Doing this in the PHP code is not the right approach for multiple reasons:
1. A bug in the PHP code prevents them from being added to the response.
2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud)
3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations.
This pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS.
This change will log all failures that prevent the CLI cronjob from happening to the database and display a warning to administrators when an error happened.
To test:
1. Configure some invalid CLI php.ini settings
2. Enable the CLI cronjob and run php cron.php
3. See the errors printed and also in the admin page
4. Configure the CLI settings correctly
5. Errors should be gone.
Fixes https://github.com/owncloud/core/issues/13994
Nobody reads the warnings anyways and so we should enforce it at installation time... Also allows us to get rid of some duplicated code.
To test change the `default_charset` to something other than `utf-8` or `UTF-8`, both should work fine with that change here. An error should then get shown.
We already set those default charsets in the shipped .user.ini and .htaccess
APCu before 4.0.6 is unbelievable buggy and tend to segfault the PHP process (i.e. the whole webserver)
This potentially fixes https://github.com/owncloud/core/issues/14175
Requires a backport to stable8
While really nearly no modern browser cares about it anymore too much it's still not wrong to have it here (and also stops some automated scanners reporting this...)
While really nearly no modern browser cares about it anymore too much it's still not wrong to have it here (and also stops some automated scanners reporting this...)
add logSettingsController
add download logfile button
move getEntries to LogSettingsController
move set log level to logsettingscontroller.php
add warning if logfile is bigger than 100MB
add unit test for set log level
fix typecasting, add new line at EoF
show log and logfile download only if log_type is set to owncloud
add unit test for getFilenameForDownload
Workaround required for IIS setups running ownCloud to prevent dataloss.
Long-term solution would be to move some configuration settings to the database
- Added setup checks in JavaScript
- Moved isWebDAVWorking to JS using SetupChecks
- Moved internet connection checks to an ajax call that goes through the
server
Jan-Christoph Borchardt
Robin McCorkell
Lukas Reschke
Morris Jobke
Jakob Sack
cmeh
Joas Schilling
Thomas Müller
Clark Tomlinson
Frank Karlitschek
Georg Ehrke
Simon Whittaker
Volkan Gezer
Vincent Petry