From cf9dbc6e349bc287a414547944fd2a6dff383d64 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= Date: Tue, 24 Sep 2013 14:25:56 +0200 Subject: [PATCH 01/52] adding error handling on file_put_contents within the web dav implementation --- lib/connector/sabre/directory.php | 7 ++++++- lib/connector/sabre/file.php | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/lib/connector/sabre/directory.php b/lib/connector/sabre/directory.php index 3181a4b310..0717d95226 100644 --- a/lib/connector/sabre/directory.php +++ b/lib/connector/sabre/directory.php @@ -72,7 +72,12 @@ class OC_Connector_Sabre_Directory extends OC_Connector_Sabre_Node implements Sa // mark file as partial while uploading (ignored by the scanner) $partpath = $newPath . '.part'; - \OC\Files\Filesystem::file_put_contents($partpath, $data); + $putOkay = \OC\Files\Filesystem::file_put_contents($partpath, $data); + if ($putOkay === false) { + \OC_Log::write('webdav', '\OC\Files\Filesystem::file_put_contents() failed', \OC_Log::ERROR); + \OC\Files\Filesystem::unlink($partpath); + throw new Sabre_DAV_Exception(); + } //detect aborted upload if (isset ($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'PUT' ) { diff --git a/lib/connector/sabre/file.php b/lib/connector/sabre/file.php index 61bdcd5e0a..57ba94c7b1 100644 --- a/lib/connector/sabre/file.php +++ b/lib/connector/sabre/file.php @@ -58,7 +58,12 @@ class OC_Connector_Sabre_File extends OC_Connector_Sabre_Node implements Sabre_D // mark file as partial while uploading (ignored by the scanner) $partpath = $this->path . '.part'; - \OC\Files\Filesystem::file_put_contents($partpath, $data); + $putOkay = \OC\Files\Filesystem::file_put_contents($partpath, $data); + if ($putOkay === false) { + \OC_Log::write('webdav', '\OC\Files\Filesystem::file_put_contents() failed', \OC_Log::ERROR); + \OC\Files\Filesystem::unlink($partpath); + throw new Sabre_DAV_Exception(); + } //detect aborted upload if (isset ($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'PUT') { From 4e7f82ef04b3713c71b4c2a2732892490e42e0d4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= Date: Tue, 24 Sep 2013 15:14:42 +0200 Subject: [PATCH 02/52] unify duplicate code --- lib/connector/sabre/directory.php | 56 ++----------------------------- lib/connector/sabre/file.php | 32 ++++++++++++++---- 2 files changed, 29 insertions(+), 59 deletions(-) diff --git a/lib/connector/sabre/directory.php b/lib/connector/sabre/directory.php index 0717d95226..fa20a60f3a 100644 --- a/lib/connector/sabre/directory.php +++ b/lib/connector/sabre/directory.php @@ -54,59 +54,9 @@ class OC_Connector_Sabre_Directory extends OC_Connector_Sabre_Node implements Sa throw new \Sabre_DAV_Exception_Forbidden(); } - if (isset($_SERVER['HTTP_OC_CHUNKED'])) { - $info = OC_FileChunking::decodeName($name); - if (empty($info)) { - throw new Sabre_DAV_Exception_NotImplemented(); - } - $chunk_handler = new OC_FileChunking($info); - $chunk_handler->store($info['index'], $data); - if ($chunk_handler->isComplete()) { - $newPath = $this->path . '/' . $info['name']; - $chunk_handler->file_assemble($newPath); - return OC_Connector_Sabre_Node::getETagPropertyForPath($newPath); - } - } else { - $newPath = $this->path . '/' . $name; - - // mark file as partial while uploading (ignored by the scanner) - $partpath = $newPath . '.part'; - - $putOkay = \OC\Files\Filesystem::file_put_contents($partpath, $data); - if ($putOkay === false) { - \OC_Log::write('webdav', '\OC\Files\Filesystem::file_put_contents() failed', \OC_Log::ERROR); - \OC\Files\Filesystem::unlink($partpath); - throw new Sabre_DAV_Exception(); - } - - //detect aborted upload - if (isset ($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'PUT' ) { - if (isset($_SERVER['CONTENT_LENGTH'])) { - $expected = $_SERVER['CONTENT_LENGTH']; - $actual = \OC\Files\Filesystem::filesize($partpath); - if ($actual != $expected) { - \OC\Files\Filesystem::unlink($partpath); - throw new Sabre_DAV_Exception_BadRequest( - 'expected filesize ' . $expected . ' got ' . $actual); - } - } - } - - // rename to correct path - \OC\Files\Filesystem::rename($partpath, $newPath); - - // allow sync clients to send the mtime along in a header - $mtime = OC_Request::hasModificationTime(); - if ($mtime !