Commit Graph

27 Commits

Author SHA1 Message Date
Lukas Reschke 3d2600b039
Add Phan plugin to check for SQL injections
This adds a phan plugin which checks for SQL injections on code using our QueryBuilder, while it isn't perfect it should already catch most potential issues.

As always, static analysis will sometimes have false positives and this is also here the case. So in some cases the analyzer just doesn't know if something is potential user input or not, thus I had to add some `@suppress SqlInjectionChecker` in front of those potential injections.

The Phan plugin hasn't the most awesome code but it works and I also added a file with test cases.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-07-20 22:48:13 +02:00
Georg Ehrke 35781ae45c
urldecode group principals in Cal- and CardDAV backend
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
2017-06-12 21:01:30 +02:00
Roeland Jago Douma 303c0dd6a8
Always dispatch Carddav events
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-05-08 11:20:47 +02:00
Morris Jobke 3e37a5f1c7 Merge pull request #3770 from nextcloud/faster-search-in-contacts
Factorize query for searching contacts
2017-04-27 00:25:30 -03:00
Roeland Jago Douma d842b29c5b Merge pull request #4401 from nextcloud/caldav-carddav-nc-owner-displayname
add owner-displayname property to calendars and addressbooks
2017-04-24 09:17:55 +02:00
Georg Ehrke c89e057d27
add owner-displayname property to calendars and addressbooks
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
2017-04-23 11:26:49 +02:00
Morris Jobke 2b6f6dac00
Remove unused variables
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-04-22 18:20:51 -05:00
Roeland Jago Douma 6d1651452f
Add back the name query part
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-04-21 20:43:40 +02:00
Thomas Citharel ecba3722da
Factorize query for searching contacts 2017-04-21 20:43:36 +02:00
Georg Ehrke 896dd76ab5
fix bug with shared_by for own calendars if shared
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
2017-03-25 23:07:09 +01:00
Joas Schilling 2eb27c636d
Make sure shares use read-write when available
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-03-02 12:28:57 +01:00
Joas Schilling 6dbdca0721
Don't waste energy unless necessary
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-03-02 12:28:56 +01:00
Joas Schilling 6bd4e1f65b
Use the correct principal for shared addressbooks
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-02-23 14:16:00 +01:00
John Molakvoæ (skjnldsv) 7e9411b929
this is public
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2017-02-14 16:56:56 +01:00
John Molakvoæ (skjnldsv) b8fcd3ce27
getUsersOwnAddressBooks
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2017-02-14 09:21:33 +01:00
Thomas Müller c778b1bade
Update sabre dav to 3.2 (#26115)
* Update sabre/dav to 3.2.0

* Adjust code to work with sabre/dav 3.2.0 and it's dependencies

* Adding own CalDAV plugin to fix calendar home property

* Test if there is a user logged in when listing files home

* Update sabre version used by integration tests

* Disable unauthenticated DAV access

This is needed to make Sabre 3.2 behave like we did before.
Eventually we should integrate better with the ACL plugin which itself
should implement an auth failure when appropriate.

=====

* Fixed so cherry-pick was succesfull

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-04 13:35:10 +01:00
Joas Schilling ce964f0a10
Translate the Contacts addressbook when it's default
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-10-06 14:20:01 +02:00
Joas Schilling 44fbf6f734
Close cursors 2016-09-15 09:47:39 +02:00
Joas Schilling 08c6ca5a1a
Chunk if you have too many contacts 2016-09-14 16:29:58 +02:00
Roeland Jago Douma 94fb5bcbae
Cast query result to int
Else we never create the default address book
2016-09-09 19:15:27 +02:00
Robin Appelman 344945bfe9 more efficient check if addressbook and calendar exists for user 2016-08-31 15:08:29 +02:00
Joas Schilling 3fbb5de74f
Better displaynames for shared address books 2016-08-24 08:50:25 +02:00
Joas Schilling 813f0a0f40
Fix apps/ 2016-07-21 18:13:57 +02:00
Bjoern Schiessle 5f6944954b get only vcard which match both the address book id and the vcard uri 2016-06-28 16:11:06 +02:00
Georg Ehrke 1452b74de7 Contacts API: replace raw image data with url (#25081)
* add uri to AddressBookImpl array

* Introduce ImageExportPlugin for CardDav

* add plugin to v1 routes

* replace binary contact photo with link

* update tests

* Adding unit tests
2016-06-21 15:25:44 +02:00
Lukas Reschke aba539703c
Update license headers 2016-05-26 19:57:24 +02:00
Joas Schilling dd9ee10bc0 Move dav app to PSR-4 (#24527)
* Move Application to correct namespace and PSR-4 it

* Move dav app to PSR-4
2016-05-12 09:42:40 +02:00