Add -device-id command line option (fixes #4387)

GitHub-Pull-Request: https://github.com/syncthing/syncthing/pull/4390

AUTHORS

@@ -107,6 +107,7 @@ Suhas Gundimeda (snugghash) <suhas.gundimeda@gmail.com> <snugghash@gmail.com>
 Tim Abell (timabell) <tim@timwise.co.uk>
 Tim Howes (timhowes) <timhowes@berkeley.edu>
 Tobias Nygren (tnn2) <tnn@nygren.pp.se>
+Tobias Tom (tobiastom) <t.tom@succont.de>
 Tomas Cerveny (kozec) <kozec@kozec.com>
 Tully Robinson (tojrobinson) <tully@tojr.org>
 Tyler Brazier (tylerbrazier) <tyler@tylerbrazier.com>

NICKS

@@ -129,6 +129,7 @@ Stefan-Code <Stefan.github@gmail.com>
 timabell <tim@timwise.co.uk>
 timhowes <timhowes@berkeley.edu>
 tnn2 <tnn@nygren.pp.se>
+tobiastom <t.tom@succont.de>
 tojrobinson <tully@tojr.org>
 tpng <benny.tpng@gmail.com>
 tylerbrazier <tyler@tylerbrazier.com>

cmd/syncthing/gui.go

@@ -332,7 +332,7 @@ func (s *apiService) Serve() {
 	}
 
 	// Add the CORS handling
-	handler = corsMiddleware(handler)
+	handler = corsMiddleware(handler, guiCfg.InsecureAllowFrameLoading)
 
 	if addressIsLocalhost(guiCfg.Address()) && !guiCfg.InsecureSkipHostCheck {
 		// Verify source host
@@ -459,7 +459,7 @@ func debugMiddleware(h http.Handler) http.Handler {
 	})
 }
 
-func corsMiddleware(next http.Handler) http.Handler {
+func corsMiddleware(next http.Handler, allowFrameLoading bool) http.Handler {
 	// Handle CORS headers and CORS OPTIONS request.
 	// CORS OPTIONS request are typically sent by browser during AJAX preflight
 	// when the browser initiate a POST request.
@@ -486,6 +486,27 @@ func corsMiddleware(next http.Handler) http.Handler {
 			return
 		}
 
+		// Other security related headers that should be present.
+		// https://www.owasp.org/index.php/Security_Headers
+
+		if !allowFrameLoading {
+			// We don't want to be rendered in an <iframe>,
+			// <frame> or <object>. (Unless we do it ourselves.
+			// This is also an escape hatch for people who serve
+			// Syncthing GUI as part of their own website
+			// through a proxy, so they don't need to set the
+			// allowFrameLoading bool.)
+			w.Header().Set("X-Frame-Options", "SAMEORIGIN")
+		}
+
+		// If the browser senses an XSS attack it's allowed to take
+		// action. (How this would not always be the default I
+		// don't fully understand.)
+		w.Header().Set("X-XSS-Protection", "1; mode=block")
+
+		// Our content type headers are correct. Don't guess.
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+
 		// For everything else, pass to the next handler
 		next.ServeHTTP(w, r)
 		return

cmd/syncthing/gui_statics.go

@@ -141,17 +141,17 @@ func (s *staticsServer) serveThemes(w http.ResponseWriter, r *http.Request) {
 func (s *staticsServer) mimeTypeForFile(file string) string {
 	// We use a built in table of the common types since the system
 	// TypeByExtension might be unreliable. But if we don't know, we delegate
-	// to the system.
+	// to the system. All our files are UTF-8.
 	ext := filepath.Ext(file)
 	switch ext {
 	case ".htm", ".html":
-		return "text/html"
+		return "text/html; charset=utf-8"
 	case ".css":
-		return "text/css"
+		return "text/css; charset=utf-8"
 	case ".js":
-		return "application/javascript"
+		return "application/javascript; charset=utf-8"
 	case ".json":
-		return "application/json"
+		return "application/json; charset=utf-8"
 	case ".png":
 		return "image/png"
 	case ".ttf":
@@ -159,7 +159,7 @@ func (s *staticsServer) mimeTypeForFile(file string) string {
 	case ".woff":
 		return "application/x-font-woff"
 	case ".svg":
-		return "image/svg+xml"
+		return "image/svg+xml; charset=utf-8"
 	default:
 		return mime.TypeByExtension(ext)
 	}

cmd/syncthing/main.go

@@ -236,6 +236,7 @@ type RuntimeOptions struct {
 	resetDeltaIdxs bool
 	showVersion    bool
 	showPaths      bool
+	showDeviceId   bool
 	doUpgrade      bool
 	doUpgradeCheck bool
 	upgradeTo      string
@@ -301,6 +302,7 @@ func parseCommandLineOptions() RuntimeOptions {
 	flag.BoolVar(&options.doUpgradeCheck, "upgrade-check", false, "Check for available upgrade")
 	flag.BoolVar(&options.showVersion, "version", false, "Show version")
 	flag.BoolVar(&options.showPaths, "paths", false, "Show configuration paths")
+	flag.BoolVar(&options.showDeviceId, "device-id", false, "Show the device ID")
 	flag.StringVar(&options.upgradeTo, "upgrade-to", options.upgradeTo, "Force upgrade directly from specified URL")
 	flag.BoolVar(&options.auditEnabled, "audit", false, "Write events to audit file")
 	flag.BoolVar(&options.verbose, "verbose", false, "Print verbose log output")
@@ -390,6 +392,17 @@ func main() {
 		return
 	}
 
+	if options.showDeviceId {
+		cert, err := tls.LoadX509KeyPair(locations[locCertFile], locations[locKeyFile])
+		if err != nil {
+			l.Fatalln("Error reading device ID:", err)
+		}
+
+		myID = protocol.NewDeviceID(cert.Certificate[0])
+		fmt.Println(myID)
+		return
+	}
+
 	if options.browserOnly {
 		openGUI()
 		return

gui/default/assets/lang/lang-de.json

@@ -183,7 +183,7 @@
     "Save": "Speichern",
     "Scan Time Remaining": "Zeit für Scan verbleibend",
     "Scanning": "Scannen",
-    "See external versioner help for supported templated command line parameters.": "See external versioner help for supported templated command line parameters.",
+    "See external versioner help for supported templated command line parameters.": "Siehe externe Versionshilfe für unterstützte Befehlszeilenparameter.",
     "Select the devices to share this folder with.": "Wähle die Geräte aus, mit denen Du diesen Ordner teilen willst.",
     "Select the folders to share with this device.": "Wähle die Ordner aus, die Du mit diesem Gerät teilen möchtest",
     "Send & Receive": "Senden & empfangen",

gui/default/assets/lang/lang-fr.json

@@ -51,7 +51,7 @@
     "Device \"{%name%}\" ({%device%} at {%address%}) wants to connect. Add new device?": "\"{{name}}\" ({{device}}), appareil actuellement à {{address}}, demande à se connecter.\nAcceptez-vous de l'ajouter à votre liste d'appareils connus ?",
     "Device ID": "ID de l'appareil",
     "Device Identification": "Identifiant de l'appareil",
-    "Device Name": "Nom de l'appareil",
+    "Device Name": "Nom convivial local de l'appareil",
     "Devices": "Appareils",
     "Disconnected": "Déconnecté",
     "Discovered": "Découvert",
@@ -142,7 +142,7 @@
     "OK": "OK",
     "Off": "Désactivé(e)",
     "Oldest First": "Les plus anciens en premier",
-    "Optional descriptive label for the folder. Can be different on each device.": "Nom convivial et optionnel du partage, à votre guise. il peut être différent sur chaque appareil.",
+    "Optional descriptive label for the folder. Can be different on each device.": "Nom local, convivial et optionnel du partage, à votre guise. il peut être différent sur chaque appareil. Par notification initiale, il sera proposé tel quel aux nouveaux participants.\nAstuce : comme il est modifiable ultérieurement, pensez à indiquer un nom parlant pour les invités, puis renommez-le quand ils l'auront accepté (exemple d'un partage à deux membres où l'initiateur commence par donner son propre nom au partage, puis le renomme plus tard au nom du partenaire quand celui-ci l'a enregistré). Évitez les erreurs d'orthographe car ce nom servira aussi de base au chemin proposé en création (local et distant) et ce chemin est difficilement modifiable.",
     "Options": "Options",
     "Out of Sync": "Désynchronisé",
     "Out of Sync Items": "Éléments non synchronisés",
@@ -170,7 +170,7 @@
     "Release candidates contain the latest features and fixes. They are similar to the traditional bi-weekly Syncthing releases.": "Les versions préliminaires contiennent les dernières fonctionnalités et derniers correctifs. Elles sont identiques aux traditionnelles mises à jour bimensuelles.",
     "Remote Devices": "Autres appareils",
     "Remove": "Supprimer",
-    "Required identifier for the folder. Must be the same on all cluster devices.": "Identifiant du partage. Doit être le même sur tous les appareils concernés.",
+    "Required identifier for the folder. Must be the same on all cluster devices.": "Identifiant du partage. Doit être le même sur tous les appareils concernés (généré aléatoirement, mais modifiable à la création).",
     "Rescan": "Réanalyser",
     "Rescan All": "Tout réanalyser",
     "Rescan Interval": "Intervalle d'analyse",
@@ -198,7 +198,7 @@
     "Show ID": "Afficher mon ID",
     "Show QR": "Afficher le QR",
     "Shown instead of Device ID in the cluster status. Will be advertised to other devices as an optional default name.": "Affiché à la place de l'ID de l'appareil dans l'état du groupe. Sera diffusé aux autres appareils comme nom convivial optionnel par défaut.",
-    "Shown instead of Device ID in the cluster status. Will be updated to the name the device advertises if left empty.": "Affiché à la place de l'ID de l'appareil dans l'état du groupe. Si laissé vide, il sera renseigné par le nom convivial proposé par l'appareil distant.",
+    "Shown instead of Device ID in the cluster status. Will be updated to the name the device advertises if left empty.": "Nom convivial local affiché à la place de l'ID de l'appareil dans la plupart des écrans. Si laissé vide, c'est le nom convivial local de l'appareil distant qui sera utilisé. (Modifiable ultérieurement).",
     "Shutdown": "Arrêter",
     "Shutdown Complete": "Arrêté !",
     "Simple File Versioning": "Suivi simplifié des versions",

gui/default/assets/lang/lang-ko-KR.json

@@ -183,7 +183,7 @@
     "Save": "저장",
     "Scan Time Remaining": "탐색 남은 시간",
     "Scanning": "탐색중",
-    "See external versioner help for supported templated command line parameters.": "See external versioner help for supported templated command line parameters.",
+    "See external versioner help for supported templated command line parameters.": "지원되는 템플릿 명령 행 매개 변수에 대해서는 외부 버전 도움말을 참조하십시오.",
     "Select the devices to share this folder with.": "이 폴더를 공유할 장치를 선택합니다.",
     "Select the folders to share with this device.": "이 장치와 공유할 폴더를 선택합니다.",
     "Send & Receive": "송신 & 수신",

gui/default/index.html

@@ -394,7 +394,7 @@
                     </tr>
                     <tr>
                       <th><span class="fa fa-fw fa-share-alt"></span>&nbsp;<span translate>Shared With</span></th>
-                      <td class="text-right" title="{{sharesFolder(folder)}}">{{sharesFolder(folder)}}</td>
+                      <td class="text-right" ng-attr-title="{{sharesFolder(folder)}}">{{sharesFolder(folder)}}</td>
                     </tr>
                     <tr>
                       <th><span class="fa fa-fw fa-clock-o"></span>&nbsp;<span translate>Last Scan</span></th>
@@ -645,7 +645,7 @@
                     </tr>
                     <tr ng-if="deviceFolders(deviceCfg).length > 0">
                       <th><span class="fa fa-fw fa-folder"></span>&nbsp;<span translate>Folders</span></th>
-                      <td class="text-right" title="{{deviceFolders(deviceCfg).map(folderLabel).join(', ')}}">{{deviceFolders(deviceCfg).map(folderLabel).join(", ")}}</td>
+                      <td class="text-right" ng-attr-title="{{deviceFolders(deviceCfg).map(folderLabel).join(', ')}}">{{deviceFolders(deviceCfg).map(folderLabel).join(", ")}}</td>
                     </tr>
                   </tbody>
                 </table>

gui/default/syncthing/core/aboutModalView.html

@@ -12,7 +12,7 @@
     <p translate>Copyright &copy; 2014-2017 the following Contributors:</p>
     <div class="row">
       <div class="col-md-12" id="contributor-list">
-Jakob Borg, Audrius Butkevicius, Alexander Graf, Anderson Mesquita, Antony Male, Ben Schulz, Caleb Callaway, Daniel Harte, Lars K.W. Gohlke, Lode Hoste, Michael Ploujnikov, Nate Morrison, Philippe Schommers, Ryan Sullivan, Sergey Mishin, Simon Frei, Stefan Tatschner, Aaron Bieber, Adam Piggott, Adel Qalieh, Alessandro G., Alexandre Viau, Andrew Dunham, Andrey D, Antoine Lamielle, Arthur Axel fREW Schmidt, Bart De Vries, Ben Curthoys, Ben Shepherd, Ben Sidhom, Benny Ng, Brandon Philips, Brendan Long, Brian R. Becker, Carsten Hagemann, Cathryne Linenweaver, Cedric Staniewski, Chris Howie, Chris Joel, Colin Kennedy, Daniel Bergmann, Daniel Martí, Darshil Chanpura, David Rimmer, Denis A., Dennis Wilson, Dominik Heidler, Elias Jarlebring, Emil Hessman, Erik Meitner, Federico Castagnini, Felix Ableitner, Felix Unterpaintner, Francois-Xavier Gsell, Frank Isemann, Gilli Sigurdsson, Heiko Zuerker, Jaakko Hannikainen, Jacek Szafarkiewicz, Jake Peterson, James Patterson, Jaroslav Malec, Jaya Chithra, Jens Diemer, Jochen Voss, Johan Vromans, Jose Manuel Delicado, Karol Różycki, Kelong Cong, Ken'ichi Kamada, Kevin Allen, Kevin White, Jr., Kurt Fitzner, Laurent Etiemble, Leo Arias, Liu Siyuan, Lord Landon Agahnim, Majed Abdulaziz, Marc Laporte, Marc Pujol, Marcin Dziadus, Mark Pulford, Mateusz Naściszewski, Matt Burke, Max Schulze, Michael Jephcote, Michael Tilli, Niels Peter Roest, Pascal Jungblut, Peter Hoeg, Phill Luby, Piotr Bejda, Robert Carosi, Roman Zaynetdinov, Ross Smith II, Sacheendra Talluri, Scott Klupfel, Stefan Kuntz, Suhas Gundimeda, Tim Abell, Tim Howes, Tobias Nygren, Tomas Cerveny, Tully Robinson, Tyler Brazier, Unrud, Veeti Paananen, Victor Buinsky, Vil Brekin, William A. Kennington III, Wulf Weich, Xavier O., Yannic A.
+Jakob Borg, Audrius Butkevicius, Alexander Graf, Anderson Mesquita, Antony Male, Ben Schulz, Caleb Callaway, Daniel Harte, Lars K.W. Gohlke, Lode Hoste, Michael Ploujnikov, Nate Morrison, Philippe Schommers, Ryan Sullivan, Sergey Mishin, Simon Frei, Stefan Tatschner, Aaron Bieber, Adam Piggott, Adel Qalieh, Alessandro G., Alexandre Viau, Andrew Dunham, Andrey D, Antoine Lamielle, Arthur Axel fREW Schmidt, Bart De Vries, Ben Curthoys, Ben Shepherd, Ben Sidhom, Benny Ng, Brandon Philips, Brendan Long, Brian R. Becker, Carsten Hagemann, Cathryne Linenweaver, Cedric Staniewski, Chris Howie, Chris Joel, Colin Kennedy, Daniel Bergmann, Daniel Martí, Darshil Chanpura, David Rimmer, Denis A., Dennis Wilson, Dominik Heidler, Elias Jarlebring, Emil Hessman, Erik Meitner, Federico Castagnini, Felix Ableitner, Felix Unterpaintner, Francois-Xavier Gsell, Frank Isemann, Gilli Sigurdsson, Heiko Zuerker, Jaakko Hannikainen, Jacek Szafarkiewicz, Jake Peterson, James Patterson, Jaroslav Malec, Jaya Chithra, Jens Diemer, Jochen Voss, Johan Vromans, Jose Manuel Delicado, Karol Różycki, Kelong Cong, Ken'ichi Kamada, Kevin Allen, Kevin White, Jr., Kurt Fitzner, Laurent Etiemble, Leo Arias, Liu Siyuan, Lord Landon Agahnim, Majed Abdulaziz, Marc Laporte, Marc Pujol, Marcin Dziadus, Mark Pulford, Mateusz Naściszewski, Matt Burke, Max Schulze, Michael Jephcote, Michael Tilli, Niels Peter Roest, Pascal Jungblut, Peter Hoeg, Phill Luby, Piotr Bejda, Robert Carosi, Roman Zaynetdinov, Ross Smith II, Sacheendra Talluri, Scott Klupfel, Stefan Kuntz, Suhas Gundimeda, Tim Abell, Tim Howes, Tobias Nygren, Tobias Tom, Tomas Cerveny, Tully Robinson, Tyler Brazier, Unrud, Veeti Paananen, Victor Buinsky, Vil Brekin, William A. Kennington III, Wulf Weich, Xavier O., Yannic A.
     </div>
     </div>
     <hr/>

lib/config/config.go

@@ -392,9 +392,10 @@ func convertV22V23(cfg *Configuration) {
 			err = fs.Remove(".stfolder")
 			if err == nil {
 				err = fs.Mkdir(".stfolder", permBits)
+				fs.Hide(".stfolder") // ignore error
 			}
 			if err != nil {
-				l.Fatalln("failed to upgrade folder marker:", err)
+				l.Infoln("Failed to upgrade folder marker:", err)
 			}
 		}
 	}

lib/config/guiconfiguration.go

@@ -13,16 +13,17 @@ import (
 )
 
