Skip to content

Commit 0c68b3f

Browse files
provokateurinprovokateurin
committed
refactor(files): Replace security annotations with respective attributes
Signed-off-by: provokateurin <[email protected]>
1 parent ea7eeb2 commit 0c68b3f

File tree

7 files changed

+56
-73
lines changed

7 files changed

+56
-73
lines changed

‎apps/files/lib/Controller/ApiController.php‎

Lines changed: 20 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,11 @@
1313
use OCA\Files\Service\ViewConfig;
1414
use OCP\AppFramework\Controller;
1515
use OCP\AppFramework\Http;
16+
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
17+
use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
1618
use OCP\AppFramework\Http\Attribute\OpenAPI;
19+
use OCP\AppFramework\Http\Attribute\PublicPage;
20+
use OCP\AppFramework\Http\Attribute\StrictCookiesRequired;
1721
use OCP\AppFramework\Http\ContentSecurityPolicy;
1822
use OCP\AppFramework\Http\DataResponse;
1923
use OCP\AppFramework\Http\FileDisplayResponse;
@@ -69,10 +73,6 @@ public function __construct(string $appName,
6973
*
7074
* @since API version 1.0
7175
*
72-
* @NoAdminRequired
73-
* @NoCSRFRequired
74-
* @StrictCookieRequired
75-
*
7676
* @param int $x Width of the thumbnail
7777
* @param int $y Height of the thumbnail
7878
* @param string $file URL-encoded filename
@@ -82,6 +82,9 @@ public function __construct(string $appName,
8282
* 400: Getting thumbnail is not possible
8383
* 404: File not found
8484
*/
85+
#[NoAdminRequired]
86+
#[NoCSRFRequired]
87+
#[StrictCookiesRequired]
8588
public function getThumbnail($x, $y, $file) {
8689
if ($x < 1 || $y < 1) {
8790
return new DataResponse(['message' => 'Requested size must be numeric and a positive value.'], Http::STATUS_BAD_REQUEST);
@@ -109,12 +112,11 @@ public function getThumbnail($x, $y, $file) {
109112
* The passed tags are absolute, which means they will
110113
* replace the actual tag selection.
111114
*
112-
* @NoAdminRequired
113-
*
114115
* @param string $path path
115116
* @param array|string $tags array of tags
116117
* @return DataResponse
117118
*/
119+
#[NoAdminRequired]
118120
public function updateFileTags($path, $tags = null) {
119121
$result = [];
120122
// if tags specified or empty array, update tags
@@ -217,10 +219,9 @@ private function getShareTypesForNodes(array $nodes): array {
217219
/**
218220
* Returns a list of recently modified files.
219221
*
220-
* @NoAdminRequired
221-
*
222222
* @return DataResponse
223223
*/
224+
#[NoAdminRequired]
224225
public function getRecentFiles() {
225226
$nodes = $this->userFolder->getRecent(100);
226227
$files = $this->formatNodes($nodes);
@@ -231,11 +232,10 @@ public function getRecentFiles() {
231232
/**
232233
* Returns the current logged-in user's storage stats.
233234
*
234-
* @NoAdminRequired
235-
*
236235
* @param ?string $dir the directory to get the storage stats from
237236
* @return JSONResponse
238237
*/
238+
#[NoAdminRequired]
239239
public function getStorageStats($dir = '/'): JSONResponse {
240240
$storageInfo = \OC_Helper::getStorageInfo($dir ?: '/');
241241
$response = new JSONResponse(['message' => 'ok', 'data' => $storageInfo]);
@@ -246,13 +246,12 @@ public function getStorageStats($dir = '/'): JSONResponse {
246246
/**
247247
* Set a user view config
248248
*
249-
* @NoAdminRequired
250-
*
251249
* @param string $view
252250
* @param string $key
253251
* @param string|bool $value
254252
* @return JSONResponse
255253
*/
254+
#[NoAdminRequired]
256255
public function setViewConfig(string $view, string $key, $value): JSONResponse {
257256
try {
258257
$this->viewConfig->setConfig($view, $key, (string)$value);
@@ -267,23 +266,21 @@ public function setViewConfig(string $view, string $key, $value): JSONResponse {
267266
/**
268267
* Get the user view config
269268
*
270-
* @NoAdminRequired
271-
*
272269
* @return JSONResponse
273270
*/
271+
#[NoAdminRequired]
274272
public function getViewConfigs(): JSONResponse {
275273
return new JSONResponse(['message' => 'ok', 'data' => $this->viewConfig->getConfigs()]);
276274
}
277275

