Version 1.3.5

Former-commit-id: e064282645a50d6eeeb293577da260c586d4bb45 [formerly 2a9ac206ab79a8f115ed25a3afb595663f18fcb4] [formerly 2ea943c96653266a9533d9e95776955821706ea4 [formerly dd59e3c62b]]
Former-commit-id: 4ec9b9738ee48943830b9045ae40e7c305010bf3 [formerly 7748b70d5109e788ad146b466b3430a822037570]
Former-commit-id: 0981b89cb1d7bc0da43d47ff8900eb1c67301982

assets/index.html

@@ -8,6 +8,7 @@
   <meta name="staticgen" content="{{ .StaticGen }}">
   <meta name="noauth" content="{{ .NoAuth }}">
   <meta name="version" content="{{ .Version }}">
+  <meta name="recaptcha" content="{{ .ReCaptchaKey }}">
   <title>File Manager</title>
   <link rel="icon" type="image/png" sizes="32x32" href="{{ .BaseURL }}/static/img/icons/favicon-32x32.png">
   <link rel="icon" type="image/png" sizes="16x16" href="{{ .BaseURL }}/static/img/icons/favicon-16x16.png">
@@ -27,6 +28,10 @@
 
   <script>CSS = "{{ .CSS }}"</script>
 
+  {{ if .ReCaptcha -}}
+    <script src='https://www.google.com/recaptcha/api.js?render=explicit'></script>
+  {{ end }}
+
   <% for (var chunk of webpack.chunks) {
     for (var file of chunk.files) {
       if (file.match(/\.(js|css)$/)) { %>

assets/src/App.vue

@@ -1,22 +1,48 @@
 <template>
-  <router-view @update:css="updateCSS" @clean:css="cleanCSS"></router-view>
+  <router-view :dependencies="loaded" @update:css="updateCSS" @clean:css="cleanCSS"></router-view>
 </template>
 
 <script>
+import { mapState } from 'vuex'
+
 export default {
   name: 'app',
+  computed: mapState(['recaptcha']),
+  data () {
+    return {
+      loaded: false
+    }
+  },
   mounted () {
-    // Remove loading animation.
-    let loading = document.getElementById('loading')
-    loading.classList.add('done')
+    if (this.recaptcha.length === 0) {
+      this.unload()
+      return
+    }
 
-    setTimeout(function () {
-      loading.parentNode.removeChild(loading)
-    }, 200)
+    let check = () => {
+      if (typeof window.grecaptcha === 'undefined') {
+        setTimeout(check, 100)
+        return
+      }
 
-    this.updateCSS()
+      this.unload()
+    }
+
+    check()
   },
   methods: {
+    unload () {
+      this.loaded = true
+      // Remove loading animation.
+      let loading = document.getElementById('loading')
+      loading.classList.add('done')
+
+      setTimeout(function () {
+        loading.parentNode.removeChild(loading)
+      }, 200)
+
+      this.updateCSS()
+    },
     updateCSS (global = false) {
       let css = this.$store.state.css
 

assets/src/css/login.css

@@ -29,6 +29,14 @@
   width: 90%;
 }
 
+#login.recaptcha form {
+  min-width: 304px;
+}
+
+#login #recaptcha {
+  margin: .5em 0 0;
+}
+
 #login input {
   width: 100%;
   width: 100%;

assets/src/i18n/ja.yaml

@@ -124,7 +124,7 @@ settings:
   examples: 例
   globalSettings: グローバル設定
   language: 言語
-  lockPassowrd: 新しいパスワードを変更に禁止
+  lockPassword: 新しいパスワードを変更に禁止
   newPassword: 新しいパスワード
   newPasswordConfirm: 新しいパスワードを確認します
   newUser: 新しいユーザー

assets/src/i18n/zh-cn.yaml

@@ -123,7 +123,7 @@ settings:
   examples: 例子
   globalSettings: 全局设置
   language: 语言
-  lockPassowrd: 禁止用户修改密码
+  lockPassword: 禁止用户修改密码
   newPassword: 您的新密码
   newPasswordConfirm: 重输一遍新密码
   newUser: 新建用户

assets/src/main.js

@@ -31,7 +31,7 @@ Vue.prototype.$showError = function (error) {
     type: 'error',
     timeout: null,
     buttons: [
-      Noty.button(i18n.t('buttons.reportIssue'), 'cancel', function () {
+      Noty.button(i18n.t('buttons.reportIssue'), '', function () {
         window.open('https://github.com/hacdias/filemanager/issues/new')
       }),
       Noty.button(i18n.t('buttons.close'), '', function () {

assets/src/router/index.js

@@ -51,14 +51,10 @@ const router = new Router({
           path: '/settings',
           name: 'Settings',
           component: Settings,
+          redirect: {
+            path: '/settings/profile'
+          },
           children: [
-            {
-              path: '/settings',
-              name: 'Settings',
-              redirect: {
-                path: '/settings/profile'
-              }
-            },
             {
               path: '/settings/profile',
               name: 'Profile Settings',

assets/src/store/index.js

@@ -17,6 +17,7 @@ const state = {
     window.CSS = null
     return css
   })(),
+  recaptcha: document.querySelector('meta[name="recaptcha"]').getAttribute('content'),
   staticGen: document.querySelector('meta[name="staticgen"]').getAttribute('content'),
   baseURL: document.querySelector('meta[name="base"]').getAttribute('content'),
   noAuth: (document.querySelector('meta[name="noauth"]').getAttribute('content') === 'true'),

assets/src/utils/auth.js

@@ -31,8 +31,8 @@ function loggedIn () {
   })
 }
 
-function login (user, password) {
-  let data = {username: user, password: password}
+function login (user, password, captcha) {
+  let data = {username: user, password: password, recaptcha: captcha}
   return new Promise((resolve, reject) => {
     let request = new window.XMLHttpRequest()
     request.open('POST', `${store.state.baseURL}/api/auth/get`, true)

assets/src/views/Login.vue

@@ -1,11 +1,12 @@
 <template>
-  <div id="login">
+  <div id="login" :class="{ recaptcha: recaptcha.length > 0 }">
     <form @submit="submit">
       <img src="../assets/logo.svg" alt="File Manager">
       <h1>File Manager</h1>
       <div v-if="wrong" class="wrong">{{ $t("login.wrongCredentials") }}</div>
       <input type="text" v-model="username" :placeholder="$t('login.username')">
       <input type="password" v-model="password" :placeholder="$t('login.password')">
+      <div v-if="recaptcha.length" id="recaptcha"></div>
       <input type="submit" :value="$t('login.submit')">
     </form>
   </div>
@@ -13,9 +14,12 @@
 
 <script>
 import auth from '@/utils/auth'
+import { mapState } from 'vuex'
 
 export default {
   name: 'login',
+  props: ['dependencies'],
+  computed: mapState(['recaptcha']),
   data: function () {
     return {
       wrong: false,
@@ -23,8 +27,23 @@ export default {
       password: ''
     }
   },
+  mounted () {
+    if (this.dependencies) this.setup()
+  },
+  watch: {
+    dependencies: function (val) {
+      if (val) this.setup()
+    }
+  },
   methods: {
-    submit: function (event) {
+    setup () {
+      if (this.recaptcha.length === 0) return
+
+      window.grecaptcha.render('recaptcha', {
+        sitekey: this.recaptcha
+      })
+    },
+    submit (event) {
       event.preventDefault()
       event.stopPropagation()
 
