wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
35255 commits 157 branches 562 tags 714 MiB
Commit graph

3035 commits

Author SHA1 Message Date
Jörn Friedrich Dreyer
f8352fcb8d
introduce callForSeenUsers and countSeenUsers (#26361) 
* introduce callForSeenUsers and countSeenUsers

* add tests

* oracle should support not null on clob

* since 9.2.0
 2016-10-28 08:44:05 +02:00
Morris Jobke
d4969abc9d Merge pull request #1800 from nextcloud/nextcloud-rich-object-strings 
Nextcloud rich object strings
 2016-10-27 15:30:58 +02:00
Roeland Jago Douma
b7046d390f
Remove internal share mail function 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-10-26 20:52:41 +02:00
Roeland Jago Douma
b98dfaccd9 Merge pull request #1920 from nextcloud/legacy-pages-should-also-receive-the-nonce 
Add nonce also to legacy CSP
 2016-10-26 16:41:34 +02:00
Morris Jobke
cde7f535bd Merge pull request #1738 from nextcloud/comments-provide-displaynames-with-mentions 
comment mentions: show displayname not uid
 2016-10-26 14:02:49 +02:00
Joas Schilling
c20ab0049f
Identify Chromium as Chrome 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-10-26 12:07:10 +02:00
Roeland Jago Douma
e351ba56f1
Move browserSupportsCspV3 to CSPNonceManager 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-10-25 22:03:10 +02:00
Morris Jobke
89574367bc Merge pull request #1871 from nextcloud/use-csp-nonces 
Use CSP nonces
 2016-10-25 14:46:00 +02:00
Lukas Reschke
740ff9108b Merge pull request #1884 from nextcloud/downstream-26292 
Fix logClientIn for non-existing users (#26292)
 2016-10-25 11:24:13 +02:00
Joas Schilling
890f752a6b Merge pull request #1452 from nextcloud/appconfig-endpoint 
Appconfig endpoint
 2016-10-25 10:57:48 +02:00
Roeland Jago Douma
593d52fe91
Fix and cleanup SessionTest 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-10-25 09:34:27 +02:00
Vincent Petry
6d1e858aa4
Fix logClientIn for non-existing users (#26292) 
The check for two factor enforcement would return true for non-existing
users. This fix makes it return false in order to be able to perform
the regular login which will then fail and return false.

This prevents throwing PasswordLoginForbidden for non-existing users.
 2016-10-25 09:34:27 +02:00
Lukas Reschke
38b3ac8213
Add ContentSecurityPolicyNonceManager 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2016-10-24 16:35:31 +02:00
Thomas Müller
03ec052b4e
App dependencies are now analysed on app enable as well - not only on app install. 2016-10-24 15:59:46 +02:00
Lukas Reschke
9e6634814e
Add support for CSP nonces 
CSP nonces are a feature available with CSP v2. Basically instead of saying "JS resources from the same domain are ok to be served" we now say "Ressources from everywhere are allowed as long as they add a `nonce` attribute to the script tag with the right nonce.

At the moment the nonce is basically just a `<?php p(base64_encode($_['requesttoken'])) ?>`, we have to decode the requesttoken since `:` is not an allowed value in the nonce. So if somebody does on their own include JS files (instead of using the `addScript` public API, they now must also include that attribute.)

IE does currently not implement CSP v2, thus there is a whitelist included that delivers the new CSP v2 policy to newer browsers. Check http://caniuse.com/#feat=contentsecuritypolicy2 for the current browser support list. An alternative approach would be to just add `'unsafe-inline'` as well as `'unsafe-inline'` is ignored by CSPv2 when a nonce is set. But this would make this security feature unusable at all in IE. Not worth it at the moment IMO.

Implementing this offers the following advantages:

1. **Security:** As we host resources from the same domain by design we don't have to worry about 'self' anymore being in the whitelist
2. **Performance:** We can move oc.js again to inline JS. This makes the loading way quicker as we don't have to load on every load of a new web page a blocking dynamically non-cached JavaScript file.

If you want to toy with CSP see also https://csp-evaluator.withgoogle.com/

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2016-10-24 12:27:50 +02:00
Roeland Jago Douma
ab91fa2660 Merge pull request #1820 from nextcloud/4byte-filenames 
Allow 4byte unicode filenames on supported platforms
 2016-10-24 10:38:25 +02:00
Roeland Jago Douma
7998689bc9
Added method to DB and fix test 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-10-24 09:45:04 +02:00
Roeland Jago Douma
eaf152efeb
Fix DateTime comparisson 
Datetime now returns microseconds. But if the database doesn't store
those comparing them for equality most likely fails.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-10-21 13:43:39 +02:00
Joas Schilling
0b1fb180a5
Make AppConfig part of the public API 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-10-21 09:09:23 +02:00
Morris Jobke
2799b0a821 Merge pull request #1835 from nextcloud/downstream-24948 
Move OC\Files\Storage\Shared to the right namespace
 2016-10-20 23:48:15 +02:00
Vincent Petry
9e9fef46d9
Get rid of very old oc:// stream wrapper (#26381) 2016-10-20 20:46:30 +02:00
Morris Jobke
c7ba73e6f4 Merge pull request #1824 from nextcloud/downstream-26423 
Ensure $commands being an array
 2016-10-20 20:43:26 +02:00
Vincent Petry
fca8bd44ab
Fix shared storage namespace in DecryptAll class 2016-10-20 20:36:50 +02:00
Joas Schilling
246bb9f33d
Move OC\Files\Storage\Shared to the right namespace 2016-10-20 20:27:44 +02:00
Thomas Müller
ef842ef20a
Ensure $commands being an array - fixes #26073 2016-10-20 15:40:27 +02:00
Morris Jobke
7836a8d8c7
use short array syntax 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2016-10-20 15:40:22 +02:00
Joas Schilling
9f2d9895a5
Restore all services when a tests failed/finished for better testcase isolation 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-10-20 15:19:41 +02:00
Joas Schilling
122edcd0c1
Make sure all tests use the TestCase method to overwrite services 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-10-20 15:19:41 +02:00
Arthur Schiwon
e5ce61b174
add missing methods to test fake manager 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2016-10-20 14:32:32 +02:00
Joas Schilling
b35d2fd8f2
Allow rich object subjects for Notifications 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-10-20 12:14:59 +02:00
Joas Schilling
2098648850
Add Rich Object Definitions and a validator 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-10-20 12:14:51 +02:00
Arthur Schiwon
5d98ab83e9
resolve displayname via manager and registerable resolvers 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2016-10-19 00:34:00 +02:00
Arthur Schiwon
fea3e20a80
move mention extraction to (I)Comment and report mentions via DAV 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2016-10-19 00:33:55 +02:00
Joas Schilling
303e073724
Do not skip when mysql uses utf8mb4 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-10-19 00:15:01 +02:00
Joas Schilling
43b7b143f4
Fix test of repair step 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-10-19 00:15:01 +02:00
Joas Schilling
17a2723948
Fix the test 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-10-19 00:15:01 +02:00
Morris Jobke
296a3274cf
only disable unicode test on mysql 2016-10-19 00:15:01 +02:00
Morris Jobke
972e560e72
Adding tests for 4 byte unicode characters 
* success on SQLite and Postgres
* failure on MySQL due to the limited charset that only supports up to 3 bytes
 2016-10-19 00:15:01 +02:00
Morris Jobke
96f8f209b9 Merge pull request #1449 from nextcloud/comments-user-mention 
Notifications for simple @-mentioning in comments
 2016-10-17 09:30:47 +02:00
Lukas Reschke
62e19dfa80 Merge pull request #1441 from nextcloud/getby-id-less-queries 
optimize Folder::getById to use less queries
 2016-10-14 15:18:23 +02:00
Christoph Wurst
53eb0f7f42 Merge pull request #1037 from nextcloud/no-double-token-update 
dont update the auth token twice
 2016-10-14 14:53:17 +02:00
Arthur Schiwon
1bcd2ca8e3
emit pre-update event for comments 
* notifications can be cleaned up, no polluted DB
* updating comments will re-notify users or remove notifications, depending on the message

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2016-10-12 18:06:22 +02:00
Robin Appelman
0d842e0550
optimize Folder::getById to use less queries 
Signed-off-by: Robin Appelman <robin@icewind.nl>
 2016-10-12 16:12:28 +02:00
Roeland Jago Douma
7eba1d806b
Add tests for commands in info.xml 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-10-11 19:48:31 +02:00
Thomas Müller
b1641cc113
Fix QueryBuilderTests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-10-11 12:30:46 +02:00
Robin Appelman
90db361827
Add test to ensure token times are updated 
Signed-off-by: Robin Appelman <robin@icewind.nl>
 2016-10-11 11:06:24 +02:00
Robin Appelman
25ed6714c7
dont update the auth token twice 
Signed-off-by: Robin Appelman <robin@icewind.nl>
 2016-10-11 11:05:25 +02:00
Roeland Jago Douma
3c173378e8
Fix typehint 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-10-10 22:13:51 +02:00
Thomas Müller
2806a4bca7
Cleanup test case 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-10-10 22:13:47 +02:00
Christoph Wurst
a0cb809342 Merge pull request #1660 from nextcloud/add-notification-icon-to-api 
Add an icon to the notification API
 2016-10-10 09:32:34 +02:00