aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request 'termux compile fix (1/2)' (#5) from ↵Xavier Del Campo Romero12 days2-3/+4
|\ | | | | | | | | | | | | fukiame/slcl:pr/termux_compile into master Reviewed-on: https://codeberg.org/xavidcr/slcl/pulls/5 Reviewed-by: Xavier Del Campo Romero <xavidcr@noreply.codeberg.org>
| * usergen: rename getpassfukiame2026-10-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | usergen.c:154:12: error: conflicting types for 'getpass' 154 | static int getpass(char *const password, const size_t n) | ^ /data/data/com.termux/files/usr/bin/../../usr/include/unistd.h:533:25: note: previous definition is here 533 | static __inline__ char* getpass(const char* prompt) { | ^ usergen.c:511:30: error: too many arguments to function call, expected single argument 'prompt', have 2 arguments 511 | || getpass(password, sizeof password) | ~~~~~~~ ^~~~~~~~~~~~~~~ /data/data/com.termux/files/usr/bin/../../usr/include/unistd.h:533:25: note: 'getpass' declared here 533 | static __inline__ char* getpass(const char* prompt) { | ^ ~~~~~~~~~~~~~~~~~~ 2 errors generated. Signed-off-by: fukiame <fukiame@proton.me>
| * configure: abide by TMPDIR if already setfukiame2026-10-031-1/+2
|/ | | | | | ./configure: 149: cannot create /tmp/Makefile.slcl: Permission denied Signed-off-by: fukiame <fukiame@proton.me>
* README.md: Update copyright yearv0.5.0Xavier Del Campo Romero2026-09-271-1/+1
|
* zip.c: Add top-level directoryXavier Del Campo Romero2026-09-271-14/+32
| | | | | | | It is desirable to keep the contents of the generated file below a directory, ideally named after the ZIP file itself, so that extraction tools can extract the files to a subdirectory, rather than spilling its contents to the working directory.
* zip.c: Const-qualify bnXavier Del Campo Romero2026-09-271-1/+2
| | | | | | | Even if basename(3) does modify the input string [1], the returned pointer is only used as a reference in this context. [1]: https://pubs.opengroup.org/onlinepubs/9699919799/functions/basename.html
* Bump to libweb v0.6.0Xavier Del Campo Romero2026-09-271-0/+0
|
* Report missing authenticationXavier Del Campo Romero2026-06-133-1/+35
| | | | | | | | | Previously, HTTP error 403 was returned if an unauthenticated user attempted to access a file or directory inside /user/. However, this error message confusing because, most often, it was caused by legitimate users with missing or expired HTTP cookies. While the usual workaround was to access /index.html and authenticate, this was too confusing to some users.
* page.c: Add explicity body tagXavier Del Campo Romero2026-06-131-0/+4
|
* page.c: Center invalid password textXavier Del Campo Romero2026-06-131-1/+3
|
* Bump libwebXavier Del Campo Romero2026-06-131-0/+0
|
* configure: Re-configure subprojects if requiredXavier Del Campo Romero2026-02-131-0/+17
| | | | | | | | When a configuration is changed from the top-level directory, it should be reflected on the subprojects as well. Note: still, "make clean" is required so that the objects are built with the new configuration flags.
* configure: Remove -gXavier Del Campo Romero2026-02-131-1/+1
| | | | | Traditionally, this flag is set by users via the CFLAGS environment variable, rather than including it by default.
* Honor user CFLAGS/LDFLAGSXavier Del Campo Romero2026-02-131-25/+34
| | | | | | | | | Ideally, these flags must be appended to those introduced by the project (e.g.: if user enters -Oz as CFLAGS, then -O1 and -Oz would co-exist and the compiler would choose the later), rather than replacing them. Additionally, user CFLAGS/LDFLAGS should be passed to children projects, too.
* Replace thumbnail Makefile with configure scriptXavier Del Campo Romero2026-02-135-40/+160
| | | | | | | | | The thumbnail subproject has dependencies against dynstr and ImageMagick6, which might or might not be available on the system, or might have been installed to non-standard paths. Therefore, it is more robust to rely on a configure script that checks whether the packages are available and how to deal with CFLAGS/LDFLAGS.
* configure: Also install thumbnailXavier Del Campo Romero2026-02-131-7/+14
|
* README.md: Add packages for Alpine LinuxXavier Del Campo Romero2026-02-131-0/+18
|
* configure: Test zlibXavier Del Campo Romero2026-02-131-1/+10
| | | | | | | | Otherwise, compilation could fail because zlib's header files and/or library cannot be found on the system. Additionally, since fdzipstream depends on zlib, zlib's ldflags must be appended to those from fdzipstream, rather than hardcoding -lz.
