Merge branch 'master' of git@github.com:dvv/pintura

cloudwork · Aug 4, 2010 · 235d0ff · 235d0ff
2 parents e4c6b8d + d3469e8
commit 235d0ff
Show file tree

Hide file tree

Showing 5 changed files with 96 additions and 35 deletions.
diff --git a/lib/jsgi/csrf.js b/lib/jsgi/csrf.js
@@ -4,7 +4,7 @@
  */
 exports.CSRFDetect = function(customHeader, nextApp){
 	// FIXME: why not satisfactory to check for X-Requested-With: XMLHttpRequest?
-	customHeader = customHeader || "client-id";
+	customHeader = customHeader || "x-requested-with";
 	return function(request){
 		var headers = request.headers;
 		if(!(headers[customHeader] || /application\/j/.test(headers.accept) ||

diff --git a/lib/jsgi/rest-store.js b/lib/jsgi/rest-store.js
@@ -132,6 +132,7 @@ return when(options.getDataModel(request), function(model){
 				// call the model with the request body and the path
 				responseValue = model[method](request.body, metadata);
 				when(responseValue, function(){
+//dir('POST?', responseValue);
 					if(method !== "get" && responseValue){
 						// include a Content-Location per http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p2-semantics-08.html#rfc.section.6.1
 						var schema = responseValue && responseValue.schema;

diff --git a/lib/jsgi/static.js b/lib/jsgi/static.js
@@ -5,38 +5,41 @@ var fs = require("promised-io/fs"),
 exports.Static = function(options, nextApp){
 	var options = options || {},
 		urls = options.urls || ["/favicon.ico"],
-		roots = options.roots || [""],
-		index = options.index || "index.html"; 
-
+		root = options.root || (options.roots && options.roots[0]) || "",
+		index = options.index || "index.html", 
+		directoryListing = options.directoryListing;
+
 	return function(request) {
 		var path = request.pathInfo;
+		if(path.indexOf("..") > -1){
+			return {
+				status: 403,
+				headers: {},
+				body: ["Parent directory references are not allowed"]
+			}
+		}
 		for (var i = 0; i < urls.length; i++) {
 			if (path.indexOf(urls[i]) === 0) {
 				var relative = path.slice(urls[i].length);
 				var rootIndex = 0;
 				var responseDeferred = defer();
-				checkNextRoot();
+				tryFile(root + relative, function(){
+					responseDeferred.resolve(nextApp ? nextApp(request) :
+						{
+							status: 404,
+							headers: {},
+							body: [path + " not found"]
+						});
+				});
 				return responseDeferred.promise;
 			}
 		}
-		return {
+		return nextApp ? nextApp(request) : {
 			status: 404,
 			headers: {},
 			body: [path + " not found"]
 		};
-		function checkNextRoot(){
-			if(rootIndex >= roots.length){
-				responseDeferred.resolve(nextApp ? nextApp(request) :
-				{
-					status: 404,
-					headers: {},
-					body: [path + " not found"]
-				});
-				return;
-			}
-			tryFile(roots[rootIndex++] + relative);
-		}
-		function tryFile(filePath){
+		function tryFile(filePath, onFail){
 			fs.stat(filePath)
 				.then(function (stat) {
 					if(stat.isFile()){
@@ -56,16 +59,69 @@ exports.Static = function(options, nextApp){
 							    	},
 							    	body: file
 							    });
-							}, checkNextRoot);
+							}, onFail);
 					}
 					else if(stat.isDirectory()){
-						tryFile(filePath + "/" + index);
+						tryFile(filePath + "/" + index, directoryListing ? function(){
+							if(filePath.charAt(filePath.length - 1) == "/"){
+								fs.readdir(filePath).then(function(paths){
+								    responseDeferred.resolve({
+								    	status: 200,
+								    	headers: {
+											"content-type": "text/html"
+								    	},
+								    	body: {
+								    		forEach: function(write){
+								    			write(DIR_START);
+								    			paths.forEach(function(path){
+								    				write(DIR_FILE.replace(/%s/g, path));
+								    			});
+								    			write(DIR_END);
+								    		}
+								    	}
+								    });
+								});
+							}else{
+							    responseDeferred.resolve({
+							    	status: 301,
+							    	headers: {
+										location: request.scriptName + request.pathInfo + '/'
+							    	},
+							    	body: []
+							    });
+							}
+						} : onFail);
 					}
 					else{
-						checkNextRoot();
+						onFail();
 					}
 
-			}, checkNextRoot);
+			}, onFail);
 		}
 	};
 };
+var DIR_FILE =
+'<tr>\n\
+    <td class="name"><a href="%s">%s</a></td>\n\
+</tr>';
+
+var DIR_START =
+'<html><head>\n\
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />\n\
+<style type="text/css">\n\
+    table { width:100%%; }\n\
+    .name { text-align:left; }\n\
+    .size, .mtime { text-align:right; }\n\
+    .type { width:11em; }\n\
+    .mtime { width:15em; }\n\
+</style>\n\
+</head><body>\n\
+<hr />\n\
+<table>\n\
+<tr>\n\
+    <th class="name">Name</th>\n\
+</tr>\n';
+var DIR_END = '\n\
+</table>\n\
+<hr />\n\
+</body>\n</html>';
diff --git a/lib/media/message/json.js b/lib/media/message/json.js
@@ -38,23 +38,27 @@ Media({
 						}
 						message.pathInfo = pathInfo;
 						var response = nextApp(message);
-						response.pathInfo = pathInfo;
-						if(response.body && typeof response.body.observe === "function"){
-							clientConnection.exportMore = true;
-							response.body.observe(function(message){
-								message.from = message.channel;
-								clientConnection.send(message);
-							});
-						}else{
-							responses.push(response);
-						}
+						responses.push(response);
+						when(response, function(response){
+							response.pathInfo = pathInfo;
+							if(response.body && typeof response.body.observe === "function"){
+								clientConnection.exportMore = true;
+								response.body.observe(function(message){
+									message.from = message.channel;
+									clientConnection.send(message);
+								});
+							}
+						});
 					});
 					return when(all(responses), function(responses){
 						return {
 							status: clientConnection.exportMore ? 202: 200,
 							headers: {},
 							messages: true,
-							body: responses
+							body: responses.filter(function(response){
+								//ignore the observable messages since they indicate that we should keep the connection open and wait for the real message
+								return !(response.body && typeof response.body.observe === "function");
+							})
 						}
 					});
 				});

diff --git a/lib/security.js b/lib/security.js
@@ -7,7 +7,7 @@ var AccessError = require("perstore/errors").AccessError,
 	when = require("promised-io/promise").when,
 	getCurrentSession = require("./jsgi/session").getCurrentSession,
 	Restrictive = require("perstore/facet").Restrictive,
-	sha1 = require("commonjs-utils/sha1").hex_sha1,
+	sha1 = require("commonjs-utils/sha1").b64_sha1,
 	settings = require("commonjs-utils/settings");
 
 try{