4a41e0cc42
getIncompatibleApps needs a string not an array
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-02-21 13:00:41 +07:00
1429146083
Merge pull request #8096 from nextcloud/feature/6382/do-not-cache-settings-in-db-anymore
...
Do not cache the settings/sections in the database anymore
2018-01-31 12:49:45 +07:00
f23ed5e0ea
Make sure we don't query the AppManager before the installation started
...
Otherwise we end up with the database not being instantiated
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-01-30 19:05:49 +07:00
d971b104ed
Do not cache the settings/sections in the database anymore
...
This caused more troubles then it had benefits, especially
when an app got disabled or was removed without being disabled.
Signed-off-by: Joas Schilling <coding@schilljs.com>
2018-01-29 15:47:37 +07:00
eb51f06a3b
Use ::class statement instead of string
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-01-29 12:03:47 +07:00
a661f043e1
Remove unneeded semicolon and parentheses
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-01-26 23:46:40 +07:00
abb17589b1
Merge pull request #7991 from nextcloud/show-trusted-domain-error-in-status.php
...
Send a proper response for status.php on trusted domain error
2018-01-24 15:05:49 +07:00
4537faa5da
Merge pull request #7918 from nextcloud/properly-log-exceptions
...
Properly log the full exception instead of only the message
2018-01-23 11:56:02 +07:00
2a38605545
Properly log the full exception instead of only the message
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-01-23 10:57:21 +07:00
c7d9e5fd63
Merge pull request #7354 from nextcloud/refacor-update-page-print
...
Refactor method to check if update is needed
2018-01-22 22:50:05 +07:00
37026d8b9d
Send a proper response for status.php on trusted domain error
...
* fixes #7732
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-01-22 15:58:57 +07:00
6bf1fca6f0
Fix strict typing issues in lib/base.php
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-01-12 14:22:31 +07:00
b19fae2629
Fix error log on PHP 7.2
...
Fixes following error in the logs: "ini_set(): A session is active. You cannot change the session module's ini settings at this time"
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-12-12 14:33:30 +07:00
0f35ef3727
Reuse systemconfig
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-11-30 16:04:07 +07:00
f22e02cd79
Refactor method to check if update is needed
...
There was only one call, that actually needed the parameter to be set to true. So this change moved the print of the page to that location and replaces all other occurences with a direct call to the underlying OCP API.
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-11-30 16:04:07 +07:00
8ccb486876
Merge pull request #7264 from nextcloud/cache-fetched-apps
...
Cache fetched apps in update check
2017-11-27 11:48:59 +07:00
0e2f00ec59
Get the Installer via DI
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-11-25 12:00:57 +07:00
5a270c2715
Reset bruteforce attempt table on successful login
...
* only clear the entries that come from the same subnet, same action and same metadata
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-11-24 14:58:57 +07:00
0eebff152a
Update license headers
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-11-06 16:56:19 +07:00
e2139d4b56
Add logrote as a default background job
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-10-24 08:28:06 +07:00
95cc831ed7
Remove SAML hack from base.php
...
This is no longer required now that
https://github.com/nextcloud/user_saml/pull/159 is in
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-09-27 08:28:09 +07:00
c257cd57d4
Handle SameSiteCookie check for index.php in AppFramework Middleware
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-09-24 21:07:16 +07:00
0f83cdc78e
Use the guest.css for the maintenance page as well
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-06-13 16:43:25 +07:00
b744639136
Reset opcache if update is detected
...
This even works if opcache_reset is in the disabled_functions php.ini setting.
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-05-21 18:38:24 +07:00
8c5062794f
Merge pull request #4873 from nextcloud/check-whether-REQUEST-exists
...
Check whether the $_SERVER['REQUEST_*'] vars exist before using them
2017-05-15 09:49:11 +07:00
72c1b24844
Check whether the $_SERVER['REQUEST_*'] vars exist before using them
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-05-15 14:33:27 +07:00
3fa604cc5e
Allow to enforce update via web UI
...
* adds a disclaimer that an update via web UI is on own risk
* allows to skip the warning
* fixes #4353
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-05-11 10:22:44 +07:00
abe4a19cbc
Properly decide on actual users if instance is too big
...
* state the reason why NC thinks it is a big instance
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-05-10 22:32:42 +07:00
9309217ecb
Fix escaped HTML on error pages
...
* fixes #4655
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-05-08 21:16:08 +07:00
d925856787
dont spam log when request can't access filesystem
...
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-04-28 17:01:31 +07:00
d4ba8198fe
Make the emergency disable also accept arrays
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-04-26 20:07:51 +07:00
f23a36b0a6
Add activities when email or password is changed
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-04-13 11:13:19 +07:00
5b4adf66e5
Move OC_Defaults to OCP\Defaults
...
* currently there are two ways to access default values:
OCP\Defaults or OC_Defaults (which is extended by
OCA\Theming\ThemingDefaults)
* our code used a mixture of both of them, which made
it hard to work on theme values
* this extended the public interface with the missing
methods and uses them everywhere to only rely on the
public interface
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-04-09 21:43:01 +07:00
edd55b0ea9
Use SystemConfig instead of AllConfig for DB stuff
...
* preparation for followup PRs to clean up the DB bootstrapping
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-03-19 15:53:49 +07:00
0024b67aaf
Check that set_time_limit is not disabled before calling it
...
Signed-off-by: Ko- <k.stoffelen@cs.ru.nl>
2017-03-11 17:04:21 +07:00
a5ba1f7803
Remove legacy class OC_Group and OC_User
...
* basically a straight replacement of the wrapped code at the calling code parts
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-03-09 17:35:09 +07:00
be36513819
Extend Same Site cookie user_saml exemption rule
...
The current check does not trigger if $request->getRequestUri() does not return index.php as a prefix
(on my config this was occuring using nginx to serve Nextcloud)
Signed-off-by: Vincent Vanackere <vincent.vanackere@trustelem.com>
2017-03-07 16:22:57 +07:00
e399097e3a
Remove deprecated OC_User::isLoggedIn
...
Signed-off-by: Sebastian Wessalowski <sebastian@wessalowski.org>
2017-03-02 22:59:39 +07:00
9533f4e5ed
Clean up single user mode
...
Single user mode basically disables WebDAV, OCS and cron execution. Since
we heavily rely on WebDAV and OCS also in the web UI it's basically useless.
An admin only sees a broken interface and can't even change any settings nor
sees any files. Also sharing is not possible.
As this is at least the case since Nextcloud 9 and we haven't received any
reports for this it seems that this feature is not used at all so I removed it.
The encryption commands now rely on the well tested maintenance mode.
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-02-22 23:02:31 +07:00
2c9d7eeb76
Fix public page css fallback loading
...
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2017-02-01 18:03:51 +07:00
bde1150d04
Merge pull request #3004 from nextcloud/fix-installation-css
...
Fixed installation page
2017-01-22 18:28:33 +07:00
e4b3ba6590
Create unified css file and merge all needed data into this file
...
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2017-01-10 17:50:29 +07:00
30689f338f
Merge pull request #2914 from nextcloud/logrotate-logfile
...
Get the logfile location while running the logrotate cron job instead…
2017-01-10 14:28:09 +07:00
4dd2a1e679
Merge pull request #2943 from nextcloud/kill_old_preview_code
...
Cleanup old preview code
2017-01-10 13:50:14 +07:00
b847dfcee9
Merge pull request #2925 from nextcloud/remove-close-wrapper
...
replace close:// streamwrapper with CallBackWrapper
2017-01-10 10:21:10 +07:00
69f3430552
Allow access to CSS resources
...
Fixes https://github.com/nextcloud/server/issues/2984
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-01-09 12:53:58 +07:00
54f96e5f58
Get the logfile location while running the logrotate cron job instead of when registering the job
...
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-01-06 16:10:07 +07:00
5774d3e82c
replace close:// streamwrapper with CallBackWrapper
...
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-01-06 15:33:32 +07:00
73fcb69cad
Merge pull request #2934 from nextcloud/quota-stream-non-global
...
remove the need to register the quota streamwrapper globally
2017-01-06 15:25:20 +07:00
5e02c7f7bd
Theme update pages via CSS
...
* SCSS on-the-fly generation isn't allowed during update
* fallback to plain CSS
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-01-06 12:36:16 +07:00
e723363053
Remove old preview code
...
* \OC\Preview is no more
* \Test\PreviewTests is no more
* PreviewHooks in base.php are gone
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-01-04 20:14:16 +07:00
bca91f2216
remove static:// stream wrapper
...
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-01-04 15:57:02 +07:00
968de70bc5
remove the need to register the quota streamwrapper globally
...
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-01-04 15:15:47 +07:00
5b09565594
remove no longer used fakedir stream wrapper
...
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-01-03 17:06:03 +07:00
47646794b9
Merge pull request #2322 from nextcloud/compat-with-chrome54
...
Remove exception for Chrome on Mobile
2016-11-25 12:00:56 +07:00
64fb0fb3dd
Merge pull request #2276 from nextcloud/update-email-address
...
Update email address
2016-11-25 11:40:20 +07:00
0de685c562
bring back setEmailAddress for the user management
...
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2016-11-25 10:26:48 +07:00
3fc75073b8
update accounts table if email address or display name changes from outside
...
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2016-11-25 10:26:47 +07:00
2144a114b0
Remove exception for Chrome on Mobile
...
This didn't really work anyways and Chrome 54 for Android has been pushed out via Google Play on October 19th. So we should remove this.
This is only in master and doesn't affect any stable branch.
Fixes https://github.com/nextcloud/server/issues/2318
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-11-24 22:26:10 +07:00
a05b8b7953
Harden cookies more appropriate
...
This adds the __Host- prefix to the same-site cookies. This is a small but yet nice security hardening.
See https://googlechrome.github.io/samples/cookie-prefixes/ for the implications.
Fixes https://github.com/nextcloud/server/issues/1412
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-11-23 12:53:44 +07:00
6a525fadbb
Show all in one message
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-11-16 12:27:22 +07:00
b228ed7bef
add explanatory text of what to do on app version error
...
Signed-off-by: Jan-Christoph Borchardt <hey@jancborchardt.net>
2016-11-16 11:47:39 +07:00
e74c527268
Merge pull request #1973 from nextcloud/dont-disable-shipped-apps-but-throw-instead
...
Throw an exception when a shipped app was not replaced before the update
2016-11-02 21:20:23 +07:00
d907666232
bring back remember-me
...
* try to reuse the old session token for remember me login
* decrypt/encrypt token password and set the session id accordingly
* create remember-me cookies only if checkbox is checked and 2fa solved
* adjust db token cleanup to store remembered tokens longer
* adjust unit tests
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2016-11-02 13:39:16 +07:00
9b66e8f7d9
Throw an exception when a shipped app was not replaced before the update
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-11-02 10:00:14 +07:00
748f18f34e
Remove all unneeded set_include_path()
2016-10-25 18:08:54 +07:00
f920153f16
Throw exception because the logger causes session issues anyway that early in the request cycle
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2016-10-24 21:14:44 +07:00
2e0e68b57f
log error when setting timezone to UTC fails ( #26354 )
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-24 21:14:40 +07:00
9e9fef46d9
Get rid of very old oc:// stream wrapper ( #26381 )
2016-10-20 20:46:30 +07:00
9a2511fe9b
Don't check for Same-Site cookie on Chrome Android
...
