upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-11 01:30:50 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 79

feat(settings): Add setup check for too much caching

Browse source 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
This commit is contained in:
Christoph Wurst 2023-10-18 12:20:21 +02:00
parent 80893480c1
commit a0329557f6
No known key found for this signature in database
GPG key ID: CC42AC2A7F0E56D8
4 changed files with 43 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
apps/settings/appinfo/routes.php
View file

@ -66,6 +66,7 @@ return [
['name' => 'LogSettings#getEntries', 'url' => '/settings/admin/log/entries', 'verb' => 'GET' , 'root' => ''],
['name' => 'LogSettings#download', 'url' => '/settings/admin/log/download', 'verb' => 'GET' , 'root' => ''],
['name' => 'CheckSetup#check', 'url' => '/settings/ajax/checksetup', 'verb' => 'GET' , 'root' => ''],
['name' => 'CheckSetup#checkCookies', 'url' => '/settings/ajax/checksetupcookies.png', 'verb' => 'GET' , 'root' => ''],
['name' => 'CheckSetup#getFailedIntegrityCheckFiles', 'url' => '/settings/integrity/failed', 'verb' => 'GET' , 'root' => ''],
['name' => 'CheckSetup#rescanFailedIntegrityCheck', 'url' => '/settings/integrity/rescan', 'verb' => 'GET' , 'root' => ''],
['name' => 'PersonalSettings#index', 'url' => '/settings/user/{section}', 'verb' => 'GET', 'defaults' => ['section' => 'personal-info'] , 'root' => ''],

18
apps/settings/lib/Controller/CheckSetupController.php
View file

@ -74,6 +74,7 @@ use OCP\AppFramework\Controller;
use OCP\AppFramework\Http\Attribute\IgnoreOpenAPI;
use OCP\AppFramework\Http\DataDisplayResponse;
use OCP\AppFramework\Http\DataResponse;
use OCP\AppFramework\Http\JSONResponse;
use OCP\AppFramework\Http\RedirectResponse;
use OCP\DB\Events\AddMissingColumnsEvent;
use OCP\DB\Events\AddMissingIndicesEvent;
@ -94,6 +95,8 @@ use OCP\Notification\IManager;
use OCP\Security\Bruteforce\IThrottler;
use OCP\Security\ISecureRandom;
use Psr\Log\LoggerInterface;
use function setcookie;
use function time;
#[IgnoreOpenAPI]
class CheckSetupController extends Controller {
@ -972,4 +975,19 @@ Raw output
]
);
}
/**
* @AuthorizedAdminSetting(settings=OCA\Settings\Settings\Admin\Overview)
*/
public function checkCookies(): JSONResponse {
$rand = $this->secureRandom->generate(32);
setcookie(
'nc_setup_check',
$rand,
time() + 60
);
return new JSONResponse([
'rand' => $rand,
]);
}
}

5
apps/settings/src/admin.js
View file

@ -243,8 +243,9 @@ window.addEventListener('DOMContentLoaded', () => {
OC.SetupChecks.checkGeneric(),
OC.SetupChecks.checkWOFF2Loading(OC.filePath('core', '', 'fonts/NotoSans-Regular-latin.woff2'), OC.theme.docPlaceholderUrl),
OC.SetupChecks.checkDataProtected(),
).then((check1, check2, check3, check4, check5, check6, check7, check8, check9, check10, check11) => {
const messages = [].concat(check1, check2, check3, check4, check5, check6, check7, check8, check9, check10, check11)
OC.SetupChecks.checkCaching(),
).then((check1, check2, check3, check4, check5, check6, check7, check8, check9, check10, check11, check12) => {
const messages = [].concat(check1, check2, check3, check4, check5, check6, check7, check8, check9, check10, check11, check12)
const $el = $('#postsetupchecks')
$('#security-warning-state-loading').addClass('hidden')

21
core/js/setupchecks.js
View file

@ -47,6 +47,27 @@
return deferred.promise();
},
checkCaching: function() {
return Promise.all([
$.get(OC.generateUrl('settings/ajax/checksetupcookies.png')),
$.get(OC.generateUrl('settings/ajax/checksetupcookies.png')),
]).then(function(responses) {
if (responses[0].rand === responses[1].rand) {
console.error('Two unique requests returned the same response', {
rand1: responses[0].rand,
rand2: responses[1].rand,
});
return [
{
msg: t('core', 'Your web server is caching too aggressively. This could lead to leaked cookies and sessions.'),
type: OC.SetupChecks.MESSAGE_TYPE_ERROR
}
];
}
return [];
})
},
/**
* Check whether the .well-known URLs works.
*