Commit Graph

845 Commits

Author SHA1 Message Date
Lukas Reschke 8a85d8bc17 Try to set required ini values in base.php
Fixes https://github.com/owncloud/core/issues/16006
2015-05-03 13:23:29 +02:00
Robin Appelman d0ad69aa9c use the preSetup hook to ensure the encryption wrapper is applied correctly 2015-04-30 13:28:06 +02:00
Thomas Müller d9990c2b4e Delay initialization of the OC\Encryption\Update - introducing 'OC\Encryption\HookManager' 2015-04-17 13:55:31 +02:00
Bjoern Schiessle b25c06f576 detect system wide mount points correctly 2015-04-16 14:15:04 +02:00
Thomas Müller 7b2d53603c Merge pull request #15489 from owncloud/dont_hide_exceptions_master
Dont hide exceptions master
2015-04-10 15:49:45 +02:00
Thomas Müller a163243e31 Merge pull request #15510 from owncloud/cron-singleuser
block cron when in single user mode
2015-04-10 14:38:50 +02:00
Thomas Müller a33edcd2f0 Fix singe user mode on public.php - take two 2015-04-10 11:17:33 +02:00
Jörn Friedrich Dreyer 8964c5068c do not disclose information, show generic error on login page
Conflicts:
	core/templates/login.php
	lib/base.php
2015-04-10 09:12:37 +02:00
Thomas Müller f05e19348d Fix single user check in case no user is logged in 2015-04-09 23:47:24 +02:00
Thomas Müller f099c9883e Adding check command to validate server environment - fixes #15429 2015-04-08 00:19:23 +02:00
Thomas Müller ba9a797eaa Encryption storage wrapper is enabled by default - necessary to detect encrypted files even if encryption was disabled after files have been encrypted - prevents data corruption 2015-04-07 13:30:31 +02:00
Bjoern Schiessle e4895bda01 add helper class accessible for encryption modules to ask for a list of users with access to a file, needed to apply the recovery key to all files 2015-04-07 13:30:29 +02:00
Thomas Müller 4db75e3407 Setting up the encryption wrapper in a setup hook - temporarily fixes the wrapping order 2015-04-07 13:30:29 +02:00
Thomas Müller dbdd754c3f Further cleanup of files_encryption 2015-04-07 13:30:28 +02:00
Bjoern Schiessle 937efe856d fix lib/private/encryption/util.php call 2015-04-07 13:30:28 +02:00
Robin Appelman bac9b54bef Add mount point to disable the encryption wrapper 2015-03-31 16:25:33 +02:00
Thomas Müller 232518ac54 Merge pull request #15234 from owncloud/encryption2_core
core part of encryption 2.0
2015-03-26 21:14:59 +01:00
Bjoern Schiessle ff9c85ce60 implement basic encryption functionallity in core to enable multiple encryption modules 2015-03-26 20:56:51 +01:00
Lukas Reschke 3e57e9d3e5 Merge pull request #15232 from owncloud/remove-arg-separator-magic
Remove custom `arg_separator.output`
2015-03-26 19:41:22 +01:00
Lukas Reschke 73af302d39 Remove custom `arg_separator.output`
This seems unrequired nowadays and like a legacy fragment. It should be safe to remove.

Fixes https://github.com/owncloud/core/issues/14782
2015-03-26 17:07:26 +01:00
Jenkins for ownCloud b585d87d9d Update license headers 2015-03-26 11:44:36 +01:00
Thomas Müller 843fef0490 Handle session initialization errors and display error page - fixes #15053 2015-03-20 12:21:03 +01:00
Joas Schilling 0bed187613 Stop executing, when 3rdparty is missing or apps directory is invalid 2015-03-18 11:58:18 +01:00
Thomas Müller 6c1a1234f8 Properly handle available databases at runtime and respect setup checks in command line as well 2015-03-11 09:27:12 +01:00
Thomas Müller 7181840665 Use occ to install ownCloud in autotest.sh 2015-03-11 09:27:12 +01:00
Robin McCorkell 0e4933e6d2 Refactor \OC\Memcache\Factory
Caches divided up into two groups: distributed and local. 'Low latency' is an
alias for local caches, while the standard `create()` call tries to get
distributed caches first, then local caches.

