|
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762 |
- /*
- The MIT License (MIT)
-
- Copyright (c) 2014-2017 DutchCoders [https://github.com/dutchcoders/]
-
- Permission is hereby granted, free of charge, to any person obtaining a copy
- of this software and associated documentation files (the "Software"), to deal
- in the Software without restriction, including without limitation the rights
- to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- copies of the Software, and to permit persons to whom the Software is
- furnished to do so, subject to the following conditions:
-
- The above copyright notice and this permission notice shall be included in
- all copies or substantial portions of the Software.
-
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- THE SOFTWARE.
- */
-
- package server
-
- import (
- // _ "transfer.sh/app/handlers"
- // _ "transfer.sh/app/utils"
-
- "archive/tar"
- "archive/zip"
- "bytes"
- "compress/gzip"
- "encoding/json"
- "errors"
- "fmt"
- "html"
- html_template "html/template"
- "io"
- "io/ioutil"
- "log"
- "math/rand"
- "mime"
- "net/http"
- "net/url"
- "os"
- "path"
- "path/filepath"
- "strconv"
- "strings"
- "sync"
- text_template "text/template"
- "time"
-
- "net"
-
- web "github.com/dutchcoders/transfer.sh-web"
- "github.com/gorilla/mux"
- "github.com/russross/blackfriday"
- )
-
- var (
- htmlTemplates = initHTMLTemplates()
- textTemplates = initTextTemplates()
- )
-
- func stripPrefix(path string) string {
- return strings.Replace(path, web.Prefix+"/", "", -1)
- }
-
- func initTextTemplates() *text_template.Template {
- templateMap := text_template.FuncMap{"format": formatNumber}
-
- // Templates with functions available to them
- var templates = text_template.New("").Funcs(templateMap)
- return templates
- }
-
- func initHTMLTemplates() *html_template.Template {
- templateMap := html_template.FuncMap{"format": formatNumber}
-
- // Templates with functions available to them
- var templates = html_template.New("").Funcs(templateMap)
-
- return templates
- }
-
- func healthHandler(w http.ResponseWriter, r *http.Request) {
- fmt.Fprintf(w, "Approaching Neutral Zone, all systems normal and functioning.")
- }
-
- /* The preview handler will show a preview of the content for browsers (accept type text/html), and referer is not transfer.sh */
- func (s *Server) previewHandler(w http.ResponseWriter, r *http.Request) {
-
- vars := mux.Vars(r)
-
- token := vars["token"]
- filename := vars["filename"]
-
- contentType, contentLength, err := s.storage.Head(token, filename)
- if err != nil {
- http.Error(w, http.StatusText(404), 404)
- return
- }
-
- var templatePath string
- var content html_template.HTML
-
- switch {
- case strings.HasPrefix(contentType, "image/"):
- templatePath = "download.image.html"
- case strings.HasPrefix(contentType, "video/"):
- templatePath = "download.video.html"
- case strings.HasPrefix(contentType, "audio/"):
- templatePath = "download.audio.html"
- case strings.HasPrefix(contentType, "text/"):
- templatePath = "download.markdown.html"
-
- var reader io.ReadCloser
- if reader, _, _, err = s.storage.Get(token, filename); err != nil {
- http.Error(w, err.Error(), http.StatusInternalServerError)
- return
- }
-
- var data []byte
- if data, err = ioutil.ReadAll(reader); err != nil {
- http.Error(w, err.Error(), http.StatusInternalServerError)
- return
- }
-
- if strings.HasPrefix(contentType, "text/x-markdown") || strings.HasPrefix(contentType, "text/markdown") {
- output := blackfriday.MarkdownCommon(data)
- content = html_template.HTML(output)
- } else if strings.HasPrefix(contentType, "text/plain") {
- content = html_template.HTML(fmt.Sprintf("<pre>%s</pre>", html.EscapeString(string(data))))
- } else {
- templatePath = "download.sandbox.html"
- }
-
- default:
- templatePath = "download.html"
- }
-
- if err != nil {
- http.Error(w, err.Error(), http.StatusInternalServerError)
- return
- }
-
- data := struct {
- ContentType string
- Content html_template.HTML
- Filename string
- Url string
- ContentLength uint64
- }{
- contentType,
- content,
- filename,
- r.URL.String(),
- contentLength,
- }
-
- if err := htmlTemplates.ExecuteTemplate(w, templatePath, data); err != nil {
- http.Error(w, err.Error(), http.StatusInternalServerError)
- return
- }
-
- }
-
- // this handler will output html or text, depending on the
- // support of the client (Accept header).
-
- func (s *Server) viewHandler(w http.ResponseWriter, r *http.Request) {
- // vars := mux.Vars(r)
-
- if acceptsHTML(r.Header) {
- if err := htmlTemplates.ExecuteTemplate(w, "index.html", nil); err != nil {
- http.Error(w, err.Error(), http.StatusInternalServerError)
- return
- }
- } else {
- if err := textTemplates.ExecuteTemplate(w, "index.txt", nil); err != nil {
- http.Error(w, err.Error(), http.StatusInternalServerError)
- return
- }
- }
- }
-
- func (s *Server) notFoundHandler(w http.ResponseWriter, r *http.Request) {
- http.Error(w, http.StatusText(404), 404)
- }
-
- func sanitize(fileName string) string {
- return path.Clean(path.Base(fileName))
- }
-
- func (s *Server) postHandler(w http.ResponseWriter, r *http.Request) {
- if err := r.ParseMultipartForm(_24K); nil != err {
- log.Printf("%s", err.Error())
- http.Error(w, "Error occurred copying to output stream", 500)
- return
- }
-
- token := Encode(10000000 + int64(rand.Intn(1000000000)))
-
- w.Header().Set("Content-Type", "text/plain")
-
- for _, fheaders := range r.MultipartForm.File {
- for _, fheader := range fheaders {
- filename := sanitize(fheader.Filename)
- contentType := fheader.Header.Get("Content-Type")
-
- if contentType == "" {
- contentType = mime.TypeByExtension(filepath.Ext(fheader.Filename))
- }
-
- var f io.Reader
- var err error
-
- if f, err = fheader.Open(); err != nil {
- log.Printf("%s", err.Error())
- http.Error(w, err.Error(), 500)
- return
- }
-
- var b bytes.Buffer
-
- n, err := io.CopyN(&b, f, _24K+1)
- if err != nil && err != io.EOF {
- log.Printf("%s", err.Error())
- http.Error(w, err.Error(), 500)
- return
- }
-
- var reader io.Reader
-
- if n > _24K {
- file, err := ioutil.TempFile(s.tempPath, "transfer-")
- if err != nil {
- log.Fatal(err)
- }
- defer file.Close()
-
- n, err = io.Copy(file, io.MultiReader(&b, f))
- if err != nil {
- os.Remove(file.Name())
-
- log.Printf("%s", err.Error())
- http.Error(w, err.Error(), 500)
- return
- }
-
- reader, err = os.Open(file.Name())
- } else {
- reader = bytes.NewReader(b.Bytes())
- }
-
- contentLength := n
-
- metadata := MetadataForRequest(contentType, r)
-
- buffer := &bytes.Buffer{}
- if err := json.NewEncoder(buffer).Encode(metadata); err != nil {
- log.Printf("%s", err.Error())
- http.Error(w, errors.New("Could not encode metadata").Error(), 500)
- return
- } else if err := s.storage.Put(token, fmt.Sprintf("%s.metadata", filename), buffer, "text/json", uint64(buffer.Len())); err != nil {
- log.Printf("%s", err.Error())
- http.Error(w, errors.New("Could not save metadata").Error(), 500)
- return
- }
-
- log.Printf("Uploading %s %s %d %s", token, filename, contentLength, contentType)
-
- if err = s.storage.Put(token, filename, reader, contentType, uint64(contentLength)); err != nil {
- log.Printf("Backend storage error: %s", err.Error())
- http.Error(w, err.Error(), 500)
- return
-
- }
-
- relativeURL, _ := url.Parse(path.Join(token, filename))
- fmt.Fprint(w, getURL(r).ResolveReference(relativeURL).String())
- }
- }
- }
-
- type Metadata struct {
- // ContentType is the original uploading content type
- ContentType string
- // Secret as knowledge to delete file
- // Secret string
- // Downloads is the actual number of downloads
- Downloads int
- // MaxDownloads contains the maximum numbers of downloads
- MaxDownloads int
- // MaxDate contains the max age of the file
- MaxDate time.Time
- }
-
- func MetadataForRequest(contentType string, r *http.Request) Metadata {
- metadata := Metadata{
- ContentType: contentType,
- MaxDate: time.Now().Add(time.Hour * 24 * 365 * 10),
- Downloads: 0,
- MaxDownloads: 99999999,
- }
-
- if v := r.Header.Get("Max-Downloads"); v == "" {
- } else if v, err := strconv.Atoi(v); err != nil {
- } else {
- metadata.MaxDownloads = v
- }
-
- if v := r.Header.Get("Max-Days"); v == "" {
- } else if v, err := strconv.Atoi(v); err != nil {
- } else {
- metadata.MaxDate = time.Now().Add(time.Hour * 24 * time.Duration(v))
- }
-
- return metadata
- }
-
- func (s *Server) putHandler(w http.ResponseWriter, r *http.Request) {
- vars := mux.Vars(r)
-
- filename := sanitize(vars["filename"])
-
- contentLength := r.ContentLength
-
- var reader io.Reader
-
- reader = r.Body
-
- if contentLength == -1 {
- // queue file to disk, because s3 needs content length
- var err error
- var f io.Reader
-
- f = reader
-
- var b bytes.Buffer
-
- n, err := io.CopyN(&b, f, _24K+1)
- if err != nil && err != io.EOF {
- log.Printf("Error putting new file: %s", err.Error())
- http.Error(w, err.Error(), 500)
- return
- }
-
- if n > _24K {
- file, err := ioutil.TempFile(s.tempPath, "transfer-")
- if err != nil {
- log.Printf("%s", err.Error())
- http.Error(w, err.Error(), 500)
- return
- }
-
- defer file.Close()
-
- n, err = io.Copy(file, io.MultiReader(&b, f))
- if err != nil {
- os.Remove(file.Name())
- log.Printf("%s", err.Error())
- http.Error(w, err.Error(), 500)
- return
- }
-
- reader, err = os.Open(file.Name())
- } else {
- reader = bytes.NewReader(b.Bytes())
- }
-
- contentLength = n
- }
-
- contentType := r.Header.Get("Content-Type")
-
- if contentType == "" {
- contentType = mime.TypeByExtension(filepath.Ext(vars["filename"]))
- }
-
- token := Encode(10000000 + int64(rand.Intn(1000000000)))
-
- metadata := MetadataForRequest(contentType, r)
-
- buffer := &bytes.Buffer{}
- if err := json.NewEncoder(buffer).Encode(metadata); err != nil {
- log.Printf("%s", err.Error())
- http.Error(w, errors.New("Could not encode metadata").Error(), 500)
- return
- } else if err := s.storage.Put(token, fmt.Sprintf("%s.metadata", filename), buffer, "text/json", uint64(buffer.Len())); err != nil {
- log.Printf("%s", err.Error())
- http.Error(w, errors.New("Could not save metadata").Error(), 500)
- return
- }
-
- log.Printf("Uploading %s %s %d %s", token, filename, contentLength, contentType)
-
- var err error
-
- if err = s.storage.Put(token, filename, reader, contentType, uint64(contentLength)); err != nil {
- log.Printf("Error putting new file: %s", err.Error())
- http.Error(w, errors.New("Could not save file").Error(), 500)
- return
- }
-
- // w.Statuscode = 200
-
- w.Header().Set("Content-Type", "text/plain")
-
- relativeURL, _ := url.Parse(path.Join(token, filename))
- fmt.Fprint(w, getURL(r).ResolveReference(relativeURL).String())
- }
-
- func getURL(r *http.Request) *url.URL {
- u := *r.URL
-
- if r.TLS != nil {
- u.Scheme = "https"
- } else if proto := r.Header.Get("X-Forwarded-Proto"); proto != "" {
- u.Scheme = proto
- } else {
- u.Scheme = "http"
- }
-
- if u.Host != "" {
- } else if host, port, err := net.SplitHostPort(r.Host); err != nil {
- u.Host = r.Host
- } else {
- if port == "80" && u.Scheme == "http" {
- u.Host = host
- } else if port == "443" && u.Scheme == "https" {
- u.Host = host
- } else {
- u.Host = net.JoinHostPort(host, port)
- }
- }
-
- return &u
- }
-
- func (s *Server) Lock(token, filename string) error {
- key := path.Join(token, filename)
-
- if _, ok := s.locks[key]; !ok {
- s.locks[key] = &sync.Mutex{}
- }
-
- s.locks[key].Lock()
-
- return nil
- }
-
- func (s *Server) Unlock(token, filename string) error {
- key := path.Join(token, filename)
- s.locks[key].Unlock()
-
- return nil
- }
-
- func (s *Server) CheckMetadata(token, filename string) error {
- s.Lock(token, filename)
- defer s.Unlock(token, filename)
-
- var metadata Metadata
-
- r, _, _, err := s.storage.Get(token, fmt.Sprintf("%s.metadata", filename))
- if s.storage.IsNotExist(err) {
- return nil
- } else if err != nil {
- return err
- }
-
- defer r.Close()
-
- if err := json.NewDecoder(r).Decode(&metadata); err != nil {
- return err
- } else if metadata.Downloads >= metadata.MaxDownloads {
- return errors.New("MaxDownloads expired.")
- } else if time.Now().After(metadata.MaxDate) {
- return errors.New("MaxDate expired.")
- } else {
- // todo(nl5887): mutex?
-
- // update number of downloads
- metadata.Downloads++
-
- buffer := &bytes.Buffer{}
- if err := json.NewEncoder(buffer).Encode(metadata); err != nil {
- return errors.New("Could not encode metadata")
- } else if err := s.storage.Put(token, fmt.Sprintf("%s.metadata", filename), buffer, "text/json", uint64(buffer.Len())); err != nil {
- return errors.New("Could not save metadata")
- }
- }
-
- return nil
- }
-
- func (s *Server) zipHandler(w http.ResponseWriter, r *http.Request) {
- vars := mux.Vars(r)
-
- files := vars["files"]
-
- zipfilename := fmt.Sprintf("transfersh-%d.zip", uint16(time.Now().UnixNano()))
-
- w.Header().Set("Content-Type", "application/zip")
- w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", zipfilename))
- w.Header().Set("Connection", "close")
-
- zw := zip.NewWriter(w)
-
- for _, key := range strings.Split(files, ",") {
- if strings.HasPrefix(key, "/") {
- key = key[1:]
- }
-
- key = strings.Replace(key, "\\", "/", -1)
-
- token := strings.Split(key, "/")[0]
- filename := sanitize(strings.Split(key, "/")[1])
-
- if err := s.CheckMetadata(token, filename); err != nil {
- log.Printf("Error metadata: %s", err.Error())
- continue
- }
-
- reader, _, _, err := s.storage.Get(token, filename)
-
- if err != nil {
- if s.storage.IsNotExist(err) {
- http.Error(w, "File not found", 404)
- return
- } else {
- log.Printf("%s", err.Error())
- http.Error(w, "Could not retrieve file.", 500)
- return
- }
- }
-
- defer reader.Close()
-
- header := &zip.FileHeader{
- Name: strings.Split(key, "/")[1],
- Method: zip.Store,
- ModifiedTime: uint16(time.Now().UnixNano()),
- ModifiedDate: uint16(time.Now().UnixNano()),
- }
-
- fw, err := zw.CreateHeader(header)
-
- if err != nil {
- log.Printf("%s", err.Error())
- http.Error(w, "Internal server error.", 500)
- return
- }
-
- if _, err = io.Copy(fw, reader); err != nil {
- log.Printf("%s", err.Error())
- http.Error(w, "Internal server error.", 500)
- return
- }
- }
-
- if err := zw.Close(); err != nil {
- log.Printf("%s", err.Error())
- http.Error(w, "Internal server error.", 500)
- return
- }
- }
-
- func (s *Server) tarGzHandler(w http.ResponseWriter, r *http.Request) {
- vars := mux.Vars(r)
-
- files := vars["files"]
-
- tarfilename := fmt.Sprintf("transfersh-%d.tar.gz", uint16(time.Now().UnixNano()))
-
- w.Header().Set("Content-Type", "application/x-gzip")
- w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", tarfilename))
- w.Header().Set("Connection", "close")
-
- os := gzip.NewWriter(w)
- defer os.Close()
-
- zw := tar.NewWriter(os)
- defer zw.Close()
-
- for _, key := range strings.Split(files, ",") {
- if strings.HasPrefix(key, "/") {
- key = key[1:]
- }
-
- key = strings.Replace(key, "\\", "/", -1)
-
- token := strings.Split(key, "/")[0]
- filename := sanitize(strings.Split(key, "/")[1])
-
- if err := s.CheckMetadata(token, filename); err != nil {
- log.Printf("Error metadata: %s", err.Error())
- continue
- }
-
- reader, _, contentLength, err := s.storage.Get(token, filename)
- if err != nil {
- if s.storage.IsNotExist(err) {
- http.Error(w, "File not found", 404)
- return
- } else {
- log.Printf("%s", err.Error())
- http.Error(w, "Could not retrieve file.", 500)
- return
- }
- }
-
- defer reader.Close()
-
- header := &tar.Header{
- Name: strings.Split(key, "/")[1],
- Size: int64(contentLength),
- }
-
- err = zw.WriteHeader(header)
- if err != nil {
- log.Printf("%s", err.Error())
- http.Error(w, "Internal server error.", 500)
- return
- }
-
