Commit Graph

221 Commits

Author SHA1 Message Date
Thomas Müller 534b2e407a Merge pull request #17662 from owncloud/locking-db
Database backend for locking
2015-08-26 03:56:37 +02:00
Lukas Reschke 8313a3fcb3 Add mitigation against BREACH
While BREACH requires the following three factors to be effectively exploitable we should add another mitigation:

1. Application must support HTTP compression
2. Response most reflect user-controlled input
3. Response should contain sensitive data

Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed.

To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.
2015-08-14 01:31:32 +02:00
Thomas Müller abd3d5c6a5 Merge pull request #17982 from owncloud/appframework-sanitize-name
Sanitize class names before registerService/query
2015-08-12 12:19:24 +02:00
Robin McCorkell cd0a2874de Merge pull request #17852 from owncloud/register-alias-factory
Add test for factories
2015-08-11 13:30:56 +01:00
Robin McCorkell 8944af57cb Set default `forwarded_for_headers` to 'HTTP_X_FORWARDED_FOR' 2015-08-10 23:04:52 +02:00
Robin Appelman 58e96e53b0 add method to check if we're inside a transaction 2015-08-10 14:15:44 +02:00
Roeland Jago Douma f0b617b508 Use DI
* Register OCP\Capability\IManager at DIContainer
* Add register capabilities to appframework
* Register capabilities in DI way
* Make unit test pass again
* Remove CapabiltiesManager from OCP
2015-08-10 10:45:16 +02:00
Robin McCorkell fcc03e588a Add \OCP\ISession to AppFramework 2015-08-07 12:29:57 +01:00
Lukas Reschke 90a11efecd Remove "use" statement
Ref https://bugs.php.net/bug.php?id=66773
2015-08-05 09:31:21 +02:00
Lukas Reschke 4efa7c09b1 Use StringUtils::equals on CSRF token and add unit tests 2015-08-04 18:34:33 +02:00
Robin McCorkell 182bc17aeb Sanitize class names before registerService/query
Leading backslashes are removed, so a `registerService('\\OC\\Foo')`
can still be resolved with `query('OC\\Foo')`.
2015-07-30 21:02:16 +01:00
Bernhard Posselt d8673dabe3 add test for factories
use ref for factory test

use a factory for registerAlias

Ensure we construct SimpleContainer

Use single instance of DIContainer in routing tests
2015-07-25 01:59:30 +02:00
Thomas Müller 1f8ee61006 Merge pull request #17755 from owncloud/alias-container-alive
Add registerAlias method to shortcut interface registration #17714
2015-07-24 13:11:32 +02:00
Joas Schilling 20cd0ae55b Add a log message when the Doctrine Query Builder is retrieved 2015-07-21 15:53:28 +02:00
Joas Schilling 516f7e8299 Add unit tests and automatic quoting 2015-07-21 15:25:47 +02:00
Joas Schilling 1bfb944d51 Add QueryBuilder, ExpressionBuilder and CompositeExpression wrappers 2015-07-21 15:25:47 +02:00
Lukas Reschke 7dda86f371 Return proper status code in case of a CORS exception
When returning a 500 statuscode external applications may interpret this as an error instead of handling this more gracefully. This will now make return a 401 thus.

Fixes https://github.com/owncloud/core/issues/17742
2015-07-20 12:54:22 +02:00
Bernhard Posselt a4e3939204 add registerAlias method to shorcut interface registration
remove unused import

add since tag

fix typo
2015-07-18 13:43:54 +02:00
Thomas Müller bd71540c8a Fixing 'Undefined index: REMOTE_ADDR' - fixes #17460 2015-07-16 16:40:57 +02:00
Morris Jobke da45fad3eb Merge pull request #17078 from owncloud/fix-initial-server-host
Fix undefined offset
2015-07-01 08:55:12 +02:00
Morris Jobke f63915d0c8 update license headers and authors 2015-06-25 14:13:49 +02:00
Lukas Reschke 4d23e06097 Fix undefined offset
There are cases where no trusted host is specified such as when installing the instance, this lead to an undefined offset warning in the log right after installing. (when another domain than localhost or 127.0.0.1 was used)
2015-06-22 12:28:07 +02:00
Robin McCorkell 04b6f67f07 Allow multiple whitespace in type hints in AppFramework
Type hints such as `@param bool     $doSomething` will now correctly get
parsed, allowing for alignment of docblock parameters if the app developer so
wishes.
2015-06-20 23:52:01 +01:00
Bernhard Posselt c8e3599cad disallow cookie auth for cors requests
testing ...

fixes

fix test

add php doc

fix small mistake

add another phpdoc

remove not working cors annotations from files app
2015-05-22 14:06:26 +02:00
Scrutinizer Auto-Fixer fdbc21fc6c Scrutinizer Auto-Fixes
This commit consists of patches automatically generated for this project on https://scrutinizer-ci.com
2015-05-19 11:23:06 +00:00
Andreas Fischer e418ced656 Check return value of OC_App::getAppPath() and verify info.xml exists. 2015-05-06 17:15:28 +02:00
Bernhard Posselt 1e58538f0e add aliases to pascal case constructor paramters to make it possible to auto assemble controllers 2015-04-29 22:29:45 +02:00
Morris Jobke ce2c8533d9 Merge pull request #15735 from owncloud/fix-visibility
Fix visibility of interfaces in \OCP
2015-04-20 14:39:15 +02:00
Joas Schilling 6da9e1a742 Fix visibility of public API methods 2015-04-20 12:52:40 +02:00
Morris Jobke ccf47f40aa Remove unused variables
* should make scrutinizer a lot more happy
* reduces maybe memory footprint
2015-04-18 16:35:19 +02:00
Jenkins for ownCloud b585d87d9d Update license headers 2015-03-26 11:44:36 +01:00
Joas Schilling c2a5bd6a01 Also add a note that clob does not work in the compare array 2015-03-16 15:41:00 +01:00
Joas Schilling d1511cdbee Fix doc blocks of insertIfNotExists() method 2015-03-11 09:05:30 +01:00
Joas Schilling 8fa692388b Allow specifying the compare-array for insertIfNotExists() 2015-03-09 22:37:49 +01:00
Lukas Reschke bbd5f28415 Let users configure security headers in their Webserver
Doing this in the PHP code is not the right approach for multiple reasons:

1. A bug in the PHP code prevents them from being added to the response.
2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud)
3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations.

This pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS.
2015-03-02 19:07:46 +01:00
Bernhard Posselt 95239ad21e AppFramework StreamResponse
First stab at the StreamResponse, see #12988

The idea is to use an interface ICallbackResponse (I'm not 100% happy with the name yet, suggestions?) that allow the response to output things in its own way, for instance stream the file using readfile

Unittests are atm lacking, plan is to

check if a mock of ICallbackResponse will be used by calling its callback (also unhappy with this name) method
Usage is:

$response = new StreamResponse('path/to/file');

rename io to output, add additional methods and handle error and not modified cases when using StreamResponse

fix indention and uppercasing, also handle forbidden cases

fix indention

fix indention

no forbidden, figuring out if a file is really readable is too complicated to get to work across OSes and streams

remove useless import

remove useless import

fix intendation
2015-02-27 15:42:33 +01:00
Morris Jobke 06aef4e8b1 Revert "Updating license headers"
This reverts commit 6a1a4880f0.
2015-02-26 11:37:37 +01:00
Thomas Müller c62eb9d652 owncloud -> ownCloud 2015-02-25 22:21:24 +01:00
Bernhard Posselt fb84e7d282 migrate to IDBConnection 2015-02-25 22:21:24 +01:00
Thomas Müller bcf3704645 Merge pull request #14458 from owncloud/revive/11157
Get the real protocol behind several proxies
2015-02-25 02:51:46 -08:00
Thomas Müller 799e144b04 Merge pull request #14151 from owncloud/update-sabre2.1
Sabre Update to 2.1
2015-02-25 02:21:55 -08:00
Lukas Reschke 9adcd15cb3 Use [0] instead of current as HHVM might have problems with that 2015-02-24 13:37:34 +01:00
Lukas Reschke 1c6eae9017 Get the real protocol behind several proxies
X-Forwarded-Proto contains a list of protocols if ownCloud is behind multiple reverse proxies.

