Merge pull request #1917 from nextcloud/ocjs_inline

Inline oc.js when possible!

core/Controller/OCJSController.php

@@ -0,0 +1,92 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OC\Core\Controller;
+
+use bantu\IniGetWrapper\IniGetWrapper;
+use OC\Template\JSConfigHelper;
+use OCP\App\IAppManager;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\DataDisplayResponse;
+use OCP\IConfig;
+use OCP\IGroupManager;
+use OCP\IL10N;
+use OCP\IRequest;
+use OCP\IURLGenerator;
+use OCP\IUserSession;
+
+class OCJSController extends Controller {
+
+	/** @var JSConfigHelper */
+	private $helper;
+
+	/**
+	 * OCJSController constructor.
+	 *
+	 * @param string $appName
+	 * @param IRequest $request
+	 * @param IL10N $l
+	 * @param \OC_Defaults $defaults
+	 * @param IAppManager $appManager
+	 * @param IUserSession $session
+	 * @param IConfig $config
+	 * @param IGroupManager $groupManager
+	 * @param IniGetWrapper $iniWrapper
+	 * @param IURLGenerator $urlGenerator
+	 */
+	public function __construct($appName,
+								IRequest $request,
+								IL10N $l,
+								\OC_Defaults $defaults,
+								IAppManager $appManager,
+								IUserSession $session,
+								IConfig $config,
+								IGroupManager $groupManager,
+								IniGetWrapper $iniWrapper,
+								IURLGenerator $urlGenerator) {
+		parent::__construct($appName, $request);
+
+		$this->helper = new JSConfigHelper(
+			$l,
+			$defaults,
+			$appManager,
+			$session->getUser(),
+			$config,
+			$groupManager,
+			$iniWrapper,
+			$urlGenerator
+		);
+	}
+
+	/**
+	 * @NoCSRFRequired
+	 * @PublicPage
+	 *
+	 * @return DataDisplayResponse
+	 */
+	public function getConfig() {
+		$data = $this->helper->getConfig();
+
+		return new DataDisplayResponse($data, Http::STATUS_OK, ['Content-type' => 'text/javascript']);
+	}
+}

core/routes.php

@@ -51,6 +51,7 @@ $application->registerRoutes($this, [
 		['name' => 'TwoFactorChallenge#selectChallenge', 'url' => '/login/selectchallenge', 'verb' => 'GET'],
 		['name' => 'TwoFactorChallenge#showChallenge', 'url' => '/login/challenge/{challengeProviderId}', 'verb' => 'GET'],
 		['name' => 'TwoFactorChallenge#solveChallenge', 'url' => '/login/challenge/{challengeProviderId}', 'verb' => 'POST'],
+		['name' => 'OCJS#getConfig', 'url' => '/core/js/oc.js', 'verb' => 'GET'],
 	],
 	'ocs' => [
 		['root' => '/cloud', 'name' => 'OCS#getCapabilities', 'url' => '/capabilities', 'verb' => 'GET'],
@@ -66,9 +67,6 @@ $application->registerRoutes($this, [
 // Search
 $this->create('search_ajax_search', '/core/search')
 	->actionInclude('core/search/ajax/search.php');
-// oC JS config
-$this->create('js_config', '/core/js/oc.js')
-	->actionInclude('core/js/config.php');
 // Routing
 $this->create('core_ajax_preview', '/core/preview')
 	->actionInclude('core/ajax/preview.php');

core/templates/layout.base.php

@@ -18,6 +18,11 @@
 		<?php foreach($_['printcssfiles'] as $cssfile): ?>
 			<link rel="stylesheet" href="<?php print_unescaped($cssfile); ?>" media="print">
 		<?php endforeach; ?>
+		<?php if (isset($_['inline_ocjs'])): ?>
+			<script nonce="<?php p(\OC::$server->getContentSecurityPolicyNonceManager()->getNonce()) ?>" type="text/javascript">
+				<?php print_unescaped($_['inline_ocjs']); ?>
+			</script>
+		<?php endif; ?>
 		<?php foreach ($_['jsfiles'] as $jsfile): ?>
 			<script nonce="<?php p(\OC::$server->getContentSecurityPolicyNonceManager()->getNonce()) ?>" src="<?php print_unescaped($jsfile); ?>"></script>
 		<?php endforeach; ?>

