From d83de30d6dac12eb48e314b29679dfcde95573ac Mon Sep 17 00:00:00 2001 From: th Date: Fri, 17 Apr 2026 17:02:04 +0200 Subject: [PATCH] =?UTF-8?q?security:=20v2.0=20=E2=80=94=20AES-GCM=20crypto?= =?UTF-8?q?,=20SSRF=20guards,=20rate=20limits,=20hardening?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Breaking wire-format change: dual-read (V1+V2) / single-write (V2) so existing user secrets, stored messages, and inter-tenant key keep working. Old clients and relays lose cross-version chat until both sides are upgraded. Relay - Switch clientEncrypt/masterEncrypt to AES-256-GCM with HKDF-derived per-ciphertext salts; keep CBC-V1 fallback on decrypt only. - On-bootstrap migration re-envelopes tenant secret_encrypted and the inter-tenant key to GCM-V2 (idempotent). - CORS: stop reflecting arbitrary Origin; allow own origin + optional RELAY_CORS_ORIGINS env allowlist; drop Access-Control-Allow-Credentials. - Generic error messages replace "no such user: " enumeration. - Exception messages no longer echoed back; logged server-side. - Collab-lock max hold capped at 10min so a member can't grief-refresh forever. - Attachment filenames validated against hex. pattern. - Passwords min length 10; /api/account/password rate-limited. App / Electron client - Shared hyprcrdRelayEncrypt/Decrypt helpers (GCM-V2 write, V1 read). - Chat + collab-buckets plugins delegate to the shared helpers. - Poll + push + attachments migrated to the dual-format path. - /api/relay/settings GET returns has_key boolean; secret never echoed. - Setup endpoint now CSRF-checked. - SSRF: CURLOPT_PROTOCOLS restricted to HTTP(S) everywhere; bookmarks favicon fetch also blocks private/loopback/link-local. - Login / password-change rate limiter moved to DB-backed IP keying. - Passwords min length 10 throughout. - Zip import enforces per-file (25MB) and total (500MB) caps, extension allowlist, no-overwrite. - Verbose relay-push debug gated behind APP_DEBUG env. Version bumped to 2.0.0 (protocol-breaking). Co-Authored-By: Claude Opus 4.7 (1M context) --- .gitignore | 1 + config.php | 6 +- electron/package.json | 2 +- public/index.php | 199 ++++++++++++++-------- public/js/app.js | 8 +- public/js/modules/sync.js | 7 +- public/js/modules/theme.js | 2 +- public/plugins/bookmarks/backend.php | 27 ++- public/plugins/chat/backend.php | 24 ++- public/plugins/collab-buckets/backend.php | 24 +-- public/plugins/tests/relay.test.js | 10 +- relay/inc/bootstrap.php | 28 +++ relay/inc/crypto.php | 104 ++++++++--- relay/inc/routes/account.php | 5 +- relay/inc/routes/admin.php | 4 +- relay/inc/routes/chat.php | 11 +- relay/inc/routes/collab-buckets.php | 5 +- relay/inc/routes/collab-cards.php | 10 ++ relay/inc/routes/collab-locks.php | 13 +- relay/inc/routes/messages.php | 11 +- relay/inc/routes/public.php | 2 +- relay/index.php | 19 ++- relay/ui/app.js | 8 +- relay/ui/layout.php | 6 +- src/CalDavClient.php | 1 + src/Database.php | 12 ++ src/bootstrap.php | 92 ++++++++++ 27 files changed, 473 insertions(+), 168 deletions(-) diff --git a/.gitignore b/.gitignore index 009ab59..011ebe3 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,4 @@ data/hyprcrd.db-wal /oumta-dashboard/ /oumta-dashboard-ui/ +relay/data diff --git a/config.php b/config.php index 9bdefd4..5a8f05e 100644 --- a/config.php +++ b/config.php @@ -1,7 +1,11 @@ exec("DELETE FROM login_attempts WHERE attempted_at < datetime('now', '-10 minutes')"); + $hyprcrdIpRateLimited = function (string $endpoint, int $max, int $windowMinutes = 5) use ($db, $hyprcrdClientIp): bool { + if ($hyprcrdClientIp === '') return false; + $q = $db->prepare("SELECT COUNT(*) FROM login_attempts WHERE ip = :ip AND endpoint = :ep AND attempted_at > datetime('now', '-{$windowMinutes} minutes')"); + $q->execute(['ip' => $hyprcrdClientIp, 'ep' => $endpoint]); + return (int)$q->fetchColumn() >= $max; + }; + $hyprcrdRecordAttempt = function (string $endpoint) use ($db, $hyprcrdClientIp): void { + if ($hyprcrdClientIp === '') return; + $db->prepare('INSERT INTO login_attempts (ip, endpoint) VALUES (:ip, :ep)') + ->execute(['ip' => $hyprcrdClientIp, 'ep' => $endpoint]); + }; + // GET /api/auth/status if ($route === '/api/auth/status' && $method === 'GET') { echo json_encode(['setup' => $isSetup, 'logged_in' => $isLoggedIn, 'csrf' => $_SESSION['csrf_token'], 'version' => APP_VERSION]); @@ -63,11 +79,20 @@ if (str_starts_with($route, '/api/auth')) { // POST /api/auth/setup — set initial password if ($route === '/api/auth/setup' && $method === 'POST' && $isSetup) { + // CSRF: same-origin + same-session guarantee. A drive-by POST from + // another site won't have the csrf cookie-bound token, so it can't + // silently claim a freshly-provisioned instance. + $csrfHeader = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? ''; + if (!hash_equals($_SESSION['csrf_token'] ?? '', $csrfHeader)) { + http_response_code(403); + echo json_encode(['error' => 'invalid csrf token']); + exit; + } $input = json_decode(file_get_contents('php://input'), true); $pw = $input['password'] ?? ''; - if (strlen($pw) < 4) { + if (strlen($pw) < 10) { http_response_code(400); - echo json_encode(['error' => 'password too short (min 4)']); + echo json_encode(['error' => 'password too short (min 10)']); exit; } $hash = password_hash($pw, PASSWORD_BCRYPT); @@ -79,13 +104,11 @@ if (str_starts_with($route, '/api/auth')) { exit; } - // POST /api/auth/login (rate limited) + // POST /api/auth/login (IP-keyed rate limit) if ($route === '/api/auth/login' && $method === 'POST') { - $attempts = $_SESSION['login_attempts'] ?? 0; - $lastAttempt = $_SESSION['login_last'] ?? 0; - if ($attempts >= 5 && time() - $lastAttempt < 60) { + if ($hyprcrdIpRateLimited('login', 10, 5)) { http_response_code(429); - echo json_encode(['error' => 'too many attempts, wait 60s']); + echo json_encode(['error' => 'too many attempts, try again later']); exit; } $input = json_decode(file_get_contents('php://input'), true); @@ -94,11 +117,9 @@ if (str_starts_with($route, '/api/auth')) { session_regenerate_id(true); $_SESSION['hyprcrd_auth'] = true; $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); - $_SESSION['login_attempts'] = 0; echo json_encode(['ok' => true, 'csrf' => $_SESSION['csrf_token']]); } else { - $_SESSION['login_attempts'] = $attempts + 1; - $_SESSION['login_last'] = time(); + $hyprcrdRecordAttempt('login'); usleep(300000); // 300ms delay against timing attacks http_response_code(401); echo json_encode(['error' => 'wrong password']); @@ -159,18 +180,24 @@ if (str_starts_with($route, '/api/auth')) { // POST /api/auth/password — change password (requires current password) if ($route === '/api/auth/password' && $method === 'POST') { + if ($hyprcrdIpRateLimited('password', 10, 5)) { + http_response_code(429); + echo json_encode(['error' => 'too many attempts, try again later']); + exit; + } $input = json_decode(file_get_contents('php://input'), true); $current = $input['current'] ?? ''; $newPass = $input['new'] ?? ''; $hash = $db->query("SELECT value FROM settings WHERE key = 'password_hash'")->fetchColumn(); if (!password_verify($current, $hash)) { + $hyprcrdRecordAttempt('password'); http_response_code(403); echo json_encode(['error' => 'wrong password']); exit; } - if (strlen($newPass) < 4) { + if (strlen($newPass) < 10) { http_response_code(400); - echo json_encode(['error' => 'min 4 characters']); + echo json_encode(['error' => 'min 10 characters']); exit; } $newHash = password_hash($newPass, PASSWORD_BCRYPT); @@ -752,21 +779,37 @@ if (str_starts_with($route, '/api/')) { } } - // Extract uploads + // Extract uploads. Guard against zip bombs and malicious payloads: + // per-file 25MB cap, 500MB total, whitelist allowed extensions (same + // set as the live /api/upload endpoint), never overwrite existing + // files, never leak paths via traversal. $uploadDir = UPLOAD_DIR; if (!is_dir($uploadDir)) mkdir($uploadDir, 0777, true); + $allowedExts = ['png', 'jpg', 'jpeg', 'gif', 'webp', 'mp3', 'ogg', 'wav', 'm4a', 'pdf']; + $perFileMax = 25 * 1024 * 1024; // 25 MB + $totalMax = 500 * 1024 * 1024; // 500 MB + $totalWritten = 0; + $skipped = []; for ($i = 0; $i < $zip->numFiles; $i++) { $name = $zip->getNameIndex($i); - if (str_starts_with($name, 'uploads/') && $name !== 'uploads/') { - $content = $zip->getFromIndex($i); - if ($content !== false) { - file_put_contents($uploadDir . '/' . basename($name), $content); - } - } + if (!str_starts_with($name, 'uploads/') || $name === 'uploads/') continue; + $base = basename($name); + $ext = strtolower(pathinfo($base, PATHINFO_EXTENSION)); + if (!in_array($ext, $allowedExts, true)) { $skipped[] = $base; continue; } + $stat = $zip->statIndex($i); + if ($stat && isset($stat['size']) && $stat['size'] > $perFileMax) { $skipped[] = $base; continue; } + if ($totalWritten + (int)($stat['size'] ?? 0) > $totalMax) { $skipped[] = $base; continue; } + $dest = $uploadDir . '/' . $base; + if (file_exists($dest)) { $skipped[] = $base; continue; } + $content = $zip->getFromIndex($i); + if ($content === false) continue; + if (strlen($content) > $perFileMax) { $skipped[] = $base; continue; } + file_put_contents($dest, $content); + $totalWritten += strlen($content); } $zip->close(); - echo json_encode(['ok' => true, 'buckets' => count($data['buckets']), 'cards' => count($data['cards'])]); + echo json_encode(['ok' => true, 'buckets' => count($data['buckets']), 'cards' => count($data['cards']), 'skipped_files' => count($skipped)]); exit; } @@ -793,18 +836,27 @@ if (str_starts_with($route, '/api/')) { $url = $db->query("SELECT value FROM settings WHERE key = 'relay_url'")->fetchColumn() ?: ''; $username = $db->query("SELECT value FROM settings WHERE key = 'relay_username'")->fetchColumn() ?: ''; $key = $db->query("SELECT value FROM settings WHERE key = 'relay_key'")->fetchColumn() ?: ''; - // Single-user local app — echo the stored secret back so the user can - // see and edit it directly without guessing if it's still saved. - echo json_encode(['url' => $url, 'username' => $username, 'key' => $key]); exit; + // Never echo the plaintext secret to the client — if it leaks via XSS + // or a compromised session, the attacker can decrypt all relay traffic. + // The UI just needs to know whether a secret is set. + echo json_encode(['url' => $url, 'username' => $username, 'has_key' => !empty($key)]); exit; } if ($route === '/api/relay/settings' && $method === 'POST') { $input = json_decode(file_get_contents('php://input'), true); if (isset($input['url'])) $db->prepare("INSERT OR REPLACE INTO settings (key, value) VALUES ('relay_url', :v)")->execute(['v' => $input['url']]); if (isset($input['username'])) $db->prepare("INSERT OR REPLACE INTO settings (key, value) VALUES ('relay_username', :v)")->execute(['v' => $input['username']]); - // Always overwrite key when present (even empty) — single-user local - // app, the input is now pre-populated so an empty submit is intentional - if (array_key_exists('key', $input)) $db->prepare("INSERT OR REPLACE INTO settings (key, value) VALUES ('relay_key', :v)")->execute(['v' => $input['key']]); + // The UI no longer receives the stored secret, so empty strings are + // just "field untouched" and we only write when the user types a new + // value. An explicit null clears the secret for users who need it. + if (array_key_exists('key', $input)) { + $newKey = $input['key']; + if ($newKey === null) { + $db->prepare("DELETE FROM settings WHERE key = 'relay_key'")->execute(); + } elseif (is_string($newKey) && $newKey !== '') { + $db->prepare("INSERT OR REPLACE INTO settings (key, value) VALUES ('relay_key', :v)")->execute(['v' => $newKey]); + } + } echo json_encode(['ok' => true]); exit; } @@ -831,6 +883,7 @@ if (str_starts_with($route, '/api/')) { CURLOPT_HTTPHEADER => ['X-Relay-User: ' . $relayUser, 'X-Relay-Key: ' . $relayKey], CURLOPT_TIMEOUT => 10, ]); + hyprcrdApplySafeCurlOpts($ch); $response = curl_exec($ch); $status = curl_getinfo($ch, CURLINFO_HTTP_CODE); curl_close($ch); @@ -851,13 +904,15 @@ if (str_starts_with($route, '/api/')) { if (!is_array($messages)) { echo json_encode(['ok' => false, 'error' => 'invalid response']); exit; } $pulled = 0; - $encKey = substr(hash('sha256', $relayKey), 0, 32); - $decryptField = function($text) use ($encKey) { - if (!str_starts_with($text, 'HYPRCRD-RELAY-V1')) return $text; - $raw = base64_decode(trim(explode("\n", $text, 2)[1] ?? '')); - if (strlen($raw) < 17) return $text; - $plain = openssl_decrypt(substr($raw, 16), 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, substr($raw, 0, 16)); - return $plain !== false ? $plain : $text; + $decryptField = function($text) use ($relayKey) { + $decoded = hyprcrdRelayDecrypt($text, $relayKey); + // Dual-format decrypt returns '' only when a magic-prefixed + // envelope failed to decrypt — surface the original string in + // that case so the UI still shows something useful. + if ($decoded === '' && (str_starts_with($text, HYPRCRD_RELAY_GCM_MAGIC) || str_starts_with($text, HYPRCRD_RELAY_CBC_MAGIC))) { + return $text; + } + return $decoded; }; // Load IDs we pushed ourselves @@ -920,6 +975,7 @@ if (str_starts_with($route, '/api/')) { ], CURLOPT_TIMEOUT => 5, ]); + hyprcrdApplySafeCurlOpts($bch); $bRes = curl_exec($bch); $bStat = curl_getinfo($bch, CURLINFO_HTTP_CODE); curl_close($bch); @@ -936,6 +992,7 @@ if (str_starts_with($route, '/api/')) { CURLOPT_HTTPHEADER => ['X-Relay-User: ' . $relayUser, 'X-Relay-Key: ' . $relayKey], CURLOPT_TIMEOUT => 30, ]); + hyprcrdApplySafeCurlOpts($ach); $attResponse = curl_exec($ach); $attStatus = curl_getinfo($ach, CURLINFO_HTTP_CODE); curl_close($ach); @@ -949,23 +1006,28 @@ if (str_starts_with($route, '/api/')) { if (!preg_match('/^[a-f0-9]+\.\w+$/', $fn)) continue; $dest = $uploadDir . '/' . $fn; if (file_exists($dest)) continue; - // New format: HYPRCRD-RELAY-V1 envelope (decrypt-reencrypted by relay) - // Old format: raw base64(iv || cipher) + // Dual-format: GCM-V2 envelope (v1.10+) and legacy + // CBC-V1 envelope; plaintext inside is base64(file + // bytes). Very-old pre-envelope format was raw + // base64(iv || cipher) — unlikely at this point but + // cheap to keep as a last-resort fallback. $payload = $att['data'] ?? ''; - if (str_starts_with($payload, 'HYPRCRD-RELAY-V1')) { - $b64 = trim(substr($payload, strlen('HYPRCRD-RELAY-V1') + 1)); - $raw = base64_decode($b64); + $decrypted = false; + if (str_starts_with($payload, HYPRCRD_RELAY_GCM_MAGIC) || str_starts_with($payload, HYPRCRD_RELAY_CBC_MAGIC)) { + $plain = hyprcrdRelayDecrypt($payload, $relayKey); + if ($plain !== '') $decrypted = $plain; } else { + $legacyKey = substr(hash('sha256', $relayKey), 0, 32); $raw = base64_decode($payload); - } - if (strlen($raw) >= 17) { - $decrypted = openssl_decrypt(substr($raw, 16), 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, substr($raw, 0, 16)); - if ($decrypted !== false) { - $fileBytes = base64_decode($decrypted); - if ($fileBytes !== false) $decrypted = $fileBytes; - file_put_contents($dest, $decrypted); + if ($raw !== false && strlen($raw) >= 17) { + $decrypted = openssl_decrypt(substr($raw, 16), 'aes-256-cbc', $legacyKey, OPENSSL_RAW_DATA, substr($raw, 0, 16)); } } + if ($decrypted !== false) { + $fileBytes = base64_decode($decrypted); + if ($fileBytes !== false) $decrypted = $fileBytes; + file_put_contents($dest, $decrypted); + } } } } @@ -982,6 +1044,7 @@ if (str_starts_with($route, '/api/')) { CURLOPT_HTTPHEADER => ['X-Relay-User: ' . $relayUser, 'X-Relay-Key: ' . $relayKey], CURLOPT_TIMEOUT => 5, ]); + hyprcrdApplySafeCurlOpts($sch); $sResp = curl_exec($sch); $sStatus = curl_getinfo($sch, CURLINFO_HTTP_CODE); curl_close($sch); @@ -1015,6 +1078,7 @@ if (str_starts_with($route, '/api/')) { CURLOPT_HTTPHEADER => ['X-Relay-User: ' . $relayUser, 'X-Relay-Key: ' . $relayKey], CURLOPT_TIMEOUT => 10, ]); + hyprcrdApplySafeCurlOpts($ch); $response = curl_exec($ch); $status = curl_getinfo($ch, CURLINFO_HTTP_CODE); curl_close($ch); @@ -1054,12 +1118,7 @@ if (str_starts_with($route, '/api/')) { $db->prepare('UPDATE cards SET relay_uid = ? WHERE id = ?')->execute([$relayUid, $cardId]); } - $encKey = substr(hash('sha256', $relayKey), 0, 32); - $encryptField = function($text) use ($encKey) { - $iv = random_bytes(16); - $cipher = openssl_encrypt($text, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv); - return "HYPRCRD-RELAY-V1\n" . base64_encode($iv . $cipher); - }; + $encryptField = fn($text) => hyprcrdRelayEncrypt((string)$text, $relayKey); $payloadData = [ 'title' => $encryptField($card['title'] ?? ''), @@ -1072,21 +1131,27 @@ if (str_starts_with($route, '/api/')) { $payload = json_encode($payloadData); $ch = curl_init(rtrim($relayUrl, '/') . '/api/messages'); - $debugStream = fopen('php://temp', 'w+'); + $debugStream = APP_DEBUG ? fopen('php://temp', 'w+') : null; curl_setopt_array($ch, [ CURLOPT_RETURNTRANSFER => true, CURLOPT_POST => true, CURLOPT_POSTFIELDS => $payload, CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'X-Relay-User: ' . $relayUser, 'X-Relay-Key: ' . $relayKey], CURLOPT_TIMEOUT => 10, - CURLOPT_VERBOSE => true, - CURLOPT_STDERR => $debugStream, ]); + hyprcrdApplySafeCurlOpts($ch); + if ($debugStream) { + curl_setopt($ch, CURLOPT_VERBOSE, true); + curl_setopt($ch, CURLOPT_STDERR, $debugStream); + } $response = curl_exec($ch); $status = curl_getinfo($ch, CURLINFO_HTTP_CODE); - rewind($debugStream); - $curlDebug = stream_get_contents($debugStream); - fclose($debugStream); + $curlDebug = ''; + if ($debugStream) { + rewind($debugStream); + $curlDebug = stream_get_contents($debugStream); + fclose($debugStream); + } curl_close($ch); if ($status === 200 || $status === 201) { @@ -1121,6 +1186,7 @@ if (str_starts_with($route, '/api/')) { CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'X-Relay-User: ' . $relayUser, 'X-Relay-Key: ' . $relayKey], CURLOPT_TIMEOUT => 30, ]); + hyprcrdApplySafeCurlOpts($ach); curl_exec($ach); curl_close($ach); } @@ -1135,16 +1201,15 @@ if (str_starts_with($route, '/api/')) { } elseif (is_string($response) && $response !