mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Add a repair step to remove sensitive event activity 

Signed-off-by: Joas Schilling <coding@schilljs.com>
This commit is contained in:
Joas Schilling 2019-01-08 18:39:40 +01:00 committed by Morris Jobke
parent 194c4b717e
commit 5ea32a1bca
No known key found for this signature in database
GPG Key ID: FE03C3A163FEDE68
5 changed files with 128 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
apps/dav/appinfo/info.xml
View File

@ -4,7 +4,7 @@
<name>WebDAV</name>
<description>WebDAV endpoint</description>
<licence>AGPL</licence>
<version>1.4.7</version>
<version>1.4.8</version>
<author>owncloud.org</author>
<default_enable/>
<types>
@ -22,6 +22,7 @@
<step>OCA\DAV\Migration\FixBirthdayCalendarComponent</step>
<step>OCA\DAV\Migration\CalDAVRemoveEmptyValue</step>
<step>OCA\DAV\Migration\BuildCalendarSearchIndex</step>
<step>OCA\DAV\Migration\RemoveClassifiedEventActivity</step>
</post-migration>
</repair-steps>
<commands>

2
apps/dav/composer/composer/ClassLoader.php
View File

@ -279,7 +279,7 @@ class ClassLoader
*/
public function setApcuPrefix($apcuPrefix)
{
$this->apcuPrefix = function_exists('apcu_fetch') && ini_get('apc.enabled') ? $apcuPrefix : null;
$this->apcuPrefix = function_exists('apcu_fetch') && filter_var(ini_get('apc.enabled'), FILTER_VALIDATE_BOOLEAN) ? $apcuPrefix : null;
}
/**

1
apps/dav/composer/composer/autoload_classmap.php
View File

@ -133,6 +133,7 @@ return array(
'OCA\\DAV\\Migration\\BuildCalendarSearchIndexBackgroundJob' => $baseDir . '/../lib/Migration/BuildCalendarSearchIndexBackgroundJob.php',
'OCA\\DAV\\Migration\\CalDAVRemoveEmptyValue' => $baseDir . '/../lib/Migration/CalDAVRemoveEmptyValue.php',
'OCA\\DAV\\Migration\\FixBirthdayCalendarComponent' => $baseDir . '/../lib/Migration/FixBirthdayCalendarComponent.php',
'OCA\\DAV\\Migration\\RemoveClassifiedEventActivity' => $baseDir . '/../lib/Migration/RemoveClassifiedEventActivity.php',
'OCA\\DAV\\Migration\\Version1004Date20170825134824' => $baseDir . '/../lib/Migration/Version1004Date20170825134824.php',
'OCA\\DAV\\Migration\\Version1004Date20170919104507' => $baseDir . '/../lib/Migration/Version1004Date20170919104507.php',
'OCA\\DAV\\Migration\\Version1004Date20170924124212' => $baseDir . '/../lib/Migration/Version1004Date20170924124212.php',

1
apps/dav/composer/composer/autoload_static.php
View File

@ -148,6 +148,7 @@ class ComposerStaticInitDAV
'OCA\\DAV\\Migration\\BuildCalendarSearchIndexBackgroundJob' => __DIR__ . '/..' . '/../lib/Migration/BuildCalendarSearchIndexBackgroundJob.php',
'OCA\\DAV\\Migration\\CalDAVRemoveEmptyValue' => __DIR__ . '/..' . '/../lib/Migration/CalDAVRemoveEmptyValue.php',
'OCA\\DAV\\Migration\\FixBirthdayCalendarComponent' => __DIR__ . '/..' . '/../lib/Migration/FixBirthdayCalendarComponent.php',
'OCA\\DAV\\Migration\\RemoveClassifiedEventActivity' => __DIR__ . '/..' . '/../lib/Migration/RemoveClassifiedEventActivity.php',
'OCA\\DAV\\Migration\\Version1004Date20170825134824' => __DIR__ . '/..' . '/../lib/Migration/Version1004Date20170825134824.php',
'OCA\\DAV\\Migration\\Version1004Date20170919104507' => __DIR__ . '/..' . '/../lib/Migration/Version1004Date20170919104507.php',
'OCA\\DAV\\Migration\\Version1004Date20170924124212' => __DIR__ . '/..' . '/../lib/Migration/Version1004Date20170924124212.php',

