summaryrefslogtreecommitdiffstats
path: root/lib/private
diff options
context:
space:
mode:
Diffstat (limited to 'lib/private')
-rw-r--r--lib/private/AppFramework/DependencyInjection/DIContainer.php8
-rw-r--r--lib/private/AppFramework/Http/Request.php40
-rw-r--r--lib/private/AppFramework/Middleware/OCSMiddleware.php80
-rw-r--r--lib/private/AppFramework/Middleware/Security/Exceptions/StrictCookieMissingException.php36
-rw-r--r--lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php11
-rw-r--r--lib/private/Group/Database.php4
-rw-r--r--lib/private/Repair/RepairLegacyStorages.php2
-rw-r--r--lib/private/legacy/eventsource.php4
-rw-r--r--lib/private/legacy/files.php2
-rw-r--r--lib/private/legacy/json.php5
10 files changed, 187 insertions, 5 deletions
diff --git a/lib/private/AppFramework/DependencyInjection/DIContainer.php b/lib/private/AppFramework/DependencyInjection/DIContainer.php
index 1684ff8027b..893d6cb9aa6 100644
--- a/lib/private/AppFramework/DependencyInjection/DIContainer.php
+++ b/lib/private/AppFramework/DependencyInjection/DIContainer.php
@@ -38,6 +38,7 @@ use OC\AppFramework\Http\Dispatcher;
use OC\AppFramework\Http\Output;
use OC\AppFramework\Middleware\MiddlewareDispatcher;
use OC\AppFramework\Middleware\Security\CORSMiddleware;
+use OC\AppFramework\Middleware\OCSMiddleware;
use OC\AppFramework\Middleware\Security\SecurityMiddleware;
use OC\AppFramework\Middleware\SessionMiddleware;
use OC\AppFramework\Utility\SimpleContainer;
@@ -374,6 +375,12 @@ class DIContainer extends SimpleContainer implements IAppContainer {
return new TwoFactorMiddleware($twoFactorManager, $userSession, $session, $urlGenerator, $reflector, $request);
});
+ $this->registerService('OCSMiddleware', function (SimpleContainer $c) {
+ return new OCSMiddleware(
+ $c['Request']
+ );
+ });
+
$middleWares = &$this->middleWares;
$this->registerService('MiddlewareDispatcher', function($c) use (&$middleWares) {
$dispatcher = new MiddlewareDispatcher();
@@ -386,6 +393,7 @@ class DIContainer extends SimpleContainer implements IAppContainer {
}
$dispatcher->registerMiddleware($c['SessionMiddleware']);
+ $dispatcher->registerMiddleware($c['OCSMiddleware']);
return $dispatcher;
});
diff --git a/lib/private/AppFramework/Http/Request.php b/lib/private/AppFramework/Http/Request.php
index d9cf1919252..8fc99f125b2 100644
--- a/lib/private/AppFramework/Http/Request.php
+++ b/lib/private/AppFramework/Http/Request.php
@@ -465,6 +465,10 @@ class Request implements \ArrayAccess, \Countable, IRequest {
return false;
}
+ if(!$this->passesStrictCookieCheck()) {
+ return false;
+ }
+
if (isset($this->items['get']['requesttoken'])) {
$token = $this->items['get']['requesttoken'];
} elseif (isset($this->items['post']['requesttoken'])) {
@@ -481,6 +485,42 @@ class Request implements \ArrayAccess, \Countable, IRequest {
}
/**
+ * Checks if the strict cookie has been sent with the request if the request
+ * is including any cookies.
+ *
+ * @return bool
+ * @since 9.1.0
+ */
+ public function passesStrictCookieCheck() {
+ if(count($this->cookies) === 0) {
+ return true;
+ }
+ if($this->getCookie('nc_sameSiteCookiestrict') === 'true'
+ && $this->passesLaxCookieCheck()) {
+ return true;
+ }
+ return false;
+ }
+
+ /**
+ * Checks if the lax cookie has been sent with the request if the request
+ * is including any cookies.
+ *
+ * @return bool
+ * @since 9.1.0
+ */
+ public function passesLaxCookieCheck() {
+ if(count($this->cookies) === 0) {
+ return true;
+ }
+ if($this->getCookie('nc_sameSiteCookielax') === 'true') {
+ return true;
+ }
+ return false;
+ }
+
+
+ /**
* Returns an ID for the request, value is not guaranteed to be unique and is mostly meant for logging
* If `mod_unique_id` is installed this value will be taken.
