From 4e034966c2a23368eff026d9f57db5405be3b1dc Mon Sep 17 00:00:00 2001 From: github-actions Date: Fri, 2 Aug 2024 11:48:41 +0200 Subject: [PATCH 01/19] migration lockfile lifetime --- application/config/migration.php | 15 +++++++++++ application/controllers/Migrate.php | 3 ++- system/libraries/Migration.php | 39 +++++++++++++++++++++++++++-- 3 files changed, 54 insertions(+), 3 deletions(-) diff --git a/application/config/migration.php b/application/config/migration.php index 03983d214..c19a65279 100644 --- a/application/config/migration.php +++ b/application/config/migration.php @@ -37,5 +37,20 @@ $config['migration_version'] = 211; $config['migration_path'] = APPPATH . 'migrations/'; +/* +|-------------------------------------------------------------------------- +| Migration Lockfile +|-------------------------------------------------------------------------- +| +| Path to the migration lockfile. +| This lockfile prevents migrations from running twice +| +*/ +$config['migration_lockfile'] = sys_get_temp_dir() . '/.migration_running'; + +// the maximum age of the lockfile in seconds +$config['migration_lf_maxage'] = 30; + + /* End of file migration.php */ /* Location: ./application/config/migration.php */ diff --git a/application/controllers/Migrate.php b/application/controllers/Migrate.php index 65bf69dba..d1da26609 100644 --- a/application/controllers/Migrate.php +++ b/application/controllers/Migrate.php @@ -3,6 +3,7 @@ class Migrate extends CI_Controller { public function index() { $this->load->library('Migration'); + $this->load->config('migration'); $result = array(); $latest = $this->migration->latest(); @@ -12,7 +13,7 @@ class Migrate extends CI_Controller { log_message('error', 'Migration failed'); $result['status'] = 'error'; } else { - while (file_exists(APPPATH . 'cache/.migration_running')) { + while (file_exists($this->config->item('migration_lockfile'))) { sleep(1); } $result['status'] = 'success'; diff --git a/system/libraries/Migration.php b/system/libraries/Migration.php index d08f78b5e..b70ea530b 100644 --- a/system/libraries/Migration.php +++ b/system/libraries/Migration.php @@ -91,7 +91,16 @@ class CI_Migration { * * @var string */ - protected $_migration_lockfile = APPPATH . 'cache/.migration_running'; + protected $_migration_lockfile = NULL; + + /** + * Max Age of the migration lockfile + * + * @var int + */ + + protected $_migration_lf_maxage = NULL; + /** * Whether to automatically run migrations @@ -147,6 +156,12 @@ class CI_Migration { // Add trailing slash if not set $this->_migration_path = rtrim($this->_migration_path, '/').'/'; + // If not set, set it + $this->_migration_lockfile !== '' OR $this->_migration_lockfile = '/tmp/.migration_running'; + + // selockfile maxage if not set in config file. Fallback is 60 seconds. + $this->_migration_lf_maxage !== '' OR $this->_migration_lf_maxage = 60; + // Load migration language $this->lang->load('migration'); @@ -341,7 +356,27 @@ class CI_Migration { } } else { - log_message('debug', 'Migration process is currently locked. Second migration attempt ignored.'); + + log_message('debug', 'There is a lockfile for migrations. Checking the age...'); + + // Get the file creation date + $lockfile_ctime = filemtime($this->_migration_lockfile); + + //compare to the current time + $tdiff = time() - $lockfile_ctime; + log_message('debug', 'Migration lockfile lifetime in seconds: '.$tdiff.'/'.$this->_migration_lf_maxage); + + // if the file is older then the configured limit, delete it + if ($tdiff > $this->_migration_lf_maxage) { + + unlink($this->_migration_lockfile); + log_message('debug', 'Deleted migration lockfile because it was older then maxage.'); + + } else { + + log_message('debug', 'Migration process is currently locked. Second migration attempt ignored.'); + + } } return $current_version; From d538aaf7d5f59b2561602028cf29eeb94d6314f7 Mon Sep 17 00:00:00 2001 From: github-actions Date: Fri, 2 Aug 2024 12:02:47 +0200 Subject: [PATCH 02/19] set the lifetime higher --- application/config/migration.php | 2 +- system/libraries/Migration.php | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/application/config/migration.php b/application/config/migration.php index c19a65279..d0dbce0ab 100644 --- a/application/config/migration.php +++ b/application/config/migration.php @@ -49,7 +49,7 @@ $config['migration_path'] = APPPATH . 'migrations/'; $config['migration_lockfile'] = sys_get_temp_dir() . '/.migration_running'; // the maximum age of the lockfile in seconds -$config['migration_lf_maxage'] = 30; +$config['migration_lf_maxage'] = 300; /* End of file migration.php */ diff --git a/system/libraries/Migration.php b/system/libraries/Migration.php index b70ea530b..256748747 100644 --- a/system/libraries/Migration.php +++ b/system/libraries/Migration.php @@ -159,8 +159,8 @@ class CI_Migration { // If not set, set it $this->_migration_lockfile !== '' OR $this->_migration_lockfile = '/tmp/.migration_running'; - // selockfile maxage if not set in config file. Fallback is 60 seconds. - $this->_migration_lf_maxage !== '' OR $this->_migration_lf_maxage = 60; + // selockfile maxage if not set in config file. Fallback is 480 seconds. + $this->_migration_lf_maxage !== '' OR $this->_migration_lf_maxage = 480; // Load migration language $this->lang->load('migration'); From 912943b44a17b0b03bec2016759eb4c6440bbef4 Mon Sep 17 00:00:00 2001 From: github-actions Date: Mon, 5 Aug 2024 14:49:43 +0200 Subject: [PATCH 03/19] htmlspecialchars --- application/models/Eqslmethods_model.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/application/models/Eqslmethods_model.php b/application/models/Eqslmethods_model.php index 5e9030d63..6a0f334d9 100644 --- a/application/models/Eqslmethods_model.php +++ b/application/models/Eqslmethods_model.php @@ -100,7 +100,7 @@ class Eqslmethods_model extends CI_Model { $adif .= "%3A"; $adif .= strlen($data['user_eqsl_password']); $adif .= "%3E"; - $adif .= urlencode($data['user_eqsl_password']); + $adif .= urlencode(htmlspecialchars($data['user_eqsl_password'])); $adif .= "%20"; $adif .= "%3C"; From b00de6ffd70bed81e28a1be60d7fe1b04537afba Mon Sep 17 00:00:00 2001 From: github-actions Date: Mon, 5 Aug 2024 21:08:19 +0200 Subject: [PATCH 04/19] fix xss vulnerability --- application/controllers/Qso.php | 5 +++++ application/views/qso/index.php | 26 +++++++++++++------------- 2 files changed, 18 insertions(+), 13 deletions(-) diff --git a/application/controllers/Qso.php b/application/controllers/Qso.php index 5463a0681..0a02437e9 100644 --- a/application/controllers/Qso.php +++ b/application/controllers/Qso.php @@ -18,6 +18,11 @@ class QSO extends CI_Controller { $this->load->model('bands'); if(!$this->user_model->authorize(2)) { $this->session->set_flashdata('notice', 'You\'re not allowed to do that!'); redirect('dashboard'); } + // Getting the live/post mode from GET command + // 0 = live + // 1 = post (manual) + $data['manual_mode'] = $this->security->xss_clean($this->input->get('manual')); + $data['active_station_profile'] = $this->stations->find_active(); $data['notice'] = false; diff --git a/application/views/qso/index.php b/application/views/qso/index.php index b54384a2b..45d5ceb02 100644 --- a/application/views/qso/index.php +++ b/application/views/qso/index.php @@ -1,6 +1,6 @@
uri->segment(1) == "contesting" && ($this->uri->segment(2) != "add" && $this->uri->segment(2) != "edit")) { ?> From fc25037cfb3c6746164b04eae362150bb3c8d7d5 Mon Sep 17 00:00:00 2001 From: github-actions Date: Tue, 6 Aug 2024 13:16:20 +0200 Subject: [PATCH 14/19] xss_cleaned some more GET inputs --- application/controllers/Lookup.php | 4 ++-- application/controllers/Qso.php | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/application/controllers/Lookup.php b/application/controllers/Lookup.php index 563e2cd2e..cc0a9b7a4 100644 --- a/application/controllers/Lookup.php +++ b/application/controllers/Lookup.php @@ -180,8 +180,8 @@ class Lookup extends CI_Controller { public function get_county() { $json = []; - if(!empty($this->input->get("query"))) { - $county = $this->input->get("state"); + if(!empty($this->security->xss_clean($this->input->get("query")))) { + $county = $this->security->xss_clean($this->input->get("state")); $cleanedcounty = explode('(', $county); $cleanedcounty = trim($cleanedcounty[0]); diff --git a/application/controllers/Qso.php b/application/controllers/Qso.php index a5a33f504..64b5fc221 100644 --- a/application/controllers/Qso.php +++ b/application/controllers/Qso.php @@ -449,7 +449,7 @@ class QSO extends CI_Controller { $this->load->library('sota'); $json = []; - if (!empty($this->input->get("query"))) { + if (!empty($this->security->xss_clean($this->input->get("query")))) { $query = $_GET['query'] ?? FALSE; $json = $this->sota->get($query); } @@ -461,7 +461,7 @@ class QSO extends CI_Controller { public function get_wwff() { $json = []; - if(!empty($this->input->get("query"))) { + if (!empty($this->security->xss_clean($this->input->get("query")))) { $query = isset($_GET['query']) ? $_GET['query'] : FALSE; $wwff = strtoupper($query); @@ -497,7 +497,7 @@ class QSO extends CI_Controller { public function get_pota() { $json = []; - if(!empty($this->input->get("query"))) { + if (!empty($this->security->xss_clean($this->input->get("query")))) { $query = isset($_GET['query']) ? $_GET['query'] : FALSE; $pota = strtoupper($query); @@ -536,7 +536,7 @@ class QSO extends CI_Controller { public function get_dok() { $json = []; - if(!empty($this->input->get("query"))) { + if (!empty($this->security->xss_clean($this->input->get("query")))) { $query = isset($_GET['query']) ? $_GET['query'] : FALSE; $dok = strtoupper($query); From 6cdcfa86d1553ba86b7b3908584101f5692becc6 Mon Sep 17 00:00:00 2001 From: github-actions Date: Tue, 6 Aug 2024 13:20:09 +0200 Subject: [PATCH 15/19] revert encoding here --- application/models/Eqslmethods_model.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/application/models/Eqslmethods_model.php b/application/models/Eqslmethods_model.php index 6a0f334d9..5e9030d63 100644 --- a/application/models/Eqslmethods_model.php +++ b/application/models/Eqslmethods_model.php @@ -100,7 +100,7 @@ class Eqslmethods_model extends CI_Model { $adif .= "%3A"; $adif .= strlen($data['user_eqsl_password']); $adif .= "%3E"; - $adif .= urlencode(htmlspecialchars($data['user_eqsl_password'])); + $adif .= urlencode($data['user_eqsl_password']); $adif .= "%20"; $adif .= "%3C"; From 7c82d51916ae0f20d6d65990cd608b4b704c823c Mon Sep 17 00:00:00 2001 From: github-actions Date: Tue, 6 Aug 2024 13:45:31 +0200 Subject: [PATCH 16/19] decode password --- application/models/Eqslmethods_model.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/application/models/Eqslmethods_model.php b/application/models/Eqslmethods_model.php index 5e9030d63..a1e89d39d 100644 --- a/application/models/Eqslmethods_model.php +++ b/application/models/Eqslmethods_model.php @@ -41,7 +41,7 @@ class Eqslmethods_model extends CI_Model { function uploadUser($userid, $username, $password) { $data['user_eqsl_name'] = $this->security->xss_clean($username); - $data['user_eqsl_password'] = $this->security->xss_clean($password); + $data['user_eqsl_password'] = html_entity_decode($this->security->xss_clean($password)); $clean_userid = $this->security->xss_clean($userid); $qslsnotsent = $this->eqsl_not_yet_sent($clean_userid); From 0c85211c4b7b8bb5a6b82e106057893116045fa3 Mon Sep 17 00:00:00 2001 From: github-actions Date: Tue, 6 Aug 2024 11:48:30 +0000 Subject: [PATCH 17/19] po/mo updates --- application/locale/bg_BG/LC_MESSAGES/messages.po | 10 +++++----- application/locale/cs_CZ/LC_MESSAGES/messages.po | 10 +++++----- application/locale/de_DE/LC_MESSAGES/messages.po | 10 +++++----- application/locale/el_GR/LC_MESSAGES/messages.po | 10 +++++----- application/locale/es_ES/LC_MESSAGES/messages.po | 10 +++++----- application/locale/fi_FI/LC_MESSAGES/messages.po | 10 +++++----- application/locale/fr_FR/LC_MESSAGES/messages.po | 10 +++++----- application/locale/it_IT/LC_MESSAGES/messages.po | 10 +++++----- application/locale/nl_NL/LC_MESSAGES/messages.po | 10 +++++----- application/locale/pl_PL/LC_MESSAGES/messages.po | 10 +++++----- application/locale/pt_PT/LC_MESSAGES/messages.po | 10 +++++----- application/locale/ru_RU/LC_MESSAGES/messages.po | 10 +++++----- application/locale/sv_SE/LC_MESSAGES/messages.po | 10 +++++----- application/locale/tr_TR/LC_MESSAGES/messages.po | 10 +++++----- application/locale/zh_CN/LC_MESSAGES/messages.po | 10 +++++----- assets/lang_src/messages.pot | 10 +++++----- 16 files changed, 80 insertions(+), 80 deletions(-) diff --git a/application/locale/bg_BG/LC_MESSAGES/messages.po b/application/locale/bg_BG/LC_MESSAGES/messages.po index 9d0508acf..28c6f9e7e 100644 --- a/application/locale/bg_BG/LC_MESSAGES/messages.po +++ b/application/locale/bg_BG/LC_MESSAGES/messages.po @@ -5,7 +5,7 @@ msgid "" msgstr "" "Report-Msgid-Bugs-To: translations@wavelog.org\n" -"POT-Creation-Date: 2024-08-06 09:50+0000\n" +"POT-Creation-Date: 2024-08-06 11:48+0000\n" "PO-Revision-Date: 2024-07-09 13:25+0000\n" "Last-Translator: Anonymous \n" "Language-Team: Bulgarian \n" "Language-Team: Czech \n" "Language-Team: German \n" "Language-Team: Greek \n" "Language-Team: Spanish \n" "Language-Team: Finnish \n" "Language-Team: French \n" "Language-Team: Italian \n" "Language-Team: Dutch \n" "Language-Team: Polish \n" "Language-Team: Portuguese (Portugal) \n" "Language-Team: Russian \n" "Language-Team: Swedish \n" "Language-Team: Turkish \n" "Language-Team: Chinese (Simplified) \n" "Language-Team: LANGUAGE \n" @@ -457,17 +457,17 @@ msgstr "" msgid "Contest Calendar" msgstr "" -#: application/controllers/Contesting.php:36 +#: application/controllers/Contesting.php:46 #: application/views/contesting/index.php:3 msgid "Contest Logging" msgstr "" -#: application/controllers/Contesting.php:101 +#: application/controllers/Contesting.php:111 #: application/views/interface_assets/header.php:268 msgid "Contests" msgstr "" -#: application/controllers/Contesting.php:115 +#: application/controllers/Contesting.php:125 msgid "Update Contest" msgstr "" @@ -1530,7 +1530,7 @@ msgstr "" msgid "Print Requested QSLs" msgstr "" -#: application/controllers/Qso.php:91 +#: application/controllers/Qso.php:101 msgid "Add QSO" msgstr "" From f544768d0bc67a81c10cdc5d32c252d2f790b585 Mon Sep 17 00:00:00 2001 From: github-actions Date: Tue, 6 Aug 2024 13:54:38 +0200 Subject: [PATCH 18/19] small adjustment --- .github/workflows/translation.yml | 2 +- install/po_gen_installer.sh | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/translation.yml b/.github/workflows/translation.yml index 22e7a170f..ec0080da0 100644 --- a/.github/workflows/translation.yml +++ b/.github/workflows/translation.yml @@ -7,7 +7,7 @@ on: - dev jobs: - build: + run_scripts: if: github.repository == 'wavelog/wavelog' runs-on: ubuntu-latest diff --git a/install/po_gen_installer.sh b/install/po_gen_installer.sh index a4f5f2b65..75e3a99fd 100644 --- a/install/po_gen_installer.sh +++ b/install/po_gen_installer.sh @@ -70,9 +70,11 @@ sed -i '8d' "$TEMP_POT_FILE" # Compare the new POT file with the existing one (excluding the POT Creation Date) if ! diff -I 'POT-Creation-Date' "$TEMP_POT_FILE" "$POT_FILE" >/dev/null; then echo "Updating POT file with new translations." + echo " " mv "$TEMP_POT_FILE" "$POT_FILE" else echo "No changes detected in translations. POT file remains unchanged." + echo " " rm "$TEMP_POT_FILE" fi From 5c47fa44f41978b1d5253b81b00a63e37a2f052a Mon Sep 17 00:00:00 2001 From: github-actions Date: Tue, 6 Aug 2024 17:06:30 +0200 Subject: [PATCH 19/19] workflow_dispatch --- .github/workflows/issue_bot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/issue_bot.yml b/.github/workflows/issue_bot.yml index f1ae31c65..21ab4119f 100644 --- a/.github/workflows/issue_bot.yml +++ b/.github/workflows/issue_bot.yml @@ -1,8 +1,8 @@ name: Issue Bot on: - workflow_dispatch: schedule: - cron: "20 */12 * * *" + workflow_dispatch: jobs: close-issues: