2011-01-23 03:33:00 +01:00
|
|
|
<?php
|
|
|
|
|
|
|
|
/*
|
2012-01-17 01:20:18 +01:00
|
|
|
* Copyright 2012 Facebook, Inc.
|
2011-01-23 03:33:00 +01:00
|
|
|
*
|
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
* you may not use this file except in compliance with the License.
|
|
|
|
* You may obtain a copy of the License at
|
|
|
|
*
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
*
|
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
* See the License for the specific language governing permissions and
|
|
|
|
* limitations under the License.
|
|
|
|
*/
|
|
|
|
|
2012-03-13 19:18:11 +01:00
|
|
|
final class PhabricatorFile extends PhabricatorFileDAO {
|
2011-01-23 03:33:00 +01:00
|
|
|
|
|
|
|
const STORAGE_FORMAT_RAW = 'raw';
|
|
|
|
|
|
|
|
protected $phid;
|
|
|
|
protected $name;
|
|
|
|
protected $mimeType;
|
|
|
|
protected $byteSize;
|
2011-07-08 06:17:00 +02:00
|
|
|
protected $authorPHID;
|
Use a proper entropy source to generate file keys
Summary:
See T549. Under configurations where files are served from an alternate domain
which does not have cookie credentials, we use random keys to prevent browsing,
similar to how Facebook relies on pseudorandom information in image URIs (we
could some day go farther than this and generate file sessions on the alternate
domain or something, I guess).
Currently, we generate these random keys in a roundabout manner. Instead, use a
real entropy source and store the key on the object. This reduces the number of
sha1() calls in the codebase as per T547.
Test Plan: Ran upgrade scripts, verified database was populated correctly.
Configured alternate file domain, uploaded file, verified secret generated and
worked properly. Changed secret, was given 404.
Reviewers: jungejason, benmathews, nh, tuomaspelkonen, aran
Reviewed By: aran
CC: aran, epriestley
Differential Revision: 1036
2011-10-23 22:50:10 +02:00
|
|
|
protected $secretKey;
|
2012-03-20 03:52:24 +01:00
|
|
|
protected $contentHash;
|
2011-01-23 03:33:00 +01:00
|
|
|
|
|
|
|
protected $storageEngine;
|
|
|
|
protected $storageFormat;
|
|
|
|
protected $storageHandle;
|
|
|
|
|
|
|
|
public function getConfiguration() {
|
|
|
|
return array(
|
|
|
|
self::CONFIG_AUX_PHID => true,
|
|
|
|
) + parent::getConfiguration();
|
|
|
|
}
|
|
|
|
|
|
|
|
public function generatePHID() {
|
2011-03-03 03:58:21 +01:00
|
|
|
return PhabricatorPHID::generateNewPHID(
|
|
|
|
PhabricatorPHIDConstants::PHID_TYPE_FILE);
|
2011-01-23 03:33:00 +01:00
|
|
|
}
|
|
|
|
|
2011-10-19 04:46:52 +02:00
|
|
|
public static function readUploadedFileData($spec) {
|
2011-01-23 03:33:00 +01:00
|
|
|
if (!$spec) {
|
|
|
|
throw new Exception("No file was uploaded!");
|
|
|
|
}
|
|
|
|
|
|
|
|
$err = idx($spec, 'error');
|
|
|
|
if ($err) {
|
2011-08-16 21:37:50 +02:00
|
|
|
throw new PhabricatorFileUploadException($err);
|
2011-01-23 03:33:00 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
$tmp_name = idx($spec, 'tmp_name');
|
|
|
|
$is_valid = @is_uploaded_file($tmp_name);
|
|
|
|
if (!$is_valid) {
|
|
|
|
throw new Exception("File is not an uploaded file.");
|
|
|
|
}
|
|
|
|
|
|
|
|
$file_data = Filesystem::readFile($tmp_name);
|
|
|
|
$file_size = idx($spec, 'size');
|
|
|
|
|
