Commit Graph

92 Commits

Author SHA1 Message Date
Lukas Reschke e2453d78c0 Properly catch whether a share is `null`
Despite it's PHPDoc the function might return `null` which was not properly catched and thus in some situations the share was resolved to the sharing users root directory.

To test this perform the following steps:

* Share file in owncloud 7 (7.0.4.2)
* Delete the parent folder of the shared file
* The share stays is in the DB and the share via the sharelink is inaccessible. (which is good)
* Upgrade to owncloud 8 (8.0.2) (This step is crucial. The bug is not reproduceable without upgrading from 7 to 8. It seems like the old tokens are handled different than the newer ones)
* Optional Step: Logout, Reset Browser Session, etc.
* Access the share via the old share url: almost empty page, but there is a dowload button which adds a "/download" to the URL.
* Upon clicking, a download.zip is downloaded which contains EVERYTHING from the owncloud directory (of the user who shared the file)
* No exception is thrown and no error is logged.

This will add a check whether the share is a valid one and also adds unit tests to prevent further regressions in the future. Needs to be backported to ownCloud 8.

Adding a proper clean-up of the orphaned shares is out-of-scope and would probably require some kind of FK or so.

Fixes https://github.com/owncloud/core/issues/15097
2015-03-24 11:21:58 +01:00
Bernhard Posselt df24a014b8 If the execute method on the mapper receives an assoc array, it binds by value instead of index 2015-03-19 17:08:46 +01:00
Bernhard Posselt f77ae37f23 also use backwards compatible method for mapper 2015-03-18 22:20:23 +01:00
Bernhard Posselt c52bd10361 fix backwards compatibility for mapper execute method 2015-03-18 09:25:22 +01:00
Roeland Jago Douma 1a0f9c375b Avatar controller moved to AppFrameWork
* Original avatarcontroller migrated to the appframework
* Added DataDisplayResponse that show data inline in the browser (used
  to retrun the image)
* Removed some unneeded code
* Added unit tests for the avatarcontroller
2015-03-11 16:37:42 +01:00
Thomas Müller 214fa44400 Merge pull request #14534 from owncloud/add-child-src
Add support for 'child-src' directive
2015-03-10 10:30:44 +01:00
Lukas Reschke cdced56f2b Fix PHPDoc
That apparently went lost when changing the signature.
2015-03-04 15:35:41 +01:00
Lukas Reschke b29940d956 Add support for 'child-src' directive
This is required when working with stuff such as PDF.js in the files_pdfviewer application. Opt-in only.

Master change only because the stable CSP policies has a failback that allows nearly anything 🙈
2015-02-28 12:27:46 +01:00
Bernhard Posselt 95239ad21e AppFramework StreamResponse
First stab at the StreamResponse, see #12988

The idea is to use an interface ICallbackResponse (I'm not 100% happy with the name yet, suggestions?) that allow the response to output things in its own way, for instance stream the file using readfile

Unittests are atm lacking, plan is to

check if a mock of ICallbackResponse will be used by calling its callback (also unhappy with this name) method
Usage is:

$response = new StreamResponse('path/to/file');

rename io to output, add additional methods and handle error and not modified cases when using StreamResponse

fix indention and uppercasing, also handle forbidden cases

fix indention

fix indention

no forbidden, figuring out if a file is really readable is too complicated to get to work across OSes and streams

remove useless import

remove useless import

fix intendation
2015-02-27 15:42:33 +01:00
Morris Jobke 06aef4e8b1 Revert "Updating license headers"
This reverts commit 6a1a4880f0.
2015-02-26 11:37:37 +01:00
Bernhard Posselt 7b2fdbfb0b use IDBConnection and close cursors after insert/update/delete 2015-02-25 22:21:24 +01:00
Bernhard Posselt fb84e7d282 migrate to IDBConnection 2015-02-25 22:21:24 +01:00
Jenkins for ownCloud 6a1a4880f0 Updating license headers 2015-02-23 12:13:59 +01:00
Lukas Reschke fcc5f5a4f4 Merge pull request #13777 from owncloud/close-cursor
Close cursor for appframework and manipulation queries if applicable
2015-02-20 20:15:22 +01:00
Lukas Reschke a9d1a01440 Rename to allowEval 2015-02-16 12:30:21 +01:00
Lukas Reschke b20174bdad Allow AppFramework applications to specify a custom CSP header
This change allows AppFramework applications to specify a custom CSP header for example when the default policy is too strict. Furthermore this allows us to partially migrate away from CSS and allowed eval() in our JavaScript components.

Legacy ownCloud components will still use the previous policy. Application developers can use this as following in their controllers:
```php
$response = new TemplateResponse('activity', 'list', []);
$cspHelper = new ContentSecurityPolicyHelper();
$cspHelper->addAllowedScriptDomain('www.owncloud.org');
$response->addHeader('Content-Security-Policy', $cspHelper->getPolicy());
return $response;
```

Fixes https://github.com/owncloud/core/issues/11857 which is a pre-requisite for https://github.com/owncloud/core/issues/13458 and https://github.com/owncloud/core/issues/11925
2015-02-16 11:00:41 +01:00
Bernhard Posselt b89ddcfe41 fix license email 2015-02-05 14:09:01 +01:00
Bernhard Posselt fdc64e370c add a controller and reponse for ocs 2015-02-05 14:02:17 +01:00
Bernhard Posselt 37e8969d34 ignore cursorclosing 2015-01-29 19:16:28 +01:00
Morris Jobke 6a5f12beca Merge pull request #12988 from owncloud/logfile_download
Logfile download
2015-01-09 00:33:22 +01:00
Georg Ehrke f579f2bd94 add Download logfile button to admin settings
add logSettingsController

add download logfile button

move getEntries to LogSettingsController

move set log level to logsettingscontroller.php

add warning if logfile is bigger than 100MB

add unit test for set log level

fix typecasting, add new line at EoF

show log and logfile download only if log_type is set to owncloud

add unit test for getFilenameForDownload
2015-01-07 14:55:53 +01:00
Bernhard Posselt f195123765 Intelligent container
* resolves dependencies by type hint or variable name
* simpler route.php
* implementation of https://github.com/owncloud/core/issues/12829

Generates and injects parameters automatically. You can now build full classes like

    $c->query('MyClassName')

without having to register it as a service. The resolved object's instance will be saved by using registerService. If a constructor parameter is not type hinted, the parameter name will be taken.

Therefore the following two implementations are identical:

    class Class1 { function __construct(MyClassName $class)
    class Class1 { function __construct($MyClassName)

This makes it possible to also inject primitive values such as strings, arrays etc.

In addition if the query could not be resolved, a `QueryException` is now thrown

Routes can now be returned as an array from `routes.php` and an `appinfo/application.php` is optional

Old commit messages:

make it possible to return the routes instead of having to intialize the application
try to get the controller by convention
add first implementation of automatic resolve
add another test just to be sure
store the resolved object
more tests
add phpdoc to public app.php method
use the same variable for the public app.php method
deprecate old methods and add services for public interfaces
deprecated getServer method
disallow private api injection for apps other than core or settings (settings should be an app goddamnit :D)
register userid because its such an often used variable
fix indention and leading slash
use test namespace
add deprecation reasons, remove private api usage checks and remove deprecation from getServer()
add additional public interfaces
add public interface for rootfolder
fix syntax error
remove deprecation from methods where no alternative is there yet
remove deprecated from method which has no alternative
add timezone public service for #12881
add another deprecation hint
move deprecation into separate branch
remove dead comment
first try to get the namespace from the info.xml, if it does not exist, just uppercase the first letter
also trim the namespace name
add an interface for timefactory
move timefactory to public and add icontrollermethodreflector
keep core interface
fix copyright date in headers
2014-12-23 09:50:42 +01:00
Thomas Müller c3544bd27e Merge pull request #12982 from owncloud/timefac-iface
Add an interface for the timefactory class
2014-12-21 20:27:53 +01:00
Bernhard Posselt ba03b0b843 add an interface for the timefactory class
fix indention
2014-12-20 15:53:31 +01:00
Bernhard Posselt 6779bf113d add isAdmin and isInGroup methods for the group manager 2014-12-17 17:41:57 +01:00
Bernhard Posselt 236632702c add a isLoggedIn method to the usersession and deprecate the isLoggedIn method on the api 2014-12-17 17:40:52 +01:00
Bernhard Posselt d59c4e832f first round of deprecation 2014-12-16 19:50:31 +01:00
Olivier Paroz 469fd3b3a3 Olivier Paroz \OCP\AppFramework\Utility\IControllerMethodReflector 2014-12-14 23:54:31 +01:00
Lukas Reschke db9765b4d5 Merge headers
Otherwise the headers from `JSONResponse` are gone and the Content-Type of the response would be `text/html` instead of `application/json; charset=utf-8`. This leads to broken scripts since we set the `nosniff` tag, furthermore this is very bad from a security PoV.
2014-12-04 14:45:15 +01:00
Lukas Reschke 048139074d Add functions to modify cookies to response class
Currently there is no AppFramework way to modify cookies, which makes it unusable for quite some use-cases or results in untestable code.

This PR adds some basic functionalities to add and invalidate cookies.

Usage:
```php
$response = new TemplateResponse(...);
$response->addCookie('foo', 'bar');
$response->invalidateCookie('foo');
$response->addCookie('bar', 'foo', new \DateTime('2015-01-01 00:00'));
```

Existing cookies can be accessed with the AppFramework using `$this->request->getCookie($name)`.
2014-11-27 14:19:00 +01:00
Lukas Reschke 4302a78b27 Deprecate older API wrappers and calls
Those old classes have now non-static pendants and can be deprecated IMHO.
2014-11-12 17:39:25 +01:00
Bernhard Posselt 91a23bfa9c fix typo in content type 2014-11-05 12:04:56 +01:00
Bernhard Posselt 0696099bad add dataresponse
fix docstrings

adjust copyright date

another copyright date update

another header update

implement third headers argument, fix indention, fix docstrings

fix docstrings
2014-10-29 09:43:47 +01:00
Thomas Müller c08a1e6455 according to PHPDoc this function shall return the entity 2014-08-17 22:27:55 +02:00
Morris Jobke 889088f72d Fix template rendering for 'blank' templates 2014-07-29 16:49:50 +02:00
Bernhard Posselt 93169eca1e also handle lowercase headers 2014-06-11 01:20:09 +02:00
Bernhard Posselt 1002281dae handle http accept headers more gracefully 2014-06-11 00:54:25 +02:00
Bernhard Posselt 587a8df566 remove controller serializers 2014-06-05 18:00:36 +02:00
Lukas Reschke c8b5ae675c Fix PHPDoc
- Remove not anymore existing parameters
- Fix typo
2014-06-01 21:46:05 +02:00
Bernhard Posselt 9e36c33104 use fetch method instead of fetchRow because fetchRow is only an owncloud internal alias that exists purely for compability 2014-05-14 01:09:48 +02:00
Morris Jobke 6499995474 Merge pull request #8477 from owncloud/better-controllers
Better appframework controllers
2014-05-12 01:07:49 +02:00
Morris Jobke 7a6ff56b13 Merge pull request #8274 from owncloud/appframework-db
Port database layer from appframework to core
2014-05-12 00:12:19 +02:00
Bernhard Posselt 1d45239c65 adjust license headers to new mail address 2014-05-11 17:54:08 +02:00
Bernhard Posselt cb666c18d6 rename formatter to responder, formatResponse to buildResponse 2014-05-11 17:54:08 +02:00
Bernhard Posselt 80648da431 implement most of the basic stuff that was suggested in #8290 2014-05-11 17:54:08 +02:00
Bernhard Posselt 3af30625ab Make db connection protected 2014-05-11 12:54:44 +02:00
Bernhard Posselt 9a4d204b55 add cors middleware
remove methodannotationreader namespace

fix namespace for server container

fix tests

fail if with cors credentials header is set to true, implement a reusable preflighted cors method in the controller baseclass, make corsmiddleware private and register it for every request

remove uneeded  local in cors middleware registratio

dont uppercase cors to easily use it from routes

fix indention

comment fixes

explicitely set allow credentials header to false

dont depend on better controllers PR, fix that stuff later

split cors methods to be in a seperate controller for exposing apis

remove protected definitions from apicontroller since controller has it
2014-05-09 23:34:41 +02:00
Bernhard Posselt 5199e4508a dont update entity and dont run an update query if an entity wasnt changed at all 2014-04-23 13:43:17 +02:00
Bernhard Posselt 7e447f4f42 make download and redirectresponse public 2014-04-20 16:12:46 +02:00
Lukas Reschke 886c5177e7 Fix typo & add type 2014-04-20 01:09:25 +02:00