Morris Jobke
a5ba1f7803
Remove legacy class OC_Group and OC_User
...
* basically a straight replacement of the wrapped code at the calling code parts
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-03-09 17:35:09 -06:00
Vincent Vanackere
be36513819
Extend Same Site cookie user_saml exemption rule
...
The current check does not trigger if $request->getRequestUri() does not return index.php as a prefix
(on my config this was occuring using nginx to serve Nextcloud)
Signed-off-by: Vincent Vanackere <vincent.vanackere@trustelem.com>
2017-03-07 16:22:57 +01:00
Sebastian Wessalowski
e399097e3a
Remove deprecated OC_User::isLoggedIn
...
Signed-off-by: Sebastian Wessalowski <sebastian@wessalowski.org>
2017-03-02 22:59:39 +01:00
Morris Jobke
9533f4e5ed
Clean up single user mode
...
Single user mode basically disables WebDAV, OCS and cron execution. Since
we heavily rely on WebDAV and OCS also in the web UI it's basically useless.
An admin only sees a broken interface and can't even change any settings nor
sees any files. Also sharing is not possible.
As this is at least the case since Nextcloud 9 and we haven't received any
reports for this it seems that this feature is not used at all so I removed it.
The encryption commands now rely on the well tested maintenance mode.
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-02-22 23:02:31 -06:00
John Molakvoæ (skjnldsv)
2c9d7eeb76
Fix public page css fallback loading
...
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2017-02-01 18:03:51 +01:00
Lukas Reschke
bde1150d04
Merge pull request #3004 from nextcloud/fix-installation-css
...
Fixed installation page
2017-01-22 18:28:33 +01:00
John Molakvoæ (skjnldsv)
e4b3ba6590
Create unified css file and merge all needed data into this file
...
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2017-01-10 17:50:29 +01:00
Morris Jobke
30689f338f
Merge pull request #2914 from nextcloud/logrotate-logfile
...
Get the logfile location while running the logrotate cron job instead…
2017-01-10 14:28:09 +01:00
Morris Jobke
4dd2a1e679
Merge pull request #2943 from nextcloud/kill_old_preview_code
...
Cleanup old preview code
2017-01-10 13:50:14 +01:00
Roeland Jago Douma
b847dfcee9
Merge pull request #2925 from nextcloud/remove-close-wrapper
...
replace close:// streamwrapper with CallBackWrapper
2017-01-10 10:21:10 +01:00
Lukas Reschke
69f3430552
Allow access to CSS resources
...
Fixes https://github.com/nextcloud/server/issues/2984
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-01-09 12:53:58 +01:00
Robin Appelman
54f96e5f58
Get the logfile location while running the logrotate cron job instead of when registering the job
...
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-01-06 16:10:07 +01:00
Robin Appelman
5774d3e82c
replace close:// streamwrapper with CallBackWrapper
...
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-01-06 15:33:32 +01:00
Roeland Jago Douma
73fcb69cad
Merge pull request #2934 from nextcloud/quota-stream-non-global
...
remove the need to register the quota streamwrapper globally
2017-01-06 15:25:20 +01:00
Morris Jobke
5e02c7f7bd
Theme update pages via CSS
...
* SCSS on-the-fly generation isn't allowed during update
* fallback to plain CSS
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-01-06 12:36:16 +01:00
Roeland Jago Douma
e723363053
Remove old preview code
...
* \OC\Preview is no more
* \Test\PreviewTests is no more
* PreviewHooks in base.php are gone
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-01-04 20:14:16 +01:00
Robin Appelman
bca91f2216
remove static:// stream wrapper
...
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-01-04 15:57:02 +01:00
Robin Appelman
968de70bc5
remove the need to register the quota streamwrapper globally
...
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-01-04 15:15:47 +01:00
Robin Appelman
5b09565594
remove no longer used fakedir stream wrapper
...
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-01-03 17:06:03 +01:00
Morris Jobke
47646794b9
Merge pull request #2322 from nextcloud/compat-with-chrome54
...
