Commit Graph

205 Commits

Author SHA1 Message Date
Thomas (Tom) Piccirello
7ddbf58a3b WebAPI: Respond with more detailed info
* WebAPI: return error message when endpoint not found
* WebAPI: send appropriate status code when logging in
* WebAPI: return more info when adding torrents

PR #23202.
Closes #375.
Closes #10688.
Closes #10747.
Closes #11464.
2025-09-12 17:53:48 +03:00
Thomas (Tom) Piccirello
69b2d7a53e WebAPI: Support persisting WebUI client preferences
This provides a mechanism for persisting WebUI client preferences that are distinct from the broader qBittorrent preferences. These preferences apply exclusively to the WebUI.

PR #23088.
2025-09-12 17:47:32 +03:00
Thomas Piccirello
0c48b70e5b Send 204 when WebAPI response contains no data
PR #21349.
2025-06-05 09:25:04 +03:00
Vladimir Golovnev
841cffafa7 Restore ability to use server-side translation by custom WebUI
PR #20968.
2025-03-30 09:47:21 +03:00
Hanabishi
3abdc3134b WebUI: Disable alternative UI in case of the index page being inaccessible
Initial failed access shows an error as before, but on the next reload it falls back to the default WebUI.

PR #22399.
Closes #18401.
2025-03-29 20:32:22 +08:00
Chocobo1
8d0870c953 Switch to string view where applicable
PR #22438.
2025-03-17 19:28:38 +08:00
Chocobo1
5a4b3b25d3 Use slice method where applicable
These code segments already have its boundary checked and can thus be faster.

PR #22411.
2025-03-15 14:58:59 +08:00
Vladimir Golovnev
d174bc75e4 Show free disk space in status bar
PR #22407.
Closes #19607.
2025-03-13 14:47:10 +03:00
Chocobo1
8da43a4054 Use const accessor
This avoids an unnecessary check to the container internal atomic variable and prevents
potential detachment.

PR #22280.
2025-02-16 15:51:40 +08:00
Chocobo1
4c6dd8e68d Remove wrong conditional in Origin trustworthy check
It might block WebUI from logging in under specific network configurations.

Fix up 130c0d8487.
PR #21972.
2024-12-13 16:12:29 +08:00
Thomas Piccirello
78a5e4ff3e WebUI: Display error when download fails
Previously we would still download the file but it would contain the error response, resulting in an invalid file.
To test: export a .torrent file for a torrent that hasn't yet downloaded metadata

PR #21696.

Signed-off-by: Thomas Piccirello <thomas@piccirello.com>
2024-11-23 16:03:43 +08:00
Chocobo1
051d7137ea Use proper macro for unreachable switch cases
Those are the `default` cases which are not expected to hit (nor reachable) normally.

When the code is compiled with release mode and it reaches `Q_UNREACHABLE()`, it becomes
undefined behavior. So it rely on the developers to catch the errors in debug mode.
The upside of this is that the `switch` statement will be more optimized than not using it.
This also means the statements after `Q_UNREACHABLE()` isn't important. It allow anything to
preserve the intention of the code.

This macro is preferred over C++23 `std::unreachable` because it will automatically insert a
`Q_ASSERT(false)` with it.

PR #21752.
2024-11-05 11:55:55 +08:00
dyseg
ab8d0d1dae Free resources allocated by web session once it is destructed
PR #21618.
Closes #20873.
2024-10-21 09:23:08 +03:00
Chocobo1
9e5433bcf8 Add name to threads
This help identifying threads when debugging.
The naming scheme is using 'class/function name + variable name'.
Note that the length limitaion is 16 chars on linux. On Windows, the limit is 32767 chars.

PR #21403.
2024-10-06 15:23:50 +08:00
Chocobo1
130c0d8487 Revise cookie 'secure flag' enable condition
The localhost is 'potentially trustworthy' and RFC 6265 allows setting secure flag in this case.
Also check `X-Forwarded-Proto` header value to support reverse proxy usage.

Note: for reverse proxy users, now the `X-Forwarded-Proto` header is expected to be sent to qbt
otherwise the `secure` flag might be set erroneously.

https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.2.5
https://w3c.github.io/webappsec-secure-contexts/#is-origin-trustworthy

Closes #21250.
PR #21260.
2024-09-07 21:38:27 +08:00
Chocobo1
fc82abe7f6 Remove 'loopback address detection' helper function
It is not needed since `QHostAddress::isLoopback()` can do the job.
PR #21259.
2024-08-31 15:53:39 +08:00
Chocobo1
155fe96bdd Revise quote escaping for translated strings in WebUI
qbt only need to escape double quotes for the sake of HTML attributes. As for single quotes it
can leave them as-is since WebUI enforce using double quotes for strings.

PR #21180.
2024-08-12 14:59:30 +08:00
Chocobo1
b1b6685663 Use Qt built-in methods 2024-05-27 23:52:39 +08:00
Chocobo1
534615373e Use simpler conversion
The cookie value can only contain ASCII characters.
2024-05-27 23:40:40 +08:00
Vladimir Golovnev
0114610a40 Provide torrent creation feature via WebAPI
PR #20366.
Closes #5614.

