v1.14.2

if files (one or more) are selected for sharing, then
a virtual folder is created to hold the selected files

if a single file is selected for sharing, then
the returned URL will point directly to that file

and fix some shares-related bugs:
* password coalescing
* log-spam on reload

README.md

@@ -42,6 +42,7 @@ turn almost any device into a file server with resumable uploads/downloads using
         * [self-destruct](#self-destruct) - uploads can be given a lifetime
         * [race the beam](#race-the-beam) - download files while they're still uploading ([demo video](http://a.ocv.me/pub/g/nerd-stuff/cpp/2024-0418-race-the-beam.webm))
     * [file manager](#file-manager) - cut/paste, rename, and delete files/folders (if you have permission)
+    * [shares](#shares) - share a file or folder by creating a temporary link
     * [batch rename](#batch-rename) - select some files and press `F2` to bring up the rename UI
     * [media player](#media-player) - plays almost every audio format there is
         * [audio equalizer](#audio-equalizer) - and [dynamic range compressor](https://en.wikipedia.org/wiki/Dynamic_range_compression)
@@ -76,6 +77,7 @@ turn almost any device into a file server with resumable uploads/downloads using
         * [upload events](#upload-events) - the older, more powerful approach ([examples](./bin/mtag/))
     * [handlers](#handlers) - redefine behavior with plugins ([examples](./bin/handlers/))
     * [identity providers](#identity-providers) - replace copyparty passwords with oauth and such
+    * [user-changeable passwords](#user-changeable-passwords) - if permitted, users can change their own passwords
     * [using the cloud as storage](#using-the-cloud-as-storage) - connecting to an aws s3 bucket and similar
     * [hiding from google](#hiding-from-google) - tell search engines you dont wanna be indexed
     * [themes](#themes)
@@ -744,6 +746,40 @@ file selection: click somewhere on the line (not the link itsef), then:
 you can move files across browser tabs (cut in one tab, paste in another)
 
 
+## shares
+
+share a file or folder by creating a temporary link
+
+when enabled in the server settings (`--shr`), click the bottom-right `share` button to share the folder you're currently in, or alternatively:
+* select a folder first to share that folder instead
+* select one or more files to share only those files
+
+this feature was made with [identity providers](#identity-providers) in mind -- configure your reverseproxy to skip the IdP's access-control for a given URL prefix and use that to safely share specific files/folders sans the usual auth checks
+
+when creating a share, the creator can choose any of the following options:
+
+* password-protection
+* expire after a certain time; `0` or blank means infinite
+* allow visitors to upload (if the user who creates the share has write-access)
+
+semi-intentional limitations:
+
+* cleanup of expired shares only works when global option `e2d` is set, and/or at least one volume on the server has volflag `e2d`
+* only folders from the same volume are shared; if you are sharing a folder which contains other volumes, then the contents of those volumes will not be available
+* no option to "delete after first access" because tricky
+  * when linking something to discord (for example) it'll get accessed by their scraper and that would count as a hit
+  * browsers wouldn't be able to resume a broken download unless the requester's IP gets allowlisted for X minutes (ref. tricky)
+
+specify `--shr /foobar` to enable this feature; a toplevel virtual folder named `foobar` is then created, and that's where all the shares will be served from
+
+* you can name it whatever, `foobar` is just an example
+* if you're using config files, put `shr: /foobar` inside the `[global]` section instead
+
+users can delete their own shares in the controlpanel, and a list of privileged users (`--shr-adm`) are allowed to see and/or delet any share on the server
+
+**security note:** using this feature does not mean that you can skip the [accounts and volumes](#accounts-and-volumes) section -- you still need to restrict access to volumes that you do not intend to share with unauthenticated users! it is not sufficient to use rules in the reverseproxy to restrict access to just the `/share` folder.
+
+
 ## batch rename
 
 select some files and press `F2` to bring up the rename UI
@@ -1355,6 +1391,29 @@ there is a [docker-compose example](./docs/examples/docker/idp-authelia-traefik)
 
 a more complete example of the copyparty configuration options [look like this](./docs/examples/docker/idp/copyparty.conf)
 
+but if you just want to let users change their own passwords, then you probably want [user-changeable passwords](#user-changeable-passwords) instead
+
+
+## user-changeable passwords
+
+if permitted, users can change their own passwords  in the control-panel
+
+* not compatible with [identity providers](#identity-providers)
+
+* must be enabled with `--chpw` because account-sharing is a popular usecase
+
+  * if you want to enable the feature but deny password-changing for a specific list of accounts, you can do that with `--chpw-no name1,name2,name3,...`
+
+* to perform a password reset, edit the server config and give the user another password there, then do a [config reload](#server-config) or server restart
+
+* the custom passwords are kept in a textfile at filesystem-path `--chpw-db`, by default `chpw.json` in the copyparty config folder
+
+  * if you run multiple copyparty instances with different users you *almost definitely* want to specify separate DBs for each instance
+
+  * if [password hashing](#password-hashing) is enbled, the passwords in the db are also hashed
+
+    * ...which means that all user-defined passwords will be forgotten if you change password-hashing settings
+
 
 ## using the cloud as storage
 
@@ -1459,7 +1518,7 @@ some reverse proxies (such as [Caddy](https://caddyserver.com/)) can automatical
 * **warning:** nginx-QUIC (HTTP/3) is still experimental and can make uploads much slower, so HTTP/1.1 is recommended for now
 * depending on server/client, HTTP/1.1 can also be 5x faster than HTTP/2
 
-for improved security (and a tiny performance boost) consider listening on a unix-socket with `-i /tmp/party.sock` instead of `-i 127.0.0.1`
+for improved security (and a 10% performance boost) consider listening on a unix-socket with `-i unix:770:www:/tmp/party.sock` (permission `770` means only members of group `www` can access it)
 
 example webserver configs:
 
@@ -1900,7 +1959,7 @@ some notes on hardening
   * cors doesn't work right otherwise
 * if you allow anonymous uploads or otherwise don't trust the contents of a volume, you can prevent XSS with volflag `nohtml`
   * this returns html documents as plaintext, and also disables markdown rendering
-* when running behind a reverse-proxy, listen on a unix-socket with `-i /tmp/party.sock` instead of `-i 127.0.0.1` for tighter access control (plus you get a tiny performance boost for free)
+* when running behind a reverse-proxy, listen on a unix-socket for tighter access control (and more performance); see [reverse-proxy](#reverse-proxy) or `--help-bind`
 
 safety profiles:
 

bin/hooks/reloc-by-ext.py

@@ -2,11 +2,12 @@
 
 import json
 import os
+import re
 import sys
 
 
 _ = r"""
-relocate/redirect incoming uploads according to file extension
+relocate/redirect incoming uploads according to file extension or name
 
 example usage as global config:
     --xbu j,c1,bin/hooks/reloc-by-ext.py
@@ -52,11 +53,19 @@ def main():
     try:
         fn, ext = fn.rsplit(".", 1)
     except:
-        # no file extension; abort
-        return
+        # no file extension; pretend it's "bin"
+        ext = "bin"
 
     ext = ext.lower()
 
+    # this function must end by printing the action to perform;
+    # that's handled by the print(json.dumps(... at the bottom
+    #
+    # the action can contain the following keys:
+    # "vp" is the folder URL to move the upload to,
+    # "ap" is the filesystem-path to move it to (but "vp" is safer),
+    # "fn" overrides the final filename to use
+
     ##
     ## some example actions to take; pick one by
     ## selecting it inside the print at the end:
@@ -80,11 +89,37 @@ def main():
     elif ext in MUSIC.split():
         by_category = {"vp": "/just/tunes"}
     else:
-        by_category = {}
+        by_category = {}  # no action
 
-    # now choose the effect to apply; can be any of these:
+    # now choose the default effect to apply; can be any of these:
     # into_subfolder  into_toplevel  into_sibling  by_category
-    effect = into_subfolder
+    effect = {"vp": "/junk"}
+
+    ##
+    ## but we can keep going, adding more speicifc rules
+    ## which can take precedence, replacing the fallback
+    ## effect we just specified:
+    ##
+
+    fn = fn.lower()  # lowercase filename to make this easier
+
+    if "screenshot" in fn:
+        effect = {"vp": "/ss"}
+    if "mpv_" in fn:
+        effect = {"vp": "/anishots"}
+    elif "debian" in fn or "biebian" in fn:
+        effect = {"vp": "/linux-ISOs"}
+    elif re.search(r"ep(isode |\.)?[0-9]", fn):
+        effect = {"vp": "/podcasts"}
+
+    # regex lets you grab a part of the matching
+    # text and use that in the upload path:
+    m = re.search(r"\b(op|ed)([^a-z]|$)", fn)
+    if m:
+        # the regex matched; use "anime-op" or "anime-ed"
+        effect = {"vp": "/anime-" + m[1]}
+
+    # aaand DO IT
     print(json.dumps({"reloc": effect}))
 
 

bin/u2c.py

@@ -1,8 +1,8 @@
 #!/usr/bin/env python3
 from __future__ import print_function, unicode_literals
 
-S_VERSION = "1.22"
-S_BUILD_DT = "2024-08-08"
+S_VERSION = "1.23"
+S_BUILD_DT = "2024-08-22"
 
 """
 u2c.py: upload to copyparty
@@ -1236,7 +1236,7 @@ source file/folder selection uses rsync syntax, meaning that:
     ap.add_argument("-v", action="store_true", help="verbose")
     ap.add_argument("-a", metavar="PASSWD", help="password or $filepath")
     ap.add_argument("-s", action="store_true", help="file-search (disables upload)")
-    ap.add_argument("-x", type=unicode, metavar="REGEX", default="", help="skip file if filesystem-abspath matches REGEX, example: '.*/\\.hist/.*'")
+    ap.add_argument("-x", type=unicode, metavar="REGEX", action="append", help="skip file if filesystem-abspath matches REGEX (option can be repeated), example: '.*/\\.hist/.*'")
     ap.add_argument("--ok", action="store_true", help="continue even if some local files are inaccessible")
     ap.add_argument("--touch", action="store_true", help="if last-modified timestamps differ, push local to server (need write+delete perms)")
     ap.add_argument("--ow", action="store_true", help="overwrite existing files instead of autorenaming")
@@ -1283,6 +1283,8 @@ source file/folder selection uses rsync syntax, meaning that:
     if ar.dr:
         ar.ow = True
 
+    ar.x = "|".join(ar.x or [])
+
     for k in "dl dr drd".split():
         errs = []
         if ar.safe and getattr(ar, k):

contrib/package/arch/PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: icxes <dev.null@need.moe>
 pkgname=copyparty
-pkgver="1.13.6"
+pkgver="1.14.1"
 pkgrel=1
 pkgdesc="File server with accelerated resumable uploads, dedup, WebDAV, FTP, TFTP, zeroconf, media indexer, thumbnails++"
 arch=("any")
@@ -21,7 +21,7 @@ optdepends=("ffmpeg: thumbnails for videos, images (slower) and audio, music tag
 )
 source=("https://github.com/9001/${pkgname}/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz")
 backup=("etc/${pkgname}.d/init" )
-sha256sums=("abb9d0df24c4082594adc2070b7e9fb84a57733d0a3fbf83f4ec2a02813dd717")
+sha256sums=("fa813298122b643a1d131ba71e3c2895be8098ddd887175b166d0857454e809f")
 
 build() {
     cd "${srcdir}/${pkgname}-${pkgver}"

contrib/package/nix/copyparty/pin.json

@@ -1,5 +1,5 @@
 {
-    "url": "https://github.com/9001/copyparty/releases/download/v1.13.6/copyparty-sfx.py",
-    "version": "1.13.6",
-    "hash": "sha256-eQSHZYXIbS4piCU/zOyEz3E6V/lS6348vENMLwONYUM="
+    "url": "https://github.com/9001/copyparty/releases/download/v1.14.1/copyparty-sfx.py",
+    "version": "1.14.1",
+    "hash": "sha256-TVwi07PPpe2+CCH+f4EoXr/c6aI+SsGWEVLUPm0YRfk="
 }

contrib/themes/bsod.css

@@ -40,8 +40,6 @@ html.ey {
 
 	--u2-b1-bg: var(--w2);
 	--u2-b2-bg: var(--w2);
-	--u2-o-bg: var(--w2);
-	--u2-o-1-bg: var(--a);
     --u2-txt-bg: var(--w2);
 	--u2-tab-bg: a;
 	--u2-tab-1-bg: var(--w2);

copyparty/__main__.py

@@ -527,6 +527,41 @@ def showlic() -> None:
 
 def get_sects():
     return [
+        [
+            "bind",
+            "configure listening",
+            dedent(
+                """
+            \033[33m-i\033[0m takes a comma-separated list of interfaces to listen on;
+            IP-addresses and/or unix-sockets (Unix Domain Sockets)
+
+            the default (\033[32m-i ::\033[0m) means all IPv4 and IPv6 addresses
+
+            \033[32m-i 0.0.0.0\033[0m    listens on all IPv4 NICs/subnets
+            \033[32m-i 127.0.0.1\033[0m  listens on IPv4 localhost only
+            \033[32m-i 127.1\033[0m      listens on IPv4 localhost only
+            \033[32m-i 127.1,192.168.123.1\033[0m = IPv4 localhost and 192.168.123.1
+
+            \033[33m-p\033[0m takes a comma-separated list of tcp ports to listen on;
+            the default is \033[32m-p 3923\033[0m but as root you can \033[32m-p 80,443,3923\033[0m
+
+            when running behind a reverse-proxy, it's recommended to
+            use unix-sockets for improved performance and security;
+
+            \033[32m-i unix:770:www:\033[33m/tmp/a.sock\033[0m listens on \033[33m/tmp/a.sock\033[0m with
+            permissions \033[33m0770\033[0m; only accessible to members of the \033[33mwww\033[0m
+            group. This is the best approach. Alternatively,
+
+            \033[32m-i unix:777:\033[33m/tmp/a.sock\033[0m sets perms \033[33m0777\033[0m so anyone can
+            access it; bad unless it's inside a restricted folder
+
+            \033[32m-i unix:\033[33m/tmp/a.sock\033[0m keeps umask-defined permissions
+            (usually \033[33m0600\033[0m) and the same user/group as copyparty
+
+            \033[33m-p\033[0m (tcp ports) is ignored for unix sockets
+            """
+            ),
+        ],
         [
             "accounts",
             "accounts and volumes",
@@ -937,6 +972,15 @@ def add_fs(ap):
     ap2.add_argument("--mtab-age", metavar="SEC", type=int, default=60, help="rebuild mountpoint cache every \033[33mSEC\033[0m to keep track of sparse-files support; keep low on servers with removable media")
 
 
+def add_share(ap):
+    db_path = os.path.join(E.cfg, "shares.db")
+    ap2 = ap.add_argument_group('share-url options')
+    ap2.add_argument("--shr", metavar="DIR", default="", help="toplevel virtual folder for shared files/folders, for example [\033[32m/share\033[0m]")
+    ap2.add_argument("--shr-db", metavar="FILE", default=db_path, help="database to store shares in")
+    ap2.add_argument("--shr-adm", metavar="U,U", default="", help="comma-separated list of users allowed to view/delete any share")
+    ap2.add_argument("--shr-v", action="store_true", help="debug")
+
+
 def add_upload(ap):
     ap2 = ap.add_argument_group('upload options')
     ap2.add_argument("--dotpart", action="store_true", help="dotfile incomplete uploads, hiding them from clients unless \033[33m-ed\033[0m")
@@ -969,8 +1013,8 @@ def add_upload(ap):
 
 def add_network(ap):
     ap2 = ap.add_argument_group('network options')
-    ap2.add_argument("-i", metavar="IP", type=u, default="::", help="ip to bind (comma-sep.) and/or [\033[32munix:/tmp/a.sock\033[0m], default: all IPv4 and IPv6")
-    ap2.add_argument("-p", metavar="PORT", type=u, default="3923", help="ports to bind (comma/range); ignored for unix-sockets")
+    ap2.add_argument("-i", metavar="IP", type=u, default="::", help="IPs and/or unix-sockets to listen on (see \033[33m--help-bind\033[0m). Default: all IPv4 and IPv6")
+    ap2.add_argument("-p", metavar="PORT", type=u, default="3923", help="ports to listen on (comma/range); ignored for unix-sockets")
     ap2.add_argument("--ll", action="store_true", help="include link-local IPv4/IPv6 in mDNS replies, even if the NIC has routable IPs (breaks some mDNS clients)")
     ap2.add_argument("--rproxy", metavar="DEPTH", type=int, default=1, help="which ip to associate clients with; [\033[32m0\033[0m]=tcp, [\033[32m1\033[0m]=origin (first x-fwd, unsafe), [\033[32m2\033[0m]=outermost-proxy, [\033[32m3\033[0m]=second-proxy, [\033[32m-1\033[0m]=closest-proxy")
     ap2.add_argument("--xff-hdr", metavar="NAME", type=u, default="x-forwarded-for", help="if reverse-proxied, which http header to read the client's real ip from")
@@ -1030,6 +1074,16 @@ def add_auth(ap):
     ap2.add_argument("--bauth-last", action="store_true", help="keeps basic-authentication enabled, but only as a last-resort; if a cookie is also provided then the cookie wins")
 
 
+def add_chpw(ap):
+    db_path = os.path.join(E.cfg, "chpw.json")
+    ap2 = ap.add_argument_group('user-changeable passwords options')
+    ap2.add_argument("--chpw", action="store_true", help="allow users to change their own passwords")
+    ap2.add_argument("--chpw-no", metavar="U,U,U", type=u, action="append", help="do not allow password-changes for this comma-separated list of usernames")
+    ap2.add_argument("--chpw-db", metavar="PATH", type=u, default=db_path, help="where to store the passwords database (if you run multiple copyparty instances, make sure they use different DBs)")
+    ap2.add_argument("--chpw-len", metavar="N", type=int, default=8, help="minimum password length")
+    ap2.add_argument("--chpw-v", metavar="LVL", type=int, default=2, help="verbosity of summary on config load [\033[32m0\033[0m] = nothing at all, [\033[32m1\033[0m] = number of users, [\033[32m2\033[0m] = list users with default-pw, [\033[32m3\033[0m] = list all users")
+
+
 def add_zeroconf(ap):
     ap2 = ap.add_argument_group("Zeroconf options")
     ap2.add_argument("-z", action="store_true", help="enable all zeroconf backends (mdns, ssdp)")
@@ -1358,7 +1412,7 @@ def add_ui(ap, retry):
     ap2 = ap.add_argument_group('ui options')
     ap2.add_argument("--grid", action="store_true", help="show grid/thumbnails by default (volflag=grid)")
     ap2.add_argument("--gsel", action="store_true", help="select files in grid by ctrl-click (volflag=gsel)")
-    ap2.add_argument("--lang", metavar="LANG", type=u, default="eng", help="language; one of the following: \033[32meng nor\033[0m")
+    ap2.add_argument("--lang", metavar="LANG", type=u, default="eng", help="language; one of the following: \033[32meng nor chi\033[0m")
     ap2.add_argument("--theme", metavar="NUM", type=int, default=0, help="default theme to use (0..7)")
     ap2.add_argument("--themes", metavar="NUM", type=int, default=8, help="number of themes installed")
     ap2.add_argument("--au-vol", metavar="0-100", type=int, default=50, choices=range(0, 101), help="default audio/video volume percent")
@@ -1438,11 +1492,13 @@ def run_argparse(
     add_tls(ap, cert_path)
     add_cert(ap, cert_path)
     add_auth(ap)
+    add_chpw(ap)
     add_qr(ap, tty)
     add_zeroconf(ap)
     add_zc_mdns(ap)
     add_zc_ssdp(ap)
     add_fs(ap)
+    add_share(ap)
     add_upload(ap)
     add_db_general(ap, hcores)
     add_db_metadata(ap)

copyparty/__version__.py

@@ -1,8 +1,8 @@
 # coding: utf-8
 
-VERSION = (1, 13, 8)
-CODENAME = "race the beam"
-BUILD_DT = (2024, 8, 13)
+VERSION = (1, 14, 2)
+CODENAME = "one step forward"
+BUILD_DT = (2024, 8, 23)
 
 S_VERSION = ".".join(map(str, VERSION))
 S_BUILD_DT = "{0:04d}-{1:02d}-{2:02d}".format(*BUILD_DT)

copyparty/authsrv.py

@@ -4,6 +4,7 @@ from __future__ import print_function, unicode_literals
 import argparse
 import base64
 import hashlib
+import json
 import os
 import re
 import stat
@@ -34,9 +35,11 @@ from .util import (
     odfusion,
     relchk,
     statdir,
+    ub64enc,
     uncyg,
     undot,
     unhumanize,
+    vjoin,
     vsplit,
 )
 
@@ -341,6 +344,8 @@ class VFS(object):
         self.histtab: dict[str, str] = {}  # all realpath->histpath
         self.dbv: Optional[VFS] = None  # closest full/non-jump parent
         self.lim: Optional[Lim] = None  # upload limits; only set for dbv
+        self.shr_src: Optional[tuple[VFS, str]] = None  # source vfs+rem of a share
+        self.shr_files: set[str] = set()  # filenames to include from shr_src
         self.aread: dict[str, list[str]] = {}
         self.awrite: dict[str, list[str]] = {}
         self.amove: dict[str, list[str]] = {}
@@ -365,6 +370,9 @@ class VFS(object):
             self.all_aps = []
             self.all_vps = []
 