== false) { - if(\OC\Files\Filesystem::touch($newPath, $mtime)) { - header('X-OC-MTime: accepted'); - } - } - - return OC_Connector_Sabre_Node::getETagPropertyForPath($newPath); - } - - return null; + $path = $this->path . '/' . $name; + $node = new OC_Connector_Sabre_File($path); + return $node->put($data); } /** diff --git a/lib/connector/sabre/file.php b/lib/connector/sabre/file.php index 57ba94c7b1..aa71b8be21 100644 --- a/lib/connector/sabre/file.php +++ b/lib/connector/sabre/file.php @@ -46,7 +46,8 @@ class OC_Connector_Sabre_File extends OC_Connector_Sabre_Node implements Sabre_D */ public function put($data) { - if (!\OC\Files\Filesystem::isUpdatable($this->path)) { + if (\OC\Files\Filesystem::file_exists($this->path) && + !\OC\Files\Filesystem::isUpdatable($this->path)) { throw new \Sabre_DAV_Exception_Forbidden(); } @@ -54,7 +55,26 @@ class OC_Connector_Sabre_File extends OC_Connector_Sabre_Node implements Sabre_D if (\OC_Util::encryptedFiles()) { throw new \Sabre_DAV_Exception_ServiceUnavailable(); } - + + // chunked handling + if (isset($_SERVER['HTTP_OC_CHUNKED'])) { + list(, $name) = \Sabre_DAV_URLUtil::splitPath($this->path); + + $info = OC_FileChunking::decodeName($name); + if (empty($info)) { + throw new Sabre_DAV_Exception_NotImplemented(); + } + $chunk_handler = new OC_FileChunking($info); + $chunk_handler->store($info['index'], $data); + if ($chunk_handler->isComplete()) { + $newPath = $this->path . '/' . $info['name']; + $chunk_handler->file_assemble($newPath); + return OC_Connector_Sabre_Node::getETagPropertyForPath($newPath); + } + + return null; + } + // mark file as partial while uploading (ignored by the scanner) $partpath = $this->path . '.part'; @@ -66,7 +86,7 @@ class OC_Connector_Sabre_File extends OC_Connector_Sabre_Node implements Sabre_D } //detect aborted upload - if (isset ($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'PUT') { + if (isset ($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'PUT' ) { if (isset($_SERVER['CONTENT_LENGTH'])) { $expected = $_SERVER['CONTENT_LENGTH']; $actual = \OC\Files\Filesystem::filesize($partpath); @@ -81,10 +101,10 @@ class OC_Connector_Sabre_File extends OC_Connector_Sabre_Node implements Sabre_D // rename to correct path \OC\Files\Filesystem::rename($partpath, $this->path); - //allow sync clients to send the mtime along in a header + // allow sync clients to send the mtime along in a header $mtime = OC_Request::hasModificationTime(); if ($mtime !== false) { - if (\OC\Files\Filesystem::touch($this->path, $mtime)) { + if(\OC\Files\Filesystem::touch($this->path, $mtime)) { header('X-OC-MTime: accepted'); } } @@ -99,7 +119,7 @@ class OC_Connector_Sabre_File extends OC_Connector_Sabre_Node implements Sabre_D */ public function get() { - //throw execption if encryption is disabled but files are still encrypted + //throw exception if encryption is disabled but files are still encrypted if (\OC_Util::encryptedFiles()) { throw new \Sabre_DAV_Exception_ServiceUnavailable(); } else { From 84a0e6930b8668a57075159d0c6e31e35e6c5e84 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= Date: Tue, 24 Sep 2013 15:35:21 +0200 Subject: [PATCH 03/52] creating non static getETagPropertyForPath() adding public $fileView to Node to allow unit testing --- lib/connector/sabre/directory.php | 5 ++--- lib/connector/sabre/file.php | 22 +++++++++++----------- lib/connector/sabre/node.php | 17 +++++++++++++++-- 3 files changed, 28 insertions(+), 16 deletions(-) diff --git a/lib/connector/sabre/directory.php b/lib/connector/sabre/directory.php index fa20a60f3a..e36ac84652 100644 --- a/lib/connector/sabre/directory.php +++ b/lib/connector/sabre/directory.php @@ -205,13 +205,12 @@ class OC_Connector_Sabre_Directory extends OC_Connector_Sabre_Node implements Sa * If the array is empty, all properties should be returned * * @param array $properties - * @return void + * @return array */ public function getProperties($properties) { $props = parent::getProperties($properties); if (in_array(self::GETETAG_PROPERTYNAME, $properties) && !isset($props[self::GETETAG_PROPERTYNAME])) { - $props[self::GETETAG_PROPERTYNAME] - = OC_Connector_Sabre_Node::getETagPropertyForPath($this->path); + $props[self::GETETAG_PROPERTYNAME] = $this->getETagPropertyForPath($this->path); } return $props; } diff --git a/lib/connector/sabre/file.php b/lib/connector/sabre/file.php index aa71b8be21..af9a36931a 100644 --- a/lib/connector/sabre/file.php +++ b/lib/connector/sabre/file.php @@ -45,9 +45,9 @@ class OC_Connector_Sabre_File extends OC_Connector_Sabre_Node implements Sabre_D * @return string|null */ public function put($data) { - - if (\OC\Files\Filesystem::file_exists($this->path) && - !\OC\Files\Filesystem::isUpdatable($this->path)) { + $fs = $this->getFS(); + if ($fs->file_exists($this->path) && + !$fs->isUpdatable($this->path)) { throw new \Sabre_DAV_Exception_Forbidden(); } @@ -69,7 +69,7 @@ class OC_Connector_Sabre_File extends OC_Connector_Sabre_Node implements Sabre_D if ($chunk_handler->isComplete()) { $newPath = $this->path . '/' . $info['name']; $chunk_handler->file_assemble($newPath); - return OC_Connector_Sabre_Node::getETagPropertyForPath($newPath); + return $this->getETagPropertyForPath($newPath); } return null; @@ -78,10 +78,10 @@ class OC_Connector_Sabre_File extends OC_Connector_Sabre_Node implements Sabre_D // mark file as partial while uploading (ignored by the scanner) $partpath = $this->path . '.part'; - $putOkay = \OC\Files\Filesystem::file_put_contents($partpath, $data); + $putOkay = $fs->file_put_contents($partpath, $data); if ($putOkay === false) { \OC_Log::write('webdav', '\OC\Files\Filesystem::file_put_contents() failed', \OC_Log::ERROR); - \OC\Files\Filesystem::unlink($partpath); + $fs->unlink($partpath); throw new Sabre_DAV_Exception(); } @@ -89,9 +89,9 @@ class OC_Connector_Sabre_File extends OC_Connector_Sabre_Node implements Sabre_D if (isset ($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'PUT' ) { if (isset($_SERVER['CONTENT_LENGTH'])) { $expected = $_SERVER['CONTENT_LENGTH']; - $actual = \OC\Files\Filesystem::filesize($partpath); + $actual = $fs->filesize($partpath); if ($actual != $expected) { - \OC\Files\Filesystem::unlink($partpath); + $fs->unlink($partpath); throw new Sabre_DAV_Exception_BadRequest( 'expected filesize ' . $expected . ' got ' . $actual); } @@ -99,17 +99,17 @@ class OC_Connector_Sabre_File extends OC_Connector_Sabre_Node implements Sabre_D } // rename to correct path - \OC\Files\Filesystem::rename($partpath, $this->path); + $fs->rename($partpath, $this->path); // allow sync clients to send the mtime along in a header $mtime = OC_Request::hasModificationTime(); if ($mtime !