nextcloud / server

lib/private/AppFramework/Http/Output.php

Indentation +58 added lines, -58 removed lines

@@ -30,70 +30,70 @@
  * Very thin wrapper class to make output testable
  */
 class Output implements IOutput {
-	/** @var string */
-	private $webRoot;
+    /** @var string */
+    private $webRoot;
 
-	/**
-	 * @param $webRoot
-	 */
-	public function __construct($webRoot) {
-		$this->webRoot = $webRoot;
-	}
+    /**
+     * @param $webRoot
+     */
+    public function __construct($webRoot) {
+        $this->webRoot = $webRoot;
+    }
 
-	/**
-	 * @param string $out
-	 */
-	public function setOutput($out) {
-		print($out);
-	}
+    /**
+     * @param string $out
+     */
+    public function setOutput($out) {
+        print($out);
+    }
 
-	/**
-	 * @param string|resource $path or file handle
-	 *
-	 * @return bool false if an error occurred
-	 */
-	public function setReadfile($path) {
-		if (is_resource($path)) {
-			$output = fopen('php://output', 'w');
-			return stream_copy_to_stream($path, $output) > 0;
-		} else {
-			return @readfile($path);
-		}
-	}
+    /**
+     * @param string|resource $path or file handle
+     *
+     * @return bool false if an error occurred
+     */
+    public function setReadfile($path) {
+        if (is_resource($path)) {
+            $output = fopen('php://output', 'w');
+            return stream_copy_to_stream($path, $output) > 0;
+        } else {
+            return @readfile($path);
+        }
+    }
 
-	/**
-	 * @param string $header
-	 */
-	public function setHeader($header) {
-		header($header);
-	}
+    /**
+     * @param string $header
+     */
+    public function setHeader($header) {
+        header($header);
+    }
 
-	/**
-	 * @param int $code sets the http status code
-	 */
-	public function setHttpResponseCode($code) {
-		http_response_code($code);
-	}
+    /**
+     * @param int $code sets the http status code
+     */
+    public function setHttpResponseCode($code) {
+        http_response_code($code);
+    }
 
-	/**
-	 * @return int returns the current http response code
-	 */
-	public function getHttpResponseCode() {
-		return http_response_code();
-	}
+    /**
+     * @return int returns the current http response code
+     */
+    public function getHttpResponseCode() {
+        return http_response_code();
+    }
 
-	/**
-	 * @param string $name
-	 * @param string $value
-	 * @param int $expire
-	 * @param string $path
-	 * @param string $domain
-	 * @param bool $secure
-	 * @param bool $httpOnly
-	 */
-	public function setCookie($name, $value, $expire, $path, $domain, $secure, $httpOnly) {
-		$path = $this->webRoot ? : '/';
-		setcookie($name, $value, $expire, $path, $domain, $secure, $httpOnly);
-	}
+    /**
+     * @param string $name
+     * @param string $value
+     * @param int $expire
+     * @param string $path
+     * @param string $domain
+     * @param bool $secure
+     * @param bool $httpOnly
+     */
+    public function setCookie($name, $value, $expire, $path, $domain, $secure, $httpOnly) {
+        $path = $this->webRoot ? : '/';
+        setcookie($name, $value, $expire, $path, $domain, $secure, $httpOnly);
+    }
 
 }

Spacing +1 added lines, -1 removed lines

@@ -92,7 +92,7 @@
 	 * @param bool $httpOnly
 	 */
 	public function setCookie($name, $value, $expire, $path, $domain, $secure, $httpOnly) {
-		$path = $this->webRoot ? : '/';
+		$path = $this->webRoot ?: '/';
 		setcookie($name, $value, $expire, $path, $domain, $secure, $httpOnly);
 	}
 

lib/private/AppFramework/Http.php

Spacing +7 added lines, -7 removed lines

@@ -41,7 +41,7 @@ 
 	 * @param array $server $_SERVER
 	 * @param string $protocolVersion the http version to use defaults to HTTP/1.1
 	 */
-	public function __construct($server, $protocolVersion='HTTP/1.1') {
+	public function __construct($server, $protocolVersion = 'HTTP/1.1') {
 		$this->server = $server;
 		$this->protocolVersion = $protocolVersion;
 
@@ -116,16 +116,16 @@ 
 	 * @param string $ETag the etag
 	 * @return string
 	 */
-	public function getStatusHeader($status, \DateTime $lastModified=null, 
-	                                $ETag=null) {
+	public function getStatusHeader($status, \DateTime $lastModified = null, 
+	                                $ETag = null) {
 
-		if(!is_null($lastModified)) {
+		if (!is_null($lastModified)) {
 			$lastModified = $lastModified->format(\DateTime::RFC2822);
 		}
 
 		// if etag or lastmodified have not changed, return a not modified
 		if ((isset($this->server['HTTP_IF_NONE_MATCH'])
-			&& trim(trim($this->server['HTTP_IF_NONE_MATCH']), '"') === (string)$ETag)
+			&& trim(trim($this->server['HTTP_IF_NONE_MATCH']), '"') === (string) $ETag)
 
 			||
 
@@ -139,13 +139,13 @@ 
 		// we have one change currently for the http 1.0 header that differs
 		// from 1.1: STATUS_TEMPORARY_REDIRECT should be STATUS_FOUND
 		// if this differs any more, we want to create childclasses for this
-		if($status === self::STATUS_TEMPORARY_REDIRECT 
+		if ($status === self::STATUS_TEMPORARY_REDIRECT 
 			&& $this->protocolVersion === 'HTTP/1.0') {
 
 			$status = self::STATUS_FOUND;
 		}
 
-		return $this->protocolVersion . ' ' . $status . ' ' . 
+		return $this->protocolVersion.' '.$status.' '. 
 			$this->headers[$status];
 	}
 

Indentation +115 added lines, -115 removed lines

@@ -33,121 +33,121 @@
 
 class Http extends BaseHttp {
 
-	private $server;
-	private $protocolVersion;
-	protected $headers;
-
-	/**
-	 * @param array $server $_SERVER
-	 * @param string $protocolVersion the http version to use defaults to HTTP/1.1
-	 */
-	public function __construct($server, $protocolVersion='HTTP/1.1') {
-		$this->server = $server;
-		$this->protocolVersion = $protocolVersion;
-
-		$this->headers = array(
-			self::STATUS_CONTINUE => 'Continue',
-			self::STATUS_SWITCHING_PROTOCOLS => 'Switching Protocols',
-			self::STATUS_PROCESSING => 'Processing',
-			self::STATUS_OK => 'OK',
-			self::STATUS_CREATED => 'Created',
-			self::STATUS_ACCEPTED => 'Accepted',
-			self::STATUS_NON_AUTHORATIVE_INFORMATION => 'Non-Authorative Information',
-			self::STATUS_NO_CONTENT => 'No Content',
-			self::STATUS_RESET_CONTENT => 'Reset Content',
-			self::STATUS_PARTIAL_CONTENT => 'Partial Content',
-			self::STATUS_MULTI_STATUS => 'Multi-Status', // RFC 4918
-			self::STATUS_ALREADY_REPORTED => 'Already Reported', // RFC 5842
-			self::STATUS_IM_USED => 'IM Used', // RFC 3229
-			self::STATUS_MULTIPLE_CHOICES => 'Multiple Choices',
-			self::STATUS_MOVED_PERMANENTLY => 'Moved Permanently',
-			self::STATUS_FOUND => 'Found',
-			self::STATUS_SEE_OTHER => 'See Other',
-			self::STATUS_NOT_MODIFIED => 'Not Modified',
-			self::STATUS_USE_PROXY => 'Use Proxy',
-			self::STATUS_RESERVED => 'Reserved',
-			self::STATUS_TEMPORARY_REDIRECT => 'Temporary Redirect',
-			self::STATUS_BAD_REQUEST => 'Bad request',
-			self::STATUS_UNAUTHORIZED => 'Unauthorized',
-			self::STATUS_PAYMENT_REQUIRED => 'Payment Required',
-			self::STATUS_FORBIDDEN => 'Forbidden',
-			self::STATUS_NOT_FOUND => 'Not Found',
-			self::STATUS_METHOD_NOT_ALLOWED => 'Method Not Allowed',
-			self::STATUS_NOT_ACCEPTABLE => 'Not Acceptable',
-			self::STATUS_PROXY_AUTHENTICATION_REQUIRED => 'Proxy Authentication Required',
-			self::STATUS_REQUEST_TIMEOUT => 'Request Timeout',
-			self::STATUS_CONFLICT => 'Conflict',
-			self::STATUS_GONE => 'Gone',
-			self::STATUS_LENGTH_REQUIRED => 'Length Required',
-			self::STATUS_PRECONDITION_FAILED => 'Precondition failed',
-			self::STATUS_REQUEST_ENTITY_TOO_LARGE => 'Request Entity Too Large',
-			self::STATUS_REQUEST_URI_TOO_LONG => 'Request-URI Too Long',
-			self::STATUS_UNSUPPORTED_MEDIA_TYPE => 'Unsupported Media Type',
-			self::STATUS_REQUEST_RANGE_NOT_SATISFIABLE => 'Requested Range Not Satisfiable',
-			self::STATUS_EXPECTATION_FAILED => 'Expectation Failed',
-			self::STATUS_IM_A_TEAPOT => 'I\'m a teapot', // RFC 2324
-			self::STATUS_UNPROCESSABLE_ENTITY => 'Unprocessable Entity', // RFC 4918
-			self::STATUS_LOCKED => 'Locked', // RFC 4918
-			self::STATUS_FAILED_DEPENDENCY => 'Failed Dependency', // RFC 4918
-			self::STATUS_UPGRADE_REQUIRED => 'Upgrade required',
-			self::STATUS_PRECONDITION_REQUIRED => 'Precondition required', // draft-nottingham-http-new-status
-			self::STATUS_TOO_MANY_REQUESTS => 'Too Many Requests', // draft-nottingham-http-new-status
-			self::STATUS_REQUEST_HEADER_FIELDS_TOO_LARGE => 'Request Header Fields Too Large', // draft-nottingham-http-new-status
-			self::STATUS_INTERNAL_SERVER_ERROR => 'Internal Server Error',
-			self::STATUS_NOT_IMPLEMENTED => 'Not Implemented',
-			self::STATUS_BAD_GATEWAY => 'Bad Gateway',
-			self::STATUS_SERVICE_UNAVAILABLE => 'Service Unavailable',
-			self::STATUS_GATEWAY_TIMEOUT => 'Gateway Timeout',
-			self::STATUS_HTTP_VERSION_NOT_SUPPORTED => 'HTTP Version not supported',
-			self::STATUS_VARIANT_ALSO_NEGOTIATES => 'Variant Also Negotiates',
-			self::STATUS_INSUFFICIENT_STORAGE => 'Insufficient Storage', // RFC 4918
-			self::STATUS_LOOP_DETECTED => 'Loop Detected', // RFC 5842
-			self::STATUS_BANDWIDTH_LIMIT_EXCEEDED => 'Bandwidth Limit Exceeded', // non-standard
-			self::STATUS_NOT_EXTENDED => 'Not extended',
-			self::STATUS_NETWORK_AUTHENTICATION_REQUIRED => 'Network Authentication Required', // draft-nottingham-http-new-status
-		);
-	}
-
-
-	/**
-	 * Gets the correct header
-	 * @param int Http::CONSTANT $status the constant from the Http class
-	 * @param \DateTime $lastModified formatted last modified date
-	 * @param string $ETag the etag
-	 * @return string
-	 */
-	public function getStatusHeader($status, \DateTime $lastModified=null, 
-	                                $ETag=null) {
-
-		if(!is_null($lastModified)) {
-			$lastModified = $lastModified->format(\DateTime::RFC2822);
-		}
-
-		// if etag or lastmodified have not changed, return a not modified
-		if ((isset($this->server['HTTP_IF_NONE_MATCH'])
-			&& trim(trim($this->server['HTTP_IF_NONE_MATCH']), '"') === (string)$ETag)
-
-			||
-
-			(isset($this->server['HTTP_IF_MODIFIED_SINCE'])
-			&& trim($this->server['HTTP_IF_MODIFIED_SINCE']) === 
-				$lastModified)) {
-
-			$status = self::STATUS_NOT_MODIFIED;
-		}
-
-		// we have one change currently for the http 1.0 header that differs
-		// from 1.1: STATUS_TEMPORARY_REDIRECT should be STATUS_FOUND
-		// if this differs any more, we want to create childclasses for this
-		if($status === self::STATUS_TEMPORARY_REDIRECT 
-			&& $this->protocolVersion === 'HTTP/1.0') {
-
-			$status = self::STATUS_FOUND;
-		}
-
-		return $this->protocolVersion . ' ' . $status . ' ' . 
-			$this->headers[$status];
-	}
+    private $server;
+    private $protocolVersion;
+    protected $headers;
+
+    /**
+     * @param array $server $_SERVER
+     * @param string $protocolVersion the http version to use defaults to HTTP/1.1
+     */
+    public function __construct($server, $protocolVersion='HTTP/1.1') {
+        $this->server = $server;
+        $this->protocolVersion = $protocolVersion;
+
+        $this->headers = array(
+            self::STATUS_CONTINUE => 'Continue',
+            self::STATUS_SWITCHING_PROTOCOLS => 'Switching Protocols',
+            self::STATUS_PROCESSING => 'Processing',
+            self::STATUS_OK => 'OK',
+            self::STATUS_CREATED => 'Created',
+            self::STATUS_ACCEPTED => 'Accepted',
+            self::STATUS_NON_AUTHORATIVE_INFORMATION => 'Non-Authorative Information',
+            self::STATUS_NO_CONTENT => 'No Content',
+            self::STATUS_RESET_CONTENT => 'Reset Content',
+            self::STATUS_PARTIAL_CONTENT => 'Partial Content',
+            self::STATUS_MULTI_STATUS => 'Multi-Status', // RFC 4918
+            self::STATUS_ALREADY_REPORTED => 'Already Reported', // RFC 5842
+            self::STATUS_IM_USED => 'IM Used', // RFC 3229
+            self::STATUS_MULTIPLE_CHOICES => 'Multiple Choices',
+            self::STATUS_MOVED_PERMANENTLY => 'Moved Permanently',
+            self::STATUS_FOUND => 'Found',
+            self::STATUS_SEE_OTHER => 'See Other',
+            self::STATUS_NOT_MODIFIED => 'Not Modified',
+            self::STATUS_USE_PROXY => 'Use Proxy',
+            self::STATUS_RESERVED => 'Reserved',
+            self::STATUS_TEMPORARY_REDIRECT => 'Temporary Redirect',
+            self::STATUS_BAD_REQUEST => 'Bad request',
+            self::STATUS_UNAUTHORIZED => 'Unauthorized',
+            self::STATUS_PAYMENT_REQUIRED => 'Payment Required',
+            self::STATUS_FORBIDDEN => 'Forbidden',
+            self::STATUS_NOT_FOUND => 'Not Found',
+            self::STATUS_METHOD_NOT_ALLOWED => 'Method Not Allowed',
+            self::STATUS_NOT_ACCEPTABLE => 'Not Acceptable',
+            self::STATUS_PROXY_AUTHENTICATION_REQUIRED => 'Proxy Authentication Required',
+            self::STATUS_REQUEST_TIMEOUT => 'Request Timeout',
+            self::STATUS_CONFLICT => 'Conflict',
+            self::STATUS_GONE => 'Gone',
+            self::STATUS_LENGTH_REQUIRED => 'Length Required',
+            self::STATUS_PRECONDITION_FAILED => 'Precondition failed',
+            self::STATUS_REQUEST_ENTITY_TOO_LARGE => 'Request Entity Too Large',
+            self::STATUS_REQUEST_URI_TOO_LONG => 'Request-URI Too Long',
+            self::STATUS_UNSUPPORTED_MEDIA_TYPE => 'Unsupported Media Type',
+            self::STATUS_REQUEST_RANGE_NOT_SATISFIABLE => 'Requested Range Not Satisfiable',
+            self::STATUS_EXPECTATION_FAILED => 'Expectation Failed',
+            self::STATUS_IM_A_TEAPOT => 'I\'m a teapot', // RFC 2324
+            self::STATUS_UNPROCESSABLE_ENTITY => 'Unprocessable Entity', // RFC 4918
+            self::STATUS_LOCKED => 'Locked', // RFC 4918
+            self::STATUS_FAILED_DEPENDENCY => 'Failed Dependency', // RFC 4918
+            self::STATUS_UPGRADE_REQUIRED => 'Upgrade required',
+            self::STATUS_PRECONDITION_REQUIRED => 'Precondition required', // draft-nottingham-http-new-status
+            self::STATUS_TOO_MANY_REQUESTS => 'Too Many Requests', // draft-nottingham-http-new-status
+            self::STATUS_REQUEST_HEADER_FIELDS_TOO_LARGE => 'Request Header Fields Too Large', // draft-nottingham-http-new-status
+            self::STATUS_INTERNAL_SERVER_ERROR => 'Internal Server Error',
+            self::STATUS_NOT_IMPLEMENTED => 'Not Implemented',
+            self::STATUS_BAD_GATEWAY => 'Bad Gateway',
+            self::STATUS_SERVICE_UNAVAILABLE => 'Service Unavailable',
+            self::STATUS_GATEWAY_TIMEOUT => 'Gateway Timeout',
+            self::STATUS_HTTP_VERSION_NOT_SUPPORTED => 'HTTP Version not supported',
+            self::STATUS_VARIANT_ALSO_NEGOTIATES => 'Variant Also Negotiates',
+            self::STATUS_INSUFFICIENT_STORAGE => 'Insufficient Storage', // RFC 4918
+            self::STATUS_LOOP_DETECTED => 'Loop Detected', // RFC 5842
+            self::STATUS_BANDWIDTH_LIMIT_EXCEEDED => 'Bandwidth Limit Exceeded', // non-standard
+            self::STATUS_NOT_EXTENDED => 'Not extended',
+            self::STATUS_NETWORK_AUTHENTICATION_REQUIRED => 'Network Authentication Required', // draft-nottingham-http-new-status
+        );
+    }
+
+
+    /**
+     * Gets the correct header
+     * @param int Http::CONSTANT $status the constant from the Http class
+     * @param \DateTime $lastModified formatted last modified date
+     * @param string $ETag the etag
+     * @return string
+     */
+    public function getStatusHeader($status, \DateTime $lastModified=null, 
+                                    $ETag=null) {
+
+        if(!is_null($lastModified)) {
+            $lastModified = $lastModified->format(\DateTime::RFC2822);
+        }
+
+        // if etag or lastmodified have not changed, return a not modified
+        if ((isset($this->server['HTTP_IF_NONE_MATCH'])
+            && trim(trim($this->server['HTTP_IF_NONE_MATCH']), '"') === (string)$ETag)
+
+            ||
+
+            (isset($this->server['HTTP_IF_MODIFIED_SINCE'])
+            && trim($this->server['HTTP_IF_MODIFIED_SINCE']) === 
+                $lastModified)) {
+
+            $status = self::STATUS_NOT_MODIFIED;
+        }
+
+        // we have one change currently for the http 1.0 header that differs
+        // from 1.1: STATUS_TEMPORARY_REDIRECT should be STATUS_FOUND
+        // if this differs any more, we want to create childclasses for this
+        if($status === self::STATUS_TEMPORARY_REDIRECT 
+            && $this->protocolVersion === 'HTTP/1.0') {
+
+            $status = self::STATUS_FOUND;
+        }
+
+        return $this->protocolVersion . ' ' . $status . ' ' . 
+            $this->headers[$status];
+    }
 
 
 }

lib/private/AppFramework/Middleware/Security/CORSMiddleware.php

Indentation +102 added lines, -102 removed lines

@@ -45,116 +45,116 @@
  * https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS
  */
 class CORSMiddleware extends Middleware {
-	/** @var IRequest  */
-	private $request;
-	/** @var ControllerMethodReflector */
-	private $reflector;
-	/** @var Session */
-	private $session;
-	/** @var Throttler */
-	private $throttler;
+    /** @var IRequest  */
+    private $request;
+    /** @var ControllerMethodReflector */
+    private $reflector;
+    /** @var Session */
+    private $session;
+    /** @var Throttler */
+    private $throttler;
 
-	/**
-	 * @param IRequest $request
-	 * @param ControllerMethodReflector $reflector
-	 * @param Session $session
-	 * @param Throttler $throttler
-	 */
-	public function __construct(IRequest $request,
-								ControllerMethodReflector $reflector,
-								Session $session,
-								Throttler $throttler) {
-		$this->request = $request;
-		$this->reflector = $reflector;
-		$this->session = $session;
-		$this->throttler = $throttler;
-	}
+    /**
+     * @param IRequest $request
+     * @param ControllerMethodReflector $reflector
+     * @param Session $session
+     * @param Throttler $throttler
+     */
+    public function __construct(IRequest $request,
+                                ControllerMethodReflector $reflector,
+                                Session $session,
+                                Throttler $throttler) {
+        $this->request = $request;
+        $this->reflector = $reflector;
+        $this->session = $session;
+        $this->throttler = $throttler;
+    }
 
-	/**
-	 * This is being run in normal order before the controller is being
-	 * called which allows several modifications and checks
-	 *
-	 * @param Controller $controller the controller that is being called
-	 * @param string $methodName the name of the method that will be called on
-	 *                           the controller
-	 * @throws SecurityException
-	 * @since 6.0.0
-	 */
-	public function beforeController($controller, $methodName){
-		// ensure that @CORS annotated API routes are not used in conjunction
-		// with session authentication since this enables CSRF attack vectors
-		if ($this->reflector->hasAnnotation('CORS') &&
-			!$this->reflector->hasAnnotation('PublicPage'))  {
-			$user = $this->request->server['PHP_AUTH_USER'];
-			$pass = $this->request->server['PHP_AUTH_PW'];
+    /**
+     * This is being run in normal order before the controller is being
+     * called which allows several modifications and checks
+     *
+     * @param Controller $controller the controller that is being called
+     * @param string $methodName the name of the method that will be called on
+     *                           the controller
+     * @throws SecurityException
+     * @since 6.0.0
+     */
+    public function beforeController($controller, $methodName){
+        // ensure that @CORS annotated API routes are not used in conjunction
+        // with session authentication since this enables CSRF attack vectors
+        if ($this->reflector->hasAnnotation('CORS') &&
+            !$this->reflector->hasAnnotation('PublicPage'))  {
+            $user = $this->request->server['PHP_AUTH_USER'];
+            $pass = $this->request->server['PHP_AUTH_PW'];
 
-			$this->session->logout();
-			try {
-				if (!$this->session->logClientIn($user, $pass, $this->request, $this->throttler)) {
-					throw new SecurityException('CORS requires basic auth', Http::STATUS_UNAUTHORIZED);
-				}
-			} catch (PasswordLoginForbiddenException $ex) {
-				throw new SecurityException('Password login forbidden, use token instead', Http::STATUS_UNAUTHORIZED);
-			}
-		}
-	}
+            $this->session->logout();
+            try {
+                if (!$this->session->logClientIn($user, $pass, $this->request, $this->throttler)) {
+                    throw new SecurityException('CORS requires basic auth', Http::STATUS_UNAUTHORIZED);
+                }
+            } catch (PasswordLoginForbiddenException $ex) {
+                throw new SecurityException('Password login forbidden, use token instead', Http::STATUS_UNAUTHORIZED);
+            }
+        }
+    }
 
-	/**
-	 * This is being run after a successful controllermethod call and allows
-	 * the manipulation of a Response object. The middleware is run in reverse order
-	 *
-	 * @param Controller $controller the controller that is being called
-	 * @param string $methodName the name of the method that will be called on
-	 *                           the controller
-	 * @param Response $response the generated response from the controller
-	 * @return Response a Response object
-	 * @throws SecurityException
-	 */
-	public function afterController($controller, $methodName, Response $response){
-		// only react if its a CORS request and if the request sends origin and
+    /**
+     * This is being run after a successful controllermethod call and allows
+     * the manipulation of a Response object. The middleware is run in reverse order
+     *
+     * @param Controller $controller the controller that is being called
+     * @param string $methodName the name of the method that will be called on
+     *                           the controller
+     * @param Response $response the generated response from the controller
+     * @return Response a Response object
+     * @throws SecurityException
+     */
+    public function afterController($controller, $methodName, Response $response){
+        // only react if its a CORS request and if the request sends origin and
 
-		if(isset($this->request->server['HTTP_ORIGIN']) &&
-			$this->reflector->hasAnnotation('CORS')) {
+        if(isset($this->request->server['HTTP_ORIGIN']) &&
+            $this->reflector->hasAnnotation('CORS')) {
 
-			// allow credentials headers must not be true or CSRF is possible
-			// otherwise
-			foreach($response->getHeaders() as $header => $value) {
-				if(strtolower($header) === 'access-control-allow-credentials' &&
-				   strtolower(trim($value)) === 'true') {
-					$msg = 'Access-Control-Allow-Credentials must not be '.
-						   'set to true in order to prevent CSRF';
-					throw new SecurityException($msg);
-				}
-			}
+            // allow credentials headers must not be true or CSRF is possible
+            // otherwise
+            foreach($response->getHeaders() as $header => $value) {
+                if(strtolower($header) === 'access-control-allow-credentials' &&
+                   strtolower(trim($value)) === 'true') {
+                    $msg = 'Access-Control-Allow-Credentials must not be '.
+                            'set to true in order to prevent CSRF';
+                    throw new SecurityException($msg);
+                }
+            }
 
-			$origin = $this->request->server['HTTP_ORIGIN'];
-			$response->addHeader('Access-Control-Allow-Origin', $origin);
-		}
-		return $response;
-	}
+            $origin = $this->request->server['HTTP_ORIGIN'];
+            $response->addHeader('Access-Control-Allow-Origin', $origin);
+        }
+        return $response;
+    }
 
-	/**
-	 * If an SecurityException is being caught return a JSON error response
-	 *
-	 * @param Controller $controller the controller that is being called
-	 * @param string $methodName the name of the method that will be called on
-	 *                           the controller
-	 * @param \Exception $exception the thrown exception
-	 * @throws \Exception the passed in exception if it can't handle it
-	 * @return Response a Response object or null in case that the exception could not be handled
-	 */
-	public function afterException($controller, $methodName, \Exception $exception){
-		if($exception instanceof SecurityException){
-			$response =  new JSONResponse(['message' => $exception->getMessage()]);
-			if($exception->getCode() !== 0) {
-				$response->setStatus($exception->getCode());
-			} else {
-				$response->setStatus(Http::STATUS_INTERNAL_SERVER_ERROR);
-			}
-			return $response;
-		}
+    /**
+     * If an SecurityException is being caught return a JSON error response
+     *
+     * @param Controller $controller the controller that is being called
+     * @param string $methodName the name of the method that will be called on
+     *                           the controller
+     * @param \Exception $exception the thrown exception
+     * @throws \Exception the passed in exception if it can't handle it
+     * @return Response a Response object or null in case that the exception could not be handled
+     */
+    public function afterException($controller, $methodName, \Exception $exception){
+        if($exception instanceof SecurityException){
+            $response =  new JSONResponse(['message' => $exception->getMessage()]);
+            if($exception->getCode() !== 0) {
+                $response->setStatus($exception->getCode());
+            } else {
+                $response->setStatus(Http::STATUS_INTERNAL_SERVER_ERROR);
+            }
+            return $response;
+        }
 
-		throw $exception;
-	}
+        throw $exception;
+    }
 
 }

Spacing +10 added lines, -10 removed lines

@@ -80,11 +80,11 @@ 
 	 * @throws SecurityException
 	 * @since 6.0.0
 	 */
-	public function beforeController($controller, $methodName){
+	public function beforeController($controller, $methodName) {
 		// ensure that @CORS annotated API routes are not used in conjunction
 		// with session authentication since this enables CSRF attack vectors
 		if ($this->reflector->hasAnnotation('CORS') &&
-			!$this->reflector->hasAnnotation('PublicPage'))  {
+			!$this->reflector->hasAnnotation('PublicPage')) {
 			$user = $this->request->server['PHP_AUTH_USER'];
 			$pass = $this->request->server['PHP_AUTH_PW'];
 
@@ -110,16 +110,16 @@ 
 	 * @return Response a Response object
 	 * @throws SecurityException
 	 */
-	public function afterController($controller, $methodName, Response $response){
+	public function afterController($controller, $methodName, Response $response) {
 		// only react if its a CORS request and if the request sends origin and
 
-		if(isset($this->request->server['HTTP_ORIGIN']) &&
+		if (isset($this->request->server['HTTP_ORIGIN']) &&
 			$this->reflector->hasAnnotation('CORS')) {
 
 			// allow credentials headers must not be true or CSRF is possible
 			// otherwise
-			foreach($response->getHeaders() as $header => $value) {
-				if(strtolower($header) === 'access-control-allow-credentials' &&
+			foreach ($response->getHeaders() as $header => $value) {
+				if (strtolower($header) === 'access-control-allow-credentials' &&
 				   strtolower(trim($value)) === 'true') {
 					$msg = 'Access-Control-Allow-Credentials must not be '.
 						   'set to true in order to prevent CSRF';
@@ -143,10 +143,10 @@ 
 	 * @throws \Exception the passed in exception if it can't handle it
 	 * @return Response a Response object or null in case that the exception could not be handled
 	 */
-	public function afterException($controller, $methodName, \Exception $exception){
-		if($exception instanceof SecurityException){
-			$response =  new JSONResponse(['message' => $exception->getMessage()]);
-			if($exception->getCode() !== 0) {
+	public function afterException($controller, $methodName, \Exception $exception) {
+		if ($exception instanceof SecurityException) {
+			$response = new JSONResponse(['message' => $exception->getMessage()]);
+			if ($exception->getCode() !== 0) {
 				$response->setStatus($exception->getCode());
 			} else {
 				$response->setStatus(Http::STATUS_INTERNAL_SERVER_ERROR);

lib/private/AppFramework/Middleware/Security/Exceptions/NotConfirmedException.php

Indentation +3 added lines, -3 removed lines

@@ -31,7 +31,7 @@
  * @package OC\AppFramework\Middleware\Security\Exceptions
  */
 class NotConfirmedException extends SecurityException {
-	public function __construct() {
-		parent::__construct('Password confirmation is required', Http::STATUS_FORBIDDEN);
-	}
+    public function __construct() {
+        parent::__construct('Password confirmation is required', Http::STATUS_FORBIDDEN);
+    }
 }

lib/private/AppFramework/Middleware/Security/Exceptions/CrossSiteRequestForgeryException.php

Indentation +3 added lines, -3 removed lines

@@ -34,7 +34,7 @@
  * @package OC\AppFramework\Middleware\Security\Exceptions
  */
 class CrossSiteRequestForgeryException extends SecurityException {
-	public function __construct() {
-		parent::__construct('CSRF check failed', Http::STATUS_PRECONDITION_FAILED);
-	}
+    public function __construct() {
+        parent::__construct('CSRF check failed', Http::STATUS_PRECONDITION_FAILED);
+    }
 }

lib/private/AppFramework/Middleware/Security/Exceptions/AppNotEnabledException.php

Indentation +3 added lines, -3 removed lines

@@ -34,7 +34,7 @@
  * @package OC\AppFramework\Middleware\Security\Exceptions
  */
 class AppNotEnabledException extends SecurityException {
-	public function __construct() {
-		parent::__construct('App is not enabled', Http::STATUS_PRECONDITION_FAILED);
-	}
+    public function __construct() {
+        parent::__construct('App is not enabled', Http::STATUS_PRECONDITION_FAILED);
+    }
 }

lib/private/AppFramework/Middleware/Security/Exceptions/NotLoggedInException.php

Indentation +3 added lines, -3 removed lines

@@ -34,7 +34,7 @@
  * @package OC\AppFramework\Middleware\Security\Exceptions
  */
 class NotLoggedInException extends SecurityException {
-	public function __construct() {
-		parent::__construct('Current user is not logged in', Http::STATUS_UNAUTHORIZED);
-	}
+    public function __construct() {
+        parent::__construct('Current user is not logged in', Http::STATUS_UNAUTHORIZED);
+    }
 }

lib/private/AppFramework/Middleware/OCSMiddleware.php

Spacing +1 added lines, -1 removed lines

@@ -143,7 +143,7 @@
 		$format = $this->request->getParam('format');
 
 		// if none is given try the first Accept header
-		if($format === null) {
+		if ($format === null) {
 			$headers = $this->request->getHeader('Accept');
 			$format = $controller->getResponderByHTTPHeader($headers, 'xml');
 		}

Indentation +109 added lines, -109 removed lines

@@ -39,116 +39,116 @@
 
 class OCSMiddleware extends Middleware {
 
-	/** @var IRequest */
-	private $request;
-
-	/** @var int */
-	private $ocsVersion;
-
-	/**
-	 * @param IRequest $request
-	 */
-	public function __construct(IRequest $request) {
-		$this->request = $request;
-	}
-
-	/**
-	 * @param Controller $controller
-	 * @param string $methodName
-	 */
-	public function beforeController($controller, $methodName) {
-		if ($controller instanceof OCSController) {
-			if (substr_compare($this->request->getScriptName(), '/ocs/v2.php', -strlen('/ocs/v2.php')) === 0) {
-				$this->ocsVersion = 2;
-			} else {
-				$this->ocsVersion = 1;
-			}
-			$controller->setOCSVersion($this->ocsVersion);
-		}
-	}
-
-	/**
-	 * @param Controller $controller
-	 * @param string $methodName
-	 * @param \Exception $exception
-	 * @throws \Exception
-	 * @return BaseResponse
-	 */
-	public function afterException($controller, $methodName, \Exception $exception) {
-		if ($controller instanceof OCSController && $exception instanceof OCSException) {
-			$code = $exception->getCode();
-			if ($code === 0) {
-				$code = API::RESPOND_UNKNOWN_ERROR;
-			}
-
-			return $this->buildNewResponse($controller, $code, $exception->getMessage());
-		}
-
-		throw $exception;
-	}
-
-	/**
-	 * @param Controller $controller
-	 * @param string $methodName
-	 * @param Response $response
-	 * @return \OCP\AppFramework\Http\Response
-	 */
-	public function afterController($controller, $methodName, Response $response) {
-		/*
+    /** @var IRequest */
+    private $request;
+
+    /** @var int */
+    private $ocsVersion;
+
+    /**
+     * @param IRequest $request
+     */
+    public function __construct(IRequest $request) {
+        $this->request = $request;
+    }
+
+    /**
+     * @param Controller $controller
+     * @param string $methodName
+     */
+    public function beforeController($controller, $methodName) {
+        if ($controller instanceof OCSController) {
+            if (substr_compare($this->request->getScriptName(), '/ocs/v2.php', -strlen('/ocs/v2.php')) === 0) {
+                $this->ocsVersion = 2;
+            } else {
+                $this->ocsVersion = 1;
+            }
+            $controller->setOCSVersion($this->ocsVersion);
+        }
+    }
+
+    /**
+     * @param Controller $controller
+     * @param string $methodName
+     * @param \Exception $exception
+     * @throws \Exception
+     * @return BaseResponse
+     */
+    public function afterException($controller, $methodName, \Exception $exception) {
+        if ($controller instanceof OCSController && $exception instanceof OCSException) {
+            $code = $exception->getCode();
+            if ($code === 0) {
+                $code = API::RESPOND_UNKNOWN_ERROR;
+            }
+
+            return $this->buildNewResponse($controller, $code, $exception->getMessage());
+        }
+
+        throw $exception;
+    }
+
+    /**
+     * @param Controller $controller
+     * @param string $methodName
+     * @param Response $response
+     * @return \OCP\AppFramework\Http\Response
+     */
+    public function afterController($controller, $methodName, Response $response) {
+        /*
 		 * If a different middleware has detected that a request unauthorized or forbidden
 		 * we need to catch the response and convert it to a proper OCS response.
 		 */
-		if ($controller instanceof OCSController && !($response instanceof BaseResponse)) {
-			if ($response->getStatus() === Http::STATUS_UNAUTHORIZED ||
-			    $response->getStatus() === Http::STATUS_FORBIDDEN) {
-
-				$message = '';
-				if ($response instanceof JSONResponse) {
-					/** @var DataResponse $response */
-					$message = $response->getData()['message'];
-				}
-
-				return $this->buildNewResponse($controller, API::RESPOND_UNAUTHORISED, $message);
-			}
-		}
-
-		return $response;
-	}
-
-	/**
-	 * @param Controller $controller
-	 * @param int $code
-	 * @param string $message
-	 * @return V1Response|V2Response
-	 */
-	private function buildNewResponse(Controller $controller, $code, $message) {
-		$format = $this->getFormat($controller);
-
-		$data = new DataResponse();
-		$data->setStatus($code);
-		if ($this->ocsVersion === 1) {
-			$response = new V1Response($data, $format, $message);
-		} else {
-			$response = new V2Response($data, $format, $message);
-		}
-
-		return $response;
-	}
-
-	/**
-	 * @param Controller $controller
-	 * @return string
-	 */
-	private function getFormat(Controller $controller) {
-		// get format from the url format or request format parameter
-		$format = $this->request->getParam('format');
-
-		// if none is given try the first Accept header
-		if($format === null) {
-			$headers = $this->request->getHeader('Accept');
-			$format = $controller->getResponderByHTTPHeader($headers, 'xml');
-		}
-
-		return $format;
-	}
+        if ($controller instanceof OCSController && !($response instanceof BaseResponse)) {
+            if ($response->getStatus() === Http::STATUS_UNAUTHORIZED ||
+                $response->getStatus() === Http::STATUS_FORBIDDEN) {
+
+                $message = '';
+                if ($response instanceof JSONResponse) {
+                    /** @var DataResponse $response */
+                    $message = $response->getData()['message'];
+                }
+
+                return $this->buildNewResponse($controller, API::RESPOND_UNAUTHORISED, $message);
+            }
+        }
+
+        return $response;
+    }
+
+    /**
+     * @param Controller $controller
+     * @param int $code
+     * @param string $message
+     * @return V1Response|V2Response
+     */
+    private function buildNewResponse(Controller $controller, $code, $message) {
+        $format = $this->getFormat($controller);
+
+        $data = new DataResponse();
+        $data->setStatus($code);
+        if ($this->ocsVersion === 1) {
+            $response = new V1Response($data, $format, $message);
+        } else {
+            $response = new V2Response($data, $format, $message);
+        }
+
+        return $response;
+    }
+
+    /**
+     * @param Controller $controller
+     * @return string
+     */
+    private function getFormat(Controller $controller) {
+        // get format from the url format or request format parameter
+        $format = $this->request->getParam('format');
+
+        // if none is given try the first Accept header
+        if($format === null) {
+            $headers = $this->request->getHeader('Accept');
+            $format = $controller->getResponderByHTTPHeader($headers, 'xml');
+        }
+
+        return $format;
+    }
 }

lib/private/AppFramework/Middleware/SessionMiddleware.php

Spacing +1 added lines, -1 removed lines

@@ -71,7 +71,7 @@
 	 * @param Response $response
 	 * @return Response
 	 */
-	public function afterController($controller, $methodName, Response $response){
+	public function afterController($controller, $methodName, Response $response) {
 		$useSession = $this->reflector->hasAnnotation('UseSession');
 		if ($useSession) {
 			$this->session->close();

Indentation +42 added lines, -42 removed lines

@@ -32,52 +32,52 @@
 
 class SessionMiddleware extends Middleware {
 
-	/**
-	 * @var IRequest
-	 */
-	private $request;
+    /**
+     * @var IRequest
+     */
+    private $request;
 
-	/**
-	 * @var ControllerMethodReflector
-	 */
-	private $reflector;
+    /**
+     * @var ControllerMethodReflector
+     */
+    private $reflector;
 
-	/**
-	 * @param IRequest $request
-	 * @param ControllerMethodReflector $reflector
-	 */
-	public function __construct(IRequest $request,
-								ControllerMethodReflector $reflector,
-								ISession $session
+    /**
+     * @param IRequest $request
+     * @param ControllerMethodReflector $reflector
+     */
+    public function __construct(IRequest $request,
+                                ControllerMethodReflector $reflector,
+                                ISession $session
 ) {
-		$this->request = $request;
-		$this->reflector = $reflector;
-		$this->session = $session;
-	}
+        $this->request = $request;
+        $this->reflector = $reflector;
+        $this->session = $session;
+    }
 
-	/**
-	 * @param Controller $controller
-	 * @param string $methodName
-	 */
-	public function beforeController($controller, $methodName) {
-		$useSession = $this->reflector->hasAnnotation('UseSession');
-		if (!$useSession) {
-			$this->session->close();
-		}
-	}
+    /**
+     * @param Controller $controller
+     * @param string $methodName
+     */
+    public function beforeController($controller, $methodName) {
+        $useSession = $this->reflector->hasAnnotation('UseSession');
+        if (!$useSession) {
+            $this->session->close();
+        }
+    }
 
-	/**
-	 * @param Controller $controller
-	 * @param string $methodName
-	 * @param Response $response
-	 * @return Response
-	 */
-	public function afterController($controller, $methodName, Response $response){
-		$useSession = $this->reflector->hasAnnotation('UseSession');
-		if ($useSession) {
-			$this->session->close();
-		}
-		return $response;
-	}
+    /**
+     * @param Controller $controller
+     * @param string $methodName
+     * @param Response $response
+     * @return Response
+     */
+    public function afterController($controller, $methodName, Response $response){
+        $useSession = $this->reflector->hasAnnotation('UseSession');
+        if ($useSession) {
+            $this->session->close();
+        }
+        return $response;
+    }
 
 }