rejetto forum

Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Topics - NaitLee

Pages: 1 2
1
Everything else / Let things calm down
« on: April 29, 2022, 06:35:32 PM »
This topic is relative to https://rejetto.com/forum/index.php?topic=13535.msg1067427#msg1067427

Let things calm down. I can't persuade further since it will make things go worse.



They are still false positives.

Gibberish code, just crackers trying another non-sense protocol (possibly HTTPS).

Bell ring, a common concept of Windows CMD/PowerShell, when there's a BELL (0x07) character, Windows will just ring, to alarm something. It's along with above circumstance.

Connect? Just another non-sense that try to horrify you.
Just compare the CONNECT with GET or POST. The difference is servers just don't understand it and won't do anything.
No request methods except GET, HEAD and POST will work, in that script.

Code: [Select]
# Example. Try in unix-like environment and modify as need
echo -e -n "CONNECT google.com:443 HTTP/1.1\r\n" | socat tcp-connect:127.0.0.1:8081 -
# it won't do anything wrong in either side

For other things else, I think I could stop, "guessing" as said. I don't want to be superhero, anyway. Do what you like & think best.



Losing trust is terrible. Even more terrible if it's all caused by outsider stalkers. Terrible for both person. Yet more if plus region things.

Now that even if I do more, useless.

Hope everything will go well, without me.

Goodbye.

2
A note for passing-by guests: this is an technical topic. For seeking template themes see other topics :)

HFS3 default frontend is so fast.
But for template makers like me, want to make template useful for both HFS versions (HFS2 and 3)
In my thought it's not the disliked "compatible", but "universal", since there's no reason for a frequent casual user to leave away from HFS2.

Now I am making a plugin for the new HFS3 to support "traditional" templates.
Macros are there for HFS2.3 to implement useful logics, making a (dynamic pages based) template more "smart".
I've already made it to parse macros in PHFS. But if you tried using it you can find it's very slow, compared to Delphi HFS2.
Yes, Python itself is slow in these basic operations like string batch,
but there are other reasons, including every time we request a section it parses through the raw strings again and again, even if the macro procedure is fixed.

I want to make things faster. Though may still slower than pure-ajax, I want to try my best, at least for skill practicing :)
I'm thinking about serializing macros to make least waste in each execution/evaluation.
And, after this, macro injection (attack) will never work, even if there's an entrance for such action.
As for now I got some ideas, stated below, in normal text and/or source code (with comments)...



Some concepts are made:

MacroSegment and MacroUnit
These will nest some instances of each other to make the macro procedure clear & easy for computer.
Get more details in the code snippets below. Be prepared for thinking :D

MacroContext and MacroContextGlobal
These are for storing eg. variables, and stack for "liner macro execution"[1] (more info below)
Code in snippets may be modified to add more things.

MacroExecutor and MacroExecutors
For defining static functions to execute macros. A MacroUnit have an executor attribute assigned to one in MacroExecutors.
This may change to getter/setter in the future, to support "dynamic executor"[2]

Also see Footnote, FaQ, and Trivia, at the end of this post :D

Some (TypeScript) code snippets, for description: (may be modified at any time)
Code: [Select]
class MacroContextGlobal {
static globals: Record<string, string> = {};
static cache: Record<string, string> = {};
}

class MacroContext extends MacroContextGlobal {
    variables: Record<string, string> = {};
    stack: MacroContextStackItem[] = [];
    shift(count: number = 1): MacroContextStackItem[] {
        return new Array(count).map(() => this.stack.shift() || null);
    }
    shiftAll(): MacroContextStackItem[] {
        return this.stack.splice(0, this.stack.length);
    }
}

interface MacroExecutorFunction {
    (ctx: MacroContext, args?: MacroExecutorArgs, kwargs?: MacroExecutorKwargs): MacroSegment;
}

class MacroExecutor {
    /** @this {MacroExecutor} */
    _function: MacroExecutorFunction;
    flags: MacroExecutorFlags;
    constructor(
        func: MacroExecutorFunction,
        flags: MacroExecutorFlags = C.NO_MULTI_FLAG
    ) {
        this._function = func.bind(this);
        this.flags = flags;
    }
    execute(ctx: MacroContext, args: MacroExecutorArgs, kwargs: MacroExecutorKwargs): MacroSegment {
        // NOTE: in the future, we may check some flags here before execution
        return this._function(ctx, args, kwargs);
    }
}

var macroExecutors = new MacroExecutors();

/**
 * A "part" of the whole macro expression, like a quote block, or a piece of string as argument of a macro.
 * A `MacroSegment` can be *evaluated*, to produce a plain string, then send to client / put into `MacroUnit` args/kwargs.
 * The term *evaluate* can be understood as original *dequote*, if there are items in `execOrder`.
 * In a section there's a root `MacroSegment`. 
 *
 * Concepts:
 * - `segOrder` and `execOrder`:
 *   - Macros are mixed with plain parts and executable parts,
 *     for result production, we first take a sub-segment from `segOrder` as text,
 *     then, we take a `MacroUnit` from `execOrder` then execute it, finally get text.
 *     By repeating until last `segOrder`, we complete.
 * - `isPlain`:
 *   - For marking current segment as plain, i.e. no need to be executed.
 * - `isAlias`:
 *   - For marking current segment as alias from `[special:alias]`
 */
class MacroSegment {
        // ... there are some attributes for plain representation as string, number, boolean. will change later
    segOrder: MacroSegment[];
    execOrder: MacroUnit[];
    isPlain: boolean;
    isAlias: boolean;
    isDynamic: boolean;
    private _inferTypesFromString(value: string): void {
        this._asString = value;
        let value_trimmed = value.trim();
        let possible_number = tryParseNumber(value_trimmed);
        this._asNumber = possible_number;
        this._asBoolean = !!possible_number;
    }
    constructor(
        raw: string = C.EMPTY_STRING,
        segOrder: MacroSegment[] = [],
        execOrder: MacroUnit[] = [],
        isPlain: boolean = true,
        isAlias: boolean = false,
        isDynamic: boolean = false
    ) {
        this._inferTypesFromString(raw);
        // if (raw === null) {}
        this.segOrder = segOrder;
        this.execOrder = execOrder;
        // this.isPlain = this.isAlias = (raw !== null);
        this.isPlain = isPlain;
        this.isAlias = isAlias;
        this.isDynamic = isDynamic;
    }
}

/**
 * A part of the whole macro expression that have specified function, as a macro block. 
 * A `MacroUnit` can be *executed*, for performing special operations.
 *
 * Concepts:
 * - `executor`:
 *   - An instance of `MacroExecutors`, taken from `MacroExecutors`.
 * - `args`:
 *   - A list of arguments, as `MacroSegment`.
 *     They **may** be dynamically *evaluated* by individual `MacroExecutor`.
 * - `kwargs`:
 *   - A list of keyword arguments, always optional, indexed with string, also as `MacroSegment`.
 */
class MacroUnit {
    executor: MacroExecutor;
    args: MacroSegment[] = [];
    kwargs: Record<string, MacroSegment> = {};
    constructor(
        executor: MacroExecutor = MacroExecutors._unknown,
        args: MacroSegment[] = [],
        kwargs: Record<string, MacroSegment> = {}
    ) {
        this.executor = executor;
        this.args = args;
        this.kwargs = kwargs;
    }
}


Footnote:

[1] "liner macro execution"
Let's consider an example:
{.add|{.mul|2|3.}|4.}
The normal way is to walk from start, see the most-inner macro, pick up, execute, then replace it as result, then do again until end...
But in our way, after serialization, instructions are ordered there one by one:
execOrder = [ mul, add ]; (pseudo code. note that these are MacroUnits, which wrapped both an executor and arguments (as nested MacroSegments, plain or evaluatable))
... after the "mul" unit executed, it's result is pushed to stack of current MacroContext, then in "add" unit we leave a mark to let it shift one element from the stack as an argument.
This is mind-exhausting, but computer is really doing effective liner action.