== false) { - if(\OC\Files\Filesystem::touch($this->path, $mtime)) { + if($fs->touch($this->path, $mtime)) { header('X-OC-MTime: accepted'); } } - return OC_Connector_Sabre_Node::getETagPropertyForPath($this->path); + return $this->getETagPropertyForPath($this->path); } /** diff --git a/lib/connector/sabre/node.php b/lib/connector/sabre/node.php index 0bffa58af7..28679ef802 100644 --- a/lib/connector/sabre/node.php +++ b/lib/connector/sabre/node.php @@ -32,6 +32,13 @@ abstract class OC_Connector_Sabre_Node implements Sabre_DAV_INode, Sabre_DAV_IPr */ public static $ETagFunction = null; + /** + * is kept public to allow overwrite for unit testing + * + * @var \OC\Files\View + */ + public $fileView; + /** * The path to the current node * @@ -216,12 +223,18 @@ abstract class OC_Connector_Sabre_Node implements Sabre_DAV_INode, Sabre_DAV_IPr * @param string $path Path of the file * @return string|null Returns null if the ETag can not effectively be determined */ - static public function getETagPropertyForPath($path) { - $data = \OC\Files\Filesystem::getFileInfo($path); + protected function getETagPropertyForPath($path) { + $data = $this->getFS()->getFileInfo($path); if (isset($data['etag'])) { return '"'.$data['etag'].'"'; } return null; } + protected function getFS() { + if (is_null($this->fileView)) { + $this->fileView = \OC\Files\Filesystem::getView(); + } + return $this->fileView; + } } From ee75a5b134eaa49b54857ea254b5217ea47e0e2f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= Date: Tue, 24 Sep 2013 15:44:02 +0200 Subject: [PATCH 04/52] adding basic unit test for failing file_put_content operation --- tests/lib/connector/sabre/file.php | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 tests/lib/connector/sabre/file.php diff --git a/tests/lib/connector/sabre/file.php b/tests/lib/connector/sabre/file.php new file mode 100644 index 0000000000..ae95ea9ac4 --- /dev/null +++ b/tests/lib/connector/sabre/file.php @@ -0,0 +1,27 @@ + + * This file is licensed under the Affero General Public License version 3 or + * later. + * See the COPYING-README file. + */ + +class Test_OC_Connector_Sabre_File extends PHPUnit_Framework_TestCase { + + public function setUp() { + } + + /** + * @expectedException Sabre_DAV_Exception + */ + public function testSimplePutFails() { + // setup + $file = new OC_Connector_Sabre_File('/test.txt'); + $file->fileView = $this->getMock('\OC\Files\View', array('file_put_contents'), array(), '', FALSE); + $file->fileView->expects($this->any())->method('file_put_contents')->withAnyParameters()->will($this->returnValue(false)); + + // action + $etag = $file->put('test data'); + } + +} From a86c10984a90ba51b8748cb789a93908118c5808 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= Date: Thu, 26 Sep 2013 11:50:46 +0200 Subject: [PATCH 05/52] catching NotPermittedException and throw it to the dav client as 403 --- lib/connector/sabre/file.php | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/lib/connector/sabre/file.php b/lib/connector/sabre/file.php index af9a36931a..aa4b886429 100644 --- a/lib/connector/sabre/file.php +++ b/lib/connector/sabre/file.php @@ -78,11 +78,16 @@ class OC_Connector_Sabre_File extends OC_Connector_Sabre_Node implements Sabre_D // mark file as partial while uploading (ignored by the scanner) $partpath = $this->path . '.part'; - $putOkay = $fs->file_put_contents($partpath, $data); - if ($putOkay === false) { - \OC_Log::write('webdav', '\OC\Files\Filesystem::file_put_contents() failed', \OC_Log::ERROR); - $fs->unlink($partpath); - throw new Sabre_DAV_Exception(); + try { + $putOkay = $fs->file_put_contents($partpath, $data); + if ($putOkay === false) { + \OC_Log::write('webdav', '\OC\Files\Filesystem::file_put_contents() failed', \OC_Log::ERROR); + $fs->unlink($partpath); + // because we have no clue about the cause we can only throw back a 500/Internal Server Error + throw new Sabre_DAV_Exception(); + } + } catch (\OCP\Files\NotPermittedException $e) { + throw new Sabre_DAV_Exception_Forbidden(); } //detect aborted upload From 1ec7dff2fe1922a4690dc2537c0c64369ca86ea1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= Date: Fri, 27 Sep 2013 13:30:09 +0200 Subject: [PATCH 06/52] remove unused setUp() --- tests/lib/connector/sabre/file.php | 3 --- 1 file changed, 3 deletions(-) diff --git a/tests/lib/connector/sabre/file.php b/tests/lib/connector/sabre/file.php index ae95ea9ac4..ab34937b0c 100644 --- a/tests/lib/connector/sabre/file.php +++ b/tests/lib/connector/sabre/file.php @@ -8,9 +8,6 @@ class Test_OC_Connector_Sabre_File extends PHPUnit_Framework_TestCase { - public function setUp() { - } - /** * @expectedException Sabre_DAV_Exception */ From 92c02e67973cf3e4e2615eae5a280674df43e084 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= Date: Mon, 30 Sep 2013 10:58:03 +0200 Subject: [PATCH 07/52] remove commented code --- lib/connector/sabre/directory.php | 56 ------------------------------- 1 file changed, 56 deletions(-) diff --git a/lib/connector/sabre/directory.php b/lib/connector/sabre/directory.php index 1e50d4cc7d..e36ac84652 100644 --- a/lib/connector/sabre/directory.php +++ b/lib/connector/sabre/directory.php @@ -57,62 +57,6 @@ class OC_Connector_Sabre_Directory extends OC_Connector_Sabre_Node implements Sa $path = $this->path . '/' . $name; $node = new OC_Connector_Sabre_File($path); return $node->put($data); - -// if (isset($_SERVER['HTTP_OC_CHUNKED'])) { -// $info = OC_FileChunking::decodeName($name); -// if (empty($info)) { -// throw new Sabre_DAV_Exception_NotImplemented(); -// } -// $chunk_handler = new OC_FileChunking($info); -// $chunk_handler->store($info['index'], $data); -// if ($chunk_handler->isComplete()) { -// $newPath = $this->path . '/' . $info['name']; -// $chunk_handler->file_assemble($newPath); -// return OC_Connector_Sabre_Node::getETagPropertyForPath($newPath); -// } -// } else { -// $newPath = $this->path . '/' . $name; -// -// // mark file as partial while uploading (ignored by the scanner) -// $partpath = $newPath . '.part'; -// -// \OC\Files\Filesystem::file_put_contents($partpath, $data); -// -// //detect aborted upload -// if (isset ($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'PUT' ) { -// if (isset($_SERVER['CONTENT_LENGTH'])) { -// $expected = $_SERVER['CONTENT_LENGTH']; -// $actual = \OC\Files\Filesystem::filesize($partpath); -// if ($actual != $expected) { -// \OC\Files\Filesystem::unlink($partpath); -// throw new Sabre_DAV_Exception_BadRequest( -// 'expected filesize ' . $expected . ' got ' . $actual); -// } -// } -// } -// -// // rename to correct path -// $renameOkay = \OC\Files\Filesystem::rename($partpath, $newPath); -// $fileExists = \OC\Files\Filesystem::file_exists($newPath); -// if ($renameOkay === false || $fileExists === false) { -// \OC_Log::write('webdav', '\OC\Files\Filesystem::rename() failed', \OC_Log::ERROR); -// \OC\Files\Filesystem::unlink($partpath); -// throw new Sabre_DAV_Exception(); -// } -// -// // allow sync clients to send the mtime along in a header -// $mtime = OC_Request::hasModificationTime(); -// if ($mtime !== false) { -// if(\OC\Files\Filesystem::touch($newPath, $mtime)) { -// header('X-OC-MTime: accepted'); -// } -// } -// -// return OC_Connector_Sabre_Node::getETagPropertyForPath($newPath); -// } -// -// return null; -//>>>>>>> master } /** From fdc87eaeb360ad14ed243368ea8f74aafed32304 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= Date: Mon, 30 Sep 2013 11:30:34 +0200 Subject: [PATCH 08/52] adding test testSimplePutFailsOnRename() --- tests/lib/connector/sabre/file.php | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/tests/lib/connector/sabre/file.php b/tests/lib/connector/sabre/file.php index ab34937b0c..a1dade3d63 100644 --- a/tests/lib/connector/sabre/file.php +++ b/tests/lib/connector/sabre/file.php @@ -21,4 +21,18 @@ class Test_OC_Connector_Sabre_File extends PHPUnit_Framework_TestCase { $etag = $file->put('test data'); } + /** + * @expectedException Sabre_DAV_Exception + */ + public function testSimplePutFailsOnRename() { + // setup + $file = new OC_Connector_Sabre_File('/test.txt'); + $file->fileView = $this->getMock('\OC\Files\View', array('file_put_contents', 'rename'), array(), '', FALSE); + $file->fileView->expects($this->any())->method('file_put_contents')->withAnyParameters()->will($this->returnValue(true)); + $file->fileView->expects($this->any())->method('rename')->withAnyParameters()->will($this->returnValue(false)); + + // action + $etag = $file->put('test data'); + } + } From d8ada370d76acc10e602d25db6af5be936880d4c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= Date: Tue, 1 Oct 2013 13:25:58 +0200 Subject: [PATCH 09/52] Squashed commit of the following: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit commit ae1f68ac54cf2878d265b2bbce13bd600d2d0719 Author: Thomas Müller Date: Thu Aug 22 11:45:27 2013 +0200 fixing undefined variable commit 982f327ca10eea0a2222eae3e74210648591fd8a Author: Thomas Müller Date: Wed Aug 7 12:00:14 2013 +0200 adding login.php as alternative for index.php/login commit da0d7e1d096fb80789524b01f0f96fe08d147943 Author: Thomas Müller Date: Wed Aug 7 11:36:12 2013 +0200 adding a route for web login commit 8e2a01160485cf7e9a2eb8bf46f06fae73956e8e Author: Karl Beecher Date: Tue Aug 6 17:00:28 2013 +0200 Login attempt returns true instead of exiting immediately commit fd89d55de9e71e986e03a0de9aad9407b632e22f Author: Karl Beecher Date: Mon Aug 5 15:31:30 2013 +0200 Further abstraction. This change introduces the ApacheBackend interface for backends that depend on Apache authentication and session management. There are no longer references to specific backends in OC_User. commit 469cfd98aea5a37985722cf5f9e00ece0ce38178 Author: Karl Beecher Date: Thu Aug 1 15:46:36 2013 +0200 Make login attempt function protected. commit d803515f19ff086e2028fcaa51afae579685e596 Author: Karl Beecher Date: Wed Jul 31 16:00:22 2013 +0200 Amends the login link When using a Shibboleth login, clicking logout displays a message to the user instead of ending the session. commit aa8c1fcea05c8268f26a10b21c4e0bc547c3414f Author: Karl Beecher Date: Tue Jul 30 13:15:59 2013 +0200 Abstract Shibboleth authentication into an Apache authentication method commit 69082f2ebcab267f6e8eceb1a252f84c52236546 Author: Karl Beecher Date: Tue Jul 30 11:22:26 2013 +0200 Convert spaces -> tabs commit 5a80861d86855eec5906fd5e235ac4ff12efb0f2 Author: Karl Beecher Date: Mon Jul 29 17:40:48 2013 +0200 Separate the authentication methods SABRE authentication and base authentication have slightly different workings right now. They should be refactored into a common method later, but time pressure requires us to reinvent the wheel slightly. commit dc20a9f8764b103b7d8c5b713f2bcdae18708b65 Author: Karl Beecher Date: Mon Jul 29 17:07:07 2013 +0200 Authenicate calls to WebDAV against Shibboleth. When using WebDAV, the OC_Connector_Sabre_Auth::authenticate method is normally called without trying the Shibboleth authentication... thus the session is not established. The method now tries Shib authentication, setting up a session if the user has already authenticated. commit 091e4861b2246c4084c9b30e232289fde4ba1abf Author: Karl Beecher Date: Mon Jul 29 14:04:54 2013 +0200 Sets up the Shibboleth login attempt. commit bae710ec0579ef99b23022cc12f6876c5fe6b0d5 Author: Karl Beecher Date: Mon Jul 29 12:36:44 2013 +0200 Add a method for attempting shibboleth login. If the PHP_AUTH_USER and EPPN environment variables are set, attempt a Shibboleth (passwordless) login. commit 667d0710a7854e58fb109201d9cee6ec064e793a Author: Karl