+        self.get_dbv = self._get_dbv
+        self.ls = self._ls
+
     def __repr__(self) -> str:
         return "VFS(%s)" % (
             ", ".join(
@@ -526,7 +534,15 @@ class VFS(object):
 
         return vn, rem
 
-    def get_dbv(self, vrem: str) -> tuple["VFS", str]:
+    def _get_share_src(self, vrem: str) -> tuple["VFS", str]:
+        src = self.shr_src
+        if not src:
+            return self._get_dbv(vrem)
+
+        shv, srem = src
+        return shv, vjoin(srem, vrem)
+
+    def _get_dbv(self, vrem: str) -> tuple["VFS", str]:
         dbv = self.dbv
         if not dbv:
             return self, vrem
@@ -552,7 +568,26 @@ class VFS(object):
         ad, fn = os.path.split(ap)
         return os.path.join(absreal(ad), fn)
 
-    def ls(
+    def _ls_nope(
+        self, *a, **ka
+    ) -> tuple[str, list[tuple[str, os.stat_result]], dict[str, "VFS"]]:
+        raise Pebkac(500, "nope.avi")
+
+    def _ls_shr(
+        self,
+        rem: str,
+        uname: str,
+        scandir: bool,
+        permsets: list[list[bool]],
+        lstat: bool = False,
+    ) -> tuple[str, list[tuple[str, os.stat_result]], dict[str, "VFS"]]:
+        """replaces _ls for certain shares (single-file, or file selection)"""
+        vn, rem = self.shr_src  # type: ignore
+        abspath, real, _ = vn.ls(rem, "\n", scandir, permsets, lstat)
+        real = [x for x in real if os.path.basename(x[0]) in self.shr_files]
+        return abspath, real, {}
+
+    def _ls(
         self,
         rem: str,
         uname: str,
@@ -807,6 +842,7 @@ class AuthSrv(object):
         self.vfs = VFS(log_func, "", "", AXS(), {})
         self.acct: dict[str, str] = {}
         self.iacct: dict[str, str] = {}
+        self.defpw: dict[str, str] = {}
         self.grps: dict[str, list[str]] = {}
         self.re_pwd: Optional[re.Pattern] = None
 
@@ -1352,7 +1388,7 @@ class AuthSrv(object):
         flags[name] = vals
         self._e("volflag [{}] += {}  ({})".format(name, vals, desc))
 
-    def reload(self) -> None:
+    def reload(self, verbosity: int = 9) -> None:
         """
         construct a flat list of mountpoints and usernames
         first from the commandline arguments
@@ -1360,9 +1396,9 @@ class AuthSrv(object):
         before finally building the VFS
         """
         with self.mutex:
-            self._reload()
+            self._reload(verbosity)
 
-    def _reload(self) -> None:
+    def _reload(self, verbosity: int = 9) -> None:
         acct: dict[str, str] = {}  # username:password
         grps: dict[str, list[str]] = {}  # groupname:usernames
         daxs: dict[str, AXS] = {}
@@ -1440,6 +1476,8 @@ class AuthSrv(object):
                     raise
 
         self.setup_pwhash(acct)
+        defpw = acct.copy()
+        self.setup_chpw(acct)
 
         # case-insensitive; normalize
         if WINDOWS:
@@ -1455,9 +1493,8 @@ class AuthSrv(object):
             vfs = VFS(self.log_func, absreal("."), "", axs, {})
         elif "" not in mount:
             # there's volumes but no root; make root inaccessible
-            vfs = VFS(self.log_func, "", "", AXS(), {})
-            vfs.flags["tcolor"] = self.args.tcolor
-            vfs.flags["d2d"] = True
+            zsd = {"d2d": True, "tcolor": self.args.tcolor}
+            vfs = VFS(self.log_func, "", "", AXS(), zsd)
 
         maxdepth = 0
         for dst in sorted(mount.keys(), key=lambda x: (x.count("/"), len(x))):
@@ -1486,6 +1523,56 @@ class AuthSrv(object):
             vol.all_vps.sort(key=lambda x: len(x[0]), reverse=True)
             vol.root = vfs
 
+        enshare = self.args.shr
+        shr = enshare[1:-1]
+        shrs = enshare[1:]
+        if enshare:
+            import sqlite3
+
+            shv = VFS(self.log_func, "", shr, AXS(), {"d2d": True})
+
+            db_path = self.args.shr_db
+            db = sqlite3.connect(db_path)
+            cur = db.cursor()
+            cur2 = db.cursor()
+            now = time.time()
+            for row in cur.execute("select * from sh"):
+                s_k, s_pw, s_vp, s_pr, s_nf, s_un, s_t0, s_t1 = row
+                if s_t1 and s_t1 < now:
+                    continue
+
+                if self.args.shr_v:
+                    t = "loading %s share [%s] by [%s] => [%s]"
+                    self.log(t % (s_pr, s_k, s_un, s_vp))
+
+                if s_pw:
+                    # gotta reuse the "account" for all shares with this pw,
+                    # so do a light scramble as this appears in the web-ui
+                    zs = ub64enc(hashlib.sha512(s_pw.encode("utf-8")).digest())[4:16]
+                    sun = "s_%s" % (zs.decode("utf-8"),)
+                    acct[sun] = s_pw
+                else:
+                    sun = "*"
+
+                s_axs = AXS(
+                    [sun] if "r" in s_pr else [],
+                    [sun] if "w" in s_pr else [],
+                    [sun] if "m" in s_pr else [],
+                    [sun] if "d" in s_pr else [],
+                )
+
+                # don't know the abspath yet + wanna ensure the user
+                # still has the privs they granted, so nullmap it
+                shv.nodes[s_k] = VFS(
+                    self.log_func, "", "%s/%s" % (shr, s_k), s_axs, shv.flags.copy()
+                )
+
+            vfs.nodes[shr] = vfs.all_vols[shr] = shv
+            for vol in shv.nodes.values():
+                vfs.all_vols[vol.vpath] = vol
+                vol.get_dbv = vol._get_share_src
+                vol.ls = vol._ls_nope
+
         zss = set(acct)
         zss.update(self.idp_accs)
         zss.discard("*")
@@ -1504,7 +1591,7 @@ class AuthSrv(object):
             for usr in unames:
                 for vp, vol in vfs.all_vols.items():
                     zx = getattr(vol.axs, axs_key)
-                    if usr in zx:
+                    if usr in zx and (not enshare or not vp.startswith(shrs)):
                         umap[usr].append(vp)
                 umap[usr].sort()
             setattr(vfs, "a" + perm, umap)
@@ -1554,6 +1641,8 @@ class AuthSrv(object):
 
         for usr in acct:
             if usr not in associated_users:
+                if enshare and usr.startswith("s_"):
+                    continue
                 if len(vfs.all_vols) > 1:
                     # user probably familiar enough that the verbose message is not necessary
                     t = "account [%s] is not mentioned in any volume definitions; see --help-accounts"
@@ -1989,9 +2078,12 @@ class AuthSrv(object):
         have_e2t = False
         t = "volumes and permissions:\n"
         for zv in vfs.all_vols.values():
-            if not self.warn_anonwrite:
+            if not self.warn_anonwrite or verbosity < 5:
                 break
 
+            if enshare and (zv.vpath == shr or zv.vpath.startswith(shrs)):
+                continue
+
             t += '\n\033[36m"/{}"  \033[33m{}\033[0m'.format(zv.vpath, zv.realpath)
             for txt, attr in [
                 ["  read", "uread"],
@@ -2018,7 +2110,7 @@ class AuthSrv(object):
 
             t += "\n"
 
-        if self.warn_anonwrite:
+        if self.warn_anonwrite and verbosity > 4:
             if not self.args.no_voldump:
                 self.log(t)
 
@@ -2042,7 +2134,7 @@ class AuthSrv(object):
 
         try:
             zv, _ = vfs.get("", "*", False, True, err=999)
-            if self.warn_anonwrite and os.getcwd() == zv.realpath:
+            if self.warn_anonwrite and verbosity > 4 and os.getcwd() == zv.realpath:
                 t = "anyone can write to the current directory: {}\n"
                 self.log(t.format(zv.realpath), c=1)
 
@@ -2069,6 +2161,7 @@ class AuthSrv(object):
 
         self.vfs = vfs
         self.acct = acct
+        self.defpw = defpw
         self.grps = grps
         self.iacct = {v: k for k, v in acct.items()}
 
@@ -2089,6 +2182,169 @@ class AuthSrv(object):
                 MIMES[ext] = mime
             EXTS.update({v: k for k, v in MIMES.items()})
 
+        if enshare:
+            # hide shares from controlpanel
+            vfs.all_vols = {
+                x: y
+                for x, y in vfs.all_vols.items()
+                if x != shr and not x.startswith(shrs)
+            }
+
+            assert db and cur and cur2 and shv  # type: ignore
+            for row in cur.execute("select * from sh"):
+                s_k, s_pw, s_vp, s_pr, s_nf, s_un, s_t0, s_t1 = row
+                shn = shv.nodes.get(s_k, None)
+                if not shn:
+                    continue
+
+                try:
+                    s_vfs, s_rem = vfs.get(
+                        s_vp, s_un, "r" in s_pr, "w" in s_pr, "m" in s_pr, "d" in s_pr
+                    )
+                except Exception as ex:
+                    t = "removing share [%s] by [%s] to [%s] due to %r"
+                    self.log(t % (s_k, s_un, s_vp, ex), 3)
+                    shv.nodes.pop(s_k)
+                    continue
+
+                fns = []
+                if s_nf:
+                    q = "select vp from sf where k = ?"
+                    for (s_fn,) in cur2.execute(q, (s_k,)):
+                        fns.append(s_fn)
+
+                    shn.shr_files = set(fns)
+                    shn.ls = shn._ls_shr
+                else:
+                    shn.ls = shn._ls
+
+                shn.shr_src = (s_vfs, s_rem)
+                shn.realpath = s_vfs.canonical(s_rem)
+
+                if self.args.shr_v:
+                    t = "mapped %s share [%s] by [%s] => [%s] => [%s]"
+                    self.log(t % (s_pr, s_k, s_un, s_vp, shn.realpath))
+
+            # transplant shadowing into shares
+            for vn in shv.nodes.values():
+                svn, srem = vn.shr_src  # type: ignore
+                if srem:
+                    continue  # free branch, safe
+                ap = svn.canonical(srem)
+                if bos.path.isfile(ap):
+                    continue  # also fine
+                for zs in svn.nodes.keys():
+                    # hide subvolume
+                    vn.nodes[zs] = VFS(self.log_func, "", "", AXS(), {})
+
+            cur2.close()
+            cur.close()
+            db.close()
+
+    def chpw(self, broker: Optional["BrokerCli"], uname, pw) -> tuple[bool, str]:
+        if not self.args.chpw:
+            return False, "feature disabled in server config"
+
+        if uname == "*" or uname not in self.defpw:
+            return False, "not logged in"
+
+        if uname in self.args.chpw_no:
+            return False, "not allowed for this account"
+
+        if len(pw) < self.args.chpw_len:
+            t = "minimum password length: %d characters"
+            return False, t % (self.args.chpw_len,)
+
+        hpw = self.ah.hash(pw) if self.ah.on else pw
+
+        if hpw == self.acct[uname]:
+            return False, "that's already your password my dude"
+
+        if hpw in self.iacct:
+            return False, "password is taken"
+
+        with self.mutex:
+            ap = self.args.chpw_db
+            if not bos.path.exists(ap):
+                pwdb = {}
+            else:
+                with open(ap, "r", encoding="utf-8") as f:
+                    pwdb = json.load(f)
+
+            pwdb = [x for x in pwdb if x[0] != uname]
+            pwdb.append((uname, self.defpw[uname], hpw))
+
+            with open(ap, "w", encoding="utf-8") as f:
+                json.dump(pwdb, f, separators=(",\n", ": "))
+
+            self.log("reinitializing due to password-change for user [%s]" % (uname,))
+
+            if not broker:
+                # only true for tests
+                self._reload()
+                return True, "new password OK"
+
+        broker.ask("_reload_blocking", False, False).get()
+        return True, "new password OK"
+
+    def setup_chpw(self, acct: dict[str, str]) -> None:
+        ap = self.args.chpw_db
+        if not self.args.chpw or not bos.path.exists(ap):
+            return
+
+        with open(ap, "r", encoding="utf-8") as f:
+            pwdb = json.load(f)
+
+        useen = set()
+        urst = set()
+        uok = set()
+        for usr, orig, mod in pwdb:
+            useen.add(usr)
+            if usr not in acct:
+                # previous user, no longer known
+                continue
+            if acct[usr] != orig:
+                urst.add(usr)
+                continue
+            uok.add(usr)
+            acct[usr] = mod
+
+        if not self.args.chpw_v:
+            return
+
+        for usr in acct:
+            if usr not in useen:
+                urst.add(usr)
+
+        for zs in uok:
+            urst.discard(zs)
+
+        if self.args.chpw_v == 1 or (self.args.chpw_v == 2 and not urst):
+            t = "chpw: %d changed, %d unchanged"
+            self.log(t % (len(uok), len(urst)))
+            return
+
+        elif self.args.chpw_v == 2:
+            t = "chpw: %d changed" % (len(uok))
+            if urst:
+                t += ", \033[0munchanged:\033[35m %s" % (", ".join(list(urst)))
+
+            self.log(t, 6)
+            return
+
+        msg = ""
+        if uok:
+            t = "\033[0mchanged: \033[32m%s"
+            msg += t % (", ".join(list(uok)),)
+        if urst:
+            t = "%s\033[0munchanged: \033[35m%s"
+            msg += t % (
+                ", " if msg else "",
+                ", ".join(list(urst)),
+            )
+
+        self.log("chpw: " + msg, 6)
+
     def setup_pwhash(self, acct: dict[str, str]) -> None:
         self.ah = PWHash(self.args)
         if not self.ah.on:

copyparty/httpcli.py

@@ -45,6 +45,7 @@ from .util import unquote  # type: ignore
 from .util import (
     APPLESAN_RE,
     BITNESS,
+    HAVE_SQLITE3,
     HTTPCODE,
     META_NOBOTS,
     UTC,
@@ -454,7 +455,7 @@ class HttpCli(object):
                 t = "incorrect --rp-loc or webserver config; expected vpath starting with [{}] but got [{}]"
                 self.log(t.format(self.args.R, vpath), 1)
 
-        self.ouparam = {k: zs for k, zs in uparam.items()}
+        self.ouparam = uparam.copy()
 
         if self.args.rsp_slp:
             time.sleep(self.args.rsp_slp)
@@ -463,6 +464,9 @@ class HttpCli(object):
 
         zso = self.headers.get("cookie")
         if zso:
+            if len(zso) > 8192:
+                self.loud_reply("cookie header too big", status=400)
+                return False
             zsll = [x.split("=", 1) for x in zso.split(";") if "=" in x]
             cookies = {k.strip(): unescape_cookie(zs) for k, zs in zsll}
             cookie_pw = cookies.get("cppws") or cookies.get("cppwd") or ""
@@ -968,10 +972,10 @@ class HttpCli(object):
         status: int = 200,
         use302: bool = False,
     ) -> bool:
-        vp = self.args.RS + vpath
+        vp = self.args.SRS + vpath
         html = self.j2s(
             "msg",
-            h2='<a href="/{}">{} /{}</a>'.format(
+            h2='<a href="{}">{} {}</a>'.format(
                 quotep(vp) + suf, flavor, html_escape(vp, crlf=True) + suf
             ),
             pre=msg,
@@ -979,7 +983,7 @@ class HttpCli(object):
         ).encode("utf-8", "replace")
 
         if use302:
-            self.reply(html, status=302, headers={"Location": "/" + vpath})
+            self.reply(html, status=302, headers={"Location": vp})
         else:
             self.reply(html, status=status)
 
@@ -1141,7 +1145,7 @@ class HttpCli(object):
             if "move" in self.uparam:
                 return self.handle_mv()
 
-        if not self.vpath:
+        if not self.vpath and self.ouparam:
             if "reload" in self.uparam:
                 return self.handle_reload()
 
@@ -1163,23 +1167,12 @@ class HttpCli(object):
             if "hc" in self.uparam:
                 return self.tx_svcs()
 
+            if "shares" in self.uparam:
+                return self.tx_shares()
+
         if "h" in self.uparam:
             return self.tx_mounts()
 
-        # conditional redirect to single volumes
-        if not self.vpath and not self.ouparam:
-            nread = len(self.rvol)
-            nwrite = len(self.wvol)
-            if nread + nwrite == 1 or (self.rvol == self.wvol and nread == 1):
-                if nread == 1:
-                    vpath = self.rvol[0]
-                else:
-                    vpath = self.wvol[0]
-
-                if self.vpath != vpath:
-                    self.redirect(vpath, flavor="redirecting to", use302=True)
-                    return True
-
         return self.tx_browser()
 
     def handle_propfind(self) -> bool:
@@ -1618,6 +1611,9 @@ class HttpCli(object):
         if "delete" in self.uparam:
             return self.handle_rm([])
 
+        if "unshare" in self.uparam:
+            return self.handle_unshare()
+
         if "application/octet-stream" in ctype:
             return self.handle_post_binary()
 
@@ -2089,6 +2085,9 @@ class HttpCli(object):
         if act == "zip":
             return self.handle_zip_post()
 
+        if act == "chpw":
+            return self.handle_chpw()
+
         raise Pebkac(422, 'invalid action "{}"'.format(act))
 
     def handle_zip_post(self) -> bool:
@@ -2147,6 +2146,9 @@ class HttpCli(object):
         if "srch" in self.uparam or "srch" in body:
             return self.handle_search(body)
 
+        if "share" in self.uparam:
+            return self.handle_share(body)
+
         if "delete" in self.uparam:
             return self.handle_rm(body)
 
@@ -2203,7 +2205,9 @@ class HttpCli(object):
     def handle_search(self, body: dict[str, Any]) -> bool:
         idx = self.conn.get_u2idx()
         if not idx or not hasattr(idx, "p_end"):
-            raise Pebkac(500, "server busy, or sqlite3 not available; cannot search")
+            if not HAVE_SQLITE3:
+                raise Pebkac(500, "sqlite3 not found on server; search is disabled")
+            raise Pebkac(500, "server busy, cannot search; please retry in a bit")
 
         vols: list[VFS] = []
         seen: dict[VFS, bool] = {}
@@ -2393,6 +2397,22 @@ class HttpCli(object):
         self.reply(b"thank")
         return True
 
+    def handle_chpw(self) -> bool:
+        assert self.parser
+        pwd = self.parser.require("pw", 64)
+        self.parser.drop()
+
+        ok, msg = self.asrv.chpw(self.conn.hsrv.broker, self.uname, pwd)
+        if ok:
+            ok, msg = self.get_pwd_cookie(pwd)
+            if ok:
+                msg = "new password OK"
+
+        redir = (self.args.SRS + "?h") if ok else ""
+        html = self.j2s("msg", h1=msg, h2='<a href="/?h">ack</a>', redir=redir)
+        self.reply(html.encode("utf-8"))
+        return True
+
     def handle_login(self) -> bool:
         assert self.parser
         pwd = self.parser.require("cppwd", 64)
@@ -2417,12 +2437,12 @@ class HttpCli(object):
             dst += "&" if "?" in dst else "?"
             dst += "_=1#" + html_escape(uhash, True, True)
 
-        msg = self.get_pwd_cookie(pwd)
+        _, msg = self.get_pwd_cookie(pwd)
         html = self.j2s("msg", h1=msg, h2='<a href="' + dst + '">ack</a>', redir=dst)
         self.reply(html.encode("utf-8"))
         return True
 
-    def get_pwd_cookie(self, pwd: str) -> str:
+    def get_pwd_cookie(self, pwd: str) -> tuple[bool, str]:
         hpwd = self.asrv.ah.hash(pwd)
         uname = self.asrv.iacct.get(hpwd)
         if uname:
@@ -2454,7 +2474,7 @@ class HttpCli(object):
             ck = gencookie(k, pwd, self.args.R, self.is_https, dur, "; HttpOnly")
             self.out_headerlist.append(("Set-Cookie", ck))
 
-        return msg
+        return dur > 0, msg
 
     def handle_mkdir(self) -> bool:
         assert self.parser
@@ -2493,7 +2513,7 @@ class HttpCli(object):
             except:
                 raise Pebkac(500, min_ex())
 
-        self.out_headers["X-New-Dir"] = quotep(vpath)
+        self.out_headers["X-New-Dir"] = quotep(self.args.RS + vpath)
 
         if dav:
             self.reply(b"", 201)
@@ -3246,7 +3266,8 @@ class HttpCli(object):
                     raise Exception("not found in registry")
                 self.pipes.set(req_path, job)
             except Exception as ex:
-                self.log("will not pipe [%s]; %s" % (ap_data, ex), 6)
+                if getattr(ex, "errno", 0) != errno.ENOENT:
+                    self.log("will not pipe [%s]; %s" % (ap_data, ex), 6)
                 ptop = None
 
