3c5a6b829e
Allow DI the system tag stuff without Application class
2015-11-30 17:08:29 +01:00
bdbefe17d6
Merge pull request #20782 from mitar/better-https
...
Also allow empty value for no-HTTPS
2015-11-27 14:24:23 +01:00
59511d97ee
Also allow empty value for no-HTTPS.
...
This makes it work better with old version of Nginx.
2015-11-27 01:01:56 -08:00
7aed592957
Add full interface of server container as alias
2015-11-26 18:20:25 +01:00
2d7c9f0ba9
also match ie11 with Request::USER_AGENT_IE
2015-11-22 16:05:52 +01:00
358858c9e3
Fix undefined HTTP_USER_AGENT
2015-11-22 16:05:50 +01:00
daa388ce8d
Move index.php from files to AppFramework
...
1. Allows it to use the more secure CSP rules of the AppFramework.
2. Adds some unit tests.
2015-11-16 21:10:11 +01:00
d514200b56
Add escapeLikeParameter to IDBConnection
2015-11-05 16:41:30 +01:00
bafb86fb9f
Use getHttpProtocol instead of $_SERVER
2015-10-30 18:05:30 +01:00
8f09d5b67c
Update license headers
2015-10-26 14:04:01 +01:00
8133d46620
Remove dependency on ICrypto + use XOR
2015-10-21 17:33:41 +02:00
a0743f12c6
Provide IAppContainer as dependency injection
2015-10-20 10:33:53 +02:00
bf579a153f
fix IE8 user agent detection
2015-10-09 11:19:06 +02:00
020bb33150
Merge pull request #19034 from owncloud/http-request-warning
...
Prevent warning decoding content
2015-10-08 21:51:47 +02:00
8d2c8cf2a2
Merge pull request #19607 from owncloud/use-url
...
Use `/` if installed in main folder
2015-10-08 13:01:41 +02:00
6a4f22c61f
Use `/` if installed in main folder
...
Otherwise an empty string is used indicating the cookie is only valid for those resources. This can lead to eunexpected behaviour.
Fixes https://github.com/owncloud/core/issues/19196
2015-10-06 15:24:19 +02:00
80a232da6a
Add \OCP\IRequest::getHttpProtocol
...
Only allow valid HTTP protocols.
Ref https://github.com/owncloud/core/pull/19537#discussion_r41252333 + https://github.com/owncloud/security-tracker/issues/119
2015-10-06 14:18:46 +02:00
8366ce2767
deduplicate @xenopathic
2015-10-06 09:52:19 +02:00
b945d71384
update licence headers via script
2015-10-05 21:15:52 +02:00
d81416c51d
return '' instead of false
2015-09-23 12:32:49 +02:00
ee75f9f594
Fix type hint errors in the container and the interface
2015-09-23 10:13:41 +02:00
31a8949adf
Prevent warning decoding content
2015-09-14 22:36:40 +01:00
fd74522804
make resolve public to avoid boiler plate code
...
add resolve to public interface
2015-09-13 17:44:24 +02:00
f12caf930e
Properly return 304
...
The ETag set in the IF_NONE_MODIFIED header is wraped in quotes (").
However the ETag that is set in response is not (yet). Also we need to
cast the ETag to a string.
* Added unit test
2015-09-01 11:04:41 +02:00
e60c4bada1
Decode request content only on getContent
2015-08-31 01:05:25 +01:00
534b2e407a
Merge pull request #17662 from owncloud/locking-db
...
Database backend for locking
2015-08-26 03:56:37 +02:00
8313a3fcb3
Add mitigation against BREACH
...
While BREACH requires the following three factors to be effectively exploitable we should add another mitigation:
1. Application must support HTTP compression
2. Response most reflect user-controlled input
3. Response should contain sensitive data
Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed.
To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.
2015-08-14 01:31:32 +02:00
abd3d5c6a5
Merge pull request #17982 from owncloud/appframework-sanitize-name
...
Sanitize class names before registerService/query
2015-08-12 12:19:24 +02:00
cd0a2874de
Merge pull request #17852 from owncloud/register-alias-factory
...
