nextcloud-server

Commit Graph

Author	SHA1	Message	Date
Christoph Wurst	d89a75be0b	Update all license headers for Nextcloud 21 Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	5 years ago
Christoph Wurst	cb057829f7	Update license headers for 19 Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	1584c9ae9c	Add visibility to all methods and position of static keyword Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	caff1023ea	Format control structures, classes, methods and function To continue this formatting madness, here's a tiny patch that adds unified formatting for control structures like if and loops as well as classes, their methods and anonymous functions. This basically forces the constructs to start on the same line. This is not exactly what PSR2 wants, but I think we can have a few exceptions with "our" style. The starting of braces on the same line is pracrically standard for our code. This also removes and empty lines from method/function bodies at the beginning and end. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	44577e4345	Remove trailing and in between spaces Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	afbd9c4e6e	Unify function spacing to PSR2 recommendation Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	1e086064f5	Move legacy classes from PSR0 to PSR4 Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	5bf3d1bb38	Update license headers Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
J0WI	1b074f48d8	Remove duplicated spaces Signed-off-by: J0WI <J0WI@users.noreply.github.com>	6 years ago
J0WI	3f2932c75a	Sort headers Signed-off-by: J0WI <J0WI@users.noreply.github.com>	6 years ago
J0WI	76cbd7db6e	Add X-Frame-Options header to .htaccess Signed-off-by: J0WI <J0WI@users.noreply.github.com>	6 years ago
Roeland Jago Douma	3b1e16458d	Forbid eval on legacy responses Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Peter Kraume	79b8703f29	Set Referrer-Policy also in addSecurityHeaders() Fix: #12689 Signed-off-by: Peter Kraume <peter.kraume@gmx.de>	7 years ago
Morris Jobke	b0a296e2e1	Do not use HTTP code OC_Response constants anymore Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Morris Jobke	79d9841bce	Replace hardcoded status headers with calls to http_response_code() Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Morris Jobke	53a899a1f5	Fix the HTTP 1.0 status code and properly detect 1.0 vs 1.1&2.0 Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Morris Jobke	e758cfcdc8	Remove unused methods of OC_Response Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Morris Jobke	70b1f510f2	Use normal header() calls instead of private method calls Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Morris Jobke	0eebff152a	Update license headers Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Lukas Reschke	dfd8125aeb	Replace wrong PHPDocs Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Joas Schilling	bd37021587	Fix casing of same origin frame option Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Lukas Reschke	3a90ab7e0a	Update legacy CSP policy Aligns it with the one enforced by the AppFramework Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	bff6c8aafc	Move X-Frame-Options into PHP The public calendar view should be embeddable and we can't do that if the .htaccess sets a global X-Frame-Options. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	fdcb8edd78	Add nonce also to legacy CSP Pages that do not use the AppFramework have its CSP inherited from `\OC_Response::addSecurityHeaders`. While those are not many anymore, there are some examples such as the "Help" page. To stay completely backwards-compatible we should also add the nonce to the legacy CSP response. To test that open your browser console and open the help page. Without this you will get a JS error. With this you won't. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Sergio Bertolín	0417cbafd0	Changed request to not add a prefix to the url (#26256 ) * Changed request to not add a prefix to the url * Expecting forbidden instead of service unavailable * Handling login exceptions	9 years ago
Joas Schilling	ba87db3fcc	Fix others	10 years ago
Lukas Reschke	aba539703c	Update license headers	10 years ago
Roeland Jago Douma	368be8894c	Move non PSR-4 files from lib/private root to legacy As discussed we move all old style classes (OC_FOO_BAR) to legacy. Then from there we can evaluate the need to convert them back or if they can be fully deprecated/deleted.	10 years ago
Stefan Weil	b1a856d7b7	lib: Fix typos (found by codespell) Signed-off-by: Stefan Weil <sw@weilnetz.de>	10 years ago
Thomas Müller	682821c71e	Happy new year!	10 years ago
