2016-09-30 04:50:06 -05:00
exports . diskfull = _ ( 'No disk space left on server, please contact the server administrator to continue.' ) ;
2016-10-17 08:23:22 -05:00
exports . emptyhosturl = _ ( 'The host URL is empty. The loolwsd server is probably misconfigured, please contact the administrator.' ) ;
2016-10-24 15:18:00 -05:00
exports . limitreached = _ ( 'This development build is limited to %0 documents, and %1 connections - to avoid the impression that it is suitable for deployment in large enterprises. To find out more about deploying and scaling %2 check out: <br/><a href=\"%3\">%3</a>.' ) ;
2016-10-12 10:52:29 -05:00
exports . serviceunavailable = _ ( 'Service is unavailable. Please try again later and report to your administrator if the issue persists.' ) ;
Attempt to handle unauthorized WOPI usage better
Use the previously unused UnauthorizedRequestException for this, and
throw a such in StorageBase::create() when the WOPI host doesn't match
any of those configured.
In a developer debug build, without access to any real WOPI
functionality, you can test by setting the FAKE_UNAUTHORIZED
environment variable and attempting to edit a plain local file:
URI. That will cause such an exception to be thrown in that function.
Catch that UnauthorizedRequestException in
ClientRequestHandler::handleGetRequest(), and send an 'error:
cmd=internal kind=unauthorized' message to the client. Handle that in
loleaflet in the same place where the 'error: cmd=internal
kild=diskfull' message is handled, and in the same fashion, giving up
on the document.
Actually, using exceptions for relatively non-exceptional situations
like this is lame and makes understanding the code harder, but that is
just my personal preference...
FIXME: By the time StorageBase::create() gets called we have already
sent three 'statusindicator:' messages ('find', 'connect', and
'ready') to the client. We should ideally do the checks we do in
StorageBase::create() much earlier.
Also consider that ClientRequestHandler::handleClientRequest() has
code that catches UnauthorizedRequestException and
BadRequestException, and tries to set the HTTP response in those
cases. I am not sure if that functionality has ever been exercised,
though. Currently, we upgrade the HTTP connection to WebSocket early,
and only after that we check whether the WOPI host is authorized
etc. By that time it is too late to return an HTTP response to the
user. If that even is what we ideally should do? If not, then we
probably should drop the code that constructs HTTP responses and
attempts to send them.
Also, if I, as a test, force an HTTPResponse::HTTP_BAD_REQUEST to be
sent before the HTTP connection is upgraded to WebSocket, loleaflet
throws up the generic "Well, this is embarrassing" dialog anyway. At
least in Firefox on Linux. (Instead of the browser showing some own
dialog, which I was half-expecting to happen.)
2016-10-17 08:55:20 -05:00
exports . unauthorized = _ ( 'Unauthorized WOPI host. Please try again later and report to your administrator if the issue persists.' ) ;
2016-10-17 08:23:22 -05:00
exports . wrongwopisrc = _ ( 'Wrong WOPISrc, usage: WOPISrc=valid encoded URI, or file_path, usage: file_path=/path/to/doc/' ) ;
