nextcloud / server

lib/private/AppFramework/Middleware/Security/CORSMiddleware.php

Indentation +102 added lines, -102 removed lines

@@ -45,116 +45,116 @@
  * https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS
  */
 class CORSMiddleware extends Middleware {
-	/** @var IRequest  */
-	private $request;
-	/** @var ControllerMethodReflector */
-	private $reflector;
-	/** @var Session */
-	private $session;
-	/** @var Throttler */
-	private $throttler;
+    /** @var IRequest  */
+    private $request;
+    /** @var ControllerMethodReflector */
+    private $reflector;
+    /** @var Session */
+    private $session;
+    /** @var Throttler */
+    private $throttler;
 
-	/**
-	 * @param IRequest $request
-	 * @param ControllerMethodReflector $reflector
-	 * @param Session $session
-	 * @param Throttler $throttler
-	 */
-	public function __construct(IRequest $request,
-								ControllerMethodReflector $reflector,
-								Session $session,
-								Throttler $throttler) {
-		$this->request = $request;
-		$this->reflector = $reflector;
-		$this->session = $session;
-		$this->throttler = $throttler;
-	}
+    /**
+     * @param IRequest $request
+     * @param ControllerMethodReflector $reflector
+     * @param Session $session
+     * @param Throttler $throttler
+     */
+    public function __construct(IRequest $request,
+                                ControllerMethodReflector $reflector,
+                                Session $session,
+                                Throttler $throttler) {
+        $this->request = $request;
+        $this->reflector = $reflector;
+        $this->session = $session;
+        $this->throttler = $throttler;
+    }
 
-	/**
-	 * This is being run in normal order before the controller is being
-	 * called which allows several modifications and checks
-	 *
-	 * @param Controller $controller the controller that is being called
-	 * @param string $methodName the name of the method that will be called on
-	 *                           the controller
-	 * @throws SecurityException
-	 * @since 6.0.0
-	 */
-	public function beforeController($controller, $methodName){
-		// ensure that @CORS annotated API routes are not used in conjunction
-		// with session authentication since this enables CSRF attack vectors
-		if ($this->reflector->hasAnnotation('CORS') &&
-			!$this->reflector->hasAnnotation('PublicPage'))  {
-			$user = $this->request->server['PHP_AUTH_USER'];
-			$pass = $this->request->server['PHP_AUTH_PW'];
+    /**
+     * This is being run in normal order before the controller is being
+     * called which allows several modifications and checks
+     *
+     * @param Controller $controller the controller that is being called
+     * @param string $methodName the name of the method that will be called on
+     *                           the controller
+     * @throws SecurityException
+     * @since 6.0.0
+     */
+    public function beforeController($controller, $methodName){
+        // ensure that @CORS annotated API routes are not used in conjunction
+        // with session authentication since this enables CSRF attack vectors
+        if ($this->reflector->hasAnnotation('CORS') &&
+            !$this->reflector->hasAnnotation('PublicPage'))  {
+            $user = $this->request->server['PHP_AUTH_USER'];
+            $pass = $this->request->server['PHP_AUTH_PW'];
 
-			$this->session->logout();
-			try {
-				if (!$this->session->logClientIn($user, $pass, $this->request, $this->throttler)) {
-					throw new SecurityException('CORS requires basic auth', Http::STATUS_UNAUTHORIZED);
-				}
-			} catch (PasswordLoginForbiddenException $ex) {
-				throw new SecurityException('Password login forbidden, use token instead', Http::STATUS_UNAUTHORIZED);
-			}
-		}
-	}
+            $this->session->logout();
+            try {
+                if (!$this->session->logClientIn($user, $pass, $this->request, $this->throttler)) {
+                    throw new SecurityException('CORS requires basic auth', Http::STATUS_UNAUTHORIZED);
+                }
+            } catch (PasswordLoginForbiddenException $ex) {
+                throw new SecurityException('Password login forbidden, use token instead', Http::STATUS_UNAUTHORIZED);
+            }
+        }
+    }
 
-	/**
-	 * This is being run after a successful controllermethod call and allows
-	 * the manipulation of a Response object. The middleware is run in reverse order
-	 *
-	 * @param Controller $controller the controller that is being called
-	 * @param string $methodName the name of the method that will be called on
-	 *                           the controller
-	 * @param Response $response the generated response from the controller
-	 * @return Response a Response object
-	 * @throws SecurityException
-	 */
-	public function afterController($controller, $methodName, Response $response){
-		// only react if its a CORS request and if the request sends origin and
+    /**
+     * This is being run after a successful controllermethod call and allows
+     * the manipulation of a Response object. The middleware is run in reverse order
+     *
+     * @param Controller $controller the controller that is being called
+     * @param string $methodName the name of the method that will be called on
+     *                           the controller
+     * @param Response $response the generated response from the controller
+     * @return Response a Response object
+     * @throws SecurityException
+     */
+    public function afterController($controller, $methodName, Response $response){
+        // only react if its a CORS request and if the request sends origin and
 
-		if(isset($this->request->server['HTTP_ORIGIN']) &&
-			$this->reflector->hasAnnotation('CORS')) {
+        if(isset($this->request->server['HTTP_ORIGIN']) &&
+            $this->reflector->hasAnnotation('CORS')) {
 
-			// allow credentials headers must not be true or CSRF is possible
-			// otherwise
-			foreach($response->getHeaders() as $header => $value) {
-				if(strtolower($header) === 'access-control-allow-credentials' &&
-				   strtolower(trim($value)) === 'true') {
-					$msg = 'Access-Control-Allow-Credentials must not be '.
-						   'set to true in order to prevent CSRF';
-					throw new SecurityException($msg);
-				}
-			}
+            // allow credentials headers must not be true or CSRF is possible
+            // otherwise
+            foreach($response->getHeaders() as $header => $value) {
+                if(strtolower($header) === 'access-control-allow-credentials' &&
+                   strtolower(trim($value)) === 'true') {
+                    $msg = 'Access-Control-Allow-Credentials must not be '.
+                            'set to true in order to prevent CSRF';
+                    throw new SecurityException($msg);
+                }
+            }
 
-			$origin = $this->request->server['HTTP_ORIGIN'];
-			$response->addHeader('Access-Control-Allow-Origin', $origin);
-		}
-		return $response;
-	}
+            $origin = $this->request->server['HTTP_ORIGIN'];
+            $response->addHeader('Access-Control-Allow-Origin', $origin);
+        }
+        return $response;
+    }
 
-	/**
-	 * If an SecurityException is being caught return a JSON error response
-	 *
-	 * @param Controller $controller the controller that is being called
-	 * @param string $methodName the name of the method that will be called on
-	 *                           the controller
-	 * @param \Exception $exception the thrown exception
-	 * @throws \Exception the passed in exception if it can't handle it
-	 * @return Response a Response object or null in case that the exception could not be handled
-	 */
-	public function afterException($controller, $methodName, \Exception $exception){
-		if($exception instanceof SecurityException){
-			$response =  new JSONResponse(['message' => $exception->getMessage()]);
-			if($exception->getCode() !== 0) {
-				$response->setStatus($exception->getCode());
-			} else {
-				$response->setStatus(Http::STATUS_INTERNAL_SERVER_ERROR);
-			}
-			return $response;
-		}
+    /**
+     * If an SecurityException is being caught return a JSON error response
+     *
+     * @param Controller $controller the controller that is being called
+     * @param string $methodName the name of the method that will be called on
+     *                           the controller
+     * @param \Exception $exception the thrown exception
+     * @throws \Exception the passed in exception if it can't handle it
+     * @return Response a Response object or null in case that the exception could not be handled
+     */
+    public function afterException($controller, $methodName, \Exception $exception){
+        if($exception instanceof SecurityException){
+            $response =  new JSONResponse(['message' => $exception->getMessage()]);
+            if($exception->getCode() !== 0) {
+                $response->setStatus($exception->getCode());
+            } else {
+                $response->setStatus(Http::STATUS_INTERNAL_SERVER_ERROR);
+            }
+            return $response;
+        }
 
-		throw $exception;
-	}
+        throw $exception;
+    }
 
 }

Spacing +10 added lines, -10 removed lines

@@ -80,11 +80,11 @@ 
 	 * @throws SecurityException
 	 * @since 6.0.0
 	 */
-	public function beforeController($controller, $methodName){
+	public function beforeController($controller, $methodName) {
 		// ensure that @CORS annotated API routes are not used in conjunction
 		// with session authentication since this enables CSRF attack vectors
 		if ($this->reflector->hasAnnotation('CORS') &&
-			!$this->reflector->hasAnnotation('PublicPage'))  {
+			!$this->reflector->hasAnnotation('PublicPage')) {
 			$user = $this->request->server['PHP_AUTH_USER'];
 			$pass = $this->request->server['PHP_AUTH_PW'];
 
@@ -110,16 +110,16 @@ 
 	 * @return Response a Response object
 	 * @throws SecurityException
 	 */
-	public function afterController($controller, $methodName, Response $response){
+	public function afterController($controller, $methodName, Response $response) {
 		// only react if its a CORS request and if the request sends origin and
 
-		if(isset($this->request->server['HTTP_ORIGIN']) &&
+		if (isset($this->request->server['HTTP_ORIGIN']) &&
 			$this->reflector->hasAnnotation('CORS')) {
 
 			// allow credentials headers must not be true or CSRF is possible
 			// otherwise
-			foreach($response->getHeaders() as $header => $value) {
-				if(strtolower($header) === 'access-control-allow-credentials' &&
+			foreach ($response->getHeaders() as $header => $value) {
+				if (strtolower($header) === 'access-control-allow-credentials' &&
 				   strtolower(trim($value)) === 'true') {
 					$msg = 'Access-Control-Allow-Credentials must not be '.
 						   'set to true in order to prevent CSRF';
@@ -143,10 +143,10 @@ 
 	 * @throws \Exception the passed in exception if it can't handle it
 	 * @return Response a Response object or null in case that the exception could not be handled
 	 */
-	public function afterException($controller, $methodName, \Exception $exception){
-		if($exception instanceof SecurityException){
-			$response =  new JSONResponse(['message' => $exception->getMessage()]);
-			if($exception->getCode() !== 0) {
+	public function afterException($controller, $methodName, \Exception $exception) {
+		if ($exception instanceof SecurityException) {
+			$response = new JSONResponse(['message' => $exception->getMessage()]);
+			if ($exception->getCode() !== 0) {
 				$response->setStatus($exception->getCode());
 			} else {
 				$response->setStatus(Http::STATUS_INTERNAL_SERVER_ERROR);

lib/private/AppFramework/Middleware/Security/Exceptions/NotConfirmedException.php

Indentation +3 added lines, -3 removed lines

@@ -31,7 +31,7 @@
  * @package OC\AppFramework\Middleware\Security\Exceptions
  */
 class NotConfirmedException extends SecurityException {
-	public function __construct() {
-		parent::__construct('Password confirmation is required', Http::STATUS_FORBIDDEN);
-	}
+    public function __construct() {
+        parent::__construct('Password confirmation is required', Http::STATUS_FORBIDDEN);
+    }
 }

lib/private/AppFramework/Middleware/Security/Exceptions/CrossSiteRequestForgeryException.php

Indentation +3 added lines, -3 removed lines

@@ -34,7 +34,7 @@
  * @package OC\AppFramework\Middleware\Security\Exceptions
  */
 class CrossSiteRequestForgeryException extends SecurityException {
-	public function __construct() {
-		parent::__construct('CSRF check failed', Http::STATUS_PRECONDITION_FAILED);
-	}
+    public function __construct() {
+        parent::__construct('CSRF check failed', Http::STATUS_PRECONDITION_FAILED);
+    }
 }

lib/private/AppFramework/Middleware/Security/Exceptions/AppNotEnabledException.php

Indentation +3 added lines, -3 removed lines

@@ -34,7 +34,7 @@
  * @package OC\AppFramework\Middleware\Security\Exceptions
  */
 class AppNotEnabledException extends SecurityException {
-	public function __construct() {
-		parent::__construct('App is not enabled', Http::STATUS_PRECONDITION_FAILED);
-	}
+    public function __construct() {
+        parent::__construct('App is not enabled', Http::STATUS_PRECONDITION_FAILED);
+    }
 }

lib/private/AppFramework/Middleware/Security/Exceptions/NotLoggedInException.php

Indentation +3 added lines, -3 removed lines

@@ -34,7 +34,7 @@
  * @package OC\AppFramework\Middleware\Security\Exceptions
  */
 class NotLoggedInException extends SecurityException {
-	public function __construct() {
-		parent::__construct('Current user is not logged in', Http::STATUS_UNAUTHORIZED);
-	}
+    public function __construct() {
+        parent::__construct('Current user is not logged in', Http::STATUS_UNAUTHORIZED);
+    }
 }

lib/private/AppFramework/Middleware/OCSMiddleware.php

Spacing +1 added lines, -1 removed lines

@@ -143,7 +143,7 @@
 		$format = $this->request->getParam('format');
 
 		// if none is given try the first Accept header
-		if($format === null) {
+		if ($format === null) {
 			$headers = $this->request->getHeader('Accept');
 			$format = $controller->getResponderByHTTPHeader($headers, 'xml');
 		}

Indentation +109 added lines, -109 removed lines

@@ -39,116 +39,116 @@
 
 class OCSMiddleware extends Middleware {
 
-	/** @var IRequest */
-	private $request;
-
-	/** @var int */
-	private $ocsVersion;
-
-	/**
-	 * @param IRequest $request
-	 */
-	public function __construct(IRequest $request) {
-		$this->request = $request;
-	}
-
-	/**
-	 * @param Controller $controller
-	 * @param string $methodName
-	 */
-	public function beforeController($controller, $methodName) {
-		if ($controller instanceof OCSController) {
-			if (substr_compare($this->request->getScriptName(), '/ocs/v2.php', -strlen('/ocs/v2.php')) === 0) {
-				$this->ocsVersion = 2;
-			} else {
-				$this->ocsVersion = 1;
-			}
-			$controller->setOCSVersion($this->ocsVersion);
-		}
-	}
-
-	/**
-	 * @param Controller $controller
-	 * @param string $methodName
-	 * @param \Exception $exception
-	 * @throws \Exception
-	 * @return BaseResponse
-	 */
-	public function afterException($controller, $methodName, \Exception $exception) {
-		if ($controller instanceof OCSController && $exception instanceof OCSException) {
-			$code = $exception->getCode();
-			if ($code === 0) {
-				$code = API::RESPOND_UNKNOWN_ERROR;
-			}
-
-			return $this->buildNewResponse($controller, $code, $exception->getMessage());
-		}
-
-		throw $exception;
-	}
-
-	/**
-	 * @param Controller $controller
-	 * @param string $methodName
-	 * @param Response $response
-	 * @return \OCP\AppFramework\Http\Response
-	 */
-	public function afterController($controller, $methodName, Response $response) {
-		/*
+    /** @var IRequest */
+    private $request;
+
+    /** @var int */
+    private $ocsVersion;
+
+    /**
+     * @param IRequest $request
+     */
+    public function __construct(IRequest $request) {
+        $this->request = $request;
+    }
+
+    /**
+     * @param Controller $controller
+     * @param string $methodName
+     */
+    public function beforeController($controller, $methodName) {
+        if ($controller instanceof OCSController) {
+            if (substr_compare($this->request->getScriptName(), '/ocs/v2.php', -strlen('/ocs/v2.php')) === 0) {
+                $this->ocsVersion = 2;
+            } else {
+                $this->ocsVersion = 1;
+            }
+            $controller->setOCSVersion($this->ocsVersion);
+        }
+    }
+
+    /**
+     * @param Controller $controller
+     * @param string $methodName
+     * @param \Exception $exception
+     * @throws \Exception
+     * @return BaseResponse
+     */
+    public function afterException($controller, $methodName, \Exception $exception) {
+        if ($controller instanceof OCSController && $exception instanceof OCSException) {
+            $code = $exception->getCode();
+            if ($code === 0) {
+                $code = API::RESPOND_UNKNOWN_ERROR;
+            }
+
+            return $this->buildNewResponse($controller, $code, $exception->getMessage());
+        }
+
+        throw $exception;
+    }
+
+    /**
+     * @param Controller $controller
+     * @param string $methodName
+     * @param Response $response
+     * @return \OCP\AppFramework\Http\Response
+     */
+    public function afterController($controller, $methodName, Response $response) {
+        /*
 		 * If a different middleware has detected that a request unauthorized or forbidden
 		 * we need to catch the response and convert it to a proper OCS response.
 		 */
-		if ($controller instanceof OCSController && !($response instanceof BaseResponse)) {
-			if ($response->getStatus() === Http::STATUS_UNAUTHORIZED ||
-			    $response->getStatus() === Http::STATUS_FORBIDDEN) {
-
-				$message = '';
-				if ($response instanceof JSONResponse) {
-					/** @var DataResponse $response */
-					$message = $response->getData()['message'];
-				}
-
-				return $this->buildNewResponse($controller, API::RESPOND_UNAUTHORISED, $message);
-			}
-		}
-
-		return $response;
-	}
-
-	/**
-	 * @param Controller $controller
-	 * @param int $code
-	 * @param string $message
-	 * @return V1Response|V2Response
-	 */
-	private function buildNewResponse(Controller $controller, $code, $message) {
-		$format = $this->getFormat($controller);
-
-		$data = new DataResponse();
-		$data->setStatus($code);
-		if ($this->ocsVersion === 1) {
-			$response = new V1Response($data, $format, $message);
-		} else {
-			$response = new V2Response($data, $format, $message);
-		}
-
-		return $response;
-	}
-
-	/**
-	 * @param Controller $controller
-	 * @return string
-	 */
-	private function getFormat(Controller $controller) {
-		// get format from the url format or request format parameter
-		$format = $this->request->getParam('format');
-
-		// if none is given try the first Accept header
-		if($format === null) {
-			$headers = $this->request->getHeader('Accept');
-			$format = $controller->getResponderByHTTPHeader($headers, 'xml');
-		}
-
-		return $format;
-	}
+        if ($controller instanceof OCSController && !($response instanceof BaseResponse)) {
+            if ($response->getStatus() === Http::STATUS_UNAUTHORIZED ||
+                $response->getStatus() === Http::STATUS_FORBIDDEN) {
+
+                $message = '';
+                if ($response instanceof JSONResponse) {
+                    /** @var DataResponse $response */
+                    $message = $response->getData()['message'];
+                }
+
+                return $this->buildNewResponse($controller, API::RESPOND_UNAUTHORISED, $message);
+            }
+        }
+
+        return $response;
+    }
+
+    /**
+     * @param Controller $controller
+     * @param int $code
+     * @param string $message
+     * @return V1Response|V2Response
+     */
+    private function buildNewResponse(Controller $controller, $code, $message) {
+        $format = $this->getFormat($controller);
+
+        $data = new DataResponse();
+        $data->setStatus($code);
+        if ($this->ocsVersion === 1) {
+            $response = new V1Response($data, $format, $message);
+        } else {
+            $response = new V2Response($data, $format, $message);
+        }
+
+        return $response;
+    }
+
+    /**
+     * @param Controller $controller
+     * @return string
+     */
+    private function getFormat(Controller $controller) {
+        // get format from the url format or request format parameter
+        $format = $this->request->getParam('format');
+
+        // if none is given try the first Accept header
+        if($format === null) {
+            $headers = $this->request->getHeader('Accept');
+            $format = $controller->getResponderByHTTPHeader($headers, 'xml');
+        }
+
+        return $format;
+    }
 }

lib/private/AppFramework/Middleware/SessionMiddleware.php

Spacing +1 added lines, -1 removed lines

@@ -71,7 +71,7 @@
 	 * @param Response $response
 	 * @return Response
 	 */
-	public function afterController($controller, $methodName, Response $response){
+	public function afterController($controller, $methodName, Response $response) {
 		$useSession = $this->reflector->hasAnnotation('UseSession');
 		if ($useSession) {
 			$this->session->close();

Indentation +32 added lines, -32 removed lines

@@ -34,41 +34,41 @@
 
 class SessionMiddleware extends Middleware {
 
-	/** @var ControllerMethodReflector */
-	private $reflector;
+    /** @var ControllerMethodReflector */
+    private $reflector;
 
