e6b52ef4cd
Merge pull request #1347 from nextcloud/bring-back-remember-me
...
fix remember me login
2016-11-02 18:32:38 +01:00
e81d04cd8d
Merge pull request #1940 from nextcloud/new-appstore
...
Use new appstore API
2016-11-02 17:00:24 +00:00
9d6e01ef40
Add missing tests and fix PHPDoc
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-11-02 13:39:17 +01:00
6f86e468d4
inject ISecureRandom into user session and use injected config too
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2016-11-02 13:39:16 +01:00
d907666232
bring back remember-me
...
* try to reuse the old session token for remember me login
* decrypt/encrypt token password and set the session id accordingly
* create remember-me cookies only if checkbox is checked and 2fa solved
* adjust db token cleanup to store remembered tokens longer
* adjust unit tests
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2016-11-02 13:39:16 +01:00
370123b8b0
Merge pull request #1966 from nextcloud/fix-csrf-token-generation
...
Fix CSRF token generation / validation
2016-11-02 12:09:30 +01:00
e5d78a3523
Fix CSRF token generation / validation
...
Operate on raw bytes instead of base64-encoded strings.
Issue was introduced in a977465
2016-11-02 10:38:05 +01:00
318160647a
add method to check if a share provider for a given type is loaded
...
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2016-11-01 19:54:39 +01:00
7e2159e9bb
Add defaultShareProvider & federatedshareprovider tests
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-01 13:52:37 +01:00
d2110ebb0b
Add Manager unit tests
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-01 12:35:50 +01:00
0eeef26a8e
Add tests for installer method
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-10-31 19:39:35 +01:00
a68595742b
Proxy images through usercontent.apps.nextcloud.com
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-10-31 17:17:47 +01:00
8acb54aa0b
Add update support
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-10-31 17:17:47 +01:00
89fc4358ba
Use substr and explode instead of a regex
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-10-31 17:17:45 +01:00
8d83e239f3
Fix tests
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-10-31 17:17:45 +01:00
32cf661215
Use new appstore API
...
This change introduces the new appstore API in Nextcloud.
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-10-31 17:17:44 +01:00
3692769b0a
Add getShareTypesInFolder to optimize folder listening
...
Signed-off-by: Robin Appelman <icewind@owncloud.com>
2016-10-31 15:55:40 +01:00
83e7cfd13a
Fix more tests
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-28 22:16:28 +02:00
f722640a32
Proper DI of config
...
* Fixed comments
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-28 10:13:35 +02:00
f8352fcb8d
introduce callForSeenUsers and countSeenUsers ( #26361 )
...
* introduce callForSeenUsers and countSeenUsers
* add tests
* oracle should support not null on clob
* since 9.2.0
2016-10-28 08:44:05 +02:00
d4969abc9d
Merge pull request #1800 from nextcloud/nextcloud-rich-object-strings
...
Nextcloud rich object strings
2016-10-27 15:30:58 +02:00
b7046d390f
Remove internal share mail function
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-26 20:52:41 +02:00
b98dfaccd9
Merge pull request #1920 from nextcloud/legacy-pages-should-also-receive-the-nonce
...
Add nonce also to legacy CSP
2016-10-26 16:41:34 +02:00
cde7f535bd
Merge pull request #1738 from nextcloud/comments-provide-displaynames-with-mentions
...
comment mentions: show displayname not uid
2016-10-26 14:02:49 +02:00
c20ab0049f
Identify Chromium as Chrome
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-10-26 12:07:10 +02:00
e351ba56f1
Move browserSupportsCspV3 to CSPNonceManager
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-25 22:03:10 +02:00
097a9ec8b0
Merge pull request #1878 from nextcloud/downstream-25936
...
Adjust unit tests to upstream
2016-10-25 17:59:01 +02:00
89574367bc
Merge pull request #1871 from nextcloud/use-csp-nonces
...
Use CSP nonces
2016-10-25 14:46:00 +02:00
740ff9108b
Merge pull request #1884 from nextcloud/downstream-26292
...
Fix logClientIn for non-existing users (#26292 )
2016-10-25 11:24:13 +02:00
890f752a6b
Merge pull request #1452 from nextcloud/appconfig-endpoint
...
Appconfig endpoint
2016-10-25 10:57:48 +02:00
593d52fe91
Fix and cleanup SessionTest
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-25 09:34:27 +02:00
6d1e858aa4
Fix logClientIn for non-existing users ( #26292 )
...
The check for two factor enforcement would return true for non-existing
users. This fix makes it return false in order to be able to perform
the regular login which will then fail and return false.
This prevents throwing PasswordLoginForbidden for non-existing users.
2016-10-25 09:34:27 +02:00
38b3ac8213
Add ContentSecurityPolicyNonceManager
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-10-24 16:35:31 +02:00
03ec052b4e
App dependencies are now analysed on app enable as well - not only on app install.
2016-10-24 15:59:46 +02:00
0c637c8d73
[9.2] Add missing unit tests ( #25936 )
...
* Adjust unit test execution after folder rename
* Adjust login controller tests to match current behavior
* Fix broken unit tests
2016-10-24 14:25:52 +02:00
9e6634814e
Add support for CSP nonces
...
CSP nonces are a feature available with CSP v2. Basically instead of saying "JS resources from the same domain are ok to be served" we now say "Ressources from everywhere are allowed as long as they add a `nonce` attribute to the script tag with the right nonce.
At the moment the nonce is basically just a `<?php p(base64_encode($_['requesttoken'])) ?>`, we have to decode the requesttoken since `:` is not an allowed value in the nonce. So if somebody does on their own include JS files (instead of using the `addScript` public API, they now must also include that attribute.)
IE does currently not implement CSP v2, thus there is a whitelist included that delivers the new CSP v2 policy to newer browsers. Check http://caniuse.com/#feat=contentsecuritypolicy2 for the current browser support list. An alternative approach would be to just add `'unsafe-inline'` as well as `'unsafe-inline'` is ignored by CSPv2 when a nonce is set. But this would make this security feature unusable at all in IE. Not worth it at the moment IMO.
Implementing this offers the following advantages:
1. **Security:** As we host resources from the same domain by design we don't have to worry about 'self' anymore being in the whitelist
2. **Performance:** We can move oc.js again to inline JS. This makes the loading way quicker as we don't have to load on every load of a new web page a blocking dynamically non-cached JavaScript file.
If you want to toy with CSP see also https://csp-evaluator.withgoogle.com/
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-10-24 12:27:50 +02:00
ab91fa2660
Merge pull request #1820 from nextcloud/4byte-filenames
...
Allow 4byte unicode filenames on supported platforms
2016-10-24 10:38:25 +02:00
7998689bc9
Added method to DB and fix test
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-24 09:45:04 +02:00
eaf152efeb
Fix DateTime comparisson
...
Datetime now returns microseconds. But if the database doesn't store
those comparing them for equality most likely fails.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-21 13:43:39 +02:00
0b1fb180a5
Make AppConfig part of the public API
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-10-21 09:09:23 +02:00
2799b0a821
Merge pull request #1835 from nextcloud/downstream-24948
...
Move OC\Files\Storage\Shared to the right namespace
2016-10-20 23:48:15 +02:00
9e9fef46d9
Get rid of very old oc:// stream wrapper ( #26381 )
2016-10-20 20:46:30 +02:00
c7ba73e6f4
Merge pull request #1824 from nextcloud/downstream-26423
...
Ensure $commands being an array
2016-10-20 20:43:26 +02:00
fca8bd44ab
Fix shared storage namespace in DecryptAll class
2016-10-20 20:36:50 +02:00
246bb9f33d
Move OC\Files\Storage\Shared to the right namespace
2016-10-20 20:27:44 +02:00
ef842ef20a
Ensure $commands being an array - fixes #26073
2016-10-20 15:40:27 +02:00
7836a8d8c7
use short array syntax
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2016-10-20 15:40:22 +02:00
9f2d9895a5
Restore all services when a tests failed/finished for better testcase isolation
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-10-20 15:19:41 +02:00
122edcd0c1
Make sure all tests use the TestCase method to overwrite services
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-10-20 15:19:41 +02:00
e5ce61b174
add missing methods to test fake manager
...
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2016-10-20 14:32:32 +02:00
Morris Jobke
Michael Grosser
Lukas Reschke
Christoph Wurst
Roeland Jago Douma
Leon Klingele
Bjoern Schiessle
Roeland Jago Douma
Robin Appelman
Jörn Friedrich Dreyer
Joas Schilling
Vincent Petry
Thomas Müller
Thomas Müller
Joas Schilling
Arthur Schiwon