lancommander-ref/LANCommander
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #385 from aaronpowell/download-files-from-new-data-path

Browse source 
Download endpoints get correct paths
This commit is contained in:
Pat Hartl 2025-12-19 01:11:10 -06:00 • committed by GitHub
commit 9b3e154eaa
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 90 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

5
LANCommander.Server.Services/ArchiveService.cs
View file

@ -13,6 +13,7 @@ using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Logging;
using Microsoft.EntityFrameworkCore;
using PascalCaseNamingConvention = YamlDotNet.Serialization.NamingConventions.PascalCaseNamingConvention;
using LANCommander.SDK;
namespace LANCommander.Server.Services
{
@ -51,7 +52,9 @@ namespace LANCommander.Server.Services
storageLocationPath = storageLocation.Path;
}
return Path.Combine(storageLocationPath, archive.ObjectKey);
return Path.IsPathRooted(storageLocationPath) ?
Path.Combine(storageLocationPath, archive.ObjectKey) :
Path.Combine(AppPaths.GetConfigDirectory(), storageLocationPath, archive.ObjectKey);
}
public async Task<string> GetArchiveFileLocationAsync(string objectKey)

10
LANCommander.Server.Services/GameSaveService.cs
View file

@ -7,6 +7,7 @@ using Microsoft.AspNetCore.Http;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Logging;
using ZiggyCreatures.Caching.Fusion;
using LANCommander.SDK;
namespace LANCommander.Server.Services
{
@ -46,7 +47,7 @@ namespace LANCommander.Server.Services
await base.DeleteAsync(entity);
}
public async Task<string> GetSavePathAsync(Guid gameId, Guid userId)
public async Task<string?> GetSavePathAsync(Guid gameId, Guid userId)
{
var save = await SortBy(gs => gs.CreatedOn, Data.Enums.SortDirection.Descending).FirstOrDefaultAsync(gs => gs.GameId == gameId && gs.UserId == userId);
@ -56,7 +57,7 @@ namespace LANCommander.Server.Services
return GetSavePath(save);
}
public async Task<string> GetSavePathAsync(Guid id)
public async Task<string?> GetSavePathAsync(Guid id)
{
// Use get with predicate to avoid async
var save = await FirstOrDefaultAsync(gs => gs.Id == id);
@ -69,7 +70,10 @@ namespace LANCommander.Server.Services
public string GetSavePath(GameSave save)
{
return Path.Combine(save.StorageLocation.Path, save.UserId.ToString(), save.GameId.ToString(), $"{save.Id}");
var gameId = save.GameId ?? throw new InvalidOperationException($"No game ID is available for save {save.Id}");
return Path.IsPathRooted(save.StorageLocation.Path) ?
Path.Combine(save.StorageLocation.Path, save.UserId.ToString(), gameId.ToString(), $"{save.Id}") :
Path.Combine(AppPaths.GetConfigDirectory(), save.StorageLocation.Path, save.UserId.ToString(), gameId.ToString(), $"{save.Id}");
}
public async Task<StorageLocation> GetDefaultStorageLocationAsync()

2
LANCommander.Server.Services/Helpers/FileHelpers.cs
View file

@ -2,7 +2,7 @@
{
public static class FileHelpers
{
public static void DeleteIfExists(string path)
public static void DeleteIfExists(string? path)
{
if (File.Exists(path))
File.Delete(path);

20
LANCommander.Server.Services/UpdateService.cs
View file

@ -5,16 +5,12 @@ using Semver;
using System.Diagnostics;
using System.IO.Compression;
using System.Net;
using System.Reflection;
using System.Runtime.InteropServices;
using AutoMapper;
using LANCommander.Server.Services.Abstractions;
using LANCommander.Server.Services.Enums;
using LANCommander.Server.Services.Exceptions;
using LANCommander.Server.Services.Models;
using LANCommander.Server.Settings.Enums;
using Microsoft.Extensions.DependencyInjection;
using ZiggyCreatures.Caching.Fusion;
using LANCommander.SDK;
namespace LANCommander.Server.Services
{
@ -269,15 +265,13 @@ namespace LANCommander.Server.Services
applicationLifetime.StopApplication();
}
public string GetLauncherFileLocation(LauncherArtifact artifact)
{
return GetLauncherFileLocation(artifact.Name);
}
public string GetLauncherFileLocation(LauncherArtifact artifact) =>
GetLauncherFileLocation(artifact.Name);
public string GetLauncherFileLocation(string objectKey)
{
return Path.Combine(_settingsProvider.CurrentValue.Server.Launcher.StoragePath, objectKey);
}
public string GetLauncherFileLocation(string objectKey) =>
Path.IsPathRooted(_settingsProvider.CurrentValue.Server.Launcher.StoragePath) ?
Path.Combine(_settingsProvider.CurrentValue.Server.Launcher.StoragePath, objectKey) :
Path.Combine(AppPaths.GetConfigDirectory(), _settingsProvider.CurrentValue.Server.Launcher.StoragePath, objectKey);
public LauncherArtifact GetLauncherArtifact(string objectKey)
{

