aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* WIP css stuffcssXavier Del Campo Romero2024-07-062-12/+70
|
* auth.c: Reject empty filesXavier Del Campo Romero2024-06-131-0/+5
| | | | | | It makes no sense to attempt to fopen(3) an empty file and malloc(3) zero bytes so as to dump it, as dump_db is still meant to fail on empty files.
* usergen: Fix error on empty $QUOTAXavier Del Campo Romero2024-06-121-1/+1
| | | | | | | When no quota is entered, printf(1) could fail because '%d' would expect at least one argument. Whereas some printf(1) implementations, such as the one by GNU coreutils, are somewhat tolerant, stricter implementations such as Busybox would (correctly) refuse this.
* README.md: Fix CMake build instructionsXavier Del Campo Romero2024-05-051-3/+2
| | | | | | The previous instructions were simply wrong because `cmake ..` would attempt to configure the project from the parent directory, instead of the build directory.
* page.c: Do not get filename on previewsXavier Del Campo Romero2024-03-011-9/+9
| | | | | | This change should provide the same behaviour, but would avoid unnecessary calls to dynstr_append and basename(3) when a preview is to be served.
* README.md: Update dependencies listXavier Del Campo Romero2024-02-241-2/+2
| | | | | | - jq is required by usergen. - Despite being part of a POSIX.1-2008 environment, m4 is not provided by Debian or Ubuntu by default.
* usergen: Do not abort on existing directoryv0.2.1Xavier Del Campo Romero2024-02-201-1/+1
| | | | | Otherwise, it would not be possible to replace user credentials if the directory already exists.
* main.c: Improve relative path detectionv0.2.1-rc4Xavier Del Campo Romero2024-02-201-6/+12
| | | | | | | | | Otherwise, the following resources would be considered valid: - /user/../test - /user/./test - /user/a/. - /user/a/./test
* main.c: Reject invalid /public/ requestsv0.2.1-rc3Xavier Del Campo Romero2024-02-201-1/+9
| | | | | | | | | | | | Otherwise: - slcl would accept /public/ (i.e., without a file name) as a valid resource. This would incorrectly map the public/ directory on the database, making slcl to return -1 because public/ is not a regular file. - slcl would accept directory names (e.g.: /public/dir/), which is never expected since slcl stores all public files into a single directory.
* main.c: Force valid cookie on check_lengthv0.2.1-rc2Xavier Del Campo Romero2024-02-201-1/+10
| | | | | Otherwise, a malicious user could send multipart/form-data requests without a valid cookie.
* page.c: Use open(2) fdopen(3) and fstat(2)v0.2.1-rc1Xavier Del Campo Romero2024-02-191-25/+79
| | | | | Now, the same file descriptor can be reused for all of the operations above, instead of calling stat(2) and fopen(3) separately.
* page.c: URL-encode hrefXavier Del Campo Romero2024-02-191-3/+25
| | | | | Otherwise, files with special characters, such as '%', could not be downloaded or previewed.
* main.c: const-qualify name and dirXavier Del Campo Romero2024-02-191-1/+1
| | | | | There was no reason why these should not be const-qualified. It was probably missed during the implementation.
* main.c: URL-encode created directoriesXavier Del Campo Romero2024-02-191-1/+8
| | | | | Otherwise, directories with special characters, such as "%", would not be accessible when performing the redirection.
* main.c: Use fstat(2) on move_fileXavier Del Campo Romero2024-02-191-24/+30
| | | | | This allows to reuse the same file descriptor to both open(2) and fstat(2) the file.
* Bump libweb to 0.3.0Xavier Del Campo Romero2024-02-193-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | The following commits fix a couple of security issues on libweb. Because of afe0681c0b26bb64bad55d7e86770f346cfa043e, slcl had to be updated to set up its struct http_cfg_post. commit afe0681c0b26bb64bad55d7e86770f346cfa043e Author: Xavier Del Campo Romero <xavi.dcr@tutanota.com> Date: Mon Feb 19 23:00:56 2024 +0100 Limit maximum multipart/form-data pairs and files A malicious user could inject an infinite number of empty files or key/value pairs into a request in order to exhaust the device's resources. commit 9d9e0c2979f43297b2ebbf84f14f064f3f9ced0e Author: Xavier Del Campo Romero <xavi.dcr@tutanota.com> Date: Mon Feb 19 22:49:09 2024 +0100 html.c: Avoid half-init objects on html_node_add_attr The previous implementation would leave half-initialised objects if one of the calls to strdup(3) failed. Now, n->attrs is only modified when all previous memory allocations were successful.
