218 Commits (edbc1060ce3ceee7500a64f99c9c98f4ecc7934d)

Author	SHA1	Message	Date
Joas Schilling	070ff71a2d	Add activities for comments	10 years ago
Joas Schilling	25cbc17bec	Add activities when a tag is (un-)assigned	10 years ago
Lukas Reschke	809ff5ac95	Add public API to give developers the possibility to adjust the global CSP defaults ... Allows to inject something into the default content policy. This is for example useful when you're injecting Javascript code into a view belonging to another controller and cannot modify its Content-Security-Policy itself. Note that the adjustment is only applied to applications that use AppFramework controllers. To use this from your `app.php` use `\OC::$server->getContentSecurityPolicyManager()->addDefaultPolicy($policy)`, $policy has to be of type `\OCP\AppFramework\Http\ContentSecurityPolicy`. To test this add something like the following into an `app.php` of any enabled app: ``` $manager = \OC::$server->getContentSecurityPolicyManager(); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFrameDomain('asdf'); $policy->addAllowedScriptDomain('yolo.com'); $policy->allowInlineScript(false); $manager->addDefaultPolicy($policy); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFontDomain('yolo.com'); $manager->addDefaultPolicy($policy); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFrameDomain('banana.com'); $manager->addDefaultPolicy($policy); ``` If you now open the files app the policy should be: ``` Content-Security-Policy:default-src 'none';script-src yolo.com 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src yolo.com 'self';connect-src 'self';media-src 'self';frame-src asdf banana.com 'self' ```	10 years ago
Roeland Jago Douma	f2e70441e4	[Share 2.0] Add getShareManager to OCP\IServerContainer	10 years ago
Lukas Reschke	a977465af5	Add new CSRF manager for unit testing purposes ... This adds a new CSRF manager for unit testing purposes, it's interface is based upon https://github.com/symfony/security-csrf. Due to some of our required custom changes it is however not possible to use the Symfony component directly.	10 years ago
Joas Schilling	31c5848e51	Allow automatic injection of the Manager	10 years ago
Robin McCorkell	da4127d23b	Introduce CredentialsManager for storage of credentials in DB ... CredentialsManager performs a simple role, of storing and retrieving encrypted credentials from the database. Credentials are stored by user ID (which may be null) and credentials identifier. Credentials themselves may be of any type that can be JSON encoded. The rationale behind this is to avoid further (mis)use of oc_preferences, which was being used for all manner of data not related to user preferences.	10 years ago
Robin McCorkell	88cd615214	Introduce IDBConnection::setValues() ... setValues() attempts to insert a new row, or failing that, update an existing row. The ability to set preconditions is also available.	10 years ago
Thomas Müller	682821c71e	Happy new year!	10 years ago
Roeland Jago Douma	98c4951f45	getLowStrengthGenerator does not do anything anymore	10 years ago
Roeland Jago Douma	cd35ad6aaa	Add 'OCP\Files\IMimeTypeDetector' to DI container ... * Added test to server container as well	10 years ago
Bernhard Posselt	23c754aed3	prefer scalar type hints over phpdoc annotation ... use method exists lookup to be safe and not break on old hhvm versions add test that checks if type hint is preferred over annotation	10 years ago
Joas Schilling	412e4ed3f6	Register app containers in the OC container	10 years ago
Lukas Reschke	f3360d51c6	Use PHP polyfills	10 years ago
Scrutinizer Auto-Fixer	ffc49a24f0	Scrutinizer Auto-Fixes ... This commit consists of patches automatically generated for this project on https://scrutinizer-ci.com	10 years ago
Lukas Reschke	7c45eaa70b	Add type description ... Allows IDEs and static code analyzers. Would have saved me some minutes today :)	10 years ago
Scrutinizer Auto-Fixer	453e1bf66e	Scrutinizer Auto-Fixes ... This commit consists of patches automatically generated for this project on https://scrutinizer-ci.com	10 years ago
Joas Schilling	44852ce324	Allow DI for OCP\Files\IMimeTypeDetector	10 years ago