         #
@@ -3938,6 +3959,7 @@ class HttpCli(object):
             rvol=rvol,
             wvol=wvol,
             avol=avol,
+            in_shr=self.args.shr and self.vpath.startswith(self.args.shr[1:]),
             vstate=vstate,
             scanning=vs["scanning"],
             hashq=vs["hashq"],
@@ -3948,6 +3970,7 @@ class HttpCli(object):
             k304=self.k304(),
             k304vis=self.args.k304 > 0,
             ver=S_VERSION if self.args.ver else "",
+            chpw=self.args.chpw and self.uname != "*",
             ahttps="" if self.is_https else "https://" + self.host + self.req,
         )
         self.reply(html.encode("utf-8"))
@@ -3985,10 +4008,10 @@ class HttpCli(object):
     def tx_404(self, is_403: bool = False) -> bool:
         rc = 404
         if self.args.vague_403:
-            t = '<h1 id="n">404 not found &nbsp;┐( ´ -`)┌</h1><p id="o">or maybe you don\'t have access -- try logging in or <a href="{}/?h">go home</a></p>'
-            pt = "404 not found  ┐( ´ -`)┌   (or maybe you don't have access -- try logging in)"
+            t = '<h1 id="n">404 not found &nbsp;┐( ´ -`)┌</h1><p id="o">or maybe you don\'t have access -- try a password or <a href="{}/?h">go home</a></p>'
+            pt = "404 not found  ┐( ´ -`)┌   (or maybe you don't have access -- try a password)"
         elif is_403:
-            t = '<h1 id="p">403 forbiddena &nbsp;~┻━┻</h1><p id="q">you\'ll have to log in or <a href="{}/?h">go home</a></p>'
+            t = '<h1 id="p">403 forbiddena &nbsp;~┻━┻</h1><p id="q">use a password or <a href="{}/?h">go home</a></p>'
             pt = "403 forbiddena ~┻━┻   (you'll have to log in)"
             rc = 403
         else:
@@ -4005,7 +4028,8 @@ class HttpCli(object):
 
         t = t.format(self.args.SR)
         qv = quotep(self.vpaths) + self.ourlq()
-        html = self.j2s("splash", this=self, qvpath=qv, msg=t)
+        in_shr = self.args.shr and self.vpath.startswith(self.args.shr[1:])
+        html = self.j2s("splash", this=self, qvpath=qv, in_shr=in_shr, msg=t)
         self.reply(html.encode("utf-8"), status=rc)
         return True
 
@@ -4082,7 +4106,9 @@ class HttpCli(object):
             dst = dst[len(top) + 1 :]
 
         ret = self.gen_tree(top, dst, self.uparam.get("k", ""))
-        if self.is_vproxied:
+        if self.is_vproxied and not self.uparam["tree"]:
+            # uparam is '' on initial load, which is
+            # the only time we gotta fill in the blanks
             parents = self.args.R.split("/")
             for parent in reversed(parents):
                 ret = {"k%s" % (parent,): ret, "a": []}
@@ -4157,7 +4183,9 @@ class HttpCli(object):
     def tx_ups(self) -> bool:
         idx = self.conn.get_u2idx()
         if not idx or not hasattr(idx, "p_end"):
-            raise Pebkac(500, "sqlite3 is not available on the server; cannot unpost")
+            if not HAVE_SQLITE3:
+                raise Pebkac(500, "sqlite3 not found on server; unpost is disabled")
+            raise Pebkac(500, "server busy, cannot unpost; please retry in a bit")
 
         filt = self.uparam.get("filter") or ""
         lm = "ups [{}]".format(filt)
@@ -4246,6 +4274,169 @@ class HttpCli(object):
         self.reply(jtxt.encode("utf-8", "replace"), mime="application/json")
         return True
 
+    def tx_shares(self) -> bool:
+        if self.uname == "*":
+            self.loud_reply("you're not logged in")
+            return True
+
+        idx = self.conn.get_u2idx()
+        if not idx or not hasattr(idx, "p_end"):
+            if not HAVE_SQLITE3:
+                raise Pebkac(500, "sqlite3 not found on server; sharing is disabled")
+            raise Pebkac(500, "server busy, cannot list shares; please retry in a bit")
+
+        cur = idx.get_shr()
+        if not cur:
+            raise Pebkac(400, "huh, sharing must be disabled in the server config...")
+
+        rows = cur.execute("select * from sh").fetchall()
+        rows = [list(x) for x in rows]
+
+        if self.uname != self.args.shr_adm:
+            rows = [x for x in rows if x[5] == self.uname]
+
+        for x in rows:
+            x[1] = "yes" if x[1] else ""
+
+        html = self.j2s(
+            "shares", this=self, shr=self.args.shr, rows=rows, now=int(time.time())
+        )
+        self.reply(html.encode("utf-8"), status=200)
+        return True
+
+    def handle_unshare(self) -> bool:
+        idx = self.conn.get_u2idx()
+        if not idx or not hasattr(idx, "p_end"):
+            if not HAVE_SQLITE3:
+                raise Pebkac(500, "sqlite3 not found on server; sharing is disabled")
+            raise Pebkac(500, "server busy, cannot create share; please retry in a bit")
+
+        if self.args.shr_v:
+            self.log("handle_unshare: " + self.req)
+
+        cur = idx.get_shr()
+        if not cur:
+            raise Pebkac(400, "huh, sharing must be disabled in the server config...")
+
+        skey = self.vpath.split("/")[-1]
+
+        uns = cur.execute("select un from sh where k = ?", (skey,)).fetchall()
+        un = uns[0][0] if uns and uns[0] else ""
+
+        if not un:
+            raise Pebkac(400, "that sharekey didn't match anything")
+
+        if un != self.uname and self.uname != self.args.shr_adm:
+            t = "your username (%r) does not match the sharekey's owner (%r) and you're not admin"
+            raise Pebkac(400, t % (self.uname, un))
+
+        cur.execute("delete from sh where k = ?", (skey,))
+        cur.connection.commit()
+
+        self.redirect(self.args.SRS + "?shares")
+        return True
+
+    def handle_share(self, req: dict[str, str]) -> bool:
+        idx = self.conn.get_u2idx()
+        if not idx or not hasattr(idx, "p_end"):
+            if not HAVE_SQLITE3:
+                raise Pebkac(500, "sqlite3 not found on server; sharing is disabled")
+            raise Pebkac(500, "server busy, cannot create share; please retry in a bit")
+
+        if self.args.shr_v:
+            self.log("handle_share: " + json.dumps(req, indent=4))
+
+        skey = req["k"]
+        vps = req["vp"]
+        fns = []
+        if len(vps) == 1:
+            vp = vps[0]
+            if not vp.endswith("/"):
+                vp, zs = vp.rsplit("/", 1)
+                fns = [zs]
+        else:
+            for zs in vps:
+                if zs.endswith("/"):
+                    t = "you cannot select more than one folder, or mix flies and folders in one selection"
+                    raise Pebkac(400, t)
+            vp = vps[0].rsplit("/", 1)[0]
+            for zs in vps:
+                vp2, fn = zs.rsplit("/", 1)
+                fns.append(fn)
+                if vp != vp2:
+                    t = "mismatching base paths in selection:\n  [%s]\n  [%s]"
+                    raise Pebkac(400, t % (vp, vp2))
+
+        vp = vp.strip("/")
+        if self.is_vproxied and (vp == self.args.R or vp.startswith(self.args.RS)):
+            vp = vp[len(self.args.RS) :]
+
+        m = re.search(r"([^0-9a-zA-Z_-])", skey)
+        if m:
+            raise Pebkac(400, "sharekey has illegal character [%s]" % (m[1],))
+
+        if vp.startswith(self.args.shr[1:]):
+            raise Pebkac(400, "yo dawg...")
+
+        cur = idx.get_shr()
+        if not cur:
+            raise Pebkac(400, "huh, sharing must be disabled in the server config...")
+
+        q = "select * from sh where k = ?"
+        qr = cur.execute(q, (skey,)).fetchall()
+        if qr and qr[0]:
+            self.log("sharekey taken by %r" % (qr,))
+            raise Pebkac(400, "sharekey [%s] is already in use" % (skey,))
+
+        # ensure user has requested perms
+        s_rd = "read" in req["perms"]
+        s_wr = "write" in req["perms"]
+        s_mv = "move" in req["perms"]
+        s_del = "delete" in req["perms"]
+        try:
+            vfs, rem = self.asrv.vfs.get(vp, self.uname, s_rd, s_wr, s_mv, s_del)
+        except:
+            raise Pebkac(400, "you dont have all the perms you tried to grant")
+
+        ap, reals, _ = vfs.ls(
+            rem, self.uname, not self.args.no_scandir, [[s_rd, s_wr, s_mv, s_del]]
+        )
+        rfns = set([x[0] for x in reals])
+        for fn in fns:
+            if fn not in rfns:
+                raise Pebkac(400, "selected file not found on disk: [%s]" % (fn,))
+
+        pw = req.get("pw") or ""
+        now = int(time.time())
+        sexp = req["exp"]
+        exp = int(sexp) if sexp else 0
+        exp = now + exp * 60 if exp else 0
+        pr = "".join(zc for zc, zb in zip("rwmd", (s_rd, s_wr, s_mv, s_del)) if zb)
+
+        q = "insert into sh values (?,?,?,?,?,?,?,?)"
+        cur.execute(q, (skey, pw, vp, pr, len(fns), self.uname, now, exp))
+
+        q = "insert into sf values (?,?)"
+        for fn in fns:
+            cur.execute(q, (skey, fn))
+
+        cur.connection.commit()
+        self.conn.hsrv.broker.ask("_reload_blocking", False, False).get()
+        self.conn.hsrv.broker.ask("up2k.wake_rescanner").get()
+
+        fn = quotep(fns[0]) if len(fns) == 1 else ""
+
+        surl = "created share: %s://%s%s%s%s/%s" % (
+            "https" if self.is_https else "http",
+            self.host,
+            self.args.SR,
+            self.args.shr,
+            skey,
+            fn,
+        )
+        self.loud_reply(surl, status=201)
+        return True
+
     def handle_rm(self, req: list[str]) -> bool:
         if not req and not self.can_delete:
             raise Pebkac(403, "not allowed for user " + self.uname)
@@ -4644,6 +4835,7 @@ class HttpCli(object):
             "have_mv": (not self.args.no_mv),
             "have_del": (not self.args.no_del),
             "have_zip": (not self.args.no_zip),
+            "have_shr": self.args.shr,
             "have_unpost": int(self.args.unpost),
             "sb_md": "" if "no_sb_md" in vf else (vf.get("md_sbf") or "y"),
             "dgrid": "grid" in vf,

copyparty/httpsrv.py

@@ -154,7 +154,17 @@ class HttpSrv(object):
 
         env = jinja2.Environment()
         env.loader = jinja2.FileSystemLoader(os.path.join(self.E.mod, "web"))
-        jn = ["splash", "svcs", "browser", "browser2", "msg", "md", "mde", "cf"]
+        jn = [
+            "splash",
+            "shares",
+            "svcs",
+            "browser",
+            "browser2",
+            "msg",
+            "md",
+            "mde",
+            "cf",
+        ]
         self.j2 = {x: env.get_template(x + ".html") for x in jn}
         zs = os.path.join(self.E.mod, "web", "deps", "prism.js.gz")
         self.prism = os.path.exists(zs)
@@ -365,7 +375,7 @@ class HttpSrv(object):
                         cip = cip[7:]
                     addr = (cip, saddr[1])
                 else:
-                    addr = (ip, sck.fileno())
+                    addr = ("127.8.3.7", sck.fileno())
             except (OSError, socket.error) as ex:
                 if self.stopping:
                     break

copyparty/svchub.py

@@ -208,6 +208,20 @@ class SvcHub(object):
             t = "WARNING: --s-rd-sz (%d) is larger than --iobuf (%d); this may lead to reduced performance"
             self.log("root", t % (args.s_rd_sz, args.iobuf), 3)
 
+        if args.chpw and args.idp_h_usr:
+            t = "ERROR: user-changeable passwords is incompatible with IdP/identity-providers; you must disable either --chpw or --idp-h-usr"
+            self.log("root", t, 1)
+            raise Exception(t)
+
+        noch = set()
+        for zs in args.chpw_no or []:
+            zsl = [x.strip() for x in zs.split(",")]
+            noch.update([x for x in zsl if x])
+        args.chpw_no = noch
+
+        if args.shr:
+            self.setup_share_db()
+
         bri = "zy"[args.theme % 2 :][:1]
         ch = "abcdefghijklmnopqrstuvwx"[int(args.theme / 2)]
         args.theme = "{0}{1} {0} {1}".format(ch, bri)
@@ -353,6 +367,93 @@ class SvcHub(object):
 
         self.broker = Broker(self)
 
+    def setup_share_db(self) -> None:
+        al = self.args
+        if not HAVE_SQLITE3:
+            self.log("root", "sqlite3 not available; disabling --shr", 1)
+            al.shr = ""
+            return
+
+        import sqlite3
+
+        al.shr = al.shr.strip("/")
+        if "/" in al.shr or not al.shr:
+            t = "config error: --shr must be the name of a virtual toplevel directory to put shares inside"
+            self.log("root", t, 1)
+            raise Exception(t)
+
+        al.shr = "/%s/" % (al.shr,)
+
+        create = True
+        modified = False
+        db_path = self.args.shr_db
+        self.log("root", "opening shares-db %s" % (db_path,))
+        for n in range(2):
+            try:
+                db = sqlite3.connect(db_path)
+                cur = db.cursor()
+                try:
+                    cur.execute("select count(*) from sh").fetchone()
+                    create = False
+                    break
+                except:
+                    pass
+            except Exception as ex:
+                if n:
+                    raise
+                t = "shares-db corrupt; deleting and recreating: %r"
+                self.log("root", t % (ex,), 3)
+                try:
+                    cur.close()  # type: ignore
+                except:
+                    pass
+                try:
+                    db.close()  # type: ignore
+                except:
+                    pass
+                os.unlink(db_path)
+
+        sch1 = [
+            r"create table kv (k text, v int)",
+            r"create table sh (k text, pw text, vp text, pr text, st int, un text, t0 int, t1 int)",
+            # sharekey, password, src, perms, numFiles, owner, created, expires
+        ]
+        sch2 = [
+            r"create table sf (k text, vp text)",
+            r"create index sf_k on sf(k)",
+            r"create index sh_k on sh(k)",
+            r"create index sh_t1 on sh(t1)",
+        ]
+
+        assert db  # type: ignore
+        assert cur  # type: ignore
+        if create:
+            dver = 2
+            modified = True
+            for cmd in sch1 + sch2:
+                cur.execute(cmd)
+            self.log("root", "created new shares-db")
+        else:
+            (dver,) = cur.execute("select v from kv where k = 'sver'").fetchall()[0]
+
+        if dver == 1:
+            modified = True
+            for cmd in sch2:
+                cur.execute(cmd)
+            cur.execute("update sh set st = 0")
+            self.log("root", "shares-db schema upgrade ok")
+
+        if modified:
+            for cmd in [
+                r"delete from kv where k = 'sver'",
+                r"insert into kv values ('sver', %d)" % (2,),
+            ]:
+                cur.execute(cmd)
+            db.commit()
+
+        cur.close()
+        db.close()
+
     def start_ftpd(self) -> None:
         time.sleep(30)
 
@@ -815,18 +916,21 @@ class SvcHub(object):
         Daemon(self._reload, "reloading")
         return "reload initiated"
 
-    def _reload(self, rescan_all_vols: bool = True) -> None:
+    def _reload(self, rescan_all_vols: bool = True, up2k: bool = True) -> None:
         with self.up2k.mutex:
             if self.reloading != 1:
                 return
             self.reloading = 2
             self.log("root", "reloading config")
-            self.asrv.reload()
-            self.up2k.reload(rescan_all_vols)
+            self.asrv.reload(9 if up2k else 4)
+            if up2k:
+                self.up2k.reload(rescan_all_vols)
+            else:
+                self.log("root", "reload done")
             self.broker.reload()
             self.reloading = 0
 
-    def _reload_blocking(self, rescan_all_vols: bool = True) -> None:
+    def _reload_blocking(self, rescan_all_vols: bool = True, up2k: bool = True) -> None:
         while True:
             with self.up2k.mutex:
                 if self.reloading < 2:
@@ -837,7 +941,7 @@ class SvcHub(object):
         # try to handle multiple pending IdP reloads at once:
         time.sleep(0.2)
 
-        self._reload(rescan_all_vols=rescan_all_vols)
+        self._reload(rescan_all_vols=rescan_all_vols, up2k=up2k)
 
     def stop_thr(self) -> None:
         while not self.stop_req:

copyparty/tcpsrv.py

@@ -226,10 +226,22 @@ class TcpSrv(object):
         self.log("tcpsrv", msg, c)
 
     def _listen(self, ip: str, port: int) -> None:
+        uds_perm = uds_gid = -1
         if "unix:" in ip:
             tcp = False
             ipv = socket.AF_UNIX
-            ip = ip.split("unix:")[1]
+            uds = ip.split(":")
+            ip = uds[-1]
+            if len(uds) > 2:
+                uds_perm = int(uds[1], 8)
+            if len(uds) > 3:
+                try:
+                    uds_gid = int(uds[2])
+                except:
+                    import grp
+
+                    uds_gid = grp.getgrnam(uds[2]).gr_gid
+
         elif ":" in ip:
             tcp = True
             ipv = socket.AF_INET6
@@ -265,7 +277,13 @@ class TcpSrv(object):
                     srv.bind(ip)
                 else:
                     tf = "%s.%d" % (ip, os.getpid())
+                    if os.path.exists(tf):
+                        os.unlink(tf)
                     srv.bind(tf)
+                    if uds_gid != -1:
+                        os.chown(tf, -1, uds_gid)
+                    if uds_perm != -1:
+                        os.chmod(tf, uds_perm)
                     atomic_move(self.nlog, tf, ip, VF_CAREFUL)
 
             sport = srv.getsockname()[1] if tcp else port

copyparty/u2idx.py

@@ -59,6 +59,8 @@ class U2idx(object):
         self.mem_cur = sqlite3.connect(":memory:", check_same_thread=False).cursor()
         self.mem_cur.execute(r"create table a (b text)")
 
+        self.sh_cur: Optional["sqlite3.Cursor"] = None
+
         self.p_end = 0.0
         self.p_dur = 0.0
 
@@ -95,17 +97,31 @@ class U2idx(object):
         except:
             raise Pebkac(500, min_ex())
 
-    def get_cur(self, vn: VFS) -> Optional["sqlite3.Cursor"]:
-        if not HAVE_SQLITE3:
+    def get_shr(self) -> Optional["sqlite3.Cursor"]:
+        if self.sh_cur:
+            return self.sh_cur
+
+        if not HAVE_SQLITE3 or not self.args.shr:
             return None
 
+        assert sqlite3  # type: ignore
+
+        db = sqlite3.connect(self.args.shr_db, timeout=2, check_same_thread=False)
+        cur = db.cursor()
+        cur.execute('pragma table_info("sh")').fetchall()
+        self.sh_cur = cur
+        return cur
+
+    def get_cur(self, vn: VFS) -> Optional["sqlite3.Cursor"]:
         cur = self.cur.get(vn.realpath)
         if cur:
             return cur
 
-        if "e2d" not in vn.flags:
+        if not HAVE_SQLITE3 or "e2d" not in vn.flags:
             return None
 
+        assert sqlite3  # type: ignore
+
         ptop = vn.realpath
         histpath = self.asrv.vfs.histtab.get(ptop)
         if not histpath:

copyparty/up2k.py

@@ -454,11 +454,17 @@ class Up2k(object):
             cooldown = now + 3
             # self.log("SR", 5)
 
-            if self.args.no_lifetime:
+            if self.args.no_lifetime and not self.args.shr:
                 timeout = now + 9001
             else:
                 # important; not deferred by db_act
                 timeout = self._check_lifetimes()
+                try:
+                    if self.args.shr:
+                        timeout = min(self._check_shares(), timeout)
+                except Exception as ex:
+                    t = "could not check for expiring shares: %r"
+                    self.log(t % (ex,), 1)
 
             try:
                 timeout = min(timeout, now + self._check_xiu())
@@ -561,6 +567,34 @@ class Up2k(object):
 
         return timeout
 
+    def _check_shares(self) -> float:
+        assert sqlite3  # type: ignore
+
+        now = time.time()
+        timeout = now + 9001
+
+        db = sqlite3.connect(self.args.shr_db, timeout=2)
+        cur = db.cursor()
+
+        q = "select k from sh where t1 and t1 <= ?"
+        rm = [x[0] for x in cur.execute(q, (now,))]
+        if rm:
+            self.log("forgetting expired shares %s" % (rm,))
+            cur.executemany("delete from sh where k=?", [(x,) for x in rm])
+            cur.executemany("delete from sf where k=?", [(x,) for x in rm])
+            db.commit()
+            Daemon(self.hub._reload_blocking, "sharedrop", (False, False))
+
+        q = "select min(t1) from sh where t1 > 1"
+        (earliest,) = cur.execute(q).fetchone()
+        if earliest:
+            timeout = earliest - now
+
+        cur.close()
+        db.close()
+
+        return timeout
+
     def _check_xiu(self) -> float:
         if self.xiu_busy:
             return 2
@@ -2535,6 +2569,10 @@ class Up2k(object):
 
         cur.connection.commit()
 