core/templates/layout.guest.php

@@ -19,6 +19,11 @@
 		<?php foreach($_['printcssfiles'] as $cssfile): ?>
 			<link rel="stylesheet" href="<?php print_unescaped($cssfile); ?>" media="print">
 		<?php endforeach; ?>
+		<?php if (isset($_['inline_ocjs'])): ?>
+			<script nonce="<?php p(\OC::$server->getContentSecurityPolicyNonceManager()->getNonce()) ?>" type="text/javascript">
+				<?php print_unescaped($_['inline_ocjs']); ?>
+			</script>
+		<?php endif; ?>
 		<?php foreach($_['jsfiles'] as $jsfile): ?>
 			<script nonce="<?php p(\OC::$server->getContentSecurityPolicyNonceManager()->getNonce()) ?>" src="<?php print_unescaped($jsfile); ?>"></script>
 		<?php endforeach; ?>

core/templates/layout.user.php

@@ -26,6 +26,11 @@
 		<?php foreach($_['printcssfiles'] as $cssfile): ?>
 			<link rel="stylesheet" href="<?php print_unescaped($cssfile); ?>" media="print">
 		<?php endforeach; ?>
+		<?php if (isset($_['inline_ocjs'])): ?>
+			<script nonce="<?php p(\OC::$server->getContentSecurityPolicyNonceManager()->getNonce()) ?>" type="text/javascript">
+				<?php print_unescaped($_['inline_ocjs']); ?>
+			</script>
+		<?php endif; ?>
 		<?php foreach($_['jsfiles'] as $jsfile): ?>
 			<script nonce="<?php p(\OC::$server->getContentSecurityPolicyNonceManager()->getNonce()) ?>" src="<?php print_unescaped($jsfile); ?>"></script>
 		<?php endforeach; ?>

lib/composer/composer/autoload_classmap.php

@@ -402,6 +402,7 @@ return array(
     'OC\\Core\\Controller\\AvatarController' => $baseDir . '/core/Controller/AvatarController.php',
     'OC\\Core\\Controller\\LoginController' => $baseDir . '/core/Controller/LoginController.php',
     'OC\\Core\\Controller\\LostController' => $baseDir . '/core/Controller/LostController.php',
+    'OC\\Core\\Controller\\OCJSController' => $baseDir . '/core/Controller/OCJSController.php',
     'OC\\Core\\Controller\\OCSController' => $baseDir . '/core/Controller/OCSController.php',
     'OC\\Core\\Controller\\SetupController' => $baseDir . '/core/Controller/SetupController.php',
     'OC\\Core\\Controller\\TwoFactorChallengeController' => $baseDir . '/core/Controller/TwoFactorChallengeController.php',
@@ -752,6 +753,7 @@ return array(
     'OC\\TemplateLayout' => $baseDir . '/lib/private/TemplateLayout.php',
     'OC\\Template\\Base' => $baseDir . '/lib/private/Template/Base.php',
     'OC\\Template\\CSSResourceLocator' => $baseDir . '/lib/private/Template/CSSResourceLocator.php',
+    'OC\\Template\\JSConfigHelper' => $baseDir . '/lib/private/Template/JSConfigHelper.php',
     'OC\\Template\\JSResourceLocator' => $baseDir . '/lib/private/Template/JSResourceLocator.php',
     'OC\\Template\\ResourceLocator' => $baseDir . '/lib/private/Template/ResourceLocator.php',
     'OC\\Template\\ResourceNotFoundException' => $baseDir . '/lib/private/Template/ResourceNotFoundException.php',

lib/composer/composer/autoload_static.php

@@ -432,6 +432,7 @@ class ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c
         'OC\\Core\\Controller\\AvatarController' => __DIR__ . '/../../..' . '/core/Controller/AvatarController.php',
         'OC\\Core\\Controller\\LoginController' => __DIR__ . '/../../..' . '/core/Controller/LoginController.php',
         'OC\\Core\\Controller\\LostController' => __DIR__ . '/../../..' . '/core/Controller/LostController.php',
+        'OC\\Core\\Controller\\OCJSController' => __DIR__ . '/../../..' . '/core/Controller/OCJSController.php',
         'OC\\Core\\Controller\\OCSController' => __DIR__ . '/../../..' . '/core/Controller/OCSController.php',
         'OC\\Core\\Controller\\SetupController' => __DIR__ . '/../../..' . '/core/Controller/SetupController.php',
         'OC\\Core\\Controller\\TwoFactorChallengeController' => __DIR__ . '/../../..' . '/core/Controller/TwoFactorChallengeController.php',
@@ -782,6 +783,7 @@ class ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c
         'OC\\TemplateLayout' => __DIR__ . '/../../..' . '/lib/private/TemplateLayout.php',
         'OC\\Template\\Base' => __DIR__ . '/../../..' . '/lib/private/Template/Base.php',
         'OC\\Template\\CSSResourceLocator' => __DIR__ . '/../../..' . '/lib/private/Template/CSSResourceLocator.php',
+        'OC\\Template\\JSConfigHelper' => __DIR__ . '/../../..' . '/lib/private/Template/JSConfigHelper.php',
         'OC\\Template\\JSResourceLocator' => __DIR__ . '/../../..' . '/lib/private/Template/JSResourceLocator.php',
         'OC\\Template\\ResourceLocator' => __DIR__ . '/../../..' . '/lib/private/Template/ResourceLocator.php',
         'OC\\Template\\ResourceNotFoundException' => __DIR__ . '/../../..' . '/lib/private/Template/ResourceNotFoundException.php',

lib/private/AppFramework/DependencyInjection/DIContainer.php

@@ -380,7 +380,8 @@ class DIContainer extends SimpleContainer implements IAppContainer {
 				$app->isLoggedIn(),
 				$app->isAdminUser(),
 				$app->getServer()->getContentSecurityPolicyManager(),
-				$app->getServer()->getCsrfTokenManager()
+				$app->getServer()->getCsrfTokenManager(),
+				$app->getServer()->getContentSecurityPolicyNonceManager()
 			);
 		});
 

lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php

@@ -36,6 +36,7 @@ use OC\AppFramework\Middleware\Security\Exceptions\NotLoggedInException;
 use OC\AppFramework\Middleware\Security\Exceptions\StrictCookieMissingException;
 use OC\AppFramework\Utility\ControllerMethodReflector;
 use OC\Security\CSP\ContentSecurityPolicyManager;
+use OC\Security\CSP\ContentSecurityPolicyNonceManager;
 use OC\Security\CSRF\CsrfTokenManager;
 use OCP\AppFramework\Http\ContentSecurityPolicy;
 use OCP\AppFramework\Http\EmptyContentSecurityPolicy;
@@ -80,6 +81,8 @@ class SecurityMiddleware extends Middleware {
 	private $contentSecurityPolicyManager;
 	/** @var CsrfTokenManager */
 	private $csrfTokenManager;
+	/** @var ContentSecurityPolicyNonceManager */
+	private $cspNonceManager;
 
 	/**
 	 * @param IRequest $request
@@ -92,6 +95,7 @@ class SecurityMiddleware extends Middleware {
 	 * @param bool $isAdminUser
 	 * @param ContentSecurityPolicyManager $contentSecurityPolicyManager
 	 * @param CSRFTokenManager $csrfTokenManager
+	 * @param ContentSecurityPolicyNonceManager $cspNonceManager
 	 */
 	public function __construct(IRequest $request,
 								ControllerMethodReflector $reflector,
@@ -102,7 +106,8 @@ class SecurityMiddleware extends Middleware {
 								$isLoggedIn,
 								$isAdminUser,
 								ContentSecurityPolicyManager $contentSecurityPolicyManager,
-								CsrfTokenManager $csrfTokenManager) {
+								CsrfTokenManager $csrfTokenManager,
+								ContentSecurityPolicyNonceManager $cspNonceManager) {
 		$this->navigationManager = $navigationManager;
 		$this->request = $request;
 		$this->reflector = $reflector;
@@ -113,6 +118,7 @@ class SecurityMiddleware extends Middleware {
 		$this->isAdminUser = $isAdminUser;
 		$this->contentSecurityPolicyManager = $contentSecurityPolicyManager;
 		$this->csrfTokenManager = $csrfTokenManager;
+		$this->cspNonceManager = $cspNonceManager;
 	}
 
 
@@ -177,23 +183,6 @@ class SecurityMiddleware extends Middleware {
 
 	}
 
-	private function browserSupportsCspV3() {
-		$browserWhitelist = [
-			// Chrome 40+
-			'/^Mozilla\/5\.0 \([^)]+\) AppleWebKit\/[0-9.]+ \(KHTML, like Gecko\) Chrome\/[4-9][0-9].[0-9.]+ (Mobile Safari|Safari)\/[0-9.]+$/',
-			// Firefox 45+
-			'/^Mozilla\/5\.0 \([^)]+\) Gecko\/[0-9.]+ Firefox\/(4[5-9]|[5-9][0-9])\.[0-9.]+$/',
-			// Safari 10+
-			'/^Mozilla\/5\.0 \([^)]+\) AppleWebKit\/[0-9.]+ \(KHTML, like Gecko\) Version\/1[0-9.]+ Safari\/[0-9.A-Z]+$/',
-		];
-
-		if($this->request->isUserAgent($browserWhitelist)) {
-			return true;
-		}
-
-		return false;
-	}
-
 	/**
 	 * Performs the default CSP modifications that may be injected by other
 	 * applications
@@ -213,7 +202,7 @@ class SecurityMiddleware extends Middleware {
 		$defaultPolicy = $this->contentSecurityPolicyManager->getDefaultPolicy();
 		$defaultPolicy = $this->contentSecurityPolicyManager->mergePolicies($defaultPolicy, $policy);
 
-		if($this->browserSupportsCspV3()) {
+		if($this->cspNonceManager->browserSupportsCspV3()) {
 			$defaultPolicy->useJsNonce($this->csrfTokenManager->getToken()->getEncryptedValue());
 		}
 

lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php

@@ -22,6 +22,7 @@
 namespace OC\Security\CSP;
 
 use OC\Security\CSRF\CsrfTokenManager;
+use OCP\IRequest;
 
 /**
  * @package OC\Security\CSP
@@ -29,14 +30,19 @@ use OC\Security\CSRF\CsrfTokenManager;
 class ContentSecurityPolicyNonceManager {
 	/** @var CsrfTokenManager */
 	private $csrfTokenManager;
+	/** @var IRequest */
+	private $request;
 	/** @var string */
 	private $nonce = '';
 
 	/**
 	 * @param CsrfTokenManager $csrfTokenManager
+	 * @param IRequest $request
 	 */
-	public function __construct(CsrfTokenManager $csrfTokenManager) {
+	public function __construct(CsrfTokenManager $csrfTokenManager,
+								IRequest $request) {
 		$this->csrfTokenManager = $csrfTokenManager;
+		$this->request = $request;
 	}
 
 	/**
@@ -51,4 +57,26 @@ class ContentSecurityPolicyNonceManager {
 
 		return $this->nonce;
 	}
+
+	/**
+	 * Check if the browser supports CSP v3
+	 *
+	 * @return bool
+	 */
+	public function browserSupportsCspV3() {
+		$browserWhitelist = [
+			// Chrome 40+
+			'/^Mozilla\/5\.0 \([^)]+\) AppleWebKit\/[0-9.]+ \(KHTML, like Gecko\) Chrome\/[4-9][0-9].[0-9.]+ (Mobile Safari|Safari)\/[0-9.]+$/',
+			// Firefox 45+
+			'/^Mozilla\/5\.0 \([^)]+\) Gecko\/[0-9.]+ Firefox\/(4[5-9]|[5-9][0-9])\.[0-9.]+$/',
+			// Safari 10+
+			'/^Mozilla\/5\.0 \([^)]+\) AppleWebKit\/[0-9.]+ \(KHTML, like Gecko\) Version\/1[0-9.]+ Safari\/[0-9.A-Z]+$/',
+		];
+
+		if($this->request->isUserAgent($browserWhitelist)) {
+			return true;
+		}
+
+		return false;
+	}
 }

lib/private/Server.php

@@ -711,7 +711,8 @@ class Server extends ServerContainer implements IServerContainer {
 		});
 		$this->registerService('ContentSecurityPolicyNonceManager', function(Server $c) {
 			return new ContentSecurityPolicyNonceManager(
-				$c->getCsrfTokenManager()
+				$c->getCsrfTokenManager(),
+				$c->getRequest()
 			);
 		});
 		$this->registerService('ShareManager', function(Server $c) {

lib/private/Template/JSConfigHelper.php

@@ -0,0 +1,243 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OC\Template;
+
+use bantu\IniGetWrapper\IniGetWrapper;
+use OCP\App\IAppManager;
+use OCP\IConfig;
+use OCP\IGroupManager;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\IUser;
+
+class JSConfigHelper {
+
+	/** @var IL10N */
+	private $l;
+
+	/** @var \OC_Defaults */
+	private $defaults;
+
+	/** @var IAppManager */
+	private $appManager;
+
+	/** @var IUser */
+	private $currentUser;
+
+	/** @var IConfig */
+	private $config;
+
+	/** @var IGroupManager */
+	private $groupManager;
+
+	/** @var IniGetWrapper */
+	private $iniWrapper;
+
+	/** @var IURLGenerator */
+	private $urlGenerator;
+
+	/**
+	 * @param IL10N $l
+	 * @param \OC_Defaults $defaults
+	 * @param IAppManager $appManager
+	 * @param IUser|null $currentUser
+	 * @param IConfig $config
+	 * @param IGroupManager $groupManager
+	 * @param IniGetWrapper $iniWrapper
+	 * @param IURLGenerator $urlGenerator
+	 */
+	public function __construct(IL10N $l,
+								\OC_Defaults $defaults,
+								IAppManager $appManager,
+								$currentUser,
+								IConfig $config,
+								IGroupManager $groupManager,
+								IniGetWrapper $iniWrapper,
+								IURLGenerator $urlGenerator) {
+		$this->l = $l;
+		$this->defaults = $defaults;
+		$this->appManager = $appManager;
+		$this->currentUser = $currentUser;
+		$this->config = $config;
+		$this->groupManager = $groupManager;
+		$this->iniWrapper = $iniWrapper;
+		$this->urlGenerator = $urlGenerator;
+	}
+
+	public function getConfig() {
+
+		if ($this->currentUser !== null) {
+			$uid = $this->currentUser->getUID();
+		} else {
+			$uid = null;
+		}
+
+		// Get the config
+		$apps_paths = [];
+
+		if ($this->currentUser === null) {
+			$apps = $this->appManager->getInstalledApps();
+		} else {
+			$apps = $this->appManager->getEnabledAppsForUser($this->currentUser);
+		}
+
+		foreach($apps as $app) {
+			$apps_paths[$app] = \OC_App::getAppWebPath($app);
+		}
+
+		$defaultExpireDateEnabled = $this->config->getAppValue('core', 'shareapi_default_expire_date', 'no') === 'yes';
+		$defaultExpireDate = $enforceDefaultExpireDate = null;
+		if ($defaultExpireDateEnabled) {
+			$defaultExpireDate = (int) $this->config->getAppValue('core', 'shareapi_expire_after_n_days', '7');
+			$enforceDefaultExpireDate = $this->config->getAppValue('core', 'shareapi_enforce_expire_date', 'no') === 'yes';
+		}
+		$outgoingServer2serverShareEnabled = $this->config->getAppValue('files_sharing', 'outgoing_server2server_share_enabled', 'yes') === 'yes';
+
+		$countOfDataLocation = 0;
+		$dataLocation = str_replace(\OC::$SERVERROOT .'/', '', $this->config->getSystemValue('datadirectory', ''), $countOfDataLocation);
+		if($countOfDataLocation !== 1 || !$this->groupManager->isAdmin($uid)) {
+			$dataLocation = false;
+		}
+
+		$array = [
+			"oc_debug" => $this->config->getSystemValue('debug', false) ? 'true' : 'false',
+			"oc_isadmin" => $this->groupManager->isAdmin($uid) ? 'true' : 'false',
+			"oc_dataURL" => is_string($dataLocation) ? "\"".$dataLocation."\"" : 'false',
+			"oc_webroot" => "\"".\OC::$WEBROOT."\"",
+			"oc_appswebroots" =>  str_replace('\\/', '/', json_encode($apps_paths)), // Ugly unescape slashes waiting for better solution
+			"datepickerFormatDate" => json_encode($this->l->l('jsdate', null)),
+			"dayNames" =>  json_encode([
+				(string)$this->l->t('Sunday'),
+				(string)$this->l->t('Monday'),
+				(string)$this->l->t('Tuesday'),
+				(string)$this->l->t('Wednesday'),
+				(string)$this->l->t('Thursday'),
+				(string)$this->l->t('Friday'),
+				(string)$this->l->t('Saturday')
+			]),
+			"dayNamesShort" =>  json_encode([
