Commit Graph

230 Commits

Author SHA1 Message Date
Lukas Reschke 8313a3fcb3 Add mitigation against BREACH
While BREACH requires the following three factors to be effectively exploitable we should add another mitigation:

1. Application must support HTTP compression
2. Response most reflect user-controlled input
3. Response should contain sensitive data

Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed.

To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.
2015-08-14 01:31:32 +02:00
Robin McCorkell cd0a2874de Merge pull request #17852 from owncloud/register-alias-factory
Add test for factories
2015-08-11 13:30:56 +01:00
Robin Appelman d979e54030 log a warning while trying to acquire a db lock from within a transaction 2015-08-10 14:39:34 +02:00
Roeland Jago Douma f0b617b508 Use DI
* Register OCP\Capability\IManager at DIContainer
* Add register capabilities to appframework
* Register capabilities in DI way
* Make unit test pass again
* Remove CapabiltiesManager from OCP
2015-08-10 10:45:16 +02:00
Roeland Jago Douma c80c9819dc Move core capabilities to new class 2015-08-10 10:45:16 +02:00
Roeland Jago Douma 7e6a2b71fd Added Capabilities Manager
* This should allow the capabilities to be intergrated into the
appframework
* Unit tests
* Throw exception if closure does not return ICapability instance
2015-08-10 10:45:08 +02:00
Robin Appelman 86acd535c2 use the database backend for locking if no memcache is configured for it 2015-08-03 14:13:36 +02:00
Roeland Jago Douma d276aebf40 Pass config dir as parameter to detection class
In order to properly test the mimetype function:

* constructor takes path to configdir
* Added unit tests for mimetype (only if vfsStream is available)
2015-07-27 14:59:49 +02:00
Roeland Jago Douma 9cdd637050 Loading of mapping/aliases is done in class 2015-07-27 14:59:49 +02:00
Roeland Jago Douma 141a0f0f47 Move mimetypedetection to files/type/detection 2015-07-27 14:59:45 +02:00
Roeland Jago Douma 6db6689740 Added mimetype detector
* Copied unit tests from old functions
2015-07-27 14:58:45 +02:00
Bernhard Posselt d8673dabe3 add test for factories
use ref for factory test

use a factory for registerAlias

Ensure we construct SimpleContainer

Use single instance of DIContainer in routing tests
2015-07-25 01:59:30 +02:00
Robin McCorkell e556d97b64 Fix memcache factory creation when not installed
Memcache factory expects a class name, not an instantiated object
2015-07-15 22:55:30 +01:00
Robin McCorkell 7830434d78 Missing memcache should not cause occ hard-fail
Warning is now printed to logs, but occ and cron will still work.
2015-07-15 22:53:14 +01:00
Morris Jobke 3e97ca3b96 Add getUserFolder to IRootFolder
* untangle DI of user specific folders
* allows to autodetect the dependency
2015-07-03 11:11:58 +02:00
Vincent Petry f70791653c Merge pull request #17291 from owncloud/mount-manager-public
expose the mount manager in the public api
2015-07-03 07:57:31 +02:00
Bjoern Schiessle f5a7aa2968 call post_addToGroup als for class OC_User because sharing and LDAP are using this class. Minimal approach to fix #16740 2015-07-02 16:25:11 +02:00
Robin Appelman faf642c31d expose the mount manager in the public api 2015-07-01 15:57:04 +02:00
Morris Jobke f63915d0c8 update license headers and authors 2015-06-25 14:13:49 +02:00
Morris Jobke 7e046d0595 Fix naming of param in private/server.php 2015-06-19 10:23:04 +02:00
Morris Jobke 6856316122 Fix return value for OCP PHPDoc 2015-06-17 15:47:45 +02:00
Joas Schilling 7d8b728066 Merge pull request #16832 from owncloud/memcache-fail
Throw exception if memcache misconfigured or missing
2015-06-16 11:00:18 +02:00
Lukas Reschke 15ba2a4100 Reintroduce user cache
This was required by avatars and was broken with https://github.com/owncloud/core/pull/16200

Fixes https://github.com/owncloud/core/issues/16942
2015-06-15 17:54:48 +02:00
Vincent Petry 3b08b26589 Throw exception if memcache misconfigured or missing
Instead of falling back to null memcache, throw exceptions.
Also throw file locking specific exceptions in case the class is not
available.
2015-06-12 12:33:06 +02:00
Joas Schilling 4582d14832 Order all use statements correctly 2015-06-11 11:29:27 +02:00
Joas Schilling 05f1ff8715 Correctly import NullCache class 2015-06-11 10:48:30 +02:00
Thomas Müller 3090348bf7 Null -> NullCache 2015-06-11 00:44:13 +02:00
Thomas Müller 48e915c7be Revert "Null -> NullCache"
This reverts commit ff24554e76.
2015-06-11 00:40:26 +02:00
Thomas Müller ff24554e76 Null -> NullCache 2015-06-11 00:34:03 +02:00
Morris Jobke cf2c599218 Merge pull request #16200 from owncloud/kill-globalfilecache
Drop file caching
2015-06-02 09:11:33 +02:00
Robin Appelman 72776b165f use arraycache for locking in unit tests 2015-06-01 13:22:56 +02:00
Robin Appelman 6b965d71d1 add seperate config option for locking memcache backend 2015-06-01 13:22:56 +02:00
Robin Appelman 72847dbc77 always use locking in unit tests 2015-06-01 13:22:56 +02:00
Vincent Petry 2f4f468399 Added config switch for file locking 2015-06-01 13:22:56 +02:00
Robin Appelman e64360e72d always use arraycache for unit tests 2015-06-01 13:22:56 +02:00
Robin Appelman cdf7f91259 expose locking provider in the server container 2015-06-01 13:22:55 +02:00
Bjoern Schiessle 5549641f1f improve error messages displayed to the user 2015-05-27 21:00:02 +02:00
Arthur Schiwon e5a91fc185 remove file cache remainings from server container 2015-05-13 12:26:36 +02:00
Joas Schilling 7c65448377 Fix return type of the getRootFolder() method 2015-04-28 09:36:29 +02:00
Thomas Müller fc4127dd62 add $encryptionModuleId to methods of Keys/IStorage 2015-04-22 11:53:05 +02:00
Morris Jobke 11f29f6d95 add visibility of methods in server container and interface 2015-04-18 14:19:22 +02:00
Bjoern Schiessle b25c06f576 detect system wide mount points correctly 2015-04-16 14:15:04 +02:00
Bjoern Schiessle e3d77c4b01 add migration script from old encryption to new one 2015-04-16 14:15:04 +02:00
Lukas Reschke ba52f6f8fc Merge pull request #15314 from owncloud/app-categories-15274
Add different trust levels to AppStore interface
2015-04-09 10:07:32 +02:00
Morris Jobke 9c76d068c3 Merge pull request #15196 from owncloud/limit-file-activities-to-favorites
Limit file activities to favorites
2015-04-09 00:18:31 +02:00
Bjoern Schiessle e4895bda01 add helper class accessible for encryption modules to ask for a list of users with access to a file, needed to apply the recovery key to all files 2015-04-07 13:30:29 +02:00
Thomas Müller 6ccd3ffa23 adding function getSecureRandom(); to IServerContainer 2015-04-07 13:30:29 +02:00
Thomas Müller 1b42b492dc kill OC_FileProxy 💥 2015-04-07 13:30:28 +02:00
Bjoern Schiessle 937efe856d fix lib/private/encryption/util.php call 2015-04-07 13:30:28 +02:00
Clark Tomlinson 0c2f9ca849 Updating keystorage movement and fixing hooks 2015-04-07 13:30:27 +02:00
Lukas Reschke 0816cf9142 Add experimental applications switch
Allows administrators to disable or enabled experimental applications as well as show the trust level.
2015-04-03 13:21:24 +02:00
Joas Schilling d01cfde982 Correctly purge the cache when an app is disabled via cli 2015-04-01 15:43:38 +02:00
Joas Schilling 730efe25a4 Make scrutinizer happy 2015-04-01 12:13:49 +02:00
Joas Schilling b95d12700c Add logic for getting the user from the rss token to the Manager 2015-03-30 15:23:09 +02:00
Thomas Müller 232518ac54 Merge pull request #15234 from owncloud/encryption2_core
core part of encryption 2.0
2015-03-26 21:14:59 +01:00
Bjoern Schiessle ff9c85ce60 implement basic encryption functionallity in core to enable multiple encryption modules 2015-03-26 20:56:51 +01:00
Jenkins for ownCloud b585d87d9d Update license headers 2015-03-26 11:44:36 +01:00
Lukas Reschke 5f044ebf1b Add wrapper for Guzzle 2015-03-25 16:04:41 +01:00
Thomas Müller afa8872955 Merge pull request #14857 from owncloud/preview-provider-registration-in-manager
Preview provider registration in manager
2015-03-20 16:34:22 +01:00
Lukas Reschke 917cb66a5b Use ArrayCache if ownCloud is not installed
If ownCloud has not been installed yet the prefix might otherwise change at this point quite some time and thus the cache runs havoc.

