Commit Graph

1033 Commits

Author SHA1 Message Date
Morris Jobke 8c5062794f Merge pull request #4873 from nextcloud/check-whether-REQUEST-exists
Check whether the $_SERVER['REQUEST_*'] vars exist before using them
2017-05-15 09:49:11 -05:00
Joas Schilling 72c1b24844
Check whether the $_SERVER['REQUEST_*'] vars exist before using them
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-05-15 14:33:27 +02:00
Morris Jobke 3fa604cc5e Allow to enforce update via web UI
* adds a disclaimer that an update via web UI is on own risk
* allows to skip the warning
* fixes #4353

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-05-11 10:22:44 -05:00
Morris Jobke abe4a19cbc Properly decide on actual users if instance is too big
* state the reason why NC thinks it is a big instance

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-05-10 22:32:42 -05:00
Morris Jobke 9309217ecb Fix escaped HTML on error pages
* fixes #4655

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-05-08 21:16:08 -05:00
Robin Appelman d925856787
dont spam log when request can't access filesystem
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-04-28 17:01:31 -03:00
Lukas Reschke d4ba8198fe
Make the emergency disable also accept arrays
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-04-26 20:07:51 +02:00
Joas Schilling f23a36b0a6
Add activities when email or password is changed
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-04-13 11:13:19 +02:00
Morris Jobke 5b4adf66e5
Move OC_Defaults to OCP\Defaults
* currently there are two ways to access default values:
  OCP\Defaults or OC_Defaults (which is extended by
  OCA\Theming\ThemingDefaults)
* our code used a mixture of both of them, which made
  it hard to work on theme values
* this extended the public interface with the missing
  methods and uses them everywhere to only rely on the
  public interface

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-04-09 21:43:01 -05:00
Morris Jobke edd55b0ea9
Use SystemConfig instead of AllConfig for DB stuff
* preparation for followup PRs to clean up the DB bootstrapping

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-03-19 15:53:49 -06:00
Ko- 0024b67aaf Check that set_time_limit is not disabled before calling it
Signed-off-by: Ko- <k.stoffelen@cs.ru.nl>
2017-03-11 17:04:21 +01:00
Morris Jobke a5ba1f7803
Remove legacy class OC_Group and OC_User
* basically a straight replacement of the wrapped code at the calling code parts

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-03-09 17:35:09 -06:00
Vincent Vanackere be36513819 Extend Same Site cookie user_saml exemption rule
The current check does not trigger if $request->getRequestUri() does not return index.php as a prefix
(on my config this was occuring using nginx to serve Nextcloud)

Signed-off-by: Vincent Vanackere <vincent.vanackere@trustelem.com>
2017-03-07 16:22:57 +01:00
Sebastian Wessalowski e399097e3a Remove deprecated OC_User::isLoggedIn
Signed-off-by: Sebastian Wessalowski <sebastian@wessalowski.org>
2017-03-02 22:59:39 +01:00
Morris Jobke 9533f4e5ed
Clean up single user mode
Single user mode basically disables WebDAV, OCS and cron execution. Since
we heavily rely on WebDAV and OCS also in the web UI it's basically useless.
An admin only sees a broken interface and can't even change any settings nor
sees any files. Also sharing is not possible.

As this is at least the case since Nextcloud 9 and we haven't received any
reports for this it seems that this feature is not used at all so I removed it.

The encryption commands now rely on the well tested maintenance mode.

