aboutsummaryrefslogtreecommitdiffstats
path: root/tests/lib/appframework/middleware/security/SecurityMiddlewareTest.php
Commit message (Collapse)AuthorAgeFilesLines
* Move tests/ to PSR-4 (#24731)Joas Schilling2016-05-201-453/+0
| | | | | | | | | | | | | | | | | | | | * Move a-b to PSR-4 * Move c-d to PSR-4 * Move e+g to PSR-4 * Move h-l to PSR-4 * Move m-r to PSR-4 * Move s-u to PSR-4 * Move files/ to PSR-4 * Move remaining tests to PSR-4 * Remove Test\ from old autoloader
* Fix namespaces in AppFramework testsJoas Schilling2016-05-181-1/+2
|
* Fix inconsistent nameing of AppFrameworkRoeland Jago Douma2016-04-221-4/+4
|
* Move login form into controllerLukas Reschke2016-04-151-4/+9
| | | | First step on getting the authorisation stuff cleaned up. This is only for the login form, all other stuff is still where it is.
* Add public API to give developers the possibility to adjust the global CSP ↵Lukas Reschke2016-01-281-2/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | defaults Allows to inject something into the default content policy. This is for example useful when you're injecting Javascript code into a view belonging to another controller and cannot modify its Content-Security-Policy itself. Note that the adjustment is only applied to applications that use AppFramework controllers. To use this from your `app.php` use `\OC::$server->getContentSecurityPolicyManager()->addDefaultPolicy($policy)`, $policy has to be of type `\OCP\AppFramework\Http\ContentSecurityPolicy`. To test this add something like the following into an `app.php` of any enabled app: ``` $manager = \OC::$server->getContentSecurityPolicyManager(); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFrameDomain('asdf'); $policy->addAllowedScriptDomain('yolo.com'); $policy->allowInlineScript(false); $manager->addDefaultPolicy($policy); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFontDomain('yolo.com'); $manager->addDefaultPolicy($policy); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFrameDomain('banana.com'); $manager->addDefaultPolicy($policy); ``` If you now open the files app the policy should be: ``` Content-Security-Policy:default-src 'none';script-src yolo.com 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src yolo.com 'self';connect-src 'self';media-src 'self';frame-src asdf banana.com 'self' ```
* Show error templateLukas Reschke2015-11-301-32/+102
| | | | Otherwise this leads to an endless redirection in case of a CSRF exception. Also sets user expectation right.
* Remove dependency on ICrypto + use XORLukas Reschke2015-10-211-1/+0
|
* Add mitigation against BREACHLukas Reschke2015-08-141-0/+1
| | | | | | | | | | | | While BREACH requires the following three factors to be effectively exploitable we should add another mitigation: 1. Application must support HTTP compression 2. Response most reflect user-controlled input 3. Response should contain sensitive data Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed. To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.
* Refactor OC_Request into TrustedDomainHelper and IRequestLukas Reschke2015-02-161-1/+2
| | | | | | | | | | This changeset removes the static class `OC_Request` and moves the functions either into `IRequest` which is accessible via `\OC::$server::->getRequest()` or into a separated `TrustedDomainHelper` class for some helper methods which should not be publicly exposed. This changes only internal methods and nothing on the public API. Some public functions in `util.php` have been deprecated though in favour of the new non-static functions. Unfortunately some part of this code uses things like `__DIR__` and thus is not completely unit-testable. Where tests where possible they ahve been added though. Fixes https://github.com/owncloud/core/issues/13976 which was requested in https://github.com/owncloud/core/pull/13973#issuecomment-73492969
* Respect `mod_unique_id` and refactor `OC_Request::getRequestId`Lukas Reschke2015-02-091-4/+8
| | | | | | | | | | | | | | When `mod_unique_id` is enabled the ID generated by it will be used for logging. This allows for correlation of the Apache logs and the ownCloud logs. Testplan: - [ ] When `mod_unique_id` is enabled the request ID equals the one generated by `mod_unique_id`. - [ ] When `mod_unique_id` is not available the request ID is a 20 character long random string - [ ] The generated Id is stable over the lifespan of one request Changeset looks a little bit larger since I had to adjust every unit test using the HTTP\Request class for proper DI. Fixes https://github.com/owncloud/core/issues/13366
* Make remaining files extend the test baseJoas Schilling2014-11-191-2/+4
|
* Check if app is enabled for userLukas Reschke2014-11-151-2/+2
| | | | Fixes https://github.com/owncloud/core/issues/12188 for AppFramework apps
* fix redirect URL unit testMorris Jobke2014-07-021-1/+3
|
* fix assertionsBernhard Posselt2014-05-281-9/+14
|
* fix 8757, get rid of service locator antipatternBernhard Posselt2014-05-281-97/+79
|
* adjust license headers to new mail addressBernhard Posselt2014-05-111-1/+1
|
* implement most of the basic stuff that was suggested in #8290Bernhard Posselt2014-05-111-11/+22
|
* make download and redirectresponse publicBernhard Posselt2014-04-201-1/+1
|
* Scrutinizer Auto-FixesScrutinizer Auto-Fixer2014-02-191-0/+11
| | | | | | | | | | | This patch was automatically generated as part of the following inspection: https://scrutinizer-ci.com/g/owncloud/core/inspections/cdfecc4e-a37e-4233-8025-f0d7252a8720 Enabled analysis tools: - PHP Analyzer - JSHint - PHP Copy/Paste Detector - PHP PDepend
* Fix namespace for OCP\Appframework\HttpThomas Tanghus2013-10-231-1/+1
| | | | | To avoid having to use OCP\Appframework\Http\Http in the public - and stable - API OCP\Appframework\Http is now both a class and a namespace.
* re-enable test in SecurityMiddlewareTestThomas Müller2013-10-161-5/+0
|
* Merge branch 'master' into fixing-appframework-masterThomas Müller2013-10-161-0/+5
|\ | | | | | | | | | | Conflicts: lib/private/appframework/middleware/security/securitymiddleware.php tests/lib/appframework/middleware/security/SecurityMiddlewareTest.php
| * Get urlParams registered before Request is instantiatedThomas Tanghus2013-10-011-1/+7
| |
* | OCP\AppFramework\Controller\Controller => OCP\AppFramework\ControllerThomas Tanghus2013-10-111-2/+2
| |
* | fixing all appframework unit testsThomas Müller2013-10-071-18/+48
|/
* kill superfluent classloader from tests - this approach might be of interest ↵Thomas Müller2013-08-211-5/+1
| | | | within the apps
* reducing controller annotations to:Thomas Müller2013-08-201-122/+34
| | | | | | @PublicPage - No user logon is expected @NoAdminRequired - the login user requires no admin rights @NoCSRFRequired - the incoming request will not check for CSRF token
* initial import of appframeworkThomas Müller2013-08-171-0/+388
generated by cgit v1.2.3 (git 2.39.1) at 2025-07-02 22:23:28 +0000