Fix: password-protected unpacking

daemon/main/nzbget.cpp

@@ -675,6 +675,12 @@ void NZBGet::ProcessStandalone()
 		return;
 	}
 	std::unique_ptr<NzbInfo> nzbInfo = nzbFile.DetachNzbInfo();
+
+	if (!nzbFile.GetPassword().empty())
+	{
+		nzbInfo->GetParameters()->SetParameter("*Unpack:Password", nzbFile.GetPassword().c_str());
+	}
+
 	m_scanner->InitPPParameters(category, nzbInfo->GetParameters(), false);
 	m_queueCoordinator->AddNzbFileToQueue(std::move(nzbInfo), nullptr, false);
 }

daemon/queue/NzbFile.cpp

@@ -3,6 +3,7 @@
  *
  *  Copyright (C) 2004 Sven Henkel <[email protected]>
  *  Copyright (C) 2007-2016 Andrey Prygunkov <[email protected]>
+ *  Copyright (C) 2024 Denis <[email protected]>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -15,7 +16,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
 
@@ -41,7 +42,7 @@ NzbFile::NzbFile(const char* fileName, const char* category) :
 
 void NzbFile::LogDebugInfo()
 {
-	info(" NZBFile %s", *m_fileName);
+	info(" NZBFile %s", m_fileName.c_str());
 }
 
 void NzbFile::AddArticle(FileInfo* fileInfo, std::unique_ptr<ArticleInfo> articleInfo)
@@ -389,11 +390,7 @@ void NzbFile::ProcessFiles()
 		}
 	}
 
-	if (m_password)
-	{
-		ReadPasswordFromNzb();
-	}
-	else
+	if (m_password.empty())
 	{
 		ReadPasswordFromFilename();
 	}
@@ -403,62 +400,18 @@ void NzbFile::ProcessFiles()
 */
 void NzbFile::ReadPasswordFromFilename()
 {
-	int startDelimiter = m_fileName.Find("{{") + 2;
-	int stopDelimiter = m_fileName.Find("}}");
-	int lengthDelimiter = stopDelimiter - startDelimiter;
-	if (lengthDelimiter > 0)
-	{
-		CString namepassword(m_fileName, m_fileName.Length());
-		namepassword.Replace(stopDelimiter, m_fileName.Length() - stopDelimiter, "", 0);
-		namepassword.Replace(0, startDelimiter, "", 0);
-		m_password = namepassword.Str();
-	}
-}
-/**
- * Password read using XML-parser may have special characters (such as TAB) stripped.
- * This function rereads password directly from file to keep all characters intact.
- */
-void NzbFile::ReadPasswordFromNzb()
-{
-	DiskFile file;
-	if (!file.Open(m_fileName, DiskFile::omRead))
-	{
-		return;
-	}
+	size_t start = m_fileName.find("{{");
+	if (start == std::string::npos) return;
+
+	start += 2;
 
-	// obtain file size.
-	file.Seek(0, DiskFile::soEnd);
-	int size  = (int)file.Position();
-	file.Seek(0, DiskFile::soSet);
+	size_t end = m_fileName.find("}}", start);
+	if (end == std::string::npos) return;
 
-	// reading first 4KB of the file
-
-	CharBuffer buf(4096);
-
-	size = size < 4096 ? size : 4096;
-
-	// copy the file into the buffer.
-	file.Read(buf, size);
-
-	file.Close();
-
-	buf[size-1] = '\0';
-
-	char* metaPassword = strstr(buf, "<meta type=\"password\">");
-	if (metaPassword)
-	{
-		metaPassword += 22; // length of '<meta type="password">'
-		char* end = strstr(metaPassword, "</meta>");
-		if (end)
-		{
-			*end = '\0';
-			WebUtil::XmlDecode(metaPassword);
-			m_password = metaPassword;
-		}
-	}
+	if (start < end)
+	    m_password = m_fileName.substr(start, end - start);
 }
 
-
 bool NzbFile::Parse()
 {
 	xmlSAXHandler SAX_handler = {0};
@@ -470,19 +423,19 @@ bool NzbFile::Parse()
 
 	m_ignoreNextError = false;
 
