\Sabre\DAV\Auth\Backend\AbstractBasic::authenticate was only calling \OC_Connector_Sabre_Auth::validateUserPass when the response of \Sabre\HTTP\BasicAuth::getUserPass was not null.
However, there is a case where the value can be null and the user could be authenticated anyways: The authentication via ownCloud web-interface and then accessing WebDAV resources. This was not possible anymore with this patch because it never reached the code path in this scenario.
This patchs allows authenticating with a session without isDavAuthenticated value stored (this is for ugly WebDAV clients that send the cookie in any case) and thus the functionality should work again.
To test this go to the admin settings and test if the WebDAV check works fine. Furthermore all the usual stuff (WebDAV / Shibboleth / etc...) needs testing as well.
There are a lot of clients that support multiple WebDAV accounts in the same application. However, they resent all the cookies they received from one of the accounts also to the other one. In the case of ownCloud this means that we will always show the user from the session and not the user that is specified in the basic authentication header.
This patch adds a workaround the following way:
1. If the user authenticates via the Sabre Auth Connector add a hint to the session that this was authorized via Basic Auth (this is to prevent logout CSRF)
2. If the request contains this hint and the username specified in the basic auth header differs from the one in the session relogin the user using basic auth
Fixes https://github.com/owncloud/core/issues/11400 and https://github.com/owncloud/core/issues/13245 and probably some other issues as well.
This requires proper testing also considering LDAP / Shibboleth and whatever instances.
When uploading files to an OC ext storage backend or when using server
to server sharing storage, part files aren't needed because the backend
already has its own part files and takes care of the final atomic rename
operation.
This also fixes issues when using two encrypted ownCloud instances where
one mounts the other either as external storage (ownCloud backend) or
through server to server sharing.
I was getting a lot of these in my logs for no apparent reason, and file
uploads were failing:
{"app":"webdav","message":"Sabre\\DAV\\Exception\\ServiceUnavailable: ","level":4,"time":"2015-01-06T15:33:39+00:00"}
In order to debug it, I had to add unique messages to all the places where
this exception was thrown, to identify which one it was, and that made the
logs much more useful:
{"app":"webdav","message":"Sabre\\DAV\\Exception\\ServiceUnavailable: Encryption is disabled","level":4,"time":"2015-01-06T15:36:47+00:00"}
Added oc:tags and oc:favorites in PROPFIND response.
It is possible to update them with PROPPATCH.
These properties are optional which means they need to be requested
explicitly
Convert \OCP\Files\StorageNotAvailableException to
\Sabre\DAV\Exception\ServiceUnavailable for every file/directory
operation happening inside of SabreDAV.
This is necessary to avoid having the exception bubble up to remote.php
which would return an exception page instead of an appropriate response.
When doing a PROPFIND on the root and one of the mount points is not
available, the returned quota attributes will now be zero.
This fix prevents the expected exception to make the whole call fail.
Assume a permission issue whenever a file could not be deleted.
This is because some storages are not able to return permissions, so a
permission denied situation can only be triggered during direct
deletion.
If client does not send content length header on webdav upload (e.g. because the content comes from a stream and its length is not predictable) the put() method should not try to compare the content length value with the actually amount of received data, because this will always fail and results in a BadRequest exception. So the check will only be performed if $_SERVER['CONTENT_LENGTH'] is set.
maintain deprecated \OC::$session when getting or setting the session via the server container or UserSession
restore order os OC::$session and OC::$CLI
remove unneded initialization of dummy session
write back session when $useCustomSession is true
log warning when deprecated app is used
As constants not defined within a class cannot be automatically found by the
autoloader moving those constants into a class makes them accessible to
code which uses them.
Signed-off-by: Stephan Peijnik <speijnik@anexia-it.com>
Whenenver range headers are set and encryption is enabled, it is not
possible to automatically fseek() to the proper position.
To avoid returning corrupt/invalid data or causing a decryption error,
the range headers are stripped so that the SabreDAV code in httpGet()
returns the whole file.
- Reuse these methods on determineIcon()
- Generate permission string for the desktop client
- expose {http://owncloud.org/ns}permissions as additional WebDAV property containing the permission string
Negative timestamps were returned as string and were confusing other
Sabre API like Sabre_DAV_Property_GetLastModified.
This fix makes sure the timestamp is returned as int when defined.
- fixed free space detection based on the already uploaded chunks
- now deleting chunks as soon as it is read out before writing it into
the part file, which reduces the space needed when assembling part
files
- added file name check for the put, rename and setNames() methods which
throw a "Bad Request" whenever invalid characters are used
- replaced \OC\Filesystem usage with $this->getFS() to be able to write
unit tests
Whenever an exception occurs in the sabre connector code or code called
by it, it will be logged.
This plugin approach is needed because Sabre already catches exceptions
to return them to the client in the XML response, so they don't appear
logged in the web server log.
This will make it much easier to debug syncing issues.
When mounting an ownCloud (backend OC) inside another ownCloud (frontend
OC), the frontend OC will use WebDAV to upload file, which will create
part files. These part files need to be accessible for the frontend OC
to rename them to the actual file name.
This fix leaves the file cache untouched but gives direct access to part
file info when requested.
This means that part file can be accessed only when their path and name
are known. These won't appear in file listtings.
Fixes#6068
This fixes the issue introduced by the transfer id which itself wasn't
taken into account by the shortcut code for part file in the shared
storage class.
Vincent Petry
Robin Appelman
Thomas Müller
Lukas Reschke
Chris Wilson
derkostka
Morris Jobke
Joas Schilling
Bjoern Schiessle
libasys
scolebrook
chli1
Clark Tomlinson
Jörn Friedrich Dreyer
Stephan Peijnik
icewind1991
Markus Goetz
ringmaster
Lukas Reschke
Andreas Fischer
Robin McCorkell
Bart Visscher
Thomas Tanghus
Scrutinizer Auto-Fixer