fixed 7z, improved security

CHANGELOG.MD

@@ -1,3 +1,11 @@
+# Version 0.9.8
+  ## HOTFIX:
+  * **Core** updated core with python 3.12 http.server guidelines (escaping control characters)
+  * **Server** Now using better temp directory.
+  * **Server** `?folder_data` json used to escape character causing `&` -> `& amp;` in folder name
+  * **Server** Improved Zfunction and better logging
+  * **Server** Fixed 7z issue since 7z subprocess took ns time to start (but main thread assumed it was done)
+
 # Version 0.9.7
   ## HOTFIX:
   * Fixed requests requirement in the list

VERSION

@@ -1 +1 @@
-0.9.7
+0.9.8

dev_src/_list_maker.py

@@ -215,14 +215,18 @@ def list_directory_html(self:SH, path, user:User, cookie:Union[SimpleCookie, str
 
 
 
-def list_directory(self:SH, path, user:User, cookie:Union[SimpleCookie, str]=None):
+def list_directory(self:SH, path, user:User, cookie:Union[SimpleCookie, str]=None, escape_html=False):
 	"""
 	Helper to produce a directory listing (absent index.html).
 
 	Return value is either a file object, or None (indicating an
 	error).  In either case, the headers are sent, making the
 	interface the same as for send_head().
 
+	path: path to the directory
+	user: User object
+	cookie: cookie object
+	escape_html: whether to escape html or not (default: False, since it will be sent as json)
 	"""
 	try:
 		dir_list = scansort(os.scandir(path))
@@ -232,7 +236,10 @@ def list_directory(self:SH, path, user:User, cookie:Union[SimpleCookie, str]=Non
 			"No permission to list directory")
 		return None
 
-	displaypath = self.get_displaypath(self.url_path)
+	displaypath = self.get_displaypath(
+		url_path=self.url_path,
+		escape_html=escape_html
+	)
 
 
 	title = get_titles(displaypath)
@@ -252,6 +259,9 @@ def list_directory(self:SH, path, user:User, cookie:Union[SimpleCookie, str]=Non
 		#fullname = os.path.join(path, name)
 		name = file.name
 		displayname = linkname = name
+
+		if escape_html:
+			displayname = html.escape(displayname, quote=False)
 		size=0
 		# Append / for directories or @ for symbolic links
 		_is_dir_ = True
@@ -266,22 +276,22 @@ def list_directory(self:SH, path, user:User, cookie:Union[SimpleCookie, str]=Non
 			__, ext = posixpath.splitext(name)
 			if ext=='.html':
 				r_li.append('h'+ urllib.parse.quote(linkname, errors='surrogatepass'))
-				f_li.append(html.escape(displayname, quote=False))
+				f_li.append(displayname)
 
 			elif self.guess_type(linkname).startswith('video/'):
 				r_li.append('v'+ urllib.parse.quote(linkname, errors='surrogatepass'))
-				f_li.append(html.escape(displayname, quote=False))
+				f_li.append(displayname)
 
 			elif self.guess_type(linkname).startswith('image/'):
 				r_li.append('i'+ urllib.parse.quote(linkname, errors='surrogatepass'))
-				f_li.append(html.escape(displayname, quote=False))
+				f_li.append(displayname)
 
 			else:
 				r_li.append('f'+ urllib.parse.quote(linkname, errors='surrogatepass'))
-				f_li.append(html.escape(displayname, quote=False))
+				f_li.append(displayname)
 		if _is_dir_:
 			r_li.append('d' + urllib.parse.quote(linkname, errors='surrogatepass'))
-			f_li.append(html.escape(displayname, quote=False))
+			f_li.append(displayname)
 
 		s_li.append(size)
 

dev_src/_zipfly_manager.py

@@ -17,6 +17,10 @@
 from collections import OrderedDict
 import re
 
+from logging import Logger
+
+logger = Logger(__name__)
+
 
 
 from _fs_utils import get_dir_m_time, _get_tree_path_n_size, humanbytes
@@ -302,6 +306,9 @@ def process_thread():
 		t = threading.Thread(target=process_thread)
 		t.start()
 
+		time.sleep(0.2)
+
+
 		while self.running_process:
 			if self.running_process.stdout is None:
 				break
@@ -499,7 +506,7 @@ def zip7z_handler(self, path, zid, source_size, zfile_name, err):
 
 		try:
 			for progress in zip7z_obj.make_zip_with_7z_generator(path, zfile_name):
-				print([progress])
+				logger.info(f"Zipping {[path]}: {[progress]}")
 				self.zip_in_progress[zid] = int(progress[:-1])
 		except Exception as e:
 			traceback.print_exc()

dev_src/clone.py

@@ -247,21 +247,25 @@ def main():
 
 	check_exist = "date+"
 	o = None
-	while not o:
+	while o not in ["date", "date+", "size", ""]:
 		o = input("""Check exist? [Default: date+]
 date: download if remote file is update time same as local file
 date+: download if remote file is newer or same as local file (ignored if local file is newer)
 size: download if remote file size is different from local file
 >>> """)
 		if o in ["date", "date+", "size"]:
 			check_exist = o
-		else:
-			o = None
+		if o == "":
+			check_exist = "date+"
 
 	delete_extras = False
-	o = input("Delete extras? (y/n) [Default: n]: ")
-	if o.lower() == "y":
-		delete_extras = True
+
+	o = None
+	while o not in ["y", "n", ""]:
+		o = input("Delete extras? (y/n) [Default: n]: ")
+		if o.lower() == "y":
+			delete_extras = True
+
 
 	cloner = Cloner()