olcxjas-softworks/LarpixServer
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

massive security update
All checks were successful
Server Build / publish (push) Successful in 29s
Details
Voice Build / publish (push) Successful in 25s
Details

Browse source
This commit is contained in:
olcxja 2026-08-24 19:22:38 +02:00
commit 6dc145a2c8
11 changed files with 739 additions and 225 deletions
Download patch file Download diff file Expand all files Collapse all files

27
LarpixServer/Program.cs
View file

@ -1,3 +1,4 @@
using System.Collections.Concurrent;
using System.Text;
using System.Text.Json;
using LarpixServer.Account;
@ -33,6 +34,12 @@ public class Program
{
if (entry.Value.resetAt <= nowSec) VoiceAuthLimits.TryRemove(entry.Key, out _);
}
//prune pozostałych rate limitów (okna 60s)
PruneRateLimits(AuthRateLimits, nowSec);
PruneRateLimits(NonceRateLimits, nowSec);
PruneRateLimits(KdfSaltRateLimits, nowSec);
PruneRateLimits(AccountInitRateLimits, nowSec);
LarpixServer.Account.Requests.PruneActionRateLimits(nowSec);
}
});
@ -44,7 +51,7 @@ public class Program
{
serverOptions.AddServerHeader = false;
serverOptions.ListenAnyIP(PORT);
serverOptions.Limits.MaxRequestBodySize = null;
serverOptions.Limits.MaxRequestBodySize = MAX_BODY_SIZE;
});
var app = builder.Build();
@ -98,6 +105,7 @@ public class Program
context.Response.Headers["Access-Control-Allow-Origin"] = "*";
context.Response.Headers["Access-Control-Allow-Headers"] = "*";
context.Response.Headers["Access-Control-Allow-Methods"] = "*";
if (context.Request.Method.ToUpper() == "OPTIONS")
{
context.Response.StatusCode = 200;
@ -252,9 +260,9 @@ public class Program
case "/_larpix/group/attachment/get":
await Account.Requests.GetGroupAttachment(context, next, query);
return;
case "/_larpix/federation":
await Federation.Receiver.FederationRequest(context, next, query, reader);
return;
//case "/_larpix/federation": //federation wylaczona (brak uwierzytelnienia miedzyserwerowego)
// await Federation.Receiver.FederationRequest(context, next, query, reader);
// return;
case "/_larpix/user/key/getpublic":
await Account.Requests.GetUserPublicKey(context, next, query, reader);
return;
@ -264,6 +272,9 @@ public class Program
case "/_larpix/group/storage/public/getentry":
await Account.Requests.GetGroupPublicStorageEntry(context, next, query, reader);
return;
case "/_larpix/kdfsalt":
await Account.Requests.GetKdfSalt(context, query);
return;
}
}
catch (Exception ex)
@ -280,4 +291,12 @@ public class Program
Console.WriteLine("Starting server at port: " + PORT);
app.Run();
}
private static void PruneRateLimits(ConcurrentDictionary<string, (int count, long resetAt)> store, long nowSec)
{
foreach (var entry in store)
{
if (entry.Value.resetAt <= nowSec) store.TryRemove(entry.Key, out _);
}
}
}