The editor is about to be opened to strangers: a post on Reddit and a guest access (#428). nginx served the whole workspace and ran every PHP file in it, the API let anybody guess passwords as fast as they liked, and one account could fill the disk. - nginx (shared web stack, outside this repo, backup in /root/config-backup-20261015/) hands out only the two pages, dist/, public/brand/, the uploads by kind and ending, and api/index.php. Everything else under /feuerwerk/ is a 404. - PHP behind it has display_errors off and no X-Powered-By. Plain HTTP forwards to HTTPS, the API refuses it. - Headers: a Content-Security-Policy without inline code or eval, nosniff, frame-ancestors, HSTS, Referrer-, Permissions-, COOP, CORP. - vite.config.ts writes the same policy into the built pages, so CI runs the whole suite under it. Pixi gets by without eval through pixi.js/unsafe-eval. The page CSS left its inline style for a file. - The harness fails a module for anything the policy refuses, from Chrome's log and from the page's securitypolicyviolation event. - LoginThrottle: five wrong passwords from one address within 15 minutes, and it gets 429 until 15 minutes after the last of them. The address is the last X-Forwarded-For entry, the Brandmauer's own. - Quota: 1 GB per account for uploads, projects and snapshots. Only a write that grows the account is refused (413). Admins have no limit. - A write whose Sec-Fetch-Site says another site is refused (403). - The session cookie carries Secure, nginx passes HTTPS on. - showFailure puts the message in as text, not as HTML. - Every PHP script outside api/ stops unless it runs on the command line. - The video worker sees the checkout read-only and can only write data/videos. No capabilities, 2 GB and 256 processes at most. - tests/php/rights.test.php runs the API under php -S on a scratch directory and asks every route as signed out, owner, stranger and admin. A route named in api/index.php but missing in the matrix fails it. limits.test.php covers the brake and the quota. Findings: - tmp/ was readable from outside, with 79 copies of project files. Closed on 15.10. at 20:02 with chmod 750. The log back to 11.10. shows only our own requests. - Port 8080 is bound on 0.0.0.0, so the LAN could reach nginx past the Brandmauer. Left as it is: the web stack is not this project's. - npm audit finds nothing in what is shipped. Dev tools (vitest, brace-expansion, source-map-js) have advisories, not touched here. Tests: check 313 files / 4843 tests. PHP limits 21, rights 60, accounts 56, snapshots 15, releases 20, files 46 (videos 50/51, no ffmpeg in the web container). e2e on stein2, atx was off: 34+38+41 197/198, the one red check (a click in 41) passes with 41 alone, 27/27. 67 misses frames at 1080p on stein2 with and without this. Path list from outside: 10 served, 26 refused. ZAP baseline against the live site: nothing High or Medium under /feuerwerk/. Counter-checks: rights.test.php without the cross-site guard, the quota, the brake, the admin check of users, or with an undocumented route fails each time. A policy without wasm-unsafe-eval fails e2e 41 with the harness's own CSP line. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
207 lines
7.5 KiB
PHP
207 lines
7.5 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
// A command-line script: under a web server it does nothing (#427).
|
|
if (PHP_SAPI !== 'cli') {
|
|
exit(1);
|
|
}
|
|
|
|
/**
|
|
* Gives every uploaded image, font and sound a project uses to the account using it (#344, once).
|
|
*
|
|
* Before #344 every file lay in `data/{textures,fonts,sounds}/` and belonged to nobody. A file a
|
|
* project, one of its snapshots or its release names moves into the folder of the project's owner,
|
|
* and the documents of that owner are rewritten to `{folder}/{file}`. Two accounts using one file
|
|
* get a copy each. A project's revision goes up, so an editor that has it open is told it changed
|
|
* elsewhere instead of saving the old names back. A file nobody uses stays where it is, nobody's.
|
|
*
|
|
* A file is only taken away from where it was when every document naming it could be rewritten:
|
|
* one named by a document without an owner (or of an account that no longer exists) stays as well.
|
|
*
|
|
* docker exec -u www-data web-php-fpm php /var/www/html/feuerwerk/tools/migrate-file-owners.php [--dry-run] [data dir]
|
|
*/
|
|
|
|
require __DIR__ . '/../api/lib/AtomicFile.php';
|
|
require __DIR__ . '/../api/lib/OriginalName.php';
|
|
require __DIR__ . '/../api/lib/UserStore.php';
|
|
require __DIR__ . '/../api/lib/HashedFileStore.php';
|
|
require __DIR__ . '/../api/lib/TextureStore.php';
|
|
require __DIR__ . '/../api/lib/FontStore.php';
|
|
require __DIR__ . '/../api/lib/SoundStore.php';
|
|
|
|
$dry = in_array('--dry-run', $argv, true);
|
|
$data = array_values(array_diff(array_slice($argv, 1), ['--dry-run']))[0] ?? dirname(__DIR__) . '/data';
|
|
$users = new UserStore("{$data}/users.json");
|
|
$kinds = ['textures' => TextureStore::class, 'fonts' => FontStore::class, 'sounds' => SoundStore::class];
|
|
|
|
/** @var array<string,string> $loose file without a folder => its kind */
|
|
$loose = [];
|
|
foreach ($kinds as $kind => $class) {
|
|
foreach (glob("{$data}/{$kind}/*.*") ?: [] as $path) {
|
|
if ($class::isValidName(basename($path))) {
|
|
$loose[basename($path)] = $kind;
|
|
}
|
|
}
|
|
}
|
|
|
|
/** Every string in `$value` that is a file without a folder. @return list<string> */
|
|
function looseIn(mixed $value, array $loose): array
|
|
{
|
|
if (is_string($value)) {
|
|
return isset($loose[$value]) ? [$value] : [];
|
|
}
|
|
$found = [];
|
|
if (is_array($value)) {
|
|
foreach ($value as $item) {
|
|
array_push($found, ...looseIn($item, $loose));
|
|
}
|
|
}
|
|
return $found;
|
|
}
|
|
|
|
/** Swaps every string in `$value` that `$map` knows. */
|
|
function rewrite(mixed $value, array $map): mixed
|
|
{
|
|
if (is_string($value)) {
|
|
return $map[$value] ?? $value;
|
|
}
|
|
if (is_array($value)) {
|
|
foreach ($value as $key => $item) {
|
|
$value[$key] = rewrite($item, $map);
|
|
}
|
|
}
|
|
return $value;
|
|
}
|
|
|
|
function readJson(string $path): ?array
|
|
{
|
|
$raw = file_get_contents($path);
|
|
$doc = $raw === false ? null : json_decode($raw, true);
|
|
return is_array($doc) ? $doc : null;
|
|
}
|
|
|
|
// The documents, each with the account it belongs to: a snapshot and a release are their project's.
|
|
$owners = [];
|
|
$docs = [];
|
|
foreach (glob("{$data}/projects/*.json") ?: [] as $path) {
|
|
$doc = readJson($path);
|
|
if ($doc === null) {
|
|
continue;
|
|
}
|
|
$owners[basename($path, '.json')] = is_string($doc['owner'] ?? null) ? $doc['owner'] : '';
|
|
$docs[] = ['path' => $path, 'kind' => 'project', 'owner' => $owners[basename($path, '.json')]];
|
|
}
|
|
foreach (glob("{$data}/snapshots/*/*.json") ?: [] as $path) {
|
|
$docs[] = ['path' => $path, 'kind' => 'snapshot', 'owner' => $owners[basename(dirname($path))] ?? ''];
|
|
}
|
|
foreach (glob("{$data}/releases/*.json") ?: [] as $path) {
|
|
$projectId = readJson($path)['projectId'] ?? '';
|
|
$docs[] = ['path' => $path, 'kind' => 'release', 'owner' => is_string($projectId) ? ($owners[$projectId] ?? '') : ''];
|
|
}
|
|
|
|
/** @var array<string,array<string,true>> $usedBy file => accounts using it */
|
|
$usedBy = [];
|
|
/** @var array<string,true> $stuck files a document names that cannot be rewritten */
|
|
$stuck = [];
|
|
foreach ($docs as $i => $doc) {
|
|
$files = array_unique(looseIn(readJson($doc['path'])['project'] ?? null, $loose));
|
|
$docs[$i]['files'] = $files;
|
|
$account = $doc['owner'] !== '' && $users->exists($doc['owner']);
|
|
foreach ($files as $file) {
|
|
if ($account) {
|
|
$usedBy[$file][$doc['owner']] = true;
|
|
} else {
|
|
$stuck[$file] = true;
|
|
echo "kept: {$file} is named by {$doc['kind']} {$doc['path']} without an account\n";
|
|
}
|
|
}
|
|
}
|
|
|
|
// Copies into each user's folder, and what their documents' names become.
|
|
$maps = [];
|
|
$copies = 0;
|
|
foreach ($usedBy as $file => $accounts) {
|
|
$kind = $loose[$file];
|
|
foreach (array_keys($accounts) as $account) {
|
|
$folder = $dry ? ($users->folderOf($account) ?: 'new-folder') : $users->folderOf($account, true);
|
|
$maps[$account][$file] = "{$folder}/{$file}";
|
|
$copies++;
|
|
echo "copy: {$kind}/{$file} → {$kind}/{$folder}/ ({$account})\n";
|
|
if ($dry) {
|
|
continue;
|
|
}
|
|
$dir = "{$data}/{$kind}/{$folder}";
|
|
if (!is_dir($dir) && !mkdir($dir, 0775, true) && !is_dir($dir)) {
|
|
throw new RuntimeException("Cannot create {$dir}");
|
|
}
|
|
if (!is_file("{$dir}/{$file}")) {
|
|
AtomicFile::write("{$dir}/{$file}", (string) file_get_contents("{$data}/{$kind}/{$file}"), AtomicFile::SERVED, 'stored file');
|
|
}
|
|
OriginalName::write($dir, $file, OriginalName::read("{$data}/{$kind}", $file));
|
|
}
|
|
}
|
|
|
|
$rewritten = ['project' => 0, 'snapshot' => 0, 'release' => 0];
|
|
foreach ($docs as $doc) {
|
|
$map = $maps[$doc['owner']] ?? [];
|
|
if ($doc['files'] === [] || $map === []) {
|
|
continue;
|
|
}
|
|
$rewritten[$doc['kind']]++;
|
|
if ($dry) {
|
|
continue;
|
|
}
|
|
$write = static function () use ($doc, $map): void {
|
|
$current = readJson($doc['path']);
|
|
if ($current === null) {
|
|
return;
|
|
}
|
|
$current['project'] = rewrite($current['project'], $map);
|
|
$flags = JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE;
|
|
if ($doc['kind'] === 'project') {
|
|
$current['revision'] = (int) $current['revision'] + 1;
|
|
$current['updatedAt'] = gmdate('c');
|
|
}
|
|
if ($doc['kind'] !== 'release') {
|
|
$flags |= JSON_PRETTY_PRINT;
|
|
}
|
|
AtomicFile::write($doc['path'], (string) json_encode($current, $flags), AtomicFile::HIDDEN, "{$doc['kind']} file");
|
|
};
|
|
if ($doc['kind'] !== 'project') {
|
|
$write();
|
|
continue;
|
|
}
|
|
// Under the save lock, as `Store` takes it: a save running at the same time waits, then fails
|
|
// on the revision instead of writing the old names back.
|
|
$lock = fopen($doc['path'] . '.lock', 'c');
|
|
if ($lock === false || !flock($lock, LOCK_EX)) {
|
|
throw new RuntimeException("Cannot lock {$doc['path']}");
|
|
}
|
|
try {
|
|
$write();
|
|
} finally {
|
|
flock($lock, LOCK_UN);
|
|
fclose($lock);
|
|
}
|
|
}
|
|
|
|
$moved = 0;
|
|
foreach (array_keys($usedBy) as $file) {
|
|
if (isset($stuck[$file])) {
|
|
continue;
|
|
}
|
|
$moved++;
|
|
if (!$dry) {
|
|
$dir = "{$data}/{$loose[$file]}";
|
|
unlink("{$dir}/{$file}");
|
|
OriginalName::delete($dir, $file);
|
|
}
|
|
}
|
|
|
|
$unused = count($loose) - count($usedBy) - count(array_diff_key($stuck, $usedBy));
|
|
echo ($dry ? '[dry run] ' : ''),
|
|
'files used: ', count($usedBy) + count(array_diff_key($stuck, $usedBy)),
|
|
", copies made: {$copies}, moved away: {$moved}, kept for documents without an account: ", count($stuck),
|
|
", unused and nobody's: {$unused}\n",
|
|
"rewritten: {$rewritten['project']} projects, {$rewritten['snapshot']} snapshots, {$rewritten['release']} releases\n";
|