Code Coverage
 
Lines
Functions and Methods
Classes and Traits
Total
93.85% covered (success)
93.85%
229 / 244
66.67% covered (warning)
66.67%
8 / 12
CRAP
0.00% covered (danger)
0.00%
0 / 1
Controller
93.85% covered (success)
93.85%
229 / 244
66.67% covered (warning)
66.67%
8 / 12
57.75
0.00% covered (danger)
0.00%
0 / 1
 __construct
90.00% covered (success)
90.00%
36 / 40
0.00% covered (danger)
0.00%
0 / 1
11.12
 _init
100.00% covered (success)
100.00%
5 / 5
100.00% covered (success)
100.00%
1 / 1
1
 _setDefaultLanguage
100.00% covered (success)
100.00%
5 / 5
100.00% covered (success)
100.00%
1 / 1
3
 _setDefaultTemplate
60.00% covered (warning)
60.00%
6 / 10
0.00% covered (danger)
0.00%
0 / 1
5.02
 _setCacheHeaders
100.00% covered (success)
100.00%
6 / 6
100.00% covered (success)
100.00%
1 / 1
1
 _create
89.80% covered (success)
89.80%
44 / 49
0.00% covered (danger)
0.00%
0 / 1
12.15
 _delete
100.00% covered (success)
100.00%
15 / 15
100.00% covered (success)
100.00%
1 / 1
6
 _read
100.00% covered (success)
100.00%
11 / 11
100.00% covered (success)
100.00%
1 / 1
5
 _view
97.01% covered (success)
97.01%
65 / 67
0.00% covered (danger)
0.00%
0 / 1
6
 _jsonld
100.00% covered (success)
100.00%
26 / 26
100.00% covered (success)
100.00%
1 / 1
4
 _shortenerproxy
100.00% covered (success)
100.00%
3 / 3
100.00% covered (success)
100.00%
1 / 1
2
 _return_message
100.00% covered (success)
100.00%
7 / 7
100.00% covered (success)
100.00%
1 / 1
2
1<?php declare(strict_types=1);
2/**
3 * PrivateBin
4 *
5 * a zero-knowledge paste bin
6 *
7 * @link      https://github.com/PrivateBin/PrivateBin
8 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
9 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
10 */
11
12namespace PrivateBin;
13
14use Exception;
15use PrivateBin\Persistence\ServerSalt;
16use PrivateBin\Persistence\TrafficLimiter;
17use PrivateBin\Proxy\AbstractProxy;
18use PrivateBin\Proxy\ShlinkProxy;
19use PrivateBin\Proxy\YourlsProxy;
20
21/**
22 * Controller
23 *
24 * Puts it all together.
25 */
26class Controller
27{
28    /**
29     * version
30     *
31     * @const string
32     */
33    const VERSION = '2.0.3';
34
35    /**
36     * minimal required PHP version
37     *
38     * @const string
39     */
40    const MIN_PHP_VERSION = '7.4.0';
41
42    /**
43     * show the same error message if the document expired or does not exist
44     *
45     * @const string
46     */
47    const GENERIC_ERROR = 'Document does not exist, has expired or has been deleted.';
48
49    /**
50     * configuration
51     *
52     * @access private
53     * @var    Configuration
54     */
55    private $_conf;
56
57    /**
58     * error message
59     *
60     * @access private
61     * @var    string
62     */
63    private $_error = '';
64
65    /**
66     * status message
67     *
68     * @access private
69     * @var    string
70     */
71    private $_status = '';
72
73    /**
74     * status message
75     *
76     * @access private
77     * @var    bool
78     */
79    private $_is_deleted = false;
80
81    /**
82     * JSON message
83     *
84     * @access private
85     * @var    string
86     */
87    private $_json = '';
88
89    /**
90     * Factory of instance models
91     *
92     * @access private
93     * @var    model
94     */
95    private $_model;
96
97    /**
98     * request
99     *
100     * @access private
101     * @var    request
102     */
103    private $_request;
104
105    /**
106     * URL base
107     *
108     * @access private
109     * @var    string
110     */
111    private $_urlBase;
112
113    /**
114     * constructor
115     *
116     * initializes and runs PrivateBin
117     *
118     * @param ?Configuration $config
119     *
120     * @access public
121     * @throws Exception
122     */
123    public function __construct(?Configuration $config = null)
124    {
125        if (version_compare(PHP_VERSION, self::MIN_PHP_VERSION) < 0) {
126            error_log(I18n::_('%s requires php %s or above to work. Sorry.', I18n::_('PrivateBin'), self::MIN_PHP_VERSION));
127            return;
128        }
129        if (strlen(PATH) < 0 && substr(PATH, -1) !== DIRECTORY_SEPARATOR) {
130            error_log(I18n::_('%s requires the PATH to end in a "%s". Please update the PATH in your index.php.', I18n::_('PrivateBin'), DIRECTORY_SEPARATOR));
131            return;
132        }
133
134        // load config (using ini file by default) & initialize required classes
135        $this->_conf = $config ?? new Configuration();
136        $this->_init();
137
138        switch ($this->_request->getOperation()) {
139            case 'create':
140                $this->_create();
141                break;
142            case 'delete':
143                $this->_delete(
144                    $this->_request->getParam('pasteid'),
145                    $this->_request->getParam('deletetoken')
146                );
147                break;
148            case 'read':
149                $this->_read($this->_request->getParam('pasteid'));
150                break;
151            case 'jsonld':
152                $this->_jsonld($this->_request->getParam('jsonld'));
153                return;
154            case 'yourlsproxy':
155                $this->_shortenerproxy(new YourlsProxy($this->_conf, $this->_request->getParam('link')));
156                break;
157            case 'shlinkproxy':
158                $this->_shortenerproxy(new ShlinkProxy($this->_conf, $this->_request->getParam('link')));
159                break;
160        }
161
162        $this->_setCacheHeaders();
163
164        // output JSON or HTML
165        if ($this->_request->isJsonApiCall()) {
166            header('Content-type: ' . Request::MIME_JSON);
167            header('Access-Control-Allow-Origin: *');
168            header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE');
169            header('Access-Control-Allow-Headers: X-Requested-With, Content-Type');
170            header('X-Uncompressed-Content-Length: ' . strlen($this->_json));
171            header('Access-Control-Expose-Headers: X-Uncompressed-Content-Length');
172            echo $this->_json;
173        } else {
174            $this->_view();
175        }
176    }
177
178    /**
179     * initialize PrivateBin
180     *
181     * @access private
182     * @throws Exception
183     */
184    private function _init()
185    {
186        $this->_model   = new Model($this->_conf);
187        $this->_request = new Request;
188        $this->_urlBase = $this->_request->getRequestUri();
189
190        $this->_setDefaultLanguage();
191        $this->_setDefaultTemplate();
192    }
193
194    /**
195     * Set default language
196     *
197     * @access private
198     */
199    private function _setDefaultLanguage()
200    {
201        $lang = $this->_conf->getKey('languagedefault');
202        I18n::setLanguageFallback($lang);
203        // force default language, if language selection is disabled and a default is set
204        if (!$this->_conf->getKey('languageselection') && strlen($lang) == 2) {
205            $_COOKIE['lang'] = $lang;
206            setcookie('lang', $lang, array('SameSite' => 'Lax', 'Secure' => true));
207        }
208    }
209
210    /**
211     * Set default template
212     *
213     * @access private
214     */
215    private function _setDefaultTemplate()
216    {
217        $templates = $this->_conf->getKey('availabletemplates');
218        $template  = $this->_conf->getKey('template');
219        if (!in_array($template, $templates, true)) {
220            $templates[] = $template;
221        }
222        TemplateSwitcher::setAvailableTemplates($templates);
223        TemplateSwitcher::setTemplateFallback($template);
224
225        // force default template, if template selection is disabled
226        if (!$this->_conf->getKey('templateselection') && array_key_exists('template', $_COOKIE)) {
227            unset($_COOKIE['template']); // ensure value is not re-used in template switcher
228            $expiredInAllTimezones = time() - 86400;
229            setcookie('template', '', array('expires' => $expiredInAllTimezones, 'SameSite' => 'Lax', 'Secure' => true));
230        }
231    }
232
233    /**
234     * Turn off browser caching
235     *
236     * @access private
237     */
238    private function _setCacheHeaders()
239    {
240        // set headers to disable caching
241        $time = gmdate('D, d M Y H:i:s \G\M\T');
242        header('Cache-Control: no-store, no-cache, no-transform, must-revalidate');
243        header('Pragma: no-cache');
244        header('Expires: ' . $time);
245        header('Last-Modified: ' . $time);
246        header('Vary: Accept');
247    }
248
249    /**
250     * Store new paste or comment
251     *
252     * POST contains:
253     * JSON encoded object with mandatory keys:
254     *   v = 2 (version)
255     *   adata (array)
256     *   ct (base64 encoded, encrypted text)
257     * meta (optional):
258     *   expire = expiration delay (never,5min,10min,1hour,1day,1week,1month,1year,burn) (default:1week)
259     * parentid (optional) = in discussions, which comment this comment replies to.
