aboutsummaryrefslogtreecommitdiffstats
path: root/tests/lib/AppFramework/Middleware
Commit message (Collapse)AuthorAgeFilesLines
* fix(ratelimit): Allow to bypass rate-limit from bruteforce allowlistbugfix/noid/allow-ratelimit-bypassJoas Schilling2025-01-271-1/+9
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* test:(PasswordConfirmationMiddleware): Fix constructor callLouis Chemineau2024-11-281-5/+14
| | | | Signed-off-by: Louis Chemineau <louis@chmn.me>
* refactor: Add void return type to PHPUnit test methodsChristoph Wurst2024-09-1512-63/+63
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* chore: Remove unused `CsrfTokenManager` from `CSPMiddleware`Ferdinand Thiessen2024-08-311-5/+0
| | | | Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
* style: update codestyle for coding-standard 1.2.3Daniel Kesselberg2024-08-252-8/+8
| | | | Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* perf: delay getting (sub)admin status for user in the security middleware ↵Robin Appelman2024-08-231-2/+15
| | | | | | untill we need it Signed-off-by: Robin Appelman <robin@icewind.nl>
* feat: Provide CSP nonce as `<meta>` elementFerdinand Thiessen2024-08-131-1/+0
| | | | | | | | This way we use the CSP nonce for dynamically loaded scripts. Important to notice: The CSP nonce must NOT be injected in `content` as this can lead to value exfiltration using e.g. side-channel attacts (CSS selectors). Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
* test: Adjust tests for CSP nonceFerdinand Thiessen2024-08-131-12/+8
| | | | Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
* fix(files_sharing): show proper share not found error messageskjnldsv2024-08-061-2/+4
| | | | Signed-off-by: skjnldsv <skjnldsv@protonmail.com>
* feat(security): Add public API to allow validating IP Ranges and checking ↵Joas Schilling2024-07-191-2/+2
| | | | | | | for "in range" Signed-off-by: Joas Schilling <coding@schilljs.com> Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
* feat(security): restrict admin actions to IP rangesBenjamin Gaussorgues2024-07-191-1/+5
| | | | Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
* feat(Security): Warn about using annotations instead of attributesprovokateurin2024-07-182-12/+19
| | | | Signed-off-by: provokateurin <kate@provokateurin.de>
* feat(AppFramework): Add ExAppRequired attributeprovokateurin2024-07-012-1/+58
| | | | Signed-off-by: provokateurin <kate@provokateurin.de>
* refactor(Token): introduce scope constantsArthur Schiwon2024-06-051-1/+1
| | | | Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* fix(Session): avoid password confirmation on SSOArthur Schiwon2024-06-052-1/+63
| | | | | | | | | | | SSO backends like SAML and OIDC tried a trick to suppress password confirmations as they are not possible by design. At least for SAML it was not reliable when existing user backends where used as user repositories. Now we are setting a special scope with the token, and also make sure that the scope is taken over when tokens are regenerated. Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* chore: Add SPDX headerAndy Scherzinger2024-05-1321-369/+47
| | | | Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
* fix: add check for app_api_system session flag to bypass rate limitFlorian Klinger2024-03-181-1/+5
| | | | | Signed-off-by: Florian Klinger <florian.klinger@nextcloud.com> Signed-off-by: Andrey Borysenko <andrey18106x@gmail.com>
* chore: apply changes from Nextcloud coding standards 1.1.1Joas Schilling2023-11-231-1/+1
| | | | | Signed-off-by: Joas Schilling <coding@schilljs.com> Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
* techdebt(DI): Use public IThrottler interface which exists since Nextcloud 25Joas Schilling2023-08-283-10/+11
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* fix!: Remove legacy event dispatching Symfony's GenericEvent from ↵Joas Schilling2023-07-271-41/+0
| | | | | | AdditionalScripts Signed-off-by: Joas Schilling <coding@schilljs.com>
* fix(middleware): Also abort the request when reaching max delay in ↵Joas Schilling2023-05-151-7/+7
| | | | | | afterController Signed-off-by: Joas Schilling <coding@schilljs.com>
* feat(security): Add PHP \Attribute for remaining security annotationsJoas Schilling2023-04-258-250/+801
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* feat(ratelimit): Add Attributes support to rate limit middlewareJoas Schilling2023-04-241-103/+170
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* feat(app-framework): Add native argument types for middlewareChristoph Wurst2023-04-181-8/+8
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Add a debug message when throttling without definingJoas Schilling2023-03-081-6/+33
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* feat(middleware): Migrate BruteForceProtection annotation to PHP Attribute ↵Joas Schilling2023-03-081-61/+168
| | | | | | and allow multiple Signed-off-by: Joas Schilling <coding@schilljs.com>
* fix(CORS): CORS should only be bypassed on `PublicPage` if not logged in to ↵Ferdinand Thiessen2023-02-161-1/+35
| | | | | | prevent CSRF attack vectors Signed-off-by: Ferdinand Thiessen <rpm@fthiessen.de>
* feat(app-framework): Add UseSession attribute to replace annotationChristoph Wurst2023-01-271-53/+100
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* composer run cs:fixCôme Chilliet2023-01-2012-12/+0
| | | | Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
* use bruteforce protection on all methods wrapped by PublicShareMiddlewareJulien Veyssier2022-12-071-1/+6
| | | | | | if an invalid token is provided or when share password is wrong Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
* Fix SessionMiddlewareTest and cover new case with reopeningJulius Härtl2022-08-241-3/+17
| | | | Signed-off-by: Julius Härtl <jus@bitgrid.net>
* Merge pull request #32587 from nextcloud/bugfix/noid/improve-jsconfighelperJoas Schilling2022-05-311-72/+52
|\ | | | | Improve JSConfigHelper code quality a bit
| * Restore old behaviour of sending flase for not found appsJoas Schilling2022-05-301-72/+52
| | | | | | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* | Update core to PHP 7.4 standardCarl Schwan2022-05-201-2/+1
|/ | | | | | | - Typed properties - Port to LoggerInterface Signed-off-by: Carl Schwan <carl@carlschwan.eu>
* Fix testsJoas Schilling2022-02-234-24/+28
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Check style updateCarl Schwan2022-01-133-17/+17
| | | | Signed-off-by: Carl Schwan <carl@carlschwan.eu>
* Add admin privilege delegation for admin settingsCarl Schwan2021-09-291-1/+11
| | | | | | | This makes it possible for selected groups to access some settings pages. Signed-off-by: Carl Schwan <carl@carlschwan.eu>
* Move DateTime::RFC2822 to DateTimeInterface::2822Christoph Wurst2021-06-231-3/+3
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Move DateTime::ATOM to DateTimeInterface::ATOMChristoph Wurst2021-06-231-2/+2
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Fix warnings about logExceptionJoas Schilling2021-06-041-2/+2
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Fix unauthorized OCS status in provisioningJoas Schilling2021-05-121-50/+49
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Merge pull request #26591 from nextcloud/techdebt/noid/less-iloggerChristoph Wurst2021-04-271-3/+3
|\ | | | | Less ILogger
| * Fix unit testsJoas Schilling2021-04-271-3/+3
| | | | | | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* | Fix ratelimit templateJoas Schilling2021-04-271-11/+9
|/ | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Remove deprecated \OCP\APIRoeland Jago Douma2021-03-031-4/+4
| | | | | | | | Time to remove this forgood now. Remaining constant moved over The world is a tiny bit better Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Remove OCSResponse type hint - see #23827Morris Jobke2020-11-031-1/+0
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Format code to a single space around binary operatorsChristoph Wurst2020-10-053-3/+3
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* More test fixingJoas Schilling2020-08-191-2/+2
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Change PHPDoc type hint from PHPUnit_Framework_MockObject_MockObject to ↵Morris Jobke2020-08-127-43/+43
| | | | | | \PHPUnit\Framework\MockObject\MockObject Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Add real events to load additionalscriptsRoeland Jago Douma2020-07-151-9/+46
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-28 17:47:23 +0000