Affected by GO-2023-1808 and 2 other vulnerabilities

GO-2023-1808: Go package pydio/cells vulnerable to authorization bypass in github.com/pydio/cells

GO-2023-1809: go package pydio cells vulnerable to cross-site scripting in github.com/pydio/cells

GO-2023-2344: Abstrium Pydio Cells Resource Injection vulnerability in github.com/pydio/cells

The highest tagged major version is v4.

common

package

v1.0.2 Latest Latest Go to latest Published: Jul 3, 2018 License: AGPL-3.0 Imports: 4 Imported by: 1,194

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/pydio/cells

Links

Open Source Insights

Documentation ¶

Overview ¶

Package common provides a library of tools used by all pydio services

Constants ¶

View Source

const (
	SERVICE_CONSUL = "consul"
	SERVICE_NATS   = "nats"

	SERVICE_LOG     = "log"
	SERVICE_CONFIG  = "config"
	SERVICE_INSTALL = "install"
	SERVICE_UPDATE  = "update"

	SERVICE_TAG_IDM        = "idm"
	SERVICE_TAG_SCHEDULER  = "scheduler"
	SERVICE_TAG_DATA       = "data"
	SERVICE_TAG_DATASOURCE = "datasource"
	SERVICE_TAG_BROKER     = "broker"
	SERVICE_TAG_GATEWAY    = "gateway"
	SERVICE_TAG_DISCOVERY  = "discovery"
	SERVICE_TAG_FRONTEND   = "frontend"

	SERVICE_ACL       = "acl"
	SERVICE_SHARE     = "share"
	SERVICE_ROLE      = "role"
	SERVICE_USER      = "user"
	SERVICE_AUTH      = "auth"
	SERVICE_WORKSPACE = "workspace"
	SERVICE_POLICY    = "policy"
	SERVICE_GRAPH     = "graph"
	SERVICE_USER_META = "user-meta"

	SERVICE_USER_KEY = "user-key"
	SERVICE_TREE     = "tree"
	SERVICE_META     = "meta"
	SERVICE_ENC_KEY  = "data-key"
	SERVICE_SEARCH   = "search"
	SERVICE_CHANGES  = "changes"
	SERVICE_SYNC     = "sync"

	SERVICE_ACTIVITY   = "activity"
	SERVICE_MAILER     = "mailer"
	SERVICE_WEBSOCKET  = "websocket"
	SERVICE_CHAT       = "chat"
	SERVICE_FRONTEND   = "frontend"
	SERVICE_FRONTPLUGS = "front-plugins"

	SERVICE_TIMER    = "timer"
	SERVICE_JOBS     = "jobs"
	SERVICE_TASKS    = "tasks"
	SERVICE_VERSIONS = "versions"
	SERVICE_DOCSTORE = "docstore"

	SERVICE_DATA_         = "data."
	SERVICE_DATA_INDEX    = SERVICE_DATA_ + "index"
	SERVICE_DATA_OBJECTS  = SERVICE_DATA_ + "objects"
	SERVICE_DATA_SYNC     = SERVICE_DATA_ + "sync"
	SERVICE_DATA_INDEX_   = SERVICE_DATA_INDEX + "."
	SERVICE_DATA_OBJECTS_ = SERVICE_DATA_OBJECTS + "."
	SERVICE_DATA_SYNC_    = SERVICE_DATA_SYNC + "."

	SERVICE_GATEWAY       = "gateway"
	SERVICE_GATEWAY_PROXY = SERVICE_GATEWAY + ".proxy"
	SERVICE_GATEWAY_DATA  = SERVICE_GATEWAY + ".data"
	SERVICE_GATEWAY_DAV   = SERVICE_GATEWAY + ".dav"
	SERVICE_GATEWAY_WOPI  = SERVICE_GATEWAY + ".wopi"
	SERVICE_MICRO_API     = "micro.api"

	SERVICE_GRPC_NAMESPACE_ = "pydio.grpc."
	SERVICE_API_NAMESPACE_  = "pydio.api."
	SERVICE_REST_NAMESPACE_ = "pydio.rest."