* configure: Test libcjsonXavier Del Campo Romero2026-02-131-1/+11
| | | | | | | | Otherwise, compilation could fail because libcjson's header files and/or library cannot be found on the system. Additionally, -lcjson should not be hardcoded to the ldflags, as this is better handled by pkg-config(1).
* README.md: Fix wrong package nameXavier Del Campo Romero2026-02-131-1/+1
|
* Bump libwebXavier Del Campo Romero2026-02-134-12/+41
| | | | | | | libweb has introduced several breaking changes: - Add optional expiration date to http_cookie_create - Replace Makefile with configure script
* main.c: Fix null pointer access on empty datav0.4.2Xavier Del Campo Romero2026-02-081-6/+44
| | | | | | If users send no payload data to a POST request, libweb sets a null pointer as part of the payload. Therefore, null pointers must always be checked as a sanity check.
* configure: Add libsodium flags to USERGEN_LDFLAGSXavier Del Campo Romero2026-02-031-0/+1
| | | | | Otherwise, usergen(1) would be built without linking against libsodium, and thus would fail to build.
* Bump libwebv0.4.1Xavier Del Campo Romero2025-10-261-0/+0
| | | | | | | | | | | | | The following commit fixes a memory leak caused by untrusted user input: commit 953210bd1930e1734f1acde86eadd7a1997bb7c3 Author: Xavier Del Campo Romero Date: Sun Oct 26 20:12:46 2025 +0100 form.c: Fix leak on invalid form When one or more entries have been appended to a struct form instance, but then an error occurs, those valid entries must be deallocated, too.
* README.md: Replace OpenSSL with libsodiumXavier Del Campo Romero2025-10-111-2/+2
| | | | | | | | | | This was a leftover from the following commit: commit 10e42591ac72285736d5cc4ee5e7c2f68dbf1e4b Author: Xavier Del Campo Romero Date: Wed Oct 8 13:50:52 2025 +0200 Replace OpenSSL with libsodium and argon2id
* page.c: Align results to centerv0.4.0Xavier Del Campo Romero2025-10-101-5/+5
|
* page.c: Ensure trailing '/' on dir download URLsXavier Del Campo Romero2025-10-101-1/+1
| | | | | | | Otherwise, it is not ensured web browsers would translate a relative directory such as "dir/.." to a URL with a trailing '/'. Therefore, a POST request to "/user?download=1" would fail because slcl only considers "/user/" (note the trailing '/') as valid.
* zip.c: Fix endless loop on empty archivesXavier Del Campo Romero2025-10-101-1/+1
| | | | | | | | When an empty directory is to be downloaded, z->lread would always equal zero because read_file is never called. Therefore, it is more sensible not to assume any number of bytes, and just dump as much data as possible into buf.
* zip.c: Remove unused variableXavier Del Campo Romero2025-10-101-2/+0
|
* README.md: Add build instructions for thumbnailXavier Del Campo Romero2025-10-091-0/+14
|
* README.md: Update copyright noticeXavier Del Campo Romero2025-10-091-1/+1
|
* doc/user.png: Update according to status quoXavier Del Campo Romero2025-10-091-0/+0
|
* main.c Remove obsolete references to OpenSSLXavier Del Campo Romero2025-10-091-2/+0
|
* Fix installation for thumbnailXavier Del Campo Romero2025-10-093-1/+5
|
* Bump libweb to v0.5.0Xavier Del Campo Romero2025-10-091-0/+0
|
* page.c: Center directory/file and page countXavier Del Campo Romero2025-10-091-11/+12
|
* Use libweb's form APIXavier Del Campo Romero2025-10-091-326/+106
| | | | | This functionality was moved from slcl to libweb since it can be shared with other web applications.
