Merge branch 'master' into McNetic-zipstreamer

Conflicts:
	3rdparty

10 files changed, 136 insertions, 206 deletions

diff --git a/lib/private/app.php b/lib/private/app.php
index 47f983cce35..048d4d4aeb1 100644
--- a/lib/private/app.php
+++ b/lib/private/app.php
@@ -69,17 +69,6 @@ class OC_App{
 		}
 		ob_end_clean();
 
-		if (!defined('DEBUG') || !DEBUG) {
-			if (is_null($types)
-				&& empty(OC_Util::$coreScripts)
-				&& empty(OC_Util::$coreStyles)) {
-				OC_Util::$coreScripts = OC_Util::$scripts;
-				OC_Util::$scripts = array();
-				OC_Util::$coreStyles = OC_Util::$styles;
-				OC_Util::$styles = array();
-			}
-		}
-		// return
 		return true;
 	}
 
diff --git a/lib/private/minimizer.php b/lib/private/minimizer.php
deleted file mode 100644
index db522de74dc..00000000000
--- a/lib/private/minimizer.php
+++ /dev/null
@@ -1,64 +0,0 @@
-<?php
-
-abstract class OC_Minimizer {
-	public function generateETag($files) {
-		$fullpath_files = array();
-		foreach($files as $file_info) {
-			$fullpath_files[] = $file_info[0] . '/' . $file_info[2];
-		}
-		return OC_Cache::generateCacheKeyFromFiles($fullpath_files);
-	}
-
-	abstract public function minimizeFiles($files);
-
-	public function output($files, $cache_key) {
-		header('Content-Type: '.$this->contentType);
-		OC_Response::enableCaching();
-		$etag = $this->generateETag($files);
-		$cache_key .= '-'.$etag;
-
-		$gzout = false;
-		$cache = OC_Cache::getGlobalCache();
-		if (!OC_Request::isNoCache() && (!defined('DEBUG') || !DEBUG)) {
-			OC_Response::setETagHeader($etag);
-			$gzout = $cache->get($cache_key.'.gz');
-		}
-
-		if (!$gzout) {
-			$out = $this->minimizeFiles($files);
-			$gzout = gzencode($out);
-			$cache->set($cache_key.'.gz', $gzout);
-			OC_Response::setETagHeader($etag);
-		}
-		// on some systems (e.g. SLES 11, but not Ubuntu) mod_deflate and zlib compression will compress the output twice.
-		// This results in broken core.css and  core.js. To avoid it, we switch off zlib compression.
-		// Since mod_deflate is still active, Apache will compress what needs to be compressed, i.e. no disadvantage.
-		if(function_exists('apache_get_modules') && ini_get('zlib.output_compression') && in_array('mod_deflate', apache_get_modules())) {
-			ini_set('zlib.output_compression', 'Off');
-		}
-		if ($encoding = OC_Request::acceptGZip()) {
-			header('Content-Encoding: '.$encoding);
-			$out = $gzout;
-		} else {
-			$out = gzdecode($gzout);
-		}
-		header('Content-Length: '.strlen($out));
-		echo $out;
-	}
-
-	public function clearCache() {
-		$cache = OC_Cache::getGlobalCache();
-		$cache->clear('core.css');
-		$cache->clear('core.js');
-	}
-}
-
-if (!function_exists('gzdecode')) {
-	function gzdecode($data, $maxlength=null, &$filename='', &$error='')
-	{
-		if (strcmp(substr($data, 0, 9),"\x1f\x8b\x8\0\0\0\0\0\0")) {
-			return null;  // Not the GZIP format we expect (See RFC 1952)
-		}
-		return gzinflate(substr($data, 10, -8));
-	}
-}
diff --git a/lib/private/minimizer/css.php b/lib/private/minimizer/css.php
deleted file mode 100644
index 8d130572e2b..00000000000
--- a/lib/private/minimizer/css.php
+++ /dev/null
@@ -1,38 +0,0 @@
-<?php
-
-require_once 'mediawiki/CSSMin.php';
-
-class OC_Minimizer_CSS extends OC_Minimizer
-{
-	protected $contentType = 'text/css';
-
-	public function minimizeFiles($files) {
-		$css_out = '';
-		$webroot = (string) OC::$WEBROOT;
-		foreach($files as $file_info) {
-			$file = $file_info[0] . '/' . $file_info[2];
-			$css_out .= '/* ' . $file . ' */' . "\n";
-			$css = file_get_contents($file);
-
-			$in_root = false;
-			foreach(OC::$APPSROOTS as $app_root) {
-				if(strpos($file, $app_root['path'].'/') === 0) {
-					$in_root = rtrim($webroot.$app_root['url'], '/');
-					break;
-				}
-			}
-			if ($in_root !== false) {
-				$css = str_replace('%appswebroot%', $in_root, $css);
-				$css = str_replace('%webroot%', $webroot, $css);
-			}
-			$remote = $file_info[1];
-			$remote .= '/';
-			$remote .= dirname($file_info[2]);
-			$css_out .= CSSMin::remap($css, dirname($file), $remote, true);
-		}
-		if (!defined('DEBUG') || !DEBUG) {
-			$css_out = CSSMin::minify($css_out);
-		}
-		return $css_out;
-	}
-}
diff --git a/lib/private/minimizer/js.php b/lib/private/minimizer/js.php
deleted file mode 100644
index bd2d836deb0..00000000000
--- a/lib/private/minimizer/js.php
+++ /dev/null
@@ -1,21 +0,0 @@
-<?php
-
-require_once 'mediawiki/JavaScriptMinifier.php';
-
-class OC_Minimizer_JS extends OC_Minimizer
-{
-	protected $contentType = 'application/javascript';
-
-	public function minimizeFiles($files) {
-		$js_out = '';
-		foreach($files as $file_info) {
-			$file = $file_info[0] . '/' . $file_info[2];
-			$js_out .= '/* ' . $file . ' */' . "\n";
-			$js_out .= file_get_contents($file);
-		}
-		if (!defined('DEBUG') || !DEBUG) {
-			$js_out = JavaScriptMinifier::minify($js_out);
-		}
-		return $js_out;
-	}
-}
diff --git a/lib/private/request.php b/lib/private/request.php
index 0fd20b3cc1f..14f3bf2cbb7 100755
--- a/lib/private/request.php
+++ b/lib/private/request.php
@@ -25,6 +25,16 @@ class OC_Request {
 	}
 
