From cfbbace45060c70d80cc01c79595c983747c63c4 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Tue, 11 Oct 2022 20:15:26 +0200 Subject: [PATCH] Require a token for "Edit locally" Signed-off-by: Joas Schilling --- apps/files/appinfo/info.xml | 2 +- apps/files/appinfo/routes.php | 14 ++ .../composer/composer/autoload_classmap.php | 4 + .../composer/composer/autoload_static.php | 4 + apps/files/js/filelist.js | 21 ++- .../Controller/OpenLocalEditorController.php | 135 ++++++++++++++++++ apps/files/lib/Db/OpenLocalEditor.php | 60 ++++++++ apps/files/lib/Db/OpenLocalEditorMapper.php | 56 ++++++++ .../Version12101Date20221011153334.php | 75 ++++++++++ 9 files changed, 365 insertions(+), 6 deletions(-) create mode 100644 apps/files/lib/Controller/OpenLocalEditorController.php create mode 100644 apps/files/lib/Db/OpenLocalEditor.php create mode 100644 apps/files/lib/Db/OpenLocalEditorMapper.php create mode 100644 apps/files/lib/Migration/Version12101Date20221011153334.php diff --git a/apps/files/appinfo/info.xml b/apps/files/appinfo/info.xml index ac7e9a2fa8e..a29fcc2394b 100644 --- a/apps/files/appinfo/info.xml +++ b/apps/files/appinfo/info.xml @@ -5,7 +5,7 @@ Files File Management File Management - 1.21.0 + 1.21.1 agpl Robin Appelman Vincent Petry diff --git a/apps/files/appinfo/routes.php b/apps/files/appinfo/routes.php index 2aeef05558c..6c94490b085 100644 --- a/apps/files/appinfo/routes.php +++ b/apps/files/appinfo/routes.php @@ -37,6 +37,8 @@ declare(strict_types=1); */ namespace OCA\Files\AppInfo; +use OCA\Files\Controller\OpenLocalEditorController; + /** @var Application $application */ $application = \OC::$server->query(Application::class); $application->registerRoutes( @@ -169,6 +171,18 @@ $application->registerRoutes( 'url' => '/api/v1/transferownership/{id}', 'verb' => 'DELETE', ], + [ + /** @see OpenLocalEditorController::create() */ + 'name' => 'OpenLocalEditor#create', + 'url' => '/api/v1/openlocaleditor', + 'verb' => 'POST', + ], + [ + /** @see OpenLocalEditorController::validate() */ + 'name' => 'OpenLocalEditor#validate', + 'url' => '/api/v1/openlocaleditor/{token}', + 'verb' => 'POST', + ], ], ] ); diff --git a/apps/files/composer/composer/autoload_classmap.php b/apps/files/composer/composer/autoload_classmap.php index 46da43165b9..5a2ec4fee1f 100644 --- a/apps/files/composer/composer/autoload_classmap.php +++ b/apps/files/composer/composer/autoload_classmap.php @@ -35,9 +35,12 @@ return array( 'OCA\\Files\\Controller\\ApiController' => $baseDir . '/../lib/Controller/ApiController.php', 'OCA\\Files\\Controller\\DirectEditingController' => $baseDir . '/../lib/Controller/DirectEditingController.php', 'OCA\\Files\\Controller\\DirectEditingViewController' => $baseDir . '/../lib/Controller/DirectEditingViewController.php', + 'OCA\\Files\\Controller\\OpenLocalEditorController' => $baseDir . '/../lib/Controller/OpenLocalEditorController.php', 'OCA\\Files\\Controller\\TemplateController' => $baseDir . '/../lib/Controller/TemplateController.php', 'OCA\\Files\\Controller\\TransferOwnershipController' => $baseDir . '/../lib/Controller/TransferOwnershipController.php', 'OCA\\Files\\Controller\\ViewController' => $baseDir . '/../lib/Controller/ViewController.php', + 'OCA\\Files\\Db\\OpenLocalEditor' => $baseDir . '/../lib/Db/OpenLocalEditor.php', + 'OCA\\Files\\Db\\OpenLocalEditorMapper' => $baseDir . '/../lib/Db/OpenLocalEditorMapper.php', 'OCA\\Files\\Db\\TransferOwnership' => $baseDir . '/../lib/Db/TransferOwnership.php', 'OCA\\Files\\Db\\TransferOwnershipMapper' => $baseDir . '/../lib/Db/TransferOwnershipMapper.php', 'OCA\\Files\\DirectEditingCapabilities' => $baseDir . '/../lib/DirectEditingCapabilities.php', @@ -48,6 +51,7 @@ return array( 'OCA\\Files\\Listener\\LegacyLoadAdditionalScriptsAdapter' => $baseDir . '/../lib/Listener/LegacyLoadAdditionalScriptsAdapter.php', 'OCA\\Files\\Listener\\LoadSidebarListener' => $baseDir . '/../lib/Listener/LoadSidebarListener.php', 'OCA\\Files\\Migration\\Version11301Date20191205150729' => $baseDir . '/../lib/Migration/Version11301Date20191205150729.php', + 'OCA\\Files\\Migration\\Version12101Date20221011153334' => $baseDir . '/../lib/Migration/Version12101Date20221011153334.php', 'OCA\\Files\\Notification\\Notifier' => $baseDir . '/../lib/Notification/Notifier.php', 'OCA\\Files\\Search\\FilesSearchProvider' => $baseDir . '/../lib/Search/FilesSearchProvider.php', 'OCA\\Files\\Service\\DirectEditingService' => $baseDir . '/../lib/Service/DirectEditingService.php', diff --git a/apps/files/composer/composer/autoload_static.php b/apps/files/composer/composer/autoload_static.php index ea9d9715fd3..676d2dbf3f9 100644 --- a/apps/files/composer/composer/autoload_static.php +++ b/apps/files/composer/composer/autoload_static.php @@ -50,9 +50,12 @@ class ComposerStaticInitFiles 'OCA\\Files\\Controller\\ApiController' => __DIR__ . '/..' . '/../lib/Controller/ApiController.php', 'OCA\\Files\\Controller\\DirectEditingController' => __DIR__ . '/..' . '/../lib/Controller/DirectEditingController.php', 'OCA\\Files\\Controller\\DirectEditingViewController' => __DIR__ . '/..' . '/../lib/Controller/DirectEditingViewController.php', + 'OCA\\Files\\Controller\\OpenLocalEditorController' => __DIR__ . '/..' . '/../lib/Controller/OpenLocalEditorController.php', 'OCA\\Files\\Controller\\TemplateController' => __DIR__ . '/..' . '/../lib/Controller/TemplateController.php', 'OCA\\Files\\Controller\\TransferOwnershipController' => __DIR__ . '/..' . '/../lib/Controller/TransferOwnershipController.php', 'OCA\\Files\\Controller\\ViewController' => __DIR__ . '/..' . '/../lib/Controller/ViewController.php', + 'OCA\\Files\\Db\\OpenLocalEditor' => __DIR__ . '/..' . '/../lib/Db/OpenLocalEditor.php', + 'OCA\\Files\\Db\\OpenLocalEditorMapper' => __DIR__ . '/..' . '/../lib/Db/OpenLocalEditorMapper.php', 'OCA\\Files\\Db\\TransferOwnership' => __DIR__ . '/..' . '/../lib/Db/TransferOwnership.php', 'OCA\\Files\\Db\\TransferOwnershipMapper' => __DIR__ . '/..' . '/../lib/Db/TransferOwnershipMapper.php', 'OCA\\Files\\DirectEditingCapabilities' => __DIR__ . '/..' . '/../lib/DirectEditingCapabilities.php', @@ -63,6 +66,7 @@ class ComposerStaticInitFiles 'OCA\\Files\\Listener\\LegacyLoadAdditionalScriptsAdapter' => __DIR__ . '/..' . '/../lib/Listener/LegacyLoadAdditionalScriptsAdapter.php', 'OCA\\Files\\Listener\\LoadSidebarListener' => __DIR__ . '/..' . '/../lib/Listener/LoadSidebarListener.php', 'OCA\\Files\\Migration\\Version11301Date20191205150729' => __DIR__ . '/..' . '/../lib/Migration/Version11301Date20191205150729.php', + 'OCA\\Files\\Migration\\Version12101Date20221011153334' => __DIR__ . '/..' . '/../lib/Migration/Version12101Date20221011153334.php', 'OCA\\Files\\Notification\\Notifier' => __DIR__ . '/..' . '/../lib/Notification/Notifier.php', 'OCA\\Files\\Search\\FilesSearchProvider' => __DIR__ . '/..' . '/../lib/Search/FilesSearchProvider.php', 'OCA\\Files\\Service\\DirectEditingService' => __DIR__ . '/..' . '/../lib/Service/DirectEditingService.php', diff --git a/apps/files/js/filelist.js b/apps/files/js/filelist.js index 2761c3a62b2..7caed29baa3 100644 --- a/apps/files/js/filelist.js +++ b/apps/files/js/filelist.js @@ -2808,12 +2808,23 @@ }, openLocalClient: function(path) { - var scheme = 'nc://'; - var command = 'open'; - var uid = OC.getCurrentUser().uid; - var url = scheme + command + '/' + uid + '@' + window.location.host + OC.encodePath(path); + var link = OC.linkToOCS('apps/files/api/v1', 2) + 'openlocaleditor?format=json'; - window.location.href = url; + $.post(link, { + path + }) + .success(function(result) { + var scheme = 'nc://'; + var command = 'open'; + var uid = OC.getCurrentUser().uid; + var url = scheme + command + '/' + uid + '@' + window.location.host + OC.encodePath(path); + url += '?token=' + result.ocs.data.token; + + window.location.href = url; + }) + .fail(function() { + OC.Notification.show(t('files', 'Failed to redirect to client')) + }) }, /** diff --git a/apps/files/lib/Controller/OpenLocalEditorController.php b/apps/files/lib/Controller/OpenLocalEditorController.php new file mode 100644 index 00000000000..ff39c1fe0e7 --- /dev/null +++ b/apps/files/lib/Controller/OpenLocalEditorController.php @@ -0,0 +1,135 @@ + + * + * @author Joas Schilling + * + * @license GNU AGPL version 3 or any later version + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as + * published by the Free Software Foundation, either version 3 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see . + * + */ + +namespace OCA\Files\Controller; + +use OCA\Files\Db\OpenLocalEditor; +use OCA\Files\Db\OpenLocalEditorMapper; +use OCP\AppFramework\Db\DoesNotExistException; +use OCP\AppFramework\Http; +use OCP\AppFramework\Http\DataResponse; +use OCP\AppFramework\OCSController; +use OCP\AppFramework\Utility\ITimeFactory; +use OCP\DB\Exception; +use OCP\IRequest; +use OCP\Security\ISecureRandom; +use Psr\Log\LoggerInterface; + +class OpenLocalEditorController extends OCSController { + public const TOKEN_LENGTH = 128; + public const TOKEN_DURATION = 600; // 10 Minutes + public const TOKEN_RETRIES = 50; + + protected ITimeFactory $timeFactory; + protected OpenLocalEditorMapper $mapper; + protected ISecureRandom $secureRandom; + protected LoggerInterface $logger; + protected ?string $userId; + + public function __construct( + string $appName, + IRequest $request, + ITimeFactory $timeFactory, + OpenLocalEditorMapper $mapper, + ISecureRandom $secureRandom, + LoggerInterface $logger, + ?string $userId + ) { + parent::__construct($appName, $request); + + $this->timeFactory = $timeFactory; + $this->mapper = $mapper; + $this->secureRandom = $secureRandom; + $this->logger = $logger; + $this->userId = $userId; + } + + /** + * @NoAdminRequired + * @UserRateThrottle(limit=10, period=120) + */ + public function create(string $path): DataResponse { + $pathHash = sha1($path); + + $entity = new OpenLocalEditor(); + $entity->setUserId($this->userId); + $entity->setPathHash($pathHash); + $entity->setExpirationTime($this->timeFactory->getTime() + self::TOKEN_DURATION); // Expire in 10 minutes + + for ($i = 1; $i <= self::TOKEN_RETRIES; $i++) { + $token = $this->secureRandom->generate(self::TOKEN_LENGTH, ISecureRandom::CHAR_ALPHANUMERIC); + $entity->setToken($token); + + try { + $this->mapper->insert($entity); + + return new DataResponse([ + 'userId' => $this->userId, + 'pathHash' => $pathHash, + 'expirationTime' => $entity->getExpirationTime(), + 'token' => $entity->getToken(), + ]); + } catch (Exception $e) { + if ($e->getCode() !== Exception::REASON_UNIQUE_CONSTRAINT_VIOLATION) { + // Only retry on unique constraint violation + throw $e; + } + } + } + + $this->logger->error('Giving up after ' . self::TOKEN_RETRIES . ' retries to generate a unique local editor token for path hash: ' . $pathHash); + return new DataResponse([], Http::STATUS_INTERNAL_SERVER_ERROR); + } + + /** + * @NoAdminRequired + * @BruteForceProtection(action=openLocalEditor) + */ + public function validate(string $path, string $token): DataResponse { + $pathHash = sha1($path); + + try { + $entity = $this->mapper->verifyToken($this->userId, $pathHash, $token); + } catch (DoesNotExistException $e) { + $response = new DataResponse([], Http::STATUS_NOT_FOUND); + $response->throttle(['userId' => $this->userId, 'pathHash' => $pathHash]); + return $response; + } + + if ($entity->getExpirationTime() <= $this->timeFactory->getTime()) { + $this->mapper->delete($entity); + return new DataResponse([], Http::STATUS_NOT_FOUND); + } + + return new DataResponse([ + 'userId' => $this->userId, + 'pathHash' => $pathHash, + 'expirationTime' => $entity->getExpirationTime(), + 'token' => $entity->getToken(), + ]); + } + +} diff --git a/apps/files/lib/Db/OpenLocalEditor.php b/apps/files/lib/Db/OpenLocalEditor.php new file mode 100644 index 00000000000..81bb55e47f7 --- /dev/null +++ b/apps/files/lib/Db/OpenLocalEditor.php @@ -0,0 +1,60 @@ + + * + * @author Joas Schilling + * + * @license GNU AGPL version 3 or any later version + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as + * published by the Free Software Foundation, either version 3 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see . + * + */ + +namespace OCA\Files\Db; + +use