From cf0778245eb7d3ee5c8a53cc2299070eba53c2ec Mon Sep 17 00:00:00 2001 From: Santosh Yadav Date: Wed, 4 Aug 2021 15:55:51 +0530 Subject: [PATCH 01/11] doc: use Angular as the example is for Angular --- app/config/platforms.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/config/platforms.php b/app/config/platforms.php index 50b8e4f745..ba1f54cc96 100644 --- a/app/config/platforms.php +++ b/app/config/platforms.php @@ -45,7 +45,7 @@ return [ ], [ 'icon' => 'angular.svg', - 'name' => 'Todo App with Angular.js', + 'name' => 'Todo App with Angular', 'description' => 'A simple Todo app that uses both the Appwrite account and database APIs.', 'source' => 'https://github.com/appwrite/todo-with-angular', 'url' => 'https://appwrite-todo-with-angular.vercel.app/', From d8d141496274fc7692e74020271deef8c3875957 Mon Sep 17 00:00:00 2001 From: Torsten Dittmann Date: Tue, 10 Aug 2021 10:30:39 +0200 Subject: [PATCH 02/11] prepare 0.9.4 version --- README.md | 6 +++--- app/init.php | 2 +- src/Appwrite/Migration/Migration.php | 1 + 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index c0c5077e0d..e8b8daf8f9 100644 --- a/README.md +++ b/README.md @@ -56,7 +56,7 @@ docker run -it --rm \ --volume /var/run/docker.sock:/var/run/docker.sock \ --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \ --entrypoint="install" \ - appwrite/appwrite:0.9.3 + appwrite/appwrite:0.9.4 ``` ### Windows @@ -68,7 +68,7 @@ docker run -it --rm ^ --volume //var/run/docker.sock:/var/run/docker.sock ^ --volume "%cd%"/appwrite:/usr/src/code/appwrite:rw ^ --entrypoint="install" ^ - appwrite/appwrite:0.9.3 + appwrite/appwrite:0.9.4 ``` #### PowerShell @@ -78,7 +78,7 @@ docker run -it --rm , --volume /var/run/docker.sock:/var/run/docker.sock , --volume ${pwd}/appwrite:/usr/src/code/appwrite:rw , --entrypoint="install" , - appwrite/appwrite:0.9.3 + appwrite/appwrite:0.9.4 ``` Once the Docker installation completes, go to http://localhost to access the Appwrite console from your browser. Please note that on non-linux native hosts, the server might take a few minutes to start after installation completes. diff --git a/app/init.php b/app/init.php index d0271e2c41..88ac10f294 100644 --- a/app/init.php +++ b/app/init.php @@ -48,7 +48,7 @@ const APP_MODE_DEFAULT = 'default'; const APP_MODE_ADMIN = 'admin'; const APP_PAGING_LIMIT = 12; const APP_CACHE_BUSTER = 150; -const APP_VERSION_STABLE = '0.9.3'; +const APP_VERSION_STABLE = '0.9.4'; const APP_STORAGE_UPLOADS = '/storage/uploads'; const APP_STORAGE_FUNCTIONS = '/storage/functions'; const APP_STORAGE_CACHE = '/storage/cache'; diff --git a/src/Appwrite/Migration/Migration.php b/src/Appwrite/Migration/Migration.php index 9f5d12d47d..203af0c67d 100644 --- a/src/Appwrite/Migration/Migration.php +++ b/src/Appwrite/Migration/Migration.php @@ -42,6 +42,7 @@ abstract class Migration '0.9.1' => 'V08', '0.9.2' => 'V08', '0.9.3' => 'V08', + '0.9.4' => 'V08', ]; /** From c52672bc9a99e144febfdad644ee225215a6bc1e Mon Sep 17 00:00:00 2001 From: Damodar Lohani Date: Sun, 1 Aug 2021 14:39:26 +0545 Subject: [PATCH 03/11] hot fix api issue --- app/controllers/api/projects.php | 8 ++++++++ app/views/console/home/index.phtml | 1 + 2 files changed, 9 insertions(+) diff --git a/app/controllers/api/projects.php b/app/controllers/api/projects.php index 2bac0efb85..bc4e5a6b1a 100644 --- a/app/controllers/api/projects.php +++ b/app/controllers/api/projects.php @@ -21,6 +21,14 @@ use Appwrite\Network\Validator\Domain as DomainValidator; use Appwrite\Utopia\Response; use Cron\CronExpression; +App::init(function ($project) { + /** @var Utopia\Database\Document $project */ + + if($project->getId() !