133 Commits (0fac2e3f3aaaeaddf431f7877ebddb6372a00a42)

Author	SHA1	Message	Date
Lukas Reschke	f9e90e92d4	Encode HTML tags in JSON ... While not encoding the HTML tags in the JSON response is perfectly fine since we set the proper mimetype as well as disable content sniffing a lot of automated code scanner do report this as security bug. Encoding them leads to less discussions and a lot of saved time.	10 years ago
Roeland Jago Douma	f12caf930e	Properly return 304 ... The ETag set in the IF_NONE_MODIFIED header is wraped in quotes ("). However the ETag that is set in response is not (yet). Also we need to cast the ETag to a string. * Added unit test	10 years ago
Lukas Reschke	8313a3fcb3	Add mitigation against BREACH ... While BREACH requires the following three factors to be effectively exploitable we should add another mitigation: 1. Application must support HTTP compression 2. Response most reflect user-controlled input 3. Response should contain sensitive data Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed. To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.	11 years ago
sualko	5590d64612	add more unit tests for data: as allowed image domain	11 years ago
sualko	930841b67a	add unit test for data: as allowed image domain	11 years ago
Lukas Reschke	4efa7c09b1	Use StringUtils::equals on CSRF token and add unit tests	11 years ago
Thomas Müller	3ecf7fce79	Fix unit test within OCSController	11 years ago
Thomas Müller	649cc2fa89	Remove duplicate and unused code	11 years ago
Robin McCorkell	182bc17aeb	Sanitize class names before registerService/query ... Leading backslashes are removed, so a `registerService('\\OC\\Foo')` can still be resolved with `query('OC\\Foo')`.	11 years ago
Robin McCorkell	0223221a64	Fix incorrect test naming ... `tesOverrideService()` was incorrect and wasn't getting called by PHPUnit. Also, the unit test itself was wrong, but went unnoticed because of point 1.	11 years ago
Bernhard Posselt	d8673dabe3	add test for factories ... use ref for factory test use a factory for registerAlias Ensure we construct SimpleContainer Use single instance of DIContainer in routing tests	11 years ago
Lukas Reschke	7dda86f371	Return proper status code in case of a CORS exception ... When returning a 500 statuscode external applications may interpret this as an error instead of handling this more gracefully. This will now make return a 401 thus. Fixes https://github.com/owncloud/core/issues/17742	11 years ago
Bernhard Posselt	a4e3939204	add registerAlias method to shorcut interface registration ... remove unused import add since tag fix typo	11 years ago
Thomas Müller	bd71540c8a	Fixing 'Undefined index: REMOTE_ADDR' - fixes #17460	11 years ago
Lukas Reschke	62e3de1bdb	Check if response could get generated ... `json_encode` fails hard on PHP >= 5.5 if a non UTF-8 value is specified by returning false. Older PHP versions just nullify the value which makes it at least somewhat usable. This leads to very confusing errors which are very hard to debug since developers are usually not aware of this. In this case I'd consider throwing a fatal exception – since it arguably is an error situation – is a fair solution since this makes developers and administrators aware of any occurence of the problem so that these bugs can get fixed. Fixes https://github.com/owncloud/core/issues/17265	11 years ago
Lukas Reschke	4d23e06097	Fix undefined offset ... There are cases where no trusted host is specified such as when installing the instance, this lead to an undefined offset warning in the log right after installing. (when another domain than localhost or 127.0.0.1 was used)	11 years ago
Robin McCorkell	f1e3e25158	AppFramework annotation whitespace unit test	11 years ago
Lukas Reschke	34f5541088	Add `no-store` to AppFramework	11 years ago
Bernhard Posselt	21ce5d034b	fix #16713	11 years ago
Joas Schilling	d3e3a84cae	Move the helpful method to the TestCase class	11 years ago
Bernhard Posselt	c8e3599cad	disallow cookie auth for cors requests ... testing ... fixes fix test add php doc fix small mistake add another phpdoc remove not working cors annotations from files app	11 years ago
Lukas Reschke	a62190a72d	Add support for disallowing domains to the ContentSecurityPolicy ... For enhanced security it is important that there is also a way to disallow domains, including the default ones. With this commit every method gets added a new "disallow" function.	11 years ago