Memcache backend is set in `config.php`, with the keys `memcache.local` and
`memcache.distributed`. If not set, `memcache.distributed` defaults to the value
of `memcache.local`.
2015-03-05 11:36:34 +00:00
Lukas Reschke bbd5f28415 Let users configure security headers in their Webserver
Doing this in the PHP code is not the right approach for multiple reasons:

1. A bug in the PHP code prevents them from being added to the response.
2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud)
3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations.

This pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS.
2015-03-02 19:07:46 +01:00
Lukas Reschke afb0d742b9 Simplify code 2015-03-01 12:35:41 +01:00
Lukas Reschke b6d8a48ce1 Add detection for invalid CLI configuration for settings page
This change will log all failures that prevent the CLI cronjob from happening to the database and display a warning to administrators when an error happened.

To test:

1. Configure some invalid CLI php.ini settings
2. Enable the CLI cronjob and run php cron.php
3. See the errors printed and also in the admin page
4. Configure the CLI settings correctly
5. Errors should be gone.

Fixes https://github.com/owncloud/core/issues/13994
2015-02-27 20:20:34 +01:00
Morris Jobke 06aef4e8b1 Revert "Updating license headers"
This reverts commit 6a1a4880f0.
2015-02-26 11:37:37 +01:00
Lukas Reschke c1d7b22d08 Always load authentication apps
The current code path may trigger situations where the LDAP application is not yet loaded and thus problems with the authentication appeared.

In previous versions of ownCloud the authentication mechanism manually loaded these apps which is why this affects ownCloud 8 and master only for my knowledge. (certainly not 6, maybe 7)

Backport to 8 might be something to consider.

Fixes https://github.com/owncloud/core/issues/14469
2015-02-24 18:00:26 +01:00
Thomas Müller 0a9b8242ee properly initialize OC::$WEBROOT and host name 2015-02-23 21:49:35 +01:00
Thomas Müller bcd10d3dc5 implement command maintenance:install 2015-02-23 16:47:47 +01:00
Jenkins for ownCloud 6a1a4880f0 Updating license headers 2015-02-23 12:13:59 +01:00
Morris Jobke 75a7bcb10c Merge pull request #14199 from owncloud/cast-type-manually
Manually type-cast all AJAX files
2015-02-19 17:19:54 +01:00
Clark Tomlinson 84cc90a0ee Merge pull request #14335 from owncloud/enable-strict-mode-per-deafult
Fix invalid `ini_set` directives
2015-02-18 10:06:12 -05:00
Lukas Reschke e4bf3fcb53 Merge pull request #14330 from owncloud/revert-13879-add_debug_log_for_memcache_instantiation
Revert "add debug log for memcache instantiation"
2015-02-18 15:45:38 +01:00
Lukas Reschke 593681a4a9 Fix invalid `ini_set` directives
Somehow they got messed up. Because PHP does automatic type juggling this has worked before as well however it's not guaranteed that this might work in the future as well.
2015-02-18 15:18:27 +01:00
Lukas Reschke cd4c064ebf Revert "add debug log for memcache instantiation" 2015-02-18 14:16:14 +01:00
Lukas Reschke 1a41f8f6f9 Check if instance is not yet installed
Due to a security hardening in 8.1 a missing value of empty trusted domains in the config would provoke an error as this was misused by a lot of users.

This caused a problem where the initial installation happened from another domain than 127.0.0.1 as in this case the domain was considered untrusted as no value was defined. However, this special case should not get intercepted.

To test:
- [ ] Installing ownCloud on 127.0.0.1 works
- [ ] Installing ownCloud on another domain / IP works
- [ ] When setting up ownCloud from 127.0.0.1 and accessing it from the domain above the trusted domain error should be shown if not specified in the config

Fixes https://github.com/owncloud/core/issues/14320
2015-02-18 13:06:46 +01:00
Lukas Reschke cebf9f6a5a Incorporate review changes 2015-02-16 22:13:03 +01:00
Lukas Reschke 992164446c Add blackmagic due to cyclic dependency 🙈 2015-02-16 22:13:01 +01:00
Lukas Reschke 886bda5f81 Refactor OC_Request into TrustedDomainHelper and IRequest
This changeset removes the static class `OC_Request` and moves the functions either into `IRequest` which is accessible via `\OC::$server::->getRequest()` or into a separated `TrustedDomainHelper` class for some helper methods which should not be publicly exposed.

This changes only internal methods and nothing on the public API. Some public functions in `util.php` have been deprecated though in favour of the new non-static functions.

