Commit Graph

3546 Commits

Author SHA1 Message Date
Roeland Jago Douma b98dfaccd9 Merge pull request #1920 from nextcloud/legacy-pages-should-also-receive-the-nonce
Add nonce also to legacy CSP
2016-10-26 16:41:34 +02:00
Morris Jobke cde7f535bd Merge pull request #1738 from nextcloud/comments-provide-displaynames-with-mentions
comment mentions: show displayname not uid
2016-10-26 14:02:49 +02:00
Joas Schilling c20ab0049f
Identify Chromium as Chrome
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-10-26 12:07:10 +02:00
Roeland Jago Douma e351ba56f1
Move browserSupportsCspV3 to CSPNonceManager
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-25 22:03:10 +02:00
Morris Jobke 097a9ec8b0 Merge pull request #1878 from nextcloud/downstream-25936
Adjust unit tests to upstream
2016-10-25 17:59:01 +02:00
Morris Jobke 89574367bc Merge pull request #1871 from nextcloud/use-csp-nonces
Use CSP nonces
2016-10-25 14:46:00 +02:00
Lukas Reschke 740ff9108b Merge pull request #1884 from nextcloud/downstream-26292
Fix logClientIn for non-existing users (#26292)
2016-10-25 11:24:13 +02:00
Joas Schilling 890f752a6b Merge pull request #1452 from nextcloud/appconfig-endpoint
Appconfig endpoint
2016-10-25 10:57:48 +02:00
Roeland Jago Douma 593d52fe91
Fix and cleanup SessionTest
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-25 09:34:27 +02:00
Vincent Petry 6d1e858aa4
Fix logClientIn for non-existing users (#26292)
The check for two factor enforcement would return true for non-existing
users. This fix makes it return false in order to be able to perform
the regular login which will then fail and return false.

This prevents throwing PasswordLoginForbidden for non-existing users.
2016-10-25 09:34:27 +02:00
Lukas Reschke 38b3ac8213
Add ContentSecurityPolicyNonceManager
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-10-24 16:35:31 +02:00
Thomas Müller 03ec052b4e
App dependencies are now analysed on app enable as well - not only on app install. 2016-10-24 15:59:46 +02:00
Thomas Müller 0c637c8d73
[9.2] Add missing unit tests (#25936)
* Adjust unit test execution after folder rename

* Adjust login controller tests to match current behavior

* Fix broken unit tests
2016-10-24 14:25:52 +02:00
Lukas Reschke 9e6634814e
Add support for CSP nonces
CSP nonces are a feature available with CSP v2. Basically instead of saying "JS resources from the same domain are ok to be served" we now say "Ressources from everywhere are allowed as long as they add a `nonce` attribute to the script tag with the right nonce.

At the moment the nonce is basically just a `<?php p(base64_encode($_['requesttoken'])) ?>`, we have to decode the requesttoken since `:` is not an allowed value in the nonce. So if somebody does on their own include JS files (instead of using the `addScript` public API, they now must also include that attribute.)

IE does currently not implement CSP v2, thus there is a whitelist included that delivers the new CSP v2 policy to newer browsers. Check http://caniuse.com/#feat=contentsecuritypolicy2 for the current browser support list. An alternative approach would be to just add `'unsafe-inline'` as well as `'unsafe-inline'` is ignored by CSPv2 when a nonce is set. But this would make this security feature unusable at all in IE. Not worth it at the moment IMO.

Implementing this offers the following advantages:

1. **Security:** As we host resources from the same domain by design we don't have to worry about 'self' anymore being in the whitelist
2. **Performance:** We can move oc.js again to inline JS. This makes the loading way quicker as we don't have to load on every load of a new web page a blocking dynamically non-cached JavaScript file.

If you want to toy with CSP see also https://csp-evaluator.withgoogle.com/

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-10-24 12:27:50 +02:00
Roeland Jago Douma ab91fa2660 Merge pull request #1820 from nextcloud/4byte-filenames
Allow 4byte unicode filenames on supported platforms
2016-10-24 10:38:25 +02:00
Roeland Jago Douma 7998689bc9
Added method to DB and fix test
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-24 09:45:04 +02:00
Roeland Jago Douma eaf152efeb
Fix DateTime comparisson
Datetime now returns microseconds. But if the database doesn't store
those comparing them for equality most likely fails.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-21 13:43:39 +02:00
Joas Schilling 0b1fb180a5
Make AppConfig part of the public API
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-10-21 09:09:23 +02:00
Morris Jobke 2799b0a821 Merge pull request #1835 from nextcloud/downstream-24948
Move OC\Files\Storage\Shared to the right namespace
2016-10-20 23:48:15 +02:00
Vincent Petry 9e9fef46d9
Get rid of very old oc:// stream wrapper (#26381) 2016-10-20 20:46:30 +02:00
Morris Jobke c7ba73e6f4 Merge pull request #1824 from nextcloud/downstream-26423
Ensure $commands being an array
2016-10-20 20:43:26 +02:00
Vincent Petry fca8bd44ab
Fix shared storage namespace in DecryptAll class 2016-10-20 20:36:50 +02:00
Joas Schilling 246bb9f33d
Move OC\Files\Storage\Shared to the right namespace 2016-10-20 20:27:44 +02:00
Thomas Müller ef842ef20a
Ensure $commands being an array - fixes #26073 2016-10-20 15:40:27 +02:00
Morris Jobke 7836a8d8c7
use short array syntax
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2016-10-20 15:40:22 +02:00
Joas Schilling 9f2d9895a5
Restore all services when a tests failed/finished for better testcase isolation
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-10-20 15:19:41 +02:00
Joas Schilling 122edcd0c1
Make sure all tests use the TestCase method to overwrite services
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-10-20 15:19:41 +02:00
Arthur Schiwon e5ce61b174
add missing methods to test fake manager
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2016-10-20 14:32:32 +02:00
Arthur Schiwon 5d98ab83e9
resolve displayname via manager and registerable resolvers
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2016-10-19 00:34:00 +02:00
Arthur Schiwon fea3e20a80
move mention extraction to (I)Comment and report mentions via DAV
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2016-10-19 00:33:55 +02:00
Joas Schilling 303e073724
Do not skip when mysql uses utf8mb4
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-10-19 00:15:01 +02:00
Joas Schilling 43b7b143f4
Fix test of repair step
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-10-19 00:15:01 +02:00
Joas Schilling 17a2723948
Fix the test
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-10-19 00:15:01 +02:00
Thomas Müller 9c3f066dab
Adding docker based unit test execution for mysql utf8mb4 2016-10-19 00:15:01 +02:00
Morris Jobke 296a3274cf
only disable unicode test on mysql 2016-10-19 00:15:01 +02:00
Morris Jobke 972e560e72
Adding tests for 4 byte unicode characters
* success on SQLite and Postgres
* failure on MySQL due to the limited charset that only supports up to 3 bytes
2016-10-19 00:15:01 +02:00
Joas Schilling 656e3f7a24
Check the mimetype before reading the content and catch exception
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-10-18 16:22:20 +02:00
Morris Jobke 96f8f209b9 Merge pull request #1449 from nextcloud/comments-user-mention
Notifications for simple @-mentioning in comments
2016-10-17 09:30:47 +02:00
Lukas Reschke 62e19dfa80 Merge pull request #1441 from nextcloud/getby-id-less-queries
optimize Folder::getById to use less queries
2016-10-14 15:18:23 +02:00
Christoph Wurst 53eb0f7f42 Merge pull request #1037 from nextcloud/no-double-token-update
dont update the auth token twice
2016-10-14 14:53:17 +02:00
Arthur Schiwon 1bcd2ca8e3
emit pre-update event for comments
* notifications can be cleaned up, no polluted DB
* updating comments will re-notify users or remove notifications, depending on the message

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2016-10-12 18:06:22 +02:00
Robin Appelman 0d842e0550
optimize Folder::getById to use less queries
Signed-off-by: Robin Appelman <robin@icewind.nl>
2016-10-12 16:12:28 +02:00
Roeland Jago Douma 7eba1d806b
Add tests for commands in info.xml
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-11 19:48:31 +02:00
Thomas Müller c5ca71ee82
[9.2] Register commands in info.xml (#26248)
* Use DI to load console commands from the apps - class name to be defined in the info.xml

* Load commands from info.xml

* Fix unit test

* Allow Di magic for IMountManager

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-11 19:48:26 +02:00
Thomas Müller b1641cc113
Fix QueryBuilderTests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-11 12:30:46 +02:00
Robin Appelman 90db361827
Add test to ensure token times are updated
Signed-off-by: Robin Appelman <robin@icewind.nl>
2016-10-11 11:06:24 +02:00
Robin Appelman 25ed6714c7
dont update the auth token twice
Signed-off-by: Robin Appelman <robin@icewind.nl>
2016-10-11 11:05:25 +02:00
Roeland Jago Douma 3c173378e8
Fix typehint
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-10 22:13:51 +02:00
Thomas Müller 2806a4bca7
Cleanup test case
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-10 22:13:47 +02:00
Christoph Wurst a0cb809342 Merge pull request #1660 from nextcloud/add-notification-icon-to-api
Add an icon to the notification API
2016-10-10 09:32:34 +02:00