Code Coverage
 
Lines
Functions and Methods
Classes and Traits
Total
95.44% covered (success)
95.44%
230 / 241
75.00% covered (warning)
75.00%
9 / 12
CRAP
0.00% covered (danger)
0.00%
0 / 1
Controller
95.44% covered (success)
95.44%
230 / 241
75.00% covered (warning)
75.00%
9 / 12
56
0.00% covered (danger)
0.00%
0 / 1
 __construct
90.00% covered (success)
90.00%
36 / 40
0.00% covered (danger)
0.00%
0 / 1
11.12
 _init
100.00% covered (success)
100.00%
5 / 5
100.00% covered (success)
100.00%
1 / 1
1
 _setDefaultLanguage
100.00% covered (success)
100.00%
5 / 5
100.00% covered (success)
100.00%
1 / 1
3
 _setDefaultTemplate
100.00% covered (success)
100.00%
7 / 7
100.00% covered (success)
100.00%
1 / 1
3
 _setCacheHeaders
100.00% covered (success)
100.00%
6 / 6
100.00% covered (success)
100.00%
1 / 1
1
 _create
89.80% covered (success)
89.80%
44 / 49
0.00% covered (danger)
0.00%
0 / 1
12.15
 _delete
100.00% covered (success)
100.00%
15 / 15
100.00% covered (success)
100.00%
1 / 1
6
 _read
100.00% covered (success)
100.00%
11 / 11
100.00% covered (success)
100.00%
1 / 1
5
 _view
97.01% covered (success)
97.01%
65 / 67
0.00% covered (danger)
0.00%
0 / 1
6
 _jsonld
100.00% covered (success)
100.00%
26 / 26
100.00% covered (success)
100.00%
1 / 1
4
 _shortenerproxy
100.00% covered (success)
100.00%
3 / 3
100.00% covered (success)
100.00%
1 / 1
2
 _return_message
100.00% covered (success)
100.00%
7 / 7
100.00% covered (success)
100.00%
1 / 1
2
1<?php declare(strict_types=1);
2/**
3 * PrivateBin
4 *
5 * a zero-knowledge paste bin
6 *
7 * @link      https://github.com/PrivateBin/PrivateBin
8 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
9 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
10 */
11
12namespace PrivateBin;
13
14use Exception;
15use PrivateBin\Persistence\ServerSalt;
16use PrivateBin\Persistence\TrafficLimiter;
17use PrivateBin\Proxy\AbstractProxy;
18use PrivateBin\Proxy\ShlinkProxy;
19use PrivateBin\Proxy\YourlsProxy;
20
21/**
22 * Controller
23 *
24 * Puts it all together.
25 */
26class Controller
27{
28    /**
29     * version
30     *
31     * @const string
32     */
33    const VERSION = '2.0.2';
34
35    /**
36     * minimal required PHP version
37     *
38     * @const string
39     */
40    const MIN_PHP_VERSION = '7.4.0';
41
42    /**
43     * show the same error message if the document expired or does not exist
44     *
45     * @const string
46     */
47    const GENERIC_ERROR = 'Document does not exist, has expired or has been deleted.';
48
49    /**
50     * configuration
51     *
52     * @access private
53     * @var    Configuration
54     */
55    private $_conf;
56
57    /**
58     * error message
59     *
60     * @access private
61     * @var    string
62     */
63    private $_error = '';
64
65    /**
66     * status message
67     *
68     * @access private
69     * @var    string
70     */
71    private $_status = '';
72
73    /**
74     * status message
75     *
76     * @access private
77     * @var    bool
78     */
79    private $_is_deleted = false;
80
81    /**
82     * JSON message
83     *
84     * @access private
85     * @var    string
86     */
87    private $_json = '';
88
89    /**
90     * Factory of instance models
91     *
92     * @access private
93     * @var    model
94     */
95    private $_model;
96
97    /**
98     * request
99     *
100     * @access private
101     * @var    request
102     */
103    private $_request;
104
105    /**
106     * URL base
107     *
108     * @access private
109     * @var    string
110     */
111    private $_urlBase;
112
113    /**
114     * constructor
115     *
116     * initializes and runs PrivateBin
117     *
118     * @param ?Configuration $config
119     *
120     * @access public
121     * @throws Exception
122     */
123    public function __construct(?Configuration $config = null)
124    {
125        if (version_compare(PHP_VERSION, self::MIN_PHP_VERSION) < 0) {
126            error_log(I18n::_('%s requires php %s or above to work. Sorry.', I18n::_('PrivateBin'), self::MIN_PHP_VERSION));
127            return;
128        }
129        if (strlen(PATH) < 0 && substr(PATH, -1) !== DIRECTORY_SEPARATOR) {
130            error_log(I18n::_('%s requires the PATH to end in a "%s". Please update the PATH in your index.php.', I18n::_('PrivateBin'), DIRECTORY_SEPARATOR));
131            return;
132        }
133
134        // load config (using ini file by default) & initialize required classes
135        $this->_conf = $config ?? new Configuration();
136        $this->_init();
137
138        switch ($this->_request->getOperation()) {
139            case 'create':
140                $this->_create();
141                break;
142            case 'delete':
143                $this->_delete(
144                    $this->_request->getParam('pasteid'),
145                    $this->_request->getParam('deletetoken')
146                );
147                break;
148            case 'read':
149                $this->_read($this->_request->getParam('pasteid'));
150                break;
151            case 'jsonld':
152                $this->_jsonld($this->_request->getParam('jsonld'));
153                return;
154            case 'yourlsproxy':
155                $this->_shortenerproxy(new YourlsProxy($this->_conf, $this->_request->getParam('link')));
156                break;
157            case 'shlinkproxy':
158                $this->_shortenerproxy(new ShlinkProxy($this->_conf, $this->_request->getParam('link')));
159                break;
160        }
161
162        $this->_setCacheHeaders();
163
164        // output JSON or HTML
165        if ($this->_request->isJsonApiCall()) {
166            header('Content-type: ' . Request::MIME_JSON);
167            header('Access-Control-Allow-Origin: *');
168            header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE');
169            header('Access-Control-Allow-Headers: X-Requested-With, Content-Type');
170            header('X-Uncompressed-Content-Length: ' . strlen($this->_json));
171            header('Access-Control-Expose-Headers: X-Uncompressed-Content-Length');
172            echo $this->_json;
173        } else {
174            $this->_view();
175        }
176    }
177
178    /**
179     * initialize PrivateBin
180     *
181     * @access private
182     * @throws Exception
183     */
184    private function _init()
185    {
186        $this->_model   = new Model($this->_conf);
187        $this->_request = new Request;
188        $this->_urlBase = $this->_request->getRequestUri();
189
190        $this->_setDefaultLanguage();
191        $this->_setDefaultTemplate();
192    }
193
194    /**
195     * Set default language
196     *
197     * @access private
198     */
199    private function _setDefaultLanguage()
200    {
201        $lang = $this->_conf->getKey('languagedefault');
202        I18n::setLanguageFallback($lang);
203        // force default language, if language selection is disabled and a default is set
204        if (!$this->_conf->getKey('languageselection') && strlen($lang) == 2) {
205            $_COOKIE['lang'] = $lang;
206            setcookie('lang', $lang, array('SameSite' => 'Lax', 'Secure' => true));
207        }
208    }
209
210    /**
211     * Set default template
212     *
213     * @access private
214     */
215    private function _setDefaultTemplate()
216    {
217        $templates = $this->_conf->getKey('availabletemplates');
218        $template  = $this->_conf->getKey('template');
219        TemplateSwitcher::setAvailableTemplates($templates);
220        TemplateSwitcher::setTemplateFallback($template);
221
222        // force default template, if template selection is disabled and a default is set
223        if (!$this->_conf->getKey('templateselection') && !empty($template)) {
224            $_COOKIE['template'] = $template;
225            setcookie('template', $template, array('SameSite' => 'Lax', 'Secure' => true));
226        }
227    }
228
229    /**
230     * Turn off browser caching
231     *
232     * @access private
233     */
234    private function _setCacheHeaders()
235    {
236        // set headers to disable caching
237        $time = gmdate('D, d M Y H:i:s \G\M\T');
238        header('Cache-Control: no-store, no-cache, no-transform, must-revalidate');
239        header('Pragma: no-cache');
240        header('Expires: ' . $time);
241        header('Last-Modified: ' . $time);
242        header('Vary: Accept');
243    }
244
245    /**
246     * Store new paste or comment
247     *
248     * POST contains:
249     * JSON encoded object with mandatory keys:
250     *   v = 2 (version)
251     *   adata (array)
252     *   ct (base64 encoded, encrypted text)
253     * meta (optional):
254     *   expire = expiration delay (never,5min,10min,1hour,1day,1week,1month,1year,burn) (default:1week)
255     * parentid (optional) = in discussions, which comment this comment replies to.
256     * pasteid (optional) = in discussions, which paste this comment belongs to.
257     *
258     * @access private
259     * @return string
260     */
261    private function _create()
262    {
263        // Ensure last paste from visitors IP address was more than configured amount of seconds ago.
264        ServerSalt::setStore($this->_model->getStore());
265        TrafficLimiter::setConfiguration($this->_conf);
266        TrafficLimiter::setStore($this->_model->getStore());
267        try {
268            TrafficLimiter::canPass();
269        } catch (Exception $e) {
270            $this->_return_message(1, $e->getMessage());
271            return;
272        }
273
274        $data      = $this->_request->getData();
275        $isComment = array_key_exists('pasteid', $data) &&
276            !empty($data['pasteid']) &&
277            array_key_exists('parentid', $data) &&
278            !empty($data['parentid']);
279        if (!FormatV2::isValid($data, $isComment)) {
280            $this->_return_message(1, I18n::_('Invalid data.'));
281            return;
282        }
283        $sizelimit = $this->_conf->getKey('sizelimit');
284        // Ensure content is not too big.
285        if (strlen($data['ct']) > $sizelimit) {
286            $this->_return_message(
287                1,
288                I18n::_(
289                    'Document is limited to %s of encrypted data.',
290                    Filter::formatHumanReadableSize($sizelimit)
291                )
292            );
293            return;
294        }
295
296        // The user posts a comment.
297        if ($isComment) {
298            $paste = $this->_model->getPaste($data['pasteid']);
299            if ($paste->exists()) {
300                try {
301                    $comment = $paste->getComment($data['parentid']);
302                    $comment->setData($data);
303                    $comment->store();
304                } catch (Exception $e) {
305                    $this->_return_message(1, $e->getMessage());
306                    return;
307                }
308                $this->_return_message(0, $comment->getId());
309            } else {
310                $this->_return_message(1, I18n::_('Invalid data.'));
311            }
312        }
313        // The user posts a standard paste.
314        else {
315            try {
316                $this->_model->purge();
317            } catch (Exception $e) {
318                error_log('Error purging documents: ' . $e->getMessage() . PHP_EOL .
319                    'Use the administration scripts statistics to find ' .
320                    'damaged paste IDs and either delete them or restore them ' .
321                    'from backup.');
322            }
323            $paste = $this->_model->getPaste();
324            try {
325                $paste->setData($data);
326                $paste->store();
327            } catch (Exception $e) {
328                $this->_return_message(1, $e->getMessage());
329                return;
330            }
331            $this->_return_message(0, $paste->getId(), array('deletetoken' => $paste->getDeleteToken()));
332        }
333    }
334
335    /**
336     * Delete an existing document
337     *
338     * @access private
339     * @param  string $dataid
340     * @param  string $deletetoken
341     */
342    private function _delete($dataid, $deletetoken)
343    {
344        try {
345            $paste = $this->_model->getPaste($dataid);
346            if ($paste->exists()) {
347                // accessing this method ensures that the document would be
348                // deleted if it has already expired
349                $paste->get();
350                if (hash_equals($paste->getDeleteToken(), $deletetoken)) {
351                    // Document exists and deletion token is valid: Delete the it.
352                    $paste->delete();
353                    $this->_status     = 'Document was properly deleted.';
354                    $this->_is_deleted = true;
355                } else {
356                    $this->_error = 'Wrong deletion token. Document was not deleted.';
357                }
358            } else {
359                $this->_error = self::GENERIC_ERROR;
360            }
361        } catch (Exception $e) {
362            $this->_error = $e->getMessage();
363        }
364        if ($this->_request->isJsonApiCall()) {
365            if (empty($this->_error)) {
366                $this->_return_message(0, $dataid);
367            } else {
368                $this->_return_message(1, $this->_error);
369            }
370        }
371    }
372
373    /**
374     * Read an existing document, only allowed via a JSON API call
375     *
376     * @access private
377     * @param  string $dataid
378     */
379    private function _read($dataid)
380    {
381        if (!$this->_request->isJsonApiCall()) {
382            return;
383        }
384
385        try {
386            $paste = $this->_model->getPaste($dataid);
387            if ($paste->exists()) {
388                $data = $paste->get();
389                if (array_key_exists('salt', $data['meta'])) {
390                    unset($data['meta']['salt']);
391                }
392                $this->_return_message(0, $dataid, (array) $data);
393            } else {
394                $this->_return_message(1, self::GENERIC_ERROR);
395            }
396        } catch (Exception $e) {
397            $this->_return_message(1, $e->getMessage());
398        }
399    }
400
401    /**
402     * Display frontend.
403     *
404     * @access private
405     */
406    private function _view()
407    {
408        header('Content-Security-Policy: ' . $this->_conf->getKey('cspheader'));
409        header('Cross-Origin-Resource-Policy: same-origin');
410        header('Cross-Origin-Embedder-Policy: require-corp');
411        // disabled, because it prevents links from a document to the same site to
412        // be opened. Didn't work with `same-origin-allow-popups` either.
413        // See issue https://github.com/PrivateBin/PrivateBin/issues/970 for details.
414        // header('Cross-Origin-Opener-Policy: same-origin');
415        header('Permissions-Policy: browsing-topics=()');
416        header('Referrer-Policy: no-referrer');
417        header('X-Content-Type-Options: nosniff');
418        header('X-Frame-Options: deny');
419        header('X-XSS-Protection: 1; mode=block');
420
421        // label all the expiration options
422        $expire = array();
423        foreach ($this->_conf->getSection('expire_options') as $time => $seconds) {
424            $expire[$time] = ($seconds == 0) ? I18n::_(ucfirst($time)) : Filter::formatHumanReadableTime($time);
425        }
426
427        // translate all the formatter options
428        $formatters = array_map('PrivateBin\\I18n::_', $this->_conf->getSection('formatter_options'));
429
430        // set language cookie if that functionality was enabled
431        $languageselection = '';
432        if ($this->_conf->getKey('languageselection')) {
433            $languageselection = I18n::getLanguage();
434            setcookie('lang', $languageselection, array('SameSite' => 'Lax', 'Secure' => true));
435        }
436
437        // set template cookie if that functionality was enabled
438        $templateselection = '';
439        if ($this->_conf->getKey('templateselection')) {
440            $templateselection = TemplateSwitcher::getTemplate();
441            setcookie('template', $templateselection, array('SameSite' => 'Lax', 'Secure' => true));
442        }
443
444        // strip policies that are unsupported in meta tag
445        $metacspheader = str_replace(
446            array(
447                'frame-ancestors \'none\'; ',
448                '; sandbox allow-same-origin allow-scripts allow-forms allow-modals allow-downloads',
449            ),
450            '',
451            $this->_conf->getKey('cspheader')
452        );
453
454        $page = new View;
455        $page->assign('CSPHEADER', $metacspheader);
456        $page->assign('ERROR', I18n::_($this->_error));
457        $page->assign('NAME', $this->_conf->getKey('name'));
458        if (in_array($this->_request->getOperation(), array('shlinkproxy', 'yourlsproxy'), true)) {
459            $page->assign('SHORTURL', $this->_status);
460            $page->draw('shortenerproxy');
461            return;
462        }
463        $page->assign('BASEPATH', I18n::_($this->_conf->getKey('basepath')));
464        $page->assign('STATUS', I18n::_($this->_status));
