th/hyprcrd
3
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: v2.0 — AES-GCM crypto, SSRF guards, rate limits, hardening

Browse Source 
Breaking wire-format change: dual-read (V1+V2) / single-write (V2) so
existing user secrets, stored messages, and inter-tenant key keep
working. Old clients and relays lose cross-version chat until both
sides are upgraded.

Relay
- Switch clientEncrypt/masterEncrypt to AES-256-GCM with HKDF-derived
  per-ciphertext salts; keep CBC-V1 fallback on decrypt only.
- On-bootstrap migration re-envelopes tenant secret_encrypted and the
  inter-tenant key to GCM-V2 (idempotent).
- CORS: stop reflecting arbitrary Origin; allow own origin + optional
  RELAY_CORS_ORIGINS env allowlist; drop Access-Control-Allow-Credentials.
- Generic error messages replace "no such user: <name>" enumeration.
- Exception messages no longer echoed back; logged server-side.
- Collab-lock max hold capped at 10min so a member can't grief-refresh
  forever.
- Attachment filenames validated against hex.<ext> pattern.
- Passwords min length 10; /api/account/password rate-limited.

App / Electron client
- Shared hyprcrdRelayEncrypt/Decrypt helpers (GCM-V2 write, V1 read).
- Chat + collab-buckets plugins delegate to the shared helpers.
- Poll + push + attachments migrated to the dual-format path.
- /api/relay/settings GET returns has_key boolean; secret never echoed.
- Setup endpoint now CSRF-checked.
- SSRF: CURLOPT_PROTOCOLS restricted to HTTP(S) everywhere; bookmarks
  favicon fetch also blocks private/loopback/link-local.
- Login / password-change rate limiter moved to DB-backed IP keying.
- Passwords min length 10 throughout.
- Zip import enforces per-file (25MB) and total (500MB) caps, extension
  allowlist, no-overwrite.
- Verbose relay-push debug gated behind APP_DEBUG env.

Version bumped to 2.0.0 (protocol-breaking).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
thandClaude Opus 4.7 committed 2026-04-17 17:02:04 +02:00
1 parent d50f9fe789
commit d83de30d6d
27 files changed
+473 -168
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.gitignore
+1
View File
@@ -15,3 +15,4 @@ data/hyprcrd.db-wal
/oumta-dashboard/
/oumta-dashboard-ui/
relay/data
config.php
+5 -1
View File
@@ -1,7 +1,11 @@
<?php
define('APP_NAME', 'hyprcrd');
define('APP_VERSION', '1.9.29');
define('APP_VERSION', '2.0.0');
// APP_DEBUG: gates verbose error responses (curl traces, upstream bodies).
// Off by default; enable via env for local troubleshooting only.
define('APP_DEBUG', getenv('APP_DEBUG') === '1' || getenv('APP_DEBUG') === 'true');
// Database path — writable directory, outside webroot
// DB_PATH / UPLOAD_DIR can be pre-defined by the Electron router for app isolation
electron/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "hyprcrd",
"version": "1.9.29",
"version": "2.0.0",
"description": "hyprcrd — self-hosted card manager",
"main": "main.js",
"scripts": {
public/index.php
+132 -67
View File
@@ -55,6 +55,22 @@ if (str_starts_with($route, '/api/auth')) {
error_reporting(0);
header('Content-Type: application/json');
// IP-keyed rate limiter for auth endpoints — session cookies are trivial
// to rotate, so the in-session counter alone is bypassable.
$hyprcrdClientIp = $_SERVER['REMOTE_ADDR'] ?? '';
$db->exec("DELETE FROM login_attempts WHERE attempted_at < datetime('now', '-10 minutes')");
$hyprcrdIpRateLimited = function (string $endpoint, int $max, int $windowMinutes = 5) use ($db, $hyprcrdClientIp): bool {
if ($hyprcrdClientIp === '') return false;
$q = $db->prepare("SELECT COUNT(*) FROM login_attempts WHERE ip = :ip AND endpoint = :ep AND attempted_at > datetime('now', '-{$windowMinutes} minutes')");
$q->execute(['ip' => $hyprcrdClientIp, 'ep' => $endpoint]);
return (int)$q->fetchColumn() >= $max;
};
$hyprcrdRecordAttempt = function (string $endpoint) use ($db, $hyprcrdClientIp): void {
if ($hyprcrdClientIp === '') return;
$db->prepare('INSERT INTO login_attempts (ip, endpoint) VALUES (:ip, :ep)')
->execute(['ip' => $hyprcrdClientIp, 'ep' => $endpoint]);
};
// GET /api/auth/status
if ($route === '/api/auth/status' && $method === 'GET') {
echo json_encode(['setup' => $isSetup, 'logged_in' => $isLoggedIn, 'csrf' => $_SESSION['csrf_token'], 'version' => APP_VERSION]);
@@ -63,11 +79,20 @@ if (str_starts_with($route, '/api/auth')) {
// POST /api/auth/setup — set initial password
if ($route === '/api/auth/setup' && $method === 'POST' && $isSetup) {
// CSRF: same-origin + same-session guarantee. A drive-by POST from
// another site won't have the csrf cookie-bound token, so it can't
// silently claim a freshly-provisioned instance.
$csrfHeader = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
if (!hash_equals($_SESSION['csrf_token'] ?? '', $csrfHeader)) {
http_response_code(403);
echo json_encode(['error' => 'invalid csrf token']);
exit;
}
$input = json_decode(file_get_contents('php://input'), true);
$pw = $input['password'] ?? '';
if (strlen($pw) < 4) {
if (strlen($pw) < 10) {
http_response_code(400);
echo json_encode(['error' => 'password too short (min 4)']);
echo json_encode(['error' => 'password too short (min 10)']);
exit;
}
$hash = password_hash($pw, PASSWORD_BCRYPT);
@@ -79,13 +104,11 @@ if (str_starts_with($route, '/api/auth')) {
exit;
}
// POST /api/auth/login (rate limited)
// POST /api/auth/login (IP-keyed rate limit)
if ($route === '/api/auth/login' && $method === 'POST') {
$attempts = $_SESSION['login_attempts'] ?? 0;
$lastAttempt = $_SESSION['login_last'] ?? 0;
if ($attempts >= 5 && time() - $lastAttempt < 60) {
if ($hyprcrdIpRateLimited('login', 10, 5)) {
http_response_code(429);
echo json_encode(['error' => 'too many attempts, wait 60s']);
echo json_encode(['error' => 'too many attempts, try again later']);
exit;
}
$input = json_decode(file_get_contents('php://input'), true);
@@ -94,11 +117,9 @@ if (str_starts_with($route, '/api/auth')) {
session_regenerate_id(true);
$_SESSION['hyprcrd_auth'] = true;
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
$_SESSION['login_attempts'] = 0;
echo json_encode(['ok' => true, 'csrf' => $_SESSION['csrf_token']]);
} else {
$_SESSION['login_attempts'] = $attempts + 1;
$_SESSION['login_last'] = time();
$hyprcrdRecordAttempt('login');
usleep(300000); // 300ms delay against timing attacks
http_response_code(401);
echo json_encode(['error' => 'wrong password']);
@@ -159,18 +180,24 @@ if (str_starts_with($route, '/api/auth')) {
// POST /api/auth/password — change password (requires current password)
if ($route === '/api/auth/password' && $method === 'POST') {
if ($hyprcrdIpRateLimited('password', 10, 5)) {
http_response_code(429);
echo json_encode(['error' => 'too many attempts, try again later']);
exit;
}
$input = json_decode(file_get_contents('php://input'), true);
$current = $input['current'] ?? '';
$newPass = $input['new'] ?? '';
$hash = $db->query("SELECT value FROM settings WHERE key = 'password_hash'")->fetchColumn();
if (!password_verify($current, $hash)) {
$hyprcrdRecordAttempt('password');
http_response_code(403);
echo json_encode(['error' => 'wrong password']);
exit;
}
if (strlen($newPass) < 4) {
if (strlen($newPass) < 10) {
http_response_code(400);
echo json_encode(['error' => 'min 4 characters']);
echo json_encode(['error' => 'min 10 characters']);
exit;
}
$newHash = password_hash($newPass, PASSWORD_BCRYPT);
@@ -752,21 +779,37 @@ if (str_starts_with($route, '/api/')) {
}
}
// Extract uploads
// Extract uploads. Guard against zip bombs and malicious payloads:
// per-file 25MB cap, 500MB total, whitelist allowed extensions (same
// set as the live /api/upload endpoint), never overwrite existing
// files, never leak paths via traversal.
$uploadDir = UPLOAD_DIR;
if (!is_dir($uploadDir)) mkdir($uploadDir, 0777, true);
$allowedExts = ['png', 'jpg', 'jpeg', 'gif', 'webp', 'mp3', 'ogg', 'wav', 'm4a', 'pdf'];
$perFileMax = 25 * 1024 * 1024; // 25 MB
$totalMax = 500 * 1024 * 1024; // 500 MB
$totalWritten = 0;
$skipped = [];
for ($i = 0; $i < $zip->numFiles; $i++) {
$name = $zip->getNameIndex($i);
if (str_starts_with($name, 'uploads/') && $name !== 'uploads/') {
$content = $zip->getFromIndex($i);
if ($content !== false) {
file_put_contents($uploadDir . '/' . basename($name), $content);
}
}
if (!str_starts_with($name, 'uploads/') || $name === 'uploads/') continue;
$base = basename($name);
$ext = strtolower(pathinfo($base, PATHINFO_EXTENSION));
if (!in_array($ext, $allowedExts, true)) { $skipped[] = $base; continue; }
$stat = $zip->statIndex($i);
if ($stat && isset($stat['size']) && $stat['size'] > $perFileMax) { $skipped[] = $base; continue; }
if ($totalWritten + (int)($stat['size'] ?? 0) > $totalMax) { $skipped[] = $base; continue; }
$dest = $uploadDir . '/' . $base;
if (file_exists($dest)) { $skipped[] = $base; continue; }
$content = $zip->getFromIndex($i);
if ($content === false) continue;
if (strlen($content) > $perFileMax) { $skipped[] = $base; continue; }
file_put_contents($dest, $content);
$totalWritten += strlen($content);
}
$zip->close();
echo json_encode(['ok' => true, 'buckets' => count($data['buckets']), 'cards' => count($data['cards'])]);
echo json_encode(['ok' => true, 'buckets' => count($data['buckets']), 'cards' => count($data['cards']), 'skipped_files' => count($skipped)]);
exit;
}
@@ -793,18 +836,27 @@ if (str_starts_with($route, '/api/')) {
$url = $db->query("SELECT value FROM settings WHERE key = 'relay_url'")->fetchColumn() ?: '';
$username = $db->query("SELECT value FROM settings WHERE key = 'relay_username'")->fetchColumn() ?: '';
$key = $db->query("SELECT value FROM settings WHERE key = 'relay_key'")->fetchColumn() ?: '';
// Single-user local app — echo the stored secret back so the user can
// see and edit it directly without guessing if it's still saved.
echo json_encode(['url' => $url, 'username' => $username, 'key' => $key]); exit;
// Never echo the plaintext secret to the client — if it leaks via XSS
// or a compromised session, the attacker can decrypt all relay traffic.
// The UI just needs to know whether a secret is set.
echo json_encode(['url' => $url, 'username' => $username, 'has_key' => !empty($key)]); exit;
}
if ($route === '/api/relay/settings' && $method === 'POST') {
$input = json_decode(file_get_contents('php://input'), true);
if (isset($input['url'])) $db->prepare("INSERT OR REPLACE INTO settings (key, value) VALUES ('relay_url', :v)")->execute(['v' => $input['url']]);
if (isset($input['username'])) $db->prepare("INSERT OR REPLACE INTO settings (key, value) VALUES ('relay_username', :v)")->execute(['v' => $input['username']]);
// Always overwrite key when present (even empty) — single-user local
// app, the input is now pre-populated so an empty submit is intentional
if (array_key_exists('key', $input)) $db->prepare("INSERT OR REPLACE INTO settings (key, value) VALUES ('relay_key', :v)")->execute(['v' => $input['key']]);
// The UI no longer receives the stored secret, so empty strings are
// just "field untouched" and we only write when the user types a new
// value. An explicit null clears the secret for users who need it.
if (array_key_exists('key', $input)) {
$newKey = $input['key'];
if ($newKey === null) {
$db->prepare("DELETE FROM settings WHERE key = 'relay_key'")->execute();
} elseif (is_string($newKey) && $newKey !== '') {
$db->prepare("INSERT OR REPLACE INTO settings (key, value) VALUES ('relay_key', :v)")->execute(['v' => $newKey]);
}
}
echo json_encode(['ok' => true]); exit;
}
@@ -831,6 +883,7 @@ if (str_starts_with($route, '/api/')) {
CURLOPT_HTTPHEADER => ['X-Relay-User: ' . $relayUser, 'X-Relay-Key: ' . $relayKey],
CURLOPT_TIMEOUT => 10,
]);
hyprcrdApplySafeCurlOpts($ch);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
@@ -851,13 +904,15 @@ if (str_starts_with($route, '/api/')) {
if (!is_array($messages)) { echo json_encode(['ok' => false, 'error' => 'invalid response']); exit; }
$pulled = 0;
$encKey = substr(hash('sha256', $relayKey), 0, 32);
$decryptField = function($text) use ($encKey) {
if (!str_starts_with($text, 'HYPRCRD-RELAY-V1')) return $text;
$raw = base64_decode(trim(explode("\n", $text, 2)[1] ?? ''));
if (strlen($raw) < 17) return $text;
$plain = openssl_decrypt(substr($raw, 16), 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, substr($raw, 0, 16));
return $plain !== false ? $plain : $text;
$decryptField = function($text) use ($relayKey) {
$decoded = hyprcrdRelayDecrypt($text, $relayKey);
// Dual-format decrypt returns '' only when a magic-prefixed
// envelope failed to decrypt — surface the original string in
// that case so the UI still shows something useful.
if ($decoded === '' && (str_starts_with($text, HYPRCRD_RELAY_GCM_MAGIC) || str_starts_with($text, HYPRCRD_RELAY_CBC_MAGIC))) {
return $text;
}
return $decoded;
};
// Load IDs we pushed ourselves
@@ -920,6 +975,7 @@ if (str_starts_with($route, '/api/')) {
],
CURLOPT_TIMEOUT => 5,
]);
hyprcrdApplySafeCurlOpts($bch);
$bRes = curl_exec($bch);
$bStat = curl_getinfo($bch, CURLINFO_HTTP_CODE);
curl_close($bch);
@@ -936,6 +992,7 @@ if (str_starts_with($route, '/api/')) {
CURLOPT_HTTPHEADER => ['X-Relay-User: ' . $relayUser, 'X-Relay-Key: ' . $relayKey],
CURLOPT_TIMEOUT => 30,
]);
hyprcrdApplySafeCurlOpts($ach);
$attResponse = curl_exec($ach);
$attStatus = curl_getinfo($ach, CURLINFO_HTTP_CODE);
curl_close($ach);
@@ -949,23 +1006,28 @@ if (str_starts_with($route, '/api/')) {
if (!preg_match('/^[a-f0-9]+\.\w+$/', $fn)) continue;
$dest = $uploadDir . '/' . $fn;
if (file_exists($dest)) continue;
// New format: HYPRCRD-RELAY-V1 envelope (decrypt-reencrypted by relay)
// Old format: raw base64(iv || cipher)
// Dual-format: GCM-V2 envelope (v1.10+) and legacy
// CBC-V1 envelope; plaintext inside is base64(file
// bytes). Very-old pre-envelope format was raw
// base64(iv || cipher) — unlikely at this point but
// cheap to keep as a last-resort fallback.