Beecher Date: Mon Jul 29 11:38:04 2013 +0200 Revert "Adds the apps2 folder with user_shibboleth backend." This reverts commit 7abbdb64676d667b0c69aca37becdc47e56dc7ef. commit 7abbdb64676d667b0c69aca37becdc47e56dc7ef Author: Karl Beecher Date: Mon Jul 29 11:28:06 2013 +0200 Adds the apps2 folder with user_shibboleth backend. Conflicts: core/templates/layout.user.php lib/base.php --- core/templates/layout.user.php | 4 +- lib/base.php | 22 +++++++++- lib/connector/sabre/auth.php | 4 ++ lib/public/apachebackend.php | 41 ++++++++++++++++++ lib/user.php | 77 ++++++++++++++++++++++++++++++++++ 5 files changed, 146 insertions(+), 2 deletions(-) create mode 100644 lib/public/apachebackend.php diff --git a/core/templates/layout.user.php b/core/templates/layout.user.php index 71bec11d21..98e54a222a 100644 --- a/core/templates/layout.user.php +++ b/core/templates/layout.user.php @@ -6,6 +6,8 @@ + + <?php p(!empty($_['application'])?$_['application'].' | ':''); @@ -64,7 +66,7 @@ </li> <?php endforeach; ?> <li> - <a id="logout" href="<?php print_unescaped(link_to('', 'index.php')); ?>?logout=true"> + <a id="logout" <?php print OC_User::getLogoutAttribute(); ?>> <img class="svg" alt="" src="<?php print_unescaped(image_path('', 'actions/logout.svg')); ?>" /> <?php p($l->t('Log out'));?> </a> diff --git a/lib/base.php b/lib/base.php index 036051119d..38e981b369 100644 --- a/lib/base.php +++ b/lib/base.php @@ -489,6 +489,11 @@ class OC { if (isset($_SERVER['PHP_AUTH_USER']) && self::$session->exists('user_id') && $_SERVER['PHP_AUTH_USER'] != self::$session->get('user_id')) { + $sessionUser = self::$session->get('user_id'); + $serverUser = $_SERVER['PHP_AUTH_USER']; + OC_Log::write('core', + "Session user-id doesn't match PHP_AUTH_USER. SESSION[user_id]: $sessionUser; SERVER[PHP_AUTH_USER]: $serverUser.", + OC_Log::WARN); OC_User::logout(); } @@ -740,11 +745,22 @@ class OC { } } + public static function login($params) { + if (OC_User::isLoggedIn()) { + header("Location: " . OC::$WEBROOT . '/'); + exit(); + } + self::handleLogin(); + } + protected static function handleLogin() { OC_App::loadApps(array('prelogin')); $error = array(); + if (OC::tryApacheAuth()) { + + } // remember was checked after last login - if (OC::tryRememberLogin()) { + elseif (OC::tryRememberLogin()) { $error[] = 'invalidcookie'; // Someone wants to log in : } elseif (OC::tryFormLogin()) { @@ -765,6 +781,10 @@ class OC { } } + protected static function tryApacheAuth() { + return OC_User::handleApacheAuth(false); + } + protected static function tryRememberLogin() { if (!isset($_COOKIE["oc_remember_login"]) || !isset($_COOKIE["oc_token"]) diff --git a/lib/connector/sabre/auth.php b/lib/connector/sabre/auth.php index bf3a49593c..9b5663998f 100644 --- a/lib/connector/sabre/auth.php +++ b/lib/connector/sabre/auth.php @@ -72,6 +72,10 @@ class OC_Connector_Sabre_Auth extends Sabre_DAV_Auth_Backend_AbstractBasic { * @return bool */ public function authenticate(Sabre_DAV_Server $server, $realm) { + if (OC_User::handleApacheAuth(true)) { + return true; + } + if (OC_User::isLoggedIn()) { $user = OC_User::getUser(); OC_Util::setupFS($user); diff --git a/lib/public/apachebackend.php b/lib/public/apachebackend.php new file mode 100644 index 0000000000..24e50ab616 --- /dev/null +++ b/lib/public/apachebackend.php @@ -0,0 +1,41 @@ +<?php + +/** + * ownCloud - Apache backend + * + * @author Karl Beecher + * @copyright 2013 Karl Beecher - karl@endocode.com + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE + * License as published by the Free Software Foundation; either + * version 3 of the License, or any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU AFFERO GENERAL PUBLIC LICENSE for more details. + * + * You should have received a copy