From 56052011fc677478e3be19b0aafbf98640378a40 Mon Sep 17 00:00:00 2001 From: sorcier Date: Mon, 2 Nov 2026 14:16:56 +0100 Subject: [PATCH] Fix: convert audio in storage/sounds first to prevent Permission Denied on /var/lib/asterisk/sounds, fix ACLs and systemd ReadWritePaths --- install.sh | 11 ++++++----- public/api.php | 31 ++++++++++++++++++++++--------- scripts/fix.sh | 11 ++++++----- 3 files changed, 34 insertions(+), 19 deletions(-) diff --git a/install.sh b/install.sh index 5aae516..cea2060 100755 --- a/install.sh +++ b/install.sh @@ -176,12 +176,13 @@ chmod 2775 "$TARGET_DIR/storage" \ "$TARGET_DIR/storage/sounds" \ "$TARGET_DIR/public/avatars" +mkdir -p /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh /var/spool/asterisk/voicemail chown -R asterisk:asterisk /etc/asterisk /var/lib/asterisk /var/spool/asterisk /var/log/asterisk -chmod -R 775 /etc/asterisk -chmod 2775 /etc/asterisk +chmod -R 775 /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh /var/spool/asterisk +chmod 2775 /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh /var/spool/asterisk chmod 2750 /etc/asterisk/keys -setfacl -R -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk 2>/dev/null || true -setfacl -R -d -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk 2>/dev/null || true +setfacl -R -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh /var/spool/asterisk 2>/dev/null || true +setfacl -R -d -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh /var/spool/asterisk 2>/dev/null || true # Droits sudoers pour l'interface web (www-data) cat << 'EOF' > /etc/sudoers.d/nexus-pbx @@ -197,7 +198,7 @@ for fpm_svc in /lib/systemd/system/php*-fpm.service /usr/lib/systemd/system/php* mkdir -p "/etc/systemd/system/${svc_name}.d" cat << 'EOF_OVERRIDE' > "/etc/systemd/system/${svc_name}.d/override.conf" [Service] -ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log +ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log /var/lib/asterisk /var/spool/asterisk EOF_OVERRIDE fi done diff --git a/public/api.php b/public/api.php index 6532f7b..e6ae4db 100644 --- a/public/api.php +++ b/public/api.php @@ -699,43 +699,56 @@ try { $targetAlaw = "{$customDir}/{$slug}.alaw"; $targetMp3 = "{$storeDir}/{$slug}.mp3"; + // Fichiers de travail dans storage/sounds (garanti accessible en écriture par www-data) + $storeWav = "{$storeDir}/{$slug}.wav"; + $storeAlaw = "{$storeDir}/{$slug}.alaw"; + // 1. Conversion Asterisk WAV (8kHz mono 16-bit PCM) - $cmdWav = sprintf('ffmpeg -y -i %s -ar 8000 -ac 1 -c:a pcm_s16le %s 2>&1', escapeshellarg($tmpPath), escapeshellarg($targetWav)); + $cmdWav = sprintf('ffmpeg -y -i %s -ar 8000 -ac 1 -c:a pcm_s16le %s 2>&1', escapeshellarg($tmpPath), escapeshellarg($storeWav)); exec($cmdWav, $outWav, $retWav); if ($retWav !== 0) { + @unlink($storeWav); throw new RuntimeException("Erreur de conversion audio WAV Asterisk : " . implode("\n", $outWav)); } // 2. Conversion Asterisk ALAW (G.711a 8kHz mono) - $cmdAlaw = sprintf('ffmpeg -y -i %s -ar 8000 -ac 1 -f alaw %s 2>&1', escapeshellarg($tmpPath), escapeshellarg($targetAlaw)); + $cmdAlaw = sprintf('ffmpeg -y -i %s -ar 8000 -ac 1 -f alaw %s 2>&1', escapeshellarg($tmpPath), escapeshellarg($storeAlaw)); exec($cmdAlaw, $outAlaw, $retAlaw); // 3. Conversion MP3 Web preview $cmdMp3 = sprintf('ffmpeg -y -i %s -c:a libmp3lame -b:a 128k %s 2>&1', escapeshellarg($tmpPath), escapeshellarg($targetMp3)); exec($cmdMp3, $outMp3, $retMp3); - // 4. Si musique d'attente (MOH), copier dans le dossier MOH correspondant + // 4. Copie vers les dossiers Asterisk custom + @copy($storeWav, $targetWav); + if (file_exists($storeAlaw)) { + @copy($storeAlaw, $targetAlaw); + } + + // 5. Si musique d'attente (MOH), copier dans le dossier MOH correspondant if ($usageType === 'moh') { $siteSlug = preg_replace('/[^a-z0-9]+/i', '-', strtolower($siteCategory)); $siteSlug = trim($siteSlug, '-') ?: 'default'; if ($siteSlug === 'global') $siteSlug = 'default'; $siteMohDir = "{$mohBase}/{$siteSlug}"; @mkdir($siteMohDir, 0775, true); - @copy($targetWav, "{$siteMohDir}/{$slug}.wav"); - @copy($targetAlaw, "{$siteMohDir}/{$slug}.alaw"); + @copy($storeWav, "{$siteMohDir}/{$slug}.wav"); + if (file_exists($storeAlaw)) { + @copy($storeAlaw, "{$siteMohDir}/{$slug}.alaw"); + } @chown($siteMohDir, 'www-data'); @chgrp($siteMohDir, 'asterisk'); } // Calcul de la durée en secondes - $cmdDur = sprintf('ffprobe -v error -show_entries format=duration -of default=noprint_wrappers=1:nokey=1 %s 2>&1', escapeshellarg($targetWav)); + $cmdDur = sprintf('ffprobe -v error -show_entries format=duration -of default=noprint_wrappers=1:nokey=1 %s 2>&1', escapeshellarg($storeWav)); $durStr = trim((string)shell_exec($cmdDur)); $durationSec = max(1, (int)round((float)$durStr)); // Permissions - @chown($targetWav, 'www-data'); @chgrp($targetWav, 'asterisk'); - @chown($targetAlaw, 'www-data'); @chgrp($targetAlaw, 'asterisk'); - @chown($targetMp3, 'www-data'); @chgrp($targetMp3, 'asterisk'); + @chown($storeWav, 'www-data'); @chgrp($storeWav, 'asterisk'); @chmod($storeWav, 0664); + @chown($targetWav, 'asterisk'); @chgrp($targetWav, 'asterisk'); @chmod($targetWav, 0664); + @chown($targetMp3, 'www-data'); @chgrp($targetMp3, 'asterisk'); @chmod($targetMp3, 0664); $stmt = $db->prepare(' INSERT INTO sounds (name, slug, site_category, usage_type, description, filename, original_filename, duration_sec, file_size, format) diff --git a/scripts/fix.sh b/scripts/fix.sh index 63a8531..38980b9 100755 --- a/scripts/fix.sh +++ b/scripts/fix.sh @@ -69,14 +69,15 @@ touch /etc/asterisk/pjsip.conf \ /etc/asterisk/rtp.conf \ /etc/asterisk/features.conf 2>/dev/null || true +mkdir -p /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh /var/spool/asterisk/voicemail 2>/dev/null || true chown -R asterisk:asterisk /etc/asterisk /var/lib/asterisk /var/spool/asterisk /var/log/asterisk 2>/dev/null || true -chmod -R 775 /etc/asterisk -chmod 2775 /etc/asterisk +chmod -R 775 /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh /var/spool/asterisk 2>/dev/null || true +chmod 2775 /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh /var/spool/asterisk 2>/dev/null || true chmod 2750 /etc/asterisk/keys 2>/dev/null || true chmod 0664 /etc/asterisk/*.conf /etc/asterisk/*.custom.conf 2>/dev/null || true -setfacl -R -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk 2>/dev/null || true -setfacl -R -d -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk 2>/dev/null || true +setfacl -R -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh /var/spool/asterisk 2>/dev/null || true +setfacl -R -d -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh /var/spool/asterisk 2>/dev/null || true chown root:asterisk /etc/fail2ban/jail.local /etc/nginx/sites-available/nexus-pbx 2>/dev/null || true chmod 0664 /etc/fail2ban/jail.local /etc/nginx/sites-available/nexus-pbx 2>/dev/null || true @@ -94,7 +95,7 @@ for fpm_svc in /lib/systemd/system/php*-fpm.service /usr/lib/systemd/system/php* mkdir -p "/etc/systemd/system/${svc_name}.d" cat << 'EOF_OVERRIDE' > "/etc/systemd/system/${svc_name}.d/override.conf" [Service] -ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log +ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log /var/lib/asterisk /var/spool/asterisk EOF_OVERRIDE fi done