Joas Schilling	3c5a6b829e	Allow DI the system tag stuff without Application class	10 years ago
Lukas Reschke	f4eb15d340	Show error template ... Otherwise this leads to an endless redirection in case of a CSRF exception. Also sets user expectation right.	10 years ago
Mitar	59511d97ee	Also allow empty value for no-HTTPS. ... This makes it work better with old version of Nginx.	10 years ago
Morris Jobke	7aed592957	Add full interface of server container as alias	10 years ago
Robin Appelman	2d7c9f0ba9	also match ie11 with Request::USER_AGENT_IE	10 years ago
Thomas Müller	358858c9e3	Fix undefined HTTP_USER_AGENT	10 years ago
Lukas Reschke	daa388ce8d	Move index.php from files to AppFramework ... 1. Allows it to use the more secure CSP rules of the AppFramework. 2. Adds some unit tests.	10 years ago
Robin Appelman	d514200b56	Add escapeLikeParameter to IDBConnection	10 years ago
Lukas Reschke	bafb86fb9f	Use getHttpProtocol instead of $_SERVER	10 years ago
Lukas Reschke	8f09d5b67c	Update license headers	10 years ago
Lukas Reschke	8133d46620	Remove dependency on ICrypto + use XOR	10 years ago
Morris Jobke	a0743f12c6	Provide IAppContainer as dependency injection	10 years ago
Morris Jobke	bf579a153f	fix IE8 user agent detection	10 years ago
Lukas Reschke	6a4f22c61f	Use `/` if installed in main folder ... Otherwise an empty string is used indicating the cookie is only valid for those resources. This can lead to eunexpected behaviour. Fixes https://github.com/owncloud/core/issues/19196	10 years ago
Lukas Reschke	80a232da6a	Add \OCP\IRequest::getHttpProtocol ... Only allow valid HTTP protocols. Ref https://github.com/owncloud/core/pull/19537#discussion_r41252333 + https://github.com/owncloud/security-tracker/issues/119	10 years ago
Morris Jobke	8366ce2767	deduplicate @xenopathic	10 years ago
Morris Jobke	b945d71384	update licence headers via script	10 years ago
Jörn Friedrich Dreyer	d81416c51d	return '' instead of false	10 years ago
Joas Schilling	ee75f9f594	Fix type hint errors in the container and the interface	10 years ago
Robin McCorkell	31a8949adf	Prevent warning decoding content	10 years ago
Bernhard Posselt	fd74522804	make resolve public to avoid boiler plate code ... add resolve to public interface	10 years ago
Roeland Jago Douma	f12caf930e	Properly return 304 ... The ETag set in the IF_NONE_MODIFIED header is wraped in quotes ("). However the ETag that is set in response is not (yet). Also we need to cast the ETag to a string. * Added unit test	10 years ago
Robin McCorkell	e60c4bada1	Decode request content only on getContent	10 years ago
Lukas Reschke	8313a3fcb3	Add mitigation against BREACH ... While BREACH requires the following three factors to be effectively exploitable we should add another mitigation: 1. Application must support HTTP compression 2. Response most reflect user-controlled input 3. Response should contain sensitive data Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed. To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.	11 years ago
Robin McCorkell	8944af57cb	Set default `forwarded_for_headers` to 'HTTP_X_FORWARDED_FOR'	11 years ago
Robin Appelman	58e96e53b0	add method to check if we're inside a transaction	11 years ago
Roeland Jago Douma	f0b617b508	Use DI ... * Register OCP\Capability\IManager at DIContainer * Add register capabilities to appframework * Register capabilities in DI way * Make unit test pass again * Remove CapabiltiesManager from OCP	11 years ago
Robin McCorkell	fcc03e588a	Add \OCP\ISession to AppFramework	11 years ago
Lukas Reschke	90a11efecd	Remove "use" statement ... Ref https://bugs.php.net/bug.php?id=66773	11 years ago
Lukas Reschke	4efa7c09b1	Use StringUtils::equals on CSRF token and add unit tests	11 years ago
Robin McCorkell	182bc17aeb	Sanitize class names before registerService/query ... Leading backslashes are removed, so a `registerService('\\OC\\Foo')` can still be resolved with `query('OC\\Foo')`.	11 years ago
Bernhard Posselt	d8673dabe3	add test for factories ... use ref for factory test use a factory for registerAlias Ensure we construct SimpleContainer Use single instance of DIContainer in routing tests	11 years ago