Commit graph

1030 commits

Author SHA1 Message Date
Individual IT Services
3bc287ff63 Merge pull request from individual-it/reuse_systemConfig
reuse existing $systemConfig variable
2015-09-04 14:03:56 +05:45
Morris Jobke
038b09b0b0 Proper details about git submodule update
* fixes 
2015-09-03 14:55:26 +02:00
Individual IT Services
cd0a5372ee reuse existing $systemConfig variable 2015-09-03 12:44:35 +05:45
Robin Appelman
e9b91b1798 verify the path in the autoloader 2015-09-01 15:03:28 +02:00
root
acae208f2f moved code to /lib/private/tempmanager.php
fix for unit test

some fixes
2015-08-29 16:59:02 +01:00
Morris Jobke
e88b380973 Remove DEBUG constant and use config value
* introduces config.php option 'debug' that defaults to false
* migrate DEBUG constant to config value
2015-08-24 15:14:05 +02:00
Morris Jobke
b3495a1dc9 Merge pull request from owncloud/encrypt-session-data
Add a session wrapper to encrypt the data before storing it on disk
2015-08-24 12:10:15 +02:00
Morris Jobke
40b1054530 Merge pull request from owncloud/mitigate-breach
Add mitigation against BREACH
2015-08-24 09:14:27 +02:00
Joas Schilling
36eef2ddab Add a session wrapper to encrypt the data before storing it on disk 2015-08-21 17:59:23 +02:00
Morris Jobke
06d8edd963 Merge pull request from owncloud/update-showappnameonappupdate
Display app names in update page for app updates
2015-08-20 11:50:01 +02:00
Vincent Petry
a2674b2b30 Additions to update page
Apps to update and to disable will always be shown.
Main title changes only when apps need updated, not core.
Added bullet style.
Exclude incompatible apps from updated apps list.
2015-08-20 11:14:30 +02:00
Vincent Petry
b919ae96f0 Display app names in update page for app updates
Whenever the update page is displayed for apps, show app names instead
of the core update text.
2015-08-19 18:03:35 +02:00
Lukas Reschke
8313a3fcb3 Add mitigation against BREACH
While BREACH requires the following three factors to be effectively exploitable we should add another mitigation:

1. Application must support HTTP compression
2. Response most reflect user-controlled input
3. Response should contain sensitive data

Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed.

To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.
2015-08-14 01:31:32 +02:00
Arthur Schiwon
ffaf5fed0e load backbone universally 2015-08-06 12:27:18 +02:00
Thomas Müller
c3cac887f5 - more injection
- less static calls
- use params on sql queries
- handle sql exception on database and user creation gracefully
2015-07-30 00:04:30 +02:00
Morris Jobke
5265a44260 Remove commented code 2015-07-24 00:47:41 +02:00
Bernhard Posselt
582f07950f Merge pull request from owncloud/bootstrap-tooltip
Replace jQuery tipsy with bootstrap tooltip
2015-07-23 19:25:09 +02:00
Morris Jobke
2d691c2fb4 Merge pull request from owncloud/fix_sharing_add_to_group
[sharing] fix addToGroup hook
2015-07-21 13:30:41 +02:00
Bjoern Schiessle
058d910f5e intproduce pre_addToGroup hook. we need to calculate the possible unique
targets before the user was added to the group otherwise we will always detect
a name collision
2015-07-06 17:24:05 +02:00
Roeland Jago Douma
c8145cdbd6 Javascript mimetype icon resolver
This makes it possible to retrieve the icon for mimetypes in javascript.
It makes no additional queries to the server to retrieve the mimetype.

* config/mimetypealiases.json added
* mimetype.js: this is where the logic resides to convert from mimetype
  to icon url
* mimetypelist.js: generated file with a list of mimetype mapping (aliases)
  and the list of icon files
* ./occ maintenance:mimetypesjs : new command for occ to gernerate
  mimetypes.js
* unit tests updated and still work
* javascript tests added
* theming support
* folder of the theme is now present in javascript (OC.theme.folder)
2015-07-06 16:32:10 +02:00
Thomas Müller
d3ac73c0c9 Remove OC_Log 2015-07-03 18:00:16 +02:00
Vincent Petry
2fe677d0ed Catch cache garbage collection exception on postLogin
Just log the exception instead of preventing access to OC.
2015-06-30 17:36:55 +02:00
Morris Jobke
f63915d0c8 update license headers and authors 2015-06-25 14:13:49 +02:00
Hendrik Leppelsack
8621d176db moved tooltip.js to vendor scripts 2015-06-22 15:38:32 +02:00
Hendrik Leppelsack
f66e9af9a0 replaced tipsy with bootstrap tooltip 2015-06-22 13:32:06 +02:00
Thomas Müller
97a3d8c313 Fix login handler for file cache - fixes 2015-06-08 14:13:38 +02:00
Thomas Müller
5e60795962 Bring back OC\Cache\File - fixes 2015-06-05 14:21:17 +02:00
Morris Jobke
cf2c599218 Merge pull request from owncloud/kill-globalfilecache
Drop file caching
2015-06-02 09:11:33 +02:00
Robin Appelman
e08423f956 release all locks on shutdown 2015-06-01 13:22:56 +02:00
Georg Ehrke
745c3c64fa fix preview hooks, enable_previews default is true 2015-05-13 19:59:41 +02:00
Arthur Schiwon
e016ed55ff also free joblist and base from file cache code 2015-05-12 17:44:31 +02:00
Bjoern Schiessle
0d5c7a11e2 use hooks to update encryption keys instead of the storage wrapper if a file gets renamed/restored, as long as we
are in the storage wrapper the file cache isn't up-to-date
2015-05-11 12:06:57 +02:00
Hugo Gonzalez Labrador
3e647afbd4 Do not trigger preview hooks if enable_previews is false 2015-05-06 10:39:48 +02:00
Hugo Gonzalez Labrador
3a3a58f248 Do not trigger preview hooks if enable_previews is false 2015-05-06 10:03:18 +02:00
Lukas Reschke
9530e819eb Don't display errors and log them
Fixes https://github.com/owncloud/core/issues/16014
2015-05-05 12:34:22 +02:00
Lukas Reschke
8a85d8bc17 Try to set required ini values in base.php
Fixes https://github.com/owncloud/core/issues/16006
2015-05-03 13:23:29 +02:00
Robin Appelman
d0ad69aa9c use the preSetup hook to ensure the encryption wrapper is applied correctly 2015-04-30 13:28:06 +02:00
Thomas Müller
d9990c2b4e Delay initialization of the OC\Encryption\Update - introducing 'OC\Encryption\HookManager' 2015-04-17 13:55:31 +02:00
Bjoern Schiessle
b25c06f576 detect system wide mount points correctly 2015-04-16 14:15:04 +02:00
Thomas Müller
7b2d53603c Merge pull request from owncloud/dont_hide_exceptions_master
Dont hide exceptions master
2015-04-10 15:49:45 +02:00
Thomas Müller
a163243e31 Merge pull request from owncloud/cron-singleuser
block cron when in single user mode
2015-04-10 14:38:50 +02:00
Thomas Müller
a33edcd2f0 Fix singe user mode on public.php - take two 2015-04-10 11:17:33 +02:00
Jörn Friedrich Dreyer
8964c5068c do not disclose information, show generic error on login page
Conflicts:
	core/templates/login.php
	lib/base.php
2015-04-10 09:12:37 +02:00
Thomas Müller
f05e19348d Fix single user check in case no user is logged in 2015-04-09 23:47:24 +02:00
Thomas Müller
f099c9883e Adding check command to validate server environment - fixes 2015-04-08 00:19:23 +02:00
Thomas Müller
ba9a797eaa Encryption storage wrapper is enabled by default - necessary to detect encrypted files even if encryption was disabled after files have been encrypted - prevents data corruption 2015-04-07 13:30:31 +02:00
Bjoern Schiessle
e4895bda01 add helper class accessible for encryption modules to ask for a list of users with access to a file, needed to apply the recovery key to all files 2015-04-07 13:30:29 +02:00
Thomas Müller
4db75e3407 Setting up the encryption wrapper in a setup hook - temporarily fixes the wrapping order 2015-04-07 13:30:29 +02:00
Thomas Müller
dbdd754c3f Further cleanup of files_encryption 2015-04-07 13:30:28 +02:00
Bjoern Schiessle
937efe856d fix lib/private/encryption/util.php call 2015-04-07 13:30:28 +02:00
Robin Appelman
bac9b54bef Add mount point to disable the encryption wrapper 2015-03-31 16:25:33 +02:00
Thomas Müller
232518ac54 Merge pull request from owncloud/encryption2_core
core part of encryption 2.0
2015-03-26 21:14:59 +01:00
Bjoern Schiessle
ff9c85ce60 implement basic encryption functionallity in core to enable multiple encryption modules 2015-03-26 20:56:51 +01:00
Lukas Reschke
3e57e9d3e5 Merge pull request from owncloud/remove-arg-separator-magic
Remove custom `arg_separator.output`
2015-03-26 19:41:22 +01:00
Lukas Reschke
73af302d39 Remove custom arg_separator.output
This seems unrequired nowadays and like a legacy fragment. It should be safe to remove.

Fixes https://github.com/owncloud/core/issues/14782
2015-03-26 17:07:26 +01:00
Jenkins for ownCloud
b585d87d9d Update license headers 2015-03-26 11:44:36 +01:00
Thomas Müller
843fef0490 Handle session initialization errors and display error page - fixes 2015-03-20 12:21:03 +01:00
Joas Schilling
0bed187613 Stop executing, when 3rdparty is missing or apps directory is invalid 2015-03-18 11:58:18 +01:00
Thomas Müller
6c1a1234f8 Properly handle available databases at runtime and respect setup checks in command line as well 2015-03-11 09:27:12 +01:00
Thomas Müller
7181840665 Use occ to install ownCloud in autotest.sh 2015-03-11 09:27:12 +01:00
Robin McCorkell
0e4933e6d2 Refactor \OC\Memcache\Factory
Caches divided up into two groups: distributed and local. 'Low latency' is an
alias for local caches, while the standard `create()` call tries to get
distributed caches first, then local caches.

Memcache backend is set in `config.php`, with the keys `memcache.local` and
`memcache.distributed`. If not set, `memcache.distributed` defaults to the value
of `memcache.local`.
2015-03-05 11:36:34 +00:00
Lukas Reschke
bbd5f28415 Let users configure security headers in their Webserver
Doing this in the PHP code is not the right approach for multiple reasons:

1. A bug in the PHP code prevents them from being added to the response.
2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud)
3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations.

This pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS.
2015-03-02 19:07:46 +01:00
Lukas Reschke
afb0d742b9 Simplify code 2015-03-01 12:35:41 +01:00
Lukas Reschke
b6d8a48ce1 Add detection for invalid CLI configuration for settings page
This change will log all failures that prevent the CLI cronjob from happening to the database and display a warning to administrators when an error happened.

To test:

1. Configure some invalid CLI php.ini settings
2. Enable the CLI cronjob and run php cron.php
3. See the errors printed and also in the admin page
4. Configure the CLI settings correctly
5. Errors should be gone.

Fixes https://github.com/owncloud/core/issues/13994
2015-02-27 20:20:34 +01:00
Morris Jobke
06aef4e8b1 Revert "Updating license headers"
This reverts commit 6a1a4880f0.
2015-02-26 11:37:37 +01:00
Lukas Reschke
c1d7b22d08 Always load authentication apps
The current code path may trigger situations where the LDAP application is not yet loaded and thus problems with the authentication appeared.

In previous versions of ownCloud the authentication mechanism manually loaded these apps which is why this affects ownCloud 8 and master only for my knowledge. (certainly not 6, maybe 7)

Backport to 8 might be something to consider.