278276
/**
279277
* Set a user config
280278
*
281-
* @NoAdminRequired
282-
*
283279
* @param string $key
284280
* @param string|bool $value
285281
* @return JSONResponse
286282
*/
283+
#[NoAdminRequired]
287284
public function setConfig(string $key, $value): JSONResponse {
288285
try {
289286
$this->userConfig->setConfig($key, (string)$value);
@@ -298,23 +295,21 @@ public function setConfig(string $key, $value): JSONResponse {
298295
/**
299296
* Get the user config
300297
*
301-
* @NoAdminRequired
302-
*
303298
* @return JSONResponse
304299
*/
300+
#[NoAdminRequired]
305301
public function getConfigs(): JSONResponse {
306302
return new JSONResponse(['message' => 'ok', 'data' => $this->userConfig->getConfigs()]);
307303
}
308304

309305
/**
310306
* Toggle default for showing/hiding hidden files
311307
*
312-
* @NoAdminRequired
313-
*
314308
* @param bool $value
315309
* @return Response
316310
* @throws \OCP\PreConditionNotMetException
317311
*/
312+
#[NoAdminRequired]
318313
public function showHiddenFiles(bool $value): Response {
319314
$this->config->setUserValue($this->userSession->getUser()->getUID(), 'files', 'show_hidden', $value ? '1' : '0');
320315
return new Response();
@@ -323,12 +318,11 @@ public function showHiddenFiles(bool $value): Response {
323318
/**
324319
* Toggle default for cropping preview images
325320
*
326-
* @NoAdminRequired
327-
*
328321
* @param bool $value
329322
* @return Response
330323
* @throws \OCP\PreConditionNotMetException
331324
*/
325+
#[NoAdminRequired]
332326
public function cropImagePreviews(bool $value): Response {
333327
$this->config->setUserValue($this->userSession->getUser()->getUID(), 'files', 'crop_image_previews', $value ? '1' : '0');
334328
return new Response();
@@ -337,32 +331,27 @@ public function cropImagePreviews(bool $value): Response {
337331
/**
338332
* Toggle default for files grid view
339333
*
340-
* @NoAdminRequired
341-
*
342334
* @param bool $show
343335
* @return Response
344336
* @throws \OCP\PreConditionNotMetException
345337
*/
338+
#[NoAdminRequired]
346339
public function showGridView(bool $show): Response {
347340
$this->config->setUserValue($this->userSession->getUser()->getUID(), 'files', 'show_grid', $show ? '1' : '0');
348341
return new Response();
349342
}
350343

351344
/**
352345
* Get default settings for the grid view
353-
*
354-
* @NoAdminRequired
355346
*/
347+
#[NoAdminRequired]
356348
public function getGridView() {
357349
$status = $this->config->getUserValue($this->userSession->getUser()->getUID(), 'files', 'show_grid', '0') === '1';
358350
return new JSONResponse(['gridview' => $status]);
359351
}
360352

361-
/**
362-
* @NoAdminRequired
363-
* @NoCSRFRequired
364-
* @PublicPage
365-
*/
353+
#[PublicPage]
354+
#[NoCSRFRequired]
366355
#[OpenAPI(scope: OpenAPI::SCOPE_IGNORE)]
367356
public function serviceWorker(): StreamResponse {
368357
$response = new StreamResponse(__DIR__ . '/../../../../dist/preview-service-worker.js');

‎apps/files/lib/Controller/DirectEditingController.php‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
use Exception;
99
use OCA\Files\Service\DirectEditingService;
1010
use OCP\AppFramework\Http;
11+
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
1112
use OCP\AppFramework\Http\DataResponse;
1213
use OCP\AppFramework\OCSController;
1314
use OCP\DirectEditing\IManager;
@@ -34,22 +35,19 @@ public function __construct(
3435
}
3536

3637
/**
37-
* @NoAdminRequired
38-
*
3938
* Get the direct editing capabilities
4039
* @return DataResponse<Http::STATUS_OK, array{editors: array<string, array{id: string, name: string, mimetypes: string[], optionalMimetypes: string[], secure: bool}>, creators: array<string, array{id: string, editor: string, name: string, extension: string, templates: bool, mimetypes: string[]}>}, array{}>
4140
*
4241
* 200: Direct editing capabilities returned
4342
*/
43+
#[NoAdminRequired]
4444
public function info(): DataResponse {
4545
$response = new DataResponse($this->directEditingService->getDirectEditingCapabilitites());
4646
$response->setETag($this->directEditingService->getDirectEditingETag());
4747
return $response;
4848
}
4949

5050
/**
51-
* @NoAdminRequired
52-
*
5351
* Create a file for direct editing
5452
*
5553
* @param string $path Path of the file
@@ -62,6 +60,7 @@ public function info(): DataResponse {
6260
* 200: URL for direct editing returned
6361
* 403: Opening file is not allowed
6462
*/
63+
#[NoAdminRequired]
6564
public function create(string $path, string $editorId, string $creatorId, ?string $templateId = null): DataResponse {
6665
if (!$this->directEditingManager->isEnabled()) {
6766
return new DataResponse(['message' => 'Direct editing is not enabled'], Http::STATUS_INTERNAL_SERVER_ERROR);
@@ -85,8 +84,6 @@ public function create(string $path, string $editorId, string $creatorId, ?strin
8584
}
8685

8786
/**
88-
* @NoAdminRequired
89-
*
9087
* Open a file for direct editing
9188
*
9289
* @param string $path Path of the file
@@ -98,6 +95,7 @@ public function create(string $path, string $editorId, string $creatorId, ?strin
9895
* 200: URL for direct editing returned
9996
* 403: Opening file is not allowed
10097
*/
98+
#[NoAdminRequired]
10199
public function open(string $path, ?string $editorId = null, ?int $fileId = null): DataResponse {
102100
if (!$this->directEditingManager->isEnabled()) {
103101
return new DataResponse(['message' => 'Direct editing is not enabled'], Http::STATUS_INTERNAL_SERVER_ERROR);
@@ -123,8 +121,6 @@ public function open(string $path, ?string $editorId = null, ?int $fileId = null
123121

124122

125123
/**
126-
* @NoAdminRequired
127-
*
128124
* Get the templates for direct editing
129125
*
130126
* @param string $editorId ID of the editor
@@ -134,6 +130,7 @@ public function open(string $path, ?string $editorId = null, ?int $fileId = null
134130
*
135131
* 200: Templates returned
136132
*/
133+
#[NoAdminRequired]
137134
public function templates(string $editorId, string $creatorId): DataResponse {
138135
if (!$this->directEditingManager->isEnabled()) {
139136
return new DataResponse(['message' => 'Direct editing is not enabled'], Http::STATUS_INTERNAL_SERVER_ERROR);

‎apps/files/lib/Controller/DirectEditingViewController.php‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,10 @@
77

88
use Exception;
99
use OCP\AppFramework\Controller;
10+
use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
1011
use OCP\AppFramework\Http\Attribute\OpenAPI;
12+
use OCP\AppFramework\Http\Attribute\PublicPage;
13+
use OCP\AppFramework\Http\Attribute\UseSession;
1114
use OCP\AppFramework\Http\NotFoundResponse;
1215
use OCP\AppFramework\Http\Response;
1316
use OCP\DirectEditing\IManager;
@@ -29,13 +32,12 @@ public function __construct(
2932
}
3033

3134
/**
32-
* @PublicPage
33-
* @NoCSRFRequired
34-
* @UseSession
35-
*
3635
* @param string $token
3736
* @return Response
3837
*/
38+
#[PublicPage]
39+
#[NoCSRFRequired]
40+
#[UseSession]
3941
public function edit(string $token): Response {
4042
$this->eventDispatcher->dispatchTyped(new RegisterDirectEditorEvent($this->directEditingManager));
4143
try {

‎apps/files/lib/Controller/OpenLocalEditorController.php‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313
use OCA\Files\Db\OpenLocalEditorMapper;
1414
use OCP\AppFramework\Db\DoesNotExistException;
1515
use OCP\AppFramework\Http;
16+
use OCP\AppFramework\Http\Attribute\BruteForceProtection;
17+
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
18+
use OCP\AppFramework\Http\Attribute\UserRateLimit;
1619
use OCP\AppFramework\Http\DataResponse;
1720
use OCP\AppFramework\OCSController;
1821
use OCP\AppFramework\Utility\ITimeFactory;
@@ -51,9 +54,6 @@ public function __construct(
5154
}
5255

5356
/**
54-
* @NoAdminRequired
55-
* @UserRateThrottle(limit=10, period=120)
56-
*
5757
* Create a local editor
5858
*
5959
* @param string $path Path of the file
@@ -62,6 +62,8 @@ public function __construct(
6262
*
6363
* 200: Local editor returned
6464
*/
65+
#[NoAdminRequired]
66+
#[UserRateLimit(10, 120)]
6567
public function create(string $path): DataResponse {
6668
$pathHash = sha1($path);
6769

@@ -96,9 +98,6 @@ public function create(string $path): DataResponse {
9698
}
9799

98100
/**
99-
* @NoAdminRequired
100-
* @BruteForceProtection(action=openLocalEditor)
101-
*
102101
* Validate a local editor
103102
*
104103
* @param string $path Path of the file
@@ -109,6 +108,8 @@ public function create(string $path): DataResponse {
109108
* 200: Local editor validated successfully
110109
* 404: Local editor not found
111110
*/
111+
#[NoAdminRequired]
112+
#[BruteForceProtection('openLocalEditor')]
112113
public function validate(string $path, string $token): DataResponse {
113114
$pathHash = sha1($path);
114115

‎apps/files/lib/Controller/TemplateController.php‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010

1111
use OCA\Files\ResponseDefinitions;
1212
use OCP\AppFramework\Http;
13+
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
1314
use OCP\AppFramework\Http\DataResponse;
1415
use OCP\AppFramework\OCS\OCSForbiddenException;
1516
use OCP\AppFramework\OCSController;
@@ -31,21 +32,18 @@ public function __construct($appName, IRequest $request, ITemplateManager $templ
3132
}
3233

3334
/**
34-
* @NoAdminRequired
35-
*
3635
* List the available templates
3736
*
3837
* @return DataResponse<Http::STATUS_OK, array<FilesTemplateFileCreator>, array{}>
3938
*
4039
* 200: Available templates returned
4140
*/
41+
#[NoAdminRequired]
4242
public function list(): DataResponse {
4343
return new DataResponse($this->templateManager->listTemplates());
4444
}
4545

4646
/**
47-
* @NoAdminRequired
48-
*
4947
* Create a template
5048
*
5149
* @param string $filePath Path of the file
@@ -57,6 +55,7 @@ public function list(): DataResponse {
5755
*
5856
* 200: Template created successfully
5957
*/
58+
#[NoAdminRequired]
6059
public function create(string $filePath, string $templatePath = '', string $templateType = 'user'): DataResponse {
6160
try {
6261
return new DataResponse($this->templateManager->createFromTemplate($filePath, $templatePath, $templateType));
@@ -66,8 +65,6 @@ public function create(string $filePath, string $templatePath = '', string $temp
6665
}
6766

6867
/**
69-
* @NoAdminRequired
70-
*
7168
* Initialize the template directory
7269
*
7370
* @param string $templatePath Path of the template directory
@@ -78,6 +75,7 @@ public function create(string $filePath, string $templatePath = '', string $temp
7875
*
7976
* 200: Template directory initialized successfully
8077
*/
78+
#[NoAdminRequired]
8179
public function path(string $templatePath = '', bool $copySystemTemplates = false) {
8280
try {
8381
/** @var string $templatePath */

0 commit comments

Comments
 (0)