Fix file and backup downloading to use URL returned by server

app/Http/Controllers/Api/Client/Servers/DownloadBackupController.php

@@ -2,14 +2,10 @@
 
 namespace Pterodactyl\Http\Controllers\Api\Client\Servers;
 
-use Lcobucci\JWT\Builder;
 use Carbon\CarbonImmutable;
-use Illuminate\Support\Str;
-use Lcobucci\JWT\Signer\Key;
 use Pterodactyl\Models\Backup;
 use Pterodactyl\Models\Server;
-use Lcobucci\JWT\Signer\Hmac\Sha256;
-use Illuminate\Http\RedirectResponse;
+use Pterodactyl\Services\Nodes\NodeJWTService;
 use Illuminate\Contracts\Routing\ResponseFactory;
 use Pterodactyl\Repositories\Wings\DaemonBackupRepository;
 use Pterodactyl\Http\Controllers\Api\Client\ClientApiController;
@@ -27,20 +23,28 @@ class DownloadBackupController extends ClientApiController
      */
     private $responseFactory;
 
+    /**
+     * @var \Pterodactyl\Services\Nodes\NodeJWTService
+     */
+    private $jwtService;
+
     /**
      * DownloadBackupController constructor.
      *
      * @param \Pterodactyl\Repositories\Wings\DaemonBackupRepository $daemonBackupRepository
+     * @param \Pterodactyl\Services\Nodes\NodeJWTService $jwtService
      * @param \Illuminate\Contracts\Routing\ResponseFactory $responseFactory
      */
     public function __construct(
         DaemonBackupRepository $daemonBackupRepository,
+        NodeJWTService $jwtService,
         ResponseFactory $responseFactory
     ) {
         parent::__construct();
 
         $this->daemonBackupRepository = $daemonBackupRepository;
         $this->responseFactory = $responseFactory;
+        $this->jwtService = $jwtService;
     }
 
     /**
@@ -51,30 +55,27 @@ class DownloadBackupController extends ClientApiController
      * @param \Pterodactyl\Http\Requests\Api\Client\Servers\Backups\DownloadBackupRequest $request
      * @param \Pterodactyl\Models\Server $server
      * @param \Pterodactyl\Models\Backup $backup
-     * @return \Illuminate\Http\RedirectResponse
+     * @return array
      */
     public function __invoke(DownloadBackupRequest $request, Server $server, Backup $backup)
     {
-        $signer = new Sha256;
-        $now = CarbonImmutable::now();
+        $token = $this->jwtService
+            ->setExpiresAt(CarbonImmutable::now()->addMinutes(15))
+            ->setClaims([
+                'backup_uuid' => $backup->uuid,
+                'server_uuid' => $server->uuid,
+            ])
+            ->handle($server->node, $request->user()->id . $server->uuid);
 
-        $token = (new Builder)->issuedBy(config('app.url'))
-            ->permittedFor($server->node->getConnectionAddress())
-            ->identifiedBy(hash('sha256', $request->user()->id . $server->uuid), true)
-            ->issuedAt($now->getTimestamp())
-            ->canOnlyBeUsedAfter($now->subMinutes(5)->getTimestamp())
-            ->expiresAt($now->addMinutes(15)->getTimestamp())
-            ->withClaim('unique_id', Str::random(16))
-            ->withClaim('backup_uuid', $backup->uuid)
-            ->withClaim('server_uuid', $server->uuid)
-            ->getToken($signer, new Key($server->node->daemonSecret));
-
-        $location = sprintf(
-            '%s/download/backup?token=%s',
-            $server->node->getConnectionAddress(),
-            $token->__toString()
-        );
-
-        return RedirectResponse::create($location);
+        return [
+            'object' => 'signed_url',
+            'attributes' => [
+                'url' => sprintf(
+                    '%s/download/backup?token=%s',
+                    $server->node->getConnectionAddress(),
+                    $token->__toString()
+                ),
+            ],
+        ];
     }
 }

app/Http/Controllers/Api/Client/Servers/FileController.php

@@ -2,9 +2,11 @@
 
 namespace Pterodactyl\Http\Controllers\Api\Client\Servers;
 
+use Carbon\CarbonImmutable;
 use Illuminate\Http\Response;
 use Pterodactyl\Models\Server;
 use GuzzleHttp\Exception\TransferException;
+use Pterodactyl\Services\Nodes\NodeJWTService;
 use Illuminate\Contracts\Routing\ResponseFactory;
 use Pterodactyl\Repositories\Wings\DaemonFileRepository;
 use Pterodactyl\Transformers\Daemon\FileObjectTransformer;
@@ -30,20 +32,28 @@ class FileController extends ClientApiController
      */
     private $responseFactory;
 
+    /**
+     * @var \Pterodactyl\Services\Nodes\NodeJWTService
+     */
+    private $jwtService;
+
     /**
      * FileController constructor.
      *
      * @param \Illuminate\Contracts\Routing\ResponseFactory $responseFactory
+     * @param \Pterodactyl\Services\Nodes\NodeJWTService $jwtService
      * @param \Pterodactyl\Repositories\Wings\DaemonFileRepository $fileRepository
      */
     public function __construct(
         ResponseFactory $responseFactory,
+        NodeJWTService $jwtService,
         DaemonFileRepository $fileRepository
     ) {
         parent::__construct();
 
         $this->fileRepository = $fileRepository;
         $this->responseFactory = $responseFactory;
+        $this->jwtService = $jwtService;
     }
 
     /**
@@ -90,36 +100,35 @@ class FileController extends ClientApiController
     }
 
     /**
+     * Generates a one-time token with a link that the user can use to
+     * download a given file.
+     *
      * @param \Pterodactyl\Http\Requests\Api\Client\Servers\Files\GetFileContentsRequest $request
      * @param \Pterodactyl\Models\Server $server
-     * @return \Symfony\Component\HttpFoundation\StreamedResponse
+     * @return array
      *
      * @throws \Exception
      */
     public function download(GetFileContentsRequest $request, Server $server)
     {
-        set_time_limit(0);
+        $token = $this->jwtService
+            ->setExpiresAt(CarbonImmutable::now()->addMinutes(15))
+            ->setClaims([
+                'file_path' => $request->get('file'),
+                'server_uuid' => $server->uuid,
+            ])
+            ->handle($server->node, $request->user()->id . $server->uuid);
 
-        $request = $this->fileRepository->setServer($server)->streamContent(
-            $request->get('file')
-        );
-
-        $body = $request->getBody();
-
-        preg_match('/filename=(?<name>.*)$/', $request->getHeaderLine('Content-Disposition'), $matches);
-
-        return $this->responseFactory->streamDownload(
-            function () use ($body) {
-                while (! $body->eof()) {
-                    echo $body->read(128);
-                }
-            },
-            $matches['name'] ?? 'download',
-            [
-                'Content-Type' => $request->getHeaderLine('Content-Type'),
-                'Content-Length' => $request->getHeaderLine('Content-Length'),
-            ]
-        );
+        return [
+            'object' => 'signed_url',
+            'attributes' => [
+                'url' => sprintf(
+                    '%s/download/file?token=%s',
+                    $server->node->getConnectionAddress(),
+                    $token->__toString()
+                ),
+            ],
+        ];
     }
 
     /**