diff --git a/code/rest/alien_controller.go b/code/rest/alien_controller.go index ab1649a..0e28da2 100644 --- a/code/rest/alien_controller.go +++ b/code/rest/alien_controller.go @@ -350,12 +350,12 @@ func (this *AlienController) FetchDownloadToken(writer http.ResponseWriter, requ // preview a file. func (this *AlienController) Preview(writer http.ResponseWriter, request *http.Request, uuid string, filename string) { - - this.alienService.PreviewOrDownload(writer, request, uuid, filename, false) + matter := this.alienService.ValidMatter(writer, request, uuid, filename) + this.alienService.PreviewOrDownload(writer, request, matter, false) } // download a file. func (this *AlienController) Download(writer http.ResponseWriter, request *http.Request, uuid string, filename string) { - - this.alienService.PreviewOrDownload(writer, request, uuid, filename, true) + matter := this.alienService.ValidMatter(writer, request, uuid, filename) + this.alienService.PreviewOrDownload(writer, request, matter, true) } diff --git a/code/rest/alien_service.go b/code/rest/alien_service.go index 63983e1..271c73c 100644 --- a/code/rest/alien_service.go +++ b/code/rest/alien_service.go @@ -19,6 +19,7 @@ type AlienService struct { shareService *ShareService imageCacheDao *ImageCacheDao imageCacheService *ImageCacheService + spaceService *SpaceService } func (this *AlienService) Init() { @@ -63,14 +64,18 @@ func (this *AlienService) Init() { if c, ok := b.(*ImageCacheService); ok { this.imageCacheService = c } + b = core.CONTEXT.GetBean(this.spaceService) + if c, ok := b.(*SpaceService); ok { + this.spaceService = c + } } -func (this *AlienService) PreviewOrDownload( +// check whether the request params ok. +func (this *AlienService) ValidMatter( writer http.ResponseWriter, request *http.Request, uuid string, - filename string, - withContentDisposition bool) { + filename string) *Matter { matter := this.matterDao.CheckByUuid(uuid) @@ -104,18 +109,28 @@ func (this *AlienService) PreviewOrDownload( } else { + //whether this is myself's matter. operator := this.findUser(request) + if operator == nil { + panic(result.BadRequest("no auth")) + } - //use share code to auth. - shareUuid := request.FormValue("shareUuid") - shareCode := request.FormValue("shareCode") - shareRootUuid := request.FormValue("shareRootUuid") - - this.shareService.ValidateMatter(request, shareUuid, shareCode, operator, shareRootUuid, matter) + if matter.SpaceUuid != operator.SpaceUuid { + //whether user has the space's read auth. + this.spaceService.CheckReadableByUuid(request, operator, matter.SpaceUuid) + } } } + return matter +} +func (this *AlienService) PreviewOrDownload( + writer http.ResponseWriter, + request *http.Request, + matter *Matter, + withContentDisposition bool, +) { //download directory if matter.Dir { @@ -145,7 +160,6 @@ func (this *AlienService) PreviewOrDownload( //async increase the download times. go core.RunWithRecovery(func() { - this.matterDao.TimesIncrement(uuid) + this.matterDao.TimesIncrement(matter.Uuid) }) - } diff --git a/code/rest/base_controller.go b/code/rest/base_controller.go index 790ca26..aa77079 100644 --- a/code/rest/base_controller.go +++ b/code/rest/base_controller.go @@ -99,6 +99,49 @@ func (this *BaseController) Wrap(f func(writer http.ResponseWriter, request *htt } } +// wrap the handle method without result. +func (this *BaseController) WrapPure(f func(writer http.ResponseWriter, request *http.Request), qualifiedRole string) func(w http.ResponseWriter, r *http.Request) { + + return func(writer http.ResponseWriter, request *http.Request) { + + var webResult *result.WebResult = nil + + //if the api not annotated with GUEST. login is required. + if qualifiedRole != USER_ROLE_GUEST { + user := this.checkUser(request) + + if user.Status == USER_STATUS_DISABLED { + //check user's status + webResult = result.CustomWebResultI18n(request, result.USER_DISABLED, i18n.UserDisabled) + } else { + if qualifiedRole == USER_ROLE_ADMINISTRATOR && user.Role != USER_ROLE_ADMINISTRATOR { + webResult = result.ConstWebResult(result.UNAUTHORIZED) + } + } + + } + + //if webResult not nil. response a json. if webResult is nil, return empty body or binary content. + if webResult != nil { + + writer.Header().Set("Content-Type", "application/json;charset=UTF-8") + + b, err := jsoniter.ConfigCompatibleWithStandardLibrary.Marshal(webResult) + + this.PanicError(err) + + writer.WriteHeader(result.FetchHttpStatus(webResult.Code)) + + _, err = fmt.Fprintf(writer, string(b)) + this.PanicError(err) + } + + //no error. + f(writer, request) + + } +} + // response a success result. 1.string 2. WebResult 3.nil pointer 4.any type func (this *BaseController) Success(data interface{}) *result.WebResult { var webResult *result.WebResult = nil diff --git a/code/rest/share_controller.go b/code/rest/share_controller.go index 2197c61..c34c42b 100644 --- a/code/rest/share_controller.go +++ b/code/rest/share_controller.go @@ -19,6 +19,7 @@ type ShareController struct { matterDao *MatterDao matterService *MatterService shareService *ShareService + alienService *AlienService } func (this *ShareController) Init() { @@ -49,6 +50,11 @@ func (this *ShareController) Init() { this.shareService = b } + b = core.CONTEXT.GetBean(this.alienService) + if b, ok := b.(*AlienService); ok { + this.alienService = b + } + } func (this *ShareController) RegisterRoutes() map[string]func(writer http.ResponseWriter, request *http.Request) { @@ -63,7 +69,9 @@ func (this *ShareController) RegisterRoutes() map[string]func(writer http.Respon routeMap["/api/share/browse"] = this.Wrap(this.Browse, USER_ROLE_GUEST) routeMap["/api/share/zip"] = this.Wrap(this.Zip, USER_ROLE_GUEST) - routeMap["/api/share/matter/page"] = this.Wrap(this.MatterPage, USER_ROLE_USER) + routeMap["/api/share/matter/page"] = this.Wrap(this.MatterPage, USER_ROLE_GUEST) + routeMap["/api/share/matter/preview"] = this.WrapPure(this.MatterPreview, USER_ROLE_GUEST) + routeMap["/api/share/matter/download"] = this.WrapPure(this.MatterDownload, USER_ROLE_GUEST) return routeMap } @@ -424,3 +432,25 @@ func (this *ShareController) MatterPage(writer http.ResponseWriter, request *htt return this.Success(pager) } + +func (this *ShareController) MatterPreviewOrDownload(writer http.ResponseWriter, request *http.Request, withContentDisposition bool) { + //auth by shareUuid. + matterUuid := util.ExtractRequestString(request, "matterUuid") + shareUuid := util.ExtractRequestString(request, "shareUuid") + shareCode := util.ExtractRequestString(request, "shareCode") + shareRootUuid := util.ExtractRequestString(request, "shareRootUuid") + + matter := this.matterDao.CheckByUuid(matterUuid) + operator := this.findUser(request) + + this.shareService.ValidateMatter(request, shareUuid, shareCode, operator, shareRootUuid, matter) + this.alienService.PreviewOrDownload(writer, request, matter, withContentDisposition) +} + +func (this *ShareController) MatterPreview(writer http.ResponseWriter, request *http.Request) { + this.MatterPreviewOrDownload(writer, request, false) +} + +func (this *ShareController) MatterDownload(writer http.ResponseWriter, request *http.Request) { + this.MatterPreviewOrDownload(writer, request, true) +}