mexon/friendica
1
0
Fork 0
Code Pull requests Activity

Merge pull request #10113 from MrPetovan/bug/10110-userexport-security

Browse source 
Prevent settings/userexport to be used by anonymous users
This commit is contained in:
Tobias Diekershoff 2021-04-02 07:44:01 +02:00 committed by GitHub
parent 5947698dc1 acbcc56754
commit bbe567a9c8
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 78 additions and 31 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

103
src/Module/Settings/UserExport.php
View file

@ -30,6 +30,7 @@ use Friendica\DI;
use Friendica\Model\Item;
use Friendica\Model\Post;
use Friendica\Module\BaseSettings;
use Friendica\Network\HTTPException;
/**
* Module to export user data
@ -46,9 +47,18 @@ class UserExport extends BaseSettings
*
* If there is an action required through the URL / path, react
* accordingly and export the requested data.
**/
*
* @param array $parameters Router-supplied parameters
* @return string
* @throws HTTPException\ForbiddenException
* @throws HTTPException\InternalServerErrorException
*/
public static function content(array $parameters = [])
{
if (!local_user()) {
throw new HTTPException\ForbiddenException(DI::l10n()->t('Permission denied.'));
}
parent::content($parameters);
/**
@ -68,14 +78,22 @@ class UserExport extends BaseSettings
'$options' => $options
]);
}
/**
* raw content generated for the different choices made
* by the user. At the moment this returns a JSON file
* to the browser which then offers a save / open dialog
* to the user.
**/
*
* @param array $parameters Router-supplied parameters
* @throws HTTPException\ForbiddenException
*/
public static function rawContent(array $parameters = [])
{
if (!local_user() || !empty(DI::app()->user['uid']) && DI::app()->user['uid'] != local_user()) {
throw new HTTPException\ForbiddenException(DI::l10n()->t('Permission denied.'));
}
$args = DI::args();
if ($args->getArgc() == 3) {
// @TODO Replace with router-provided arguments
@ -85,26 +103,29 @@ class UserExport extends BaseSettings
case "backup":
header("Content-type: application/json");
header('Content-Disposition: attachment; filename="' . $user['nickname'] . '.' . $action . '"');
self::exportAll(DI::app());
exit();
self::exportAll(local_user());
break;
case "account":
header("Content-type: application/json");
header('Content-Disposition: attachment; filename="' . $user['nickname'] . '.' . $action . '"');
self::exportAccount(DI::app());
exit();
self::exportAccount(local_user());
break;
case "contact":
header("Content-type: application/csv");
header('Content-Disposition: attachment; filename="' . $user['nickname'] . '-contacts.csv' . '"');
self::exportContactsAsCSV();
exit();
self::exportContactsAsCSV(local_user());
break;
default:
}
exit();
}
}
}
/**
* @param string $query
* @return array
* @throws \Exception
*/
private static function exportMultiRow(string $query)
{
$dbStructure = DBStructure::definition(DI::app()->getBasePath(), false);
@ -132,6 +153,11 @@ class UserExport extends BaseSettings
return $result;
}
/**
* @param string $query
* @return array
* @throws \Exception
*/
private static function exportRow(string $query)
{
$dbStructure = DBStructure::definition(DI::app()->getBasePath(), false);
@ -142,12 +168,12 @@ class UserExport extends BaseSettings
$result = [];
$r = q($query);
if (DBA::isResult($r)) {
foreach ($r as $rr) {
foreach ($rr as $k => $v) {
if (empty($dbStructure[$table]['fields'][$k])) {
continue;
}
switch ($dbStructure[$table]['fields'][$k]['type']) {
case 'datetime':
$result[$k] = $v ?? DBA::NULL_DATETIME;
@ -159,59 +185,76 @@ class UserExport extends BaseSettings
}
}
}
return $result;
}
/**
* Export a list of the contacts as CSV file as e.g. Mastodon and Pleroma are doing.
