10 Commits (ff629ad158a6e2b1ae0202733e31f1ae14723d96)

Author	SHA1	Message	Date
Roeland Jago Douma	ad676c0102	Set default frame-ancestors to 'self' ... For #13042 Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	64244e1a4f	CSP: Allow fonts to be provided in data ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	5b61ef9213	Disallow unsafe-eval by default ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	a34495933e	Move caching logic to response ... This avoids having to do it at all the places we want cached responses. We can't inject the ITimeFactor without breaking public API. However we can perfectly overwrite the service (resulting in the same testable effect). Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Lukas Reschke	f22ab3e665	Add metadata to \OCP\AppFramework\Http\Response::throttle ... Fixes https://github.com/nextcloud/server/issues/5891 Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	8149945a91	Make BruteForceProtection annotation more clever ... This makes the new `@BruteForceProtection` annotation more clever and moves the relevant code into it's own middleware. Basically you can now set `@BruteForceProtection(action=$key)` as annotation and that will make the controller bruteforce protected. However, the difference to before is that you need to call `$responmse->throttle()` to increase the counter. Before the counter was increased every time which leads to all kind of unexpected problems. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Morris Jobke	f9bc53146d	Fix unit tests ... Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Lukas Reschke	adfd1e63f6	Add base-uri to CSP policy ... As per https://twitter.com/we1x/status/842032709543333890 a nice security hardening Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Christoph Wurst	fe6416072d	set 'no-store' cache header if we do not want FF to cache ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	9 years ago
Joas Schilling	94ad54ec9b	Move tests/ to PSR-4 (#24731) ... * Move a-b to PSR-4 * Move c-d to PSR-4 * Move e+g to PSR-4 * Move h-l to PSR-4 * Move m-r to PSR-4 * Move s-u to PSR-4 * Move files/ to PSR-4 * Move remaining tests to PSR-4 * Remove Test\ from old autoloader	10 years ago
Joas Schilling	9eade36ae5	Fix namespaces in AppFramework tests	10 years ago
Lukas Reschke	e735a9915c	Add blob: scheme to default CSP policy ... Fixes https://github.com/owncloud/core/issues/19438	10 years ago
sualko	5590d64612	add more unit tests for data: as allowed image domain	11 years ago
Lukas Reschke	34f5541088	Add `no-store` to AppFramework	11 years ago
Lukas Reschke	b20174bdad	Allow AppFramework applications to specify a custom CSP header ... This change allows AppFramework applications to specify a custom CSP header for example when the default policy is too strict. Furthermore this allows us to partially migrate away from CSS and allowed eval() in our JavaScript components. Legacy ownCloud components will still use the previous policy. Application developers can use this as following in their controllers: ```php $response = new TemplateResponse('activity', 'list', []); $cspHelper = new ContentSecurityPolicyHelper(); $cspHelper->addAllowedScriptDomain('www.owncloud.org'); $response->addHeader('Content-Security-Policy', $cspHelper->getPolicy()); return $response; ``` Fixes https://github.com/owncloud/core/issues/11857 which is a pre-requisite for https://github.com/owncloud/core/issues/13458 and https://github.com/owncloud/core/issues/11925	11 years ago
Lukas Reschke	048139074d	Add functions to modify cookies to response class ... Currently there is no AppFramework way to modify cookies, which makes it unusable for quite some use-cases or results in untestable code. This PR adds some basic functionalities to add and invalidate cookies. Usage: ```php $response = new TemplateResponse(...); $response->addCookie('foo', 'bar'); $response->invalidateCookie('foo'); $response->addCookie('bar', 'foo', new \DateTime('2015-01-01 00:00')); ``` Existing cookies can be accessed with the AppFramework using `$this->request->getCookie($name)`.	11 years ago
Joas Schilling	6202ca33ba	Make remaining files extend the test base	11 years ago
Bernhard Posselt	0696099bad	add dataresponse ... fix docstrings adjust copyright date another copyright date update another header update implement third headers argument, fix indention, fix docstrings fix docstrings	11 years ago
Bernhard Posselt	1d45239c65	adjust license headers to new mail address	12 years ago
Bernhard Posselt	9a4d204b55	add cors middleware ... remove methodannotationreader namespace fix namespace for server container fix tests fail if with cors credentials header is set to true, implement a reusable preflighted cors method in the controller baseclass, make corsmiddleware private and register it for every request remove uneeded local in cors middleware registratio dont uppercase cors to easily use it from routes fix indention comment fixes explicitely set allow credentials header to false dont depend on better controllers PR, fix that stuff later split cors methods to be in a seperate controller for exposing apis remove protected definitions from apicontroller since controller has it	12 years ago
Thomas Tanghus	8f6ea900f2	Chainable Response in AppFramework	12 years ago
Jörn Friedrich Dreyer	39f2f564a9	use assertSame and assertNotSame for etag checks	12 years ago
Scrutinizer Auto-Fixer	adaee6a5a1	Scrutinizer Auto-Fixes ... This patch was automatically generated as part of the following inspection: https://scrutinizer-ci.com/g/owncloud/core/inspections/cdfecc4e-a37e-4233-8025-f0d7252a8720 Enabled analysis tools: - PHP Analyzer - JSHint - PHP Copy/Paste Detector - PHP PDepend	12 years ago
Thomas Tanghus	ad017285e1	Fix namespace for OCP\Appframework\Http ... To avoid having to use OCP\Appframework\Http\Http in the public - and stable - API OCP\Appframework\Http is now both a class and a namespace.	12 years ago
Thomas Müller	33db8a3089	kill superfluent classloader from tests - this approach might be of interest within the apps	13 years ago
Thomas Müller	fde9cabe97	initial import of appframework	13 years ago