v1.9.4

add ?tar=gz, ?tar=bz2, ?tar=xz with optional level;
defaults are ?tar=gz:3, ?tar=bz2:9, ?tar=xz:1
2023-09-02 00:18:53 +00:00 · 2023-09-01 23:44:10 +00:00 · 2023-09-01 20:29:55 +00:00 · 2023-09-01 20:16:19 +00:00 · 2023-08-31 23:08:32 +00:00 · 2023-08-31 22:11:31 +00:00
30 changed files with 445 additions and 109 deletions
--- a/README.md
+++ b/README.md
@@ -285,8 +285,11 @@ server notes:
 * Android: music playback randomly stops due to [battery usage settings](#fix-unreliable-playback-on-android)

 * iPhones: the volume control doesn't work because [apple doesn't want it to](https://developer.apple.com/library/archive/documentation/AudioVideo/Conceptual/Using_HTML5_Audio_Video/Device-SpecificConsiderations/Device-SpecificConsiderations.html#//apple_ref/doc/uid/TP40009523-CH5-SW11)
-  * *future workaround:* enable the equalizer, make it all-zero, and set a negative boost to reduce the volume
-    * "future" because `AudioContext` can't maintain a stable playback speed in the current iOS version (15.7), maybe one day...
+  * `AudioContext` will probably never be a viable workaround as apple introduces new issues faster than they fix current ones
+
+* iPhones: the preload feature (in the media-player-options tab) can cause a tiny audio glitch 20sec before the end of each song, but disabling it may cause worse iOS bugs to appear instead
+  * just a hunch, but disabling preloading may cause playback to stop entirely, or possibly mess with bluetooth speakers
+  * tried to add a tooltip regarding this but looks like apple broke my tooltips

 * Windows: folders cannot be accessed if the name ends with `.`
  * python or windows bug
@@ -506,10 +509,16 @@ select which type of archive you want in the `[⚙️] config` tab:
 | name | url-suffix | description |
 |--|--|--|
 | `tar` | `?tar` | plain gnutar, works great with `curl \| tar -xv` |
+| `tar.gz` | `?tar=gz` | gzip compressed tar, for `curl \| tar -xvz` |
+| `tar.xz` | `?tar=xz` | gnu-tar with xz / lzma compression (good) |
+| `tar.bz2` | `?tar=bz2` | bzip2-compressed tar (mostly useless) |
 | `zip` | `?zip=utf8` | works everywhere, glitchy filenames on win7 and older |
 | `zip_dos` | `?zip` | traditional cp437 (no unicode) to fix glitchy filenames |
 | `zip_crc` | `?zip=crc` | cp437 with crc32 computed early for truly ancient software |

+* gzip default level is `3` (0=fast, 9=best), change with `?tar=gz:9`
+* xz default level is `1` (0=fast, 9=best), change with `?tar=xz:9`
+* bz2 default level is `2` (1=fast, 9=best), change with `?tar=bz2:9`
 * hidden files (dotfiles) are excluded unless `-ed`
  * `up2k.db` and `dir.txt` is always excluded
 * `zip_crc` will take longer to download since the server has to read each file twice
@@ -721,6 +730,8 @@ can also boost the volume in general, or increase/decrease stereo width (like [c

 has the convenient side-effect of reducing the pause between songs, so gapless albums play better with the eq enabled (just make it flat)

+not available on iPhones / iPads because AudioContext currently breaks background audio playback on iOS (15.7.8)
+

 ### fix unreliable playback on android

@@ -1599,6 +1610,7 @@ some notes on hardening
 * set `--rproxy 0` if your copyparty is directly facing the internet (not through a reverse-proxy)
  * cors doesn't work right otherwise
 * if you allow anonymous uploads or otherwise don't trust the contents of a volume, you can prevent XSS with volflag `nohtml`
+  * this returns html documents as plaintext, and also disables markdown rendering

 safety profiles:

@@ -1612,9 +1624,9 @@ safety profiles:
  * `--unpost 0`, `--no-del`, `--no-mv` disables all move/delete support
  * `--hardlink` creates hardlinks instead of symlinks when deduplicating uploads, which is less maintenance
    * however note if you edit one file it will also affect the other copies
-  * `--vague-401` returns a "404 not found" instead of "401 unauthorized" which is a common enterprise meme
+  * `--vague-403` returns a "404 not found" instead of "401 unauthorized" which is a common enterprise meme
  * `--ban-404=50,60,1440` ban client for 1440min (24h) if they hit 50 404's in 60min
-    * **NB:** will ban anyone who enables up2k turbo
+    * `--turbo=-1` to force-disable turbo-mode in the uploader which could otherwise hit the 404-ban
  * `--nih` removes the server hostname from directory listings

 * option `-sss` is a shortcut for the above plus:
@@ -1636,10 +1648,12 @@ other misc notes:
 behavior that might be unexpected

 * users without read-access to a folder can still see the `.prologue.html` / `.epilogue.html` / `README.md` contents, for the purpose of showing a description on how to use the uploader for example
-* users can submit `<script>`s which autorun for other visitors in a few ways;
+* users can submit `<script>`s which autorun (in a sandbox) for other visitors in a few ways;
  * uploading a `README.md` -- avoid with `--no-readme`
  * renaming `some.html` to `.epilogue.html` -- avoid with either `--no-logues` or `--no-dot-ren`
-  * the directory-listing embed is sandboxed (so any malicious scripts can't do any damage) but the markdown editor is not
+  * the directory-listing embed is sandboxed (so any malicious scripts can't do any damage) but the markdown editor is not 100% safe, see below
+* markdown documents can contain html and `<script>`s; attempts are made to prevent scripts from executing (unless `-emp` is specified) but this is not 100% bulletproof, so setting the `nohtml` volflag is still the safest choice
+  * or eliminate the problem entirely by only giving write-access to trustworthy people :^)


 ## cors
--- a/bin/u2c.py
+++ b/bin/u2c.py
@@ -40,7 +40,7 @@ except:

 try:
    import requests
-except ImportError:
+except ImportError as ex:
    if EXE:
        raise
    elif sys.version_info > (2, 7):
@@ -51,7 +51,7 @@ except ImportError:
        m = "\n  ERROR: need these:\n" + "\n".join(m) + "\n"
        m += "\n  for f in *.whl; do unzip $f; done; rm -r *.dist-info\n"

-    print(m.format(sys.executable))
+    print(m.format(sys.executable), "\nspecifically,", ex)
    sys.exit(1)


--- a/contrib/nginx/copyparty.conf
+++ b/contrib/nginx/copyparty.conf
@@ -34,6 +34,8 @@ server {
 		proxy_set_header   Host              $host;
 		proxy_set_header   X-Real-IP         $remote_addr;
 		proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
+		# NOTE: with cloudflare you want this instead:
+		#proxy_set_header   X-Forwarded-For   $http_cf_connecting_ip;
 		proxy_set_header   X-Forwarded-Proto $scheme;
 		proxy_set_header   Connection        "Keep-Alive";
 	}
--- a/contrib/package/arch/PKGBUILD
+++ b/contrib/package/arch/PKGBUILD
@@ -1,6 +1,6 @@
 # Maintainer: icxes <dev.null@need.moe>
 pkgname=copyparty
-pkgver="1.9.0"
+pkgver="1.9.3"
 pkgrel=1
 pkgdesc="Portable file sharing hub"
 arch=("any")
@@ -20,7 +20,7 @@ optdepends=("ffmpeg: thumbnails for videos, images (slower) and audio, music tag
 )
 source=("https://github.com/9001/${pkgname}/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz")
 backup=("etc/${pkgname}.d/init" )
-sha256sums=("3fdeef995e2dd24d255122a7308f468d5caf04db13c0e14435ce5a52e1d4f3b2")
+sha256sums=("87db55a57adf14b3b875c72d94b5df67560abc6dbfc104104e0c76d7f02848b6")

 build() {
    cd "${srcdir}/${pkgname}-${pkgver}"
--- a/contrib/package/nix/copyparty/pin.json
+++ b/contrib/package/nix/copyparty/pin.json
@@ -1,5 +1,5 @@
 {
-    "url": "https://github.com/9001/copyparty/releases/download/v1.9.0/copyparty-sfx.py",
-    "version": "1.9.0",
-    "hash": "sha256-rbOw+i6rh0263YkvmZq5ASvCvM57JpaztHVRndaC9W4="
+    "url": "https://github.com/9001/copyparty/releases/download/v1.9.3/copyparty-sfx.py",
+    "version": "1.9.3",
+    "hash": "sha256-ufT7WARaj6nKaLX/r3X/ex/hMLMh1rtG0lkZHCm4Gu4="
 }
--- a/copyparty/main.py
+++ b/copyparty/main.py
@@ -815,7 +815,7 @@ def add_upload(ap):
    ap2.add_argument("--magic", action="store_true", help="enable filetype detection on nameless uploads (volflag=magic)")
    ap2.add_argument("--df", metavar="GiB", type=float, default=0, help="ensure GiB free disk space by rejecting upload requests")
    ap2.add_argument("--sparse", metavar="MiB", type=int, default=4, help="windows-only: minimum size of incoming uploads through up2k before they are made into sparse files")
-    ap2.add_argument("--turbo", metavar="LVL", type=int, default=0, help="configure turbo-mode in up2k client; [\033[32m0\033[0m] = off and warn if enabled, [\033[32m1\033[0m] = off, [\033[32m2\033[0m] = on, [\033[32m3\033[0m] = on and disable datecheck")
+    ap2.add_argument("--turbo", metavar="LVL", type=int, default=0, help="configure turbo-mode in up2k client; [\033[32m-1\033[0m] = forbidden/always-off, [\033[32m0\033[0m] = default-off and warn if enabled, [\033[32m1\033[0m] = default-off, [\033[32m2\033[0m] = on, [\033[32m3\033[0m] = on and disable datecheck")
    ap2.add_argument("--u2sort", metavar="TXT", type=u, default="s", help="upload order; [\033[32ms\033[0m]=smallest-first, [\033[32mn\033[0m]=alphabetical, [\033[32mfs\033[0m]=force-s, [\033[32mfn\033[0m]=force-n -- alphabetical is a bit slower on fiber/LAN but makes it easier to eyeball if everything went fine")
    ap2.add_argument("--write-uplog", action="store_true", help="write POST reports to textfiles in working-directory")

