fix: node.default + authentication was not working
Massimo Melina committed
Oct 24, 2023 at 09:32 UTC
133f3a3ad291075c07c66236f79e61ba20202874
2 files changed
+9
-10
src/middlewares.ts
+8
-6
@@ -4,7 +4,7 @@ import compress from 'koa-compress'
4
import Koa from 'koa'
5
import {
6
ADMIN_URI, API_URI, BUILD_TIMESTAMP, DEV,
7
- HTTP_FORBIDDEN, HTTP_NOT_FOUND, HTTP_FOOL, HTTP_UNAUTHORIZED, HTTP_BAD_REQUEST,
7
+ HTTP_FORBIDDEN, HTTP_NOT_FOUND, HTTP_FOOL, HTTP_UNAUTHORIZED, HTTP_BAD_REQUEST, HTTP_METHOD_NOT_ALLOWED,
8
} from './const'
9
import { FRONTEND_URI } from './const'
10
import { statusCodeForMissingPerm, nodeIsDirectory, urlToNode, vfs, walkNode, VfsNode, getNodeName } from './vfs'
@@ -114,8 +114,6 @@ export const serveGuiAndSharedFiles: Koa.Middleware = async (ctx, next) => {
114
if (ctx.originalUrl === '/favicon.ico' && favicon.get()) // originalUrl to not be subject to changes (vhosting plugin)
115
return serveFile(ctx, favicon.get())
116
let node = await urlToNode(path, ctx)
117
- if (node?.default && (path.endsWith('/') || !node.default.match(/\.html?$/i))) // final/ needed on browser to make resource urls correctly
118
- node = await urlToNode(node.default, ctx, node) ?? node
117
if (!node)
118
return sendErrorPage(ctx, HTTP_NOT_FOUND)
119
if (ctx.method === 'POST') { // curl -F upload=@file url/
@@ -133,10 +131,14 @@ export const serveGuiAndSharedFiles: Koa.Middleware = async (ctx, next) => {
131
res()
132
}))
133
}
134
+ if (node.default && path.endsWith('/')) // final/ needed on browser to make resource urls correctly with html pages
135
+ node = await urlToNode(node.default, ctx, node) ?? node
136
if (!await nodeIsDirectory(node))
137
- return !node.source && await next()
138
- || statusCodeForMissingPerm(node, 'can_read', ctx)
139
- || serveFileNode(ctx, node)
137
+ return !node.source ? sendErrorPage(ctx, HTTP_METHOD_NOT_ALLOWED)
138
+ : !statusCodeForMissingPerm(node, 'can_read', ctx) ? serveFileNode(ctx, node)
139
+ : ctx.status !== HTTP_UNAUTHORIZED ? null
140
+ : !path.endsWith('/') ? ctx.set('WWW-Authenticate', 'Basic') // this is necessary to support standard urls with credentials. Final / means we are dealing with default file...
141
+ : (ctx.state.serveApp = true) && serveFrontendFiles(ctx, next) // ...for which we still provide fancy login
142
if (!path.endsWith('/'))
143
return ctx.redirect(ctx.state.revProxyPath + ctx.originalUrl.replace(/(\?|$)/, '/$1')) // keep query-string, if any
144
if (statusCodeForMissingPerm(node, 'can_list', ctx)) {
src/vfs.ts
+1
-4
@@ -186,11 +186,8 @@ export function hasPermission(node: VfsNode, perm: keyof VfsPerms, ctx: Koa.Cont
186
187
export function statusCodeForMissingPerm(node: VfsNode, perm: keyof VfsPerms, ctx: Koa.Context, assign=true) {
188
const ret = getCode()
189
- if (ret && assign) {
189
+ if (ret && assign)
190
ctx.status = ret
191
- if (ret === HTTP_UNAUTHORIZED && !(node.default && node.source?.endsWith(node.default))) // this is necessary to support standard urls with credentials
192
- ctx.set('WWW-Authenticate', 'Basic') // we support basic authentication
193
- }
191
return ret
192
193
function getCode() {