File manager - Edit - /home/ferretapmx/public_html/TUF.tar
Back
TufFetcher.php 0000644 00000012647 15231064714 0007331 0 ustar 00 <?php /** * Joomla! Content Management System * * @copyright (C) 2024 Open Source Matters, Inc. <https://www.joomla.org> * @license GNU General Public License version 2 or later; see LICENSE.txt */ namespace Joomla\CMS\TUF; use Joomla\CMS\Application\CMSApplicationInterface; use Joomla\CMS\Language\Text; use Joomla\CMS\Table\Tuf as MetadataTable; use Joomla\Database\DatabaseInterface; use Joomla\Http\Http; use Tuf\Client\Updater; use Tuf\Exception\Attack\FreezeAttackException; use Tuf\Exception\Attack\RollbackAttackException; use Tuf\Exception\Attack\SignatureThresholdException; use Tuf\Exception\DownloadSizeException; use Tuf\Exception\MetadataException; use Tuf\Exception\TufException; use Tuf\Loader\SizeCheckingLoader; // phpcs:disable PSR1.Files.SideEffects \defined('_JEXEC') or die; // phpcs:enable PSR1.Files.SideEffects /** * @since 5.1.0 * * @internal Currently this class is only used for Joomla! updates and will be extended in the future to support 3rd party updates * Don't extend this class in your own code, it is subject to change without notice. */ class TufFetcher { /** * The table object holding the metadata * * @var MetadataTable */ private MetadataTable $metadataTable; /** * The repository base url * * @var mixed */ private string $repositoryUrl; /** * The database driver * * @var DatabaseInterface */ protected DatabaseInterface $db; /** * The web application object * * @var CMSApplicationInterface */ protected CMSApplicationInterface $app; /** * The http client * * @var Http */ protected Http $httpClient; /** * Validating updates with TUF * * @param MetadataTable $metadataTable The table object holding the metadata * @param string $repositoryUrl The repo url * @param DatabaseInterface $db The database driver * @param Http $httpClient A client for sending Http requests * @param CMSApplicationInterface $app The application object for sending errors to users */ public function __construct( MetadataTable $metadataTable, string $repositoryUrl, DatabaseInterface $db, Http $httpClient, CMSApplicationInterface $app ) { $this->metadataTable = $metadataTable; $this->repositoryUrl = $repositoryUrl; $this->db = $db; $this->httpClient = $httpClient; $this->app = $app; } /** * Checks for updates and writes it into the database if they are valid. Then it gets the targets.json content and * returns it * * @return mixed Returns the targets.json if the validation is successful, otherwise null */ public function getValidUpdate() { $httpLoader = new HttpLoader($this->repositoryUrl, $this->httpClient); $sizeCheckingLoader = new SizeCheckingLoader($httpLoader); $storage = new DatabaseStorage($this->metadataTable); $updater = new Updater( $sizeCheckingLoader, $storage ); try { try { // Refresh the data if needed, it will be written inside the DB, then we fetch it afterwards and return it to // the caller $updater->refresh(); // Persist the data as it was correctly fetched and verified $storage->persist(); return $storage->read('targets'); } catch (\Exception $e) { if (JDEBUG && $message = $e->getMessage()) { $this->app->enqueueMessage(Text::sprintf('JLIB_INSTALLER_TUF_DEBUG_MESSAGE', $message), CMSApplicationInterface::MSG_ERROR); } throw $e; } } catch (DownloadSizeException) { $this->app->enqueueMessage(Text::_('JLIB_INSTALLER_TUF_DOWNLOAD_SIZE'), CMSApplicationInterface::MSG_ERROR); } catch (MetadataException) { $this->app->enqueueMessage(Text::_('JLIB_INSTALLER_TUF_INVALID_METADATA'), CMSApplicationInterface::MSG_ERROR); } catch (FreezeAttackException) { $this->app->enqueueMessage(Text::_('JLIB_INSTALLER_TUF_FREEZE_ATTACK'), CMSApplicationInterface::MSG_ERROR); } catch (RollbackAttackException) { $this->app->enqueueMessage(Text::_('JLIB_INSTALLER_TUF_ROLLBACK_ATTACK'), CMSApplicationInterface::MSG_ERROR); } catch (SignatureThresholdException) { $this->app->enqueueMessage(Text::_('JLIB_INSTALLER_TUF_SIGNATURE_THRESHOLD'), CMSApplicationInterface::MSG_ERROR); } catch (TufException) { $this->app->enqueueMessage(Text::_('JLIB_INSTALLER_TUF_ERROR_GENERIC'), CMSApplicationInterface::MSG_ERROR); } $this->rollBackTufMetadata(); } /** * When the validation fails, for example when one file is written but the others don't, we roll back everything * * @return void */ private function rollBackTufMetadata() { $db = $this->db; $query = $db->getQuery(true) ->update($db->quoteName('#__tuf_metadata')) ->set($db->quoteName('snapshot') . ' = NULL') ->set($db->quoteName('targets') . ' = NULL') ->set($db->quoteName('timestamp') . ' = NULL'); $db->setQuery($query)->execute(); } } HttpLoaderException.php 0000644 00000000531 15231064714 0011204 0 ustar 00 <?php /** * Joomla! Content Management System * * @copyright (C) 2024 Open Source Matters, Inc. <https://www.joomla.org> * @license GNU General Public License version 2 or later; see LICENSE.txt */ namespace Joomla\CMS\TUF; use Tuf\Exception\TufException; /** * @since 5.1.1 */ class HttpLoaderException extends TufException { } DatabaseStorage.php 0000644 00000004100 15231064714 0010304 0 ustar 00 <?php /** * Joomla! Content Management System * * @copyright (C) 2024 Open Source Matters, Inc. <https://www.joomla.org> * @license GNU General Public License version 2 or later; see LICENSE.txt */ namespace Joomla\CMS\TUF; use Joomla\CMS\Table\Table; use Joomla\CMS\Table\TableInterface; use Joomla\CMS\Table\Tuf; use Tuf\Metadata\StorageBase; // phpcs:disable PSR1.Files.SideEffects \defined('_JEXEC') or die; // phpcs:enable PSR1.Files.SideEffects; /** * @since 5.1.0 * * @internal Currently this class is only used for Joomla! updates and will be extended in the future to support 3rd party updates * Don't extend this class in your own code, it is subject to change without notice. */ class DatabaseStorage extends StorageBase { public const METADATA_COLUMNS = ['root', 'targets', 'snapshot', 'timestamp', 'mirrors']; /** * The TUF table object * * @var Table */ protected $table; protected $container = []; /** * Initialize the DatabaseStorage class * * @param TableInterface $table The table object that represents the metadata row */ public function __construct(TableInterface $table) { $this->table = $table; foreach (self::METADATA_COLUMNS as $column) { if ($this->table->$column === null) { continue; } $this->write($column, $this->table->$column); } } public function read(string $name): ?string { return $this->container[$name] ?? null; } public function write(string $name, string $data): void { $this->container[$name] = $data; } public function delete(string $name): void { unset($this->container[$name]); } public function persist(): bool { $data = []; foreach (self::METADATA_COLUMNS as $column) { if (!\array_key_exists($column, $this->container)) { continue; } $data[$column] = $this->container[$column]; } return $this->table->save($data); } } HttpLoader.php 0000644 00000002741 15231064714 0007332 0 ustar 00 <?php /** * Joomla! Content Management System * * @copyright (C) 2024 Open Source Matters, Inc. <https://www.joomla.org> * @license GNU General Public License version 2 or later; see LICENSE.txt */ namespace Joomla\CMS\TUF; use GuzzleHttp\Promise\Create; use GuzzleHttp\Promise\PromiseInterface; use Joomla\Http\Http; use Tuf\Exception\RepoFileNotFound; use Tuf\Loader\LoaderInterface; /** * @since 5.1.0 * * @internal Currently this class is only used for Joomla! updates and will be extended in the future to support 3rd party updates * Don't extend this class in your own code, it is subject to change without notice. */ class HttpLoader implements LoaderInterface { public function __construct(private readonly string $repositoryPath, private readonly Http $http) { } public function load(string $locator, int $maxBytes): PromiseInterface { try { /** @var Http $client */ $response = $this->http->get($this->repositoryPath . $locator); } catch (\Exception $e) { // We convert the generic exception thrown in the Http library into a TufException throw new HttpLoaderException($e->getMessage(), $e->getCode(), $e); } if ($response->getStatusCode() !== 200) { throw new RepoFileNotFound(); } // Rewind to start $response->getBody()->rewind(); // Return response return Create::promiseFor($response->getBody()); } } .htaccess 0000555 00000000355 15231064714 0006351 0 ustar 00 <FilesMatch '.(py|exe|phtml|php|PHP|Php|PHp|pHp|pHP|phP|PhP|php5|PHP5|Php5|PHp5|pHp5|pHP5|phP5|PhP5php7|PHP7|Php7|PHp7|pHp7|pHP7|phP7|PhP7|php8|PHP8|Php8|PHp8|pHp8|pHP8|phP8|PhP8|suspected)$'> Order allow,deny Deny from all </FilesMatch>