'ss'

users/assets.go

@@ -0,0 +1,26 @@
+package users
+
+import (
+	"embed"
+	"strings"
+)
+
+//go:embed assets
+var assets embed.FS
+var commonPasswords map[string]struct{}
+
+//nolint:gochecknoinits
+func init() {
+	// Password list sourced from:
+	// https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/100k-most-used-passwords-NCSC.txt
+	data, err := assets.ReadFile("assets/common-passwords.txt")
+	if err != nil {
+		panic(err)
+	}
+
+	passwords := strings.Split(strings.TrimSpace(string(data)), "\n")
+	commonPasswords = make(map[string]struct{}, len(passwords))
+	for _, password := range passwords {
+		commonPasswords[strings.TrimSpace(password)] = struct{}{}
+	}
+}

users/password.go

@@ -0,0 +1,47 @@
+package users
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+
+	"golang.org/x/crypto/bcrypt"
+
+	fbErrors "github.com/filebrowser/filebrowser/v2/errors"
+)
+
+// ValidateAndHashPwd validates and hashes a password.
+func ValidateAndHashPwd(password string, minimumLength uint) (string, error) {
+	if uint(len(password)) < minimumLength {
+		return "", fbErrors.ErrShortPassword{MinimumLength: minimumLength}
+	}
+
+	if _, ok := commonPasswords[password]; ok {
+		return "", fbErrors.ErrEasyPassword
+	}
+
+	return HashPwd(password)
+}
+
+// HashPwd hashes a password.
+func HashPwd(password string) (string, error) {
+	bytes, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	return string(bytes), err
+}
+
+// CheckPwd checks if a password is correct.
+func CheckPwd(password, hash string) bool {
+	err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
+	return err == nil
+}
+
+func RandomPwd(passwordLength uint) (string, error) {
+	randomPasswordBytes := make([]byte, passwordLength)
+	var _, err = rand.Read(randomPasswordBytes)
+	if err != nil {
+		return "", err
+	}
+
+	// This is done purely to make the password human-readable
+	var randomPasswordString = base64.URLEncoding.EncodeToString(randomPasswordBytes)
+	return randomPasswordString, nil
+}

users/permissions.go

@@ -0,0 +1,13 @@
+package users
+
+// Permissions describe a user's permissions.
+type Permissions struct {
+	Admin    bool `json:"admin"`
+	Execute  bool `json:"execute"`
+	Create   bool `json:"create"`
+	Rename   bool `json:"rename"`
+	Modify   bool `json:"modify"`
+	Delete   bool `json:"delete"`
+	Share    bool `json:"share"`
+	Download bool `json:"download"`
+}

users/storage.go

@@ -0,0 +1,133 @@
+package users
+
+import (
+	"sync"
+	"time"
+
+	"github.com/filebrowser/filebrowser/v2/errors"
+)
+
+// StorageBackend is the interface to implement for a users storage.
+type StorageBackend interface {
+	GetBy(interface{}) (*User, error)
+	Gets() ([]*User, error)
+	Save(u *User) error
+	Update(u *User, fields ...string) error
+	DeleteByID(uint) error
+	DeleteByUsername(string) error
+}
+
+type Store interface {
+	Get(baseScope string, id interface{}) (user *User, err error)
+	Gets(baseScope string) ([]*User, error)
+	Update(user *User, fields ...string) error
+	Save(user *User) error
+	Delete(id interface{}) error
+	LastUpdate(id uint) int64
+}
+
+// Storage is a users storage.
+type Storage struct {
+	back    StorageBackend
+	updated map[uint]int64
+	mux     sync.RWMutex
+}
+
+// NewStorage creates a users storage from a backend.
+func NewStorage(back StorageBackend) *Storage {
+	return &Storage{
+		back:    back,
+		updated: map[uint]int64{},
+	}
+}
+
+// Get allows you to get a user by its name or username. The provided
+// id must be a string for username lookup or a uint for id lookup. If id
+// is neither, a ErrInvalidDataType will be returned.
+func (s *Storage) Get(baseScope string, id interface{}) (user *User, err error) {
+	user, err = s.back.GetBy(id)
+	if err != nil {
+		return
+	}
+	if err := user.Clean(baseScope); err != nil {
+		return nil, err
+	}
+	return
+}
+
+// Gets gets a list of all users.
+func (s *Storage) Gets(baseScope string) ([]*User, error) {
+	users, err := s.back.Gets()
+	if err != nil {
+		return nil, err
+	}
+
+	for _, user := range users {
+		if err := user.Clean(baseScope); err != nil { //nolint:govet
+			return nil, err
+		}
+	}
+
+	return users, err
+}
+
+// Update updates a user in the database.
+func (s *Storage) Update(user *User, fields ...string) error {
+	err := user.Clean("", fields...)
+	if err != nil {
+		return err
+	}
+
+	err = s.back.Update(user, fields...)
+	if err != nil {
+		return err
+	}
+
+	s.mux.Lock()
+	s.updated[user.ID] = time.Now().Unix()
+	s.mux.Unlock()
+	return nil
+}
+
+// Save saves the user in a storage.
+func (s *Storage) Save(user *User) error {
+	if err := user.Clean(""); err != nil {
+		return err
+	}
+
+	return s.back.Save(user)
+}
+
+// Delete allows you to delete a user by its name or username. The provided
+// id must be a string for username lookup or a uint for id lookup. If id
+// is neither, a ErrInvalidDataType will be returned.
+func (s *Storage) Delete(id interface{}) error {
+	switch id := id.(type) {
+	case string:
+		user, err := s.back.GetBy(id)
+		if err != nil {
+			return err
+		}
+		if user.ID == 1 {
+			return errors.ErrRootUserDeletion
+		}
+		return s.back.DeleteByUsername(id)
+	case uint:
+		if id == 1 {
+			return errors.ErrRootUserDeletion
+		}
+		return s.back.DeleteByID(id)
+	default:
+		return errors.ErrInvalidDataType
+	}
+}
+
+// LastUpdate gets the timestamp for the last update of an user.
+func (s *Storage) LastUpdate(id uint) int64 {
+	s.mux.RLock()
+	defer s.mux.RUnlock()
+	if val, ok := s.updated[id]; ok {
+		return val
+	}
+	return 0
+}

