From c9068f7433789da512438a7b623d62f8ac5c91aa Mon Sep 17 00:00:00 2001
From: chrislu <chris.lu@gmail.com>
Date: Fri, 5 Dec 2025 12:55:50 -0800
Subject: [PATCH] fix: Ensure HTTP response body is closed on non-200 responses

In ViewFile, the response body was only closed on 200 OK paths,
which could leak connections on non-200 responses. Now the body
is always closed via defer immediately after checking err == nil,
before checking the status code.
---
 weed/admin/handlers/file_browser_handlers.go | 23 ++++++++++++--------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/weed/admin/handlers/file_browser_handlers.go b/weed/admin/handlers/file_browser_handlers.go
index f7f36b700..a5c195912 100644
--- a/weed/admin/handlers/file_browser_handlers.go
+++ b/weed/admin/handlers/file_browser_handlers.go
@@ -657,19 +657,24 @@ func (h *FileBrowserHandlers) ViewFile(c *gin.Context) {
 								Timeout:   30 * time.Second,
 							}
 							resp, err := clientWithTimeout.Get(fileURL)
-							if err == nil && resp.StatusCode == http.StatusOK {
+							if err != nil {
+								viewable = false
+								reason = "Failed to fetch file from filer"
+							} else {
 								defer resp.Body.Close()
-								contentBytes, err := io.ReadAll(resp.Body)
-								if err == nil {
-									content = string(contentBytes)
-									viewable = true
+								if resp.StatusCode == http.StatusOK {
+									contentBytes, err := io.ReadAll(resp.Body)
+									if err == nil {
+										content = string(contentBytes)
+										viewable = true
+									} else {
+										viewable = false
+										reason = "Failed to read file content"
+									}
 								} else {
 									viewable = false
-									reason = "Failed to read file content"
+									reason = "Failed to fetch file from filer"
 								}
-							} else {
-								viewable = false
-								reason = "Failed to fetch file from filer"
 							}
 						}
 					} else {