Implement traversal of folders

index.js

@@ -1,4 +1,22 @@
+/*
+POST request contains a JSON object
+{
+    "loc": <path>
+}
+Reply format
+{
+    "loc": <path>,
+    "back": <path to return to>
+    "contents":[
+        {
+            "name": <file name>,
+            "path": <path>
+            "isDir": <true|false>
+        }
+    ]
+}
 
+*/
 
 
 const express = require('express')
@@ -16,30 +34,16 @@ const DIR=settings.dirname;
 app.use(bodyParser.urlencoded({extended:false}))
 app.use(bodyParser.json())
 
-//Get the status of the folder and things related
+let inDir = (dircheck,dirmain) => !path.relative(path.normalize(dircheck), dirmain).startsWith('..')
-app.get('/files',(req,res,next)=>{
-    fs.readdir(DIR,{withFileTypes:true},(err,stream)=>{
-        if(err){
-            next(err)
-        }
-        else{
-            //res.json(stream[0].isDirectory())
-            res.json({"filename":`${DIR}`,"loc":processing.dirprocess(stream,settings)});
-        }
-    })
-})
-
-
-//Attempt to upload a file - Placeholder
-app.put('/files/upload',(req,res)=>{
-    console.log("Upload attempted")
-    res.json({'error':500})
-})
-
 
 //Get folder details
+
 app.post('/files/ls',(req,res,next)=>{
     const location = processing.mergedir(req.body.loc,settings)
+    //console.log(path.relative( path.normalize(settings.dirname) ,location))
+
+    //Make sure not escaping the given path; insecure
+    if(inDir(settings.dirname,location)){
         fs.readdir(location,{withFileTypes:true},(err,files)=>{
             if(err){
                 next(err)
@@ -47,16 +51,29 @@ app.post('/files/ls',(req,res,next)=>{
             else{
                 res.json({
                     "location": location ,
-                "contents":processing.dirprocess(files,settings)
+                    "back": inDir(settings.dirname, path.normalize(path.join(location,'..')) )?path.normalize(path.join(location,'..')):null,
+                    "contents":processing.dirprocess(files,location,settings)
                 })
             }
         })
+    }
+    else{
+        res.json({"error":"Access denied","loc":'/'})
+    }
     
     //next()
 })
-//console.log(path.join(__dirname ,'node_modules','jquery','dist'))
+
+//Attempt to upload a file - Placeholder
+app.put('/files/upload',(req,res)=>{
+    console.log("Upload attempted")
+    res.json({'error':500})
+})
+
+// Use jquery
 app.use('/jquery', express.static( path.join(__dirname ,'node_modules','jquery','dist') ) )
 
+// Use the statics
 app.get( '/*', express.static( path.join(__dirname,'static') ) )
 
 

processing.js

@@ -1,23 +1,22 @@
-const paths = require('path')
+const path = require('path')
 module.exports.mergedir = (dirname,settings)=>{
-    return paths.normalize(paths.join(settings.dirname,dirname));
+    return path.normalize(path.join(settings.dirname,dirname));
 }
 
-module.exports.dirprocess = (dirstream,settings)=>{
+//produces the contents array
+module.exports.dirprocess = (dirstream,location,settings)=>{
+    let contents = []
     dirstream.forEach(element => {
-        element.type = element.isDirectory()
+        console.log(element)
-    });
+        if(!(element.name.startsWith('.')&&!settings.showHidden) )
-    dirstream.push({'name':'..','type':true})
+        {
-    //dirstream.contents.push({'name':'..','type':true})
+            contents.push({
-    if(!settings.showHidden){
+                "name":element.name,
-        let fdirstream = dirstream.filter((ele)=>{
+                "path":path.normalize(path.join(location,element.name)) ,
-            //ele.type=ele.isDirectory
+                "isDir": element.isDirectory()
-            return ele.name[0]!='.'||ele.name=='..'
             })
-        return fdirstream
-    }
-    else{
-        return dirstream
         }
+    });
+    return contents
 }
 

static/base.js

@@ -5,7 +5,7 @@ let currDir = {'loc':'','contents':null};
 function doUpdate(ele){
     console.log(ele.attr('data-choice'));
     if(ele.hasClass('file-isDir')){
-        currDir.loc = currDir.loc+ "/"+ ele.attr('data-choice');
+        currDir.loc = ele.attr('data-choice');
         populateContents();
     }
     //$()
@@ -13,15 +13,24 @@ function doUpdate(ele){
 }
 
 function updateContents(contents){
-    //console.log(contents)
+    console.log(contents)
+
+    // Change top header contents
     $('#files-location').html(currDir.loc)
-    if(contents===null) $('#files-table').append(`<tr><td>null</td><td class="file-handlers"></td></tr>`)
+
+    // if empty, return null, this shouldnt execute if the server is responding properly but ok
+    if(contents===null) {
+        $('#files-table').append(`<tr><td>null</td><td class="file-handlers"></td></tr>`)
+    }
     else
     {
         $('#files-table').empty();
         contents.contents.forEach(element => {
-            $('#files-table').append(`<tr class="files-row"><td onclick="doUpdate($(this))" class="file-name ${(element.type?'file-isDir':'file-isFile')}" data-choice="${element.name}">${element.name}</td><td class="file-handlers"></td></tr>`)
+            $('#files-table').append(`<tr class="files-row"><td onclick="doUpdate($(this))" class="file-name ${(element.isDir?'file-isDir':'file-isFile')}" data-choice="${element.path}">${element.name}</td><td class="file-handlers"></td></tr>`)
         });
+        if(contents.back!=null){
+            $('#files-table').prepend(`<tr class="files-row"><td onclick="doUpdate($(this))" class="file-name file-isDir file-isBack" data-choice="${contents.back}">..</td><td class="file-handlers"></td></tr>`)
+        }
     }
 }