🎇 resolved #160

server/check.go

@@ -2,9 +2,11 @@ package server
 
 import (
 	"fmt"
+	"github.com/Xhofe/alist/conf"
 	"github.com/Xhofe/alist/model"
 	"github.com/Xhofe/alist/utils"
 	"github.com/gin-gonic/gin"
+	log "github.com/sirupsen/logrus"
 	"gorm.io/gorm"
 	"path/filepath"
 )
@@ -53,3 +55,26 @@ func CheckParent(path string, password string) bool {
 		return CheckParent(filepath.Dir(path), password)
 	}
 }
+
+func CheckDownLink(path string, passwordMd5 string) bool {
+	if !conf.CheckDown {
+		return true
+	}
+	meta, err := model.GetMetaByPath(path)
+	log.Debugf("check down path: %s", path)
+	if err == nil {
+		log.Debugf("check down link: %s,%s", meta.Password, passwordMd5)
+		if meta.Password != "" && utils.Get16MD5Encode(meta.Password) != passwordMd5 {
+			return false
+		}
+		return true
+	} else {
+		if !conf.CheckParent {
+			return true
+		}
+		if path == "/" {
+			return true
+		}
+		return CheckDownLink(filepath.Dir(path), passwordMd5)
+	}
+}

server/down.go

@@ -21,6 +21,11 @@ func Down(c *gin.Context) {
 	}
 	rawPath = utils.ParsePath(rawPath)
 	log.Debugf("down: %s", rawPath)
+	pw := c.Query("pw")
+	if !CheckDownLink(filepath.Dir(rawPath), pw) {
+		ErrorResp(c, fmt.Errorf("wrong password"), 401)
+		return
+	}
 	account, path, driver, err := ParsePath(rawPath)
 	if err != nil {
 		ErrorResp(c, err, 500)
@@ -52,6 +57,11 @@ func Proxy(c *gin.Context) {
 	}
 	rawPath = utils.ParsePath(rawPath)
 	log.Debugf("proxy: %s", rawPath)
+	pw := c.Query("pw")
+	if !CheckDownLink(filepath.Dir(rawPath), pw) {
+		ErrorResp(c, fmt.Errorf("wrong password"), 401)
+		return
+	}
 	account, path, driver, err := ParsePath(rawPath)
 	if err != nil {
 		ErrorResp(c, err, 500)
@@ -74,7 +84,7 @@ func Proxy(c *gin.Context) {
 			Text(c, link)
 			return
 		}
-		driver.Proxy(c,account)
+		driver.Proxy(c, account)
 		r := c.Request
 		w := c.Writer
 		target, err := url.Parse(link)