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-02-22 23:02:31 -06:00
John Molakvoæ (skjnldsv) 2c9d7eeb76
Fix public page css fallback loading
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2017-02-01 18:03:51 +01:00
Lukas Reschke bde1150d04 Merge pull request #3004 from nextcloud/fix-installation-css
Fixed installation page
2017-01-22 18:28:33 +01:00
John Molakvoæ (skjnldsv) e4b3ba6590
Create unified css file and merge all needed data into this file
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2017-01-10 17:50:29 +01:00
Morris Jobke 30689f338f Merge pull request #2914 from nextcloud/logrotate-logfile
Get the logfile location while running the logrotate cron job instead…
2017-01-10 14:28:09 +01:00
Morris Jobke 4dd2a1e679 Merge pull request #2943 from nextcloud/kill_old_preview_code
Cleanup old preview code
2017-01-10 13:50:14 +01:00
Roeland Jago Douma b847dfcee9 Merge pull request #2925 from nextcloud/remove-close-wrapper
replace close:// streamwrapper with CallBackWrapper
2017-01-10 10:21:10 +01:00
Lukas Reschke 69f3430552
Allow access to CSS resources
Fixes https://github.com/nextcloud/server/issues/2984

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-01-09 12:53:58 +01:00
Robin Appelman 54f96e5f58
Get the logfile location while running the logrotate cron job instead of when registering the job
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-01-06 16:10:07 +01:00
Robin Appelman 5774d3e82c
replace close:// streamwrapper with CallBackWrapper
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-01-06 15:33:32 +01:00
Roeland Jago Douma 73fcb69cad Merge pull request #2934 from nextcloud/quota-stream-non-global
remove the need to register the quota streamwrapper globally
2017-01-06 15:25:20 +01:00
Morris Jobke 5e02c7f7bd
Theme update pages via CSS
* SCSS on-the-fly generation isn't allowed during update
* fallback to plain CSS

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-01-06 12:36:16 +01:00
Roeland Jago Douma e723363053
Remove old preview code
* \OC\Preview is no more
* \Test\PreviewTests is no more
* PreviewHooks in base.php are gone

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-01-04 20:14:16 +01:00
Robin Appelman bca91f2216
remove static:// stream wrapper
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-01-04 15:57:02 +01:00
Robin Appelman 968de70bc5
remove the need to register the quota streamwrapper globally
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-01-04 15:15:47 +01:00
Robin Appelman 5b09565594
remove no longer used fakedir stream wrapper
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-01-03 17:06:03 +01:00
Morris Jobke 47646794b9 Merge pull request #2322 from nextcloud/compat-with-chrome54
Remove exception for Chrome on Mobile
2016-11-25 12:00:56 +01:00
Morris Jobke 64fb0fb3dd Merge pull request #2276 from nextcloud/update-email-address
Update email address
2016-11-25 11:40:20 +01:00
Bjoern Schiessle 0de685c562
bring back setEmailAddress for the user management
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2016-11-25 10:26:48 +01:00
Bjoern Schiessle 3fc75073b8
update accounts table if email address or display name changes from outside
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2016-11-25 10:26:47 +01:00
Lukas Reschke 2144a114b0
Remove exception for Chrome on Mobile
This didn't really work anyways and Chrome 54 for Android has been pushed out via Google Play on October 19th. So we should remove this.

This is only in master and doesn't affect any stable branch.

Fixes https://github.com/nextcloud/server/issues/2318

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-11-24 22:26:10 +01:00
Lukas Reschke a05b8b7953
Harden cookies more appropriate
This adds the __Host- prefix to the same-site cookies. This is a small but yet nice security hardening.

See https://googlechrome.github.io/samples/cookie-prefixes/ for the implications.

Fixes https://github.com/nextcloud/server/issues/1412

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-11-23 12:53:44 +01:00
Joas Schilling 6a525fadbb
Show all in one message
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-11-16 12:27:22 +01:00
Jan-Christoph Borchardt b228ed7bef add explanatory text of what to do on app version error
Signed-off-by: Jan-Christoph Borchardt <hey@jancborchardt.net>
2016-11-16 11:47:39 +01:00
Morris Jobke e74c527268 Merge pull request #1973 from nextcloud/dont-disable-shipped-apps-but-throw-instead
Throw an exception when a shipped app was not replaced before the update
2016-11-02 21:20:23 +01:00
Christoph Wurst d907666232
bring back remember-me
* try to reuse the old session token for remember me login
* decrypt/encrypt token password and set the session id accordingly
* create remember-me cookies only if checkbox is checked and 2fa solved
* adjust db token cleanup to store remembered tokens longer
* adjust unit tests

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2016-11-02 13:39:16 +01:00
Joas Schilling 9b66e8f7d9
Throw an exception when a shipped app was not replaced before the update
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-11-02 10:00:14 +01:00
Thomas Müller 748f18f34e
Remove all unneeded set_include_path() 2016-10-25 18:08:54 +02:00
Morris Jobke f920153f16
Throw exception because the logger causes session issues anyway that early in the request cycle
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2016-10-24 21:14:44 +02:00
Jörn Friedrich Dreyer 2e0e68b57f
log error when setting timezone to UTC fails (#26354)
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-24 21:14:40 +02:00
Vincent Petry 9e9fef46d9
Get rid of very old oc:// stream wrapper (#26381) 2016-10-20 20:46:30 +02:00
Lukas Reschke 9a2511fe9b
Don't check for Same-Site cookie on Chrome Android
Chrome on Android has a bug that it doesn't sent cookies with the
same-site attribute for the download manager. To work around that
all same-site cookies get deleted and recreated directly. Awesome!
FIXME: Remove once Chrome 54 is deployed to end-users
@see https://github.com/nextcloud/server/pull/1454
2016-09-20 01:20:17 +02:00
Lukas Reschke 6ac890812f
Add exemptions for incompatible UAs
Some user agents are notorious and don't really properly follow HTTP
 specifications. For those, have an automated opt-out. Since the protection
for remote.php is applied in base.php as starting point we need to opt out
here.
2016-09-08 17:20:46 +02:00
Joas Schilling 7bfc698ae4
Allow to call status.php before the instance is installed 2016-09-06 13:59:45 +02:00
Robin Appelman acffaa55a1 Short circuit processing of the heartbeat request 2016-08-30 15:44:00 +02:00
Juan Pablo Villafáñez b50a03141b
Fix redirection taking care of protocol and port 2016-08-29 14:24:23 +02:00
Arthur Schiwon 208e551216
check registered sections and settings after an app got updated to garbage collect orphaned classes 2016-08-16 00:56:17 +02:00
Arthur Schiwon 9edca39b49
attempt to remove section and settings entries when an app got disabled 2016-08-16 00:56:17 +02:00
Morris Jobke 4277051442 Merge pull request #660 from gdamjan/custom-config-dir
introduce NEXTCLOUD_CONFIG_DIR env variable (see #300)
2016-08-09 10:58:23 +02:00
Jan-Christoph Borchardt 835dc59d6a reduce info on update screens, introduce button to refresh 2016-08-04 12:48:25 +02:00
Damjan Georgievski 982bdb1823 introduce NEXTCLOUD_CONFIG_DIR env variable (see #300)
nextcloud by default uses the `/config/` directory in the source/application tree for its config file(s).
with this commit that directory can be overridden by the `NEXTCLOUD_CONFIG_DIR` environment variable.

in uwsgi, you would use the option `--env "NEXTCLOUD_CONFIG_DIR=/tmp/nx-config/"`
in apache `SetENV …`
and the cli command can be run with: `NEXTCLOUD_CONFIG_DIR=/tmp/nx-config ./occ` (or just use `export` once in the
shell).

NEXTCLOUD_CONFIG_DIR can be supplied with or without the trailing slash (`/`), but in all cases `$configDir` will have
it automatically added if needed.