123
apps/dav/lib/Migration/RemoveClassifiedEventActivity.php Normal file
View File

@ -0,0 +1,123 @@
<?php
/**
* @copyright Copyright (c) 2019 Joas Schilling <coding@schilljs.com>
*
* @license GNU AGPL version 3 or any later version
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
*/
namespace OCA\DAV\Migration;
use OCA\DAV\CalDAV\CalDavBackend;
use OCP\IDBConnection;
use OCP\Migration\IOutput;
use OCP\Migration\IRepairStep;
class RemoveClassifiedEventActivity implements IRepairStep {
/** @var IDBConnection */
private $connection;
public function __construct(IDBConnection $connection) {
$this->connection = $connection;
}
/**
* @inheritdoc
*/
public function getName() {
return 'Remove activity entries of private events';
}
/**
* @inheritdoc
*/
public function run(IOutput $output) {
if (!$this->connection->tableExists('activity')) {
return;
}
$deletedEvents = $this->removePrivateEventActivity();
$deletedEvents += $this->removeConfidentialUncensoredEventActivity();
$output->info("Removed $deletedEvents activity entries");
}
protected function removePrivateEventActivity() {
$deletedEvents = 0;
$delete = $this->connection->getQueryBuilder();
$delete->delete('activity')
->where($delete->expr()->neq('affecteduser', $delete->createParameter('owner')))
->andWhere($delete->expr()->eq('object_type', $delete->createParameter('type')))
->andWhere($delete->expr()->eq('object_id', $delete->createParameter('calendar_id')))
->andWhere($delete->expr()->like('subjectparams', $delete->createParameter('event_uid')));
$query = $this->connection->getQueryBuilder();
$query->select('c.principaluri', 'o.calendarid', 'o.uid')
->from('calendarobjects', 'o')
->leftJoin('o', 'calendars', 'c', $query->expr()->eq('c.id', 'o.calendarid'))
->where($query->expr()->eq('o.classification', $query->createNamedParameter(CalDavBackend::CLASSIFICATION_PRIVATE)));
$result = $query->execute();
while ($row = $result->fetch()) {
$delete->setParameter('owner', $this->getPrincipal($row['principaluri']))
->setParameter('type', 'calendar')
->setParameter('calendar_id', $row['calendarid'])
->setParameter('event_uid', '%' . $this->connection->escapeLikeParameter('{"id":"' . $row['uid'] . '"') . '%');
$deletedEvents += $delete->execute();
}
$result->closeCursor();
return $deletedEvents;
}
protected function removeConfidentialUncensoredEventActivity() {
$deletedEvents = 0;
$delete = $this->connection->getQueryBuilder();
$delete->delete('activity')
->where($delete->expr()->neq('affecteduser', $delete->createParameter('owner')))
->andWhere($delete->expr()->eq('object_type', $delete->createParameter('type')))
->andWhere($delete->expr()->eq('object_id', $delete->createParameter('calendar_id')))
->andWhere($delete->expr()->like('subjectparams', $delete->createParameter('event_uid')))
->andWhere($delete->expr()->notLike('subjectparams', $delete->createParameter('filtered_name')));
$query = $this->connection->getQueryBuilder();
$query->select('c.principaluri', 'o.calendarid', 'o.uid')
->from('calendarobjects', 'o')
->leftJoin('o', 'calendars', 'c', $query->expr()->eq('c.id', 'o.calendarid'))
->where($query->expr()->eq('o.classification', $query->createNamedParameter(CalDavBackend::CLASSIFICATION_CONFIDENTIAL)));
$result = $query->execute();
while ($row = $result->fetch()) {
$delete->setParameter('owner', $this->getPrincipal($row['principaluri']))
->setParameter('type', 'calendar')
->setParameter('calendar_id', $row['calendarid'])
->setParameter('event_uid', '%' . $this->connection->escapeLikeParameter('{"id":"' . $row['uid'] . '"') . '%')
->setParameter('filtered_name', '%' . $this->connection->escapeLikeParameter('{"id":"' . $row['uid'] . '","name":"Busy"') . '%');
$deletedEvents += $delete->execute();
}
$result->closeCursor();
return $deletedEvents;
}
protected function getPrincipal($principalUri) {
$uri = explode('/', $principalUri);
return $uri[2];
}
}