|
|
|
if (strlen($file_data) != $file_size) {
|
|
|
|
throw new Exception("File size disagrees with uploaded size.");
|
|
|
|
}
|
|
|
|
|
2012-05-07 15:17:00 +02:00
|
|
|
self::validateFileSize(strlen($file_data));
|
|
|
|
|
2011-10-19 04:46:52 +02:00
|
|
|
return $file_data;
|
|
|
|
}
|
|
|
|
|
|
|
|
public static function newFromPHPUpload($spec, array $params = array()) {
|
|
|
|
$file_data = self::readUploadedFileData($spec);
|
|
|
|
|
2011-01-23 03:33:00 +01:00
|
|
|
$file_name = nonempty(
|
|
|
|
idx($params, 'name'),
|
|
|
|
idx($spec, 'name'));
|
|
|
|
$params = array(
|
|
|
|
'name' => $file_name,
|
|
|
|
) + $params;
|
|
|
|
|
|
|
|
return self::newFromFileData($file_data, $params);
|
|
|
|
}
|
|
|
|
|
2012-05-07 15:17:00 +02:00
|
|
|
public static function newFromXHRUpload($data, array $params = array()) {
|
|
|
|
self::validateFileSize(strlen($data));
|
|
|
|
return self::newFromFileData($data, $params);
|
|
|
|
}
|
|
|
|
|
|
|
|
private static function validateFileSize($size) {
|
|
|
|
$limit = PhabricatorEnv::getEnvConfig('storage.upload-size-limit');
|
|
|
|
if (!$limit) {
|
|
|
|
return;
|
|
|
|
}
|
2011-01-23 03:33:00 +01:00
|
|
|
|
2012-05-07 15:17:00 +02:00
|
|
|
$limit = phabricator_parse_bytes($limit);
|
|
|
|
if ($size > $limit) {
|
|
|
|
throw new PhabricatorFileUploadException(-1000);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
public static function newFromFileData($data, array $params = array()) {
|
2012-03-21 22:48:58 +01:00
|
|
|
$selector = PhabricatorEnv::newObjectFromConfig('storage.engine-selector');
|
2011-07-20 07:48:38 +02:00
|
|
|
|
|
|
|
$engines = $selector->selectStorageEngines($data, $params);
|
|
|
|
if (!$engines) {
|
|
|
|
throw new Exception("No valid storage engines are available!");
|
|
|
|
}
|
|
|
|
|
|
|
|
$data_handle = null;
|
|
|
|
$engine_identifier = null;
|
2012-04-09 00:07:34 +02:00
|
|
|
$exceptions = array();
|
2011-07-20 07:48:38 +02:00
|
|
|
foreach ($engines as $engine) {
|
2012-04-09 00:07:34 +02:00
|
|
|
$engine_class = get_class($engine);
|
2011-07-20 07:48:38 +02:00
|
|
|
try {
|
|
|
|
// Perform the actual write.
|
|
|
|
$data_handle = $engine->writeFile($data, $params);
|
|
|
|
if (!$data_handle || strlen($data_handle) > 255) {
|
|
|
|
// This indicates an improperly implemented storage engine.
|
2012-04-09 00:07:34 +02:00
|
|
|
throw new PhabricatorFileStorageConfigurationException(
|
|
|
|
"Storage engine '{$engine_class}' executed writeFile() but did ".
|
|
|
|
"not return a valid handle ('{$data_handle}') to the data: it ".
|
|
|
|
"must be nonempty and no longer than 255 characters.");
|
2011-07-20 07:48:38 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
$engine_identifier = $engine->getEngineIdentifier();
|
|
|
|
if (!$engine_identifier || strlen($engine_identifier) > 32) {
|
2012-04-09 00:07:34 +02:00
|
|
|
throw new PhabricatorFileStorageConfigurationException(
|
|
|
|
"Storage engine '{$engine_class}' returned an improper engine ".
|
2011-07-20 07:48:38 +02:00
|
|
|
"identifier '{$engine_identifier}': it must be nonempty ".
|
|
|
|
"and no longer than 32 characters.");
|
|
|
|
}
|
|
|
|
|
|
|
|
// We stored the file somewhere so stop trying to write it to other
|
|
|
|
// places.
