteString(fmt.Sprintf("WebDAV URL: %v://:%v/ ", scheme, config.GetWebDAVDConfig().Bindings[0].Port))
}
if config.GetHTTPDConfig().Bindings[0].IsValid() {
scheme := "http"
if config.GetHTTPDConfig().CertificateFile != "" && config.GetHTTPDConfig().CertificateKeyFile != "" {
scheme = "https"
}
- fmt.Fprintf(&info, "WebClient URL: %s://:%d/ ", scheme, config.GetHTTPDConfig().Bindings[0].Port)
+ info.WriteString(fmt.Sprintf("WebClient URL: %v://:%v/ ", scheme, config.GetHTTPDConfig().Bindings[0].Port))
}
return info.String()
}
@@ -144,15 +144,16 @@ func (s *Service) configurePortableUser() string {
printablePassword = "[redacted]"
}
if len(s.PortableUser.PublicKeys) == 0 && s.PortableUser.Password == "" {
- s.PortableUser.Password = util.GenerateUniqueID()
+ var b strings.Builder
+ for i := 0; i < 16; i++ {
+ b.WriteRune(chars[rand.Intn(len(chars))])
+ }
+ s.PortableUser.Password = b.String()
printablePassword = s.PortableUser.Password
}
s.PortableUser.Filters.WebClient = []string{sdk.WebClientSharesDisabled, sdk.WebClientInfoChangeDisabled,
sdk.WebClientPubKeyChangeDisabled, sdk.WebClientPasswordChangeDisabled, sdk.WebClientAPIKeyAuthChangeDisabled,
- sdk.WebClientMFADisabled, sdk.WebClientPasswordResetDisabled, sdk.WebClientTLSCertChangeDisabled,
- }
- if !s.PortableUser.HasAnyPerm([]string{dataprovider.PermUpload, dataprovider.PermOverwrite}, "/") {
- s.PortableUser.Filters.WebClient = append(s.PortableUser.Filters.WebClient, sdk.WebClientWriteDisabled)
+ sdk.WebClientMFADisabled,
}
s.configurePortableSecrets()
return printablePassword
@@ -210,7 +211,7 @@ func configurePortableSFTPService(port int, enabledSSHCommands []string) {
} else {
sftpdConf.Bindings[0].Port = 0
}
- if slices.Contains(enabledSSHCommands, "*") {
+ if util.Contains(enabledSSHCommands, "*") {
sftpdConf.EnabledSSHCommands = sftpd.GetSupportedSSHCommands()
} else {
sftpdConf.EnabledSSHCommands = enabledSSHCommands
diff --git a/internal/service/service_windows.go b/internal/service/service_windows.go
index 16be97ae..bb1f7627 100644
--- a/internal/service/service_windows.go
+++ b/internal/service/service_windows.go
@@ -108,7 +108,7 @@ func (s *WindowsService) Execute(args []string, r <-chan svc.ChangeRequest, chan
changes <- svc.Status{State: svc.StartPending}
go func() {
- if err := s.Service.Start(); err != nil {
+ if err := s.Service.Start(false); err != nil {
logger.Error(logSender, "", "Windows service failed to start, error: %v", err)
s.Service.Error = err
s.Service.Shutdown <- true
diff --git a/internal/service/signals_unix.go b/internal/service/signals_unix.go
index cecbea9f..22b0c3f1 100644
--- a/internal/service/signals_unix.go
+++ b/internal/service/signals_unix.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build !windows
+// +build !windows
package service
diff --git a/internal/cmd/signals_unix.go b/internal/sftpd/cmd_unix.go
similarity index 58%
rename from internal/cmd/signals_unix.go
rename to internal/sftpd/cmd_unix.go
index 91849b9a..1d0eaca4 100644
--- a/internal/cmd/signals_unix.go
+++ b/internal/sftpd/cmd_unix.go
@@ -1,4 +1,4 @@
-// Copyright (C) 2025 Nicola Murino
+// Copyright (C) 2019 Nicola Murino
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published
@@ -13,29 +13,26 @@
// along with this program. If not, see .
//go:build !windows
+// +build !windows
-package cmd
+package sftpd
import (
"os"
- "os/signal"
+ "os/exec"
"syscall"
-
- "github.com/drakkan/sftpgo/v2/internal/logger"
- "github.com/drakkan/sftpgo/v2/internal/plugin"
)
-func registerSignals() {
- c := make(chan os.Signal, 1)
- signal.Notify(c, syscall.SIGINT, syscall.SIGTERM)
- go func() {
- for sig := range c {
- switch sig {
- case syscall.SIGINT, syscall.SIGTERM:
- logger.DebugToConsole("Received interrupt request")
- plugin.Handler.Cleanup()
- os.Exit(0)
- }
- }
- }()
+var (
+ processUID = os.Geteuid()
+ processGID = os.Getegid()
+)
+
+func wrapCmd(cmd *exec.Cmd, uid, gid int) *exec.Cmd {
+ isCurrentUser := processUID == uid && processGID == gid
+ if (uid > 0 || gid > 0) && !isCurrentUser {
+ cmd.SysProcAttr = &syscall.SysProcAttr{}
+ cmd.SysProcAttr.Credential = &syscall.Credential{Uid: uint32(uid), Gid: uint32(gid)}
+ }
+ return cmd
}
diff --git a/internal/sftpd/cmd_windows.go b/internal/sftpd/cmd_windows.go
new file mode 100644
index 00000000..825045bf
--- /dev/null
+++ b/internal/sftpd/cmd_windows.go
@@ -0,0 +1,23 @@
+// Copyright (C) 2019 Nicola Murino
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published
+// by the Free Software Foundation, version 3.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see .
+
+package sftpd
+
+import (
+ "os/exec"
+)
+
+func wrapCmd(cmd *exec.Cmd, _, _ int) *exec.Cmd {
+ return cmd
+}
diff --git a/internal/sftpd/handler.go b/internal/sftpd/handler.go
index ca8575f5..310e908a 100644
--- a/internal/sftpd/handler.go
+++ b/internal/sftpd/handler.go
@@ -19,7 +19,6 @@ import (
"net"
"os"
"path"
- "strings"
"time"
"github.com/pkg/sftp"
@@ -73,15 +72,10 @@ func (c *Connection) GetCommand() string {
// Fileread creates a reader for a file on the system and returns the reader back.
func (c *Connection) Fileread(request *sftp.Request) (io.ReaderAt, error) {
c.UpdateLastActivity()
- updateRequestPaths(request)
if !c.User.HasPerm(dataprovider.PermDownload, path.Dir(request.Filepath)) {
return nil, sftp.ErrSSHFxPermissionDenied
}
- if err := common.Connections.IsNewTransferAllowed(c.User.Username); err != nil {
- c.Log(logger.LevelInfo, "denying file read due to transfer count limits")
- return nil, c.GetPermissionDeniedError()
- }
transferQuota := c.GetTransferQuota()
if !transferQuota.HasDownloadSpace() {
c.Log(logger.LevelInfo, "denying file read due to quota limits")
@@ -126,14 +120,8 @@ func (c *Connection) Filewrite(request *sftp.Request) (io.WriterAt, error) {
return c.handleFilewrite(request)
}
-func (c *Connection) handleFilewrite(request *sftp.Request) (sftp.WriterAtReaderAt, error) { //nolint:gocyclo
+func (c *Connection) handleFilewrite(request *sftp.Request) (sftp.WriterAtReaderAt, error) {
c.UpdateLastActivity()
- updateRequestPaths(request)
-
- if err := common.Connections.IsNewTransferAllowed(c.User.Username); err != nil {
- c.Log(logger.LevelInfo, "denying file write due to transfer count limits")
- return nil, c.GetPermissionDeniedError()
- }
if ok, _ := c.User.IsFileAllowed(request.Filepath); !ok {
c.Log(logger.LevelWarn, "writing file %q is not allowed", request.Filepath)
@@ -192,7 +180,6 @@ func (c *Connection) handleFilewrite(request *sftp.Request) (sftp.WriterAtReader
// or writing to those files.
func (c *Connection) Filecmd(request *sftp.Request) error {
c.UpdateLastActivity()
- updateRequestPaths(request)
switch request.Method {
case "Setstat":
@@ -225,7 +212,6 @@ func (c *Connection) Filecmd(request *sftp.Request) error {
// a directory as well as perform file/folder stat calls.
func (c *Connection) Filelist(request *sftp.Request) (sftp.ListerAt, error) {
c.UpdateLastActivity()
- updateRequestPaths(request)
switch request.Method {
case "List":
@@ -235,9 +221,9 @@ func (c *Connection) Filelist(request *sftp.Request) (sftp.ListerAt, error) {
}
modTime := time.Unix(0, 0)
if request.Filepath != "/" {
- lister.Prepend(vfs.NewFileInfo("..", true, 0, modTime, false))
+ lister.Add(vfs.NewFileInfo("..", true, 0, modTime, false))
}
- lister.Prepend(vfs.NewFileInfo(".", true, 0, modTime, false))
+ lister.Add(vfs.NewFileInfo(".", true, 0, modTime, false))
return lister, nil
case "Stat":
if !c.User.HasPerm(dataprovider.PermListItems, path.Dir(request.Filepath)) {
@@ -257,7 +243,6 @@ func (c *Connection) Filelist(request *sftp.Request) (sftp.ListerAt, error) {
// Readlink implements the ReadlinkFileLister interface
func (c *Connection) Readlink(filePath string) (string, error) {
- filePath = util.CleanPath(filePath)
if err := c.canReadLink(filePath); err != nil {
return "", err
}
@@ -282,7 +267,6 @@ func (c *Connection) Readlink(filePath string) (string, error) {
// Lstat implements LstatFileLister interface
func (c *Connection) Lstat(request *sftp.Request) (sftp.ListerAt, error) {
c.UpdateLastActivity()
- updateRequestPaths(request)
if !c.User.HasPerm(dataprovider.PermListItems, path.Dir(request.Filepath)) {
return nil, sftp.ErrSSHFxPermissionDenied
@@ -298,14 +282,15 @@ func (c *Connection) Lstat(request *sftp.Request) (sftp.ListerAt, error) {
// RealPath implements the RealPathFileLister interface
func (c *Connection) RealPath(p string) (string, error) {
+ if !c.User.HasPerm(dataprovider.PermListItems, path.Dir(p)) {
+ return "", sftp.ErrSSHFxPermissionDenied
+ }
+
if c.User.Filters.StartDirectory == "" {
p = util.CleanPath(p)
} else {
p = util.CleanPathWithBase(c.User.Filters.StartDirectory, p)
}
- if !c.User.HasPerm(dataprovider.PermListItems, path.Dir(p)) {
- return "", sftp.ErrSSHFxPermissionDenied
- }
fs, fsPath, err := c.GetFsAndResolvedPath(p)
if err != nil {
return "", err
@@ -323,7 +308,6 @@ func (c *Connection) RealPath(p string) (string, error) {
// StatVFS implements StatVFSFileCmder interface
func (c *Connection) StatVFS(r *sftp.Request) (*sftp.StatVFS, error) {
c.UpdateLastActivity()
- updateRequestPaths(r)
// we are assuming that r.Filepath is a dir, this could be wrong but should
// not produce any side effect here.
@@ -473,7 +457,7 @@ func (c *Connection) handleSFTPUploadToExistingFile(fs vfs.Fs, pflags sftp.FileO
}
if common.Config.IsAtomicUploadEnabled() && fs.IsAtomicUploadSupported() {
- _, _, err = fs.Rename(resolvedPath, filePath, 0)
+ _, _, err = fs.Rename(resolvedPath, filePath)
if err != nil {
c.Log(logger.LevelError, "error renaming existing file for atomic upload, source: %q, dest: %q, err: %+v",
resolvedPath, filePath, err)
@@ -575,10 +559,13 @@ func (c *Connection) getStatVFSFromQuotaResult(fs vfs.Fs, name string, quotaResu
func (c *Connection) updateQuotaAfterTruncate(requestPath string, fileSize int64) {
vfolder, err := c.User.GetVirtualFolderForPath(path.Dir(requestPath))
if err == nil {
- dataprovider.UpdateUserFolderQuota(&vfolder, &c.User, 0, -fileSize, false)
- return
+ dataprovider.UpdateVirtualFolderQuota(&vfolder.BaseVirtualFolder, 0, -fileSize, false) //nolint:errcheck
+ if vfolder.IsIncludedInUserQuota() {
+ dataprovider.UpdateUserQuota(&c.User, 0, -fileSize, false) //nolint:errcheck
+ }
+ } else {
+ dataprovider.UpdateUserQuota(&c.User, 0, -fileSize, false) //nolint:errcheck
}
- dataprovider.UpdateUserQuota(&c.User, 0, -fileSize, false) //nolint:errcheck
}
func getOSOpenFlags(requestFlags sftp.FileOpenFlags) (flags int) {
@@ -603,15 +590,3 @@ func getOSOpenFlags(requestFlags sftp.FileOpenFlags) (flags int) {
}
return osFlags
}
-
-func updateRequestPaths(request *sftp.Request) {
- if request.Method == "Symlink" {
- request.Filepath = path.Clean(strings.ReplaceAll(request.Filepath, "\\", "/"))
- } else {
- request.Filepath = util.CleanPath(request.Filepath)
- }
-
- if request.Target != "" {
- request.Target = util.CleanPath(request.Target)
- }
-}
diff --git a/internal/sftpd/internal_test.go b/internal/sftpd/internal_test.go
index 44e93faa..bc96b68a 100644
--- a/internal/sftpd/internal_test.go
+++ b/internal/sftpd/internal_test.go
@@ -16,7 +16,6 @@ package sftpd
import (
"bytes"
- "context"
"errors"
"fmt"
"io"
@@ -25,7 +24,6 @@ import (
"os"
"path/filepath"
"runtime"
- "slices"
"testing"
"time"
@@ -147,7 +145,7 @@ func (fs MockOsFs) Remove(name string, _ bool) error {
}
// Rename renames (moves) source to target
-func (fs MockOsFs) Rename(source, target string, _ int) (int, int64, error) {
+func (fs MockOsFs) Rename(source, target string) (int, int64, error) {
if fs.err != nil {
return -1, -1, fs.err
}
@@ -271,7 +269,6 @@ func TestReadWriteErrors(t *testing.T) {
err = os.Remove(testfile)
assert.NoError(t, err)
assert.Len(t, conn.GetTransfers(), 0)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
}
func TestUnsupportedListOP(t *testing.T) {
@@ -377,9 +374,8 @@ func TestWithInvalidHome(t *testing.T) {
c := Connection{
BaseConnection: common.NewBaseConnection("", common.ProtocolSFTP, "", "", u),
}
- resolved, err := fs.ResolvePath("../upper_path")
- assert.NoError(t, err)
- assert.Equal(t, filepath.Join(u.HomeDir, "upper_path"), resolved)
+ _, err = fs.ResolvePath("../upper_path")
+ assert.Error(t, err, "tested path is not a home subdir")
_, err = c.StatVFS(&sftp.Request{
Method: "StatVFS",
Filepath: "../unresolvable-path",
@@ -422,7 +418,7 @@ func TestSupportedSSHCommands(t *testing.T) {
assert.Equal(t, len(supportedSSHCommands), len(cmds))
for _, c := range cmds {
- assert.True(t, slices.Contains(supportedSSHCommands, c))
+ assert.True(t, util.Contains(supportedSSHCommands, c))
}
}
@@ -529,6 +525,14 @@ func TestSSHCommandErrors(t *testing.T) {
err = cmd.handle()
assert.Error(t, err, "ssh command must fail, we are requesting an invalid path")
+ cmd = sshCommand{
+ command: "git-receive-pack",
+ connection: &connection,
+ args: []string{"/../../testrepo"},
+ }
+ err = cmd.handle()
+ assert.Error(t, err, "ssh command must fail, we are requesting an invalid path")
+
user = dataprovider.User{}
user.Permissions = map[string][]string{
"/": {dataprovider.PermAny},
@@ -539,6 +543,43 @@ func TestSSHCommandErrors(t *testing.T) {
cmd.connection.User = user
_, err = cmd.connection.User.GetFilesystem("123")
assert.NoError(t, err)
+ err = cmd.handle()
+ assert.EqualError(t, err, common.ErrQuotaExceeded.Error())
+
+ cmd.connection.User.QuotaFiles = 0
+ cmd.connection.User.UsedQuotaFiles = 0
+ cmd.connection.User.Permissions = make(map[string][]string)
+ cmd.connection.User.Permissions["/"] = []string{dataprovider.PermListItems}
+ err = cmd.handle()
+ assert.EqualError(t, err, common.ErrPermissionDenied.Error())
+
+ cmd.connection.User.Permissions["/"] = []string{dataprovider.PermAny}
+ cmd.command = "invalid_command"
+ command, err := cmd.getSystemCommand()
+ assert.NoError(t, err)
+
+ err = cmd.executeSystemCommand(command)
+ assert.Error(t, err, "invalid command must fail")
+
+ command, err = cmd.getSystemCommand()
+ assert.NoError(t, err)
+
+ _, err = command.cmd.StderrPipe()
+ assert.NoError(t, err)
+
+ err = cmd.executeSystemCommand(command)
+ assert.Error(t, err, "command must fail, pipe was already assigned")
+
+ err = cmd.executeSystemCommand(command)
+ assert.Error(t, err, "command must fail, pipe was already assigned")
+
+ command, err = cmd.getSystemCommand()
+ assert.NoError(t, err)
+
+ _, err = command.cmd.StdoutPipe()
+ assert.NoError(t, err)
+ err = cmd.executeSystemCommand(command)
+ assert.Error(t, err, "command must fail, pipe was already assigned")
cmd = sshCommand{
command: "sftpgo-remove",
@@ -556,6 +597,23 @@ func TestSSHCommandErrors(t *testing.T) {
err = cmd.handle()
assert.Error(t, err, "ssh command must fail, we are requesting an invalid path")
+ cmd.connection.User.HomeDir = filepath.Clean(os.TempDir())
+
+ cmd = sshCommand{
+ command: "sftpgo-copy",
+ connection: &connection,
+ args: []string{"src", "dst"},
+ }
+
+ cmd.connection.User.Permissions = make(map[string][]string)
+ cmd.connection.User.Permissions["/"] = []string{dataprovider.PermAny}
+
+ common.WaitForTransfers(1)
+ _, err = cmd.getSystemCommand()
+ if assert.Error(t, err) {
+ assert.Contains(t, err.Error(), common.ErrShuttingDown.Error())
+ }
+
err = common.Initialize(common.Config, 0)
assert.NoError(t, err)
}
@@ -596,6 +654,38 @@ func TestCommandsWithExtensionsFilter(t *testing.T) {
}
err := cmd.handleHashCommands()
assert.EqualError(t, err, common.ErrPermissionDenied.Error())
+
+ cmd = sshCommand{
+ command: "rsync",
+ connection: connection,
+ args: []string{"--server", "-vlogDtprze.iLsfxC", ".", "/"},
+ }
+ _, err = cmd.getSystemCommand()
+ assert.EqualError(t, err, errUnsupportedConfig.Error())
+
+ cmd = sshCommand{
+ command: "git-receive-pack",
+ connection: connection,
+ args: []string{"/subdir"},
+ }
+ _, err = cmd.getSystemCommand()
+ assert.EqualError(t, err, errUnsupportedConfig.Error())
+
+ cmd = sshCommand{
+ command: "git-receive-pack",
+ connection: connection,
+ args: []string{"/subdir/dir"},
+ }
+ _, err = cmd.getSystemCommand()
+ assert.EqualError(t, err, errUnsupportedConfig.Error())
+
+ cmd = sshCommand{
+ command: "git-receive-pack",
+ connection: connection,
+ args: []string{"/adir/subdir"},
+ }
+ _, err = cmd.getSystemCommand()
+ assert.NoError(t, err)
}
func TestSSHCommandsRemoteFs(t *testing.T) {
@@ -626,7 +716,17 @@ func TestSSHCommandsRemoteFs(t *testing.T) {
args: []string{},
}
- err := cmd.handleSFTPGoCopy()
+ command, err := cmd.getSystemCommand()
+ assert.NoError(t, err)
+
+ err = cmd.executeSystemCommand(command)
+ assert.Error(t, err, "command must fail for a non local filesystem")
+ cmd = sshCommand{
+ command: "sftpgo-copy",
+ connection: connection,
+ args: []string{},
+ }
+ err = cmd.handleSFTPGoCopy()
assert.Error(t, err)
cmd = sshCommand{
command: "sftpgo-remove",
@@ -675,12 +775,282 @@ func TestSSHCmdGetFsErrors(t *testing.T) {
assert.NoError(t, err)
}
+func TestGitVirtualFolders(t *testing.T) {
+ permissions := make(map[string][]string)
+ permissions["/"] = []string{dataprovider.PermAny}
+ user := dataprovider.User{
+ BaseUser: sdk.BaseUser{
+ Permissions: permissions,
+ HomeDir: os.TempDir(),
+ },
+ }
+ conn := &Connection{
+ BaseConnection: common.NewBaseConnection("", common.ProtocolSFTP, "", "", user),
+ }
+ cmd := sshCommand{
+ command: "git-receive-pack",
+ connection: conn,
+ args: []string{"/vdir"},
+ }
+ cmd.connection.User.VirtualFolders = append(cmd.connection.User.VirtualFolders, vfs.VirtualFolder{
+ BaseVirtualFolder: vfs.BaseVirtualFolder{
+ MappedPath: os.TempDir(),
+ },
+ VirtualPath: "/vdir",
+ })
+ _, err := cmd.getSystemCommand()
+ assert.NoError(t, err)
+ cmd.args = []string{"/"}
+ _, err = cmd.getSystemCommand()
+ assert.EqualError(t, err, errUnsupportedConfig.Error())
+ cmd.args = []string{"/vdir1"}
+ _, err = cmd.getSystemCommand()
+ assert.NoError(t, err)
+
+ cmd.connection.User.VirtualFolders = nil
+ cmd.connection.User.VirtualFolders = append(cmd.connection.User.VirtualFolders, vfs.VirtualFolder{
+ BaseVirtualFolder: vfs.BaseVirtualFolder{
+ MappedPath: os.TempDir(),
+ },
+ VirtualPath: "/vdir",
+ })
+ cmd.args = []string{"/vdir/subdir"}
+ _, err = cmd.getSystemCommand()
+ assert.NoError(t, err)
+
+ cmd.args = []string{"/adir/subdir"}
+ _, err = cmd.getSystemCommand()
+ assert.NoError(t, err)
+}
+
+func TestRsyncOptions(t *testing.T) {
+ permissions := make(map[string][]string)
+ permissions["/"] = []string{dataprovider.PermAny}
+ user := dataprovider.User{
+ BaseUser: sdk.BaseUser{
+ Permissions: permissions,
+ HomeDir: os.TempDir(),
+ },
+ }
+ conn := &Connection{
+ BaseConnection: common.NewBaseConnection("", common.ProtocolSFTP, "", "", user),
+ }
+ sshCmd := sshCommand{
+ command: "rsync",
+ connection: conn,
+ args: []string{"--server", "-vlogDtprze.iLsfxC", ".", "/"},
+ }
+ cmd, err := sshCmd.getSystemCommand()
+ assert.NoError(t, err)
+ assert.True(t, util.Contains(cmd.cmd.Args, "--safe-links"),
+ "--safe-links must be added if the user has the create symlinks permission")
+
+ permissions["/"] = []string{dataprovider.PermDownload, dataprovider.PermUpload, dataprovider.PermCreateDirs,
+ dataprovider.PermListItems, dataprovider.PermOverwrite, dataprovider.PermDelete, dataprovider.PermRename}
+ user.Permissions = permissions
+
+ conn = &Connection{
+ BaseConnection: common.NewBaseConnection("", common.ProtocolSFTP, "", "", user),
+ }
+ sshCmd = sshCommand{
+ command: "rsync",
+ connection: conn,
+ args: []string{"--server", "-vlogDtprze.iLsfxC", ".", "/"},
+ }
+ cmd, err = sshCmd.getSystemCommand()
+ assert.NoError(t, err)
+ assert.True(t, util.Contains(cmd.cmd.Args, "--munge-links"),
+ "--munge-links must be added if the user has the create symlinks permission")
+
+ sshCmd.connection.User.VirtualFolders = append(sshCmd.connection.User.VirtualFolders, vfs.VirtualFolder{
+ BaseVirtualFolder: vfs.BaseVirtualFolder{
+ MappedPath: os.TempDir(),
+ },
+ VirtualPath: "/vdir",
+ })
+ _, err = sshCmd.getSystemCommand()
+ assert.EqualError(t, err, errUnsupportedConfig.Error())
+}
+
+func TestSystemCommandSizeForPath(t *testing.T) {
+ permissions := make(map[string][]string)
+ permissions["/"] = []string{dataprovider.PermAny}
+ user := dataprovider.User{
+ BaseUser: sdk.BaseUser{
+ Permissions: permissions,
+ HomeDir: os.TempDir(),
+ },
+ }
+ fs, err := user.GetFilesystem("123")
+ assert.NoError(t, err)
+ conn := &Connection{
+ BaseConnection: common.NewBaseConnection("", common.ProtocolSFTP, "", "", user),
+ }
+ sshCmd := sshCommand{
+ command: "rsync",
+ connection: conn,
+ args: []string{"--server", "-vlogDtprze.iLsfxC", ".", "/"},
+ }
+ _, _, err = sshCmd.getSizeForPath(fs, "missing path")
+ assert.NoError(t, err)
+ testDir := filepath.Join(os.TempDir(), "dir")
+ err = os.MkdirAll(testDir, os.ModePerm)
+ assert.NoError(t, err)
+ testFile := filepath.Join(testDir, "testfile")
+ err = os.WriteFile(testFile, []byte("test content"), os.ModePerm)
+ assert.NoError(t, err)
+ err = os.Symlink(testFile, testFile+".link")
+ assert.NoError(t, err)
+ numFiles, size, err := sshCmd.getSizeForPath(fs, testFile+".link")
+ assert.NoError(t, err)
+ assert.Equal(t, 0, numFiles)
+ assert.Equal(t, int64(0), size)
+ numFiles, size, err = sshCmd.getSizeForPath(fs, testFile)
+ assert.NoError(t, err)
+ assert.Equal(t, 1, numFiles)
+ assert.Equal(t, int64(12), size)
+ if runtime.GOOS != osWindows {
+ err = os.Chmod(testDir, 0001)
+ assert.NoError(t, err)
+ _, _, err = sshCmd.getSizeForPath(fs, testFile)
+ assert.Error(t, err)
+ err = os.Chmod(testDir, os.ModePerm)
+ assert.NoError(t, err)
+ }
+ err = os.RemoveAll(testDir)
+ assert.NoError(t, err)
+}
+
+func TestSystemCommandErrors(t *testing.T) {
+ buf := make([]byte, 65535)
+ stdErrBuf := make([]byte, 65535)
+ readErr := fmt.Errorf("test read error")
+ writeErr := fmt.Errorf("test write error")
+ mockSSHChannel := MockChannel{
+ Buffer: bytes.NewBuffer(buf),
+ StdErrBuffer: bytes.NewBuffer(stdErrBuf),
+ ReadError: nil,
+ WriteError: writeErr,
+ }
+ permissions := make(map[string][]string)
+ permissions["/"] = []string{dataprovider.PermAny}
+ homeDir := filepath.Join(os.TempDir(), "adir")
+ err := os.MkdirAll(homeDir, os.ModePerm)
+ assert.NoError(t, err)
+ err = os.WriteFile(filepath.Join(homeDir, "afile"), []byte("content"), os.ModePerm)
+ assert.NoError(t, err)
+ user := dataprovider.User{
+ BaseUser: sdk.BaseUser{
+ Permissions: permissions,
+ HomeDir: homeDir,
+ },
+ }
+ fs, err := user.GetFilesystem("123")
+ assert.NoError(t, err)
+ connection := &Connection{
+ BaseConnection: common.NewBaseConnection("", common.ProtocolSFTP, "", "", user),
+ channel: &mockSSHChannel,
+ }
+ var sshCmd sshCommand
+ if runtime.GOOS == osWindows {
+ sshCmd = sshCommand{
+ command: "dir",
+ connection: connection,
+ args: []string{"/"},
+ }
+ } else {
+ sshCmd = sshCommand{
+ command: "ls",
+ connection: connection,
+ args: []string{"/"},
+ }
+ }
+ systemCmd, err := sshCmd.getSystemCommand()
+ assert.NoError(t, err)
+
+ systemCmd.cmd.Dir = os.TempDir()
+ // FIXME: the command completes but the fake client is unable to read the response
+ // no error is reported in this case. We can see that the expected code is executed
+ // reading the test coverage
+ sshCmd.executeSystemCommand(systemCmd) //nolint:errcheck
+
+ mockSSHChannel = MockChannel{
+ Buffer: bytes.NewBuffer(buf),
+ StdErrBuffer: bytes.NewBuffer(stdErrBuf),
+ ReadError: readErr,
+ WriteError: nil,
+ }
+ sshCmd.connection.channel = &mockSSHChannel
+ baseTransfer := common.NewBaseTransfer(nil, sshCmd.connection.BaseConnection, nil, "", "", "",
+ common.TransferUpload, 0, 0, 0, 0, false, fs, dataprovider.TransferQuota{})
+ transfer := newTransfer(baseTransfer, nil, nil, nil)
+ destBuff := make([]byte, 65535)
+ dst := bytes.NewBuffer(destBuff)
+ _, err = transfer.copyFromReaderToWriter(dst, sshCmd.connection.channel)
+ assert.EqualError(t, err, readErr.Error())
+
+ mockSSHChannel = MockChannel{
+ Buffer: bytes.NewBuffer(buf),
+ StdErrBuffer: bytes.NewBuffer(stdErrBuf),
+ ReadError: nil,
+ WriteError: nil,
+ }
+ sshCmd.connection.channel = &mockSSHChannel
+ transfer.MaxWriteSize = 1
+ _, err = transfer.copyFromReaderToWriter(dst, sshCmd.connection.channel)
+ assert.True(t, transfer.Connection.IsQuotaExceededError(err))
+
+ mockSSHChannel = MockChannel{
+ Buffer: bytes.NewBuffer(buf),
+ StdErrBuffer: bytes.NewBuffer(stdErrBuf),
+ ReadError: nil,
+ WriteError: nil,
+ ShortWriteErr: true,
+ }
+ sshCmd.connection.channel = &mockSSHChannel
+ _, err = transfer.copyFromReaderToWriter(sshCmd.connection.channel, dst)
+ assert.EqualError(t, err, io.ErrShortWrite.Error())
+ transfer.MaxWriteSize = -1
+ _, err = transfer.copyFromReaderToWriter(sshCmd.connection.channel, dst)
+ assert.True(t, transfer.Connection.IsQuotaExceededError(err))
+
+ baseTransfer = common.NewBaseTransfer(nil, sshCmd.connection.BaseConnection, nil, "", "", "",
+ common.TransferDownload, 0, 0, 0, 0, false, fs, dataprovider.TransferQuota{
+ AllowedDLSize: 1,
+ })
+ transfer = newTransfer(baseTransfer, nil, nil, nil)
+ mockSSHChannel = MockChannel{
+ Buffer: bytes.NewBuffer(buf),
+ StdErrBuffer: bytes.NewBuffer(stdErrBuf),
+ ReadError: nil,
+ WriteError: nil,
+ }
+ sshCmd.connection.channel = &mockSSHChannel
+ _, err = transfer.copyFromReaderToWriter(dst, sshCmd.connection.channel)
+ if assert.Error(t, err) {
+ assert.Contains(t, err.Error(), common.ErrReadQuotaExceeded.Error())
+ }
+
+ err = os.RemoveAll(homeDir)
+ assert.NoError(t, err)
+}
+
func TestCommandGetFsError(t *testing.T) {
user := dataprovider.User{
FsConfig: vfs.Filesystem{
Provider: sdk.CryptedFilesystemProvider,
},
}
+ conn := &Connection{
+ BaseConnection: common.NewBaseConnection("", common.ProtocolSFTP, "", "", user),
+ }
+ sshCmd := sshCommand{
+ command: "rsync",
+ connection: conn,
+ args: []string{"--server", "-vlogDtprze.iLsfxC", ".", "/"},
+ }
+ _, err := sshCmd.getSystemCommand()
+ assert.Error(t, err)
buf := make([]byte, 65535)
stdErrBuf := make([]byte, 65535)
@@ -689,7 +1059,7 @@ func TestCommandGetFsError(t *testing.T) {
StdErrBuffer: bytes.NewBuffer(stdErrBuf),
ReadError: nil,
}
- conn := &Connection{
+ conn = &Connection{
BaseConnection: common.NewBaseConnection("", common.ProtocolSCP, "", "", user),
channel: &mockSSHChannel,
}
@@ -701,7 +1071,7 @@ func TestCommandGetFsError(t *testing.T) {
},
}
- err := scpCommand.handleRecursiveUpload()
+ err = scpCommand.handleRecursiveUpload()
assert.Error(t, err)
err = scpCommand.handleDownload("")
assert.Error(t, err)
@@ -1346,7 +1716,6 @@ func TestSCPUploadFiledata(t *testing.T) {
if assert.Error(t, err) {
assert.EqualError(t, err, common.ErrTransferClosed.Error())
}
- transfer.Connection.RemoveTransfer(transfer)
mockSSHChannel = MockChannel{
Buffer: bytes.NewBuffer(buf),
@@ -1358,12 +1727,9 @@ func TestSCPUploadFiledata(t *testing.T) {
transfer.Connection.AddTransfer(transfer)
err = scpCommand.getUploadFileData(2, transfer)
assert.ErrorContains(t, err, os.ErrClosed.Error())
- transfer.Connection.RemoveTransfer(transfer)
err = os.Remove(testfile)
assert.NoError(t, err)
-
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
}
func TestUploadError(t *testing.T) {
@@ -1479,9 +1845,9 @@ func TestConfigsFromProvider(t *testing.T) {
SFTPD: &dataprovider.SFTPDConfigs{
HostKeyAlgos: []string{ssh.KeyAlgoRSA},
KexAlgorithms: []string{ssh.InsecureKeyExchangeDHGEXSHA1},
- Ciphers: []string{ssh.InsecureCipherAES128CBC},
+ Ciphers: []string{ssh.InsecureCipherAES128CBC, ssh.InsecureCipherAES192CBC, ssh.InsecureCipherAES256CBC},
MACs: []string{ssh.HMACSHA512ETM},
- PublicKeyAlgos: []string{ssh.InsecureKeyAlgoDSA}, //nolint:staticcheck
+ PublicKeyAlgos: []string{ssh.InsecureKeyAlgoDSA},
},
}
err = dataprovider.UpdateConfigs(&configs, "", "", "")
@@ -1512,7 +1878,7 @@ func TestSupportedSecurityOptions(t *testing.T) {
var defaultKexs []string
for _, k := range supportedKexAlgos {
defaultKexs = append(defaultKexs, k)
- if k == ssh.KeyExchangeCurve25519 {
+ if k == ssh.KeyExchangeCurve25519SHA256 {
defaultKexs = append(defaultKexs, keyExchangeCurve25519SHA256LibSSH)
}
}
@@ -1529,7 +1895,7 @@ func TestSupportedSecurityOptions(t *testing.T) {
c.MACs = []string{
" hmac-sha2-256-etm@openssh.com ", " hmac-sha2-512-etm@openssh.com",
"hmac-sha2-256", "hmac-sha2-512 ",
- "hmac-sha1 ", " hmac-sha1-96",
+ " hmac-sha1-96", "hmac-sha1 ",
}
err = c.configureSecurityOptions(serverConfig)
assert.NoError(t, err)
@@ -1616,6 +1982,40 @@ func TestCertCheckerInitErrors(t *testing.T) {
assert.NoError(t, err)
}
+func TestSFTPSubSystem(t *testing.T) {
+ permissions := make(map[string][]string)
+ permissions["/"] = []string{dataprovider.PermAny}
+ user := &dataprovider.User{
+ BaseUser: sdk.BaseUser{
+ Permissions: permissions,
+ HomeDir: os.TempDir(),
+ },
+ }
+ user.FsConfig.Provider = sdk.AzureBlobFilesystemProvider
+ err := ServeSubSystemConnection(user, "connID", nil, nil)
+ assert.Error(t, err)
+ user.FsConfig.Provider = sdk.LocalFilesystemProvider
+
+ buf := make([]byte, 0, 4096)
+ stdErrBuf := make([]byte, 0, 4096)
+ mockSSHChannel := &MockChannel{
+ Buffer: bytes.NewBuffer(buf),
+ StdErrBuffer: bytes.NewBuffer(stdErrBuf),
+ }
+ // this is 327680 and it will result in packet too long error
+ _, err = mockSSHChannel.Write([]byte{0x00, 0x05, 0x00, 0x00, 0x00, 0x00})
+ assert.NoError(t, err)
+ err = ServeSubSystemConnection(user, "id", mockSSHChannel, mockSSHChannel)
+ assert.EqualError(t, err, "packet too long")
+
+ subsystemChannel := newSubsystemChannel(mockSSHChannel, mockSSHChannel)
+ n, err := subsystemChannel.Write([]byte{0x00})
+ assert.NoError(t, err)
+ assert.Equal(t, n, 1)
+ err = subsystemChannel.Close()
+ assert.NoError(t, err)
+}
+
func TestRecoverer(t *testing.T) {
c := Configuration{}
c.AcceptInboundConnection(nil, nil)
@@ -1639,7 +2039,6 @@ func TestRecoverer(t *testing.T) {
err = scpCmd.handle()
assert.EqualError(t, err, common.ErrGenericFailure.Error())
assert.Len(t, common.Connections.GetStats(""), 0)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
}
func TestListernerAcceptErrors(t *testing.T) {
@@ -1746,27 +2145,9 @@ func TestMaxUserSessions(t *testing.T) {
c := Configuration{}
c.handleSftpConnection(nil, connection)
- buf := make([]byte, 65535)
- stdErrBuf := make([]byte, 65535)
- mockSSHChannel := MockChannel{
- Buffer: bytes.NewBuffer(buf),
- StdErrBuffer: bytes.NewBuffer(stdErrBuf),
- }
-
- conn := &Connection{
- BaseConnection: common.NewBaseConnection(xid.New().String(), common.ProtocolSFTP, "", "", dataprovider.User{
- BaseUser: sdk.BaseUser{
- Username: "user_max_sessions",
- HomeDir: filepath.Clean(os.TempDir()),
- MaxSessions: 1,
- },
- }),
- channel: &mockSSHChannel,
- }
-
sshCmd := sshCommand{
command: "cd",
- connection: conn,
+ connection: connection,
}
err = sshCmd.handle()
if assert.Error(t, err) {
@@ -1775,17 +2156,19 @@ func TestMaxUserSessions(t *testing.T) {
scpCmd := scpCommand{
sshCommand: sshCommand{
command: "scp",
- connection: conn,
+ connection: connection,
},
}
err = scpCmd.handle()
if assert.Error(t, err) {
assert.Contains(t, err.Error(), "too many open sessions")
}
-
+ err = ServeSubSystemConnection(&connection.User, connection.ID, nil, nil)
+ if assert.Error(t, err) {
+ assert.Contains(t, err.Error(), "too many open sessions")
+ }
common.Connections.Remove(connection.GetID())
assert.Len(t, common.Connections.GetStats(""), 0)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
}
func TestCanReadSymlink(t *testing.T) {
@@ -1820,7 +2203,6 @@ func TestCanReadSymlink(t *testing.T) {
}
func TestAuthenticationErrors(t *testing.T) {
- sftpAuthError := newAuthenticationError(nil, "", "")
loginMethod := dataprovider.SSHLoginMethodPassword
username := "test user"
err := newAuthenticationError(fmt.Errorf("cannot validate credentials: %w", util.NewRecordNotFoundError("not found")),
@@ -1845,42 +2227,3 @@ func TestAuthenticationErrors(t *testing.T) {
assert.ErrorIs(t, err, sftpAuthError)
assert.NotErrorIs(t, err, util.ErrNotFound)
}
-
-type mockCommandExecutor struct {
- Output []byte
- Err error
-}
-
-func (f mockCommandExecutor) CombinedOutput(ctx context.Context, name string, args ...string) ([]byte, error) {
- return f.Output, f.Err
-}
-
-func TestVerifyWithOPKSSH(t *testing.T) {
- sshCert := []byte(`ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAg4+hKHVPKv183MU/Q7XD/mzDBFSc2YY3eraltxLMGJo0AAAADAQABAAABAQCe6jMoy1xCQgiZkZJ7gi6NLj4uRqz2OaUGK/OJYZTfBqK+SlS9iymAluHu9K+cc4+0qxx0gn7dRTJWINSgzvca6ayYe995EKgD1hE5krh9BH0bRrXB+hGqyslcZOgLNO+v8jYojClQbRtET2tS+xb4k33GCuL5wgla2790ZgOQgs7huQUjG0S8c1W+EYt6fI4cWE/DeEBnv9sqryS8rOb0PbM6WUd7XBadwySFWYQUX0ei56GNt12Z4gADEGlFQV/OnV0PvnTcAMGUl0rfToPgJ4jgogWKoTVWuZ9wyA/x+2LRLRvgm2a969ig937/AH0i0Wq+FzqfK7EXQ99Yf5K/AAAAAAAAAAAAAAACAAAAFGhvc3QuZXhhbXBsZS5jb20ta2V5AAAAFAAAABBob3N0LmV4YW1wbGUuY29tAAAAAGXEzYAAAAAAd8sP4wAAAAAAAAAAAAAAAAAAARcAAAAHc3NoLXJzYQAAAAMBAAEAAAEBAL4PXUPSERufZWCW/hhEnylk3IeMgaa+2HcNY5Cur77a8fYy6OYZAPF+vhJUT0akwGUpTeXAZumAgHECDrJlw1J+jo9ZVT0AKDo0wU77IzNzYxob7+dpB02NJ7DLAXmPauQ07Zc5pWJFVKtmuh7YH9pjYtNXSMOXye7k06PBGzX+ztIt7nPWvD9fR2mZeTSoljeBCGZHwdlnV2ESQlQbBoEI93RPxqxJh/UCDatQPhpDbyverr2ZvB9Y45rqsx6ZVmu5RXl3MfBU1U21W/4ia2di3PybyD4rSmVoam0efcqxo6cBKSHe26OFoTuS9zgdH0iCWL37vqOFmJ7eH91M3nMAAAEUAAAADHJzYS1zaGEyLTI1NgAAAQA/ByIegNZYJRRl413S/8LxGvTZnbxsPwaluoJ/54niGZV9P28THz7d9jXfSHPjalhH93jNPfTYXvI4opnDC37ua1Nu8KKfk40IWXnnDdZLWraUxEidIzhmfVtz8kGdGoFQ8H0EzubL7zKNOTlfSfOoDlmQVOuxT/+eh2mEp4ri0/+8J1mLfLBr8tREX0/iaNjK+RKdcyTMicKursAYMCDdu8vlaphxea+ocyHM9izSX/l33t44V13ueTqIOh2Zbl2UE2k+jk+0dc1CmV0SEoiWiIyt8TRM4yQry1vPlQLsrf28sYM/QMwnhCVhyZO3vs5F25aQWrB9d51VEzBW9/fd host.example.com`)
- key, _, _, _, err := ssh.ParseAuthorizedKey(sshCert) //nolint:dogsled
- require.NoError(t, err)
- cert, ok := key.(*ssh.Certificate)
- require.True(t, ok)
- c := Configuration{}
- c.executor = mockCommandExecutor{
- Err: errors.New("test error"),
- }
- err = c.verifyWithOPKSSH("user", cert)
- assert.Error(t, err)
-
- c.executor = mockCommandExecutor{}
- err = c.verifyWithOPKSSH("", cert)
- assert.Error(t, err)
-
- c.executor = mockCommandExecutor{
- Output: ssh.MarshalAuthorizedKey(cert),
- }
- err = c.verifyWithOPKSSH("", cert)
- assert.Error(t, err)
-
- c.executor = mockCommandExecutor{
- Output: ssh.MarshalAuthorizedKey(cert.SignatureKey),
- }
- err = c.verifyWithOPKSSH("", cert)
- assert.NoError(t, err)
-}
diff --git a/internal/sftpd/internal_unix_test.go b/internal/sftpd/internal_unix_test.go
new file mode 100644
index 00000000..3bb0207f
--- /dev/null
+++ b/internal/sftpd/internal_unix_test.go
@@ -0,0 +1,36 @@
+// Copyright (C) 2019 Nicola Murino
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published
+// by the Free Software Foundation, version 3.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see .
+
+//go:build !windows
+// +build !windows
+
+package sftpd
+
+import (
+ "os/exec"
+ "testing"
+
+ "github.com/stretchr/testify/assert"
+)
+
+func TestWrapCmd(t *testing.T) {
+ cmd := exec.Command("ls")
+ cmd = wrapCmd(cmd, 3001, 3002)
+ assert.Equal(t, uint32(3001), cmd.SysProcAttr.Credential.Uid)
+ assert.Equal(t, uint32(3002), cmd.SysProcAttr.Credential.Gid)
+
+ cmd = exec.Command("cd")
+ cmd = wrapCmd(cmd, processUID, processGID)
+ assert.Nil(t, cmd.SysProcAttr)
+}
diff --git a/internal/sftpd/scp.go b/internal/sftpd/scp.go
index 2d91afe3..be4079ed 100644
--- a/internal/sftpd/scp.go
+++ b/internal/sftpd/scp.go
@@ -51,9 +51,8 @@ func (c *scpCommand) handle() (err error) {
}
}()
if err := common.Connections.Add(c.connection); err != nil {
- defer c.connection.CloseFS() //nolint:errcheck
logger.Info(logSender, "", "unable to add SCP connection: %v", err)
- return c.sendErrorResponse(err)
+ return err
}
defer common.Connections.Remove(c.connection.GetID())
@@ -228,12 +227,6 @@ func (c *scpCommand) getUploadFileData(sizeToRead int64, transfer *transfer) err
}
func (c *scpCommand) handleUploadFile(fs vfs.Fs, resolvedPath, filePath string, sizeToRead int64, isNewFile bool, fileSize int64, requestPath string) error {
- if err := common.Connections.IsNewTransferAllowed(c.connection.User.Username); err != nil {
- err := fmt.Errorf("denying file write due to transfer count limits")
- c.connection.Log(logger.LevelInfo, "denying file write due to transfer count limits")
- c.sendErrorMessage(nil, err)
- return err
- }
diskQuota, transferQuota := c.connection.HasSpace(isNewFile, false, requestPath)
if !diskQuota.HasSpace || !transferQuota.HasUploadSpace() {
err := fmt.Errorf("denying file write due to quota limits")
@@ -265,7 +258,10 @@ func (c *scpCommand) handleUploadFile(fs vfs.Fs, resolvedPath, filePath string,
if vfs.HasTruncateSupport(fs) {
vfolder, err := c.connection.User.GetVirtualFolderForPath(path.Dir(requestPath))
if err == nil {
- dataprovider.UpdateUserFolderQuota(&vfolder, &c.connection.User, 0, -fileSize, false)
+ dataprovider.UpdateVirtualFolderQuota(&vfolder.BaseVirtualFolder, 0, -fileSize, false) //nolint:errcheck
+ if vfolder.IsIncludedInUserQuota() {
+ dataprovider.UpdateUserQuota(&c.connection.User, 0, -fileSize, false) //nolint:errcheck
+ }
} else {
dataprovider.UpdateUserQuota(&c.connection.User, 0, -fileSize, false) //nolint:errcheck
}
@@ -337,7 +333,7 @@ func (c *scpCommand) handleUpload(uploadFilePath string, sizeToRead int64) error
}
if common.Config.IsAtomicUploadEnabled() && fs.IsAtomicUploadSupported() {
- _, _, err = fs.Rename(p, filePath, 0)
+ _, _, err = fs.Rename(p, filePath)
if err != nil {
c.connection.Log(logger.LevelError, "error renaming existing file for atomic upload, source: %q, dest: %q, err: %v",
p, filePath, err)
@@ -508,13 +504,6 @@ func (c *scpCommand) sendDownloadFileData(fs vfs.Fs, filePath string, stat os.Fi
func (c *scpCommand) handleDownload(filePath string) error {
c.connection.UpdateLastActivity()
-
- if err := common.Connections.IsNewTransferAllowed(c.connection.User.Username); err != nil {
- err := fmt.Errorf("denying file read due to transfer count limits")
- c.connection.Log(logger.LevelInfo, "denying file read due to transfer count limits")
- c.sendErrorMessage(nil, err)
- return err
- }
transferQuota := c.connection.GetTransferQuota()
if !transferQuota.HasDownloadSpace() {
c.connection.Log(logger.LevelInfo, "denying file read due to quota limits")
diff --git a/internal/sftpd/server.go b/internal/sftpd/server.go
index 3bee040d..fdad2d0f 100644
--- a/internal/sftpd/server.go
+++ b/internal/sftpd/server.go
@@ -16,21 +16,16 @@ package sftpd
import (
"bytes"
- "context"
- "crypto/sha256"
"encoding/hex"
"encoding/json"
"errors"
"fmt"
"io"
"io/fs"
- "maps"
"net"
"os"
- "os/exec"
"path/filepath"
"runtime/debug"
- "slices"
"strings"
"sync"
"time"
@@ -55,10 +50,6 @@ const (
defaultPrivateEd25519KeyName = "id_ed25519"
sourceAddressCriticalOption = "source-address"
keyExchangeCurve25519SHA256LibSSH = "curve25519-sha256@libssh.org"
- extraDataPartialSuccessErrKey = "partialSuccessErr"
- extraDataUserKey = "user"
- extraDataKeyIDKey = "keyID"
- extraDataLoginMethodKey = "login_method"
)
var (
@@ -85,20 +76,10 @@ var (
revokedCertManager = revokedCertificates{
certs: map[string]bool{},
}
+
+ sftpAuthError = newAuthenticationError(nil, "", "")
)
-type commandExecutor interface {
- CombinedOutput(ctx context.Context, name string, args ...string) ([]byte, error)
-}
-
-type defaultExecutor struct{}
-
-func (d defaultExecutor) CombinedOutput(ctx context.Context, name string, args ...string) ([]byte, error) {
- cmd := exec.CommandContext(ctx, name, args...)
- cmd.Env = []string{}
- return cmd.CombinedOutput()
-}
-
// Binding defines the configuration for a network listener
type Binding struct {
// The address to listen on. A blank value means listen on all available network interfaces.
@@ -147,6 +128,10 @@ type Configuration struct {
// KexAlgorithms specifies the available KEX (Key Exchange) algorithms in
// preference order.
KexAlgorithms []string `json:"kex_algorithms" mapstructure:"kex_algorithms"`
+ // MinDHGroupExchangeKeySize defines the minimum key size to allow for the
+ // key exchanges when using diffie-ellman-group-exchange-sha1 or sha256 key
+ // exchange algorithms.
+ MinDHGroupExchangeKeySize int `json:"min_dh_group_exchange_key_size" mapstructure:"min_dh_group_exchange_key_size"`
// Ciphers specifies the ciphers allowed
Ciphers []string `json:"ciphers" mapstructure:"ciphers"`
// MACs Specifies the available MAC (message authentication code) algorithms
@@ -163,10 +148,6 @@ type Configuration struct {
// Example content:
// ["SHA256:bsBRHC/xgiqBJdSuvSTNpJNLTISP/G356jNMCRYC5Es","SHA256:119+8cL/HH+NLMawRsJx6CzPF1I3xC+jpM60bQHXGE8"]
RevokedUserCertsFile string `json:"revoked_user_certs_file" mapstructure:"revoked_user_certs_file"`
- // Absolute path to the opkssh binary used for OpenPubkey SSH integration
- OPKSSHPath string `json:"opkssh_path" mapstructure:"opkssh_path"`
- // Expected SHA256 checksum of the opkssh binary. It is verified at application startup
- OPKSSHChecksum string `json:"opkssh_checksum" mapstructure:"opkssh_checksum"`
// LoginBannerFile the contents of the specified file, if any, are sent to
// the remote user before authentication is allowed.