== 'console') { + throw new Exception('Access to this API is forbidden.', 401); + } +}, ['project'], 'projects'); + App::post('/v1/projects') ->desc('Create Project') ->groups(['api', 'projects']) diff --git a/app/views/console/home/index.phtml b/app/views/console/home/index.phtml index 021cf89928..2342a2af23 100644 --- a/app/views/console/home/index.phtml +++ b/app/views/console/home/index.phtml @@ -79,6 +79,7 @@ $usageStatsEnabled = $this->getParam('usageStatsEnabled',true);
From 0ad7d35bb038d298f1c8ea99397b11ebee1ecaad Mon Sep 17 00:00:00 2001 From: Torsten Dittmann Date: Tue, 10 Aug 2021 11:03:28 +0200 Subject: [PATCH 04/11] chore(changes): 0.9.4 changelog --- CHANGES.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGES.md b/CHANGES.md index c6e74d8528..210c82788f 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -1,3 +1,9 @@ +# Version 0.9.4 + +## Security + +- Fixed security vulnerability that exposes project ID's from other admin users + # Version 0.9.3 ## Bugs From 7af9bdbe3a454d12aefdb09a6002dbb34b7322fe Mon Sep 17 00:00:00 2001 From: Torsten Dittmann Date: Tue, 10 Aug 2021 11:07:53 +0200 Subject: [PATCH 05/11] chore(changes): 0.9.4 changelog --- CHANGES.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGES.md b/CHANGES.md index 210c82788f..c63d0205ef 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -2,7 +2,7 @@ ## Security -- Fixed security vulnerability that exposes project ID's from other admin users +- Fixed security vulnerability that exposes project ID's from other admin users (#1453) # Version 0.9.3 From 474a283cc188216f9d9163c9d020fe86172a8b57 Mon Sep 17 00:00:00 2001 From: Torsten Dittmann Date: Wed, 18 Aug 2021 13:24:25 +0200 Subject: [PATCH 06/11] docker(traefik): update to 2.5 --- app/views/install/compose.phtml | 2 +- docker-compose.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/app/views/install/compose.phtml b/app/views/install/compose.phtml index c110fcd4eb..95e33b9ea2 100644 --- a/app/views/install/compose.phtml +++ b/app/views/install/compose.phtml @@ -9,7 +9,7 @@ $image = $this->getParam('image', ''); services: traefik: - image: traefik:2.3 + image: traefik:2.5 container_name: appwrite-traefik command: - --providers.file.directory=/storage/config diff --git a/docker-compose.yml b/docker-compose.yml index 31f673c2af..86b1e4dc23 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -7,7 +7,7 @@ version: '3' services: traefik: - image: traefik:2.3 + image: traefik:2.5 container_name: appwrite-traefik command: - --log.level=DEBUG From 6a2c8c1478e1781fad3d1bc409572843f60f6ec8 Mon Sep 17 00:00:00 2001 From: Torsten Dittmann Date: Wed, 18 Aug 2021 13:29:48 +0200 Subject: [PATCH 07/11] deps(php): update swoole and imagick --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index d15dbf508e..5b2224323c 100755 --- a/Dockerfile +++ b/Dockerfile @@ -18,8 +18,8 @@ ARG DEBUG=false ENV DEBUG=$DEBUG ENV PHP_REDIS_VERSION=5.3.4 \ - PHP_SWOOLE_VERSION=v4.6.7 \ - PHP_IMAGICK_VERSION=3.5.0 \ + PHP_SWOOLE_VERSION=v4.7.0 \ + PHP_IMAGICK_VERSION=3.5.1 \ PHP_YAML_VERSION=2.2.1 \ PHP_MAXMINDDB_VERSION=v1.10.1 From 00ec0a1f9d0c6fd59ce7274aa7281c6c182c2a62 Mon Sep 17 00:00:00 2001 From: Torsten Dittmann Date: Wed, 18 Aug 2021 14:54:30 +0200 Subject: [PATCH 08/11] ci(travis): improve build speed and arm stability --- .travis.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.travis.yml b/.travis.yml index af63bd6030..7f47068982 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,8 +1,8 @@ -dist: xenial +dist: focal arch: - amd64 - - arm64 + - arm64-graviton2 os: linux @@ -30,6 +30,7 @@ before_install: - echo "_APP_FUNCTIONS_RUNTIMES=php-8.0" >> .env install: +- docker-compose build --parallel - docker-compose up -d - sleep 10 From 4a48f5348b32fceaf8d4883d40eb238897af2905 Mon Sep 17 00:00:00 2001 From: Torsten Dittmann Date: Wed, 18 Aug 2021 15:25:29 +0200 Subject: [PATCH 09/11] ci(travis): remove parallel build --- .travis.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.travis.yml b/.travis.yml index 7f47068982..ab378158fb 100644 --- a/.travis.yml +++ b/.travis.yml @@ -30,8 +30,7 @@ before_install: - echo "_APP_FUNCTIONS_RUNTIMES=php-8.0" >> .env install: -- docker-compose build --parallel -- docker-compose up -d +- docker-compose up -d --build - sleep 10 script: From c43f13a5ddfa852817ed9446ef370e9fdc63b340 Mon Sep 17 00:00:00 2001 From: Torsten Dittmann Date: Wed, 18 Aug 2021 16:14:34 +0200 Subject: [PATCH 10/11] ci(travis): print logs after failure --- .travis.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.travis.yml b/.travis.yml index ab378158fb..3381c3ecb2 100644 --- a/.travis.yml +++ b/.travis.yml @@ -41,6 +41,9 @@ script: - docker-compose exec appwrite vars - docker-compose exec appwrite test --debug +after_failure: +- docker-compose logs appwrite + deploy: - provider: script edge: true From 9170f64a75039d785e70520d01aa9734aa4d9264 Mon Sep 17 00:00:00 2001 From: Damodar Lohani Date: Thu, 19 Aug 2021 10:50:21 +0545 Subject: [PATCH 11/11] fix changed getURL to getPath --- app/controllers/general.php | 2 +- app/controllers/mock.php | 4 ++-- app/controllers/shared/api.php | 2 +- composer.json | 2 +- composer.lock | 15 +++++++-------- src/Appwrite/Specification/Format/OpenAPI3.php | 2 +- src/Appwrite/Specification/Format/Swagger2.php | 2 +- 7 files changed, 14 insertions(+), 15 deletions(-) diff --git a/app/controllers/general.php b/app/controllers/general.php index 708e249853..0af6d92fd4 100644 --- a/app/controllers/general.php +++ b/app/controllers/general.php @@ -316,7 +316,7 @@ App::error(function ($error, $utopia, $request, $response, $layout, $project) { if($route) { Console::error('[Error] Method: '.$route->getMethod()); - Console::error('[Error] URL: '.$route->getURL()); + Console::error('[Error] URL: '.$route->getPath()); } Console::error('[Error] Type: '.get_class($error)); diff --git a/app/controllers/mock.php b/app/controllers/mock.php index 2cad650f58..d4076547e0 100644 --- a/app/controllers/mock.php +++ b/app/controllers/mock.php @@ -518,7 +518,7 @@ App::shutdown(function($utopia, $response, $request) { throw new Exception('Failed to read results', 500); } - $result[$route->getMethod() . ':' . $route->getURL()] = true; + $result[$route->getMethod() . ':' . $route->getPath()] = true; $tests = \array_merge($tests, $result); @@ -526,5 +526,5 @@ App::shutdown(function($utopia, $response, $request) { throw new Exception('Failed to save resutls', 500); } - $response->dynamic(new Document(['result' => $route->getMethod() . ':' . $route->getURL() . ':passed']), Response::MODEL_MOCK); + $response->dynamic(new Document(['result' => $route->getMethod() . ':' . $route->getPath() . ':passed']), Response::MODEL_MOCK); }, ['utopia', 'response', 'request'], 'mock'); \ No newline at end of file diff --git a/app/controllers/shared/api.php b/app/controllers/shared/api.php index 4ebe7f32af..0df72d0578 100644 --- a/app/controllers/shared/api.php +++ b/app/controllers/shared/api.php @@ -40,7 +40,7 @@ App::init(function ($utopia, $request, $response, $project, $user, $register, $e ->setParam('{userId}', $user->getId()) ->setParam('{userAgent}', $request->getUserAgent('')) ->setParam('{ip}', $request->getIP()) - ->setParam('{url}', $request->getHostname().$route->getURL()) + ->setParam('{url}', $request->getHostname().$route->getPath()) ; //TODO make sure we get array here diff --git a/composer.json b/composer.json index fe173521c2..9c18073123 100644 --- a/composer.json +++ b/composer.json @@ -38,7 +38,7 @@ "appwrite/php-clamav": "1.1.*", "appwrite/php-runtimes": "0.4.*", - "utopia-php/framework": "0.17.*", + "utopia-php/framework": "0.18.*", "utopia-php/abuse": "0.5.*", "utopia-php/analytics": "0.2.*", "utopia-php/audit": "0.5.*", diff --git a/composer.lock b/composer.lock index 9db0fcb302..e0858de93c 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "63a89a825697892a52aa27d6819b5972", + "content-hash": "45963af754680568d89330a4f37c40d1", "packages": [ { "name": "adhocore/jwt", @@ -1756,16 +1756,16 @@ }, { "name": "utopia-php/framework", - "version": "0.17.2", + "version": "0.18.0", "source": { "type": "git", "url": "https://github.com/utopia-php/framework.git", - "reference": "3cd5fa2a9e30040277861f4254c5ccd1b1600952" + "reference": "f577522a5eb8009967b893fb7ad4ee70d3f7c0db" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/utopia-php/framework/zipball/3cd5fa2a9e30040277861f4254c5ccd1b1600952", - "reference": "3cd5fa2a9e30040277861f4254c5ccd1b1600952", + "url": "https://api.github.com/repos/utopia-php/framework/zipball/f577522a5eb8009967b893fb7ad4ee70d3f7c0db", + "reference": "f577522a5eb8009967b893fb7ad4ee70d3f7c0db", "shasum": "" }, "require": { @@ -1799,9 +1799,9 @@ ], "support": { "issues": "https://github.com/utopia-php/framework/issues", - "source": "https://github.com/utopia-php/framework/tree/0.17.2" + "source": "https://github.com/utopia-php/framework/tree/0.18.0" }, - "time": "2021-08-02T10:18:26+00:00" + "time": "2021-08-19T04:58:47+00:00" }, { "name": "utopia-php/image", @@ -4882,7 +4882,6 @@ "type": "github" } ], - "abandoned": true, "time": "2020-09-28T06:45:17+00:00" }, { diff --git a/src/Appwrite/Specification/Format/OpenAPI3.php b/src/Appwrite/Specification/Format/OpenAPI3.php index b14134cdf2..d01a7da72e 100644 --- a/src/Appwrite/Specification/Format/OpenAPI3.php +++ b/src/Appwrite/Specification/Format/OpenAPI3.php @@ -91,7 +91,7 @@ class OpenAPI3 extends Format $usedModels = []; foreach ($this->routes as $route) { /** @var \Utopia\Route $route */ - $url = \str_replace('/v1', '', $route->getURL()); + $url = \str_replace('/v1', '', $route->getPath()); $scope = $route->getLabel('scope', ''); $hide = $route->getLabel('sdk.hide', false); $consumes = [$route->getLabel('sdk.request.type', 'application/json')]; diff --git a/src/Appwrite/Specification/Format/Swagger2.php b/src/Appwrite/Specification/Format/Swagger2.php index 9809220f87..dfb6bdc987 100644 --- a/src/Appwrite/Specification/Format/Swagger2.php +++ b/src/Appwrite/Specification/Format/Swagger2.php @@ -89,7 +89,7 @@ class Swagger2 extends Format $usedModels = []; foreach ($this->routes as $route) { /** @var \Utopia\Route $route */ - $url = \str_replace('/v1', '', $route->getURL()); + $url = \str_replace('/v1', '', $route->getPath()); $scope = $route->getLabel('scope', ''); $hide = $route->getLabel('sdk.hide', false); $consumes = [$route->getLabel('sdk.request.type', 'application/json')];