merge main branch

Cargo.toml

@@ -39,11 +39,11 @@ form_urlencoded = "1.2"
 alphanumeric-sort = "1.4"
 content_inspector = "0.2"
 anyhow = "1.0"
-chardetng = "0.1"
+chardetng = "1.0"
 glob = "0.3"
 indexmap = "2.2"
 serde_yaml = "0.9"
-sha-crypt = "0.5"
+sha-crypt = "0.6"
 base64 = "0.22"
 smart-default = "0.7"
 rustls-pki-types = "1.2"
@@ -51,7 +51,7 @@ hyper-util = { version = "0.1", features = ["server-auto", "tokio"] }
 http-body-util = "0.1"
 bytes = "1.5"
 pin-project-lite = "0.2"
-sha2 = "0.10.8"
+sha2 = "0.11.0"
 ed25519-dalek = "2.2.0"
 hex = "0.4.3"
 

assets/index.js

@@ -106,6 +106,15 @@ let $logoutBtn;
  */
 let $userName;
 
+// manage unload event to prevent leaving with uploads in progress
+const beforeUnloadHandler = (event) => {
+  if (Uploader.queues.length > 0 || Uploader.runnings > 0) {
+    event.preventDefault();
+    event.returnValue = '';
+    return ''; // for some browsers
+  }
+};
+
 // Produce table when window loads
 window.addEventListener("DOMContentLoaded", async () => {
   const $indexData = document.getElementById('index-data');
@@ -131,6 +140,8 @@ async function ready() {
   $logoutBtn = document.querySelector(".logout-btn");
   $userName = document.querySelector(".user-name");
 
+  window.addEventListener('beforeunload', beforeUnloadHandler);
+
   addBreadcrumb(DATA.href, DATA.uri_prefix);
 
   if (DATA.kind === "Index") {

src/args.rs

@@ -295,6 +295,7 @@ pub struct Args {
     pub render_try_index: bool,
     pub enable_cors: bool,
     pub assets: Option<PathBuf>,
+    pub error_page: Option<PathBuf>,
     #[serde(deserialize_with = "deserialize_log_http")]
     #[serde(rename = "log-format")]
     pub http_logger: HttpLogger,
@@ -410,6 +411,13 @@ impl Args {
             args.assets = Some(Args::sanitize_assets_path(assets_path)?);
         }
 
+        if let Some(assets_path) = &args.assets {
+            let p = assets_path.join("404.html");
+            if p.exists() {
+                args.error_page = Some(p);
+            }
+        }
+
         if let Some(log_format) = matches.get_one::<String>("log-format") {
             args.http_logger = log_format.parse()?;
         }

src/auth.rs

@@ -9,6 +9,7 @@ use indexmap::IndexMap;
 use lazy_static::lazy_static;
 use md5::Context;
 use sha2::{Digest, Sha256};
+use sha_crypt::PasswordVerifier;
 use std::{
     collections::HashMap,
     path::{Path, PathBuf},
@@ -85,8 +86,14 @@ impl AccessControl {
             access_paths
                 .merge(paths)
                 .ok_or_else(|| anyhow!("Invalid auth value `{user}:{pass}@{paths}"))?;
-            if let Some(paths) = annoy_paths {
+            if let Some(anon_ap) = &anonymous {
-                access_paths.merge(paths);
+                let orig_user = access_paths.clone();
+                access_paths.absorb_anon(
+                    anon_ap,
+                    &orig_user,
+                    AccessPerm::IndexOnly,
+                    AccessPerm::IndexOnly,
+                );
             }
             if pass.starts_with("$6$") {
                 use_hashed_password = true;
@@ -219,9 +226,8 @@ impl AccessPaths {
     }
 
     pub fn set_perm(&mut self, perm: AccessPerm) {
-        if self.perm < perm {
+        if !perm.indexonly() {
             self.perm = perm;
-            self.recursively_purge_children(perm);
         }
     }
 
