Go code updates

Former-commit-id: ac2160fe6ef9c41c7b180a8af967f3d44f126394 [formerly c99451b289742e4738812c3f4bcfdc63931f2e6a] [formerly 10bc4c44b68391f2be0ee965187caaaaa27ba8f0 [formerly 1a4242ca06]] Former-commit-id: b3555e3ea88e695ee72a87cee4b226f3d0a1d48d [formerly 70e58315f9e2a3bb3e46d48b3280127aa49107c5] Former-commit-id: d66ddf727e7924b95e2caf88f3c02de17a1f86cf
2025-11-26 14:25:26 +08:00 · 2017-07-08 17:51:47 +01:00
parent f6aeb27ca4
commit b4067cc423
8 changed files with 728 additions and 599 deletions
--- a/users.go
+++ b/users.go
@@ -0,0 +1,289 @@
+package filemanager
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/asdine/storm"
+)
+
+func usersHandler(c *requestContext, w http.ResponseWriter, r *http.Request) (int, error) {
+	switch r.Method {
+	case http.MethodGet:
+		return usersGetHandler(c, w, r)
+	case http.MethodPost:
+		return usersPostHandler(c, w, r)
+	case http.MethodDelete:
+		return usersDeleteHandler(c, w, r)
+	case http.MethodPut:
+		return usersPutHandler(c, w, r)
+	}
+
+	return http.StatusNotImplemented, nil
+}
+
+// usersGetHandler is used to handle the GET requests for /api/users. It can print a list
+// of users or a specific user. The password hash is always removed before being sent to the
+// client.
+func usersGetHandler(c *requestContext, w http.ResponseWriter, r *http.Request) (int, error) {
+	if !c.us.Admin {
+		return http.StatusForbidden, nil
+	}
+
+	// If the request is a list of users.
+	if r.URL.Path == "/" {
+		users := []User{}
+
+		for _, user := range c.fm.Users {
+			// Copies the user and removes the password.
+			u := *user
+			u.Password = ""
+			users = append(users, u)
+		}
+
+		sort.Slice(users, func(i, j int) bool {
+			return users[i].ID < users[j].ID
+		})
+
+		return renderJSON(w, users)
+	}
+
+	// Otherwise we just want one, specific, user.
+	sid := strings.TrimPrefix(r.URL.Path, "/")
+	sid = strings.TrimSuffix(sid, "/")
+
+	id, err := strconv.Atoi(sid)
+	if err != nil {
+		return http.StatusNotFound, err
+	}
+
+	// Searches for the user and prints the one who matches.
+	for _, user := range c.fm.Users {
+		if user.ID != id {
+			continue
+		}
+
+		u := *user
+		u.Password = ""
+		return renderJSON(w, u)
+	}
+
+	// If there aren't any matches, return Not Found.
+	return http.StatusNotFound, nil
+}
+
+func usersPostHandler(c *requestContext, w http.ResponseWriter, r *http.Request) (int, error) {
+	if !c.us.Admin {
+		return http.StatusForbidden, nil
+	}
+
+	// New users should be created on /api/users.
+	if r.URL.Path != "/" {
+		return http.StatusMethodNotAllowed, nil
+	}
+
+	// If the request body is empty, send a Bad Request status.
+	if r.Body == nil {
+		return http.StatusBadRequest, nil
+	}
+
+	var u User
+
+	// Parses the user and checks for error.
+	err := json.NewDecoder(r.Body).Decode(&u)
+	if err != nil {
+		return http.StatusBadRequest, nil
+	}
+
+	// The username and the password cannot be empty.
+	if u.Username == "" || u.Password == "" || u.FileSystem == "" {
+		return http.StatusBadRequest, errors.New("Username, password or scope are empty")
+	}
+
+	// Initialize rules if they're not initialized.
+	if u.Rules == nil {
+		u.Rules = []*Rule{}
+	}
+
+	// Initialize commands if not initialized.
+	if u.Commands == nil {
+		u.Commands = []string{}
+	}
+
+	// It's a new user so the ID will be auto created.
+	if u.ID != 0 {
+		u.ID = 0
+	}
+
+	// Hashes the password.
+	pw, err := hashPassword(u.Password)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	u.Password = pw
+
+	// Saves the user to the database.
+	err = c.fm.db.Save(&u)
+	if err == storm.ErrAlreadyExists {
+		return http.StatusConflict, err
+	}
+
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	// Saves the user to the memory.