Chrome on Android has a bug that it doesn't sent cookies with the
same-site attribute for the download manager. To work around that
all same-site cookies get deleted and recreated directly. Awesome!
FIXME: Remove once Chrome 54 is deployed to end-users
@see https://github.com/nextcloud/server/pull/1454
2016-09-20 01:20:17 +07:00
6ac890812f
Add exemptions for incompatible UAs
...
Some user agents are notorious and don't really properly follow HTTP
specifications. For those, have an automated opt-out. Since the protection
for remote.php is applied in base.php as starting point we need to opt out
here.
2016-09-08 17:20:46 +07:00
7bfc698ae4
Allow to call status.php before the instance is installed
2016-09-06 13:59:45 +07:00
acffaa55a1
Short circuit processing of the heartbeat request
2016-08-30 15:44:00 +07:00
b50a03141b
Fix redirection taking care of protocol and port
2016-08-29 14:24:23 +07:00
208e551216
check registered sections and settings after an app got updated to garbage collect orphaned classes
2016-08-16 00:56:17 +07:00
9edca39b49
attempt to remove section and settings entries when an app got disabled
2016-08-16 00:56:17 +07:00
4277051442
Merge pull request #660 from gdamjan/custom-config-dir
...
introduce NEXTCLOUD_CONFIG_DIR env variable (see #300 )
2016-08-09 10:58:23 +07:00
835dc59d6a
reduce info on update screens, introduce button to refresh
2016-08-04 12:48:25 +07:00
982bdb1823
introduce NEXTCLOUD_CONFIG_DIR env variable (see #300 )
...
nextcloud by default uses the `/config/` directory in the source/application tree for its config file(s).
with this commit that directory can be overridden by the `NEXTCLOUD_CONFIG_DIR` environment variable.
in uwsgi, you would use the option `--env "NEXTCLOUD_CONFIG_DIR=/tmp/nx-config/"`
in apache `SetENV …`
and the cli command can be run with: `NEXTCLOUD_CONFIG_DIR=/tmp/nx-config ./occ` (or just use `export` once in the
shell).
NEXTCLOUD_CONFIG_DIR can be supplied with or without the trailing slash (`/`), but in all cases `$configDir` will have
it automatically added if needed.
The other changes are several occurrences of `OC::$SERVERROOT . '/config'` to `OC::$configDir`.
2016-07-29 17:49:14 +07:00
0215b004da
Update with robin
2016-07-21 18:13:58 +07:00
ba87db3fcc
Fix others
2016-07-21 18:13:57 +07:00
c385423d10
Merge pull request #479 from nextcloud/add-bruteforce-throttler
...
Implement brute force protection
2016-07-21 00:31:02 +07:00
ba4f12baa0
Implement brute force protection
...
Class Throttler implements the bruteforce protection for security actions in
Nextcloud.
It is working by logging invalid login attempts to the database and slowing
down all login attempts from the same subnet. The max delay is 30 seconds and
the starting delay are 200 milliseconds. (after the first failed login)
2016-07-20 22:08:56 +07:00
a299fa38a9
[master] Port Same-Site Cookies to master
...
Fixes https://github.com/nextcloud/server/issues/50
2016-07-20 18:37:57 +07:00
13a25535d2
Merge pull request #400 from nextcloud/ocs_appframework
...
OCS routes use AppFramework
2016-07-19 12:21:14 +07:00
1caceea6c0
Make the OCS endpoint handle the new OCS AppFramework routes
2016-07-18 11:09:45 +07:00
2c988ecbf4
Use the themed Defaults everywhere
2016-07-15 09:17:30 +07:00
2791b8f00d
Revert "occ web executor ( #24957 )"
...
This reverts commit 854352d9a0
2016-07-07 12:14:45 +07:00
e3b509220b
Revert "Bypass upgrade page when occ controller is requested"
...
This reverts commit 89e581acf8
2016-07-07 12:14:39 +07:00
ba16fd0d33
Merge branch 'master' into sync-master
2016-07-07 11:29:46 +07:00
e38bbdc9fe
Bypass upgrade page when occ controller is requested
2016-07-05 09:20:37 +07:00
90b7f74da7
Changed name of default logfile from owncloud.log to nextcloud.log.
2016-07-04 11:50:32 +07:00
7a9d60d87e
Merge remote-tracking branch 'upstream/master' into master-upstream-sync
2016-06-26 12:55:05 +07:00
854352d9a0
occ web executor ( #24957 )
...
* Initial web executor
* Fix PHPDoc
Fix broken integration test
OccControllerTests do not require database access - moch them all!
Kill unused sprintf
2016-06-22 13:12:36 +07:00
fa19e4c2eb
some text-changes to nextcloud
2016-06-22 08:41:10 +07:00
39aeebfac5
Print error message again, when 3rdparty submodule is not initialized
...
- old code used Response which attempted to use OC::$server which is not
and cannot be intialised at this part of the code.
2016-06-08 10:34:32 +07:00
aba539703c
Update license headers
2016-05-26 19:57:24 +07:00
6222d42462
Fix class name in hook registration
2016-05-24 10:42:11 +07:00
c9ad60defc
Only allow loading of legacy (lib/private/legacy) by default
2016-05-20 16:35:07 +07:00
d666725fa7
Move \OCP to PSR-4
2016-05-19 09:43:33 +07:00
379be91618
Merge pull request #24597 from owncloud/run-upgrade-in-incognito-mode
...
run upgrades in incognito mode
2016-05-17 16:14:11 +07:00
5c9103287f
Group fixup ( #24621 )
...
* Move used OC_Group_xx to \OC\Group
* Add (deprecated) legacy wrapper in legacy, OC_Group_xx
* Replace deprecated use of OC_Group_xx with \OC\Group\xx
2016-05-17 16:06:44 +07:00
8b6bb0a426
Log user out correctly if max session lifetime is reached ( #24552 )
2016-05-12 12:09:13 +07:00
3a1882b143
run upgrades in incognito mode
2016-05-12 11:56:58 +07:00
168ccf90a6
try apache auth too
2016-05-11 13:36:46 +07:00
d8cde414bd
token based auth
...
* Add InvalidTokenException
* add DefaultTokenMapper and use it to check if a auth token exists
* create new token for the browser session if none exists
hash stored token; save user agent
* encrypt login password when creating the token
2016-05-11 13:36:46 +07:00
9e1d9871a8
Move OC_User_Database to \OC\User\Database
2016-05-10 19:53:36 +07:00
8668560352
Keep the composer instance so we can add psr4 paths later
2016-05-02 14:10:53 +07:00
e37b95ae53
Merge pull request #24200 from owncloud/appframework_psr4
...
Move \OC\AppFramework to PSR-4
2016-04-22 17:22:02 +07:00
f56be022a3
Disable web updater if ldap or shibboleth are installed - refs https://github.com/owncloud/core/issues/23913#issuecomment-213432232
2016-04-22 15:53:27 +07:00
1d33a5ef13
Move \OC\AppFramework to PSR-4
...
* Also moved the autoloader setup a bit up since we need it in initpaths
2016-04-22 15:28:09 +07:00
afad27fafd
Merge pull request #24075 from owncloud/no-html-on-cli
...
In case of fatal php errors and other unhandled exceptions no html er…
2016-04-20 13:50:43 +07:00
1773dcbef2
Merge pull request #23973 from owncloud/share_move_post_delete_from_group_hook
...
Move post_removeFromGroup to shareManager
2016-04-19 06:59:58 +07:00
c609abf075
In case of fatal php errors and other unhandled exceptions no html error page is expected to be displayed in the console
2016-04-18 22:30:01 +07:00
8222ad5157
Move logout to controller
...
Testable code. Yay.
2016-04-18 21:21:52 +07:00
739dfb5c66
Suggest cli based updater in case the instance is bigger - #23913
2016-04-18 17:09:21 +07:00
17dfffefb3
Keep used username in URL
...
This is required until the new controller can also handle POST requests
2016-04-15 19:33:25 +07:00
331e4efacb
Move login form into controller
...
First step on getting the authorisation stuff cleaned up. This is only for the login form, all other stuff is still where it is.
2016-04-15 17:36:23 +07:00
dc061bae42
Kill movable 3rdparty
2016-04-14 17:59:49 +07:00
6144ced7a0
Move post_removeFromGroup to shareManager
...
The last sharing hook to be moved over.
* Added unit tests
* Removed old tests that relied on old behaviour
* Removed old hooks.php
2016-04-13 15:00:12 +07:00
495a964ca2
Migrate post_groupDelete hook to share manager ( #23841 )
...
The hook now calls the share manager that will call the responsible
shareProvider to do the proper cleanup.
* Unit tests added
Again nothing should change it is just to cleanup old code
2016-04-12 09:46:25 +07:00
8e16e7bf34
Merge pull request #23856 from owncloud/share_remove_addtogroup_hooks
...
Remove pre/post_addToGroup hooks for shares
2016-04-11 15:05:20 +07:00
3fae4c82d2
Remove pre/post_addToGroup hooks for shares
...
There is no need to perform the checks for unique targets on add to
group as we have to do this all when mounting the shares anyway.
2016-04-08 11:56:38 +07:00
b1a856d7b7
lib: Fix typos (found by codespell)
...
Signed-off-by: Stefan Weil <sw@weilnetz.de>
2016-04-07 19:51:27 +07:00
0de15a86f0
Merge pull request #23773 from owncloud/share_move_delete_user_hook
...
Migrate post_userDelete hook to share manager
2016-04-07 13:01:10 +07:00
e0cee43cf0
Migrate post_userDelete hook to share manager
...
This makes the post_userDelete hook call the sharemanager. This will
cleanup to and from this user.
* All shares owned by this user
* All shares with this user (user)
* All custom group shares
* All link share initiated by this user (to avoid invisible link shares)
Unit tests are added for the defaultshare provider as well as the
federated share provider
2016-04-04 14:15:38 +07:00
1bf4c75e8b
Show individual sql schema migration steps during upgrade - on web as well as on the command line
2016-04-04 12:34:18 +07:00
93ed965cbb
fix creation of versions of encrypted files on external storages
...
in order to create a 1:1 copy of a file if a version gets created
we need to store this information on copyBetweenStorage(). This
allows us to by-pass the encryption wrapper if we read the source file.
2016-03-31 19:24:47 +07:00
61c5717281
Merge pull request #23463 from owncloud/lets-consistently-use-no-referer
...
Consistently use rel=noreferrer
2016-03-23 09:14:54 +07:00
6ad957906e
Consistently use rel=noreferrer
...
When linking to external entities we should consistently use rel=noreferrer
2016-03-20 15:27:20 +07:00
24abe1e1e1
Use raw PATH_INFO
...
PATH_INFO will be empty at this point and thus the logic in base.php did not catch this. Changing this to "getRawPathInfo" will ensure that the path info is properly read.
Fixes https://github.com/owncloud/core/issues/23199
2016-03-17 17:32:38 +07:00
0864851001
Replace unneded OC::needUpgrade with OCP method
2016-03-14 10:10:29 +07:00
51072f742e
Merge pull request #21582 from owncloud/core_composer
...
Composers PSR-4 autoloader in core
2016-03-10 12:06:44 +07:00
f7729cdc40
Add composers default autoloader to core
...
This introduces the defacto standard PSR-4 autoloader from composer into
core. This will allow proper PSR-4 naming of our classes.
Since our original autoloader is still available we can slowly switch
over classes to PSR-4.
2016-03-09 16:53:27 +07:00
12b2192038
Do not set response status in CLI in case of error
2016-03-09 15:40:34 +07:00
adf5d111f6
don't hide server not available exception, fixes #20536
2016-03-03 01:15:41 +07:00
933f60e314
Update author information
...
Probably nice for the people that contributed to 9.0 to see themselves in the AUTHORS file :)
2016-03-01 17:25:15 +07:00
1dbe240b0e
Disable app that bricks the server after enabling
...
If an app is getting enabled in the web UI, an ajax call is now made to
make sure the server still works. If it doesn't, it sends an emergency
app disabling call to disable the breaking app.
2016-02-29 12:07:37 +07:00
0173063923
Pass checked host as "domain" variable to "untrustedDomain" template.
...
Currently the "SERVER_NAME" is passed to the template, which in some cases doesn't match the host returned by "getInsecureServerHost" (or is empty).
2016-02-15 17:02:14 +07:00
b01d50216e
The local address book is replaced now by the system addressbook as part of the dav app
2016-02-02 10:56:33 +07:00
f32827e903
Ignore GD JPEG warnings
...
Fixes https://github.com/owncloud/core/issues/21873
2016-01-27 13:59:15 +07:00
06fe4cabfc
move setup controller to core/controller
2016-01-20 10:23:57 +07:00
682821c71e
Happy new year!
2016-01-12 15:02:18 +07:00
876fb83ddc
getMediumStrengthGenerator is deprecated and does not do anything anymore
2016-01-11 20:06:30 +07:00
1a592e5745
Only '/tests' to be autoloaded when running unit tests
2016-01-10 21:36:14 +07:00
fce8c42240
OC autoloader is not allowed to load 3rdparty
2016-01-10 21:32:52 +07:00
74876fa6e7
Remove code related to session regeneration after some time
...
I do not really consider this necessary or a real security addition. Let's get rid of it thus, cleans up the code and makes the logic easier.
2016-01-10 11:01:30 +07:00
a58ca89e7f
Use ISession::clear
...
The native approach using the PHP calls will not work properly with the cryptowrapper and thus this code is effectively doing nothing at the moment.
2016-01-10 10:39:22 +07:00
0e561afe79
Check if app does exists
2016-01-07 21:29:45 +07:00
fec41e7539
Move regeneration of session ID into session classes
...
There were code paths that nowadays call ISession::login directly thus bypassing the desired regeneration of the session ID. This moves the session regeneration deeper into the session handling and thus ensures that it is always called. Furthermore, I also added the session regeneration to the remember me cookie plus added some test case expectations for this.
2016-01-04 15:09:01 +07:00
6f00729124
Refactor OC_Util::callCheck
2015-12-22 09:32:14 +07:00
ed98cdf532
Use OCP\Util::getVersion instead of the internal private implementation
2015-12-18 15:26:54 +07:00
6fb60815c5
Use SystemConfig internally
2015-12-18 11:53:41 +07:00
0a09004d39
Inject Config into SystemConfig
2015-12-18 11:53:41 +07:00
82bf99c0cf
Get rid of legacy OC_Config
...
We were still using the lecagy class OC_Config all over the place. Which
was a wrapper around the new class OC\Config
2015-12-18 11:53:41 +07:00
7e44ea5da0
Remove deprecated function OC_User::getManager
...
Private deprecated function => removed
Replaced all instances with suggested replacement
2015-12-17 16:18:34 +07:00
1f69dcb593
Use URLGenerator instead of hard-coded WEBROOT
...
Fixes https://github.com/owncloud/core/issues/20922
2015-12-03 14:42:14 +07:00
4d9af08f12
Execute only for web and not for CLI
2015-12-02 11:49:33 +07:00
125b7e7512
Ensure that ownCloud is always accessed with a trailing slash
2015-12-02 11:26:41 +07:00
675417a75c
Untangle the linkToDocs method in OC_Helper
...
* now uses the proper URLGenerator interface
* add comment about DI problems
2015-11-26 13:58:43 +07:00
ba67dd9818
Add warning log entry when user accesses untrusted domain
2015-11-10 12:02:10 +07:00
0bb5eadf89
[autoloader] Make sure to load construct full paths
...
This reduces a lot of the autoloader magic and makes sure that we
generate full paths in the autoloader.
2015-11-06 13:36:19 +07:00
23e22c52b0
Use IRequest's `getScriptName` functionality instead of $_SERVER['SCRIPT_NAME']
2015-10-21 17:33:49 +07:00
5588c5f262
Delete cookie instead of emptying value
...
PHP will handle session cookies with an empty values as an E_WARNING error. ([php/#68063](https://bugs.php.net/bug.php?id=68063 ))
ownCloud sets the cookie to an empty value in case the session expires, it however after this starts a new session. Due to potential race conditions this can in unlikely cases lead to the fact that the session never gets restarted and the user is left with an empty cookie. PHP tries then to use the empty cookie which makes the instance not usable.
To work around any race condition we now tell PHP to explicitly delete the value which can be done by using `null` as value, PHP will then send a cookie with the value "deleted". Also theepiration has been set to -1.
2015-10-19 19:54:12 +07:00
13dd62f7b0
Make sure that remote shares use the correct uid casing
2015-10-06 15:16:19 +07:00
b945d71384
update licence headers via script
2015-10-05 21:15:52 +07:00
fbe43e6a26
cache result of \OCP\Util::needUpgrade()
...
reduce calls of \OCP\Util::needUpgrade()
where \OCP\Util::needUpgrade() is called we can call as well
self::checkUpgrade and use the cached result
In line 877 the call way unnecessary anyway because of the first part of
the if statement
move caching to \OCP\Util::needUpgrade
renaming variable
fixing testNeedUpgradeCore()
cache result of checkUpgrade() in self::$needUpgrade
reduce calls of \OCP\Util::needUpgrade()
where \OCP\Util::needUpgrade() is called we can call as well
self::checkUpgrade and use the cached result
In line 877 the call way unnecessary anyway because of the first part of
the if statement
move caching to \OCP\Util::needUpgrade
renaming variable
fixing testNeedUpgradeCore()
fix typo in variable name
deleting tabs
2015-09-29 15:34:42 +07:00
68bf4440d3
Merge pull request #19293 from owncloud/individual-it-move_initTemplate
...
[jenkins] do not load unnecessary code in case of webdav
2015-09-25 13:49:51 +07:00
e7bc2a10e3
Merge pull request #15098 from owncloud/fix_preview_versions_revert_issue
...
fix issue with version rollback and thumbnails
2015-09-24 21:06:27 +07:00
bf1cb20e90
do not load unnecessary code in case of webdav
...
changing from "protected static" to "protected"
as suggested by @nickvergessen
https://github.com/owncloud/core/pull/19114#discussion_r39719851
moving initTemplate() into template constr.
reduce to move initTemplate only
cleanup spaces
2015-09-23 11:57:10 +07:00
a165710e99
Minor text typos
...
that I noticed while looking at some code.
2015-09-21 23:04:25 +07:00
b3ff773bbf
delete cached preview when rolling back file's version
...
add random number using OC.parseQueryString and _.extend()
version rollback: add missing prefix to OC\Preview::post_delete
add test to assure that the rollback hook is called
2015-09-20 11:22:40 +07:00
decdaf0018
Merge pull request #19024 from owncloud/remove-get_temp_dir
...
Remove get_temp_dir()
2015-09-15 14:18:29 +07:00
f8619870ea
Remove get_temp_dir()
2015-09-15 11:33:25 +07:00
65ebba44ce
Allow /tests folder in autoloader by default
...
Given the fact that "/tests" is not shipped by default and this has broken some applications and frustrated quite some people we should add "/tests" to the default allowed autoloading set.
I do consider the security impact marginally since the /tests folder is not shipped within the release as well as usually has a hard requirement on being called by phpunit.
2015-09-15 11:32:07 +07:00
7562e4959b
Merge pull request #18658 from owncloud/configurable-temp
...
Configurable temporary directory
2015-09-12 22:04:41 +07:00
b3acf09c60
Only add valid root for enabled apps
2015-09-05 00:04:58 +07:00
3bc287ff63
Merge pull request #18794 from individual-it/reuse_systemConfig
...
reuse existing $systemConfig variable
2015-09-04 14:03:56 +07:00
038b09b0b0
Proper details about git submodule update
...
* fixes #18801
2015-09-03 14:55:26 +07:00
cd0a5372ee
reuse existing $systemConfig variable
2015-09-03 12:44:35 +07:00
e9b91b1798
verify the path in the autoloader
2015-09-01 15:03:28 +07:00
acae208f2f
moved code to /lib/private/tempmanager.php
...
fix for unit test
some fixes
2015-08-29 16:59:02 +07:00
e88b380973
Remove DEBUG constant and use config value
...
* introduces config.php option 'debug' that defaults to false
* migrate DEBUG constant to config value
2015-08-24 15:14:05 +07:00
b3495a1dc9
Merge pull request #18482 from owncloud/encrypt-session-data
...
Add a session wrapper to encrypt the data before storing it on disk
2015-08-24 12:10:15 +07:00
40b1054530
Merge pull request #18254 from owncloud/mitigate-breach
...
Add mitigation against BREACH
2015-08-24 09:14:27 +07:00
36eef2ddab
Add a session wrapper to encrypt the data before storing it on disk
2015-08-21 17:59:23 +07:00
06d8edd963
Merge pull request #17434 from owncloud/update-showappnameonappupdate
...
Display app names in update page for app updates
2015-08-20 11:50:01 +07:00
a2674b2b30
Additions to update page
...
Apps to update and to disable will always be shown.
Main title changes only when apps need updated, not core.
Added bullet style.
Exclude incompatible apps from updated apps list.
2015-08-20 11:14:30 +07:00
b919ae96f0
Display app names in update page for app updates
...
Whenever the update page is displayed for apps, show app names instead
of the core update text.
2015-08-19 18:03:35 +07:00
8313a3fcb3
Add mitigation against BREACH
...
While BREACH requires the following three factors to be effectively exploitable we should add another mitigation:
1. Application must support HTTP compression
2. Response most reflect user-controlled input
3. Response should contain sensitive data
Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed.
To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.
2015-08-14 01:31:32 +07:00
ffaf5fed0e
load backbone universally
2015-08-06 12:27:18 +07:00
c3cac887f5
- more injection
...
- less static calls
- use params on sql queries
- handle sql exception on database and user creation gracefully
2015-07-30 00:04:30 +07:00
5265a44260
Remove commented code
2015-07-24 00:47:41 +07:00
582f07950f
Merge pull request #17075 from owncloud/bootstrap-tooltip
...
Replace jQuery tipsy with bootstrap tooltip
2015-07-23 19:25:09 +07:00
2d691c2fb4
Merge pull request #17381 from owncloud/fix_sharing_add_to_group
...
[sharing] fix addToGroup hook
2015-07-21 13:30:41 +07:00
058d910f5e
intproduce pre_addToGroup hook. we need to calculate the possible unique
...
targets before the user was added to the group otherwise we will always detect
a name collision
2015-07-06 17:24:05 +07:00
c8145cdbd6
Javascript mimetype icon resolver
...
This makes it possible to retrieve the icon for mimetypes in javascript.
It makes no additional queries to the server to retrieve the mimetype.
* config/mimetypealiases.json added
* mimetype.js: this is where the logic resides to convert from mimetype
to icon url
* mimetypelist.js: generated file with a list of mimetype mapping (aliases)
and the list of icon files
* ./occ maintenance:mimetypesjs : new command for occ to gernerate
mimetypes.js
* unit tests updated and still work
* javascript tests added
* theming support
* folder of the theme is now present in javascript (OC.theme.folder)
2015-07-06 16:32:10 +07:00
d3ac73c0c9
Remove OC_Log
2015-07-03 18:00:16 +07:00
2fe677d0ed
Catch cache garbage collection exception on postLogin
...
Just log the exception instead of preventing access to OC.
2015-06-30 17:36:55 +07:00
f63915d0c8
update license headers and authors
2015-06-25 14:13:49 +07:00
8621d176db
moved tooltip.js to vendor scripts
2015-06-22 15:38:32 +07:00
f66e9af9a0
replaced tipsy with bootstrap tooltip
2015-06-22 13:32:06 +07:00
97a3d8c313
Fix login handler for file cache - fixes #16795
2015-06-08 14:13:38 +07:00
5e60795962
Bring back OC\Cache\File - fixes #16760
2015-06-05 14:21:17 +07:00
cf2c599218
Merge pull request #16200 from owncloud/kill-globalfilecache
...
Drop file caching
2015-06-02 09:11:33 +07:00
e08423f956
release all locks on shutdown
2015-06-01 13:22:56 +07:00
745c3c64fa
fix preview hooks, enable_previews default is true
2015-05-13 19:59:41 +07:00
e016ed55ff
also free joblist and base from file cache code
2015-05-12 17:44:31 +07:00
0d5c7a11e2
use hooks to update encryption keys instead of the storage wrapper if a file gets renamed/restored, as long as we
...
are in the storage wrapper the file cache isn't up-to-date
2015-05-11 12:06:57 +07:00
3e647afbd4
Do not trigger preview hooks if enable_previews is false
2015-05-06 10:39:48 +07:00
3a3a58f248
Do not trigger preview hooks if enable_previews is false
2015-05-06 10:03:18 +07:00
9530e819eb
Don't display errors and log them
...
Fixes https://github.com/owncloud/core/issues/16014
2015-05-05 12:34:22 +07:00
8a85d8bc17
Try to set required ini values in base.php
...
Fixes https://github.com/owncloud/core/issues/16006
2015-05-03 13:23:29 +07:00
d0ad69aa9c
use the preSetup hook to ensure the encryption wrapper is applied correctly
2015-04-30 13:28:06 +07:00
d9990c2b4e
Delay initialization of the OC\Encryption\Update - introducing 'OC\Encryption\HookManager'
2015-04-17 13:55:31 +07:00
b25c06f576
detect system wide mount points correctly
2015-04-16 14:15:04 +07:00
7b2d53603c
Merge pull request #15489 from owncloud/dont_hide_exceptions_master
...
Dont hide exceptions master
2015-04-10 15:49:45 +07:00
a163243e31
Merge pull request #15510 from owncloud/cron-singleuser
...
block cron when in single user mode
2015-04-10 14:38:50 +07:00
a33edcd2f0
Fix singe user mode on public.php - take two
2015-04-10 11:17:33 +07:00
8964c5068c
do not disclose information, show generic error on login page
...
Conflicts:
core/templates/login.php
lib/base.php
2015-04-10 09:12:37 +07:00
f05e19348d
Fix single user check in case no user is logged in
2015-04-09 23:47:24 +07:00
f099c9883e
Adding check command to validate server environment - fixes #15429
2015-04-08 00:19:23 +07:00
ba9a797eaa
Encryption storage wrapper is enabled by default - necessary to detect encrypted files even if encryption was disabled after files have been encrypted - prevents data corruption
2015-04-07 13:30:31 +07:00
e4895bda01
add helper class accessible for encryption modules to ask for a list of users with access to a file, needed to apply the recovery key to all files
2015-04-07 13:30:29 +07:00
4db75e3407
Setting up the encryption wrapper in a setup hook - temporarily fixes the wrapping order
2015-04-07 13:30:29 +07:00
dbdd754c3f
Further cleanup of files_encryption
2015-04-07 13:30:28 +07:00
937efe856d
fix lib/private/encryption/util.php call
2015-04-07 13:30:28 +07:00
bac9b54bef
Add mount point to disable the encryption wrapper
2015-03-31 16:25:33 +07:00
232518ac54
Merge pull request #15234 from owncloud/encryption2_core
...
core part of encryption 2.0
2015-03-26 21:14:59 +07:00
ff9c85ce60
implement basic encryption functionallity in core to enable multiple encryption modules
2015-03-26 20:56:51 +07:00
3e57e9d3e5
Merge pull request #15232 from owncloud/remove-arg-separator-magic
...
Remove custom `arg_separator.output`
2015-03-26 19:41:22 +07:00
73af302d39
Remove custom `arg_separator.output`
...
This seems unrequired nowadays and like a legacy fragment. It should be safe to remove.
Fixes https://github.com/owncloud/core/issues/14782
2015-03-26 17:07:26 +07:00
b585d87d9d
Update license headers
2015-03-26 11:44:36 +07:00
843fef0490
Handle session initialization errors and display error page - fixes #15053
2015-03-20 12:21:03 +07:00
0bed187613
Stop executing, when 3rdparty is missing or apps directory is invalid
2015-03-18 11:58:18 +07:00
6c1a1234f8
Properly handle available databases at runtime and respect setup checks in command line as well
2015-03-11 09:27:12 +07:00
7181840665
Use occ to install ownCloud in autotest.sh
2015-03-11 09:27:12 +07:00
0e4933e6d2
Refactor \OC\Memcache\Factory
...
Caches divided up into two groups: distributed and local. 'Low latency' is an
alias for local caches, while the standard `create()` call tries to get
distributed caches first, then local caches.
Memcache backend is set in `config.php`, with the keys `memcache.local` and
`memcache.distributed`. If not set, `memcache.distributed` defaults to the value
of `memcache.local`.
2015-03-05 11:36:34 +07:00
bbd5f28415
Let users configure security headers in their Webserver
...
Doing this in the PHP code is not the right approach for multiple reasons:
1. A bug in the PHP code prevents them from being added to the response.
2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud)
3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations.
This pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS.
2015-03-02 19:07:46 +07:00
afb0d742b9
Simplify code
2015-03-01 12:35:41 +07:00
b6d8a48ce1
Add detection for invalid CLI configuration for settings page
...
This change will log all failures that prevent the CLI cronjob from happening to the database and display a warning to administrators when an error happened.
To test:
1. Configure some invalid CLI php.ini settings
2. Enable the CLI cronjob and run php cron.php
3. See the errors printed and also in the admin page
4. Configure the CLI settings correctly
5. Errors should be gone.
Fixes https://github.com/owncloud/core/issues/13994
2015-02-27 20:20:34 +07:00
06aef4e8b1
Revert "Updating license headers"
...
This reverts commit 6a1a4880f0
2015-02-26 11:37:37 +07:00
c1d7b22d08
Always load authentication apps
...
The current code path may trigger situations where the LDAP application is not yet loaded and thus problems with the authentication appeared.
In previous versions of ownCloud the authentication mechanism manually loaded these apps which is why this affects ownCloud 8 and master only for my knowledge. (certainly not 6, maybe 7)
Backport to 8 might be something to consider.
Fixes https://github.com/owncloud/core/issues/14469
2015-02-24 18:00:26 +07:00
0a9b8242ee
properly initialize OC::$WEBROOT and host name
2015-02-23 21:49:35 +07:00
bcd10d3dc5
implement command maintenance:install
2015-02-23 16:47:47 +07:00
6a1a4880f0
Updating license headers
2015-02-23 12:13:59 +07:00
75a7bcb10c
Merge pull request #14199 from owncloud/cast-type-manually
...
Manually type-cast all AJAX files
2015-02-19 17:19:54 +07:00
84cc90a0ee
Merge pull request #14335 from owncloud/enable-strict-mode-per-deafult
...
Fix invalid `ini_set` directives
2015-02-18 10:06:12 +07:00
e4bf3fcb53
Merge pull request #14330 from owncloud/revert-13879-add_debug_log_for_memcache_instantiation
...
Revert "add debug log for memcache instantiation"
2015-02-18 15:45:38 +07:00
593681a4a9
Fix invalid `ini_set` directives
...
Somehow they got messed up. Because PHP does automatic type juggling this has worked before as well however it's not guaranteed that this might work in the future as well.
2015-02-18 15:18:27 +07:00
Roeland Jago Douma
Roeland Jago Douma
Julius Härtl
Joas Schilling
Morris Jobke
blizzz
Lukas Reschke
Robin Appelman
Ko-
Vincent Vanackere
Sebastian Wessalowski
John Molakvoæ (skjnldsv)
Bjoern Schiessle
Jan-Christoph Borchardt
Christoph Wurst
Thomas Müller
Jörn Friedrich Dreyer
Vincent Petry
Juan Pablo Villafáñez
Damjan Georgievski
Roeland Jago Douma
Victor Dubiniuk
Thomas Pulzer
Lukas Reschke
VicDeo
Joachim Sokolowski
Joas Schilling
Christoph Wurst
Christoph Wurst
Thomas Müller
Joas Schilling
Stefan Weil
Bjoern Schiessle
Arthur Schiwon
Joachim Bauch
Individual IT Services
Phil Davis
Georg Ehrke
Robin McCorkell
Frank Karlitschek
Robin Appelman
root
Bernhard Posselt
Hendrik Leppelsack
Hugo Gonzalez Labrador
Jenkins for ownCloud
Robin McCorkell
Clark Tomlinson