This made installing ownCloud impossible on systems where APCu or so was available. However, I was not able to reproduce the same problem for application upgrades so this patch seems to work fine for this situation as well.

Fixes itself.
2015-03-18 11:47:16 +01:00
Robin McCorkell 760f5fc5e5 Merge pull request #14954 from owncloud/cache-image-path
Cache \OC\URLGenerator::imagePath
2015-03-17 19:36:23 +00:00
Lukas Reschke c233f2c90b Add version and path to cache prefix
Prevents to have the cache reused by other instances on the server which have possible the same instance ID and also invalidates older cache entries after an upgrade which can cause unwanted side-effects.

Impact for deployment: The same cache will only get used if ownCloud is installed with the same version and under the same path. But this should be a basic requirement anyways.
2015-03-17 12:39:49 +01:00
Lukas Reschke 9e2ebf2dce Cache \OC\URLGenerator::imagePath
\OC\URLGenerator::imagePath is a really expensive operation due to all the I/O handling and can really benefit from caching.
2015-03-17 12:35:47 +01:00
Lukas Reschke d7c7808a5e Add debug log message back 2015-03-16 13:01:17 +01:00
Lukas Reschke 13486a5ada Migrate to SwiftMail
Replaces the OC_Mail and phpmailer with SwiftMail allowing us to mock it properly.

Fixes the unit test execution on master on local machines and https://github.com/owncloud/core/issues/12014

Conflicts:
	3rdparty
	lib/private/server.php
	lib/public/iservercontainer.php
	tests/lib/mail.php
	tests/settings/controller/mailsettingscontrollertest.php

Conflicts:
	3rdparty
	lib/private/mail.php
	lib/private/server.php
	lib/public/iservercontainer.php
	settings/ajax/lostpassword.php
	settings/application.php
2015-03-16 12:47:05 +01:00
Joas Schilling 1a1dc9b335 Use DI for the config 2015-03-16 12:44:11 +01:00
Robin McCorkell 0e4933e6d2 Refactor \OC\Memcache\Factory
Caches divided up into two groups: distributed and local. 'Low latency' is an
alias for local caches, while the standard `create()` call tries to get
distributed caches first, then local caches.

