nextcloud / server

lib/private/Security/CertificateManager.php

Indentation +244 added lines, -244 removed lines

@@ -44,248 +44,248 @@
  * Manage trusted certificates for users
  */
 class CertificateManager implements ICertificateManager {
-	protected View $view;
-	protected IConfig $config;
-	protected LoggerInterface $logger;
-	protected ISecureRandom $random;
-
-	private ?string $bundlePath = null;
-
-	public function __construct(View $view,
-								IConfig $config,
-								LoggerInterface $logger,
-								ISecureRandom $random) {
-		$this->view = $view;
-		$this->config = $config;
-		$this->logger = $logger;
-		$this->random = $random;
-	}
-
-	/**
-	 * Returns all certificates trusted by the user
-	 *
-	 * @return \OCP\ICertificate[]
-	 */
-	public function listCertificates(): array {
-		if (!$this->config->getSystemValueBool('installed', false)) {
-			return [];
-		}
-
-		$path = $this->getPathToCertificates() . 'uploads/';
-		if (!$this->view->is_dir($path)) {
-			return [];
-		}
-		$result = [];
-		$handle = $this->view->opendir($path);
-		if (!is_resource($handle)) {
-			return [];
-		}
-		while (false !== ($file = readdir($handle))) {
-			if ($file != '.' && $file != '..') {
-				try {
-					$content = $this->view->file_get_contents($path . $file);
-					if ($content !== false) {
-						$result[] = new Certificate($content, $file);
-					} else {
-						$this->logger->error("Failed to read certificate from $path");
-					}
-				} catch (\Exception $e) {
-					$this->logger->error("Failed to read certificate from $path", ['exception' => $e]);
-				}
-			}
-		}
-		closedir($handle);
-		return $result;
-	}
-
-	private function hasCertificates(): bool {
-		if (!$this->config->getSystemValueBool('installed', false)) {
-			return false;
-		}
-
-		$path = $this->getPathToCertificates() . 'uploads/';
-		if (!$this->view->is_dir($path)) {
-			return false;
-		}
-		$result = [];
-		$handle = $this->view->opendir($path);
-		if (!is_resource($handle)) {
-			return false;
-		}
-		while (false !== ($file = readdir($handle))) {
-			if ($file !== '.' && $file !== '..') {
-				return true;
-			}
-		}
-		closedir($handle);
-		return false;
-	}
-
-	/**
-	 * create the certificate bundle of all trusted certificated
-	 */
-	public function createCertificateBundle(): void {
-		$path = $this->getPathToCertificates();
-		$certs = $this->listCertificates();
-
-		if (!$this->view->file_exists($path)) {
-			$this->view->mkdir($path);
-		}
-
-		$defaultCertificates = file_get_contents(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
-		if (strlen($defaultCertificates) < 1024) { // sanity check to verify that we have some content for our bundle
-			// log as exception so we have a stacktrace
-			$e = new \Exception('Shipped ca-bundle is empty, refusing to create certificate bundle');
-			$this->logger->error($e->getMessage(), ['exception' => $e]);
-			return;
-		}
-
-		$certPath = $path . 'rootcerts.crt';
-		$tmpPath = $certPath . '.tmp' . $this->random->generate(10, ISecureRandom::CHAR_DIGITS);
-		$fhCerts = $this->view->fopen($tmpPath, 'w');
-
-		if (!is_resource($fhCerts)) {
-			throw new \RuntimeException('Unable to open file handler to create certificate bundle "' . $tmpPath . '".');
-		}
-
-		// Write user certificates
-		foreach ($certs as $cert) {
-			$file = $path . '/uploads/' . $cert->getName();
-			$data = $this->view->file_get_contents($file);
-			if (strpos($data, 'BEGIN CERTIFICATE')) {
-				fwrite($fhCerts, $data);
-				fwrite($fhCerts, "\r\n");
-			}
-		}
-
-		// Append the default certificates
-		fwrite($fhCerts, $defaultCertificates);
-
-		// Append the system certificate bundle
-		$systemBundle = $this->getCertificateBundle();
-		if ($systemBundle !== $certPath && $this->view->file_exists($systemBundle)) {
-			$systemCertificates = $this->view->file_get_contents($systemBundle);
-			fwrite($fhCerts, $systemCertificates);
-		}
-
-		fclose($fhCerts);
-
-		$this->view->rename($tmpPath, $certPath);
