remote.php 5.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170
  1. <?php
  2. /**
  3. * @author Brice Maron <brice@bmaron.net>
  4. * @author Christopher Schäpers <kondou@ts.unde.re>
  5. * @author Joas Schilling <nickvergessen@owncloud.com>
  6. * @author Jörn Friedrich Dreyer <jfd@butonic.de>
  7. * @author Lukas Reschke <lukas@owncloud.com>
  8. * @author Robin Appelman <icewind@owncloud.com>
  9. * @author Robin McCorkell <robin@mccorkell.me.uk>
  10. * @author Thomas Müller <thomas.mueller@tmit.eu>
  11. * @author Vincent Petry <pvince81@owncloud.com>
  12. *
  13. * @copyright Copyright (c) 2016, ownCloud, Inc.
  14. * @license AGPL-3.0
  15. *
  16. * This code is free software: you can redistribute it and/or modify
  17. * it under the terms of the GNU Affero General Public License, version 3,
  18. * as published by the Free Software Foundation.
  19. *
  20. * This program is distributed in the hope that it will be useful,
  21. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  22. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  23. * GNU Affero General Public License for more details.
  24. *
  25. * You should have received a copy of the GNU Affero General Public License, version 3,
  26. * along with this program. If not, see <http://www.gnu.org/licenses/>
  27. *
  28. */
  29. use OCA\DAV\Connector\Sabre\ExceptionLoggerPlugin;
  30. use Sabre\DAV\Exception\ServiceUnavailable;
  31. use Sabre\DAV\Server;
  32. /**
  33. * Class RemoteException
  34. * Dummy exception class to be use locally to identify certain conditions
  35. * Will not be logged to avoid DoS
  36. */
  37. class RemoteException extends Exception {
  38. }
  39. /**
  40. * @param Exception | Error $e
  41. */
  42. function handleException($e) {
  43. $request = \OC::$server->getRequest();
  44. // in case the request content type is text/xml - we assume it's a WebDAV request
  45. $isXmlContentType = strpos($request->getHeader('Content-Type'), 'text/xml');
  46. if ($isXmlContentType === 0) {
  47. // fire up a simple server to properly process the exception
  48. $server = new Server();
  49. if (!($e instanceof RemoteException)) {
  50. // we shall not log on RemoteException
  51. $server->addPlugin(new ExceptionLoggerPlugin('webdav', \OC::$server->getLogger()));
  52. }
  53. $server->on('beforeMethod', function () use ($e) {
  54. if ($e instanceof RemoteException) {
  55. switch ($e->getCode()) {
  56. case OC_Response::STATUS_SERVICE_UNAVAILABLE:
  57. throw new ServiceUnavailable($e->getMessage());
  58. case OC_Response::STATUS_NOT_FOUND:
  59. throw new \Sabre\DAV\Exception\NotFound($e->getMessage());
  60. }
  61. }
  62. $class = get_class($e);
  63. $msg = $e->getMessage();
  64. throw new ServiceUnavailable("$class: $msg");
  65. });
  66. $server->exec();
  67. } else {
  68. $statusCode = OC_Response::STATUS_INTERNAL_SERVER_ERROR;
  69. if ($e instanceof \OC\ServiceUnavailableException ) {
  70. $statusCode = OC_Response::STATUS_SERVICE_UNAVAILABLE;
  71. }
  72. if ($e instanceof RemoteException) {
  73. // we shall not log on RemoteException
  74. OC_Response::setStatus($e->getCode());
  75. OC_Template::printErrorPage($e->getMessage());
  76. } else {
  77. \OC::$server->getLogger()->logException($e, ['app' => 'remote']);
  78. OC_Response::setStatus($statusCode);
  79. OC_Template::printExceptionErrorPage($e);
  80. }
  81. }
  82. }
  83. /**
  84. * @param $service
  85. * @return string
  86. */
  87. function resolveService($service) {
  88. $services = [
  89. 'webdav' => 'dav/appinfo/v1/webdav.php',
  90. 'dav' => 'dav/appinfo/v2/remote.php',
  91. 'caldav' => 'dav/appinfo/v1/caldav.php',
  92. 'calendar' => 'dav/appinfo/v1/caldav.php',
  93. 'carddav' => 'dav/appinfo/v1/carddav.php',
  94. 'contacts' => 'dav/appinfo/v1/carddav.php',
  95. 'files' => 'dav/appinfo/v1/webdav.php',
  96. ];
  97. if (isset($services[$service])) {
  98. return $services[$service];
  99. }
  100. return \OC::$server->getConfig()->getAppValue('core', 'remote_' . $service);
  101. }
  102. try {
  103. require_once 'lib/base.php';
  104. // All resources served via the DAV endpoint should have the strictest possible
  105. // policy. Exempted from this is the SabreDAV browser plugin which overwrites
  106. // this policy with a softer one if debug mode is enabled.
  107. header("Content-Security-Policy: default-src 'none';");
  108. if (\OCP\Util::needUpgrade()) {
  109. // since the behavior of apps or remotes are unpredictable during
  110. // an upgrade, return a 503 directly
  111. throw new RemoteException('Service unavailable', OC_Response::STATUS_SERVICE_UNAVAILABLE);
  112. }
  113. $request = \OC::$server->getRequest();
  114. $pathInfo = $request->getPathInfo();
  115. if ($pathInfo === false || $pathInfo === '') {
  116. throw new RemoteException('Path not found', OC_Response::STATUS_NOT_FOUND);
  117. }
  118. if (!$pos = strpos($pathInfo, '/', 1)) {
  119. $pos = strlen($pathInfo);
  120. }
  121. $service=substr($pathInfo, 1, $pos-1);
  122. $file = resolveService($service);
  123. if(is_null($file)) {
  124. throw new RemoteException('Path not found', OC_Response::STATUS_NOT_FOUND);
  125. }
  126. // force language as given in the http request
  127. \OC::$server->getL10NFactory()->setLanguageFromRequest();
  128. $file=ltrim($file, '/');
  129. $parts=explode('/', $file, 2);
  130. $app=$parts[0];
  131. // Load all required applications
  132. \OC::$REQUESTEDAPP = $app;
  133. OC_App::loadApps(array('authentication'));
  134. OC_App::loadApps(array('filesystem', 'logging'));
  135. switch ($app) {
  136. case 'core':
  137. $file = OC::$SERVERROOT .'/'. $file;
  138. break;
  139. default:
  140. if (!\OC::$server->getAppManager()->isInstalled($app)) {
  141. throw new RemoteException('App not installed: ' . $app);
  142. }
  143. OC_App::loadApp($app);
  144. $file = OC_App::getAppPath($app) .'/'. $parts[1];
  145. break;
  146. }
  147. $baseuri = OC::$WEBROOT . '/remote.php/'.$service.'/';
  148. require_once $file;
  149. } catch (Exception $ex) {
  150. handleException($ex);
  151. } catch (Error $e) {
  152. handleException($e);
  153. }