 	/**
+	 * @brief Checks whether a domain is considered as trusted. This is used to prevent Host Header Poisoning.
+	 * @param string $host
+	 * @return bool
+	 */
+	public static function isTrustedDomain($domain) {
+		$trustedList = \OC_Config::getValue('trusted_domains', array(''));
+		return in_array($domain, $trustedList);
+	}
+
+	/**
 	 * @brief Returns the server host
 	 * @returns string the server host
 	 *
@@ -43,21 +53,27 @@ class OC_Request {
 				$host = trim(array_pop(explode(",", $_SERVER['HTTP_X_FORWARDED_HOST'])));
 			}
 			else{
-				$host=$_SERVER['HTTP_X_FORWARDED_HOST'];
+				$host = $_SERVER['HTTP_X_FORWARDED_HOST'];
 			}
-		}
-		else{
+		} else {
 			if (isset($_SERVER['HTTP_HOST'])) {
-				return $_SERVER['HTTP_HOST'];
+				$host = $_SERVER['HTTP_HOST'];
 			}
 			if (isset($_SERVER['SERVER_NAME'])) {
-				return $_SERVER['SERVER_NAME'];
+				$host = $_SERVER['SERVER_NAME'];
 			}
-			return 'localhost';
 		}
-		return $host;
-	}
 
+		// Verify that the host is a trusted domain if the trusted domains
+		// are defined
+		// If no trusted domain is provided the first trusted domain is returned
+		if(self::isTrustedDomain($host) || \OC_Config::getValue('trusted_domains', "") === "") {
+			return $host;
+		} else {
+			$trustedList = \OC_Config::getValue('trusted_domains', array(''));
+			return $trustedList[0];
+		}
+	}
 
 	/**
 	* @brief Returns the server protocol
@@ -71,14 +87,14 @@ class OC_Request {
 		}
 		if (isset($_SERVER['HTTP_X_FORWARDED_PROTO'])) {
 			$proto = strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']);
-		}else{
-			if(isset($_SERVER['HTTPS']) and !empty($_SERVER['HTTPS']) and ($_SERVER['HTTPS']!='off')) {
-				$proto = 'https';
-			}else{
-				$proto = 'http';
-			}
+			// Verify that the protocol is always HTTP or HTTPS
+			// default to http if an invalid value is provided
+			return $proto === 'https' ? 'https' : 'http';
+		}
+		if (isset($_SERVER['HTTPS']) && !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') {
+			return 'https';
 		}
-		return $proto;
+		return 'http';
 	}
 
 	/**
@@ -180,33 +196,6 @@ class OC_Request {
 	}
 
 	/**
-	 * @brief Check if this is a no-cache request
-	 * @return boolean true for no-cache
-	 */
-	static public function isNoCache() {
-		if (!isset($_SERVER['HTTP_CACHE_CONTROL'])) {
-			return false;
-		}
-		return $_SERVER['HTTP_CACHE_CONTROL'] == 'no-cache';
-	}
-
-	/**
-	 * @brief Check if the requestor understands gzip
-	 * @return false|string true for gzip encoding supported
-	 */
-	static public function acceptGZip() {
-		if (!isset($_SERVER['HTTP_ACCEPT_ENCODING'])) {
-			return false;
-		}
-		$HTTP_ACCEPT_ENCODING = $_SERVER["HTTP_ACCEPT_ENCODING"];
-		if( strpos($HTTP_ACCEPT_ENCODING, 'x-gzip') !== false )
-			return 'x-gzip';
-		else if( strpos($HTTP_ACCEPT_ENCODING, 'gzip') !== false )
-			return 'gzip';
-		return false;
-	}
-
-	/**
 	 * @brief Check if the requester sent along an mtime
 	 * @return false or an mtime
 	 */
diff --git a/lib/private/setup.php b/lib/private/setup.php
index 17ef75bc7b5..3906204bda3 100644
--- a/lib/private/setup.php
+++ b/lib/private/setup.php
@@ -65,6 +65,7 @@ class OC_Setup {
 		OC_Config::setValue('passwordsalt', $salt);
 
 		//write the config file
+		OC_Config::setValue('trusted_domains', array(OC_Request::serverHost())); 
 		OC_Config::setValue('datadirectory', $datadir);
 		OC_Config::setValue('dbtype', $dbtype);
 		OC_Config::setValue('version', implode('.', OC_Util::getVersion()));
@@ -97,8 +98,6 @@ class OC_Setup {
 			$appConfig = \OC::$server->getAppConfig();
 			$appConfig->setValue('core', 'installedat', microtime(true));
 			$appConfig->setValue('core', 'lastupdatedat', microtime(true));
-			$appConfig->setValue('core', 'remote_core.css', '/core/minimizer.php');
-			$appConfig->setValue('core', 'remote_core.js', '/core/minimizer.php');
 
