Merge remote-tracking branch 'github/master' into portable

debomatic-webui/debomatic-webui

@@ -34,24 +34,44 @@ if ('development' == env) {
 app.set('views', __dirname + '/views');
 app.set('view engine', 'ejs');
 
-// Routes
+// index page
 app.get('/', routes.index);
+
 // distibution page
 app.get(config.routes.distribution, routes.distribution);
+
 // parefernces page
 if (config.routes.preferences)
     app.get(config.routes.preferences, routes.preferences);
+
 // commands page
 if (config.routes.commands)
     app.get(config.routes.commands, routes.commands);
+
 // debomatic static page
-app.use(config.routes.debomatic, serve_static(config.debomatic.path));
-app.use(config.routes.debomatic, serve_index(config.debomatic.path, {
-    filter: function (filename) {
-        // do not show these files and directories
-        return ['dev', 'sys'].indexOf(filename) < 0;
-    }
-}));
+if (config.routes.debomatic) {
+    app.all(config.routes.debomatic + '*', function (req, res, next) {
+        // send 403 status when users want to browse the chroots:
+        // - unstable/unstable
+        // - unstable/build/*
+        // this prevents system crashes
+        var base = config.routes.debomatic;
+        base += base[base.length - 1] != '/' ? '/' : ''; // append /
+        var match = req.url.replace(base, '').split('/');
+        if (match[match.length - 1] === '') match.pop();
+        if (match.length >= 2 && (
+            (match[0] == match[1]) || /* case unstable/unstable */
+            (match[1] == 'build' && match.length > 2) /* case unstable/build/* */
+        )) {
+            res.status(403).send('<h1>403 Forbidden</h1>');
+        } else
+            next(); // call next() here to move on to next middleware/router
+    });
+
+    app.use(config.routes.debomatic, serve_static(config.debomatic.path));
+    app.use(config.routes.debomatic, serve_index(config.debomatic.path));
+}
+
 // serve stylesheet-javascript
 app.use(serve_static(__dirname + '/public'));
 

debomatic-webui/views/index.ejs

@@ -11,11 +11,11 @@
       <section>
         <p>Welcome to debomatic web interface. Here you can monitor debomatic service,
         browse the packages already built and real-time check the building process of a new incoming
-        package. 
-        <p>Most of these actions can be taken in 
+        package.
+        <p>Most of these actions can be taken in
         <a href="<%= web.paths.distribution %>">distribution</a> page. </p>
 
-        <p>If you want a bit customization 
+        <p>If you want a bit customization
         check the <a href="<%= web.paths.preferences %>">preferences</a> page out.</p>
 
       </section>
@@ -30,12 +30,13 @@
           <p>For build account requests please mail <span subject="Build account request for <%= web.debomatic.dput.host %>" address="<%= web.debomatic.admin.email %>" class="email"></span>.</p>
         </div>
       </div>
-
+      <% if (web.paths.debomatic) { %>
       <section>
-        <p class="alert alert-warning"><strong>Remember:</strong> if you do not find here what you are 
-          looking for, you are always able to browse debomatic static directory 
+        <p class="alert alert-warning"><strong>Remember:</strong> if you do not find here what you are
+          looking for, you are always able to browse debomatic static directory
           in <a class="alert-link" href="<%= web.paths.debomatic %>">this page</a>.</p>
       </section>
+      <% } %>
     </article>
 
     <article id="configuration" >
@@ -94,15 +95,15 @@ scp_compress   = 1
       <header><h3>About debomatic</h3></header>
       <section>
         <p><strong>Deb-o-Matic</strong> is an easy to use utility to build Debian source packages, meant
-        to help developers to automate building of their packages with limited user interaction 
+        to help developers to automate building of their packages with limited user interaction
         and a simple startup configuration.</p>
 
         <p>It provides some useful features such as automatic chroot update, rebuilds of
         source packages, post-build checks, and much more.</p>
-        
-        <p>It is also extendable using modules that are loaded and executed 
+
+        <p>It is also extendable using modules that are loaded and executed
         during the build phases.</p>
-        
+
         <p><a class="btn btn-primary" href="http://launchpad.net/debomatic">Get more!</a></p>
       </section>
     </article>
@@ -112,7 +113,7 @@ scp_compress   = 1
       <section>
         <p><strong>debomatic-webui</strong> is a web interface for Deb-o-Matic aims to give to users a simple
         way to browse logs and to know what's going on debomatic build service providing a real-time packages status.</p>
-        
+
         <p>This interface is built up on <a href="//nodejs.org">node</a> platform
         and uses intensely <a href="//socket.io">socket.io</a> and <a href="//jquery.com/">jquery</a> technologies.</p>
 
@@ -125,4 +126,4 @@ scp_compress   = 1
   </section>
 </article>
 
-<% include footer.ejs %>
\ No newline at end of file
+<% include footer.ejs %>