nextcloud / server

lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php

Indentation +161 added lines, -161 removed lines

@@ -66,97 +66,97 @@ 
  * check fails
  */
 class SecurityMiddleware extends Middleware {
-	/** @var INavigationManager */
-	private $navigationManager;
-	/** @var IRequest */
-	private $request;
-	/** @var ControllerMethodReflector */
-	private $reflector;
-	/** @var string */
-	private $appName;
-	/** @var IURLGenerator */
-	private $urlGenerator;
-	/** @var ILogger */
-	private $logger;
-	/** @var bool */
-	private $isLoggedIn;
-	/** @var bool */
-	private $isAdminUser;
-	/** @var bool */
-	private $isSubAdmin;
-	/** @var IAppManager */
-	private $appManager;
-	/** @var IL10N */
-	private $l10n;
-
-	public function __construct(IRequest $request,
-								ControllerMethodReflector $reflector,
-								INavigationManager $navigationManager,
-								IURLGenerator $urlGenerator,
-								ILogger $logger,
-								string $appName,
-								bool $isLoggedIn,
-								bool $isAdminUser,
-								bool $isSubAdmin,
-								IAppManager $appManager,
-								IL10N $l10n
-	) {
-		$this->navigationManager = $navigationManager;
-		$this->request = $request;
-		$this->reflector = $reflector;
-		$this->appName = $appName;
-		$this->urlGenerator = $urlGenerator;
-		$this->logger = $logger;
-		$this->isLoggedIn = $isLoggedIn;
-		$this->isAdminUser = $isAdminUser;
-		$this->isSubAdmin = $isSubAdmin;
-		$this->appManager = $appManager;
-		$this->l10n = $l10n;
-	}
-
-	/**
-	 * This runs all the security checks before a method call. The
-	 * security checks are determined by inspecting the controller method
-	 * annotations
-	 * @param Controller $controller the controller
-	 * @param string $methodName the name of the method
-	 * @throws SecurityException when a security check fails
-	 */
-	public function beforeController($controller, $methodName) {
-
-		// this will set the current navigation entry of the app, use this only
-		// for normal HTML requests and not for AJAX requests
-		$this->navigationManager->setActiveEntry($this->appName);
-
-		// security checks
-		$isPublicPage = $this->reflector->hasAnnotation('PublicPage');
-		if(!$isPublicPage) {
-			if(!$this->isLoggedIn) {
-				throw new NotLoggedInException();
-			}
-
-			if($this->reflector->hasAnnotation('SubAdminRequired')
-				&& !$this->isSubAdmin
-				&& !$this->isAdminUser) {
-				throw new NotAdminException($this->l10n->t('Logged in user must be an admin or sub admin'));
-			}
-			if(!$this->reflector->hasAnnotation('SubAdminRequired')
-				&& !$this->reflector->hasAnnotation('NoAdminRequired')
-				&& !$this->isAdminUser) {
-				throw new NotAdminException($this->l10n->t('Logged in user must be an admin'));
-			}
-		}
-
-		// Check for strict cookie requirement
-		if($this->reflector->hasAnnotation('StrictCookieRequired') || !$this->reflector->hasAnnotation('NoCSRFRequired')) {
-			if(!$this->request->passesStrictCookieCheck()) {
-				throw new StrictCookieMissingException();
-			}
-		}
-		// CSRF check - also registers the CSRF token since the session may be closed later
-		Util::callRegister();
-		if(!$this->reflector->hasAnnotation('NoCSRFRequired')) {
-			/*
+    /** @var INavigationManager */
+    private $navigationManager;
+    /** @var IRequest */
+    private $request;
+    /** @var ControllerMethodReflector */
+    private $reflector;
+    /** @var string */
+    private $appName;
+    /** @var IURLGenerator */
+    private $urlGenerator;
+    /** @var ILogger */
+    private $logger;
+    /** @var bool */
+    private $isLoggedIn;
+    /** @var bool */
+    private $isAdminUser;
+    /** @var bool */
+    private $isSubAdmin;
+    /** @var IAppManager */
+    private $appManager;
+    /** @var IL10N */
+    private $l10n;
+
+    public function __construct(IRequest $request,
+                                ControllerMethodReflector $reflector,
+                                INavigationManager $navigationManager,
+                                IURLGenerator $urlGenerator,
+                                ILogger $logger,
+                                string $appName,
+                                bool $isLoggedIn,
+                                bool $isAdminUser,
+                                bool $isSubAdmin,
+                                IAppManager $appManager,
+                                IL10N $l10n
+    ) {
+        $this->navigationManager = $navigationManager;
+        $this->request = $request;
+        $this->reflector = $reflector;
+        $this->appName = $appName;
+        $this->urlGenerator = $urlGenerator;
+        $this->logger = $logger;
+        $this->isLoggedIn = $isLoggedIn;
+        $this->isAdminUser = $isAdminUser;
+        $this->isSubAdmin = $isSubAdmin;
+        $this->appManager = $appManager;
+        $this->l10n = $l10n;
+    }
+
+    /**
+     * This runs all the security checks before a method call. The
+     * security checks are determined by inspecting the controller method
+     * annotations
+     * @param Controller $controller the controller
+     * @param string $methodName the name of the method
+     * @throws SecurityException when a security check fails
+     */
+    public function beforeController($controller, $methodName) {
+
+        // this will set the current navigation entry of the app, use this only
+        // for normal HTML requests and not for AJAX requests
+        $this->navigationManager->setActiveEntry($this->appName);
+
+        // security checks
+        $isPublicPage = $this->reflector->hasAnnotation('PublicPage');
+        if(!$isPublicPage) {
+            if(!$this->isLoggedIn) {
+                throw new NotLoggedInException();
+            }
+
+            if($this->reflector->hasAnnotation('SubAdminRequired')
+                && !$this->isSubAdmin
+                && !$this->isAdminUser) {
+                throw new NotAdminException($this->l10n->t('Logged in user must be an admin or sub admin'));
+            }
+            if(!$this->reflector->hasAnnotation('SubAdminRequired')
+                && !$this->reflector->hasAnnotation('NoAdminRequired')
+                && !$this->isAdminUser) {
+                throw new NotAdminException($this->l10n->t('Logged in user must be an admin'));
+            }
+        }
+
+        // Check for strict cookie requirement
+        if($this->reflector->hasAnnotation('StrictCookieRequired') || !$this->reflector->hasAnnotation('NoCSRFRequired')) {
+            if(!$this->request->passesStrictCookieCheck()) {
+                throw new StrictCookieMissingException();
+            }
+        }
+        // CSRF check - also registers the CSRF token since the session may be closed later
+        Util::callRegister();
+        if(!$this->reflector->hasAnnotation('NoCSRFRequired')) {
+            /*
 			 * Only allow the CSRF check to fail on OCS Requests. This kind of
 			 * hacks around that we have no full token auth in place yet and we
 			 * do want to offer CSRF checks for web requests.
@@ -164,75 +164,75 @@ 
 			 * Additionally we allow Bearer authenticated requests to pass on OCS routes.
 			 * This allows oauth apps (e.g. moodle) to use the OCS endpoints
 			 */
-			if(!$this->request->passesCSRFCheck() && !(
-					$controller instanceof OCSController && (
-						$this->request->getHeader('OCS-APIREQUEST') === 'true' ||
-						strpos($this->request->getHeader('Authorization'), 'Bearer ') === 0
-					)
-				)) {
-				throw new CrossSiteRequestForgeryException();
-			}
-		}
-
-		/**
-		 * Checks if app is enabled (also includes a check whether user is allowed to access the resource)
-		 * The getAppPath() check is here since components such as settings also use the AppFramework and
-		 * therefore won't pass this check.
-		 * If page is public, app does not need to be enabled for current user/visitor
-		 */
-		try {
-			$appPath = $this->appManager->getAppPath($this->appName);
-		} catch (AppPathNotFoundException $e) {
-			$appPath = false;
-		}
-
-		if ($appPath !== false && !$isPublicPage && !$this->appManager->isEnabledForUser($this->appName)) {
-			throw new AppNotEnabledException();
-		}
-	}
-
-	/**
-	 * If an SecurityException is being caught, ajax requests return a JSON error
-	 * response and non ajax requests redirect to the index
-	 * @param Controller $controller the controller that is being called
-	 * @param string $methodName the name of the method that will be called on
-	 *                           the controller
-	 * @param \Exception $exception the thrown exception
-	 * @throws \Exception the passed in exception if it can't handle it
-	 * @return Response a Response object or null in case that the exception could not be handled
-	 */
-	public function afterException($controller, $methodName, \Exception $exception): Response {
-		if($exception instanceof SecurityException) {
-			if($exception instanceof StrictCookieMissingException) {
-				return new RedirectResponse(\OC::$WEBROOT);
- 			}
-			if (stripos($this->request->getHeader('Accept'),'html') === false) {
-				$response = new JSONResponse(
-					['message' => $exception->getMessage()],
-					$exception->getCode()
-				);
-			} else {
-				if($exception instanceof NotLoggedInException) {
-					$params = [];
-					if (isset($this->request->server['REQUEST_URI'])) {
-						$params['redirect_url'] = $this->request->server['REQUEST_URI'];
-					}
-					$url = $this->urlGenerator->linkToRoute('core.login.showLoginForm', $params);
-					$response = new RedirectResponse($url);
-				} else {
-					$response = new TemplateResponse('core', '403', ['message' => $exception->getMessage()], 'guest');
-					$response->setStatus($exception->getCode());
-				}
-			}
-
-			$this->logger->logException($exception, [
-				'level' => ILogger::DEBUG,
-				'app' => 'core',
-			]);
-			return $response;
-		}
-
-		throw $exception;
-	}
+            if(!$this->request->passesCSRFCheck() && !(
+                    $controller instanceof OCSController && (
+                        $this->request->getHeader('OCS-APIREQUEST') === 'true' ||
+                        strpos($this->request->getHeader('Authorization'), 'Bearer ') === 0
+                    )
+                )) {
+                throw new CrossSiteRequestForgeryException();
+            }
+        }
+
+        /**
+         * Checks if app is enabled (also includes a check whether user is allowed to access the resource)
+         * The getAppPath() check is here since components such as settings also use the AppFramework and
+         * therefore won't pass this check.
+         * If page is public, app does not need to be enabled for current user/visitor
+         */
+        try {
+            $appPath = $this->appManager->getAppPath($this->appName);
+        } catch (AppPathNotFoundException $e) {
+            $appPath = false;
+        }
+
+        if ($appPath !== false && !$isPublicPage && !$this->appManager->isEnabledForUser($this->appName)) {
+            throw new AppNotEnabledException();
+        }
+    }
+
+    /**
+     * If an SecurityException is being caught, ajax requests return a JSON error
+     * response and non ajax requests redirect to the index
+     * @param Controller $controller the controller that is being called
+     * @param string $methodName the name of the method that will be called on
+     *                           the controller
+     * @param \Exception $exception the thrown exception
+     * @throws \Exception the passed in exception if it can't handle it
+     * @return Response a Response object or null in case that the exception could not be handled
+     */
+    public function afterException($controller, $methodName, \Exception $exception): Response {
+        if($exception instanceof SecurityException) {
+            if($exception instanceof StrictCookieMissingException) {
+                return new RedirectResponse(\OC::$WEBROOT);
+                }
+            if (stripos($this->request->getHeader('Accept'),'html') === false) {
+                $response = new JSONResponse(
+                    ['message' => $exception->getMessage()],
+                    $exception->getCode()
+                );
+            } else {
+                if($exception instanceof NotLoggedInException) {
+                    $params = [];
+                    if (isset($this->request->server['REQUEST_URI'])) {
+                        $params['redirect_url'] = $this->request->server['REQUEST_URI'];
+                    }
+                    $url = $this->urlGenerator->linkToRoute('core.login.showLoginForm', $params);
+                    $response = new RedirectResponse($url);
+                } else {
+                    $response = new TemplateResponse('core', '403', ['message' => $exception->getMessage()], 'guest');
+                    $response->setStatus($exception->getCode());
+                }
+            }
+
+            $this->logger->logException($exception, [
+                'level' => ILogger::DEBUG,
+                'app' => 'core',
+            ]);
+            return $response;
+        }
+
+        throw $exception;
+    }
 
 }

Spacing +12 added lines, -12 removed lines

@@ -130,17 +130,17 @@ 
 
 		// security checks
 		$isPublicPage = $this->reflector->hasAnnotation('PublicPage');
-		if(!$isPublicPage) {
-			if(!$this->isLoggedIn) {
+		if (!$isPublicPage) {
+			if (!$this->isLoggedIn) {
 				throw new NotLoggedInException();
 			}
 
-			if($this->reflector->hasAnnotation('SubAdminRequired')
+			if ($this->reflector->hasAnnotation('SubAdminRequired')
 				&& !$this->isSubAdmin
 				&& !$this->isAdminUser) {
 				throw new NotAdminException($this->l10n->t('Logged in user must be an admin or sub admin'));
 			}
-			if(!$this->reflector->hasAnnotation('SubAdminRequired')
+			if (!$this->reflector->hasAnnotation('SubAdminRequired')
 				&& !$this->reflector->hasAnnotation('NoAdminRequired')
 				&& !$this->isAdminUser) {
 				throw new NotAdminException($this->l10n->t('Logged in user must be an admin'));
@@ -148,14 +148,14 @@ 
 		}
 
 		// Check for strict cookie requirement
-		if($this->reflector->hasAnnotation('StrictCookieRequired') || !$this->reflector->hasAnnotation('NoCSRFRequired')) {
-			if(!$this->request->passesStrictCookieCheck()) {
+		if ($this->reflector->hasAnnotation('StrictCookieRequired') || !$this->reflector->hasAnnotation('NoCSRFRequired')) {
+			if (!$this->request->passesStrictCookieCheck()) {
 				throw new StrictCookieMissingException();
 			}
 		}
 		// CSRF check - also registers the CSRF token since the session may be closed later
 		Util::callRegister();
-		if(!$this->reflector->hasAnnotation('NoCSRFRequired')) {
+		if (!$this->reflector->hasAnnotation('NoCSRFRequired')) {
 			/*
 			 * Only allow the CSRF check to fail on OCS Requests. This kind of
 			 * hacks around that we have no full token auth in place yet and we
@@ -164,7 +164,7 @@ 
 			 * Additionally we allow Bearer authenticated requests to pass on OCS routes.
 			 * This allows oauth apps (e.g. moodle) to use the OCS endpoints
 			 */
-			if(!$this->request->passesCSRFCheck() && !(
+			if (!$this->request->passesCSRFCheck() && !(
 					$controller instanceof OCSController && (
 						$this->request->getHeader('OCS-APIREQUEST') === 'true' ||
 						strpos($this->request->getHeader('Authorization'), 'Bearer ') === 0
@@ -202,17 +202,17 @@ 
 	 * @return Response a Response object or null in case that the exception could not be handled
 	 */
 	public function afterException($controller, $methodName, \Exception $exception): Response {
-		if($exception instanceof SecurityException) {
-			if($exception instanceof StrictCookieMissingException) {
+		if ($exception instanceof SecurityException) {
+			if ($exception instanceof StrictCookieMissingException) {
 				return new RedirectResponse(\OC::$WEBROOT);
  			}
-			if (stripos($this->request->getHeader('Accept'),'html') === false) {
+			if (stripos($this->request->getHeader('Accept'), 'html') === false) {
 				$response = new JSONResponse(
 					['message' => $exception->getMessage()],
 					$exception->getCode()
 				);
 			} else {
-				if($exception instanceof NotLoggedInException) {
+				if ($exception instanceof NotLoggedInException) {
 					$params = [];
 					if (isset($this->request->server['REQUEST_URI'])) {
 						$params['redirect_url'] = $this->request->server['REQUEST_URI'];

lib/private/AppFramework/Middleware/Security/CSPMiddleware.php

Indentation +35 added lines, -35 removed lines

@@ -35,46 +35,46 @@
 
 class CSPMiddleware extends Middleware {
 
-	/** @var ContentSecurityPolicyManager */
-	private $contentSecurityPolicyManager;
-	/** @var ContentSecurityPolicyNonceManager */
-	private $cspNonceManager;
-	/** @var CsrfTokenManager */
-	private $csrfTokenManager;
+    /** @var ContentSecurityPolicyManager */
+    private $contentSecurityPolicyManager;
+    /** @var ContentSecurityPolicyNonceManager */
+    private $cspNonceManager;
+    /** @var CsrfTokenManager */
+    private $csrfTokenManager;
 