Lukas Reschke	4d0dcd3c53	Add X-Download-Options and X-Permitted-Cross-Domain-Policies Two small security hardenings for our IE users and those with Adobe products. Aligns it more with https://github.com/twitter/secureheaders#secureheaders---	10 years ago
Lukas Reschke	bafb86fb9f	Use getHttpProtocol instead of $_SERVER	10 years ago
Lukas Reschke	e735a9915c	Add blob: scheme to default CSP policy Fixes https://github.com/owncloud/core/issues/19438	10 years ago
Olivier Paroz	c4bac1655d	Fix CSP for images for legacy apps Fixes #19425	10 years ago
Morris Jobke	f63915d0c8	update license headers and authors	11 years ago
Lukas Reschke	a98b819366	Add version to deprecation notice As requested by @MorrisJobke	11 years ago
Lukas Reschke	f672e120fc	Deprecate unused `\OCP\Response::sendFile` This function is unused in our own code and can be better achieved using the AppFramework. Also very easy to do grave mistaked using this function.	11 years ago
Lukas Reschke	9d1ce53cb1	Add some generic default headers as well via PHP	11 years ago
Andreas Fischer	0f58315543	Add OC_Response::setContentLengthHeader() for Apache PHP SAPI workaround. Do not send Content-Length headers with a value larger than PHP_INT_MAX (2147483647) on Apache PHP SAPI 32-bit. PHP will eat them and send 2147483647 instead. When X-Sendfile is enabled, Apache will send a correct Content-Length header, even for files larger than 2147483647 bytes. When X-Sendfile is not enabled, ownCloud will not send a Content-Length header. This prevents progress bars from working, but allows the actual transfer to work properly.	11 years ago
Jenkins for ownCloud	b585d87d9d	Update license headers	11 years ago
Lukas Reschke	bbd5f28415	Let users configure security headers in their Webserver Doing this in the PHP code is not the right approach for multiple reasons: 1. A bug in the PHP code prevents them from being added to the response. 2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud) 3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations. This pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS.	11 years ago
Morris Jobke	06aef4e8b1	Revert "Updating license headers" This reverts commit `6a1a4880f0`.	11 years ago
Jenkins for ownCloud	6a1a4880f0	Updating license headers	11 years ago
Lukas Reschke	886bda5f81	Refactor OC_Request into TrustedDomainHelper and IRequest This changeset removes the static class `OC_Request` and moves the functions either into `IRequest` which is accessible via `\OC::$server::->getRequest()` or into a separated `TrustedDomainHelper` class for some helper methods which should not be publicly exposed. This changes only internal methods and nothing on the public API. Some public functions in `util.php` have been deprecated though in favour of the new non-static functions. Unfortunately some part of this code uses things like `__DIR__` and thus is not completely unit-testable. Where tests where possible they ahve been added though. Fixes https://github.com/owncloud/core/issues/13976 which was requested in https://github.com/owncloud/core/pull/13973#issuecomment-73492969	11 years ago
Lukas Reschke	b20174bdad	Allow AppFramework applications to specify a custom CSP header This change allows AppFramework applications to specify a custom CSP header for example when the default policy is too strict. Furthermore this allows us to partially migrate away from CSS and allowed eval() in our JavaScript components. Legacy ownCloud components will still use the previous policy. Application developers can use this as following in their controllers: ```php $response = new TemplateResponse('activity', 'list', []); $cspHelper = new ContentSecurityPolicyHelper(); $cspHelper->addAllowedScriptDomain('www.owncloud.org'); $response->addHeader('Content-Security-Policy', $cspHelper->getPolicy()); return $response; ``` Fixes https://github.com/owncloud/core/issues/11857 which is a pre-requisite for https://github.com/owncloud/core/issues/13458 and https://github.com/owncloud/core/issues/11925	11 years ago
Lukas Reschke	b3f881748d	Allow any outgoing XHR connections Quickfix for https://github.com/owncloud/core/issues/11064	11 years ago
Morris Jobke	dc36d30953	Remove all occurences of @brief and @returns from PHPDoc * test case added to avoid adding them later	12 years ago
Robin McCorkell	87b548ed91	Fix all PHPDoc types and variable names, in /lib	12 years ago
Thomas Müller	3cd32dcb7c	adding X-Robots-Tag to all responses of ownCloud + move addSecurityHeaders() to OC_Response, which seems to be a more reasonable place	12 years ago
Lukas Reschke	0b7d9e2668	Cleanup code a little bit - Use OCP\Response constants instead of the HTTP error code - Use checkAppEnabled() instead of OC_App::isEnabled with an if statement - Remove uneeded variable $baseURL - Rename $isvalid to $isValid	12 years ago

7 Commits (5cd1880daa048a685da689c7f41a2e50486494de)