99 Commits (5eae69bd2d73bc3ec6b60e2c1eaecb70faa019cc)

Author	SHA1	Message	Date
Roeland Jago Douma	b68567e9ba	Add StandaloneTemplateResponse ... This can be used by pages that do not have the full Nextcloud UI. So notifications etc do not load there. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	d88604015a	No need to emit additonalscript event on public pages ... There already is a separate event for this. This will make it possible to only inject code with the logged in one on default rendered pages. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	d182037bce	Emit to load additionalscripts ... Fixes #13662 This will fire of an event after a Template Response has been returned. There is an event for the generic loading and one when logged in. So apps can chose to load only on loged in pages. This is a more generic approach than the files app event. As some things we might want to load on other pages as well besides the files app. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Joas Schilling	f8b74cf0a5	Allow resources via OCS as well ... Signed-off-by: Joas Schilling <coding@schilljs.com>	7 years ago
Roeland Jago Douma	ad676c0102	Set default frame-ancestors to 'self' ... For #13042 Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	64244e1a4f	CSP: Allow fonts to be provided in data ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	54ff913de6	Cleanup middleware registering ... Fixes #12224 Since we only use the middleware at 1 location it makes no sense to register them in each and every container. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	514426e27d	Only trust the X-FORWARDED-HOST header for trusted proxies ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	0e5147f001	Fix tests ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Oliver Wegner	401ca28f07	Adding handling of CIDR notation to trusted_proxies for IPv4 ... Signed-off-by: Oliver Wegner <void1976@gmail.com>	7 years ago
Roeland Jago Douma	579822b6a5	Add report-uri to CSP ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	5b61ef9213	Disallow unsafe-eval by default ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	8c1e75e052	Do not use file as template parameter ... Using file will overwrite the $file parameter in the template base. Leading to trying to include a file that is the exception message. Which will of course fail. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	5455045a9b	Fix direct access to authen page ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	1bb8bc8ff9	Add AuthPublicShareControllerTest ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	61e445da88	Add PublicShareControllerTests ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	e7338173e8	Add PublicShareMiddlewareTest ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	a34495933e	Move caching logic to response ... This avoids having to do it at all the places we want cached responses. We can't inject the ITimeFactor without breaking public API. However we can perfectly overwrite the service (resulting in the same testable effect). Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	3ad7daeda5	Add tests ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	d179186430	Remove testcase ... Since a token now always requires a string we don't need to test for null Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Julius Härtl	5a4aa2b7dd	Add test for PublicTemplateResponse ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	8 years ago
Morris Jobke	cf35c4b03a	Provide translated error message for permission error ... Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Roeland Jago Douma	0ee45d3d20	Fix proper types ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	ca9f364fd4	Fix tests ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	7405dfb544	Update tests ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Joas Schilling	bf2be08c9f	Fix risky tests without assertions ... Signed-off-by: Joas Schilling <coding@schilljs.com>	8 years ago
Joas Schilling	870023365c	Fix "Undefined method setExpectedException()" ... Signed-off-by: Joas Schilling <coding@schilljs.com>	8 years ago
Morris Jobke	2a38605545	Properly log the full exception instead of only the message ... Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Morris Jobke	c70927eaa0	Remove not needed 3rdparty app disabling during upgrade for PHP 5.x ... Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Joas Schilling	7bc9a69c3f	Remove deprecated core API ... Signed-off-by: Joas Schilling <coding@schilljs.com>	8 years ago
Roeland Jago Douma	57050146f6	Move passwordconfirmation to its own midleware ... Add tests Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Bjoern Schiessle	1bcbeb24bc	disable password confirmation with SSO ... Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>	8 years ago
Bjoern Schiessle	f0202245ee	allow 'Nextcloud' in the user agent string of Android ... Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>	8 years ago
Morris Jobke	43e498844e	Use ::class in test mocks ... Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Morris Jobke	ce0c45a4ea	Use proper DI for security middleware for app enabled check ... Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Roeland Jago Douma	c257cd57d4	Handle SameSiteCookie check for index.php in AppFramework Middleware ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Thomas Citharel	ecf347bd1a	Add CSP frame-ancestors support ... Didn't set the @since annotation yet. Signed-off-by: Thomas Citharel <tcit@tcit.fr>	8 years ago
Lukas Reschke	f93a82b8b0	Remove explicit type hints for Controller ... This is public API and breaks the middlewares of existing apps. Since this also requires maintaining two different code paths for 12 and 13 I'm at the moment voting for reverting this change. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Roeland Jago Douma	f71dc7523f	Fix tests ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	3548603a88	Fix middleware implementations signatures ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Lukas Reschke	f22ab3e665	Add metadata to \OCP\AppFramework\Http\Response::throttle ... Fixes https://github.com/nextcloud/server/issues/5891 Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Roeland Jago Douma	0b495ceff8	Remove deprecated Controller Functions ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Lukas Reschke	8149945a91	Make BruteForceProtection annotation more clever ... This makes the new `@BruteForceProtection` annotation more clever and moves the relevant code into it's own middleware. Basically you can now set `@BruteForceProtection(action=$key)` as annotation and that will make the controller bruteforce protected. However, the difference to before is that you need to call `$responmse->throttle()` to increase the counter. Before the counter was increased every time which leads to all kind of unexpected problems. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	31ae39c569	Add tests for multiple parameters ... Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	a1ae5275f9	Move to dedicated MiddleWare ... Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	66835476b5	Add support for ratelimiting via annotations ... This allows adding rate limiting via annotations to controllers, as one example: ``` @UserRateThrottle(limit=5, period=100) @AnonRateThrottle(limit=1, period=100) ``` Would mean that logged-in users can access the page 5 times within 100 seconds, and anonymous users 1 time within 100 seconds. If only an AnonRateThrottle is specified that one will also be applied to logged-in users. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Roeland Jago Douma	2a9192334e	Don't try to parse empty body if there is no body ... Fixes #3890 If we do a put request without a body the current code still tries to read the body. This patch makes sure that we do not try to read the body if the content length is 0. See RFC 2616 Section 4.3 Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Morris Jobke	f9bc53146d	Fix unit tests ... Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Roeland Jago Douma	21641302a9	Add DI intergration tests ... * Moved some interface definitions to Server.php (more to come) * Build/Query only for existing classes in the AppContainer * Build/Query only for classes of the App in the AppContainer * Offload other stuff to the servercontainer Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	7cece61ff6	Extend DI tests ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago