Skip to content

Add Feature-Policy header - #16613

Merged
rullzer merged 3 commits into
masterfrom
enh/featurepolicy
Aug 11, 2019
Merged

Add Feature-Policy header#16613
rullzer merged 3 commits into
masterfrom
enh/featurepolicy

Conversation

@rullzer

@rullzerrullzer commented Jul 30, 2019

Copy link
Copy Markdown
Member

No description provided.

@rullzerrullzer added this to the Nextcloud 17 milestone Jul 30, 2019
@rullzerrullzer added 3. to review Waiting for reviews and removed 2. developing Work in progress labels Aug 1, 2019
@rullzer

rullzer commented Aug 1, 2019

Copy link
Copy Markdown
MemberAuthor

Review time :)

This is not all the features. But other things will be added later in steps.

georgehrke
georgehrke previously requested changes Aug 1, 2019
View reviewed changes

@georgehrkegeorgehrke left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code looks good, just some minor changes.

To test just make sure that the header is there?

Comment threadlib/public/AppFramework/Http/EmptyFeaturePolicy.php Outdated
Comment threadlib/public/AppFramework/Http/EmptyFeaturePolicy.php Outdated
Comment threadlib/public/AppFramework/Http/EmptyFeaturePolicy.php Outdated
Comment threadlib/public/AppFramework/Http/EmptyFeaturePolicy.php Outdated
Comment threadlib/public/AppFramework/Http/EmptyFeaturePolicy.php Outdated
Comment threadlib/public/AppFramework/Http/EmptyFeaturePolicy.php Outdated
@rullzer

rullzer commented Aug 1, 2019

Copy link
Copy Markdown
MemberAuthor

Yes check the header is there.
You could check with talk. That should fail hard now until I provide a patch there ;)

ChristophWurst
ChristophWurst reviewed Aug 5, 2019
View reviewed changes

@ChristophWurstChristophWurst left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good otherwise

Comment threadlib/private/AppFramework/DependencyInjection/DIContainer.php Outdated
Comment threadlib/private/Security/FeaturePolicy/FeaturePolicyManager.php Outdated
Comment threadlib/public/AppFramework/Http/EmptyFeaturePolicy.php Outdated
Comment threadlib/public/AppFramework/Http/EmptyFeaturePolicy.php Outdated
@rullzer
rullzer requested a review from georgehrkeAugust 5, 2019 19:34
@rullzer

rullzer commented Aug 5, 2019

Copy link
Copy Markdown
MemberAuthor

All done @ChristophWurst 😉

ChristophWurst
ChristophWurst approved these changes Aug 6, 2019
View reviewed changes

@ChristophWurstChristophWurst left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good!

kesselb
kesselb reviewed Aug 6, 2019
View reviewed changes
Comment threadlib/private/AppFramework/Middleware/Security/FeaturePolicyMiddleware.php
* @return Response
*/
public function afterController($controller, $methodName, Response $response): Response {
$policy = !is_null($response->getFeaturePolicy()) ? $response->getFeaturePolicy() : new FeaturePolicy();

@kesselbkesselbAug 6, 2019

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
$policy = !is_null($response->getFeaturePolicy()) ? $response->getFeaturePolicy() :newFeaturePolicy();
$policy = $response->getFeaturePolicy() ??newFeaturePolicy();

Could that work?

@rullzerrullzerAug 8, 2019

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably. But lets leave it for now.

@MorrisJobkeMorrisJobke mentioned this pull request Aug 8, 2019
Merged
28 tasks
@rullzer
rullzer requested a review from kesselbAugust 8, 2019 06:35
@rullzerrullzer mentioned this pull request Aug 8, 2019
Merged
georgehrke
georgehrke approved these changes Aug 8, 2019
View reviewed changes

@georgehrkegeorgehrke left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 Tested and works

danxuliu
danxuliu approved these changes Aug 8, 2019
View reviewed changes

@danxuliudanxuliu left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested (with Talk) and works 👍

@rullzer
Have the OCSBaseResponse call the parent constructor
5d94590
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
@rullzer
Add feature policy header
b8c5008
This adds the events and the classes to modify the feature policy.
It also adds a default restricted feature policy.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
@rullzer

rullzer commented Aug 10, 2019

Copy link
Copy Markdown
MemberAuthor

Pushed tests. Will merge once CI is happy

@rullzer
Add tests
f81817b
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
@rullzer
rullzer merged commit 773ce9e into masterAug 11, 2019
@rullzer
rullzer deleted the enh/featurepolicy branch August 11, 2019 08:17
@RelloRello mentioned this pull request Aug 16, 2019
Closed
MorrisJobke added a commit to nextcloud/documentation that referenced this pull request Aug 10, 2020
@MorrisJobke
Document existing events
da43209
* LoadAdditionalScripts (@rullzer) - nextcloud/server#16641
* LoadViewerEvent (@skjnldsv) - nextcloud/viewer#271
* RegisterDirectEditorEvent (@juliushaertl) - nextcloud/server#17625
* typed events for files scanner (@ChristophWurst) - nextcloud/server#18351
* typed events for group mangement (@ChristophWurst) - nextcloud/server#18350
* AddContentSecurityPolicyEvent (@rullzer) - nextcloud/server#15730
* UserLiveStatusEvent (@georgehrke) - nextcloud/server#21186
* password_policy events (@ChristophWurst) - nextcloud/server#18019
* AddFeaturePolicyEvent (@rullzer) - nextcloud/server#16613
* ShareCreatedEvent (@rullzer) - nextcloud/server#18384
* LoadSettingsScriptsEvent (@blizzz) - nextcloud/server#21475
* flow events (@rullzer) - nextcloud/server#18535
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
@MorrisJobkeMorrisJobke mentioned this pull request Aug 10, 2020
Merged
backportbot-nextcloudBot pushed a commit to nextcloud/documentation that referenced this pull request Aug 10, 2020
@MorrisJobke@backportbot
Document existing events
6ca7040
* LoadAdditionalScripts (@rullzer) - nextcloud/server#16641
* LoadViewerEvent (@skjnldsv) - nextcloud/viewer#271
* RegisterDirectEditorEvent (@juliushaertl) - nextcloud/server#17625
* typed events for files scanner (@ChristophWurst) - nextcloud/server#18351
* typed events for group mangement (@ChristophWurst) - nextcloud/server#18350
* AddContentSecurityPolicyEvent (@rullzer) - nextcloud/server#15730
* UserLiveStatusEvent (@georgehrke) - nextcloud/server#21186
* password_policy events (@ChristophWurst) - nextcloud/server#18019
* AddFeaturePolicyEvent (@rullzer) - nextcloud/server#16613
* ShareCreatedEvent (@rullzer) - nextcloud/server#18384
* LoadSettingsScriptsEvent (@blizzz) - nextcloud/server#21475
* flow events (@rullzer) - nextcloud/server#18535
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
MorrisJobke added a commit to nextcloud/documentation that referenced this pull request Aug 10, 2020
@MorrisJobke
Document existing events
7e78e7e
* LoadAdditionalScripts (@rullzer) - nextcloud/server#16641
* LoadViewerEvent (@skjnldsv) - nextcloud/viewer#271
* RegisterDirectEditorEvent (@juliushaertl) - nextcloud/server#17625
* typed events for files scanner (@ChristophWurst) - nextcloud/server#18351
* typed events for group mangement (@ChristophWurst) - nextcloud/server#18350
* AddContentSecurityPolicyEvent (@rullzer) - nextcloud/server#15730
* UserLiveStatusEvent (@georgehrke) - nextcloud/server#21186
* password_policy events (@ChristophWurst) - nextcloud/server#18019
* AddFeaturePolicyEvent (@rullzer) - nextcloud/server#16613
* ShareCreatedEvent (@rullzer) - nextcloud/server#18384
* LoadSettingsScriptsEvent (@blizzz) - nextcloud/server#21475
* flow events (@rullzer) - nextcloud/server#18535
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
MorrisJobke added a commit to nextcloud/documentation that referenced this pull request Aug 10, 2020
@MorrisJobke
Document existing events
6da5114
* LoadAdditionalScripts (@rullzer) - nextcloud/server#16641
* LoadViewerEvent (@skjnldsv) - nextcloud/viewer#271
* RegisterDirectEditorEvent (@juliushaertl) - nextcloud/server#17625
* typed events for files scanner (@ChristophWurst) - nextcloud/server#18351
* typed events for group mangement (@ChristophWurst) - nextcloud/server#18350
* AddContentSecurityPolicyEvent (@rullzer) - nextcloud/server#15730
* UserLiveStatusEvent (@georgehrke) - nextcloud/server#21186
* password_policy events (@ChristophWurst) - nextcloud/server#18019
* AddFeaturePolicyEvent (@rullzer) - nextcloud/server#16613
* ShareCreatedEvent (@rullzer) - nextcloud/server#18384
* LoadSettingsScriptsEvent (@blizzz) - nextcloud/server#21475
* flow events (@rullzer) - nextcloud/server#18535
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@georgehrkegeorgehrkegeorgehrke approved these changes
@ChristophWurstChristophWurstChristophWurst approved these changes
@danxuliudanxuliudanxuliu approved these changes
@MorrisJobkeMorrisJobkeAwaiting requested review from MorrisJobke
@nickvergessennickvergessenAwaiting requested review from nickvergessen
@juliusknorrjuliusknorrAwaiting requested review from juliusknorr
@kesselbkesselbAwaiting requested review from kesselb

Assignees

No one assigned

Labels

3. to reviewWaiting for reviewsenhancementsecurity

Projects

None yet

Milestone

Nextcloud 17

Development

Successfully merging this pull request may close these issues.

5 participants

@rullzer@georgehrke@ChristophWurst@kesselb@danxuliu