45 Commits (0fac2e3f3aaaeaddf431f7877ebddb6372a00a42)

Author	SHA1	Message	Date
Lukas Reschke	f9e90e92d4	Encode HTML tags in JSON ... While not encoding the HTML tags in the JSON response is perfectly fine since we set the proper mimetype as well as disable content sniffing a lot of automated code scanner do report this as security bug. Encoding them leads to less discussions and a lot of saved time.	11 years ago
Lukas Reschke	a7e4785be9	Cleanup OCS code ... This removes unused code from `OC_OCS` which nobody understood what it really was for anyways.	11 years ago
Thomas Müller	1d219cf799	With V2 we should ensure that the status codes are kept in sync	11 years ago
sualko	ead25de628	add data: to allowed image domains	11 years ago
Thomas Müller	649cc2fa89	Remove duplicate and unused code	11 years ago
Lukas Reschke	62e3de1bdb	Check if response could get generated ... `json_encode` fails hard on PHP >= 5.5 if a non UTF-8 value is specified by returning false. Older PHP versions just nullify the value which makes it at least somewhat usable. This leads to very confusing errors which are very hard to debug since developers are usually not aware of this. In this case I'd consider throwing a fatal exception – since it arguably is an error situation – is a fair solution since this makes developers and administrators aware of any occurence of the problem so that these bugs can get fixed. Fixes https://github.com/owncloud/core/issues/17265	11 years ago
Morris Jobke	f63915d0c8	update license headers and authors	11 years ago
Lukas Reschke	34f5541088	Add `no-store` to AppFramework	11 years ago
Lukas Reschke	a62190a72d	Add support for disallowing domains to the ContentSecurityPolicy ... For enhanced security it is important that there is also a way to disallow domains, including the default ones. With this commit every method gets added a new "disallow" function.	11 years ago
Morris Jobke	7644950b48	Add @since tags to all methods in public namespace ... * enhance the app development experience - you can look up the method introduction right inside the code without searching via git blame * easier to write apps for multiple versions	11 years ago
Morris Jobke	1d30efdd73	Fix private member access of parent class in ocsresponse ... * noticed while checking PHPDoc	11 years ago
Jenkins for ownCloud	b585d87d9d	Update license headers	11 years ago
Lukas Reschke	e2453d78c0	Properly catch whether a share is `null` ... Despite it's PHPDoc the function might return `null` which was not properly catched and thus in some situations the share was resolved to the sharing users root directory. To test this perform the following steps: * Share file in owncloud 7 (7.0.4.2) * Delete the parent folder of the shared file * The share stays is in the DB and the share via the sharelink is inaccessible. (which is good) * Upgrade to owncloud 8 (8.0.2) (This step is crucial. The bug is not reproduceable without upgrading from 7 to 8. It seems like the old tokens are handled different than the newer ones) * Optional Step: Logout, Reset Browser Session, etc. * Access the share via the old share url: almost empty page, but there is a dowload button which adds a "/download" to the URL. * Upon clicking, a download.zip is downloaded which contains EVERYTHING from the owncloud directory (of the user who shared the file) * No exception is thrown and no error is logged. This will add a check whether the share is a valid one and also adds unit tests to prevent further regressions in the future. Needs to be backported to ownCloud 8. Adding a proper clean-up of the orphaned shares is out-of-scope and would probably require some kind of FK or so. Fixes https://github.com/owncloud/core/issues/15097	11 years ago
Roeland Jago Douma	1a0f9c375b	Avatar controller moved to AppFrameWork ... * Original avatarcontroller migrated to the appframework * Added DataDisplayResponse that show data inline in the browser (used to retrun the image) * Removed some unneeded code * Added unit tests for the avatarcontroller	11 years ago
Lukas Reschke	cdced56f2b	Fix PHPDoc ... That apparently went lost when changing the signature.	11 years ago
Lukas Reschke	b29940d956	Add support for 'child-src' directive ... This is required when working with stuff such as PDF.js in the files_pdfviewer application. Opt-in only. Master change only because the stable CSP policies has a failback that allows nearly anything 🙈	11 years ago
Bernhard Posselt	95239ad21e	AppFramework StreamResponse ... First stab at the StreamResponse, see #12988 The idea is to use an interface ICallbackResponse (I'm not 100% happy with the name yet, suggestions?) that allow the response to output things in its own way, for instance stream the file using readfile Unittests are atm lacking, plan is to check if a mock of ICallbackResponse will be used by calling its callback (also unhappy with this name) method Usage is: $response = new StreamResponse('path/to/file'); rename io to output, add additional methods and handle error and not modified cases when using StreamResponse fix indention and uppercasing, also handle forbidden cases fix indention fix indention no forbidden, figuring out if a file is really readable is too complicated to get to work across OSes and streams remove useless import remove useless import fix intendation	11 years ago
Morris Jobke	06aef4e8b1	Revert "Updating license headers" ... This reverts commit 6a1a4880f0.	11 years ago
Jenkins for ownCloud	6a1a4880f0	Updating license headers	11 years ago
Lukas Reschke	a9d1a01440	Rename to allowEval	11 years ago
Lukas Reschke	b20174bdad	Allow AppFramework applications to specify a custom CSP header ... This change allows AppFramework applications to specify a custom CSP header for example when the default policy is too strict. Furthermore this allows us to partially migrate away from CSS and allowed eval() in our JavaScript components. Legacy ownCloud components will still use the previous policy. Application developers can use this as following in their controllers: ```php $response = new TemplateResponse('activity', 'list', []); $cspHelper = new ContentSecurityPolicyHelper(); $cspHelper->addAllowedScriptDomain('www.owncloud.org'); $response->addHeader('Content-Security-Policy', $cspHelper->getPolicy()); return $response; ``` Fixes https://github.com/owncloud/core/issues/11857 which is a pre-requisite for https://github.com/owncloud/core/issues/13458 and https://github.com/owncloud/core/issues/11925	11 years ago
Bernhard Posselt	fdc64e370c	add a controller and reponse for ocs	11 years ago
Georg Ehrke	f579f2bd94	add Download logfile button to admin settings ... add logSettingsController add download logfile button move getEntries to LogSettingsController move set log level to logsettingscontroller.php add warning if logfile is bigger than 100MB add unit test for set log level fix typecasting, add new line at EoF show log and logfile download only if log_type is set to owncloud add unit test for getFilenameForDownload	11 years ago
Lukas Reschke	048139074d	Add functions to modify cookies to response class ... Currently there is no AppFramework way to modify cookies, which makes it unusable for quite some use-cases or results in untestable code. This PR adds some basic functionalities to add and invalidate cookies. Usage: ```php $response = new TemplateResponse(...); $response->addCookie('foo', 'bar'); $response->invalidateCookie('foo'); $response->addCookie('bar', 'foo', new \DateTime('2015-01-01 00:00')); ``` Existing cookies can be accessed with the AppFramework using `$this->request->getCookie($name)`.	11 years ago
Bernhard Posselt	91a23bfa9c	fix typo in content type	11 years ago
Bernhard Posselt	0696099bad	add dataresponse ... fix docstrings adjust copyright date another copyright date update another header update implement third headers argument, fix indention, fix docstrings fix docstrings	11 years ago
Morris Jobke	889088f72d	Fix template rendering for 'blank' templates	12 years ago
Bernhard Posselt	587a8df566	remove controller serializers	12 years ago
Bernhard Posselt	1d45239c65	adjust license headers to new mail address	12 years ago
Bernhard Posselt	80648da431	implement most of the basic stuff that was suggested in #8290	12 years ago
Bernhard Posselt	9a4d204b55	add cors middleware ... remove methodannotationreader namespace fix namespace for server container fix tests fail if with cors credentials header is set to true, implement a reusable preflighted cors method in the controller baseclass, make corsmiddleware private and register it for every request remove uneeded local in cors middleware registratio dont uppercase cors to easily use it from routes fix indention comment fixes explicitely set allow credentials header to false dont depend on better controllers PR, fix that stuff later split cors methods to be in a seperate controller for exposing apis remove protected definitions from apicontroller since controller has it	12 years ago
Bernhard Posselt	7e447f4f42	make download and redirectresponse public	12 years ago
Lukas Reschke	b04d95b116	Remove uneeded usages of nosniff	12 years ago
Thomas Tanghus	a1aacc18df	Add @return PHPDocs	12 years ago
Thomas Tanghus	8f6ea900f2	Chainable Response in AppFramework	12 years ago
Jörn Friedrich Dreyer	2a6a9a8cef	polish documentation based on scrutinizer patches	12 years ago
Morris Jobke	bc8cc9142e	AppFramework(Controller|HTTP|HTTP-Responses|Middleware), IContainer API fixes	12 years ago
Morris Jobke	ef592981ea	unify license headers for public API files	12 years ago
Thomas Tanghus	ad017285e1	Fix namespace for OCP\Appframework\Http ... To avoid having to use OCP\Appframework\Http\Http in the public - and stable - API OCP\Appframework\Http is now both a class and a namespace.	12 years ago
Morris Jobke	30f4d91d01	Public API documentation fixes ... refs #4883 * http/response.php * config.php * response.php * files.php * idbconnection.php * app.php * user.php * template.php * share.php * db.php * icache.php & il10n.php	12 years ago
Thomas Müller	e071bfc144	fixing SecurityMiddleware to use OC6 API	12 years ago
Thomas Müller	911bd3c16f	moving response classes over to OCP	13 years ago