Fixes https://github.com/owncloud/core/issues/14469
2015-02-24 18:00:26 +01:00
Thomas Müller
0a9b8242ee properly initialize OC::$WEBROOT and host name 2015-02-23 21:49:35 +01:00
Thomas Müller
bcd10d3dc5 implement command maintenance:install 2015-02-23 16:47:47 +01:00
Jenkins for ownCloud
6a1a4880f0 Updating license headers 2015-02-23 12:13:59 +01:00
Morris Jobke
75a7bcb10c Merge pull request from owncloud/cast-type-manually
Manually type-cast all AJAX files
2015-02-19 17:19:54 +01:00
Clark Tomlinson
84cc90a0ee Merge pull request from owncloud/enable-strict-mode-per-deafult
Fix invalid `ini_set` directives
2015-02-18 10:06:12 -05:00
Lukas Reschke
e4bf3fcb53 Merge pull request from owncloud/revert-13879-add_debug_log_for_memcache_instantiation
Revert "add debug log for memcache instantiation"
2015-02-18 15:45:38 +01:00
Lukas Reschke
593681a4a9 Fix invalid ini_set directives
Somehow they got messed up. Because PHP does automatic type juggling this has worked before as well however it's not guaranteed that this might work in the future as well.
2015-02-18 15:18:27 +01:00
Lukas Reschke
cd4c064ebf Revert "add debug log for memcache instantiation" 2015-02-18 14:16:14 +01:00
Lukas Reschke
1a41f8f6f9 Check if instance is not yet installed
Due to a security hardening in 8.1 a missing value of empty trusted domains in the config would provoke an error as this was misused by a lot of users.

This caused a problem where the initial installation happened from another domain than 127.0.0.1 as in this case the domain was considered untrusted as no value was defined. However, this special case should not get intercepted.

To test:
- [ ] Installing ownCloud on 127.0.0.1 works
- [ ] Installing ownCloud on another domain / IP works
- [ ] When setting up ownCloud from 127.0.0.1 and accessing it from the domain above the trusted domain error should be shown if not specified in the config

Fixes https://github.com/owncloud/core/issues/14320
2015-02-18 13:06:46 +01:00
Lukas Reschke
cebf9f6a5a Incorporate review changes 2015-02-16 22:13:03 +01:00
Lukas Reschke
992164446c Add blackmagic due to cyclic dependency 🙈 2015-02-16 22:13:01 +01:00
Lukas Reschke
886bda5f81 Refactor OC_Request into TrustedDomainHelper and IRequest
This changeset removes the static class `OC_Request` and moves the functions either into `IRequest` which is accessible via `\OC::$server::->getRequest()` or into a separated `TrustedDomainHelper` class for some helper methods which should not be publicly exposed.

This changes only internal methods and nothing on the public API. Some public functions in `util.php` have been deprecated though in favour of the new non-static functions.

Unfortunately some part of this code uses things like `__DIR__` and thus is not completely unit-testable. Where tests where possible they ahve been added though.

Fixes https://github.com/owncloud/core/issues/13976 which was requested in https://github.com/owncloud/core/pull/13973#issuecomment-73492969
2015-02-16 22:13:00 +01:00
Jörn Friedrich Dreyer
87db136508 add debug log for memcache instantiation 2015-02-16 18:05:43 +01:00
Lukas Reschke
a7df23ceba Manually type-case all AJAX files
This enforces proper types on POST and GET arguments where I considered it sensible. I didn't update some as I don't know what kind of values they would support 🙈

Fixes https://github.com/owncloud/core/issues/14196 for core
2015-02-13 13:33:20 +01:00
Morris Jobke
573aa196d4 Properly show the warning about the missing composer autoloader 2015-01-31 20:48:58 +01:00
Morris Jobke
254a1fa12a Merge pull request from owncloud/login-hook-logout
Return false if the login is canceled in a hook
2015-01-22 23:34:19 +01:00
Robin Appelman
8eda661761 Throw an exception when login is canceled by an app 2015-01-22 14:13:17 +01:00
Lukas Reschke
5f31207e84 Add some more sanity checks for maintenance mode 2015-01-09 21:52:16 +01:00
Lukas Reschke
1c75b73239 Verify authentication before initializing apps and routing
The current behaviour of the authenticion logic in base.php prevents REST APIs in ownCloud applications to work.

Because `!self::$CLI` is usually always a true statement the previously above block was entered which returned, thus the authentication logic for this part does not trigger in.

This can be reproduced by installing apps such as the News app and issuing the following command:

`curl -u admin:admin http://localhost/index.php/apps/news/api/v1-2/feeds`

The following parts needs to get throughly tested:

- [ ] OCS
- [ ] remote.php's DAV features
- [ ] Regular login features

This bug affects master and stable7. I'd propose that we merge this for 8.0 since this has the potential to break every component that relies on Basic Auth features. A backport would also be very nice.

Remark to myself: We really need to move out the authentication code for 8.1 out of base.php - I already have a local branch that does that somewhere which I will get in shape for 8.1... - This untested code is a night-mare.

Fixes itself.
2015-01-09 21:07:29 +01:00
Jörn Friedrich Dreyer
606f802b7b move search results below filelist, show hint when results are off screen, use js plugin mechanism 2015-01-02 10:28:41 +01:00
Jörn Friedrich Dreyer
088323aad5 move code from js.js to search.js in the search app 2015-01-02 10:28:41 +01:00
Jörn Friedrich Dreyer
891474b0d6 Merge pull request from owncloud/core-reduce-js-and-css
make sure styles and scripts are only loaded once
2014-12-18 23:18:37 +01:00
Lukas Reschke
058324b80e Check basic auth header only for not-logged-in users 2014-12-17 21:42:07 +01:00
Lukas Reschke
b91a435ed4 Move basic auth login out of isLoggedIn
Potentially fixes https://github.com/owncloud/core/issues/12915 and opens the door for potential other bugs...