- if _, err = io.Copy(zw, reader); err != nil {
- log.Printf("%s", err.Error())
- http.Error(w, "Internal server error.", 500)
- return
- }
- }
- }
-
- func (s *Server) tarHandler(w http.ResponseWriter, r *http.Request) {
- vars := mux.Vars(r)
-
- files := vars["files"]
-
- tarfilename := fmt.Sprintf("transfersh-%d.tar", uint16(time.Now().UnixNano()))
-
- w.Header().Set("Content-Type", "application/x-tar")
- w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", tarfilename))
- w.Header().Set("Connection", "close")
-
- zw := tar.NewWriter(w)
- defer zw.Close()
-
- for _, key := range strings.Split(files, ",") {
- token := strings.Split(key, "/")[0]
- filename := strings.Split(key, "/")[1]
-
- if err := s.CheckMetadata(token, filename); err != nil {
- log.Printf("Error metadata: %s", err.Error())
- continue
- }
-
- reader, _, contentLength, err := s.storage.Get(token, filename)
- if err != nil {
- if s.storage.IsNotExist(err) {
- http.Error(w, "File not found", 404)
- return
- } else {
- log.Printf("%s", err.Error())
- http.Error(w, "Could not retrieve file.", 500)
- return
- }
- }
-
- defer reader.Close()
-
- header := &tar.Header{
- Name: strings.Split(key, "/")[1],
- Size: int64(contentLength),
- }
-
- err = zw.WriteHeader(header)
- if err != nil {
- log.Printf("%s", err.Error())
- http.Error(w, "Internal server error.", 500)
- return
- }
-
- if _, err = io.Copy(zw, reader); err != nil {
- log.Printf("%s", err.Error())
- http.Error(w, "Internal server error.", 500)
- return
- }
- }
- }
-
- func (s *Server) getHandler(w http.ResponseWriter, r *http.Request) {
- vars := mux.Vars(r)
-
- token := vars["token"]
- filename := vars["filename"]
-
- if err := s.CheckMetadata(token, filename); err != nil {
- log.Printf("Error metadata: %s", err.Error())
- http.Error(w, http.StatusText(http.StatusNotFound), http.StatusNotFound)
- return
- }
-
- reader, contentType, contentLength, err := s.storage.Get(token, filename)
- if s.storage.IsNotExist(err) {
- http.Error(w, http.StatusText(http.StatusNotFound), http.StatusNotFound)
- return
- } else if err != nil {
- log.Printf("%s", err.Error())
- http.Error(w, "Could not retrieve file.", 500)
- return
- }
-
- defer reader.Close()
-
- w.Header().Set("Content-Type", contentType)
- w.Header().Set("Content-Length", strconv.FormatUint(contentLength, 10))
- w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", filename))
- w.Header().Set("Connection", "close")
-
- if _, err = io.Copy(w, reader); err != nil {
- log.Printf("%s", err.Error())
- http.Error(w, "Error occurred copying to output stream", 500)
- return
- }
- }
-
- func (s *Server) RedirectHandler(h http.Handler) http.HandlerFunc {
- return func(w http.ResponseWriter, r *http.Request) {
- if !s.forceHTTPs {
- // we don't want to enforce https
- } else if r.URL.Path == "/health.html" {
- // health check url won't redirect
- } else if strings.HasSuffix(ipAddrFromRemoteAddr(r.Host), ".onion") {
- // .onion addresses cannot get a valid certificate, so don't redirect
- } else if r.Header.Get("X-Forwarded-Proto") == "https" {
- } else if r.URL.Scheme == "https" {
- } else {
- u := getURL(r)
- u.Scheme = "https"
-
- http.Redirect(w, r, u.String(), http.StatusPermanentRedirect)
- return
- }
-
- h.ServeHTTP(w, r)
- }
- }
-
- // Create a log handler for every request it receives.
- func LoveHandler(h http.Handler) http.HandlerFunc {
- return func(w http.ResponseWriter, r *http.Request) {
- w.Header().Set("x-made-with", "<3 by DutchCoders")
- w.Header().Set("x-served-by", "Proudly served by DutchCoders")
- w.Header().Set("Server", "Transfer.sh HTTP Server 1.0")
- h.ServeHTTP(w, r)
- }
- }
|