Memcache backend is set in `config.php`, with the keys `memcache.local` and
`memcache.distributed`. If not set, `memcache.distributed` defaults to the value
of `memcache.local`.
2015-03-05 11:36:34 +00:00
Lukas Reschke 5c2fafa05f Read from IRequest instead of reading twice
Potentially fixes https://github.com/owncloud/core/issues/14541 and https://github.com/owncloud/core/issues/14506
2015-02-27 14:22:35 +01:00
Thomas Müller f72f9e0159 Merge pull request #14530 from owncloud/revert-14403
Revert "Updating license headers"
2015-02-27 00:39:29 -08:00
Morris Jobke 0c1e6fad6c Merge pull request #14300 from owncloud/commandbus
Add async command system to handle asynchronous operations
2015-02-26 15:10:13 +01:00
Morris Jobke 06aef4e8b1 Revert "Updating license headers"
This reverts commit 6a1a4880f0.
2015-02-26 11:37:37 +01:00
Bernhard Posselt 59bbf27253 remove IDb interface from core class usage 2015-02-25 22:21:24 +01:00
Bernhard Posselt 4e29a4d867 deprecate getters for deprecated class 2015-02-25 22:21:24 +01:00
Robin Appelman bf65b1f18b Rename getAsyncCommandBus to getCommandBus 2015-02-25 15:09:41 +01:00
Robin Appelman 74ae7b8929 Add async command system to handle asynchronous operations 2015-02-25 15:08:40 +01:00
Jenkins for ownCloud 6a1a4880f0 Updating license headers 2015-02-23 12:13:59 +01:00
Lukas Reschke cd4c064ebf Revert "add debug log for memcache instantiation" 2015-02-18 14:16:14 +01:00
Lukas Reschke cebf9f6a5a Incorporate review changes 2015-02-16 22:13:03 +01:00
Lukas Reschke 886bda5f81 Refactor OC_Request into TrustedDomainHelper and IRequest
This changeset removes the static class `OC_Request` and moves the functions either into `IRequest` which is accessible via `\OC::$server::->getRequest()` or into a separated `TrustedDomainHelper` class for some helper methods which should not be publicly exposed.

This changes only internal methods and nothing on the public API. Some public functions in `util.php` have been deprecated though in favour of the new non-static functions.

Unfortunately some part of this code uses things like `__DIR__` and thus is not completely unit-testable. Where tests where possible they ahve been added though.

Fixes https://github.com/owncloud/core/issues/13976 which was requested in https://github.com/owncloud/core/pull/13973#issuecomment-73492969
2015-02-16 22:13:00 +01:00
Jörn Friedrich Dreyer 87db136508 add debug log for memcache instantiation 2015-02-16 18:05:43 +01:00
Lukas Reschke 770fa761b8 Respect `mod_unique_id` and refactor `OC_Request::getRequestId`
When `mod_unique_id` is enabled the ID generated by it will be used for logging. This allows for correlation of the Apache logs and the ownCloud logs.

Testplan:

- [ ] When `mod_unique_id` is enabled the request ID equals the one generated by `mod_unique_id`.
- [ ] When `mod_unique_id` is not available the request ID is a 20 character long random string
- [ ] The generated Id is stable over the lifespan of one request

Changeset looks a little bit larger since I had to adjust every unit test using the HTTP\Request class for proper DI.

Fixes https://github.com/owncloud/core/issues/13366
2015-02-09 11:53:11 +01:00
Bjoern Schiessle 5ba19ba7fc certificate manager should always use a \OC\Files\View otherwise we will get problems for different primary storages 2015-01-26 16:58:52 +01:00
Bjoern Schiessle 67da1f7e5a certificate manager only needs the user-id, no need to pass on the complete user object 2015-01-26 16:58:52 +01:00
Bjoern Schiessle 24993280ed Next step in server-to-server sharing next generation, see #12285
Beside some small improvements and bug fixes this will probably the final state for OC8.

To test this you need to set up two ownCloud instances. Let's say:

URL: myPC/firstOwnCloud user: user1
URL: myPC/secondOwnCloud user: user2
Now user1 can share a file with user2 by entering the username and the URL to the second ownCloud to the share-drop-down, in this case "user2@myPC/secondOwnCloud".

