From fd7cca239abb6712d442e374407a29c2fcc57643 Mon Sep 17 00:00:00 2001 From: Uwe Steinmann Date: Wed, 17 Jun 2020 11:17:09 +0200 Subject: [PATCH 01/55] =?UTF-8?q?ignore=20all=20files/directories=20starti?= =?UTF-8?q?ng=20with=20'.'=20when=20zip=D1=96ng=20an=20extension?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- inc/inc.ClassExtensionMgr.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/inc/inc.ClassExtensionMgr.php b/inc/inc.ClassExtensionMgr.php index 1776eb79f..b65cec291 100644 --- a/inc/inc.ClassExtensionMgr.php +++ b/inc/inc.ClassExtensionMgr.php @@ -255,6 +255,9 @@ class SeedDMS_Extension_Mgr { // Ignore "." and ".." folders if( in_array(substr($file, strrpos($file, '/')+1), array('.', '..')) ) continue; + // Ignore all files and directories starting with a '.' + if( preg_match('#/\\.#', $file) ) + continue; $file = realpath($file); From 5dcafd65cee26c86e6fd7db4d5c11ec11cd6abc1 Mon Sep 17 00:00:00 2001 From: Uwe Steinmann Date: Wed, 17 Jun 2020 11:18:15 +0200 Subject: [PATCH 02/55] add support for cors --- restapi/index.php | 36 +++++++++++++++++++++++++++++++++--- 1 file changed, 33 insertions(+), 3 deletions(-) diff --git a/restapi/index.php b/restapi/index.php index 6fc693faf..50a6c0f1e 100644 --- a/restapi/index.php +++ b/restapi/index.php @@ -20,6 +20,25 @@ if(USE_PHP_SESSION) { exit; $dms->setUser($userobj); } else { + $headers = apache_request_headers(); + if($settings->_apiOrigin && isset($headers['Origin'])) { + $origins = explode(',', $settings->_apiOrigin); + if(!in_array($headers['Origin'], $origins)) { + http_response_code(403); + exit; + } + } + if(isset($headers['Authorization']) && !empty($settings->_apiKey) && !empty($settings->_apiUserId)) { + if($settings->_apiKey == $headers['Authorization']) { + if(!($userobj = $dms->getUser($settings->_apiUserId))) { + http_response_code(403); + exit; + } + } else { + http_response_code(403); + exit; + } + } else { require_once("../inc/inc.ClassSession.php"); $session = new SeedDMS_Session($db); if (isset($_COOKIE["mydms_session"])) { @@ -50,6 +69,7 @@ if(USE_PHP_SESSION) { } $dms->setUser($userobj); } + } } require "vendor/autoload.php"; @@ -2034,12 +2054,22 @@ function clearFolderAccessList($request, $response, $args) { /* {{{ */ } /* }}} */ function echoData($request, $response) { /* {{{ */ - echo $request->getBody(); + return $response->withJson(array('success'=>true, 'message'=>'This is the result of the echo call.', 'data'=>''), 200); } /* }}} */ //$app = new Slim(array('mode'=>'development', '_session.handler'=>null)); $app = new \Slim\App(); - +// Make CORS preflighted request possible +$app->options('/{routes:.+}', function ($request, $response, $args) { + return $response; +}); +$app->add(function ($req, $res, $next) { + $response = $next($req, $res); + return $response + ->withHeader('Access-Control-Allow-Origin', $req->getHeader('Origin')) + ->withHeader('Access-Control-Allow-Headers', 'X-Requested-With, Content-Type, Accept, Origin, Authorization') + ->withHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, PATCH, OPTIONS'); +}); // use post for create operation // use get for retrieval operation // use put for update operation @@ -2104,7 +2134,7 @@ $app->post('/categories', 'createCategory'); $app->put('/categories/{id}/name', 'changeCategoryName'); $app->get('/attributedefinitions', 'getAttributeDefinitions'); $app->put('/attributedefinitions/{id}/name', 'changeAttributeDefinitionName'); -$app->any('/echo', 'echoData'); +$app->get('/echo', 'echoData'); $app->run(); ?