260     * pasteid (optional) = in discussions, which paste this comment belongs to.
261     *
262     * @access private
263     * @return string
264     */
265    private function _create()
266    {
267        // Ensure last paste from visitors IP address was more than configured amount of seconds ago.
268        ServerSalt::setStore($this->_model->getStore());
269        TrafficLimiter::setConfiguration($this->_conf);
270        TrafficLimiter::setStore($this->_model->getStore());
271        try {
272            TrafficLimiter::canPass();
273        } catch (Exception $e) {
274            $this->_return_message(1, $e->getMessage());
275            return;
276        }
277
278        $data      = $this->_request->getData();
279        $isComment = array_key_exists('pasteid', $data) &&
280            !empty($data['pasteid']) &&
281            array_key_exists('parentid', $data) &&
282            !empty($data['parentid']);
283        if (!FormatV2::isValid($data, $isComment)) {
284            $this->_return_message(1, I18n::_('Invalid data.'));
285            return;
286        }
287        $sizelimit = $this->_conf->getKey('sizelimit');
288        // Ensure content is not too big.
289        if (strlen($data['ct']) > $sizelimit) {
290            $this->_return_message(
291                1,
292                I18n::_(
293                    'Document is limited to %s of encrypted data.',
294                    Filter::formatHumanReadableSize($sizelimit)
295                )
296            );
297            return;
298        }
299
300        // The user posts a comment.
301        if ($isComment) {
302            $paste = $this->_model->getPaste($data['pasteid']);
303            if ($paste->exists()) {
304                try {
305                    $comment = $paste->getComment($data['parentid']);
306                    $comment->setData($data);
307                    $comment->store();
308                } catch (Exception $e) {
309                    $this->_return_message(1, $e->getMessage());
310                    return;
311                }
312                $this->_return_message(0, $comment->getId());
313            } else {
314                $this->_return_message(1, I18n::_('Invalid data.'));
315            }
316        }
317        // The user posts a standard paste.
318        else {
319            try {
320                $this->_model->purge();
321            } catch (Exception $e) {
322                error_log('Error purging documents: ' . $e->getMessage() . PHP_EOL .
323                    'Use the administration scripts statistics to find ' .
324                    'damaged paste IDs and either delete them or restore them ' .
325                    'from backup.');
326            }
327            $paste = $this->_model->getPaste();
328            try {
329                $paste->setData($data);
330                $paste->store();
331            } catch (Exception $e) {
332                $this->_return_message(1, $e->getMessage());
333                return;
334            }
335            $this->_return_message(0, $paste->getId(), array('deletetoken' => $paste->getDeleteToken()));
336        }
337    }
338
339    /**
340     * Delete an existing document
341     *
342     * @access private
343     * @param  string $dataid
344     * @param  string $deletetoken
345     */
346    private function _delete($dataid, $deletetoken)
347    {
348        try {
349            $paste = $this->_model->getPaste($dataid);
350            if ($paste->exists()) {
351                // accessing this method ensures that the document would be
352                // deleted if it has already expired
353                $paste->get();
354                if (hash_equals($paste->getDeleteToken(), $deletetoken)) {
355                    // Document exists and deletion token is valid: Delete the it.
356                    $paste->delete();
357                    $this->_status     = 'Document was properly deleted.';
358                    $this->_is_deleted = true;
359                } else {
360                    $this->_error = 'Wrong deletion token. Document was not deleted.';
361                }
362            } else {
363                $this->_error = self::GENERIC_ERROR;
364            }
365        } catch (Exception $e) {
366            $this->_error = $e->getMessage();
367        }
368        if ($this->_request->isJsonApiCall()) {
369            if (empty($this->_error)) {
370                $this->_return_message(0, $dataid);
371            } else {
372                $this->_return_message(1, $this->_error);
373            }
374        }
375    }
376
377    /**
378     * Read an existing document, only allowed via a JSON API call
379     *
380     * @access private
381     * @param  string $dataid
382     */
383    private function _read($dataid)
384    {
385        if (!$this->_request->isJsonApiCall()) {
386            return;
387        }
388
389        try {
390            $paste = $this->_model->getPaste($dataid);
391            if ($paste->exists()) {
392                $data = $paste->get();
393                if (array_key_exists('salt', $data['meta'])) {
394                    unset($data['meta']['salt']);
395                }
396                $this->_return_message(0, $dataid, (array) $data);
397            } else {
398                $this->_return_message(1, self::GENERIC_ERROR);
399            }
400        } catch (Exception $e) {
401            $this->_return_message(1, $e->getMessage());
402        }
403    }
404
405    /**
406     * Display frontend.
407     *
408     * @access private
409     */
410    private function _view()
411    {
412        header('Content-Security-Policy: ' . $this->_conf->getKey('cspheader'));
413        header('Cross-Origin-Resource-Policy: same-origin');
414        header('Cross-Origin-Embedder-Policy: require-corp');
415        // disabled, because it prevents links from a document to the same site to
416        // be opened. Didn't work with `same-origin-allow-popups` either.
417        // See issue https://github.com/PrivateBin/PrivateBin/issues/970 for details.
418        // header('Cross-Origin-Opener-Policy: same-origin');
419        header('Permissions-Policy: browsing-topics=()');
420        header('Referrer-Policy: no-referrer');
421        header('X-Content-Type-Options: nosniff');
422        header('X-Frame-Options: deny');
423        header('X-XSS-Protection: 1; mode=block');
424
425        // label all the expiration options
426        $expire = array();
427        foreach ($this->_conf->getSection('expire_options') as $time => $seconds) {
428            $expire[$time] = ($seconds == 0) ? I18n::_(ucfirst($time)) : Filter::formatHumanReadableTime($time);
429        }
430
431        // translate all the formatter options
432        $formatters = array_map('PrivateBin\\I18n::_', $this->_conf->getSection('formatter_options'));
433
434        // set language cookie if that functionality was enabled
435        $languageselection = '';
436        if ($this->_conf->getKey('languageselection')) {
437            $languageselection = I18n::getLanguage();
438            setcookie('lang', $languageselection, array('SameSite' => 'Lax', 'Secure' => true));
439        }
440
441        // set template cookie if that functionality was enabled
442        $templateselection = '';
443        if ($this->_conf->getKey('templateselection')) {
444            $templateselection = TemplateSwitcher::getTemplate();
445            setcookie('template', $templateselection, array('SameSite' => 'Lax', 'Secure' => true));
446        }
447
448        // strip policies that are unsupported in meta tag
449        $metacspheader = str_replace(
450            array(
451                'frame-ancestors \'none\'; ',
452                '; sandbox allow-same-origin allow-scripts allow-forms allow-modals allow-downloads',
453            ),
454            '',
455            $this->_conf->getKey('cspheader')
456        );
457
458        $page = new View;
459        $page->assign('CSPHEADER', $metacspheader);
460        $page->assign('ERROR', I18n::_($this->_error));
461        $page->assign('NAME', $this->_conf->getKey('name'));
462        if (in_array($this->_request->getOperation(), array('shlinkproxy', 'yourlsproxy'), true)) {
463            $page->assign('SHORTURL', $this->_status);
464            $page->draw('shortenerproxy');
465            return;
466        }
467        $page->assign('BASEPATH', I18n::_($this->_conf->getKey('basepath')));
468        $page->assign('STATUS', I18n::_($this->_status));
