1217 Commits (master)

Author	SHA1	Message	Date
Carl Schwan	6eabaaf104	refactor: Deprecated user config from IConfig correctly ... Mark the methods in the interface deprecated instead of just the one in the implementation. Signed-off-by: Carl Schwan <carl.schwan@nextcloud.com>	2 weeks ago
Côme Chilliet	eb54143c2d	fix: Delete legacy OC_Response ... Moved the last used method in base.php where it’s called. Ideally we would remove it but it’s not clear whether that would be possible any time soon or even at all. Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	3 months ago
Ferdinand Thiessen	660f3f6fd1	refactor: use logical `&&` `||` instead of weak `and` `or` operators ... Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	3 months ago
Côme Chilliet	22160b9d2b	chore: Add comment to make it clear the bail out for status.php should ... not be moved above ini_set calls. Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	4 months ago
Joas Schilling	3df6d90a4c	Revert "perf(base): Stop setting up the FS for every basic auth request"	4 months ago
Côme Chilliet	34aaa0cf83	fix(status.php): Fix samesite cookies ... This skips less calls for status.php so that ini vars are correctly set and the code to set samesite cookies has the correct information when Nextcloud is installed in a subpath. Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	4 months ago
provokateurin	778c6c0d46	perf(base): Stop setting up the FS for every basic auth request ... Signed-off-by: provokateurin <kate@provokateurin.de>	4 months ago
Ferdinand Thiessen	7fe272fd74	fix(Coordinator): ensure the core app is loaded first ... Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	5 months ago
John Molakvoæ	2b50d9b2c5	Revert "perf(base): Stop setting up the FS for every basic auth request"	6 months ago
Daniel Calviño Sánchez	01766b18f8	fix: Fix theming for disabled accounts ... The Theming app injects the stylesheets for the different themes in the "<header>" element of the page, and those stylesheets are then loaded by the browser from a "Controller" (a plain "Controller", not an "OCSController"). The stylesheets, in turn, may also get some images (like the background) also from the "Controller". When handling a request to "index.php" it is checked whether the user is logged in and, if not, a login is tried. A disabled user is explicitly seen as not logged in, so a login is always tried in that case, but disabled users are also explicitly prevented to log in, so the login also fails. Due to that trying to get any of the themed stylesheets or images with a disabled account (to be able to show the "Account disabled" error page) fails with an HTTP status 401. To solve that, and to avoid touching this basic logic as much as possible, the login exception is now ignored (if the user is disabled) for some specific requests to the Theming app. Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>	6 months ago
provokateurin	0eae0e3c06	perf(base): Stop setting up the FS for every basic auth request ... Signed-off-by: provokateurin <kate@provokateurin.de>	6 months ago
Ferdinand Thiessen	5981b7eb51	chore: apply new CSFixer rules ... Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de> # Conflicts: # apps/settings/lib/SetupChecks/PhpOpcacheSetup.php	6 months ago
Côme Chilliet	e8bc35ec0a	fix(ocs): Return a proper error on JSON decoding failures ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	6 months ago
Josh	54142b2b20	fix(maintenanceMode): Refresh web page when turned off (part 1) ... Signed-off-by: Josh <josh.t.richards@gmail.com>	6 months ago
Samuel Bizien Filippi	a14cade3ac	feat(core): add cookie_domain config option ... Signed-off-by: Samuel Bizien Filippi <samuel.bizien-filippi@finances.gouv.fr>	6 months ago
Côme Chilliet	78ff8e233f	fix: Switch lazy object to enabled by default on PHP 8.4 ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	7 months ago
Côme Chilliet	2eed6d3a89	feat: Add a configuration toggle for lazy objects in DI ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	7 months ago
Ferdinand Thiessen	c21e189850	fix: make core application bootstrapable by coordinator ... Co-authored-by: Ferdinand Thiessen <opensource@fthiessen.de> Co-authored-by: Côme Chilliet <91878298+come-nc@users.noreply.github.com> Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	7 months ago
Côme Chilliet	7c251e4f96	fix: Remove useless legacy autoloader ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	7 months ago
Côme Chilliet	9560e00cf3	chore: Remove useless legacy autoloader for tests ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	7 months ago
Louis Chemineau	009d0c550c	fix: Move CSRF check from base to PublicAuth for public.php ... This currently prevent directly accessing a ressource when clicking on a link on a third party site. Example, clicking on `https://example.com/public.php/dav/files/pqLWcA269zfzXez/?accept=zip` in a GitHub comment. Skipping the check is an issue with password protected shares, as it allows third party sites to request the ressource when the user already entered the password, aka CSRF. So after removing the check from `base.php`, we need to add the it again in the `PublicAuth` plugin. We also add a redirect to be helpful to the user. **Warning**: this adds the limitation that clicking on a direct download link for password protected shares will redirect you to the password form, and then to the main share view. Fix #52482 Signed-off-by: Louis Chemineau <louis@chmn.me>	7 months ago
Ferdinand Thiessen	22889d4f1d	chore: deprecate `OC_Helper::isReadOnlyConfigEnabled` ... Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	7 months ago
Côme Chilliet	536ccf144c	feat(encryption): Migrate from hooks to events ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	8 months ago