LoginBannerFile string `json:"login_banner_file" mapstructure:"login_banner_file"`
@@ -202,7 +183,6 @@ type Configuration struct {
PasswordAuthentication bool `json:"password_authentication" mapstructure:"password_authentication"`
certChecker *ssh.CertChecker
parsedUserCAKeys []ssh.PublicKey
- executor commandExecutor
}
type authenticationError struct {
@@ -255,6 +235,10 @@ func (c *Configuration) getServerConfig() *ssh.ServerConfig {
MaxAuthTries: c.MaxAuthTries,
PublicKeyCallback: func(conn ssh.ConnMetadata, pubKey ssh.PublicKey) (*ssh.Permissions, error) {
sp, err := c.validatePublicKeyCredentials(conn, pubKey)
+ var partialSuccess *ssh.PartialSuccessError
+ if errors.As(err, &partialSuccess) {
+ return sp, err
+ }
if err != nil {
return nil, newAuthenticationError(fmt.Errorf("could not validate public key credentials: %w", err),
dataprovider.SSHLoginMethodPublicKey, conn.User())
@@ -262,35 +246,6 @@ func (c *Configuration) getServerConfig() *ssh.ServerConfig {
return sp, nil
},
- VerifiedPublicKeyCallback: func(conn ssh.ConnMetadata, key ssh.PublicKey, permissions *ssh.Permissions, signatureAlgorithm string) (*ssh.Permissions, error) {
- if partialErr, ok := permissions.ExtraData[extraDataPartialSuccessErrKey]; ok {
- logger.Info(logSender, hex.EncodeToString(conn.SessionID()), "user %q authenticated with partial success, signature algorithm %q",
- conn.User(), signatureAlgorithm)
- return nil, partialErr.(error)
- }
- method := dataprovider.SSHLoginMethodPublicKey
- user := permissions.ExtraData[extraDataUserKey].(dataprovider.User)
- keyID := permissions.ExtraData[extraDataKeyIDKey].(string)
- sshPerm, err := loginUser(&user, method, fmt.Sprintf("%s (%s)", keyID, signatureAlgorithm), conn)
- if err == nil {
- // if we have a SSH user cert we need to merge certificate permissions with our ones
- // we only set Extensions, so CriticalOptions are always the ones from the certificate
- sshPerm.CriticalOptions = permissions.CriticalOptions
- if permissions.Extensions != nil {
- if sshPerm.Extensions == nil {
- sshPerm.Extensions = make(map[string]string)
- }
- maps.Copy(sshPerm.Extensions, permissions.Extensions)
- }
- if sshPerm.ExtraData == nil {
- sshPerm.ExtraData = make(map[any]any)
- }
- }
- user.Username = conn.User()
- ipAddr := util.GetIPFromRemoteAddress(conn.RemoteAddr().String())
- updateLoginMetrics(&user, ipAddr, method, err)
- return sshPerm, err
- },
ServerVersion: fmt.Sprintf("SSH-2.0-%s", version.GetServerVersion("_", false)),
}
@@ -308,13 +263,13 @@ func (c *Configuration) getServerConfig() *ssh.ServerConfig {
func (c *Configuration) updateSupportedAuthentications() {
serviceStatus.Authentications = util.RemoveDuplicates(serviceStatus.Authentications, false)
- if slices.Contains(serviceStatus.Authentications, dataprovider.LoginMethodPassword) &&
- slices.Contains(serviceStatus.Authentications, dataprovider.SSHLoginMethodPublicKey) {
+ if util.Contains(serviceStatus.Authentications, dataprovider.LoginMethodPassword) &&
+ util.Contains(serviceStatus.Authentications, dataprovider.SSHLoginMethodPublicKey) {
serviceStatus.Authentications = append(serviceStatus.Authentications, dataprovider.SSHLoginMethodKeyAndPassword)
}
- if slices.Contains(serviceStatus.Authentications, dataprovider.SSHLoginMethodKeyboardInteractive) &&
- slices.Contains(serviceStatus.Authentications, dataprovider.SSHLoginMethodPublicKey) {
+ if util.Contains(serviceStatus.Authentications, dataprovider.SSHLoginMethodKeyboardInteractive) &&
+ util.Contains(serviceStatus.Authentications, dataprovider.SSHLoginMethodPublicKey) {
serviceStatus.Authentications = append(serviceStatus.Authentications, dataprovider.SSHLoginMethodKeyAndKeyboardInt)
}
}
@@ -360,7 +315,6 @@ func (c *Configuration) loadFromProvider() error {
// Initialize the SFTP server and add a persistent listener to handle inbound SFTP connections.
func (c *Configuration) Initialize(configDir string) error {
- c.executor = defaultExecutor{}
if err := c.loadFromProvider(); err != nil {
return fmt.Errorf("unable to load configs from provider: %w", err)
}
@@ -371,6 +325,9 @@ func (c *Configuration) Initialize(configDir string) error {
return common.ErrNoBinding
}
+ ssh.SetDHKexServerMinBits(uint32(c.MinDHGroupExchangeKeySize))
+ logger.Debug(logSender, "", "minimum key size allowed for diffie-ellman-group-exchange: %d",
+ ssh.GetDHKexServerMinBits())
sftp.SetSFTPExtensions(sftpExtensions...) //nolint:errcheck // we configure valid SFTP Extensions so we cannot get an error
sftp.MaxFilelist = 250
@@ -384,9 +341,6 @@ func (c *Configuration) Initialize(configDir string) error {
if err := c.initializeCertChecker(configDir); err != nil {
return err
}
- if err := c.initializeOPKSSH(); err != nil {
- return err
- }
c.configureKeyboardInteractiveAuth(serverConfig)
c.configureLoginBanner(serverConfig, configDir)
c.checkSSHCommands()
@@ -468,7 +422,7 @@ func (c *Configuration) configureKeyAlgos(serverConfig *ssh.ServerConfig) error
c.HostKeyAlgorithms = util.RemoveDuplicates(c.HostKeyAlgorithms, true)
}
for _, hostKeyAlgo := range c.HostKeyAlgorithms {
- if !slices.Contains(supportedHostKeyAlgos, hostKeyAlgo) {
+ if !util.Contains(supportedHostKeyAlgos, hostKeyAlgo) {
return fmt.Errorf("unsupported host key algorithm %q", hostKeyAlgo)
}
}
@@ -476,7 +430,7 @@ func (c *Configuration) configureKeyAlgos(serverConfig *ssh.ServerConfig) error
if len(c.PublicKeyAlgorithms) > 0 {
c.PublicKeyAlgorithms = util.RemoveDuplicates(c.PublicKeyAlgorithms, true)
for _, algo := range c.PublicKeyAlgorithms {
- if !slices.Contains(supportedPublicKeyAlgos, algo) {
+ if !util.Contains(supportedPublicKeyAlgos, algo) {
return fmt.Errorf("unsupported public key authentication algorithm %q", algo)
}
}
@@ -498,9 +452,9 @@ func (c *Configuration) checkKeyExchangeAlgorithms() {
}
kexs = append(kexs, k)
if strings.TrimSpace(k) == keyExchangeCurve25519SHA256LibSSH {
- kexs = append(kexs, ssh.KeyExchangeCurve25519)
+ kexs = append(kexs, ssh.KeyExchangeCurve25519SHA256)
}
- if strings.TrimSpace(k) == ssh.KeyExchangeCurve25519 {
+ if strings.TrimSpace(k) == ssh.KeyExchangeCurve25519SHA256 {
kexs = append(kexs, keyExchangeCurve25519SHA256LibSSH)
}
}
@@ -518,7 +472,7 @@ func (c *Configuration) configureSecurityOptions(serverConfig *ssh.ServerConfig)
if kex == keyExchangeCurve25519SHA256LibSSH {
continue
}
- if !slices.Contains(supportedKexAlgos, kex) {
+ if !util.Contains(supportedKexAlgos, kex) {
return fmt.Errorf("unsupported key-exchange algorithm %q", kex)
}
}
@@ -532,10 +486,7 @@ func (c *Configuration) configureSecurityOptions(serverConfig *ssh.ServerConfig)
if len(c.Ciphers) > 0 {
c.Ciphers = util.RemoveDuplicates(c.Ciphers, true)
for _, cipher := range c.Ciphers {
- if slices.Contains([]string{"aes192-cbc", "aes256-cbc"}, cipher) {
- continue
- }
- if !slices.Contains(supportedCiphers, cipher) {
+ if !util.Contains(supportedCiphers, cipher) {
return fmt.Errorf("unsupported cipher %q", cipher)
}
}
@@ -548,7 +499,7 @@ func (c *Configuration) configureSecurityOptions(serverConfig *ssh.ServerConfig)
if len(c.MACs) > 0 {
c.MACs = util.RemoveDuplicates(c.MACs, true)
for _, mac := range c.MACs {
- if !slices.Contains(supportedMACs, mac) {
+ if !util.Contains(supportedMACs, mac) {
return fmt.Errorf("unsupported MAC algorithm %q", mac)
}
}
@@ -611,7 +562,7 @@ func (c *Configuration) configureKeyboardInteractiveAuth(serverConfig *ssh.Serve
}
// AcceptInboundConnection handles an inbound connection to the server instance and determines if the request should be served or not.
-func (c *Configuration) AcceptInboundConnection(conn net.Conn, config *ssh.ServerConfig) { //nolint:gocyclo
+func (c *Configuration) AcceptInboundConnection(conn net.Conn, config *ssh.ServerConfig) {
defer func() {
if r := recover(); r != nil {
logger.Error(logSender, "", "panic in AcceptInboundConnection: %q stack trace: %v", r, string(debug.Stack()))
@@ -640,10 +591,14 @@ func (c *Configuration) AcceptInboundConnection(conn net.Conn, config *ssh.Serve
conn.SetDeadline(time.Time{}) //nolint:errcheck
go ssh.DiscardRequests(reqs)
- defer sconn.Close()
+ defer conn.Close()
- user := sconn.Permissions.ExtraData[extraDataUserKey].(dataprovider.User)
- loginType := sconn.Permissions.ExtraData[extraDataLoginMethodKey].(string)
+ var user dataprovider.User
+
+ // Unmarshal cannot fails here and even if it fails we'll have a user with no permissions
+ json.Unmarshal(util.StringToBytes(sconn.Permissions.Extensions["sftpgo_user"]), &user) //nolint:errcheck
+
+ loginType := sconn.Permissions.Extensions["sftpgo_login_method"]
connectionID := hex.EncodeToString(sconn.SessionID())
defer user.CloseFs() //nolint:errcheck
@@ -653,13 +608,13 @@ func (c *Configuration) AcceptInboundConnection(conn net.Conn, config *ssh.Serve
return
}
- logger.LoginLog(user.Username, ipAddr, loginType, common.ProtocolSSH, connectionID,
- util.BytesToString(sconn.ClientVersion()), true,
- fmt.Sprintf("negotiated algorithms: %+v", sconn.Conn.(ssh.AlgorithmsConnMetadata).Algorithms()))
-
+ logger.Log(logger.LevelInfo, common.ProtocolSSH, connectionID,
+ "User %q logged in with %q, from ip %q, client version %q, negotiated algorithms: %+v",
+ user.Username, loginType, ipAddr, util.BytesToString(sconn.ClientVersion()),
+ sconn.Conn.(ssh.AlgorithmsConnMetadata).Algorithms())
dataprovider.UpdateLastLogin(&user)
- sshConnection := common.NewSSHConnection(connectionID, sconn)
+ sshConnection := common.NewSSHConnection(connectionID, conn)
common.Connections.AddSSHConnection(sshConnection)
defer common.Connections.RemoveSSHConnection(connectionID)
@@ -682,6 +637,7 @@ func (c *Configuration) AcceptInboundConnection(conn net.Conn, config *ssh.Serve
}
channelCounter++
+ sshConnection.UpdateLastActivity()
// Channels have a type that is dependent on the protocol. For SFTP this is "subsystem"
// with a payload that (should) be "sftp". Discard anything else we receive ("pty", "shell", etc)
go func(in <-chan *ssh.Request, counter int64) {
@@ -691,9 +647,8 @@ func (c *Configuration) AcceptInboundConnection(conn net.Conn, config *ssh.Serve
switch req.Type {
case "subsystem":
- if bytes.Equal(req.Payload[4:], []byte("sftp")) {
+ if util.BytesToString(req.Payload[4:]) == "sftp" {
ok = true
- sshConnection.UpdateLastActivity()
connection := &Connection{
BaseConnection: common.NewBaseConnection(connID, common.ProtocolSFTP, conn.LocalAddr().String(),
conn.RemoteAddr().String(), user),
@@ -715,9 +670,6 @@ func (c *Configuration) AcceptInboundConnection(conn net.Conn, config *ssh.Serve
channel: channel,
}
ok = processSSHCommand(req.Payload, &connection, c.EnabledSSHCommands)
- if ok {
- sshConnection.UpdateLastActivity()
- }
}
if req.WantReply {
req.Reply(ok, nil) //nolint:errcheck
@@ -734,7 +686,6 @@ func (c *Configuration) handleSftpConnection(channel ssh.Channel, connection *Co
}
}()
if err := common.Connections.Add(connection); err != nil {
- defer connection.CloseFS() //nolint:errcheck
errClose := connection.Disconnect()
logger.Info(logSender, "", "unable to add connection: %v, close err: %v", err, errClose)
return
@@ -834,7 +785,7 @@ func loginUser(user *dataprovider.User, loginMethod, publicKey string, conn ssh.
user.Username, user.HomeDir)
return nil, fmt.Errorf("cannot login user with invalid home dir: %q", user.HomeDir)
}
- if slices.Contains(user.Filters.DeniedProtocols, common.ProtocolSSH) {
+ if util.Contains(user.Filters.DeniedProtocols, common.ProtocolSSH) {
logger.Info(logSender, connectionID, "cannot login user %q, protocol SSH is not allowed", user.Username)
return nil, fmt.Errorf("protocol SSH is not allowed for user %q", user.Username)
}
@@ -863,25 +814,30 @@ func loginUser(user *dataprovider.User, loginMethod, publicKey string, conn ssh.
return nil, fmt.Errorf("login for user %q is not allowed from this address: %v", user.Username, remoteAddr)
}
+ json, err := json.Marshal(user)
+ if err != nil {
+ logger.Warn(logSender, connectionID, "error serializing user info: %v, authentication rejected", err)
+ return nil, err
+ }
if publicKey != "" {
loginMethod = fmt.Sprintf("%v: %v", loginMethod, publicKey)
}
p := &ssh.Permissions{}
- p.ExtraData = make(map[any]any)
- p.ExtraData[extraDataUserKey] = *user
- p.ExtraData[extraDataLoginMethodKey] = loginMethod
+ p.Extensions = make(map[string]string)
+ p.Extensions["sftpgo_user"] = util.BytesToString(json)
+ p.Extensions["sftpgo_login_method"] = loginMethod
return p, nil
}
func (c *Configuration) checkSSHCommands() {
- if slices.Contains(c.EnabledSSHCommands, "*") {
+ if util.Contains(c.EnabledSSHCommands, "*") {
c.EnabledSSHCommands = GetSupportedSSHCommands()
return
}
sshCommands := []string{}
for _, command := range c.EnabledSSHCommands {
command = strings.TrimSpace(command)
- if slices.Contains(supportedSSHCommands, command) {
+ if util.Contains(supportedSSHCommands, command) {
sshCommands = append(sshCommands, command)
} else {
logger.Warn(logSender, "", "unsupported ssh command: %q ignored", command)
@@ -900,12 +856,11 @@ func (c *Configuration) generateDefaultHostKeys(configDir string) error {
if _, err = os.Stat(autoFile); errors.Is(err, fs.ErrNotExist) {
logger.Info(logSender, "", "No host keys configured and %q does not exist; try to create a new host key", autoFile)
logger.InfoToConsole("No host keys configured and %q does not exist; try to create a new host key", autoFile)
- switch k {
- case defaultPrivateRSAKeyName:
+ if k == defaultPrivateRSAKeyName {
err = util.GenerateRSAKeys(autoFile)
- case defaultPrivateECDSAKeyName:
+ } else if k == defaultPrivateECDSAKeyName {
err = util.GenerateECDSAKeys(autoFile)
- default:
+ } else {
err = util.GenerateEd25519Keys(autoFile)
}
if err != nil {
@@ -972,7 +927,7 @@ func (c *Configuration) checkHostKeyAutoGeneration(configDir string) error {
func (c *Configuration) getHostKeyAlgorithms(keyFormat string) []string {
var algos []string
for _, algo := range algorithmsForKeyFormat(keyFormat) {
- if slices.Contains(c.HostKeyAlgorithms, algo) {
+ if util.Contains(c.HostKeyAlgorithms, algo) {
algos = append(algos, algo)
}
}
@@ -1031,7 +986,7 @@ func (c *Configuration) checkAndLoadHostKeys(configDir string, serverConfig *ssh
var algos []string
for _, algo := range algorithmsForKeyFormat(signer.PublicKey().Type()) {
if underlyingAlgo, ok := certKeyAlgoNames[algo]; ok {
- if slices.Contains(mas.Algorithms(), underlyingAlgo) {
+ if util.Contains(mas.Algorithms(), underlyingAlgo) {
algos = append(algos, algo)
}
}
@@ -1091,49 +1046,6 @@ func (c *Configuration) loadHostCertificates(configDir string) ([]hostCertificat
return certs, nil
}
-func (c *Configuration) initializeOPKSSH() error {
- if c.OPKSSHPath != "" {
- if len(c.parsedUserCAKeys) > 0 {
- return errors.New("opkssh and certificate authorities are mutually exclusive")
- }
- if !util.IsFileInputValid(c.OPKSSHPath) || !filepath.IsAbs(c.OPKSSHPath) {
- return fmt.Errorf("opkssh path %q is not valid, it must be an absolute path", c.OPKSSHPath)
- }
- if c.OPKSSHChecksum == "" {
- if _, err := os.Stat(c.OPKSSHPath); err != nil {
- return fmt.Errorf("error validating opkssh path %q: %w", c.OPKSSHPath, err)
- }
- } else {
- if err := util.VerifyFileChecksum(c.OPKSSHPath, sha256.New(), c.OPKSSHChecksum, 100*1024*1024); err != nil {
- return fmt.Errorf("error validating opkssh checksum: %w", err)
- }
- }
- }
-
- return nil
-}
-
-func (c *Configuration) verifyWithOPKSSH(username string, cert *ssh.Certificate) error {
- ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
- defer cancel()
-
- args := []string{"verify", username, util.BytesToString(ssh.MarshalAuthorizedKey(cert)), cert.Type()}
- out, err := c.executor.CombinedOutput(ctx, c.OPKSSHPath, args...)
- if err != nil {
- logger.Debug(logSender, "", "unable to execute opk verifier: %s", string(out))
- return fmt.Errorf("unable to execute opk verifier: %w", err)
- }
- pubKey, _, _, _, err := ssh.ParseAuthorizedKey(out) //nolint:dogsled
- if err != nil {
- logger.Debug(logSender, "", "unable to validate the opk verifier output: %s", string(out))
- return fmt.Errorf("unable to validate the opk verifier output: %w", err)
- }
- if !bytes.Equal(pubKey.Marshal(), cert.SignatureKey.Marshal()) {
- return errors.New("unable to validate opk result")
- }
- return nil
-}
-
func (c *Configuration) initializeCertChecker(configDir string) error {
for _, keyPath := range c.TrustedUserCAKeys {
keyPath = strings.TrimSpace(keyPath)
@@ -1186,12 +1098,12 @@ func (c *Configuration) initializeCertChecker(configDir string) error {
func (c *Configuration) getPartialSuccessError(nextAuthMethods []string) error {
err := &ssh.PartialSuccessError{}
- if c.PasswordAuthentication && slices.Contains(nextAuthMethods, dataprovider.LoginMethodPassword) {
+ if c.PasswordAuthentication && util.Contains(nextAuthMethods, dataprovider.LoginMethodPassword) {
err.Next.PasswordCallback = func(conn ssh.ConnMetadata, password []byte) (*ssh.Permissions, error) {
return c.validatePasswordCredentials(conn, password, dataprovider.SSHLoginMethodKeyAndPassword)
}
}
- if c.KeyboardInteractiveAuthentication && slices.Contains(nextAuthMethods, dataprovider.SSHLoginMethodKeyboardInteractive) {
+ if c.KeyboardInteractiveAuthentication && util.Contains(nextAuthMethods, dataprovider.SSHLoginMethodKeyboardInteractive) {
err.Next.KeyboardInteractiveCallback = func(conn ssh.ConnMetadata, client ssh.KeyboardInteractiveChallenge) (*ssh.Permissions, error) {
return c.validateKeyboardInteractiveCredentials(conn, client, dataprovider.SSHLoginMethodKeyAndKeyboardInt, true)
}
@@ -1200,75 +1112,74 @@ func (c *Configuration) getPartialSuccessError(nextAuthMethods []string) error {
}
func (c *Configuration) validatePublicKeyCredentials(conn ssh.ConnMetadata, pubKey ssh.PublicKey) (*ssh.Permissions, error) {
+ var err error
var user dataprovider.User
+ var keyID string
+ var sshPerm *ssh.Permissions
var certPerm *ssh.Permissions
+ connectionID := hex.EncodeToString(conn.SessionID())
method := dataprovider.SSHLoginMethodPublicKey
ipAddr := util.GetIPFromRemoteAddress(conn.RemoteAddr().String())
cert, ok := pubKey.(*ssh.Certificate)
var certFingerprint string
if ok {
certFingerprint = ssh.FingerprintSHA256(cert.Key)
- if c.OPKSSHPath != "" {
- if err := c.verifyWithOPKSSH(conn.User(), cert); err != nil {
- err := fmt.Errorf("ssh: verification with OPK failed: %v", err)
- user.Username = conn.User()
- updateLoginMetrics(&user, ipAddr, method, err)
- return nil, err
- }
- } else {
- if cert.CertType != ssh.UserCert {
- err := fmt.Errorf("ssh: cert has type %d", cert.CertType)
- user.Username = conn.User()
- updateLoginMetrics(&user, ipAddr, method, err)
- return nil, err
- }
- if !c.certChecker.IsUserAuthority(cert.SignatureKey) {
- err := errors.New("ssh: certificate signed by unrecognized authority")
- user.Username = conn.User()
- updateLoginMetrics(&user, ipAddr, method, err)
- return nil, err
- }
- if len(cert.ValidPrincipals) == 0 {
- err := fmt.Errorf("ssh: certificate %s has no valid principals, user: \"%s\"", certFingerprint, conn.User())
- user.Username = conn.User()
- updateLoginMetrics(&user, ipAddr, method, err)
- return nil, err
- }
- if revokedCertManager.isRevoked(certFingerprint) {
- err := fmt.Errorf("ssh: certificate %s is revoked", certFingerprint)
- user.Username = conn.User()
- updateLoginMetrics(&user, ipAddr, method, err)
- return nil, err
- }
- if err := c.certChecker.CheckCert(conn.User(), cert); err != nil {
- user.Username = conn.User()
- updateLoginMetrics(&user, ipAddr, method, err)
- return nil, err
- }
+ if cert.CertType != ssh.UserCert {
+ err = fmt.Errorf("ssh: cert has type %d", cert.CertType)
+ user.Username = conn.User()
+ updateLoginMetrics(&user, ipAddr, method, err)
+ return nil, err
+ }
+ if !c.certChecker.IsUserAuthority(cert.SignatureKey) {
+ err = errors.New("ssh: certificate signed by unrecognized authority")
+ user.Username = conn.User()
+ updateLoginMetrics(&user, ipAddr, method, err)
+ return nil, err
+ }
+ if len(cert.ValidPrincipals) == 0 {
+ err = fmt.Errorf("ssh: certificate %s has no valid principals, user: \"%s\"", certFingerprint, conn.User())
+ user.Username = conn.User()
+ updateLoginMetrics(&user, ipAddr, method, err)
+ return nil, err
+ }
+ if revokedCertManager.isRevoked(certFingerprint) {
+ err = fmt.Errorf("ssh: certificate %s is revoked", certFingerprint)
+ user.Username = conn.User()
+ updateLoginMetrics(&user, ipAddr, method, err)
+ return nil, err
+ }
+ if err := c.certChecker.CheckCert(conn.User(), cert); err != nil {
+ user.Username = conn.User()
+ updateLoginMetrics(&user, ipAddr, method, err)
+ return nil, err
}
certPerm = &cert.Permissions
}
- user, keyID, err := dataprovider.CheckUserAndPubKey(conn.User(), pubKey.Marshal(), ipAddr, common.ProtocolSSH, ok)
- if err != nil {
- user.Username = conn.User()
- updateLoginMetrics(&user, ipAddr, method, err)
- return nil, err
+ if user, keyID, err = dataprovider.CheckUserAndPubKey(conn.User(), pubKey.Marshal(), ipAddr, common.ProtocolSSH, ok); err == nil {
+ if ok {
+ keyID = fmt.Sprintf("%s: ID: %s, serial: %v, CA %s %s", certFingerprint,
+ cert.KeyId, cert.Serial, cert.Type(), ssh.FingerprintSHA256(cert.SignatureKey))
+ }
+ if user.IsPartialAuth() {
+ logger.Debug(logSender, connectionID, "user %q authenticated with partial success", conn.User())
+ return certPerm, c.getPartialSuccessError(user.GetNextAuthMethods())
+ }
+ sshPerm, err = loginUser(&user, method, keyID, conn)
+ if err == nil && certPerm != nil {
+ // if we have a SSH user cert we need to merge certificate permissions with our ones
+ // we only set Extensions, so CriticalOptions are always the ones from the certificate
+ sshPerm.CriticalOptions = certPerm.CriticalOptions
+ if certPerm.Extensions != nil {
+ for k, v := range certPerm.Extensions {
+ sshPerm.Extensions[k] = v
+ }
+ }
+ }
}
- if ok {
- keyID = fmt.Sprintf("%s: ID: %s, serial: %v, CA %s %s", certFingerprint,
- cert.KeyId, cert.Serial, cert.Type(), ssh.FingerprintSHA256(cert.SignatureKey))
- }
- if certPerm == nil {
- certPerm = &ssh.Permissions{}
- }
- certPerm.ExtraData = make(map[any]any)
- certPerm.ExtraData[extraDataKeyIDKey] = keyID
- certPerm.ExtraData[extraDataUserKey] = user
- if user.IsPartialAuth() {
- certPerm.ExtraData[extraDataPartialSuccessErrKey] = c.getPartialSuccessError(user.GetNextAuthMethods())
- }
- return certPerm, nil
+ user.Username = conn.User()
+ updateLoginMetrics(&user, ipAddr, method, err)
+ return sshPerm, err
}
func (c *Configuration) validatePasswordCredentials(conn ssh.ConnMetadata, pass []byte, method string) (*ssh.Permissions, error) {
diff --git a/internal/sftpd/sftpd.go b/internal/sftpd/sftpd.go
index 3f69cdde..92f30460 100644
--- a/internal/sftpd/sftpd.go
+++ b/internal/sftpd/sftpd.go
@@ -31,15 +31,16 @@ const (
var (
supportedSSHCommands = []string{"scp", "md5sum", "sha1sum", "sha256sum", "sha384sum", "sha512sum", "cd", "pwd",
- "sftpgo-copy", "sftpgo-remove"}
+ "git-receive-pack", "git-upload-pack", "git-upload-archive", "rsync", "sftpgo-copy", "sftpgo-remove"}
defaultSSHCommands = []string{"md5sum", "sha1sum", "sha256sum", "cd", "pwd", "scp"}
sshHashCommands = []string{"md5sum", "sha1sum", "sha256sum", "sha384sum", "sha512sum"}
+ systemCommands = []string{"git-receive-pack", "git-upload-pack", "git-upload-archive", "rsync"}
serviceStatus ServiceStatus
certKeyAlgoNames = map[string]string{
ssh.CertAlgoRSAv01: ssh.KeyAlgoRSA,
ssh.CertAlgoRSASHA256v01: ssh.KeyAlgoRSASHA256,
ssh.CertAlgoRSASHA512v01: ssh.KeyAlgoRSASHA512,
- ssh.InsecureCertAlgoDSAv01: ssh.InsecureKeyAlgoDSA, //nolint:staticcheck
+ ssh.InsecureCertAlgoDSAv01: ssh.InsecureKeyAlgoDSA,
ssh.CertAlgoECDSA256v01: ssh.KeyAlgoECDSA256,
ssh.CertAlgoECDSA384v01: ssh.KeyAlgoECDSA384,
ssh.CertAlgoECDSA521v01: ssh.KeyAlgoECDSA521,
diff --git a/internal/sftpd/sftpd_test.go b/internal/sftpd/sftpd_test.go
index 44de3c31..f8fe779c 100644
--- a/internal/sftpd/sftpd_test.go
+++ b/internal/sftpd/sftpd_test.go
@@ -23,7 +23,6 @@ import (
"crypto/sha512"
"encoding/base64"
"encoding/binary"
- "encoding/hex"
"encoding/json"
"errors"
"fmt"
@@ -38,7 +37,6 @@ import (
"path"
"path/filepath"
"runtime"
- "slices"
"strconv"
"strings"
"sync"
@@ -259,7 +257,7 @@ func TestMain(m *testing.M) {
}
sftpdConf.KexAlgorithms = []string{"curve25519-sha256@libssh.org", ssh.KeyExchangeECDHP256,
ssh.KeyExchangeECDHP384}
- sftpdConf.Ciphers = []string{ssh.CipherChaCha20Poly1305, ssh.CipherAES128GCM,
+ sftpdConf.Ciphers = []string{ssh.CipherChacha20Poly1305, ssh.CipherAES128GCM,
ssh.CipherAES256CTR}
sftpdConf.LoginBannerFile = loginBannerFileName
// we need to test all supported ssh commands
@@ -488,17 +486,6 @@ func TestInitialization(t *testing.T) {
assert.NoError(t, err)
sftpdConf.HostKeys = nil
sftpdConf.HostCertificates = nil
- sftpdConf.OPKSSHPath = "relative path"
- err = sftpdConf.Initialize(configDir)
- assert.Error(t, err)
- sftpdConf.OPKSSHPath = filepath.Join(os.TempDir(), "missing path")
- err = sftpdConf.Initialize(configDir)
- assert.Error(t, err)
- sftpdConf.OPKSSHChecksum = "invalid checksum"
- err = sftpdConf.Initialize(configDir)
- assert.Error(t, err)
- sftpdConf.OPKSSHPath = ""
- sftpdConf.OPKSSHChecksum = ""
sftpdConf.RevokedUserCertsFile = "."
err = sftpdConf.Initialize(configDir)
assert.Error(t, err)
@@ -795,34 +782,6 @@ func TestSFTPFsEscapeHomeDir(t *testing.T) {
assert.NoError(t, err)
}
-func TestReadDirLongNames(t *testing.T) {
- usePubKey := true
- user, _, err := httpdtest.AddUser(getTestUser(usePubKey), http.StatusCreated)
- assert.NoError(t, err)
-
- conn, client, err := getSftpClient(user, usePubKey)
- if assert.NoError(t, err) {
- defer conn.Close()
- defer client.Close()
-
- numFiles := 1000
- for i := 0; i < 1000; i++ {
- fPath := filepath.Join(user.GetHomeDir(), hex.EncodeToString(util.GenerateRandomBytes(127)))
- err = os.WriteFile(fPath, util.GenerateRandomBytes(30), 0666)
- assert.NoError(t, err)
- }
-
- entries, err := client.ReadDir("/")
- assert.NoError(t, err)
- assert.Len(t, entries, numFiles)
- }
-
- _, err = httpdtest.RemoveUser(user, http.StatusOK)
- assert.NoError(t, err)
- err = os.RemoveAll(user.GetHomeDir())
- assert.NoError(t, err)
-}
-
func TestGroupSettingsOverride(t *testing.T) {
usePubKey := true
g := getTestGroup()
@@ -1213,7 +1172,6 @@ func TestConcurrency(t *testing.T) {
assert.Eventually(t, func() bool {
return len(common.Connections.GetStats("")) == 0
}, 1*time.Second, 50*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
err = os.Remove(testFilePath)
assert.NoError(t, err)
@@ -2485,7 +2443,7 @@ func TestLoginWithDatabaseCredentials(t *testing.T) {
u := getTestUser(usePubKey)
u.FsConfig.Provider = sdk.GCSFilesystemProvider
u.FsConfig.GCSConfig.Bucket = "testbucket"
- u.FsConfig.GCSConfig.Credentials = kms.NewPlainSecret(`{ "type": "service_account", "private_key": " ", "client_email": "example@iam.gserviceaccount.com" }`)
+ u.FsConfig.GCSConfig.Credentials = kms.NewPlainSecret(`{ "type": "service_account" }`)
user, _, err := httpdtest.AddUser(u, http.StatusCreated)
assert.NoError(t, err)
assert.Equal(t, sdkkms.SecretStatusSecretBox, user.FsConfig.GCSConfig.Credentials.GetStatus())
@@ -3011,15 +2969,6 @@ func TestPreLoginScript(t *testing.T) {
}
usePubKey := true
u := getTestUser(usePubKey)
- mappedPath := filepath.Join(os.TempDir(), "vdir")
- folderName := filepath.Base(mappedPath)
- folderMountPath := "/vpath"
- u.VirtualFolders = append(u.VirtualFolders, vfs.VirtualFolder{
- BaseVirtualFolder: vfs.BaseVirtualFolder{
- Name: folderName,
- },
- VirtualPath: folderMountPath,
- })
err := dataprovider.Close()
assert.NoError(t, err)
err = config.LoadConfig(configDir, "")
@@ -3031,37 +2980,13 @@ func TestPreLoginScript(t *testing.T) {
err = dataprovider.Initialize(providerConf, configDir, true)
assert.NoError(t, err)
- f := vfs.BaseVirtualFolder{
- Name: folderName,
- MappedPath: mappedPath,
- FsConfig: vfs.Filesystem{
- Provider: sdk.CryptedFilesystemProvider,
- CryptConfig: vfs.CryptFsConfig{
- Passphrase: kms.NewPlainSecret(defaultPassword),
- },
- },
- }
- _, _, err = httpdtest.AddFolder(f, http.StatusCreated)
- assert.NoError(t, err)
-
user, _, err := httpdtest.AddUser(u, http.StatusCreated)
assert.NoError(t, err)
conn, client, err := getSftpClient(u, usePubKey)
if assert.NoError(t, err) {
defer conn.Close()
defer client.Close()
-
assert.NoError(t, checkBasicSFTP(client))
- testFilePath := filepath.Join(homeBasePath, testFileName)
- testData := []byte("test data")
- err = os.WriteFile(testFilePath, testData, 0666)
- assert.NoError(t, err)
- err = sftpUploadFile(testFilePath, path.Join(folderMountPath, testFileName), int64(len(testData)), client)
- assert.NoError(t, err)
- info, err := os.Stat(filepath.Join(mappedPath, testFileName))
- if assert.NoError(t, err) {
- assert.Greater(t, info.Size(), int64(len(testData)))
- }
}
err = os.WriteFile(preLoginPath, getPreLoginScriptContent(user, true), os.ModePerm)
assert.NoError(t, err)
@@ -3098,10 +3023,6 @@ func TestPreLoginScript(t *testing.T) {
assert.NoError(t, err)
err = os.RemoveAll(user.GetHomeDir())
assert.NoError(t, err)
- _, err = httpdtest.RemoveFolder(vfs.BaseVirtualFolder{Name: folderName}, http.StatusOK)
- assert.NoError(t, err)
- err = os.RemoveAll(mappedPath)
- assert.NoError(t, err)
err = dataprovider.Close()
assert.NoError(t, err)
err = config.LoadConfig(configDir, "")
@@ -3119,7 +3040,6 @@ func TestPreLoginUserCreation(t *testing.T) {
}
usePubKey := false
u := getTestUser(usePubKey)
- u.Permissions["/list"] = []string{"list", "download"}
err := dataprovider.Close()
assert.NoError(t, err)
err = config.LoadConfig(configDir, "")
@@ -3141,23 +3061,6 @@ func TestPreLoginUserCreation(t *testing.T) {
}
user, _, err := httpdtest.GetUserByUsername(defaultUsername, http.StatusOK)
assert.NoError(t, err)
- assert.Len(t, user.Permissions, 2)
- assert.Empty(t, user.Description)
- u.Description = "some desc"
- delete(u.Permissions, "/list")
- err = os.WriteFile(preLoginPath, getPreLoginScriptContent(u, false), os.ModePerm)
- assert.NoError(t, err)
- // The user should be updated and list permission removed
- conn, client, err = getSftpClient(u, usePubKey)
- if assert.NoError(t, err) {
- defer conn.Close()
- defer client.Close()
- assert.NoError(t, checkBasicSFTP(client))
- }
- user, _, err = httpdtest.GetUserByUsername(defaultUsername, http.StatusOK)
- assert.NoError(t, err)
- assert.Len(t, user.Permissions, 1)
- assert.NotEmpty(t, user.Description)
_, err = httpdtest.RemoveUser(user, http.StatusOK)
assert.NoError(t, err)
err = os.RemoveAll(user.GetHomeDir())
@@ -4458,78 +4361,6 @@ func TestMaxPerHostConnections(t *testing.T) {
common.Config.MaxPerHostConnections = oldValue
}
-func TestMaxTransfers(t *testing.T) {
- oldValue := common.Config.MaxPerHostConnections
- common.Config.MaxPerHostConnections = 2
-
- assert.Eventually(t, func() bool {
- return common.Connections.GetClientConnections() == 0
- }, 1000*time.Millisecond, 50*time.Millisecond)
-
- usePubKey := true
- user := getTestUser(usePubKey)
- err := dataprovider.AddUser(&user, "", "", "")
- assert.NoError(t, err)
- user.Password = ""
- conn, client, err := getSftpClient(user, usePubKey)
- if assert.NoError(t, err) {
- assert.NoError(t, checkBasicSFTP(client))
-
- testFilePath := filepath.Join(homeBasePath, testFileName)
- testFileSize := int64(65535)
- err = createTestFile(testFilePath, testFileSize)
- assert.NoError(t, err)
- err = sftpUploadFile(testFilePath, testFileName, testFileSize, client)
- assert.NoError(t, err)
-
- f1, err := client.Create("file1")
- assert.NoError(t, err)
- f2, err := client.Create("file2")
- assert.NoError(t, err)
- _, err = f1.Write([]byte(" "))
- assert.NoError(t, err)
- _, err = f2.Write([]byte(" "))
- assert.NoError(t, err)
-
- err = sftpUploadFile(testFilePath, testFileName, testFileSize, client)
- assert.ErrorContains(t, err, sftp.ErrSSHFxPermissionDenied.Error())
-
- remoteUpPath := fmt.Sprintf("%v@127.0.0.1:%v", user.Username, "/")
- err = scpUpload(testFilePath, remoteUpPath, false, false)
- assert.Error(t, err)
-
- localDownloadPath := filepath.Join(homeBasePath, testDLFileName)
- err = sftpDownloadFile(testFileName, localDownloadPath, testFileSize, client)
- assert.ErrorContains(t, err, sftp.ErrSSHFxPermissionDenied.Error())
-
- remoteDownPath := fmt.Sprintf("%v@127.0.0.1:%v", user.Username, path.Join("/", testFileName))
- err = scpDownload(localDownloadPath, remoteDownPath, false, false)
- assert.Error(t, err)
-
- err = f1.Close()
- assert.NoError(t, err)
- err = f2.Close()
- assert.NoError(t, err)
- err = os.Remove(testFilePath)
- assert.NoError(t, err)
- err = os.Remove(localDownloadPath)
- assert.NoError(t, err)
- err = client.Close()
- assert.NoError(t, err)
- err = conn.Close()
- assert.NoError(t, err)
- }
- err = dataprovider.DeleteUser(user.Username, "", "", "")
- assert.NoError(t, err)
- err = os.RemoveAll(user.GetHomeDir())
- assert.NoError(t, err)
- assert.Eventually(t, func() bool {
- return common.Connections.GetTotalTransfers() == 0
- }, 1000*time.Millisecond, 50*time.Millisecond)
-
- common.Config.MaxPerHostConnections = oldValue
-}
-
func TestMaxSessions(t *testing.T) {
usePubKey := false
u := getTestUser(usePubKey)
@@ -5079,7 +4910,6 @@ func TestBandwidthAndConnections(t *testing.T) {
assert.Eventually(t, func() bool {
return len(common.Connections.GetStats("")) == 0
}, 10*time.Second, 200*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
err = os.Remove(testFilePath)
assert.NoError(t, err)
err = os.Remove(localDownloadPath)
@@ -5663,13 +5493,13 @@ func TestNestedVirtualFolders(t *testing.T) {
folderGet, _, err = httpdtest.GetFolderByName(folderName, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), folderGet.UsedQuotaSize)
- assert.Equal(t, 0, folderGet.UsedQuotaFiles)
+ assert.Equal(t, int64(18769), folderGet.UsedQuotaSize)
+ assert.Equal(t, 1, folderGet.UsedQuotaFiles)
folderGet, _, err = httpdtest.GetFolderByName(folderNameNested, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), folderGet.UsedQuotaSize)
- assert.Equal(t, 0, folderGet.UsedQuotaFiles)
+ assert.Equal(t, int64(27658), folderGet.UsedQuotaSize)
+ assert.Equal(t, 1, folderGet.UsedQuotaFiles)
files, err := client.ReadDir("/")
if assert.NoError(t, err) {
@@ -6336,8 +6166,8 @@ func TestVirtualFoldersQuotaValues(t *testing.T) {
assert.Equal(t, expectedQuotaSize, user.UsedQuotaSize)
f, _, err := httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize, f.UsedQuotaSize)
@@ -6456,8 +6286,8 @@ func TestQuotaRenameInsideSameVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize+testFileSize1, user.UsedQuotaSize)
f, _, err := httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize+testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 2, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize+testFileSize1, f.UsedQuotaSize)
@@ -6481,8 +6311,8 @@ func TestQuotaRenameInsideSameVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize+testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize+testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 2, f.UsedQuotaFiles)
// rename a file inside vdir2, it isn't included inside user quota, so we have:
// - vdir1/dir1/testFileName.rename
// - vdir1/dir2/testFileName1
@@ -6500,8 +6330,8 @@ func TestQuotaRenameInsideSameVirtualFolder(t *testing.T) {
assert.Equal(t, 2, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize+testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 2, f.UsedQuotaFiles)
// rename a file inside vdir2 overwriting an existing, we now have:
// - vdir1/dir1/testFileName.rename
// - vdir1/dir2/testFileName1
@@ -6518,8 +6348,8 @@ func TestQuotaRenameInsideSameVirtualFolder(t *testing.T) {
assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize+testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 2, f.UsedQuotaFiles)
// rename a file inside vdir1 overwriting an existing, we now have:
// - vdir1/dir1/testFileName.rename (initial testFileName1)
// - vdir2/dir1/testFileName.rename (initial testFileName1)
@@ -6531,8 +6361,8 @@ func TestQuotaRenameInsideSameVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize1, f.UsedQuotaSize)
@@ -6552,8 +6382,8 @@ func TestQuotaRenameInsideSameVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize1, f.UsedQuotaSize)
@@ -6674,8 +6504,8 @@ func TestQuotaRenameBetweenVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize, user.UsedQuotaSize)
f, _, err := httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize+testFileSize1+testFileSize1, f.UsedQuotaSize)
@@ -6693,8 +6523,8 @@ func TestQuotaRenameBetweenVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize*2, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize*2, f.UsedQuotaSize)
+ assert.Equal(t, 2, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize1*2, f.UsedQuotaSize)
@@ -6711,8 +6541,8 @@ func TestQuotaRenameBetweenVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize1+testFileSize, f.UsedQuotaSize)
@@ -6728,8 +6558,8 @@ func TestQuotaRenameBetweenVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize, f.UsedQuotaSize)
@@ -6759,8 +6589,8 @@ func TestQuotaRenameBetweenVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize1*3+testFileSize*2, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize1*3+testFileSize*2, f.UsedQuotaSize)
+ assert.Equal(t, 5, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, int64(0), f.UsedQuotaSize)
@@ -6774,8 +6604,8 @@ func TestQuotaRenameBetweenVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize1*2+testFileSize, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize1*2+testFileSize, f.UsedQuotaSize)
+ assert.Equal(t, 3, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize+testFileSize1, f.UsedQuotaSize)
@@ -6896,8 +6726,8 @@ func TestQuotaRenameFromVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize+testFileSize1, user.UsedQuotaSize)
f, _, err := httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize+testFileSize1, f.UsedQuotaSize)
@@ -6915,8 +6745,8 @@ func TestQuotaRenameFromVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize+testFileSize1+testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize, f.UsedQuotaSize)
@@ -6979,8 +6809,8 @@ func TestQuotaRenameFromVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize*3+testFileSize1*3, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize+testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 2, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, int64(0), f.UsedQuotaSize)
@@ -7113,8 +6943,8 @@ func TestQuotaRenameToVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize+testFileSize1, user.UsedQuotaSize)
f, _, err := httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
// rename a file from user home dir to vdir2, vdir2 is not included in user quota so we have:
// - /vdir2/dir1/testFileName
// - /vdir1/dir1/testFileName1
@@ -7153,8 +6983,8 @@ func TestQuotaRenameToVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize+testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize, f.UsedQuotaSize)
@@ -7170,8 +7000,8 @@ func TestQuotaRenameToVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize1, f.UsedQuotaSize)
@@ -7193,8 +7023,8 @@ func TestQuotaRenameToVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize*2+testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize1, f.UsedQuotaSize)
@@ -7211,8 +7041,8 @@ func TestQuotaRenameToVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize*2+testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize*2+testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 3, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize1, f.UsedQuotaSize)
@@ -7237,8 +7067,8 @@ func TestQuotaRenameToVirtualFolder(t *testing.T) {
assert.Equal(t, testFileSize*2+testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize*2+testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 3, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize1*2+testFileSize, f.UsedQuotaSize)
@@ -7506,8 +7336,8 @@ func TestVFolderQuotaSize(t *testing.T) {
f, _, err := httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize, f.UsedQuotaSize)
+ assert.Equal(t, 1, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize, f.UsedQuotaSize)
@@ -8584,12 +8414,18 @@ func TestResolvePaths(t *testing.T) {
assert.Equal(t, fs.Join(user.GetHomeDir(), "/test/sub"), resolved)
path = "../test/sub"
resolved, err = fs.ResolvePath(filepath.ToSlash(path))
- assert.NoError(t, err)
- assert.Equal(t, fs.Join(user.GetHomeDir(), "/test/sub"), resolved)
+ if vfs.IsLocalOsFs(fs) {
+ assert.Error(t, err, "Unexpected resolved path: %v for: %v, fs: %v", resolved, path, fs.Name())
+ } else {
+ assert.Equal(t, fs.Join(user.GetHomeDir(), "/test/sub"), resolved)
+ }
path = "../../../test/../sub"
resolved, err = fs.ResolvePath(filepath.ToSlash(path))
- assert.NoError(t, err)
- assert.Equal(t, fs.Join(user.GetHomeDir(), "/sub"), resolved)
+ if vfs.IsLocalOsFs(fs) {
+ assert.Error(t, err, "Unexpected resolved path: %v for: %v, fs: %v", resolved, path, fs.Name())
+ } else {
+ assert.Equal(t, fs.Join(user.GetHomeDir(), "/sub"), resolved)
+ }
}
err = os.RemoveAll(user.GetHomeDir())
assert.NoError(t, err)
@@ -8771,8 +8607,8 @@ func TestUserAllowedLoginMethods(t *testing.T) {
allowedMethods = user.GetAllowedLoginMethods()
assert.Equal(t, 4, len(allowedMethods))
- assert.True(t, slices.Contains(allowedMethods, dataprovider.SSHLoginMethodKeyAndKeyboardInt))
- assert.True(t, slices.Contains(allowedMethods, dataprovider.SSHLoginMethodKeyAndPassword))
+ assert.True(t, util.Contains(allowedMethods, dataprovider.SSHLoginMethodKeyAndKeyboardInt))
+ assert.True(t, util.Contains(allowedMethods, dataprovider.SSHLoginMethodKeyAndPassword))
}
func TestUserPartialAuth(t *testing.T) {
@@ -9279,8 +9115,8 @@ func TestSSHCopy(t *testing.T) {
assert.Equal(t, 2*testFileSize+2*testFileSize1, user.UsedQuotaSize)
f, _, err := httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, testFileSize+testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 2, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, testFileSize+testFileSize1, f.UsedQuotaSize)
@@ -9358,8 +9194,8 @@ func TestSSHCopy(t *testing.T) {
assert.Equal(t, 5*testFileSize+4*testFileSize1, user.UsedQuotaSize)
f, _, err = httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, 2*testFileSize+2*testFileSize1, f.UsedQuotaSize)
+ assert.Equal(t, 4, f.UsedQuotaFiles)
}
// cross folder copy
newDir := "newdir"
@@ -9932,13 +9768,10 @@ func TestSSHRemoveCryptFs(t *testing.T) {
assert.NoError(t, err)
}
-func TestSSHCommandMaxTransfers(t *testing.T) {
+func TestBasicGitCommands(t *testing.T) {
if len(gitPath) == 0 || len(sshPath) == 0 || runtime.GOOS == osWindows {
t.Skip("git and/or ssh command not found or OS is windows, unable to execute this test")
}
- oldValue := common.Config.MaxPerHostConnections
- common.Config.MaxPerHostConnections = 2
-
usePubKey := true
u := getTestUser(usePubKey)
user, _, err := httpdtest.AddUser(u, http.StatusCreated)
@@ -9950,31 +9783,43 @@ func TestSSHCommandMaxTransfers(t *testing.T) {
assert.NoError(t, err)
err = os.RemoveAll(filepath.Join(homeBasePath, repoName))
assert.NoError(t, err)
+ out, err := initGitRepo(filepath.Join(user.HomeDir, repoName))
+ assert.NoError(t, err, "unexpected error, out: %v", string(out))
- conn, client, err := getSftpClient(user, usePubKey)
- if assert.NoError(t, err) {
- f1, err := client.Create("file1")
- assert.NoError(t, err)
- f2, err := client.Create("file2")
- assert.NoError(t, err)
- _, err = f1.Write([]byte(" "))
- assert.NoError(t, err)
- _, err = f2.Write([]byte(" "))
- assert.NoError(t, err)
+ out, err = cloneGitRepo(homeBasePath, "/"+repoName, user.Username)
+ assert.NoError(t, err, "unexpected error, out: %v", string(out))
- _, err = client.Create("file3")
- assert.Error(t, err)
+ out, err = addFileToGitRepo(clonePath, 128)
+ assert.NoError(t, err, "unexpected error, out: %v", string(out))
- err = f1.Close()
- assert.NoError(t, err)
- err = f2.Close()
- assert.NoError(t, err)
- err = client.Close()
- assert.NoError(t, err)
- err = conn.Close()
- assert.NoError(t, err)
+ user.QuotaFiles = 100000
+ _, _, err = httpdtest.UpdateUser(user, http.StatusOK, "")
+ assert.NoError(t, err)
+
+ out, err = pushToGitRepo(clonePath)
+ if !assert.NoError(t, err, "unexpected error, out: %v", string(out)) {
+ printLatestLogs(10)
}
+ out, err = addFileToGitRepo(clonePath, 131072)
+ assert.NoError(t, err, "unexpected error, out: %v", string(out))
+
+ user, _, err = httpdtest.GetUserByUsername(user.Username, http.StatusOK)
+ assert.NoError(t, err)
+ user.QuotaSize = user.UsedQuotaSize + 1
+ _, _, err = httpdtest.UpdateUser(user, http.StatusOK, "")
+ assert.NoError(t, err)
+ out, err = pushToGitRepo(clonePath)
+ assert.Error(t, err, "git push must fail if quota is exceeded, out: %v", string(out))
+
+ aDir := filepath.Join(user.GetHomeDir(), repoName, "adir")
+ err = os.MkdirAll(aDir, 0001)
+ assert.NoError(t, err)
+ _, err = pushToGitRepo(clonePath)
+ assert.Error(t, err)
+ err = os.Chmod(aDir, os.ModePerm)
+ assert.NoError(t, err)
+
_, err = httpdtest.RemoveUser(user, http.StatusOK)
assert.NoError(t, err)
@@ -9982,9 +9827,180 @@ func TestSSHCommandMaxTransfers(t *testing.T) {
assert.NoError(t, err)
err = os.RemoveAll(clonePath)
assert.NoError(t, err)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
+}
- common.Config.MaxPerHostConnections = oldValue
+func TestGitIncludedVirtualFolders(t *testing.T) {
+ if len(gitPath) == 0 || len(sshPath) == 0 || runtime.GOOS == osWindows {
+ t.Skip("git and/or ssh command not found or OS is windows, unable to execute this test")
+ }
+ usePubKey := true
+ repoName := "trepo"
+ u := getTestUser(usePubKey)
+ u.QuotaFiles = 10000
+ mappedPath := filepath.Join(os.TempDir(), "repo")
+ folderName := filepath.Base(mappedPath)
+ u.VirtualFolders = append(u.VirtualFolders, vfs.VirtualFolder{
+ BaseVirtualFolder: vfs.BaseVirtualFolder{
+ Name: folderName,
+ },
+ VirtualPath: "/" + repoName,
+ QuotaFiles: -1,
+ QuotaSize: -1,
+ })
+ f := vfs.BaseVirtualFolder{
+ Name: folderName,
+ MappedPath: mappedPath,
+ }
+ _, _, err := httpdtest.AddFolder(f, http.StatusCreated)
+ assert.NoError(t, err)
+ user, _, err := httpdtest.AddUser(u, http.StatusCreated)
+ assert.NoError(t, err)
+
+ clonePath := filepath.Join(homeBasePath, repoName)
+ err = os.RemoveAll(user.GetHomeDir())
+ assert.NoError(t, err)
+ err = os.RemoveAll(filepath.Join(homeBasePath, repoName))
+ assert.NoError(t, err)
+ out, err := initGitRepo(mappedPath)
+ assert.NoError(t, err, "unexpected error, out: %v", string(out))
+
+ out, err = cloneGitRepo(homeBasePath, "/"+repoName, user.Username)
+ assert.NoError(t, err, "unexpected error, out: %v", string(out))
+
+ out, err = addFileToGitRepo(clonePath, 128)
+ assert.NoError(t, err, "unexpected error, out: %v", string(out))
+
+ out, err = pushToGitRepo(clonePath)
+ assert.NoError(t, err, "unexpected error, out: %v", string(out))
+
+ user, _, err = httpdtest.GetUserByUsername(user.Username, http.StatusOK)
+ assert.NoError(t, err)
+ if user.UsedQuotaFiles == 0 {
+ assert.Eventually(t, func() bool {
+ user, _, err = httpdtest.GetUserByUsername(user.Username, http.StatusOK)
+ if err != nil {
+ return false
+ }
+ return user.QuotaFiles > 0
+ }, 1*time.Second, 100*time.Millisecond)
+ }
+ user, _, err = httpdtest.GetUserByUsername(user.Username, http.StatusOK)
+ assert.NoError(t, err)
+ assert.Greater(t, user.UsedQuotaFiles, 0)
+ assert.Greater(t, user.UsedQuotaSize, int64(0))
+
+ folder, _, err := httpdtest.GetFolderByName(folderName, http.StatusOK)
+ assert.NoError(t, err)
+ assert.Equal(t, user.UsedQuotaFiles, folder.UsedQuotaFiles)
+ assert.Equal(t, user.UsedQuotaSize, folder.UsedQuotaSize)
+
+ _, err = httpdtest.RemoveUser(user, http.StatusOK)
+ assert.NoError(t, err)
+ err = os.RemoveAll(user.GetHomeDir())
+ assert.NoError(t, err)
+ _, err = httpdtest.RemoveFolder(vfs.BaseVirtualFolder{Name: folderName}, http.StatusOK)
+ assert.NoError(t, err)
+ err = os.RemoveAll(mappedPath)
+ assert.NoError(t, err)
+ err = os.RemoveAll(clonePath)
+ assert.NoError(t, err)
+}
+
+func TestGitQuotaVirtualFolders(t *testing.T) {
+ if len(gitPath) == 0 || len(sshPath) == 0 || runtime.GOOS == osWindows {
+ t.Skip("git and/or ssh command not found or OS is windows, unable to execute this test")
+ }
+ usePubKey := true
+ repoName := "testrepo"
+ u := getTestUser(usePubKey)
+ u.QuotaFiles = 1
+ u.QuotaSize = 131072
+ mappedPath := filepath.Join(os.TempDir(), "repo")
+ folderName := filepath.Base(mappedPath)
+ u.VirtualFolders = append(u.VirtualFolders, vfs.VirtualFolder{
+ BaseVirtualFolder: vfs.BaseVirtualFolder{
+ Name: folderName,
+ },
+ VirtualPath: "/" + repoName,
+ QuotaFiles: 0,
+ QuotaSize: 0,
+ })
+ f := vfs.BaseVirtualFolder{
+ Name: folderName,
+ MappedPath: mappedPath,
+ }
+ _, _, err := httpdtest.AddFolder(f, http.StatusCreated)
+ assert.NoError(t, err)
+ err = os.MkdirAll(mappedPath, os.ModePerm)
+ assert.NoError(t, err)
+ user, _, err := httpdtest.AddUser(u, http.StatusCreated)
+ assert.NoError(t, err)
+ conn, client, err := getSftpClient(user, usePubKey)
+ if assert.NoError(t, err) {
+ // we upload a file so the user is over quota
+ defer conn.Close()
+ defer client.Close()
+ testFilePath := filepath.Join(homeBasePath, testFileName)
+ err = createTestFile(testFilePath, u.QuotaSize)
+ assert.NoError(t, err)
+ err = sftpUploadFile(testFilePath, testFileName, u.QuotaSize, client)
+ assert.NoError(t, err)
+ err = os.Remove(testFilePath)
+ assert.NoError(t, err)
+ }
+
+ clonePath := filepath.Join(homeBasePath, repoName)
+ err = os.RemoveAll(user.GetHomeDir())
+ assert.NoError(t, err)
+ err = os.RemoveAll(filepath.Join(homeBasePath, repoName))
+ assert.NoError(t, err)
+ out, err := initGitRepo(mappedPath)
+ assert.NoError(t, err, "unexpected error, out: %v", string(out))
+
+ out, err = cloneGitRepo(homeBasePath, "/"+repoName, user.Username)
+ assert.NoError(t, err, "unexpected error, out: %v", string(out))
+
+ out, err = addFileToGitRepo(clonePath, 128)
+ assert.NoError(t, err, "unexpected error, out: %v", string(out))
+
+ out, err = pushToGitRepo(clonePath)
+ assert.NoError(t, err, "unexpected error, out: %v", string(out))
+
+ _, err = httpdtest.RemoveUser(user, http.StatusOK)
+ assert.NoError(t, err)
+ err = os.RemoveAll(user.GetHomeDir())
+ assert.NoError(t, err)
+ _, err = httpdtest.RemoveFolder(vfs.BaseVirtualFolder{Name: folderName}, http.StatusOK)
+ assert.NoError(t, err)
+ err = os.RemoveAll(mappedPath)
+ assert.NoError(t, err)
+ err = os.RemoveAll(clonePath)
+ assert.NoError(t, err)
+}
+
+func TestGitErrors(t *testing.T) {
+ if len(gitPath) == 0 || len(sshPath) == 0 || runtime.GOOS == osWindows {
+ t.Skip("git and/or ssh command not found or OS is windows, unable to execute this test")
+ }
+ usePubKey := true
+ u := getTestUser(usePubKey)
+ user, _, err := httpdtest.AddUser(u, http.StatusCreated)
+ assert.NoError(t, err)
+ repoName := "testrepo"
+ clonePath := filepath.Join(homeBasePath, repoName)
+ err = os.RemoveAll(user.GetHomeDir())
+ assert.NoError(t, err)
+ err = os.RemoveAll(filepath.Join(homeBasePath, repoName))
+ assert.NoError(t, err)
+ out, err := cloneGitRepo(homeBasePath, "/"+repoName, user.Username)
+ assert.Error(t, err, "cloning a missing repo must fail, out: %v", string(out))
+
+ _, err = httpdtest.RemoveUser(user, http.StatusOK)
+ assert.NoError(t, err)
+ err = os.RemoveAll(user.GetHomeDir())
+ assert.NoError(t, err)
+ err = os.RemoveAll(clonePath)
+ assert.NoError(t, err)
}
// Start SCP tests
@@ -10661,8 +10677,8 @@ func TestSCPVirtualFoldersQuota(t *testing.T) {
assert.Equal(t, expectedQuotaSize, user.UsedQuotaSize)
f, _, err := httpdtest.GetFolderByName(folderName1, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), f.UsedQuotaSize)
- assert.Equal(t, 0, f.UsedQuotaFiles)
+ assert.Equal(t, expectedQuotaSize, f.UsedQuotaSize)
+ assert.Equal(t, expectedQuotaFiles, f.UsedQuotaFiles)
f, _, err = httpdtest.GetFolderByName(folderName2, http.StatusOK)
assert.NoError(t, err)
assert.Equal(t, expectedQuotaSize, f.UsedQuotaSize)
@@ -11058,7 +11074,6 @@ func TestSCPErrors(t *testing.T) {
err = cmd.Process.Kill()
assert.NoError(t, err)
assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 }, 2*time.Second, 100*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
cmd = getScpUploadCommand(testFilePath, remoteUpPath, false, false)
go func() {
err := cmd.Run()
@@ -11071,7 +11086,6 @@ func TestSCPErrors(t *testing.T) {
err = cmd.Process.Kill()
assert.NoError(t, err)
assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 }, 2*time.Second, 100*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
err = os.Remove(testFilePath)
assert.NoError(t, err)
os.Remove(localPath)
@@ -11594,6 +11608,64 @@ func checkSystemCommands() {
}
}
+func initGitRepo(path string) ([]byte, error) {
+ err := os.MkdirAll(path, os.ModePerm)
+ if err != nil {
+ return nil, err
+ }
+ args := []string{"init", "--bare"}
+ cmd := exec.Command(gitPath, args...)
+ cmd.Dir = path
+ return cmd.CombinedOutput()
+}
+
+func pushToGitRepo(repoPath string) ([]byte, error) {
+ cmd := exec.Command(gitPath, "push")
+ cmd.Dir = repoPath
+ cmd.Env = append(os.Environ(),
+ fmt.Sprintf("GIT_SSH=%v", gitWrapPath))
+ return cmd.CombinedOutput()
+}
+
+func cloneGitRepo(basePath, remotePath, username string) ([]byte, error) {
+ remoteURL := fmt.Sprintf("ssh://%v@127.0.0.1:2022%v", username, remotePath)
+ args := []string{"clone", remoteURL}
+ cmd := exec.Command(gitPath, args...)
+ cmd.Dir = basePath
+ cmd.Env = append(os.Environ(),
+ fmt.Sprintf("GIT_SSH=%v", gitWrapPath))
+ return cmd.CombinedOutput()
+}
+
+func addFileToGitRepo(repoPath string, fileSize int64) ([]byte, error) {
+ path := filepath.Join(repoPath, "test")
+ err := createTestFile(path, fileSize)
+ if err != nil {
+ return []byte(""), err
+ }
+ cmd := exec.Command(gitPath, "config", "user.email", "testuser@example.com")
+ cmd.Dir = repoPath
+ out, err := cmd.CombinedOutput()
+ if err != nil {
+ return out, err
+ }
+ cmd = exec.Command(gitPath, "config", "user.name", "testuser")
+ cmd.Dir = repoPath
+ out, err = cmd.CombinedOutput()
+ if err != nil {
+ return out, err
+ }
+ cmd = exec.Command(gitPath, "add", "test")
+ cmd.Dir = repoPath
+ out, err = cmd.CombinedOutput()
+ if err != nil {
+ return out, err
+ }
+ cmd = exec.Command(gitPath, "commit", "-am", "test")
+ cmd.Dir = repoPath
+ return cmd.CombinedOutput()
+}
+
func getKeyboardInteractiveScriptForBuiltinChecks(addPasscode bool, result int) []byte {
content := []byte("#!/bin/sh\n\n")
echos := []bool{false}
diff --git a/internal/sftpd/ssh_cmd.go b/internal/sftpd/ssh_cmd.go
index c82f3b89..8a342e99 100644
--- a/internal/sftpd/ssh_cmd.go
+++ b/internal/sftpd/ssh_cmd.go
@@ -23,12 +23,16 @@ import (
"fmt"
"hash"
"io"
+ "os"
+ "os/exec"
+ "path"
"runtime/debug"
- "slices"
"strings"
+ "sync"
"time"
"github.com/google/shlex"
+ "github.com/sftpgo/sdk"
"golang.org/x/crypto/ssh"
"github.com/drakkan/sftpgo/v2/internal/common"
@@ -44,6 +48,10 @@ const (
sshCommandLogSender = "SSHCommand"
)
+var (
+ errUnsupportedConfig = errors.New("command unsupported for this configuration")
+)
+
type sshCommand struct {
command string
args []string
@@ -51,13 +59,39 @@ type sshCommand struct {
startTime time.Time
}
+type systemCommand struct {
+ cmd *exec.Cmd
+ fsPath string
+ quotaCheckPath string
+ fs vfs.Fs
+}
+
+func (c *systemCommand) GetSTDs() (io.WriteCloser, io.ReadCloser, io.ReadCloser, error) {
+ stdin, err := c.cmd.StdinPipe()
+ if err != nil {
+ return nil, nil, nil, err
+ }
+ stdout, err := c.cmd.StdoutPipe()
+ if err != nil {
+ stdin.Close()
+ return nil, nil, nil, err
+ }
+ stderr, err := c.cmd.StderrPipe()
+ if err != nil {
+ stdin.Close()
+ stdout.Close()
+ return nil, nil, nil, err
+ }
+ return stdin, stdout, stderr, nil
+}
+
func processSSHCommand(payload []byte, connection *Connection, enabledSSHCommands []string) bool {
var msg sshSubsystemExecMsg
if err := ssh.Unmarshal(payload, &msg); err == nil {
name, args, err := parseCommandPayload(msg.Command)
connection.Log(logger.LevelDebug, "new ssh command: %q args: %v num args: %d user: %s, error: %v",
name, args, len(args), connection.User.Username, err)
- if err == nil && slices.Contains(enabledSSHCommands, name) {
+ if err == nil && util.Contains(enabledSSHCommands, name) {
connection.command = msg.Command
if name == scpCmdName && len(args) >= 2 {
connection.SetProtocol(common.ProtocolSCP)
@@ -99,15 +133,20 @@ func (c *sshCommand) handle() (err error) {
}
}()
if err := common.Connections.Add(c.connection); err != nil {
- defer c.connection.CloseFS() //nolint:errcheck
logger.Info(logSender, "", "unable to add SSH command connection: %v", err)
- return c.sendErrorResponse(err)
+ return err
}
defer common.Connections.Remove(c.connection.GetID())
c.connection.UpdateLastActivity()
- if slices.Contains(sshHashCommands, c.command) {
+ if util.Contains(sshHashCommands, c.command) {
return c.handleHashCommands()
+ } else if util.Contains(systemCommands, c.command) {
+ command, err := c.getSystemCommand()
+ if err != nil {
+ return c.sendErrorResponse(err)
+ }
+ return c.executeSystemCommand(command)
} else if c.command == "cd" {
c.sendExitStatus(nil)
} else if c.command == "pwd" {
@@ -150,18 +189,29 @@ func (c *sshCommand) handleSFTPGoRemove() error {
return nil
}
+func (c *sshCommand) updateQuota(sshDestPath string, filesNum int, filesSize int64) {
+ vfolder, err := c.connection.User.GetVirtualFolderForPath(sshDestPath)
+ if err == nil {
+ dataprovider.UpdateVirtualFolderQuota(&vfolder.BaseVirtualFolder, filesNum, filesSize, false) //nolint:errcheck
+ if vfolder.IsIncludedInUserQuota() {
+ dataprovider.UpdateUserQuota(&c.connection.User, filesNum, filesSize, false) //nolint:errcheck
+ }
+ } else {
+ dataprovider.UpdateUserQuota(&c.connection.User, filesNum, filesSize, false) //nolint:errcheck
+ }
+}
+
func (c *sshCommand) handleHashCommands() error {
var h hash.Hash
- switch c.command {
- case "md5sum":
+ if c.command == "md5sum" {
h = md5.New()
- case "sha1sum":
+ } else if c.command == "sha1sum" {
h = sha1.New()
- case "sha256sum":
+ } else if c.command == "sha256sum" {
h = sha256.New()
- case "sha384sum":
+ } else if c.command == "sha384sum" {
h = sha512.New384()
- default:
+ } else {
h = sha512.New()
}
var response string
@@ -198,6 +248,212 @@ func (c *sshCommand) handleHashCommands() error {
return nil
}
+func (c *sshCommand) executeSystemCommand(command systemCommand) error {
+ sshDestPath := c.getDestPath()
+ if !c.isLocalPath(sshDestPath) {
+ return c.sendErrorResponse(errUnsupportedConfig)
+ }
+ diskQuota, transferQuota := c.connection.HasSpace(true, false, command.quotaCheckPath)
+ if !diskQuota.HasSpace || !transferQuota.HasUploadSpace() || !transferQuota.HasDownloadSpace() {
+ return c.sendErrorResponse(common.ErrQuotaExceeded)
+ }
+ perms := []string{dataprovider.PermDownload, dataprovider.PermUpload, dataprovider.PermCreateDirs, dataprovider.PermListItems,
+ dataprovider.PermOverwrite, dataprovider.PermDelete}
+ if !c.connection.User.HasPerms(perms, sshDestPath) {
+ return c.sendErrorResponse(c.connection.GetPermissionDeniedError())
+ }
+
+ initialFiles, initialSize, err := c.getSizeForPath(command.fs, command.fsPath)
+ if err != nil {
+ return c.sendErrorResponse(err)
+ }
+
+ stdin, stdout, stderr, err := command.GetSTDs()
+ if err != nil {
+ return c.sendErrorResponse(err)
+ }
+ err = command.cmd.Start()
+ if err != nil {
+ return c.sendErrorResponse(err)
+ }
+
+ closeCmdOnError := func() {
+ c.connection.Log(logger.LevelDebug, "kill cmd: %q and close ssh channel after read or write error",
+ c.connection.command)
+ killerr := command.cmd.Process.Kill()
+ closerr := c.connection.channel.Close()
+ c.connection.Log(logger.LevelDebug, "kill cmd error: %v close channel error: %v", killerr, closerr)
+ }
+ var once sync.Once
+ commandResponse := make(chan bool)
+
+ remainingQuotaSize := diskQuota.GetRemainingSize()
+
+ go func() {
+ defer stdin.Close()
+ baseTransfer := common.NewBaseTransfer(nil, c.connection.BaseConnection, nil, command.fsPath, command.fsPath, sshDestPath,
+ common.TransferUpload, 0, 0, remainingQuotaSize, 0, false, command.fs, transferQuota)
+ transfer := newTransfer(baseTransfer, nil, nil, nil)
+
+ w, e := transfer.copyFromReaderToWriter(stdin, c.connection.channel)
+ c.connection.Log(logger.LevelDebug, "command: %q, copy from remote command to sdtin ended, written: %v, "+
+ "initial remaining quota: %v, err: %v", c.connection.command, w, remainingQuotaSize, e)
+ if e != nil {
+ once.Do(closeCmdOnError)
+ }
+ }()
+
+ go func() {
+ baseTransfer := common.NewBaseTransfer(nil, c.connection.BaseConnection, nil, command.fsPath, command.fsPath, sshDestPath,
+ common.TransferDownload, 0, 0, 0, 0, false, command.fs, transferQuota)
+ transfer := newTransfer(baseTransfer, nil, nil, nil)
+
+ w, e := transfer.copyFromReaderToWriter(c.connection.channel, stdout)
+ c.connection.Log(logger.LevelDebug, "command: %q, copy from sdtout to remote command ended, written: %v err: %v",
+ c.connection.command, w, e)
+ if e != nil {
+ once.Do(closeCmdOnError)
+ }
+ commandResponse <- true
+ }()
+
+ go func() {
+ baseTransfer := common.NewBaseTransfer(nil, c.connection.BaseConnection, nil, command.fsPath, command.fsPath, sshDestPath,
+ common.TransferDownload, 0, 0, 0, 0, false, command.fs, transferQuota)
+ transfer := newTransfer(baseTransfer, nil, nil, nil)
+
+ w, e := transfer.copyFromReaderToWriter(c.connection.channel.(ssh.Channel).Stderr(), stderr)
+ c.connection.Log(logger.LevelDebug, "command: %q, copy from sdterr to remote command ended, written: %v err: %v",
+ c.connection.command, w, e)
+ // os.ErrClosed means that the command is finished so we don't need to do anything
+ if (e != nil && !errors.Is(e, os.ErrClosed)) || w > 0 {
+ once.Do(closeCmdOnError)
+ }
+ }()
+
+ <-commandResponse
+ err = command.cmd.Wait()
+ c.sendExitStatus(err)
+
+ numFiles, dirSize, errSize := c.getSizeForPath(command.fs, command.fsPath)
+ if errSize == nil {
+ c.updateQuota(sshDestPath, numFiles-initialFiles, dirSize-initialSize)
+ }
+ c.connection.Log(logger.LevelDebug, "command %q finished for path %q, initial files %v initial size %v "+
+ "current files %v current size %v size err: %v", c.connection.command, command.fsPath, initialFiles, initialSize,
+ numFiles, dirSize, errSize)
+ return c.connection.GetFsError(command.fs, err)
+}
+
+func (c *sshCommand) isSystemCommandAllowed() error {
+ sshDestPath := c.getDestPath()
+ if c.connection.User.IsVirtualFolder(sshDestPath) {
+ // overlapped virtual path are not allowed
+ return nil
+ }
+ if c.connection.User.HasVirtualFoldersInside(sshDestPath) {
+ c.connection.Log(logger.LevelDebug, "command %q is not allowed, path %q has virtual folders inside it, user %q",
+ c.command, sshDestPath, c.connection.User.Username)
+ return errUnsupportedConfig
+ }
+ for _, f := range c.connection.User.Filters.FilePatterns {
+ if f.Path == sshDestPath {
+ c.connection.Log(logger.LevelDebug,
+ "command %q is not allowed inside folders with file patterns filters %q user %q",
+ c.command, sshDestPath, c.connection.User.Username)
+ return errUnsupportedConfig
+ }
+ if len(sshDestPath) > len(f.Path) {
+ if strings.HasPrefix(sshDestPath, f.Path+"/") || f.Path == "/" {
+ c.connection.Log(logger.LevelDebug,
+ "command %q is not allowed it includes folders with file patterns filters %q user %q",
+ c.command, sshDestPath, c.connection.User.Username)
+ return errUnsupportedConfig
+ }
+ }
+ if len(sshDestPath) < len(f.Path) {
+ if strings.HasPrefix(sshDestPath+"/", f.Path) || sshDestPath == "/" {
+ c.connection.Log(logger.LevelDebug,
+ "command %q is not allowed inside folder with file patterns filters %q user %q",
+ c.command, sshDestPath, c.connection.User.Username)
+ return errUnsupportedConfig
+ }
+ }
+ }
+ return nil
+}
+
+func (c *sshCommand) getSystemCommand() (systemCommand, error) {
+ command := systemCommand{
+ cmd: nil,
+ fs: nil,
+ fsPath: "",
+ quotaCheckPath: "",
+ }
+ if err := common.CheckClosing(); err != nil {
+ return command, err
+ }
+ args := make([]string, len(c.args))
+ copy(args, c.args)
+ var fsPath, quotaPath string
+ sshPath := c.getDestPath()
+ fs, err := c.connection.User.GetFilesystemForPath(sshPath, c.connection.ID)
+ if err != nil {
+ return command, err
+ }
+ if len(c.args) > 0 {
+ var err error
+ fsPath, err = fs.ResolvePath(sshPath)
+ if err != nil {
+ return command, c.connection.GetFsError(fs, err)
+ }
+ quotaPath = sshPath
+ fi, err := fs.Stat(fsPath)
+ if err == nil && fi.IsDir() {
+ // if the target is an existing dir the command will write inside this dir
+ // so we need to check the quota for this directory and not its parent dir
+ quotaPath = path.Join(sshPath, "fakecontent")
+ }
+ if strings.HasSuffix(sshPath, "/") && !strings.HasSuffix(fsPath, string(os.PathSeparator)) {
+ fsPath += string(os.PathSeparator)
+ c.connection.Log(logger.LevelDebug, "path separator added to fsPath %q", fsPath)
+ }
+ args = args[:len(args)-1]
+ args = append(args, fsPath)
+ }
+ if err := c.isSystemCommandAllowed(); err != nil {
+ return command, errUnsupportedConfig
+ }
+ if c.command == "rsync" {
+ // we cannot avoid that rsync creates symlinks so if the user has the permission
+ // to create symlinks we add the option --safe-links to the received rsync command if
+ // it is not already set. This should prevent to create symlinks that point outside
+ // the home dir.
+ // If the user cannot create symlinks we add the option --munge-links, if it is not
+ // already set. This should make symlinks unusable (but manually recoverable)
+ if c.connection.User.HasPerm(dataprovider.PermCreateSymlinks, c.getDestPath()) {
+ if !util.Contains(args, "--safe-links") {
+ args = append([]string{"--safe-links"}, args...)
+ }
+ } else {
+ if !util.Contains(args, "--munge-links") {
+ args = append([]string{"--munge-links"}, args...)
+ }
+ }
+ }
+ c.connection.Log(logger.LevelDebug, "new system command %q, with args: %+v fs path %q quota check path %q",
+ c.command, args, fsPath, quotaPath)
+ cmd := exec.Command(c.command, args...)
+ uid := c.connection.User.GetUID()
+ gid := c.connection.User.GetGID()
+ cmd = wrapCmd(cmd, uid, gid)
+ command.cmd = cmd
+ command.fsPath = fsPath
+ command.quotaCheckPath = quotaPath
+ command.fs = fs
+ return command, nil
+}
+
// for the supported commands, the destination path, if any, is the last argument
func (c *sshCommand) getDestPath() string {
if len(c.args) == 0 {
@@ -236,6 +492,37 @@ func (c *sshCommand) getRemovePath() (string, error) {
return sshDestPath, nil
}
+func (c *sshCommand) isLocalPath(virtualPath string) bool {
+ folder, err := c.connection.User.GetVirtualFolderForPath(virtualPath)
+ if err != nil {
+ return c.connection.User.FsConfig.Provider == sdk.LocalFilesystemProvider
+ }
+ return folder.FsConfig.Provider == sdk.LocalFilesystemProvider
+}
+
+func (c *sshCommand) getSizeForPath(fs vfs.Fs, name string) (int, int64, error) {
+ if dataprovider.GetQuotaTracking() > 0 {
+ fi, err := fs.Lstat(name)
+ if err != nil {
+ if fs.IsNotExist(err) {
+ return 0, 0, nil
+ }
+ c.connection.Log(logger.LevelDebug, "unable to stat %q error: %v", name, err)
+ return 0, 0, err
+ }
+ if fi.IsDir() {
+ files, size, err := fs.GetDirSize(name)
+ if err != nil {
+ c.connection.Log(logger.LevelDebug, "unable to get size for dir %q error: %v", name, err)
+ }
+ return files, size, err
+ } else if fi.Mode().IsRegular() {
+ return 1, fi.Size(), nil
+ }
+ }
+ return 0, 0, nil
+}
+
func (c *sshCommand) sendErrorResponse(err error) error {
errorString := fmt.Sprintf("%v: %v %v\n", c.command, c.getDestPath(), err)
c.connection.channel.Write([]byte(errorString)) //nolint:errcheck
diff --git a/internal/sftpd/subsystem.go b/internal/sftpd/subsystem.go
new file mode 100644
index 00000000..b17bd62e
--- /dev/null
+++ b/internal/sftpd/subsystem.go
@@ -0,0 +1,87 @@
+// Copyright (C) 2019 Nicola Murino
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published
+// by the Free Software Foundation, version 3.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see .
+
+package sftpd
+
+import (
+ "io"
+ "net"
+
+ "github.com/pkg/sftp"
+
+ "github.com/drakkan/sftpgo/v2/internal/common"
+ "github.com/drakkan/sftpgo/v2/internal/dataprovider"
+ "github.com/drakkan/sftpgo/v2/internal/logger"
+)
+
+type subsystemChannel struct {
+ reader io.Reader
+ writer io.Writer
+}
+
+func (s *subsystemChannel) Read(p []byte) (int, error) {
+ return s.reader.Read(p)
+}
+
+func (s *subsystemChannel) Write(p []byte) (int, error) {
+ return s.writer.Write(p)
+}
+
+func (s *subsystemChannel) Close() error {
+ return nil
+}
+
+func newSubsystemChannel(reader io.Reader, writer io.Writer) *subsystemChannel {
+ return &subsystemChannel{
+ reader: reader,
+ writer: writer,
+ }
+}
+
+// ServeSubSystemConnection handles a connection as SSH subsystem
+func ServeSubSystemConnection(user *dataprovider.User, connectionID string, reader io.Reader, writer io.Writer) error {
+ err := user.CheckFsRoot(connectionID)
+ if err != nil {
+ errClose := user.CloseFs()
+ logger.Warn(logSender, connectionID, "unable to check fs root: %v close fs error: %v", err, errClose)
+ return err
+ }
+
+ connection := &Connection{
+ BaseConnection: common.NewBaseConnection(connectionID, common.ProtocolSFTP, "", "", *user),
+ ClientVersion: "",
+ RemoteAddr: &net.IPAddr{},
+ LocalAddr: &net.IPAddr{},
+ channel: newSubsystemChannel(reader, writer),
+ }
+ err = common.Connections.Add(connection)
+ if err != nil {
+ errClose := user.CloseFs()
+ logger.Warn(logSender, connectionID, "unable to add connection: %v close fs error: %v", err, errClose)
+ return err
+ }
+ defer common.Connections.Remove(connection.GetID())
+
+ dataprovider.UpdateLastLogin(user)
+ sftp.SetSFTPExtensions(sftpExtensions...) //nolint:errcheck
+ server := sftp.NewRequestServer(connection.channel, sftp.Handlers{
+ FileGet: connection,
+ FilePut: connection,
+ FileCmd: connection,
+ FileList: connection,
+ })
+
+ defer server.Close()
+ return server.Serve()
+}
diff --git a/internal/sftpd/transfer.go b/internal/sftpd/transfer.go
index 465ad8c3..d3acc202 100644
--- a/internal/sftpd/transfer.go
+++ b/internal/sftpd/transfer.go
@@ -19,6 +19,7 @@ import (
"io"
"github.com/drakkan/sftpgo/v2/internal/common"
+ "github.com/drakkan/sftpgo/v2/internal/metric"
"github.com/drakkan/sftpgo/v2/internal/vfs"
)
@@ -176,7 +177,7 @@ func (t *transfer) closeIO() error {
} else if t.readerAt != nil {
err = t.readerAt.Close()
if metadater, ok := t.readerAt.(vfs.Metadater); ok {
- t.SetMetadata(metadater.Metadata())
+ t.BaseTransfer.SetMetadata(metadater.Metadata())
}
}
return err
@@ -191,3 +192,63 @@ func (t *transfer) setFinished() error {
t.isFinished = true
return nil
}
+
+// used for ssh commands.
+// It reads from src until EOF so it does not treat an EOF from Read as an error to be reported.
+// EOF from Write is reported as error
+func (t *transfer) copyFromReaderToWriter(dst io.Writer, src io.Reader) (int64, error) {
+ defer t.Connection.RemoveTransfer(t)
+
+ var written int64
+ var err error
+
+ if t.MaxWriteSize < 0 {
+ return 0, common.ErrQuotaExceeded
+ }
+ isDownload := t.GetType() == common.TransferDownload
+ buf := make([]byte, 32768)
+ for {
+ t.Connection.UpdateLastActivity()
+ nr, er := src.Read(buf)
+ if nr > 0 {
+ nw, ew := dst.Write(buf[0:nr])
+ if nw > 0 {
+ written += int64(nw)
+ if isDownload {
+ t.BytesSent.Store(written)
+ if errCheck := t.CheckRead(); errCheck != nil {
+ err = errCheck
+ break
+ }
+ } else {
+ t.BytesReceived.Store(written)
+ if errCheck := t.CheckWrite(); errCheck != nil {
+ err = errCheck
+ break
+ }
+ }
+ }
+ if ew != nil {
+ err = ew
+ break
+ }
+ if nr != nw {
+ err = io.ErrShortWrite
+ break
+ }
+ }
+ if er != nil {
+ if er != io.EOF {
+ err = er
+ }
+ break
+ }
+ t.HandleThrottle()
+ }
+ t.ErrTransfer = err
+ if written > 0 || err != nil {
+ metric.TransferCompleted(t.BytesSent.Load(), t.BytesReceived.Load(), t.GetType(),
+ t.ErrTransfer, vfs.IsSFTPFs(t.Fs))
+ }
+ return written, err
+}
diff --git a/internal/smtp/oauth2.go b/internal/smtp/oauth2.go
index 87997947..5fea89f5 100644
--- a/internal/smtp/oauth2.go
+++ b/internal/smtp/oauth2.go
@@ -19,7 +19,6 @@ import (
"context"
"errors"
"fmt"
- "slices"
"sync"
"time"
@@ -28,6 +27,7 @@ import (
"golang.org/x/oauth2/microsoft"
"github.com/drakkan/sftpgo/v2/internal/logger"
+ "github.com/drakkan/sftpgo/v2/internal/util"
)
// Supported OAuth2 providers
@@ -56,7 +56,7 @@ type OAuth2Config struct {
// Validate validates and initializes the configuration
func (c *OAuth2Config) Validate() error {
- if !slices.Contains(supportedOAuth2Providers, c.Provider) {
+ if !util.Contains(supportedOAuth2Providers, c.Provider) {
return fmt.Errorf("smtp oauth2: unsupported provider %d", c.Provider)
}
if c.ClientID == "" {
diff --git a/internal/smtp/smtp.go b/internal/smtp/smtp.go
index 94984249..893534de 100644
--- a/internal/smtp/smtp.go
+++ b/internal/smtp/smtp.go
@@ -279,15 +279,15 @@ func (c *Config) Initialize(configDir string, isService bool) error {
}
func (c *Config) getMailClientOptions() []mail.Option {
- options := []mail.Option{mail.WithPort(c.Port), mail.WithoutNoop()}
+ options := []mail.Option{mail.WithoutNoop()}
switch c.Encryption {
case 1:
- options = append(options, mail.WithSSL())
+ options = append(options, mail.WithSSLPort(false))
case 2:
- options = append(options, mail.WithTLSPolicy(mail.TLSMandatory))
+ options = append(options, mail.WithTLSPortPolicy(mail.TLSMandatory))
default:
- options = append(options, mail.WithTLSPolicy(mail.NoTLS))
+ options = append(options, mail.WithTLSPortPolicy(mail.NoTLS))
}
if c.User != "" {
options = append(options, mail.WithUsername(c.User))
@@ -317,6 +317,7 @@ func (c *Config) getMailClientOptions() []mail.Option {
}),
mail.WithDebugLog())
}
+ options = append(options, mail.WithPort(c.Port))
return options
}
@@ -415,6 +416,12 @@ func SendEmail(to, bcc []string, subject, body string, contentType EmailContentT
return config.sendEmail(to, bcc, subject, body, contentType, attachments...)
}
+// ReloadProviderConf reloads the configuration from the provider
+// and apply it if different from the active one
+func ReloadProviderConf() {
+ loadConfigFromProvider() //nolint:errcheck
+}
+
func loadConfigFromProvider() error {
configs, err := dataprovider.GetConfigs()
if err != nil {
diff --git a/internal/telemetry/telemetry.go b/internal/telemetry/telemetry.go
index 233636aa..dad7e869 100644
--- a/internal/telemetry/telemetry.go
+++ b/internal/telemetry/telemetry.go
@@ -135,9 +135,9 @@ func (c Conf) Initialize(configDir string) error {
}
logger.Debug(logSender, "", "configured TLS cipher suites: %v", config.CipherSuites)
httpServer.TLSConfig = config
- return util.HTTPListenAndServe(httpServer, c.BindAddress, c.BindPort, true, nil, logSender)
+ return util.HTTPListenAndServe(httpServer, c.BindAddress, c.BindPort, true, logSender)
}
- return util.HTTPListenAndServe(httpServer, c.BindAddress, c.BindPort, false, nil, logSender)
+ return util.HTTPListenAndServe(httpServer, c.BindAddress, c.BindPort, false, logSender)
}
// ReloadCertificateMgr reloads the certificate manager
diff --git a/internal/util/i18n.go b/internal/util/i18n.go
index 2b318310..56db5b60 100644
--- a/internal/util/i18n.go
+++ b/internal/util/i18n.go
@@ -114,7 +114,6 @@ const (
I18nErrorConnectionForbidden = "general.connection_forbidden"
I18nErrorReservedUsername = "user.username_reserved"
I18nErrorInvalidEmail = "general.email_invalid"
- I18nErrorInvalidInput = "general.invalid_input"
I18nErrorInvalidUser = "user.username_invalid"
I18nErrorInvalidName = "general.name_invalid"
I18nErrorHomeRequired = "user.home_required"
@@ -122,7 +121,6 @@ const (
I18nErrorPubKeyInvalid = "user.pub_key_invalid"
I18nErrorPrivKeyInvalid = "user.priv_key_invalid"
I18nErrorKeySizeInvalid = "user.key_invalid_size"
- I18nErrorKeyInsecure = "user.key_insecure"
I18nErrorPrimaryGroup = "user.err_primary_group"
I18nErrorDuplicateGroup = "user.err_duplicate_group"
I18nErrorNoPermission = "user.no_permissions"
@@ -242,9 +240,9 @@ const (
I18nErrorRestore = "maintenance.restore_error"
I18nErrorACMEGeneric = "acme.generic_error"
I18nErrorSMTPRequiredFields = "smtp.err_required_fields"
- I18nErrorClientIDRequired = "oauth2.client_id_required"
- I18nErrorClientSecretRequired = "oauth2.client_secret_required"
- I18nErrorRefreshTokenRequired = "oauth2.refresh_token_required"
+ I18nErrorSMTPClientIDRequired = "smtp.client_id_required"
+ I18nErrorSMTPClientSecretRequired = "smtp.client_secret_required"
+ I18nErrorSMTPRefreshTokenRequired = "smtp.refresh_token_required"
I18nErrorURLRequired = "actions.http_url_required"
I18nErrorURLInvalid = "actions.http_url_invalid"
I18nErrorHTTPPartNameRequired = "actions.http_part_name_required"
@@ -305,9 +303,6 @@ const (
I18nErrorEvSyncUnsupportedFs = "rules.sync_unsupported_fs_event"
I18nErrorRuleFailureActionsOnly = "rules.only_failure_actions"
I18nErrorRuleSyncActionRequired = "rules.sync_action_required"
- I18nErrorInvalidPNG = "branding.invalid_png"
- I18nErrorInvalidPNGSize = "branding.invalid_png_size"
- I18nErrorInvalidDisclaimerURL = "branding.invalid_disclaimer_url"
)
// NewI18nError returns a I18nError wrappring the provided error
diff --git a/internal/util/resources.go b/internal/util/resources.go
index 8cddd946..9d1a360c 100644
--- a/internal/util/resources.go
+++ b/internal/util/resources.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build !bundle
+// +build !bundle
package util
diff --git a/internal/util/resources_embedded.go b/internal/util/resources_embedded.go
index 685eaf72..0512cc70 100644
--- a/internal/util/resources_embedded.go
+++ b/internal/util/resources_embedded.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build bundle
+// +build bundle
package util
diff --git a/internal/util/timeoutlistener.go b/internal/util/timeoutlistener.go
new file mode 100644
index 00000000..643f7799
--- /dev/null
+++ b/internal/util/timeoutlistener.go
@@ -0,0 +1,100 @@
+// Copyright (C) 2019 Nicola Murino
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published
+// by the Free Software Foundation, version 3.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see .
+
+package util
+
+import (
+ "net"
+ "sync/atomic"
+ "time"
+)
+
+type listener struct {
+ net.Listener
+ ReadTimeout time.Duration
+ WriteTimeout time.Duration
+}
+
+func (l *listener) Accept() (net.Conn, error) {
+ c, err := l.Listener.Accept()
+ if err != nil {
+ return nil, err
+ }
+ tc := &Conn{
+ Conn: c,
+ ReadTimeout: l.ReadTimeout,
+ WriteTimeout: l.WriteTimeout,
+ ReadThreshold: int32((l.ReadTimeout * 1024) / time.Second),
+ WriteThreshold: int32((l.WriteTimeout * 1024) / time.Second),
+ }
+ tc.BytesReadFromDeadline.Store(0)
+ tc.BytesWrittenFromDeadline.Store(0)
+ return tc, nil
+}
+
+// Conn wraps a net.Conn, and sets a deadline for every read
+// and write operation.
+type Conn struct {
+ net.Conn
+ ReadTimeout time.Duration
+ WriteTimeout time.Duration
+ ReadThreshold int32
+ WriteThreshold int32
+ BytesReadFromDeadline atomic.Int32
+ BytesWrittenFromDeadline atomic.Int32
+}
+
+func (c *Conn) Read(b []byte) (n int, err error) {
+ if c.BytesReadFromDeadline.Load() > c.ReadThreshold {
+ c.BytesReadFromDeadline.Store(0)
+ // we set both read and write deadlines here otherwise after the request
+ // is read writing the response fails with an i/o timeout error
+ err = c.Conn.SetDeadline(time.Now().Add(c.ReadTimeout))
+ if err != nil {
+ return 0, err
+ }
+ }
+ n, err = c.Conn.Read(b)
+ c.BytesReadFromDeadline.Add(int32(n))
+ return
+}
+
+func (c *Conn) Write(b []byte) (n int, err error) {
+ if c.BytesWrittenFromDeadline.Load() > c.WriteThreshold {
+ c.BytesWrittenFromDeadline.Store(0)
+ // we extend the read deadline too, not sure it's necessary,
+ // but it doesn't hurt
+ err = c.Conn.SetDeadline(time.Now().Add(c.WriteTimeout))
+ if err != nil {
+ return
+ }
+ }
+ n, err = c.Conn.Write(b)
+ c.BytesWrittenFromDeadline.Add(int32(n))
+ return
+}
+
+func newListener(network, addr string, readTimeout, writeTimeout time.Duration) (net.Listener, error) {
+ l, err := net.Listen(network, addr)
+ if err != nil {
+ return nil, err
+ }
+
+ tl := &listener{
+ Listener: l,
+ ReadTimeout: readTimeout,
+ WriteTimeout: writeTimeout,
+ }
+ return tl, nil
+}
diff --git a/internal/util/util.go b/internal/util/util.go
index 82cbbba2..fc61c00d 100644
--- a/internal/util/util.go
+++ b/internal/util/util.go
@@ -23,7 +23,6 @@ import (
"crypto/rand"
"crypto/rsa"
"crypto/sha256"
- "crypto/subtle"
"crypto/tls"
"crypto/x509"
"encoding/hex"
@@ -31,7 +30,6 @@ import (
"encoding/pem"
"errors"
"fmt"
- "hash"
"io"
"io/fs"
"math"
@@ -52,7 +50,7 @@ import (
"unsafe"
"github.com/google/uuid"
- "github.com/lithammer/shortuuid/v4"
+ "github.com/lithammer/shortuuid/v3"
"golang.org/x/crypto/ssh"
"github.com/drakkan/sftpgo/v2/internal/logger"
@@ -132,6 +130,16 @@ var bytesSizeTable = map[string]uint64{
"e": eByte,
}
+// Contains reports whether v is present in elems.
+func Contains[T comparable](elems []T, v T) bool {
+ for _, s := range elems {
+ if v == s {
+ return true
+ }
+ }
+ return false
+}
+
// IsStringPrefixInSlice searches a string prefix in a slice and returns true
// if a matching prefix is found
func IsStringPrefixInSlice(obj string, list []string) bool {
@@ -163,48 +171,6 @@ func RemoveDuplicates(obj []string, trim bool) []string {
return obj[:validIdx]
}
-// IsNameValid validates that a name/username contains only safe characters.
-func IsNameValid(name string) bool {
- if name == "" {
- return false
- }
- if len(name) > 255 {
- return false
- }
- for _, r := range name {
- if unicode.IsControl(r) {
- return false
- }
-
- switch r {
- case '/', '\\':
- return false
- case ':', '*', '?', '"', '<', '>', '|':
- return false
- }
- }
-
- if name == "." || name == ".." {
- return false
- }
-
- upperName := strings.ToUpper(name)
- baseName := strings.Split(upperName, ".")[0]
-
- switch baseName {
- case "CON", "PRN", "AUX", "NUL",
- "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9",
- "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9":
- return false
- }
-
- if strings.HasSuffix(name, " ") || strings.HasSuffix(name, ".") {
- return false
- }
-
- return true
-}
-
// GetTimeAsMsSinceEpoch returns unix timestamp as milliseconds from a time struct
func GetTimeAsMsSinceEpoch(t time.Time) int64 {
return t.UnixMilli()
@@ -279,7 +245,7 @@ func ParseBytes(s string) (int64, error) {
lastDigit := 0
hasComma := false
for _, r := range s {
- if !unicode.IsDigit(r) && r != '.' && r != ',' {
+ if !(unicode.IsDigit(r) || r == '.' || r == ',') {
break
}
if r == ',' {
@@ -290,7 +256,7 @@ func ParseBytes(s string) (int64, error) {
num := s[:lastDigit]
if hasComma {
- num = strings.ReplaceAll(num, ",", "")
+ num = strings.Replace(num, ",", "", -1)
}
f, err := strconv.ParseFloat(num, 64)
@@ -533,7 +499,10 @@ func GetDirsForVirtualPath(virtualPath string) []string {
}
}
dirsForPath := []string{virtualPath}
- for virtualPath != "/" {
+ for {
+ if virtualPath == "/" {
+ break
+ }
virtualPath = path.Dir(virtualPath)
dirsForPath = append(dirsForPath, virtualPath)
}
@@ -548,7 +517,7 @@ func CleanPath(p string) string {
// CleanPathWithBase returns a clean POSIX (/) absolute path to work with.
// The specified base will be used if the provided path is not absolute
func CleanPathWithBase(base, p string) string {
- p = strings.ReplaceAll(p, "\\", "/")
+ p = filepath.ToSlash(p)
if !path.IsAbs(p) {
p = path.Join(base, p)
}
@@ -609,7 +578,7 @@ func GenerateOpaqueString() string {
return hex.EncodeToString(randomBytes[:])
}
-// GenerateUniqueID returns an unique ID
+// GenerateUniqueID retuens an unique ID
func GenerateUniqueID() string {
u, err := uuid.NewRandom()
if err != nil {
@@ -620,10 +589,7 @@ func GenerateUniqueID() string {
// HTTPListenAndServe is a wrapper for ListenAndServe that support both tcp
// and Unix-domain sockets
-func HTTPListenAndServe(srv *http.Server, address string, port int, isTLS bool,
- listenerWrapper func(net.Listener) (net.Listener, error),
- logSender string,
-) error {
+func HTTPListenAndServe(srv *http.Server, address string, port int, isTLS bool, logSender string) error {
var listener net.Listener
var err error
@@ -637,7 +603,7 @@ func HTTPListenAndServe(srv *http.Server, address string, port int, isTLS bool,
logger.Error(logSender, "", "error creating Unix-domain socket parent dir: %v", err)
}
os.Remove(address)
- listener, err = net.Listen("unix", address)
+ listener, err = newListener("unix", address, srv.ReadTimeout, srv.WriteTimeout)
if err == nil {
// should a chmod err be fatal?
if errChmod := os.Chmod(address, 0770); errChmod != nil {
@@ -646,17 +612,12 @@ func HTTPListenAndServe(srv *http.Server, address string, port int, isTLS bool,
}
} else {
CheckTCP4Port(port)
- listener, err = net.Listen("tcp", fmt.Sprintf("%s:%d", address, port))
+ listener, err = newListener("tcp", fmt.Sprintf("%s:%d", address, port), srv.ReadTimeout, srv.WriteTimeout)
}
if err != nil {
return err
}
- if listenerWrapper != nil {
- listener, err = listenerWrapper(listener)
- if err != nil {
- return err
- }
- }
+
logger.Info(logSender, "", "server listener registered, address: %s TLS enabled: %t", listener.Addr().String(), isTLS)
defer listener.Close()
@@ -677,11 +638,6 @@ func GetTLSCiphersFromNames(cipherNames []string) []uint16 {
ciphers = append(ciphers, c.ID)
}
}
- for _, c := range tls.InsecureCipherSuites() {
- if c.Name == strings.TrimSpace(name) {
- ciphers = append(ciphers, c.ID)
- }
- }
}
if len(ciphers) == 0 {
@@ -775,7 +731,7 @@ func GetRealIP(r *http.Request, header string, depth int) string {
var ipAddresses []string
for _, h := range r.Header.Values(header) {
- for ipStr := range strings.SplitSeq(h, ",") {
+ for _, ipStr := range strings.Split(h, ",") {
ipStr = strings.TrimSpace(ipStr)
ipAddresses = append(ipAddresses, ipStr)
}
@@ -843,9 +799,7 @@ func GetRedactedURL(rawurl string) string {
return u.Redacted()
}
-// GetTLSVersion returns the TLS version from an integer value:
-// - 10 means TLS 1.0
-// - 11 means TLS 1.1
+// GetTLSVersion returns the TLS version for integer:
// - 12 means TLS 1.2
// - 13 means TLS 1.3
// default is TLS 1.2
@@ -853,10 +807,6 @@ func GetTLSVersion(val int) uint16 {
switch val {
case 13:
return tls.VersionTLS13
- case 11:
- return tls.VersionTLS11
- case 10:
- return tls.VersionTLS10
default:
return tls.VersionTLS12
}
@@ -974,40 +924,3 @@ func SlicesEqual(s1, s2 []string) bool {
return true
}
-
-// VerifyFileChecksum computes the hash of the given file using the provided
-// hash algorithm and compares it against the expected checksum (in hex format).
-// It returns an error if the checksum does not match or if the operation fails.
-func VerifyFileChecksum(filePath string, h hash.Hash, expectedHex string, maxSize int64) error {
- expected, err := hex.DecodeString(expectedHex)
- if err != nil {
- return fmt.Errorf("invalid checksum %q: %w", expectedHex, err)
- }
-
- f, err := os.Open(filePath)
- if err != nil {
- return err
- }
- defer f.Close()
-
- if maxSize > 0 {
- fi, err := f.Stat()
- if err != nil {
- return err
- }
- if fi.Size() > maxSize {
- return fmt.Errorf("file too large: %s", ByteCountIEC(fi.Size()))
- }
- }
-
- if _, err := io.Copy(h, f); err != nil {
- return err
- }
-
- actual := h.Sum(nil)
- if subtle.ConstantTimeCompare(actual, expected) != 1 {
- return errors.New("checksum mismatch")
- }
-
- return nil
-}
diff --git a/internal/version/version.go b/internal/version/version.go
index c9e066ea..cd2e96f4 100644
--- a/internal/version/version.go
+++ b/internal/version/version.go
@@ -18,7 +18,7 @@ package version
import "strings"
const (
- version = "2.7.99-dev"
+ version = "2.6.4"
appName = "SFTPGo"
)
diff --git a/internal/vfs/azblobfs.go b/internal/vfs/azblobfs.go
index 46b7ae78..3d4e92c1 100644
--- a/internal/vfs/azblobfs.go
+++ b/internal/vfs/azblobfs.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build !noazblob
+// +build !noazblob
package vfs
@@ -38,10 +39,10 @@ import (
"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
"github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
- "github.com/Azure/azure-sdk-for-go/sdk/azidentity"
"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/blob"
"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/blockblob"
"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/container"
+ "github.com/eikenb/pipeat"
"github.com/google/uuid"
"github.com/pkg/sftp"
@@ -103,6 +104,10 @@ func NewAzBlobFs(connectionID, localTempDir, mountPath string, config AzBlobFsCo
return fs.initFromSASURL()
}
+ credential, err := blob.NewSharedKeyCredential(fs.config.AccountName, fs.config.AccountKey.GetPayload())
+ if err != nil {
+ return fs, fmt.Errorf("invalid credentials: %v", err)
+ }
var endpoint string
if fs.config.UseEmulator {
endpoint = fmt.Sprintf("%s/%s", fs.config.Endpoint, fs.config.AccountName)
@@ -110,25 +115,9 @@ func NewAzBlobFs(connectionID, localTempDir, mountPath string, config AzBlobFsCo
endpoint = fmt.Sprintf("https://%s.%s/", fs.config.AccountName, fs.config.Endpoint)
}
containerURL := runtime.JoinPaths(endpoint, fs.config.Container)
- if fs.config.AccountKey.GetPayload() != "" {
- credential, err := blob.NewSharedKeyCredential(fs.config.AccountName, fs.config.AccountKey.GetPayload())
- if err != nil {
- return fs, fmt.Errorf("invalid credentials: %v", err)
- }
- svc, err := container.NewClientWithSharedKeyCredential(containerURL, credential, getAzContainerClientOptions())
- if err != nil {
- return fs, fmt.Errorf("unable to create the storage client using shared key credentials: %v", err)
- }
- fs.containerClient = svc
- return fs, err
- }
- credential, err := azidentity.NewDefaultAzureCredential(nil)
+ svc, err := container.NewClientWithSharedKeyCredential(containerURL, credential, getAzContainerClientOptions())
if err != nil {
- return fs, fmt.Errorf("invalid default azure credentials: %v", err)
- }
- svc, err := container.NewClient(containerURL, credential, getAzContainerClientOptions())
- if err != nil {
- return fs, fmt.Errorf("unable to create the storage client using azure credentials: %v", err)
+ return fs, fmt.Errorf("invalid credentials: %v", err)
}
fs.containerClient = svc
return fs, err
@@ -197,11 +186,7 @@ func (fs *AzureBlobFs) Stat(name string) (os.FileInfo, error) {
if val := getAzureLastModified(attrs.Metadata); val > 0 {
lastModified = util.GetTimeFromMsecSinceEpoch(val)
}
- info := NewFileInfo(name, isDir, util.GetIntFromPointer(attrs.ContentLength), lastModified, false)
- if !isDir {
- info.setMetadataFromPointerVal(attrs.Metadata)
- }
- return info, nil
+ return NewFileInfo(name, isDir, util.GetIntFromPointer(attrs.ContentLength), lastModified, false), nil
}
if !fs.IsNotExist(err) {
return nil, err
@@ -224,7 +209,7 @@ func (fs *AzureBlobFs) Lstat(name string) (os.FileInfo, error) {
// Open opens the named file for reading
func (fs *AzureBlobFs) Open(name string, offset int64) (File, PipeReader, func(), error) {
- r, w, err := createPipeFn(fs.localTempDir, fs.config.DownloadPartSize*int64(fs.config.DownloadConcurrency)+1)
+ r, w, err := pipeat.PipeInDir(fs.localTempDir)
if err != nil {
return nil, nil, nil, err
}
@@ -252,7 +237,7 @@ func (fs *AzureBlobFs) Create(name string, flag, checks int) (File, PipeWriter,
return nil, nil, nil, err
}
}
- r, w, err := createPipeFn(fs.localTempDir, fs.config.UploadPartSize+1024*1024)
+ r, w, err := pipeat.PipeInDir(fs.localTempDir)
if err != nil {
return nil, nil, nil, err
}
@@ -317,21 +302,19 @@ func (fs *AzureBlobFs) Create(name string, flag, checks int) (File, PipeWriter,
}
// Rename renames (moves) source to target.
-func (fs *AzureBlobFs) Rename(source, target string, checks int) (int, int64, error) {
+func (fs *AzureBlobFs) Rename(source, target string) (int, int64, error) {
if source == target {
return -1, -1, nil
}
- if checks&CheckParentDir != 0 {
- _, err := fs.Stat(path.Dir(target))
- if err != nil {
- return -1, -1, err
- }
+ _, err := fs.Stat(path.Dir(target))
+ if err != nil {
+ return -1, -1, err
}
fi, err := fs.Stat(source)
if err != nil {
return -1, -1, err
}
- return fs.renameInternal(source, target, fi, 0, checks&CheckUpdateModTime != 0)
+ return fs.renameInternal(source, target, fi, 0)
}
// Remove removes the named file or (empty) directory.
@@ -413,7 +396,7 @@ func (fs *AzureBlobFs) Chtimes(name string, _, mtime time.Time, isUploading bool
}
found := false
for k := range metadata {
- if strings.EqualFold(k, lastModifiedField) {
+ if strings.ToLower(k) == lastModifiedField {
metadata[k] = to.Ptr(strconv.FormatInt(mtime.UnixMilli(), 10))
found = true
break
@@ -560,7 +543,7 @@ func (fs *AzureBlobFs) GetDirSize(dirname string) (int, int64, error) {
metric.AZListObjectsCompleted(err)
return numFiles, size, err
}
- for _, blobItem := range resp.Segment.BlobItems {
+ for _, blobItem := range resp.ListBlobsFlatSegmentResponse.Segment.BlobItems {
if blobItem.Properties != nil {
contentType := util.GetStringFromPointer(blobItem.Properties.ContentType)
isDir := checkDirectoryMarkers(contentType, blobItem.Metadata)
@@ -628,7 +611,7 @@ func (fs *AzureBlobFs) Walk(root string, walkFn filepath.WalkFunc) error {
metric.AZListObjectsCompleted(err)
return err
}
- for _, blobItem := range resp.Segment.BlobItems {
+ for _, blobItem := range resp.ListBlobsFlatSegmentResponse.Segment.BlobItems {
name := util.GetStringFromPointer(blobItem.Name)
if fs.isEqual(name, prefix) {
continue
@@ -669,18 +652,18 @@ func (*AzureBlobFs) HasVirtualFolders() bool {
// ResolvePath returns the matching filesystem path for the specified sftp path
func (fs *AzureBlobFs) ResolvePath(virtualPath string) (string, error) {
if fs.mountPath != "" {
- if after, found := strings.CutPrefix(virtualPath, fs.mountPath); found {
- virtualPath = after
- }
+ virtualPath = strings.TrimPrefix(virtualPath, fs.mountPath)
+ }
+ if !path.IsAbs(virtualPath) {
+ virtualPath = path.Clean("/" + virtualPath)
}
- virtualPath = path.Clean("/" + virtualPath)
return fs.Join(fs.config.KeyPrefix, strings.TrimPrefix(virtualPath, "/")), nil
}
// CopyFile implements the FsFileCopier interface
-func (fs *AzureBlobFs) CopyFile(source, target string, srcInfo os.FileInfo) (int, int64, error) {
+func (fs *AzureBlobFs) CopyFile(source, target string, srcSize int64) (int, int64, error) {
numFiles := 1
- sizeDiff := srcInfo.Size()
+ sizeDiff := srcSize
attrs, err := fs.headObject(target)
if err == nil {
sizeDiff -= util.GetIntFromPointer(attrs.ContentLength)
@@ -690,7 +673,7 @@ func (fs *AzureBlobFs) CopyFile(source, target string, srcInfo os.FileInfo) (int
return 0, 0, err
}
}
- if err := fs.copyFileInternal(source, target, srcInfo, true); err != nil {
+ if err := fs.copyFileInternal(source, target); err != nil {
return 0, 0, err
}
return numFiles, sizeDiff, nil
@@ -773,13 +756,13 @@ func (fs *AzureBlobFs) setConfigDefaults() {
}
}
-func (fs *AzureBlobFs) copyFileInternal(source, target string, srcInfo os.FileInfo, updateModTime bool) error {
+func (fs *AzureBlobFs) copyFileInternal(source, target string) error {
ctx, cancelFn := context.WithDeadline(context.Background(), time.Now().Add(fs.ctxLongTimeout))
defer cancelFn()
srcBlob := fs.containerClient.NewBlockBlobClient(source)
dstBlob := fs.containerClient.NewBlockBlobClient(target)
- resp, err := dstBlob.StartCopyFromURL(ctx, srcBlob.URL(), fs.getCopyOptions(srcInfo, updateModTime))
+ resp, err := dstBlob.StartCopyFromURL(ctx, srcBlob.URL(), fs.getCopyOptions())
if err != nil {
metric.AZCopyObjectCompleted(err)
return err
@@ -812,13 +795,11 @@ func (fs *AzureBlobFs) copyFileInternal(source, target string, srcInfo os.FileIn
return nil
}
-func (fs *AzureBlobFs) renameInternal(source, target string, srcInfo os.FileInfo, recursion int,
- updateModTime bool,
-) (int, int64, error) {
+func (fs *AzureBlobFs) renameInternal(source, target string, fi os.FileInfo, recursion int) (int, int64, error) {
var numFiles int
var filesSize int64
- if srcInfo.IsDir() {
+ if fi.IsDir() {
if renameMode == 0 {
hasContents, err := fs.hasContents(source)
if err != nil {
@@ -832,7 +813,7 @@ func (fs *AzureBlobFs) renameInternal(source, target string, srcInfo os.FileInfo
return numFiles, filesSize, err
}
if renameMode == 1 {
- files, size, err := doRecursiveRename(fs, source, target, fs.renameInternal, recursion, updateModTime)
+ files, size, err := doRecursiveRename(fs, source, target, fs.renameInternal, recursion)
numFiles += files
filesSize += size
if err != nil {
@@ -840,13 +821,13 @@ func (fs *AzureBlobFs) renameInternal(source, target string, srcInfo os.FileInfo
}
}
} else {
- if err := fs.copyFileInternal(source, target, srcInfo, updateModTime); err != nil {
+ if err := fs.copyFileInternal(source, target); err != nil {
return numFiles, filesSize, err
}
numFiles++
- filesSize += srcInfo.Size()
+ filesSize += fi.Size()
}
- err := fs.skipNotExistErr(fs.Remove(source, srcInfo.IsDir()))
+ err := fs.skipNotExistErr(fs.Remove(source, fi.IsDir()))
return numFiles, filesSize, err
}
@@ -885,7 +866,7 @@ func (fs *AzureBlobFs) hasContents(name string) (bool, error) {
return result, err
}
- result = len(resp.Segment.BlobItems) > 0
+ result = len(resp.ListBlobsFlatSegmentResponse.Segment.BlobItems) > 0
}
metric.AZListObjectsCompleted(nil)
@@ -908,14 +889,15 @@ func (fs *AzureBlobFs) downloadPart(ctx context.Context, blockBlob *blockblob.Cl
if err != nil {
return err
}
- defer resp.Body.Close()
+ defer resp.DownloadResponse.Body.Close()
- _, err = io.ReadAtLeast(resp.Body, buf, int(count))
+ _, err = io.ReadAtLeast(resp.DownloadResponse.Body, buf, int(count))
if err != nil {
return err
}
- return writeAtFull(w, buf, writeOffset, int(count))
+ _, err = fs.writeAtFull(w, buf, writeOffset, int(count))
+ return err
}
func (fs *AzureBlobFs) handleMultipartDownload(ctx context.Context, blockBlob *blockblob.Client,
@@ -945,8 +927,6 @@ func (fs *AzureBlobFs) handleMultipartDownload(ctx context.Context, blockBlob *b
guard := make(chan struct{}, fs.config.DownloadConcurrency)
blockCtxTimeout := time.Duration(fs.config.DownloadPartSize/(1024*1024)) * time.Minute
pool := newBufferAllocator(int(partSize))
- defer pool.free()
-
finished := false
var wg sync.WaitGroup
var errOnce sync.Once
@@ -1000,6 +980,7 @@ func (fs *AzureBlobFs) handleMultipartDownload(ctx context.Context, blockBlob *b
wg.Wait()
close(guard)
+ pool.free()
return poolError
}
@@ -1014,8 +995,6 @@ func (fs *AzureBlobFs) handleMultipartUpload(ctx context.Context, reader io.Read
// sync.Pool seems to use a lot of memory so prefer our own, very simple, allocator
// we only need to recycle few byte slices
pool := newBufferAllocator(int(partSize))
- defer pool.free()
-
finished := false
var blocks []string
var wg sync.WaitGroup
@@ -1026,17 +1005,10 @@ func (fs *AzureBlobFs) handleMultipartUpload(ctx context.Context, reader io.Read
poolCtx, poolCancel := context.WithCancel(ctx)
defer poolCancel()
- finalizeFailedUpload := func(err error) {
- fsLog(fs, logger.LevelDebug, "multipart upload error: %+v", err)
- hasError.Store(true)
- poolError = fmt.Errorf("multipart upload error: %w", err)
- poolCancel()
- }
-
for part := 0; !finished; part++ {
buf := pool.getBuffer()
- n, err := readFill(reader, buf)
+ n, err := fs.readFill(reader, buf)
if err == io.EOF {
// read finished, if n > 0 we need to process the last data chunck
if n == 0 {
@@ -1046,10 +1018,8 @@ func (fs *AzureBlobFs) handleMultipartUpload(ctx context.Context, reader io.Read
finished = true
} else if err != nil {
pool.releaseBuffer(buf)
- errOnce.Do(func() {
- finalizeFailedUpload(err)
- })
- break
+ pool.free()
+ return err
}
// Block IDs are unique values to avoid issue if 2+ clients are uploading blocks
@@ -1057,10 +1027,8 @@ func (fs *AzureBlobFs) handleMultipartUpload(ctx context.Context, reader io.Read
generatedUUID, err := uuid.NewRandom()
if err != nil {
pool.releaseBuffer(buf)
- errOnce.Do(func() {
- finalizeFailedUpload(err)
- })
- break
+ pool.free()
+ return fmt.Errorf("unable to generate block ID: %w", err)
}
blockID := base64.StdEncoding.EncodeToString([]byte(generatedUUID.String()))
blocks = append(blocks, blockID)
@@ -1090,7 +1058,9 @@ func (fs *AzureBlobFs) handleMultipartUpload(ctx context.Context, reader io.Read
if err != nil {
errOnce.Do(func() {
fsLog(fs, logger.LevelDebug, "multipart upload error: %+v", err)
- finalizeFailedUpload(err)
+ hasError.Store(true)
+ poolError = fmt.Errorf("multipart upload error: %w", err)
+ poolCancel()
})
}
}(blockID, buf, n)
@@ -1098,6 +1068,7 @@ func (fs *AzureBlobFs) handleMultipartUpload(ctx context.Context, reader io.Read
wg.Wait()
close(guard)
+ pool.free()
if poolError != nil {
return poolError
@@ -1115,27 +1086,33 @@ func (fs *AzureBlobFs) handleMultipartUpload(ctx context.Context, reader io.Read
return err
}
-func (fs *AzureBlobFs) getCopyOptions(srcInfo os.FileInfo, updateModTime bool) *blob.StartCopyFromURLOptions {
+func (*AzureBlobFs) writeAtFull(w io.WriterAt, buf []byte, offset int64, count int) (int, error) {
+ written := 0
+ for written < count {
+ n, err := w.WriteAt(buf[written:count], offset+int64(written))
+ written += n
+ if err != nil {
+ return written, err
+ }
+ }
+ return written, nil
+}
+
+// copied from rclone
+func (*AzureBlobFs) readFill(r io.Reader, buf []byte) (n int, err error) {
+ var nn int
+ for n < len(buf) && err == nil {
+ nn, err = r.Read(buf[n:])
+ n += nn
+ }
+ return n, err
+}
+
+func (fs *AzureBlobFs) getCopyOptions() *blob.StartCopyFromURLOptions {
copyOptions := &blob.StartCopyFromURLOptions{}
if fs.config.AccessTier != "" {
copyOptions.Tier = (*blob.AccessTier)(&fs.config.AccessTier)
}
- if updateModTime {
- metadata := make(map[string]*string)
- for k, v := range getMetadata(srcInfo) {
- if v != "" {
- if strings.EqualFold(k, lastModifiedField) {
- metadata[k] = to.Ptr("0")
- } else {
- metadata[k] = to.Ptr(v)
- }
- }
- }
- if len(metadata) > 0 {
- copyOptions.Metadata = metadata
- }
- }
-
return copyOptions
}
@@ -1158,8 +1135,8 @@ func checkDirectoryMarkers(contentType string, metadata map[string]*string) bool
return true
}
for k, v := range metadata {
- if strings.EqualFold(k, azFolderKey) {
- return strings.EqualFold(util.GetStringFromPointer(v), "true")
+ if strings.ToLower(k) == azFolderKey {
+ return strings.ToLower(util.GetStringFromPointer(v)) == "true"
}
}
return false
@@ -1175,6 +1152,66 @@ func getAzContainerClientOptions() *container.ClientOptions {
}
}
+type bytesReaderWrapper struct {
+ *bytes.Reader
+}
+
+func (b *bytesReaderWrapper) Close() error {
+ return nil
+}
+
+type bufferAllocator struct {
+ sync.Mutex
+ available [][]byte
+ bufferSize int
+ finalized bool
+}
+
+func newBufferAllocator(size int) *bufferAllocator {
+ return &bufferAllocator{
+ bufferSize: size,
+ finalized: false,
+ }
+}
+
+func (b *bufferAllocator) getBuffer() []byte {
+ b.Lock()
+ defer b.Unlock()
+
+ if len(b.available) > 0 {
+ var result []byte
+
+ truncLength := len(b.available) - 1
+ result = b.available[truncLength]
+
+ b.available[truncLength] = nil
+ b.available = b.available[:truncLength]
+
+ return result
+ }
+
+ return make([]byte, b.bufferSize)
+}
+
+func (b *bufferAllocator) releaseBuffer(buf []byte) {
+ b.Lock()
+ defer b.Unlock()
+
+ if b.finalized || len(buf) != b.bufferSize {
+ return
+ }
+
+ b.available = append(b.available, buf)
+}
+
+func (b *bufferAllocator) free() {
+ b.Lock()
+ defer b.Unlock()
+
+ b.available = nil
+ b.finalized = true
+}
+
type azureBlobDirLister struct {
baseDirLister
paginator *runtime.Pager[container.ListBlobsHierarchyResponse]
@@ -1207,7 +1244,7 @@ func (l *azureBlobDirLister) Next(limit int) ([]os.FileInfo, error) {
return l.cache, err
}
- for _, blobPrefix := range page.Segment.BlobPrefixes {
+ for _, blobPrefix := range page.ListBlobsHierarchySegmentResponse.Segment.BlobPrefixes {
name := util.GetStringFromPointer(blobPrefix.Name)
// we don't support prefixes == "/" this will be sent if a key starts with "/"
if name == "" || name == "/" {
@@ -1222,12 +1259,11 @@ func (l *azureBlobDirLister) Next(limit int) ([]os.FileInfo, error) {
l.prefixes[strings.TrimSuffix(name, "/")] = true
}
- for _, blobItem := range page.Segment.BlobItems {
+ for _, blobItem := range page.ListBlobsHierarchySegmentResponse.Segment.BlobItems {
name := util.GetStringFromPointer(blobItem.Name)
name = strings.TrimPrefix(name, l.prefix)
size := int64(0)
isDir := false
- var metadata map[string]*string
modTime := time.Unix(0, 0)
if blobItem.Properties != nil {
size = util.GetIntFromPointer(blobItem.Properties.ContentLength)
@@ -1240,16 +1276,12 @@ func (l *azureBlobDirLister) Next(limit int) ([]os.FileInfo, error) {
continue
}
l.prefixes[name] = true
- } else {
- metadata = blobItem.Metadata
}
if val := getAzureLastModified(blobItem.Metadata); val > 0 {
modTime = util.GetTimeFromMsecSinceEpoch(val)
}
}
- info := NewFileInfo(name, isDir, size, modTime, false)
- info.setMetadataFromPointerVal(metadata)
- l.cache = append(l.cache, info)
+ l.cache = append(l.cache, NewFileInfo(name, isDir, size, modTime, false))
}
return l.returnFromCache(limit), nil
diff --git a/internal/vfs/azblobfs_disabled.go b/internal/vfs/azblobfs_disabled.go
index 35b83e2b..34639d3d 100644
--- a/internal/vfs/azblobfs_disabled.go
+++ b/internal/vfs/azblobfs_disabled.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build noazblob
+// +build noazblob
package vfs
diff --git a/internal/vfs/cryptfs.go b/internal/vfs/cryptfs.go
index 8e76da30..3f20fb37 100644
--- a/internal/vfs/cryptfs.go
+++ b/internal/vfs/cryptfs.go
@@ -24,6 +24,7 @@ import (
"net/http"
"os"
+ "github.com/eikenb/pipeat"
"github.com/minio/sio"
"golang.org/x/crypto/hkdf"
@@ -59,8 +60,8 @@ func NewCryptFs(connectionID, rootDir, mountPath string, config CryptFsConfig) (
connectionID: connectionID,
rootDir: rootDir,
mountPath: getMountPath(mountPath),
- readBufferSize: config.ReadBufferSize * 1024 * 1024,
- writeBufferSize: config.WriteBufferSize * 1024 * 1024,
+ readBufferSize: config.OSFsConfig.ReadBufferSize * 1024 * 1024,
+ writeBufferSize: config.OSFsConfig.WriteBufferSize * 1024 * 1024,
},
masterKey: []byte(config.Passphrase.GetPayload()),
}
@@ -88,7 +89,7 @@ func (fs *CryptFs) Open(name string, offset int64) (File, PipeReader, func(), er
f.Close()
return nil, nil, nil, err
}
- r, w, err := createPipeFn(fs.localTempDir, 0)
+ r, w, err := pipeat.PipeInDir(fs.localTempDir)
if err != nil {
f.Close()
return nil, nil, nil, err
@@ -174,7 +175,7 @@ func (fs *CryptFs) Create(name string, _, _ int) (File, PipeWriter, func(), erro
f.Close()
return nil, nil, nil, err
}
- r, w, err := createPipeFn(fs.localTempDir, 0)
+ r, w, err := pipeat.PipeInDir(fs.localTempDir)
if err != nil {
f.Close()
return nil, nil, nil, err
diff --git a/internal/vfs/fileinfo.go b/internal/vfs/fileinfo.go
index c27fbf79..a6079443 100644
--- a/internal/vfs/fileinfo.go
+++ b/internal/vfs/fileinfo.go
@@ -18,8 +18,6 @@ import (
"os"
"path"
"time"
-
- "github.com/drakkan/sftpgo/v2/internal/util"
)
// FileInfo implements os.FileInfo for a Cloud Storage file.
@@ -28,7 +26,6 @@ type FileInfo struct {
sizeInBytes int64
modTime time.Time
mode os.FileMode
- metadata map[string]string
}
// NewFileInfo creates file info.
@@ -82,36 +79,5 @@ func (fi *FileInfo) SetMode(mode os.FileMode) {
// Sys provides the underlying data source (can return nil)
func (fi *FileInfo) Sys() any {
- return fi.metadata
-}
-
-func (fi *FileInfo) setMetadata(value map[string]string) {
- fi.metadata = value
-}
-
-func (fi *FileInfo) setMetadataFromPointerVal(value map[string]*string) {
- if len(value) == 0 {
- fi.metadata = nil
- return
- }
-
- fi.metadata = map[string]string{}
- for k, v := range value {
- val := util.GetStringFromPointer(v)
- if val != "" {
- fi.metadata[k] = val
- }
- }
-}
-
-func getMetadata(fi os.FileInfo) map[string]string {
- if fi.Sys() == nil {
- return nil
- }
- if val, ok := fi.Sys().(map[string]string); ok {
- if len(val) > 0 {
- return val
- }
- }
return nil
}
diff --git a/internal/vfs/filesystem.go b/internal/vfs/filesystem.go
index 59ce47dd..95b3df40 100644
--- a/internal/vfs/filesystem.go
+++ b/internal/vfs/filesystem.go
@@ -20,7 +20,6 @@ import (
"github.com/sftpgo/sdk"
"github.com/drakkan/sftpgo/v2/internal/kms"
- "github.com/drakkan/sftpgo/v2/internal/util"
)
// Filesystem defines filesystem details
@@ -39,7 +38,6 @@ type Filesystem struct {
// SetEmptySecrets sets the secrets to empty
func (f *Filesystem) SetEmptySecrets() {
f.S3Config.AccessSecret = kms.NewEmptySecret()
- f.S3Config.SSECustomerKey = kms.NewEmptySecret()
f.GCSConfig.Credentials = kms.NewEmptySecret()
f.AzBlobConfig.AccountKey = kms.NewEmptySecret()
f.AzBlobConfig.SASURL = kms.NewEmptySecret()
@@ -56,9 +54,6 @@ func (f *Filesystem) SetEmptySecretsIfNil() {
if f.S3Config.AccessSecret == nil {
f.S3Config.AccessSecret = kms.NewEmptySecret()
}
- if f.S3Config.SSECustomerKey == nil {
- f.S3Config.SSECustomerKey = kms.NewEmptySecret()
- }
if f.GCSConfig.Credentials == nil {
f.GCSConfig.Credentials = kms.NewEmptySecret()
}
@@ -95,9 +90,6 @@ func (f *Filesystem) SetNilSecretsIfEmpty() {
if f.S3Config.AccessSecret != nil && f.S3Config.AccessSecret.IsEmpty() {
f.S3Config.AccessSecret = nil
}
- if f.S3Config.SSECustomerKey != nil && f.S3Config.SSECustomerKey.IsEmpty() {
- f.S3Config.SSECustomerKey = nil
- }
if f.GCSConfig.Credentials != nil && f.GCSConfig.Credentials.IsEmpty() {
f.GCSConfig.Credentials = nil
}
@@ -240,7 +232,8 @@ func (f *Filesystem) Validate(additionalData string) error {
f.CryptConfig = CryptFsConfig{}
f.SFTPConfig = SFTPFsConfig{}
return nil
- case sdk.LocalFilesystemProvider:
+ default:
+ f.Provider = sdk.LocalFilesystemProvider
f.S3Config = S3FsConfig{}
f.GCSConfig = GCSFsConfig{}
f.AzBlobConfig = AzBlobFsConfig{}
@@ -248,11 +241,6 @@ func (f *Filesystem) Validate(additionalData string) error {
f.SFTPConfig = SFTPFsConfig{}
f.HTTPConfig = HTTPFsConfig{}
return validateOSFsConfig(&f.OSConfig)
- default:
- return util.NewI18nError(
- util.NewValidationError("invalid filesystem provider"),
- util.I18nErrorFsValidation,
- )
}
}
@@ -261,9 +249,6 @@ func (f *Filesystem) HasRedactedSecret() bool {
// TODO move vfs specific code into each *FsConfig struct
switch f.Provider {
case sdk.S3FilesystemProvider:
- if f.S3Config.SSECustomerKey.IsRedacted() {
- return true
- }
return f.S3Config.AccessSecret.IsRedacted()
case sdk.GCSFilesystemProvider:
return f.GCSConfig.Credentials.IsRedacted()
@@ -338,8 +323,7 @@ func (f *Filesystem) GetACopy() Filesystem {
ForcePathStyle: f.S3Config.ForcePathStyle,
SkipTLSVerify: f.S3Config.SkipTLSVerify,
},
- AccessSecret: f.S3Config.AccessSecret.Clone(),
- SSECustomerKey: f.S3Config.SSECustomerKey.Clone(),
+ AccessSecret: f.S3Config.AccessSecret.Clone(),
},
GCSConfig: GCSFsConfig{
BaseGCSFsConfig: sdk.BaseGCSFsConfig{
diff --git a/internal/vfs/folder.go b/internal/vfs/folder.go
index 5fcee524..b85d82ff 100644
--- a/internal/vfs/folder.go
+++ b/internal/vfs/folder.go
@@ -107,24 +107,18 @@ func (v *BaseVirtualFolder) HasRedactedSecret() bool {
// hasPathPlaceholder returns true if the folder has a path placeholder
func (v *BaseVirtualFolder) hasPathPlaceholder() bool {
- placeholders := []string{"%username%", "%role%"}
- var config string
+ placeholder := "%username%"
switch v.FsConfig.Provider {
case sdk.S3FilesystemProvider:
- config = v.FsConfig.S3Config.KeyPrefix
+ return strings.Contains(v.FsConfig.S3Config.KeyPrefix, placeholder)
case sdk.GCSFilesystemProvider:
- config = v.FsConfig.GCSConfig.KeyPrefix
+ return strings.Contains(v.FsConfig.GCSConfig.KeyPrefix, placeholder)
case sdk.AzureBlobFilesystemProvider:
- config = v.FsConfig.AzBlobConfig.KeyPrefix
+ return strings.Contains(v.FsConfig.AzBlobConfig.KeyPrefix, placeholder)
case sdk.SFTPFilesystemProvider:
- config = v.FsConfig.SFTPConfig.Prefix
+ return strings.Contains(v.FsConfig.SFTPConfig.Prefix, placeholder)
case sdk.LocalFilesystemProvider, sdk.CryptedFilesystemProvider:
- config = v.MappedPath
- }
- for _, placeholder := range placeholders {
- if strings.Contains(config, placeholder) {
- return true
- }
+ return strings.Contains(v.MappedPath, placeholder)
}
return false
}
diff --git a/internal/vfs/gcsfs.go b/internal/vfs/gcsfs.go
index b3cfa6c2..613e67ff 100644
--- a/internal/vfs/gcsfs.go
+++ b/internal/vfs/gcsfs.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build !nogcs
+// +build !nogcs
package vfs
@@ -31,6 +32,7 @@ import (
"time"
"cloud.google.com/go/storage"
+ "github.com/eikenb/pipeat"
"github.com/pkg/sftp"
"github.com/rs/xid"
"google.golang.org/api/googleapi"
@@ -87,20 +89,13 @@ func NewGCSFs(connectionID, localTempDir, mountPath string, config GCSFsConfig)
}
ctx := context.Background()
if fs.config.AutomaticCredentials > 0 {
- fs.svc, err = storage.NewClient(ctx,
- storage.WithJSONReads(),
- option.WithUserAgent(version.GetVersionHash()),
- )
+ fs.svc, err = storage.NewClient(ctx)
} else {
err = fs.config.Credentials.TryDecrypt()
if err != nil {
return fs, err
}
- fs.svc, err = storage.NewClient(ctx,
- storage.WithJSONReads(),
- option.WithUserAgent(version.GetVersionHash()),
- option.WithAuthCredentialsJSON(option.ServiceAccount, []byte(fs.config.Credentials.GetPayload())),
- )
+ fs.svc, err = storage.NewClient(ctx, option.WithCredentialsJSON([]byte(fs.config.Credentials.GetPayload())))
}
return fs, err
}
@@ -133,7 +128,7 @@ func (fs *GCSFs) Lstat(name string) (os.FileInfo, error) {
// Open opens the named file for reading
func (fs *GCSFs) Open(name string, offset int64) (File, PipeReader, func(), error) {
- r, w, err := createPipeFn(fs.localTempDir, 0)
+ r, w, err := pipeat.PipeInDir(fs.localTempDir)
if err != nil {
return nil, nil, nil, err
}
@@ -181,11 +176,7 @@ func (fs *GCSFs) Create(name string, flag, checks int) (File, PipeWriter, func()
return nil, nil, nil, err
}
}
- chunkSize := googleapi.DefaultUploadChunkSize
- if fs.config.UploadPartSize > 0 {
- chunkSize = int(fs.config.UploadPartSize) * 1024 * 1024
- }
- r, w, err := createPipeFn(fs.localTempDir, int64(chunkSize+1024*1024))
+ r, w, err := pipeat.PipeInDir(fs.localTempDir)
if err != nil {
return nil, nil, nil, err
}
@@ -229,7 +220,9 @@ func (fs *GCSFs) Create(name string, flag, checks int) (File, PipeWriter, func()
objectWriter = obj.NewWriter(ctx)
}
- objectWriter.ChunkSize = chunkSize
+ if fs.config.UploadPartSize > 0 {
+ objectWriter.ChunkSize = int(fs.config.UploadPartSize) * 1024 * 1024
+ }
if fs.config.UploadPartMaxTime > 0 {
objectWriter.ChunkRetryDeadline = time.Duration(fs.config.UploadPartMaxTime) * time.Second
}
@@ -262,21 +255,19 @@ func (fs *GCSFs) Create(name string, flag, checks int) (File, PipeWriter, func()
}
// Rename renames (moves) source to target.
-func (fs *GCSFs) Rename(source, target string, checks int) (int, int64, error) {
+func (fs *GCSFs) Rename(source, target string) (int, int64, error) {
if source == target {
return -1, -1, nil
}
- if checks&CheckParentDir != 0 {
- _, err := fs.Stat(path.Dir(target))
- if err != nil {
- return -1, -1, err
- }
+ _, err := fs.Stat(path.Dir(target))
+ if err != nil {
+ return -1, -1, err
}
fi, err := fs.getObjectStat(source)
if err != nil {
return -1, -1, err
}
- return fs.renameInternal(source, target, fi, 0, checks&CheckUpdateModTime != 0)
+ return fs.renameInternal(source, target, fi, 0)
}
// Remove removes the named file or (empty) directory.
@@ -428,12 +419,11 @@ func (*GCSFs) IsNotExist(err error) bool {
if err == nil {
return false
}
- if errors.Is(err, storage.ErrObjectNotExist) {
+ if err == storage.ErrObjectNotExist || err == storage.ErrBucketNotExist {
return true
}
- var apiErr *googleapi.Error
- if errors.As(err, &apiErr) {
- if apiErr.Code == http.StatusNotFound {
+ if e, ok := err.(*googleapi.Error); ok {
+ if e.Code == http.StatusNotFound {
return true
}
}
@@ -446,9 +436,8 @@ func (*GCSFs) IsPermission(err error) bool {
if err == nil {
return false
}
- var apiErr *googleapi.Error
- if errors.As(err, &apiErr) {
- if apiErr.Code == http.StatusForbidden || apiErr.Code == http.StatusUnauthorized {
+ if e, ok := err.(*googleapi.Error); ok {
+ if e.Code == http.StatusForbidden || e.Code == http.StatusUnauthorized {
return true
}
}
@@ -631,25 +620,25 @@ func (*GCSFs) Join(elem ...string) string {
}
// HasVirtualFolders returns true if folders are emulated
-func (*GCSFs) HasVirtualFolders() bool {
+func (GCSFs) HasVirtualFolders() bool {
return true
}
// ResolvePath returns the matching filesystem path for the specified virtual path
func (fs *GCSFs) ResolvePath(virtualPath string) (string, error) {
if fs.mountPath != "" {
- if after, found := strings.CutPrefix(virtualPath, fs.mountPath); found {
- virtualPath = after
- }
+ virtualPath = strings.TrimPrefix(virtualPath, fs.mountPath)
+ }
+ if !path.IsAbs(virtualPath) {
+ virtualPath = path.Clean("/" + virtualPath)
}
- virtualPath = path.Clean("/" + virtualPath)
return fs.Join(fs.config.KeyPrefix, strings.TrimPrefix(virtualPath, "/")), nil
}
// CopyFile implements the FsFileCopier interface
-func (fs *GCSFs) CopyFile(source, target string, srcInfo os.FileInfo) (int, int64, error) {
+func (fs *GCSFs) CopyFile(source, target string, srcSize int64) (int, int64, error) {
numFiles := 1
- sizeDiff := srcInfo.Size()
+ sizeDiff := srcSize
var conditions *storage.Conditions
attrs, err := fs.headObject(target)
if err == nil {
@@ -662,7 +651,7 @@ func (fs *GCSFs) CopyFile(source, target string, srcInfo os.FileInfo) (int, int6
}
conditions = &storage.Conditions{DoesNotExist: true}
}
- if err := fs.copyFileInternal(source, target, conditions, srcInfo, true); err != nil {
+ if err := fs.copyFileInternal(source, target, conditions); err != nil {
return 0, 0, err
}
return numFiles, sizeDiff, nil
@@ -690,11 +679,7 @@ func (fs *GCSFs) getObjectStat(name string) (os.FileInfo, error) {
objectModTime = util.GetTimeFromMsecSinceEpoch(val)
}
isDir := attrs.ContentType == dirMimeType || strings.HasSuffix(attrs.Name, "/")
- info := NewFileInfo(name, isDir, objSize, objectModTime, false)
- if !isDir {
- info.setMetadata(attrs.Metadata)
- }
- return info, nil
+ return NewFileInfo(name, isDir, objSize, objectModTime, false), nil
}
if !fs.IsNotExist(err) {
return nil, err
@@ -727,10 +712,10 @@ func (fs *GCSFs) setWriterAttrs(objectWriter *storage.Writer, flag int, name str
contentType = mime.TypeByExtension(path.Ext(name))
}
if contentType != "" {
- objectWriter.ContentType = contentType
+ objectWriter.ObjectAttrs.ContentType = contentType
}
if fs.config.StorageClass != "" {
- objectWriter.StorageClass = fs.config.StorageClass
+ objectWriter.ObjectAttrs.StorageClass = fs.config.StorageClass
}
if fs.config.ACL != "" {
objectWriter.PredefinedACL = fs.config.ACL
@@ -764,9 +749,7 @@ func (fs *GCSFs) composeObjects(ctx context.Context, dst, partialObject *storage
return err
}
-func (fs *GCSFs) copyFileInternal(source, target string, conditions *storage.Conditions,
- srcInfo os.FileInfo, updateModTime bool,
-) error {
+func (fs *GCSFs) copyFileInternal(source, target string, conditions *storage.Conditions) error {
src := fs.svc.Bucket(fs.config.Bucket).Object(source)
dst := fs.svc.Bucket(fs.config.Bucket).Object(target)
if conditions != nil {
@@ -797,25 +780,16 @@ func (fs *GCSFs) copyFileInternal(source, target string, conditions *storage.Con
if contentType != "" {
copier.ContentType = contentType
}
- metadata := getMetadata(srcInfo)
- if updateModTime && len(metadata) > 0 {
- delete(metadata, lastModifiedField)
- }
- if len(metadata) > 0 {
- copier.Metadata = metadata
- }
_, err := copier.Run(ctx)
metric.GCSCopyObjectCompleted(err)
return err
}
-func (fs *GCSFs) renameInternal(source, target string, srcInfo os.FileInfo, recursion int,
- updateModTime bool,
-) (int, int64, error) {
+func (fs *GCSFs) renameInternal(source, target string, fi os.FileInfo, recursion int) (int, int64, error) {
var numFiles int
var filesSize int64
- if srcInfo.IsDir() {
+ if fi.IsDir() {
if renameMode == 0 {
hasContents, err := fs.hasContents(source)
if err != nil {
@@ -829,7 +803,7 @@ func (fs *GCSFs) renameInternal(source, target string, srcInfo os.FileInfo, recu
return numFiles, filesSize, err
}
if renameMode == 1 {
- files, size, err := doRecursiveRename(fs, source, target, fs.renameInternal, recursion, updateModTime)
+ files, size, err := doRecursiveRename(fs, source, target, fs.renameInternal, recursion)
numFiles += files
filesSize += size
if err != nil {
@@ -837,13 +811,13 @@ func (fs *GCSFs) renameInternal(source, target string, srcInfo os.FileInfo, recu
}
}
} else {
- if err := fs.copyFileInternal(source, target, nil, srcInfo, updateModTime); err != nil {
+ if err := fs.copyFileInternal(source, target, nil); err != nil {
return numFiles, filesSize, err
}
numFiles++
- filesSize += srcInfo.Size()
+ filesSize += fi.Size()
}
- err := fs.Remove(source, srcInfo.IsDir())
+ err := fs.Remove(source, fi.IsDir())
if fs.IsNotExist(err) {
err = nil
}
@@ -1028,9 +1002,7 @@ func (l *gcsDirLister) Next(limit int) ([]os.FileInfo, error) {
if val := getLastModified(attrs.Metadata); val > 0 {
modTime = util.GetTimeFromMsecSinceEpoch(val)
}
- info := NewFileInfo(name, isDir, attrs.Size, modTime, false)
- info.setMetadata(attrs.Metadata)
- l.cache = append(l.cache, info)
+ l.cache = append(l.cache, NewFileInfo(name, isDir, attrs.Size, modTime, false))
}
}
diff --git a/internal/vfs/gcsfs_disabled.go b/internal/vfs/gcsfs_disabled.go
index cac24e60..edc0143f 100644
--- a/internal/vfs/gcsfs_disabled.go
+++ b/internal/vfs/gcsfs_disabled.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build nogcs
+// +build nogcs
package vfs
diff --git a/internal/vfs/httpfs.go b/internal/vfs/httpfs.go
index 76aa940c..331f72dc 100644
--- a/internal/vfs/httpfs.go
+++ b/internal/vfs/httpfs.go
@@ -32,6 +32,7 @@ import (
"strings"
"time"
+ "github.com/eikenb/pipeat"
"github.com/pkg/sftp"
"github.com/sftpgo/sdk"
@@ -316,7 +317,7 @@ func (fs *HTTPFs) Lstat(name string) (os.FileInfo, error) {
// Open opens the named file for reading
func (fs *HTTPFs) Open(name string, offset int64) (File, PipeReader, func(), error) {
- r, w, err := createPipeFn(fs.localTempDir, 0)
+ r, w, err := pipeat.PipeInDir(fs.localTempDir)
if err != nil {
return nil, nil, nil, err
}
@@ -350,7 +351,7 @@ func (fs *HTTPFs) Open(name string, offset int64) (File, PipeReader, func(), err
// Create creates or opens the named file for writing
func (fs *HTTPFs) Create(name string, flag, checks int) (File, PipeWriter, func(), error) {
- r, w, err := createPipeFn(fs.localTempDir, 0)
+ r, w, err := pipeat.PipeInDir(fs.localTempDir)
if err != nil {
return nil, nil, nil, err
}
@@ -383,7 +384,7 @@ func (fs *HTTPFs) Create(name string, flag, checks int) (File, PipeWriter, func(
}
// Rename renames (moves) source to target.
-func (fs *HTTPFs) Rename(source, target string, checks int) (int, int64, error) {
+func (fs *HTTPFs) Rename(source, target string) (int, int64, error) {
if source == target {
return -1, -1, nil
}
@@ -396,9 +397,6 @@ func (fs *HTTPFs) Rename(source, target string, checks int) (int, int64, error)
return -1, -1, err
}
defer resp.Body.Close()
- if checks&CheckUpdateModTime != 0 {
- fs.Chtimes(target, time.Now(), time.Now(), false) //nolint:errcheck
- }
return -1, -1, nil
}
@@ -638,11 +636,12 @@ func (*HTTPFs) HasVirtualFolders() bool {
// ResolvePath returns the matching filesystem path for the specified virtual path
func (fs *HTTPFs) ResolvePath(virtualPath string) (string, error) {
if fs.mountPath != "" {
- if after, found := strings.CutPrefix(virtualPath, fs.mountPath); found {
- virtualPath = after
- }
+ virtualPath = strings.TrimPrefix(virtualPath, fs.mountPath)
}
- return path.Clean("/" + virtualPath), nil
+ if !path.IsAbs(virtualPath) {
+ virtualPath = path.Clean("/" + virtualPath)
+ }
+ return virtualPath, nil
}
// GetMimeType returns the content type
diff --git a/internal/vfs/osfs.go b/internal/vfs/osfs.go
index 1f0a502f..affc44f4 100644
--- a/internal/vfs/osfs.go
+++ b/internal/vfs/osfs.go
@@ -24,16 +24,17 @@ import (
"os"
"path"
"path/filepath"
- "slices"
"strings"
"time"
+ "github.com/eikenb/pipeat"
fscopy "github.com/otiai10/copy"
"github.com/pkg/sftp"
"github.com/rs/xid"
"github.com/sftpgo/sdk"
"github.com/drakkan/sftpgo/v2/internal/logger"
+ "github.com/drakkan/sftpgo/v2/internal/util"
)
const (
@@ -115,7 +116,7 @@ func (fs *OsFs) Open(name string, offset int64) (File, PipeReader, func(), error
if fs.readBufferSize <= 0 {
return f, nil, nil, err
}
- r, w, err := createPipeFn(fs.localTempDir, 0)
+ r, w, err := pipeat.PipeInDir(fs.localTempDir)
if err != nil {
f.Close()
return nil, nil, nil, err
@@ -148,7 +149,7 @@ func (fs *OsFs) Create(name string, flag, _ int) (File, PipeWriter, func(), erro
if err != nil {
return nil, nil, nil, err
}
- r, w, err := createPipeFn(fs.localTempDir, 0)
+ r, w, err := pipeat.PipeInDir(fs.localTempDir)
if err != nil {
f.Close()
return nil, nil, nil, err
@@ -175,7 +176,7 @@ func (fs *OsFs) Create(name string, flag, _ int) (File, PipeWriter, func(), erro
}
// Rename renames (moves) source to target
-func (fs *OsFs) Rename(source, target string, checks int) (int, int64, error) {
+func (fs *OsFs) Rename(source, target string) (int, int64, error) {
if source == target {
return -1, -1, nil
}
@@ -198,15 +199,9 @@ func (fs *OsFs) Rename(source, target string, checks int) (int, int64, error) {
fsLog(fs, logger.LevelError, "cross device copy error: %v", err)
return -1, -1, err
}
- if checks&CheckUpdateModTime != 0 {
- fs.Chtimes(target, time.Now(), time.Now(), false) //nolint:errcheck
- }
err = os.RemoveAll(source)
return -1, -1, err
}
- if checks&CheckUpdateModTime != 0 && err == nil {
- fs.Chtimes(target, time.Now(), time.Now(), false) //nolint:errcheck
- }
return -1, -1, err
}
@@ -357,16 +352,12 @@ func (fs *OsFs) GetRelativePath(name string) string {
}
rel, err := filepath.Rel(fs.rootDir, filepath.Clean(name))
if err != nil {
- return virtualPath
+ return ""
}
- rel = filepath.ToSlash(rel)
- if rel == ".." || strings.HasPrefix(rel, "../") {
- return virtualPath
- }
- if rel == "." {
+ if rel == "." || strings.HasPrefix(rel, "..") {
rel = ""
}
- return path.Join(virtualPath, rel)
+ return path.Join(virtualPath, filepath.ToSlash(rel))
}
// Walk walks the file tree rooted at root, calling walkFn for each file or
@@ -386,11 +377,8 @@ func (fs *OsFs) ResolvePath(virtualPath string) (string, error) {
return "", fmt.Errorf("invalid root path %q", fs.rootDir)
}
if fs.mountPath != "" {
- if after, found := strings.CutPrefix(virtualPath, fs.mountPath); found {
- virtualPath = after
- }
+ virtualPath = strings.TrimPrefix(virtualPath, fs.mountPath)
}
- virtualPath = path.Clean("/" + virtualPath)
r := filepath.Clean(filepath.Join(fs.rootDir, virtualPath))
p, err := filepath.EvalSymlinks(r)
if isInvalidNameError(err) {
@@ -487,7 +475,7 @@ func (fs *OsFs) findNonexistentDirs(filePath string) ([]string, error) {
for fs.IsNotExist(err) {
results = append(results, parent)
parent = filepath.Dir(parent)
- if slices.Contains(results, parent) {
+ if util.Contains(results, parent) {
break
}
_, err = os.Stat(parent)
diff --git a/internal/vfs/s3fs.go b/internal/vfs/s3fs.go
index f0e9c093..b74d2877 100644
--- a/internal/vfs/s3fs.go
+++ b/internal/vfs/s3fs.go
@@ -13,16 +13,13 @@
// along with this program. If not, see .
//go:build !nos3
+// +build !nos3
package vfs
import (
- "bytes"
"context"
- "crypto/md5"
- "crypto/sha256"
"crypto/tls"
- "encoding/base64"
"errors"
"fmt"
"io"
@@ -33,7 +30,6 @@ import (
"os"
"path"
"path/filepath"
- "slices"
"sort"
"strings"
"sync"
@@ -45,9 +41,11 @@ import (
"github.com/aws/aws-sdk-go-v2/config"
"github.com/aws/aws-sdk-go-v2/credentials"
"github.com/aws/aws-sdk-go-v2/credentials/stscreds"
+ "github.com/aws/aws-sdk-go-v2/feature/s3/manager"
"github.com/aws/aws-sdk-go-v2/service/s3"
"github.com/aws/aws-sdk-go-v2/service/s3/types"
"github.com/aws/aws-sdk-go-v2/service/sts"
+ "github.com/eikenb/pipeat"
"github.com/pkg/sftp"
"github.com/drakkan/sftpgo/v2/internal/logger"
@@ -73,13 +71,10 @@ type S3Fs struct {
connectionID string
localTempDir string
// if not empty this fs is mouted as virtual folder in the specified path
- mountPath string
- config *S3FsConfig
- svc *s3.Client
- ctxTimeout time.Duration
- sseCustomerKey string
- sseCustomerKeyMD5 string
- sseCustomerAlgo string
+ mountPath string
+ config *S3FsConfig
+ svc *s3.Client
+ ctxTimeout time.Duration
}
func init() {
@@ -125,23 +120,6 @@ func NewS3Fs(connectionID, localTempDir, mountPath string, s3Config S3FsConfig)
fs.config.SessionToken),
)
}
- if !fs.config.SSECustomerKey.IsEmpty() {
- if err := fs.config.SSECustomerKey.TryDecrypt(); err != nil {
- return fs, err
- }
- key := fs.config.SSECustomerKey.GetPayload()
- if len(key) == 32 {
- md5sumBinary := md5.Sum([]byte(key))
- fs.sseCustomerKey = base64.StdEncoding.EncodeToString([]byte(key))
- fs.sseCustomerKeyMD5 = base64.StdEncoding.EncodeToString(md5sumBinary[:])
- } else {
- keyHash := sha256.Sum256([]byte(key))
- md5sumBinary := md5.Sum(keyHash[:])
- fs.sseCustomerKey = base64.StdEncoding.EncodeToString(keyHash[:])
- fs.sseCustomerKeyMD5 = base64.StdEncoding.EncodeToString(md5sumBinary[:])
- }
- fs.sseCustomerAlgo = "AES256"
- }
fs.setConfigDefaults()
@@ -153,8 +131,6 @@ func NewS3Fs(connectionID, localTempDir, mountPath string, s3Config S3FsConfig)
fs.svc = s3.NewFromConfig(awsConfig, func(o *s3.Options) {
o.AppID = version.GetVersionHash()
o.UsePathStyle = fs.config.ForcePathStyle
- o.RequestChecksumCalculation = aws.RequestChecksumCalculationWhenRequired
- o.ResponseChecksumValidation = aws.ResponseChecksumValidationWhenRequired
if fs.config.Endpoint != "" {
o.BaseEndpoint = aws.String(fs.config.Endpoint)
}
@@ -185,13 +161,12 @@ func (fs *S3Fs) Stat(name string) (os.FileInfo, error) {
if err == nil {
// Some S3 providers (like SeaweedFS) remove the trailing '/' from object keys.
// So we check some common content types to detect if this is a "directory".
- isDir := slices.Contains(s3DirMimeTypes, util.GetStringFromPointer(obj.ContentType))
+ isDir := util.Contains(s3DirMimeTypes, util.GetStringFromPointer(obj.ContentType))
if util.GetIntFromPointer(obj.ContentLength) == 0 && !isDir {
_, err = fs.headObject(name + "/")
isDir = err == nil
}
- info := NewFileInfo(name, isDir, util.GetIntFromPointer(obj.ContentLength), util.GetTimeFromPointer(obj.LastModified), false)
- return info, nil
+ return NewFileInfo(name, isDir, util.GetIntFromPointer(obj.ContentLength), util.GetTimeFromPointer(obj.LastModified), false), nil
}
if !fs.IsNotExist(err) {
return result, err
@@ -226,29 +201,50 @@ func (fs *S3Fs) Lstat(name string) (os.FileInfo, error) {
// Open opens the named file for reading
func (fs *S3Fs) Open(name string, offset int64) (File, PipeReader, func(), error) {
- attrs, err := fs.headObject(name)
- if err != nil {
- return nil, nil, nil, err
- }
- r, w, err := createPipeFn(fs.localTempDir, fs.config.DownloadPartSize*int64(fs.config.DownloadConcurrency)+1)
+ r, w, err := pipeat.PipeInDir(fs.localTempDir)
if err != nil {
return nil, nil, nil, err
}
p := NewPipeReader(r)
if readMetadata > 0 {
+ attrs, err := fs.headObject(name)
+ if err != nil {
+ r.Close()
+ w.Close()
+ return nil, nil, nil, err
+ }
p.setMetadata(attrs.Metadata)
}
+
ctx, cancelFn := context.WithCancel(context.Background())
+ downloader := manager.NewDownloader(fs.svc, func(d *manager.Downloader) {
+ d.Concurrency = fs.config.DownloadConcurrency
+ d.PartSize = fs.config.DownloadPartSize
+ if offset == 0 && fs.config.DownloadPartMaxTime > 0 {
+ d.ClientOptions = append(d.ClientOptions, func(o *s3.Options) {
+ o.HTTPClient = getAWSHTTPClient(fs.config.DownloadPartMaxTime, 100*time.Millisecond,
+ fs.config.SkipTLSVerify)
+ })
+ }
+ })
+
+ var streamRange *string
+ if offset > 0 {
+ streamRange = aws.String(fmt.Sprintf("bytes=%v-", offset))
+ }
go func() {
defer cancelFn()
- err := fs.handleDownload(ctx, name, offset, w, attrs)
+ n, err := downloader.Download(ctx, w, &s3.GetObjectInput{
+ Bucket: aws.String(fs.config.Bucket),
+ Key: aws.String(name),
+ Range: streamRange,
+ })
w.CloseWithError(err) //nolint:errcheck
- fsLog(fs, logger.LevelDebug, "download completed, path: %q size: %d, err: %+v", name, w.GetWrittenBytes(), err)
- metric.S3TransferCompleted(w.GetWrittenBytes(), 1, err)
+ fsLog(fs, logger.LevelDebug, "download completed, path: %q size: %v, err: %+v", name, n, err)
+ metric.S3TransferCompleted(n, 1, err)
}()
-
return nil, p, cancelFn, nil
}
@@ -260,7 +256,7 @@ func (fs *S3Fs) Create(name string, flag, checks int) (File, PipeWriter, func(),
return nil, nil, nil, err
}
}
- r, w, err := createPipeFn(fs.localTempDir, fs.config.UploadPartSize+1024*1024)
+ r, w, err := pipeat.PipeInDir(fs.localTempDir)
if err != nil {
return nil, nil, nil, err
}
@@ -271,6 +267,16 @@ func (fs *S3Fs) Create(name string, flag, checks int) (File, PipeWriter, func(),
p = NewPipeWriter(w)
}
ctx, cancelFn := context.WithCancel(context.Background())
+ uploader := manager.NewUploader(fs.svc, func(u *manager.Uploader) {
+ u.Concurrency = fs.config.UploadConcurrency
+ u.PartSize = fs.config.UploadPartSize
+ if fs.config.UploadPartMaxTime > 0 {
+ u.ClientOptions = append(u.ClientOptions, func(o *s3.Options) {
+ o.HTTPClient = getAWSHTTPClient(fs.config.UploadPartMaxTime, 100*time.Millisecond,
+ fs.config.SkipTLSVerify)
+ })
+ }
+ })
go func() {
defer cancelFn()
@@ -281,7 +287,14 @@ func (fs *S3Fs) Create(name string, flag, checks int) (File, PipeWriter, func(),
} else {
contentType = mime.TypeByExtension(path.Ext(name))
}
- err := fs.handleUpload(ctx, r, name, contentType)
+ _, err := uploader.Upload(ctx, &s3.PutObjectInput{
+ Bucket: aws.String(fs.config.Bucket),
+ Key: aws.String(name),
+ Body: r,
+ ACL: types.ObjectCannedACL(fs.config.ACL),
+ StorageClass: types.StorageClass(fs.config.StorageClass),
+ ContentType: util.NilIfEmpty(contentType),
+ })
r.CloseWithError(err) //nolint:errcheck
p.Done(err)
fsLog(fs, logger.LevelDebug, "upload completed, path: %q, acl: %q, readed bytes: %d, err: %+v",
@@ -316,21 +329,19 @@ func (fs *S3Fs) Create(name string, flag, checks int) (File, PipeWriter, func(),
}
// Rename renames (moves) source to target.
-func (fs *S3Fs) Rename(source, target string, checks int) (int, int64, error) {
+func (fs *S3Fs) Rename(source, target string) (int, int64, error) {
if source == target {
return -1, -1, nil
}
- if checks&CheckParentDir != 0 {
- _, err := fs.Stat(path.Dir(target))
- if err != nil {
- return -1, -1, err
- }
+ _, err := fs.Stat(path.Dir(target))
+ if err != nil {
+ return -1, -1, err
}
fi, err := fs.Stat(source)
if err != nil {
return -1, -1, err
}
- return fs.renameInternal(source, target, fi, 0, checks&CheckUpdateModTime != 0)
+ return fs.renameInternal(source, target, fi, 0)
}
// Remove removes the named file or (empty) directory.
@@ -611,18 +622,18 @@ func (*S3Fs) HasVirtualFolders() bool {
// ResolvePath returns the matching filesystem path for the specified virtual path
func (fs *S3Fs) ResolvePath(virtualPath string) (string, error) {
if fs.mountPath != "" {
- if after, found := strings.CutPrefix(virtualPath, fs.mountPath); found {
- virtualPath = after
- }
+ virtualPath = strings.TrimPrefix(virtualPath, fs.mountPath)
+ }
+ if !path.IsAbs(virtualPath) {
+ virtualPath = path.Clean("/" + virtualPath)
}
- virtualPath = path.Clean("/" + virtualPath)
return fs.Join(fs.config.KeyPrefix, strings.TrimPrefix(virtualPath, "/")), nil
}
// CopyFile implements the FsFileCopier interface
-func (fs *S3Fs) CopyFile(source, target string, srcInfo os.FileInfo) (int, int64, error) {
+func (fs *S3Fs) CopyFile(source, target string, srcSize int64) (int, int64, error) {
numFiles := 1
- sizeDiff := srcInfo.Size()
+ sizeDiff := srcSize
attrs, err := fs.headObject(target)
if err == nil {
sizeDiff -= util.GetIntFromPointer(attrs.ContentLength)
@@ -632,7 +643,7 @@ func (fs *S3Fs) CopyFile(source, target string, srcInfo os.FileInfo) (int, int64
return 0, 0, err
}
}
- if err := fs.copyFileInternal(source, target, srcInfo); err != nil {
+ if err := fs.copyFileInternal(source, target, srcSize); err != nil {
return 0, 0, err
}
return numFiles, sizeDiff, nil
@@ -648,73 +659,60 @@ func (fs *S3Fs) resolve(name *string, prefix string) (string, bool) {
}
func (fs *S3Fs) setConfigDefaults() {
- const defaultPartSize = 1024 * 1024 * 5
- const defaultConcurrency = 5
-
if fs.config.UploadPartSize == 0 {
- fs.config.UploadPartSize = defaultPartSize
+ fs.config.UploadPartSize = manager.DefaultUploadPartSize
} else {
if fs.config.UploadPartSize < 1024*1024 {
fs.config.UploadPartSize *= 1024 * 1024
}
}
if fs.config.UploadConcurrency == 0 {
- fs.config.UploadConcurrency = defaultConcurrency
+ fs.config.UploadConcurrency = manager.DefaultUploadConcurrency
}
if fs.config.DownloadPartSize == 0 {
- fs.config.DownloadPartSize = defaultPartSize
+ fs.config.DownloadPartSize = manager.DefaultDownloadPartSize
} else {
if fs.config.DownloadPartSize < 1024*1024 {
fs.config.DownloadPartSize *= 1024 * 1024
}
}
if fs.config.DownloadConcurrency == 0 {
- fs.config.DownloadConcurrency = defaultConcurrency
+ fs.config.DownloadConcurrency = manager.DefaultDownloadConcurrency
}
}
-func (fs *S3Fs) copyFileInternal(source, target string, srcInfo os.FileInfo) error {
+func (fs *S3Fs) copyFileInternal(source, target string, fileSize int64) error {
contentType := mime.TypeByExtension(path.Ext(source))
copySource := pathEscape(fs.Join(fs.config.Bucket, source))
- if srcInfo.Size() > s3CopyObjectThreshold {
+ if fileSize > s3CopyObjectThreshold {
fsLog(fs, logger.LevelDebug, "renaming file %q with size %d using multipart copy",
- source, srcInfo.Size())
- err := fs.doMultipartCopy(copySource, target, contentType, srcInfo.Size())
+ source, fileSize)
+ err := fs.doMultipartCopy(copySource, target, contentType, fileSize)
metric.S3CopyObjectCompleted(err)
return err
}
ctx, cancelFn := context.WithDeadline(context.Background(), time.Now().Add(fs.ctxTimeout))
defer cancelFn()
- copyObject := &s3.CopyObjectInput{
- Bucket: aws.String(fs.config.Bucket),
- CopySource: aws.String(copySource),
- Key: aws.String(target),
- StorageClass: types.StorageClass(fs.config.StorageClass),
- ACL: types.ObjectCannedACL(fs.config.ACL),
- ContentType: util.NilIfEmpty(contentType),
- CopySourceSSECustomerKey: util.NilIfEmpty(fs.sseCustomerKey),
- CopySourceSSECustomerAlgorithm: util.NilIfEmpty(fs.sseCustomerAlgo),
- CopySourceSSECustomerKeyMD5: util.NilIfEmpty(fs.sseCustomerKeyMD5),
- SSECustomerKey: util.NilIfEmpty(fs.sseCustomerKey),
- SSECustomerAlgorithm: util.NilIfEmpty(fs.sseCustomerAlgo),
- SSECustomerKeyMD5: util.NilIfEmpty(fs.sseCustomerKeyMD5),
- }
-
- _, err := fs.svc.CopyObject(ctx, copyObject)
+ _, err := fs.svc.CopyObject(ctx, &s3.CopyObjectInput{
+ Bucket: aws.String(fs.config.Bucket),
+ CopySource: aws.String(copySource),
+ Key: aws.String(target),
+ StorageClass: types.StorageClass(fs.config.StorageClass),
+ ACL: types.ObjectCannedACL(fs.config.ACL),
+ ContentType: util.NilIfEmpty(contentType),
+ })
metric.S3CopyObjectCompleted(err)
return err
}
-func (fs *S3Fs) renameInternal(source, target string, srcInfo os.FileInfo, recursion int,
- updateModTime bool,
-) (int, int64, error) {
+func (fs *S3Fs) renameInternal(source, target string, fi os.FileInfo, recursion int) (int, int64, error) {
var numFiles int
var filesSize int64
- if srcInfo.IsDir() {
+ if fi.IsDir() {
if renameMode == 0 {
hasContents, err := fs.hasContents(source)
if err != nil {
@@ -728,7 +726,7 @@ func (fs *S3Fs) renameInternal(source, target string, srcInfo os.FileInfo, recur
return numFiles, filesSize, err
}
if renameMode == 1 {
- files, size, err := doRecursiveRename(fs, source, target, fs.renameInternal, recursion, updateModTime)
+ files, size, err := doRecursiveRename(fs, source, target, fs.renameInternal, recursion)
numFiles += files
filesSize += size
if err != nil {
@@ -736,13 +734,13 @@ func (fs *S3Fs) renameInternal(source, target string, srcInfo os.FileInfo, recur
}
}
} else {
- if err := fs.copyFileInternal(source, target, srcInfo); err != nil {
+ if err := fs.copyFileInternal(source, target, fi.Size()); err != nil {
return numFiles, filesSize, err
}
numFiles++
- filesSize += srcInfo.Size()
+ filesSize += fi.Size()
}
- err := fs.Remove(source, srcInfo.IsDir())
+ err := fs.Remove(source, fi.IsDir())
if fs.IsNotExist(err) {
err = nil
}
@@ -793,340 +791,16 @@ func (fs *S3Fs) hasContents(name string) (bool, error) {
return false, nil
}
-func (fs *S3Fs) downloadPart(ctx context.Context, name string, buf []byte, w io.WriterAt, start, count, writeOffset int64) error {
- if count == 0 {
- return nil
- }
- rangeHeader := fmt.Sprintf("bytes=%d-%d", start, start+count-1)
-
- resp, err := fs.svc.GetObject(ctx, &s3.GetObjectInput{
- Bucket: aws.String(fs.config.Bucket),
- Key: aws.String(name),
- Range: &rangeHeader,
- SSECustomerKey: util.NilIfEmpty(fs.sseCustomerKey),
- SSECustomerAlgorithm: util.NilIfEmpty(fs.sseCustomerAlgo),
- SSECustomerKeyMD5: util.NilIfEmpty(fs.sseCustomerKeyMD5),
- })
- if err != nil {
- return err
- }
- defer resp.Body.Close()
-
- _, err = io.ReadAtLeast(resp.Body, buf, int(count))
- if err != nil {
- return err
- }
-
- return writeAtFull(w, buf, writeOffset, int(count))
-}
-
-func (fs *S3Fs) handleDownload(ctx context.Context, name string, offset int64, writer io.WriterAt, attrs *s3.HeadObjectOutput) error {
- contentLength := util.GetIntFromPointer(attrs.ContentLength)
- sizeToDownload := contentLength - offset
- if sizeToDownload < 0 {
- fsLog(fs, logger.LevelError, "invalid multipart download size or offset, size: %d, offset: %d, size to download: %d",
- contentLength, offset, sizeToDownload)
- return errors.New("the requested offset exceeds the file size")
- }
- if sizeToDownload == 0 {
- fsLog(fs, logger.LevelDebug, "nothing to download, offset %d, content length %d", offset, contentLength)
- return nil
- }
- partSize := fs.config.DownloadPartSize
- guard := make(chan struct{}, fs.config.DownloadConcurrency)
- var blockCtxTimeout time.Duration
- if fs.config.DownloadPartMaxTime > 0 {
- blockCtxTimeout = time.Duration(fs.config.DownloadPartMaxTime) * time.Second
- } else {
- blockCtxTimeout = time.Duration(fs.config.DownloadPartSize/(1024*1024)) * time.Minute
- }
- pool := newBufferAllocator(int(partSize))
- defer pool.free()
-
- finished := false
- var wg sync.WaitGroup
- var errOnce sync.Once
- var hasError atomic.Bool
- var poolError error
-
- poolCtx, poolCancel := context.WithCancel(ctx)
- defer poolCancel()
-
- for part := 0; !finished; part++ {
- start := offset
- end := offset + partSize
- if end >= contentLength {
- end = contentLength
- finished = true
- }
- writeOffset := int64(part) * partSize
- offset = end
-
- guard <- struct{}{}
- if hasError.Load() {
- fsLog(fs, logger.LevelDebug, "pool error, download for part %d not started", part)
- break
- }
-
- buf := pool.getBuffer()
- wg.Add(1)
- go func(start, end, writeOffset int64, buf []byte) {
- defer func() {
- pool.releaseBuffer(buf)
- <-guard
- wg.Done()
- }()
-
- innerCtx, cancelFn := context.WithDeadline(poolCtx, time.Now().Add(blockCtxTimeout))
- defer cancelFn()
-
- err := fs.downloadPart(innerCtx, name, buf, writer, start, end-start, writeOffset)
- if err != nil {
- errOnce.Do(func() {
- fsLog(fs, logger.LevelError, "multipart download error: %+v", err)
- hasError.Store(true)
- poolError = fmt.Errorf("multipart download error: %w", err)
- poolCancel()
- })
- }
- }(start, end, writeOffset, buf)
- }
-
- wg.Wait()
- close(guard)
-
- return poolError
-}
-
-func (fs *S3Fs) initiateMultipartUpload(ctx context.Context, name, contentType string) (string, error) {
- ctx, cancelFn := context.WithDeadline(ctx, time.Now().Add(fs.ctxTimeout))
- defer cancelFn()
-
- res, err := fs.svc.CreateMultipartUpload(ctx, &s3.CreateMultipartUploadInput{
- Bucket: aws.String(fs.config.Bucket),
- Key: aws.String(name),
- StorageClass: types.StorageClass(fs.config.StorageClass),
- ACL: types.ObjectCannedACL(fs.config.ACL),
- ContentType: util.NilIfEmpty(contentType),
- SSECustomerKey: util.NilIfEmpty(fs.sseCustomerKey),
- SSECustomerAlgorithm: util.NilIfEmpty(fs.sseCustomerAlgo),
- SSECustomerKeyMD5: util.NilIfEmpty(fs.sseCustomerKeyMD5),
- })
- if err != nil {
- return "", fmt.Errorf("unable to create multipart upload request: %w", err)
- }
- uploadID := util.GetStringFromPointer(res.UploadId)
- if uploadID == "" {
- return "", errors.New("unable to get multipart upload ID")
- }
- return uploadID, nil
-}
-
-func (fs *S3Fs) uploadPart(ctx context.Context, name, uploadID string, partNumber int32, data []byte) (*string, error) {
- timeout := time.Duration(fs.config.UploadPartSize/(1024*1024)) * time.Minute
- if fs.config.UploadPartMaxTime > 0 {
- timeout = time.Duration(fs.config.UploadPartMaxTime) * time.Second
- }
- ctx, cancelFn := context.WithDeadline(ctx, time.Now().Add(timeout))
- defer cancelFn()
-
- resp, err := fs.svc.UploadPart(ctx, &s3.UploadPartInput{
- Bucket: aws.String(fs.config.Bucket),
- Key: aws.String(name),
- PartNumber: &partNumber,
- UploadId: aws.String(uploadID),
- Body: bytes.NewReader(data),
- SSECustomerKey: util.NilIfEmpty(fs.sseCustomerKey),
- SSECustomerAlgorithm: util.NilIfEmpty(fs.sseCustomerAlgo),
- SSECustomerKeyMD5: util.NilIfEmpty(fs.sseCustomerKeyMD5),
- })
- if err != nil {
- return nil, fmt.Errorf("unable to upload part number %d: %w", partNumber, err)
- }
- return resp.ETag, nil
-}
-
-func (fs *S3Fs) completeMultipartUpload(ctx context.Context, name, uploadID string, completedParts []types.CompletedPart) error {
- ctx, cancelFn := context.WithDeadline(ctx, time.Now().Add(fs.ctxTimeout))
- defer cancelFn()
-
- _, err := fs.svc.CompleteMultipartUpload(ctx, &s3.CompleteMultipartUploadInput{
- Bucket: aws.String(fs.config.Bucket),
- Key: aws.String(name),
- UploadId: aws.String(uploadID),
- MultipartUpload: &types.CompletedMultipartUpload{
- Parts: completedParts,
- },
- })
- return err
-}
-
-func (fs *S3Fs) abortMultipartUpload(name, uploadID string) error {
- ctx, cancelFn := context.WithDeadline(context.Background(), time.Now().Add(fs.ctxTimeout))
- defer cancelFn()
-
- _, err := fs.svc.AbortMultipartUpload(ctx, &s3.AbortMultipartUploadInput{
- Bucket: aws.String(fs.config.Bucket),
- Key: aws.String(name),
- UploadId: aws.String(uploadID),
- })
- return err
-}
-
-func (fs *S3Fs) singlePartUpload(ctx context.Context, name, contentType string, data []byte) error {
- timeout := time.Duration(fs.config.UploadPartSize/(1024*1024)) * time.Minute
- if fs.config.UploadPartMaxTime > 0 {
- timeout = time.Duration(fs.config.UploadPartMaxTime) * time.Second
- }
- ctx, cancelFn := context.WithDeadline(ctx, time.Now().Add(timeout))
- defer cancelFn()
-
- contentLength := int64(len(data))
- _, err := fs.svc.PutObject(ctx, &s3.PutObjectInput{
- Bucket: aws.String(fs.config.Bucket),
- Key: aws.String(name),
- ACL: types.ObjectCannedACL(fs.config.ACL),
- Body: bytes.NewReader(data),
- ContentType: util.NilIfEmpty(contentType),
- ContentLength: &contentLength,
- SSECustomerKey: util.NilIfEmpty(fs.sseCustomerKey),
- SSECustomerAlgorithm: util.NilIfEmpty(fs.sseCustomerAlgo),
- SSECustomerKeyMD5: util.NilIfEmpty(fs.sseCustomerKeyMD5),
- StorageClass: types.StorageClass(fs.config.StorageClass),
- })
- return err
-}
-
-func (fs *S3Fs) handleUpload(ctx context.Context, reader io.Reader, name, contentType string) error {
- pool := newBufferAllocator(int(fs.config.UploadPartSize))
- defer pool.free()
-
- firstBuf := pool.getBuffer()
- firstReadSize, err := readFill(reader, firstBuf)
- if err == io.EOF {
- return fs.singlePartUpload(ctx, name, contentType, firstBuf[:firstReadSize])
- }
- if err != nil {
- return err
- }
-
- uploadID, err := fs.initiateMultipartUpload(ctx, name, contentType)
- if err != nil {
- return err
- }
- guard := make(chan struct{}, fs.config.UploadConcurrency)
- finished := false
- var partMutex sync.Mutex
- var completedParts []types.CompletedPart
- var wg sync.WaitGroup
- var hasError atomic.Bool
- var poolErr error
- var errOnce sync.Once
- var partNumber int32
-
- poolCtx, poolCancel := context.WithCancel(ctx)
- defer poolCancel()
-
- finalizeFailedUpload := func(err error) {
- fsLog(fs, logger.LevelError, "finalize failed multipart upload after error: %v", err)
- hasError.Store(true)
- poolErr = err
- poolCancel()
- if abortErr := fs.abortMultipartUpload(name, uploadID); abortErr != nil {
- fsLog(fs, logger.LevelError, "unable to abort multipart upload: %+v", abortErr)
- }
- }
-
- uploadPart := func(partNum int32, buf []byte, bytesRead int) {
- defer func() {
- pool.releaseBuffer(buf)
- <-guard
- wg.Done()
- }()
-
- etag, err := fs.uploadPart(poolCtx, name, uploadID, partNum, buf[:bytesRead])
- if err != nil {
- errOnce.Do(func() {
- finalizeFailedUpload(err)
- })
- return
- }
- partMutex.Lock()
- completedParts = append(completedParts, types.CompletedPart{
- PartNumber: &partNum,
- ETag: etag,
- })
- partMutex.Unlock()
- }
-
- partNumber = 1
- guard <- struct{}{}
-
- wg.Add(1)
- go uploadPart(partNumber, firstBuf, firstReadSize)
-
- for partNumber = 2; !finished; partNumber++ {
- buf := pool.getBuffer()
-
- n, err := readFill(reader, buf)
- if err == io.EOF {
- if n == 0 {
- pool.releaseBuffer(buf)
- break
- }
- finished = true
- } else if err != nil {
- pool.releaseBuffer(buf)
- errOnce.Do(func() {
- finalizeFailedUpload(err)
- })
- break
- }
- guard <- struct{}{}
- if hasError.Load() {
- fsLog(fs, logger.LevelError, "pool error, upload for part %d not started", partNumber)
- pool.releaseBuffer(buf)
- break
- }
-
- wg.Add(1)
- go uploadPart(partNumber, buf, n)
- }
-
- wg.Wait()
- close(guard)
-
- if poolErr != nil {
- return poolErr
- }
-
- sort.Slice(completedParts, func(i, j int) bool {
- getPartNumber := func(number *int32) int32 {
- if number == nil {
- return 0
- }
- return *number
- }
-
- return getPartNumber(completedParts[i].PartNumber) < getPartNumber(completedParts[j].PartNumber)
- })
-
- return fs.completeMultipartUpload(ctx, name, uploadID, completedParts)
-}
-
func (fs *S3Fs) doMultipartCopy(source, target, contentType string, fileSize int64) error {
ctx, cancelFn := context.WithDeadline(context.Background(), time.Now().Add(fs.ctxTimeout))
defer cancelFn()
res, err := fs.svc.CreateMultipartUpload(ctx, &s3.CreateMultipartUploadInput{
- Bucket: aws.String(fs.config.Bucket),
- Key: aws.String(target),
- StorageClass: types.StorageClass(fs.config.StorageClass),
- ACL: types.ObjectCannedACL(fs.config.ACL),
- ContentType: util.NilIfEmpty(contentType),
- SSECustomerKey: util.NilIfEmpty(fs.sseCustomerKey),
- SSECustomerAlgorithm: util.NilIfEmpty(fs.sseCustomerAlgo),
- SSECustomerKeyMD5: util.NilIfEmpty(fs.sseCustomerKeyMD5),
+ Bucket: aws.String(fs.config.Bucket),
+ Key: aws.String(target),
+ StorageClass: types.StorageClass(fs.config.StorageClass),
+ ACL: types.ObjectCannedACL(fs.config.ACL),
+ ContentType: util.NilIfEmpty(contentType),
})
if err != nil {
return fmt.Errorf("unable to create multipart copy request: %w", err)
@@ -1181,18 +855,12 @@ func (fs *S3Fs) doMultipartCopy(source, target, contentType string, fileSize int
defer innerCancelFn()
partResp, err := fs.svc.UploadPartCopy(innerCtx, &s3.UploadPartCopyInput{
- Bucket: aws.String(fs.config.Bucket),
- CopySource: aws.String(source),
- Key: aws.String(target),
- PartNumber: &partNum,
- UploadId: aws.String(uploadID),
- CopySourceRange: aws.String(fmt.Sprintf("bytes=%d-%d", partStart, partEnd-1)),
- CopySourceSSECustomerKey: util.NilIfEmpty(fs.sseCustomerKey),
- CopySourceSSECustomerAlgorithm: util.NilIfEmpty(fs.sseCustomerAlgo),
- CopySourceSSECustomerKeyMD5: util.NilIfEmpty(fs.sseCustomerKeyMD5),
- SSECustomerKey: util.NilIfEmpty(fs.sseCustomerKey),
- SSECustomerAlgorithm: util.NilIfEmpty(fs.sseCustomerAlgo),
- SSECustomerKeyMD5: util.NilIfEmpty(fs.sseCustomerKeyMD5),
+ Bucket: aws.String(fs.config.Bucket),
+ CopySource: aws.String(source),
+ Key: aws.String(target),
+ PartNumber: &partNum,
+ UploadId: aws.String(uploadID),
+ CopySourceRange: aws.String(fmt.Sprintf("bytes=%d-%d", partStart, partEnd-1)),
})
if err != nil {
errOnce.Do(func() {
@@ -1201,7 +869,15 @@ func (fs *S3Fs) doMultipartCopy(source, target, contentType string, fileSize int
copyError = fmt.Errorf("error copying part number %d: %w", partNum, err)
opCancel()
- if errAbort := fs.abortMultipartUpload(target, uploadID); errAbort != nil {
+ abortCtx, abortCancelFn := context.WithDeadline(context.Background(), time.Now().Add(fs.ctxTimeout))
+ defer abortCancelFn()
+
+ _, errAbort := fs.svc.AbortMultipartUpload(abortCtx, &s3.AbortMultipartUploadInput{
+ Bucket: aws.String(fs.config.Bucket),
+ Key: aws.String(target),
+ UploadId: aws.String(uploadID),
+ })
+ if errAbort != nil {
fsLog(fs, logger.LevelError, "unable to abort multipart copy: %+v", errAbort)
}
})
@@ -1267,11 +943,8 @@ func (fs *S3Fs) headObject(name string) (*s3.HeadObjectOutput, error) {
defer cancelFn()
obj, err := fs.svc.HeadObject(ctx, &s3.HeadObjectInput{
- Bucket: aws.String(fs.config.Bucket),
- Key: aws.String(name),
- SSECustomerKey: util.NilIfEmpty(fs.sseCustomerKey),
- SSECustomerAlgorithm: util.NilIfEmpty(fs.sseCustomerAlgo),
- SSECustomerKeyMD5: util.NilIfEmpty(fs.sseCustomerKeyMD5),
+ Bucket: aws.String(fs.config.Bucket),
+ Key: aws.String(name),
})
metric.S3HeadObjectCompleted(err)
return obj, err
@@ -1298,18 +971,28 @@ func (*S3Fs) GetAvailableDiskSize(_ string) (*sftp.StatVFS, error) {
func (fs *S3Fs) downloadToWriter(name string, w PipeWriter) (int64, error) {
fsLog(fs, logger.LevelDebug, "starting download before resuming upload, path %q", name)
- attrs, err := fs.headObject(name)
- if err != nil {
- return 0, err
- }
ctx, cancelFn := context.WithTimeout(context.Background(), preResumeTimeout)
defer cancelFn()
- err = fs.handleDownload(ctx, name, 0, w, attrs)
+ downloader := manager.NewDownloader(fs.svc, func(d *manager.Downloader) {
+ d.Concurrency = fs.config.DownloadConcurrency
+ d.PartSize = fs.config.DownloadPartSize
+ if fs.config.DownloadPartMaxTime > 0 {
+ d.ClientOptions = append(d.ClientOptions, func(o *s3.Options) {
+ o.HTTPClient = getAWSHTTPClient(fs.config.DownloadPartMaxTime, 100*time.Millisecond,
+ fs.config.SkipTLSVerify)
+ })
+ }
+ })
+
+ n, err := downloader.Download(ctx, w, &s3.GetObjectInput{
+ Bucket: aws.String(fs.config.Bucket),
+ Key: aws.String(name),
+ })
fsLog(fs, logger.LevelDebug, "download before resuming upload completed, path %q size: %d, err: %+v",
- name, w.GetWrittenBytes(), err)
- metric.S3TransferCompleted(w.GetWrittenBytes(), 1, err)
- return w.GetWrittenBytes(), err
+ name, n, err)
+ metric.S3TransferCompleted(n, 1, err)
+ return n, err
}
type s3DirLister struct {
diff --git a/internal/vfs/s3fs_disabled.go b/internal/vfs/s3fs_disabled.go
index 5c1f1b53..8f71384a 100644
--- a/internal/vfs/s3fs_disabled.go
+++ b/internal/vfs/s3fs_disabled.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build nos3
+// +build nos3
package vfs
diff --git a/internal/vfs/sftpfs.go b/internal/vfs/sftpfs.go
index 2f263dd3..869c315e 100644
--- a/internal/vfs/sftpfs.go
+++ b/internal/vfs/sftpfs.go
@@ -18,10 +18,9 @@ import (
"bufio"
"bytes"
"crypto/rsa"
- "crypto/sha256"
- "encoding/hex"
"errors"
"fmt"
+ "hash/fnv"
"io"
"io/fs"
"net"
@@ -29,13 +28,13 @@ import (
"os"
"path"
"path/filepath"
- "slices"
"strconv"
"strings"
"sync"
"sync/atomic"
"time"
+ "github.com/eikenb/pipeat"
"github.com/pkg/sftp"
"github.com/robfig/cron/v3"
"github.com/rs/xid"
@@ -70,17 +69,6 @@ type SFTPFsConfig struct {
forbiddenSelfUsernames []string `json:"-"`
}
-func (c *SFTPFsConfig) getKeySigner() (ssh.Signer, error) {
- privPayload := c.PrivateKey.GetPayload()
- if privPayload == "" {
- return nil, nil
- }
- if key := c.KeyPassphrase.GetPayload(); key != "" {
- return ssh.ParsePrivateKeyWithPassphrase([]byte(privPayload), []byte(key))
- }
- return ssh.ParsePrivateKey([]byte(privPayload))
-}
-
// HideConfidentialData hides confidential data
func (c *SFTPFsConfig) HideConfidentialData() {
if c.Password != nil {
@@ -126,7 +114,7 @@ func (c *SFTPFsConfig) isEqual(other SFTPFsConfig) bool {
return false
}
for _, fp := range c.Fingerprints {
- if !slices.Contains(other.Fingerprints, fp) {
+ if !util.Contains(other.Fingerprints, fp) {
return false
}
}
@@ -197,20 +185,25 @@ func (c *SFTPFsConfig) validate() error {
func (c *SFTPFsConfig) validatePrivateKey() error {
if c.PrivateKey.IsPlain() {
- signer, err := c.getKeySigner()
+ var signer ssh.Signer
+ var err error
+ if c.KeyPassphrase.IsPlain() {
+ signer, err = ssh.ParsePrivateKeyWithPassphrase([]byte(c.PrivateKey.GetPayload()),
+ []byte(c.KeyPassphrase.GetPayload()))
+ } else {
+ signer, err = ssh.ParsePrivateKey([]byte(c.PrivateKey.GetPayload()))
+ }
if err != nil {
return util.NewI18nError(fmt.Errorf("invalid private key: %w", err), util.I18nErrorPrivKeyInvalid)
}
- if signer != nil {
- if key, ok := signer.PublicKey().(ssh.CryptoPublicKey); ok {
- cryptoKey := key.CryptoPublicKey()
- if rsaKey, ok := cryptoKey.(*rsa.PublicKey); ok {
- if size := rsaKey.N.BitLen(); size < 2048 {
- return util.NewI18nError(
- fmt.Errorf("rsa key with size %d not accepted, minimum 2048", size),
- util.I18nErrorKeySizeInvalid,
- )
- }
+ if key, ok := signer.PublicKey().(ssh.CryptoPublicKey); ok {
+ cryptoKey := key.CryptoPublicKey()
+ if rsaKey, ok := cryptoKey.(*rsa.PublicKey); ok {
+ if size := rsaKey.N.BitLen(); size < 2048 {
+ return util.NewI18nError(
+ fmt.Errorf("rsa key with size %d not accepted, minimum 2048", size),
+ util.I18nErrorKeySizeInvalid,
+ )
}
}
}
@@ -284,8 +277,8 @@ func (c *SFTPFsConfig) ValidateAndEncryptCredentials(additionalData string) erro
}
// getUniqueID returns an hash of the settings used to connect to the SFTP server
-func (c *SFTPFsConfig) getUniqueID(partition int) string {
- h := sha256.New()
+func (c *SFTPFsConfig) getUniqueID(partition int) uint64 {
+ h := fnv.New64a()
var b bytes.Buffer
b.WriteString(c.Endpoint)
@@ -302,7 +295,7 @@ func (c *SFTPFsConfig) getUniqueID(partition int) string {
b.WriteString(strconv.Itoa(partition))
h.Write(b.Bytes())
- return hex.EncodeToString(h.Sum(nil))
+ return h.Sum64()
}
// SFTPFs is a Fs implementation for SFTP backends
@@ -338,19 +331,15 @@ func NewSFTPFs(connectionID, mountPath, localTempDir string, forbiddenSelfUserna
return nil, err
}
}
- conn, err := sftpConnsCache.Get(&config, connectionID)
- if err != nil {
- return nil, err
- }
config.forbiddenSelfUsernames = forbiddenSelfUsernames
sftpFs := &SFTPFs{
connectionID: connectionID,
mountPath: getMountPath(mountPath),
localTempDir: localTempDir,
config: &config,
- conn: conn,
+ conn: sftpConnsCache.Get(&config, connectionID),
}
- err = sftpFs.createConnection()
+ err := sftpFs.createConnection()
if err != nil {
sftpFs.Close() //nolint:errcheck
}
@@ -405,7 +394,7 @@ func (fs *SFTPFs) Open(name string, offset int64) (File, PipeReader, func(), err
if fs.config.BufferSize == 0 {
return f, nil, nil, nil
}
- r, w, err := createPipeFn(fs.localTempDir, 0)
+ r, w, err := pipeat.PipeInDir(fs.localTempDir)
if err != nil {
f.Close()
return nil, nil, nil, err
@@ -445,7 +434,7 @@ func (fs *SFTPFs) Create(name string, flag, _ int) (File, PipeWriter, func(), er
if err != nil {
return nil, nil, nil, err
}
- r, w, err := createPipeFn(fs.localTempDir, 0)
+ r, w, err := pipeat.PipeInDir(fs.localTempDir)
if err != nil {
f.Close()
return nil, nil, nil, err
@@ -479,7 +468,7 @@ func (fs *SFTPFs) Create(name string, flag, _ int) (File, PipeWriter, func(), er
}
// Rename renames (moves) source to target.
-func (fs *SFTPFs) Rename(source, target string, checks int) (int, int64, error) {
+func (fs *SFTPFs) Rename(source, target string) (int, int64, error) {
if source == target {
return -1, -1, nil
}
@@ -489,15 +478,9 @@ func (fs *SFTPFs) Rename(source, target string, checks int) (int, int64, error)
}
if _, ok := client.HasExtension("posix-rename@openssh.com"); ok {
err := client.PosixRename(source, target)
- if checks&CheckUpdateModTime != 0 && err == nil {
- fs.Chtimes(target, time.Now(), time.Now(), false) //nolint:errcheck
- }
return -1, -1, err
}
err = client.Rename(source, target)
- if checks&CheckUpdateModTime != 0 && err == nil {
- fs.Chtimes(target, time.Now(), time.Now(), false) //nolint:errcheck
- }
return -1, -1, err
}
@@ -541,7 +524,7 @@ func (fs *SFTPFs) Readlink(name string) (string, error) {
if err != nil {
return resolved, err
}
- resolved = path.Clean(strings.ReplaceAll(resolved, "\\", "/"))
+ resolved = path.Clean(resolved)
if !path.IsAbs(resolved) {
// we assume that multiple links are not followed
resolved = path.Join(path.Dir(name), resolved)
@@ -683,23 +666,13 @@ func (fs *SFTPFs) GetRelativePath(name string) string {
rel = ""
}
if !path.IsAbs(rel) {
- // If we have a relative path we assume it is already relative to the virtual root
- rel = "/" + rel
- } else if fs.config.Prefix != "/" {
- prefixDir := fs.config.Prefix
- if !strings.HasSuffix(prefixDir, "/") {
- prefixDir += "/"
- }
-
- if rel == fs.config.Prefix {
- rel = "/"
- } else if after, found := strings.CutPrefix(rel, prefixDir); found {
- rel = path.Clean("/" + after)
- } else {
- // Absolute path outside of the configured prefix
- fsLog(fs, logger.LevelWarn, "path %q is an absolute path outside %q", name, fs.config.Prefix)
+ return "/" + rel
+ }
+ if fs.config.Prefix != "/" {
+ if !strings.HasPrefix(rel, fs.config.Prefix) {
rel = "/"
}
+ rel = path.Clean("/" + strings.TrimPrefix(rel, fs.config.Prefix))
}
if fs.mountPath != "" {
rel = path.Join(fs.mountPath, rel)
@@ -741,11 +714,11 @@ func (*SFTPFs) HasVirtualFolders() bool {
// ResolvePath returns the matching filesystem path for the specified virtual path
func (fs *SFTPFs) ResolvePath(virtualPath string) (string, error) {
if fs.mountPath != "" {
- if after, found := strings.CutPrefix(virtualPath, fs.mountPath); found {
- virtualPath = after
- }
+ virtualPath = strings.TrimPrefix(virtualPath, fs.mountPath)
+ }
+ if !path.IsAbs(virtualPath) {
+ virtualPath = path.Clean("/" + virtualPath)
}
- virtualPath = path.Clean("/" + virtualPath)
fsPath := fs.Join(fs.config.Prefix, virtualPath)
if fs.config.Prefix != "/" && fsPath != "/" {
// we need to check if this path is a symlink outside the given prefix
@@ -792,7 +765,6 @@ func (fs *SFTPFs) RealPath(p string) (string, error) {
if err != nil {
return "", err
}
- resolved = path.Clean(strings.ReplaceAll(resolved, "\\", "/"))
if fs.config.Prefix != "/" {
if err := fs.isSubDir(resolved); err != nil {
fsLog(fs, logger.LevelError, "Invalid real path resolution, original path %q resolved %q err: %v",
@@ -822,7 +794,6 @@ func (fs *SFTPFs) getRealPath(name string) (string, error) {
if err != nil {
return name, fmt.Errorf("unable to resolve link to %q: %w", name, err)
}
- resolvedLink = strings.ReplaceAll(resolvedLink, "\\", "/")
resolvedLink = path.Clean(resolvedLink)
if path.IsAbs(resolvedLink) {
name = resolvedLink
@@ -939,7 +910,6 @@ type sftpConnection struct {
isConnected bool
sessions map[string]bool
lastActivity time.Time
- signer ssh.Signer
}
func newSFTPConnection(config *SFTPFsConfig, sessionID string) *sftpConnection {
@@ -949,7 +919,6 @@ func newSFTPConnection(config *SFTPFsConfig, sessionID string) *sftpConnection {
isConnected: false,
sessions: map[string]bool{},
lastActivity: time.Now().UTC(),
- signer: nil,
}
c.sessions[sessionID] = true
return c
@@ -962,6 +931,17 @@ func (c *sftpConnection) OpenConnection() error {
return c.openConnNoLock()
}
+func (c *sftpConnection) getKeySigner() (ssh.Signer, error) {
+ privPayload := c.config.PrivateKey.GetPayload()
+ if privPayload == "" {
+ return nil, nil
+ }
+ if key := c.config.KeyPassphrase.GetPayload(); key != "" {
+ return ssh.ParsePrivateKeyWithPassphrase([]byte(privPayload), []byte(key))
+ }
+ return ssh.ParsePrivateKey([]byte(privPayload))
+}
+
func (c *sftpConnection) openConnNoLock() error {
if c.isConnected {
logger.Debug(c.logSender, "", "reusing connection")
@@ -973,12 +953,12 @@ func (c *sftpConnection) openConnNoLock() error {
User: c.config.Username,
HostKeyCallback: func(_ string, _ net.Addr, key ssh.PublicKey) error {
fp := ssh.FingerprintSHA256(key)
- if slices.Contains(sftpFingerprints, fp) {
+ if util.Contains(sftpFingerprints, fp) {
if allowSelfConnections == 0 {
logger.Log(logger.LevelError, c.logSender, "", "SFTP self connections not allowed")
return ErrSFTPLoop
}
- if slices.Contains(c.config.forbiddenSelfUsernames, c.config.Username) {
+ if util.Contains(c.config.forbiddenSelfUsernames, c.config.Username) {
logger.Log(logger.LevelError, c.logSender, "",
"SFTP loop or nested local SFTP folders detected, username %q, forbidden usernames: %+v",
c.config.Username, c.config.forbiddenSelfUsernames)
@@ -999,8 +979,12 @@ func (c *sftpConnection) openConnNoLock() error {
Timeout: 15 * time.Second,
ClientVersion: fmt.Sprintf("SSH-2.0-%s", version.GetServerVersion("_", false)),
}
- if c.signer != nil {
- clientConfig.Auth = append(clientConfig.Auth, ssh.PublicKeys(c.signer))
+ signer, err := c.getKeySigner()
+ if err != nil {
+ return fmt.Errorf("sftpfs: unable to parse the private key: %w", err)
+ }
+ if signer != nil {
+ clientConfig.Auth = append(clientConfig.Auth, ssh.PublicKeys(signer))
}
if pwd := c.config.Password.GetPayload(); pwd != "" {
clientConfig.Auth = append(clientConfig.Auth, ssh.Password(pwd))
@@ -1008,7 +992,8 @@ func (c *sftpConnection) openConnNoLock() error {
supportedAlgos := ssh.SupportedAlgorithms()
insecureAlgos := ssh.InsecureAlgorithms()
// add all available ciphers, KEXs and MACs, they are negotiated according to the order
- clientConfig.Ciphers = append(supportedAlgos.Ciphers, ssh.InsecureCipherAES128CBC)
+ clientConfig.Ciphers = append(supportedAlgos.Ciphers, ssh.InsecureCipherAES128CBC,
+ ssh.InsecureCipherAES192CBC, ssh.InsecureCipherAES256CBC)
clientConfig.KeyExchanges = append(supportedAlgos.KeyExchanges, insecureAlgos.KeyExchanges...)
clientConfig.MACs = append(supportedAlgos.MACs, insecureAlgos.MACs...)
sshClient, err := ssh.Dial("tcp", c.config.Endpoint, clientConfig)
@@ -1156,14 +1141,14 @@ func (c *sftpConnection) GetLastActivity() time.Time {
type sftpConnectionsCache struct {
scheduler *cron.Cron
- sync.Mutex
- items map[string]*sftpConnection
+ sync.RWMutex
+ items map[uint64]*sftpConnection
}
func newSFTPConnectionCache() *sftpConnectionsCache {
c := &sftpConnectionsCache{
scheduler: cron.New(cron.WithLocation(time.UTC), cron.WithLogger(cron.DiscardLogger)),
- items: make(map[string]*sftpConnection),
+ items: make(map[uint64]*sftpConnection),
}
_, err := c.scheduler.AddFunc("@every 1m", c.Cleanup)
util.PanicOnError(err)
@@ -1171,62 +1156,65 @@ func newSFTPConnectionCache() *sftpConnectionsCache {
return c
}
-func (c *sftpConnectionsCache) Get(config *SFTPFsConfig, sessionID string) (*sftpConnection, error) {
+func (c *sftpConnectionsCache) Get(config *SFTPFsConfig, sessionID string) *sftpConnection {
partition := 0
key := config.getUniqueID(partition)
c.Lock()
defer c.Unlock()
+ var oldKey uint64
for {
if val, ok := c.items[key]; ok {
activeSessions := val.ActiveSessions()
- if activeSessions < maxSessionsPerConnection {
+ if activeSessions < maxSessionsPerConnection || key == oldKey {
logger.Debug(logSenderSFTPCache, "",
- "reusing connection for session ID %q, key %s, active sessions %d, active connections: %d",
+ "reusing connection for session ID %q, key: %d, active sessions %d, active connections: %d",
sessionID, key, activeSessions+1, len(c.items))
val.AddSession(sessionID)
- return val, nil
+ return val
}
partition++
+ oldKey = key
key = config.getUniqueID(partition)
logger.Debug(logSenderSFTPCache, "",
- "connection full, generated new key for partition: %d, active sessions: %d, key: %s",
- partition, activeSessions, key)
+ "connection full, generated new key for partition: %d, active sessions: %d, key: %d, old key: %d",
+ partition, activeSessions, oldKey, key)
} else {
conn := newSFTPConnection(config, sessionID)
- signer, err := config.getKeySigner()
- if err != nil {
- return nil, fmt.Errorf("sftpfs: unable to parse the private key: %w", err)
- }
- conn.signer = signer
c.items[key] = conn
logger.Debug(logSenderSFTPCache, "",
- "adding new connection for session ID %q, partition: %d, key: %s, active connections: %d",
+ "adding new connection for session ID %q, partition: %d, key: %d, active connections: %d",
sessionID, partition, key, len(c.items))
- return conn, nil
+ return conn
}
}
}
+func (c *sftpConnectionsCache) Remove(key uint64) {
+ c.Lock()
+ defer c.Unlock()
+
+ if conn, ok := c.items[key]; ok {
+ delete(c.items, key)
+ logger.Debug(logSenderSFTPCache, "", "removed connection with key %d, active connections: %d", key, len(c.items))
+
+ defer conn.Close()
+ }
+}
+
func (c *sftpConnectionsCache) Cleanup() {
- c.Lock()
-
- var connectionsToClose []*sftpConnection
+ c.RLock()
for k, conn := range c.items {
if val := conn.GetLastActivity(); val.Before(time.Now().Add(-30 * time.Second)) {
- delete(c.items, k)
- logger.Debug(logSenderSFTPCache, "", "removed connection with key %s, last activity %s, active connections: %d",
- k, val, len(c.items))
- connectionsToClose = append(connectionsToClose, conn)
+ logger.Debug(conn.logSender, "", "removing inactive connection, last activity %s", val)
+
+ defer func(key uint64) {
+ c.Remove(key)
+ }(k)
}
}
- c.Unlock()
-
- for _, conn := range connectionsToClose {
- err := conn.Close()
- logger.Debug(logSenderSFTPCache, "", "connection closed, err: %v", err)
- }
+ c.RUnlock()
}
diff --git a/internal/vfs/statvfs_fallback.go b/internal/vfs/statvfs_fallback.go
index 19d8e2c3..f857ffbe 100644
--- a/internal/vfs/statvfs_fallback.go
+++ b/internal/vfs/statvfs_fallback.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build !darwin && !linux && !freebsd
+// +build !darwin,!linux,!freebsd
package vfs
diff --git a/internal/vfs/statvfs_linux.go b/internal/vfs/statvfs_linux.go
index 772265fc..03b71459 100644
--- a/internal/vfs/statvfs_linux.go
+++ b/internal/vfs/statvfs_linux.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build linux
+// +build linux
package vfs
diff --git a/internal/vfs/statvfs_unix.go b/internal/vfs/statvfs_unix.go
index 53f43202..26482b1a 100644
--- a/internal/vfs/statvfs_unix.go
+++ b/internal/vfs/statvfs_unix.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build freebsd || darwin
+// +build freebsd darwin
package vfs
diff --git a/internal/vfs/sys_unix.go b/internal/vfs/sys_unix.go
index 427792f8..e2e01e13 100644
--- a/internal/vfs/sys_unix.go
+++ b/internal/vfs/sys_unix.go
@@ -13,6 +13,7 @@
// along with this program. If not, see .
//go:build !windows
+// +build !windows
package vfs
diff --git a/internal/vfs/vfs.go b/internal/vfs/vfs.go
index 6f883e6a..b8edcb34 100644
--- a/internal/vfs/vfs.go
+++ b/internal/vfs/vfs.go
@@ -16,7 +16,6 @@
package vfs
import (
- "bytes"
"errors"
"fmt"
"io"
@@ -25,7 +24,6 @@ import (
"path"
"path/filepath"
"runtime"
- "slices"
"strconv"
"strings"
"sync"
@@ -53,9 +51,8 @@ const (
// Additional checks for files
const (
- CheckParentDir = 1
- CheckResume = 2
- CheckUpdateModTime = 4
+ CheckParentDir = 1
+ CheckResume = 2
)
var (
@@ -74,12 +71,6 @@ var (
uploadMode int
)
-var (
- createPipeFn = func(dirPath string, _ int64) (pipeReaderAt, pipeWriterAt, error) {
- return pipeat.PipeInDir(dirPath)
- }
-)
-
// SetAllowSelfConnections sets the desired behaviour for self connections
func SetAllowSelfConnections(value int) {
allowSelfConnections = value
@@ -129,7 +120,7 @@ type Fs interface {
Lstat(name string) (os.FileInfo, error)
Open(name string, offset int64) (File, PipeReader, func(), error)
Create(name string, flag, checks int) (File, PipeWriter, func(), error)
- Rename(source, target string, checks int) (int, int64, error)
+ Rename(source, target string) (int, int64, error)
Remove(name string, isDir bool) error
Mkdir(name string) error
Symlink(source, target string) error
@@ -168,7 +159,7 @@ type FsRealPather interface {
// FsFileCopier is a Fs that implements the CopyFile method.
type FsFileCopier interface {
Fs
- CopyFile(source, target string, srcInfo os.FileInfo) (int, int64, error)
+ CopyFile(source, target string, srcSize int64) (int, int64, error)
}
// File defines an interface representing a SFTPGo file
@@ -203,22 +194,6 @@ type PipeReader interface {
Metadata() map[string]string
}
-type pipeReaderAt interface {
- Read(p []byte) (int, error)
- ReadAt(p []byte, offset int64) (int, error)
- GetReadedBytes() int64
- Close() error
- CloseWithError(err error) error
-}
-
-type pipeWriterAt interface {
- Write(p []byte) (int, error)
- WriteAt(p []byte, offset int64) (int, error)
- GetWrittenBytes() int64
- Close() error
- CloseWithError(err error) error
-}
-
// DirLister defines an interface for a directory lister
type DirLister interface {
Next(limit int) ([]os.FileInfo, error)
@@ -290,8 +265,7 @@ func (q *QuotaCheckResult) GetRemainingFiles() int {
// S3FsConfig defines the configuration for S3 based filesystem
type S3FsConfig struct {
sdk.BaseS3FsConfig
- AccessSecret *kms.Secret `json:"access_secret,omitempty"`
- SSECustomerKey *kms.Secret `json:"sse_customer_key,omitempty"`
+ AccessSecret *kms.Secret `json:"access_secret,omitempty"`
}
// HideConfidentialData hides confidential data
@@ -299,9 +273,6 @@ func (c *S3FsConfig) HideConfidentialData() {
if c.AccessSecret != nil {
c.AccessSecret.Hide()
}
- if c.SSECustomerKey != nil {
- c.SSECustomerKey.Hide()
- }
}
func (c *S3FsConfig) isEqual(other S3FsConfig) bool {
@@ -364,15 +335,6 @@ func (c *S3FsConfig) areMultipartFieldsEqual(other S3FsConfig) bool {
}
func (c *S3FsConfig) isSecretEqual(other S3FsConfig) bool {
- if c.SSECustomerKey == nil {
- c.SSECustomerKey = kms.NewEmptySecret()
- }
- if other.SSECustomerKey == nil {
- other.SSECustomerKey = kms.NewEmptySecret()
- }
- if !c.SSECustomerKey.IsEqual(other.SSECustomerKey) {
- return false
- }
if c.AccessSecret == nil {
c.AccessSecret = kms.NewEmptySecret()
}
@@ -401,12 +363,6 @@ func (c *S3FsConfig) checkCredentials() error {
if !c.AccessSecret.IsEmpty() && !c.AccessSecret.IsValidInput() {
return errors.New("invalid access_secret")
}
- if c.SSECustomerKey.IsEncrypted() && !c.SSECustomerKey.IsValid() {
- return errors.New("invalid encrypted sse_customer_key")
- }
- if !c.SSECustomerKey.IsEmpty() && !c.SSECustomerKey.IsValidInput() {
- return errors.New("invalid sse_customer_key")
- }
return nil
}
@@ -430,23 +386,13 @@ func (c *S3FsConfig) ValidateAndEncryptCredentials(additionalData string) error
)
}
}
- if c.SSECustomerKey.IsPlain() {
- c.SSECustomerKey.SetAdditionalData(additionalData)
- err := c.SSECustomerKey.Encrypt()
- if err != nil {
- return util.NewI18nError(
- util.NewValidationError(fmt.Sprintf("could not encrypt s3 SSE customer key: %v", err)),
- util.I18nErrorFsValidation,
- )
- }
- }
return nil
}
func (c *S3FsConfig) checkPartSizeAndConcurrency() error {
- if c.UploadPartSize != 0 && (c.UploadPartSize < 5 || c.UploadPartSize > 2000) {
+ if c.UploadPartSize != 0 && (c.UploadPartSize < 5 || c.UploadPartSize > 5000) {
return util.NewI18nError(
- errors.New("upload_part_size cannot be != 0, lower than 5 (MB) or greater than 2000 (MB)"),
+ errors.New("upload_part_size cannot be != 0, lower than 5 (MB) or greater than 5000 (MB)"),
util.I18nErrorULPartSizeInvalid,
)
}
@@ -456,9 +402,9 @@ func (c *S3FsConfig) checkPartSizeAndConcurrency() error {
util.I18nErrorULConcurrencyInvalid,
)
}
- if c.DownloadPartSize != 0 && (c.DownloadPartSize < 5 || c.DownloadPartSize > 2000) {
+ if c.DownloadPartSize != 0 && (c.DownloadPartSize < 5 || c.DownloadPartSize > 5000) {
return util.NewI18nError(
- errors.New("download_part_size cannot be != 0, lower than 5 (MB) or greater than 2000 (MB)"),
+ errors.New("download_part_size cannot be != 0, lower than 5 (MB) or greater than 5000 (MB)"),
util.I18nErrorDLPartSizeInvalid,
)
}
@@ -486,9 +432,6 @@ func (c *S3FsConfig) validate() error {
if c.AccessSecret == nil {
c.AccessSecret = kms.NewEmptySecret()
}
- if c.SSECustomerKey == nil {
- c.SSECustomerKey = kms.NewEmptySecret()
- }
if c.Bucket == "" {
return util.NewI18nError(errors.New("bucket cannot be empty"), util.I18nErrorBucketRequired)
}
@@ -586,7 +529,7 @@ func (c *GCSFsConfig) isSameResource(other GCSFsConfig) bool {
}
// validate returns an error if the configuration is not valid
-func (c *GCSFsConfig) validate() error { //nolint:gocyclo
+func (c *GCSFsConfig) validate() error {
if c.Credentials == nil || c.AutomaticCredentials == 1 {
c.Credentials = kms.NewEmptySecret()
}
@@ -610,7 +553,7 @@ func (c *GCSFsConfig) validate() error { //nolint:gocyclo
}
c.StorageClass = strings.TrimSpace(c.StorageClass)
c.ACL = strings.TrimSpace(c.ACL)
- if c.UploadPartSize < 0 || c.UploadPartSize > 2000 {
+ if c.UploadPartSize < 0 {
c.UploadPartSize = 0
}
if c.UploadPartMaxTime < 0 {
@@ -737,8 +680,8 @@ func (c *AzBlobFsConfig) checkCredentials() error {
if !c.SASURL.IsEmpty() {
return nil
}
- if c.AccountName == "" {
- return util.NewI18nError(errors.New("account name is required"), util.I18nErrorAccountNameRequired)
+ if c.AccountName == "" || !c.AccountKey.IsValidInput() {
+ return util.NewI18nError(errors.New("credentials cannot be empty or invalid"), util.I18nErrorAccountNameRequired)
}
if c.AccountKey.IsEncrypted() && !c.AccountKey.IsValid() {
return errors.New("invalid encrypted account_key")
@@ -747,7 +690,7 @@ func (c *AzBlobFsConfig) checkCredentials() error {
}
func (c *AzBlobFsConfig) checkPartSizeAndConcurrency() error {
- if c.UploadPartSize < 0 || c.UploadPartSize > 2000 {
+ if c.UploadPartSize < 0 || c.UploadPartSize > 100 {
return util.NewI18nError(
fmt.Errorf("invalid upload part size: %v", c.UploadPartSize),
util.I18nErrorULPartSizeInvalid,
@@ -759,7 +702,7 @@ func (c *AzBlobFsConfig) checkPartSizeAndConcurrency() error {
util.I18nErrorULConcurrencyInvalid,
)
}
- if c.DownloadPartSize < 0 || c.DownloadPartSize > 2000 {
+ if c.DownloadPartSize < 0 || c.DownloadPartSize > 100 {
return util.NewI18nError(
fmt.Errorf("invalid download part size: %v", c.DownloadPartSize),
util.I18nErrorDLPartSizeInvalid,
@@ -791,12 +734,6 @@ func (c *AzBlobFsConfig) isSameResource(other AzBlobFsConfig) bool {
if c.Endpoint != other.Endpoint {
return false
}
- if c.SASURL == nil {
- c.SASURL = kms.NewEmptySecret()
- }
- if other.SASURL == nil {
- other.SASURL = kms.NewEmptySecret()
- }
return c.SASURL.GetPayload() == other.SASURL.GetPayload()
}
@@ -827,7 +764,7 @@ func (c *AzBlobFsConfig) validate() error {
if err := c.checkPartSizeAndConcurrency(); err != nil {
return err
}
- if !slices.Contains(validAzAccessTier, c.AccessTier) {
+ if !util.Contains(validAzAccessTier, c.AccessTier) {
return fmt.Errorf("invalid access tier %q, valid values: \"''%v\"", c.AccessTier, strings.Join(validAzAccessTier, ", "))
}
return nil
@@ -896,25 +833,25 @@ func (c *CryptFsConfig) validate() error {
return nil
}
-// pipeWriter defines a wrapper for a pipeWriterAt.
+// pipeWriter defines a wrapper for pipeat.PipeWriterAt.
type pipeWriter struct {
- pipeWriterAt
+ *pipeat.PipeWriterAt
err error
done chan bool
}
// NewPipeWriter initializes a new PipeWriter
-func NewPipeWriter(w pipeWriterAt) PipeWriter {
+func NewPipeWriter(w *pipeat.PipeWriterAt) PipeWriter {
return &pipeWriter{
- pipeWriterAt: w,
+ PipeWriterAt: w,
err: nil,
done: make(chan bool),
}
}
-// Close waits for the upload to end, closes the pipeWriterAt and returns an error if any.
+// Close waits for the upload to end, closes the pipeat.PipeWriterAt and returns an error if any.
func (p *pipeWriter) Close() error {
- p.pipeWriterAt.Close() //nolint:errcheck // the returned error is always null
+ p.PipeWriterAt.Close() //nolint:errcheck // the returned error is always null
<-p.done
return p.err
}
@@ -926,10 +863,10 @@ func (p *pipeWriter) Done(err error) {
p.done <- true
}
-func newPipeWriterAtOffset(w pipeWriterAt, offset int64) PipeWriter {
+func newPipeWriterAtOffset(w *pipeat.PipeWriterAt, offset int64) PipeWriter {
return &pipeWriterAtOffset{
pipeWriter: &pipeWriter{
- pipeWriterAt: w,
+ PipeWriterAt: w,
err: nil,
done: make(chan bool),
},
@@ -958,15 +895,15 @@ func (p *pipeWriterAtOffset) Write(buf []byte) (int, error) {
}
// NewPipeReader initializes a new PipeReader
-func NewPipeReader(r pipeReaderAt) PipeReader {
+func NewPipeReader(r *pipeat.PipeReaderAt) PipeReader {
return &pipeReader{
- pipeReaderAt: r,
+ PipeReaderAt: r,
}
}
// pipeReader defines a wrapper for pipeat.PipeReaderAt.
type pipeReader struct {
- pipeReaderAt
+ *pipeat.PipeReaderAt
mu sync.RWMutex
metadata map[string]string
}
@@ -1146,7 +1083,7 @@ func IsUploadResumeSupported(fs Fs, size int64) bool {
}
func getLastModified(metadata map[string]string) int64 {
- if val, ok := metadata[lastModifiedField]; ok && val != "" {
+ if val, ok := metadata[lastModifiedField]; ok {
lastModified, err := strconv.ParseInt(val, 10, 64)
if err == nil {
return lastModified
@@ -1157,7 +1094,7 @@ func getLastModified(metadata map[string]string) int64 {
func getAzureLastModified(metadata map[string]*string) int64 {
for k, v := range metadata {
- if strings.EqualFold(k, lastModifiedField) {
+ if strings.ToLower(k) == lastModifiedField {
if val := util.GetStringFromPointer(v); val != "" {
lastModified, err := strconv.ParseInt(val, 10, 64)
if err == nil {
@@ -1229,8 +1166,8 @@ func getLocalTempDir() string {
}
func doRecursiveRename(fs Fs, source, target string,
- renameFn func(string, string, os.FileInfo, int, bool) (int, int64, error),
- recursion int, updateModTime bool,
+ renameFn func(string, string, os.FileInfo, int) (int, int64, error),
+ recursion int,
) (int, int64, error) {
var numFiles int
var filesSize int64
@@ -1255,7 +1192,7 @@ func doRecursiveRename(fs Fs, source, target string,
for _, info := range entries {
sourceEntry := fs.Join(source, info.Name())
targetEntry := fs.Join(target, info.Name())
- files, size, err := renameFn(sourceEntry, targetEntry, info, recursion, updateModTime)
+ files, size, err := renameFn(sourceEntry, targetEntry, info, recursion)
if err != nil {
if fs.IsNotExist(err) {
fsLog(fs, logger.LevelInfo, "skipping rename for %q: %v", sourceEntry, err)
@@ -1272,88 +1209,6 @@ func doRecursiveRename(fs Fs, source, target string,
}
}
-// copied from rclone
-func readFill(r io.Reader, buf []byte) (n int, err error) {
- var nn int
- for n < len(buf) && err == nil {
- nn, err = r.Read(buf[n:])
- n += nn
- }
- return n, err
-}
-
-func writeAtFull(w io.WriterAt, buf []byte, offset int64, count int) error {
- written := 0
- for written < count {
- n, err := w.WriteAt(buf[written:count], offset+int64(written))
- written += n
- if err != nil {
- return err
- }
- }
- return nil
-}
-
-type bytesReaderWrapper struct {
- *bytes.Reader
-}
-
-func (b *bytesReaderWrapper) Close() error {
- return nil
-}
-
-type bufferAllocator struct {
- sync.Mutex
- available [][]byte
- bufferSize int
- finalized bool
-}
-
-func newBufferAllocator(size int) *bufferAllocator {
- return &bufferAllocator{
- bufferSize: size,
- finalized: false,
- }
-}
-
-func (b *bufferAllocator) getBuffer() []byte {
- b.Lock()
- defer b.Unlock()
-
- if len(b.available) > 0 {
- var result []byte
-
- truncLength := len(b.available) - 1
- result = b.available[truncLength]
-
- b.available[truncLength] = nil
- b.available = b.available[:truncLength]
-
- return result
- }
-
- return make([]byte, b.bufferSize)
-}
-
-func (b *bufferAllocator) releaseBuffer(buf []byte) {
- b.Lock()
- defer b.Unlock()
-
- if b.finalized || len(buf) != b.bufferSize {
- return
- }
-
- b.available = append(b.available, buf)
-}
-
-func (b *bufferAllocator) free() {
- b.Lock()
- defer b.Unlock()
-
- b.available = nil
- b.finalized = true
-}
-
func fsLog(fs Fs, level logger.LogLevel, format string, v ...any) {
logger.Log(level, fs.Name(), fs.ConnectionID(), format, v...)
}
diff --git a/internal/webdavd/file.go b/internal/webdavd/file.go
index 88cc6bde..345c2714 100644
--- a/internal/webdavd/file.go
+++ b/internal/webdavd/file.go
@@ -23,11 +23,11 @@ import (
"net/http"
"os"
"path"
- "slices"
"sync/atomic"
"time"
"github.com/drakkan/webdav"
+ "github.com/eikenb/pipeat"
"github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/dataprovider"
@@ -51,7 +51,7 @@ type webDavFile struct {
readTried atomic.Bool
}
-func newWebDavFile(baseTransfer *common.BaseTransfer, pipeWriter vfs.PipeWriter, pipeReader vfs.PipeReader) *webDavFile {
+func newWebDavFile(baseTransfer *common.BaseTransfer, pipeWriter vfs.PipeWriter, pipeReader *pipeat.PipeReaderAt) *webDavFile {
var writer io.WriteCloser
var reader io.ReadCloser
if baseTransfer.File != nil {
@@ -165,7 +165,7 @@ func (f *webDavFile) checkFirstRead() error {
if !f.Connection.User.HasPerm(dataprovider.PermDownload, path.Dir(f.GetVirtualPath())) {
return f.Connection.GetPermissionDeniedError()
}
- transferQuota := f.GetTransferQuota()
+ transferQuota := f.BaseTransfer.GetTransferQuota()
if !transferQuota.HasDownloadSpace() {
f.Connection.Log(logger.LevelInfo, "denying file read due to quota limits")
return f.Connection.GetReadQuotaExceededError()
@@ -212,7 +212,7 @@ func (f *webDavFile) Read(p []byte) (n int, err error) {
} else if r != nil {
f.reader = r
}
- f.SetCancelFn(cancelFn)
+ f.BaseTransfer.SetCancelFn(cancelFn)
}
f.ErrTransfer = e
f.startOffset = 0
@@ -322,10 +322,9 @@ func (f *webDavFile) Seek(offset int64, whence int) (int64, error) {
if f.GetType() == common.TransferDownload {
readOffset := f.startOffset + f.BytesSent.Load()
if offset == 0 && readOffset == 0 {
- switch whence {
- case io.SeekStart:
+ if whence == io.SeekStart {
return 0, nil
- case io.SeekEnd:
+ } else if whence == io.SeekEnd {
if err := f.updateStatInfo(); err != nil {
return 0, err
}
@@ -364,7 +363,7 @@ func (f *webDavFile) Seek(offset int64, whence int) (int64, error) {
f.reader = r
}
f.ErrTransfer = err
- f.SetCancelFn(cancelFn)
+ f.BaseTransfer.SetCancelFn(cancelFn)
f.Unlock()
return startByte, err
@@ -404,7 +403,7 @@ func (f *webDavFile) closeIO() error {
} else if f.reader != nil {
err = f.reader.Close()
if metadater, ok := f.reader.(vfs.Metadater); ok {
- f.SetMetadata(metadater.Metadata())
+ f.BaseTransfer.SetMetadata(metadater.Metadata())
}
}
return err
@@ -448,11 +447,11 @@ func (f *webDavFile) Patch(patches []webdav.Proppatch) ([]webdav.Propstat, error
pstat := webdav.Propstat{}
for _, p := range patch.Props {
if status == http.StatusForbidden && !hasError {
- if !patch.Remove && slices.Contains(lastModifiedProps, p.XMLName.Local) {
+ if !patch.Remove && util.Contains(lastModifiedProps, p.XMLName.Local) {
parsed, err := parseTime(util.BytesToString(p.InnerXML))
if err != nil {
f.Connection.Log(logger.LevelWarn, "unsupported last modification time: %q, err: %v",
- p.InnerXML, err)
+ util.BytesToString(p.InnerXML), err)
hasError = true
continue
}
diff --git a/internal/webdavd/handler.go b/internal/webdavd/handler.go
index 2fc3ca1b..674b5b72 100644
--- a/internal/webdavd/handler.go
+++ b/internal/webdavd/handler.go
@@ -36,17 +36,6 @@ import (
type Connection struct {
*common.BaseConnection
request *http.Request
- rc *http.ResponseController
-}
-
-func newConnection(conn *common.BaseConnection, w http.ResponseWriter, r *http.Request) *Connection {
- rc := http.NewResponseController(w)
- responseControllerDeadlines(rc, time.Time{}, time.Time{})
- return &Connection{
- BaseConnection: conn,
- request: r,
- rc: rc,
- }
}
func (c *Connection) getModificationTime() time.Time {
@@ -84,9 +73,6 @@ func (c *Connection) GetRemoteAddress() string {
// Disconnect closes the active transfer
func (c *Connection) Disconnect() error {
- if c.rc != nil {
- responseControllerDeadlines(c.rc, time.Now().Add(5*time.Second), time.Now().Add(5*time.Second))
- }
return c.SignalTransfersAbort()
}
@@ -159,11 +145,6 @@ func (c *Connection) RemoveAll(_ context.Context, name string) error {
func (c *Connection) OpenFile(_ context.Context, name string, flag int, _ os.FileMode) (webdav.File, error) {
c.UpdateLastActivity()
- if err := common.Connections.IsNewTransferAllowed(c.User.Username); err != nil {
- c.Log(logger.LevelInfo, "denying transfer due to count limits")
- return nil, c.GetPermissionDeniedError()
- }
-
name = util.CleanPath(name)
fs, p, err := c.GetFsAndResolvedPath(name)
if err != nil {
@@ -273,7 +254,7 @@ func (c *Connection) handleUploadToExistingFile(fs vfs.Fs, resolvedPath, filePat
maxWriteSize, _ := c.GetMaxWriteSize(diskQuota, false, fileSize, fs.IsUploadResumeSupported())
if common.Config.IsAtomicUploadEnabled() && fs.IsAtomicUploadSupported() {
- _, _, err = fs.Rename(resolvedPath, filePath, 0)
+ _, _, err = fs.Rename(resolvedPath, filePath)
if err != nil {
c.Log(logger.LevelError, "error renaming existing file for atomic upload, source: %q, dest: %q, err: %+v",
resolvedPath, filePath, err)
@@ -291,7 +272,10 @@ func (c *Connection) handleUploadToExistingFile(fs vfs.Fs, resolvedPath, filePat
if vfs.HasTruncateSupport(fs) {
vfolder, err := c.User.GetVirtualFolderForPath(path.Dir(requestPath))
if err == nil {
- dataprovider.UpdateUserFolderQuota(&vfolder, &c.User, 0, -fileSize, false)
+ dataprovider.UpdateVirtualFolderQuota(&vfolder.BaseVirtualFolder, 0, -fileSize, false) //nolint:errcheck
+ if vfolder.IsIncludedInUserQuota() {
+ dataprovider.UpdateUserQuota(&c.User, 0, -fileSize, false) //nolint:errcheck
+ }
} else {
dataprovider.UpdateUserQuota(&c.User, 0, -fileSize, false) //nolint:errcheck
}
diff --git a/internal/webdavd/internal_test.go b/internal/webdavd/internal_test.go
index 35f71035..0366c7d2 100644
--- a/internal/webdavd/internal_test.go
+++ b/internal/webdavd/internal_test.go
@@ -270,7 +270,6 @@ Ap157PUHTriSnxyMF2Sb3EhX/rQkmbnbCqqygHC14iBy8MrKzLG00X6BelZV5n0D
RKjnkiEZeG4+G91Xu7+HmcBLwV86k5I+tXK9O1Okomr6Zry8oqVcxU5TB6VRS+rA
ubwF00Drdvk2+kDZfxIM137nBiy7wgCJi2Ksm5ihN3dUF6Q0oNPl
-----END RSA PRIVATE KEY-----`
- osWindows = "windows"
)
// MockOsFs mockable OsFs
@@ -313,7 +312,7 @@ func (fs *MockOsFs) Remove(name string, _ bool) error {
}
// Rename renames (moves) source to target
-func (fs *MockOsFs) Rename(source, target string, _ int) (int, int64, error) {
+func (fs *MockOsFs) Rename(source, target string) (int, int64, error) {
err := os.Rename(source, target)
return -1, -1, err
}
@@ -379,15 +378,6 @@ func TestAllowedProxyUnixDomainSocket(t *testing.T) {
}
}
-func TestProxyListenerWrapper(t *testing.T) {
- b := Binding{
- ProxyMode: 0,
- }
- require.Nil(t, b.listenerWrapper())
- b.ProxyMode = 1
- require.NotNil(t, b.listenerWrapper())
-}
-
func TestRemoteAddress(t *testing.T) {
remoteAddr1 := "100.100.100.100"
remoteAddr2 := "172.172.172.172"
@@ -524,7 +514,7 @@ func TestResolvePathErrors(t *testing.T) {
assert.EqualError(t, err, common.ErrGenericFailure.Error())
}
- if runtime.GOOS != osWindows {
+ if runtime.GOOS != "windows" {
user.HomeDir = filepath.Clean(os.TempDir())
connection.User = user
fs := vfs.NewOsFs("connID", connection.User.HomeDir, "", nil)
@@ -761,8 +751,6 @@ func TestContentType(t *testing.T) {
assert.NoError(t, err)
assert.Equal(t, "application/sftpgo", ctype)
}
- err = davFile.Close()
- assert.NoError(t, err)
baseTransfer = common.NewBaseTransfer(nil, connection.BaseConnection, nil, testFilePath, testFilePath, testFile+".unknown2",
common.TransferDownload, 0, 0, 0, 0, false, fs, dataprovider.TransferQuota{})
@@ -809,7 +797,7 @@ func TestTransferReadWriteErrors(t *testing.T) {
r, w, err := pipeat.Pipe()
assert.NoError(t, err)
- davFile = newWebDavFile(baseTransfer, nil, vfs.NewPipeReader(r))
+ davFile = newWebDavFile(baseTransfer, nil, r)
davFile.Connection.RemoveTransfer(davFile.BaseTransfer)
davFile = newWebDavFile(baseTransfer, vfs.NewPipeWriter(w), nil)
davFile.Connection.RemoveTransfer(davFile.BaseTransfer)
@@ -817,8 +805,6 @@ func TestTransferReadWriteErrors(t *testing.T) {
assert.NoError(t, err)
err = w.Close()
assert.NoError(t, err)
- err = davFile.BaseTransfer.Close()
- assert.Error(t, err)
baseTransfer = common.NewBaseTransfer(nil, connection.BaseConnection, nil, testFilePath, testFilePath, testFile,
common.TransferDownload, 0, 0, 0, 0, false, fs, dataprovider.TransferQuota{})
@@ -827,8 +813,6 @@ func TestTransferReadWriteErrors(t *testing.T) {
assert.True(t, fs.IsNotExist(err))
_, err = davFile.Stat()
assert.True(t, fs.IsNotExist(err))
- err = davFile.Close()
- assert.Error(t, err)
baseTransfer = common.NewBaseTransfer(nil, connection.BaseConnection, nil, testFilePath, testFilePath, testFile,
common.TransferDownload, 0, 0, 0, 0, false, fs, dataprovider.TransferQuota{})
@@ -851,8 +835,6 @@ func TestTransferReadWriteErrors(t *testing.T) {
if assert.NoError(t, err) {
assert.Equal(t, int64(0), info.Size())
}
- err = davFile.Close()
- assert.Error(t, err)
r, w, err = pipeat.Pipe()
assert.NoError(t, err)
@@ -996,11 +978,8 @@ func TestTransferSeek(t *testing.T) {
res, err = davFile.Seek(2, io.SeekEnd)
assert.True(t, fs.IsNotExist(err))
assert.Equal(t, int64(0), res)
- err = davFile.Close()
- assert.NoError(t, err)
assert.Len(t, common.Connections.GetStats(""), 0)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
err = os.Remove(testFilePath)
assert.NoError(t, err)
@@ -1497,11 +1476,8 @@ func TestUserCacheIsolation(t *testing.T) {
LockSystem: webdav.NewMemLS(),
}
cachedUser.User.FsConfig.S3Config.AccessSecret = kms.NewPlainSecret("test secret")
- cachedUser.User.FsConfig.S3Config.SSECustomerKey = kms.NewPlainSecret("test key")
err = cachedUser.User.FsConfig.S3Config.AccessSecret.Encrypt()
assert.NoError(t, err)
- err = cachedUser.User.FsConfig.S3Config.SSECustomerKey.Encrypt()
- assert.NoError(t, err)
dataprovider.CacheWebDAVUser(cachedUser)
cachedUser, ok := dataprovider.GetCachedWebDAVUser(username)
@@ -1515,9 +1491,6 @@ func TestUserCacheIsolation(t *testing.T) {
assert.True(t, cachedUser.User.FsConfig.S3Config.AccessSecret.IsEncrypted())
err = cachedUser.User.FsConfig.S3Config.AccessSecret.Decrypt()
assert.NoError(t, err)
- assert.True(t, cachedUser.User.FsConfig.S3Config.SSECustomerKey.IsEncrypted())
- err = cachedUser.User.FsConfig.S3Config.SSECustomerKey.Decrypt()
- assert.NoError(t, err)
cachedUser.User.FsConfig.Provider = sdk.S3FilesystemProvider
_, err = cachedUser.User.GetFilesystem("")
assert.Error(t, err, "we don't have to get the previously cached filesystem!")
@@ -1526,7 +1499,6 @@ func TestUserCacheIsolation(t *testing.T) {
if assert.True(t, ok) {
assert.Equal(t, sdk.LocalFilesystemProvider, cachedUser.User.FsConfig.Provider)
assert.False(t, cachedUser.User.FsConfig.S3Config.AccessSecret.IsEncrypted())
- assert.False(t, cachedUser.User.FsConfig.S3Config.SSECustomerKey.IsEncrypted())
}
err = dataprovider.DeleteUser(username, "", "", "")
@@ -1741,68 +1713,3 @@ func TestGetCacheExpirationTime(t *testing.T) {
c.ExpirationTime = 1
assert.False(t, c.getExpirationTime().IsZero())
}
-
-func TestBindingGetAddress(t *testing.T) {
- tests := []struct {
- name string
- binding Binding
- want string
- }{
- {
- name: "IP address with port",
- binding: Binding{Address: "127.0.0.1", Port: 8080},
- want: "127.0.0.1:8080",
- },
- {
- name: "Unix socket path (no port)",
- binding: Binding{Address: "/tmp/app.sock", Port: 0},
- want: "/tmp/app.sock",
- },
- }
-
- for _, tt := range tests {
- t.Run(tt.name, func(t *testing.T) {
- if got := tt.binding.GetAddress(); got != tt.want {
- t.Errorf("GetAddress() = %v, want %v", got, tt.want)
- }
- })
- }
-}
-
-func TestBindingIsValid(t *testing.T) {
- tests := []struct {
- name string
- binding Binding
- want bool
- }{
- {
- name: "Valid: Positive port",
- binding: Binding{Address: "127.0.0.1", Port: 10080},
- want: true,
- },
- {
- name: "Valid: Absolute path on Unix (non-Windows)",
- binding: Binding{Address: "/var/run/app.sock", Port: 0},
- // This test outcome is dynamic based on the OS
- want: runtime.GOOS != osWindows,
- },
- {
- name: "Invalid: Port 0 and relative path",
- binding: Binding{Address: "relative/path", Port: 0},
- want: false,
- },
- {
- name: "Invalid: Empty address and port 0",
- binding: Binding{Address: "", Port: 0},
- want: false,
- },
- }
-
- for _, tt := range tests {
- t.Run(tt.name, func(t *testing.T) {
- if got := tt.binding.IsValid(); got != tt.want {
- t.Errorf("IsValid() = %v, want %v", got, tt.want)
- }
- })
- }
-}
diff --git a/internal/webdavd/server.go b/internal/webdavd/server.go
index 06533320..aad07040 100644
--- a/internal/webdavd/server.go
+++ b/internal/webdavd/server.go
@@ -26,7 +26,6 @@ import (
"path"
"path/filepath"
"runtime/debug"
- "slices"
"strings"
"time"
@@ -34,7 +33,6 @@ import (
"github.com/go-chi/chi/v5/middleware"
"github.com/rs/cors"
"github.com/rs/xid"
- "github.com/rs/zerolog"
"github.com/sftpgo/sdk/plugin/notifier"
"github.com/drakkan/sftpgo/v2/internal/common"
@@ -55,6 +53,8 @@ func (s *webDavServer) listenAndServe(compressor *middleware.Compressor) error {
handler := compressor.Handler(s)
httpServer := &http.Server{
ReadHeaderTimeout: 30 * time.Second,
+ ReadTimeout: 60 * time.Second,
+ WriteTimeout: 60 * time.Second,
IdleTimeout: 60 * time.Second,
MaxHeaderBytes: 1 << 16, // 64KB
ErrorLog: log.New(&logger.StdLoggerWrapper{Sender: logSender}, "", 0),
@@ -98,13 +98,11 @@ func (s *webDavServer) listenAndServe(compressor *middleware.Compressor) error {
httpServer.TLSConfig.ClientAuth = tls.VerifyClientCertIfGiven
}
}
- return util.HTTPListenAndServe(httpServer, s.binding.Address, s.binding.Port, true,
- s.binding.listenerWrapper(), logSender)
+ return util.HTTPListenAndServe(httpServer, s.binding.Address, s.binding.Port, true, logSender)
}
s.binding.EnableHTTPS = false
serviceStatus.Bindings = append(serviceStatus.Bindings, s.binding)
- return util.HTTPListenAndServe(httpServer, s.binding.Address, s.binding.Port, false,
- s.binding.listenerWrapper(), logSender)
+ return util.HTTPListenAndServe(httpServer, s.binding.Address, s.binding.Port, false, logSender)
}
func (s *webDavServer) verifyTLSConnection(state tls.ConnectionState) error {
@@ -168,11 +166,6 @@ func (s *webDavServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
}
}()
- responseControllerDeadlines(
- http.NewResponseController(w),
- time.Now().Add(60*time.Second),
- time.Now().Add(60*time.Second),
- )
w.Header().Set("Server", version.GetServerVersion("/", false))
ipAddr := s.checkRemoteAddress(r)
@@ -213,7 +206,7 @@ func (s *webDavServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
if err != nil {
// remove the cached user, we have not yet validated its filesystem
dataprovider.RemoveCachedWebDAVUser(user.Username)
- updateLoginMetrics(&user, ipAddr, loginMethod, err, r)
+ updateLoginMetrics(&user, ipAddr, loginMethod, err)
http.Error(w, err.Error(), http.StatusForbidden)
return
}
@@ -226,24 +219,26 @@ func (s *webDavServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
if err != nil {
errClose := user.CloseFs()
logger.Warn(logSender, connectionID, "unable to check fs root: %v close fs error: %v", err, errClose)
- updateLoginMetrics(&user, ipAddr, loginMethod, common.ErrInternalFailure, r)
+ updateLoginMetrics(&user, ipAddr, loginMethod, common.ErrInternalFailure)
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
- baseConn := common.NewBaseConnection(connectionID, common.ProtocolWebDAV, util.GetHTTPLocalAddress(r),
- r.RemoteAddr, user)
- connection := newConnection(baseConn, w, r)
+ connection := &Connection{
+ BaseConnection: common.NewBaseConnection(connectionID, common.ProtocolWebDAV, util.GetHTTPLocalAddress(r),
+ r.RemoteAddr, user),
+ request: r,
+ }
if err = common.Connections.Add(connection); err != nil {
errClose := user.CloseFs()
logger.Warn(logSender, connectionID, "unable add connection: %v close fs error: %v", err, errClose)
- updateLoginMetrics(&user, ipAddr, loginMethod, err, r)
+ updateLoginMetrics(&user, ipAddr, loginMethod, err)
http.Error(w, err.Error(), http.StatusTooManyRequests)
return
}
defer common.Connections.Remove(connection.GetID())
- updateLoginMetrics(&user, ipAddr, loginMethod, err, r)
+ updateLoginMetrics(&user, ipAddr, loginMethod, err)
ctx := context.WithValue(r.Context(), requestIDKey, connectionID)
ctx = context.WithValue(ctx, requestStartKey, time.Now())
@@ -320,7 +315,7 @@ func (s *webDavServer) authenticate(r *http.Request, ip string) (dataprovider.Us
dataprovider.CacheWebDAVUser(cachedUser)
return cachedUser.User, false, cachedUser.LockSystem, loginMethod, nil
}
- updateLoginMetrics(&cachedUser.User, ip, loginMethod, dataprovider.ErrInvalidCredentials, r)
+ updateLoginMetrics(&cachedUser.User, ip, loginMethod, dataprovider.ErrInvalidCredentials)
return user, false, nil, loginMethod, dataprovider.ErrInvalidCredentials
}
}
@@ -328,7 +323,7 @@ func (s *webDavServer) authenticate(r *http.Request, ip string) (dataprovider.Us
common.ProtocolWebDAV, tlsCert)
if err != nil {
user.Username = username
- updateLoginMetrics(&user, ip, loginMethod, err, r)
+ updateLoginMetrics(&user, ip, loginMethod, err)
return user, false, nil, loginMethod, dataprovider.ErrInvalidCredentials
}
lockSystem := webdav.NewMemLS()
@@ -351,7 +346,7 @@ func (s *webDavServer) validateUser(user *dataprovider.User, r *http.Request, lo
user.Username, user.HomeDir)
return connID, fmt.Errorf("cannot login user with invalid home dir: %q", user.HomeDir)
}
- if slices.Contains(user.Filters.DeniedProtocols, common.ProtocolWebDAV) {
+ if util.Contains(user.Filters.DeniedProtocols, common.ProtocolWebDAV) {
logger.Info(logSender, connectionID, "cannot login user %q, protocol DAV is not allowed", user.Username)
return connID, fmt.Errorf("protocol DAV is not allowed for user %q", user.Username)
}
@@ -390,30 +385,17 @@ func (s *webDavServer) checkRemoteAddress(r *http.Request) string {
return ipAddr
}
-func responseControllerDeadlines(rc *http.ResponseController, read, write time.Time) {
- if err := rc.SetReadDeadline(read); err != nil {
- logger.Error(logSender, "", "unable to set read timeout to %s: %v", read, err)
- }
- if err := rc.SetWriteDeadline(write); err != nil {
- logger.Error(logSender, "", "unable to set write timeout to %s: %v", write, err)
- }
-}
-
func writeLog(r *http.Request, status int, err error) {
scheme := "http"
- cipherSuite := ""
if r.TLS != nil {
scheme = "https"
- cipherSuite = tls.CipherSuiteName(r.TLS.CipherSuite)
}
fields := map[string]any{
- "remote_addr": r.RemoteAddr,
- "proto": r.Proto,
- "method": r.Method,
- "user_agent": r.UserAgent(),
- "uri": fmt.Sprintf("%s://%s%s", scheme, r.Host, r.RequestURI),
- "cipher_suite": cipherSuite,
- }
+ "remote_addr": r.RemoteAddr,
+ "proto": r.Proto,
+ "method": r.Method,
+ "user_agent": r.UserAgent(),
+ "uri": fmt.Sprintf("%s://%s%s", scheme, r.Host, r.RequestURI)}
if reqID, ok := r.Context().Value(requestIDKey).(string); ok {
fields["request_id"] = reqID
}
@@ -432,15 +414,7 @@ func writeLog(r *http.Request, status int, err error) {
if status != 0 {
fields["resp_status"] = status
}
- var ev *zerolog.Event
- if status >= http.StatusInternalServerError {
- ev = logger.GetLogger().Error()
- } else if status >= http.StatusBadRequest {
- ev = logger.GetLogger().Warn()
- } else {
- ev = logger.GetLogger().Debug()
- }
- ev.
+ logger.GetLogger().Info().
Timestamp().
Str("sender", logSender).
Fields(fields).
@@ -448,10 +422,9 @@ func writeLog(r *http.Request, status int, err error) {
Send()
}
-func updateLoginMetrics(user *dataprovider.User, ip, loginMethod string, err error, r *http.Request) {
+func updateLoginMetrics(user *dataprovider.User, ip, loginMethod string, err error) {
metric.AddLoginAttempt(loginMethod)
if err == nil {
- logger.LoginLog(user.Username, ip, loginMethod, common.ProtocolWebDAV, "", r.UserAgent(), r.TLS != nil, "")
plugin.Handler.NotifyLogEvent(notifier.LogEventTypeLoginOK, common.ProtocolWebDAV, user.Username, ip, "", nil)
common.DelayLogin(nil)
} else if err != common.ErrInternalFailure && err != common.ErrNoCredentials {
diff --git a/internal/webdavd/webdavd.go b/internal/webdavd/webdavd.go
index 36b3b33c..62d37568 100644
--- a/internal/webdavd/webdavd.go
+++ b/internal/webdavd/webdavd.go
@@ -21,7 +21,6 @@ import (
"net/http"
"os"
"path/filepath"
- "runtime"
"time"
"github.com/go-chi/chi/v5/middleware"
@@ -139,9 +138,6 @@ type Binding struct {
// Prefix for WebDAV resources, if empty WebDAV resources will be available at the
// root ("/") URI. If defined it must be an absolute URI.
Prefix string `json:"prefix" mapstructure:"prefix"`
- // Defines whether to use the common proxy protocol configuration or the
- // binding-specific proxy header configuration.
- ProxyMode int `json:"proxy_mode" mapstructure:"proxy_mode"`
// List of IP addresses and IP ranges allowed to set client IP proxy headers
ProxyAllowed []string `json:"proxy_allowed" mapstructure:"proxy_allowed"`
// Allowed client IP proxy header such as "X-Forwarded-For", "X-Real-IP"
@@ -177,28 +173,12 @@ func (b *Binding) isMutualTLSEnabled() bool {
// GetAddress returns the binding address
func (b *Binding) GetAddress() string {
- if b.Port > 0 {
- return fmt.Sprintf("%s:%d", b.Address, b.Port)
- }
- return b.Address
+ return fmt.Sprintf("%s:%d", b.Address, b.Port)
}
-// IsValid returns true if the binding is valid
+// IsValid returns true if the binding port is > 0
func (b *Binding) IsValid() bool {
- if b.Port > 0 {
- return true
- }
- if filepath.IsAbs(b.Address) && runtime.GOOS != "windows" {
- return true
- }
- return false
-}
-
-func (b *Binding) listenerWrapper() func(net.Listener) (net.Listener, error) {
- if b.ProxyMode == 1 {
- return common.Config.GetProxyListener
- }
- return nil
+ return b.Port > 0
}
// Configuration defines the configuration for the WevDAV server
diff --git a/internal/webdavd/webdavd_test.go b/internal/webdavd/webdavd_test.go
index f7985c34..2c09d516 100644
--- a/internal/webdavd/webdavd_test.go
+++ b/internal/webdavd/webdavd_test.go
@@ -38,13 +38,11 @@ import (
"time"
"github.com/minio/sio"
- "github.com/pkg/sftp"
"github.com/rs/zerolog"
"github.com/sftpgo/sdk"
sdkkms "github.com/sftpgo/sdk/kms"
"github.com/stretchr/testify/assert"
"github.com/studio-b12/gowebdav"
- "golang.org/x/crypto/ssh"
"github.com/drakkan/sftpgo/v2/internal/common"
"github.com/drakkan/sftpgo/v2/internal/config"
@@ -639,7 +637,6 @@ func TestBasicHandling(t *testing.T) {
assert.NoError(t, err)
assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 },
1*time.Second, 100*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
status := webdavd.GetStatus()
assert.True(t, status.IsActive)
}
@@ -724,7 +721,6 @@ func TestBasicHandlingCryptFs(t *testing.T) {
assert.NoError(t, err)
assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 },
1*time.Second, 100*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
}
func TestBufferedUser(t *testing.T) {
@@ -1014,8 +1010,6 @@ func TestRenameWithLock(t *testing.T) {
err = resp.Body.Close()
assert.NoError(t, err)
- err = os.Remove(testFilePath)
- assert.NoError(t, err)
_, err = httpdtest.RemoveUser(user, http.StatusOK)
assert.NoError(t, err)
err = os.RemoveAll(user.GetHomeDir())
@@ -1083,7 +1077,6 @@ func TestPropPatch(t *testing.T) {
assert.NoError(t, err)
assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 },
1*time.Second, 100*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
}
func TestLoginInvalidPwd(t *testing.T) {
@@ -1527,7 +1520,6 @@ func TestPreDownloadHook(t *testing.T) {
assert.NoError(t, err)
assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 },
1*time.Second, 100*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
common.Config.Actions.ExecuteOn = []string{common.OperationPreDownload}
common.Config.Actions.Hook = preDownloadPath
@@ -1578,7 +1570,6 @@ func TestPreUploadHook(t *testing.T) {
assert.NoError(t, err)
assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 },
1*time.Second, 100*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
common.Config.Actions.ExecuteOn = oldExecuteOn
common.Config.Actions.Hook = oldHook
@@ -1642,7 +1633,6 @@ func TestMaxConnections(t *testing.T) {
assert.NoError(t, err)
assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 },
1*time.Second, 100*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
common.Config.MaxTotalConnections = oldValue
}
@@ -1675,61 +1665,6 @@ func TestMaxPerHostConnections(t *testing.T) {
assert.NoError(t, err)
assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 },
1*time.Second, 100*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
-
- common.Config.MaxPerHostConnections = oldValue
-}
-
-func TestMaxTransfers(t *testing.T) {
- oldValue := common.Config.MaxPerHostConnections
- common.Config.MaxPerHostConnections = 2
-
- assert.Eventually(t, func() bool {
- return common.Connections.GetClientConnections() == 0
- }, 1000*time.Millisecond, 50*time.Millisecond)
-
- user, _, err := httpdtest.AddUser(getTestUser(), http.StatusCreated)
- assert.NoError(t, err)
- client := getWebDavClient(user, true, nil)
- assert.NoError(t, checkBasicFunc(client))
-
- conn, sftpClient, err := getSftpClient(user)
- assert.NoError(t, err)
- defer conn.Close()
- defer sftpClient.Close()
-
- f1, err := sftpClient.Create("file1")
- assert.NoError(t, err)
- f2, err := sftpClient.Create("file2")
- assert.NoError(t, err)
- _, err = f1.Write([]byte(" "))
- assert.NoError(t, err)
- _, err = f2.Write([]byte(" "))
- assert.NoError(t, err)
-
- testFilePath := filepath.Join(homeBasePath, testFileName)
- testFileSize := int64(65535)
- err = createTestFile(testFilePath, testFileSize)
- assert.NoError(t, err)
- err = uploadFileWithRawClient(testFilePath, testFileName, user.Username, defaultPassword,
- false, testFileSize, client)
- assert.Error(t, err)
-
- err = os.Remove(testFilePath)
- assert.NoError(t, err)
-
- err = f1.Close()
- assert.NoError(t, err)
- err = f2.Close()
- assert.NoError(t, err)
-
- _, err = httpdtest.RemoveUser(user, http.StatusOK)
- assert.NoError(t, err)
- err = os.RemoveAll(user.GetHomeDir())
- assert.NoError(t, err)
- assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 },
- 1*time.Second, 100*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
common.Config.MaxPerHostConnections = oldValue
}
@@ -1777,7 +1712,6 @@ func TestMaxSessions(t *testing.T) {
assert.NoError(t, err)
assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 },
1*time.Second, 100*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
}
func TestLoginWithIPilters(t *testing.T) {
@@ -2237,7 +2171,6 @@ func TestClientClose(t *testing.T) {
wg.Wait()
assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 },
1*time.Second, 100*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
err = os.Remove(localDownloadPath)
assert.NoError(t, err)
@@ -2255,7 +2188,7 @@ func TestLoginWithDatabaseCredentials(t *testing.T) {
u := getTestUser()
u.FsConfig.Provider = sdk.GCSFilesystemProvider
u.FsConfig.GCSConfig.Bucket = "test"
- u.FsConfig.GCSConfig.Credentials = kms.NewPlainSecret(`{ "type": "service_account", "private_key": " ", "client_email": "example@iam.gserviceaccount.com" }`)
+ u.FsConfig.GCSConfig.Credentials = kms.NewPlainSecret(`{ "type": "service_account" }`)
user, _, err := httpdtest.AddUser(u, http.StatusCreated)
assert.NoError(t, err)
assert.Equal(t, sdkkms.SecretStatusSecretBox, user.FsConfig.GCSConfig.Credentials.GetStatus())
@@ -2606,7 +2539,6 @@ func TestStat(t *testing.T) {
func TestUploadOverwriteVfolder(t *testing.T) {
u := getTestUser()
- u.QuotaFiles = 1000
vdir := "/vdir"
mappedPath := filepath.Join(os.TempDir(), "mappedDir")
folderName := filepath.Base(mappedPath)
@@ -2653,25 +2585,15 @@ func TestUploadOverwriteVfolder(t *testing.T) {
assert.NoError(t, err)
folder, _, err := httpdtest.GetFolderByName(folderName, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), folder.UsedQuotaSize)
- assert.Equal(t, 0, folder.UsedQuotaFiles)
- user, _, err = httpdtest.GetUserByUsername(user.Username, http.StatusOK)
- assert.NoError(t, err)
- assert.Equal(t, testFileSize, user.UsedQuotaSize)
- assert.Equal(t, 1, user.UsedQuotaFiles)
-
+ assert.Equal(t, testFileSize, folder.UsedQuotaSize)
+ assert.Equal(t, 1, folder.UsedQuotaFiles)
err = uploadFileWithRawClient(testFilePath, path.Join(vdir, testFileName), user.Username,
defaultPassword, true, testFileSize, client)
assert.NoError(t, err)
folder, _, err = httpdtest.GetFolderByName(folderName, http.StatusOK)
assert.NoError(t, err)
- assert.Equal(t, int64(0), folder.UsedQuotaSize)
- assert.Equal(t, 0, folder.UsedQuotaFiles)
- user, _, err = httpdtest.GetUserByUsername(user.Username, http.StatusOK)
- assert.NoError(t, err)
- assert.Equal(t, testFileSize, user.UsedQuotaSize)
- assert.Equal(t, 1, user.UsedQuotaFiles)
-
+ assert.Equal(t, testFileSize, folder.UsedQuotaSize)
+ assert.Equal(t, 1, folder.UsedQuotaFiles)
err = os.Remove(testFilePath)
assert.NoError(t, err)
_, err = httpdtest.RemoveUser(user, http.StatusOK)
@@ -3343,7 +3265,6 @@ func TestNestedVirtualFolders(t *testing.T) {
assert.NoError(t, err)
assert.Eventually(t, func() bool { return len(common.Connections.GetStats("")) == 0 },
1*time.Second, 100*time.Millisecond)
- assert.Equal(t, int32(0), common.Connections.GetTotalTransfers())
}
func checkBasicFunc(client *gowebdav.Client) error {
@@ -3540,30 +3461,6 @@ func getTestUserWithCryptFs() dataprovider.User {
return user
}
-func getSftpClient(user dataprovider.User) (*ssh.Client, *sftp.Client, error) {
- var sftpClient *sftp.Client
- config := &ssh.ClientConfig{
- User: user.Username,
- HostKeyCallback: ssh.InsecureIgnoreHostKey(),
- Timeout: 5 * time.Second,
- }
- if user.Password != "" {
- config.Auth = []ssh.AuthMethod{ssh.Password(user.Password)}
- } else {
- config.Auth = []ssh.AuthMethod{ssh.Password(defaultPassword)}
- }
-
- conn, err := ssh.Dial("tcp", sftpServerAddr, config)
- if err != nil {
- return conn, sftpClient, err
- }
- sftpClient, err = sftp.NewClient(conn)
- if err != nil {
- conn.Close()
- }
- return conn, sftpClient, err
-}
-
func getEncryptedFileSize(size int64) (int64, error) {
encSize, err := sio.EncryptedSize(uint64(size))
return int64(encSize) + 33, err
diff --git a/main.go b/main.go
index 1d9cf48e..f147eb47 100644
--- a/main.go
+++ b/main.go
@@ -20,9 +20,17 @@
package main // import "github.com/drakkan/sftpgo"
import (
+ "fmt"
+
+ "go.uber.org/automaxprocs/maxprocs"
+
"github.com/drakkan/sftpgo/v2/internal/cmd"
)
func main() {
+ if undo, err := maxprocs.Set(); err != nil {
+ fmt.Printf("error setting max procs: %v\n", err)
+ undo()
+ }
cmd.Execute()
}
diff --git a/openapi/openapi.yaml b/openapi/openapi.yaml
index 32dc3dc7..e8d19819 100644
--- a/openapi/openapi.yaml
+++ b/openapi/openapi.yaml
@@ -29,7 +29,7 @@ info:
SFTPGo supports groups to simplify the administration of multiple accounts by letting you assign settings once to a group, instead of multiple times to each individual user.
The SFTPGo WebClient allows end users to change their credentials, browse and manage their files in the browser and setup two-factor authentication which works with Authy, Google Authenticator and other compatible apps.
From the WebClient each authorized user can also create HTTP/S links to externally share files and folders securely, by setting limits to the number of downloads/uploads, protecting the share with a password, limiting access by source IP address, setting an automatic expiration date.
- version: v2.7.0
+ version: 2.6.4
contact:
name: API support
url: 'https://github.com/drakkan/sftpgo'
@@ -1088,6 +1088,60 @@ paths:
$ref: '#/components/responses/InternalServerError'
default:
$ref: '#/components/responses/DefaultResponse'
+ /retention/users/{username}/check:
+ parameters:
+ - name: username
+ in: path
+ description: the username
+ required: true
+ schema:
+ type: string
+ - name: notifications
+ in: query
+ description: 'specify how to notify results'
+ explode: false
+ schema:
+ type: array
+ items:
+ $ref: '#/components/schemas/RetentionCheckNotification'
+ post:
+ tags:
+ - data retention
+ summary: Start a retention check
+ description: 'Starts a new retention check for the given user. If a retention check for this user is already active a 409 status code is returned'
+ operationId: start_user_retention_check
+ requestBody:
+ required: true
+ description: 'Defines virtual paths to check and their retention time in hours'
+ content:
+ application/json:
+ schema:
+ type: array
+ items:
+ $ref: '#/components/schemas/FolderRetention'
+ responses:
+ '202':
+ description: successful operation
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/ApiResponse'
+ example:
+ message: Check started
+ '400':
+ $ref: '#/components/responses/BadRequest'
+ '401':
+ $ref: '#/components/responses/Unauthorized'
+ '403':
+ $ref: '#/components/responses/Forbidden'
+ '404':
+ $ref: '#/components/responses/NotFound'
+ '409':
+ $ref: '#/components/responses/Conflict'
+ '500':
+ $ref: '#/components/responses/InternalServerError'
+ default:
+ $ref: '#/components/responses/DefaultResponse'
/quotas/users/scans:
get:
tags:
@@ -2678,7 +2732,7 @@ paths:
$ref: '#/components/responses/InternalServerError'
default:
$ref: '#/components/responses/DefaultResponse'
- /events/logs:
+ /events/log:
get:
tags:
- events
@@ -5088,6 +5142,15 @@ components:
* `shares-disabled` - sharing files and directories with external users is not allowed
* `password-reset-disabled` - resetting the password is not allowed
* `shares-without-password-disabled` - creating shares without password protection is not allowed
+ RetentionCheckNotification:
+ type: string
+ enum:
+ - Hook
+ - Email
+ description: |
+ Options:
+ * `Hook` - notify result using the defined hook. A "data_retention_hook" must be defined in your configuration file for this to work
+ * `Email` - notify results by email. The admin starting the retention check must have an associated email address and the SMTP server must be configured for this to work
APIKeyScope:
type: integer
enum:
@@ -5385,10 +5448,14 @@ components:
max_upload_file_size:
type: integer
format: int64
- description: 'maximum allowed size, as bytes, for a single file upload. The upload will be aborted if/when the size of the file being sent exceeds this limit. 0 means unlimited'
+ description: 'maximum allowed size, as bytes, for a single file upload. The upload will be aborted if/when the size of the file being sent exceeds this limit. 0 means unlimited. This restriction does not apply for SSH system commands such as `git` and `rsync`'
tls_username:
type: string
description: 'defines the TLS certificate field to use as username. For FTP clients it must match the name provided using the "USER" command. For WebDAV, if no username is provided, the CN will be used as username. For WebDAV clients it must match the implicit or provided username. Ignored if mutual TLS is disabled. Currently the only supported value is `CommonName`'
+ tls_certs:
+ type: array
+ items:
+ type: string
hooks:
$ref: '#/components/schemas/HooksFilter'
disable_fs_checks:
@@ -5460,15 +5527,6 @@ components:
type: array
items:
$ref: '#/components/schemas/RecoveryCode'
- tls_certs:
- type: array
- items:
- type: string
- additional_emails:
- type: array
- items:
- type: string
- format: email
Secret:
type: object
properties:
@@ -5507,8 +5565,6 @@ components:
type: string
access_secret:
$ref: '#/components/schemas/Secret'
- sse_customer_key:
- $ref: '#/components/schemas/Secret'
role_arn:
type: string
description: 'Optional IAM Role ARN to assume'
@@ -6208,6 +6264,9 @@ components:
delete_empty_dirs:
type: boolean
description: if enabled, empty directories will be deleted
+ ignore_user_permissions:
+ type: boolean
+ description: 'if enabled, files will be deleted even if the user does not have the delete permission. The default is "false" which means that files will be skipped if the user does not have permission to delete them. File patterns filters will always be silently ignored'
RetentionCheck:
type: object
properties:
@@ -6222,6 +6281,14 @@ components:
type: integer
format: int64
description: check start time as unix timestamp in milliseconds
+ notifications:
+ type: array
+ items:
+ $ref: '#/components/schemas/RetentionCheckNotification'
+ email:
+ type: string
+ format: email
+ description: 'if the notification method is set to "Email", this is the e-mail address that receives the retention check report. This field is automatically set to the email address associated with the administrator starting the check'
QuotaScan:
type: object
properties:
@@ -6895,14 +6962,6 @@ components:
type: string
value:
type: string
- RenameConfig:
- allOf:
- - $ref: '#/components/schemas/KeyValue'
- - type: object
- properties:
- update_modtime:
- type: boolean
- description: 'Update modification time. This setting is not recursive and only applies to storage providers that support changing modification times'
HTTPPart:
type: object
properties:
@@ -7035,7 +7094,7 @@ components:
renames:
type: array
items:
- $ref: '#/components/schemas/RenameConfig'
+ $ref: '#/components/schemas/KeyValue'
mkdirs:
type: array
items:
@@ -7214,19 +7273,6 @@ components:
max_size:
type: integer
format: int64
- event_statuses:
- type: array
- items:
- type: integer
- enum:
- - 1
- - 2
- - 3
- description: |
- Event status:
- - `1` OK
- - `2` Failed
- - `3` Quota exceeded
concurrent_execution:
type: boolean
description: allow concurrent execution from multiple nodes
diff --git a/openapi/swagger-ui/swagger-ui-bundle.js b/openapi/swagger-ui/swagger-ui-bundle.js
index 64a04935..45262199 100644
--- a/openapi/swagger-ui/swagger-ui-bundle.js
+++ b/openapi/swagger-ui/swagger-ui-bundle.js
@@ -1,2 +1,2 @@
/*! For license information please see swagger-ui-bundle.js.LICENSE.txt */
-!function webpackUniversalModuleDefinition(s,o){"object"==typeof exports&&"object"==typeof module?module.exports=o():"function"==typeof define&&define.amd?define([],o):"object"==typeof exports?exports.SwaggerUIBundle=o():s.SwaggerUIBundle=o()}(this,(()=>(()=>{var s={251:(s,o)=>{o.read=function(s,o,i,a,u){var _,w,x=8*u-a-1,C=(1<>1,L=-7,B=i?u-1:0,$=i?-1:1,U=s[o+B];for(B+=$,_=U&(1<<-L)-1,U>>=-L,L+=x;L>0;_=256*_+s[o+B],B+=$,L-=8);for(w=_&(1<<-L)-1,_>>=-L,L+=a;L>0;w=256*w+s[o+B],B+=$,L-=8);if(0===_)_=1-j;else{if(_===C)return w?NaN:1/0*(U?-1:1);w+=Math.pow(2,a),_-=j}return(U?-1:1)*w*Math.pow(2,_-a)},o.write=function(s,o,i,a,u,_){var w,x,C,j=8*_-u-1,L=(1<>1,$=23===u?Math.pow(2,-24)-Math.pow(2,-77):0,U=a?0:_-1,V=a?1:-1,z=o<0||0===o&&1/o<0?1:0;for(o=Math.abs(o),isNaN(o)||o===1/0?(x=isNaN(o)?1:0,w=L):(w=Math.floor(Math.log(o)/Math.LN2),o*(C=Math.pow(2,-w))<1&&(w--,C*=2),(o+=w+B>=1?$/C:$*Math.pow(2,1-B))*C>=2&&(w++,C/=2),w+B>=L?(x=0,w=L):w+B>=1?(x=(o*C-1)*Math.pow(2,u),w+=B):(x=o*Math.pow(2,B-1)*Math.pow(2,u),w=0));u>=8;s[i+U]=255&x,U+=V,x/=256,u-=8);for(w=w<0;s[i+U]=255&w,U+=V,w/=256,j-=8);s[i+U-V]|=128*z}},462:(s,o,i)=>{"use strict";var a=i(40975);s.exports=a},659:(s,o,i)=>{var a=i(51873),u=Object.prototype,_=u.hasOwnProperty,w=u.toString,x=a?a.toStringTag:void 0;s.exports=function getRawTag(s){var o=_.call(s,x),i=s[x];try{s[x]=void 0;var a=!0}catch(s){}var u=w.call(s);return a&&(o?s[x]=i:delete s[x]),u}},694:(s,o,i)=>{"use strict";i(91599);var a=i(37257);i(12560),s.exports=a},953:(s,o,i)=>{"use strict";s.exports=i(53375)},1733:s=>{var o=/[^\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f]+/g;s.exports=function asciiWords(s){return s.match(o)||[]}},1882:(s,o,i)=>{var a=i(72552),u=i(23805);s.exports=function isFunction(s){if(!u(s))return!1;var o=a(s);return"[object Function]"==o||"[object GeneratorFunction]"==o||"[object AsyncFunction]"==o||"[object Proxy]"==o}},1907:(s,o,i)=>{"use strict";var a=i(41505),u=Function.prototype,_=u.call,w=a&&u.bind.bind(_,_);s.exports=a?w:function(s){return function(){return _.apply(s,arguments)}}},2205:function(s,o,i){var a;a=void 0!==i.g?i.g:this,s.exports=function(s){if(s.CSS&&s.CSS.escape)return s.CSS.escape;var cssEscape=function(s){if(0==arguments.length)throw new TypeError("`CSS.escape` requires an argument.");for(var o,i=String(s),a=i.length,u=-1,_="",w=i.charCodeAt(0);++u=1&&o<=31||127==o||0==u&&o>=48&&o<=57||1==u&&o>=48&&o<=57&&45==w?"\\"+o.toString(16)+" ":0==u&&1==a&&45==o||!(o>=128||45==o||95==o||o>=48&&o<=57||o>=65&&o<=90||o>=97&&o<=122)?"\\"+i.charAt(u):i.charAt(u):_+="�";return _};return s.CSS||(s.CSS={}),s.CSS.escape=cssEscape,cssEscape}(a)},2209:(s,o,i)=>{"use strict";var a,u=i(9404),_=function productionTypeChecker(){invariant(!1,"ImmutablePropTypes type checking code is stripped in production.")};_.isRequired=_;var w=function getProductionTypeChecker(){return _};function getPropType(s){var o=typeof s;return Array.isArray(s)?"array":s instanceof RegExp?"object":s instanceof u.Iterable?"Immutable."+s.toSource().split(" ")[0]:o}function createChainableTypeChecker(s){function checkType(o,i,a,u,_,w){for(var x=arguments.length,C=Array(x>6?x-6:0),j=6;j>",null!=i[a]?s.apply(void 0,[i,a,u,_,w].concat(C)):o?new Error("Required "+_+" `"+w+"` was not specified in `"+u+"`."):void 0}var o=checkType.bind(null,!1);return o.isRequired=checkType.bind(null,!0),o}function createIterableSubclassTypeChecker(s,o){return function createImmutableTypeChecker(s,o){return createChainableTypeChecker((function validate(i,a,u,_,w){var x=i[a];if(!o(x)){var C=getPropType(x);return new Error("Invalid "+_+" `"+w+"` of type `"+C+"` supplied to `"+u+"`, expected `"+s+"`.")}return null}))}("Iterable."+s,(function(s){return u.Iterable.isIterable(s)&&o(s)}))}(a={listOf:w,mapOf:w,orderedMapOf:w,setOf:w,orderedSetOf:w,stackOf:w,iterableOf:w,recordOf:w,shape:w,contains:w,mapContains:w,orderedMapContains:w,list:_,map:_,orderedMap:_,set:_,orderedSet:_,stack:_,seq:_,record:_,iterable:_}).iterable.indexed=createIterableSubclassTypeChecker("Indexed",u.Iterable.isIndexed),a.iterable.keyed=createIterableSubclassTypeChecker("Keyed",u.Iterable.isKeyed),s.exports=a},2404:(s,o,i)=>{var a=i(60270);s.exports=function isEqual(s,o){return a(s,o)}},2523:s=>{s.exports=function baseFindIndex(s,o,i,a){for(var u=s.length,_=i+(a?1:-1);a?_--:++_{"use strict";var a=i(45951),u=Object.defineProperty;s.exports=function(s,o){try{u(a,s,{value:o,configurable:!0,writable:!0})}catch(i){a[s]=o}return o}},2694:(s,o,i)=>{"use strict";var a=i(6925);function emptyFunction(){}function emptyFunctionWithReset(){}emptyFunctionWithReset.resetWarningCache=emptyFunction,s.exports=function(){function shim(s,o,i,u,_,w){if(w!==a){var x=new Error("Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types");throw x.name="Invariant Violation",x}}function getShim(){return shim}shim.isRequired=shim;var s={array:shim,bigint:shim,bool:shim,func:shim,number:shim,object:shim,string:shim,symbol:shim,any:shim,arrayOf:getShim,element:shim,elementType:shim,instanceOf:getShim,node:shim,objectOf:getShim,oneOf:getShim,oneOfType:getShim,shape:getShim,exact:getShim,checkPropTypes:emptyFunctionWithReset,resetWarningCache:emptyFunction};return s.PropTypes=s,s}},2874:s=>{s.exports={}},2875:(s,o,i)=>{"use strict";var a=i(23045),u=i(80376);s.exports=Object.keys||function keys(s){return a(s,u)}},2955:(s,o,i)=>{"use strict";var a,u=i(65606);function _defineProperty(s,o,i){return(o=function _toPropertyKey(s){var o=function _toPrimitive(s,o){if("object"!=typeof s||null===s)return s;var i=s[Symbol.toPrimitive];if(void 0!==i){var a=i.call(s,o||"default");if("object"!=typeof a)return a;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===o?String:Number)(s)}(s,"string");return"symbol"==typeof o?o:String(o)}(o))in s?Object.defineProperty(s,o,{value:i,enumerable:!0,configurable:!0,writable:!0}):s[o]=i,s}var _=i(86238),w=Symbol("lastResolve"),x=Symbol("lastReject"),C=Symbol("error"),j=Symbol("ended"),L=Symbol("lastPromise"),B=Symbol("handlePromise"),$=Symbol("stream");function createIterResult(s,o){return{value:s,done:o}}function readAndResolve(s){var o=s[w];if(null!==o){var i=s[$].read();null!==i&&(s[L]=null,s[w]=null,s[x]=null,o(createIterResult(i,!1)))}}function onReadable(s){u.nextTick(readAndResolve,s)}var U=Object.getPrototypeOf((function(){})),V=Object.setPrototypeOf((_defineProperty(a={get stream(){return this[$]},next:function next(){var s=this,o=this[C];if(null!==o)return Promise.reject(o);if(this[j])return Promise.resolve(createIterResult(void 0,!0));if(this[$].destroyed)return new Promise((function(o,i){u.nextTick((function(){s[C]?i(s[C]):o(createIterResult(void 0,!0))}))}));var i,a=this[L];if(a)i=new Promise(function wrapForNext(s,o){return function(i,a){s.then((function(){o[j]?i(createIterResult(void 0,!0)):o[B](i,a)}),a)}}(a,this));else{var _=this[$].read();if(null!==_)return Promise.resolve(createIterResult(_,!1));i=new Promise(this[B])}return this[L]=i,i}},Symbol.asyncIterator,(function(){return this})),_defineProperty(a,"return",(function _return(){var s=this;return new Promise((function(o,i){s[$].destroy(null,(function(s){s?i(s):o(createIterResult(void 0,!0))}))}))})),a),U);s.exports=function createReadableStreamAsyncIterator(s){var o,i=Object.create(V,(_defineProperty(o={},$,{value:s,writable:!0}),_defineProperty(o,w,{value:null,writable:!0}),_defineProperty(o,x,{value:null,writable:!0}),_defineProperty(o,C,{value:null,writable:!0}),_defineProperty(o,j,{value:s._readableState.endEmitted,writable:!0}),_defineProperty(o,B,{value:function value(s,o){var a=i[$].read();a?(i[L]=null,i[w]=null,i[x]=null,s(createIterResult(a,!1))):(i[w]=s,i[x]=o)},writable:!0}),o));return i[L]=null,_(s,(function(s){if(s&&"ERR_STREAM_PREMATURE_CLOSE"!==s.code){var o=i[x];return null!==o&&(i[L]=null,i[w]=null,i[x]=null,o(s)),void(i[C]=s)}var a=i[w];null!