users/storage_test.go

@@ -0,0 +1,4 @@
+package users
+
+// Interface is implemented by storage
+var _ Store = &Storage{}

users/users.go

@@ -0,0 +1,105 @@
+package users
+
+import (
+	"path/filepath"
+
+	"github.com/spf13/afero"
+
+	"github.com/filebrowser/filebrowser/v2/errors"
+	"github.com/filebrowser/filebrowser/v2/files"
+	"github.com/filebrowser/filebrowser/v2/rules"
+)
+
+// ViewMode describes a view mode.
+type ViewMode string
+
+const (
+	ListViewMode   ViewMode = "list"
+	MosaicViewMode ViewMode = "mosaic"
+)
+
+// User describes a user.
+type User struct {
+	ID           uint          `storm:"id,increment" json:"id"`
+	Username     string        `storm:"unique" json:"username"`
+	Password     string        `json:"password"`
+	Scope        string        `json:"scope"`
+	Locale       string        `json:"locale"`
+	LockPassword bool          `json:"lockPassword"`
+	ViewMode     ViewMode      `json:"viewMode"`
+	SingleClick  bool          `json:"singleClick"`
+	Perm         Permissions   `json:"perm"`
+	Commands     []string      `json:"commands"`
+	Sorting      files.Sorting `json:"sorting"`
+	Fs           afero.Fs      `json:"-" yaml:"-"`
+	Rules        []rules.Rule  `json:"rules"`
+	HideDotfiles bool          `json:"hideDotfiles"`
+	DateFormat   bool          `json:"dateFormat"`
+}
+
+// GetRules implements rules.Provider.
+func (u *User) GetRules() []rules.Rule {
+	return u.Rules
+}
+
+var checkableFields = []string{
+	"Username",
+	"Password",
+	"Scope",
+	"ViewMode",
+	"Commands",
+	"Sorting",
+	"Rules",
+}
+
+// Clean cleans up a user and verifies if all its fields
+// are alright to be saved.
+//
+//nolint:gocyclo
+func (u *User) Clean(baseScope string, fields ...string) error {
+	if len(fields) == 0 {
+		fields = checkableFields
+	}
+
+	for _, field := range fields {
+		switch field {
+		case "Username":
+			if u.Username == "" {
+				return errors.ErrEmptyUsername
+			}
+		case "Password":
+			if u.Password == "" {
+				return errors.ErrEmptyPassword
+			}
+		case "ViewMode":
+			if u.ViewMode == "" {
+				u.ViewMode = ListViewMode
+			}
+		case "Commands":
+			if u.Commands == nil {
+				u.Commands = []string{}
+			}
+		case "Sorting":
+			if u.Sorting.By == "" {
+				u.Sorting.By = "name"
+			}
+		case "Rules":
+			if u.Rules == nil {
+				u.Rules = []rules.Rule{}
+			}
+		}
+	}
+
+	if u.Fs == nil {
+		scope := u.Scope
+		scope = filepath.Join(baseScope, filepath.Join("/", scope)) //nolint:gocritic
+		u.Fs = afero.NewBasePathFs(afero.NewOsFs(), scope)
+	}
+
+	return nil
+}
+
+// FullPath gets the full path for a user's relative path.
+func (u *User) FullPath(path string) string {
+	return afero.FullBaseFsPath(u.Fs.(*afero.BasePathFs), path)
+}