 			OC_Group::createGroup('admin');
 			OC_Group::addToGroup($username, 'admin');
diff --git a/lib/private/template/cssresourcelocator.php b/lib/private/template/cssresourcelocator.php
index 8e7831ca549..e26daa25827 100644
--- a/lib/private/template/cssresourcelocator.php
+++ b/lib/private/template/cssresourcelocator.php
@@ -22,7 +22,7 @@ class CSSResourceLocator extends ResourceLocator {
 		$app = substr($style, 0, strpos($style, '/'));
 		$style = substr($style, strpos($style, '/')+1);
 		$app_path = \OC_App::getAppPath($app);
-		$app_url = $this->webroot . '/index.php/apps/' . $app;
+		$app_url = \OC_App::getAppWebPath($app);
 		if ($this->appendIfExist($app_path, $style.$this->form_factor.'.css', $app_url)
 			|| $this->appendIfExist($app_path, $style.'.css', $app_url)
 		) {
diff --git a/lib/private/templatelayout.php b/lib/private/templatelayout.php
index 7bca5bc4836..af17adb11c6 100644
--- a/lib/private/templatelayout.php
+++ b/lib/private/templatelayout.php
@@ -1,4 +1,11 @@
 <?php
+use Assetic\Asset\AssetCollection;
+use Assetic\Asset\FileAsset;
+use Assetic\Asset\GlobAsset;
+use Assetic\AssetManager;
+use Assetic\AssetWriter;
+use Assetic\Filter\CssRewriteFilter;
+
 /**
  * Copyright (c) 2012 Bart Visscher <bartv@thisnet.nl>
  * This file is licensed under the Affero General Public License version 3 or
@@ -57,35 +64,38 @@ class OC_TemplateLayout extends OC_Template {
 		} else {
 			parent::__construct('core', 'layout.base');
 		}
+
 		$versionParameter = '?v=' . md5(implode(OC_Util::getVersion()));
-		// Add the js files
-		$jsfiles = self::findJavascriptFiles(OC_Util::$scripts);
-		$this->assign('jsfiles', array(), false);
-		if (OC_Config::getValue('installed', false) && $renderas!='error') {
+		$useAssetPipeline = OC_Config::getValue('asset-pipeline.enabled', false);
+		if ($useAssetPipeline) {
+
 			$this->append( 'jsfiles', OC_Helper::linkToRoute('js_config') . $versionParameter);
-		}
-		if (!empty(OC_Util::$coreScripts)) {
-			$this->append( 'jsfiles', OC_Helper::linkToRemoteBase('core.js', false) . $versionParameter);
-		}
-		foreach($jsfiles as $info) {
-			$root = $info[0];
-			$web = $info[1];
-			$file = $info[2];
-			$this->append( 'jsfiles', $web.'/'.$file . $versionParameter);
-		}
 
-		// Add the css files
-		$cssfiles = self::findStylesheetFiles(OC_Util::$styles);
-		$this->assign('cssfiles', array());
-		if (!empty(OC_Util::$coreStyles)) {
-			$this->append( 'cssfiles', OC_Helper::linkToRemoteBase('core.css', false) . $versionParameter);
-		}
-		foreach($cssfiles as $info) {
-			$root = $info[0];
-			$web = $info[1];
-			$file = $info[2];
+			$this->generateAssets();
 
-			$this->append( 'cssfiles', $web.'/'.$file . $versionParameter);
+		} else {
+
+			// Add the js files
+			$jsfiles = self::findJavascriptFiles(OC_Util::$scripts);
+			$this->assign('jsfiles', array(), false);
+			if (OC_Config::getValue('installed', false) && $renderas!='error') {
+				$this->append( 'jsfiles', OC_Helper::linkToRoute('js_config') . $versionParameter);
+			}
+			foreach($jsfiles as $info) {
+				$web = $info[1];
+				$file = $info[2];
+				$this->append( 'jsfiles', $web.'/'.$file . $versionParameter);
+			}
+
+			// Add the css files
+			$cssfiles = self::findStylesheetFiles(OC_Util::$styles);
+			$this->assign('cssfiles', array());
+			foreach($cssfiles as $info) {
+				$web = $info[1];
+				$file = $info[2];
+
+				$this->append( 'cssfiles', $web.'/'.$file . $versionParameter);
+			}
 		}
 	}
 
@@ -116,4 +126,57 @@ class OC_TemplateLayout extends OC_Template {
 		$locator->find($scripts);
 		return $locator->getResources();
 	}
+
+	public function generateAssets()
+	{
+		$jsFiles = self::findJavascriptFiles(OC_Util::$scripts);
+		$jsHash = self::hashScriptNames($jsFiles);
+
+		if (!file_exists("assets/$jsHash.js")) {
+			$jsFiles = array_map(function ($item) {
+				$root = $item[0];
+				$file = $item[2];
+				return new FileAsset($root . '/' . $file, array(), $root, $file);
+			}, $jsFiles);
+			$jsCollection = new AssetCollection($jsFiles);
+			$jsCollection->setTargetPath("assets/$jsHash.js");
+
+			$writer = new AssetWriter(\OC::$SERVERROOT);
+			$writer->writeAsset($jsCollection);
+		}
+
+		$cssFiles = self::findStylesheetFiles(OC_Util::$styles);
+		$cssHash = self::hashScriptNames($cssFiles);
+
+		if (!file_exists("assets/$cssHash.css")) {
+			$cssFiles = array_map(function ($item) {
+				$root = $item[0];
+				$file = $item[2];
+				$assetPath = $root . '/' . $file;
+				$sourceRoot =  \OC::$SERVERROOT;
+				$sourcePath = substr($assetPath, strlen(\OC::$SERVERROOT));
+				return new FileAsset($assetPath, array(new CssRewriteFilter()), $sourceRoot, $sourcePath);
+			}, $cssFiles);
+			$cssCollection = new AssetCollection($cssFiles);
+			$cssCollection->setTargetPath("assets/$cssHash.css");
+
+			$writer = new AssetWriter(\OC::$SERVERROOT);
+			$writer->writeAsset($cssCollection);
+		}
+
+		$this->append('jsfiles', OC_Helper::linkTo('assets', "$jsHash.js"));
+		$this->append('cssfiles', OC_Helper::linkTo('assets', "$cssHash.css"));
+	}
+
+	private static function hashScriptNames($files)
+	{
+		$files = array_map(function ($item) {
+			$root = $item[0];
+			$file = $item[2];
+			return $root . '/' . $file;
+		}, $files);
+
+		sort($files);
+		return hash('md5', implode('', $files));
+	}
 }
diff --git a/lib/private/updater.php b/lib/private/updater.php
index 764a0f14120..f05d5038b76 100644
--- a/lib/private/updater.php
+++ b/lib/private/updater.php
@@ -102,6 +102,20 @@ class Updater extends BasicEmitter {
 			$this->log->debug('starting upgrade from ' . $installedVersion . ' to ' . $currentVersion, array('app' => 'core'));
 		}
 		$this->emit('\OC\Updater', 'maintenanceStart');
+
+		/*
+		 * START CONFIG CHANGES FOR OLDER VERSIONS
+		 */
+		if (version_compare($currentVersion, '6.90.1', '<')) {
+			// Add the overwriteHost config if it is not existant
+			// This is added to prevent host header poisoning
+			\OC_Config::setValue('trusted_domains', \OC_Config::getValue('trusted_domains', array(\OC_Request::serverHost()))); 
+		}
+		/*
+		 * STOP CONFIG CHANGES FOR OLDER VERSIONS
+		 */
+
+
 		try {
 			\OC_DB::updateDbFromStructure(\OC::$SERVERROOT . '/db_structure.xml');
 			$this->emit('\OC\Updater', 'dbUpgrade');
@@ -162,3 +176,4 @@ class Updater extends BasicEmitter {
 		$this->emit('\OC\Updater', 'filecacheDone');
 	}
 }
+
diff --git a/lib/private/util.php b/lib/private/util.php
index d3b682daa5c..920161949ae 100755
--- a/lib/private/util.php
+++ b/lib/private/util.php
@@ -11,8 +11,6 @@ class OC_Util {
 	public static $headers=array();
 	private static $rootMounted=false;
 	private static $fsSetup=false;
-	public static $coreStyles=array();
-	public static $coreScripts=array();
 
 	/**
 	 * @brief Can be set up