Bernhard Posselt	df24a014b8	If the execute method on the mapper receives an assoc array, it binds by value instead of index	11 years ago
Lukas Reschke	b29940d956	Add support for 'child-src' directive ... This is required when working with stuff such as PDF.js in the files_pdfviewer application. Opt-in only. Master change only because the stable CSP policies has a failback that allows nearly anything 🙈	11 years ago
Bernhard Posselt	95239ad21e	AppFramework StreamResponse ... First stab at the StreamResponse, see #12988 The idea is to use an interface ICallbackResponse (I'm not 100% happy with the name yet, suggestions?) that allow the response to output things in its own way, for instance stream the file using readfile Unittests are atm lacking, plan is to check if a mock of ICallbackResponse will be used by calling its callback (also unhappy with this name) method Usage is: $response = new StreamResponse('path/to/file'); rename io to output, add additional methods and handle error and not modified cases when using StreamResponse fix indention and uppercasing, also handle forbidden cases fix indention fix indention no forbidden, figuring out if a file is really readable is too complicated to get to work across OSes and streams remove useless import remove useless import fix intendation	11 years ago
Bernhard Posselt	f993ed823e	fix tabs and spaces	11 years ago
Bernhard Posselt	aaf753bc9a	fix mappertestutility	11 years ago
Bernhard Posselt	7b2fdbfb0b	use IDBConnection and close cursors after insert/update/delete	11 years ago
Lukas Reschke	1c6eae9017	Get the real protocol behind several proxies ... X-Forwarded-Proto contains a list of protocols if ownCloud is behind multiple reverse proxies. This is a revival of https://github.com/owncloud/core/pull/11157 using the new IRequest public API.	11 years ago
Lukas Reschke	886bda5f81	Refactor OC_Request into TrustedDomainHelper and IRequest ... This changeset removes the static class `OC_Request` and moves the functions either into `IRequest` which is accessible via `\OC::$server::->getRequest()` or into a separated `TrustedDomainHelper` class for some helper methods which should not be publicly exposed. This changes only internal methods and nothing on the public API. Some public functions in `util.php` have been deprecated though in favour of the new non-static functions. Unfortunately some part of this code uses things like `__DIR__` and thus is not completely unit-testable. Where tests where possible they ahve been added though. Fixes https://github.com/owncloud/core/issues/13976 which was requested in https://github.com/owncloud/core/pull/13973#issuecomment-73492969	11 years ago
Lukas Reschke	a9d1a01440	Rename to allowEval	11 years ago
Lukas Reschke	b20174bdad	Allow AppFramework applications to specify a custom CSP header ... This change allows AppFramework applications to specify a custom CSP header for example when the default policy is too strict. Furthermore this allows us to partially migrate away from CSS and allowed eval() in our JavaScript components. Legacy ownCloud components will still use the previous policy. Application developers can use this as following in their controllers: ```php $response = new TemplateResponse('activity', 'list', []); $cspHelper = new ContentSecurityPolicyHelper(); $cspHelper->addAllowedScriptDomain('www.owncloud.org'); $response->addHeader('Content-Security-Policy', $cspHelper->getPolicy()); return $response; ``` Fixes https://github.com/owncloud/core/issues/11857 which is a pre-requisite for https://github.com/owncloud/core/issues/13458 and https://github.com/owncloud/core/issues/11925	11 years ago
Thomas Müller	c60dabd11b	Request requires a second parameter	11 years ago
Lukas Reschke	770fa761b8	Respect `mod_unique_id` and refactor `OC_Request::getRequestId` ... When `mod_unique_id` is enabled the ID generated by it will be used for logging. This allows for correlation of the Apache logs and the ownCloud logs. Testplan: - [ ] When `mod_unique_id` is enabled the request ID equals the one generated by `mod_unique_id`. - [ ] When `mod_unique_id` is not available the request ID is a 20 character long random string - [ ] The generated Id is stable over the lifespan of one request Changeset looks a little bit larger since I had to adjust every unit test using the HTTP\Request class for proper DI. Fixes https://github.com/owncloud/core/issues/13366	11 years ago
Bernhard Posselt	9873aa3d9e	fix license email	11 years ago
Bernhard Posselt	b89ddcfe41	fix license email	11 years ago
Bernhard Posselt	fdc64e370c	add a controller and reponse for ocs	11 years ago
Bernhard Posselt	81836ccc7e	another test for overriding the docblock	11 years ago
Bernhard Posselt	72d2b6f723	additional inheritance tests	11 years ago
Bernhard Posselt	84a47645b9	fix indention	11 years ago
Bernhard Posselt	983563d7d9	add tests for closing the cursor	11 years ago
Bernhard Posselt	37e8969d34	ignore cursorclosing	11 years ago
Bernhard Posselt	bb0c88a577	always set url parameters when they are available in the app dispatch ... prefer url parameters passed into the main method. If they are not present, use the containers urlParameters add space	11 years ago
Bernhard Posselt	f195123765	Intelligent container ... * resolves dependencies by type hint or variable name * simpler route.php * implementation of https://github.com/owncloud/core/issues/12829 Generates and injects parameters automatically. You can now build full classes like $c->query('MyClassName') without having to register it as a service. The resolved object's instance will be saved by using registerService. If a constructor parameter is not type hinted, the parameter name will be taken. Therefore the following two implementations are identical: class Class1 { function __construct(MyClassName $class) class Class1 { function __construct($MyClassName) This makes it possible to also inject primitive values such as strings, arrays etc. In addition if the query could not be resolved, a `QueryException` is now thrown Routes can now be returned as an array from `routes.php` and an `appinfo/application.php` is optional Old commit messages: make it possible to return the routes instead of having to intialize the application try to get the controller by convention add first implementation of automatic resolve add another test just to be sure store the resolved object more tests add phpdoc to public app.php method use the same variable for the public app.php method deprecate old methods and add services for public interfaces deprecated getServer method disallow private api injection for apps other than core or settings (settings should be an app goddamnit :D) register userid because its such an often used variable fix indention and leading slash use test namespace add deprecation reasons, remove private api usage checks and remove deprecation from getServer() add additional public interfaces add public interface for rootfolder fix syntax error remove deprecation from methods where no alternative is there yet remove deprecated from method which has no alternative add timezone public service for #12881 add another deprecation hint move deprecation into separate branch remove dead comment first try to get the namespace from the info.xml, if it does not exist, just uppercase the first letter also trim the namespace name add an interface for timefactory move timefactory to public and add icontrollermethodreflector keep core interface fix copyright date in headers	11 years ago
Lukas Reschke	d2e8358da2	Fix unit test	11 years ago
Morris Jobke	bf1b62a34a	PHP < 5.4 is not supported anymore - see #12606	11 years ago
Morris Jobke	2c5e4b3d3f	Remove last traces of travis integration	11 years ago
Lukas Reschke	048139074d	Add functions to modify cookies to response class ... Currently there is no AppFramework way to modify cookies, which makes it unusable for quite some use-cases or results in untestable code. This PR adds some basic functionalities to add and invalidate cookies. Usage: ```php $response = new TemplateResponse(...); $response->addCookie('foo', 'bar'); $response->invalidateCookie('foo'); $response->addCookie('bar', 'foo', new \DateTime('2015-01-01 00:00')); ``` Existing cookies can be accessed with the AppFramework using `$this->request->getCookie($name)`.	11 years ago
Joas Schilling	6202ca33ba	Make remaining files extend the test base	11 years ago
Bernhard Posselt	4e90c44301	add postfix ... add postfix	11 years ago