==a&&(i[L]=null,i[w]=null,i[x]=null,a(createIterResult(void 0,!0))),i[j]=!0})),s.on("readable",onReadable.bind(null,i)),i}},3110:(s,o,i)=>{const a=i(5187),u=i(85015),_=i(98023),w=i(53812),x=i(23805),C=i(85105),j=i(86804);class Namespace{constructor(s){this.elementMap={},this.elementDetection=[],this.Element=j.Element,this.KeyValuePair=j.KeyValuePair,s&&s.noDefault||this.useDefault(),this._attributeElementKeys=[],this._attributeElementArrayKeys=[]}use(s){return s.namespace&&s.namespace({base:this}),s.load&&s.load({base:this}),this}useDefault(){return this.register("null",j.NullElement).register("string",j.StringElement).register("number",j.NumberElement).register("boolean",j.BooleanElement).register("array",j.ArrayElement).register("object",j.ObjectElement).register("member",j.MemberElement).register("ref",j.RefElement).register("link",j.LinkElement),this.detect(a,j.NullElement,!1).detect(u,j.StringElement,!1).detect(_,j.NumberElement,!1).detect(w,j.BooleanElement,!1).detect(Array.isArray,j.ArrayElement,!1).detect(x,j.ObjectElement,!1),this}register(s,o){return this._elements=void 0,this.elementMap[s]=o,this}unregister(s){return this._elements=void 0,delete this.elementMap[s],this}detect(s,o,i){return void 0===i||i?this.elementDetection.unshift([s,o]):this.elementDetection.push([s,o]),this}toElement(s){if(s instanceof this.Element)return s;let o;for(let i=0;i{const o=s[0].toUpperCase()+s.substr(1);this._elements[o]=this.elementMap[s]}))),this._elements}get serialiser(){return new C(this)}}C.prototype.Namespace=Namespace,s.exports=Namespace},3121:(s,o,i)=>{"use strict";var a=i(65482),u=Math.min;s.exports=function(s){var o=a(s);return o>0?u(o,9007199254740991):0}},3209:(s,o,i)=>{var a=i(91596),u=i(53320),_=i(36306),w="__lodash_placeholder__",x=128,C=Math.min;s.exports=function mergeData(s,o){var i=s[1],j=o[1],L=i|j,B=L<131,$=j==x&&8==i||j==x&&256==i&&s[7].length<=o[8]||384==j&&o[7].length<=o[8]&&8==i;if(!B&&!$)return s;1&j&&(s[2]=o[2],L|=1&i?0:4);var U=o[3];if(U){var V=s[3];s[3]=V?a(V,U,o[4]):U,s[4]=V?_(s[3],w):o[4]}return(U=o[5])&&(V=s[5],s[5]=V?u(V,U,o[6]):U,s[6]=V?_(s[5],w):o[6]),(U=o[7])&&(s[7]=U),j&x&&(s[8]=null==s[8]?o[8]:C(s[8],o[8])),null==s[9]&&(s[9]=o[9]),s[0]=o[0],s[1]=L,s}},3650:(s,o,i)=>{var a=i(74335)(Object.keys,Object);s.exports=a},3656:(s,o,i)=>{s=i.nmd(s);var a=i(9325),u=i(89935),_=o&&!o.nodeType&&o,w=_&&s&&!s.nodeType&&s,x=w&&w.exports===_?a.Buffer:void 0,C=(x?x.isBuffer:void 0)||u;s.exports=C},4509:(s,o,i)=>{var a=i(12651);s.exports=function mapCacheHas(s){return a(this,s).has(s)}},4640:s=>{"use strict";var o=String;s.exports=function(s){try{return o(s)}catch(s){return"Object"}}},4664:(s,o,i)=>{var a=i(79770),u=i(63345),_=Object.prototype.propertyIsEnumerable,w=Object.getOwnPropertySymbols,x=w?function(s){return null==s?[]:(s=Object(s),a(w(s),(function(o){return _.call(s,o)})))}:u;s.exports=x},4901:(s,o,i)=>{var a=i(72552),u=i(30294),_=i(40346),w={};w["[object Float32Array]"]=w["[object Float64Array]"]=w["[object Int8Array]"]=w["[object Int16Array]"]=w["[object Int32Array]"]=w["[object Uint8Array]"]=w["[object Uint8ClampedArray]"]=w["[object Uint16Array]"]=w["[object Uint32Array]"]=!0,w["[object Arguments]"]=w["[object Array]"]=w["[object ArrayBuffer]"]=w["[object Boolean]"]=w["[object DataView]"]=w["[object Date]"]=w["[object Error]"]=w["[object Function]"]=w["[object Map]"]=w["[object Number]"]=w["[object Object]"]=w["[object RegExp]"]=w["[object Set]"]=w["[object String]"]=w["[object WeakMap]"]=!1,s.exports=function baseIsTypedArray(s){return _(s)&&u(s.length)&&!!w[a(s)]}},4993:(s,o,i)=>{"use strict";var a=i(16946),u=i(74239);s.exports=function(s){return a(u(s))}},5187:s=>{s.exports=function isNull(s){return null===s}},5419:s=>{s.exports=function(s,o,i,a){var u=new Blob(void 0!==a?[a,s]:[s],{type:i||"application/octet-stream"});if(void 0!==window.navigator.msSaveBlob)window.navigator.msSaveBlob(u,o);else{var _=window.URL&&window.URL.createObjectURL?window.URL.createObjectURL(u):window.webkitURL.createObjectURL(u),w=document.createElement("a");w.style.display="none",w.href=_,w.setAttribute("download",o),void 0===w.download&&w.setAttribute("target","_blank"),document.body.appendChild(w),w.click(),setTimeout((function(){document.body.removeChild(w),window.URL.revokeObjectURL(_)}),200)}}},5556:(s,o,i)=>{s.exports=i(2694)()},5861:(s,o,i)=>{var a=i(55580),u=i(68223),_=i(32804),w=i(76545),x=i(28303),C=i(72552),j=i(47473),L="[object Map]",B="[object Promise]",$="[object Set]",U="[object WeakMap]",V="[object DataView]",z=j(a),Y=j(u),Z=j(_),ee=j(w),ie=j(x),ae=C;(a&&ae(new a(new ArrayBuffer(1)))!=V||u&&ae(new u)!=L||_&&ae(_.resolve())!=B||w&&ae(new w)!=$||x&&ae(new x)!=U)&&(ae=function(s){var o=C(s),i="[object Object]"==o?s.constructor:void 0,a=i?j(i):"";if(a)switch(a){case z:return V;case Y:return L;case Z:return B;case ee:return $;case ie:return U}return o}),s.exports=ae},6048:s=>{s.exports=function negate(s){if("function"!=typeof s)throw new TypeError("Expected a function");return function(){var o=arguments;switch(o.length){case 0:return!s.call(this);case 1:return!s.call(this,o[0]);case 2:return!s.call(this,o[0],o[1]);case 3:return!s.call(this,o[0],o[1],o[2])}return!s.apply(this,o)}}},6188:s=>{"use strict";s.exports=Math.max},6205:s=>{s.exports={ROOT:0,GROUP:1,POSITION:2,SET:3,RANGE:4,REPETITION:5,REFERENCE:6,CHAR:7}},6233:(s,o,i)=>{const a=i(6048),u=i(10316),_=i(92340);class ArrayElement extends u{constructor(s,o,i){super(s||[],o,i),this.element="array"}primitive(){return"array"}get(s){return this.content[s]}getValue(s){const o=this.get(s);if(o)return o.toValue()}getIndex(s){return this.content[s]}set(s,o){return this.content[s]=this.refract(o),this}remove(s){const o=this.content.splice(s,1);return o.length?o[0]:null}map(s,o){return this.content.map(s,o)}flatMap(s,o){return this.map(s,o).reduce(((s,o)=>s.concat(o)),[])}compactMap(s,o){const i=[];return this.forEach((a=>{const u=s.bind(o)(a);u&&i.push(u)})),i}filter(s,o){return new _(this.content.filter(s,o))}reject(s,o){return this.filter(a(s),o)}reduce(s,o){let i,a;void 0!==o?(i=0,a=this.refract(o)):(i=1,a="object"===this.primitive()?this.first.value:this.first);for(let o=i;o{s.bind(o)(i,this.refract(a))}))}shift(){return this.content.shift()}unshift(s){this.content.unshift(this.refract(s))}push(s){return this.content.push(this.refract(s)),this}add(s){this.push(s)}findElements(s,o){const i=o||{},a=!!i.recursive,u=void 0===i.results?[]:i.results;return this.forEach(((o,i,_)=>{a&&void 0!==o.findElements&&o.findElements(s,{results:u,recursive:a}),s(o,i,_)&&u.push(o)})),u}find(s){return new _(this.findElements(s,{recursive:!0}))}findByElement(s){return this.find((o=>o.element===s))}findByClass(s){return this.find((o=>o.classes.includes(s)))}getById(s){return this.find((o=>o.id.toValue()===s)).first}includes(s){return this.content.some((o=>o.equals(s)))}contains(s){return this.includes(s)}empty(){return new this.constructor([])}"fantasy-land/empty"(){return this.empty()}concat(s){return new this.constructor(this.content.concat(s.content))}"fantasy-land/concat"(s){return this.concat(s)}"fantasy-land/map"(s){return new this.constructor(this.map(s))}"fantasy-land/chain"(s){return this.map((o=>s(o)),this).reduce(((s,o)=>s.concat(o)),this.empty())}"fantasy-land/filter"(s){return new this.constructor(this.content.filter(s))}"fantasy-land/reduce"(s,o){return this.content.reduce(s,o)}get length(){return this.content.length}get isEmpty(){return 0===this.content.length}get first(){return this.getIndex(0)}get second(){return this.getIndex(1)}get last(){return this.getIndex(this.length-1)}}ArrayElement.empty=function empty(){return new this},ArrayElement["fantasy-land/empty"]=ArrayElement.empty,"undefined"!=typeof Symbol&&(ArrayElement.prototype[Symbol.iterator]=function symbol(){return this.content[Symbol.iterator]()}),s.exports=ArrayElement},6499:(s,o,i)=>{"use strict";var a=i(1907),u=0,_=Math.random(),w=a(1..toString);s.exports=function(s){return"Symbol("+(void 0===s?"":s)+")_"+w(++u+_,36)}},6549:s=>{"use strict";s.exports=Object.getOwnPropertyDescriptor},6925:s=>{"use strict";s.exports="SECRET_DO_NOT_PASS_THIS_OR_YOU_WILL_BE_FIRED"},7057:(s,o,i)=>{"use strict";var a=i(11470).charAt,u=i(90160),_=i(64932),w=i(60183),x=i(59550),C="String Iterator",j=_.set,L=_.getterFor(C);w(String,"String",(function(s){j(this,{type:C,string:u(s),index:0})}),(function next(){var s,o=L(this),i=o.string,u=o.index;return u>=i.length?x(void 0,!0):(s=a(i,u),o.index+=s.length,x(s,!1))}))},7176:(s,o,i)=>{"use strict";var a,u=i(73126),_=i(75795);try{a=[].__proto__===Array.prototype}catch(s){if(!s||"object"!=typeof s||!("code"in s)||"ERR_PROTO_ACCESS"!==s.code)throw s}var w=!!a&&_&&_(Object.prototype,"__proto__"),x=Object,C=x.getPrototypeOf;s.exports=w&&"function"==typeof w.get?u([w.get]):"function"==typeof C&&function getDunder(s){return C(null==s?s:x(s))}},7309:(s,o,i)=>{var a=i(62006)(i(24713));s.exports=a},7376:s=>{"use strict";s.exports=!0},7463:(s,o,i)=>{"use strict";var a=i(98828),u=i(62250),_=/#|\.prototype\./,isForced=function(s,o){var i=x[w(s)];return i===j||i!==C&&(u(o)?a(o):!!o)},w=isForced.normalize=function(s){return String(s).replace(_,".").toLowerCase()},x=isForced.data={},C=isForced.NATIVE="N",j=isForced.POLYFILL="P";s.exports=isForced},7666:(s,o,i)=>{var a=i(84851),u=i(953);function _extends(){var o;return s.exports=_extends=a?u(o=a).call(o):function(s){for(var o=1;o{const a=i(6205);o.wordBoundary=()=>({type:a.POSITION,value:"b"}),o.nonWordBoundary=()=>({type:a.POSITION,value:"B"}),o.begin=()=>({type:a.POSITION,value:"^"}),o.end=()=>({type:a.POSITION,value:"$"})},8068:s=>{"use strict";var o=(()=>{var s=Object.defineProperty,o=Object.getOwnPropertyDescriptor,i=Object.getOwnPropertyNames,a=Object.getOwnPropertySymbols,u=Object.prototype.hasOwnProperty,_=Object.prototype.propertyIsEnumerable,__defNormalProp=(o,i,a)=>i in o?s(o,i,{enumerable:!0,configurable:!0,writable:!0,value:a}):o[i]=a,__spreadValues=(s,o)=>{for(var i in o||(o={}))u.call(o,i)&&__defNormalProp(s,i,o[i]);if(a)for(var i of a(o))_.call(o,i)&&__defNormalProp(s,i,o[i]);return s},__publicField=(s,o,i)=>__defNormalProp(s,"symbol"!=typeof o?o+"":o,i),w={};((o,i)=>{for(var a in i)s(o,a,{get:i[a],enumerable:!0})})(w,{DEFAULT_OPTIONS:()=>C,DEFAULT_UUID_LENGTH:()=>x,default:()=>B});var x=6,C={dictionary:"alphanum",shuffle:!0,debug:!1,length:x,counter:0},j=class _ShortUniqueId{constructor(s={}){__publicField(this,"counter"),__publicField(this,"debug"),__publicField(this,"dict"),__publicField(this,"version"),__publicField(this,"dictIndex",0),__publicField(this,"dictRange",[]),__publicField(this,"lowerBound",0),__publicField(this,"upperBound",0),__publicField(this,"dictLength",0),__publicField(this,"uuidLength"),__publicField(this,"_digit_first_ascii",48),__publicField(this,"_digit_last_ascii",58),__publicField(this,"_alpha_lower_first_ascii",97),__publicField(this,"_alpha_lower_last_ascii",123),__publicField(this,"_hex_last_ascii",103),__publicField(this,"_alpha_upper_first_ascii",65),__publicField(this,"_alpha_upper_last_ascii",91),__publicField(this,"_number_dict_ranges",{digits:[this._digit_first_ascii,this._digit_last_ascii]}),__publicField(this,"_alpha_dict_ranges",{lowerCase:[this._alpha_lower_first_ascii,this._alpha_lower_last_ascii],upperCase:[this._alpha_upper_first_ascii,this._alpha_upper_last_ascii]}),__publicField(this,"_alpha_lower_dict_ranges",{lowerCase:[this._alpha_lower_first_ascii,this._alpha_lower_last_ascii]}),__publicField(this,"_alpha_upper_dict_ranges",{upperCase:[this._alpha_upper_first_ascii,this._alpha_upper_last_ascii]}),__publicField(this,"_alphanum_dict_ranges",{digits:[this._digit_first_ascii,this._digit_last_ascii],lowerCase:[this._alpha_lower_first_ascii,this._alpha_lower_last_ascii],upperCase:[this._alpha_upper_first_ascii,this._alpha_upper_last_ascii]}),__publicField(this,"_alphanum_lower_dict_ranges",{digits:[this._digit_first_ascii,this._digit_last_ascii],lowerCase:[this._alpha_lower_first_ascii,this._alpha_lower_last_ascii]}),__publicField(this,"_alphanum_upper_dict_ranges",{digits:[this._digit_first_ascii,this._digit_last_ascii],upperCase:[this._alpha_upper_first_ascii,this._alpha_upper_last_ascii]}),__publicField(this,"_hex_dict_ranges",{decDigits:[this._digit_first_ascii,this._digit_last_ascii],alphaDigits:[this._alpha_lower_first_ascii,this._hex_last_ascii]}),__publicField(this,"_dict_ranges",{_number_dict_ranges:this._number_dict_ranges,_alpha_dict_ranges:this._alpha_dict_ranges,_alpha_lower_dict_ranges:this._alpha_lower_dict_ranges,_alpha_upper_dict_ranges:this._alpha_upper_dict_ranges,_alphanum_dict_ranges:this._alphanum_dict_ranges,_alphanum_lower_dict_ranges:this._alphanum_lower_dict_ranges,_alphanum_upper_dict_ranges:this._alphanum_upper_dict_ranges,_hex_dict_ranges:this._hex_dict_ranges}),__publicField(this,"log",((...s)=>{const o=[...s];o[0]="[short-unique-id] ".concat(s[0]),!0!==this.debug||"undefined"==typeof console||null===console||console.log(...o)})),__publicField(this,"_normalizeDictionary",((s,o)=>{let i;if(s&&Array.isArray(s)&&s.length>1)i=s;else{i=[],this.dictIndex=0;const o="_".concat(s,"_dict_ranges"),a=this._dict_ranges[o];let u=0;for(const[,s]of Object.entries(a)){const[o,i]=s;u+=Math.abs(i-o)}i=new Array(u);let _=0;for(const[,s]of Object.entries(a)){this.dictRange=s,this.lowerBound=this.dictRange[0],this.upperBound=this.dictRange[1];const o=this.lowerBound<=this.upperBound,a=this.lowerBound,u=this.upperBound;if(o)for(let s=a;su;s--)i[_++]=String.fromCharCode(s),this.dictIndex=s}i.length=_}if(o){for(let s=i.length-1;s>0;s--){const o=Math.floor(Math.random()*(s+1));[i[s],i[o]]=[i[o],i[s]]}}return i})),__publicField(this,"setDictionary",((s,o)=>{this.dict=this._normalizeDictionary(s,o),this.dictLength=this.dict.length,this.setCounter(0)})),__publicField(this,"seq",(()=>this.sequentialUUID())),__publicField(this,"sequentialUUID",(()=>{const s=this.dictLength,o=this.dict;let i=this.counter;const a=[];do{const u=i%s;i=Math.trunc(i/s),a.push(o[u])}while(0!==i);const u=a.join("");return this.counter+=1,u})),__publicField(this,"rnd",((s=this.uuidLength||x)=>this.randomUUID(s))),__publicField(this,"randomUUID",((s=this.uuidLength||x)=>{if(null==s||s<1)throw new Error("Invalid UUID Length Provided");const o=new Array(s),i=this.dictLength,a=this.dict;for(let u=0;uthis.formattedUUID(s,o))),__publicField(this,"formattedUUID",((s,o)=>{const i={$r:this.randomUUID,$s:this.sequentialUUID,$t:this.stamp};return s.replace(/\$[rs]\d{0,}|\$t0|\$t[1-9]\d{1,}/g,(s=>{const a=s.slice(0,2),u=Number.parseInt(s.slice(2),10);return"$s"===a?i[a]().padStart(u,"0"):"$t"===a&&o?i[a](u,o):i[a](u)}))})),__publicField(this,"availableUUIDs",((s=this.uuidLength)=>Number.parseFloat(([...new Set(this.dict)].length**s).toFixed(0)))),__publicField(this,"_collisionCache",new Map),__publicField(this,"approxMaxBeforeCollision",((s=this.availableUUIDs(this.uuidLength))=>{const o=s,i=this._collisionCache.get(o);if(void 0!==i)return i;const a=Number.parseFloat(Math.sqrt(Math.PI/2*s).toFixed(20));return this._collisionCache.set(o,a),a})),__publicField(this,"collisionProbability",((s=this.availableUUIDs(this.uuidLength),o=this.uuidLength)=>Number.parseFloat((this.approxMaxBeforeCollision(s)/this.availableUUIDs(o)).toFixed(20)))),__publicField(this,"uniqueness",((s=this.availableUUIDs(this.uuidLength))=>{const o=Number.parseFloat((1-this.approxMaxBeforeCollision(s)/s).toFixed(20));return o>1?1:o<0?0:o})),__publicField(this,"getVersion",(()=>this.version)),__publicField(this,"stamp",((s,o)=>{const i=Math.floor(+(o||new Date)/1e3).toString(16);if("number"==typeof s&&0===s)return i;if("number"!=typeof s||s<10)throw new Error(["Param finalLength must be a number greater than or equal to 10,","or 0 if you want the raw hexadecimal timestamp"].join("\n"));const a=s-9,u=Math.round(Math.random()*(a>15?15:a)),_=this.randomUUID(a);return"".concat(_.substring(0,u)).concat(i).concat(_.substring(u)).concat(u.toString(16))})),__publicField(this,"parseStamp",((s,o)=>{if(o&&!/t0|t[1-9]\d{1,}/.test(o))throw new Error("Cannot extract date from a formated UUID with no timestamp in the format");const i=o?o.replace(/\$[rs]\d{0,}|\$t0|\$t[1-9]\d{1,}/g,(s=>{const o={$r:s=>[...Array(s)].map((()=>"r")).join(""),$s:s=>[...Array(s)].map((()=>"s")).join(""),$t:s=>[...Array(s)].map((()=>"t")).join("")},i=s.slice(0,2),a=Number.parseInt(s.slice(2),10);return o[i](a)})).replace(/^(.*?)(t{8,})(.*)$/g,((o,i,a)=>s.substring(i.length,i.length+a.length))):s;if(8===i.length)return new Date(1e3*Number.parseInt(i,16));if(i.length<10)throw new Error("Stamp length invalid");const a=Number.parseInt(i.substring(i.length-1),16);return new Date(1e3*Number.parseInt(i.substring(a,a+8),16))})),__publicField(this,"setCounter",(s=>{this.counter=s})),__publicField(this,"validate",((s,o)=>{const i=o?this._normalizeDictionary(o):this.dict;return s.split("").every((s=>i.includes(s)))}));const o=__spreadValues(__spreadValues({},C),s);this.counter=0,this.debug=!1,this.dict=[],this.version="5.3.2";const{dictionary:i,shuffle:a,length:u,counter:_}=o;this.uuidLength=u,this.setDictionary(i,a),this.setCounter(_),this.debug=o.debug,this.log(this.dict),this.log("Generator instantiated with Dictionary Size ".concat(this.dictLength," and counter set to ").concat(this.counter)),this.log=this.log.bind(this),this.setDictionary=this.setDictionary.bind(this),this.setCounter=this.setCounter.bind(this),this.seq=this.seq.bind(this),this.sequentialUUID=this.sequentialUUID.bind(this),this.rnd=this.rnd.bind(this),this.randomUUID=this.randomUUID.bind(this),this.fmt=this.fmt.bind(this),this.formattedUUID=this.formattedUUID.bind(this),this.availableUUIDs=this.availableUUIDs.bind(this),this.approxMaxBeforeCollision=this.approxMaxBeforeCollision.bind(this),this.collisionProbability=this.collisionProbability.bind(this),this.uniqueness=this.uniqueness.bind(this),this.getVersion=this.getVersion.bind(this),this.stamp=this.stamp.bind(this),this.parseStamp=this.parseStamp.bind(this)}};__publicField(j,"default",j);var L,B=j;return L=w,((a,_,w,x)=>{if(_&&"object"==typeof _||"function"==typeof _)for(let C of i(_))u.call(a,C)||C===w||s(a,C,{get:()=>_[C],enumerable:!(x=o(_,C))||x.enumerable});return a})(s({},"__esModule",{value:!0}),L)})();s.exports=o.default,"undefined"!=typeof window&&(o=o.default)},9325:(s,o,i)=>{var a=i(34840),u="object"==typeof self&&self&&self.Object===Object&&self,_=a||u||Function("return this")();s.exports=_},9404:function(s){s.exports=function(){"use strict";var s=Array.prototype.slice;function createClass(s,o){o&&(s.prototype=Object.create(o.prototype)),s.prototype.constructor=s}function Iterable(s){return isIterable(s)?s:Seq(s)}function KeyedIterable(s){return isKeyed(s)?s:KeyedSeq(s)}function IndexedIterable(s){return isIndexed(s)?s:IndexedSeq(s)}function SetIterable(s){return isIterable(s)&&!isAssociative(s)?s:SetSeq(s)}function isIterable(s){return!(!s||!s[o])}function isKeyed(s){return!(!s||!s[i])}function isIndexed(s){return!(!s||!s[a])}function isAssociative(s){return isKeyed(s)||isIndexed(s)}function isOrdered(s){return!(!s||!s[u])}createClass(KeyedIterable,Iterable),createClass(IndexedIterable,Iterable),createClass(SetIterable,Iterable),Iterable.isIterable=isIterable,Iterable.isKeyed=isKeyed,Iterable.isIndexed=isIndexed,Iterable.isAssociative=isAssociative,Iterable.isOrdered=isOrdered,Iterable.Keyed=KeyedIterable,Iterable.Indexed=IndexedIterable,Iterable.Set=SetIterable;var o="@@__IMMUTABLE_ITERABLE__@@",i="@@__IMMUTABLE_KEYED__@@",a="@@__IMMUTABLE_INDEXED__@@",u="@@__IMMUTABLE_ORDERED__@@",_="delete",w=5,x=1<>>0;if(""+i!==o||4294967295===i)return NaN;o=i}return o<0?ensureSize(s)+o:o}function returnTrue(){return!0}function wholeSlice(s,o,i){return(0===s||void 0!==i&&s<=-i)&&(void 0===o||void 0!==i&&o>=i)}function resolveBegin(s,o){return resolveIndex(s,o,0)}function resolveEnd(s,o){return resolveIndex(s,o,o)}function resolveIndex(s,o,i){return void 0===s?i:s<0?Math.max(0,o+s):void 0===o?s:Math.min(o,s)}var $=0,U=1,V=2,z="function"==typeof Symbol&&Symbol.iterator,Y="@@iterator",Z=z||Y;function Iterator(s){this.next=s}function iteratorValue(s,o,i,a){var u=0===s?o:1===s?i:[o,i];return a?a.value=u:a={value:u,done:!1},a}function iteratorDone(){return{value:void 0,done:!0}}function hasIterator(s){return!!getIteratorFn(s)}function isIterator(s){return s&&"function"==typeof s.next}function getIterator(s){var o=getIteratorFn(s);return o&&o.call(s)}function getIteratorFn(s){var o=s&&(z&&s[z]||s[Y]);if("function"==typeof o)return o}function isArrayLike(s){return s&&"number"==typeof s.length}function Seq(s){return null==s?emptySequence():isIterable(s)?s.toSeq():seqFromValue(s)}function KeyedSeq(s){return null==s?emptySequence().toKeyedSeq():isIterable(s)?isKeyed(s)?s.toSeq():s.fromEntrySeq():keyedSeqFromValue(s)}function IndexedSeq(s){return null==s?emptySequence():isIterable(s)?isKeyed(s)?s.entrySeq():s.toIndexedSeq():indexedSeqFromValue(s)}function SetSeq(s){return(null==s?emptySequence():isIterable(s)?isKeyed(s)?s.entrySeq():s:indexedSeqFromValue(s)).toSetSeq()}Iterator.prototype.toString=function(){return"[Iterator]"},Iterator.KEYS=$,Iterator.VALUES=U,Iterator.ENTRIES=V,Iterator.prototype.inspect=Iterator.prototype.toSource=function(){return this.toString()},Iterator.prototype[Z]=function(){return this},createClass(Seq,Iterable),Seq.of=function(){return Seq(arguments)},Seq.prototype.toSeq=function(){return this},Seq.prototype.toString=function(){return this.__toString("Seq {","}")},Seq.prototype.cacheResult=function(){return!this._cache&&this.__iterateUncached&&(this._cache=this.entrySeq().toArray(),this.size=this._cache.length),this},Seq.prototype.__iterate=function(s,o){return seqIterate(this,s,o,!0)},Seq.prototype.__iterator=function(s,o){return seqIterator(this,s,o,!0)},createClass(KeyedSeq,Seq),KeyedSeq.prototype.toKeyedSeq=function(){return this},createClass(IndexedSeq,Seq),IndexedSeq.of=function(){return IndexedSeq(arguments)},IndexedSeq.prototype.toIndexedSeq=function(){return this},IndexedSeq.prototype.toString=function(){return this.__toString("Seq [","]")},IndexedSeq.prototype.__iterate=function(s,o){return seqIterate(this,s,o,!1)},IndexedSeq.prototype.__iterator=function(s,o){return seqIterator(this,s,o,!1)},createClass(SetSeq,Seq),SetSeq.of=function(){return SetSeq(arguments)},SetSeq.prototype.toSetSeq=function(){return this},Seq.isSeq=isSeq,Seq.Keyed=KeyedSeq,Seq.Set=SetSeq,Seq.Indexed=IndexedSeq;var ee,ie,ae,ce="@@__IMMUTABLE_SEQ__@@";function ArraySeq(s){this._array=s,this.size=s.length}function ObjectSeq(s){var o=Object.keys(s);this._object=s,this._keys=o,this.size=o.length}function IterableSeq(s){this._iterable=s,this.size=s.length||s.size}function IteratorSeq(s){this._iterator=s,this._iteratorCache=[]}function isSeq(s){return!(!s||!s[ce])}function emptySequence(){return ee||(ee=new ArraySeq([]))}function keyedSeqFromValue(s){var o=Array.isArray(s)?new ArraySeq(s).fromEntrySeq():isIterator(s)?new IteratorSeq(s).fromEntrySeq():hasIterator(s)?new IterableSeq(s).fromEntrySeq():"object"==typeof s?new ObjectSeq(s):void 0;if(!o)throw new TypeError("Expected Array or iterable object of [k, v] entries, or keyed object: "+s);return o}function indexedSeqFromValue(s){var o=maybeIndexedSeqFromValue(s);if(!o)throw new TypeError("Expected Array or iterable object of values: "+s);return o}function seqFromValue(s){var o=maybeIndexedSeqFromValue(s)||"object"==typeof s&&new ObjectSeq(s);if(!o)throw new TypeError("Expected Array or iterable object of values, or keyed object: "+s);return o}function maybeIndexedSeqFromValue(s){return isArrayLike(s)?new ArraySeq(s):isIterator(s)?new IteratorSeq(s):hasIterator(s)?new IterableSeq(s):void 0}function seqIterate(s,o,i,a){var u=s._cache;if(u){for(var _=u.length-1,w=0;w<=_;w++){var x=u[i?_-w:w];if(!1===o(x[1],a?x[0]:w,s))return w+1}return w}return s.__iterateUncached(o,i)}function seqIterator(s,o,i,a){var u=s._cache;if(u){var _=u.length-1,w=0;return new Iterator((function(){var s=u[i?_-w:w];return w++>_?iteratorDone():iteratorValue(o,a?s[0]:w-1,s[1])}))}return s.__iteratorUncached(o,i)}function fromJS(s,o){return o?fromJSWith(o,s,"",{"":s}):fromJSDefault(s)}function fromJSWith(s,o,i,a){return Array.isArray(o)?s.call(a,i,IndexedSeq(o).map((function(i,a){return fromJSWith(s,i,a,o)}))):isPlainObj(o)?s.call(a,i,KeyedSeq(o).map((function(i,a){return fromJSWith(s,i,a,o)}))):o}function fromJSDefault(s){return Array.isArray(s)?IndexedSeq(s).map(fromJSDefault).toList():isPlainObj(s)?KeyedSeq(s).map(fromJSDefault).toMap():s}function isPlainObj(s){return s&&(s.constructor===Object||void 0===s.constructor)}function is(s,o){if(s===o||s!=s&&o!=o)return!0;if(!s||!o)return!1;if("function"==typeof s.valueOf&&"function"==typeof o.valueOf){if((s=s.valueOf())===(o=o.valueOf())||s!=s&&o!=o)return!0;if(!s||!o)return!1}return!("function"!=typeof s.equals||"function"!=typeof o.equals||!s.equals(o))}function deepEqual(s,o){if(s===o)return!0;if(!isIterable(o)||void 0!==s.size&&void 0!==o.size&&s.size!==o.size||void 0!==s.__hash&&void 0!==o.__hash&&s.__hash!==o.__hash||isKeyed(s)!==isKeyed(o)||isIndexed(s)!==isIndexed(o)||isOrdered(s)!==isOrdered(o))return!1;if(0===s.size&&0===o.size)return!0;var i=!isAssociative(s);if(isOrdered(s)){var a=s.entries();return o.every((function(s,o){var u=a.next().value;return u&&is(u[1],s)&&(i||is(u[0],o))}))&&a.next().done}var u=!1;if(void 0===s.size)if(void 0===o.size)"function"==typeof s.cacheResult&&s.cacheResult();else{u=!0;var _=s;s=o,o=_}var w=!0,x=o.__iterate((function(o,a){if(i?!s.has(o):u?!is(o,s.get(a,j)):!is(s.get(a,j),o))return w=!1,!1}));return w&&s.size===x}function Repeat(s,o){if(!(this instanceof Repeat))return new Repeat(s,o);if(this._value=s,this.size=void 0===o?1/0:Math.max(0,o),0===this.size){if(ie)return ie;ie=this}}function invariant(s,o){if(!s)throw new Error(o)}function Range(s,o,i){if(!(this instanceof Range))return new Range(s,o,i);if(invariant(0!==i,"Cannot step a Range by 0"),s=s||0,void 0===o&&(o=1/0),i=void 0===i?1:Math.abs(i),oa?iteratorDone():iteratorValue(s,u,i[o?a-u++:u++])}))},createClass(ObjectSeq,KeyedSeq),ObjectSeq.prototype.get=function(s,o){return void 0===o||this.has(s)?this._object[s]:o},ObjectSeq.prototype.has=function(s){return this._object.hasOwnProperty(s)},ObjectSeq.prototype.__iterate=function(s,o){for(var i=this._object,a=this._keys,u=a.length-1,_=0;_<=u;_++){var w=a[o?u-_:_];if(!1===s(i[w],w,this))return _+1}return _},ObjectSeq.prototype.__iterator=function(s,o){var i=this._object,a=this._keys,u=a.length-1,_=0;return new Iterator((function(){var w=a[o?u-_:_];return _++>u?iteratorDone():iteratorValue(s,w,i[w])}))},ObjectSeq.prototype[u]=!0,createClass(IterableSeq,IndexedSeq),IterableSeq.prototype.__iterateUncached=function(s,o){if(o)return this.cacheResult().__iterate(s,o);var i=getIterator(this._iterable),a=0;if(isIterator(i))for(var u;!(u=i.next()).done&&!1!==s(u.value,a++,this););return a},IterableSeq.prototype.__iteratorUncached=function(s,o){if(o)return this.cacheResult().__iterator(s,o);var i=getIterator(this._iterable);if(!isIterator(i))return new Iterator(iteratorDone);var a=0;return new Iterator((function(){var o=i.next();return o.done?o:iteratorValue(s,a++,o.value)}))},createClass(IteratorSeq,IndexedSeq),IteratorSeq.prototype.__iterateUncached=function(s,o){if(o)return this.cacheResult().__iterate(s,o);for(var i,a=this._iterator,u=this._iteratorCache,_=0;_=a.length){var o=i.next();if(o.done)return o;a[u]=o.value}return iteratorValue(s,u,a[u++])}))},createClass(Repeat,IndexedSeq),Repeat.prototype.toString=function(){return 0===this.size?"Repeat []":"Repeat [ "+this._value+" "+this.size+" times ]"},Repeat.prototype.get=function(s,o){return this.has(s)?this._value:o},Repeat.prototype.includes=function(s){return is(this._value,s)},Repeat.prototype.slice=function(s,o){var i=this.size;return wholeSlice(s,o,i)?this:new Repeat(this._value,resolveEnd(o,i)-resolveBegin(s,i))},Repeat.prototype.reverse=function(){return this},Repeat.prototype.indexOf=function(s){return is(this._value,s)?0:-1},Repeat.prototype.lastIndexOf=function(s){return is(this._value,s)?this.size:-1},Repeat.prototype.__iterate=function(s,o){for(var i=0;i=0&&o=0&&ii?iteratorDone():iteratorValue(s,_++,w)}))},Range.prototype.equals=function(s){return s instanceof Range?this._start===s._start&&this._end===s._end&&this._step===s._step:deepEqual(this,s)},createClass(Collection,Iterable),createClass(KeyedCollection,Collection),createClass(IndexedCollection,Collection),createClass(SetCollection,Collection),Collection.Keyed=KeyedCollection,Collection.Indexed=IndexedCollection,Collection.Set=SetCollection;var le="function"==typeof Math.imul&&-2===Math.imul(4294967295,2)?Math.imul:function imul(s,o){var i=65535&(s|=0),a=65535&(o|=0);return i*a+((s>>>16)*a+i*(o>>>16)<<16>>>0)|0};function smi(s){return s>>>1&1073741824|3221225471&s}function hash(s){if(!1===s||null==s)return 0;if("function"==typeof s.valueOf&&(!1===(s=s.valueOf())||null==s))return 0;if(!0===s)return 1;var o=typeof s;if("number"===o){if(s!=s||s===1/0)return 0;var i=0|s;for(i!==s&&(i^=4294967295*s);s>4294967295;)i^=s/=4294967295;return smi(i)}if("string"===o)return s.length>Se?cachedHashString(s):hashString(s);if("function"==typeof s.hashCode)return s.hashCode();if("object"===o)return hashJSObj(s);if("function"==typeof s.toString)return hashString(s.toString());throw new Error("Value type "+o+" cannot be hashed.")}function cachedHashString(s){var o=Pe[s];return void 0===o&&(o=hashString(s),xe===we&&(xe=0,Pe={}),xe++,Pe[s]=o),o}function hashString(s){for(var o=0,i=0;i0)switch(s.nodeType){case 1:return s.uniqueID;case 9:return s.documentElement&&s.documentElement.uniqueID}}var fe,ye="function"==typeof WeakMap;ye&&(fe=new WeakMap);var be=0,_e="__immutablehash__";"function"==typeof Symbol&&(_e=Symbol(_e));var Se=16,we=255,xe=0,Pe={};function assertNotInfinite(s){invariant(s!==1/0,"Cannot perform this action with an infinite size.")}function Map(s){return null==s?emptyMap():isMap(s)&&!isOrdered(s)?s:emptyMap().withMutations((function(o){var i=KeyedIterable(s);assertNotInfinite(i.size),i.forEach((function(s,i){return o.set(i,s)}))}))}function isMap(s){return!(!s||!s[Re])}createClass(Map,KeyedCollection),Map.of=function(){var o=s.call(arguments,0);return emptyMap().withMutations((function(s){for(var i=0;i=o.length)throw new Error("Missing value for key: "+o[i]);s.set(o[i],o[i+1])}}))},Map.prototype.toString=function(){return this.__toString("Map {","}")},Map.prototype.get=function(s,o){return this._root?this._root.get(0,void 0,s,o):o},Map.prototype.set=function(s,o){return updateMap(this,s,o)},Map.prototype.setIn=function(s,o){return this.updateIn(s,j,(function(){return o}))},Map.prototype.remove=function(s){return updateMap(this,s,j)},Map.prototype.deleteIn=function(s){return this.updateIn(s,(function(){return j}))},Map.prototype.update=function(s,o,i){return 1===arguments.length?s(this):this.updateIn([s],o,i)},Map.prototype.updateIn=function(s,o,i){i||(i=o,o=void 0);var a=updateInDeepMap(this,forceIterator(s),o,i);return a===j?void 0:a},Map.prototype.clear=function(){return 0===this.size?this:this.__ownerID?(this.size=0,this._root=null,this.__hash=void 0,this.__altered=!0,this):emptyMap()},Map.prototype.merge=function(){return mergeIntoMapWith(this,void 0,arguments)},Map.prototype.mergeWith=function(o){return mergeIntoMapWith(this,o,s.call(arguments,1))},Map.prototype.mergeIn=function(o){var i=s.call(arguments,1);return this.updateIn(o,emptyMap(),(function(s){return"function"==typeof s.merge?s.merge.apply(s,i):i[i.length-1]}))},Map.prototype.mergeDeep=function(){return mergeIntoMapWith(this,deepMerger,arguments)},Map.prototype.mergeDeepWith=function(o){var i=s.call(arguments,1);return mergeIntoMapWith(this,deepMergerWith(o),i)},Map.prototype.mergeDeepIn=function(o){var i=s.call(arguments,1);return this.updateIn(o,emptyMap(),(function(s){return"function"==typeof s.mergeDeep?s.mergeDeep.apply(s,i):i[i.length-1]}))},Map.prototype.sort=function(s){return OrderedMap(sortFactory(this,s))},Map.prototype.sortBy=function(s,o){return OrderedMap(sortFactory(this,o,s))},Map.prototype.withMutations=function(s){var o=this.asMutable();return s(o),o.wasAltered()?o.__ensureOwner(this.__ownerID):this},Map.prototype.asMutable=function(){return this.__ownerID?this:this.__ensureOwner(new OwnerID)},Map.prototype.asImmutable=function(){return this.__ensureOwner()},Map.prototype.wasAltered=function(){return this.__altered},Map.prototype.__iterator=function(s,o){return new MapIterator(this,s,o)},Map.prototype.__iterate=function(s,o){var i=this,a=0;return this._root&&this._root.iterate((function(o){return a++,s(o[1],o[0],i)}),o),a},Map.prototype.__ensureOwner=function(s){return s===this.__ownerID?this:s?makeMap(this.size,this._root,s,this.__hash):(this.__ownerID=s,this.__altered=!1,this)},Map.isMap=isMap;var Te,Re="@@__IMMUTABLE_MAP__@@",$e=Map.prototype;function ArrayMapNode(s,o){this.ownerID=s,this.entries=o}function BitmapIndexedNode(s,o,i){this.ownerID=s,this.bitmap=o,this.nodes=i}function HashArrayMapNode(s,o,i){this.ownerID=s,this.count=o,this.nodes=i}function HashCollisionNode(s,o,i){this.ownerID=s,this.keyHash=o,this.entries=i}function ValueNode(s,o,i){this.ownerID=s,this.keyHash=o,this.entry=i}function MapIterator(s,o,i){this._type=o,this._reverse=i,this._stack=s._root&&mapIteratorFrame(s._root)}function mapIteratorValue(s,o){return iteratorValue(s,o[0],o[1])}function mapIteratorFrame(s,o){return{node:s,index:0,__prev:o}}function makeMap(s,o,i,a){var u=Object.create($e);return u.size=s,u._root=o,u.__ownerID=i,u.__hash=a,u.__altered=!1,u}function emptyMap(){return Te||(Te=makeMap(0))}function updateMap(s,o,i){var a,u;if(s._root){var _=MakeRef(L),w=MakeRef(B);if(a=updateNode(s._root,s.__ownerID,0,void 0,o,i,_,w),!w.value)return s;u=s.size+(_.value?i===j?-1:1:0)}else{if(i===j)return s;u=1,a=new ArrayMapNode(s.__ownerID,[[o,i]])}return s.__ownerID?(s.size=u,s._root=a,s.__hash=void 0,s.__altered=!0,s):a?makeMap(u,a):emptyMap()}function updateNode(s,o,i,a,u,_,w,x){return s?s.update(o,i,a,u,_,w,x):_===j?s:(SetRef(x),SetRef(w),new ValueNode(o,a,[u,_]))}function isLeafNode(s){return s.constructor===ValueNode||s.constructor===HashCollisionNode}function mergeIntoNode(s,o,i,a,u){if(s.keyHash===a)return new HashCollisionNode(o,a,[s.entry,u]);var _,x=(0===i?s.keyHash:s.keyHash>>>i)&C,j=(0===i?a:a>>>i)&C;return new BitmapIndexedNode(o,1<>>=1)w[C]=1&i?o[_++]:void 0;return w[a]=u,new HashArrayMapNode(s,_+1,w)}function mergeIntoMapWith(s,o,i){for(var a=[],u=0;u>1&1431655765))+(s>>2&858993459))+(s>>4)&252645135,s+=s>>8,127&(s+=s>>16)}function setIn(s,o,i,a){var u=a?s:arrCopy(s);return u[o]=i,u}function spliceIn(s,o,i,a){var u=s.length+1;if(a&&o+1===u)return s[o]=i,s;for(var _=new Array(u),w=0,x=0;x=qe)return createNodes(s,C,a,u);var U=s&&s===this.ownerID,V=U?C:arrCopy(C);return $?x?L===B-1?V.pop():V[L]=V.pop():V[L]=[a,u]:V.push([a,u]),U?(this.entries=V,this):new ArrayMapNode(s,V)}},BitmapIndexedNode.prototype.get=function(s,o,i,a){void 0===o&&(o=hash(i));var u=1<<((0===s?o:o>>>s)&C),_=this.bitmap;return _&u?this.nodes[popCount(_&u-1)].get(s+w,o,i,a):a},BitmapIndexedNode.prototype.update=function(s,o,i,a,u,_,x){void 0===i&&(i=hash(a));var L=(0===o?i:i>>>o)&C,B=1<=ze)return expandNodes(s,z,$,L,Z);if(U&&!Z&&2===z.length&&isLeafNode(z[1^V]))return z[1^V];if(U&&Z&&1===z.length&&isLeafNode(Z))return Z;var ee=s&&s===this.ownerID,ie=U?Z?$:$^B:$|B,ae=U?Z?setIn(z,V,Z,ee):spliceOut(z,V,ee):spliceIn(z,V,Z,ee);return ee?(this.bitmap=ie,this.nodes=ae,this):new BitmapIndexedNode(s,ie,ae)},HashArrayMapNode.prototype.get=function(s,o,i,a){void 0===o&&(o=hash(i));var u=(0===s?o:o>>>s)&C,_=this.nodes[u];return _?_.get(s+w,o,i,a):a},HashArrayMapNode.prototype.update=function(s,o,i,a,u,_,x){void 0===i&&(i=hash(a));var L=(0===o?i:i>>>o)&C,B=u===j,$=this.nodes,U=$[L];if(B&&!U)return this;var V=updateNode(U,s,o+w,i,a,u,_,x);if(V===U)return this;var z=this.count;if(U){if(!V&&--z0&&a=0&&s>>o&C;if(a>=this.array.length)return new VNode([],s);var u,_=0===a;if(o>0){var x=this.array[a];if((u=x&&x.removeBefore(s,o-w,i))===x&&_)return this}if(_&&!u)return this;var j=editableVNode(this,s);if(!_)for(var L=0;L>>o&C;if(u>=this.array.length)return this;if(o>0){var _=this.array[u];if((a=_&&_.removeAfter(s,o-w,i))===_&&u===this.array.length-1)return this}var x=editableVNode(this,s);return x.array.splice(u+1),a&&(x.array[u]=a),x};var Xe,Qe,et={};function iterateList(s,o){var i=s._origin,a=s._capacity,u=getTailOffset(a),_=s._tail;return iterateNodeOrLeaf(s._root,s._level,0);function iterateNodeOrLeaf(s,o,i){return 0===o?iterateLeaf(s,i):iterateNode(s,o,i)}function iterateLeaf(s,w){var C=w===u?_&&_.array:s&&s.array,j=w>i?0:i-w,L=a-w;return L>x&&(L=x),function(){if(j===L)return et;var s=o?--L:j++;return C&&C[s]}}function iterateNode(s,u,_){var C,j=s&&s.array,L=_>i?0:i-_>>u,B=1+(a-_>>u);return B>x&&(B=x),function(){for(;;){if(C){var s=C();if(s!==et)return s;C=null}if(L===B)return et;var i=o?--B:L++;C=iterateNodeOrLeaf(j&&j[i],u-w,_+(i<=s.size||o<0)return s.withMutations((function(s){o<0?setListBounds(s,o).set(0,i):setListBounds(s,0,o+1).set(o,i)}));o+=s._origin;var a=s._tail,u=s._root,_=MakeRef(B);return o>=getTailOffset(s._capacity)?a=updateVNode(a,s.__ownerID,0,o,i,_):u=updateVNode(u,s.__ownerID,s._level,o,i,_),_.value?s.__ownerID?(s._root=u,s._tail=a,s.__hash=void 0,s.__altered=!0,s):makeList(s._origin,s._capacity,s._level,u,a):s}function updateVNode(s,o,i,a,u,_){var x,j=a>>>i&C,L=s&&j0){var B=s&&s.array[j],$=updateVNode(B,o,i-w,a,u,_);return $===B?s:((x=editableVNode(s,o)).array[j]=$,x)}return L&&s.array[j]===u?s:(SetRef(_),x=editableVNode(s,o),void 0===u&&j===x.array.length-1?x.array.pop():x.array[j]=u,x)}function editableVNode(s,o){return o&&s&&o===s.ownerID?s:new VNode(s?s.array.slice():[],o)}function listNodeFor(s,o){if(o>=getTailOffset(s._capacity))return s._tail;if(o<1<0;)i=i.array[o>>>a&C],a-=w;return i}}function setListBounds(s,o,i){void 0!==o&&(o|=0),void 0!==i&&(i|=0);var a=s.__ownerID||new OwnerID,u=s._origin,_=s._capacity,x=u+o,j=void 0===i?_:i<0?_+i:u+i;if(x===u&&j===_)return s;if(x>=j)return s.clear();for(var L=s._level,B=s._root,$=0;x+$<0;)B=new VNode(B&&B.array.length?[void 0,B]:[],a),$+=1<<(L+=w);$&&(x+=$,u+=$,j+=$,_+=$);for(var U=getTailOffset(_),V=getTailOffset(j);V>=1<U?new VNode([],a):z;if(z&&V>U&&x<_&&z.array.length){for(var Z=B=editableVNode(B,a),ee=L;ee>w;ee-=w){var ie=U>>>ee&C;Z=Z.array[ie]=editableVNode(Z.array[ie],a)}Z.array[U>>>w&C]=z}if(j<_&&(Y=Y&&Y.removeAfter(a,0,j)),x>=V)x-=V,j-=V,L=w,B=null,Y=Y&&Y.removeBefore(a,0,x);else if(x>u||V>>L&C;if(ae!==V>>>L&C)break;ae&&($+=(1<u&&(B=B.removeBefore(a,L,x-$)),B&&Vu&&(u=x.size),isIterable(w)||(x=x.map((function(s){return fromJS(s)}))),a.push(x)}return u>s.size&&(s=s.setSize(u)),mergeIntoCollectionWith(s,o,a)}function getTailOffset(s){return s>>w<=x&&w.size>=2*_.size?(a=(u=w.filter((function(s,o){return void 0!==s&&C!==o}))).toKeyedSeq().map((function(s){return s[0]})).flip().toMap(),s.__ownerID&&(a.__ownerID=u.__ownerID=s.__ownerID)):(a=_.remove(o),u=C===w.size-1?w.pop():w.set(C,void 0))}else if(L){if(i===w.get(C)[1])return s;a=_,u=w.set(C,[o,i])}else a=_.set(o,w.size),u=w.set(w.size,[o,i]);return s.__ownerID?(s.size=a.size,s._map=a,s._list=u,s.__hash=void 0,s):makeOrderedMap(a,u)}function ToKeyedSequence(s,o){this._iter=s,this._useKeys=o,this.size=s.size}function ToIndexedSequence(s){this._iter=s,this.size=s.size}function ToSetSequence(s){this._iter=s,this.size=s.size}function FromEntriesSequence(s){this._iter=s,this.size=s.size}function flipFactory(s){var o=makeSequence(s);return o._iter=s,o.size=s.size,o.flip=function(){return s},o.reverse=function(){var o=s.reverse.apply(this);return o.flip=function(){return s.reverse()},o},o.has=function(o){return s.includes(o)},o.includes=function(o){return s.has(o)},o.cacheResult=cacheResultThrough,o.__iterateUncached=function(o,i){var a=this;return s.__iterate((function(s,i){return!1!==o(i,s,a)}),i)},o.__iteratorUncached=function(o,i){if(o===V){var a=s.__iterator(o,i);return new Iterator((function(){var s=a.next();if(!s.done){var o=s.value[0];s.value[0]=s.value[1],s.value[1]=o}return s}))}return s.__iterator(o===U?$:U,i)},o}function mapFactory(s,o,i){var a=makeSequence(s);return a.size=s.size,a.has=function(o){return s.has(o)},a.get=function(a,u){var _=s.get(a,j);return _===j?u:o.call(i,_,a,s)},a.__iterateUncached=function(a,u){var _=this;return s.__iterate((function(s,u,w){return!1!==a(o.call(i,s,u,w),u,_)}),u)},a.__iteratorUncached=function(a,u){var _=s.__iterator(V,u);return new Iterator((function(){var u=_.next();if(u.done)return u;var w=u.value,x=w[0];return iteratorValue(a,x,o.call(i,w[1],x,s),u)}))},a}function reverseFactory(s,o){var i=makeSequence(s);return i._iter=s,i.size=s.size,i.reverse=function(){return s},s.flip&&(i.flip=function(){var o=flipFactory(s);return o.reverse=function(){return s.flip()},o}),i.get=function(i,a){return s.get(o?i:-1-i,a)},i.has=function(i){return s.has(o?i:-1-i)},i.includes=function(o){return s.includes(o)},i.cacheResult=cacheResultThrough,i.__iterate=function(o,i){var a=this;return s.__iterate((function(s,i){return o(s,i,a)}),!i)},i.__iterator=function(o,i){return s.__iterator(o,!i)},i}function filterFactory(s,o,i,a){var u=makeSequence(s);return a&&(u.has=function(a){var u=s.get(a,j);return u!==j&&!!o.call(i,u,a,s)},u.get=function(a,u){var _=s.get(a,j);return _!==j&&o.call(i,_,a,s)?_:u}),u.__iterateUncached=function(u,_){var w=this,x=0;return s.__iterate((function(s,_,C){if(o.call(i,s,_,C))return x++,u(s,a?_:x-1,w)}),_),x},u.__iteratorUncached=function(u,_){var w=s.__iterator(V,_),x=0;return new Iterator((function(){for(;;){var _=w.next();if(_.done)return _;var C=_.value,j=C[0],L=C[1];if(o.call(i,L,j,s))return iteratorValue(u,a?j:x++,L,_)}}))},u}function countByFactory(s,o,i){var a=Map().asMutable();return s.__iterate((function(u,_){a.update(o.call(i,u,_,s),0,(function(s){return s+1}))})),a.asImmutable()}function groupByFactory(s,o,i){var a=isKeyed(s),u=(isOrdered(s)?OrderedMap():Map()).asMutable();s.__iterate((function(_,w){u.update(o.call(i,_,w,s),(function(s){return(s=s||[]).push(a?[w,_]:_),s}))}));var _=iterableClass(s);return u.map((function(o){return reify(s,_(o))}))}function sliceFactory(s,o,i,a){var u=s.size;if(void 0!==o&&(o|=0),void 0!==i&&(i===1/0?i=u:i|=0),wholeSlice(o,i,u))return s;var _=resolveBegin(o,u),w=resolveEnd(i,u);if(_!=_||w!=w)return sliceFactory(s.toSeq().cacheResult(),o,i,a);var x,C=w-_;C==C&&(x=C<0?0:C);var j=makeSequence(s);return j.size=0===x?x:s.size&&x||void 0,!a&&isSeq(s)&&x>=0&&(j.get=function(o,i){return(o=wrapIndex(this,o))>=0&&ox)return iteratorDone();var s=u.next();return a||o===U?s:iteratorValue(o,C-1,o===$?void 0:s.value[1],s)}))},j}function takeWhileFactory(s,o,i){var a=makeSequence(s);return a.__iterateUncached=function(a,u){var _=this;if(u)return this.cacheResult().__iterate(a,u);var w=0;return s.__iterate((function(s,u,x){return o.call(i,s,u,x)&&++w&&a(s,u,_)})),w},a.__iteratorUncached=function(a,u){var _=this;if(u)return this.cacheResult().__iterator(a,u);var w=s.__iterator(V,u),x=!0;return new Iterator((function(){if(!x)return iteratorDone();var s=w.next();if(s.done)return s;var u=s.value,C=u[0],j=u[1];return o.call(i,j,C,_)?a===V?s:iteratorValue(a,C,j,s):(x=!1,iteratorDone())}))},a}function skipWhileFactory(s,o,i,a){var u=makeSequence(s);return u.__iterateUncached=function(u,_){var w=this;if(_)return this.cacheResult().__iterate(u,_);var x=!0,C=0;return s.__iterate((function(s,_,j){if(!x||!(x=o.call(i,s,_,j)))return C++,u(s,a?_:C-1,w)})),C},u.__iteratorUncached=function(u,_){var w=this;if(_)return this.cacheResult().__iterator(u,_);var x=s.__iterator(V,_),C=!0,j=0;return new Iterator((function(){var s,_,L;do{if((s=x.next()).done)return a||u===U?s:iteratorValue(u,j++,u===$?void 0:s.value[1],s);var B=s.value;_=B[0],L=B[1],C&&(C=o.call(i,L,_,w))}while(C);return u===V?s:iteratorValue(u,_,L,s)}))},u}function concatFactory(s,o){var i=isKeyed(s),a=[s].concat(o).map((function(s){return isIterable(s)?i&&(s=KeyedIterable(s)):s=i?keyedSeqFromValue(s):indexedSeqFromValue(Array.isArray(s)?s:[s]),s})).filter((function(s){return 0!==s.size}));if(0===a.length)return s;if(1===a.length){var u=a[0];if(u===s||i&&isKeyed(u)||isIndexed(s)&&isIndexed(u))return u}var _=new ArraySeq(a);return i?_=_.toKeyedSeq():isIndexed(s)||(_=_.toSetSeq()),(_=_.flatten(!0)).size=a.reduce((function(s,o){if(void 0!==s){var i=o.size;if(void 0!==i)return s+i}}),0),_}function flattenFactory(s,o,i){var a=makeSequence(s);return a.__iterateUncached=function(a,u){var _=0,w=!1;function flatDeep(s,x){var C=this;s.__iterate((function(s,u){return(!o||x0}function zipWithFactory(s,o,i){var a=makeSequence(s);return a.size=new ArraySeq(i).map((function(s){return s.size})).min(),a.__iterate=function(s,o){for(var i,a=this.__iterator(U,o),u=0;!(i=a.next()).done&&!1!==s(i.value,u++,this););return u},a.__iteratorUncached=function(s,a){var u=i.map((function(s){return s=Iterable(s),getIterator(a?s.reverse():s)})),_=0,w=!1;return new Iterator((function(){var i;return w||(i=u.map((function(s){return s.next()})),w=i.some((function(s){return s.done}))),w?iteratorDone():iteratorValue(s,_++,o.apply(null,i.map((function(s){return s.value}))))}))},a}function reify(s,o){return isSeq(s)?o:s.constructor(o)}function validateEntry(s){if(s!==Object(s))throw new TypeError("Expected [K, V] tuple: "+s)}function resolveSize(s){return assertNotInfinite(s.size),ensureSize(s)}function iterableClass(s){return isKeyed(s)?KeyedIterable:isIndexed(s)?IndexedIterable:SetIterable}function makeSequence(s){return Object.create((isKeyed(s)?KeyedSeq:isIndexed(s)?IndexedSeq:SetSeq).prototype)}function cacheResultThrough(){return this._iter.cacheResult?(this._iter.cacheResult(),this.size=this._iter.size,this):Seq.prototype.cacheResult.call(this)}function defaultComparator(s,o){return s>o?1:s=0;i--)o={value:arguments[i],next:o};return this.__ownerID?(this.size=s,this._head=o,this.__hash=void 0,this.