* jwt.c: Use original base64 variantXavier Del Campo Romero2025-10-091-1/+1
| | | | | | | | | | | | | | | | Otherwise, cookies set by previous, OpenSSL-based versions of slcl would be now invalidated because URL-safe base64 transforms some characters, thus breaking backwards compatiblity. For example, '/' is transformed into '_' on the example cookies below: - Original base64 encoding: a=eyJhbGciOiAiSFMyNTYiLCAidHlwIjogIkpXVCJ9.eyJuYW1lIjogImEifQ==.jgp/SsraDR/3zlAnDLyj05VHulUNbDNHaPowvUkLto4= - URL-safe base64 encoding: a=eyJhbGciOiAiSFMyNTYiLCAidHlwIjogIkpXVCJ9.eyJuYW1lIjogImEifQ==.jgp_SsraDR_3zlAnDLyj05VHulUNbDNHaPowvUkLto4=
* Allow building thumbnail from the top-level buildXavier Del Campo Romero2025-10-085-5/+34
|
* Replace OpenSSL with libsodium and argon2idXavier Del Campo Romero2025-10-0813-349/+845
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The SHA256-based password hashing algorithm used by slcl(1) and usergen(1) is considered insecure against several kinds of attacks, including brute force attacks. [1] Therefore, a stronger password hashing algorithm based on the Argon2id key derivation function is now used by default. While OpenSSL does support Argon2id, it is only supported by very recent versions [2], which are still not packaged by most distributions as of the time of this writing. [3] As an alternative to OpenSSL, libsodium [4] had several benefits: - It provides easy-to-use functions for password hashing, base64 encoding/decoding and other cryptographic primitives used by slcl(1) and usergen(1). - It is packaged by most distributions [5], and most often only the patch version differs, which ensures good compatibility across distributions. Unfortunately, and as opposed to OpenSSL, libsodium does not come with command-line tools. Therefore, usergen(1) had to be rewritten in C. In order to maintain backwards compatiblity with existing databases, slcl(1) and usergen(1) shall support the insecure, SHA256-based password hashing algorithm. However, Argon2id shall now be the default choice for usergen(1). [1]: https://security.stackexchange.com/questions/195563/why-is-sha-256-not-good-for-passwords [2]: https://docs.openssl.org/3.3/man7/EVP_KDF-ARGON2/ [3]: https://repology.org/project/openssl/versions [4]: https://www.libsodium.org/ [5]: https://repology.org/project/libsodium/versions
* Use free function pointer for chunk/stepXavier Del Campo Romero2025-10-083-15/+10
| | | | | | libweb now supports deallocating user-defined data whenever an error occurs during a chunked transfer or an asynchronous HTTP response, thus avoiding memory leaks.
* page.c: Switch preview and downloadXavier Del Campo Romero2025-10-081-17/+35
| | | | | | | | | | | | | | | So far, clicking on a directory name previewed it, whereas clicking on a file name would download it, and file previews were on a separate column. This behaviour was found to be confusing, so it has been simplified. Now, clicking on a file or directory name would preview it. On the other hand, the "Preview" column has been replaced with a "Download" column, so that both files and directories can be downloaded. Thanks to Avron for the suggestion. [1] [1]: https://codeberg.org/xavidcr/slcl/issues/2
* page.c: Move remove checkbox to the rightXavier Del Campo Romero2025-10-081-1/+1
| | | | | | It feels more intuitive to keep the thumbnail and file name as first columns. It is assumed removing files and/or directories is not the main interaction from users.
* configure: Call distclean for submodulesXavier Del Campo Romero2025-10-081-0/+16
|
* page.c: Remove unused variableXavier Del Campo Romero2025-10-081-1/+1
|
* Implement directory download as ZIPXavier Del Campo Romero2025-10-0812-11/+487
| | | | | | | | | | | | | | | | | | | | | | | | Thanks to the fdzipstream library [1] and zlib [2], it is possible to generate ZIP files on-the-fly, therefore requiring no extra disk space usage and only a small amount of memory. Unfortunately, as of the time of this writing fdzipstream is not packaged by any distributions yet [3], so it had to be imported as a git submodule as a workaround. While libarchive [4] could be an interesting alternative, writing ZIP files is only supported by very recent versions (>= 3.8.0), which are still not packaged by many distributions [5], either. Moreover, libarchive is a package with several dependencies other than zlib and is significantly larger compared to fdzipstreams, so fdzipstreams was ultimately considered a better fit for this purpose. [1]: https://github.com/CTrabant/fdzipstream.git [2]: http://zlib.net/ [3]: https://repology.org/projects/?search=fdzipstream [4]: https://www.libarchive.org/ [5]: https://repology.org/project/libarchive/versions
* Import fdzipstreamXavier Del Campo Romero2025-10-062-0/+3
|
* page.c: Report logged user name on directory previewXavier Del Campo Romero2025-10-061-14/+39
| | | | | | Thanks to Avron for the suggestion. [1] [1]: https://codeberg.org/xavidcr/slcl/issues/2
* page.c: Add table head for directory previewXavier Del Campo Romero2025-10-061-2/+55
| | | | | | Thanks to Avron for the suggestion. [1] [1]: https://codeberg.org/xavidcr/slcl/issues/2
* Setup higher backlog countXavier Del Campo Romero2025-10-062-0/+2
| | | | | libweb now allows to set up a custom value for the backlog argument in the internal call to listen(2).
generated by cgit v1.2.3 (git 2.39.1) at 2026-10-20 09:10:03 +0000