c385423d10
Merge pull request #479 from nextcloud/add-bruteforce-throttler
...
Implement brute force protection
2016-07-21 00:31:02 +02:00
ba4f12baa0
Implement brute force protection
...
Class Throttler implements the bruteforce protection for security actions in
Nextcloud.
It is working by logging invalid login attempts to the database and slowing
down all login attempts from the same subnet. The max delay is 30 seconds and
the starting delay are 200 milliseconds. (after the first failed login)
2016-07-20 22:08:56 +02:00
a17ba2f488
Merge pull request #466 from nextcloud/escape-special-characters
...
Escape special characters (#25429 )
2016-07-20 21:24:19 +02:00
26cf51403e
Merge pull request #464 from nextcloud/master-change-load-order
...
[master] Change load order of auth backends so that we can throw an exception …
2016-07-20 20:08:22 +02:00
e5c4f53eea
Cast share id to string ( #25402 )
2016-07-20 15:10:10 +02:00
7c0de08cc4
Escape special characters ( #25429 )
...
* Escape LIKE parameter
* Escape LIKE parameter
* Escape LIKE parameter
* Escape LIKE parameter
* Escape LIKE parameter
* Use correct method in the AbstractMapping class
* Change the getNamesBySearch method so that input can be properly escaped while still supporting matches
* Don't escape hardcoded wildcard
2016-07-20 14:46:47 +02:00
e795f7b106
Change load order of auth backends so that we can throw an exception in OCA\DAV\Connector\Sabre\Auth - fixes #25362 ( #25476 )
2016-07-20 14:40:52 +02:00
0a6d95b126
Merge pull request #394 from nextcloud/tags-for-everything
...
SystemTags for everything not just files
2016-07-19 10:47:12 +02:00
ea470f8777
Merge pull request #405 from nextcloud/theming-fixes
...
Theming fixes
2016-07-18 15:59:47 +02:00
7c039bcbf6
Allow apps to register SystemTags plugins
2016-07-18 10:26:42 +02:00
c2b077e185
Fix doc blocks
2016-07-18 10:26:42 +02:00
8e13ff2c86
Fix TODO and bring in abstraction (similar to comments)
2016-07-18 10:26:36 +02:00
2c988ecbf4
Use the themed Defaults everywhere
2016-07-15 09:17:30 +02:00
059b7435ab
PasswordLoginForbidden is not a FATAL exception
...
It is just a 'Sabre\DAV\Exception\NotAuthenticated' exception
with some special meaning.
So just log it as DEBUG and not as FATAL.
2016-07-14 22:53:12 +02:00
6da066e7be
Fix test using private propertries
2016-07-08 12:36:25 +02:00
f98cb9efa0
Fix type hinting
2016-07-08 12:35:50 +02:00
8f84c99e3f
Fix undefined properties
2016-07-08 12:35:16 +02:00
ba16fd0d33
Merge branch 'master' into sync-master
2016-07-07 11:29:46 +02:00
7d95cde37d
Add all properties while creating a subscription ( #25318 )
...
Fixes #24469
2016-07-01 13:42:35 +02:00
179a355b2c
Merge remote-tracking branch 'upstream/master' into master-sync-upstream
2016-07-01 11:36:35 +02:00
26e14529be
fix error message
2016-06-30 13:50:31 +02:00
c771368c4e
Add proper throws PHP docs
2016-06-30 13:19:50 +02:00
1e7f0f7341
Add required $message parameter
2016-06-30 13:17:53 +02:00
3571207bd9
add some additonal permission checks to the webdav backend
2016-06-30 11:16:49 +02:00
5ace6b53f3
get only vcards which match both the address book id and the vcard uri ( #25294 )
2016-06-29 12:13:59 +02:00
5f6944954b
get only vcard which match both the address book id and the vcard uri
2016-06-28 16:11:06 +02:00
3c399be6ec
fix a ImageExportPlugin Test ( #25215 )
2016-06-27 21:26:56 +02:00
56ad4cdfec
Show error message when posting an invalid comment
...
When an internal server error occurs while creating or updating a
comment, display a proper error notification in the UI.
2016-06-24 10:17:12 +02:00
1452b74de7
Contacts API: replace raw image data with url ( #25081 )
...
* add uri to AddressBookImpl array
* Introduce ImageExportPlugin for CardDav
* add plugin to v1 routes
* replace binary contact photo with link
* update tests
* Adding unit tests
2016-06-21 15:25:44 +02:00
2340660a5b
PasswordLoginForbidden must extend NotAuthenticated
...
The auth code from Sabre will forward NotAuthenticated exceptions but
in the case of a generic exception, it is packaged as "service not
available".
2016-06-17 15:50:24 +02:00
5a8cfab68f
throw PasswordLoginForbidden on DAV
2016-06-17 11:30:24 +02:00
82b50d126c
add PasswordLoginForbiddenException
2016-06-17 11:02:07 +02:00
0b7685d326
Move birthday calendar generation to a live migration job ( #25135 )
2016-06-16 16:14:28 +02:00
331d88bcab
create session token on all APIs
2016-06-13 15:38:34 +02:00
68c3b23e04
Merge pull request #24080 from owncloud/support-calendar-class-property
...
Extract CLASS property from calendar object and store it in the database
2016-06-10 11:22:11 +02:00
67c3a97401
Merge pull request #25046 from owncloud/fix-the-realm
...
Use the correct realm for basic authentication
2016-06-10 10:41:46 +02:00
543545505d
Merge pull request #25043 from owncloud/webdav-download-mimetype
...
DAV now returns file name with Content-Disposition header
2016-06-10 09:55:59 +02:00
1399e87d57
DAV now returns file name with Content-Disposition header
...
Fixes issue where Chrome would append ".txt" to XML files when
downloaded in the web UI
2016-06-09 15:51:41 +02:00
cf06b17df1
Use the correct realm for basic authentication - fixes #23427
2016-06-09 13:53:32 +02:00
f20c617154
Allow login by email address via webdav as well - fixes #24791
2016-06-09 12:08:49 +02:00
bfcd1dc49c
Filter confidential calendar objects in shared calendars
...
Filter private calendar objects in shared calendars
2016-06-09 11:09:14 +02:00
082f456b8b
Added unit testing for the migration step
2016-06-09 11:09:14 +02:00
369c3b5d7e
Implement classification migration as repair step
2016-06-09 11:09:14 +02:00
287e41732c
Bump dav app version and fix variable rename
2016-06-09 11:09:14 +02:00
f013cfc530
Add migration step
2016-06-09 11:09:13 +02:00
fbdec59f22
Extract CLASS property from calendar object and store it in the database
2016-06-09 11:09:13 +02:00
f119769c26
Better handling of forbidden files in dav
2016-06-07 14:01:55 +02:00
371a07e3ab
Fix checkMove() implementation for dav v2 - fixes #24776 ( #24971 )
2016-06-06 17:01:27 +02:00
3ff2bec5fa
Merge pull request #24935 from owncloud/2fa-block-dav
...
block DAV if 2FA challenge needs to be solved first
2016-06-02 15:31:18 +02:00
942e946f06
Catch the ForbiddenException to make sure it gets handled
2016-06-01 16:17:57 +02:00
da03a85c3c
block DAV if 2FA challenge needs to be solved first
2016-06-01 10:42:38 +02:00
aba539703c
Update license headers
2016-05-26 19:57:24 +02:00
28ce7dd262
do not allow client password logins if token auth is enforced or 2FA is enabled
2016-05-24 17:54:02 +02:00
ad10485cec
when generating browser/device token, save the login name for later password checks
2016-05-24 11:49:15 +02:00
87fa86a69a
Merge pull request #24559 from owncloud/2fa
...
two factor auth
2016-05-23 20:50:03 +02:00
c10d8a37f7
Merge pull request #22690 from owncloud/fix-comments-href-remote.php-files
...
ensure comments-href returns a value also when propfind is done again…
2016-05-23 14:47:03 +02:00
dfb4d426c2
Add two factor auth to core
2016-05-23 11:21:10 +02:00
c9fda84841
Make the root collection neutral so it does not only work for files
2016-05-23 09:03:48 +02:00
3a8e537946
Remove unused UserFolder
2016-05-23 09:03:47 +02:00
5963128342
Adjust DAV SystemTagPlugin unit tests for groups
2016-05-20 17:56:02 +02:00
10fae3994a
Fix system tag update code
2016-05-20 17:56:02 +02:00
d7727cdc74
Add admin-only system tag groups property
...
For setting/getting system tag groups
2016-05-20 17:56:02 +02:00
88740f035d
Act on effective system tag canAssign permission
...
Whenever the server returns true for the can-assign Webdav property of
a system tag, it means the current user is allowed to assign,
regardless of the value of user-assignable.
This commit brings the proper logic to the web UI to make it possible
for users to assign when they have the permission.
2016-05-20 17:56:02 +02:00
03d32bc39b
Fix system tags DAV unit tests
2016-05-20 17:56:02 +02:00
bede872dbc
Bring back admin permissions to change system tag permissions
2016-05-20 17:56:02 +02:00
09b3883d9c
Updated canUser* functions in SystemTagManager to accept objects
2016-05-20 17:56:02 +02:00
8343cfb64b
Add interface methods for permission check
...
Instead of checking for admin perm, use interface method
canUserAssignTag and canUserSeeTag to check for permissions.
Allows for more flexible implementation.
2016-05-20 17:56:02 +02:00
2b30136ae9
ensure comments-href returns a value also when propfind is done against remote.php/files
2016-05-20 16:22:13 +02:00
dd9ee10bc0
Move dav app to PSR-4 ( #24527 )
...
