mirror of
https://github.com/Kareadita/Kavita.git
synced 2025-05-24 00:52:23 -04:00
* Updated ngx-extended-pdf-viewer to 14.5.2 + misc security vuln * Hooked up remove from want to read AND fixed a bug in the logic that was removing everything BUT what was passed. Allow for bookmarks to have date info for better ordering. * Implemented a quick way to set darkneses level on manga reader for when nightlight just isn't dark enough * Added Japanese Series name support in the Parser * Updated our security file with our Huntr. * Fixed a security vulnerability where through the API, an unauthorized user could delete/modify reading lists that did not belong to them. Fixed a bug where when creating a reading list with the name of another users, the API would throw an exception (but reading list would still get created) * Ensure all reading list apis are authorized * Ensured all APIs require authentication, except those that explicitly don't. All APIs are default requiring Authentication. Fixed a security vulnerability which would allow a user to take over an admin account. * Fixed a bug where cover-upload would accept filenames that were not expected. * Explicitly check that a user has access to the pdf file before we serve it back. * Enabled lock out when invalid user auth occurs. After 5 invalid auths, the user account will be locked out for 10 mins.
310 lines
13 KiB
C#
310 lines
13 KiB
C#
using System;
|
|
using System.IO;
|
|
using System.Threading.Tasks;
|
|
using API.Data;
|
|
using API.DTOs.Uploads;
|
|
using API.Extensions;
|
|
using API.Services;
|
|
using API.SignalR;
|
|
using Flurl.Http;
|
|
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
using Microsoft.Extensions.Logging;
|
|
using NetVips;
|
|
|
|
namespace API.Controllers
|
|
{
|
|
/// <summary>
|
|
///
|
|
/// </summary>
|
|
[Authorize(Policy = "RequireAdminRole")]
|
|
public class UploadController : BaseApiController
|
|
{
|
|
private readonly IUnitOfWork _unitOfWork;
|
|
private readonly IImageService _imageService;
|
|
private readonly ILogger<UploadController> _logger;
|
|
private readonly ITaskScheduler _taskScheduler;
|
|
private readonly IDirectoryService _directoryService;
|
|
private readonly IEventHub _eventHub;
|
|
|
|
/// <inheritdoc />
|
|
public UploadController(IUnitOfWork unitOfWork, IImageService imageService, ILogger<UploadController> logger,
|
|
ITaskScheduler taskScheduler, IDirectoryService directoryService, IEventHub eventHub)
|
|
{
|
|
_unitOfWork = unitOfWork;
|
|
_imageService = imageService;
|
|
_logger = logger;
|
|
_taskScheduler = taskScheduler;
|
|
_directoryService = directoryService;
|
|
_eventHub = eventHub;
|
|
}
|
|
|
|
/// <summary>
|
|
/// This stores a file (image) in temp directory for use in a cover image replacement flow.
|
|
/// This is automatically cleaned up.
