From faf48e42b7a9bf208bd2e16baa0a9cc4c602dce3 Mon Sep 17 00:00:00 2001 From: Vincent Chan Date: Mon, 1 Feb 2016 18:14:10 +0100 Subject: [PATCH] Move data protection check to javascript fixes #20199 --- core/js/config.php | 8 +++ core/js/setupchecks.js | 31 +++++++-- core/js/tests/specs/setupchecksSpec.js | 67 +++++++++++++------ settings/controller/checksetupcontroller.php | 1 - settings/js/admin.js | 7 +- .../controller/CheckSetupControllerTest.php | 5 -- 6 files changed, 83 insertions(+), 36 deletions(-) diff --git a/core/js/config.php b/core/js/config.php index 9ea8f3864d..0eb059051c 100644 --- a/core/js/config.php +++ b/core/js/config.php @@ -62,9 +62,17 @@ if ($defaultExpireDateEnabled) { } $outgoingServer2serverShareEnabled = $config->getAppValue('files_sharing', 'outgoing_server2server_share_enabled', 'yes') === 'yes'; +$CountOfDataLocation = 0; + +$DataLocation = str_replace(OC::$SERVERROOT .'/', '', $config->getSystemValue('datadirectory', ''), $CountOfDataLocation); +if($CountOfDataLocation !== 1 || !OC_User::isAdminUser(OC_User::getUser())){ + $DataLocation = false; +} + $array = array( "oc_debug" => $config->getSystemValue('debug', false) ? 'true' : 'false', "oc_isadmin" => OC_User::isAdminUser(OC_User::getUser()) ? 'true' : 'false', + "oc_dataURL" => is_string($DataLocation) ? "\"".$DataLocation."\"" : 'false', "oc_webroot" => "\"".OC::$WEBROOT."\"", "oc_appswebroots" => str_replace('\\/', '/', json_encode($apps_paths)), // Ugly unescape slashes waiting for better solution "datepickerFormatDate" => json_encode($l->l('jsdate', null)), diff --git a/core/js/setupchecks.js b/core/js/setupchecks.js index 2fa119334d..bc49c61a5a 100644 --- a/core/js/setupchecks.js +++ b/core/js/setupchecks.js @@ -15,7 +15,6 @@ MESSAGE_TYPE_INFO:0, MESSAGE_TYPE_WARNING:1, MESSAGE_TYPE_ERROR:2, - /** * Check whether the WebDAV connection works. * @@ -97,12 +96,6 @@ type: OC.SetupChecks.MESSAGE_TYPE_WARNING }); } - if(!data.dataDirectoryProtected) { - messages.push({ - msg: t('core', 'Your data directory and your files are probably accessible from the Internet. The .htaccess file is not working. We strongly suggest that you configure your web server in a way that the data directory is no longer accessible or you move the data directory outside the web server document root.'), - type: OC.SetupChecks.MESSAGE_TYPE_ERROR - }); - } if(!data.isMemcacheConfigured) { messages.push({ msg: t('core', 'No memory cache has been configured. To enhance your performance please configure a memcache if available. Further information can be found in our documentation.', {docLink: data.memcacheDocs}), @@ -194,6 +187,30 @@ return deferred.promise(); }, + checkDataProtected: function() { + var deferred = $.Deferred(); + if(oc_dataURL === false){ + return deferred.resolve([]); + } + var afterCall = function(xhr) { + var messages = []; + if (xhr.status !== 403 && xhr.status !== 307 && xhr.status !== 301) { + messages.push({ + msg: t('core', 'Your data directory and your files are probably accessible from the Internet. The .htaccess file is not working. We strongly suggest that you configure your web server in a way that the data directory is no longer accessible or you move the data directory outside the web server document root.'), + type: OC.SetupChecks.MESSAGE_TYPE_ERROR + }); + } + deferred.resolve(messages); + }; + + $.ajax({ + type: 'GET', + url: OC.linkTo('', oc_dataURL+'/.ocdata'), + complete: afterCall + }); + return deferred.promise(); + }, + /** * Runs check for some generic security headers on the server side * diff --git a/core/js/tests/specs/setupchecksSpec.js b/core/js/tests/specs/setupchecksSpec.js index fff169ec09..59df3a5874 100644 --- a/core/js/tests/specs/setupchecksSpec.js +++ b/core/js/tests/specs/setupchecksSpec.js @@ -96,6 +96,49 @@ describe('OC.SetupChecks tests', function() { }); }); + describe('checkDataProtected', function() { + + oc_dataURL = "data"; + + it('should return an error if data directory is not protected', function(done) { + var async = OC.SetupChecks.checkDataProtected(); + + suite.server.requests[0].respond(200); + + async.done(function( data, s, x ){ + expect(data).toEqual([ + { + msg: 'Your data directory and your files are probably accessible from the Internet. The .htaccess file is not working. We strongly suggest that you configure your web server in a way that the data directory is no longer accessible or you move the data directory outside the web server document root.', + type: OC.SetupChecks.MESSAGE_TYPE_ERROR + }]); + done(); + }); + }); + + it('should not return an error if data directory is protected', function(done) { + var async = OC.SetupChecks.checkDataProtected(); + + suite.server.requests[0].respond(403); + + async.done(function( data, s, x ){ + expect(data).toEqual([]); + done(); + }); + }); + + it('should return an error if data directory is a boolean', function(done) { + + oc_dataURL = false; + + var async = OC.SetupChecks.checkDataProtected(); + + async.done(function( data, s, x ){ + expect(data).toEqual([]); + done(); + }); + }); + }); + describe('checkSetup', function() { it('should return an error if server has no internet connection', function(done) { var async = OC.SetupChecks.checkSetup(); @@ -120,9 +163,6 @@ describe('OC.SetupChecks tests', function() { { msg: 'This server has no working Internet connection. This means that some of the features like mounting external storage, notifications about updates or installation of third-party apps will not work. Accessing files remotely and sending of notification emails might not work, either. We suggest to enable Internet connection for this server if you want to have all features.', type: OC.SetupChecks.MESSAGE_TYPE_WARNING - }, { - msg: 'Your data directory and your files are probably accessible from the Internet. The .htaccess file is not working. We strongly suggest that you configure your web server in a way that the data directory is no longer accessible or you move the data directory outside the web server document root.', - type: OC.SetupChecks.MESSAGE_TYPE_ERROR }, { msg: 'No memory cache has been configured. To enhance your performance please configure a memcache if available. Further information can be found in our documentation.', type: OC.SetupChecks.MESSAGE_TYPE_INFO @@ -142,7 +182,6 @@ describe('OC.SetupChecks tests', function() { JSON.stringify({ isUrandomAvailable: true, serverHasInternetConnection: false, - dataDirectoryProtected: false, memcacheDocs: 'https://doc.owncloud.org/server/go.php?to=admin-performance', forwardedForHeadersWorking: true, isCorrectMemcachedPHPModuleInstalled: true, @@ -156,10 +195,6 @@ describe('OC.SetupChecks tests', function() { msg: 'This server has no working Internet connection. This means that some of the features like mounting external storage, notifications about updates or installation of third-party apps will not work. Accessing files remotely and sending of notification emails might not work, either. We suggest to enable Internet connection for this server if you want to have all features.', type: OC.SetupChecks.MESSAGE_TYPE_WARNING }, - { - msg: 'Your data directory and your files are probably accessible from the Internet. The .htaccess file is not working. We strongly suggest that you configure your web server in a way that the data directory is no longer accessible or you move the data directory outside the web server document root.', - type: OC.SetupChecks.MESSAGE_TYPE_ERROR - }, { msg: 'No memory cache has been configured. To enhance your performance please configure a memcache if available. Further information can be found in our documentation.', type: OC.SetupChecks.MESSAGE_TYPE_INFO @@ -179,7 +214,6 @@ describe('OC.SetupChecks tests', function() { JSON.stringify({ isUrandomAvailable: true, serverHasInternetConnection: false, - dataDirectoryProtected: false, isMemcacheConfigured: true, forwardedForHeadersWorking: true, isCorrectMemcachedPHPModuleInstalled: true, @@ -192,11 +226,8 @@ describe('OC.SetupChecks tests', function() { { msg: 'This server has no working Internet connection. This means that some of the features like mounting external storage, notifications about updates or installation of third-party apps will not work. Accessing files remotely and sending of notification emails might not work, either. We suggest to enable Internet connection for this server if you want to have all features.', type: OC.SetupChecks.MESSAGE_TYPE_WARNING - }, - { - msg: 'Your data directory and your files are probably accessible from the Internet. The .htaccess file is not working. We strongly suggest that you configure your web server in a way that the data directory is no longer accessible or you move the data directory outside the web server document root.', - type: OC.SetupChecks.MESSAGE_TYPE_ERROR - }]); + } + ]); done(); }); }); @@ -213,7 +244,6 @@ describe('OC.SetupChecks tests', function() { isUrandomAvailable: false, securityDocs: 'https://docs.owncloud.org/myDocs.html', serverHasInternetConnection: true, - dataDirectoryProtected: true, isMemcacheConfigured: true, forwardedForHeadersWorking: true, isCorrectMemcachedPHPModuleInstalled: true, @@ -242,7 +272,6 @@ describe('OC.SetupChecks tests', function() { isUrandomAvailable: true, securityDocs: 'https://docs.owncloud.org/myDocs.html', serverHasInternetConnection: true, - dataDirectoryProtected: true, isMemcacheConfigured: true, forwardedForHeadersWorking: true, isCorrectMemcachedPHPModuleInstalled: false, @@ -270,7 +299,6 @@ describe('OC.SetupChecks tests', function() { JSON.stringify({ isUrandomAvailable: true, serverHasInternetConnection: true, - dataDirectoryProtected: true, isMemcacheConfigured: true, forwardedForHeadersWorking: false, reverseProxyDocs: 'https://docs.owncloud.org/foo/bar.html', @@ -296,7 +324,7 @@ describe('OC.SetupChecks tests', function() { { 'Content-Type': 'application/json' }, - JSON.stringify({data: {serverHasInternetConnection: false, dataDirectoryProtected: false}}) + JSON.stringify({data: {serverHasInternetConnection: false}}) ); async.done(function( data, s, x ){ @@ -320,7 +348,6 @@ describe('OC.SetupChecks tests', function() { isUrandomAvailable: true, securityDocs: 'https://docs.owncloud.org/myDocs.html', serverHasInternetConnection: true, - dataDirectoryProtected: true, isMemcacheConfigured: true, forwardedForHeadersWorking: true, phpSupported: {eol: true, version: '5.4.0'}, @@ -484,7 +511,7 @@ describe('OC.SetupChecks tests', function() { { 'Content-Type': 'application/json' }, - JSON.stringify({data: {serverHasInternetConnection: false, dataDirectoryProtected: false}}) + JSON.stringify({data: {serverHasInternetConnection: false}}) ); async.done(function( data, s, x ){ expect(data).toEqual([{ diff --git a/settings/controller/checksetupcontroller.php b/settings/controller/checksetupcontroller.php index 7b995bf2c1..26194bb118 100644 --- a/settings/controller/checksetupcontroller.php +++ b/settings/controller/checksetupcontroller.php @@ -329,7 +329,6 @@ Raw output return new DataResponse( [ 'serverHasInternetConnection' => $this->isInternetConnectionWorking(), - 'dataDirectoryProtected' => $this->util->isHtaccessWorking($this->config), 'isMemcacheConfigured' => $this->isMemcacheConfigured(), 'memcacheDocs' => $this->urlGenerator->linkToDocs('admin-performance'), 'isUrandomAvailable' => $this->isUrandomAvailable(), diff --git a/settings/js/admin.js b/settings/js/admin.js index 6660bfe9b4..90b1de6837 100644 --- a/settings/js/admin.js +++ b/settings/js/admin.js @@ -171,9 +171,10 @@ $(document).ready(function(){ OC.SetupChecks.checkWellKnownUrl('/.well-known/caldav/', oc_defaults.docPlaceholderUrl, $('#postsetupchecks').data('check-wellknown') === 'true'), OC.SetupChecks.checkWellKnownUrl('/.well-known/carddav/', oc_defaults.docPlaceholderUrl, $('#postsetupchecks').data('check-wellknown') === 'true'), OC.SetupChecks.checkSetup(), - OC.SetupChecks.checkGeneric() - ).then(function(check1, check2, check3, check4, check5) { - var messages = [].concat(check1, check2, check3, check4, check5); + OC.SetupChecks.checkGeneric(), + OC.SetupChecks.checkDataProtected() + ).then(function(check1, check2, check3, check4, check5, check6) { + var messages = [].concat(check1, check2, check3, check4, check5, check6); var $el = $('#postsetupchecks'); $el.find('.loading').addClass('hidden'); diff --git a/tests/settings/controller/CheckSetupControllerTest.php b/tests/settings/controller/CheckSetupControllerTest.php index 08d4135fa1..c22ddb2e12 100644 --- a/tests/settings/controller/CheckSetupControllerTest.php +++ b/tests/settings/controller/CheckSetupControllerTest.php @@ -326,10 +326,6 @@ class CheckSetupControllerTest extends TestCase { $this->clientService->expects($this->once()) ->method('newClient') ->will($this->returnValue($client)); - - $this->util->expects($this->once()) - ->method('isHtaccessWorking') - ->will($this->returnValue(true)); $this->urlGenerator->expects($this->at(0)) ->method('linkToDocs') ->with('admin-performance') @@ -347,7 +343,6 @@ class CheckSetupControllerTest extends TestCase { $expected = new DataResponse( [ 'serverHasInternetConnection' => false, - 'dataDirectoryProtected' => true, 'isMemcacheConfigured' => true, 'memcacheDocs' => 'http://doc.owncloud.org/server/go.php?to=admin-performance', 'isUrandomAvailable' => self::invokePrivate($this->checkSetupController, 'isUrandomAvailable'),