custom/plugins/SwagPlatformSecurity/src/Fixes/NEXT15675/SecurityFix.php line 73

Open in your IDE?
  1. <?php declare(strict_types=1);
  3. namespace Swag\Security\Fixes\NEXT15675;
  5. use Shopware\Core\Content\ImportExport\Aggregate\ImportExportFile\ImportExportFileEntity;
  6. use Shopware\Core\Content\ImportExport\Exception\FileNotFoundException;
  7. use Shopware\Core\Content\ImportExport\Exception\InvalidFileAccessTokenException;
  8. use Shopware\Core\Content\ImportExport\Service\ImportExportService as CoreImportExportService;
  9. use Shopware\Core\Framework\Context;
  10. use Shopware\Core\Framework\DataAbstractionLayer\EntityRepositoryInterface;
  11. use Shopware\Core\Framework\DataAbstractionLayer\Search\Criteria;
  12. use Swag\Security\Components\AbstractSecurityFix;
  13. use Symfony\Component\DependencyInjection\ContainerBuilder;
  14. use Symfony\Component\DependencyInjection\Definition;
  15. use Symfony\Component\DependencyInjection\Reference;
  16. use Symfony\Component\HttpKernel\Event\ControllerArgumentsEvent;
  17. use Symfony\Component\HttpKernel\KernelEvents;
  18. use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
  20. class SecurityFix extends AbstractSecurityFix
  21. {
  22.     /**
  23.      * @var EntityRepositoryInterface $fileRepository
  24.      */
  25.     private $fileRepository;
  27.     /**
  28.      * @var EventDispatcherInterface $eventDispatcher
  29.      */
  30.     private $eventDispatcher;
  32.     public function __construct(EntityRepositoryInterface $fileRepository, EventDispatcherInterface $eventDispatcher)
  33.     {
  34.         $this->fileRepository = $fileRepository;
  35.         $this->eventDispatcher = $eventDispatcher;
  36.     }
  38.     public static function getTicket(): string
  39.     {
  40.         return 'NEXT-15675';
  41.     }
  43.     public static function getMaxVersion(): ?string
  44.     {
  45.         return '6.4.3.1';
  46.     }
  48.     public static function getMinVersion(): string
  49.     {
  50.         return '6.1.5';
  51.     }
  53.     public static function getSubscribedEvents(): array
  54.     {
  55.         return [
  56.             KernelEvents::CONTROLLER_ARGUMENTS => 'onControllerArguments'
  57.         ];
  58.     }
  60.     public static function buildContainer(ContainerBuilder $container): void
  61.     {
  62.         $coreImportExportService = $container->getDefinition(CoreImportExportService::class);
  64.         $def = new Definition(ImportExportService::class);
  65.         $def->setDecoratedService(CoreImportExportService::class);
  66.         $def->setArguments([$coreImportExportService->getArguments(), new Reference('import_export_file.repository')]);
  67.         $def->addTag('swag.security.fix', ['ticket' => \Swag\Security\Fixes\NEXT15675\SecurityFix::class]);
  69.         $container
  70.             ->setDefinition(ImportExportService::class, $def);
  71.     }
  73.     public function onControllerArguments(ControllerArgumentsEvent $event)
  74.     {
  75.         $request = $event->getRequest();
  77.         $route = $request->attributes->get('_route', '');
  79.         if ($route !== 'api.action.import_export.file.download') {
  80.             return;
  81.         }
  83.         $fileId = (string) $request->query->get('fileId', '');
  85.         /** @var ImportExportFileEntity $file */
  86.         $file = $this->fileRepository->search(new Criteria([$fileId]), Context::createDefaultContext())->first();
  88.         if ($file === null) {
  89.             throw new FileNotFoundException($fileId);
  90.         }
  92.         if ($file->getAccessToken() === ImportExportService::PLACEHOLDER_EMPTY_ACCESS_TOKEN) {
  93.             throw new InvalidFileAccessTokenException();
  94.         }
  96.         if ($file->getUpdatedAt() === null) {
  97.             throw new InvalidFileAccessTokenException();
  98.         }
  100.         $diff = time() - $file->getUpdatedAt()->getTimestamp();
  102.         if ($diff > 300) {
  103.             throw new InvalidFileAccessTokenException();
  104.         }
  107.         $executed = false;
  108.         $this->eventDispatcher->addListener(KernelEvents::TERMINATE, function () use($fileId, &$executed) {
  109.             if ($executed) {
  110.                 return;
  111.             }
  113.             $this->fileRepository->update([
  114.                 [
  115.                     'id' => $fileId,
  116.                     'accessToken' => ImportExportService::PLACEHOLDER_EMPTY_ACCESS_TOKEN
  117.                 ]
  118.             ], Context::createDefaultContext());
  120.             $executed = true;
  121.         });
  122.     }
  123. }