|
|
|
|
break;
|
|
|
|
} catch (Exception $ex) {
|
2012-04-09 00:07:34 +02:00
|
|
|
if ($ex instanceof PhabricatorFileStorageConfigurationException) {
|
|
|
|
// If an engine is outright misconfigured (or misimplemented), raise
|
|
|
|
// that immediately since it probably needs attention.
|
|
|
|
throw $ex;
|
|
|
|
}
|
|
|
|
|
2011-07-20 07:48:38 +02:00
|
|
|
// If an engine doesn't work, keep trying all the other valid engines
|
|
|
|
// in case something else works.
|
|
|
|
phlog($ex);
|
2012-04-09 00:07:34 +02:00
|
|
|
|
|
|
|
$exceptions[] = $ex;
|
2011-07-20 07:48:38 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!$data_handle) {
|
2012-04-09 00:07:34 +02:00
|
|
|
throw new PhutilAggregateException(
|
|
|
|
"All storage engines failed to write file:",
|
|
|
|
$exceptions);
|
2011-01-23 03:33:00 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
$file_name = idx($params, 'name');
|
|
|
|
$file_name = self::normalizeFileName($file_name);
|
|
|
|
|
2011-07-08 06:17:00 +02:00
|
|
|
// If for whatever reason, authorPHID isn't passed as a param
|
|
|
|
// (always the case with newFromFileDownload()), store a ''
|
|
|
|
$authorPHID = idx($params, 'authorPHID');
|
|
|
|
|
2011-01-23 03:33:00 +01:00
|
|
|
$file = new PhabricatorFile();
|
|
|
|
$file->setName($file_name);
|
|
|
|
$file->setByteSize(strlen($data));
|
2011-07-08 06:17:00 +02:00
|
|
|
$file->setAuthorPHID($authorPHID);
|
2012-03-20 03:52:24 +01:00
|
|
|
$file->setContentHash(PhabricatorHash::digest($data));
|
2011-01-23 03:33:00 +01:00
|
|
|
|
2011-07-20 07:48:38 +02:00
|
|
|
$file->setStorageEngine($engine_identifier);
|
|
|
|
$file->setStorageHandle($data_handle);
|
2011-01-23 03:33:00 +01:00
|
|
|
|
2011-07-20 07:48:38 +02:00
|
|
|
// TODO: This is probably YAGNI, but allows for us to do encryption or
|
|
|
|
// compression later if we want.
|
2011-01-23 03:33:00 +01:00
|
|
|
$file->setStorageFormat(self::STORAGE_FORMAT_RAW);
|
|
|
|
|
2011-02-02 22:48:52 +01:00
|
|
|
if (isset($params['mime-type'])) {
|
|
|
|
$file->setMimeType($params['mime-type']);
|
|
|
|
} else {
|
2012-02-15 02:00:05 +01:00
|
|
|
$tmp = new TempFile();
|
|
|
|
Filesystem::writeFile($tmp, $data);
|
|
|
|
$file->setMimeType(Filesystem::getMimeType($tmp));
|
2011-01-23 03:33:00 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
$file->save();
|
|
|
|
|
|
|
|
return $file;
|
|
|
|
}
|
|
|
|
|
2011-04-14 00:15:48 +02:00
|
|
|
public static function newFromFileDownload($uri, $name) {
|
|
|
|
$uri = new PhutilURI($uri);
|
2011-05-02 23:20:24 +02:00
|
|
|
|
|
|
|
$protocol = $uri->getProtocol();
|
|
|
|
switch ($protocol) {
|
|
|
|
case 'http':
|
|
|
|
case 'https':
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
// Make sure we are not accessing any file:// URIs or similar.
