Messages

1

Bug reports / "Bad Session" on both New Folder and Rename

« on: January 14, 2016, 07:24:22 PM »

In both 2.3f and 2.3g, I get a "Bad Session" error whenever I try to create a New Folder or Rename something.

I'm running the server under Win 7.  The error occurs whether I browse to the server from the same machine or a different one.  It happens under both Chrome and Firefox.

I've read other posts in regards to the session cookie, "HFS_SID_".  I've tried inserting code in the template for 2.3f to delete that cookie if the AJAX call comes back "bad session":

         if (res !== "ok") {
            alert("{.!Error.}: " + ">>>" + res + "<<<" );
            if (res.substring(0,11) === 'bad session') {
                delCookie('HFS_SID_');
                location.reload();

I've tried clearing the cookie, closing the browser, closing the server, and trying again with no luck.  I can't find any situation where it works.

Other posts say it worked in 2.3e, but I can't find that version to download.

Is this fixable?

2

HFS ~ HTTP File Server / Re: Control access to subfolders

« on: August 05, 2015, 07:34:19 PM »

I really don't understand what you're trying to tell me.

Let's say I have a folder, in Windows, called "MainFolder".  Within it I have subfolders: "Cust1Folder", "Cust2Folder",...

Let's say in HFS I have accounts for Cust1, Cust2,... and I want Cust1 to only be able to access/upload to Cust1Folder, Cust2 to only access/upload to Cust2Folder, etc.

Now, I know I can do this by adding Cust1Folder, Cust2Folder, etc. individually to HFS, and then setting permissions on each one.

I also know I can just put MainFolder in HFS and set each account's "After ~login redirect to" attribute to their appropriate subfolder.  However, that doesn't stop an account from navigating up a level after login and seeing all the other accounts' folders.

It would be nice if HFS had the concept of a "root folder" per account, like FTP - i.e. a way to limit an account to navigating no higher than a particular folder in a hierarchy.

Does anything like that exist?  Could it be added?  Would anyone be interested in adding it (for a fee)?

3

HFS ~ HTTP File Server / Re: Single login

« on: August 05, 2015, 07:13:49 PM »

No, I am not trying to migrate from a hosting service.  And this doesn't have anything to do with contacts.  I don't know where you got either of those ideas.

The portal is hosted at Rackspace.  HFS will run on a file server here in the Atlanta office. 

I'll have no trouble creating a page within the portal that contains an iframe that refers to the HFS host here in Atlanta.

But, if that's all I do, then when a portal user - who has already logged into the portal - surfs to the page containing the iframe, he will see the HFS login challenge.  This will (rightly) annoy him!  He has already logged into the portal, why should he have to log in again?

I have no issue with creating accounts within HFS to exactly mirror the accounts in the portal.  I have no issue with setting permissions on all these accounts to see the appropriate files/folders in the VFS.

I just want to be able to have the portal somehow "pass a parameter" to HFS to tell it who the currently-logged-in portal user is (e.g. in the iframe's URL), and then have HFS react by silently logging that user in and respecting their permissions. 

Maybe it would entail composing the iframe URL something like:

http://hfs.mycompany.com:1234?user=fred

to tell HFS to connect to the "fred" account.  This need not compromise security; I can arrange it that only calls coming from the portal's IP can connect through the Atlanta firewall to the HFS server.  Thus I can be sure that calls are only made on behalf of already-authenticated portal users.

If there is no existing feature to let me get into HFS with a previously authenticated user name, can anyone advise me as to what it would take to add such a feature?  What technologies and development resources does it take to (re)program HFS?  It's open-source and we have programmers, but alternatively, would anyone care to undertake this enhancement for a fee?

4

HFS ~ HTTP File Server / Different templates for different accounts?

« on: August 05, 2015, 05:26:30 PM »

Is there a way to use different templates for different accounts?

5

HFS ~ HTTP File Server / Controlling permissions for Move, Archive, Get List, Comment...

« on: August 05, 2015, 05:11:21 PM »

Is there a way to control what permissions a user (account) has for a file/folder, apart from Access, Upload and Delete?

In the template it's obvious that there are permissions like "can mkdir", "can comment", "can rename", etc., but how does one control them?  I don't see anywhere in the UI where these permissions can be toggled per account or per file/folder.

6

HFS ~ HTTP File Server / Control access to subfolders

« on: August 05, 2015, 03:09:56 PM »

I have a folder containing other folders, one per user.

I want to share the subfolders to the users via HFS.  Is there an easier way to do this than to individually drag each subfolder into HFS as a real folder (at the top level), create an account for each user, and then tie the individual accounts to the corresponding individual folders?

It would be slightly nicer to drag the parent folder into HFS and then be able to tie accounts to its subfolders, but there doesn't seem to be a way to associate accounts with subfolders of a real folder.  Am I missing something?

7

HFS ~ HTTP File Server / Single login

« on: August 05, 2015, 02:36:21 PM »

Our company has a portal for our customers.  It's hosted on IIS and built in Dot Net Nuke (DNN).

DNN provides basic login features, and each of our customers has account credentials.  I would like to iframe HFS within the site to provide a logged-in customer with upload/download access to files on a server separate from the web host.

This is easily done, except that HFS requires its own login.  I'd like to avoid that since by the time the user gets to the iframed HFS interface, he'll already have been authenticated.

Is there a way to arrange this?  E.g. is there a way to pass some sort of account-identifying parameter/token to HFS on the URL in order to auto-login without challenging the user with a login prompt?

8

HFS ~ HTTP File Server / Re: Limit Folder List by Account

« on: August 04, 2015, 07:19:55 PM »

OK, that's much easier!  Thank you.

9

HFS ~ HTTP File Server / Re: Limit Folder List by Account

« on: August 04, 2015, 03:33:02 PM »

I think I figured it out for myself.  Perhaps there's a better way, but I changed the template section responsible for building the rows in the file/folder list.  Basically, I surrounded each piece of the list with:

{.if|{.and|{.get|can access.}|{.length|%user%.}.}| ...  .}

I.e., I only add a piece to the list if a user is logged in ({.length|%user%.}) and if the user can access the folder/file ({.get|can access.}).

The full section of list-building code now looks like this (new code in blue):

[file=folder=link|private]
{.if|{.and|{.get|can access.}|{.length|%user%.}.}|
   <tr class='{.if|{.mod|{.count|row.}|2.}|even.}'><td>
        <input type='checkbox' class='selector' name='selection' value="%item-url%" {.if not|{.or|{.get|can delete.}|{.get|can access.}|{.get|can archive item.}.}|disabled='disabled'.} />
      {.if|{.get|is new.}|<span class='flag'>&nbsp;NEW&nbsp;</span>.}
      {.if not|{.get|can access.}|<img src='/~img_lock'>.}
      <a href="%item-url%"><img src="%item-icon%"> %item-name%</a>
      {.if| {.length|{.?search.}.} |{:{.123 if 2|<div class='item-folder'>{.!item folder.} |{.breadcrumbs|{:<a href="%bread-url%">%bread-name%/</a>:}|from={.count substring|/|%folder%.}/breadcrumbs.}|</div>.}:} .}
      {.123 if 2|<div class='comment'>|{.commentNL|%item-comment%.}|</div>.}.}

[+file]
{.if|{.and|{.get|can access.}|{.length|%user%.}.}|<td>%item-size%B<td>%item-modified%<td>%item-dl-count%.}

[+folder]
{.if|{.and|{.get|can access.}|{.length|%user%.}.}|<td class='nosize'>folder<td>%item-modified%<td>%item-dl-count%.}

[+link]
{.if|{.and|{.get|can access.}|{.length|%user%.}.}|<td class='nosize'>link<td colspan='2'>.}

(Note the change in red altered the display so the lock symbol only appears next to things the user doesn't have access to.  But this change was mooted by the larger change - since things the user can't access aren't displayed at all!)

A minor issue with this mod is that the code that colors even/odd rows differently (<tr class='{.if|{.mod|{.count|row.}|2.}|even.}'>) references the count within the total file/folder list, not the list filtered by whether the user has access or not.  As a result, the list's rows don't alternate colors as intended. 

If anyone sees a reason why this won't fly, or if anyone knows of a better way to accomplish the desired behavior, please let me know.

10

HFS ~ HTTP File Server / Limit Folder List by Account

« on: August 03, 2015, 11:47:47 PM »

I'm looking for a way to configure/alter HFS so that (a) until an account logs in no files/folders are displayed in the list, and (b) after logging in the account should see only those folders to which it has access.

I'm working in a business that receives data files from each of our customers every quarter.  We have a main share on our network where these files need to go, and within it a folder is allocated for each customer:

MainShare
   Customer1Data
   Customer2Data
   ...

I'd like to use HFS to create 1 account per customer, and give each account Upload rights only to their folder in the share.  But I don't want a customer to even see that there are folders for other customers - our customers should not be aware of who our other customers are.

E.g. when Customer1 surfs to our HFS site, he should only initially see a login challenge - no folders/files.  Then after he logs in, he should only see Customer1Data.  At no time should he see that there even exists a Customer2Data folder.

In general, I don't want to be limited to 1 folder per customer.  That is, maybe Customer1 should have access to 2 folders for their data: Customer1SalesData and Customer1InventoryData.  Until they login to their account, they should see neither (i.e. no folders at all).  After they login, they should see only these 2 folders.  And at no time should any account that doesn't have permissions for either of these folders be able to see that they exist.  (Note that some accounts, i.e. "administrative" accounts, should be allowed to have access to and see all the folders.)

Can something like this be done?