GNUsocial/gnu-social
4
0
Fork 1
Code Issues Releases Wiki Activity

Merge branch 'remote-media-blacklist-mk2' into 'nightly'

Browse Source 
add server blacklist to StoreRemoteMedia plugin

allows server admins to block local storage of remote media from particular servers while still allowing a default policy of acceptance

See merge request !114
This commit is contained in:
mmn 2016-03-03 20:17:23 +00:00
commit a9bdf761e8
2 changed files with 43 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
plugins/StoreRemoteMedia/README
View File

@ -7,9 +7,19 @@ to the bottom of your config.php
Settings
========
domain_blacklist: Array of regular expressions. Always escape your dots and end your strings.
check_blacklist: Whether to check the domain_blacklist.
domain_whitelist: Array of regular expressions. Always escape your dots and end your strings.
check_whitelist: Whether to check the domain_whitelist.
When check_whitelist is set, only images from URLs matching a regex in the
domain_whitelist array are accepted for local storage. When check_blacklist
is set, images from URLs matching any regex in the domain_blacklist are
denied local storage. When both lists are checked, only images from URLs
that match a regex in the domain_whitelist and that match no regexen in the
domain_blacklist are accepted for local storage.
Example
=======
addPlugin('StoreRemoteMedia', array(
@ -17,6 +27,6 @@ addPlugin('StoreRemoteMedia', array(
'^i\d*\.ytimg\.com$' => 'YouTube',
'^i\d*\.vimeocdn\.com$' => 'Vimeo'
),
'check_whitelist' => true
'check_whitelist' => true,
));

38
plugins/StoreRemoteMedia/StoreRemoteMediaPlugin.php
View File

@ -15,6 +15,9 @@ class StoreRemoteMediaPlugin extends Plugin
public $append_whitelist = array(); // fill this array as domain_whitelist to add more trusted sources
public $check_whitelist = false; // security/abuse precaution
public $domain_blacklist = array();
public $check_blacklist = false;
protected $imgData = array();
// these should be declared protected everywhere
@ -74,7 +77,10 @@ class StoreRemoteMediaPlugin extends Plugin
return true;
}
$this->checkWhitelist($file->getUrl());
if (!$this->checkWhiteList($file->getUrl()) ||
!$this->checkBlackList($file->getUrl())) {
return true;
}
// First we download the file to memory and test whether it's actually an image file
common_debug(sprintf('Downloading remote file id==%u with URL: %s', $file->getID(), _ve($file->getUrl())));
@ -124,23 +130,39 @@ class StoreRemoteMediaPlugin extends Plugin
}
/**
* @return boolean false on no check made, provider name on success
* @throws ServerException if check is made but fails
* @return boolean true if given url passes blacklist check
*/
protected function checkWhitelist($url)
protected function checkBlackList($url)
{
if (!$this->check_whitelist) {
return false; // indicates "no check made"
if (!$this->check_blacklist) {
return true;
}
$host = parse_url($url, PHP_URL_HOST);
foreach ($this->domain_blacklist as $regex => $provider) {
if (preg_match("/$regex/", $host)) {
return false;
}
}
return true;
}
/***
* @return boolean true if given url passes whitelist check
*/
protected function checkWhiteList($url)
{
if (!$this->check_whitelist) {
return true;
}
$host = parse_url($url, PHP_URL_HOST);
foreach ($this->domain_whitelist as $regex => $provider) {
if (preg_match("/$regex/", $host)) {
return $provider; // we trust this source, return provider name
return true;
}
}
throw new ServerException(sprintf(_('Domain not in remote source whitelist: %s'), $host));
return false;
}
public function onPluginVersion(array &$versions)