From 337f529afdfaa65a11157644ba2d812432042cc0 Mon Sep 17 00:00:00 2001 From: Ryan Date: Fri, 11 Apr 2025 03:21:09 -0400 Subject: [PATCH] fix drag-drop, UI glitches, & update validation --- CHANGELOG.md | 13 +++++++++++++ addUser.php | 2 +- copyFiles.php | 4 ++-- createFolder.php | 4 ++-- createFolderShareLink.php | 12 +++++++++++- createShareLink.php | 12 +++++++++++- deleteFiles.php | 4 ++-- deleteFolder.php | 2 +- deleteTrashFiles.php | 2 +- download.php | 2 +- downloadZip.php | 4 ++-- extractZip.php | 4 ++-- getFileList.php | 4 ++-- getFolderList.php | 2 +- getUsers.php | 2 +- index.html | 2 +- js/auth.js | 41 ++++++++++++++++++++++++++------------- js/authModals.js | 24 ++++++++++++++--------- js/fileDragDrop.js | 2 +- js/fileEditor.js | 2 +- js/fileListView.js | 2 +- js/fileMenu.js | 2 +- login_basic.php | 2 +- moveFiles.php | 4 ++-- removeChunks.php | 6 ++---- removeUser.php | 2 +- renameFile.php | 4 ++-- renameFolder.php | 2 +- restoreFiles.php | 2 +- saveFile.php | 2 +- saveFileTag.php | 12 +++++++++++- totp_recover.php | 2 +- totp_saveCode.php | 2 +- updateUserPermissions.php | 27 ++++++++++++++++++++++++-- upload.php | 17 ++++++++++------ uploadToSharedFolder.php | 2 -- 36 files changed, 161 insertions(+), 73 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f1cfc67..076fb15 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,18 @@ # Changelog +## Changes 4/11/2025 + +- Fixed fileDragDrop issue from previous update. +- Fixed User Panel height changing unexpectedly on mouse over. +- Improved JS file comments for better documentation. +- Fixed userPermissions not updating after initial setting. +- Disabled folder and file sharing for readOnly users. +- Moved change password close button to the top right of the modal. +- Updated upload regex pattern to be Unicode‑enabled and added additional security measures. [(#19)](https://github.com/error311/FileRise/issues/19) +- Updated filename, folder, and username regex acceptance patterns. + +--- + ## Shift Key Multi‑Selection Changes 4/10/2025 v1.1.1 - **Implemented Range Selection:** diff --git a/addUser.php b/addUser.php index fe9d78a..cc8aba2 100644 --- a/addUser.php +++ b/addUser.php @@ -49,7 +49,7 @@ if (!$newUsername || !$newPassword) { } // Validate username using preg_match (allow letters, numbers, underscores, dashes, and spaces). -if (!preg_match('/^[A-Za-z0-9_\- ]+$/', $newUsername)) { +if (!preg_match('/^[\p{L}\p{N}_\- ]+$/u', $newUsername)) { echo json_encode(["error" => "Invalid username. Only letters, numbers, underscores, dashes, and spaces are allowed."]); exit; } diff --git a/copyFiles.php b/copyFiles.php index e9e368c..7da5952 100644 --- a/copyFiles.php +++ b/copyFiles.php @@ -44,7 +44,7 @@ $destinationFolder = trim($data['destination']); $files = $data['files']; // Validate folder names: allow letters, numbers, underscores, dashes, spaces, and forward slashes. -$folderPattern = '/^[A-Za-z0-9_\- \/]+$/'; +$folderPattern = '/^[\p{L}\p{N}_\-\s\/\\\\]+$/u'; if ($sourceFolder !== 'root' && !preg_match($folderPattern, $sourceFolder)) { echo json_encode(["error" => "Invalid source folder name."]); exit; @@ -104,7 +104,7 @@ $destMetadata = file_exists($destMetaFile) ? json_decode(file_get_contents($dest $errors = []; // Define a safe file name pattern: letters, numbers, underscores, dashes, dots, parentheses, and spaces. -$safeFileNamePattern = '/^[A-Za-z0-9_\-\.\(\) ]+$/'; +$safeFileNamePattern = '/^[\p{L}\p{N}\p{M}%\-\.\(\) _]+$/u'; foreach ($files as $fileName) { // Save the original name for metadata lookup. diff --git a/createFolder.php b/createFolder.php index ed21c1b..2cdc9ba 100644 --- a/createFolder.php +++ b/createFolder.php @@ -45,13 +45,13 @@ $folderName = trim($input['folderName']); $parent = isset($input['parent']) ? trim($input['parent']) : ""; // Basic sanitation: allow only letters, numbers, underscores, dashes, and spaces in folderName -if (!preg_match('/^[A-Za-z0-9_\- ]+$/', $folderName)) { +if (!preg_match('/^[\p{L}\p{N}_\-\s\/\\\\]+$/u', $folderName)) { echo json_encode(['success' => false, 'error' => 'Invalid folder name.']); exit; } // Optionally, sanitize the parent folder if needed. -if ($parent && !preg_match('/^[A-Za-z0-9_\- \/]+$/', $parent)) { +if ($parent && !preg_match('/^[\p{L}\p{N}_\-\s\/\\\\]+$/u', $parent)) { echo json_encode(['success' => false, 'error' => 'Invalid parent folder name.']); exit; } diff --git a/createFolderShareLink.php b/createFolderShareLink.php index ef3d9c1..885ed4d 100644 --- a/createFolderShareLink.php +++ b/createFolderShareLink.php @@ -10,6 +10,16 @@ if (!$input) { exit; } +$username = $_SESSION['username'] ?? ''; +$userPermissions = loadUserPermissions($username); +if ($username) { + $userPermissions = loadUserPermissions($username); + if (isset($userPermissions['readOnly']) && $userPermissions['readOnly'] === true) { + echo json_encode(["error" => "Read-only users are not allowed to create shared folders."]); + exit(); + } +} + $folder = isset($input['folder']) ? trim($input['folder']) : ""; $expirationMinutes = isset($input['expirationMinutes']) ? intval($input['expirationMinutes']) : 60; $password = isset($input['password']) ? $input['password'] : ""; @@ -17,7 +27,7 @@ $allowUpload = isset($input['allowUpload']) ? intval($input['allowUpload']) : 0; // Validate folder name using regex. // Allow letters, numbers, underscores, hyphens, spaces and slashes. -if ($folder !== 'root' && !preg_match('/^[A-Za-z0-9_\- \/]+$/', $folder)) { +if ($folder !== 'root' && !preg_match('/^[\p{L}\p{N}_\-\s\/\\\\]+$/u', $folder)) { echo json_encode(["error" => "Invalid folder name."]); exit; } diff --git a/createShareLink.php b/createShareLink.php index 9b21411..9d754ab 100644 --- a/createShareLink.php +++ b/createShareLink.php @@ -9,13 +9,23 @@ if (!$input) { exit; } +$username = $_SESSION['username'] ?? ''; +$userPermissions = loadUserPermissions($username); +if ($username) { + $userPermissions = loadUserPermissions($username); + if (isset($userPermissions['readOnly']) && $userPermissions['readOnly'] === true) { + echo json_encode(["error" => "Read-only users are not allowed to create share files."]); + exit(); + } +} + $folder = isset($input['folder']) ? trim($input['folder']) : ""; $file = isset($input['file']) ? basename($input['file']) : ""; $expirationMinutes = isset($input['expirationMinutes']) ? intval($input['expirationMinutes']) : 60; $password = isset($input['password']) ? $input['password'] : ""; // Validate folder using regex. -if ($folder !