Fix SCSS usage in apps

[MorrisJobke]

• fix the web root detection of the ResourceLocator for apps

[mention-bot]

@MorrisJobke, thanks for your PR! By analyzing the history of the files in this pull request, we identified @nickvergessen, @bartv2 and @butonic to be potential reviewers.

[codecov-io]

Codecov Report

Merging #3619 into master will decrease coverage by -0.01%.
The diff coverage is 23.52%.

@@             Coverage Diff             @@
##             master   #3619      +/-   ##
===========================================
- Coverage     54.31%   54.3%   -0.01%     
- Complexity    20926   20930       +4     
===========================================
  Files          1297    1297              
  Lines         79828   79844      +16     
  Branches       1253    1253              
===========================================
+ Hits          43358   43362       +4     
- Misses        36470   36482      +12

Impacted Files	Coverage Δ	Complexity Δ
lib/private/Template/ResourceLocator.php	68% <23.52%> (-23.18%)	18 <ø> (+4)
lib/private/Files/Cache/Propagator.php	96.2% <ø> (+1.26%)	16% <ø> (ø)	❌

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8a7b8f9...cf3e2eb. Read the comment docs.

[raimund-schluessler]

Seems to fix the loading of the compiled css file, but the log shows this after loading the Tasks app:

{"reqId":"3PK1Nsw4KSUukJz0r8HN","remoteAddr":"192.168.56.1","app":"css","message":"Could not find resource file \"\/nextcloud\/index.php\/css\/core\/styles.css\"","level":0,"time":"2017-02-25T08:19:28+00:00","method":"GET","url":"\/nextcloud\/index.php\/apps\/tasks\/","user":"admin","version":"12.0.0.13"}
{"reqId":"3PK1Nsw4KSUukJz0r8HN","remoteAddr":"192.168.56.1","app":"css","message":"Could not find resource file \"\/nextcloud\/index.php\/css\/core\/header.css\"","level":0,"time":"2017-02-25T08:19:28+00:00","method":"GET","url":"\/nextcloud\/index.php\/apps\/tasks\/","user":"admin","version":"12.0.0.13"}
{"reqId":"3PK1Nsw4KSUukJz0r8HN","remoteAddr":"192.168.56.1","app":"css","message":"Could not find resource file \"\/nextcloud\/index.php\/css\/core\/icons.css\"","level":0,"time":"2017-02-25T08:19:28+00:00","method":"GET","url":"\/nextcloud\/index.php\/apps\/tasks\/","user":"admin","version":"12.0.0.13"}
{"reqId":"3PK1Nsw4KSUukJz0r8HN","remoteAddr":"192.168.56.1","app":"css","message":"Could not find resource file \"\/nextcloud\/index.php\/css\/core\/apps.css\"","level":0,"time":"2017-02-25T08:19:28+00:00","method":"GET","url":"\/nextcloud\/index.php\/apps\/tasks\/","user":"admin","version":"12.0.0.13"}
{"reqId":"3PK1Nsw4KSUukJz0r8HN","remoteAddr":"192.168.56.1","app":"css","message":"Could not find resource file \"\/nextcloud\/index.php\/css\/core\/multiselect.css\"","level":0,"time":"2017-02-25T08:19:28+00:00","method":"GET","url":"\/nextcloud\/index.php\/apps\/tasks\/","user":"admin","version":"12.0.0.13"}
{"reqId":"3PK1Nsw4KSUukJz0r8HN","remoteAddr":"192.168.56.1","app":"css","message":"Could not find resource file \"\/nextcloud\/index.php\/css\/core\/tooltip.css\"","level":0,"time":"2017-02-25T08:19:28+00:00","method":"GET","url":"\/nextcloud\/index.php\/apps\/tasks\/","user":"admin","version":"12.0.0.13"}
{"reqId":"3PK1Nsw4KSUukJz0r8HN","remoteAddr":"192.168.56.1","app":"core","message":"Could not find resource file \"\/nextcloud\/index.php\/css\/core\/share.css\"","level":0,"time":"2017-02-25T08:19:28+00:00","method":"GET","url":"\/nextcloud\/index.php\/apps\/tasks\/","user":"admin","version":"12.0.0.13"}
{"reqId":"3PK1Nsw4KSUukJz0r8HN","remoteAddr":"192.168.56.1","app":"css","message":"Could not find resource file \"\/nextcloud\/index.php\/css\/core\/inputs.css\"","level":0,"time":"2017-02-25T08:19:28+00:00","method":"GET","url":"\/nextcloud\/index.php\/apps\/tasks\/","user":"admin","version":"12.0.0.13"}
{"reqId":"3PK1Nsw4KSUukJz0r8HN","remoteAddr":"192.168.56.1","app":"tasks","message":"Could not find resource file \"\/nextcloud\/index.php\/css\/tasks\/style.css\"","level":0,"time":"2017-02-25T08:19:28+00:00","method":"GET","url":"\/nextcloud\/index.php\/apps\/tasks\/","user":"admin","version":"12.0.0.13"}

