Exemple #1
0
 /**
  * Handle the request
  */
 public static function handleRequest()
 {
     \OC::$server->getEventLogger()->start('handle_request', 'Handle request');
     $systemConfig = \OC::$server->getSystemConfig();
     // load all the classpaths from the enabled apps so they are available
     // in the routing files of each app
     OC::loadAppClassPaths();
     // Check if ownCloud is installed or in maintenance (update) mode
     if (!$systemConfig->getValue('installed', false)) {
         \OC::$server->getSession()->clear();
         $setupHelper = new OC\Setup(\OC::$server->getConfig(), \OC::$server->getIniWrapper(), \OC::$server->getL10N('lib'), new \OC_Defaults(), \OC::$server->getLogger(), \OC::$server->getSecureRandom());
         $controller = new OC\Core\Setup\Controller($setupHelper);
         $controller->run($_POST);
         exit;
     }
     $request = \OC::$server->getRequest()->getPathInfo();
     if (substr($request, -3) !== '.js') {
         // we need these files during the upgrade
         self::checkMaintenanceMode();
         self::checkUpgrade();
     }
     // Always load authentication apps
     OC_App::loadApps(['authentication']);
     // Load minimum set of apps
     if (!self::checkUpgrade(false) && !$systemConfig->getValue('maintenance', false) && !\OCP\Util::needUpgrade()) {
         // For logged-in users: Load everything
         if (OC_User::isLoggedIn()) {
             OC_App::loadApps();
         } else {
             // For guests: Load only filesystem and logging
             OC_App::loadApps(array('filesystem', 'logging'));
             \OC_User::tryBasicAuthLogin();
         }
     }
     if (!self::$CLI and (!isset($_GET["logout"]) or $_GET["logout"] !== 'true')) {
         try {
             if (!$systemConfig->getValue('maintenance', false) && !\OCP\Util::needUpgrade()) {
                 OC_App::loadApps(array('filesystem', 'logging'));
                 OC_App::loadApps();
             }
             self::checkSingleUserMode();
             OC_Util::setupFS();
             OC::$server->getRouter()->match(\OC::$server->getRequest()->getRawPathInfo());
             return;
         } catch (Symfony\Component\Routing\Exception\ResourceNotFoundException $e) {
             //header('HTTP/1.0 404 Not Found');
         } catch (Symfony\Component\Routing\Exception\MethodNotAllowedException $e) {
             OC_Response::setStatus(405);
             return;
         }
     }
     // Handle redirect URL for logged in users
     if (isset($_REQUEST['redirect_url']) && OC_User::isLoggedIn()) {
         $location = OC_Helper::makeURLAbsolute(urldecode($_REQUEST['redirect_url']));
         // Deny the redirect if the URL contains a @
         // This prevents unvalidated redirects like ?redirect_url=:user@domain.com
         if (strpos($location, '@') === false) {
             header('Location: ' . $location);
             return;
         }
     }
     // Handle WebDAV
     if ($_SERVER['REQUEST_METHOD'] == 'PROPFIND') {
         // not allowed any more to prevent people
         // mounting this root directly.
         // Users need to mount remote.php/webdav instead.
         header('HTTP/1.1 405 Method Not Allowed');
         header('Status: 405 Method Not Allowed');
         return;
     }
     // Redirect to index if the logout link is accessed without valid session
     // this is needed to prevent "Token expired" messages while login if a session is expired
     // @see https://github.com/owncloud/core/pull/8443#issuecomment-42425583
     if (isset($_GET['logout']) && !OC_User::isLoggedIn()) {
         header("Location: " . OC::$WEBROOT . (empty(OC::$WEBROOT) ? '/' : ''));
         return;
     }
     // Someone is logged in
     if (OC_User::isLoggedIn()) {
         OC_App::loadApps();
         OC_User::setupBackends();
         OC_Util::setupFS();
         if (isset($_GET["logout"]) and $_GET["logout"]) {
             OC_JSON::callCheck();
             if (isset($_COOKIE['oc_token'])) {
                 \OC::$server->getConfig()->deleteUserValue(OC_User::getUser(), 'login_token', $_COOKIE['oc_token']);
             }
             OC_User::logout();
             // redirect to webroot and add slash if webroot is empty
             header("Location: " . OC::$WEBROOT . (empty(OC::$WEBROOT) ? '/' : ''));
         } else {
             // Redirect to default application
             OC_Util::redirectToDefaultPage();
         }
     } else {
         // Not handled and not logged in
         self::handleLogin();
     }
 }
Exemple #2
0
 /**
  * @brief Handle the request
  */
 public static function handleRequest()
 {
     // load all the classpaths from the enabled apps so they are available
     // in the routing files of each app
     OC::loadAppClassPaths();
     // Check if ownCloud is installed or in maintenance (update) mode
     if (!OC_Config::getValue('installed', false)) {
         require_once 'core/setup.php';
         exit;
     }
     $request = OC_Request::getPathInfo();
     if (substr($request, -3) !== '.js') {
         // we need these files during the upgrade
         self::checkMaintenanceMode();
         self::checkUpgrade();
     }
     if (!self::$CLI) {
         try {
             if (!OC_Config::getValue('maintenance', false)) {
                 OC_App::loadApps();
             }
             OC::getRouter()->match(OC_Request::getRawPathInfo());
             return;
         } catch (Symfony\Component\Routing\Exception\ResourceNotFoundException $e) {
             //header('HTTP/1.0 404 Not Found');
         } catch (Symfony\Component\Routing\Exception\MethodNotAllowedException $e) {
             OC_Response::setStatus(405);
             return;
         }
     }
     $app = OC::$REQUESTEDAPP;
     $file = OC::$REQUESTEDFILE;
     $param = array('app' => $app, 'file' => $file);
     // Handle app css files
     if (substr($file, -3) == 'css') {
         self::loadCSSFile($param);
         return;
     }
     // Handle redirect URL for logged in users
     if (isset($_REQUEST['redirect_url']) && OC_User::isLoggedIn()) {
         $location = OC_Helper::makeURLAbsolute(urldecode($_REQUEST['redirect_url']));
         // Deny the redirect if the URL contains a @
         // This prevents unvalidated redirects like ?redirect_url=:user@domain.com
         if (strpos($location, '@') === FALSE) {
             header('Location: ' . $location);
             return;
         }
     }
     // Handle WebDAV
     if ($_SERVER['REQUEST_METHOD'] == 'PROPFIND') {
         header('location: ' . OC_Helper::linkToRemote('webdav'));
         return;
     }
     // Someone is logged in :
     if (OC_User::isLoggedIn()) {
         OC_App::loadApps();
         OC_User::setupBackends();
         if (isset($_GET["logout"]) and $_GET["logout"]) {
             if (isset($_COOKIE['oc_token'])) {
                 OC_Preferences::deleteKey(OC_User::getUser(), 'login_token', $_COOKIE['oc_token']);
             }
             OC_User::logout();
             header("Location: " . OC::$WEBROOT . '/');
         } else {
             if (is_null($file)) {
                 $param['file'] = 'index.php';
             }
             $file_ext = substr($param['file'], -3);
             if ($file_ext != 'php' || !self::loadAppScriptFile($param)) {
                 header('HTTP/1.0 404 Not Found');
             }
         }
         return;
     }
     // Not handled and not logged in
     self::handleLogin();
 }
Exemple #3
0
 /**
  * @brief Handle the request
  */
 public static function handleRequest()
 {
     // load all the classpaths from the enabled apps so they are available
     // in the routing files of each app
     OC::loadAppClassPaths();
     // Check if ownCloud is installed or in maintenance (update) mode
     if (!OC_Config::getValue('installed', false)) {
         require_once 'core/setup.php';
         exit;
     }
     $host = OC_Request::insecureServerHost();
     // if the host passed in headers isn't trusted
     if (!OC::$CLI && OC_Request::getOverwriteHost() === null && !OC_Request::isTrustedDomain($host)) {
         header('HTTP/1.1 400 Bad Request');
         header('Status: 400 Bad Request');
         OC_Template::printErrorPage('You are accessing the server from an untrusted domain.', 'Please contact your administrator. If you are an administrator of this instance, configure the "trusted_domain" setting in config/config.php. An example configuration is provided in config/config.sample.php.');
         return;
     }
     $request = OC_Request::getPathInfo();
     if (substr($request, -3) !== '.js') {
         // we need these files during the upgrade
         self::checkMaintenanceMode();
         self::checkUpgrade();
     }
     // Test it the user is already authenticated using Apaches AuthType Basic... very usable in combination with LDAP
     OC::tryBasicAuthLogin();
     if (!self::$CLI and (!isset($_GET["logout"]) or $_GET["logout"] !== 'true')) {
         try {
             if (!OC_Config::getValue('maintenance', false)) {
                 OC_App::loadApps();
             }
             self::checkSingleUserMode();
             OC::getRouter()->match(OC_Request::getRawPathInfo());
             return;
         } catch (Symfony\Component\Routing\Exception\ResourceNotFoundException $e) {
             //header('HTTP/1.0 404 Not Found');
         } catch (Symfony\Component\Routing\Exception\MethodNotAllowedException $e) {
             OC_Response::setStatus(405);
             return;
         }
     }
     $app = OC::$REQUESTEDAPP;
     $file = OC::$REQUESTEDFILE;
     $param = array('app' => $app, 'file' => $file);
     // Handle app css files
     if (substr($file, -3) == 'css') {
         self::loadCSSFile($param);
         return;
     }
     // Handle redirect URL for logged in users
     if (isset($_REQUEST['redirect_url']) && OC_User::isLoggedIn()) {
         $location = OC_Helper::makeURLAbsolute(urldecode($_REQUEST['redirect_url']));
         // Deny the redirect if the URL contains a @
         // This prevents unvalidated redirects like ?redirect_url=:user@domain.com
         if (strpos($location, '@') === false) {
             header('Location: ' . $location);
             return;
         }
     }
     // Handle WebDAV
     if ($_SERVER['REQUEST_METHOD'] == 'PROPFIND') {
         // not allowed any more to prevent people
         // mounting this root directly.
         // Users need to mount remote.php/webdav instead.
         header('HTTP/1.1 405 Method Not Allowed');
         header('Status: 405 Method Not Allowed');
         return;
     }
     // Someone is logged in :
     if (OC_User::isLoggedIn()) {
         OC_App::loadApps();
         OC_User::setupBackends();
         if (isset($_GET["logout"]) and $_GET["logout"]) {
             if (isset($_COOKIE['oc_token'])) {
                 OC_Preferences::deleteKey(OC_User::getUser(), 'login_token', $_COOKIE['oc_token']);
             }
             OC_User::logout();
             header("Location: " . OC::$WEBROOT . '/');
         } else {
             if (is_null($file)) {
                 $param['file'] = 'index.php';
             }
             $file_ext = substr($param['file'], -3);
             if ($file_ext != 'php' || !self::loadAppScriptFile($param)) {
                 header('HTTP/1.0 404 Not Found');
             }
         }
         return;
     }
     // Not handled and not logged in
     self::handleLogin();
 }
Exemple #4
0
 /**
  * Handle the request
  */
 public static function handleRequest()
 {
     \OC::$server->getEventLogger()->start('handle_request', 'Handle request');
     $systemConfig = \OC::$server->getSystemConfig();
     // load all the classpaths from the enabled apps so they are available
     // in the routing files of each app
     OC::loadAppClassPaths();
     // Check if ownCloud is installed or in maintenance (update) mode
     if (!$systemConfig->getValue('installed', false)) {
         \OC::$server->getSession()->clear();
         $setupHelper = new OC\Setup(\OC::$server->getConfig(), \OC::$server->getIniWrapper(), \OC::$server->getL10N('lib'), new \OC_Defaults(), \OC::$server->getLogger(), \OC::$server->getSecureRandom());
         $controller = new OC\Core\Controller\SetupController($setupHelper);
         $controller->run($_POST);
         exit;
     }
     $request = \OC::$server->getRequest();
     // Check if requested URL matches 'index.php/occ'
     $isOccControllerRequested = preg_match('|/index\\.php$|', $request->getScriptName()) === 1 && strpos($request->getPathInfo(), '/occ/') === 0;
     $requestPath = $request->getRawPathInfo();
     if (substr($requestPath, -3) !== '.js') {
         // we need these files during the upgrade
         self::checkMaintenanceMode($request);
         $needUpgrade = self::checkUpgrade(!$isOccControllerRequested);
     }
     // emergency app disabling
     if ($requestPath === '/disableapp' && $request->getMethod() === 'POST' && (string) $request->getParam('appid') !== '') {
         \OCP\JSON::callCheck();
         \OCP\JSON::checkAdminUser();
         $appId = (string) $request->getParam('appid');
         $appId = \OC_App::cleanAppId($appId);
         \OC_App::disable($appId);
         \OC_JSON::success();
         exit;
     }
     try {
         // Always load authentication apps
         OC_App::loadApps(['authentication']);
     } catch (\OC\NeedsUpdateException $e) {
         if ($isOccControllerRequested && $needUpgrade) {
             OC::$server->getRouter()->match(\OC::$server->getRequest()->getRawPathInfo());
             return;
         }
         throw $e;
     }
     // Load minimum set of apps
     if (!self::checkUpgrade(false) && !$systemConfig->getValue('maintenance', false)) {
         // For logged-in users: Load everything
         if (OC_User::isLoggedIn()) {
             OC_App::loadApps();
         } else {
             // For guests: Load only filesystem and logging
             OC_App::loadApps(array('filesystem', 'logging'));
             self::handleLogin($request);
         }
     }
     if (!self::$CLI) {
         try {
             if (!$systemConfig->getValue('maintenance', false) && !self::checkUpgrade(false)) {
                 OC_App::loadApps(array('filesystem', 'logging'));
                 OC_App::loadApps();
             }
             self::checkSingleUserMode();
             OC_Util::setupFS();
             OC::$server->getRouter()->match(\OC::$server->getRequest()->getRawPathInfo());
             return;
         } catch (Symfony\Component\Routing\Exception\ResourceNotFoundException $e) {
             //header('HTTP/1.0 404 Not Found');
         } catch (Symfony\Component\Routing\Exception\MethodNotAllowedException $e) {
             OC_Response::setStatus(405);
             return;
         }
     }
     // Handle WebDAV
     if ($_SERVER['REQUEST_METHOD'] == 'PROPFIND') {
         // not allowed any more to prevent people
         // mounting this root directly.
         // Users need to mount remote.php/webdav instead.
         header('HTTP/1.1 405 Method Not Allowed');
         header('Status: 405 Method Not Allowed');
         return;
     }
     // Someone is logged in
     if (OC_User::isLoggedIn()) {
         OC_App::loadApps();
         OC_User::setupBackends();
         OC_Util::setupFS();
         // FIXME
         // Redirect to default application
         OC_Util::redirectToDefaultPage();
     } else {
         // Not handled and not logged in
         header('Location: ' . \OC::$server->getURLGenerator()->linkToRouteAbsolute('core.login.showLoginForm'));
     }
 }
Exemple #5
0
 /**
  * Handle the request
  */
 public static function handleRequest()
 {
     $l = \OC_L10N::get('lib');
     // load all the classpaths from the enabled apps so they are available
     // in the routing files of each app
     OC::loadAppClassPaths();
     // Check if ownCloud is installed or in maintenance (update) mode
     if (!OC_Config::getValue('installed', false)) {
         $controller = new OC\Core\Setup\Controller();
         $controller->run($_POST);
         exit;
     }
     $host = OC_Request::insecureServerHost();
     // if the host passed in headers isn't trusted
     if (!OC::$CLI && OC_Request::getOverwriteHost() === null && !OC_Request::isTrustedDomain($host)) {
         header('HTTP/1.1 400 Bad Request');
         header('Status: 400 Bad Request');
         OC_Template::printErrorPage($l->t('You are accessing the server from an untrusted domain.'), $l->t('Please contact your administrator. If you are an administrator of this instance, configure the "trusted_domain" setting in config/config.php. An example configuration is provided in config/config.sample.php.'));
         return;
     }
     $request = OC_Request::getPathInfo();
     if (substr($request, -3) !== '.js') {
         // we need these files during the upgrade
         self::checkMaintenanceMode();
         self::checkUpgrade();
     }
     if (!OC_User::isLoggedIn()) {
         // Test it the user is already authenticated using Apaches AuthType Basic... very usable in combination with LDAP
         OC::tryBasicAuthLogin();
     }
     if (!self::$CLI and (!isset($_GET["logout"]) or $_GET["logout"] !== 'true')) {
         try {
             if (!OC_Config::getValue('maintenance', false) && !\OCP\Util::needUpgrade()) {
                 OC_App::loadApps(array('authentication'));
                 OC_App::loadApps(array('filesystem', 'logging'));
                 OC_App::loadApps();
             }
             self::checkSingleUserMode();
             OC::$server->getRouter()->match(OC_Request::getRawPathInfo());
             return;
         } catch (Symfony\Component\Routing\Exception\ResourceNotFoundException $e) {
             //header('HTTP/1.0 404 Not Found');
         } catch (Symfony\Component\Routing\Exception\MethodNotAllowedException $e) {
             OC_Response::setStatus(405);
             return;
         }
     }
     // Load minimum set of apps
     if (!self::checkUpgrade(false)) {
         // For logged-in users: Load everything
         if (OC_User::isLoggedIn()) {
             OC_App::loadApps();
         } else {
             // For guests: Load only authentication, filesystem and logging
             OC_App::loadApps(array('authentication'));
             OC_App::loadApps(array('filesystem', 'logging'));
         }
     }
     // Handle redirect URL for logged in users
     if (isset($_REQUEST['redirect_url']) && OC_User::isLoggedIn()) {
         $location = OC_Helper::makeURLAbsolute(urldecode($_REQUEST['redirect_url']));
         // Deny the redirect if the URL contains a @
         // This prevents unvalidated redirects like ?redirect_url=:user@domain.com
         if (strpos($location, '@') === false) {
             header('Location: ' . $location);
             return;
         }
     }
     // Handle WebDAV
     if ($_SERVER['REQUEST_METHOD'] == 'PROPFIND') {
         // not allowed any more to prevent people
         // mounting this root directly.
         // Users need to mount remote.php/webdav instead.
         header('HTTP/1.1 405 Method Not Allowed');
         header('Status: 405 Method Not Allowed');
         return;
     }
     // Redirect to index if the logout link is accessed without valid session
     // this is needed to prevent "Token expired" messages while login if a session is expired
     // @see https://github.com/owncloud/core/pull/8443#issuecomment-42425583
     if (isset($_GET['logout']) && !OC_User::isLoggedIn()) {
         header("Location: " . OC::$WEBROOT . (empty(OC::$WEBROOT) ? '/' : ''));
         return;
     }
     // Someone is logged in
     if (OC_User::isLoggedIn()) {
         OC_App::loadApps();
         OC_User::setupBackends();
         if (isset($_GET["logout"]) and $_GET["logout"]) {
             OC_JSON::callCheck();
             if (isset($_COOKIE['oc_token'])) {
                 OC_Preferences::deleteKey(OC_User::getUser(), 'login_token', $_COOKIE['oc_token']);
             }
             if (isset($_SERVER['PHP_AUTH_USER'])) {
                 if (isset($_COOKIE['oc_ignore_php_auth_user'])) {
                     // Ignore HTTP Authentication for 5 more mintues.
                     setcookie('oc_ignore_php_auth_user', $_SERVER['PHP_AUTH_USER'], time() + 300, OC::$WEBROOT . (empty(OC::$WEBROOT) ? '/' : ''));
                 } elseif ($_SERVER['PHP_AUTH_USER'] === self::$session->get('loginname')) {
                     // Ignore HTTP Authentication to allow a different user to log in.
                     setcookie('oc_ignore_php_auth_user', $_SERVER['PHP_AUTH_USER'], 0, OC::$WEBROOT . (empty(OC::$WEBROOT) ? '/' : ''));
                 }
             }
             OC_User::logout();
             // redirect to webroot and add slash if webroot is empty
             header("Location: " . OC::$WEBROOT . (empty(OC::$WEBROOT) ? '/' : ''));
         } else {
             // Redirect to default application
             OC_Util::redirectToDefaultPage();
         }
     } else {
         // Not handled and not logged in
         self::handleLogin();
     }
 }