From f51b219860b33d550cdacada488569cc2b895eb0 Mon Sep 17 00:00:00 2001 From: Kieran Date: Mon, 30 Dec 2024 17:40:23 -0800 Subject: [PATCH] [Bugfix] Improve OPML route security (#535) * WIP - moved plugs; set up a new token-protected route plug * Added a route_token column to settings model * Hooked up token_protected_route plug to database * Hooked up new OPML route to UI; turned RSS and OPML feed buttons into links * Docs, tests * Added a note about the phoenix bug --- lib/pinchflat/settings/setting.ex | 1 + .../controllers/sources/source_html.ex | 4 +- .../source_html/actions_dropdown.html.heex | 20 +-- .../sources/source_html/index.html.heex | 9 +- lib/pinchflat_web/endpoint.ex | 7 + lib/pinchflat_web/plugs.ex | 66 +++++++ lib/pinchflat_web/router.ex | 40 +---- priv/repo/erd.png | Bin 448558 -> 452210 bytes ...1230192618_add_route_token_to_settings.exs | 11 ++ .../controllers/podcast_controller_test.exs | 21 ++- test/pinchflat_web/plugs_test.exs | 166 ++++++++++++++++++ test/pinchflat_web/routing_test.exs | 108 ------------ 12 files changed, 295 insertions(+), 158 deletions(-) create mode 100644 lib/pinchflat_web/plugs.ex create mode 100644 priv/repo/migrations/20241230192618_add_route_token_to_settings.exs create mode 100644 test/pinchflat_web/plugs_test.exs delete mode 100644 test/pinchflat_web/routing_test.exs diff --git a/lib/pinchflat/settings/setting.ex b/lib/pinchflat/settings/setting.ex index d449ca0..8e63fc7 100644 --- a/lib/pinchflat/settings/setting.ex +++ b/lib/pinchflat/settings/setting.ex @@ -31,6 +31,7 @@ defmodule Pinchflat.Settings.Setting do field :apprise_version, :string field :apprise_server, :string field :youtube_api_key, :string + field :route_token, :string field :video_codec_preference, :string field :audio_codec_preference, :string diff --git a/lib/pinchflat_web/controllers/sources/source_html.ex b/lib/pinchflat_web/controllers/sources/source_html.ex index 4692a04..57a57b4 100644 --- a/lib/pinchflat_web/controllers/sources/source_html.ex +++ b/lib/pinchflat_web/controllers/sources/source_html.ex @@ -40,11 +40,13 @@ defmodule PinchflatWeb.Sources.SourceHTML do end def rss_feed_url(conn, source) do + # NOTE: The reason for this concatenation is to avoid what appears to be a bug in Phoenix + # See: https://github.com/phoenixframework/phoenix/issues/6033 url(conn, ~p"/sources/#{source.uuid}/feed") <> ".xml" end def opml_feed_url(conn) do - url(conn, ~p"/sources/opml") <> ".xml" + url(conn, ~p"/sources/opml.xml?#{[route_token: Settings.get!(:route_token)]}") end def output_path_template_override_placeholders(media_profiles) do diff --git a/lib/pinchflat_web/controllers/sources/source_html/actions_dropdown.html.heex b/lib/pinchflat_web/controllers/sources/source_html/actions_dropdown.html.heex index f2681c0..43d0e64 100644 --- a/lib/pinchflat_web/controllers/sources/source_html/actions_dropdown.html.heex +++ b/lib/pinchflat_web/controllers/sources/source_html/actions_dropdown.html.heex @@ -1,18 +1,16 @@ <.button_dropdown text="Actions" class="justify-center w-full sm:w-50"> <:option> - copied = true, - () => copied = false - ) - "} - > + <.link href={rss_feed_url(@conn, @source)} x-data="{ copied: false }" x-on:click={~s" + $event.preventDefault(); + copyWithCallbacks( + '#{rss_feed_url(@conn, @source)}', + () => copied = true, + () => copied = false + ) + "}> Copy RSS Feed <.icon name="hero-check" class="ml-2 h-4 w-4" /> - + <:option>

Sources

-