diff --git a/appinfo/routes.php b/appinfo/routes.php index 2d02f93..397843e 100644 --- a/appinfo/routes.php +++ b/appinfo/routes.php @@ -2,10 +2,10 @@ return [ 'routes' => [ - ['name' => 'pubPage#getByToken', 'url' => '/s/{token}', 'verb' => 'GET'], - ['name' => 'pubPage#getByTokenAndPath', 'url' => '/s/{token}/{path}', 'verb' => 'GET', + ['name' => 'pubPage#getByToken', 'url' => '/s/{token}'], + ['name' => 'pubPage#getByTokenAndPath', 'url' => '/s/{token}/{path}', 'requirements' => array('path' => '.+')], - ['name' => 'privatePage#getByPath', 'url' => '/files/{path}', 'verb' => 'GET', + ['name' => 'privatePage#getByPath', 'url' => '/files/{path}', 'requirements' => array('path' => '.+')], ] ]; diff --git a/lib/Controller/PrivatePageController.php b/lib/Controller/PrivatePageController.php index e9b4957..c87dd2c 100644 --- a/lib/Controller/PrivatePageController.php +++ b/lib/Controller/PrivatePageController.php @@ -36,8 +36,6 @@ class PrivatePageController extends Controller { } catch (NotFoundException $e) { return new NotFoundResponse(); } - $content = $node->getContent(); - $mimetype = $node->getMimeType(); - $this->returnRawResponse($content, $mimetype); + $this->returnRawResponse($node); } } diff --git a/lib/Controller/PubPageController.php b/lib/Controller/PubPageController.php index 284d5ef..8798cf2 100644 --- a/lib/Controller/PubPageController.php +++ b/lib/Controller/PubPageController.php @@ -5,12 +5,13 @@ use \Exception; use OCP\IRequest; use OCP\Share\IManager; use OCP\AppFramework\Controller; -use OCP\Files\Folder; +use OCP\AppFramework\Http\NotFoundResponse; +use OCP\Files\NotFoundException; class PubPageController extends Controller { use RawResponse; - private $manager; + private $shareManager; public function __construct( $AppName, @@ -18,7 +19,7 @@ class PubPageController extends Controller { IManager $shareManager ) { parent::__construct($AppName, $request); - $this->manager = $shareManager; + $this->shareManager = $shareManager; } /** @@ -27,15 +28,9 @@ class PubPageController extends Controller { * @NoCSRFRequired */ public function getByToken($token) { - $share = $this->manager->getShareByToken($token); + $share = $this->shareManager->getShareByToken($token); $node = $share->getNode(); - if ($node->getType() === 'dir') { - // Is there some reasonable thing to return for a directory? An html index? A tarball? - throw new Exception("Requested share is a directory, not a file."); - } - $content = $node->getContent(); - $mimetype = $node->getMimeType(); - $this->returnRawResponse($content, $mimetype); + $this->returnRawResponse($node); } /** @@ -44,18 +39,16 @@ class PubPageController extends Controller { * @NoCSRFRequired */ public function getByTokenAndPath($token, $path) { - $share = $this->manager->getShareByToken($token); + $share = $this->shareManager->getShareByToken($token); $dirNode = $share->getNode(); if ($dirNode->getType() !== 'dir') { throw new Exception("Received a sub-path for a share that is not a directory"); } - $fileNode = $dirNode->get($path); - if ($fileNode->getType() === 'dir') { - // Is there some reasonable thing to return for a directory? An html index? A tarball? - throw new Exception("Requested share is a directory, not a file."); + try { + $fileNode = $dirNode->get($path); + } catch (NotFoundException $e) { + return new NotFoundResponse(); } - $content = $fileNode->getContent(); - $mimetype = $fileNode->getMimeType(); - $this->returnRawResponse($content, $mimetype); + $this->returnRawResponse($fileNode); } } diff --git a/lib/Controller/RawResponse.php b/lib/Controller/RawResponse.php index fee38a3..e7b10e7 100644 --- a/lib/Controller/RawResponse.php +++ b/lib/Controller/RawResponse.php @@ -1,8 +1,18 @@ getType() === 'dir') { + // Is there some reasonable thing to return for a directory? An html index? A tarball? + throw new Exception("Requested share is a directory, not a file."); + } + + $content = $fileNode->getContent(); + $mimetype = $fileNode->getMimeType(); + // Ugly hack to prevent security middleware messing up the CSP. header( "Content-Security-Policy: sandbox; default-src 'none'; img-src data:; media-src data:; "