Commit Graph

132 Commits

Author SHA1 Message Date
Lukas Reschke 52add798d4 Do not automatically try to enable index.php-less URLs (#24539)
The current logic for mod_rewrite relies on the fact that people have properly configured ownCloud, basically it reads from the `overwrite.cli.ur
l` entry and then derives the `RewriteBase` from it.

This usually works. However, since the ownCloud packages seem to install themselves at `/owncloud` (because subfolders are cool or so…) _a lot_ of people have just created a new Virtual Host for it or have simply symlinked the path etc.

This means that `overwrite.cli.url` is wrong, which fails hard if it is used as RewriteBase since Apache does not know where it should serve files from. In the end the ownCloud instance will not be accessible anymore and users will be frustrated. Also some shared hosters like 1&1 (because using shared hosters is so awesome… ;-)) have somewhat dubious Apache configurations or use versions of mod_rewrite from the mediveal age. (because updating is money or so…)

Anyhow. This makes this explicitly an opt-in configuration flag. If `htaccess.RewriteBase` is set then it will configure index.php-less URLs, if
admins set that after installation and don't want to wait until the next ownCloud version they can run `occ maintenance:update:htaccess`.

For ownCloud 9.0 we also have to add a repair step to make sure that instances that already have a RewriteBase configured continue to use it by copying it into the config file. That way all existing URLs stay valid. That one is not in this PR since this is unneccessary in master.

Effectively this reduces another risk of breakage when updating from ownCloud 8 to ownCloud 9.

Fixes https://github.com/owncloud/core/issues/24525, https://github.com/owncloud/core/issues/24426 and probably some more.
2016-05-12 09:43:26 +02:00
Thomas Müller 9c9fec36dd
Add occ commands to enable and disable a user + a disabled user can no longer login - fixes #23838 2016-05-02 09:31:22 +02:00
Thomas Müller cdcd49b473
Adding progress to occ maintenance:repair 2016-04-28 13:52:01 +02:00
Thomas Müller d0030aad6c
Remove deprecated HTTPHelper from InfoParser 2016-04-22 08:38:41 +02:00
Roeland Jago Douma a2c8597b00
Add occ command for updating the data-fingerprint 2016-04-18 16:08:19 +02:00
Lukas Reschke 933f60e314 Update author information
Probably nice for the people that contributed to 9.0 to see themselves in the AUTHORS file :)
2016-03-01 17:25:15 +01:00
Victor Dubiniuk fef7fc1248 CLI commands to check app and core signatures 2016-02-05 21:10:22 +03:00
Lukas Reschke ea367b598a Use path instead of app id
This change requires the usage of a path instead of the App ID when signing code. This has the advantage that developers can also sign code under a different location to make it easier. (e.g. remove `.git`, …)

Also it adds an example command usage as well as a link to the documentation
2016-01-20 20:38:18 +01:00
Joas Schilling 56184f799e Make it possible to enable apps for groups only via occ 2016-01-19 14:29:12 +01:00
Joas Schilling 78a02d1b2f Make it possible to disable apps via the console, which are not enabled for the current user 2016-01-19 14:29:01 +01:00
Joas Schilling d2285113a8 Make sure to list "group enabled" apps as enabled
also when they are not enabled for the current user
2016-01-19 14:29:01 +01:00
Robin Appelman c67a09112b Add occ commands to manager trusted certificates 2016-01-13 14:35:37 +01:00
Thomas Müller 682821c71e Happy new year! 2016-01-12 15:02:18 +01:00
Victor Dubiniuk b59285d0d0 Add occ command to get app path 2015-12-09 11:22:13 +01:00
Lukas Reschke 4971015544 Add code integrity check
This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository.

Furthermore, there is a basic implementation to display problems with the code integrity on the update screen.

Code signing basically happens the following way:

- There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release 😉). This certificate is not intended to be used for signing directly and only is used to sign new certificates.
- Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`,  apps need to be signed with a certificate that either has a CN of `core` (shipped apps!)  or the AppID.
- The command generates a signature.json file of the following format:
```json
{
    "hashes": {
        "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d",
        "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9"
    },
    "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----",
    "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl"
}
```
`hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the  certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`.

Steps to do in other PRs, this is already a quite huge one:
- Add nag screen in case the code check fails to ensure that administrators are aware of this.
- Add code verification also to OCC upgrade and unify display code more.
- Add enforced code verification to apps shipped from the appstore with a level of "official"
- Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release
- Add some developer documentation on how devs can request their own certificate
- Check when installing ownCloud
- Add support for CRLs to allow revoking certificates

**Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature:

```
➜  master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt
Successfully signed "core"
```

Then increase the version and you should see something like the following:

![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png)

As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen.