@@ -246,17 +252,6 @@ impl AccessPaths {
         Some(target)
     }
 
-    fn recursively_purge_children(&mut self, perm: AccessPerm) {
-        self.children.retain(|_, child| {
-            if child.perm <= perm {
-                false
-            } else {
-                child.recursively_purge_children(perm);
-                true
-            }
-        });
-    }
-
     fn add(&mut self, path: &str, perm: AccessPerm) {
         let path = path.trim_matches('/');
         if path.is_empty() {
@@ -268,18 +263,48 @@ impl AccessPaths {
     }
 
     fn add_impl(&mut self, parts: &[&str], perm: AccessPerm) {
-        let parts_len = parts.len();
+        if parts.is_empty() {
-        if parts_len == 0 {
+            self.perm = perm;
-            self.set_perm(perm);
-            return;
-        }
-        if self.perm >= perm {
             return;
         }
         let child = self.children.entry(parts[0].to_string()).or_default();
         child.add_impl(&parts[1..], perm)
     }
 
+    /// Merge anonymous `AccessPaths` into `self` (a user's paths) with "higher perm wins" semantics.
+    /// `orig_user` is a snapshot of `self` before any anonymous merging begins, used so that
+    /// the user's own effective perm is measured against the pre-merge state.
+    fn absorb_anon(
+        &mut self,
+        anon: &AccessPaths,
+        orig_user: &AccessPaths,
+        user_inherited: AccessPerm,
+        anon_inherited: AccessPerm,
+    ) {
+        let anon_eff = if !anon.perm.indexonly() {
+            anon.perm
+        } else {
+            anon_inherited
+        };
+        let orig_user_eff = if !orig_user.perm.indexonly() {
+            orig_user.perm
+        } else {
+            user_inherited
+        };
+
+        let combined = std::cmp::max(anon_eff, orig_user_eff);
+        if !combined.indexonly() && combined > self.perm {
+            self.perm = combined;
+        }
+
+        let default_ap = AccessPaths::default();
+        for (name, anon_child) in &anon.children {
+            let orig_user_child = orig_user.children.get(name).unwrap_or(&default_ap);
+            let user_child = self.children.entry(name.clone()).or_default();
+            user_child.absorb_anon(anon_child, orig_user_child, orig_user_eff, anon_eff);
+        }
+    }
+
     pub fn find(&self, path: &str) -> Option<AccessPaths> {
         let parts: Vec<&str> = path
             .trim_matches('/')
@@ -403,7 +428,10 @@ pub fn check_auth(
         }
 
         if auth_pass.starts_with("$6$") {
-            if let Ok(()) = sha_crypt::sha512_check(pass, auth_pass) {
+            if sha_crypt::ShaCrypt::SHA512
+                .verify_password(pass.as_bytes(), auth_pass)
+                .is_ok()
+            {
                 return Some(());
             }
         } else if pass == auth_pass {
@@ -706,7 +734,7 @@ mod tests {
         );
         assert_eq!(
             paths.find("dir2/dir21/dir211/file"),
-            Some(AccessPaths::new(AccessPerm::ReadWrite))
+            Some(AccessPaths::new(AccessPerm::ReadOnly))
         );
         assert_eq!(
             paths.find("dir2/dir22/file"),

src/http_logger.rs

@@ -1,8 +1,15 @@
-use std::{collections::HashMap, str::FromStr};
+use std::{
+    collections::HashMap,
+    str::FromStr,
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+use chrono::{Local, SecondsFormat};
 
 use crate::{auth::get_auth_user, server::Request, utils::decode_uri};
 
-pub const DEFAULT_LOG_FORMAT: &str = r#"$remote_addr "$request" $status"#;
+pub const DEFAULT_LOG_FORMAT: &str =
+    r#"$time_iso8601 $log_level - $remote_addr "$request" $status"#;
 
 #[derive(Debug, Clone, PartialEq)]
 pub struct HttpLogger {
@@ -28,10 +35,17 @@ impl HttpLogger {
         for element in self.elements.iter() {
             match element {
                 LogElement::Variable(name) => match name.as_str() {
-                    "request" => {
+                    "request" | "request_method" | "request_uri" => {
                         let uri = req.uri().to_string();
-                        let uri = decode_uri(&uri).map(|s| s.to_string()).unwrap_or(uri);
+                        let decoded_uri = decode_uri(&uri)
-                        data.insert(name.to_string(), format!("{} {uri}", req.method()));
+                            .map(|s| sanitize_log_value(&s))
+                            .unwrap_or_else(|| uri.clone());
+                        data.entry("request".to_string())
+                            .or_insert_with(|| format!("{} {decoded_uri}", req.method()));
+                        data.entry("request_method".to_string())
+                            .or_insert_with(|| req.method().to_string());
+                        data.entry("request_uri".to_string())
+                            .or_insert_with(|| decoded_uri);
                     }
                     "remote_user" => {
                         if let Some(user) =
@@ -44,7 +58,7 @@ impl HttpLogger {
                 },
                 LogElement::Header(name) => {
                     if let Some(value) = req.headers().get(name).and_then(|v| v.to_str().ok()) {
-                        data.insert(name.to_string(), value.to_string());
+                        data.insert(name.to_string(), sanitize_log_value(value));
                     }
                 }
                 LogElement::Literal(_) => {}
@@ -57,22 +71,62 @@ impl HttpLogger {
         if self.elements.is_empty() {
             return;
         }
+        let is_error = err.is_some();
+        let now = Local::now();
+        let time_local = now.to_rfc3339_opts(SecondsFormat::Secs, false);
+        let time_iso8601 = now.to_rfc3339_opts(SecondsFormat::Secs, true);
+        let msec = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .map(|d| format!("{:.3}", d.as_secs_f64()))
+            .unwrap_or_default();
+        let log_level = if is_error { "ERROR" } else { "INFO" };
+
         let mut output = String::new();
         for element in self.elements.iter() {
             match element {
                 LogElement::Literal(value) => output.push_str(value.as_str()),
-                LogElement::Header(name) | LogElement::Variable(name) => {
+                LogElement::Variable(name) => {
-                    output.push_str(data.get(name).map(|v| v.as_str()).unwrap_or("-"))
+                    let resolved = match name.as_str() {
+                        "time_local" => Some(time_local.as_str()),
+                        "time_iso8601" => Some(time_iso8601.as_str()),
+                        "msec" => Some(msec.as_str()),
+                        "log_level" => Some(log_level),
+                        _ => None,
+                    };
+                    let val = resolved
+                        .or_else(|| data.get(name.as_str()).map(|v| v.as_str()))
+                        .unwrap_or("-");
+                    output.push_str(val);
+                }
+                LogElement::Header(name) => {
+                    output.push_str(data.get(name.as_str()).map(|v| v.as_str()).unwrap_or("-"))
                 }
             }
         }
         match err {
-            Some(err) => error!("{output} {err}"),
+            Some(err) => emit_http_access(&format!("{output} {err}"), true),
-            None => info!("{output}"),
+            None => emit_http_access(&output, false),
         }
     }
 }
 
+/// Emit via the `log` crate with target `http_access` so the system logger
+/// prints the line verbatim (no extra timestamp/level prefix).
+fn emit_http_access(msg: &str, is_error: bool) {
+    let level = if is_error {
+        log::Level::Error
+    } else {
+        log::Level::Info
+    };
+    log::logger().log(
+        &log::Record::builder()
+            .args(format_args!("{}", msg))
+            .level(level)
+            .target("http_access")
+            .build(),
+    );
+}
+
 impl FromStr for HttpLogger {
     type Err = anyhow::Error;
     fn from_str(s: &str) -> Result<Self, Self::Err> {
@@ -104,3 +158,14 @@ impl FromStr for HttpLogger {
         Ok(Self { elements })
     }
 }
+
+fn sanitize_log_value(s: &str) -> String {
+    s.chars()
+        .flat_map(|c| match c {
+            '\\' => vec!['\\', '\\'],
+            '"' => vec!['\\', '"'],
+            c if c.is_control() => format!("\\x{:02x}", c as u32).chars().collect::<Vec<_>>(),
+            c => vec![c],
+        })
+        .collect()
+}