> From 0429815c781319b1194ba5da835029a4f9951585 Mon Sep 17 00:00:00 2001 From: Uwe Steinmann Date: Wed, 17 Jun 2020 11:18:42 +0200 Subject: [PATCH 03/55] add changes for 5.1.18 --- CHANGELOG | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG b/CHANGELOG index e37ca2eed..56e0f6981 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -5,6 +5,10 @@ - minor fix for better behaviour of folder tree ('plus' signs appears if folder has children) - allow to import users from csv file +- skip all fileѕ and directories starting with a '.' when creating an extension's + zip file +- add support for authentication of the rest api by a key +- add support for CORS in the rest api -------------------------------------------------------------------------------- Changes in version 5.1.17 From 7725a0b03b1b06e0d21be15aa32912dda3e6658f Mon Sep 17 00:00:00 2001 From: Uwe Steinmann Date: Wed, 17 Jun 2020 11:19:02 +0200 Subject: [PATCH 04/55] add configuration for authentication by key in rest api --- inc/inc.ClassSettings.php | 12 ++++++++++++ op/op.Settings.php | 3 +++ views/bootstrap/class.Settings.php | 3 +++ 3 files changed, 18 insertions(+) diff --git a/inc/inc.ClassSettings.php b/inc/inc.ClassSettings.php index 7965fc619..d040cbb02 100644 --- a/inc/inc.ClassSettings.php +++ b/inc/inc.ClassSettings.php @@ -68,6 +68,12 @@ class Settings { /* {{{ */ var $_cookieLifetime = ''; // default access mode for documents var $_defaultAccessDocs = ''; + // api key for restapi + var $_apiKey = ''; + // api user id for restapi + var $_apiUserId = 0; + // api allowed origins for restapi + var $_apiOrigin = ''; // Strict form checking var $_strictFormCheck = false; // list of form fields which are visible by default but can be explixitly @@ -656,6 +662,9 @@ class Settings { /* {{{ */ $tab = $node[0]->attributes(); $this->_guestID = intval($tab["guestID"]); $this->_adminIP = strval($tab["adminIP"]); + $this->_apiKey = strval($tab["apiKey"]); + $this->_apiUserId = intval($tab["apiUserId"]); + $this->_apiOrigin = strval($tab["apiOrigin"]); } // XML Path: /configuration/advanced/edition @@ -985,6 +994,9 @@ class Settings { /* {{{ */ $node = $this->getXMLNode($xml, '/configuration/advanced', 'authentication'); $this->setXMLAttributValue($node, "guestID", $this->_guestID); $this->setXMLAttributValue($node, "adminIP", $this->_adminIP); + $this->setXMLAttributValue($node, "apiKey", $this->_apiKey); + $this->setXMLAttributValue($node, "apiUserId", $this->_apiUserId); + $this->setXMLAttributValue($node, "apiOrigin", $this->_apiOrigin); // XML Path: /configuration/advanced/edition $node = $this->getXMLNode($xml, '/configuration/advanced', 'edition'); diff --git a/op/op.Settings.php b/op/op.Settings.php index 273626cb1..2c1c9a463 100644 --- a/op/op.Settings.php +++ b/op/op.Settings.php @@ -181,6 +181,9 @@ if ($action == "saveSettings") // SETTINGS - ADVANCED - AUTHENTICATION $settings->_guestID = intval($_POST["guestID"]); $settings->_adminIP = $_POST["adminIP"]; + $settings->_apiKey = strval($_POST["apiKey"]); + $settings->_apiUserId = intval($_POST["apiUserId"]); + $settings->_apiOrigin = strval($_POST["apiOrigin"]); // SETTINGS - ADVANCED - EDITION $settings->_versioningFileName = $_POST["versioningFileName"]; diff --git a/views/bootstrap/class.Settings.php b/views/bootstrap/class.Settings.php index a8ecb3e3d..820f1db1e 100644 --- a/views/bootstrap/class.Settings.php +++ b/views/bootstrap/class.Settings.php @@ -421,6 +421,9 @@ $this->showStartPaneContent('site', (!$currenttab || $currenttab == 'site')); showConfigHeadline('settings_Authentication'); ?> showConfigText('settings_guestID', 'guestID'); ?> showConfigText('settings_adminIP', 'adminIP'); ?> +showConfigText('settings_apiKey', 'apiKey'); ?> +showConfigText('settings_apiUserId', 'apiUserId'); ?> +showConfigText('settings_apiOrigin', 'apiOrigin'); ?>