|
|
/// </summary>
|
|
/// <param name="dto">Escaped url to download from</param>
|
|
/// <returns>filename</returns>
|
|
[Authorize(Policy = "RequireAdminRole")]
|
|
[HttpPost("upload-by-url")]
|
|
public async Task<ActionResult<string>> GetImageFromFile(UploadUrlDto dto)
|
|
{
|
|
var dateString = $"{DateTime.Now.ToShortDateString()}_{DateTime.Now.ToLongTimeString()}".Replace("/", "_").Replace(":", "_");
|
|
var format = _directoryService.FileSystem.Path.GetExtension(dto.Url.Split('?')[0]).Replace(".", "");
|
|
try
|
|
{
|
|
var path = await dto.Url
|
|
.DownloadFileAsync(_directoryService.TempDirectory, $"coverupload_{dateString}.{format}");
|
|
|
|
if (string.IsNullOrEmpty(path) || !_directoryService.FileSystem.File.Exists(path))
|
|
return BadRequest($"Could not download file");
|
|
|
|
if (!await _imageService.IsImage(path)) return BadRequest("Url does not return a valid image");
|
|
|
|
return $"coverupload_{dateString}.{format}";
|
|
}
|
|
catch (FlurlHttpException ex)
|
|
{
|
|
// Unauthorized
|
|
if (ex.StatusCode == 401)
|
|
return BadRequest("The server requires authentication to load the url externally");
|
|
}
|
|
|
|
return BadRequest("Unable to download image, please use another url or upload by file");
|
|
}
|
|
|
|
/// <summary>
|
|
/// Replaces series cover image and locks it with a base64 encoded image
|
|
/// </summary>
|
|
/// <param name="uploadFileDto"></param>
|
|
/// <returns></returns>
|
|
[Authorize(Policy = "RequireAdminRole")]
|
|
[RequestSizeLimit(8_000_000)]
|
|
[HttpPost("series")]
|
|
public async Task<ActionResult> UploadSeriesCoverImageFromUrl(UploadFileDto uploadFileDto)
|
|
{
|
|
// Check if Url is non empty, request the image and place in temp, then ask image service to handle it.
|
|
// See if we can do this all in memory without touching underlying system
|
|
if (string.IsNullOrEmpty(uploadFileDto.Url))
|
|
{
|
|
return BadRequest("You must pass a url to use");
|
|
}
|
|
|
|
try
|
|
{
|
|
var filePath = _imageService.CreateThumbnailFromBase64(uploadFileDto.Url, ImageService.GetSeriesFormat(uploadFileDto.Id));
|
|
var series = await _unitOfWork.SeriesRepository.GetSeriesByIdAsync(uploadFileDto.Id);
|
|
|
|
if (!string.IsNullOrEmpty(filePath))
|
|
{
|
|
series.CoverImage = filePath;
|
|
series.CoverImageLocked = true;
|
|
_unitOfWork.SeriesRepository.Update(series);
|
|
}
|
|
|
|
if (_unitOfWork.HasChanges())
|
|
{
|
|
await _eventHub.SendMessageAsync(MessageFactory.CoverUpdate,
|
|
MessageFactory.CoverUpdateEvent(series.Id, MessageFactoryEntityTypes.Series), false);
|
|
await _unitOfWork.CommitAsync();
|
|
return Ok();
|
|
}
|
|
|
|
}
|
|
catch (Exception e)
|
|
{
|
|
_logger.LogError(e, "There was an issue uploading cover image for Series {Id}", uploadFileDto.Id);
|
|
await _unitOfWork.RollbackAsync();
|
|
}
|
|
|
|
return BadRequest("Unable to save cover image to Series");
|
|
}
|
|
|
|
/// <summary>
|
|
/// Replaces collection tag cover image and locks it with a base64 encoded image
|
|
/// </summary>
|
|
/// <param name="uploadFileDto"></param>
|
|
/// <returns></returns>
|
|
[Authorize(Policy = "RequireAdminRole")]
|
|
[RequestSizeLimit(8_000_000)]
|
|
[HttpPost("collection")]
|
|
public async Task<ActionResult> UploadCollectionCoverImageFromUrl(UploadFileDto uploadFileDto)
|
|
{
|
|
// Check if Url is non empty, request the image and place in temp, then ask image service to handle it.