$payload = $att['data'] ?? '';
if (str_starts_with($payload, 'HYPRCRD-RELAY-V1')) {
$b64 = trim(substr($payload, strlen('HYPRCRD-RELAY-V1') + 1));
$raw = base64_decode($b64);
$decrypted = false;
if (str_starts_with($payload, HYPRCRD_RELAY_GCM_MAGIC) || str_starts_with($payload, HYPRCRD_RELAY_CBC_MAGIC)) {
$plain = hyprcrdRelayDecrypt($payload, $relayKey);
if ($plain !== '') $decrypted = $plain;
} else {
$legacyKey = substr(hash('sha256', $relayKey), 0, 32);
$raw = base64_decode($payload);
}
if (strlen($raw) >= 17) {
$decrypted = openssl_decrypt(substr($raw, 16), 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, substr($raw, 0, 16));
if ($decrypted !== false) {
$fileBytes = base64_decode($decrypted);
if ($fileBytes !== false) $decrypted = $fileBytes;
file_put_contents($dest, $decrypted);
if ($raw !== false && strlen($raw) >= 17) {
$decrypted = openssl_decrypt(substr($raw, 16), 'aes-256-cbc', $legacyKey, OPENSSL_RAW_DATA, substr($raw, 0, 16));
}
}
if ($decrypted !== false) {
$fileBytes = base64_decode($decrypted);
if ($fileBytes !== false) $decrypted = $fileBytes;
file_put_contents($dest, $decrypted);
}
}
}
}
@@ -982,6 +1044,7 @@ if (str_starts_with($route, '/api/')) {
CURLOPT_HTTPHEADER => ['X-Relay-User: ' . $relayUser, 'X-Relay-Key: ' . $relayKey],
CURLOPT_TIMEOUT => 5,
]);
hyprcrdApplySafeCurlOpts($sch);
$sResp = curl_exec($sch);
$sStatus = curl_getinfo($sch, CURLINFO_HTTP_CODE);
curl_close($sch);
@@ -1015,6 +1078,7 @@ if (str_starts_with($route, '/api/')) {
CURLOPT_HTTPHEADER => ['X-Relay-User: ' . $relayUser, 'X-Relay-Key: ' . $relayKey],
CURLOPT_TIMEOUT => 10,
]);
hyprcrdApplySafeCurlOpts($ch);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
@@ -1054,12 +1118,7 @@ if (str_starts_with($route, '/api/')) {
$db->prepare('UPDATE cards SET relay_uid = ? WHERE id = ?')->execute([$relayUid, $cardId]);
}
$encKey = substr(hash('sha256', $relayKey), 0, 32);
$encryptField = function($text) use ($encKey) {
$iv = random_bytes(16);
$cipher = openssl_encrypt($text, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv);
return "HYPRCRD-RELAY-V1\n" . base64_encode($iv . $cipher);
};
$encryptField = fn($text) => hyprcrdRelayEncrypt((string)$text, $relayKey);
$payloadData = [
'title' => $encryptField($card['title'] ?? ''),
@@ -1072,21 +1131,27 @@ if (str_starts_with($route, '/api/')) {
$payload = json_encode($payloadData);
$ch = curl_init(rtrim($relayUrl, '/') . '/api/messages');
$debugStream = fopen('php://temp', 'w+');
$debugStream = APP_DEBUG ? fopen('php://temp', 'w+') : null;
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => $payload,
CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'X-Relay-User: ' . $relayUser, 'X-Relay-Key: ' . $relayKey],
CURLOPT_TIMEOUT => 10,
CURLOPT_VERBOSE => true,
CURLOPT_STDERR => $debugStream,
]);
hyprcrdApplySafeCurlOpts($ch);
if ($debugStream) {
curl_setopt($ch, CURLOPT_VERBOSE, true);
curl_setopt($ch, CURLOPT_STDERR, $debugStream);
}
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
rewind($debugStream);
$curlDebug = stream_get_contents($debugStream);
fclose($debugStream);
$curlDebug = '';
if ($debugStream) {
rewind($debugStream);
$curlDebug = stream_get_contents($debugStream);
fclose($debugStream);
}
curl_close($ch);
if ($status === 200 || $status === 201) {
@@ -1121,6 +1186,7 @@ if (str_starts_with($route, '/api/')) {
CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'X-Relay-User: ' . $relayUser, 'X-Relay-Key: ' . $relayKey],
CURLOPT_TIMEOUT => 30,
]);
hyprcrdApplySafeCurlOpts($ach);
curl_exec($ach);
curl_close($ach);
}
@@ -1135,16 +1201,15 @@ if (str_starts_with($route, '/api/')) {
} elseif (is_string($response) && $response !== '') {
$relayMsg = ' — ' . substr($response, 0, 200);
}
// Strip the X-Relay-Key value from the debug log so we don't leak the secret
$safeDebug = preg_replace('/(X-Relay-Key:\s*)[^\r\n]+/i', '$1<redacted>', $curlDebug);
echo json_encode([
'ok' => false,
'error' => "relay returned HTTP $status$relayMsg",
'sent_username' => $relayUser,
'relay_url' => rtrim($relayUrl, '/') . '/api/messages',
'response_body' => is_string($response) ? substr($response, 0, 500) : null,
'curl_debug' => $safeDebug,
]);
// In production, don't leak upstream URL / raw bodies / curl traces —
// APP_DEBUG=1 re-enables them for local troubleshooting.
$out = ['ok' => false, 'error' => "relay returned HTTP $status$relayMsg", 'sent_username' => $relayUser];
if (APP_DEBUG) {
$out['relay_url'] = rtrim($relayUrl, '/') . '/api/messages';
$out['response_body'] = is_string($response) ? substr($response, 0, 500) : null;
$out['curl_debug'] = preg_replace('/(X-Relay-Key:\s*)[^\r\n]+/i', '$1<redacted>', $curlDebug);
}
echo json_encode($out);
exit;
}
public/js/app.js
+4 -4
View File
@@ -194,11 +194,11 @@ async function checkAuth() {
if (data.setup) {
let pw = null;
while (!pw || pw.length < 4) {
pw = await showDialog({ title: 'setup', message: 'Welcome to hyprcrd. Set a password:', input: 'password', placeholder: '> password (min. 4 chars)...', okLabel: 'Set', cancelLabel: '' });
if (pw && pw.length < 4) pw = null;
while (!pw || pw.length < 10) {
pw = await showDialog({ title: 'setup', message: 'Welcome to hyprcrd. Set a password:', input: 'password', placeholder: '> password (min. 10 chars)...', okLabel: 'Set', cancelLabel: '' });
if (pw && pw.length < 10) pw = null;
}
const r = await fetch('api/auth/setup', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ password: pw }) });
const r = await fetch('api/auth/setup', { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': data.csrf || '' }, body: JSON.stringify({ password: pw }) });
const d = await r.json();
if (d.error) { location.reload(); return; }
if (d.csrf) { setCsrf(d.csrf); window.hyprcrd?.util?.setCsrf?.(d.csrf); }
public/js/modules/sync.js
+5 -2
View File
@@ -321,8 +321,11 @@ export async function loadRelaySettings() {
if (urlInput) urlInput.value = s.url || '';
if (userInput) userInput.value = s.username || '';
if (keyInput) {
keyInput.value = s.key || '';
keyInput.placeholder = 'shared secret';
// The server no longer echoes the stored secret. Leave the field
// blank; placeholder tells the user whether one is set. An empty
// save is treated as "field untouched" server-side.
keyInput.value = '';
keyInput.placeholder = s.has_key ? '•••••••• (saved — type to change)' : 'shared secret';
}
// Sync-interval slider lives in the Relay panel but drives every
// poller. Snap points span 5s..1h; live label updates on drag,
public/js/modules/theme.js
+1 -1
View File
@@ -411,7 +411,7 @@ $('settings-pw-save')?.addEventListener('click', async () => {
if (!current || !newPw) { if (status) { status.textContent = 'fill all fields'; status.style.color = 'var(--t-danger)'; } return; }
if (newPw !== confirm) { if (status) { status.textContent = 'passwords do not match'; status.style.color = 'var(--t-danger)'; } return; }
if (newPw.length < 4) { if (status) { status.textContent = 'min 4 characters'; status.style.color = 'var(--t-danger)'; } return; }
if (newPw.length < 10) { if (status) { status.textContent = 'min 10 characters'; status.style.color = 'var(--t-danger)'; } return; }
const res = await fetch('api/auth/password', {
method: 'POST',
public/plugins/bookmarks/backend.php
+21 -6
View File
@@ -20,6 +20,17 @@ PluginManager::instance()->onApiRoute(function (string $route, string $method) {
echo json_encode(['error' => 'valid url required']);
exit;
}
$scheme = strtolower((string)parse_url($url, PHP_URL_SCHEME));
if ($scheme !== 'http' && $scheme !== 'https') {
http_response_code(400);
echo json_encode(['error' => 'only http/https URLs allowed']);
exit;
}
if (!hyprcrdUrlHostIsPublic($url)) {
http_response_code(400);
echo json_encode(['error' => 'URL host is not publicly reachable']);
exit;
}
$ch = curl_init($url);
curl_setopt_array($ch, [
@@ -30,6 +41,7 @@ PluginManager::instance()->onApiRoute(function (string $route, string $method) {
CURLOPT_USERAGENT => 'Mozilla/5.0 (compatible; hyprcrd-bookmarks/1.0)',
CURLOPT_SSL_VERIFYPEER => true,
]);
hyprcrdApplySafeCurlOpts($ch);
$html = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$finalUrl = curl_getinfo($ch, CURLINFO_EFFECTIVE_URL) ?: $url;
@@ -63,18 +75,21 @@ PluginManager::instance()->onApiRoute(function (string $route, string $method) {
}
$faviconData = '';
$ch2 = curl_init($faviconUrl);
curl_setopt_array($ch2, [
$faviconScheme = strtolower((string)parse_url($faviconUrl, PHP_URL_SCHEME));
$favCh = ($faviconScheme === 'http' || $faviconScheme === 'https') && hyprcrdUrlHostIsPublic($faviconUrl);
$ch2 = $favCh ? curl_init($faviconUrl) : null;
if ($ch2) curl_setopt_array($ch2, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_MAXREDIRS => 3,
CURLOPT_TIMEOUT => 5,
CURLOPT_USERAGENT => 'Mozilla/5.0 (compatible; hyprcrd-bookmarks/1.0)',
]);
$favBytes = curl_exec($ch2);
$favStatus = curl_getinfo($ch2, CURLINFO_HTTP_CODE);
$favMime = curl_getinfo($ch2, CURLINFO_CONTENT_TYPE) ?: 'image/x-icon';
curl_close($ch2);
if ($ch2) hyprcrdApplySafeCurlOpts($ch2);
$favBytes = $ch2 ? curl_exec($ch2) : false;
$favStatus = $ch2 ? curl_getinfo($ch2, CURLINFO_HTTP_CODE) : 0;
$favMime = $ch2 ? (curl_getinfo($ch2, CURLINFO_CONTENT_TYPE) ?: 'image/x-icon') : 'image/x-icon';
if ($ch2) curl_close($ch2);
if ($favBytes && $favStatus >= 200 && $favStatus < 400 && strlen($favBytes) <= 32768) {
$mime = preg_replace('/;.*$/', '', $favMime);
public/plugins/chat/backend.php
+10 -14
View File
@@ -108,24 +108,20 @@ function chatRelaySettings(): array {
];
}
/** Same envelope format as the existing relay sync (HYPRCRD-RELAY-V1). */
/** Dual-format envelope shared with the relay sync path. Writes V2
* (AES-GCM + HKDF), reads V2 + legacy V1 (CBC). Delegates to the central
* helpers so the format stays in lock-step with src/bootstrap.php and
* the relay's crypto.php. */
function chatEncrypt(string $plain, string $relayKey): string {
$encKey = substr(hash('sha256', $relayKey), 0, 32);
$iv = random_bytes(16);
$cipher = openssl_encrypt($plain, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv);
return "HYPRCRD-RELAY-V1\n" . base64_encode($iv . $cipher);
return hyprcrdRelayEncrypt($plain, $relayKey);
}
function chatDecrypt(string $envelope, string $relayKey): string {
if (!str_starts_with($envelope, 'HYPRCRD-RELAY-V1')) return '';
$b64 = trim(substr($envelope, strlen('HYPRCRD-RELAY-V1') + 1));
$raw = base64_decode($b64);
if (!$raw || strlen($raw) < 17) return '';
$encKey = substr(hash('sha256', $relayKey), 0, 32);
$iv = substr($raw, 0, 16);
$cipher = substr($raw, 16);
$result = openssl_decrypt($cipher, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv);
return $result !== false ? $result : '';
// Old behaviour returned '' for non-envelope strings; preserve that.
if (!str_starts_with($envelope, HYPRCRD_RELAY_GCM_MAGIC) && !str_starts_with($envelope, HYPRCRD_RELAY_CBC_MAGIC)) {
return '';
}
return hyprcrdRelayDecrypt($envelope, $relayKey);
}
function chatGetState(string $key, $default = null) {
public/plugins/collab-buckets/backend.php
+8 -16
View File
@@ -110,32 +110,24 @@
");
})();
/** Encrypt a JSON payload with the local relay_key using the same envelope
* format the rest of hyprcrd uses (HYPRCRD-RELAY-V1). */
/** Encrypt a JSON payload with the local relay_key using the shared
* dual-format envelope (GCM-V2 writes, V1 read-only fallback lives in
* hyprcrdRelayDecrypt). */
function collabEncryptPayload(array $fields): ?string {
$key = collabRelaySettings()['key'] ?? '';
if ($key === '') return null;
$encKey = substr(hash('sha256', $key), 0, 32);
$plain = json_encode($fields);
$iv = random_bytes(16);
$cipher = openssl_encrypt($plain, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv);
if ($cipher === false) return null;
return "HYPRCRD-RELAY-V1\n" . base64_encode($iv . $cipher);
if ($plain === false) return null;
return hyprcrdRelayEncrypt($plain, $key);
}
/** Decrypt the inverse. Returns an associative array, or null on failure. */
function collabDecryptPayload(string $envelope): ?array {
if (!str_starts_with($envelope, 'HYPRCRD-RELAY-V1')) return null;
$b64 = trim(substr($envelope, strlen('HYPRCRD-RELAY-V1') + 1));
$raw = base64_decode($b64);
if (!$raw || strlen($raw) < 17) return null;
if (!str_starts_with($envelope, HYPRCRD_RELAY_GCM_MAGIC) && !str_starts_with($envelope, HYPRCRD_RELAY_CBC_MAGIC)) return null;
$key = collabRelaySettings()['key'] ?? '';
if ($key === '') return null;
$encKey = substr(hash('sha256', $key), 0, 32);
$iv = substr($raw, 0, 16);
$cipher = substr($raw, 16);
$plain = openssl_decrypt($cipher, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv);
if ($plain === false) return null;
$plain = hyprcrdRelayDecrypt($envelope, $key);
if ($plain === '') return null;
$data = json_decode($plain, true);
return is_array($data) ? $data : null;
}
public/plugins/tests/relay.test.js
+6 -4
View File
@@ -3,8 +3,10 @@ import { describe, it, expect, csrf } from './runner.js?v=4';
describe('Relay: Push API', () => {
it('push without config returns error', async () => {
const settings = await fetch('api/relay/settings').then(r => r.json());
// The GET endpoint echoes the secret directly as `key` (single-user local app).
if (settings.url && settings.key) return; // skip if configured
// GET only reports `has_key` (boolean) — the secret itself is never
// echoed. If a relay is configured the real push may succeed or fail
// for other reasons, so skip in that case.
if (settings.url && settings.has_key) return; // skip if configured
const res = await fetch('api/relay/push', {
method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
@@ -16,7 +18,7 @@ describe('Relay: Push API', () => {
it('push without card_id returns error', async () => {
const settings = await fetch('api/relay/settings').then(r => r.json());
if (!settings.url || !settings.key) return; // card_id check is after config check
if (!settings.url || !settings.has_key) return; // card_id check is after config check
const res = await fetch('api/relay/push', {
method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
body: JSON.stringify({}),
@@ -28,7 +30,7 @@ describe('Relay: Push API', () => {
describe('Relay: Poll API', () => {
it('poll without config returns 0 pulled', async () => {
const settings = await fetch('api/relay/settings').then(r => r.json());
if (settings.url && settings.key) return;
if (settings.url && settings.has_key) return;
const res = await fetch('api/relay/poll', {
method: 'POST', headers: { 'X-CSRF-Token': csrf() },
relay/inc/bootstrap.php
+28
View File
@@ -395,6 +395,34 @@ $db->exec('CREATE TABLE IF NOT EXISTS rate_limits (
attempted_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
)');
// ── v3.x → v1.10 crypto migration ────────────────────────────────
// Re-encrypt master-wrapped secrets (tenant client secrets + inter-tenant
// key) from CBC-V1 to GCM-V2. This only touches data we already hold the
// master key for, so no user action is needed and no secrets change —
// only the envelope around them. Idempotent: rows already in V2 skip.
require_once __DIR__ . '/crypto.php';
if (tableExists($db, 'tenants')) {
$legacyTenantRows = $db->query("SELECT id, secret_encrypted FROM tenants WHERE secret_encrypted IS NOT NULL AND secret_encrypted != '' AND secret_encrypted NOT LIKE '" . HYPRCRD_GCM_MAGIC_MASTER . "%'")->fetchAll();
if ($legacyTenantRows) {
$upd = $db->prepare('UPDATE tenants SET secret_encrypted = :s WHERE id = :i');
foreach ($legacyTenantRows as $r) {
$plain = masterDecrypt($r['secret_encrypted'], $MASTER_KEY);
if ($plain !== '') {
$upd->execute(['s' => masterEncrypt($plain, $MASTER_KEY), 'i' => $r['id']]);
}
}
@error_log('[hyprcrd-relay] migrated ' . count($legacyTenantRows) . ' tenant secret_encrypted rows to GCM-V2');
}
$legacyItk = $db->query("SELECT value FROM settings WHERE key = 'inter_tenant_key'")->fetchColumn();
if ($legacyItk && !str_starts_with($legacyItk, HYPRCRD_GCM_MAGIC_MASTER)) {
$plainItk = masterDecrypt($legacyItk, $MASTER_KEY);
if ($plainItk !== '') {
setInterTenantKey($db, $MASTER_KEY, $plainItk);
@error_log('[hyprcrd-relay] migrated inter-tenant key to GCM-V2');
}
}
}
// Cleanup: 24h ephemeral storage, expired sessions, old rate limits
$db->exec("DELETE FROM messages WHERE created_at < datetime('now', '-24 hours')");
$db->exec("DELETE FROM attachments WHERE created_at < datetime('now', '-24 hours')");
relay/inc/crypto.php
+77 -27
View File
@@ -1,24 +1,54 @@
<?php
// Crypto helpers: at-rest encryption with master key, plus the
// HYPRCRD-RELAY-V1 envelope format used by both the JS client and
// the relay's internal re-encryption hops.
// Crypto helpers.
//
// Two envelope formats coexist during the v1.10 rollout:
//
// HYPRCRD-GCM-V2 — new: AES-256-GCM, per-ciphertext random salt + HKDF
// (authenticated, standard). Used for every new write.
// HYPRCRD-RELAY-V1 — legacy: AES-256-CBC, substr(hex(sha256(secret))) as a
// 32-byte ASCII key, no MAC. Dual-read only.
//
// For at-rest master-key encryption the legacy format carries no magic
// prefix (raw base64(iv || cipher)). The new format uses HYPRCRD-MGCM-V2.
//
// Same user secret works across both formats — only the KDF and cipher
// differ. Old data stays readable forever via the V1 fallback; new data
// is authenticated and cannot be silently mutated.
if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
const HYPRCRD_GCM_MAGIC_CLIENT = 'HYPRCRD-GCM-V2';
const HYPRCRD_CBC_MAGIC_CLIENT = 'HYPRCRD-RELAY-V1';
const HYPRCRD_GCM_MAGIC_MASTER = 'HYPRCRD-MGCM-V2';
const HYPRCRD_HKDF_INFO_CLIENT = 'hyprcrd-relay-client-v2';
/**
* Encrypt a value at-rest with the master key. Used for tenant secrets
* and the inter-tenant key in the DB.
* Encrypt a value at-rest with the master key. The master key is already
* cryptographically random (32 raw bytes), so no KDF stretching is needed —
* a fresh 12-byte nonce per ciphertext is enough for GCM.
*/
function masterEncrypt(string $plain, string $masterKeyHex): string {
$key = hex2bin($masterKeyHex);
$iv = random_bytes(16);
$cipher = openssl_encrypt($plain, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
return base64_encode($iv . $cipher);
$nonce = random_bytes(12);
$tag = '';
$cipher = openssl_encrypt($plain, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag, '', 16);
return HYPRCRD_GCM_MAGIC_MASTER . "\n" . base64_encode($nonce . $cipher . $tag);
}
function masterDecrypt(string $encoded, string $masterKeyHex): string {
$key = hex2bin($masterKeyHex);
$raw = base64_decode($encoded);
if (str_starts_with($encoded, HYPRCRD_GCM_MAGIC_MASTER)) {
$b64 = trim(substr($encoded, strlen(HYPRCRD_GCM_MAGIC_MASTER) + 1));
$raw = base64_decode($b64, true);
if (!$raw || strlen($raw) < 12 + 16 + 1) return '';
$nonce = substr($raw, 0, 12);
$tag = substr($raw, -16);
$cipher = substr($raw, 12, -16);
$plain = openssl_decrypt($cipher, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag);
return $plain !== false ? $plain : '';
}
// Legacy: base64(iv(16) || ciphertext) under AES-256-CBC, no prefix.
$raw = base64_decode($encoded, true);
if (!$raw || strlen($raw) < 17) return '';
$iv = substr($raw, 0, 16);
$cipher = substr($raw, 16);
@@ -26,27 +56,48 @@ function masterDecrypt(string $encoded, string $masterKeyHex): string {
}
/**
* Match the JS client's encryption format exactly:
* key = first 32 chars of hex(SHA-256(secret)) used as 32-byte ASCII key
* envelope = "HYPRCRD-RELAY-V1\n" + base64(iv || ciphertext)
* Encrypt with a user-chosen secret (client API "shared secret" and the
* relay-wide inter-tenant key). V2 format:
* magic "\n" base64( salt(16) || nonce(12) || ciphertext || tag(16) )
* Per-ciphertext salt feeds HKDF(SHA-256) to derive a fresh 32-byte subkey
* — defeats the weak legacy substr-of-hex KDF and removes cross-tenant
* key collisions for identical secrets.
*/
function clientEncrypt(string $plain, string $secret): string {
$key = substr(hash('sha256', $secret), 0, 32);
$iv = random_bytes(16);
$cipher = openssl_encrypt($plain, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
return "HYPRCRD-RELAY-V1\n" . base64_encode($iv . $cipher);
$salt = random_bytes(16);
$nonce = random_bytes(12);
$key = hash_hkdf('sha256', $secret, 32, HYPRCRD_HKDF_INFO_CLIENT, $salt);
$tag = '';
$cipher = openssl_encrypt($plain, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag, '', 16);
return HYPRCRD_GCM_MAGIC_CLIENT . "\n" . base64_encode($salt . $nonce . $cipher . $tag);
}
function clientDecrypt(string $envelope, string $secret): string {
if (!str_starts_with($envelope, 'HYPRCRD-RELAY-V1')) return $envelope;
$b64 = trim(substr($envelope, strlen('HYPRCRD-RELAY-V1') + 1));
$raw = base64_decode($b64);
if (!$raw || strlen($raw) < 17) return '';
$key = substr(hash('sha256', $secret), 0, 32);
$iv = substr($raw, 0, 16);
$cipher = substr($raw, 16);
$result = openssl_decrypt($cipher, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
return $result !== false ? $result : '';
if (str_starts_with($envelope, HYPRCRD_GCM_MAGIC_CLIENT)) {
$b64 = trim(substr($envelope, strlen(HYPRCRD_GCM_MAGIC_CLIENT) + 1));
$raw = base64_decode($b64, true);
if (!$raw || strlen($raw) < 16 + 12 + 16 + 1) return '';
$salt = substr($raw, 0, 16);
$nonce = substr($raw, 16, 12);
$tag = substr($raw, -16);
$cipher = substr($raw, 28, -16);
$key = hash_hkdf('sha256', $secret, 32, HYPRCRD_HKDF_INFO_CLIENT, $salt);
$plain = openssl_decrypt($cipher, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag);
return $plain !== false ? $plain : '';
}
if (str_starts_with($envelope, HYPRCRD_CBC_MAGIC_CLIENT)) {
$b64 = trim(substr($envelope, strlen(HYPRCRD_CBC_MAGIC_CLIENT) + 1));
$raw = base64_decode($b64, true);
if (!$raw || strlen($raw) < 17) return '';
$key = substr(hash('sha256', $secret), 0, 32);
$iv = substr($raw, 0, 16);
$cipher = substr($raw, 16);
$result = openssl_decrypt($cipher, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
return $result !== false ? $result : '';
}
// Neither envelope — passthrough. Preserves the old behaviour where
// already-plaintext fields flowed through unchanged.
return $envelope;
}
/**
@@ -54,8 +105,7 @@ function clientDecrypt(string $envelope, string $secret): string {
* during initial setup (it's the third field in the setup form). Used to
* re-encrypt messages at rest so they can be routed between tenants.
