feat(vikon): rewrite VikonIntegration from scratch — OAuth + core update

- HttpTask: Laravel Http facade with SSL enabled, retry, timeout - ValidateTokenTask: token check via auth.db-nica.ru - RefreshTokenTask: token refresh via db-nica.ru - FilesystemTask: path traversal protection, blocked extensions (PHP/ASP/etc) - AuthenticateAction: OAuth2 code→token exchange - CheckAccessAction: token validation + filesystem writability check - CheckVersionAction: version comparison against remote API - UpdateCoreAction: ZIP download, Zip Slip protection, atomic sync with rollback - VikonController: thin controller, 7 endpoints with Session-based token storage - Routes: access-check, dashboard.auth, throttle:30,1 middleware - Vue 3 Composition API frontend with progress bar - Config: all secrets in .env via config/vikon.php - vikon_core kept as fallback (not deleted)
2026-07-04 12:53:28 +05:00
parent 82df1210c2
commit f4f8bc8e77
15 changed files with 990 additions and 1 deletions
@@ -0,0 +1,86 @@
+<?php
+
+namespace App\Containers\VikonIntegration\Tasks;
+
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Log;
+
+class FilesystemTask
+{
+    public function isPathSafe(string $path, string $base): bool
+    {
+        $realBase = realpath($base);
+        if ($realBase === false) return false;
+
+        $realPath = realpath($path);
+        if ($realPath !== false) {
+            return str_starts_with($realPath, $realBase);
+        }
+
+        $parent = realpath(dirname($path));
+        return $parent !== false && str_starts_with($parent, $realBase);
+    }
+
+    public function safeRemove(string $path, string $base, bool $recursive = false): bool
+    {
+        if (!$this->isPathSafe($path, $base)) {
+            Log::warning('Path traversal blocked', ['path' => $path, 'base' => $base]);
+            return false;
+        }
+        if (!file_exists($path)) return true;
+        if (!is_dir($path)) return File::delete($path);
+        return File::deleteDirectory($path);
+    }
+
+    public function safeMkdir(string $path): bool
+    {
+        if (File::isDirectory($path)) return true;
+        return File::makeDirectory($path, 0755, true, true);
+    }
+
+    public function replaceDirectory(string $source, string $target, string $base): bool
+    {
+        if (!$this->isPathSafe($source, $base) || !$this->isPathSafe($target, $base)) {
+            return false;
+        }
+        if (!File::exists($source)) return false;
+        if (File::exists($target)) return false;
+
+        $parent = dirname($target);
+        if (!is_writable($parent)) return false;
+
+        if (!File::makeDirectory($target, 0755, true, true)) return false;
+
+        foreach (File::allFiles($source) as $file) {
+            $relative = ltrim(str_replace($source, '', $file->getPathname()), '/');
+            $dest = $target . '/' . $relative;
+            $destDir = dirname($dest);
+            if (!File::isDirectory($destDir)) {
+                File::makeDirectory($destDir, 0755, true, true);
+            }
+            if (!copy($file->getPathname(), $dest)) return false;
+        }
+
+        return File::deleteDirectory($source);
+    }
+
+    public function validateFileTypes(string $directory): array
+    {
+        $blocked = [
+            'php', 'php3', 'php4', 'php5', 'php7', 'php8', 'phtml', 'phps',
+            'asp', 'aspx', 'jsp', 'jspx', 'cfm',
+            'pl', 'py', 'rb', 'cgi', 'sh', 'bash', 'bat', 'cmd', 'exe',
+            'ps1', 'htaccess', 'htpasswd',
+        ];
+        $found = [];
+
+        foreach (File::allFiles($directory) as $file) {
+            $ext = strtolower($file->getExtension());
+            if (in_array($ext, $blocked, true)) {
+                $found[] = str_replace(base_path() . '/', '', $file->getPathname());
+            }
+        }
+
+        return $found;
+    }
+}