From 9b46291a20d34a5cb36007b9d646ab241b33c2cb Mon Sep 17 00:00:00 2001 From: ed Date: Sat, 26 Aug 2023 13:19:38 +0000 Subject: [PATCH] add option to force-disable turbo, making it safer to enable --ban-404 (u2c can still get banned inadvertently) --- README.md | 4 ++-- copyparty/__main__.py | 4 ++-- copyparty/svchub.py | 1 + copyparty/web/up2k.js | 5 +++++ 4 files changed, 10 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 8fd93ea2..d867ceff 100644 --- a/README.md +++ b/README.md @@ -1612,9 +1612,9 @@ safety profiles: * `--unpost 0`, `--no-del`, `--no-mv` disables all move/delete support * `--hardlink` creates hardlinks instead of symlinks when deduplicating uploads, which is less maintenance * however note if you edit one file it will also affect the other copies - * `--vague-401` returns a "404 not found" instead of "401 unauthorized" which is a common enterprise meme + * `--vague-403` returns a "404 not found" instead of "401 unauthorized" which is a common enterprise meme * `--ban-404=50,60,1440` ban client for 1440min (24h) if they hit 50 404's in 60min - * **NB:** will ban anyone who enables up2k turbo + * `--turbo=-1` to force-disable turbo-mode in the uploader which could otherwise hit the 404-ban * `--nih` removes the server hostname from directory listings * option `-sss` is a shortcut for the above plus: diff --git a/copyparty/__main__.py b/copyparty/__main__.py index 9a44c278..fd397368 100755 --- a/copyparty/__main__.py +++ b/copyparty/__main__.py @@ -815,7 +815,7 @@ def add_upload(ap): ap2.add_argument("--magic", action="store_true", help="enable filetype detection on nameless uploads (volflag=magic)") ap2.add_argument("--df", metavar="GiB", type=float, default=0, help="ensure GiB free disk space by rejecting upload requests") ap2.add_argument("--sparse", metavar="MiB", type=int, default=4, help="windows-only: minimum size of incoming uploads through up2k before they are made into sparse files") - ap2.add_argument("--turbo", metavar="LVL", type=int, default=0, help="configure turbo-mode in up2k client; [\033[32m0\033[0m] = off and warn if enabled, [\033[32m1\033[0m] = off, [\033[32m2\033[0m] = on, [\033[32m3\033[0m] = on and disable datecheck") + ap2.add_argument("--turbo", metavar="LVL", type=int, default=0, help="configure turbo-mode in up2k client; [\033[32m-1\033[0m] = forbidden/always-off, [\033[32m0\033[0m] = default-off and warn if enabled, [\033[32m1\033[0m] = default-off, [\033[32m2\033[0m] = on, [\033[32m3\033[0m] = on and disable datecheck") ap2.add_argument("--u2sort", metavar="TXT", type=u, default="s", help="upload order; [\033[32ms\033[0m]=smallest-first, [\033[32mn\033[0m]=alphabetical, [\033[32mfs\033[0m]=force-s, [\033[32mfn\033[0m]=force-n -- alphabetical is a bit slower on fiber/LAN but makes it easier to eyeball if everything went fine") ap2.add_argument("--write-uplog", action="store_true", help="write POST reports to textfiles in working-directory") @@ -995,7 +995,7 @@ def add_optouts(ap): def add_safety(ap): ap2 = ap.add_argument_group('safety options') ap2.add_argument("-s", action="count", default=0, help="increase safety: Disable thumbnails / potentially dangerous software (ffmpeg/pillow/vips), hide partial uploads, avoid crawlers.\n └─Alias of\033[32m --dotpart --no-thumb --no-mtag-ff --no-robots --force-js") - ap2.add_argument("-ss", action="store_true", help="further increase safety: Prevent js-injection, accidental move/delete, broken symlinks, webdav, 404 on 403, ban on excessive 404s.\n └─Alias of\033[32m -s --unpost=0 --no-del --no-mv --hardlink --vague-403 --ban-404=50,60,1440 -nih") + ap2.add_argument("-ss", action="store_true", help="further increase safety: Prevent js-injection, accidental move/delete, broken symlinks, webdav, 404 on 403, ban on excessive 404s.\n └─Alias of\033[32m -s --unpost=0 --no-del --no-mv --hardlink --vague-403 --ban-404=50,60,1440 --turbo=-1 -nih") ap2.add_argument("-sss", action="store_true", help="further increase safety: Enable logging to disk, scan for dangerous symlinks.\n └─Alias of\033[32m -ss --no-dav --no-logues --no-readme -lo=cpp-%%Y-%%m%%d-%%H%%M%%S.txt.xz --ls=**,*,ln,p,r") ap2.add_argument("--ls", metavar="U[,V[,F]]", type=u, help="do a sanity/safety check of all volumes on startup; arguments \033[33mUSER\033[0m,\033[33mVOL\033[0m,\033[33mFLAGS\033[0m; example [\033[32m**,*,ln,p,r\033[0m]") ap2.add_argument("--xvol", action="store_true", help="never follow symlinks leaving the volume root, unless the link is into another volume where the user has similar access (volflag=xvol)") diff --git a/copyparty/svchub.py b/copyparty/svchub.py index 3ba90135..0c669ffd 100644 --- a/copyparty/svchub.py +++ b/copyparty/svchub.py @@ -121,6 +121,7 @@ class SvcHub(object): args.hardlink = True args.vague_403 = True args.ban_404 = "50,60,1440" + args.turbo = -1 args.nih = True if args.s: diff --git a/copyparty/web/up2k.js b/copyparty/web/up2k.js index 424bfaf9..0b84b8dc 100644 --- a/copyparty/web/up2k.js +++ b/copyparty/web/up2k.js @@ -2698,6 +2698,11 @@ function up2k_init(subtle) { } function draw_turbo() { + if (turbolvl < 0 && uc.turbo) { + bcfg_set('u2turbo', uc.turbo = false); + toast.err(10, "turbo is disabled in server config"); + } + var msg = (turbolvl || !uc.turbo) ? null : uc.fsearch ? L.u_ts : L.u_tu, html = ebi('u2foot').innerHTML;