Browse Source

Disable filer UI in configuration (#5297)

* Add filer.ui.enabled configuration property

* Add filer.expose_directory_metadata to config

* Ammend commit

* Remove ShowUI reference

* Update all routes that allow directory metadata

* Add cmd flag to server.go
pull/5351/head
jerebear12 10 months ago
committed by GitHub
parent
commit
85d6d5371b
No known key found for this signature in database GPG Key ID: B5690EEEBB952194
  1. 2
      weed/command/filer.go
  2. 7
      weed/command/scaffold/security.toml
  3. 1
      weed/command/server.go
  4. 5
      weed/server/filer_server.go
  5. 4
      weed/server/filer_server_handlers_read.go
  6. 6
      weed/server/filer_server_handlers_read_dir.go

2
weed/command/filer.go

@ -62,6 +62,7 @@ type FilerOptions struct {
downloadMaxMBps *int
diskType *string
allowedOrigins *string
exposeDirectoryData *bool
}
func init() {
@ -93,6 +94,7 @@ func init() {
f.downloadMaxMBps = cmdFiler.Flag.Int("downloadMaxMBps", 0, "download max speed for each download request, in MB per second")
f.diskType = cmdFiler.Flag.String("disk", "", "[hdd|ssd|<tag>] hard drive or solid state drive or any tag")
f.allowedOrigins = cmdFiler.Flag.String("allowedOrigins", "*", "comma separated list of allowed origins")
f.exposeDirectoryData = cmdFiler.Flag.Bool("exposeDirectoryData", true, "whether to return directory metadata and content in Filer UI")
// start s3 on filer
filerStartS3 = cmdFiler.Flag.Bool("s3", false, "whether to start S3 gateway")

7
weed/command/scaffold/security.toml

@ -24,6 +24,13 @@ expires_after_seconds = 10 # seconds
[access]
ui = false
# by default the filer UI is enabled. This can be a security risk if the filer is exposed to the public
# and the JWT for reads is not set. If you don't want the public to have access to the objects in your
# storage, and you haven't set the JWT for reads it is wise to disable access to directory metadata.
# This disables access to the Filer UI, and will no longer return directory metadata in GET requests.
[filer.expose_directory_metadata]
enabled = true
# this jwt signing key is read by master and volume server, and it is used for read operations:
# - the Master server generates the JWT, which can be used to read a certain file on a volume server
# - the Volume server validates the JWT on reading

1
weed/command/server.go

@ -118,6 +118,7 @@ func init() {
filerOptions.showUIDirectoryDelete = cmdServer.Flag.Bool("filer.ui.deleteDir", true, "enable filer UI show delete directory button")
filerOptions.downloadMaxMBps = cmdServer.Flag.Int("filer.downloadMaxMBps", 0, "download max speed for each download request, in MB per second")
filerOptions.diskType = cmdServer.Flag.String("filer.disk", "", "[hdd|ssd|<tag>] hard drive or solid state drive or any tag")
filerOptions.exposeDirectoryData = cmdServer.Flag.Bool("filer.exposeDirectoryData", true, "expose directory data via filer. If false, filer UI will be innaccessible.")
serverOptions.v.port = cmdServer.Flag.Int("volume.port", 8080, "volume server http listen port")
serverOptions.v.portGrpc = cmdServer.Flag.Int("volume.port.grpc", 0, "volume server grpc listen port")

5
weed/server/filer_server.go

@ -72,6 +72,7 @@ type FilerOption struct {
DownloadMaxBytesPs int64
DiskType string
AllowedOrigins []string
ExposeDirectoryData bool
}
type FilerServer struct {
@ -115,6 +116,10 @@ func NewFilerServer(defaultMux, readonlyMux *http.ServeMux, option *FilerOption)
domains := strings.Split(allowedOrigins, ",")
option.AllowedOrigins = domains
v.SetDefault("filer.expose_directory_metadata.enabled", true)
returnDirMetadata := v.GetBool("filer.expose_directory_metadata.enabled")
option.ExposeDirectoryData = returnDirMetadata
fs = &FilerServer{
option: option,
grpcDialOption: security.LoadClientTLS(util.GetViper(), "grpc.filer"),

4
weed/server/filer_server_handlers_read.go

@ -117,7 +117,7 @@ func (fs *FilerServer) GetOrHeadHandler(w http.ResponseWriter, r *http.Request)
w.WriteHeader(http.StatusForbidden)
return
}
if query.Get("metadata") == "true" {
if query.Get("metadata") == "true" && fs.option.ExposeDirectoryData != false {
writeJsonQuiet(w, r, http.StatusOK, entry)
return
}
@ -135,7 +135,7 @@ func (fs *FilerServer) GetOrHeadHandler(w http.ResponseWriter, r *http.Request)
return
}
if query.Get("metadata") == "true" {
if query.Get("metadata") == "true" && fs.option.ExposeDirectoryData != false {
if query.Get("resolveManifest") == "true" {
if entry.Chunks, _, err = filer.ResolveChunkManifest(
fs.filer.MasterClient.GetLookupFileIdFunction(),

6
weed/server/filer_server_handlers_read_dir.go

@ -18,6 +18,11 @@ import (
// is empty.
func (fs *FilerServer) listDirectoryHandler(w http.ResponseWriter, r *http.Request) {
if fs.option.ExposeDirectoryData == false {
http.NotFound(w, r)
return
}
stats.FilerHandlerCounter.WithLabelValues(stats.DirList).Inc()
path := r.URL.Path
@ -95,4 +100,5 @@ func (fs *FilerServer) listDirectoryHandler(w http.ResponseWriter, r *http.Reque
if err != nil {
glog.V(0).Infof("Template Execute Error: %v", err)
}
}
Loading…
Cancel
Save