2014-05-08 13:47:18 +04:00
|
|
|
<?php
|
|
|
|
/**
|
2015-03-26 13:44:34 +03:00
|
|
|
* @author Bernhard Posselt <dev@bernhard-posselt.com>
|
2015-07-20 13:54:22 +03:00
|
|
|
* @author Lukas Reschke <lukas@owncloud.com>
|
2015-10-05 21:54:56 +03:00
|
|
|
* @author Morris Jobke <hey@morrisjobke.de>
|
2015-02-23 13:28:53 +03:00
|
|
|
*
|
2015-03-26 13:44:34 +03:00
|
|
|
* @copyright Copyright (c) 2015, ownCloud, Inc.
|
|
|
|
* @license AGPL-3.0
|
|
|
|
*
|
|
|
|
* This code is free software: you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU Affero General Public License, version 3,
|
|
|
|
* as published by the Free Software Foundation.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU Affero General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU Affero General Public License, version 3,
|
|
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>
|
2014-05-08 13:47:18 +04:00
|
|
|
*
|
|
|
|
*/
|
2015-02-26 13:37:37 +03:00
|
|
|
|
2014-05-08 13:47:18 +04:00
|
|
|
namespace OC\AppFramework\Middleware\Security;
|
|
|
|
|
2014-05-11 19:55:59 +04:00
|
|
|
use OC\AppFramework\Utility\ControllerMethodReflector;
|
2015-07-20 13:54:22 +03:00
|
|
|
use OCP\AppFramework\Controller;
|
|
|
|
use OCP\AppFramework\Http;
|
|
|
|
use OCP\AppFramework\Http\JSONResponse;
|
2014-05-08 13:47:18 +04:00
|
|
|
use OCP\IRequest;
|
2015-05-22 14:17:27 +03:00
|
|
|
use OCP\IUserSession;
|
2014-05-08 13:47:18 +04:00
|
|
|
use OCP\AppFramework\Http\Response;
|
|
|
|
use OCP\AppFramework\Middleware;
|
|
|
|
|
|
|
|
/**
|
2015-05-22 14:17:27 +03:00
|
|
|
* This middleware sets the correct CORS headers on a response if the
|
2014-05-08 13:47:18 +04:00
|
|
|
* controller has the @CORS annotation. This is needed for webapps that want
|
2015-05-22 14:17:27 +03:00
|
|
|
* to access an API and dont run on the same domain, see
|
2014-05-08 13:47:18 +04:00
|
|
|
* https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS
|
|
|
|
*/
|
|
|
|
class CORSMiddleware extends Middleware {
|
|
|
|
|
2015-05-22 14:17:27 +03:00
|
|
|
/**
|
|
|
|
* @var IRequest
|
|
|
|
*/
|
2014-05-08 13:47:18 +04:00
|
|
|
private $request;
|
2015-05-22 14:17:27 +03:00
|
|
|
|
|
|
|
/**
|
|
|
|
* @var ControllerMethodReflector
|
|
|
|
*/
|
2014-05-11 19:55:59 +04:00
|
|
|
private $reflector;
|
2014-05-08 13:47:18 +04:00
|
|
|
|
2015-05-22 14:17:27 +03:00
|
|
|
/**
|
|
|
|
* @var IUserSession
|
|
|
|
*/
|
|
|
|
private $session;
|
|
|
|
|
2014-05-08 13:47:18 +04:00
|
|
|
/**
|
2014-05-11 16:03:58 +04:00
|
|
|
* @param IRequest $request
|
2014-05-11 19:55:59 +04:00
|
|
|
* @param ControllerMethodReflector $reflector
|
2015-05-22 14:17:27 +03:00
|
|
|
* @param IUserSession $session
|
2014-05-08 13:47:18 +04:00
|
|
|
*/
|
2015-05-22 14:17:27 +03:00
|
|
|
public function __construct(IRequest $request,
|
2015-07-20 13:54:22 +03:00
|
|
|
ControllerMethodReflector $reflector,
|
|
|
|
IUserSession $session) {
|
2014-05-08 13:47:18 +04:00
|
|
|
$this->request = $request;
|
2014-05-11 19:55:59 +04:00
|
|
|
$this->reflector = $reflector;
|
2015-05-22 14:17:27 +03:00
|
|
|
$this->session = $session;
|
2014-05-08 13:47:18 +04:00
|
|
|
}
|
|
|
|
|
2015-05-22 14:17:27 +03:00
|
|
|
/**
|
|
|
|
* This is being run in normal order before the controller is being
|
|
|
|
* called which allows several modifications and checks
|
|
|
|
*
|
|
|
|
* @param Controller $controller the controller that is being called
|
|
|
|
* @param string $methodName the name of the method that will be called on
|
|
|
|
* the controller
|
2015-07-20 13:54:22 +03:00
|
|
|
* @throws SecurityException
|
2015-05-22 14:17:27 +03:00
|
|
|
* @since 6.0.0
|
|
|
|
*/
|
|
|
|
public function beforeController($controller, $methodName){
|
|
|
|
// ensure that @CORS annotated API routes are not used in conjunction
|
|
|
|
// with session authentication since this enables CSRF attack vectors
|
|
|
|
if ($this->reflector->hasAnnotation('CORS') &&
|
|
|
|
!$this->reflector->hasAnnotation('PublicPage')) {
|
|
|
|
$user = $this->request->server['PHP_AUTH_USER'];
|
|
|
|
$pass = $this->request->server['PHP_AUTH_PW'];
|
|
|
|
|
|
|
|
$this->session->logout();
|
|
|
|
if(!$this->session->login($user, $pass)) {
|
2015-07-20 13:54:22 +03:00
|
|
|
throw new SecurityException('CORS requires basic auth', Http::STATUS_UNAUTHORIZED);
|
2015-05-22 14:17:27 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2014-05-08 13:47:18 +04:00
|
|
|
|
|
|
|
/**
|
|
|
|
* This is being run after a successful controllermethod call and allows
|
|
|
|
* the manipulation of a Response object. The middleware is run in reverse order
|
|
|
|
*
|
|
|
|
* @param Controller $controller the controller that is being called
|
|
|
|
* @param string $methodName the name of the method that will be called on
|
|
|
|
* the controller
|
|
|
|
* @param Response $response the generated response from the controller
|
|
|
|
* @return Response a Response object
|
2015-07-20 13:54:22 +03:00
|
|
|
* @throws SecurityException
|
2014-05-08 13:47:18 +04:00
|
|
|
*/
|
|
|
|
public function afterController($controller, $methodName, Response $response){
|
|
|
|
// only react if its a CORS request and if the request sends origin and
|
|
|
|
|
|
|
|
if(isset($this->request->server['HTTP_ORIGIN']) &&
|
2014-05-11 19:55:59 +04:00
|
|
|
$this->reflector->hasAnnotation('CORS')) {
|
2014-05-08 13:47:18 +04:00
|
|
|
|
2015-05-22 14:17:27 +03:00
|
|
|
// allow credentials headers must not be true or CSRF is possible
|
2014-05-08 13:47:18 +04:00
|
|
|
// otherwise
|
2015-07-20 13:54:22 +03:00
|
|
|
foreach($response->getHeaders() as $header => $value) {
|
2014-05-08 13:47:18 +04:00
|
|
|
if(strtolower($header) === 'access-control-allow-credentials' &&
|
|
|
|
strtolower(trim($value)) === 'true') {
|
|
|
|
$msg = 'Access-Control-Allow-Credentials must not be '.
|
2014-05-11 19:55:59 +04:00
|
|
|
'set to true in order to prevent CSRF';
|
2014-05-08 13:47:18 +04:00
|
|
|
throw new SecurityException($msg);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
$origin = $this->request->server['HTTP_ORIGIN'];
|
|
|
|
$response->addHeader('Access-Control-Allow-Origin', $origin);
|
|
|
|
}
|
|
|
|
return $response;
|
|
|
|
}
|
|
|
|
|
2015-07-20 13:54:22 +03:00
|
|
|
/**
|
|
|
|
* If an SecurityException is being caught return a JSON error response
|
|
|
|
*
|
|
|
|
* @param Controller $controller the controller that is being called
|
|
|
|
* @param string $methodName the name of the method that will be called on
|
|
|
|
* the controller
|
|
|
|
* @param \Exception $exception the thrown exception
|
|
|
|
* @throws \Exception the passed in exception if it cant handle it
|
|
|
|
* @return Response a Response object or null in case that the exception could not be handled
|
|
|
|
*/
|
|
|
|
public function afterException($controller, $methodName, \Exception $exception){
|
|
|
|
if($exception instanceof SecurityException){
|
|
|
|
$response = new JSONResponse(['message' => $exception->getMessage()]);
|
|
|
|
if($exception->getCode() !== 0) {
|
|
|
|
$response->setStatus($exception->getCode());
|
|
|
|
} else {
|
|
|
|
$response->setStatus(Http::STATUS_INTERNAL_SERVER_ERROR);
|
|
|
|
}
|
|
|
|
return $response;
|
|
|
|
}
|
|
|
|
|
|
|
|
throw $exception;
|
|
|
|
}
|
2014-05-08 13:47:18 +04:00
|
|
|
|
|
|
|
}
|