notazof/yavsc
1
1
Fork 0
Code Issues 1 Pull requests 1 Projects 2 Releases 9 Packages Wiki Activity Actions

Files management

Browse source 
* implements file & dir deletion & moving API
* validates pathes usage
This commit is contained in:
Paul Schneider 2019-09-05 15:13:10 +01:00
commit 9a29f94e51
1 changed files with 15 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

26
src/Yavsc/ApiControllers/Blogspot/FileSystemApiController.cs
View file

@ -14,6 +14,7 @@ namespace Yavsc.ApiControllers
using Yavsc.Exceptions; using Yavsc.Exceptions;
using Yavsc.Models.FileSystem; using Yavsc.Models.FileSystem;
using System.ComponentModel.DataAnnotations; using System.ComponentModel.DataAnnotations;
using Yavsc.Attributes.Validation;
[Authorize,Route("api/fs")] [Authorize,Route("api/fs")]
public class FileSystemApiController : Controller public class FileSystemApiController : Controller
@ -39,20 +40,18 @@ namespace Yavsc.ApiControllers
} }
[HttpGet("{*subdir}")] [HttpGet("{*subdir}")]
public IActionResult GetDir(string subdir="") public IActionResult GetDir([ValidRemoteUserFilePath] string subdir="")
{ {
if (subdir !=null) if (!ModelState.IsValid) return new BadRequestObjectResult(ModelState);
if (!subdir.IsValidYavscPath())
return new BadRequestResult();
// _logger.LogInformation($"listing files from {User.Identity.Name}{subdir}"); // _logger.LogInformation($"listing files from {User.Identity.Name}{subdir}");
var files = AbstractFileSystemHelpers.GetUserFiles(User.Identity.Name, subdir); var files = AbstractFileSystemHelpers.GetUserFiles(User.Identity.Name, subdir);
return Ok(files); return Ok(files);
} }
[HttpPost("{*subdir}")] [HttpPost("{*subdir}")]
public IActionResult Post(string subdir="") public IActionResult Post([ValidRemoteUserFilePath] string subdir="")
{ {
if (!ModelState.IsValid) return new BadRequestObjectResult(ModelState);
string destDir = null; string destDir = null;
List<FileRecievedInfo> received = new List<FileRecievedInfo>(); List<FileRecievedInfo> received = new List<FileRecievedInfo>();
InvalidPathException pathex = null; InvalidPathException pathex = null;
@ -92,9 +91,10 @@ namespace Yavsc.ApiControllers
public IActionResult AddQuota(string uname, int len) public IActionResult AddQuota(string uname, int len)
{ {
var uid = User.GetUserId(); var uid = User.GetUserId();
var user = dbContext.Users.Single( var user = dbContext.Users.FirstOrDefault(
u => u.UserName == uname u => u.UserName == uname
); );
if (user==null) return new BadRequestObjectResult(new { error = "no such use" });
user.AddQuota(len); user.AddQuota(len);
dbContext.SaveChanges(uid); dbContext.SaveChanges(uid);
return Ok(len); return Ok(len);
@ -102,8 +102,9 @@ namespace Yavsc.ApiControllers
[Route("/api/fsc/movefile")] [Route("/api/fsc/movefile")]
[Authorize()] [Authorize()]
public IActionResult MoveFile(string from, string to) public IActionResult MoveFile([ValidRemoteUserFilePath] string from, [ValidRemoteUserFilePath] string to)
{ {
if (!ModelState.IsValid) return new BadRequestObjectResult(ModelState);
var uid = User.GetUserId(); var uid = User.GetUserId();
var user = dbContext.Users.Single( var user = dbContext.Users.Single(
u => u.Id == uid u => u.Id == uid
@ -117,8 +118,9 @@ namespace Yavsc.ApiControllers
[HttpPatch] [HttpPatch]
[Route("/api/fsc/movedir")] [Route("/api/fsc/movedir")]
[Authorize()] [Authorize()]
public IActionResult MoveDir(string from, string to) public IActionResult MoveDir([ValidRemoteUserFilePath] string from,[ValidRemoteUserFilePath] string to)
{ {
if (!ModelState.IsValid) return new BadRequestObjectResult(ModelState);
var uid = User.GetUserId(); var uid = User.GetUserId();
var user = dbContext.Users.Single( var user = dbContext.Users.Single(
u => u.Id == uid u => u.Id == uid
@ -142,8 +144,9 @@ namespace Yavsc.ApiControllers
[HttpDelete] [HttpDelete]
[Route("/api/fsc/rm/{*id}")] [Route("/api/fsc/rm/{*id}")]
public async Task <IActionResult> Delete (string id) public async Task <IActionResult> Delete ([ValidRemoteUserFilePath] string id)
{ {
if (!ModelState.IsValid) return new BadRequestObjectResult(ModelState);
var user = dbContext.Users.Single( var user = dbContext.Users.Single(
u => u.Id == User.GetUserId() u => u.Id == User.GetUserId()
); );
@ -164,8 +167,9 @@ namespace Yavsc.ApiControllers
[HttpDelete] [HttpDelete]
[Route("/api/fsc/rmdir/{*id}")] [Route("/api/fsc/rmdir/{*id}")]
public IActionResult RemoveDir (string id) public IActionResult RemoveDir ([ValidRemoteUserFilePath] string id)
{ {
if (!ModelState.IsValid) return new BadRequestObjectResult(ModelState);
var user = dbContext.Users.Single( var user = dbContext.Users.Single(
u => u.Id == User.GetUserId() u => u.Id == User.GetUserId()
); );