wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
51042 commits 157 branches 562 tags 714 MiB
Commit graph

5341 commits

Author SHA1 Message Date
Roeland Jago Douma
6dc179ee12
Fix login flow form actions 
So fun fact. Chrome considers a redirect after submitting a form part of
the form actions. Since we redirect to a new protocol (nc://login/).
Causing the form submission to work but the redirect failing hard.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-08-11 19:53:49 +02:00
Roeland Jago Douma
f81817b47d
Add tests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-08-10 19:40:13 +02:00
Roeland Jago Douma
b8c5008acf
Add feature policy header 
This adds the events and the classes to modify the feature policy.
It also adds a default restricted feature policy.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-08-10 14:26:22 +02:00
Roeland Jago Douma
2e2d1b6b5c
Merge pull request #16592 from nextcloud/bugfix/noid/federated-reshare 
Fix permission check on incoming federated shares
 2019-08-01 10:55:35 +02:00
Roeland Jago Douma
cf647451e5
Update CSP test cases to handle the new form-action 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-07-31 15:16:10 +02:00
Julius Härtl
22b81ac1e4
Fix permission check on incoming federated shares 
Since federated shares have their permissions set on the node, we do not need
to check for parent share permissions. Otherwise reshares of incoming federated
have no permission variable defined and creating them will fail

Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2019-07-31 12:59:51 +02:00
Roeland Jago Douma
436f7b92d5
Merge pull request #16544 from nextcloud/bugfix/16540 
Add missing password reset page to vue
 2019-07-31 11:02:20 +02:00
Julius Härtl
3b0d13944a
Move actual password reset to vue 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2019-07-31 09:19:07 +02:00
Joas Schilling
d4eb8481fa
Merge pull request #16594 from nextcloud/tech-debt/noid/remove-unused-checkPasswordProtectedShare 
Remove unused OC\Share\Share::checkPasswordProtectedShare
 2019-07-30 09:58:38 +02:00
Roeland Jago Douma
135209f24e
Merge pull request #16579 from nextcloud/enh/PostLoginEvent 
Add proper PostLoginEvent
 2019-07-30 08:54:10 +02:00
Morris Jobke
e21f440990
Merge pull request #16502 from nextcloud/bugfix/16474 
Check the if we can actually access the storage cache for recent files
 2019-07-29 16:59:26 +02:00
Roeland Jago Douma
0ea7fbae54
Update tests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-07-29 16:31:40 +02:00
Morris Jobke
98237d2a00
Remove unused OC\Share\Share::checkPasswordProtectedShare 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2019-07-29 15:23:21 +02:00
Roeland Jago Douma
51197ac622
Merge pull request #16582 from nextcloud/enh/split_up_security_middleware 
Split up security middleware
 2019-07-29 12:13:55 +02:00
Roeland Jago Douma
b6dd2ebd39
Use proper exception in lostController 
There is no need to log the expcetion of most of the stuff here.
We should properly log them but an exception is excessive.

This moves it to a proper exception which we can catch and then log.
The other exceptions will still be fully logged.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-07-27 20:12:16 +02:00
Roeland Jago Douma
37a4282c7a
Split up security middleware 
With upcoming work for the feature policy header. Splitting this in
smaller classes that just do 1 thing makes sense.

I rather have a few small classes that are tiny and do 1 thing right
(and we all understand what is going on) than have big ones.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-07-27 16:11:45 +02:00
Morris Jobke
2e803dc3d3
Merge pull request #16555 from nextcloud/fix/16529/mask-keys 
use a pattern to identify sensitive config keys
 2019-07-26 15:15:56 +02:00
Morris Jobke
71e5300f84
Merge pull request #16551 from nextcloud/fix/12735/displayname-email 
supresses disclosing the userid for LDAP users in the welcome mail
 2019-07-26 15:14:59 +02:00
Arthur Schiwon
78201bcb72
treat sensitive config keys by pattern 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2019-07-26 13:31:14 +02:00
Roeland Jago Douma
0487144b26
Remove deprecated searchByTag 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-07-26 12:29:19 +02:00
Arthur Schiwon
898430b6b1
supresses disclosing the userid for LDAP users in the welcome mail 
The userid is not relevant here, and by default cannot be used to login
with. Typically, there is a common type of login names in organizations
(LDAP username or email most often) that does not need to be disclosed.

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2019-07-26 10:48:34 +02:00
Julius Härtl
3674f6fa2d
Check the if we can actually access the storage cache for recent files 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2019-07-24 14:01:24 +02:00
Morris Jobke
d5b524ae07
Merge pull request #16492 from nextcloud/enh/exclude-rnd-files 
Exclude .rnd files from integrity check
 2019-07-23 14:57:55 +02:00
Daniel Kesselberg
8bed3021bd
Exclude .rnd files from integrity check 
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
 2019-07-21 20:29:11 +02:00
Sam Bull
ea935f65fd
Add support for CSP_NONCE server variable 
Allow passing a nonce from the web server, allowing the possibility to enforce a strict CSP from the web server.

Signed-off-by: Sam Bull <git@sambull.org>
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-07-18 12:16:29 +02:00
Morris Jobke
5b604eaeab
Merge pull request #15040 from nextcloud/feature/13980/push-for-deleted-notifications 
Notifications overhaul
 2019-07-17 20:22:03 +02:00
Morris Jobke
782554d2ac
Merge pull request #16075 from nextcloud/bugfix/15823/app-restricted-groups 
Remove deleted groups from app restrictions fixes #15823
 2019-07-17 17:36:00 +02:00
Morris Jobke
99f2c82222
Properly inject the logger 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2019-07-16 22:38:14 +02:00
Joas Schilling
565838da9c
Update unit tests 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2019-07-16 13:32:44 +02:00
Joas Schilling
55f5bc79a1
Keep the old method as a fallback and adjust the tests 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2019-07-16 11:36:32 +02:00
Roeland Jago Douma
f8aeef7ae9
Lock SCSS so we only run 1 job at a time 
This is bit hacky but a start to lock the SCSS compiler properly
Retry during 10s then give up
Properly get error message
Do not clear locks and properly debug scss caching

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-07-12 16:18:02 +02:00
Roeland Jago Douma
c193c0d466
Merge pull request #16331 from nextcloud/feature/noid/talk-guest-mentions 
Allow guest mentions of talk to be parsed
 2019-07-12 10:35:54 +02:00
Joas Schilling
092d34d9df
Add a unit test for guests as well 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2019-07-11 10:24:27 +02:00
Morris Jobke
5c21b29d7f
Merge pull request #16308 from nextcloud/fix/undefined-offset-0 
Prevent undefined offset 0 in findByUserIdOrMail
 2019-07-10 12:16:36 +02:00
Daniel Kesselberg
d57540ac84
Return first value from $users 
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
 2019-07-09 19:29:14 +02:00
Roeland Jago Douma
6a088d6800
Merge pull request #16310 from nextcloud/enh/drop-execution-context 
Don't send executionContexts for Clear-Site-Data
 2019-07-09 19:20:50 +02:00
Daniel Kesselberg
6235a66aac
Don't send executionContexts for Clear-Site-Data 
There are plans to remove executionContexts from the spec: https://github.com/w3c/webappsec-clear-site-data/issues/59

Firefox already removed it https://bugzilla.mozilla.org/show_bug.cgi?id=1548034

Chromium implementation is not finish: https://bugs.chromium.org/p/chromium/issues/detail?id=898503&q=clear-site-data&sort=-modified&colspec=ID%20Pri%20M%20Stars%20ReleaseBlock%20Component%20Status%20Owner%20Summary%20OS%20Modified

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
 2019-07-09 15:08:25 +02:00
Christoph Wurst
d058ef2b6c
Make it possible to wipe all tokens/devices of a user 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2019-07-09 13:57:04 +02:00
Christoph Wurst
1c261675ad
Refactor: move remote wipe token logic to RW service 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2019-07-09 13:39:27 +02:00
Roeland Jago Douma
5cef8957b5
Merge pull request #15730 from nextcloud/enh/14179/event_for_csp 
Add an event to edit the CSP
 2019-07-09 10:59:15 +02:00
Roeland Jago Douma
5ac857bcdc
Add an event to edit the CSP 
This introduces and event that can be listend to when we actually use
the CSP. This means that apps no longer have to always inject their CSP
but only do so when it is required. Yay for being lazy.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-07-08 20:35:15 +02:00
Morris Jobke
53d2d95478
Remove one time repair steps that have already run when updating to 17 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2019-07-08 14:47:26 +02:00
John Molakvoæ
5a03189ce7
Mimetype list integrity check should not fail if it's changed (#15810) 
Mimetype list integrity check should not fail if it's changed
 2019-07-07 20:01:58 +02:00
Xheni Myrtaj
9211e34aec
Added Tests for modified mimetypelist 
Signed-off-by: Xheni Myrtaj <myrtajxheni@gmail.com>
 2019-07-04 09:35:36 +01:00
Julius Härtl
857fae288c
Always set the display name for user shares 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2019-07-03 21:34:18 +02:00
Joas Schilling
85a80b05ac
Unify the permission checking in one place only 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2019-07-03 16:34:00 +02:00
Joas Schilling
e4addbae3e
Better check reshare permissions when creating a share 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2019-07-03 14:00:13 +02:00
Christoph Wurst
c50fe2a9c9
Send emails when remote wipe starts/finishes 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2019-07-02 21:59:23 +02:00
Georg Ehrke
9f7fca49bb
Merge pull request #15775 from nextcloud/refactor/decouple-remote-wipe-notifications 
Decouple remote wipe notifcation channels with events
 2019-07-02 08:58:21 +00:00
Julius Härtl
5db328cc15
Remove fs package 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2019-07-01 11:24:58 +02:00
Roeland Jago Douma
2c449469d3
Merge pull request #16070 from nextcloud/fix/setup-check-no-internet-no-error 
Do not show a internet connectivity warning if internet access is dis…
 2019-06-28 10:54:29 +02:00
Greta Doci
5898e87e0f Remove deleted groups from app restrictions fixes #15823 
Signed-off-by: Greta Doci <gretadoci@gmail.com>
 2019-06-27 20:17:50 +02:00
Christoph Wurst
aa6622ccef Decouple remote wipe notifcation channels with events 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2019-06-27 17:16:18 +02:00
Roeland Jago Douma
dd79eda8a0
Use correct test avatar 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-06-27 13:27:03 +02:00
Christoph Wurst
20afe94297 Do not show a internet connectivity warning if internet access is disabled 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2019-06-27 10:51:59 +02:00
Jan-Christoph Borchardt
b466127b1f
Merge pull request #16055 from nextcloud/design/native-fonts 
Use native font stack
 2019-06-26 00:08:16 +02:00
Roeland Jago Douma
d4a44d9b78
Merge pull request #15870 from nextcloud/preview-provider-v2 
Add new Provider interface for preview providers
 2019-06-25 15:05:54 +02:00
Roeland Jago Douma
335af0c46c
Merge pull request #15971 from nextcloud/dependabot/npm_and_yarn/tests/ui-regression/pixelmatch-tw-5.0.2 
Update pixelmatch requirement from ^4.0.2 to ^5.0.2 in /tests/ui-regression
 2019-06-25 14:25:29 +02:00
Roeland Jago Douma
5fbf304c2a
Merge pull request #15777 from nextcloud/feature/ocp-event-dispatcher 
Add event dispatcher to OCP
 2019-06-25 11:48:16 +02:00
Christoph Wurst
3174012adf Add event dispatcher to OCP 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2019-06-25 10:02:27 +02:00
Jan-Christoph Borchardt
d14c0f2ed7
Move font from Nunito to Noto Sans 
Signed-off-by: Jan-Christoph Borchardt <hey@jancborchardt.net>
 2019-06-22 11:23:44 +02:00
Robin Appelman
1ad95caf24
Merge pull request #15889 from nextcloud/touch-handle-backend-exceptions 
handle storage exceptions when trying to set mtime
 2019-06-21 17:14:27 +02:00
Robin Appelman
000898d932
fix tests 
Signed-off-by: Robin Appelman <robin@icewind.nl>
 2019-06-21 16:23:47 +02:00
Julius Härtl
d5805df6c2
Fix subscription tests 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2019-06-17 16:36:24 +02:00
Robin Appelman
6150614374
Add new Provider interface for preview providers 
the main difference is passing the `File` object to the provider
instead of a `View` + path

Old providers will still continue to work as before

Signed-off-by: Robin Appelman <robin@icewind.nl>
 2019-06-17 14:09:09 +02:00
dependabot-preview[bot]
f5709c130b
Update pixelmatch requirement in /tests/ui-regression 
Updates the requirements on [pixelmatch](https://github.com/mapbox/pixelmatch) to permit the latest version.
- [Release notes](https://github.com/mapbox/pixelmatch/releases)
- [Commits](https://github.com/mapbox/pixelmatch/compare/v4.0.2...v5.0.2)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2019-06-16 01:13:18 +00:00
John Molakvoæ
bf18f1ee93
Add strict type on Notifications tests (#15935) 
Add strict type on Notifications tests
 2019-06-14 14:12:50 +02:00
John Molakvoæ (skjnldsv)
e9351ef779
Add strict type on Notifications tests 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2019-06-13 14:58:38 +02:00
John Molakvoæ
b3bfae8cfe
Adjust acceptance tests to notifications based on toastify (#15938) 
Adjust acceptance tests to notifications based on toastify
 2019-06-13 14:04:50 +02:00
Daniel Calviño Sánchez
e65fd11419 Add messages to assertFalse/True to clarify the failed assertion 
Otherwise the output would just read "Failed asserting that true is
false." or "Failed asserting that false is true.", which is not very
informative when there are several assertFalse/True in a row.

Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
 2019-06-12 15:32:40 +02:00
Daniel Calviño Sánchez
df8406dbae Adjust acceptance tests to notifications based on toastify 
The old notifications were added as ".row" elements to the
"#notification-container" element; the new notifications based on
toastify are added as ".toastify .on .toast..." elements to the
"#content" element. Besides that, they also include a span element with
an X to close the notification, so now only the first child text node
should be compared to the expected message.

Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
 2019-06-12 14:32:15 +02:00
Roeland Jago Douma
357263a70b
Do not try to autoload built in types 
This avoids calls to the autoloader (or chain of autoloaders) to see if
for example 'principalPrefix' class can be found. While we already know
it is a string.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-06-04 15:13:32 +02:00
Xheni Myrtaj
7cb6265378
Fix checker test 
Signed-off-by: Xheni Myrtaj <myrtajxheni@gmail.com>
 2019-05-30 14:50:07 +02:00
John Molakvoæ
21f9487939
Fix personal security section tests (#15789) 
Fix personal security section tests
 2019-05-29 14:52:02 +02:00
Christoph Wurst
f88907a2d9
Fix personal security section tests 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2019-05-29 13:10:07 +02:00
Christoph Wurst
64c4bb5bce
Vueify the login page 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2019-05-29 11:05:16 +02:00
Julius Härtl
67dd4b018a
Check for free space on touch 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2019-05-28 13:06:59 +02:00
Roeland Jago Douma
b0c2042a28
Merge pull request #15714 from nextcloud/fix/204_304_rfc 
Check the actual status code for 204 and 304
 2019-05-24 19:51:01 +02:00
Roeland Jago Douma
b0c030cbb5
Check the actual status code for 204 and 304 
The header is the full http header like: HTTP/1.1 304 Not Modified
So comparing this to an int always yields false
This also makes the 304 RFC compliant as the resulting content length
should otherwise be the length of the message and not 0.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2019-05-24 15:18:32 +02:00
Christoph Wurst
22ae682823
Make it possible to show admin settings for sub admins 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2019-05-23 20:31:40 +02:00
Morris Jobke
9a733b7f50
Merge pull request #12114 from RubenHoms/master 
Stop decryption when maintenance mode is enabled
 2019-05-22 22:32:13 +02:00
Morris Jobke
8c3c04596e
Fix l10n for SettingsManager by injecting the l10n factory 
Fixes #10832

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2019-05-21 22:25:13 +02:00
Ruben Homs
98047e8c1c
Stop decryption when maintenance mode is enabled, fixes #8311 
Signed-off-by: Ruben Homs <ruben@homs.codes>
 2019-05-21 09:24:50 +02:00
Roeland Jago Douma
f03eb7ec3c
Remote wipe support 
This allows a user to mark a token for remote wipe.
Clients that support this can then wipe the device properly.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2019-05-20 20:50:27 +02:00
Roeland Jago Douma
528eb1b223
Merge pull request #15304 from nextcloud/enh/2fa_setup_at_login 
2FA setup during login
 2019-05-17 11:04:42 +02:00
Roeland Jago Douma
579162d7b9
Allow 2FA to be setup on first login 
Once 2FA is enforced for a user and they have no 2FA setup yet this will
now prompt them with a setup screen. Given that providers are enabled
that allow setup then.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2019-05-17 10:11:53 +02:00
Roeland Jago Douma
2dcb4cfbd6
Allow clients to delete their own apptoken 
Fixes #15480

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-05-17 09:52:06 +02:00
Morris Jobke
83b00a99fa
Add interfaces to interact with subscription from support app 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2019-05-13 11:04:47 +02:00
Christoph Wurst
d3a244f9d9
Allow crash reporters to catpture any message 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2019-05-09 14:06:44 +02:00
Morris Jobke
f095bd1642
Use non-absolute logout URL to fix wrong URL in reverse proxy scenario 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2019-05-08 18:02:00 +02:00
Christoph Wurst
170582d4f5
Add a login chain to reduce the complexity of LoginController::tryLogin 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2019-05-07 18:04:36 +02:00
Morris Jobke
582b679ca9
Deprecate legacy share code and cleanup some unused methods 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2019-04-18 17:44:14 +02:00
Morris Jobke
049d613dba
Merge pull request #15152 from nextcloud/enhancement/noid/contactsmenu-sharing-enum-settings 
Respect sharing enumeration config in contacts menu
 2019-04-18 15:00:02 +02:00
Julius Härtl
db17c14f80
Respect sharing enumeration config in contacts menu 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2019-04-18 11:39:49 +02:00
Daniel Kesselberg
6c156d81ed
Fix testGetProxyUri 
Changed the implementation for getProxyUri with
fd1d85365c

If proxy is already null then we don't ask for proxyuserpwd. Test
failed because we expected getSystemValue to be called once with
proxyuserpwd

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
 2019-04-16 21:33:56 +02:00
Daniel Kesselberg
2708d26407
Set User-Agent as header without middleware 
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
 2019-04-16 21:13:29 +02:00
Roeland Jago Douma
7276735eb4
Set empty CSP by default 
For #14179

By default responses should have the strictest (and simplest) CSP
possible. Only template responses should require an actual CSP.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-04-16 14:09:39 +02:00
Joas Schilling
8852b85d13
Disable acceptance test which should fail anyway 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2019-04-11 14:03:41 +02:00
Morris Jobke
c1e6a5965e
Return true in the dummy backend for successful display name change 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2019-04-11 11:43:33 +02:00
Leon Klingele
f420647add
lib/private/User: do not change user properties if value has not changed 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2019-04-11 10:11:05 +02:00