__altered=!0,this):makeStack(s,o)},Stack.prototype.pushAll=function(s){if(0===(s=IndexedIterable(s)).size)return this;assertNotInfinite(s.size);var o=this.size,i=this._head;return s.reverse().forEach((function(s){o++,i={value:s,next:i}})),this.__ownerID?(this.size=o,this._head=i,this.__hash=void 0,this.__altered=!0,this):makeStack(o,i)},Stack.prototype.pop=function(){return this.slice(1)},Stack.prototype.unshift=function(){return this.push.apply(this,arguments)},Stack.prototype.unshiftAll=function(s){return this.pushAll(s)},Stack.prototype.shift=function(){return this.pop.apply(this,arguments)},Stack.prototype.clear=function(){return 0===this.size?this:this.__ownerID?(this.size=0,this._head=void 0,this.__hash=void 0,this.__altered=!0,this):emptyStack()},Stack.prototype.slice=function(s,o){if(wholeSlice(s,o,this.size))return this;var i=resolveBegin(s,this.size);if(resolveEnd(o,this.size)!==this.size)return IndexedCollection.prototype.slice.call(this,s,o);for(var a=this.size-i,u=this._head;i--;)u=u.next;return this.__ownerID?(this.size=a,this._head=u,this.__hash=void 0,this.__altered=!0,this):makeStack(a,u)},Stack.prototype.__ensureOwner=function(s){return s===this.__ownerID?this:s?makeStack(this.size,this._head,s,this.__hash):(this.__ownerID=s,this.__altered=!1,this)},Stack.prototype.__iterate=function(s,o){if(o)return this.reverse().__iterate(s);for(var i=0,a=this._head;a&&!1!==s(a.value,i++,this);)a=a.next;return i},Stack.prototype.__iterator=function(s,o){if(o)return this.reverse().__iterator(s);var i=0,a=this._head;return new Iterator((function(){if(a){var o=a.value;return a=a.next,iteratorValue(s,i++,o)}return iteratorDone()}))},Stack.isStack=isStack;var at,ct="@@__IMMUTABLE_STACK__@@",lt=Stack.prototype;function makeStack(s,o,i,a){var u=Object.create(lt);return u.size=s,u._head=o,u.__ownerID=i,u.__hash=a,u.__altered=!1,u}function emptyStack(){return at||(at=makeStack(0))}function mixin(s,o){var keyCopier=function(i){s.prototype[i]=o[i]};return Object.keys(o).forEach(keyCopier),Object.getOwnPropertySymbols&&Object.getOwnPropertySymbols(o).forEach(keyCopier),s}lt[ct]=!0,lt.withMutations=$e.withMutations,lt.asMutable=$e.asMutable,lt.asImmutable=$e.asImmutable,lt.wasAltered=$e.wasAltered,Iterable.Iterator=Iterator,mixin(Iterable,{toArray:function(){assertNotInfinite(this.size);var s=new Array(this.size||0);return this.valueSeq().__iterate((function(o,i){s[i]=o})),s},toIndexedSeq:function(){return new ToIndexedSequence(this)},toJS:function(){return this.toSeq().map((function(s){return s&&"function"==typeof s.toJS?s.toJS():s})).__toJS()},toJSON:function(){return this.toSeq().map((function(s){return s&&"function"==typeof s.toJSON?s.toJSON():s})).__toJS()},toKeyedSeq:function(){return new ToKeyedSequence(this,!0)},toMap:function(){return Map(this.toKeyedSeq())},toObject:function(){assertNotInfinite(this.size);var s={};return this.__iterate((function(o,i){s[i]=o})),s},toOrderedMap:function(){return OrderedMap(this.toKeyedSeq())},toOrderedSet:function(){return OrderedSet(isKeyed(this)?this.valueSeq():this)},toSet:function(){return Set(isKeyed(this)?this.valueSeq():this)},toSetSeq:function(){return new ToSetSequence(this)},toSeq:function(){return isIndexed(this)?this.toIndexedSeq():isKeyed(this)?this.toKeyedSeq():this.toSetSeq()},toStack:function(){return Stack(isKeyed(this)?this.valueSeq():this)},toList:function(){return List(isKeyed(this)?this.valueSeq():this)},toString:function(){return"[Iterable]"},__toString:function(s,o){return 0===this.size?s+o:s+" "+this.toSeq().map(this.__toStringMapper).join(", ")+" "+o},concat:function(){return reify(this,concatFactory(this,s.call(arguments,0)))},includes:function(s){return this.some((function(o){return is(o,s)}))},entries:function(){return this.__iterator(V)},every:function(s,o){assertNotInfinite(this.size);var i=!0;return this.__iterate((function(a,u,_){if(!s.call(o,a,u,_))return i=!1,!1})),i},filter:function(s,o){return reify(this,filterFactory(this,s,o,!0))},find:function(s,o,i){var a=this.findEntry(s,o);return a?a[1]:i},forEach:function(s,o){return assertNotInfinite(this.size),this.__iterate(o?s.bind(o):s)},join:function(s){assertNotInfinite(this.size),s=void 0!==s?""+s:",";var o="",i=!0;return this.__iterate((function(a){i?i=!1:o+=s,o+=null!=a?a.toString():""})),o},keys:function(){return this.__iterator($)},map:function(s,o){return reify(this,mapFactory(this,s,o))},reduce:function(s,o,i){var a,u;return assertNotInfinite(this.size),arguments.length<2?u=!0:a=o,this.__iterate((function(o,_,w){u?(u=!1,a=o):a=s.call(i,a,o,_,w)})),a},reduceRight:function(s,o,i){var a=this.toKeyedSeq().reverse();return a.reduce.apply(a,arguments)},reverse:function(){return reify(this,reverseFactory(this,!0))},slice:function(s,o){return reify(this,sliceFactory(this,s,o,!0))},some:function(s,o){return!this.every(not(s),o)},sort:function(s){return reify(this,sortFactory(this,s))},values:function(){return this.__iterator(U)},butLast:function(){return this.slice(0,-1)},isEmpty:function(){return void 0!==this.size?0===this.size:!this.some((function(){return!0}))},count:function(s,o){return ensureSize(s?this.toSeq().filter(s,o):this)},countBy:function(s,o){return countByFactory(this,s,o)},equals:function(s){return deepEqual(this,s)},entrySeq:function(){var s=this;if(s._cache)return new ArraySeq(s._cache);var o=s.toSeq().map(entryMapper).toIndexedSeq();return o.fromEntrySeq=function(){return s.toSeq()},o},filterNot:function(s,o){return this.filter(not(s),o)},findEntry:function(s,o,i){var a=i;return this.__iterate((function(i,u,_){if(s.call(o,i,u,_))return a=[u,i],!1})),a},findKey:function(s,o){var i=this.findEntry(s,o);return i&&i[0]},findLast:function(s,o,i){return this.toKeyedSeq().reverse().find(s,o,i)},findLastEntry:function(s,o,i){return this.toKeyedSeq().reverse().findEntry(s,o,i)},findLastKey:function(s,o){return this.toKeyedSeq().reverse().findKey(s,o)},first:function(){return this.find(returnTrue)},flatMap:function(s,o){return reify(this,flatMapFactory(this,s,o))},flatten:function(s){return reify(this,flattenFactory(this,s,!0))},fromEntrySeq:function(){return new FromEntriesSequence(this)},get:function(s,o){return this.find((function(o,i){return is(i,s)}),void 0,o)},getIn:function(s,o){for(var i,a=this,u=forceIterator(s);!(i=u.next()).done;){var _=i.value;if((a=a&&a.get?a.get(_,j):j)===j)return o}return a},groupBy:function(s,o){return groupByFactory(this,s,o)},has:function(s){return this.get(s,j)!==j},hasIn:function(s){return this.getIn(s,j)!==j},isSubset:function(s){return s="function"==typeof s.includes?s:Iterable(s),this.every((function(o){return s.includes(o)}))},isSuperset:function(s){return(s="function"==typeof s.isSubset?s:Iterable(s)).isSubset(this)},keyOf:function(s){return this.findKey((function(o){return is(o,s)}))},keySeq:function(){return this.toSeq().map(keyMapper).toIndexedSeq()},last:function(){return this.toSeq().reverse().first()},lastKeyOf:function(s){return this.toKeyedSeq().reverse().keyOf(s)},max:function(s){return maxFactory(this,s)},maxBy:function(s,o){return maxFactory(this,o,s)},min:function(s){return maxFactory(this,s?neg(s):defaultNegComparator)},minBy:function(s,o){return maxFactory(this,o?neg(o):defaultNegComparator,s)},rest:function(){return this.slice(1)},skip:function(s){return this.slice(Math.max(0,s))},skipLast:function(s){return reify(this,this.toSeq().reverse().skip(s).reverse())},skipWhile:function(s,o){return reify(this,skipWhileFactory(this,s,o,!0))},skipUntil:function(s,o){return this.skipWhile(not(s),o)},sortBy:function(s,o){return reify(this,sortFactory(this,o,s))},take:function(s){return this.slice(0,Math.max(0,s))},takeLast:function(s){return reify(this,this.toSeq().reverse().take(s).reverse())},takeWhile:function(s,o){return reify(this,takeWhileFactory(this,s,o))},takeUntil:function(s,o){return this.takeWhile(not(s),o)},valueSeq:function(){return this.toIndexedSeq()},hashCode:function(){return this.__hash||(this.__hash=hashIterable(this))}});var ut=Iterable.prototype;ut[o]=!0,ut[Z]=ut.values,ut.__toJS=ut.toArray,ut.__toStringMapper=quoteString,ut.inspect=ut.toSource=function(){return this.toString()},ut.chain=ut.flatMap,ut.contains=ut.includes,mixin(KeyedIterable,{flip:function(){return reify(this,flipFactory(this))},mapEntries:function(s,o){var i=this,a=0;return reify(this,this.toSeq().map((function(u,_){return s.call(o,[_,u],a++,i)})).fromEntrySeq())},mapKeys:function(s,o){var i=this;return reify(this,this.toSeq().flip().map((function(a,u){return s.call(o,a,u,i)})).flip())}});var pt=KeyedIterable.prototype;function keyMapper(s,o){return o}function entryMapper(s,o){return[o,s]}function not(s){return function(){return!s.apply(this,arguments)}}function neg(s){return function(){return-s.apply(this,arguments)}}function quoteString(s){return"string"==typeof s?JSON.stringify(s):String(s)}function defaultZipper(){return arrCopy(arguments)}function defaultNegComparator(s,o){return so?-1:0}function hashIterable(s){if(s.size===1/0)return 0;var o=isOrdered(s),i=isKeyed(s),a=o?1:0;return murmurHashOfSize(s.__iterate(i?o?function(s,o){a=31*a+hashMerge(hash(s),hash(o))|0}:function(s,o){a=a+hashMerge(hash(s),hash(o))|0}:o?function(s){a=31*a+hash(s)|0}:function(s){a=a+hash(s)|0}),a)}function murmurHashOfSize(s,o){return o=le(o,3432918353),o=le(o<<15|o>>>-15,461845907),o=le(o<<13|o>>>-13,5),o=le((o=o+3864292196^s)^o>>>16,2246822507),o=smi((o=le(o^o>>>13,3266489909))^o>>>16)}function hashMerge(s,o){return s^o+2654435769+(s<<6)+(s>>2)}return pt[i]=!0,pt[Z]=ut.entries,pt.__toJS=ut.toObject,pt.__toStringMapper=function(s,o){return JSON.stringify(o)+": "+quoteString(s)},mixin(IndexedIterable,{toKeyedSeq:function(){return new ToKeyedSequence(this,!1)},filter:function(s,o){return reify(this,filterFactory(this,s,o,!1))},findIndex:function(s,o){var i=this.findEntry(s,o);return i?i[0]:-1},indexOf:function(s){var o=this.keyOf(s);return void 0===o?-1:o},lastIndexOf:function(s){var o=this.lastKeyOf(s);return void 0===o?-1:o},reverse:function(){return reify(this,reverseFactory(this,!1))},slice:function(s,o){return reify(this,sliceFactory(this,s,o,!1))},splice:function(s,o){var i=arguments.length;if(o=Math.max(0|o,0),0===i||2===i&&!o)return this;s=resolveBegin(s,s<0?this.count():this.size);var a=this.slice(0,s);return reify(this,1===i?a:a.concat(arrCopy(arguments,2),this.slice(s+o)))},findLastIndex:function(s,o){var i=this.findLastEntry(s,o);return i?i[0]:-1},first:function(){return this.get(0)},flatten:function(s){return reify(this,flattenFactory(this,s,!1))},get:function(s,o){return(s=wrapIndex(this,s))<0||this.size===1/0||void 0!==this.size&&s>this.size?o:this.find((function(o,i){return i===s}),void 0,o)},has:function(s){return(s=wrapIndex(this,s))>=0&&(void 0!==this.size?this.size===1/0||s{"use strict";i(71340);var a=i(92046);s.exports=a.Object.assign},9957:(s,o,i)=>{"use strict";var a=Function.prototype.call,u=Object.prototype.hasOwnProperty,_=i(66743);s.exports=_.call(a,u)},9999:(s,o,i)=>{var a=i(37217),u=i(83729),_=i(16547),w=i(74733),x=i(43838),C=i(93290),j=i(23007),L=i(92271),B=i(48948),$=i(50002),U=i(83349),V=i(5861),z=i(76189),Y=i(77199),Z=i(35529),ee=i(56449),ie=i(3656),ae=i(87730),ce=i(23805),le=i(38440),pe=i(95950),de=i(37241),fe="[object Arguments]",ye="[object Function]",be="[object Object]",_e={};_e[fe]=_e["[object Array]"]=_e["[object ArrayBuffer]"]=_e["[object DataView]"]=_e["[object Boolean]"]=_e["[object Date]"]=_e["[object Float32Array]"]=_e["[object Float64Array]"]=_e["[object Int8Array]"]=_e["[object Int16Array]"]=_e["[object Int32Array]"]=_e["[object Map]"]=_e["[object Number]"]=_e[be]=_e["[object RegExp]"]=_e["[object Set]"]=_e["[object String]"]=_e["[object Symbol]"]=_e["[object Uint8Array]"]=_e["[object Uint8ClampedArray]"]=_e["[object Uint16Array]"]=_e["[object Uint32Array]"]=!0,_e["[object Error]"]=_e[ye]=_e["[object WeakMap]"]=!1,s.exports=function baseClone(s,o,i,Se,we,xe){var Pe,Te=1&o,Re=2&o,$e=4&o;if(i&&(Pe=we?i(s,Se,we,xe):i(s)),void 0!==Pe)return Pe;if(!ce(s))return s;var qe=ee(s);if(qe){if(Pe=z(s),!Te)return j(s,Pe)}else{var ze=V(s),We=ze==ye||"[object GeneratorFunction]"==ze;if(ie(s))return C(s,Te);if(ze==be||ze==fe||We&&!we){if(Pe=Re||We?{}:Z(s),!Te)return Re?B(s,x(Pe,s)):L(s,w(Pe,s))}else{if(!_e[ze])return we?s:{};Pe=Y(s,ze,Te)}}xe||(xe=new a);var He=xe.get(s);if(He)return He;xe.set(s,Pe),le(s)?s.forEach((function(a){Pe.add(baseClone(a,o,i,a,s,xe))})):ae(s)&&s.forEach((function(a,u){Pe.set(u,baseClone(a,o,i,u,s,xe))}));var Ye=qe?void 0:($e?Re?U:$:Re?de:pe)(s);return u(Ye||s,(function(a,u){Ye&&(a=s[u=a]),_(Pe,u,baseClone(a,o,i,u,s,xe))})),Pe}},10023:(s,o,i)=>{const a=i(6205),INTS=()=>[{type:a.RANGE,from:48,to:57}],WORDS=()=>[{type:a.CHAR,value:95},{type:a.RANGE,from:97,to:122},{type:a.RANGE,from:65,to:90}].concat(INTS()),WHITESPACE=()=>[{type:a.CHAR,value:9},{type:a.CHAR,value:10},{type:a.CHAR,value:11},{type:a.CHAR,value:12},{type:a.CHAR,value:13},{type:a.CHAR,value:32},{type:a.CHAR,value:160},{type:a.CHAR,value:5760},{type:a.RANGE,from:8192,to:8202},{type:a.CHAR,value:8232},{type:a.CHAR,value:8233},{type:a.CHAR,value:8239},{type:a.CHAR,value:8287},{type:a.CHAR,value:12288},{type:a.CHAR,value:65279}];o.words=()=>({type:a.SET,set:WORDS(),not:!1}),o.notWords=()=>({type:a.SET,set:WORDS(),not:!0}),o.ints=()=>({type:a.SET,set:INTS(),not:!1}),o.notInts=()=>({type:a.SET,set:INTS(),not:!0}),o.whitespace=()=>({type:a.SET,set:WHITESPACE(),not:!1}),o.notWhitespace=()=>({type:a.SET,set:WHITESPACE(),not:!0}),o.anyChar=()=>({type:a.SET,set:[{type:a.CHAR,value:10},{type:a.CHAR,value:13},{type:a.CHAR,value:8232},{type:a.CHAR,value:8233}],not:!0})},10043:(s,o,i)=>{"use strict";var a=i(54018),u=String,_=TypeError;s.exports=function(s){if(a(s))return s;throw new _("Can't set "+u(s)+" as a prototype")}},10076:s=>{"use strict";s.exports=Function.prototype.call},10124:(s,o,i)=>{var a=i(9325);s.exports=function(){return a.Date.now()}},10300:(s,o,i)=>{"use strict";var a=i(13930),u=i(82159),_=i(36624),w=i(4640),x=i(73448),C=TypeError;s.exports=function(s,o){var i=arguments.length<2?x(s):o;if(u(i))return _(a(i,s));throw new C(w(s)+" is not iterable")}},10316:(s,o,i)=>{const a=i(2404),u=i(55973),_=i(92340);class Element{constructor(s,o,i){o&&(this.meta=o),i&&(this.attributes=i),this.content=s}freeze(){Object.isFrozen(this)||(this._meta&&(this.meta.parent=this,this.meta.freeze()),this._attributes&&(this.attributes.parent=this,this.attributes.freeze()),this.children.forEach((s=>{s.parent=this,s.freeze()}),this),this.content&&Array.isArray(this.content)&&Object.freeze(this.content),Object.freeze(this))}primitive(){}clone(){const s=new this.constructor;return s.element=this.element,this.meta.length&&(s._meta=this.meta.clone()),this.attributes.length&&(s._attributes=this.attributes.clone()),this.content?this.content.clone?s.content=this.content.clone():Array.isArray(this.content)?s.content=this.content.map((s=>s.clone())):s.content=this.content:s.content=this.content,s}toValue(){return this.content instanceof Element?this.content.toValue():this.content instanceof u?{key:this.content.key.toValue(),value:this.content.value?this.content.value.toValue():void 0}:this.content&&this.content.map?this.content.map((s=>s.toValue()),this):this.content}toRef(s){if(""===this.id.toValue())throw Error("Cannot create reference to an element that does not contain an ID");const o=new this.RefElement(this.id.toValue());return s&&(o.path=s),o}findRecursive(...s){if(arguments.length>1&&!this.isFrozen)throw new Error("Cannot find recursive with multiple element names without first freezing the element. Call `element.freeze()`");const o=s.pop();let i=new _;const append=(s,o)=>(s.push(o),s),checkElement=(s,i)=>{i.element===o&&s.push(i);const a=i.findRecursive(o);return a&&a.reduce(append,s),i.content instanceof u&&(i.content.key&&checkElement(s,i.content.key),i.content.value&&checkElement(s,i.content.value)),s};return this.content&&(this.content.element&&checkElement(i,this.content),Array.isArray(this.content)&&this.content.reduce(checkElement,i)),s.isEmpty||(i=i.filter((o=>{let i=o.parents.map((s=>s.element));for(const o in s){const a=s[o],u=i.indexOf(a);if(-1===u)return!1;i=i.splice(0,u)}return!0}))),i}set(s){return this.content=s,this}equals(s){return a(this.toValue(),s)}getMetaProperty(s,o){if(!this.meta.hasKey(s)){if(this.isFrozen){const s=this.refract(o);return s.freeze(),s}this.meta.set(s,o)}return this.meta.get(s)}setMetaProperty(s,o){this.meta.set(s,o)}get element(){return this._storedElement||"element"}set element(s){this._storedElement=s}get content(){return this._content}set content(s){if(s instanceof Element)this._content=s;else if(s instanceof _)this.content=s.elements;else if("string"==typeof s||"number"==typeof s||"boolean"==typeof s||"null"===s||null==s)this._content=s;else if(s instanceof u)this._content=s;else if(Array.isArray(s))this._content=s.map(this.refract);else{if("object"!=typeof s)throw new Error("Cannot set content to given value");this._content=Object.keys(s).map((o=>new this.MemberElement(o,s[o])))}}get meta(){if(!this._meta){if(this.isFrozen){const s=new this.ObjectElement;return s.freeze(),s}this._meta=new this.ObjectElement}return this._meta}set meta(s){s instanceof this.ObjectElement?this._meta=s:this.meta.set(s||{})}get attributes(){if(!this._attributes){if(this.isFrozen){const s=new this.ObjectElement;return s.freeze(),s}this._attributes=new this.ObjectElement}return this._attributes}set attributes(s){s instanceof this.ObjectElement?this._attributes=s:this.attributes.set(s||{})}get id(){return this.getMetaProperty("id","")}set id(s){this.setMetaProperty("id",s)}get classes(){return this.getMetaProperty("classes",[])}set classes(s){this.setMetaProperty("classes",s)}get title(){return this.getMetaProperty("title","")}set title(s){this.setMetaProperty("title",s)}get description(){return this.getMetaProperty("description","")}set description(s){this.setMetaProperty("description",s)}get links(){return this.getMetaProperty("links",[])}set links(s){this.setMetaProperty("links",s)}get isFrozen(){return Object.isFrozen(this)}get parents(){let{parent:s}=this;const o=new _;for(;s;)o.push(s),s=s.parent;return o}get children(){if(Array.isArray(this.content))return new _(this.content);if(this.content instanceof u){const s=new _([this.content.key]);return this.content.value&&s.push(this.content.value),s}return this.content instanceof Element?new _([this.content]):new _}get recursiveChildren(){const s=new _;return this.children.forEach((o=>{s.push(o),o.recursiveChildren.forEach((o=>{s.push(o)}))})),s}}s.exports=Element},10392:s=>{s.exports=function getValue(s,o){return null==s?void 0:s[o]}},10487:(s,o,i)=>{"use strict";var a=i(96897),u=i(30655),_=i(73126),w=i(12205);s.exports=function callBind(s){var o=_(arguments),i=s.length-(arguments.length-1);return a(o,1+(i>0?i:0),!0)},u?u(s.exports,"apply",{value:w}):s.exports.apply=w},10776:(s,o,i)=>{var a=i(30756),u=i(95950);s.exports=function getMatchData(s){for(var o=u(s),i=o.length;i--;){var _=o[i],w=s[_];o[i]=[_,w,a(w)]}return o}},10866:(s,o,i)=>{const a=i(6048),u=i(92340);class ObjectSlice extends u{map(s,o){return this.elements.map((i=>s.bind(o)(i.value,i.key,i)))}filter(s,o){return new ObjectSlice(this.elements.filter((i=>s.bind(o)(i.value,i.key,i))))}reject(s,o){return this.filter(a(s.bind(o)))}forEach(s,o){return this.elements.forEach(((i,a)=>{s.bind(o)(i.value,i.key,i,a)}))}keys(){return this.map(((s,o)=>o.toValue()))}values(){return this.map((s=>s.toValue()))}}s.exports=ObjectSlice},11002:s=>{"use strict";s.exports=Function.prototype.apply},11042:(s,o,i)=>{"use strict";var a=i(85582),u=i(1907),_=i(24443),w=i(87170),x=i(36624),C=u([].concat);s.exports=a("Reflect","ownKeys")||function ownKeys(s){var o=_.f(x(s)),i=w.f;return i?C(o,i(s)):o}},11091:(s,o,i)=>{"use strict";var a=i(45951),u=i(76024),_=i(92361),w=i(62250),x=i(13846).f,C=i(7463),j=i(92046),L=i(28311),B=i(61626),$=i(49724);i(36128);var wrapConstructor=function(s){var Wrapper=function(o,i,a){if(this instanceof Wrapper){switch(arguments.length){case 0:return new s;case 1:return new s(o);case 2:return new s(o,i)}return new s(o,i,a)}return u(s,this,arguments)};return Wrapper.prototype=s.prototype,Wrapper};s.exports=function(s,o){var i,u,U,V,z,Y,Z,ee,ie,ae=s.target,ce=s.global,le=s.stat,pe=s.proto,de=ce?a:le?a[ae]:a[ae]&&a[ae].prototype,fe=ce?j:j[ae]||B(j,ae,{})[ae],ye=fe.prototype;for(V in o)u=!(i=C(ce?V:ae+(le?".":"#")+V,s.forced))&&de&&$(de,V),Y=fe[V],u&&(Z=s.dontCallGetSet?(ie=x(de,V))&&ie.value:de[V]),z=u&&Z?Z:o[V],(i||pe||typeof Y!=typeof z)&&(ee=s.bind&&u?L(z,a):s.wrap&&u?wrapConstructor(z):pe&&w(z)?_(z):z,(s.sham||z&&z.sham||Y&&Y.sham)&&B(ee,"sham",!0),B(fe,V,ee),pe&&($(j,U=ae+"Prototype")||B(j,U,{}),B(j[U],V,z),s.real&&ye&&(i||!ye[V])&&B(ye,V,z)))}},11287:s=>{s.exports=function getHolder(s){return s.placeholder}},11331:(s,o,i)=>{var a=i(72552),u=i(28879),_=i(40346),w=Function.prototype,x=Object.prototype,C=w.toString,j=x.hasOwnProperty,L=C.call(Object);s.exports=function isPlainObject(s){if(!_(s)||"[object Object]"!=a(s))return!1;var o=u(s);if(null===o)return!0;var i=j.call(o,"constructor")&&o.constructor;return"function"==typeof i&&i instanceof i&&C.call(i)==L}},11470:(s,o,i)=>{"use strict";var a=i(1907),u=i(65482),_=i(90160),w=i(74239),x=a("".charAt),C=a("".charCodeAt),j=a("".slice),createMethod=function(s){return function(o,i){var a,L,B=_(w(o)),$=u(i),U=B.length;return $<0||$>=U?s?"":void 0:(a=C(B,$))<55296||a>56319||$+1===U||(L=C(B,$+1))<56320||L>57343?s?x(B,$):a:s?j(B,$,$+2):L-56320+(a-55296<<10)+65536}};s.exports={codeAt:createMethod(!1),charAt:createMethod(!0)}},11842:(s,o,i)=>{var a=i(82819),u=i(9325);s.exports=function createBind(s,o,i){var _=1&o,w=a(s);return function wrapper(){return(this&&this!==u&&this instanceof wrapper?w:s).apply(_?i:this,arguments)}}},12205:(s,o,i)=>{"use strict";var a=i(66743),u=i(11002),_=i(13144);s.exports=function applyBind(){return _(a,u,arguments)}},12242:(s,o,i)=>{const a=i(10316);s.exports=class BooleanElement extends a{constructor(s,o,i){super(s,o,i),this.element="boolean"}primitive(){return"boolean"}}},12507:(s,o,i)=>{var a=i(28754),u=i(49698),_=i(63912),w=i(13222);s.exports=function createCaseFirst(s){return function(o){o=w(o);var i=u(o)?_(o):void 0,x=i?i[0]:o.charAt(0),C=i?a(i,1).join(""):o.slice(1);return x[s]()+C}}},12560:(s,o,i)=>{"use strict";i(99363);var a=i(19287),u=i(45951),_=i(14840),w=i(93742);for(var x in a)_(u[x],x),w[x]=w.Array},12651:(s,o,i)=>{var a=i(74218);s.exports=function getMapData(s,o){var i=s.__data__;return a(o)?i["string"==typeof o?"string":"hash"]:i.map}},12749:(s,o,i)=>{var a=i(81042),u=Object.prototype.hasOwnProperty;s.exports=function hashHas(s){var o=this.__data__;return a?void 0!==o[s]:u.call(o,s)}},13144:(s,o,i)=>{"use strict";var a=i(66743),u=i(11002),_=i(10076),w=i(47119);s.exports=w||a.call(_,u)},13222:(s,o,i)=>{var a=i(77556);s.exports=function toString(s){return null==s?"":a(s)}},13846:(s,o,i)=>{"use strict";var a=i(39447),u=i(13930),_=i(22574),w=i(75817),x=i(4993),C=i(70470),j=i(49724),L=i(73648),B=Object.getOwnPropertyDescriptor;o.f=a?B:function getOwnPropertyDescriptor(s,o){if(s=x(s),o=C(o),L)try{return B(s,o)}catch(s){}if(j(s,o))return w(!u(_.f,s,o),s[o])}},13930:(s,o,i)=>{"use strict";var a=i(41505),u=Function.prototype.call;s.exports=a?u.bind(u):function(){return u.apply(u,arguments)}},14248:s=>{s.exports=function arraySome(s,o){for(var i=-1,a=null==s?0:s.length;++i{s.exports=function arrayPush(s,o){for(var i=-1,a=o.length,u=s.length;++i{const a=i(10316);s.exports=class RefElement extends a{constructor(s,o,i){super(s||[],o,i),this.element="ref",this.path||(this.path="element")}get path(){return this.attributes.get("path")}set path(s){this.attributes.set("path",s)}}},14744:s=>{"use strict";var o=function isMergeableObject(s){return function isNonNullObject(s){return!!s&&"object"==typeof s}(s)&&!function isSpecial(s){var o=Object.prototype.toString.call(s);return"[object RegExp]"===o||"[object Date]"===o||function isReactElement(s){return s.$$typeof===i}(s)}(s)};var i="function"==typeof Symbol&&Symbol.for?Symbol.for("react.element"):60103;function cloneUnlessOtherwiseSpecified(s,o){return!1!==o.clone&&o.isMergeableObject(s)?deepmerge(function emptyTarget(s){return Array.isArray(s)?[]:{}}(s),s,o):s}function defaultArrayMerge(s,o,i){return s.concat(o).map((function(s){return cloneUnlessOtherwiseSpecified(s,i)}))}function getKeys(s){return Object.keys(s).concat(function getEnumerableOwnPropertySymbols(s){return Object.getOwnPropertySymbols?Object.getOwnPropertySymbols(s).filter((function(o){return Object.propertyIsEnumerable.call(s,o)})):[]}(s))}function propertyIsOnObject(s,o){try{return o in s}catch(s){return!1}}function mergeObject(s,o,i){var a={};return i.isMergeableObject(s)&&getKeys(s).forEach((function(o){a[o]=cloneUnlessOtherwiseSpecified(s[o],i)})),getKeys(o).forEach((function(u){(function propertyIsUnsafe(s,o){return propertyIsOnObject(s,o)&&!(Object.hasOwnProperty.call(s,o)&&Object.propertyIsEnumerable.call(s,o))})(s,u)||(propertyIsOnObject(s,u)&&i.isMergeableObject(o[u])?a[u]=function getMergeFunction(s,o){if(!o.customMerge)return deepmerge;var i=o.customMerge(s);return"function"==typeof i?i:deepmerge}(u,i)(s[u],o[u],i):a[u]=cloneUnlessOtherwiseSpecified(o[u],i))})),a}function deepmerge(s,i,a){(a=a||{}).arrayMerge=a.arrayMerge||defaultArrayMerge,a.isMergeableObject=a.isMergeableObject||o,a.cloneUnlessOtherwiseSpecified=cloneUnlessOtherwiseSpecified;var u=Array.isArray(i);return u===Array.isArray(s)?u?a.arrayMerge(s,i,a):mergeObject(s,i,a):cloneUnlessOtherwiseSpecified(i,a)}deepmerge.all=function deepmergeAll(s,o){if(!Array.isArray(s))throw new Error("first argument should be an array");return s.reduce((function(s,i){return deepmerge(s,i,o)}),{})};var a=deepmerge;s.exports=a},14792:(s,o,i)=>{var a=i(13222),u=i(55808);s.exports=function capitalize(s){return u(a(s).toLowerCase())}},14840:(s,o,i)=>{"use strict";var a=i(52623),u=i(74284).f,_=i(61626),w=i(49724),x=i(54878),C=i(76264)("toStringTag");s.exports=function(s,o,i,j){var L=i?s:s&&s.prototype;L&&(w(L,C)||u(L,C,{configurable:!0,value:o}),j&&!a&&_(L,"toString",x))}},14974:s=>{s.exports=function safeGet(s,o){if(("constructor"!==o||"function"!=typeof s[o])&&"__proto__"!=o)return s[o]}},15287:(s,o)=>{"use strict";var i=Symbol.for("react.element"),a=Symbol.for("react.portal"),u=Symbol.for("react.fragment"),_=Symbol.for("react.strict_mode"),w=Symbol.for("react.profiler"),x=Symbol.for("react.provider"),C=Symbol.for("react.context"),j=Symbol.for("react.forward_ref"),L=Symbol.for("react.suspense"),B=Symbol.for("react.memo"),$=Symbol.for("react.lazy"),U=Symbol.iterator;var V={isMounted:function(){return!1},enqueueForceUpdate:function(){},enqueueReplaceState:function(){},enqueueSetState:function(){}},z=Object.assign,Y={};function E(s,o,i){this.props=s,this.context=o,this.refs=Y,this.updater=i||V}function F(){}function G(s,o,i){this.props=s,this.context=o,this.refs=Y,this.updater=i||V}E.prototype.isReactComponent={},E.prototype.setState=function(s,o){if("object"!=typeof s&&"function"!=typeof s&&null!=s)throw Error("setState(...): takes an object of state variables to update or a function which returns an object of state variables.");this.updater.enqueueSetState(this,s,o,"setState")},E.prototype.forceUpdate=function(s){this.updater.enqueueForceUpdate(this,s,"forceUpdate")},F.prototype=E.prototype;var Z=G.prototype=new F;Z.constructor=G,z(Z,E.prototype),Z.isPureReactComponent=!0;var ee=Array.isArray,ie=Object.prototype.hasOwnProperty,ae={current:null},ce={key:!0,ref:!0,__self:!0,__source:!0};function M(s,o,a){var u,_={},w=null,x=null;if(null!=o)for(u in void 0!==o.ref&&(x=o.ref),void 0!==o.key&&(w=""+o.key),o)ie.call(o,u)&&!ce.hasOwnProperty(u)&&(_[u]=o[u]);var C=arguments.length-2;if(1===C)_.children=a;else if(1{var a=i(96131);s.exports=function arrayIncludes(s,o){return!!(null==s?0:s.length)&&a(s,o,0)>-1}},15340:()=>{},15377:(s,o,i)=>{"use strict";var a=i(92861).Buffer,u=i(64634),_=i(74372),w=ArrayBuffer.isView||function isView(s){try{return _(s),!0}catch(s){return!1}},x="undefined"!=typeof Uint8Array,C="undefined"!=typeof ArrayBuffer&&"undefined"!=typeof Uint8Array,j=C&&(a.prototype instanceof Uint8Array||a.TYPED_ARRAY_SUPPORT);s.exports=function toBuffer(s,o){if(s instanceof a)return s;if("string"==typeof s)return a.from(s,o);if(C&&w(s)){if(0===s.byteLength)return a.alloc(0);if(j){var i=a.from(s.buffer,s.byteOffset,s.byteLength);if(i.byteLength===s.byteLength)return i}var _=s instanceof Uint8Array?s:new Uint8Array(s.buffer,s.byteOffset,s.byteLength),L=a.from(_);if(L.length===s.byteLength)return L}if(x&&s instanceof Uint8Array)return a.from(s);var B=u(s);if(B)for(var $=0;$255||~~U!==U)throw new RangeError("Array items must be numbers in the range 0-255.")}if(B||a.isBuffer(s)&&s.constructor&&"function"==typeof s.constructor.isBuffer&&s.constructor.isBuffer(s))return a.from(s);throw new TypeError('The "data" argument must be a string, an Array, a Buffer, a Uint8Array, or a DataView.')}},15389:(s,o,i)=>{var a=i(93663),u=i(87978),_=i(83488),w=i(56449),x=i(50583);s.exports=function baseIteratee(s){return"function"==typeof s?s:null==s?_:"object"==typeof s?w(s)?u(s[0],s[1]):a(s):x(s)}},15972:(s,o,i)=>{"use strict";var a=i(49724),u=i(62250),_=i(39298),w=i(92522),x=i(57382),C=w("IE_PROTO"),j=Object,L=j.prototype;s.exports=x?j.getPrototypeOf:function(s){var o=_(s);if(a(o,C))return o[C];var i=o.constructor;return u(i)&&o instanceof i?i.prototype:o instanceof j?L:null}},16038:(s,o,i)=>{var a=i(5861),u=i(40346);s.exports=function baseIsSet(s){return u(s)&&"[object Set]"==a(s)}},16426:s=>{s.exports=function(){var s=document.getSelection();if(!s.rangeCount)return function(){};for(var o=document.activeElement,i=[],a=0;a{var a=i(43360),u=i(75288),_=Object.prototype.hasOwnProperty;s.exports=function assignValue(s,o,i){var w=s[o];_.call(s,o)&&u(w,i)&&(void 0!==i||o in s)||a(s,o,i)}},16708:(s,o,i)=>{"use strict";var a,u=i(65606);function CorkedRequest(s){var o=this;this.next=null,this.entry=null,this.finish=function(){!function onCorkedFinish(s,o,i){var a=s.entry;s.entry=null;for(;a;){var u=a.callback;o.pendingcb--,u(i),a=a.next}o.corkedRequestsFree.next=s}(o,s)}}s.exports=Writable,Writable.WritableState=WritableState;var _={deprecate:i(94643)},w=i(40345),x=i(48287).Buffer,C=(void 0!==i.g?i.g:"undefined"!=typeof window?window:"undefined"!=typeof self?self:{}).Uint8Array||function(){};var j,L=i(75896),B=i(65291).getHighWaterMark,$=i(86048).F,U=$.ERR_INVALID_ARG_TYPE,V=$.ERR_METHOD_NOT_IMPLEMENTED,z=$.ERR_MULTIPLE_CALLBACK,Y=$.ERR_STREAM_CANNOT_PIPE,Z=$.ERR_STREAM_DESTROYED,ee=$.ERR_STREAM_NULL_VALUES,ie=$.ERR_STREAM_WRITE_AFTER_END,ae=$.ERR_UNKNOWN_ENCODING,ce=L.errorOrDestroy;function nop(){}function WritableState(s,o,_){a=a||i(25382),s=s||{},"boolean"!=typeof _&&(_=o instanceof a),this.objectMode=!!s.objectMode,_&&(this.objectMode=this.objectMode||!!s.writableObjectMode),this.highWaterMark=B(this,s,"writableHighWaterMark",_),this.finalCalled=!1,this.needDrain=!1,this.ending=!1,this.ended=!1,this.finished=!1,this.destroyed=!1;var w=!1===s.decodeStrings;this.decodeStrings=!w,this.defaultEncoding=s.defaultEncoding||"utf8",this.length=0,this.writing=!1,this.corked=0,this.sync=!0,this.bufferProcessing=!1,this.onwrite=function(s){!function onwrite(s,o){var i=s._writableState,a=i.sync,_=i.writecb;if("function"!=typeof _)throw new z;if(function onwriteStateUpdate(s){s.writing=!1,s.writecb=null,s.length-=s.writelen,s.writelen=0}(i),o)!function onwriteError(s,o,i,a,_){--o.pendingcb,i?(u.nextTick(_,a),u.nextTick(finishMaybe,s,o),s._writableState.errorEmitted=!0,ce(s,a)):(_(a),s._writableState.errorEmitted=!0,ce(s,a),finishMaybe(s,o))}(s,i,a,o,_);else{var w=needFinish(i)||s.destroyed;w||i.corked||i.bufferProcessing||!i.bufferedRequest||clearBuffer(s,i),a?u.nextTick(afterWrite,s,i,w,_):afterWrite(s,i,w,_)}}(o,s)},this.writecb=null,this.writelen=0,this.bufferedRequest=null,this.lastBufferedRequest=null,this.pendingcb=0,this.prefinished=!1,this.errorEmitted=!1,this.emitClose=!1!==s.emitClose,this.autoDestroy=!!s.autoDestroy,this.bufferedRequestCount=0,this.corkedRequestsFree=new CorkedRequest(this)}function Writable(s){var o=this instanceof(a=a||i(25382));if(!o&&!j.call(Writable,this))return new Writable(s);this._writableState=new WritableState(s,this,o),this.writable=!0,s&&("function"==typeof s.write&&(this._write=s.write),"function"==typeof s.writev&&(this._writev=s.writev),"function"==typeof s.destroy&&(this._destroy=s.destroy),"function"==typeof s.final&&(this._final=s.final)),w.call(this)}function doWrite(s,o,i,a,u,_,w){o.writelen=a,o.writecb=w,o.writing=!0,o.sync=!0,o.destroyed?o.onwrite(new Z("write")):i?s._writev(u,o.onwrite):s._write(u,_,o.onwrite),o.sync=!1}function afterWrite(s,o,i,a){i||function onwriteDrain(s,o){0===o.length&&o.needDrain&&(o.needDrain=!1,s.emit("drain"))}(s,o),o.pendingcb--,a(),finishMaybe(s,o)}function clearBuffer(s,o){o.bufferProcessing=!0;var i=o.bufferedRequest;if(s._writev&&i&&i.next){var a=o.bufferedRequestCount,u=new Array(a),_=o.corkedRequestsFree;_.entry=i;for(var w=0,x=!0;i;)u[w]=i,i.isBuf||(x=!1),i=i.next,w+=1;u.allBuffers=x,doWrite(s,o,!0,o.length,u,"",_.finish),o.pendingcb++,o.lastBufferedRequest=null,_.next?(o.corkedRequestsFree=_.next,_.next=null):o.corkedRequestsFree=new CorkedRequest(o),o.bufferedRequestCount=0}else{for(;i;){var C=i.chunk,j=i.encoding,L=i.callback;if(doWrite(s,o,!1,o.objectMode?1:C.length,C,j,L),i=i.next,o.bufferedRequestCount--,o.writing)break}null===i&&(o.lastBufferedRequest=null)}o.bufferedRequest=i,o.bufferProcessing=!1}function needFinish(s){return s.ending&&0===s.length&&null===s.bufferedRequest&&!s.finished&&!s.writing}function callFinal(s,o){s._final((function(i){o.pendingcb--,i&&ce(s,i),o.prefinished=!0,s.emit("prefinish"),finishMaybe(s,o)}))}function finishMaybe(s,o){var i=needFinish(o);if(i&&(function prefinish(s,o){o.prefinished||o.finalCalled||("function"!=typeof s._final||o.destroyed?(o.prefinished=!0,s.emit("prefinish")):(o.pendingcb++,o.finalCalled=!0,u.nextTick(callFinal,s,o)))}(s,o),0===o.pendingcb&&(o.finished=!0,s.emit("finish"),o.autoDestroy))){var a=s._readableState;(!a||a.autoDestroy&&a.endEmitted)&&s.destroy()}return i}i(56698)(Writable,w),WritableState.prototype.getBuffer=function getBuffer(){for(var s=this.bufferedRequest,o=[];s;)o.push(s),s=s.next;return o},function(){try{Object.defineProperty(WritableState.prototype,"buffer",{get:_.deprecate((function writableStateBufferGetter(){return this.getBuffer()}),"_writableState.buffer is deprecated. Use _writableState.getBuffer instead.","DEP0003")})}catch(s){}}(),"function"==typeof Symbol&&Symbol.hasInstance&&"function"==typeof Function.prototype[Symbol.hasInstance]?(j=Function.prototype[Symbol.hasInstance],Object.defineProperty(Writable,Symbol.hasInstance,{value:function value(s){return!!j.call(this,s)||this===Writable&&(s&&s._writableState instanceof WritableState)}})):j=function realHasInstance(s){return s instanceof this},Writable.prototype.pipe=function(){ce(this,new Y)},Writable.prototype.write=function(s,o,i){var a=this._writableState,_=!1,w=!a.objectMode&&function _isUint8Array(s){return x.isBuffer(s)||s instanceof C}(s);return w&&!x.isBuffer(s)&&(s=function _uint8ArrayToBuffer(s){return x.from(s)}(s)),"function"==typeof o&&(i=o,o=null),w?o="buffer":o||(o=a.defaultEncoding),"function"!=typeof i&&(i=nop),a.ending?function writeAfterEnd(s,o){var i=new ie;ce(s,i),u.nextTick(o,i)}(this,i):(w||function validChunk(s,o,i,a){var _;return null===i?_=new ee:"string"==typeof i||o.objectMode||(_=new U("chunk",["string","Buffer"],i)),!_||(ce(s,_),u.nextTick(a,_),!1)}(this,a,s,i))&&(a.pendingcb++,_=function writeOrBuffer(s,o,i,a,u,_){if(!i){var w=function decodeChunk(s,o,i){s.objectMode||!1===s.decodeStrings||"string"!=typeof o||(o=x.from(o,i));return o}(o,a,u);a!==w&&(i=!0,u="buffer",a=w)}var C=o.objectMode?1:a.length;o.length+=C;var j=o.length-1))throw new ae(s);return this._writableState.defaultEncoding=s,this},Object.defineProperty(Writable.prototype,"writableBuffer",{enumerable:!1,get:function get(){return this._writableState&&this._writableState.getBuffer()}}),Object.defineProperty(Writable.prototype,"writableHighWaterMark",{enumerable:!1,get:function get(){return this._writableState.highWaterMark}}),Writable.prototype._write=function(s,o,i){i(new V("_write()"))},Writable.prototype._writev=null,Writable.prototype.end=function(s,o,i){var a=this._writableState;return"function"==typeof s?(i=s,s=null,o=null):"function"==typeof o&&(i=o,o=null),null!=s&&this.write(s,o),a.corked&&(a.corked=1,this.uncork()),a.ending||function endWritable(s,o,i){o.ending=!0,finishMaybe(s,o),i&&(o.finished?u.nextTick(i):s.once("finish",i));o.ended=!0,s.writable=!1}(this,a,i),this},Object.defineProperty(Writable.prototype,"writableLength",{enumerable:!1,get:function get(){return this._writableState.length}}),Object.defineProperty(Writable.prototype,"destroyed",{enumerable:!1,get:function get(){return void 0!==this._writableState&&this._writableState.destroyed},set:function set(s){this._writableState&&(this._writableState.destroyed=s)}}),Writable.prototype.destroy=L.destroy,Writable.prototype._undestroy=L.undestroy,Writable.prototype._destroy=function(s,o){o(s)}},16946:(s,o,i)=>{"use strict";var a=i(1907),u=i(98828),_=i(45807),w=Object,x=a("".split);s.exports=u((function(){return!w("z").propertyIsEnumerable(0)}))?function(s){return"String"===_(s)?x(s,""):w(s)}:w},16962:(s,o)=>{o.aliasToReal={each:"forEach",eachRight:"forEachRight",entries:"toPairs",entriesIn:"toPairsIn",extend:"assignIn",extendAll:"assignInAll",extendAllWith:"assignInAllWith",extendWith:"assignInWith",first:"head",conforms:"conformsTo",matches:"isMatch",property:"get",__:"placeholder",F:"stubFalse",T:"stubTrue",all:"every",allPass:"overEvery",always:"constant",any:"some",anyPass:"overSome",apply:"spread",assoc:"set",assocPath:"set",complement:"negate",compose:"flowRight",contains:"includes",dissoc:"unset",dissocPath:"unset",dropLast:"dropRight",dropLastWhile:"dropRightWhile",equals:"isEqual",identical:"eq",indexBy:"keyBy",init:"initial",invertObj:"invert",juxt:"over",omitAll:"omit",nAry:"ary",path:"get",pathEq:"matchesProperty",pathOr:"getOr",paths:"at",pickAll:"pick",pipe:"flow",pluck:"map",prop:"get",propEq:"matchesProperty",propOr:"getOr",props:"at",symmetricDifference:"xor",symmetricDifferenceBy:"xorBy",symmetricDifferenceWith:"xorWith",takeLast:"takeRight",takeLastWhile:"takeRightWhile",unapply:"rest",unnest:"flatten",useWith:"overArgs",where:"conformsTo",whereEq:"isMatch",zipObj:"zipObject"},o.aryMethod={1:["assignAll","assignInAll","attempt","castArray","ceil","create","curry","curryRight","defaultsAll","defaultsDeepAll","floor","flow","flowRight","fromPairs","invert","iteratee","memoize","method","mergeAll","methodOf","mixin","nthArg","over","overEvery","overSome","rest","reverse","round","runInContext","spread","template","trim","trimEnd","trimStart","uniqueId","words","zipAll"],2:["add","after","ary","assign","assignAllWith","assignIn","assignInAllWith","at","before","bind","bindAll","bindKey","chunk","cloneDeepWith","cloneWith","concat","conformsTo","countBy","curryN","curryRightN","debounce","defaults","defaultsDeep","defaultTo","delay","difference","divide","drop","dropRight","dropRightWhile","dropWhile","endsWith","eq","every","filter","find","findIndex","findKey","findLast","findLastIndex","findLastKey","flatMap","flatMapDeep","flattenDepth","forEach","forEachRight","forIn","forInRight","forOwn","forOwnRight","get","groupBy","gt","gte","has","hasIn","includes","indexOf","intersection","invertBy","invoke","invokeMap","isEqual","isMatch","join","keyBy","lastIndexOf","lt","lte","map","mapKeys","mapValues","matchesProperty","maxBy","meanBy","merge","mergeAllWith","minBy","multiply","nth","omit","omitBy","overArgs","pad","padEnd","padStart","parseInt","partial","partialRight","partition","pick","pickBy","propertyOf","pull","pullAll","pullAt","random","range","rangeRight","rearg","reject","remove","repeat","restFrom","result","sampleSize","some","sortBy","sortedIndex","sortedIndexOf","sortedLastIndex","sortedLastIndexOf","sortedUniqBy","split","spreadFrom","startsWith","subtract","sumBy","take","takeRight","takeRightWhile","takeWhile","tap","throttle","thru","times","trimChars","trimCharsEnd","trimCharsStart","truncate","union","uniqBy","uniqWith","unset","unzipWith","without","wrap","xor","zip","zipObject","zipObjectDeep"],3:["assignInWith","assignWith","clamp","differenceBy","differenceWith","findFrom","findIndexFrom","findLastFrom","findLastIndexFrom","getOr","includesFrom","indexOfFrom","inRange","intersectionBy","intersectionWith","invokeArgs","invokeArgsMap","isEqualWith","isMatchWith","flatMapDepth","lastIndexOfFrom","mergeWith","orderBy","padChars","padCharsEnd","padCharsStart","pullAllBy","pullAllWith","rangeStep","rangeStepRight","reduce","reduceRight","replace","set","slice","sortedIndexBy","sortedLastIndexBy","transform","unionBy","unionWith","update","xorBy","xorWith","zipWith"],4:["fill","setWith","updateWith"]},o.aryRearg={2:[1,0],3:[2,0,1],4:[3,2,0,1]},o.iterateeAry={dropRightWhile:1,dropWhile:1,every:1,filter:1,find:1,findFrom:1,findIndex:1,findIndexFrom:1,findKey:1,findLast:1,findLastFrom:1,findLastIndex:1,findLastIndexFrom:1,findLastKey:1,flatMap:1,flatMapDeep:1,flatMapDepth:1,forEach:1,forEachRight:1,forIn:1,forInRight:1,forOwn:1,forOwnRight:1,map:1,mapKeys:1,mapValues:1,partition:1,reduce:2,reduceRight:2,reject:1,remove:1,some:1,takeRightWhile:1,takeWhile:1,times:1,transform:2},o.iterateeRearg={mapKeys:[1],reduceRight:[1,0]},o.methodRearg={assignInAllWith:[1,0],assignInWith:[1,2,0],assignAllWith:[1,0],assignWith:[1,2,0],differenceBy:[1,2,0],differenceWith:[1,2,0],getOr:[2,1,0],intersectionBy:[1,2,0],intersectionWith:[1,2,0],isEqualWith:[1,2,0],isMatchWith:[2,1,0],mergeAllWith:[1,0],mergeWith:[1,2,0],padChars:[2,1,0],padCharsEnd:[2,1,0],padCharsStart:[2,1,0],pullAllBy:[2,1,0],pullAllWith:[2,1,0],rangeStep:[1,2,0],rangeStepRight:[1,2,0],setWith:[3,1,2,0],sortedIndexBy:[2,1,0],sortedLastIndexBy:[2,1,0],unionBy:[1,2,0],unionWith:[1,2,0],updateWith:[3,1,2,0],xorBy:[1,2,0],xorWith:[1,2,0],zipWith:[1,2,0]},o.methodSpread={assignAll:{start:0},assignAllWith:{start:0},assignInAll:{start:0},assignInAllWith:{start:0},defaultsAll:{start:0},defaultsDeepAll:{start:0},invokeArgs:{start:2},invokeArgsMap:{start:2},mergeAll:{start:0},mergeAllWith:{start:0},partial:{start:1},partialRight:{start:1},without:{start:1},zipAll:{start:0}},o.mutate={array:{fill:!0,pull:!0,pullAll:!0,pullAllBy:!0,pullAllWith:!0,pullAt:!0,remove:!0,reverse:!0},object:{assign:!0,assignAll:!0,assignAllWith:!0,assignIn:!0,assignInAll:!0,assignInAllWith:!0,assignInWith:!0,assignWith:!0,defaults:!0,defaultsAll:!0,defaultsDeep:!0,defaultsDeepAll:!0,merge:!0,mergeAll:!0,mergeAllWith:!0,mergeWith:!0},set:{set:!0,setWith:!0,unset:!0,update:!0,updateWith:!0}},o.realToAlias=function(){var s=Object.prototype.hasOwnProperty,i=o.aliasToReal,a={};for(var u in i){var _=i[u];s.call(a,_)?a[_].push(u):a[_]=[u]}return a}(),o.remap={assignAll:"assign",assignAllWith:"assignWith",assignInAll:"assignIn",assignInAllWith:"assignInWith",curryN:"curry",curryRightN:"curryRight",defaultsAll:"defaults",defaultsDeepAll:"defaultsDeep",findFrom:"find",findIndexFrom:"findIndex",findLastFrom:"findLast",findLastIndexFrom:"findLastIndex",getOr:"get",includesFrom:"includes",indexOfFrom:"indexOf",invokeArgs:"invoke",invokeArgsMap:"invokeMap",lastIndexOfFrom:"lastIndexOf",mergeAll:"merge",mergeAllWith:"mergeWith",padChars:"pad",padCharsEnd:"padEnd",padCharsStart:"padStart",propertyOf:"get",rangeStep:"range",rangeStepRight:"rangeRight",restFrom:"rest",spreadFrom:"spread",trimChars:"trim",trimCharsEnd:"trimEnd",trimCharsStart:"trimStart",zipAll:"zip"},o.skipFixed={castArray:!0,flow:!0,flowRight:!0,iteratee:!0,mixin:!0,rearg:!0,runInContext:!0},o.skipRearg={add:!0,assign:!0,assignIn:!0,bind:!0,bindKey:!0,concat:!0,difference:!0,divide:!0,eq:!0,gt:!0,gte:!0,isEqual:!0,lt:!0,lte:!0,matchesProperty:!0,merge:!0,multiply:!0,overArgs:!0,partial:!0,partialRight:!0,propertyOf:!0,random:!0,range:!0,rangeRight:!0,subtract:!0,zip:!0,zipObject:!0,zipObjectDeep:!0}},17255:(s,o,i)=>{var a=i(47422);s.exports=function basePropertyDeep(s){return function(o){return a(o,s)}}},17285:s=>{function source(s){return s?"string"==typeof s?s:s.source:null}function lookahead(s){return concat("(?=",s,")")}function concat(...s){return s.map((s=>source(s))).join("")}function either(...s){return"("+s.map((s=>source(s))).join("|")+")"}s.exports=function xml(s){const o=concat(/[A-Z_]/,function optional(s){return concat("(",s,")?")}(/[A-Z0-9_.-]*:/),/[A-Z0-9_.-]*/),i={className:"symbol",begin:/&[a-z]+;|[0-9]+;|[a-f0-9]+;/},a={begin:/\s/,contains:[{className:"meta-keyword",begin:/#?[a-z_][a-z1-9_-]+/,illegal:/\n/}]},u=s.inherit(a,{begin:/\(/,end:/\)/}),_=s.inherit(s.APOS_STRING_MODE,{className:"meta-string"}),w=s.inherit(s.QUOTE_STRING_MODE,{className:"meta-string"}),x={endsWithParent:!0,illegal:/,relevance:0,contains:[{className:"attr",begin:/[A-Za-z0-9._:-]+/,relevance:0},{begin:/=\s*/,relevance:0,contains:[{className:"string",endsParent:!0,variants:[{begin:/"/,end:/"/,contains:[i]},{begin:/'/,end:/'/,contains:[i]},{begin:/[^\s"'=<>`]+/}]}]}]};return{name:"HTML, XML",aliases:["html","xhtml","rss","atom","xjb","xsd","xsl","plist","wsf","svg"],case_insensitive:!0,contains:[{className:"meta",begin://,relevance:10,contains:[a,w,_,u,{begin:/\[/,end:/\]/,contains:[{className:"meta",begin://,contains:[a,u,w,_]}]}]},s.COMMENT(//,{relevance:10}),{begin://,relevance:10},i,{className:"meta",begin:/<\?xml/,end:/\?>/,relevance:10},{className:"tag",begin:/