mirrors/copyparty
1
0
Fork 0
mirror of https://github.com/9001/copyparty.git synced 2025-08-17 17:12:13 -06:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix overly strict permission chk (hello from acon)

Browse source
This commit is contained in:
ed 2019-06-15 00:05:23 +00:00
parent 2075780a93
commit 1b817b90f2
2 changed files with 8 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
README.md
View file

@ -62,7 +62,6 @@ pip install black bandit pylint flake8 # vscode tooling
roughly sorted by priority
* permissions break for `ed` on `-v /home/ed/vfs:moji:r -v /home/ed/inc:inc:r:aed`
* http error handling (conn.status or handler-retval)
* look into android thumbnail cache file format
* last-modified header

13
copyparty/authsrv.py
View file

@ -70,16 +70,19 @@ class VFS(object):
def can_access(self, vpath, uname):
"""return [readable,writable]"""
vn, _ = self._find(vpath)
return [uname in vn.uread, uname in vn.uwrite]
return [
uname in vn.uread or "*" in vn.uread,
uname in vn.uwrite or "*" in vn.uwrite,
]
def get(self, vpath, uname, will_read, will_write):
"""returns [vfsnode,fs_remainder] if user has the requested permissions"""
vn, rem = self._find(vpath)
if will_read and uname not in vn.uread:
if will_read and (uname not in vn.uread and "*" not in vn.uread):
raise Pebkac("you don't have read-access for this location")
if will_write and uname not in vn.uwrite:
if will_write and (uname not in vn.uwrite and "*" not in vn.uwrite):
raise Pebkac("you don't have write-access for this location")
return vn, rem
@ -117,8 +120,8 @@ class VFS(object):
def user_tree(self, uname, readable=False, writable=False):
ret = []
opt1 = readable and uname in self.uread
opt2 = writable and uname in self.uwrite
opt1 = readable and (uname in self.uread or "*" in self.uread)
opt2 = writable and (uname in self.uwrite or "*" in self.uwrite)
if opt1 or opt2:
ret.append(self.vpath)