Messages

1

HFS ~ HTTP File Server / Re: HFS v2.x security update By DANNY

« on: December 04, 2025, 03:23:25 PM »

1). Just updated templates for fast recovery during bot internet noise.

2). Included a little text file with 2 examples of optional bot blockers that you can try for your hfs.events. 
Please do add a post with more examples like that!   

2

HFS ~ HTTP File Server / HFS2.3M oldstyle "purist" edition

« on: November 25, 2025, 01:47:12 PM »

For the improvement adverse:  Minimal change.

HFS-23-m-oldstyle.zip is available at http://software.run.place

Built fresh from HFS2.3M original source, adding Leo's macro security patch, and the exec macro is disabled.  Featuring the original defaults, the original default template, etc.... Not recommended for those new to HFS.  But, HFS2.3m-oldstyle can help the "Don't Change" crowd to experience that in a real way.

For somewhat more comfort (optional) there is 'HFS 23 style template V2' included in the zip file.  It is not preinstalled, but you could load it manually if you want to bypass some annoyances and run much faster (optional). 

Edit:  Also compatible with a pre-2025 hfs.ini file; if you happened to have an old backup handy from original M or K (remember to exit before copying the ini file to the same folder as hfs.exe).  That would cause it to simply go back to work as expected. 

3

HFS ~ HTTP File Server / Re: HFS v2.x security update By DANNY

« on: November 16, 2025, 05:18:13 PM »

Enjoy summer break!  Perfect timing.  I need to hunt for a better job this season.  HFS is doing fine because there's nothing to fix other than keeping ahead of new browser changes. 

The development/lite version finally showed the progress it was made for--At version 2XF, features can be added to it and it will still run stable.  Thanks for the advice on WinMerge, to analyze differences.  Very helpful!   

4

HFS ~ HTTP File Server / Re: update

« on: November 15, 2025, 01:14:28 PM »

I like the idea in Leo's patch because it is data validation.  For sure development with HFS2x will need to add data validation and input validation, mainly because the internet is so different today than it was in the early 2000's when most of the features were introduced.  The fact that browsers are also different, just pales in comparison to the change of connecting a server to a very different internet.  So, when the foundation is not level, adding some validation really helps.  I've been adding a little input validation and update for mobile browsers.

So far, I think there wasn't a speed increase; but for sure, more stability/durability has made a capacity increase. 

5

HFS ~ HTTP File Server / update

« on: November 04, 2025, 03:25:41 PM »

Nice results from the October/November 2025 updates: 

Recently, my server withstood a 2 day ddos attack.  And the good news:  Leo wrote a stability patch which kept HFS on track during edge-conditions where it could go to 0 bandwidth.  But, there was No problem.  Thank you Leo!! 

Also I had made an edit so that HFS did not exit from attempting to update the screen two different ways at the same time.  Leo's patch and my little edit, work together to help the server stay on track during high load. 


P.S.  Bonus method to reduce bot annoyance:  You can require your access url (such as your dynamic dns).  It goes in an HFS events entry (control+F6).  Don't specify a port if it is 80.  Here is a whitelist example by naitlee.  I like it!

Code: [Select]

[+request]
{.if|{.and|
{.!=|{.header|Host.}|localhost:8080.}|
{.!=|{.header|Host.}|127.0.0.1:8080.}|
{.!=|{.header|Host.}|mydomain.com.}|
{.!=|{.header|Host.}|mydomain.com:8080.}
.}|{:{.disconnect.}:}.}Similar to Apache's htaccess file, you can find many features by searching for hfs events on the forum.

6

HFS ~ HTTP File Server / HFS v2.4, and security update By DANNY

« on: August 09, 2025, 02:58:45 AM »

Thanks Leo!   A lot of your suggestions were incorporated into these new versions.  I really would have been lost without your help with it. 
I do like the idea of supporting the many installs of HFS2x, by providing an option for stable and secure.

And now we have the HFS2.4 template, able to run on our stable and secure version of HFS 2.3
Contributors:  Rejetto, DJ, Rapid, NaitLee, Mars, LeoNeeson, SilentPliz, Danny, Bmartino

Large Folder Capable!  No Slow Paging!   It streams the file list no matter how many files. 
It has HFS native upload pages, browser native icons and native javascript, all for going fast and stable.

Consider this an HFS2.3 > 2.4 adapter, because most of the work in 2.4 was the template itself.
*the template is in the zip files with security-patched HFS from http://software.run.place

7

HTML & templates / Re: The Throwback (retro) template. With large folder and mobile support.

« on: July 31, 2025, 09:43:19 PM »

New versions of Throwback are included in the .zip file with the security-patched editions of HFS.
https://rejetto.com/forum/index.php?topic=13703.0

8

HFS ~ HTTP File Server / HFS2.x security update 'p5' on suggestion from forum admin

« on: July 30, 2025, 10:30:16 PM »

The suggestion that I got, was (paraphrase):  Disable the .exec macro, to help folks sleep better at night. 

Although a collection of new filters still prevent macro run from remote... yet it is even more comfortable to know exactly what the .exec macro will do.
So, for "p5" (security patch level 5), the .exec macro function has been changed to make a log entry on-screen, and .exec does nothing else at all.

HFS2.3K_299p5 and HFS2.3N_301p5 are available http://software.run.place

P.S. 
The "K" has tighter timings ideal with the faster templates like throwback and stripes, or
The "N" has the language feature and longer timings to tolerate feature-filled templates.
These new 2025 editions are built from a cleaned-up and stable version of HFS.
Edit:  Now we might want to try for a community edition. 

