fix: regression: accessing a folder without final / returned 404
Massimo Melina committed
Jun 27, 2022 at 12:02 UTC
332b22664576e208c4ee8877914a212da56e5d0f
2 files changed
+6
-6
server/src/middlewares.ts
+4
-5
@@ -70,20 +70,19 @@ export const serveGuiAndSharedFiles: Koa.Middleware = async (ctx, next) => {
70
return ctx.status = 404
71
const canRead = hasPermission(node, 'can_read', ctx)
72
const isFolder = await nodeIsDirectory(node)
73
+ if (isFolder && !path.endsWith('/'))
74
+ return ctx.redirect(path + '/')
75
if (canRead && !isFolder)
76
return node.source ? serveFileNode(node)(ctx,next)
77
: next()
76
- ctx.set({ server:'HFS '+BUILD_TIMESTAMP })
78
if (!canRead) {
79
ctx.status = cantReadStatusCode(node)
80
if (ctx.status === FORBIDDEN)
81
return
81
- // this folder was requested without the trailing / and we may still log in
82
- if (isFolder && !path.endsWith('/') && !ctx.state.account)
83
- return ctx.redirect(path + '/')
84
- ctx.set('WWW-Authenticate', 'Basic')
82
+ ctx.set('WWW-Authenticate', 'Basic') // we support basic authentication
83
return serveFrontendFiles(ctx, next)
84
}
85
+ ctx.set({ server:'HFS '+BUILD_TIMESTAMP })
86
const { get } = ctx.query
87
if (get === 'zip')
88
return await zipStreamFromFolder(node, ctx)
tests/test.ts
+2
-1
@@ -17,11 +17,12 @@ const API = '/~/api/'
17
const BASE_URL = 'http://localhost'
18
19
const jar = new CookieJar()
20
-const client = wrapper(axios.create({ jar }))
20
+const client = wrapper(axios.create({ jar, maxRedirects: 0 }))
21
22
describe('basics', () => {
23
//before(async () => appStarted)
24
it('frontend', req('/', /<body>/))
25
+ it('force slash', req('/f1', 302))
26
it('list', reqList('/f1/', { inList:['f2/', 'page'] }))
27
it('search', reqList('f1', { inList:['f2/'], outList:['page'] }, { search:'2' }))
28
it('search root', reqList('/', { inList:['cantReadPage/'], outList:['cantReadPage/page/'] }, { search:'page' }))