*
* Returns null if not set yet (e.g. legacy v2 installs that haven't been
* upgraded through the new setup wizard).
* Returns null if not set yet.
*/
function getInterTenantKey(PDO $db, string $masterKey): ?string {
$stored = $db->query("SELECT value FROM settings WHERE key = 'inter_tenant_key'")->fetchColumn();
relay/inc/routes/account.php
+4 -1
View File
@@ -52,11 +52,14 @@ if ($route === '/api/account/secret' && $method === 'DELETE') {
if ($route === '/api/account/password' && $method === 'POST') {
if (!$sessionTenant) jsonResponse(['error' => 'not logged in'], 401);
// Rate-limit password changes — a stolen session cookie could otherwise
// brute-force the `current` field server-side with no friction.
if (isRateLimited($db, 'account-password', 10)) jsonResponse(['error' => 'too many attempts'], 429);
$input = json_decode(file_get_contents('php://input'), true) ?: [];
$current = (string)($input['current'] ?? '');
$new = (string)($input['new'] ?? '');
if (strlen($new) < 4) jsonResponse(['error' => 'new password must be at least 4 chars'], 400);
if (strlen($new) < 10) jsonResponse(['error' => 'new password must be at least 10 chars'], 400);
if (!password_verify($current, $sessionTenant['password_hash'])) {
jsonResponse(['error' => 'current password is wrong'], 401);
}
relay/inc/routes/admin.php
+2 -2
View File
@@ -28,7 +28,7 @@ if ($route === '/api/users' && $method === 'POST') {
if (!preg_match('/^[a-zA-Z0-9_-]{2,32}$/', $username)) {
jsonResponse(['error' => 'username must be 2-32 chars: letters, digits, _ or -'], 400);
}
if (strlen($password) < 4) jsonResponse(['error' => 'password must be at least 4 chars'], 400);
if (strlen($password) < 10) jsonResponse(['error' => 'password must be at least 10 chars'], 400);
if (getTenantByUsername($db, $username)) jsonResponse(['error' => 'username already exists'], 409);
// No client secret — the new user sets that themselves after first login
@@ -53,7 +53,7 @@ if (preg_match('#^/api/users/(\d+)$#', $route, $m) && $method === 'PATCH') {
$input = json_decode(file_get_contents('php://input'), true) ?: [];
$fields = []; $params = ['id' => $id];
if (!empty($input['password'])) {
if (strlen($input['password']) < 4) jsonResponse(['error' => 'password too short'], 400);
if (strlen($input['password']) < 10) jsonResponse(['error' => 'password must be at least 10 chars'], 400);
$fields[] = 'password_hash = :pw';
$params['pw'] = password_hash($input['password'], PASSWORD_BCRYPT);
}
relay/inc/routes/chat.php
+6 -5
View File
@@ -93,7 +93,7 @@ if ($route === '/api/chat/send' && $method === 'POST' && $sessionTenant) {
if ($body === '') jsonResponse(['error' => 'body required'], 400);
if ($recipientName === '') jsonResponse(['error' => 'recipient required'], 400);
$recipient = getTenantByUsername($db, $recipientName);
if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
$interKey = getInterTenantKey($db, $MASTER_KEY);
if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
$stored = clientEncrypt($body, $interKey);
@@ -122,7 +122,7 @@ if ($route === '/api/sync-events' && $method === 'POST') {
if ($recipientName === '') jsonResponse(['error' => 'recipient required'], 400);
if ($recipientName === $clientTenant['username']) jsonResponse(['ok' => true, 'id' => 0]); // suppress self-notifications
$recipient = getTenantByUsername($db, $recipientName);
if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
$db->prepare('INSERT INTO relay_sync_events (recipient_id, sender_username, body) VALUES (:r, :sn, :b)')
->execute(['r' => $recipient['id'], 'sn' => $clientTenant['username'], 'b' => $body]);
jsonResponse(['ok' => true, 'id' => (int)$db->lastInsertId()]);
@@ -193,7 +193,8 @@ if ($route === '/api/chat/rooms' && $method === 'POST') {
$db->commit();
} catch (Throwable $e) {
if ($db->inTransaction()) $db->rollBack();
jsonResponse(['error' => 'create failed: ' . $e->getMessage()], 500);
@error_log('[hyprcrd-relay] chat room create failed: ' . $e->getMessage());
jsonResponse(['error' => 'create failed'], 500);
}
jsonResponse(['ok' => true, 'uid' => $uid, 'members' => array_values($resolved)]);
}
@@ -306,7 +307,7 @@ if ($route === '/api/chat' && $method === 'POST') {
->execute(['me' => $clientTenant['id'], 's' => $clientTenant['id'], 'sn' => $clientTenant['username'], 'ru' => $roomUid, 'b' => $stored]);
} else {
$recipient = getTenantByUsername($db, $recipientName);
if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
$db->prepare('INSERT INTO chat_messages (recipient_id, sender_id, sender_username, body, persistent) VALUES (:r, :s, :sn, :b, :p)')
->execute([
'r' => $recipient['id'],
@@ -417,7 +418,7 @@ if ($route === '/api/chat/backfill' && $method === 'GET') {
$stmt->execute();
} else {
$peerTenant = getTenantByUsername($db, $peer);
if (!$peerTenant) jsonResponse(['error' => "no such user: $peer"], 404);
if (!$peerTenant) jsonResponse(['error' => 'peer not found'], 404);
$sql = "SELECT id, sender_id, sender_username, room_uid, body, created_at
FROM chat_messages
WHERE room_uid IS NULL
relay/inc/routes/collab-buckets.php
+3 -2
View File
@@ -50,7 +50,8 @@ if ($route === '/api/collab-buckets' && $method === 'POST') {
$db->commit();
} catch (Throwable $e) {
if ($db->inTransaction()) $db->rollBack();
jsonResponse(['error' => 'create failed: ' . $e->getMessage()], 500);
@error_log('[hyprcrd-relay] collab bucket create failed: ' . $e->getMessage());
jsonResponse(['error' => 'create failed'], 500);
}
jsonResponse(['ok' => true, 'uid' => $uid, 'members' => array_values($resolved)]);
}
@@ -102,7 +103,7 @@ if (preg_match('#^/api/collab-buckets/([a-zA-Z0-9_-]+)$#', $route, $m) && $metho
$newOwnerName = trim((string)$input['owner']);
if ($newOwnerName === '') jsonResponse(['error' => 'owner cannot be empty'], 400);
$newOwner = getTenantByUsername($db, $newOwnerName);
if (!$newOwner) jsonResponse(['error' => "no such user: $newOwnerName"], 404);
if (!$newOwner) jsonResponse(['error' => 'user not found'], 404);
$memCheck = $db->prepare('SELECT 1 FROM collab_bucket_members WHERE bucket_uid = :b AND tenant_id = :t');
$memCheck->execute(['b' => $uid, 't' => $newOwner['id']]);
if (!$memCheck->fetchColumn()) {
relay/inc/routes/collab-cards.php
+10
View File
@@ -243,6 +243,14 @@ if (preg_match('#^/api/collab-cards/([a-zA-Z0-9_-]+)/([a-zA-Z0-9_-]+)$#', $route
// ── Collab attachments (images/PDFs/audio referenced by collab cards) ─
// Attachment filenames always follow the hyprcrd upload pattern
// (bin2hex(random_bytes(16)).<ext>). Enforce server-side so malicious
// clients can't poison the DB with traversal-shaped names that later
// surface in UIs or get forwarded to filesystem APIs.