93
LANCommander.Server/Endpoints/DownloadEndpoints.cs
View file

@ -1,8 +1,8 @@
using System.Net.Mime;
using System.Security.Claims;
using LANCommander.SDK.Services;
using LANCommander.Server.Services;
using LANCommander.Server.Services.Extensions;
using Microsoft.AspNetCore.Http.HttpResults;
using Microsoft.AspNetCore.Mvc;
namespace LANCommander.Server.Endpoints;
@ -18,76 +18,125 @@ public static class DownloadEndpoints
group.MapGet("/Launcher/{objectKey}", DownloadLauncherAsync);
}
internal static async Task<IResult> DownloadArchiveAsync(
internal static async Task<Results<NotFound, FileStreamHttpResult>> DownloadArchiveAsync(
Guid id,
[FromServices] ArchiveService archiveService)
[FromServices] ArchiveService archiveService,
[FromServices] ILoggerFactory loggerFactory)
{
var logger = loggerFactory.CreateLogger(nameof(DownloadEndpoints));
logger.LogInformation("Attempting to download archive with ID: {ArchiveId}", id);
var archive = await archiveService
.Include(a => a.Game)
.Include(a => a.Redistributable)
.Include(a => a.Game!)
.Include(a => a.Redistributable!)
.GetAsync(id);
if (archive == null)
{
logger.LogWarning("Archive with ID {ArchiveId} not found", id);
return TypedResults.NotFound();
var fileName = await archiveService.GetArchiveFileLocationAsync(archive);
}
var fileName = await archiveService.GetArchiveFileLocationAsync(archive);
if (!File.Exists(fileName))
{
logger.LogWarning("Archive file not found at path: {FilePath} for archive ID {ArchiveId}", fileName, id);
return TypedResults.NotFound();
}
string name = "";
if (archive.Game != null)
{
name = $"{archive.Game.Title.SanitizeFilename()}.zip";
logger.LogInformation("Serving game archive {GameTitle} (ID: {ArchiveId})", archive.Game.Title, id);
}
else if (archive.Redistributable != null)
{
name = $"{archive.Redistributable.Name.SanitizeFilename()}.zip";
logger.LogInformation("Serving redistributable archive {RedistName} (ID: {ArchiveId})", archive.Redistributable.Name, id);
}
return TypedResults.File(new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.Read), fileDownloadName: name, contentType: MediaTypeNames.Application.Octet);
}
internal static async Task<IResult> DownloadSaveAsync(
internal static async Task<Results<UnauthorizedHttpResult, NotFound, FileStreamHttpResult>> DownloadSaveAsync(
Guid id,
ClaimsPrincipal user,
[FromServices] GameSaveService gameSaveService)
[FromServices] GameSaveService gameSaveService,
[FromServices] ILoggerFactory loggerFactory)
{
var logger = loggerFactory.CreateLogger(nameof(DownloadEndpoints));
logger.LogInformation("Attempting to download save with ID: {SaveId}", id);
var save = await gameSaveService
.Include(s => s.Game)
.Include(s => s.User)
.GetAsync(id);
.Include(s => s.Game!)
.Include(s => s.User!)
.GetAsync(id);
if (user == null || user.Identity?.Name != save.User?.UserName && !user.IsInRole(RoleService.AdministratorRoleName))
{
logger.LogWarning("Unauthorized access attempt for save {SaveId} by user {UserName}", id, user?.Identity?.Name);
return TypedResults.Unauthorized();
}
if (save == null)
{
logger.LogWarning("Save with ID {SaveId} not found", id);
return TypedResults.NotFound();
}
var fileName = gameSaveService.GetSavePath(save);
var fileName = gameSaveService.GetSavePath(save);
if (!File.Exists(fileName))
{
logger.LogWarning("Save file not found at path: {FilePath}", fileName);
return TypedResults.NotFound();
}
var name =
$"{save.User?.UserName} - {(save.Game != null ? "Unknown" : save.Game?.Title)} - {save.CreatedOn.ToString("MM-dd-yyyy.hh-mm")}.zip";
$"{save.User?.UserName} - {(save.Game != null ? "Unknown" : save.Game?.Title)} - {save.CreatedOn:MM-dd-yyyy.hh-mm}.zip";
logger.LogInformation("Successfully serving save file {FileName} for user {UserName}", name, save.User?.UserName);
return TypedResults.File(new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.Read), fileDownloadName: name, contentType: MediaTypeNames.Application.Zip);
}
internal static IResult DownloadLauncherAsync(
internal static Results<NotFound, BadRequest<string>, FileStreamHttpResult> DownloadLauncherAsync(
string objectKey,
ClaimsPrincipal user,
[FromServices] UpdateService updateService)
[FromServices] UpdateService updateService,
[FromServices] ILoggerFactory loggerFactory)
{
var logger = loggerFactory.CreateLogger(nameof(DownloadEndpoints));
logger.LogInformation("Attempting to download launcher file with object key: {ObjectKey}", objectKey);
if (string.IsNullOrEmpty(objectKey))
{
logger.LogWarning("Empty object key provided for launcher download");
return TypedResults.NotFound();
}
if (objectKey.Contains("..") || objectKey.Contains(Path.AltDirectorySeparatorChar) || objectKey.Contains(Path.DirectorySeparatorChar))
{
logger.LogWarning("Invalid object key provided (potential path traversal attempt): {ObjectKey}", objectKey);
return TypedResults.BadRequest("Bad object key provided.");
}
var fileName = updateService.GetLauncherFileLocation(objectKey);
var file = new FileInfo(fileName);
if (!file.Exists)
{
logger.LogWarning("Launcher file not found at path: {FilePath} for object key: {ObjectKey}", fileName, objectKey);
return TypedResults.NotFound();
}
logger.LogInformation("Successfully serving launcher file {FileName} for object key {ObjectKey}", file.Name, objectKey);
return TypedResults.File(new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.Read), fileDownloadName: file.Name, contentType: MediaTypeNames.Application.Octet);
}