Commit Graph

62 Commits

Author SHA1 Message Date
Lukas Reschke 80a232da6a Add \OCP\IRequest::getHttpProtocol
Only allow valid HTTP protocols.

Ref https://github.com/owncloud/core/pull/19537#discussion_r41252333 + https://github.com/owncloud/security-tracker/issues/119
2015-10-06 14:18:46 +02:00
Morris Jobke 8366ce2767 deduplicate @xenopathic 2015-10-06 09:52:19 +02:00
Morris Jobke b945d71384 update licence headers via script 2015-10-05 21:15:52 +02:00
Jörn Friedrich Dreyer d81416c51d return '' instead of false 2015-09-23 12:32:49 +02:00
Robin McCorkell e60c4bada1 Decode request content only on getContent 2015-08-31 01:05:25 +01:00
Lukas Reschke 8313a3fcb3 Add mitigation against BREACH
While BREACH requires the following three factors to be effectively exploitable we should add another mitigation:

1. Application must support HTTP compression
2. Response most reflect user-controlled input
3. Response should contain sensitive data

Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed.

To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.
2015-08-14 01:31:32 +02:00
Robin McCorkell 8944af57cb Set default `forwarded_for_headers` to 'HTTP_X_FORWARDED_FOR' 2015-08-10 23:04:52 +02:00
Lukas Reschke 90a11efecd Remove "use" statement
Ref https://bugs.php.net/bug.php?id=66773
2015-08-05 09:31:21 +02:00
Lukas Reschke 4efa7c09b1 Use StringUtils::equals on CSRF token and add unit tests 2015-08-04 18:34:33 +02:00
Thomas Müller bd71540c8a Fixing 'Undefined index: REMOTE_ADDR' - fixes #17460 2015-07-16 16:40:57 +02:00
Morris Jobke da45fad3eb Merge pull request #17078 from owncloud/fix-initial-server-host
Fix undefined offset
2015-07-01 08:55:12 +02:00
Morris Jobke f63915d0c8 update license headers and authors 2015-06-25 14:13:49 +02:00
Lukas Reschke 4d23e06097 Fix undefined offset
There are cases where no trusted host is specified such as when installing the instance, this lead to an undefined offset warning in the log right after installing. (when another domain than localhost or 127.0.0.1 was used)
2015-06-22 12:28:07 +02:00
Morris Jobke ce2c8533d9 Merge pull request #15735 from owncloud/fix-visibility
Fix visibility of interfaces in \OCP
2015-04-20 14:39:15 +02:00
Joas Schilling 6da9e1a742 Fix visibility of public API methods 2015-04-20 12:52:40 +02:00
Morris Jobke ccf47f40aa Remove unused variables
* should make scrutinizer a lot more happy
* reduces maybe memory footprint
2015-04-18 16:35:19 +02:00
Jenkins for ownCloud b585d87d9d Update license headers 2015-03-26 11:44:36 +01:00
Lukas Reschke bbd5f28415 Let users configure security headers in their Webserver
Doing this in the PHP code is not the right approach for multiple reasons:

1. A bug in the PHP code prevents them from being added to the response.
2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud)
3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations.

This pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS.
2015-03-02 19:07:46 +01:00
Bernhard Posselt 95239ad21e AppFramework StreamResponse
First stab at the StreamResponse, see #12988

The idea is to use an interface ICallbackResponse (I'm not 100% happy with the name yet, suggestions?) that allow the response to output things in its own way, for instance stream the file using readfile

Unittests are atm lacking, plan is to

check if a mock of ICallbackResponse will be used by calling its callback (also unhappy with this name) method
Usage is:

$response = new StreamResponse('path/to/file');

rename io to output, add additional methods and handle error and not modified cases when using StreamResponse

fix indention and uppercasing, also handle forbidden cases

fix indention

fix indention

no forbidden, figuring out if a file is really readable is too complicated to get to work across OSes and streams

remove useless import

remove useless import

fix intendation
2015-02-27 15:42:33 +01:00
Morris Jobke 06aef4e8b1 Revert "Updating license headers"
This reverts commit 6a1a4880f0.
2015-02-26 11:37:37 +01:00
Thomas Müller bcf3704645 Merge pull request #14458 from owncloud/revive/11157
Get the real protocol behind several proxies
2015-02-25 02:51:46 -08:00
Thomas Müller 799e144b04 Merge pull request #14151 from owncloud/update-sabre2.1
Sabre Update to 2.1
2015-02-25 02:21:55 -08:00
Lukas Reschke 9adcd15cb3 Use [0] instead of current as HHVM might have problems with that 2015-02-24 13:37:34 +01:00
Lukas Reschke 1c6eae9017 Get the real protocol behind several proxies
X-Forwarded-Proto contains a list of protocols if ownCloud is behind multiple reverse proxies.

This is a revival of https://github.com/owncloud/core/pull/11157 using the new IRequest public API.
2015-02-24 12:24:55 +01:00
Vincent Petry 9f6dcb9d3e Sabre Update to 2.1
- VObject fixes for Sabre\VObject 3.3
- Remove VObject property workarounds
- Added prefetching for tags in sabre tags plugin
- Moved oc_properties logic to separate PropertyStorage backend (WIP)
- Fixed Sabre connector namespaces
- Improved files plugin to handle props on-demand
- Moved allowed props from server class to files plugin
- Fixed tags caching for files that are known to have no tags
  (less queries)
- Added/fixed unit tests for Sabre FilesPlugin, TagsPlugin
- Replace OC\Connector\Sabre\Request with direct call to
  httpRequest->setUrl()
- Fix exception detection in DAV client when using Sabre\DAV\Client
- Added setETag() on Node instead of using the static FileSystem
- Also preload tags/props when depth is infinity
2015-02-23 22:27:23 +01:00
Thomas Müller 0a9b8242ee properly initialize OC::$WEBROOT and host name 2015-02-23 21:49:35 +01:00
Jenkins for ownCloud 6a1a4880f0 Updating license headers 2015-02-23 12:13:59 +01:00
Lukas Reschke cebf9f6a5a Incorporate review changes 2015-02-16 22:13:03 +01:00
Lukas Reschke 992164446c Add blackmagic due to cyclic dependency 🙈 2015-02-16 22:13:01 +01:00
Lukas Reschke 9f91d64918 Make scrutinizer happy 2015-02-16 22:13:00 +01:00
Lukas Reschke 886bda5f81 Refactor OC_Request into TrustedDomainHelper and IRequest
This changeset removes the static class `OC_Request` and moves the functions either into `IRequest` which is accessible via `\OC::$server::->getRequest()` or into a separated `TrustedDomainHelper` class for some helper methods which should not be publicly exposed.

This changes only internal methods and nothing on the public API. Some public functions in `util.php` have been deprecated though in favour of the new non-static functions.

Unfortunately some part of this code uses things like `__DIR__` and thus is not completely unit-testable. Where tests where possible they ahve been added though.

Fixes https://github.com/owncloud/core/issues/13976 which was requested in https://github.com/owncloud/core/pull/13973#issuecomment-73492969
2015-02-16 22:13:00 +01:00
Lukas Reschke 770fa761b8 Respect `mod_unique_id` and refactor `OC_Request::getRequestId`
When `mod_unique_id` is enabled the ID generated by it will be used for logging. This allows for correlation of the Apache logs and the ownCloud logs.

Testplan:

- [ ] When `mod_unique_id` is enabled the request ID equals the one generated by `mod_unique_id`.
- [ ] When `mod_unique_id` is not available the request ID is a 20 character long random string
- [ ] The generated Id is stable over the lifespan of one request

Changeset looks a little bit larger since I had to adjust every unit test using the HTTP\Request class for proper DI.

Fixes https://github.com/owncloud/core/issues/13366
2015-02-09 11:53:11 +01:00
Bernhard Posselt bb0c88a577 always set url parameters when they are available in the app dispatch
prefer url parameters passed into the main method. If they are not present, use the containers urlParameters

add space
2015-01-15 15:22:52 +01:00
Lukas Reschke 048139074d Add functions to modify cookies to response class
Currently there is no AppFramework way to modify cookies, which makes it unusable for quite some use-cases or results in untestable code.

This PR adds some basic functionalities to add and invalidate cookies.

Usage:
```php
$response = new TemplateResponse(...);
$response->addCookie('foo', 'bar');
$response->invalidateCookie('foo');
$response->addCookie('bar', 'foo', new \DateTime('2015-01-01 00:00'));
```

Existing cookies can be accessed with the AppFramework using `$this->request->getCookie($name)`.
2014-11-27 14:19:00 +01:00
Bernhard Posselt 0696099bad add dataresponse
fix docstrings

adjust copyright date

another copyright date update

another header update

implement third headers argument, fix indention, fix docstrings

fix docstrings
2014-10-29 09:43:47 +01:00
Lukas Reschke 41374986d3 Remove dead code 2014-09-29 17:20:29 +02:00
Georg Ehrke c30bea45e9 don't typecast null values inside dispatcher.php 2014-06-29 22:40:50 +02:00
Bernhard Posselt 0252d39bb6 fix indention 2014-06-11 00:57:00 +02:00
Bernhard Posselt 1002281dae handle http accept headers more gracefully 2014-06-11 00:54:25 +02:00
Bernhard Posselt a152e320f6 make it possible to omit parameters and use the default parameters from the controller method 2014-05-13 10:40:49 +02:00
Bernhard Posselt 3e58a767ad Fix method signature 2014-05-11 17:54:09 +02:00
Bernhard Posselt 1d45239c65 adjust license headers to new mail address 2014-05-11 17:54:08 +02:00
Bernhard Posselt cb666c18d6 rename formatter to responder, formatResponse to buildResponse 2014-05-11 17:54:08 +02:00
Bernhard Posselt ede7325772 fix broken if 2014-05-11 17:54:08 +02:00
Bernhard Posselt d8da79cab0 add test for not failing when adding more comments after type parameters, do not limit x-www-form-urlencoded to POST 2014-05-11 17:54:08 +02:00
Bernhard Posselt 80648da431 implement most of the basic stuff that was suggested in #8290 2014-05-11 17:54:08 +02:00
Bernhard Posselt 7e447f4f42 make download and redirectresponse public 2014-04-20 16:12:46 +02:00
Bernhard Posselt 62cce982bb default to GET request when no method is set to fix unittests, also set parsed json parameters on the post attribute 2014-04-12 16:17:49 +02:00
Bernhard Posselt e7fa2790f3 Correctly process request parameters other than GET or POST, dont use globals in the class but inject it 2014-04-12 15:02:19 +02:00
Scrutinizer Auto-Fixer adaee6a5a1 Scrutinizer Auto-Fixes
This patch was automatically generated as part of the following inspection:
https://scrutinizer-ci.com/g/owncloud/core/inspections/cdfecc4e-a37e-4233-8025-f0d7252a8720

Enabled analysis tools:
 - PHP Analyzer
 - JSHint
 - PHP Copy/Paste Detector
 - PHP PDepend
2014-02-19 09:31:54 +01:00