Commit Graph

104 Commits

Author SHA1 Message Date
gitmotion
9792f06691 deprecate ALLOWED_IFRAME_ORIGINS 2025-06-20 09:30:23 -07:00
gitmotion
1458dcfdc4 CORS/CSP fix 2025-06-20 08:20:28 -07:00
abite
54cdf4be36 Update README.md 2025-06-04 11:07:48 -05:00
abite
db27b25372 Merge pull request #56 from gitmotion/fix/escape-html-xss
Add html escaping to frontend uploader for xss security
2025-05-15 12:54:35 -05:00
abite
478477c6ea Merge pull request #57 from gitmotion/update-icon
Update icons to selfh.st icons
2025-05-13 11:15:40 -04:00
gitmotion
d37760e9dd Update icons to selfh.st icons 2025-05-13 08:10:47 -07:00
gitmotion
1835f611da Add html escaping to frontend uploader for xss security
replace innerhtml to textcontent
2025-05-12 13:31:58 -07:00
greirson
5177752a6a chore: Update comments in environment configuration files to clarify BASE_URL usage 2025-05-09 07:59:14 -07:00
Greirson Lee-Thorp
c75d200c70 Update docker-publish.yml to support :dev tag 2025-05-05 16:53:40 -07:00
Greirson Lee-Thorp
b256311822 feat(upload): Implement persistent state via metadata for resumability (#50) (#51)
* feat: Enhance chunk upload functionality with configurable retry logic

- Introduced MAX_RETRIES configuration to allow dynamic adjustment of retry attempts for chunk uploads.
- Updated index.html to read MAX_RETRIES from server-side configuration, providing a default value if not set.
- Implemented retry logic in uploadChunkWithRetry method, including exponential backoff and error handling for network issues.
- Added console warnings for invalid or missing MAX_RETRIES values to improve debugging.

This commit improves the robustness of file uploads by allowing configurable retry behavior, enhancing user experience during upload failures.

* feat: Enhance upload functionality with metadata management and improved error handling

- Introduced persistent metadata management for uploads, allowing resumability and better tracking of upload states.
- Added special handling for 404 responses during chunk uploads, logging warnings and marking uploads as complete if previously finished.
- Implemented metadata directory creation and validation in app.js to ensure proper upload management.
- Updated upload.js to include metadata read/write functions, improving the robustness of the upload process.
- Enhanced cleanup routines to handle stale metadata and incomplete uploads, ensuring a cleaner state.

This commit significantly improves the upload process by adding metadata support, enhancing error handling, and ensuring better resource management during uploads.

Fixes #24
2025-05-04 16:30:16 -07:00
greirson
bf1c9a2dbd fix: Correct BASE_URL handling in login.html for API requests 2025-05-04 11:56:06 -07:00
Greirson Lee-Thorp
e963f2bcde feat: Improve dev experience, Improve Environmental Variable and Folder Control, resolves BASE_URL junk (#49)
* feat: Add ALLOWED_IFRAME_ORIGINS configuration and update security headers (#47)

- Introduced ALLOWED_IFRAME_ORIGINS environment variable to specify trusted origins for iframe embedding.
- Updated security headers middleware to conditionally allow specified origins in Content Security Policy.
- Enhanced documentation in README.md to explain the new configuration and its security implications.

Fixes #35

* feat: Update .env.example and .gitignore for improved configuration management

- Enhanced .env.example with detailed comments for environment variables, including upload settings, security options, and notification configurations.
- Updated .gitignore to include additional editor and OS-specific files, ensuring a cleaner repository.
- Modified package.json to add a predev script for Node.js version validation and adjusted the dev script for nodemon.
- Improved server.js shutdown handling to prevent multiple shutdowns and ensure graceful exits.
- Refactored config/index.js to log loaded environment variables and ensure the upload directory exists based on environment settings.
- Cleaned up fileUtils.js by removing unused functions and improving logging for directory creation.

This commit enhances clarity and maintainability of configuration settings and improves application shutdown behavior.

* feat: Update Docker configuration and documentation for upload handling

- Explicitly set the upload directory environment variable in docker-compose.yml to ensure clarity in file storage.
- Simplified the Dockerfile by removing the creation of the local_uploads directory, as it is now managed by the host system.
- Enhanced README.md to reflect changes in upload directory management and provide clearer instructions for users.
- Removed outdated development configuration files to streamline the development setup.

This commit improves the clarity and usability of the Docker setup for file uploads.

* feat: Add Local Development Guide and update README for clarity

- Introduced a comprehensive LOCAL_DEVELOPMENT.md file with setup instructions, testing guidelines, and troubleshooting tips for local development.
- Updated README.md to include a link to the new Local Development Guide and revised sections for clarity regarding upload directory management.
- Enhanced the Quick Start section to direct users to the dedicated local development documentation.

This commit improves the onboarding experience for developers and provides clear instructions for local setup.

* feat: Implement BASE_URL configuration for asset management and API requests

- Added BASE_URL configuration to README.md, emphasizing the need for a trailing slash when deploying under a subpath.
- Updated index.html and login.html to utilize BASE_URL for linking stylesheets, icons, and API requests, ensuring correct asset loading.
- Enhanced app.js to replace placeholders with the actual BASE_URL during HTML rendering.
- Implemented a validation check in config/index.js to ensure BASE_URL is a valid URL and ends with a trailing slash.

This commit improves the flexibility of the application for different deployment scenarios and enhances asset management.

Fixes #34, Fixes #39, Fixes #38

* Update app.js, borked some of the css n such

* resolved BASE_URL breaking frontend

* fix: Update BASE_URL handling and security headers

- Ensured BASE_URL has a trailing slash in app.js to prevent asset loading issues.
- Refactored index.html and login.html to remove leading slashes from API paths for correct concatenation with BASE_URL.
- Enhanced security headers middleware to include 'connect-src' directive in Content Security Policy.

This commit addresses issues with asset management and improves security configurations.
2025-05-04 10:29:48 -07:00
Greirson Lee-Thorp
107684fe6a feat: Add ALLOWED_IFRAME_ORIGINS configuration and update security headers (#47) (#48)
- Introduced ALLOWED_IFRAME_ORIGINS environment variable to specify trusted origins for iframe embedding.
- Updated security headers middleware to conditionally allow specified origins in Content Security Policy.
- Enhanced documentation in README.md to explain the new configuration and its security implications.

Fixes #35
2025-05-02 17:25:27 -07:00
V
12ae628bd4 Merge pull request #46 from DumbWareio/greirson/issue45
Tested and working.

tree
├── test
│   ├── dumb.png
│   ├── dumb.txt
│   └── test2
│       ├── dumb.png
│       └── dumb.txt
2025-05-02 15:13:17 -07:00
greirson
ccd06f92bb feat: Enhance folder upload handling and filename sanitation
- Added support for checking webkitRelativePath in folder uploads, alerting users if their browser does not support this feature.
- Introduced sanitizePathPreserveDirs function to sanitize filenames while preserving directory structure.
- Updated upload route to utilize the new sanitation function and ensure consistent folder naming during uploads.

Fixes #45
2025-05-02 14:38:28 -07:00
abite
8f4b2ea873 Merge pull request #41 from gitmotion/fix/apprise-notifications-not-working-and-cve-fix
Fixed notifications config mapping and filename sanitation/use of spawn for cve/rce
2025-03-13 17:58:37 -04:00
gitmotion
e11c9261f7 Fixed notifications config mapping and filename sanitation for cve/rce
add svg to login / index for favicon

ensure file sanitization before and during notification
2025-03-13 14:24:03 -07:00
abite
81baf87e93 Merge pull request #40 from gitmotion/feature/add-pwa-registration
Add PWA Registration
2025-03-12 16:22:25 -05:00
gitmotion
c4a806604a Add PWA Registration 2025-03-12 14:00:38 -07:00
V
fc83e527b7 feat: Add Demo Mode for Testing and Evaluation (#37)
* demo things.
2025-02-27 11:25:25 -08:00
Chris
c6a969b5cd feat: pin not working when rate limited redirect fix & allow non https baseUrl pin fix (#32)
* feat: ratelimit pin not working with baseUrl fix