-	}
-
-	/**
-	 * Save the certificate and re-generate the certificate bundle
-	 *
-	 * @param string $certificate the certificate data
-	 * @param string $name the filename for the certificate
-	 * @return \OCP\ICertificate
-	 * @throws \Exception If the certificate could not get added
-	 */
-	public function addCertificate(string $certificate, string $name): ICertificate {
-		if (!Filesystem::isValidPath($name) or Filesystem::isFileBlacklisted($name)) {
-			throw new \Exception('Filename is not valid');
-		}
-		$this->bundlePath = null;
-
-		$dir = $this->getPathToCertificates() . 'uploads/';
-		if (!$this->view->file_exists($dir)) {
-			$this->view->mkdir($dir);
-		}
-
-		try {
-			$file = $dir . $name;
-			$certificateObject = new Certificate($certificate, $name);
-			$this->view->file_put_contents($file, $certificate);
-			$this->createCertificateBundle();
-			return $certificateObject;
-		} catch (\Exception $e) {
-			throw $e;
-		}
-	}
-
-	/**
-	 * Remove the certificate and re-generate the certificate bundle
-	 *
-	 * @param string $name
-	 * @return bool
-	 */
-	public function removeCertificate(string $name): bool {
-		if (!Filesystem::isValidPath($name)) {
-			return false;
-		}
-		$this->bundlePath = null;
-
-		$path = $this->getPathToCertificates() . 'uploads/';
-		if ($this->view->file_exists($path . $name)) {
-			$this->view->unlink($path . $name);
-			$this->createCertificateBundle();
-		}
-		return true;
-	}
-
-	/**
-	 * Get the path to the certificate bundle
-	 *
-	 * @return string
-	 */
-	public function getCertificateBundle(): string {
-		return $this->getPathToCertificates() . 'rootcerts.crt';
-	}
-
-	/**
-	 * Get the full local path to the certificate bundle
-	 * @throws \Exception when getting bundle path fails
-	 */
-	public function getAbsoluteBundlePath(): string {
-		try {
-			if ($this->bundlePath === null) {
-				if (!$this->hasCertificates()) {
-					$this->bundlePath = \OC::$SERVERROOT . '/resources/config/ca-bundle.crt';
-				}
-
-				if ($this->needsRebundling()) {
-					$this->createCertificateBundle();
-				}
-
-				$certificateBundle = $this->getCertificateBundle();
-				$this->bundlePath = $this->view->getLocalFile($certificateBundle) ?: null;
-
-				if ($this->bundlePath === null) {
-					throw new \RuntimeException('Unable to get certificate bundle "' . $certificateBundle . '".');
-				}
-			}
-			return $this->bundlePath;
-		} catch (\Exception $e) {
-			$this->logger->error('Failed to get absolute bundle path. Fallback to default ca-bundle.crt', ['exception' => $e]);
-			return \OC::$SERVERROOT . '/resources/config/ca-bundle.crt';
-		}
-	}
-
-	private function getPathToCertificates(): string {
-		return '/files_external/';
-	}
-
-	/**
-	 * Check if we need to re-bundle the certificates because one of the sources has updated
-	 *
-	 * @return bool
-	 */
-	private function needsRebundling(): bool {
-		$targetBundle = $this->getCertificateBundle();
-		if (!$this->view->file_exists($targetBundle)) {
-			return true;
-		}
-
-		$sourceMTime = $this->getFilemtimeOfCaBundle();
-		return $sourceMTime > $this->view->filemtime($targetBundle);
-	}
-
-	/**
-	 * get mtime of ca-bundle shipped by Nextcloud
-	 *
-	 * @return int
-	 */
-	protected function getFilemtimeOfCaBundle(): int {
-		return filemtime(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
-	}
+    protected View $view;
+    protected IConfig $config;
+    protected LoggerInterface $logger;
+    protected ISecureRandom $random;
+
+    private ?string $bundlePath = null;
+
+    public function __construct(View $view,
+                                IConfig $config,
+                                LoggerInterface $logger,
+                                ISecureRandom $random) {
+        $this->view = $view;
+        $this->config = $config;
+        $this->logger = $logger;
+        $this->random = $random;
+    }
+
+    /**
+     * Returns all certificates trusted by the user
+     *
+     * @return \OCP\ICertificate[]
+     */
+    public function listCertificates(): array {
+        if (!$this->config->getSystemValueBool('installed', false)) {
+            return [];
+        }
+
+        $path = $this->getPathToCertificates() . 'uploads/';
+        if (!$this->view->is_dir($path)) {
+            return [];
+        }
+        $result = [];
+        $handle = $this->view->opendir($path);
+        if (!is_resource($handle)) {
+            return [];
+        }
+        while (false !== ($file = readdir($handle))) {
+            if ($file != '.' && $file != '..') {
+                try {
+                    $content = $this->view->file_get_contents($path . $file);
+                    if ($content !== false) {
+                        $result[] = new Certificate($content, $file);
+                    } else {
+                        $this->logger->error("Failed to read certificate from $path");
+                    }
+                } catch (\Exception $e) {
+                    $this->logger->error("Failed to read certificate from $path", ['exception' => $e]);
+                }
+            }
+        }
+        closedir($handle);
+        return $result;
+    }
+
+    private function hasCertificates(): bool {
+        if (!$this->config->getSystemValueBool('installed', false)) {
+            return false;
+        }
+
+        $path = $this->getPathToCertificates() . 'uploads/';
+        if (!$this->view->is_dir($path)) {
+            return false;
+        }
+        $result = [];
+        $handle = $this->view->opendir($path);
+        if (!is_resource($handle)) {
+            return false;
+        }
+        while (false !== ($file = readdir($handle))) {
+            if ($file !== '.' && $file !== '..') {
+                return true;
+            }
+        }
+        closedir($handle);
+        return false;
+    }
+
+    /**
+     * create the certificate bundle of all trusted certificated
+     */
+    public function createCertificateBundle(): void {
+        $path = $this->getPathToCertificates();
+        $certs = $this->listCertificates();
+
+        if (!$this->view->file_exists($path)) {
+            $this->view->mkdir($path);
+        }
+
+        $defaultCertificates = file_get_contents(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
+        if (strlen($defaultCertificates) < 1024) { // sanity check to verify that we have some content for our bundle
+            // log as exception so we have a stacktrace
+            $e = new \Exception('Shipped ca-bundle is empty, refusing to create certificate bundle');
+            $this->logger->error($e->getMessage(), ['exception' => $e]);
+            return;
+        }
+
+        $certPath = $path . 'rootcerts.crt';
+        $tmpPath = $certPath . '.tmp' . $this->random->generate(10, ISecureRandom::CHAR_DIGITS);
+        $fhCerts = $this->view->fopen($tmpPath, 'w');
+
+        if (!is_resource($fhCerts)) {
+            throw new \RuntimeException('Unable to open file handler to create certificate bundle "' . $tmpPath . '".');
+        }
+
+        // Write user certificates
+        foreach ($certs as $cert) {
+            $file = $path . '/uploads/' . $cert->getName();
+            $data = $this->view->file_get_contents($file);
+            if (strpos($data, 'BEGIN CERTIFICATE')) {
+                fwrite($fhCerts, $data);
+                fwrite($fhCerts, "\r\n");
+            }
+        }
+
+        // Append the default certificates
+        fwrite($fhCerts, $defaultCertificates);
+
+        // Append the system certificate bundle
+        $systemBundle = $this->getCertificateBundle();
+        if ($systemBundle !== $certPath && $this->view->file_exists($systemBundle)) {
+            $systemCertificates = $this->view->file_get_contents($systemBundle);
+            fwrite($fhCerts, $systemCertificates);
+        }
+
+        fclose($fhCerts);
+
+        $this->view->rename($tmpPath, $certPath);
+    }
+
+    /**
+     * Save the certificate and re-generate the certificate bundle
+     *
+     * @param string $certificate the certificate data
+     * @param string $name the filename for the certificate
+     * @return \OCP\ICertificate
+     * @throws \Exception If the certificate could not get added
+     */
+    public function addCertificate(string $certificate, string $name): ICertificate {
+        if (!Filesystem::isValidPath($name) or Filesystem::isFileBlacklisted($name)) {
+            throw new \Exception('Filename is not valid');
+        }
+        $this->bundlePath = null;
+
+        $dir = $this->getPathToCertificates() . 'uploads/';
+        if (!$this->view->file_exists($dir)) {
+            $this->view->mkdir($dir);
+        }
+
+        try {
+            $file = $dir . $name;
+            $certificateObject = new Certificate($certificate, $name);
+            $this->view->file_put_contents($file, $certificate);
+            $this->createCertificateBundle();
+            return $certificateObject;
+        } catch (\Exception $e) {
+            throw $e;
+        }
+    }
+
+    /**
+     * Remove the certificate and re-generate the certificate bundle
+     *
+     * @param string $name
+     * @return bool
+     */
+    public function removeCertificate(string $name): bool {
+        if (!Filesystem::isValidPath($name)) {
+            return false;
+        }
+        $this->bundlePath = null;
+
+        $path = $this->getPathToCertificates() . 'uploads/';
+        if ($this->view->file_exists($path . $name)) {
+            $this->view->unlink($path . $name);
+            $this->createCertificateBundle();
+        }
+        return true;
+    }
+
+    /**
+     * Get the path to the certificate bundle
+     *
+     * @return string
+     */
+    public function getCertificateBundle(): string {
+        return $this->getPathToCertificates() . 'rootcerts.crt';
+    }
+
+    /**
+     * Get the full local path to the certificate bundle
+     * @throws \Exception when getting bundle path fails
+     */
+    public function getAbsoluteBundlePath(): string {
+        try {
+            if ($this->bundlePath === null) {
+                if (!$this->hasCertificates()) {
+                    $this->bundlePath = \OC::$SERVERROOT . '/resources/config/ca-bundle.crt';
+                }
+
+                if ($this->needsRebundling()) {
+                    $this->createCertificateBundle();
+                }
+
+                $certificateBundle = $this->getCertificateBundle();
+                $this->bundlePath = $this->view->getLocalFile($certificateBundle) ?: null;
+
+                if ($this->bundlePath === null) {
+                    throw new \RuntimeException('Unable to get certificate bundle "' . $certificateBundle . '".');
+                }
+            }
+            return $this->bundlePath;
+        } catch (\Exception $e) {
+            $this->logger->error('Failed to get absolute bundle path. Fallback to default ca-bundle.crt', ['exception' => $e]);
+            return \OC::$SERVERROOT . '/resources/config/ca-bundle.crt';
+        }
+    }
+
+    private function getPathToCertificates(): string {
+        return '/files_external/';
+    }
+
+    /**
+     * Check if we need to re-bundle the certificates because one of the sources has updated
+     *
+     * @return bool
+     */
+    private function needsRebundling(): bool {
+        $targetBundle = $this->getCertificateBundle();
+        if (!$this->view->file_exists($targetBundle)) {
+            return true;
+        }
+
+        $sourceMTime = $this->getFilemtimeOfCaBundle();
+        return $sourceMTime > $this->view->filemtime($targetBundle);
+    }
+
+    /**
+     * get mtime of ca-bundle shipped by Nextcloud
+     *
+     * @return int
+     */
+    protected function getFilemtimeOfCaBundle(): int {
+        return filemtime(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
+    }
 }