function collabAttachmentFilenameValid(string $fn): bool {
return (bool)preg_match('/^[a-f0-9]{8,64}\.[a-z0-9]{1,8}$/', $fn);
}
if ($route === '/api/collab-attachments' && $method === 'POST') {
if (!$clientTenant) jsonResponse(['error' => 'unauthorized'], 401);
$input = json_decode(file_get_contents('php://input'), true) ?: [];
@@ -250,6 +258,7 @@ if ($route === '/api/collab-attachments' && $method === 'POST') {
$filename = (string)($input['filename'] ?? '');
$data = (string)($input['data'] ?? '');
if (!$bucketUid || !$filename || !$data) jsonResponse(['error' => 'bucket_uid, filename, and data required'], 400);
if (!collabAttachmentFilenameValid($filename)) jsonResponse(['error' => 'invalid filename'], 400);
if (!collabCardsIsMember($db, $bucketUid, (int)$clientTenant['id'])) {
jsonResponse(['error' => 'not a member of this bucket'], 403);
}
@@ -277,6 +286,7 @@ if ($route === '/api/collab-attachments' && $method === 'GET') {
$bucketUid = trim($_GET['bucket_uid'] ?? '');
$filename = trim($_GET['filename'] ?? '');
if (!$bucketUid) jsonResponse(['error' => 'bucket_uid required'], 400);
if ($filename !== '' && !collabAttachmentFilenameValid($filename)) jsonResponse(['error' => 'invalid filename'], 400);
if (!collabCardsIsMember($db, $bucketUid, (int)$clientTenant['id'])) {
jsonResponse(['error' => 'not a member of this bucket'], 403);
}
relay/inc/routes/collab-locks.php
+12 -1
View File
@@ -20,6 +20,13 @@ function collabLocksIsMember(PDO $db, string $bucketUid, int $tenantId): bool {
// ── POST: acquire/refresh ────────────────────────────────────────
// Maximum time a single holder can keep refreshing the same lock. Without a
// cap a malicious member could heartbeat forever, blocking every other
// member's writes. 10 minutes is long enough for any real edit session and
// short enough to time-box grief. When the cap is hit the lock is force-
// released and the client must re-acquire — giving everyone else a window.
const COLLAB_LOCK_MAX_HOLD_SECONDS = 600;
if ($route === '/api/collab-locks' && $method === 'POST') {
if (!$clientTenant) jsonResponse(['error' => 'unauthorized'], 401);
if (isRateLimited($db, 'collab-locks-post', 240)) jsonResponse(['error' => 'rate limited'], 429);
@@ -35,8 +42,12 @@ if ($route === '/api/collab-locks' && $method === 'POST') {
// narrow window between cleanup and this query.
$db->prepare("DELETE FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c AND expires_at <= datetime('now')")
->execute(['b' => $bucketUid, 'c' => $cardUid]);
// Also drop locks that have been refreshed past the max hold window —
// cap enforcement for grief prevention.
$db->prepare("DELETE FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c AND acquired_at <= datetime('now', '-" . COLLAB_LOCK_MAX_HOLD_SECONDS . " seconds')")
->execute(['b' => $bucketUid, 'c' => $cardUid]);
// Existing live lock? If a different tenant holds it, refuse.
$cur = $db->prepare('SELECT holder_id, holder_username, expires_at FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c');
$cur = $db->prepare('SELECT holder_id, holder_username, expires_at, acquired_at FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c');
$cur->execute(['b' => $bucketUid, 'c' => $cardUid]);
$existing = $cur->fetch();
if ($existing && (int)$existing['holder_id'] !== (int)$clientTenant['id']) {
relay/inc/routes/messages.php
+7 -4
View File
@@ -21,7 +21,7 @@ if ($route === '/api/messages' && $method === 'POST' && $sessionTenant && empty(
if ($body === '') jsonResponse(['error' => 'body required'], 400);
$recipient = getTenantByUsername($db, $recipientName);
if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
$interKey = getInterTenantKey($db, $MASTER_KEY);
if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
@@ -54,7 +54,7 @@ if ($route === '/api/attachments/upload' && $method === 'POST' && $sessionTenant
if (!$relayUid) jsonResponse(['error' => 'relay_uid required'], 400);
$recipient = getTenantByUsername($db, $recipientName);
if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
$interKey = getInterTenantKey($db, $MASTER_KEY);
if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
@@ -142,7 +142,7 @@ if ($route === '/api/messages' && $method === 'POST') {
if ($encryptedBody === '') jsonResponse(['error' => 'body required'], 400);
$recipient = getTenantByUsername($db, $recipientName);
if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
// Decrypt with sender's secret
if (empty($clientTenant['secret_encrypted'])) {
@@ -225,9 +225,12 @@ if ($route === '/api/attachments' && $method === 'POST') {
$data = (string)($input['data'] ?? '');
$recipientName = trim((string)($input['recipient'] ?? $clientTenant['username']));
if (!$relayUid || !$filename || !$data) jsonResponse(['error' => 'relay_uid, filename, and data required'], 400);
// Enforce the hyprcrd upload naming scheme server-side so traversal-shaped
// names never enter storage or get forwarded back to other clients.
if (!preg_match('/^[a-f0-9]{8,64}\.[a-z0-9]{1,8}$/', $filename)) jsonResponse(['error' => 'invalid filename'], 400);
$recipient = getTenantByUsername($db, $recipientName);
if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
// Decrypt-reencrypt hop, same shape as messages: arrives encrypted with
// sender's secret, gets stored at-rest under the inter-tenant key.
relay/inc/routes/public.php
+1 -1
View File
@@ -49,7 +49,7 @@ if ($route === '/api/setup' && $method === 'POST') {
if (!preg_match('/^[a-zA-Z0-9_-]{2,32}$/', $username)) {
jsonResponse(['error' => 'username must be 2-32 chars: letters, digits, _ or -'], 400);
}
if (strlen($password) < 4) jsonResponse(['error' => 'password must be at least 4 chars'], 400);
if (strlen($password) < 10) jsonResponse(['error' => 'password must be at least 10 chars'], 400);
if (strlen($superSecret) < 12) jsonResponse(['error' => 'super-shared secret must be at least 12 chars'], 400);
// Create the admin tenant. NO client secret yet — the admin (and every
relay/index.php
+17 -2
View File
@@ -40,10 +40,25 @@ $isSetup = tenantCount($db) === 0;
if (str_starts_with($route, '/api/')) {
header('Content-Type: application/json');
// CORS: the hyprcrd client hits us server-side (no browser CORS in play)
// and the relay UI lives same-origin, so the only legitimate cross-origin
// callers are other tenant UIs on the same relay host. We allow the
// relay's own scheme+host, plus an opt-in allowlist via RELAY_CORS_ORIGINS
// (comma-separated). Credentials are intentionally NOT allowed — API auth
// is header-based (X-Relay-User/Key) and the UI is same-origin.