This is a revival of https://github.com/owncloud/core/pull/11157 using the new IRequest public API.
2015-02-24 12:24:55 +01:00
Vincent Petry 9f6dcb9d3e Sabre Update to 2.1
- VObject fixes for Sabre\VObject 3.3
- Remove VObject property workarounds
- Added prefetching for tags in sabre tags plugin
- Moved oc_properties logic to separate PropertyStorage backend (WIP)
- Fixed Sabre connector namespaces
- Improved files plugin to handle props on-demand
- Moved allowed props from server class to files plugin
- Fixed tags caching for files that are known to have no tags
  (less queries)
- Added/fixed unit tests for Sabre FilesPlugin, TagsPlugin
- Replace OC\Connector\Sabre\Request with direct call to
  httpRequest->setUrl()
- Fix exception detection in DAV client when using Sabre\DAV\Client
- Added setETag() on Node instead of using the static FileSystem
- Also preload tags/props when depth is infinity
2015-02-23 22:27:23 +01:00
Thomas Müller 0a9b8242ee properly initialize OC::$WEBROOT and host name 2015-02-23 21:49:35 +01:00
Bernhard Posselt 8176032176 Merge pull request #14427 from owncloud/fix-some-php-docs
Fix some PHPDocs
2015-02-23 14:04:35 +01:00
Lukas Reschke c06a94ecc2 Fix some PHPDocs 2015-02-23 12:19:52 +01:00
Jenkins for ownCloud 6a1a4880f0 Updating license headers 2015-02-23 12:13:59 +01:00
Lukas Reschke cebf9f6a5a Incorporate review changes 2015-02-16 22:13:03 +01:00
Lukas Reschke 992164446c Add blackmagic due to cyclic dependency 🙈 2015-02-16 22:13:01 +01:00
Lukas Reschke 9f91d64918 Make scrutinizer happy 2015-02-16 22:13:00 +01:00
Lukas Reschke 886bda5f81 Refactor OC_Request into TrustedDomainHelper and IRequest
This changeset removes the static class `OC_Request` and moves the functions either into `IRequest` which is accessible via `\OC::$server::->getRequest()` or into a separated `TrustedDomainHelper` class for some helper methods which should not be publicly exposed.

This changes only internal methods and nothing on the public API. Some public functions in `util.php` have been deprecated though in favour of the new non-static functions.

Unfortunately some part of this code uses things like `__DIR__` and thus is not completely unit-testable. Where tests where possible they ahve been added though.

Fixes https://github.com/owncloud/core/issues/13976 which was requested in https://github.com/owncloud/core/pull/13973#issuecomment-73492969
2015-02-16 22:13:00 +01:00
Morris Jobke 1bb6de7c1b Merge pull request #13425 from owncloud/phpdoc_cleanup
Cleanup of PHPDoc return types
2015-02-10 01:14:00 +01:00
Lukas Reschke 770fa761b8 Respect `mod_unique_id` and refactor `OC_Request::getRequestId`
When `mod_unique_id` is enabled the ID generated by it will be used for logging. This allows for correlation of the Apache logs and the ownCloud logs.

Testplan:

- [ ] When `mod_unique_id` is enabled the request ID equals the one generated by `mod_unique_id`.
- [ ] When `mod_unique_id` is not available the request ID is a 20 character long random string
- [ ] The generated Id is stable over the lifespan of one request

Changeset looks a little bit larger since I had to adjust every unit test using the HTTP\Request class for proper DI.

Fixes https://github.com/owncloud/core/issues/13366
2015-02-09 11:53:11 +01:00
Lukas Reschke bedf358b40 Use proper namespace
IAppManager lives in OCP\App and not in OCP.

Fixes https://github.com/owncloud/core/issues/13710
2015-01-27 17:34:25 +01:00
Bernhard Posselt 9df297324f get rid of log warning when using servercontainer 2015-01-22 15:33:09 +01:00
Robin McCorkell 2b99fc76ec Cleanup of PHPDoc return types 2015-01-16 20:30:43 +00:00
Bernhard Posselt bb0c88a577 always set url parameters when they are available in the app dispatch
prefer url parameters passed into the main method. If they are not present, use the containers urlParameters

add space
2015-01-15 15:22:52 +01:00
Morris Jobke 4ffe7ddb75 degraded logging policy for server container in AppFramework 2015-01-06 13:43:40 +01:00
Lukas Reschke 8689605999 Use info instead of warning log level
Otherwise the log is flooded as can be seen at https://github.com/owncloud/core/issues/13106

Fixes https://github.com/owncloud/core/issues/13106
2015-01-05 11:18:54 +01:00
Bernhard Posselt f195123765 Intelligent container
* resolves dependencies by type hint or variable name
* simpler route.php
* implementation of https://github.com/owncloud/core/issues/12829

Generates and injects parameters automatically. You can now build full classes like

    $c->query('MyClassName')

without having to register it as a service. The resolved object's instance will be saved by using registerService. If a constructor parameter is not type hinted, the parameter name will be taken.