@@ -33,7 +52,17 @@ export default {
         redirect = '/files/'
       }
 
-      auth.login(this.username, this.password)
+      let captcha = ''
+      if (this.recaptcha.length > 0) {
+        captcha = window.grecaptcha.getResponse()
+
+        if (captcha === '') {
+          this.wrong = true
+          return
+        }
+      }
+
+      auth.login(this.username, this.password, captcha)
         .then(() => { this.$router.push({ path: redirect }) })
         .catch(() => { this.wrong = true })
     }

assets/src/views/settings/Global.vue

@@ -1,6 +1,6 @@
 <template>
   <div class="dashboard">
-    <form class="card" @submit.prevent="saveStaticGen">
+    <form class="card" v-if="staticGen.length" @submit.prevent="saveStaticGen">
       <div class="card-title">
         <h2>{{ capitalize($store.state.staticGen) }}</h2>
       </div>
@@ -80,7 +80,6 @@ export default {
   created () {
     getSettings()
       .then(settings => {
-        console.log(settings)
         if (this.$store.state.staticGen.length > 0) {
           this.parseStaticGen(settings.staticGen)
         }

caddy/parser/parser.go

@@ -48,6 +48,8 @@ func Parse(c *caddy.Controller, plugin string) ([]*filemanager.FileManager, erro
 		scope := "."
 		database := ""
 		noAuth := false
+		reCaptchaKey := ""
+		reCaptchaSecret := ""
 
 		if plugin != "" {
 			baseURL = "/admin"
@@ -155,6 +157,18 @@ func Parse(c *caddy.Controller, plugin string) ([]*filemanager.FileManager, erro
 				if u.ViewMode != "mosaic" && u.ViewMode != "list" {
 					return nil, c.ArgErr()
 				}
+			case "recaptcha_key":
+				if !c.NextArg() {
+					return nil, c.ArgErr()
+				}
+
+				reCaptchaKey = c.Val()
+			case "recaptcha_secret":
+				if !c.NextArg() {
+					return nil, c.ArgErr()
+				}
+
+				reCaptchaSecret = c.Val()
 			case "no_auth":
 				if !c.NextArg() {
 					noAuth = true
@@ -213,10 +227,12 @@ func Parse(c *caddy.Controller, plugin string) ([]*filemanager.FileManager, erro
 		}
 
 		m := &filemanager.FileManager{
-			NoAuth:      noAuth,
-			BaseURL:     "",
-			PrefixURL:   "",
-			DefaultUser: u,
+			NoAuth:          noAuth,
+			BaseURL:         "",
+			PrefixURL:       "",
+			ReCaptchaKey:    reCaptchaKey,
+			ReCaptchaSecret: reCaptchaSecret,
+			DefaultUser:     u,
 			Store: &filemanager.Store{
 				Config: bolt.ConfigStore{DB: db},
 				Users:  bolt.UsersStore{DB: db},

cmd/filemanager/main.go

@@ -24,24 +24,26 @@ import (
 )
 
 var (
-	addr          string
-	config        string
-	database      string
-	scope         string
-	commands      string
-	logfile       string
-	staticg       string
-	locale        string
-	baseurl       string
-	prefixurl     string
-	viewMode      string
-	port          int
-	noAuth        bool
-	allowCommands bool
-	allowEdit     bool
-	allowNew      bool
-	allowPublish  bool
-	showVer       bool
+	addr            string
+	config          string
+	database        string
+	scope           string
+	commands        string
+	logfile         string
+	staticg         string
+	locale          string
+	baseurl         string
+	prefixurl       string
+	viewMode        string
+	recaptchakey    string
+	recaptchasecret string
+	port            int
+	noAuth          bool
+	allowCommands   bool
+	allowEdit       bool
+	allowNew        bool
+	allowPublish    bool
+	showVer         bool
 )
 
 func init() {
@@ -55,6 +57,8 @@ func init() {
 	flag.StringVar(&commands, "commands", "git svn hg", "Default commands option for new users")
 	flag.StringVar(&prefixurl, "prefixurl", "", "Prefix URL")
 	flag.StringVar(&viewMode, "view-mode", "mosaic", "Default view mode for new users")
+	flag.StringVar(&recaptchakey, "recaptcha-key", "", "ReCaptcha site key")
+	flag.StringVar(&recaptchasecret, "recaptcha-secret", "", "ReCaptcha secret")
 	flag.BoolVar(&allowCommands, "allow-commands", true, "Default allow commands option for new users")
 	flag.BoolVar(&allowEdit, "allow-edit", true, "Default allow edit option for new users")
 	flag.BoolVar(&allowPublish, "allow-publish", true, "Default allow publish option for new users")
@@ -82,6 +86,8 @@ func setupViper() {
 	viper.SetDefault("BaseURL", "")
 	viper.SetDefault("PrefixURL", "")
 	viper.SetDefault("ViewMode", "mosaic")
+	viper.SetDefault("ReCaptchaKey", "")
+	viper.SetDefault("ReCaptchaSecret", "")
 
 	viper.BindPFlag("Port", flag.Lookup("port"))
 	viper.BindPFlag("Address", flag.Lookup("address"))
@@ -99,6 +105,8 @@ func setupViper() {
 	viper.BindPFlag("BaseURL", flag.Lookup("baseurl"))
 	viper.BindPFlag("PrefixURL", flag.Lookup("prefixurl"))
 	viper.BindPFlag("ViewMode", flag.Lookup("view-mode"))
+	viper.BindPFlag("ReCaptchaKey", flag.Lookup("recaptcha-key"))
+	viper.BindPFlag("ReCaptchaSecret", flag.Lookup("recaptcha-secret"))
 
 	viper.SetConfigName("filemanager")
 	viper.AddConfigPath(".")
@@ -179,9 +187,11 @@ func handler() http.Handler {
 	}
 
 	fm := &filemanager.FileManager{
-		NoAuth:    viper.GetBool("NoAuth"),
-		BaseURL:   viper.GetString("BaseURL"),
-		PrefixURL: viper.GetString("PrefixURL"),
+		NoAuth:          viper.GetBool("NoAuth"),
+		BaseURL:         viper.GetString("BaseURL"),
+		PrefixURL:       viper.GetString("PrefixURL"),
+		ReCaptchaKey:    viper.GetString("ReCaptchaKey"),
+		ReCaptchaSecret: viper.GetString("ReCaptchaSecret"),
 		DefaultUser: &filemanager.User{
 			AllowCommands: viper.GetBool("AllowCommands"),
 			AllowEdit:     viper.GetBool("AllowEdit"),

filemanager.go

@@ -22,7 +22,7 @@ import (
 )
 
 // Version is the current File Manager version.
-const Version = "1.3.2"
+const Version = "1.3.5"
 
 var (
 	ErrExist              = errors.New("the resource already exists")
@@ -66,6 +66,10 @@ type FileManager struct {
 	// there will only exist one user, called "admin".
 	NoAuth bool
 
+	// ReCaptcha Site key and secret.
+	ReCaptchaKey    string
+	ReCaptchaSecret string
+
 	// StaticGen is the static websit generator handler.
 	StaticGen StaticGen
 
@@ -201,6 +205,14 @@ func (m *FileManager) Setup() error {
 		}
 	}
 
+	// TODO: remove this after 1.5
+	for _, user := range users {
+		if user.ViewMode != "list" && user.ViewMode != "mosaic" {
+			user.ViewMode = "list"
+			m.Store.Users.Update(user, "ViewMode")
+		}
+	}
+
 	m.DefaultUser.Username = ""
 	m.DefaultUser.Password = ""
 

http/auth.go

@@ -1,8 +1,11 @@
 package http
 
 import (
+	"bytes"
 	"encoding/json"
+	"fmt"
 	"net/http"
+	"net/url"
 	"strings"
 	"time"
 
@@ -11,6 +14,45 @@ import (
 	fm "github.com/hacdias/filemanager"
 )
 
+type cred struct {
+	Password  string `json:"password"`
+	Username  string `json:"username"`
+	Recaptcha string `json:"recaptcha"`
+}
+
+// recaptcha checks the recaptcha code.
+func recaptcha(secret string, response string) (bool, error) {
+	api := "https://www.google.com/recaptcha/api/siteverify"
+
+	body := url.Values{}
+	body.Set("secret", secret)
+	body.Add("response", response)
+
+	client := &http.Client{}
+	resp, err := client.Post(api, "application/x-www-form-urlencoded", bytes.NewBufferString(body.Encode()))
+	if err != nil {
+		return false, err
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return false, nil
+	}
+
+	var data struct {
+		Success     bool        `json:"success"`
+		ChallengeTS time.Time   `json:"challenge_ts"`
+		Hostname    string      `json:"hostname"`
+		ErrorCodes  interface{} `json:"error-codes"`
+	}
+
+	err = json.NewDecoder(resp.Body).Decode(&data)
+	if err != nil {
+		return false, err
+	}
+
+	return data.Success, nil
+}
+
 // authHandler proccesses the authentication for the user.
 func authHandler(c *fm.Context, w http.ResponseWriter, r *http.Request) (int, error) {
 	// NoAuth instances shouldn't call this method.
@@ -19,7 +61,7 @@ func authHandler(c *fm.Context, w http.ResponseWriter, r *http.Request) (int, er
 	}
 
 	// Receive the credentials from the request and unmarshal them.
-	var cred fm.User
+	var cred cred
 	if r.Body == nil {
 		return http.StatusForbidden, nil
 	}
@@ -29,6 +71,19 @@ func authHandler(c *fm.Context, w http.ResponseWriter, r *http.Request) (int, er
 		return http.StatusForbidden, nil
 	}
 
+	// If ReCaptcha is enabled, check the code.
+	if len(c.ReCaptchaSecret) > 0 {
+		ok, err := recaptcha(c.ReCaptchaSecret, cred.Recaptcha)
+		if err != nil {
+			fmt.Println(err)
+			return http.StatusForbidden, err
+		}
+
+		if !ok {
+			return http.StatusForbidden, nil
+		}
+	}
+
 	// Checks if the user exists.
 	u, err := c.Store.Users.GetByUsername(cred.Username, c.NewFS)
 	if err != nil {

http/http.go

@@ -226,10 +226,13 @@ func renderFile(c *fm.Context, w http.ResponseWriter, file string) (int, error)
 	w.Header().Set("Content-Type", contentType+"; charset=utf-8")
 
 	data := map[string]interface{}{
-		"BaseURL": c.RootURL(),
-		"NoAuth":  c.NoAuth,
-		"Version": fm.Version,
-		"CSS":     template.CSS(c.CSS),
+		"BaseURL":         c.RootURL(),
+		"NoAuth":          c.NoAuth,
+		"Version":         fm.Version,
+		"CSS":             template.CSS(c.CSS),
+		"ReCaptcha":       c.ReCaptchaKey != "" && c.ReCaptchaSecret != "",
+		"ReCaptchaKey":    c.ReCaptchaKey,
+		"ReCaptchaSecret": c.ReCaptchaSecret,
 	}
 
 	if c.StaticGen != nil {

http/users.go

@@ -268,6 +268,13 @@ func usersPutHandler(c *fm.Context, w http.ResponseWriter, r *http.Request) (int
 		return http.StatusBadRequest, err
 	}
 
+	// If we're updating the default user. Only for NoAuth
+	// implementations. Used to change the viewMode.
+	if id == 0 && c.NoAuth {
+		c.DefaultUser.ViewMode = u.ViewMode
+		return http.StatusOK, nil
+	}
+
 	// Updates the CSS and locale.
 	if which == "partial" {
 		c.User.CSS = u.CSS

rice-box.go.REMOVED.git-id

@@ -1 +1 @@
-36b9bba06c64cd83f3994bbb77fc36948d9d2dfe
+fb04f17b945f280665365cf87b85c4f8c936b31a