modify some errors and be consistent with pro edition

server/http-status-codes.h

@@ -3,6 +3,7 @@
 
 /* Seafile specific http status codes. */
 
+#define SEAF_HTTP_RES_FORBIDDEN 403
 #define SEAF_HTTP_RES_BADFILENAME 440
 #define SEAF_HTTP_RES_EXISTS 441
 #define SEAF_HTTP_RES_NOT_EXISTS 441

server/upload-file.c

@@ -42,6 +42,7 @@ enum UploadError {
     ERROR_NOT_EXIST,
     ERROR_SIZE,
     ERROR_QUOTA,
+    ERROR_FORBIDDEN,
     ERROR_RECV,
     ERROR_BLOCK_MISSING,
     ERROR_INTERNAL,
@@ -59,7 +60,6 @@ typedef struct RecvFSM {
     char *user;
     char *boundary;        /* boundary of multipart form-data. */
     char *input_name;      /* input name of the current form field. */
-    gboolean is_parent_dir;
     char *parent_dir;
     evbuf_t *line;          /* buffer for a line */
 
@@ -292,7 +292,7 @@ check_parent_dir (evhtp_request_t *req, const char *repo_id,
 
 static gboolean
 is_parent_matched (const char *upload_dir,
-                     const char *parent_dir)
+                   const char *parent_dir)
 {
     gboolean ret = TRUE;
     char *upload_dir_canon = NULL;
@@ -302,7 +302,7 @@ is_parent_matched (const char *upload_dir,
     parent_dir_canon = get_canonical_path (parent_dir);
 
     if (strcmp (upload_dir_canon,parent_dir_canon) != 0) {
-	    ret = FALSE;
+        ret = FALSE;
     }
 
     g_free (upload_dir_canon);
@@ -501,9 +501,9 @@ upload_api_cb(evhtp_request_t *req, void *arg)
     if (!check_parent_dir (req, fsm->repo_id, parent_dir))
         goto out;
 
-    if (!fsm->is_parent_dir || !is_parent_matched (fsm->parent_dir, parent_dir)){
+    if (!fsm->parent_dir || !is_parent_matched (fsm->parent_dir, parent_dir)){
-        send_error_reply (req, EVHTP_RES_FORBIDDEN, "Invalid parent dir.\n");
+        error_code = ERROR_FORBIDDEN;
-        goto out;
+        goto error;
     }
 
     if (!check_tmp_file_list (fsm->files, &error_code))
@@ -605,6 +605,9 @@ error:
     case ERROR_QUOTA:
         send_error_reply (req, SEAF_HTTP_RES_NOQUOTA, "Out of quota.\n");
         break;
+    case ERROR_FORBIDDEN:
+        send_error_reply (req, SEAF_HTTP_RES_FORBIDDEN, "Permission denied.");
+        break;
     case ERROR_RECV:
     case ERROR_INTERNAL:
         send_error_reply (req, EVHTP_RES_SERVERR, "Internal error\n");
@@ -1169,9 +1172,10 @@ upload_ajax_cb(evhtp_request_t *req, void *arg)
 
     if (!check_parent_dir (req, fsm->repo_id, parent_dir))
         goto out;
-    if (!fsm->is_parent_dir || !is_parent_matched (fsm->parent_dir, parent_dir)){
+
-        send_error_reply (req, EVHTP_RES_FORBIDDEN, "Invalid parent dir.\n");
+    if (!fsm->parent_dir || !is_parent_matched (fsm->parent_dir, parent_dir)){
-        goto out;
+        error_code = ERROR_FORBIDDEN;
+        goto error;
     }
 
     if (!check_tmp_file_list (fsm->files, &error_code))
@@ -1266,6 +1270,9 @@ error:
     case ERROR_QUOTA:
         send_error_reply (req, SEAF_HTTP_RES_NOQUOTA, "Out of quota.");
         break;
+    case ERROR_FORBIDDEN:
+        send_error_reply (req, SEAF_HTTP_RES_FORBIDDEN, "Permission denied.");
+        break;
     case ERROR_RECV:
     case ERROR_INTERNAL:
         send_error_reply (req, EVHTP_RES_SERVERR, "Internal error.\n");
@@ -2370,40 +2377,20 @@ get_boundary (evhtp_headers_t *hdr)
     return boundary;
 }
 
-static gboolean
-get_parent_dir_from_obj_id(const char *obj_id, char **parent_dir, gboolean *is_parent_dir){
-    const char *_parent_dir = NULL;
-    json_t *object;
-    json_error_t err;
-
-    object = json_loads(obj_id,0,&err);
-    if (!object) {
-        return FALSE;
-    }
-    _parent_dir = json_object_get_string_member (object, "parent_dir");
-
-    if (_parent_dir){
-        *parent_dir = g_strdup(_parent_dir);
-        *is_parent_dir = TRUE;
-    }
-    json_decref (object);
-
-    return TRUE;
-}
-
 static int
 check_access_token (const char *token,
                     const char *url_op,
                     char **repo_id,
                     char **parent_dir,
                     char **user,
-                    char **token_type,
+                    char **token_type)
-                    gboolean *is_parent_dir)
 {
     SeafileWebAccess *webaccess;
     const char *op;
     const char *_repo_id;
     const char *_obj_id;
+    const char *_parent_dir;
+    json_t *parent_dir_json;
 
     webaccess = (SeafileWebAccess *)
         seaf_web_at_manager_query_access_token (seaf->web_at_mgr, token);
@@ -2417,9 +2404,6 @@ check_access_token (const char *token,
         return -1;
     }
 
-    _obj_id = seafile_web_access_get_obj_id(webaccess);
-    get_parent_dir_from_obj_id (_obj_id, parent_dir, is_parent_dir);
-
     /* token with op = "upload" can only be used for "upload-*" operations;
      * token with op = "update" can only be used for "update-*" operations.
      */
@@ -2438,6 +2422,17 @@ check_access_token (const char *token,
     *repo_id = g_strdup (_repo_id);
     *user = g_strdup (seafile_web_access_get_username (webaccess));
 
+    _obj_id  = seafile_web_access_get_obj_id (webaccess);
+    parent_dir_json = json_loadb (_obj_id, strlen (_obj_id), 0, NULL);
+    if (parent_dir_json) {
+        _parent_dir = json_object_get_string_member (parent_dir_json, "parent_dir");
+        
+        if (_parent_dir){
+            *parent_dir = g_strdup(_parent_dir);
+        }
+        json_decref (parent_dir_json);
+    }
+
     g_object_unref (webaccess);
 
     return 0;
@@ -2531,7 +2526,6 @@ upload_headers_cb (evhtp_request_t *req, evhtp_headers_t *hdr, void *arg)
     char *token_type = NULL;
     RecvFSM *fsm = NULL;
     Progress *progress = NULL;
-    gboolean is_parent_dir = FALSE;
 
     if (evhtp_request_get_method(req) == htp_method_OPTIONS) {
          return EVHTP_RES_OK;
@@ -2552,7 +2546,7 @@ upload_headers_cb (evhtp_request_t *req, evhtp_headers_t *hdr, void *arg)
     }
     char *url_op = parts[0];
 
-    if (check_access_token (token, url_op, &repo_id, &parent_dir, &user, &token_type, &is_parent_dir) < 0) {
+    if (check_access_token (token, url_op, &repo_id, &parent_dir, &user, &token_type) < 0) {
         err_msg = "Access denied";
         goto err;
     }
@@ -2588,7 +2582,6 @@ upload_headers_cb (evhtp_request_t *req, evhtp_headers_t *hdr, void *arg)
     fsm->boundary = boundary;
     fsm->repo_id = repo_id;
     fsm->parent_dir = parent_dir;
-    fsm->is_parent_dir = is_parent_dir;
     fsm->user = user;
     fsm->token_type = token_type;
     fsm->rstart = rstart;

tests/test_file_operation/test_upload_and_update.py

@@ -71,6 +71,21 @@ def assert_update_response(response, is_json):
         new_file_id = response.text
         assert len(new_file_id) == 40 and new_file_id != file_id
 
+def request_resumable_upload(filepath, headers,upload_url_base,parent_dir,is_ajax):
+    write_file(chunked_part1_path, chunked_part1_content)
+    write_file(chunked_part2_path, chunked_part2_content)
+
+    files = {'file': open(filepath, 'rb'),
+             'parent_dir':parent_dir}
+    params = {'ret-json':'1'}
+    if is_ajax:
+        response = requests.post(upload_url_base, headers = headers,
+                             files = files)
+    else:
+        response = requests.post(upload_url_base, headers = headers,
+                             files = files, params = params)
+    return response
+
 def write_file(file_path, file_content):
     fp = open(file_path, 'w')
     fp.write(file_content)
@@ -148,18 +163,11 @@ def test_ajax(repo):
     assert_upload_response(response, False, True)
 
     #test resumable upload file to test dir
-    write_file(chunked_part1_path, chunked_part1_content)
+    parent_dir = '/test'
-    write_file(chunked_part2_path, chunked_part2_content)
-
-    token = api.get_fileserver_access_token(repo.id, obj_id,
-                                            'upload', USER, False)
     headers = {'Content-Range':'bytes 0-{}/{}'.format(str(len(chunked_part1_content) - 1),
                                                       str(total_size)),
                'Content-Disposition':'attachment; filename=\"{}\"'.format(resumable_file_name)}
-    files = {'file': open(chunked_part1_path, 'rb'),
+    response = request_resumable_upload(chunked_part1_path, headers, upload_url_base, parent_dir, True)
-             'parent_dir':'/test'}
-    response = requests.post(upload_url_base, headers = headers,
-                             files = files)
     assert_resumable_upload_response(response, repo.id,
                                      resumable_test_file_name, False)
 
