OVH has implemented load balancing in a very questionable way where the reverse proxy actually internally adds some cookies which would trigger a security exception. To work around this, this change only checks for the session cookie.
'core' and 'settings' are just apps but we treat them slightly
different. Make sure that we construct the correct namespace so we can
actually do automatic AppFramework stuff.
One of the possibilities of the old OCS API is that you can define the
url yourself.
This PR makes this possible again by adding an optional root elemenet to
the route. Routes are thus:
.../ocs/v2.php/<root>/<url>
By default <root> = apps/<app>
This will allow for example the provisioning API etc to be in
../ovs/v2/php/cloud/users
Class Throttler implements the bruteforce protection for security actions in
Nextcloud.
It is working by logging invalid login attempts to the database and slowing
down all login attempts from the same subnet. The max delay is 30 seconds and
the starting delay are 200 milliseconds. (after the first failed login)
* Move a-b to PSR-4
* Move c-d to PSR-4
* Move e+g to PSR-4
* Move h-l to PSR-4
* Move m-r to PSR-4
* Move s-u to PSR-4
* Move files/ to PSR-4
* Move remaining tests to PSR-4
* Remove Test\ from old autoloader
Lukas Reschke
Roeland Jago Douma
Christoph Wurst
Joas Schilling