469        $page->assign('ISDELETED', I18n::_(json_encode($this->_is_deleted)));
470        $page->assign('VERSION', self::VERSION);
471        $page->assign('DISCUSSION', $this->_conf->getKey('discussion'));
472        $page->assign('OPENDISCUSSION', $this->_conf->getKey('opendiscussion'));
473        $page->assign('MARKDOWN', array_key_exists('markdown', $formatters));
474        $page->assign('SYNTAXHIGHLIGHTING', array_key_exists('syntaxhighlighting', $formatters));
475        $page->assign('SYNTAXHIGHLIGHTINGTHEME', $this->_conf->getKey('syntaxhighlightingtheme'));
476        $page->assign('FORMATTER', $formatters);
477        $page->assign('FORMATTERDEFAULT', $this->_conf->getKey('defaultformatter'));
478        $page->assign('INFO', I18n::_(str_replace("'", '"', $this->_conf->getKey('info'))));
479        $page->assign('NOTICE', I18n::_($this->_conf->getKey('notice')));
480        $page->assign('BURNAFTERREADINGSELECTED', $this->_conf->getKey('burnafterreadingselected'));
481        $page->assign('PASSWORD', $this->_conf->getKey('password'));
482        $page->assign('FILEUPLOAD', $this->_conf->getKey('fileupload'));
483        $page->assign('LANGUAGESELECTION', $languageselection);
484        $page->assign('LANGUAGES', I18n::getLanguageLabels(I18n::getAvailableLanguages()));
485        $page->assign('TEMPLATESELECTION', $templateselection);
486        $page->assign('TEMPLATES', TemplateSwitcher::getAvailableTemplates());
487        $page->assign('EXPIRE', $expire);
488        $page->assign('EXPIREDEFAULT', $this->_conf->getKey('default', 'expire'));
489        $page->assign('URLSHORTENER', $this->_conf->getKey('urlshortener'));
490        $page->assign('SHORTENBYDEFAULT', $this->_conf->getKey('shortenbydefault'));
491        $page->assign('QRCODE', $this->_conf->getKey('qrcode'));
492        $page->assign('EMAIL', $this->_conf->getKey('email'));
493        $page->assign('HTTPWARNING', $this->_conf->getKey('httpwarning'));
494        $page->assign('HTTPSLINK', 'https://' . $this->_request->getHost() . $this->_request->getRequestUri());
495        $page->assign('COMPRESSION', $this->_conf->getKey('compression'));
496        $page->assign('SRI', $this->_conf->getSection('sri'));
497        $page->draw(TemplateSwitcher::getTemplate());
498    }
499
500    /**
501     * outputs requested JSON-LD context
502     *
503     * @access private
504     * @param string $type
505     */
506    private function _jsonld($type)
507    {
508        if (!in_array($type, array(
509            'comment',
510            'commentmeta',
511            'paste',
512            'pastemeta',
513            'types',
514        ))) {
515            $type = '';
516        }
517        $content = '{}';
518        $file    = PUBLIC_PATH . DIRECTORY_SEPARATOR . 'js' . DIRECTORY_SEPARATOR . $type . '.jsonld';
519        if (is_readable($file)) {
520            $content = str_replace(
521                '?jsonld=',
522                $this->_urlBase . '?jsonld=',
523                file_get_contents($file)
524            );
525        }
526        if ($type === 'types') {
527            $content = str_replace(
528                implode('", "', array_keys($this->_conf->getDefaults()['expire_options'])),
529                implode('", "', array_keys($this->_conf->getSection('expire_options'))),
530                $content
531            );
532        }
533
534        header('Content-type: application/ld+json');
535        header('Access-Control-Allow-Origin: *');
536        header('Access-Control-Allow-Methods: GET');
537        echo $content;
538    }
539
540    /**
541     * Proxies a link using the specified proxy class, and updates the status or error with the response.
542     *
543     * @access private
544     * @param AbstractProxy $proxy The instance of the proxy class.
545     */
546    private function _shortenerproxy(AbstractProxy $proxy)
547    {
548        if ($proxy->isError()) {
549            $this->_error = $proxy->getError();
550        } else {
551            $this->_status = $proxy->getUrl();
552        }
553    }
554
555    /**
556     * prepares JSON encoded status message
557     *
558     * @access private
559     * @param  int $status
560     * @param  string $message
561     * @param  array $other
562     */
563    private function _return_message($status, $message, $other = array())
564    {
565        $result = array('status' => $status);
566        if ($status) {
567            $result['message'] = I18n::_($message);
568        } else {
569            $result['id']  = $message;
570            $result['url'] = $this->_urlBase . '?' . $message;
571        }
572        $result += $other;
573        $this->_json = Json::encode($result);
574    }
575}