 type GUIConfiguration struct {
-	Enabled               bool   `xml:"enabled,attr" json:"enabled" default:"true"`
-	RawAddress            string `xml:"address" json:"address" default:"127.0.0.1:8384"`
-	User                  string `xml:"user,omitempty" json:"user"`
-	Password              string `xml:"password,omitempty" json:"password"`
-	RawUseTLS             bool   `xml:"tls,attr" json:"useTLS"`
-	APIKey                string `xml:"apikey,omitempty" json:"apiKey"`
-	InsecureAdminAccess   bool   `xml:"insecureAdminAccess,omitempty" json:"insecureAdminAccess"`
-	Theme                 string `xml:"theme" json:"theme" default:"default"`
-	Debugging             bool   `xml:"debugging,attr" json:"debugging"`
-	InsecureSkipHostCheck bool   `xml:"insecureSkipHostcheck,omitempty" json:"insecureSkipHostcheck"`
+	Enabled                   bool   `xml:"enabled,attr" json:"enabled" default:"true"`
+	RawAddress                string `xml:"address" json:"address" default:"127.0.0.1:8384"`
+	User                      string `xml:"user,omitempty" json:"user"`
+	Password                  string `xml:"password,omitempty" json:"password"`
+	RawUseTLS                 bool   `xml:"tls,attr" json:"useTLS"`
+	APIKey                    string `xml:"apikey,omitempty" json:"apiKey"`
+	InsecureAdminAccess       bool   `xml:"insecureAdminAccess,omitempty" json:"insecureAdminAccess"`
+	Theme                     string `xml:"theme" json:"theme" default:"default"`
+	Debugging                 bool   `xml:"debugging,attr" json:"debugging"`
+	InsecureSkipHostCheck     bool   `xml:"insecureSkipHostcheck,omitempty" json:"insecureSkipHostcheck"`
+	InsecureAllowFrameLoading bool   `xml:"insecureAllowFrameLoading,omitempty" json:"insecureAllowFrameLoading"`
 }
 
 func (c GUIConfiguration) Address() string {

lib/model/model.go

@@ -80,7 +80,6 @@ type Model struct {
 	clientVersion string
 
 	folderCfgs         map[string]config.FolderConfiguration                  // folder -> cfg
-	folderFs           map[string]fs.Filesystem                               // folder -> fs
 	folderFiles        map[string]*db.FileSet                                 // folder -> files
 	folderDevices      folderDeviceSet                                        // folder -> deviceIDs
 	deviceFolders      map[protocol.DeviceID][]string                         // deviceID -> folders
@@ -137,7 +136,6 @@ func NewModel(cfg *config.Wrapper, id protocol.DeviceID, clientName, clientVersi
 		clientName:          clientName,
 		clientVersion:       clientVersion,
 		folderCfgs:          make(map[string]config.FolderConfiguration),
-		folderFs:            make(map[string]fs.Filesystem),
 		folderFiles:         make(map[string]*db.FileSet),
 		folderDevices:       make(folderDeviceSet),
 		deviceFolders:       make(map[protocol.DeviceID][]string),
@@ -253,7 +251,14 @@ func (m *Model) startFolderLocked(folder string) config.FolderType {
 		}
 	}
 
-	p := folderFactory(m, cfg, ver, fs.MtimeFS())
+	ffs := fs.MtimeFS()
+
+	// These are our metadata files, and they should always be hidden.
+	ffs.Hide(".stfolder")
+	ffs.Hide(".stversions")
+	ffs.Hide(".stignore")
+
+	p := folderFactory(m, cfg, ver, ffs)
 	m.folderRunners[folder] = p
 
 	m.warnAboutOverwritingProtectedFiles(folder)
@@ -334,7 +339,14 @@ func (m *Model) RemoveFolder(folder string) {
 	m.pmut.Lock()
 
 	// Delete syncthing specific files
-	folderCfg := m.folderCfgs[folder]
+	folderCfg, ok := m.folderCfgs[folder]
+	if !ok {
+		// Folder might be paused
+		folderCfg, ok = m.cfg.Folder(folder)
+	}
+	if !ok {
+		panic("bug: remove non existing folder")
+	}
 	fs := folderCfg.Filesystem()
 	fs.RemoveAll(".stfolder")
 

lib/model/model_test.go

@@ -1902,6 +1902,52 @@ func TestIssue3164(t *testing.T) {
 	}
 }
 
+func TestIssue4357(t *testing.T) {
+	db := db.OpenMemory()
+	m := NewModel(defaultConfig, protocol.LocalDeviceID, "syncthing", "dev", db, nil)
+	m.ServeBackground()
+	defer m.Stop()
+	cfg := m.cfg.RawCopy()
+	m.CommitConfiguration(config.Configuration{}, cfg)
+
+	if _, ok := m.folderCfgs["default"]; !ok {
+		t.Error("Folder should be running")
+	}
+
+	newCfg := m.cfg.RawCopy()
+	newCfg.Folders[0].Paused = true
+	m.CommitConfiguration(cfg, newCfg)
+
+	if _, ok := m.folderCfgs["default"]; ok {
+		t.Error("Folder should not be running")
+	}
+
+	// Should not panic when removing a paused folder.
+	m.RemoveFolder("default")
+
+	// Add the folder back, should be running
+	m.CommitConfiguration(config.Configuration{}, cfg)
+
+	if _, ok := m.folderCfgs["default"]; !ok {
+		t.Error("Folder should be running")
+	}
+
+	// Should not panic when removing a running folder.
+	m.RemoveFolder("default")
+	if _, ok := m.folderCfgs["default"]; ok {
+		t.Error("Folder should not be running")
+	}
+
+	// Should panic when removing a non-existing folder
+	defer func() {
+		if recover() == nil {
+			t.Error("expected a panic")
+		}
+	}()
+	m.RemoveFolder("non-existing")
+
+}
+
 func TestScanNoDatabaseWrite(t *testing.T) {
 	// When scanning, nothing should be committed to database unless
 	// something actually changed.