-	int ret = xmlSAXUserParseFile(&SAX_handler, this, m_fileName);
+	int ret = xmlSAXUserParseFile(&SAX_handler, this, m_fileName.c_str());
 
 	if (ret != 0)
 	{
 		m_nzbInfo->AddMessage(Message::mkError, BString<1024>(
-			"Error parsing nzb-file %s", FileSystem::BaseFileName(m_fileName)));
+			"Error parsing nzb-file %s", FileSystem::BaseFileName(m_fileName.c_str())));
 		return false;
 	}
 
 	if (m_nzbInfo->GetFileList()->empty())
 	{
 		m_nzbInfo->AddMessage(Message::mkError, BString<1024>(
-			"Error parsing nzb-file %s: file has no content", FileSystem::BaseFileName(m_fileName)));
+			"Error parsing nzb-file %s: file has no content", FileSystem::BaseFileName(m_fileName.c_str())));
 		return false;
 	}
 
@@ -500,7 +453,7 @@ void NzbFile::Parse_StartElement(const char *name, const char **atts)
 	if (!strcmp("file", name))
 	{
 		m_fileInfo = std::make_unique<FileInfo>();
-		m_fileInfo->SetFilename(m_fileName);
+		m_fileInfo->SetFilename(m_fileName.c_str());
 
 		if (!atts)
 		{

daemon/queue/NzbFile.h

@@ -3,6 +3,7 @@
  *
  *  Copyright (C) 2004 Sven Henkel <[email protected]>
  *  Copyright (C) 2007-2016 Andrey Prygunkov <[email protected]>
+ *  Copyright (C) 2024 Denis <[email protected]>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -15,7 +16,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
 
@@ -30,16 +31,16 @@ class NzbFile
 public:
 	NzbFile(const char* fileName, const char* category);
 	bool Parse();
-	const char* GetFileName() const { return m_fileName; }
+	const char* GetFileName() const { return m_fileName.c_str(); }
 	std::unique_ptr<NzbInfo> DetachNzbInfo() { return std::move(m_nzbInfo); }
-	const char* GetPassword() { return m_password; }
+	const std::string& GetPassword() const { return m_password; }
 
 	void LogDebugInfo();
 
 private:
 	std::unique_ptr<NzbInfo> m_nzbInfo;
-	CString m_fileName;
-	CString m_password;
+	std::string m_fileName;
+	std::string m_password;
 
 	void AddArticle(FileInfo* fileInfo, std::unique_ptr<ArticleInfo> articleInfo);
 	void AddFileInfo(std::unique_ptr<FileInfo> fileInfo);
@@ -48,7 +49,6 @@ class NzbFile
 	void ProcessFiles();
 	void CalcHashes();
 	bool HasDuplicateFilenames();
-	void ReadPasswordFromNzb();
 	void ReadPasswordFromFilename();
 
 

daemon/queue/Scanner.cpp

@@ -458,9 +458,9 @@ bool Scanner::AddFileToQueue(const char* filename, const char* nzbName, const ch
 		nzbInfo->SetSkipDiskWrite(urlInfo->GetSkipDiskWrite());
 	}
 
-	if (nzbFile.GetPassword())
+	if (!nzbFile.GetPassword().empty())
 	{
-		nzbInfo->GetParameters()->SetParameter("*Unpack:Password", nzbFile.GetPassword());
+		nzbInfo->GetParameters()->SetParameter("*Unpack:Password", nzbFile.GetPassword().c_str());
 	}
 
 	nzbInfo->GetParameters()->CopyFrom(parameters);

tests/queue/NzbFileTest.cpp

@@ -15,7 +15,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
 
@@ -91,11 +91,11 @@ void TestNzb(std::string testFilename)
 
 	if(strcmp(lastBuffer, buffer) == 0)
 	{
-		BOOST_CHECK(nzbFile.GetPassword() == nullptr);
+		BOOST_CHECK(nzbFile.GetPassword().empty());
 	}
 	else
 	{
-		BOOST_CHECK(std::string(nzbFile.GetPassword()) == std::string(buffer));
+		BOOST_CHECK(nzbFile.GetPassword() == std::string(buffer));
 	}
 
 	fclose(infofile);