Therefore the following two implementations are identical:

    class Class1 { function __construct(MyClassName $class)
    class Class1 { function __construct($MyClassName)

This makes it possible to also inject primitive values such as strings, arrays etc.

In addition if the query could not be resolved, a `QueryException` is now thrown

Routes can now be returned as an array from `routes.php` and an `appinfo/application.php` is optional

Old commit messages:

make it possible to return the routes instead of having to intialize the application
try to get the controller by convention
add first implementation of automatic resolve
add another test just to be sure
store the resolved object
more tests
add phpdoc to public app.php method
use the same variable for the public app.php method
deprecate old methods and add services for public interfaces
deprecated getServer method
disallow private api injection for apps other than core or settings (settings should be an app goddamnit :D)
register userid because its such an often used variable
fix indention and leading slash
use test namespace
add deprecation reasons, remove private api usage checks and remove deprecation from getServer()
add additional public interfaces
add public interface for rootfolder
fix syntax error
remove deprecation from methods where no alternative is there yet
remove deprecated from method which has no alternative
add timezone public service for #12881
add another deprecation hint
move deprecation into separate branch
remove dead comment
first try to get the namespace from the info.xml, if it does not exist, just uppercase the first letter
also trim the namespace name
add an interface for timefactory
move timefactory to public and add icontrollermethodreflector
keep core interface
fix copyright date in headers
2014-12-23 09:50:42 +01:00
Thomas Müller c3544bd27e Merge pull request #12982 from owncloud/timefac-iface
Add an interface for the timefactory class
2014-12-21 20:27:53 +01:00
Bernhard Posselt ba03b0b843 add an interface for the timefactory class
fix indention
2014-12-20 15:53:31 +01:00
Bernhard Posselt 6779bf113d add isAdmin and isInGroup methods for the group manager 2014-12-17 17:41:57 +01:00
Bernhard Posselt 236632702c add a isLoggedIn method to the usersession and deprecate the isLoggedIn method on the api 2014-12-17 17:40:52 +01:00
Bernhard Posselt d59c4e832f first round of deprecation 2014-12-16 19:50:31 +01:00
Olivier Paroz 469fd3b3a3 Olivier Paroz \OCP\AppFramework\Utility\IControllerMethodReflector 2014-12-14 23:54:31 +01:00
Philipp Knechtges 768aea57d3 make regex in controllermethodreflector.php compatible with PCRE 6.x
The syntax ?<...> seems to be only supported from PCRE 7.0 on. For
backwards-compability ?P<...> is used.
2014-12-14 10:52:21 +01:00
Lukas Reschke d197f43475 Use server container 2014-11-27 14:36:11 +01:00
Lukas Reschke 048139074d Add functions to modify cookies to response class
Currently there is no AppFramework way to modify cookies, which makes it unusable for quite some use-cases or results in untestable code.

This PR adds some basic functionalities to add and invalidate cookies.

Usage:
```php
$response = new TemplateResponse(...);
$response->addCookie('foo', 'bar');
$response->invalidateCookie('foo');
$response->addCookie('bar', 'foo', new \DateTime('2015-01-01 00:00'));
```

