nextcloud / server

lib/public/ICertificate.php

Indentation +40 added lines, -40 removed lines

@@ -32,51 +32,51 @@
  * @since 8.0.0
  */
 interface ICertificate {
-	/**
-	 * @return string
-	 * @since 8.0.0
-	 */
-	public function getName(): string;
+    /**
+     * @return string
+     * @since 8.0.0
+     */
+    public function getName(): string;
 
-	/**
-	 * @return string|null
-	 * @since 8.0.0
-	 */
-	public function getCommonName(): ?string;
+    /**
+     * @return string|null
+     * @since 8.0.0
+     */
+    public function getCommonName(): ?string;
 
-	/**
-	 * @return string|null
-	 * @since 8.0.0
-	 */
-	public function getOrganization(): ?string;
+    /**
+     * @return string|null
+     * @since 8.0.0
+     */
+    public function getOrganization(): ?string;
 
-	/**
-	 * @return \DateTime
-	 * @since 8.0.0
-	 */
-	public function getIssueDate(): \DateTime;
+    /**
+     * @return \DateTime
+     * @since 8.0.0
+     */
+    public function getIssueDate(): \DateTime;
 
-	/**
-	 * @return \DateTime
-	 * @since 8.0.0
-	 */
-	public function getExpireDate(): \DateTime;
+    /**
+     * @return \DateTime
+     * @since 8.0.0
+     */
+    public function getExpireDate(): \DateTime;
 
-	/**
-	 * @return bool
-	 * @since 8.0.0
-	 */
-	public function isExpired(): bool;
+    /**
+     * @return bool
+     * @since 8.0.0
+     */
+    public function isExpired(): bool;
 
-	/**
-	 * @return string|null
-	 * @since 8.0.0
-	 */
-	public function getIssuerName(): ?string;
+    /**
+     * @return string|null
+     * @since 8.0.0
+     */
+    public function getIssuerName(): ?string;
 
-	/**
-	 * @return string|null
-	 * @since 8.0.0
-	 */
-	public function getIssuerOrganization(): ?string;
+    /**
+     * @return string|null
+     * @since 8.0.0
+     */
+    public function getIssuerOrganization(): ?string;
 }

lib/public/ICertificateManager.php

Indentation +35 added lines, -35 removed lines

@@ -32,43 +32,43 @@
  * @since 8.0.0
  */
 interface ICertificateManager {
-	/**
-	 * Returns all certificates trusted by the system
-	 *
-	 * @return \OCP\ICertificate[]
-	 * @since 8.0.0
-	 */
-	public function listCertificates(): array;
+    /**
+     * Returns all certificates trusted by the system
+     *
+     * @return \OCP\ICertificate[]
+     * @since 8.0.0
+     */
+    public function listCertificates(): array;
 
-	/**
-	 * @param string $certificate the certificate data
-	 * @param string $name the filename for the certificate
-	 * @return \OCP\ICertificate
-	 * @throws \Exception If the certificate could not get added
-	 * @since 8.0.0 - since 8.1.0 throws exception instead of returning false
-	 */
-	public function addCertificate(string $certificate, string $name): \OCP\ICertificate;
+    /**
+     * @param string $certificate the certificate data
+     * @param string $name the filename for the certificate
+     * @return \OCP\ICertificate
+     * @throws \Exception If the certificate could not get added
+     * @since 8.0.0 - since 8.1.0 throws exception instead of returning false
+     */
+    public function addCertificate(string $certificate, string $name): \OCP\ICertificate;
 
-	/**
-	 * @param string $name
-	 * @return bool
-	 * @since 8.0.0
-	 */
-	public function removeCertificate(string $name): bool;
+    /**
+     * @param string $name
+     * @return bool
+     * @since 8.0.0
+     */
+    public function removeCertificate(string $name): bool;
 
-	/**
-	 * Get the path to the certificate bundle
-	 *
-	 * @return string
-	 * @since 8.0.0
-	 */
-	public function getCertificateBundle(): string;
+    /**
+     * Get the path to the certificate bundle
+     *
+     * @return string
+     * @since 8.0.0
+     */
+    public function getCertificateBundle(): string;
 
-	/**
-	 * Get the full local path to the certificate bundle
-	 *
-	 * @return string
-	 * @since 9.0.0
-	 */
-	public function getAbsoluteBundlePath(): string;
+    /**
+     * Get the full local path to the certificate bundle
+     *
+     * @return string
+     * @since 9.0.0
+     */
+    public function getAbsoluteBundlePath(): string;
 }

lib/public/Security/ICredentialsManager.php

Indentation +35 added lines, -35 removed lines

@@ -33,42 +33,42 @@
  */
 interface ICredentialsManager {
 
-	/**
-	 * Store a set of credentials
-	 *
-	 * @param string $userId empty string for system-wide credentials
-	 * @param string $identifier
-	 * @param mixed $credentials
-	 * @since 8.2.0
-	 */
-	public function store(string $userId, string $identifier, $credentials): void;
+    /**
+     * Store a set of credentials
+     *
+     * @param string $userId empty string for system-wide credentials
+     * @param string $identifier
+     * @param mixed $credentials
+     * @since 8.2.0
+     */
+    public function store(string $userId, string $identifier, $credentials): void;
 
