diff --git a/apps/workflowengine/js/requestremoteaddressplugin.js b/apps/workflowengine/js/requestremoteaddressplugin.js
new file mode 100644
index 0000000000000000000000000000000000000000..a66d6f51f0f8f1151938fbbaf5845fd50b418a93
Binary files /dev/null and b/apps/workflowengine/js/requestremoteaddressplugin.js differ
diff --git a/apps/workflowengine/lib/AppInfo/Application.php b/apps/workflowengine/lib/AppInfo/Application.php
index b024518c4c538fc30f8c791a5a3758b198006487..14efbaa45f4a3999519289c282a37f304cc21389 100644
--- a/apps/workflowengine/lib/AppInfo/Application.php
+++ b/apps/workflowengine/lib/AppInfo/Application.php
@@ -58,8 +58,9 @@ class Application extends \OCP\AppFramework\App {
'filemimetypeplugin',
'filesizeplugin',
'filesystemtagsplugin',
- 'requestuseragentplugin',
+ 'requestremoteaddressplugin',
'requesturlplugin',
+ 'requestuseragentplugin',
'usergroupmembershipplugin',
]);
},
diff --git a/apps/workflowengine/lib/Check/RequestRemoteAddress.php b/apps/workflowengine/lib/Check/RequestRemoteAddress.php
new file mode 100644
index 0000000000000000000000000000000000000000..7897fcbd9d3d0dc52e78d8723d8d9ff268cc8a0c
--- /dev/null
+++ b/apps/workflowengine/lib/Check/RequestRemoteAddress.php
@@ -0,0 +1,148 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016 Joas Schilling <coding@schilljs.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\WorkflowEngine\Check;
+
+
+use OCP\Files\Storage\IStorage;
+use OCP\IRequest;
+use OCP\WorkflowEngine\ICheck;
+
+class RequestRemoteAddress implements ICheck {
+
+ /** @var IRequest */
+ protected $request;
+
+ /**
+ * @param IRequest $request
+ */
+ public function __construct(IRequest $request) {
+ $this->request = $request;
+ }
+
+ /**
+ * @param IStorage $storage
+ * @param string $path
+ */
+ public function setFileInfo(IStorage $storage, $path) {
+ // A different path doesn't change time, so nothing to do here.
+ }
+
+ /**
+ * @param string $operator
+ * @param string $value
+ * @return bool
+ */
+ public function executeCheck($operator, $value) {
+ $actualValue = $this->request->getRemoteAddress();
+ $decodedValue = explode('/', $value);
+
+ if ($operator === 'matchesIPv4') {
+ return $this->matchIPv4($actualValue, $decodedValue[0], $decodedValue[1]);
+ } else if ($operator === '!matchesIPv4') {
+ return !$this->matchIPv4($actualValue, $decodedValue[0], $decodedValue[1]);
+ } else if ($operator === 'matchesIPv6') {
+ return $this->matchIPv6($actualValue, $decodedValue[0], $decodedValue[1]);
+ } else {
+ return !$this->matchIPv6($actualValue, $decodedValue[0], $decodedValue[1]);
+ }
+ }
+
+ /**
+ * @param string $operator
+ * @param string $value
+ * @throws \UnexpectedValueException
+ */
+ public function validateCheck($operator, $value) {
+ if (!in_array($operator, ['matchesIPv4', '!matchesIPv4', 'matchesIPv6', '!matchesIPv6'])) {
+ throw new \UnexpectedValueException('Invalid operator', 1);
+ }
+
+ $decodedValue = explode('/', $value);
+ if (sizeof($decodedValue) !== 2) {
+ throw new \UnexpectedValueException('Invalid IP range', 2);
+ }
+
+ if (in_array($operator, ['matchesIPv4', '!matchesIPv4'])) {
+ if (!filter_var($decodedValue[0], FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
+ throw new \UnexpectedValueException('Invalid IPv4 range', 3);
+ }
+ if ($decodedValue[1] > 32 || $decodedValue[1] <= 0) {
+ throw new \UnexpectedValueException('Invalid IPv4 range', 4);
+ }
+ } else {
+ if (!filter_var($decodedValue[0], FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
+ throw new \UnexpectedValueException('Invalid IPv6 range', 3);
+ }
+ if ($decodedValue[1] > 128 || $decodedValue[1] <= 0) {
+ throw new \UnexpectedValueException('Invalid IPv6 range', 4);
+ }
+ }
+ }
+
+ /**
+ * Based on http://stackoverflow.com/a/594134
+ * @param string $ip
+ * @param string $rangeIp
+ * @param int $bits
+ * @return bool
+ */
+ protected function matchIPv4($ip, $rangeIp, $bits) {
+ $rangeDecimal = ip2long($rangeIp);
+ $ipDecimal = ip2long($ip);
+ $mask = -1 << (32 - $bits);
+ return ($ipDecimal & $mask) === ($rangeDecimal & $mask);
+ }
+
+ /**