* Remove white space changes

* Refactor PIN verification error handling and input state management

- Improve error handling in login page JavaScript
- Standardize API response structure with explicit success and error fields
- Enhance user feedback for PIN authentication failures
- Implement more robust input state management during login attempts

* Fix PIN verification logic in root route

- Improve PIN verification check to handle missing cookie scenario
- Add explicit check for cookie existence before comparing PIN
- Enhance root route authentication logic for more robust access control
2025-02-24 10:56:57 -08:00
V
d42ca55c08 Update docker-publish.yml
oops, I lied...Fixed this time.
2025-02-21 21:22:07 -07:00
V
a923bb957a Update docker-publish.yml
Did the thing, didn't break everything... I think. Name=dumbwareio/dumbdrop
2025-02-21 21:20:33 -07:00
Chris
3236a727ff Update pin input type to password to mask pin and match dumbwareio products (#33) 2025-02-21 18:28:38 -08:00
Greirson Lee-Thorp
1a74774d6a feat: Enhance login page security and caching
- Add rate limit handling for PIN verification with user-friendly error message
- Disable PIN input on repeated failed attempts to prevent refresh loops
- Implement cache control headers for login page to prevent browser caching
2025-02-21 11:08:21 -08:00
Greirson Lee-Thorp
aa25ef92f8 fix: Update login API endpoint paths for authentication routes
- Modify fetch URLs to use '/api/auth/' prefix for PIN verification endpoints
- Update '/api/pin-required' and '/api/verify-pin' to '/api/auth/pin-required' and '/api/auth/verify-pin'
- Ensure consistent routing for authentication-related API calls

Closes #31
2025-02-19 08:27:23 -08:00
Greirson Lee-Thorp
7e0f3f85d7 Update .cursorrules 2025-02-16 23:57:03 -08:00
Greirson Lee-Thorp
1b40cf2e8e feat: add BASE_URL configuration for flexible deployment environments (#30)
- Introduce BASE_URL environment variable for flexible application URL configuration
- Update .env.example, docker-compose, and README with new configuration option
- Implement BASE_URL validation in config module
- Modify server logging to use configurable base URL
- Provide default base URL generation when not explicitly set
2025-02-16 23:47:32 -08:00
Greirson Lee-Thorp
22f79f830b feat: Complete Application Infrastructure and Security Overhaul (#28)
Chores & Configuration
	•	Enhanced development setup: optimized Dockerfile, refined scripts, and improved .gitignore.
	•	Updated docker-compose for better dev/prod separation.
	•	Improved documentation in README and source files.

Features & Enhancements
	•	Refactored project structure with modular architecture.
	•	Improved testing infrastructure and integration tests.
	•	Enhanced file upload logic, client-side handling, and API routes.
	•	Implemented robust server shutdown, rate limiting, and cleanup mechanisms.
	•	Improved upload progress tracking with UI enhancements.
	•	Strengthened security in PIN authentication and cookie handling.

Refactors & Fixes
	•	Cleaned up test infrastructure, logging, and error handling.
	•	Simplified API route paths and improved middleware.
	•	Fixed incorrect total storage size reporting.
	•	Optimized logging verbosity based on environment.

Documentation
	•	Expanded project documentation and comments for clarity.
2025-02-16 15:39:13 -08:00
V
2ec69ba26e Merge pull request #27 from vin-im/main
Update README.md
2025-02-08 19:03:07 -07:00
V
72e8e2c286 Update README.md
Updated photo and fixed the name.
2025-02-08 16:59:55 -07:00
Greirson Lee-Thorp
0dd96b50ac fix: Update Apprise notification command execution method 2025-02-07 10:44:13 -08:00
Greirson Lee-Thorp
d1aab6bc60 fix: Add proxy trust configuration for rate limiting 2025-02-07 10:33:53 -08:00
abite
80f74c5b8d Update issue templates 2025-02-06 11:18:17 -06:00
abite
5d801d699c Update issue templates 2025-02-06 11:17:37 -06:00
Greirson Lee-Thorp
6f0918a530 docs/test: Add dev setup and update docs (#23)
* feat: Add development environment configuration

- Create dev/dev.sh script for simplified development workflow
- Add docker-compose.dev.yml for local development setup
- Update .gitignore to exclude dev directory except specific files
- Add development section to README.md with guide reference

* docs: Update README and docker-compose with comprehensive setup instructions and configuration options
2025-02-04 21:15:21 -08:00
abite
beb03e2415 Merge pull request #22 from greirson/progress-bar
Feat: Enhanced Upload Progress Bar UI/UX
2025-02-04 20:06:44 -06:00
Greirson Lee-Thorp
3177ac079b Merge branch 'DumbWareio:main' into progress-bar 2025-02-04 17:45:00 -08:00
Greirson Lee-Thorp
8ab70f45c8 feat: enhance file upload progress tracking and user experience
- Add detailed upload progress tracking with speed and time remaining
- Implement dynamic waiting messages during upload initialization
- Create utility functions for file size and speed formatting
- Improve progress bar UI with more informative status details
- Add interval-based speed and progress updates for smoother UI
2025-02-04 17:00:31 -08:00
abite
3d10957ca0 Merge pull request #21 from greirson/even-dumber-drop
feat: Add auto upload configuration and update environment settings
2025-02-04 12:33:11 -06:00
Greirson Lee-Thorp
16447493bf Merge branch 'main' into even-dumber-drop 2025-02-04 09:52:10 -08:00
abite
432cf7e386 Merge pull request #17 from greirson/security-enhancements
feat: enhance security with rate limiting and file extension filtering
2025-02-04 08:15:07 -06:00
Greirson Lee-Thorp
afb4f3f106 feat: Enhance AUTO_UPLOAD configuration parsing
- Improve AUTO_UPLOAD environment variable parsing
- Add support for multiple truthy values ('true', '1', 'yes')
- Convert input to lowercase for case-insensitive comparison
2025-02-03 22:29:42 -08:00
Greirson Lee-Thorp
1a5bc93e01 feat: Add auto upload configuration and update environment settings
- Introduce AUTO_UPLOAD environment variable to enable automatic file uploads
- Update .env.example with new configuration options
- Modify docker-compose.yml to use new image and comment out default settings
- Update README.md to document AUTO_UPLOAD feature
- Implement client-side auto upload logic in index.html
- Add server-side logging for auto upload status
chore: Refactor notification message template and size unit handling
2025-02-03 22:11:21 -08:00
Greirson Lee-Thorp
71d2e939c2 Merge branch 'main' into security-enhancements 2025-02-03 21:23:50 -08:00
abite
38fc5994dd Merge pull request #20 from greirson/feat-dupe-handling
feat: Duplicate file/folder handling
2025-02-03 21:05:22 -06:00
Greirson Lee-Thorp
bcc555939b feat: improve batch ID handling for file and folder uploads
- Update server-side upload initialization to always refresh batch activity timestamp
- Enhance client-side file grouping to consistently track batch IDs for files and folders
- Modify drop and file selection handlers to generate batch IDs for all upload scenarios
- Ensure batch ID is preserved and used consistently across file upload groups
2025-02-03 17:37:33 -08:00
Greirson Lee-Thorp
79f6c53871 feat: improve single file upload batch ID generation
- Add automatic batch ID generation for single file uploads
- Generate unique batch ID using timestamp and random string
- Enhance batch ID validation to handle single file and multi-file upload scenarios
- Improve error handling for batch ID format validation
2025-02-03 17:14:03 -08:00
Greirson Lee-Thorp
dec54b7803 feat: implement batch upload inactivity cleanup mechanism
- Add batchActivity Map to track batch upload timestamps
- Create interval-based cleanup for inactive batch uploads
- Update upload chunk route to refresh batch activity timestamp
- Remove manual timeout for folder mappings in favor of centralized cleanup
- Improve resource management for long-running batch uploads
2025-02-03 17:10:43 -08:00
Greirson Lee-Thorp
a488c753db feat: improve file upload handling with atomic file and folder creation
- Refactor getUniqueFilePath and getUniqueFolderPath to use async/await and atomic file operations
- Enhance upload initialization to handle file and folder naming conflicts more robustly
- Implement file handle management to prevent resource leaks
- Add error handling for file and folder creation scenarios
- Ensure parent directories are created recursively when needed
2025-02-03 17:07:43 -08:00