mirrors/copyparty
1
0
Fork 0
mirror of https://github.com/9001/copyparty.git synced 2025-08-17 09:02:15 -06:00
Code Issues Actions Packages Projects Releases Wiki Activity

unpost: authed users can see anon on same ip

Browse source
This commit is contained in:
ed 2024-10-13 22:00:15 +00:00
parent b7f9bf5a28
commit 22b58e31ef
1 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
copyparty/up2k.py
View file

@ -357,17 +357,18 @@ class Up2k(object):
return '[{"timeout":1}]' return '[{"timeout":1}]'
ret: list[tuple[int, str, int, int, int]] = [] ret: list[tuple[int, str, int, int, int]] = []
userset = set([(uname or "\n"), "*"])
try: try:
for ptop, tab2 in self.registry.items(): for ptop, tab2 in self.registry.items():
cfg = self.flags.get(ptop, {}).get("u2abort", 1) cfg = self.flags.get(ptop, {}).get("u2abort", 1)
if not cfg: if not cfg:
continue continue
addr = (ip or "\n") if cfg in (1, 2) else "" addr = (ip or "\n") if cfg in (1, 2) else ""
user = (uname or "\n") if cfg in (1, 3) else "" user = userset if cfg in (1, 3) else None
for job in tab2.values(): for job in tab2.values():
if ( if (
"done" in job "done" in job
or (user and user != job["user"]) or (user and job["user"] not in user)
or (addr and addr != job["addr"]) or (addr and addr != job["addr"])
): ):
continue continue
@ -3833,10 +3834,12 @@ class Up2k(object):
with self.mutex, self.reg_mutex: with self.mutex, self.reg_mutex:
abrt_cfg = self.flags.get(ptop, {}).get("u2abort", 1) abrt_cfg = self.flags.get(ptop, {}).get("u2abort", 1)
addr = (ip or "\n") if abrt_cfg in (1, 2) else "" addr = (ip or "\n") if abrt_cfg in (1, 2) else ""
user = (uname or "\n") if abrt_cfg in (1, 3) else "" user = ((uname or "\n"), "*") if abrt_cfg in (1, 3) else None
reg = self.registry.get(ptop, {}) if abrt_cfg else {} reg = self.registry.get(ptop, {}) if abrt_cfg else {}
for wark, job in reg.items(): for wark, job in reg.items():
if (user and user != job["user"]) or (addr and addr != job["addr"]): if (addr and addr != job["addr"]) or (
user and job["user"] not in user
):
continue continue
jrem = djoin(job["prel"], job["name"]) jrem = djoin(job["prel"], job["name"])
if ANYWIN: if ANYWIN: