F4ilji
967db81d3c
fix(vikon): use correct token introspect endpoint for update system
...
Original vikon_core security.php validates tokens via:
POST db-nica.ru/oauth2/resource/token/introspect
Body: client_id=542&access_token=XXX
Our code was incorrectly using:
GET auth.db-nica.ru/api/profile_applicant/check_access_token
Header: Authorization: Bearer XXX
This was the WRONG endpoint — the profile check is for abitur forms,
not for the update system.
2026-07-04 13:54:56 +05:00
F4ilji
a963647770
fix(vikon): use form-encoded POST + correct domain for OAuth token exchange
...
- HttpTask::post() now sends application/x-www-form-urlencoded (not JSON)
- AuthenticateAction sends to db-nica.ru (not auth.db-nica.ru) matching original vikon_core
- Original code: remoteRequest($apiDomen . 'oauth2/authorize/token', ...)
2026-07-04 13:46:49 +05:00
F4ilji
94e17dfbbc
fix(vikon): use api_domain for OAuth authorize URL (not auth_domain)
...
Original vikon_core used db-nica.ru for /oauth2/authorize, not auth.db-nica.ru.
This was causing 'Client authentication failed' error.
2026-07-04 13:33:39 +05:00
F4ilji
ba99b2a093
fix(vikon): switch validateFileTypes from blacklist to whitelist
...
Based on actual file analysis of sveden/abitur/vsoko modules:
- html, css, js, map (content + assets)
- png, jpg, gif, svg, ico, bmp (images)
- ttf, woff, woff2, eot (fonts)
- pdf, doc, docx (documents)
- vikon (module-specific)
No PHP/ASP/executables in allowed list — any non-whitelisted file is blocked.
2026-07-04 13:21:54 +05:00
F4ilji
f4f8bc8e77
feat(vikon): rewrite VikonIntegration from scratch — OAuth + core update
...
- HttpTask: Laravel Http facade with SSL enabled, retry, timeout
- ValidateTokenTask: token check via auth.db-nica.ru
- RefreshTokenTask: token refresh via db-nica.ru
- FilesystemTask: path traversal protection, blocked extensions (PHP/ASP/etc)
- AuthenticateAction: OAuth2 code→token exchange
- CheckAccessAction: token validation + filesystem writability check
- CheckVersionAction: version comparison against remote API
- UpdateCoreAction: ZIP download, Zip Slip protection, atomic sync with rollback
- VikonController: thin controller, 7 endpoints with Session-based token storage
- Routes: access-check, dashboard.auth, throttle:30,1 middleware
- Vue 3 Composition API frontend with progress bar
- Config: all secrets in .env via config/vikon.php
- vikon_core kept as fallback (not deleted)
2026-07-04 12:53:28 +05:00
F4ilji
47aac647ac
feat(vikon): remove broken VikonIntegration container - starting fresh
2026-07-04 12:40:41 +05:00
F4ilji
169a2f5654
changes
2026-04-08 14:14:38 +05:00
F4ilji