Add test for factories
2015-08-11 13:30:56 +01:00
8944af57cb
Set default `forwarded_for_headers` to 'HTTP_X_FORWARDED_FOR'
2015-08-10 23:04:52 +02:00
58e96e53b0
add method to check if we're inside a transaction
2015-08-10 14:15:44 +02:00
f0b617b508
Use DI
...
* Register OCP\Capability\IManager at DIContainer
* Add register capabilities to appframework
* Register capabilities in DI way
* Make unit test pass again
* Remove CapabiltiesManager from OCP
2015-08-10 10:45:16 +02:00
fcc03e588a
Add \OCP\ISession to AppFramework
2015-08-07 12:29:57 +01:00
90a11efecd
Remove "use" statement
...
Ref https://bugs.php.net/bug.php?id=66773
2015-08-05 09:31:21 +02:00
4efa7c09b1
Use StringUtils::equals on CSRF token and add unit tests
2015-08-04 18:34:33 +02:00
182bc17aeb
Sanitize class names before registerService/query
...
Leading backslashes are removed, so a `registerService('\\OC\\Foo')`
can still be resolved with `query('OC\\Foo')`.
2015-07-30 21:02:16 +01:00
d8673dabe3
add test for factories
...
use ref for factory test
use a factory for registerAlias
Ensure we construct SimpleContainer
Use single instance of DIContainer in routing tests
2015-07-25 01:59:30 +02:00
1f8ee61006
Merge pull request #17755 from owncloud/alias-container-alive
...
Add registerAlias method to shortcut interface registration #17714
2015-07-24 13:11:32 +02:00
20cd0ae55b
Add a log message when the Doctrine Query Builder is retrieved
2015-07-21 15:53:28 +02:00
516f7e8299
Add unit tests and automatic quoting
2015-07-21 15:25:47 +02:00
1bfb944d51
Add QueryBuilder, ExpressionBuilder and CompositeExpression wrappers
2015-07-21 15:25:47 +02:00
7dda86f371
Return proper status code in case of a CORS exception
...
When returning a 500 statuscode external applications may interpret this as an error instead of handling this more gracefully. This will now make return a 401 thus.
Fixes https://github.com/owncloud/core/issues/17742
2015-07-20 12:54:22 +02:00
a4e3939204
add registerAlias method to shorcut interface registration
...
remove unused import
add since tag
fix typo
2015-07-18 13:43:54 +02:00
bd71540c8a
Fixing 'Undefined index: REMOTE_ADDR' - fixes #17460
2015-07-16 16:40:57 +02:00
da45fad3eb
Merge pull request #17078 from owncloud/fix-initial-server-host
...
Fix undefined offset
2015-07-01 08:55:12 +02:00
f63915d0c8
update license headers and authors
2015-06-25 14:13:49 +02:00
4d23e06097
Fix undefined offset
...
There are cases where no trusted host is specified such as when installing the instance, this lead to an undefined offset warning in the log right after installing. (when another domain than localhost or 127.0.0.1 was used)
2015-06-22 12:28:07 +02:00
04b6f67f07
Allow multiple whitespace in type hints in AppFramework
...
Type hints such as `@param bool $doSomething` will now correctly get
parsed, allowing for alignment of docblock parameters if the app developer so
wishes.
2015-06-20 23:52:01 +01:00
c8e3599cad
disallow cookie auth for cors requests
...
testing ...
fixes
fix test
add php doc
fix small mistake
add another phpdoc
remove not working cors annotations from files app
2015-05-22 14:06:26 +02:00
fdbc21fc6c
Scrutinizer Auto-Fixes
...
This commit consists of patches automatically generated for this project on https://scrutinizer-ci.com
2015-05-19 11:23:06 +00:00
Joas Schilling
Thomas Müller
Mitar
Morris Jobke
Robin Appelman
Lukas Reschke
Jörn Friedrich Dreyer
Robin McCorkell
Bernhard Posselt
Roeland Jago Douma
Robin McCorkell
Scrutinizer Auto-Fixer