Move certificate management interface from files_external to core

7 files changed, 220 insertions, 93 deletions

diff --git a/settings/ajax/addRootCertificate.php b/settings/ajax/addRootCertificate.php
new file mode 100644
index 00000000000..9be8fd0025b
--- /dev/null
+++ b/settings/ajax/addRootCertificate.php
@@ -0,0 +1,34 @@
+<?php
+
+OCP\JSON::checkAppEnabled('files_external');
+OCP\JSON::callCheck();
+
+$l = new OC_L10N('core');
+
+if (!($filename = $_FILES['rootcert_import']['name'])) {
+	header('Location:' . OCP\Util::linkToRoute("settings_personal"));
+	exit;
+}
+
+$fh = fopen($_FILES['rootcert_import']['tmp_name'], 'r');
+$data = fread($fh, filesize($_FILES['rootcert_import']['tmp_name']));
+fclose($fh);
+$filename = $_FILES['rootcert_import']['name'];
+
+$certificateManager = \OC::$server->getCertificateManager();
+
+if ($cert = $certificateManager->addCertificate($data, $filename)) {
+	OCP\JSON::success(array(
+		'name' => $cert->getName(),
+		'commonName' => $cert->getCommonName(),
+		'organization' => $cert->getOrganization(),
+		'validFrom' => $cert->getIssueDate()->getTimestamp(),
+		'validTill' => $cert->getExpireDate()->getTimestamp(),
+		'validFromString' => $l->l('date', $cert->getIssueDate()),
+		'validTillString' => $l->l('date', $cert->getExpireDate()),
+		'issuer' => $cert->getIssuerName(),
+		'issuerOrganization' => $cert->getIssuerOrganization()
+	));
+} else {
+	OCP\JSON::error(array('error' => 'Couldn\'t import SSL root certificate, allowed formats: PEM and DER'));
+}
diff --git a/settings/ajax/removeRootCertificate.php b/settings/ajax/removeRootCertificate.php
new file mode 100644
index 00000000000..0931138ad4b
--- /dev/null
+++ b/settings/ajax/removeRootCertificate.php
@@ -0,0 +1,9 @@
+<?php
+
+OCP\JSON::checkAppEnabled('files_external');
+OCP\JSON::checkLoggedIn();
+OCP\JSON::callCheck();
+
+$name = $_POST['cert'];
+$certificateManager = \OC::$server->getCertificateManager();
+$certificateManager->removeCertificate($name);
diff --git a/settings/css/settings.css b/settings/css/settings.css
index a62a971b831..95fab85df97 100644
--- a/settings/css/settings.css
+++ b/settings/css/settings.css
@@ -6,9 +6,11 @@ select#languageinput, select#timezone { width:15em; }
 input#openid, input#webdav { width:20em; }
 
 /* PERSONAL */
-#rootcert_import {
-	margin: 0 0 10px 0;
-	display: block;
+#sslCertificate tr.expired {
+	background-color: rgba(255, 0, 0, 0.5);
+}
+#sslCertificate td {
+	padding: 5px;
 }
 
 /* Sync clients */
diff --git a/settings/js/personal.js b/settings/js/personal.js
index f56dd3425f7..d6763cdb295 100644
--- a/settings/js/personal.js
+++ b/settings/js/personal.js
@@ -13,12 +13,12 @@
  *
  * @param callback
  */
-jQuery.fn.keyUpDelayedOrEnter = function(callback){
+jQuery.fn.keyUpDelayedOrEnter = function (callback) {
 	var cb = callback;
 	var that = this;
 	this.keyup(_.debounce(function (event) {
 		// enter is already handled in keypress
-		if(event.keyCode === 13) {
+		if (event.keyCode === 13) {
 			return;
 		}
 		if (that.val() !== '') {
@@ -27,7 +27,7 @@ jQuery.fn.keyUpDelayedOrEnter = function(callback){
 	}, 1000));
 
