Merge hotfix/v2.0.2 into master

common/ASC.Api.Core/ASC.Api.Core.csproj

@@ -26,8 +26,8 @@
     <PackageReference Include="Microsoft.Extensions.Hosting.Systemd" Version="7.0.0" />
     <PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="7.0.1" />
     <PackageReference Include="NLog.Web.AspNetCore" Version="5.3.5" />
-    <PackageReference Include="RedisRateLimiting" Version="1.0.12" />
-    <PackageReference Include="RedisRateLimiting.AspNetCore" Version="1.0.9" />
+    <PackageReference Include="RedisRateLimiting" Version="1.1.0" />
+    <PackageReference Include="RedisRateLimiting.AspNetCore" Version="1.1.0" />
     <PackageReference Include="StackExchange.Redis.Extensions.AspNetCore" Version="9.1.0" />
     <PackageReference Include="StackExchange.Redis.Extensions.Newtonsoft" Version="9.1.0" />
 	<PackageReference Include="Autofac.Extensions.DependencyInjection" Version="8.0.0" />

common/ASC.Api.Core/Core/BaseStartup.cs

@@ -104,14 +104,50 @@ public virtual void ConfigureServices(IServiceCollection services)
 
         services.AddRateLimiter(options =>
         {
+            bool EnableNoLimiter(IPAddress address)
+            {
+                var knownNetworks = _configuration.GetSection("core:hosting:rateLimiterOptions:knownNetworks").Get<List<String>>();
+                var knownIPAddresses = _configuration.GetSection("core:hosting:rateLimiterOptions:knownIPAddresses").Get<List<String>>();
+
+                if (knownIPAddresses is { Count: > 0 })
+                {
+                    foreach (var knownIPAddress in knownIPAddresses)
+                    {
+                        if (IPAddress.Parse(knownIPAddress).Equals(address)) return true;
+                    }
+                }
+
+                if (knownNetworks is { Count: > 0 })
+                {
+                    foreach (var knownNetwork in knownNetworks)
+                    {
+                        var prefix = IPAddress.Parse(knownNetwork.Split("/")[0]);
+                        var prefixLength = Convert.ToInt32(knownNetwork.Split("/")[1]);
+                        var ipNetwork = new IPNetwork(prefix, prefixLength);
+
+                        if (ipNetwork.Contains(address)) return true;
+                    }
+                }
+
+                return false;
+            }
+
+
             options.GlobalLimiter = PartitionedRateLimiter.CreateChained(
             PartitionedRateLimiter.Create<HttpContext, string>(httpContext =>
             {
                 var userId = httpContext?.User.Claims.FirstOrDefault(x => x.Type == ClaimTypes.Sid)?.Value;
 
+                var remoteIpAddress = httpContext?.Connection.RemoteIpAddress;
+
+                if (EnableNoLimiter(remoteIpAddress))
+                {
+                    return RateLimitPartition.GetNoLimiter("no_limiter");
+                }
+
                 if (userId == null)
                 {
-                    userId = httpContext?.Connection.RemoteIpAddress.ToInvariantString();
+                    userId = remoteIpAddress.ToInvariantString();
                 }
 
                 var permitLimit = 1500;
@@ -131,9 +167,16 @@ public virtual void ConfigureServices(IServiceCollection services)
                     string partitionKey;
                     int permitLimit;
 
+                    var remoteIpAddress = httpContext?.Connection.RemoteIpAddress;
+
+                    if (EnableNoLimiter(remoteIpAddress))
+                    {
+                        return RateLimitPartition.GetNoLimiter("no_limiter");
+                    }
+
                     if (userId == null)
                     {
-                        userId = httpContext?.Connection.RemoteIpAddress.ToInvariantString();
+                        userId = remoteIpAddress.ToInvariantString();
                     }
 
                     if (String.Compare(httpContext?.Request.Method, "GET", StringComparison.OrdinalIgnoreCase) == 0)
@@ -154,14 +197,21 @@ public virtual void ConfigureServices(IServiceCollection services)
                         QueueLimit = 0,
                         ConnectionMultiplexerFactory = () => connectionMultiplexer
                     });
-                }), 
+                }),
                 PartitionedRateLimiter.Create<HttpContext, string>(httpContext =>
                    {
                        var userId = httpContext?.User?.Claims.FirstOrDefault(x => x.Type == ClaimTypes.Sid)?.Value;
 
+                       var remoteIpAddress = httpContext?.Connection.RemoteIpAddress;
+
+                       if (EnableNoLimiter(remoteIpAddress))
+                       {
+                           return RateLimitPartition.GetNoLimiter("no_limiter");
+                       }
+
                        if (userId == null)
                        {
-                           userId = httpContext?.Connection.RemoteIpAddress.ToInvariantString();
+                           userId = remoteIpAddress.ToInvariantString();
                        }
 
                        var partitionKey = $"fw_post_put_{userId}";
@@ -187,6 +237,12 @@ public virtual void ConfigureServices(IServiceCollection services)
                 var userId = httpContext?.User?.Claims.FirstOrDefault(x => x.Type == ClaimTypes.Sid)?.Value;
                 var permitLimit = 5;
                 var partitionKey = $"sensitive_api_{userId}";
+                var remoteIpAddress = httpContext?.Connection.RemoteIpAddress;
+
+                if (EnableNoLimiter(remoteIpAddress))
+                {
+                    return RateLimitPartition.GetNoLimiter("no_limiter");
+                }
 
                 return RedisRateLimitPartition.GetSlidingWindowRateLimiter(partitionKey, _ => new RedisSlidingWindowRateLimiterOptions
                 {
@@ -254,10 +310,14 @@ public virtual void ConfigureServices(IServiceCollection services)
                                   policy =>
                                   {
                                       policy.WithOrigins(_corsOrigin)
-                                      .SetIsOriginAllowedToAllowWildcardSubdomains()
-                                      .AllowAnyHeader()
-                                      .AllowAnyMethod()
-                                      .AllowCredentials();
+                                            .SetIsOriginAllowedToAllowWildcardSubdomains()
+                                            .AllowAnyHeader()
+                                            .AllowAnyMethod();                                            
+
+                                      if (_corsOrigin != "*")
+                                      {
+                                          policy.AllowCredentials();
+                                      }
                                   });
             });
         }
@@ -411,7 +471,12 @@ public virtual void Configure(IApplicationBuilder app, IWebHostEnvironment env)
         app.UseAuthentication();
 
         // TODO: if some client requests very slow, this line will need to remove
-       // app.UseRateLimiter();
+        bool.TryParse(_configuration["core:hosting:rateLimiterOptions:enable"], out var enableRateLimiter);
+
+        if (enableRateLimiter)
+        {
+            app.UseRateLimiter();
+        }
 
         app.UseAuthorization();
 

common/ASC.Api.Core/Security/InvitationLinkHelper.cs

@@ -130,7 +130,7 @@ private async Task<ValidationResult> ValidateIndividualLinkAsync(string email, s
             return ValidationResult.Invalid;
         }
 
-        var visitMessage = await GetLinkVisitMessageAsync(email, key);
+        var visitMessage = await GetLinkVisitMessageAsync(user.TenantId, email, key);
 
         if (visitMessage == null)
         {
@@ -151,14 +151,14 @@ private async Task<ValidationResult> ValidateIndividualLinkAsync(string email, s
         return linkId == default ? (ValidationResult.Invalid, default) : (ValidationResult.Ok, linkId);
     }
 
-    private async Task<DbAuditEvent> GetLinkVisitMessageAsync(string email, string key)
+    private async Task<DbAuditEvent> GetLinkVisitMessageAsync(int tenantId, string email, string key)
     {
         await using var context = await _dbContextFactory.CreateDbContextAsync();
 
         var target = _messageTarget.Create(email);
         var description = JsonSerializer.Serialize(new[] { key });
 
-        var message = await Queries.AuditEventsAsync(context, target.ToString(), description);
+        var message = await Queries.AuditEventsAsync(context, tenantId, target.ToString(), description);
 
         return message;
     }
@@ -188,8 +188,9 @@ public class LinkValidationResult
 
 static file class Queries
 {
-    public static readonly Func<MessagesContext, string, string, Task<DbAuditEvent>> AuditEventsAsync =
+    public static readonly Func<MessagesContext, int, string, string, Task<DbAuditEvent>> AuditEventsAsync =
         EF.CompileAsyncQuery(
-            (MessagesContext ctx, string target, string description) =>
-                ctx.AuditEvents.FirstOrDefault(a => a.Target == target && a.DescriptionRaw == description));
+            (MessagesContext ctx, int tenantId, string target, string description) =>
+                ctx.AuditEvents.FirstOrDefault(a => 
+                    a.TenantId == tenantId && a.Action == (int)MessageAction.RoomInviteLinkUsed && a.Target == target && a.DescriptionRaw == description));
 }

common/ASC.Common/ASC.Common.csproj

@@ -59,7 +59,7 @@
     <PackageReference Include="NLog.Targets.Syslog" Version="7.0.0" />
     <PackageReference Include="NVelocity" Version="1.2.0" />
     <PackageReference Include="protobuf-net" Version="3.2.26" />
-    <PackageReference Include="RabbitMQ.Client" Version="6.6.0" />
+    <PackageReference Include="RabbitMQ.Client" Version="6.8.1" />
     <PackageReference Include="StackExchange.Redis" Version="2.6.122" />
     <PackageReference Include="StackExchange.Redis.Extensions.Core" Version="9.1.0" />
   </ItemGroup>

common/ASC.Common/Utils/TimeZoneConverter/TimeZoneConverter.cs

@@ -66,6 +66,18 @@ public string GetTimeZoneDisplayName(TimeZoneInfo tz)
         return displayName;
     }
 
