summaryrefslogtreecommitdiffstats
path: root/lib/private/Security/CertificateManager.php
diff options
context:
space:
mode:
authorRoeland Jago Douma <rullzer@owncloud.com>2016-04-14 19:21:18 +0200
committerRoeland Jago Douma <rullzer@owncloud.com>2016-04-14 19:21:18 +0200
commit9050e76d955e06a5e5ed9b4b1c444bdf03699ba0 (patch)
treeeeded71dd4672fc9dc2f67296b0faff8cd62ab73 /lib/private/Security/CertificateManager.php
parent5911ce530b003d46348f59e9280b610f684de85a (diff)
downloadnextcloud-server-9050e76d955e06a5e5ed9b4b1c444bdf03699ba0.tar.gz
nextcloud-server-9050e76d955e06a5e5ed9b4b1c444bdf03699ba0.zip
Move \OC\Security to PSR-4
Diffstat (limited to 'lib/private/Security/CertificateManager.php')
-rw-r--r--lib/private/Security/CertificateManager.php250
1 files changed, 250 insertions, 0 deletions
diff --git a/lib/private/Security/CertificateManager.php b/lib/private/Security/CertificateManager.php
new file mode 100644
index 00000000000..f4932ca568e
--- /dev/null
+++ b/lib/private/Security/CertificateManager.php
@@ -0,0 +1,250 @@
+<?php
+/**
+ * @author Björn Schießle <schiessle@owncloud.com>
+ * @author Joas Schilling <nickvergessen@owncloud.com>
+ * @author Lukas Reschke <lukas@owncloud.com>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Robin Appelman <icewind@owncloud.com>
+ *
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+namespace OC\Security;
+
+use OC\Files\Filesystem;
+use OCP\ICertificateManager;
+use OCP\IConfig;
+
+/**
+ * Manage trusted certificates for users
+ */
+class CertificateManager implements ICertificateManager {
+ /**
+ * @var string
+ */
+ protected $uid;
+
+ /**
+ * @var \OC\Files\View
+ */
+ protected $view;
+
+ /**
+ * @var IConfig
+ */
+ protected $config;
+
+ /**
+ * @param string $uid
+ * @param \OC\Files\View $view relative to data/
+ * @param IConfig $config
+ */
+ public function __construct($uid, \OC\Files\View $view, IConfig $config) {
+ $this->uid = $uid;
+ $this->view = $view;
+ $this->config = $config;
+ }
+
+ /**
+ * Returns all certificates trusted by the user
+ *
+ * @return \OCP\ICertificate[]
+ */
+ public function listCertificates() {
+
+ if (!$this->config->getSystemValue('installed', false)) {
+ return array();
+ }
+
+ $path = $this->getPathToCertificates() . 'uploads/';
+ if (!$this->view->is_dir($path)) {
+ return array();
+ }
+ $result = array();
+ $handle = $this->view->opendir($path);
+ if (!is_resource($handle)) {
+ return array();
+ }
+ while (false !== ($file = readdir($handle))) {
+ if ($file != '.' && $file != '..') {
+ try {
+ $result[] = new Certificate($this->view->file_get_contents($path . $file), $file);
+ } catch (\Exception $e) {
+ }
+ }
+ }
+ closedir($handle);
+ return $result;
+ }
+
+ /**
+ * create the certificate bundle of all trusted certificated
+ */
+ public function createCertificateBundle() {
+ $path = $this->getPathToCertificates();
+ $certs = $this->listCertificates();
+
+ if (!$this->view->file_exists($path)) {
+ $this->view->mkdir($path);
+ }
+
+ $fhCerts = $this->view->fopen($path . '/rootcerts.crt', 'w');
+
+ // Write user certificates
+ foreach ($certs as $cert) {
+ $file = $path . '/uploads/' . $cert->getName();
+ $data = $this->view->file_get_contents($file);
+ if (strpos($data, 'BEGIN CERTIFICATE')) {
+ fwrite($fhCerts, $data);
+ fwrite($fhCerts, "\r\n");
+ }
+ }
+
+ // Append the default certificates
+ $defaultCertificates = file_get_contents(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
+ fwrite($fhCerts, $defaultCertificates);
+
+ // Append the system certificate bundle
+ $systemBundle = $this->getCertificateBundle(null);
+ if ($this->view->file_exists($systemBundle)) {
+ $systemCertificates = $this->view->file_get_contents($systemBundle);
+ fwrite($fhCerts, $systemCertificates);
+ }
+
+ fclose($fhCerts);
+ }
+
+ /**
+ * Save the certificate and re-generate the certificate bundle
+ *
+ * @param string $certificate the certificate data
+ * @param string $name the filename for the certificate
+ * @return \OCP\ICertificate
+ * @throws \Exception If the certificate could not get added
+ */
+ public function addCertificate($certificate, $name) {
+ if (!Filesystem::isValidPath($name) or Filesystem::isFileBlacklisted($name)) {
+ throw new \Exception('Filename is not valid');
+ }
+
+ $dir = $this->getPathToCertificates() . 'uploads/';
+ if (!$this->view->file_exists($dir)) {
+ $this->view->mkdir($dir);
+ }
+
+ try {
+ $file = $dir . $name;
+ $certificateObject = new Certificate($certificate, $name);
+ $this->view->file_put_contents($file, $certificate);
+ $this->createCertificateBundle();
+ return $certificateObject;
+ } catch (\Exception $e) {
+ throw $e;
+ }
+
+ }
+
+ /**
+ * Remove the certificate and re-generate the certificate bundle
+ *
+ * @param string $name
+ * @return bool
+ */
+ public function removeCertificate($name) {
+ if (!Filesystem::isValidPath($name)) {
+ return false;
+ }
+ $path = $this->getPathToCertificates() . 'uploads/';
+ if ($this->view->file_exists($path . $name)) {
+ $this->view->unlink($path . $name);
+ $this->createCertificateBundle();
+ }
+ return true;
+ }
+
+ /**
+ * Get the path to the certificate bundle for this user
+ *
+ * @param string $uid (optional) user to get the certificate bundle for, use `null` to get the system bundle
+ * @return string
+ */
+ public function getCertificateBundle($uid = '') {
+ if ($uid === '') {
+ $uid = $this->uid;
+ }
+ return $this->getPathToCertificates($uid) . 'rootcerts.crt';
+ }
+
+ /**
+ * Get the full local path to the certificate bundle for this user
+ *
+ * @param string $uid (optional) user to get the certificate bundle for, use `null` to get the system bundle
+ * @return string
+ */
+ public function getAbsoluteBundlePath($uid = '') {
+ if ($uid === '') {
+ $uid = $this->uid;
+ }
+ if ($this->needsRebundling($uid)) {
+ if (is_null($uid)) {
+ $manager = new CertificateManager(null, $this->view, $this->config);
+ $manager->createCertificateBundle();
+ } else {
+ $this->createCertificateBundle();
+ }
+ }
+ return $this->view->getLocalFile($this->getCertificateBundle($uid));
+ }
+
+ /**
+ * @param string $uid (optional) user to get the certificate path for, use `null` to get the system path
+ * @return string
+ */
+ private function getPathToCertificates($uid = '') {
+ if ($uid === '') {
+ $uid = $this->uid;
+ }
+ $path = is_null($uid) ? '/files_external/' : '/' . $uid . '/files_external/';
+
+ return $path;
+ }
+
+ /**
+ * Check if we need to re-bundle the certificates because one of the sources has updated
+ *
+ * @param string $uid (optional) user to get the certificate path for, use `null` to get the system path
+ * @return bool
+ */
+ private function needsRebundling($uid = '') {
+ if ($uid === '') {
+ $uid = $this->uid;
+ }
+ $sourceMTimes = [filemtime(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt')];
+ $targetBundle = $this->getCertificateBundle($uid);
+ if (!$this->view->file_exists($targetBundle)) {
+ return true;
+ }
+ if (!is_null($uid)) { // also depend on the system bundle
+ $sourceBundles[] = $this->view->filemtime($this->getCertificateBundle(null));
+ }
+
+ $sourceMTime = array_reduce($sourceMTimes, function ($max, $mtime) {
+ return max($max, $mtime);
+ }, 0);
+ return $sourceMTime > $this->view->filemtime($targetBundle);
+ }
+}
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-11 01:23:18 +0000
pan class="p">, "{actor} created todo {todo} in list {calendar}" : "{actor} ha creato la cosa da fare {todo} nell'elenco {calendar}", "You created todo {todo} in list {calendar}" : "Hai creato la cosa da fare {todo} nell'elenco {calendar}", "{actor} deleted todo {todo} from list {calendar}" : "{actor} ha eliminato la cosa da fare {todo} dall'elenco {calendar}", "You deleted todo {todo} from list {calendar}" : "Hai eliminato la cosa da fare {todo} dall'elenco {calendar}", "{actor} updated todo {todo} in list {calendar}" : "{actor} ha aggiornato la cosa da fare {todo} nell'elenco {calendar}", "You updated todo {todo} in list {calendar}" : "Hai aggiornato la cosa da fare {todo} nell'elenco {calendar}", "{actor} solved todo {todo} in list {calendar}" : "{actor} ha risolto la cosa da fare {todo} nell'elenco {calendar}", "You solved todo {todo} in list {calendar}" : "Hai risolto la cosa da fare {todo} nell'elenco {calendar}", "{actor} reopened todo {todo} in list {calendar}" : "{actor} ha riaperto la cosa da fare {todo} nell'elenco {calendar}", "You reopened todo {todo} in list {calendar}" : "Hai riaperto la cosa da fare {todo} nell'elenco {calendar}", "Calendar and tasks" : "Calendario e attività", "A <strong>calendar</strong> was modified" : "Un <strong>calendario</strong> è stato modificato", "A calendar <strong>event</strong> was modified" : "Un <strong>evento</strong> del calendario è stato modificato", "A calendar <strong>todo</strong> was modified" : "Una <strong>cosa da fare</strong> del calendario è stata modificata", "Contact birthdays" : "Date di nascita dei contatti", "Death of %s" : "Morte di %s", "Calendar:" : "Calendario:", "Date:" : "Data:", "Where:" : "Dove:", "Description:" : "Descrizione:", "Untitled event" : "Evento senza titolo", "_%n year_::_%n years_" : ["%n anno","%n anni"], "_%n month_::_%n months_" : ["%n mese","%n mesi"], "_%n day_::_%n days_" : ["%n giorno","%n giorni"], "_%n hour_::_%n hours_" : ["%n ora","%n ore"], "_%n minute_::_%n minutes_" : ["%n minuto","%n minuti"], "%s (in %s)" : "%s (in %s)", "%s (%s ago)" : "%s (%s fa)", "Calendar: %s" : "Calendario: %s", "Date: %s" : "Data: %s", "Description: %s" : "Descrizione: %s", "Where: %s" : "Dove: %s", "%1$s via %2$s" : "%1$s tramite %2$s", "Invitation canceled" : "Invito annullato", "Invitation updated" : "Invito aggiornato", "Invitation" : "Invito", "Title:" : "Titolo:", "Time:" : "Ora:", "Location:" : "Posizione:", "Link:" : "Collegamento:", "Organizer:" : "Organizzatore:", "Attendees:" : "Partecipanti:", "Accept" : "Accetta", "Decline" : "Rifiuta", "More options …" : "Altre opzioni...", "More options at %s" : "Altre opzioni alle %s", "Contacts" : "Contatti", "System in maintenance mode." : "Sistema in manutenzione", "Upgrade needed" : "Aggiornamento necessario", "Your %s needs to be configured to use HTTPS in order to use CalDAV and CardDAV with iOS/macOS." : "Il tuo %s deve essere configurato all'uso di HTTPS per poter usare CalDAV e CardDAV con iOS/macOS.", "Configures a CalDAV account" : "Configura un account CalDAV", "Configures a CardDAV account" : "Configura un account CardDAV", "Events" : "Eventi", "Tasks" : "Attività", "Untitled task" : "Attività senza titolo", "Completed on %s" : "Completata il %s", "Due on %s by %s" : "Scade il %s per %s", "Due on %s" : "Scade il %s", "WebDAV" : "WebDAV", "WebDAV endpoint" : "Terminatore WebDAV", "There was an error updating your attendance status." : "Si è verificato un errore durante l'aggiornamento dello stato della tua partecipazione.", "Please contact the organizer directly." : "Contatta direttamente l'amministratore.", "Are you accepting the invitation?" : "Accetti l'invito?", "Tentative" : "Provvisorio", "Save" : "Salva", "Your attendance was updated successfully." : "La tua partecipazione è stata aggiornata correttamente.", "Calendar server" : "Server di calendari", "Also install the {calendarappstoreopen}Calendar app{linkclose}, or {calendardocopen}connect your desktop & mobile for syncing ↗{linkclose}." : "Installa anche {calendarappstoreopen}l'applicazione Calendario{linkclose}, o {calendardocopen}connetti il tuo desktop e mobile per la sincronizzazione ↗{linkclose}.", "Send invitations to attendees" : "Invia gli inviti ai partecipanti", "Please make sure to properly set up {emailopen}the email server{linkclose}." : "Assicurati di configurare correttamente {emailopen}il server di posta{linkclose}.", "Automatically generate a birthday calendar" : "Genera automaticamente un calendario dei compleanni", "Birthday calendars will be generated by a background job." : "Il calendario dei compleanni sarà generato con un'operazione in background.", "Hence they will not be available immediately after enabling but will show up after some time." : "Per cui non saranno disponibili immediatamente dopo l'abilitazione, ma saranno mostrati dopo qualche istante.", "Send notifications for events" : "Invia notifiche per eventi", "Notifications are sent via background jobs, so these must occur often enough." : "Le notifiche saranno inviate tramite operazioni in background, per cui tali operazioni devono essere eseguite abbastanza spesso.", "Enable notifications for events via push" : "Abilita notifiche per eventi tramite push", "Hello %s," : "Ciao %s,", "The meeting »%1$s« with %2$s was canceled." : "L'incontro «%1$s» con %2$s è stato annullato.", "The meeting »%1$s« with %2$s was updated." : "L'incontro «%1$s» con %2$s è stato aggiornato.", "%1$s invited you to »%2$s«" : "%1$s ti ha invitato a «%2$s»", "When:" : "Quando:" }, "nplurals=2; plural=(n != 1);");
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-11 01:23:05 +0000