2014-05-08 13:47:18 +04:00
|
|
|
<?php
|
|
|
|
/**
|
2015-02-23 13:28:53 +03:00
|
|
|
* @author Bernhard Posselt <dev@bernhard-posselt.com>
|
2014-05-08 13:47:18 +04:00
|
|
|
*
|
2015-02-23 13:28:53 +03:00
|
|
|
* @copyright Copyright (c) 2015, ownCloud, Inc.
|
|
|
|
* @license AGPL-3.0
|
|
|
|
*
|
|
|
|
* This code is free software: you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU Affero General Public License, version 3,
|
|
|
|
* as published by the Free Software Foundation.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU Affero General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU Affero General Public License, version 3,
|
|
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>
|
2014-05-08 13:47:18 +04:00
|
|
|
*
|
|
|
|
*/
|
|
|
|
namespace OC\AppFramework\Middleware\Security;
|
|
|
|
|
2014-05-11 19:55:59 +04:00
|
|
|
use OC\AppFramework\Utility\ControllerMethodReflector;
|
2014-05-08 13:47:18 +04:00
|
|
|
use OCP\IRequest;
|
|
|
|
use OCP\AppFramework\Http\Response;
|
|
|
|
use OCP\AppFramework\Middleware;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* This middleware sets the correct CORS headers on a response if the
|
|
|
|
* controller has the @CORS annotation. This is needed for webapps that want
|
|
|
|
* to access an API and dont run on the same domain, see
|
|
|
|
* https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS
|
|
|
|
*/
|
|
|
|
class CORSMiddleware extends Middleware {
|
|
|
|
|
|
|
|
private $request;
|
2014-05-11 19:55:59 +04:00
|
|
|
private $reflector;
|
2014-05-08 13:47:18 +04:00
|
|
|
|
|
|
|
/**
|
2014-05-11 16:03:58 +04:00
|
|
|
* @param IRequest $request
|
2014-05-11 19:55:59 +04:00
|
|
|
* @param ControllerMethodReflector $reflector
|
2014-05-08 13:47:18 +04:00
|
|
|
*/
|
2014-05-11 19:55:59 +04:00
|
|
|
public function __construct(IRequest $request,
|
|
|
|
ControllerMethodReflector $reflector) {
|
2014-05-08 13:47:18 +04:00
|
|
|
$this->request = $request;
|
2014-05-11 19:55:59 +04:00
|
|
|
$this->reflector = $reflector;
|
2014-05-08 13:47:18 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
* This is being run after a successful controllermethod call and allows
|
|
|
|
* the manipulation of a Response object. The middleware is run in reverse order
|
|
|
|
*
|
|
|
|
* @param Controller $controller the controller that is being called
|
|
|
|
* @param string $methodName the name of the method that will be called on
|
|
|
|
* the controller
|
|
|
|
* @param Response $response the generated response from the controller
|
|
|
|
* @return Response a Response object
|
|
|
|
*/
|
|
|
|
public function afterController($controller, $methodName, Response $response){
|
|
|
|
// only react if its a CORS request and if the request sends origin and
|
|
|
|
|
|
|
|
if(isset($this->request->server['HTTP_ORIGIN']) &&
|
2014-05-11 19:55:59 +04:00
|
|
|
$this->reflector->hasAnnotation('CORS')) {
|
2014-05-08 13:47:18 +04:00
|
|
|
|
|
|
|
// allow credentials headers must not be true or CSRF is possible
|
|
|
|
// otherwise
|
|
|
|
foreach($response->getHeaders() as $header => $value ) {
|
|
|
|
if(strtolower($header) === 'access-control-allow-credentials' &&
|
|
|
|
strtolower(trim($value)) === 'true') {
|
|
|
|
$msg = 'Access-Control-Allow-Credentials must not be '.
|
2014-05-11 19:55:59 +04:00
|
|
|
'set to true in order to prevent CSRF';
|
2014-05-08 13:47:18 +04:00
|
|
|
throw new SecurityException($msg);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
$origin = $this->request->server['HTTP_ORIGIN'];
|
|
|
|
$response->addHeader('Access-Control-Allow-Origin', $origin);
|
|
|
|
}
|
|
|
|
return $response;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
}
|