ba7d221cff
allow getting the path from the lockedexception
2015-04-30 14:48:42 +02:00
8119b8b040
add tests for castrait
2015-04-30 14:48:39 +02:00
96f9573a4b
add memcache based shared/exclusive locking
2015-04-30 14:48:39 +02:00
acf30ede95
add compare and swap to memcache
2015-04-30 14:48:39 +02:00
29213b6136
extends memcache with add, inc and dec
2015-04-30 14:48:36 +02:00
cf4a6874fb
Allow setting protected properties
2015-04-30 12:04:02 +02:00
09d479e79d
Add a test to share a subfolder of a folder shared with the owner by group
2015-04-29 13:33:20 +02:00
8c7db2536d
Merge pull request #15596 from owncloud/issue/15589
...
Correctly generate the feedback URL for remote share
2015-04-29 10:52:43 +02:00
7df7a3b360
Merge pull request #15906 from rullzer/fix_15777
...
Password set via OCS API should not be double escaped
2015-04-29 10:44:25 +02:00
34d0e610cc
Filter potential dangerous filenames for avatars
...
We don't want to have users misusing this API resulting in a potential file disclosure of "avatar.(jpg|png)" files.
2015-04-28 16:57:23 +02:00
b55ef51a27
Add tests for the correct share id on the call aswell
2015-04-28 14:56:13 +02:00
02269b6464
Added unit test
2015-04-28 14:00:36 +02:00
02c60949dd
make scrutinizer happy
2015-04-28 11:28:54 +02:00
d146c13abd
Add tests for the remote sharing url
2015-04-28 11:28:54 +02:00
de8c15e1a4
Merge pull request #14764 from owncloud/shared-etag-propagate
...
Propagate etags across shared storages
2015-04-28 10:58:50 +02:00
7d0eba7a41
Merge pull request #15886 from owncloud/fix-15848-master
...
Adjust isLocal() on encryption wrapper
2015-04-27 15:06:26 +02:00
678b7d7e4d
Merge pull request #15860 from owncloud/enc_fallback_old_encryption
...
[encryption] handle encrypted files correctly which where encrypted with a old version of ownCloud (<=oc6)
2015-04-27 14:32:19 +02:00
936d564058
fixes #15848
2015-04-27 14:26:05 +02:00
6bf0579622
fix test
2015-04-27 14:07:16 +02:00
be55a90323
dont use our now non existing hook
2015-04-27 14:07:15 +02:00
27683f9442
fall back to the ownCloud default encryption module and aes128 if we read a encrypted file without a header
2015-04-27 13:01:18 +02:00
8f61fbb81f
Fix new tests
2015-04-27 11:10:31 +02:00
d600955a51
Make getDefaultModuleId public and get module protected
2015-04-27 11:03:51 +02:00
4e97228cde
Deduplicate module mock
2015-04-27 11:03:51 +02:00
4b7ae395f2
Add test for setDefaultEncryptionModule
2015-04-27 11:03:51 +02:00
b35379515c
Add a test that the default module is returned before we fall back
2015-04-27 11:03:50 +02:00
4dfdaf741c
Merge pull request #15834 from owncloud/make-temporary-file-really-unique
...
Fix collision on temporary files + adjust permissions
2015-04-25 23:18:26 +02:00
b9df932e3c
Merge pull request #15683 from owncloud/block-legacy-clients
...
Block old legacy clients
2015-04-24 18:21:10 +02:00
9a5783b284
fix unit tests
2015-04-24 16:47:27 +02:00
4554df2512
enable testWriteWriteRead
2015-04-24 16:44:00 +02:00
18a1225b0c
enable testRewind
2015-04-24 16:44:00 +02:00
27ea23ea6b
Update encryption.php
2015-04-24 16:44:00 +02:00
d6841aa706
disable r+ test
2015-04-24 16:44:00 +02:00
7a34f75da6
add two tests
...
testRewind tests reading and writing after rewind on an encrypted stream; testWriteWriteRead tests r+ mode
2015-04-24 16:44:00 +02:00
4334e77035
Merge pull request #15839 from owncloud/enc_fix_moving_shared_files
...
[encryption] fix moving files to a shared folder
2015-04-24 15:07:36 +02:00
411f7893bf
Add test "operation on keys failed"
2015-04-24 14:27:23 +02:00
781cfff221
Deduplicate data provider and fix method visibility
2015-04-24 13:12:45 +02:00
24128d1384
only update share keys if the file was encrypted
2015-04-24 10:19:09 +02:00
2646bccb83
update share keys if file gets copied
2015-04-23 17:18:48 +02:00
2990b0e07e
update share keys if a file is moved to a shared folder
2015-04-23 17:18:48 +02:00
ab9ea97d3a
Catch not existing User-Agent header
...
In case of an not sent UA header consider the client as valid
2015-04-23 16:33:51 +02:00
155ae44bc6
Fix collision on temporary files + adjust permissions
...
This changeset hardens the temporary file and directory creation to address multiple problems that may lead to exposure of files to other users, data loss or other unexpected behaviour that is impossible to debug.
**[CWE-668: Exposure of Resource to Wrong Sphere](https://cwe.mitre.org/data/definitions/668.html )**
The temporary file and folder handling as implemented in ownCloud is performed using a MD5 hash over `time()` concatenated with `rand()`. This is insufficiently and leads to the following security problems:
The generated filename could already be used by another user. It is not verified whether the file is already used and thus temporary files might be used for another user as well resulting in all possible stuff such as "user has file of other user".
Effectively this leaves us with:
1. A timestamp based on seconds (no entropy at all)
2. `rand()` which returns usually a number between 0 and 2,147,483,647
Considering the birthday paradox and that we use this method quite often (especially when handling external storage) this is quite error prone and needs to get addressed.
This behaviour has been fixed by using `tempnam` instead for single temporary files. For creating temporary directories an additional postfix will be appended, the solution is for directories still not absolutely bulletproof but the best I can think about at the moment. Improvement suggestions are welcome.
**[CWE-378: Creation of Temporary File With Insecure Permissions](https://cwe.mitre.org/data/definitions/378.html )**
Files were created using `touch()` which defaults to a permission of 0644. Thus other users on the machine may read potentially sensitive information as `/tmp/` is world-readable. However, ownCloud always encourages users to use a dedicated machine to run the ownCloud instance and thus this is no a high severe issue. Permissions have been adjusted to 0600.
**[CWE-379: Creation of Temporary File in Directory with Incorrect Permissions](https://cwe.mitre.org/data/definitions/379.html )**
Files were created using `mkdir()` which defaults to a permission of 0777. Thus other users on the machine may read potentially sensitive information as `/tmp/` is world-readable. However, ownCloud always encourages users to use a dedicated machine to run the ownCloud instance and thus this is no a high severe issue. Permissions have been adjusted to 0700.Please enter the commit message for your changes.
2015-04-23 15:07:54 +02:00
b88d0ba0ac
Delete temp files after testing encryption stream wrapper
2015-04-23 13:42:18 +02:00
ed0b465cf9
Use 403 instead a 50x response
2015-04-20 12:53:40 +02:00
4ea205e262
Block old legacy clients
...
This Pull Request introduces a SabreDAV plugin that will block all older clients than 1.6.1 to connect and sync with the ownCloud instance.
This has multiple reasons:
1. Old ownCloud client versions before 1.6.0 are not properly working with sticky cookies for load balancers and thus generating sessions en masse
2. Old ownCloud client versions tend to be horrible buggy
In some cases we had in 80minutes about 10'000 sessions created by a single user. While this change set does not really "fix" the problem as 3rdparty legacy clients are affected as well, it is a good work-around and hopefully should force users to update their client
2015-04-20 11:12:17 +02:00
8f51efc49e
get rid of OC_Geo
2015-04-19 20:16:56 +02:00
758b2332f0
Use data provider instead of hand-crafted for loops
...
* reduces scrutinizer complains
* uses PHPUnit functionality
2015-04-18 15:19:33 +02:00
7d4b1b52d0
always create a new instance of the encryption module
2015-04-17 10:31:33 +02:00
b25c06f576
detect system wide mount points correctly
2015-04-16 14:15:04 +02:00
e3d77c4b01
add migration script from old encryption to new one
2015-04-16 14:15:04 +02:00
903d52d45f
Merge pull request #15809 from owncloud/view-null-root
...
dont allow using null as view root
2015-04-22 18:10:26 +02:00
e302213248
add unit tests for null handling in view
2015-04-22 16:24:25 +02:00
225cde2183
pass KeyStorage via ctor
2015-04-22 13:09:42 +02:00
987bc138df
calling renameKeys() on directory level as well - fixes #15778
2015-04-22 12:12:27 +02:00
fc4127dd62
add $encryptionModuleId to methods of Keys/IStorage
2015-04-22 11:53:05 +02:00
570718fb6b
Merge pull request #15757 from owncloud/enc-fixfeofforlastblock
...
