0
0
mirror of https://github.com/nextcloud/server.git synced 2024-12-29 16:38:28 +00:00
nextcloud_server/apps/settings/lib/SetupChecks/AllowedAdminRanges.php
Joas Schilling 047479ccf9
feat(security): Add public API to allow validating IP Ranges and checking for "in range"
Signed-off-by: Joas Schilling <coding@schilljs.com>
Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
2024-07-19 16:28:03 +02:00

64 lines
1.7 KiB
PHP
Raw Permalink Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

<?php
declare(strict_types=1);
/**
* SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
* SPDX-License-Identifier: AGPL-3.0-or-later
*/
namespace OCA\Settings\SetupChecks;
use OC\Security\Ip\Range;
use OC\Security\Ip\RemoteAddress;
use OCP\IConfig;
use OCP\IL10N;
use OCP\SetupCheck\ISetupCheck;
use OCP\SetupCheck\SetupResult;
class AllowedAdminRanges implements ISetupCheck {
public function __construct(
private IConfig $config,
private IL10N $l10n,
) {
}
public function getCategory(): string {
return 'system';
}
public function getName(): string {
return $this->l10n->t('Allowed admin IP ranges');
}
public function run(): SetupResult {
$allowedAdminRanges = $this->config->getSystemValue(RemoteAddress::SETTING_NAME, false);
if (
$allowedAdminRanges === false
|| (is_array($allowedAdminRanges) && empty($allowedAdminRanges))
) {
return SetupResult::success($this->l10n->t('Admin IP filtering isnt applied.'));
}
if (!is_array($allowedAdminRanges)) {
return SetupResult::error(
$this->l10n->t(
'Configuration key "%1$s" expects an array (%2$s found). Admin IP range validation will not be applied.',
[RemoteAddress::SETTING_NAME, gettype($allowedAdminRanges)],
)
);
}
$invalidRanges = array_filter($allowedAdminRanges, static fn (mixed $range): bool => !is_string($range) || !Range::isValid($range));
if (!empty($invalidRanges)) {
return SetupResult::warning(
$this->l10n->t(
'Configuration key "%1$s" contains invalid IP range(s): "%2$s"',
[RemoteAddress::SETTING_NAME, implode('", "', $invalidRanges)],
),
);
}
return SetupResult::success($this->l10n->t('Admin IP filtering is correctly configured.'));
}
}