-	/**
-	 * Retrieve a set of credentials
-	 *
-	 * @param string $userId empty string for system-wide credentials
-	 * @param string $identifier
-	 * @return mixed
-	 * @since 8.2.0
-	 */
-	public function retrieve(string $userId, string $identifier);
+    /**
+     * Retrieve a set of credentials
+     *
+     * @param string $userId empty string for system-wide credentials
+     * @param string $identifier
+     * @return mixed
+     * @since 8.2.0
+     */
+    public function retrieve(string $userId, string $identifier);
 
-	/**
-	 * Delete a set of credentials
-	 *
-	 * @param string $userId empty string for system-wide credentials
-	 * @param string $identifier
-	 * @return int rows removed
-	 * @since 8.2.0
-	 */
-	public function delete(string $userId, string $identifier): int;
+    /**
+     * Delete a set of credentials
+     *
+     * @param string $userId empty string for system-wide credentials
+     * @param string $identifier
+     * @return int rows removed
+     * @since 8.2.0
+     */
+    public function delete(string $userId, string $identifier): int;
 
-	/**
-	 * Erase all credentials stored for a user
-	 *
-	 * @param string $userId
-	 * @return int rows removed
-	 * @since 8.2.0
-	 */
-	public function erase(string $userId): int;
+    /**
+     * Erase all credentials stored for a user
+     *
+     * @param string $userId
+     * @return int rows removed
+     * @since 8.2.0
+     */
+    public function erase(string $userId): int;
 }

lib/private/Security/CredentialsManager.php

Indentation +100 added lines, -100 removed lines

@@ -38,104 +38,104 @@
  * @package OC\Security
  */
 class CredentialsManager implements ICredentialsManager {
-	public const DB_TABLE = 'storages_credentials';
-
-	/** @var ICrypto */
-	protected $crypto;
-
-	/** @var IDBConnection */
-	protected $dbConnection;
-
-	/**
-	 * @param ICrypto $crypto
-	 * @param IDBConnection $dbConnection
-	 */
-	public function __construct(ICrypto $crypto, IDBConnection $dbConnection) {
-		$this->crypto = $crypto;
-		$this->dbConnection = $dbConnection;
-	}
-
-	/**
-	 * Store a set of credentials
-	 *
-	 * @param string $userId empty string for system-wide credentials
-	 * @param string $identifier
-	 * @param mixed $credentials
-	 */
-	public function store(string $userId, string $identifier, $credentials): void {
-		$value = $this->crypto->encrypt(json_encode($credentials));
-
-		$this->dbConnection->setValues(self::DB_TABLE, [
-			'user' => $userId,
-			'identifier' => $identifier,
-		], [
-			'credentials' => $value,
-		]);
-	}
-
-	/**
-	 * Retrieve a set of credentials
-	 *
-	 * @param string $userId empty string for system-wide credentials
-	 * @param string $identifier
-	 * @return mixed
-	 */
-	public function retrieve(string $userId, string $identifier) {
-		$qb = $this->dbConnection->getQueryBuilder();
-		$qb->select('credentials')
-			->from(self::DB_TABLE)
-			->where($qb->expr()->eq('identifier', $qb->createNamedParameter($identifier)));
-
-		if ($userId === '') {
-			$qb->andWhere($qb->expr()->emptyString('user'));
-		} else {
-			$qb->andWhere($qb->expr()->eq('user', $qb->createNamedParameter($userId)));
-		}
-
-		$qResult = $qb->execute();
-		$result = $qResult->fetch();
-		$qResult->closeCursor();
-
-		if (!$result) {
-			return null;
-		}
-		$value = $result['credentials'];
-
-		return json_decode($this->crypto->decrypt($value), true);
-	}
-
-	/**
-	 * Delete a set of credentials
-	 *
-	 * @param string $userId empty string for system-wide credentials
-	 * @param string $identifier
-	 * @return int rows removed
-	 */
-	public function delete(string $userId, string $identifier): int {
-		$qb = $this->dbConnection->getQueryBuilder();
-		$qb->delete(self::DB_TABLE)
-			->where($qb->expr()->eq('identifier', $qb->createNamedParameter($identifier)));
-
-		if ($userId === '') {
-			$qb->andWhere($qb->expr()->emptyString('user'));
-		} else {
-			$qb->andWhere($qb->expr()->eq('user', $qb->createNamedParameter($userId)));
-		}
-
-		return $qb->execute();
-	}
-
-	/**
-	 * Erase all credentials stored for a user
-	 *
-	 * @param string $userId
-	 * @return int rows removed
-	 */
-	public function erase(string $userId): int {
-		$qb = $this->dbConnection->getQueryBuilder();
-		$qb->delete(self::DB_TABLE)
-			->where($qb->expr()->eq('user', $qb->createNamedParameter($userId)))
-		;
-		return $qb->execute();
-	}
+    public const DB_TABLE = 'storages_credentials';
+
+    /** @var ICrypto */
+    protected $crypto;
+
+    /** @var IDBConnection */
+    protected $dbConnection;
+
+    /**
+     * @param ICrypto $crypto
+     * @param IDBConnection $dbConnection
+     */
+    public function __construct(ICrypto $crypto, IDBConnection $dbConnection) {
+        $this->crypto = $crypto;
+        $this->dbConnection = $dbConnection;
+    }
+
+    /**
+     * Store a set of credentials
+     *
+     * @param string $userId empty string for system-wide credentials
+     * @param string $identifier
+     * @param mixed $credentials
+     */
+    public function store(string $userId, string $identifier, $credentials): void {
+        $value = $this->crypto->encrypt(json_encode($credentials));
+
+        $this->dbConnection->setValues(self::DB_TABLE, [
+            'user' => $userId,
+            'identifier' => $identifier,
+        ], [
+            'credentials' => $value,
+        ]);
+    }
+
+    /**
+     * Retrieve a set of credentials
+     *
+     * @param string $userId empty string for system-wide credentials
+     * @param string $identifier
+     * @return mixed
+     */
+    public function retrieve(string $userId, string $identifier) {
+        $qb = $this->dbConnection->getQueryBuilder();
+        $qb->select('credentials')
+            ->from(self::DB_TABLE)
+            ->where($qb->expr()->eq('identifier', $qb->createNamedParameter($identifier)));
+
+        if ($userId === '') {
+            $qb->andWhere($qb->expr()->emptyString('user'));
+        } else {
+            $qb->andWhere($qb->expr()->eq('user', $qb->createNamedParameter($userId)));
+        }
+
+        $qResult = $qb->execute();
+        $result = $qResult->fetch();
+        $qResult->closeCursor();
+
+        if (!$result) {
+            return null;
+        }
+        $value = $result['credentials'];
+
+        return json_decode($this->crypto->decrypt($value), true);
+    }
+
+    /**
+     * Delete a set of credentials
+     *
+     * @param string $userId empty string for system-wide credentials
+     * @param string $identifier
+     * @return int rows removed
+     */
+    public function delete(string $userId, string $identifier): int {
+        $qb = $this->dbConnection->getQueryBuilder();
+        $qb->delete(self::DB_TABLE)
+            ->where($qb->expr()->eq('identifier', $qb->createNamedParameter($identifier)));
+
+        if ($userId === '') {
+            $qb->andWhere($qb->expr()->emptyString('user'));
+        } else {
+            $qb->andWhere($qb->expr()->eq('user', $qb->createNamedParameter($userId)));
+        }
+
+        return $qb->execute();
+    }
+
+    /**
+     * Erase all credentials stored for a user
+     *
+     * @param string $userId
+     * @return int rows removed
+     */
+    public function erase(string $userId): int {
+        $qb = $this->dbConnection->getQueryBuilder();
+        $qb->delete(self::DB_TABLE)
+            ->where($qb->expr()->eq('user', $qb->createNamedParameter($userId)))
+        ;
+        return $qb->execute();
+    }
 }

