FeaturePolicyMiddleware.php 2.1 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465
  1. <?php
  2. declare(strict_types=1);
  3. /**
  4. * @copyright Copyright (c) 2019, Roeland Jago Douma <roeland@famdouma.nl>
  5. *
  6. * @author Roeland Jago Douma <roeland@famdouma.nl>
  7. *
  8. * @license GNU AGPL version 3 or any later version
  9. *
  10. * This program is free software: you can redistribute it and/or modify
  11. * it under the terms of the GNU Affero General Public License as
  12. * published by the Free Software Foundation, either version 3 of the
  13. * License, or (at your option) any later version.
  14. *
  15. * This program is distributed in the hope that it will be useful,
  16. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  18. * GNU Affero General Public License for more details.
  19. *
  20. * You should have received a copy of the GNU Affero General Public License
  21. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  22. *
  23. */
  24. namespace OC\AppFramework\Middleware\Security;
  25. use OC\Security\FeaturePolicy\FeaturePolicy;
  26. use OC\Security\FeaturePolicy\FeaturePolicyManager;
  27. use OCP\AppFramework\Controller;
  28. use OCP\AppFramework\Http\EmptyFeaturePolicy;
  29. use OCP\AppFramework\Http\Response;
  30. use OCP\AppFramework\Middleware;
  31. class FeaturePolicyMiddleware extends Middleware {
  32. /** @var FeaturePolicyManager */
  33. private $policyManager;
  34. public function __construct(FeaturePolicyManager $policyManager) {
  35. $this->policyManager = $policyManager;
  36. }
  37. /**
  38. * Performs the default FeaturePolicy modifications that may be injected by other
  39. * applications
  40. *
  41. * @param Controller $controller
  42. * @param string $methodName
  43. * @param Response $response
  44. * @return Response
  45. */
  46. public function afterController($controller, $methodName, Response $response): Response {
  47. $policy = !is_null($response->getFeaturePolicy()) ? $response->getFeaturePolicy() : new FeaturePolicy();
  48. if (get_class($policy) === EmptyFeaturePolicy::class) {
  49. return $response;
  50. }
  51. $defaultPolicy = $this->policyManager->getDefaultPolicy();
  52. $defaultPolicy = $this->policyManager->mergePolicies($defaultPolicy, $policy);
  53. $response->setFeaturePolicy($defaultPolicy);
  54. return $response;
  55. }
  56. }