filebrowser/http
Henrique Dias 0b925cbca9
fix: unblock stalled and frozen uploads
A TUS PATCH rejected before its body was read left the client still streaming
a chunk. net/http gives up draining an unread request body after 256KiB and
then closes the connection, so the status we replied with was lost and the
browser saw a bare transport error instead. The client could not tell a
conflict from a network fault, retried blindly, and the upload stalled after
the first chunk — while curl, which reads the response as it writes, still
reported the status and appeared to work. Drain what is left of a rejected
chunk so the answer arrives on a connection that stays usable. The explicit
r.Body.Close() had to go with it: it ran before the drain, and the server
closes the request body itself once the handler returns.

Pressing Upload awaited a recursive listing of the whole destination subtree
before a single byte was sent, with no sign that anything was happening. On a
large destination that reads as a dead button, and the walk kept running after
the client gave up, then reported the failed write as a 500. A flat upload can
only collide with a direct child of the destination, so walk recursively only
for folder uploads, stop the walk once the request is done, and show the action
as busy while the destination is checked.

Along the way: a failed upload was credited as fully sent, so the progress bar
reported 100% when nothing had been written; the progress timer was recreated
without clearing the previous one; and the chunk size field threw on a value
with no unit and raced its own debounce on submit, so it appeared to refuse
every change.

Fixes #6006
Refs #5987
2026-07-27 16:28:17 +02:00
..
auth.go fix(http): canonicalize paths before checking access rules (#6045) 2026-07-26 10:00:18 +02:00
auth_test.go fix(auth): reject signup when normalized home dir collides (GHSA-7rc3-g7h6-22m7) 2026-06-27 09:08:56 +02:00
commands.go refactor: cleanup package names (#5605) 2025-12-06 10:52:11 +01:00
data.go fix(http): canonicalize paths before checking access rules (#6045) 2026-07-26 10:00:18 +02:00
headers.go refactor: cleanup package names (#5605) 2025-12-06 10:52:11 +01:00
http.go fix(http): canonicalize paths before checking access rules (#6045) 2026-07-26 10:00:18 +02:00
preview.go fix(http): canonicalize paths before checking access rules (#6045) 2026-07-26 10:00:18 +02:00
preview_enum.go refactor: cleanup package names (#5605) 2025-12-06 10:52:11 +01:00
public.go fix(http): canonicalize paths before checking access rules (#6045) 2026-07-26 10:00:18 +02:00
public_symlink_test.go fix: restore symlink behavior as opt-in followExternalSymlinks 2026-06-23 13:19:51 +02:00
public_test.go fix: restore symlink behavior as opt-in followExternalSymlinks 2026-06-23 13:19:51 +02:00
raw.go fix(http): canonicalize paths before checking access rules (#6045) 2026-07-26 10:00:18 +02:00
raw_test.go fix(raw): neutralize backslashes in archive entry names (GHSA-83xp-526h-j3ww) 2026-06-27 08:39:14 +02:00
resource.go fix: unblock stalled and frozen uploads 2026-07-27 16:28:17 +02:00
resource_checksum_test.go test(http): cover download-permission gate on the checksum branch 2026-07-25 08:16:19 +02:00
resource_recursive_test.go fix: unblock stalled and frozen uploads 2026-07-27 16:28:17 +02:00
resource_test.go fix(http): run upload hooks for directories (#6034) 2026-07-17 20:14:41 +02:00
rules_path_test.go fix(http): canonicalize paths before checking access rules (#6045) 2026-07-26 10:00:18 +02:00
search.go feat: support streaming response for search results (#5630) 2025-12-28 21:57:25 +01:00
settings.go fix: request a password to change sensitive user data (#5629) 2026-01-03 08:44:03 +01:00
share.go fix(share): stop exposing password hash and bypass token in share API (GHSA-833g-cqhp-h72j) 2026-06-27 09:08:56 +02:00
share_test.go fix(share): stop exposing password hash and bypass token in share API (GHSA-833g-cqhp-h72j) 2026-06-27 09:08:56 +02:00
static.go fix: accessibility and security improvements (#6033) 2026-07-25 07:30:02 +02:00
subtitle.go fix: preserve SRT subtitle line breaks (#6002) 2026-06-27 07:28:55 +02:00
subtitle_test.go fix: preserve SRT subtitle line breaks (#6002) 2026-06-27 07:28:55 +02:00
tus_handlers.go fix: unblock stalled and frozen uploads 2026-07-27 16:28:17 +02:00
tus_multichunk_test.go fix: unblock stalled and frozen uploads 2026-07-27 16:28:17 +02:00
tus_symlink_test.go refactor: ScopedFs to avoid escaping symlinks 2026-06-07 18:16:46 +02:00
tus_upload_length_test.go test(http): cover TUS Upload-Length enforcement 2026-07-25 08:16:19 +02:00
upload_cache_memory.go fix(http): delete abandoned TUS uploads through the scoped filesystem 2026-07-25 08:16:18 +02:00
upload_cache_memory_test.go test(http): cover scope-safe removal on TUS upload eviction 2026-07-25 08:16:19 +02:00
upload_cache_redis.go fix(http): delete abandoned TUS uploads through the scoped filesystem 2026-07-25 08:16:18 +02:00
users.go fix: restore symlink behavior as opt-in followExternalSymlinks 2026-06-23 13:19:51 +02:00
utils.go fix: unblock stalled and frozen uploads 2026-07-27 16:28:17 +02:00
utils_test.go fix(http): canonicalize paths before checking access rules (#6045) 2026-07-26 10:00:18 +02:00