9b1df43ef2
Trim "-" in filenames
9 years ago
0b37309237
Allow configuration from ini-style file
9 years ago
c53c909165
Remove unnecessary margin on pastebins
9 years ago
be08b7f0fd
Remove "sandbox" from files CSP to have pdfs work in chrome
9 years ago
ba9fcd3a7b
Document allowing hotlinking
9 years ago
c8fc62398a
Enable randomize in remote uploads
9 years ago
20456b0b3c
Updarte README.md
9 years ago
39ae89107c
Update README.md
9 years ago
7df3b1328e
Update README.md
9 years ago
50a54bbcfc
Add linx-client in API documentation
9 years ago
0d365409d0
Allow /upload/ for PUT requests without filename
9 years ago
120909ce46
Template file was missing
9 years ago
c77f8285d4
Fix/implement .story
9 years ago
9847beeff5
Cleanup
9 years ago
3c659601e2
Make it an option for post uploads
9 years ago
9b724725b3
Blank referrers are allowed
9 years ago
256ca43d69
Update API documentation with API keys
9 years ago
b1e82f8d7f
Update build.sh to build linx-genkey
9 years ago
68653372ff
Rename auth header to Linx-Api-Key and remove
b64encoding requirement for uploading with keys
9 years ago
6987edc0d8
Remove non-API navigation links when using auth
9 years ago
be15ba076d
Removed unnecessary duplicate static caching
9 years ago
e1b2896c64
Merge pull request #60 from mutantmonkey/proper_referrer_check
do a proper same-origin check
9 years ago
d138755806
do a proper same-origin check
String prefix matching is hacky and provides insufficient checking if it
does not end with a /.
9 years ago
ff1d9f56a1
Merge pull request #59 from mutantmonkey/csp_referrer_fix
fix CSP referrer policy
9 years ago
a3723d3665
short-circuit on origin header
If the Origin header is present, we can check it and skip the other
checks.
9 years ago
0a1aa869e4
nicer 400 error page
9 years ago
a7ae455ac1
strict referrer check improvements
* Always check Origin if it is present, regardless of headers sent
* Whitelist X-Requested-With header
9 years ago
61147554a9
update CSP flags in readme
9 years ago
cd83f9f0eb
fix CSP referrer policy
The policy of "referrer none" was incorrect and was nonfunctional. With
this change, the CSP referrer policy is set to origin, which
will causes only the origin to be sent for requests made from the main
site.
A fix was also needed for referrer checks in two places.
9 years ago
4fee922543
Merge pull request #58 from mutantmonkey/referrer_fixup2
trim trailing / for origin checking
9 years ago
39d874374d
trim trailing / for origin checking
9 years ago
60239467fd
Merge pull request #56 from mutantmonkey/auth
Add support for auth keys (and remote auth keys)
9 years ago
613ab24721
show usage for -authfile and -remoteauthfile
9 years ago
2cd432b5d3
update readme
9 years ago
dd4ac3a7ed
add support remote auth keys
These are taken as a parameter to the remote upload page. Note that all
keys will be logged since this is a GET request.
9 years ago
3dc4753b7a
move reading auth keys into readAuthKeys
9 years ago
104f648c0f
Remove artifact
9 years ago
ae02f537f7
Add linx-genkey
9 years ago
adbc1604dc
add some more auth tests
It's going to be difficult to get 100% code coverage, but we can at
least ensure that checkAuth works properly.
9 years ago
cc4e2ca0d9
read authfile once only
Read the authfile upon initial server start and store the auth keys in
the auth struct, rather than reading the file for each page load.
9 years ago
3c9e260926
improve auth tests and rename auth struct
9 years ago
aa7dad3a03
add support for auth keys
Add a middleware that requires authorization for all POST, PUT, and
DELETE requests. This is done using the Authorization header and the
provided auth key is then checked against a file containing scrypted
auth keys. These keys are salted the constant string `linx-server`.
9 years ago
2b0135697b
Add option for using Real-IP
9 years ago
9ac016c3b5
Document overwriting a file
9 years ago
6c9d517c80
Merge pull request #55 from mutantmonkey/redirect_fix
use 303 redirects instead of 301s
9 years ago
52ec9f8e2d
use 303 redirects instead of 301s
HTTP status code 301 is for a permanent redirect, which these are not.
Although 302 would work here in most browsers, it would not follow the
HTTP spec, so instead we use 303 which has a clearly and consistently
defined behavior in response to a POST or PUT request.
9 years ago
354278d488
Real-IP middleware for fastcgi + nginx doc update
9 years ago
ef13181a23
Adjust the csp_test to use the new mux
9 years ago
d42b2d28ac
Merge pull request #53 from mutantmonkey/fixbind
Replace -b and -bind with a single -bind
9 years ago
5600dd1ce3
update readme for new -bind flag
9 years ago
andreimarcu
mutantmonkey