Checksumming of uploaded packages

[gocheese.git] / gocheese.go

diff --git a/gocheese.go b/gocheese.go
index 3c6d1521a754d06edbce07a85fd72cb5f14f23b0..cdbb1358d70789ecd211e0097b6c9e5080775a5e 100644 (file)
--- a/gocheese.go
+++ b/gocheese.go
@@ -298,6 +298,14 @@ func serveUpload(w http.ResponseWriter, r *http.Request) {
                http.Error(w, err.Error(), http.StatusBadRequest)
                return
        }
+       var digestExpected []byte
+       if digestExpectedHex, exists := r.MultipartForm.Value["sha256_digest"]; exists {
+               digestExpected, err = hex.DecodeString(digestExpectedHex[0])
+               if err != nil {
+                       http.Error(w, "bad sha256_digest: "+err.Error(), http.StatusBadRequest)
+                       return
+               }
+       }
        for _, file := range r.MultipartForm.File["content"] {
                filename := file.Filename
                log.Println(r.RemoteAddr, "put", filename, "by", username)
@@ -347,11 +355,22 @@ func serveUpload(w http.ResponseWriter, r *http.Request) {
                        return
                }
                dst.Close()
+               digest := hasher.Sum(nil)
+               if digestExpected != nil {
+                       if bytes.Compare(digestExpected, digest) == 0 {
+                               log.Println(r.RemoteAddr, filename, "good checksum received")
+                       } else {
+                               log.Println(r.RemoteAddr, filename, "bad checksum received")
+                               http.Error(w, "bad checksum", http.StatusBadRequest)
+                               os.Remove(dst.Name())
+                               return
+                       }
+               }
                if err = os.Rename(dst.Name(), path); err != nil {
                        http.Error(w, err.Error(), http.StatusInternalServerError)
                        return
                }
-               if err = ioutil.WriteFile(path+SHA256Ext, hasher.Sum(nil), os.FileMode(0666)); err != nil {
+               if err = ioutil.WriteFile(path+SHA256Ext, digest, os.FileMode(0666)); err != nil {
                        http.Error(w, err.Error(), http.StatusInternalServerError)
                        return
                }
@@ -359,7 +378,8 @@ func serveUpload(w http.ResponseWriter, r *http.Request) {
 }
 
 func handler(w http.ResponseWriter, r *http.Request) {
-       if r.Method == "GET" {
+       switch r.Method {
+       case "GET":
                var path string
                var autorefresh bool
                if strings.HasPrefix(r.URL.Path, *norefreshURLPath) {
@@ -383,8 +403,10 @@ func handler(w http.ResponseWriter, r *http.Request) {
                } else {
                        servePkg(w, r, parts[0], parts[1])
                }
-       } else if r.Method == "POST" {
+       case "POST":
                serveUpload(w, r)
+       default:
+               http.Error(w, "unknown action", http.StatusBadRequest)
        }
 }