**/
private static function exportContactsAsCSV()
*
* @param int $user_id
* @throws \Exception
*/
private static function exportContactsAsCSV(int $user_id)
{
if (!$user_id) {
throw new \RuntimeException(DI::l10n()->t('Permission denied.'));
}
// write the table header (like Mastodon)
echo "Account address, Show boosts\n";
// get all the contacts
$contacts = DBA::select('contact', ['addr', 'url'], ['uid' => $_SESSION['uid'], 'self' => false, 'rel' => [1,3], 'deleted' => false]);
$contacts = DBA::select('contact', ['addr', 'url'], ['uid' => $user_id, 'self' => false, 'rel' => [1, 3], 'deleted' => false]);
while ($contact = DBA::fetch($contacts)) {
echo ($contact['addr'] ?: $contact['url']) . ", true\n";
}
DBA::close($contacts);
}
private static function exportAccount(App $a)
/**
* @param int $user_id
* @throws \Exception
*/
private static function exportAccount(int $user_id)
{
if (!$user_id) {
throw new \RuntimeException(DI::l10n()->t('Permission denied.'));
}
$user = self::exportRow(
sprintf("SELECT * FROM `user` WHERE `uid` = %d LIMIT 1", intval(local_user()))
sprintf("SELECT * FROM `user` WHERE `uid` = %d LIMIT 1", $user_id)
);
$contact = self::exportMultiRow(
sprintf("SELECT * FROM `contact` WHERE `uid` = %d ", intval(local_user()))
sprintf("SELECT * FROM `contact` WHERE `uid` = %d ", $user_id)
);
$profile = self::exportMultiRow(
sprintf("SELECT *, 'default' AS `profile_name`, 1 AS `is-default` FROM `profile` WHERE `uid` = %d ", intval(local_user()))
sprintf("SELECT *, 'default' AS `profile_name`, 1 AS `is-default` FROM `profile` WHERE `uid` = %d ", $user_id)
);
$profile_fields = self::exportMultiRow(
sprintf("SELECT * FROM `profile_field` WHERE `uid` = %d ", intval(local_user()))
sprintf("SELECT * FROM `profile_field` WHERE `uid` = %d ", $user_id)
);
$photo = self::exportMultiRow(
sprintf("SELECT * FROM `photo` WHERE uid = %d AND profile = 1", intval(local_user()))
sprintf("SELECT * FROM `photo` WHERE uid = %d AND profile = 1", $user_id)
);
foreach ($photo as &$p) {
$p['data'] = bin2hex($p['data']);
}
$pconfig = self::exportMultiRow(
sprintf("SELECT * FROM `pconfig` WHERE uid = %d", intval(local_user()))
sprintf("SELECT * FROM `pconfig` WHERE uid = %d", $user_id)
);
$group = self::exportMultiRow(
sprintf("SELECT * FROM `group` WHERE uid = %d", intval(local_user()))
sprintf("SELECT * FROM `group` WHERE uid = %d", $user_id)
);
$group_member = self::exportMultiRow(
sprintf("SELECT `group_member`.`gid`, `group_member`.`contact-id` FROM `group_member` INNER JOIN `group` ON `group`.`id` = `group_member`.`gid` WHERE `group`.`uid` = %d", intval(local_user()))
sprintf("SELECT `group_member`.`gid`, `group_member`.`contact-id` FROM `group_member` INNER JOIN `group` ON `group`.`id` = `group_member`.`gid` WHERE `group`.`uid` = %d", $user_id)
);
$output = [
@ -234,19 +277,23 @@ class UserExport extends BaseSettings
/**
* echoes account data and items as separated json, one per line
*
* @param App $a
* @param int $user_id
* @throws \Exception
*/
private static function exportAll(App $a)
private static function exportAll(int $user_id)
{
self::exportAccount($a);
if (!$user_id) {
throw new \RuntimeException(DI::l10n()->t('Permission denied.'));
}
self::exportAccount($user_id);
echo "\n";
$total = Post::count(['uid' => local_user()]);
$total = Post::count(['uid' => $user_id]);
// chunk the output to avoid exhausting memory
for ($x = 0; $x < $total; $x += 500) {
$items = Post::selectToArray(Item::ITEM_FIELDLIST, ['uid' => local_user()], ['limit' => [$x, 500]]);
$items = Post::selectToArray(Item::ITEM_FIELDLIST, ['uid' => $user_id], ['limit' => [$x, 500]]);
$output = ['item' => $items];
echo json_encode($output, JSON_PARTIAL_OUTPUT_ON_ERROR) . "\n";
}