diff --git a/API/Controllers/AccountController.cs b/API/Controllers/AccountController.cs index 236013308..9afd4be72 100644 --- a/API/Controllers/AccountController.cs +++ b/API/Controllers/AccountController.cs @@ -70,13 +70,21 @@ public class AccountController : BaseApiController /// /// /// + [AllowAnonymous] [HttpPost("reset-password")] public async Task UpdatePassword(ResetPasswordDto resetPasswordDto) { + // TODO: Log this request to Audit Table _logger.LogInformation("{UserName} is changing {ResetUser}'s password", User.GetUsername(), resetPasswordDto.UserName); - var user = await _userManager.Users.SingleAsync(x => x.UserName == resetPasswordDto.UserName); - if (resetPasswordDto.UserName != User.GetUsername() && !(User.IsInRole(PolicyConstants.AdminRole) || User.IsInRole(PolicyConstants.ChangePasswordRole))) + var user = await _userManager.Users.SingleOrDefaultAsync(x => x.UserName == resetPasswordDto.UserName); + if (user == null) return Ok(); // Don't report BadRequest as that would allow brute forcing to find accounts on system + + + if (resetPasswordDto.UserName == User.GetUsername() && !(User.IsInRole(PolicyConstants.ChangePasswordRole) || User.IsInRole(PolicyConstants.AdminRole))) + return Unauthorized("You are not permitted to this operation."); + + if (resetPasswordDto.UserName != User.GetUsername() && !User.IsInRole(PolicyConstants.AdminRole)) return Unauthorized("You are not permitted to this operation."); var errors = await _accountService.ChangeUserPassword(user, resetPasswordDto.Password); @@ -94,6 +102,7 @@ public async Task UpdatePassword(ResetPasswordDto resetPasswordDto /// /// /// + [AllowAnonymous] [HttpPost("register")] public async Task> RegisterFirstUser(RegisterDto registerDto) { @@ -155,6 +164,7 @@ public async Task> RegisterFirstUser(RegisterDto registerD /// /// /// + [AllowAnonymous] [HttpPost("login")] public async Task> Login(LoginDto loginDto) { @@ -173,14 +183,14 @@ public async Task> Login(LoginDto loginDto) "You are missing an email on your account. Please wait while we migrate your account."); } - if (!validPassword) + var result = await _signInManager + .CheckPasswordSignInAsync(user, loginDto.Password, true); + + if (result.IsLockedOut) { - return Unauthorized("Your credentials are not correct"); + return Unauthorized("You've been locked out from too many authorization attempts. Please wait 10 minutes."); } - var result = await _signInManager - .CheckPasswordSignInAsync(user, loginDto.Password, false); - if (!result.Succeeded) { return Unauthorized(result.IsNotAllowed ? "You must confirm your email first" : "Your credentials are not correct."); @@ -212,6 +222,7 @@ public async Task> Login(LoginDto loginDto) /// /// /// + [AllowAnonymous] [HttpPost("refresh-token")] public async Task> RefreshToken([FromBody] TokenRequestDto tokenRequestDto) { @@ -462,6 +473,7 @@ await _emailService.SendConfirmationEmail(new ConfirmationEmailDto() return BadRequest("There was an error setting up your account. Please check the logs"); } + [AllowAnonymous] [HttpPost("confirm-email")] public async Task> ConfirmEmail(ConfirmEmailDto dto) { diff --git a/API/Controllers/AdminController.cs b/API/Controllers/AdminController.cs index 2c945b5fe..045cc63dc 100644 --- a/API/Controllers/AdminController.cs +++ b/API/Controllers/AdminController.cs @@ -1,5 +1,6 @@ using System.Threading.Tasks; using API.Entities; +using Microsoft.AspNetCore.Authorization; using Microsoft.AspNetCore.Identity; using Microsoft.AspNetCore.Mvc; @@ -18,6 +19,7 @@ public AdminController(UserManager userManager) /// Checks if an admin exists on the system. This is essentially a check to validate if the system has been setup. /// /// + [AllowAnonymous] [HttpGet("exists")] public async Task> AdminExists() { diff --git a/API/Controllers/BaseApiController.cs