Please test very carefully, this includes:

- Testing from OCS via cURL (as in )
- Testing from OCS via browser (Open the "Von Dir geteilt" shares overview)
- WebDAV
- CalDAV
- CardDAV
2014-12-17 20:12:14 +01:00
Thomas Müller
51a22431ee load showpassord.js conditionally in the template only if needed 2014-12-16 18:45:37 +01:00
Morris Jobke
9f30d3529a Implement method that reads vendor libs from core.json
* includes them at the beginning of initTemplate()
2014-12-15 14:30:03 +01:00
Morris Jobke
edcd2f2706 bower jquery-ui - exported changes to a separate css file 2014-12-13 09:47:34 +01:00
Lukas Reschke
9ea205dc3d Check if open_basedir is set
The file:// protocol does not work with curl when an open_basedir is set.

This fixes https://github.com/owncloud/core/issues/12016
2014-12-11 00:09:55 +01:00
Morris Jobke
0d4f0ab871 reduce OC_Preferences, OC_Config and \OCP\Config usage
* files_encryption
* files_versions
* files_trashbin
* tests
* status.php
* core
* server container
2014-12-08 22:42:37 +01:00
Morris Jobke
f164161f69 fix base.php for not installed systems 2014-12-08 22:29:43 +01:00
Lukas Reschke
bd520d2e53 Create config if it does not exists
The codepath that is executed when executing ownCloud via CLI is different than via browser. Specifically, the config is created by the user session already in `OC_Util::getInstanceId()` by a call to `setValue`. That said, this seems to be quite a bad side-effect, but for the sake of "not breaking whatever might break if we touch this" let's keep it that way for now.

When executing the autoconfig via `php -f index.php` the said session was not setup and thus no `config/config.php` file was created resulting in an installation error.

To reproduce this try to setup ownCloud via `php -f index.php` with and without that patch. (ensure to delete all existing configs before and don't access ownCloud with a browser in the meantime)

Fixes itself.
2014-12-06 14:00:14 +01:00
Lukas Reschke
ddcf2b84ec Remove checks for safe mode and magic quotes
Both are removed from 5.4.0

Safe Mode: http://php.net/manual/en/features.safe-mode.php
> This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0.

Magic Quotes: http://php.net/manual/en/security.magicquotes.php
> This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0.
2014-12-05 19:14:47 +01:00
Thomas Müller
0769556989 Merge pull request from owncloud/read-only-config
Allow read-only configuration
2014-12-01 16:37:29 +01:00
Lukas Reschke
e35feadac2 Pass \OC::$WEBROOT to the ctr 2014-11-27 14:50:14 +01:00
Thomas Müller
5097d4dc05 remove deprecated \OC:$session 2014-11-26 15:32:47 +01:00
Lukas Reschke
fc116f563f Allow read-only configuration
Workaround required for IIS setups running ownCloud to prevent dataloss.

Long-term solution would be to move some configuration settings to the database
2014-11-25 16:26:47 +01:00
Morris Jobke
604bf61e10 Merge pull request from owncloud/clean-lib-base-config
replace all static calls to OC_Config and OC_Preferences to calls to OCP...
2014-11-20 16:24:37 +01:00
Thomas Müller
cbb9caf030 Merge pull request from owncloud/remove-phpass
Remove phpass and migrate to new Hasher interface
2014-11-20 14:59:59 +01:00
Morris Jobke
980dd4d22a replace double quotes with single quotes 2014-11-19 13:15:04 +01:00
Morris Jobke
fef9d4218c replace all static calls to OC_Config and OC_Preferences to calls to OCP\IConfig 2014-11-19 13:06:22 +01:00
Lukas Reschke
d0a30b0e55 Ignore port for trusted domains
This lead to a lot of confusion in the past and did not really offer any value. Let's remove the port check therefore. (it's anyways not really a part of the domain)

Fixes https://github.com/owncloud/core/issues/12150 and https://github.com/owncloud/core/issues/12123 and also a problem reported by @DeepDiver1975.

Conflicts:
	lib/private/request.php
2014-11-18 12:36:03 +01:00
Lukas Reschke
8595b76df2 Remove phpass and migrate to new Hasher interface
This PR removes phpass and migrates to the new Hasher interface.

Please notice that due to https://github.com/owncloud/core/issues/10671 old hashes are not updated but the hashes are backwards compatible so this shouldn't hurt.
Once the sharing classes have a possibility to update the passwords of single shares those methods should be used within the newHash if block.
2014-11-17 13:39:13 +01:00
Thomas Müller
4c1244f50c Merge pull request from owncloud/fix-11909
Add checkbox to enforce SSL for subdomains
2014-11-11 20:37:50 +01:00
Lukas Reschke
5b8a6b66b5 Load PHPAss via autoloader 2014-11-06 16:32:53 +01:00
Lukas Reschke
5f2a083686 Merge pull request from owncloud/clear-session-for-setup
Clear session before setup
2014-11-06 14:39:51 +01:00
Morris Jobke
73569b29bc md5 now handled via bower 2014-11-06 13:22:16 +01:00
Morris Jobke
e49b9022a1 bower snapjs 2014-11-06 12:03:57 +01:00
Morris Jobke
957dee5af1 bower underscore 2014-11-05 23:23:03 +01:00
Morris Jobke
74d375d8ea migrate jQuery to bower 2014-11-04 14:28:29 +01:00
Morris Jobke
1a405e56f5 replace moment.js with bower version
* fix JS unit tests
2014-11-03 20:54:50 +01:00
Thomas Müller
994768d99f Update Pimple to V3.0 2014-11-03 16:57:16 +01:00
Lukas Reschke
e73ccbd4ca Migrate "setsecurity.php" to the AppFramework
Add switch to enforce SSL for subdomains

Add unit tests

Add test for boolean values

Camel-case

Fix ugly JS
2014-11-03 16:53:03 +01:00
Thomas Müller
a4f0483f56 Update Symfony/Console to 2.5 & Update Symfony/Routing to 2.5 2014-11-03 13:52:47 +01:00
Lukas Reschke
d30fd23544 Clear session before setup
Fixes https://github.com/owncloud/core/issues/11861
2014-10-31 11:21:00 +01:00
Thomas Müller
105940b9dc Merge pull request from owncloud/oc8-translations
[OC8] Load javascript translations using standard web technologies
2014-10-29 13:09:02 +01:00
Vincent Petry
d71cd680dd Include core translations
Moved search result type translations to search.js

Load JS translations earlier

Translations need to be loaded earlier to make sure that some JS files
like search.js get access to translations at this time.