+    def wake_rescanner(self):
+        with self.rescan_cond:
+            self.rescan_cond.notify_all()
+
     def handle_json(
         self, cj: dict[str, Any], busy_aps: dict[str, int]
     ) -> dict[str, Any]:
@@ -2564,7 +2602,10 @@ class Up2k(object):
 
         return ret
 
-    def _handle_json(self, cj: dict[str, Any]) -> dict[str, Any]:
+    def _handle_json(self, cj: dict[str, Any], depth: int = 1) -> dict[str, Any]:
+        if depth > 16:
+            raise Pebkac(500, "too many xbu relocs, giving up")
+
         ptop = cj["ptop"]
         if not self.register_vpath(ptop, cj["vcfg"]):
             if ptop not in self.registry:
@@ -2757,7 +2798,8 @@ class Up2k(object):
                         job = deepcopy(job)
                         job["wark"] = wark
                         job["at"] = cj.get("at") or time.time()
-                        for k in "lmod ptop vtop prel name host user addr".split():
+                        zs = "lmod ptop vtop prel name host user addr poke"
+                        for k in zs.split():
                             job[k] = cj.get(k) or ""
 
                         pdir = djoin(cj["ptop"], cj["prel"])
@@ -2794,12 +2836,18 @@ class Up2k(object):
                             if hr.get("reloc"):
                                 x = pathmod(self.asrv.vfs, dst, vp, hr["reloc"])
                                 if x:
+                                    zvfs = vfs
                                     pdir, _, job["name"], (vfs, rem) = x
                                     dst = os.path.join(pdir, job["name"])
+                                    job["vcfg"] = vfs.flags
                                     job["ptop"] = vfs.realpath
                                     job["vtop"] = vfs.vpath
                                     job["prel"] = rem
-                                    bos.makedirs(pdir)
+                                    if zvfs.vpath != vfs.vpath:
+                                        # print(json.dumps(job, sort_keys=True, indent=4))
+                                        job["hash"] = cj["hash"]
+                                        self.log("xbu reloc1:%d..." % (depth,), 6)
+                                        return self._handle_json(job, depth + 1)
 
                         job["name"] = self._untaken(pdir, job, now)
 
@@ -2880,7 +2928,9 @@ class Up2k(object):
                         lut.add(k)
 
                 try:
-                    self._new_upload(job)
+                    ret = self._new_upload(job, vfs, depth)
+                    if ret:
+                        return ret  # xbu recursed
                 except:
                     self.registry[job["ptop"]].pop(job["wark"], None)
                     raise
@@ -4176,22 +4226,17 @@ class Up2k(object):
 
         return ret
 
-    def _new_upload(self, job: dict[str, Any]) -> None:
+    def _new_upload(self, job: dict[str, Any], vfs: VFS, depth: int) -> dict[str, str]:
         pdir = djoin(job["ptop"], job["prel"])
         if not job["size"]:
             try:
                 inf = bos.stat(djoin(pdir, job["name"]))
                 if stat.S_ISREG(inf.st_mode):
                     job["lmod"] = inf.st_size
-                    return
+                    return {}
             except:
                 pass
 
-        self.registry[job["ptop"]][job["wark"]] = job
-        job["name"] = self._untaken(pdir, job, job["t0"])
-        # if len(job["name"].split(".")) > 8:
-        #    raise Exception("aaa")
-
         xbu = self.flags[job["ptop"]].get("xbu")
         ap_chk = djoin(pdir, job["name"])
         vp_chk = djoin(job["vtop"], job["prel"], job["name"])
@@ -4220,10 +4265,18 @@ class Up2k(object):
             if hr.get("reloc"):
                 x = pathmod(self.asrv.vfs, ap_chk, vp_chk, hr["reloc"])
                 if x:
+                    zvfs = vfs
                     pdir, _, job["name"], (vfs, rem) = x
+                    job["vcfg"] = vfs.flags
                     job["ptop"] = vfs.realpath
                     job["vtop"] = vfs.vpath
                     job["prel"] = rem
+                    if zvfs.vpath != vfs.vpath:
+                        self.log("xbu reloc2:%d..." % (depth,), 6)
+                        return self._handle_json(job, depth + 1)
+
+        job["name"] = self._untaken(pdir, job, job["t0"])
+        self.registry[job["ptop"]][job["wark"]] = job
 
         tnam = job["name"] + ".PARTIAL"
         if self.args.dotpart:
@@ -4233,7 +4286,7 @@ class Up2k(object):
             job["tnam"] = tnam
             if not job["hash"]:
                 del self.registry[job["ptop"]][job["wark"]]
-            return
+            return {}
 
         if self.args.plain_ip:
             dip = job["addr"].replace(":", ".")
@@ -4293,6 +4346,8 @@ class Up2k(object):
         if not job["hash"]:
             self._finish_upload(job["ptop"], job["wark"])
 
+        return {}
+
     def _snapshot(self) -> None:
         slp = self.args.snap_wri
         if not slp or self.args.no_snap:

copyparty/util.py

@@ -1760,7 +1760,7 @@ def read_header(sr: Unrecv, t_idle: int, t_tot: int) -> list[str]:
 
         ofs = ret.find(b"\r\n\r\n")
         if ofs < 0:
-            if len(ret) > 1024 * 64:
+            if len(ret) > 1024 * 32:
                 raise Pebkac(400, "header 2big")
             else:
                 continue

copyparty/web/browser.css

@@ -10,7 +10,6 @@
 	--fg2-max: #fff;
 	--fg-weak: #bbb;
 
-	--bg-u7: #555;
 	--bg-u6: #4c4c4c;
 	--bg-u5: #444;
 	--bg-u4: #383838;
@@ -43,8 +42,14 @@
 	--btn-h-bg: #805;
 	--btn-1-fg: #400;
 	--btn-1-bg: var(--a);
+	--btn-h-bs: var(--btn-bs);
+	--btn-h-bb: var(--btn-bb);
+	--btn-1-bs: var(--btn-bs);
+	--btn-1-bb: var(--btn-bb);
 	--btn-1h-fg: var(--btn-1-fg);
 	--btn-1h-bg: #fe8;
+	--btn-1h-bs: var(--btn-1-bs);
+	--btn-1h-bb: var(--btn-1-bb);
 	--chk-fg: var(--tab-alt);
 	--txt-sh: var(--bg-d2);
 	--txt-bg: var(--btn-bg);
@@ -212,22 +217,19 @@ html.y {
 html.a {
 	--op-aa-sh: 0 0 .2em var(--bg-d3) inset;
 
-	--u2-o-bg: #603;
-	--u2-o-b1: #a16;
-	--u2-o-sh: #a00;
-	--u2-o-h-bg: var(--u2-o-bg);
-	--u2-o-h-b1: #fb0;
-	--u2-o-h-sh: #fb0;
-	--u2-o-1-bg: #6a1;
-	--u2-o-1-b1: #efa;
-	--u2-o-1-sh: #0c0;
-	--u2-o-1h-bg: var(--u2-o-1-bg);
+	--btn-bs: 0 0 .2em var(--bg-d3);
+}
+html.az {
+	--btn-1-bs: 0 0 .1em var(--fg) inset;
 }
 html.ay {
 	--op-aa-sh: 0 .1em .2em #ccc;
 	--op-aa-bg: var(--bg-max);
 }
 html.b {
+	--btn-bs: 0 .05em 0 var(--bg-d3) inset;
+	--btn-1-bs: 0 .05em 0 var(--btn-1h-bg) inset;
+
 	--tree-bg: var(--bg);
 
 	--g-bg: var(--bg);
@@ -244,17 +246,13 @@ html.b {
 	--u2-b1-bg: rgba(128,128,128,0.15);
 	--u2-b2-bg: var(--u2-b1-bg);
 
-	--u2-o-bg: var(--btn-bg);
-	--u2-o-h-bg: var(--btn-h-bg);
-	--u2-o-1-bg: var(--a);
-	--u2-o-1h-bg: var(--a-hil);
-
 	--f-sh1: 0.1;
 	--mp-b-bg: transparent;
 }
 html.bz {
 	--fg: #cce;
 	--fg-weak: #bbd;
+
 	--bg-u5: #3b3f58;
 	--bg-u4: #1e2130;
 	--bg-u3: #1e2130;
@@ -266,12 +264,14 @@ html.bz {
 
 	--row-alt: #181a27;
 
+	--a-b: #fb4;
+
 	--btn-bg: #202231;
 	--btn-h-bg: #2d2f45;
-	--btn-1-bg: #ba2959;
-	--btn-1-is: #f59;
-	--btn-1-fg: #fff;
+	--btn-1-bg: #eb6;
+	--btn-1-fg: #000;
 	--btn-1h-fg: #000;
+	--btn-1h-bg: #ff9;
 	--txt-sh: a;
 
 	--u2-tab-b1: var(--bg-u5);
@@ -306,6 +306,7 @@ html.by {
 }
 html.c {
 	font-weight: bold;
+
 	--fg: #fff;
 	--fg-weak: #cef;
 	--bg-u5: #409;
@@ -326,16 +327,23 @@ html.c {
 	--chk-fg: #d90;
 
 	--op-aa-bg: #f9dd22;
-	--u2-o-1-bg: #4cf;
 
 	--srv-1: #ea0;
 	--mp-b-bg: transparent;
 }
 html.cz {
 	--bgg: var(--bg-u2);
+
 	--sel-bg: var(--bg-u5);
 	--sel-fg: var(--fg);
+
+	--btn-bb: .2em solid #709;
+	--btn-bs: 0 .1em .6em rgba(255,0,185,0.5);
+	--btn-1-bb: .2em solid #e90;
+	--btn-1-bs: 0 .1em .8em rgba(255,205,0,0.9);
+
 	--srv-3: #fff;
+
 	--u2-tab-b1: var(--bg-d3);
 }
 html.cy {
@@ -363,6 +371,7 @@ html.cy {
 	--btn-h-fg: #fff;
 	--btn-1-bg: #ff0;
 	--btn-1-fg: #000;
+	--btn-bs: 0 .25em 0 #f00;
 	--chk-fg: #fd0;
 
 	--srv-1: #f00;
@@ -371,8 +380,6 @@ html.cy {
 
 	--u2-b1-bg: #f00;
 	--u2-b2-bg: #f00;
-	--u2-o-bg: #ff0;
-	--u2-o-1-bg: #f00;
 }
 html.dz {
 	--fg: #4d4;
@@ -380,7 +387,6 @@ html.dz {
 	--fg2-max: #fff;
 	--fg-weak: #2a2;
 
-	--bg-u7: #020;
 	--bg-u6: #020;
 	--bg-u5: #050;
 	--bg-u4: #020;
@@ -413,6 +419,9 @@ html.dz {
 	--btn-1-bg: #4f4;
 	--btn-1h-fg: var(--btn-1-fg);
 	--btn-1h-bg: #3f3;
+	--btn-bs: 0 0 0 .1em #080 inset;
+	--btn-1-bs: a;
+
 	--chk-fg: var(--tab-alt);
 	--txt-sh: var(--bg-d2);
 	--txt-bg: var(--btn-bg);
@@ -434,12 +443,6 @@ html.dz {
 	--u2-b-fg: #fff;
 	--u2-b1-bg: #3a3;
 	--u2-b2-bg: #3a3;
-	--u2-o-bg: var(--btn-bg);
-	--u2-o-b1: var(--bg-u5);
-	--u2-o-h-bg: var(--fg-weak);
-	--u2-o-1-bg: var(--fg-weak);
-	--u2-o-1-b1: var(--a);
-	--u2-o-1h-bg: var(--a);
 	--u2-inf-bg: #07a;
 	--u2-inf-b1: #0be;
 	--u2-ok-bg: #380;
@@ -551,10 +554,6 @@ html.dy {
 	--u2-tab-1-bg: a;
 	--u2-b1-bg: #000;
 	--u2-b2-bg: #000;
-	--u2-o-h-bg: #999;
-	--u2-o-1h-bg: #999;
-	--u2-o-bg: #eee;
-	--u2-o-1-bg: #000;
 
 	--ud-b1: a;
 
@@ -627,6 +626,7 @@ pre, code, tt, #doc, #doc>code {
 	overflow: hidden;
 	width: 0;
 	height: 0;
+	color: var(--bg);
 }
 html .ayjump:focus {
 	z-index: 80386;
@@ -963,6 +963,8 @@ html.y #path a:hover {
 #files tbody tr.play a:hover {
 	color: var(--btn-1h-fg);
 	background: var(--btn-1h-bg);
+	box-shadow: var(--btn-1h-bs);
+	border-bottom: var(--btn-1h-bb);
 }
 #ggrid {
 	margin: -.2em -.5em;
@@ -971,6 +973,7 @@ html.y #path a:hover {
 	overflow: hidden;
 	display: block;
 	display: -webkit-box;
+	line-clamp: var(--grid-ln);
 	-webkit-line-clamp: var(--grid-ln);
 	-webkit-box-orient: vertical;
 	padding-top: .3em;
@@ -1145,6 +1148,7 @@ html.y #widget.open {
 	width: 100%;
 	height: 100%;
 }
+#fshr,
 #wtgrid,
 #wtico {
 	position: relative;
@@ -1331,6 +1335,7 @@ html.y #widget.open {
 #widget.cmp #wtoggle {
 	font-size: 1.2em;
 }
+#widget.cmp #fshr,
 #widget.cmp #wtgrid {
 	display: none;
 }
@@ -1431,7 +1436,11 @@ input[type="checkbox"]+label {
 input[type="radio"]:checked+label,
 input[type="checkbox"]:checked+label {
 	color: #0e0;
-	color: var(--a);
+	color: var(--btn-1-bg);
+}
+input[type="checkbox"]:checked+label {
+	box-shadow: var(--btn-1-bs);
+	border-bottom: var(--btn-1-bb);
 }
 html.dz input {
 	font-family: 'scp', monospace, monospace;
@@ -1609,6 +1618,8 @@ html {
 	color: var(--btn-fg);
 	background: #eee;
 	background: var(--btn-bg);
+	box-shadow: var(--btn-bs);
+	border-bottom: var(--btn-bb);
 	border-radius: .3em;
 	padding: .2em .4em;
 	font-size: 1.2em;
@@ -1622,20 +1633,14 @@ html.c .btn,
 html.a .btn {
 	border-radius: .2em;
 }
-html.cz .btn {
-	box-shadow: 0 .1em .6em rgba(255,0,185,0.5);
-	border-bottom: .2em solid #709;
-}
 html.dz .btn {
 	font-size: 1em;
-	box-shadow: 0 0 0 .1em #080 inset;
-}
-html.dz .tgl.btn.on {
-	box-shadow: 0 0 0 .1em var(--btn-1-bg) inset;
 }
 .btn:hover {
 	color: var(--btn-h-fg);
 	background: var(--btn-h-bg);
+	box-shadow: var(--btn-h-bs);
+	border-bottom: var(--btn-h-bb);
 }
 .tgl.btn.on {
 	background: #000;
@@ -1643,14 +1648,14 @@ html.dz .tgl.btn.on {
 	color: #fff;
 	color: var(--btn-1-fg);
 	text-shadow: none;
-}
-html.cz .tgl.btn.on {
-	box-shadow: 0 .1em .8em rgba(255,205,0,0.9);
-	border-bottom: .2em solid #e90;
+	box-shadow: var(--btn-1-bs);
+	border-bottom: var(--btn-1-bb);
 }
 .tgl.btn.on:hover {
-	background: var(--btn-1h-bg);
 	color: var(--btn-1h-fg);
+	background: var(--btn-1h-bg);
+	box-shadow: var(--btn-1h-bs);
+	border-bottom: var(--btn-1h-bb);
 }
 #detree {
 	padding: .3em .5em;
@@ -1855,6 +1860,7 @@ html.y #tree.nowrap .ntree a+a:hover {
 #unpost td:nth-child(4) {
 	text-align: right;
 }
+#shui,
 #rui {
 	background: #fff;
 	background: var(--bg);
@@ -1870,13 +1876,25 @@ html.y #tree.nowrap .ntree a+a:hover {
 	padding: 1em;
 	z-index: 765;
 }
+#shui div+div,
 #rui div+div {
 	margin-top: 1em;
 }
+#shui table,
 #rui table {
 	width: 100%;
 	border-collapse: collapse;
 }
+#shui button {
+	margin: 0 1em 0 0;
+}
+#shui .btn {
+	font-size: 1em;
+}
+#shui td {
+	padding: .8em 0;
+}
+#shui td+td,
 #rui td+td {
 	padding: .2em 0 .2em .5em;
 }
@@ -1884,10 +1902,15 @@ html.y #tree.nowrap .ntree a+a:hover {
 	font-family: 'scp', monospace, monospace;
 	font-family: var(--font-mono), 'scp', monospace, monospace;
 }
+#shui td+td,
 #rui td+td,
+#shui td input[type="text"],
 #rui td input[type="text"] {
 	width: 100%;
 }
+#shui td.exs input[type="text"] {
+	width: 3em;
+}
 #rn_f.m td:first-child {
 	white-space: nowrap;
 }
@@ -2682,23 +2705,25 @@ html.b #u2conf a.b:hover {
 #u2conf input[type="checkbox"]:checked+label {
 	position: relative;
 	cursor: pointer;
-	background: var(--u2-o-bg);
-	border-bottom: .2em solid var(--u2-o-b1);
-	box-shadow: 0 .1em .3em var(--u2-o-sh) inset;
+	background: var(--btn-bg);
+	box-shadow: var(--btn-bs);
+	border-bottom: var(--btn-bb);
 	text-shadow: 1px 1px 1px #000, 1px -1px 1px #000, -1px -1px 1px #000, -1px 1px 1px #000;
 }
 #u2conf input[type="checkbox"]:checked+label {
-	background: var(--u2-o-1-bg);
-	border-bottom: .2em solid var(--u2-o-1-b1);
-	box-shadow: 0 .1em .5em var(--u2-o-1-sh);
+	background: var(--btn-1-bg);
+	box-shadow: var(--btn-1-bs);
+	border-bottom: var(--btn-1-bb);
 }
 #u2conf input[type="checkbox"]+label:hover {
-	box-shadow: 0 .1em .3em var(--u2-o-h-sh);
-	border-color: var(--u2-o-h-b1);
-	background: var(--u2-o-h-bg);
+	background: var(--btn-h-bg);
+	box-shadow: var(--btn-h-bs);
+	border-bottom: var(--btn-h-bb);
 }
 #u2conf input[type="checkbox"]:checked+label:hover {
-	background: var(--u2-o-1h-bg);
+	background: var(--btn-1h-bg);
+	box-shadow: var(--btn-1h-bs);
+	border-bottom: var(--btn-1h-bb);
 }
 #op_up2k.srch #u2conf td:nth-child(2)>*,
 #op_up2k.srch #u2conf td:nth-child(3)>* {
@@ -3058,14 +3083,6 @@ html.b #ggrid>a {
 html.b .btn {
 	top: -.1em;
 }
-html.b .btn,
-html.b #u2conf a.b,
-html.b #u2conf input[type="checkbox"]:not(:checked)+label {
-	box-shadow: 0 .05em 0 var(--bg-d3) inset;
-}
-html.b .tgl.btn.on {
-	box-shadow: 0 .05em 0 var(--btn-1-is) inset;
-}
 html.b #op_up2k.srch sup {
 	color: #fc0;
 }

copyparty/web/browser.html

@@ -67,14 +67,14 @@
 	<div id="op_up2k" class="opview"></div>
 
 	<div id="op_cfg" class="opview opbox opwide"></div>
-	
+
 	<h1 id="path">
 		<a href="#" id="entree">🌲</a>
 		{%- for n in vpnodes %}
 		<a href="{{ r }}/{{ n[0] }}">{{ n[1] }}</a>
 		{%- endfor %}
 	</h1>
-	
+
 	<div id="tree"></div>
 
 <div id="wrap">
@@ -118,11 +118,11 @@
 
 		</tbody>
 	</table>
-	
+
 	<div id="epi" class="logue">{{ "" if sb_lg else logues[1] }}</div>
 
 	<h2 id="wfp"><a href="{{ r }}/?h" id="goh">control-panel</a></h2>
-	
+
 	<a href="#" id="repl">π</a>
 
 </div>

copyparty/web/browser.js

@@ -309,6 +309,25 @@ var Ls = {
 		"fd_emore": "select at least one item to delete",
 		"fc_emore": "select at least one item to cut",
 
+		"fs_sc": "share the folder you're in",
+		"fs_ss": "share the selected files",
+		"fs_just1d": "you cannot select more than one folder,\nor mix flies and folders in one selection",
+		"fs_abrt": "❌ abort",
+		"fs_rand": "🎲 rand.name",
+		"fs_go": "✅ create share",
+		"fs_name": "name",
+		"fs_src": "source",
+		"fs_pwd": "passwd",
+		"fs_exp": "expiry",
+		"fs_tmin": "min",
+		"fs_thrs": "hours",
+		"fs_tdays": "days",
+		"fs_never": "eternal",
+		"fs_pname": "optional link name; will be random if blank",
+		"fs_tsrc": "the file or folder to share",
+		"fs_ppwd": "optional password",
+		"fs_ok": "<h6>share-URL created</h6>\npress <code>Enter/OK</code> to Clipboard\npress <code>ESC/Cancel</code> to Close\n\n",
+
 		"frt_dec": "may fix some cases of broken filenames\">url-decode",
 		"frt_rst": "reset modified filenames back to the original ones\">↺ reset",
 		"frt_abrt": "abort and close this window\">❌ cancel",
@@ -821,11 +840,30 @@ var Ls = {
 		"fr_eperm": 'kan ikke endre navn:\ndu har ikke “move”-rettigheten i denne mappen',
 		"fd_eperm": 'kan ikke slette:\ndu har ikke “delete”-rettigheten i denne mappen',
 		"fc_eperm": 'kan ikke klippe ut:\ndu har ikke “move”-rettigheten i denne mappen',
-		"fp_eperm": 'kan ikke lime inn:\ndu har ikke "write"-rettigheten i denne mappen',
+		"fp_eperm": 'kan ikke lime inn:\ndu har ikke “write”-rettigheten i denne mappen',
 		"fr_emore": "velg minst én fil som skal få nytt navn",
 		"fd_emore": "velg minst én fil som skal slettes",
 		"fc_emore": "velg minst én fil som skal klippes ut",
 
+		"fs_sc": "del mappen du er i nå",
+		"fs_ss": "del de valgte filene",
+		"fs_just1d": "du kan ikke markere flere mapper samtidig,\neller kombinere mapper og filer",
+		"fs_abrt": "❌ avbryt",
+		"fs_rand": "🎲 tilfeldig navn",
+		"fs_go": "✅ opprett deling",
+		"fs_name": "navn",
+		"fs_src": "kilde",
+		"fs_pwd": "passord",
+		"fs_exp": "varighet",
+		"fs_tmin": "min",
+		"fs_thrs": "timer",
+		"fs_tdays": "dager",
+		"fs_never": "for evig",
+		"fs_pname": "frivillig navn (blir noe tilfeldig ellers)",
+		"fs_tsrc": "fil/mappe som skal deles",
+		"fs_ppwd": "frivillig passord",
+		"fs_ok": "<h6>URL opprettet</h6>\ntrykk <code>Enter/OK</code> for å kopiere linken (for CTRL-V)\ntrykk <code>ESC/Avbryt</code> for å bare bekrefte\n\n",
+
 		"frt_dec": "kan korrigere visse ødelagte filnavn\">url-decode",
 		"frt_rst": "nullstiller endringer (tilbake til de originale filnavnene)\">↺ reset",
 		"frt_abrt": "avbryt og lukk dette vinduet\">❌ avbryt",
@@ -1037,14 +1075,550 @@ var Ls = {
 
 		"lang_set": "passer det å laste siden på nytt?",
 	},
+
+	"chi": {
+		// 以 //m 结尾的行是未经验证的机器翻译
+		"tt": "中文",
+		"cols": {
+			"c": "操作按钮",
+			"dur": "持续时间",
+			"q": "质量 / 比特率",
+			"Ac": "音频编码",
+			"Vc": "视频编码",
+			"Fmt": "格式 / 容器",
+			"Ahash": "音频校验和",
+			"Vhash": "视频校验和",
+			"Res": "分辨率",
+			"T": "文件类型",
+			"aq": "音频质量 / 比特率",
+			"vq": "视频质量 / 比特率",
+			"pixfmt": "子采样 / 像素结构",
+			"resw": "水平分辨率",
+			"resh": "垂直分辨率",
+			"chs": "音频频道",
+			"hz": "采样率"
+		},
+
+		"hks": [
+			[
+				"misc",
+				["ESC", "关闭各种窗口"],
+
+				"file-manager",
+				["G", "切换列表 / 网格视图"],
+				["T", "切换缩略图 / 图标"],
+				["🡅 A/D", "缩略图大小"],
+				["ctrl-K", "删除选中项"],
+				["ctrl-X", "剪切选中项"],
+				["ctrl-V", "粘贴到文件夹"],
+				["Y", "下载选中项"],
+				["F2", "重命名选中项"],
+
+				"file-list-sel",
+				["space", "切换文件选择"],
+				["🡑/🡓", "移动选择光标"],
+				["ctrl 🡑/🡓", "移动光标和视图"],
+				["🡅 🡑/🡓", "选择上一个/下一个文件"],
+				["ctrl-A", "选择所有文件 / 文件夹"]
+			], [
+				"navigation",
+				["B", "切换面包屑导航 / 导航窗格"],
+				["I/K", "前一个/下一个文件夹"],
+				["M", "父文件夹（或折叠当前文件夹）"],
+				["V", "切换导航窗格中的文件夹 / 文本文件"],
+				["A/D", "导航窗格大小"]
+			], [
+				"audio-player",
+				["J/L", "上一首/下一首歌曲"],
+				["U/O", "跳过10秒向前/向后"],
+				["0..9", "跳转到0%..90%"],
+				["P",  "播放/暂停（也可以启动）"],
+				["Y", "下载歌曲"]
+			], [
+				"image-viewer",
+				["J/L, ←/→", "上一张/下一张图片"],
+				["Home/End", "第一张/最后一张图片"],
+				["F", "全屏"],
+				["R", "顺时针旋转"],
+				["🡅 R", "逆时针旋转"],
+				["Y", "下载图片"]
+			], [
+				"video-player",
+				["U/O", "跳过10秒向前/向后"],
+				["P/K/Space", "播放/暂停"],
+				["C", "继续播放下一段"],
+				["V", "循环"],
+				["M", "静音"],
+				["[ and ]", "设置循环区间"]
+			], [
+				"textfile-viewer",
+				["I/K", "前一个/下一个文件"],
+				["M", "关闭文本文件"],
+				["E", "编辑文本文件"],
+				["S", "选择文件（用于剪切/重命名）"]
+			]
+		],
+
+		"m_ok": "确定",
+		"m_ng": "取消",
+
+		"ht_s": "秒",
+		"ht_m": "分",
+		"ht_h": "时",
+		"ht_d": "天",
+		"ht_and": " 和 ",
+
+		"goh": "控制面板",
+		"gop": '前一项">pre',
+		"gou": '顶部">up',
+		"gon": '下一项">next',
+		"logout": " 登出",
+		"access": " 访问",
+		"ot_close": "关闭子菜单",
+		"ot_search": "按属性、路径/名称、音乐标签或上述内容的任意组合搜索文件$N$N&lt;code&gt;foo bar&lt;/code&gt; = 必须包含 «foo» 和 «bar»,$N&lt;code&gt;foo -bar&lt;/code&gt; = 包含 «foo» 而不包含 «bar»,$N&lt;code&gt;^yana .opus$&lt;/code&gt; = 以 «yama» 为开头的 «opus» 文件$N&lt;code&gt;&quot;try unite&quot;&lt;/code&gt; = 正好包含 «try unite»$N$N时间格式为 iso-8601, 比如:$N&lt;code&gt;2009-12-31&lt;/code&gt; or &lt;code&gt;2020-09-12 23:30:00&lt;/code&gt;",
+		"ot_unpost": "取消发布：删除最近上传的内容，或中止未完成的内容",
+		"ot_bup": "bup：基础上传器，甚至支持 Netscape 4.0",
+		"ot_mkdir": "mkdir：创建新目录",
+		"ot_md": "new-md：创建新 Markdown 文档",
+		"ot_msg": "msg：向服务器日志发送消息",
+		"ot_mp": "媒体播放器选项",
+		"ot_cfg": "配置选项",
+		"ot_u2i": 'up2k：上传文件（如果你有写入权限），或切换到搜索模式以查看文件是否存在于服务器上,$N$N上传是可恢复的，多线程的，保留文件时间戳，但比 [🎈]&nbsp;（基础上传器）占用 更多的CPU<br /><br />上传过程中，此图标会变成进度指示器！',
+		"ot_u2w": 'up2k：带有恢复支持的文件上传（关闭浏览器后，重新上传相同文件）$N$N多线程的，文件时间戳得以保留，但比 [🎈]&nbsp; （基础上传器）使用更多CPU<br /><br />上传过程中，这个图标会变成进度指示器！',
+		"ot_noie": '请使用 Chrome / Firefox / Edge',
+
+		"ab_mkdir": "创建目录",
+		"ab_mkdoc": "新建 Markdown 文档",
+		"ab_msg": "发送消息到服务器日志",
+
+		"ay_path": "跳转到文件夹",
+		"ay_files": "跳转到文件",
+
+		"wt_ren": "重命名选中的项目$N快捷键: F2",
+		"wt_del": "删除选中的项目$N快捷键: ctrl-K",
+		"wt_cut": "剪切选中的项目&lt;small&gt;（然后粘贴到其他地方）&lt;/small&gt;$N快捷键: ctrl-X",
+		"wt_pst": "粘贴之前剪切/复制的选择$N快捷键: ctrl-V",
+		"wt_selall": "选择所有文件$N快捷键: ctrl-A（当文件被聚焦时）",
+		"wt_selinv": "反转选择",
+		"wt_selzip": "将选择下载为归档文件",
+		"wt_seldl": "将选择下载为单独的文件$N快捷键: Y",
+		"wt_npirc": "复制 IRC 格式的曲目信息",
+		"wt_nptxt": "复制纯文本格式的曲目信息",
+		"wt_grid": "切换网格/列表视图$N快捷键: G",
+		"wt_prev": "上一曲$N快捷键: J",
+		"wt_play": "播放/暂停$N快捷键: P",
+		"wt_next": "下一曲$N快捷键: L",
+
+		"ul_par": "并行上传：",
+		"ut_rand": "随机化文件名",
+		"ut_u2ts": "将最后修改的时间戳$N从你的文件系统复制到服务器",
+		"ut_mt": "在上传时继续哈希其他文件$N$N如果你的 CPU 或硬盘是瓶颈，可能需要禁用",
+		"ut_ask": '上传开始前询问确认">💭',
+		"ut_pot": "通过简化 UI 来$N提高慢设备上的上传速度",
+		"ut_srch": "实际不上传，而是检查文件是否$N已经存在于服务器上（将扫描你可以读取的所有文件夹）",
+		"ut_par": "通过将其设置为 0 来暂停上传$N$N如果你的连接很慢/延迟高，$N$N请增加在局域网或服务器硬盘是瓶颈时保持为 1",
+		"ul_btn": "将文件/文件夹拖放到这里（或点击我）",
+		"ul_btnu": "上 传",
+		"ul_btns": "搜 索",
+
+		"ul_hash": "哈希",
+		"ul_send": "发送",
+		"ul_done": "完成",
+		"ul_idle1": "没有排队的上传任务",
+		"ut_etah": "平均 &lt;em&gt;hashing&lt;/em&gt; 速度和估计完成时间",
+		"ut_etau": "平均 &lt;em&gt;上传&lt;/em&gt; 速度和估计完成时间",
+		"ut_etat": "平均 &lt;em&gt;总&lt;/em&gt; 速度和估计完成时间",
+
+		"uct_ok": "成功完成",
+		"uct_ng": "失败/拒绝/未找到",
+		"uct_done": "成功和失败的组合",
+		"uct_bz": "正在哈希或上传",
+		"uct_q": "空闲，待处理",
+
+		"utl_name": "文件名",
+		"utl_ulist": "列表",
+		"utl_ucopy": "复制",
+		"utl_links": "链接",
+		"utl_stat": "状态",
+		"utl_prog": "进度",
+
+		"ul_flagblk": "文件已添加到队列</b><br>但另一个浏览器标签中有一个繁忙的 up2k，<br>因此等待它完成",
+		"ul_btnlk": "服务器配置已将此开关锁定到此状态",
+
+		"udt_up": "上传",
+		"udt_srch": "搜索",
+		"udt_drop": "将文件拖放到这里",
+
+		"u_nav_m": '<h6>好的，你有什么？</h6><code>Enter</code> = 文件（一个或多个）\n<code>ESC</code> = 一个文件夹（包括子文件夹）',
+		"u_nav_b": '<a href="#" id="modal-ok">文件</a><a href="#" id="modal-ng">一个文件夹</a>',
+
+		"cl_opts": "开关选项",
+		"cl_themes": "主题",
+		"cl_langs": "语言",
+		"cl_ziptype": "文件夹下载",
+		"cl_uopts": "up2k 开关",
+		"cl_favico": "网站图标",
+		"cl_bigdir": "最大目录数",
+		"cl_keytype": "键位符号",
+		"cl_hiddenc": "隐藏列",
+		"cl_hidec": "隐藏",
+		"cl_reset": "重置",
+		"cl_hpick": "点击列标题以在下表中隐藏",
+		"cl_hcancel": "列隐藏已取消",
+
+		"ct_grid": '网格视图',
+		"ct_thumb": '在网格视图中，切换图标或缩略图$N快捷键: T">🖼️ 缩略图',
+		"ct_csel": '在网格视图中使用 CTRL 和 SHIFT 进行文件选择">CTRL',
+		"ct_ihop": '当图像查看器关闭时，滚动到最后查看的文件">滚动',
+		"ct_dots": '显示隐藏文件（如果服务器允许）">隐藏文件',
+		"ct_dir1st": '在文件之前排序文件夹">📁 排序',
+		"ct_readme": '在文件夹列表中显示 README.md">📜 readme',
+		"ct_idxh": '显示 index.html 代替文件夹列表">htm',
+		"ct_sbars": '显示滚动条">⟊',
+
+		"cut_umod": "如果文件已存在于服务器上，将服务器的最后修改时间戳更新为与你的本地文件匹配（需要写入和删除权限）\">re📅",
+
+		"cut_turbo": "YOLO 按钮，你可能不想启用这个：$N$N如果你上传了大量文件并且由于某些原因需要重新启动，$N并且想要尽快继续上传，使用此选项$N$N这会用简单的 <em>&quot;服务器上的文件大小是否相同？&quot;</em> 替代哈希检查，$N因此如果文件内容不同，它将不会被上传$N$N上传完成后，你应该关闭此选项，$N然后重新&quot;上传&quot;相同的文件以让客户端验证它们\">加速",
+
+		"cut_datechk": "除非启用「加速」按钮，否则没有效果$N$N略微减少 YOLO 因素；检查服务器上的文件时间戳是否与你的一致$N$N<em>理论上</em> 应该能捕捉到大多数未完成/损坏的上传，$N但不能替代之后禁用「加速」进行的验证\">日期检查",
+
+		"cut_u2sz": "每个上传块的大小（以 MiB 为单位）；较大的值跨大西洋传输效果更好。在非常不可靠的连接上尝试较小的值",
+
+		"cut_flag": "确保一次只有一个标签页在上传$N -- 其他标签页也必须启用此选项$N -- 仅影响同一域名下的标签页",
+
+		"cut_az": "按字母顺序上传文件，而不是按最小文件优先$N$N按字母顺序可以更容易地查看服务器上是否出现了问题，但在光纤/局域网上传稍微慢一些",
+
+		"cut_nag": "上传完成时的操作系统通知$N（仅当浏览器或标签页不活跃时）",
+		"cut_sfx": "上传完成时的声音警报$N（仅当浏览器或标签页不活跃时）",
+
+		"cut_mt": "使用多线程加速文件哈希$N$N这使用 Web Worker 并且需要更多内存（额外最多 512 MiB）$N$N比https快30%，http快4.5倍，比Android 手机快5.3倍\">mt",
+
+		"cft_text": "网站图标文本（为空并刷新以禁用）",
+		"cft_fg": "前景色",
+		"cft_bg": "背景色",
+
+		"cdt_lim": "文件夹中显示的最大文件数",
+		"cdt_ask": "滚动到底部时，$N不会加载更多文件，$N而是询问你该怎么做",
+
+		"tt_entree": "显示导航面板（目录树侧边栏）$N快捷键: B",
+		"tt_detree": "显示面包屑导航$N快捷键: B",
+		"tt_visdir": "滚动到选定的文件夹",
+		"tt_ftree": "切换文件夹树 / 文本文件$N快捷键: V",
+		"tt_pdock": "在顶部的停靠窗格中显示父文件夹",
+		"tt_dynt": "随着树的展开自动增长",
+		"tt_wrap": "自动换行",
+		"tt_hover": "悬停时显示溢出的行$N（当鼠标光标在左侧边栏中时，滚动可能会中断）",
+
+		"ml_pmode": "在文件夹末尾时...",
+		"ml_btns": "命令",
+		"ml_tcode": "转码",
+		"ml_tint": "透明度",
+		"ml_eq": "音频均衡器",
+		"ml_drc": "动态范围压缩器",
+
+		"mt_shuf": "在每个文件夹中随机播放歌曲\">🔀",
+		"mt_aplay": "如果链接中有歌曲 ID，则自动播放,禁用此选项将停止在播放音乐时更新页面 URL 中的歌曲 ID，以防止在设置丢失但 URL 保留时自动播放\">自动播放▶",
+		"mt_preload": "在歌曲快结束时开始加载下一首歌，以实现无缝播放\">预加载",
+		"mt_prescan": "在最后一首歌结束之前切换到下一个文件夹$N保持网页浏览器活跃$N以免停止播放\">自动切换",
+		"mt_fullpre": "尝试预加载整首歌；$N✅ 在 <b>不可靠</b> 连接上启用，$N❌ 可能在慢速连接上禁用\">加载整首歌",
+		"mt_fau": "在手机上，如果下一首歌未能快速预加载，防止音乐停止（可能导致标签显示异常）\">☕️",
+		"mt_waves": "波形进度条：$N显示音频幅度\">进度条",
+		"mt_npclip": "显示当前播放歌曲的剪贴板按钮\">♪剪切板",
+		"mt_octl": "操作系统集成（媒体快捷键 / OSD）\">OSD",
+		"mt_oseek": "允许通过操作系统集成进行跳转$N$N注意：在某些设备（如 iPhone）上，$N这将替代下一首歌按钮\">seek",
+		"mt_oscv": "在 OSD 中显示专辑封面\">封面",
+		"mt_follow": "保持正在播放的曲目滚动到视图中\">🎯",
+		"mt_compact": "紧凑的控制按钮\">⟎",
+		"mt_uncache": "清除缓存&nbsp;$N（如果你的浏览器缓存了一个损坏的歌曲副本而拒绝播放，请尝试此操作）\">uncache",
+		"mt_mloop": "循环打开的文件夹\">🔁 循环",
+		"mt_mnext": "加载下一个文件夹并继续\">📂 下一首",
+		"mt_cflac": "将 flac / wav 转换为 opus\">flac",
+		"mt_caac": "将 aac / m4a 转换为 opus\">aac",
+		"mt_coth": "将所有其他（不是 mp3）转换为 opus\">oth",
+		"mt_tint": "在进度条上设置背景级别（0-100）",
+		"mt_eq": "启用均衡器和增益控制；$N$Nboost &lt;code&gt;0&lt;/code&gt; = 标准 100% 音量（默认）$N$Nwidth &lt;code&gt;1 &nbsp;&lt;/code&gt; = 标准立体声（默认）$Nwidth &lt;code&gt;0.5&lt;/code&gt; = 50% 左右交叉反馈$Nwidth &lt;code&gt;0 &nbsp;&lt;/code&gt; = 单声道$N$Nboost &lt;code&gt;-0.8&lt;/code&gt; &amp; width &lt;code&gt;10&lt;/code&gt; = 人声移除 )$N$N启用均衡器使无缝专辑完全无缝，所以如果你在乎这一点，请保持启用，所有值设为零（除了宽度 = 1）",
+		"mt_drc": "启用动态范围压缩器（音量平滑器 / 限幅器）；还会启用均衡器以平衡音频，因此如果你不想要它，请将均衡器字段除了 '宽度' 外的所有字段设置为 0$N$N降低 THRESHOLD dB 以上的音频的音量；每超过 THRESHOLD dB 的 RATIO 会有 1 dB 输出，所以默认值 tresh -24 和 ratio 12 意味着它的音量不应超过 -22 dB，可以安全地将均衡器增益提高到 0.8，甚至在 ATK 0 和 RLS 如 90 的情况下提高到 1.8（仅在 Firefox 中有效；其他浏览器中 RLS 最大为 1）$N$N（见维基百科，他们解释得更好）",
+
+		"mb_play": "播放",
+		"mm_hashplay": "播放这个音频文件？",
+		"mp_breq": "需要 Firefox 82+ 或 Chrome 73+ 或 iOS 15+",
+		"mm_bload": "正在加载...",
+		"mm_bconv": "正在转换为 {0}，请稍等...",
+		"mm_opusen": "你的浏览器无法播放 aac / m4a 文件；\n现在启用转码为 opus",
+		"mm_playerr": "播放失败：",
+		"mm_eabrt": "播放尝试已取消",
+		"mm_enet": "你的互联网连接有问题",
+		"mm_edec": "这个文件可能已损坏？？",
+		"mm_esupp": "你的浏览器不支持这个音频格式",
+		"mm_eunk": "未知错误",
+		"mm_e404": "无法播放音频；错误 404：文件未找到。",
+		"mm_e403": "无法播放音频；错误 403：访问被拒绝。\n\n尝试按 F5 重新加载，也许你已被注销",
+		"mm_e5xx": "无法播放音频；服务器错误",
+		"mm_nof": "附近找不到更多音频文件",
+		"mm_prescan": "正在寻找下一首音乐...",
+		"mm_scank": "找到下一首歌：",
+		"mm_uncache": "缓存已清除；所有歌曲将在下次播放时重新下载",
+		"mm_hnf": "那首歌不再存在",
+
+		"im_hnf": "那张图片不再存在",
+
+		"f_empty": '该文件夹为空',
+		"f_chide": '隐藏列 «{0}»\n\n你可以在设置选项卡中重新显示列',
+		"f_bigtxt": "这个文件大小为 {0} MiB -- 真的以文本形式查看？",
+		"fbd_more": '<div id="blazy">显示 <code>{0}</code> 个文件中的 <code>{1}</code> 个；<a href="#" id="bd_more">显示 {2}</a> 或 <a href="#" id="bd_all">显示全部</a></div>',
+		"fbd_all": '<div id="blazy">显示 <code>{0}</code> 个文件中的 <code>{1}</code> 个；<a href="#" id="bd_all">显示全部</a></div>',
+
+		"f_dls": '当前文件夹中的文件链接已\n更改为下载链接',
+
+		"f_partial": "要安全下载正在上传的文件，请点击没有 <code>.PARTIAL</code> 文件扩展名的同名文件。请按取消或 Escape 执行此操作。\n\n按 OK / Enter 将忽略此警告并继续下载 <code>.PARTIAL</code> 临时文件，这几乎肯定会导致数据损坏。",
+
+		"ft_paste": "粘贴 {0} 项$N快捷键: ctrl-V",
+		"fr_eperm": '无法重命名：\n你在此文件夹中没有 “移动” 权限',
+		"fd_eperm": '无法删除：\n你在此文件夹中没有 “删除” 权限',
+		"fc_eperm": '无法剪切：\n你在此文件夹中没有 “移动” 权限',
+		"fp_eperm": '无法粘贴：\n你在此文件夹中没有 “写入” 权限',
+		"fr_emore": "选择至少一个项目以重命名",
+		"fd_emore": "选择至少一个项目以删除",
+		"fc_emore": "选择至少一个项目以剪切",
+
+		"fs_sc": "分享你所在的文件夹",
+		"fs_ss": "分享选定的文件",
+		"fs_just1d": "你不能同时选择多个文件夹，也不能同时选择文件夹和文件",
+		"fs_abrt": "❌ 取消",
+		"fs_rand": "🎲 随机名称",
+		"fs_go": "✅ 创建分享",
+		"fs_name": "名称",
+		"fs_src": "源",
+		"fs_pwd": "密码",
+		"fs_exp": "过期",
+		"fs_tmin": "分",
+		"fs_thrs": "时",
+		"fs_tdays": "天",
+		"fs_never": "永久",
+		"fs_pname": "链接名称可选；如果为空则随机",
+		"fs_tsrc": "共享的文件或文件夹",
+		"fs_ppwd": "密码可选",
+		"fs_ok": "<h6>分享链接已创建</h6>\n按 <code>Enter/OK</code> 复制到剪贴板\n按 <code>ESC/Cancel</code> 关闭\n\n",
+
+		"frt_dec": "可能修复一些损坏的文件名\">url-decode",
+		"frt_rst": "将修改后的文件名重置为原始文件名\">↺ 重置",
+		"frt_abrt": "中止并关闭此窗口\">❌ 取消",
+		"frb_apply": "应用重命名",
+		"fr_adv": "批量 / 元数据 / 模式重命名\">高级",
+		"fr_case": "区分大小写的正则表达式\">case",
+		"fr_win": "Windows 安全名称；将 <code>&lt;&gt;:&quot;\\|?*</code> 替换为日文全角字符\">win",
+		"fr_slash": "将 <code>/</code> 替换为不会导致新文件夹创建的字符\">不使用 /",
+		"fr_pdel": "删除",
+		"fr_pnew": "另存为",
+		"fr_pname": "为你的新预设提供一个名称",
+		"fr_aborted": "已中止",
+		"fr_lold": "旧名称",
+		"fr_lnew": "新名称",
+		"fr_tags": "选定文件的标签（只读，仅供参考）：",
+		"fr_busy": "正在重命名 {0} 项...\n\n{1}",
+		"fr_efail": "重命名失败：\n",
+		"fr_nchg": "{0} 个新名称由于 <code>win</code> 和/或 <code>ikke /</code> 被更改\n\n确定继续使用这些更改的新名称？",
+
+		"fd_ok": "删除成功",
+		"fd_err": "删除失败：\n",
+		"fd_none": "没有文件被删除；可能被服务器配置（xbd）阻止？",
+		"fd_busy": "正在删除 {0} 项...\n\n{1}",
+		"fd_warn1": "删除这 {0} 项？",
+		"fd_warn2": "<b>最后机会！</b> 无法撤销。删除？",
+
+		"fc_ok": "剪切 {0} 项",
+		"fc_warn": '剪切 {0} 项\n\n但：只有 <b>这个</b> 浏览器标签页可以粘贴它们\n（因为选择非常庞大）',
+
+		"fp_ecut": "首先剪切一些文件/文件夹以粘贴/移动\n\n注意：你可以在不同的浏览器标签页之间剪切/粘贴",
+		"fp_ename": "这些 {0} 项不能移动到这里（名称已存在）：",
+		"fp_ok": "移动成功",
+		"fp_busy": "正在移动 {0} 项...\n\n{1}",
+		"fp_err": "移动失败：\n",
+		"fp_confirm": "将这些 {0} 项移动到这里？",
+		"fp_etab": '无法从其他浏览器标签页读取剪贴板',
+		"fp_name": "从你的设备上传一个文件。给它一个名字：",
+		"fp_both_m": '<h6>选择粘贴内容</h6><code>Enter</code> = 从 «{1}» 移动 {0} 个文件\n<code>ESC</code> = 从你的设备上传 {2} 个文件',
+		"fp_both_b": '<a href="#" id="modal-ok">移动</a><a href="#" id="modal-ng">上传</a>',
+
+		"mk_noname": "在左侧文本框中输入名称，然后再执行此操作 :p",
+
+		"tv_load": "加载文本文件：\n\n{0}\n\n{1}% ({2} 的 {3} MiB 已加载)",
+		"tv_xe1": "无法加载文本文件：\n\n错误 ",
+		"tv_xe2": "404，文件未找到",
+		"tv_lst": "文本文件列表",
+		"tvt_close": "返回到文件夹视图$N快捷键: M（或 Esc）\">❌ 关闭",
+		"tvt_dl": "下载此文件$N快捷键: Y\">💾 下载",
+		"tvt_prev": "显示上一个文档$N快捷键: i\">⬆ 上一个",
+		"tvt_next": "显示下一个文档$N快捷键: K\">⬇ 下一个",
+		"tvt_sel": "选择文件&nbsp;（用于剪切/删除/...）$N快捷键: S\">选择",
+		"tvt_edit": "在文本编辑器中打开文件$N快捷键: E\">✏️ 编辑",
+
+		"gt_vau": "不显示视频，仅播放音频\">🎧",
+		"gt_msel": "启用文件选择；按住 ctrl 键点击文件以覆盖$N$N&lt;em&gt;当启用时：双击文件/文件夹以打开它&lt;/em&gt;$N$N快捷键：S\">多选",
+		"gt_crop": "中心裁剪缩略图\">裁剪",
+		"gt_3x": "高分辨率缩略图\">3x",
+		"gt_zoom": "缩放",
+		"gt_chop": "剪裁",
+		"gt_sort": "排序依据",
+		"gt_name": "名称",
+		"gt_sz": "大小",
+		"gt_ts": "日期",
+		"gt_ext": "类型",
+		"gt_c1": "截断文件名更多（显示更少）",
+		"gt_c2": "截断文件名更少（显示更多）",
+
+		"sm_prev": "以下是来自先前查询的搜索结果：\n  ",
+		"sl_close": "关闭搜索结果",
+		"sl_hits": "显示 {0} 个结果",
+		"sl_moar": "加载更多",
+
+		"s_sz": "大小",
+		"s_dt": "日期",
+		"s_rd": "路径",
+		"s_fn": "名称",
+		"s_ta": "标签",
+		"s_ua": "上传于",
+		"s_ad": "高级",
+		"s_s1": "最小 MiB",
+		"s_s2": "最大 MiB",
+		"s_d1": "最早 iso8601",
+		"s_d2": "最晚 iso8601",
+		"s_u1": "上传后",
+		"s_u2": "和/或之前",
+		"s_r1": "路径包含 &nbsp;（空格分隔）",
+		"s_f1": "名称包含 &nbsp;（用 -nope 否定）",
+		"s_t1": "标签包含 &nbsp;（^=开头，$=结尾）",
+		"s_a1": "特定元数据属性",
+
+		"md_eshow": "无法渲染 ",
+		"md_off": "[📜<em>readme</em>] 在 [⚙️] 中禁用 -- 文档隐藏",
+
+		"badreply": "解析服务器回复失败",
+
+		"xhr403": "403: 访问被拒绝\n\n尝试按 F5 可能会重新登录",
+		"xhr0": "未知（可能丢失连接到服务器，或服务器离线）",
+		"cf_ok": "抱歉 -- DD" + wah + "oS 保护启动\n\n事情应该在大约 30 秒后恢复\n\n如果没有任何变化，按 F5 重新加载页面",
+		"tl_xe1": "无法列出子文件夹：\n\n错误 ",
+		"tl_xe2": "404: 文件夹未找到",
+		"fl_xe1": "无法列出文件夹中的文件：\n\n错误 ",
+		"fl_xe2": "404: 文件夹未找到",
+		"fd_xe1": "无法创建子文件夹：\n\n错误 ",
+		"fd_xe2": "404: 父文件夹未找到",
+		"fsm_xe1": "无法发送消息：\n\n错误 ",
+		"fsm_xe2": "404: 父文件夹未找到",
+		"fu_xe1": "无法从服务器加载未发布列表：\n\n错误 ",
+		"fu_xe2": "404: 文件未找到??",
+
+		"fz_tar": "未压缩的 gnu-tar 文件（linux / mac）",
+		"fz_pax": "未压缩的 pax 格式 tar（较慢）",
+		"fz_targz": "gnu-tar 带 gzip 级别 3 压缩$N$N通常非常慢，所以$N建议使用未压缩的 tar",
+		"fz_tarxz": "gnu-tar 带 xz 级别 1 压缩$N$N通常非常慢，所以$N建议使用未压缩的 tar",
+		"fz_zip8": "zip 带 utf8 文件名（在 windows 7 及更早版本上可能会出现问题）",
+		"fz_zipd": "zip 带传统 cp437 文件名，适用于非常旧的软件",
+		"fz_zipc": "cp437 带 crc32 提前计算，$N适用于 MS-DOS PKZIP v2.04g（1993 年 10 月）$N（处理时间较长，在下载开始之前）",
+
+		"un_m1": "你可以删除下面的近期上传（或中止未完成的上传）",
+		"un_upd": "刷新",
+		"un_m4": "或分享下面可见的文件：",
+		"un_ulist": "显示",
+		"un_ucopy": "复制",
+		"un_flt": "可选过滤器：&nbsp; URL 必须包含",
+		"un_fclr": "清除过滤器",
+		"un_derr": '未发布删除失败：\n',
+		"un_f5": '出现问题，请尝试刷新或按 F5',
+		"un_uf5": "抱歉，你必须刷新页面（例如，按 F5 或 CTRL-R），然后才能中止此上传",
+		"un_nou": '<b>警告：</b> 服务器太忙，无法显示未完成的上传；稍后点击“刷新”链接',
+		"un_noc": '<b>警告：</b> 服务器配置中未启用/允许完全上传文件的取消发布',
+		"un_max": "显示前 2000 个文件（使用过滤器）",
+		"un_avail": "{0} 个近期上传可以被删除<br />{1} 个未完成的上传可以被中止",
+		"un_m2": "按上传时间排序；最新的在前：",
+		"un_no1": "哎呀！没有足够新的上传",
+		"un_no2": "哎呀！没有符合该过滤器的足够新的上传",
+		"un_next": "删除下面的下一个 {0} 个文件",
+		"un_abrt": "中止",
+		"un_del": "删除",
+		"un_m3": "正在加载你的近期上传...",
+		"un_busy": "正在删除 {0} 个文件...",
+
+		"u_https1": "你应该",
+		"u_https2": "切换到 https",
+		"u_https3": "以获得更好的性能",
+		"u_ancient": '你的浏览器非常古老 -- 也许你应该 <a href="#" onclick="goto(\'bup\')">改用 bup</a>',
+		"u_nowork": "需要 Firefox 53+ 或 Chrome 57+ 或 iOS 11+",
+		"u_uri": "要从其他浏览器窗口拖放图片，\n请将其拖放到大的上传按钮上",
+		"u_enpot": '切换到 <a href="#">简约 UI</a>（可能提高上传速度）',
+		"u_depot": '切换到 <a href="#">精美 UI</a>（可能降低上传速度）',
+		"u_gotpot": '切换到土豆 UI 以提高上传速度，\n\n随时可以不同意并切换回去！',
+		"u_ever": "这是基本的上传工具； up2k 需要至少<br>chrome 21 // firefox 13 // edge 12 // opera 12 // safari 5.1",
+		"u_su2k": '这是基本的上传工具；<a href="#" id="u2yea">up2k</a> 更好',
+		"u_ewrite": '你对这个文件夹没有写入权限',
+		"u_eread": '你对这个文件夹没有读取权限',
+		"u_enoi": '文件搜索在服务器配置中未启用',
+		"u_badf": '这些 {0} 个文件（共 {1} 个）被跳过，可能是由于文件系统权限：\n\n',
+		"u_blankf": '这些 {0} 个文件（共 {1} 个）是空白的；是否仍然上传？\n\n',
+		"u_just1": '\n也许如果你只选择一个文件会更好',
+		"u_ff_many": "如果你使用的是 <b>Linux / MacOS / Android，</b> 那么这个文件数量 <a href=\"https://bugzilla.mozilla.org/show_bug.cgi?id=1790500\" target=\"_blank\"><em>可能</em> 崩溃 Firefox!</a>\n如果发生这种情况，请再试一次（或使用 Chrome）。",
+		"u_up_life": "此上传将在 {0} 后从服务器删除",
+		"u_asku": '将这些 {0} 个文件上传到 <code>{1}</code>',
+		"u_unpt": "你可以使用左上角的 🧯 撤销/删除此上传",
+		"u_etadone": '完成 ({0}, {1} 个文件)',
+		"u_etaprep": '(准备上传)',
+		"u_hashdone": '哈希完成',
+		"u_hashing": '哈希',
+		"u_fixed": "好！&nbsp;已修复 👍",
+		"u_cuerr": "上传块 {0} 的 {1} 失败；\n可能无害，继续中\n\n文件：{2}",
+		"u_cuerr2": "服务器拒绝上传（块 {0} 的 {1}）；\n稍后重试\n\n文件：{2}\n\n错误 ",
+		"u_ehstmp": "将重试；见右下角",
+		"u_ehsfin": "服务器拒绝了最终上传请求；正在重试...",
+		"u_ehssrch": "服务器拒绝了搜索请求；正在重试...",
+		"u_ehsinit": "服务器拒绝了启动上传请求；正在重试...",
+		"u_eneths": "进行上传握手时的网络错误；正在重试...",
+		"u_enethd": "测试目标存在时的网络错误；正在重试...",
+		"u_cbusy": "等待服务器在网络故障后再次信任我们...",
+		"u_ehsdf": "服务器磁盘空间不足！\n\n将继续重试，以防有人\n释放足够的空间以继续",
+		"u_emtleak1": "看起来你的网页浏览器可能有内存泄漏；\n请",
+		"u_emtleak2": ' <a href="{0}">切换到 https（推荐）</a> 或 ',
+		"u_emtleak3": ' ',
+		"u_emtleakc": '尝试以下操作：\n<ul><li>按 <code>F5</code> 刷新页面</li><li>然后在&nbsp;<code>⚙️ 设置</code> 中禁用&nbsp;<code>mt</code>&nbsp;按钮</li><li>然后再次尝试上传</li></ul>上传会稍微慢一些，不过没关系。\n抱歉带来麻烦！\n\nPS：chrome v107 <a href="https://bugs.chromium.org/p/chromium/issues/detail?id=1354816" target="_blank">已修复</a>此问题',
+		"u_emtleakf": '尝试以下操作：\n<ul><li>按 <code>F5</code> 刷新页面</li><li>然后在上传 UI 中启用 <code>🥔</code>（土豆）<li>然后再次尝试上传</li></ul>\nPS: firefox <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1790500" target="_blank">希望会在某个时点修复此问题</a>',
+		"u_s404": "在服务器上未找到",
+		"u_expl": "解释",
+		"u_maxconn": "大多数浏览器限制为 6，但 Firefox 允许你通过 <code>connections-per-server</code> 在 <code>about:config</code> 中提高限制",
+		"u_tu": '<p class="warn">警告：启用了 turbo，<span>&nbsp;客户端可能无法检测和恢复不完整的上传；查看 turbo 按钮工具提示</span></p>',
+		"u_ts": '<p class="warn">警告：启用了 turbo，<span>&nbsp;搜索结果可能不正确；查看 turbo 按钮工具提示</span></p>',
+		"u_turbo_c": "服务器配置中禁用了 turbo",
+		"u_turbo_g": "禁用 turbo，因为你在此卷中没有\n目录列表权限",
+		"u_life_cfg": '自动删除时间为 <input id="lifem" p="60" /> 分钟（或 <input id="lifeh" p="3600" /> 小时）',
+		"u_life_est": '上传将在 <span id="lifew" tt="本地时间">---</span> 删除',
+		"u_life_max": '此文件夹强制执行\n最大寿命为 {0}',
+		"u_unp_ok": '允许取消发布 {0}',
+		"u_unp_ng": '取消发布将不被允许',
+		"ue_ro": '你对这个文件夹的访问是只读的\n\n',
+		"ue_nl": '你当前未登录',
+		"ue_la": '你当前以 "{0}" 登录',
+		"ue_sr": '你当前处于文件搜索模式\n\n通过点击大搜索按钮旁边的放大镜 🔎 切换到上传模式，然后重试上传\n\n抱歉',
+		"ue_ta": '尝试再次上传，现在应该能正常工作',
+		"ur_1uo": "成功：文件上传成功",
+		"ur_auo": "成功：所有 {0} 个文件上传成功",
+		"ur_1so": "成功：文件在服务器上找到",
+		"ur_aso": "成功：所有 {0} 个文件在服务器上找到",
+		"ur_1un": "上传失败，抱歉",
+		"ur_aun": "所有 {0} 个上传失败，抱歉",
+		"ur_1sn": "文件未在服务器上找到",
+		"ur_asn": "这些 {0} 个文件未在服务器上找到",
+		"ur_um": "完成；\n{0} 个上传成功，\n{1} 个上传失败，抱歉",
+		"ur_sm": "完成；\n{0} 个文件在服务器上找到，\n{1} 个文件未在服务器上找到",
+
+		"lang_set": "刷新以使更改生效？",
+	},
 };
 
-var LANGS = ["eng", "nor"];
+var LANGS = ["eng", "nor", "chi"];
 
 if (window.langmod)
 	langmod();
 
-var L = Ls[sread("cpp_lang", LANGS) || lang] || Ls.eng || Ls.nor;
+var L = Ls[sread("cpp_lang", LANGS) || lang] || Ls.eng || Ls.nor || Ls.chi;
 
 for (var a = 0; a < LANGS.length; a++) {
 	for (var b = a + 1; b < LANGS.length; b++) {
@@ -1069,16 +1643,16 @@ modal.load();
 
 // toolbar
 ebi('ops').innerHTML = (
-	'<a href="#" data-dest="" tt="' + L.ot_close + '">--</a>' +
-	'<a href="#" data-perm="read" data-dep="idx" data-dest="search" tt="' + L.ot_search + '">🔎</a>' +
-	(have_del ? '<a href="#" data-dest="unpost" tt="' + L.ot_unpost + '">🧯</a>' : '') +
-	'<a href="#" data-dest="up2k">🚀</a>' +
-	'<a href="#" data-perm="write" data-dest="bup" tt="' + L.ot_bup + '">🎈</a>' +
-	'<a href="#" data-perm="write" data-dest="mkdir" tt="' + L.ot_mkdir + '">📂</a>' +
-	'<a href="#" data-perm="read write" data-dest="new_md" tt="' + L.ot_md + '">📝</a>' +
-	'<a href="#" data-dest="msg" tt="' + L.ot_msg + '">📟</a>' +
-	'<a href="#" data-dest="player" tt="' + L.ot_mp + '">🎺</a>' +
-	'<a href="#" data-dest="cfg" tt="' + L.ot_cfg + '">⚙️</a>' +
+	'<a href="#" id="opa_x" data-dest="" tt="' + L.ot_close + '">--</a>' +
+	'<a href="#" id="opa_srch" data-perm="read" data-dep="idx" data-dest="search" tt="' + L.ot_search + '">🔎</a>' +
+	(have_del ? '<a href="#" id="opa_del" data-dest="unpost" tt="' + L.ot_unpost + '">🧯</a>' : '') +
+	'<a href="#" id="opa_up" data-dest="up2k">🚀</a>' +
+	'<a href="#" id="opa_bup" data-perm="write" data-dest="bup" tt="' + L.ot_bup + '">🎈</a>' +
+	'<a href="#" id="opa_mkd" data-perm="write" data-dest="mkdir" tt="' + L.ot_mkdir + '">📂</a>' +
+	'<a href="#" id="opa_md" data-perm="read write" data-dest="new_md" tt="' + L.ot_md + '">📝</a>' +
+	'<a href="#" id="opa_msg" data-dest="msg" tt="' + L.ot_msg + '">📟</a>' +
+	'<a href="#" id="opa_auc" data-dest="player" tt="' + L.ot_mp + '">🎺</a>' +
+	'<a href="#" id="opa_cfg" data-dest="cfg" tt="' + L.ot_cfg + '">⚙️</a>' +
 	(IE ? '<span id="noie">' + L.ot_noie + '</span>' : '') +
 	'<div id="opdesc"></div>'
 );
@@ -1089,6 +1663,7 @@ ebi('widget').innerHTML = (
 	'<div id="wtoggle">' +
 	'<span id="wfs"></span>' +
 	'<span id="wfm"><a' +
+	' href="#" id="fshr" tt="' + L.wt_shr + '">📨<span>share</span></a><a' +
 	' href="#" id="fren" tt="' + L.wt_ren + '">✎<span>name</span></a><a' +
 	' href="#" id="fdel" tt="' + L.wt_del + '">⌫<span>del.</span></a><a' +
 	' href="#" id="fcut" tt="' + L.wt_cut + '">✂<span>cut</span></a><a' +
@@ -2543,6 +3118,7 @@ function mpause(e) {
 			if (!dist || !mp.au)
 				return true;
 
+			dist *= -1;
 			mp.setvol(mp.vol + dist / 500);
 			vbar.draw();
 			ev(e);
@@ -3690,6 +4266,7 @@ var fileman = (function () {
 		bdel = ebi('fdel'),
 		bcut = ebi('fcut'),
 		bpst = ebi('fpst'),
+		bshr = ebi('fshr'),
 		t_paste,
 		r = {};
 
@@ -3704,17 +4281,32 @@ var fileman = (function () {
 			r.clip = jread('fman_clip', []).slice(1);
 
 		var sel = msel.getsel(),
-			nsel = sel.length;
+			nsel = sel.length,
+			enren = nsel,
+			endel = nsel,
+			encut = nsel,
+			enpst = r.clip && r.clip.length,
+			hren = !(have_mv && has(perms, 'write') && has(perms, 'move')),
+			hdel = !(have_del && has(perms, 'delete')),
+			hcut = !(have_mv && has(perms, 'move')),
+			hpst = !(have_mv && has(perms, 'write')),
+			hshr = !(have_shr && acct != '*' && (has(perms, 'read') || has(perms, 'write')));
 
-		clmod(bren, 'en', nsel);
-		clmod(bdel, 'en', nsel);
-		clmod(bcut, 'en', nsel);
-		clmod(bpst, 'en', r.clip && r.clip.length);
+		if (!(enren || endel || encut || enpst))
+			hren = hdel = hcut = hpst = true;
+
+		clmod(bren, 'en', enren);
+		clmod(bdel, 'en', endel);
+		clmod(bcut, 'en', encut);
+		clmod(bpst, 'en', enpst);
+		clmod(bshr, 'en', 1);
+
+		clmod(bren, 'hide', hren);
+		clmod(bdel, 'hide', hdel);
+		clmod(bcut, 'hide', hcut);
+		clmod(bpst, 'hide', hpst);
+		clmod(bshr, 'hide', hshr);
 
-		clmod(bren, 'hide', !(have_mv && has(perms, 'write') && has(perms, 'move')));
-		clmod(bdel, 'hide', !(have_del && has(perms, 'delete')));
-		clmod(bcut, 'hide', !(have_mv && has(perms, 'move')));
-		clmod(bpst, 'hide', !(have_mv && has(perms, 'write')));
 		clmod(ebi('wfm'), 'act', QS('#wfm a.en:not(.hide)'));
 
 		var wfs = ebi('wfs'), h = '';
@@ -3725,6 +4317,7 @@ var fileman = (function () {
 		clmod(wfs, 'act', h);
 
 		bpst.setAttribute('tt', L.ft_paste.format(r.clip.length));
+		bshr.setAttribute('tt', nsel ? L.fs_ss : L.fs_sc);
 	};
 
 	r.fsi = function (sel) {
@@ -3762,6 +4355,181 @@ var fileman = (function () {
 		return ret;
 	};
 
+	r.share = function (e) {
+		ev(e);
+
+		var vp = uricom_dec(get_evpath()),
+			sel = msel.getsel(),
+			fns = [];
+
+		for (var a = 0; a < sel.length; a++)
+			fns.push(uricom_dec(noq_href(ebi(sel[a].id))));
+
+		if (fns.length == 1 && fns[0].endsWith('/'))
+			vp = fns.pop();
+
+		for (var a = 0; a < fns.length; a++)
+			if (fns[a].endsWith('/'))
+				return toast.err(10, L.fs_just1d);
+
+		var shui = ebi('shui');
+		if (!shui) {
+			shui = mknod('div', 'shui');
+			document.body.appendChild(shui);
+		}
+		shui.style.display = 'block';
+
+		var html = [
+			'<div>',
+			'<table>',
+			'<tr><td colspan="2">',
+			'<button id="sh_abrt">' + L.fs_abrt + '</button>',
+			'<button id="sh_rand">' + L.fs_rand + '</button>',
+			'<button id="sh_apply">' + L.fs_go + '</button>',
+			'</td></tr>',
+			'<tr><td>' + L.fs_name + '</td><td><input type="text" id="sh_k" ' + NOAC + ' placeholder="  ' + L.fs_pname + '" /></td></tr>',
+			'<tr><td>' + L.fs_src + '</td><td><input type="text" id="sh_vp" ' + NOAC + ' readonly tt="' + L.fs_tsrc + '" /></td></tr>',
+			'<tr><td>' + L.fs_pwd + '</td><td><input type="text" id="sh_pw" ' + NOAC + ' placeholder="  ' + L.fs_ppwd + '" /></td></tr>',
+			'<tr><td>' + L.fs_exp + '</td><td class="exs">',
+			'<input type="text" id="sh_exm" ' + NOAC + ' /> ' + L.fs_tmin + ' / ',
+			'<input type="text" id="sh_exh" ' + NOAC + ' /> ' + L.fs_thrs + ' / ',
+			'<input type="text" id="sh_exd" ' + NOAC + ' /> ' + L.fs_tdays + ' / ',
+			'<button id="sh_noex">' + L.fs_never + '</button>',
+			'</td></tr>',
+			'<tr><td>perms</td><td class="sh_axs">',
+		];
+		for (var a = 0; a < perms.length; a++)
+			if (perms[a] != 'admin')
+				html.push('<a href="#" class="tgl btn">' + perms[a] + '</a>');
+
+		html.push('</td></tr></div');
+		shui.innerHTML = html.join('\n');
+
+		var sh_rand = ebi('sh_rand'),
+			sh_abrt = ebi('sh_abrt'),
+			sh_apply = ebi('sh_apply'),
+			sh_noex = ebi('sh_noex'),
+			exm = ebi('sh_exm'),
+			exh = ebi('sh_exh'),
+			exd = ebi('sh_exd'),
+			sh_k = ebi('sh_k'),
+			sh_vp = ebi('sh_vp'),
+			sh_pw = ebi('sh_pw');
+
+		function setexp(a, b) {
+			a = parseFloat(a);
+			if (!isNum(a))
+				return;
+
+			var v = a * b;
+			swrite('fsh_exp', v);
+
+			if (exm.value != v) exm.value = Math.round(v * 10) / 10; v /= 60;
+			if (exh.value != v) exh.value = Math.round(v * 10) / 10; v /= 24;
+			if (exd.value != v) exd.value = Math.round(v * 10) / 10;
+		}
+		function setdef() {
+			setexp(icfg_get('fsh_exp', 60 * 24), 1);
+		}
+		setdef();
+
+		exm.oninput = function () { setexp(this.value, 1); };
+		exh.oninput = function () { setexp(this.value, 60); };
+		exd.oninput = function () { setexp(this.value, 60 * 24); };
+		exm.onfocus = exh.onfocus = exd.onfocus = function () {
+			this.value = '';
+		};
+		sh_noex.onclick = function () {
+			setexp(0, 1);
+		};
+		exm.onblur = exh.onblur = exd.onblur = setdef;
+
+		exm.onkeydown = exh.onkeydown = exd.onkeydown =
+		sh_k.onkeydown = sh_pw.onkeydown = function (e) {
+			var kc = (e.code || e.key) + '';
+			if (kc.endsWith('Enter'))
+				sh_apply.click();
+		};
+
+		sh_abrt.onclick = function () {
+			shui.parentNode.removeChild(shui);
+		};
+		sh_rand.onclick = function () {
+			sh_k.value = randstr(12).replace(/l/g, 'n');
+		};
+		tt.att(shui);
+
+		var pbtns = QSA('#shui .sh_axs a');
+		for (var a = 0; a < pbtns.length; a++)
+			pbtns[a].onclick = shspf;
+
+		function shspf() {
+			clmod(this, 'on', 't');
+		}
+		clmod(pbtns[0], 'on', 1);
+
+		var vpt = vp;
+		if (fns.length) {
+			vpt = fns.length + ' files in ' + vp + '  '
+			for (var a = 0; a < fns.length; a++)
+				vpt += '「' + fns[a].split('/').pop() + '」';
+		}
+		sh_vp.value = vpt;
+
+		sh_k.oninput = function (e) {
+			var v = this.value,
+				v2 = v.replace(/[^0-9a-zA-Z-]/g, '_');
+
+			if (v != v2)
+				this.value = v2;
+		};
+
+		function shr_cb() {
+			toast.hide();
+			var surl = this.responseText;
+			if (this.status !== 201 || !/^created share:/.exec(surl)) {
+				shui.style.display = 'block';
+				var msg = unpre(surl);
+				toast.err(9, msg);
+				return;
+			}
+			surl = surl.slice(15);
+			modal.confirm(L.fs_ok + esc(surl), function() {
+				cliptxt(surl, function () {
+					toast.ok(2, 'copied to clipboard');
+				});
+			});
+		}
+
+		sh_apply.onclick = function () {
+			if (!sh_k.value)
+				sh_rand.click();
+
+			var plist = [];
+			for (var a = 0; a < pbtns.length; a++)
+				if (clgot(pbtns[a], 'on'))
+					plist.push(pbtns[a].textContent);
+
+			shui.style.display = 'none';
+			toast.inf(30, "creating share...");
+
+			var body = {
+				"k": sh_k.value,
+				"vp": fns.length ? fns : [sh_vp.value],
+				"pw": sh_pw.value,
+				"exp": exm.value,
+				"perms": plist,
+			};
+			var xhr = new XHR();
+			xhr.open('POST', SR + '/?share', true);
+			xhr.setRequestHeader('Content-Type', 'text/plain');
+			xhr.onload = xhr.onerror = shr_cb;
+			xhr.send(JSON.stringify(body));
+		};
+
+		setTimeout(sh_pw.focus.bind(sh_pw), 1);
+	};
+
 	r.rename = function (e) {
 		ev(e);
 		if (clgot(bren, 'hide'))
@@ -4338,6 +5106,7 @@ var fileman = (function () {
 	bdel.onclick = r.delete;
 	bcut.onclick = r.cut;
 	bpst.onclick = r.paste;
+	bshr.onclick = r.share;
 
 	return r;
 })();
@@ -5348,6 +6117,9 @@ var ahotkeys = function (e) {
 		if (ebi('rn_cancel'))
 			return ebi('rn_cancel').click();
 
+		if (ebi('sh_abrt'))
+			return ebi('sh_abrt').click();
+
 		if (QS('.opview.act'))
 			return QS('#ops>a').click();
 
@@ -7402,10 +8174,11 @@ var settheme = (function () {
 
 	function setlang(e) {
 		ev(e);
+		var t = L.lang_set;
 		L = Ls[this.textContent];
 		swrite("cpp_lang", this.textContent);
 		freshen();
-		modal.confirm(Ls.eng.lang_set + "\n\n" + Ls.nor.lang_set, location.reload.bind(location), null);
+		modal.confirm(L.lang_set + "\n\n" + t, location.reload.bind(location), null);
 	};
 
 	freshen();
@@ -8030,7 +8803,7 @@ function sandbox(tgt, rules, cls, html) {
 	}
 
 	html = '<html class="iframe ' + document.documentElement.className +
-		'"><head><style>html{background:#eee;color:#000}\n' + globalcss() +
+		'"><head><style>html{background:#eee;color:#000}</style><style>' + globalcss() +
 		'</style><base target="_parent"></head><body id="b" class="logue ' + cls + '">' + html +
 		'<script>' + env + '</script>' + sandboxjs() +
 		'<script>var d=document.documentElement,TS="' + TS + '",' +

copyparty/web/browser2.html

@@ -51,11 +51,11 @@
 
 		</tbody>
 	</table>
-	
+
 	{%- if logues[1] %}
 	<div>{{ logues[1] }}</div><br />
 	{%- endif %}
-	
+
 	<h2><a href="{{ r }}/{{ url_suf }}{{ url_suf and '&amp;' or '?' }}h">control-panel</a></h2>
 
 </body>

copyparty/web/md.html

@@ -49,7 +49,7 @@
 		<div id="mp" class="mdo"></div>
 	</div>
 	<a href="#" id="repl">π</a>
-	
+
 	{%- if edit %}
 	<div id="helpbox">
 		<textarea autocomplete="off">
@@ -125,7 +125,7 @@ write markdown (most html is 🙆 too)
 		</textarea>
 	</div>
 	{%- endif %}
-	
+
 	<script>
 
 var SR = {{ r|tojson }},

copyparty/web/shares.css

@@ -0,0 +1,82 @@
+html {
+	color: #333;
+	background: #f7f7f7;
+	font-family: sans-serif;
+	font-family: var(--font-main), sans-serif;
+	touch-action: manipulation;
+}
+#wrap {
+	margin: 2em auto;
+	padding: 0 1em 3em 1em;
+	line-height: 2.3em;
+}
+#wrap>span {
+    margin: 0 0 0 1em;
+    border-bottom: 1px solid #999;
+}
+li {
+	margin: 1em 0;
+}
+a {
+	color: #047;
+	background: #fff;
+	text-decoration: none;
+	white-space: nowrap;
+	border-bottom: 1px solid #8ab;
+	border-radius: .2em;
+	padding: .2em .6em;
+	margin: 0 .3em;
+}
+td a {
+	margin: 0;
+}
+#w {
+	color: #fff;
+	background: #940;
+	border-color: #b70;
+}
+#repl {
+	border: none;
+	background: none;
+	color: inherit;
+	padding: 0;
+	position: fixed;
+	bottom: .25em;
+	left: .2em;
+}
+table {
+	border-collapse: collapse;
+    position: relative;
+}
+th {
+	top: -1px;
+	position: sticky;
+    background: #f7f7f7;
+}
+td, th {
+	padding: .3em .6em;
+	text-align: left;
+	white-space: nowrap;
+}
+td+td+td+td+td+td+td+td {
+	font-family: var(--font-mono), monospace, monospace;
+}
+
+
+
+html.z {
+	background: #222;
+	color: #ccc;
+}
+html.z a {
+	color: #fff;
+	background: #057;
+	border-color: #37a;
+}
+html.z th {
+    background: #222;
+}
+html.bz {
+	color: #bbd;
+	background: #11121d;
+}

copyparty/web/shares.html

@@ -0,0 +1,74 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+	<meta charset="utf-8">
+	<title>{{ s_doctitle }}</title>
+	<meta http-equiv="X-UA-Compatible" content="IE=edge">
+	<meta name="viewport" content="width=device-width, initial-scale=0.8">
+	<meta name="theme-color" content="#{{ tcolor }}">
+	<link rel="stylesheet" media="screen" href="{{ r }}/.cpr/shares.css?_={{ ts }}">
+	<link rel="stylesheet" media="screen" href="{{ r }}/.cpr/ui.css?_={{ ts }}">
+{{ html_head }}
+</head>
+
+<body>
+	<div id="wrap">
+		<a id="a" href="{{ r }}/?shares" class="af">refresh</a>
+		<a id="a" href="{{ r }}/?h" class="af">control-panel</a>
+
+        <span>axs = perms (read,write,move,delet)</span>
+        <span>nf = numFiles (0=dir)</span>
+        <span>min/hrs = time left</span>
+
+        <table id="tab"><thead><tr>
+            <th>delete</th>
+            <th>sharekey</th>
+            <th>pw</th>
+            <th>source</th>
+            <th>axs</th>
+            <th>nf</th>
+            <th>user</th>
+            <th>created</th>
+            <th>expires</th>
+            <th>min</th>
+            <th>hrs</th>
+        </tr></thead><tbody>
+        {% for k, pw, vp, pr, st, un, t0, t1 in rows %}
+        <tr>
+            <td><a href="#" k="{{ k }}">delete</a></td>
+            <td><a href="{{ r }}{{ shr }}{{ k }}">{{ k }}</a></td>
+            <td>{{ pw }}</td>
+            <td><a href="{{ r }}/{{ vp|e }}">{{ vp|e }}</a></td>
+            <td>{{ pr }}</td>
+            <td>{{ st }}</td>
+            <td>{{ un|e }}</td>
+            <td>{{ t0 }}</td>
+            <td>{{ t1 }}</td>
+            <td>{{ ((t1 - now) / 60)   | round(1) if t1 else "inf" }}</td>
+            <td>{{ ((t1 - now) / 3600) | round(1) if t1 else "inf" }}</td>
+        </tr>
+        {% endfor %}
+        </tbody></table>
+        {% if not rows %}
+        (you don't have any active shares btw)
+        {% endif %}
+	<script>
+
+var SR = {{ r|tojson }},
+    shr="{{ shr }}",
+	lang="{{ lang }}",
+	dfavico="{{ favico }}";
+
+var STG = window.localStorage;
+document.documentElement.className = (STG && STG.cpp_thm) || "{{ this.args.theme }}";
+
+</script>
+<script src="{{ r }}/.cpr/util.js?_={{ ts }}"></script>
+<script src="{{ r }}/.cpr/shares.js?_={{ ts }}"></script>
+{%- if js %}
+<script src="{{ js }}_={{ ts }}"></script>
+{%- endif %}
+</body>
+</html>
+

copyparty/web/shares.js

@@ -0,0 +1,37 @@
+var t = QSA('a[k]');
+for (var a = 0; a < t.length; a++)
+    t[a].onclick = rm;
+
+function rm() {
+    var u = SR + shr + uricom_enc(this.getAttribute('k')) + '?unshare',
+        xhr = new XHR();
+
+    xhr.open('POST', u, true);
+    xhr.onload = xhr.onerror = cb;
+    xhr.send();
+}
+
+function cb() {
+    if (this.status !== 200)
+        return modal.alert('<h6>server error</h6>' + esc(unpre(this.responseText)));
+
+    document.location = '?shares';
+}
+
+(function() {
+    var tab = ebi('tab').tBodies[0],
+        tr = Array.prototype.slice.call(tab.rows, 0);
+
+    var buf = [];
+    for (var a = 0; a < tr.length; a++)
+        for (var b = 7; b < 9; b++)
+            buf.push(parseInt(tr[a].cells[b].innerHTML));
+
+    var ibuf = 0;
+    for (var a = 0; a < tr.length; a++)
+        for (var b = 7; b < 9; b++) {
+            var v = buf[ibuf++];
+            tr[a].cells[b].innerHTML =
+                v ? unix2iso(v).replace(' ', ',&nbsp;') : 'never';
+        }
+})();

copyparty/web/splash.css

@@ -182,13 +182,18 @@ html.z a.g {
 	border-color: #af4;
 	box-shadow: 0 .3em 1em #7d0;
 }
+form {
+	line-height: 2.5em;
+}
+#x,
 input {
 	color: #a50;
 	background: #fff;
 	border: 1px solid #a50;
-	border-radius: .5em;
-	padding: .5em .7em;
-	margin: 0 .5em 0 0;
+	border-radius: .3em;
+	padding: .25em .6em;
+	margin: 0 .3em 0 0;
+	font-size: 1em;
 }
 input::placeholder {
 	font-size: 1.2em;
@@ -197,6 +202,7 @@ input::placeholder {
 	opacity: 0.64;
 	color: #930;
 }
+#x,
 html.z input {
 	color: #fff;
 	background: #626;

copyparty/web/splash.html

@@ -14,6 +14,7 @@
 
 <body>
 	<div id="wrap">
+		{%- if not in_shr %}
 		<a id="a" href="{{ r }}/?h" class="af">refresh</a>
 		<a id="v" href="{{ r }}/?hc" class="af">connect</a>
 
@@ -21,7 +22,8 @@
 			<p id="b">howdy stranger &nbsp; <small>(you're not logged in)</small></p>
 		{%- else %}
 			<a id="c" href="{{ r }}/?pw=x" class="logout">logout</a>
-			<p><span id="m">welcome back,</span> <strong>{{ this.uname }}</strong></p>
+			<p><span id="m">welcome back,</span> <strong>{{ this.uname|e }}</strong></p>
+		{%- endif %}
 		{%- endif %}
 
 		{%- if msg %}
@@ -76,8 +78,43 @@
 		</ul>
 		{%- endif %}
 
-		<h1 id="cc">client config:</h1>
+		{%- if in_shr %}
+		<h1 id="z">unlock this share:</h1>
+		<div>
+			<form id="lf" method="post" enctype="multipart/form-data" action="{{ r }}/{{ qvpath }}">
+				<input type="hidden" id="la" name="act" value="login" />
+				<input type="password" id="lp" name="cppwd" placeholder=" password" />
+				<input type="hidden" name="uhash" id="uhash" value="x" />
+				<input type="submit" id="ls" value="Unlock" />
+				{% if ahttps %}
+				<a id="w" href="{{ ahttps }}">switch to https</a>
+				{% endif %}
+			</form>
+		</div>
+		{%- else %}
+		<h1 id="l">login for more:</h1>
+		<div>
+			<form id="lf" method="post" enctype="multipart/form-data" action="{{ r }}/{{ qvpath }}">
+				<input type="hidden" id="la" name="act" value="login" />
+				<input type="password" id="lp" name="cppwd" placeholder=" password" />
+				<input type="hidden" name="uhash" id="uhash" value="x" />
+				<input type="submit" id="ls" value="Login" />
+				{% if chpw %}
+				<a id="x" href="#">change password</a>
+				{% endif %}
+				{% if ahttps %}
+				<a id="w" href="{{ ahttps }}">switch to https</a>
+				{% endif %}
+			</form>
+		</div>
+		{%- endif %}
+
+		<h1 id="cc">other stuff:</h1>
 		<ul>
+			{%- if this.uname != '*' and this.args.shr %}
+			<li><a id="y" href="{{ r }}/?shares">edit shares</a></li>
+			{% endif %}
+
 			{% if k304 or k304vis %}
 			{% if k304 %}
 			<li><a id="h" href="{{ r }}/?k304=n">disable k304</a> (currently enabled)
@@ -90,18 +127,6 @@
 			<li><a id="k" href="{{ r }}/?reset" class="r" onclick="localStorage.clear();return true">reset client settings</a></li>
 		</ul>
 
