Merge pull request #13 from gloomy-ghost/password

allow configuring a password for uploading

config.py

@@ -5,3 +5,5 @@ DB = 'elimage.db'
 
 XHEADERS = True # you may set this to false if not behind another server
 CLOUDFLARE = False
+
+UPLOAD_PASSWORD = ''

main.py

@@ -8,6 +8,7 @@ from collections import OrderedDict
 import mimetypes
 import subprocess
 from functools import lru_cache
+from hmac import compare_digest
 
 import tornado.web
 import tornado.template
@@ -73,7 +74,10 @@ class IndexHandler(tornado.web.RequestHandler):
       else:
         self.index_template = tornado.template.Template(
           text, compress_whitespace=False)
-        content = self.index_template.generate(url=self.request.full_url())
+        content = self.index_template.generate(
+          url=self.request.full_url(),
+          password_required=bool(self.settings['password'])
+        )
         self.write(content)
 
   def post(self):
@@ -87,6 +91,12 @@ class IndexHandler(tornado.web.RequestHandler):
       else:
         uid = user['id']
 
+    # Check whether password is required
+    expected_password = self.settings['password']
+    if expected_password and \
+      not compare_digest(self.get_argument('password'), expected_password):
+        raise tornado.web.HTTPError(403, 'You need a valid password to post.')
+
     files = self.request.files
     if not files:
       raise tornado.web.HTTPError(400, 'upload your image please')
@@ -199,7 +209,8 @@ def main():
   define("address", default='', help="run on the given address", type=str)
   define("datadir", default=DEFAULT_DATA_DIR, help="the directory to put uploaded data", type=str)
   define("fork", default=False, help="fork after startup", type=bool)
-  define("cloudflare", default=False, help="check for Cloudflare IPs", type=bool)
+  define("cloudflare", default=CLOUDFLARE, help="check for Cloudflare IPs", type=bool)
+  define("password", default=UPLOAD_PASSWORD, help="optional password", type=str)
 
   tornado.options.parse_command_line()
   if options.fork:
@@ -223,6 +234,7 @@ def main():
     datadir=options.datadir,
     debug=DEBUG,
     template_path=os.path.join(os.path.dirname(__file__), "templates"),
+    password=UPLOAD_PASSWORD,
   )
   http_server = tornado.httpserver.HTTPServer(
     application,

templates/index.html

@@ -11,7 +11,7 @@ NAME
 SYNOPSIS
     curl -F 'name=@/path/to/image' {{ url }}
 
-    Or upload via your browser: <form action="/" method="post" enctype="multipart/form-data" style="display: inline;"><input type="file" name="image" width="10" multiple accept="image/*"/><input type="submit" value="Upload!"/></form>
+    Or upload via your browser: <form action="/" method="post" enctype="multipart/form-data" style="display: inline;"><input type="file" name="image" width="10" multiple accept="image/*"/>{% if password_required %}<input type="password" name="password" style="width: 20px" required/>{% end %}<input type="submit" value="Upload!"/></form>
 
     You can also paste an image here.