Remove exception for Chrome on Mobile
2016-11-25 12:00:56 +01:00
Morris Jobke
64fb0fb3dd
Merge pull request #2276 from nextcloud/update-email-address
...
Update email address
2016-11-25 11:40:20 +01:00
Bjoern Schiessle
0de685c562
bring back setEmailAddress for the user management
...
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2016-11-25 10:26:48 +01:00
Bjoern Schiessle
3fc75073b8
update accounts table if email address or display name changes from outside
...
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2016-11-25 10:26:47 +01:00
Lukas Reschke
2144a114b0
Remove exception for Chrome on Mobile
...
This didn't really work anyways and Chrome 54 for Android has been pushed out via Google Play on October 19th. So we should remove this.
This is only in master and doesn't affect any stable branch.
Fixes https://github.com/nextcloud/server/issues/2318
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-11-24 22:26:10 +01:00
Lukas Reschke
a05b8b7953
Harden cookies more appropriate
...
This adds the __Host- prefix to the same-site cookies. This is a small but yet nice security hardening.
See https://googlechrome.github.io/samples/cookie-prefixes/ for the implications.
Fixes https://github.com/nextcloud/server/issues/1412
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-11-23 12:53:44 +01:00
Joas Schilling
6a525fadbb
Show all in one message
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-11-16 12:27:22 +01:00
Jan-Christoph Borchardt
b228ed7bef
add explanatory text of what to do on app version error
...
Signed-off-by: Jan-Christoph Borchardt <hey@jancborchardt.net>
2016-11-16 11:47:39 +01:00
Morris Jobke
e74c527268
Merge pull request #1973 from nextcloud/dont-disable-shipped-apps-but-throw-instead
...
Throw an exception when a shipped app was not replaced before the update
2016-11-02 21:20:23 +01:00
Christoph Wurst
d907666232
bring back remember-me
...
* try to reuse the old session token for remember me login
* decrypt/encrypt token password and set the session id accordingly
* create remember-me cookies only if checkbox is checked and 2fa solved
* adjust db token cleanup to store remembered tokens longer
* adjust unit tests
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2016-11-02 13:39:16 +01:00
Joas Schilling
9b66e8f7d9
Throw an exception when a shipped app was not replaced before the update
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-11-02 10:00:14 +01:00
Thomas Müller
748f18f34e
Remove all unneeded set_include_path()
2016-10-25 18:08:54 +02:00
Morris Jobke
f920153f16
Throw exception because the logger causes session issues anyway that early in the request cycle
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2016-10-24 21:14:44 +02:00
Jörn Friedrich Dreyer
2e0e68b57f
log error when setting timezone to UTC fails ( #26354 )
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-24 21:14:40 +02:00
Vincent Petry
9e9fef46d9
Get rid of very old oc:// stream wrapper ( #26381 )
2016-10-20 20:46:30 +02:00
Lukas Reschke
9a2511fe9b
Don't check for Same-Site cookie on Chrome Android
...
Chrome on Android has a bug that it doesn't sent cookies with the
same-site attribute for the download manager. To work around that
all same-site cookies get deleted and recreated directly. Awesome!
FIXME: Remove once Chrome 54 is deployed to end-users
@see https://github.com/nextcloud/server/pull/1454
2016-09-20 01:20:17 +02:00
Lukas Reschke
6ac890812f
Add exemptions for incompatible UAs
...
Some user agents are notorious and don't really properly follow HTTP
specifications. For those, have an automated opt-out. Since the protection
for remote.php is applied in base.php as starting point we need to opt out
here.
2016-09-08 17:20:46 +02:00
Joas Schilling
7bfc698ae4
Allow to call status.php before the instance is installed
2016-09-06 13:59:45 +02:00
Robin Appelman
acffaa55a1
Short circuit processing of the heartbeat request
2016-08-30 15:44:00 +02:00
Juan Pablo Villafáñez
b50a03141b
Fix redirection taking care of protocol and port
2016-08-29 14:24:23 +02:00
Arthur Schiwon
208e551216
check registered sections and settings after an app got updated to garbage collect orphaned classes
2016-08-16 00:56:17 +02:00
Arthur Schiwon
9edca39b49
attempt to remove section and settings entries when an app got disabled
2016-08-16 00:56:17 +02:00
Morris Jobke
4277051442
Merge pull request #660 from gdamjan/custom-config-dir
...
introduce NEXTCLOUD_CONFIG_DIR env variable (see #300 )
2016-08-09 10:58:23 +02:00
Jan-Christoph Borchardt
835dc59d6a
reduce info on update screens, introduce button to refresh
2016-08-04 12:48:25 +02:00
Damjan Georgievski
982bdb1823
introduce NEXTCLOUD_CONFIG_DIR env variable (see #300 )
...
nextcloud by default uses the `/config/` directory in the source/application tree for its config file(s).
with this commit that directory can be overridden by the `NEXTCLOUD_CONFIG_DIR` environment variable.
in uwsgi, you would use the option `--env "NEXTCLOUD_CONFIG_DIR=/tmp/nx-config/"`
in apache `SetENV …`
and the cli command can be run with: `NEXTCLOUD_CONFIG_DIR=/tmp/nx-config ./occ` (or just use `export` once in the
shell).
NEXTCLOUD_CONFIG_DIR can be supplied with or without the trailing slash (`/`), but in all cases `$configDir` will have
it automatically added if needed.
The other changes are several occurrences of `OC::$SERVERROOT . '/config'` to `OC::$configDir`.
2016-07-29 17:49:14 +02:00
Joas Schilling
0215b004da
Update with robin
2016-07-21 18:13:58 +02:00
Joas Schilling
ba87db3fcc
Fix others
2016-07-21 18:13:57 +02:00
Lukas Reschke
c385423d10
Merge pull request #479 from nextcloud/add-bruteforce-throttler
...
Implement brute force protection
2016-07-21 00:31:02 +02:00
Lukas Reschke
ba4f12baa0
Implement brute force protection
...
Class Throttler implements the bruteforce protection for security actions in
Nextcloud.
It is working by logging invalid login attempts to the database and slowing
down all login attempts from the same subnet. The max delay is 30 seconds and
the starting delay are 200 milliseconds. (after the first failed login)
2016-07-20 22:08:56 +02:00
Lukas Reschke
a299fa38a9
[master] Port Same-Site Cookies to master
...
Fixes https://github.com/nextcloud/server/issues/50
2016-07-20 18:37:57 +02:00
Roeland Douma
13a25535d2
Merge pull request #400 from nextcloud/ocs_appframework
...
OCS routes use AppFramework
2016-07-19 12:21:14 +02:00
Roeland Jago Douma
1caceea6c0
Make the OCS endpoint handle the new OCS AppFramework routes
2016-07-18 11:09:45 +02:00
Joas Schilling
2c988ecbf4
Use the themed Defaults everywhere
2016-07-15 09:17:30 +02:00
Morris Jobke
2791b8f00d
Revert "occ web executor ( #24957 )"
...
This reverts commit 854352d9a0
.
2016-07-07 12:14:45 +02:00
Morris Jobke
e3b509220b
Revert "Bypass upgrade page when occ controller is requested"
...
This reverts commit 89e581acf8
.
2016-07-07 12:14:39 +02:00
Morris Jobke
ba16fd0d33
Merge branch 'master' into sync-master
2016-07-07 11:29:46 +02:00
Victor Dubiniuk
e38bbdc9fe
Bypass upgrade page when occ controller is requested
2016-07-05 09:20:37 +03:00
Thomas Pulzer
90b7f74da7
Changed name of default logfile from owncloud.log to nextcloud.log.
2016-07-04 11:50:32 +02:00
Lukas Reschke
7a9d60d87e
Merge remote-tracking branch 'upstream/master' into master-upstream-sync
2016-06-26 12:55:05 +02:00
VicDeo
854352d9a0
occ web executor ( #24957 )
...
* Initial web executor
* Fix PHPDoc
Fix broken integration test
OccControllerTests do not require database access - moch them all!
