wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
☁️ Nextcloud server, a safe home for all your data
26227 commits 157 branches 562 tags 714 MiB
PHP 56.1%
JavaScript 40.3%
Gherkin 1.2%
Vue 1%
SCSS 0.7%
Other 0.6%
Find a file
Lukas Reschke 8313a3fcb3 Add mitigation against BREACH 
While BREACH requires the following three factors to be effectively exploitable we should add another mitigation:

1. Application must support HTTP compression
2. Response most reflect user-controlled input
3. Response should contain sensitive data

Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed.

To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.
2015-08-14 01:31:32 +02:00
.idea Add newline that was removed by 15be763d46 2014-12-10 09:38:32 +01:00
3rdparty@b94f7d38f6 [provisioning api] Test for correct displayname 2015-08-11 13:01:37 +02:00
apps Merge pull request #18178 from owncloud/files-sidebar-actions 2015-08-13 17:17:10 +02:00
build Implement OCP Since Check for classes and interfaces 2015-07-27 10:49:45 +02:00
config Merge pull request #18065 from owncloud/new-trashbin-retention 2015-08-12 13:13:45 +02:00
core Merge pull request #18178 from owncloud/files-sidebar-actions 2015-08-13 17:17:10 +02:00
l10n files_encryption -> encryption 2015-04-14 16:18:12 +02:00
lib Add mitigation against BREACH 2015-08-14 01:31:32 +02:00
ocs Reduce duplicate code 2015-08-03 18:06:07 +02:00
ocs-provider Add endpoint with list of OCS providers 2015-06-27 18:23:49 +02:00
settings also don't count group members when more than 1 ldap configs are active 2015-08-13 14:44:17 +02:00
tests Add mitigation against BREACH 2015-08-14 01:31:32 +02:00
themes Revert "make knowledge base url configurable" 2015-08-11 14:20:25 +02:00
.bowerrc ability to add bower resources 2014-11-03 20:54:40 +01:00
.gitignore add example theme 2015-05-22 02:17:46 +02:00
.gitmodules use https as submodule url 2014-03-21 19:38:22 +01:00
.htaccess This will be 8.2 in the future 2015-07-01 10:06:26 -04:00
.jshintrc enable laxbreak option in jshintrc to comply with our coding guide lines 2014-11-04 12:51:54 +01:00
.mailmap add additional email address for Georg 2015-06-25 14:14:14 +02:00
.scrutinizer.yml Update comment 2015-06-28 17:06:49 +02:00
.tag Add .tag file to make tar balls tracable 2014-06-14 17:40:32 +02:00
.user.ini Use "off" and "off" instead of true booleans 2015-02-23 09:40:15 +01:00
AUTHORS Add myself as author 2014-09-19 17:24:12 +02:00
autotest-external.sh Replace replace with sed statement 2015-04-29 09:53:45 +02:00
autotest-hhvm.sh Combine autotest-hhvm.sh with autotest.sh 2015-05-04 16:37:23 +02:00
autotest-js.sh remove 'set -e' - causes issues during ci execution 2014-09-12 15:42:50 +02:00
autotest.cmd Restore the development config after running the tests 2014-12-02 12:41:33 +01:00
autotest.sh Add possible use of docker instance for MariaDB 2015-07-29 10:44:56 +02:00
bower.json add backbone.js 2015-08-06 00:00:40 +02:00
buildjsdocs.sh Added script to build the JS documentation 2014-10-31 13:27:36 +01:00
console.php Fix the config.php owner check for console.php 2015-07-09 23:19:52 +02:00
CONTRIBUTING.md Add information how to report security bugs 2015-05-29 19:28:45 +02:00
COPYING-AGPL Really add AGPL file 2011-02-09 15:12:09 +00:00
COPYING-README correct icon license, we use Elementary icons, not Silk anymore 2014-07-15 11:35:49 +02:00
cron.php Remove OC_Log 2015-07-03 18:00:16 +02:00
db_structure.xml Store storage availability in database 2015-07-20 16:27:26 +01:00
index.html Try to prefer index.php over index.html in the same directory 2013-04-24 15:11:53 +02:00
index.php Update license headers 2015-03-26 11:44:36 +01:00
indie.json add indie.json for Indie App Store listing 2014-06-29 22:03:24 +02:00
issue_template.md Add example command to the issue_template.md 2015-07-07 11:18:25 +02:00
occ Use a more universal shebang 2014-11-19 17:34:03 +01:00
public.php update license headers and authors 2015-06-25 14:13:49 +02:00
README.md Update version to 8.2 in README and bower 2015-07-07 10:21:20 +02:00
remote.php Fixing content type detection and handle all local printErrorPage calls 2015-06-30 15:05:59 +02:00
robots.txt Add robot.txt 2013-01-28 16:39:53 -06:00
status.php Fix maintenance refresh interval 2015-04-08 18:02:00 +02:00
version.php Bump version patch number, fixes #18129 2015-08-11 14:43:32 +01:00

README.md

ownCloud

ownCloud gives you freedom and control over your own data. A personal cloud which runs on your own server.

Build Status on Jenkins CI

Git master: Build Status

Quality:

  • Scrutinizer: Scrutinizer Quality Score
  • CodeClimate: Code Climate

Depencencies:

Dependency Status

Dependency Status

Installation instructions

https://doc.owncloud.org/server/8.2/developer_manual/app/index.html

Contribution Guidelines

https://owncloud.org/contribute/

Get in touch

Important notice on translations

Please submit translations via Transifex: https://www.transifex.com/projects/p/owncloud/

Transifex

For more detailed information about translations: http://doc.owncloud.org/server/8.2/developer_manual/core/translation.html