aboutsummaryrefslogtreecommitdiffstats
path: root/tests/lib/AppFramework
Commit message (Collapse)AuthorAgeFilesLines
* fix(Token): make new scope future compatibleArthur Schiwon2024-06-121-1/+1
| | | | | | | - "password-unconfirmable" is the effective name for 30, but a draft name was backported. Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* fix(Session): avoid password confirmation on SSOArthur Schiwon2024-06-112-1/+63
| | | | | | | | | | | SSO backends like SAML and OIDC tried a trick to suppress password confirmations as they are not possible by design. At least for SAML it was not reliable when existing user backends where used as user repositories. Now we are setting a special scope with the token, and also make sure that the scope is taken over when tokens are regenerated. Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* fix: add check for app_api_system session flag to bypass rate limitFlorian Klinger2024-03-181-1/+5
| | | | | Signed-off-by: Florian Klinger <florian.klinger@nextcloud.com> Signed-off-by: Andrey Borysenko <andrey18106x@gmail.com>
* fix xml ocs response for serializable objectsKlaus2024-02-231-0/+39
| | | | | Signed-off-by: sualko <klaus@jsxc.org> Signed-off-by: skjnldsv <skjnldsv@protonmail.com>
* test(request): Add tests to strip the port when forwarding requestsJoas Schilling2024-02-131-288/+119
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Add timezone getter to ITimeFactoryAnna Larch2024-02-131-0/+17
| | | | Signed-off-by: Anna Larch <anna@nextcloud.com>
* better testsMaxence Lange2024-02-011-129/+606
| | | | Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
* fix lintMaxence Lange2024-01-311-18/+18
| | | | Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
* adding testMaxence Lange2024-01-311-0/+214
| | | | Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
* test(unit): fix RequestTestArthur Schiwon2024-01-271-3/+4
| | | | Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* fix(API): Use a distinct exception so apps can react to it and customize the ↵Joas Schilling2023-11-281-1/+2
| | | | | | return Signed-off-by: Joas Schilling <coding@schilljs.com>
* enh(dispatcher): enforce psalm ranges in the http dispatcherArthur Schiwon2023-11-242-0/+68
| | | | | | - allows devs to provide int ranges for API arguments Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* chore: apply changes from Nextcloud coding standards 1.1.1Joas Schilling2023-11-234-11/+11
| | | | | Signed-off-by: Joas Schilling <coding@schilljs.com> Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
* fix(CSP): Only add `strict-dynamic` when using noncesFerdinand Thiessen2023-11-172-59/+59
| | | | Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
* fix!(ContentSecurityPolicy): Make `strict-dynamic` enabled by default on ↵Ferdinand Thiessen2023-11-171-76/+73
| | | | | | `script-src-elem` Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
* feat(ContentSecurityPolicy): Allow to set `strict-dynamic` on ↵Ferdinand Thiessen2023-11-172-0/+73
| | | | | | | | | `script-src-elem` only This adds the possibility to set `strict-dynamic` on `script-src-elem` only while keep the default rules for `script-src`. The idea is to allow loading module js which imports other files and thus does not allow nonces on import but on the initial script tag. Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
* Reverse X-Forwarded-For list to read the correct proxy remote addressJoas Schilling2023-11-161-6/+32
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* feat(dependencyinjection): Allow optional (nullable) servicesChristoph Wurst2023-11-031-0/+24
| | | | | | Allows working with classes that might or might not be available. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Merge pull request #39852 from nextcloud/pragmaHeaderFerdinand Thiessen2023-10-181-2/+0
|\ | | | | Stop sending deprecated Pragma header
| * Stop sending deprecated Pragma headerGit'Fellow2023-08-281-2/+0
| | | | | | | | Signed-off-by: Git'Fellow <12234510+solracsf@users.noreply.github.com>
* | techdebt(DI): Use public IThrottler interface which exists since Nextcloud 25Joas Schilling2023-08-283-10/+11
|/ | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Allow "wasm-unsafe-eval" in CSPDaniel Calviño Sánchez2023-08-102-0/+14
| | | | | | | | | | | | | | | | | | If a page has a Content Security Policy header and the `script-src` (or `default-src`) directive does not contain neither `wasm-unsafe-eval` nor `unsafe-eval` loading and executing WebAssembly is blocked in the page (although it is still possible to load and execute WebAssembly in a worker thread). Although the Nextcloud classes to manage the CSP already supported allowing `unsafe-eval` this affects not only WebAssembly, but also the `eval` operation in JavaScript. To make possible to allow WebAssembly execution without allowing JavaScript `eval` this commit adds support for allowing `wasm-unsafe-eval`. Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
* fix!: Remove legacy event dispatching Symfony's GenericEvent from ↵Joas Schilling2023-07-271-41/+0
| | | | | | AdditionalScripts Signed-off-by: Joas Schilling <coding@schilljs.com>
* feat(request): Allow to match the client version with the ↵Joas Schilling2023-07-111-0/+57
| | | | | | IRequest::USER_AGENT_* regex Signed-off-by: Joas Schilling <coding@schilljs.com>
* Add template types to responsesjld31032023-06-301-1/+4
| | | | Signed-off-by: jld3103 <jld3103yt@gmail.com>
* Allow stdClass in XML responsesjld31032023-06-131-1/+2
| | | | Signed-off-by: jld3103 <jld3103yt@gmail.com>
* chore(appframework)!: Drop ↵Christoph Wurst2023-06-123-37/+3
| | | | | | \OCP\AppFramework\Http\EmptyContentSecurityPolicy::allowInlineScript Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* fix(middleware): Also abort the request when reaching max delay in ↵Joas Schilling2023-05-151-7/+7
| | | | | | afterController Signed-off-by: Joas Schilling <coding@schilljs.com>
* feat(security): Add PHP \Attribute for remaining security annotationsJoas Schilling2023-04-258-250/+801
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* feat(ratelimit): Add Attributes support to rate limit middlewareJoas Schilling2023-04-241-103/+170
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Merge branch 'master' into enh/type-iconfig-getter-callsCôme Chilliet2023-04-201-8/+8
|\ | | | | Signed-off-by: Côme Chilliet <91878298+come-nc@users.noreply.github.com>
| * feat(app-framework): Add native argument types for middlewareChristoph Wurst2023-04-181-8/+8
| | | | | | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* | Adapt tests to config value typingCôme Chilliet2023-04-051-6/+6
|/ | | | Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
* Add a debug message when throttling without definingJoas Schilling2023-03-081-6/+33
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* feat(middleware): Migrate BruteForceProtection annotation to PHP Attribute ↵Joas Schilling2023-03-081-61/+168
| | | | | | and allow multiple Signed-off-by: Joas Schilling <coding@schilljs.com>
* feat(appframework): ⌚ Make ITimeFactory extend \PSR\Clock\ClockInterfaceJoas Schilling2023-03-031-0/+49
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Merge pull request #36396 from nextcloud/fix/corsJulius Härtl2023-02-171-1/+35
|\
| * fix(CORS): CORS should only be bypassed on `PublicPage` if not logged in to ↵Ferdinand Thiessen2023-02-161-1/+35
| | | | | | | | | | | | prevent CSRF attack vectors Signed-off-by: Ferdinand Thiessen <rpm@fthiessen.de>
* | Change X-Robots-Tag header from "none" to "noindex, nofollow"MichaIng2023-02-153-3/+3
| | | | | | | | | | | | | | | | | | | | While "none" is indeed equivalent to "noindex, nofollow" for Google, but seems to be not supported by Bing and probably other search engines. https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta/name#other_metadata_names https://developers.google.com/search/docs/crawling-indexing/robots-meta-tag?hl=de#comma-separated-list https://www.bing.com/webmasters/help/which-robots-metatags-does-bing-support-5198d240 Signed-off-by: MichaIng <micha@dietpi.com>
* | DI for RouterRobin Appelman2023-02-131-6/+46
|/ | | | Signed-off-by: Robin Appelman <robin@icewind.nl>
* fix: Throw `NotFoundExceptionInterface` to fulfill PSR container interface ↵Ferdinand Thiessen2023-02-061-3/+24
| | | | | | if class not found Signed-off-by: Ferdinand Thiessen <rpm@fthiessen.de>
* feat(app-framework): Add UseSession attribute to replace annotationChristoph Wurst2023-01-271-53/+100
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* feat(app-framework): Add support for global middlewaresChristoph Wurst2023-01-262-4/+36
| | | | | | | This allows apps to register middlewares that always register, not just for the app's own requests Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* perf(app-framework): Make the app middleware registration lazyChristoph Wurst2023-01-252-18/+47
| | | | | | | | | Before this patch, app middlewares were registered on the dispatcher for every app loaded in a Nextcloud process. With the patch, only middlewares belonging to the same app of a dispatcher instance are loaded. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* composer run cs:fixCôme Chilliet2023-01-2036-48/+9
| | | | Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
* feat(app framework)!: Inject services into controller methodsChristoph Wurst2023-01-181-10/+19
| | | | | | | | | | | | | | | Usually Nextcloud DI goes through constructor injection. This has the implication that each instance of a class builds the full DI tree. That is the injected services, their services, etc. Occasionally there is a service that is only needed for one controller method. Then the DI tree is build regardless if used or not. If services are injected into the method, we only build the DI tree if that method gets executed. This is also how Laravel allows injection. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Merge branch 'master' into add-scim-json-supportStanimir Bozhilov2022-12-196-528/+47
|\ | | | | Signed-off-by: Stanimir Bozhilov <stanimir.bozhilov.1998@gmail.com>
| * Merge pull request #35780 from ↵Vincent Petry2022-12-161-7/+14
| |\ | | | | | | | | | | | | nextcloud/fix/http-dispatcher-double-parameter-cast Fix missing cast of double controller parameters
| | * fix(app framework): Fix missing cast of double controller parametersChristoph Wurst2022-12-151-7/+14
| | | | | | | | | | | | | | | | | | ``settype`` allows 'double' as alias of 'float'. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
| * | check if params given to API are really an arrayArtur Neumann2022-12-151-2/+13
| |/ | | | | | | Signed-off-by: Artur Neumann <artur@jankaritech.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-28 07:09:00 +0000