Unfortunately some part of this code uses things like `__DIR__` and thus is not completely unit-testable. Where tests where possible they ahve been added though.

Fixes https://github.com/owncloud/core/issues/13976 which was requested in https://github.com/owncloud/core/pull/13973#issuecomment-73492969
2015-02-16 22:13:00 +01:00
Jörn Friedrich Dreyer 87db136508 add debug log for memcache instantiation 2015-02-16 18:05:43 +01:00
Lukas Reschke a7df23ceba Manually type-case all AJAX files
This enforces proper types on POST and GET arguments where I considered it sensible. I didn't update some as I don't know what kind of values they would support 🙈

Fixes https://github.com/owncloud/core/issues/14196 for core
2015-02-13 13:33:20 +01:00
Morris Jobke 573aa196d4 Properly show the warning about the missing composer autoloader 2015-01-31 20:48:58 +01:00
Morris Jobke 254a1fa12a Merge pull request #13314 from owncloud/login-hook-logout
Return false if the login is canceled in a hook
2015-01-22 23:34:19 +01:00
Robin Appelman 8eda661761 Throw an exception when login is canceled by an app 2015-01-22 14:13:17 +01:00
Lukas Reschke 5f31207e84 Add some more sanity checks for maintenance mode 2015-01-09 21:52:16 +01:00
Lukas Reschke 1c75b73239 Verify authentication before initializing apps and routing
The current behaviour of the authenticion logic in base.php prevents REST APIs in ownCloud applications to work.

Because `!self::$CLI` is usually always a true statement the previously above block was entered which returned, thus the authentication logic for this part does not trigger in.

This can be reproduced by installing apps such as the News app and issuing the following command:

`curl -u admin:admin http://localhost/index.php/apps/news/api/v1-2/feeds`

The following parts needs to get throughly tested:

- [ ] OCS
- [ ] remote.php's DAV features
- [ ] Regular login features

This bug affects master and stable7. I'd propose that we merge this for 8.0 since this has the potential to break every component that relies on Basic Auth features. A backport would also be very nice.

Remark to myself: We really need to move out the authentication code for 8.1 out of base.php - I already have a local branch that does that somewhere which I will get in shape for 8.1... - This untested code is a night-mare.

Fixes itself.
2015-01-09 21:07:29 +01:00
Jörn Friedrich Dreyer 606f802b7b move search results below filelist, show hint when results are off screen, use js plugin mechanism 2015-01-02 10:28:41 +01:00
Jörn Friedrich Dreyer 088323aad5 move code from js.js to search.js in the search app 2015-01-02 10:28:41 +01:00
Jörn Friedrich Dreyer 891474b0d6 Merge pull request #12759 from owncloud/core-reduce-js-and-css
make sure styles and scripts are only loaded once
2014-12-18 23:18:37 +01:00
Lukas Reschke 058324b80e Check basic auth header only for not-logged-in users 2014-12-17 21:42:07 +01:00
Lukas Reschke b91a435ed4 Move basic auth login out of `isLoggedIn`
Potentially fixes https://github.com/owncloud/core/issues/12915 and opens the door for potential other bugs...

Please test very carefully, this includes:

- Testing from OCS via cURL (as in #12915)
- Testing from OCS via browser (Open the "Von Dir geteilt" shares overview)
- WebDAV
- CalDAV
- CardDAV
2014-12-17 20:12:14 +01:00
Thomas Müller 51a22431ee load showpassord.js conditionally in the template only if needed 2014-12-16 18:45:37 +01:00
Morris Jobke 9f30d3529a Implement method that reads vendor libs from core.json
* includes them at the beginning of initTemplate()
2014-12-15 14:30:03 +01:00
Morris Jobke edcd2f2706 bower jquery-ui - exported changes to a separate css file 2014-12-13 09:47:34 +01:00
Lukas Reschke 9ea205dc3d Check if open_basedir is set
The file:// protocol does not work with curl when an open_basedir is set.

