101 Commits (fc445a2eaa2f93ae7f55b3af8800a87a69480a66)

Author	SHA1	Message	Date
Daniel Calviño Sánchez	41f2d912d2	Allow "wasm-unsafe-eval" in CSP ... If a page has a Content Security Policy header and the `script-src` (or `default-src`) directive does not contain neither `wasm-unsafe-eval` nor `unsafe-eval` loading and executing WebAssembly is blocked in the page (although it is still possible to load and execute WebAssembly in a worker thread). Although the Nextcloud classes to manage the CSP already supported allowing `unsafe-eval` this affects not only WebAssembly, but also the `eval` operation in JavaScript. To make possible to allow WebAssembly execution without allowing JavaScript `eval` this commit adds support for allowing `wasm-unsafe-eval`. Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>	2 years ago
Joas Schilling	2c6f32cb28	feat(request): Allow to match the client version with the IRequest::USER_AGENT_* regex ... Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
jld3103	b0001c6010	Add template types to responses ... Signed-off-by: jld3103 <jld3103yt@gmail.com>	3 years ago
Christoph Wurst	08a3f37695	chore(appframework)!: Drop \OCP\AppFramework\Http\EmptyContentSecurityPolicy::allowInlineScript ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Côme Chilliet	8d5165e8dc	Adapt tests to config value typing ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	3 years ago
MichaIng	5f90b8eb11	Change X-Robots-Tag header from "none" to "noindex, nofollow" ... While "none" is indeed equivalent to "noindex, nofollow" for Google, but seems to be not supported by Bing and probably other search engines. https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta/name#other_metadata_names https://developers.google.com/search/docs/crawling-indexing/robots-meta-tag?hl=de#comma-separated-list https://www.bing.com/webmasters/help/which-robots-metatags-does-bing-support-5198d240 Signed-off-by: MichaIng <micha@dietpi.com>	3 years ago
Côme Chilliet	f5c361cf44	composer run cs:fix ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	3 years ago
Christoph Wurst	20fcfb5739	feat(app framework)!: Inject services into controller methods ... Usually Nextcloud DI goes through constructor injection. This has the implication that each instance of a class builds the full DI tree. That is the injected services, their services, etc. Occasionally there is a service that is only needed for one controller method. Then the DI tree is build regardless if used or not. If services are injected into the method, we only build the DI tree if that method gets executed. This is also how Laravel allows injection. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Christoph Wurst	b6dd1a1d7b	fix(app framework): Fix missing cast of double controller parameters ... ``settype`` allows 'double' as alias of 'float'. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Artur Neumann	81f2857f34	check if params given to API are really an array ... Signed-off-by: Artur Neumann <artur@jankaritech.com>	3 years ago
Côme Chilliet	68363f6944	Fix some more problems with tests under PHP 8.2 ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	3 years ago
Stanimir Bozhilov	46c10c77e1	Fix the JSON content type regex to match all MIME types ... Signed-off-by: Stanimir Bozhilov <stanimir@audriga.com>	3 years ago
Stanimir Bozhilov	f7d51a39cf	Add unit tests for application/scim+json content type ... Signed-off-by: Stanimir Bozhilov <stanimir@audriga.com>	3 years ago
Simon Leiner	09362eaeaa	Support specifying IPv6 proxies in CIDR notation ... Previously, it was not possible to use CIDR notation for IPv6 proxies in the trusted_proxies parameter of config.php [1]. This patch adds support for that. [1]: https://docs.nextcloud.com/server/24/admin_manual/configuration_server/reverse_proxy_configuration.html#defining-trusted-proxies Signed-off-by: Simon Leiner <simon@leiner.me>	3 years ago
Côme Chilliet	1bd5222224	Fix PHP 8.2 warnings about undeclared properties ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	4 years ago
Côme Chilliet	c7e1c36362	Remove at matcher uses in tests/lib ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	4 years ago
Julius Härtl	3901a93c72	Use JSON_THROW_ON_ERROR instead of custom error handling ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	4 years ago
Julius Härtl	bd03dd37be	Allow to set a strict-dynamic CSP through the API ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	4 years ago
Julius Härtl	2dd96fe8da	Fix tests ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	4 years ago
Joas Schilling	cc6653e45c	Adjust and add unit tests ... Signed-off-by: Joas Schilling <coding@schilljs.com>	4 years ago