The other changes are several occurrences of `OC::$SERVERROOT . '/config'` to `OC::$configDir`.
2016-07-29 17:49:14 +02:00
Joas Schilling 0215b004da
Update with robin 2016-07-21 18:13:58 +02:00
Joas Schilling ba87db3fcc
Fix others 2016-07-21 18:13:57 +02:00
Lukas Reschke c385423d10 Merge pull request #479 from nextcloud/add-bruteforce-throttler
Implement brute force protection
2016-07-21 00:31:02 +02:00
Lukas Reschke ba4f12baa0
Implement brute force protection
Class Throttler implements the bruteforce protection for security actions in
Nextcloud.

It is working by logging invalid login attempts to the database and slowing
down all login attempts from the same subnet. The max delay is 30 seconds and
the starting delay are 200 milliseconds. (after the first failed login)
2016-07-20 22:08:56 +02:00
Lukas Reschke a299fa38a9
[master] Port Same-Site Cookies to master
Fixes https://github.com/nextcloud/server/issues/50
2016-07-20 18:37:57 +02:00
Roeland Douma 13a25535d2 Merge pull request #400 from nextcloud/ocs_appframework
OCS routes use AppFramework
2016-07-19 12:21:14 +02:00
Roeland Jago Douma 1caceea6c0
Make the OCS endpoint handle the new OCS AppFramework routes 2016-07-18 11:09:45 +02:00
Joas Schilling 2c988ecbf4
Use the themed Defaults everywhere 2016-07-15 09:17:30 +02:00
Morris Jobke 2791b8f00d Revert "occ web executor (#24957)"
This reverts commit 854352d9a0.
2016-07-07 12:14:45 +02:00
Morris Jobke e3b509220b Revert "Bypass upgrade page when occ controller is requested"
This reverts commit 89e581acf8.
2016-07-07 12:14:39 +02:00
Morris Jobke ba16fd0d33 Merge branch 'master' into sync-master 2016-07-07 11:29:46 +02:00
Victor Dubiniuk e38bbdc9fe Bypass upgrade page when occ controller is requested 2016-07-05 09:20:37 +03:00
Thomas Pulzer 90b7f74da7 Changed name of default logfile from owncloud.log to nextcloud.log. 2016-07-04 11:50:32 +02:00
Lukas Reschke 7a9d60d87e
Merge remote-tracking branch 'upstream/master' into master-upstream-sync 2016-06-26 12:55:05 +02:00
VicDeo 854352d9a0 occ web executor (#24957)
* Initial web executor

* Fix PHPDoc

Fix broken integration test

OccControllerTests do not require database access - moch them all!

Kill unused sprintf
2016-06-22 13:12:36 +02:00
Joachim Sokolowski fa19e4c2eb some text-changes to nextcloud 2016-06-22 08:41:10 +02:00
Arthur Schiwon 39aeebfac5
Print error message again, when 3rdparty submodule is not initialized
- old code used Response which attempted to use OC::$server which is not
and cannot be intialised at this part of the code.
2016-06-08 10:34:32 +02:00
Lukas Reschke aba539703c
Update license headers 2016-05-26 19:57:24 +02:00
Joas Schilling 6222d42462
Fix class name in hook registration 2016-05-24 10:42:11 +02:00
Roeland Jago Douma c9ad60defc
Only allow loading of legacy (lib/private/legacy) by default 2016-05-20 16:35:07 +02:00
Roeland Jago Douma d666725fa7
Move \OCP to PSR-4 2016-05-19 09:43:33 +02:00
Vincent Petry 379be91618 Merge pull request #24597 from owncloud/run-upgrade-in-incognito-mode
run upgrades in incognito mode
2016-05-17 16:14:11 +02:00
Roeland Douma 5c9103287f Group fixup (#24621)
* Move used OC_Group_xx to \OC\Group

