mirrors/etherpad-lite
1
0
Fork 0
mirror of https://github.com/ether/etherpad-lite.git synced 2025-04-20 15:36:16 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fix readOnly pad export

Browse source 
The export request hook wasn't testing if the pad's id was from a read-only
pad before validating with the pad manager.

This includes an extra step that makes the read-only id verification and also
avoids setting the original pad's id as the file's name.
This commit is contained in:
Pedro Beschorner Marin 2020-09-16 14:57:27 -03:00 • committed by John McLear
parent 9f63d9b76a
commit c56973ce74
3 changed files with 27 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/node/db/ReadOnlyManager.js
View file

@ -22,6 +22,16 @@
var db = require("./DB"); var db = require("./DB");
var randomString = require("../utils/randomstring"); var randomString = require("../utils/randomstring");
/**
* checks if the id pattern matches a read-only pad id
* @param {String} the pad's id
*/
exports.isReadOnlyId = function(id)
{
return id.indexOf("r.") === 0;
}
/** /**
* returns a read only id for a pad * returns a read only id for a pad
* @param {String} padId the id of the pad * @param {String} padId the id of the pad

9
src/node/handler/ExportHandler.js
View file

@ -49,9 +49,10 @@ const tempDirectory = os.tmpdir();
/** /**
* do a requested export * do a requested export
*/ */
async function doExport(req, res, padId, type) async function doExport(req, res, padId, readOnlyId, type)
{ {
var fileName = padId; // avoid naming the read-only file as the original pad's id
var fileName = readOnlyId ? readOnlyId : padId;
// allow fileName to be overwritten by a hook, the type type is kept static for security reasons // allow fileName to be overwritten by a hook, the type type is kept static for security reasons
let hookFileName = await hooks.aCallFirst("exportFileName", padId); let hookFileName = await hooks.aCallFirst("exportFileName", padId);
@ -130,9 +131,9 @@ async function doExport(req, res, padId, type)
} }
} }
exports.doExport = function(req, res, padId, type) exports.doExport = function(req, res, padId, readOnlyId, type)
{ {
doExport(req, res, padId, type).catch(err => { doExport(req, res, padId, readOnlyId, type).catch(err => {
if (err !== "stop") { if (err !== "stop") {
throw err; throw err;
} }

15
src/node/hooks/express/importexport.js
View file

@ -4,6 +4,7 @@ var settings = require('../../utils/Settings');
var exportHandler = require('../../handler/ExportHandler'); var exportHandler = require('../../handler/ExportHandler');
var importHandler = require('../../handler/ImportHandler'); var importHandler = require('../../handler/ImportHandler');
var padManager = require("../../db/PadManager"); var padManager = require("../../db/PadManager");
var readOnlyManager = require("../../db/ReadOnlyManager");
var authorManager = require("../../db/AuthorManager"); var authorManager = require("../../db/AuthorManager");
const rateLimit = require("express-rate-limit"); const rateLimit = require("express-rate-limit");
const securityManager = require("../../db/SecurityManager"); const securityManager = require("../../db/SecurityManager");
@ -39,14 +40,22 @@ exports.expressCreateServer = function (hook_name, args, cb) {
res.header("Access-Control-Allow-Origin", "*"); res.header("Access-Control-Allow-Origin", "*");
if (await hasPadAccess(req, res)) { if (await hasPadAccess(req, res)) {
let exists = await padManager.doesPadExists(req.params.pad); let padId = req.params.pad;
let readOnlyId = null;
if (readOnlyManager.isReadOnlyId(padId)) {
readOnlyId = padId;
padId = await readOnlyManager.getPadId(readOnlyId);
}
let exists = await padManager.doesPadExists(padId);
if (!exists) { if (!exists) {
console.warn(`Someone tried to export a pad that doesn't exist (${req.params.pad})`); console.warn(`Someone tried to export a pad that doesn't exist (${padId})`);
return next(); return next();
} }
console.log(`Exporting pad "${req.params.pad}" in ${req.params.type} format`); console.log(`Exporting pad "${req.params.pad}" in ${req.params.type} format`);
exportHandler.doExport(req, res, req.params.pad, req.params.type); exportHandler.doExport(req, res, padId, readOnlyId, req.params.type);
} }
}); });