7e271012b2
Merge pull request #16243 from owncloud/error_if_download_failed
...
redirect to error page if download failed
2015-05-18 11:42:55 +02:00
9a71eddaf9
work on tests
...
Tests reorganised and extended
2015-05-18 11:32:29 +02:00
7ee3f99a4a
Merge pull request #16364 from owncloud/add-warning-webdav
...
Add notice that WebDAV interface is not intended for browsers
2015-05-18 11:28:47 +02:00
887be709f5
a new approach to display the error message
2015-05-18 10:15:17 +02:00
257ee205bb
Merge pull request #15978 from owncloud/feature/fix-encryption-tooltips
...
[enc2]fixing recovery tooltip
2015-05-15 22:39:17 +02:00
4c9734f630
Test overriding channel
2015-05-15 22:37:14 +03:00
246000f799
Merge pull request #16176 from owncloud/fix-provisioning-api-set-quota
...
Validate the quota value to be a correct value
2015-05-15 18:07:13 +02:00
8e61ad0872
Merge pull request #15811 from owncloud/exception-on-lost-ldap-connection
...
throw exception when LDAP Connection was lost
2015-05-15 17:32:07 +02:00
18661ceb63
do not execute integration tests when executing autotest.sh
2015-05-15 16:38:21 +02:00
0991c0cc02
Merge pull request #16292 from owncloud/webdav-storage-fireprehooks
...
Fire prehooks when uploading directly to storage
2015-05-15 15:08:27 +02:00
eab55aa959
Properly log out test users in unit tests
2015-05-15 12:33:17 +02:00
54ef098867
Add unit tests for \OC\Connector\Sabre\DummyGetResponsePlugin
2015-05-15 09:08:10 +02:00
3cae0135ad
Fire prehooks when uploading directly to storage
2015-05-13 17:47:04 +02:00
4789e87a53
Merge pull request #16276 from owncloud/dav-quota-root
...
fix webdav quota check for the root of the dav endpoint
2015-05-13 14:43:02 +02:00
1f7df3eba8
Added unit test to quota plugin for free_space argument
2015-05-13 13:58:01 +02:00
d6becb8d82
add repair steps to get rid of old background jobs
2015-05-12 18:19:44 +02:00
fbe4b77c49
Merge pull request #16228 from owncloud/enc_fix_restore
...
use hooks to update encryption keys
2015-05-12 13:10:16 +02:00
b11c0c533e
Merge pull request #16233 from owncloud/enc_fix_check_if_file_is_excluded
...
fix check if a file is excluded from encryption
2015-05-12 09:12:38 +02:00
9727386d8b
fixing test
2015-05-11 09:38:23 -04:00
9dd517071e
fix check if file is excluded from encryption
2015-05-11 12:38:59 +02:00
dfed287dc0
Use insertIfNotExists to avoid problems with parallel calls
2015-05-11 12:38:33 +02:00
39497b9c3a
Add a test for parallel insert
2015-05-11 12:29:28 +02:00
2916b0ba76
Always test the object and the legacy class
2015-05-11 12:22:23 +02:00
0d5c7a11e2
use hooks to update encryption keys instead of the storage wrapper if a file gets renamed/restored, as long as we
...
are in the storage wrapper the file cache isn't up-to-date
2015-05-11 12:06:57 +02:00
e79c255cab
Conditional logging
...
* Log condition for log level increase based on conditions. Once one of these
conditions is met, the required log level is set to debug. This allows to
debug specific requests, users or apps
* Supported conditions (setting `log_condition` in `config.php`):
- `shared_secret`: if a request parameter with the name `log_secret` is set to
this value the condition is met
- `users`: if the current request is done by one of the specified users,
this condition is met
- `apps`: if the log message is invoked by one of the specified apps,
this condition is met
* fix unit test and add app log condition test
2015-05-08 15:58:33 +02:00
3de7f58321
remove file cache classes and its tests
2015-05-08 14:05:54 +02:00
15d134124b
Validate the quota value to be a correct value
2015-05-07 17:56:13 +02:00
4f6ecd3da6
\OC\Connector\Sabre\CopyEtagHeaderPlugin constructor does not take arguments.