Côme Chilliet	20c6d1a7e9	feat: Improve init a bit, and add more profiling steps ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	8 months ago
Julius Knorr	3fc9a99521	perf: Add config options to trigger individual and sample profiling using excimer ... Signed-off-by: Julius Knorr <jus@bitgrid.net>	8 months ago
Côme Chilliet	0cf4f3cc71	fix: Replace all usages of OC_User backend method calls by IUserManager ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	9 months ago
Côme Chilliet	b2100484c0	fix: Remove some call and references to deprecated OC_Util class ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	9 months ago
Joas Schilling	34bcc53fb9	fix(base.php): Correct order for booting \OC\Server ... A recent change had broken authentication with an older FastCGI Apache2 module, because the IRequest object got initialised before the fix from self::handleAuthHeaders() copied the authentication headers into the correct $_SERVER variables. Since this part is completely independent from any Nextcloud code it is now done as a first thing within the init() call. Additionally similar issues could happen when another class would boot too early and read other global PHP settings like ini values and default timezone, so those are now also moved to the beginning. Signed-off-by: Joas Schilling <coding@schilljs.com>	10 months ago
Côme Chilliet	f033ef7c18	fix: Migrate all uses of OCP\Template to OCP\Template\ITemplateManager ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	10 months ago
Côme Chilliet	71dc34c03c	fix: Deprecate OC_Template, add proper template manager instead ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	10 months ago
provokateurin	dd47daa4a8	fix(Share20): Convert broken hooks to IEventListener ... Signed-off-by: provokateurin <kate@provokateurin.de>	10 months ago
DaleBCooper	e1e0b68feb	Fix A+ rating when checking with Nextcloud Security Scan. ... Due to commit 33d7019 session.cookie_secure=true is not set when accessing /status.php. This results in a degration from A+ to A rating due to missing __Host prefix for nc_sameSiteCookielax and nc_sameSiteCookiestrict cookies.	10 months ago
Côme Chilliet	34139987d6	fix: Replace OC_App calls by IAppManager ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	10 months ago
Julius Knorr	d31bc88a23	perf: Log requests using high amount of memory as warning ... Signed-off-by: Julius Knorr <jus@bitgrid.net>	11 months ago
Côme Chilliet	a3685551f7	fix: Replace isInstalled calls with isEnabledForAnyone or isEnabledForUser ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	11 months ago
Côme Chilliet	b45bc2a462	fix: Use the new countUsersTotal method where it makes sense ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	12 months ago
Git'Fellow	33d7019f58	fix(status): Avoid session creation for status requests ... Signed-off-by: Git'Fellow <12234510+solracsf@users.noreply.github.com>	1 year ago
Ferdinand Thiessen	0cd626a059	fix: Do not check for strict cookie when running webcron ... Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	1 year ago
Julius Knorr	606241caeb	chore(legacy): Introduce public version ct plass and drop version methods from OC_Util ... Signed-off-by: Julius Knorr <jus@bitgrid.net>	1 year ago
provokateurin	9836e9b164	chore(deps): Update nextcloud/coding-standard to v1.3.1 ... Signed-off-by: provokateurin <kate@provokateurin.de>	1 year ago
Ferdinand Thiessen	9e979d42b4	fix(setup-checks): Ensure URL with webroot works ... We basically mock the way `URLGenerator::getAbsoluteURL` works, so we must make sure that the URL might already contain the webroot. Because `baseURL` and `cliURL` also contain the webroot we need to remove the webroot from the URL first. Co-authored-by: Ferdinand Thiessen <opensource@fthiessen.de> Co-authored-by: Daniel <mail@danielkesselberg.de> Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	1 year ago
Maxence Lange	9100b8757e	fix(setup): ignore long session login during installation ... Signed-off-by: Maxence Lange <maxence@artificial-owl.com>	1 year ago
Daniel Kesselberg	af6de04e9e	style: update codestyle for coding-standard 1.2.3 ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	1 year ago
Josh Richards	8032b6ac63	(base) Give a hint in web interface if SimpleXML (php-xml) is missing ... Fixes #2180 And prevents #31473, #23970, #18610, #15708 Avoids a 500 error and also gives a useful error message on the web interface if this module isn't installed, gets overlooked during a PHP upgrade, etc. While we check for it later, it's too late for session. Inspired by #17163 Signed-off-by: Josh Richards <josh.t.richards@gmail.com>	1 year ago
Christoph Wurst	2b38d6ae7e	fix(session): Log when session_* calls are slow ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	1 year ago
Côme Chilliet	5b9966feba	fix(occ): Use the const instead of hardcoded string for --debug-log option ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	1 year ago
Côme Chilliet	9baf8fea8c	fix(occ): Move debug log listener setup to a static method, add option for level ... Also changed option from --debug to --debug-log to avoid conflicts Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Côme Chilliet	2ba0819243	feat(occ): Add a --debug option to output all log levels to the output ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Andy Scherzinger	dae7c159f7	chore: Add SPDX header ... Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>	2 years ago
Daniel Kesselberg	fedc80d4ea	chore: remove unnecessary ini_set ... Changing gc_maxlifetime cannot have any effect because this configuration option does not exist. There is a configuration option named session.gc_maxlifetime. I removed the ini_set call because autoconfiguring is error-prone, and the current code could never have worked as intended. Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	2 years ago