mirror of
https://github.com/filebrowser/filebrowser.git
synced 2026-07-25 08:54:13 +00:00
8ddd3d1db9
Proxy- and hook-authenticated users were auto-provisioned by applying the
default scope (".") and passing it straight to MakeUserDir, which normalizes
"." to "/". With CreateUserDir enabled, every provisioned user therefore
received the server root as its scope instead of a per-user home directory,
letting one user read, overwrite and delete another user's files.
The signup handler already cleared the scope before deriving the home
directory. Centralize that logic into Settings.CreateUserHome (clear the
scope when CreateUserDir is on and no explicit scope was supplied, derive the
home dir, then reject a scope already owned by another user) and use it from
signup, proxy and hook auth so the three provisioning paths cannot diverge.
Refs GHSA-j7jh-37pf-mf8h, GHSA-j2fc-28fx-hc8q
67 lines
1.8 KiB
Go
67 lines
1.8 KiB
Go
package auth
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
|
|
fberrors "github.com/filebrowser/filebrowser/v2/errors"
|
|
"github.com/filebrowser/filebrowser/v2/settings"
|
|
"github.com/filebrowser/filebrowser/v2/users"
|
|
)
|
|
|
|
// MethodProxyAuth is used to identify no auth.
|
|
const MethodProxyAuth settings.AuthMethod = "proxy"
|
|
|
|
// ProxyAuth is a proxy implementation of an auther.
|
|
type ProxyAuth struct {
|
|
Header string `json:"header"`
|
|
}
|
|
|
|
// Auth authenticates the user via an HTTP header.
|
|
func (a ProxyAuth) Auth(r *http.Request, usr users.Store, setting *settings.Settings, srv *settings.Server) (*users.User, error) {
|
|
username := r.Header.Get(a.Header)
|
|
user, err := usr.Get(srv.Root, srv.FollowExternalSymlinks, username)
|
|
if errors.Is(err, fberrors.ErrNotExist) {
|
|
return a.createUser(usr, setting, srv, username)
|
|
}
|
|
return user, err
|
|
}
|
|
|
|
func (a ProxyAuth) createUser(usr users.Store, setting *settings.Settings, srv *settings.Server, username string) (*users.User, error) {
|
|
const randomPasswordLength = settings.DefaultMinimumPasswordLength + 10
|
|
pwd, err := users.RandomPwd(randomPasswordLength)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
var hashedRandomPassword string
|
|
hashedRandomPassword, err = users.ValidateAndHashPwd(pwd, setting.MinimumPasswordLength)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
user := &users.User{
|
|
Username: username,
|
|
Password: hashedRandomPassword,
|
|
LockPassword: true,
|
|
}
|
|
setting.Defaults.Apply(user)
|
|
user.Perm.Admin = false
|
|
user.Perm.Execute = false
|
|
user.Commands = []string{}
|
|
|
|
if err = setting.CreateUserHome(user, usr, srv.Root, false); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if err = usr.Save(user); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return user, nil
|
|
}
|
|
|
|
// LoginPage tells that proxy auth doesn't require a login page.
|
|
func (a ProxyAuth) LoginPage() bool {
|
|
return false
|
|
}
|