Add Feature-Policy header by rullzer · Pull Request #16613 · nextcloud/server

rullzer · 2019-07-30T09:26:56Z

No description provided.

rullzer · 2019-08-01T20:27:05Z

Review time :)

This is not all the features. But other things will be added later in steps.

georgehrke

Code looks good, just some minor changes.

To test just make sure that the header is there?

lib/public/AppFramework/Http/EmptyFeaturePolicy.php

rullzer · 2019-08-01T20:56:43Z

Yes check the header is there.
You could check with talk. That should fail hard now until I provide a patch there ;)

ChristophWurst

looks good otherwise

lib/private/AppFramework/DependencyInjection/DIContainer.php

lib/private/Security/FeaturePolicy/FeaturePolicyManager.php

lib/public/AppFramework/Http/EmptyFeaturePolicy.php

rullzer · 2019-08-05T19:34:19Z

All done @ChristophWurst 😉

ChristophWurst

looks good!

kesselb · 2019-08-06T06:57:18Z

lib/private/AppFramework/Middleware/Security/FeaturePolicyMiddleware.php

+	 * @return Response
+	 */
+	public function afterController($controller, $methodName, Response $response): Response {
+		$policy = !is_null($response->getFeaturePolicy()) ? $response->getFeaturePolicy() : new FeaturePolicy();


Suggested change

$policy = !is_null($response->getFeaturePolicy()) ? $response->getFeaturePolicy() : new FeaturePolicy();

$policy = $response->getFeaturePolicy() ?? new FeaturePolicy();

Could that work?

Probably. But lets leave it for now.

Done

georgehrke

👍 Tested and works

danxuliu

Tested (with Talk) and works 👍

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

This adds the events and the classes to modify the feature policy. It also adds a default restricted feature policy. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

rullzer · 2019-08-10T12:36:35Z

Pushed tests. Will merge once CI is happy

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

@rullzer

* LoadAdditionalScripts (@rullzer) - nextcloud/server#16641 * LoadViewerEvent (@skjnldsv) - nextcloud/viewer#271 * RegisterDirectEditorEvent (@juliushaertl) - nextcloud/server#17625 * typed events for files scanner (@ChristophWurst) - nextcloud/server#18351 * typed events for group mangement (@ChristophWurst) - nextcloud/server#18350 * AddContentSecurityPolicyEvent (@rullzer) - nextcloud/server#15730 * UserLiveStatusEvent (@georgehrke) - nextcloud/server#21186 * password_policy events (@ChristophWurst) - nextcloud/server#18019 * AddFeaturePolicyEvent (@rullzer) - nextcloud/server#16613 * ShareCreatedEvent (@rullzer) - nextcloud/server#18384 * LoadSettingsScriptsEvent (@blizzz) - nextcloud/server#21475 * flow events (@rullzer) - nextcloud/server#18535 Signed-off-by: Morris Jobke <hey@morrisjobke.de>

@rullzer

* LoadAdditionalScripts (@rullzer) - nextcloud/server#16641 * LoadViewerEvent (@skjnldsv) - nextcloud/viewer#271 * RegisterDirectEditorEvent (@juliushaertl) - nextcloud/server#17625 * typed events for files scanner (@ChristophWurst) - nextcloud/server#18351 * typed events for group mangement (@ChristophWurst) - nextcloud/server#18350 * AddContentSecurityPolicyEvent (@rullzer) - nextcloud/server#15730 * UserLiveStatusEvent (@georgehrke) - nextcloud/server#21186 * password_policy events (@ChristophWurst) - nextcloud/server#18019 * AddFeaturePolicyEvent (@rullzer) - nextcloud/server#16613 * ShareCreatedEvent (@rullzer) - nextcloud/server#18384 * LoadSettingsScriptsEvent (@blizzz) - nextcloud/server#21475 * flow events (@rullzer) - nextcloud/server#18535 Signed-off-by: Morris Jobke <hey@morrisjobke.de>

@rullzer

* LoadAdditionalScripts (@rullzer) - nextcloud/server#16641 * LoadViewerEvent (@skjnldsv) - nextcloud/viewer#271 * RegisterDirectEditorEvent (@juliushaertl) - nextcloud/server#17625 * typed events for files scanner (@ChristophWurst) - nextcloud/server#18351 * typed events for group mangement (@ChristophWurst) - nextcloud/server#18350 * AddContentSecurityPolicyEvent (@rullzer) - nextcloud/server#15730 * UserLiveStatusEvent (@georgehrke) - nextcloud/server#21186 * password_policy events (@ChristophWurst) - nextcloud/server#18019 * AddFeaturePolicyEvent (@rullzer) - nextcloud/server#16613 * ShareCreatedEvent (@rullzer) - nextcloud/server#18384 * LoadSettingsScriptsEvent (@blizzz) - nextcloud/server#21475 * flow events (@rullzer) - nextcloud/server#18535 Signed-off-by: Morris Jobke <hey@morrisjobke.de>

@rullzer

* LoadAdditionalScripts (@rullzer) - nextcloud/server#16641 * LoadViewerEvent (@skjnldsv) - nextcloud/viewer#271 * RegisterDirectEditorEvent (@juliushaertl) - nextcloud/server#17625 * typed events for files scanner (@ChristophWurst) - nextcloud/server#18351 * typed events for group mangement (@ChristophWurst) - nextcloud/server#18350 * AddContentSecurityPolicyEvent (@rullzer) - nextcloud/server#15730 * UserLiveStatusEvent (@georgehrke) - nextcloud/server#21186 * password_policy events (@ChristophWurst) - nextcloud/server#18019 * AddFeaturePolicyEvent (@rullzer) - nextcloud/server#16613 * ShareCreatedEvent (@rullzer) - nextcloud/server#18384 * LoadSettingsScriptsEvent (@blizzz) - nextcloud/server#21475 * flow events (@rullzer) - nextcloud/server#18535 Signed-off-by: Morris Jobke <hey@morrisjobke.de>

rullzer added enhancement 2. developing Work in progress security labels Jul 30, 2019

rullzer added this to the Nextcloud 17 milestone Jul 30, 2019

rullzer added 3. to review Waiting for reviews and removed 2. developing Work in progress labels Aug 1, 2019

rullzer requested review from ChristophWurst, MorrisJobke, georgehrke, juliusknorr and nickvergessen August 1, 2019 20:26

georgehrke previously requested changes Aug 1, 2019

View reviewed changes

ChristophWurst reviewed Aug 5, 2019

View reviewed changes

rullzer requested a review from georgehrke August 5, 2019 19:34

ChristophWurst approved these changes Aug 6, 2019

View reviewed changes

kesselb reviewed Aug 6, 2019

View reviewed changes

MorrisJobke mentioned this pull request Aug 8, 2019

17.0.0 Beta 1 #16408

Merged

28 tasks

rullzer requested a review from kesselb August 8, 2019 06:35

rullzer mentioned this pull request Aug 8, 2019

Allow mic+camera using feature policy nextcloud/spreed#2073

Merged

georgehrke approved these changes Aug 8, 2019

View reviewed changes

danxuliu approved these changes Aug 8, 2019

View reviewed changes

Have the OCSBaseResponse call the parent constructor

5d94590

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

rullzer force-pushed the enh/featurepolicy branch from c037ad8 to a54d637 Compare August 8, 2019 07:55

Add feature policy header

b8c5008

This adds the events and the classes to modify the feature policy. It also adds a default restricted feature policy. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

rullzer force-pushed the enh/featurepolicy branch from a54d637 to 9c9ed33 Compare August 10, 2019 12:35

rullzer force-pushed the enh/featurepolicy branch from 9c9ed33 to a01e2fb Compare August 10, 2019 13:10

Add tests

f81817b

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

rullzer force-pushed the enh/featurepolicy branch from a01e2fb to f81817b Compare August 10, 2019 17:40

rullzer merged commit 773ce9e into master Aug 11, 2019

rullzer deleted the enh/featurepolicy branch August 11, 2019 08:17

Rello mentioned this pull request Aug 16, 2019

Audio Player NC17 compatibility: EmptyFeaturePolicy Rello/audioplayer#428

Closed

MorrisJobke mentioned this pull request Aug 10, 2020

Document existing events nextcloud/documentation#2842

Merged

	$policy = !is_null($response->getFeaturePolicy()) ? $response->getFeaturePolicy() : new FeaturePolicy();
	$policy = $response->getFeaturePolicy() ?? new FeaturePolicy();

Uh oh!

Conversation

rullzer commented Jul 30, 2019

Uh oh!

rullzer commented Aug 1, 2019

Uh oh!

georgehrke left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rullzer commented Aug 1, 2019

Uh oh!

ChristophWurst left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rullzer commented Aug 5, 2019

Uh oh!

ChristophWurst left a comment

Choose a reason for hiding this comment

Uh oh!

kesselb Aug 6, 2019

Choose a reason for hiding this comment

Uh oh!

rullzer Aug 8, 2019

Choose a reason for hiding this comment

Uh oh!

georgehrke left a comment

Choose a reason for hiding this comment

Uh oh!

danxuliu left a comment

Choose a reason for hiding this comment

Uh oh!

rullzer commented Aug 10, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants