Topics

1

HFS ~ HTTP File Server / HFS2.3M oldstyle "purist" edition

« on: November 25, 2025, 01:47:12 PM »

For the improvement adverse:  Minimal change.  HFS-23-m-oldstyle.zip is available at http://software.run.place
Built fresh from HFS2.3M original source, adding Leo's macro security patch, and the exec macro is disabled. 

Not recommended for those new to HFS.   HFS-23-m-oldstyle is for those who wish to avoid/reduce change. 

The older style default template is still included internal to the program.   For somewhat more comfort (optional) there is a considerably more Efficient default.tpl included separately in the zip file; because, it is nice to have the option of. . . not crash during a bot attack. 

Edit:  Also compatible with a pre-2025 hfs.ini file; if you happened to have an old backup handy from original M or K (remember to exit before copying the ini file to the same folder as hfs.exe).  Using the old ini file will simply cause it to go back to work as expected. 

2

HFS ~ HTTP File Server / HFS v2.x security update By DANNY

« on: July 02, 2025, 04:30:29 PM »

Hi Leo!  Thanks for the reply.  Thanks for the compiling guide! 

Patched edition available at http://software.run.place

3

Programmers corner / Template/events for QOS or traffic shaping.

« on: March 23, 2021, 05:57:47 AM »

This won't be complete because full equal-opposite metrics/status/measures aren't provisioned. 

But, this is what I've 'cooked-up' so far: 




{.if|{.{.calc|%number-addresses-downloading%*%speed-out% .}> 7500.}|{: busy :}|{: archive :}.} 
can also be used for style display none or style display initial (to hide/show buttons)

or

{.if|{.{.calc|%number-addresses-downloading%*%speed-out% .} < 7500.}|{:
archive script
upload script
:}.}
If reasonable load, do script (else omit)

or

soft version {.if|{.%connections% > 39.}|{: busy excuse + javascript recheck timer :}|{: do file list :}.}
connection count management without high cpu load cost

hard version {.if|{.%connections% > 49.}|{:{.redirect|/~busyexcuse.}:}.}
new [busyexcuse|public] section is page for javascript recheck timer wait seconds, if less than x connections then back..
connection count management without high cpu load cost + connection desist (disconnect/redirect) kills downloader/scanner.


P.S.
Multi-user scalable:  These above examples run condition detect on the server but the stalling waiting part runs on the Client cpu.
To make stronger logic, the scope was purposefully confined to doable.   Just sayin' that hard road North got 2 more signposts, like Snacks > and < Else. 

4

HTML & templates / Stripes, the template for simple and easy

« on: February 20, 2021, 11:56:39 AM »

Stripes has a very clean layout that helps focus the users. 
Anyone will be able to use it easily.  Stripes is open-source.
Template Install:  HFS menu, HTML Template, Change file.

+ High efficiency for multi-user workload.  Caching.  Exceptionally Sturdy.
+ Support for:  Phone/PC, large folders, basic users, any connection type.
+ Data savings and download integrity

click here to get the newest version

5

HTML & templates / Tiles and Stripes, the gallery view

« on: July 26, 2020, 11:51:14 AM »

For HFS 2.4 RC5/6/7...

Tiles-n-Stripes template is for development/testing purposes (not for main server). 
Tiles/Gallery layout may cause a couple of problems:
1).  On a fast connection, the amount of data (if page scroll+download/archive) can jam the ui and get stuck.
2).  On a slow connection, the amount of incomplete requests can snowball an overlarge 'todo' list; also stuck.

For problem#1, it was rewritten with micro-delay timers between retries and between rows of lazyload photo tiles.  This avoids the fast-connection-stuck problem, by providing some slack-time for other functions to run (ui-screen-update, list, uploads, multiple-users, etc.).   So, it can work for localhost/local-lan test and other fast connections.  Do see the updated lazyload script.

For problem#2, your clients have a variety of connection speeds, so this template might not be suitable for use over the internet. 
Possible fixes include ondemand (not implemented) whereby no tiles are shown until user clicks to see tiles on current page.  And, speed adaptive tile size, whereby the tiles get much larger size and margins for slow connections, so they could load faster if fewer fit on screen (not implemented because no client speed measure available).  If you want to put it to work, you could use the WatchCat script. 

6

HFS ~ HTTP File Server / FR: average speed

« on: June 24, 2020, 12:54:38 PM »

Feature request:    I would like to access averaged peak speed data via macro. 
Like that ui graph with speed peak. . . average of peaks, if made available by macro, would be so very useful in determining workload/capacity. 
That is the missing piece of data for making pages adaptive to capacity. 

7

Bug reports / unimportant leaks through to error section

« on: June 10, 2020, 04:55:28 AM »

If [error-page] is present, that content will be a response, to ban/disconnect/scanner
Next,
No matter if [error-page] section is present or not, contents of [overload] will be a response to banned/disconnect/scanner

This is unintentionally verbose/pingable. 

Also, if you do the hide-root thing, throwback14 is rigged not to leak at / but, if you ask for url/File, the overload section is the response even if you don't have a folder named file.   Apparently, /file has a special meaning and exists always. 

Here is a patch: 
Delete the [error-page] section (if any).  Throwback14 doesn't have it.
And also,
The [overload] section should start off with 3 filter macros: 
{.if|!%user%|{:{.if|{.%url% = /.}|{:{.disconnect.}:}.}:}.}{.if|!%user%|{:{.if|{.%url% = /file.}|{:{.disconnect.}:}.}:}.}{.if|!%user%|{:{.if|{.%url% = /File.}|{:{.disconnect.}:}.}:}.}
Does:  Don't send extra messages to strangers seeking /, /file, /File. 
Pseudocode:  If  stranger caused overload at / then disconnect; and, if  stranger caused overload at /file then disconnect; and, if stranger caused overload at /File then disconnect.

If there are more built-ins, then the filter which starts the [overload] section should be revised to:
{.if|!%user%|{:{.disconnect.}:}.}
Pseudocode:  Don't send overload message to strangers. 
I updated my home server to that, because I don't know how many built-ins there are (such as /file which exists always). 

The question is:
Should the security update be done at the template or at hfs.exe? 
If it was a good idea to put the security update into a template, then I'd need to ask a moderator to unlock the Throwback template thread. 

Severity:
Least Impact.  Almost none.  Hideroot style security effort is not expected to succeed on port80; and common scanners don't check every uncommon port to see if web servers respond to /file, because it is unfeasible to use a scanner in that way. 


In my opinion:
A template could not be fully effective at hideroot security efforts (not a total means of security, but it lasts until a change).  A template could do either least or more verbose response.  Only hfs.exe could do zero response.  Perhaps an option could be added for make no response to / nor to any folders which don't exist?  I'm glad that Throwback and Takeback have better inbuilt security than any other templates; however, I think it would be a bit more effective if the .exe did the job.  Again, the security-gap reported is least-impact (of least concern).  But, it could be improved.

8

HFS ~ HTTP File Server / How do I measure download speed, without measuring page speed?

« on: January 15, 2020, 04:55:59 PM »

This post redacted.

9

HTML & templates / forum error

« on: May 08, 2018, 06:12:33 PM »

This thread has copies of some posts from the Throwback thread.   Seems to be an error.

10

HTML & templates / The Throwback (retro) template. With large folder and mobile support.

« on: May 08, 2018, 05:33:00 PM »

The files (here at post#1) are open source; built for speed and quality.   Feel free to make a comment.

There is no limit on folder size (any size folder is fine); so, it can be used for an effective music player and file finder (tested up to half million file list).  There is no minimum connection speed (it has streaming file list).  Any kind of connection works fine.

It has a clean layout that works on any size screen, and simple error recovery so it is easier for users (they are not confused).

The photo Thumbnail & Slideshow features are ondemand and adaptive for data savings.
The music shuffle player does many file types, including .mp3, .ogg, .m4a, .wma, .aac, .flac

Template Install:  HFS menu, HTML Template, change file
Do see:  watchdog & WatchCat keepalive monitor accessories.
HFS2.3N or Lite for updated security and higher capacity
Kudos to DJ for login, music shuffle player, delete and slideshow

There is a vulnerability in HFS 2x that has been fixed New versions of Throwback are included in the .zip file with (click here) the security-patched editions of HFS.

11

HTML & templates / build 299, still trying to log in, from a phone

« on: April 27, 2018, 09:56:23 PM »

Edit:  Many of the phone/mobile browsers don't have basic-auth.  But, Firefox mobile is compatible and Some chrome versions can do it.  So, the eventual solution was to simply download a compatible browser. 

It seems recommendable to put a note like that into the [unauthorized] section of an hfs template.  So, instead of no explanation, the user could have a note on what to do to achieve login.