	TOPIC_SERVICE_STOP     = "topic.pydio.service.stop"
	TOPIC_INDEX_CHANGES    = "topic.pydio.index.nodes.changes"
	TOPIC_TREE_CHANGES     = "topic.pydio.tree.nodes.changes"
	TOPIC_META_CHANGES     = "topic.pydio.meta.nodes.changes"
	TOPIC_TIMER_EVENT      = "topic.pydio.meta.timer.event"
	TOPIC_JOB_CONFIG_EVENT = "topic.pydio.jobconfig.event"
	TOPIC_JOB_TASK_EVENT   = "topic.pydio.jobconfig.event"
	TOPIC_IDM_EVENT        = "topic.pydio.idm.event"
	TOPIC_ACTIVITY_EVENT   = "topic.pydio.activity.event"
	TOPIC_CHAT_EVENT       = "topic.pydio.chat.event"
	TOPIC_DATASOURCE_EVENT = "topic.pydio.datasource.event"

	META_NAMESPACE_DATASOURCE_NAME        = "pydio:meta-data-source-name"
	META_NAMESPACE_DATASOURCE_PATH        = "pydio:meta-data-source-path"
	META_NAMESPACE_NODE_TEST_LOCAL_FOLDER = "pydio:test:local-folder-storage"

	PYDIO_THUMBSTORE_NAMESPACE        = "pydio-thumbstore"
	PYDIO_DOCSTORE_BINARIES_NAMESPACE = "pydio-binaries"
	PYDIO_VERSIONS_NAMESPACE          = "versions-store"

	PYDIO_CONTEXT_USER_KEY      = "X-Pydio-User"
	PYDIO_SYSTEM_USERNAME       = "pydio.system.user"
	PYDIO_S3ANON_USERNAME       = "pydio.anon.user"
	PYDIO_S3ANON_PROFILE        = "anon"
	PYDIO_SYNC_HIDDEN_FILE_META = ".pydio"

	PYDIO_PROFILE_ADMIN    = "admin"
	PYDIO_PROFILE_STANDARD = "standard"
	PYDIO_PROFILE_SHARED   = "shared"
	PYDIO_PROFILE_ANON     = "anon"

	KEYRING_MASTER_KEY       = "keyring.master"
	META_FLAG_READONLY       = "node_readonly"
	NODE_FLAG_ETAG_TEMPORARY = "temporary"

	DB_MAX_OPEN_CONNS    = 30
	DB_MAX_IDLE_CONNS    = 20
	DB_CONN_MAX_LIFETIME = 5 * time.Minute

	LogConfigConsole    LogConfigType = "console"
	LogConfigProduction LogConfigType = "production"
)

View Source

const (

	// Meta keys
	KEY_MSG_ID = "MsgId"
	KEY_TS     = "Ts"
	KEY_LEVEL  = "Level"
	KEY_LOGGER = "Logger"
	KEY_MSG    = "Msg"

	// Known audit message IDs
	// NOTE: also update the below label map when adding a new value
	AUDIT_LOGIN_SUCCEED       = "1"
	AUDIT_LOGIN_FAILED        = "2"
	AUDIT_LOGIN_POLICY_DENIAL = "3"
	AUDIT_INVALID_JWT         = "4"
	AUDIT_OBJECT_GET          = "21"
	AUDIT_OBJECT_PUT          = "22"
	// Tree events
	AUDIT_NODE_CREATE = "11"
	AUDIT_NODE_READ   = "12"
	AUDIT_NODE_LIST   = "13"
	AUDIT_NODE_UPDATE = "14"
	AUDIT_NODE_DELETE = "15"
	AUDIT_WS_CREATE   = "16"
	AUDIT_WS_UPDATE   = "17"
	AUDIT_WS_DELETE   = "18"
	// Users, Group, Roles
	AUDIT_USER_CREATE  = "41"
	AUDIT_USER_READ    = "42"
	AUDIT_USER_UPDATE  = "43"
	AUDIT_USER_DELETE  = "44"
	AUDIT_GROUP_CREATE = "46"
	AUDIT_GROUP_READ   = "47"
	AUDIT_GROUP_UPDATE = "48"
	AUDIT_GROUP_DELETE = "49"
	AUDIT_ROLE_CREATE  = "51"
	AUDIT_ROLE_READ    = "52"
	AUDIT_ROLE_UPDATE  = "53"
	AUDIT_ROLE_DELETE  = "54"
	// POLICIES
	AUDIT_POLICY_GROUP_STORE  = "61"
	AUDIT_POLICY_GROUP_DELETE = "62"
	AUDIT_POLICY_STORE        = "63"
	AUDIT_POLICY_DELETE       = "64"
	// ShareLinks And Cells
	AUDIT_CELL_CREATE = "71"
	AUDIT_CELL_READ   = "72"
	AUDIT_CELL_UPDATE = "73"
	AUDIT_CELL_DELETE = "74"
	AUDIT_LINK_CREATE = "75"
	AUDIT_LINK_READ   = "76"
	AUDIT_LINK_UPDATE = "77"
	AUDIT_LINK_DELTE  = "78"

	// CONTEXT
	KEY_CONTEXT          = "Context"
	KEY_SPAN_UUID        = "SpanUuid"
	KEY_SPAN_PARENT_UUID = "SpanParentUuid"
	KEY_SPAN_ROOT_UUID   = "SpanRootUuid"

	// NODE
	KEY_NODE      = "Node"
	KEY_NODE_UUID = "NodeUuid"
	KEY_NODE_PATH = "NodePath"

	KEY_WORKSPACE       = "Workspace"
	KEY_WORKSPACE_UUID  = "WorkspaceUuid"
	KEY_WORKSPACE_SCOPE = "WorkspaceScope"

	KEY_CHANGE_LOG        = "ChangeLog"
	KEY_NODE_CHANGE_EVENT = "NodeChangeEvent"
	KEY_VERSIONING_POLICY = "VersioningPolicy"

	KEY_ACTIVITY_SUBSCRIPTION   = "ActivitySubscription"
	KEY_ACTIVITY_STREAM_REQUEST = "StreamActivitiesRequest"
	KEY_ACTIVITY_POST_EVENT     = "PostActivityEvent"
	KEY_ACTIVITY_OBJECT         = "ActivityObject"

	// USERS & IDM
	KEY_ROLE      = "Role"
	KEY_ROLE_UUID = "RoleUuid"
	KEY_ROLES     = "Roles"
	KEY_PROFILE   = "Profile"

	KEY_USER      = "User"
	KEY_USERNAME  = "UserName"
	KEY_USER_UUID = "UserUuid"

	KEY_GROUP_PATH = "GroupPath"

	KEY_CONNECTOR = "Connector"

	// Should be ACL and ACLID if we use proto names, changed to stay homogeneous with the other fields
	KEY_ACL    = "Acl"
	KEY_ACL_ID = "AclId"
	// Pydio internal merged representation of all ACLs that a user has access to
	KEY_ACCESS_LIST = "AccessList"

	KEY_POLICY_GROUP      = "PolicyGroup"
	KEY_POLICY_GROUP_UUID = "PolicyGroupUuid"
	KEY_POLICY            = "Policy"
	KEY_POLICY_ID         = "PolicyId"
	KEY_POLICY_REQUEST    = "PolicyRequest"

	// JOB
	KEY_JOB    = "Job"
	KEY_JOB_ID = "JobId"

	KEY_ACTION    = "Action"
	KEY_ACTION_ID = "ActionId"

	KEY_TASK    = "Task"
	KEY_TASK_ID = "TaskId"

	// CELLS
	KEY_CELL      = "Cell"
	KEY_CELL_UUID = "CellUuid"
	KEY_LINK      = "ShareLink"
	KEY_LINK_UUID = "ShareLinkUuid"

	// CHAT
	KEY_CHAT_ROOM          = "ChatRoom"
	KEY_CHAT_LIST_ROOM_REQ = "ChatListRoomRequest"
	KEY_CHAT_LIST_MSG_REQ  = "ChatListMsgRequest"
	KEY_CHAT_POST_MSG_REQ  = "ChatPostMsgRequest"