9

HFS ~ HTTP File Server / Re: HFS v2.x By DANNY

« on: July 24, 2025, 12:22:18 AM »

HFS2.3N is released
And the server you'd download from is running the same version of HFS2.3N

It has:
Added security filter from Leo (result is auto ban) for hfs-specific
Added security filters from me (result inactivated) for unspecified
Added Leo's skip the loop filter for graph workload (no load if feature unused)
Added Leo's skip the loop filter for limiter workload (reduced load if feature unused)
Shielded archive links (logged-in users may archive, bots cannot)
Removed version "M" bugged headers mod (to avoid disrupting the data flow)
Removed operationally reliant hardcoded external reference (was outdated)

10

HFS ~ HTTP File Server / Re: HFS v2.x By DANNY

« on: July 11, 2025, 10:06:03 PM »

Speedup: 
locate hfs23-K-patched3.zip and you can test it out. 
http://software.run.place
It is running that same copy of HFS2.3K, with the macros on.

Thanks to Leo for help in bypassing the always-on limiters, and this prevents freezes.  Also, I raised the console TTL so the UI stays responsive. 

 Edit:  For round 3:  Thanks to Leo for updated code that blocks hfs-specific attack, in the .exe, without reliance on any particular template.  So, you can use any template that you want to.
 
Included in the zip file is now the legacy default template for HFS2.3M, and I have altered it slightly, so it can run well on the security-patched edition of HFS2.3K.  There is the unicode font added to the stylesheet, some necessary size adjustment, and it does not overwork the system icon code.

11

HFS ~ HTTP File Server / Re: HFS v2.x By DANNY

« on: July 09, 2025, 12:30:32 AM »

For patched version of HFS2.3K, I've added many layers of defense. . . and *Might have solved/reduced the gigabit freeze problem. 
http://software.run.place
locate hfs23-K-patched.zip and you can test it out. 
The site to download it, is running that same copy of HFS2.3K, with the macros on. 

12

HTML & templates / Re: Stripes, the template for simple and easy. Updated for security.

« on: July 05, 2025, 08:25:59 AM »

There is a vulnerability in HFS 2.3 and 2.4 that has been fixed
New versions of Stripes are included in the .zip file with (click here) the security-patched editions of HFS.

13

HFS ~ HTTP File Server / HFS v2.x security update By DANNY

« on: July 02, 2025, 04:30:29 PM »

Hi Leo!  Thanks for the reply.  Thanks for the compiling guide! 

Patched edition available at http://software.run.place

14

HFS ~ HTTP File Server / Re: Warning: HFS v2.x has a severe vulnerability possible fix?

« on: June 29, 2025, 09:36:35 PM »

Edit:  Here is an approach with Auto-Ban.   This will not catch everything--keep scrolling, several posts further down.
in hfs.events (alt+f6)

Code: [Select]

[+request]
{.if|{.match|*filter=*.exec*;*search=*.exec*;*.exec*;*%host%*;*_host_*;*cmd.exe*;*&cmd=*;*powershell+*;*/wp-includes/*|%url%.}|{:
{.set|n|{.from table|#tries|%ip%.}.}{.inc|n.}{.set table|#tries|%ip%={.^n.}.}
{.if|{.{.^n.} > 0.}|{:
{.set ini|ban-list={.no pipe|{.from table|#ini|ban-list.}%ip%#AutoBan {.time.}.}.}{.set table|#tries|%ip%=0.}
:}/if.}
{.disconnect.}{.add to log|%ip% %user% BANNED FOR POSSIBLE SECURITY THREAT.}:}.}Note:  This is possibly useful in combination with the TINYWALL firewall project, an egress blocking firewall, whereby you'd let through (allow) your web browser, HFS (possibly unblock lan), and very little else.  Newer version or there is also older version (for older server).

15

Beta / Re: version 2.4

« on: October 27, 2022, 11:07:51 PM »

. . . it just stops taking new connections, switching the server off and then on fixes it, i couldn't find why this happens and had to resort to run a script that checks 24x7 if hfs is not accepting downloads and kills it and runs it again.

Do you use the Watchcat2 script? https://rejetto.com/forum/index.php?action=dlattach;topic=12055.0;attach=9809

The stuck/off server is made worse by running limits (hfs menu > limits) that make HFS get more busy and stuck more often.
The Worst is Speed limit.  Instead of HFS speed limit, you could spend 3 dollars on a 100 megabit USB2 adapter, assign it a fixed address and assign HFS to the megabit>USB adapter's ip address.   If you were to accidentally get a gigabit adapter, (and therefore get stuck), just go to properties of the network adapter and manually set 100-half.  This also applies to single-thread versions of most web servers. 

Upload and download at the same time will probably get stuck If the connection speed is high.  Perhaps a clever programmer could figure out complete lockout/tagout logic to thoroughly prevent simultaneous uploads+downloads?  The problem is not severe at 100megabit and lower speeds. 

Edit: HFS2.4 RC7 has 'archive-only-selected' for overload protection; however, earlier versions can try to download the entire server with just one click on the archive button (stuck in 1 click).  Possible fixes include search and disable the recursive function. . . Or switch to the RC7 template or takeback or throwback or stripes.  Since the archive feature makes .tar files that the user doesn't want, removing the archive button is an option. 

EDIT:  See HFS 3 https://github.com/rejetto/hfs