@@ -959,7 +959,7 @@ def add_hooks(ap):
    ap2.add_argument("--xbd", metavar="CMD", type=u, action="append", help="execute CMD before a file delete")
    ap2.add_argument("--xad", metavar="CMD", type=u, action="append", help="execute CMD after  a file delete")
    ap2.add_argument("--xm", metavar="CMD", type=u, action="append", help="execute CMD on message")
-    ap2.add_argument("--xban", metavar="CMD", type=u, action="append", help="execute CMD if someone gets banned (pw/404)")
+    ap2.add_argument("--xban", metavar="CMD", type=u, action="append", help="execute CMD if someone gets banned (pw/404/403/url)")


 def add_stats(ap):
@@ -989,13 +989,14 @@ def add_optouts(ap):
    ap2.add_argument("-nid", action="store_true", help="no info disk-usage -- don't show in UI")
    ap2.add_argument("-nb", action="store_true", help="no powered-by-copyparty branding in UI")
    ap2.add_argument("--no-zip", action="store_true", help="disable download as zip/tar")
+    ap2.add_argument("--no-tarcmp", action="store_true", help="disable download as compressed tar (?tar=gz, ?tar=bz2, ?tar=xz, ?tar=gz:9, ...)")
    ap2.add_argument("--no-lifetime", action="store_true", help="disable automatic deletion of uploads after a certain time (as specified by the 'lifetime' volflag)")


 def add_safety(ap):
    ap2 = ap.add_argument_group('safety options')
    ap2.add_argument("-s", action="count", default=0, help="increase safety: Disable thumbnails / potentially dangerous software (ffmpeg/pillow/vips), hide partial uploads, avoid crawlers.\n └─Alias of\033[32m --dotpart --no-thumb --no-mtag-ff --no-robots --force-js")
-    ap2.add_argument("-ss", action="store_true", help="further increase safety: Prevent js-injection, accidental move/delete, broken symlinks, webdav, 404 on 403, ban on excessive 404s.\n └─Alias of\033[32m -s --unpost=0 --no-del --no-mv --hardlink --vague-403 --ban-404=50,60,1440 -nih")
+    ap2.add_argument("-ss", action="store_true", help="further increase safety: Prevent js-injection, accidental move/delete, broken symlinks, webdav, 404 on 403, ban on excessive 404s.\n └─Alias of\033[32m -s --unpost=0 --no-del --no-mv --hardlink --vague-403 --ban-404=50,60,1440 --turbo=-1 -nih")
    ap2.add_argument("-sss", action="store_true", help="further increase safety: Enable logging to disk, scan for dangerous symlinks.\n └─Alias of\033[32m -ss --no-dav --no-logues --no-readme -lo=cpp-%%Y-%%m%%d-%%H%%M%%S.txt.xz --ls=**,*,ln,p,r")
    ap2.add_argument("--ls", metavar="U[,V[,F]]", type=u, help="do a sanity/safety check of all volumes on startup; arguments \033[33mUSER\033[0m,\033[33mVOL\033[0m,\033[33mFLAGS\033[0m; example [\033[32m**,*,ln,p,r\033[0m]")
    ap2.add_argument("--xvol", action="store_true", help="never follow symlinks leaving the volume root, unless the link is into another volume where the user has similar access (volflag=xvol)")
@@ -1010,6 +1011,11 @@ def add_safety(ap):
    ap2.add_argument("--logout", metavar="H", type=float, default="8086", help="logout clients after H hours of inactivity; [\033[32m0.0028\033[0m]=10sec, [\033[32m0.1\033[0m]=6min, [\033[32m24\033[0m]=day, [\033[32m168\033[0m]=week, [\033[32m720\033[0m]=month, [\033[32m8760\033[0m]=year)")
    ap2.add_argument("--ban-pw", metavar="N,W,B", type=u, default="9,60,1440", help="more than \033[33mN\033[0m wrong passwords in \033[33mW\033[0m minutes = ban for \033[33mB\033[0m minutes; disable with [\033[32mno\033[0m]")
    ap2.add_argument("--ban-404", metavar="N,W,B", type=u, default="no", help="hitting more than \033[33mN\033[0m 404's in \033[33mW\033[0m minutes = ban for \033[33mB\033[0m minutes (disabled by default since turbo-up2k counts as 404s)")
+    ap2.add_argument("--ban-403", metavar="N,W,B", type=u, default="9,2,1440", help="hitting more than \033[33mN\033[0m 403's in \033[33mW\033[0m minutes = ban for \033[33mB\033[0m minutes; [\033[32m1440\033[0m]=day, [\033[32m10080\033[0m]=week, [\033[32m43200\033[0m]=month")
+    ap2.add_argument("--ban-422", metavar="N,W,B", type=u, default="9,2,1440", help="hitting more than \033[33mN\033[0m 422's in \033[33mW\033[0m minutes = ban for \033[33mB\033[0m minutes (422 is server fuzzing, invalid POSTs and so)")
+    ap2.add_argument("--ban-url", metavar="N,W,B", type=u, default="9,2,1440", help="hitting more than \033[33mN\033[0m sus URL's in \033[33mW\033[0m minutes = ban for \033[33mB\033[0m minutes (decent replacement for --ban-404 if that can't be used)")
+    ap2.add_argument("--sus-urls", metavar="REGEX", type=u, default=r"\.php$|(^|/)wp-(admin|content|includes)/", help="URLs which are considered sus / eligible for banning; disable with blank or [\033[32mno\033[0m]")
+    ap2.add_argument("--nonsus-urls", metavar="REGEX", type=u, default=r"^(favicon\.ico|robots\.txt)$|^apple-touch-icon|^\.well-known", help="harmless URLs ignored from 404-bans; disable with blank or [\033[32mno\033[0m]")
    ap2.add_argument("--aclose", metavar="MIN", type=int, default=10, help="if a client maxes out the server connection limit, downgrade it from connection:keep-alive to connection:close for MIN minutes (and also kill its active connections) -- disable with 0")
    ap2.add_argument("--loris", metavar="B", type=int, default=60, help="if a client maxes out the server connection limit without sending headers, ban it for B minutes; disable with [\033[32m0\033[0m]")
    ap2.add_argument("--acao", metavar="V[,V]", type=u, default="*", help="Access-Control-Allow-Origin; list of origins (domains/IPs without port) to accept requests from; [\033[32mhttps://1.2.3.4\033[0m]. Default [\033[32m*\033[0m] allows requests from all sites but removes cookies and http-auth; only ?pw=hunter2 survives")
@@ -1150,7 +1156,7 @@ def add_ui(ap, retry):
    ap2.add_argument("--doctitle", metavar="TXT", type=u, default="copyparty @ --name", help="title / service-name to show in html documents")
    ap2.add_argument("--bname", metavar="TXT", type=u, default="--name", help="server name (displayed in filebrowser document title)")
    ap2.add_argument("--pb-url", metavar="URL", type=u, default="https://github.com/9001/copyparty", help="powered-by link; disable with -np")
-    ap2.add_argument("--ver", action="store_true", help="show version on the control panel (incompatible by -np)")
+    ap2.add_argument("--ver", action="store_true", help="show version on the control panel (incompatible with -nb)")
    ap2.add_argument("--md-sbf", metavar="FLAGS", type=u, default="downloads forms popups scripts top-navigation-by-user-activation", help="list of capabilities to ALLOW for README.md docs (volflag=md_sbf); see https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox")
    ap2.add_argument("--lg-sbf", metavar="FLAGS", type=u, default="downloads forms popups scripts top-navigation-by-user-activation", help="list of capabilities to ALLOW for prologue/epilogue docs  (volflag=lg_sbf)")
    ap2.add_argument("--no-sb-md", action="store_true", help="don't sandbox README.md documents (volflags: no_sb_md | sb_md)")
--- a/copyparty/version.py
+++ b/copyparty/version.py
@@ -1,8 +1,8 @@
 # coding: utf-8

-VERSION = (1, 9, 1)
+VERSION = (1, 9, 4)
 CODENAME = "prometheable"
-BUILD_DT = (2023, 8, 20)
+BUILD_DT = (2023, 9, 2)

 S_VERSION = ".".join(map(str, VERSION))
 S_BUILD_DT = "{0:04d}-{1:02d}-{2:02d}".format(*BUILD_DT)
--- a/copyparty/authsrv.py
+++ b/copyparty/authsrv.py
@@ -476,7 +476,8 @@ class VFS(object):
                    self.log("vfs", "invalid relpath [{}]".format(vpath))
                raise Pebkac(404)

-        vn, rem = self._find(undot(vpath))
+        cvpath = undot(vpath)
+        vn, rem = self._find(cvpath)
        c: AXS = vn.axs

        for req, d, msg in [
@@ -487,6 +488,11 @@ class VFS(object):
            (will_get, c.uget, "get"),
        ]:
            if req and (uname not in d and "*" not in d) and uname != LEELOO_DALLAS:
+                if self.log and err != 999:
+                    ap = vn.canonical(rem)
+                    t = "{} has no {} in [{}] => [{}] => [{}]"
+                    self.log("vfs", t.format(uname, msg, vpath, cvpath, ap), 6)
+
                t = "you don't have {}-access for this location"
                raise Pebkac(err, t.format(msg))

@@ -1669,7 +1675,7 @@ class AuthSrv(object):
                self.log(t.format(zv.realpath), c=1)

        try:
-            zv, _ = vfs.get("/", "*", False, True)
+            zv, _ = vfs.get("/", "*", False, True, err=999)
            if self.warn_anonwrite and os.getcwd() == zv.realpath:
                t = "anyone can write to the current directory: {}\n"
                self.log(t.format(zv.realpath), c=1)
--- a/copyparty/ftpd.py
+++ b/copyparty/ftpd.py
@@ -9,12 +9,19 @@ import stat
 import sys
 import time

+from .__init__ import ANYWIN, PY2, TYPE_CHECKING, E
+
+try:
+    import asynchat
+except:
+    sys.path.append(os.path.join(E.mod, "vend"))
+
 from pyftpdlib.authorizers import AuthenticationFailed, DummyAuthorizer
 from pyftpdlib.filesystems import AbstractedFS, FilesystemError
 from pyftpdlib.handlers import FTPHandler
+from pyftpdlib.ioloop import IOLoop
 from pyftpdlib.servers import FTPServer

-from .__init__ import ANYWIN, PY2, TYPE_CHECKING, E
 from .authsrv import VFS
 from .bos import bos
 from .util import (
@@ -30,15 +37,6 @@ from .util import (
    vjoin,
 )

-try:
-    from pyftpdlib.ioloop import IOLoop
-except ImportError:
-    p = os.path.join(E.mod, "vend")
-    print("loading asynchat from " + p)
-    sys.path.append(p)
-    from pyftpdlib.ioloop import IOLoop
-
-
 if TYPE_CHECKING:
    from .svchub import SvcHub

--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
@@ -333,10 +333,12 @@ class HttpCli(object):
        # split req into vpath + uparam
        uparam = {}
        if "?" not in self.req:
-            self.trailing_slash = self.req.endswith("/")
-            vpath = undot(self.req)
+            vpath = unquotep(self.req)  # not query, so + means +
+            self.trailing_slash = vpath.endswith("/")
+            vpath = undot(vpath)
        else:
            vpath, arglist = self.req.split("?", 1)
+            vpath = unquotep(vpath)
            self.trailing_slash = vpath.endswith("/")
            vpath = undot(vpath)

@@ -351,6 +353,8 @@ class HttpCli(object):
            for k in arglist.split("&"):
                if "=" in k:
                    k, zs = k.split("=", 1)
+                    # x-www-form-urlencoded (url query part) uses
+                    # either + or %20 for 0x20 so handle both
                    uparam[k.lower()] = unquotep(zs.strip().replace("+", " "))
                else:
                    uparam[k.lower()] = ""
@@ -385,7 +389,7 @@ class HttpCli(object):

        self.uparam = uparam
        self.cookies = cookies
-        self.vpath = unquotep(vpath)  # not query, so + means +
+        self.vpath = vpath
        self.vpaths = (
            self.vpath + "/" if self.trailing_slash and self.vpath else self.vpath
        )
@@ -564,8 +568,8 @@ class HttpCli(object):
            self.out_headers.update(NO_CACHE)
            return

-        n = "604869" if cache == "i" else cache or "69"
-        self.out_headers["Cache-Control"] = "max-age=" + n
+        n = 69 if not cache else 604869 if cache == "i" else int(cache)
+        self.out_headers["Cache-Control"] = "max-age=" + str(n)

    def k304(self) -> bool:
        k304 = self.cookies.get("k304")
@@ -625,9 +629,27 @@ class HttpCli(object):
        headers: Optional[dict[str, str]] = None,
        volsan: bool = False,
    ) -> bytes:
-        if status == 404:
-            g = self.conn.hsrv.g404
-            if g.lim:
+        if status > 400 and status in (403, 404, 422):
+            if status == 404:
+                g = self.conn.hsrv.g404
+            elif status == 403:
+                g = self.conn.hsrv.g403
+            else:
+                g = self.conn.hsrv.g422
+
+            gurl = self.conn.hsrv.gurl
+            if (
+                gurl.lim
+                and (not g.lim or gurl.lim < g.lim)
+                and self.args.sus_urls.search(self.vpath)
+            ):
+                g = self.conn.hsrv.gurl
+
+            if g.lim and (
+                g == self.conn.hsrv.g422
+                or not self.args.nonsus_urls
+                or not self.args.nonsus_urls.search(self.vpath)
+            ):
                bonk, ip = g.bonk(self.ip, self.vpath)
                if bonk:
                    xban = self.vn.flags.get("xban")
@@ -642,14 +664,19 @@ class HttpCli(object):
                        0,
                        self.ip,
                        time.time(),
-                        "404",
+                        str(status),
                    ):
-                        self.log("client banned: 404s", 1)
+                        self.log("client banned: %ss" % (status,), 1)
                        self.conn.hsrv.bans[ip] = bonk

        if volsan:
            vols = list(self.asrv.vfs.all_vols.values())
            body = vol_san(vols, body)
+            try:
+                zs = absreal(__file__).rsplit(os.path.sep, 2)[0]
+                body = body.replace(zs.encode("utf-8"), b"PP")
+            except:
+                pass

        self.send_headers(len(body), status, mime, headers)

@@ -843,14 +870,17 @@ class HttpCli(object):

        if not self.can_read and not self.can_write and not self.can_get:
            t = "@{} has no access to [{}]"
-            self.log(t.format(self.uname, self.vpath))

            if "on403" in self.vn.flags:
+                t += " (on403)"
+                self.log(t.format(self.uname, self.vpath))
                ret = self.on40x(self.vn.flags["on403"], self.vn, self.rem)
                if ret == "true":
                    return True
                elif ret == "false":
                    return False
+                elif ret == "home":
+                    self.uparam["h"] = ""
                elif ret == "allow":
                    self.log("plugin override; access permitted")
                    self.can_read = self.can_write = self.can_move = True
@@ -860,6 +890,10 @@ class HttpCli(object):
                    return self.tx_404(True)
            else:
                if self.vpath:
+                    ptn = self.args.nonsus_urls
+                    if not ptn or not ptn.search(self.vpath):
+                        self.log(t.format(self.uname, self.vpath))
+
                    return self.tx_404(True)

                self.uparam["h"] = ""
@@ -2861,12 +2895,26 @@ class HttpCli(object):
        logmsg = "{:4} {} ".format("", self.req)
        self.keepalive = False

+        cancmp = not self.args.no_tarcmp
+
        if fmt == "tar":
-            mime = "application/x-tar"
            packer: Type[StreamArc] = StreamTar
+            if cancmp and uarg.startswith("gz"):
+                mime = "application/gzip"
+                ext = "tar.gz"
+            elif cancmp and uarg.startswith("bz2"):
+                mime = "application/x-bzip"
+                ext = "tar.bz2"
+            elif cancmp and uarg.startswith("xz"):
+                mime = "application/x-xz"
+                ext = "tar.xz"
+            else:
+                mime = "application/x-tar"
+                ext = "tar"
        else:
            mime = "application/zip"
            packer = StreamZip
+            ext = "zip"

        fn = items[0] if items and items[0] else self.vpath
        if fn:
@@ -2891,7 +2939,7 @@ class HttpCli(object):
        ufn = b"".join(zbl).decode("ascii")

        cdis = "attachment; filename=\"{}.{}\"; filename*=UTF-8''{}.{}"
-        cdis = cdis.format(afn, fmt, ufn, fmt)
+        cdis = cdis.format(afn, ext, ufn, ext)
        self.log(cdis)
        self.send_headers(None, mime=mime, headers={"Content-Disposition": cdis})

@@ -2909,7 +2957,13 @@ class HttpCli(object):
                self.log("transcoding to [{}]".format(cfmt))
                fgen = gfilter(fgen, self.thumbcli, self.uname, vpath, cfmt)

-        bgen = packer(self.log, fgen, utf8="utf" in uarg, pre_crc="crc" in uarg)
+        bgen = packer(
+            self.log,
+            fgen,
+            utf8="utf" in uarg,
+            pre_crc="crc" in uarg,
+            cmp=uarg if cancmp else "",
+        )
        bsent = 0
        for buf in bgen.gen():
            if not buf:
@@ -3256,7 +3310,7 @@ class HttpCli(object):
            dst = ""
        elif top:
            if not dst.startswith(top + "/"):
-                raise Pebkac(400, "arg funk")
+                raise Pebkac(422, "arg funk")

            dst = dst[len(top) + 1 :]

@@ -3278,8 +3332,9 @@ class HttpCli(object):
            sub = self.gen_tree("/".join([top, excl]).strip("/"), target)
            ret["k" + quotep(excl)] = sub

+        vfs = self.asrv.vfs
        try:
-            vn, rem = self.asrv.vfs.get(top, self.uname, True, False)
+            vn, rem = vfs.get(top, self.uname, True, False)
            fsroot, vfs_ls, vfs_virt = vn.ls(
                rem,
                self.uname,
@@ -3292,7 +3347,7 @@ class HttpCli(object):
            for v in self.rvol:
                d1, d2 = v.rsplit("/", 1) if "/" in v else ["", v]
                if d1 == top:
-                    vfs_virt[d2] = self.asrv.vfs  # typechk, value never read
+                    vfs_virt[d2] = vfs  # typechk, value never read

        dirs = []

@@ -3306,6 +3361,11 @@ class HttpCli(object):

        for x in vfs_virt:
            if x != excl:
+                try:
+                    dvn, drem = vfs.get(vjoin(top, x), self.uname, True, False)
+                    bos.stat(dvn.canonical(drem, False))
+                except:
+                    x += "\n"
                dirs.append(x)

        ret["a"] = dirs
@@ -3319,8 +3379,7 @@ class HttpCli(object):
        if not idx or not hasattr(idx, "p_end"):
            raise Pebkac(500, "sqlite3 is not available on the server; cannot unpost")

-        filt = self.uparam.get("filter")
-        filt = unquotep(filt or "")
+        filt = self.uparam.get("filter") or ""
        lm = "ups [{}]".format(filt)
        self.log(lm)

@@ -3418,9 +3477,6 @@ class HttpCli(object):
        if not dst:
            raise Pebkac(400, "need dst vpath")

-        # x-www-form-urlencoded (url query part) uses
-        # either + or %20 for 0x20 so handle both
-        dst = unquotep(dst.replace("+", " "))
        return self._mv(self.vpath, dst.lstrip("/"))

    def _mv(self, vsrc: str, vdst: str) -> bool:
@@ -3800,7 +3856,9 @@ class HttpCli(object):
            pass

        # show dotfiles if permitted and requested
-        if not self.args.ed or "dots" not in self.uparam:
+        if not self.args.ed or (
+            "dots" not in self.uparam and (is_ls or "dots" not in self.cookies)
+        ):
            ls_names = exclude_dotfiles(ls_names)

        add_fk = vn.flags.get("fk")
--- a/copyparty/httpsrv.py
+++ b/copyparty/httpsrv.py
@@ -107,6 +107,9 @@ class HttpSrv(object):
        self.ssdp: Optional["SSDPr"] = None
        self.gpwd = Garda(self.args.ban_pw)
        self.g404 = Garda(self.args.ban_404)
+        self.g403 = Garda(self.args.ban_403)
+        self.g422 = Garda(self.args.ban_422, False)
+        self.gurl = Garda(self.args.ban_url)
        self.bans: dict[str, int] = {}
        self.aclose: dict[str, int] = {}

--- a/copyparty/star.py
+++ b/copyparty/star.py
@@ -44,6 +44,7 @@ class StreamTar(StreamArc):
        self,
        log: "NamedLogger",
        fgen: Generator[dict[str, Any], None, None],
+        cmp: str = "",
        **kwargs: Any
    ):
        super(StreamTar, self).__init__(log, fgen)
@@ -53,10 +54,31 @@ class StreamTar(StreamArc):
        self.qfile = QFile()
        self.errf: dict[str, Any] = {}

+        try:
+            cmp, lv = cmp.replace(":", ",").split(",")
+            lv = int(lv)
+        except:
+            lv = None
+
        # python 3.8 changed to PAX_FORMAT as default,
        # waste of space and don't care about the new features
        fmt = tarfile.GNU_FORMAT
-        self.tar = tarfile.open(fileobj=self.qfile, mode="w|", format=fmt)  # type: ignore
+
+        arg = {"name": None, "fileobj": self.qfile, "mode": "w", "format": fmt}
+        if cmp == "gz":
+            fun = tarfile.TarFile.gzopen
+            arg["compresslevel"] = lv if lv is not None else 3
+        elif cmp == "bz2":
+            fun = tarfile.TarFile.bz2open
+            arg["compresslevel"] = lv if lv is not None else 2
+        elif cmp == "xz":
+            fun = tarfile.TarFile.xzopen
+            arg["preset"] = lv if lv is not None else 1
+        else:
+            fun = tarfile.open
+            arg["mode"] = "w|"
+
+        self.tar = fun(**arg)

        Daemon(self._gen, "star-gen")

--- a/copyparty/svchub.py
+++ b/copyparty/svchub.py
@@ -100,11 +100,6 @@ class SvcHub(object):

        self.iphash = HMaccas(os.path.join(self.E.cfg, "iphash"), 8)

