6ad957906e
Consistently use rel=noreferrer
...
When linking to external entities we should consistently use rel=noreferrer
2016-03-20 15:27:20 +01:00
24abe1e1e1
Use raw PATH_INFO
...
PATH_INFO will be empty at this point and thus the logic in base.php did not catch this. Changing this to "getRawPathInfo" will ensure that the path info is properly read.
Fixes https://github.com/owncloud/core/issues/23199
2016-03-17 17:32:38 +01:00
0864851001
Replace unneded OC::needUpgrade with OCP method
2016-03-14 10:10:29 +01:00
51072f742e
Merge pull request #21582 from owncloud/core_composer
...
Composers PSR-4 autoloader in core
2016-03-10 12:06:44 +01:00
f7729cdc40
Add composers default autoloader to core
...
This introduces the defacto standard PSR-4 autoloader from composer into
core. This will allow proper PSR-4 naming of our classes.
Since our original autoloader is still available we can slowly switch
over classes to PSR-4.
2016-03-09 16:53:27 +01:00
12b2192038
Do not set response status in CLI in case of error
2016-03-09 15:40:34 +01:00
adf5d111f6
don't hide server not available exception, fixes #20536
2016-03-03 01:15:41 +01:00
933f60e314
Update author information
...
Probably nice for the people that contributed to 9.0 to see themselves in the AUTHORS file :)
2016-03-01 17:25:15 +01:00
1dbe240b0e
Disable app that bricks the server after enabling
...
If an app is getting enabled in the web UI, an ajax call is now made to
make sure the server still works. If it doesn't, it sends an emergency
app disabling call to disable the breaking app.
2016-02-29 12:07:37 +01:00
0173063923
Pass checked host as "domain" variable to "untrustedDomain" template.
...
Currently the "SERVER_NAME" is passed to the template, which in some cases doesn't match the host returned by "getInsecureServerHost" (or is empty).
2016-02-15 17:02:14 +01:00
b01d50216e
The local address book is replaced now by the system addressbook as part of the dav app
2016-02-02 10:56:33 +01:00
f32827e903
Ignore GD JPEG warnings
...
Fixes https://github.com/owncloud/core/issues/21873
2016-01-27 13:59:15 +01:00
06fe4cabfc
move setup controller to core/controller
2016-01-20 10:23:57 +01:00
682821c71e
Happy new year!
2016-01-12 15:02:18 +01:00
876fb83ddc
getMediumStrengthGenerator is deprecated and does not do anything anymore
2016-01-11 20:06:30 +01:00
1a592e5745
Only '/tests' to be autoloaded when running unit tests
2016-01-10 21:36:14 +01:00
fce8c42240
OC autoloader is not allowed to load 3rdparty
2016-01-10 21:32:52 +01:00
74876fa6e7
Remove code related to session regeneration after some time
...
I do not really consider this necessary or a real security addition. Let's get rid of it thus, cleans up the code and makes the logic easier.
2016-01-10 11:01:30 +01:00
a58ca89e7f
Use ISession::clear
...
The native approach using the PHP calls will not work properly with the cryptowrapper and thus this code is effectively doing nothing at the moment.
2016-01-10 10:39:22 +01:00
0e561afe79
Check if app does exists
2016-01-07 21:29:45 +01:00
fec41e7539
Move regeneration of session ID into session classes
...
There were code paths that nowadays call ISession::login directly thus bypassing the desired regeneration of the session ID. This moves the session regeneration deeper into the session handling and thus ensures that it is always called. Furthermore, I also added the session regeneration to the remember me cookie plus added some test case expectations for this.
2016-01-04 15:09:01 +01:00
6f00729124
Refactor OC_Util::callCheck
2015-12-22 09:32:14 +01:00
ed98cdf532
Use OCP\Util::getVersion instead of the internal private implementation
2015-12-18 15:26:54 +01:00
6fb60815c5
Use SystemConfig internally
2015-12-18 11:53:41 +01:00
0a09004d39
Inject Config into SystemConfig
2015-12-18 11:53:41 +01:00
82bf99c0cf
Get rid of legacy OC_Config
...
We were still using the lecagy class OC_Config all over the place. Which
was a wrapper around the new class OC\Config
2015-12-18 11:53:41 +01:00
7e44ea5da0
Remove deprecated function OC_User::getManager
...
Private deprecated function => removed
Replaced all instances with suggested replacement
2015-12-17 16:18:34 +01:00
1f69dcb593
Use URLGenerator instead of hard-coded WEBROOT
...
Fixes https://github.com/owncloud/core/issues/20922
2015-12-03 14:42:14 +01:00
4d9af08f12
Execute only for web and not for CLI
2015-12-02 11:49:33 +01:00
125b7e7512
Ensure that ownCloud is always accessed with a trailing slash
2015-12-02 11:26:41 +01:00
675417a75c
Untangle the linkToDocs method in OC_Helper
...
* now uses the proper URLGenerator interface
* add comment about DI problems
2015-11-26 13:58:43 +01:00
ba67dd9818
Add warning log entry when user accesses untrusted domain
2015-11-10 12:02:10 +01:00
0bb5eadf89
[autoloader] Make sure to load construct full paths
...
This reduces a lot of the autoloader magic and makes sure that we
generate full paths in the autoloader.
2015-11-06 13:36:19 +01:00
23e22c52b0
Use IRequest's `getScriptName` functionality instead of $_SERVER['SCRIPT_NAME']
2015-10-21 17:33:49 +02:00
5588c5f262
Delete cookie instead of emptying value
...
PHP will handle session cookies with an empty values as an E_WARNING error. ([php/#68063](https://bugs.php.net/bug.php?id=68063 ))
ownCloud sets the cookie to an empty value in case the session expires, it however after this starts a new session. Due to potential race conditions this can in unlikely cases lead to the fact that the session never gets restarted and the user is left with an empty cookie. PHP tries then to use the empty cookie which makes the instance not usable.
To work around any race condition we now tell PHP to explicitly delete the value which can be done by using `null` as value, PHP will then send a cookie with the value "deleted". Also theepiration has been set to -1.
2015-10-19 19:54:12 +02:00
13dd62f7b0
Make sure that remote shares use the correct uid casing
2015-10-06 15:16:19 +02:00
b945d71384
update licence headers via script
2015-10-05 21:15:52 +02:00
fbe43e6a26
cache result of \OCP\Util::needUpgrade()
...
reduce calls of \OCP\Util::needUpgrade()
where \OCP\Util::needUpgrade() is called we can call as well
self::checkUpgrade and use the cached result
In line 877 the call way unnecessary anyway because of the first part of
the if statement
move caching to \OCP\Util::needUpgrade
renaming variable
fixing testNeedUpgradeCore()
cache result of checkUpgrade() in self::$needUpgrade
reduce calls of \OCP\Util::needUpgrade()
where \OCP\Util::needUpgrade() is called we can call as well
self::checkUpgrade and use the cached result
In line 877 the call way unnecessary anyway because of the first part of
the if statement
move caching to \OCP\Util::needUpgrade
renaming variable
fixing testNeedUpgradeCore()
fix typo in variable name
deleting tabs
2015-09-29 15:34:42 +02:00
68bf4440d3
Merge pull request #19293 from owncloud/individual-it-move_initTemplate
...
[jenkins] do not load unnecessary code in case of webdav
2015-09-25 13:49:51 +02:00
e7bc2a10e3
Merge pull request #15098 from owncloud/fix_preview_versions_revert_issue
...
fix issue with version rollback and thumbnails
2015-09-24 21:06:27 +02:00
bf1cb20e90
do not load unnecessary code in case of webdav
...
changing from "protected static" to "protected"
as suggested by @nickvergessen
https://github.com/owncloud/core/pull/19114#discussion_r39719851
moving initTemplate() into template constr.
reduce to move initTemplate only
cleanup spaces
2015-09-23 11:57:10 +02:00
a165710e99
Minor text typos
...
that I noticed while looking at some code.
2015-09-21 23:04:25 +05:45
b3ff773bbf
delete cached preview when rolling back file's version
...
add random number using OC.parseQueryString and _.extend()
version rollback: add missing prefix to OC\Preview::post_delete
add test to assure that the rollback hook is called
2015-09-20 11:22:40 +02:00
decdaf0018
Merge pull request #19024 from owncloud/remove-get_temp_dir
...
Remove get_temp_dir()
2015-09-15 14:18:29 +02:00
f8619870ea
Remove get_temp_dir()
2015-09-15 11:33:25 +02:00
65ebba44ce
Allow /tests folder in autoloader by default
...
Given the fact that "/tests" is not shipped by default and this has broken some applications and frustrated quite some people we should add "/tests" to the default allowed autoloading set.
I do consider the security impact marginally since the /tests folder is not shipped within the release as well as usually has a hard requirement on being called by phpunit.
2015-09-15 11:32:07 +02:00
7562e4959b
Merge pull request #18658 from owncloud/configurable-temp
...
Configurable temporary directory
2015-09-12 22:04:41 +02:00
b3acf09c60
Only add valid root for enabled apps
2015-09-05 00:04:58 +01:00
3bc287ff63
Merge pull request #18794 from individual-it/reuse_systemConfig
...
reuse existing $systemConfig variable
2015-09-04 14:03:56 +05:45
038b09b0b0
Proper details about git submodule update
...
* fixes #18801
2015-09-03 14:55:26 +02:00
cd0a5372ee
reuse existing $systemConfig variable
2015-09-03 12:44:35 +05:45
e9b91b1798
verify the path in the autoloader
2015-09-01 15:03:28 +02:00
acae208f2f
moved code to /lib/private/tempmanager.php
...
fix for unit test
some fixes
2015-08-29 16:59:02 +01:00
e88b380973
Remove DEBUG constant and use config value
...
* introduces config.php option 'debug' that defaults to false
* migrate DEBUG constant to config value
2015-08-24 15:14:05 +02:00
b3495a1dc9
Merge pull request #18482 from owncloud/encrypt-session-data
...
Add a session wrapper to encrypt the data before storing it on disk
2015-08-24 12:10:15 +02:00
40b1054530
Merge pull request #18254 from owncloud/mitigate-breach
...
Add mitigation against BREACH
2015-08-24 09:14:27 +02:00
36eef2ddab
Add a session wrapper to encrypt the data before storing it on disk
2015-08-21 17:59:23 +02:00
06d8edd963
Merge pull request #17434 from owncloud/update-showappnameonappupdate
...
Display app names in update page for app updates
2015-08-20 11:50:01 +02:00
a2674b2b30
Additions to update page
...
Apps to update and to disable will always be shown.
Main title changes only when apps need updated, not core.
Added bullet style.
Exclude incompatible apps from updated apps list.
2015-08-20 11:14:30 +02:00
b919ae96f0
Display app names in update page for app updates
...
Whenever the update page is displayed for apps, show app names instead
of the core update text.
2015-08-19 18:03:35 +02:00
8313a3fcb3
Add mitigation against BREACH
...
While BREACH requires the following three factors to be effectively exploitable we should add another mitigation:
1. Application must support HTTP compression
2. Response most reflect user-controlled input
3. Response should contain sensitive data
Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed.
To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.
2015-08-14 01:31:32 +02:00
ffaf5fed0e
load backbone universally
2015-08-06 12:27:18 +02:00
c3cac887f5
- more injection
...
- less static calls
- use params on sql queries
- handle sql exception on database and user creation gracefully
2015-07-30 00:04:30 +02:00
5265a44260
Remove commented code
2015-07-24 00:47:41 +02:00
582f07950f
Merge pull request #17075 from owncloud/bootstrap-tooltip
...
Replace jQuery tipsy with bootstrap tooltip
2015-07-23 19:25:09 +02:00
2d691c2fb4
Merge pull request #17381 from owncloud/fix_sharing_add_to_group
...
[sharing] fix addToGroup hook
2015-07-21 13:30:41 +02:00
058d910f5e
intproduce pre_addToGroup hook. we need to calculate the possible unique
...
targets before the user was added to the group otherwise we will always detect
a name collision
2015-07-06 17:24:05 +02:00
c8145cdbd6
Javascript mimetype icon resolver
...
This makes it possible to retrieve the icon for mimetypes in javascript.
It makes no additional queries to the server to retrieve the mimetype.
* config/mimetypealiases.json added
* mimetype.js: this is where the logic resides to convert from mimetype
to icon url
* mimetypelist.js: generated file with a list of mimetype mapping (aliases)
and the list of icon files
* ./occ maintenance:mimetypesjs : new command for occ to gernerate
mimetypes.js
* unit tests updated and still work
* javascript tests added
* theming support
* folder of the theme is now present in javascript (OC.theme.folder)
2015-07-06 16:32:10 +02:00
d3ac73c0c9
Remove OC_Log
2015-07-03 18:00:16 +02:00
2fe677d0ed
Catch cache garbage collection exception on postLogin
...
Just log the exception instead of preventing access to OC.
2015-06-30 17:36:55 +02:00
f63915d0c8
update license headers and authors
2015-06-25 14:13:49 +02:00
8621d176db
moved tooltip.js to vendor scripts
2015-06-22 15:38:32 +02:00
f66e9af9a0
replaced tipsy with bootstrap tooltip
2015-06-22 13:32:06 +02:00
97a3d8c313
Fix login handler for file cache - fixes #16795
2015-06-08 14:13:38 +02:00
5e60795962
Bring back OC\Cache\File - fixes #16760
2015-06-05 14:21:17 +02:00
cf2c599218
Merge pull request #16200 from owncloud/kill-globalfilecache
...
Drop file caching
2015-06-02 09:11:33 +02:00
e08423f956
release all locks on shutdown
2015-06-01 13:22:56 +02:00
745c3c64fa
fix preview hooks, enable_previews default is true
2015-05-13 19:59:41 +02:00
e016ed55ff
also free joblist and base from file cache code
2015-05-12 17:44:31 +02:00
0d5c7a11e2
use hooks to update encryption keys instead of the storage wrapper if a file gets renamed/restored, as long as we
...
are in the storage wrapper the file cache isn't up-to-date
2015-05-11 12:06:57 +02:00
3e647afbd4
Do not trigger preview hooks if enable_previews is false
2015-05-06 10:39:48 +02:00
3a3a58f248
Do not trigger preview hooks if enable_previews is false
2015-05-06 10:03:18 +02:00
9530e819eb
Don't display errors and log them
...
Fixes https://github.com/owncloud/core/issues/16014
2015-05-05 12:34:22 +02:00
8a85d8bc17
Try to set required ini values in base.php
...
Fixes https://github.com/owncloud/core/issues/16006
2015-05-03 13:23:29 +02:00
d0ad69aa9c
use the preSetup hook to ensure the encryption wrapper is applied correctly
2015-04-30 13:28:06 +02:00
d9990c2b4e
Delay initialization of the OC\Encryption\Update - introducing 'OC\Encryption\HookManager'
2015-04-17 13:55:31 +02:00
b25c06f576
detect system wide mount points correctly
2015-04-16 14:15:04 +02:00
7b2d53603c
Merge pull request #15489 from owncloud/dont_hide_exceptions_master
...
Dont hide exceptions master
2015-04-10 15:49:45 +02:00
a163243e31
Merge pull request #15510 from owncloud/cron-singleuser
...
block cron when in single user mode
2015-04-10 14:38:50 +02:00
a33edcd2f0
Fix singe user mode on public.php - take two
2015-04-10 11:17:33 +02:00
8964c5068c
do not disclose information, show generic error on login page
...
Conflicts:
core/templates/login.php
lib/base.php
2015-04-10 09:12:37 +02:00
f05e19348d
Fix single user check in case no user is logged in
2015-04-09 23:47:24 +02:00
f099c9883e
Adding check command to validate server environment - fixes #15429
2015-04-08 00:19:23 +02:00
ba9a797eaa
Encryption storage wrapper is enabled by default - necessary to detect encrypted files even if encryption was disabled after files have been encrypted - prevents data corruption
2015-04-07 13:30:31 +02:00
e4895bda01
add helper class accessible for encryption modules to ask for a list of users with access to a file, needed to apply the recovery key to all files
2015-04-07 13:30:29 +02:00
4db75e3407
Setting up the encryption wrapper in a setup hook - temporarily fixes the wrapping order
2015-04-07 13:30:29 +02:00
dbdd754c3f
Further cleanup of files_encryption
2015-04-07 13:30:28 +02:00
937efe856d
fix lib/private/encryption/util.php call
2015-04-07 13:30:28 +02:00
bac9b54bef
Add mount point to disable the encryption wrapper
2015-03-31 16:25:33 +02:00
232518ac54
Merge pull request #15234 from owncloud/encryption2_core
...
core part of encryption 2.0
2015-03-26 21:14:59 +01:00
Lukas Reschke
Morris Jobke
Thomas Müller
Roeland Jago Douma
Vincent Petry
Arthur Schiwon
Joachim Bauch
Joas Schilling
Individual IT Services
Phil Davis
Georg Ehrke
Robin McCorkell
Frank Karlitschek
Robin Appelman
root
Bernhard Posselt
Bjoern Schiessle
Roeland Jago Douma
Hendrik Leppelsack
Hugo Gonzalez Labrador
Jörn Friedrich Dreyer