-		<h1 id="l">login for more:</h1>
-		<div>
-			<form method="post" enctype="multipart/form-data" action="{{ r }}/{{ qvpath }}">
-				<input type="hidden" name="act" value="login" />
-				<input type="password" name="cppwd" placeholder=" password" />
-				<input type="hidden" name="uhash" id="uhash" value="x" />
-				<input type="submit" value="Login" />
-				{% if ahttps %}
-				<a id="w" href="{{ ahttps }}">switch to https</a>
-				{% endif %}
-			</form>
-		</div>
 	</div>
 	<a href="#" id="repl">π</a>
 	{%- if not this.args.nb %}

copyparty/web/splash.js

@@ -9,7 +9,7 @@ var Ls = {
 		"e2": "leser inn konfigurasjonsfiler på nytt$N(kontoer, volumer, volumbrytere)$Nog kartlegger alle e2ds-volumer$N$Nmerk: endringer i globale parametere$Nkrever en full restart for å ta gjenge",
 		"f1": "du kan betrakte:",
 		"g1": "du kan laste opp til:",
-		"cc1": "klient-konfigurasjon",
+		"cc1": "brytere og sånt",
 		"h1": "skru av k304",
 		"i1": "skru på k304",
 		"j1": "k304 bryter tilkoplingen for hver HTTP 304. Dette hjelper mot visse mellomtjenere som kan sette seg fast / plutselig slutter å laste sider, men det reduserer også ytelsen betydelig",
@@ -17,9 +17,9 @@ var Ls = {
 		"l1": "logg inn:",
 		"m1": "velkommen tilbake,",
 		"n1": "404: filen finnes ikke  ┐( ´ -`)┌",
-		"o1": 'eller kanskje du ikke har tilgang? prøv å logge inn eller <a href="' + SR + '/?h">gå hjem</a>',
+		"o1": 'eller kanskje du ikke har tilgang? prøv et passord eller <a href="' + SR + '/?h">gå hjem</a>',
 		"p1": "403: tilgang nektet &nbsp;~┻━┻",
-		"q1": 'du må logge inn eller <a href="' + SR + '/?h">gå hjem</a>',
+		"q1": 'prøv et passord eller <a href="' + SR + '/?h">gå hjem</a>',
 		"r1": "gå hjem",
 		".s1": "kartlegg",
 		"t1": "handling",
@@ -27,21 +27,66 @@ var Ls = {
 		"v1": "koble til",
 		"v2": "bruk denne serveren som en lokal harddisk$N$NADVARSEL: kommer til å vise passordet ditt!",
 		"w1": "bytt til https",
+		"x1": "bytt passord",
+		"y1": "dine delinger",
+		"z1": "lås opp område",
+		"ta1": "du må skrive et nytt passord først",
+		"ta2": "gjenta for å bekrefte nytt passord:",
+		"ta3": "fant en skrivefeil; vennligst prøv igjen",
 	},
 	"eng": {
 		"d2": "shows the state of all active threads",
 		"e2": "reload config files (accounts/volumes/volflags),$Nand rescan all e2ds volumes$N$Nnote: any changes to global settings$Nrequire a full restart to take effect",
 		"u2": "time since the last server write$N( upload / rename / ... )$N$N17d = 17 days$N1h23 = 1 hour 23 minutes$N4m56 = 4 minutes 56 seconds",
 		"v2": "use this server as a local HDD$N$NWARNING: this will show your password!",
+		"ta1": "fill in your new password first",
+		"ta2": "repeat to confirm new password:",
+		"ta3": "found a typo; please try again",
+	},
+
+	"chi": {
+		"a1": "更新",
+		"b1": "你好 &nbsp; <small>(你尚未登录)</small>",
+		"c1": "登出",
+		"d1": "状态",
+		"d2": "显示所有活动线程的状态",
+		"e1": "重新加载配置",
+		"e2": "重新加载配置文件（账户/卷/卷标），$N并重新扫描所有 e2ds 卷$N$N注意：任何全局设置的更改$N都需要完全重启才能生效",
+		"f1": "你可以查看：",
+		"g1": "你可以上传到：",
+		"cc1": "开关等",
+		"h1": "关闭 k304",
+		"i1": "开启 k304",
+		"j1": "k304 会在每个 HTTP 304 时断开连接。这有助于避免某些代理服务器卡住或突然停止加载页面，但也会显著降低性能。",
+		"k1": "重置设置",
+		"l1": "登录：",
+		"m1": "欢迎回来，",
+		"n1": "404: 文件不存在 &nbsp;┐( ´ -`)┌",
+		"o1": '或者你可能没有权限？尝试输入密码或 <a href="' + SR + '/?h">回家</a>',
+		"p1": "403: 访问被拒绝 &nbsp;~┻━┻",
+		"q1": '尝试输入密码或 <a href="' + SR + '/?h">回家</a>',
+		"r1": "回家",
+		".s1": "映射",
+		"t1": "操作",
+		"u2": "自上次服务器写入的时间$N( 上传 / 重命名 / ... )$N$N17d = 17 天$N1h23 = 1 小时 23 分钟$N4m56 = 4 分钟 56 秒",
+		"v1": "连接",
+		"v2": "将此服务器用作本地硬盘$N$N警告：这将显示你的密码！",
+		"w1": "切换到 https",
+		"x1": "更改密码",
+		"y1": "你的分享",
+		"z1": "解锁区域",
+		"ta1": "请先输入新密码",
+		"ta2": "重复以确认新密码：",
+		"ta3": "发现拼写错误；请重试",
 	}
 };
 
-var LANGS = ["eng", "nor"];
+var LANGS = ["eng", "nor", "chi"];
 
 if (window.langmod)
 	langmod();
 
-var d = Ls[sread("cpp_lang", LANGS) || lang] || Ls.eng || Ls.nor;
+var d = Ls[sread("cpp_lang", LANGS) || lang] || Ls.eng || Ls.nor || Ls.chi;
 
 for (var k in (d || {})) {
 	var f = k.slice(-1),
@@ -74,3 +119,42 @@ if (o && /[0-9]+$/.exec(o.innerHTML))
 	o.innerHTML = shumantime(o.innerHTML);
 
 ebi('uhash').value = '' + location.hash;
+
+(function() {
+	if (!ebi('x'))
+		return;
+
+	var pwi = ebi('lp');
+
+	function redo(msg) {
+		modal.alert(msg, function() {
+			pwi.value = '';
+			pwi.focus();
+		});
+	}
+	function mok(v) {
+		if (v !== pwi.value)
+			return redo(d.ta3);
+
+		pwi.setAttribute('name', 'pw');
+		ebi('la').value = 'chpw';
+		ebi('lf').submit();
+	}
+	function stars() {
+		var m = ebi('modali');
+		function enstars(n) {
+			setTimeout(function() { m.value = ''; }, n);
+		}
+		m.setAttribute('type', 'password');
+		enstars(17);
+		enstars(32);
+		enstars(69);
+	}
+	ebi('x').onclick = function (e) {
+		ev(e);
+		if (!pwi.value)
+			return redo(d.ta1);
+
+		modal.prompt(d.ta2, "y", mok, null, stars);
+	};
+})();

copyparty/web/util.js

@@ -473,6 +473,24 @@ function crc32(str) {
 }
 
 
+function randstr(len) {
+    var ret = '';
+    try {
+        var ar = new Uint32Array(Math.floor((len + 3) / 4));
+        crypto.getRandomValues(ar);
+        for (var a = 0; a < ar.length; a++)
+            ret += ('000' + ar[a].toString(36)).slice(-4);
+        return ret.slice(0, len);
+    }
+    catch (ex) {
+        console.log('using unsafe randstr because ' + ex);
+        while (ret.length < len)
+            ret += ('000' + Math.floor(Math.random() * 1679616).toString(36)).slice(-4);
+        return ret.slice(0, len);
+    }
+}
+
+
 function clmod(el, cls, add) {
     if (!el)
         return false;

docs/changelog.md

@@ -1,3 +1,86 @@
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2024-0819-0014  `v1.14.1`  one step forward
+
+[if i turn back now, then this will always follow... one step forward, forward](https://youtu.be/xe3Wkzc0O3k?t=27)
+
+* read-only demo server at https://a.ocv.me/pub/demo/
+* [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/)
+
+there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2023-07-23)
+
+## new features
+
+* #92 users can change their own passwords 83fb569d 00da7440
+  * this feature is default-disabled; see [readme](https://github.com/9001/copyparty#user-changeable-passwords)
+* #84 share files/folders by creating a temporary url 7c2beba5
+  * inspired by other file servers; click the share-button to create a link like `example.com/share/enkz8g374o8g`
+    * primary usecase is to sneak past authentication services (see issue description)
+  * the create-share UI has options to accept uploads into the share, and/or set expiration time
+  * this feature is default-disabled; see [readme](https://github.com/9001/copyparty#shares)
+
+## bugfixes
+
+* #93 fixes for vproxy / location-based / not-vhost-based reverse-proxying 0b46b1a6
+  * using `--rp-loc` to reverse-proxy from a subfolder made some UI stuff break
+* listening on unix-sockets: 687df2fa
+  * fix `x-forwarded-for` support, and avoid a possible container-specific collision
+  * new syntax which allows setting unix-permissions and unix-group
+    * `-i unix:770:www:/tmp/party.sock` (see `--help-bind` for more examples)
+* using relocation hooks (introduced in previous ver) could cause dedup issues c8f4aeae b0af4b37
+* custom fonts using `@import` css statements 5a62cb48
+* invert volume scrollwheel 7d8d9438
+
+## other changes
+
+* changed the button colors in theme 2 (pm-monokai) from red to yellow 5153db6b
+  * the red buttons look better, but are too confusing because usually red means off
+
+
+
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2024-0813-0008  `v1.13.8`  hook into place
+
+## new features
+
+* #86 intentional side-effects from hooks 6c94a63f
+  * use hooks (plugins) to conditionally move uploads into another folder depending on filename, extension, uploader ip/name, file contents, ...
+  * hooks can create additional files and tell copyparty to index them immediately, or delete an existing file based on some condition
+  * only one example so far though, [reloc-by-ext](https://github.com/9001/copyparty/tree/hovudstraum/bin/hooks#before-upload) which was a feature-request to dodge [sharex#3992](https://github.com/ShareX/ShareX/issues/3992)
+* listen on unix-sockets ee9aad82
+  * `-i unix:/tmp/party.sock` stops listening on TCP ports entirely, and only listens on that unix-socket
+  * can be combined with regular sockets, `-i 127.0.0.1,unix:/tmp/a.sock`
+  * kinda buggy for now (need to `--xff-src=any` and doesn't let you set socket-perms yet), will be fixed in next ver
+  * makes it 10% faster, but more importantly offers tighter access control behind reverse-proxies
+    * inspired by https://www.oligo.security/blog/0-0-0-0-day-exploiting-localhost-apis-from-the-browser
+* up2k stitching:
+  * more optimal stitch sizes for max throughput across connections c862ec1b
+  * improve fat32 compatibility 373194c3
+* new option `--js-other` to load custom javascript dbd42bc6
+  * `--js-browser` affects the filebrowser page, `--js-other` does all the others
+  * endless possibilities, such as [adding a login-banner](https://github.com/9001/copyparty/blob/hovudstraum/contrib/plugins/banner.js) which [looks like this](https://github.com/user-attachments/assets/8ae8e087-b209-449c-b08d-74e040f0284b)
+* list detected optional dependencies on startup 3db117d8
+  * hopefully reduces the guesswork / jank factor by a tiny bit
+
+## bugfixes
+
+* up2k stitching:
+  * put the request headers on a diet so they fit through more reverse-proxies 0da719f4
+* fix deadlock on s390x (IBM mainframes) 250c8c56
+
+## other changes
+
+* add flags to disengage [features](https://github.com/9001/copyparty/tree/hovudstraum#feature-chickenbits) and [dependencies](https://github.com/9001/copyparty/tree/hovudstraum#dependency-chickenbits) in case they cause trouble 72361c99
+* optimizations
+  * 6% faster on average d5c9c8eb
+  * docker: reduce ram usage 98ffaadf
+  * python2: reduce ram usage ebb19818
+* docker: add [portainer howto](https://github.com/9001/copyparty/blob/hovudstraum/docs/examples/docker/portainer.md) e136231c
+* update deps ca001c85
+  * pyftpdlib 1.5.10
+  * copyparty.exe: python 3.12.5
+
+
+
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
 # 2024-0729-2028  `v1.13.6`  not that big
 

docs/devnotes.md

@@ -1,7 +1,7 @@
 ## devnotes toc
 
 * top
-* [future plans](#future-plans) - some improvement ideas
+* [future ideas](#future-ideas) - list of dreams which will probably never happen
 * [design](#design)
     * [up2k](#up2k) - quick outline of the up2k protocol
         * [why not tus](#why-not-tus) - I didn't know about [tus](https://tus.io/)
@@ -27,9 +27,9 @@
     * [discarded ideas](#discarded-ideas)
 
 
-# future plans
+# future ideas
 
-some improvement ideas
+list of dreams which will probably never happen
 
 * the JS is a mess -- a ~~preact~~ rewrite would be nice
   * preferably without build dependencies like webpack/babel/node.js, maybe a python thing to assemble js files into main.js
@@ -139,6 +139,7 @@ authenticate using header `Cookie: cppwd=foo` or url param `&pw=foo`
 | GET | `?tar&w` | pregenerate webp thumbnails |
 | GET | `?tar&j` | pregenerate jpg thumbnails |
 | GET | `?tar&p` | pregenerate audio waveforms |
+| GET | `?shares` | list your shared files/folders |
 | GET | `?ups` | show recent uploads from your IP |
 | GET | `?ups&filter=f` | ...where URL contains `f` |
 | GET | `?mime=foo` | specify return mimetype `foo` |
@@ -175,6 +176,8 @@ authenticate using header `Cookie: cppwd=foo` or url param `&pw=foo`
 | mPOST | `?media` | `f=FILE` | ...and return medialink (not hotlink) |
 | mPOST | | `act=mkdir`, `name=foo` | create directory `foo` at URL |
 | POST | `?delete` | | delete URL recursively |
+| POST | `?unshare` | | stop sharing a file/folder |
+| jPOST | `?share` | (complicated) | create temp URL for file/folder |
 | jPOST | `?delete` | `["/foo","/bar"]` | delete `/foo` and `/bar` recursively |
 | uPOST | | `msg=foo` | send message `foo` into server log |
 | mPOST | | `act=tput`, `body=TEXT` | overwrite markdown document at URL |

docs/notes.sh

@@ -141,6 +141,9 @@ find -maxdepth 1 -printf '%s %p\n' | sort -n | awk '!/-([0-9a-zA-Z_-]{11})\.(mkv
 # unique stacks in a stackdump
 f=a; rm -rf stacks; mkdir stacks; grep -E '^#' $f | while IFS= read -r n; do awk -v n="$n" '!$0{o=0} o; $0==n{o=1}' <$f >stacks/f; h=$(sha1sum <stacks/f | cut -c-16); mv stacks/f stacks/$h-"$n"; done ; find stacks/ | sort | uniq -cw24
 
+# find unused css variables
+cat browser.css | sed -r 's/(var\()/\n\1/g' | awk '{sub(/:/," ")} $1~/^--/{d[$1]=1} /var\(/{sub(/.*var\(/,"");sub(/\).*/,"");u[$1]=1} END{for (x in u) delete d[x]; for (x in d) print x}' | tr '\n' '|'
+
 
 ##
 ## sqlite3 stuff

scripts/sfx.ls

@@ -103,6 +103,9 @@ copyparty/web/mde.html,
 copyparty/web/mde.js,
 copyparty/web/msg.css,
 copyparty/web/msg.html,
+copyparty/web/shares.css,
+copyparty/web/shares.html,
+copyparty/web/shares.js,
 copyparty/web/splash.css,
 copyparty/web/splash.html,
 copyparty/web/splash.js,

scripts/tlcheck.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+set -e
+
+# usage: ./scripts/tlcheck.sh eng chi copyparty/web/browser.js 
+
+awk <"$3" -v lang1=\"$1\": -v lang2=\"$2\": '
+    /^\t\}/{fa=0;fb=0}
+    !/":/{next}
+    $0~lang1{fa=1}
+    $0~lang2{fb=1}
+    fa{a[ia++]=$0}
+    fb{b[ib++]=$0}
+    END{for (i=0;i<ia;i++) printf "%s\n%s\n\n",a[i],b[i]}
+' |
+awk -v apos=\' -v quot=\" '
+    # count special chars and prefix to line
+    function c(ch) {
+        m=$0;
+        gsub(ch,"",m);
+        t=t sprintf("%s%d ", ch, length($0)-length(m))
+    }
+    !$0 && t!=tp {
+        print "\n\033[1;37;41m====DIFF===="
+    }
+    !$0 { print; next; }
+    {
+        tp=t; t="";
+        c(quot);
+        c(apos);
+        c("<");
+        c(">");
+        c("{");
+        c("}");
+        c("&");
+        c("\\\$");
+        c("\\\\");
+        print t $0;
+    }
+' |
+sed -r $'
+    s/\\\\/\033[1;37;41m\\\\\033[0m/g;
+    s/\$N/\033[1;37;45m$N\033[0m/g;
+    s/([{}])/\033[34m\\1\033[0m/g;
+    s/"/\033[44m"\033[0m/g;
+    s/\'/\033[45m\'\033[0m/g;
+    s/&/\033[1;43;30m&\033[0m/g;
+    s/([<>])/\033[30;47m\\1\033[0m/g
+' |
+sed -r 's/\t+//' |
+less -R

tests/util.py

@@ -119,7 +119,7 @@ class Cfg(Namespace):
     def __init__(self, a=None, v=None, c=None, **ka0):
         ka = {}
 
-        ex = "daw dav_auth dav_inf dav_mac dav_rt e2d e2ds e2dsa e2t e2ts e2tsr e2v e2vu e2vp early_ban ed emp exp force_js getmod grid gsel hardlink ih ihead magic never_symlink nid nih no_acode no_athumb no_dav no_dedup no_del no_dupe no_lifetime no_logues no_mv no_pipe no_poll no_readme no_robots no_sb_md no_sb_lg no_scandir no_tarcmp no_thumb no_vthumb no_zip nrand nw og og_no_head og_s_title q rand smb srch_dbg stats uqe vague_403 vc ver write_uplog xdev xlink xvol"
+        ex = "chpw daw dav_auth dav_inf dav_mac dav_rt e2d e2ds e2dsa e2t e2ts e2tsr e2v e2vu e2vp early_ban ed emp exp force_js getmod grid gsel hardlink ih ihead magic never_symlink nid nih no_acode no_athumb no_dav no_dedup no_del no_dupe no_lifetime no_logues no_mv no_pipe no_poll no_readme no_robots no_sb_md no_sb_lg no_scandir no_tarcmp no_thumb no_vthumb no_zip nrand nw og og_no_head og_s_title q rand smb srch_dbg stats uqe vague_403 vc ver write_uplog xdev xlink xvol"
         ka.update(**{k: False for k in ex.split()})
 
         ex = "dotpart dotsrch hook_v no_dhash no_fastboot no_rescan no_sendfile no_snap no_voldump re_dhash plain_ip"
@@ -137,7 +137,7 @@ class Cfg(Namespace):
         ex = "db_act k304 loris re_maxage rproxy rsp_jtr rsp_slp s_wr_slp snap_wri theme themes turbo"
         ka.update(**{k: 0 for k in ex.split()})
 
-        ex = "ah_alg bname doctitle df exit favico idp_h_usr html_head lg_sbf log_fk md_sbf name og_desc og_site og_th og_title og_title_a og_title_v og_title_i tcolor textfiles unlist vname R RS SR"
+        ex = "ah_alg bname chpw_db doctitle df exit favico idp_h_usr html_head lg_sbf log_fk md_sbf name og_desc og_site og_th og_title og_title_a og_title_v og_title_i shr tcolor textfiles unlist vname R RS SR"
         ka.update(**{k: "" for k in ex.split()})
 
         ex = "grp on403 on404 xad xar xau xban xbd xbr xbu xiu xm"
@@ -170,6 +170,7 @@ class Cfg(Namespace):
             s_wr_sz=256 * 1024,
             sort="href",
             srch_hits=99999,
+            SRS="/",
             th_covers=["folder.png"],
             th_coversd=["folder.png"],
             th_covers_set=set(["folder.png"]),
@@ -232,7 +233,7 @@ class VHttpSrv(object):
         self.nreq = 0
         self.nsus = 0
 
-        aliases = ["splash", "browser", "browser2", "msg", "md", "mde"]
+        aliases = ["splash", "shares", "browser", "browser2", "msg", "md", "mde"]
         self.j2 = {x: J2_FILES for x in aliases}
 
         self.gpwd = Garda("")