Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backport/owncloud/core/pull/30421 #30814

Merged
merged 3 commits into from
Mar 20, 2018
Merged

Backport/owncloud/core/pull/30421 #30814

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c128ce8
[stable10] No need to handle authentication that early aka in here at…
DeepDiver1975 Feb 8, 2018
57490b7
[stable10] Perform login in SecurityMiddleWare
DeepDiver1975 Feb 9, 2018
41ec0eb
[stable10] Handle login in old ajax endpoints which use OCP\JSON::che…
DeepDiver1975 Feb 26, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion lib/base.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -898,7 +898,6 @@ public static function handleRequest() {
} else {
// For guests: Load only filesystem and logging
OC_App::loadApps(['filesystem', 'logging']);
self::handleLogin($request);
Copy link
Member

@butonic butonic Apr 10, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this seems to breaks apache auth, double checking

}
}

Expand Down
2 changes: 1 addition & 1 deletion lib/private/AppFramework/DependencyInjection/DIContainer.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -353,8 +353,8 @@ public function __construct($appName, $urlParams = []){
$app->getServer()->getNavigationManager(),
$app->getServer()->getURLGenerator(),
$app->getServer()->getLogger(),
$app->getServer()->getUserSession(),
$c['AppName'],
$app->isLoggedIn(),
$app->isAdminUser(),
$app->getServer()->getContentSecurityPolicyManager()
);
Expand Down
24 changes: 17 additions & 7 deletions lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@
use OCP\IRequest;
use OCP\ILogger;
use OCP\AppFramework\Controller;
use OCP\IUserSession;
use OCP\Util;
use OC\AppFramework\Middleware\Security\Exceptions\SecurityException;

Expand All @@ -69,20 +70,20 @@ class SecurityMiddleware extends Middleware {
/** @var ILogger */
private $logger;
/** @var bool */
private $isLoggedIn;
/** @var bool */
private $isAdminUser;
/** @var ContentSecurityPolicyManager */
private $contentSecurityPolicyManager;
/** @var IUserSession */
private $session;

/**
* @param IRequest $request
* @param ControllerMethodReflector $reflector
* @param INavigationManager $navigationManager
* @param IURLGenerator $urlGenerator
* @param ILogger $logger
* @param IUserSession $session
* @param string $appName
* @param bool $isLoggedIn
* @param bool $isAdminUser
* @param ContentSecurityPolicyManager $contentSecurityPolicyManager
*/
Expand All @@ -91,8 +92,8 @@ public function __construct(IRequest $request,
INavigationManager $navigationManager,
IURLGenerator $urlGenerator,
ILogger $logger,
IUserSession $session,
$appName,
$isLoggedIn,
$isAdminUser,
ContentSecurityPolicyManager $contentSecurityPolicyManager) {
$this->navigationManager = $navigationManager;
Expand All @@ -101,7 +102,7 @@ public function __construct(IRequest $request,
$this->appName = $appName;
$this->urlGenerator = $urlGenerator;
$this->logger = $logger;
$this->isLoggedIn = $isLoggedIn;
$this->session = $session;
$this->isAdminUser = $isAdminUser;
$this->contentSecurityPolicyManager = $contentSecurityPolicyManager;
}
Expand All @@ -124,7 +125,7 @@ public function beforeController($controller, $methodName) {
// security checks
$isPublicPage = $this->reflector->hasAnnotation('PublicPage');
if(!$isPublicPage) {
if(!$this->isLoggedIn) {
if(!$this->isLoggedIn()) {
throw new NotLoggedInException();
}

Expand Down Expand Up @@ -165,7 +166,7 @@ public function beforeController($controller, $methodName) {
* @return Response
*/
public function afterController($controller, $methodName, Response $response) {
$policy = !is_null($response->getContentSecurityPolicy()) ? $response->getContentSecurityPolicy() : new ContentSecurityPolicy();
$policy = $response->getContentSecurityPolicy() !== null ? $response->getContentSecurityPolicy() : new ContentSecurityPolicy();

$defaultPolicy = $this->contentSecurityPolicyManager->getDefaultPolicy();
$defaultPolicy = $this->contentSecurityPolicyManager->mergePolicies($defaultPolicy, $policy);
Expand Down Expand Up @@ -229,4 +230,13 @@ public function afterException($controller, $methodName, \Exception $exception)
throw $exception;
}

private function isLoggedIn() {
static $loginCalled = false;
if (!$loginCalled && !$this->session->isLoggedIn()) {
\OC::handleLogin($this->request);
$loginCalled = true;
}
return $this->session->isLoggedIn();
}

}
3 changes: 2 additions & 1 deletion lib/private/AppFramework/Utility/ControllerMethodReflector.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,8 +46,9 @@ public function __construct() {


/**
* @param object $object an object or classname
* @param object|string $object an object or classname
* @param string $method the method which we want to inspect
* @throws \ReflectionException
*/
public function reflect($object, $method){
$reflection = new \ReflectionMethod($object, $method);
Expand Down
6 changes: 6 additions & 0 deletions lib/private/legacy/json.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,12 @@ public static function checkAppEnabled($app) {
* @deprecated Use annotation based ACLs from the AppFramework instead
*/
public static function checkLoggedIn() {
static $loginCalled = false;
if (!$loginCalled && !OC_User::isLoggedIn()) {
\OC::handleLogin(\OC::$server->getRequest());
$loginCalled = true;
}

$twoFactorAuthManger = \OC::$server->getTwoFactorAuthManager();
if( !OC_User::isLoggedIn()
|| $twoFactorAuthManger->needsSecondFactor()) {
Expand Down
Loading