@@ -167,25 +175,15 @@ def test_ajax(repo):
                                                        str(total_size - 1),
                                                        str(total_size)),
                'Content-Disposition':'attachment; filename=\"{}\"'.format(resumable_file_name)}
-    files = {'file': open(chunked_part2_path, 'rb'),
+    response = request_resumable_upload(chunked_part2_path, headers, upload_url_base, parent_dir, True)
-             'parent_dir':'/test'}
-    response = requests.post(upload_url_base, headers = headers,
-                             files = files)
     assert response.status_code == 403
 
     #test resumable upload file to root dir
-    write_file(chunked_part1_path, chunked_part1_content)
+    parent_dir = '/'
-    write_file(chunked_part2_path, chunked_part2_content)
-
-    token = api.get_fileserver_access_token(repo.id, obj_id,
-                                            'upload', USER, False)
     headers = {'Content-Range':'bytes 0-{}/{}'.format(str(len(chunked_part1_content) - 1),
                                                       str(total_size)),
                'Content-Disposition':'attachment; filename=\"{}\"'.format(resumable_file_name)}
-    files = {'file': open(chunked_part1_path, 'rb'),
+    response = request_resumable_upload(chunked_part1_path, headers, upload_url_base, parent_dir, True)
-             'parent_dir':'/'}
-    response = requests.post(upload_url_base, headers = headers,
-                             files = files)
     assert_resumable_upload_response(response, repo.id,
                                      resumable_file_name, False)
 
@@ -193,10 +191,9 @@ def test_ajax(repo):
                                                        str(total_size - 1),
                                                        str(total_size)),
                'Content-Disposition':'attachment; filename=\"{}\"'.format(resumable_file_name)}
-    files = {'file': open(chunked_part2_path, 'rb'),
-             'parent_dir':'/'}
     response = requests.post(upload_url_base, headers = headers,
                              files = files)
+    response = request_resumable_upload(chunked_part2_path, headers, upload_url_base, parent_dir, True)
     assert_resumable_upload_response(response, repo.id,
                                      resumable_file_name, True)
 
@@ -316,18 +313,11 @@ def test_api(repo):
     assert_upload_response(response, False, True)
 
     #test resumable upload file to test
-    write_file(chunked_part1_path, chunked_part1_content)
+    parent_dir = '/test'
-    write_file(chunked_part2_path, chunked_part2_content)
-
-    token = api.get_fileserver_access_token(repo.id, obj_id,
-                                            'upload', USER, False)
     headers = {'Content-Range':'bytes 0-{}/{}'.format(str(len(chunked_part1_content) - 1),
                                                       str(total_size)),
                'Content-Disposition':'attachment; filename=\"{}\"'.format(resumable_file_name)}
-    files = {'file': open(chunked_part1_path, 'rb'),
+    response = request_resumable_upload(chunked_part1_path, headers, upload_url_base, parent_dir, False)
-             'parent_dir':'/test'}
-    response = requests.post(upload_url_base, headers = headers,
-                             files = files, params = params)
     assert_resumable_upload_response(response, repo.id,
                                      resumable_test_file_name, False)
 
@@ -335,25 +325,15 @@ def test_api(repo):
                                                        str(total_size - 1),
                                                        str(total_size)),
                'Content-Disposition':'attachment; filename=\"{}\"'.format(resumable_file_name)}
-    files = {'file': open(chunked_part2_path, 'rb'),
+    response = request_resumable_upload(chunked_part2_path, headers, upload_url_base, parent_dir, False)
-             'parent_dir':'/test'}
-    response = requests.post(upload_url_base, headers = headers,
-                             files = files, params = params)
     assert response.status_code == 403
 
     #test resumable upload file to root dir
-    write_file(chunked_part1_path, chunked_part1_content)
+    parent_dir = '/'
-    write_file(chunked_part2_path, chunked_part2_content)
-
-    token = api.get_fileserver_access_token(repo.id, obj_id,
-                                            'upload', USER, False)
     headers = {'Content-Range':'bytes 0-{}/{}'.format(str(len(chunked_part1_content) - 1),
                                                       str(total_size)),
                'Content-Disposition':'attachment; filename=\"{}\"'.format(resumable_file_name)}
-    files = {'file': open(chunked_part1_path, 'rb'),
+    response = request_resumable_upload(chunked_part1_path,headers, upload_url_base,parent_dir, False)
-             'parent_dir':'/'}
-    response = requests.post(upload_url_base, headers = headers,
-                             files = files, params = params)
     assert_resumable_upload_response(response, repo.id,
                                      resumable_file_name, False)
 
@@ -361,10 +341,7 @@ def test_api(repo):
                                                        str(total_size - 1),
                                                        str(total_size)),
                'Content-Disposition':'attachment; filename=\"{}\"'.format(resumable_file_name)}
-    files = {'file': open(chunked_part2_path, 'rb'),
+    response = request_resumable_upload(chunked_part2_path, headers, upload_url_base, parent_dir, False)
-             'parent_dir':'/'}
-    response = requests.post(upload_url_base, headers = headers,
-                             files = files, params = params)
     assert_resumable_upload_response(response, repo.id,
                                      resumable_file_name, True)