Co-authored-by: Radu Carpa <radu.carpa@cern.ch>
2024-02-27 15:57:16 +03:00
Vladimir Golovnev
60bb819e2e Allow WebAPI to specify filename and mime type for result data
PR #20377.
2024-02-12 09:07:09 +03:00
Chocobo1
f87ea1b5d3 Sort languages combobox by language code
* Avoid creating redundant file lists
* Sort languages combobox by language code

PR #20365.
2024-02-05 13:44:18 +08:00
Vladimir Golovnev
0f40fad74d Drop WebUI default credentials
PR #19777.
2023-11-10 07:18:42 +03:00
Vladimir Golovnev
c88bd7cb3f Improve free disk space checking for WebAPI
Use single free disk space checker instance for all the web sessions.

PR #19855.
Closes #19732.
2023-11-07 12:44:27 +03:00
Vladimir Golovnev
dcf3e97291 Implement gateway for adding new torrents
PR #19355.
2023-08-14 18:17:56 +03:00
Chocobo1
80791e328d Fix wrong behavior when reading text
Also add another 'file read error' status.

Closes #19254.
PR #19262.
2023-07-02 13:23:20 +08:00
Chocobo1
e6d85a468b Rename literal operator
Qt 6.4 introduced `QString operator""_s()` and the previous `""_qs` is
deprecated since Qt 6.8.
2023-06-18 03:32:44 +08:00
Chocobo1
f6b58f36e2 WebUI: set Cross Origin Opener Policy to same-origin
This separates browsing context for different origin sites and prevents
leaking data from it.
This header is only present when using built-in WebUI. Alternative WebUI
is not affected.
https://web.dev/why-coop-coep/#coop

PR #19157.
2023-06-14 13:38:48 +08:00
Chocobo1
79ca2e145f Don't read unlimited data from files
It now guards against reading infinite files such as `/dev/zero`.
And most readings are bound with a (lax) limit.
As a side effect, more checking are done when reading a file and
overall the reading procedure is more robust.

PR #19095.
2023-06-14 13:38:19 +08:00
Chocobo1
179a61d75e Add curly braces 2023-05-07 19:41:55 +08:00
七海千秋
1e400df324 Set "SameSite=None" if CSRF Protection is disabled
PR #18843.
2023-04-16 14:27:49 +03:00
Vladimir Golovnev
58a654a70f Reject requests that contain backslash in path
PR #18626.
Closes #18618.
2023-02-27 16:50:50 +03:00
Vladimir Golovnev
72ac92ec68 Allow to use another icons in dark mode
PR #18435.
2023-02-07 22:07:15 +03:00
Vladimir Golovnev
c58fb92365 Suppress warning when session cookie name isn't overridden
PR #18455.
2023-01-26 07:00:20 +03:00
Vladimir Golovnev
771c58d000 WebAPI: Allow to specify session cookie name
PR #18384.
Closes #18329.
2023-01-17 09:31:17 +03:00
brvphoenix
b33dc7d831 Unify the way to generate the language list in WebUI and GUI
PR #17994.
2022-12-25 16:44:37 +03:00
Chocobo1
109c45bb95 Allow to use subnet notation in reverse proxy list
Closes #17475.
2022-09-08 14:44:18 +08:00
Chocobo1
851374e517 Rename function 2022-09-07 14:11:23 +08:00
Chocobo1
082e6f8830 Apply i18n translation only to built-in WebUI 2022-08-27 13:55:05 +08:00
Chocobo1
ee38124db7 Optimize symbolic links checking 2022-08-27 13:55:04 +08:00
Chocobo1
e06e1d9911 Throw error exception properly 2022-08-27 13:55:04 +08:00
Chocobo1
3851e76179 Remove special handling of icons 2022-08-27 13:55:04 +08:00
Chocobo1
aa6b29fe7e Set HTTP method restriction on WebAPI actions
PR #17548.
2022-08-15 11:56:59 +08:00
Chocobo1
5d1115f591 Remove compile-time conditional
This checking should be universally applied and not limited to certain OS.
2022-07-25 01:18:42 +08:00
Vladimir Golovnev
f8a304abdc Implement base classes for application components
PR #17219.
2022-06-25 15:46:55 +03:00
Tom Piccirello
fb7f7d0c75 Add support for exporting .torrent from WebUI
PR #16968.
2022-05-04 12:13:24 +08:00
Requi
669b67e666 WebAPI: return correct status
Fix web API returning Not Found instead of Forbidden.

When not having a session the API would return "Not Found" instead of "Forbidden" when trying to access a non-public endpoint.

PR #16866.
2022-04-14 08:26:19 +03:00
Vladimir Golovnev
4471a6377e Have separate API controller instances per session
PR #16848.
2022-04-12 13:39:35 +03:00
Chocobo1
4ca6de2b54 Revise string literal usage
PR #16703.
2022-03-26 11:53:50 +08:00
Chocobo1
efc04645b7 Use QString literals
It covers src/webui and enables `QT_NO_CAST_FROM_ASCII`.
2022-03-20 13:33:40 +08:00