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
|
2012-06-19 00:11:47 +02:00
|
|
|
$timeout = 5;
|
|
|
|
|
|
|
|
$file_data = HTTPSFuture::loadContent($uri, $timeout);
|
2011-04-14 00:15:48 +02:00
|
|
|
if ($file_data === false) {
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
|
|
|
|
return self::newFromFileData($file_data, array('name' => $name));
|
|
|
|
}
|
|
|
|
|
2011-01-23 03:33:00 +01:00
|
|
|
public static function normalizeFileName($file_name) {
|
|
|
|
return preg_replace('/[^a-zA-Z0-9.~_-]/', '_', $file_name);
|
|
|
|
}
|
|
|
|
|
|
|
|
public function delete() {
|
2011-07-20 07:48:38 +02:00
|
|
|
$engine = $this->instantiateStorageEngine();
|
|
|
|
|
|
|
|
$ret = parent::delete();
|
|
|
|
|
|
|
|
$engine->deleteFile($this->getStorageHandle());
|
2011-01-23 03:33:00 +01:00
|
|
|
|
|
|
|
return $ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
public function loadFileData() {
|
|
|
|
|
2011-07-20 07:48:38 +02:00
|
|
|
$engine = $this->instantiateStorageEngine();
|
|
|
|
$data = $engine->readFile($this->getStorageHandle());
|
2011-01-23 03:33:00 +01:00
|
|
|
|
|
|
|
switch ($this->getStorageFormat()) {
|
|
|
|
case self::STORAGE_FORMAT_RAW:
|
|
|
|
$data = $data;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
throw new Exception("Unknown storage format.");
|
|
|
|
}
|
|
|
|
|
|
|
|
return $data;
|
|
|
|
}
|
|
|
|
|
2011-01-26 18:02:09 +01:00
|
|
|
public function getViewURI() {
|
Use a proper entropy source to generate file keys
Summary:
See T549. Under configurations where files are served from an alternate domain
which does not have cookie credentials, we use random keys to prevent browsing,
similar to how Facebook relies on pseudorandom information in image URIs (we
could some day go farther than this and generate file sessions on the alternate
domain or something, I guess).
Currently, we generate these random keys in a roundabout manner. Instead, use a
real entropy source and store the key on the object. This reduces the number of
sha1() calls in the codebase as per T547.
Test Plan: Ran upgrade scripts, verified database was populated correctly.
Configured alternate file domain, uploaded file, verified secret generated and
worked properly. Changed secret, was given 404.
Reviewers: jungejason, benmathews, nh, tuomaspelkonen, aran
Reviewed By: aran
CC: aran, epriestley
Differential Revision: 1036
2011-10-23 22:50:10 +02:00
|
|
|
if (!$this->getPHID()) {
|
|
|
|
throw new Exception(
|
|
|
|
"You must save a file before you can generate a view URI.");
|
|
|
|
}
|
|
|
|
|
2012-01-17 01:20:18 +01:00
|
|
|
$name = phutil_escape_uri($this->getName());
|
|
|
|
|
Move ALL files to serve from the alternate file domain, not just files without
"Content-Disposition: attachment"
Summary:
We currently serve some files off the primary domain (with "Content-Disposition:
attachment" + a CSRF check) and some files off the alternate domain (without
either).
This is not sufficient, because some UAs (like the iPad) ignore
"Content-Disposition: attachment". So there's an attack that goes like this:
- Alice uploads xss.html
- Alice says to Bob "hey download this file on your iPad"
- Bob clicks "Download" on Phabricator on his iPad, gets XSS'd.
NOTE: This removes the CSRF check for downloading files. The check is nice to
have but only raises the barrier to entry slightly. Between iPad / sniffing /
flash bytecode attacks, single-domain installs are simply insecure. We could
restore the check at some point in conjunction with a derived authentication
cookie (i.e., a mini-session-token which is only useful for downloading files),
but that's a lot of complexity to drop all at once.
(Because files are now authenticated only by knowing the PHID and secret key,
this also fixes the "no profile pictures in public feed while logged out"
issue.)