Fix encryption feof to not return too early
2015-04-22 11:32:21 +02:00
19e8c4fcb1
get dirname from sharePath
2015-04-21 14:58:01 +02:00
76dad297ff
Fix encryption feof to not return too early
...
This is because stream_read will pre-cache the next block which causes
feof($this->source) to return true prematurely. So we cannot rely on it.
Fixed encryption stream wrapper unit tests to actually simulate 6k/8k
blocks to make sure we cover the matching logic.
Added two data files with 8192 and 8193 bytes.
2015-04-20 18:32:40 +02:00
fe2cbc3795
Merge pull request #15744 from owncloud/fix-inverted-path-in-resourcenotfound
...
Fix wrong path generation
2015-04-20 16:55:36 +02:00
9bc48451b9
Adjust tests and statuscode
2015-04-20 13:00:02 +02:00
21f0476d31
Fix files
2015-04-20 13:00:02 +02:00
9f61cf60d4
Verify if returned object is an array
...
The error has to be thrown at this point as otherwise errors and notices are thrown since the time cannot be parsed in L60 and L61
2015-04-20 12:58:57 +02:00
ddcd79132d
Add tests for correct path
2015-04-20 12:31:35 +02:00
0cf13e9b78
Fix phpStorm complains and namespace
2015-04-20 12:31:07 +02:00
e33e5b425a
Merge pull request #12006 from owncloud/dav-put-storage
...
Work directly on the storage when uploading over webdav
2015-04-15 03:08:52 +02:00
1aa368effe
Merge pull request #15592 from owncloud/fix-15590-master
...
Avoid php message "Invalid argument supplied for foreach()"
2015-04-15 00:14:08 +02:00
4f0437fbde
Merge pull request #15598 from owncloud/fix-enc-file-size-master
...
Fix file size of encrypted files
2015-04-14 16:48:04 +02:00
717723b83e
Remove unneeded comments
2015-04-14 16:44:24 +02:00
308af8b909
pass a stream to the tests
2015-04-14 15:25:52 +02:00
82cab25762
Merge pull request #13360 from owncloud/cross-storage-move
...
Proper copy/move between multiple local storages
2015-04-14 14:35:08 +02:00
cbe30f740e
remove calculateUnencryptedSize() - not needed
2015-04-14 13:08:59 +02:00
88cc52c408
Avoid php message "Invalid argument supplied for foreach()" - refs #15590
2015-04-14 11:00:20 +02:00
5f66f867b6
Merge pull request #15581 from owncloud/deduplicate-oc-repair-namespace
...
Fix namespace duplication and other issues in repairlegacystorages
2015-04-13 21:51:38 +02:00
01da6be4d6
upda tests
2015-04-13 17:10:02 +02:00
d7b3a1a35a
preserve cache data when doing a cross storage move
2015-04-13 17:10:01 +02:00
71de1d58cd
Fix namespace duplication and other issues in repairlegacystorages
2015-04-13 16:34:10 +02:00
0772e3b4c1
Properly handle copy/move failures in cross storage copy/move
2015-04-13 15:13:03 +02:00
31e94708f8
Improve cross storage copy between local storages
2015-04-13 15:13:02 +02:00
2822d0579e
Properly add trailing slash to mount point
...
Fixes resolving mount points when shared mount point's target name has
the same prefix as the source name
2015-04-13 12:36:47 +02:00
906b6b7337
Prevent php message: "Trying to get property of non-object at /xxx/lib/private/ocsclient.php#282"
2015-04-13 09:43:45 +02:00
84041a4fa2
Merge pull request #15541 from owncloud/add-reply-to-support
...
Add "Reply-To" support for sharing mails as well as refactor code and add unit-tests
2015-04-12 22:30:35 +02:00
e3ad99d252
Add "Reply-To" support to sharing mails and refactor code
2015-04-10 17:30:07 +02:00
fafecd1c05
fix cherrypicking
2015-04-10 11:08:24 +02:00
a85bc5538f
fix filesystem and encryption tests
...
Conflicts:
apps/files_encryption/lib/util.php
apps/files_encryption/tests/hooks.php
2015-04-10 09:12:37 +02:00
5abbf6d5b0
Merge pull request #13920 from owncloud/sharing_no_user_entry_for_group_shares
...
only create a db entry for the user in case of a name conflict on group share
2015-04-09 23:37:02 +02:00
0bad8f644a
Merge pull request #15511 from owncloud/fix-typos
...
Fix typos and some other adjustments
2015-04-09 19:23:27 +02:00
06a5a9d0c2
Fix mock object to return proper type
2015-04-09 18:30:45 +02:00
11c3741526
Fix mock object to return proper type
2015-04-09 17:45:57 +02:00
cbcee34eb0
update tests
2015-04-09 14:46:25 +02:00
1d9bd3d31e
Merge pull request #15496 from owncloud/enc-check-if-key-exists-before-deleting
...
Check if the key exists, before trying to delete it
2015-04-09 14:45:40 +02:00
332ea77865
only create a db entry for the user in case of a name conflict on group share
2015-04-09 11:16:08 +02:00
45575d0135
Check if the key exists, before trying to delete it
2015-04-09 10:28:02 +02:00
ba52f6f8fc
Merge pull request #15314 from owncloud/app-categories-15274
...
Add different trust levels to AppStore interface
2015-04-09 10:07:32 +02:00
9c76d068c3
Merge pull request #15196 from owncloud/limit-file-activities-to-favorites
...
Limit file activities to favorites
2015-04-09 00:18:31 +02:00
103d451459
Merge pull request #14987 from rullzer/ocs_password_fix2
...
OCS Fixes to allow setting of password without removing additional settings
2015-04-08 14:44:17 +02:00
f8cfc03f36
Replace originalStorage in tests with a proper teardown
...
The purpose of $originalStorage in unit tests was to remount the old
root.
However that storage itself is already wrapped by storage wrapper, so
remounting it would rewrap the storage several times.
This fix makes use of "loginAsUser()" and "logout()" from the TestCase
class to properly initialize and cleanup the FS as expected.
2015-04-08 12:45:38 +02:00
6c327f8331
Merge pull request #14879 from oparoz/fix-preview-caching
...
Introducing the maximum size preview
2015-04-07 18:16:24 +02:00
74bf9806b0
Introducing the maximum size preview
...
The first time we're asked to generate a preview we'll generate one of the maximum dimension indicated in the configuration and all future resizing requests will be done on that preview in order to not waste time converting the same file over and over.
One of the fixes required for #12465
2015-04-07 16:45:59 +02:00
2d2cb09715
fixing unit test - expected value change due to different size being stored in cache table
2015-04-07 14:30:01 +02:00
54a3bdf1c5
fixing unit test execution related to trashbin
2015-04-07 13:30:31 +02:00
268d346b36
fixing unit tests
2015-04-07 13:30:31 +02:00
fce42a3161
fixing unit test execution - test dummy module was behaving wrong
2015-04-07 13:30:31 +02:00
870c53ee37
fixing unit test execution
2015-04-07 13:30:31 +02:00
3d7404fe68
add unit tests to the keystorage
2015-04-07 13:30:31 +02:00
fe74a0cb4f
implement webdav copy
2015-04-07 13:30:31 +02:00
3e3226da4c
Properly set size and unencrypted size in the stream unit tests
2015-04-07 13:30:31 +02:00
b3c5ef3afe
Adding unit test for read and write of big file
2015-04-07 13:30:31 +02:00
104d11ec4c
Fixing encryption storage wrapper tests
2015-04-07 13:30:30 +02:00
e8e5bd61ae
fixing unit tests for encryption stream wrapper seek
2015-04-07 13:30:30 +02:00
8ffa6db110
fixing unit tests for stream wrapper
2015-04-07 13:30:30 +02:00
e0ab2c34ea
update unit tests after ctor signature change of \OC\Encryption\Util
2015-04-07 13:30:28 +02:00
1b42b492dc
kill OC_FileProxy 💥
2015-04-07 13:30:28 +02:00
00338f9dca
Removing files_encryption left overs
2015-04-07 13:30:28 +02:00
0eee3a2618
remove unencrypted_size from the cache, size will contain the unencrypted size
2015-04-07 13:30:28 +02:00
498625ea3a
adding unit tests for stream wrapper
2015-04-07 13:30:28 +02:00
a905f641b3
various fixes & start to unit test the encryption storage wrapper
2015-04-07 13:30:28 +02:00
4aa125cc0a
fix unit test execution
2015-04-07 13:30:28 +02:00
8dde932546
Comment duplicate test methods
2015-04-07 13:30:27 +02:00
e2f714263f
fix encryption manager to handle more than one encryption module
2015-04-07 13:30:27 +02:00
39733c8da1
Initial commit
2015-04-07 13:30:27 +02:00
0fcd273714
Select the timezone on the right timestamp and assert it
2015-04-07 10:13:51 +02:00
25531bad88
Make user names clickable
2015-04-03 13:36:03 +02:00
0816cf9142
Add experimental applications switch
...
Allows administrators to disable or enabled experimental applications as well as show the trust level.
2015-04-03 13:21:24 +02:00
70ec74e88b
Introducing media types for yml, yaml, cnf, conf
2015-04-02 21:37:57 +02:00
aa6573cf54
Adjust tests and check whether clear() is called
2015-04-01 17:19:44 +02:00
730efe25a4
Make scrutinizer happy
2015-04-01 12:13:49 +02:00
5c9998179f
Properly quote file names in listFiles query for GDrive
2015-03-31 15:14:03 +02:00
53f67fc65d
Revert "Properly quote file names in listFiles query for GDrive"
2015-03-31 15:12:35 +02:00
b216b3fad0
Merge pull request #15215 from owncloud/ext-gdrivelistfilequoting
...
Properly quote file names in listFiles query for GDrive
2015-03-31 09:08:59 -04:00
3b1f0e6019
Fix unit test
2015-03-30 21:18:24 +02:00
bf17ac929d
Merge pull request #15169 from rullzer/fix_displayNamesInGroup
...
Groupmanagers displayNamesInGroup should actually search in displaynames
2015-03-30 17:04:09 +02:00
dd535968e8
Add tests from getCurrentUserId() method and fix the constructor
2015-03-30 15:23:10 +02:00
b0aa17b13f
OCS Fixes to allow setting of password without removing additional settings
...
- Added setPassword to share.php
- Fixed OCS API call
- Added unit tests
2015-03-30 14:00:50 +02:00
65202d2a18
Add check for activated local memcache
...
Also used the opportunity to refactor it into an AppFramework controller so that we can unit test it.
Fixes https://github.com/owncloud/core/issues/14956
2015-03-28 13:59:22 +01:00
1511a42da7
Check for relative datadirectory path
2015-03-27 23:29:46 +00:00
f4dc9e6bf3
Merge pull request #15155 from owncloud/share-donotreturntrashedfiles
...
Do not return shares for files outside "files"
2015-03-27 17:05:14 +01:00
4d12c4a38b
Merge pull request #13938 from owncloud/deprecate-iappconfig
...
Deprecated \OCP\IAppConfig - add missing methods to IConfig
2015-03-27 16:07:41 +01:00
23cb8112fc
Add logout in share test to avoid nasty side effects
2015-03-27 15:54:29 +01:00
722e50a112
Merge pull request #15240 from owncloud/storage-wrapper-priority
...
add priority to storage wrappers
2015-03-27 15:18:44 +01:00
98bc1ad70a
Merge pull request #15265 from owncloud/enc2_fixes
...
core improvements for Encryption 2.0
2015-03-27 14:58:33 +01:00
80f83ab5e0
Do not return shares for files outside "files"
2015-03-27 13:25:23 +01:00
7ad4dfa201
Merge pull request #15227 from owncloud/ocetag-header
...
Copy Etag header to OC-Etag for sabre calls
2015-03-27 13:10:27 +01:00
c6be1ba8d3
fix check if a file is excluded from encryption or not
2015-03-27 11:51:50 +01:00
fb8994603b
Merge pull request #15252 from owncloud/prevent-directory-characters-in-temporary-path
...
Filter potential dangerous characters in path name
2015-03-27 01:19:55 +01:00
f72939df91
Merge pull request #15255 from owncloud/test-namespacesforrepairtests
...
Fix namespace for repair step tests
2015-03-27 00:16:47 +01:00
cf2fd2a825
Fix namespace for repair step tests
2015-03-26 23:19:27 +01:00
9622fbdf29
Filter potential dangerous characters in path name
...
We should not allow / or \ in the postfix here.
2015-03-26 23:17:18 +01:00
746be98e03
Merge pull request #13654 from oparoz/tmpfile-with-extension
...
Keep the extension in temp files
2015-03-26 23:08:08 +01:00
e8109f0bc3
Merge pull request #13802 from owncloud/share-partfilepermissions
...
Fix share permission checks
2015-03-26 22:01:05 +01:00
cb9ead7dde
add priority to storage wrappers
2015-03-26 21:26:38 +01:00
Robin Appelman
Joas Schilling
Morris Jobke
Lukas Reschke
Roeland Jago Douma
Thomas Müller
Bjoern Schiessle
jknockaert
Joas Schilling
Vincent Petry
Georg Ehrke
Björn Schießle
Jörn Friedrich Dreyer
Olivier Paroz
Clark Tomlinson
Frank Karlitschek
Robin McCorkell