nextcloud-server

Commit Graph

Author	SHA1	Message	Date
Peter Kraume	79b8703f29	Set Referrer-Policy also in addSecurityHeaders() Fix: #12689 Signed-off-by: Peter Kraume <peter.kraume@gmx.de>	7 years ago
Morris Jobke	b0a296e2e1	Do not use HTTP code OC_Response constants anymore Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Morris Jobke	79d9841bce	Replace hardcoded status headers with calls to http_response_code() Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Morris Jobke	53a899a1f5	Fix the HTTP 1.0 status code and properly detect 1.0 vs 1.1&2.0 Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Morris Jobke	e758cfcdc8	Remove unused methods of OC_Response Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Morris Jobke	70b1f510f2	Use normal header() calls instead of private method calls Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Morris Jobke	0eebff152a	Update license headers Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Lukas Reschke	dfd8125aeb	Replace wrong PHPDocs Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Joas Schilling	bd37021587	Fix casing of same origin frame option Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Lukas Reschke	3a90ab7e0a	Update legacy CSP policy Aligns it with the one enforced by the AppFramework Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	bff6c8aafc	Move X-Frame-Options into PHP The public calendar view should be embeddable and we can't do that if the .htaccess sets a global X-Frame-Options. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	fdcb8edd78	Add nonce also to legacy CSP Pages that do not use the AppFramework have its CSP inherited from `\OC_Response::addSecurityHeaders`. While those are not many anymore, there are some examples such as the "Help" page. To stay completely backwards-compatible we should also add the nonce to the legacy CSP response. To test that open your browser console and open the help page. Without this you will get a JS error. With this you won't. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Sergio Bertolín	0417cbafd0	Changed request to not add a prefix to the url (#26256 ) * Changed request to not add a prefix to the url * Expecting forbidden instead of service unavailable * Handling login exceptions	9 years ago
Joas Schilling	ba87db3fcc	Fix others	10 years ago
Lukas Reschke	aba539703c	Update license headers	10 years ago
Roeland Jago Douma	368be8894c	Move non PSR-4 files from lib/private root to legacy As discussed we move all old style classes (OC_FOO_BAR) to legacy. Then from there we can evaluate the need to convert them back or if they can be fully deprecated/deleted.	10 years ago
Stefan Weil	b1a856d7b7	lib: Fix typos (found by codespell) Signed-off-by: Stefan Weil <sw@weilnetz.de>	10 years ago
Thomas Müller	682821c71e	Happy new year!	10 years ago
Lukas Reschke	4d0dcd3c53	Add X-Download-Options and X-Permitted-Cross-Domain-Policies Two small security hardenings for our IE users and those with Adobe products. Aligns it more with https://github.com/twitter/secureheaders#secureheaders---	10 years ago
Lukas Reschke	bafb86fb9f	Use getHttpProtocol instead of $_SERVER	10 years ago
Lukas Reschke	e735a9915c	Add blob: scheme to default CSP policy Fixes https://github.com/owncloud/core/issues/19438	11 years ago
Olivier Paroz	c4bac1655d	Fix CSP for images for legacy apps Fixes #19425	11 years ago
Morris Jobke	f63915d0c8	update license headers and authors	11 years ago
Lukas Reschke	a98b819366	Add version to deprecation notice As requested by @MorrisJobke	11 years ago
Lukas Reschke	f672e120fc	Deprecate unused `\OCP\Response::sendFile` This function is unused in our own code and can be better achieved using the AppFramework. Also very easy to do grave mistaked using this function.	11 years ago
Lukas Reschke	9d1ce53cb1	Add some generic default headers as well via PHP	11 years ago
Andreas Fischer	0f58315543	Add OC_Response::setContentLengthHeader() for Apache PHP SAPI workaround. Do not send Content-Length headers with a value larger than PHP_INT_MAX (2147483647) on Apache PHP SAPI 32-bit. PHP will eat them and send 2147483647 instead. When X-Sendfile is enabled, Apache will send a correct Content-Length header, even for files larger than 2147483647 bytes. When X-Sendfile is not enabled, ownCloud will not send a Content-Length header. This prevents progress bars from working, but allows the actual transfer to work properly.	11 years ago
Jenkins for ownCloud	b585d87d9d	Update license headers	11 years ago
Lukas Reschke	bbd5f28415	Let users configure security headers in their Webserver Doing this in the PHP code is not the right approach for multiple reasons: 1. A bug in the PHP code prevents them from being added to the response. 2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud) 3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations. This pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS.	11 years ago
Morris Jobke	06aef4e8b1	Revert "Updating license headers" This reverts commit `6a1a4880f0`.	11 years ago
Jenkins for ownCloud	6a1a4880f0	Updating license headers	11 years ago
Lukas Reschke	886bda5f81	Refactor OC_Request into TrustedDomainHelper and IRequest This changeset removes the static class `OC_Request` and moves the functions either into `IRequest` which is accessible via `\OC::$server::->getRequest()` or into a separated `TrustedDomainHelper` class for some helper methods which should not be publicly exposed. This changes only internal methods and nothing on the public API. Some public functions in `util.php` have been deprecated though in favour of the new non-static functions. Unfortunately some part of this code uses things like `__DIR__` and thus is not completely unit-testable. Where tests where possible they ahve been added though. Fixes https://github.com/owncloud/core/issues/13976 which was requested in https://github.com/owncloud/core/pull/13973#issuecomment-73492969	11 years ago
Lukas Reschke	b20174bdad	Allow AppFramework applications to specify a custom CSP header This change allows AppFramework applications to specify a custom CSP header for example when the default policy is too strict. Furthermore this allows us to partially migrate away from CSS and allowed eval() in our JavaScript components. Legacy ownCloud components will still use the previous policy. Application developers can use this as following in their controllers: ```php $response = new TemplateResponse('activity', 'list', []); $cspHelper = new ContentSecurityPolicyHelper(); $cspHelper->addAllowedScriptDomain('www.owncloud.org'); $response->addHeader('Content-Security-Policy', $cspHelper->getPolicy()); return $response; ``` Fixes https://github.com/owncloud/core/issues/11857 which is a pre-requisite for https://github.com/owncloud/core/issues/13458 and https://github.com/owncloud/core/issues/11925	11 years ago
Lukas Reschke	b3f881748d	Allow any outgoing XHR connections Quickfix for https://github.com/owncloud/core/issues/11064	11 years ago
Morris Jobke	dc36d30953	Remove all occurences of @brief and @returns from PHPDoc * test case added to avoid adding them later	12 years ago
Robin McCorkell	87b548ed91	Fix all PHPDoc types and variable names, in /lib	12 years ago
Thomas Müller	3cd32dcb7c	adding X-Robots-Tag to all responses of ownCloud + move addSecurityHeaders() to OC_Response, which seems to be a more reasonable place	12 years ago
Lukas Reschke	0b7d9e2668	Cleanup code a little bit - Use OCP\Response constants instead of the HTTP error code - Use checkAppEnabled() instead of OC_App::isEnabled with an if statement - Remove uneeded variable $baseURL - Rename $isvalid to $isValid	12 years ago
Lukas Reschke	e88731a477	Some more PHPDoc fixes	12 years ago
Vincent Petry	b619ff6076	Return 503 when a config/data dir error exists	12 years ago
Jörn Friedrich Dreyer	2a6a9a8cef	polish documentation based on scrutinizer patches	12 years ago
Martial Saunois	c2ed8d5aa1	New user agent added for the Freebox. The Freebox is the multimedia device of a french Internet provider: Free. This device provides a seedbox which uses the user agent "Mozilla/5.0". In the "Content-Disposition" header, if the "filename" key is used with the "filename*=UTF-8''" value, the seedbox does not take care about the header and saves the file name with the origin URL. This patch brings the support for the Freebox users.	12 years ago
Vincent Petry	09bd5bd517	Added isUserAgent() method to request - added isUserAgent() method to OC_Request which makes it possible to test it - OC_Response::setContentDisposition now uses OC_Request::isUserAgent()	12 years ago
Vincent Petry	82bf1f9c8c	Added workaround for Android content disposition Fixes #5807	12 years ago
Vincent Petry	409b510889	Moved content disposition code+workarounds to OCP\Response Added new OC\Response API called setContentDispositionHeader() that contains the needed workarounds for UTF8 and IE. Refactored download code to use the new API. Removed unused trashbin download file.	12 years ago
Thomas Müller	9c9dc276b7	move the private namespace OC into lib/private - OCP will stay in lib/public Conflicts: lib/private/vcategories.php	13 years ago
Jörn Friedrich Dreyer	8dc6bdd96b	clean up usage of DatabaseSetupException and catch Exceptions in entrypoints	13 years ago
Sam Tuke	8b01286a5d	Merged branch 'master'	14 years ago
Bart Visscher	386d1ac49f	Fix setEtagHeader function	14 years ago
Thomas Tanghus	71aa36c3f1	ETags must be quoted.	14 years ago

17 Commits (845fd2dd5a8700131494de8c7ebc66ebef097821)