For packaging stable releases this requires the following additional steps as a last action before zipping:
1. Run `./occ integrity:sign-core` once
2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.
2015-12-01 11:55:20 +01:00
Thomas Müller 4cb5970947 Always pass in ILogger 2015-10-09 14:08:22 +02:00
Morris Jobke 8366ce2767 deduplicate @xenopathic 2015-10-06 09:52:19 +02:00
Morris Jobke b945d71384 update licence headers via script 2015-10-05 21:15:52 +02:00
Morris Jobke 9b652ed5d5 [App Code Check] add check for version and mandatory fields
* ref #17598
* including unit tests for mandatory fields/versions
2015-09-24 11:58:12 +02:00
Bjoern Schiessle 9bd4f2d41e occ script to disable encryption and to decrypt all files again 2015-09-15 22:39:44 +02:00
Robin McCorkell 19830e6c24 Introduce mimetype DB update occ command 2015-09-04 17:37:09 +01:00
Robin McCorkell 79fceeff33 Move maintenance:mimetypesjs to sublocation, cleanup code 2015-09-01 14:12:07 +01:00
Bjoern Schiessle 289e9130f3 make system root of key storage configurable 2015-08-30 19:00:03 +02:00
Björn Schießle 6e210d960c Merge pull request #18423 from owncloud/occ_encrypt_all
occ command line tool to encrypt all files
2015-08-28 20:44:55 +02:00
Bjoern Schiessle 8c08dd0ac2 occ tool to encrypt all files 2015-08-26 14:58:22 +02:00
Robin McCorkell 07e119a3f8 Introduce occ command to manage owncloud log backend
log:owncloud can set/display the log filename and log file rotation size
2015-08-19 12:55:27 +01:00
Robin McCorkell 67536e71aa Introduce occ command for logging management
log:manage can set/display the log backend, log level and log timezone
2015-08-19 12:33:23 +01:00
Morris Jobke 08afce3d7e [command] single user mode - use config object & add tests 2015-07-09 18:33:46 +02:00
Joas Schilling 2b86eb0b29 Add commands to get, set and delete app config values 2015-07-07 11:18:25 +02:00
Joas Schilling 86952f88cb Add a command to import an json array into the config 2015-07-07 11:18:25 +02:00
Joas Schilling bc084c40a6 Add a command to delete a system config 2015-07-07 11:18:25 +02:00
Joas Schilling 3608c1007e Add a command to get a config value 2015-07-07 11:18:25 +02:00
Joas Schilling a83eac3762 Add a command to set a system config value 2015-07-07 11:18:25 +02:00
Joas Schilling 6763637773 Add a command to list existing configs 2015-07-07 11:18:24 +02:00
Joas Schilling 6d4cb1b480 Sort registration of commands alphabetically 2015-07-07 11:18:21 +02:00
Roeland Jago Douma c8145cdbd6 Javascript mimetype icon resolver
This makes it possible to retrieve the icon for mimetypes in javascript.
It makes no additional queries to the server to retrieve the mimetype.

* config/mimetypealiases.json added
* mimetype.js: this is where the logic resides to convert from mimetype
  to icon url
* mimetypelist.js: generated file with a list of mimetype mapping (aliases)
  and the list of icon files
* ./occ maintenance:mimetypesjs : new command for occ to gernerate
  mimetypes.js
* unit tests updated and still work
* javascript tests added
* theming support
* folder of the theme is now present in javascript (OC.theme.folder)
2015-07-06 16:32:10 +02:00
Morris Jobke f63915d0c8 update license headers and authors 2015-06-25 14:13:49 +02:00
Thomas Müller 2344298954 Merge pull request #16035 from owncloud/issue-15975-occ-encryption-enable-warning-no-module
Display a message when there is a problem with the default module
2015-05-07 12:03:30 +02:00
Joas Schilling 5180c2398d Add an occ command to get the status of encryption 2015-05-04 15:31:19 +02:00
Joas Schilling 10144bd7f5 Display a message when there is a problem with the default module 2015-05-04 12:36:50 +02:00
Joas Schilling f6d4bdb1fd Add occ commands to manage the encryption modules 2015-04-27 11:03:50 +02:00
Joas Schilling eec92a16d6 Unify the output of the user commands and use DI 2015-04-23 12:40:13 +02:00
Thomas Müller f099c9883e Adding check command to validate server environment - fixes #15429 2015-04-08 00:19:23 +02:00
Robin McCorkell cbbff87d0c Allow app:check-code and l10n:createjs commands when not installed 2015-04-01 13:18:56 +01:00
Jenkins for ownCloud b585d87d9d Update license headers 2015-03-26 11:44:36 +01:00
Joas Schilling b1ff21ee28 Add a console command user:add to create users over the console 2015-03-11 14:22:23 +01:00
Christian Kampka 83e0f84fef Allow configuring background job mode from the console 2015-03-02 20:51:40 +01:00
Morris Jobke 06aef4e8b1 Revert "Updating license headers"
This reverts commit 6a1a4880f0.
2015-02-26 11:37:37 +01:00
Thomas Müller bcd10d3dc5 implement command maintenance:install 2015-02-23 16:47:47 +01:00
Jenkins for ownCloud 6a1a4880f0 Updating license headers 2015-02-23 12:13:59 +01:00
Thomas Müller d74662df7d implement php code checker to detect usage of not allowed private APIs - including console command to check local code to be used by developers 2015-02-10 11:51:24 +01:00
Arthur Schiwon ae9c9a46b8 inject and use user manager to delete command instead of using old static oc_user way 2015-01-07 12:21:28 +01:00
Arthur Schiwon 4fa39250e7 LDAP User Cleanup: Port from stable7 without further adjustements
LDAP User Cleanup

background job for user clean up

adjust user backend for clean up

register background job

remove dead code

dependency injection

make Helper non-static for proper testing

check whether it is OK to run clean up job. Do not forget to pass arguments.

use correct method to get the config from server

methods can be private, proper indirect testing is given

no automatic user deletion

make limit readable for test purposes

make method less complex

add first tests

let preferences accept limit and offset for getUsersForValue

DI via constructor does not work for background jobs

after detecting, now we have retrieving deleted users and their details

we need this method to be public for now

finalize export method, add missing getter

clean up namespaces and get rid of unnecessary files

helper is not static anymore

cleanup according to scrutinizer

add cli tool to show deleted users

uses are necessary after recent namespace change

also remove user from mappings table on deletion

add occ command to delete users

fix use statement

improve output

big fixes / improvements

PHP doc

return true in userExists early for cleaning up deleted users

bump version

control state and interval with one config.php setting, now ldapUserCleanupInterval. 0 will disable it. enabled by default.

improve doc

rename cli method to be consistent with  others

introduce ldapUserCleanupInterval in sample config

don't show last login as unix epoche start when no  login happend

less log output

consistent namespace for OfflineUser

rename GarbageCollector to DeletedUsersIndex and move it to user subdir

fix unit tests

add tests for deleteUser

more test adjustements

Conflicts:
	apps/user_ldap/ajax/clearMappings.php
	apps/user_ldap/appinfo/app.php
	apps/user_ldap/lib/access.php
	apps/user_ldap/lib/helper.php
	apps/user_ldap/tests/helper.php
	core/register_command.php
	lib/private/preferences.php
	lib/private/user.php

add ldap:check-user to check user existance on the fly

Conflicts:
	apps/user_ldap/lib/helper.php

forgotten file

PHPdoc fixes, no code change

and don't forget to adjust tests
2014-12-19 19:47:54 +01:00
Morris Jobke 8ae8eb4734 drop dependency of some commands on old config object 2014-11-20 15:03:16 +01:00
Thomas Müller 2f19de11e4 adding console command to generate javascript translation files based on existing php translation files
read server side translations from json files
2014-10-29 10:09:12 +01:00
Thomas Müller a348a6f450 no loner use deprecated class \OC_Config 2014-09-22 12:04:48 +02:00
Vincent Petry ca690c4d02 Added RepairStep interface and default repair step lists
The updater is using "before update" repair steps and "regular" repair
steps.
The "regular" repair steps are also used by the CLI tool.

Currently no steps exist but can be added later in the static methods in
the \OC\Repair class.

Added unit test to test messaging, error and exception cases.
2014-06-12 17:38:26 +02:00
Andreas Fischer 9fba8221a6 Merge pull request #8554 from owncloud/add_resetadminpass_command
Add a resetadminpass command to console

* owncloud/add_resetadminpass_command:
  Move resetpassword into user: command space.
  Document type of user project.
  Receive \OC\User\Manager as a constructor dependency.
  Use userManager, color output, return 1 on error
  Add doc, check return-value, fix spacing, require interactive
  Back to the future
  Make ResetAdminPass to ResetPassword
  Add a resetadminpass command to console - fix #8248
2014-05-29 14:43:27 +02:00
Andreas Fischer 678a6b98ff Merge pull request #8748 from owncloud/cli_maintenance_mode
Add ability to enable/disable maintenance mode from cli.

* owncloud/cli_maintenance_mode:
  Use OC\Config instead of OC_Config
  Changed class name to mode
  Add ability to enable/disable maintenance mode from cli.
2014-05-29 03:45:49 +02:00
Andreas Fischer 5754b0b9e7 Merge remote-tracking branch 'owncloud/master' into add_resetadminpass_command
* owncloud/master: (238 commits)
  Change visibility of scanner internals
  [tx-robot] updated from transifex
  remove legacy OC_Filesystem being used in a hook callback
  add title property to share dialog
  forgotten infobox messages translations
  reverts 188c543 and translates only mail
  fix warning text and margin
  Adjust core apps to use "requiremin" instead of "require"
  Added requiremin/requiremax fields for apps
  [tx-robot] updated from transifex
  unwrapped strings fix
  allow resharing of files with only share permissions
  don't lose file size during rename
  drop superflous statement in phpdoc
  add preRememberedLogin hook and document this and postRememberedLogin in class descripttion. Also fixes documentation of postLogin hook
  [tx-robot] updated from transifex
  fix grammar
  make user_ldap fully translatable
  [tx-robot] updated from transifex
  fix typo
  ...

Conflicts:
	core/register_command.php
2014-05-28 22:57:33 +02:00
Andreas Fischer f81ee94cad Move resetpassword into user: command space. 2014-05-28 22:53:44 +02:00
Andreas Fischer 52e7bf9630 Receive \OC\User\Manager as a constructor dependency. 2014-05-28 22:42:33 +02:00
scolebrook 43759f1f46 Use OC\Config instead of OC_Config 2014-05-28 16:26:13 -04:00
scolebrook 00f811f09c Changed class name to mode 2014-05-28 09:41:34 -04:00
scolebrook 7151369e5f Add ability to enable/disable maintenance mode from cli. 2014-05-27 13:03:53 -04:00
Arthur Schiwon 09bb8e0e3a add cli command to check a users last login 2014-05-23 10:37:34 +02:00
kondou e5e77b370a Make ResetAdminPass to ResetPassword 2014-05-12 16:10:59 +02:00
kondou 011bd0a1c4 Add a resetadminpass command to console - fix #8248 2014-05-12 15:33:26 +02:00
Andreas Fischer f9853b253c Deduplicate connection handling code into \OC\DB\ConnectionFactory 2014-03-31 20:09:07 +02:00
Bart Visscher 3abcd13979 Allow converting from any db type 2014-02-11 18:01:41 +01:00
Bart Visscher b57299f727 Merge branch 'master' into db-convert-tool
Conflicts:
	3rdparty
2014-01-30 18:16:55 +01:00
Arthur Schiwon bc1235d325 Add command line tool to show numbers of users and user directories 2014-01-07 23:06:37 +01:00
Bart Visscher 202e26647e Inject config object 2013-12-24 13:36:32 +01:00
Bart Visscher e4c31b362e Add command for converting sqlite database to server based one 2013-12-07 14:44:23 +01:00
Robin Appelman 10d84f6e9b Add a (currently) empty system for running common repair steps 2013-11-26 14:12:48 +01:00
Robin Appelman 9fbccc83e3 merge master into single-user-mode 2013-11-25 21:25:04 +01:00
Robin Appelman abe63bd329 Add occ command to list all apps 2013-11-25 17:34:16 +01:00
Robin Appelman a324c09e6c Add occ command to enable and disable single user mode 2013-11-25 15:27:05 +01:00
Robin Appelman d3bfb433d1 add occ commands for enabling and disabling apps 2013-11-25 13:20:16 +01:00
ringmaster 29a21466f3 Add `occ upgrade` command. 2013-10-24 13:59:39 -04:00
Thomas Müller 6e1881dbe4 new console command to generate sql migration scripts 2013-10-17 12:51:30 +02:00
Bart Visscher 666bbbe060 Use appinfo/register_command.php to add commands to the console command 2013-09-13 18:10:04 +02:00