pyload-ng 0.5.0b3.dev99__tar.gz → 0.5.0b3.dev100__tar.gz

{pyload_ng-0.5.0b3.dev99 → pyload_ng-0.5.0b3.dev100}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyload-ng
-Version: 0.5.0b3.dev99
+Version: 0.5.0b3.dev100
 Summary: The free and open-source Download Manager written in pure Python
 Home-page: https://pyload.net
 Download-URL: https://github.com/pyload/pyload/releases

{pyload_ng-0.5.0b3.dev99 → pyload_ng-0.5.0b3.dev100}/src/pyload/core/api/__init__.py

@@ -148,6 +148,9 @@ class Api:
         self.pyload = core
         self._ = core._
 
+        # API key cache
+        self._apikey_cache = {}  # Format: {key_id: (timestamp, data)}
+
     def _required_http_method_for_api(self, func_name: str) -> Optional[str]:
         """
         Get the allowed HTTP method for an API method
@@ -235,10 +238,15 @@ class Api:
         is_admin = user_info.get("role") == Role.ADMIN
 
         ADMIN_ONLY_CORE_OPTIONS = {
+            ("general", "ssl_verify"),
             ("general", "storage_folder"),
             ("log", "syslog_host"),
             ("log", "syslog_port"),
+            ("proxy", "enabled"),
+            ("proxy", "host"),
             ("proxy", "password"),
+            ("proxy", "socks_resolve_dns"),
+            ("proxy", "type"),
             ("proxy", "username"),
             ("reconnect", "script"),
             ("webui", "host"),
@@ -256,12 +264,8 @@ class Api:
         if section == "core":
             if category == "general" and option == "storage_folder":
                 # Forbid setting the download folder inside dangerous locations
-                correct_case = lambda x: x.lower() if os.name == "nt" else x
-                directories = [
-                    correct_case(os.path.join(os.path.realpath(d), ""))
-                    for d in [value, PKGDIR, self.pyload.userdir]
-                ]
-                if any(directories[0].startswith(d) for d in directories[1:]):
+                blocked_dirs = [PKGDIR, self.pyload.userdir]
+                if any(fs.is_within_directory(d, value) for d in blocked_dirs):
                     return
 
             # Require ADMIN role for security-critical settings
@@ -554,17 +558,8 @@ class Api:
         else:
             folder = ""
 
-        folder = (
-            folder.replace("http://", "")
-            .replace("https://", "")
-            .replace("../", "_")
-            .replace("..\\", "_")
-            .replace(":", "")
-            .replace("/", "_")
-            .replace("\\", "_")
-            .replace("\r", "_")
-            .replace("\n", "_")
-        )
+        folder = folder.replace("http://", "").replace("https://", "")
+        folder = secure_filename(folder)
 
         sanitized_name = name.replace("\n", "\\n").replace("\r", "\\r")
         package_id = self.pyload.files.add_package(sanitized_name, folder, Destination(dest))
@@ -1163,6 +1158,8 @@ class Api:
         for key, value in data.items():
             if key == "id":
                 continue
+            elif key == "_folder":
+                value = secure_filename(value)
             setattr(p, key, value)
 
         p.sync()
@@ -1629,6 +1626,16 @@ class Api:
         """
         deletes a user login.
         """
+        user_id = self.pyload.db.get_user_id(user)
+        if user_id:
+            # Remove all cache entries where the cached_data has matching user_id
+            keys_to_delete = [
+                key_id for key_id, (_, data) in self._apikey_cache.items()
+                if data.get("user_id") == user_id
+            ]
+            for key_id in keys_to_delete:
+                del self._apikey_cache[key_id]
+
         return self.pyload.db.remove_user(user)
 
     @legacy("changePassword")
@@ -1721,14 +1728,19 @@ class Api:
                 "error": "Invalid username",
             }
         else:
+            result = self.pyload.db.delete_user_apikey(user_id, key_id)
+            if result:
+                self._apikey_cache.pop(key_id, None)  # remove from cache
+
             return {
-                "success": self.pyload.db.delete_user_apikey(user_id, key_id),
+                "success": result,
             }
 
