xavi/slcl/main.c, branch v0.3.1Small and lightweight cloud storage written in C99 and POSIX.1-2008.
https://gitea.privatedns.org/xavi/slcl/atom?h=v0.3.12025-01-23T22:41:03+00:00main.c: Require paths with leading '/' on sharing2025-01-23T22:41:03+00:00Xavier Del Campo Romeroxavi.dcr@tutanota.com2025-01-23T22:24:22+00:00urn:sha1:3e618c2d0f1d489e13ed1f45b5a9068936c05743
When sharing, paths must be expressed as an absolute path e.g.:
/path/to/file .
main.c: Forbid sharing non-existing files2025-01-23T22:37:39+00:00Xavier Del Campo Romeroxavi.dcr@tutanota.com2025-01-23T22:21:44+00:00urn:sha1:9752843329a257542c34798d65e829a6cff7764b
So far, slcl would allow to share literally any directory or file, even
if they did not exist, as long as valid credentials were given.
Now, directories cannot be shared, since this is already restricted by
the web interface. This is now considered an invalid request.
On the other hand, attempting to share non-existing files shall now
return a 404 Not Found response to the user.
Bump to libweb 0.4.02024-08-22T00:28:25+00:00Xavier Del Campo Romeroxavi.dcr@tutanota.com2024-08-22T00:21:15+00:00urn:sha1:78eff0cfa55606ade2ce494258739514c92994ca
Now, libweb (rightfully) forces applications to handle signals and
introduces handler_notify_close(3) to achieve the desired behaviour.
Additionally, libweb 0.4.0 introduces several bugfixes.
main.c: Fix missing O_TRUNC2024-08-22T00:00:11+00:00Xavier Del Campo Romeroxavi.dcr@tutanota.com2024-08-22T00:00:11+00:00urn:sha1:36dec4c1b495cd13542827e7ab98b7938adb1524
Otherwise, uploaded files meant to overwrite an existing file would not
be updated accordingly if their newer size was smaller.
main.c: Improve relative path detection2024-02-20T20:24:17+00:00Xavier Del Campo Romeroxavi.dcr@tutanota.com2024-02-20T20:24:17+00:00urn:sha1:8bcf0bf855c1cd7710aa6c04e8bf23c06248c88b
Otherwise, the following resources would be considered valid:
- /user/../test
- /user/./test
- /user/a/.
- /user/a/./test
main.c: Reject invalid /public/ requests2024-02-20T07:18:11+00:00Xavier Del Campo Romeroxavi.dcr@tutanota.com2024-02-20T07:18:11+00:00urn:sha1:afc5cf0dfcb8c507315e40d71ee305fa130be6db
Otherwise:
- slcl would accept /public/ (i.e., without a file name) as a valid
resource. This would incorrectly map the public/ directory on the
database, making slcl to return -1 because public/ is not a regular
file.
- slcl would accept directory names (e.g.: /public/dir/), which is never
expected since slcl stores all public files into a single directory.
main.c: Force valid cookie on check_length2024-02-19T23:17:40+00:00Xavier Del Campo Romeroxavi.dcr@tutanota.com2024-02-19T23:17:40+00:00urn:sha1:b7f232366c03dad8afbbb8ed5ba44314e42b13fd
Otherwise, a malicious user could send multipart/form-data requests
without a valid cookie.
main.c: const-qualify name and dir2024-02-19T22:35:08+00:00Xavier Del Campo Romeroxavi.dcr@tutanota.com2024-02-19T22:08:35+00:00urn:sha1:55008f2f648b2ebb275d04607961d6bd4b9768ec
There was no reason why these should not be const-qualified. It was
probably missed during the implementation.
main.c: URL-encode created directories2024-02-19T22:35:08+00:00Xavier Del Campo Romeroxavi.dcr@tutanota.com2024-02-19T22:07:16+00:00urn:sha1:1f8aa578a489905ed2d7443cfcdb73a3ff8d48ea
Otherwise, directories with special characters, such as "%", would not
be accessible when performing the redirection.
main.c: Use fstat(2) on move_file2024-02-19T22:35:08+00:00Xavier Del Campo Romeroxavi.dcr@tutanota.com2024-02-19T22:04:50+00:00urn:sha1:a578ad6537320e562ce936bf70426ab2820ddaad
This allows to reuse the same file descriptor to both open(2) and
fstat(2) the file.