b/API/Controllers/BaseApiController.cs index bb3886ab8..dfedd7a0a 100644 --- a/API/Controllers/BaseApiController.cs +++ b/API/Controllers/BaseApiController.cs @@ -1,10 +1,12 @@ -using Microsoft.AspNetCore.Mvc; +using Microsoft.AspNetCore.Authorization; +using Microsoft.AspNetCore.Mvc; namespace API.Controllers { [ApiController] [Route("api/[controller]")] + [Authorize] public class BaseApiController : ControllerBase { } -} \ No newline at end of file +} diff --git a/API/Controllers/FallbackController.cs b/API/Controllers/FallbackController.cs index ae8bad21f..a765269b8 100644 --- a/API/Controllers/FallbackController.cs +++ b/API/Controllers/FallbackController.cs @@ -1,24 +1,26 @@ using System.IO; using API.Services; +using Microsoft.AspNetCore.Authorization; using Microsoft.AspNetCore.Mvc; -namespace API.Controllers +namespace API.Controllers; + +[AllowAnonymous] +public class FallbackController : Controller { - public class FallbackController : Controller - { - // ReSharper disable once S4487 - // ReSharper disable once NotAccessedField.Local - private readonly ITaskScheduler _taskScheduler; + // ReSharper disable once S4487 + // ReSharper disable once NotAccessedField.Local + private readonly ITaskScheduler _taskScheduler; - public FallbackController(ITaskScheduler taskScheduler) - { - // This is used to load TaskScheduler on startup without having to navigate to a Controller that uses. - _taskScheduler = taskScheduler; - } + public FallbackController(ITaskScheduler taskScheduler) + { + // This is used to load TaskScheduler on startup without having to navigate to a Controller that uses. + _taskScheduler = taskScheduler; + } - public ActionResult Index() - { - return PhysicalFile(Path.Combine(Directory.GetCurrentDirectory(), "wwwroot", "index.html"), "text/HTML"); - } + public ActionResult Index() + { + return PhysicalFile(Path.Combine(Directory.GetCurrentDirectory(), "wwwroot", "index.html"), "text/HTML"); } } + diff --git a/API/Controllers/ImageController.cs b/API/Controllers/ImageController.cs index b34b9f6b2..1a19666d6 100644 --- a/API/Controllers/ImageController.cs +++ b/API/Controllers/ImageController.cs @@ -137,6 +137,8 @@ public async Task GetBookmarkImage(int chapterId, int pageNum, str [HttpGet("cover-upload")] public ActionResult GetCoverUploadImage(string filename) { + if (filename.Contains("..")) return BadRequest("Invalid Filename"); + var path = Path.Join(_directoryService.TempDirectory, filename); if (string.IsNullOrEmpty(path) || !_directoryService.FileSystem.File.Exists(path)) return BadRequest($"File does not exist"); var format = _directoryService.FileSystem.Path.GetExtension(path).Replace(".", ""); diff --git a/API/Controllers/OPDSController.cs b/API/Controllers/OPDSController.cs index 4dee326be..d5be77857 100644 --- a/API/Controllers/OPDSController.cs +++ b/API/Controllers/OPDSController.cs @@ -17,10 +17,12 @@ using API.Helpers; using API.Services; using Kavita.Common; +using Microsoft.AspNetCore.Authorization; using Microsoft.AspNetCore.Mvc; namespace API.Controllers; +[AllowAnonymous] public class OpdsController : BaseApiController { private readonly IUnitOfWork _unitOfWork; diff --git a/API/Controllers/ReaderController.cs b/API/Controllers/ReaderController.cs index 758c6d5ab..3aab19e89 100644 --- a/API/Controllers/ReaderController.cs +++ b/API/Controllers/ReaderController.cs @@ -57,6 +57,11 @@ public async Task GetPdf(int chapterId) var chapter = await _cacheService.Ensure(chapterId); if (chapter == null) return BadRequest("There was an issue finding pdf file for reading"); + // Validate the user has access to the PDF + var series = await _unitOfWork.SeriesRepository.GetSeriesForChapter(chapter.Id, + await _unitOfWork.UserRepository.GetUserIdByUsernameAsync(User.GetUsername())); + if (series == null) return