$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
if ($origin) {
$ownScheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https' ? 'https' : 'http';
$ownOrigin = $ownScheme . '://' . ($_SERVER['HTTP_HOST'] ?? '');
$allowed = [$ownOrigin];
$extra = getenv('RELAY_CORS_ORIGINS');
if ($extra) {
foreach (explode(',', $extra) as $o) {
$o = trim($o);
if ($o !== '') $allowed[] = $o;
}
}
if ($origin && in_array($origin, $allowed, true)) {
header('Access-Control-Allow-Origin: ' . $origin);
header('Access-Control-Allow-Credentials: true');
header('Vary: Origin');
}
header('Access-Control-Allow-Headers: Content-Type, X-Relay-User, X-Relay-Key');
relay/ui/app.js
+4 -4
View File
@@ -199,7 +199,7 @@ async function doChangePassword() {
const err = $('cp-err');
err.textContent = '';
if (!current || !newPw) { err.textContent = 'all fields required'; return; }
if (newPw.length < 4) { err.textContent = 'new password too short'; return; }
if (newPw.length < 10) { err.textContent = 'new password must be at least 10 chars'; return; }
if (newPw !== newPw2) { err.textContent = 'new passwords don\'t match'; return; }
if (current === newPw) { err.textContent = 'new password must differ from current'; return; }
@@ -231,7 +231,7 @@ async function doSetup() {
const err = $('setup-err');
err.textContent = '';
if (!username) { err.textContent = 'username required'; return; }
if (password.length < 4) { err.textContent = 'password too short'; return; }
if (password.length < 10) { err.textContent = 'password must be at least 10 chars'; return; }
if (superSecret.length < 12) { err.textContent = 'super-shared secret needs at least 12 chars'; return; }
const res = await api('api/setup', { method: 'POST', body: { username, password, super_secret: superSecret } });
if (res.ok) {
@@ -1039,8 +1039,8 @@ async function createUser() {
}
async function resetUserPassword(id, username) {
const newPw = prompt(`new password for ${username} (min 4 chars):`);
if (!newPw || newPw.length < 4) { toast('password too short', true); return; }
const newPw = prompt(`new password for ${username} (min 10 chars):`);
if (!newPw || newPw.length < 10) { toast('password too short', true); return; }
const res = await api('api/users/' + id, { method: 'PATCH', body: { password: newPw } });
if (res.ok) toast('password updated');
else toast(res.error || 'failed', true);
relay/ui/layout.php
+3 -3
View File
@@ -47,7 +47,7 @@ if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
</div>
<div class="field">
<label>admin password</label>
<input type="password" id="setup-password" placeholder="min 4 chars" autocomplete="new-password">
<input type="password" id="setup-password" placeholder="min 10 chars" autocomplete="new-password">
</div>
<div class="field">
<label>super-shared secret</label>
@@ -144,7 +144,7 @@ if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
</div>
<div class="field">
<label>new password</label>
<input type="password" id="cp-new" placeholder="min 4 chars" autocomplete="new-password">
<input type="password" id="cp-new" placeholder="min 10 chars" autocomplete="new-password">
</div>
<div class="field">
<label>confirm new password</label>
@@ -205,7 +205,7 @@ if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
</div>
<div class="field">
<label for="new-password">password</label>
<input type="password" id="new-password" placeholder="min 4 chars" autocomplete="new-password">
<input type="password" id="new-password" placeholder="min 10 chars" autocomplete="new-password">
</div>
<label class="checkbox">
<input type="checkbox" id="new-is-admin"> grant admin privileges
src/CalDavClient.php
+1
View File
@@ -28,6 +28,7 @@ class CalDavClient
CURLOPT_TIMEOUT => 30,
CURLOPT_SSL_VERIFYPEER => true,
]);
hyprcrdApplySafeCurlOpts($ch);
if ($body !== '') {
curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
}
src/Database.php
+12
View File
@@ -169,5 +169,17 @@ class Database
)
');
self::$pdo->exec('CREATE INDEX IF NOT EXISTS idx_card_history_card ON card_history(card_id, changed_at DESC)');
// Login / password-change rate limiting. Keyed by IP so rotating the
// session cookie doesn't reset the counter. Old rows are purged at
// the top of every login request.
self::$pdo->exec('
CREATE TABLE IF NOT EXISTS login_attempts (
ip TEXT NOT NULL,
endpoint TEXT NOT NULL,
attempted_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
)
');
self::$pdo->exec('CREATE INDEX IF NOT EXISTS idx_login_attempts_ip_ep ON login_attempts(ip, endpoint, attempted_at)');
}
}
src/bootstrap.php
+92
View File
@@ -23,3 +23,95 @@ $pluginManager = PluginManager::instance();
$pluginManager->scan(__DIR__ . '/../public/plugins');
$pluginManager->loadDisabled(dirname(DB_PATH) . '/plugins.json');
$pluginManager->loadBackends(); // require_once enabled backend.php files
// ── SSRF guards ────────────────────────────────────────────────────
// Used by every outbound cURL that fetches a user-supplied URL.
// Default: restrict protocols to HTTP(S); caller opts into private-IP
// blocking when the target should be public-internet-only (bookmarks).
if (!defined('HYPRCRD_SAFE_PROTOS')) {
define('HYPRCRD_SAFE_PROTOS', CURLPROTO_HTTP | CURLPROTO_HTTPS);
}
function hyprcrdApplySafeCurlOpts($ch): void {
curl_setopt($ch, CURLOPT_PROTOCOLS, HYPRCRD_SAFE_PROTOS);
curl_setopt($ch, CURLOPT_REDIR_PROTOCOLS, HYPRCRD_SAFE_PROTOS);
}
// ── Relay wire crypto ──────────────────────────────────────────────
// Dual-format envelope used by the relay push/poll path. Mirrors
// relay/inc/crypto.php exactly — same magic strings, same HKDF info.
//
// HYPRCRD-GCM-V2 (new) AES-256-GCM + HKDF(SHA-256) + per-cipher salt
// HYPRCRD-RELAY-V1 (legacy) AES-256-CBC + substr(hex(sha256())) KDF
//
// Encrypt always writes V2. Decrypt accepts either so hyprcrd keeps
// reading messages and attachments pushed before the v1.10 upgrade.
const HYPRCRD_RELAY_GCM_MAGIC = 'HYPRCRD-GCM-V2';
const HYPRCRD_RELAY_CBC_MAGIC = 'HYPRCRD-RELAY-V1';
const HYPRCRD_RELAY_HKDF_INFO = 'hyprcrd-relay-client-v2';
function hyprcrdRelayEncrypt(string $plain, string $secret): string {
$salt = random_bytes(16);
$nonce = random_bytes(12);
$key = hash_hkdf('sha256', $secret, 32, HYPRCRD_RELAY_HKDF_INFO, $salt);
$tag = '';
$cipher = openssl_encrypt($plain, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag, '', 16);
return HYPRCRD_RELAY_GCM_MAGIC . "\n" . base64_encode($salt . $nonce . $cipher . $tag);
}
function hyprcrdRelayDecrypt(string $envelope, string $secret): string {
if (str_starts_with($envelope, HYPRCRD_RELAY_GCM_MAGIC)) {
$b64 = trim(substr($envelope, strlen(HYPRCRD_RELAY_GCM_MAGIC) + 1));
$raw = base64_decode($b64, true);
if (!$raw || strlen($raw) < 16 + 12 + 16 + 1) return '';
$salt = substr($raw, 0, 16);
$nonce = substr($raw, 16, 12);
$tag = substr($raw, -16);
$cipher = substr($raw, 28, -16);
$key = hash_hkdf('sha256', $secret, 32, HYPRCRD_RELAY_HKDF_INFO, $salt);
$plain = openssl_decrypt($cipher, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag);
return $plain !== false ? $plain : '';
}
if (str_starts_with($envelope, HYPRCRD_RELAY_CBC_MAGIC)) {
$b64 = trim(substr($envelope, strlen(HYPRCRD_RELAY_CBC_MAGIC) + 1));
$raw = base64_decode($b64, true);
if (!$raw || strlen($raw) < 17) return '';
$key = substr(hash('sha256', $secret), 0, 32);
$iv = substr($raw, 0, 16);
$cipher = substr($raw, 16);
$result = openssl_decrypt($cipher, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
return $result !== false ? $result : '';
}
// Passthrough for already-plaintext fields (legacy relays occasionally
// returned title fields unwrapped).
return $envelope;
}
function hyprcrdUrlHostIsPublic(string $url): bool {
$host = parse_url($url, PHP_URL_HOST);
if (!$host) return false;
$host = strtolower(trim($host, '[]'));
$ips = [];
if (filter_var($host, FILTER_VALIDATE_IP)) {
$ips[] = $host;
} else {
$rec = @dns_get_record($host, DNS_A + DNS_AAAA);
foreach ($rec ?: [] as $r) {
if (!empty($r['ip'])) $ips[] = $r['ip'];
if (!empty($r['ipv6'])) $ips[] = $r['ipv6'];
}
if (!$ips) {
$resolved = @gethostbynamel($host);
if ($resolved) $ips = $resolved;
}
}
if (!$ips) return false;
foreach ($ips as $ip) {
if (!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
return false;
}
}
return true;
}