fix: some browsers could show basic-authentication because mistaken with a download-manager
Massimo Melina committed
Apr 10, 2024 at 14:42 UTC
ee0b4e3927d16a1587f7b89619ac0e3b710ffbb8
2 files changed
+6
-4
src/serveGuiAndSharedFiles.ts
+5
-3
@@ -92,9 +92,11 @@ export const serveGuiAndSharedFiles: Koa.Middleware = async (ctx, next) => {
92
if (statusCodeForMissingPerm(node, 'can_list', ctx)) {
93
if (ctx.status === HTTP_FORBIDDEN)
94
return sendErrorPage(ctx, HTTP_FORBIDDEN)
95
- const browserDetected = ctx.get('Upgrade-Insecure-Requests') || ctx.get('Sec-Fetch-Mode') // ugh, heuristics
96
- if (!browserDetected) // we don't want to trigger basic authentication on browsers, it's meant for download managers only
97
- return ctx.set('WWW-Authenticate', 'Basic') // we support basic authentication
95
+ // detect if we are dealing with a download-manager, as it may need basic authentication, while we don't want it on browsers
96
+ const { authenticate } = ctx.query
97
+ const downloadManagerDetected = /DAP|FDM|[Mm]anager/.test(ctx.get('user-agent'))
98
+ if (downloadManagerDetected || authenticate)
99
+ return ctx.set('WWW-Authenticate', authenticate || 'Basic') // we support basic authentication
100
ctx.state.serveApp = true
101
return serveFrontendFiles(ctx, next)
102
}
tests/test.ts
+1
-1
@@ -44,7 +44,7 @@ describe('basics', () => {
44
it('custom mime from above', req('/tests/page/index.html', { status: 200, mime:'text/plain' }))
45
it('name encoding', req('/x%25%23x', 200))
46
47
- it('missing perm', req('/for-admins/', 401))
47
+ it('missing perm', reqList('/for-admins/', 401))
48
it('missing perm.file', req('/for-admins/alfa.txt', 401))
49
50
it('forbidden list', req('/cantListPage/page/', 403))