- - -
-
diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..c0fafb4f --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,44 @@ +# Security Policy + +## Introduction + +The Postiz app is committed to ensuring the security and integrity of our users' data. This security policy outlines our procedures for handling security vulnerabilities and our disclosure policy. + +## Reporting Security Vulnerabilities + +If you discover a security vulnerability in the Postiz app, please report it to us privately via email to one of the maintainers: + +* @nevo-david +* @jamesread ([email](mailto:contact@jread.com)) +* @jonathan-irvin ([email](mailto:offendingcommit@gmail.com)) + +When reporting a security vulnerability, please provide as much detail as possible, including: + +* A clear description of the vulnerability +* Steps to reproduce the vulnerability +* Any relevant code or configuration files + +## Supported Versions + +This project currently only supports the latest release. We recommend that users always use the latest version of the Postiz app to ensure they have the latest security patches. + +## Disclosure Guidelines + +We follow a private disclosure policy. If you discover a security vulnerability, please report it to us privately via email to one of the maintainers listed above. We will respond promptly to reports of vulnerabilities and work to resolve them as quickly as possible. + +We will not publicly disclose security vulnerabilities until a patch or fix is available to prevent malicious actors from exploiting the vulnerability before a fix is released. + +## Security Vulnerability Response Process + +We take security vulnerabilities seriously and will respond promptly to reports of vulnerabilities. Our response process includes: + +* Investigating the report and verifying the vulnerability. +* Developing a patch or fix for the vulnerability. +* Releasing the patch or fix as soon as possible. +* Notifying users of the vulnerability and the patch or fix. + +## Template Attribution + +This SECURITY.md file is based on the [GitHub Security Policy Template](https://github.com/github/security/blob/master/SECURITY.md). + +Thank you for helping to keep the `postiz-app` secure! diff --git a/apps/backend/src/api/api.module.ts b/apps/backend/src/api/api.module.ts index 01156270..d60fabc3 100644 --- a/apps/backend/src/api/api.module.ts +++ b/apps/backend/src/api/api.module.ts @@ -11,7 +11,6 @@ import { PermissionsService } from '@gitroom/backend/services/auth/permissions/p import { IntegrationsController } from '@gitroom/backend/api/routes/integrations.controller'; import { IntegrationManager } from '@gitroom/nestjs-libraries/integrations/integration.manager'; import { SettingsController } from '@gitroom/backend/api/routes/settings.controller'; -import { ioRedis } from '@gitroom/nestjs-libraries/redis/redis.service'; import { PostsController } from '@gitroom/backend/api/routes/posts.controller'; import { MediaController } from '@gitroom/backend/api/routes/media.controller'; import { UploadModule } from '@gitroom/nestjs-libraries/upload/upload.module'; @@ -27,6 +26,7 @@ import { CodesService } from '@gitroom/nestjs-libraries/services/codes.service'; import { CopilotController } from '@gitroom/backend/api/routes/copilot.controller'; import { AgenciesController } from '@gitroom/backend/api/routes/agencies.controller'; import { PublicController } from '@gitroom/backend/api/routes/public.controller'; +import { RootController } from '@gitroom/backend/api/routes/root.controller'; const authenticatedController = [ UsersController, @@ -60,6 +60,7 @@ const authenticatedController = [ : []), ], controllers: [ + RootController, StripeController, AuthController, PublicController, diff --git a/apps/backend/src/api/routes/auth.controller.ts b/apps/backend/src/api/routes/auth.controller.ts index bd14422e..ba394cc4 100644 --- a/apps/backend/src/api/routes/auth.controller.ts +++ b/apps/backend/src/api/routes/auth.controller.ts @@ -8,11 +8,15 @@ import { ForgotReturnPasswordDto } from '@gitroom/nestjs-libraries/dtos/auth/for import { ForgotPasswordDto } from '@gitroom/nestjs-libraries/dtos/auth/forgot.password.dto'; import { ApiTags } from '@nestjs/swagger'; import { getCookieUrlFromDomain } from '@gitroom/helpers/subdomain/subdomain.management'; +import { EmailService } from '@gitroom/nestjs-libraries/services/email.service'; @ApiTags('Auth') @Controller('/auth') export class AuthController { - constructor(private _authService: AuthService) {} + constructor( + private _authService: AuthService, + private _emailService: EmailService + ) {} @Post('/register') async register( @Req() req: Request, @@ -30,7 +34,9 @@ export class AuthController { getOrgFromCookie ); - if (body.provider === 'LOCAL') { + const activationRequired = body.provider === 'LOCAL' && this._emailService.hasProvider(); + + if (activationRequired) { response.header('activate', 'true'); response.status(200).json({ activate: true }); return; diff --git a/apps/backend/src/api/routes/integrations.controller.ts b/apps/backend/src/api/routes/integrations.controller.ts index a9a92b2d..6d89b46e 100644 --- a/apps/backend/src/api/routes/integrations.controller.ts +++ b/apps/backend/src/api/routes/integrations.controller.ts @@ -27,6 +27,7 @@ import { GetUserFromRequest } from '@gitroom/nestjs-libraries/user/user.from.req import { NotEnoughScopesFilter } from '@gitroom/nestjs-libraries/integrations/integration.missing.scopes'; import { PostsService } from '@gitroom/nestjs-libraries/database/prisma/posts/posts.service'; import { IntegrationTimeDto } from '@gitroom/nestjs-libraries/dtos/integrations/integration.time.dto'; +import { AuthService } from '@gitroom/helpers/auth/auth.service'; @ApiTags('Integrations') @Controller('/integrations') @@ -46,21 +47,68 @@ export class IntegrationsController { return { integrations: ( await this._integrationService.getIntegrationsList(org.id) - ).map((p) => ({ - name: p.name, - id: p.id, - internalId: p.internalId, - disabled: p.disabled, - picture: p.picture, - identifier: p.providerIdentifier, - inBetweenSteps: p.inBetweenSteps, - refreshNeeded: p.refreshNeeded, - type: p.type, - time: JSON.parse(p.postingTimes) - })), + ).map((p) => { + const findIntegration = this._integrationManager.getSocialIntegration( + p.providerIdentifier + ); + return { + name: p.name, + id: p.id, + internalId: p.internalId, + disabled: p.disabled, + picture: p.picture, + identifier: p.providerIdentifier, + inBetweenSteps: p.inBetweenSteps, + refreshNeeded: p.refreshNeeded, + type: p.type, + time: JSON.parse(p.postingTimes), + changeProfilePicture: !!findIntegration?.changeProfilePicture, + changeNickName: !!findIntegration?.changeNickname, + }; + }), }; } + @Post('/:id/nickname') + async setNickname( + @GetOrgFromRequest() org: Organization, + @Param('id') id: string, + @Body() body: { name: string; picture: string } + ) { + const integration = await this._integrationService.getIntegrationById( + org.id, + id + ); + if (!integration) { + throw new Error('Invalid integration'); + } + + const manager = this._integrationManager.getSocialIntegration( + integration.providerIdentifier + ); + if (!manager.changeProfilePicture && !manager.changeNickname) { + throw new Error('Invalid integration'); + } + + const { url } = manager.changeProfilePicture + ? await manager.changeProfilePicture( + integration.internalId, + integration.token, + body.picture + ) + : { url: '' }; + + const { name } = manager.changeNickname + ? await manager.changeNickname( + integration.internalId, + integration.token, + body.name + ) + : { name: '' }; + + return this._integrationService.updateNameAndUrl(id, name, url); + } + @Get('/:id') getSingleIntegration( @Param('id') id: string, @@ -80,7 +128,8 @@ export class IntegrationsController { @CheckPolicies([AuthorizationActions.Create, Sections.CHANNEL]) async getIntegrationUrl( @Param('integration') integration: string, - @Query('refresh') refresh: string + @Query('refresh') refresh: string, + @Query('externalUrl') externalUrl: string ) { if ( !this._integrationManager @@ -92,11 +141,33 @@ export class IntegrationsController { const integrationProvider = this._integrationManager.getSocialIntegration(integration); - const { codeVerifier, state, url } = - await integrationProvider.generateAuthUrl(refresh); - await ioRedis.set(`login:${state}`, codeVerifier, 'EX', 300); - return { url }; + if (integrationProvider.externalUrl && !externalUrl) { + throw new Error('Missing external url'); + } + + try { + const getExternalUrl = integrationProvider.externalUrl + ? { + ...(await integrationProvider.externalUrl(externalUrl)), + instanceUrl: externalUrl, + } + : undefined; + + const { codeVerifier, state, url } = + await integrationProvider.generateAuthUrl(refresh, getExternalUrl); + await ioRedis.set(`login:${state}`, codeVerifier, 'EX', 300); + await ioRedis.set( + `external:${state}`, + JSON.stringify(getExternalUrl), + 'EX', + 300 + ); + + return { url }; + } catch (err) { + return { err: true }; + } } @Post('/:id/time') @@ -129,7 +200,11 @@ export class IntegrationsController { } if (integrationProvider[body.name]) { - return integrationProvider[body.name](getIntegration.token, body.data); + return integrationProvider[body.name]( + getIntegration.token, + body.data, + getIntegration.internalId + ); } throw new Error('Function not found'); } @@ -144,7 +219,11 @@ export class IntegrationsController { } if (integrationProvider[body.name]) { - return integrationProvider[body.name](getIntegration.token, body.data); + return integrationProvider[body.name]( + getIntegration.token, + body.data, + getIntegration.internalId + ); } throw new Error('Function not found'); } @@ -209,15 +288,28 @@ export class IntegrationsController { throw new Error('Integration not allowed'); } - const getCodeVerifier = await ioRedis.get(`login:${body.state}`); + const integrationProvider = + this._integrationManager.getSocialIntegration(integration); + + const getCodeVerifier = integrationProvider.customFields + ? 'none' + : await ioRedis.get(`login:${body.state}`); if (!getCodeVerifier) { throw new Error('Invalid state'); } - await ioRedis.del(`login:${body.state}`); + if (!integrationProvider.customFields) { + await ioRedis.del(`login:${body.state}`); + } + + const details = integrationProvider.externalUrl + ? await ioRedis.get(`external:${body.state}`) + : undefined; + + if (details) { + await ioRedis.del(`external:${body.state}`); + } - const integrationProvider = - this._integrationManager.getSocialIntegration(integration); const { accessToken, expiresIn, @@ -226,11 +318,14 @@ export class IntegrationsController { name, picture, username, - } = await integrationProvider.authenticate({ - code: body.code, - codeVerifier: getCodeVerifier, - refresh: body.refresh, - }); + } = await integrationProvider.authenticate( + { + code: body.code, + codeVerifier: getCodeVerifier, + refresh: body.refresh, + }, + details ? JSON.parse(details) : undefined + ); if (!id) { throw new Error('Invalid api key'); @@ -249,7 +344,14 @@ export class IntegrationsController { username, integrationProvider.isBetweenSteps, body.refresh, - +body.timezone + +body.timezone, + details + ? AuthService.fixedEncryption(details) + : integrationProvider.customFields + ? AuthService.fixedEncryption( + Buffer.from(body.code, 'base64').toString() + ) + : undefined ); } diff --git a/apps/backend/src/api/routes/root.controller.ts b/apps/backend/src/api/routes/root.controller.ts new file mode 100644 index 00000000..c79d9080 --- /dev/null +++ b/apps/backend/src/api/routes/root.controller.ts @@ -0,0 +1,8 @@ +import { Controller, Get } from '@nestjs/common'; +@Controller('/') +export class RootController { + @Get('/') + getRoot(): string { + return 'App is running!'; + } +} diff --git a/apps/backend/src/api/routes/users.controller.ts b/apps/backend/src/api/routes/users.controller.ts index e8d52049..85311535 100644 --- a/apps/backend/src/api/routes/users.controller.ts +++ b/apps/backend/src/api/routes/users.controller.ts @@ -21,7 +21,7 @@ import { AuthorizationActions, Sections, } from '@gitroom/backend/services/auth/permissions/permissions.service'; -import { removeSubdomain } from '@gitroom/helpers/subdomain/subdomain.management'; +import { getCookieUrlFromDomain } from '@gitroom/helpers/subdomain/subdomain.management'; import { pricing } from '@gitroom/nestjs-libraries/database/prisma/subscriptions/pricing'; import { ApiTags } from '@nestjs/swagger'; import { UsersService } from '@gitroom/nestjs-libraries/database/prisma/users/users.service'; @@ -92,8 +92,7 @@ export class UsersController { } response.cookie('impersonate', id, { - domain: - '.' + new URL(removeSubdomain(process.env.FRONTEND_URL!)).hostname, + domain: getCookieUrlFromDomain(process.env.FRONTEND_URL!), secure: true, httpOnly: true, sameSite: 'none', @@ -163,8 +162,7 @@ export class UsersController { @Res({ passthrough: true }) response: Response ) { response.cookie('showorg', id, { - domain: - '.' + new URL(removeSubdomain(process.env.FRONTEND_URL!)).hostname, + domain: getCookieUrlFromDomain(process.env.FRONTEND_URL!), secure: true, httpOnly: true, sameSite: 'none', @@ -177,8 +175,7 @@ export class UsersController { @Post('/logout') logout(@Res({ passthrough: true }) response: Response) { response.cookie('auth', '', { - domain: - '.' + new URL(removeSubdomain(process.env.FRONTEND_URL!)).hostname, + domain: getCookieUrlFromDomain(process.env.FRONTEND_URL!), secure: true, httpOnly: true, maxAge: -1, @@ -187,8 +184,7 @@ export class UsersController { }); response.cookie('showorg', '', { - domain: - '.' + new URL(removeSubdomain(process.env.FRONTEND_URL!)).hostname, + domain: getCookieUrlFromDomain(process.env.FRONTEND_URL!), secure: true, httpOnly: true, maxAge: -1, @@ -197,8 +193,7 @@ export class UsersController { }); response.cookie('impersonate', '', { - domain: - '.' + new URL(removeSubdomain(process.env.FRONTEND_URL!)).hostname, + domain: getCookieUrlFromDomain(process.env.FRONTEND_URL!), secure: true, httpOnly: true, maxAge: -1, diff --git a/apps/backend/src/main.ts b/apps/backend/src/main.ts index 7cc0a962..30f1be83 100644 --- a/apps/backend/src/main.ts +++ b/apps/backend/src/main.ts @@ -8,6 +8,7 @@ import { NestFactory } from '@nestjs/core'; import { AppModule } from './app.module'; import { SubscriptionExceptionFilter } from '@gitroom/backend/services/auth/permissions/subscription.exception'; import { HttpExceptionFilter } from '@gitroom/nestjs-libraries/services/exception.filter'; +import { ConfigurationChecker } from '@gitroom/helpers/configuration/configuration.checker'; async function bootstrap() { const app = await NestFactory.create(AppModule, { @@ -38,6 +39,8 @@ async function bootstrap() { try { await app.listen(port); + + checkConfiguration() // Do this last, so that users will see obvious issues at the end of the startup log without having to scroll up. Logger.log(`🚀 Backend is running on: http://localhost:${port}`); } catch (e) { @@ -45,4 +48,20 @@ async function bootstrap() { } } +function checkConfiguration() { + const checker = new ConfigurationChecker(); + checker.readEnvFromProcess() + checker.check() + + if (checker.hasIssues()) { + for (const issue of checker.getIssues()) { + Logger.warn(issue, 'Configuration issue') + } + + Logger.warn("Configuration issues found: " + checker.getIssuesCount()) + } else { + Logger.log("Configuration check completed without any issues.") + } +} + bootstrap(); diff --git a/apps/commands/src/command.module.ts b/apps/commands/src/command.module.ts index dfa6acaa..9430ef56 100644 --- a/apps/commands/src/command.module.ts +++ b/apps/commands/src/command.module.ts @@ -4,11 +4,12 @@ import { CheckStars } from './tasks/check.stars'; import { DatabaseModule } from '@gitroom/nestjs-libraries/database/prisma/database.module'; import { RefreshTokens } from './tasks/refresh.tokens'; import { BullMqModule } from '@gitroom/nestjs-libraries/bull-mq-transport-new/bull.mq.module'; +import { ConfigurationTask } from './tasks/configuration'; @Module({ imports: [ExternalCommandModule, DatabaseModule, BullMqModule], controllers: [], - providers: [CheckStars, RefreshTokens], + providers: [CheckStars, RefreshTokens, ConfigurationTask], get exports() { return [...this.imports, ...this.providers]; }, diff --git a/apps/commands/src/tasks/configuration.ts b/apps/commands/src/tasks/configuration.ts new file mode 100644 index 00000000..7fd6f287 --- /dev/null +++ b/apps/commands/src/tasks/configuration.ts @@ -0,0 +1,30 @@ +import { Command } from 'nestjs-command'; +import { Injectable } from '@nestjs/common'; +import { ConfigurationChecker } from '@gitroom/helpers/configuration/configuration.checker'; + +@Injectable() +export class ConfigurationTask { + @Command({ + command: 'config:check', + describe: 'Checks your configuration (.env) file for issues.', + }) + create() { + const checker = new ConfigurationChecker(); + checker.readEnvFromProcess() + checker.check() + + if (checker.hasIssues()) { + for (const issue of checker.getIssues()) { + console.warn("Configuration issue:", issue) + } + + console.error("Configuration check complete, issues: ", checker.getIssuesCount()) + } else { + console.log("Configuration check complete, no issues found.") + } + + console.log("Press Ctrl+C to exit."); + return true + } +} + diff --git a/apps/cron/src/cron.module.ts b/apps/cron/src/cron.module.ts index a44744b9..4db31e81 100644 --- a/apps/cron/src/cron.module.ts +++ b/apps/cron/src/cron.module.ts @@ -8,6 +8,6 @@ import { BullMqModule } from '@gitroom/nestjs-libraries/bull-mq-transport-new/bu @Module({ imports: [DatabaseModule, ScheduleModule.forRoot(), BullMqModule], controllers: [], - providers: [CheckStars, SyncTrending], + providers: [...(!process.env.IS_GENERAL ? [CheckStars, SyncTrending] : [])], }) export class CronModule {} diff --git a/apps/frontend/public/icons/platforms/bluesky.png b/apps/frontend/public/icons/platforms/bluesky.png new file mode 100644 index 00000000..492b23a6 Binary files /dev/null and b/apps/frontend/public/icons/platforms/bluesky.png differ diff --git a/apps/frontend/public/icons/platforms/discord.png b/apps/frontend/public/icons/platforms/discord.png new file mode 100644 index 00000000..90af762a Binary files /dev/null and b/apps/frontend/public/icons/platforms/discord.png differ diff --git a/apps/frontend/public/icons/platforms/mastodon-custom.png b/apps/frontend/public/icons/platforms/mastodon-custom.png new file mode 100644 index 00000000..79670abc Binary files /dev/null and b/apps/frontend/public/icons/platforms/mastodon-custom.png differ diff --git a/apps/frontend/public/icons/platforms/mastodon.png b/apps/frontend/public/icons/platforms/mastodon.png new file mode 100644 index 00000000..79670abc Binary files /dev/null and b/apps/frontend/public/icons/platforms/mastodon.png differ diff --git a/apps/frontend/public/icons/platforms/slack.png b/apps/frontend/public/icons/platforms/slack.png new file mode 100644 index 00000000..09cb7004 Binary files /dev/null and b/apps/frontend/public/icons/platforms/slack.png differ diff --git a/apps/frontend/src/app/(site)/integrations/social/[provider]/continue/page.tsx b/apps/frontend/src/app/(site)/integrations/social/[provider]/continue/page.tsx index bead77f8..8a06e542 100644 --- a/apps/frontend/src/app/(site)/integrations/social/[provider]/continue/page.tsx +++ b/apps/frontend/src/app/(site)/integrations/social/[provider]/continue/page.tsx @@ -4,6 +4,7 @@ export const dynamic = 'force-dynamic'; import { internalFetch } from '@gitroom/helpers/utils/internal.fetch'; import { redirect } from 'next/navigation'; +import { Redirect } from '@gitroom/frontend/components/layout/redirect'; export default async function Page({ params: { provider }, @@ -30,6 +31,22 @@ export default async function Page({ return redirect(`/launches?scope=missing`); } + if ( + data.status !== HttpStatusCode.Ok && + data.status !== HttpStatusCode.Created + ) { + return ( + <> +
+ 
+ 
+ 
+ 