No OneTemporary
Actions

Size

54 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/src/applications/auth/controller/PhabricatorAuthController.php b/src/applications/auth/controller/PhabricatorAuthController.php
	index a6803ac9b1..d4b63c4238 100644
	--- a/src/applications/auth/controller/PhabricatorAuthController.php
	+++ b/src/applications/auth/controller/PhabricatorAuthController.php
	@@ -1,238 +1,238 @@
	<?php

	abstract class PhabricatorAuthController extends PhabricatorController {

	public function buildStandardPageResponse($view, array $data) {
	$page = $this->buildStandardPageView();

	$page->setApplicationName(pht('Login'));
	$page->setBaseURI('/login/');
	$page->setTitle(idx($data, 'title'));
	$page->appendChild($view);

	$response = new AphrontWebpageResponse();
	return $response->setContent($page->render());
	}

	protected function renderErrorPage($title, array $messages) {
	$view = new AphrontErrorView();
	$view->setTitle($title);
	$view->setErrors($messages);

	return $this->buildApplicationPage(
	$view,
	array(
	'title' => $title,
	'device' => true,
	));

	}

	/**
	* Returns true if this install is newly setup (i.e., there are no user
	* accounts yet). In this case, we enter a special mode to permit creation
	* of the first account form the web UI.
	*/
	protected function isFirstTimeSetup() {
	// If there are any auth providers, this isn't first time setup, even if
	// we don't have accounts.
	if (PhabricatorAuthProvider::getAllEnabledProviders()) {
	return false;
	}

	// Otherwise, check if there are any user accounts. If not, we're in first
	// time setup.
	$any_users = id(new PhabricatorPeopleQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->setLimit(1)
	->execute();

	return !$any_users;
	}


	/**
	* Log a user into a web session and return an @{class:AphrontResponse} which
	* corresponds to continuing the login process.
	*
	* Normally, this is a redirect to the validation controller which makes sure
	* the user's cookies are set. However, event listeners can intercept this
	* event and do something else if they prefer.
	*
	* @param PhabricatorUser User to log the viewer in as.
	* @return AphrontResponse Response which continues the login process.
	*/
	protected function loginUser(PhabricatorUser $user) {

	$response = $this->buildLoginValidateResponse($user);
	- $session_type = 'web';
	+ $session_type = PhabricatorAuthSession::TYPE_WEB;

	$event_type = PhabricatorEventType::TYPE_AUTH_WILLLOGINUSER;
	$event_data = array(
	'user' => $user,
	'type' => $session_type,
	'response' => $response,
	'shouldLogin' => true,
	);

	$event = id(new PhabricatorEvent($event_type, $event_data))
	->setUser($user);
	PhutilEventEngine::dispatchEvent($event);

	$should_login = $event->getValue('shouldLogin');
	if ($should_login) {
	$session_key = id(new PhabricatorAuthSessionEngine())
	->establishSession($session_type, $user->getPHID());

	// NOTE: We allow disabled users to login and roadblock them later, so
	// there's no check for users being disabled here.

	$request = $this->getRequest();
	$request->setCookie('phusr', $user->getUsername());
	$request->setCookie('phsid', $session_key);

	$this->clearRegistrationCookies();
	}

	return $event->getValue('response');
	}

	protected function clearRegistrationCookies() {
	$request = $this->getRequest();

	// Clear the registration key.
	$request->clearCookie('phreg');

	// Clear the client ID / OAuth state key.
	$request->clearCookie('phcid');
	}

	private function buildLoginValidateResponse(PhabricatorUser $user) {
	$validate_uri = new PhutilURI($this->getApplicationURI('validate/'));
	$validate_uri->setQueryParam('phusr', $user->getUsername());

	return id(new AphrontRedirectResponse())->setURI((string)$validate_uri);
	}

	protected function renderError($message) {
	return $this->renderErrorPage(
	pht('Authentication Error'),
	array(
	$message,
	));
	}

	protected function loadAccountForRegistrationOrLinking($account_key) {
	$request = $this->getRequest();
	$viewer = $request->getUser();

	$account = null;
	$provider = null;
	$response = null;

	if (!$account_key) {
	$response = $this->renderError(
	pht('Request did not include account key.'));
	return array($account, $provider, $response);
	}

	// NOTE: We're using the omnipotent user because the actual user may not
	// be logged in yet, and because we want to tailor an error message to
	// distinguish between "not usable" and "does not exist". We do explicit
	// checks later on to make sure this account is valid for the intended
	// operation.

	$account = id(new PhabricatorExternalAccountQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->withAccountSecrets(array($account_key))
	->needImages(true)
	->executeOne();

	if (!$account) {
	$response = $this->renderError(pht('No valid linkable account.'));
	return array($account, $provider, $response);
	}

	if ($account->getUserPHID()) {
	if ($account->getUserPHID() != $viewer->getUserPHID()) {
	$response = $this->renderError(
	pht(
	'The account you are attempting to register or link is already '.
	'linked to another user.'));
	} else {
	$response = $this->renderError(
	pht(
	'The account you are attempting to link is already linked '.
	'to your account.'));
	}
	return array($account, $provider, $response);
	}

	$registration_key = $request->getCookie('phreg');

	// NOTE: This registration key check is not strictly necessary, because
	// we're only creating new accounts, not linking existing accounts. It
	// might be more hassle than it is worth, especially for email.
	//
	// The attack this prevents is getting to the registration screen, then
	// copy/pasting the URL and getting someone else to click it and complete
	// the process. They end up with an account bound to credentials you
	// control. This doesn't really let you do anything meaningful, though,
	// since you could have simply completed the process yourself.

	if (!$registration_key) {
	$response = $this->renderError(
	pht(
	'Your browser did not submit a registration key with the request. '.
	'You must use the same browser to begin and complete registration. '.
	'Check that cookies are enabled and try again.'));
	return array($account, $provider, $response);
	}

	// We store the digest of the key rather than the key itself to prevent a
	// theoretical attacker with read-only access to the database from
	// hijacking registration sessions.

	$actual = $account->getProperty('registrationKey');
	$expect = PhabricatorHash::digest($registration_key);
	if ($actual !== $expect) {
	$response = $this->renderError(
	pht(
	'Your browser submitted a different registration key than the one '.
	'associated with this account. You may need to clear your cookies.'));
	return array($account, $provider, $response);
	}

	$other_account = id(new PhabricatorExternalAccount())->loadAllWhere(
	'accountType = %s AND accountDomain = %s AND accountID = %s
	AND id != %d',
	$account->getAccountType(),
	$account->getAccountDomain(),
	$account->getAccountID(),
	$account->getID());

	if ($other_account) {
	$response = $this->renderError(
	pht(
	'The account you are attempting to register with already belongs '.
	'to another user.'));
	return array($account, $provider, $response);
	}

	$provider = PhabricatorAuthProvider::getEnabledProviderByKey(
	$account->getProviderKey());

	if (!$provider) {
	$response = $this->renderError(
	pht(
	'The account you are attempting to register with uses a nonexistent '.
	'or disabled authentication provider (with key "%s"). An '.
	'administrator may have recently disabled this provider.',
	$account->getProviderKey()));
	return array($account, $provider, $response);
	}

	return array($account, $provider, null);
	}

	}
	diff --git a/src/applications/auth/engine/PhabricatorAuthSessionEngine.php b/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
	index 17865a7c39..7735db3fa1 100644
	--- a/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
	+++ b/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
	@@ -1,182 +1,183 @@
	<?php

	final class PhabricatorAuthSessionEngine extends Phobject {

	public function loadUserForSession($session_type, $session_key) {
	$session_table = new PhabricatorAuthSession();
	$user_table = new PhabricatorUser();
	$conn_r = $session_table->establishConnection('w');

	$info = queryfx_one(
	$conn_r,
	'SELECT u.* FROM %T u JOIN %T s ON u.phid = s.userPHID
	AND s.type LIKE %> AND s.sessionKey = %s',
	$user_table->getTableName(),
	$session_table->getTableName(),
	$session_type.'-',
	PhabricatorHash::digest($session_key));

	if (!$info) {
	return null;
	}

	return $user_table->loadFromArray($info);
	}


	/**
	* Issue a new session key for a given identity. Phabricator supports
	* different types of sessions (like "web" and "conduit") and each session
	* type may have multiple concurrent sessions (this allows a user to be
	* logged in on multiple browsers at the same time, for instance).
	*
	* Note that this method is transport-agnostic and does not set cookies or
	* issue other types of tokens, it ONLY generates a new session key.
	*
	* You can configure the maximum number of concurrent sessions for various
	* session types in the Phabricator configuration.
	*
	- * @param string Session type, like "web".
	+ * @param const Session type constant (see
	+ * @{class:PhabricatorAuthSession}).
	* @param phid Identity to establish a session for, usually a user PHID.
	* @return string Newly generated session key.
	*/
	public function establishSession($session_type, $identity_phid) {
	$session_table = new PhabricatorAuthSession();
	$conn_w = $session_table->establishConnection('w');

	if (strpos($session_type, '-') !== false) {
	throw new Exception("Session type must not contain hyphen ('-')!");
	}

	// We allow multiple sessions of the same type, so when a caller requests
	// a new session of type "web", we give them the first available session in
	// "web-1", "web-2", ..., "web-N", up to some configurable limit. If none
	// of these sessions is available, we overwrite the oldest session and
	// reissue a new one in its place.

	$session_limit = 1;
	switch ($session_type) {
	- case 'web':
	+ case PhabricatorAuthSession::TYPE_WEB:
	$session_limit = PhabricatorEnv::getEnvConfig('auth.sessions.web');
	break;
	- case 'conduit':
	+ case PhabricatorAuthSession::TYPE_CONDUIT:
	$session_limit = PhabricatorEnv::getEnvConfig('auth.sessions.conduit');
	break;
	default:
	throw new Exception("Unknown session type '{$session_type}'!");
	}

	$session_limit = (int)$session_limit;
	if ($session_limit <= 0) {
	throw new Exception(
	"Session limit for '{$session_type}' must be at least 1!");
	}

	// NOTE: Session establishment is sensitive to race conditions, as when
	// piping `arc` to `arc`:
	//
	// arc export ... \| arc paste ...
	//
	// To avoid this, we overwrite an old session only if it hasn't been
	// re-established since we read it.

	// Consume entropy to generate a new session key, forestalling the eventual
	// heat death of the universe.
	$session_key = Filesystem::readRandomCharacters(40);

	// Load all the currently active sessions.
	$sessions = queryfx_all(
	$conn_w,
	'SELECT type, sessionKey, sessionStart FROM %T
	WHERE userPHID = %s AND type LIKE %>',
	$session_table->getTableName(),
	$identity_phid,
	$session_type.'-');
	$sessions = ipull($sessions, null, 'type');
	$sessions = isort($sessions, 'sessionStart');

	$existing_sessions = array_keys($sessions);

	// UNGUARDED WRITES: Logging-in users don't have CSRF stuff yet.
	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();

	$retries = 0;
	while (true) {

	// Choose which 'type' we'll actually establish, i.e. what number we're
	// going to append to the basic session type. To do this, just check all
	// the numbers sequentially until we find an available session.
	$establish_type = null;
	for ($ii = 1; $ii <= $session_limit; $ii++) {
	$try_type = $session_type.'-'.$ii;
	if (!in_array($try_type, $existing_sessions)) {
	$establish_type = $try_type;
	$expect_key = PhabricatorHash::digest($session_key);
	$existing_sessions[] = $try_type;

	// Ensure the row exists so we can issue an update below. We don't
	// care if we race here or not.
	queryfx(
	$conn_w,
	'INSERT IGNORE INTO %T (userPHID, type, sessionKey, sessionStart)
	VALUES (%s, %s, %s, 0)',
	$session_table->getTableName(),
	$identity_phid,
	$establish_type,
	PhabricatorHash::digest($session_key));
	break;
	}
	}

	// If we didn't find an available session, choose the oldest session and
	// overwrite it.
	if (!$establish_type) {
	$oldest = reset($sessions);
	$establish_type = $oldest['type'];
	$expect_key = $oldest['sessionKey'];
	}

	// This is so that we'll only overwrite the session if it hasn't been
	// refreshed since we read it. If it has, the session key will be
	// different and we know we're racing other processes. Whichever one
	// won gets the session, we go back and try again.

	queryfx(
	$conn_w,
	'UPDATE %T SET sessionKey = %s, sessionStart = UNIX_TIMESTAMP()
	WHERE userPHID = %s AND type = %s AND sessionKey = %s',
	$session_table->getTableName(),
	PhabricatorHash::digest($session_key),
	$identity_phid,
	$establish_type,
	$expect_key);

	if ($conn_w->getAffectedRows()) {
	// The update worked, so the session is valid.
	break;
	} else {
	// We know this just got grabbed, so don't try it again.
	unset($sessions[$establish_type]);
	}

	if (++$retries > $session_limit) {
	throw new Exception("Failed to establish a session!");
	}
	}

	$log = PhabricatorUserLog::initializeNewLog(
	null,
	$identity_phid,
	PhabricatorUserLog::ACTION_LOGIN);
	$log->setDetails(
	array(
	'session_type' => $session_type,
	'session_issued' => $establish_type,
	));
	$log->setSession($session_key);
	$log->save();

	return $session_key;
	}

	}
	diff --git a/src/applications/auth/storage/PhabricatorAuthSession.php b/src/applications/auth/storage/PhabricatorAuthSession.php
	index 3045848764..1006238d4d 100644
	--- a/src/applications/auth/storage/PhabricatorAuthSession.php
	+++ b/src/applications/auth/storage/PhabricatorAuthSession.php
	@@ -1,82 +1,85 @@
	<?php

	final class PhabricatorAuthSession extends PhabricatorAuthDAO
	implements PhabricatorPolicyInterface {

	+ const TYPE_WEB = 'web';
	+ const TYPE_CONDUIT = 'conduit';
	+
	protected $userPHID;
	protected $type;
	protected $sessionKey;
	protected $sessionStart;

	private $identityObject = self::ATTACHABLE;

	public function getConfiguration() {
	return array(
	self::CONFIG_IDS => self::IDS_MANUAL,
	self::CONFIG_TIMESTAMPS => false,
	) + parent::getConfiguration();
	}

	public function getApplicationName() {
	// This table predates the "Auth" application, and really all applications.
	return 'user';
	}

	public function getTableName() {
	// This is a very old table with a nonstandard name.
	return PhabricatorUser::SESSION_TABLE;
	}

	public function attachIdentityObject($identity_object) {
	$this->identityObject = $identity_object;
	return $this;
	}

	public function getIdentityObject() {
	return $this->assertAttached($this->identityObject);
	}

	public function delete() {
	// TODO: We don't have a proper `id` column yet, so make this work as
	// expected until we do.
	queryfx(
	$this->establishConnection('w'),
	'DELETE FROM %T WHERE sessionKey = %s',
	$this->getTableName(),
	$this->getSessionKey());
	return $this;
	}

	/* -( PhabricatorPolicyInterface )----------------------------------------- */


	public function getCapabilities() {
	return array(
	PhabricatorPolicyCapability::CAN_VIEW,
	);
	}

	public function getPolicy($capability) {
	return PhabricatorPolicies::POLICY_NOONE;
	}

	public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
	if (!$viewer->getPHID()) {
	return false;
	}

	$object = $this->getIdentityObject();
	if ($object instanceof PhabricatorUser) {
	return ($object->getPHID() == $viewer->getPHID());
	} else if ($object instanceof PhabricatorExternalAccount) {
	return ($object->getUserPHID() == $viewer->getPHID());
	}

	return false;
	}

	public function describeAutomaticCapability($capability) {
	return pht('A session is visible only to its owner.');
	}

	}
	diff --git a/src/applications/base/controller/PhabricatorController.php b/src/applications/base/controller/PhabricatorController.php
	index 8995e43cd9..5bdf7fd8af 100644
	--- a/src/applications/base/controller/PhabricatorController.php
	+++ b/src/applications/base/controller/PhabricatorController.php
	@@ -1,408 +1,408 @@
	<?php

	abstract class PhabricatorController extends AphrontController {

	private $handles;

	public function shouldRequireLogin() {
	return true;
	}

	public function shouldRequireAdmin() {
	return false;
	}

	public function shouldRequireEnabledUser() {
	return true;
	}

	public function shouldAllowPublic() {
	return false;
	}

	public function shouldRequireEmailVerification() {
	return PhabricatorUserEmail::isEmailVerificationRequired();
	}

	public function willBeginExecution() {

	$request = $this->getRequest();
	if ($request->getUser()) {
	// NOTE: Unit tests can set a user explicitly. Normal requests are not
	// permitted to do this.
	PhabricatorTestCase::assertExecutingUnitTests();
	$user = $request->getUser();
	} else {
	$user = new PhabricatorUser();

	$phsid = $request->getCookie('phsid');
	if ($phsid) {
	$session_user = id(new PhabricatorAuthSessionEngine())
	- ->loadUserForSession('web', $phsid);
	+ ->loadUserForSession(PhabricatorAuthSession::TYPE_WEB, $phsid);
	if ($session_user) {
	$user = $session_user;
	}
	}

	$request->setUser($user);
	}

	$translation = $user->getTranslation();
	if ($translation &&
	$translation != PhabricatorEnv::getEnvConfig('translation.provider')) {
	$translation = newv($translation, array());
	PhutilTranslator::getInstance()
	->setLanguage($translation->getLanguage())
	->addTranslations($translation->getTranslations());
	}

	$preferences = $user->loadPreferences();
	if (PhabricatorEnv::getEnvConfig('darkconsole.enabled')) {
	$dark_console = PhabricatorUserPreferences::PREFERENCE_DARK_CONSOLE;
	if ($preferences->getPreference($dark_console) \|\|
	PhabricatorEnv::getEnvConfig('darkconsole.always-on')) {
	$console = new DarkConsoleCore();
	$request->getApplicationConfiguration()->setConsole($console);
	}
	}

	if ($this->shouldRequireEnabledUser()) {
	if ($user->isLoggedIn() && !$user->getIsApproved()) {
	$controller = new PhabricatorAuthNeedsApprovalController($request);
	return $this->delegateToController($controller);
	}
	if ($user->getIsDisabled()) {
	$controller = new PhabricatorDisabledUserController($request);
	return $this->delegateToController($controller);
	}
	}

	$event = new PhabricatorEvent(
	PhabricatorEventType::TYPE_CONTROLLER_CHECKREQUEST,
	array(
	'request' => $request,
	'controller' => $this,
	));
	$event->setUser($user);
	PhutilEventEngine::dispatchEvent($event);
	$checker_controller = $event->getValue('controller');
	if ($checker_controller != $this) {
	return $this->delegateToController($checker_controller);
	}

	if ($this->shouldRequireLogin()) {
	// This actually means we need either:
	// - a valid user, or a public controller; and
	// - permission to see the application.

