nextcloud-server

Commit Graph

Author	SHA1	Message	Date
Joas Schilling	c20ab0049f	Identify Chromium as Chrome Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Roeland Jago Douma	e351ba56f1	Move browserSupportsCspV3 to CSPNonceManager Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Lukas Reschke	9e6634814e	Add support for CSP nonces CSP nonces are a feature available with CSP v2. Basically instead of saying "JS resources from the same domain are ok to be served" we now say "Ressources from everywhere are allowed as long as they add a `nonce` attribute to the script tag with the right nonce. At the moment the nonce is basically just a `<?php p(base64_encode($_['requesttoken'])) ?>`, we have to decode the requesttoken since `:` is not an allowed value in the nonce. So if somebody does on their own include JS files (instead of using the `addScript` public API, they now must also include that attribute.) IE does currently not implement CSP v2, thus there is a whitelist included that delivers the new CSP v2 policy to newer browsers. Check http://caniuse.com/#feat=contentsecuritypolicy2 for the current browser support list. An alternative approach would be to just add `'unsafe-inline'` as well as `'unsafe-inline'` is ignored by CSPv2 when a nonce is set. But this would make this security feature unusable at all in IE. Not worth it at the moment IMO. Implementing this offers the following advantages: 1. Security: As we host resources from the same domain by design we don't have to worry about 'self' anymore being in the whitelist 2. Performance: We can move oc.js again to inline JS. This makes the loading way quicker as we don't have to load on every load of a new web page a blocking dynamically non-cached JavaScript file. If you want to toy with CSP see also https://csp-evaluator.withgoogle.com/ Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Roeland Jago Douma	6dace7f6ad	Add tests	9 years ago
Roeland Jago Douma	4066f04c4b	Fix getMock MapperTestUtility	9 years ago
Roeland Jago Douma	3c55fe6bab	Split OCS version handling This cleans up a bit the OCSController/Middleware. Since the 2 versions of OCS differ a bit. Moved a lot of stuff internal since it is of no concern to the outside.	9 years ago
Roeland Jago Douma	777c3ee325	Add FileDisplayResponse A lazy implementation of the DisplayResponse that only hits the filesystem if the etag and mtime do not match.	9 years ago
Roeland Jago Douma	21a87d3c2e	No body or content-length for 204 and 304 responses See: https://tools.ietf.org/html/rfc7230#section-3.3	9 years ago
Lukas Reschke	d50e7ee36c	Remove reading PATH_INFO from server variable Having two code paths for this is unreliable and can lead to bugs. Also, in some cases Apache isn't setting the PATH_INFO variable when mod_rewrite is used. Fixes https://github.com/nextcloud/server/issues/983	10 years ago
Roeland Jago Douma	a0b22227fc	Add tests	10 years ago
Roeland Jago Douma	a98376f38c	Add tests	10 years ago
Roeland Jago Douma	1f370c97ed	OCSController requires DataResponse The OCS Controller requires a DataResponse object to be returned. This means that all error handling will have to be done via exceptions thrown and handling in the middleware.	10 years ago
Lukas Reschke	b53ea18ea5	Match only for actual session cookie OVH has implemented load balancing in a very questionable way where the reverse proxy actually internally adds some cookies which would trigger a security exception. To work around this, this change only checks for the session cookie.	10 years ago
Roeland Jago Douma	0032a5c2d1	Hanlde Core and Settings app in AppFramework 'core' and 'settings' are just apps but we treat them slightly different. Make sure that we construct the correct namespace so we can actually do automatic AppFramework stuff.	10 years ago
Roeland Jago Douma	63f6d2d558	Allow ocs/v2.php/cloud/... routes One of the possibilities of the old OCS API is that you can define the url yourself. This PR makes this possible again by adding an optional root elemenet to the route. Routes are thus: .../ocs/v2.php/<root>/<url> By default <root> = apps/<app> This will allow for example the provisioning API etc to be in ../ovs/v2/php/cloud/users	10 years ago
Roeland Jago Douma	5c718b13b8	We should properly check for 'true' instaed of the bool	10 years ago
Roeland Jago Douma	f7f5216aa3	Dark hackery to not always disable CSRF for OCS controllers	10 years ago
Roeland Jago Douma	8bdd0adcee	Support subdir in the OCS v2 endpoint We should check against the ending substring since people could run their nextcloud in a subfolder. * Added test	10 years ago
Roeland Jago Douma	72b06d250d	Add tests	10 years ago
Lukas Reschke	ba4f12baa0	Implement brute force protection Class Throttler implements the bruteforce protection for security actions in Nextcloud. It is working by logging invalid login attempts to the database and slowing down all login attempts from the same subnet. The max delay is 30 seconds and the starting delay are 200 milliseconds. (after the first failed login)	10 years ago
Roeland Jago Douma	5f32b57332	Add unit tests	10 years ago
Lukas Reschke	a299fa38a9	[master] Port Same-Site Cookies to master Fixes https://github.com/nextcloud/server/issues/50	10 years ago
Roeland Jago Douma	0bda09236e	Add route tests	10 years ago
Roeland Jago Douma	937c9519d6	Mock logger	10 years ago
Roeland Jago Douma	2fa9e67294	Fix phpunit-5.4 wargning * getMock is deprecated. * \PDOStatement mocking fails hard on phpunit 4.8	10 years ago
Christoph Wurst	82b50d126c	add PasswordLoginForbiddenException	10 years ago
Christoph Wurst	9997c431c3	use client login method on CORS routes	10 years ago
Joas Schilling	94ad54ec9b	Move tests/ to PSR-4 (#24731 ) * Move a-b to PSR-4 * Move c-d to PSR-4 * Move e+g to PSR-4 * Move h-l to PSR-4 * Move m-r to PSR-4 * Move s-u to PSR-4 * Move files/ to PSR-4 * Move remaining tests to PSR-4 * Remove Test\ from old autoloader	10 years ago

31 Commits (311531ecce497663960877fc536ba94deff27bc0)