+    public string GetIanaTimeZoneId(TimeZoneInfo timeZone)
+    {
+        if (timeZone.HasIanaId)
+        {
+            return timeZone.Id;
+        }
+
+        return TimeZoneInfo.TryConvertWindowsIdToIanaId(timeZone.Id, out var ianaTimeZoneId)
+            ? ianaTimeZoneId
+            : WindowsTzId2OlsonTzId(timeZone.Id);
+    }
+
     public string OlsonTzId2WindowsTzId(string olsonTimeZoneId, bool defaultIfNoMatch = true)
     {
         var mapZone = GetMapZoneByWindowsTzId(olsonTimeZoneId);

common/ASC.Core.Common/EF/Model/Tenant/DbQuota.cs

@@ -127,9 +127,18 @@ public static ModelBuilderWrapper AddDbQuota(this ModelBuilderWrapper modelBuild
                     Price = 0,
                     ProductId = null,
                     Visible = false
+                },
+                new DbQuota
+                {
+                    TenantId = -8,
+                    Name = "zoom",
+                    Description = null,
+                    Features = "free,total_size:107374182400,manager:100,room:100",
+                    Price = 0,
+                    ProductId = null,
+                    Visible = false
                 }
                 );
-
         return modelBuilder;
     }
 

common/ASC.Core.Common/Log/NotifyEngineLogger.cs

@@ -44,8 +44,8 @@ public static partial class NotifyEngineLogger
     [LoggerMessage(Level = LogLevel.Error, Message = "NotifySender")]
     public static partial void ErrorNotifySender(this ILogger<NotifySenderService> logger, Exception exception);
 
-    [LoggerMessage(Level = LogLevel.Error, Message = "Prepare")]
-    public static partial void ErrorPrepare(this ILogger logger, Exception exception);
+    [LoggerMessage(Level = LogLevel.Error, Message = "Prepare {action} {recipient}")]
+    public static partial void ErrorPrepare(this ILogger logger, Exception exception, INotifyAction action, IRecipient recipient);
 
     [LoggerMessage(Level = LogLevel.Error, Message = "UpdateScheduleDate")]
     public static partial void ErrorUpdateScheduleDate(this ILogger logger, Exception exception);

common/ASC.Core.Common/Notify/Engine/NotifyEngine.cs

@@ -213,7 +213,7 @@ private async Task<List<SendResponse>> SendDirectNotifyAsync(NotifyRequest reque
         catch (Exception ex)
         {
             responses.Add(new SendResponse(request.NotifyAction, null, request.Recipient, SendResult.Impossible));
-            _logger.ErrorPrepare(ex);
+            _logger.ErrorPrepare(ex, request.NotifyAction, request.Recipient);
         }
 
         if (request._senderNames is { Length: > 0 })

common/ASC.Data.Backup.Core/BackupAjaxHandler.cs

@@ -165,7 +165,8 @@ public async Task CheckAccessToFolderAsync<T>(T folderId)
     public async Task CreateScheduleAsync(BackupStorageType storageType, Dictionary<string, string> storageParams, int backupsStored, CronParams cronParams)
     {
         await DemandPermissionsBackupAsync();
-
+        await DemandPermissionsAutoBackupAsync();
+
         if (!SetupInfo.IsVisibleSettings("AutoBackup"))
         {
             throw new InvalidOperationException(Resource.ErrorNotAllowedOption);
@@ -238,7 +239,7 @@ public async Task<Schedule> GetScheduleAsync()
             schedule.StorageParams = consumer.AdditionalKeys.ToDictionary(r => r, r => consumer[r]);
             schedule.StorageParams.Add("module", "S3");
 
-            var Schedule = new CreateScheduleRequest
+            var scheduleRequest = new CreateScheduleRequest
             {
                 TenantId = await _tenantManager.GetCurrentTenantIdAsync(),
                 Cron = schedule.CronParams.ToString(),
@@ -247,7 +248,7 @@ public async Task<Schedule> GetScheduleAsync()
                 StorageParams = schedule.StorageParams
             };
 
-            await _backupService.CreateScheduleAsync(Schedule);
+            await _backupService.CreateScheduleAsync(scheduleRequest);
 
