Hello everyone! 
One of the pillars of open source software is, without a doubt, promoting transparency — the ability to compile the source code yourself (along with verifying its security and understand its functionality). This becomes even more important when we're talking about an HTTP file server. That's why, whenever I collaborate on something, I always try to make my contributions public.In this case, I want to publicly thank
Danny, who recently shared his own customized version of HFS in
this thread. I haven't reviewed his changes in depth — I've only briefly tested his version — but I did help him with
two small improvements that I’m sharing here in case anyone finds them useful.
Thanks to Leo for help in bypassing the always-on limiters, and this prevents freezes.
That specific tweak is simply the following code (
Danny is using an older build:
HFS 2.3k, but it's the same and could be used on other versions as well). Personally, I haven’t been able to reproduce any issues that this is supposed to fix, but technically the change should have a positive effect.
The following is a portion of 'main.pas' in 'hfs2.3m.src.zip'
Add the line marked in red, after line 5061 in 'main.pas' with objByIp(data.address) do
begin
if speedLimitIP < 0 then limiter.maxSpeed:=MAXINT
else limiter.maxSpeed:=round(speedLimitIP*1000);
if limiter.maxSpeed < MAXINT then
if conn.limiters.indexOf(limiter) < 0 then
conn.limiters.add(limiter);
end;
Thanks to Leo for updated code that blocks hfs-specific attack, in the .exe, without reliance on any particular template.
This change is simple: it bans the IP of any user attempting to execute a macro via the URL (which is the cause of the vulnerability described in
this other thread), even though a similar IP ban could already be implemented using macros in a template. Personally, I think this may not be very effective nowadays, since many ISPs assign dynamic IPs (often even changing the subnet), or because proxies can bypass this entirely. Still, it’s one more layer of protection that might interest some users.
The following is a portion of 'main.pas' in 'hfs2.3m.src.zip'
Add all these lines, around line 5091 in 'main.pas' if anyMacroMarkerIn(conn.request.full) then
begin
data.disconnectReason := 'Possible security threat';
add2log('Hack attempt blocked: '+ansiToUTF8(conn.request.url));
getPage('ban', data);
conn.reply.mode := HRM_DENY;
if not isBanned(conn.address, data.banReason) then
begin
i := length(banlist);
setlength(banlist, i+1);
banlist[i].ip := conn.address;
banlist[i].comment := data.disconnectReason;
end;
exit;
end;These were my only two contributions. The rest of the build reflects
Danny’s personal choices and ideas.
Anyone is free to compile HFS (there are many users who have already done it), and if you're not sure how, you can check out the tutorial here. That’s all for now. I'm closing this topic since its purpose was simply to share this. If I ever need to add something else, I’ll ask a moderator to reopen it. 
Cheers,
Leo.-
Recent Posts
I'm glad you liked and found my guide to compiling HFS helpful. The following message below is what I wrote yesterday before going to sleep (replying your original message), which I'll leave here anyway...