mirrors/go-hauk
2
0
Fork 0
mirror of https://github.com/parkan/go-hauk.git synced 2026-05-08 16:47:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix adopt auth bypass, add rate limiting

Browse Source
This commit is contained in:
Arkadiy Kukarkin
2025-12-25 19:19:28 +01:00
parent 6959aff335
commit 558b4ddf1c
6 changed files with 200 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
api/server.go
View File

@@ -3,22 +3,26 @@ package api
import (
"io/fs"
"net/http"
"time"
"github.com/parkan/go-hauk/auth"
"github.com/parkan/go-hauk/config"
"github.com/parkan/go-hauk/frontend"
"github.com/parkan/go-hauk/linkgen"
"github.com/parkan/go-hauk/ratelimit"
"github.com/parkan/go-hauk/store"
)
const backendVersion = "1.6.2-go"
type Server struct {
mux *http.ServeMux
cfg *config.Config
store store.Store
auth auth.Authenticator
linkgen *linkgen.Generator
mux *http.ServeMux
cfg *config.Config
store store.Store
auth auth.Authenticator
linkgen *linkgen.Generator
rlAuth *ratelimit.Limiter
rlAdopt *ratelimit.Limiter
}
func NewServer(cfg *config.Config, s store.Store) *Server {
@@ -27,6 +31,8 @@ func NewServer(cfg *config.Config, s store.Store) *Server {
cfg: cfg,
store: s,
linkgen: linkgen.New(s, cfg.LinkStyle),
rlAuth: ratelimit.New(cfg.RateLimitAuth, time.Minute, cfg.TrustProxy),
rlAdopt: ratelimit.New(cfg.RateLimitAdopt, time.Minute, cfg.TrustProxy),
}
switch cfg.AuthMethod {
@@ -41,11 +47,11 @@ func NewServer(cfg *config.Config, s store.Store) *Server {
srv.auth = auth.NewPasswordAuth(cfg.PasswordHash)
}
srv.mux.HandleFunc("POST /api/create.php", srv.handleCreate)
srv.mux.HandleFunc("POST /api/create.php", srv.rlAuth.WrapFunc(srv.handleCreate))
srv.mux.HandleFunc("POST /api/post.php", srv.handlePost)
srv.mux.HandleFunc("GET /api/fetch.php", srv.handleFetch)
srv.mux.HandleFunc("POST /api/stop.php", srv.handleStop)
srv.mux.HandleFunc("POST /api/adopt.php", srv.handleAdopt)
srv.mux.HandleFunc("POST /api/adopt.php", srv.rlAdopt.WrapFunc(srv.handleAdopt))
srv.mux.HandleFunc("POST /api/new-link.php", srv.handleNewLink)
srv.mux.HandleFunc("GET /dynamic.js.php", srv.handleDynamic)