The_Great_Archive/cryptpad
1
0
Fork 0
mirror of https://github.com/cryptpad/cryptpad.git synced 2026-09-14 11:05:41 +05:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'fixes' into 2026.4-test

Browse Source
This commit is contained in:
yflory 2026-04-27 15:13:04 +02:00
commit ef5cc5982d
11 changed files with 34 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lib/commands/invitation.js
View File

@ -7,9 +7,10 @@ const Invitation = module.exports;
const Invite = require('../storage/invite');
const Util = require("../common-util");
const Users = require("./users");
const Crypto = require('node:crypto');
const getUid = () => {
return Util.uid() + Util.uid() + Util.uid();
return Crypto.randomBytes(18).toString('hex');
};
Invitation.getAll = (Env, cb) => {

25
lib/http-commands.js
View File

@ -129,7 +129,7 @@ var handleCommand = function (Env, req, res) {
COMMANDS[command](Env, body, function (err) {
if (err) {
Env.Log.error('CHALLENGE_COMMAND_EXECUTION_ERROR', {
body: body,
command,
error: Util.serializeError(err),
});
// errors returned from commands are passed back to the client
@ -229,16 +229,6 @@ var handleResponse = function (Env, req, res) {
});
}
// garbage collection can clean this up later
Challenge.delete(Env, txid, function (err) {
if (err) {
Env.Log.error("CHALLENGE_DELETION_ERROR", {
txid: txid,
error: Util.serializeError(err),
});
}
});
var json = Util.tryParse(text);
if (!json) {
@ -284,8 +274,7 @@ var handleResponse = function (Env, req, res) {
u8_publicKey = Util.decodeBase64(publicKey);
} catch (err3) {
Env.Log.error('CHALLENGE_RESPONSE_DECODING_ERROR', {
text: text,
sig: sig,
command,
publicKey: publicKey,
error: Util.serializeError(err3),
});
@ -305,6 +294,16 @@ var handleResponse = function (Env, req, res) {
});
}
// garbage collection can clean this up later
Challenge.delete(Env, txid, function (err) {
if (err) {
Env.Log.error("CHALLENGE_DELETION_ERROR", {
txid: txid,
error: Util.serializeError(err),
});
}
});
// execute the command
action(Env, json, function (err, content) {
if (err) {

18
lib/http-worker.js
View File

@ -258,7 +258,7 @@ app.use('/ssoauth', (req, res, next) => {
Log.error('E_SSO_WRITE_REQ', err);
return res.sendStatus(500);
}
let value = `samltoken="${token}"; SameSite=Strict; HttpOnly`;
let value = `samltoken="${token}"; SameSite=Strict; HttpOnly; Path=/; Secure`;
res.setHeader('Set-Cookie', value);
next();
});
@ -750,22 +750,6 @@ var send500 = function (res, path) {
});
};
app.get('/api/updatequota', function (req, res) {
if (!Env.accounts_api) {
res.status(404);
return void send404(res);
}
sendMessage({
command: 'UPDATE_QUOTA',
}, (err) => {
if (err) {
res.status(500);
return void send500(res);
}
res.send();
});
});
app.get('/api/profiling', function (req, res) {
if (!Env.enableProfiling) { return void send404(res); }
sendMessage({

4
lib/storage/basic.js
View File

@ -89,3 +89,7 @@ Basic.restore = function (Env, archivePath, path, cb) {
cb(err);
});
};
Basic.isValidId = id => {
return id && typeof(id) === "string" && /^[a-zA-Z0-9-+=]+$/.test(id);
};

4
lib/storage/challenge.js
View File

@ -22,7 +22,9 @@ const Challenge = module.exports;
*/
const pathFromId = function (Env, id) {
if (!id || typeof(id) !== 'string') { return void console.error('CHALLENGE_BAD_ID', id); }
if (!Basic.isValidId(id)) {
return void console.error('CHALLENGE_BAD_ID', id);
}
return Path.join(Env.paths.base, "challenges", id.slice(0, 2), id);
};

4
lib/storage/invite.js
View File

@ -17,7 +17,9 @@ const Invite = module.exports;
*/
const pathFromId = function (Env, id) {
if (!id || typeof(id) !== 'string') { return void console.error('INVITE_BAD_ID', id); }
if (!Basic.isValidId(id)) {
return void console.error('INVITE_BAD_ID', id);
}
return Path.join(Env.paths.base, "invitations", id.slice(0, 2), id);
};

1
lib/storage/mfa.js
View File

@ -28,6 +28,7 @@ so that it can be accessed quickly.
var pathFromId = function (Env, id) {
if (!id || typeof(id) !== 'string') { return; }
id = Util.escapeKeyCharacters(id);
if (!Basic.isValidId(id)) { return; }
return Path.join(Env.paths.base, "mfa", id.slice(0, 2), `${id}.json`);
};

4
lib/storage/moderator.js
View File

@ -14,7 +14,9 @@ const Moderator = module.exports;
*/
const pathFromId = function (Env, id) {
if (!id || typeof(id) !== 'string') { return void console.error('KNWONUSER_BAD_ID', id); }
if (!Basic.isValidId(id)) {
return void console.error('MODERATOR_BAD_ID', id);
}
return Path.join(Env.paths.base, "support", id.slice(0, 2), id);
};

1
lib/storage/sessions.js
View File

@ -25,6 +25,7 @@ const Sessions = module.exports;
var pathFromId = function (Env, id, ref) {
if (!id || typeof(id) !== 'string') { return; }
if (!Basic.isValidId(ref)) { return; }
id = Util.escapeKeyCharacters(id);
return Path.join(Env.paths.base, "sessions", id.slice(0, 2), id, ref);
};

1
lib/storage/sso.js
View File

@ -20,6 +20,7 @@ The path for the user database is based on their persistent identifier (id) from
var pathFromId = function (Env, id, subPath) {
if (!id || typeof(id) !== 'string') { return; }
id = Util.escapeKeyCharacters(id);
if (!Basic.isValidId(id)) { return; }
return Path.join(Env.paths.base, subPath, id.slice(0, 2), `${id}.json`);
};
var reqPathFromId = function (Env, id) {

4
lib/storage/user.js
View File

@ -14,7 +14,9 @@ const User = module.exports;
*/
const pathFromId = function (Env, id) {
if (!id || typeof(id) !== 'string') { return void console.error('KNWONUSER_BAD_ID', id); }
if (!Basic.isValidId(id)) {
return void console.error('USER_BAD_ID', id);
}
return Path.join(Env.paths.base, "users", id.slice(0, 2), id);
};