move filetransfer to locks.

server/internal/http/http.go

@@ -105,70 +105,77 @@ func New(conf *config.Server, webSocketHandler types.WebSocketHandler, desktop t
 		}
 	})
 
-	router.Get("/file", func(w http.ResponseWriter, r *http.Request) {
-		password := r.URL.Query().Get("pwd")
-		isAuthorized, err := webSocketHandler.CanTransferFiles(password)
-		if err != nil {
-			http.Error(w, err.Error(), http.StatusForbidden)
-			return
-		}
-
-		if !isAuthorized {
-			http.Error(w, "bad authorization", http.StatusUnauthorized)
-			return
-		}
-
-		filename := r.URL.Query().Get("filename")
-		badChars, _ := regexp.MatchString(`(?m)\.\.(?:\/|$)`, filename)
-		if filename == "" || badChars {
-			http.Error(w, "bad filename", http.StatusBadRequest)
-			return
-		}
-
-		path := webSocketHandler.MakeFilePath(filename)
-		f, err := os.Open(path)
-		if err != nil {
-			http.Error(w, "not found or unable to open", http.StatusNotFound)
-			return
-		}
-		defer f.Close()
-
-		w.Header().Set("Content-Type", "application/octet-stream")
-		w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", filename))
-		io.Copy(w, f)
-	})
-
-	router.Post("/file", func(w http.ResponseWriter, r *http.Request) {
-		password := r.URL.Query().Get("pwd")
-		isAuthorized, err := webSocketHandler.CanTransferFiles(password)
-		if err != nil {
-			http.Error(w, err.Error(), http.StatusForbidden)
-			return
-		}
-
-		if !isAuthorized {
-			http.Error(w, "bad authorization", http.StatusUnauthorized)
-			return
-		}
-
-		r.ParseMultipartForm(32 << 20)
-		for _, formheader := range r.MultipartForm.File["files"] {
-			formfile, err := formheader.Open()
+	// allow downloading and uploading files
+	if webSocketHandler.FileTransferEnabled() {
+		router.Get("/file", func(w http.ResponseWriter, r *http.Request) {
+			password := r.URL.Query().Get("pwd")
+			isAuthorized, err := webSocketHandler.CanTransferFiles(password)
 			if err != nil {
-				logger.Warn().Err(err).Msg("failed to open formdata file")
-				http.Error(w, "error writing file", http.StatusInternalServerError)
+				http.Error(w, err.Error(), http.StatusForbidden)
 				return
 			}
-			defer formfile.Close()
-			f, err := os.OpenFile(webSocketHandler.MakeFilePath(formheader.Filename), os.O_WRONLY|os.O_CREATE, 0644)
+
+			if !isAuthorized {
+				http.Error(w, "bad authorization", http.StatusUnauthorized)
+				return
+			}
+
+			filename := r.URL.Query().Get("filename")
+			badChars, _ := regexp.MatchString(`(?m)\.\.(?:\/|$)`, filename)
+			if filename == "" || badChars {
+				http.Error(w, "bad filename", http.StatusBadRequest)
+				return
+			}
+
+			filePath := webSocketHandler.FileTransferPath(filename)
+			f, err := os.Open(filePath)
 			if err != nil {
-				http.Error(w, "unable to open file for writing", http.StatusInternalServerError)
+				http.Error(w, "not found or unable to open", http.StatusNotFound)
 				return
 			}
 			defer f.Close()
-			io.Copy(f, formfile)
-		}
-	})
+
+			w.Header().Set("Content-Type", "application/octet-stream")
+			w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%q", filename))
+			io.Copy(w, f)
+		})
+
+		router.Post("/file", func(w http.ResponseWriter, r *http.Request) {
+			password := r.URL.Query().Get("pwd")
+			isAuthorized, err := webSocketHandler.CanTransferFiles(password)
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusForbidden)
+				return
+			}
+
+			if !isAuthorized {
+				http.Error(w, "bad authorization", http.StatusUnauthorized)
+				return
+			}
+
+			r.ParseMultipartForm(32 << 20)
+			for _, formheader := range r.MultipartForm.File["files"] {
+				filePath := webSocketHandler.FileTransferPath(formheader.Filename)
+
+				formfile, err := formheader.Open()
+				if err != nil {
+					logger.Warn().Err(err).Msg("failed to open formdata file")
+					http.Error(w, "error writing file", http.StatusInternalServerError)
+					return
+				}
+				defer formfile.Close()
+
+				f, err := os.OpenFile(filePath, os.O_WRONLY|os.O_CREATE, 0644)
+				if err != nil {
+					http.Error(w, "unable to open file for writing", http.StatusInternalServerError)
+					return
+				}
+				defer f.Close()
+
+				io.Copy(f, formfile)
+			}
+		})
+	}
 
 	router.Get("/health", func(w http.ResponseWriter, r *http.Request) {
 		_, _ = w.Write([]byte("true"))