-        # for non-http clients (ftp)
-        self.bans: dict[str, int] = {}
-        self.gpwd = Garda(self.args.ban_pw)
-        self.g404 = Garda(self.args.ban_404)
-
        if args.sss or args.s >= 3:
            args.ss = True
            args.no_dav = True
@@ -121,6 +116,7 @@ class SvcHub(object):
            args.hardlink = True
            args.vague_403 = True
            args.ban_404 = "50,60,1440"
+            args.turbo = -1
            args.nih = True

        if args.s:
@@ -133,6 +129,14 @@ class SvcHub(object):
        if not self._process_config():
            raise Exception(BAD_CFG)

+        # for non-http clients (ftp)
+        self.bans: dict[str, int] = {}
+        self.gpwd = Garda(self.args.ban_pw)
+        self.g404 = Garda(self.args.ban_404)
+        self.g403 = Garda(self.args.ban_403)
+        self.g422 = Garda(self.args.ban_422)
+        self.gurl = Garda(self.args.ban_url)
+
        self.log_div = 10 ** (6 - args.log_tdec)
        self.log_efmt = "%02d:%02d:%02d.%0{}d".format(args.log_tdec)
        self.log_dfmt = "%04d-%04d-%06d.%0{}d".format(args.log_tdec)
@@ -399,6 +403,18 @@ class SvcHub(object):
            if vs and vs.startswith("~"):
                setattr(al, k, os.path.expanduser(vs))

+        for k in "sus_urls nonsus_urls".split(" "):
+            vs = getattr(al, k)
+            if not vs or vs == "no":
+                setattr(al, k, None)
+            else:
+                setattr(al, k, re.compile(vs))
+
+        if not al.sus_urls:
+            al.ban_url = "no"
+        elif al.ban_url == "no":
+            al.sus_urls = None
+
        return True

    def _setlimits(self) -> None:
--- a/copyparty/szip.py
+++ b/copyparty/szip.py
@@ -221,6 +221,7 @@ class StreamZip(StreamArc):
        fgen: Generator[dict[str, Any], None, None],
        utf8: bool = False,
        pre_crc: bool = False,
+        **kwargs: Any
    ) -> None:
        super(StreamZip, self).__init__(log, fgen)

--- a/copyparty/up2k.py
+++ b/copyparty/up2k.py
@@ -867,8 +867,11 @@ class Up2k(object):
        if not HAVE_SQLITE3 or "e2d" not in flags or "d2d" in flags:
            return None

-        if bos.makedirs(histpath):
-            hidedir(histpath)
+        try:
+            if bos.makedirs(histpath):
+                hidedir(histpath)
+        except:
+            return None

        try:
            cur = self._open_db(db_path)
@@ -1047,7 +1050,7 @@ class Up2k(object):
        if WINDOWS:
            rd = rd.replace("\\", "/").strip("/")

-        g = statdir(self.log_func, not self.args.no_scandir, False, cdir)
+        g = statdir(self.log_func, not self.args.no_scandir, True, cdir)
        gl = sorted(g)
        partials = set([x[0] for x in gl if "PARTIAL" in x[0]])
        for iname, inf in gl:
@@ -1062,6 +1065,12 @@ class Up2k(object):
                continue

            lmod = int(inf.st_mtime)
+            if stat.S_ISLNK(inf.st_mode):
+                try:
+                    inf = bos.stat(abspath)
+                except:
+                    continue
+
            sz = inf.st_size
            if fat32 and not ffat and inf.st_mtime % 2:
                fat32 = False
@@ -1442,9 +1451,11 @@ class Up2k(object):
                pf = "v{}, {:.0f}+".format(n_left, b_left / 1024 / 1024)
                self.pp.msg = pf + abspath

-                st = bos.stat(abspath)
+                # throws on broken symlinks (always did)
+                stl = bos.lstat(abspath)
+                st = bos.stat(abspath) if stat.S_ISLNK(stl.st_mode) else stl
+                mt2 = int(stl.st_mtime)
                sz2 = st.st_size
-                mt2 = int(st.st_mtime)

                if nohash or not sz2:
                    w2 = up2k_wark_from_metadata(self.salt, sz2, mt2, rd, fn)
@@ -1466,6 +1477,13 @@ class Up2k(object):
                if w == w2:
                    continue

+                # symlink mtime was inconsistent before v1.9.4; check if that's it
+                if st != stl and (nohash or not sz2):
+                    mt2b = int(st.st_mtime)
+                    w2b = up2k_wark_from_metadata(self.salt, sz2, mt2b, rd, fn)
+                    if w == w2b:
+                        continue
+
                rewark.append((drd, dfn, w2, sz2, mt2))

                t = "hash mismatch: {}\n  db: {} ({} byte, {})\n  fs: {} ({} byte, {})"
--- a/copyparty/util.py
+++ b/copyparty/util.py
@@ -926,7 +926,8 @@ class Magician(object):
 class Garda(object):
    """ban clients for repeated offenses"""

-    def __init__(self, cfg: str) -> None:
+    def __init__(self, cfg: str, uniq: bool = True) -> None:
+        self.uniq = uniq
        try:
            a, b, c = cfg.strip().split(",")
            self.lim = int(a)
@@ -972,7 +973,7 @@ class Garda(object):
            # assume /64 clients; drop 4 groups
            ip = IPv6Address(ip).exploded[:-20]

-        if prev:
+        if prev and self.uniq:
            if self.prev.get(ip) == prev:
                return 0, ip

@@ -1447,7 +1448,7 @@ class MultipartParser(object):
        for buf in iterable:
            ret += buf
            if len(ret) > max_len:
-                raise Pebkac(400, "field length is too long")
+                raise Pebkac(422, "field length is too long")

        return ret

--- a/copyparty/web/browser.css
+++ b/copyparty/web/browser.css
@@ -860,7 +860,7 @@ html.y #path a:hover {
 }
 .mdo,
 .mdo * {
-	line-height: 1.4em;
+	line-height: 1.5em;
 }
 #srv_info,
 #srv_info2,
@@ -1620,6 +1620,12 @@ html.cz .tgl.btn.on {
 	list-style: none;
 	border-top: 1px solid var(--bg-u5);
 }
+#tree li.offline>a:first-child:before {
+	content: '❌';
+	position: absolute;
+	margin-left: -.25em;
+	z-index: 3;
+}
 #tree ul a.sel {
 	background: #000;
 	background: var(--bg-d3);
--- a/copyparty/web/browser.html
+++ b/copyparty/web/browser.html
@@ -29,7 +29,7 @@

 	<div id="op_player" class="opview opbox opwide"></div>

-	<div id="op_bup" class="opview opbox act">
+	<div id="op_bup" class="opview opbox {% if not ls0 %}act{% endif %}">
 		<div id="u2err"></div>
 		<form method="post" enctype="multipart/form-data" accept-charset="utf-8" action="{{ url_suf }}">
 			<input type="hidden" name="act" value="bput" />
@@ -39,7 +39,7 @@
 		<a id="bbsw" href="?b=u" rel="nofollow"><br />switch to basic browser</a>
 	</div>

-	<div id="op_mkdir" class="opview opbox act">
+	<div id="op_mkdir" class="opview opbox {% if not ls0 %}act{% endif %}">
 		<form method="post" enctype="multipart/form-data" accept-charset="utf-8" action="{{ url_suf }}">
 			<input type="hidden" name="act" value="mkdir" />
 			📂<input type="text" name="name" class="i" placeholder="awesome mix vol.1">
@@ -55,7 +55,7 @@
 		</form>
 	</div>

-	<div id="op_msg" class="opview opbox act">
+	<div id="op_msg" class="opview opbox {% if not ls0 %}act{% endif %}">
 		<form method="post" enctype="application/x-www-form-urlencoded" accept-charset="utf-8" action="{{ url_suf }}">
 			📟<input type="text" name="msg" class="i" placeholder="lorem ipsum dolor sit amet">
 			<input type="submit" value="send msg to srv log">
--- a/copyparty/web/browser.js
+++ b/copyparty/web/browser.js
@@ -262,7 +262,8 @@ var Ls = {
 		"mm_e403": "Could not play audio; error 403: Access denied.\n\nTry pressing F5 to reload, maybe you got logged out",
 		"mm_e5xx": "Could not play audio; server error ",
 		"mm_nof": "not finding any more audio files nearby",
-		"mm_pwrsv": "<p>it looks like playback is being interrupted by your phone's power-saving settings!</p>" + '<p>please go to <a target="_blank" href="https://user-images.githubusercontent.com/241032/235262121-2ffc51ae-7821-4310-a322-c3b7a507890c.png">the app settings of your browser</a> and then <a target="_blank" href="https://user-images.githubusercontent.com/241032/235262123-c328cca9-3930-4948-bd18-3949b9fd3fcf.png">allow unrestricted battery usage</a> to fix it.</p><p>(probably a good idea to use a separate browser dedicated for just music streaming...)</p>',
+		"mm_pwrsv": "<p>it looks like playback is being interrupted by your phone's power-saving settings!</p>" + '<p>please go to <a target="_blank" href="https://user-images.githubusercontent.com/241032/235262121-2ffc51ae-7821-4310-a322-c3b7a507890c.png">the app settings of your browser</a> and then <a target="_blank" href="https://user-images.githubusercontent.com/241032/235262123-c328cca9-3930-4948-bd18-3949b9fd3fcf.png">allow unrestricted battery usage</a> to fix it.</p><p><em>however,</em> it could also be due to the browser\'s autoplay settings;</p><p>Firefox: tap the icon on the left side of the address bar, then select "autoplay" and "allow audio"</p><p>Chrome: the problem will gradually dissipate as you play more music on this site</p>',
+		"mm_iosblk": "<p>your web browser thinks the audio playback is unwanted, and it decided to block playback until you start another track manually... unfortunately we are both powerless in telling it otherwise</p><p>supposedly this will get better as you continue playing music on this site, but I'm unfamiliar with apple devices so idk if that's true</p><p>you could try another browser, maybe firefox or chrome?</p>",
 		"mm_hnf": "that song no longer exists",

 		"im_hnf": "that image no longer exists",
@@ -374,7 +375,9 @@ var Ls = {
 		"fu_xe1": "failed to load unpost list from server:\n\nerror ",
 		"fu_xe2": "404: File not found??",