lib/model/rwfolder.go

@@ -245,8 +245,8 @@ func (f *sendReceiveFolder) Serve() {
 					// errors preventing us. Flag this with a warning and
 					// wait a bit longer before retrying.
 					if folderErrors := f.currentErrors(); len(folderErrors) > 0 {
-						for path, err := range folderErrors {
-							l.Infof("Puller (folder %q, dir %q): %v", f.Description(), path, err)
+						for _, fileError := range folderErrors {
+							l.Infof("Puller (folder %v, dir %q): %v", f.Description(), fileError.Path, fileError.Err)
 						}
 						events.Default.Log(events.FolderErrors, map[string]interface{}{
 							"folder": f.folderID,
@@ -254,7 +254,7 @@ func (f *sendReceiveFolder) Serve() {
 						})
 					}
 
-					l.Infof("Folder %q isn't making progress. Pausing puller for %v.", f.folderID, f.pause)
+					l.Infof("Folder %v isn't making progress. Pausing puller for %v.", f.Description(), f.pause)
 					l.Debugln(f, "next pull in", f.pause)
 
 					f.pullTimer.Reset(f.pause)

lib/model/sharedpullerstate.go

@@ -164,6 +164,9 @@ func (s *sharedPullerState) tempFile() (io.WriterAt, error) {
 		return nil, err
 	}
 
+	// Hide the temporary file
+	s.fs.Hide(s.tempName)
+
 	// Don't truncate symlink files, as that will mean that the path will
 	// contain a bunch of nulls.
 	if s.sparse && !s.file.IsSymlink() {
@@ -307,6 +310,12 @@ func (s *sharedPullerState) finalClose() (bool, error) {
 
 	s.closed = true
 
+	// Unhide the temporary file when we close it, as it's likely to
+	// immediately be renamed to the final name. If this is a failed temp
+	// file we will also unhide it, but I'm fine with that as we're now
+	// leaving it around for potentially quite a while.
+	s.fs.Unhide(s.tempName)
+
 	return true, s.err
 }
 

lib/protocol/deviceid.go

@@ -10,7 +10,6 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/calmh/luhn"
 	"github.com/syncthing/syncthing/lib/sha256"
 )
 
@@ -158,7 +157,7 @@ func luhnify(s string) (string, error) {
 	for i := 0; i < 4; i++ {
 		p := s[i*13 : (i+1)*13]
 		copy(res[i*(13+1):], p)
-		l, err := luhn.Base32.Generate(p)
+		l, err := luhnBase32.generate(p)
 		if err != nil {
 			return "", err
 		}
@@ -176,7 +175,7 @@ func unluhnify(s string) (string, error) {
 	for i := 0; i < 4; i++ {
 		p := s[i*(13+1) : (i+1)*(13+1)-1]
 		copy(res[i*13:], p)
-		l, err := luhn.Base32.Generate(p)
+		l, err := luhnBase32.generate(p)
 		if err != nil {
 			return "", err
 		}

lib/protocol/luhn.go

@@ -0,0 +1,53 @@
+// Copyright (C) 2014 The Protocol Authors.
+
+package protocol
+
+import (
+	"fmt"
+	"strings"
+)
+
+// An alphabet is a string of N characters, representing the digits of a given
+// base N.
+type luhnAlphabet string
+
+var (
+	luhnBase32 luhnAlphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"
+)
+
+// generate returns a check digit for the string s, which should be composed
+// of characters from the Alphabet a.
+func (a luhnAlphabet) generate(s string) (rune, error) {
+	factor := 1
+	sum := 0
+	n := len(a)
+
+	for i := range s {
+		codepoint := strings.IndexByte(string(a), s[i])
+		if codepoint == -1 {
+			return 0, fmt.Errorf("Digit %q not valid in alphabet %q", s[i], a)
+		}
+		addend := factor * codepoint
+		if factor == 2 {
+			factor = 1
+		} else {
+			factor = 2
+		}
+		addend = (addend / n) + (addend % n)
+		sum += addend
+	}
+	remainder := sum % n
+	checkCodepoint := (n - remainder) % n
+	return rune(a[checkCodepoint]), nil
+}
+
+// luhnValidate returns true if the last character of the string s is correct, for
+// a string s composed of characters in the alphabet a.
+func (a luhnAlphabet) luhnValidate(s string) bool {
+	t := s[:len(s)-1]
+	c, err := a.generate(t)
+	if err != nil {
+		return false
+	}
+	return rune(s[len(s)-1]) == c
+}

lib/protocol/luhn_test.go

@@ -0,0 +1,48 @@
+// Copyright (C) 2014 The Protocol Authors.
+
+package protocol
+
+import (
+	"testing"
+)
+
+func TestGenerate(t *testing.T) {
+	// Base 6 Luhn
+	a := luhnAlphabet("abcdef")
+	c, err := a.generate("abcdef")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c != 'e' {
+		t.Errorf("Incorrect check digit %c != e", c)
+	}
+
+	// Base 10 Luhn
+	a = luhnAlphabet("0123456789")
+	c, err = a.generate("7992739871")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c != '3' {
+		t.Errorf("Incorrect check digit %c != 3", c)
+	}
+}
+
+func TestInvalidString(t *testing.T) {
+	a := luhnAlphabet("ABC")
+	_, err := a.generate("7992739871")
+	t.Log(err)
+	if err == nil {
+		t.Error("Unexpected nil error")
+	}
+}
+
+func TestValidate(t *testing.T) {
+	a := luhnAlphabet("abcdef")
+	if !a.luhnValidate("abcdefe") {
+		t.Errorf("Incorrect validation response for abcdefe")
+	}
+	if a.luhnValidate("abcdefd") {
+		t.Errorf("Incorrect validation response for abcdefd")
+	}
+}

lib/protocol/protocol.go

@@ -16,7 +16,7 @@ import (
 )
 
 const (
-	// BlockSize is the standard ata block size (128 KiB)
+	// BlockSize is the standard data block size (128 KiB)
 	BlockSize = 128 << 10
 
 	// MaxMessageLen is the largest message size allowed on the wire. (500 MB)

man/stdiscosrv.1

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "STDISCOSRV" "1" "September 04, 2017" "v0.14" "Syncthing"
+.TH "STDISCOSRV" "1" "September 08, 2017" "v0.14" "Syncthing"
 .SH NAME
 stdiscosrv \- Syncthing Discovery Server
 .

man/strelaysrv.1

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "STRELAYSRV" "1" "September 04, 2017" "v0.14" "Syncthing"
+.TH "STRELAYSRV" "1" "September 08, 2017" "v0.14" "Syncthing"
 .SH NAME
 strelaysrv \- Syncthing Relay Server
 .

man/syncthing-bep.7

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SYNCTHING-BEP" "7" "September 04, 2017" "v0.14" "Syncthing"
+.TH "SYNCTHING-BEP" "7" "September 08, 2017" "v0.14" "Syncthing"
 .SH NAME
 syncthing-bep \- Block Exchange Protocol v1
 .

man/syncthing-config.5

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SYNCTHING-CONFIG" "5" "September 04, 2017" "v0.14" "Syncthing"
+.TH "SYNCTHING-CONFIG" "5" "September 08, 2017" "v0.14" "Syncthing"
 .SH NAME
 syncthing-config \- Syncthing Configuration
 .

man/syncthing-device-ids.7

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SYNCTHING-DEVICE-IDS" "7" "September 04, 2017" "v0.14" "Syncthing"
+.TH "SYNCTHING-DEVICE-IDS" "7" "September 08, 2017" "v0.14" "Syncthing"
 .SH NAME
 syncthing-device-ids \- Understanding Device IDs
 .

man/syncthing-event-api.7

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SYNCTHING-EVENT-API" "7" "September 04, 2017" "v0.14" "Syncthing"
+.TH "SYNCTHING-EVENT-API" "7" "September 08, 2017" "v0.14" "Syncthing"
 .SH NAME
 syncthing-event-api \- Event API
 .

man/syncthing-faq.7

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SYNCTHING-FAQ" "7" "September 04, 2017" "v0.14" "Syncthing"
+.TH "SYNCTHING-FAQ" "7" "September 08, 2017" "v0.14" "Syncthing"
 .SH NAME
 syncthing-faq \- Frequently Asked Questions
 .

man/syncthing-globaldisco.7

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SYNCTHING-GLOBALDISCO" "7" "September 04, 2017" "v0.14" "Syncthing"
+.TH "SYNCTHING-GLOBALDISCO" "7" "September 08, 2017" "v0.14" "Syncthing"
 .SH NAME
 syncthing-globaldisco \- Global Discovery Protocol v3
 .

man/syncthing-localdisco.7

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SYNCTHING-LOCALDISCO" "7" "September 04, 2017" "v0.14" "Syncthing"
+.TH "SYNCTHING-LOCALDISCO" "7" "September 08, 2017" "v0.14" "Syncthing"
 .SH NAME
 syncthing-localdisco \- Local Discovery Protocol v4
 .

man/syncthing-networking.7

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SYNCTHING-NETWORKING" "7" "September 04, 2017" "v0.14" "Syncthing"
+.TH "SYNCTHING-NETWORKING" "7" "September 08, 2017" "v0.14" "Syncthing"
 .SH NAME
 syncthing-networking \- Firewall Setup
 .

