xavi/slcl/libweb, branch v0.4.1

Bump libweb

2025-10-26T19:15:14+00:00

The following commit fixes a memory leak caused by untrusted user input: commit 953210bd1930e1734f1acde86eadd7a1997bb7c3 Author: Xavier Del Campo Romero Date: Sun Oct 26 20:12:46 2025 +0100 form.c: Fix leak on invalid form When one or more entries have been appended to a struct form instance, but then an error occurs, those valid entries must be deallocated, too.

Bump libweb to v0.5.0

2025-10-09T09:29:56+00:00

Use free function pointer for chunk/step

2025-10-08T00:03:17+00:00

libweb now supports deallocating user-defined data whenever an error occurs during a chunked transfer or an asynchronous HTTP response, thus avoiding memory leaks.

Implement directory download as ZIP

2025-10-08T00:03:05+00:00

Thanks to the fdzipstream library [1] and zlib [2], it is possible to generate ZIP files on-the-fly, therefore requiring no extra disk space usage and only a small amount of memory. Unfortunately, as of the time of this writing fdzipstream is not packaged by any distributions yet [3], so it had to be imported as a git submodule as a workaround. While libarchive [4] could be an interesting alternative, writing ZIP files is only supported by very recent versions (>= 3.8.0), which are still not packaged by many distributions [5], either. Moreover, libarchive is a package with several dependencies other than zlib and is significantly larger compared to fdzipstreams, so fdzipstreams was ultimately considered a better fit for this purpose. [1]: https://github.com/CTrabant/fdzipstream.git [2]: http://zlib.net/ [3]: https://repology.org/projects/?search=fdzipstream [4]: https://www.libarchive.org/ [5]: https://repology.org/project/libarchive/versions

Setup higher backlog count

2025-10-06T19:06:04+00:00

libweb now allows to set up a custom value for the backlog argument in the internal call to listen(2).

Fix missing refactors related to cftw

2025-10-06T14:28:59+00:00

Commit 4fa1b3e8 missed to update other calls to cftw that were still relying on the older interface, causing unexpected errors. As a side effect, user quotas are now calculated asynchronously i.e., without blocking other clients. While the same improvement was planned for the /rm endpoint, it proved too challenging to implement for a first refactor: on one hand, /rm takes one or more key-value pairs involving the top-level directories and/or files to remove. On the other hand, every directory must be traversed recursively as rmdir(2) must be used on empty directories. While certainly possible, it was considered to keep a synchronous behaviour for do_rm for the sake of simplicity.

Make search non-blocking

2025-09-24T10:39:09+00:00

Thanks to a new feature in libweb, it is now possible to generate HTTP responses asynchronously i.e., without blocking other clients if the response takes a long time to generate. This now allow users to search for files or directories without blocking other users, regardless how much time the search operation takes. This required cftw to deviate from the POSIX-like, blocking interface it had so far, and has been replaced now with a non-blocking interface, so that directories are inspected one entry at a time.

Bump libweb

2025-09-23T14:33:35+00:00

commit f7864cb7d49a8ca5bddf8d1f68b71ecd5ed85adc Author: Xavier Del Campo Romero Date: Tue Sep 23 16:28:44 2025 +0200 http.c: Always set SameSite=Strict to cookies This cookie attribute allows to mitigate CSRF attacks, while not requiring the server to store additional data. [1] [1]: https://owasp.org/www-community/SameSite

libweb: Add byte serving

2024-11-10T23:08:50+00:00

libweb started to support HTTP/1.1 Range Requests [1] so that large files can be partially retrieved. In the context of slcl, this is interesting in order to preview large media files, such as videos, PDFs or audio files. [1]: https://httpwg.org/specs/rfc7233.html

Bump libweb to v0.4.1

2024-08-28T01:57:00+00:00