* Add (deprecated) legacy wrapper in legacy, OC_Group_xx

* Replace deprecated use of OC_Group_xx with \OC\Group\xx
2016-05-17 16:06:44 +02:00
Christoph Wurst 8b6bb0a426 Log user out correctly if max session lifetime is reached (#24552) 2016-05-12 12:09:13 +02:00
Christoph Wurst 3a1882b143
run upgrades in incognito mode 2016-05-12 11:56:58 +02:00
Christoph Wurst 168ccf90a6
try apache auth too 2016-05-11 13:36:46 +02:00
Christoph Wurst d8cde414bd
token based auth
* Add InvalidTokenException
* add DefaultTokenMapper and use it to check if a auth token exists
* create new token for the browser session if none exists
hash stored token; save user agent
* encrypt login password when creating the token
2016-05-11 13:36:46 +02:00
Roeland Jago Douma 9e1d9871a8
Move OC_User_Database to \OC\User\Database 2016-05-10 19:53:36 +02:00
Joas Schilling 8668560352
Keep the composer instance so we can add psr4 paths later 2016-05-02 14:10:53 +02:00
Thomas Müller e37b95ae53 Merge pull request #24200 from owncloud/appframework_psr4
Move \OC\AppFramework to PSR-4
2016-04-22 17:22:02 +02:00
Thomas Müller f56be022a3
Disable web updater if ldap or shibboleth are installed - refs https://github.com/owncloud/core/issues/23913#issuecomment-213432232 2016-04-22 15:53:27 +02:00
Roeland Jago Douma 1d33a5ef13
Move \OC\AppFramework to PSR-4
* Also moved the autoloader setup a bit up since we need it in initpaths
2016-04-22 15:28:09 +02:00
Lukas Reschke afad27fafd Merge pull request #24075 from owncloud/no-html-on-cli
In case of fatal php errors and other unhandled exceptions no html er…
2016-04-20 13:50:43 +02:00
Thomas Müller 1773dcbef2 Merge pull request #23973 from owncloud/share_move_post_delete_from_group_hook
Move post_removeFromGroup to shareManager
2016-04-19 06:59:58 +02:00
Thomas Müller c609abf075
In case of fatal php errors and other unhandled exceptions no html error page is expected to be displayed in the console 2016-04-18 22:30:01 +02:00
Lukas Reschke 8222ad5157
Move logout to controller
Testable code. Yay.
2016-04-18 21:21:52 +02:00
Thomas Müller 739dfb5c66
Suggest cli based updater in case the instance is bigger - #23913 2016-04-18 17:09:21 +02:00
Lukas Reschke 17dfffefb3
Keep used username in URL
This is required until the new controller can also handle POST requests
2016-04-15 19:33:25 +02:00
Lukas Reschke 331e4efacb
Move login form into controller
First step on getting the authorisation stuff cleaned up. This is only for the login form, all other stuff is still where it is.
2016-04-15 17:36:23 +02:00
Thomas Müller dc061bae42
Kill movable 3rdparty 2016-04-14 17:59:49 +02:00
Roeland Jago Douma 6144ced7a0
Move post_removeFromGroup to shareManager
The last sharing hook to be moved over.

* Added unit tests
* Removed old tests that relied on old behaviour
* Removed old hooks.php
2016-04-13 15:00:12 +02:00
Roeland Douma 495a964ca2 Migrate post_groupDelete hook to share manager (#23841)
The hook now calls the share manager that will call the responsible
shareProvider to do the proper cleanup.

* Unit tests added

Again nothing should change it is just to cleanup old code
2016-04-12 09:46:25 +02:00
Joas Schilling 8e16e7bf34 Merge pull request #23856 from owncloud/share_remove_addtogroup_hooks
Remove pre/post_addToGroup hooks for shares
2016-04-11 15:05:20 +02:00
Roeland Jago Douma 3fae4c82d2
Remove pre/post_addToGroup hooks for shares
There is no need to perform the checks for unique targets on add to
group as we have to do this all when mounting the shares anyway.
2016-04-08 11:56:38 +02:00
Stefan Weil b1a856d7b7 lib: Fix typos (found by codespell)
Signed-off-by: Stefan Weil <sw@weilnetz.de>
2016-04-07 19:51:27 +02:00