* @return string
diff --git a/lib/private/AppFramework/Middleware/OCSMiddleware.php b/lib/private/AppFramework/Middleware/OCSMiddleware.php
new file mode 100644
index 00000000000..2c7d1167e7c
--- /dev/null
+++ b/lib/private/AppFramework/Middleware/OCSMiddleware.php
@@ -0,0 +1,80 @@
+<?php
+/**
+ *
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OC\AppFramework\Middleware;
+
+use OC\AppFramework\Http;
+use OCP\AppFramework\Http\OCSResponse;
+use OCP\AppFramework\OCS\OCSException;
+use OCP\AppFramework\OCSController;
+use OCP\IRequest;
+use OCP\AppFramework\Middleware;
+
+class OCSMiddleware extends Middleware {
+
+ /** @var IRequest */
+ private $request;
+
+ /**
+ * @param IRequest $request
+ */
+ public function __construct(IRequest $request) {
+ $this->request = $request;
+ }
+
+ /**
+ * @param \OCP\AppFramework\Controller $controller
+ * @param string $methodName
+ * @param \Exception $exception
+ * @throws \Exception
+ * @return OCSResponse
+ */
+ public function afterException($controller, $methodName, \Exception $exception) {
+ if ($controller instanceof OCSController && $exception instanceof OCSException) {
+ $format = $this->getFormat($controller);
+
+ $code = $exception->getCode();
+ if ($code === 0) {
+ $code = Http::STATUS_INTERNAL_SERVER_ERROR;
+ }
+ return new OCSResponse($format, $code, $exception->getMessage());
+ }
+
+ throw $exception;
+ }
+
+ /**
+ * @param \OCP\AppFramework\Controller $controller
+ * @return string
+ */
+ private function getFormat($controller) {
+ // get format from the url format or request format parameter
+ $format = $this->request->getParam('format');
+
+ // if none is given try the first Accept header
+ if($format === null) {
+ $headers = $this->request->getHeader('Accept');
+ $format = $controller->getResponderByHTTPHeader($headers);
+ }
+
+ return $format;
+ }
+}
diff --git a/lib/private/AppFramework/Middleware/Security/Exceptions/StrictCookieMissingException.php b/lib/private/AppFramework/Middleware/Security/Exceptions/StrictCookieMissingException.php
new file mode 100644
index 00000000000..9ccaed4566f
--- /dev/null
+++ b/lib/private/AppFramework/Middleware/Security/Exceptions/StrictCookieMissingException.php
@@ -0,0 +1,36 @@
+<?php
+/**
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OC\AppFramework\Middleware\Security\Exceptions;
+
+use OCP\AppFramework\Http;
+
+/**
+ * Class StrictCookieMissingException is thrown when the strict cookie has not
+ * been sent with the request but is required.
+ *
+ * @package OC\AppFramework\Middleware\Security\Exceptions
+ */
+class StrictCookieMissingException extends SecurityException {
+ public function __construct() {
+ parent::__construct('Strict Cookie has not been found in request.', Http::STATUS_PRECONDITION_FAILED);
+ }
+}
diff --git a/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php b/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php
index a3ece262e10..98117751e21 100644
--- a/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php
+++ b/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php
@@ -32,6 +32,7 @@ use OC\AppFramework\Middleware\Security\Exceptions\AppNotEnabledException;
use OC\AppFramework\Middleware\Security\Exceptions\CrossSiteRequestForgeryException;
use OC\AppFramework\Middleware\Security\Exceptions\NotAdminException;
use OC\AppFramework\Middleware\Security\Exceptions\NotLoggedInException;
+use OC\AppFramework\Middleware\Security\Exceptions\StrictCookieMissingException;
use OC\AppFramework\Utility\ControllerMethodReflector;
use OC\Security\CSP\ContentSecurityPolicyManager;
use OCP\AppFramework\Http\ContentSecurityPolicy;
@@ -134,6 +135,12 @@ class SecurityMiddleware extends Middleware {
}
}
+ // Check for strict cookie requirement
+ if($this->reflector->hasAnnotation('StrictCookieRequired') || !$this->reflector->hasAnnotation('NoCSRFRequired')) {
+ if(!$this->request->passesStrictCookieCheck()) {
+ throw new StrictCookieMissingException();
+ }
+ }
// CSRF check - also registers the CSRF token since the session may be closed later
Util::callRegister();
if(!$this->reflector->hasAnnotation('NoCSRFRequired')) {
@@ -186,7 +193,9 @@ class SecurityMiddleware extends Middleware {
*/
public function afterException($controller, $methodName, \Exception $exception) {
if($exception instanceof SecurityException) {
-
+ if($exception instanceof StrictCookieMissingException) {
+ return new RedirectResponse(\OC::$WEBROOT);
+ }
if (stripos($this->request->getHeader('Accept'),'html') === false) {
$response = new JSONResponse(
array('message' => $exception->getMessage()),
diff --git a/lib/private/Group/Database.php b/lib/private/Group/Database.php
index 36d19f74cc6..64f249d4d25 100644
--- a/lib/private/Group/Database.php
+++ b/lib/private/Group/Database.php
@@ -285,7 +285,7 @@ class Database extends \OC\Group\Backend {
$parameters = [$gid];
$searchLike = '';
if ($search !== '') {
- $parameters[] = '%' . $search . '%';
+ $parameters[] = '%' . $this->dbConn->escapeLikeParameter($search) . '%';
$searchLike = ' AND `uid` LIKE ?';
}
@@ -311,7 +311,7 @@ class Database extends \OC\Group\Backend {
$parameters = [$gid];
$searchLike = '';
if ($search !== '') {
- $parameters[] = '%' . $search . '%';
+ $parameters[] = '%' . $this->dbConn->escapeLikeParameter($search) . '%';
$searchLike = ' AND `uid` LIKE ?';
}
diff --git a/lib/private/Repair/RepairLegacyStorages.php b/lib/private/Repair/RepairLegacyStorages.php
index 8ef20cdf3c2..096300f51c2 100644
--- a/lib/private/Repair/RepairLegacyStorages.php
+++ b/lib/private/Repair/RepairLegacyStorages.php
@@ -172,7 +172,7 @@ class RepairLegacyStorages implements IRepairStep{
$sql = 'SELECT `id`, `numeric_id` FROM `*PREFIX*storages`'
. ' WHERE `id` LIKE ?'
. ' ORDER BY `id`';
- $result = $this->connection->executeQuery($sql, array($dataDirId . '%'));
+ $result = $this->connection->executeQuery($sql, array($this->connection->escapeLikeParameter($dataDirId) . '%'));
while ($row = $result->fetch()) {
$currentId = $row['id'];
diff --git a/lib/private/legacy/eventsource.php b/lib/private/legacy/eventsource.php
index 51040e7be7d..70e9847d237 100644
--- a/lib/private/legacy/eventsource.php
+++ b/lib/private/legacy/eventsource.php
@@ -76,6 +76,10 @@ class OC_EventSource implements \OCP\IEventSource {
} else {
header("Content-Type: text/event-stream");
}
+ if(!\OC::$server->getRequest()->passesStrictCookieCheck()) {
+ header('Location: '.\OC::$WEBROOT);
+ exit();
+ }
if (!(\OC::$server->getRequest()->passesCSRFCheck())) {
$this->send('error', 'Possible CSRF attack. Connection will be closed.');
$this->close();
diff --git a/lib/private/legacy/files.php b/lib/private/legacy/files.php
index 8cf98322223..cb8dc35aa5c 100644
--- a/lib/private/legacy/files.php
+++ b/lib/private/legacy/files.php
@@ -192,7 +192,7 @@ class OC_Files {
* @return array $rangeArray ('from'=>int,'to'=>int), ...
*/
private static function parseHttpRangeHeader($rangeHeaderPos, $fileSize) {
- $rArray=split(',', $rangeHeaderPos);
+ $rArray=explode(',', $rangeHeaderPos);
$minOffset = 0;
$ind = 0;
diff --git a/lib/private/legacy/json.php b/lib/private/legacy/json.php
index 1dde63602b1..557e1d77012 100644
--- a/lib/private/legacy/json.php
+++ b/lib/private/legacy/json.php
@@ -79,6 +79,11 @@ class OC_JSON{
* @deprecated Use annotation based CSRF checks from the AppFramework instead
*/
public static function callCheck() {
+ if(!\OC::$server->getRequest()->passesStrictCookieCheck()) {
+ header('Location: '.\OC::$WEBROOT);
+ exit();
+ }
+
if( !(\OC::$server->getRequest()->passesCSRFCheck())) {
$l = \OC::$server->getL10N('lib');
self::error(array( 'data' => array( 'message' => $l->t('Token expired. Please reload page.'), 'error' => 'token_expired' )));
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-29 18:55:38 +0000