nextcloud / server

lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php

Spacing +1 added lines, -1 removed lines

@@ -247,7 +247,7 @@
 	public function afterException($controller, $methodName, \Exception $exception): Response {
 		if ($exception instanceof SecurityException) {
 			if ($exception instanceof StrictCookieMissingException) {
-				return new RedirectResponse(\OC::$WEBROOT . '/');
+				return new RedirectResponse(\OC::$WEBROOT.'/');
 			}
 			if (stripos($this->request->getHeader('Accept'), 'html') === false) {
 				$response = new JSONResponse(

Indentation +201 added lines, -201 removed lines

@@ -55,145 +55,145 @@ 
  * check fails
  */
 class SecurityMiddleware extends Middleware {
-	private ?bool $isAdminUser = null;
-	private ?bool $isSubAdmin = null;
+    private ?bool $isAdminUser = null;
+    private ?bool $isSubAdmin = null;
 
-	public function __construct(
-		private readonly IRequest $request,
-		private readonly MiddlewareUtils $middlewareUtils,
-		private readonly INavigationManager $navigationManager,
-		private readonly IURLGenerator $urlGenerator,
-		private readonly LoggerInterface $logger,
-		private readonly string $appName,
-		private readonly bool $isLoggedIn,
-		private readonly IGroupManager $groupManager,
-		private readonly ISubAdmin $subAdminManager,
-		private readonly IAppManager $appManager,
-		private readonly IL10N $l10n,
-		private readonly AuthorizedGroupMapper $groupAuthorizationMapper,
-		private readonly IUserSession $userSession,
-		private readonly IRemoteAddress $remoteAddress,
-	) {
-	}
+    public function __construct(
+        private readonly IRequest $request,
+        private readonly MiddlewareUtils $middlewareUtils,
+        private readonly INavigationManager $navigationManager,
+        private readonly IURLGenerator $urlGenerator,
+        private readonly LoggerInterface $logger,
+        private readonly string $appName,
+        private readonly bool $isLoggedIn,
+        private readonly IGroupManager $groupManager,
+        private readonly ISubAdmin $subAdminManager,
+        private readonly IAppManager $appManager,
+        private readonly IL10N $l10n,
+        private readonly AuthorizedGroupMapper $groupAuthorizationMapper,
+        private readonly IUserSession $userSession,
+        private readonly IRemoteAddress $remoteAddress,
+    ) {
+    }
 
-	private function isAdminUser(): bool {
-		if ($this->isAdminUser === null) {
-			$user = $this->userSession->getUser();
-			$this->isAdminUser = $user && $this->groupManager->isAdmin($user->getUID());
-		}
-		return $this->isAdminUser;
-	}
+    private function isAdminUser(): bool {
+        if ($this->isAdminUser === null) {
+            $user = $this->userSession->getUser();
+            $this->isAdminUser = $user && $this->groupManager->isAdmin($user->getUID());
+        }
+        return $this->isAdminUser;
+    }
 
-	private function isSubAdmin(): bool {
-		if ($this->isSubAdmin === null) {
-			$user = $this->userSession->getUser();
-			$this->isSubAdmin = $user && $this->subAdminManager->isSubAdmin($user);
-		}
-		return $this->isSubAdmin;
-	}
+    private function isSubAdmin(): bool {
+        if ($this->isSubAdmin === null) {
+            $user = $this->userSession->getUser();
+            $this->isSubAdmin = $user && $this->subAdminManager->isSubAdmin($user);
+        }
+        return $this->isSubAdmin;
+    }
 
-	/**
-	 * This runs all the security checks before a method call. The
-	 * security checks are determined by inspecting the controller method
-	 * annotations
-	 *
-	 * @param Controller $controller the controller
-	 * @param string $methodName the name of the method
-	 * @throws SecurityException when a security check fails
-	 *
-	 * @suppress PhanUndeclaredClassConstant
-	 */
-	public function beforeController($controller, $methodName) {
-		// this will set the current navigation entry of the app, use this only
-		// for normal HTML requests and not for AJAX requests
-		$this->navigationManager->setActiveEntry($this->appName);
+    /**
+     * This runs all the security checks before a method call. The
+     * security checks are determined by inspecting the controller method
+     * annotations
+     *
+     * @param Controller $controller the controller
+     * @param string $methodName the name of the method
+     * @throws SecurityException when a security check fails
+     *
+     * @suppress PhanUndeclaredClassConstant
+     */
+    public function beforeController($controller, $methodName) {
+        // this will set the current navigation entry of the app, use this only
+        // for normal HTML requests and not for AJAX requests
+        $this->navigationManager->setActiveEntry($this->appName);
 
-		if (get_class($controller) === \OCA\Talk\Controller\PageController::class && $methodName === 'showCall') {
-			$this->navigationManager->setActiveEntry('spreed');
-		}
+        if (get_class($controller) === \OCA\Talk\Controller\PageController::class && $methodName === 'showCall') {
+            $this->navigationManager->setActiveEntry('spreed');
+        }
 
-		$reflectionMethod = new ReflectionMethod($controller, $methodName);
+        $reflectionMethod = new ReflectionMethod($controller, $methodName);
 
-		// security checks
-		$isPublicPage = $this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'PublicPage', PublicPage::class);
+        // security checks
+        $isPublicPage = $this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'PublicPage', PublicPage::class);
 
-		if ($this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'ExAppRequired', ExAppRequired::class)) {
-			if (!$this->userSession instanceof Session || $this->userSession->getSession()->get('app_api') !== true) {
-				throw new ExAppRequiredException();
-			}
-		} elseif (!$isPublicPage) {
-			$authorized = false;
-			if ($this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, null, AppApiAdminAccessWithoutUser::class)) {
-				// this attribute allows ExApp to access admin endpoints only if "userId" is "null"
-				if ($this->userSession instanceof Session && $this->userSession->getSession()->get('app_api') === true && $this->userSession->getUser() === null) {
-					$authorized = true;
-				}
-			}
+        if ($this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'ExAppRequired', ExAppRequired::class)) {
+            if (!$this->userSession instanceof Session || $this->userSession->getSession()->get('app_api') !== true) {
+                throw new ExAppRequiredException();
+            }
+        } elseif (!$isPublicPage) {
+            $authorized = false;
+            if ($this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, null, AppApiAdminAccessWithoutUser::class)) {
+                // this attribute allows ExApp to access admin endpoints only if "userId" is "null"
+                if ($this->userSession instanceof Session && $this->userSession->getSession()->get('app_api') === true && $this->userSession->getUser() === null) {
+                    $authorized = true;
+                }
+            }
 
-			if (!$authorized && !$this->isLoggedIn) {
-				throw new NotLoggedInException();
-			}
+            if (!$authorized && !$this->isLoggedIn) {
+                throw new NotLoggedInException();
+            }
 
-			if (!$authorized && $this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'AuthorizedAdminSetting', AuthorizedAdminSetting::class)) {
-				$authorized = $this->isAdminUser();
+            if (!$authorized && $this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'AuthorizedAdminSetting', AuthorizedAdminSetting::class)) {
+                $authorized = $this->isAdminUser();
 
-				if (!$authorized && $this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'SubAdminRequired', SubAdminRequired::class)) {
-					$authorized = $this->isSubAdmin();
-				}
+                if (!$authorized && $this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'SubAdminRequired', SubAdminRequired::class)) {
+                    $authorized = $this->isSubAdmin();
+                }
 
-				if (!$authorized) {
-					$settingClasses = $this->middlewareUtils->getAuthorizedAdminSettingClasses($reflectionMethod);
-					$authorizedClasses = $this->groupAuthorizationMapper->findAllClassesForUser($this->userSession->getUser());
-					foreach ($settingClasses as $settingClass) {
-						$authorized = in_array($settingClass, $authorizedClasses, true);
+                if (!$authorized) {
+                    $settingClasses = $this->middlewareUtils->getAuthorizedAdminSettingClasses($reflectionMethod);
+                    $authorizedClasses = $this->groupAuthorizationMapper->findAllClassesForUser($this->userSession->getUser());
+                    foreach ($settingClasses as $settingClass) {
+                        $authorized = in_array($settingClass, $authorizedClasses, true);
 
-						if ($authorized) {
-							break;
-						}
-					}
-				}
-				if (!$authorized) {
-					throw new NotAdminException($this->l10n->t('Logged in account must be an admin, a sub admin or gotten special right to access this setting'));
-				}
-				if (!$this->remoteAddress->allowsAdminActions()) {
-					throw new AdminIpNotAllowedException($this->l10n->t('Your current IP address doesn\'t allow you to perform admin actions'));
-				}
-			}
-			if ($this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'SubAdminRequired', SubAdminRequired::class)
-				&& !$this->isSubAdmin()
-				&& !$this->isAdminUser()
-				&& !$authorized) {
-				throw new NotAdminException($this->l10n->t('Logged in account must be an admin or sub admin'));
-			}
-			if (!$this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'SubAdminRequired', SubAdminRequired::class)
-				&& !$this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'NoAdminRequired', NoAdminRequired::class)
-				&& !$this->isAdminUser()
-				&& !$authorized) {
-				throw new NotAdminException($this->l10n->t('Logged in account must be an admin'));
-			}
-			if ($this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'SubAdminRequired', SubAdminRequired::class)
-				&& !$this->remoteAddress->allowsAdminActions()) {
-				throw new AdminIpNotAllowedException($this->l10n->t('Your current IP address doesn\'t allow you to perform admin actions'));
-			}
-			if (!$this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'SubAdminRequired', SubAdminRequired::class)
-				&& !$this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'NoAdminRequired', NoAdminRequired::class)
-				&& !$this->remoteAddress->allowsAdminActions()) {
-				throw new AdminIpNotAllowedException($this->l10n->t('Your current IP address doesn\'t allow you to perform admin actions'));
-			}
+                        if ($authorized) {
+                            break;
+                        }
+                    }
+                }
+                if (!$authorized) {
+                    throw new NotAdminException($this->l10n->t('Logged in account must be an admin, a sub admin or gotten special right to access this setting'));
+                }
+                if (!$this->remoteAddress->allowsAdminActions()) {
+                    throw new AdminIpNotAllowedException($this->l10n->t('Your current IP address doesn\'t allow you to perform admin actions'));
+                }
+            }
+            if ($this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'SubAdminRequired', SubAdminRequired::class)
+                && !$this->isSubAdmin()
+                && !$this->isAdminUser()
+                && !$authorized) {
+                throw new NotAdminException($this->l10n->t('Logged in account must be an admin or sub admin'));
+            }
+            if (!$this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'SubAdminRequired', SubAdminRequired::class)
+                && !$this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'NoAdminRequired', NoAdminRequired::class)
+                && !$this->isAdminUser()
+                && !$authorized) {
+                throw new NotAdminException($this->l10n->t('Logged in account must be an admin'));
+            }
+            if ($this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'SubAdminRequired', SubAdminRequired::class)
+                && !$this->remoteAddress->allowsAdminActions()) {
+                throw new AdminIpNotAllowedException($this->l10n->t('Your current IP address doesn\'t allow you to perform admin actions'));
+            }
+            if (!$this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'SubAdminRequired', SubAdminRequired::class)
+                && !$this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'NoAdminRequired', NoAdminRequired::class)
+                && !$this->remoteAddress->allowsAdminActions()) {
+                throw new AdminIpNotAllowedException($this->l10n->t('Your current IP address doesn\'t allow you to perform admin actions'));
+            }
 
-		}
+        }
 
-		// Check for strict cookie requirement
-		if ($this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'StrictCookieRequired', StrictCookiesRequired::class)
-			|| !$this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'NoCSRFRequired', NoCSRFRequired::class)) {
-			if (!$this->request->passesStrictCookieCheck()) {
-				throw new StrictCookieMissingException();
-			}
-		}
-		// CSRF check - also registers the CSRF token since the session may be closed later
-		Util::callRegister();
-		if ($this->isInvalidCSRFRequired($reflectionMethod)) {
-			/*
+        // Check for strict cookie requirement
+        if ($this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'StrictCookieRequired', StrictCookiesRequired::class)
+            || !$this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'NoCSRFRequired', NoCSRFRequired::class)) {
+            if (!$this->request->passesStrictCookieCheck()) {
+                throw new StrictCookieMissingException();
+            }
+        }
+        // CSRF check - also registers the CSRF token since the session may be closed later
+        Util::callRegister();
+        if ($this->isInvalidCSRFRequired($reflectionMethod)) {
+            /*
 			 * Only allow the CSRF check to fail on OCS Requests. This kind of
 			 * hacks around that we have no full token auth in place yet and we
 			 * do want to offer CSRF checks for web requests.
@@ -201,89 +201,89 @@ 
 			 * Additionally we allow Bearer authenticated requests to pass on OCS routes.
 			 * This allows oauth apps (e.g. moodle) to use the OCS endpoints
 			 */
-			if (!$controller instanceof OCSController || !$this->isValidOCSRequest()) {
-				throw new CrossSiteRequestForgeryException();
-			}
-		}
+            if (!$controller instanceof OCSController || !$this->isValidOCSRequest()) {
+                throw new CrossSiteRequestForgeryException();
+            }
+        }
 
-		/**
-		 * Checks if app is enabled (also includes a check whether user is allowed to access the resource)
-		 * The getAppPath() check is here since components such as settings also use the AppFramework and
-		 * therefore won't pass this check.
-		 * If page is public, app does not need to be enabled for current user/visitor
-		 */
-		try {
-			$appPath = $this->appManager->getAppPath($this->appName);
-		} catch (AppPathNotFoundException $e) {
-			$appPath = false;
-		}
+        /**
+         * Checks if app is enabled (also includes a check whether user is allowed to access the resource)
+         * The getAppPath() check is here since components such as settings also use the AppFramework and
+         * therefore won't pass this check.
+         * If page is public, app does not need to be enabled for current user/visitor
+         */
+        try {
+            $appPath = $this->appManager->getAppPath($this->appName);
+        } catch (AppPathNotFoundException $e) {
+            $appPath = false;
+        }
 
-		if ($appPath !== false && !$isPublicPage && !$this->appManager->isEnabledForUser($this->appName)) {
-			throw new AppNotEnabledException();
-		}
-	}
+        if ($appPath !== false && !$isPublicPage && !$this->appManager->isEnabledForUser($this->appName)) {
+            throw new AppNotEnabledException();
+        }
+    }
 
-	private function isInvalidCSRFRequired(ReflectionMethod $reflectionMethod): bool {
-		if ($this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'NoCSRFRequired', NoCSRFRequired::class)) {
-			return false;
-		}
+    private function isInvalidCSRFRequired(ReflectionMethod $reflectionMethod): bool {
+        if ($this->middlewareUtils->hasAnnotationOrAttribute($reflectionMethod, 'NoCSRFRequired', NoCSRFRequired::class)) {
+            return false;
+        }
 
-		return !$this->request->passesCSRFCheck();
-	}
+        return !$this->request->passesCSRFCheck();
+    }
 
-	private function isValidOCSRequest(): bool {
-		return $this->request->getHeader('OCS-APIREQUEST') === 'true'
-			|| str_starts_with($this->request->getHeader('Authorization'), 'Bearer ');
-	}
+    private function isValidOCSRequest(): bool {
+        return $this->request->getHeader('OCS-APIREQUEST') === 'true'
+            || str_starts_with($this->request->getHeader('Authorization'), 'Bearer ');
+    }
 
-	/**
-	 * If an SecurityException is being caught, ajax requests return a JSON error
-	 * response and non ajax requests redirect to the index
-	 *
-	 * @param Controller $controller the controller that is being called
-	 * @param string $methodName the name of the method that will be called on
-	 *                           the controller
-	 * @param \Exception $exception the thrown exception
-	 * @return Response a Response object or null in case that the exception could not be handled
-	 * @throws \Exception the passed in exception if it can't handle it
-	 */
-	public function afterException($controller, $methodName, \Exception $exception): Response {
-		if ($exception instanceof SecurityException) {
-			if ($exception instanceof StrictCookieMissingException) {
-				return new RedirectResponse(\OC::$WEBROOT . '/');
-			}
-			if (stripos($this->request->getHeader('Accept'), 'html') === false) {
-				$response = new JSONResponse(
-					['message' => $exception->getMessage()],
-					$exception->getCode()
-				);
-			} else {
-				if ($exception instanceof NotLoggedInException) {
-					$params = [];
-					if (isset($this->request->server['REQUEST_URI'])) {
-						$params['redirect_url'] = $this->request->server['REQUEST_URI'];
-					}
-					$usernamePrefill = $this->request->getParam('user', '');
-					if ($usernamePrefill !== '') {
-						$params['user'] = $usernamePrefill;
-					}
-					if ($this->request->getParam('direct')) {
-						$params['direct'] = 1;
-					}
-					$url = $this->urlGenerator->linkToRoute('core.login.showLoginForm', $params);
-					$response = new RedirectResponse($url);
-				} else {
-					$response = new TemplateResponse('core', '403', ['message' => $exception->getMessage()], 'guest');
-					$response->setStatus($exception->getCode());
-				}
-			}
+    /**
+     * If an SecurityException is being caught, ajax requests return a JSON error
+     * response and non ajax requests redirect to the index
+     *
+     * @param Controller $controller the controller that is being called
+     * @param string $methodName the name of the method that will be called on
+     *                           the controller
+     * @param \Exception $exception the thrown exception
+     * @return Response a Response object or null in case that the exception could not be handled
+     * @throws \Exception the passed in exception if it can't handle it
+     */
+    public function afterException($controller, $methodName, \Exception $exception): Response {
+        if ($exception instanceof SecurityException) {
+            if ($exception instanceof StrictCookieMissingException) {
+                return new RedirectResponse(\OC::$WEBROOT . '/');
+            }
+            if (stripos($this->request->getHeader('Accept'), 'html') === false) {
+                $response = new JSONResponse(
+                    ['message' => $exception->getMessage()],
+                    $exception->getCode()
+                );
+            } else {
+                if ($exception instanceof NotLoggedInException) {
+                    $params = [];
+                    if (isset($this->request->server['REQUEST_URI'])) {
+                        $params['redirect_url'] = $this->request->server['REQUEST_URI'];
+                    }
+                    $usernamePrefill = $this->request->getParam('user', '');
+                    if ($usernamePrefill !== '') {
+                        $params['user'] = $usernamePrefill;
+                    }
+                    if ($this->request->getParam('direct')) {
+                        $params['direct'] = 1;
+                    }
+                    $url = $this->urlGenerator->linkToRoute('core.login.showLoginForm', $params);
+                    $response = new RedirectResponse($url);
+                } else {
+                    $response = new TemplateResponse('core', '403', ['message' => $exception->getMessage()], 'guest');
+                    $response->setStatus($exception->getCode());
+                }
+            }
 
-			$this->logger->debug($exception->getMessage(), [
-				'exception' => $exception,
-			]);
-			return $response;
-		}
+            $this->logger->debug($exception->getMessage(), [
+                'exception' => $exception,
+            ]);
+            return $response;
+        }
 
-		throw $exception;
-	}
+        throw $exception;
+    }
 }

tests/Core/Middleware/TwoFactorMiddlewareTest.php

Indentation +252 added lines, -252 removed lines

@@ -38,271 +38,271 @@
 use Test\TestCase;
 
 class HasTwoFactorAnnotationController extends Controller {
-	#[NoTwoFactorRequired]
-	public function index(): Response {
-		return new Response();
-	}
+    #[NoTwoFactorRequired]
+    public function index(): Response {
+        return new Response();
+    }
 }
 
 class LoginSetupController extends ALoginSetupController {
-	public function index(): Response {
-		return new Response();
-	}
+    public function index(): Response {
+        return new Response();
+    }
 }
 
 class NoTwoFactorAnnotationController extends Controller {
-	public function index(): Response {
-		return new Response();
-	}
+    public function index(): Response {
+        return new Response();
+    }
 }
 
 class NoTwoFactorChallengeAnnotationController extends TwoFactorChallengeController {
-	public function index(): Response {
-		return new Response();
-	}
+    public function index(): Response {
+        return new Response();
+    }
 }
 
 class HasTwoFactorSetUpDoneAnnotationController extends TwoFactorChallengeController {
-	#[TwoFactorSetUpDoneRequired]
-	public function index(): Response {
-		return new Response();
-	}
+    #[TwoFactorSetUpDoneRequired]
+    public function index(): Response {
+        return new Response();
+    }
 }
 
