wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
server/lib/private
History
Lukas Reschke bbd5f28415 Let users configure security headers in their Webserver 
Doing this in the PHP code is not the right approach for multiple reasons:

1. A bug in the PHP code prevents them from being added to the response.
2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud)
3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations.

This pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS.
2015-03-02 19:07:46 +01:00
..
app Merge pull request #14529 from owncloud/intuitive-version-check 2015-02-27 02:16:23 -08:00
appframework Let users configure security headers in their Webserver 2015-03-02 19:07:46 +01:00
archive Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
assetic Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
backgroundjob Merge pull request #14530 from owncloud/revert-14403 2015-02-27 00:39:29 -08:00
cache Merge pull request #14530 from owncloud/revert-14403 2015-02-27 00:39:29 -08:00
command Add FileAccess trait for commands 2015-02-25 15:09:41 +01:00
connector/sabre Merge pull request #14530 from owncloud/revert-14403 2015-02-27 00:39:29 -08:00
contacts Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
db Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
diagnostics Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
fileproxy Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
files Allow disabling the cache updater 2015-02-27 17:14:16 +01:00
group Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
hooks Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
l10n Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
legacy Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
log Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
memcache Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
ocs Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
preview Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
repair Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
route Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
search Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
security Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
session Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
setup Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
share Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
tagging Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
template Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
user Let users configure security headers in their Webserver 2015-03-02 19:07:46 +01:00
activitymanager.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
allconfig.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
api.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
app.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
appconfig.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
apphelper.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
archive.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
arrayparser.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
avatar.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
avatarmanager.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
backgroundjob.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
cache.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
config.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
contactsmanager.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
databaseexception.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
databasesetupexception.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
datetimeformatter.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
datetimezone.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
db.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
defaults.php Add more HTTPS endpoints 2015-02-27 11:37:30 +01:00
eventsource.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
filechunking.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
fileproxy.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
files.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
forbiddenexception.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
geo.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
group.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
helper.php Merge pull request #14530 from owncloud/revert-14403 2015-02-27 00:39:29 -08:00
hintexception.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
hook.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
httphelper.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
image.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
installer.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
json.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
l10n.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
largefilehelper.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
log.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
mail.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
mimetypes.list.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
naturalsort.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
naturalsort_defaultcollator.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
navigationmanager.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
needsupdateexception.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
notsquareexception.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
ocs.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
ocsclient.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
preview.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
previewmanager.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
repair.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
repairexception.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
repairstep.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
response.php Let users configure security headers in their Webserver 2015-03-02 19:07:46 +01:00
search.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
server.php Merge pull request #14530 from owncloud/revert-14403 2015-02-27 00:39:29 -08:00
serviceunavailableexception.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
setup.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
subadmin.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
systemconfig.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
tagmanager.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
tags.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
template.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
templatelayout.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
tempmanager.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
updater.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
urlgenerator.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
user.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00
util.php Disable some server checks when running on HHVM 2015-02-28 10:08:41 +01:00
vobject.php Revert "Updating license headers" 2015-02-26 11:37:37 +01:00