gru/rustpad
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new finctions and fixes

Browse Source
This commit is contained in:
Mateusz Gruszczyński
2026-07-30 10:12:10 +02:00
parent bca9a37625
commit fb379ac69f
8 changed files with 74 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Cargo.lock
Generated
+1 -1
View File
@@ -2581,7 +2581,7 @@ dependencies = [
[[package]]
name = "rustpad"
version = "0.2.4"
version = "0.2.6"
dependencies = [
"argon2",
"aws-config",
Cargo.toml
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "rustpad"
version = "0.2.5"
version = "0.2.6"
edition = "2024"
rust-version = "1.94"
description = "Collaborative Markdown notepad built with Axum, WebSockets and SQLite, PostgreSQL and MySQL"
src/api/files.rs
+42 -6
View File
@@ -16,7 +16,6 @@ pub async fn upload_pad_file(
Path(slug): Path<String>,
mut multipart: Multipart,
) -> Result<Json<serde_json::Value>, ApiError> {
require_authenticated_upload(&state, &headers).await?;
let mut password: Option<String> = None;
let mut access_token: Option<String> = None;
let mut file: Option<(String, Vec<u8>)> = None;
@@ -61,6 +60,14 @@ pub async fn upload_pad_file(
&headers,
)
.await?;
require_upload_permission(
&state,
&headers,
"pad",
&slug,
resource_request_token(&headers, "pad", &slug, access_token.as_deref()),
)
.await?;
let level = if db::verify_pad_password(&pad, password.as_deref())
|| (pad.is_private == 0 && pad.password_hash.is_none())
{
@@ -205,7 +212,6 @@ pub async fn upload_note_file(
Path((workspace_slug, note_slug)): Path<(String, String)>,
mut multipart: Multipart,
) -> Result<Json<serde_json::Value>, ApiError> {
require_authenticated_upload(&state, &headers).await?;
let mut password: Option<String> = None;
let mut access_token: Option<String> = None;
let mut file: Option<(String, Vec<u8>)> = None;
@@ -252,6 +258,20 @@ pub async fn upload_note_file(
)
.await?;
require_upload_permission(
&state,
&headers,
"workspace",
&workspace_slug,
resource_request_token(
&headers,
"workspace",
&workspace_slug,
access_token.as_deref(),
),
)
.await?;
let level = if db::verify_workspace_password(&workspace, password.as_deref())
|| (workspace.is_private == 0 && workspace.password_hash.is_none())
{
@@ -438,17 +458,33 @@ pub async fn delete_note_file(
Ok(Json(serde_json::json!({"ok": true})))
}
async fn require_authenticated_upload(
async fn require_upload_permission(
state: &SharedState,
headers: &HeaderMap,
kind: &str,
slug: &str,
resource_token: Option<&str>,
) -> Result<(), ApiError> {
let permission = crate::auth::share_link_permission(state, kind, slug, resource_token)
.await
.map_err(|error| ApiError::forbidden(&error.message))?;
if permission.as_deref() == Some("rw") {
return Ok(());
}
let user = crate::auth::optional_user(state, headers)
.await
.map_err(|error| ApiError::forbidden(&error.message))?;
if user.is_none() {
return Err(ApiError::forbidden("Log in to upload files."));
if user.is_some() {
return Ok(());
}
match permission.as_deref() {
Some("ro") => Err(ApiError::forbidden("Read-only access.")),
_ => Err(ApiError::forbidden(
"Log in or use a read-write share link to upload files.",
)),
}
Ok(())
}
pub async fn download_file(
src/security.rs
+9
View File
@@ -1,3 +1,12 @@
/*
* Copyright (C) 2026 Mateusz Gruszczyński @linuxiarz.pl
* Source-Available Code / Dual-Licensed.
*
* Free for non-commercial and evaluation use under terms of BSL/GPLv3.
* Commercial or production use requires a valid paid license.
* See LICENSE file in repository root for details.
*/
use axum::http::{HeaderMap, HeaderValue, Uri, header};
use sha2::{Digest, Sha256};
static/editor.html
+15 -10
View File
@@ -125,8 +125,9 @@
aria-hidden="true"></span><span id="authorship-colors-label">Colors
on</span></label>
<div class="authorship-mode-control" role="group" aria-label="Authorship display"><button
type="button" data-authorship-mode="simple" class="active" disabled>Simple</button><button
type="button" data-authorship-mode="full" disabled>Full</button></div>
type="button" data-authorship-mode="simple" class="active"
disabled>Simple</button><button type="button" data-authorship-mode="full"
disabled>Full</button></div>
</div>
</div>
<div id="participant-badges" class="participant-badges" aria-label="Participants"></div>
@@ -218,9 +219,9 @@
guest</button><button id="show-register" class="text-button" type="button">Register</button><button
id="show-login" class="text-button" type="button">Log in</button></div>
<section id="auth-panel" class="auth-panel" hidden>
<h3 id="auth-mode-title">Log in</h3><label id="auth-email-field">E-mail / organization login<input
<h3 id="auth-mode-title">Log in</h3><label id="auth-email-field">E-mail / LDAP or AD Username<input
id="auth-email" name="username" type="email" maxlength="320" autocomplete="username"
placeholder="you@example.com"></label><label>Password<input
placeholder="you@example.com or name.second-name"></label><label>Password<input
id="auth-password" name="password" type="password" minlength="8" maxlength="128"
autocomplete="current-password"></label><button id="auth-submit" class="primary-button"
type="submit">Log in and continue</button>
@@ -234,8 +235,8 @@
</dialog>
<dialog id="password-dialog">
<form id="password-form" class="dialog-panel">
<h2>Protected __PROTECTED_RESOURCE_LABEL__</h2><input id="open-password" type="password" autocomplete="current-password" required
placeholder="Password">
<h2>Protected __PROTECTED_RESOURCE_LABEL__</h2><input id="open-password" type="password"
autocomplete="current-password" required placeholder="Password">
<p id="password-error" class="form-message error"></p><button class="primary-button">Open</button><a
class="dialog-link" href="/">Cancel</a>
</form>
@@ -261,10 +262,14 @@
<option value="20">20</option>
<option value="22">22</option>
</select></label>
<label class="public-task-toggle mobile-option-check"><input id="mobile-line-numbers-toggle" type="checkbox"> Editor lines</label>
<label class="public-task-toggle mobile-option-check"><input id="mobile-preview-line-numbers-toggle" type="checkbox"> Preview lines</label>
<label class="public-task-toggle mobile-option-check"><input id="mobile-compact-toggle" type="checkbox"> Compact view</label>
<label class="public-task-toggle mobile-option-check"><input id="mobile-line-links-toggle" type="checkbox"> Line links</label>
<label class="public-task-toggle mobile-option-check"><input id="mobile-line-numbers-toggle"
type="checkbox"> Editor lines</label>
<label class="public-task-toggle mobile-option-check"><input id="mobile-preview-line-numbers-toggle"
type="checkbox"> Preview lines</label>
<label class="public-task-toggle mobile-option-check"><input id="mobile-compact-toggle" type="checkbox">
Compact view</label>
<label class="public-task-toggle mobile-option-check"><input id="mobile-line-links-toggle"
type="checkbox"> Line links</label>
</div>
</details>
<label id="mobile-color-button" class="mobile-color-button" title="Editor color"
static/home.html
+1 -1
View File
@@ -101,7 +101,7 @@
<div class="identity-fields">
<label>Nickname<input id="nickname" name="nickname" maxlength="40" autocomplete="off" data-bwignore="true"
placeholder="Your nickname"></label>
<label id="auth-email-field">E-mail / LDAP Username<input id="auth-email" name="username" type="email"
<label id="auth-email-field">E-mail / LDAP or AD Username<input id="auth-email" name="username" type="email"
maxlength="320" autocomplete="username" required placeholder="you@example.com or name.second-name"></label>
<label>Password<input id="auth-password" name="password" type="password" minlength="8" maxlength="128"
autocomplete="current-password" required placeholder="At least 8 characters"></label>
static/js/note-files.js
+4 -1
View File
@@ -75,7 +75,10 @@ export function bindNoteFiles({ editor, endpoints, getAccessToken, canDelete, to
}
document.querySelector("#upload-button").addEventListener("click", () => {
if (!getAuthToken()) { toast("Log in to upload files."); return; }
if (!getAuthToken() && !getAccessToken()) {
toast("Log in or use a read-write share link to upload files.");
return;
}
input.click();
});
input.addEventListener("change", async event => {