Disallow adding/editing localfs integration from ui

internal/integrations/integrations.go

@@ -13,11 +13,11 @@ import (
 )
 
 const (
-	ftpProvider     = "ftp"
-	webdavProvider  = "webdav"
-	dropboxProvider = "dropbox"
-	googleProvider  = "google"
-	localfsProvider = "localfs"
+	FtpProvider     = "ftp"
+	WebdavProvider  = "webdav"
+	DropboxProvider = "dropbox"
+	GoogleProvider  = "google"
+	LocalfsProvider = "localfs"
 )
 
 // IntegrationProvider abstracts 3rd party integrations
@@ -39,13 +39,13 @@ func GetIntegrationProvider(storer storage.UserStorer, uid, integrationid string
 			continue
 		}
 		switch intg.Provider {
-		case dropboxProvider:
+		case DropboxProvider:
 			return newDropbox(intg), nil
-		case ftpProvider:
+		case FtpProvider:
 			return newFTP(intg), nil
-		case localfsProvider:
+		case LocalfsProvider:
 			return newLocalFS(intg), nil
-		case webdavProvider:
+		case WebdavProvider:
 			return newWebDav(intg), nil
 		}
 	}
@@ -56,13 +56,13 @@ func GetIntegrationProvider(storer storage.UserStorer, uid, integrationid string
 // fix the name
 func fixProviderName(n string) string {
 	switch n {
-	case ftpProvider:
+	case FtpProvider:
 		fallthrough
-	case dropboxProvider:
+	case DropboxProvider:
 		return "Dropbox"
-	case googleProvider:
+	case GoogleProvider:
 		fallthrough
-	case webdavProvider:
+	case WebdavProvider:
 		return "GoogleDrive"
 	default:
 		return n

internal/ui/handlers.go

@@ -14,6 +14,7 @@ import (
 	"github.com/golang-jwt/jwt/v4"
 	"github.com/google/uuid"
 	log "github.com/sirupsen/logrus"
+	"gopkg.in/yaml.v3"
 )
 
 const (
@@ -529,6 +530,16 @@ func (app *ReactAppWrapper) listIntegrations(c *gin.Context) {
 	c.JSON(http.StatusOK, user.Integrations)
 }
 
+func warnLocalfsEdition(c *gin.Context, int *model.IntegrationConfig) {
+	s, err := yaml.Marshal(gin.H{"integrations": []*model.IntegrationConfig{int}})
+	if err != nil {
+		log.Error("error updating user", err)
+		c.AbortWithStatus(http.StatusInternalServerError)
+		return
+	}
+	c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "To avoid security issues with local directory integration, you have to manually edit your .userprofile file:\n\n" + string(s)})
+}
+
 func (app *ReactAppWrapper) createIntegration(c *gin.Context) {
 	int := model.IntegrationConfig{}
 	if err := c.ShouldBindJSON(&int); err != nil {
@@ -537,6 +548,12 @@ func (app *ReactAppWrapper) createIntegration(c *gin.Context) {
 		return
 	}
 
+	if int.Provider == integrations.LocalfsProvider {
+		int.ID = uuid.NewString()
+		warnLocalfsEdition(c, &int)
+		return
+	}
+
 	uid := c.GetString(userIDContextKey)
 
 	user, err := app.userStorer.GetUser(uid)
@@ -590,6 +607,11 @@ func (app *ReactAppWrapper) updateIntegration(c *gin.Context) {
 		return
 	}
 
+	if int.Provider == integrations.LocalfsProvider {
+		warnLocalfsEdition(c, &int)
+		return
+	}
+
 	uid := c.GetString(userIDContextKey)
 
 	intid := common.ParamS(intIDParam, c)

ui/src/pages/Integrations/IntegrationModal.js

@@ -71,7 +71,9 @@ export default function IntegrationModal(params) {
           <div>
             <Alert variant="danger" hidden={!formErrors.error}>
               <Alert.Heading>An Error Occurred</Alert.Heading>
-              {formErrors.error}
+              <div style={{'white-space': 'pre-wrap'}}>
+                {formErrors.error}
+              </div>
             </Alert>
 
             <Form.Label>IntegrationID</Form.Label>

ui/src/pages/Integrations/NewIntegrationModal.js

@@ -54,7 +54,9 @@ export default function IntegrationProfileModal(params) {
         <Card.Body>
           <Alert variant="danger" hidden={!formErrors.error}>
             <Alert.Heading>An Error Occurred</Alert.Heading>
-            {formErrors.error}
+            <div style={{'white-space': 'pre-wrap'}}>
+              {formErrors.error}
+            </div>
           </Alert>
 
           <Alert variant="info" hidden={!formInfo.message}>

ui/src/services/api.service.js

@@ -169,6 +169,9 @@ function handleError(r) {
       window.location.reload(true);
       return
     }
+    if (r.headers.get("Content-Type").startsWith("application/json")) {
+      return r.json().then(d => {throw new Error(d.error)});
+    }
     if (r.status === 400) {
       return r.text().then(text => {throw new Error(text)})
     }