	// FRONT LOGS
	KEY_FRONT_IP      = "FrontIp"
	KEY_FRONT_USERID  = "UserId"
	KEY_FRONT_WKSID   = "WorkspaceId"
	KEY_FRONT_SOURCE  = "Source"
	KEY_FRONT_PREFIX  = "Prefix"
	KEY_FRONT_MESSAGE = "Message"
	KEY_FRONT_NODES   = "Nodes"
)

Variables ¶

View Source

var (
	// Will be initialized by main
	PackageType  string
	PackageLabel string

	BuildStamp    string
	BuildRevision string

	// Update Server Default values
	UpdateDefaultChannel   = "stable"
	UpdateDefaultServerUrl = "https://updatecells.pydio.com/"
	UpdateDefaultPublicKey = `` /* 424-byte string literal not displayed */

	// Logging Levels
	LogConfig        LogConfigType
	LogLevel         zapcore.Level
	LogCaptureStdOut bool

	ServicesDiscovery = []string{SERVICE_CONSUL, SERVICE_NATS}
	// Profiles order reflects the level of authorizations
	PydioUserProfiles = []string{
		PYDIO_PROFILE_ANON,
		PYDIO_PROFILE_SHARED,
		PYDIO_PROFILE_STANDARD,
		PYDIO_PROFILE_ADMIN,
	}
)

View Source

var (
	LogEventLabels = map[string]string{
		AUDIT_LOGIN_SUCCEED: "Login succeed",
		AUDIT_LOGIN_FAILED:  "Login failed",
		AUDIT_NODE_CREATE:   "Create Node",
		AUDIT_NODE_READ:     "Read Node",
		AUDIT_NODE_LIST:     "List Node",
		AUDIT_NODE_UPDATE:   "Upadate Node",
		AUDIT_NODE_DELETE:   "Delete Node",
		AUDIT_OBJECT_GET:    "Get Object",
		AUDIT_OBJECT_PUT:    "Put Object",
	}
)

Functions ¶

func Version ¶

func Version() *hashiversion.Version

Types ¶

type Converter ¶

type Converter interface {
	Convert(*any.Any) (string, bool)
}

Converter interface

type LogConfigType ¶

type LogConfigType string

type Manager ¶

type Manager interface {
	Get(string) interface{}
	Set(string, interface{}) error
	Del(string) error
	Map(string) map[string]interface{}
}

Manager interface

type ServiceName ¶

type ServiceName string

type ServiceTag ¶

type ServiceTag string

type ServiceType ¶

type ServiceType string

Source Files ¶

View all Source files

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
auth Package auth provides tools related to authentication of pydio services	Package auth provides tools related to authentication of pydio services
claim Package claim wraps the JWT claims with util functions	Package claim wraps the JWT claims with util functions
dex Package dex provides specific connectors for the CoreOS/Dex implementation of OpenID Connect protocol	Package dex provides specific connectors for the CoreOS/Dex implementation of OpenID Connect protocol
boltdb Package BoltDB provides tools for using Bolt as a standard persistence layer for services	Package BoltDB provides tools for using Bolt as a standard persistence layer for services
config Package configs provides tools for managing configurations	Package configs provides tools for managing configurations
envvar Package envvar implements Pydio specific interface for dynamic configurations that are backed by OS environment variables.	Package envvar implements Pydio specific interface for dynamic configurations that are backed by OS environment variables.
file
remote Package source implements a configuration client backed by a config server	Package source implements a configuration client backed by a config server
crypto Package crypto provides tools for data encryption and certificates management	Package crypto provides tools for data encryption and certificates management
dao Package dao provides abstraction of persistence layer used by pydio services.	Package dao provides abstraction of persistence layer used by pydio services.
event Package event wraps protobuf events to add context information	Package event wraps protobuf events to add context information
forms Package forms provides utility methods to generate XML that is interpreted by the Front End to build forms.	Package forms provides utility methods to generate XML that is interpreted by the Front End to build forms.
log Package log define and configure the Pydio loggers based on zap.	Package log define and configure the Pydio loggers based on zap.
mocks Package mocks should provide utils used by tests to mock various layers.	Package mocks should provide utils used by tests to mock various layers.
proto ## Protobuf Definitions This folder contains all Protobufs used by services to communicate	## Protobuf Definitions This folder contains all Protobufs used by services to communicate
activity Package activity is a generated protocol buffer package.	Package activity is a generated protocol buffer package.
auth Package auth is a generated protocol buffer package.	Package auth is a generated protocol buffer package.
cert Package cert is a generated protocol buffer package.	Package cert is a generated protocol buffer package.
chat Package chat is a generated protocol buffer package.	Package chat is a generated protocol buffer package.
ctl Package ctl is a generated protocol buffer package.	Package ctl is a generated protocol buffer package.
docstore Package docstore is a generated protocol buffer package.	Package docstore is a generated protocol buffer package.
encryption Package encryption is a generated protocol buffer package.	Package encryption is a generated protocol buffer package.
idm Package idm is a generated protocol buffer package.	Package idm is a generated protocol buffer package.
install Package install is a generated protocol buffer package.	Package install is a generated protocol buffer package.
jobs Package jobs is a generated protocol buffer package.	Package jobs is a generated protocol buffer package.
log Package log is a generated protocol buffer package.	Package log is a generated protocol buffer package.
mailer Package mailer is a generated protocol buffer package.	Package mailer is a generated protocol buffer package.
object Package object is a generated protocol buffer package.	Package object is a generated protocol buffer package.
rest Package rest is a generated protocol buffer package.	Package rest is a generated protocol buffer package.
rest/cmd Package cmd provides a specific tool for transforming json swagger file into a go file	Package cmd provides a specific tool for transforming json swagger file into a go file
sync Package sync is a generated protocol buffer package.	Package sync is a generated protocol buffer package.
tree Package tree is a generated protocol buffer package.	Package tree is a generated protocol buffer package.
update Package update is a generated protocol buffer package.	Package update is a generated protocol buffer package.
registry Package registry provides the main glue between services It wraps micro registry (running services declared to the discovery server) into a more generic registry where all actual plugins are self-declared.	Package registry provides the main glue between services It wraps micro registry (running services declared to the discovery server) into a more generic registry where all actual plugins are self-declared.
service Package service acts as a factory for all Pydio services.	Package service acts as a factory for all Pydio services.
context Package servicecontext performs context values read/write, generally through server or client wrappers	Package servicecontext performs context values read/write, generally through server or client wrappers
defaults Package defaults initializes the defaults GRPC clients and servers used by services	Package defaults initializes the defaults GRPC clients and servers used by services
frontend Package frontend provides tools to publish static data from within any micro service It implements a simple Union HttpFS to be exposed by a standard net.HttpFileServer interface.	Package frontend provides tools to publish static data from within any micro service It implements a simple Union HttpFS to be exposed by a standard net.HttpFileServer interface.
proto Package service is a generated protocol buffer package.	Package service is a generated protocol buffer package.
resources Package resources provides extendable service Handler for managing resource-policy based data.	Package resources provides extendable service Handler for managing resource-policy based data.
sql Package sql provides tools and DAOs for speaking SQL as well as managing tables migrations	Package sql provides tools and DAOs for speaking SQL as well as managing tables migrations
index Package index provides ready-to-use tables and DAOs for storing hierarchical data using the nested sets pattern * Copyright (c) 2018.	Package index provides ready-to-use tables and DAOs for storing hierarchical data using the nested sets pattern * Copyright (c) 2018.
resources Package resources provides ready-to-use SQL schemes and DAOs for attaching resource policies to any data	Package resources provides ready-to-use SQL schemes and DAOs for attaching resource policies to any data
utils Package utils provides swiss-knife tools for all services	Package utils provides swiss-knife tools for all services
views Package views provides high-level clients for talking to the main data tree in certain context.	Package views provides high-level clients for talking to the main data tree in certain context.