[2] "dynamic executor"
Another example:
{.{.if|{.^want_sub.}|sub|add.}|5|3.}
I think most dynamic language developers have tried such method to determine which function to use. :D
(wantSub ? sub : add)(5, 3) (sub and add are functions)
While it just works, it may confuse a static computing rule.
So our MacroExecutor need to be dynamic at here, by making the executor attr a getter.

FaQ:
= Why don't publish source code now?
- The source now only contains these "ideas" and completely not usable. It takes some time to integrate this large scale.
= Well... where will the source code be?
- On here of GitLab. But it's empty now.
= What's wrong with GitHub?
- Here have trouble accessing it, ranging the whole mainland region. Successfully viewing is by luck.
= Mirror to GitHub?
- I'll consider/try when the project become active.

Trivia:
I scribbled on my note paper in order to understand all of these by myself.
This project is developing on a new laptop with Manjaro GNU/Linux, for playing with edge-technique stuffs now my main workstation
I didn't want to touch Node.js, until I want to work on this. :)
The source code is full of typo "executer" before I post this. :P
I'm trying out Tabnine, an AI assist for coders. It auto-completed many pieces of code here. (Note: no advertisement meanings at all, but may help)

3
Everything else / My new avatar
« on: August 29, 2021, 03:46:03 PM »
I costed some money online and got a new avatar picture. As cute as the original! But will be better to be used somewhere like a introduction image/slideshow/video etc...

In attachment there's a smaller & watermark version of the avatar. I want to reserve my copyright since I want to use it far later.

Enjoy the cuteness ;)

4
中文 - Chinese / HFS 相關的繁體中文資源(翻譯)
« on: August 17, 2021, 03:59:39 AM »
熱心網友 @MongWu.NeitherHowger.Long 為大家做了好多翻譯工作,包括 HFS 2.4 RC7(lng)、官方範本(template)、Takeback 範本的對應繁體中文翻譯!

附件有用於 HFS 2.4 RC7 的翻譯檔案,放在 hfs.exe 同目錄下、重啓 HFS 即可!

5
Everything else / Today is my 18th birthday :)
« on: August 09, 2021, 06:30:55 AM »
... But no one cares about this  :'(

Here is my most familiar place, so I speak something here :D

The age 18 means a lot at almost everywhere.

Many ones say that I'm "pre-matured" "since i'm small". But now that I have a reason to say "you are wrong" to them.

I coded many, but got few attention. I don't want to get polluted by proprietary, but I still want my creations to help ones get better, get more freedom to their computing rights.

I trust GNU philosophy, which will be a hard step in a world with surveillance. Rather than failure expected by eyes around me, I got a "victory" at here, created my own HFS template & HFS (yeah, see signature 8)), brought light to HFS world. Though this land is small, but with infinity fun!

I learnt JavaScript/TypeScript, Python, and now C#. I'm not one that always stick at one thing till die. I even bought a book that teaches anime drawing for game creation. A person should always follow "learning" in his life.

Everyday my mind echos some annoying stuff, somewhat like "you must use WINDOWS to complete your daily task here", "ActiveX is the most ADVANCED technology in this world, so we should use IE to surf the Internet"... ... Wrapped by these disgusting things, I really to escape, escape to a far-far land without control by so-called "big companies". Windows do good as a personal OS, AX is sure a fun thing in the past. But they should not be used as a reason to stop discovery. I used GNU/Linux for one year to complain about this, but who cares? ... ... All in all, I HATE them, that's why we should FIGHT against them.

Also ones say who talks too much **** is only saying, without any real effect. But, God knows how many kind persons enjoy giving to others, and also how many helpless persons enjoy them? 人之初,性本善。Do not get your eyes masked by a piece of leaf.

This is more like a presentation. But, these are what my heart thinks. Please, let's enjoy this day, which is another peace day to hack  ;D ;D ;D


Regards,
NaitLee

6
It's a hard work till now and my Python version of HFS can work ;D
Now you can use it as a personal nas drive with your beloved raspberry pi (if you have) and template~

Here's it's repository: https://github.com/NaitLee/PHFS
Feel free to star it :D  or say this to geeks around you!

