eberkheev
c467a4d254
A token passed as `?token=` was accepted on every route, so it ended up in the request log (and journald), browser history and Referer. - drop `?token=` from _check_auth; API and download routes now take only the cookie or an Authorization: Bearer header - keep pre-authenticated links working: on the index route a valid `?token=` is swapped for the cookie and redirected to a clean URL, so the secret does not linger in the address bar - redact `token=` from log output - send Referrer-Policy: no-referrer, and mark the cookie Secure
87 lines
2.5 KiB
Markdown
87 lines
2.5 KiB
Markdown
# Share
|
|
|
|
Local network file sharing via web page. Drag & drop, Ctrl+V paste, download.
|
|
|
|
No dependencies — Python 3 stdlib only.
|
|
|
|
Setting this up on a new machine? See [SETUP.md](SETUP.md).
|
|
|
|
## Quick start
|
|
|
|
```
|
|
./install.sh # generates a token, installs + starts the systemd service
|
|
```
|
|
|
|
Or run it in the foreground without installing anything:
|
|
|
|
```
|
|
cp share.config.example share.config # then set `token` in it
|
|
python3 share.py
|
|
```
|
|
|
|
Open `https://localhost:3001` in a browser. The network address is printed at
|
|
startup. The cert is self-signed, so expect a browser warning on first visit.
|
|
|
|
## Options
|
|
|
|
CLI flags override `share.config`.
|
|
|
|
```
|
|
python3 share.py -p 3001 -d ~/Downloads/shared --ttl 7
|
|
```
|
|
|
|
| Flag | Default | Description |
|
|
|------|---------|-------------|
|
|
| `-p`, `--port` | `3001` | Port |
|
|
| `-d`, `--dir` | `~/Downloads/shared` | Upload directory |
|
|
| `--ttl` | `7` | File lifetime in days (0 = keep forever) |
|
|
| `--token` | | Auth token (empty = open access) |
|
|
| `--cert` | | Path to SSL certificate |
|
|
| `--key` | | Path to SSL key |
|
|
|
|
## Authentication
|
|
|
|
Set `token` in `share.config` or pass `--token`. All endpoints require a valid
|
|
token. An empty `token` means open access to everyone on the network.
|
|
|
|
The token is accepted as an `Authorization: Bearer` header or the `share_token`
|
|
cookie set by the login page. A `?token=` link works only on `/` — it is exchanged
|
|
for the cookie and redirected away so the secret does not linger in the URL.
|
|
|
|
`share.config` is gitignored because it holds the secret — `share.config.example`
|
|
is the tracked template.
|
|
|
|
The token can be stored as plain text or as a SHA-256 hash:
|
|
|
|
```
|
|
# generate hash
|
|
python3 share.py hash mytoken
|
|
|
|
# store in share.config
|
|
token = 9c56cc51b374c3ba189210d5b6d0d04...
|
|
```
|
|
|
|
If the value is a 64-character hex string, it is treated as a hash. Otherwise it is hashed automatically at startup.
|
|
|
|
## systemd (Arch)
|
|
|
|
Installed by `./install.sh` from `share.service.template` to
|
|
`~/.config/systemd/user/share.service`. Restart after editing `share.config` —
|
|
it is only read at startup.
|
|
|
|
```
|
|
systemctl --user enable --now share # start + autostart
|
|
systemctl --user restart share # restart
|
|
systemctl --user stop share # stop
|
|
journalctl --user -u share -f # logs
|
|
```
|
|
|
|
## Features
|
|
|
|
- Drag & drop files onto the page
|
|
- Ctrl+V to paste images / files from clipboard
|
|
- Click the drop zone to open file picker
|
|
- Upload progress bar
|
|
- File list with download and delete
|
|
- Auto-cleanup of old files (configurable via `--ttl`)
|