3 Commits

Author SHA1 Message Date
Eva
081e78c711 Merge 90cc0b3d59 into 376f687c38 2025-02-20 21:47:06 +03:00
Eva
90cc0b3d59 client/posts: remove cache buster query string on post file change
Since filenames now use the new file's sha1.
2023-05-22 11:54:39 +02:00
Eva
a2d8454880 server/posts: file sha1 in filenames and prevent offline secret cracking
Imagine if we had a bunch of simple strings encrypted with the same key
we use to salt passwords, publicly accessible, which would undermine
our salting model by removing the requirement of filesystem access to
crack our users' passwords, requiring only database access and offline
cracking of our secret.
Wouldn't that be fun?
2023-05-22 11:54:39 +02:00
3 changed files with 5 additions and 21 deletions

View File

@ -88,7 +88,6 @@ class PostContentControl {
_evtPostContentChange(e) {
this._post = e.detail.post;
this._post.mutateContentUrl();
this._reinstall();
}

View File

@ -454,13 +454,6 @@ class Post extends events.EventTarget {
});
}
mutateContentUrl() {
this._contentUrl =
this._orig._contentUrl +
"?bypass-cache=" +
Math.round(Math.random() * 1000);
}
_updateFromResponse(response) {
const map = () => ({
_version: response.version,

View File

@ -97,20 +97,12 @@ FLAG_MAP = {
}
def get_post_security_hash(id: int) -> str:
return hmac.new(
config.config["secret"].encode("utf8"),
msg=str(id).encode("utf-8"),
digestmod="md5",
).hexdigest()[0:16]
def get_post_content_url(post: model.Post) -> str:
assert post
return "%s/posts/%d_%s.%s" % (
config.config["data_url"].rstrip("/"),
post.post_id,
get_post_security_hash(post.post_id),
post.checksum,
mime.get_extension(post.mime_type) or "dat",
)
@ -120,7 +112,7 @@ def get_post_thumbnail_url(post: model.Post) -> str:
return "%s/generated-thumbnails/%d_%s.jpg" % (
config.config["data_url"].rstrip("/"),
post.post_id,
get_post_security_hash(post.post_id),
post.checksum,
)
@ -129,7 +121,7 @@ def get_post_content_path(post: model.Post) -> str:
assert post.post_id
return "posts/%d_%s.%s" % (
post.post_id,
get_post_security_hash(post.post_id),
post.checksum,
mime.get_extension(post.mime_type) or "dat",
)
@ -138,7 +130,7 @@ def get_post_thumbnail_path(post: model.Post) -> str:
assert post
return "generated-thumbnails/%d_%s.jpg" % (
post.post_id,
get_post_security_hash(post.post_id),
post.checksum,
)
@ -146,7 +138,7 @@ def get_post_thumbnail_backup_path(post: model.Post) -> str:
assert post
return "posts/custom-thumbnails/%d_%s.dat" % (
post.post_id,
get_post_security_hash(post.post_id),
post.checksum,
)