 class TwoFactorMiddlewareTest extends TestCase {
-	private Manager&MockObject $twoFactorManager;
-	private IUserSession&MockObject $userSession;
-	private ISession&MockObject $session;
-	private IURLGenerator&MockObject $urlGenerator;
-	private ControllerMethodReflector&MockObject $reflector;
-	private IRequest $request;
-	private TwoFactorMiddleware $middleware;
-	private LoggerInterface&MockObject $logger;
-
-	protected function setUp(): void {
-		parent::setUp();
-
-		$this->twoFactorManager = $this->getMockBuilder(Manager::class)
-			->disableOriginalConstructor()
-			->getMock();
-		$this->userSession = $this->getMockBuilder(Session::class)
-			->disableOriginalConstructor()
-			->getMock();
-		$this->session = $this->createMock(ISession::class);
-		$this->urlGenerator = $this->createMock(IURLGenerator::class);
-		$this->reflector = $this->createMock(ControllerMethodReflector::class);
-		$this->logger = $this->createMock(LoggerInterface::class);
-		$this->request = new Request(
-			[
-				'server' => [
-					'REQUEST_URI' => 'test/url'
-				]
-			],
-			$this->createMock(IRequestId::class),
-			$this->createMock(IConfig::class)
-		);
-
-		$this->middleware = new TwoFactorMiddleware($this->twoFactorManager, $this->userSession, $this->session, $this->urlGenerator, new MiddlewareUtils($this->reflector, $this->logger), $this->request);
-	}
-
-	public function testBeforeControllerNotLoggedIn(): void {
-		$this->userSession->expects($this->once())
-			->method('isLoggedIn')
-			->willReturn(false);
-
-		$this->userSession->expects($this->never())
-			->method('getUser');
-
-		$controller = $this->getMockBuilder(NoTwoFactorAnnotationController::class)
-			->disableOriginalConstructor()
-			->getMock();
-		$this->middleware->beforeController($controller, 'index');
-	}
-
-	public function testBeforeSetupController(): void {
-		$user = $this->createMock(IUser::class);
-		$this->userSession->expects($this->any())
-			->method('getUser')
-			->willReturn($user);
-		$this->twoFactorManager->expects($this->once())
-			->method('needsSecondFactor')
-			->willReturn(true);
-		$this->userSession->expects($this->never())
-			->method('isLoggedIn');
-
-		$this->middleware->beforeController(new LoginSetupController('foo', $this->request), 'index');
-	}
-
-	public function testBeforeControllerNoTwoFactorCheckNeeded(): void {
-		$user = $this->createMock(IUser::class);
-
-		$this->userSession->expects($this->once())
-			->method('isLoggedIn')
-			->willReturn(true);
-		$this->userSession->expects($this->once())
-			->method('getUser')
-			->willReturn($user);
-		$this->twoFactorManager->expects($this->once())
-			->method('isTwoFactorAuthenticated')
-			->with($user)
-			->willReturn(false);
-
-		$controller = $this->getMockBuilder(NoTwoFactorAnnotationController::class)
-			->disableOriginalConstructor()
-			->getMock();
-		$this->middleware->beforeController($controller, 'index');
-	}
-
-
-	public function testBeforeControllerTwoFactorAuthRequired(): void {
-		$this->expectException(TwoFactorAuthRequiredException::class);
-
-		$user = $this->createMock(IUser::class);
-
-		$this->userSession->expects($this->once())
-			->method('isLoggedIn')
-			->willReturn(true);
-		$this->userSession->expects($this->once())
-			->method('getUser')
-			->willReturn($user);
-		$this->twoFactorManager->expects($this->once())
-			->method('isTwoFactorAuthenticated')
-			->with($user)
-			->willReturn(true);
-		$this->twoFactorManager->expects($this->once())
-			->method('needsSecondFactor')
-			->with($user)
-			->willReturn(true);
-
-		$controller = $this->getMockBuilder(NoTwoFactorAnnotationController::class)
-			->disableOriginalConstructor()
-			->getMock();
-		$this->middleware->beforeController($controller, 'index');
-	}
-
-
-	public function testBeforeControllerUserAlreadyLoggedIn(): void {
-		$this->expectException(UserAlreadyLoggedInException::class);
-
-		$user = $this->createMock(IUser::class);
-
-		$this->userSession->expects($this->once())
-			->method('isLoggedIn')
-			->willReturn(true);
-		$this->userSession
-			->method('getUser')
-			->willReturn($user);
-		$this->twoFactorManager->expects($this->once())
-			->method('isTwoFactorAuthenticated')
-			->with($user)
-			->willReturn(true);
-		$this->twoFactorManager->expects($this->once())
-			->method('needsSecondFactor')
-			->with($user)
-			->willReturn(false);
-
-		$twoFactorChallengeController = $this->getMockBuilder(NoTwoFactorChallengeAnnotationController::class)
-			->disableOriginalConstructor()
-			->getMock();
-		$this->middleware->beforeController($twoFactorChallengeController, 'index');
-	}
-
-	public function testAfterExceptionTwoFactorAuthRequired(): void {
-		$ex = new TwoFactorAuthRequiredException();
-
-		$this->urlGenerator->expects($this->once())
-			->method('linkToRoute')
-			->with('core.TwoFactorChallenge.selectChallenge')
-			->willReturn('test/url');
-		$expected = new RedirectResponse('test/url');
-
-		$controller = new HasTwoFactorAnnotationController('foo', $this->request);
-		$this->assertEquals($expected, $this->middleware->afterException($controller, 'index', $ex));
-	}
-
-	public function testAfterException(): void {
-		$ex = new UserAlreadyLoggedInException();
-
-		$this->urlGenerator->expects($this->once())
-			->method('linkToRoute')
-			->with('files.view.index')
-			->willReturn('redirect/url');
-		$expected = new RedirectResponse('redirect/url');
-
-		$controller = new HasTwoFactorAnnotationController('foo', $this->request);
-		$this->assertEquals($expected, $this->middleware->afterException($controller, 'index', $ex));
-	}
-
-	public function testRequires2FASetupDoneAnnotated(): void {
-		$user = $this->createMock(IUser::class);
-
-		$this->userSession->expects($this->once())
-			->method('isLoggedIn')
-			->willReturn(true);
-		$this->userSession
-			->method('getUser')
-			->willReturn($user);
-		$this->twoFactorManager->expects($this->once())
-			->method('isTwoFactorAuthenticated')
-			->with($user)
-			->willReturn(true);
-		$this->twoFactorManager->expects($this->once())
-			->method('needsSecondFactor')
-			->with($user)
-			->willReturn(false);
-
-		$this->expectException(UserAlreadyLoggedInException::class);
-
-		$controller = $this->getMockBuilder(HasTwoFactorSetUpDoneAnnotationController::class)
-			->disableOriginalConstructor()
-			->getMock();
-		$this->middleware->beforeController($controller, 'index');
-	}
-
-	public static function dataRequires2FASetupDone(): array {
-		return [
-			[false, false, false],
-			[false,  true,  true],
-			[true, false, true],
-			[true, true,  true],
-		];
-	}
-
-	#[DataProvider('dataRequires2FASetupDone')]
-	public function testRequires2FASetupDone(bool $hasProvider, bool $missingProviders, bool $expectEception): void {
-		if ($hasProvider) {
-			$provider = $this->createMock(IProvider::class);
-			$provider->method('getId')
-				->willReturn('2FAftw');
-			$providers = [$provider];
-		} else {
-			$providers = [];
-		}
-
-
-		$user = $this->createMock(IUser::class);
-
-		$this->userSession
-			->method('getUser')
-			->willReturn($user);
-		$providerSet = new ProviderSet($providers, $missingProviders);
-		$this->twoFactorManager->method('getProviderSet')
-			->with($user)
-			->willReturn($providerSet);
-		$this->userSession
-			->method('isLoggedIn')
-			->willReturn(false);
-
-		if ($expectEception) {
-			$this->expectException(TwoFactorAuthRequiredException::class);
-		} else {
-			// hack to make phpunit shut up. Since we don't expect an exception here...
-			$this->assertTrue(true);
-		}
-
-		$controller = $this->getMockBuilder(NoTwoFactorChallengeAnnotationController::class)
-			->disableOriginalConstructor()
-			->getMock();
-		$this->middleware->beforeController($controller, 'index');
-	}
+    private Manager&MockObject $twoFactorManager;
+    private IUserSession&MockObject $userSession;
+    private ISession&MockObject $session;
+    private IURLGenerator&MockObject $urlGenerator;
+    private ControllerMethodReflector&MockObject $reflector;
+    private IRequest $request;
+    private TwoFactorMiddleware $middleware;
+    private LoggerInterface&MockObject $logger;
+
+    protected function setUp(): void {
+        parent::setUp();
+
+        $this->twoFactorManager = $this->getMockBuilder(Manager::class)
+            ->disableOriginalConstructor()
+            ->getMock();
+        $this->userSession = $this->getMockBuilder(Session::class)
+            ->disableOriginalConstructor()
+            ->getMock();
+        $this->session = $this->createMock(ISession::class);
+        $this->urlGenerator = $this->createMock(IURLGenerator::class);
+        $this->reflector = $this->createMock(ControllerMethodReflector::class);
+        $this->logger = $this->createMock(LoggerInterface::class);
+        $this->request = new Request(
+            [
+                'server' => [
+                    'REQUEST_URI' => 'test/url'
+                ]
+            ],
+            $this->createMock(IRequestId::class),
+            $this->createMock(IConfig::class)
+        );
+
+        $this->middleware = new TwoFactorMiddleware($this->twoFactorManager, $this->userSession, $this->session, $this->urlGenerator, new MiddlewareUtils($this->reflector, $this->logger), $this->request);
+    }
+
+    public function testBeforeControllerNotLoggedIn(): void {
+        $this->userSession->expects($this->once())
+            ->method('isLoggedIn')
+            ->willReturn(false);
+
+        $this->userSession->expects($this->never())
+            ->method('getUser');
+
+        $controller = $this->getMockBuilder(NoTwoFactorAnnotationController::class)
+            ->disableOriginalConstructor()
+            ->getMock();
+        $this->middleware->beforeController($controller, 'index');
+    }
+
+    public function testBeforeSetupController(): void {
+        $user = $this->createMock(IUser::class);
+        $this->userSession->expects($this->any())
+            ->method('getUser')
+            ->willReturn($user);
+        $this->twoFactorManager->expects($this->once())
+            ->method('needsSecondFactor')
+            ->willReturn(true);
+        $this->userSession->expects($this->never())
+            ->method('isLoggedIn');
+
+        $this->middleware->beforeController(new LoginSetupController('foo', $this->request), 'index');
+    }
+
+    public function testBeforeControllerNoTwoFactorCheckNeeded(): void {
+        $user = $this->createMock(IUser::class);
+
+        $this->userSession->expects($this->once())
+            ->method('isLoggedIn')
+            ->willReturn(true);
+        $this->userSession->expects($this->once())
+            ->method('getUser')
+            ->willReturn($user);
+        $this->twoFactorManager->expects($this->once())
+            ->method('isTwoFactorAuthenticated')
+            ->with($user)
+            ->willReturn(false);
+
+        $controller = $this->getMockBuilder(NoTwoFactorAnnotationController::class)
+            ->disableOriginalConstructor()
+            ->getMock();
+        $this->middleware->beforeController($controller, 'index');
+    }
+
+
+    public function testBeforeControllerTwoFactorAuthRequired(): void {
+        $this->expectException(TwoFactorAuthRequiredException::class);
+
+        $user = $this->createMock(IUser::class);
+
+        $this->userSession->expects($this->once())
+            ->method('isLoggedIn')
+            ->willReturn(true);
+        $this->userSession->expects($this->once())
+            ->method('getUser')
+            ->willReturn($user);
+        $this->twoFactorManager->expects($this->once())
+            ->method('isTwoFactorAuthenticated')
+            ->with($user)
+            ->willReturn(true);
+        $this->twoFactorManager->expects($this->once())
+            ->method('needsSecondFactor')
+            ->with($user)
+            ->willReturn(true);
+
+        $controller = $this->getMockBuilder(NoTwoFactorAnnotationController::class)
+            ->disableOriginalConstructor()
+            ->getMock();
+        $this->middleware->beforeController($controller, 'index');
+    }
+
+
+    public function testBeforeControllerUserAlreadyLoggedIn(): void {
+        $this->expectException(UserAlreadyLoggedInException::class);
+
+        $user = $this->createMock(IUser::class);
+
+        $this->userSession->expects($this->once())
+            ->method('isLoggedIn')
+            ->willReturn(true);
+        $this->userSession
+            ->method('getUser')
+            ->willReturn($user);
+        $this->twoFactorManager->expects($this->once())
+            ->method('isTwoFactorAuthenticated')
+            ->with($user)
+            ->willReturn(true);
+        $this->twoFactorManager->expects($this->once())
+            ->method('needsSecondFactor')
+            ->with($user)
+            ->willReturn(false);
+
+        $twoFactorChallengeController = $this->getMockBuilder(NoTwoFactorChallengeAnnotationController::class)
+            ->disableOriginalConstructor()
+            ->getMock();
+        $this->middleware->beforeController($twoFactorChallengeController, 'index');
+    }
+
+    public function testAfterExceptionTwoFactorAuthRequired(): void {
+        $ex = new TwoFactorAuthRequiredException();
+
+        $this->urlGenerator->expects($this->once())
+            ->method('linkToRoute')
+            ->with('core.TwoFactorChallenge.selectChallenge')
+            ->willReturn('test/url');
+        $expected = new RedirectResponse('test/url');
+
+        $controller = new HasTwoFactorAnnotationController('foo', $this->request);
+        $this->assertEquals($expected, $this->middleware->afterException($controller, 'index', $ex));
+    }
+
+    public function testAfterException(): void {
+        $ex = new UserAlreadyLoggedInException();
+
+        $this->urlGenerator->expects($this->once())
+            ->method('linkToRoute')
+            ->with('files.view.index')
+            ->willReturn('redirect/url');
+        $expected = new RedirectResponse('redirect/url');
+
+        $controller = new HasTwoFactorAnnotationController('foo', $this->request);
+        $this->assertEquals($expected, $this->middleware->afterException($controller, 'index', $ex));
+    }
+
+    public function testRequires2FASetupDoneAnnotated(): void {
+        $user = $this->createMock(IUser::class);
+
+        $this->userSession->expects($this->once())
+            ->method('isLoggedIn')
+            ->willReturn(true);
+        $this->userSession
+            ->method('getUser')
+            ->willReturn($user);
+        $this->twoFactorManager->expects($this->once())
+            ->method('isTwoFactorAuthenticated')
+            ->with($user)
+            ->willReturn(true);
+        $this->twoFactorManager->expects($this->once())
+            ->method('needsSecondFactor')
+            ->with($user)
+            ->willReturn(false);
+
+        $this->expectException(UserAlreadyLoggedInException::class);
+
+        $controller = $this->getMockBuilder(HasTwoFactorSetUpDoneAnnotationController::class)
+            ->disableOriginalConstructor()
+            ->getMock();
+        $this->middleware->beforeController($controller, 'index');
+    }
+
+    public static function dataRequires2FASetupDone(): array {
+        return [
+            [false, false, false],
+            [false,  true,  true],
+            [true, false, true],
+            [true, true,  true],
+        ];
+    }
+
+    #[DataProvider('dataRequires2FASetupDone')]
+    public function testRequires2FASetupDone(bool $hasProvider, bool $missingProviders, bool $expectEception): void {
+        if ($hasProvider) {
+            $provider = $this->createMock(IProvider::class);
+            $provider->method('getId')
+                ->willReturn('2FAftw');
+            $providers = [$provider];
+        } else {
+            $providers = [];
+        }
+
+
+        $user = $this->createMock(IUser::class);
+
+        $this->userSession
+            ->method('getUser')
+            ->willReturn($user);
+        $providerSet = new ProviderSet($providers, $missingProviders);
+        $this->twoFactorManager->method('getProviderSet')
+            ->with($user)
+            ->willReturn($providerSet);
+        $this->userSession
+            ->method('isLoggedIn')
+            ->willReturn(false);
+
+        if ($expectEception) {
+            $this->expectException(TwoFactorAuthRequiredException::class);
+        } else {
+            // hack to make phpunit shut up. Since we don't expect an exception here...
+            $this->assertTrue(true);
+        }
+
+        $controller = $this->getMockBuilder(NoTwoFactorChallengeAnnotationController::class)
+            ->disableOriginalConstructor()
+            ->getMock();
+        $this->middleware->beforeController($controller, 'index');
+    }
 }

Spacing +2 added lines, -2 removed lines

@@ -262,9 +262,9 @@
 	public static function dataRequires2FASetupDone(): array {
 		return [
 			[false, false, false],
-			[false,  true,  true],
+			[false, true, true],
 			[true, false, true],
-			[true, true,  true],
+			[true, true, true],
 		];
 	}
 

tests/lib/AppFramework/Middleware/Security/CORSMiddlewareTest.php

Indentation +313 added lines, -313 removed lines

@@ -25,317 +25,317 @@
 use Test\AppFramework\Middleware\Security\Mock\CORSMiddlewareController;
 
 class CORSMiddlewareTest extends \Test\TestCase {
-	private ControllerMethodReflector $reflector;
-	private Session&MockObject $session;
-	private IThrottler&MockObject $throttler;
-	private CORSMiddlewareController $controller;
-	private LoggerInterface $logger;
-
-	protected function setUp(): void {
-		parent::setUp();
-		$this->reflector = new ControllerMethodReflector();
-		$this->session = $this->createMock(Session::class);
-		$this->throttler = $this->createMock(IThrottler::class);
-		$this->logger = $this->createMock(LoggerInterface::class);
-		$this->controller = new CORSMiddlewareController(
-			'test',
-			$this->createMock(IRequest::class)
-		);
-	}
-
-	public static function dataSetCORSAPIHeader(): array {
-		return [
-			['testSetCORSAPIHeader'],
-			['testSetCORSAPIHeaderAttribute'],
-		];
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataSetCORSAPIHeader')]
-	public function testSetCORSAPIHeader(string $method): void {
-		$request = new Request(
-			[
-				'server' => [
-					'HTTP_ORIGIN' => 'test'
-				]
-			],
-			$this->createMock(IRequestId::class),
-			$this->createMock(IConfig::class)
-		);
-		$this->reflector->reflect($this->controller, $method);
-		$middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
-
-		$response = $middleware->afterController($this->controller, $method, new Response());
-		$headers = $response->getHeaders();
-		$this->assertEquals('test', $headers['Access-Control-Allow-Origin']);
-	}
-
-	public function testNoAnnotationNoCORSHEADER(): void {
-		$request = new Request(
-			[
-				'server' => [
-					'HTTP_ORIGIN' => 'test'
-				]
-			],
-			$this->createMock(IRequestId::class),
-			$this->createMock(IConfig::class)
-		);
-		$middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
-
-		$response = $middleware->afterController($this->controller, __FUNCTION__, new Response());
-		$headers = $response->getHeaders();
-		$this->assertFalse(array_key_exists('Access-Control-Allow-Origin', $headers));
-	}
-
-	public static function dataNoOriginHeaderNoCORSHEADER(): array {
-		return [
-			['testNoOriginHeaderNoCORSHEADER'],
-			['testNoOriginHeaderNoCORSHEADERAttribute'],
-		];
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoOriginHeaderNoCORSHEADER')]
-	public function testNoOriginHeaderNoCORSHEADER(string $method): void {
-		$request = new Request(
-			[],
-			$this->createMock(IRequestId::class),
-			$this->createMock(IConfig::class)
-		);
-		$this->reflector->reflect($this->controller, $method);
-		$middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
-
-		$response = $middleware->afterController($this->controller, $method, new Response());
-		$headers = $response->getHeaders();
-		$this->assertFalse(array_key_exists('Access-Control-Allow-Origin', $headers));
-	}
-
-	public static function dataCorsIgnoredIfWithCredentialsHeaderPresent(): array {
-		return [
-			['testCorsIgnoredIfWithCredentialsHeaderPresent'],
-			['testCorsAttributeIgnoredIfWithCredentialsHeaderPresent'],
-		];
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataCorsIgnoredIfWithCredentialsHeaderPresent')]
-	public function testCorsIgnoredIfWithCredentialsHeaderPresent(string $method): void {
-		$this->expectException(SecurityException::class);
-
-		$request = new Request(
-			[
-				'server' => [
-					'HTTP_ORIGIN' => 'test'
-				]
-			],
-			$this->createMock(IRequestId::class),
-			$this->createMock(IConfig::class)
-		);
-		$this->reflector->reflect($this->controller, $method);
-		$middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler, $this->logger);
-
-		$response = new Response();
-		$response->addHeader('AcCess-control-Allow-Credentials ', 'TRUE');
-		$middleware->afterController($this->controller, $method, $response);
-	}
-
-	public static function dataNoCORSOnAnonymousPublicPage(): array {
-		return [
-			['testNoCORSOnAnonymousPublicPage'],
-			['testNoCORSOnAnonymousPublicPageAttribute'],
-			['testNoCORSAttributeOnAnonymousPublicPage'],
-			['testNoCORSAttributeOnAnonymousPublicPageAttribute'],
-		];
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoCORSOnAnonymousPublicPage')]
-	public function testNoCORSOnAnonymousPublicPage(string $method): void {
-		$request = new Request(
-			[],
-			$this->createMock(IRequestId::class),
-			$this->createMock(IConfig::class)
-		);
-		$this->reflector->reflect($this->controller, $method);
-		$middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler, $this->logger);
-		$this->session->expects($this->once())
-			->method('isLoggedIn')
-			->willReturn(false);
-		$this->session->expects($this->never())
-			->method('logout');
-		$this->session->expects($this->never())
-			->method('logClientIn')
-			->with($this->equalTo('user'), $this->equalTo('pass'))
-			->willReturn(true);
-		$this->reflector->reflect($this->controller, $method);
-
-		$middleware->beforeController($this->controller, $method);
-	}
-
-	public static function dataCORSShouldNeverAllowCookieAuth(): array {
-		return [
-			['testCORSShouldNeverAllowCookieAuth'],
-			['testCORSShouldNeverAllowCookieAuthAttribute'],
-			['testCORSAttributeShouldNeverAllowCookieAuth'],
-			['testCORSAttributeShouldNeverAllowCookieAuthAttribute'],
-		];
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataCORSShouldNeverAllowCookieAuth')]
-	public function testCORSShouldNeverAllowCookieAuth(string $method): void {
-		$request = new Request(
-			[],
-			$this->createMock(IRequestId::class),
-			$this->createMock(IConfig::class)
-		);
-		$this->reflector->reflect($this->controller, $method);
-		$middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
-		$this->session->expects($this->once())
-			->method('isLoggedIn')
-			->willReturn(true);
-		$this->session->expects($this->once())
-			->method('logout');
-		$this->session->expects($this->never())
-			->method('logClientIn')
-			->with($this->equalTo('user'), $this->equalTo('pass'))
-			->willReturn(true);
-
-		$this->expectException(SecurityException::class);
-		$middleware->beforeController($this->controller, $method);
-	}
-
-	public static function dataCORSShouldRelogin(): array {
-		return [
-			['testCORSShouldRelogin'],
-			['testCORSAttributeShouldRelogin'],
-		];
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataCORSShouldRelogin')]
-	public function testCORSShouldRelogin(string $method): void {
-		$request = new Request(
-			['server' => [
-				'PHP_AUTH_USER' => 'user',
-				'PHP_AUTH_PW' => 'pass'
-			]],
-			$this->createMock(IRequestId::class),
-			$this->createMock(IConfig::class)
-		);
-		$this->session->expects($this->once())
-			->method('logout');
-		$this->session->expects($this->once())
-			->method('logClientIn')
-			->with($this->equalTo('user'), $this->equalTo('pass'))
-			->willReturn(true);
-		$this->reflector->reflect($this->controller, $method);
-		$middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
-
-		$middleware->beforeController($this->controller, $method);
-	}
-
-	public static function dataCORSShouldFailIfPasswordLoginIsForbidden(): array {
-		return [
-			['testCORSShouldFailIfPasswordLoginIsForbidden'],
-			['testCORSAttributeShouldFailIfPasswordLoginIsForbidden'],
-		];
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataCORSShouldFailIfPasswordLoginIsForbidden')]
-	public function testCORSShouldFailIfPasswordLoginIsForbidden(string $method): void {
-		$this->expectException(SecurityException::class);
-
-		$request = new Request(
-			['server' => [
-				'PHP_AUTH_USER' => 'user',
-				'PHP_AUTH_PW' => 'pass'
-			]],
-			$this->createMock(IRequestId::class),
-			$this->createMock(IConfig::class)
-		);
-		$this->session->expects($this->once())
-			->method('logout');
-		$this->session->expects($this->once())
-			->method('logClientIn')
-			->with($this->equalTo('user'), $this->equalTo('pass'))
-			->willThrowException(new PasswordLoginForbiddenException);
-		$this->reflector->reflect($this->controller, $method);
-		$middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
-
-		$middleware->beforeController($this->controller, $method);
-	}
-
-	public static function dataCORSShouldNotAllowCookieAuth(): array {
-		return [
-			['testCORSShouldNotAllowCookieAuth'],
-			['testCORSAttributeShouldNotAllowCookieAuth'],
-		];
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataCORSShouldNotAllowCookieAuth')]
-	public function testCORSShouldNotAllowCookieAuth(string $method): void {
-		$this->expectException(SecurityException::class);
-
-		$request = new Request(
-			['server' => [
-				'PHP_AUTH_USER' => 'user',
-				'PHP_AUTH_PW' => 'pass'
-			]],
-			$this->createMock(IRequestId::class),
-			$this->createMock(IConfig::class)
-		);
-		$this->session->expects($this->once())
-			->method('logout');
-		$this->session->expects($this->once())
-			->method('logClientIn')
-			->with($this->equalTo('user'), $this->equalTo('pass'))
-			->willReturn(false);
-		$this->reflector->reflect($this->controller, $method);
-		$middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
-
-		$middleware->beforeController($this->controller, $method);
-	}
-
-	public function testAfterExceptionWithSecurityExceptionNoStatus(): void {
-		$request = new Request(
-			['server' => [
-				'PHP_AUTH_USER' => 'user',
-				'PHP_AUTH_PW' => 'pass'
-			]],
-			$this->createMock(IRequestId::class),
-			$this->createMock(IConfig::class)
-		);
-		$middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
-		$response = $middleware->afterException($this->controller, __FUNCTION__, new SecurityException('A security exception'));
-
-		$expected = new JSONResponse(['message' => 'A security exception'], 500);
-		$this->assertEquals($expected, $response);
-	}
-
-	public function testAfterExceptionWithSecurityExceptionWithStatus(): void {
-		$request = new Request(
-			['server' => [
-				'PHP_AUTH_USER' => 'user',
-				'PHP_AUTH_PW' => 'pass'
-			]],
-			$this->createMock(IRequestId::class),
-			$this->createMock(IConfig::class)
-		);
-		$middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
-		$response = $middleware->afterException($this->controller, __FUNCTION__, new SecurityException('A security exception', 501));
-
-		$expected = new JSONResponse(['message' => 'A security exception'], 501);
-		$this->assertEquals($expected, $response);
-	}
-
-	public function testAfterExceptionWithRegularException(): void {
-		$this->expectException(\Exception::class);
-		$this->expectExceptionMessage('A regular exception');
-
-		$request = new Request(
-			['server' => [
-				'PHP_AUTH_USER' => 'user',
-				'PHP_AUTH_PW' => 'pass'
-			]],
-			$this->createMock(IRequestId::class),
-			$this->createMock(IConfig::class)
-		);
-		$middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
-		$middleware->afterException($this->controller, __FUNCTION__, new \Exception('A regular exception'));
-	}
+    private ControllerMethodReflector $reflector;
+    private Session&MockObject $session;
+    private IThrottler&MockObject $throttler;
+    private CORSMiddlewareController $controller;
+    private LoggerInterface $logger;
+
+    protected function setUp(): void {
+        parent::setUp();
+        $this->reflector = new ControllerMethodReflector();
+        $this->session = $this->createMock(Session::class);
+        $this->throttler = $this->createMock(IThrottler::class);
+        $this->logger = $this->createMock(LoggerInterface::class);
+        $this->controller = new CORSMiddlewareController(
+            'test',
+            $this->createMock(IRequest::class)
+        );
+    }
+
+    public static function dataSetCORSAPIHeader(): array {
+        return [
+            ['testSetCORSAPIHeader'],
+            ['testSetCORSAPIHeaderAttribute'],
+        ];
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataSetCORSAPIHeader')]
+    public function testSetCORSAPIHeader(string $method): void {
+        $request = new Request(
+            [
+                'server' => [
+                    'HTTP_ORIGIN' => 'test'
+                ]
+            ],
+            $this->createMock(IRequestId::class),
+            $this->createMock(IConfig::class)
+        );
+        $this->reflector->reflect($this->controller, $method);
+        $middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
+
+        $response = $middleware->afterController($this->controller, $method, new Response());
+        $headers = $response->getHeaders();
+        $this->assertEquals('test', $headers['Access-Control-Allow-Origin']);
+    }
+
+    public function testNoAnnotationNoCORSHEADER(): void {
+        $request = new Request(
+            [
+                'server' => [
+                    'HTTP_ORIGIN' => 'test'
+                ]
+            ],
+            $this->createMock(IRequestId::class),
+            $this->createMock(IConfig::class)
+        );
+        $middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
+
+        $response = $middleware->afterController($this->controller, __FUNCTION__, new Response());
+        $headers = $response->getHeaders();
+        $this->assertFalse(array_key_exists('Access-Control-Allow-Origin', $headers));
+    }
+
+    public static function dataNoOriginHeaderNoCORSHEADER(): array {
+        return [
+            ['testNoOriginHeaderNoCORSHEADER'],
+            ['testNoOriginHeaderNoCORSHEADERAttribute'],
+        ];
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoOriginHeaderNoCORSHEADER')]
+    public function testNoOriginHeaderNoCORSHEADER(string $method): void {
+        $request = new Request(
+            [],
+            $this->createMock(IRequestId::class),
+            $this->createMock(IConfig::class)
+        );
+        $this->reflector->reflect($this->controller, $method);
+        $middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
+
+        $response = $middleware->afterController($this->controller, $method, new Response());
+        $headers = $response->getHeaders();
+        $this->assertFalse(array_key_exists('Access-Control-Allow-Origin', $headers));
+    }
+
+    public static function dataCorsIgnoredIfWithCredentialsHeaderPresent(): array {
+        return [
+            ['testCorsIgnoredIfWithCredentialsHeaderPresent'],
+            ['testCorsAttributeIgnoredIfWithCredentialsHeaderPresent'],
+        ];
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataCorsIgnoredIfWithCredentialsHeaderPresent')]
+    public function testCorsIgnoredIfWithCredentialsHeaderPresent(string $method): void {
+        $this->expectException(SecurityException::class);
+
+        $request = new Request(
+            [
+                'server' => [
+                    'HTTP_ORIGIN' => 'test'
+                ]
+            ],
+            $this->createMock(IRequestId::class),
+            $this->createMock(IConfig::class)
+        );
+        $this->reflector->reflect($this->controller, $method);
+        $middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler, $this->logger);
+
+        $response = new Response();
+        $response->addHeader('AcCess-control-Allow-Credentials ', 'TRUE');
+        $middleware->afterController($this->controller, $method, $response);
+    }
+
+    public static function dataNoCORSOnAnonymousPublicPage(): array {
+        return [
+            ['testNoCORSOnAnonymousPublicPage'],
+            ['testNoCORSOnAnonymousPublicPageAttribute'],
+            ['testNoCORSAttributeOnAnonymousPublicPage'],
+            ['testNoCORSAttributeOnAnonymousPublicPageAttribute'],
+        ];
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoCORSOnAnonymousPublicPage')]
+    public function testNoCORSOnAnonymousPublicPage(string $method): void {
+        $request = new Request(
+            [],
+            $this->createMock(IRequestId::class),
+            $this->createMock(IConfig::class)
+        );
+        $this->reflector->reflect($this->controller, $method);
+        $middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler, $this->logger);
+        $this->session->expects($this->once())
+            ->method('isLoggedIn')
+            ->willReturn(false);
+        $this->session->expects($this->never())
+            ->method('logout');
+        $this->session->expects($this->never())
+            ->method('logClientIn')
+            ->with($this->equalTo('user'), $this->equalTo('pass'))
+            ->willReturn(true);
+        $this->reflector->reflect($this->controller, $method);
+
+        $middleware->beforeController($this->controller, $method);
+    }
+
+    public static function dataCORSShouldNeverAllowCookieAuth(): array {
+        return [
+            ['testCORSShouldNeverAllowCookieAuth'],
+            ['testCORSShouldNeverAllowCookieAuthAttribute'],
+            ['testCORSAttributeShouldNeverAllowCookieAuth'],
+            ['testCORSAttributeShouldNeverAllowCookieAuthAttribute'],
+        ];
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataCORSShouldNeverAllowCookieAuth')]
+    public function testCORSShouldNeverAllowCookieAuth(string $method): void {
+        $request = new Request(
+            [],
+            $this->createMock(IRequestId::class),
+            $this->createMock(IConfig::class)
+        );
+        $this->reflector->reflect($this->controller, $method);
+        $middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
+        $this->session->expects($this->once())
+            ->method('isLoggedIn')
+            ->willReturn(true);
+        $this->session->expects($this->once())
+            ->method('logout');
+        $this->session->expects($this->never())
+            ->method('logClientIn')
+            ->with($this->equalTo('user'), $this->equalTo('pass'))
+            ->willReturn(true);
+
+        $this->expectException(SecurityException::class);
+        $middleware->beforeController($this->controller, $method);
+    }
+
+    public static function dataCORSShouldRelogin(): array {
+        return [
+            ['testCORSShouldRelogin'],
+            ['testCORSAttributeShouldRelogin'],
+        ];
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataCORSShouldRelogin')]
+    public function testCORSShouldRelogin(string $method): void {
+        $request = new Request(
+            ['server' => [
+                'PHP_AUTH_USER' => 'user',
+                'PHP_AUTH_PW' => 'pass'
+            ]],
+            $this->createMock(IRequestId::class),
+            $this->createMock(IConfig::class)
+        );
+        $this->session->expects($this->once())
+            ->method('logout');
+        $this->session->expects($this->once())
+            ->method('logClientIn')
+            ->with($this->equalTo('user'), $this->equalTo('pass'))
+            ->willReturn(true);
+        $this->reflector->reflect($this->controller, $method);
+        $middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
+
+        $middleware->beforeController($this->controller, $method);
+    }
+
+    public static function dataCORSShouldFailIfPasswordLoginIsForbidden(): array {
+        return [
+            ['testCORSShouldFailIfPasswordLoginIsForbidden'],
+            ['testCORSAttributeShouldFailIfPasswordLoginIsForbidden'],
+        ];
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataCORSShouldFailIfPasswordLoginIsForbidden')]
+    public function testCORSShouldFailIfPasswordLoginIsForbidden(string $method): void {
+        $this->expectException(SecurityException::class);
+
+        $request = new Request(
+            ['server' => [
+                'PHP_AUTH_USER' => 'user',
+                'PHP_AUTH_PW' => 'pass'
+            ]],
+            $this->createMock(IRequestId::class),
+            $this->createMock(IConfig::class)
+        );
+        $this->session->expects($this->once())
+            ->method('logout');
+        $this->session->expects($this->once())
+            ->method('logClientIn')
+            ->with($this->equalTo('user'), $this->equalTo('pass'))
+            ->willThrowException(new PasswordLoginForbiddenException);
+        $this->reflector->reflect($this->controller, $method);
+        $middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
+
+        $middleware->beforeController($this->controller, $method);
+    }
+
+    public static function dataCORSShouldNotAllowCookieAuth(): array {
+        return [
+            ['testCORSShouldNotAllowCookieAuth'],
+            ['testCORSAttributeShouldNotAllowCookieAuth'],
+        ];
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataCORSShouldNotAllowCookieAuth')]
+    public function testCORSShouldNotAllowCookieAuth(string $method): void {
+        $this->expectException(SecurityException::class);
+
+        $request = new Request(
+            ['server' => [
+                'PHP_AUTH_USER' => 'user',
+                'PHP_AUTH_PW' => 'pass'
+            ]],
+            $this->createMock(IRequestId::class),
+            $this->createMock(IConfig::class)
+        );
+        $this->session->expects($this->once())
+            ->method('logout');
+        $this->session->expects($this->once())
+            ->method('logClientIn')
+            ->with($this->equalTo('user'), $this->equalTo('pass'))
+            ->willReturn(false);
+        $this->reflector->reflect($this->controller, $method);
+        $middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
+
+        $middleware->beforeController($this->controller, $method);
+    }
+
+    public function testAfterExceptionWithSecurityExceptionNoStatus(): void {
+        $request = new Request(
+            ['server' => [
+                'PHP_AUTH_USER' => 'user',
+                'PHP_AUTH_PW' => 'pass'
+            ]],
+            $this->createMock(IRequestId::class),
+            $this->createMock(IConfig::class)
+        );
+        $middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
+        $response = $middleware->afterException($this->controller, __FUNCTION__, new SecurityException('A security exception'));
+
+        $expected = new JSONResponse(['message' => 'A security exception'], 500);
+        $this->assertEquals($expected, $response);
+    }
+
+    public function testAfterExceptionWithSecurityExceptionWithStatus(): void {
+        $request = new Request(
+            ['server' => [
+                'PHP_AUTH_USER' => 'user',
+                'PHP_AUTH_PW' => 'pass'
+            ]],
+            $this->createMock(IRequestId::class),
+            $this->createMock(IConfig::class)
+        );
+        $middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
+        $response = $middleware->afterException($this->controller, __FUNCTION__, new SecurityException('A security exception', 501));
+
+        $expected = new JSONResponse(['message' => 'A security exception'], 501);
+        $this->assertEquals($expected, $response);
+    }
+
+    public function testAfterExceptionWithRegularException(): void {
+        $this->expectException(\Exception::class);
+        $this->expectExceptionMessage('A regular exception');
+
+        $request = new Request(
+            ['server' => [
+                'PHP_AUTH_USER' => 'user',
+                'PHP_AUTH_PW' => 'pass'
+            ]],
+            $this->createMock(IRequestId::class),
+            $this->createMock(IConfig::class)
+        );
+        $middleware = new CORSMiddleware($request, new MiddlewareUtils($this->reflector, $this->logger), $this->session, $this->throttler);
+        $middleware->afterException($this->controller, __FUNCTION__, new \Exception('A regular exception'));
+    }
 }

tests/lib/AppFramework/Middleware/Security/SecurityMiddlewareTest.php

Indentation +642 added lines, -642 removed lines

@@ -45,646 +45,646 @@
 use Test\AppFramework\Middleware\Security\Mock\SecurityMiddlewareController;
 
 class SecurityMiddlewareTest extends \Test\TestCase {
-	private SecurityMiddleware $middleware;
-	private ControllerMethodReflector $reader;
-	private SecurityMiddlewareController $controller;
-	private SecurityException $secAjaxException;
-	private IRequest|MockObject $request;
-	private MiddlewareUtils $middlewareUtils;
-	private LoggerInterface&MockObject $logger;
-	private INavigationManager&MockObject $navigationManager;
-	private IURLGenerator&MockObject $urlGenerator;
-	private IAppManager&MockObject $appManager;
-	private IL10N&MockObject $l10n;
-	private IUserSession&MockObject $userSession;
-	private AuthorizedGroupMapper&MockObject $authorizedGroupMapper;
-
-	protected function setUp(): void {
-		parent::setUp();
-
-		$this->authorizedGroupMapper = $this->createMock(AuthorizedGroupMapper::class);
-		$this->userSession = $this->createMock(Session::class);
-		$user = $this->createMock(IUser::class);
-		$user->method('getUID')->willReturn('test');
-		$this->userSession->method('getUser')->willReturn($user);
-		$this->request = $this->createMock(IRequest::class);
-		$this->controller = new SecurityMiddlewareController(
-			'test',
-			$this->request
-		);
-		$this->reader = new ControllerMethodReflector();
-		$this->logger = $this->createMock(LoggerInterface::class);
-		$this->navigationManager = $this->createMock(INavigationManager::class);
-		$this->urlGenerator = $this->createMock(IURLGenerator::class);
-		$this->l10n = $this->createMock(IL10N::class);
-		$this->middlewareUtils = new MiddlewareUtils($this->reader, $this->logger);
-		$this->middleware = $this->getMiddleware(true, true, false);
-		$this->secAjaxException = new SecurityException('hey', true);
-	}
-
-	private function getMiddleware(bool $isLoggedIn, bool $isAdminUser, bool $isSubAdmin, bool $isAppEnabledForUser = true): SecurityMiddleware {
-		$this->appManager = $this->createMock(IAppManager::class);
-		$this->appManager->expects($this->any())
-			->method('isEnabledForUser')
-			->willReturn($isAppEnabledForUser);
-		$remoteIpAddress = $this->createMock(IRemoteAddress::class);
-		$remoteIpAddress->method('allowsAdminActions')->willReturn(true);
-
-		$groupManager = $this->createMock(IGroupManager::class);
-		$groupManager->method('isAdmin')
-			->willReturn($isAdminUser);
-		$subAdminManager = $this->createMock(ISubAdmin::class);
-		$subAdminManager->method('isSubAdmin')
-			->willReturn($isSubAdmin);
-
-		return new SecurityMiddleware(
-			$this->request,
-			$this->middlewareUtils,
-			$this->navigationManager,
-			$this->urlGenerator,
-			$this->logger,
-			'files',
-			$isLoggedIn,
-			$groupManager,
-			$subAdminManager,
-			$this->appManager,
-			$this->l10n,
-			$this->authorizedGroupMapper,
-			$this->userSession,
-			$remoteIpAddress
-		);
-	}
-
-	public static function dataNoCSRFRequiredPublicPage(): array {
-		return [
-			['testAnnotationNoCSRFRequiredPublicPage'],
-			['testAnnotationNoCSRFRequiredAttributePublicPage'],
-			['testAnnotationPublicPageAttributeNoCSRFRequired'],
-			['testAttributeNoCSRFRequiredPublicPage'],
-		];
-	}
-
-	public static function dataPublicPage(): array {
-		return [
-			['testAnnotationPublicPage'],
-			['testAttributePublicPage'],
-		];
-	}
-
-	public static function dataNoCSRFRequired(): array {
-		return [
-			['testAnnotationNoCSRFRequired'],
-			['testAttributeNoCSRFRequired'],
-		];
-	}
-
-	public static function dataPublicPageStrictCookieRequired(): array {
-		return [
-			['testAnnotationPublicPageStrictCookieRequired'],
-			['testAnnotationStrictCookieRequiredAttributePublicPage'],
-			['testAnnotationPublicPageAttributeStrictCookiesRequired'],
-			['testAttributePublicPageStrictCookiesRequired'],
-		];
-	}
-
-	public static function dataNoCSRFRequiredPublicPageStrictCookieRequired(): array {
-		return [
-			['testAnnotationNoCSRFRequiredPublicPageStrictCookieRequired'],
-			['testAttributeNoCSRFRequiredPublicPageStrictCookiesRequired'],
-		];
-	}
-
-	public static function dataNoAdminRequiredNoCSRFRequired(): array {
-		return [
-			['testAnnotationNoAdminRequiredNoCSRFRequired'],
-			['testAttributeNoAdminRequiredNoCSRFRequired'],
-		];
-	}
-
-	public static function dataNoAdminRequiredNoCSRFRequiredPublicPage(): array {
-		return [
-			['testAnnotationNoAdminRequiredNoCSRFRequiredPublicPage'],
-			['testAttributeNoAdminRequiredNoCSRFRequiredPublicPage'],
-		];
-	}
-
-	public static function dataNoCSRFRequiredSubAdminRequired(): array {
-		return [
-			['testAnnotationNoCSRFRequiredSubAdminRequired'],
-			['testAnnotationNoCSRFRequiredAttributeSubAdminRequired'],
-			['testAnnotationSubAdminRequiredAttributeNoCSRFRequired'],
-			['testAttributeNoCSRFRequiredSubAdminRequired'],
-		];
-	}
-
-	public static function dataExAppRequired(): array {
-		return [
-			['testAnnotationExAppRequired'],
-			['testAttributeExAppRequired'],
-		];
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequiredPublicPage')]
-	public function testSetNavigationEntry(string $method): void {
-		$this->navigationManager->expects($this->once())
-			->method('setActiveEntry')
-			->with($this->equalTo('files'));
-
-		$this->reader->reflect($this->controller, $method);
-		$this->middleware->beforeController($this->controller, $method);
-	}
-
-
-	/**
-	 * @param string $method
-	 * @param string $test
-	 */
-	private function ajaxExceptionStatus($method, $test, $status) {
-		$isLoggedIn = false;
-		$isAdminUser = false;
-
-		// isAdminUser requires isLoggedIn call to return true
-		if ($test === 'isAdminUser') {
-			$isLoggedIn = true;
-		}
-
-		$sec = $this->getMiddleware($isLoggedIn, $isAdminUser, false);
-
-		try {
-			$this->reader->reflect($this->controller, $method);
-			$sec->beforeController($this->controller, $method);
-		} catch (SecurityException $ex) {
-			$this->assertEquals($status, $ex->getCode());
-		}
-
-		// add assertion if everything should work fine otherwise phpunit will
-		// complain
-		if ($status === 0) {
-			$this->addToAssertionCount(1);
-		}
-	}
-
-	public function testAjaxStatusLoggedInCheck(): void {
-		$this->ajaxExceptionStatus(
-			'testNoAnnotationNorAttribute',
-			'isLoggedIn',
-			Http::STATUS_UNAUTHORIZED
-		);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequired')]
-	public function testAjaxNotAdminCheck(string $method): void {
-		$this->ajaxExceptionStatus(
-			$method,
-			'isAdminUser',
-			Http::STATUS_FORBIDDEN
-		);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataPublicPage')]
-	public function testAjaxStatusCSRFCheck(string $method): void {
-		$this->ajaxExceptionStatus(
-			$method,
-			'passesCSRFCheck',
-			Http::STATUS_PRECONDITION_FAILED
-		);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequiredPublicPage')]
-	public function testAjaxStatusAllGood(string $method): void {
-		$this->ajaxExceptionStatus(
-			$method,
-			'isLoggedIn',
-			0
-		);
-		$this->ajaxExceptionStatus(
-			$method,
-			'isAdminUser',
-			0
-		);
-		$this->ajaxExceptionStatus(
-			$method,
-			'passesCSRFCheck',
-			0
-		);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequiredPublicPage')]
-	public function testNoChecks(string $method): void {
-		$this->request->expects($this->never())
-			->method('passesCSRFCheck')
-			->willReturn(false);
-
-		$sec = $this->getMiddleware(false, false, false);
-
-		$this->reader->reflect($this->controller, $method);
-		$sec->beforeController($this->controller, $method);
-	}
-
-	/**
-	 * @param string $method
-	 * @param string $expects
-	 */
-	private function securityCheck($method, $expects, $shouldFail = false) {
-		// admin check requires login
-		if ($expects === 'isAdminUser') {
-			$isLoggedIn = true;
-			$isAdminUser = !$shouldFail;
-		} else {
-			$isLoggedIn = !$shouldFail;
-			$isAdminUser = false;
-		}
-
-		$sec = $this->getMiddleware($isLoggedIn, $isAdminUser, false);
-
-		if ($shouldFail) {
-			$this->expectException(SecurityException::class);
-		} else {
-			$this->addToAssertionCount(1);
-		}
-
-		$this->reader->reflect($this->controller, $method);
-		$sec->beforeController($this->controller, $method);
-	}
-
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataPublicPage')]
-	public function testCsrfCheck(string $method): void {
-		$this->expectException(CrossSiteRequestForgeryException::class);
-
-		$this->request->expects($this->once())
-			->method('passesCSRFCheck')
-			->willReturn(false);
-		$this->request->expects($this->once())
-			->method('passesStrictCookieCheck')
-			->willReturn(true);
-		$this->reader->reflect($this->controller, $method);
-		$this->middleware->beforeController($this->controller, $method);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequiredPublicPage')]
-	public function testNoCsrfCheck(string $method): void {
-		$this->request->expects($this->never())
-			->method('passesCSRFCheck')
-			->willReturn(false);
-
-		$this->reader->reflect($this->controller, $method);
-		$this->middleware->beforeController($this->controller, $method);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataPublicPage')]
-	public function testPassesCsrfCheck(string $method): void {
-		$this->request->expects($this->once())
-			->method('passesCSRFCheck')
-			->willReturn(true);
-		$this->request->expects($this->once())
-			->method('passesStrictCookieCheck')
-			->willReturn(true);
-
-		$this->reader->reflect($this->controller, $method);
-		$this->middleware->beforeController($this->controller, $method);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataPublicPage')]
-	public function testFailCsrfCheck(string $method): void {
-		$this->expectException(CrossSiteRequestForgeryException::class);
-
-		$this->request->expects($this->once())
-			->method('passesCSRFCheck')
-			->willReturn(false);
-		$this->request->expects($this->once())
-			->method('passesStrictCookieCheck')
-			->willReturn(true);
-
-		$this->reader->reflect($this->controller, $method);
-		$this->middleware->beforeController($this->controller, $method);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataPublicPageStrictCookieRequired')]
-	public function testStrictCookieRequiredCheck(string $method): void {
-		$this->expectException(\OC\AppFramework\Middleware\Security\Exceptions\StrictCookieMissingException::class);
-
-		$this->request->expects($this->never())
-			->method('passesCSRFCheck');
-		$this->request->expects($this->once())
-			->method('passesStrictCookieCheck')
-			->willReturn(false);
-
-		$this->reader->reflect($this->controller, $method);
-		$this->middleware->beforeController($this->controller, $method);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequiredPublicPage')]
-	public function testNoStrictCookieRequiredCheck(string $method): void {
-		$this->request->expects($this->never())
-			->method('passesStrictCookieCheck')
-			->willReturn(false);
-
-		$this->reader->reflect($this->controller, $method);
-		$this->middleware->beforeController($this->controller, $method);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequiredPublicPageStrictCookieRequired')]
-	public function testPassesStrictCookieRequiredCheck(string $method): void {
-		$this->request
-			->expects($this->once())
-			->method('passesStrictCookieCheck')
-			->willReturn(true);
-
-		$this->reader->reflect($this->controller, $method);
-		$this->middleware->beforeController($this->controller, $method);
-	}
-
-	public static function dataCsrfOcsController(): array {
-		return [
-			[NormalController::class, false, false, true],
-			[NormalController::class, false,  true, true],
-			[NormalController::class,  true, false, true],
-			[NormalController::class,  true,  true, true],
-
-			[OCSController::class, false, false,  true],
-			[OCSController::class, false,  true, false],
-			[OCSController::class,  true, false, false],
-			[OCSController::class,  true,  true, false],
-		];
-	}
-
-	/**
-	 * @param string $controllerClass
-	 * @param bool $hasOcsApiHeader
-	 * @param bool $hasBearerAuth
-	 * @param bool $exception
-	 */
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataCsrfOcsController')]
-	public function testCsrfOcsController(string $controllerClass, bool $hasOcsApiHeader, bool $hasBearerAuth, bool $exception): void {
-		$this->request
-			->method('getHeader')
-			->willReturnCallback(function ($header) use ($hasOcsApiHeader, $hasBearerAuth) {
-				if ($header === 'OCS-APIREQUEST' && $hasOcsApiHeader) {
-					return 'true';
-				}
-				if ($header === 'Authorization' && $hasBearerAuth) {
-					return 'Bearer TOKEN!';
-				}
-				return '';
-			});
-		$this->request->expects($this->once())
-			->method('passesStrictCookieCheck')
-			->willReturn(true);
-
-		$controller = new $controllerClass('test', $this->request);
-
-		try {
-			$this->middleware->beforeController($controller, 'foo');
-			$this->assertFalse($exception);
-		} catch (CrossSiteRequestForgeryException $e) {
-			$this->assertTrue($exception);
-		}
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoAdminRequiredNoCSRFRequired')]
-	public function testLoggedInCheck(string $method): void {
-		$this->securityCheck($method, 'isLoggedIn');
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoAdminRequiredNoCSRFRequired')]
-	public function testFailLoggedInCheck(string $method): void {
-		$this->securityCheck($method, 'isLoggedIn', true);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequired')]
-	public function testIsAdminCheck(string $method): void {
-		$this->securityCheck($method, 'isAdminUser');
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequiredSubAdminRequired')]
-	public function testIsNotSubAdminCheck(string $method): void {
-		$this->reader->reflect($this->controller, $method);
-		$sec = $this->getMiddleware(true, false, false);
-
-		$this->expectException(SecurityException::class);
-		$sec->beforeController($this->controller, $method);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequiredSubAdminRequired')]
-	public function testIsSubAdminCheck(string $method): void {
-		$this->reader->reflect($this->controller, $method);
-		$sec = $this->getMiddleware(true, false, true);
-
-		$sec->beforeController($this->controller, $method);
-		$this->addToAssertionCount(1);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequiredSubAdminRequired')]
-	public function testIsSubAdminAndAdminCheck(string $method): void {
-		$this->reader->reflect($this->controller, $method);
-		$sec = $this->getMiddleware(true, true, true);
-
-		$sec->beforeController($this->controller, $method);
-		$this->addToAssertionCount(1);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequired')]
-	public function testFailIsAdminCheck(string $method): void {
-		$this->securityCheck($method, 'isAdminUser', true);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoAdminRequiredNoCSRFRequiredPublicPage')]
-	public function testRestrictedAppLoggedInPublicPage(string $method): void {
-		$middleware = $this->getMiddleware(true, false, false);
-		$this->reader->reflect($this->controller, $method);
-
-		$this->appManager->method('getAppPath')
-			->with('files')
-			->willReturn('foo');
-
-		$this->appManager->method('isEnabledForUser')
-			->with('files')
-			->willReturn(false);
-
-		$middleware->beforeController($this->controller, $method);
-		$this->addToAssertionCount(1);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoAdminRequiredNoCSRFRequiredPublicPage')]
-	public function testRestrictedAppNotLoggedInPublicPage(string $method): void {
-		$middleware = $this->getMiddleware(false, false, false);
-		$this->reader->reflect($this->controller, $method);
-
-		$this->appManager->method('getAppPath')
-			->with('files')
-			->willReturn('foo');
-
-		$this->appManager->method('isEnabledForUser')
-			->with('files')
-			->willReturn(false);
-
-		$middleware->beforeController($this->controller, $method);
-		$this->addToAssertionCount(1);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataNoAdminRequiredNoCSRFRequired')]
-	public function testRestrictedAppLoggedIn(string $method): void {
-		$middleware = $this->getMiddleware(true, false, false, false);
-		$this->reader->reflect($this->controller, $method);
-
-		$this->appManager->method('getAppPath')
-			->with('files')
-			->willReturn('foo');
-
-		$this->expectException(AppNotEnabledException::class);
-		$middleware->beforeController($this->controller, $method);
-	}
-
-
-	public function testAfterExceptionNotCaughtThrowsItAgain(): void {
-		$ex = new \Exception();
-		$this->expectException(\Exception::class);
-		$this->middleware->afterException($this->controller, 'test', $ex);
-	}
-
-	public function testAfterExceptionReturnsRedirectForNotLoggedInUser(): void {
-		$this->request = new Request(
-			[
-				'server'
-					=> [
-						'HTTP_ACCEPT' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
-						'REQUEST_URI' => 'nextcloud/index.php/apps/specialapp'
-					]
-			],
-			$this->createMock(IRequestId::class),
-			$this->createMock(IConfig::class)
-		);
-		$this->middleware = $this->getMiddleware(false, false, false);
-		$this->urlGenerator
-			->expects($this->once())
-			->method('linkToRoute')
-			->with(
-				'core.login.showLoginForm',
-				[
-					'redirect_url' => 'nextcloud/index.php/apps/specialapp',
-				]
-			)
-			->willReturn('http://localhost/nextcloud/index.php/login?redirect_url=nextcloud/index.php/apps/specialapp');
-		$this->logger
-			->expects($this->once())
-			->method('debug');
-		$response = $this->middleware->afterException(
-			$this->controller,
-			'test',
-			new NotLoggedInException()
-		);
-		$expected = new RedirectResponse('http://localhost/nextcloud/index.php/login?redirect_url=nextcloud/index.php/apps/specialapp');
-		$this->assertEquals($expected, $response);
-	}
-
-	public function testAfterExceptionRedirectsToWebRootAfterStrictCookieFail(): void {
-		$this->request = new Request(
-			[
-				'server' => [
-					'HTTP_ACCEPT' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
-					'REQUEST_URI' => 'nextcloud/index.php/apps/specialapp',
-				],
-			],
-			$this->createMock(IRequestId::class),
-			$this->createMock(IConfig::class)
-		);
-
-		$this->middleware = $this->getMiddleware(false, false, false);
-		$response = $this->middleware->afterException(
-			$this->controller,
-			'test',
-			new StrictCookieMissingException()
-		);
-
-		$expected = new RedirectResponse(\OC::$WEBROOT . '/');
-		$this->assertEquals($expected, $response);
-	}
-
-
-	/**
-	 * @return array
-	 */
-	public static function exceptionProvider(): array {
-		return [
-			[
-				new AppNotEnabledException(),
-			],
-			[
-				new CrossSiteRequestForgeryException(),
-			],
-			[
-				new NotAdminException(''),
-			],
-		];
-	}
-
-	/**
-	 * @param SecurityException $exception
-	 */
-	#[\PHPUnit\Framework\Attributes\DataProvider('exceptionProvider')]
-	public function testAfterExceptionReturnsTemplateResponse(SecurityException $exception): void {
-		$this->request = new Request(
-			[
-				'server'
-					=> [
-						'HTTP_ACCEPT' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
-						'REQUEST_URI' => 'nextcloud/index.php/apps/specialapp'
-					]
-			],
-			$this->createMock(IRequestId::class),
-			$this->createMock(IConfig::class)
-		);
-		$this->middleware = $this->getMiddleware(false, false, false);
-		$this->logger
-			->expects($this->once())
-			->method('debug');
-		$response = $this->middleware->afterException(
-			$this->controller,
-			'test',
-			$exception
-		);
-		$expected = new TemplateResponse('core', '403', ['message' => $exception->getMessage()], 'guest');
-		$expected->setStatus($exception->getCode());
-		$this->assertEquals($expected, $response);
-	}
-
-	public function testAfterAjaxExceptionReturnsJSONError(): void {
-		$response = $this->middleware->afterException($this->controller, 'test',
-			$this->secAjaxException);
-
-		$this->assertTrue($response instanceof JSONResponse);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataExAppRequired')]
-	public function testExAppRequired(string $method): void {
-		$middleware = $this->getMiddleware(true, false, false);
-		$this->reader->reflect($this->controller, $method);
-
-		$session = $this->createMock(ISession::class);
-		$session->method('get')->with('app_api')->willReturn(true);
-		$this->userSession->method('getSession')->willReturn($session);
-
-		$this->request->expects($this->once())
-			->method('passesStrictCookieCheck')
-			->willReturn(true);
-		$this->request->expects($this->once())
-			->method('passesCSRFCheck')
-			->willReturn(true);
-
-		$middleware->beforeController($this->controller, $method);
-	}
-
-	#[\PHPUnit\Framework\Attributes\DataProvider('dataExAppRequired')]
-	public function testExAppRequiredError(string $method): void {
-		$middleware = $this->getMiddleware(true, false, false, false);
-		$this->reader->reflect($this->controller, $method);
-
-		$session = $this->createMock(ISession::class);
-		$session->method('get')->with('app_api')->willReturn(false);
-		$this->userSession->method('getSession')->willReturn($session);
-
-		$this->expectException(ExAppRequiredException::class);
-		$middleware->beforeController($this->controller, $method);
-	}
+    private SecurityMiddleware $middleware;
+    private ControllerMethodReflector $reader;
+    private SecurityMiddlewareController $controller;
+    private SecurityException $secAjaxException;
+    private IRequest|MockObject $request;
+    private MiddlewareUtils $middlewareUtils;
+    private LoggerInterface&MockObject $logger;
+    private INavigationManager&MockObject $navigationManager;
+    private IURLGenerator&MockObject $urlGenerator;
+    private IAppManager&MockObject $appManager;
+    private IL10N&MockObject $l10n;
+    private IUserSession&MockObject $userSession;
+    private AuthorizedGroupMapper&MockObject $authorizedGroupMapper;
+
+    protected function setUp(): void {
+        parent::setUp();
+
+        $this->authorizedGroupMapper = $this->createMock(AuthorizedGroupMapper::class);
+        $this->userSession = $this->createMock(Session::class);
+        $user = $this->createMock(IUser::class);
+        $user->method('getUID')->willReturn('test');
+        $this->userSession->method('getUser')->willReturn($user);
+        $this->request = $this->createMock(IRequest::class);
+        $this->controller = new SecurityMiddlewareController(
+            'test',
+            $this->request
+        );
+        $this->reader = new ControllerMethodReflector();
+        $this->logger = $this->createMock(LoggerInterface::class);
+        $this->navigationManager = $this->createMock(INavigationManager::class);
+        $this->urlGenerator = $this->createMock(IURLGenerator::class);
+        $this->l10n = $this->createMock(IL10N::class);
+        $this->middlewareUtils = new MiddlewareUtils($this->reader, $this->logger);
+        $this->middleware = $this->getMiddleware(true, true, false);
+        $this->secAjaxException = new SecurityException('hey', true);
+    }
+
+    private function getMiddleware(bool $isLoggedIn, bool $isAdminUser, bool $isSubAdmin, bool $isAppEnabledForUser = true): SecurityMiddleware {
+        $this->appManager = $this->createMock(IAppManager::class);
+        $this->appManager->expects($this->any())
+            ->method('isEnabledForUser')
+            ->willReturn($isAppEnabledForUser);
+        $remoteIpAddress = $this->createMock(IRemoteAddress::class);
+        $remoteIpAddress->method('allowsAdminActions')->willReturn(true);
+
+        $groupManager = $this->createMock(IGroupManager::class);
+        $groupManager->method('isAdmin')
+            ->willReturn($isAdminUser);
+        $subAdminManager = $this->createMock(ISubAdmin::class);
+        $subAdminManager->method('isSubAdmin')
+            ->willReturn($isSubAdmin);
+
+        return new SecurityMiddleware(
+            $this->request,
+            $this->middlewareUtils,
+            $this->navigationManager,
+            $this->urlGenerator,
+            $this->logger,
+            'files',
+            $isLoggedIn,
+            $groupManager,
+            $subAdminManager,
+            $this->appManager,
+            $this->l10n,
+            $this->authorizedGroupMapper,
+            $this->userSession,
+            $remoteIpAddress
+        );
+    }
+
+    public static function dataNoCSRFRequiredPublicPage(): array {
+        return [
+            ['testAnnotationNoCSRFRequiredPublicPage'],
+            ['testAnnotationNoCSRFRequiredAttributePublicPage'],
+            ['testAnnotationPublicPageAttributeNoCSRFRequired'],
+            ['testAttributeNoCSRFRequiredPublicPage'],
+        ];
+    }
+
+    public static function dataPublicPage(): array {
+        return [
+            ['testAnnotationPublicPage'],
+            ['testAttributePublicPage'],
+        ];
+    }
+
+    public static function dataNoCSRFRequired(): array {
+        return [
+            ['testAnnotationNoCSRFRequired'],
+            ['testAttributeNoCSRFRequired'],
+        ];
+    }
+
+    public static function dataPublicPageStrictCookieRequired(): array {
+        return [
+            ['testAnnotationPublicPageStrictCookieRequired'],
+            ['testAnnotationStrictCookieRequiredAttributePublicPage'],
+            ['testAnnotationPublicPageAttributeStrictCookiesRequired'],
+            ['testAttributePublicPageStrictCookiesRequired'],
+        ];
+    }
+
+    public static function dataNoCSRFRequiredPublicPageStrictCookieRequired(): array {
+        return [
+            ['testAnnotationNoCSRFRequiredPublicPageStrictCookieRequired'],
+            ['testAttributeNoCSRFRequiredPublicPageStrictCookiesRequired'],
+        ];
+    }
+
+    public static function dataNoAdminRequiredNoCSRFRequired(): array {
+        return [
+            ['testAnnotationNoAdminRequiredNoCSRFRequired'],
+            ['testAttributeNoAdminRequiredNoCSRFRequired'],
+        ];
+    }
+
+    public static function dataNoAdminRequiredNoCSRFRequiredPublicPage(): array {
+        return [
+            ['testAnnotationNoAdminRequiredNoCSRFRequiredPublicPage'],
+            ['testAttributeNoAdminRequiredNoCSRFRequiredPublicPage'],
+        ];
+    }
+
+    public static function dataNoCSRFRequiredSubAdminRequired(): array {
+        return [
+            ['testAnnotationNoCSRFRequiredSubAdminRequired'],
+            ['testAnnotationNoCSRFRequiredAttributeSubAdminRequired'],
+            ['testAnnotationSubAdminRequiredAttributeNoCSRFRequired'],
+            ['testAttributeNoCSRFRequiredSubAdminRequired'],
+        ];
+    }
+
+    public static function dataExAppRequired(): array {
+        return [
+            ['testAnnotationExAppRequired'],
+            ['testAttributeExAppRequired'],
+        ];
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequiredPublicPage')]
+    public function testSetNavigationEntry(string $method): void {
+        $this->navigationManager->expects($this->once())
+            ->method('setActiveEntry')
+            ->with($this->equalTo('files'));
+
+        $this->reader->reflect($this->controller, $method);
+        $this->middleware->beforeController($this->controller, $method);
+    }
+
+
+    /**
+     * @param string $method
+     * @param string $test
+     */
+    private function ajaxExceptionStatus($method, $test, $status) {
+        $isLoggedIn = false;
+        $isAdminUser = false;
+
+        // isAdminUser requires isLoggedIn call to return true
+        if ($test === 'isAdminUser') {
+            $isLoggedIn = true;
+        }
+
+        $sec = $this->getMiddleware($isLoggedIn, $isAdminUser, false);
+
+        try {
+            $this->reader->reflect($this->controller, $method);
+            $sec->beforeController($this->controller, $method);
+        } catch (SecurityException $ex) {
+            $this->assertEquals($status, $ex->getCode());
+        }
+
+        // add assertion if everything should work fine otherwise phpunit will
+        // complain
+        if ($status === 0) {
+            $this->addToAssertionCount(1);
+        }
+    }
+
+    public function testAjaxStatusLoggedInCheck(): void {
+        $this->ajaxExceptionStatus(
+            'testNoAnnotationNorAttribute',
+            'isLoggedIn',
+            Http::STATUS_UNAUTHORIZED
+        );
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequired')]
+    public function testAjaxNotAdminCheck(string $method): void {
+        $this->ajaxExceptionStatus(
+            $method,
+            'isAdminUser',
+            Http::STATUS_FORBIDDEN
+        );
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataPublicPage')]
+    public function testAjaxStatusCSRFCheck(string $method): void {
+        $this->ajaxExceptionStatus(
+            $method,
+            'passesCSRFCheck',
+            Http::STATUS_PRECONDITION_FAILED
+        );
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequiredPublicPage')]
+    public function testAjaxStatusAllGood(string $method): void {
+        $this->ajaxExceptionStatus(
+            $method,
+            'isLoggedIn',
+            0
+        );
+        $this->ajaxExceptionStatus(
+            $method,
+            'isAdminUser',
+            0
+        );
+        $this->ajaxExceptionStatus(
+            $method,
+            'passesCSRFCheck',
+            0
+        );
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequiredPublicPage')]
+    public function testNoChecks(string $method): void {
+        $this->request->expects($this->never())
+            ->method('passesCSRFCheck')
+            ->willReturn(false);
+
+        $sec = $this->getMiddleware(false, false, false);
+
+        $this->reader->reflect($this->controller, $method);
+        $sec->beforeController($this->controller, $method);
+    }
+
+    /**
+     * @param string $method
+     * @param string $expects
+     */
+    private function securityCheck($method, $expects, $shouldFail = false) {
+        // admin check requires login
+        if ($expects === 'isAdminUser') {
+            $isLoggedIn = true;
+            $isAdminUser = !$shouldFail;
+        } else {
+            $isLoggedIn = !$shouldFail;
+            $isAdminUser = false;
+        }
+
+        $sec = $this->getMiddleware($isLoggedIn, $isAdminUser, false);
+
+        if ($shouldFail) {
+            $this->expectException(SecurityException::class);
+        } else {
+            $this->addToAssertionCount(1);
+        }
+
+        $this->reader->reflect($this->controller, $method);
+        $sec->beforeController($this->controller, $method);
+    }
+
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataPublicPage')]
+    public function testCsrfCheck(string $method): void {
+        $this->expectException(CrossSiteRequestForgeryException::class);
+
+        $this->request->expects($this->once())
+            ->method('passesCSRFCheck')
+            ->willReturn(false);
+        $this->request->expects($this->once())
+            ->method('passesStrictCookieCheck')
+            ->willReturn(true);
+        $this->reader->reflect($this->controller, $method);
+        $this->middleware->beforeController($this->controller, $method);
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequiredPublicPage')]
+    public function testNoCsrfCheck(string $method): void {
+        $this->request->expects($this->never())
+            ->method('passesCSRFCheck')
+            ->willReturn(false);
+
+        $this->reader->reflect($this->controller, $method);
+        $this->middleware->beforeController($this->controller, $method);
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataPublicPage')]
+    public function testPassesCsrfCheck(string $method): void {
+        $this->request->expects($this->once())
+            ->method('passesCSRFCheck')
+            ->willReturn(true);
+        $this->request->expects($this->once())
+            ->method('passesStrictCookieCheck')
+            ->willReturn(true);
+
+        $this->reader->reflect($this->controller, $method);
+        $this->middleware->beforeController($this->controller, $method);
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataPublicPage')]
+    public function testFailCsrfCheck(string $method): void {
+        $this->expectException(CrossSiteRequestForgeryException::class);
+
+        $this->request->expects($this->once())
+            ->method('passesCSRFCheck')
+            ->willReturn(false);
+        $this->request->expects($this->once())
+            ->method('passesStrictCookieCheck')
+            ->willReturn(true);
+
+        $this->reader->reflect($this->controller, $method);
+        $this->middleware->beforeController($this->controller, $method);
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataPublicPageStrictCookieRequired')]
+    public function testStrictCookieRequiredCheck(string $method): void {
+        $this->expectException(\OC\AppFramework\Middleware\Security\Exceptions\StrictCookieMissingException::class);
+
+        $this->request->expects($this->never())
+            ->method('passesCSRFCheck');
+        $this->request->expects($this->once())
+            ->method('passesStrictCookieCheck')
+            ->willReturn(false);
+
+        $this->reader->reflect($this->controller, $method);
+        $this->middleware->beforeController($this->controller, $method);
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequiredPublicPage')]
+    public function testNoStrictCookieRequiredCheck(string $method): void {
+        $this->request->expects($this->never())
+            ->method('passesStrictCookieCheck')
+            ->willReturn(false);
+
+        $this->reader->reflect($this->controller, $method);
+        $this->middleware->beforeController($this->controller, $method);
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequiredPublicPageStrictCookieRequired')]
+    public function testPassesStrictCookieRequiredCheck(string $method): void {
+        $this->request
+            ->expects($this->once())
+            ->method('passesStrictCookieCheck')
+            ->willReturn(true);
+
+        $this->reader->reflect($this->controller, $method);
+        $this->middleware->beforeController($this->controller, $method);
+    }
+
+    public static function dataCsrfOcsController(): array {
+        return [
+            [NormalController::class, false, false, true],
+            [NormalController::class, false,  true, true],
+            [NormalController::class,  true, false, true],
+            [NormalController::class,  true,  true, true],
+
+            [OCSController::class, false, false,  true],
+            [OCSController::class, false,  true, false],
+            [OCSController::class,  true, false, false],
+            [OCSController::class,  true,  true, false],
+        ];
+    }
+
+    /**
+     * @param string $controllerClass
+     * @param bool $hasOcsApiHeader
+     * @param bool $hasBearerAuth
+     * @param bool $exception
+     */
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataCsrfOcsController')]
+    public function testCsrfOcsController(string $controllerClass, bool $hasOcsApiHeader, bool $hasBearerAuth, bool $exception): void {
+        $this->request
+            ->method('getHeader')
+            ->willReturnCallback(function ($header) use ($hasOcsApiHeader, $hasBearerAuth) {
+                if ($header === 'OCS-APIREQUEST' && $hasOcsApiHeader) {
+                    return 'true';
+                }
+                if ($header === 'Authorization' && $hasBearerAuth) {
+                    return 'Bearer TOKEN!';
+                }
+                return '';
+            });
+        $this->request->expects($this->once())
+            ->method('passesStrictCookieCheck')
+            ->willReturn(true);
+
+        $controller = new $controllerClass('test', $this->request);
+
+        try {
+            $this->middleware->beforeController($controller, 'foo');
+            $this->assertFalse($exception);
+        } catch (CrossSiteRequestForgeryException $e) {
+            $this->assertTrue($exception);
+        }
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoAdminRequiredNoCSRFRequired')]
+    public function testLoggedInCheck(string $method): void {
+        $this->securityCheck($method, 'isLoggedIn');
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoAdminRequiredNoCSRFRequired')]
+    public function testFailLoggedInCheck(string $method): void {
+        $this->securityCheck($method, 'isLoggedIn', true);
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequired')]
+    public function testIsAdminCheck(string $method): void {
+        $this->securityCheck($method, 'isAdminUser');
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequiredSubAdminRequired')]
+    public function testIsNotSubAdminCheck(string $method): void {
+        $this->reader->reflect($this->controller, $method);
+        $sec = $this->getMiddleware(true, false, false);
+
+        $this->expectException(SecurityException::class);
+        $sec->beforeController($this->controller, $method);
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequiredSubAdminRequired')]
+    public function testIsSubAdminCheck(string $method): void {
+        $this->reader->reflect($this->controller, $method);
+        $sec = $this->getMiddleware(true, false, true);
+
+        $sec->beforeController($this->controller, $method);
+        $this->addToAssertionCount(1);
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequiredSubAdminRequired')]
+    public function testIsSubAdminAndAdminCheck(string $method): void {
+        $this->reader->reflect($this->controller, $method);
+        $sec = $this->getMiddleware(true, true, true);
+
+        $sec->beforeController($this->controller, $method);
+        $this->addToAssertionCount(1);
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoCSRFRequired')]
+    public function testFailIsAdminCheck(string $method): void {
+        $this->securityCheck($method, 'isAdminUser', true);
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoAdminRequiredNoCSRFRequiredPublicPage')]
+    public function testRestrictedAppLoggedInPublicPage(string $method): void {
+        $middleware = $this->getMiddleware(true, false, false);
+        $this->reader->reflect($this->controller, $method);
+
+        $this->appManager->method('getAppPath')
+            ->with('files')
+            ->willReturn('foo');
+
+        $this->appManager->method('isEnabledForUser')
+            ->with('files')
+            ->willReturn(false);
+
+        $middleware->beforeController($this->controller, $method);
+        $this->addToAssertionCount(1);
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoAdminRequiredNoCSRFRequiredPublicPage')]
+    public function testRestrictedAppNotLoggedInPublicPage(string $method): void {
+        $middleware = $this->getMiddleware(false, false, false);
+        $this->reader->reflect($this->controller, $method);
+
+        $this->appManager->method('getAppPath')
+            ->with('files')
+            ->willReturn('foo');
+
+        $this->appManager->method('isEnabledForUser')
+            ->with('files')
+            ->willReturn(false);
+
+        $middleware->beforeController($this->controller, $method);
+        $this->addToAssertionCount(1);
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataNoAdminRequiredNoCSRFRequired')]
+    public function testRestrictedAppLoggedIn(string $method): void {
+        $middleware = $this->getMiddleware(true, false, false, false);
+        $this->reader->reflect($this->controller, $method);
+
+        $this->appManager->method('getAppPath')
+            ->with('files')
+            ->willReturn('foo');
+
+        $this->expectException(AppNotEnabledException::class);
+        $middleware->beforeController($this->controller, $method);
+    }
+
+
+    public function testAfterExceptionNotCaughtThrowsItAgain(): void {
+        $ex = new \Exception();
+        $this->expectException(\Exception::class);
+        $this->middleware->afterException($this->controller, 'test', $ex);
+    }
+
+    public function testAfterExceptionReturnsRedirectForNotLoggedInUser(): void {
+        $this->request = new Request(
+            [
+                'server'
+                    => [
+                        'HTTP_ACCEPT' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+                        'REQUEST_URI' => 'nextcloud/index.php/apps/specialapp'
+                    ]
+            ],
+            $this->createMock(IRequestId::class),
+            $this->createMock(IConfig::class)
+        );
+        $this->middleware = $this->getMiddleware(false, false, false);
+        $this->urlGenerator
+            ->expects($this->once())
+            ->method('linkToRoute')
+            ->with(
+                'core.login.showLoginForm',
+                [
+                    'redirect_url' => 'nextcloud/index.php/apps/specialapp',
+                ]
+            )
+            ->willReturn('http://localhost/nextcloud/index.php/login?redirect_url=nextcloud/index.php/apps/specialapp');
+        $this->logger
+            ->expects($this->once())
+            ->method('debug');
+        $response = $this->middleware->afterException(
+            $this->controller,
+            'test',
+            new NotLoggedInException()
+        );
+        $expected = new RedirectResponse('http://localhost/nextcloud/index.php/login?redirect_url=nextcloud/index.php/apps/specialapp');
+        $this->assertEquals($expected, $response);
+    }
+
+    public function testAfterExceptionRedirectsToWebRootAfterStrictCookieFail(): void {
+        $this->request = new Request(
+            [
+                'server' => [
+                    'HTTP_ACCEPT' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+                    'REQUEST_URI' => 'nextcloud/index.php/apps/specialapp',
+                ],
+            ],
+            $this->createMock(IRequestId::class),
+            $this->createMock(IConfig::class)
+        );
+
+        $this->middleware = $this->getMiddleware(false, false, false);
+        $response = $this->middleware->afterException(
+            $this->controller,
+            'test',
+            new StrictCookieMissingException()
+        );
+
+        $expected = new RedirectResponse(\OC::$WEBROOT . '/');
+        $this->assertEquals($expected, $response);
+    }
+
+
+    /**
+     * @return array
+     */
+    public static function exceptionProvider(): array {
+        return [
+            [
+                new AppNotEnabledException(),
+            ],
+            [
+                new CrossSiteRequestForgeryException(),
+            ],
+            [
+                new NotAdminException(''),
+            ],
+        ];
+    }
+
+    /**
+     * @param SecurityException $exception
+     */
+    #[\PHPUnit\Framework\Attributes\DataProvider('exceptionProvider')]
+    public function testAfterExceptionReturnsTemplateResponse(SecurityException $exception): void {
+        $this->request = new Request(
+            [
+                'server'
+                    => [
+                        'HTTP_ACCEPT' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+                        'REQUEST_URI' => 'nextcloud/index.php/apps/specialapp'
+                    ]
+            ],
+            $this->createMock(IRequestId::class),
+            $this->createMock(IConfig::class)
+        );
+        $this->middleware = $this->getMiddleware(false, false, false);
+        $this->logger
+            ->expects($this->once())
+            ->method('debug');
+        $response = $this->middleware->afterException(
+            $this->controller,
+            'test',
+            $exception
+        );
+        $expected = new TemplateResponse('core', '403', ['message' => $exception->getMessage()], 'guest');
+        $expected->setStatus($exception->getCode());
+        $this->assertEquals($expected, $response);
+    }
+
+    public function testAfterAjaxExceptionReturnsJSONError(): void {
+        $response = $this->middleware->afterException($this->controller, 'test',
+            $this->secAjaxException);
+
+        $this->assertTrue($response instanceof JSONResponse);
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataExAppRequired')]
+    public function testExAppRequired(string $method): void {
+        $middleware = $this->getMiddleware(true, false, false);
+        $this->reader->reflect($this->controller, $method);
+
+        $session = $this->createMock(ISession::class);
+        $session->method('get')->with('app_api')->willReturn(true);
+        $this->userSession->method('getSession')->willReturn($session);
+
+        $this->request->expects($this->once())
+            ->method('passesStrictCookieCheck')
+            ->willReturn(true);
+        $this->request->expects($this->once())
+            ->method('passesCSRFCheck')
+            ->willReturn(true);
+
+        $middleware->beforeController($this->controller, $method);
+    }
+
+    #[\PHPUnit\Framework\Attributes\DataProvider('dataExAppRequired')]
+    public function testExAppRequiredError(string $method): void {
+        $middleware = $this->getMiddleware(true, false, false, false);
+        $this->reader->reflect($this->controller, $method);
+
+        $session = $this->createMock(ISession::class);
+        $session->method('get')->with('app_api')->willReturn(false);
+        $this->userSession->method('getSession')->willReturn($session);
+
+        $this->expectException(ExAppRequiredException::class);
+        $middleware->beforeController($this->controller, $method);
+    }
 }

Spacing +11 added lines, -11 removed lines

@@ -49,7 +49,7 @@ 
 	private ControllerMethodReflector $reader;
 	private SecurityMiddlewareController $controller;
 	private SecurityException $secAjaxException;
-	private IRequest|MockObject $request;
+	private IRequest | MockObject $request;
 	private MiddlewareUtils $middlewareUtils;
 	private LoggerInterface&MockObject $logger;
 	private INavigationManager&MockObject $navigationManager;
@@ -398,14 +398,14 @@ 
 	public static function dataCsrfOcsController(): array {
 		return [
 			[NormalController::class, false, false, true],
-			[NormalController::class, false,  true, true],
-			[NormalController::class,  true, false, true],
-			[NormalController::class,  true,  true, true],
-
-			[OCSController::class, false, false,  true],
-			[OCSController::class, false,  true, false],
-			[OCSController::class,  true, false, false],
-			[OCSController::class,  true,  true, false],
+			[NormalController::class, false, true, true],
+			[NormalController::class, true, false, true],
+			[NormalController::class, true, true, true],
+
+			[OCSController::class, false, false, true],
+			[OCSController::class, false, true, false],
+			[OCSController::class, true, false, false],
+			[OCSController::class, true, true, false],
 		];
 	}
 
@@ -419,7 +419,7 @@ 
 	public function testCsrfOcsController(string $controllerClass, bool $hasOcsApiHeader, bool $hasBearerAuth, bool $exception): void {
 		$this->request
 			->method('getHeader')
-			->willReturnCallback(function ($header) use ($hasOcsApiHeader, $hasBearerAuth) {
+			->willReturnCallback(function($header) use ($hasOcsApiHeader, $hasBearerAuth) {
 				if ($header === 'OCS-APIREQUEST' && $hasOcsApiHeader) {
 					return 'true';
 				}
@@ -597,7 +597,7 @@ 
 			new StrictCookieMissingException()
 		);
 
-		$expected = new RedirectResponse(\OC::$WEBROOT . '/');
+		$expected = new RedirectResponse(\OC::$WEBROOT.'/');
 		$this->assertEquals($expected, $response);
 	}
 

tests/lib/AppFramework/Middleware/Security/SameSiteCookieMiddlewareTest.php

Indentation +79 added lines, -79 removed lines

@@ -22,114 +22,114 @@
 use Test\TestCase;
 
 class HasAnnotationController extends Controller {
-	#[NoSameSiteCookieRequired]
-	public function foo(): Response {
-		return new Response();
-	}
+    #[NoSameSiteCookieRequired]
+    public function foo(): Response {
+        return new Response();
+    }
 }
 
 class NoAnnotationController extends Controller {
-	public function foo(): Response {
-		return new Response();
-	}
+    public function foo(): Response {
+        return new Response();
+    }
 }
 
 class SameSiteCookieMiddlewareTest extends TestCase {
-	private SameSiteCookieMiddleware $middleware;
-	private Request&MockObject $request;
-	private ControllerMethodReflector&MockObject $reflector;
-	private LoggerInterface&MockObject $logger;
+    private SameSiteCookieMiddleware $middleware;
+    private Request&MockObject $request;
+    private ControllerMethodReflector&MockObject $reflector;
+    private LoggerInterface&MockObject $logger;
 
-	protected function setUp(): void {
-		parent::setUp();
+    protected function setUp(): void {
+        parent::setUp();
 
-		$this->request = $this->createMock(Request::class);
-		$this->logger = $this->createMock(LoggerInterface::class);
-		$this->reflector = $this->createMock(ControllerMethodReflector::class);
-		$this->middleware = new SameSiteCookieMiddleware($this->request, new MiddlewareUtils($this->reflector, $this->logger));
-	}
+        $this->request = $this->createMock(Request::class);
+        $this->logger = $this->createMock(LoggerInterface::class);
+        $this->reflector = $this->createMock(ControllerMethodReflector::class);
+        $this->middleware = new SameSiteCookieMiddleware($this->request, new MiddlewareUtils($this->reflector, $this->logger));
+    }
 
-	public function testBeforeControllerNoIndex(): void {
-		$this->request->method('getScriptName')
-			->willReturn('/ocs/v2.php');
+    public function testBeforeControllerNoIndex(): void {
+        $this->request->method('getScriptName')
+            ->willReturn('/ocs/v2.php');
 
-		$this->middleware->beforeController(new NoAnnotationController('foo', $this->request), 'foo');
-		$this->addToAssertionCount(1);
-	}
+        $this->middleware->beforeController(new NoAnnotationController('foo', $this->request), 'foo');
+        $this->addToAssertionCount(1);
+    }
 
-	public function testBeforeControllerIndexHasAnnotation(): void {
-		$this->request->method('getScriptName')
-			->willReturn('/index.php');
+    public function testBeforeControllerIndexHasAnnotation(): void {
+        $this->request->method('getScriptName')
+            ->willReturn('/index.php');
 
-		$this->reflector->method('hasAnnotation')
-			->with('NoSameSiteCookieRequired')
-			->willReturn(true);
+        $this->reflector->method('hasAnnotation')
+            ->with('NoSameSiteCookieRequired')
+            ->willReturn(true);
 
-		$this->middleware->beforeController(new HasAnnotationController('foo', $this->request), 'foo');
-		$this->addToAssertionCount(1);
-	}
+        $this->middleware->beforeController(new HasAnnotationController('foo', $this->request), 'foo');
+        $this->addToAssertionCount(1);
+    }
 
-	public function testBeforeControllerIndexNoAnnotationPassingCheck(): void {
-		$this->request->method('getScriptName')
-			->willReturn('/index.php');
+    public function testBeforeControllerIndexNoAnnotationPassingCheck(): void {
+        $this->request->method('getScriptName')
+            ->willReturn('/index.php');
 
-		$this->reflector->method('hasAnnotation')
-			->with('NoSameSiteCookieRequired')
-			->willReturn(false);
+        $this->reflector->method('hasAnnotation')
+            ->with('NoSameSiteCookieRequired')
+            ->willReturn(false);
 
-		$this->request->method('passesLaxCookieCheck')
-			->willReturn(true);
+        $this->request->method('passesLaxCookieCheck')
+            ->willReturn(true);
 
-		$this->middleware->beforeController(new NoAnnotationController('foo', $this->request), 'foo');
-		$this->addToAssertionCount(1);
-	}
+        $this->middleware->beforeController(new NoAnnotationController('foo', $this->request), 'foo');
+        $this->addToAssertionCount(1);
+    }
 
-	public function testBeforeControllerIndexNoAnnotationFailingCheck(): void {
-		$this->expectException(LaxSameSiteCookieFailedException::class);
+    public function testBeforeControllerIndexNoAnnotationFailingCheck(): void {
+        $this->expectException(LaxSameSiteCookieFailedException::class);
 
-		$this->request->method('getScriptName')
-			->willReturn('/index.php');
+        $this->request->method('getScriptName')
+            ->willReturn('/index.php');
 
-		$this->reflector->method('hasAnnotation')
-			->with('NoSameSiteCookieRequired')
-			->willReturn(false);
+        $this->reflector->method('hasAnnotation')
+            ->with('NoSameSiteCookieRequired')
+            ->willReturn(false);
 
-		$this->request->method('passesLaxCookieCheck')
-			->willReturn(false);
+        $this->request->method('passesLaxCookieCheck')
+            ->willReturn(false);
 
-		$this->middleware->beforeController(new NoAnnotationController('foo', $this->request), 'foo');
-	}
+        $this->middleware->beforeController(new NoAnnotationController('foo', $this->request), 'foo');
+    }
 
-	public function testAfterExceptionNoLaxCookie(): void {
-		$ex = new SecurityException();
+    public function testAfterExceptionNoLaxCookie(): void {
+        $ex = new SecurityException();
 
-		try {
-			$this->middleware->afterException(new NoAnnotationController('foo', $this->request), 'foo', $ex);
-			$this->fail();
-		} catch (\Exception $e) {
-			$this->assertSame($ex, $e);
-		}
-	}
+        try {
+            $this->middleware->afterException(new NoAnnotationController('foo', $this->request), 'foo', $ex);
+            $this->fail();
+        } catch (\Exception $e) {
+            $this->assertSame($ex, $e);
+        }
+    }
 
-	public function testAfterExceptionLaxCookie(): void {
-		$ex = new LaxSameSiteCookieFailedException();
+    public function testAfterExceptionLaxCookie(): void {
+        $ex = new LaxSameSiteCookieFailedException();
 
-		$this->request->method('getRequestUri')
-			->willReturn('/myrequri');
+        $this->request->method('getRequestUri')
+            ->willReturn('/myrequri');
 
-		$middleware = $this->getMockBuilder(SameSiteCookieMiddleware::class)
-			->setConstructorArgs([$this->request, new MiddlewareUtils($this->reflector, $this->logger)])
-			->onlyMethods(['setSameSiteCookie'])
-			->getMock();
+        $middleware = $this->getMockBuilder(SameSiteCookieMiddleware::class)
+            ->setConstructorArgs([$this->request, new MiddlewareUtils($this->reflector, $this->logger)])
+            ->onlyMethods(['setSameSiteCookie'])
+            ->getMock();
 
-		$middleware->expects($this->once())
-			->method('setSameSiteCookie');
+        $middleware->expects($this->once())
+            ->method('setSameSiteCookie');
 
-		$resp = $middleware->afterException(new NoAnnotationController('foo', $this->request), 'foo', $ex);
+        $resp = $middleware->afterException(new NoAnnotationController('foo', $this->request), 'foo', $ex);
 
-		$this->assertSame(Http::STATUS_FOUND, $resp->getStatus());
+        $this->assertSame(Http::STATUS_FOUND, $resp->getStatus());
 
-		$headers = $resp->getHeaders();
-		$this->assertSame('/myrequri', $headers['Location']);
-	}
+        $headers = $resp->getHeaders();
+        $this->assertSame('/myrequri', $headers['Location']);
+    }
 }

apps/theming/lib/Controller/ThemingController.php

Indentation +436 added lines, -436 removed lines

@@ -44,466 +44,466 @@
  * @package OCA\Theming\Controller
  */
 class ThemingController extends Controller {
-	public const VALID_UPLOAD_KEYS = ['header', 'logo', 'logoheader', 'background', 'favicon'];
+    public const VALID_UPLOAD_KEYS = ['header', 'logo', 'logoheader', 'background', 'favicon'];
 
-	public function __construct(
-		string $appName,
-		IRequest $request,
-		private IConfig $config,
-		private IAppConfig $appConfig,
-		private ThemingDefaults $themingDefaults,
-		private IL10N $l10n,
-		private IURLGenerator $urlGenerator,
-		private IAppManager $appManager,
-		private ImageManager $imageManager,
-		private ThemesService $themesService,
-		private INavigationManager $navigationManager,
-	) {
-		parent::__construct($appName, $request);
-	}
+    public function __construct(
+        string $appName,
+        IRequest $request,
+        private IConfig $config,
+        private IAppConfig $appConfig,
+        private ThemingDefaults $themingDefaults,
+        private IL10N $l10n,
+        private IURLGenerator $urlGenerator,
+        private IAppManager $appManager,
+        private ImageManager $imageManager,
+        private ThemesService $themesService,
+        private INavigationManager $navigationManager,
+    ) {
+        parent::__construct($appName, $request);
+    }
 
-	/**
-	 * @throws NotPermittedException
-	 */
-	#[AuthorizedAdminSetting(settings: Admin::class)]
-	public function updateStylesheet(string $setting, string $value): DataResponse {
-		$value = trim($value);
-		$error = null;
-		$saved = false;
-		switch ($setting) {
-			case 'name':
-				if (strlen($value) > 250) {
-					$error = $this->l10n->t('The given name is too long');
-				}
-				break;
-			case 'url':
-				if (strlen($value) > 500) {
-					$error = $this->l10n->t('The given web address is too long');
-				}
-				if ($value !== '' && !$this->isValidUrl($value)) {
-					$error = $this->l10n->t('The given web address is not a valid URL');
-				}
-				break;
-			case 'legalNoticeUrl':
-				$setting = 'imprintUrl';
-				// no break
-			case 'imprintUrl':
-				if (strlen($value) > 500) {
-					$error = $this->l10n->t('The given legal notice address is too long');
-				}
-				if ($value !== '' && !$this->isValidUrl($value)) {
-					$error = $this->l10n->t('The given legal notice address is not a valid URL');
-				}
-				break;
-			case 'privacyPolicyUrl':
-				$setting = 'privacyUrl';
-				// no break
-			case 'privacyUrl':
-				if (strlen($value) > 500) {
-					$error = $this->l10n->t('The given privacy policy address is too long');
-				}
-				if ($value !== '' && !$this->isValidUrl($value)) {
-					$error = $this->l10n->t('The given privacy policy address is not a valid URL');
-				}
-				break;
-			case 'slogan':
-				if (strlen($value) > 500) {
-					$error = $this->l10n->t('The given slogan is too long');
-				}
-				break;
-			case 'primaryColor':
-				$setting = 'primary_color';
-				// no break
-			case 'primary_color':
-				if (!preg_match('/^\#([0-9a-f]{3}|[0-9a-f]{6})$/i', $value)) {
-					$error = $this->l10n->t('The given color is invalid');
-				}
-				break;
-			case 'backgroundColor':
-				$setting = 'background_color';
-				// no break
-			case 'background_color':
-				if (!preg_match('/^\#([0-9a-f]{3}|[0-9a-f]{6})$/i', $value)) {
-					$error = $this->l10n->t('The given color is invalid');
-				}
-				break;
-			case 'disableUserTheming':
-			case 'disable-user-theming':
-				if (!in_array($value, ['yes', 'true', 'no', 'false'])) {
-					$error = $this->l10n->t('%1$s should be true or false', ['disable-user-theming']);
-				} else {
-					$this->appConfig->setAppValueBool('disable-user-theming', $value === 'yes' || $value === 'true');
-					$saved = true;
-				}
-				break;
-			case 'backgroundMime':
-				if ($value !== 'backgroundColor') {
-					$error = $this->l10n->t('%1$s can only be set to %2$s through the API', ['backgroundMime', 'backgroundColor']);
-				}
-				break;
-			default:
-				$error = $this->l10n->t('Invalid setting key');
-		}
-		if ($error !== null) {
-			return new DataResponse([
-				'data' => [
-					'message' => $error,
-				],
-				'status' => 'error'
-			], Http::STATUS_BAD_REQUEST);
-		}
+    /**
+     * @throws NotPermittedException
+     */
+    #[AuthorizedAdminSetting(settings: Admin::class)]
+    public function updateStylesheet(string $setting, string $value): DataResponse {
+        $value = trim($value);
+        $error = null;
+        $saved = false;
+        switch ($setting) {
+            case 'name':
+                if (strlen($value) > 250) {
+                    $error = $this->l10n->t('The given name is too long');
+                }
+                break;
+            case 'url':
+                if (strlen($value) > 500) {
+                    $error = $this->l10n->t('The given web address is too long');
+                }
+                if ($value !== '' && !$this->isValidUrl($value)) {
+                    $error = $this->l10n->t('The given web address is not a valid URL');
+                }
+                break;
+            case 'legalNoticeUrl':
+                $setting = 'imprintUrl';
+                // no break
+            case 'imprintUrl':
+                if (strlen($value) > 500) {
+                    $error = $this->l10n->t('The given legal notice address is too long');
+                }
+                if ($value !== '' && !$this->isValidUrl($value)) {
+                    $error = $this->l10n->t('The given legal notice address is not a valid URL');
+                }
+                break;
+            case 'privacyPolicyUrl':
+                $setting = 'privacyUrl';
+                // no break
+            case 'privacyUrl':
+                if (strlen($value) > 500) {
+                    $error = $this->l10n->t('The given privacy policy address is too long');
+                }
+                if ($value !== '' && !$this->isValidUrl($value)) {
+                    $error = $this->l10n->t('The given privacy policy address is not a valid URL');
+                }
+                break;
+            case 'slogan':
+                if (strlen($value) > 500) {
+                    $error = $this->l10n->t('The given slogan is too long');
+                }
+                break;
+            case 'primaryColor':
+                $setting = 'primary_color';
+                // no break
+            case 'primary_color':
+                if (!preg_match('/^\#([0-9a-f]{3}|[0-9a-f]{6})$/i', $value)) {
+                    $error = $this->l10n->t('The given color is invalid');
+                }
+                break;
+            case 'backgroundColor':
+                $setting = 'background_color';
+                // no break
+            case 'background_color':
+                if (!preg_match('/^\#([0-9a-f]{3}|[0-9a-f]{6})$/i', $value)) {
+                    $error = $this->l10n->t('The given color is invalid');
+                }
+                break;
+            case 'disableUserTheming':
+            case 'disable-user-theming':
+                if (!in_array($value, ['yes', 'true', 'no', 'false'])) {
+                    $error = $this->l10n->t('%1$s should be true or false', ['disable-user-theming']);
+                } else {
+                    $this->appConfig->setAppValueBool('disable-user-theming', $value === 'yes' || $value === 'true');
+                    $saved = true;
+                }
+                break;
+            case 'backgroundMime':
+                if ($value !== 'backgroundColor') {
+                    $error = $this->l10n->t('%1$s can only be set to %2$s through the API', ['backgroundMime', 'backgroundColor']);
+                }
+                break;
+            default:
+                $error = $this->l10n->t('Invalid setting key');
+        }
+        if ($error !== null) {
+            return new DataResponse([
+                'data' => [
+                    'message' => $error,
+                ],
+                'status' => 'error'
+            ], Http::STATUS_BAD_REQUEST);
+        }
 
-		if (!$saved) {
-			$this->themingDefaults->set($setting, $value);
-		}
+        if (!$saved) {
+            $this->themingDefaults->set($setting, $value);
+        }
 
-		return new DataResponse([
-			'data' => [
-				'message' => $this->l10n->t('Saved'),
-			],
-			'status' => 'success'
-		]);
-	}
+        return new DataResponse([
+            'data' => [
+                'message' => $this->l10n->t('Saved'),
+            ],
+            'status' => 'success'
+        ]);
+    }
 
-	/**
-	 * @throws NotPermittedException
-	 */
-	#[AuthorizedAdminSetting(settings: Admin::class)]
-	public function updateAppMenu(string $setting, mixed $value): DataResponse {
-		$error = null;
-		switch ($setting) {
-			case 'defaultApps':
-				if (is_array($value)) {
-					try {
-						$this->navigationManager->setDefaultEntryIds($value);
-					} catch (InvalidArgumentException $e) {
-						$error = $this->l10n->t('Invalid app given');
-					}
-				} else {
-					$error = $this->l10n->t('Invalid type for setting "defaultApp" given');
-				}
-				break;
-			default:
-				$error = $this->l10n->t('Invalid setting key');
-		}
-		if ($error !== null) {
-			return new DataResponse([
-				'data' => [
-					'message' => $error,
-				],
-				'status' => 'error'
-			], Http::STATUS_BAD_REQUEST);
-		}
+    /**
+     * @throws NotPermittedException
+     */
+    #[AuthorizedAdminSetting(settings: Admin::class)]
+    public function updateAppMenu(string $setting, mixed $value): DataResponse {
+        $error = null;
+        switch ($setting) {
+            case 'defaultApps':
+                if (is_array($value)) {
+                    try {
+                        $this->navigationManager->setDefaultEntryIds($value);
+                    } catch (InvalidArgumentException $e) {
+                        $error = $this->l10n->t('Invalid app given');
+                    }
+                } else {
+                    $error = $this->l10n->t('Invalid type for setting "defaultApp" given');
+                }
+                break;
+            default:
+                $error = $this->l10n->t('Invalid setting key');
+        }
+        if ($error !== null) {
+            return new DataResponse([
+                'data' => [
+                    'message' => $error,
+                ],
+                'status' => 'error'
+            ], Http::STATUS_BAD_REQUEST);
+        }
 
-		return new DataResponse([
-			'data' => [
-				'message' => $this->l10n->t('Saved'),
-			],
-			'status' => 'success'
-		]);
-	}
+        return new DataResponse([
+            'data' => [
+                'message' => $this->l10n->t('Saved'),
+            ],
+            'status' => 'success'
+        ]);
+    }
 
-	/**
-	 * Check that a string is a valid http/https url.
-	 * Also validates that there is no way for XSS through HTML
-	 */
-	private function isValidUrl(string $url): bool {
-		return ((str_starts_with($url, 'http://') || str_starts_with($url, 'https://'))
-			&& filter_var($url, FILTER_VALIDATE_URL) !== false)
-			&& !str_contains($url, '"');
-	}
+    /**
+     * Check that a string is a valid http/https url.
+     * Also validates that there is no way for XSS through HTML
+     */
+    private function isValidUrl(string $url): bool {
+        return ((str_starts_with($url, 'http://') || str_starts_with($url, 'https://'))
+            && filter_var($url, FILTER_VALIDATE_URL) !== false)
+            && !str_contains($url, '"');
+    }
 
-	/**
-	 * @throws NotPermittedException
-	 */
-	#[AuthorizedAdminSetting(settings: Admin::class)]
-	public function uploadImage(): DataResponse {
-		$key = $this->request->getParam('key');
-		if (!in_array($key, self::VALID_UPLOAD_KEYS, true)) {
-			return new DataResponse(
-				[
-					'data' => [
-						'message' => 'Invalid key'
-					],
-					'status' => 'failure',
-				],
-				Http::STATUS_BAD_REQUEST
-			);
-		}
-		$image = $this->request->getUploadedFile('image');
-		$error = null;
-		$phpFileUploadErrors = [
-			UPLOAD_ERR_OK => $this->l10n->t('The file was uploaded'),
-			UPLOAD_ERR_INI_SIZE => $this->l10n->t('The uploaded file exceeds the upload_max_filesize directive in php.ini'),
-			UPLOAD_ERR_FORM_SIZE => $this->l10n->t('The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form'),
-			UPLOAD_ERR_PARTIAL => $this->l10n->t('The file was only partially uploaded'),
-			UPLOAD_ERR_NO_FILE => $this->l10n->t('No file was uploaded'),
-			UPLOAD_ERR_NO_TMP_DIR => $this->l10n->t('Missing a temporary folder'),
-			UPLOAD_ERR_CANT_WRITE => $this->l10n->t('Could not write file to disk'),
-			UPLOAD_ERR_EXTENSION => $this->l10n->t('A PHP extension stopped the file upload'),
-		];
-		if (empty($image)) {
-			$error = $this->l10n->t('No file uploaded');
-		}
-		if (!empty($image) && array_key_exists('error', $image) && $image['error'] !== UPLOAD_ERR_OK) {
-			$error = $phpFileUploadErrors[$image['error']];
-		}
+    /**
+     * @throws NotPermittedException
+     */
+    #[AuthorizedAdminSetting(settings: Admin::class)]
+    public function uploadImage(): DataResponse {
+        $key = $this->request->getParam('key');
+        if (!in_array($key, self::VALID_UPLOAD_KEYS, true)) {
+            return new DataResponse(
+                [
+                    'data' => [
+                        'message' => 'Invalid key'
+                    ],
+                    'status' => 'failure',
+                ],
+                Http::STATUS_BAD_REQUEST
+            );
+        }
+        $image = $this->request->getUploadedFile('image');
+        $error = null;
+        $phpFileUploadErrors = [
+            UPLOAD_ERR_OK => $this->l10n->t('The file was uploaded'),
+            UPLOAD_ERR_INI_SIZE => $this->l10n->t('The uploaded file exceeds the upload_max_filesize directive in php.ini'),
+            UPLOAD_ERR_FORM_SIZE => $this->l10n->t('The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form'),
+            UPLOAD_ERR_PARTIAL => $this->l10n->t('The file was only partially uploaded'),
+            UPLOAD_ERR_NO_FILE => $this->l10n->t('No file was uploaded'),
+            UPLOAD_ERR_NO_TMP_DIR => $this->l10n->t('Missing a temporary folder'),
+            UPLOAD_ERR_CANT_WRITE => $this->l10n->t('Could not write file to disk'),
+            UPLOAD_ERR_EXTENSION => $this->l10n->t('A PHP extension stopped the file upload'),
+        ];
+        if (empty($image)) {
+            $error = $this->l10n->t('No file uploaded');
+        }
+        if (!empty($image) && array_key_exists('error', $image) && $image['error'] !== UPLOAD_ERR_OK) {
+            $error = $phpFileUploadErrors[$image['error']];
+        }
 
-		if ($error !== null) {
-			return new DataResponse(
-				[
-					'data' => [
-						'message' => $error
-					],
-					'status' => 'failure',
-				],
-				Http::STATUS_UNPROCESSABLE_ENTITY
-			);
-		}
+        if ($error !== null) {
+            return new DataResponse(
+                [
+                    'data' => [
+                        'message' => $error
+                    ],
+                    'status' => 'failure',
+                ],
+                Http::STATUS_UNPROCESSABLE_ENTITY
+            );
+        }
 
-		try {
-			$mime = $this->imageManager->updateImage($key, $image['tmp_name']);
-			$this->themingDefaults->set($key . 'Mime', $mime);
-		} catch (\Exception $e) {
-			return new DataResponse(
-				[
-					'data' => [
-						'message' => $e->getMessage()
-					],
-					'status' => 'failure',
-				],
-				Http::STATUS_UNPROCESSABLE_ENTITY
-			);
-		}
+        try {
+            $mime = $this->imageManager->updateImage($key, $image['tmp_name']);
+            $this->themingDefaults->set($key . 'Mime', $mime);
+        } catch (\Exception $e) {
+            return new DataResponse(
+                [
+                    'data' => [
+                        'message' => $e->getMessage()
+                    ],
+                    'status' => 'failure',
+                ],
+                Http::STATUS_UNPROCESSABLE_ENTITY
+            );
+        }
 
-		$name = $image['name'];
+        $name = $image['name'];
 
-		return new DataResponse(
-			[
-				'data'
-					=> [
-						'name' => $name,
-						'url' => $this->imageManager->getImageUrl($key),
-						'message' => $this->l10n->t('Saved'),
-					],
-				'status' => 'success'
-			]
-		);
-	}
+        return new DataResponse(
+            [
+                'data'
+                    => [
+                        'name' => $name,
+                        'url' => $this->imageManager->getImageUrl($key),
+                        'message' => $this->l10n->t('Saved'),
+                    ],
+                'status' => 'success'
+            ]
+        );
+    }
 
-	/**
-	 * Revert setting to default value
-	 *
-	 * @param string $setting setting which should be reverted
-	 * @return DataResponse
-	 * @throws NotPermittedException
-	 */
-	#[AuthorizedAdminSetting(settings: Admin::class)]
-	public function undo(string $setting): DataResponse {
-		$setting = match ($setting) {
-			'primaryColor' => 'primary_color',
-			'backgroundColor' => 'background_color',
-			'legalNoticeUrl' => 'imprintUrl',
-			'privacyPolicyUrl' => 'privacyUrl',
-			default => $setting,
-		};
-		$value = $this->themingDefaults->undo($setting);
+    /**
+     * Revert setting to default value
+     *
+     * @param string $setting setting which should be reverted
+     * @return DataResponse
+     * @throws NotPermittedException
+     */
+    #[AuthorizedAdminSetting(settings: Admin::class)]
+    public function undo(string $setting): DataResponse {
+        $setting = match ($setting) {
+            'primaryColor' => 'primary_color',
+            'backgroundColor' => 'background_color',
+            'legalNoticeUrl' => 'imprintUrl',
+            'privacyPolicyUrl' => 'privacyUrl',
+            default => $setting,
+        };
+        $value = $this->themingDefaults->undo($setting);
 
-		return new DataResponse(
-			[
-				'data'
-					=> [
-						'value' => $value,
-						'message' => $this->l10n->t('Saved'),
-					],
-				'status' => 'success'
-			]
-		);
-	}
+        return new DataResponse(
+            [
+                'data'
+                    => [
+                        'value' => $value,
+                        'message' => $this->l10n->t('Saved'),
+                    ],
+                'status' => 'success'
+            ]
+        );
+    }
 
-	/**
-	 * Revert all theming settings to their default values
-	 *
-	 * @return DataResponse
-	 * @throws NotPermittedException
-	 */
-	#[AuthorizedAdminSetting(settings: Admin::class)]
-	public function undoAll(): DataResponse {
-		$this->themingDefaults->undoAll();
-		$this->navigationManager->setDefaultEntryIds([]);
+    /**
+     * Revert all theming settings to their default values
+     *
+     * @return DataResponse
+     * @throws NotPermittedException
+     */
+    #[AuthorizedAdminSetting(settings: Admin::class)]
+    public function undoAll(): DataResponse {
+        $this->themingDefaults->undoAll();
+        $this->navigationManager->setDefaultEntryIds([]);
 
-		return new DataResponse(
-			[
-				'data'
-					=> [
-						'message' => $this->l10n->t('Saved'),
-					],
-				'status' => 'success'
-			]
-		);
-	}
+        return new DataResponse(
+            [
+                'data'
+                    => [
+                        'message' => $this->l10n->t('Saved'),
+                    ],
+                'status' => 'success'
+            ]
+        );
+    }
 
-	/**
-	 * @NoSameSiteCookieRequired
-	 *
-	 * Get an image
-	 *
-	 * @param string $key Key of the image
-	 * @param bool $useSvg Return image as SVG
-	 * @return FileDisplayResponse<Http::STATUS_OK, array{}>|NotFoundResponse<Http::STATUS_NOT_FOUND, array{}>
-	 * @throws NotPermittedException
-	 *
-	 * 200: Image returned
-	 * 404: Image not found
-	 */
-	#[PublicPage]
-	#[NoCSRFRequired]
-	#[OpenAPI(scope: OpenAPI::SCOPE_DEFAULT)]
-	public function getImage(string $key, bool $useSvg = true) {
-		try {
-			$useSvg = $useSvg && $this->imageManager->canConvert('SVG');
-			$file = $this->imageManager->getImage($key, $useSvg);
-		} catch (NotFoundException $e) {
-			return new NotFoundResponse();
-		}
+    /**
+     * @NoSameSiteCookieRequired
+     *
+     * Get an image
+     *
+     * @param string $key Key of the image
+     * @param bool $useSvg Return image as SVG
+     * @return FileDisplayResponse<Http::STATUS_OK, array{}>|NotFoundResponse<Http::STATUS_NOT_FOUND, array{}>
+     * @throws NotPermittedException
+     *
+     * 200: Image returned
+     * 404: Image not found
+     */
+    #[PublicPage]
+    #[NoCSRFRequired]
+    #[OpenAPI(scope: OpenAPI::SCOPE_DEFAULT)]
+    public function getImage(string $key, bool $useSvg = true) {
+        try {
+            $useSvg = $useSvg && $this->imageManager->canConvert('SVG');
+            $file = $this->imageManager->getImage($key, $useSvg);
+        } catch (NotFoundException $e) {
+            return new NotFoundResponse();
+        }
 
-		$response = new FileDisplayResponse($file);
-		$csp = new ContentSecurityPolicy();
-		$csp->allowInlineStyle();
-		$response->setContentSecurityPolicy($csp);
-		$response->cacheFor(3600);
-		$response->addHeader('Content-Type', $file->getMimeType());
-		$response->addHeader('Content-Disposition', 'attachment; filename="' . $key . '"');
-		return $response;
-	}
+        $response = new FileDisplayResponse($file);
+        $csp = new ContentSecurityPolicy();
+        $csp->allowInlineStyle();
+        $response->setContentSecurityPolicy($csp);
+        $response->cacheFor(3600);
+        $response->addHeader('Content-Type', $file->getMimeType());
+        $response->addHeader('Content-Disposition', 'attachment; filename="' . $key . '"');
+        return $response;
+    }
 
-	/**
-	 * Get the CSS stylesheet for a theme
-	 *
-	 * @param string $themeId ID of the theme
-	 * @param bool $plain Let the browser decide the CSS priority
-	 * @param bool $withCustomCss Include custom CSS
-	 * @return DataDisplayResponse<Http::STATUS_OK, array{Content-Type: 'text/css'}>|NotFoundResponse<Http::STATUS_NOT_FOUND, array{}>
-	 *
-	 * 200: Stylesheet returned
-	 * 404: Theme not found
-	 */
-	#[PublicPage]
-	#[NoCSRFRequired]
-	#[NoTwoFactorRequired]
-	#[OpenAPI(scope: OpenAPI::SCOPE_DEFAULT)]
-	#[NoSameSiteCookieRequired]
-	public function getThemeStylesheet(string $themeId, bool $plain = false, bool $withCustomCss = false) {
-		$themes = $this->themesService->getThemes();
-		if (!in_array($themeId, array_keys($themes))) {
-			return new NotFoundResponse();
-		}
+    /**
+     * Get the CSS stylesheet for a theme
+     *
+     * @param string $themeId ID of the theme
+     * @param bool $plain Let the browser decide the CSS priority
+     * @param bool $withCustomCss Include custom CSS
+     * @return DataDisplayResponse<Http::STATUS_OK, array{Content-Type: 'text/css'}>|NotFoundResponse<Http::STATUS_NOT_FOUND, array{}>
+     *
+     * 200: Stylesheet returned
+     * 404: Theme not found
+     */
+    #[PublicPage]
+    #[NoCSRFRequired]
+    #[NoTwoFactorRequired]
+    #[OpenAPI(scope: OpenAPI::SCOPE_DEFAULT)]
+    #[NoSameSiteCookieRequired]
+    public function getThemeStylesheet(string $themeId, bool $plain = false, bool $withCustomCss = false) {
+        $themes = $this->themesService->getThemes();
+        if (!in_array($themeId, array_keys($themes))) {
+            return new NotFoundResponse();
+        }
 
-		$theme = $themes[$themeId];
-		$customCss = $theme->getCustomCss();
+        $theme = $themes[$themeId];
+        $customCss = $theme->getCustomCss();
 
-		// Generate variables
-		$variables = '';
-		foreach ($theme->getCSSVariables() as $variable => $value) {
-			$variables .= "$variable:$value; ";
-		};
+        // Generate variables
+        $variables = '';
+        foreach ($theme->getCSSVariables() as $variable => $value) {
+            $variables .= "$variable:$value; ";
+        };
 
-		// If plain is set, the browser decides of the css priority
-		if ($plain) {
-			$css = ":root { $variables } " . $customCss;
-		} else {
-			// If not set, we'll rely on the body class
-			// We need to separate @-rules from normal selectors, as they can't be nested
-			// This is a replacement for the SCSS compiler that did this automatically before f1448fcf0777db7d4254cb0a3ef94d63be9f7a24
-			// We need a better way to handle this, but for now we just remove comments and split the at-rules
-			// from the rest of the CSS.
-			$customCssWithoutComments = preg_replace('!/\*.*?\*/!s', '', $customCss);
-			$customCssWithoutComments = preg_replace('!//.*!', '', $customCssWithoutComments);
-			preg_match_all('/(@[^{]+{(?:[^{}]*|(?R))*})/', $customCssWithoutComments, $atRules);
-			$atRulesCss = implode('', $atRules[0]);
-			$scopedCss = preg_replace('/(@[^{]+{(?:[^{}]*|(?R))*})/', '', $customCssWithoutComments);
+        // If plain is set, the browser decides of the css priority
+        if ($plain) {
+            $css = ":root { $variables } " . $customCss;
+        } else {
+            // If not set, we'll rely on the body class
+            // We need to separate @-rules from normal selectors, as they can't be nested
+            // This is a replacement for the SCSS compiler that did this automatically before f1448fcf0777db7d4254cb0a3ef94d63be9f7a24
+            // We need a better way to handle this, but for now we just remove comments and split the at-rules
+            // from the rest of the CSS.
+            $customCssWithoutComments = preg_replace('!/\*.*?\*/!s', '', $customCss);
+            $customCssWithoutComments = preg_replace('!//.*!', '', $customCssWithoutComments);
+            preg_match_all('/(@[^{]+{(?:[^{}]*|(?R))*})/', $customCssWithoutComments, $atRules);
+            $atRulesCss = implode('', $atRules[0]);
+            $scopedCss = preg_replace('/(@[^{]+{(?:[^{}]*|(?R))*})/', '', $customCssWithoutComments);
 
-			$css = "$atRulesCss [data-theme-$themeId] { $variables $scopedCss }";
-		}
+            $css = "$atRulesCss [data-theme-$themeId] { $variables $scopedCss }";
+        }
 
-		try {
-			$response = new DataDisplayResponse($css, Http::STATUS_OK, ['Content-Type' => 'text/css']);
-			$response->cacheFor(86400);
-			return $response;
-		} catch (NotFoundException $e) {
-			return new NotFoundResponse();
-		}
-	}
+        try {
+            $response = new DataDisplayResponse($css, Http::STATUS_OK, ['Content-Type' => 'text/css']);
+            $response->cacheFor(86400);
+            return $response;
+        } catch (NotFoundException $e) {
+            return new NotFoundResponse();
+        }
+    }
 
-	/**
-	 * Get the manifest for an app
-	 *
-	 * @param string $app ID of the app
-	 * @psalm-suppress LessSpecificReturnStatement The content of the Manifest doesn't need to be described in the return type
-	 * @return JSONResponse<Http::STATUS_OK, array{name: string, short_name: string, start_url: string, theme_color: string, background_color: string, description: string, icons: list<array{src: non-empty-string, type: string, sizes: string}>, display_override: list<string>, display: string}, array{}>|JSONResponse<Http::STATUS_NOT_FOUND, list<empty>, array{}>
-	 *
-	 * 200: Manifest returned
-	 * 404: App not found
-	 */
-	#[PublicPage]
-	#[NoCSRFRequired]
-	#[BruteForceProtection(action: 'manifest')]
-	#[OpenAPI(scope: OpenAPI::SCOPE_DEFAULT)]
-	public function getManifest(string $app): JSONResponse {
-		$cacheBusterValue = $this->config->getAppValue('theming', 'cachebuster', '0');
-		if ($app === 'core' || $app === 'settings') {
-			$name = $this->themingDefaults->getName();
-			$shortName = $this->themingDefaults->getName();
-			$startUrl = $this->urlGenerator->getBaseUrl();
-			$description = $this->themingDefaults->getSlogan();
-		} else {
-			if (!$this->appManager->isEnabledForUser($app)) {
-				$response = new JSONResponse([], Http::STATUS_NOT_FOUND);
-				$response->throttle(['action' => 'manifest', 'app' => $app]);
-				return $response;
-			}
+    /**
+     * Get the manifest for an app
+     *
+     * @param string $app ID of the app
+     * @psalm-suppress LessSpecificReturnStatement The content of the Manifest doesn't need to be described in the return type
+     * @return JSONResponse<Http::STATUS_OK, array{name: string, short_name: string, start_url: string, theme_color: string, background_color: string, description: string, icons: list<array{src: non-empty-string, type: string, sizes: string}>, display_override: list<string>, display: string}, array{}>|JSONResponse<Http::STATUS_NOT_FOUND, list<empty>, array{}>
+     *
+     * 200: Manifest returned
+     * 404: App not found
+     */
+    #[PublicPage]
+    #[NoCSRFRequired]
+    #[BruteForceProtection(action: 'manifest')]
+    #[OpenAPI(scope: OpenAPI::SCOPE_DEFAULT)]
+    public function getManifest(string $app): JSONResponse {
+        $cacheBusterValue = $this->config->getAppValue('theming', 'cachebuster', '0');
+        if ($app === 'core' || $app === 'settings') {
+            $name = $this->themingDefaults->getName();
+            $shortName = $this->themingDefaults->getName();
+            $startUrl = $this->urlGenerator->getBaseUrl();
+            $description = $this->themingDefaults->getSlogan();
+        } else {
+            if (!$this->appManager->isEnabledForUser($app)) {
+                $response = new JSONResponse([], Http::STATUS_NOT_FOUND);
+                $response->throttle(['action' => 'manifest', 'app' => $app]);
+                return $response;
+            }
 
-			$info = $this->appManager->getAppInfo($app, false, $this->l10n->getLanguageCode());
-			$name = $info['name'] . ' - ' . $this->themingDefaults->getName();
-			$shortName = $info['name'];
-			if (str_contains($this->request->getRequestUri(), '/index.php/')) {
-				$startUrl = $this->urlGenerator->getBaseUrl() . '/index.php/apps/' . $app . '/';
-			} else {
-				$startUrl = $this->urlGenerator->getBaseUrl() . '/apps/' . $app . '/';
-			}
-			$description = $info['summary'] ?? '';
-		}
-		/**
-		 * @var string $description
-		 * @var string $shortName
-		 */
-		$responseJS = [
-			'name' => $name,
-			'short_name' => $shortName,
-			'start_url' => $startUrl,
-			'theme_color' => $this->themingDefaults->getColorPrimary(),
-			'background_color' => $this->themingDefaults->getColorPrimary(),
-			'description' => $description,
-			'icons'
-				=> [
-					[
-						'src' => $this->urlGenerator->linkToRoute('theming.Icon.getTouchIcon',
-							['app' => $app]) . '?v=' . $cacheBusterValue,
-						'type' => 'image/png',
-						'sizes' => '512x512'
-					],
-					[
-						'src' => $this->urlGenerator->linkToRoute('theming.Icon.getFavicon',
-							['app' => $app]) . '?v=' . $cacheBusterValue,
-						'type' => 'image/svg+xml',
-						'sizes' => '16x16'
-					]
-				],
-			'display_override' => [$this->config->getSystemValueBool('theming.standalone_window.enabled', true) ? 'minimal-ui' : ''],
-			'display' => $this->config->getSystemValueBool('theming.standalone_window.enabled', true) ? 'standalone' : 'browser'
-		];
-		$response = new JSONResponse($responseJS);
-		$response->cacheFor(3600);
-		return $response;
-	}
+            $info = $this->appManager->getAppInfo($app, false, $this->l10n->getLanguageCode());
+            $name = $info['name'] . ' - ' . $this->themingDefaults->getName();
+            $shortName = $info['name'];
+            if (str_contains($this->request->getRequestUri(), '/index.php/')) {
+                $startUrl = $this->urlGenerator->getBaseUrl() . '/index.php/apps/' . $app . '/';
+            } else {
+                $startUrl = $this->urlGenerator->getBaseUrl() . '/apps/' . $app . '/';
+            }
+            $description = $info['summary'] ?? '';
+        }
+        /**
+         * @var string $description
+         * @var string $shortName
+         */
+        $responseJS = [
+            'name' => $name,
+            'short_name' => $shortName,
+            'start_url' => $startUrl,
+            'theme_color' => $this->themingDefaults->getColorPrimary(),
+            'background_color' => $this->themingDefaults->getColorPrimary(),
+            'description' => $description,
+            'icons'
+                => [
+                    [
+                        'src' => $this->urlGenerator->linkToRoute('theming.Icon.getTouchIcon',
+                            ['app' => $app]) . '?v=' . $cacheBusterValue,
+                        'type' => 'image/png',
+                        'sizes' => '512x512'
+                    ],
+                    [
+                        'src' => $this->urlGenerator->linkToRoute('theming.Icon.getFavicon',
+                            ['app' => $app]) . '?v=' . $cacheBusterValue,
+                        'type' => 'image/svg+xml',
+                        'sizes' => '16x16'
+                    ]
+                ],
+            'display_override' => [$this->config->getSystemValueBool('theming.standalone_window.enabled', true) ? 'minimal-ui' : ''],
+            'display' => $this->config->getSystemValueBool('theming.standalone_window.enabled', true) ? 'standalone' : 'browser'
+        ];
+        $response = new JSONResponse($responseJS);
+        $response->cacheFor(3600);
+        return $response;
+    }
 }

apps/files_sharing/lib/Controller/ShareController.php

Indentation +349 added lines, -349 removed lines

@@ -51,353 +51,353 @@
  */
 #[OpenAPI(scope: OpenAPI::SCOPE_IGNORE)]
 class ShareController extends AuthPublicShareController {
-	protected ?IShare $share = null;
-
-	public const SHARE_ACCESS = 'access';
-	public const SHARE_AUTH = 'auth';
-	public const SHARE_DOWNLOAD = 'download';
-
-	public function __construct(
-		string $appName,
-		IRequest $request,
-		protected IConfig $config,
-		IURLGenerator $urlGenerator,
-		protected IUserManager $userManager,
-		protected \OCP\Activity\IManager $activityManager,
-		protected ShareManager $shareManager,
-		ISession $session,
-		protected IPreview $previewManager,
-		protected IRootFolder $rootFolder,
-		protected FederatedShareProvider $federatedShareProvider,
-		protected IAccountManager $accountManager,
-		protected IEventDispatcher $eventDispatcher,
-		protected IL10N $l10n,
-		protected ISecureRandom $secureRandom,
-		protected Defaults $defaults,
-		private IPublicShareTemplateFactory $publicShareTemplateFactory,
-	) {
-		parent::__construct($appName, $request, $session, $urlGenerator);
-	}
-
-	/**
-	 * Show the authentication page
-	 * The form has to submit to the authenticate method route
-	 */
-	#[PublicPage]
-	#[NoCSRFRequired]
-	public function showAuthenticate(): TemplateResponse {
-		$templateParameters = ['share' => $this->share];
-
-		$this->eventDispatcher->dispatchTyped(new BeforeTemplateRenderedEvent($this->share, BeforeTemplateRenderedEvent::SCOPE_PUBLIC_SHARE_AUTH));
-
-		$response = new TemplateResponse('core', 'publicshareauth', $templateParameters, 'guest');
-		if ($this->share->getSendPasswordByTalk()) {
-			$csp = new ContentSecurityPolicy();
-			$csp->addAllowedConnectDomain('*');
-			$csp->addAllowedMediaDomain('blob:');
-			$response->setContentSecurityPolicy($csp);
-		}
-
-		return $response;
-	}
-
-	/**
-	 * The template to show when authentication failed
-	 */
-	protected function showAuthFailed(): TemplateResponse {
-		$templateParameters = ['share' => $this->share, 'wrongpw' => true];
-
-		$this->eventDispatcher->dispatchTyped(new BeforeTemplateRenderedEvent($this->share, BeforeTemplateRenderedEvent::SCOPE_PUBLIC_SHARE_AUTH));
-
-		$response = new TemplateResponse('core', 'publicshareauth', $templateParameters, 'guest');
-		if ($this->share->getSendPasswordByTalk()) {
-			$csp = new ContentSecurityPolicy();
-			$csp->addAllowedConnectDomain('*');
-			$csp->addAllowedMediaDomain('blob:');
-			$response->setContentSecurityPolicy($csp);
-		}
-
-		return $response;
-	}
-
-	/**
-	 * The template to show after user identification
-	 */
-	protected function showIdentificationResult(bool $success = false): TemplateResponse {
-		$templateParameters = ['share' => $this->share, 'identityOk' => $success];
-
-		$this->eventDispatcher->dispatchTyped(new BeforeTemplateRenderedEvent($this->share, BeforeTemplateRenderedEvent::SCOPE_PUBLIC_SHARE_AUTH));
-
-		$response = new TemplateResponse('core', 'publicshareauth', $templateParameters, 'guest');
-		if ($this->share->getSendPasswordByTalk()) {
-			$csp = new ContentSecurityPolicy();
-			$csp->addAllowedConnectDomain('*');
-			$csp->addAllowedMediaDomain('blob:');
-			$response->setContentSecurityPolicy($csp);
-		}
-
-		return $response;
-	}
-
-	/**
-	 * Validate the identity token of a public share
-	 *
-	 * @param ?string $identityToken
-	 * @return bool
-	 */
-	protected function validateIdentity(?string $identityToken = null): bool {
-		if ($this->share->getShareType() !== IShare::TYPE_EMAIL) {
-			return false;
-		}
-
-		if ($identityToken === null || $this->share->getSharedWith() === null) {
-			return false;
-		}
-
-		return $identityToken === $this->share->getSharedWith();
-	}
-
-	/**
-	 * Generates a password for the share, respecting any password policy defined
-	 */
-	protected function generatePassword(): void {
-		$event = new GenerateSecurePasswordEvent(PasswordContext::SHARING);
-		$this->eventDispatcher->dispatchTyped($event);
-		$password = $event->getPassword() ?? $this->secureRandom->generate(20);
-
-		$this->share->setPassword($password);
-		$this->shareManager->updateShare($this->share);
-	}
-
-	protected function verifyPassword(string $password): bool {
-		return $this->shareManager->checkPassword($this->share, $password);
-	}
-
-	protected function getPasswordHash(): ?string {
-		return $this->share->getPassword();
-	}
-
-	public function isValidToken(): bool {
-		try {
-			$this->share = $this->shareManager->getShareByToken($this->getToken());
-		} catch (ShareNotFound $e) {
-			return false;
-		}
-
-		return true;
-	}
-
-	protected function isPasswordProtected(): bool {
-		return $this->share->getPassword() !== null;
-	}
-
-	protected function authSucceeded() {
-		if ($this->share === null) {
-			throw new NotFoundException();
-		}
-
-		// For share this was always set so it is still used in other apps
-		$allowedShareIds = $this->session->get(PublicAuth::DAV_AUTHENTICATED);
-		if (!is_array($allowedShareIds)) {
-			$allowedShareIds = [];
-		}
-
-		$this->session->set(PublicAuth::DAV_AUTHENTICATED, array_merge($allowedShareIds, [$this->share->getId()]));
-	}
-
-	protected function authFailed() {
-		$this->emitAccessShareHook($this->share, 403, 'Wrong password');
-		$this->emitShareAccessEvent($this->share, self::SHARE_AUTH, 403, 'Wrong password');
-	}
-
-	/**
-	 * throws hooks when a share is attempted to be accessed
-	 *
-	 * @param IShare|string $share the Share instance if available,
-	 *                             otherwise token
-	 * @param int $errorCode
-	 * @param string $errorMessage
-	 *
-	 * @throws HintException
-	 * @throws \OC\ServerNotAvailableException
-	 *
-	 * @deprecated use OCP\Files_Sharing\Event\ShareLinkAccessedEvent
-	 */
-	protected function emitAccessShareHook($share, int $errorCode = 200, string $errorMessage = '') {
-		$itemType = $itemSource = $uidOwner = '';
-		$token = $share;
-		$exception = null;
-		if ($share instanceof IShare) {
-			try {
-				$token = $share->getToken();
-				$uidOwner = $share->getSharedBy();
-				$itemType = $share->getNodeType();
-				$itemSource = $share->getNodeId();
-			} catch (\Exception $e) {
-				// we log what we know and pass on the exception afterwards
-				$exception = $e;
-			}
-		}
-
-		\OC_Hook::emit(Share::class, 'share_link_access', [
-			'itemType' => $itemType,
-			'itemSource' => $itemSource,
-			'uidOwner' => $uidOwner,
-			'token' => $token,
-			'errorCode' => $errorCode,
-			'errorMessage' => $errorMessage
-		]);
-
-		if (!is_null($exception)) {
-			throw $exception;
-		}
-	}
-
-	/**
-	 * Emit a ShareLinkAccessedEvent event when a share is accessed, downloaded, auth...
-	 */
-	protected function emitShareAccessEvent(IShare $share, string $step = '', int $errorCode = 200, string $errorMessage = ''): void {
-		if ($step !== self::SHARE_ACCESS
-			&& $step !== self::SHARE_AUTH
-			&& $step !== self::SHARE_DOWNLOAD) {
-			return;
-		}
-		$this->eventDispatcher->dispatchTyped(new ShareLinkAccessedEvent($share, $step, $errorCode, $errorMessage));
-	}
-
-	/**
-	 * Validate the permissions of the share
-	 *
-	 * @param Share\IShare $share
-	 * @return bool
-	 */
-	private function validateShare(IShare $share) {
-		// If the owner is disabled no access to the link is granted
-		$owner = $this->userManager->get($share->getShareOwner());
-		if ($owner === null || !$owner->isEnabled()) {
-			return false;
-		}
-
-		// If the initiator of the share is disabled no access is granted
-		$initiator = $this->userManager->get($share->getSharedBy());
-		if ($initiator === null || !$initiator->isEnabled()) {
-			return false;
-		}
-
-		return $share->getNode()->isReadable() && $share->getNode()->isShareable();
-	}
-
-	/**
-	 * @param string $path
-	 * @return TemplateResponse
-	 * @throws NotFoundException
-	 * @throws \Exception
-	 */
-	#[PublicPage]
-	#[NoCSRFRequired]
-	public function showShare($path = ''): TemplateResponse {
-		\OC_User::setIncognitoMode(true);
-
-		// Check whether share exists
-		try {
-			$share = $this->shareManager->getShareByToken($this->getToken());
-		} catch (ShareNotFound $e) {
-			// The share does not exists, we do not emit an ShareLinkAccessedEvent
-			$this->emitAccessShareHook($this->getToken(), 404, 'Share not found');
-			throw new NotFoundException($this->l10n->t('This share does not exist or is no longer available'));
-		}
-
-		if (!$this->validateShare($share)) {
-			throw new NotFoundException($this->l10n->t('This share does not exist or is no longer available'));
-		}
-
-		$shareNode = $share->getNode();
-
-		try {
-			$templateProvider = $this->publicShareTemplateFactory->getProvider($share);
-			$response = $templateProvider->renderPage($share, $this->getToken(), $path);
-		} catch (NotFoundException $e) {
-			$this->emitAccessShareHook($share, 404, 'Share not found');
-			$this->emitShareAccessEvent($share, ShareController::SHARE_ACCESS, 404, 'Share not found');
-			throw new NotFoundException($this->l10n->t('This share does not exist or is no longer available'));
-		}
-
-		// We can't get the path of a file share
-		try {
-			if ($shareNode instanceof File && $path !== '') {
-				$this->emitAccessShareHook($share, 404, 'Share not found');
-				$this->emitShareAccessEvent($share, self::SHARE_ACCESS, 404, 'Share not found');
-				throw new NotFoundException($this->l10n->t('This share does not exist or is no longer available'));
-			}
-		} catch (\Exception $e) {
-			$this->emitAccessShareHook($share, 404, 'Share not found');
-			$this->emitShareAccessEvent($share, self::SHARE_ACCESS, 404, 'Share not found');
-			throw $e;
-		}
-
-
-		$this->emitAccessShareHook($share);
-		$this->emitShareAccessEvent($share, self::SHARE_ACCESS);
-
-		return $response;
-	}
-
-	/**
-	 * @throws NotFoundException
-	 * @deprecated 31.0.0 Users are encouraged to use the DAV endpoint
-	 */
-	#[PublicPage]
-	#[NoCSRFRequired]
-	#[NoSameSiteCookieRequired]
-	public function downloadShare(string $token, ?string $files = null, string $path = ''): NotFoundResponse|RedirectResponse|DataResponse {
-		\OC_User::setIncognitoMode(true);
-
-		$share = $this->shareManager->getShareByToken($token);
-
-		if (!($share->getPermissions() & Constants::PERMISSION_READ)) {
-			return new DataResponse('Share has no read permission');
-		}
-
-		$attributes = $share->getAttributes();
-		if ($attributes?->getAttribute('permissions', 'download') === false) {
-			return new DataResponse('Share has no download permission');
-		}
-
-		if (!$this->validateShare($share)) {
-			throw new NotFoundException();
-		}
-
-		$node = $share->getNode();
-		if ($node instanceof Folder) {
-			// Directory share
-
-			// Try to get the path
-			if ($path !== '') {
-				try {
-					$node = $node->get($path);
-				} catch (NotFoundException $e) {
-					$this->emitAccessShareHook($share, 404, 'Share not found');
-					$this->emitShareAccessEvent($share, self::SHARE_DOWNLOAD, 404, 'Share not found');
-					return new NotFoundResponse();
-				}
-			}
-
-			if ($node instanceof Folder) {
-				if ($files === null || $files === '') {
-					if ($share->getHideDownload()) {
-						throw new NotFoundException('Downloading a folder');
-					}
-				}
-			}
-		}
-
-		$this->emitAccessShareHook($share);
-		$this->emitShareAccessEvent($share, self::SHARE_DOWNLOAD);
-
-		$davUrl = '/public.php/dav/files/' . $token . '/?accept=zip';
-		if ($files !== null) {
-			$davUrl .= '&files=' . $files;
-		}
-		return new RedirectResponse($this->urlGenerator->getAbsoluteURL($davUrl));
-	}
+    protected ?IShare $share = null;
+
+    public const SHARE_ACCESS = 'access';
+    public const SHARE_AUTH = 'auth';
+    public const SHARE_DOWNLOAD = 'download';
+
+    public function __construct(
+        string $appName,
+        IRequest $request,
+        protected IConfig $config,
+        IURLGenerator $urlGenerator,
+        protected IUserManager $userManager,
+        protected \OCP\Activity\IManager $activityManager,
+        protected ShareManager $shareManager,
+        ISession $session,
+        protected IPreview $previewManager,
+        protected IRootFolder $rootFolder,
+        protected FederatedShareProvider $federatedShareProvider,
+        protected IAccountManager $accountManager,
+        protected IEventDispatcher $eventDispatcher,
+        protected IL10N $l10n,
+        protected ISecureRandom $secureRandom,
+        protected Defaults $defaults,
+        private IPublicShareTemplateFactory $publicShareTemplateFactory,
+    ) {
+        parent::__construct($appName, $request, $session, $urlGenerator);
+    }
+
+    /**
+     * Show the authentication page
+     * The form has to submit to the authenticate method route
+     */
+    #[PublicPage]
+    #[NoCSRFRequired]
+    public function showAuthenticate(): TemplateResponse {
+        $templateParameters = ['share' => $this->share];
+
+        $this->eventDispatcher->dispatchTyped(new BeforeTemplateRenderedEvent($this->share, BeforeTemplateRenderedEvent::SCOPE_PUBLIC_SHARE_AUTH));
+
+        $response = new TemplateResponse('core', 'publicshareauth', $templateParameters, 'guest');
+        if ($this->share->getSendPasswordByTalk()) {
+            $csp = new ContentSecurityPolicy();
+            $csp->addAllowedConnectDomain('*');
+            $csp->addAllowedMediaDomain('blob:');
+            $response->setContentSecurityPolicy($csp);
+        }
+
+        return $response;
+    }
+
+    /**
+     * The template to show when authentication failed
+     */
+    protected function showAuthFailed(): TemplateResponse {
+        $templateParameters = ['share' => $this->share, 'wrongpw' => true];
+
+        $this->eventDispatcher->dispatchTyped(new BeforeTemplateRenderedEvent($this->share, BeforeTemplateRenderedEvent::SCOPE_PUBLIC_SHARE_AUTH));
+
+        $response = new TemplateResponse('core', 'publicshareauth', $templateParameters, 'guest');
+        if ($this->share->getSendPasswordByTalk()) {
+            $csp = new ContentSecurityPolicy();
+            $csp->addAllowedConnectDomain('*');
+            $csp->addAllowedMediaDomain('blob:');
+            $response->setContentSecurityPolicy($csp);
+        }
+
+        return $response;
+    }
+
+    /**
+     * The template to show after user identification
+     */
+    protected function showIdentificationResult(bool $success = false): TemplateResponse {
+        $templateParameters = ['share' => $this->share, 'identityOk' => $success];
+
+        $this->eventDispatcher->dispatchTyped(new BeforeTemplateRenderedEvent($this->share, BeforeTemplateRenderedEvent::SCOPE_PUBLIC_SHARE_AUTH));
+
+        $response = new TemplateResponse('core', 'publicshareauth', $templateParameters, 'guest');
+        if ($this->share->getSendPasswordByTalk()) {
+            $csp = new ContentSecurityPolicy();
+            $csp->addAllowedConnectDomain('*');
+            $csp->addAllowedMediaDomain('blob:');
+            $response->setContentSecurityPolicy($csp);
+        }
+
+        return $response;
+    }
+
+    /**
+     * Validate the identity token of a public share
+     *
+     * @param ?string $identityToken
+     * @return bool
+     */
+    protected function validateIdentity(?string $identityToken = null): bool {
+        if ($this->share->getShareType() !== IShare::TYPE_EMAIL) {
+            return false;
+        }
+
+        if ($identityToken === null || $this->share->getSharedWith() === null) {
+            return false;
+        }
+
+        return $identityToken === $this->share->getSharedWith();
+    }
+
+    /**
+     * Generates a password for the share, respecting any password policy defined
+     */
+    protected function generatePassword(): void {
+        $event = new GenerateSecurePasswordEvent(PasswordContext::SHARING);
+        $this->eventDispatcher->dispatchTyped($event);
+        $password = $event->getPassword() ?? $this->secureRandom->generate(20);
+
+        $this->share->setPassword($password);
+        $this->shareManager->updateShare($this->share);
+    }
+
+    protected function verifyPassword(string $password): bool {
+        return $this->shareManager->checkPassword($this->share, $password);
+    }
+
+    protected function getPasswordHash(): ?string {
+        return $this->share->getPassword();
+    }
+
+    public function isValidToken(): bool {
+        try {
+            $this->share = $this->shareManager->getShareByToken($this->getToken());
+        } catch (ShareNotFound $e) {
+            return false;
+        }
+
+        return true;
+    }
+
+    protected function isPasswordProtected(): bool {
+        return $this->share->getPassword() !== null;
+    }
+
+    protected function authSucceeded() {
+        if ($this->share === null) {
+            throw new NotFoundException();
+        }
+
+        // For share this was always set so it is still used in other apps
+        $allowedShareIds = $this->session->get(PublicAuth::DAV_AUTHENTICATED);
+        if (!is_array($allowedShareIds)) {
+            $allowedShareIds = [];
+        }
+
+        $this->session->set(PublicAuth::DAV_AUTHENTICATED, array_merge($allowedShareIds, [$this->share->getId()]));
+    }
+
+    protected function authFailed() {
+        $this->emitAccessShareHook($this->share, 403, 'Wrong password');
+        $this->emitShareAccessEvent($this->share, self::SHARE_AUTH, 403, 'Wrong password');
+    }
+
+    /**
+     * throws hooks when a share is attempted to be accessed
+     *
+     * @param IShare|string $share the Share instance if available,
+     *                             otherwise token
+     * @param int $errorCode
+     * @param string $errorMessage
+     *
+     * @throws HintException
+     * @throws \OC\ServerNotAvailableException
+     *
+     * @deprecated use OCP\Files_Sharing\Event\ShareLinkAccessedEvent
+     */
+    protected function emitAccessShareHook($share, int $errorCode = 200, string $errorMessage = '') {
+        $itemType = $itemSource = $uidOwner = '';
+        $token = $share;
+        $exception = null;
+        if ($share instanceof IShare) {
+            try {
+                $token = $share->getToken();
+                $uidOwner = $share->getSharedBy();
+                $itemType = $share->getNodeType();
+                $itemSource = $share->getNodeId();
+            } catch (\Exception $e) {
+                // we log what we know and pass on the exception afterwards
+                $exception = $e;
+            }
+        }
+
+        \OC_Hook::emit(Share::class, 'share_link_access', [
+            'itemType' => $itemType,
+            'itemSource' => $itemSource,
+            'uidOwner' => $uidOwner,
+            'token' => $token,
+            'errorCode' => $errorCode,
+            'errorMessage' => $errorMessage
+        ]);
+
+        if (!is_null($exception)) {
+            throw $exception;
+        }
+    }
+
+    /**
+     * Emit a ShareLinkAccessedEvent event when a share is accessed, downloaded, auth...
+     */
+    protected function emitShareAccessEvent(IShare $share, string $step = '', int $errorCode = 200, string $errorMessage = ''): void {
+        if ($step !== self::SHARE_ACCESS
+            && $step !== self::SHARE_AUTH
+            && $step !== self::SHARE_DOWNLOAD) {
+            return;
+        }
+        $this->eventDispatcher->dispatchTyped(new ShareLinkAccessedEvent($share, $step, $errorCode, $errorMessage));
+    }
+
+    /**
+     * Validate the permissions of the share
+     *
+     * @param Share\IShare $share
+     * @return bool
+     */
+    private function validateShare(IShare $share) {
+        // If the owner is disabled no access to the link is granted
+        $owner = $this->userManager->get($share->getShareOwner());
+        if ($owner === null || !$owner->isEnabled()) {
+            return false;
+        }
+
+        // If the initiator of the share is disabled no access is granted
+        $initiator = $this->userManager->get($share->getSharedBy());
+        if ($initiator === null || !$initiator->isEnabled()) {
+            return false;
+        }
+
+        return $share->getNode()->isReadable() && $share->getNode()->isShareable();
+    }
+
+    /**
+     * @param string $path
+     * @return TemplateResponse
+     * @throws NotFoundException
+     * @throws \Exception
+     */
+    #[PublicPage]
+    #[NoCSRFRequired]
+    public function showShare($path = ''): TemplateResponse {
+        \OC_User::setIncognitoMode(true);
+
+        // Check whether share exists
+        try {
+            $share = $this->shareManager->getShareByToken($this->getToken());
+        } catch (ShareNotFound $e) {
+            // The share does not exists, we do not emit an ShareLinkAccessedEvent
+            $this->emitAccessShareHook($this->getToken(), 404, 'Share not found');
+            throw new NotFoundException($this->l10n->t('This share does not exist or is no longer available'));
+        }
+
+        if (!$this->validateShare($share)) {
+            throw new NotFoundException($this->l10n->t('This share does not exist or is no longer available'));
+        }
+
+        $shareNode = $share->getNode();
+
+        try {
+            $templateProvider = $this->publicShareTemplateFactory->getProvider($share);
+            $response = $templateProvider->renderPage($share, $this->getToken(), $path);
+        } catch (NotFoundException $e) {
+            $this->emitAccessShareHook($share, 404, 'Share not found');
+            $this->emitShareAccessEvent($share, ShareController::SHARE_ACCESS, 404, 'Share not found');
+            throw new NotFoundException($this->l10n->t('This share does not exist or is no longer available'));
+        }
+
+        // We can't get the path of a file share
+        try {
+            if ($shareNode instanceof File && $path !== '') {
+                $this->emitAccessShareHook($share, 404, 'Share not found');
+                $this->emitShareAccessEvent($share, self::SHARE_ACCESS, 404, 'Share not found');
+                throw new NotFoundException($this->l10n->t('This share does not exist or is no longer available'));
+            }
+        } catch (\Exception $e) {
+            $this->emitAccessShareHook($share, 404, 'Share not found');
+            $this->emitShareAccessEvent($share, self::SHARE_ACCESS, 404, 'Share not found');
+            throw $e;
+        }
+
+
+        $this->emitAccessShareHook($share);
+        $this->emitShareAccessEvent($share, self::SHARE_ACCESS);
+
+        return $response;
+    }
+
+    /**
+     * @throws NotFoundException
+     * @deprecated 31.0.0 Users are encouraged to use the DAV endpoint
+     */
+    #[PublicPage]
+    #[NoCSRFRequired]
+    #[NoSameSiteCookieRequired]
+    public function downloadShare(string $token, ?string $files = null, string $path = ''): NotFoundResponse|RedirectResponse|DataResponse {
+        \OC_User::setIncognitoMode(true);
+
+        $share = $this->shareManager->getShareByToken($token);
+
+        if (!($share->getPermissions() & Constants::PERMISSION_READ)) {
+            return new DataResponse('Share has no read permission');
+        }
+
+        $attributes = $share->getAttributes();
+        if ($attributes?->getAttribute('permissions', 'download') === false) {
+            return new DataResponse('Share has no download permission');
+        }
+
+        if (!$this->validateShare($share)) {
+            throw new NotFoundException();
+        }
+
+        $node = $share->getNode();
+        if ($node instanceof Folder) {
+            // Directory share
+
+            // Try to get the path
+            if ($path !== '') {
+                try {
+                    $node = $node->get($path);
+                } catch (NotFoundException $e) {
+                    $this->emitAccessShareHook($share, 404, 'Share not found');
+                    $this->emitShareAccessEvent($share, self::SHARE_DOWNLOAD, 404, 'Share not found');
+                    return new NotFoundResponse();
+                }
+            }
+
+            if ($node instanceof Folder) {
+                if ($files === null || $files === '') {
+                    if ($share->getHideDownload()) {
+                        throw new NotFoundException('Downloading a folder');
+                    }
+                }
+            }
+        }
+
+        $this->emitAccessShareHook($share);
+        $this->emitShareAccessEvent($share, self::SHARE_DOWNLOAD);
+
+        $davUrl = '/public.php/dav/files/' . $token . '/?accept=zip';
+        if ($files !== null) {
+            $davUrl .= '&files=' . $files;
+        }
+        return new RedirectResponse($this->urlGenerator->getAbsoluteURL($davUrl));
+    }
 }

Spacing +3 added lines, -3 removed lines

@@ -349,7 +349,7 @@ 
 	#[PublicPage]
 	#[NoCSRFRequired]
 	#[NoSameSiteCookieRequired]
-	public function downloadShare(string $token, ?string $files = null, string $path = ''): NotFoundResponse|RedirectResponse|DataResponse {
+	public function downloadShare(string $token, ?string $files = null, string $path = ''): NotFoundResponse | RedirectResponse | DataResponse {
 		\OC_User::setIncognitoMode(true);
 
 		$share = $this->shareManager->getShareByToken($token);
@@ -394,9 +394,9 @@ 
 		$this->emitAccessShareHook($share);
 		$this->emitShareAccessEvent($share, self::SHARE_DOWNLOAD);
 
-		$davUrl = '/public.php/dav/files/' . $token . '/?accept=zip';
+		$davUrl = '/public.php/dav/files/'.$token.'/?accept=zip';
 		if ($files !== null) {
-			$davUrl .= '&files=' . $files;
+			$davUrl .= '&files='.$files;
 		}
 		return new RedirectResponse($this->urlGenerator->getAbsoluteURL($davUrl));
 	}

apps/files_sharing/lib/Controller/PublicPreviewController.php

Indentation +175 added lines, -175 removed lines

@@ -28,179 +28,179 @@
 
 class PublicPreviewController extends PublicShareController {
 
-	/** @var IShare */
-	private $share;
-
-	public function __construct(
-		string $appName,
-		IRequest $request,
-		private ShareManager $shareManager,
-		ISession $session,
-		private IPreview $previewManager,
-		private IMimeIconProvider $mimeIconProvider,
-	) {
-		parent::__construct($appName, $request, $session);
-	}
-
-	protected function getPasswordHash(): ?string {
-		return $this->share->getPassword();
-	}
-
-	public function isValidToken(): bool {
-		try {
-			$this->share = $this->shareManager->getShareByToken($this->getToken());
-			return true;
-		} catch (ShareNotFound $e) {
-			return false;
-		}
-	}
-
-	protected function isPasswordProtected(): bool {
-		return $this->share->getPassword() !== null;
-	}
-
-
-	/**
-	 * Get a preview for a shared file
-	 *
-	 * @param string $token Token of the share
-	 * @param string $file File in the share
-	 * @param int $x Width of the preview
-	 * @param int $y Height of the preview
-	 * @param bool $a Whether to not crop the preview
-	 * @param bool $mimeFallback Whether to fallback to the mime icon if no preview is available
-	 * @return FileDisplayResponse<Http::STATUS_OK, array{Content-Type: string}>|DataResponse<Http::STATUS_BAD_REQUEST|Http::STATUS_FORBIDDEN|Http::STATUS_NOT_FOUND, list<empty>, array{}>|RedirectResponse<Http::STATUS_SEE_OTHER, array{}>
-	 *
-	 * 200: Preview returned
-	 * 303: Redirect to the mime icon url if mimeFallback is true
-	 * 400: Getting preview is not possible
-	 * 403: Getting preview is not allowed
-	 * 404: Share or preview not found
-	 */
-	#[PublicPage]
-	#[NoCSRFRequired]
-	#[OpenAPI(scope: OpenAPI::SCOPE_DEFAULT)]
-	public function getPreview(
-		string $token,
-		string $file = '',
-		int $x = 32,
-		int $y = 32,
-		$a = false,
-		bool $mimeFallback = false,
-	) {
-		$cacheForSeconds = 60 * 60 * 24; // 1 day
-
-		if ($token === '' || $x === 0 || $y === 0) {
-			return new DataResponse([], Http::STATUS_BAD_REQUEST);
-		}
-
-		try {
-			$share = $this->shareManager->getShareByToken($token);
-		} catch (ShareNotFound $e) {
-			return new DataResponse([], Http::STATUS_NOT_FOUND);
-		}
-
-		if (($share->getPermissions() & Constants::PERMISSION_READ) === 0) {
-			return new DataResponse([], Http::STATUS_FORBIDDEN);
-		}
-
-		// Only explicitly set to false will forbid the download!
-		$downloadForbidden = !$share->canSeeContent();
-
-		// Is this header is set it means our UI is doing a preview for no-download shares
-		// we check a header so we at least prevent people from using the link directly (obfuscation)
-		$isPublicPreview = $this->request->getHeader('x-nc-preview') === 'true';
-
-		if ($isPublicPreview && $downloadForbidden) {
-			// Only cache for 15 minutes on public preview requests to quickly remove from cache
-			$cacheForSeconds = 15 * 60;
-		} elseif ($downloadForbidden) {
-			// This is not a public share preview so we only allow a preview if download permissions are granted
-			return new DataResponse([], Http::STATUS_FORBIDDEN);
-		}
-
-		try {
-			$node = $share->getNode();
-			if ($node instanceof Folder) {
-				$file = $node->get($file);
-			} else {
-				$file = $node;
-			}
-
-			$f = $this->previewManager->getPreview($file, $x, $y, !$a);
-			$response = new FileDisplayResponse($f, Http::STATUS_OK, ['Content-Type' => $f->getMimeType()]);
-			$response->cacheFor($cacheForSeconds);
-			return $response;
-		} catch (NotFoundException $e) {
-			// If we have no preview enabled, we can redirect to the mime icon if any
-			if ($mimeFallback) {
-				if ($url = $this->mimeIconProvider->getMimeIconUrl($file->getMimeType())) {
-					return new RedirectResponse($url);
-				}
-			}
-			return new DataResponse([], Http::STATUS_NOT_FOUND);
-		} catch (\InvalidArgumentException $e) {
-			return new DataResponse([], Http::STATUS_BAD_REQUEST);
-		}
-	}
-
-	/**
-	 * Get a direct link preview for a shared file
-	 *
-	 * @param string $token Token of the share
-	 * @return FileDisplayResponse<Http::STATUS_OK, array{Content-Type: string}>|DataResponse<Http::STATUS_BAD_REQUEST|Http::STATUS_FORBIDDEN|Http::STATUS_NOT_FOUND, list<empty>, array{}>
-	 *
-	 * 200: Preview returned
-	 * 400: Getting preview is not possible
-	 * 403: Getting preview is not allowed
-	 * 404: Share or preview not found
-	 */
-	#[PublicPage]
-	#[NoCSRFRequired]
-	#[OpenAPI(scope: OpenAPI::SCOPE_DEFAULT)]
-	#[NoSameSiteCookieRequired]
-	public function directLink(string $token) {
-		// No token no image
-		if ($token === '') {
-			return new DataResponse([], Http::STATUS_BAD_REQUEST);
-		}
-
-		// No share no image
-		try {
-			$share = $this->shareManager->getShareByToken($token);
-		} catch (ShareNotFound $e) {
-			return new DataResponse([], Http::STATUS_NOT_FOUND);
-		}
-
-		// No permissions no image
-		if (($share->getPermissions() & Constants::PERMISSION_READ) === 0) {
-			return new DataResponse([], Http::STATUS_FORBIDDEN);
-		}
-
-		// Password protected shares have no direct link!
-		if ($share->getPassword() !== null) {
-			return new DataResponse([], Http::STATUS_FORBIDDEN);
-		}
-
-		if (!$share->canSeeContent()) {
-			return new DataResponse([], Http::STATUS_FORBIDDEN);
-		}
-
-		try {
-			$node = $share->getNode();
-			if ($node instanceof Folder) {
-				// Direct link only works for single files
-				return new DataResponse([], Http::STATUS_BAD_REQUEST);
-			}
-
-			$f = $this->previewManager->getPreview($node, -1, -1, false);
-			$response = new FileDisplayResponse($f, Http::STATUS_OK, ['Content-Type' => $f->getMimeType()]);
-			$response->cacheFor(3600 * 24);
-			return $response;
-		} catch (NotFoundException $e) {
-			return new DataResponse([], Http::STATUS_NOT_FOUND);
-		} catch (\InvalidArgumentException $e) {
-			return new DataResponse([], Http::STATUS_BAD_REQUEST);
-		}
-	}
+    /** @var IShare */
+    private $share;
+
+    public function __construct(
+        string $appName,
+        IRequest $request,
+        private ShareManager $shareManager,
+        ISession $session,
+        private IPreview $previewManager,
+        private IMimeIconProvider $mimeIconProvider,
+    ) {
+        parent::__construct($appName, $request, $session);
+    }
+
+    protected function getPasswordHash(): ?string {
+        return $this->share->getPassword();
+    }
+
+    public function isValidToken(): bool {
+        try {
+            $this->share = $this->shareManager->getShareByToken($this->getToken());
+            return true;
+        } catch (ShareNotFound $e) {
+            return false;
+        }
+    }
+
+    protected function isPasswordProtected(): bool {
+        return $this->share->getPassword() !== null;
+    }
+
+
+    /**
+     * Get a preview for a shared file
+     *
+     * @param string $token Token of the share
+     * @param string $file File in the share
+     * @param int $x Width of the preview
+     * @param int $y Height of the preview
+     * @param bool $a Whether to not crop the preview
+     * @param bool $mimeFallback Whether to fallback to the mime icon if no preview is available
+     * @return FileDisplayResponse<Http::STATUS_OK, array{Content-Type: string}>|DataResponse<Http::STATUS_BAD_REQUEST|Http::STATUS_FORBIDDEN|Http::STATUS_NOT_FOUND, list<empty>, array{}>|RedirectResponse<Http::STATUS_SEE_OTHER, array{}>
+     *
+     * 200: Preview returned
+     * 303: Redirect to the mime icon url if mimeFallback is true
+     * 400: Getting preview is not possible
+     * 403: Getting preview is not allowed
+     * 404: Share or preview not found
+     */
+    #[PublicPage]
+    #[NoCSRFRequired]
+    #[OpenAPI(scope: OpenAPI::SCOPE_DEFAULT)]
+    public function getPreview(
+        string $token,
+        string $file = '',
+        int $x = 32,
+        int $y = 32,
+        $a = false,
+        bool $mimeFallback = false,
+    ) {
+        $cacheForSeconds = 60 * 60 * 24; // 1 day
+
+        if ($token === '' || $x === 0 || $y === 0) {
+            return new DataResponse([], Http::STATUS_BAD_REQUEST);
+        }
+
+        try {
+            $share = $this->shareManager->getShareByToken($token);
+        } catch (ShareNotFound $e) {
+            return new DataResponse([], Http::STATUS_NOT_FOUND);
+        }
+
+        if (($share->getPermissions() & Constants::PERMISSION_READ) === 0) {
+            return new DataResponse([], Http::STATUS_FORBIDDEN);
+        }
+
+        // Only explicitly set to false will forbid the download!
+        $downloadForbidden = !$share->canSeeContent();
+
+        // Is this header is set it means our UI is doing a preview for no-download shares
+        // we check a header so we at least prevent people from using the link directly (obfuscation)
+        $isPublicPreview = $this->request->getHeader('x-nc-preview') === 'true';
+
+        if ($isPublicPreview && $downloadForbidden) {
+            // Only cache for 15 minutes on public preview requests to quickly remove from cache
+            $cacheForSeconds = 15 * 60;
+        } elseif ($downloadForbidden) {
+            // This is not a public share preview so we only allow a preview if download permissions are granted
+            return new DataResponse([], Http::STATUS_FORBIDDEN);
+        }
+
+        try {
+            $node = $share->getNode();
+            if ($node instanceof Folder) {
+                $file = $node->get($file);
+            } else {
+                $file = $node;
+            }
+
+            $f = $this->previewManager->getPreview($file, $x, $y, !$a);
+            $response = new FileDisplayResponse($f, Http::STATUS_OK, ['Content-Type' => $f->getMimeType()]);
+            $response->cacheFor($cacheForSeconds);
+            return $response;
+        } catch (NotFoundException $e) {
+            // If we have no preview enabled, we can redirect to the mime icon if any
+            if ($mimeFallback) {
+                if ($url = $this->mimeIconProvider->getMimeIconUrl($file->getMimeType())) {
+                    return new RedirectResponse($url);
+                }
+            }
+            return new DataResponse([], Http::STATUS_NOT_FOUND);
+        } catch (\InvalidArgumentException $e) {
+            return new DataResponse([], Http::STATUS_BAD_REQUEST);
+        }
+    }
+
+    /**
+     * Get a direct link preview for a shared file
+     *
+     * @param string $token Token of the share
+     * @return FileDisplayResponse<Http::STATUS_OK, array{Content-Type: string}>|DataResponse<Http::STATUS_BAD_REQUEST|Http::STATUS_FORBIDDEN|Http::STATUS_NOT_FOUND, list<empty>, array{}>
+     *
+     * 200: Preview returned
+     * 400: Getting preview is not possible
+     * 403: Getting preview is not allowed
+     * 404: Share or preview not found
+     */
+    #[PublicPage]
+    #[NoCSRFRequired]
+    #[OpenAPI(scope: OpenAPI::SCOPE_DEFAULT)]
+    #[NoSameSiteCookieRequired]
+    public function directLink(string $token) {
+        // No token no image
+        if ($token === '') {
+            return new DataResponse([], Http::STATUS_BAD_REQUEST);
+        }
+
+        // No share no image
+        try {
+            $share = $this->shareManager->getShareByToken($token);
+        } catch (ShareNotFound $e) {
+            return new DataResponse([], Http::STATUS_NOT_FOUND);
+        }
+
+        // No permissions no image
+        if (($share->getPermissions() & Constants::PERMISSION_READ) === 0) {
+            return new DataResponse([], Http::STATUS_FORBIDDEN);
+        }
+
+        // Password protected shares have no direct link!
+        if ($share->getPassword() !== null) {
+            return new DataResponse([], Http::STATUS_FORBIDDEN);
+        }
+
+        if (!$share->canSeeContent()) {
+            return new DataResponse([], Http::STATUS_FORBIDDEN);
+        }
+
+        try {
+            $node = $share->getNode();
+            if ($node instanceof Folder) {
+                // Direct link only works for single files
+                return new DataResponse([], Http::STATUS_BAD_REQUEST);
+            }
+
+            $f = $this->previewManager->getPreview($node, -1, -1, false);
+            $response = new FileDisplayResponse($f, Http::STATUS_OK, ['Content-Type' => $f->getMimeType()]);
+            $response->cacheFor(3600 * 24);
+            return $response;
+        } catch (NotFoundException $e) {
+            return new DataResponse([], Http::STATUS_NOT_FOUND);
+        } catch (\InvalidArgumentException $e) {
+            return new DataResponse([], Http::STATUS_BAD_REQUEST);
+        }
+    }
 }

lib/private/AppFramework/Http/Dispatcher.php

Indentation +180 added lines, -180 removed lines

@@ -26,184 +26,184 @@
  * Class to dispatch the request to the middleware dispatcher
  */
 class Dispatcher {
-	/**
-	 * @param Http $protocol the http protocol with contains all status headers
-	 * @param MiddlewareDispatcher $middlewareDispatcher the dispatcher which
-	 *                                                   runs the middleware
-	 */
-	public function __construct(
-		private readonly Http $protocol,
-		private readonly MiddlewareDispatcher $middlewareDispatcher,
-		private readonly ControllerMethodReflector $reflector,
-		private readonly IRequest $request,
-		private readonly IConfig $config,
-		private readonly ConnectionAdapter $connection,
-		private readonly LoggerInterface $logger,
-		private readonly IEventLogger $eventLogger,
-		private readonly ContainerInterface $appContainer,
-	) {
-	}
-
-
-	/**
-	 * Handles a request and calls the dispatcher on the controller
-	 * @param Controller $controller the controller which will be called
-	 * @param string $methodName the method name which will be called on
-	 *                           the controller
-	 * @return array{0: string, 1: array, 2: array, 3: string, 4: Response}
-	 *                                                                      $array[0] contains the http status header as a string,
-	 *                                                                      $array[1] contains response headers as an array,
-	 *                                                                      $array[2] contains response cookies as an array,
-	 *                                                                      $array[3] contains the response output as a string,
-	 *                                                                      $array[4] contains the response object
-	 * @throws \Exception
-	 */
-	public function dispatch(Controller $controller, string $methodName): array {
-		try {
-			// prefill reflector with everything that's needed for the
-			// middlewares
-			$this->reflector->reflect($controller, $methodName);
-
-			$this->middlewareDispatcher->beforeController($controller,
-				$methodName);
-
-			$databaseStatsBefore = [];
-			if ($this->config->getSystemValueBool('debug', false)) {
-				$databaseStatsBefore = $this->connection->getInner()->getStats();
-			}
-
-			$response = $this->executeController($controller, $methodName);
-
-			if (!empty($databaseStatsBefore)) {
-				$databaseStatsAfter = $this->connection->getInner()->getStats();
-				$numBuilt = $databaseStatsAfter['built'] - $databaseStatsBefore['built'];
-				$numExecuted = $databaseStatsAfter['executed'] - $databaseStatsBefore['executed'];
-
-				if ($numBuilt > 50) {
-					$this->logger->debug('Controller {class}::{method} created {count} QueryBuilder objects, please check if they are created inside a loop by accident.', [
-						'class' => get_class($controller),
-						'method' => $methodName,
-						'count' => $numBuilt,
-					]);
-				}
-
-				if ($numExecuted > 100) {
-					$this->logger->warning('Controller {class}::{method} executed {count} queries.', [
-						'class' => get_class($controller),
-						'method' => $methodName,
-						'count' => $numExecuted,
-					]);
-				}
-			}
-
-			// if an exception appears, the middleware checks if it can handle the
-			// exception and creates a response. If no response is created, it is
-			// assumed that there's no middleware who can handle it and the error is
-			// thrown again
-		} catch (\Exception $exception) {
-			$response = $this->middlewareDispatcher->afterException(
-				$controller, $methodName, $exception);
-		} catch (\Throwable $throwable) {
-			$exception = new \Exception($throwable->getMessage() . ' in file \'' . $throwable->getFile() . '\' line ' . $throwable->getLine(), $throwable->getCode(), $throwable);
-			$response = $this->middlewareDispatcher->afterException(
-				$controller, $methodName, $exception);
-		}
-
-		$response = $this->middlewareDispatcher->afterController(
-			$controller, $methodName, $response);
-
-		// depending on the cache object the headers need to be changed
-		return [
-			$this->protocol->getStatusHeader($response->getStatus()),
-			array_merge($response->getHeaders()),
-			$response->getCookies(),
-			$this->middlewareDispatcher->beforeOutput(
-				$controller, $methodName, $response->render()
-			),
-			$response,
-		];
-	}
-
-
-	/**
-	 * Uses the reflected parameters, types and request parameters to execute
-	 * the controller
-	 * @param Controller $controller the controller to be executed
-	 * @param string $methodName the method on the controller that should be executed
-	 * @return Response
-	 */
-	private function executeController(Controller $controller, string $methodName): Response {
-		$arguments = [];
-
-		// valid types that will be cast
-		$types = ['int', 'integer', 'bool', 'boolean', 'float', 'double'];
-
-		foreach ($this->reflector->getParameters() as $param => $default) {
-			// try to get the parameter from the request object and cast
-			// it to the type annotated in the @param annotation
-			$value = $this->request->getParam($param, $default);
-			$type = $this->reflector->getType($param);
-
-			// Converted the string `'false'` to false when the controller wants a boolean
-			if ($value === 'false' && ($type === 'bool' || $type === 'boolean')) {
-				$value = false;
-			} elseif ($value !== null && \in_array($type, $types, true)) {
-				settype($value, $type);
-				$this->ensureParameterValueSatisfiesRange($param, $value);
-			} elseif ($value === null && $type !== null && $this->appContainer->has($type)) {
-				$value = $this->appContainer->get($type);
-			}
-
-			$arguments[] = $value;
-		}
-
-		$this->eventLogger->start('controller:' . get_class($controller) . '::' . $methodName, 'App framework controller execution');
-		try {
-			$response = \call_user_func_array([$controller, $methodName], $arguments);
-		} catch (\TypeError $e) {
-			// Only intercept TypeErrors occurring on the first line, meaning that the invocation of the controller method failed.
-			// Any other TypeError happens inside the controller method logic and should be logged as normal.
-			if ($e->getFile() === $this->reflector->getFile() && $e->getLine() === $this->reflector->getStartLine()) {
-				$this->logger->debug('Failed to call controller method: ' . $e->getMessage(), ['exception' => $e]);
-				return new Response(Http::STATUS_BAD_REQUEST);
-			}
-
-			throw $e;
-		}
-		$this->eventLogger->end('controller:' . get_class($controller) . '::' . $methodName);
-
-		if (!($response instanceof Response)) {
-			$this->logger->debug($controller::class . '::' . $methodName . ' returned raw data. Please wrap it in a Response or one of it\'s inheritors.');
-		}
-
-		// format response
-		if ($response instanceof DataResponse || !($response instanceof Response)) {
-			$format = $this->request->getFormat();
-			if ($format !== null && $controller->isResponderRegistered($format)) {
-				$response = $controller->buildResponse($response, $format);
-			} else {
-				$response = $controller->buildResponse($response);
-			}
-		}
-
-		return $response;
-	}
-
-	/**
-	 * @psalm-param mixed $value
-	 * @throws ParameterOutOfRangeException
-	 */
-	private function ensureParameterValueSatisfiesRange(string $param, $value): void {
-		$rangeInfo = $this->reflector->getRange($param);
-		if ($rangeInfo) {
-			if ($value < $rangeInfo['min'] || $value > $rangeInfo['max']) {
-				throw new ParameterOutOfRangeException(
-					$param,
-					$value,
-					$rangeInfo['min'],
-					$rangeInfo['max'],
-				);
-			}
-		}
-	}
+    /**
+     * @param Http $protocol the http protocol with contains all status headers
+     * @param MiddlewareDispatcher $middlewareDispatcher the dispatcher which
+     *                                                   runs the middleware
+     */
+    public function __construct(
+        private readonly Http $protocol,
+        private readonly MiddlewareDispatcher $middlewareDispatcher,
+        private readonly ControllerMethodReflector $reflector,
+        private readonly IRequest $request,
+        private readonly IConfig $config,
+        private readonly ConnectionAdapter $connection,
+        private readonly LoggerInterface $logger,
+        private readonly IEventLogger $eventLogger,
+        private readonly ContainerInterface $appContainer,
+    ) {
+    }
+
+
+    /**
+     * Handles a request and calls the dispatcher on the controller
+     * @param Controller $controller the controller which will be called
+     * @param string $methodName the method name which will be called on
+     *                           the controller
+     * @return array{0: string, 1: array, 2: array, 3: string, 4: Response}
+     *                                                                      $array[0] contains the http status header as a string,
+     *                                                                      $array[1] contains response headers as an array,
+     *                                                                      $array[2] contains response cookies as an array,
+     *                                                                      $array[3] contains the response output as a string,
+     *                                                                      $array[4] contains the response object
+     * @throws \Exception
+     */
+    public function dispatch(Controller $controller, string $methodName): array {
+        try {
+            // prefill reflector with everything that's needed for the
+            // middlewares
+            $this->reflector->reflect($controller, $methodName);
+
+            $this->middlewareDispatcher->beforeController($controller,
+                $methodName);
+
+            $databaseStatsBefore = [];
+            if ($this->config->getSystemValueBool('debug', false)) {
+                $databaseStatsBefore = $this->connection->getInner()->getStats();
+            }
+
+            $response = $this->executeController($controller, $methodName);
+
+            if (!empty($databaseStatsBefore)) {
+                $databaseStatsAfter = $this->connection->getInner()->getStats();
+                $numBuilt = $databaseStatsAfter['built'] - $databaseStatsBefore['built'];
+                $numExecuted = $databaseStatsAfter['executed'] - $databaseStatsBefore['executed'];
+
+                if ($numBuilt > 50) {
+                    $this->logger->debug('Controller {class}::{method} created {count} QueryBuilder objects, please check if they are created inside a loop by accident.', [
+                        'class' => get_class($controller),
+                        'method' => $methodName,
+                        'count' => $numBuilt,
+                    ]);
+                }
+
+                if ($numExecuted > 100) {
+                    $this->logger->warning('Controller {class}::{method} executed {count} queries.', [
+                        'class' => get_class($controller),
+                        'method' => $methodName,
+                        'count' => $numExecuted,
+                    ]);
+                }
+            }
+
+            // if an exception appears, the middleware checks if it can handle the
+            // exception and creates a response. If no response is created, it is
+            // assumed that there's no middleware who can handle it and the error is
+            // thrown again
+        } catch (\Exception $exception) {
+            $response = $this->middlewareDispatcher->afterException(
+                $controller, $methodName, $exception);
+        } catch (\Throwable $throwable) {
+            $exception = new \Exception($throwable->getMessage() . ' in file \'' . $throwable->getFile() . '\' line ' . $throwable->getLine(), $throwable->getCode(), $throwable);
+            $response = $this->middlewareDispatcher->afterException(
+                $controller, $methodName, $exception);
+        }
+
+        $response = $this->middlewareDispatcher->afterController(
+            $controller, $methodName, $response);
+
+        // depending on the cache object the headers need to be changed
+        return [
+            $this->protocol->getStatusHeader($response->getStatus()),
+            array_merge($response->getHeaders()),
+            $response->getCookies(),
+            $this->middlewareDispatcher->beforeOutput(
+                $controller, $methodName, $response->render()
+            ),
+            $response,
+        ];
+    }
+
+
+    /**
+     * Uses the reflected parameters, types and request parameters to execute
+     * the controller
+     * @param Controller $controller the controller to be executed
+     * @param string $methodName the method on the controller that should be executed
+     * @return Response
+     */
+    private function executeController(Controller $controller, string $methodName): Response {
+        $arguments = [];
+
+        // valid types that will be cast
+        $types = ['int', 'integer', 'bool', 'boolean', 'float', 'double'];
+
+        foreach ($this->reflector->getParameters() as $param => $default) {
+            // try to get the parameter from the request object and cast
+            // it to the type annotated in the @param annotation
+            $value = $this->request->getParam($param, $default);
+            $type = $this->reflector->getType($param);
+
+            // Converted the string `'false'` to false when the controller wants a boolean
+            if ($value === 'false' && ($type === 'bool' || $type === 'boolean')) {
+                $value = false;
+            } elseif ($value !== null && \in_array($type, $types, true)) {
+                settype($value, $type);
+                $this->ensureParameterValueSatisfiesRange($param, $value);
+            } elseif ($value === null && $type !== null && $this->appContainer->has($type)) {
+                $value = $this->appContainer->get($type);
+            }
+
+            $arguments[] = $value;
+        }
+
+        $this->eventLogger->start('controller:' . get_class($controller) . '::' . $methodName, 'App framework controller execution');
+        try {
+            $response = \call_user_func_array([$controller, $methodName], $arguments);
+        } catch (\TypeError $e) {
+            // Only intercept TypeErrors occurring on the first line, meaning that the invocation of the controller method failed.
+            // Any other TypeError happens inside the controller method logic and should be logged as normal.
+            if ($e->getFile() === $this->reflector->getFile() && $e->getLine() === $this->reflector->getStartLine()) {
+                $this->logger->debug('Failed to call controller method: ' . $e->getMessage(), ['exception' => $e]);
+                return new Response(Http::STATUS_BAD_REQUEST);
+            }
+
+            throw $e;
+        }
+        $this->eventLogger->end('controller:' . get_class($controller) . '::' . $methodName);
+
+        if (!($response instanceof Response)) {
+            $this->logger->debug($controller::class . '::' . $methodName . ' returned raw data. Please wrap it in a Response or one of it\'s inheritors.');
+        }
+
+        // format response
+        if ($response instanceof DataResponse || !($response instanceof Response)) {
+            $format = $this->request->getFormat();
+            if ($format !== null && $controller->isResponderRegistered($format)) {
+                $response = $controller->buildResponse($response, $format);
+            } else {
+                $response = $controller->buildResponse($response);
+            }
+        }
+
+        return $response;
+    }
+
+    /**
+     * @psalm-param mixed $value
+     * @throws ParameterOutOfRangeException
+     */
+    private function ensureParameterValueSatisfiesRange(string $param, $value): void {
+        $rangeInfo = $this->reflector->getRange($param);
+        if ($rangeInfo) {
+            if ($value < $rangeInfo['min'] || $value > $rangeInfo['max']) {
+                throw new ParameterOutOfRangeException(
+                    $param,
+                    $value,
+                    $rangeInfo['min'],
+                    $rangeInfo['max'],
+                );
+            }
+        }
+    }
 }