man/syncthing-relay.7

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SYNCTHING-RELAY" "7" "September 04, 2017" "v0.14" "Syncthing"
+.TH "SYNCTHING-RELAY" "7" "September 08, 2017" "v0.14" "Syncthing"
 .SH NAME
 syncthing-relay \- Relay Protocol v1
 .

man/syncthing-rest-api.7

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SYNCTHING-REST-API" "7" "September 04, 2017" "v0.14" "Syncthing"
+.TH "SYNCTHING-REST-API" "7" "September 08, 2017" "v0.14" "Syncthing"
 .SH NAME
 syncthing-rest-api \- REST API
 .

man/syncthing-security.7

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SYNCTHING-SECURITY" "7" "September 04, 2017" "v0.14" "Syncthing"
+.TH "SYNCTHING-SECURITY" "7" "September 08, 2017" "v0.14" "Syncthing"
 .SH NAME
 syncthing-security \- Security Principles
 .

man/syncthing-stignore.5

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SYNCTHING-STIGNORE" "5" "September 04, 2017" "v0.14" "Syncthing"
+.TH "SYNCTHING-STIGNORE" "5" "September 08, 2017" "v0.14" "Syncthing"
 .SH NAME
 syncthing-stignore \- Prevent files from being synchronized to other nodes
 .

man/syncthing-versioning.7

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SYNCTHING-VERSIONING" "7" "September 04, 2017" "v0.14" "Syncthing"
+.TH "SYNCTHING-VERSIONING" "7" "September 08, 2017" "v0.14" "Syncthing"
 .SH NAME
 syncthing-versioning \- Keep automatic backups of deleted files by other nodes
 .

man/syncthing.1

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SYNCTHING" "1" "September 04, 2017" "v0.14" "Syncthing"
+.TH "SYNCTHING" "1" "September 08, 2017" "v0.14" "Syncthing"
 .SH NAME
 syncthing \- Syncthing
 .

vendor/github.com/calmh/luhn/LICENSE

@@ -1,19 +0,0 @@
-Copyright (C) 2014 Jakob Borg
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of
-this software and associated documentation files (the "Software"), to deal in
-the Software without restriction, including without limitation the rights to
-use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
-of the Software, and to permit persons to whom the Software is furnished to do
-so, subject to the following conditions:
-
-- The above copyright notice and this permission notice shall be included in
-  all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

vendor/github.com/calmh/luhn/luhn.go

@@ -1,67 +0,0 @@
-// Copyright (C) 2014 Jakob Borg
-
-// Package luhn generates and validates Luhn mod N check digits.
-package luhn
-
-import (
-	"fmt"
-	"strings"
-)
-
-// An alphabet is a string of N characters, representing the digits of a given
-// base N.
-type Alphabet string
-
-var (
-	Base32 Alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"
-)
-
-// Generate returns a check digit for the string s, which should be composed
-// of characters from the Alphabet a.
-func (a Alphabet) Generate(s string) (rune, error) {
-	factor := 1
-	sum := 0
-	n := len(a)
-
-	for i := range s {
-		codepoint := strings.IndexByte(string(a), s[i])
-		if codepoint == -1 {
-			return 0, fmt.Errorf("Digit %q not valid in alphabet %q", s[i], a)
-		}
-		addend := factor * codepoint
-		if factor == 2 {
-			factor = 1
-		} else {
-			factor = 2
-		}
-		addend = (addend / n) + (addend % n)
-		sum += addend
-	}
-	remainder := sum % n
-	checkCodepoint := (n - remainder) % n
-	return rune(a[checkCodepoint]), nil
-}
-
-// Validate returns true if the last character of the string s is correct, for
-// a string s composed of characters in the alphabet a.
-func (a Alphabet) Validate(s string) bool {
-	t := s[:len(s)-1]
-	c, err := a.Generate(t)
-	if err != nil {
-		return false
-	}
-	return rune(s[len(s)-1]) == c
-}
-
-// NewAlphabet converts the given string an an Alphabet, verifying that it
-// is correct.
-func NewAlphabet(s string) (Alphabet, error) {
-	cm := make(map[byte]bool, len(s))
-	for i := range s {
-		if cm[s[i]] {
-			return "", fmt.Errorf("Digit %q non-unique in alphabet %q", s[i], s)
-		}
-		cm[s[i]] = true
-	}
-	return Alphabet(s), nil
-}

vendor/manifest

@@ -49,14 +49,6 @@
 			"branch": "master",
 			"notests": true
 		},
-		{
-			"importpath": "github.com/calmh/luhn",
-			"repository": "https://github.com/calmh/luhn",
-			"vcs": "git",
-			"revision": "c0f1d77264fb3d1bfc65b70eea6ee264058c57c0",
-			"branch": "master",
-			"notests": true
-		},
 		{
 			"importpath": "github.com/calmh/xdr",
 			"repository": "https://github.com/calmh/xdr",