38 Commits (eb1d5fdaf8b077809100b1db48688301be2c19fb)

Author	SHA1	Message	Date
Lukas Reschke	06a4da43ec	[master] Ignore certificate file if it starts with file://	10 years ago
Lukas Reschke	dc6789fd5b	Explicitly check for port ... The setup uses `\OCP\IRequest::getInsecureServerHost` which in some cases can also include a port. This makes the trusted domain check fail thus. I've decided to add this here that way because adjusting the setup would require parsing the host properly. This is not something that can be done very good in PHP. Check the following example for why `parse_url` is not our friend: https://3v4l.org/k501Z	10 years ago
Lukas Reschke	809ff5ac95	Add public API to give developers the possibility to adjust the global CSP defaults ... Allows to inject something into the default content policy. This is for example useful when you're injecting Javascript code into a view belonging to another controller and cannot modify its Content-Security-Policy itself. Note that the adjustment is only applied to applications that use AppFramework controllers. To use this from your `app.php` use `\OC::$server->getContentSecurityPolicyManager()->addDefaultPolicy($policy)`, $policy has to be of type `\OCP\AppFramework\Http\ContentSecurityPolicy`. To test this add something like the following into an `app.php` of any enabled app: ``` $manager = \OC::$server->getContentSecurityPolicyManager(); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFrameDomain('asdf'); $policy->addAllowedScriptDomain('yolo.com'); $policy->allowInlineScript(false); $manager->addDefaultPolicy($policy); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFontDomain('yolo.com'); $manager->addDefaultPolicy($policy); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFrameDomain('banana.com'); $manager->addDefaultPolicy($policy); ``` If you now open the files app the policy should be: ``` Content-Security-Policy:default-src 'none';script-src yolo.com 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src yolo.com 'self';connect-src 'self';media-src 'self';frame-src asdf banana.com 'self' ```	10 years ago
Lukas Reschke	a977465af5	Add new CSRF manager for unit testing purposes ... This adds a new CSRF manager for unit testing purposes, it's interface is based upon https://github.com/symfony/security-csrf. Due to some of our required custom changes it is however not possible to use the Symfony component directly.	10 years ago
Robin Appelman	7ba715d144	fix test	10 years ago
Robin McCorkell	da4127d23b	Introduce CredentialsManager for storage of credentials in DB ... CredentialsManager performs a simple role, of storing and retrieving encrypted credentials from the database. Credentials are stored by user ID (which may be null) and credentials identifier. Credentials themselves may be of any type that can be JSON encoded. The rationale behind this is to avoid further (mis)use of oc_preferences, which was being used for all manner of data not related to user preferences.	10 years ago
Robin Appelman	c15cab7ed6	Allow admins to add system wide root certificates	10 years ago
Roeland Jago Douma	876fb83ddc	getMediumStrengthGenerator is deprecated and does not do anything anymore	10 years ago
Roeland Jago Douma	98c4951f45	getLowStrengthGenerator does not do anything anymore	10 years ago
Roeland Jago Douma	1f715289bf	Removed deprecated function OC_User::deleteUser ... Replaced with proper OCP calls	10 years ago
Roeland Jago Douma	835911bce5	Removed deprecated private OC_User::createUser ... All function calls are replaced with the recommended (which was already the body of the function).	10 years ago
Lukas Reschke	f3360d51c6	Use PHP polyfills	10 years ago
Lukas Reschke	8289943a0f	Do not trust casting	10 years ago
Thomas Müller	3bb6dcea64	Apply DB group annotation ...	10 years ago
Bjoern Schiessle	37513f9411	don't read certificates if ownCloud is not installed	10 years ago
Lukas Reschke	ab87274930	Use certificates that expire in 10 years ... 🙊 🙊 🙊	11 years ago
Joas Schilling	d3e3a84cae	Move the helpful method to the TestCase class	11 years ago
Lukas Reschke	9bc48451b9	Adjust tests and statuscode	11 years ago
Lukas Reschke	21f0476d31	Fix files	11 years ago
Lukas Reschke	9f61cf60d4	Verify if returned object is an array ... The error has to be thrown at this point as otherwise errors and notices are thrown since the time cannot be parsed in L60 and L61	11 years ago
Lukas Reschke	886bda5f81	Refactor OC_Request into TrustedDomainHelper and IRequest ... This changeset removes the static class `OC_Request` and moves the functions either into `IRequest` which is accessible via `\OC::$server::->getRequest()` or into a separated `TrustedDomainHelper` class for some helper methods which should not be publicly exposed. This changes only internal methods and nothing on the public API. Some public functions in `util.php` have been deprecated though in favour of the new non-static functions. Unfortunately some part of this code uses things like `__DIR__` and thus is not completely unit-testable. Where tests where possible they ahve been added though. Fixes https://github.com/owncloud/core/issues/13976 which was requested in https://github.com/owncloud/core/pull/13973#issuecomment-73492969	11 years ago
Bjoern Schiessle	5ba19ba7fc	certificate manager should always use a \OC\Files\View otherwise we will get problems for different primary storages	11 years ago
Bjoern Schiessle	67da1f7e5a	certificate manager only needs the user-id, no need to pass on the complete user object	11 years ago
Joas Schilling	6202ca33ba	Make remaining files extend the test base	11 years ago
Joas Schilling	39ae569c5c	Correctly close handle of directory when listing certificates	11 years ago
Lukas Reschke	24ca2d858f	Add OCP\Security\IHasher ... Public interface for hashing which also works with legacy ownCloud hashes and supports updating the legacy hash via a passed reference. Follow-up of https://github.com/owncloud/core/pull/10219#issuecomment-61624662 Requires https://github.com/owncloud/3rdparty/pull/136	11 years ago
Lukas Reschke	d07d5915c9	Remove unused and overflowing function ... Resolves https://github.com/owncloud/core/issues/10991 failure 4	11 years ago
Lukas Reschke	a54af89d8a	Add test for the second argument	12 years ago
Lukas Reschke	1ccbaae846	Refactor tests a little bit	12 years ago
Lukas Reschke	50b430ee7c	Add char consts, hash the specified password for the HMAC	12 years ago
Robin Appelman	3a85767182	5.3 syntax...	12 years ago
Robin Appelman	bfa0c4b78a	Explicitly set the timezones	12 years ago
Lukas Reschke	4bc9980f4b	Add test for expired certificate ... Will only work after tomorrow	12 years ago
Lukas Reschke	4efe6f6240	Add unit tests and fix rootcerts creation bug	12 years ago
Lukas Reschke	3329e0f2b2	Use DI	12 years ago
Lukas Reschke	d26a9c3c58	Add some security utilities ... This adds some security utilities to core including: - A library for basic crypto operations (e.g. to encrypt passwords) - A better library for cryptographic actions which allows you to specify the charset - A library for secure string comparisions Remove .htaccess Remove .htaccess Fix typo Add public API Use timing constant comparision Remove CBC constant Adjust code Remove confusing $this	12 years ago