\Sabre\DAV\Auth\Backend\AbstractBasic::authenticate was only calling \OC_Connector_Sabre_Auth::validateUserPass when the response of \Sabre\HTTP\BasicAuth::getUserPass was not null.
However, there is a case where the value can be null and the user could be authenticated anyways: The authentication via ownCloud web-interface and then accessing WebDAV resources. This was not possible anymore with this patch because it never reached the code path in this scenario.
This patchs allows authenticating with a session without isDavAuthenticated value stored (this is for ugly WebDAV clients that send the cookie in any case) and thus the functionality should work again.
To test this go to the admin settings and test if the WebDAV check works fine. Furthermore all the usual stuff (WebDAV / Shibboleth / etc...) needs testing as well.
Modified CSS for files_external application to render labels around checkboxes at the same
width as other input elements, aligning them with other elements on the same page.
This function is called a lot of times and was really slow before due to not reusing the same array.
Previously when it was called 500'000 times it took about 2seconds, now we're down to 0.2 seconds on my local machine.
Ref https://github.com/owncloud/core/issues/13434
There are a lot of clients that support multiple WebDAV accounts in the same application. However, they resent all the cookies they received from one of the accounts also to the other one. In the case of ownCloud this means that we will always show the user from the session and not the user that is specified in the basic authentication header.
This patch adds a workaround the following way:
1. If the user authenticates via the Sabre Auth Connector add a hint to the session that this was authorized via Basic Auth (this is to prevent logout CSRF)
2. If the request contains this hint and the username specified in the basic auth header differs from the one in the session relogin the user using basic auth
Fixes https://github.com/owncloud/core/issues/11400 and https://github.com/owncloud/core/issues/13245 and probably some other issues as well.
This requires proper testing also considering LDAP / Shibboleth and whatever instances.
Thomas Müller
Joas Schilling
Lukas Reschke
Jenkins for ownCloud
Morris Jobke
Ross Nicoll
Vincent Petry
Georg Ehrke
Bjoern Schiessle
Frank Karlitschek
Volkan Gezer
Sugaroverdose
Robin McCorkell