The next time user2 login he will get a notification that he received a server-to-server share with the option to accept/decline it. If he accept it the share will be mounted. In both cases a event will be send back to user1 and add a notification to the activity stream that the share was accepted/declined.

If user1 decides to unshare the file again from user2 the share will automatically be removed from the second ownCloud server and user2 will see a notification in his activity stream that user1@myPC/firstOwnCloud has unshared the file/folder from him.
2014-12-19 15:20:24 +01:00
Joas Schilling 26100a6dfb Move timezone logic out of server.php 2014-12-16 16:16:22 +01:00
Vincent Petry 4b57892c4e Merge pull request #12778 from owncloud/searchbytags2
Added searchByTags to view, storage and cache
2014-12-12 14:27:19 +01:00
Morris Jobke c56fa64801 Merge pull request #12786 from owncloud/userfolder-setup
Ensure user mountpoints are setup when using getUserFolder
2014-12-11 23:51:49 +01:00
Robin Appelman 802c1b0b3a Ensure user mountpoints are setup when using getUserFolder 2014-12-11 14:34:30 +01:00
Vincent Petry 745d8706b9 Add user parameter to tag manager 2014-12-11 12:22:28 +01:00
Lukas Reschke 9ea205dc3d Check if open_basedir is set
The file:// protocol does not work with curl when an open_basedir is set.

This fixes https://github.com/owncloud/core/issues/12016
2014-12-11 00:09:55 +01:00
Lukas Reschke d84a1f6f3a Add IniGetWrapper to public interface 2014-12-11 00:09:55 +01:00
Joas Schilling 4d232e536e Deprecate Util::formatDate()
Make DateTimeFormatter a service and adjust tests that have been inaccurate
2014-12-10 11:58:56 +01:00
Thomas Müller c36bac3abd Merge pull request #12406 from owncloud/drop-getApps-getUsers
Config cleanup - OC_Preferences refactoring
2014-12-09 09:36:38 +01:00
Lukas Reschke 25a87d4058 Merge pull request #12577 from owncloud/public-mount-api
Add a public api for apps to add mounts
2014-12-08 22:57:33 +01:00
Morris Jobke 2d5fc9c1a6 Workaround to fix the too early init dilemma
* this needs to be properly fixed by a proper organisation of the base.php
* introduced fixDIInit() in AllConfig that moves the injection
  of DatabaseConnection to a later point in time
* problems mostly because of the autoconfig setup
2014-12-08 22:33:36 +01:00
Morris Jobke f0b10324ca Refactoring of OC_Preferences to AllConfig
* keep old static methods - mapped to new ones and deprecated
* removed deleteApp, getUsers, getApps because they are unused
* make AllConfig unit tests more robust against not cleaned up environments
2014-12-08 22:33:29 +01:00
Morris Jobke 50c2a819a0 Extract interaction with config.php into SystemConfig
* introduce SystemConfig to avoid DI circle (used by database connection which is itself needed by AllConfig that itself contains the methods to access the config.php which then would need the database connection - did you get it? ;))
* use DI container and use that method in legacy code paths (for easier refactoring later)
* create and use getSystemConfig instead of query() in DI container
2014-12-08 22:29:42 +01:00
Lukas Reschke fe7d9a7ca0 Add REST route for user & group management
First step of a somewhat testable user management. - I know, the JSON returns are in an ugly format but the JS expects it that way. So let's keep it that way until we have time to fix the JS in the future.
2014-12-08 12:11:01 +01:00
Robin Appelman f4701d7721 Add public api for mount configurations 2014-12-04 16:47:27 +01:00
Morris Jobke b188710af3 Merge pull request #12472 from owncloud/modifyCookies
Add functions to modify cookies to response class
2014-11-28 10:16:22 +01:00