2010-03-10 12:03:40 +00:00
< ? php
2022-11-29 15:29:12 +00:00
declare ( strict_types = 1 );
2010-03-10 12:03:40 +00:00
/**
2016-07-21 15:07:57 +00:00
* @ copyright Copyright ( c ) 2016 , ownCloud , Inc .
*
2015-03-26 10:44:34 +00:00
* @ author Adam Williamson < awilliam @ redhat . com >
* @ author Andreas Fischer < bantu @ owncloud . com >
2016-05-26 17:56:05 +00:00
* @ author Arthur Schiwon < blizzz @ arthur - schiwon . de >
2015-03-26 10:44:34 +00:00
* @ author Bart Visscher < bartv @ thisnet . nl >
* @ author Bernhard Posselt < dev @ bernhard - posselt . com >
2017-11-06 14:56:42 +00:00
* @ author Bjoern Schiessle < bjoern @ schiessle . org >
2016-05-26 17:56:05 +00:00
* @ author Björn Schießle < bjoern @ schiessle . org >
2019-12-03 18:57:53 +00:00
* @ author Christoph Wurst < christoph @ winzerhof - wurst . at >
2022-11-29 15:29:12 +00:00
* @ author Côme Chilliet < come . chilliet @ nextcloud . com >
2017-11-06 14:56:42 +00:00
* @ author Damjan Georgievski < gdamjan @ gmail . com >
2020-03-31 08:49:10 +00:00
* @ author Daniel Kesselberg < mail @ danielkesselberg . de >
2015-03-26 10:44:34 +00:00
* @ author davidgumberg < davidnoizgumberg @ gmail . com >
2019-12-03 18:57:53 +00:00
* @ author Eric Masseran < rico . masseran @ gmail . com >
2015-03-26 10:44:34 +00:00
* @ author Florin Peter < github @ florin - peter . de >
2019-12-03 18:57:53 +00:00
* @ author Greta Doci < gretadoci @ gmail . com >
2021-06-04 19:52:51 +00:00
* @ author J0WI < J0WI @ users . noreply . github . com >
2015-03-26 10:44:34 +00:00
* @ author Jakob Sack < mail @ jakobsack . de >
2019-12-03 18:57:53 +00:00
* @ author jaltek < jaltek @ mailbox . org >
2017-11-06 14:56:42 +00:00
* @ author Jan - Christoph Borchardt < hey @ jancborchardt . net >
2016-07-21 15:07:57 +00:00
* @ author Joachim Sokolowski < github @ sokolowski . org >
* @ author Joas Schilling < coding @ schilljs . com >
2021-06-04 19:52:51 +00:00
* @ author John Molakvoæ < skjnldsv @ protonmail . com >
2015-03-26 10:44:34 +00:00
* @ author Jörn Friedrich Dreyer < jfd @ butonic . de >
2020-03-31 08:49:10 +00:00
* @ author Jose Quinteiro < github @ quinteiro . org >
2019-12-03 18:57:53 +00:00
* @ author Juan Pablo Villafáñez < jvillafanez @ solidgear . es >
* @ author Julius Härtl < jus @ bitgrid . net >
2017-11-06 14:56:42 +00:00
* @ author Ko - < k . stoffelen @ cs . ru . nl >
2016-05-26 17:56:05 +00:00
* @ author Lukas Reschke < lukas @ statuscode . ch >
2019-12-03 18:57:53 +00:00
* @ author MartB < mart . b @ outlook . de >
2015-03-26 10:44:34 +00:00
* @ author Michael Gapczynski < GapczynskiM @ gmail . com >
2021-11-30 15:45:51 +00:00
* @ author MichaIng < micha @ dietpi . com >
2015-03-26 10:44:34 +00:00
* @ author Morris Jobke < hey @ morrisjobke . de >
* @ author Owen Winkler < a_github @ midnightcircus . com >
2015-10-05 18:54:56 +00:00
* @ author Phil Davis < phil . davis @ inf . org >
2015-03-26 10:44:34 +00:00
* @ author Ramiro Aparicio < rapariciog @ gmail . com >
2016-07-21 16:13:36 +00:00
* @ author Robin Appelman < robin @ icewind . nl >
2016-01-12 14:02:16 +00:00
* @ author Robin McCorkell < robin @ mccorkell . me . uk >
2016-07-21 15:07:57 +00:00
* @ author Roeland Jago Douma < roeland @ famdouma . nl >
2017-11-06 14:56:42 +00:00
* @ author Sebastian Wessalowski < sebastian @ wessalowski . org >
2016-05-26 17:56:05 +00:00
* @ author Stefan Weil < sw @ weilnetz . de >
2015-03-26 10:44:34 +00:00
* @ author Thomas Müller < thomas . mueller @ tmit . eu >
* @ author Thomas Tanghus < thomas @ tanghus . net >
2019-12-03 18:57:53 +00:00
* @ author Tobia De Koninck < tobia @ ledfan . be >
2020-12-16 13:54:15 +00:00
* @ author Vincent Petry < vincent @ nextcloud . com >
2015-03-26 10:44:34 +00:00
* @ author Volkan Gezer < volkangezer @ gmail . com >
2011-04-15 17:24:23 +00:00
*
2015-03-26 10:44:34 +00:00
* @ license AGPL - 3.0
2011-04-15 17:24:23 +00:00
*
2015-03-26 10:44:34 +00:00
* This code is free software : you can redistribute it and / or modify
* it under the terms of the GNU Affero General Public License , version 3 ,
* as published by the Free Software Foundation .
2011-04-15 17:24:23 +00:00
*
2015-03-26 10:44:34 +00:00
* This program is distributed in the hope that it will be useful ,
2011-04-15 17:24:23 +00:00
* but WITHOUT ANY WARRANTY ; without even the implied warranty of
2015-03-26 10:44:34 +00:00
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
* GNU Affero General Public License for more details .
2014-04-27 14:41:09 +00:00
*
2015-03-26 10:44:34 +00:00
* You should have received a copy of the GNU Affero General Public License , version 3 ,
2019-12-03 18:57:53 +00:00
* along with this program . If not , see < http :// www . gnu . org / licenses />
2011-04-15 17:24:23 +00:00
*
*/
2022-02-11 08:08:02 +00:00
2022-11-29 15:29:12 +00:00
use OC\Encryption\HookManager ;
use OC\Share20\Hooks ;
2020-07-07 19:17:25 +00:00
use OCP\EventDispatcher\IEventDispatcher ;
2020-07-27 10:12:11 +00:00
use OCP\Group\Events\UserRemovedEvent ;
2018-04-25 13:22:28 +00:00
use OCP\ILogger ;
2021-08-04 13:52:10 +00:00
use OCP\IRequest ;
2022-11-29 15:53:27 +00:00
use OCP\IURLGenerator ;
use OCP\IUserSession ;
2023-08-28 13:50:45 +00:00
use OCP\Security\Bruteforce\IThrottler ;
2022-05-12 08:18:40 +00:00
use OCP\Server ;
2018-01-25 22:16:13 +00:00
use OCP\Share ;
2021-06-15 17:32:39 +00:00
use OCP\User\Events\UserChangedEvent ;
2022-12-01 10:21:57 +00:00
use Psr\Log\LoggerInterface ;
2023-03-03 08:40:43 +00:00
use Symfony\Component\Routing\Exception\MethodNotAllowedException ;
2022-10-14 05:42:25 +00:00
use function OCP\Log\logger ;
2018-01-25 22:16:13 +00:00
2016-05-19 06:00:09 +00:00
require_once 'public/Constants.php' ;
2012-11-11 14:52:23 +00:00
2011-08-02 16:31:42 +00:00
/**
* Class that is a namespace for all global OC variables
2011-08-06 09:36:56 +00:00
* No , we can not put this class in its own file because it is used by
* OC_autoload !
