ProjectHentai/alist
6
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: check password while upload (close #2444)

Browse Source
This commit is contained in:
Noah Hsu
2022-11-22 16:14:01 +08:00
parent c09800790b
commit 85e1350af8
6 changed files with 81 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
server/handles/fsup.go
View File

@ -6,13 +6,10 @@ import (
"strconv"
"time"
"github.com/alist-org/alist/v3/internal/db"
"github.com/alist-org/alist/v3/internal/errs"
"github.com/alist-org/alist/v3/internal/fs"
"github.com/alist-org/alist/v3/internal/model"
"github.com/alist-org/alist/v3/server/common"
"github.com/gin-gonic/gin"
"github.com/pkg/errors"
)
func FsStream(c *gin.Context) {
@ -25,19 +22,6 @@ func FsStream(c *gin.Context) {
asTask := c.GetHeader("As-Task") == "true"
user := c.MustGet("user").(*model.User)
path = stdpath.Join(user.BasePath, path)
if !user.CanWrite() {
meta, err := db.GetNearestMeta(stdpath.Dir(path))
if err != nil {
if !errors.Is(errors.Cause(err), errs.MetaNotFound) {
common.ErrorResp(c, err, 500, true)
return
}
}
if !canWrite(meta, path) {
common.ErrorResp(c, errs.PermissionDenied, 403)
return
}
}
dir, name := stdpath.Split(path)
sizeStr := c.GetHeader("Content-Length")
@ -78,19 +62,7 @@ func FsForm(c *gin.Context) {
asTask := c.GetHeader("As-Task") == "true"
user := c.MustGet("user").(*model.User)
path = stdpath.Join(user.BasePath, path)
if !user.CanWrite() {
meta, err := db.GetNearestMeta(stdpath.Dir(path))
if err != nil {
if !errors.Is(errors.Cause(err), errs.MetaNotFound) {
common.ErrorResp(c, err, 500, true)
return
}
}
if !canWrite(meta, path) {
common.ErrorResp(c, errs.PermissionDenied, 403)
return
}
}
storage, err := fs.GetStorage(path)
if err != nil {
common.ErrorResp(c, err, 400)