mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Use temporary htaccesstest.txt for data dir security check

This commit is contained in:
Vincent Petry 2016-06-07 18:23:19 +02:00
parent bf917d7063
commit fb087a0261
No known key found for this signature in database
GPG Key ID: AF8F9EFC56562186
4 changed files with 31 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
core/js/setupchecks.js
View File

@ -197,7 +197,7 @@
} }
var afterCall = function(xhr) { var afterCall = function(xhr) {
var messages = []; var messages = [];
if (xhr.status !== 403 && xhr.status !== 307 && xhr.status !== 301 && xhr.responseText === '') { if (xhr.status !== 403 && xhr.status !== 307 && xhr.status !== 301 && xhr.responseText !== '') {
messages.push({ messages.push({
msg: t('core', 'Your data directory and your files are probably accessible from the Internet. The .htaccess file is not working. We strongly suggest that you configure your web server in a way that the data directory is no longer accessible or you move the data directory outside the web server document root.'), msg: t('core', 'Your data directory and your files are probably accessible from the Internet. The .htaccess file is not working. We strongly suggest that you configure your web server in a way that the data directory is no longer accessible or you move the data directory outside the web server document root.'),
type: OC.SetupChecks.MESSAGE_TYPE_ERROR type: OC.SetupChecks.MESSAGE_TYPE_ERROR
@ -208,7 +208,7 @@
$.ajax({ $.ajax({
type: 'GET', type: 'GET',
url: OC.linkTo('', oc_dataURL+'/.ocdata'), url: OC.linkTo('', oc_dataURL+'/htaccesstest.txt?t=' + (new Date()).getTime()),
complete: afterCall complete: afterCall
}); });
return deferred.promise(); return deferred.promise();

2
core/js/tests/specs/setupchecksSpec.js
View File

@ -103,7 +103,7 @@ describe('OC.SetupChecks tests', function() {
it('should return an error if data directory is not protected', function(done) { it('should return an error if data directory is not protected', function(done) {
var async = OC.SetupChecks.checkDataProtected(); var async = OC.SetupChecks.checkDataProtected();
suite.server.requests[0].respond(200); suite.server.requests[0].respond(200, {'Content-Type': 'text/plain'}, 'file contents');
async.done(function( data, s, x ){ async.done(function( data, s, x ){
expect(data).toEqual([ expect(data).toEqual([

37
lib/private/legacy/util.php
View File

@ -1128,19 +1128,8 @@ class OC_Util {
return $encoded; return $encoded;
} }
/**
* Check if the .htaccess file is working
* @param \OCP\IConfig $config
* @return bool
* @throws Exception
* @throws \OC\HintException If the test file can't get written.
*/
public function isHtaccessWorking(\OCP\IConfig $config) {
if (\OC::$CLI || !$config->getSystemValue('check_for_working_htaccess', true)) {
return true;
}
public function createHtaccessTestFile(\OCP\IConfig $config) {
// php dev server does not support htaccess // php dev server does not support htaccess
if (php_sapi_name() === 'cli-server') { if (php_sapi_name() === 'cli-server') {
return false; return false;
@ -1148,7 +1137,7 @@ class OC_Util {
// testdata // testdata
$fileName = '/htaccesstest.txt'; $fileName = '/htaccesstest.txt';
$testContent = 'testcontent'; $testContent = 'This is used for testing whether htaccess is properly enabled to disallow access from the outside. This file can be safely removed.';
// creating a test file // creating a test file
$testFile = $config->getSystemValue('datadirectory', OC::$SERVERROOT . '/data') . '/' . $fileName; $testFile = $config->getSystemValue('datadirectory', OC::$SERVERROOT . '/data') . '/' . $fileName;
@ -1164,6 +1153,28 @@ class OC_Util {
} }
fwrite($fp, $testContent); fwrite($fp, $testContent);
fclose($fp); fclose($fp);
}
/**
* Check if the .htaccess file is working
* @param \OCP\IConfig $config
* @return bool
* @throws Exception
* @throws \OC\HintException If the test file can't get written.
*/
public function isHtaccessWorking(\OCP\IConfig $config) {
if (\OC::$CLI || !$config->getSystemValue('check_for_working_htaccess', true)) {
return true;
}
$testContent = $this->createHtaccessTestFile($config);
if ($testContent === false) {
return false;
}
$fileName = '/htaccesstest.txt';
$testFile = $config->getSystemValue('datadirectory', OC::$SERVERROOT . '/data') . '/' . $fileName;
// accessing the file via http // accessing the file via http
$url = \OC::$server->getURLGenerator()->getAbsoluteURL(OC::$WEBROOT . '/data' . $fileName); $url = \OC::$server->getURLGenerator()->getAbsoluteURL(OC::$WEBROOT . '/data' . $fileName);

4
settings/admin.php
View File

@ -267,3 +267,7 @@ if ($updaterAppPanel) {
$template->assign('forms', $formsAndMore); $template->assign('forms', $formsAndMore);
$template->printPage(); $template->printPage();
$util = new \OC_Util();
$util->createHtaccessTestFile(\OC::$server->getConfig());