+				(string)$this->l->t('Sun.'),
+				(string)$this->l->t('Mon.'),
+				(string)$this->l->t('Tue.'),
+				(string)$this->l->t('Wed.'),
+				(string)$this->l->t('Thu.'),
+				(string)$this->l->t('Fri.'),
+				(string)$this->l->t('Sat.')
+			]),
+			"dayNamesMin" =>  json_encode([
+				(string)$this->l->t('Su'),
+				(string)$this->l->t('Mo'),
+				(string)$this->l->t('Tu'),
+				(string)$this->l->t('We'),
+				(string)$this->l->t('Th'),
+				(string)$this->l->t('Fr'),
+				(string)$this->l->t('Sa')
+			]),
+			"monthNames" => json_encode([
+				(string)$this->l->t('January'),
+				(string)$this->l->t('February'),
+				(string)$this->l->t('March'),
+				(string)$this->l->t('April'),
+				(string)$this->l->t('May'),
+				(string)$this->l->t('June'),
+				(string)$this->l->t('July'),
+				(string)$this->l->t('August'),
+				(string)$this->l->t('September'),
+				(string)$this->l->t('October'),
+				(string)$this->l->t('November'),
+				(string)$this->l->t('December')
+			]),
+			"monthNamesShort" => json_encode([
+				(string)$this->l->t('Jan.'),
+				(string)$this->l->t('Feb.'),
+				(string)$this->l->t('Mar.'),
+				(string)$this->l->t('Apr.'),
+				(string)$this->l->t('May.'),
+				(string)$this->l->t('Jun.'),
+				(string)$this->l->t('Jul.'),
+				(string)$this->l->t('Aug.'),
+				(string)$this->l->t('Sep.'),
+				(string)$this->l->t('Oct.'),
+				(string)$this->l->t('Nov.'),
+				(string)$this->l->t('Dec.')
+			]),
+			"firstDay" => json_encode($this->l->l('firstday', null)) ,
+			"oc_config" => json_encode([
+				'session_lifetime'	=> min($this->config->getSystemValue('session_lifetime', $this->iniWrapper->getNumeric('session.gc_maxlifetime')), $this->iniWrapper->getNumeric('session.gc_maxlifetime')),
+				'session_keepalive'	=> $this->config->getSystemValue('session_keepalive', true),
+				'version'			=> implode('.', \OCP\Util::getVersion()),
+				'versionstring'		=> \OC_Util::getVersionString(),
+				'enable_avatars'	=> $this->config->getSystemValue('enable_avatars', true) === true,
+				'lost_password_link'=> $this->config->getSystemValue('lost_password_link', null),
+				'modRewriteWorking'	=> (getenv('front_controller_active') === 'true'),
+			]),
+			"oc_appconfig" => json_encode([
+				'core' => [
+					'defaultExpireDateEnabled' => $defaultExpireDateEnabled,
+					'defaultExpireDate' => $defaultExpireDate,
+					'defaultExpireDateEnforced' => $enforceDefaultExpireDate,
+					'enforcePasswordForPublicLink' => \OCP\Util::isPublicLinkPasswordRequired(),
+					'sharingDisabledForUser' => \OCP\Util::isSharingDisabledForUser(),
+					'resharingAllowed' => \OCP\Share::isResharingAllowed(),
+					'remoteShareAllowed' => $outgoingServer2serverShareEnabled,
+					'federatedCloudShareDoc' => $this->urlGenerator->linkToDocs('user-sharing-federated'),
+					'allowGroupSharing' => \OC::$server->getShareManager()->allowGroupSharing()
+				]
+			]),
+			"oc_defaults" => json_encode([
+				'entity' => $this->defaults->getEntity(),
+				'name' => $this->defaults->getName(),
+				'title' => $this->defaults->getTitle(),
+				'baseUrl' => $this->defaults->getBaseUrl(),
+				'syncClientUrl' => $this->defaults->getSyncClientUrl(),
+				'docBaseUrl' => $this->defaults->getDocBaseUrl(),
+				'docPlaceholderUrl' => $this->defaults->buildDocLinkToKey('PLACEHOLDER'),
+				'slogan' => $this->defaults->getSlogan(),
+				'logoClaim' => $this->defaults->getLogoClaim(),
+				'shortFooter' => $this->defaults->getShortFooter(),
+				'longFooter' => $this->defaults->getLongFooter(),
+				'folder' => \OC_Util::getTheme(),
+			]),
+		];
+
+		if ($this->currentUser !== null) {
+			$array['oc_userconfig'] = json_encode([
+				'avatar' => [
+					'version' => (int)$this->config->getUserValue($uid, 'avatar', 'version', 0),
+				]
+			]);
+		}
+
+		// Allow hooks to modify the output values
+		\OC_Hook::emit('\OCP\Config', 'js', array('array' => &$array));
+
+		$result = '';
+
+		// Echo it
+		foreach ($array as  $setting => $value) {
+			$result .= 'var '. $setting . '='. $value . ';' . PHP_EOL;
+		}
+
+		return $result;
+	}
+}

lib/private/TemplateLayout.php

@@ -43,6 +43,7 @@ use Assetic\Filter\CssMinFilter;
 use Assetic\Filter\CssRewriteFilter;
 use Assetic\Filter\JSqueezeFilter;
 use Assetic\Filter\SeparatorFilter;
+use OC\Template\JSConfigHelper;
 
 class TemplateLayout extends \OC_Template {
 
@@ -142,7 +143,22 @@ class TemplateLayout extends \OC_Template {
 		$jsFiles = self::findJavascriptFiles(\OC_Util::$scripts);
 		$this->assign('jsfiles', array());
 		if ($this->config->getSystemValue('installed', false) && $renderAs != 'error') {
-			$this->append( 'jsfiles', \OC::$server->getURLGenerator()->linkToRoute('js_config', ['v' => self::$versionHash]));
+			if (\OC::$server->getContentSecurityPolicyNonceManager()->browserSupportsCspV3()) {
+				$jsConfigHelper = new JSConfigHelper(
+					\OC::$server->getL10N('core'),
+					\OC::$server->getThemingDefaults(),
+					\OC::$server->getAppManager(),
+					\OC::$server->getUserSession()->getUser(),
+					\OC::$server->getConfig(),
+					\OC::$server->getGroupManager(),
+					\OC::$server->getIniWrapper(),
+					\OC::$server->getURLGenerator()
+				);
+				$this->assign('inline_ocjs', $jsConfigHelper->getConfig());
+				$this->assign('foo', 'bar');
+			} else {
+				$this->append('jsfiles', \OC::$server->getURLGenerator()->linkToRoute('core.OCJS.getConfig', ['v' => self::$versionHash]));
+			}
 		}
 		foreach($jsFiles as $info) {
 			$web = $info[1];

tests/lib/AppFramework/Middleware/Security/SecurityMiddlewareTest.php

@@ -36,6 +36,7 @@ use OC\AppFramework\Middleware\Security\SecurityMiddleware;
 use OC\AppFramework\Utility\ControllerMethodReflector;
 use OC\Security\CSP\ContentSecurityPolicy;
 use OC\Security\CSP\ContentSecurityPolicyManager;
+use OC\Security\CSP\ContentSecurityPolicyNonceManager;
 use OC\Security\CSRF\CsrfToken;
 use OC\Security\CSRF\CsrfTokenManager;
 use OCP\AppFramework\Controller;
@@ -76,6 +77,8 @@ class SecurityMiddlewareTest extends \Test\TestCase {
 	private $contentSecurityPolicyManager;
 	/** @var CsrfTokenManager|\PHPUnit_Framework_MockObject_MockObject */
 	private $csrfTokenManager;
+	/** @var ContentSecurityPolicyNonceManager|\PHPUnit_Framework_MockObject_MockObject */
+	private $cspNonceManager;
 
 	protected function setUp() {
 		parent::setUp();
@@ -88,6 +91,7 @@ class SecurityMiddlewareTest extends \Test\TestCase {
 		$this->request = $this->createMock(IRequest::class);
 		$this->contentSecurityPolicyManager = $this->createMock(ContentSecurityPolicyManager::class);
 		$this->csrfTokenManager = $this->createMock(CsrfTokenManager::class);
+		$this->cspNonceManager = $this->createMock(ContentSecurityPolicyNonceManager::class);
 		$this->middleware = $this->getMiddleware(true, true);
 		$this->secException = new SecurityException('hey', false);
 		$this->secAjaxException = new SecurityException('hey', true);
@@ -109,7 +113,8 @@ class SecurityMiddlewareTest extends \Test\TestCase {
 			$isLoggedIn,
 			$isAdminUser,
 			$this->contentSecurityPolicyManager,
-			$this->csrfTokenManager
+			$this->csrfTokenManager,
+			$this->cspNonceManager
 		);
 	}
 
@@ -559,9 +564,9 @@ class SecurityMiddlewareTest extends \Test\TestCase {
 	}
 
 	public function testAfterController() {
-		$this->request
+		$this->cspNonceManager
 			->expects($this->once())
-			->method('isUserAgent')
+			->method('browserSupportsCspV3')
 			->willReturn(false);
 		$response = $this->createMock(Response::class);
 		$defaultPolicy = new ContentSecurityPolicy();
@@ -603,9 +608,9 @@ class SecurityMiddlewareTest extends \Test\TestCase {
 	}
 
 	public function testAfterControllerWithContentSecurityPolicy3Support() {
-		$this->request
+		$this->cspNonceManager
 			->expects($this->once())
-			->method('isUserAgent')
+			->method('browserSupportsCspV3')
 			->willReturn(true);
 		$token = $this->createMock(CsrfToken::class);
 		$token

tests/lib/Security/CSP/ContentSecurityPolicyNonceManagerTest.php

@@ -24,6 +24,7 @@ namespace Test\Security\CSP;
 use OC\Security\CSP\ContentSecurityPolicyNonceManager;
 use OC\Security\CSRF\CsrfToken;
 use OC\Security\CSRF\CsrfTokenManager;
+use OCP\IRequest;
 use Test\TestCase;
 
 class ContentSecurityPolicyNonceManagerTest extends TestCase  {
@@ -35,7 +36,8 @@ class ContentSecurityPolicyNonceManagerTest extends TestCase  {
 	public function setUp() {
 		$this->csrfTokenManager = $this->createMock(CsrfTokenManager::class);
 		$this->nonceManager = new ContentSecurityPolicyNonceManager(
-			$this->csrfTokenManager
+			$this->csrfTokenManager,
+			$this->createMock(IRequest::class)
 		);
 	}