lib/private/Security/Bruteforce/Capabilities.php

Indentation +29 added lines, -29 removed lines

@@ -31,33 +31,33 @@
 use OCP\IRequest;
 
 class Capabilities implements IPublicCapability {
-	/** @var IRequest */
-	private $request;
-
-	/** @var Throttler */
-	private $throttler;
-
-	/**
-	 * Capabilities constructor.
-	 *
-	 * @param IRequest $request
-	 * @param Throttler $throttler
-	 */
-	public function __construct(IRequest $request,
-								Throttler $throttler) {
-		$this->request = $request;
-		$this->throttler = $throttler;
-	}
-
-	public function getCapabilities(): array {
-		if (version_compare(\OC::$server->getConfig()->getSystemValue('version', '0.0.0.0'), '12.0.0.0', '<')) {
-			return [];
-		}
-
-		return [
-			'bruteforce' => [
-				'delay' => $this->throttler->getDelay($this->request->getRemoteAddress())
-			]
-		];
-	}
+    /** @var IRequest */
+    private $request;
+
+    /** @var Throttler */
+    private $throttler;
+
+    /**
+     * Capabilities constructor.
+     *
+     * @param IRequest $request
+     * @param Throttler $throttler
+     */
+    public function __construct(IRequest $request,
+                                Throttler $throttler) {
+        $this->request = $request;
+        $this->throttler = $throttler;
+    }
+
+    public function getCapabilities(): array {
+        if (version_compare(\OC::$server->getConfig()->getSystemValue('version', '0.0.0.0'), '12.0.0.0', '<')) {
+            return [];
+        }
+
+        return [
+            'bruteforce' => [
+                'delay' => $this->throttler->getDelay($this->request->getRemoteAddress())
+            ]
+        ];
+    }
 }

lib/private/Security/CertificateManager.php

Indentation +238 added lines, -238 removed lines

@@ -43,242 +43,242 @@
  * Manage trusted certificates for users
  */
 class CertificateManager implements ICertificateManager {
-	/**
-	 * @var \OC\Files\View
-	 */
-	protected $view;
-
-	/**
-	 * @var IConfig
-	 */
-	protected $config;
-
-	/**
-	 * @var ILogger
-	 */
-	protected $logger;
-
-	/** @var ISecureRandom */
-	protected $random;
-
-	/**
-	 * @param \OC\Files\View $view relative to data/
-	 * @param IConfig $config
-	 * @param ILogger $logger
-	 * @param ISecureRandom $random
-	 */
-	public function __construct(\OC\Files\View $view,
-								IConfig $config,
-								ILogger $logger,
-								ISecureRandom $random) {
-		$this->view = $view;
-		$this->config = $config;
-		$this->logger = $logger;
-		$this->random = $random;
-	}
-
-	/**
-	 * Returns all certificates trusted by the user
-	 *
-	 * @return \OCP\ICertificate[]
-	 */
-	public function listCertificates(): array {
-		if (!$this->config->getSystemValue('installed', false)) {
-			return [];
-		}
-
-		$path = $this->getPathToCertificates() . 'uploads/';
-		if (!$this->view->is_dir($path)) {
-			return [];
-		}
-		$result = [];
-		$handle = $this->view->opendir($path);
-		if (!is_resource($handle)) {
-			return [];
-		}
-		while (false !== ($file = readdir($handle))) {
-			if ($file != '.' && $file != '..') {
-				try {
-					$result[] = new Certificate($this->view->file_get_contents($path . $file), $file);
-				} catch (\Exception $e) {
-				}
-			}
-		}
-		closedir($handle);
-		return $result;
-	}
-
-	private function hasCertificates(): bool {
-		if (!$this->config->getSystemValue('installed', false)) {
-			return false;
-		}
-
-		$path = $this->getPathToCertificates() . 'uploads/';
-		if (!$this->view->is_dir($path)) {
-			return false;
-		}
-		$result = [];
-		$handle = $this->view->opendir($path);
-		if (!is_resource($handle)) {
-			return false;
-		}
-		while (false !== ($file = readdir($handle))) {
-			if ($file !== '.' && $file !== '..') {
-				return true;
-			}
-		}
-		closedir($handle);
-		return false;
-	}
-
-	/**
-	 * create the certificate bundle of all trusted certificated
-	 */
-	public function createCertificateBundle(): void {
-		$path = $this->getPathToCertificates();
-		$certs = $this->listCertificates();
-
-		if (!$this->view->file_exists($path)) {
-			$this->view->mkdir($path);
-		}
-
-		$defaultCertificates = file_get_contents(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
-		if (strlen($defaultCertificates) < 1024) { // sanity check to verify that we have some content for our bundle
-			// log as exception so we have a stacktrace
-			$this->logger->logException(new \Exception('Shipped ca-bundle is empty, refusing to create certificate bundle'));
-			return;
-		}
-
-		$certPath = $path . 'rootcerts.crt';
-		$tmpPath = $certPath . '.tmp' . $this->random->generate(10, ISecureRandom::CHAR_DIGITS);
-		$fhCerts = $this->view->fopen($tmpPath, 'w');
-
-		// Write user certificates
-		foreach ($certs as $cert) {
-			$file = $path . '/uploads/' . $cert->getName();
-			$data = $this->view->file_get_contents($file);
-			if (strpos($data, 'BEGIN CERTIFICATE')) {
-				fwrite($fhCerts, $data);
-				fwrite($fhCerts, "\r\n");
-			}
-		}
-
-		// Append the default certificates
-		fwrite($fhCerts, $defaultCertificates);
-
-		// Append the system certificate bundle
-		$systemBundle = $this->getCertificateBundle();
-		if ($systemBundle !== $certPath && $this->view->file_exists($systemBundle)) {
-			$systemCertificates = $this->view->file_get_contents($systemBundle);
-			fwrite($fhCerts, $systemCertificates);
-		}
-
-		fclose($fhCerts);
-
-		$this->view->rename($tmpPath, $certPath);
-	}
-
-	/**
-	 * Save the certificate and re-generate the certificate bundle
-	 *
-	 * @param string $certificate the certificate data
-	 * @param string $name the filename for the certificate
-	 * @return \OCP\ICertificate
-	 * @throws \Exception If the certificate could not get added
-	 */
-	public function addCertificate(string $certificate, string $name): ICertificate {
-		if (!Filesystem::isValidPath($name) or Filesystem::isFileBlacklisted($name)) {
-			throw new \Exception('Filename is not valid');
-		}
-
-		$dir = $this->getPathToCertificates() . 'uploads/';
-		if (!$this->view->file_exists($dir)) {
-			$this->view->mkdir($dir);
-		}
-
-		try {
-			$file = $dir . $name;
-			$certificateObject = new Certificate($certificate, $name);
-			$this->view->file_put_contents($file, $certificate);
-			$this->createCertificateBundle();
-			return $certificateObject;
-		} catch (\Exception $e) {
-			throw $e;
-		}
-	}
-
-	/**
-	 * Remove the certificate and re-generate the certificate bundle
-	 *
-	 * @param string $name
-	 * @return bool
-	 */
-	public function removeCertificate(string $name): bool {
-		if (!Filesystem::isValidPath($name)) {
-			return false;
-		}
-		$path = $this->getPathToCertificates() . 'uploads/';
-		if ($this->view->file_exists($path . $name)) {
-			$this->view->unlink($path . $name);
-			$this->createCertificateBundle();
-		}
-		return true;
-	}
-
-	/**
-	 * Get the path to the certificate bundle
-	 *
-	 * @return string
-	 */
-	public function getCertificateBundle(): string {
-		return $this->getPathToCertificates() . 'rootcerts.crt';
-	}
-
-	/**
-	 * Get the full local path to the certificate bundle
-	 *
-	 * @return string
-	 */
-	public function getAbsoluteBundlePath(): string {
-		if (!$this->hasCertificates()) {
-			return \OC::$SERVERROOT . '/resources/config/ca-bundle.crt';
-		}
-
-		if ($this->needsRebundling()) {
-			$this->createCertificateBundle();
-		}
-
-		return $this->view->getLocalFile($this->getCertificateBundle());
-	}
-
-	/**
-	 * @return string
-	 */
-	private function getPathToCertificates(): string {
-		return '/files_external/';
-	}
-
-	/**
-	 * Check if we need to re-bundle the certificates because one of the sources has updated
-	 *
-	 * @return bool
-	 */
-	private function needsRebundling(): bool {
-		$targetBundle = $this->getCertificateBundle();
-		if (!$this->view->file_exists($targetBundle)) {
-			return true;
-		}
-
-		$sourceMTime = $this->getFilemtimeOfCaBundle();
-		return $sourceMTime > $this->view->filemtime($targetBundle);
-	}
-
-	/**
-	 * get mtime of ca-bundle shipped by Nextcloud
-	 *
-	 * @return int
-	 */
-	protected function getFilemtimeOfCaBundle(): int {
-		return filemtime(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
-	}
+    /**
+     * @var \OC\Files\View
+     */
+    protected $view;
+
+    /**
+     * @var IConfig
+     */
+    protected $config;
+
+    /**
+     * @var ILogger
+     */
+    protected $logger;
+
+    /** @var ISecureRandom */
+    protected $random;
+
+    /**
+     * @param \OC\Files\View $view relative to data/
+     * @param IConfig $config
+     * @param ILogger $logger
+     * @param ISecureRandom $random
+     */
+    public function __construct(\OC\Files\View $view,
