www: handle access failures in file browser

Don't show the content of the cgi-bin folder when the selected path cannot be accessed.
marcone · Mar 25, 2024 · b18351c · b18351c
1 parent 4958c23
commit b18351c
Show file tree

Hide file tree

Showing 3 changed files with 47 additions and 19 deletions.
diff --git a/teslausb-www/html/cgi-bin/ls.sh b/teslausb-www/html/cgi-bin/ls.sh
@@ -10,7 +10,10 @@ do
   urlargs[i]="$(echo -e "${val//%/\\x}")"
 done
 
-cd "$DOCUMENT_ROOT/${urlargs[0]}"
+if ! cd "$DOCUMENT_ROOT/${urlargs[0]}"
+then
+  exit
+fi
 
 lspath="${urlargs[@]:1}"
 if [[ -z "$lspath" ]]

diff --git a/teslausb-www/html/filebrowser.css b/teslausb-www/html/filebrowser.css
@@ -394,6 +394,11 @@ details > ul.fb-droptarget {
   border: none;
   padding: 0;
   z-index: 3;
+  display: none;
+}
+
+.fb-barbutton.fb-visiblebarbutton {
+  display: block;
 }
 
 .fb-trashbutton {

diff --git a/teslausb-www/html/filebrowser.js b/teslausb-www/html/filebrowser.js
@@ -277,18 +277,27 @@ class FileBrowser {
   }
 
   showButton(name, show) {
-    this.buttonbar.querySelector(name).style.display =
-      show ? "block" : "none";
+    if (show) {
+      this.buttonbar.querySelector(name).classList.add("fb-visiblebarbutton");
+    } else {
+      this.buttonbar.querySelector(name).classList.remove("fb-visiblebarbutton");
+    }
   }
 
   updateButtonBar() {
-    var numsel = this.numSelected();
-    this.showButton(".fb-trashbutton", numsel > 0);
-    this.showButton(".fb-pencilbutton", numsel == 1);
-    this.showButton(".fb-uploadbutton", numsel == 0);
-    this.showButton(".fb-downloadbutton", numsel > 0);
-    this.showButton(".fb-newfolderbutton", numsel == 0);
-    this.showButton(".fb-locksoundbutton", numsel == 1 && this.isPotentialLockChime(this.selection()[0]));
+    const numsel = this.numSelected();
+    const enabled = this.valid;
+    this.showButton(".fb-trashbutton", enabled && numsel > 0);
+    this.showButton(".fb-pencilbutton", enabled && numsel == 1);
+    this.showButton(".fb-uploadbutton", enabled && numsel == 0);
+    this.showButton(".fb-downloadbutton", enabled && numsel > 0);
+    this.showButton(".fb-newfolderbutton", enabled && numsel == 0);
+    this.showButton(".fb-locksoundbutton", enabled && numsel == 1 && this.isPotentialLockChime(this.selection()[0]));
+    if (this.buttonbar.querySelector(".fb-visiblebarbutton") == null) {
+      this.buttonbar.style.display = "none";
+    } else {
+      this.buttonbar.style.display = "block";
+    }
   }
 
   eventCoordinates(e) {
@@ -353,7 +362,7 @@ class FileBrowser {
 
   showContextMenu(event) {
     this.log("context menu");
-    if (event.ctrlKey) {
+    if (!this.valid || event.ctrlKey) {
       this.hideContextMenu();
       return;
     }
@@ -547,7 +556,7 @@ class FileBrowser {
 
   listPointerDown(event) {
     /* only respond to left mouse button */
-    if (event.button != 0) {
+    if (!this.valid || event.button != 0) {
       event.preventDefault();
       return;
     }
@@ -677,12 +686,18 @@ class FileBrowser {
     var request = new XMLHttpRequest();
     request.open('GET', url);
     request.onreadystatechange = function () {
-      if (request.readyState === XMLHttpRequest.DONE && request.status === 200) {
-        var type = request.getResponseHeader('Content-Type');
-        if (type.indexOf("text") !== 1) {
-          if (callback != null) {
-            callback(request.responseText, callbackarg);
+      if (request.readyState === XMLHttpRequest.DONE) {
+        if (request.status === 200) {
+          var type = request.getResponseHeader('Content-Type');
+          if (type.indexOf("text") !== 1) {
+            if (callback != null) {
+              callback(request.responseText, callbackarg);
+            }
           }
+        } else if (request.status > 400) {
+            if (callback != null) {
+              callback(null, null);
+            }
         }
       }
     }
@@ -741,15 +756,20 @@ class FileBrowser {
     switchtopath=true: update the right-hand side
   */
   readPaths(path, paths, switchtopath) {
-    paths = paths.trimEnd();
+    this.valid = (paths != null && switchtopath != null);
+    if (!this.valid) {
+      var pathdiv = this.anchor_elem.querySelector(".fb-dirpath");
+      pathdiv.innerText = "<< error retrieving file list >>";
+    }
+    paths = this.valid ? paths.trimEnd() : "";
     var root = this.anchor_elem.querySelector(".fb-tree");
     root.dataset.fullpath=".";
     this.addCommonDragHooks(root);
     if (path == "." && !switchtopath) {
       root.innerHTML = '';
     }
     var lines = paths.split('\n');
-    if (switchtopath) {
+    if (! this.valid || switchtopath) {
       this.anchor_elem.querySelector('.fb-fileslist').querySelectorAll(".fb-direntry,.fb-fileentry").forEach((entry) => entry.remove());
     }
     for (var line of lines) {