-	public function __construct(ContentSecurityPolicyManager $policyManager,
-								ContentSecurityPolicyNonceManager $cspNonceManager,
-								CsrfTokenManager $csrfTokenManager) {
-		$this->contentSecurityPolicyManager = $policyManager;
-		$this->cspNonceManager = $cspNonceManager;
-		$this->csrfTokenManager = $csrfTokenManager;
-	}
+    public function __construct(ContentSecurityPolicyManager $policyManager,
+                                ContentSecurityPolicyNonceManager $cspNonceManager,
+                                CsrfTokenManager $csrfTokenManager) {
+        $this->contentSecurityPolicyManager = $policyManager;
+        $this->cspNonceManager = $cspNonceManager;
+        $this->csrfTokenManager = $csrfTokenManager;
+    }
 
-	/**
-	 * Performs the default CSP modifications that may be injected by other
-	 * applications
-	 *
-	 * @param Controller $controller
-	 * @param string $methodName
-	 * @param Response $response
-	 * @return Response
-	 */
-	public function afterController($controller, $methodName, Response $response): Response {
-		$policy = !is_null($response->getContentSecurityPolicy()) ? $response->getContentSecurityPolicy() : new ContentSecurityPolicy();
+    /**
+     * Performs the default CSP modifications that may be injected by other
+     * applications
+     *
+     * @param Controller $controller
+     * @param string $methodName
+     * @param Response $response
+     * @return Response
+     */
+    public function afterController($controller, $methodName, Response $response): Response {
+        $policy = !is_null($response->getContentSecurityPolicy()) ? $response->getContentSecurityPolicy() : new ContentSecurityPolicy();
 
-		if (get_class($policy) === EmptyContentSecurityPolicy::class) {
-			return $response;
-		}
+        if (get_class($policy) === EmptyContentSecurityPolicy::class) {
+            return $response;
+        }
 
-		$defaultPolicy = $this->contentSecurityPolicyManager->getDefaultPolicy();
-		$defaultPolicy = $this->contentSecurityPolicyManager->mergePolicies($defaultPolicy, $policy);
+        $defaultPolicy = $this->contentSecurityPolicyManager->getDefaultPolicy();
+        $defaultPolicy = $this->contentSecurityPolicyManager->mergePolicies($defaultPolicy, $policy);
 
-		if($this->cspNonceManager->browserSupportsCspV3()) {
-			$defaultPolicy->useJsNonce($this->csrfTokenManager->getToken()->getEncryptedValue());
-		}
+        if($this->cspNonceManager->browserSupportsCspV3()) {
+            $defaultPolicy->useJsNonce($this->csrfTokenManager->getToken()->getEncryptedValue());
+        }
 
-		$response->setContentSecurityPolicy($defaultPolicy);
+        $response->setContentSecurityPolicy($defaultPolicy);
 
-		return $response;
-	}
+        return $response;
+    }
 }

Spacing +1 added lines, -1 removed lines

@@ -69,7 +69,7 @@
 		$defaultPolicy = $this->contentSecurityPolicyManager->getDefaultPolicy();
 		$defaultPolicy = $this->contentSecurityPolicyManager->mergePolicies($defaultPolicy, $policy);
 
-		if($this->cspNonceManager->browserSupportsCspV3()) {
+		if ($this->cspNonceManager->browserSupportsCspV3()) {
 			$defaultPolicy->useJsNonce($this->csrfTokenManager->getToken()->getEncryptedValue());
 		}
 

lib/private/AppFramework/DependencyInjection/DIContainer.php

Indentation +347 added lines, -347 removed lines

@@ -69,351 +69,351 @@
 
 class DIContainer extends SimpleContainer implements IAppContainer {
 
-	/**
-	 * @var array
-	 */
-	private $middleWares = [];
-
-	/** @var ServerContainer */
-	private $server;
-
-	/**
-	 * Put your class dependencies in here
-	 * @param string $appName the name of the app
-	 * @param array $urlParams
-	 * @param ServerContainer|null $server
-	 */
-	public function __construct($appName, $urlParams = array(), ServerContainer $server = null){
-		parent::__construct();
-		$this['AppName'] = $appName;
-		$this['urlParams'] = $urlParams;
-
-		$this->registerAlias('Request', IRequest::class);
-
-		/** @var \OC\ServerContainer $server */
-		if ($server === null) {
-			$server = \OC::$server;
-		}
-		$this->server = $server;
-		$this->server->registerAppContainer($appName, $this);
-
-		// aliases
-		$this->registerAlias('appName', 'AppName');
-		$this->registerAlias('webRoot', 'WebRoot');
-		$this->registerAlias('userId', 'UserId');
-
-		/**
-		 * Core services
-		 */
-		$this->registerService(IOutput::class, function(){
-			return new Output($this->getServer()->getWebRoot());
-		});
-
-		$this->registerService(Folder::class, function() {
-			return $this->getServer()->getUserFolder();
-		});
-
-		$this->registerService(IAppData::class, function (SimpleContainer $c) {
-			return $this->getServer()->getAppDataDir($c->query('AppName'));
-		});
-
-		$this->registerService(IL10N::class, function($c) {
-			return $this->getServer()->getL10N($c->query('AppName'));
-		});
-
-		// Log wrapper
-		$this->registerService(ILogger::class, function ($c) {
-			return new OC\AppFramework\Logger($this->server->query(ILogger::class), $c->query('AppName'));
-		});
-
-		$this->registerService(IServerContainer::class, function () {
-			return $this->getServer();
-		});
-		$this->registerAlias('ServerContainer', IServerContainer::class);
-
-		$this->registerService(\OCP\WorkflowEngine\IManager::class, function ($c) {
-			return $c->query(Manager::class);
-		});
-
-		$this->registerService(\OCP\AppFramework\IAppContainer::class, function ($c) {
-			return $c;
-		});
-
-		// commonly used attributes
-		$this->registerService('UserId', function ($c) {
-			return $c->query(IUserSession::class)->getSession()->get('user_id');
-		});
-
-		$this->registerService('WebRoot', function ($c) {
-			return $c->query('ServerContainer')->getWebRoot();
-		});
-
-		$this->registerService('OC_Defaults', function ($c) {
-			return $c->getServer()->getThemingDefaults();
-		});
-
-		$this->registerService(IConfig::class, function ($c) {
-			return $c->query(OC\GlobalScale\Config::class);
-		});
-
-		$this->registerService('Protocol', function($c){
-			/** @var \OC\Server $server */
-			$server = $c->query('ServerContainer');
-			$protocol = $server->getRequest()->getHttpProtocol();
-			return new Http($_SERVER, $protocol);
-		});
-
-		$this->registerService('Dispatcher', function($c) {
-			return new Dispatcher(
-				$c['Protocol'],
-				$c['MiddlewareDispatcher'],
-				$c->query(IControllerMethodReflector::class),
-				$c['Request']
-			);
-		});
-
-		/**
-		 * App Framework default arguments
-		 */
-		$this->registerParameter('corsMethods', 'PUT, POST, GET, DELETE, PATCH');
-		$this->registerParameter('corsAllowedHeaders', 'Authorization, Content-Type, Accept');
-		$this->registerParameter('corsMaxAge', 1728000);
-
-		/**
-		 * Middleware
-		 */
-		$this->registerService('MiddlewareDispatcher', function(SimpleContainer $c) {
-			$server =  $this->getServer();
-
-			$dispatcher = new MiddlewareDispatcher();
-			$dispatcher->registerMiddleware(
-				$c->query(OC\AppFramework\Middleware\Security\ReloadExecutionMiddleware::class)
-			);
-
-			$dispatcher->registerMiddleware(
-				new OC\AppFramework\Middleware\Security\SameSiteCookieMiddleware(
-					$c->query(IRequest::class),
-					$c->query(IControllerMethodReflector::class)
-				)
-			);
-			$dispatcher->registerMiddleware(
-				new CORSMiddleware(
-					$c->query(IRequest::class),
-					$c->query(IControllerMethodReflector::class),
-					$c->query(IUserSession::class),
-					$c->query(OC\Security\Bruteforce\Throttler::class)
-				)
-			);
-			$dispatcher->registerMiddleware(
-				new OCSMiddleware(
-					$c->query(IRequest::class)
-				)
-			);
-
-			$securityMiddleware = new SecurityMiddleware(
-				$c->query(IRequest::class),
-				$c->query(IControllerMethodReflector::class),
-				$c->query(INavigationManager::class),
-				$c->query(IURLGenerator::class),
-				$server->getLogger(),
-				$c['AppName'],
-				$server->getUserSession()->isLoggedIn(),
-				$server->getGroupManager()->isAdmin($this->getUserId()),
-				$server->getUserSession()->getUser() !== null && $server->query(ISubAdmin::class)->isSubAdmin($server->getUserSession()->getUser()),
-				$server->getAppManager(),
-				$server->getL10N('lib')
-			);
-			$dispatcher->registerMiddleware($securityMiddleware);
-			$dispatcher->registerMiddleware(
-				new OC\AppFramework\Middleware\Security\CSPMiddleware(
-					$server->query(OC\Security\CSP\ContentSecurityPolicyManager::class),
-					$server->query(OC\Security\CSP\ContentSecurityPolicyNonceManager::class),
-					$server->query(OC\Security\CSRF\CsrfTokenManager::class)
-				)
-			);
-			$dispatcher->registerMiddleware(
-				new OC\AppFramework\Middleware\Security\PasswordConfirmationMiddleware(
-					$c->query(IControllerMethodReflector::class),
-					$c->query(ISession::class),
-					$c->query(IUserSession::class),
-					$c->query(ITimeFactory::class)
-				)
-			);
-			$dispatcher->registerMiddleware(
-				new TwoFactorMiddleware(
-					$c->query(OC\Authentication\TwoFactorAuth\Manager::class),