7
I'm just trying to implement a virtual file system (vfs) thing in Python, but cannot figure out the technique to do.
HFS source code is a bit long and I failed to discover the actual way.

Please, help me imagine a method to complete it :)
Any spoken thing is fine :D

8
HTML & templates / The Python Template Interpreter (PTI) Plan: suggestions?
« on: February 14, 2021, 10:52:45 AM »
I just think python is a good choice to make a cross-platform HFS template interpreter.
After struggling for days, now we can truly make such a thing out: core macro parser has been made, in a different way.

So this time I'm searching for some tips and suggestions, more is good :)

Also, here's it's repo and site :D, it's named phfs because it also has a server!

Poll: Which priority should I choose?

9
HTML & templates / The "white" template: FTP-like, fewer functions
« on: February 12, 2021, 03:50:49 AM »
Suggested by my friend, I've made this simple template.
It's like an FTP page, without login and file-operation functions, for ones that need simplicity.

Enjoy ;)

10
其实这样的例子应该有很多了。但是让我碰见一个:http://193.42.26.37:85/

这货貌似盗了我一个朋友的 Skype 账号,给我发了个“协助商户流程.chm”。这是编译的 HTML 帮助文档,Windows 默认用嵌入的 IE 打开。

我把它拆开,草草解密了一下里面的 JavaScript,是调用 ActiveX 对象来下载上面网站的 Host.exe 病毒程序——毕竟 ActiveX 正是 IE 的不安全所在。

所以,保持警惕!不要乱打开文件!



后记:

1、这货居然用的不是我的 HFS 翻译版本?有点小生气耶…… 🙃
2、我只是个高三党,哪里来的商户?🤪
3、所以话说 HFS “降低了犯罪成本”?真荒唐……呵呵……
4、那个 CHM 文件我给附在下面,你们可以深入地研究研究……解压密码:"virus?" (不包含引号)
    ( I attached that CHM virus file below, have a hack with that ;) unzip password: "virus?" (quote signs not included) )

11
中文 - Chinese / 国内 code.jquery.com jQuery CDN 问题
« on: December 03, 2020, 04:49:38 AM »
包括此论坛的许多网站都在使用 code.jquery.com 作为其获取 jQuery 脚本的 CDN。
但是在我这里试图访问 code.jquery.com 的话对面会关闭连接——而且是在很长时间后。
这导致了我访问这个论坛的时候,如果不全局禁用脚本,加载会卡在这个 jQuery 上,特别慢。
而且就算我不禁用脚本,也不能使用大多数脚本功能,比如登录。

大家有没有这样的情况呢?有解决方法的话会更好 ;)

12
I made a new i18n tool with pure JavaScript: https://github.com/NaitLee/i18-N.js-Lite

You can use this to localize your webpage or template easily.
Just define some languages in your page and include the script. See the example at readme.md.
Even a single page of .html is fine. You can copy-paste all the script into a <script> tag.

Any requests please report :D

13
I think there will always be someone interested in this, so I post this here. :D

I've found the answer here.
When HFS is running with Wine for Linux, it's exactly someway to execute outside GNU/Linux packages:
Code: [Select]
{.exec|cmd /c start /unix /usr/bin/gedit|out=x.}
{.^x.}
This will run gedit.

More usefully:
Code: [Select]
{.exec|cmd /c start /unix /usr/bin/libreoffice --convert-to html --outdir "/home/user/converted_document" "/home/user/document/file.docx"|out=x.}
{.^x.}
This will convert "file.docx" to "file.html" with LibreOffice, so the file can be previewed within a browser.

But seems in this way we cannot execute bash based things (like /bin/sh), with a debug message:
Code: [Select]
0045:fixme:exec:SHELL_execute flags ignored: 0x00000100We may report this to Wine developers? :)

14
There comes another working-in-progress template: the Together template. ;)

It's aim is to create a cooperative environment for text-editing work, both rich text document and code.

It currently have basic editing function for rich text and code, but cannot save & "together" yet.
Please wait, patiently :D

Still only a snap shot is available...

Plan & Progress:
(O) Basic loading function (No macro execution while loading)
(O) Basic editing function
(...) The ability to save files
(...) Better UI
(...) Be "together", cooperatively
(...) Advanced editing function (auto-complete, format clone etc.)

15
How about introducing a document converter (to html) to your template & server?
This can be quite useful if user wants to share documents (like .docx .odt formatted) with HFS.

There are all the codes for such a feature. Besides, you need to install LibreOffice to your server OS.
Code: [Select]
[+special:strings]
EnableDocConvert=1

[ajax.convertdoctohtml|public]
[ajax.convertdoctohtml|public]
{.set|LibreOfficePath|C:\Program Files\LibreOffice\program\soffice.exe.}
{.break|if={.not|{.!EnableDocConvert.}.}|reason=Doc Convert not enabled.}
{.break|if={.not|{.exists|{.^LibreOfficePath.}.}.}|reason=No LibreOffice installed.}

{.set|file|{.urlvar|file.}.}
{.set|target|{.vfs to disk|{.urlvar|path.}.}.}
{.set|folder|{.^target.}\{.^file.}.html.}

{.mkdir|{.^folder.}.}
{.save|{.^folder.}\index.html|{.replace|@@filename@@|{.^file.}|{.no pipe|{.$docview.html.}.}.}.}

{.set|cmd|"{.^LibreOfficePath.}" --convert-to html --outdir "{.^folder.}" --convert-images-to "gif" "{.^target.}\{.^file.}".}
{.^cmd.}
{.exec|{.^cmd.}|out=x.}
{.^x.}
OK

[docview.html]
<!DOCTYPE html>
<html>
<head>
{.$commonhead.}
<title>@@filename@@</title>
<script>
function getdoc () {
var xhr = new XMLHttpRequest();
var docfile = './'+'@@filename@@'.replace(/\..*$/, '')+'.html';
xhr.open('HEAD', docfile);
xhr.onload = function() {
if (xhr.status == '404') { // Conversion not completed yet
setTimeout(function() { getdoc(); }, 1000);
} else if (xhr.status == '200') { // Done, go
window.location.replace(docfile);
}
}
xhr.send();
}
getdoc();
</script>
</head>
<body>
{.$commonbody.upper.}
<h1 style="text-align: center;">{.!Converting document, please wait....}</h1>
{.$commonbody.lower.}
</body>
</html>

[+]
<script>
var converttohtml = function (file, path) {
notice('{.!Converting.} '+file+' {.!to .html format..} {.!Please wait.}', '{.!Conversion Started.}');
var xhr = new XMLHttpRequest();
xhr.open('POST', '/~ajax.convertdoctohtml?file='+file+'&path='+path);
xhr.onload = function() {
var response = xhr.responseText.trim();
if (response.substring('Doc Convert not enabled') >= -1) {
popup('{.!Conversion failed..}<br />{.!Doc Convert not enabled.}', '?alert');
} else if (response.substring('No LibreOffice installed') >= -1) {
popup('{.!Conversion failed..}<br />{.!Server has no LibreOffice installed..}', '?alert');
} else {
// popup('{.!Conversion started.}<br />{.!You may wait for a while to see specified .html file..}', '?alert');
setTimeout(function() {
previewfile('?open', path+file+'.html');
}, 1000);
}
}
xhr.send();
}

// Then use converttohtml('file.docx', '/my shared files/folder/'); to convert your file.
// There will be a folder named "file.docx.html" created, it contains an index.html for auto-refreshing and the converted file.html.
</script>

These codes presents in new preview version of Takeback,
 you may test it. Don't forget to enable that feature by editing it first.
Some code parts above contains APIs in Takeback. Change them to yours as well.

After all, just have fun!  ;)

Edit: Updated the code to avoid filename being parsed as response code.

Pages: 1 2