bbs.profullstack/agentbbs
1
0
Fork 0
mirror of https://github.com/profullstack/agentbbs.git synced 2026-08-13 14:27:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Require POST for file web mutations (#82)
Some checks failed
CI / build (push) Has been cancelled
Details
deploy / deploy (push) Has been cancelled
Details
test / test (push) Has been cancelled
Details

Browse source
This commit is contained in:
Luna Ops 2026-07-07 20:41:16 +08:00 • committed by GitHub
parent ee06082ce1
commit ff9eef907d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 50 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

18
internal/files/web.go
View file

@ -231,6 +231,9 @@ func (h *webSrv) handleDownload(w http.ResponseWriter, r *http.Request) {
}
func (h *webSrv) handleUpload(w http.ResponseWriter, r *http.Request) {
if !requirePost(w, r) {
return
}
sess, ok := h.session(w, r)
if !ok {
return
@ -268,6 +271,9 @@ func (h *webSrv) handleUpload(w http.ResponseWriter, r *http.Request) {
}
func (h *webSrv) handleMkdir(w http.ResponseWriter, r *http.Request) {
if !requirePost(w, r) {
return
}
sess, ok := h.session(w, r)
if !ok {
return
@ -286,6 +292,9 @@ func (h *webSrv) handleMkdir(w http.ResponseWriter, r *http.Request) {
}
func (h *webSrv) handleDelete(w http.ResponseWriter, r *http.Request) {
if !requirePost(w, r) {
return
}
sess, ok := h.session(w, r)
if !ok {
return
@ -299,6 +308,15 @@ func (h *webSrv) handleDelete(w http.ResponseWriter, r *http.Request) {
h.redirectMsg(w, r, parent, "deleted "+path.Base(target))
}
func requirePost(w http.ResponseWriter, r *http.Request) bool {
if r.Method == http.MethodPost {
return true
}
w.Header().Set("Allow", http.MethodPost)
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
return false
}
// session resolves the logged-in member into a filesystem session, writing an
// auth error to w when there is none.
func (h *webSrv) session(w http.ResponseWriter, r *http.Request) (*session, bool) {