|
|
// See if we can do this all in memory without touching underlying system
|
|
if (string.IsNullOrEmpty(uploadFileDto.Url))
|
|
{
|
|
return BadRequest("You must pass a url to use");
|
|
}
|
|
|
|
try
|
|
{
|
|
var filePath = _imageService.CreateThumbnailFromBase64(uploadFileDto.Url, $"{ImageService.GetCollectionTagFormat(uploadFileDto.Id)}");
|
|
var tag = await _unitOfWork.CollectionTagRepository.GetTagAsync(uploadFileDto.Id);
|
|
|
|
if (!string.IsNullOrEmpty(filePath))
|
|
{
|
|
tag.CoverImage = filePath;
|
|
tag.CoverImageLocked = true;
|
|
_unitOfWork.CollectionTagRepository.Update(tag);
|
|
}
|
|
|
|
if (_unitOfWork.HasChanges())
|
|
{
|
|
await _unitOfWork.CommitAsync();
|
|
await _eventHub.SendMessageAsync(MessageFactory.CoverUpdate,
|
|
MessageFactory.CoverUpdateEvent(tag.Id, MessageFactoryEntityTypes.CollectionTag), false);
|
|
return Ok();
|
|
}
|
|
|
|
}
|
|
catch (Exception e)
|
|
{
|
|
_logger.LogError(e, "There was an issue uploading cover image for Collection Tag {Id}", uploadFileDto.Id);
|
|
await _unitOfWork.RollbackAsync();
|
|
}
|
|
|
|
return BadRequest("Unable to save cover image to Collection Tag");
|
|
}
|
|
|
|
/// <summary>
|
|
/// Replaces reading list cover image and locks it with a base64 encoded image
|
|
/// </summary>
|
|
/// <param name="uploadFileDto"></param>
|
|
/// <returns></returns>
|
|
[Authorize(Policy = "RequireAdminRole")]
|
|
[RequestSizeLimit(8_000_000)]
|
|
[HttpPost("reading-list")]
|
|
public async Task<ActionResult> UploadReadingListCoverImageFromUrl(UploadFileDto uploadFileDto)
|
|
{
|
|
// Check if Url is non empty, request the image and place in temp, then ask image service to handle it.
|
|
// See if we can do this all in memory without touching underlying system
|
|
if (string.IsNullOrEmpty(uploadFileDto.Url))
|
|
{
|
|
return BadRequest("You must pass a url to use");
|
|
}
|
|
|
|
try
|
|
{
|
|
var filePath = _imageService.CreateThumbnailFromBase64(uploadFileDto.Url, $"{ImageService.GetReadingListFormat(uploadFileDto.Id)}");
|
|
var readingList = await _unitOfWork.ReadingListRepository.GetReadingListByIdAsync(uploadFileDto.Id);
|
|
|
|
if (!string.IsNullOrEmpty(filePath))
|
|
{
|
|
readingList.CoverImage = filePath;
|
|
readingList.CoverImageLocked = true;
|
|
_unitOfWork.ReadingListRepository.Update(readingList);
|
|
}
|
|
|
|
if (_unitOfWork.HasChanges())
|
|
{
|
|
await _unitOfWork.CommitAsync();
|
|
await _eventHub.SendMessageAsync(MessageFactory.CoverUpdate,
|
|
MessageFactory.CoverUpdateEvent(readingList.Id, MessageFactoryEntityTypes.ReadingList), false);
|
|
return Ok();
|
|
}
|
|
|
|
}
|
|
catch (Exception e)
|
|
{
|
|
_logger.LogError(e, "There was an issue uploading cover image for Reading List {Id}", uploadFileDto.Id);
|
|
await _unitOfWork.RollbackAsync();
|
|
}
|
|
|
|
return BadRequest("Unable to save cover image to Reading List");
|
|
}
|
|
|
|
/// <summary>
|
|
/// Replaces chapter cover image and locks it with a base64 encoded image. This will update the parent volume's cover image.
|
|
/// </summary>
|
|
/// <param name="uploadFileDto"></param>
|
|
/// <returns></returns>
|
|
[Authorize(Policy = "RequireAdminRole")]
|
|
[RequestSizeLimit(8_000_000)]
|
|
[HttpPost("chapter")]
|
|
public async Task<ActionResult> UploadChapterCoverImageFromUrl(UploadFileDto uploadFileDto)
|
|
{
|
|
// Check if Url is non empty, request the image and place in temp, then ask image service to handle it.
|
|
// See if we can do this all in memory without touching underlying system
|
|
if (string.IsNullOrEmpty(uploadFileDto.Url))
|
|
{
|
|
return BadRequest("You must pass a url to use");
|
|
}
|
|
|
|
try
|
|
{
|
|
var chapter = await _unitOfWork.ChapterRepository.GetChapterAsync(uploadFileDto.Id);
|
|
var filePath = _imageService.CreateThumbnailFromBase64(uploadFileDto.Url, $"{ImageService.GetChapterFormat(uploadFileDto.Id, chapter.VolumeId)}");
|
|
|
|
if (!string.IsNullOrEmpty(filePath))
|
|
{
|
|
chapter.CoverImage = filePath;
|
|
chapter.CoverImageLocked = true;
|
|
_unitOfWork.ChapterRepository.Update(chapter);
|
|
var volume = await _unitOfWork.VolumeRepository.GetVolumeAsync(chapter.VolumeId);
|
|
volume.CoverImage = chapter.CoverImage;
|
|
_unitOfWork.VolumeRepository.Update(volume);
|
|
}
|
|
|
|
if (_unitOfWork.HasChanges())
|
|
{
|
|
await _unitOfWork.CommitAsync();
|
|
await _eventHub.SendMessageAsync(MessageFactory.CoverUpdate,
|
|
MessageFactory.CoverUpdateEvent(chapter.VolumeId, MessageFactoryEntityTypes.Volume), false);
|
|
await _eventHub.SendMessageAsync(MessageFactory.CoverUpdate,
|
|
MessageFactory.CoverUpdateEvent(chapter.Id, MessageFactoryEntityTypes.Chapter), false);
|
|
return Ok();
|
|
}
|
|
|
|
}
|
|
catch (Exception e)
|
|
{
|
|
_logger.LogError(e, "There was an issue uploading cover image for Chapter {Id}", uploadFileDto.Id);
|
|
await _unitOfWork.RollbackAsync();
|
|
}
|
|
|
|
return BadRequest("Unable to save cover image to Chapter");
|
|
}
|
|
|
|
/// <summary>
|
|
/// Replaces chapter cover image and locks it with a base64 encoded image. This will update the parent volume's cover image.
|
|
/// </summary>
|
|
/// <param name="uploadFileDto">Does not use Url property</param>
|
|
/// <returns></returns>
|
|
[Authorize(Policy = "RequireAdminRole")]
|
|
[HttpPost("reset-chapter-lock")]
|
|
public async Task<ActionResult> ResetChapterLock(UploadFileDto uploadFileDto)
|
|
{
|
|
try
|
|
{
|
|
var chapter = await _unitOfWork.ChapterRepository.GetChapterAsync(uploadFileDto.Id);
|
|
var originalFile = chapter.CoverImage;
|
|
chapter.CoverImage = string.Empty;
|
|
chapter.CoverImageLocked = false;
|
|
_unitOfWork.ChapterRepository.Update(chapter);
|
|
var volume = await _unitOfWork.VolumeRepository.GetVolumeAsync(chapter.VolumeId);
|
|
volume.CoverImage = chapter.CoverImage;
|
|
_unitOfWork.VolumeRepository.Update(volume);
|
|
var series = await _unitOfWork.SeriesRepository.GetSeriesByIdAsync(volume.SeriesId);
|
|
|
|
if (_unitOfWork.HasChanges())
|
|
{
|
|
await _unitOfWork.CommitAsync();
|
|
System.IO.File.Delete(originalFile);
|
|
_taskScheduler.RefreshSeriesMetadata(series.LibraryId, series.Id, true);
|
|
return Ok();
|
|
}
|
|
|
|
}
|
|
catch (Exception e)
|
|
{
|
|
_logger.LogError(e, "There was an issue resetting cover lock for Chapter {Id}", uploadFileDto.Id);
|
|
await _unitOfWork.RollbackAsync();
|
|
}
|
|
|
|
return BadRequest("Unable to resetting cover lock for Chapter");
|
|
}
|
|
|
|
}
|
|
}
|