2018-12-23 13:04:54 -07:00
|
|
|
# Pleroma: A lightweight social networking server
|
2023-01-02 13:38:50 -07:00
|
|
|
# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
|
2018-12-23 13:04:54 -07:00
|
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
|
|
|
2020-06-24 00:03:48 -06:00
|
|
|
defmodule Pleroma.Web.Plugs.UploadedMedia do
|
2018-11-23 09:40:45 -07:00
|
|
|
@moduledoc """
|
|
|
|
"""
|
|
|
|
|
|
|
|
import Plug.Conn
|
2019-07-10 03:25:58 -06:00
|
|
|
import Pleroma.Web.Gettext
|
2018-11-23 09:40:45 -07:00
|
|
|
require Logger
|
|
|
|
|
2020-06-14 12:02:57 -06:00
|
|
|
alias Pleroma.Web.MediaProxy
|
|
|
|
|
2018-11-23 09:40:45 -07:00
|
|
|
@behaviour Plug
|
|
|
|
# no slashes
|
|
|
|
@path "media"
|
|
|
|
|
2020-03-13 11:27:50 -06:00
|
|
|
@default_cache_control_header "public, max-age=1209600"
|
2020-03-13 11:02:58 -06:00
|
|
|
|
2018-11-23 09:40:45 -07:00
|
|
|
def init(_opts) do
|
|
|
|
static_plug_opts =
|
2020-03-13 13:12:33 -06:00
|
|
|
[
|
|
|
|
headers: %{"cache-control" => @default_cache_control_header},
|
|
|
|
cache_control_for_etags: @default_cache_control_header
|
|
|
|
]
|
2018-11-23 09:40:45 -07:00
|
|
|
|> Keyword.put(:from, "__unconfigured_media_plug")
|
|
|
|
|> Keyword.put(:at, "/__unconfigured_media_plug")
|
|
|
|
|> Plug.Static.init()
|
|
|
|
|
|
|
|
%{static_plug_opts: static_plug_opts}
|
|
|
|
end
|
|
|
|
|
2019-02-06 12:19:39 -07:00
|
|
|
def call(%{request_path: <<"/", @path, "/", file::binary>>} = conn, opts) do
|
2019-03-12 00:10:19 -06:00
|
|
|
conn =
|
|
|
|
case fetch_query_params(conn) do
|
|
|
|
%{query_params: %{"name" => name}} = conn ->
|
2023-04-17 16:07:39 -06:00
|
|
|
name = String.replace(name, ~s["], ~s[\\"])
|
2019-03-12 00:21:13 -06:00
|
|
|
|
2023-04-17 16:07:39 -06:00
|
|
|
put_resp_header(conn, "content-disposition", ~s[inline; filename="#{name}"])
|
2019-03-12 00:10:19 -06:00
|
|
|
|
|
|
|
conn ->
|
|
|
|
conn
|
|
|
|
end
|
2020-04-15 04:05:22 -06:00
|
|
|
|> merge_resp_headers([{"content-security-policy", "sandbox"}])
|
2019-03-12 00:10:19 -06:00
|
|
|
|
2019-06-14 09:45:05 -06:00
|
|
|
config = Pleroma.Config.get(Pleroma.Upload)
|
2018-11-23 09:40:45 -07:00
|
|
|
|
2023-05-29 12:16:03 -06:00
|
|
|
media_host = Pleroma.Upload.base_url() |> URI.parse() |> Map.get(:host)
|
|
|
|
|
|
|
|
with {:valid_host, true} <- {:valid_host, match?(^media_host, conn.host)},
|
|
|
|
uploader <- Keyword.fetch!(config, :uploader),
|
2018-11-23 09:40:45 -07:00
|
|
|
proxy_remote = Keyword.get(config, :proxy_remote, false),
|
2020-06-14 12:02:57 -06:00
|
|
|
{:ok, get_method} <- uploader.get_file(file),
|
2020-06-17 12:13:55 -06:00
|
|
|
false <- media_is_banned(conn, get_method) do
|
2018-11-23 09:40:45 -07:00
|
|
|
get_media(conn, get_method, proxy_remote, opts)
|
|
|
|
else
|
2023-05-29 12:16:03 -06:00
|
|
|
{:valid_host, false} ->
|
|
|
|
conn
|
|
|
|
|
|
|
|
send_resp(conn, 400, Plug.Conn.Status.reason_phrase(400))
|
|
|
|
|> halt()
|
|
|
|
|
2018-11-23 09:40:45 -07:00
|
|
|
_ ->
|
|
|
|
conn
|
2019-07-10 03:25:58 -06:00
|
|
|
|> send_resp(:internal_server_error, dgettext("errors", "Failed"))
|
2018-11-23 09:40:45 -07:00
|
|
|
|> halt()
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def call(conn, _opts), do: conn
|
|
|
|
|
2020-06-17 12:13:55 -06:00
|
|
|
defp media_is_banned(%{request_path: path} = _conn, {:static_dir, _}) do
|
2021-01-08 16:05:55 -07:00
|
|
|
MediaProxy.in_banned_urls(Pleroma.Upload.base_url() <> path)
|
2020-06-14 12:02:57 -06:00
|
|
|
end
|
|
|
|
|
2020-06-17 12:13:55 -06:00
|
|
|
defp media_is_banned(_, {:url, url}), do: MediaProxy.in_banned_urls(url)
|
2020-06-14 12:02:57 -06:00
|
|
|
|
2020-06-17 12:13:55 -06:00
|
|
|
defp media_is_banned(_, _), do: false
|
2020-06-14 12:02:57 -06:00
|
|
|
|
2018-11-23 09:40:45 -07:00
|
|
|
defp get_media(conn, {:static_dir, directory}, _, opts) do
|
|
|
|
static_opts =
|
|
|
|
Map.get(opts, :static_plug_opts)
|
|
|
|
|> Map.put(:at, [@path])
|
|
|
|
|> Map.put(:from, directory)
|
|
|
|
|
|
|
|
conn = Plug.Static.call(conn, static_opts)
|
|
|
|
|
|
|
|
if conn.halted do
|
|
|
|
conn
|
|
|
|
else
|
|
|
|
conn
|
2019-07-10 04:40:34 -06:00
|
|
|
|> send_resp(:not_found, dgettext("errors", "Not found"))
|
2018-11-23 09:40:45 -07:00
|
|
|
|> halt()
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
defp get_media(conn, {:url, url}, true, _) do
|
2021-01-05 14:06:00 -07:00
|
|
|
proxy_opts = [
|
|
|
|
http: [
|
|
|
|
follow_redirect: true,
|
|
|
|
pool: :upload
|
|
|
|
]
|
|
|
|
]
|
|
|
|
|
2018-11-23 09:40:45 -07:00
|
|
|
conn
|
2021-01-05 14:06:00 -07:00
|
|
|
|> Pleroma.ReverseProxy.call(url, proxy_opts)
|
2018-11-23 09:40:45 -07:00
|
|
|
end
|
|
|
|
|
|
|
|
defp get_media(conn, {:url, url}, _, _) do
|
|
|
|
conn
|
|
|
|
|> Phoenix.Controller.redirect(external: url)
|
|
|
|
|> halt()
|
|
|
|
end
|
|
|
|
|
|
|
|
defp get_media(conn, unknown, _, _) do
|
|
|
|
Logger.error("#{__MODULE__}: Unknown get startegy: #{inspect(unknown)}")
|
|
|
|
|
|
|
|
conn
|
2019-07-10 04:40:34 -06:00
|
|
|
|> send_resp(:internal_server_error, dgettext("errors", "Internal Error"))
|
2018-11-23 09:40:45 -07:00
|
|
|
|> halt()
|
|
|
|
end
|
|
|
|
end
|