 	this.keypress(function (event) {
-		if (event.keyCode === 13 && that.val() !== '' ){
+		if (event.keyCode === 13 && that.val() !== '') {
 			event.preventDefault();
 			cb();
 		}
@@ -38,48 +38,48 @@ jQuery.fn.keyUpDelayedOrEnter = function(callback){
 /**
  * Post the email address change to the server.
  */
-function changeEmailAddress(){
-    var emailInfo = $('#email');
-    if (emailInfo.val() === emailInfo.defaultValue){
-        return;
-    }
-    emailInfo.defaultValue = emailInfo.val();
-    OC.msg.startSaving('#lostpassword .msg');
-    var post = $( "#lostpassword" ).serialize();
-    $.post( 'ajax/lostpassword.php', post, function(data){
-        OC.msg.finishedSaving('#lostpassword .msg', data);
-    });
+function changeEmailAddress () {
+	var emailInfo = $('#email');
+	if (emailInfo.val() === emailInfo.defaultValue) {
+		return;
+	}
+	emailInfo.defaultValue = emailInfo.val();
+	OC.msg.startSaving('#lostpassword .msg');
+	var post = $("#lostpassword").serialize();
+	$.post('ajax/lostpassword.php', post, function (data) {
+		OC.msg.finishedSaving('#lostpassword .msg', data);
+	});
 }
 
 /**
  * Post the display name change to the server.
  */
-function changeDisplayName(){
-    if ($('#displayName').val() !== '' ) {
-        OC.msg.startSaving('#displaynameform .msg');
-        // Serialize the data
-        var post = $( "#displaynameform" ).serialize();
-        // Ajax foo
-        $.post( 'ajax/changedisplayname.php', post, function(data){
-            if( data.status === "success" ){
-                $('#oldDisplayName').val($('#displayName').val());
-                // update displayName on the top right expand button
-                $('#expandDisplayName').text($('#displayName').val());
-                updateAvatar();
-            }
-            else{
-                $('#newdisplayname').val(data.data.displayName);
-            }
-            OC.msg.finishedSaving('#displaynameform .msg', data);
-        });
-    }
+function changeDisplayName () {
+	if ($('#displayName').val() !== '') {
+		OC.msg.startSaving('#displaynameform .msg');
+		// Serialize the data
+		var post = $("#displaynameform").serialize();
+		// Ajax foo
+		$.post('ajax/changedisplayname.php', post, function (data) {
+			if (data.status === "success") {
+				$('#oldDisplayName').val($('#displayName').val());
+				// update displayName on the top right expand button
+				$('#expandDisplayName').text($('#displayName').val());
+				updateAvatar();
+			}
+			else {
+				$('#newdisplayname').val(data.data.displayName);
+			}
+			OC.msg.finishedSaving('#displaynameform .msg', data);
+		});
+	}
 }
 
 function updateAvatar (hidedefault) {
 	var $headerdiv = $('#header .avatardiv');
 	var $displaydiv = $('#displayavatar .avatardiv');
 
-	if(hidedefault) {
+	if (hidedefault) {
 		$headerdiv.hide();
 		$('#header .avatardiv').removeClass('avatardiv-shown');
 	} else {
@@ -93,16 +93,16 @@ function updateAvatar (hidedefault) {
 	$('#removeavatar').show();
 }
 
-function showAvatarCropper() {
+function showAvatarCropper () {
 	var $cropper = $('#cropper');
 	$cropper.prepend("<img>");
 	var $cropperImage = $('#cropper img');
 
 	$cropperImage.attr('src',
-		OC.generateUrl('/avatar/tmp')+'?requesttoken='+oc_requesttoken+'#'+Math.floor(Math.random()*1000));
+		OC.generateUrl('/avatar/tmp') + '?requesttoken=' + oc_requesttoken + '#' + Math.floor(Math.random() * 1000));
 
 	// Looks weird, but on('load', ...) doesn't work in IE8
-	$cropperImage.ready(function(){
+	$cropperImage.ready(function () {
 		$('#displayavatar').hide();
 		$cropper.show();
 
@@ -117,7 +117,7 @@ function showAvatarCropper() {
 	});
 }
 
-function sendCropData() {
+function sendCropData () {
 	cleanCropper();
 
 	var cropperData = $('#cropper').data();
@@ -130,11 +130,11 @@ function sendCropData() {
 	$.post(OC.generateUrl('/avatar/cropped'), {crop: data}, avatarResponseHandler);
 }
 
-function saveCoords(c) {
+function saveCoords (c) {
 	$('#cropper').data(c);
 }
 
-function cleanCropper() {
+function cleanCropper () {
 	var $cropper = $('#cropper');
 	$('#displayavatar').show();
 	$cropper.hide();
@@ -143,7 +143,7 @@ function cleanCropper() {
 	$('#cropper img').remove();
 }
 
-function avatarResponseHandler(data) {
+function avatarResponseHandler (data) {
 	var $warning = $('#avatar .warning');
 	$warning.hide();
 	if (data.status === "success") {
@@ -156,20 +156,20 @@ function avatarResponseHandler(data) {
 	}
 }
 
-$(document).ready(function(){
-	$("#passwordbutton").click( function(){
+$(document).ready(function () {
+	$("#passwordbutton").click(function () {
 		if ($('#pass1').val() !== '' && $('#pass2').val() !== '') {
 			// Serialize the data
-			var post = $( "#passwordform" ).serialize();
+			var post = $("#passwordform").serialize();
 			$('#passwordchanged').hide();
 			$('#passworderror').hide();
 			// Ajax foo
-			$.post(OC.generateUrl('/settings/personal/changepassword'), post, function(data){
-				if( data.status === "success" ){
+			$.post(OC.generateUrl('/settings/personal/changepassword'), post, function (data) {
+				if (data.status === "success") {
 					$('#pass1').val('');
 					$('#pass2').val('');
 					$('#passwordchanged').show();
-				} else{
+				} else {
 					if (typeof(data.data) !== "undefined") {
 						$('#passworderror').html(data.data.message);
 					} else {
@@ -190,22 +190,22 @@ $(document).ready(function(){
 	$('#displayName').keyUpDelayedOrEnter(changeDisplayName);
 	$('#email').keyUpDelayedOrEnter(changeEmailAddress);
 
-	$("#languageinput").change( function(){
+	$("#languageinput").change(function () {
 		// Serialize the data
-		var post = $( "#languageinput" ).serialize();
+		var post = $("#languageinput").serialize();
 		// Ajax foo
-		$.post( 'ajax/setlanguage.php', post, function(data){
-			if( data.status === "success" ){
+		$.post('ajax/setlanguage.php', post, function (data) {
+			if (data.status === "success") {
 				location.reload();
 			}
-			else{
-				$('#passworderror').html( data.data.message );
+			else {
+				$('#passworderror').html(data.data.message);
 			}
 		});
 		return false;
 	});
 
-	$('button:button[name="submitDecryptAll"]').click(function() {
+	$('button:button[name="submitDecryptAll"]').click(function () {
 		var privateKeyPassword = $('#decryptAll input:password[id="privateKeyPassword"]').val();
 		$('#decryptAll button:button[name="submitDecryptAll"]').prop("disabled", true);
 		$('#decryptAll input:password[name="privateKeyPassword"]').prop("disabled", true);
@@ -213,23 +213,23 @@ $(document).ready(function(){
 	});
 
 
-	$('button:button[name="submitRestoreKeys"]').click(function() {
+	$('button:button[name="submitRestoreKeys"]').click(function () {
 		$('#restoreBackupKeys button:button[name="submitDeleteKeys"]').prop("disabled", true);
 		$('#restoreBackupKeys button:button[name="submitRestoreKeys"]').prop("disabled", true);
 		OC.Encryption.restoreKeys();
 	});
 
-	$('button:button[name="submitDeleteKeys"]').click(function() {
+	$('button:button[name="submitDeleteKeys"]').click(function () {
 		$('#restoreBackupKeys button:button[name="submitDeleteKeys"]').prop("disabled", true);
 		$('#restoreBackupKeys button:button[name="submitRestoreKeys"]').prop("disabled", true);
 		OC.Encryption.deleteKeys();
 	});
 
-	$('#decryptAll input:password[name="privateKeyPassword"]').keyup(function(event) {
+	$('#decryptAll input:password[name="privateKeyPassword"]').keyup(function (event) {
 		var privateKeyPassword = $('#decryptAll input:password[id="privateKeyPassword"]').val();
-		if (privateKeyPassword !== '' ) {
+		if (privateKeyPassword !== '') {
 			$('#decryptAll button:button[name="submitDecryptAll"]').prop("disabled", false);
-			if(event.which === 13) {
+			if (event.which === 13) {
 				$('#decryptAll button:button[name="submitDecryptAll"]').prop("disabled", true);
 				$('#decryptAll input:password[name="privateKeyPassword"]').prop("disabled", true);
 				OC.Encryption.decryptAll(privateKeyPassword);
@@ -240,21 +240,21 @@ $(document).ready(function(){
 	});
 
 	var uploadparms = {
-		done: function(e, data) {
+		done: function (e, data) {
 			avatarResponseHandler(data.result);
 		}
 	};
 
-	$('#uploadavatarbutton').click(function(){
+	$('#uploadavatarbutton').click(function () {
 		$('#uploadavatar').click();
 	});
 
 	$('#uploadavatar').fileupload(uploadparms);
 
-	$('#selectavatar').click(function(){
+	$('#selectavatar').click(function () {
 		OC.dialogs.filepicker(
 			t('settings', "Select a profile picture"),
-			function(path){
+			function (path) {
 				$.post(OC.generateUrl('/avatar/'), {path: path}, avatarResponseHandler);
 			},
 			false,
@@ -262,27 +262,27 @@ $(document).ready(function(){
 		);
 	});
 
-	$('#removeavatar').click(function(){
+	$('#removeavatar').click(function () {
 		$.ajax({
-			type:	'DELETE',
-			url:	OC.generateUrl('/avatar/'),
-			success: function() {
+			type: 'DELETE',
+			url: OC.generateUrl('/avatar/'),
+			success: function () {
 				updateAvatar(true);
 				$('#removeavatar').hide();
 			}
 		});
 	});
 
-	$('#abortcropperbutton').click(function(){
+	$('#abortcropperbutton').click(function () {
 		cleanCropper();
 	});
 
-	$('#sendcropperbutton').click(function(){
+	$('#sendcropperbutton').click(function () {
 		sendCropData();
 	});
 
 	$('#pass2').strengthify({
-		zxcvbn: OC.linkTo('3rdparty','zxcvbn/js/zxcvbn.js'),
+		zxcvbn: OC.linkTo('3rdparty', 'zxcvbn/js/zxcvbn.js'),
 		titles: [
 			t('core', 'Very weak password'),
 			t('core', 'Weak password'),
@@ -298,18 +298,59 @@ $(document).ready(function(){
 		'/avatar/{user}/{size}',
 		{user: OC.currentUser, size: 1}
 	) + '?requesttoken=' + oc_requesttoken;
-	$.get(url, function(result) {
+	$.get(url, function (result) {
 		if (typeof(result) === 'object') {
 			$('#removeavatar').hide();
 		}
 	});
-} );
+
+	$('#sslCertificate').on('click', 'td.remove > img', function () {
+		var row = $(this).parent().parent();
+		$.post(OC.filePath('settings', 'ajax', 'removeRootCertificate.php'), {
+			cert: row.data('name')
+		});
+		row.remove();
+		return true;
+	});
+
+	$('#sslCertificate tr > td').tipsy({fade: true, gravity: 'n', live: true});
+
+	$('#rootcert_import').fileupload({
+		done: function (e, data) {
+			console.log(data.result);
+			var issueDate = new Date(data.result.validFrom * 1000);
+			var expireDate = new Date(data.result.validTill * 1000);
+			var now = new Date();
+			var isExpired = !(issueDate <= now && now <= expireDate);
+
+			var row = $('<tr/>');
+			row.addClass(isExpired? 'expired': 'valid');
+			row.append($('<td/>').attr('title', data.result.organization).text(data.result.commonName));
+			row.append($('<td/>').attr('title', t('core,', 'Valid from {date}', {date: data.result.validFromString}))
+				.text(data.result.validTillString));
+			row.append($('<td/>').attr('title', data.result.issuerOrganization).text(data.result.issuer));
+			row.append($('<td/>').addClass('remove').append(
+				$('<img/>').attr({
+					alt: t('core', 'Delete'),
+					title: t('core', 'Delete'),
+					src: OC.imagePath('core', 'actions/delete.svg')
+				}).addClass('action')
+			));
+
+			$('#sslCertificate tbody').append(row);
+		}
+	});
+
+	$('#rootcert_import_button').click(function () {
+		$('#rootcert_import').click();
+	});
+});
 
 OC.Encryption = {
-	decryptAll: function(password) {
+	decryptAll: function (password) {
 		var message = t('settings', 'Decrypting files... Please wait, this can take some time.');
 		OC.Encryption.msg.start('#decryptAll .msg', message);
-		$.post('ajax/decryptall.php', {password:password}, function(data) {
+		$.post('ajax/decryptall.php', {password: password}, function (data) {
 			if (data.status === "error") {
 				OC.Encryption.msg.finished('#decryptAll .msg', data);
 				$('#decryptAll input:password[name="privateKeyPassword"]').prop("disabled", false);
@@ -320,10 +361,10 @@ OC.Encryption = {
 		});
 	},
 
-	deleteKeys: function() {
+	deleteKeys: function () {
 		var message = t('settings', 'Delete encryption keys permanently.');
 		OC.Encryption.msg.start('#restoreBackupKeys .msg', message);
-		$.post('ajax/deletekeys.php', null, function(data) {
+		$.post('ajax/deletekeys.php', null, function (data) {
 			if (data.status === "error") {
 				OC.Encryption.msg.finished('#restoreBackupKeys .msg', data);
 				$('#restoreBackupKeys button:button[name="submitDeleteKeys"]').prop("disabled", false);
@@ -334,10 +375,10 @@ OC.Encryption = {
 		});
 	},
 
-	restoreKeys: function() {
+	restoreKeys: function () {
 		var message = t('settings', 'Restore encryption keys.');
 		OC.Encryption.msg.start('#restoreBackupKeys .msg', message);
-		$.post('ajax/restorekeys.php', {}, function(data) {
+		$.post('ajax/restorekeys.php', {}, function (data) {
 			if (data.status === "error") {
 				OC.Encryption.msg.finished('#restoreBackupKeys .msg', data);
 				$('#restoreBackupKeys button:button[name="submitDeleteKeys"]').prop("disabled", false);
@@ -349,24 +390,24 @@ OC.Encryption = {
 	}
 };
 
-OC.Encryption.msg={
-	start:function(selector, msg){
-		var spinner = '<img src="'+ OC.imagePath('core', 'loading-small.gif') +'">';
+OC.Encryption.msg = {
+	start: function (selector, msg) {
+		var spinner = '<img src="' + OC.imagePath('core', 'loading-small.gif') + '">';
 		$(selector)
-			.html( msg + ' ' + spinner )
+			.html(msg + ' ' + spinner)
 			.removeClass('success')
 			.removeClass('error')
 			.stop(true, true)
 			.show();
 	},
-	finished:function(selector, data){
-		if( data.status === "success" ){
-			$(selector).html( data.data.message )
+	finished: function (selector, data) {
+		if (data.status === "success") {
+			$(selector).html(data.data.message)
 				.addClass('success')
 				.stop(true, true)
 				.delay(3000);
-		}else{
-			$(selector).html( data.data.message ).addClass('error');
+		} else {
+			$(selector).html(data.data.message).addClass('error');
 		}
 	}
 };
diff --git a/settings/personal.php b/settings/personal.php
index a72b293413a..d426fd7f359 100644
--- a/settings/personal.php
+++ b/settings/personal.php
@@ -8,6 +8,7 @@
 OC_Util::checkLoggedIn();
 
 $defaults = new OC_Defaults(); // initialize themable default strings and urls
+$certificateManager = \OC::$server->getCertificateManager();
 
 // Highlight navigation entry
 OC_Util::addScript( 'settings', 'personal' );
@@ -98,6 +99,7 @@ $tmpl->assign('backupKeysExists' , $backupKeysExists);
 $tmpl->assign('filesStillEncrypted' , $filesStillEncrypted);
 $tmpl->assign('enableAvatars', \OC_Config::getValue('enable_avatars', true));
 $tmpl->assign('avatarChangeSupported', OC_User::canUserChangeAvatar(OC_User::getUser()));
+$tmpl->assign('certs', $certificateManager->listCertificates());
 
 $forms=OC_App::getForms('personal');
 $tmpl->assign('forms', array());
diff --git a/settings/routes.php b/settings/routes.php
index 1c8ad1b3fe8..c7bab409d4b 100644
--- a/settings/routes.php
+++ b/settings/routes.php
@@ -62,6 +62,10 @@ $this->create('settings_ajax_restorekeys', '/settings/ajax/restorekeys.php')
 	->actionInclude('settings/ajax/restorekeys.php');
 $this->create('settings_ajax_deletekeys', '/settings/ajax/deletekeys.php')
 	->actionInclude('settings/ajax/deletekeys.php');
+$this->create('core_cert_post', '/settings/ajax/addRootCertificate.php')
+	->actionInclude('settings/ajax/addRootCertificate.php');
+$this->create('core_cert_remove', '/settings/ajax/removeRootCertificate.php')
+	->actionInclude('settings/ajax/removeRootCertificate.php');
 // apps
 $this->create('settings_ajax_apps_ocs', '/settings/ajax/apps/ocs.php')
 	->actionInclude('settings/ajax/apps/ocs.php');
diff --git a/settings/templates/personal.php b/settings/templates/personal.php
index c1fb20dce05..6d07b899544 100644
--- a/settings/templates/personal.php
+++ b/settings/templates/personal.php
@@ -150,6 +150,44 @@ if($_['passwordChangeSupported']) {
 	print_unescaped($form);
 };?>
 
+<div class="section">
+	<h2><?php p($l->t('SSL root certificates')); ?></h2>
+	<table id="sslCertificate" class="grid">
+		<thead>
+			<th><?php p($l->t('Common Name')); ?></th>
+			<th><?php p($l->t('Valid until')); ?></th>
+			<th><?php p($l->t('Issued By')); ?></th>
+			<th/>
+		</thead>
+		<tbody>
+			<?php foreach ($_['certs'] as $rootCert): /**@var \OCP\ICertificate $rootCert*/?>
+				<tr class="<?php echo ($rootCert->isExpired()) ? 'expired' : 'valid' ?>" data-name="<?php p($rootCert->getName()) ?>">
+					<td class="rootCert" title="<?php p($rootCert->getOrganization())?>">
+						<?php p($rootCert->getCommonName()) ?>
+					</td>
+					<td title="<?php p($l->t('Valid from %s', $l->l('date', $rootCert->getExpireDate()))) ?>">
+						<?php echo $l->l('date', $rootCert->getExpireDate()) ?>
+					</td>
+					<td title="<?php p($rootCert->getIssuerOrganization()) ?>">
+						<?php p($rootCert->getIssuerName()) ?>
+					</td>
+					<td <?php if ($rootCert != ''): ?>class="remove"
+						<?php else: ?>style="visibility:hidden;"
+						<?php endif; ?>><img alt="<?php p($l->t('Delete')); ?>"
+											 title="<?php p($l->t('Delete')); ?>"
+											 class="svg action"
+											 src="<?php print_unescaped(image_path('core', 'actions/delete.svg')); ?>"/>
+					</td>
+				</tr>
+			<?php endforeach; ?>
+		</tbody>
+	</table>
+	<form class="uploadButton" method="post" action="<?php p(\OC_Helper::linkToRoute('core_cert_post')); ?>" target="certUploadFrame">
+		<input type="file" id="rootcert_import" name="rootcert_import" class="hidden">
+		<input type="button" id="rootcert_import_button" value="<?php p($l->t('Import Root Certificate')); ?>"/>
+	</form>
+</div>
+
 <?php if($_['enableDecryptAll']): ?>
 <div class="section">
 
@@ -177,11 +215,8 @@ if($_['passwordChangeSupported']) {
 	</p>
 	<br />
 	</div>
-
 	<?php endif; ?>
 
-
-
 	<div id="restoreBackupKeys" <?php $_['backupKeysExists'] ? '' : print_unescaped("class='hidden'") ?>>
 
 	<?php p($l->t( "Your encryption keys are moved to a backup location. If something went wrong you can restore the keys. Only delete them permanently if you are sure that all files are decrypted correctly." )); ?>