From e2c746aec89bbda8671696377ec2a5f004b3afed Mon Sep 17 00:00:00 2001
From: mstmdev <mstmdev@gmail.com>
Date: Wed, 1 Dec 2021 03:59:04 +0800
Subject: [PATCH] The file server allows anonymous access if there is no
 effective account from server_users flag.

---
 cmd/gofs/flag.go               |  2 +-
 server/fs/file_server.go       | 14 ++++++++++----
 server/fs/gin_file_server.go   | 12 +++++++++---
 server/middleware/auth/auth.go |  8 ++++++++
 server/server.go               |  4 ++++
 5 files changed, 32 insertions(+), 8 deletions(-)

diff --git a/cmd/gofs/flag.go b/cmd/gofs/flag.go
index dbd3f00e..ce717c72 100644
--- a/cmd/gofs/flag.go
+++ b/cmd/gofs/flag.go
@@ -69,7 +69,7 @@ func parseFlags() {
 	flag.BoolVar(&fileServer, "server", false, "start a file server to browse source directory and target directory")
 	flag.StringVar(&fileServerAddr, "server_addr", server.DefaultAddrHttps, "a file server binding address")
 	flag.BoolVar(&fileServerTLS, "server_tls", true, fmt.Sprintf("enable https for file server, if disable it, server_addr is \"%s\" default", server.DefaultAddrHttp))
-	flag.StringVar(&fileServerUsers, "server_users", "", "the file server users, format like this, user1|password1,user2|password2")
+	flag.StringVar(&fileServerUsers, "server_users", "", "the file server accounts, the file server allows anonymous access if there is no effective account, format like this, user1|password1,user2|password2")
 	flag.StringVar(&fileServerTemplate, "server_tmpl", "./template/*.html", "the file server template pattern")
 	flag.StringVar(&certFile, "tls_cert_file", "gofs.pem", "cert file for https connections")
 	flag.StringVar(&keyFile, "tls_key_file", "gofs.key", "key file for https connections")
diff --git a/server/fs/file_server.go b/server/fs/file_server.go
index fddbc479..74242ae2 100644
--- a/server/fs/file_server.go
+++ b/server/fs/file_server.go
@@ -31,7 +31,13 @@ func StartFileServer(src core.VFS, target core.VFS, addr string, init retry.Wait
 		return err
 	}
 
-	http.Handle("/", auth.Auth(handler.NewDefaultHandler(serverTemplate), store))
+	authFunc := auth.Auth
+	if len(users) == 0 {
+		server.PrintAnonymousAccessWarning()
+		authFunc = auth.NoAuth
+	}
+
+	http.Handle("/", authFunc(handler.NewDefaultHandler(serverTemplate), store))
 
 	http.HandleFunc(server.LoginIndexFullRoute, func(writer http.ResponseWriter, request *http.Request) {
 		t.ExecuteTemplate(writer, "login.html", nil)
@@ -40,17 +46,17 @@ func StartFileServer(src core.VFS, target core.VFS, addr string, init retry.Wait
 	http.Handle(server.LoginRoute+server.LoginSignInRoute, auth.NewLoginHandler(store, users))
 
 	if src.IsDisk() || src.Is(core.RemoteDisk) {
-		http.Handle(server.SrcRoutePrefix, auth.Auth(http.StripPrefix(server.SrcRoutePrefix, http.FileServer(http.Dir(src.Path()))), store))
+		http.Handle(server.SrcRoutePrefix, authFunc(http.StripPrefix(server.SrcRoutePrefix, http.FileServer(http.Dir(src.Path()))), store))
 		enableFileApi = true
 	}
 
 	if target.IsDisk() {
-		http.Handle(server.TargetRoutePrefix, auth.Auth(http.StripPrefix(server.TargetRoutePrefix, http.FileServer(http.Dir(target.Path()))), store))
+		http.Handle(server.TargetRoutePrefix, authFunc(http.StripPrefix(server.TargetRoutePrefix, http.FileServer(http.Dir(target.Path()))), store))
 		enableFileApi = true
 	}
 
 	if enableFileApi {
-		http.Handle(server.QueryRoute, auth.Auth(handler.NewFileApiHandler(http.Dir(src.Path())), store))
+		http.Handle(server.QueryRoute, authFunc(handler.NewFileApiHandler(http.Dir(src.Path())), store))
 	}
 
 	log.Log("file server [%s] starting...", addr)
diff --git a/server/fs/gin_file_server.go b/server/fs/gin_file_server.go
index 8bbf6ba2..ccf27976 100644
--- a/server/fs/gin_file_server.go
+++ b/server/fs/gin_file_server.go
@@ -55,9 +55,15 @@ func StartFileServer(src core.VFS, target core.VFS, addr string, init retry.Wait
 		auth.NewLoginHandler(store, users).ServeHTTP(context.Writer, context.Request)
 	})
 
-	rootGroup := engine.Group("/").Use(func(context *gin.Context) {
-		auth.Auth(nil, store).ServeHTTP(context.Writer, context.Request)
-	})
+	rootGroup := engine.Group("/")
+
+	if len(users) > 0 {
+		rootGroup.Use(func(context *gin.Context) {
+			auth.Auth(nil, store).ServeHTTP(context.Writer, context.Request)
+		})
+	} else {
+		server.PrintAnonymousAccessWarning()
+	}
 
 	rootGroup.GET("/", func(context *gin.Context) {
 		handler.NewDefaultHandler(serverTemplate).ServeHTTP(context.Writer, context.Request)
diff --git a/server/middleware/auth/auth.go b/server/middleware/auth/auth.go
index 417061c1..f8ab76ed 100644
--- a/server/middleware/auth/auth.go
+++ b/server/middleware/auth/auth.go
@@ -19,3 +19,11 @@ func Auth(h http.Handler, store sessions.Store) http.HandlerFunc {
 		}
 	}
 }
+
+func NoAuth(h http.Handler, store sessions.Store) http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		if h != nil {
+			h.ServeHTTP(writer, request)
+		}
+	}
+}
diff --git a/server/server.go b/server/server.go
index 0555c169..eeee2143 100644
--- a/server/server.go
+++ b/server/server.go
@@ -76,3 +76,7 @@ func GenerateAddr(scheme, host string, port int) string {
 	}
 	return addr
 }
+
+func PrintAnonymousAccessWarning() {
+	log.Warn("the file server allows anonymous access, you should set some server users for security reasons")
+}