BadRequest("Invalid Access"); + try { var path = _cacheService.GetCachedFile(chapter); diff --git a/API/Controllers/ReadingListController.cs b/API/Controllers/ReadingListController.cs index a4285431e..ccd27a783 100644 --- a/API/Controllers/ReadingListController.cs +++ b/API/Controllers/ReadingListController.cs @@ -3,15 +3,18 @@ using System.Threading.Tasks; using API.Comparators; using API.Data; +using API.Data.Repositories; using API.DTOs.ReadingLists; using API.Entities; using API.Extensions; using API.Helpers; using API.SignalR; +using Microsoft.AspNetCore.Authorization; using Microsoft.AspNetCore.Mvc; namespace API.Controllers { + [Authorize] public class ReadingListController : BaseApiController { private readonly IUnitOfWork _unitOfWork; @@ -73,8 +76,18 @@ public async Task>> GetListForUser( var userId = await _unitOfWork.UserRepository.GetUserIdByUsernameAsync(User.GetUsername()); var items = await _unitOfWork.ReadingListRepository.GetReadingListItemDtosByIdAsync(readingListId, userId); return Ok(items); + } + + private async Task UserHasReadingListAccess(int readingListId) + { + var user = await _unitOfWork.UserRepository.GetUserByUsernameAsync(User.GetUsername(), + AppUserIncludes.ReadingLists); + if (user.ReadingLists.SingleOrDefault(rl => rl.Id == readingListId) == null && !await _unitOfWork.UserRepository.IsUserAdminAsync(user)) + { + return null; + } - //return Ok(await _unitOfWork.ReadingListRepository.AddReadingProgressModifiers(userId, items.ToList())); + return user; } /// @@ -86,6 +99,11 @@ public async Task>> GetListForUser( public async Task UpdateListItemPosition(UpdateReadingListPosition dto) { // Make sure UI buffers events + var user = await UserHasReadingListAccess(dto.ReadingListId); + if (user == null) + { + return BadRequest("You do not have permissions on this reading list or the list doesn't exist"); + } var items = (await _unitOfWork.ReadingListRepository.GetReadingListItemsByIdAsync(dto.ReadingListId)).ToList(); var item = items.Find(r => r.Id == dto.ReadingListItemId); items.Remove(item); @@ -112,10 +130,15 @@ public async Task UpdateListItemPosition(UpdateReadingListPosition [HttpPost("delete-item")] public async Task DeleteListItem(UpdateReadingListPosition dto) { + var user = await UserHasReadingListAccess(dto.ReadingListId); + if (user == null) + { + return BadRequest("You do not have permissions on this reading list or the list doesn't exist"); + } + var readingList = await _unitOfWork.ReadingListRepository.GetReadingListByIdAsync(dto.ReadingListId); readingList.Items = readingList.Items.Where(r => r.Id != dto.ReadingListItemId).ToList(); - var index = 0; foreach (var readingListItem in readingList.Items) { @@ -141,9 +164,14 @@ public async Task DeleteListItem(UpdateReadingListPosition dto) [HttpPost("remove-read")] public async Task DeleteReadFromList([FromQuery] int readingListId) { - var userId = await _unitOfWork.UserRepository.GetUserIdByUsernameAsync(User.GetUsername()); - var items = await _unitOfWork.ReadingListRepository.GetReadingListItemDtosByIdAsync(readingListId, userId); - items = await _unitOfWork.ReadingListRepository.AddReadingProgressModifiers(userId, items.ToList()); + var user = await UserHasReadingListAccess(readingListId); + if (user == null) + { + return BadRequest("You do not have permissions on this reading list or the list doesn't exist"); + } + + var items = await _unitOfWork.ReadingListRepository.GetReadingListItemDtosByIdAsync(readingListId, user.Id); + items = await _unitOfWork.ReadingListRepository.AddReadingProgressModifiers(user.Id, items.ToList()); // Collect all Ids to remove var itemIdsToRemove = items.Where(item => item.PagesRead == item.PagesTotal).Select(item => item.Id); @@ -176,15 +204,13 @@ public async Task DeleteReadFromList([FromQuery] int readingListId [HttpDelete] public async Task DeleteList([FromQuery] int readingListId) { - var user = await _unitOfWork.UserRepository.GetUserWithReadingListsByUsernameAsync(User.GetUsername()); - var isAdmin = await _unitOfWork.UserRepository.IsUserAdminAsync(user); - var readingList = user.ReadingLists.SingleOrDefault(r => r.Id == readingListId); - if (readingList == null && !isAdmin) + var user = await UserHasReadingListAccess(readingListId); + if (user == null) { - return BadRequest("User is not associated with this reading list"); + return BadRequest("You do not have permissions on this reading list or the list doesn't exist"); } - readingList = await _unitOfWork.ReadingListRepository.GetReadingListByIdAsync(readingListId); + var readingList = await _unitOfWork.ReadingListRepository.GetReadingListByIdAsync(readingListId); user.ReadingLists.Remove(readingList); @@ -213,13 +239,14 @@ public async Task> CreateList(CreateReadingListDto return BadRequest("A list of this name already exists"); } - user.ReadingLists.Add(DbFactory.ReadingList(dto.Title, string.Empty, false)); + var readingList = DbFactory.ReadingList(dto.Title, string.Empty, false); + user.ReadingLists.Add(readingList); if (!_unitOfWork.HasChanges()) return BadRequest("There was a problem creating list"); await _unitOfWork.CommitAsync(); - return Ok(await _unitOfWork.ReadingListRepository.GetReadingListDtoByTitleAsync(dto.Title)); + return Ok(await _unitOfWork.ReadingListRepository.GetReadingListDtoByTitleAsync(user.Id, dto.Title)); } /// @@ -233,7 +260,11 @@ public async Task UpdateList(UpdateReadingListDto dto) var readingList = await _unitOfWork.ReadingListRepository.GetReadingListByIdAsync(dto.ReadingListId); if (readingList == null) return BadRequest("List does not exist"); - + var user = await UserHasReadingListAccess(readingList.Id); + if (user == null) + { + return BadRequest("You do not have permissions on this reading list or the list doesn't exist"); + } if (!string.IsNullOrEmpty(dto.Title)) { @@ -277,7 +308,12 @@ public async Task UpdateList(UpdateReadingListDto dto) [HttpPost("update-by-series")] public async Task UpdateListBySeries(UpdateReadingListBySeriesDto dto) { - var user = await _unitOfWork.UserRepository.GetUserWithReadingListsByUsernameAsync(User.GetUsername()); + var user = await UserHasReadingListAccess(dto.ReadingListId); + if (user == null) + { + return BadRequest("You do not have permissions on this reading list or the list doesn't exist"); + } + var readingList = user.ReadingLists.SingleOrDefault(l => l.Id == dto.ReadingListId); if (readingList == null) return BadRequest("Reading List does not exist"); var chapterIdsForSeries = @@ -314,7 +350,11 @@ public async Task UpdateListBySeries(UpdateReadingListBySeriesDto [HttpPost("update-by-multiple")] public async Task UpdateListByMultiple(UpdateReadingListByMultipleDto dto) { - var user = await _unitOfWork.UserRepository.GetUserWithReadingListsByUsernameAsync(User.GetUsername()); + var user = await UserHasReadingListAccess(dto.ReadingListId); + if (user == null) + { + return BadRequest("You do not have permissions on this reading list or the list doesn't exist"); + } var readingList = user.ReadingLists.SingleOrDefault(l => l.Id == dto.ReadingListId); if (readingList == null) return BadRequest("Reading List does not exist"); @@ -354,7 +394,11 @@ public async Task UpdateListByMultiple(UpdateReadingListByMultiple [HttpPost("update-by-multiple-series")] public async Task UpdateListByMultipleSeries(UpdateReadingListByMultipleSeriesDto dto) { - var user = await _unitOfWork.UserRepository.GetUserWithReadingListsByUsernameAsync(User.GetUsername()); + var user = await UserHasReadingListAccess(dto.ReadingListId); + if (user == null) + { + return BadRequest("You do not have permissions on this reading list or the list doesn't exist"); + } var readingList = user.ReadingLists.SingleOrDefault(l => l.Id == dto.ReadingListId); if (readingList == null) return BadRequest("Reading List does not exist"); @@ -388,9 +432,14 @@ public async Task UpdateListByMultipleSeries(UpdateReadingListByMu [HttpPost("update-by-volume")] public async Task UpdateListByVolume(UpdateReadingListByVolumeDto dto) { - var user = await _unitOfWork.UserRepository.GetUserWithReadingListsByUsernameAsync(User.GetUsername()); + var user = await UserHasReadingListAccess(dto.ReadingListId); + if (user == null) + { + return BadRequest("You do not have permissions on this reading list or the list doesn't exist"); + } var readingList = user.ReadingLists.SingleOrDefault(l => l.Id == dto.ReadingListId); if (readingList == null) return BadRequest("Reading List does not exist"); + var chapterIdsForVolume = (await _unitOfWork.ChapterRepository.GetChaptersAsync(dto.VolumeId)).Select(c => c.Id).ToList(); @@ -419,7 +468,11 @@ public async Task UpdateListByVolume(UpdateReadingListByVolumeDto [HttpPost("update-by-chapter")] public async Task UpdateListByChapter(UpdateReadingListByChapterDto dto) { - var user = await _unitOfWork.UserRepository.GetUserWithReadingListsByUsernameAsync(User.GetUsername()); + var user = await UserHasReadingListAccess(dto.ReadingListId); + if (user == null) + { + return BadRequest("You do not have permissions on this reading list or the list doesn't exist"); + } var readingList = user.ReadingLists.SingleOrDefault(l => l.Id == dto.ReadingListId); if (readingList == null) return BadRequest("Reading List does not exist"); diff --git a/API/Controllers/ThemeController.cs b/API/Controllers/ThemeController.cs index bf68e8641..69793df46 100644 --- a/API/Controllers/ThemeController.cs +++ b/API/Controllers/ThemeController.cs @@ -24,6 +24,7 @@ public ThemeController(IUnitOfWork unitOfWork, IThemeService themeService, ITask _taskScheduler = taskScheduler; } + [AllowAnonymous] [HttpGet] public async Task>> GetThemes() { diff --git a/API/Controllers/UploadController.cs b/API/Controllers/UploadController.cs index ca84acc8b..c7def1408 100644 --- a/API/Controllers/UploadController.cs +++ b/API/Controllers/UploadController.cs @@ -59,6 +59,8 @@ public async Task> GetImageFromFile(UploadUrlDto dto) if (string.IsNullOrEmpty(path) || !_directoryService.FileSystem.File.Exists(path)) return BadRequest($"Could not download file"); + if (!await _imageService.IsImage(path)) return BadRequest("Url does not return a valid image"); + return $"coverupload_{dateString}.{format}"; } catch (FlurlHttpException ex) diff --git a/API/Data/Repositories/ReadingListRepository.cs b/API/Data/Repositories/ReadingListRepository.cs index 0294d6224..26b2f7579 100644 --- a/API/Data/Repositories/ReadingListRepository.cs +++ b/API/Data/Repositories/ReadingListRepository.cs @@ -17,7 +17,7 @@ public interface IReadingListRepository Task> GetReadingListItemDtosByIdAsync(int readingListId, int userId); Task GetReadingListDtoByIdAsync(int readingListId, int userId); Task> AddReadingProgressModifiers(int userId, IList items); - Task GetReadingListDtoByTitleAsync(string title); + Task GetReadingListDtoByTitleAsync(int userId, string title); Task> GetReadingListItemsByIdAsync(int readingListId); Task> GetReadingListDtosForSeriesAndUserAsync(int userId, int seriesId, @@ -211,10 +211,10 @@ public async Task> AddReadingProgressModifiers(i return items; } - public async Task GetReadingListDtoByTitleAsync(string title) + public async Task GetReadingListDtoByTitleAsync(int userId, string title) { return await _context.ReadingList - .Where(r => r.Title.Equals(title)) + .Where(r => r.Title.Equals(title) && r.AppUserId == userId) .ProjectTo(_mapper.ConfigurationProvider) .SingleOrDefaultAsync(); } diff --git a/API/Extensions/IdentityServiceExtensions.cs b/API/Extensions/IdentityServiceExtensions.cs index 043e5c919..5cc4718bb 100644 --- a/API/Extensions/IdentityServiceExtensions.cs +++ b/API/Extensions/IdentityServiceExtensions.cs @@ -1,4 +1,5 @@ -using System.Text; +using System; +using System.Text; using System.Threading.Tasks; using API.Constants; using API.Data; @@ -32,6 +33,11 @@ public static IServiceCollection AddIdentityServices(this IServiceCollection ser opt.Password.RequiredLength = 6; opt.SignIn.RequireConfirmedEmail = true; + + opt.Lockout.AllowedForNewUsers = true; + opt.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(10); + opt.Lockout.MaxFailedAccessAttempts = 5; + }) .AddTokenProvider>(TokenOptions.DefaultProvider) .AddRoles() diff --git a/API/Services/ImageService.cs b/API/Services/ImageService.cs index a1ab70fd0..4dd31db8c 100644 --- a/API/Services/ImageService.cs +++ b/API/Services/ImageService.cs @@ -27,6 +27,8 @@ public interface IImageService /// Full path to the image to convert /// File of written webp image Task ConvertToWebP(string filePath, string outputPath); + + Task IsImage(string filePath); } public class ImageService : IImageService @@ -115,6 +117,23 @@ public async Task ConvertToWebP(string filePath, string outputPath) return outputFile; } + public async Task IsImage(string filePath) + { + try + { + var info = await SixLabors.ImageSharp.Image.IdentifyAsync(filePath); + if (info == null) return false; + + return true; + } + catch (Exception ex) + { + /* Swallow Exception */ + } + + return false; + } + /// public string CreateThumbnailFromBase64(string encodedImage, string fileName) diff --git a/Kavita.Common/Kavita.Common.csproj b/Kavita.Common/Kavita.Common.csproj index 7c99c09fc..debd9b5a9 100644 --- a/Kavita.Common/Kavita.Common.csproj +++ b/Kavita.Common/Kavita.Common.csproj @@ -4,7 +4,7 @@ net6.0 kavitareader.com Kavita - 0.5.4.0 + 0.5.4.1 en diff --git a/README.md b/README.md index e4f47b795..b92725d04 100644 --- a/README.md +++ b/README.md @@ -21,12 +21,12 @@ your reading collection with your friends and family! - [x] Serve up Manga/Webtoons/Comics (cbr, cbz, zip/rar, 7zip, raw images) and Books (epub, pdf) - [x] First class responsive readers that work great on any device (phone, tablet, desktop) - [x] Dark mode and customizable theming support -- [ ] Provide hooks into metadata providers to fetch metadata for Comics, Manga, and Books +- [ ] Provide a plugin system to allow external metadata integration and scrobbling for read status, ratings, and reviews - [x] Metadata should allow for collections, want to read integration from 3rd party services, genres. - [x] Ability to manage users, access, and ratings -- [ ] Ability to sync ratings and reviews to external services - [x] Fully Accessible with active accessibility audits - [x] Dedicated webtoon reading mode +- [ ] Full localization support - [ ] And so much [more...](https://github.com/Kareadita/Kavita/projects) ## Support @@ -93,6 +93,9 @@ Thank you to [ JetBrains](http: ## Palace-Designs We would like to extend a big thank you to [](https://www.palace-designs.com/) who hosts our infrastructure pro-bono. +## Huntr +We would like to extend a big thank you to [Huntr](https://huntr.dev/repos/kareadita/kavita) who has worked with Kavita in reporting security vulnerabilities. If you are interested in +being paid to help secure Kavita, please give them a try. ### License diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..56f010fb3 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,10 @@ +# Security Policy + +## Supported Versions + +Security is maintained on latest stable version only. + +## Reporting a Vulnerability + + +Please reach out to majora2007 via our Discord or you can (and should) report your vulnerability via [Huntr](https://huntr.dev/repos/kareadita/kavita).