2011-08-02 16:31:42 +00:00
*/
2013-01-30 21:55:33 +00:00
class OC {
2013-01-14 19:30:28 +00:00
/**
2013-01-18 18:52:29 +00:00
* Associative array for autoloading . classname => filename
2013-01-14 19:30:28 +00:00
*/
2022-11-29 15:29:12 +00:00
public static array $CLASSPATH = [];
2013-01-14 19:30:28 +00:00
/**
2016-06-22 06:41:10 +00:00
* The installation path for Nextcloud on the server ( e . g . / srv / http / nextcloud )
2013-01-14 19:30:28 +00:00
*/
2022-11-29 15:29:12 +00:00
public static string $SERVERROOT = '' ;
2013-01-14 19:30:28 +00:00
/**
2016-06-22 06:41:10 +00:00
* the current request path relative to the Nextcloud root ( e . g . files / index . php )
2013-01-14 19:30:28 +00:00
*/
2022-11-29 15:29:12 +00:00
private static string $SUBURI = '' ;
2013-01-14 19:30:28 +00:00
/**
2016-06-22 06:41:10 +00:00
* the Nextcloud root path for http requests ( e . g . nextcloud / )
2013-01-14 19:30:28 +00:00
*/
2022-11-29 15:29:12 +00:00
public static string $WEBROOT = '' ;
2013-01-14 19:30:28 +00:00
/**
2016-06-22 06:41:10 +00:00
* The installation path array of the apps folder on the server ( e . g . / srv / http / nextcloud ) 'path' and
2013-01-14 19:30:28 +00:00
* web path in 'url'
*/
2022-11-29 15:29:12 +00:00
public static array $APPSROOTS = [];
2014-01-17 13:40:48 +00:00
2022-11-29 15:29:12 +00:00
public static string $configDir ;
2014-01-17 13:40:48 +00:00
2014-05-10 12:00:22 +00:00
/**
2013-01-14 19:30:28 +00:00
* requested app
*/
2022-11-29 15:29:12 +00:00
public static string $REQUESTEDAPP = '' ;
2014-05-10 12:00:22 +00:00
2013-01-14 19:30:28 +00:00
/**
2016-06-22 06:41:10 +00:00
* check if Nextcloud runs in cli mode
2013-01-14 19:30:28 +00:00
*/
2022-11-29 15:29:12 +00:00
public static bool $CLI = false ;
2013-10-06 22:32:08 +00:00
2022-12-01 10:43:17 +00:00
public static \OC\Autoloader $loader ;
2013-01-14 19:30:28 +00:00
2022-12-01 10:43:17 +00:00
public static \Composer\Autoload\ClassLoader $composerAutoloader ;
2016-05-02 12:10:53 +00:00
2022-12-01 10:43:17 +00:00
public static \OC\Server $server ;
2013-08-20 22:58:15 +00:00
2022-12-01 10:43:17 +00:00
private static \OC\Config $config ;
2015-12-18 09:33:30 +00:00
2015-03-18 10:48:51 +00:00
/**
* @ throws \RuntimeException when the 3 rdparty directory is missing or
* the app path list is empty or contains an invalid path
*/
2022-11-29 15:29:12 +00:00
public static function initPaths () : void {
2020-04-10 12:19:56 +00:00
if ( defined ( 'PHPUNIT_CONFIG_DIR' )) {
2014-03-13 12:33:09 +00:00
self :: $configDir = OC :: $SERVERROOT . '/' . PHPUNIT_CONFIG_DIR . '/' ;
2022-05-16 13:54:18 +00:00
} elseif ( defined ( 'PHPUNIT_RUN' ) and PHPUNIT_RUN and is_dir ( OC :: $SERVERROOT . '/tests/config/' )) {
2014-01-20 12:41:52 +00:00
self :: $configDir = OC :: $SERVERROOT . '/tests/config/' ;
2020-04-10 12:19:56 +00:00
} elseif ( $dir = getenv ( 'NEXTCLOUD_CONFIG_DIR' )) {
2016-07-29 15:47:39 +00:00
self :: $configDir = rtrim ( $dir , '/' ) . '/' ;
2014-01-17 13:40:48 +00:00
} else {
self :: $configDir = OC :: $SERVERROOT . '/config/' ;
}
2015-12-18 09:33:30 +00:00
self :: $config = new \OC\Config ( self :: $configDir );
2014-01-17 13:40:48 +00:00
2022-11-29 15:29:12 +00:00
OC :: $SUBURI = str_replace ( " \\ " , " / " , substr ( realpath ( $_SERVER [ " SCRIPT_FILENAME " ] ? ? '' ), strlen ( OC :: $SERVERROOT )));
2015-10-21 15:33:49 +00:00
/**
2017-05-15 12:33:27 +00:00
* FIXME : The following lines are required because we can ' t yet instantiate
2022-11-29 17:07:27 +00:00
* Server :: get ( \OCP\IRequest :: class ) since \OC :: $server does not yet exist .
2015-10-21 15:33:49 +00:00
*/
$params = [
'server' => [
2022-11-29 15:29:12 +00:00
'SCRIPT_NAME' => $_SERVER [ 'SCRIPT_NAME' ] ? ? null ,
'SCRIPT_FILENAME' => $_SERVER [ 'SCRIPT_FILENAME' ] ? ? null ,
2015-10-21 15:33:49 +00:00
],
];
2023-05-16 09:39:39 +00:00
if ( isset ( $_SERVER [ 'REMOTE_ADDR' ])) {
$params [ 'server' ][ 'REMOTE_ADDR' ] = $_SERVER [ 'REMOTE_ADDR' ];
}
2022-02-16 22:41:54 +00:00
$fakeRequest = new \OC\AppFramework\Http\Request (
$params ,
new \OC\AppFramework\Http\RequestId ( $_SERVER [ 'UNIQUE_ID' ] ? ? '' , new \OC\Security\SecureRandom ()),
new \OC\AllConfig ( new \OC\SystemConfig ( self :: $config ))
);
2015-10-21 15:33:49 +00:00
$scriptName = $fakeRequest -> getScriptName ();
2013-01-14 19:30:28 +00:00
if ( substr ( $scriptName , - 1 ) == '/' ) {
$scriptName .= 'index.php' ;
//make sure suburi follows the same rules as scriptName
if ( substr ( OC :: $SUBURI , - 9 ) != 'index.php' ) {
if ( substr ( OC :: $SUBURI , - 1 ) != '/' ) {
OC :: $SUBURI = OC :: $SUBURI . '/' ;
}
OC :: $SUBURI = OC :: $SUBURI . 'index.php' ;
}
}
2015-10-21 15:33:49 +00:00
2015-02-23 20:49:35 +00:00
if ( OC :: $CLI ) {
2015-12-18 10:42:09 +00:00
OC :: $WEBROOT = self :: $config -> getValue ( 'overwritewebroot' , '' );
2015-02-23 20:49:35 +00:00
} else {
if ( substr ( $scriptName , 0 - strlen ( OC :: $SUBURI )) === OC :: $SUBURI ) {
OC :: $WEBROOT = substr ( $scriptName , 0 , 0 - strlen ( OC :: $SUBURI ));
2013-01-14 19:30:28 +00:00
2015-02-23 20:49:35 +00:00
if ( OC :: $WEBROOT != '' && OC :: $WEBROOT [ 0 ] !== '/' ) {
OC :: $WEBROOT = '/' . OC :: $WEBROOT ;
}
} else {
// The scriptName is not ending with OC::$SUBURI
// This most likely means that we are calling from CLI.
// However some cron jobs still need to generate
// a web URL, so we use overwritewebroot as a fallback.
2015-12-18 10:42:09 +00:00
OC :: $WEBROOT = self :: $config -> getValue ( 'overwritewebroot' , '' );
2014-07-07 13:01:02 +00:00
}
2013-01-14 19:30:28 +00:00
2016-06-22 06:41:10 +00:00
// Resolve /nextcloud to /nextcloud/ to ensure to always have a trailing
2015-12-02 10:49:33 +00:00
// slash which is required by URL generation.
2017-05-15 12:33:27 +00:00
if ( isset ( $_SERVER [ 'REQUEST_URI' ]) && $_SERVER [ 'REQUEST_URI' ] === \OC :: $WEBROOT &&
2015-12-02 10:49:33 +00:00
substr ( $_SERVER [ 'REQUEST_URI' ], - 1 ) !== '/' ) {
header ( 'Location: ' . \OC :: $WEBROOT . '/' );
exit ();
}
2015-12-02 10:26:41 +00:00
}
2013-01-14 19:30:28 +00:00
// search the apps folder
2020-03-26 08:30:18 +00:00
$config_paths = self :: $config -> getValue ( 'apps_paths' , []);
2013-01-14 19:30:28 +00:00
if ( ! empty ( $config_paths )) {
foreach ( $config_paths as $paths ) {
if ( isset ( $paths [ 'url' ]) && isset ( $paths [ 'path' ])) {
$paths [ 'url' ] = rtrim ( $paths [ 'url' ], '/' );
$paths [ 'path' ] = rtrim ( $paths [ 'path' ], '/' );
OC :: $APPSROOTS [] = $paths ;
}
}
} elseif ( file_exists ( OC :: $SERVERROOT . '/apps' )) {
2020-03-26 08:30:18 +00:00
OC :: $APPSROOTS [] = [ 'path' => OC :: $SERVERROOT . '/apps' , 'url' => '/apps' , 'writable' => true ];
2013-01-14 19:30:28 +00:00
}
if ( empty ( OC :: $APPSROOTS )) {
2016-06-22 06:41:10 +00:00
throw new \RuntimeException ( 'apps directory not found! Please put the Nextcloud apps folder in the Nextcloud folder'
2021-01-20 20:22:39 +00:00
. '. You can also configure the location in the config.php file.' );
2013-01-14 19:30:28 +00:00
}
2020-03-26 08:30:18 +00:00
$paths = [];
2013-01-30 21:55:33 +00:00
foreach ( OC :: $APPSROOTS as $path ) {
2013-01-14 19:30:28 +00:00
$paths [] = $path [ 'path' ];
2015-03-18 10:48:51 +00:00
if ( ! is_dir ( $path [ 'path' ])) {
2016-06-22 06:41:10 +00:00
throw new \RuntimeException ( sprintf ( 'App directory "%s" not found! Please put the Nextcloud apps folder in the'
2021-01-20 20:22:39 +00:00
. ' Nextcloud folder. You can also configure the location in the config.php file.' , $path [ 'path' ]));
2015-03-18 10:48:51 +00:00
}
2013-01-30 21:55:33 +00:00
}
2013-01-14 19:30:28 +00:00
// set the right include path
set_include_path (
2016-10-24 21:37:05 +00:00
implode ( PATH_SEPARATOR , $paths )
2013-01-14 19:30:28 +00:00
);
}
2012-12-20 10:10:45 +00:00
2022-11-29 15:29:12 +00:00
public static function checkConfig () : void {
2022-11-29 15:53:27 +00:00
$l = Server :: get ( \OCP\L10N\IFactory :: class ) -> get ( 'lib' );
2014-12-05 16:32:19 +00:00
2015-09-21 17:19:25 +00:00
// Create config if it does not already exist
2014-12-05 16:32:19 +00:00
$configFilePath = self :: $configDir . '/config.php' ;
2020-04-10 12:19:56 +00:00
if ( ! file_exists ( $configFilePath )) {
2014-12-05 16:32:19 +00:00
@ touch ( $configFilePath );
}
// Check if config is writable
$configFileWritable = is_writable ( $configFilePath );
2014-11-25 15:12:12 +00:00
if ( ! $configFileWritable && ! OC_Helper :: isReadOnlyConfigEnabled ()
2017-11-30 15:00:19 +00:00
|| ! $configFileWritable && \OCP\Util :: needUpgrade ()) {
2022-11-29 15:53:27 +00:00
$urlGenerator = Server :: get ( IURLGenerator :: class );
2015-11-26 09:48:08 +00:00
2013-11-25 12:04:23 +00:00
if ( self :: $CLI ) {
2014-05-28 23:21:54 +00:00
echo $l -> t ( 'Cannot write into "config" directory!' ) . " \n " ;
2021-12-15 16:27:26 +00:00
echo $l -> t ( 'This can usually be fixed by giving the web server write access to the config directory.' ) . " \n " ;
2017-10-27 22:54:25 +00:00
echo " \n " ;
2021-05-27 13:37:39 +00:00