         }
         else if (response.StorageType != BackupStorageType.ThirdPartyConsumer)
@@ -314,37 +315,31 @@ public async Task StartRestoreAsync(string backupId, BackupStorageType storageTy
     public async Task<BackupProgress> GetRestoreProgressAsync()
     {
         var tenant = await _tenantManager.GetCurrentTenantAsync();
-        var result = _backupService.GetRestoreProgress(tenant.Id);
-
-        return result;
+
+        return _backupService.GetRestoreProgress(tenant.Id);
     }
 
-    public async Task DemandPermissionsRestoreAsync()
+    private async Task DemandPermissionsRestoreAsync()
     {
         await _permissionContext.DemandPermissionsAsync(SecurityConstants.EditPortalSettings);
 
         var quota = await _tenantManager.GetTenantQuotaAsync(await _tenantManager.GetCurrentTenantIdAsync());
-        if (!SetupInfo.IsVisibleSettings("Restore") ||
-            (!_coreBaseSettings.Standalone && !quota.AutoBackupRestore))
+        if (!SetupInfo.IsVisibleSettings("Restore") || (!_coreBaseSettings.Standalone && !quota.AutoBackupRestore))
         {
             throw new BillingException(Resource.ErrorNotAllowedOption, "Restore");
         }
 
-
-        if (!_coreBaseSettings.Standalone
-            && (!SetupInfo.IsVisibleSettings("Restore")
-                || !quota.AutoBackupRestore))
+        if (!_coreBaseSettings.Standalone && (!SetupInfo.IsVisibleSettings("Restore") || !quota.AutoBackupRestore))
         {
             throw new BillingException(Resource.ErrorNotAllowedOption, "Restore");
         }
     }
 
-    public async Task DemandPermissionsAutoBackupAsync()
+    private async Task DemandPermissionsAutoBackupAsync()
     {
         await _permissionContext.DemandPermissionsAsync(SecurityConstants.EditPortalSettings);
 
-        if (!SetupInfo.IsVisibleSettings("AutoBackup") ||
-            (!_coreBaseSettings.Standalone && !(await _tenantManager.GetTenantQuotaAsync(await _tenantManager.GetCurrentTenantIdAsync())).AutoBackupRestore))
+        if (!SetupInfo.IsVisibleSettings("AutoBackup") || !(await _tenantManager.GetTenantQuotaAsync(await _tenantManager.GetCurrentTenantIdAsync())).AutoBackupRestore)
         {
             throw new BillingException(Resource.ErrorNotAllowedOption, "AutoBackup");
         }

common/ASC.Data.Backup.Core/Tasks/BackupPortalTask.cs

@@ -123,26 +123,6 @@ private async Task DoDump(IDataWriteOperator writer)
     {
         var databases = new Dictionary<Tuple<string, string>, List<string>>();
 
-        try
-        {
-            await using var connection = DbFactory.OpenConnection();
-            var command = connection.CreateCommand();
-            command.CommandText = "select id, connection_string from mail_server_server";
-            ExecuteList(command).ForEach(r =>
-            {
-                var connectionString = GetConnectionString((int)r[0], JsonConvert.DeserializeObject<Dictionary<string, object>>(Convert.ToString(r[1]))["DbConnection"].ToString());
-
-                var command = connection.CreateCommand();
-                command.CommandText = "show tables";
-                var tables = ExecuteList(command).Select(r => Convert.ToString(r[0])).ToList();
-                databases.Add(new Tuple<string, string>(connectionString.Name, connectionString.ConnectionString), tables);
-            });
-        }
-        catch (Exception e)
-        {
-            _logger.ErrorWithException(e);
-        }
-
         await using (var connection = DbFactory.OpenConnection())
         {
             var command = connection.CreateCommand();
@@ -470,26 +450,24 @@ private void SaveToFile(string path, string t, IReadOnlyCollection<string> colum
 
                     for (var i = 0; i < obj.Length; i++)
                     {
-                        var value = obj[i];
-                        if (value is byte[] byteArray && byteArray.Length != 0)
+                        var byteArray = obj[i] as byte[];
+                        if (byteArray != null && byteArray.Length != 0)
                         {
                             sw.Write("0x");
                             foreach (var b in byteArray)
-                            {
                                 sw.Write("{0:x2}", b);
-                            }
                         }
                         else
                         {
                             var s = obj[i] as string;
                             if (s != null)
                             {
-                                sw.Write("'" + s.Replace("\r", "\\r").Replace("\n", "\\n") + "'");
+                                sw.Write("'" + s.Replace("\\", "\\\\").Replace("\r", "\\r").Replace("'", "\\'").Replace("\n", "\\n") + "'");
                             }
                             else
                             {
                                 var ser = new JsonSerializer();
-                                ser.Serialize(writer, value);
+                                ser.Serialize(writer, obj[i]);
                             }
                         }
                         if (i != obj.Length - 1)