src/logger.rs

@@ -1,5 +1,4 @@
 use anyhow::{Context, Result};
-use chrono::{Local, SecondsFormat};
 use log::{Level, LevelFilter, Metadata, Record};
 use std::fs::{File, OpenOptions};
 use std::io::Write;
@@ -17,8 +16,7 @@ impl log::Log for SimpleLogger {
 
     fn log(&self, record: &Record) {
         if self.enabled(record.metadata()) {
-            let timestamp = Local::now().to_rfc3339_opts(SecondsFormat::Secs, true);
+            let text = record.args().to_string();
-            let text = format!("{} {} - {}", timestamp, record.level(), record.args());
             match &self.file {
                 Some(file) => {
                     if let Ok(mut file) = file.lock() {

src/server.rs

@@ -245,7 +245,8 @@ impl Server {
                 self.handle_send_file(&self.args.serve_path, headers, head_only, &mut res)
                     .await?;
             } else {
-                status_not_found(&mut res);
+                self.handle_not_found(&query_params, headers, head_only, &mut res)
+                    .await?;
             }
             return Ok(res);
         }
@@ -273,7 +274,8 @@ impl Server {
         let render_try_index = self.args.render_try_index;
 
         if self.guard_root_contained(path).await {
-            status_not_found(&mut res);
+            self.handle_not_found(&query_params, headers, head_only, &mut res)
+                .await?;
             return Ok(res);
         }
 
@@ -283,7 +285,8 @@ impl Server {
                     if render_try_index {
                         if allow_archive && has_query_flag(&query_params, "zip") {
                             if !allow_archive {
-                                status_not_found(&mut res);
+                                self.handle_not_found(&query_params, headers, head_only, &mut res)
+                                    .await?;
                                 return Ok(res);
                             }
                             self.handle_zip_dir(path, head_only, access_paths, &mut res)
@@ -351,7 +354,9 @@ impl Server {
                         .await?;
                     }
                 } else if is_file {
-                    if has_query_flag(&query_params, "edit") {
+                    if has_query_flag(&query_params, "json") {
+                        self.handle_file_json(path, head_only, &mut res).await?;
+                    } else if has_query_flag(&query_params, "edit") {
                         self.handle_edit_file(path, DataKind::Edit, head_only, user, &mut res)
                             .await?;
                     } else if has_query_flag(&query_params, "view") {
@@ -368,7 +373,7 @@ impl Server {
                             .await?;
                     }
                 } else if render_spa {
-                    self.handle_render_spa(path, headers, head_only, &mut res)
+                    self.handle_render_spa(path, &query_params, headers, head_only, &mut res)
                         .await?;
                 } else if allow_upload && req_path.ends_with('/') {
                     self.handle_ls_dir(
@@ -382,7 +387,8 @@ impl Server {
                     )
                     .await?;
                 } else {
-                    status_not_found(&mut res);
+                    self.handle_not_found(&query_params, headers, head_only, &mut res)
+                        .await?;
                 }
             }
             Method::OPTIONS => {
@@ -718,14 +724,41 @@ impl Server {
             self.handle_ls_dir(path, true, query_params, head_only, user, access_paths, res)
                 .await?;
         } else {
-            status_not_found(res)
+            self.handle_not_found(query_params, headers, head_only, res)
+                .await?;
         }
         Ok(())
     }
 
+    async fn handle_file_json(
+        &self,
+        path: &Path,
+        head_only: bool,
+        res: &mut Response,
+    ) -> Result<()> {
+        let pathitem = match self.to_pathitem(path, &self.args.serve_path).await? {
+            Some(v) => v,
+            None => {
+                status_not_found(res);
+                return Ok(());
+            }
+        };
+        let output = serde_json::to_string_pretty(&pathitem)?;
+        res.headers_mut()
+            .typed_insert(ContentType::from(mime_guess::mime::APPLICATION_JSON));
+        res.headers_mut()
+            .typed_insert(ContentLength(output.len() as u64));
+        if head_only {
+            return Ok(());
+        }
+        *res.body_mut() = body_full(output);
+        Ok(())
+    }
+
     async fn handle_render_spa(
         &self,
         path: &Path,
+        query_params: &HashMap<String, String>,
         headers: &HeaderMap<HeaderValue>,
         head_only: bool,
         res: &mut Response,
@@ -735,11 +768,31 @@ impl Server {
             self.handle_send_file(&path, headers, head_only, res)
                 .await?;
         } else {
-            status_not_found(res)
+            self.handle_not_found(query_params, headers, head_only, res)
+                .await?;
         }
         Ok(())
     }
 
+    async fn handle_not_found(
+        &self,
+        query_params: &HashMap<String, String>,
+        headers: &HeaderMap<HeaderValue>,
+        head_only: bool,
+        res: &mut Response,
+    ) -> Result<()> {
+        if let Some(error_page) = &self.args.error_page {
+            if !has_query_flag(query_params, "noscript") {
+                self.handle_send_file(error_page, headers, head_only, res)
+                    .await?;
+                *res.status_mut() = StatusCode::NOT_FOUND;
+                return Ok(());
+            }
+        }
+        status_not_found(res);
+        Ok(())
+    }
+
     async fn handle_internal(
         &self,
         req_path: &str,
@@ -1830,14 +1883,10 @@ async fn get_content_type(path: &Path) -> Result<String> {
     let mime = mime_guess::from_path(path).first();
     let is_text = content_inspector::inspect(&buffer).is_text();
     let content_type = if is_text {
-        let mut detector = chardetng::EncodingDetector::new();
+        let mut detector = chardetng::EncodingDetector::new(chardetng::Iso2022JpDetection::Allow);
         detector.feed(&buffer, buffer.len() < 1024);
-        let (enc, confident) = detector.guess_assess(None, true);
+        let enc = detector.guess(None, chardetng::Utf8Detection::Allow);
-        let charset = if confident {
+        let charset = format!("; charset={}", enc.name());
-            format!("; charset={}", enc.name())
-        } else {
-            "".into()
-        };
         match mime {
             Some(m) => format!("{m}{charset}"),
             None => format!("text/plain{charset}"),
@@ -1881,7 +1930,7 @@ async fn sha256_file(path: &Path) -> Result<String> {
     }
 
     let result = hasher.finalize();
-    Ok(format!("{result:x}"))
+    Ok(hex::encode(result))
 }
 
 fn has_query_flag(query_params: &HashMap<String, String>, name: &str) -> bool {

src/utils.rs

@@ -121,7 +121,7 @@ pub fn parse_range(range: &str, size: u64) -> Option<Vec<(u64, u64)>> {
                     result.push((start, size - 1));
                 } else {
                     let end = end.parse::<u64>().ok()?;
-                    if end < size {
+                    if end < size && start <= end {
                         result.push((start, end));
                     } else {
                         return None;