echo $l -> t ( 'But, if you prefer to keep config.php file read only, set the option "config_is_read_only" to true in it.' ) . " \n " ;
2017-10-27 22:54:25 +00:00
echo $l -> t ( 'See %s' , [ $urlGenerator -> linkToDocs ( 'admin-config' ) ]) . " \n " ;
2013-11-25 12:04:23 +00:00
exit ;
} else {
OC_Template :: printErrorPage (
2014-05-28 23:21:54 +00:00
$l -> t ( 'Cannot write into "config" directory!' ),
2021-12-15 16:27:26 +00:00
$l -> t ( 'This can usually be fixed by giving the web server write access to the config directory.' ) . ' '
2021-05-27 13:37:39 +00:00
. $l -> t ( 'But, if you prefer to keep config.php file read only, set the option "config_is_read_only" to true in it.' ) . ' '
. $l -> t ( 'See %s' , [ $urlGenerator -> linkToDocs ( 'admin-config' ) ]),
2018-07-05 15:09:38 +00:00
503
2013-11-25 12:04:23 +00:00
);
}
2013-01-03 19:11:00 +00:00
}
}
2022-11-29 15:29:12 +00:00
public static function checkInstalled ( \OC\SystemConfig $systemConfig ) : void {
2015-02-21 19:52:32 +00:00
if ( defined ( 'OC_CONSOLE' )) {
return ;
}
2013-01-14 19:30:28 +00:00
// Redirect to installer if not installed
2021-01-20 20:55:16 +00:00
if ( ! $systemConfig -> getValue ( 'installed' , false ) && OC :: $SUBURI !== '/index.php' && OC :: $SUBURI !== '/status.php' ) {
2014-07-25 17:39:29 +00:00
if ( OC :: $CLI ) {
throw new Exception ( 'Not installed' );
2014-07-24 11:45:06 +00:00
} else {
2016-08-25 12:27:58 +00:00
$url = OC :: $WEBROOT . '/index.php' ;
2014-07-25 17:39:29 +00:00
header ( 'Location: ' . $url );
2013-01-14 19:30:28 +00:00
}
exit ();
}
}
2022-11-29 15:29:12 +00:00
public static function checkMaintenanceMode ( \OC\SystemConfig $systemConfig ) : void {
2013-01-04 02:32:33 +00:00
// Allow ajax update script to execute without being stopped
2021-01-20 20:55:16 +00:00
if ((( bool ) $systemConfig -> getValue ( 'maintenance' , false )) && OC :: $SUBURI != '/core/ajax/update.php' ) {
2013-01-14 20:39:55 +00:00
// send http status 503
2018-06-26 08:32:50 +00:00
http_response_code ( 503 );
2022-07-08 15:45:41 +00:00
header ( 'X-Nextcloud-Maintenance-Mode: 1' );
2013-01-14 20:39:55 +00:00
header ( 'Retry-After: 120' );
// render error page
2015-04-09 21:47:24 +00:00
$template = new OC_Template ( '' , 'update.user' , 'guest' );
2022-05-16 07:28:15 +00:00
\OCP\Util :: addScript ( 'core' , 'maintenance' );
\OCP\Util :: addStyle ( 'core' , 'guest' );
2015-04-09 21:47:24 +00:00
$template -> printPage ();
2013-10-24 15:46:52 +00:00
die ();
2013-01-03 19:11:00 +00:00
}
}
2015-07-07 10:12:54 +00:00
/**
* Prints the upgrade page
*/
2022-11-29 15:29:12 +00:00
private static function printUpgradePage ( \OC\SystemConfig $systemConfig ) : void {
2023-06-10 07:47:04 +00:00
$cliUpgradeLink = $systemConfig -> getValue ( 'upgrade.cli-upgrade-link' , '' );
2016-04-11 14:58:08 +00:00
$disableWebUpdater = $systemConfig -> getValue ( 'upgrade.disable-web' , false );
$tooBig = false ;
if ( ! $disableWebUpdater ) {
2022-11-29 15:53:27 +00:00
$apps = Server :: get ( \OCP\App\IAppManager :: class );
2017-05-11 02:39:09 +00:00
if ( $apps -> isInstalled ( 'user_ldap' )) {
2022-11-29 17:07:27 +00:00
$qb = Server :: get ( \OCP\IDBConnection :: class ) -> getQueryBuilder ();
2017-05-11 02:39:09 +00:00
2018-10-19 14:44:28 +00:00
$result = $qb -> select ( $qb -> func () -> count ( '*' , 'user_count' ))
2017-05-11 02:39:09 +00:00
-> from ( 'ldap_user_mapping' )
2022-11-29 15:53:27 +00:00
-> executeQuery ();
2017-05-11 02:39:09 +00:00
$row = $result -> fetch ();
$result -> closeCursor ();
$tooBig = ( $row [ 'user_count' ] > 50 );
}
if ( ! $tooBig && $apps -> isInstalled ( 'user_saml' )) {
2022-11-29 17:07:27 +00:00
$qb = Server :: get ( \OCP\IDBConnection :: class ) -> getQueryBuilder ();
2017-05-11 02:39:09 +00:00
2018-10-19 14:44:28 +00:00
$result = $qb -> select ( $qb -> func () -> count ( '*' , 'user_count' ))
2017-05-11 02:39:09 +00:00
-> from ( 'user_saml_users' )
2022-11-29 15:53:27 +00:00
-> executeQuery ();
2017-05-11 02:39:09 +00:00
$row = $result -> fetch ();
$result -> closeCursor ();
$tooBig = ( $row [ 'user_count' ] > 50 );
}
2016-04-22 13:52:18 +00:00
if ( ! $tooBig ) {
// count users
2022-11-29 17:07:27 +00:00
$stats = Server :: get ( \OCP\IUserManager :: class ) -> countUsers ();
2016-04-22 13:52:18 +00:00
$totalUsers = array_sum ( $stats );
$tooBig = ( $totalUsers > 50 );
}
2016-04-11 14:58:08 +00:00
}
2017-05-11 03:26:51 +00:00
$ignoreTooBigWarning = isset ( $_GET [ 'IKnowThatThisIsABigInstanceAndTheUpdateRequestCouldRunIntoATimeoutAndHowToRestoreABackup' ]) &&
$_GET [ 'IKnowThatThisIsABigInstanceAndTheUpdateRequestCouldRunIntoATimeoutAndHowToRestoreABackup' ] === 'IAmSuperSureToDoThis' ;
if ( $disableWebUpdater || ( $tooBig && ! $ignoreTooBigWarning )) {
2016-04-11 14:58:08 +00:00
// send http status 503
2018-06-26 08:32:50 +00:00
http_response_code ( 503 );
2016-04-11 14:58:08 +00:00
header ( 'Retry-After: 120' );
// render error page
$template = new OC_Template ( '' , 'update.use-cli' , 'guest' );
2016-08-04 10:48:25 +00:00
$template -> assign ( 'productName' , 'nextcloud' ); // for now
2016-04-11 14:58:08 +00:00
$template -> assign ( 'version' , OC_Util :: getVersionString ());
$template -> assign ( 'tooBig' , $tooBig );
2023-06-10 07:47:04 +00:00
$template -> assign ( 'cliUpgradeLink' , $cliUpgradeLink );
2016-04-11 14:58:08 +00:00
$template -> printPage ();
die ();
}
// check whether this is a core update or apps update
$installedVersion = $systemConfig -> getValue ( 'version' , '0.0.0' );
$currentVersion = implode ( '.' , \OCP\Util :: getVersion ());
// if not a core upgrade, then it's apps upgrade
2018-01-26 22:46:40 +00:00
$isAppsOnlyUpgrade = version_compare ( $currentVersion , $installedVersion , '=' );
2016-04-11 14:58:08 +00:00
2015-07-07 10:12:54 +00:00
$oldTheme = $systemConfig -> getValue ( 'theme' );
$systemConfig -> setValue ( 'theme' , '' );
2022-01-18 17:37:45 +00:00
\OCP\Util :: addScript ( 'core' , 'common' );
\OCP\Util :: addScript ( 'core' , 'main' );
\OCP\Util :: addTranslations ( 'core' );
\OCP\Util :: addScript ( 'core' , 'update' );
2015-07-07 10:12:54 +00:00
2016-11-16 11:27:22 +00:00
/** @var \OC\App\AppManager $appManager */
2022-11-29 15:53:27 +00:00
$appManager = Server :: get ( \OCP\App\IAppManager :: class );
2015-07-07 10:12:54 +00:00
$tmpl = new OC_Template ( '' , 'update.admin' , 'guest' );
$tmpl -> assign ( 'version' , OC_Util :: getVersionString ());
2016-04-11 14:58:08 +00:00
$tmpl -> assign ( 'isAppsOnlyUpgrade' , $isAppsOnlyUpgrade );
2015-08-20 09:14:30 +00:00
// get third party apps
2015-12-18 14:26:54 +00:00
$ocVersion = \OCP\Util :: getVersion ();
2018-02-21 12:00:41 +00:00
$ocVersion = implode ( '.' , $ocVersion );
2016-11-02 08:40:10 +00:00
$incompatibleApps = $appManager -> getIncompatibleApps ( $ocVersion );
2021-11-30 15:45:51 +00:00
$incompatibleOverwrites = $systemConfig -> getValue ( 'app_install_overwrite' , []);
2016-11-16 11:27:22 +00:00
$incompatibleShippedApps = [];
2021-11-30 15:45:51 +00:00
$incompatibleDisabledApps = [];
2016-11-02 08:40:10 +00:00
foreach ( $incompatibleApps as $appInfo ) {
if ( $appManager -> isShipped ( $appInfo [ 'id' ])) {
2016-11-16 11:27:22 +00:00
$incompatibleShippedApps [] = $appInfo [ 'name' ] . ' (' . $appInfo [ 'id' ] . ')' ;
2016-11-02 08:40:10 +00:00
}
2021-11-30 15:45:51 +00:00
if ( ! in_array ( $appInfo [ 'id' ], $incompatibleOverwrites )) {
$incompatibleDisabledApps [] = $appInfo ;
}
2016-11-02 08:40:10 +00:00
}
2016-11-16 11:27:22 +00:00
if ( ! empty ( $incompatibleShippedApps )) {
2022-11-29 15:53:27 +00:00
$l = Server :: get ( \OCP\L10N\IFactory :: class ) -> get ( 'core' );
2023-05-09 09:19:48 +00:00
$hint = $l -> t ( 'Application %1$s is not present or has a non-compatible version with this server. Please check the apps directory.' , [ implode ( ', ' , $incompatibleShippedApps )]);
throw new \OCP\HintException ( 'Application ' . implode ( ', ' , $incompatibleShippedApps ) . ' is not present or has a non-compatible version with this server. Please check the apps directory.' , $hint );
2016-11-16 11:27:22 +00:00
}
2015-08-20 09:14:30 +00:00
$tmpl -> assign ( 'appsToUpgrade' , $appManager -> getAppsNeedingUpgrade ( $ocVersion ));
2021-11-30 15:45:51 +00:00
$tmpl -> assign ( 'incompatibleAppsList' , $incompatibleDisabledApps );
2021-03-22 15:32:35 +00:00
try {
$defaults = new \OC_Defaults ();
$tmpl -> assign ( 'productName' , $defaults -> getName ());
} catch ( Throwable $error ) {
$tmpl -> assign ( 'productName' , 'Nextcloud' );
}
2015-07-07 10:12:54 +00:00
$tmpl -> assign ( 'oldTheme' , $oldTheme );
$tmpl -> printPage ();
}
2022-11-29 15:29:12 +00:00
public static function initSession () : void {
2021-08-04 13:52:10 +00:00
$request = Server :: get ( IRequest :: class );
2023-03-20 11:27:44 +00:00
// TODO: Temporary disabled again to solve issues with CalDAV/CardDAV clients like DAVx5 that use cookies
// TODO: See https://github.com/nextcloud/server/issues/37277#issuecomment-1476366147 and the other comments
// TODO: for further information.
