Commit Graph

2322 Commits

Author SHA1 Message Date
Lukas Reschke f9e90e92d4 Encode HTML tags in JSON
While not encoding the HTML tags in the JSON response is perfectly fine since we set the proper mimetype as well as disable content sniffing a lot of automated code scanner do report this as security bug. Encoding them leads to less discussions and a lot of saved time.
2015-09-03 00:44:46 +02:00
Morris Jobke c86cac6a2b use config.php value instead of version string 2015-09-02 08:16:27 +02:00
Vincent Petry 87b3e28f06 Merge pull request #18730 from owncloud/appframework_proper_304
Properly return 304 in AppFramework
2015-09-01 15:39:59 +02:00
Robin Appelman e9b91b1798 verify the path in the autoloader 2015-09-01 15:03:28 +02:00
Roeland Jago Douma f12caf930e Properly return 304
The ETag set in the IF_NONE_MODIFIED header is wraped in quotes (").
However the ETag that is set in response is not (yet). Also we need to
cast the ETag to a string.

* Added unit test
2015-09-01 11:04:41 +02:00
Bjoern Schiessle 37513f9411 don't read certificates if ownCloud is not installed 2015-08-30 19:00:03 +02:00
Bjoern Schiessle 289e9130f3 make system root of key storage configurable 2015-08-30 19:00:03 +02:00
Morris Jobke 90dfa981c5 Merge pull request #14856 from rullzer/remote_avatars
Allow Remote avatars
2015-08-29 18:05:32 +02:00
Vincent Petry 723f8c8f1b Merge pull request #18620 from owncloud/add-public-interface-for-factory
Add a public interface for the language factory so apps can use it
2015-08-29 16:44:08 +02:00
Roeland Jago Douma ae62537adf Allow remote avatars 2015-08-29 15:22:13 +02:00
Björn Schießle 6e210d960c Merge pull request #18423 from owncloud/occ_encrypt_all
occ command line tool to encrypt all files
2015-08-28 20:44:55 +02:00
Joas Schilling bd1215c1dd Add a test for the interface 2015-08-28 12:08:54 +02:00
Lukas Reschke ab87274930 Use certificates that expire in 10 years
🙊 🙊 🙊
2015-08-27 22:23:08 +02:00
Bjoern Schiessle e51fe617d8 copy always file by file to encrypt/decrypt it if needed 2015-08-26 14:58:22 +02:00
Bjoern Schiessle 8c08dd0ac2 occ tool to encrypt all files 2015-08-26 14:58:22 +02:00
Thomas Müller 534b2e407a Merge pull request #17662 from owncloud/locking-db
Database backend for locking
2015-08-26 03:56:37 +02:00
Lukas Reschke f3561e2349 Explicitly specify status code 200 as response code
Potentially fixes https://github.com/owncloud/core/issues/17586
2015-08-25 18:07:40 +02:00
Lukas Reschke a67a2272e7 Merge pull request #18491 from owncloud/expire-token-after-12h-or-login
Expire token after 12h and if user logged-in again
2015-08-24 14:08:46 +02:00
Morris Jobke b3495a1dc9 Merge pull request #18482 from owncloud/encrypt-session-data
Add a session wrapper to encrypt the data before storing it on disk
2015-08-24 12:10:15 +02:00
Morris Jobke 40b1054530 Merge pull request #18254 from owncloud/mitigate-breach
Add mitigation against BREACH
2015-08-24 09:14:27 +02:00
Lukas Reschke db4cb1dd4d Expire token after 12h and if user logged-in again
As an hardening measure we should expire password reset tokens after 12h and if the user has logged-in again successfully after the token was requested.
2015-08-22 20:42:45 +02:00
Lukas Reschke 6a3fb0d3b3 Handle failures gracefully, remove switch 2015-08-21 19:16:28 +02:00
Joas Schilling 36eef2ddab Add a session wrapper to encrypt the data before storing it on disk 2015-08-21 17:59:23 +02:00
Morris Jobke ac086a11c1 Merge pull request #18426 from owncloud/joblist-next-non-existing
handle non existing job classes in $jobList->getNext
2015-08-21 10:34:33 +02:00
Robin McCorkell 5f5c3520c9 Merge pull request #18457 from owncloud/test-traits
Move common test logic to re-usable traits
2015-08-20 22:28:54 +01:00
Robin Appelman 24a2fff946 add test mountprovider logic to a trait 2015-08-20 16:39:32 +02:00
Joas Schilling 9573d7d60d Merge pull request #18372 from owncloud/issue-18358-object-type-and-id-for-activities
Issue 18358 object type and id for activities
2015-08-20 15:53:36 +02:00
Robin Appelman 3dbfbdaf54 allow moving common test logic into traits 2015-08-20 15:17:14 +02:00
Morris Jobke c7b0d50cb2 Merge pull request #18369 from owncloud/occ-log
occ commands to manage logging
2015-08-20 12:57:05 +02:00
Morris Jobke 06d8edd963 Merge pull request #17434 from owncloud/update-showappnameonappupdate
Display app names in update page for app updates
2015-08-20 11:50:01 +02:00
Vincent Petry a2674b2b30 Additions to update page
Apps to update and to disable will always be shown.
Main title changes only when apps need updated, not core.
Added bullet style.
Exclude incompatible apps from updated apps list.
2015-08-20 11:14:30 +02:00
Joas Schilling 389a32e92a Add test coverage for Activity Event and Manager 2015-08-20 10:25:49 +02:00
Morris Jobke b3356b1288 Merge pull request #18432 from owncloud/ext-backends.simple
Migrate simple external storage backends to new registration API [part 1]
2015-08-19 20:04:20 +02:00
Vincent Petry b919ae96f0 Display app names in update page for app updates
Whenever the update page is displayed for apps, show app names instead
of the core update text.
2015-08-19 18:03:35 +02:00
Robin McCorkell 3b27603762 Revert "Fix mounting wrapped storages resulting in many-layered wrapping"
This reverts commit 75a5e6e12b.
2015-08-19 14:41:43 +01:00
Robin McCorkell c693e5d5d1 Unit tests for occ log:* commands 2015-08-19 13:49:41 +01:00
Robin Appelman beaef820cf handle non existing job classes in $jobList->getNext 2015-08-19 14:16:05 +02:00
Joas Schilling 6231bbdde3 Filter the objectstore password from the config list as well 2015-08-19 14:06:05 +02:00
Roeland Jago Douma 65cf4028cc Move avatarcontroller towards Node Api 2015-08-18 14:48:19 +02:00
Robin McCorkell 675d852c7d Merge pull request #17182 from owncloud/user_ini_upload_size
Update .user.ini when setting upload size limit
2015-08-17 13:27:47 +01:00
Morris Jobke 15da671349 [test] more tests for UserController::setMailAddress
* fixes #12885
2015-08-17 11:53:03 +02:00
Lukas Reschke 8313a3fcb3 Add mitigation against BREACH
While BREACH requires the following three factors to be effectively exploitable we should add another mitigation:

1. Application must support HTTP compression
2. Response most reflect user-controlled input
3. Response should contain sensitive data

Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed.

To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.
2015-08-14 01:31:32 +02:00
Thomas Müller abd3d5c6a5 Merge pull request #17982 from owncloud/appframework-sanitize-name
Sanitize class names before registerService/query
2015-08-12 12:19:24 +02:00
Thomas Müller eb13cb8d75 Merge pull request #18127 from owncloud/dav-request-tests
add test framework for doing full request webdav tests
2015-08-12 10:07:20 +02:00
Robin Appelman d15870b998 fix setup/teardown 2015-08-11 14:43:46 +02:00
Robin Appelman b0c8654f9e split out creating the sabre dav server to it's own factory 2015-08-11 14:43:46 +02:00
Robin Appelman 8c5302847b add test framework for doing full request webdav tests 2015-08-11 14:43:46 +02:00
Robin McCorkell cd0a2874de Merge pull request #17852 from owncloud/register-alias-factory
Add test for factories
2015-08-11 13:30:56 +01:00
Thomas Müller aed068b237 Merge pull request #17868 from owncloud/x-forwarded-for
Set default 'forwarded for' headers for reverse proxy
2015-08-11 14:02:46 +02:00
Thomas Müller d5bba42030 Merge pull request #17932 from owncloud/fix_move_files
make sure that hooks are emitted properly on file move operation
2015-08-11 13:54:09 +02:00