k/downloadwf
1
Fork 0
Code Releases Activity

security

Browse Source
This commit is contained in:
Anaïs Saraiva
2026-08-15 00:28:32 +02:00
parent 5f201cf725
commit 954384d1e4
14 changed files with 393 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/smoke-test.sh
+12
View File
@@ -73,6 +73,18 @@ check "delete with key succeeds" \
check "file gone after delete" test \
"$(curl -sS -o /dev/null -w '%{http_code}' "$BASE$URL")" = "404"
echo
echo "-- password protection --"
check "upload with password" curl -sS -f -F "password=hunter2" -F "file=@$TMP/plain.txt" "$BASE/api/upload" > "$TMP/upP.json"
KP="$(get "$TMP/upP.json" key)"
check "protected file serves a password form" test \
"$(curl -sS -o /dev/null -w '%{content_type}' "$BASE/d/$KP")" = "text/html; charset=utf-8"
check "wrong password is rejected" test \
"$(curl -sS -o /dev/null -w '%{http_code}' -X POST -d 'password=nope' "$BASE/api/auth/$KP")" = "302"
check "correct password returns redirect" curl -sS -c "$TMP/cj.txt" -X POST -d "password=hunter2" "$BASE/api/auth/$KP" >/dev/null
curl -sS -b "$TMP/cj.txt" -o "$TMP/downP.txt" "$BASE/d/$KP"
check "download with cookie matches" cmp "$TMP/plain.txt" "$TMP/downP.txt"
echo
echo "passed: $pass, failed: $fail"
[ "$fail" -eq 0 ] || exit 1