3d2600b039
Add Phan plugin to check for SQL injections
...
This adds a phan plugin which checks for SQL injections on code using our QueryBuilder, while it isn't perfect it should already catch most potential issues.
As always, static analysis will sometimes have false positives and this is also here the case. So in some cases the analyzer just doesn't know if something is potential user input or not, thus I had to add some `@suppress SqlInjectionChecker` in front of those potential injections.
The Phan plugin hasn't the most awesome code but it works and I also added a file with test cases.
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-07-20 22:48:13 +02:00
984933e586
Only use readable chars in Share Tokens
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-07-18 15:44:34 +02:00
b4deba2078
Merge pull request #5483 from nextcloud/issue-5075-png-files-for-activity-emails
...
Use PNGs for icons in activity emails
2017-07-07 11:05:00 +02:00
b27819785e
Don't log passwords on dav exceptions
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-06-29 17:20:10 +02:00
eb9aedf44b
Enhance the logging if the part file can not be renamed
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-06-22 17:50:14 -05:00
90fa27694a
Use PNG version of the icons for shipped activities
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-06-20 13:48:51 +02:00
698a7cb7f0
Merge pull request #5124 from nextcloud/allow-dirlisting-with-unreadable-items
...
Allow dir-listing also when one child is blocked by access control
2017-06-16 10:47:08 +02:00
ca3c69c8ae
Merge pull request #5298 from nextcloud/bugfix/4885/calendar_shares_url_special_char_issue
...
urldecode group principals in Cal- and CardDAV backend
2017-06-14 23:10:40 -05:00
ac565cecad
Merge pull request #5300 from nextcloud/bugfix/noid/fix_proppatch_requests_to_groupshares
...
allow users to send PropPatch request when calendar is group-shared with them
2017-06-14 23:00:39 -05:00
f38f2baa5a
Merge pull request #5295 from nextcloud/bugfix/5077/allow_proppatches_to_birthday_calendar
...
allow PropPatch requests to contact_birthdays
2017-06-13 18:11:13 -05:00
633396001f
Prevent sending second WWW-Authenticate header
...
Overrides \Sabre\DAV\Auth\Backend\AbstractBearer::challenge to prevent sending a second WWW-Authenticate header which is standard-compliant but most DAV clients simply fail hard.
Fixes https://github.com/nextcloud/server/issues/5088
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-06-13 13:54:52 +02:00
35781ae45c
urldecode group principals in Cal- and CardDAV backend
...
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
2017-06-12 21:01:30 +02:00
0f1d47cdf3
allow users to send PropPatch request when calendar is group-shared with them
...
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
2017-06-08 09:21:56 +02:00
9563c25c69
allow PropPatch requests to contact_birthdays
...
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
2017-06-08 08:00:52 +02:00
d0c614a322
Allow dir-listing also when one child is blocked by access control
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-05-26 15:54:39 +02:00
4b5379309e
fix replacing of 4MB Unicode Chars in cal props table
...
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
2017-05-21 13:26:46 +02:00
639ba526d0
Adjust realm from SabreDAV to Nextcloud
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-05-18 21:38:55 +02:00
f93db724d7
Make legacy DAV backend use the BearerAuth backend as well
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-05-18 21:19:39 +02:00
df3909a7c3
Use Bearer backend for SabreDAV
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-05-18 20:49:10 +02:00
5f71805c35
Add basic implementation for OAuth 2.0 Authorization Code Flow
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-05-18 20:49:03 +02:00
cef2110263
Revert "fix objectstore rename"
...
This reverts commit 5334a3dc33
2017-05-15 13:59:18 +02:00
b2c96d0c23
Stop if user folder is not available
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-05-09 11:26:08 -05:00
2d707fdfb5
Merge pull request #4621 from nextcloud/fix_readonly_shared_calendar_proppatch
...
fix PROPPATCH requests to read-only shared calendars
2017-05-08 12:42:30 -05:00
df6ce6b385
Merge pull request #4675 from nextcloud/fix_4651
...
Create a photo cache to speedup the contactsmenu
2017-05-08 12:20:27 -05:00
9d8936c5bf
fix error when browsing the dav root
...
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-05-08 14:34:36 +02:00
dea6edb066
Fix init
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-05-08 12:40:00 +02:00
255442f281
fix PROPPATCH requests to read-only shared calendars
...
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
2017-05-08 12:09:15 +02:00
92408390b0
Fix ImageExportPluginTest
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-05-08 11:20:49 +02:00
747990b03a
No more XSS
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-05-08 11:20:49 +02:00
3ab53d000f
Clear cache on vcard change/delete
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-05-08 11:20:49 +02:00
34d97aa51c
Request proper size for contacts menu
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-05-08 11:20:49 +02:00
dd430c2fd7
Cache the carddav photo endpoint
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-05-08 11:20:49 +02:00
303c0dd6a8
Always dispatch Carddav events
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-05-08 11:20:47 +02:00
49e958fa12
Enforce type hints in dav app
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-05-04 19:32:22 -03:00
c053a275d7
check password for mail shares as well
...
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2017-05-04 11:20:20 +02:00
59e27f03b6
Add caching to the imageexport plugin
...
Since we now heavily use this endpoint for the contacts menu we better
set proper caching on the images. Else this gets reload over and over
again leading to slow loading menu and unneded bytes transfered.
* cache for 1 hour by default
* added ETag for validation
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-05-02 12:30:34 +02:00
2a773310dc
Merge pull request #4098 from nextcloud/feature/caldav_search
...
add Nextcloud Search extension to CalDAV
2017-04-28 23:38:04 -03:00
0f8a9514de
rename calendarobjects_properties -> calendarobjects_props
...
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
2017-04-28 20:21:46 +02:00
8d00458b56
unit test custom calendar search
...
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
2017-04-28 20:21:36 +02:00
ab9a36e872
allow apps to set custom mount types
...
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-04-28 09:38:21 +02:00
9da697b11a
Merge pull request #4524 from nextcloud/downstream-27508
...
Keep file id on move
2017-04-28 09:37:40 +02:00
211a76eff3
Add comment
2017-04-27 09:29:20 +02:00
614bd5c294
Properly handle missing READ permission
2017-04-27 09:29:02 +02:00
3e37a5f1c7
Merge pull request #3770 from nextcloud/faster-search-in-contacts
...
Factorize query for searching contacts
2017-04-27 00:25:30 -03:00
edd9444209
Merge pull request #4503 from nextcloud/downstream-27281
...
fix objectstore rename
2017-04-26 17:17:24 +02:00
7b6e4d0dd2
Fix FutureFile MOVE to keep destination node
...
Sabre usually deletes the target node on MOVE before proceeding with the
actual move operation. This fix prevents this to happen in case the
source node is a FutureFile.
2017-04-26 15:46:38 +02:00
ec8d7010e5
Accept moving FutureFile into a Directory
2017-04-26 15:43:01 +02:00
82b967d3f9
Remove ObjectTree::move and let is use the IMoveTarget approach instead
...
This removes the duplicated code
2017-04-26 15:35:08 +02:00
0a9f7730d0
Ported ObjectTree::move to IMoveTarget in new DAV endpoint
2017-04-26 15:33:20 +02:00
c76633bb8a
require at least one param or prop filter element
...
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
2017-04-25 18:20:32 +02:00
Lukas Reschke
Joas Schilling
Morris Jobke
Georg Ehrke
Roeland Jago Douma
Robin Appelman
Bjoern Schiessle
Roeland Jago Douma
Vincent Petry