+                                IConfig $config,
+                                ILogger $logger,
+                                ISecureRandom $random) {
+        $this->view = $view;
+        $this->config = $config;
+        $this->logger = $logger;
+        $this->random = $random;
+    }
+
+    /**
+     * Returns all certificates trusted by the user
+     *
+     * @return \OCP\ICertificate[]
+     */
+    public function listCertificates(): array {
+        if (!$this->config->getSystemValue('installed', false)) {
+            return [];
+        }
+
+        $path = $this->getPathToCertificates() . 'uploads/';
+        if (!$this->view->is_dir($path)) {
+            return [];
+        }
+        $result = [];
+        $handle = $this->view->opendir($path);
+        if (!is_resource($handle)) {
+            return [];
+        }
+        while (false !== ($file = readdir($handle))) {
+            if ($file != '.' && $file != '..') {
+                try {
+                    $result[] = new Certificate($this->view->file_get_contents($path . $file), $file);
+                } catch (\Exception $e) {
+                }
+            }
+        }
+        closedir($handle);
+        return $result;
+    }
+
+    private function hasCertificates(): bool {
+        if (!$this->config->getSystemValue('installed', false)) {
+            return false;
+        }
+
+        $path = $this->getPathToCertificates() . 'uploads/';
+        if (!$this->view->is_dir($path)) {
+            return false;
+        }
+        $result = [];
+        $handle = $this->view->opendir($path);
+        if (!is_resource($handle)) {
+            return false;
+        }
+        while (false !== ($file = readdir($handle))) {
+            if ($file !== '.' && $file !== '..') {
+                return true;
+            }
+        }
+        closedir($handle);
+        return false;
+    }
+
+    /**
+     * create the certificate bundle of all trusted certificated
+     */
+    public function createCertificateBundle(): void {
+        $path = $this->getPathToCertificates();
+        $certs = $this->listCertificates();
+
+        if (!$this->view->file_exists($path)) {
+            $this->view->mkdir($path);
+        }
+
+        $defaultCertificates = file_get_contents(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
+        if (strlen($defaultCertificates) < 1024) { // sanity check to verify that we have some content for our bundle
+            // log as exception so we have a stacktrace
+            $this->logger->logException(new \Exception('Shipped ca-bundle is empty, refusing to create certificate bundle'));
+            return;
+        }
+
+        $certPath = $path . 'rootcerts.crt';
+        $tmpPath = $certPath . '.tmp' . $this->random->generate(10, ISecureRandom::CHAR_DIGITS);
+        $fhCerts = $this->view->fopen($tmpPath, 'w');
+
+        // Write user certificates
+        foreach ($certs as $cert) {
+            $file = $path . '/uploads/' . $cert->getName();
+            $data = $this->view->file_get_contents($file);
+            if (strpos($data, 'BEGIN CERTIFICATE')) {
+                fwrite($fhCerts, $data);
+                fwrite($fhCerts, "\r\n");
+            }
+        }
+
+        // Append the default certificates
+        fwrite($fhCerts, $defaultCertificates);
+
+        // Append the system certificate bundle
+        $systemBundle = $this->getCertificateBundle();
+        if ($systemBundle !== $certPath && $this->view->file_exists($systemBundle)) {
+            $systemCertificates = $this->view->file_get_contents($systemBundle);
+            fwrite($fhCerts, $systemCertificates);
+        }
+
+        fclose($fhCerts);
+
+        $this->view->rename($tmpPath, $certPath);
+    }
+
+    /**
+     * Save the certificate and re-generate the certificate bundle
+     *
+     * @param string $certificate the certificate data
+     * @param string $name the filename for the certificate
+     * @return \OCP\ICertificate
+     * @throws \Exception If the certificate could not get added
+     */
+    public function addCertificate(string $certificate, string $name): ICertificate {
+        if (!Filesystem::isValidPath($name) or Filesystem::isFileBlacklisted($name)) {
+            throw new \Exception('Filename is not valid');
+        }
+
+        $dir = $this->getPathToCertificates() . 'uploads/';
+        if (!$this->view->file_exists($dir)) {
+            $this->view->mkdir($dir);
+        }
+
+        try {
+            $file = $dir . $name;
+            $certificateObject = new Certificate($certificate, $name);
+            $this->view->file_put_contents($file, $certificate);
+            $this->createCertificateBundle();
+            return $certificateObject;
+        } catch (\Exception $e) {
+            throw $e;
+        }
+    }
+
+    /**
+     * Remove the certificate and re-generate the certificate bundle
+     *
+     * @param string $name
+     * @return bool
+     */
+    public function removeCertificate(string $name): bool {
+        if (!Filesystem::isValidPath($name)) {
+            return false;
+        }
+        $path = $this->getPathToCertificates() . 'uploads/';
+        if ($this->view->file_exists($path . $name)) {
+            $this->view->unlink($path . $name);
+            $this->createCertificateBundle();
+        }
+        return true;
+    }
+
+    /**
+     * Get the path to the certificate bundle
+     *
+     * @return string
+     */
+    public function getCertificateBundle(): string {
+        return $this->getPathToCertificates() . 'rootcerts.crt';
+    }
+
+    /**
+     * Get the full local path to the certificate bundle
+     *
+     * @return string
+     */
+    public function getAbsoluteBundlePath(): string {
+        if (!$this->hasCertificates()) {
+            return \OC::$SERVERROOT . '/resources/config/ca-bundle.crt';
+        }
+
+        if ($this->needsRebundling()) {
+            $this->createCertificateBundle();
+        }
+
+        return $this->view->getLocalFile($this->getCertificateBundle());
+    }
+
+    /**
+     * @return string
+     */
+    private function getPathToCertificates(): string {
+        return '/files_external/';
+    }
+
+    /**
+     * Check if we need to re-bundle the certificates because one of the sources has updated
+     *
+     * @return bool
+     */
+    private function needsRebundling(): bool {
+        $targetBundle = $this->getCertificateBundle();
+        if (!$this->view->file_exists($targetBundle)) {
+            return true;
+        }
+
+        $sourceMTime = $this->getFilemtimeOfCaBundle();
+        return $sourceMTime > $this->view->filemtime($targetBundle);
+    }
+
+    /**
+     * get mtime of ca-bundle shipped by Nextcloud
+     *
+     * @return int
+     */
+    protected function getFilemtimeOfCaBundle(): int {
+        return filemtime(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
+    }
 }

Spacing +15 added lines, -15 removed lines

@@ -87,7 +87,7 @@ 
 			return [];
 		}
 
-		$path = $this->getPathToCertificates() . 'uploads/';
+		$path = $this->getPathToCertificates().'uploads/';
 		if (!$this->view->is_dir($path)) {
 			return [];
 		}
@@ -99,7 +99,7 @@ 
 		while (false !== ($file = readdir($handle))) {
 			if ($file != '.' && $file != '..') {
 				try {
-					$result[] = new Certificate($this->view->file_get_contents($path . $file), $file);
+					$result[] = new Certificate($this->view->file_get_contents($path.$file), $file);
 				} catch (\Exception $e) {
 				}
 			}
@@ -113,7 +113,7 @@ 
 			return false;
 		}
 
-		$path = $this->getPathToCertificates() . 'uploads/';
+		$path = $this->getPathToCertificates().'uploads/';
 		if (!$this->view->is_dir($path)) {
 			return false;
 		}
@@ -142,20 +142,20 @@ 
 			$this->view->mkdir($path);
 		}
 
-		$defaultCertificates = file_get_contents(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
+		$defaultCertificates = file_get_contents(\OC::$SERVERROOT.'/resources/config/ca-bundle.crt');
 		if (strlen($defaultCertificates) < 1024) { // sanity check to verify that we have some content for our bundle
 			// log as exception so we have a stacktrace
 			$this->logger->logException(new \Exception('Shipped ca-bundle is empty, refusing to create certificate bundle'));
 			return;
 		}
 
-		$certPath = $path . 'rootcerts.crt';
-		$tmpPath = $certPath . '.tmp' . $this->random->generate(10, ISecureRandom::CHAR_DIGITS);
+		$certPath = $path.'rootcerts.crt';
+		$tmpPath = $certPath.'.tmp'.$this->random->generate(10, ISecureRandom::CHAR_DIGITS);
 		$fhCerts = $this->view->fopen($tmpPath, 'w');
 
 		// Write user certificates
 		foreach ($certs as $cert) {
-			$file = $path . '/uploads/' . $cert->getName();
+			$file = $path.'/uploads/'.$cert->getName();
 			$data = $this->view->file_get_contents($file);
 			if (strpos($data, 'BEGIN CERTIFICATE')) {
 				fwrite($fhCerts, $data);
@@ -191,13 +191,13 @@ 
 			throw new \Exception('Filename is not valid');
 		}
 
-		$dir = $this->getPathToCertificates() . 'uploads/';
+		$dir = $this->getPathToCertificates().'uploads/';
 		if (!$this->view->file_exists($dir)) {
 			$this->view->mkdir($dir);
 		}
 
 		try {
-			$file = $dir . $name;
+			$file = $dir.$name;
 			$certificateObject = new Certificate($certificate, $name);
 			$this->view->file_put_contents($file, $certificate);
 			$this->createCertificateBundle();
@@ -217,9 +217,9 @@ 
 		if (!Filesystem::isValidPath($name)) {
 			return false;
 		}
-		$path = $this->getPathToCertificates() . 'uploads/';
-		if ($this->view->file_exists($path . $name)) {
-			$this->view->unlink($path . $name);
+		$path = $this->getPathToCertificates().'uploads/';
+		if ($this->view->file_exists($path.$name)) {
+			$this->view->unlink($path.$name);
 			$this->createCertificateBundle();
 		}
 		return true;
@@ -231,7 +231,7 @@ 
 	 * @return string
 	 */
 	public function getCertificateBundle(): string {
-		return $this->getPathToCertificates() . 'rootcerts.crt';
+		return $this->getPathToCertificates().'rootcerts.crt';
 	}
 
 	/**
@@ -241,7 +241,7 @@ 
 	 */
 	public function getAbsoluteBundlePath(): string {
 		if (!$this->hasCertificates()) {
-			return \OC::$SERVERROOT . '/resources/config/ca-bundle.crt';
+			return \OC::$SERVERROOT.'/resources/config/ca-bundle.crt';
 		}
 
 		if ($this->needsRebundling()) {
@@ -279,6 +279,6 @@ 
 	 * @return int
 	 */
 	protected function getFilemtimeOfCaBundle(): int {
-		return filemtime(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
+		return filemtime(\OC::$SERVERROOT.'/resources/config/ca-bundle.crt');
 	}
 }

lib/private/Security/Certificate.php

Indentation +100 added lines, -100 removed lines

@@ -31,104 +31,104 @@
 use OCP\ICertificate;
 
 class Certificate implements ICertificate {
-	protected $name;
-
-	protected $commonName;
-
-	protected $organization;
-
-	protected $serial;
-
-	protected $issueDate;
-
-	protected $expireDate;
-
-	protected $issuerName;
-
-	protected $issuerOrganization;
-
-	/**
-	 * @param string $data base64 encoded certificate
-	 * @param string $name
-	 * @throws \Exception If the certificate could not get parsed
-	 */
-	public function __construct(string $data, string $name) {
-		$this->name = $name;
-		$gmt = new \DateTimeZone('GMT');
-
-		// If string starts with "file://" ignore the certificate
-		$query = 'file://';
-		if (strtolower(substr($data, 0, strlen($query))) === $query) {
-			throw new \Exception('Certificate could not get parsed.');
-		}
-
-		$info = openssl_x509_parse($data);
-		if (!is_array($info)) {
-			throw new \Exception('Certificate could not get parsed.');
-		}
-
-		$this->commonName = isset($info['subject']['CN']) ? $info['subject']['CN'] : null;
-		$this->organization = isset($info['subject']['O']) ? $info['subject']['O'] : null;
-		$this->issueDate = new \DateTime('@' . $info['validFrom_time_t'], $gmt);
-		$this->expireDate = new \DateTime('@' . $info['validTo_time_t'], $gmt);
-		$this->issuerName = isset($info['issuer']['CN']) ? $info['issuer']['CN'] : null;
-		$this->issuerOrganization = isset($info['issuer']['O']) ? $info['issuer']['O'] : null;
-	}
-
-	/**
-	 * @return string
-	 */
-	public function getName(): string {
-		return $this->name;
-	}
-
-	/**
-	 * @return string|null
-	 */
-	public function getCommonName(): ?string {
-		return $this->commonName;
-	}
-
-	/**
-	 * @return string|null
-	 */
-	public function getOrganization(): ?string {
-		return $this->organization;
-	}
-
-	/**
-	 * @return \DateTime
-	 */
-	public function getIssueDate(): \DateTime {
-		return $this->issueDate;
-	}
-
-	/**
-	 * @return \DateTime
-	 */
-	public function getExpireDate(): \DateTime {
-		return $this->expireDate;
-	}
-
-	/**
-	 * @return bool
-	 */
-	public function isExpired(): bool {
-		$now = new \DateTime();
-		return $this->issueDate > $now or $now > $this->expireDate;
-	}
-
-	/**
-	 * @return string|null
-	 */
-	public function getIssuerName(): ?string {
-		return $this->issuerName;
-	}
-
-	/**
-	 * @return string|null
-	 */
-	public function getIssuerOrganization(): ?string {
-		return $this->issuerOrganization;
-	}
+    protected $name;
+
+    protected $commonName;
+
+    protected $organization;
+
+    protected $serial;
+
+    protected $issueDate;
+
+    protected $expireDate;
+
+    protected $issuerName;
+
+    protected $issuerOrganization;
+
+    /**
+     * @param string $data base64 encoded certificate
+     * @param string $name
+     * @throws \Exception If the certificate could not get parsed
+     */
+    public function __construct(string $data, string $name) {
+        $this->name = $name;
+        $gmt = new \DateTimeZone('GMT');
+
+        // If string starts with "file://" ignore the certificate
+        $query = 'file://';
+        if (strtolower(substr($data, 0, strlen($query))) === $query) {
+            throw new \Exception('Certificate could not get parsed.');
+        }
+
+        $info = openssl_x509_parse($data);
+        if (!is_array($info)) {
+            throw new \Exception('Certificate could not get parsed.');
+        }
+
+        $this->commonName = isset($info['subject']['CN']) ? $info['subject']['CN'] : null;
+        $this->organization = isset($info['subject']['O']) ? $info['subject']['O'] : null;
+        $this->issueDate = new \DateTime('@' . $info['validFrom_time_t'], $gmt);
+        $this->expireDate = new \DateTime('@' . $info['validTo_time_t'], $gmt);
+        $this->issuerName = isset($info['issuer']['CN']) ? $info['issuer']['CN'] : null;
+        $this->issuerOrganization = isset($info['issuer']['O']) ? $info['issuer']['O'] : null;
+    }
+
+    /**
+     * @return string
+     */
+    public function getName(): string {
+        return $this->name;
+    }
+
+    /**
+     * @return string|null
+     */
+    public function getCommonName(): ?string {
+        return $this->commonName;
+    }
+
+    /**
+     * @return string|null
+     */
+    public function getOrganization(): ?string {
+        return $this->organization;
+    }
+
+    /**
+     * @return \DateTime
+     */
+    public function getIssueDate(): \DateTime {
+        return $this->issueDate;
+    }
+
+    /**
+     * @return \DateTime
+     */
+    public function getExpireDate(): \DateTime {
+        return $this->expireDate;
+    }
+
+    /**
+     * @return bool
+     */
+    public function isExpired(): bool {
+        $now = new \DateTime();
+        return $this->issueDate > $now or $now > $this->expireDate;
+    }
+
+    /**
+     * @return string|null
+     */
+    public function getIssuerName(): ?string {
+        return $this->issuerName;
+    }
+
+    /**
+     * @return string|null
+     */
+    public function getIssuerOrganization(): ?string {
+        return $this->issuerOrganization;
+    }
 }

lib/private/Security/TrustedDomainHelper.php

Indentation +65 added lines, -65 removed lines

@@ -39,75 +39,75 @@
  * @package OC\Security
  */
 class TrustedDomainHelper {
-	/** @var IConfig */
-	private $config;
+    /** @var IConfig */
+    private $config;
 
-	/**
-	 * @param IConfig $config
-	 */
-	public function __construct(IConfig $config) {
-		$this->config = $config;
-	}
+    /**
+     * @param IConfig $config
+     */
+    public function __construct(IConfig $config) {
+        $this->config = $config;
+    }
 
-	/**
-	 * Strips a potential port from a domain (in format domain:port)
-	 * @param string $host
-	 * @return string $host without appended port
-	 */
-	private function getDomainWithoutPort(string $host): string {
-		$pos = strrpos($host, ':');
-		if ($pos !== false) {
-			$port = substr($host, $pos + 1);
-			if (is_numeric($port)) {
-				$host = substr($host, 0, $pos);
-			}
-		}
-		return $host;
-	}
+    /**
+     * Strips a potential port from a domain (in format domain:port)
+     * @param string $host
+     * @return string $host without appended port
+     */
+    private function getDomainWithoutPort(string $host): string {
+        $pos = strrpos($host, ':');
+        if ($pos !== false) {
+            $port = substr($host, $pos + 1);
+            if (is_numeric($port)) {
+                $host = substr($host, 0, $pos);
+            }
+        }
+        return $host;
+    }
 
-	/**
-	 * Checks whether a domain is considered as trusted from the list
-	 * of trusted domains. If no trusted domains have been configured, returns
-	 * true.
-	 * This is used to prevent Host Header Poisoning.
-	 * @param string $domainWithPort
-	 * @return bool true if the given domain is trusted or if no trusted domains
-	 * have been configured
-	 */
-	public function isTrustedDomain(string $domainWithPort): bool {
-		// overwritehost is always trusted
-		if ($this->config->getSystemValue('overwritehost') !== '') {
-			return true;
-		}
+    /**
+     * Checks whether a domain is considered as trusted from the list
+     * of trusted domains. If no trusted domains have been configured, returns
+     * true.
+     * This is used to prevent Host Header Poisoning.
+     * @param string $domainWithPort
+     * @return bool true if the given domain is trusted or if no trusted domains
+     * have been configured
+     */
+    public function isTrustedDomain(string $domainWithPort): bool {
+        // overwritehost is always trusted
+        if ($this->config->getSystemValue('overwritehost') !== '') {
+            return true;
+        }
 
-		$domain = $this->getDomainWithoutPort($domainWithPort);
+        $domain = $this->getDomainWithoutPort($domainWithPort);
 
-		// Read trusted domains from config
-		$trustedList = $this->config->getSystemValue('trusted_domains', []);
-		if (!is_array($trustedList)) {
-			return false;
-		}
+        // Read trusted domains from config
+        $trustedList = $this->config->getSystemValue('trusted_domains', []);
+        if (!is_array($trustedList)) {
+            return false;
+        }
 
-		// Always allow access from localhost
-		if (preg_match(Request::REGEX_LOCALHOST, $domain) === 1) {
-			return true;
-		}
-		// Reject misformed domains in any case
-		if (strpos($domain,'-') === 0 || strpos($domain,'..') !== false) {
-			return false;
-		}
-		// Match, allowing for * wildcards
-		foreach ($trustedList as $trusted) {
-			if (gettype($trusted) !== 'string') {
-				break;
-			}
-			$regex = '/^' . implode('[-\.a-zA-Z0-9]*', array_map(function ($v) {
-				return preg_quote($v, '/');
-			}, explode('*', $trusted))) . '$/i';
-			if (preg_match($regex, $domain) || preg_match($regex, $domainWithPort)) {
-				return true;
-			}
-		}
-		return false;
-	}
+        // Always allow access from localhost
+        if (preg_match(Request::REGEX_LOCALHOST, $domain) === 1) {
+            return true;
+        }
+        // Reject misformed domains in any case
+        if (strpos($domain,'-') === 0 || strpos($domain,'..') !== false) {
+            return false;
+        }
+        // Match, allowing for * wildcards
+        foreach ($trustedList as $trusted) {
+            if (gettype($trusted) !== 'string') {
+                break;
+            }
+            $regex = '/^' . implode('[-\.a-zA-Z0-9]*', array_map(function ($v) {
+                return preg_quote($v, '/');
+            }, explode('*', $trusted))) . '$/i';
+            if (preg_match($regex, $domain) || preg_match($regex, $domainWithPort)) {
+                return true;
+            }
+        }
+        return false;
+    }
 }