This requires the template initialization to be moved to after session
initialization, because only after the session we have access to the
current language.
2014-10-29 10:09:12 +01:00
Vincent Petry
ec1a73fab9 Added OC.L10N namespace with translation functions
Added addTranslations and fixed de.js file

Fixed de.js to use OC.L10N.register() and use to correct expected
format.

Added JS unit tests for OC.L10N class

Include translations JS script for all apps
2014-10-29 10:09:12 +01:00
Thomas Müller
46c2909c78 Update doctrine/dbal to 2.5 2014-10-28 15:39:37 +01:00
Thomas Müller
c93ddf77b9 Use composer autoloader to load Patchwork 2014-10-28 13:42:28 +01:00
Adam Williamson
0e3f2055d2 use Composer autoloader not OC for non-Composer 3rdparty ()
Composer's autoloader is rather better than the OwnCloud autoloader's
handling of non-OC classes. Plus we can rely on upstream Composer to
maintain it and not worry about it ourselves.

With this change, we drop the bits of OwnCloud's autoloader that
handled non-OC classes, and register the classes that were being
handled by that code with Composer's autoloader instead. As these
dependencies are converted to actually being managed by Composer,
the explicit registrations can be dropped as they won't be needed
any more.

Since OwnCloud's autoloader isn't going to handle non-OC classes any
more, we no longer need to test to make sure it does it right.

drop unneeded registerPrefix() and registerClass() from autoloader

Now we're not handling anything but OC's own classes, these are
unnecessary.

error out if composer autoloader is not found (thanks bantu)

We're never going to be able to work without the autoloader, if it's not
there we should just throw our hands up and surrender.
2014-10-28 11:32:20 +01:00
Lukas Reschke
d6380a5395 Merge pull request from owncloud/MakeSupportedDBsConfigurable
Make supported DBs configurable within config.php
2014-10-27 22:24:16 +01:00
Lukas Reschke
233c49f4b9 Make supported DBs configurable within config.php
This commit will make the supported DBs for installation configurable within config.php. By default the following databases are tested: "sqlite", "mysql", "pgsql". The reason behind this is that there might be instances where we want to prevent SQLite to be used by mistake.

To test this play around with the new configuration parameter "supportedDatabases".
2014-10-27 21:39:34 +01:00
Robin Appelman
0b96297783 Use the TempManager to handle temporary files 2014-10-24 12:18:49 +02:00
Morris Jobke
e2ff180521 Merge pull request from owncloud/eventlogger
Allow apps to gather performance diagnistics
2014-10-22 11:18:26 +02:00
Thomas Müller
2814a294c8 call initPaths() right before the server is instantiated 2014-10-21 14:10:57 +02:00
Thomas Müller
d9907b6fa3 move some deprecated usage of OC_Config and OC_AppConfig to \OC::server 2014-10-20 14:44:44 +02:00
Robin Appelman
9fd234f63f Log some additional events 2014-10-20 13:38:38 +02:00
Robin Appelman
1e69f5e7ac Log some basic events 2014-10-20 13:38:38 +02:00
Vincent Petry
9fc23e1967 Merge pull request from owncloud/datadir-write-setup
Don't complain about non-writable datadirs before we're installed
2014-09-25 14:32:32 +02:00
Lukas Reschke
4893d2c0ed Show login again instead of JSON if CSRF check fails
Previously a JSON error page was shown to the user in-case the CSRF token was not valid. This was confusing and prevented people from login.

With this at least the login page is shown again and not a JSON error message. I consider this as sufficient since adding a new error page just for this sake would uneededly make lib/base.php even more cluttered and this is a edge-case which optimally should anyways not happen that often.

This can be tested by opening the login page, then clearing the cookies, and trying to login.
2014-09-23 14:55:08 +02:00
Thomas Müller
bb18fe1384 send browsers timezone back tp the server on login 2014-09-22 14:01:45 +02:00
Thomas Müller
b1d0a0f3bf Merge pull request from owncloud/add-port-to-trusted-domain-wizard
Append port to trusted domain in case it's not 80 or 443
2014-09-22 10:04:02 +02:00
Lukas Reschke
d0d3b7457b Move BasicAuth check to "isLoggedIn()"
Ensures that Basic Auth works properly for APIs and removes the need for some even uglier lines of code.
2014-09-18 16:14:07 +02:00
Robin Appelman
6fa3280c2a Inject config into checkserver and cleanup tests 2014-09-18 13:33:13 +02:00
Lukas Reschke
c19bc1917b Move basic auth check
At the previous point not all apps were initialized. Now the basic auth check happens together at the same location as all others.

Fixes https://github.com/owncloud/core/issues/11129
2014-09-17 16:04:12 +02:00
Lukas Reschke
07b14bcd4f Merge pull request from owncloud/use-intl-module-master
use intl's native normalizer_normalize() in case the module is available
2014-09-15 14:13:30 +02:00
Thomas Müller
59209e0f2b use intl's native normalizer_normalize() in case the module is available 2014-09-11 10:24:31 +02:00
kondou
69f2c0544e Refresh if maintenance mode is over
Using status.php for this.
I modified status.php to also show, whether we're in maintenance.

Checks every 20 seconds if maintenance is over, if yes: reload.
2014-09-09 17:26:11 +02:00
Lukas Reschke
2590a4dc85 Append port to trusted domain in case it's not 80 or 443
Ref https://github.com/owncloud/core/pull/10584#issuecomment-54677059
2014-09-08 16:15:31 +02:00
Vincent Petry
d6bfd90bf8 Do not load extra user backends when an upgrade is due
Whenever an upgrade is due, do not load extra user backends
2014-09-08 12:30:04 +02:00
Lukas Reschke
c9afa60f62 Move trusted domain check to init()
handleRequest() is not called from remote.php or public.php which made these files party available but all included apps in there produced errors.