* Move Application to correct namespace and PSR-4 it
* Move dav app to PSR-4
2016-05-12 09:42:40 +02:00
0486d750aa
use the UID for creating the session token, not the login name
2016-05-11 13:36:46 +02:00
5e55dfb2d6
create session token for DAV clients (sync clients)
2016-05-11 13:36:46 +02:00
47157bcd76
Merge pull request #24400 from owncloud/cache_shareManager
...
Cache shareManager
2016-05-06 14:25:30 +02:00
3c2fee8775
Cache shareManager
...
There is no need to call \OC::$server->getShareManager for each Node.
We have it available so better pass it around.
2016-05-02 22:27:24 +02:00
b10dcfc3b7
Fixing local event delivery for calendar events based on the email address
2016-05-02 14:20:59 +02:00
606b756a94
Merge pull request #23918 from owncloud/cruds-for-federated-shares
...
bring back CRUDS permissions for federated shares
2016-04-22 14:50:42 +02:00
3b3cff4f79
Merge pull request #24151 from owncloud/create-personal-calendar
...
Personal calendar should be generated even if the birthday calendar a…
2016-04-22 11:09:45 +02:00
1d1247069f
Birthday calendar should never have write acl - fixes #24154
2016-04-21 13:36:52 +02:00
38c7296867
Personal calendar should be generated even if the birthday calendar already exists - fixes #24082
2016-04-21 12:34:20 +02:00
cd01c440a0
Merge pull request #23919 from owncloud/cyclyc-share-dep-example
...
SharedStorage to new sharing code + cleanup
2016-04-20 20:37:27 +02:00
a86fd873d6
Merge pull request #24076 from owncloud/fix-initial-calendar-and-addressbook-names
...
Fix displayname for initial calendars and address books
2016-04-19 14:30:35 +02:00
afa37d363f
Fix related logic
2016-04-19 14:04:00 +02:00
748134bd90
Fix displayname for initial calendars and address books - fixes #24057
2016-04-18 23:08:37 +02:00
d0ad8e6e69
Revert "Fix displayname for initial calendars and address books - fixes #24057"
...
This reverts commit a5d3e5ed68
2016-04-18 23:07:49 +02:00
a5d3e5ed68
Fix displayname for initial calendars and address books - fixes #24057
2016-04-18 23:06:38 +02:00
dcb2b37e24
Add data-fingerprint property to webdav
2016-04-18 16:08:11 +02:00
52669d0ea3
return correct share permissions on propfind
2016-04-18 12:02:06 +02:00
0cebb16e7c
Move share-permissions property namespace
...
Fixes https://github.com/owncloud/core/issues/23741
2016-04-15 10:22:18 +02:00
55735e1450
Translate contacts birthday - fixes #23982
2016-04-14 16:58:45 +02:00
068e73cc47
Merge pull request #23975 from owncloud/change-default-calendar-and-contacts-names
...
Use better names for the default calendars and addressbooks
2016-04-14 11:57:43 +02:00
439de52534
Remove dav migration for 9.1
2016-04-13 15:53:57 +02:00
353449bff7
Use better names for the default calendars and addressbooks - fixes #23720
2016-04-13 15:44:59 +02:00
3c0a1d4241
Merge pull request #20118 from owncloud/chunked-upload-dav
...
Initial implementation of the new chunked upload
2016-04-13 14:37:10 +02:00
499d131a09
always return the complete permissions the file was shared with
2016-04-12 17:56:56 +02:00
e21642ca31
Fix unit test of file plugin
2016-04-12 15:51:09 +02:00
bb2e68f72b
Fix chunk file move
2016-04-12 14:26:42 +02:00
72f5c539e8
Initial implementation of the new chunked upload - as specified in https://dragotin.wordpress.com/2015/06/22/owncloud-chunking-ng/
2016-04-12 12:32:04 +02:00
8652ef28aa
Merge pull request #23868 from owncloud/scrutinizer-patch-2
...
Scrutinizer Auto-Fixes
2016-04-11 10:38:02 +02:00
24c2252ff4
Adding VCFExportPlugin
2016-04-10 12:43:15 +02:00
3ebeb07a30
Scrutinizer Auto-Fixes
...
This commit consists of patches automatically generated for this project on https://scrutinizer-ci.com
2016-04-08 15:11:37 +00:00
6f3eeeeb36
Merge pull request #23510 from owncloud/birthdays-on-shared-addressbooks
...
Propagate birthdays of shared addressbooks to the sharee's birthday c…
2016-04-08 15:19:38 +02:00
Lukas Reschke
Roeland Douma
Vincent Petry
Aaron Wood
Thomas Müller
Morris Jobke
Björn Schießle
Joas Schilling
Roeland Jago Douma
Robin Appelman
Thomas Citharel
Lukas Reschke
Georg Ehrke
Christoph Wurst
Thomas Müller
Joas Schilling
Arthur Schiwon
Joas Schilling
Roeland Jago Douma
Björn Schießle
Scrutinizer Auto-Fixer