From 1f8cd7f0812ecbe929522db7b87d8c83c3684df4 Mon Sep 17 00:00:00 2001 From: Eldad Fux Date: Thu, 11 Jun 2020 00:42:16 +0300 Subject: [PATCH 01/18] Limit key size to 32 chars --- app/views/console/database/collection.phtml | 4 +-- src/Appwrite/Database/Validator/Key.php | 6 +++- tests/unit/Database/Validator/KeyTest.php | 36 +++++++++++++++++++++ 3 files changed, 43 insertions(+), 3 deletions(-) create mode 100644 tests/unit/Database/Validator/KeyTest.php diff --git a/app/views/console/database/collection.phtml b/app/views/console/database/collection.phtml index 8c6c75754d..da586a85d7 100644 --- a/app/views/console/database/collection.phtml +++ b/app/views/console/database/collection.phtml @@ -251,7 +251,7 @@ $rules = $collection->getAttribute('rules', []);
- +
@@ -404,7 +404,7 @@ $rules = $collection->getAttribute('rules', []);
- +
diff --git a/src/Appwrite/Database/Validator/Key.php b/src/Appwrite/Database/Validator/Key.php index aef689fe02..f6cc7ce91f 100644 --- a/src/Appwrite/Database/Validator/Key.php +++ b/src/Appwrite/Database/Validator/Key.php @@ -34,11 +34,15 @@ class Key extends Validator */ public function isValid($value) { + if(!is_string($value)) { + return false; + } + if (preg_match('/[^A-Za-z0-9\-\_]/', $value)) { return false; } - if (mb_strlen($value) > 40) { + if (mb_strlen($value) > 32) { return false; } diff --git a/tests/unit/Database/Validator/KeyTest.php b/tests/unit/Database/Validator/KeyTest.php new file mode 100644 index 0000000000..1ec815ce2f --- /dev/null +++ b/tests/unit/Database/Validator/KeyTest.php @@ -0,0 +1,36 @@ +object = new Key(); + } + + public function tearDown() + { + } + + public function testValues() + { + $this->assertEquals($this->object->isValid('dasda asdasd'), false); + $this->assertEquals($this->object->isValid('asdasdasdas'), true); + $this->assertEquals($this->object->isValid('as$$5dasdasdas'), false); + $this->assertEquals($this->object->isValid(false), false); + $this->assertEquals($this->object->isValid(null), false); + $this->assertEquals($this->object->isValid('socialAccountForYoutubeSubscribers'), false); + $this->assertEquals($this->object->isValid('socialAccountForYoutubeSubscriber'), false); + $this->assertEquals($this->object->isValid('socialAccountForYoutubeSubscribe'), true); + $this->assertEquals($this->object->isValid('socialAccountForYoutubeSubscrib'), true); + } +} \ No newline at end of file From 9eef72cdd385876ad5e464010304c8243f42b783 Mon Sep 17 00:00:00 2001 From: Eldad Fux Date: Thu, 11 Jun 2020 07:37:12 +0300 Subject: [PATCH 02/18] Limited number of cells --- app/views/console/database/collection.phtml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/app/views/console/database/collection.phtml b/app/views/console/database/collection.phtml index da586a85d7..c3ed6e5574 100644 --- a/app/views/console/database/collection.phtml +++ b/app/views/console/database/collection.phtml @@ -1,6 +1,7 @@ getParam('collection', []); $rules = $collection->getAttribute('rules', []); +$maxCells = 10; ?>
getAttribute('rules', []); - $rule): + if($i > $maxCells) { + break; + } $label = (isset($rule['label'])) ? $rule['label'] : ''; ?> @@ -96,7 +100,10 @@ $rules = $collection->getAttribute('rules', []); - $rule): + if($i > $maxCells) { + break; + } $label = (isset($rule['label'])) ? $rule['label'] : ''; $key = (isset($rule['key'])) ? $rule['key'] : ''; $type = (isset($rule['type'])) ? $rule['type'] : ''; From 74744cace019069383c0417deadff06d9b40571e Mon Sep 17 00:00:00 2001 From: Eldad Fux Date: Thu, 11 Jun 2020 07:38:19 +0300 Subject: [PATCH 03/18] Updated change log --- CHANGES.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGES.md b/CHANGES.md index cbd6a58996..d27cb023c0 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -12,6 +12,7 @@ - Fixed output of /v1/health/queue/certificates returning wrong data - Fixed network calculation for uploaded files - Fixed a UI bug preventing float values in numeric fields +- Fixed missing validation for database documents key length (32 chars) ## Security From d5cd136c6b20edae8688a789917f1315f93303c2 Mon Sep 17 00:00:00 2001 From: Eldad Fux Date: Sat, 13 Jun 2020 08:18:07 +0300 Subject: [PATCH 04/18] Build Nginx from source --- Dockerfile | 41 +++++++++++++++++++++++++++++++---------- 1 file changed, 31 insertions(+), 10 deletions(-) diff --git a/Dockerfile b/Dockerfile index efd1344c5d..fb8739e405 100644 --- a/Dockerfile +++ b/Dockerfile @@ -11,7 +11,7 @@ ENV TZ=Asia/Tel_Aviv \ RUN \ apt-get update && \ - apt-get install -y --no-install-recommends --no-install-suggests ca-certificates software-properties-common wget curl git openssl && \ + apt-get install -y --no-install-recommends --no-install-suggests ca-certificates software-properties-common wget git openssl && \ LC_ALL=C.UTF-8 add-apt-repository -y ppa:ondrej/php && \ apt-get update && \ apt-get install -y --no-install-recommends --no-install-suggests make php$PHP_VERSION php$PHP_VERSION-dev zip unzip php$PHP_VERSION-zip && \ @@ -23,7 +23,9 @@ RUN \ ./configure && \ make && \ # Composer - curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/bin --filename=composer + wget https://getcomposer.org/composer.phar && \ + chmod +x ./composer.phar && \ + mv ./composer.phar /usr/bin/composer WORKDIR /usr/local/src/ @@ -80,25 +82,44 @@ RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone RUN \ apt-get update && \ - apt-get install -y --no-install-recommends --no-install-suggests wget curl ca-certificates software-properties-common openssl gnupg && \ + apt-get install -y --no-install-recommends --no-install-suggests wget ca-certificates software-properties-common build-essential libpcre3-dev zlib1g-dev libssl-dev htop supervisor openssl gnupg && \ LC_ALL=C.UTF-8 add-apt-repository -y ppa:ondrej/php && \ add-apt-repository universe && \ add-apt-repository ppa:certbot/certbot && \ apt-get update && \ - apt-get install -y --no-install-recommends --no-install-suggests htop supervisor php$PHP_VERSION php$PHP_VERSION-fpm \ + apt-get install -y --no-install-recommends --no-install-suggests php$PHP_VERSION php$PHP_VERSION-fpm \ php$PHP_VERSION-mysqlnd php$PHP_VERSION-curl php$PHP_VERSION-imagick php$PHP_VERSION-mbstring php$PHP_VERSION-dom webp certbot && \ # Nginx - echo "deb http://nginx.org/packages/mainline/ubuntu/ bionic nginx" >> /etc/apt/sources.list.d/nginx.list && \ - wget -q http://nginx.org/keys/nginx_signing.key && \ - apt-key add nginx_signing.key && \ - apt-get update && \ - apt-get install -y --no-install-recommends --no-install-suggests nginx && \ + # echo "deb http://nginx.org/packages/nginx-1.19.0/ubuntu/ bionic nginx" >> /etc/apt/sources.list.d/nginx.list && \ + # wget -q http://nginx.org/keys/nginx_signing.key && \ + # apt-key add nginx_signing.key && \ + # apt-get update && \ + # apt-get install -y --no-install-recommends --no-install-suggests nginx && \ + wget http://nginx.org/download/nginx-1.19.0.tar.gz && \ + tar -xzvf nginx-1.19.0.tar.gz && rm nginx-1.19.0.tar.gz && \ + cd nginx-1.19.0 && \ + ./configure --prefix=/usr/share/nginx \ + --sbin-path=/usr/sbin/nginx \ + --modules-path=/usr/lib/nginx/modules \ + --conf-path=/etc/nginx/nginx.conf \ + --error-log-path=/var/log/nginx/error.log \ + --http-log-path=/var/log/nginx/access.log \ + --pid-path=/run/nginx.pid \ + --lock-path=/var/lock/nginx.lock \ + --user=www-data \ + --group=www-data \ + --build=Ubuntu \ + --with-http_gzip_static_module \ + --with-http_ssl_module \ + --with-http_v2_module && \ + make && \ + make install && \ # Redis Extension echo extension=redis.so >> /etc/php/$PHP_VERSION/fpm/conf.d/redis.ini && \ echo extension=redis.so >> /etc/php/$PHP_VERSION/cli/conf.d/redis.ini && \ # Cleanup cd ../ && \ - apt-get purge -y --auto-remove software-properties-common gnupg curl && \ + apt-get purge -y --auto-remove software-properties-common build-essential libpcre3-dev zlib1g-dev libssl-dev gnupg && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* From 2dbba826307efe99dc69065a62f348ae41dde013 Mon Sep 17 00:00:00 2001 From: Eldad Fux Date: Sat, 13 Jun 2020 10:35:29 +0300 Subject: [PATCH 05/18] Added brotli modules --- Dockerfile | 17 ++++++++++------- docker/nginx.conf | 10 ++++++++++ 2 files changed, 20 insertions(+), 7 deletions(-) diff --git a/Dockerfile b/Dockerfile index fb8739e405..1a7f8af26c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -25,7 +25,11 @@ RUN \ # Composer wget https://getcomposer.org/composer.phar && \ chmod +x ./composer.phar && \ - mv ./composer.phar /usr/bin/composer + mv ./composer.phar /usr/bin/composer && \ + #Brotli + cd / && \ + git clone https://github.com/eustas/ngx_brotli.git && \ + cd ngx_brotli && git submodule update --init && cd .. WORKDIR /usr/local/src/ @@ -77,6 +81,8 @@ ENV TZ=Asia/Tel_Aviv \ #ENV _APP_SMTP_PASSWORD '' COPY --from=builder /phpredis-5.2.1/modules/redis.so /usr/lib/php/20190902/ +COPY --from=builder /phpredis-5.2.1/modules/redis.so /usr/lib/php/20190902/ +COPY --from=builder /ngx_brotli /ngx_brotli RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone @@ -90,11 +96,6 @@ RUN \ apt-get install -y --no-install-recommends --no-install-suggests php$PHP_VERSION php$PHP_VERSION-fpm \ php$PHP_VERSION-mysqlnd php$PHP_VERSION-curl php$PHP_VERSION-imagick php$PHP_VERSION-mbstring php$PHP_VERSION-dom webp certbot && \ # Nginx - # echo "deb http://nginx.org/packages/nginx-1.19.0/ubuntu/ bionic nginx" >> /etc/apt/sources.list.d/nginx.list && \ - # wget -q http://nginx.org/keys/nginx_signing.key && \ - # apt-key add nginx_signing.key && \ - # apt-get update && \ - # apt-get install -y --no-install-recommends --no-install-suggests nginx && \ wget http://nginx.org/download/nginx-1.19.0.tar.gz && \ tar -xzvf nginx-1.19.0.tar.gz && rm nginx-1.19.0.tar.gz && \ cd nginx-1.19.0 && \ @@ -111,7 +112,8 @@ RUN \ --build=Ubuntu \ --with-http_gzip_static_module \ --with-http_ssl_module \ - --with-http_v2_module && \ + --with-http_v2_module \ + --add-module=/ngx_brotli && \ make && \ make install && \ # Redis Extension @@ -121,6 +123,7 @@ RUN \ cd ../ && \ apt-get purge -y --auto-remove software-properties-common build-essential libpcre3-dev zlib1g-dev libssl-dev gnupg && \ apt-get clean && \ + rm -rf /ngx_brotli && \ rm -rf /var/lib/apt/lists/* # Set Upload Limit (default to 100MB) diff --git a/docker/nginx.conf b/docker/nginx.conf index b1a569029e..7b62ec9a5b 100644 --- a/docker/nginx.conf +++ b/docker/nginx.conf @@ -46,6 +46,16 @@ http { gzip_http_version 1.1; gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml; + # Brotli Settings + brotli on; + brotli_comp_level 5; + brotli_static on; + brotli_types application/atom+xml application/javascript application/json application/rss+xml + application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype + application/x-font-ttf application/x-javascript application/xhtml+xml application/xml + font/eot font/opentype font/otf font/truetype image/svg+xml image/vnd.microsoft.icon + image/x-icon image/x-win-bitmap text/css text/javascript text/plain text/xml; + # Virtual Host Configs server { listen 80; ## listen for ipv4; this line is default and implied From 539346317c4878393283a8bfcd409c01734d23ff Mon Sep 17 00:00:00 2001 From: Eldad Fux Date: Sat, 13 Jun 2020 11:26:27 +0300 Subject: [PATCH 06/18] Image optimization --- Dockerfile | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 1a7f8af26c..d3dba93457 100644 --- a/Dockerfile +++ b/Dockerfile @@ -88,7 +88,7 @@ RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone RUN \ apt-get update && \ - apt-get install -y --no-install-recommends --no-install-suggests wget ca-certificates software-properties-common build-essential libpcre3-dev zlib1g-dev libssl-dev htop supervisor openssl gnupg && \ + apt-get install -y --no-install-recommends --no-install-suggests wget ca-certificates software-properties-common build-essential libpcre3-dev zlib1g-dev libssl-dev openssl gnupg htop supervisor && \ LC_ALL=C.UTF-8 add-apt-repository -y ppa:ondrej/php && \ add-apt-repository universe && \ add-apt-repository ppa:certbot/certbot && \ @@ -116,12 +116,13 @@ RUN \ --add-module=/ngx_brotli && \ make && \ make install && \ + rm -rf ../nginx-1.19.0 && \ # Redis Extension echo extension=redis.so >> /etc/php/$PHP_VERSION/fpm/conf.d/redis.ini && \ echo extension=redis.so >> /etc/php/$PHP_VERSION/cli/conf.d/redis.ini && \ # Cleanup cd ../ && \ - apt-get purge -y --auto-remove software-properties-common build-essential libpcre3-dev zlib1g-dev libssl-dev gnupg && \ + apt-get purge -y --auto-remove wget ca-certificates software-properties-common build-essential libpcre3-dev zlib1g-dev libssl-dev gnupg && \ apt-get clean && \ rm -rf /ngx_brotli && \ rm -rf /var/lib/apt/lists/* From bd12352d608bd1ae549e542331b7e7f06b3d22ed Mon Sep 17 00:00:00 2001 From: Eldad Fux Date: Sat, 13 Jun 2020 11:28:36 +0300 Subject: [PATCH 07/18] Updated change log --- CHANGES.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGES.md b/CHANGES.md index 2ba4e152e0..670d33dd70 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -9,6 +9,7 @@ - Added option to delete team from the console - Added option to view team members from the console - Added option to join a user to any team from the console +- Added support for Brotli compression ## Bug Fixes From 67f9ceb2316f4ce57355bd70dce308eee9d45d1c Mon Sep 17 00:00:00 2001 From: Eldad Fux Date: Sat, 13 Jun 2020 11:48:28 +0300 Subject: [PATCH 08/18] Fixed tests --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index d3dba93457..1f41c3e331 100644 --- a/Dockerfile +++ b/Dockerfile @@ -122,7 +122,7 @@ RUN \ echo extension=redis.so >> /etc/php/$PHP_VERSION/cli/conf.d/redis.ini && \ # Cleanup cd ../ && \ - apt-get purge -y --auto-remove wget ca-certificates software-properties-common build-essential libpcre3-dev zlib1g-dev libssl-dev gnupg && \ + apt-get purge -y --auto-remove wget software-properties-common build-essential libpcre3-dev zlib1g-dev libssl-dev gnupg && \ apt-get clean && \ rm -rf /ngx_brotli && \ rm -rf /var/lib/apt/lists/* From b79b2b4ccc6832226316d9e7afe5f61d350cc680 Mon Sep 17 00:00:00 2001 From: Eldad Fux Date: Sat, 13 Jun 2020 14:13:53 +0300 Subject: [PATCH 09/18] Performance and accessibility improvments --- app/controllers/web/console.php | 1 + app/views/console/comps/footer.phtml | 6 +++--- app/views/console/comps/header.phtml | 10 +++++----- app/views/console/database/collection.phtml | 6 +++--- app/views/console/database/document.phtml | 6 +++--- app/views/console/database/rules/array.phtml | 4 ++-- app/views/console/home/index.phtml | 14 +++++++------- app/views/console/index.phtml | 7 +++---- app/views/console/keys/index.phtml | 4 ++-- app/views/console/settings/index.phtml | 2 +- app/views/console/storage/index.phtml | 8 ++++---- app/views/console/tasks/index.phtml | 4 ++-- app/views/console/webhooks/index.phtml | 4 ++-- app/views/home/auth/signup.phtml | 2 +- public/dist/scripts/app-all.js | 7 ++++--- public/dist/scripts/app.js | 7 ++++--- public/dist/styles/default-ltr.css | 2 +- public/dist/styles/default-rtl.css | 2 +- public/scripts/views/forms/upload.js | 3 +++ public/scripts/views/ui/open.js | 7 ++++++- public/styles/scopes/console.less | 7 +++++++ 21 files changed, 65 insertions(+), 48 deletions(-) diff --git a/app/controllers/web/console.php b/app/controllers/web/console.php index d90966ba72..ff59b03072 100644 --- a/app/controllers/web/console.php +++ b/app/controllers/web/console.php @@ -14,6 +14,7 @@ use Appwrite\Storage\Storage; $utopia->init(function () use ($layout) { $layout + ->setParam('description', 'Appwrite Console allows you to easily manage, monitor, and control your entire backend API and tools.') ->setParam('analytics', 'UA-26264668-5') ; }); diff --git a/app/views/console/comps/footer.phtml b/app/views/console/comps/footer.phtml index e8f7770d6f..c966839392 100644 --- a/app/views/console/comps/footer.phtml +++ b/app/views/console/comps/footer.phtml @@ -9,21 +9,21 @@ $version = $this->getParam('version', '').'.'.APP_CACHE_BUSTER; data-analytics-event="click" data-analytics-category="console/footer" data-analytics-label="GitHub Link" - href="https://github.com/appwrite/appwrite" target="_blank"> GitHub + href="https://github.com/appwrite/appwrite" target="_blank" rel="noopener"> GitHub
  • Open an Issue + href="https://github.com/appwrite/appwrite/issues/new?body=%0A%0A%0A---%0AAppwrite Version:%20" target="_blank" rel="noopener">Open an Issue
  • Docs + href="/docs" target="_blank" rel="noopener">Docs
  • v: diff --git a/app/views/console/comps/header.phtml b/app/views/console/comps/header.phtml index 6588adf4e6..4a8d586436 100644 --- a/app/views/console/comps/header.phtml +++ b/app/views/console/comps/header.phtml @@ -42,7 +42,7 @@ -
    +
    -
    • escape($label); ?>