-		"fz_tar": "plain gnutar file (linux / mac)",
+		"fz_tar": "plain gnu-tar file (linux / mac)",
+		"fz_targz": "tar with gzip level 3 compression$N$Nthis is usually very slow, so$Nuse uncompressed tar instead",
+		"fz_tarxz": "tar with xz level 1 compression$N$Nthis is usually very slow, so$Nuse uncompressed tar instead",
 		"fz_zip8": "zip with utf8 filenames (maybe wonky on windows 7 and older)",
 		"fz_zipd": "zip with traditional cp437 filenames, for really old software",
 		"fz_zipc": "cp437 with crc32 computed early,$Nfor MS-DOS PKZIP v2.04g (october 1993)$N(takes longer to process before download can start)",
@@ -725,7 +728,8 @@ var Ls = {
 		"mm_e403": "Avspilling feilet: Tilgang nektet.\n\nKanskje du ble logget ut?\nPrøv å trykk F5 for å laste siden på nytt.",
 		"mm_e5xx": "Avspilling feilet: ",
 		"mm_nof": "finner ikke flere sanger i nærheten",
-		"mm_pwrsv": "<p>det ser ut som musikken ble avbrutt av telefonen sine strømsparings-innstillinger!</p>" + '<p>ta en tur innom <a target="_blank" href="https://user-images.githubusercontent.com/241032/235262121-2ffc51ae-7821-4310-a322-c3b7a507890c.png">app-innstillingene til nettleseren din</a> og så <a target="_blank" href="https://user-images.githubusercontent.com/241032/235262123-c328cca9-3930-4948-bd18-3949b9fd3fcf.png">tillat ubegrenset batteriforbruk</a></p><p>(sikkert smart å ha en egen nettleser kun for musikkspilling...)</p>',
+		"mm_pwrsv": "<p>det ser ut som musikken ble avbrutt av telefonen sine strømsparings-innstillinger!</p>" + '<p>ta en tur innom <a target="_blank" href="https://user-images.githubusercontent.com/241032/235262121-2ffc51ae-7821-4310-a322-c3b7a507890c.png">app-innstillingene til nettleseren din</a> og så <a target="_blank" href="https://user-images.githubusercontent.com/241032/235262123-c328cca9-3930-4948-bd18-3949b9fd3fcf.png">tillat ubegrenset batteriforbruk</a></p><p>NB: det kan også være pga. autoplay-innstillingene, så prøv dette:</p><p>Firefox: klikk på ikonet i venstre side av addressefeltet, velg "autoplay" og "tillat lyd"</p><p>Chrome: problemet vil minske gradvis jo mer musikk du spiller på denne siden</p>',
+		"mm_iosblk": "<p>nettleseren din tror at musikken er uønsket, og den bestemte seg for å stoppe avspillingen slik at du manuelt må velge en ny sang... dessverre er både du og jeg maktesløse når den har bestemt seg.</p><p>det ryktes at problemet vil minske jo mer musikk du spiller på denne siden, men jeg er ikke godt kjent med apple-dingser så jeg er ikke sikker.</p><p>kanskje firefox eller chrome fungerer bedre?</p>",
 		"mm_hnf": "sangen finnes ikke lenger",

 		"im_hnf": "bildet finnes ikke lenger",
@@ -838,6 +842,8 @@ var Ls = {
 		"fu_xe2": "404: Filen finnes ikke??",

 		"fz_tar": "ukomprimert gnu-tar arkiv, for linux og mac",
+		"fz_targz": "gnu-tar pakket med gzip (nivå 3)$N$NNB: denne er veldig treg;$Nukomprimert tar er bedre",
+		"fz_tarxz": "gnu-tar pakket med xz (nivå 1)$N$NNB: denne er veldig treg;$Nukomprimert tar er bedre",
 		"fz_zip8": "zip med filnavn i utf8 (noe problematisk på windows 7 og eldre)",
 		"fz_zipd": "zip med filnavn i cp437, for høggamle maskiner",
 		"fz_zipc": "cp437 med tidlig crc32,$Nfor MS-DOS PKZIP v2.04g (oktober 1993)$N(øker behandlingstid på server)",
@@ -1299,7 +1305,8 @@ function set_files_html(html) {
 }


-var ACtx = window.AudioContext || window.webkitAudioContext,
+// actx breaks background album playback on ios
+var ACtx = !IPHONE && (window.AudioContext || window.webkitAudioContext),
 	noih = /[?&]v\b/.exec('' + location),
 	hash0 = location.hash,
 	mp;
@@ -2184,6 +2191,7 @@ function song_skip(n, dirskip) {

 	if (dirskip && ofs + 1 && ofs > mp.order.length - 2) {
 		toast.inf(10, L.mm_nof);
+		console.log("mm_nof1");
 		mpl.traversals = 0;
 		return;
 	}
@@ -2210,13 +2218,14 @@ function next_song_cmn(e) {
 	}
 	if (mpl.traversals++ < 5) {
 		if (MOBILE && t_fchg && Date.now() - t_fchg > 30 * 1000)
-			modal.alert(L.mm_pwrsv);
+			modal.alert(IPHONE ? L.mm_iosblk : L.mm_pwrsv);

 		t_fchg = document.hasFocus() ? 0 : Date.now();
 		treectl.ls_cb = next_song_cmn;
 		return tree_neigh(1);
 	}
 	toast.inf(10, L.mm_nof);
+	console.log("mm_nof2");
 	mpl.traversals = 0;
 	t_fchg = 0;
 }
@@ -2366,7 +2375,7 @@ var mpui = (function () {
 			// cannot check document.hasFocus to avoid false positives;
 			// it continues on power-on, doesn't need to be in-browser
 			if (MOBILE && Date.now() - t_fchg > 30 * 1000)
-				modal.alert(L.mm_pwrsv);
+				modal.alert(IPHONE ? L.mm_iosblk : L.mm_pwrsv);

 			t_fchg = 0;
 		}
@@ -2932,6 +2941,7 @@ function evau_error(e) {
 		err = e404;

 	toast.warn(15, esc(basenames(err + mfile)));
+	console.log(basenames(err + mfile));

 	if (em.startsWith('MEDIA_ELEMENT_ERROR:')) {
 		// chromish for 40x
@@ -3043,7 +3053,7 @@ function eval_hash() {
 		goto('search');
 		var i = ebi('q_raw');
 		i.value = uricom_dec(v.slice(3));
-		return i.oninput();
+		return i.onkeydown({ 'key': 'Enter' });
 	}

 	if (v.indexOf('#v=') === 0) {
@@ -4623,7 +4633,11 @@ function tree_neigh(n) {
 	if (act >= links.length)
 		act = 0;

-	treectl.treego.call(links[act]);
+	if (showfile.active())
+		links[act].click();
+	else
+		treectl.treego.call(links[act]);
+
 	links[act].focus();
 }

@@ -4675,6 +4689,7 @@ function hkhelp() {
 }


+var fselgen, fselctr;
 document.onkeydown = function (e) {
 	if (e.altKey || e.isComposing)
 		return;
@@ -4719,15 +4734,26 @@ document.onkeydown = function (e) {
 	}

 	if (aet == 'tr' && ae.closest('#files')) {
-		var d = '';
+		var d = '', rem = 0;
 		if (k == 'ArrowUp') d = 'previous';
 		if (k == 'ArrowDown') d = 'next';
+		if (k == 'PageUp') { d = 'previous'; rem = 0.6; }
+		if (k == 'PageDown') { d = 'next'; rem = 0.6; }
 		if (d) {
-			var el = ae[d + 'ElementSibling'];
-			if (el) {
+			fselctr = 0;
+			var gen = fselgen = Date.now();
+			if (rem)
+				rem *= window.innerHeight;
+
+			function selfun() {
+				var el = ae[d + 'ElementSibling'];
+				if (!el || gen != fselgen)
+					return;
+
 				el.focus();
+				var elh = el.offsetHeight;
 				if (ctrl(e))
-					document.documentElement.scrollTop += (d == 'next' ? 1 : -1) * el.offsetHeight;
+					document.documentElement.scrollTop += (d == 'next' ? 1 : -1) * elh;

 				if (e.shiftKey) {
 					clmod(el, 'sel', 't');
@@ -4735,8 +4761,17 @@ document.onkeydown = function (e) {
 					msel.selui();
 				}

-				return ev(e);
+				rem -= elh;
+				if (rem > 0) {
+					ae = document.activeElement;
+					if (++fselctr % 5 && rem > elh * (FIREFOX ? 5 : 2))
+						selfun();
+					else
+						setTimeout(selfun, 1);
+				}
 			}
+			selfun();
+			return ev(e);
 		}
 		if (k == 'Space') {
 			clmod(ae, 'sel', 't');
@@ -4937,7 +4972,7 @@ document.onkeydown = function (e) {
 		search_in_progress = 0;

 	function ev_search_input() {
-		var v = this.value,
+		var v = unsmart(this.value),
 			id = this.getAttribute('id');

 		if (id.slice(-1) == 'v') {
@@ -4974,7 +5009,7 @@ document.onkeydown = function (e) {
 		if (search_in_progress)
 			return;

-		var q = ebi('q_raw').value,
+		var q = unsmart(ebi('q_raw').value),
 			vq = ebi('files').getAttribute('q_raw');

 		srch_msg(false, (q == vq) ? '' : L.sm_prev + (vq ? vq : '(*)'));
@@ -4986,7 +5021,7 @@ document.onkeydown = function (e) {
 			for (var b = 1; b < sconf[a].length; b++) {
 				var k = sconf[a][b][0],
 					chk = 'srch_' + k + 'c',
-					vs = ebi('srch_' + k + 'v').value,
+					vs = unsmart(ebi('srch_' + k + 'v').value),
 					tvs = [];

 				if (a == 1)
@@ -5079,7 +5114,7 @@ document.onkeydown = function (e) {
 		xhr.setRequestHeader('Content-Type', 'text/plain');
 		xhr.onload = xhr.onerror = xhr_search_results;
 		xhr.ts = Date.now();
-		xhr.q_raw = ebi('q_raw').value;
+		xhr.q_raw = unsmart(ebi('q_raw').value);
 		xhr.send(JSON.stringify({ "q": xhr.q_raw, "n": cap }));
 	}

@@ -5248,6 +5283,9 @@ var treectl = (function () {
 	bcfg_bind(r, 'csel', 'csel', false);
 	bcfg_bind(r, 'dots', 'dotfiles', false, function (v) {
 		r.goto(get_evpath());
+		var xhr = new XHR();
+		xhr.open('GET', SR + '/?setck=dots=' + (v ? 'y' : ''), true);
+		xhr.send();
 	});
 	bcfg_bind(r, 'dir1st', 'dir1st', true, function (v) {
 		treectl.gentab(get_evpath(), treectl.lsc);
@@ -5772,9 +5810,15 @@ var treectl = (function () {
 		var nodes = res.dirs.concat(res.files),
 			html = mk_files_header(res.taglist),
 			sel = r.lsc === res ? msel.getsel() : [],
+			ae = document.activeElement,
+			cid = null,
 			plain = [],
 			seen = {};

+		if (ae && /^tr$/i.exec(ae.nodeName))
+			if (ae = ae.querySelector('a[id]'))
+				cid = ae.getAttribute('id');
+
 		r.lsc = res;
 		if (res.unlist) {
 			var ptn = new RegExp(res.unlist);
@@ -5874,6 +5918,10 @@ var treectl = (function () {
 			else
 				msel.origin_id(null);

+			if (cid) try {
+				ebi(cid).closest('tr').focus();
+			} catch (ex) { }
+
 			setTimeout(eval_hash, 1);
 		}

@@ -5990,7 +6038,8 @@ var treectl = (function () {
 		for (var a = 0; a < keys.length; a++) {
 			var kk = keys[a],
 				ks = kk.slice(1),
-				k = uricom_sdec(ks),
+				ded = ks.endsWith('\n'),
+				k = uricom_sdec(ded ? ks.replace(/\n$/, '') : ks),
 				hek = esc(k[0]),
 				uek = k[1] ? uricom_enc(k[0], true) : k[0],
 				url = '/' + (top ? top + uek : uek) + '/',
@@ -6003,7 +6052,7 @@ var treectl = (function () {
 				ret += '<li>' + link + '\n<ul>\n' + subtree + '</ul></li>\n';
 			}
 			else {
-				ret += '<li>' + link + '</li>\n';
+				ret += (ded ? '<li class="offline">' : '<li>') + link + '</li>\n';
 			}
 		}
 		return ret;
@@ -6627,6 +6676,8 @@ var arcfmt = (function () {
 	var html = [],
 		fmts = [
 			["tar", "tar", L.fz_tar],
+			["tgz", "tar=gz", L.fz_targz],
+			["txz", "tar=xz", L.fz_tarxz],
 			["zip", "zip=utf8", L.fz_zip8],
 			["zip_dos", "zip", L.fz_zipd],
 			["zip_crc", "zip=crc", L.fz_zipc]
@@ -6656,7 +6707,7 @@ var arcfmt = (function () {

 		for (var a = 0, aa = tds.length; a < aa; a++) {
 			var o = tds[a], txt = o.textContent, href = o.getAttribute('href');
-			if (txt != 'tar' && txt != 'zip')
+			if (!/^(zip|tar|tgz|txz)$/.exec(txt))
 				continue;

 			var ofs = href.lastIndexOf('?');
@@ -7085,7 +7136,12 @@ function show_md(md, name, div, url, depth) {

 	try {
 		clmod(div, 'mdo', 1);
-		if (sandbox(div, sb_md, 'mdo', marked.parse(md, marked_opts)))
+
+		var md_html = marked.parse(md, marked_opts);
+		if (!have_emp)
+			md_html = DOMPurify.sanitize(md_html);
+
+		if (sandbox(div, sb_md, 'mdo', md_html))
 			return;

 		ext = md_plug.post;
@@ -7179,7 +7235,7 @@ function sandbox(tgt, rules, cls, html) {
 		'function say(m){window.parent.postMessage(m,"*")};' +
 		'setTimeout(function(){var its=0,pih=-1,f=function(){' +
 		'var ih=2+Math.min(parseInt(getComputedStyle(d).height),d.scrollHeight);' +
-		'if(ih!=pih){pih=ih;say("iheight #' + tid + ' "+ih,"*")}' +
+		'if(ih!=pih&&!isNaN(ih)){pih=ih;say("iheight #' + tid + ' "+ih,"*")}' +
 		'if(++its<20)return setTimeout(f,20);if(its==20)setInterval(f,200)' +
 		'};f();' +
 		'window.onfocus=function(){say("igot #' + tid + '")};' +
--- a/copyparty/web/md.js
+++ b/copyparty/web/md.js
@@ -212,6 +212,8 @@ function convert_markdown(md_text, dest_dom) {

    try {
        var md_html = marked.parse(md_text, marked_opts);
+        if (!have_emp)
+            md_html = DOMPurify.sanitize(md_html);
    }
    catch (ex) {
        if (ext)
--- a/copyparty/web/up2k.js
+++ b/copyparty/web/up2k.js
@@ -2698,6 +2698,11 @@ function up2k_init(subtle) {
    }

    function draw_turbo() {
+        if (turbolvl < 0 && uc.turbo) {
+            bcfg_set('u2turbo', uc.turbo = false);
+            toast.err(10, "turbo is disabled in server config");
+        }
+
        var msg = (turbolvl || !uc.turbo) ? null : uc.fsearch ? L.u_ts : L.u_tu,
            html = ebi('u2foot').innerHTML;

--- a/copyparty/web/util.js
+++ b/copyparty/web/util.js
@@ -369,6 +369,15 @@ function import_js(url, cb) {
 }


+function unsmart(txt) {
+    return !IPHONE ? txt : (txt.
+        replace(/[\u2014]/g, "--").
+        replace(/[\u2022]/g, "*").
+        replace(/[\u2018\u2019]/g, "'").
+        replace(/[\u201c\u201d]/g, '"'));
+}
+
+
 var crctab = (function () {
    var c, tab = [];
    for (var n = 0; n < 256; n++) {
@@ -1117,6 +1126,8 @@ var timer = (function () {
    var r = {};
    r.q = [];
    r.last = 0;
+    r.fs = 0;
+    r.fc = 0;

    r.add = function (fun, run) {
        r.rm(fun);
@@ -1142,6 +1153,7 @@ var timer = (function () {
            q[a]();

        r.last = Date.now();
+        //r.fc++; if (r.last - r.fs >= 2000) { console.log(r.last - r.fs, r.fc); r.fs = r.last; r.fc = 0; }
    }
    setInterval(doevents, 100);

@@ -1598,7 +1610,7 @@ function repl_load() {
            ret = [
                'var v=Object.keys(localStorage); v.sort(); JSON.stringify(v)',
                "for (var a of QSA('#files a[id]')) a.setAttribute('download','')",
-                'console.hist.slice(-10).join("\\n")'
+                'console.hist.slice(-50).join("\\n")'
            ];

        ipre.innerHTML = '<option value=""></option>';
@@ -1654,6 +1666,8 @@ function repl(e) {
        if (!cmd)
            return toast.inf(3, 'eval aborted');

+        cmd = unsmart(cmd);
+
        if (cmd.startsWith(',')) {
            evalex_fatal = true;
            return modal.alert(esc(eval(cmd.slice(1)) + ''));
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -1,3 +1,97 @@
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2023-0831-2211  `v1.9.3`  iOS and http fixes
+
+## new features
+* iPhones and iPads are now able to...
+  * 9986136dfb2364edb35aa9fbb87410641c6d6af3 play entire albums while the screen is off without the music randomly stopping
+    * apple keeps breaking AudioContext in new and interesting ways; time to give up (no more equalizer)
+  * 1c0d978979a703edeb792e552b18d3b7695b2d90 perform search queries and execude js code
+    * by translating [smart-quotes](https://stackoverflow.com/questions/48678359/ios-11-safari-html-disable-smart-punctuation) into regular `'` and `"` characters
+* python 3.12 support
+  * technically a bugfix since it was added [a year ago](https://github.com/9001/copyparty/commit/32e22dfe84d5e0b13914b4d0e15c1b8c9725a76d) way before the first py3.12 alpha was released but turns out i botched it, oh well
+* filter error messages so they never include the filesystem path where copyparty's python files reside
+* print more context in server logs if someone hits an unexpected permission-denied
+
+# bugfixes
+found some iffy stuff combing over the code but, as far as I can tell, luckily none of these were dangerous:
+* URL normalization was a bit funky, but it appears everything access-control-related was unaffected
+* some url parameters were double-decoded, causing the unpost filtering and file renaming to fail if the values contained `%`
+* clients could cause the server to return an invalid cache-control header, but newlines and control-characters got rejected correctly
+* minor cosmetics / qol fixes:
+  * reduced flickering on page load in chrome
+  * fixed some console spam in search results
+  * markdown documents now have the same line-height in directory listings and the editor
+
+
+
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2023-0826-2116  `v1.9.2`  bigger hammer
+
+## new features
+* more ways to automatically ban users! three new sensors, all default-enabled, giving a 1 day ban after 9 hits in 2 minutes:
+  * `--ban-403`: trying to access volumes that dont exist or require authentication
+  * `--ban-422`: invalid POST messages (from brutefocing POST parameters and such)
+  * `--ban-url`: URLs which 404 and also match `--sus-urls` (scanners/crawlers)
+  * if you want to run a vulnerability scan on copyparty, please just [download the server](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py) and do it locally! takes less than 30 seconds to set up, you get lower latency, and you won't be filling up the logfiles on the demo server with junk, thank you 🙏
+* more ban-related stuff,
+  * new global option `--nonsus-urls` specifies regex of URLs which are OK to 404 and shouldn't ban people
+  * `--turbo` now accepts the value `-1` which makes it impossible for clients to enable it, making `--ban-404` safe to use
+* range-selecting files in the list-view by shift-pgup/pgdn
+* volumes which are currently unavailable (dead nfs share, external HDD which is off, ...) are marked with a ❌ in the directory tree sidebar
+* the toggle-button to see dotfiles is now persisted as a cookie so it also applies on the initial page load
+* more effort is made to prevent `<script>`s inside markdown documents from running in the markdown editor and the fullpage viewer
+  * anyone who wanted to use markdown files for malicious stuff can still just upload an html file instead, so this doesn't make anything more secure, just less confusing
+  * the safest approach is still the `nohtml` volflag which disables markdown rendering outside sandboxes entirely, or only giving out write-access to trustworthy people
+  * enabling markdown plugins with `-emp` now has the side-effect of cancelling this band-aid too
+
+## bugfixes
+* textfile navigation hotkeys broke in the previous version
+
+## other changes
+* example [nginx config](https://github.com/9001/copyparty/blob/hovudstraum/contrib/nginx/copyparty.conf) was not compatible with cloudflare (suggest `$http_cf_connecting_ip` instead of `$proxy_add_x_forwarded_for`)
+* `copyparty.exe` is now built with python 3.11.5 which fixes [CVE-2023-40217](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40217)
+  * `copyparty32.exe` is not, because python understandably ended win7 support 
+* [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md):
+  * copyparty appears to be 30x faster than nextcloud and seafile at receiving uploads of many small files
+  * seafile has a size limit when zip-downloading folders
+
+
+
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2023-0820-2338  `v1.9.1`  prometheable
+
+## new features
+* #49 prometheus / grafana / openmetrics integration ([see readme](https://github.com/9001/copyparty#prometheus))
+  * read metrics from http://127.0.0.1:3923/.cpr/metrics after enabling with `--stats`
+* download a folder with all music transcoded to opus by adding `?tar=opus` or `?zip&opus` to the URL
+  * can also be used to download thumbnails instead of full images; `?tar=w` for webp, `?tar=j` for jpg
+    * so i guess the long-time requested feature of pre-generating thumbnails kind of happened after all, if you schedule a `curl http://127.0.0.1:3923/?tar=w >/dev/null` after server startup
+* u2c (commandline uploader): argument `-x` to exclude files by regex (compares absolute filesystem paths)
+* `--zm-spam 30` can be used to improve zeroconf / mDNS reliability on crazy networks
+  * only necessary if there are clients with multiple IPs and some of the IPs are outside the subnets that copyparty are in -- not spec-compliant, not really recommended, but shouldn't cause any issues either
+  * and `--mc-hop` wasn't actually implemented until now
+* dragging an image from another browser window onto the upload button is now possible
+  * only works on chrome, and only on windows or linux (not macos)
+* server hostname is prefixed in all window titles
+  * can be adjusted with `--bname` (the file explorer) and `--doctitle` (all other documents)
+  * can be disabled with `--nth` (just window title) or `--nih` (title + header)
+
+## bugfixes
+* docker: the autogenerated seeds for filekeys and account passwords now get persisted to the config volume (thx noktuas)
+* uploading files with fancy filenames could fail if the copyparty server is running on android
+* improve workarounds for some apple/iphone/ios jank (thx noktuas and spiky)
+  * some ui elements had their font-size selected by fair dice roll
+  * the volume control does nothing because [apple disabled it](https://developer.apple.com/library/archive/documentation/AudioVideo/Conceptual/Using_HTML5_Audio_Video/Device-SpecificConsiderations/Device-SpecificConsiderations.html#//apple_ref/doc/uid/TP40009523-CH5-SW11), so add a warning
+  * the image gallery cannot be fullscreened [as apple intended](https://developer.mozilla.org/en-US/docs/Web/API/Element/requestFullscreen#browser_compatibility) so add a warning
+
+## other changes
+* file table columns are now limited to browser window width
+* readme: mention that nginx-QUIC is currently very slow (thx noktuas)
+* #50 add a safeguard to the wget plugin in case wget at some point adds support for `file://` or similar
+* show a suggestion on startup to enable the database
+
+
+
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
 # 2023-0725-1550  `v1.8.8`  just boring bugfixes

--- a/docs/versus.md
+++ b/docs/versus.md
@@ -148,7 +148,7 @@ symbol legend,

 | feature / software      | a | b | c | d | e | f | g | h | i | j | k | l |
 | ----------------------- | - | - | - | - | - | - | - | - | - | - | - | - |
-| download folder as zip  | █ | █ | █ | █ | █ |   | █ |   | █ | █ | ╱ | █ |
+| download folder as zip  | █ | █ | █ | █ | ╱ |   | █ |   | █ | █ | ╱ | █ |
 | download folder as tar  | █ |   |   |   |   |   |   |   |   | █ |   |   |
 | upload                  | █ | █ | █ | █ | █ | █ | █ | █ | █ | █ | █ | █ |
 | parallel uploads        | █ |   |   | █ | █ |   | • |   | █ |   | █ |   |
@@ -183,6 +183,7 @@ symbol legend,
 * `cloud storage backend` = able to serve files from (and write to) s3 or similar cloud services; `╱` means the software can do this with some help from `rclone mount` as a bridge

 * `a`/copyparty can reject uploaded files (based on complex conditions), for example [by extension](https://github.com/9001/copyparty/blob/hovudstraum/bin/hooks/reject-extension.py) or [mimetype](https://github.com/9001/copyparty/blob/hovudstraum/bin/hooks/reject-mimetype.py)
+* `e`/seafile download-as-zip is not streaming; it creates the full zipfile before download can start, and fails on big folders
 * `j`/filebrowser remarks:
  * can provide checksums for single files on request
  * can probably do extension/mimetype rejection similar to copyparty
@@ -432,6 +433,7 @@ symbol legend,
  * not that bad, can probably be remedied with bindmounts or maybe symlinks
 * ⚠️ uploads not resumable / accelerated / integrity-checked
  * ⚠️ on cloudflare: max upload size 100 MiB
+* ⚠️ uploading small files is slow; `2.2` files per sec (copyparty does `87`/sec), tested locally with [linuxserver/nextcloud](https://hub.docker.com/r/linuxserver/nextcloud) (sqlite)
 * ⚠️ no write-only / upload-only folders
 * ⚠️ http/webdav only; no ftp, zeroconf
 * ⚠️ less awesome music player
@@ -451,7 +453,9 @@ symbol legend,
  * *much worse than nextcloud* in that regard
 * ⚠️ uploads not resumable / accelerated / integrity-checked
  * ⚠️ on cloudflare: max upload size 100 MiB
+* ⚠️ uploading small files is slow; `2.7` files per sec (copyparty does `87`/sec), tested locally with [official container](https://manual.seafile.com/docker/deploy_seafile_with_docker/)
 * ⚠️ no write-only / upload-only folders
+* ⚠️ big folders cannot be zip-downloaded
 * ⚠️ http/webdav only; no ftp, zeroconf
 * ⚠️ less awesome music player
 * ⚠️ doesn't run on android or ipads
--- a/scripts/deps-docker/Dockerfile
+++ b/scripts/deps-docker/Dockerfile
@@ -3,6 +3,7 @@ WORKDIR /z
 ENV     ver_asmcrypto=c72492f4a66e17a0e5dd8ad7874de354f3ccdaa5 \
        ver_hashwasm=4.9.0 \
        ver_marked=4.3.0 \
+        ver_dompf=3.0.5 \
        ver_mde=2.18.0 \
        ver_codemirror=5.65.12 \
        ver_fontawesome=5.13.0 \
@@ -13,6 +14,7 @@ ENV     ver_asmcrypto=c72492f4a66e17a0e5dd8ad7874de354f3ccdaa5 \
 # https://github.com/markedjs/marked/releases
 # https://github.com/Ionaru/easy-markdown-editor/tags
 # https://github.com/codemirror/codemirror5/releases
+# https://github.com/cure53/DOMPurify/releases
 # https://github.com/Daninet/hash-wasm/releases
 # https://github.com/openpgpjs/asmcrypto.js
 # https://github.com/google/zopfli/tags
@@ -27,6 +29,7 @@ RUN     mkdir -p /z/dist/no-pk \
        && wget https://github.com/markedjs/marked/archive/v$ver_marked.tar.gz -O marked.tgz \
        && wget https://github.com/Ionaru/easy-markdown-editor/archive/$ver_mde.tar.gz -O mde.tgz \
        && wget https://github.com/codemirror/codemirror5/archive/$ver_codemirror.tar.gz -O codemirror.tgz \
+        && wget https://github.com/cure53/DOMPurify/archive/refs/tags/$ver_dompf.tar.gz -O dompurify.tgz \
        && wget https://github.com/FortAwesome/Font-Awesome/releases/download/$ver_fontawesome/fontawesome-free-$ver_fontawesome-web.zip -O fontawesome.zip \
        && wget https://github.com/google/zopfli/archive/zopfli-$ver_zopfli.tar.gz -O zopfli.tgz \
        && wget https://github.com/Daninet/hash-wasm/releases/download/v$ver_hashwasm/hash-wasm@$ver_hashwasm.zip -O hash-wasm.zip \
@@ -48,6 +51,7 @@ RUN     mkdir -p /z/dist/no-pk \
            && cd easy-markdown-editor* \
            && npm install \
            && npm i gulp-cli -g ) \
+        && tar -xf dompurify.tgz \
        && tar -xf prism.tgz \
        && unzip fontawesome.zip \
        && tar -xf zopfli.tgz
@@ -120,6 +124,10 @@ RUN     cd easy-markdown-editor-$ver_mde \
        && cp -pv dist/easymde.min.js /z/dist/easymde.js