465        $page->assign('ISDELETED', I18n::_(json_encode($this->_is_deleted)));
466        $page->assign('VERSION', self::VERSION);
467        $page->assign('DISCUSSION', $this->_conf->getKey('discussion'));
468        $page->assign('OPENDISCUSSION', $this->_conf->getKey('opendiscussion'));
469        $page->assign('MARKDOWN', array_key_exists('markdown', $formatters));
470        $page->assign('SYNTAXHIGHLIGHTING', array_key_exists('syntaxhighlighting', $formatters));
471        $page->assign('SYNTAXHIGHLIGHTINGTHEME', $this->_conf->getKey('syntaxhighlightingtheme'));
472        $page->assign('FORMATTER', $formatters);
473        $page->assign('FORMATTERDEFAULT', $this->_conf->getKey('defaultformatter'));
474        $page->assign('INFO', I18n::_(str_replace("'", '"', $this->_conf->getKey('info'))));
475        $page->assign('NOTICE', I18n::_($this->_conf->getKey('notice')));
476        $page->assign('BURNAFTERREADINGSELECTED', $this->_conf->getKey('burnafterreadingselected'));
477        $page->assign('PASSWORD', $this->_conf->getKey('password'));
478        $page->assign('FILEUPLOAD', $this->_conf->getKey('fileupload'));
479        $page->assign('LANGUAGESELECTION', $languageselection);
480        $page->assign('LANGUAGES', I18n::getLanguageLabels(I18n::getAvailableLanguages()));
481        $page->assign('TEMPLATESELECTION', $templateselection);
482        $page->assign('TEMPLATES', TemplateSwitcher::getAvailableTemplates());
483        $page->assign('EXPIRE', $expire);
484        $page->assign('EXPIREDEFAULT', $this->_conf->getKey('default', 'expire'));
485        $page->assign('URLSHORTENER', $this->_conf->getKey('urlshortener'));
486        $page->assign('SHORTENBYDEFAULT', $this->_conf->getKey('shortenbydefault'));
487        $page->assign('QRCODE', $this->_conf->getKey('qrcode'));
488        $page->assign('EMAIL', $this->_conf->getKey('email'));
489        $page->assign('HTTPWARNING', $this->_conf->getKey('httpwarning'));
490        $page->assign('HTTPSLINK', 'https://' . $this->_request->getHost() . $this->_request->getRequestUri());
491        $page->assign('COMPRESSION', $this->_conf->getKey('compression'));
492        $page->assign('SRI', $this->_conf->getSection('sri'));
493        $page->draw(TemplateSwitcher::getTemplate());
494    }
495
496    /**
497     * outputs requested JSON-LD context
498     *
499     * @access private
500     * @param string $type
501     */
502    private function _jsonld($type)
503    {
504        if (!in_array($type, array(
505            'comment',
506            'commentmeta',
507            'paste',
508            'pastemeta',
509            'types',
510        ))) {
511            $type = '';
512        }
513        $content = '{}';
514        $file    = PUBLIC_PATH . DIRECTORY_SEPARATOR . 'js' . DIRECTORY_SEPARATOR . $type . '.jsonld';
515        if (is_readable($file)) {
516            $content = str_replace(
517                '?jsonld=',
518                $this->_urlBase . '?jsonld=',
519                file_get_contents($file)
520            );
521        }
522        if ($type === 'types') {
523            $content = str_replace(
524                implode('", "', array_keys($this->_conf->getDefaults()['expire_options'])),
525                implode('", "', array_keys($this->_conf->getSection('expire_options'))),
526                $content
527            );
528        }
529
530        header('Content-type: application/ld+json');
531        header('Access-Control-Allow-Origin: *');
532        header('Access-Control-Allow-Methods: GET');
533        echo $content;
534    }
535
536    /**
537     * Proxies a link using the specified proxy class, and updates the status or error with the response.
538     *
539     * @access private
540     * @param AbstractProxy $proxy The instance of the proxy class.
541     */
542    private function _shortenerproxy(AbstractProxy $proxy)
543    {
544        if ($proxy->isError()) {
545            $this->_error = $proxy->getError();
546        } else {
547            $this->_status = $proxy->getUrl();
548        }
549    }
550
551    /**
552     * prepares JSON encoded status message
553     *
554     * @access private
555     * @param  int $status
556     * @param  string $message
557     * @param  array $other
558     */
559    private function _return_message($status, $message, $other = array())
560    {
561        $result = array('status' => $status);
562        if ($status) {
563            $result['message'] = I18n::_($message);
564        } else {
565            $result['id']  = $message;
566            $result['url'] = $this->_urlBase . '?' . $message;
567        }
568        $result += $other;
569        $this->_json = Json::encode($result);
570    }
571}