summaryrefslogtreecommitdiffstats
path: root/tests/lib/AppFramework
Commit message (Collapse)AuthorAgeFilesLines
* Add testsRoeland Jago Douma2019-08-103-0/+355
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Add feature policy headerRoeland Jago Douma2019-08-103-1/+4
| | | | | | | This adds the events and the classes to modify the feature policy. It also adds a default restricted feature policy. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Update CSP test cases to handle the new form-actionRoeland Jago Douma2019-07-311-58/+58
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Split up security middlewareRoeland Jago Douma2019-07-272-97/+149
| | | | | | | | | | With upcoming work for the feature policy header. Splitting this in smaller classes that just do 1 thing makes sense. I rather have a few small classes that are tiny and do 1 thing right (and we all understand what is going on) than have big ones. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Merge pull request #15714 from nextcloud/fix/204_304_rfcRoeland Jago Douma2019-05-241-10/+9
|\ | | | | Check the actual status code for 204 and 304
| * Check the actual status code for 204 and 304Roeland Jago Douma2019-05-241-10/+9
| | | | | | | | | | | | | | | | | | | | The header is the full http header like: HTTP/1.1 304 Not Modified So comparing this to an int always yields false This also makes the 304 RFC compliant as the resulting content length should otherwise be the length of the message and not 0. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl> Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* | Make it possible to show admin settings for sub adminsChristoph Wurst2019-05-231-16/+47
|/ | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Set empty CSP by defaultRoeland Jago Douma2019-04-163-4/+4
| | | | | | | | | For #14179 By default responses should have the strictest (and simplest) CSP possible. Only template responses should require an actual CSP. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* [#11236] Set parameter type in QBMapperMarius David Wieschollek2019-03-241-0/+241
| | | | Signed-off-by: Marius David Wieschollek <git.public@mdns.eu>
* Add StandaloneTemplateResponseRoeland Jago Douma2019-02-061-0/+17
| | | | | | | This can be used by pages that do not have the full Nextcloud UI. So notifications etc do not load there. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* No need to emit additonalscript event on public pagesRoeland Jago Douma2019-02-051-0/+10
| | | | | | | There already is a separate event for this. This will make it possible to only inject code with the logged in one on default rendered pages. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Emit to load additionalscriptsRoeland Jago Douma2019-01-311-0/+108
| | | | | | | | | | | | | Fixes #13662 This will fire of an event after a Template Response has been returned. There is an event for the generic loading and one when logged in. So apps can chose to load only on loged in pages. This is a more generic approach than the files app event. As some things we might want to load on other pages as well besides the files app. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Allow resources via OCS as wellJoas Schilling2019-01-221-0/+85
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Set default frame-ancestors to 'self'Roeland Jago Douma2019-01-084-61/+61
| | | | | | For #13042 Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* CSP: Allow fonts to be provided in dataRoeland Jago Douma2019-01-074-62/+62
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Cleanup middleware registeringRoeland Jago Douma2019-01-031-9/+10
| | | | | | | | | Fixes #12224 Since we only use the middleware at 1 location it makes no sense to register them in each and every container. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Only trust the X-FORWARDED-HOST header for trusted proxiesRoeland Jago Douma2018-12-171-53/+90
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Fix testsRoeland Jago Douma2018-11-022-17/+7
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Adding handling of CIDR notation to trusted_proxies for IPv4Oliver Wegner2018-10-301-0/+115
| | | | Signed-off-by: Oliver Wegner <void1976@gmail.com>
* Add report-uri to CSPRoeland Jago Douma2018-10-211-0/+15
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Disallow unsafe-eval by defaultRoeland Jago Douma2018-10-144-60/+67
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Do not use file as template parameterRoeland Jago Douma2018-08-091-1/+1
| | | | | | | | Using file will overwrite the $file parameter in the template base. Leading to trying to include a file that is the exception message. Which will of course fail. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Fix direct access to authen pageRoeland Jago Douma2018-06-201-0/+2
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Add AuthPublicShareControllerTestRoeland Jago Douma2018-06-201-0/+157
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Add PublicShareControllerTestsRoeland Jago Douma2018-06-201-0/+102
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Add PublicShareMiddlewareTestRoeland Jago Douma2018-06-201-0/+287
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Move caching logic to responseRoeland Jago Douma2018-06-041-2/+12
| | | | | | | | | | This avoids having to do it at all the places we want cached responses. We can't inject the ITimeFactor without breaking public API. However we can perfectly overwrite the service (resulting in the same testable effect). Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Merge pull request #8593 from eneiluj/masterMorris Jobke2018-03-081-10/+78
|\ | | | | Allow public page access to apps with group restrictions
| * Add testsRoeland Jago Douma2018-03-081-10/+78
| | | | | | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* | Remove testcaseRoeland Jago Douma2018-03-051-1/+0
|/ | | | | | | Since a token now always requires a string we don't need to test for null Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Add test for PublicTemplateResponseJulius Härtl2018-02-271-0/+84
| | | | Signed-off-by: Julius Härtl <jus@bitgrid.net>
* Merge pull request #8541 from nextcloud/translate-permission-error-pageMorris Jobke2018-02-261-7/+7
|\ | | | | Provide translated error message for permission error
| * Provide translated error message for permission errorMorris Jobke2018-02-261-7/+7
| | | | | | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* | Fix proper typesRoeland Jago Douma2018-02-221-1/+1
|/ | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Fix testsRoeland Jago Douma2018-02-212-12/+18
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Update testsRoeland Jago Douma2018-01-291-8/+20
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Fix risky tests without assertionsJoas Schilling2018-01-253-4/+7
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Fix "Undefined method setExpectedException()"Joas Schilling2018-01-246-24/+25
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Properly log the full exception instead of only the messageMorris Jobke2018-01-231-4/+2
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Remove not needed 3rdparty app disabling during upgrade for PHP 5.xMorris Jobke2018-01-191-1/+0
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Remove deprecated core APIJoas Schilling2018-01-152-24/+3
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Move passwordconfirmation to its own midlewareRoeland Jago Douma2018-01-022-10/+130
| | | | | | Add tests Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* disable password confirmation with SSOBjoern Schiessle2018-01-021-1/+10
| | | | Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
* allow 'Nextcloud' in the user agent string of AndroidBjoern Schiessle2017-12-121-0/+14
| | | | Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
* Merge pull request #6921 from nextcloud/appmanager-securitymiddlewareRoeland Jago Douma2017-10-241-1/+9
|\ | | | | Use proper DI for security middleware for app enabled check
| * Use proper DI for security middleware for app enabled checkMorris Jobke2017-10-241-1/+9
| | | | | | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* | Use ::class in test mocksMorris Jobke2017-10-248-17/+24
|/ | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Handle SameSiteCookie check for index.php in AppFramework MiddlewareRoeland Jago Douma2017-09-242-2/+145
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Add CSP frame-ancestors supportThomas Citharel2017-09-151-0/+41
| | | | | | Didn't set the @since annotation yet. Signed-off-by: Thomas Citharel <tcit@tcit.fr>
* Remove explicit type hints for ControllerLukas Reschke2017-08-011-4/+4
| | | | | | This is public API and breaks the middlewares of existing apps. Since this also requires maintaining two different code paths for 12 and 13 I'm at the moment voting for reverting this change. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-30 23:18:03 +0000