	$auth_class = 'PhabricatorApplicationAuth';
	$auth_application = PhabricatorApplication::getByClass($auth_class);

	$allow_public = $this->shouldAllowPublic() &&
	PhabricatorEnv::getEnvConfig('policy.allow-public');

	// If this controller isn't public, and the user isn't logged in, require
	// login.
	if (!$allow_public && !$user->isLoggedIn()) {
	$login_controller = new PhabricatorAuthStartController($request);
	$this->setCurrentApplication($auth_application);
	return $this->delegateToController($login_controller);
	}

	if ($user->isLoggedIn()) {
	if ($this->shouldRequireEmailVerification()) {
	if (!$user->getIsEmailVerified()) {
	$controller = new PhabricatorMustVerifyEmailController($request);
	$this->setCurrentApplication($auth_application);
	return $this->delegateToController($controller);
	}
	}
	}

	// If the user doesn't have access to the application, don't let them use
	// any of its controllers. We query the application in order to generate
	// a policy exception if the viewer doesn't have permission.

	$application = $this->getCurrentApplication();
	if ($application) {
	id(new PhabricatorApplicationQuery())
	->setViewer($user)
	->withPHIDs(array($application->getPHID()))
	->executeOne();
	}
	}

	// NOTE: We do this last so that users get a login page instead of a 403
	// if they need to login.
	if ($this->shouldRequireAdmin() && !$user->getIsAdmin()) {
	return new Aphront403Response();
	}

	}

	public function buildStandardPageView() {
	$view = new PhabricatorStandardPageView();
	$view->setRequest($this->getRequest());
	$view->setController($this);
	return $view;
	}

	public function buildStandardPageResponse($view, array $data) {
	$page = $this->buildStandardPageView();
	$page->appendChild($view);
	$response = new AphrontWebpageResponse();
	$response->setContent($page->render());
	return $response;
	}

	public function getApplicationURI($path = '') {
	if (!$this->getCurrentApplication()) {
	throw new Exception("No application!");
	}
	return $this->getCurrentApplication()->getApplicationURI($path);
	}

	public function buildApplicationPage($view, array $options) {
	$page = $this->buildStandardPageView();

	$title = PhabricatorEnv::getEnvConfig('phabricator.serious-business') ?
	'Phabricator' :
	pht('Bacon Ice Cream for Breakfast');

	$application = $this->getCurrentApplication();
	$page->setTitle(idx($options, 'title', $title));
	if ($application) {
	$page->setApplicationName($application->getName());
	if ($application->getTitleGlyph()) {
	$page->setGlyph($application->getTitleGlyph());
	}
	}

	if (!($view instanceof AphrontSideNavFilterView)) {
	$nav = new AphrontSideNavFilterView();
	$nav->appendChild($view);
	$view = $nav;
	}

	$user = $this->getRequest()->getUser();
	$view->setUser($user);

	$page->appendChild($view);

	$object_phids = idx($options, 'pageObjects', array());
	if ($object_phids) {
	$page->appendPageObjects($object_phids);
	foreach ($object_phids as $object_phid) {
	PhabricatorFeedStoryNotification::updateObjectNotificationViews(
	$user,
	$object_phid);
	}
	}

	if (idx($options, 'device')) {
	$page->setDeviceReady(true);
	}

	$page->setShowChrome(idx($options, 'chrome', true));

	$application_menu = $this->buildApplicationMenu();
	if ($application_menu) {
	$page->setApplicationMenu($application_menu);
	}

	$response = new AphrontWebpageResponse();
	return $response->setContent($page->render());
	}

	public function didProcessRequest($response) {
	$request = $this->getRequest();
	$response->setRequest($request);

	$seen = array();
	while ($response instanceof AphrontProxyResponse) {

	$hash = spl_object_hash($response);
	if (isset($seen[$hash])) {
	$seen[] = get_class($response);
	throw new Exception(
	"Cycle while reducing proxy responses: ".
	implode(' -> ', $seen));
	}
	$seen[$hash] = get_class($response);

	$response = $response->reduceProxyResponse();
	}

	if ($response instanceof AphrontDialogResponse) {
	if (!$request->isAjax()) {
	$view = new PhabricatorStandardPageView();
	$view->setRequest($request);
	$view->setController($this);
	$view->appendChild(phutil_tag(
	'div',
	array('style' => 'padding: 2em 0;'),
	$response->buildResponseString()));
	$page_response = new AphrontWebpageResponse();
	$page_response->setContent($view->render());
	$page_response->setHTTPResponseCode($response->getHTTPResponseCode());
	return $page_response;
	} else {
	$response->getDialog()->setIsStandalone(true);

	return id(new AphrontAjaxResponse())
	->setContent(array(
	'dialog' => $response->buildResponseString(),
	));
	}
	} else if ($response instanceof AphrontRedirectResponse) {
	if ($request->isAjax()) {
	return id(new AphrontAjaxResponse())
	->setContent(
	array(
	'redirect' => $response->getURI(),
	));
	}
	}
	return $response;
	}

	protected function getHandle($phid) {
	if (empty($this->handles[$phid])) {
	throw new Exception(
	"Attempting to access handle which wasn't loaded: {$phid}");
	}
	return $this->handles[$phid];
	}

	protected function loadHandles(array $phids) {
	$phids = array_filter($phids);
	$this->handles = $this->loadViewerHandles($phids);
	return $this;
	}

	protected function getLoadedHandles() {
	return $this->handles;
	}

	protected function loadViewerHandles(array $phids) {
	return id(new PhabricatorHandleQuery())
	->setViewer($this->getRequest()->getUser())
	->withPHIDs($phids)
	->execute();
	}


	/**
	* Render a list of links to handles, identified by PHIDs. The handles must
	* already be loaded.
	*
	* @param list<phid> List of PHIDs to render links to.
	* @param string Style, one of "\n" (to put each item on its own line)
	* or "," (to list items inline, separated by commas).
	* @return string Rendered list of handle links.
	*/
	protected function renderHandlesForPHIDs(array $phids, $style = "\n") {
	$style_map = array(
	"\n" => phutil_tag('br'),
	',' => ', ',
	);

	if (empty($style_map[$style])) {
	throw new Exception("Unknown handle list style '{$style}'!");
	}

	return implode_selected_handle_links($style_map[$style],
	$this->getLoadedHandles(),
	array_filter($phids));
	}

	protected function buildApplicationMenu() {
	return null;
	}

	protected function buildApplicationCrumbs() {

	$crumbs = array();

	$application = $this->getCurrentApplication();
	if ($application) {
	$sprite = $application->getIconName();
	if (!$sprite) {
	$sprite = 'application';
	}

	$crumbs[] = id(new PhabricatorCrumbView())
	->setHref($this->getApplicationURI())
	->setIcon($sprite);
	}

	$view = new PhabricatorCrumbsView();
	foreach ($crumbs as $crumb) {
	$view->addCrumb($crumb);
	}

	return $view;
	}

	protected function hasApplicationCapability($capability) {
	return PhabricatorPolicyFilter::hasCapability(
	$this->getRequest()->getUser(),
	$this->getCurrentApplication(),
	$capability);
	}

	protected function requireApplicationCapability($capability) {
	PhabricatorPolicyFilter::requireCapability(
	$this->getRequest()->getUser(),
	$this->getCurrentApplication(),
	$capability);
	}

	protected function explainApplicationCapability(
	$capability,
	$positive_message,
	$negative_message) {

	$can_act = $this->hasApplicationCapability($capability);
	if ($can_act) {
	$message = $positive_message;
	$icon_name = 'enable-grey';
	} else {
	$message = $negative_message;
	$icon_name = 'lock';
	}

	$icon = id(new PHUIIconView())
	->setSpriteSheet(PHUIIconView::SPRITE_ICONS)
	->setSpriteIcon($icon_name);

	require_celerity_resource('policy-css');

	$phid = $this->getCurrentApplication()->getPHID();
	$explain_uri = "/policy/explain/{$phid}/{$capability}/";

	$message = phutil_tag(
	'div',
	array(
	'class' => 'policy-capability-explanation',
	),
	array(
	$icon,
	javelin_tag(
	'a',
	array(
	'href' => $explain_uri,
	'sigil' => 'workflow',
	),
	$message),
	));

	return array($can_act, $message);
	}

	public function getDefaultResourceSource() {
	return 'phabricator';
	}


	}
	diff --git a/src/applications/conduit/controller/PhabricatorConduitAPIController.php b/src/applications/conduit/controller/PhabricatorConduitAPIController.php
	index 21eeeb0b9b..997a2ac857 100644
	--- a/src/applications/conduit/controller/PhabricatorConduitAPIController.php
	+++ b/src/applications/conduit/controller/PhabricatorConduitAPIController.php
	@@ -1,471 +1,471 @@
	<?php

	/**
	* @group conduit
	*/
	final class PhabricatorConduitAPIController
	extends PhabricatorConduitController {

	public function shouldRequireLogin() {
	return false;
	}

	private $method;

	public function willProcessRequest(array $data) {
	$this->method = $data['method'];
	return $this;
	}

	public function processRequest() {
	$time_start = microtime(true);
	$request = $this->getRequest();

	$method = $this->method;

	$api_request = null;

	$log = new PhabricatorConduitMethodCallLog();
	$log->setMethod($method);
	$metadata = array();

	try {

	$params = $this->decodeConduitParams($request, $method);
	$metadata = idx($params, '__conduit__', array());
	unset($params['__conduit__']);

	$call = new ConduitCall(
	$method, $params, idx($metadata, 'isProxied', false));

	$result = null;

	// TODO: Straighten out the auth pathway here. We shouldn't be creating
	// a ConduitAPIRequest at this level, but some of the auth code expects
	// it. Landing a halfway version of this to unblock T945.

	$api_request = new ConduitAPIRequest($params);

	$allow_unguarded_writes = false;
	$auth_error = null;
	$conduit_username = '-';
	if ($call->shouldRequireAuthentication()) {
	$metadata['scope'] = $call->getRequiredScope();
	$auth_error = $this->authenticateUser($api_request, $metadata);
	// If we've explicitly authenticated the user here and either done
	// CSRF validation or are using a non-web authentication mechanism.
	$allow_unguarded_writes = true;

	if (isset($metadata['actAsUser'])) {
	$this->actAsUser($api_request, $metadata['actAsUser']);
	}

	if ($auth_error === null) {
	$conduit_user = $api_request->getUser();
	if ($conduit_user && $conduit_user->getPHID()) {
	$conduit_username = $conduit_user->getUsername();
	}
	$call->setUser($api_request->getUser());
	}
	}

	$access_log = PhabricatorAccessLog::getLog();
	if ($access_log) {
	$access_log->setData(
	array(
	'u' => $conduit_username,
	'm' => $method,
	));
	}

	if ($call->shouldAllowUnguardedWrites()) {
	$allow_unguarded_writes = true;
	}

	if ($auth_error === null) {
	if ($allow_unguarded_writes) {
	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
	}

	try {
	$result = $call->execute();
	$error_code = null;
	$error_info = null;
	} catch (ConduitException $ex) {
	$result = null;
	$error_code = $ex->getMessage();
	if ($ex->getErrorDescription()) {
	$error_info = $ex->getErrorDescription();
	} else {
	$error_info = $call->getErrorDescription($error_code);
	}
	}
	if ($allow_unguarded_writes) {
	unset($unguarded);
	}
	} else {
	list($error_code, $error_info) = $auth_error;
	}
	} catch (Exception $ex) {
	phlog($ex);
	$result = null;
	$error_code = ($ex instanceof ConduitException
	? 'ERR-CONDUIT-CALL'
	: 'ERR-CONDUIT-CORE');
	$error_info = $ex->getMessage();
	}

	$time_end = microtime(true);

	$connection_id = null;
	if (idx($metadata, 'connectionID')) {
	$connection_id = $metadata['connectionID'];
	} else if (($method == 'conduit.connect') && $result) {
	$connection_id = idx($result, 'connectionID');
	}

