From 9f47bef1f45fb88983d205ca4f2b2a5cd2c7ffa5 Mon Sep 17 00:00:00 2001 From: nilsteampassnet Date: Fri, 11 Oct 2024 08:05:01 +0200 Subject: [PATCH 01/13] Code review fixes --- api/Controller/Api/BaseController.php | 3 +- api/Controller/Api/ItemController.php | 53 +++++++++++-------- api/index.php | 13 ++++- includes/config/include.php | 2 +- includes/tables_integrity.json | 16 +++--- index.php | 4 +- pages/admin.php | 2 +- pages/uploads.js.php | 4 +- pages/uploads.php | 4 +- scripts/background_tasks___items_handler.php | 2 +- ...ckground_tasks___items_handler_subtask.php | 2 +- scripts/task_maintenance_purge_old_files.php | 1 - sources/backups.queries.php | 2 +- sources/core.php | 12 ++--- sources/downloadFile.php | 5 +- sources/folders.class.php | 1 - sources/folders.queries.php | 3 +- sources/import.queries.php | 7 +-- sources/logs.datatables.php | 2 +- sources/main.functions.php | 9 ++-- sources/main.queries.php | 7 +-- sources/tree.php | 3 -- sources/upload.attachments.php | 7 +-- sources/upload.files.php | 4 +- sources/users.queries.php | 3 +- 25 files changed, 88 insertions(+), 83 deletions(-) diff --git a/api/Controller/Api/BaseController.php b/api/Controller/Api/BaseController.php index e75544a91..21dc48f06 100755 --- a/api/Controller/Api/BaseController.php +++ b/api/Controller/Api/BaseController.php @@ -80,8 +80,7 @@ public function sanitizeUrl(array $array) return dataSanitizer( $array, - $filters, - __DIR__.'/../../..' + $filters ); } diff --git a/api/Controller/Api/ItemController.php b/api/Controller/Api/ItemController.php index f2a1dc438..e92a6455f 100755 --- a/api/Controller/Api/ItemController.php +++ b/api/Controller/Api/ItemController.php @@ -185,29 +185,38 @@ public function createAction(array $userData) // get parameters $arrQueryStringParams = $this->getQueryStringParams(); - // check parameters - $arrCheck = $this->checkNewItemData($arrQueryStringParams, $userData); - if ($arrCheck['error'] === true) { - $strErrorDesc = $arrCheck['strErrorDesc']; - $strErrorHeader = $arrCheck['strErrorHeader']; + // Check that the parameters are indeed an array before using them + if (is_array($arrQueryStringParams)) { + // check parameters + $arrCheck = $this->checkNewItemData($arrQueryStringParams, $userData); + + if ($arrCheck['error'] === true) { + $strErrorDesc = $arrCheck['strErrorDesc']; + $strErrorHeader = $arrCheck['strErrorHeader']; + } else { + // launch + $itemModel = new ItemModel(); + $ret = $itemModel->addItem( + $arrQueryStringParams['folder_id'], + $arrQueryStringParams['label'], + $arrQueryStringParams['password'], + $arrQueryStringParams['description'], + $arrQueryStringParams['login'], + $arrQueryStringParams['email'], + $arrQueryStringParams['url'], + $arrQueryStringParams['tags'], + $arrQueryStringParams['anyone_can_modify'], + $arrQueryStringParams['icon'], + $userData['id'], + $userData['username'], + ); + $responseData = json_encode($ret); + } + } else { - // launch - $itemModel = new ItemModel(); - $ret = $itemModel->addItem( - $arrQueryStringParams['folder_id'], - $arrQueryStringParams['label'], - $arrQueryStringParams['password'], - $arrQueryStringParams['description'], - $arrQueryStringParams['login'], - $arrQueryStringParams['email'], - $arrQueryStringParams['url'], - $arrQueryStringParams['tags'], - $arrQueryStringParams['anyone_can_modify'], - $arrQueryStringParams['icon'], - $userData['id'], - $userData['username'], - ); - $responseData = json_encode($ret); + // Gérer le cas où les paramètres ne sont pas un tableau + $strErrorDesc = 'Data not consistent'; + $strErrorHeader = 'Expected array, received ' . gettype($arrQueryStringParams); } } } else { diff --git a/api/index.php b/api/index.php index c6c356a4a..2d0db62c8 100755 --- a/api/index.php +++ b/api/index.php @@ -23,7 +23,18 @@ * @see https://www.teampass.net */ -header("Access-Control-Allow-Origin: ".$_SERVER['HTTP_HOST']); +// Determine the protocol used +$protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https://' : 'http://'; + +// Validate and filter the host +$host = filter_var($_SERVER['HTTP_HOST'], FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME); + +// Allocate the correct CORS header +if ($host !== false) { + header("Access-Control-Allow-Origin: $protocol$host"); +} else { + header("Access-Control-Allow-Origin: 'null'"); +} header("Content-Type: application/json; charset=UTF-8"); header("Access-Control-Allow-Methods: POST, GET"); header("Access-Control-Max-Age: 3600"); diff --git a/includes/config/include.php b/includes/config/include.php index fb65e0561..99e6f5076 100755 --- a/includes/config/include.php +++ b/includes/config/include.php @@ -28,7 +28,7 @@ define('TP_VERSION', '3.1.2'); define("UPGRADE_MIN_DATE", "1727110744"); -define('TP_VERSION_MINOR', '134'); +define('TP_VERSION_MINOR', '6'); define('TP_TOOL_NAME', 'Teampass'); define('TP_ONE_DAY_SECONDS', 86400); define('TP_ONE_WEEK_SECONDS', 604800); diff --git a/includes/tables_integrity.json b/includes/tables_integrity.json index 032f20dc3..1d4d296d6 100644 --- a/includes/tables_integrity.json +++ b/includes/tables_integrity.json @@ -13,19 +13,19 @@ }, { "table_name": "background_tasks", - "structure_hash": "824ea4c3db1b930b8655191a54d6c09415fca3e0c104117da14ecaa924f05c06" + "structure_hash": "d31e1bf6f7d08b0f7f327fc5403e7226a0e6ba661c4d60058953b314adf9428f" }, { "table_name": "background_tasks_logs", - "structure_hash": "8825f1d0e45b66d4245eb0a7d9d8e0937c504110294ff7e2774511ccc67c5c9b" + "structure_hash": "63c8be2cbe7e9d672dd8b7d68ed1a710370c134861e29942fc39485954e34a17" }, { "table_name": "cache", - "structure_hash": "a5988fbb32009d30106453eb5434d90b1f10135fb988fb3736bbf5fa254a39db" + "structure_hash": "59952248e90c52b35880b1bb62539d8706407406b1759860d3ed44b5081e07ad" }, { "table_name": "cache_tree", - "structure_hash": "322846a049a63afa03479daf66c370de76831bde4f0b0cd34e63fc4887b11f1d" + "structure_hash": "54a46ee10114cbd70f1199a88dd51c6a25d668919e709283bc915b3d0d6e85c8" }, { "table_name": "categories", @@ -97,15 +97,15 @@ }, { "table_name": "log_items", - "structure_hash": "470b020e4d7578366bf8299b3fd14c9a4681057a77dc018587ba08a24a6be7bb" + "structure_hash": "e6284adabbddae673d2fd4e85edaf52adef7418ad42bbd2f185e6fa032964d04" }, { "table_name": "log_system", - "structure_hash": "8e396ef59c43500907160db66b009e41e29c6ed9d9a6aa8e324abd31be0d5777" + "structure_hash": "23229fe42f9dee7df3d95d4718b8d23244e1655aee2d4554d6b37f07892e4613" }, { "table_name": "misc", - "structure_hash": "3cc8939148fb17fabdabcea7eeef550f261c1b62bcbf863e5f9cb5984ad448d1" + "structure_hash": "66fbea921b5ab4f91eec2a157c327c1d17a798a1a7854a2290c6abce5c90975d" }, { "table_name": "nested_tree", @@ -193,7 +193,7 @@ }, { "table_name": "tokens", - "structure_hash": "4c7f59e6e8cc4e8b95626a6c8ef05987e9660b3c8f2ffbb24e7c432d956a6cb7" + "structure_hash": "904d889fdbf82770ba0c18eecb834017576dd6631259276c86a50f99c6a4edcf" }, { "table_name": "user_requests", diff --git a/index.php b/index.php index 829b7a705..a50b39cc3 100755 --- a/index.php +++ b/index.php @@ -687,9 +687,9 @@