We already support the `config_is_read_only` for the config file itself. However not for the whole directory (which is a bug).
This unifies the check in the checkServer routine with the one in base.php. Now one can enable a read only config folder so that ownCloud is not allowed to overwrite it's own source code.
To test this set the whole config folder to read only, clear your session, refresh, see it fails, add the new code, refresh, see it works. Also verify that setup still works fine. (obviously setup does not work with a read only config Also verify that setup still works fine. (obviously setup does not work with a read only config))
Fixes https://github.com/owncloud/core/issues/14455
This changeset allows ownCloud to run with pretty URLs, they will be used if mod_rewrite and mod_env are available. This means basically that the `index.php` in the URL is not shown to the user anymore.
Also the not deprecated functions to generate URLs have been modified to support this behaviour, old functions such as `filePath` will still behave as before for compatibility reasons.
Examples:
http://localhost/owncloud/index.php/s/AIDyKbxiRZWAAjP => http://localhost/owncloud/s/AIDyKbxiRZWAAjPhttp://localhost/owncloud/index.php/apps/files/ => http://localhost/owncloud/apps/files/
Due to the way our CSS and JS is structured the .htaccess uses some hacks for the final result but could be worse... And I was just annoyed by all that users crying for the removal of `index.php` ;-)
While BREACH requires the following three factors to be effectively exploitable we should add another mitigation:
1. Application must support HTTP compression
2. Response most reflect user-controlled input
3. Response should contain sensitive data
Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed.
To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.
Storage status is saved in the database. Failed storages are rechecked every
10 minutes, while working storages are rechecked every request.
Using the files_external app will recheck all external storages when the
settings page is viewed, or whenever an external storage is saved.
Morris Jobke
Thomas Müller
Roeland Jago Douma
Robin Appelman
Lukas Reschke
Joas Schilling
Individual IT Services
Martin
Bjoern Schiessle
Vincent Petry
Andreas Böhler
Robin McCorkell