+# build dompurify
+RUN     (echo; cat DOMPurify-$ver_dompf/dist/purify.min.js) >> /z/dist/marked.js
+
+
 # build fontawesome and scp
 COPY    mini-fa.sh /z
 COPY    mini-fa.css /z
--- a/scripts/pyinstaller/depchk.sh
+++ b/scripts/pyinstaller/depchk.sh
@@ -44,7 +44,7 @@ ckgh() {
 			curl -s https://api.github.com/repos/$dep/releases | tee h |
 			jq -r 'first|.assets|.[]|.name'
 		)
-		[ -z "$k" ] && echo "outdated: $dep" && cp h "ng-$dep" e=1
+		[ -z "$k" ] && echo "outdated: $dep" && cp h "ng-$dep" && e=1
 	done
 	true
 }
--- a/scripts/pyinstaller/deps.sha512
+++ b/scripts/pyinstaller/deps.sha512
@@ -1,12 +1,12 @@
 d5510a24cb5e15d6d30677335bbc7624c319b371c0513981843dc51d9b3a1e027661096dfcfc540634222bb2634be6db55bf95185b30133cb884f1e47652cf53  altgraph-0.17.3-py2.py3-none-any.whl
 eda6c38fc4d813fee897e969ff9ecc5acc613df755ae63df0392217bbd67408b5c1f6c676f2bf5497b772a3eb4e1a360e1245e1c16ee83f0af555f1ab82c3977  Git-2.39.1-32-bit.exe
 17ce52ba50692a9d964f57a23ac163fb74c77fdeb2ca988a6d439ae1fe91955ff43730c073af97a7b3223093ffea3479a996b9b50ee7fba0869247a56f74baa6  pefile-2023.2.7-py3-none-any.whl
-2410f79f25b55829169fdd45611c04f51932f7701c0601df64ade0eb545c96ba950b7be186eb082482506bc689fcde5fe09c1f6f7cd77c2107028959b7e0d06f  pyinstaller-5.12.0-py3-none-win32.whl
-62f4f3dda0526ea88cfc5af1806c7b53094672f4237d64c088626c226ad2fbc7549f6c9c6bbe5b228b1f87faf1e5c343ec468c485e4c17fe6d79c6b1f570153a  pyinstaller-5.12.0-py3-none-win_amd64.whl
-2612c263f73a02eab41404ba96e0c7cf8be4475104668b47dfbae50fadf977b3621dd4102682b301264d82b6e130d95ea84a28bf2106a626a1a2845dac16df47  pyinstaller_hooks_contrib-2023.3-py2.py3-none-any.whl
-132a5380f33a245f2e744413a0e1090bc42b7356376de5121397cec5976b04b79f7c9ebe28af222c9c7b01461f7d7920810d220e337694727e0d7cd9e91fa667  pywin32_ctypes-0.2.0-py2.py3-none-any.whl
+f298e34356b5590dde7477d7b3a88ad39c622a2bcf3fcd7c53870ce8384dd510f690af81b8f42e121a22d3968a767d2e07595036b2ed7049c8ef4d112bcf3a61  pyinstaller-5.13.2-py3-none-win32.whl
+ea73aa54cc6d5db20dfb127e54562dabf890e4cd6171a91b10a51af2bcfc76e1d64cbdce4546df2dcfe42b624724c85b1cd05934be2413425b1f880222727b4f  pyinstaller-5.13.2-py3-none-win_amd64.whl
+2f4e3927a38cf7757bc9a1c06370d79209669a285a80f1b09cf9917137825c7022a50a56b351807e6e687e2c3a7bd7b2c5cc6daeb4d90e11920284c1a04a1cc3  pyinstaller_hooks_contrib-2023.8-py2.py3-none-any.whl
+749a473646c6d4c7939989649733d4c7699fd1c359c27046bf5bc9c070d1a4b8b986bbc65f60d7da725baf16dbfdd75a4c2f5bb8335f2cb5685073f5fee5c2d1  pywin32_ctypes-0.2.2-py3-none-any.whl
 3c5adf0a36516d284a2ede363051edc1bcc9df925c5a8a9fa2e03cab579dd8d847fdad42f7fd5ba35992e08234c97d2dbfec40a9d12eec61c8dc03758f2bd88e  typing_extensions-4.4.0-py3-none-any.whl
-4b6e9ae967a769fe32be8cf0bc0d5a213b138d1e0344e97656d08a3d15578d81c06c45b334c872009db2db8f39db0c77c94ff6c35168d5e13801917667c08678  upx-4.0.2-win32.zip
+8d16a967a0a7872a7575b1005cf66915deacda6ee8611fbb52f42fc3e3beb2f901a5140c942a5d146bd412b92bfa9cbadd82beeba83df6d70930c6dc26608a5b  upx-4.1.0-win32.zip
 # u2c (win7)
 a7d259277af4948bf960682bc9fb45a44b9ae9a19763c8a7c313cef4aa9ec2d447d843e4a7c409e9312c8c8f863a24487a8ee4ffa6891e9b1c4e111bb4723861  certifi-2022.12.7-py3-none-any.whl
 2822c0dae180b1c8cfb7a70c8c00bad62af9afdbb18b656236680def9d3f1fcdcb8ef5eb64fc3b4c934385cd175ad5992a2284bcba78a243130de75b2d1650db  charset_normalizer-3.1.0-cp37-cp37m-win32.whl
@@ -27,4 +27,4 @@ ba91ab0518c61eff13e5612d9e6b532940813f6b56e6ed81ea6c7c4d45acee4d98136a383a250675
 7f8f4daa4f4f2dbf24cdd534b2952ee3fba6334eb42b37465ccda3aa1cccc3d6204aa6bfffb8a83bf42ec59c702b5b5247d4c8ee0d4df906334ae53072ef8c4c  MarkupSafe-2.1.3-cp311-cp311-win_amd64.whl
 4a20aeb52d4fde6aabcba05ee261595eeb5482c72ee27332690f34dd6e7a49c0b3ba3813202ac15c9d21e29f1cd803f2e79ccc1c45ec314fcd0a937016bcbc56  mutagen-1.46.0-py3-none-any.whl
 926d408a886059a75cf12706fa061146f9f042b27fb6e65be7d49f398ed23fb0227639d84804586ac014c6bcf7d08cd86a09c1a20793d341aa0802d3d32a546b  Pillow-10.0.0-cp311-cp311-win_amd64.whl
-a48ee8992eee60a0d620dced71b9f96596f5dd510e3024015aca55884cdb3f9e2405734bfc13f3f40b79106a77bc442cce02ac4c8f5d16207448052b368fd52a  python-3.11.4-amd64.exe
+c86bbeacad3ae3c7bde747f5b4f09c11eced841add14e79ec4a064e5e29ebca35460e543ba735b11bfb882837d5ff4371ce64492d28d096b4686233c9a8cda6d  python-3.11.5-amd64.exe
--- a/scripts/pyinstaller/notes.txt
+++ b/scripts/pyinstaller/notes.txt
@@ -17,10 +17,10 @@ uname -s | grep NT-10 && w10=1 || {
 fns=(
  altgraph-0.17.3-py2.py3-none-any.whl
  pefile-2023.2.7-py3-none-any.whl
-  pyinstaller-5.10.1-py3-none-win_amd64.whl
-  pyinstaller_hooks_contrib-2023.2-py2.py3-none-any.whl
-  pywin32_ctypes-0.2.0-py2.py3-none-any.whl
-  upx-4.0.2-win32.zip
+  pyinstaller-5.13.1-py3-none-win_amd64.whl
+  pyinstaller_hooks_contrib-2023.7-py2.py3-none-any.whl
+  pywin32_ctypes-0.2.2-py3-none-any.whl
+  upx-4.1.0-win32.zip
 )
 [ $w10 ] && fns+=(
  mutagen-1.46.0-py3-none-any.whl
@@ -43,12 +43,11 @@ fns=(
 )
 [ $w7x64 ] && fns+=(
  windows6.1-kb2533623-x64.msu
-  pyinstaller-5.10.1-py3-none-win_amd64.whl
  python-3.7.9-amd64.exe
 )
 [ $w7x32 ] && fns+=(
  windows6.1-kb2533623-x86.msu
-  pyinstaller-5.10.1-py3-none-win32.whl
+  pyinstaller-5.13.1-py3-none-win32.whl
  python-3.7.9.exe
 )
 dl() { curl -fkLOC- "$1" && return 0; echo "$1"; return 1; }
--- a/scripts/test/smoketest.py
+++ b/scripts/test/smoketest.py
@@ -100,6 +100,7 @@ def tc1(vflags):
        "-p4321",
        "-e2dsa",
        "-e2tsr",
+        "--ban-403=no",
        "--dbd=yolo",
        "--no-mutagen",
        "--th-ff-jpg",
--- a/tests/util.py
+++ b/tests/util.py
@@ -189,6 +189,8 @@ class VHttpSrv(object):

        self.gpwd = Garda("")
        self.g404 = Garda("")
+        self.g403 = Garda("")
+        self.gurl = Garda("")

        self.ptn_cc = re.compile(r"[\x00-\x1f]")
Author	SHA1	Message	Date
ed	cadaeeeace	v1.9.4	2023-09-02 00:18:53 +00:00
ed	767696185b	add ?tar=gz, ?tar=bz2, ?tar=xz with optional level; defaults are ?tar=gz:3, ?tar=bz2:9, ?tar=xz:1	2023-09-01 23:44:10 +00:00
ed	c1efd227b7	fix inconsistent use of symlink mtimes in database; on upload, dupes are by default handled by symlinking to the existing copy on disk, writing the uploader's local mtime into the symlink mtime, which is also what gets indexed in the db this worked as intended, however during an -e2dsa rescan on startup the symlink destination timestamps would be used instead, causing a reindex and the resulting loss of uploader metadata (ip, timestamp) will now always use the symlink's mtime; worst-case 1% slower startup (no dhash) this change will cause a reindex of incorrectly indexed files, however as this has already happened at least once due to the bug being fixed, there will be no additional loss of metadata	2023-09-01 20:29:55 +00:00
ed	a50d0563c3	instantly perform search when URL contains a raw query	2023-09-01 20:16:19 +00:00
ed	e5641ddd16	update pkgs to 1.9.3	2023-08-31 23:08:32 +00:00
ed	700111ffeb	v1.9.3	2023-08-31 22:11:31 +00:00
ed	b8adeb824a	misc http correctness; some of this looks shady af but appears to have been harmless (decent amount of testing came out ok) * some location normalization happened before unquoting; however vfs handled this correctly so the outcome was just confusing messages * some url parameters were double-decoded (unpost filter, move destinations), causing some operations to fail unexpectedly * invalid cache-control headers could be generated, but not in a maliciously-beneficial way (there are safeguards stripping newlines and control-characters) also adds an exception-message cleanup step to strip away the filesystem path that copyparty's python files are located at, in case that could be interesting knowledge	2023-08-31 21:51:58 +00:00
ed	30cc9defcb	cosmetics: * in case someone gets a confusing access-related error message, include more context in serverlogs (exact path) * fix js console spam in search results * same markdown line-height in viewer and browser	2023-08-31 21:27:14 +00:00
ed	61875bd773	slightly reduce flickering during page load on chrome	2023-08-31 20:02:33 +00:00
ed	30905c6f5d	add convenient debugs in case the fight is not over	2023-08-31 20:00:14 +00:00
ed	9986136dfb	apple/ios/iphone: maybe fix background album playback good news: apple finally added support for samplerates other than 44100 for AudioContext, meaning it would now have been possible to set non-100% volume for audio files including opus files bad news: apple broke AudioContext in a way that makes it bug out mediaSessions, causing lockscreen controls to become mostly useless bad news: apple broke AudioContext additionally where it randomly causes playback issues, blocking playback of audio files, even if the AudioContext is sitting idle doing nothing (which is a requirement for reliable upload speeds on other platforms) disable AudioContext on iOS	2023-08-31 19:57:05 +00:00
ed	1c0d978979	ios/iphone: autoreplace smart-quotes with sane quotes, as the iphone keyboard is not able to produce ' or "	2023-08-31 19:29:37 +00:00
ed	0a0364e9f8	FTPd: fix py3.12 support; workaround until next release: run sfx twice with PYTHONPATH=/tmp/pe-copyparty.$(id -u)/copyparty/vend	2023-08-28 00:25:33 +00:00
ed	3376fbde1a	update pkgs to 1.9.2	2023-08-26 22:09:43 +00:00
ed	ac21fa7782	v1.9.2	2023-08-26 21:16:30 +00:00
ed	c1c8dc5e82	ok lets try that again	2023-08-26 19:07:23 +00:00
ed	5a38311481	mark offline volumes in directory tree sidebar	2023-08-26 19:00:46 +00:00
ed	9f8edb7f32	make markdown slightly safer without the nohtml volflag by running dompurify after marked.parse if plugins are not enabled; adds no protection against the more practical approach of just putting a malicious <script> in an html file and uploading that, but one footgun less is one less footgun	2023-08-26 17:37:02 +00:00
ed	c5a6ac8417	persist dotfile preference as cookie for initial listing	2023-08-26 15:50:57 +00:00
ed	50e01d6904	add more autoban triggers: * --ban-url: URLs which 404 and also match --sus-urls (bot-scan) * --ban-403: trying to access volumes that dont exist or require auth * --ban-422: invalid POST messages, fuzzing and such * --nonsus-urls: regex of 404s which shouldn't trigger --ban-404 in may situations it makes sense to handle this logic inside copyparty, since stuff like cloudflare and running copyparty on another physical box than the nginx frontend is on becomes fairly clunky	2023-08-26 13:52:24 +00:00
ed	9b46291a20	add option to force-disable turbo, making it safer to enable --ban-404 (u2c can still get banned inadvertently)	2023-08-26 13:19:38 +00:00
ed	14497b2425	docs: * mention cloudflare-specific nginx config versus.md: * seafile has a size limit on zip downloads * seafile and nextcloud are slow at uploading many small files u2c: improve error message in funky environments	2023-08-25 21:57:26 +00:00
ed	f7ceae5a5f	add filetable range-select with shift-pgup/pgdn, and retain file selection cursor when lazyloading more files	2023-08-25 19:34:37 +00:00
ed	c9492d16ba	fix textfile navigation hotkeys (broke in `5d13ebb4`)	2023-08-25 18:41:45 +00:00
ed	9fb9ada3aa	dont whine about inaccessible root on rootless configs, and make it easier for on403 to invoke the homepage-redirect	2023-08-25 18:33:15 +00:00
ed	db0abbfdda	typo	2023-08-21 00:05:39 +00:00
ed	e7f0009e57	update pkgs to 1.9.1	2023-08-20 23:53:58 +00:00