@@ -73,10 +73,15 @@ public function listWebhooks(): DataResponse {
7373 * @NoAdminRequired
7474 * @NoCSRFRequired
7575 */
76- public function register (string $ targetUrl , string $ webhookUrl , string $ expiry ): DataResponse {
77- // FIXME: Validate WAC read access to the target URL for $this->webId
78- if ($ this ->checkReadAccess ($ targetUrl )) {
79- return new DataResponse ($ this ->webhookService ->create ($ this ->webId , $ targetUrl , $ webhookUrl , $ expiry ));
76+ public function register (string $ topic , string $ target ): DataResponse {
77+ if (!$ this ->isValidWebhookTarget ($ target )) {
78+ return new DataResponse ("Error: invalid webhook target " , 422 );
79+ }
80+
81+ if ($ this ->checkReadAccess ($ topic )) {
82+ return new DataResponse ($ this ->webhookService ->create ($ this ->webId , $ topic , $ target ));
83+ } else {
84+ return new DataResponse ("Error: denied access " , 401 );
8085 }
8186 }
8287
@@ -85,12 +90,18 @@ public function register(string $targetUrl, string $webhookUrl, string $expiry):
8590 * @NoAdminRequired
8691 * @NoCSRFRequired
8792 */
88- public function unregister (string $ targetUrl ): DataResponse {
89- return $ this ->handleNotFound (function () use ($ targetUrl ) {
90- return $ this ->webhookService ->delete ($ this ->webId , $ targetUrl );
93+ public function unregister (string $ topic ): DataResponse {
94+ return $ this ->handleNotFound (function () use ($ topic ) {
95+ return $ this ->webhookService ->delete ($ this ->webId , $ topic );
9196 });
9297 }
9398
99+ private function isValidWebhookTarget ($ target ) {
100+ if (!preg_match ("|^https://| " , $ target )) {
101+ return false ;
102+ }
103+ return true ;
104+ }
94105
95106 private function getFileSystem () {
96107 // Create the Nextcloud Adapter
@@ -135,22 +146,22 @@ private function initializeStorage($userId) {
135146 $ this ->filesystem = $ this ->getFileSystem ();
136147 }
137148
138- private function parseTargetUrl ( $ targetUrl ) {
139- // targetUrl = https://nextcloud.server/solid/@alice/storage/foo/bar
149+ private function parseTopic ( $ topic ) {
150+ // topic = https://nextcloud.server/solid/@alice/storage/foo/bar
140151 $ appBaseUrl = $ this ->getAppBaseUrl (); // https://nextcloud.server/solid/
141- $ internalUrl = str_replace ($ appBaseUrl , '' , $ targetUrl ); // @alice/storage/foo/bar
152+ $ internalUrl = str_replace ($ appBaseUrl , '' , $ topic ); // @alice/storage/foo/bar
142153 $ pathicles = explode ("/ " , $ internalUrl );
143154 $ userId = $ pathicles [0 ]; // @alice
144155 $ userId = preg_replace ("/^@/ " , "" , $ userId ); // alice
145156 $ storageUrl = $ this ->getStorageUrl ($ userId ); // https://nextcloud.server/solid/@alice/storage/
146- $ storagePath = str_replace ($ storageUrl , '/ ' , $ targetUrl ); // /foo/bar
157+ $ storagePath = str_replace ($ storageUrl , '/ ' , $ topic ); // /foo/bar
147158 return array (
148159 "userId " => $ userId ,
149160 "path " => $ storagePath
150161 );
151162 }
152163
153- private function createGetRequest ($ targetUrl ) {
164+ private function createGetRequest ($ topic ) {
154165 $ serverParams = [];
155166 $ fileParams = [];
156167 $ method = "GET " ;
@@ -160,18 +171,18 @@ private function createGetRequest($targetUrl) {
160171 return new \Laminas \Diactoros \ServerRequest (
161172 $ serverParams ,
162173 $ fileParams ,
163- $ targetUrl ,
174+ $ topic ,
164175 $ method ,
165176 $ body ,
166177 $ headers
167178 );
168179 }
169180
170- private function checkReadAccess ($ targetUrl ) {
171- // split out $targetUrl into $userId and $path https://nextcloud.server/solid/@alice/storage/foo/bar
181+ private function checkReadAccess ($ topic ) {
182+ // split out $topic into $userId and $path https://nextcloud.server/solid/@alice/storage/foo/bar
172183 // - userId in this case is the pod owner (not the one doing the request). (alice)
173184 // - path is the path within the storage pod (/foo/bar)
174- $ target = $ this ->parseTargetUrl ( $ targetUrl );
185+ $ target = $ this ->parseTopic ( $ topic );
175186 $ userId = $ target ["userId " ];
176187 $ path = $ target ["path " ];
177188
@@ -184,7 +195,7 @@ private function checkReadAccess($targetUrl) {
184195 $ serverParams = [];
185196 $ fileParams = [];
186197
187- $ request = $ this ->createGetRequest ($ targetUrl );
198+ $ request = $ this ->createGetRequest ($ topic );
188199 if (!$ this ->WAC ->isAllowed ($ request , $ this ->webId )) { // Deny if we don't have read grants on the URL;
189200 return false ;
190201 }
0 commit comments