+	c.fm.Users[u.Username] = &u
+
+	// Set the Location header and return.
+	w.Header().Set("Location", "/users/"+strconv.Itoa(u.ID))
+	w.WriteHeader(http.StatusCreated)
+	return 0, nil
+}
+
+func usersDeleteHandler(c *requestContext, w http.ResponseWriter, r *http.Request) (int, error) {
+	if !c.us.Admin {
+		return http.StatusForbidden, nil
+	}
+
+	// New users should be created on /api/users.
+	if r.URL.Path == "/" {
+		return http.StatusMethodNotAllowed, nil
+	}
+
+	// Otherwise we just want one, specific, user.
+	sid := strings.TrimPrefix(r.URL.Path, "/")
+	sid = strings.TrimSuffix(sid, "/")
+
+	id, err := strconv.Atoi(sid)
+	if err != nil {
+		return http.StatusNotFound, err
+	}
+
+	err = c.fm.db.DeleteStruct(&User{ID: id})
+	if err == storm.ErrNotFound {
+		return http.StatusNotFound, err
+	}
+
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	for _, user := range c.fm.Users {
+		if user.ID == id {
+			delete(c.fm.Users, user.Username)
+		}
+	}
+
+	return http.StatusOK, nil
+}
+
+func usersPutHandler(c *requestContext, w http.ResponseWriter, r *http.Request) (int, error) {
+	if !c.us.Admin && !(r.URL.Path == "/change-password" || r.URL.Path == "/change-css") {
+		return http.StatusForbidden, nil
+	}
+
+	// New users should be created on /api/users.
+	if r.URL.Path == "/" {
+		return http.StatusMethodNotAllowed, nil
+	}
+
+	// Otherwise we just want one, specific, user.
+	sid := strings.TrimPrefix(r.URL.Path, "/")
+	sid = strings.TrimSuffix(sid, "/")
+
+	id, err := strconv.Atoi(sid)
+	if err != nil && sid != "change-password" && sid != "change-css" {
+		return http.StatusNotFound, err
+	}
+
+	// If the request body is empty, send a Bad Request status.
+	if r.Body == nil {
+		return http.StatusBadRequest, errors.New("The request has an empty body")
+	}
+
+	var u User
+
+	// Parses the user and checks for error.
+	err = json.NewDecoder(r.Body).Decode(&u)
+	if err != nil {
+		return http.StatusBadRequest, errors.New("Invalid JSON")
+	}
+
+	if sid == "change-password" {
+		if u.Password == "" {
+			return http.StatusBadRequest, errors.New("Password cannot be empty")
+		}
+
+		pw, err := hashPassword(u.Password)
+		if err != nil {
+			return http.StatusInternalServerError, err
+		}
+
+		c.us.Password = pw
+		err = c.fm.db.UpdateField(&User{ID: c.us.ID}, "Password", pw)
+		if err != nil {
+			return http.StatusInternalServerError, err
+		}
+
+		return http.StatusOK, nil
+	}
+
+	if sid == "change-css" {
+		c.us.CSS = u.CSS
+		err = c.fm.db.UpdateField(&User{ID: c.us.ID}, "CSS", u.CSS)
+		if err != nil {
+			return http.StatusInternalServerError, err
+		}
+
+		return http.StatusOK, nil
+	}
+
+	// The username and the filesystem cannot be empty.
+	if u.Username == "" || u.FileSystem == "" {
+		return http.StatusBadRequest, errors.New("Username, password or scope are empty")
+	}
+
+	// Initialize rules if they're not initialized.
+	if u.Rules == nil {
+		u.Rules = []*Rule{}
+	}
+
+	// Initialize commands if not initialized.
+	if u.Commands == nil {
+		u.Commands = []string{}
+	}
+
+	ouser, ok := c.fm.Users[u.Username]
+	if !ok {
+		return http.StatusNotFound, nil
+	}
+
+	u.ID = id
+
+	if u.Password == "" {
+		u.Password = ouser.Password
+	} else {
+		pw, err := hashPassword(u.Password)
+		if err != nil {
+			return http.StatusInternalServerError, err
+		}
+
+		u.Password = pw
+	}
+
+	// Updates the whole User struct because we always are supposed
+	// to send a new entire object.
+	err = c.fm.db.Save(&u)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	c.fm.Users[u.Username] = &u
+	return http.StatusOK, nil
+}