* main.c: Add missing relative path checkXavier Del Campo Romero2024-02-191-1/+5
|
* CMakeLists.txt: Bump version to 0.2.0v0.2.0Xavier Del Campo Romero2024-02-121-1/+1
|
* Bump libweb to 0.2.0Xavier Del Campo Romero2024-02-122-1/+1
|
* usergen: Fix password generationXavier Del Campo Romero2024-01-261-1/+1
| | | | | For longer passwords, od(1) might introduce a newline character, causing printf(1) to interpret its input string incorrectly.
* Bump libwebXavier Del Campo Romero2024-01-261-0/+0
| | | | | | | | | | | | | | | | | | | | | | | The following commits introduced performance improvements and bugfixes: Author: Xavier Del Campo Romero <xavi.dcr@tutanota.com> Date: Sat Jan 20 01:09:18 2024 +0100 server.c: Fix wrong priority for do_exit Under some specific circumstances, poll(2) would return a positive integer, but do_exit might had been previously set. This caused libweb to ignore SIGTERM, with the potential risk for an endless loop. Author: Xavier Del Campo Romero <xavi.dcr@tutanota.com> Date: Sat Jan 20 01:05:05 2024 +0100 http.c: Solve performance issues on POST uploads Profiling showed that reading multipart/form POST uploads byte-by-byte was too slow and typically led to maximum CPU usage. Therefore, the older approach (as done up to commit 7efc2b3a) was more efficient, even if the resulting code was a bit uglier.
* configure: Avoid file extension conversionXavier Del Campo Romero2024-01-261-1/+1
|
* configure: Fix typoXavier Del Campo Romero2023-11-241-1/+1
| | | | | | | | | | slweb was renamed to libweb some time ago: commit 28ae865e5ecad9b398ac21fa148fc4b93c987226 Author: Xavier Del Campo Romero <xavi.dcr@tutanota.com> Date: Tue Oct 10 23:43:47 2023 +0200 Apply slweb renaming to libweb
* .gitignore: Ignore only ./MakefileXavier Del Campo Romero2023-11-241-1/+1
| | | | | Future commits might introduce Makefiles on other directories that should not be ignored.
* Bump libwebXavier Del Campo Romero2023-11-241-0/+0
| | | | | | | | | | | | | | | | | | | | | | | | | The following commit should increase performance for slcl: commit b0accd099fa8c5110d4c3c68830ad6fd810ca3ec Author: Xavier Del Campo Romero <xavi.dcr@tutanota.com> Date: Fri Nov 24 00:52:50 2023 +0100 http.c: Unify read operations So far, libweb would perform different read operations depending on its state: - For HTTP headers or request bodies, one byte at a time was read. - For multipart/form-data, up to BUFSIZ bytes at a time were read. However, this caused a significant extra number of syscalls for no reason and would increase code complexity, specially when parsing multiform/form-data boundaries. Now, http_read always reads up to BUFSIZ bytes at a time and process them on a loop. Apart from reducing code complexity, this should increase performance due to the (much) lower number of syscalls required.
* CMakeLists.txt: Fix wrong parameters for projectXavier Del Campo Romero2023-11-231-1/+1
| | | | When VERSION is given, LANGUAGES becomes mandatory.
* Upgrade to new libweb interfaceXavier Del Campo Romero2023-11-232-2/+12
| | | | | | | | | | | | | | | | | | | | | | | Recent commits from libweb brought a few breaking changes. The one below affected slcl, so it had to be updated according to the new interface: commit 98f5f52461b0c1ab1ee3331722bd32e2db9e1d41 Author: Xavier Del Campo <xavier.delcampo@midokura.com> Date: Thu Nov 16 12:23:08 2023 +0100 Split handler_loop from handler_listen Some applications might set up a struct handler object to listen on any port i.e., 0, but still need a way to determine which port number was eventually selected by the implementation. Therefore, handler_listen has been reduced to the server initialization bit, whereas the main loop has been split into its own function, namely handler_loop. Because of these changes, it no longer made sense for libweb to write the selected port to standard output, as this is something now applications can do on their own.
* main.c: Treat non-existing upload dir as non-fatalXavier Del Campo Romero2023-11-231-4/+52
| | | | | | | | | | When a user attempts to upload a file into a non-existing directory, slcl would not check whether the directory exists. Then, rename(3) would fail and slcl would treat this as a fatal error, effectively closing itself. Since this is an example of ill-formed user input, it must be treated as a non-fatal error, and instead slcl should return a bad request page.
* Bump libwebXavier Del Campo Romero2023-11-121-0/+0
| | | | | | | | | | | | | | | | | | More bugfixes related to partial boundary parsing were provided by this commit: commit b71a6174e12b4709acaf8bc151938ba12d2a54f6 Author: Xavier Del Campo Romero <xavi.dcr@tutanota.com> Date: Sun Nov 12 23:31:57 2023 +0100 http.c: Fix more issues with partial boundaries - http_memmem must not check strlen(a) > n because, in case of a partial boundary, it would wrongfully return NULL. - If one or more characters from a partial boundary are found at the end of a buffer, but the next buffer does not start with the rest of the boundary, the accumulated boundary must be reset, and then look for a new boundary.
* Bump libwebXavier Del Campo Romero2023-11-121-0/+0
| | | | | | | | | | | | | | | | | | | Several bugfixes related to partial boundary parsing were provided by this commit: commit 7d02b225fe11fb0c7233cd2ea576485ee920f203 Author: Xavier Del Campo Romero <xavi.dcr@tutanota.com> Date: Sun Nov 12 06:16:26 2023 +0100 http.c: Fix several issues with partial boundaries - Writing to m->boundary[len] did not make any sense, as len is not meant to change between calls to read_mf_boundary_byte. - For the same reason, memset(3)ing "len + 1" did not make any sense. - When a partial boundary is found, http_memmem must still return st. - Calling reset_boundary with prev == 0 did not make sense, since that case typically means a partial boundary was found on a previous iteration, so m->blen must not be reset.
* libweb: Bump new signature for http_decode_urlXavier Del Campo Romero2023-11-122-15/+30
| | | | | | The new signature allows callers to distinguish decoding errors from fatal errors. This is important for slcl to avoid crashing when ill-formed data is received from a client.
* README.md: Remove wrong comment about /tmpv0.1.0-rc4v0.1.0Xavier Del Campo Romero2023-10-251-3/+1
| | | | | /tmp is at least defined by POSIX.1-2017 at section 10 (Directory Structure and Devices).
* Bump libweb to v0.1.0-rc6Xavier Del Campo Romero2023-10-251-0/+0
|
* CMakeLists.txt: set project VERSIONXavier Del Campo Romero2023-10-251-1/+1
|
* Bump libweb to v0.1.0-rc5Xavier Del Campo Romero2023-10-251-0/+0
|
* Replace handwritten Makefile with configure scriptXavier Del Campo Romero2023-10-254-52/+172
|
* CMake: Find system libweb or dynstr if availableXavier Del Campo Romero2023-10-252-1/+35
| | | | | So far, slcl's build system would always build libweb and dynstr. However, this is discouraged by distribution packagers.
* usergen: Call mkdir(1) before database swapXavier Del Campo Romero2023-10-191-1/+1
| | | | No changes must be committed to the database if mkdir(1) fails.
* usergen: Replace use of non-standard mktemp(1)Xavier Del Campo Romero2023-10-191-1/+8
| | | | | | Despite common use in several POSIX operating systems, mktemp(1) is not defined by POSIX.1-2008, nor even POSIX.1-2017. As long as it is not introduced, m4(1)'s mkstemp can be used with similar effect.
* main.c: Use BUFSIZ instead of arbitrary valueXavier Del Campo Romero2023-10-191-1/+1
| | | | | | | | | | According to C99 7.19.1p3: BUFSIZ is a macro that expands to an integer constant expression that is the size of the buffer used by the setbuf function. In other words, this means BUFSIZ is the most optimal length for a buffer that reads a file into memory in chunks using fread(3).
* CMakeLists.txt: Fix wrong library nameXavier Del Campo Romero2023-10-141-1/+1
|
* auth.c: Fix potential signed integer overflowXavier Del Campo Romero2023-10-141-2/+2
| | | | | | | | For platforms where int is a 16-bit data type, this operation might overflow and possibly cause either unexpected behaviour and/or a compiler warning. Therefore, it is safer to promote each integer constant accordingly.
* Implement HEAD supportXavier Del Campo Romero2023-10-143-0/+90
|
* List number of files and directoriesv0.1.0-rc3Xavier Del Campo Romero2023-10-111-23/+82
| | | | | Sometimes, users want to know how many files and/or directories reside on a directory. Now, slcl prints such information below the logout form.
* page.c: Force whitespace renderingXavier Del Campo Romero2023-10-111-1/+1
|
* Apply slweb renaming to libwebXavier Del Campo Romero2023-10-1111-27/+27
|
* Bump slwebv0.1.0-rc2Xavier Del Campo Romero2023-10-021-0/+0
|
* Bump slweb to v0.1.0-rc1v0.1.0-rc1Xavier Del Campo Romero2023-09-271-0/+0
|
* man1: Replace LICENSE/AUTHORS with COPYRIGHTXavier Del Campo Romero2023-09-272-10/+14
| | | | | LICENSE is not copied to the installation prefix, so adding a short copyright notice instead might be a better reference.
* CMakeLists.txt: Install targetsXavier Del Campo Romero2023-09-272-0/+12
|
generated by cgit v1.2.3 (git 2.39.1) at 2026-06-01 15:29:23 +0000