This adds a phan plugin which checks for SQL injections on code using our QueryBuilder, while it isn't perfect it should already catch most potential issues.
As always, static analysis will sometimes have false positives and this is also here the case. So in some cases the analyzer just doesn't know if something is potential user input or not, thus I had to add some `@suppress SqlInjectionChecker` in front of those potential injections.
The Phan plugin hasn't the most awesome code but it works and I also added a file with test cases.
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
- This kind of hook signal used to be emitted in the old Share library but it was missing from Share 2.0
Signed-off-by: Pauli Järvinen <pauli.jarvinen@gmail.com>
In order to decide if a recovery key needs to be added we always
need to check the files owner settings and not the settings of
the currently logged in user.
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
in case a user is already logged in on the same server from
which the public link comes from, we need to setup the owners
file system in order to show the preview
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
Running the acceptance tests on Drone relied on the pod-style networking
used by services (service containers were available at 127.0.0.1 from
the build containers). However, in Drone 0.7 service and build
containers must be accessed from each other using their domain name
instead. Thus, acceptance tests had to be disabled on Drone.
Now that the acceptance test system supports setting a different domain
for the Selenium server and for the Nextcloud test server the acceptance
tests can be enabled again on Drone.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
By default "127.0.0.1:4444" is used, so nothing needs to be set when the
acceptance tests and the Selenium server share the same network (like
when called by "run.sh").
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
By default "127.0.0.1" is used, so nothing needs to be set when the
Selenium server and the Nextcloud test server share the same network
(like when called by "run.sh").
Besides passing the domain to the acceptance tests the Nextcloud test
server configuration must be modified to see the given domain as a
trusted domain; otherwise the access would be forbidden.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
The NextcloudTestServerLocalHelper started the PHP built-in web server
for the Nextcloud test server at 127.0.0.1; as the Selenium server has
to access the Nextcloud test server they were forced to share the same
network. Now, the domain at which the PHP built-in web server is started
can be specified when the NextcloudTestServerLocalHelper is created,
which removes the need of sharing the same network, as the Selenium
server now can access the Nextcloud test server at an arbitrary domain.
However, by default "127.0.0.1" is still used if no domain is given.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Previously this container used a very old CentOS version. It has been migrated to Debian Jessie now using the deb.sury.org repositories.
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
Nextcloud bot
Lukas Reschke
Artem Kochnev
Björn Schießle
Pauli Järvinen
Morris Jobke
Roeland Jago Douma
Joas Schilling
Roeland Jago Douma
Daniel Calviño Sánchez
Robin Appelman