fix: (regression 0.28.0) vhosting plugin not working
Massimo Melina committed
Feb 5, 2023 at 22:31 UTC
7fd6a2f1c46cc8ef4f7d8001fa218ff0823f4dcf
3 files changed
+19
-6
src/apiMiddleware.ts
+1
-4
@@ -3,7 +3,7 @@
3
import Koa from 'koa'
4
import createSSE from './sse'
5
import { Readable } from 'stream'
6
-import { asyncGeneratorToReadable, objSameKeys, onOff, stream2string, tryJson } from './misc'
6
+import { asyncGeneratorToReadable, onOff } from './misc'
7
import events from './events'
8
import { HTTP_BAD_REQUEST, HTTP_NOT_FOUND, HTTP_UNAUTHORIZED } from './const'
9
import _, { DebouncedFunc } from 'lodash'
@@ -26,9 +26,6 @@ export function apiMiddleware(apis: ApiHandlers) : Koa.Middleware {
26
ctx.body = 'invalid api'
27
return ctx.status = HTTP_NOT_FOUND
28
}
29
- ctx.params = ctx.method === 'POST' ? tryJson(await stream2string(ctx.req))
30
- : objSameKeys(ctx.query, x => Array.isArray(x) ? x : tryJson(x))
31
- console.debug('API', ctx.method, ctx.path, { ...ctx.params })
29
const csrf = ctx.cookies.get('csrf')
30
// we don't rely on SameSite cookie option because it's https-only
31
let res = csrf && csrf !== ctx.params.csrf ? new ApiError(HTTP_UNAUTHORIZED, 'csrf')
src/index.ts
+10
-1
@@ -9,7 +9,15 @@ import { frontEndApis } from './frontEndApis'
9
import { log } from './log'
10
import { pluginsMiddleware } from './plugins'
11
import { throttler } from './throttler'
12
-import { headRequests, gzipper, sessions, serveGuiAndSharedFiles, someSecurity, prepareState } from './middlewares'
12
+import {
13
+ headRequests,
14
+ gzipper,
15
+ sessions,
16
+ serveGuiAndSharedFiles,
17
+ someSecurity,
18
+ prepareState,
19
+ paramsDecoder
20
+} from './middlewares'
21
import './listen'
22
import './commands'
23
import { adminApis } from './adminApis'
@@ -29,6 +37,7 @@ app.use(someSecurity)
37
.use(log())
38
.use(throttler)
39
.use(gzipper)
40
+ .use(paramsDecoder) // must be done before plugins, so they can manipulate params
41
.use(pluginsMiddleware())
42
.use(mount(API_URI, apiMiddleware({ ...frontEndApis, ...adminApis })))
43
.use(serveGuiAndSharedFiles)
src/middlewares.ts
+8
-1
@@ -12,7 +12,7 @@ import {
12
} from './const'
13
import { FRONTEND_URI } from './const'
14
import { cantReadStatusCode, hasPermission, nodeIsDirectory, urlToNode, vfs } from './vfs'
15
-import { dirTraversal } from './misc'
15
+import { dirTraversal, objSameKeys, stream2string, tryJson } from './misc'
16
import { zipStreamFromFolder } from './zip'
17
import { serveFileNode } from './serveFile'
18
import { serveGuiFiles } from './serveGuiFiles'
@@ -193,3 +193,10 @@ async function srpCheck(username: string, password: string) {
193
const clientRes2 = await clientRes1.step2(BigInt(salt), BigInt(pubKey))
194
return await step1.step2(clientRes2.A, clientRes2.M1).then(() => true, () => false)
195
}
196
+
197
+// unify get/post parameters, with JSON decoding to not be limited to strings
198
+export const paramsDecoder: Koa.Middleware = async (ctx, next) => {
199
+ ctx.params = ctx.method === 'POST' ? tryJson(await stream2string(ctx.req))
200
+ : objSameKeys(ctx.query, x => Array.isArray(x) ? x : tryJson(x))
201
+ await next()
202
+}