nextcloud / server

lib/public/AppFramework/OCSController.php

Indentation +68 added lines, -68 removed lines

@@ -36,77 +36,77 @@
  * @since 8.1.0
  */
 abstract class OCSController extends ApiController {
-	public const RESPOND_UNAUTHORISED = 997;
-	public const RESPOND_SERVER_ERROR = 996;
-	public const RESPOND_NOT_FOUND = 998;
-	public const RESPOND_UNKNOWN_ERROR = 999;
+    public const RESPOND_UNAUTHORISED = 997;
+    public const RESPOND_SERVER_ERROR = 996;
+    public const RESPOND_NOT_FOUND = 998;
+    public const RESPOND_UNKNOWN_ERROR = 999;
 
-	/** @var int */
-	private $ocsVersion;
+    /** @var int */
+    private $ocsVersion;
 
-	/**
-	 * constructor of the controller
-	 * @param string $appName the name of the app
-	 * @param IRequest $request an instance of the request
-	 * @param string $corsMethods comma separated string of HTTP verbs which
-	 * should be allowed for websites or webapps when calling your API, defaults to
-	 * 'PUT, POST, GET, DELETE, PATCH'
-	 * @param string $corsAllowedHeaders comma separated string of HTTP headers
-	 * which should be allowed for websites or webapps when calling your API,
-	 * defaults to 'Authorization, Content-Type, Accept'
-	 * @param int $corsMaxAge number in seconds how long a preflighted OPTIONS
-	 * request should be cached, defaults to 1728000 seconds
-	 * @since 8.1.0
-	 */
-	public function __construct($appName,
-								IRequest $request,
-								$corsMethods = 'PUT, POST, GET, DELETE, PATCH',
-								$corsAllowedHeaders = 'Authorization, Content-Type, Accept, OCS-APIRequest',
-								$corsMaxAge = 1728000) {
-		parent::__construct($appName, $request, $corsMethods,
-							$corsAllowedHeaders, $corsMaxAge);
-		$this->registerResponder('json', function ($data) {
-			return $this->buildOCSResponse('json', $data);
-		});
-		$this->registerResponder('xml', function ($data) {
-			return $this->buildOCSResponse('xml', $data);
-		});
-	}
+    /**
+     * constructor of the controller
+     * @param string $appName the name of the app
+     * @param IRequest $request an instance of the request
+     * @param string $corsMethods comma separated string of HTTP verbs which
+     * should be allowed for websites or webapps when calling your API, defaults to
+     * 'PUT, POST, GET, DELETE, PATCH'
+     * @param string $corsAllowedHeaders comma separated string of HTTP headers
+     * which should be allowed for websites or webapps when calling your API,
+     * defaults to 'Authorization, Content-Type, Accept'
+     * @param int $corsMaxAge number in seconds how long a preflighted OPTIONS
+     * request should be cached, defaults to 1728000 seconds
+     * @since 8.1.0
+     */
+    public function __construct($appName,
+                                IRequest $request,
+                                $corsMethods = 'PUT, POST, GET, DELETE, PATCH',
+                                $corsAllowedHeaders = 'Authorization, Content-Type, Accept, OCS-APIRequest',
+                                $corsMaxAge = 1728000) {
+        parent::__construct($appName, $request, $corsMethods,
+                            $corsAllowedHeaders, $corsMaxAge);
+        $this->registerResponder('json', function ($data) {
+            return $this->buildOCSResponse('json', $data);
+        });
+        $this->registerResponder('xml', function ($data) {
+            return $this->buildOCSResponse('xml', $data);
+        });
+    }
 
-	/**
-	 * @param int $version
-	 * @since 11.0.0
-	 * @internal
-	 */
-	public function setOCSVersion($version) {
-		$this->ocsVersion = $version;
-	}
+    /**
+     * @param int $version
+     * @since 11.0.0
+     * @internal
+     */
+    public function setOCSVersion($version) {
+        $this->ocsVersion = $version;
+    }
 
-	/**
-	 * Since the OCS endpoints default to XML we need to find out the format
-	 * again
-	 * @param mixed $response the value that was returned from a controller and
-	 * is not a Response instance
-	 * @param string $format the format for which a formatter has been registered
-	 * @throws \DomainException if format does not match a registered formatter
-	 * @return Response
-	 * @since 9.1.0
-	 */
-	public function buildResponse($response, $format = 'xml') {
-		return parent::buildResponse($response, $format);
-	}
+    /**
+     * Since the OCS endpoints default to XML we need to find out the format
+     * again
+     * @param mixed $response the value that was returned from a controller and
+     * is not a Response instance
+     * @param string $format the format for which a formatter has been registered
+     * @throws \DomainException if format does not match a registered formatter
+     * @return Response
+     * @since 9.1.0
+     */
+    public function buildResponse($response, $format = 'xml') {
+        return parent::buildResponse($response, $format);
+    }
 
-	/**
-	 * Unwrap data and build ocs response
-	 * @param string $format json or xml
-	 * @param DataResponse $data the data which should be transformed
-	 * @since 8.1.0
-	 * @return \OC\AppFramework\OCS\BaseResponse
-	 */
-	private function buildOCSResponse($format, DataResponse $data) {
-		if ($this->ocsVersion === 1) {
-			return new \OC\AppFramework\OCS\V1Response($data, $format);
-		}
-		return new \OC\AppFramework\OCS\V2Response($data, $format);
-	}
+    /**
+     * Unwrap data and build ocs response
+     * @param string $format json or xml
+     * @param DataResponse $data the data which should be transformed
+     * @since 8.1.0
+     * @return \OC\AppFramework\OCS\BaseResponse
+     */
+    private function buildOCSResponse($format, DataResponse $data) {
+        if ($this->ocsVersion === 1) {
+            return new \OC\AppFramework\OCS\V1Response($data, $format);
+        }
+        return new \OC\AppFramework\OCS\V2Response($data, $format);
+    }
 }

lib/private/AppFramework/Middleware/Security/CORSMiddleware.php

Indentation +105 added lines, -105 removed lines

@@ -45,118 +45,118 @@
  * https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS
  */
 class CORSMiddleware extends Middleware {
-	/** @var IRequest  */
-	private $request;
-	/** @var ControllerMethodReflector */
-	private $reflector;
-	/** @var Session */
-	private $session;
-	/** @var Throttler */
-	private $throttler;
+    /** @var IRequest  */
+    private $request;
+    /** @var ControllerMethodReflector */
+    private $reflector;
+    /** @var Session */
+    private $session;
+    /** @var Throttler */
+    private $throttler;
 
-	/**
-	 * @param IRequest $request
-	 * @param ControllerMethodReflector $reflector
-	 * @param Session $session
-	 * @param Throttler $throttler
-	 */
-	public function __construct(IRequest $request,
-								ControllerMethodReflector $reflector,
-								Session $session,
-								Throttler $throttler) {
-		$this->request = $request;
-		$this->reflector = $reflector;
-		$this->session = $session;
-		$this->throttler = $throttler;
-	}
+    /**
+     * @param IRequest $request
+     * @param ControllerMethodReflector $reflector
+     * @param Session $session
+     * @param Throttler $throttler
+     */
+    public function __construct(IRequest $request,
+                                ControllerMethodReflector $reflector,
+                                Session $session,
+                                Throttler $throttler) {
+        $this->request = $request;
+        $this->reflector = $reflector;
+        $this->session = $session;
+        $this->throttler = $throttler;
+    }
 
-	/**
-	 * This is being run in normal order before the controller is being
-	 * called which allows several modifications and checks
-	 *
-	 * @param Controller $controller the controller that is being called
-	 * @param string $methodName the name of the method that will be called on
-	 *                           the controller
-	 * @throws SecurityException
-	 * @since 6.0.0
-	 */
-	public function beforeController($controller, $methodName) {
-		// ensure that @CORS annotated API routes are not used in conjunction
-		// with session authentication since this enables CSRF attack vectors
-		if ($this->reflector->hasAnnotation('CORS') && !$this->reflector->hasAnnotation('PublicPage')) {
-			$user = array_key_exists('PHP_AUTH_USER', $this->request->server) ? $this->request->server['PHP_AUTH_USER'] : null;
-			$pass = array_key_exists('PHP_AUTH_PW', $this->request->server) ? $this->request->server['PHP_AUTH_PW'] : null;
+    /**
+     * This is being run in normal order before the controller is being
+     * called which allows several modifications and checks
+     *
+     * @param Controller $controller the controller that is being called
+     * @param string $methodName the name of the method that will be called on
+     *                           the controller
+     * @throws SecurityException
+     * @since 6.0.0
+     */
+    public function beforeController($controller, $methodName) {
+        // ensure that @CORS annotated API routes are not used in conjunction
+        // with session authentication since this enables CSRF attack vectors
+        if ($this->reflector->hasAnnotation('CORS') && !$this->reflector->hasAnnotation('PublicPage')) {
+            $user = array_key_exists('PHP_AUTH_USER', $this->request->server) ? $this->request->server['PHP_AUTH_USER'] : null;
+            $pass = array_key_exists('PHP_AUTH_PW', $this->request->server) ? $this->request->server['PHP_AUTH_PW'] : null;
 
