mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-17 17:15:08 +00:00
ignacionelson
e9496dc357
An infected file now goes somewhere rather than nowhere. Staff holding the new release_quarantined_files permission get a Quarantine screen listing what was refused, who uploaded it, and what the scanner called it. They can delete it as they always could, or release it — which needs a written reason, a password confirmation on top of the permission, and lands in the activity log under their name. Only the administrator role holds that permission by default. Deciding a threat report is wrong is a different judgement from deciding a file is no longer needed, which is why it is not delete_files. Two notifications, two audiences: staff who can act on it, and the person who uploaded it — for whom this is how they learn their own machine has something on it. The people the file was shared with are deliberately not told about a file they never received. `projectsend:scan-files` runs hourly: it re-queues files still waiting, and re-scans the ones that went out unscanned while the scanner was unreachable, since it may be back. With --existing it also works through a library uploaded before scanning was switched on, paced by a setting so it does not starve today's uploads. A file that was downloadable before it was caught says so on the screen, with its download count, because that is the case where somebody may already have a copy.
72 lines
2.5 KiB
PHP
72 lines
2.5 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Modules\Files\Scanning;
|
|
|
|
use App\Models\User;
|
|
use App\Modules\Files\Models\File;
|
|
use App\Modules\Identity\Permissions\Permission;
|
|
use App\Modules\Identity\Permissions\PermissionChecker;
|
|
use App\Modules\Identity\UserType;
|
|
use App\Modules\Notifications\Notifier;
|
|
|
|
/**
|
|
* Who hears about a quarantined file.
|
|
*
|
|
* Two audiences, deliberately not three. Staff who can do something about
|
|
* it are told, because a file sitting in quarantine that nobody looks at
|
|
* is the same as a file silently lost. The person who uploaded it is
|
|
* told, because on an honest account this is how they find out their own
|
|
* machine has something on it — and because otherwise their file simply
|
|
* never arrives and they have no idea why.
|
|
*
|
|
* The people the file was shared with are **not** told. They never
|
|
* received it, and a message about a virus in a file they never saw
|
|
* would alarm without informing.
|
|
*
|
|
* Recipients are resolved here rather than inside Notifier, which
|
|
* authorizes nothing by design — see its security contract.
|
|
*/
|
|
class QuarantineNotifier
|
|
{
|
|
public function __construct(
|
|
private readonly Notifier $notifier,
|
|
private readonly PermissionChecker $permissions,
|
|
) {}
|
|
|
|
public function quarantined(File $file, string $threat): void
|
|
{
|
|
$uploader = $file->uploader;
|
|
|
|
$this->notifier->send('file_quarantined', $this->staff(), subject: $file, data: [
|
|
'itemName' => $file->name,
|
|
'uploaderName' => $uploader->name ?? __('a deleted account'),
|
|
'threat' => $threat,
|
|
]);
|
|
|
|
// The uploader hears it once. Without this check a staff member
|
|
// who uploaded an infected file would get both messages, which
|
|
// read as two different files.
|
|
if ($uploader !== null && ! $this->staff()->contains(fn (User $staff): bool => $staff->is($uploader))) {
|
|
$this->notifier->send('upload_blocked', [$uploader], subject: $file, data: [
|
|
'itemName' => $file->name,
|
|
'threat' => $threat,
|
|
]);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @return \Illuminate\Support\Collection<int, User>
|
|
*/
|
|
private function staff(): \Illuminate\Support\Collection
|
|
{
|
|
return User::query()
|
|
->where('type', UserType::Staff)
|
|
->where('active', true)
|
|
->get()
|
|
->filter(fn (User $staff): bool => $this->permissions->allows($staff, Permission::ReleaseQuarantinedFiles))
|
|
->values();
|
|
}
|
|
}
|