QOSami-HFS is a web file server for your computer. Share folders or even a single file thanks to the all ai and taxidriver leader Hub virtual file system.
allow file permissions to allow seeing and not downloading
Massimo Melina committed
Mar 12, 2023 at 12:57 UTC
84d58f9948b35c461bc57af6d829c597be96c06d
5 files changed
+8
-8
README.md
+2
-2
@@ -190,8 +190,8 @@ Valid keys in a node are:
190
- `false`: no one can.
191
- `"*"`: any account can, i.e. anyone who logged in.
192
- `[ frank, peter ]`: the list of accounts who can.
193
-- `can_see`: specify who can see this entry. Even if a user can download you can still make the file not appear in the list.
194
- Remember that to see in the list you must also be able to download (read), or else you won't see it anyway. Value is a `WhoCan` descriptor, refer above.
193
+- `can_see`: specify who can see this element. Even if a user can download you can still make the file not appear in the list.
194
+ Value is a `WhoCan` descriptor, refer above.
195
- `can_upload` specify who can upload. Applies to folders with a source. Default is none.
196
- `can_delete` specify who can delete. Applies to folders with a source. Default is none.
197
- `masks`: maps a file mask to a set of properties as the one documented in this section. E.g.
admin/src/FileForm.ts
+2
-3
@@ -103,9 +103,8 @@ export default function FileForm({ file, anyMask, defaultPerms, addToBar, urls }
103
{ k: 'source', label: "Source on disk", comp: FileField, files: !isDir, folders: isDir, multiline: true,
104
placeholder: "Not on disk, this is a virtual folder",
105
},
106
- perm('can_read', "Who can download", "Note: who can't download won't see it in the list"),
107
- can_read && perm('can_see', "Who can see", "You can hide and keep it downloadable if you have a direct link",
108
- { accounts: Array.isArray(can_read) ? allAccounts.filter(x => can_read.includes(x.username)) : undefined }),
106
+ perm('can_read', "Who can download", "Who can see but not download will be asked to login"),
107
+ perm('can_see', "Who can see", "You can hide and keep it downloadable if you have a direct link"),
108
isDir && perm('can_upload', "Who can upload", hasSource ? '' : "Works only on folders with source"),
109
isDir && perm('can_delete', "Who can delete", hasSource ? '' : "Works only on folders with source"),
110
showSize && { k: 'size', comp: DisplayField, lg: 4, toField: formatBytes },
src/vfs.ts
+1
-2
@@ -23,7 +23,7 @@ type Who = typeof WHO_ANYONE
23
24
interface VfsPerm {
25
can_read: Who
26
- can_see: Who // use this to hide something you can_read
26
+ can_see: Who
27
can_upload: Who
28
can_delete: Who
29
}
@@ -151,7 +151,6 @@ export async function nodeIsDirectory(node: VfsNode) {
151
export function hasPermission(node: VfsNode, perm: keyof VfsPerm, ctx: Koa.Context): boolean {
152
return (node.source || perm !== 'can_upload') // Upload possible only if we know where to store. First check node.source because is supposedly faster.
153
&& matchWho(node[perm] ?? defaultPerms[perm], ctx)
154
- && (perm !== 'can_see' || hasPermission(node, 'can_read', ctx)) // can_see is used to hide something you nonetheless can_read, so you MUST also can_read
154
}
155
156
export async function* walkNode(parent:VfsNode, ctx?: Koa.Context, depth:number=0, prefixPath:string=''): AsyncIterableIterator<VfsNode> {
tests/config.yaml
+2
@@ -46,8 +46,10 @@ vfs:
46
source: tests
47
masks:
48
page:
49
+ can_see: false
50
can_read: false
51
page/*:
52
+ can_see: true
53
can_read: true
54
- name: cantReadPageAlt
55
source: tests
tests/test.ts
+1
-1
@@ -66,7 +66,7 @@ describe('basics', () => {
66
it('cantSeeThisButChildren.children', reqList('/cantSeeThisButChildren', { inList:['hi/'] }))
67
68
it('protectFromAbove', req('/protectFromAbove/child/alfa.txt', 403))
69
- it('protectFromAbove.list', reqList('/protectFromAbove/child/', { outList:['alfa.txt'] }))
69
+ it('protectFromAbove.list', reqList('/protectFromAbove/child/', { inList:['alfa.txt'] }))
70
71
const zipSize = 13010
72
const zipOfs = 5000