+ * Based on http://stackoverflow.com/a/7951507
+ * @param string $ip
+ * @param string $rangeIp
+ * @param int $bits
+ * @return bool
+ */
+ protected function matchIPv6($ip, $rangeIp, $bits) {
+ $ipNet = inet_pton($ip);
+ $binaryIp = $this->ipv6ToBits($ipNet);
+ $ipNetBits = substr($binaryIp, 0, $bits);
+
+ $rangeNet = inet_pton($rangeIp);
+ $binaryRange = $this->ipv6ToBits($rangeNet);
+ $rangeNetBits = substr($binaryRange, 0, $bits);
+
+ return $ipNetBits === $rangeNetBits;
+ }
+
+ /**
+ * Based on http://stackoverflow.com/a/7951507
+ * @param string $packedIp
+ * @return string
+ */
+ protected function ipv6ToBits($packedIp) {
+ $unpackedIp = unpack('A16', $packedIp);
+ $unpackedIp = str_split($unpackedIp[1]);
+ $binaryIp = '';
+ foreach ($unpackedIp as $char) {
+ $binaryIp .= str_pad(decbin(ord($char)), 8, '0', STR_PAD_LEFT);
+ }
+ return str_pad($binaryIp, 128, '0', STR_PAD_RIGHT);
+ }
+}
diff --git a/apps/workflowengine/tests/Check/RequestRemoteAddressTest.php b/apps/workflowengine/tests/Check/RequestRemoteAddressTest.php
new file mode 100644
index 0000000000000000000000000000000000000000..ec8798794df4c4fbcd490a77c584d5f72c660f83
--- /dev/null
+++ b/apps/workflowengine/tests/Check/RequestRemoteAddressTest.php
@@ -0,0 +1,123 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016 Joas Schilling <coding@schilljs.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\WorkflowEngine\Tests\Check;
+
+
+class RequestRemoteAddressTest extends \Test\TestCase {
+
+ /** @var \OCP\IRequest|\PHPUnit_Framework_MockObject_MockObject */
+ protected $request;
+
+ protected function setUp() {
+ parent::setUp();
+
+ $this->request = $this->getMockBuilder('OCP\IRequest')
+ ->getMock();
+ }
+
+ public function dataExecuteCheckIPv4() {
+ return [
+ ['127.0.0.1/32', '127.0.0.1', true],
+ ['127.0.0.1/32', '127.0.0.0', false],
+ ['127.0.0.1/31', '127.0.0.0', true],
+ ['127.0.0.1/32', '127.0.0.2', false],
+ ['127.0.0.1/31', '127.0.0.2', false],
+ ['127.0.0.1/30', '127.0.0.2', true],
+ ];
+ }
+
+ /**
+ * @dataProvider dataExecuteCheckIPv4
+ * @param string $value
+ * @param string $ip
+ * @param bool $expected
+ */
+ public function testExecuteCheckMatchesIPv4($value, $ip, $expected) {
+ $check = new \OCA\WorkflowEngine\Check\RequestRemoteAddress($this->request);
+
+ $this->request->expects($this->once())
+ ->method('getRemoteAddress')
+ ->willReturn($ip);
+
+ $this->assertEquals($expected, $check->executeCheck('matchesIPv4', $value));
+ }
+
+ /**
+ * @dataProvider dataExecuteCheckIPv4
+ * @param string $value
+ * @param string $ip
+ * @param bool $expected
+ */
+ public function testExecuteCheckNotMatchesIPv4($value, $ip, $expected) {
+ $check = new \OCA\WorkflowEngine\Check\RequestRemoteAddress($this->request);
+
+ $this->request->expects($this->once())
+ ->method('getRemoteAddress')
+ ->willReturn($ip);
+
+ $this->assertEquals(!$expected, $check->executeCheck('!matchesIPv4', $value));
+ }
+
+ public function dataExecuteCheckIPv6() {
+ return [
+ ['::1/128', '::1', true],
+ ['::2/128', '::3', false],
+ ['::2/127', '::3', true],
+ ['::1/128', '::2', false],
+ ['::1/127', '::2', false],
+ ['::1/126', '::2', true],
+ ['1234::1/127', '1234::', true],
+ ];
+ }
+
+ /**
+ * @dataProvider dataExecuteCheckIPv6
+ * @param string $value
+ * @param string $ip
+ * @param bool $expected
+ */
+ public function testExecuteCheckMatchesIPv6($value, $ip, $expected) {
+ $check = new \OCA\WorkflowEngine\Check\RequestRemoteAddress($this->request);
+
+ $this->request->expects($this->once())
+ ->method('getRemoteAddress')
+ ->willReturn($ip);
+
+ $this->assertEquals($expected, $check->executeCheck('matchesIPv6', $value));
+ }
+
+ /**
+ * @dataProvider dataExecuteCheckIPv6
+ * @param string $value
+ * @param string $ip
+ * @param bool $expected
+ */
+ public function testExecuteCheckNotMatchesIPv6($value, $ip, $expected) {
+ $check = new \OCA\WorkflowEngine\Check\RequestRemoteAddress($this->request);
+
+ $this->request->expects($this->once())
+ ->method('getRemoteAddress')
+ ->willReturn($ip);
+
+ $this->assertEquals(!$expected, $check->executeCheck('!matchesIPv6', $value));
+ }
+}