-			// Allow to use the current session if a CSRF token is provided
-			if ($this->request->passesCSRFCheck()) {
-				return;
-			}
-			$this->session->logout();
-			try {
-				if ($user === null || $pass === null || !$this->session->logClientIn($user, $pass, $this->request, $this->throttler)) {
-					throw new SecurityException('CORS requires basic auth', Http::STATUS_UNAUTHORIZED);
-				}
-			} catch (PasswordLoginForbiddenException $ex) {
-				throw new SecurityException('Password login forbidden, use token instead', Http::STATUS_UNAUTHORIZED);
-			}
-		}
-	}
+            // Allow to use the current session if a CSRF token is provided
+            if ($this->request->passesCSRFCheck()) {
+                return;
+            }
+            $this->session->logout();
+            try {
+                if ($user === null || $pass === null || !$this->session->logClientIn($user, $pass, $this->request, $this->throttler)) {
+                    throw new SecurityException('CORS requires basic auth', Http::STATUS_UNAUTHORIZED);
+                }
+            } catch (PasswordLoginForbiddenException $ex) {
+                throw new SecurityException('Password login forbidden, use token instead', Http::STATUS_UNAUTHORIZED);
+            }
+        }
+    }
 
-	/**
-	 * This is being run after a successful controllermethod call and allows
-	 * the manipulation of a Response object. The middleware is run in reverse order
-	 *
-	 * @param Controller $controller the controller that is being called
-	 * @param string $methodName the name of the method that will be called on
-	 *                           the controller
-	 * @param Response $response the generated response from the controller
-	 * @return Response a Response object
-	 * @throws SecurityException
-	 */
-	public function afterController($controller, $methodName, Response $response) {
-		// only react if its a CORS request and if the request sends origin and
+    /**
+     * This is being run after a successful controllermethod call and allows
+     * the manipulation of a Response object. The middleware is run in reverse order
+     *
+     * @param Controller $controller the controller that is being called
+     * @param string $methodName the name of the method that will be called on
+     *                           the controller
+     * @param Response $response the generated response from the controller
+     * @return Response a Response object
+     * @throws SecurityException
+     */
+    public function afterController($controller, $methodName, Response $response) {
+        // only react if its a CORS request and if the request sends origin and
 
-		if (isset($this->request->server['HTTP_ORIGIN']) &&
-			$this->reflector->hasAnnotation('CORS')) {
+        if (isset($this->request->server['HTTP_ORIGIN']) &&
+            $this->reflector->hasAnnotation('CORS')) {
 
-			// allow credentials headers must not be true or CSRF is possible
-			// otherwise
-			foreach ($response->getHeaders() as $header => $value) {
-				if (strtolower($header) === 'access-control-allow-credentials' &&
-				   strtolower(trim($value)) === 'true') {
-					$msg = 'Access-Control-Allow-Credentials must not be '.
-						   'set to true in order to prevent CSRF';
-					throw new SecurityException($msg);
-				}
-			}
+            // allow credentials headers must not be true or CSRF is possible
+            // otherwise
+            foreach ($response->getHeaders() as $header => $value) {
+                if (strtolower($header) === 'access-control-allow-credentials' &&
+                   strtolower(trim($value)) === 'true') {
+                    $msg = 'Access-Control-Allow-Credentials must not be '.
+                            'set to true in order to prevent CSRF';
+                    throw new SecurityException($msg);
+                }
+            }
 
-			$origin = $this->request->server['HTTP_ORIGIN'];
-			$response->addHeader('Access-Control-Allow-Origin', $origin);
-		}
-		return $response;
-	}
+            $origin = $this->request->server['HTTP_ORIGIN'];
+            $response->addHeader('Access-Control-Allow-Origin', $origin);
+        }
+        return $response;
+    }
 
-	/**
-	 * If an SecurityException is being caught return a JSON error response
-	 *
-	 * @param Controller $controller the controller that is being called
-	 * @param string $methodName the name of the method that will be called on
-	 *                           the controller
-	 * @param \Exception $exception the thrown exception
-	 * @throws \Exception the passed in exception if it can't handle it
-	 * @return Response a Response object or null in case that the exception could not be handled
-	 */
-	public function afterException($controller, $methodName, \Exception $exception) {
-		if ($exception instanceof SecurityException) {
-			$response = new JSONResponse(['message' => $exception->getMessage()]);
-			if ($exception->getCode() !== 0) {
-				$response->setStatus($exception->getCode());
-			} else {
-				$response->setStatus(Http::STATUS_INTERNAL_SERVER_ERROR);
-			}
-			return $response;
-		}
+    /**
+     * If an SecurityException is being caught return a JSON error response
+     *
+     * @param Controller $controller the controller that is being called
+     * @param string $methodName the name of the method that will be called on
+     *                           the controller
+     * @param \Exception $exception the thrown exception
+     * @throws \Exception the passed in exception if it can't handle it
+     * @return Response a Response object or null in case that the exception could not be handled
+     */
+    public function afterException($controller, $methodName, \Exception $exception) {
+        if ($exception instanceof SecurityException) {
+            $response = new JSONResponse(['message' => $exception->getMessage()]);
+            if ($exception->getCode() !== 0) {
+                $response->setStatus($exception->getCode());
+            } else {
+                $response->setStatus(Http::STATUS_INTERNAL_SERVER_ERROR);
+            }
+            return $response;
+        }
 
-		throw $exception;
-	}
+        throw $exception;
+    }
 }