Robin Appelman	c712987878	send request id in response header ... Signed-off-by: Robin Appelman <robin@icewind.nl>	4 years ago
Carl Schwan	6312c0df69	Check style update ... Signed-off-by: Carl Schwan <carl@carlschwan.eu>	4 years ago
Côme Chilliet	3a1b3745eb	Fix DateTime constructor calls with null ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	4 years ago
Lukas Reschke	377514aad1	Escape filename in Content-Disposition ... We should escape all occurences of ' and \ in here. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	5 years ago
Roeland Jago Douma	9163790b7c	Set frame-ancestors to none if none are filled ... frame-ancestors doesn't fall back to default-src. So when we apply a very restricted CSP we should make sure to set it to 'none' and not leave it empty. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	5 years ago
Roeland Jago Douma	fa6a790859	Remove deprecated OCSResponse ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	5 years ago
Christoph Wurst	d9015a8c94	Format code to a single space around binary operators ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	5 years ago
Joas Schilling	95a301ea57	Fix tests ... Signed-off-by: Joas Schilling <coding@schilljs.com>	5 years ago
Morris Jobke	234b510652	Change PHPDoc type hint from PHPUnit_Framework_MockObject_MockObject to \PHPUnit\Framework\MockObject\MockObject ... Signed-off-by: Morris Jobke <hey@morrisjobke.de>	5 years ago
Morris Jobke	0123cd0ae3	Use assertStringContainsString instead of assertContains on strings ... Signed-off-by: Morris Jobke <hey@morrisjobke.de>	6 years ago
Joas Schilling	74a9cadc50	Fix IPv6 remote addresses from X_FORWARDED_FOR headers before validating ... Signed-off-by: Joas Schilling <coding@schilljs.com>	6 years ago
Joas Schilling	b7060be18d	Fix robots "noindex, nofollow" signals ... Signed-off-by: Joas Schilling <coding@schilljs.com>	6 years ago
Roeland Jago Douma	fbf9772a3e	Allow to specify the cookie type for appframework responses ... In general it is good to set them to Lax. But also to give devs more control over them is not a bad thing. Helps with #21474 Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Roeland Jago Douma	c006b5ff2a	Fix unit test of the ResponseTest ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Roeland Jago Douma	12fa748c49	Move the notmodified check to middleware where it belongs ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Clement Wong	979dd1b6f5	Fix http cache test ... Signed-off-by: Clement Wong <git@clement.hk>	6 years ago
Christoph Wurst	1584c9ae9c	Add visibility to all methods and position of static keyword ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	caff1023ea	Format control structures, classes, methods and function ... To continue this formatting madness, here's a tiny patch that adds unified formatting for control structures like if and loops as well as classes, their methods and anonymous functions. This basically forces the constructs to start on the same line. This is not exactly what PSR2 wants, but I think we can have a few exceptions with "our" style. The starting of braces on the same line is pracrically standard for our code. This also removes and empty lines from method/function bodies at the beginning and end. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	14c996d982	Use elseif instead of else if ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	44577e4345	Remove trailing and in between spaces ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	afbd9c4e6e	Unify function spacing to PSR2 recommendation ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	2a529e453a	Use a blank line after the opening tag ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	41b5e5923a	Use exactly one empty line after the namespace declaration ... For PSR2 Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	2fbad1ed72	Fix (array) indent style to always use one tab ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	b80ebc9674	Use the short array syntax, everywhere ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	2ee65f177e	Use the shorter phpunit syntax for mocked return values ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	74936c49ea	Remove unused imports ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Daniel Kesselberg	8331d8296b	Make getServerHost more robust to faulty user input ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	6 years ago
Daniel Kesselberg	d393b1612b	Modify regex to match some other chromium browsers ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	6 years ago
Roeland Jago Douma	3a7cf40aaa	Mode to modern phpunit ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago