bbs.profullstack/agentbbs
1
0
Fork 0
mirror of https://github.com/profullstack/agentbbs.git synced 2026-08-14 14:57:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Require POST for file web mutations

Browse source
This commit is contained in:
Luna Ops 2026-07-07 06:28:36 +08:00
parent 9d0c0a0193
commit 9f18e13199
2 changed files with 50 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

18
internal/files/web.go
View file

@ -231,6 +231,9 @@ func (h *webSrv) handleDownload(w http.ResponseWriter, r *http.Request) {
}
func (h *webSrv) handleUpload(w http.ResponseWriter, r *http.Request) {
if !requirePost(w, r) {
return
}
sess, ok := h.session(w, r)
if !ok {
return
@ -268,6 +271,9 @@ func (h *webSrv) handleUpload(w http.ResponseWriter, r *http.Request) {
}
func (h *webSrv) handleMkdir(w http.ResponseWriter, r *http.Request) {
if !requirePost(w, r) {
return
}
sess, ok := h.session(w, r)
if !ok {
return
@ -286,6 +292,9 @@ func (h *webSrv) handleMkdir(w http.ResponseWriter, r *http.Request) {
}
func (h *webSrv) handleDelete(w http.ResponseWriter, r *http.Request) {
if !requirePost(w, r) {
return
}
sess, ok := h.session(w, r)
if !ok {
return
@ -299,6 +308,15 @@ func (h *webSrv) handleDelete(w http.ResponseWriter, r *http.Request) {
h.redirectMsg(w, r, parent, "deleted "+path.Base(target))
}
func requirePost(w http.ResponseWriter, r *http.Request) bool {
if r.Method == http.MethodPost {
return true
}
w.Header().Set("Allow", http.MethodPost)
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
return false
}
// session resolves the logged-in member into a filesystem session, writing an
// auth error to w when there is none.
func (h *webSrv) session(w http.ResponseWriter, r *http.Request) (*session, bool) {