This fixes https://github.com/owncloud/core/issues/12016
2014-12-11 00:09:55 +01:00
Morris Jobke 0d4f0ab871 reduce OC_Preferences, OC_Config and \OCP\Config usage
* files_encryption
* files_versions
* files_trashbin
* tests
* status.php
* core
* server container
2014-12-08 22:42:37 +01:00
Morris Jobke f164161f69 fix base.php for not installed systems 2014-12-08 22:29:43 +01:00
Lukas Reschke bd520d2e53 Create config if it does not exists
The codepath that is executed when executing ownCloud via CLI is different than via browser. Specifically, the config is created by the user session already in `OC_Util::getInstanceId()` by a call to `setValue`. That said, this seems to be quite a bad side-effect, but for the sake of "not breaking whatever might break if we touch this" let's keep it that way for now.

When executing the autoconfig via `php -f index.php` the said session was not setup and thus no `config/config.php` file was created resulting in an installation error.

To reproduce this try to setup ownCloud via `php -f index.php` with and without that patch. (ensure to delete all existing configs before and don't access ownCloud with a browser in the meantime)

Fixes itself.
2014-12-06 14:00:14 +01:00
Lukas Reschke ddcf2b84ec Remove checks for safe mode and magic quotes
Both are removed from 5.4.0

Safe Mode: http://php.net/manual/en/features.safe-mode.php
> This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0.

Magic Quotes: http://php.net/manual/en/security.magicquotes.php
> This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0.
2014-12-05 19:14:47 +01:00
Thomas Müller 0769556989 Merge pull request #12419 from owncloud/read-only-config
Allow read-only configuration
2014-12-01 16:37:29 +01:00
Lukas Reschke e35feadac2 Pass \OC::$WEBROOT to the ctr 2014-11-27 14:50:14 +01:00
Thomas Müller 5097d4dc05 remove deprecated \OC:$session 2014-11-26 15:32:47 +01:00
Lukas Reschke fc116f563f Allow read-only configuration
Workaround required for IIS setups running ownCloud to prevent dataloss.

Long-term solution would be to move some configuration settings to the database
2014-11-25 16:26:47 +01:00
Morris Jobke 604bf61e10 Merge pull request #12299 from owncloud/clean-lib-base-config
replace all static calls to OC_Config and OC_Preferences to calls to OCP...
2014-11-20 16:24:37 +01:00
Thomas Müller cbb9caf030 Merge pull request #12226 from owncloud/remove-phpass
Remove phpass and migrate to new Hasher interface
2014-11-20 14:59:59 +01:00
Morris Jobke 980dd4d22a replace double quotes with single quotes 2014-11-19 13:15:04 +01:00
Morris Jobke fef9d4218c replace all static calls to OC_Config and OC_Preferences to calls to OCP\IConfig 2014-11-19 13:06:22 +01:00
Lukas Reschke d0a30b0e55 Ignore port for trusted domains
This lead to a lot of confusion in the past and did not really offer any value. Let's remove the port check therefore. (it's anyways not really a part of the domain)

Fixes https://github.com/owncloud/core/issues/12150 and https://github.com/owncloud/core/issues/12123 and also a problem reported by @DeepDiver1975.

Conflicts:
	lib/private/request.php
2014-11-18 12:36:03 +01:00
Lukas Reschke 8595b76df2 Remove phpass and migrate to new Hasher interface
This PR removes phpass and migrates to the new Hasher interface.

Please notice that due to https://github.com/owncloud/core/issues/10671 old hashes are not updated but the hashes are backwards compatible so this shouldn't hurt.
Once the sharing classes have a possibility to update the passwords of single shares those methods should be used within the newHash if block.
2014-11-17 13:39:13 +01:00
Thomas Müller 4c1244f50c Merge pull request #11917 from owncloud/fix-11909
Add checkbox to enforce SSL for subdomains
2014-11-11 20:37:50 +01:00
Lukas Reschke 5b8a6b66b5 Load PHPAss via autoloader 2014-11-06 16:32:53 +01:00
Lukas Reschke 5f2a083686 Merge pull request #11883 from owncloud/clear-session-for-setup
Clear session before setup
2014-11-06 14:39:51 +01:00
Morris Jobke 73569b29bc md5 now handled via bower 2014-11-06 13:22:16 +01:00
Morris Jobke e49b9022a1 bower snapjs 2014-11-06 12:03:57 +01:00
Morris Jobke 957dee5af1 bower underscore 2014-11-05 23:23:03 +01:00
Morris Jobke 74d375d8ea migrate jQuery to bower 2014-11-04 14:28:29 +01:00
Morris Jobke 1a405e56f5 replace moment.js with bower version
* fix JS unit tests
2014-11-03 20:54:50 +01:00
Thomas Müller 994768d99f Update Pimple to V3.0 2014-11-03 16:57:16 +01:00
Lukas Reschke e73ccbd4ca Migrate "setsecurity.php" to the AppFramework
Add switch to enforce SSL for subdomains

Add unit tests

Add test for boolean values

Camel-case

Fix ugly JS
2014-11-03 16:53:03 +01:00
Thomas Müller a4f0483f56 Update Symfony/Console to 2.5 & Update Symfony/Routing to 2.5 2014-11-03 13:52:47 +01:00
Lukas Reschke d30fd23544 Clear session before setup
Fixes https://github.com/owncloud/core/issues/11861
2014-10-31 11:21:00 +01:00
Thomas Müller 105940b9dc Merge pull request #11638 from owncloud/oc8-translations
[OC8] Load javascript translations using standard web technologies
2014-10-29 13:09:02 +01:00
Vincent Petry d71cd680dd Include core translations
Moved search result type translations to search.js

Load JS translations earlier

Translations need to be loaded earlier to make sure that some JS files
like search.js get access to translations at this time.

This requires the template initialization to be moved to after session
initialization, because only after the session we have access to the
current language.
2014-10-29 10:09:12 +01:00
Vincent Petry ec1a73fab9 Added OC.L10N namespace with translation functions
Added addTranslations and fixed de.js file

Fixed de.js to use OC.L10N.register() and use to correct expected
format.

Added JS unit tests for OC.L10N class

Include translations JS script for all apps
2014-10-29 10:09:12 +01:00
Thomas Müller 46c2909c78 Update doctrine/dbal to 2.5 2014-10-28 15:39:37 +01:00
Thomas Müller c93ddf77b9 Use composer autoloader to load Patchwork 2014-10-28 13:42:28 +01:00
Adam Williamson 0e3f2055d2 use Composer autoloader not OC for non-Composer 3rdparty (#9643)
Composer's autoloader is rather better than the OwnCloud autoloader's
handling of non-OC classes. Plus we can rely on upstream Composer to
maintain it and not worry about it ourselves.

With this change, we drop the bits of OwnCloud's autoloader that
handled non-OC classes, and register the classes that were being
handled by that code with Composer's autoloader instead. As these
dependencies are converted to actually being managed by Composer,
the explicit registrations can be dropped as they won't be needed
any more.

Since OwnCloud's autoloader isn't going to handle non-OC classes any
more, we no longer need to test to make sure it does it right.

drop unneeded registerPrefix() and registerClass() from autoloader

Now we're not handling anything but OC's own classes, these are
unnecessary.

error out if composer autoloader is not found (thanks bantu)

We're never going to be able to work without the autoloader, if it's not
there we should just throw our hands up and surrender.
2014-10-28 11:32:20 +01:00
Lukas Reschke d6380a5395 Merge pull request #11786 from owncloud/MakeSupportedDBsConfigurable
Make supported DBs configurable within config.php
2014-10-27 22:24:16 +01:00
Lukas Reschke 233c49f4b9 Make supported DBs configurable within config.php
This commit will make the supported DBs for installation configurable within config.php. By default the following databases are tested: "sqlite", "mysql", "pgsql". The reason behind this is that there might be instances where we want to prevent SQLite to be used by mistake.

To test this play around with the new configuration parameter "supportedDatabases".
2014-10-27 21:39:34 +01:00
Robin Appelman 0b96297783 Use the TempManager to handle temporary files 2014-10-24 12:18:49 +02:00
Morris Jobke e2ff180521 Merge pull request #11416 from owncloud/eventlogger
Allow apps to gather performance diagnistics
2014-10-22 11:18:26 +02:00
Thomas Müller 2814a294c8 call initPaths() right before the server is instantiated 2014-10-21 14:10:57 +02:00
Thomas Müller d9907b6fa3 move some deprecated usage of OC_Config and OC_AppConfig to \OC::server 2014-10-20 14:44:44 +02:00
Robin Appelman 9fd234f63f Log some additional events 2014-10-20 13:38:38 +02:00
Robin Appelman 1e69f5e7ac Log some basic events 2014-10-20 13:38:38 +02:00
Vincent Petry 9fc23e1967 Merge pull request #10934 from owncloud/datadir-write-setup
Don't complain about non-writable datadirs before we're installed
2014-09-25 14:32:32 +02:00