However, the call to e.g. http://192.168.56.2/nextcloud/index.php/css/tasks/style.css works, despite what the log says.

Also the images referenced with url("../img/sprites.svg"); in the css/scss file cannot be found anymore.

[raimund-schluessler]

The reason for the errors in the log seems to be that line

server/lib/private/Template/ResourceLocator.php

Line 156 in cf3e2eb

throw new ResourceNotFoundException($file, $webRoot);

is called although the resource was found.

The images not loaded seems to be a separate issue: #3606 (comment)

[rullzer]

Ok I think (tm) this works now!

[raimund-schluessler]

It works on my testing instance now. The css file is generated, the file is included and loads correctly and also the paths to icon files are calculated correctly now (although url('../../../apps/tasks/css/../img/sprites.svg') could be shortened to url('../../../apps/tasks/img/sprites.svg').

[skjnldsv]

@raimund-schluessler yes, but it's easier to just add a piece of string than splitting it, popping an entry and remerging it again :)

[dirigit]

@skjnldsv
Constructs like being shown by raimund-schuessler ('../../xyadf/../) are considered insecure because they are often used in attacks (directory traversal). You can block such attacks in core successfull and easy only when you don't use those constructs for yourself. Otherwise you need a lot of exceptions even at firewall or proxy parsing URLs for possible attacks ...

[raimund-schluessler]

@skjnldsv Would you have time to review if the PR is working for you?

Constructs like being shown by raimund-schuessler ('../../xyadf/../) are considered insecure because they are often used in attacks (directory traversal). You can block such attacks in core successfull and easy only when you don't use those constructs for yourself. Otherwise you need a lot of exceptions even at firewall or proxy parsing URLs for possible attacks ...

I think we should merge the PR if it fixes the issue. Regarding the security implications I can't say anything. However, I would still merge this PR since the paths are already created like this in server. In case the security impact is real I would prefer fixing this in a separate PR. Also @LukasReschke.

[juliusknorr]

Constructs like being shown by raimund-schuessler ('../../xyadf/../) are considered insecure because they are often used in attacks (directory traversal). You can block such attacks in core successfull and easy only when you don't use those constructs for yourself. Otherwise you need a lot of exceptions even at firewall or proxy parsing URLs for possible attacks ...

I don't see any security issue here, since those path traversals are only used in CSS url statements and will be resolved by your webserver.

[skjnldsv]

Can't test right now, but seems good to me :)

[MorrisJobke]

I tested it and it works 👍

[derkostka]

@rullzer @MorrisJobke : I did several tests. I got an exception thrown under the following condition:

Edit: Found the problem, maybe it is of interest:

I´ve had the folder "/var/www/" symlinked to an external sd, that is encrypted and rather slow. The problem was that no folder icons were drawn and the exception (see below) occured. Now i have moved the "/var/www/nextcloud" back to the internal parititon and everything is fine.

Log was:
{"reqId":"44JIuvpq9gxa8N2z7B6B","level":3,"time":"May 21, 2017 11:51:08","remoteAddr":"127.0.0.1","user":"[email protected]","app":"lib","method":"GET","url":"\/apps\/files\/","message":"ResourceLocator can not find a web root (root: \/var\/www\/nextcloud\/apps\/files, file: css\/files\/merged.css, webRoot: , throw: true)","userAgent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/58.0.3029.110 Safari\/537.36","version":"12.0.0.26"}