== '') { $relayMsg = ' — ' . substr($response, 0, 200); } - // Strip the X-Relay-Key value from the debug log so we don't leak the secret - $safeDebug = preg_replace('/(X-Relay-Key:\s*)[^\r\n]+/i', '$1', $curlDebug); - echo json_encode([ - 'ok' => false, - 'error' => "relay returned HTTP $status$relayMsg", - 'sent_username' => $relayUser, - 'relay_url' => rtrim($relayUrl, '/') . '/api/messages', - 'response_body' => is_string($response) ? substr($response, 0, 500) : null, - 'curl_debug' => $safeDebug, - ]); + // In production, don't leak upstream URL / raw bodies / curl traces — + // APP_DEBUG=1 re-enables them for local troubleshooting. + $out = ['ok' => false, 'error' => "relay returned HTTP $status$relayMsg", 'sent_username' => $relayUser]; + if (APP_DEBUG) { + $out['relay_url'] = rtrim($relayUrl, '/') . '/api/messages'; + $out['response_body'] = is_string($response) ? substr($response, 0, 500) : null; + $out['curl_debug'] = preg_replace('/(X-Relay-Key:\s*)[^\r\n]+/i', '$1', $curlDebug); + } + echo json_encode($out); exit; } diff --git a/public/js/app.js b/public/js/app.js index 094620b..78ad4c4 100644 --- a/public/js/app.js +++ b/public/js/app.js @@ -194,11 +194,11 @@ async function checkAuth() { if (data.setup) { let pw = null; - while (!pw || pw.length < 4) { - pw = await showDialog({ title: 'setup', message: 'Welcome to hyprcrd. Set a password:', input: 'password', placeholder: '> password (min. 4 chars)...', okLabel: 'Set', cancelLabel: '' }); - if (pw && pw.length < 4) pw = null; + while (!pw || pw.length < 10) { + pw = await showDialog({ title: 'setup', message: 'Welcome to hyprcrd. Set a password:', input: 'password', placeholder: '> password (min. 10 chars)...', okLabel: 'Set', cancelLabel: '' }); + if (pw && pw.length < 10) pw = null; } - const r = await fetch('api/auth/setup', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ password: pw }) }); + const r = await fetch('api/auth/setup', { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': data.csrf || '' }, body: JSON.stringify({ password: pw }) }); const d = await r.json(); if (d.error) { location.reload(); return; } if (d.csrf) { setCsrf(d.csrf); window.hyprcrd?.util?.setCsrf?.(d.csrf); } diff --git a/public/js/modules/sync.js b/public/js/modules/sync.js index 1b56057..8473950 100644 --- a/public/js/modules/sync.js +++ b/public/js/modules/sync.js @@ -321,8 +321,11 @@ export async function loadRelaySettings() { if (urlInput) urlInput.value = s.url || ''; if (userInput) userInput.value = s.username || ''; if (keyInput) { - keyInput.value = s.key || ''; - keyInput.placeholder = 'shared secret'; + // The server no longer echoes the stored secret. Leave the field + // blank; placeholder tells the user whether one is set. An empty + // save is treated as "field untouched" server-side. + keyInput.value = ''; + keyInput.placeholder = s.has_key ? '•••••••• (saved — type to change)' : 'shared secret'; } // Sync-interval slider lives in the Relay panel but drives every // poller. Snap points span 5s..1h; live label updates on drag, diff --git a/public/js/modules/theme.js b/public/js/modules/theme.js index 9834a0b..4a46fd5 100644 --- a/public/js/modules/theme.js +++ b/public/js/modules/theme.js @@ -411,7 +411,7 @@ $('settings-pw-save')?.addEventListener('click', async () => { if (!current || !newPw) { if (status) { status.textContent = 'fill all fields'; status.style.color = 'var(--t-danger)'; } return; } if (newPw !== confirm) { if (status) { status.textContent = 'passwords do not match'; status.style.color = 'var(--t-danger)'; } return; } - if (newPw.length < 4) { if (status) { status.textContent = 'min 4 characters'; status.style.color = 'var(--t-danger)'; } return; } + if (newPw.length < 10) { if (status) { status.textContent = 'min 10 characters'; status.style.color = 'var(--t-danger)'; } return; } const res = await fetch('api/auth/password', { method: 'POST', diff --git a/public/plugins/bookmarks/backend.php b/public/plugins/bookmarks/backend.php index db7a0cf..372ca06 100644 --- a/public/plugins/bookmarks/backend.php +++ b/public/plugins/bookmarks/backend.php @@ -20,6 +20,17 @@ PluginManager::instance()->onApiRoute(function (string $route, string $method) { echo json_encode(['error' => 'valid url required']); exit; } + $scheme = strtolower((string)parse_url($url, PHP_URL_SCHEME)); + if ($scheme !== 'http' && $scheme !== 'https') { + http_response_code(400); + echo json_encode(['error' => 'only http/https URLs allowed']); + exit; + } + if (!hyprcrdUrlHostIsPublic($url)) { + http_response_code(400); + echo json_encode(['error' => 'URL host is not publicly reachable']); + exit; + } $ch = curl_init($url); curl_setopt_array($ch, [ @@ -30,6 +41,7 @@ PluginManager::instance()->onApiRoute(function (string $route, string $method) { CURLOPT_USERAGENT => 'Mozilla/5.0 (compatible; hyprcrd-bookmarks/1.0)', CURLOPT_SSL_VERIFYPEER => true, ]); + hyprcrdApplySafeCurlOpts($ch); $html = curl_exec($ch); $status = curl_getinfo($ch, CURLINFO_HTTP_CODE); $finalUrl = curl_getinfo($ch, CURLINFO_EFFECTIVE_URL) ?: $url; @@ -63,18 +75,21 @@ PluginManager::instance()->onApiRoute(function (string $route, string $method) { } $faviconData = ''; - $ch2 = curl_init($faviconUrl); - curl_setopt_array($ch2, [ + $faviconScheme = strtolower((string)parse_url($faviconUrl, PHP_URL_SCHEME)); + $favCh = ($faviconScheme === 'http' || $faviconScheme === 'https') && hyprcrdUrlHostIsPublic($faviconUrl); + $ch2 = $favCh ? curl_init($faviconUrl) : null; + if ($ch2) curl_setopt_array($ch2, [ CURLOPT_RETURNTRANSFER => true, CURLOPT_FOLLOWLOCATION => true, CURLOPT_MAXREDIRS => 3, CURLOPT_TIMEOUT => 5, CURLOPT_USERAGENT => 'Mozilla/5.0 (compatible; hyprcrd-bookmarks/1.0)', ]); - $favBytes = curl_exec($ch2); - $favStatus = curl_getinfo($ch2, CURLINFO_HTTP_CODE); - $favMime = curl_getinfo($ch2, CURLINFO_CONTENT_TYPE) ?: 'image/x-icon'; - curl_close($ch2); + if ($ch2) hyprcrdApplySafeCurlOpts($ch2); + $favBytes = $ch2 ? curl_exec($ch2) : false; + $favStatus = $ch2 ? curl_getinfo($ch2, CURLINFO_HTTP_CODE) : 0; + $favMime = $ch2 ? (curl_getinfo($ch2, CURLINFO_CONTENT_TYPE) ?: 'image/x-icon') : 'image/x-icon'; + if ($ch2) curl_close($ch2); if ($favBytes && $favStatus >= 200 && $favStatus < 400 && strlen($favBytes) <= 32768) { $mime = preg_replace('/;.*$/', '', $favMime); diff --git a/public/plugins/chat/backend.php b/public/plugins/chat/backend.php index 9153e50..82e18c2 100644 --- a/public/plugins/chat/backend.php +++ b/public/plugins/chat/backend.php @@ -108,24 +108,20 @@ function chatRelaySettings(): array { ]; } -/** Same envelope format as the existing relay sync (HYPRCRD-RELAY-V1). */ +/** Dual-format envelope shared with the relay sync path. Writes V2 + * (AES-GCM + HKDF), reads V2 + legacy V1 (CBC). Delegates to the central + * helpers so the format stays in lock-step with src/bootstrap.php and + * the relay's crypto.php. */ function chatEncrypt(string $plain, string $relayKey): string { - $encKey = substr(hash('sha256', $relayKey), 0, 32); - $iv = random_bytes(16); - $cipher = openssl_encrypt($plain, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv); - return "HYPRCRD-RELAY-V1\n" . base64_encode($iv . $cipher); + return hyprcrdRelayEncrypt($plain, $relayKey); } function chatDecrypt(string $envelope, string $relayKey): string { - if (!str_starts_with($envelope, 'HYPRCRD-RELAY-V1')) return ''; - $b64 = trim(substr($envelope, strlen('HYPRCRD-RELAY-V1') + 1)); - $raw = base64_decode($b64); - if (!$raw || strlen($raw) < 17) return ''; - $encKey = substr(hash('sha256', $relayKey), 0, 32); - $iv = substr($raw, 0, 16); - $cipher = substr($raw, 16); - $result = openssl_decrypt($cipher, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv); - return $result !== false ? $result : ''; + // Old behaviour returned '' for non-envelope strings; preserve that. + if (!str_starts_with($envelope, HYPRCRD_RELAY_GCM_MAGIC) && !str_starts_with($envelope, HYPRCRD_RELAY_CBC_MAGIC)) { + return ''; + } + return hyprcrdRelayDecrypt($envelope, $relayKey); } function chatGetState(string $key, $default = null) { diff --git a/public/plugins/collab-buckets/backend.php b/public/plugins/collab-buckets/backend.php index 3dbf9ef..561bbd6 100644 --- a/public/plugins/collab-buckets/backend.php +++ b/public/plugins/collab-buckets/backend.php @@ -110,32 +110,24 @@ "); })(); -/** Encrypt a JSON payload with the local relay_key using the same envelope - * format the rest of hyprcrd uses (HYPRCRD-RELAY-V1). */ +/** Encrypt a JSON payload with the local relay_key using the shared + * dual-format envelope (GCM-V2 writes, V1 read-only fallback lives in + * hyprcrdRelayDecrypt). */ function collabEncryptPayload(array $fields): ?string { $key = collabRelaySettings()['key'] ?? ''; if ($key === '') return null; - $encKey = substr(hash('sha256', $key), 0, 32); $plain = json_encode($fields); - $iv = random_bytes(16); - $cipher = openssl_encrypt($plain, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv); - if ($cipher === false) return null; - return "HYPRCRD-RELAY-V1\n" . base64_encode($iv . $cipher); + if ($plain === false) return null; + return hyprcrdRelayEncrypt($plain, $key); } /** Decrypt the inverse. Returns an associative array, or null on failure. */ function collabDecryptPayload(string $envelope): ?array { - if (!str_starts_with($envelope, 'HYPRCRD-RELAY-V1')) return null; - $b64 = trim(substr($envelope, strlen('HYPRCRD-RELAY-V1') + 1)); - $raw = base64_decode($b64); - if (!$raw || strlen($raw) < 17) return null; + if (!str_starts_with($envelope, HYPRCRD_RELAY_GCM_MAGIC) && !str_starts_with($envelope, HYPRCRD_RELAY_CBC_MAGIC)) return null; $key = collabRelaySettings()['key'] ?? ''; if ($key === '') return null; - $encKey = substr(hash('sha256', $key), 0, 32); - $iv = substr($raw, 0, 16); - $cipher = substr($raw, 16); - $plain = openssl_decrypt($cipher, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv); - if ($plain === false) return null; + $plain = hyprcrdRelayDecrypt($envelope, $key); + if ($plain === '') return null; $data = json_decode($plain, true); return is_array($data) ? $data : null; } diff --git a/public/plugins/tests/relay.test.js b/public/plugins/tests/relay.test.js index e611712..5c90e06 100644 --- a/public/plugins/tests/relay.test.js +++ b/public/plugins/tests/relay.test.js @@ -3,8 +3,10 @@ import { describe, it, expect, csrf } from './runner.js?v=4'; describe('Relay: Push API', () => { it('push without config returns error', async () => { const settings = await fetch('api/relay/settings').then(r => r.json()); - // The GET endpoint echoes the secret directly as `key` (single-user local app). - if (settings.url && settings.key) return; // skip if configured + // GET only reports `has_key` (boolean) — the secret itself is never + // echoed. If a relay is configured the real push may succeed or fail + // for other reasons, so skip in that case. + if (settings.url && settings.has_key) return; // skip if configured const res = await fetch('api/relay/push', { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() }, @@ -16,7 +18,7 @@ describe('Relay: Push API', () => { it('push without card_id returns error', async () => { const settings = await fetch('api/relay/settings').then(r => r.json()); - if (!settings.url || !settings.key) return; // card_id check is after config check + if (!settings.url || !settings.has_key) return; // card_id check is after config check const res = await fetch('api/relay/push', { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() }, body: JSON.stringify({}), @@ -28,7 +30,7 @@ describe('Relay: Push API', () => { describe('Relay: Poll API', () => { it('poll without config returns 0 pulled', async () => { const settings = await fetch('api/relay/settings').then(r => r.json()); - if (settings.url && settings.key) return; + if (settings.url && settings.has_key) return; const res = await fetch('api/relay/poll', { method: 'POST', headers: { 'X-CSRF-Token': csrf() }, diff --git a/relay/inc/bootstrap.php b/relay/inc/bootstrap.php index 2f3edd4..1e900f8 100644 --- a/relay/inc/bootstrap.php +++ b/relay/inc/bootstrap.php @@ -395,6 +395,34 @@ $db->exec('CREATE TABLE IF NOT EXISTS rate_limits ( attempted_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP )'); +// ── v3.x → v1.10 crypto migration ──────────────────────────────── +// Re-encrypt master-wrapped secrets (tenant client secrets + inter-tenant +// key) from CBC-V1 to GCM-V2. This only touches data we already hold the +// master key for, so no user action is needed and no secrets change — +// only the envelope around them. Idempotent: rows already in V2 skip. +require_once __DIR__ . '/crypto.php'; +if (tableExists($db, 'tenants')) { + $legacyTenantRows = $db->query("SELECT id, secret_encrypted FROM tenants WHERE secret_encrypted IS NOT NULL AND secret_encrypted != '' AND secret_encrypted NOT LIKE '" . HYPRCRD_GCM_MAGIC_MASTER . "%'")->fetchAll(); + if ($legacyTenantRows) { + $upd = $db->prepare('UPDATE tenants SET secret_encrypted = :s WHERE id = :i'); + foreach ($legacyTenantRows as $r) { + $plain = masterDecrypt($r['secret_encrypted'], $MASTER_KEY); + if ($plain !