Existing cookies can be accessed with the AppFramework using `$this->request->getCookie($name)`.
2014-11-27 14:19:00 +01:00
Thomas Müller ddacd7f900 Merge pull request #12294 from owncloud/route-postfix
Add route postfix to allow url versioning when only the http method changed
2014-11-24 16:32:54 +01:00
Morris Jobke 1b17429c1d Merge pull request #12142 from owncloud/DeprecateOldIAPICalls
Deprecate older API wrappers and calls
2014-11-24 14:01:49 +01:00
Bernhard Posselt 4e90c44301 add postfix
add postfix
2014-11-19 12:01:42 +01:00
Lukas Reschke 07f0d76fc6 Move CSRF check
Because we're closing the session now before controllers are executed there are cases where we cannot write the session.
2014-11-17 15:10:53 +01:00
Lukas Reschke cd5925036a Check if app is enabled for user
Fixes https://github.com/owncloud/core/issues/12188 for AppFramework apps
2014-11-15 11:13:55 +01:00
Lukas Reschke 4302a78b27 Deprecate older API wrappers and calls
Those old classes have now non-static pendants and can be deprecated IMHO.
2014-11-12 17:39:25 +01:00
Bernhard Posselt 6d5a239abf Fix Pimple unset 2014-11-11 22:04:46 +01:00
Thomas Müller 994768d99f Update Pimple to V3.0 2014-11-03 16:57:16 +01:00
Bernhard Posselt 0696099bad add dataresponse
fix docstrings

adjust copyright date

another copyright date update

another header update

implement third headers argument, fix indention, fix docstrings

fix docstrings
2014-10-29 09:43:47 +01:00
Lukas Reschke d060180140 Use function outside of loop
Otherwise the function is executed n times which is a lot of overhead
2014-10-24 12:27:53 +02:00
Thomas Müller 6c1871da06 Merge pull request #10985 from owncloud/db-cleanup
Cleanup database handling
2014-10-23 13:48:33 +02:00
Lukas Reschke be06937e65 Use mixed as type
Actually query() returns value of the type "mixed" (as is also stated in the interface) - this is purely there to make our IDEs and Scrutinizer happier.
2014-10-22 15:09:33 +02:00
Thomas Müller 02c5933af8 introduce SessionMiddleWare to control session handling via an annotation 2014-10-22 12:44:19 +02:00
Robin Appelman d83b11d34a Use statements wrapper in \OCP\IDB 2014-10-22 12:29:53 +02:00
Robin Appelman 2ae6a0d96d Move creating the database connection to the server container 2014-10-22 12:29:53 +02:00
Lukas Reschke 41374986d3 Remove dead code 2014-09-29 17:20:29 +02:00
Patrick Paysant cb5416b798 Allow default values for route parameters. 2014-09-09 23:00:29 +02:00
Robin Appelman fa3393674c Better phpdoc and method naming 2014-09-04 13:26:51 +02:00
Robin Appelman 65608d7c92 Use the public api to get event sources 2014-09-03 13:36:15 +02:00
Jörn Friedrich Dreyer f551917a3c kill OC::$session
maintain deprecated \OC::$session when getting or setting the session via the server container or UserSession

restore order os OC::$session and OC::$CLI

remove unneded initialization of dummy session

write back session when $useCustomSession is true

log warning when deprecated app is used
2014-08-29 10:22:21 +02:00
Morris Jobke 676fa459d7 Minor fixes
* instanceof \OC\Files\View
* fix misplaced paranthesis
* remove misplaced character in comment
2014-08-05 16:53:28 +02:00
Morris Jobke 9ee1c7ff71 Merge pull request #9228 from owncloud/remove-routing-singular-issues
Routing: Dont strip the s from the resource id to prevent possible weird behavior with irregular english plural nouns
2014-07-14 17:10:07 +02:00
Morris Jobke 904e3102d3 Merge pull request #9288 from owncloud/fix_dispatcher_null_values
don't typecast null values inside dispatcher.php
2014-07-02 15:29:33 +02:00
Morris Jobke b6a4cc20f7 Redirect after session expiry to the previous loaded page
* fixes #6945
2014-07-01 16:54:52 +02:00
Georg Ehrke c30bea45e9 don't typecast null values inside dispatcher.php 2014-06-29 22:40:50 +02:00
Bernhard Posselt 2662c4c61b use id instead of resourceId 2014-06-26 14:20:35 +02:00
Bernhard Posselt 5496ca234b dont strip the s from the resource 2014-06-26 14:02:20 +02:00
Vincent Petry 3e1576011f Merge pull request #8980 from owncloud/better-accept-header
handle http accept headers more gracefully
2014-06-12 13:28:03 +02:00
Vincent Petry 4e4c2b04c8 Fixed array_combine for PHP 5.3 2014-06-11 19:13:49 +02:00
Bernhard Posselt 0252d39bb6 fix indention 2014-06-11 00:57:00 +02:00