tests/assets.rs

@@ -123,3 +123,36 @@ fn assets_override(tmpdir: TempDir, port: u16) -> Result<(), Error> {
     child.kill()?;
     Ok(())
 }
+
+#[rstest]
+fn assets_override_not_found_page(tmpdir: TempDir, port: u16) -> Result<(), Error> {
+    let not_found_html = "<html><body>custom 404 page</body></html>";
+    std::fs::write(
+        tmpdir.join(format!("{}404.html", DIR_ASSETS)),
+        not_found_html,
+    )?;
+
+    let mut child = Command::new(assert_cmd::cargo::cargo_bin!())
+        .arg(tmpdir.path())
+        .arg("-p")
+        .arg(port.to_string())
+        .arg("--assets")
+        .arg(tmpdir.join(DIR_ASSETS))
+        .stdout(Stdio::piped())
+        .spawn()?;
+
+    wait_for_port(port);
+
+    let url = format!("http://localhost:{port}/missing-path");
+    let resp = reqwest::blocking::get(&url)?;
+    assert_eq!(resp.status(), 404);
+    assert_eq!(resp.text()?, not_found_html);
+
+    let url = format!("http://localhost:{port}/missing-path?noscript");
+    let resp = reqwest::blocking::get(&url)?;
+    assert_eq!(resp.status(), 404);
+    assert_eq!(resp.text()?, "Not Found");
+
+    child.kill()?;
+    Ok(())
+}

tests/auth.rs

@@ -366,7 +366,18 @@ fn auth_data(
 }
 
 #[rstest]
-fn auth_shadow(
+fn auth_precedence(
+    #[with(&["--auth", "user:pass@/dir1:rw,/dir1/test.txt", "-A"])] server: TestServer,
+) -> Result<(), Error> {
+    let url = format!("{}dir1/test.txt", server.url());
+    let resp = send_with_digest_auth(fetch!(b"PUT", &url).body(b"abc".to_vec()), "user", "pass")?;
+    assert_eq!(resp.status(), 403);
+
+    Ok(())
+}
+
+#[rstest]
+fn auth_anonymous_no_precedence(
     #[with(&["--auth", "user:pass@/:rw", "-a", "@/dir1", "-A"])] server: TestServer,
 ) -> Result<(), Error> {
     let url = format!("{}dir1/test.txt", server.url());

tests/http.rs

@@ -185,6 +185,22 @@ fn get_file(server: TestServer) -> Result<(), Error> {
     Ok(())
 }
 
+#[rstest]
+fn get_file_json(server: TestServer) -> Result<(), Error> {
+    let resp = reqwest::blocking::get(format!("{}index.html?json", server.url()))?;
+    assert_eq!(resp.status(), 200);
+    assert_eq!(
+        resp.headers().get("content-type").unwrap(),
+        "application/json"
+    );
+    let json: Value = serde_json::from_str(&resp.text()?).unwrap();
+    assert_eq!(json["name"], "index.html");
+    assert_eq!(json["path_type"], "File");
+    assert!(json["size"].as_u64().is_some());
+    assert!(json["mtime"].as_u64().is_some());
+    Ok(())
+}
+
 #[rstest]
 fn head_file(server: TestServer) -> Result<(), Error> {
     let resp = fetch!(b"HEAD", format!("{}index.html", server.url())).send()?;

tests/range.rs

@@ -104,3 +104,25 @@ fn get_file_multipart_range_invalid(server: TestServer) -> Result<(), Error> {
     assert_eq!(resp.headers().get("content-length").unwrap(), "0");
     Ok(())
 }
+
+#[rstest]
+fn get_file_range_reversed(server: TestServer) -> Result<(), Error> {
+    let resp = fetch!(b"GET", format!("{}index.html", server.url()))
+        .header("range", HeaderValue::from_static("bytes=10-1"))
+        .send()?;
+    assert_eq!(resp.status(), 416);
+    assert_eq!(resp.headers().get("content-range").unwrap(), "bytes */18");
+    assert_eq!(resp.headers().get("accept-ranges").unwrap(), "bytes");
+    Ok(())
+}
+
+#[rstest]
+fn get_file_multipart_range_reversed(server: TestServer) -> Result<(), Error> {
+    let resp = fetch!(b"GET", format!("{}index.html", server.url()))
+        .header("range", HeaderValue::from_static("bytes=10-1,20-2"))
+        .send()?;
+    assert_eq!(resp.status(), 416);
+    assert_eq!(resp.headers().get("content-range").unwrap(), "bytes */18");
+    assert_eq!(resp.headers().get("accept-ranges").unwrap(), "bytes");
+    Ok(())
+}