Spacing +18 added lines, -18 removed lines

@@ -71,7 +71,7 @@ 
 			return [];
 		}
 
-		$path = $this->getPathToCertificates() . 'uploads/';
+		$path = $this->getPathToCertificates().'uploads/';
 		if (!$this->view->is_dir($path)) {
 			return [];
 		}
@@ -83,7 +83,7 @@ 
 		while (false !== ($file = readdir($handle))) {
 			if ($file != '.' && $file != '..') {
 				try {
-					$content = $this->view->file_get_contents($path . $file);
+					$content = $this->view->file_get_contents($path.$file);
 					if ($content !== false) {
 						$result[] = new Certificate($content, $file);
 					} else {
@@ -103,7 +103,7 @@ 
 			return false;
 		}
 
-		$path = $this->getPathToCertificates() . 'uploads/';
+		$path = $this->getPathToCertificates().'uploads/';
 		if (!$this->view->is_dir($path)) {
 			return false;
 		}
@@ -132,7 +132,7 @@ 
 			$this->view->mkdir($path);
 		}
 
-		$defaultCertificates = file_get_contents(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
+		$defaultCertificates = file_get_contents(\OC::$SERVERROOT.'/resources/config/ca-bundle.crt');
 		if (strlen($defaultCertificates) < 1024) { // sanity check to verify that we have some content for our bundle
 			// log as exception so we have a stacktrace
 			$e = new \Exception('Shipped ca-bundle is empty, refusing to create certificate bundle');
@@ -140,17 +140,17 @@ 
 			return;
 		}
 
-		$certPath = $path . 'rootcerts.crt';
-		$tmpPath = $certPath . '.tmp' . $this->random->generate(10, ISecureRandom::CHAR_DIGITS);
+		$certPath = $path.'rootcerts.crt';
+		$tmpPath = $certPath.'.tmp'.$this->random->generate(10, ISecureRandom::CHAR_DIGITS);
 		$fhCerts = $this->view->fopen($tmpPath, 'w');
 
 		if (!is_resource($fhCerts)) {
-			throw new \RuntimeException('Unable to open file handler to create certificate bundle "' . $tmpPath . '".');
+			throw new \RuntimeException('Unable to open file handler to create certificate bundle "'.$tmpPath.'".');
 		}
 
 		// Write user certificates
 		foreach ($certs as $cert) {
-			$file = $path . '/uploads/' . $cert->getName();
+			$file = $path.'/uploads/'.$cert->getName();
 			$data = $this->view->file_get_contents($file);
 			if (strpos($data, 'BEGIN CERTIFICATE')) {
 				fwrite($fhCerts, $data);
@@ -187,13 +187,13 @@ 
 		}
 		$this->bundlePath = null;
 
-		$dir = $this->getPathToCertificates() . 'uploads/';
+		$dir = $this->getPathToCertificates().'uploads/';
 		if (!$this->view->file_exists($dir)) {
 			$this->view->mkdir($dir);
 		}
 
 		try {
-			$file = $dir . $name;
+			$file = $dir.$name;
 			$certificateObject = new Certificate($certificate, $name);
 			$this->view->file_put_contents($file, $certificate);
 			$this->createCertificateBundle();
@@ -215,9 +215,9 @@ 
 		}
 		$this->bundlePath = null;
 
-		$path = $this->getPathToCertificates() . 'uploads/';
-		if ($this->view->file_exists($path . $name)) {
-			$this->view->unlink($path . $name);
+		$path = $this->getPathToCertificates().'uploads/';
+		if ($this->view->file_exists($path.$name)) {
+			$this->view->unlink($path.$name);
 			$this->createCertificateBundle();
 		}
 		return true;
@@ -229,7 +229,7 @@ 
 	 * @return string
 	 */
 	public function getCertificateBundle(): string {
-		return $this->getPathToCertificates() . 'rootcerts.crt';
+		return $this->getPathToCertificates().'rootcerts.crt';
 	}
 
 	/**
@@ -240,7 +240,7 @@ 
 		try {
 			if ($this->bundlePath === null) {
 				if (!$this->hasCertificates()) {
-					$this->bundlePath = \OC::$SERVERROOT . '/resources/config/ca-bundle.crt';
+					$this->bundlePath = \OC::$SERVERROOT.'/resources/config/ca-bundle.crt';
 				}
 
 				if ($this->needsRebundling()) {
@@ -251,13 +251,13 @@ 
 				$this->bundlePath = $this->view->getLocalFile($certificateBundle) ?: null;
 
 				if ($this->bundlePath === null) {
-					throw new \RuntimeException('Unable to get certificate bundle "' . $certificateBundle . '".');
+					throw new \RuntimeException('Unable to get certificate bundle "'.$certificateBundle.'".');
 				}
 			}
 			return $this->bundlePath;
 		} catch (\Exception $e) {
 			$this->logger->error('Failed to get absolute bundle path. Fallback to default ca-bundle.crt', ['exception' => $e]);
-			return \OC::$SERVERROOT . '/resources/config/ca-bundle.crt';
+			return \OC::$SERVERROOT.'/resources/config/ca-bundle.crt';
 		}
 	}
 
@@ -286,6 +286,6 @@ 
 	 * @return int
 	 */
 	protected function getFilemtimeOfCaBundle(): int {
-		return filemtime(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
+		return filemtime(\OC::$SERVERROOT.'/resources/config/ca-bundle.crt');
 	}
 }