-	/** @var ISession */
-	private $session;
+    /** @var ISession */
+    private $session;
 
-	public function __construct(ControllerMethodReflector $reflector,
-								ISession $session) {
-		$this->reflector = $reflector;
-		$this->session = $session;
-	}
+    public function __construct(ControllerMethodReflector $reflector,
+                                ISession $session) {
+        $this->reflector = $reflector;
+        $this->session = $session;
+    }
 
-	/**
-	 * @param Controller $controller
-	 * @param string $methodName
-	 */
-	public function beforeController($controller, $methodName) {
-		$useSession = $this->reflector->hasAnnotation('UseSession');
-		if (!$useSession) {
-			$this->session->close();
-		}
-	}
+    /**
+     * @param Controller $controller
+     * @param string $methodName
+     */
+    public function beforeController($controller, $methodName) {
+        $useSession = $this->reflector->hasAnnotation('UseSession');
+        if (!$useSession) {
+            $this->session->close();
+        }
+    }
 
-	/**
-	 * @param Controller $controller
-	 * @param string $methodName
-	 * @param Response $response
-	 * @return Response
-	 */
-	public function afterController($controller, $methodName, Response $response){
-		$useSession = $this->reflector->hasAnnotation('UseSession');
-		if ($useSession) {
-			$this->session->close();
-		}
-		return $response;
-	}
+    /**
+     * @param Controller $controller
+     * @param string $methodName
+     * @param Response $response
+     * @return Response
+     */
+    public function afterController($controller, $methodName, Response $response){
+        $useSession = $this->reflector->hasAnnotation('UseSession');
+        if ($useSession) {
+            $this->session->close();
+        }
+        return $response;
+    }
 
 }

lib/private/AppFramework/OCS/BaseResponse.php

Spacing +1 added lines, -1 removed lines

@@ -26,7 +26,7 @@
 use OCP\AppFramework\Http\EmptyContentSecurityPolicy;
 use OCP\AppFramework\Http\Response;
 
-abstract class BaseResponse extends Response   {
+abstract class BaseResponse extends Response {
 	/** @var array */
 	protected $data;
 

Indentation +118 added lines, -118 removed lines

@@ -28,122 +28,122 @@
 use OCP\AppFramework\Http\Response;
 