As the expected behaviour is anyways that a trusted domain warning is shown I moved this to init()

Fixes https://github.com/owncloud/core/issues/10064
2014-09-05 14:10:35 +02:00
Lukas Reschke
63a90a129b Use proper RNG generator
OC_Util::generateRandomBytes() only returns lowercase alphanumeric values.
We should use the new RNG which has a broader characterset.
2014-09-03 17:46:48 +02:00
Robin Appelman
3c618a0252 Also setup the filesystem when matching routes 2014-09-02 16:15:42 +02:00
Robin Appelman
a9a37b5363 Don't automatically setup the filesystem the moment we load OC\Files\FileSystem 2014-09-02 16:15:42 +02:00
Robin Appelman
d0266c0bf8 Use public api for getting l10n 2014-08-31 10:08:22 +02:00
Jörn Friedrich Dreyer
f687794a4a be correct in deprecation documentation 2014-08-29 10:22:21 +02:00
Jörn Friedrich Dreyer
f551917a3c kill OC::$session
maintain deprecated \OC::$session when getting or setting the session via the server container or UserSession

restore order os OC::$session and OC::$CLI

remove unneded initialization of dummy session

write back session when $useCustomSession is true

log warning when deprecated app is used
2014-08-29 10:22:21 +02:00
Georg Ehrke
f82b788ba5 add moment.js 2014-08-26 17:39:15 +02:00
Lukas Reschke
97b536e3df Add a trusted domain wizard
Adds a little button to the trusted domain warning, if an admin clicks on the warning he will be redirected to ownCloud and asked whether he want to trust this domain.

By far not the cleanest code, or clean at all, but does the job and I don't see a reason to make a lot of changes for this little improvement.
2014-08-21 22:22:35 +02:00
blizzz
52d5429768 Merge pull request from owncloud/removeLoadAppScript
Remove loadAppScriptFile
2014-08-21 19:59:31 +02:00
Lukas Reschke
ea2a45f19d Remove loadAppScriptFile 2014-08-19 15:16:49 +02:00
Lukas Reschke
fdb203ff1e Merge pull request from owncloud/iShallNotCopyStuffWithoutThinking
Add a copied_sample_config switch
2014-08-19 11:03:57 +02:00
Lukas Reschke
c33d1cacd4 Add a copied_sample_config switch
Hopefully this will stop people from copying the sample config. I'm so annoyed by all those wrong bug reports...

Add some explanation about this switch

Move check to init
2014-08-19 09:57:03 +02:00
Lukas Reschke
a822a31ce3 Merge pull request from owncloud/move-failed-logins
Move authentication failed logging to checkPassword
2014-08-15 16:50:28 +02:00
Lukas Reschke
5bb4772858 Move authentication failed logging to checkPassword
Fixes https://github.com/owncloud/core/issues/10366
2014-08-15 12:13:00 +02:00
Lukas Reschke
a4a897d26d Remove ability to trigger DEBUG mode via cookie
Users should not be able to enable debug mode on their own by setting a cookie. Using debug mode might leak too much information about the environment or have other unexpected behaviour.

We should backport this.
2014-08-15 11:21:56 +02:00
Jörn Friedrich Dreyer
fd798fd982 update deprecation docs 2014-08-14 12:22:34 +02:00
blizzz
54491e8c68 Merge pull request from gekmihesg/master
Load authentication backends before tryBasicAuth
2014-08-13 16:08:48 +02:00
gekmihesg
578a57f0fb Load authentication backends before tryBasicAuth 2014-08-10 13:29:32 +02:00
marc0s
f2e20757f6 Fix checking of NULL or empty OC::$THIRDPARTYROOT/OC::$THIRDPARTYWEBROOT
Fixes 
2014-07-30 23:24:55 +02:00
Morris Jobke
521934ee0d Merge pull request from owncloud/fix-thirdparty
Fix silent crash if 3rdparty dir is not available
2014-07-30 18:34:55 +02:00
Victor Dubiniuk
eb9bd200fa Replace exit with return 2014-07-30 14:03:31 +02:00
Victor Dubiniuk
31e7fdb9bf Fix silent crash if 3rdparty dir is not available 2014-07-30 14:03:31 +02:00
Andreas Fischer
a8fbc709ce Add registerAutoloaderCache(). 2014-07-29 11:18:40 +02:00
Andreas Fischer
9be8ac5867 Memcache\Factory: Remove static, use globalPrefix. 2014-07-29 11:14:36 +02:00
Andreas Fischer
da391b8932 InstanceId is properly injected into factory. Remove comment. 2014-07-29 11:03:10 +02:00
Thomas Müller
a3411e3719 Merge pull request from owncloud/localuser-addressbook
ownCloud users are exported as address book
2014-07-28 12:18:56 +02:00
Jörn Friedrich Dreyer
ec7a10f882 reorder if statements to remove negation, indentation correction 2014-07-25 19:39:29 +02:00
Thomas Müller
176ecbd311 ownCloud users are exported as address book 2014-07-24 17:35:02 +02:00
Thomas Müller
2594fb80aa don't silently exit in cli-mode in case ownCloud in not yet installed 2014-07-24 13:45:06 +02:00
Lukas Reschke
1c16d012ab Remove uneeded strip_tags
This `strip_tags` seems to be completely unneeded and will cause problems with passwords containing stripped characters. (e.g. `<` or `>`)

Needs https://github.com/owncloud/core/pull/9735 to be merged first.
2014-07-19 10:17:24 +02:00
Andreas Fischer
bfd59bddf4 Extract Auth Header logic into new function handleAuthHeaders(). 2014-07-19 02:21:18 +02:00
Andreas Fischer
fafed17c60 Deduplicate user/password extraction from alternative HTTP headers. 2014-07-19 02:06:37 +02:00
Joas Schilling
5d3e1bc023 Only calculate the WEBROOT from scriptName if it contains $SUBURI
If not we are most likely in CLI mode. However to be able to still
generate valid URLs, we need to use the overwrite webroot instead.