// $isDavRequest = strpos($request->getRequestUri(), '/remote.php/dav') === 0 || strpos($request->getRequestUri(), '/remote.php/webdav') === 0;
// if ($request->getHeader('Authorization') !== '' && is_null($request->getCookie('cookie_test')) && $isDavRequest && !isset($_COOKIE['nc_session_id'])) {
// setcookie('cookie_test', 'test', time() + 3600);
// // Do not initialize the session if a request is authenticated directly
// // unless there is a session cookie already sent along
// return;
// }
2021-08-04 13:52:10 +00:00
if ( $request -> getServerProtocol () === 'https' ) {
2021-04-26 10:44:05 +00:00
ini_set ( 'session.cookie_secure' , 'true' );
2017-12-12 13:33:30 +00:00
}
2013-01-14 19:30:28 +00:00
// prevents javascript from accessing php session cookies
2017-12-04 22:20:48 +00:00
ini_set ( 'session.cookie_httponly' , 'true' );
2013-01-14 19:30:28 +00:00
2016-06-22 06:41:10 +00:00
// set the cookie path to the Nextcloud directory
2013-07-02 15:45:34 +00:00
$cookie_path = OC :: $WEBROOT ? : '/' ;
2013-04-18 19:11:55 +00:00
ini_set ( 'session.cookie_path' , $cookie_path );
2013-04-05 22:16:52 +00:00
2014-05-12 15:08:28 +00:00
// Let the session name be changed in the initSession Hook
$sessionName = OC_Util :: getInstanceId ();
2013-07-02 15:45:34 +00:00
try {
2020-07-07 19:42:20 +00:00
// set the session name to the instance id - which is unique
$session = new \OC\Session\Internal ( $sessionName );
2015-07-20 10:59:04 +00:00
2022-11-29 17:07:27 +00:00
$cryptoWrapper = Server :: get ( \OC\Session\CryptoWrapper :: class );
2015-07-20 10:59:04 +00:00
$session = $cryptoWrapper -> wrapSession ( $session );
self :: $server -> setSession ( $session );
2016-04-07 17:51:27 +00:00
// if session can't be started break with http 500 error
2013-07-02 15:45:34 +00:00
} catch ( Exception $e ) {
2022-12-01 10:21:57 +00:00
Server :: get ( LoggerInterface :: class ) -> error ( $e -> getMessage (), [ 'app' => 'base' , 'exception' => $e ]);
2013-11-04 20:55:55 +00:00
//show the user a detailed error page
2018-06-26 10:15:09 +00:00
OC_Template :: printExceptionErrorPage ( $e , 500 );
2016-01-09 22:56:28 +00:00
die ();
2013-02-25 17:37:05 +00:00
}
2013-01-14 19:30:28 +00:00
2022-08-17 10:10:03 +00:00
//try to set the session lifetime
2013-06-26 07:19:19 +00:00
$sessionLifeTime = self :: getSessionLifeTime ();
2022-11-29 17:13:51 +00:00
@ ini_set ( 'gc_maxlifetime' , ( string ) $sessionLifeTime );
2013-01-14 19:30:28 +00:00
// session timeout
2014-07-16 17:40:22 +00:00
if ( $session -> exists ( 'LAST_ACTIVITY' ) && ( time () - $session -> get ( 'LAST_ACTIVITY' ) > $sessionLifeTime )) {
2013-01-14 19:30:28 +00:00
if ( isset ( $_COOKIE [ session_name ()])) {
2018-09-06 18:34:16 +00:00
setcookie ( session_name (), '' , - 1 , self :: $WEBROOT ? : '/' );
2013-01-14 19:30:28 +00:00
}
2022-11-29 15:53:27 +00:00
Server :: get ( IUserSession :: class ) -> logout ();
2013-01-14 19:30:28 +00:00
}
2013-05-27 23:04:09 +00:00
2022-08-16 08:09:14 +00:00
if ( ! self :: hasSessionRelaxedExpiry ()) {
$session -> set ( 'LAST_ACTIVITY' , time ());
}
2022-04-26 10:57:58 +00:00
$session -> close ();
2013-01-14 19:30:28 +00:00
}
2022-11-29 17:07:27 +00:00
private static function getSessionLifeTime () : int {
return Server :: get ( \OC\AllConfig :: class ) -> getSystemValueInt ( 'session_lifetime' , 60 * 60 * 24 );
2013-06-26 07:19:19 +00:00
}
2022-08-16 08:09:14 +00:00
/**
* @ return bool true if the session expiry should only be done by gc instead of an explicit timeout
*/
public static function hasSessionRelaxedExpiry () : bool {
2022-11-29 17:07:27 +00:00
return Server :: get ( \OC\AllConfig :: class ) -> getSystemValueBool ( 'session_relaxed_expiry' , false );
2022-08-16 08:09:14 +00:00
}
2022-05-16 13:54:18 +00:00
/**
* Try to set some values to the required Nextcloud default
*/
2022-11-29 15:29:12 +00:00
public static function setRequiredIniValues () : void {
2022-05-16 13:54:18 +00:00
@ ini_set ( 'default_charset' , 'UTF-8' );
@ ini_set ( 'gd.jpeg_ignore_warning' , '1' );
}
2016-07-20 15:37:30 +00:00
/**
* Send the same site cookies
*/
2022-11-29 15:29:12 +00:00
private static function sendSameSiteCookies () : void {
2016-07-20 15:37:30 +00:00
$cookieParams = session_get_cookie_params ();
$secureCookie = ( $cookieParams [ 'secure' ] === true ) ? 'secure; ' : '' ;
$policies = [
'lax' ,
'strict' ,
];
2016-11-23 11:53:44 +00:00
// Append __Host to the cookie if it meets the requirements
$cookiePrefix = '' ;
2020-04-10 12:19:56 +00:00
if ( $cookieParams [ 'secure' ] === true && $cookieParams [ 'path' ] === '/' ) {
2016-11-23 11:53:44 +00:00
$cookiePrefix = '__Host-' ;
}
2020-04-10 12:19:56 +00:00
foreach ( $policies as $policy ) {
2016-07-20 15:37:30 +00:00
header (
sprintf (
2016-11-23 11:53:44 +00:00
'Set-Cookie: %snc_sameSiteCookie%s=true; path=%s; httponly;' . $secureCookie . 'expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=%s' ,
$cookiePrefix ,
2016-07-20 15:37:30 +00:00
$policy ,
$cookieParams [ 'path' ],
$policy
),
false
);
}
}
/**
* Same Site cookie to further mitigate CSRF attacks . This cookie has to
* be set in every request if cookies are sent to add a second level of
* defense against CSRF .
*
* If the cookie is not sent this will set the cookie and reload the page .
* We use an additional cookie since we want to protect logout CSRF and
* also we can 't directly interfere with PHP' s session mechanism .
*/
2022-11-29 15:29:12 +00:00
private static function performSameSiteCookieProtection ( \OCP\IConfig $config ) : void {
2021-08-04 13:52:10 +00:00
$request = Server :: get ( IRequest :: class );
2016-09-08 15:14:32 +00:00
// Some user agents are notorious and don't really properly follow HTTP
// specifications. For those, have an automated opt-out. Since the protection
// for remote.php is applied in base.php as starting point we need to opt out
// here.
2021-01-20 20:55:16 +00:00
$incompatibleUserAgents = $config -> getSystemValue ( 'csrf.optout' );
2018-01-31 13:17:56 +00:00
// Fallback, if csrf.optout is unset
if ( ! is_array ( $incompatibleUserAgents )) {
$incompatibleUserAgents = [
// OS X Finder
'/^WebDAVFS/' ,
// Windows webdav drive
'/^Microsoft-WebDAV-MiniRedir/' ,
];
}
2020-04-10 12:19:56 +00:00
if ( $request -> isUserAgent ( $incompatibleUserAgents )) {
2016-09-08 15:14:32 +00:00
return ;
}
2020-04-10 12:19:56 +00:00
if ( count ( $_COOKIE ) > 0 ) {
2016-07-20 15:37:30 +00:00
$requestUri = $request -> getScriptName ();
$processingScript = explode ( '/' , $requestUri );
2020-10-05 13:12:57 +00:00
$processingScript = $processingScript [ count ( $processingScript ) - 1 ];
2017-09-27 06:28:09 +00:00
2017-09-22 10:21:44 +00:00
// index.php routes are handled in the middleware
2020-04-10 12:19:56 +00:00
if ( $processingScript === 'index.php' ) {
2017-09-22 10:21:44 +00:00
return ;
}
// All other endpoints require the lax and the strict cookie
2020-04-10 12:19:56 +00:00
if ( ! $request -> passesStrictCookieCheck ()) {
2023-03-20 15:26:41 +00:00
logger ( 'core' ) -> warning ( 'Request does not pass strict cookie check' );
2017-09-22 10:21:44 +00:00
self :: sendSameSiteCookies ();
// Debug mode gets access to the resources without strict cookie
// due to the fact that the SabreDAV browser also lives there.
2023-04-05 10:50:08 +00:00
if ( ! $config -> getSystemValueBool ( 'debug' , false )) {
2023-03-21 08:11:00 +00:00
http_response_code ( \OCP\AppFramework\Http :: STATUS_PRECONDITION_FAILED );
header ( 'Content-Type: application/json' );
echo json_encode ([ 'error' => 'Strict Cookie has not been found in request' ]);
2016-07-20 15:37:30 +00:00
exit ();
}
}
2020-04-10 12:19:56 +00:00
} elseif ( ! isset ( $_COOKIE [ 'nc_sameSiteCookielax' ]) || ! isset ( $_COOKIE [ 'nc_sameSiteCookiestrict' ])) {
2016-07-20 15:37:30 +00:00
self :: sendSameSiteCookies ();
}
}
2022-11-29 15:29:12 +00:00
public static function init () : void {
2023-07-12 07:23:37 +00:00
// prevent any XML processing from loading external entities
libxml_set_external_entity_loader ( static function () {
return null ;
});
2015-08-18 13:35:02 +00:00
// calculate the root directories
OC :: $SERVERROOT = str_replace ( " \\ " , '/' , substr ( __DIR__ , 0 , - 4 ));
2013-01-14 19:30:28 +00:00
// register autoloader
2014-10-15 11:53:19 +00:00
$loaderStart = microtime ( true );
2013-05-07 20:53:07 +00:00
require_once __DIR__ . '/autoloader.php' ;
2015-08-18 13:35:02 +00:00
self :: $loader = new \OC\Autoloader ([
2016-05-19 13:32:20 +00:00
OC :: $SERVERROOT . '/lib/private/legacy' ,
2015-08-18 13:35:02 +00:00
]);
2016-01-10 20:36:14 +00:00
if ( defined ( 'PHPUNIT_RUN' )) {
self :: $loader -> addValidRoot ( OC :: $SERVERROOT . '/tests' );
}
2020-03-26 08:30:18 +00:00
spl_autoload_register ([ self :: $loader , 'load' ]);
2014-10-15 11:53:19 +00:00
$loaderEnd = microtime ( true );
2013-01-14 19:30:28 +00:00
2015-02-23 20:49:35 +00:00
self :: $CLI = ( php_sapi_name () == 'cli' );
2023-09-08 14:40:48 +00:00
// Add default composer PSR-4 autoloader, ensure apcu to be disabled
2016-05-02 12:10:53 +00:00
self :: $composerAutoloader = require_once OC :: $SERVERROOT . '/lib/composer/autoload.php' ;
2023-09-08 14:40:48 +00:00
self :: $composerAutoloader -> setApcuPrefix ( null );
2016-04-22 13:28:09 +00:00
2015-03-18 10:48:51 +00:00
try {
self :: initPaths ();
// setup 3rdparty autoloader
2016-04-14 15:59:49 +00:00
$vendorAutoLoad = OC :: $SERVERROOT . '/3rdparty/autoload.php' ;
2015-03-18 10:48:51 +00:00
if ( ! file_exists ( $vendorAutoLoad )) {
2015-09-03 12:55:26 +00:00
throw new \RuntimeException ( 'Composer autoloader not found, unable to continue. Check the folder "3rdparty". Running "git submodule update --init" will initialize the git submodule that handles the subfolder "3rdparty".' );
2015-03-18 10:48:51 +00:00
}
2014-11-17 12:10:15 +00:00
require_once $vendorAutoLoad ;
2015-03-18 10:48:51 +00:00
} catch ( \RuntimeException $e ) {
2016-03-09 14:40:34 +00:00
if ( ! self :: $CLI ) {
2018-06-26 08:32:50 +00:00
http_response_code ( 503 );
2016-03-09 14:40:34 +00:00
}
2015-01-31 15:04:24 +00:00
// we can't use the template error page here, because this needs the
// DI container which isn't available yet
2015-03-18 10:48:51 +00:00
print ( $e -> getMessage ());
2015-01-31 15:04:24 +00:00
exit ();
2014-07-29 01:48:17 +00:00
}
// setup the basic server
2015-12-18 10:24:15 +00:00
self :: $server = new \OC\Server ( \OC :: $WEBROOT , self :: $config );
2020-04-22 13:21:15 +00:00
self :: $server -> boot ();
2022-02-11 08:08:02 +00:00
2022-11-29 17:07:27 +00:00
$eventLogger = Server :: get ( \OCP\Diagnostics\IEventLogger :: class );
2021-01-20 20:55:16 +00:00
$eventLogger -> log ( 'autoloader' , 'Autoloader' , $loaderStart , $loaderEnd );
$eventLogger -> start ( 'boot' , 'Initialize' );
2013-01-14 19:30:28 +00:00
2020-03-09 19:01:05 +00:00
// Override php.ini and log everything if we're troubleshooting
if ( self :: $config -> getValue ( 'loglevel' ) === ILogger :: DEBUG ) {
2020-03-09 19:59:54 +00:00
error_reporting ( E_ALL );
2020-03-09 19:01:05 +00:00
}
2015-05-05 10:34:22 +00:00
// Don't display errors and log them
2017-12-04 22:20:48 +00:00
@ ini_set ( 'display_errors' , '0' );
@ ini_set ( 'log_errors' , '1' );
2013-01-14 19:30:28 +00:00
2020-04-10 12:19:56 +00:00
if ( ! date_default_timezone_set ( 'UTC' )) {
2016-10-24 13:03:18 +00:00
throw new \RuntimeException ( 'Could not set timezone to UTC' );
2018-01-26 22:46:40 +00:00
}
2013-01-14 19:30:28 +00:00
2022-04-29 06:21:53 +00:00
2013-01-14 19:30:28 +00:00
//try to configure php to enable big file uploads.
2022-04-29 06:21:53 +00:00
//this doesn´ t work always depending on the webserver and php configuration.
//Let´ s try to overwrite some defaults if they are smaller than 1 hour
2022-05-16 08:14:53 +00:00
if ( intval ( @ ini_get ( 'max_execution_time' ) ? ? 0 ) < 3600 ) {
2022-04-30 14:30:11 +00:00
@ ini_set ( 'max_execution_time' , strval ( 3600 ));
2022-04-29 06:21:53 +00:00
}
2022-05-16 08:14:53 +00:00
if ( intval ( @ ini_get ( 'max_input_time' ) ? ? 0 ) < 3600 ) {
2022-04-30 14:30:11 +00:00
@ ini_set ( 'max_input_time' , strval ( 3600 ));
2022-04-29 06:21:53 +00:00
}
2013-01-14 19:30:28 +00:00
2022-04-29 06:21:53 +00:00
//try to set the maximum execution time to the largest time limit we have
2017-03-11 16:04:21 +00:00
if ( strpos ( @ ini_get ( 'disable_functions' ), 'set_time_limit' ) === false ) {
2022-05-16 08:14:53 +00:00
@ set_time_limit ( max ( intval ( @ ini_get ( 'max_execution_time' )), intval ( @ ini_get ( 'max_input_time' ))));
2017-03-11 16:04:21 +00:00
}
2013-01-14 19:30:28 +00:00
2022-05-16 13:54:18 +00:00
self :: setRequiredIniValues ();
2014-07-19 00:16:28 +00:00
self :: handleAuthHeaders ();
2022-11-29 15:53:27 +00:00
$systemConfig = Server :: get ( \OC\SystemConfig :: class );
2021-01-20 20:55:16 +00:00
self :: registerAutoloaderCache ( $systemConfig );
2014-07-29 09:14:36 +00:00
2021-01-07 14:55:49 +00:00
// initialize intl fallback if necessary
2014-07-29 01:48:17 +00:00
OC_Util :: isSetLocaleWorking ();
2014-09-09 12:41:45 +00:00
2022-11-29 15:53:27 +00:00
$config = Server :: get ( \OCP\IConfig :: class );
2013-07-21 20:40:35 +00:00
if ( ! defined ( 'PHPUNIT_RUN' )) {
2022-05-24 06:39:20 +00:00
$errorHandler = new OC\Log\ErrorHandler (
\OCP\Server :: get ( \Psr\Log\LoggerInterface :: class ),
);
$exceptionHandler = [ $errorHandler , 'onException' ];
2023-04-05 10:50:08 +00:00
if ( $config -> getSystemValueBool ( 'debug' , false )) {
2022-05-24 06:39:20 +00:00
set_error_handler ([ $errorHandler , 'onAll' ], E_ALL );
if ( \OC :: $CLI ) {
$exceptionHandler = [ 'OC_Template' , 'printExceptionErrorPage' ];
}
} else {
set_error_handler ([ $errorHandler , 'onError' ]);
}
register_shutdown_function ([ $errorHandler , 'onShutdown' ]);
set_exception_handler ( $exceptionHandler );
2013-02-15 02:15:09 +00:00
}
2020-05-07 19:10:30 +00:00
/** @var \OC\AppFramework\Bootstrap\Coordinator $bootstrapCoordinator */
2022-11-29 15:53:27 +00:00
$bootstrapCoordinator = Server :: get ( \OC\AppFramework\Bootstrap\Coordinator :: class );
2020-11-16 18:41:22 +00:00
$bootstrapCoordinator -> runInitialRegistration ();
2020-05-07 19:10:30 +00:00
2021-01-20 20:55:16 +00:00
$eventLogger -> start ( 'init_session' , 'Initialize session' );
2020-03-26 08:30:18 +00:00
OC_App :: loadApps ([ 'session' ]);
2014-11-26 12:16:22 +00:00
if ( ! self :: $CLI ) {
2014-07-25 17:39:29 +00:00
self :: initSession ();
2013-04-19 13:18:27 +00:00
}
2021-01-20 20:55:16 +00:00
$eventLogger -> end ( 'init_session' );
2013-05-31 15:31:52 +00:00
self :: checkConfig ();
2021-01-20 20:55:16 +00:00
self :: checkInstalled ( $systemConfig );
2015-01-19 10:56:04 +00:00
2014-05-12 13:14:01 +00:00
OC_Response :: addSecurityHeaders ();
2013-01-14 19:30:28 +00:00
2021-01-20 20:55:16 +00:00
self :: performSameSiteCookieProtection ( $config );
2016-07-20 15:37:30 +00:00
2015-04-07 22:19:23 +00:00
if ( ! defined ( 'OC_CONSOLE' )) {
2021-01-20 20:55:16 +00:00
$errors = OC_Util :: checkServer ( $systemConfig );
2015-04-07 22:19:23 +00:00
if ( count ( $errors ) > 0 ) {
2019-09-16 17:38:13 +00:00
if ( ! self :: $CLI ) {
http_response_code ( 503 );
OC_Util :: addStyle ( 'guest' );
2015-04-07 22:19:23 +00:00
try {
2020-03-26 08:30:18 +00:00
OC_Template :: printGuestPage ( '' , 'error' , [ 'errors' => $errors ]);
2019-09-16 17:38:13 +00:00
exit ;
2015-04-07 22:19:23 +00:00
} catch ( \Exception $e ) {
2019-09-16 17:38:13 +00:00
// In case any error happens when showing the error page, we simply fall back to posting the text.
// This might be the case when e.g. the data directory is broken and we can not load/write SCSS to/from it.
2015-04-07 22:19:23 +00:00
}
2015-02-27 19:04:52 +00:00
}
2019-09-16 17:38:13 +00:00
// Convert l10n string into regular string for usage in database
$staticErrors = [];
foreach ( $errors as $error ) {
echo $error [ 'error' ] . " \n " ;
echo $error [ 'hint' ] . " \n \n " ;
$staticErrors [] = [
'error' => ( string ) $error [ 'error' ],
'hint' => ( string ) $error [ 'hint' ],
];
}
try {
2021-01-20 20:55:16 +00:00
$config -> setAppValue ( 'core' , 'cronErrors' , json_encode ( $staticErrors ));
2019-09-16 17:38:13 +00:00
} catch ( \Exception $e ) {
echo ( 'Writing to database failed' );
}
exit ( 1 );
2023-04-05 10:50:08 +00:00
} elseif ( self :: $CLI && $config -> getSystemValueBool ( 'installed' , false )) {
2021-01-20 20:55:16 +00:00
$config -> deleteAppValue ( 'core' , 'cronErrors' );
2015-04-07 22:19:23 +00:00
}
2013-01-14 19:30:28 +00:00
}
2013-06-26 07:19:19 +00:00
2013-01-14 19:30:28 +00:00
// User and Groups
2014-11-28 17:52:09 +00:00
if ( ! $systemConfig -> getValue ( " installed " , false )) {
2014-07-16 17:40:22 +00:00
self :: $server -> getSession () -> set ( 'user_id' , '' );
2013-01-14 19:30:28 +00:00
}
2016-05-04 06:34:39 +00:00
OC_User :: useBackend ( new \OC\User\Database ());
2022-11-29 17:07:27 +00:00
Server :: get ( \OCP\IGroupManager :: class ) -> addBackend ( new \OC\Group\Database ());
2013-12-11 13:01:48 +00:00
2015-10-05 09:50:36 +00:00
// Subscribe to the hook
\OCP\Util :: connectHook (
'\OCA\Files_Sharing\API\Server2Server' ,
'preLoginNameUsedAsUserName' ,
2016-05-24 08:42:11 +00:00
'\OC\User\Database' ,
2015-10-05 09:50:36 +00:00
'preLoginNameUsedAsUserName'
);
2013-01-14 19:30:28 +00:00
//setup extra user backends
2017-11-30 15:00:19 +00:00
if ( ! \OCP\Util :: needUpgrade ()) {
2014-09-08 10:30:04 +00:00
OC_User :: setupBackends ();
2016-05-12 09:56:58 +00:00
} else {
// Run upgrades in incognito mode
OC_User :: setIncognitoMode ( true );
2014-09-08 10:30:04 +00:00
}
2013-01-14 19:30:28 +00:00
2021-01-20 20:55:16 +00:00
self :: registerCleanupHooks ( $systemConfig );
self :: registerShareHooks ( $systemConfig );
self :: registerEncryptionWrapperAndHooks ();
2016-11-23 20:19:06 +00:00
self :: registerAccountHooks ();
2019-02-22 14:04:59 +00:00
self :: registerResourceCollectionHooks ();
2022-08-30 17:53:12 +00:00
self :: registerFileReferenceEventListener ();
2022-12-02 12:06:59 +00:00
self :: registerRenderReferenceEventListener ();
2019-06-25 13:20:06 +00:00
self :: registerAppRestrictionsHooks ();
2013-01-14 19:30:28 +00:00
2018-01-29 12:15:05 +00:00
// Make sure that the application class is not loaded before the database is setup
if ( $systemConfig -> getValue ( " installed " , false )) {
2019-09-17 14:33:27 +00:00
OC_App :: loadApp ( 'settings' );
2022-02-03 15:12:37 +00:00
/* Build core application to make sure that listeners are registered */
2022-11-29 15:53:27 +00:00
Server :: get ( \OC\Core\Application :: class );
2018-01-29 12:15:05 +00:00
}
2017-04-12 13:19:45 +00:00
2013-01-14 19:30:28 +00:00
//make sure temporary files are cleaned up
2022-11-29 17:07:27 +00:00
$tmpManager = Server :: get ( \OCP\ITempManager :: class );
2020-03-26 08:30:18 +00:00
register_shutdown_function ([ $tmpManager , 'clean' ]);
2022-11-29 17:07:27 +00:00
$lockProvider = Server :: get ( \OCP\Lock\ILockingProvider :: class );
2020-03-26 08:30:18 +00:00
register_shutdown_function ([ $lockProvider , 'releaseAll' ]);
2013-01-14 19:30:28 +00:00
2014-08-13 22:06:19 +00:00
// Check whether the sample configuration has been copied
2020-04-10 12:19:56 +00:00
if ( $systemConfig -> getValue ( 'copied_sample_config' , false )) {
2022-11-29 15:53:27 +00:00
$l = Server :: get ( \OCP\L10N\IFactory :: class ) -> get ( 'lib' );
2014-08-13 22:06:19 +00:00
OC_Template :: printErrorPage (
$l -> t ( 'Sample configuration detected' ),
2018-06-26 07:17:37 +00:00
$l -> t ( 'It has been detected that the sample configuration has been copied. This can break your installation and is unsupported. Please read the documentation before performing changes on config.php' ),
2018-07-05 15:09:38 +00:00
503
2014-08-13 22:06:19 +00:00
);
return ;
}
2014-09-05 12:10:35 +00:00
2021-08-04 13:52:10 +00:00
$request = Server :: get ( IRequest :: class );
2015-02-10 12:02:48 +00:00
$host = $request -> getInsecureServerHost ();
/**
* if the host passed in headers isn ' t trusted
* FIXME : Should not be in here at all : see_no_evil :
*/
2014-09-05 12:10:35 +00:00
if ( ! OC :: $CLI
2022-11-29 17:07:27 +00:00
&& ! Server :: get ( \OC\Security\TrustedDomainHelper :: class ) -> isTrustedDomain ( $host )
2023-04-05 10:50:08 +00:00
&& $config -> getSystemValueBool ( 'installed' , false )
2014-09-05 12:10:35 +00:00
) {
2017-01-09 11:52:43 +00:00
// Allow access to CSS resources
$isScssRequest = false ;
2022-11-29 17:07:27 +00:00
if ( strpos ( $request -> getPathInfo () ? : '' , '/css/' ) === 0 ) {
2017-01-09 11:52:43 +00:00
$isScssRequest = true ;
}
2020-04-10 12:19:56 +00:00
if ( substr ( $request -> getRequestUri (), - 11 ) === '/status.php' ) {
2018-06-26 08:32:50 +00:00
http_response_code ( 400 );
2018-01-22 14:58:57 +00:00
header ( 'Content-Type: application/json' );
echo '{"error": "Trusted domain error.", "code": 15}' ;
exit ();
}
2017-01-09 11:52:43 +00:00
if ( ! $isScssRequest ) {
2018-06-26 08:32:50 +00:00
http_response_code ( 400 );
2022-12-01 10:21:57 +00:00
Server :: get ( LoggerInterface :: class ) -> info (
2015-11-10 10:13:25 +00:00
'Trusted domain error. "{remoteAddress}" tried to access using "{host}" as host.' ,
[
'app' => 'core' ,
'remoteAddress' => $request -> getRemoteAddress (),
'host' => $host ,
]
2017-01-09 11:52:43 +00:00
);
2015-11-10 10:13:25 +00:00
2017-01-09 11:52:43 +00:00
$tmpl = new OCP\Template ( 'core' , 'untrustedDomain' , 'guest' );
2022-11-29 15:53:27 +00:00
$tmpl -> assign ( 'docUrl' , Server :: get ( IURLGenerator :: class ) -> linkToDocs ( 'admin-trusted-domains' ));
2017-01-09 11:52:43 +00:00
$tmpl -> printPage ();
2014-09-08 14:15:31 +00:00
2017-01-09 11:52:43 +00:00
exit ();
}
2014-09-05 12:10:35 +00:00
}
2021-01-20 20:55:16 +00:00
$eventLogger -> end ( 'boot' );
2022-02-11 08:08:02 +00:00
$eventLogger -> log ( 'init' , 'OC::init' , $loaderStart , microtime ( true ));
2022-05-16 11:25:45 +00:00
$eventLogger -> start ( 'runtime' , 'Runtime' );
$eventLogger -> start ( 'request' , 'Full request after boot' );
register_shutdown_function ( function () use ( $eventLogger ) {
$eventLogger -> end ( 'request' );
});
2013-01-14 19:30:28 +00:00
}
2015-06-05 12:21:17 +00:00
/**
2017-11-23 12:37:50 +00:00
* register hooks for the cleanup of cache and bruteforce protection
2015-06-05 12:21:17 +00:00
*/
2022-11-29 15:29:12 +00:00
public static function registerCleanupHooks ( \OC\SystemConfig $systemConfig ) : void {
2015-06-05 12:21:17 +00:00
//don't try to do this before we are properly setup
2021-01-20 20:55:16 +00:00
if ( $systemConfig -> getValue ( 'installed' , false ) && ! \OCP\Util :: needUpgrade ()) {
2015-06-05 12:21:17 +00:00
// NOTE: This will be replaced to use OCP
2022-11-29 17:07:27 +00:00
$userSession = Server :: get ( \OC\User\Session :: class );
2017-11-23 12:37:50 +00:00
$userSession -> listen ( '\OC\User' , 'postLogin' , function () use ( $userSession ) {
2020-04-03 20:51:46 +00:00
if ( ! defined ( 'PHPUNIT_RUN' ) && $userSession -> isLoggedIn ()) {
2017-11-23 12:37:50 +00:00
// reset brute force delay for this IP address and username
2022-11-29 15:53:27 +00:00
$uid = $userSession -> getUser () -> getUID ();
2021-08-04 13:52:10 +00:00
$request = Server :: get ( IRequest :: class );
2023-08-28 13:50:45 +00:00
$throttler = Server :: get ( IThrottler :: class );
2017-11-23 12:37:50 +00:00
$throttler -> resetDelay ( $request -> getRemoteAddress (), 'login' , [ 'user' => $uid ]);
}
2023-02-21 06:36:43 +00:00
try {
$cache = new \OC\Cache\File ();
$cache -> gc ();
} catch ( \OC\ServerNotAvailableException $e ) {
// not a GC exception, pass it on
throw $e ;
} catch ( \OC\ForbiddenException $e ) {
// filesystem blocked for this request, ignore
} catch ( \Exception $e ) {
// a GC exception should not prevent users from using OC,
// so log the exception
Server :: get ( LoggerInterface :: class ) -> warning ( 'Exception when running cache gc.' , [
'app' => 'core' ,
'exception' => $e ,
]);
}
2015-06-08 12:13:38 +00:00
});
2015-06-05 12:21:17 +00:00
}
}
2022-11-29 15:29:12 +00:00
private static function registerEncryptionWrapperAndHooks () : void {
2022-11-29 17:07:27 +00:00
$manager = Server :: get ( \OCP\Encryption\IManager :: class );
2016-03-30 21:20:37 +00:00
\OCP\Util :: connectHook ( 'OC_Filesystem' , 'preSetup' , $manager , 'setupStorage' );
2015-01-14 19:39:23 +00:00
2021-01-20 20:55:16 +00:00
$enabled = $manager -> isEnabled ();
2015-01-14 19:39:23 +00:00
if ( $enabled ) {
2018-01-25 22:16:13 +00:00
\OCP\Util :: connectHook ( Share :: class , 'post_shared' , HookManager :: class , 'postShared' );
\OCP\Util :: connectHook ( Share :: class , 'post_unshare' , HookManager :: class , 'postUnshared' );
\OCP\Util :: connectHook ( 'OC_Filesystem' , 'post_rename' , HookManager :: class , 'postRename' );
\OCP\Util :: connectHook ( '\OCA\Files_Trashbin\Trashbin' , 'post_restore' , HookManager :: class , 'postRestore' );
2015-01-14 19:39:23 +00:00
}
}
2022-11-29 15:29:12 +00:00
private static function registerAccountHooks () : void {
2021-06-15 17:32:39 +00:00
/** @var IEventDispatcher $dispatcher */
2022-11-29 15:53:27 +00:00
$dispatcher = Server :: get ( IEventDispatcher :: class );
2021-06-15 17:32:39 +00:00
$dispatcher -> addServiceListener ( UserChangedEvent :: class , \OC\Accounts\Hooks :: class );
2016-11-23 20:19:06 +00:00
}
2022-11-29 15:29:12 +00:00
private static function registerAppRestrictionsHooks () : void {
2020-10-14 11:00:20 +00:00
/** @var \OC\Group\Manager $groupManager */
2022-11-29 15:53:27 +00:00
$groupManager = Server :: get ( \OCP\IGroupManager :: class );
2020-04-09 14:05:56 +00:00
$groupManager -> listen ( '\OC\Group' , 'postDelete' , function ( \OCP\IGroup $group ) {
2022-11-29 15:53:27 +00:00
$appManager = Server :: get ( \OCP\App\IAppManager :: class );
2019-06-25 13:20:06 +00:00
$apps = $appManager -> getEnabledAppsForGroup ( $group );
foreach ( $apps as $appId ) {
$restrictions = $appManager -> getAppRestriction ( $appId );
if ( empty ( $restrictions )) {
continue ;
}
$key = array_search ( $group -> getGID (), $restrictions );
unset ( $restrictions [ $key ]);
$restrictions = array_values ( $restrictions );
if ( empty ( $restrictions )) {
$appManager -> disableApp ( $appId );
2020-04-10 12:19:56 +00:00
} else {
2019-06-25 13:20:06 +00:00
$appManager -> enableAppForGroups ( $appId , $restrictions );
}
}
});
}
2022-11-29 15:29:12 +00:00
private static function registerResourceCollectionHooks () : void {
2023-07-27 21:01:40 +00:00
\OC\Collaboration\Resources\Listener :: register ( Server :: get ( IEventDispatcher :: class ));
2019-02-22 14:04:59 +00:00
}
2022-11-29 15:29:12 +00:00
private static function registerFileReferenceEventListener () : void {
2022-08-30 17:53:12 +00:00
\OC\Collaboration\Reference\File\FileReferenceEventListener :: register ( Server :: get ( IEventDispatcher :: class ));
}
2022-12-02 12:06:59 +00:00
private static function registerRenderReferenceEventListener () {
\OC\Collaboration\Reference\RenderReferenceEventListener :: register ( Server :: get ( IEventDispatcher :: class ));
}
2013-01-14 19:30:28 +00:00
/**
* register hooks for sharing
*/
2022-11-29 15:29:12 +00:00
public static function registerShareHooks ( \OC\SystemConfig $systemConfig ) : void {
2021-01-20 20:55:16 +00:00
if ( $systemConfig -> getValue ( 'installed' )) {
2018-01-25 22:16:13 +00:00
OC_Hook :: connect ( 'OC_User' , 'post_deleteUser' , Hooks :: class , 'post_deleteUser' );
OC_Hook :: connect ( 'OC_User' , 'post_deleteGroup' , Hooks :: class , 'post_deleteGroup' );
2020-07-27 10:12:11 +00:00
2020-07-07 19:17:25 +00:00
/** @var IEventDispatcher $dispatcher */
2022-11-29 15:53:27 +00:00
$dispatcher = Server :: get ( IEventDispatcher :: class );
2020-07-27 10:12:11 +00:00
$dispatcher -> addServiceListener ( UserRemovedEvent :: class , \OC\Share20\UserRemovedListener :: class );
2013-05-16 23:20:02 +00:00
}
2013-01-14 19:30:28 +00:00
}
2022-11-29 15:29:12 +00:00
protected static function registerAutoloaderCache ( \OC\SystemConfig $systemConfig ) : void {
2014-07-29 09:18:40 +00:00
// The class loader takes an optional low-latency cache, which MUST be
// namespaced. The instanceid is used for namespacing, but might be
2016-04-07 17:51:27 +00:00
// unavailable at this point. Furthermore, it might not be possible to
2014-07-29 09:18:40 +00:00
// generate an instanceid via \OC_Util::getInstanceId() because the
// config file may not be writable. As such, we only register a class
// loader cache if instanceid is available without trying to create one.
2021-01-20 20:55:16 +00:00
$instanceId = $systemConfig -> getValue ( 'instanceid' , null );
2014-07-29 09:18:40 +00:00
if ( $instanceId ) {
try {
2022-11-29 17:07:27 +00:00
$memcacheFactory = Server :: get ( \OCP\ICacheFactory :: class );
2015-01-14 18:25:00 +00:00
self :: $loader -> setMemoryCache ( $memcacheFactory -> createLocal ( 'Autoloader' ));
2014-07-29 09:18:40 +00:00
} catch ( \Exception $ex ) {
}
}
}
2013-01-14 19:30:28 +00:00
/**
2014-05-19 15:50:53 +00:00
* Handle the request
2013-01-14 19:30:28 +00:00
*/
2022-11-29 17:07:27 +00:00
public static function handleRequest () : void {
Server :: get ( \OCP\Diagnostics\IEventLogger :: class ) -> start ( 'handle_request' , 'Handle request' );
$systemConfig = Server :: get ( \OC\SystemConfig :: class );
2013-01-17 20:42:33 +00:00
2016-06-22 06:41:10 +00:00
// Check if Nextcloud is installed or in maintenance (update) mode
2014-11-28 17:52:09 +00:00
if ( ! $systemConfig -> getValue ( 'installed' , false )) {
2014-10-31 10:21:00 +00:00
\OC :: $server -> getSession () -> clear ();
2024-01-29 14:12:53 +00:00
$controller = Server :: get ( \OC\Core\Controller\SetupController :: class );
2013-09-10 18:19:42 +00:00
$controller -> run ( $_POST );
2013-01-30 21:55:33 +00:00
exit ();
}
2013-02-05 22:33:44 +00:00
2021-08-04 13:52:10 +00:00
$request = Server :: get ( IRequest :: class );
2016-03-17 16:32:38 +00:00
$requestPath = $request -> getRawPathInfo ();
2016-08-30 13:44:00 +00:00
if ( $requestPath === '/heartbeat' ) {
return ;
}
2015-07-07 15:29:54 +00:00
if ( substr ( $requestPath , - 3 ) !== '.js' ) { // we need these files during the upgrade
2021-01-20 20:55:16 +00:00
self :: checkMaintenanceMode ( $systemConfig );
2017-11-30 15:00:19 +00:00
if ( \OCP\Util :: needUpgrade ()) {
if ( function_exists ( 'opcache_reset' )) {
opcache_reset ();
}
2019-02-06 16:08:41 +00:00
if ( ! (( bool ) $systemConfig -> getValue ( 'maintenance' , false ))) {
2017-11-30 15:01:42 +00:00
self :: printUpgradePage ( $systemConfig );
2017-11-30 15:00:19 +00:00
exit ();
}
}
2013-01-30 22:05:44 +00:00
}
2013-01-30 21:55:33 +00:00
2016-07-07 10:14:39 +00:00
// Always load authentication apps
OC_App :: loadApps ([ 'authentication' ]);
2023-04-12 10:34:38 +00:00
OC_App :: loadApps ([ 'extended_authentication' ]);
2015-02-24 17:00:26 +00:00
2015-01-09 19:59:23 +00:00
// Load minimum set of apps
2017-11-30 15:00:19 +00:00
if ( ! \OCP\Util :: needUpgrade ()
2019-02-06 16:08:41 +00:00
&& ! (( bool ) $systemConfig -> getValue ( 'maintenance' , false ))) {
2015-01-09 19:59:23 +00:00
// For logged-in users: Load everything
2022-11-29 15:53:27 +00:00
if ( Server :: get ( IUserSession :: class ) -> isLoggedIn ()) {
2015-01-09 19:59:23 +00:00
OC_App :: loadApps ();
} else {
2015-02-24 17:00:26 +00:00
// For guests: Load only filesystem and logging
2020-03-26 08:30:18 +00:00
OC_App :: loadApps ([ 'filesystem' , 'logging' ]);
2021-10-19 11:03:23 +00:00
// Don't try to login when a client is trying to get a OAuth token.
// OAuth needs to support basic auth too, so the login is not valid
// inside Nextcloud and the Login exception would ruin it.
if ( $request -> getRawPathInfo () !== '/apps/oauth2/api/v1/token' ) {
self :: handleLogin ( $request );
}
2015-01-09 19:59:23 +00:00
}
}
2016-04-18 10:14:07 +00:00
if ( ! self :: $CLI ) {
2013-02-07 16:53:38 +00:00
try {
2019-02-06 16:08:41 +00:00
if ( ! (( bool ) $systemConfig -> getValue ( 'maintenance' , false )) && ! \OCP\Util :: needUpgrade ()) {
2020-03-26 08:30:18 +00:00
OC_App :: loadApps ([ 'filesystem' , 'logging' ]);
2014-06-24 15:37:58 +00:00
OC_App :: loadApps ();
2013-03-03 22:03:47 +00:00
}
2022-11-29 15:53:27 +00:00
Server :: get ( \OC\Route\Router :: class ) -> match ( $request -> getRawPathInfo ());
2013-02-07 16:53:38 +00:00
return ;
} catch ( Symfony\Component\Routing\Exception\ResourceNotFoundException $e ) {
//header('HTTP/1.0 404 Not Found');
} catch ( Symfony\Component\Routing\Exception\MethodNotAllowedException $e ) {
2018-06-26 08:32:50 +00:00
http_response_code ( 405 );
2013-02-07 16:53:38 +00:00
return ;
}
2013-01-14 19:30:28 +00:00
}
2013-01-30 22:05:44 +00:00
2013-01-25 13:57:52 +00:00
// Handle WebDAV
2017-05-15 12:33:27 +00:00
if ( isset ( $_SERVER [ 'REQUEST_METHOD' ]) && $_SERVER [ 'REQUEST_METHOD' ] === 'PROPFIND' ) {
2013-10-24 08:34:09 +00:00
// not allowed any more to prevent people
// mounting this root directly.
// Users need to mount remote.php/webdav instead.
2018-06-26 08:32:50 +00:00
http_response_code ( 405 );
2013-01-25 13:57:52 +00:00
return ;
}
2022-07-08 17:14:05 +00:00
// Handle requests for JSON or XML
$acceptHeader = $request -> getHeader ( 'Accept' );
if ( in_array ( $acceptHeader , [ 'application/json' , 'application/xml' ], true )) {
http_response_code ( 404 );
return ;
}
2022-07-08 16:28:14 +00:00
// Handle resources that can't be found
// This prevents browsers from redirecting to the default page and then
// attempting to parse HTML as CSS and similar.
$destinationHeader = $request -> getHeader ( 'Sec-Fetch-Dest' );
if ( in_array ( $destinationHeader , [ 'font' , 'script' , 'style' ])) {
http_response_code ( 404 );
return ;
}
2022-10-14 05:42:25 +00:00
// Redirect to the default app or login only as an entry point
if ( $requestPath === '' ) {
// Someone is logged in
2022-11-29 15:53:27 +00:00
if ( Server :: get ( IUserSession :: class ) -> isLoggedIn ()) {
header ( 'Location: ' . Server :: get ( IURLGenerator :: class ) -> linkToDefaultPageUrl ());
2022-10-14 05:42:25 +00:00
} else {
// Not handled and not logged in
2022-11-29 15:53:27 +00:00
header ( 'Location: ' . Server :: get ( IURLGenerator :: class ) -> linkToRouteAbsolute ( 'core.login.showLoginForm' ));
2022-10-14 05:42:25 +00:00
}
return ;
}
try {
2022-11-29 17:07:27 +00:00
Server :: get ( \OC\Route\Router :: class ) -> match ( '/error/404' );
2022-10-14 05:42:25 +00:00
} catch ( \Exception $e ) {
2023-03-03 08:40:43 +00:00
if ( ! $e instanceof MethodNotAllowedException ) {
logger ( 'core' ) -> emergency ( $e -> getMessage (), [ 'exception' => $e ]);
}
2022-11-29 15:53:27 +00:00
$l = Server :: get ( \OCP\L10N\IFactory :: class ) -> get ( 'lib' );
2022-10-14 05:42:25 +00:00
OC_Template :: printErrorPage (
2023-10-21 09:48:46 +00:00
'404' ,
2022-10-14 05:42:25 +00:00
$l -> t ( 'The page could not be found on the server.' ),
404
);
2013-01-14 19:30:28 +00:00
}
}
2016-04-29 07:40:33 +00:00
/**
* Check login : apache auth , auth token , basic auth
*/
2022-11-29 15:53:27 +00:00
public static function handleLogin ( OCP\IRequest $request ) : bool {
2022-07-04 15:05:15 +00:00
if ( $request -> getHeader ( 'X-Nextcloud-Federation' )) {
return false ;
}
2022-11-29 17:07:27 +00:00
$userSession = Server :: get ( \OC\User\Session :: class );
2016-04-29 07:40:33 +00:00
if ( OC_User :: handleApacheAuth ()) {
return true ;
}
2023-09-06 13:53:53 +00:00
if ( self :: tryAppAPILogin ( $request )) {
2023-08-01 11:50:59 +00:00
return true ;
}
2016-04-29 07:40:33 +00:00
if ( $userSession -> tryTokenLogin ( $request )) {
return true ;
}
2016-09-06 19:41:15 +00:00
if ( isset ( $_COOKIE [ 'nc_username' ])
&& isset ( $_COOKIE [ 'nc_token' ])
&& isset ( $_COOKIE [ 'nc_session_id' ])
&& $userSession -> loginWithCookie ( $_COOKIE [ 'nc_username' ], $_COOKIE [ 'nc_token' ], $_COOKIE [ 'nc_session_id' ])) {
return true ;
}
2023-08-28 13:50:45 +00:00
if ( $userSession -> tryBasicAuthLogin ( $request , Server :: get ( IThrottler :: class ))) {
2016-04-29 07:40:33 +00:00
return true ;
}
return false ;
}
2022-11-29 15:29:12 +00:00
protected static function handleAuthHeaders () : void {
2014-07-19 00:16:28 +00:00
//copy http auth headers for apache+php-fcgid work around
if ( isset ( $_SERVER [ 'HTTP_XAUTHORIZATION' ]) && ! isset ( $_SERVER [ 'HTTP_AUTHORIZATION' ])) {
$_SERVER [ 'HTTP_AUTHORIZATION' ] = $_SERVER [ 'HTTP_XAUTHORIZATION' ];
}
// Extract PHP_AUTH_USER/PHP_AUTH_PW from other headers if necessary.
2020-03-26 08:30:18 +00:00
$vars = [
2014-07-19 00:16:28 +00:00
'HTTP_AUTHORIZATION' , // apache+php-cgi work around
'REDIRECT_HTTP_AUTHORIZATION' , // apache+php-cgi alternative
2020-03-26 08:30:18 +00:00
];
2014-07-19 00:16:28 +00:00
foreach ( $vars as $var ) {
2022-11-29 17:07:27 +00:00
if ( isset ( $_SERVER [ $var ]) && is_string ( $_SERVER [ $var ]) && preg_match ( '/Basic\s+(.*)$/i' , $_SERVER [ $var ], $matches )) {
2020-02-23 17:53:17 +00:00
$credentials = explode ( ':' , base64_decode ( $matches [ 1 ]), 2 );
if ( count ( $credentials ) === 2 ) {
$_SERVER [ 'PHP_AUTH_USER' ] = $credentials [ 0 ];
$_SERVER [ 'PHP_AUTH_PW' ] = $credentials [ 1 ];
break ;
}
2014-07-19 00:16:28 +00:00
}
}
}
2023-08-01 11:50:59 +00:00
2023-09-06 13:53:53 +00:00
protected static function tryAppAPILogin ( OCP\IRequest $request ) : bool {
2023-08-01 11:50:59 +00:00
$appManager = Server :: get ( OCP\App\IAppManager :: class );
2023-09-06 13:53:53 +00:00
if ( ! $request -> getHeader ( 'AUTHORIZATION-APP-API' )) {
2023-08-01 11:50:59 +00:00
return false ;
}
2023-09-06 13:53:53 +00:00
if ( ! $appManager -> isInstalled ( 'app_api' )) {
2023-08-01 11:50:59 +00:00
return false ;
}
2023-08-02 14:40:58 +00:00
try {
2023-09-06 13:53:53 +00:00
$appAPIService = Server :: get ( OCA\AppAPI\Service\AppAPIService :: class );
return $appAPIService -> validateExAppRequestToNC ( $request );
2023-08-02 14:40:58 +00:00
} catch ( \Psr\Container\NotFoundExceptionInterface | \Psr\Container\ContainerExceptionInterface $e ) {
return false ;
}
2023-08-01 11:50:59 +00:00
}
2011-07-29 19:03:53 +00:00
}
2011-11-13 15:16:21 +00:00
OC :: init ();