 abstract class BaseResponse extends Response   {
-	/** @var array */
-	protected $data;
-
-	/** @var string */
-	protected $format;
-
-	/** @var string */
-	protected $statusMessage;
-
-	/** @var int */
-	protected $itemsCount;
-
-	/** @var int */
-	protected $itemsPerPage;
-
-	/**
-	 * BaseResponse constructor.
-	 *
-	 * @param DataResponse|null $dataResponse
-	 * @param string $format
-	 * @param string|null $statusMessage
-	 * @param int|null $itemsCount
-	 * @param int|null $itemsPerPage
-	 */
-	public function __construct(DataResponse $dataResponse,
-								$format = 'xml',
-								$statusMessage = null,
-								$itemsCount = null,
-								$itemsPerPage = null) {
-		parent::__construct();
-
-		$this->format = $format;
-		$this->statusMessage = $statusMessage;
-		$this->itemsCount = $itemsCount;
-		$this->itemsPerPage = $itemsPerPage;
-
-		$this->data = $dataResponse->getData();
-
-		$this->setHeaders($dataResponse->getHeaders());
-		$this->setStatus($dataResponse->getStatus());
-		$this->setETag($dataResponse->getETag());
-		$this->setLastModified($dataResponse->getLastModified());
-		$this->setCookies($dataResponse->getCookies());
-
-		if ($format === 'json') {
-			$this->addHeader(
-				'Content-Type', 'application/json; charset=utf-8'
-			);
-		} else {
-			$this->addHeader(
-				'Content-Type', 'application/xml; charset=utf-8'
-			);
-		}
-	}
-
-	/**
-	 * @param string[] $meta
-	 * @return string
-	 */
-	protected function renderResult(array $meta): string {
-		$status = $this->getStatus();
-		if ($status === Http::STATUS_NO_CONTENT ||
-			$status === Http::STATUS_NOT_MODIFIED ||
-			($status >= 100 && $status <= 199)) {
-			// Those status codes are not supposed to have a body:
-			// https://stackoverflow.com/q/8628725
-			return '';
-		}
-
-		$response = [
-			'ocs' => [
-				'meta' => $meta,
-				'data' => $this->data,
-			],
-		];
-
-		if ($this->format === 'json') {
-			return json_encode($response, JSON_HEX_TAG);
-		}
-
-		$writer = new \XMLWriter();
-		$writer->openMemory();
-		$writer->setIndent(true);
-		$writer->startDocument();
-		$this->toXML($response, $writer);
-		$writer->endDocument();
-		return $writer->outputMemory(true);
-
-	}
-
-	/**
-	 * @param array $array
-	 * @param \XMLWriter $writer
-	 */
-	protected function toXML(array $array, \XMLWriter $writer) {
-		foreach ($array as $k => $v) {
-			if ($k[0] === '@') {
-				$writer->writeAttribute(substr($k, 1), $v);
-				continue;
-			}
-
-			if (\is_numeric($k)) {
-				$k = 'element';
-			}
-
-			if (\is_array($v)) {
-				$writer->startElement($k);
-				$this->toXML($v, $writer);
-				$writer->endElement();
-			} else {
-				$writer->writeElement($k, $v);
-			}
-		}
-	}
-
-	public function getOCSStatus() {
-		return parent::getStatus();
-	}
+    /** @var array */
+    protected $data;
+
+    /** @var string */
+    protected $format;
+
+    /** @var string */
+    protected $statusMessage;
+
+    /** @var int */
+    protected $itemsCount;
+
+    /** @var int */
+    protected $itemsPerPage;
+
+    /**
+     * BaseResponse constructor.
+     *
+     * @param DataResponse|null $dataResponse
+     * @param string $format
+     * @param string|null $statusMessage
+     * @param int|null $itemsCount
+     * @param int|null $itemsPerPage
+     */
+    public function __construct(DataResponse $dataResponse,
+                                $format = 'xml',
+                                $statusMessage = null,
+                                $itemsCount = null,
+                                $itemsPerPage = null) {
+        parent::__construct();
+
+        $this->format = $format;
+        $this->statusMessage = $statusMessage;
+        $this->itemsCount = $itemsCount;
+        $this->itemsPerPage = $itemsPerPage;
+
+        $this->data = $dataResponse->getData();
+
+        $this->setHeaders($dataResponse->getHeaders());
+        $this->setStatus($dataResponse->getStatus());
+        $this->setETag($dataResponse->getETag());
+        $this->setLastModified($dataResponse->getLastModified());
+        $this->setCookies($dataResponse->getCookies());
+
+        if ($format === 'json') {
+            $this->addHeader(
+                'Content-Type', 'application/json; charset=utf-8'
+            );
+        } else {
+            $this->addHeader(
+                'Content-Type', 'application/xml; charset=utf-8'
+            );
+        }
+    }
+
+    /**
+     * @param string[] $meta
+     * @return string
+     */
+    protected function renderResult(array $meta): string {
+        $status = $this->getStatus();
+        if ($status === Http::STATUS_NO_CONTENT ||
+            $status === Http::STATUS_NOT_MODIFIED ||
+            ($status >= 100 && $status <= 199)) {
+            // Those status codes are not supposed to have a body:
+            // https://stackoverflow.com/q/8628725
+            return '';
+        }
+
+        $response = [
+            'ocs' => [
+                'meta' => $meta,
+                'data' => $this->data,
+            ],
+        ];
+
+        if ($this->format === 'json') {
+            return json_encode($response, JSON_HEX_TAG);
+        }
+
+        $writer = new \XMLWriter();
+        $writer->openMemory();
+        $writer->setIndent(true);
+        $writer->startDocument();
+        $this->toXML($response, $writer);
+        $writer->endDocument();
+        return $writer->outputMemory(true);
+
+    }
+
+    /**
+     * @param array $array
+     * @param \XMLWriter $writer
+     */
+    protected function toXML(array $array, \XMLWriter $writer) {
+        foreach ($array as $k => $v) {
+            if ($k[0] === '@') {
+                $writer->writeAttribute(substr($k, 1), $v);
+                continue;
+            }
+
+            if (\is_numeric($k)) {
+                $k = 'element';
+            }
+
+            if (\is_array($v)) {
+                $writer->startElement($k);
+                $this->toXML($v, $writer);
+                $writer->endElement();
+            } else {
+                $writer->writeElement($k, $v);
+            }
+        }
+    }
+
+    public function getOCSStatus() {
+        return parent::getStatus();
+    }
 }

lib/private/AppFramework/OCS/V2Response.php

Indentation +40 added lines, -40 removed lines

@@ -27,50 +27,50 @@
 
 class V2Response extends BaseResponse {
 
-	/**
-	 * The V2 endpoint just passes on status codes.
-	 * Of course we have to map the OCS specific codes to proper HTTP status codes
-	 *
-	 * @return int
-	 */
-	public function getStatus() {
+    /**
+     * The V2 endpoint just passes on status codes.
+     * Of course we have to map the OCS specific codes to proper HTTP status codes
+     *
+     * @return int
+     */
+    public function getStatus() {
 
-		$status  = parent::getStatus();
-		if ($status === API::RESPOND_UNAUTHORISED) {
-			return Http::STATUS_UNAUTHORIZED;
-		} else if ($status === API::RESPOND_NOT_FOUND) {
-			return Http::STATUS_NOT_FOUND;
-		} else if ($status === API::RESPOND_SERVER_ERROR || $status === API::RESPOND_UNKNOWN_ERROR) {
-			return Http::STATUS_INTERNAL_SERVER_ERROR;
-		} else if ($status < 200 || $status > 600) {
-			return Http::STATUS_BAD_REQUEST;
-		}
+        $status  = parent::getStatus();
+        if ($status === API::RESPOND_UNAUTHORISED) {
+            return Http::STATUS_UNAUTHORIZED;
+        } else if ($status === API::RESPOND_NOT_FOUND) {
+            return Http::STATUS_NOT_FOUND;
+        } else if ($status === API::RESPOND_SERVER_ERROR || $status === API::RESPOND_UNKNOWN_ERROR) {
+            return Http::STATUS_INTERNAL_SERVER_ERROR;
+        } else if ($status < 200 || $status > 600) {
+            return Http::STATUS_BAD_REQUEST;
+        }
 
-		return $status;
-	}
+        return $status;
+    }
 
-	/**
-	 * Construct the meta part of the response
-	 * And then late the base class render
-	 *
-	 * @return string
-	 */
-	public function render() {
-		$status = parent::getStatus();
+    /**
+     * Construct the meta part of the response
+     * And then late the base class render
+     *
+     * @return string
+     */
+    public function render() {
+        $status = parent::getStatus();
 
-		$meta = [
-			'status' => $status >= 200 && $status < 300 ? 'ok' : 'failure',
-			'statuscode' => $this->getOCSStatus(),
-			'message' => $status >= 200 && $status < 300 ? 'OK' : $this->statusMessage,
-		];
+        $meta = [
+            'status' => $status >= 200 && $status < 300 ? 'ok' : 'failure',
+            'statuscode' => $this->getOCSStatus(),
+            'message' => $status >= 200 && $status < 300 ? 'OK' : $this->statusMessage,
+        ];
 
-		if ($this->itemsCount !== null) {
-			$meta['totalitems'] = $this->itemsCount;
-		}
-		if ($this->itemsPerPage !== null) {
-			$meta['itemsperpage'] = $this->itemsPerPage;
-		}
+        if ($this->itemsCount !== null) {
+            $meta['totalitems'] = $this->itemsCount;
+        }
+        if ($this->itemsPerPage !== null) {
+            $meta['itemsperpage'] = $this->itemsPerPage;
+        }
 
-		return $this->renderResult($meta);
-	}
+        return $this->renderResult($meta);
+    }
 }

Spacing +1 added lines, -1 removed lines

@@ -35,7 +35,7 @@
 	 */
 	public function getStatus() {
 
-		$status  = parent::getStatus();
+		$status = parent::getStatus();
 		if ($status === API::RESPOND_UNAUTHORISED) {
 			return Http::STATUS_UNAUTHORIZED;
 		} else if ($status === API::RESPOND_NOT_FOUND) {