Kill unused sprintf
2016-06-22 13:12:36 +02:00
Joachim Sokolowski
fa19e4c2eb
some text-changes to nextcloud
2016-06-22 08:41:10 +02:00
Arthur Schiwon
39aeebfac5
Print error message again, when 3rdparty submodule is not initialized
...
- old code used Response which attempted to use OC::$server which is not
and cannot be intialised at this part of the code.
2016-06-08 10:34:32 +02:00
Lukas Reschke
aba539703c
Update license headers
2016-05-26 19:57:24 +02:00
Joas Schilling
6222d42462
Fix class name in hook registration
2016-05-24 10:42:11 +02:00
Roeland Jago Douma
c9ad60defc
Only allow loading of legacy (lib/private/legacy) by default
2016-05-20 16:35:07 +02:00
Roeland Jago Douma
d666725fa7
Move \OCP to PSR-4
2016-05-19 09:43:33 +02:00
Vincent Petry
379be91618
Merge pull request #24597 from owncloud/run-upgrade-in-incognito-mode
...
run upgrades in incognito mode
2016-05-17 16:14:11 +02:00
Roeland Douma
5c9103287f
Group fixup ( #24621 )
...
* Move used OC_Group_xx to \OC\Group
* Add (deprecated) legacy wrapper in legacy, OC_Group_xx
* Replace deprecated use of OC_Group_xx with \OC\Group\xx
2016-05-17 16:06:44 +02:00
Christoph Wurst
8b6bb0a426
Log user out correctly if max session lifetime is reached ( #24552 )
2016-05-12 12:09:13 +02:00
Christoph Wurst
3a1882b143
run upgrades in incognito mode
2016-05-12 11:56:58 +02:00
Christoph Wurst
168ccf90a6
try apache auth too
2016-05-11 13:36:46 +02:00
Christoph Wurst
d8cde414bd
token based auth
...
* Add InvalidTokenException
* add DefaultTokenMapper and use it to check if a auth token exists
* create new token for the browser session if none exists
hash stored token; save user agent
* encrypt login password when creating the token
2016-05-11 13:36:46 +02:00
Roeland Jago Douma
9e1d9871a8
Move OC_User_Database to \OC\User\Database
2016-05-10 19:53:36 +02:00
Joas Schilling
8668560352
Keep the composer instance so we can add psr4 paths later
2016-05-02 14:10:53 +02:00
Thomas Müller
e37b95ae53
Merge pull request #24200 from owncloud/appframework_psr4
...
Move \OC\AppFramework to PSR-4
2016-04-22 17:22:02 +02:00
Thomas Müller
f56be022a3
Disable web updater if ldap or shibboleth are installed - refs https://github.com/owncloud/core/issues/23913#issuecomment-213432232
2016-04-22 15:53:27 +02:00
Roeland Jago Douma
1d33a5ef13
Move \OC\AppFramework to PSR-4
...
* Also moved the autoloader setup a bit up since we need it in initpaths
2016-04-22 15:28:09 +02:00
Lukas Reschke
afad27fafd
Merge pull request #24075 from owncloud/no-html-on-cli
...
In case of fatal php errors and other unhandled exceptions no html er…
2016-04-20 13:50:43 +02:00
Thomas Müller
1773dcbef2
Merge pull request #23973 from owncloud/share_move_post_delete_from_group_hook
...
Move post_removeFromGroup to shareManager
2016-04-19 06:59:58 +02:00
Thomas Müller
c609abf075
In case of fatal php errors and other unhandled exceptions no html error page is expected to be displayed in the console
2016-04-18 22:30:01 +02:00
Lukas Reschke
8222ad5157
Move logout to controller
...
Testable code. Yay.
2016-04-18 21:21:52 +02:00
Thomas Müller
739dfb5c66
Suggest cli based updater in case the instance is bigger - #23913
2016-04-18 17:09:21 +02:00
Lukas Reschke
17dfffefb3
Keep used username in URL
...
This is required until the new controller can also handle POST requests
2016-04-15 19:33:25 +02:00
Lukas Reschke
331e4efacb
Move login form into controller
...
First step on getting the authorisation stuff cleaned up. This is only for the login form, all other stuff is still where it is.
2016-04-15 17:36:23 +02:00
Thomas Müller
dc061bae42
Kill movable 3rdparty
2016-04-14 17:59:49 +02:00
Roeland Jago Douma
6144ced7a0
Move post_removeFromGroup to shareManager
...
The last sharing hook to be moved over.
* Added unit tests
* Removed old tests that relied on old behaviour
* Removed old hooks.php
2016-04-13 15:00:12 +02:00
Roeland Douma
495a964ca2
Migrate post_groupDelete hook to share manager ( #23841 )
...
The hook now calls the share manager that will call the responsible
shareProvider to do the proper cleanup.
* Unit tests added
Again nothing should change it is just to cleanup old code
2016-04-12 09:46:25 +02:00
Joas Schilling
8e16e7bf34
Merge pull request #23856 from owncloud/share_remove_addtogroup_hooks
...
Remove pre/post_addToGroup hooks for shares
2016-04-11 15:05:20 +02:00
Roeland Jago Douma
3fae4c82d2
Remove pre/post_addToGroup hooks for shares
...
There is no need to perform the checks for unique targets on add to
group as we have to do this all when mounting the shares anyway.
2016-04-08 11:56:38 +02:00
Stefan Weil
b1a856d7b7
lib: Fix typos (found by codespell)
...
Signed-off-by: Stefan Weil <sw@weilnetz.de>
2016-04-07 19:51:27 +02:00
Joas Schilling
0de15a86f0
Merge pull request #23773 from owncloud/share_move_delete_user_hook
...
Migrate post_userDelete hook to share manager
2016-04-07 13:01:10 +02:00
Roeland Jago Douma
e0cee43cf0
Migrate post_userDelete hook to share manager
...
This makes the post_userDelete hook call the sharemanager. This will
cleanup to and from this user.
* All shares owned by this user
* All shares with this user (user)
* All custom group shares
* All link share initiated by this user (to avoid invisible link shares)
Unit tests are added for the defaultshare provider as well as the
federated share provider
2016-04-04 14:15:38 +02:00
Thomas Müller
1bf4c75e8b
Show individual sql schema migration steps during upgrade - on web as well as on the command line
2016-04-04 12:34:18 +02:00
Bjoern Schiessle
93ed965cbb
fix creation of versions of encrypted files on external storages
...
in order to create a 1:1 copy of a file if a version gets created
we need to store this information on copyBetweenStorage(). This
allows us to by-pass the encryption wrapper if we read the source file.
2016-03-31 19:24:47 +02:00
Thomas Müller
61c5717281
Merge pull request #23463 from owncloud/lets-consistently-use-no-referer
...
Consistently use rel=noreferrer
2016-03-23 09:14:54 +01:00
Lukas Reschke
6ad957906e
Consistently use rel=noreferrer
...
When linking to external entities we should consistently use rel=noreferrer
2016-03-20 15:27:20 +01:00
Lukas Reschke
24abe1e1e1
Use raw PATH_INFO
...
PATH_INFO will be empty at this point and thus the logic in base.php did not catch this. Changing this to "getRawPathInfo" will ensure that the path info is properly read.
Fixes https://github.com/owncloud/core/issues/23199
2016-03-17 17:32:38 +01:00
Morris Jobke
0864851001
Replace unneded OC::needUpgrade with OCP method
2016-03-14 10:10:29 +01:00
Thomas Müller
51072f742e
Merge pull request #21582 from owncloud/core_composer
...
Composers PSR-4 autoloader in core
2016-03-10 12:06:44 +01:00
Roeland Jago Douma
f7729cdc40
Add composers default autoloader to core
...
This introduces the defacto standard PSR-4 autoloader from composer into
core. This will allow proper PSR-4 naming of our classes.
Since our original autoloader is still available we can slowly switch
over classes to PSR-4.
2016-03-09 16:53:27 +01:00
Vincent Petry
12b2192038
Do not set response status in CLI in case of error
2016-03-09 15:40:34 +01:00