diff options
author | Joas Schilling <coding@schilljs.com> | 2019-01-08 20:39:40 +0300 |
---|---|---|
committer | Morris Jobke <hey@morrisjobke.de> | 2019-01-09 20:33:17 +0300 |
commit | 5ea32a1bca9592835d5648654f0a7dfc98946a05 (patch) | |
tree | 742e98e74939330fd55337c73317524b2a321ed2 /apps | |
parent | 194c4b717e4f43b8033da8afc397a1368b3b1812 (diff) |
Add a repair step to remove sensitive event activity
Signed-off-by: Joas Schilling <coding@schilljs.com>
Diffstat (limited to 'apps')
-rw-r--r-- | apps/dav/appinfo/info.xml | 3 | ||||
-rw-r--r-- | apps/dav/composer/composer/ClassLoader.php | 2 | ||||
-rw-r--r-- | apps/dav/composer/composer/autoload_classmap.php | 1 | ||||
-rw-r--r-- | apps/dav/composer/composer/autoload_static.php | 1 | ||||
-rw-r--r-- | apps/dav/lib/Migration/RemoveClassifiedEventActivity.php | 123 |
5 files changed, 128 insertions, 2 deletions
diff --git a/apps/dav/appinfo/info.xml b/apps/dav/appinfo/info.xml index 54afaf32a00..49bfcdd1df1 100644 --- a/apps/dav/appinfo/info.xml +++ b/apps/dav/appinfo/info.xml @@ -4,7 +4,7 @@ <name>WebDAV</name> <description>WebDAV endpoint</description> <licence>AGPL</licence> - <version>1.4.7</version> + <version>1.4.8</version> <author>owncloud.org</author> <default_enable/> <types> @@ -22,6 +22,7 @@ <step>OCA\DAV\Migration\FixBirthdayCalendarComponent</step> <step>OCA\DAV\Migration\CalDAVRemoveEmptyValue</step> <step>OCA\DAV\Migration\BuildCalendarSearchIndex</step> + <step>OCA\DAV\Migration\RemoveClassifiedEventActivity</step> </post-migration> </repair-steps> <commands> diff --git a/apps/dav/composer/composer/ClassLoader.php b/apps/dav/composer/composer/ClassLoader.php index 95f7e0978ba..fce8549f078 100644 --- a/apps/dav/composer/composer/ClassLoader.php +++ b/apps/dav/composer/composer/ClassLoader.php @@ -279,7 +279,7 @@ class ClassLoader */ public function setApcuPrefix($apcuPrefix) { - $this->apcuPrefix = function_exists('apcu_fetch') && ini_get('apc.enabled') ? $apcuPrefix : null; + $this->apcuPrefix = function_exists('apcu_fetch') && filter_var(ini_get('apc.enabled'), FILTER_VALIDATE_BOOLEAN) ? $apcuPrefix : null; } /** diff --git a/apps/dav/composer/composer/autoload_classmap.php b/apps/dav/composer/composer/autoload_classmap.php index 44b2efa7251..5e4e5bcd0c3 100644 --- a/apps/dav/composer/composer/autoload_classmap.php +++ b/apps/dav/composer/composer/autoload_classmap.php @@ -133,6 +133,7 @@ return array( 'OCA\\DAV\\Migration\\BuildCalendarSearchIndexBackgroundJob' => $baseDir . '/../lib/Migration/BuildCalendarSearchIndexBackgroundJob.php', 'OCA\\DAV\\Migration\\CalDAVRemoveEmptyValue' => $baseDir . '/../lib/Migration/CalDAVRemoveEmptyValue.php', 'OCA\\DAV\\Migration\\FixBirthdayCalendarComponent' => $baseDir . '/../lib/Migration/FixBirthdayCalendarComponent.php', + 'OCA\\DAV\\Migration\\RemoveClassifiedEventActivity' => $baseDir . '/../lib/Migration/RemoveClassifiedEventActivity.php', 'OCA\\DAV\\Migration\\Version1004Date20170825134824' => $baseDir . '/../lib/Migration/Version1004Date20170825134824.php', 'OCA\\DAV\\Migration\\Version1004Date20170919104507' => $baseDir . '/../lib/Migration/Version1004Date20170919104507.php', 'OCA\\DAV\\Migration\\Version1004Date20170924124212' => $baseDir . '/../lib/Migration/Version1004Date20170924124212.php', diff --git a/apps/dav/composer/composer/autoload_static.php b/apps/dav/composer/composer/autoload_static.php index 68fe73b3f4b..aefb1faa78a 100644 --- a/apps/dav/composer/composer/autoload_static.php +++ b/apps/dav/composer/composer/autoload_static.php @@ -148,6 +148,7 @@ class ComposerStaticInitDAV 'OCA\\DAV\\Migration\\BuildCalendarSearchIndexBackgroundJob' => __DIR__ . '/..' . '/../lib/Migration/BuildCalendarSearchIndexBackgroundJob.php', 'OCA\\DAV\\Migration\\CalDAVRemoveEmptyValue' => __DIR__ . '/..' . '/../lib/Migration/CalDAVRemoveEmptyValue.php', 'OCA\\DAV\\Migration\\FixBirthdayCalendarComponent' => __DIR__ . '/..' . '/../lib/Migration/FixBirthdayCalendarComponent.php', + 'OCA\\DAV\\Migration\\RemoveClassifiedEventActivity' => __DIR__ . '/..' . '/../lib/Migration/RemoveClassifiedEventActivity.php', 'OCA\\DAV\\Migration\\Version1004Date20170825134824' => __DIR__ . '/..' . '/../lib/Migration/Version1004Date20170825134824.php', 'OCA\\DAV\\Migration\\Version1004Date20170919104507' => __DIR__ . '/..' . '/../lib/Migration/Version1004Date20170919104507.php', 'OCA\\DAV\\Migration\\Version1004Date20170924124212' => __DIR__ . '/..' . '/../lib/Migration/Version1004Date20170924124212.php', diff --git a/apps/dav/lib/Migration/RemoveClassifiedEventActivity.php b/apps/dav/lib/Migration/RemoveClassifiedEventActivity.php new file mode 100644 index 00000000000..07f77e57c25 --- /dev/null +++ b/apps/dav/lib/Migration/RemoveClassifiedEventActivity.php @@ -0,0 +1,123 @@ +<?php +/** + * @copyright Copyright (c) 2019 Joas Schilling <coding@schilljs.com> + * + * @license GNU AGPL version 3 or any later version + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as + * published by the Free Software Foundation, either version 3 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + * + */ + +namespace OCA\DAV\Migration; + +use OCA\DAV\CalDAV\CalDavBackend; +use OCP\IDBConnection; +use OCP\Migration\IOutput; +use OCP\Migration\IRepairStep; + +class RemoveClassifiedEventActivity implements IRepairStep { + + /** @var IDBConnection */ + private $connection; + + public function __construct(IDBConnection $connection) { + $this->connection = $connection; + } + + /** + * @inheritdoc + */ + public function getName() { + return 'Remove activity entries of private events'; + } + + /** + * @inheritdoc + */ + public function run(IOutput $output) { + if (!$this->connection->tableExists('activity')) { + return; + } + + $deletedEvents = $this->removePrivateEventActivity(); + $deletedEvents += $this->removeConfidentialUncensoredEventActivity(); + + $output->info("Removed $deletedEvents activity entries"); + } + + protected function removePrivateEventActivity() { + $deletedEvents = 0; + + $delete = $this->connection->getQueryBuilder(); + $delete->delete('activity') + ->where($delete->expr()->neq('affecteduser', $delete->createParameter('owner'))) + ->andWhere($delete->expr()->eq('object_type', $delete->createParameter('type'))) + ->andWhere($delete->expr()->eq('object_id', $delete->createParameter('calendar_id'))) + ->andWhere($delete->expr()->like('subjectparams', $delete->createParameter('event_uid'))); + + $query = $this->connection->getQueryBuilder(); + $query->select('c.principaluri', 'o.calendarid', 'o.uid') + ->from('calendarobjects', 'o') + ->leftJoin('o', 'calendars', 'c', $query->expr()->eq('c.id', 'o.calendarid')) + ->where($query->expr()->eq('o.classification', $query->createNamedParameter(CalDavBackend::CLASSIFICATION_PRIVATE))); + $result = $query->execute(); + + while ($row = $result->fetch()) { + $delete->setParameter('owner', $this->getPrincipal($row['principaluri'])) + ->setParameter('type', 'calendar') + ->setParameter('calendar_id', $row['calendarid']) + ->setParameter('event_uid', '%' . $this->connection->escapeLikeParameter('{"id":"' . $row['uid'] . '"') . '%'); + $deletedEvents += $delete->execute(); + } + $result->closeCursor(); + + return $deletedEvents; + } + + protected function removeConfidentialUncensoredEventActivity() { + $deletedEvents = 0; + + $delete = $this->connection->getQueryBuilder(); + $delete->delete('activity') + ->where($delete->expr()->neq('affecteduser', $delete->createParameter('owner'))) + ->andWhere($delete->expr()->eq('object_type', $delete->createParameter('type'))) + ->andWhere($delete->expr()->eq('object_id', $delete->createParameter('calendar_id'))) + ->andWhere($delete->expr()->like('subjectparams', $delete->createParameter('event_uid'))) + ->andWhere($delete->expr()->notLike('subjectparams', $delete->createParameter('filtered_name'))); + + $query = $this->connection->getQueryBuilder(); + $query->select('c.principaluri', 'o.calendarid', 'o.uid') + ->from('calendarobjects', 'o') + ->leftJoin('o', 'calendars', 'c', $query->expr()->eq('c.id', 'o.calendarid')) + ->where($query->expr()->eq('o.classification', $query->createNamedParameter(CalDavBackend::CLASSIFICATION_CONFIDENTIAL))); + $result = $query->execute(); + + while ($row = $result->fetch()) { + $delete->setParameter('owner', $this->getPrincipal($row['principaluri'])) + ->setParameter('type', 'calendar') + ->setParameter('calendar_id', $row['calendarid']) + ->setParameter('event_uid', '%' . $this->connection->escapeLikeParameter('{"id":"' . $row['uid'] . '"') . '%') + ->setParameter('filtered_name', '%' . $this->connection->escapeLikeParameter('{"id":"' . $row['uid'] . '","name":"Busy"') . '%'); + $deletedEvents += $delete->execute(); + } + $result->closeCursor(); + + return $deletedEvents; + } + + protected function getPrincipal($principalUri) { + $uri = explode('/', $principalUri); + return $uri[2]; + } +} |