-					$c->query(IUserSession::class),
-					$c->query(ISession::class),
-					$c->query(IURLGenerator::class),
-					$c->query(IControllerMethodReflector::class),
-					$c->query(IRequest::class)
-				)
-			);
-			$dispatcher->registerMiddleware(
-				new OC\AppFramework\Middleware\Security\BruteForceMiddleware(
-					$c->query(IControllerMethodReflector::class),
-					$c->query(OC\Security\Bruteforce\Throttler::class),
-					$c->query(IRequest::class)
-				)
-			);
-			$dispatcher->registerMiddleware(
-				new RateLimitingMiddleware(
-					$c->query(IRequest::class),
-					$c->query(IUserSession::class),
-					$c->query(IControllerMethodReflector::class),
-					$c->query(OC\Security\RateLimiting\Limiter::class)
-				)
-			);
-			$dispatcher->registerMiddleware(
-				new OC\AppFramework\Middleware\PublicShare\PublicShareMiddleware(
-					$c->query(IRequest::class),
-					$c->query(ISession::class),
-					$c->query(\OCP\IConfig::class)
-				)
-			);
-			$dispatcher->registerMiddleware(
-				$c->query(\OC\AppFramework\Middleware\AdditionalScriptsMiddleware::class)
-			);
-
-			foreach($this->middleWares as $middleWare) {
-				$dispatcher->registerMiddleware($c[$middleWare]);
-			}
-
-			$dispatcher->registerMiddleware(
-				new SessionMiddleware(
-					$c->query(IRequest::class),
-					$c->query(IControllerMethodReflector::class),
-					$c->query(ISession::class)
-				)
-			);
-			return $dispatcher;
-		});
-
-		$this->registerAlias(\OCP\Collaboration\Resources\IManager::class, OC\Collaboration\Resources\Manager::class);
-	}
-
-	/**
-	 * @return \OCP\IServerContainer
-	 */
-	public function getServer()
-	{
-		return $this->server;
-	}
-
-	/**
-	 * @param string $middleWare
-	 * @return boolean|null
-	 */
-	public function registerMiddleWare($middleWare) {
-		if (in_array($middleWare, $this->middleWares, true) !== false) {
-			return false;
-		}
-		$this->middleWares[] = $middleWare;
-	}
-
-	/**
-	 * used to return the appname of the set application
-	 * @return string the name of your application
-	 */
-	public function getAppName() {
-		return $this->query('AppName');
-	}
-
-	/**
-	 * @deprecated use IUserSession->isLoggedIn()
-	 * @return boolean
-	 */
-	public function isLoggedIn() {
-		return \OC::$server->getUserSession()->isLoggedIn();
-	}
-
-	/**
-	 * @deprecated use IGroupManager->isAdmin($userId)
-	 * @return boolean
-	 */
-	public function isAdminUser() {
-		$uid = $this->getUserId();
-		return \OC_User::isAdminUser($uid);
-	}
-
-	private function getUserId() {
-		return $this->getServer()->getSession()->get('user_id');
-	}
-
-	/**
-	 * @deprecated use the ILogger instead
-	 * @param string $message
-	 * @param string $level
-	 * @return mixed
-	 */
-	public function log($message, $level) {
-		switch($level){
-			case 'debug':
-				$level = ILogger::DEBUG;
-				break;
-			case 'info':
-				$level = ILogger::INFO;
-				break;
-			case 'warn':
-				$level = ILogger::WARN;
-				break;
-			case 'fatal':
-				$level = ILogger::FATAL;
-				break;
-			default:
-				$level = ILogger::ERROR;
-				break;
-		}
-		\OCP\Util::writeLog($this->getAppName(), $message, $level);
-	}
-
-	/**
-	 * Register a capability
-	 *
-	 * @param string $serviceName e.g. 'OCA\Files\Capabilities'
-	 */
-	public function registerCapability($serviceName) {
-		$this->query('OC\CapabilitiesManager')->registerCapability(function() use ($serviceName) {
-			return $this->query($serviceName);
-		});
-	}
-
-	public function query(string $name, bool $autoload = true) {
-		try {
-			return $this->queryNoFallback($name);
-		} catch (QueryException $firstException) {
-			try {
-				return $this->getServer()->query($name, $autoload);
-			} catch (QueryException $secondException) {
-				if ($firstException->getCode() === 1) {
-					throw $secondException;
-				}
-				throw $firstException;
-			}
-		}
-	}
-
-	/**
-	 * @param string $name
-	 * @return mixed
-	 * @throws QueryException if the query could not be resolved
-	 */
-	public function queryNoFallback($name) {
-		$name = $this->sanitizeName($name);
-
-		if ($this->offsetExists($name)) {
-			return parent::query($name);
-		} else {
-			if ($this['AppName'] === 'settings' && strpos($name, 'OC\\Settings\\') === 0) {
-				return parent::query($name);
-			} else if ($this['AppName'] === 'core' && strpos($name, 'OC\\Core\\') === 0) {
-				return parent::query($name);
-			} else if (strpos($name, \OC\AppFramework\App::buildAppNamespace($this['AppName']) . '\\') === 0) {
-				return parent::query($name);
-			}
-		}
-
-		throw new QueryException('Could not resolve ' . $name . '!' .
-			' Class can not be instantiated', 1);
-	}
+    /**
+     * @var array
+     */
+    private $middleWares = [];
+
+    /** @var ServerContainer */
+    private $server;
+
+    /**
+     * Put your class dependencies in here
+     * @param string $appName the name of the app
+     * @param array $urlParams
+     * @param ServerContainer|null $server
+     */
+    public function __construct($appName, $urlParams = array(), ServerContainer $server = null){
+        parent::__construct();
+        $this['AppName'] = $appName;
+        $this['urlParams'] = $urlParams;
+
+        $this->registerAlias('Request', IRequest::class);
+
+        /** @var \OC\ServerContainer $server */
+        if ($server === null) {
+            $server = \OC::$server;
+        }
+        $this->server = $server;
+        $this->server->registerAppContainer($appName, $this);
+
+        // aliases
+        $this->registerAlias('appName', 'AppName');
+        $this->registerAlias('webRoot', 'WebRoot');
+        $this->registerAlias('userId', 'UserId');
+
+        /**
+         * Core services
+         */
+        $this->registerService(IOutput::class, function(){
+            return new Output($this->getServer()->getWebRoot());
+        });
+
+        $this->registerService(Folder::class, function() {
+            return $this->getServer()->getUserFolder();
+        });
+
+        $this->registerService(IAppData::class, function (SimpleContainer $c) {
+            return $this->getServer()->getAppDataDir($c->query('AppName'));
+        });
+
+        $this->registerService(IL10N::class, function($c) {
+            return $this->getServer()->getL10N($c->query('AppName'));
+        });
+
+        // Log wrapper
+        $this->registerService(ILogger::class, function ($c) {
+            return new OC\AppFramework\Logger($this->server->query(ILogger::class), $c->query('AppName'));
+        });
+
+        $this->registerService(IServerContainer::class, function () {
+            return $this->getServer();
+        });
+        $this->registerAlias('ServerContainer', IServerContainer::class);
+
+        $this->registerService(\OCP\WorkflowEngine\IManager::class, function ($c) {
+            return $c->query(Manager::class);
+        });
+
+        $this->registerService(\OCP\AppFramework\IAppContainer::class, function ($c) {
+            return $c;
+        });
+
+        // commonly used attributes
+        $this->registerService('UserId', function ($c) {
+            return $c->query(IUserSession::class)->getSession()->get('user_id');
+        });
+
+        $this->registerService('WebRoot', function ($c) {
+            return $c->query('ServerContainer')->getWebRoot();
+        });
+
+        $this->registerService('OC_Defaults', function ($c) {
+            return $c->getServer()->getThemingDefaults();
+        });
+
+        $this->registerService(IConfig::class, function ($c) {
+            return $c->query(OC\GlobalScale\Config::class);
+        });
+
+        $this->registerService('Protocol', function($c){
+            /** @var \OC\Server $server */
+            $server = $c->query('ServerContainer');
+            $protocol = $server->getRequest()->getHttpProtocol();
+            return new Http($_SERVER, $protocol);
+        });
+
+        $this->registerService('Dispatcher', function($c) {
+            return new Dispatcher(
+                $c['Protocol'],
+                $c['MiddlewareDispatcher'],
+                $c->query(IControllerMethodReflector::class),
+                $c['Request']
+            );
+        });
+
+        /**
+         * App Framework default arguments
+         */
+        $this->registerParameter('corsMethods', 'PUT, POST, GET, DELETE, PATCH');
+        $this->registerParameter('corsAllowedHeaders', 'Authorization, Content-Type, Accept');
+        $this->registerParameter('corsMaxAge', 1728000);
+
+        /**
+         * Middleware
+         */
+        $this->registerService('MiddlewareDispatcher', function(SimpleContainer $c) {
+            $server =  $this->getServer();
+
+            $dispatcher = new MiddlewareDispatcher();
+            $dispatcher->registerMiddleware(
+                $c->query(OC\AppFramework\Middleware\Security\ReloadExecutionMiddleware::class)
+            );
+
+            $dispatcher->registerMiddleware(
+                new OC\AppFramework\Middleware\Security\SameSiteCookieMiddleware(
+                    $c->query(IRequest::class),
+                    $c->query(IControllerMethodReflector::class)
+                )
+            );
+            $dispatcher->registerMiddleware(
+                new CORSMiddleware(
+                    $c->query(IRequest::class),
+                    $c->query(IControllerMethodReflector::class),
+                    $c->query(IUserSession::class),
+                    $c->query(OC\Security\Bruteforce\Throttler::class)
+                )
+            );
+            $dispatcher->registerMiddleware(
+                new OCSMiddleware(
+                    $c->query(IRequest::class)
+                )
+            );
+
+            $securityMiddleware = new SecurityMiddleware(
+                $c->query(IRequest::class),
+                $c->query(IControllerMethodReflector::class),
+                $c->query(INavigationManager::class),
+                $c->query(IURLGenerator::class),
+                $server->getLogger(),
+                $c['AppName'],
+                $server->getUserSession()->isLoggedIn(),
+                $server->getGroupManager()->isAdmin($this->getUserId()),
+                $server->getUserSession()->getUser() !== null && $server->query(ISubAdmin::class)->isSubAdmin($server->getUserSession()->getUser()),
+                $server->getAppManager(),
+                $server->getL10N('lib')
+            );
+            $dispatcher->registerMiddleware($securityMiddleware);
+            $dispatcher->registerMiddleware(
+                new OC\AppFramework\Middleware\Security\CSPMiddleware(
+                    $server->query(OC\Security\CSP\ContentSecurityPolicyManager::class),
+                    $server->query(OC\Security\CSP\ContentSecurityPolicyNonceManager::class),
+                    $server->query(OC\Security\CSRF\CsrfTokenManager::class)
+                )
+            );
+            $dispatcher->registerMiddleware(
+                new OC\AppFramework\Middleware\Security\PasswordConfirmationMiddleware(
+                    $c->query(IControllerMethodReflector::class),
+                    $c->query(ISession::class),
+                    $c->query(IUserSession::class),
+                    $c->query(ITimeFactory::class)
+                )
+            );
+            $dispatcher->registerMiddleware(
+                new TwoFactorMiddleware(
+                    $c->query(OC\Authentication\TwoFactorAuth\Manager::class),
+                    $c->query(IUserSession::class),
+                    $c->query(ISession::class),
+                    $c->query(IURLGenerator::class),
+                    $c->query(IControllerMethodReflector::class),
+                    $c->query(IRequest::class)
+                )
+            );
+            $dispatcher->registerMiddleware(
+                new OC\AppFramework\Middleware\Security\BruteForceMiddleware(
+                    $c->query(IControllerMethodReflector::class),
+                    $c->query(OC\Security\Bruteforce\Throttler::class),
+                    $c->query(IRequest::class)
+                )
+            );
+            $dispatcher->registerMiddleware(
+                new RateLimitingMiddleware(
+                    $c->query(IRequest::class),
+                    $c->query(IUserSession::class),
+                    $c->query(IControllerMethodReflector::class),
+                    $c->query(OC\Security\RateLimiting\Limiter::class)
+                )
+            );
+            $dispatcher->registerMiddleware(
+                new OC\AppFramework\Middleware\PublicShare\PublicShareMiddleware(
+                    $c->query(IRequest::class),
+                    $c->query(ISession::class),
+                    $c->query(\OCP\IConfig::class)
+                )
+            );
+            $dispatcher->registerMiddleware(
+                $c->query(\OC\AppFramework\Middleware\AdditionalScriptsMiddleware::class)
+            );
+
+            foreach($this->middleWares as $middleWare) {
+                $dispatcher->registerMiddleware($c[$middleWare]);
+            }
+
+            $dispatcher->registerMiddleware(
+                new SessionMiddleware(
+                    $c->query(IRequest::class),
+                    $c->query(IControllerMethodReflector::class),
+                    $c->query(ISession::class)
+                )
+            );
+            return $dispatcher;
+        });
+
+        $this->registerAlias(\OCP\Collaboration\Resources\IManager::class, OC\Collaboration\Resources\Manager::class);
+    }
+
+    /**
+     * @return \OCP\IServerContainer
+     */
+    public function getServer()
+    {
+        return $this->server;
+    }
+
+    /**
+     * @param string $middleWare
+     * @return boolean|null
+     */
+    public function registerMiddleWare($middleWare) {
+        if (in_array($middleWare, $this->middleWares, true) !== false) {
+            return false;
+        }
+        $this->middleWares[] = $middleWare;
+    }
+
+    /**
+     * used to return the appname of the set application
+     * @return string the name of your application
+     */
+    public function getAppName() {
+        return $this->query('AppName');
+    }
+
+    /**
+     * @deprecated use IUserSession->isLoggedIn()
+     * @return boolean
+     */
+    public function isLoggedIn() {
+        return \OC::$server->getUserSession()->isLoggedIn();
+    }
+
+    /**
+     * @deprecated use IGroupManager->isAdmin($userId)
+     * @return boolean
+     */
+    public function isAdminUser() {
+        $uid = $this->getUserId();
+        return \OC_User::isAdminUser($uid);
+    }
+
+    private function getUserId() {
+        return $this->getServer()->getSession()->get('user_id');
+    }
+
+    /**
+     * @deprecated use the ILogger instead
+     * @param string $message
+     * @param string $level
+     * @return mixed
+     */
+    public function log($message, $level) {
+        switch($level){
+            case 'debug':
+                $level = ILogger::DEBUG;
+                break;
+            case 'info':
+                $level = ILogger::INFO;
+                break;
+            case 'warn':
+                $level = ILogger::WARN;
+                break;
+            case 'fatal':
+                $level = ILogger::FATAL;
+                break;
+            default:
+                $level = ILogger::ERROR;
+                break;
+        }
+        \OCP\Util::writeLog($this->getAppName(), $message, $level);
+    }
+
+    /**
+     * Register a capability
+     *
+     * @param string $serviceName e.g. 'OCA\Files\Capabilities'
+     */
+    public function registerCapability($serviceName) {
+        $this->query('OC\CapabilitiesManager')->registerCapability(function() use ($serviceName) {
+            return $this->query($serviceName);
+        });
+    }
+
+    public function query(string $name, bool $autoload = true) {
+        try {
+            return $this->queryNoFallback($name);
+        } catch (QueryException $firstException) {
+            try {
+                return $this->getServer()->query($name, $autoload);
+            } catch (QueryException $secondException) {
+                if ($firstException->getCode() === 1) {
+                    throw $secondException;
+                }
+                throw $firstException;
+            }
+        }
+    }
+
+    /**
+     * @param string $name
+     * @return mixed
+     * @throws QueryException if the query could not be resolved
+     */
+    public function queryNoFallback($name) {
+        $name = $this->sanitizeName($name);
+
+        if ($this->offsetExists($name)) {
+            return parent::query($name);
+        } else {
+            if ($this['AppName'] === 'settings' && strpos($name, 'OC\\Settings\\') === 0) {
+                return parent::query($name);
+            } else if ($this['AppName'] === 'core' && strpos($name, 'OC\\Core\\') === 0) {
+                return parent::query($name);
+            } else if (strpos($name, \OC\AppFramework\App::buildAppNamespace($this['AppName']) . '\\') === 0) {
+                return parent::query($name);
+            }
+        }
+
+        throw new QueryException('Could not resolve ' . $name . '!' .
+            ' Class can not be instantiated', 1);
+    }
 }