aboutsummaryrefslogtreecommitdiffstats
path: root/tests/lib/AppFramework
Commit message (Collapse)AuthorAgeFilesLines
...
* fix(API): Use a distinct exception so apps can react to it and customize the ↵Joas Schilling2023-11-281-1/+2
| | | | | | return Signed-off-by: Joas Schilling <coding@schilljs.com>
* enh(dispatcher): enforce psalm ranges in the http dispatcherArthur Schiwon2023-11-242-0/+68
| | | | | | - allows devs to provide int ranges for API arguments Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* chore: apply changes from Nextcloud coding standards 1.1.1Joas Schilling2023-11-234-11/+11
| | | | | Signed-off-by: Joas Schilling <coding@schilljs.com> Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
* fix(CSP): Only add `strict-dynamic` when using noncesFerdinand Thiessen2023-11-172-59/+59
| | | | Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
* fix!(ContentSecurityPolicy): Make `strict-dynamic` enabled by default on ↵Ferdinand Thiessen2023-11-171-76/+73
| | | | | | `script-src-elem` Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
* feat(ContentSecurityPolicy): Allow to set `strict-dynamic` on ↵Ferdinand Thiessen2023-11-172-0/+73
| | | | | | | | | `script-src-elem` only This adds the possibility to set `strict-dynamic` on `script-src-elem` only while keep the default rules for `script-src`. The idea is to allow loading module js which imports other files and thus does not allow nonces on import but on the initial script tag. Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
* Reverse X-Forwarded-For list to read the correct proxy remote addressJoas Schilling2023-11-161-6/+32
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* feat(dependencyinjection): Allow optional (nullable) servicesChristoph Wurst2023-11-031-0/+24
| | | | | | Allows working with classes that might or might not be available. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Merge pull request #39852 from nextcloud/pragmaHeaderFerdinand Thiessen2023-10-181-2/+0
|\ | | | | Stop sending deprecated Pragma header
| * Stop sending deprecated Pragma headerGit'Fellow2023-08-281-2/+0
| | | | | | | | Signed-off-by: Git'Fellow <12234510+solracsf@users.noreply.github.com>
* | techdebt(DI): Use public IThrottler interface which exists since Nextcloud 25Joas Schilling2023-08-283-10/+11
|/ | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Allow "wasm-unsafe-eval" in CSPDaniel Calviño Sánchez2023-08-102-0/+14
| | | | | | | | | | | | | | | | | | If a page has a Content Security Policy header and the `script-src` (or `default-src`) directive does not contain neither `wasm-unsafe-eval` nor `unsafe-eval` loading and executing WebAssembly is blocked in the page (although it is still possible to load and execute WebAssembly in a worker thread). Although the Nextcloud classes to manage the CSP already supported allowing `unsafe-eval` this affects not only WebAssembly, but also the `eval` operation in JavaScript. To make possible to allow WebAssembly execution without allowing JavaScript `eval` this commit adds support for allowing `wasm-unsafe-eval`. Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
* fix!: Remove legacy event dispatching Symfony's GenericEvent from ↵Joas Schilling2023-07-271-41/+0
| | | | | | AdditionalScripts Signed-off-by: Joas Schilling <coding@schilljs.com>
* feat(request): Allow to match the client version with the ↵Joas Schilling2023-07-111-0/+57
| | | | | | IRequest::USER_AGENT_* regex Signed-off-by: Joas Schilling <coding@schilljs.com>
* Add template types to responsesjld31032023-06-301-1/+4
| | | | Signed-off-by: jld3103 <jld3103yt@gmail.com>
* Allow stdClass in XML responsesjld31032023-06-131-1/+2
| | | | Signed-off-by: jld3103 <jld3103yt@gmail.com>
* chore(appframework)!: Drop ↵Christoph Wurst2023-06-123-37/+3
| | | | | | \OCP\AppFramework\Http\EmptyContentSecurityPolicy::allowInlineScript Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* fix(middleware): Also abort the request when reaching max delay in ↵Joas Schilling2023-05-151-7/+7
| | | | | | afterController Signed-off-by: Joas Schilling <coding@schilljs.com>
* feat(security): Add PHP \Attribute for remaining security annotationsJoas Schilling2023-04-258-250/+801
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* feat(ratelimit): Add Attributes support to rate limit middlewareJoas Schilling2023-04-241-103/+170
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Merge branch 'master' into enh/type-iconfig-getter-callsCôme Chilliet2023-04-201-8/+8
|\ | | | | Signed-off-by: Côme Chilliet <91878298+come-nc@users.noreply.github.com>
| * feat(app-framework): Add native argument types for middlewareChristoph Wurst2023-04-181-8/+8
| | | | | | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* | Adapt tests to config value typingCôme Chilliet2023-04-051-6/+6
|/ | | | Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
* Add a debug message when throttling without definingJoas Schilling2023-03-081-6/+33
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* feat(middleware): Migrate BruteForceProtection annotation to PHP Attribute ↵Joas Schilling2023-03-081-61/+168
| | | | | | and allow multiple Signed-off-by: Joas Schilling <coding@schilljs.com>
* feat(appframework): ⌚ Make ITimeFactory extend \PSR\Clock\ClockInterfaceJoas Schilling2023-03-031-0/+49
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Merge pull request #36396 from nextcloud/fix/corsJulius Härtl2023-02-171-1/+35
|\
| * fix(CORS): CORS should only be bypassed on `PublicPage` if not logged in to ↵Ferdinand Thiessen2023-02-161-1/+35
| | | | | | | | | | | | prevent CSRF attack vectors Signed-off-by: Ferdinand Thiessen <rpm@fthiessen.de>
* | Change X-Robots-Tag header from "none" to "noindex, nofollow"MichaIng2023-02-153-3/+3
| | | | | | | | | | | | | | | | | | | | While "none" is indeed equivalent to "noindex, nofollow" for Google, but seems to be not supported by Bing and probably other search engines. https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta/name#other_metadata_names https://developers.google.com/search/docs/crawling-indexing/robots-meta-tag?hl=de#comma-separated-list https://www.bing.com/webmasters/help/which-robots-metatags-does-bing-support-5198d240 Signed-off-by: MichaIng <micha@dietpi.com>
* | DI for RouterRobin Appelman2023-02-131-6/+46
|/ | | | Signed-off-by: Robin Appelman <robin@icewind.nl>
* fix: Throw `NotFoundExceptionInterface` to fulfill PSR container interface ↵Ferdinand Thiessen2023-02-061-3/+24
| | | | | | if class not found Signed-off-by: Ferdinand Thiessen <rpm@fthiessen.de>
* feat(app-framework): Add UseSession attribute to replace annotationChristoph Wurst2023-01-271-53/+100
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* feat(app-framework): Add support for global middlewaresChristoph Wurst2023-01-262-4/+36
| | | | | | | This allows apps to register middlewares that always register, not just for the app's own requests Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* perf(app-framework): Make the app middleware registration lazyChristoph Wurst2023-01-252-18/+47
| | | | | | | | | Before this patch, app middlewares were registered on the dispatcher for every app loaded in a Nextcloud process. With the patch, only middlewares belonging to the same app of a dispatcher instance are loaded. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* composer run cs:fixCôme Chilliet2023-01-2036-48/+9
| | | | Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
* feat(app framework)!: Inject services into controller methodsChristoph Wurst2023-01-181-10/+19
| | | | | | | | | | | | | | | Usually Nextcloud DI goes through constructor injection. This has the implication that each instance of a class builds the full DI tree. That is the injected services, their services, etc. Occasionally there is a service that is only needed for one controller method. Then the DI tree is build regardless if used or not. If services are injected into the method, we only build the DI tree if that method gets executed. This is also how Laravel allows injection. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Merge branch 'master' into add-scim-json-supportStanimir Bozhilov2022-12-196-528/+47
|\ | | | | Signed-off-by: Stanimir Bozhilov <stanimir.bozhilov.1998@gmail.com>
| * Merge pull request #35780 from ↵Vincent Petry2022-12-161-7/+14
| |\ | | | | | | | | | | | | nextcloud/fix/http-dispatcher-double-parameter-cast Fix missing cast of double controller parameters
| | * fix(app framework): Fix missing cast of double controller parametersChristoph Wurst2022-12-151-7/+14
| | | | | | | | | | | | | | | | | | ``settype`` allows 'double' as alias of 'float'. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
| * | check if params given to API are really an arrayArtur Neumann2022-12-151-2/+13
| |/ | | | | | | Signed-off-by: Artur Neumann <artur@jankaritech.com>
| * use bruteforce protection on all methods wrapped by PublicShareMiddlewareJulien Veyssier2022-12-071-1/+6
| | | | | | | | | | | | if an invalid token is provided or when share password is wrong Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
| * Fix some more problems with tests under PHP 8.2Côme Chilliet2022-11-151-12/+14
| | | | | | | | Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
| * Remove long depreated AppFramework/Db/MapperRoeland Jago Douma2022-10-102-506/+0
| | | | | | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* | Fix the JSON content type regex to match all MIME typesStanimir Bozhilov2022-09-261-0/+91
| | | | | | | | Signed-off-by: Stanimir Bozhilov <stanimir@audriga.com>
* | Add unit tests for application/scim+json content typeStanimir Bozhilov2022-09-201-0/+92
|/ | | | Signed-off-by: Stanimir Bozhilov <stanimir@audriga.com>
* Fix SessionMiddlewareTest and cover new case with reopeningJulius Härtl2022-08-241-3/+17
| | | | Signed-off-by: Julius Härtl <jus@bitgrid.net>
* Support specifying IPv6 proxies in CIDR notationSimon Leiner2022-08-021-0/+77
| | | | | | | | | | Previously, it was not possible to use CIDR notation for IPv6 proxies in the trusted_proxies parameter of config.php [1]. This patch adds support for that. [1]: https://docs.nextcloud.com/server/24/admin_manual/configuration_server/reverse_proxy_configuration.html#defining-trusted-proxies Signed-off-by: Simon Leiner <simon@leiner.me>
* Fix reading blob data as resourceThomas Citharel2022-07-251-0/+17
| | | | | | | | | | | | | | | | PostgreSQL returns data as resource when using IQueryBuilder::PARAM_LOB (which is used for QBMapper). Previously we just converted this resource using settype, which produced things like "Resource id #14" instead of the actual resource data. Now we read the stream correctly if the returned data is a resource See context at #22472 Fixes #22439 Signed-off-by: Thomas Citharel <tcit@tcit.fr>
* Fix PHP 8.2 warnings about undeclared propertiesCôme Chilliet2022-06-211-0/+2
| | | | Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
* Remove at matcher uses in tests/libCôme Chilliet2022-06-162-154/+109
| | | | Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-01 20:29:48 +0000