of the GNU Affero General Public + * License along with this library. If not, see <http://www.gnu.org/licenses/>. + * + */ + +namespace OCP; + +interface ApacheBackend { + + /** + * @return Returns whether Apache reports a user is currently logged in. + */ + public function isSessionActive(); + + /** + * Creates an attribute which is added to the logout hyperlink. It can + * supply any attribute(s) which are valid for <a>. + * + * @return String with one or more HTML attributes. + */ + public function getLogoutAttribute(); + +} \ No newline at end of file diff --git a/lib/user.php b/lib/user.php index 15e807088b..e0b58e22c3 100644 --- a/lib/user.php +++ b/lib/user.php @@ -213,6 +213,64 @@ class OC_User { return self::getUserSession()->login($uid, $password); } + /** + * @brief Try to login a user, assuming authentication + * has already happened (e.g. via SSO). + * + * Log in a user and regenerate a new session. + */ + public static function loginWithApache() { + + $uid = $_SERVER["PHP_AUTH_USER"]; + $run = true; + OC_Hook::emit( "OC_User", "pre_login", array( "run" => &$run, "uid" => $uid )); + + $enabled = self::isEnabled($uid); + if($uid && $enabled) { + session_regenerate_id(true); + self::setUserId($uid); + self::setDisplayName($uid); + OC_Hook::emit( "OC_User", "post_login", array( "uid" => $uid, 'password'=>'' )); + return true; + } + return false; + } + + /** + * @brief Verify with Apache whether user is authenticated. + * @note Currently supports only Shibboleth. + * + * @param $isWebdav Is this request done using webdav. + * @return true: authenticated - false: not authenticated + */ + public static function handleApacheAuth($isWebdav = false) { + foreach (self::$_usedBackends as $backend) { + if ($backend instanceof OCP\ApacheBackend) { + if ($backend->isSessionActive()) { + OC_App::loadApps(); + + //setup extra user backends + self::setupBackends(); + self::unsetMagicInCookie(); + + if (self::loginWithApache()) { + if (! $isWebdav) { + $_REQUEST['redirect_url'] = \OC_Request::requestUri(); + OC_Util::redirectToDefaultPage(); + return true; + } + else { + return true; + } + } + } + } + } + + return false; + } + + /** * @brief Sets user id for session and triggers emit */ @@ -259,6 +317,25 @@ class OC_User { return false; } + /** + * Supplies an attribute to the logout hyperlink. The default behaviuour + * is to return an href with '?logout=true' appended. However, it can + * supply any attribute(s) which are valid for <a>. + * + * @return String with one or more HTML attributes. + */ + public static function getLogoutAttribute() { + foreach (self::$_usedBackends as $backend) { + if ($backend instanceof OCP\ApacheBackend) { + if ($backend->isSessionActive()) { + return $backend->getLogoutAttribute(); + } + } + } + + return print_unescaped("href=".link_to('', 'index.php'))."?logout=true"; + } + /** * @brief Check if the user is an admin user * @param string $uid uid of the admin From d5038e93dba633cce36538905b7e5365ba1b3b63 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <thomas.mueller@tmit.eu> Date: Tue, 1 Oct 2013 14:33:56 +0200 Subject: [PATCH 10/52] use $defaults instead of $theme --- core/templates/layout.user.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/core/templates/layout.user.php b/core/templates/layout.user.php index 98e54a222a..c00cf55040 100644 --- a/core/templates/layout.user.php +++ b/core/templates/layout.user.php @@ -11,7 +11,7 @@ <head data-user="<?php p($_['user_uid']); ?>" data-requesttoken="<?php p($_['requesttoken']); ?>"> <title> <?php p(!empty($_['application'])?$_['application'].' | ':''); - p($theme->getTitle()); + p($defaults->getTitle()); p(trim($_['user_displayname']) != '' ?' ('.$_['user_displayname'].') ':'') ?> @@ -45,8 +45,8 @@