== 'root' && !preg_match('/^[A-Za-z0-9_\- \/]+$/', $folder)) { +if ($folder !== 'root' && !preg_match('/^[\p{L}\p{N}_\-\s\/\\\\]+$/u', $folder)) { echo json_encode(["error" => "Invalid folder name."]); exit; } diff --git a/deleteFiles.php b/deleteFiles.php index 70dfbd9..4083cdd 100644 --- a/deleteFiles.php +++ b/deleteFiles.php @@ -69,7 +69,7 @@ if (!isset($data['files']) || !is_array($data['files'])) { $folder = isset($data['folder']) ? trim($data['folder']) : 'root'; // Validate folder: allow letters, numbers, underscores, dashes, spaces, and forward slashes -if ($folder !== 'root' && !preg_match('/^[A-Za-z0-9_\- \/]+$/', $folder)) { +if ($folder !== 'root' && !preg_match('/^[\p{L}\p{N}_\-\s\/\\\\]+$/u', $folder)) { echo json_encode(["error" => "Invalid folder name."]); exit; } @@ -96,7 +96,7 @@ $movedFiles = []; $errors = []; // Define a safe file name pattern: allow letters, numbers, underscores, dashes, dots, and spaces. -$safeFileNamePattern = '/^[A-Za-z0-9_\-\.\(\) ]+$/'; +$safeFileNamePattern = '/^[\p{L}\p{N}\p{M}%\-\.\(\) _]+$/u'; foreach ($data['files'] as $fileName) { $basename = basename(trim($fileName)); diff --git a/deleteFolder.php b/deleteFolder.php index a8e47de..1c3ce9e 100644 --- a/deleteFolder.php +++ b/deleteFolder.php @@ -50,7 +50,7 @@ if ($folderName === 'root') { } // Allow letters, numbers, underscores, dashes, spaces, and forward slashes. -if (!preg_match('/^[A-Za-z0-9_\- \/]+$/', $folderName)) { +if (!preg_match('/^[\p{L}\p{N}_\-\s\/\\\\]+$/u', $folderName)) { echo json_encode(['success' => false, 'error' => 'Invalid folder name.']); exit; } diff --git a/deleteTrashFiles.php b/deleteTrashFiles.php index 1727bfc..717e62a 100644 --- a/deleteTrashFiles.php +++ b/deleteTrashFiles.php @@ -62,7 +62,7 @@ $deletedFiles = []; $errors = []; // Define a safe file name pattern. -$safeFileNamePattern = '/^[A-Za-z0-9_\-\.\(\) ]+$/'; +$safeFileNamePattern = '/^[\p{L}\p{N}\p{M}%\-\.\(\) _]+$/u'; foreach ($filesToDelete as $trashName) { $trashName = trim($trashName); diff --git a/download.php b/download.php index 2ec11cf..85ba9d2 100644 --- a/download.php +++ b/download.php @@ -14,7 +14,7 @@ $file = isset($_GET['file']) ? basename($_GET['file']) : ''; $folder = isset($_GET['folder']) ? trim($_GET['folder']) : 'root'; // Validate file name (allowing letters, numbers, underscores, dashes, dots, and parentheses) -if (!preg_match('/^[A-Za-z0-9_\-\.\(\) ]+$/', $file)) { +if (!preg_match('/^[\p{L}\p{N}\p{M}%\-\.\(\) _]+$/u', $file)) { http_response_code(400); echo json_encode(["error" => "Invalid file name."]); exit; diff --git a/downloadZip.php b/downloadZip.php index 714af1d..4b046b8 100644 --- a/downloadZip.php +++ b/downloadZip.php @@ -38,7 +38,7 @@ $files = $data['files']; if ($folder !== "root") { $parts = explode('/', $folder); foreach ($parts as $part) { - if (empty($part) || $part === '.' || $part === '..' || !preg_match('/^[A-Za-z0-9_\-\.\(\) ]+$/', $part)) { + if (empty($part) || $part === '.' || $part === '..' || !preg_match('/^[\p{L}\p{N}_\-\s\/\\\\]+$/u', $part)) { http_response_code(400); header('Content-Type: application/json'); echo json_encode(["error" => "Invalid folder name."]); @@ -76,7 +76,7 @@ if (empty($files)) { } foreach ($files as $fileName) { - if (!preg_match('/^[A-Za-z0-9_\-\.\(\) ]+$/', $fileName)) { + if (!preg_match('/^[\p{L}\p{N}\p{M}%\-\.\(\) _]+$/u', $fileName)) { http_response_code(400); header('Content-Type: application/json'); echo json_encode(["error" => "Invalid file name: " . $fileName]); diff --git a/extractZip.php b/extractZip.php index 2d71271..f6c6848 100644 --- a/extractZip.php +++ b/extractZip.php @@ -50,7 +50,7 @@ if (empty($files)) { if ($folder !== "root") { $parts = explode('/', $folder); foreach ($parts as $part) { - if (empty($part) || $part === '.' || $part === '..' || !preg_match('/^[A-Za-z0-9_\-\.\(\) ]+$/', $part)) { + if (empty($part) || $part === '.' || $part === '..' || !preg_match('/^[\p{L}\p{N}_\-\s\/\\\\]+$/u', $part)) { http_response_code(400); echo json_encode(["error" => "Invalid folder name."]); exit; @@ -92,7 +92,7 @@ $destMetadata = file_exists($destMetaFile) ? json_decode(file_get_contents($dest $errors = []; $allSuccess = true; $extractedFiles = array(); // Array to collect names of extracted files -$safeFileNamePattern = '/^[A-Za-z0-9_\-\.\(\) ]+$/'; +$safeFileNamePattern = '/^[\p{L}\p{N}\p{M}%\-\.\(\) _]+$/u'; // ---------- Process Each File ---------- foreach ($files as $zipFileName) { diff --git a/getFileList.php b/getFileList.php index 324d61d..f44dbd8 100644 --- a/getFileList.php +++ b/getFileList.php @@ -14,7 +14,7 @@ if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) { $folder = isset($_GET['folder']) ? trim($_GET['folder']) : 'root'; // Allow only safe characters in the folder parameter (letters, numbers, underscores, dashes, spaces, and forward slashes). -if ($folder !== 'root' && !preg_match('/^[A-Za-z0-9_\- \/]+$/', $folder)) { +if ($folder !== 'root' && !preg_match('/^[\p{L}\p{N}_\-\s\/\\\\]+$/u', $folder)) { echo json_encode(["error" => "Invalid folder name."]); exit; } @@ -53,7 +53,7 @@ $files = array_values(array_diff(scandir($directory), array('.', '..'))); $fileList = []; // Define a safe file name pattern: letters, numbers, underscores, dashes, dots, parentheses, and spaces. -$safeFileNamePattern = '/^[A-Za-z0-9_\-\.\(\) ]+$/'; +$safeFileNamePattern = '/^[\p{L}\p{N}\p{M}%\-\.\(\) _]+$/u'; foreach ($files as $file) { // Skip hidden files (those that begin with a dot) diff --git a/getFolderList.php b/getFolderList.php index c97ef7f..a477b71 100644 --- a/getFolderList.php +++ b/getFolderList.php @@ -20,7 +20,7 @@ function getSubfolders($dir, $relative = '') { $folders = []; $items = scandir($dir); // Allow letters, numbers, underscores, dashes, and spaces in folder names. - $safeFolderNamePattern = '/^[A-Za-z0-9_\- ]+$/'; + $safeFolderNamePattern = '/^[\p{L}\p{N}_\-\s\/\\\\]+$/u'; foreach ($items as $item) { if ($item === '.' || $item === '..') continue; if (!preg_match($safeFolderNamePattern, $item)) { diff --git a/getUsers.php b/getUsers.php index bc11f31..9bde782 100644 --- a/getUsers.php +++ b/getUsers.php @@ -17,7 +17,7 @@ if (file_exists($usersFile)) { $parts = explode(':', trim($line)); if (count($parts) >= 3) { // Validate username format: - if (preg_match('/^[A-Za-z0-9_\- ]+$/', $parts[0])) { + if (preg_match('/^[\p{L}\p{N}_\- ]+$/u', $parts[0])) { $users[] = [ "username" => $parts[0], "role" => trim($parts[2]) diff --git a/index.html b/index.html index e0aec12..436dbf4 100644 --- a/index.html +++ b/index.html @@ -413,7 +413,7 @@