OCP\AppFramework\Db\Entity; + +/** + * @method void setUserId(string $userId) + * @method string getUserId() + * @method void setPathHash(string $pathHash) + * @method string getPathHash() + * @method void setExpirationTime(int $expirationTime) + * @method int getExpirationTime() + * @method void setToken(string $token) + * @method string getToken() + */ +class OpenLocalEditor extends Entity { + /** @var string */ + protected $userId; + + /** @var string */ + protected $pathHash; + + /** @var int */ + protected $expirationTime; + + /** @var string */ + protected $token; + + public function __construct() { + $this->addType('userId', 'string'); + $this->addType('pathHash', 'string'); + $this->addType('expirationTime', 'integer'); + $this->addType('token', 'string'); + } +} diff --git a/apps/files/lib/Db/OpenLocalEditorMapper.php b/apps/files/lib/Db/OpenLocalEditorMapper.php new file mode 100644 index 00000000000..a0ed8b0fe96 --- /dev/null +++ b/apps/files/lib/Db/OpenLocalEditorMapper.php @@ -0,0 +1,56 @@ + + * + * @author Joas Schilling + * + * @license GNU AGPL version 3 or any later version + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as + * published by the Free Software Foundation, either version 3 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see . + * + */ + +namespace OCA\Files\Db; + +use OCP\AppFramework\Db\DoesNotExistException; +use OCP\AppFramework\Db\MultipleObjectsReturnedException; +use OCP\AppFramework\Db\QBMapper; +use OCP\DB\Exception; +use OCP\IDBConnection; + +class OpenLocalEditorMapper extends QBMapper { + public function __construct(IDBConnection $db) { + parent::__construct($db, 'open_local_editor', OpenLocalEditor::class); + } + + /** + * @throws DoesNotExistException + * @throws MultipleObjectsReturnedException + * @throws Exception + */ + public function verifyToken(string $userId, string $pathHash, string $token): OpenLocalEditor { + $qb = $this->db->getQueryBuilder(); + + $qb->select('*') + ->from($this->getTableName()) + ->where($qb->expr()->eq('user_id', $qb->createNamedParameter($userId))) + ->andWhere($qb->expr()->eq('path_hash', $qb->createNamedParameter($pathHash))) + ->andWhere($qb->expr()->eq('token', $qb->createNamedParameter($token))); + + return $this->findEntity($qb); + } +} diff --git a/apps/files/lib/Migration/Version12101Date20221011153334.php b/apps/files/lib/Migration/Version12101Date20221011153334.php new file mode 100644 index 00000000000..84708c65076 --- /dev/null +++ b/apps/files/lib/Migration/Version12101Date20221011153334.php @@ -0,0 +1,75 @@ + + * + * @author Joas Schilling + * + * @license GNU AGPL version 3 or any later version + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as + * published by the Free Software Foundation, either version 3 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see . + * + */ + +namespace OCA\Files\Migration; + +use Closure; +use OCP\DB\ISchemaWrapper; +use OCP\DB\Types; +use OCP\Migration\IOutput; +use OCP\Migration\SimpleMigrationStep; + +class Version12101Date20221011153334 extends SimpleMigrationStep { + /** + * @param IOutput $output + * @param Closure(): ISchemaWrapper $schemaClosure + * @param array $options + * @return null|ISchemaWrapper + */ + public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper { + /** @var ISchemaWrapper $schema */ + $schema = $schemaClosure(); + + $table = $schema->createTable('open_local_editor'); + $table->addColumn('id',Types::BIGINT, [ + 'autoincrement' => true, + 'notnull' => true, + 'length' => 20, + 'unsigned' => true, + ]); + $table->addColumn('user_id', Types::STRING, [ + 'notnull' => true, + 'length' => 64, + ]); + $table->addColumn('path_hash', Types::STRING, [ + 'notnull' => true, + 'length' => 64, + ]); + $table->addColumn('expiration_time', Types::BIGINT, [ + 'notnull' => true, + 'unsigned' => true, + ]); + $table->addColumn('token', Types::STRING, [ + 'notnull' => true, + 'length' => 128, + ]); + + $table->setPrimaryKey(['id']); + $table->addUniqueIndex(['user_id', 'path_hash', 'token'], 'openlocal_user_path_token'); + + return $schema; + } +} -- 2.39.5