2015-05-07 12:24:06 +02:00
2344298954
Merge pull request #16035 from owncloud/issue-15975-occ-encryption-enable-warning-no-module
...
Display a message when there is a problem with the default module
2015-05-07 12:03:30 +02:00
aea734aaf1
Fix missing types on doc block and deduplicate the method name
2015-05-06 14:31:10 +02:00
dc39bda870
move/copy from storage
2015-05-06 14:20:02 +02:00
83ed4ee5b6
unit tests
2015-05-06 12:28:15 +02:00
874d35b27a
Merge pull request #16070 from owncloud/enc_update_file_cache_on_copy
...
make sure that we keep the correct encrypted-flag and the (unencrypted)size
2015-05-06 10:28:10 +02:00
7089af96f2
make sure that we keep the correct encrypted-flag and the (unencrypted)size if a file gets copied
2015-05-05 16:17:14 +02:00
2aaafc134c
Merge pull request #16064 from owncloud/fix-empty-mail-address
...
Allow user to set an empty email address
2015-05-05 14:51:53 +02:00
d36d14366b
Add test for setEmailAddress
2015-05-05 13:53:00 +02:00
493844eda4
add positive tests for operator in code checker
2015-05-05 13:09:12 +02:00
aae098c24a
Check usage of != and == - refs #16054
2015-05-05 12:59:33 +02:00
59c657da53
Merge pull request #15772 from owncloud/issue-15771-dont-restrict-permissions-for-share-owner
...
Do not restrict permissions for the original owner
2015-05-04 15:07:37 +02:00
10144bd7f5
Display a message when there is a problem with the default module
2015-05-04 12:36:50 +02:00
7376ea9b26
Merge pull request #15584 from owncloud/enc_fix_upload_shared_folder
...
skip user if we don't have a public key
2015-05-04 09:57:19 +02:00
ba7d221cff
allow getting the path from the lockedexception
2015-04-30 14:48:42 +02:00
8119b8b040
add tests for castrait
2015-04-30 14:48:39 +02:00
96f9573a4b
add memcache based shared/exclusive locking
2015-04-30 14:48:39 +02:00
acf30ede95
add compare and swap to memcache
2015-04-30 14:48:39 +02:00
29213b6136
extends memcache with add, inc and dec
2015-04-30 14:48:36 +02:00
cf4a6874fb
Allow setting protected properties
2015-04-30 12:04:02 +02:00
09d479e79d
Add a test to share a subfolder of a folder shared with the owner by group
2015-04-29 13:33:20 +02:00
8c7db2536d
Merge pull request #15596 from owncloud/issue/15589
...
Correctly generate the feedback URL for remote share
2015-04-29 10:52:43 +02:00
7df7a3b360
Merge pull request #15906 from rullzer/fix_15777
...
Password set via OCS API should not be double escaped
2015-04-29 10:44:25 +02:00
34d0e610cc
Filter potential dangerous filenames for avatars
...
We don't want to have users misusing this API resulting in a potential file disclosure of "avatar.(jpg|png)" files.
2015-04-28 16:57:23 +02:00
b55ef51a27
Add tests for the correct share id on the call aswell
2015-04-28 14:56:13 +02:00
02269b6464
Added unit test
2015-04-28 14:00:36 +02:00
02c60949dd
make scrutinizer happy
2015-04-28 11:28:54 +02:00
d146c13abd
Add tests for the remote sharing url
2015-04-28 11:28:54 +02:00
de8c15e1a4
Merge pull request #14764 from owncloud/shared-etag-propagate
...
Propagate etags across shared storages
2015-04-28 10:58:50 +02:00
7d0eba7a41
Merge pull request #15886 from owncloud/fix-15848-master
...
Adjust isLocal() on encryption wrapper
2015-04-27 15:06:26 +02:00
678b7d7e4d
Merge pull request #15860 from owncloud/enc_fallback_old_encryption
...
[encryption] handle encrypted files correctly which where encrypted with a old version of ownCloud (<=oc6)
2015-04-27 14:32:19 +02:00
936d564058
fixes #15848
2015-04-27 14:26:05 +02:00
6bf0579622
fix test
2015-04-27 14:07:16 +02:00
be55a90323
dont use our now non existing hook
2015-04-27 14:07:15 +02:00
27683f9442
fall back to the ownCloud default encryption module and aes128 if we read a encrypted file without a header
2015-04-27 13:01:18 +02:00
8f61fbb81f
Fix new tests
2015-04-27 11:10:31 +02:00
e4977841b4
Add unit tests for the commands
2015-04-27 11:03:51 +02:00
d600955a51
Make getDefaultModuleId public and get module protected
2015-04-27 11:03:51 +02:00
4e97228cde
Deduplicate module mock
2015-04-27 11:03:51 +02:00
4b7ae395f2
Add test for setDefaultEncryptionModule
2015-04-27 11:03:51 +02:00
b35379515c
Add a test that the default module is returned before we fall back
2015-04-27 11:03:50 +02:00
4dfdaf741c
Merge pull request #15834 from owncloud/make-temporary-file-really-unique
...
Fix collision on temporary files + adjust permissions
2015-04-25 23:18:26 +02:00
b9df932e3c
Merge pull request #15683 from owncloud/block-legacy-clients
...
Block old legacy clients
2015-04-24 18:21:10 +02:00
9a5783b284
fix unit tests
2015-04-24 16:47:27 +02:00
4554df2512
enable testWriteWriteRead
2015-04-24 16:44:00 +02:00
18a1225b0c
enable testRewind
2015-04-24 16:44:00 +02:00
27ea23ea6b
Update encryption.php
2015-04-24 16:44:00 +02:00
d6841aa706
disable r+ test
2015-04-24 16:44:00 +02:00
7a34f75da6
add two tests
...
testRewind tests reading and writing after rewind on an encrypted stream; testWriteWriteRead tests r+ mode
2015-04-24 16:44:00 +02:00
4334e77035
Merge pull request #15839 from owncloud/enc_fix_moving_shared_files
...
[encryption] fix moving files to a shared folder
2015-04-24 15:07:36 +02:00
411f7893bf
Add test "operation on keys failed"
2015-04-24 14:27:23 +02:00
781cfff221
Deduplicate data provider and fix method visibility
2015-04-24 13:12:45 +02:00
24128d1384
only update share keys if the file was encrypted
2015-04-24 10:19:09 +02:00
61c6d64125
Merge pull request #15826 from owncloud/issue-15804-occ-user-delete-exception
...
Issue 15804 occ user delete exception
2015-04-23 22:58:24 +02:00
2646bccb83
update share keys if file gets copied
2015-04-23 17:18:48 +02:00
2990b0e07e
update share keys if a file is moved to a shared folder
2015-04-23 17:18:48 +02:00
ab9ea97d3a
Catch not existing User-Agent header
...
In case of an not sent UA header consider the client as valid
2015-04-23 16:33:51 +02:00
155ae44bc6
Fix collision on temporary files + adjust permissions
...
This changeset hardens the temporary file and directory creation to address multiple problems that may lead to exposure of files to other users, data loss or other unexpected behaviour that is impossible to debug.
**[CWE-668: Exposure of Resource to Wrong Sphere](https://cwe.mitre.org/data/definitions/668.html )**
The temporary file and folder handling as implemented in ownCloud is performed using a MD5 hash over `time()` concatenated with `rand()`. This is insufficiently and leads to the following security problems:
The generated filename could already be used by another user. It is not verified whether the file is already used and thus temporary files might be used for another user as well resulting in all possible stuff such as "user has file of other user".
Effectively this leaves us with:
1. A timestamp based on seconds (no entropy at all)
2. `rand()` which returns usually a number between 0 and 2,147,483,647
Considering the birthday paradox and that we use this method quite often (especially when handling external storage) this is quite error prone and needs to get addressed.
This behaviour has been fixed by using `tempnam` instead for single temporary files. For creating temporary directories an additional postfix will be appended, the solution is for directories still not absolutely bulletproof but the best I can think about at the moment. Improvement suggestions are welcome.
**[CWE-378: Creation of Temporary File With Insecure Permissions](https://cwe.mitre.org/data/definitions/378.html )**
Files were created using `touch()` which defaults to a permission of 0644. Thus other users on the machine may read potentially sensitive information as `/tmp/` is world-readable. However, ownCloud always encourages users to use a dedicated machine to run the ownCloud instance and thus this is no a high severe issue. Permissions have been adjusted to 0600.
**[CWE-379: Creation of Temporary File in Directory with Incorrect Permissions](https://cwe.mitre.org/data/definitions/379.html )**
Files were created using `mkdir()` which defaults to a permission of 0777. Thus other users on the machine may read potentially sensitive information as `/tmp/` is world-readable. However, ownCloud always encourages users to use a dedicated machine to run the ownCloud instance and thus this is no a high severe issue. Permissions have been adjusted to 0700.Please enter the commit message for your changes.
2015-04-23 15:07:54 +02:00
b88d0ba0ac
Delete temp files after testing encryption stream wrapper
2015-04-23 13:42:18 +02:00
cb641b4c29
Fix file names
2015-04-23 12:53:01 +02:00
cfa23e60d3
Add tests for occ user:lastseen
2015-04-23 12:41:06 +02:00
bb5b6e5f63
Add unit tests for occ user:delete
2015-04-23 12:33:12 +02:00
570718fb6b
Merge pull request #15757 from owncloud/enc-fixfeofforlastblock
...
Fix encryption feof to not return too early
2015-04-22 11:32:21 +02:00
19e8c4fcb1
get dirname from sharePath
2015-04-21 14:58:01 +02:00
76dad297ff
Fix encryption feof to not return too early
...
This is because stream_read will pre-cache the next block which causes
feof($this->source) to return true prematurely. So we cannot rely on it.
Fixed encryption stream wrapper unit tests to actually simulate 6k/8k
blocks to make sure we cover the matching logic.
Added two data files with 8192 and 8193 bytes.
2015-04-20 18:32:40 +02:00
fe2cbc3795
Merge pull request #15744 from owncloud/fix-inverted-path-in-resourcenotfound
...
Fix wrong path generation
2015-04-20 16:55:36 +02:00
9bc48451b9
Adjust tests and statuscode
2015-04-20 13:00:02 +02:00
21f0476d31
Fix files
2015-04-20 13:00:02 +02:00
20a6073a9f
Migrate personal certificate handling into AppFramework controllers
...
Also added unit-tests and better error-handling
2015-04-20 12:58:58 +02:00
9f61cf60d4
Verify if returned object is an array
...
The error has to be thrown at this point as otherwise errors and notices are thrown since the time cannot be parsed in L60 and L61
2015-04-20 12:58:57 +02:00
ed0b465cf9
Use 403 instead a 50x response
2015-04-20 12:53:40 +02:00
ddcd79132d
Add tests for correct path
2015-04-20 12:31:35 +02:00
0cf13e9b78
Fix phpStorm complains and namespace
2015-04-20 12:31:07 +02:00
Vincent Petry
jknockaert
Morris Jobke
Bjoern Schiessle
Thomas Müller
Victor Dubiniuk
Joas Schilling
Lukas Reschke
Robin Appelman
Arthur Schiwon
Björn Schießle
Clark Tomlinson
Joas Schilling
Andreas Fischer
Jan-Christoph Borchardt
Robin Appelman
Roeland Jago Douma