Fix 
2014-07-07 15:08:46 +02:00
Bjoern Schiessle
3c45925e74 fix hook names 2014-07-03 13:52:58 +02:00
Volkan Gezer
ae68a773c0 more strings to translate in utils also some fixes in defaults 2014-06-28 13:29:24 +02:00
Vincent Petry
a120d6e9a3 Bring back loadApps() in base.php
loadApps() had been deleted by mistake in
799205488c
2014-06-24 17:37:58 +02:00
Vincent Petry
799205488c Prevent loadApps on upgrade
Moved OC::needUpgrade() to OCP\Util::needUpgrade() to make it accessible
form the router.
Moved maintenance + upgrade check to the router.
2014-06-18 11:10:07 +02:00
Lukas Reschke
d4bdcb7a9b Merge pull request from owncloud/fix_preload_fundamental_apps
Load fundamental apps, before any possible customizing app may follow
2014-06-18 07:29:04 +02:00
Lukas Reschke
f2fc214ce0 Add deprecation notice to load* functions
This functions are deprecated and/or removed since ownCloud 7. Additionally a issubdirectory check has been added here to prevent developers to use this function in a potentially insecure way.

Port of https://github.com/owncloud/core/pull/9033
2014-06-16 20:33:04 +02:00
Arthur Schiwon
7b704eeb5e Load fundamental apps, before any possible customizing app may follow 2014-06-16 13:12:21 +02:00
Morris Jobke
63c5c7bd21 set logger before registrate to an error handler 2014-06-09 10:02:23 +02:00
Thomas Müller
289accc31b Merge pull request from owncloud/mobile-sidebar-swipe
Mobile sidebar swipe
2014-06-06 11:27:04 +02:00
Jan-Christoph Borchardt
9e56acbdc9 add snap.js script 2014-06-05 11:52:17 +02:00
Lukas Reschke
7c4abce373 Move authentication to it's own call 2014-06-05 11:45:45 +02:00
Lukas Reschke
ac7fb1b23e Remove legacy routing code
The getfile routing code was absolutely legacy and not needed anymore. Additionally \OC::$REQUESTEDAPP was never set to the actually accessed application.

This commit removes the legacy routing code and ensures that $REQUESTEDAPP is always set so that other applications (e.g. the firewall or a two-factor authentication) can intercept the currently accessed app.

Testplan:
[x] Installation works
[x] Login with DB works
[x] Logout works
[x] Login with alternate backend works (tested with user_webdavauth)
[x] Other apps are accessible
[x] Redirect on login works (e.g. index.php?redirect_url=%2Fcore%2Findex.php%2Fsettings%2Fapps%3Finstalled)
[x] Personal settings are accessible
[x] Admin settings are accessible
[x] Sharing files works
[x] DAV works
[x] OC::$REQUESTEDAPP contains the requested application and can be intercepted by other applications
2014-06-05 11:45:45 +02:00
Thomas Müller
1c20c72efe Merge pull request from owncloud/design-navigation-two
Toggle app navigation not only on mobile, but on desktop as well
2014-06-05 10:53:22 +02:00
Vincent Petry
95fda3c17c Do not load apps when upgrade is needed
This prevents routes like "core/js/oc.js" to automatically load apps and
trigger their update prematurely.
2014-06-04 18:52:52 +02:00
Jan-Christoph Borchardt
35308f5b09 hide navigation by default, not only on small screens, first step 2014-06-04 14:29:46 +02:00
Bernhard Posselt
ade6ed3797 Merge pull request from owncloud/slide-up-toggle
Create reusable data attribute for apps setting slideup
2014-06-04 11:31:04 +02:00
Jan-Christoph Borchardt
a244172219 Merge pull request from owncloud/design-typeface
Use Open Sans as typeface
2014-06-04 11:16:03 +02:00
Jan-Christoph Borchardt
6b2b903ea6 Merge pull request from owncloud/remove-infieldlabels
Remove infieldlabels
2014-06-04 09:28:20 +02:00
Morris Jobke
3a1994d001 Merge pull request from owncloud/session-early
Make the session available as early as possible
2014-06-03 19:23:30 +02:00
Jan-Christoph Borchardt
80627dfd2c use Open Sans as typeface 2014-06-03 19:07:08 +02:00
Morris Jobke
cea7d4961e move to updated version of placeholder 2014-06-03 16:18:06 +02:00
Jan-Christoph Borchardt
7177d3a496 first step of infield label removal, fix login screen 2014-06-03 15:28:59 +02:00
Robin Appelman
3e14affa9b Add some comments 2014-06-03 10:57:18 +02:00
Vincent Petry
4e957c7b18 Merge pull request from owncloud/csrf-on-login-and-logout
Add CSRF check on login and logout
2014-06-02 11:27:20 +02:00
Lukas Reschke
705242d390 Merge pull request from owncloud/upgrade-overview
Added update overview page
2014-05-29 21:28:47 +02:00
Lukas Reschke
ce9d5df6df Merge pull request from owncloud/logintimestamp
Record login timestamp per user. Required for new user managament.
2014-05-28 19:06:47 +02:00
Thomas Müller
f03a3d9d05 remove legacy OC_Filesystem being used in a hook callback 2014-05-28 00:13:54 +02:00
Vincent Petry
02f682b156 Now showing disabled apps as upgrade status line
- Added app id in update overview.
- Added status message for disabled app for CLI upgrade and web upgrade
2014-05-27 15:20:33 +02:00
Vincent Petry
146583a98d Added update overview page 2014-05-27 14:53:08 +02:00
Bernhard Posselt
c2330e558e rename to apps.js 2014-05-26 17:31:41 +02:00
Lukas Reschke
c03e7fcfa9 Clarify comment 2014-05-24 10:24:42 +02:00
Bernhard Posselt
db1511a11d add a slideup mechanism 2014-05-23 18:49:16 +02:00
Robin Appelman
8b56d52398 Make the session available as early as possible 2014-05-23 13:27:27 +02:00
Arthur Schiwon
2c89962919 clean up tryRememberLogin and save the timestamp of users last login 2014-05-21 18:03:37 +02:00
scolebrook
954d5b27ff use custom logfile path if defined, otherwise use default of owncloud.log in data directory 2014-05-20 11:29:59 -04:00
Thomas Müller
f8cb8f4803 Merge branch 'master' into csrf-on-login-and-logout
Conflicts:
	core/templates/login.php
2014-05-19 20:40:55 +02:00
Morris Jobke
dc36d30953 Remove all occurences of @brief and @returns from PHPDoc
* test case added to avoid adding them later
2014-05-19 17:50:53 +02:00
Thomas Müller
04e6c12fe2 Merge pull request from owncloud/custom_session_handling
Allow apps to create custom session handlers.
2014-05-19 15:58:30 +02:00
Robin McCorkell
bd3bf4b507 Change parameter order of implode 2014-05-13 19:08:14 +01:00
ringmaster
75bc25f906 Allow apps to create custom session handlers. 2014-05-12 11:08:28 -04:00
Thomas Müller
3cd32dcb7c adding X-Robots-Tag to all responses of ownCloud + move addSecurityHeaders() to OC_Response, which seems to be a more reasonable place 2014-05-12 15:14:01 +02:00
Lukas Reschke
fd5b2d11d6 Rename issubdirectory to isSubDirectory 2014-05-11 15:50:59 +02:00
Lukas Reschke
e1e1009ccc Redirect to index if the logout link is accessed without valid session
This is needed to prevent "Token expired" messages while login if a session is expired
@see https://github.com/owncloud/core/pull/8443#issuecomment-42425583
2014-05-11 13:09:46 +02:00
Lukas Reschke
73b914ddbc Add CSRF check on login and logout
This is a minor issue and not worth a backport in my opinion as it could break more things than it's worth having it.
2014-05-04 13:56:21 +02:00
Bernhard Posselt
906061a07b Merge pull request from owncloud/fix-import
be nice and use a relative import so people can use the class without fi...
2014-05-02 22:43:19 +02:00
Thomas Müller
7c0340c63c Merge pull request from josh4trunks/basic_auth_fix
Fixes login / logout when HTTP Basic Headers are avilable.
2014-04-28 21:46:52 +02:00
Thomas Müller
6935364b33 add class Pimple to autloader 2014-04-28 20:57:44 +02:00
Lukas Reschke
1d9ac38da6 Remove an added t by the github webeditor
Notice to myself: Stick to my IDE.
2014-04-27 16:41:09 +02:00
Lukas Reschke
7a8bfeae6e Grammatical fixes 2014-04-27 16:31:04 +02:00
Lukas Reschke
b6612ef04a Clarify the trusted_domain error page 2014-04-26 23:11:29 +02:00
Volkan Gezer
ff0dab6e92 This adds one more missing untranslated text from lib/share
Also displays the untrusted domain warning in English
2014-04-24 01:42:18 +02:00
Lukas Reschke
e88731a477 Some more PHPDoc fixes 2014-04-21 15:44:54 +02:00
Lukas Reschke
c123dc7de4 Fix typo
Thanks @DeepDiver1975
2014-04-14 10:15:31 +02:00
Lukas Reschke
387d46cb98 Typo + Line breaks 2014-04-13 12:54:26 +02:00
Lukas Reschke
df67a04385 Move security headers to base.php
Some headers were currently only added to the templates but not to other components (e.g. SabreDAV / JSON / etc...)
The migration to base.php ensures that the headers are served to all requests passing base.php
2014-04-13 11:51:03 +02:00
Thomas Müller
647abe512b reduce code duplication, fix parse error, prevent page reload on hitting enter while changing the display name - refs 2014-04-07 14:04:16 +02:00
josh4trunks
5b402aa846 Fixed Typo 2014-04-03 22:12:57 -07:00
josh4trunks
a266144750 Don't always $cookie_path, only set it when needed 2014-04-03 22:12:57 -07:00
josh4trunks
d1106f1749 cookie would be useless if value is not set 2014-04-03 22:12:57 -07:00
josh4trunks
63df8354da Don't to set the cookie it wasn't needed. 2014-04-03 22:12:57 -07:00
josh4trunks
4ddf5d92f2 Fixes login / logout when HTTP Basic Headers are avilable. 2014-04-03 22:12:57 -07:00
Vincent Petry
d0012e729a Merge pull request from owncloud/sharing_cleanup_public_api
sharing api cleanup, first step
2014-03-28 12:23:11 +01:00
Thomas Müller
5fa8f7cf12 Merge pull request from owncloud/load-apps-proper-master
Load apps proper master
2014-03-28 10:33:55 +01:00
Bjoern Schiessle
b602662578 add a "helper" and a "hooks" class. Move constants needed by multiple classes
to a "constants" class
2014-03-25 17:47:24 +01:00
icewind1991
4c8a83e82f Merge pull request from owncloud/phpunit-config
Allow setting the config dir to use as enviroment variable for phpunit
2014-03-24 13:01:37 +01:00
Thomas Müller
96e6cb3db4 all authentication apps are loaded at first - everything else relies on these apps 2014-03-21 15:00:25 +01:00
Thomas Müller
6ff96b34ad Merge branch 'master' into load-apps-proper-master
Conflicts:
	apps/files/ajax/rawlist.php
	cron.php
	ocs/v1.php
2014-03-21 14:05:08 +01:00
Vincent Petry
36c0f08ec0 Merge pull request from owncloud/datafolderexistence
Added .ocdata file to check for data folder validity
2014-03-20 11:31:28 +01:00
Thomas Müller
756bbe8786 Merge pull request from owncloud/routing-public
Move routing classes to an interface and expose it in the public api
2014-03-17 21:07:05 +01:00
Vincent Petry
b619ff6076 Return 503 when a config/data dir error exists 2014-03-14 21:05:15 +01:00