From 96353aee3d5e07e8e07f4860729dc5602796b732 Mon Sep 17 00:00:00 2001
From: Ingo Oppermann <ingo@datarhei.com>
Date: Tue, 23 Aug 2022 08:32:49 +0300
Subject: [PATCH] Fix panic if s3 is not enabled, fix value in closure

---
 app/api/api.go | 88 +++++++++++++++++++++++++++-----------------------
 http/fs/fs.go  |  2 ++
 http/server.go | 40 ++++++++++++++---------
 3 files changed, 75 insertions(+), 55 deletions(-)

diff --git a/app/api/api.go b/app/api/api.go
index 644708d5..6e66f97a 100644
--- a/app/api/api.go
+++ b/app/api/api.go
@@ -829,6 +829,51 @@ func (a *api) start() error {
 
 	a.log.logger.main = a.log.logger.core.WithComponent(logcontext).WithField("address", cfg.Address)
 
+	filesystems := []httpfs.FS{
+		{
+			Name:               "diskfs",
+			Mountpoint:         "",
+			AllowWrite:         false,
+			EnableAuth:         false,
+			Username:           "",
+			Password:           "",
+			DefaultFile:        "index.html",
+			DefaultContentType: "text/html",
+			Gzip:               true,
+			Filesystem:         diskfs,
+			Cache:              a.cache,
+		},
+		{
+			Name:               "memfs",
+			Mountpoint:         "/memfs",
+			AllowWrite:         true,
+			EnableAuth:         cfg.Storage.Memory.Auth.Enable,
+			Username:           cfg.Storage.Memory.Auth.Username,
+			Password:           cfg.Storage.Memory.Auth.Password,
+			DefaultFile:        "",
+			DefaultContentType: "application/data",
+			Gzip:               true,
+			Filesystem:         a.memfs,
+			Cache:              nil,
+		},
+	}
+
+	if a.s3fs != nil {
+		filesystems = append(filesystems, httpfs.FS{
+			Name:               "s3fs",
+			Mountpoint:         "/s3",
+			AllowWrite:         true,
+			EnableAuth:         cfg.Storage.S3.Auth.Enable,
+			Username:           cfg.Storage.S3.Auth.Username,
+			Password:           cfg.Storage.S3.Auth.Password,
+			DefaultFile:        "",
+			DefaultContentType: "application/data",
+			Gzip:               true,
+			Filesystem:         a.s3fs,
+			Cache:              a.cache,
+		})
+	}
+
 	serverConfig := http.Config{
 		Logger:        a.log.logger.main,
 		LogBuffer:     a.log.buffer,
@@ -836,46 +881,9 @@ func (a *api) start() error {
 		Metrics:       a.metrics,
 		Prometheus:    a.prom,
 		MimeTypesFile: cfg.Storage.MimeTypes,
-		Filesystems: []httpfs.FS{
-			{
-				Name:               "diskfs",
-				Mountpoint:         "/",
-				AllowWrite:         false,
-				Username:           "",
-				Password:           "",
-				DefaultFile:        "index.html",
-				DefaultContentType: "text/html",
-				Gzip:               true,
-				Filesystem:         diskfs,
-				Cache:              a.cache,
-			},
-			{
-				Name:               "memfs",
-				Mountpoint:         "/memfs",
-				AllowWrite:         cfg.Storage.Memory.Auth.Enable,
-				Username:           cfg.Storage.Memory.Auth.Username,
-				Password:           cfg.Storage.Memory.Auth.Password,
-				DefaultFile:        "",
-				DefaultContentType: "application/data",
-				Gzip:               true,
-				Filesystem:         a.memfs,
-				Cache:              a.cache,
-			},
-			{
-				Name:               "s3fs",
-				Mountpoint:         "/s3",
-				AllowWrite:         cfg.Storage.S3.Auth.Enable,
-				Username:           cfg.Storage.S3.Auth.Username,
-				Password:           cfg.Storage.S3.Auth.Password,
-				DefaultFile:        "",
-				DefaultContentType: "application/data",
-				Gzip:               true,
-				Filesystem:         a.s3fs,
-				Cache:              a.cache,
-			},
-		},
-		IPLimiter: iplimiter,
-		Profiling: cfg.Debug.Profiling,
+		Filesystems:   filesystems,
+		IPLimiter:     iplimiter,
+		Profiling:     cfg.Debug.Profiling,
 		Cors: http.CorsConfig{
 			Origins: cfg.Storage.CORS.Origins,
 		},
diff --git a/http/fs/fs.go b/http/fs/fs.go
index 0e5eed7c..500ab733 100644
--- a/http/fs/fs.go
+++ b/http/fs/fs.go
@@ -10,6 +10,8 @@ type FS struct {
 	Mountpoint string
 
 	AllowWrite bool
+
+	EnableAuth bool
 	Username   string
 	Password   string
 
diff --git a/http/server.go b/http/server.go
index 68281edf..4cd8c562 100644
--- a/http/server.go
+++ b/http/server.go
@@ -424,7 +424,15 @@ func (s *server) setRoutes() {
 
 	// Mount filesystems
 	for _, filesystem := range s.filesystems {
-		fs := s.router.Group(filesystem.Mountpoint + "/*")
+		// Define a local variable because later in the loop we have a closure
+		filesystem := filesystem
+
+		mountpoint := filesystem.Mountpoint + "/*"
+		if filesystem.Mountpoint == "/" {
+			mountpoint = "/*"
+		}
+
+		fs := s.router.Group(mountpoint)
 		fs.Use(mwmime.NewWithConfig(mwmime.Config{
 			MimeTypesFile:      s.mimeTypesFile,
 			DefaultContentType: filesystem.DefaultContentType,
@@ -448,22 +456,24 @@ func (s *server) setRoutes() {
 		fs.GET("", filesystem.handler.GetFile)
 		fs.HEAD("", filesystem.handler.GetFile)
 
-		if len(filesystem.Username) != 0 || len(filesystem.Password) != 0 {
-			authmw := middleware.BasicAuth(func(username, password string, c echo.Context) (bool, error) {
-				if username == filesystem.Username && password == filesystem.Password {
-					return true, nil
-				}
+		if filesystem.AllowWrite {
+			if filesystem.EnableAuth {
+				authmw := middleware.BasicAuth(func(username, password string, c echo.Context) (bool, error) {
+					if username == filesystem.Username && password == filesystem.Password {
+						return true, nil
+					}
 
-				return false, nil
-			})
+					return false, nil
+				})
 
-			fs.POST("", filesystem.handler.PutFile, authmw)
-			fs.PUT("", filesystem.handler.PutFile, authmw)
-			fs.DELETE("", filesystem.handler.DeleteFile, authmw)
-		} else {
-			fs.POST("", filesystem.handler.PutFile)
-			fs.PUT("", filesystem.handler.PutFile)
-			fs.DELETE("", filesystem.handler.DeleteFile)
+				fs.POST("", filesystem.handler.PutFile, authmw)
+				fs.PUT("", filesystem.handler.PutFile, authmw)
+				fs.DELETE("", filesystem.handler.DeleteFile, authmw)
+			} else {
+				fs.POST("", filesystem.handler.PutFile)
+				fs.PUT("", filesystem.handler.PutFile)
+				fs.DELETE("", filesystem.handler.DeleteFile)
+			}
 		}
 	}