	$log
	->setCallerPHID(
	isset($conduit_user)
	? $conduit_user->getPHID()
	: null)
	->setConnectionID($connection_id)
	->setError((string)$error_code)
	->setDuration(1000000 * ($time_end - $time_start));

	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
	$log->save();
	unset($unguarded);

	$response = id(new ConduitAPIResponse())
	->setResult($result)
	->setErrorCode($error_code)
	->setErrorInfo($error_info);

	switch ($request->getStr('output')) {
	case 'human':
	return $this->buildHumanReadableResponse(
	$method,
	$api_request,
	$response->toDictionary());
	case 'json':
	default:
	return id(new AphrontJSONResponse())
	->setAddJSONShield(false)
	->setContent($response->toDictionary());
	}
	}

	/**
	* Change the api request user to the user that we want to act as.
	* Only admins can use actAsUser
	*
	* @param ConduitAPIRequest Request being executed.
	* @param string The username of the user we want to act as
	*/
	private function actAsUser(
	ConduitAPIRequest $api_request,
	$user_name) {

	if (!$api_request->getUser()->getIsAdmin()) {
	throw new Exception("Only administrators can use actAsUser");
	}

	$user = id(new PhabricatorUser())->loadOneWhere(
	'userName = %s',
	$user_name);

	if (!$user) {
	throw new Exception(
	"The actAsUser username '{$user_name}' is not a valid user."
	);
	}

	$api_request->setUser($user);
	}

	/**
	* Authenticate the client making the request to a Phabricator user account.
	*
	* @param ConduitAPIRequest Request being executed.
	* @param dict Request metadata.
	* @return null\|pair Null to indicate successful authentication, or
	* an error code and error message pair.
	*/
	private function authenticateUser(
	ConduitAPIRequest $api_request,
	array $metadata) {

	$request = $this->getRequest();

	if ($request->getUser()->getPHID()) {
	$request->validateCSRF();
	return $this->validateAuthenticatedUser(
	$api_request,
	$request->getUser());
	}

	// handle oauth
	$access_token = $request->getStr('access_token');
	$method_scope = $metadata['scope'];
	if ($access_token &&
	$method_scope != PhabricatorOAuthServerScope::SCOPE_NOT_ACCESSIBLE) {
	$token = id(new PhabricatorOAuthServerAccessToken())
	->loadOneWhere('token = %s',
	$access_token);
	if (!$token) {
	return array(
	'ERR-INVALID-AUTH',
	'Access token does not exist.',
	);
	}

	$oauth_server = new PhabricatorOAuthServer();
	$valid = $oauth_server->validateAccessToken($token,
	$method_scope);
	if (!$valid) {
	return array(
	'ERR-INVALID-AUTH',
	'Access token is invalid.',
	);
	}

	// valid token, so let's log in the user!
	$user_phid = $token->getUserPHID();
	$user = id(new PhabricatorUser())
	->loadOneWhere('phid = %s',
	$user_phid);
	if (!$user) {
	return array(
	'ERR-INVALID-AUTH',
	'Access token is for invalid user.',
	);
	}
	return $this->validateAuthenticatedUser(
	$api_request,
	$user);
	}

	// Handle sessionless auth. TOOD: This is super messy.
	if (isset($metadata['authUser'])) {
	$user = id(new PhabricatorUser())->loadOneWhere(
	'userName = %s',
	$metadata['authUser']);
	if (!$user) {
	return array(
	'ERR-INVALID-AUTH',
	'Authentication is invalid.',
	);
	}
	$token = idx($metadata, 'authToken');
	$signature = idx($metadata, 'authSignature');
	$certificate = $user->getConduitCertificate();
	if (sha1($token.$certificate) !== $signature) {
	return array(
	'ERR-INVALID-AUTH',
	'Authentication is invalid.',
	);
	}
	return $this->validateAuthenticatedUser(
	$api_request,
	$user);
	}

	$session_key = idx($metadata, 'sessionKey');
	if (!$session_key) {
	return array(
	'ERR-INVALID-SESSION',
	'Session key is not present.'
	);
	}

	$user = id(new PhabricatorAuthSessionEngine())
	- ->loadUserForSession('conduit', $session_key);
	+ ->loadUserForSession(PhabricatorAuthSession::TYPE_CONDUIT, $session_key);

	if (!$user) {
	return array(
	'ERR-INVALID-SESSION',
	'Session key is invalid.',
	);
	}

	return $this->validateAuthenticatedUser(
	$api_request,
	$user);
	}

	private function validateAuthenticatedUser(
	ConduitAPIRequest $request,
	PhabricatorUser $user) {

	if (!$user->isUserActivated()) {
	return array(
	'ERR-USER-DISABLED',
	pht('User account is not activated.'),
	);
	}

	$request->setUser($user);
	return null;
	}

	private function buildHumanReadableResponse(
	$method,
	ConduitAPIRequest $request = null,
	$result = null) {

	$param_rows = array();
	$param_rows[] = array('Method', $this->renderAPIValue($method));
	if ($request) {
	foreach ($request->getAllParameters() as $key => $value) {
	$param_rows[] = array(
	$key,
	$this->renderAPIValue($value),
	);
	}
	}

	$param_table = new AphrontTableView($param_rows);
	$param_table->setDeviceReadyTable(true);
	$param_table->setColumnClasses(
	array(
	'header',
	'wide',
	));

	$result_rows = array();
	foreach ($result as $key => $value) {
	$result_rows[] = array(
	$key,
	$this->renderAPIValue($value),
	);
	}

	$result_table = new AphrontTableView($result_rows);
	$result_table->setDeviceReadyTable(true);
	$result_table->setColumnClasses(
	array(
	'header',
	'wide',
	));

	$param_panel = new AphrontPanelView();
	$param_panel->setHeader('Method Parameters');
	$param_panel->appendChild($param_table);

	$result_panel = new AphrontPanelView();
	$result_panel->setHeader('Method Result');
	$result_panel->appendChild($result_table);

	$param_head = id(new PHUIHeaderView())
	->setHeader(pht('Method Parameters'));

	$result_head = id(new PHUIHeaderView())
	->setHeader(pht('Method Result'));

	$method_uri = $this->getApplicationURI('method/'.$method.'/');

	$crumbs = $this->buildApplicationCrumbs()
	->addTextCrumb($method, $method_uri)
	->addTextCrumb(pht('Call'));

	return $this->buildApplicationPage(
	array(
	$crumbs,
	$param_head,
	$param_table,
	$result_head,
	$result_table,
	),
	array(
	'title' => 'Method Call Result',
	'device' => true,
	));
	}

	private function renderAPIValue($value) {
	$json = new PhutilJSON();
	if (is_array($value)) {
	$value = $json->encodeFormatted($value);
	}

	$value = phutil_tag(
	'pre',
	array('style' => 'white-space: pre-wrap;'),
	$value);

	return $value;
	}

	private function decodeConduitParams(
	AphrontRequest $request,
	$method) {

	// Look for parameters from the Conduit API Console, which are encoded
	// as HTTP POST parameters in an array, e.g.:
	//
	// params[name]=value&params[name2]=value2
	//
	// The fields are individually JSON encoded, since we require users to
	// enter JSON so that we avoid type ambiguity.

	$params = $request->getArr('params', null);
	if ($params !== null) {
	foreach ($params as $key => $value) {
	if ($value == '') {
	// Interpret empty string null (e.g., the user didn't type anything
	// into the box).
	$value = 'null';
	}
	$decoded_value = json_decode($value, true);
	if ($decoded_value === null && strtolower($value) != 'null') {
	// When json_decode() fails, it returns null. This almost certainly
	// indicates that a user was using the web UI and didn't put quotes
	// around a string value. We can either do what we think they meant
	// (treat it as a string) or fail. For now, err on the side of
	// caution and fail. In the future, if we make the Conduit API
	// actually do type checking, it might be reasonable to treat it as
	// a string if the parameter type is string.
	throw new Exception(
	"The value for parameter '{$key}' is not valid JSON. All ".
	"parameters must be encoded as JSON values, including strings ".
	"(which means you need to surround them in double quotes). ".
	"Check your syntax. Value was: {$value}");
	}
	$params[$key] = $decoded_value;
	}

	return $params;
	}

	// Otherwise, look for a single parameter called 'params' which has the
	// entire param dictionary JSON encoded. This is the usual case for remote
	// requests.

	$params_json = $request->getStr('params');
	if (!strlen($params_json)) {
	if ($request->getBool('allowEmptyParams')) {
	// TODO: This is a bit messy, but otherwise you can't call
	// "conduit.ping" from the web console.
	$params = array();
	} else {
	throw new Exception(
	"Request has no 'params' key. This may mean that an extension like ".
	"Suhosin has dropped data from the request. Check the PHP ".
	"configuration on your server. If you are developing a Conduit ".
	"client, you MUST provide a 'params' parameter when making a ".
	"Conduit request, even if the value is empty (e.g., provide '{}').");
	}
	} else {
	$params = json_decode($params_json, true);
	if (!is_array($params)) {
	throw new Exception(
	"Invalid parameter information was passed to method ".
	"'{$method}', could not decode JSON serialization. Data: ".
	$params_json);
	}
	}

	return $params;
	}
	}
	diff --git a/src/applications/conduit/method/ConduitAPI_conduit_connect_Method.php b/src/applications/conduit/method/ConduitAPI_conduit_connect_Method.php
	index 75252a2114..0995f2748f 100644
	--- a/src/applications/conduit/method/ConduitAPI_conduit_connect_Method.php
	+++ b/src/applications/conduit/method/ConduitAPI_conduit_connect_Method.php
	@@ -1,158 +1,160 @@
	<?php

	/**
	* @group conduit
	*/
	final class ConduitAPI_conduit_connect_Method extends ConduitAPIMethod {

	public function shouldRequireAuthentication() {
	return false;
	}

	public function shouldAllowUnguardedWrites() {
	return true;
	}

	public function getMethodDescription() {
	return "Connect a session-based client.";
	}

	public function defineParamTypes() {
	return array(
	'client' => 'required string',
	'clientVersion' => 'required int',
	'clientDescription' => 'optional string',
	'user' => 'optional string',
	'authToken' => 'optional int',
	'authSignature' => 'optional string',
	'host' => 'required string',
	);
	}

	public function defineReturnType() {
	return 'dict<string, any>';
	}

	public function defineErrorTypes() {
	return array(
	"ERR-BAD-VERSION" =>
	"Client/server version mismatch. Upgrade your server or downgrade ".
	"your client.",
	"NEW-ARC-VERSION" =>
	"Client/server version mismatch. Upgrade your client.",
	"ERR-UNKNOWN-CLIENT" =>
	"Client is unknown.",
	"ERR-INVALID-USER" =>
	"The username you are attempting to authenticate with is not valid.",
	"ERR-INVALID-CERTIFICATE" =>
	"Your authentication certificate for this server is invalid.",
	"ERR-INVALID-TOKEN" =>
	"The challenge token you are authenticating with is outside of the ".
	"allowed time range. Either your system clock is out of whack or ".
	"you're executing a replay attack.",
	"ERR-NO-CERTIFICATE" => "This server requires authentication.",
	);
	}

	protected function execute(ConduitAPIRequest $request) {

	$this->validateHost($request->getValue('host'));

	$client = $request->getValue('client');
	$client_version = (int)$request->getValue('clientVersion');
	$client_description = (string)$request->getValue('clientDescription');
	$username = (string)$request->getValue('user');

	// Log the connection, regardless of the outcome of checks below.
	$connection = new PhabricatorConduitConnectionLog();
	$connection->setClient($client);
	$connection->setClientVersion($client_version);
	$connection->setClientDescription($client_description);
	$connection->setUsername($username);
	$connection->save();

	switch ($client) {
	case 'arc':
	$server_version = 6;
	$supported_versions = array(
	$server_version => true,
	// Client version 5 introduced "user.query" call
	4 => true,
	// Client version 6 introduced "diffusion.getlintmessages" call
	5 => true,
	);

	if (empty($supported_versions[$client_version])) {
	if ($server_version < $client_version) {
	$ex = new ConduitException('ERR-BAD-VERSION');
	$ex->setErrorDescription(
	"Your 'arc' client version is '{$client_version}', which ".
	"is newer than the server version, '{$server_version}'. ".
	"Upgrade your Phabricator install.");
	} else {
	$ex = new ConduitException('NEW-ARC-VERSION');
	$ex->setErrorDescription(
	"A new version of arc is available! You need to upgrade ".
	"to connect to this server (you are running version ".
	"{$client_version}, the server is running version ".
	"{$server_version}).");
	}
	throw $ex;
	}
	break;
	default:
	// Allow new clients by default.
	break;
	}

