Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 11 additions & 6 deletions app/api/webdav/[...path]/route.ts
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ async function handle(

const requestUrl = new URL(req.url);
let endpoint = requestUrl.searchParams.get("endpoint");
let proxy_method = requestUrl.searchParams.get("proxy_method") || req.method;

// Validate the endpoint to prevent potential SSRF attacks
if (
Expand Down Expand Up @@ -65,7 +66,11 @@ async function handle(
const targetPath = `${endpoint}${endpointPath}`;

// only allow MKCOL, GET, PUT
if (req.method !== "MKCOL" && req.method !== "GET" && req.method !== "PUT") {
if (
proxy_method !== "MKCOL" &&
proxy_method !== "GET" &&
proxy_method !== "PUT"
) {
return NextResponse.json(
{
error: true,
Expand All @@ -78,7 +83,7 @@ async function handle(
}

// for MKCOL request, only allow request ${folder}
if (req.method === "MKCOL" && !targetPath.endsWith(folder)) {
if (proxy_method === "MKCOL" && !targetPath.endsWith(folder)) {
return NextResponse.json(
{
error: true,
Expand All @@ -91,7 +96,7 @@ async function handle(
}

// for GET request, only allow request ending with fileName
if (req.method === "GET" && !targetPath.endsWith(fileName)) {
if (proxy_method === "GET" && !targetPath.endsWith(fileName)) {
return NextResponse.json(
{
error: true,
Expand All @@ -104,7 +109,7 @@ async function handle(
}

// for PUT request, only allow request ending with fileName
if (req.method === "PUT" && !targetPath.endsWith(fileName)) {
if (proxy_method === "PUT" && !targetPath.endsWith(fileName)) {
return NextResponse.json(
{
error: true,
Expand All @@ -118,7 +123,7 @@ async function handle(

const targetUrl = targetPath;

const method = req.method;
const method = proxy_method || req.method;
const shouldNotHaveBody = ["get", "head"].includes(
method?.toLowerCase() ?? "",
);
Expand All @@ -143,7 +148,7 @@ async function handle(
"[Any Proxy]",
targetUrl,
{
method: req.method,
method: method,
},
{
status: fetchResult?.status,
Expand Down
1 change: 1 addition & 0 deletions app/components/chat.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -1506,6 +1506,7 @@ function _Chat() {
)}
<div className={styles["chat-message-item"]}>
<Markdown
key={message.streaming ? "loading" : "done"}
content={getMessageTextContent(message)}
loading={
(message.preview || message.streaming) &&
Expand Down
14 changes: 11 additions & 3 deletions app/utils/cloud/webdav.ts
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,8 @@ export function createWebDavClient(store: SyncStore) {
return {
async check() {
try {
const res = await fetch(this.path(folder, proxyUrl), {
method: "MKCOL",
const res = await fetch(this.path(folder, proxyUrl, "MKCOL"), {
method: "GET",
headers: this.headers(),
});
const success = [201, 200, 404, 405, 301, 302, 307, 308].includes(
Expand All @@ -42,6 +42,10 @@ export function createWebDavClient(store: SyncStore) {

console.log("[WebDav] get key = ", key, res.status, res.statusText);

if (404 == res.status) {
return "";
}

return await res.text();
},

Expand All @@ -62,7 +66,7 @@ export function createWebDavClient(store: SyncStore) {
authorization: `Basic ${auth}`,
};
},
path(path: string, proxyUrl: string = "") {
path(path: string, proxyUrl: string = "", proxyMethod: string = "") {
if (path.startsWith("/")) {
path = path.slice(1);
}
Expand All @@ -78,9 +82,13 @@ export function createWebDavClient(store: SyncStore) {
let u = new URL(proxyUrl + pathPrefix + path);
// add query params
u.searchParams.append("endpoint", config.endpoint);
proxyMethod && u.searchParams.append("proxy_method", proxyMethod);
url = u.toString();
} catch (e) {
url = pathPrefix + path + "?endpoint=" + config.endpoint;
if (proxyMethod) {
url += "&proxy_method=" + proxyMethod;
}
}

return url;
Expand Down