-    def check_apikey(self, apikey: str) -> dict[str, Any]:
+    def check_apikey(self, apikey: str, ttl: int = 5 * 60) -> dict[str, Any]:
         """
-        Validates an API key.
+        Validates an API key with caching for improved performance.
         :param apikey: API key to validate
+        :param ttl: API key cache TTL in seconds (0 = no cache)
         :return: dict with `data` as the API key info
         """
         if (
@@ -1743,15 +1755,47 @@ class Api:
             }
 
         key_id = int(apikey[4:4 + int(apikey[3])])
+
+        now = int(time.time() * 1000)
+
+        # Check cache first (skip if ttl is 0)
+        if ttl > 0 and key_id in self._apikey_cache:
+            cache_time, cached_data = self._apikey_cache[key_id]
+            if now - cache_time < ttl * 1000:
+                # Cache hit - verify expiration in case key expired during cache window
+                expires_at = cached_data["expires_at"]
+                if 0 < expires_at <= now:
+                    # Key expired, remove from cache and fail
+                    del self._apikey_cache[key_id]
+                    return {
+                        "success": False,
+                        "error": "API key has expired",
+                    }
+
+                else:
+                    # Cache hit - return cached data
+                    return {
+                        "success": True,
+                        "data": cached_data,
+                    }
+            else:
+                # Cache expired - remove it
+                del self._apikey_cache[key_id]
+
+        # Cache miss - query database
         key_data = self.pyload.db.check_apikey(key_id, apikey[-43:])
         if not key_data:
             return {
                 "success": False,
                 "error": "Invalid or expired API key",
             }
-        else:
-            self.pyload.db.update_apikey_last_used(key_id)
-            return {
-                "success": True,
-                "data": key_data,
-            }
+
+        # Cache the successful validation result (only if ttl > 0)
+        if ttl > 0:
+            self._apikey_cache[key_id] = (now, key_data)
+
+        self.pyload.db.update_apikey_last_used(key_id)
+        return {
+            "success": True,
+            "data": key_data,
+        }

{pyload_ng-0.5.0b3.dev99 → pyload_ng-0.5.0b3.dev100}/src/pyload/core/database/apikey_database.py

@@ -1,10 +1,8 @@
 import hmac  # Only imported for its secure string comparison function
 import time
-from typing import Union
 
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import hashes
-from wtforms.validators import Optional
 
 from ..utils.struct.style import style
 

pyload_ng-0.5.0b3.dev100/src/pyload/core/database/user_database.py

@@ -0,0 +1,316 @@
+import os
+
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
+
+from ..utils.struct.style import style
+
+
+# TODO: rewrite using scrypt or argon2_cffi
+def _salted_password(password, salt):
+    """
+    Generate a salted password hash using PBKDF2-HMAC-SHA256.
+
+    Uses 100,000 iterations to derive a 32-byte key from the password and salt.
+
+    Parameters:
+        password (str): Plain text password to hash.
+        salt (str): Hexadecimal string representing the salt (32 characters).
+
+    Returns:
+        str: Concatenated salt and derived key as hexadecimal string.
+    """
+    # Use PBKDF2 via cryptography to derive a 32-byte key with 100,000 iterations (SHA-256)
+    kdf = PBKDF2HMAC(
+        algorithm=hashes.SHA256(),
+        length=32,
+        salt=bytes.fromhex(salt),
+        iterations=100000,
+    )
+    dk = kdf.derive(password.encode())
+    return salt + dk.hex()
+
+
+def _gensalt():
+    """
+    Generate a cryptographically secure random salt.
+
+    Returns:
+        str: 32-character hexadecimal string (16 random bytes).
+    """
+    return os.urandom(16).hex()
+
+
+def _check_password(hashed, clear):
+    """
+    Verify a plain text password against a hashed password.
+
+    Extracts the salt from the hashed password, rehashes the plain text
+    password with the same salt, and compares the results.
+
+    Parameters:
+        hashed (str): Stored password hash (salt + derived key in hex).
+        clear (str): Plain text password to verify.
+
+    Returns:
+        bool: True if the password matches, False otherwise.
+    """
+    salt = hashed[:32]
+    to_compare = _salted_password(clear, salt)
+
+    return hashed == to_compare
+
+
+class UserDatabaseMethods:
+    @style.queue
+    def check_auth(self, username, password):
+        """
+        Authenticate a user by username and password.
+
+        Retrieves user data from the database and verifies the provided
+        password against the stored hash.
+
+        Parameters:
+            username (str): Username to authenticate.
+            password (str): Plain text password to verify.
+
+        Returns:
+            dict: User data dictionary with keys: id, name, role, permission,
+                  template, email. Returns empty dict if authentication fails.
+        """
+        self.c.execute(
+            "SELECT id, name, password, role, permission, template, email FROM users WHERE name=?",
+            (username,),
+        )
+        r = self.c.fetchone()
+        if not r:
+            return {}
+
+        stored_password = r[2]
+        if not _check_password(stored_password, password):
+            return {}
+
+        return {
+            "id": r[0],
+            "name": r[1],
+            "role": r[3],
+            "permission": r[4],
+            "template": r[5],
+            "email": r[6],
+        }
+
+    @style.queue
+    def add_user(self, username, password, role=0, perms=0, reset=False):
+        """
+        Add a new user or update an existing user's credentials.
+
+        Creates a new user with the specified credentials. If the user already
+        exists and reset=True, updates their password, role, and permissions.
+
+        Parameters:
+            username (str): Username for the new or existing user.
+            password (str): Plain text password (will be hashed).
+            role (int): User role identifier. Defaults to 0.
+            perms (int): User permission flags. Defaults to 0.
+            reset (bool): If True, update existing user's credentials.
+                         If False, fail if user exists. Defaults to False.
+
+        Returns:
+            bool: True if user was created or updated successfully,
+                  False if user exists and reset=False.
+        """
+        salt_pw = _salted_password(password, _gensalt())
+
+        self.c.execute("SELECT name FROM users WHERE name=?", (username,))
+        if self.c.fetchone() is not None:
+            if reset:
+                self.c.execute(
+                    "UPDATE users SET password=?, role=?, permission=? WHERE name=?",
+                    (salt_pw, role, perms, username),
+                )
+                return True
+            else:
+                return False
+        else:
+            self.c.execute(
+                "INSERT INTO users (name, password, role, permission) VALUES (?, ?, ?, ?)",
+                (username, salt_pw, role, perms),
+            )
+            return True
+
+    @style.queue
+    def change_password(self, username, old_password, new_password):
+        """
+        Change a user's password after verifying the old password.
+
+        Validates the old password before updating to the new password.
+        The new password is salted and hashed before storage.
+
+        Parameters:
+            username (str): Username of the account to update.
+            old_password (str): Current password for verification.
+            new_password (str): New password to set (will be hashed).
+
+        Returns:
+            bool: True if password was changed successfully,
+                  False if user not found or old password is incorrect.
+        """
+        self.c.execute("SELECT id, name, password FROM users WHERE name=?", (username,))
+        r = self.c.fetchone()
+        if not r:
+            return False
+
+        stored_password = r[2]
+        if not _check_password(stored_password, old_password):
+            return False
+
+        newpw = _salted_password(new_password, _gensalt())
+
+        self.c.execute("UPDATE users SET password=? WHERE name=?", (newpw, username))
+        return True
+
+    @style.async_
+    def set_permission(self, username, perms):
+        """
+        Update a user's permission flags.
+
+        This is an asynchronous operation that updates the permission field
+        for the specified user.
+
+        Parameters:
+            username (str): Username of the account to update.
+            perms (int): New permission flags to set.
+
+        Returns:
+            None
+        """
+        self.c.execute("UPDATE users SET permission=? WHERE name=?", (perms, username))
+
+    @style.async_
+    def set_role(self, username, role):
+        """
+        Update a user's role.
+
+        This is an asynchronous operation that updates the role field
+        for the specified user.
+
+        Parameters:
+            username (str): Username of the account to update.
+            role (int): New role identifier to set.
+
+        Returns:
+            None
+        """
+        self.c.execute("UPDATE users SET role=? WHERE name=?", (role, username))
+
+    @style.queue
+    def user_exists(self, username):
+        """
+        Check if a user exists in the database.
+
+        Parameters:
+            username (str): Username to check.
+
+        Returns:
+            bool: True if user exists, False otherwise.
+        """
+        self.c.execute("SELECT name FROM users WHERE name=?", (username,))
+        return self.c.fetchone() is not None
+
+    @style.queue
+    def list_users(self):
+        """
+        Retrieve a list of all usernames in the database.
+
+        Returns:
+            list: List of username strings.
+        """
+        self.c.execute("SELECT name FROM users")
+        users = []
+        for row in self.c:
+            users.append(row[0])
+        return users
+
+    @style.queue
+    def get_all_user_data(self):
+        """
+        Retrieve complete data for all users.
+
+        Returns:
+            dict: Dictionary mapping user IDs to user data dictionaries.
+                  Each user data dict contains: name, permission, role,
+                  template, email.
+        """
+        self.c.execute("SELECT id, name, permission, role, template, email FROM users")
+        user_data = {}
+        for r in self.c:
+            user_data[r[0]] = {
+                "name": r[1],
+                "permission": r[2],
+                "role": r[3],
+                "template": r[4],
+                "email": r[5],
+            }
+
+        return user_data
+
+    @style.queue
+    def get_user_id(self, username):
+        """
+        Retrieve the user ID for a given username.
+
+        Parameters:
+            username (str): Username to look up.
+
+        Returns:
+            int or bool: User ID if found, False if user does not exist.
+        """
+        self.c.execute("SELECT id, name FROM users WHERE name=?", (username,))
+        r = self.c.fetchone()
+        if not r:
+            return False
+        else:
+            return r[0]
+
+    @style.queue
+    def get_user_by_id(self, user_id):
+        """
+        Get user data by user ID.
+
+        Parameters:
+            user_id (int): ID of the user to retrieve.
+
+        Returns:
+            dict: User data dictionary with keys: name, permission, role,
+                  template, email. Returns empty dict if user not found.
+        """
+        self.c.execute(
+            "SELECT id, name, permission, role, template, email FROM users WHERE id=?",
+            (user_id,),
+        )
+        r = self.c.fetchone()
+        if not r:
+            return {}
+        return {
+            "id": r[0],
+            "name": r[1],
+            "permission": r[2],
+            "role": r[3],
+            "template": r[4],
+            "email": r[5],
+        }
+
+    @style.queue
+    def remove_user(self, username):
+        """
+        Delete a user from the database.
+
+        Parameters:
+            username (str): Username of the account to delete.
+
+        Returns:
+            bool: True if user was deleted (rowcount > 0),
+                  False if user was not found.
+        """
+        self.c.execute("DELETE FROM users WHERE name=?", (username,))
+        return self.c.rowcount > 0

{pyload_ng-0.5.0b3.dev99 → pyload_ng-0.5.0b3.dev100}/src/pyload/core/network/http/exceptions.py

@@ -17,7 +17,12 @@ PROPRIETARY_RESPONSES = {
 }
 
 
-class BadHeader(Exception):
+class HTTPError(Exception):
+    """Base exception for HTTP-related errors."""
+    pass
+
+
+class BadHeader(HTTPError):
     def __init__(self, code, headers, content=""):
         code = int(code)
         response = http.client.responses.get(code, PROPRIETARY_RESPONSES.get(code, "unknown error code"))
@@ -25,3 +30,8 @@ class BadHeader(Exception):
         self.code = code
         self.headers = headers
         self.content = content
+
+
+class WrongFormat(HTTPError):
+    """Exception raised when chunk metadata file format is invalid."""
+    pass