Test Plan: Viewed, info'd, and downloaded files
Reviewers: btrahan, arice, alok
Reviewed By: arice
CC: aran, epriestley
Maniphest Tasks: T843
Differential Revision: https://secure.phabricator.com/D1608
2012-02-14 23:52:27 +01:00
|
|
|
$path = '/file/data/'.$this->getSecretKey().'/'.$this->getPHID().'/'.$name;
|
|
|
|
return PhabricatorEnv::getCDNURI($path);
|
2011-01-26 18:02:09 +01:00
|
|
|
}
|
2011-02-22 18:22:57 +01:00
|
|
|
|
2011-07-29 19:00:16 +02:00
|
|
|
public function getInfoURI() {
|
|
|
|
return '/file/info/'.$this->getPHID().'/';
|
|
|
|
}
|
|
|
|
|
|
|
|
public function getBestURI() {
|
|
|
|
if ($this->isViewableInBrowser()) {
|
|
|
|
return $this->getViewURI();
|
|
|
|
} else {
|
|
|
|
return $this->getInfoURI();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
Improve drag-and-drop uploader
Summary:
Make it discoverable, show uploading progress, show file thumbnails, allow you
to remove files, make it a generic form component.
Test Plan:
Uploaded ducks
Reviewed By: tomo
Reviewers: aran, tomo, jungejason, tuomaspelkonen
CC: anjali, aran, epriestley, tomo
Differential Revision: 334
2011-05-23 01:11:41 +02:00
|
|
|
public function getThumb60x45URI() {
|
|
|
|
return '/file/xform/thumb-60x45/'.$this->getPHID().'/';
|
|
|
|
}
|
|
|
|
|
2011-05-23 02:06:42 +02:00
|
|
|
public function getThumb160x120URI() {
|
|
|
|
return '/file/xform/thumb-160x120/'.$this->getPHID().'/';
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2011-02-22 18:19:14 +01:00
|
|
|
public function isViewableInBrowser() {
|
|
|
|
return ($this->getViewableMimeType() !== null);
|
|
|
|
}
|
2011-02-22 18:22:57 +01:00
|
|
|
|
2012-03-20 03:52:24 +01:00
|
|
|
public function isViewableImage() {
|
|
|
|
if (!$this->isViewableInBrowser()) {
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
$mime_map = PhabricatorEnv::getEnvConfig('files.image-mime-types');
|
|
|
|
$mime_type = $this->getMimeType();
|
|
|
|
return idx($mime_map, $mime_type);
|
|
|
|
}
|
|
|
|
|
2011-05-22 23:40:51 +02:00
|
|
|
public function isTransformableImage() {
|
Support thumbnailing non-image files and straighten out setup for 'gd'
Summary:
Make 'gd' an explicit optional dependency, test for it in setup, and make the
software behave correctly if it is not available.
When generating file thumnails, provide reasonable defaults and behavior for
non-image files.
Test Plan:
Uploaded text files, pdf files, etc., and got real thumbnails instead of a
broken image.
Simulated setup and gd failures and walked through setup process and image
fallback for thumbnails.
Reviewed By: aran
Reviewers: toulouse, jungejason, tuomaspelkonen, aran
CC: aran, epriestley
Differential Revision: 446
2011-06-13 17:43:42 +02:00
|
|
|
|
|
|
|
// NOTE: The way the 'gd' extension works in PHP is that you can install it
|
|
|
|
// with support for only some file types, so it might be able to handle
|
|
|
|
// PNG but not JPEG. Try to generate thumbnails for whatever we can. Setup
|
|
|
|
// warns you if you don't have complete support.
|
|
|
|
|
|
|
|
$matches = null;
|
|
|
|
$ok = preg_match(
|
|
|
|
'@^image/(gif|png|jpe?g)@',
|
|
|
|
$this->getViewableMimeType(),
|
|
|
|
$matches);
|
|
|
|
if (!$ok) {
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
switch ($matches[1]) {
|
|
|
|
case 'jpg';
|
|
|
|
case 'jpeg':
|
|
|
|
return function_exists('imagejpeg');
|
|
|
|
break;
|
|
|
|
case 'png':
|
|
|
|
return function_exists('imagepng');
|
|
|
|
break;
|
|
|
|
case 'gif':
|
|
|
|
return function_exists('imagegif');
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
throw new Exception('Unknown type matched as image MIME type.');
|
|
|
|
}
|
2011-05-22 23:40:51 +02:00
|
|
|
}
|
|
|
|
|
2012-03-14 20:41:33 +01:00
|
|
|
public static function getTransformableImageFormats() {
|
|
|
|
$supported = array();
|
|
|
|
|
|
|
|
if (function_exists('imagejpeg')) {
|
|
|
|
$supported[] = 'jpg';
|
|
|
|
}
|
|
|
|
|
|
|
|
if (function_exists('imagepng')) {
|
|
|
|
$supported[] = 'png';
|
|
|
|
}
|
|
|
|
|
|
|
|
if (function_exists('imagegif')) {
|
|
|
|
$supported[] = 'gif';
|
|
|
|
}
|
|
|
|
|
|
|
|
return $supported;
|
|
|
|
}
|
|
|
|
|
2011-07-20 07:48:38 +02:00
|
|
|
protected function instantiateStorageEngine() {
|
|
|
|
$engines = id(new PhutilSymbolLoader())
|
|
|
|
->setType('class')
|
|
|
|
->setAncestorClass('PhabricatorFileStorageEngine')
|
|
|
|
->selectAndLoadSymbols();
|
|
|
|
|
|
|
|
foreach ($engines as $engine_class) {
|
|
|
|
$engine = newv($engine_class['name'], array());
|
|
|
|
if ($engine->getEngineIdentifier() == $this->getStorageEngine()) {
|
|
|
|
return $engine;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
throw new Exception("File's storage engine could be located!");
|
|
|
|
}
|
|
|
|
|
2011-02-22 18:19:14 +01:00
|
|
|
public function getViewableMimeType() {
|
|
|
|
$mime_map = PhabricatorEnv::getEnvConfig('files.viewable-mime-types');
|
|
|
|
|
|
|
|
$mime_type = $this->getMimeType();
|
|
|
|
$mime_parts = explode(';', $mime_type);
|
2011-02-28 19:15:42 +01:00
|
|
|
$mime_type = trim(reset($mime_parts));
|
2011-02-22 18:22:57 +01:00
|
|
|
|
2011-02-22 18:19:14 +01:00
|
|
|
return idx($mime_map, $mime_type);
|
|
|
|
}
|
2011-01-26 18:02:09 +01:00
|
|
|
|
Provide a setting which forces all file views to be served from an alternate
domain
Summary:
See D758, D759.
- Provide a strongly recommended setting which permits configuration of an
alternate domain.
- Lock cookies down better: set them on the exact domain, and use SSL-only if
the configuration is HTTPS.
- Prevent Phabriator from setting cookies on other domains.
This assumes D759 will land, it is not effective without that change.
Test Plan:
- Attempted to login from a different domain and was rejected.
- Logged out, logged back in normally.
- Put install in setup mode and verified it revealed a warning.
- Configured an alterate domain.
- Tried to view an image with an old URI, got a 400.
- Went to /files/ and verified links rendered to the alternate domain.
- Viewed an alternate domain file.
- Tried to view an alternate domain file without the secret key, got a 404.
Reviewers: andrewjcg, erling, aran, tuomaspelkonen, jungejason, codeblock
CC: aran
Differential Revision: 760
2011-08-02 07:24:00 +02:00
|
|
|
public function validateSecretKey($key) {
|
Use a proper entropy source to generate file keys
Summary:
See T549. Under configurations where files are served from an alternate domain
which does not have cookie credentials, we use random keys to prevent browsing,
similar to how Facebook relies on pseudorandom information in image URIs (we
could some day go farther than this and generate file sessions on the alternate
domain or something, I guess).
Currently, we generate these random keys in a roundabout manner. Instead, use a
real entropy source and store the key on the object. This reduces the number of
sha1() calls in the codebase as per T547.
Test Plan: Ran upgrade scripts, verified database was populated correctly.
Configured alternate file domain, uploaded file, verified secret generated and
worked properly. Changed secret, was given 404.
Reviewers: jungejason, benmathews, nh, tuomaspelkonen, aran
Reviewed By: aran
CC: aran, epriestley
Differential Revision: 1036
2011-10-23 22:50:10 +02:00
|
|
|
return ($key == $this->getSecretKey());
|
Provide a setting which forces all file views to be served from an alternate
domain
Summary:
See D758, D759.
- Provide a strongly recommended setting which permits configuration of an
alternate domain.
- Lock cookies down better: set them on the exact domain, and use SSL-only if
the configuration is HTTPS.
- Prevent Phabriator from setting cookies on other domains.
This assumes D759 will land, it is not effective without that change.
Test Plan:
- Attempted to login from a different domain and was rejected.
- Logged out, logged back in normally.
- Put install in setup mode and verified it revealed a warning.
- Configured an alterate domain.
- Tried to view an image with an old URI, got a 400.
- Went to /files/ and verified links rendered to the alternate domain.
- Viewed an alternate domain file.
- Tried to view an alternate domain file without the secret key, got a 404.
Reviewers: andrewjcg, erling, aran, tuomaspelkonen, jungejason, codeblock
CC: aran
Differential Revision: 760
2011-08-02 07:24:00 +02:00
|
|
|
}
|
|
|
|
|
Use a proper entropy source to generate file keys
Summary:
See T549. Under configurations where files are served from an alternate domain
which does not have cookie credentials, we use random keys to prevent browsing,
similar to how Facebook relies on pseudorandom information in image URIs (we
could some day go farther than this and generate file sessions on the alternate
domain or something, I guess).
Currently, we generate these random keys in a roundabout manner. Instead, use a
real entropy source and store the key on the object. This reduces the number of
sha1() calls in the codebase as per T547.
Test Plan: Ran upgrade scripts, verified database was populated correctly.
Configured alternate file domain, uploaded file, verified secret generated and
worked properly. Changed secret, was given 404.
Reviewers: jungejason, benmathews, nh, tuomaspelkonen, aran
Reviewed By: aran
CC: aran, epriestley
Differential Revision: 1036
2011-10-23 22:50:10 +02:00
|
|
|
public function save() {
|
|
|
|
if (!$this->getSecretKey()) {
|
|
|
|
$this->setSecretKey($this->generateSecretKey());
|
|
|
|
}
|
|
|
|
return parent::save();
|
Provide a setting which forces all file views to be served from an alternate
domain
Summary:
See D758, D759.
- Provide a strongly recommended setting which permits configuration of an
alternate domain.
- Lock cookies down better: set them on the exact domain, and use SSL-only if
the configuration is HTTPS.
- Prevent Phabriator from setting cookies on other domains.
This assumes D759 will land, it is not effective without that change.
Test Plan:
- Attempted to login from a different domain and was rejected.
- Logged out, logged back in normally.
- Put install in setup mode and verified it revealed a warning.
- Configured an alterate domain.
- Tried to view an image with an old URI, got a 400.
- Went to /files/ and verified links rendered to the alternate domain.
- Viewed an alternate domain file.
- Tried to view an alternate domain file without the secret key, got a 404.
Reviewers: andrewjcg, erling, aran, tuomaspelkonen, jungejason, codeblock
CC: aran
Differential Revision: 760
2011-08-02 07:24:00 +02:00
|
|
|
}
|
|
|
|
|
Use a proper entropy source to generate file keys
Summary:
See T549. Under configurations where files are served from an alternate domain
which does not have cookie credentials, we use random keys to prevent browsing,
similar to how Facebook relies on pseudorandom information in image URIs (we
could some day go farther than this and generate file sessions on the alternate
domain or something, I guess).
Currently, we generate these random keys in a roundabout manner. Instead, use a
real entropy source and store the key on the object. This reduces the number of
sha1() calls in the codebase as per T547.
Test Plan: Ran upgrade scripts, verified database was populated correctly.
Configured alternate file domain, uploaded file, verified secret generated and
worked properly. Changed secret, was given 404.
Reviewers: jungejason, benmathews, nh, tuomaspelkonen, aran
Reviewed By: aran
CC: aran, epriestley
Differential Revision: 1036
2011-10-23 22:50:10 +02:00
|
|
|
public function generateSecretKey() {
|
|
|
|
return Filesystem::readRandomCharacters(20);
|
|
|
|
}
|
2011-01-23 03:33:00 +01:00
|
|
|
}
|