summaryrefslogtreecommitdiffstats
path: root/lib/private/appframework/http
Commit message (Collapse)AuthorAgeFilesLines
* Add new CSRF manager for unit testing purposesLukas Reschke2016-01-251-19/+11
| | | | This adds a new CSRF manager for unit testing purposes, it's interface is based upon https://github.com/symfony/security-csrf. Due to some of our required custom changes it is however not possible to use the Symfony component directly.
* Happy new year!Thomas Müller2016-01-123-4/+7
|
* getLowStrengthGenerator does not do anything anymoreRoeland Jago Douma2016-01-111-1/+1
|
* Use PHP polyfillsLukas Reschke2015-12-111-1/+1
|
* Also allow empty value for no-HTTPS.Mitar2015-11-271-1/+2
| | | | This makes it work better with old version of Nginx.
* also match ie11 with Request::USER_AGENT_IERobin Appelman2015-11-221-1/+1
|
* Fix undefined HTTP_USER_AGENTThomas Müller2015-11-221-0/+3
|
* Update license headersLukas Reschke2015-10-261-0/+1
|
* Remove dependency on ICrypto + use XORLukas Reschke2015-10-211-11/+4
|
* fix IE8 user agent detectionMorris Jobke2015-10-091-0/+1
|
* Merge pull request #19034 from owncloud/http-request-warningThomas Müller2015-10-081-1/+3
|\ | | | | Prevent warning decoding content
| * Prevent warning decoding contentRobin McCorkell2015-09-141-1/+3
| |
* | Merge pull request #19607 from owncloud/use-urlThomas Müller2015-10-081-3/+13
|\ \ | | | | | | Use `/` if installed in main folder
| * | Use `/` if installed in main folderLukas Reschke2015-10-061-3/+13
| | | | | | | | | | | | | | | | | | Otherwise an empty string is used indicating the cookie is only valid for those resources. This can lead to eunexpected behaviour. Fixes https://github.com/owncloud/core/issues/19196
* | | Add \OCP\IRequest::getHttpProtocolLukas Reschke2015-10-061-0/+21
|/ / | | | | | | | | | | Only allow valid HTTP protocols. Ref https://github.com/owncloud/core/pull/19537#discussion_r41252333 + https://github.com/owncloud/security-tracker/issues/119
* | deduplicate @xenopathicMorris Jobke2015-10-061-1/+0
| |
* | update licence headers via scriptMorris Jobke2015-10-051-1/+2
| |
* | return '' instead of falseJörn Friedrich Dreyer2015-09-231-1/+1
|/
* Decode request content only on getContentRobin McCorkell2015-08-311-34/+49
|
* Add mitigation against BREACHLukas Reschke2015-08-141-1/+21
| | | | | | | | | | | | While BREACH requires the following three factors to be effectively exploitable we should add another mitigation: 1. Application must support HTTP compression 2. Response most reflect user-controlled input 3. Response should contain sensitive data Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed. To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.
* Set default `forwarded_for_headers` to 'HTTP_X_FORWARDED_FOR'Robin McCorkell2015-08-101-1/+4
|
* Remove "use" statementLukas Reschke2015-08-051-2/+1
| | | | Ref https://bugs.php.net/bug.php?id=66773
* Use StringUtils::equals on CSRF token and add unit testsLukas Reschke2015-08-041-5/+4
|
* Fixing 'Undefined index: REMOTE_ADDR' - fixes #17460Thomas Müller2015-07-161-1/+2
|
* Merge pull request #17078 from owncloud/fix-initial-server-hostMorris Jobke2015-07-011-6/+5
|\ | | | | Fix undefined offset
| * Fix undefined offsetLukas Reschke2015-06-221-6/+5
| | | | | | | | There are cases where no trusted host is specified such as when installing the instance, this lead to an undefined offset warning in the log right after installing. (when another domain than localhost or 127.0.0.1 was used)
* | update license headers and authorsMorris Jobke2015-06-251-0/+1
|/
* Merge pull request #15735 from owncloud/fix-visibilityMorris Jobke2015-04-201-1/+1
|\ | | | | Fix visibility of interfaces in \OCP
| * Fix visibility of public API methodsJoas Schilling2015-04-201-1/+1
| |
* | Remove unused variablesMorris Jobke2015-04-181-2/+1
|/ | | | | * should make scrutinizer a lot more happy * reduces maybe memory footprint
* Update license headersJenkins for ownCloud2015-03-263-32/+50
|
* Let users configure security headers in their WebserverLukas Reschke2015-03-021-1/+1
| | | | | | | | | | Doing this in the PHP code is not the right approach for multiple reasons: 1. A bug in the PHP code prevents them from being added to the response. 2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud) 3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations. This pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS.
* AppFramework StreamResponseBernhard Posselt2015-02-272-6/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | First stab at the StreamResponse, see #12988 The idea is to use an interface ICallbackResponse (I'm not 100% happy with the name yet, suggestions?) that allow the response to output things in its own way, for instance stream the file using readfile Unittests are atm lacking, plan is to check if a mock of ICallbackResponse will be used by calling its callback (also unhappy with this name) method Usage is: $response = new StreamResponse('path/to/file'); rename io to output, add additional methods and handle error and not modified cases when using StreamResponse fix indention and uppercasing, also handle forbidden cases fix indention fix indention no forbidden, figuring out if a file is really readable is too complicated to get to work across OSes and streams remove useless import remove useless import fix intendation
* Revert "Updating license headers"Morris Jobke2015-02-262-31/+30
| | | | This reverts commit 6a1a4880f0d556fb090f19a5019fec31916f5c36.
* Merge pull request #14458 from owncloud/revive/11157Thomas Müller2015-02-251-3/+9
|\ | | | | Get the real protocol behind several proxies
| * Use [0] instead of current as HHVM might have problems with thatLukas Reschke2015-02-241-1/+1
| |
| * Get the real protocol behind several proxiesLukas Reschke2015-02-241-3/+9
| | | | | | | | | | | | X-Forwarded-Proto contains a list of protocols if ownCloud is behind multiple reverse proxies. This is a revival of https://github.com/owncloud/core/pull/11157 using the new IRequest public API.
* | Merge pull request #14151 from owncloud/update-sabre2.1Thomas Müller2015-02-251-2/+2
|\ \ | |/ |/| Sabre Update to 2.1
| * Sabre Update to 2.1Vincent Petry2015-02-231-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - VObject fixes for Sabre\VObject 3.3 - Remove VObject property workarounds - Added prefetching for tags in sabre tags plugin - Moved oc_properties logic to separate PropertyStorage backend (WIP) - Fixed Sabre connector namespaces - Improved files plugin to handle props on-demand - Moved allowed props from server class to files plugin - Fixed tags caching for files that are known to have no tags (less queries) - Added/fixed unit tests for Sabre FilesPlugin, TagsPlugin - Replace OC\Connector\Sabre\Request with direct call to httpRequest->setUrl() - Fix exception detection in DAV client when using Sabre\DAV\Client - Added setETag() on Node instead of using the static FileSystem - Also preload tags/props when depth is infinity
* | properly initialize OC::$WEBROOT and host nameThomas Müller2015-02-231-1/+1
|/
* Updating license headersJenkins for ownCloud2015-02-232-30/+31
|
* Incorporate review changesLukas Reschke2015-02-161-6/+6
|
* Add blackmagic due to cyclic dependency :see_no_evil:Lukas Reschke2015-02-161-3/+3
|
* Make scrutinizer happyLukas Reschke2015-02-161-1/+1
|
* Refactor OC_Request into TrustedDomainHelper and IRequestLukas Reschke2015-02-161-6/+282
| | | | | | | | | | This changeset removes the static class `OC_Request` and moves the functions either into `IRequest` which is accessible via `\OC::$server::->getRequest()` or into a separated `TrustedDomainHelper` class for some helper methods which should not be publicly exposed. This changes only internal methods and nothing on the public API. Some public functions in `util.php` have been deprecated though in favour of the new non-static functions. Unfortunately some part of this code uses things like `__DIR__` and thus is not completely unit-testable. Where tests where possible they ahve been added though. Fixes https://github.com/owncloud/core/issues/13976 which was requested in https://github.com/owncloud/core/pull/13973#issuecomment-73492969
* Respect `mod_unique_id` and refactor `OC_Request::getRequestId`Lukas Reschke2015-02-091-12/+40
| | | | | | | | | | | | | | When `mod_unique_id` is enabled the ID generated by it will be used for logging. This allows for correlation of the Apache logs and the ownCloud logs. Testplan: - [ ] When `mod_unique_id` is enabled the request ID equals the one generated by `mod_unique_id`. - [ ] When `mod_unique_id` is not available the request ID is a 20 character long random string - [ ] The generated Id is stable over the lifespan of one request Changeset looks a little bit larger since I had to adjust every unit test using the HTTP\Request class for proper DI. Fixes https://github.com/owncloud/core/issues/13366
* always set url parameters when they are available in the app dispatchBernhard Posselt2015-01-151-7/+15
| | | | | | prefer url parameters passed into the main method. If they are not present, use the containers urlParameters add space
* Add functions to modify cookies to response classLukas Reschke2014-11-271-3/+5
| | | | | | | | | | | | | | | | Currently there is no AppFramework way to modify cookies, which makes it unusable for quite some use-cases or results in untestable code. This PR adds some basic functionalities to add and invalidate cookies. Usage: ```php $response = new TemplateResponse(...); $response->addCookie('foo', 'bar'); $response->invalidateCookie('foo'); $response->addCookie('bar', 'foo', new \DateTime('2015-01-01 00:00')); ``` Existing cookies can be accessed with the AppFramework using `$this->request->getCookie($name)`.
* add dataresponseBernhard Posselt2014-10-291-2/+3
| | | | | | | | | | | | | | fix docstrings adjust copyright date another copyright date update another header update implement third headers argument, fix indention, fix docstrings fix docstrings
* Remove dead codeLukas Reschke2014-09-291-1/+0
|
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-26 18:15:53 +0000