feat: enhance authentication flow with 2FA setup and validation improvements

Author: dogukanoksuz

app/Http/Controllers/API/AuthController.php

@@ -142,9 +142,11 @@ public function login(Request $request)
 
             if (auth('api')->user()->google2fa_secret == null) {
                 $secret = $tfa->generateSecretKey();
+                auth('api')->user()->update([
+                    'google2fa_secret' => $secret,
+                ]);
                 return response()->json([
                     'message' => 'İki faktörlü doğrulama için Google Authenticator uygulaması ile QR kodunu okutunuz.',
-                    'secret' => $secret,
                     'image' => $tfa->getQRCodeInline(
                         "Liman",
                         auth('api')->user()->email,
@@ -184,7 +186,7 @@ public function setupTwoFactorAuthentication(Request $request)
         $validator = Validator::make($request->all(), [
             'email' => 'required|string',
             'password' => 'required|string',
-            'secret' => 'required'
+            'token' => 'required|string',
         ]);
 
         if ($validator->fails()) {
@@ -200,17 +202,26 @@ public function setupTwoFactorAuthentication(Request $request)
             return response()->json(['message' => 'Kullanıcı adı veya şifreniz yanlış.'], 401);
         }
 
-        $token = auth('api')->attempt([
+        $authToken = auth('api')->attempt([
             'email' => $user->email,
             'password' => $validator->validated()["password"],
         ]);
-        if (! $token) {
+        if (! $authToken) {
             return response()->json(['message' => 'Kullanıcı adı veya şifreniz yanlış.'], 401);
         }
 
-        User::find(auth('api')->user()->id)->update([
+        $authenticatedUser = auth('api')->user();
+        if (! $authenticatedUser->google2fa_secret) {
+            return response()->json(['message' => '2FA kurulum süreci başlatılmamış. Lütfen önce giriş yapınız.'], 422);
+        }
+
+        $tfa = app('pragmarx.google2fa');
+        if (! $tfa->verifyGoogle2FA($authenticatedUser->google2fa_secret, $request->token)) {
+            return response()->json(['message' => 'OTP doğrulama başarısız. QR kodunu tekrar okutup deneyiniz.'], 422);
+        }
+
+        $authenticatedUser->update([
             'otp_enabled' => true,
-            'google2fa_secret' => $request->secret
         ]);
 
         return response()->json(['message' => '2FA kurulumu başarıyla yapıldı.']);

app/Http/Controllers/API/ServerController.php

@@ -229,19 +229,55 @@ private function grantPermissions(Server $server)
      */
     public function checkAccess()
     {
-        if (request('port') == -1) {
+        validate([
+            'ip_address' => 'required|string|max:255',
+            'port' => 'required|integer|min:-1|max:65535',
+        ]);
+
+        $ip = request('ip_address');
+        $port = (int) request('port');
+
+        // Port -1 means no port check needed (portless server)
+        if ($port === -1) {
             return response()->json([
                 'message' => 'Sunucuya başarıyla erişim sağlandı.',
             ]);
         }
+
+        // Validate port range for actual connections
+        if ($port < 1) {
+            return response()->json(['port' => 'Geçersiz port numarası.'], 422);
+        }
+
+        // Resolve hostname to IP for validation
+        $resolvedIp = $ip;
+        if (! filter_var($ip, FILTER_VALIDATE_IP)) {
+            $resolvedIp = gethostbyname($ip);
+            if ($resolvedIp === $ip) {
+                return response()->json(['ip_address' => 'Sunucu adresi çözümlenemedi.'], 422);
+            }
+        }
+
+        // Block metadata endpoints and cloud-internal addresses (169.254.x.x link-local)
+        if (filter_var($resolvedIp, FILTER_VALIDATE_IP) && str_starts_with($resolvedIp, '169.254.')) {
+            return response()->json(['ip_address' => 'Link-local adresleri kullanılamaz.'], 422);
+        }
+
+        // Restrict to safe port range — block well-known internal service ports
+        $blockedPorts = [6379, 11211, 27017, 9200, 9300, 2379, 5432, 3306];
+        if (in_array($port, $blockedPorts)) {
+            return response()->json(['port' => 'Bu port numarası güvenlik nedeniyle engellenmiştir.'], 422);
+        }
+
         $status = @fsockopen(
-            request('ip_address'),
-            request('port'),
+            $ip,
+            $port,
             $errno,
             $errstr,
             intval(config('liman.server_connection_timeout')) / 1000
         );
         if (is_resource($status)) {
+            fclose($status);
             return response()->json([
                 'message' => 'Sunucuya başarıyla erişim sağlandı.',
             ]);

app/Http/Controllers/API/Settings/MailController.php

@@ -36,13 +36,24 @@ public function getConfiguration()
     public function saveConfiguration(Request $request)
     {
         validate([
-            'host' => 'required|string',
-            'port' => 'required|integer',
-            'username' => 'required|string',
-            'password' => 'nullable|string',
-            'encryption' => 'required|string',
+            'host' => 'required|string|max:255',
+            'port' => 'required|integer|min:1|max:65535',
+            'username' => 'required|string|max:255',
+            'password' => 'nullable|string|max:255',
+            'encryption' => 'required|string|in:tls,ssl,null',
         ]);
 
+        $fields = ['host', 'username', 'password', 'encryption'];
+        foreach ($fields as $field) {
+            if ($request->has($field) && $request->$field !== null) {
+                if (preg_match('/[\n\r]/', $request->$field)) {
+                    return response()->json([
+                        'message' => 'Geçersiz karakter tespit edildi.',
+                    ], 422);
+                }
+            }
+        }
+
         setEnv([
             'MAIL_ENABLED' => (bool) $request->active,
             'MAIL_HOST' => $request->host,

app/Http/Controllers/API/Settings/VaultController.php

@@ -151,6 +151,12 @@ public function delete(Request $request)
         if (! $first) {
             return response()->json(['status' => false], 404);
         }
+
+        // Ownership check: only admins or the owner can delete
+        if (! auth('api')->user()->isAdmin() && auth('api')->user()->id != $first->user_id) {
+            return response()->json(['status' => false, 'message' => 'Bu kayıt üzerinde yetkiniz bulunmamaktadır.'], 403);
+        }
+
         if (
             $first->name == 'clientUsername' ||
             $first->name == 'clientPassword'

app/Http/Helpers.php

@@ -721,6 +721,12 @@ function setEnv(array $values): bool
 
         $editor = $editor->load(base_path('.env'));
         foreach ($values as $key => $value) {
+            if (is_string($key) && preg_match('/[\n\r]/', $key)) {
+                return false;
+            }
+            if (is_string($value) && preg_match('/[\n\r]/', $value)) {
+                return false;
+            }
             $editor->set($key, $value);
         }
         try {

app/Http/Middleware/TusAuthenticated.php

@@ -2,6 +2,7 @@
 
 namespace App\Http\Middleware;
 
+use App\Models\Permission;
 use Illuminate\Support\Facades\Log;
 use Symfony\Component\HttpKernel\Exception\UnauthorizedHttpException;
 use TusPhp\Middleware\TusMiddleware;
@@ -22,10 +23,20 @@ class TusAuthenticated implements TusMiddleware
      */
     public function handle(Request $request, Response $response)
     {
+        // 1. Check if already authenticated via JWT Authorization header
         if (auth('api')->check()) {
+            $this->checkExtensionPermission();
             return;
         }
 
+        // 2. Check session/cookie-based auth (web guard)
+        if (auth('web')->check()) {
+            auth('api')->login(auth('web')->user());
+            $this->checkExtensionPermission();
+            return;
+        }
+
+        // 3. Try Extension-Token (JWT from sandbox customRequestData['token'])
         $token = "";
         if (request()->token) {
             $token = request()->token;
@@ -34,14 +45,52 @@ public function handle(Request $request, Response $response)
         }
 
         if (! $token) {
-            if (auth('api')->check()) {
-                return true;
+            // 4. Try cookie-based JWT (web middleware group doesn't run CookieJWTAuthenticator)
+            if (request()->hasCookie('token')) {
+                request()->headers->set('Authorization', 'Bearer ' . request()->cookie('token'));
+                if (auth('api')->check()) {
+                    $this->checkExtensionPermission();
+                    return;
+                }
             }
 
             throw new UnauthorizedHttpException('', 'Extension-Token header is missing.');
         }
 
-        Log::info('Extension-Token is valid. User ip: ' . request()->ip);
+        // Validate the JWT token
+        try {
+            request()->headers->set('Authorization', 'Bearer ' . $token);
+            if (! auth('api')->check()) {
+                throw new UnauthorizedHttpException('', 'Invalid Extension-Token.');
+            }
+        } catch (\Exception $e) {
+            throw new UnauthorizedHttpException('', 'Invalid Extension-Token.');
+        }
+
+        $this->checkExtensionPermission();
+
+        Log::info('Extension-Token validated for user ' . auth('api')->user()->id . '. IP: ' . request()->ip());
         return true;
     }
+
+    /**
+     * Check if the authenticated user has permission to upload to the specified extension
+     */
+    private function checkExtensionPermission(): void
+    {
+        $extensionId = request()->headers->get('extension-id');
+
+        if (! $extensionId) {
+            return;
+        }
+
+        $user = auth('api')->user();
+        if (! $user) {
+            return;
+        }
+
+        if (! Permission::can($user->id, 'extension', 'id', $extensionId)) {
+            throw new UnauthorizedHttpException('', 'You do not have permission to upload to this extension.');
+        }
+    }
 }

storage/VERSION

@@ -1 +1 @@
-2.2.1
+2.2.2