Merge pull request #43906 from nextcloud/enh/migrate-ssl-url-setupcheck

feat(settings): Migrate SSL access and URL generation check to SetupCheck API
This commit is contained in:
Côme Chilliet 2024-03-04 15:54:47 +01:00 коммит произвёл GitHub
Родитель 1ae15967fc ca246dc35c
Коммит 5794e1c9d6
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: B5690EEEBB952194
8 изменённых файлов: 79 добавлений и 30 удалений

Просмотреть файл

@ -93,6 +93,7 @@ return array(
'OCA\\Settings\\SetupChecks\\EmailTestSuccessful' => $baseDir . '/../lib/SetupChecks/EmailTestSuccessful.php',
'OCA\\Settings\\SetupChecks\\FileLocking' => $baseDir . '/../lib/SetupChecks/FileLocking.php',
'OCA\\Settings\\SetupChecks\\ForwardedForHeaders' => $baseDir . '/../lib/SetupChecks/ForwardedForHeaders.php',
'OCA\\Settings\\SetupChecks\\HttpsUrlGeneration' => $baseDir . '/../lib/SetupChecks/HttpsUrlGeneration.php',
'OCA\\Settings\\SetupChecks\\InternetConnectivity' => $baseDir . '/../lib/SetupChecks/InternetConnectivity.php',
'OCA\\Settings\\SetupChecks\\JavaScriptModules' => $baseDir . '/../lib/SetupChecks/JavaScriptModules.php',
'OCA\\Settings\\SetupChecks\\LegacySSEKeyFormat' => $baseDir . '/../lib/SetupChecks/LegacySSEKeyFormat.php',

Просмотреть файл

@ -108,6 +108,7 @@ class ComposerStaticInitSettings
'OCA\\Settings\\SetupChecks\\EmailTestSuccessful' => __DIR__ . '/..' . '/../lib/SetupChecks/EmailTestSuccessful.php',
'OCA\\Settings\\SetupChecks\\FileLocking' => __DIR__ . '/..' . '/../lib/SetupChecks/FileLocking.php',
'OCA\\Settings\\SetupChecks\\ForwardedForHeaders' => __DIR__ . '/..' . '/../lib/SetupChecks/ForwardedForHeaders.php',
'OCA\\Settings\\SetupChecks\\HttpsUrlGeneration' => __DIR__ . '/..' . '/../lib/SetupChecks/HttpsUrlGeneration.php',
'OCA\\Settings\\SetupChecks\\InternetConnectivity' => __DIR__ . '/..' . '/../lib/SetupChecks/InternetConnectivity.php',
'OCA\\Settings\\SetupChecks\\JavaScriptModules' => __DIR__ . '/..' . '/../lib/SetupChecks/JavaScriptModules.php',
'OCA\\Settings\\SetupChecks\\LegacySSEKeyFormat' => __DIR__ . '/..' . '/../lib/SetupChecks/LegacySSEKeyFormat.php',

Просмотреть файл

@ -64,6 +64,7 @@ use OCA\Settings\SetupChecks\DefaultPhoneRegionSet;
use OCA\Settings\SetupChecks\EmailTestSuccessful;
use OCA\Settings\SetupChecks\FileLocking;
use OCA\Settings\SetupChecks\ForwardedForHeaders;
use OCA\Settings\SetupChecks\HttpsUrlGeneration;
use OCA\Settings\SetupChecks\InternetConnectivity;
use OCA\Settings\SetupChecks\JavaScriptModules;
use OCA\Settings\SetupChecks\LegacySSEKeyFormat;
@ -190,6 +191,7 @@ class Application extends App implements IBootstrap {
$context->registerSetupCheck(EmailTestSuccessful::class);
$context->registerSetupCheck(FileLocking::class);
$context->registerSetupCheck(ForwardedForHeaders::class);
$context->registerSetupCheck(HttpsUrlGeneration::class);
$context->registerSetupCheck(InternetConnectivity::class);
$context->registerSetupCheck(JavaScriptModules::class);
$context->registerSetupCheck(LegacySSEKeyFormat::class);

Просмотреть файл

@ -176,8 +176,6 @@ Raw output
public function check() {
return new DataResponse(
[
'reverseProxyDocs' => $this->urlGenerator->linkToDocs('admin-reverse-proxy'),
'reverseProxyGeneratedURL' => $this->urlGenerator->getAbsoluteURL('index.php'),
'generic' => $this->setupCheckManager->runAll(),
]
);

Просмотреть файл

@ -0,0 +1,75 @@
<?php
declare(strict_types=1);
/**
* @copyright Copyright (c) 2024 Côme Chilliet <come.chilliet@nextcloud.com>
*
* @author Côme Chilliet <come.chilliet@nextcloud.com>
*
* @license GNU AGPL version 3 or any later version
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
*/
namespace OCA\Settings\SetupChecks;
use OCP\IL10N;
use OCP\IRequest;
use OCP\IURLGenerator;
use OCP\SetupCheck\ISetupCheck;
use OCP\SetupCheck\SetupResult;
class HttpsUrlGeneration implements ISetupCheck {
public function __construct(
private IL10N $l10n,
private IURLGenerator $urlGenerator,
private IRequest $request,
) {
}
public function getCategory(): string {
return 'security';
}
public function getName(): string {
return $this->l10n->t('HTTPS access and URLs');
}
public function run(): SetupResult {
if (!\OC::$CLI && $this->request->getServerProtocol() !== 'https') {
if (!preg_match('/(?:^(?:localhost|127\.0\.0\.1|::1)|\.onion)$/', $this->request->getInsecureServerHost())) {
return SetupResult::error(
$this->l10n->t('Accessing site insecurely via HTTP. You are strongly advised to set up your server to require HTTPS instead. Without it some important web functionality like "copy to clipboard" or "service workers" will not work!'),
$this->urlGenerator->linkToDocs('admin-security')
);
} else {
return SetupResult::info(
$this->l10n->t('Accessing site insecurely via HTTP.'),
$this->urlGenerator->linkToDocs('admin-security')
);
}
}
$generatedUrl = $this->urlGenerator->getAbsoluteURL('index.php');
if (!str_starts_with($generatedUrl, 'https://')) {
return SetupResult::warning(
$this->l10n->t('You are accessing your instance over a secure connection, however your instance is generating insecure URLs. This most likely means that you are behind a reverse proxy and the overwrite config variables are not set correctly.'),
$this->urlGenerator->linkToDocs('admin-reverse-proxy')
);
}
return SetupResult::success($this->l10n->t('You are accessing your instance over a secure connection, and your instance is generating secure URLs.'));
}
}

Просмотреть файл

@ -163,8 +163,6 @@ class CheckSetupControllerTest extends TestCase {
$expected = new DataResponse(
[
'reverseProxyDocs' => 'reverse-proxy-doc-link',
'reverseProxyGeneratedURL' => 'https://server/index.php',
'generic' => [],
]
);

Просмотреть файл

@ -105,14 +105,6 @@
var afterCall = function(data, statusText, xhr) {
var messages = [];
if (xhr.status === 200 && data) {
if (window.location.protocol === 'https:' && data.reverseProxyGeneratedURL.split('/')[0] !== 'https:') {
messages.push({
msg: t('core', 'You are accessing your instance over a secure connection, however your instance is generating insecure URLs. This most likely means that you are behind a reverse proxy and the overwrite config variables are not set correctly. Please read {linkstart}the documentation page about this ↗{linkend}.')
.replace('{linkstart}', '<a target="_blank" rel="noreferrer noopener" class="external" href="' + data.reverseProxyDocs + '">')
.replace('{linkend}', '</a>'),
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
})
}
if (Object.keys(data.generic).length > 0) {
Object.keys(data.generic).forEach(function(key){
Object.keys(data.generic[key]).forEach(function(title){
@ -340,13 +332,6 @@
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
});
}
} else if (!/(?:^(?:localhost|127\.0\.0\.1|::1)|\.onion)$/.exec(window.location.hostname)) {
messages.push({
msg: t('core', 'Accessing site insecurely via HTTP. You are strongly advised to set up your server to require HTTPS instead, as described in the {linkstart}security tips ↗{linkend}. Without it some important web functionality like "copy to clipboard" or "service workers" will not work!')
.replace('{linkstart}', '<a target="_blank" rel="noreferrer noopener" class="external" href="' + tipsUrl + '">')
.replace('{linkend}', '</a>'),
type: OC.SetupChecks.MESSAGE_TYPE_ERROR
});
}
} else {
messages.push({

Просмотреть файл

@ -117,7 +117,6 @@ describe('OC.SetupChecks tests', function() {
'Content-Type': 'application/json'
},
JSON.stringify({
reverseProxyGeneratedURL: 'https://server',
generic: {
network: {
"Internet connectivity": {
@ -150,7 +149,6 @@ describe('OC.SetupChecks tests', function() {
'Content-Type': 'application/json'
},
JSON.stringify({
reverseProxyGeneratedURL: 'https://server',
generic: {
network: {
"Internet connectivity": {
@ -183,7 +181,6 @@ describe('OC.SetupChecks tests', function() {
'Content-Type': 'application/json',
},
JSON.stringify({
reverseProxyGeneratedURL: 'https://server',
generic: {
network: {
"Internet connectivity": {
@ -216,8 +213,6 @@ describe('OC.SetupChecks tests', function() {
'Content-Type': 'application/json',
},
JSON.stringify({
reverseProxyDocs: 'https://docs.nextcloud.com/foo/bar.html',
reverseProxyGeneratedURL: 'https://server',
generic: {
network: {
"Internet connectivity": {
@ -280,7 +275,6 @@ describe('OC.SetupChecks tests', function() {
'Content-Type': 'application/json',
},
JSON.stringify({
reverseProxyGeneratedURL: 'https://server',
generic: {
network: {
"Internet connectivity": {
@ -322,8 +316,6 @@ describe('OC.SetupChecks tests', function() {
'Content-Type': 'application/json',
},
JSON.stringify({
reverseProxyDocs: 'https://docs.nextcloud.com/foo/bar.html',
reverseProxyGeneratedURL: 'http://server',
generic: {
network: {
"Internet connectivity": {
@ -354,8 +346,6 @@ describe('OC.SetupChecks tests', function() {
'Content-Type': 'application/json',
},
JSON.stringify({
reverseProxyDocs: 'https://docs.nextcloud.com/foo/bar.html',
reverseProxyGeneratedURL: 'http://server',
generic: {
network: {
"Internet connectivity": {
@ -383,7 +373,6 @@ describe('OC.SetupChecks tests', function() {
'Content-Type': 'application/json',
},
JSON.stringify({
reverseProxyGeneratedURL: 'https://server',
generic: {
network: {
"Internet connectivity": {