WooYun.org

function download()
    local fs = require("nixio.fs")
    local mime = require("luci.http.protocol.mime")
    local ltn12 = require("luci.ltn12")
    local log = require("xiaoqiang.XQLog")
    
    local path = LuciHttp.formvalue("path")
    if XQFunction.isStrNil(path) then
        LuciHttp.status(404, _("no Such file"))
        return
    end
    local constPrefix1 = "/userdisk/data/"
    local constPrefix2 = "/extdisks/"
    local constPrefix3 = "/userdisk/privacyData/"
    if (string.sub(path, 1, string.len(constPrefix1)) ~= constPrefix1) and (string.sub(path, 1, string.len(constPrefix2)) ~= constPrefix2) and (string.sub(path, 1, string.len(constPrefix3)) ~= constPrefix3) then
        LuciHttp.status(403, _("no permission"))
        return
    end
    -- check privacy disk permission by md5 device mac address
    if string.sub(path, 1, string.len(constPrefix3)) == constPrefix3 then
        local secret = LuciHttp.formvalue("secret")
        if XQFunction.isStrNil(secret) then
            LuciHttp.status(403, _("no permission"))
            return
        end
        log.log(3, "=============secret = " .. secret)
        local access = false
        local XQCryptoUtil = require("xiaoqiang.util.XQCryptoUtil")
        local XQDeviceUtil = require("xiaoqiang.util.XQDeviceUtil")
        local macfilterInfoList = XQDeviceUtil.getMacfilterInfoList()
        for _,value in ipairs(macfilterInfoList) do
            if XQFunction.isStrNil(value.mac) == false then
                log.log(3, "=============mac = " .. value.mac)
                if string.lower(XQCryptoUtil.md5Str(string.lower(value.mac))) == string.lower(secret) then
                    log.log(3, "=============device found")
                    if value.pridisk then
                        access = true
                    end
                    break
                end
            end
        end
        if access == false then
            LuciHttp.status(403, _("no permission"))
            return
        end
    end
    log.log(3, "=============path = " .. path)
    local stat = fs.stat(path)
    if not stat then
        LuciHttp.status(404, _("no Such file"))
        return
    end
    LuciHttp.header("Accept-Ranges", "bytes")
    LuciHttp.header("Content-Type", mime.to_mime(path))
    local range = LuciHttp.getenv("HTTP_RANGE")
    -- format: bytes=123-
    if range then
        LuciHttp.status(206)
        range = string.gsub(range, "bytes=", "")
        range = string.gsub(range, "-", "")
    else
        range = 0
    end
    log.log(3, "=============range = " .. range)
    -- format: bytes 123-456/457
    local contentRange = "bytes " .. range .. "-" .. (stat.size - 1) .. "/" .. stat.size
    log.log(3, "=============contentRange = " .. contentRange)
    LuciHttp.header("Content-Length", stat.size - range)
    LuciHttp.header("Content-Range", contentRange)
    LuciHttp.header("Content-Disposition", "attachment; filename=" .. fs.basename(path))
    if string.sub(path, 1, string.len(constPrefix1)) == constPrefix1 then
        LuciHttp.header("X-Accel-Redirect", string.gsub(path, constPrefix1, "/download-userdisk/"))
    elseif string.sub(path, 1, string.len(constPrefix2)) == constPrefix2 then
        LuciHttp.header("X-Accel-Redirect", string.gsub(path, constPrefix2, "/download-extdisks/"))
    elseif string.sub(path, 1, string.len(constPrefix3)) == constPrefix3 then
        LuciHttp.header("X-Accel-Redirect", string.gsub(path, constPrefix3, "/download-pridisk/"))
    end
    --local file = io.open(path, "r")
    --local position = file:seek("set", range)
    --log.log(3, "=============position = " .. position)
    --ltn12.pump.all(ltn12.source.file(file), LuciHttp.write)
end

function getMacfilterInfoList()
    local LuciUtil = require("luci.util")
    local macFilterInfo = {}
    local metaData = LuciUtil.execi("/usr/sbin/sysapi macfilter get")
    for filterInfo in metaData do
        filterInfo = filterInfo..";"
        local mac = filterInfo:match('mac=(%S-);') or ""
        local wan = filterInfo:match('wan=(%S-);') or ""
        local lan = filterInfo:match('lan=(%S-);') or ""
        local admin = filterInfo:match('admin=(%S-);') or ""
        local pridisk = filterInfo:match('pridisk=(%S-);') or ""
        local entry = {}
        if (not XQFunction.isStrNil(mac)) then
            entry["mac"] = XQFunction.macFormat(mac)
            entry["wan"] = (string.upper(wan) == "YES" and true or false)
            entry["lan"] = (string.upper(lan) == "YES" and true or false)
            entry["admin"] = (string.upper(admin) == "YES" and true or false)
            entry["pridisk"] = (string.upper(pridisk) == "YES" and true or false)
            table.insert(macFilterInfo, entry)
        end
    end
    return macFilterInfo
end