== '') { + $upd->execute(['s' => masterEncrypt($plain, $MASTER_KEY), 'i' => $r['id']]); + } + } + @error_log('[hyprcrd-relay] migrated ' . count($legacyTenantRows) . ' tenant secret_encrypted rows to GCM-V2'); + } + $legacyItk = $db->query("SELECT value FROM settings WHERE key = 'inter_tenant_key'")->fetchColumn(); + if ($legacyItk && !str_starts_with($legacyItk, HYPRCRD_GCM_MAGIC_MASTER)) { + $plainItk = masterDecrypt($legacyItk, $MASTER_KEY); + if ($plainItk !== '') { + setInterTenantKey($db, $MASTER_KEY, $plainItk); + @error_log('[hyprcrd-relay] migrated inter-tenant key to GCM-V2'); + } + } +} + // Cleanup: 24h ephemeral storage, expired sessions, old rate limits $db->exec("DELETE FROM messages WHERE created_at < datetime('now', '-24 hours')"); $db->exec("DELETE FROM attachments WHERE created_at < datetime('now', '-24 hours')"); diff --git a/relay/inc/crypto.php b/relay/inc/crypto.php index 13bee32..c83d6e0 100644 --- a/relay/inc/crypto.php +++ b/relay/inc/crypto.php @@ -1,24 +1,54 @@ query("SELECT value FROM settings WHERE key = 'inter_tenant_key'")->fetchColumn(); diff --git a/relay/inc/routes/account.php b/relay/inc/routes/account.php index abf6988..63fe233 100644 --- a/relay/inc/routes/account.php +++ b/relay/inc/routes/account.php @@ -52,11 +52,14 @@ if ($route === '/api/account/secret' && $method === 'DELETE') { if ($route === '/api/account/password' && $method === 'POST') { if (!$sessionTenant) jsonResponse(['error' => 'not logged in'], 401); + // Rate-limit password changes — a stolen session cookie could otherwise + // brute-force the `current` field server-side with no friction. + if (isRateLimited($db, 'account-password', 10)) jsonResponse(['error' => 'too many attempts'], 429); $input = json_decode(file_get_contents('php://input'), true) ?: []; $current = (string)($input['current'] ?? ''); $new = (string)($input['new'] ?? ''); - if (strlen($new) < 4) jsonResponse(['error' => 'new password must be at least 4 chars'], 400); + if (strlen($new) < 10) jsonResponse(['error' => 'new password must be at least 10 chars'], 400); if (!password_verify($current, $sessionTenant['password_hash'])) { jsonResponse(['error' => 'current password is wrong'], 401); } diff --git a/relay/inc/routes/admin.php b/relay/inc/routes/admin.php index f53da58..83cbcf5 100644 --- a/relay/inc/routes/admin.php +++ b/relay/inc/routes/admin.php @@ -28,7 +28,7 @@ if ($route === '/api/users' && $method === 'POST') { if (!preg_match('/^[a-zA-Z0-9_-]{2,32}$/', $username)) { jsonResponse(['error' => 'username must be 2-32 chars: letters, digits, _ or -'], 400); } - if (strlen($password) < 4) jsonResponse(['error' => 'password must be at least 4 chars'], 400); + if (strlen($password) < 10) jsonResponse(['error' => 'password must be at least 10 chars'], 400); if (getTenantByUsername($db, $username)) jsonResponse(['error' => 'username already exists'], 409); // No client secret — the new user sets that themselves after first login @@ -53,7 +53,7 @@ if (preg_match('#^/api/users/(\d+)$#', $route, $m) && $method === 'PATCH') { $input = json_decode(file_get_contents('php://input'), true) ?: []; $fields = []; $params = ['id' => $id]; if (!empty($input['password'])) { - if (strlen($input['password']) < 4) jsonResponse(['error' => 'password too short'], 400); + if (strlen($input['password']) < 10) jsonResponse(['error' => 'password must be at least 10 chars'], 400); $fields[] = 'password_hash = :pw'; $params['pw'] = password_hash($input['password'], PASSWORD_BCRYPT); } diff --git a/relay/inc/routes/chat.php b/relay/inc/routes/chat.php index 2728ea3..6629195 100644 --- a/relay/inc/routes/chat.php +++ b/relay/inc/routes/chat.php @@ -93,7 +93,7 @@ if ($route === '/api/chat/send' && $method === 'POST' && $sessionTenant) { if ($body === '') jsonResponse(['error' => 'body required'], 400); if ($recipientName === '') jsonResponse(['error' => 'recipient required'], 400); $recipient = getTenantByUsername($db, $recipientName); - if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404); + if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404); $interKey = getInterTenantKey($db, $MASTER_KEY); if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500); $stored = clientEncrypt($body, $interKey); @@ -122,7 +122,7 @@ if ($route === '/api/sync-events' && $method === 'POST') { if ($recipientName === '') jsonResponse(['error' => 'recipient required'], 400); if ($recipientName === $clientTenant['username']) jsonResponse(['ok' => true, 'id' => 0]); // suppress self-notifications $recipient = getTenantByUsername($db, $recipientName); - if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404); + if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404); $db->prepare('INSERT INTO relay_sync_events (recipient_id, sender_username, body) VALUES (:r, :sn, :b)') ->execute(['r' => $recipient['id'], 'sn' => $clientTenant['username'], 'b' => $body]); jsonResponse(['ok' => true, 'id' => (int)$db->lastInsertId()]); @@ -193,7 +193,8 @@ if ($route === '/api/chat/rooms' && $method === 'POST') { $db->commit(); } catch (Throwable $e) { if ($db->inTransaction()) $db->rollBack(); - jsonResponse(['error' => 'create failed: ' . $e->getMessage()], 500); + @error_log('[hyprcrd-relay] chat room create failed: ' . $e->getMessage()); + jsonResponse(['error' => 'create failed'], 500); } jsonResponse(['ok' => true, 'uid' => $uid, 'members' => array_values($resolved)]); } @@ -306,7 +307,7 @@ if ($route === '/api/chat' && $method === 'POST') { ->execute(['me' => $clientTenant['id'], 's' => $clientTenant['id'], 'sn' => $clientTenant['username'], 'ru' => $roomUid, 'b' => $stored]); } else { $recipient = getTenantByUsername($db, $recipientName); - if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404); + if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404); $db->prepare('INSERT INTO chat_messages (recipient_id, sender_id, sender_username, body, persistent) VALUES (:r, :s, :sn, :b, :p)') ->execute([ 'r' => $recipient['id'], @@ -417,7 +418,7 @@ if ($route === '/api/chat/backfill' && $method === 'GET') { $stmt->execute(); } else { $peerTenant = getTenantByUsername($db, $peer); - if (!$peerTenant) jsonResponse(['error' => "no such user: $peer"], 404); + if (!$peerTenant) jsonResponse(['error' => 'peer not found'], 404); $sql = "SELECT id, sender_id, sender_username, room_uid, body, created_at FROM chat_messages WHERE room_uid IS NULL diff --git a/relay/inc/routes/collab-buckets.php b/relay/inc/routes/collab-buckets.php index 5123ffa..cd34d9f 100644 --- a/relay/inc/routes/collab-buckets.php +++ b/relay/inc/routes/collab-buckets.php @@ -50,7 +50,8 @@ if ($route === '/api/collab-buckets' && $method === 'POST') { $db->commit(); } catch (Throwable $e) { if ($db->inTransaction()) $db->rollBack(); - jsonResponse(['error' => 'create failed: ' . $e->getMessage()], 500); + @error_log('[hyprcrd-relay] collab bucket create failed: ' . $e->getMessage()); + jsonResponse(['error' => 'create failed'], 500); } jsonResponse(['ok' => true, 'uid' => $uid, 'members' => array_values($resolved)]); } @@ -102,7 +103,7 @@ if (preg_match('#^/api/collab-buckets/([a-zA-Z0-9_-]+)$#', $route, $m) && $metho $newOwnerName = trim((string)$input['owner']); if ($newOwnerName === '') jsonResponse(['error' => 'owner cannot be empty'], 400); $newOwner = getTenantByUsername($db, $newOwnerName); - if (!$newOwner) jsonResponse(['error' => "no such user: $newOwnerName"], 404); + if (!$newOwner) jsonResponse(['error' => 'user not found'], 404); $memCheck = $db->prepare('SELECT 1 FROM collab_bucket_members WHERE bucket_uid = :b AND tenant_id = :t'); $memCheck->execute(['b' => $uid, 't' => $newOwner['id']]); if (!$memCheck->fetchColumn()) { diff --git a/relay/inc/routes/collab-cards.php b/relay/inc/routes/collab-cards.php index f940db8..1a4955e 100644 --- a/relay/inc/routes/collab-cards.php +++ b/relay/inc/routes/collab-cards.php @@ -243,6 +243,14 @@ if (preg_match('#^/api/collab-cards/([a-zA-Z0-9_-]+)/([a-zA-Z0-9_-]+)$#', $route // ── Collab attachments (images/PDFs/audio referenced by collab cards) ─ +// Attachment filenames always follow the hyprcrd upload pattern +// (bin2hex(random_bytes(16)).). Enforce server-side so malicious +// clients can't poison the DB with traversal-shaped names that later +// surface in UIs or get forwarded to filesystem APIs. +function collabAttachmentFilenameValid(string $fn): bool { + return (bool)preg_match('/^[a-f0-9]{8,64}\.[a-z0-9]{1,8}$/', $fn); +} + if ($route === '/api/collab-attachments' && $method === 'POST') { if (!$clientTenant) jsonResponse(['error' => 'unauthorized'], 401); $input = json_decode(file_get_contents('php://input'), true) ?: []; @@ -250,6 +258,7 @@ if ($route === '/api/collab-attachments' && $method === 'POST') { $filename = (string)($input['filename'] ?? ''); $data = (string)($input['data'] ?? ''); if (!$bucketUid || !$filename || !$data) jsonResponse(['error' => 'bucket_uid, filename, and data required'], 400); + if (!collabAttachmentFilenameValid($filename)) jsonResponse(['error' => 'invalid filename'], 400); if (!collabCardsIsMember($db, $bucketUid, (int)$clientTenant['id'])) { jsonResponse(['error' => 'not a member of this bucket'], 403); } @@ -277,6 +286,7 @@ if ($route === '/api/collab-attachments' && $method === 'GET') { $bucketUid = trim($_GET['bucket_uid'] ?? ''); $filename = trim($_GET['filename'] ?? ''); if (!$bucketUid) jsonResponse(['error' => 'bucket_uid required'], 400); + if ($filename !== '' && !collabAttachmentFilenameValid($filename)) jsonResponse(['error' => 'invalid filename'], 400); if (!collabCardsIsMember($db, $bucketUid, (int)$clientTenant['id'])) { jsonResponse(['error' => 'not a member of this bucket'], 403); } diff --git a/relay/inc/routes/collab-locks.php b/relay/inc/routes/collab-locks.php index 953e8c6..18c1370 100644 --- a/relay/inc/routes/collab-locks.php +++ b/relay/inc/routes/collab-locks.php @@ -20,6 +20,13 @@ function collabLocksIsMember(PDO $db, string $bucketUid, int $tenantId): bool { // ── POST: acquire/refresh ──────────────────────────────────────── +// Maximum time a single holder can keep refreshing the same lock. Without a +// cap a malicious member could heartbeat forever, blocking every other +// member's writes. 10 minutes is long enough for any real edit session and +// short enough to time-box grief. When the cap is hit the lock is force- +// released and the client must re-acquire — giving everyone else a window. +const COLLAB_LOCK_MAX_HOLD_SECONDS = 600; + if ($route === '/api/collab-locks' && $method === 'POST') { if (!$clientTenant) jsonResponse(['error' => 'unauthorized'], 401); if (isRateLimited($db, 'collab-locks-post', 240)) jsonResponse(['error' => 'rate limited'], 429); @@ -35,8 +42,12 @@ if ($route === '/api/collab-locks' && $method === 'POST') { // narrow window between cleanup and this query. $db->prepare("DELETE FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c AND expires_at <= datetime('now')") ->execute(['b' => $bucketUid, 'c' => $cardUid]); + // Also drop locks that have been refreshed past the max hold window — + // cap enforcement for grief prevention. + $db->prepare("DELETE FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c AND acquired_at <= datetime('now', '-" . COLLAB_LOCK_MAX_HOLD_SECONDS . " seconds')") + ->execute(['b' => $bucketUid, 'c' => $cardUid]); // Existing live lock? If a different tenant holds it, refuse. - $cur = $db->prepare('SELECT holder_id, holder_username, expires_at FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c'); + $cur = $db->prepare('SELECT holder_id, holder_username, expires_at, acquired_at FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c'); $cur->execute(['b' => $bucketUid, 'c' => $cardUid]); $existing = $cur->fetch(); if ($existing && (int)$existing['holder_id'] !== (int)$clientTenant['id']) { diff --git a/relay/inc/routes/messages.php b/relay/inc/routes/messages.php index bf3f901..6536f59 100644 --- a/relay/inc/routes/messages.php +++ b/relay/inc/routes/messages.php @@ -21,7 +21,7 @@ if ($route === '/api/messages' && $method === 'POST' && $sessionTenant && empty( if ($body === '') jsonResponse(['error' => 'body required'], 400); $recipient = getTenantByUsername($db, $recipientName); - if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404); + if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404); $interKey = getInterTenantKey($db, $MASTER_KEY); if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500); @@ -54,7 +54,7 @@ if ($route === '/api/attachments/upload' && $method === 'POST' && $sessionTenant if (!$relayUid) jsonResponse(['error' => 'relay_uid required'], 400); $recipient = getTenantByUsername($db, $recipientName); - if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404); + if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404); $interKey = getInterTenantKey($db, $MASTER_KEY); if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500); @@ -142,7 +142,7 @@ if ($route === '/api/messages' && $method === 'POST') { if ($encryptedBody === '') jsonResponse(['error' => 'body required'], 400); $recipient = getTenantByUsername($db, $recipientName); - if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404); + if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404); // Decrypt with sender's secret if (empty($clientTenant['secret_encrypted'])) { @@ -225,9 +225,12 @@ if ($route === '/api/attachments' && $method === 'POST') { $data = (string)($input['data'] ?? ''); $recipientName = trim((string)($input['recipient'] ?? $clientTenant['username'])); if (!$relayUid || !$filename || !$data) jsonResponse(['error' => 'relay_uid, filename, and data required'], 400); + // Enforce the hyprcrd upload naming scheme server-side so traversal-shaped + // names never enter storage or get forwarded back to other clients. + if (!preg_match('/^[a-f0-9]{8,64}\.[a-z0-9]{1,8}$/', $filename)) jsonResponse(['error' => 'invalid filename'], 400); $recipient = getTenantByUsername($db, $recipientName); - if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404); + if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404); // Decrypt-reencrypt hop, same shape as messages: arrives encrypted with // sender's secret, gets stored at-rest under the inter-tenant key. diff --git a/relay/inc/routes/public.php b/relay/inc/routes/public.php index ad677c8..1a83ca5 100644 --- a/relay/inc/routes/public.php +++ b/relay/inc/routes/public.php @@ -49,7 +49,7 @@ if ($route === '/api/setup' && $method === 'POST') { if (!preg_match('/^[a-zA-Z0-9_-]{2,32}$/', $username)) { jsonResponse(['error' => 'username must be 2-32 chars: letters, digits, _ or -'], 400); } - if (strlen($password) < 4) jsonResponse(['error' => 'password must be at least 4 chars'], 400); + if (strlen($password) < 10) jsonResponse(['error' => 'password must be at least 10 chars'], 400); if (strlen($superSecret) < 12) jsonResponse(['error' => 'super-shared secret must be at least 12 chars'], 400); // Create the admin tenant. NO client secret yet — the admin (and every diff --git a/relay/index.php b/relay/index.php index d832f1a..dd92dd8 100644 --- a/relay/index.php +++ b/relay/index.php @@ -40,10 +40,25 @@ $isSetup = tenantCount($db) === 0; if (str_starts_with($route, '/api/')) { header('Content-Type: application/json'); + // CORS: the hyprcrd client hits us server-side (no browser CORS in play) + // and the relay UI lives same-origin, so the only legitimate cross-origin + // callers are other tenant UIs on the same relay host. We allow the + // relay's own scheme+host, plus an opt-in allowlist via RELAY_CORS_ORIGINS + // (comma-separated). Credentials are intentionally NOT allowed — API auth + // is header-based (X-Relay-User/Key) and the UI is same-origin. $origin = $_SERVER['HTTP_ORIGIN'] ?? ''; - if ($origin) { + $ownScheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https' ? 'https' : 'http'; + $ownOrigin = $ownScheme . '://' . ($_SERVER['HTTP_HOST'] ?? ''); + $allowed = [$ownOrigin]; + $extra = getenv('RELAY_CORS_ORIGINS'); + if ($extra) { + foreach (explode(',', $extra) as $o) { + $o = trim($o); + if ($o !== '') $allowed[] = $o; + } + } + if ($origin && in_array($origin, $allowed, true)) { header('Access-Control-Allow-Origin: ' . $origin); - header('Access-Control-Allow-Credentials: true'); header('Vary: Origin'); } header('Access-Control-Allow-Headers: Content-Type, X-Relay-User, X-Relay-Key'); diff --git a/relay/ui/app.js b/relay/ui/app.js index f3d745e..ec755b3 100644 --- a/relay/ui/app.js +++ b/relay/ui/app.js @@ -199,7 +199,7 @@ async function doChangePassword() { const err = $('cp-err'); err.textContent = ''; if (!current || !newPw) { err.textContent = 'all fields required'; return; } - if (newPw.length < 4) { err.textContent = 'new password too short'; return; } + if (newPw.length < 10) { err.textContent = 'new password must be at least 10 chars'; return; } if (newPw !== newPw2) { err.textContent = 'new passwords don\'t match'; return; } if (current === newPw) { err.textContent = 'new password must differ from current'; return; } @@ -231,7 +231,7 @@ async function doSetup() { const err = $('setup-err'); err.textContent = ''; if (!username) { err.textContent = 'username required'; return; } - if (password.length < 4) { err.textContent = 'password too short'; return; } + if (password.length < 10) { err.textContent = 'password must be at least 10 chars'; return; } if (superSecret.length < 12) { err.textContent = 'super-shared secret needs at least 12 chars'; return; } const res = await api('api/setup', { method: 'POST', body: { username, password, super_secret: superSecret } }); if (res.ok) { @@ -1039,8 +1039,8 @@ async function createUser() { } async function resetUserPassword(id, username) { - const newPw = prompt(`new password for ${username} (min 4 chars):`); - if (!newPw || newPw.length < 4) { toast('password too short', true); return; } + const newPw = prompt(`new password for ${username} (min 10 chars):`); + if (!newPw || newPw.length < 10) { toast('password too short', true); return; } const res = await api('api/users/' + id, { method: 'PATCH', body: { password: newPw } }); if (res.ok) toast('password updated'); else toast(res.error || 'failed', true); diff --git a/relay/ui/layout.php b/relay/ui/layout.php index 9cf75d1..23e37b6 100644 --- a/relay/ui/layout.php +++ b/relay/ui/layout.php @@ -47,7 +47,7 @@ if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
- +
@@ -144,7 +144,7 @@ if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
- +
@@ -205,7 +205,7 @@ if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
- +