1
0

OpenLocalEditorController.php 4.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156
  1. <?php
  2. declare(strict_types=1);
  3. /**
  4. * @copyright Copyright (c) 2022 Joas Schilling <coding@schilljs.com>
  5. *
  6. * @author Joas Schilling <coding@schilljs.com>
  7. *
  8. * @license GNU AGPL version 3 or any later version
  9. *
  10. * This program is free software: you can redistribute it and/or modify
  11. * it under the terms of the GNU Affero General Public License as
  12. * published by the Free Software Foundation, either version 3 of the
  13. * License, or (at your option) any later version.
  14. *
  15. * This program is distributed in the hope that it will be useful,
  16. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  18. * GNU Affero General Public License for more details.
  19. *
  20. * You should have received a copy of the GNU Affero General Public License
  21. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  22. *
  23. */
  24. namespace OCA\Files\Controller;
  25. use OCA\Files\Db\OpenLocalEditor;
  26. use OCA\Files\Db\OpenLocalEditorMapper;
  27. use OCP\AppFramework\Db\DoesNotExistException;
  28. use OCP\AppFramework\Http;
  29. use OCP\AppFramework\Http\DataResponse;
  30. use OCP\AppFramework\OCSController;
  31. use OCP\AppFramework\Utility\ITimeFactory;
  32. use OCP\DB\Exception;
  33. use OCP\IRequest;
  34. use OCP\Security\ISecureRandom;
  35. use Psr\Log\LoggerInterface;
  36. class OpenLocalEditorController extends OCSController {
  37. public const TOKEN_LENGTH = 128;
  38. public const TOKEN_DURATION = 600; // 10 Minutes
  39. public const TOKEN_RETRIES = 50;
  40. protected ITimeFactory $timeFactory;
  41. protected OpenLocalEditorMapper $mapper;
  42. protected ISecureRandom $secureRandom;
  43. protected LoggerInterface $logger;
  44. protected ?string $userId;
  45. public function __construct(
  46. string $appName,
  47. IRequest $request,
  48. ITimeFactory $timeFactory,
  49. OpenLocalEditorMapper $mapper,
  50. ISecureRandom $secureRandom,
  51. LoggerInterface $logger,
  52. ?string $userId
  53. ) {
  54. parent::__construct($appName, $request);
  55. $this->timeFactory = $timeFactory;
  56. $this->mapper = $mapper;
  57. $this->secureRandom = $secureRandom;
  58. $this->logger = $logger;
  59. $this->userId = $userId;
  60. }
  61. /**
  62. * @NoAdminRequired
  63. * @UserRateThrottle(limit=10, period=120)
  64. *
  65. * Create a local editor
  66. *
  67. * @param string $path Path of the file
  68. *
  69. * @return DataResponse<Http::STATUS_OK, array{userId: ?string, pathHash: string, expirationTime: int, token: string}, array{}>|DataResponse<Http::STATUS_INTERNAL_SERVER_ERROR, array<empty>, array{}>
  70. *
  71. * 200: Local editor returned
  72. */
  73. public function create(string $path): DataResponse {
  74. $pathHash = sha1($path);
  75. $entity = new OpenLocalEditor();
  76. $entity->setUserId($this->userId);
  77. $entity->setPathHash($pathHash);
  78. $entity->setExpirationTime($this->timeFactory->getTime() + self::TOKEN_DURATION); // Expire in 10 minutes
  79. for ($i = 1; $i <= self::TOKEN_RETRIES; $i++) {
  80. $token = $this->secureRandom->generate(self::TOKEN_LENGTH, ISecureRandom::CHAR_ALPHANUMERIC);
  81. $entity->setToken($token);
  82. try {
  83. $this->mapper->insert($entity);
  84. return new DataResponse([
  85. 'userId' => $this->userId,
  86. 'pathHash' => $pathHash,
  87. 'expirationTime' => $entity->getExpirationTime(),
  88. 'token' => $entity->getToken(),
  89. ]);
  90. } catch (Exception $e) {
  91. if ($e->getCode() !== Exception::REASON_UNIQUE_CONSTRAINT_VIOLATION) {
  92. // Only retry on unique constraint violation
  93. throw $e;
  94. }
  95. }
  96. }
  97. $this->logger->error('Giving up after ' . self::TOKEN_RETRIES . ' retries to generate a unique local editor token for path hash: ' . $pathHash);
  98. return new DataResponse([], Http::STATUS_INTERNAL_SERVER_ERROR);
  99. }
  100. /**
  101. * @NoAdminRequired
  102. * @BruteForceProtection(action=openLocalEditor)
  103. *
  104. * Validate a local editor
  105. *
  106. * @param string $path Path of the file
  107. * @param string $token Token of the local editor
  108. *
  109. * @return DataResponse<Http::STATUS_OK, array{userId: string, pathHash: string, expirationTime: int, token: string}, array{}>|DataResponse<Http::STATUS_NOT_FOUND, array<empty>, array{}>
  110. *
  111. * 200: Local editor validated successfully
  112. * 404: Local editor not found
  113. */
  114. public function validate(string $path, string $token): DataResponse {
  115. $pathHash = sha1($path);
  116. try {
  117. $entity = $this->mapper->verifyToken($this->userId, $pathHash, $token);
  118. } catch (DoesNotExistException $e) {
  119. $response = new DataResponse([], Http::STATUS_NOT_FOUND);
  120. $response->throttle(['userId' => $this->userId, 'pathHash' => $pathHash]);
  121. return $response;
  122. }
  123. $this->mapper->delete($entity);
  124. if ($entity->getExpirationTime() <= $this->timeFactory->getTime()) {
  125. $response = new DataResponse([], Http::STATUS_NOT_FOUND);
  126. $response->throttle(['userId' => $this->userId, 'pathHash' => $pathHash]);
  127. return $response;
  128. }
  129. return new DataResponse([
  130. 'userId' => $this->userId,
  131. 'pathHash' => $pathHash,
  132. 'expirationTime' => $entity->getExpirationTime(),
  133. 'token' => $entity->getToken(),
  134. ]);
  135. }
  136. }