	$token = $request->getValue('authToken');
	$signature = $request->getValue('authSignature');

	$user = id(new PhabricatorUser())->loadOneWhere(
	'username = %s',
	$username);
	if (!$user) {
	throw new ConduitException('ERR-INVALID-USER');
	}

	$session_key = null;
	if ($token && $signature) {
	$threshold = 60 * 15;
	$now = time();
	if (abs($token - $now) > $threshold) {
	throw id(new ConduitException('ERR-INVALID-TOKEN'))
	->setErrorDescription(
	pht(
	"The request you submitted is signed with a timestamp, but that ".
	"timestamp is not within %s of the current time. The ".
	"signed timestamp is %s (%s), and the current server time is ".
	"%s (%s). This is a difference of %s seconds, but the ".
	"timestamp must differ from the server time by no more than ".
	"%s seconds. Your client or server clock may not be set ".
	"correctly.",
	phabricator_format_relative_time($threshold),
	$token,
	date('r', $token),
	$now,
	date('r', $now),
	($token - $now),
	$threshold));
	}
	$valid = sha1($token.$user->getConduitCertificate());
	if ($valid != $signature) {
	throw new ConduitException('ERR-INVALID-CERTIFICATE');
	}
	$session_key = id(new PhabricatorAuthSessionEngine())
	- ->establishSession('conduit', $user->getPHID());
	+ ->establishSession(
	+ PhabricatorAuthSession::TYPE_CONDUIT,
	+ $user->getPHID());
	} else {
	throw new ConduitException('ERR-NO-CERTIFICATE');
	}

	return array(
	'connectionID' => $connection->getID(),
	'sessionKey' => $session_key,
	'userPHID' => $user->getPHID(),
	);
	}

	}
	diff --git a/src/applications/settings/panel/PhabricatorSettingsPanelConduit.php b/src/applications/settings/panel/PhabricatorSettingsPanelConduit.php
	index 60ab25a730..4645c04d56 100644
	--- a/src/applications/settings/panel/PhabricatorSettingsPanelConduit.php
	+++ b/src/applications/settings/panel/PhabricatorSettingsPanelConduit.php
	@@ -1,117 +1,117 @@
	<?php

	final class PhabricatorSettingsPanelConduit
	extends PhabricatorSettingsPanel {

	public function getPanelKey() {
	return 'conduit';
	}

	public function getPanelName() {
	return pht('Conduit');
	}

	public function getPanelGroup() {
	return pht('Authentication');
	}

	public function processRequest(AphrontRequest $request) {
	$user = $request->getUser();

	if ($request->isFormPost()) {
	if (!$request->isDialogFormPost()) {
	$dialog = new AphrontDialogView();
	$dialog->setUser($user);
	$dialog->setTitle(pht('Really regenerate session?'));
	$dialog->setSubmitURI($this->getPanelURI());
	$dialog->addSubmitButton(pht('Regenerate'));
	$dialog->addCancelbutton($this->getPanelURI());
	$dialog->appendChild(phutil_tag('p', array(), pht(
	'Really destroy the old certificate? Any established '.
	'sessions will be terminated.')));

	return id(new AphrontDialogResponse())
	->setDialog($dialog);
	}

	$sessions = id(new PhabricatorAuthSessionQuery())
	->setViewer($user)
	->withIdentityPHIDs(array($user->getPHID()))
	- ->withSessionTypes(array('conduit'))
	+ ->withSessionTypes(array(PhabricatorAuthSession::TYPE_CONDUIT))
	->execute();
	foreach ($sessions as $session) {
	$session->delete();
	}

	// This implicitly regenerates the certificate.
	$user->setConduitCertificate(null);
	$user->save();
	return id(new AphrontRedirectResponse())
	->setURI($this->getPanelURI('?regenerated=true'));
	}

	if ($request->getStr('regenerated')) {
	$notice = new AphrontErrorView();
	$notice->setSeverity(AphrontErrorView::SEVERITY_NOTICE);
	$notice->setTitle(pht('Certificate Regenerated'));
	$notice->appendChild(phutil_tag(
	'p',
	array(),
	pht('Your old certificate has been destroyed and you have been issued '.
	'a new certificate. Sessions established under the old certificate '.
	'are no longer valid.')));
	$notice = $notice->render();
	} else {
	$notice = null;
	}

	Javelin::initBehavior('select-on-click');

	$cert_form = new AphrontFormView();
	$cert_form
	->setUser($user)
	->appendChild(phutil_tag(
	'p',
	array('class' => 'aphront-form-instructions'),
	pht('This certificate allows you to authenticate over Conduit, '.
	'the Phabricator API. Normally, you just run %s to install it.',
	phutil_tag('tt', array(), 'arc install-certificate'))))
	->appendChild(
	id(new AphrontFormTextAreaControl())
	->setLabel(pht('Certificate'))
	->setHeight(AphrontFormTextAreaControl::HEIGHT_SHORT)
	->setReadonly(true)
	->setSigil('select-on-click')
	->setValue($user->getConduitCertificate()));

	$cert_form = id(new PHUIObjectBoxView())
	->setHeaderText(pht('Arcanist Certificate'))
	->setForm($cert_form);

	$regen_instruction = pht('You can regenerate this certificate, which '.
	'will invalidate the old certificate and create a new one.');

	$regen_form = new AphrontFormView();
	$regen_form
	->setUser($user)
	->setAction($this->getPanelURI())
	->setWorkflow(true)
	->appendChild(phutil_tag(
	'p',
	array('class' => 'aphront-form-instructions'),
	$regen_instruction))
	->appendChild(
	id(new AphrontFormSubmitControl())
	->setValue(pht('Regenerate Certificate')));

	$regen_form = id(new PHUIObjectBoxView())
	->setHeaderText(pht('Regenerate Certificate'))
	->setForm($regen_form);

	return array(
	$notice,
	$cert_form,
	$regen_form,
	);
	}
	}

File Metadata

Mime Type: text/x-diff
Expires: Mon, Mar 16, 11:20 PM (1 d, 10 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 963568
Default Alt Text: (54 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions