nextcloud-server

Commit Graph

Author	SHA1	Message	Date
Côme Chilliet	eb23f27dee	fix: Use strict array comparisons in lib/ To avoid surprises with corner cases. Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	4 weeks ago
Côme Chilliet	dc49dbc4bb	chore: Add comment to make it clear the bail out for status.php should not be moved above ini_set calls. Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	5 months ago
Côme Chilliet	317044a68b	fix(status.php): Fix samesite cookies This skips less calls for status.php so that ini vars are correctly set and the code to set samesite cookies has the correct information when Nextcloud is installed in a subpath. Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	5 months ago
Josh	cef4f55077	fix(maintenanceMode): Refresh web page when turned off (part 1) Signed-off-by: Josh <josh.t.richards@gmail.com>	6 months ago
Daniel Calviño Sánchez	ac6b07356d	fix: Fix theming for disabled accounts The Theming app injects the stylesheets for the different themes in the "<header>" element of the page, and those stylesheets are then loaded by the browser from a "Controller" (a plain "Controller", not an "OCSController"). The stylesheets, in turn, may also get some images (like the background) also from the "Controller". When handling a request to "index.php" it is checked whether the user is logged in and, if not, a login is tried. A disabled user is explicitly seen as not logged in, so a login is always tried in that case, but disabled users are also explicitly prevented to log in, so the login also fails. Due to that trying to get any of the themed stylesheets or images with a disabled account (to be able to show the "Account disabled" error page) fails with an HTTP status 401. To solve that, and to avoid touching this basic logic as much as possible, the login exception is now ignored (if the user is disabled) for some specific requests to the Theming app. Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>	7 months ago
Louis Chemineau	7a0261878a	fix: Move CSRF check from base to PublicAuth for public.php This currently prevent directly accessing a ressource when clicking on a link on a third party site. Example, clicking on `https://example.com/public.php/dav/files/pqLWcA269zfzXez/?accept=zip` in a GitHub comment. Skipping the check is an issue with password protected shares, as it allows third party sites to request the ressource when the user already entered the password, aka CSRF. So after removing the check from `base.php`, we need to add the it again in the `PublicAuth` plugin. We also add a redirect to be helpful to the user. Warning: this adds the limitation that clicking on a direct download link for password protected shares will redirect you to the password form, and then to the main share view. Fix #52482 Signed-off-by: Louis Chemineau <louis@chmn.me>	9 months ago
Julius Knorr	44d6f4390e	perf: Log requests using high amount of memory as warning Signed-off-by: Julius Knorr <jus@bitgrid.net>	10 months ago
Joas Schilling	a7cee21ec1	fix(base.php): Correct order for booting \OC\Server A recent change had broken authentication with an older FastCGI Apache2 module, because the IRequest object got initialised before the fix from self::handleAuthHeaders() copied the authentication headers into the correct $_SERVER variables. Since this part is completely independent from any Nextcloud code it is now done as a first thing within the init() call. Additionally similar issues could happen when another class would boot too early and read other global PHP settings like ini values and default timezone, so those are now also moved to the beginning. Signed-off-by: Joas Schilling <coding@schilljs.com>	11 months ago
provokateurin	64ed0c05dd	fix(Share20): Convert broken hooks to IEventListener Signed-off-by: provokateurin <kate@provokateurin.de>	11 months ago
DaleBCooper	ed15fdf0a3	Fix A+ rating when checking with Nextcloud Security Scan. Due to commit `33d7019` session.cookie_secure=true is not set when accessing /status.php. This results in a degration from A+ to A rating due to missing __Host prefix for nc_sameSiteCookielax and nc_sameSiteCookiestrict cookies.	11 months ago
Côme Chilliet	b45bc2a462	fix: Use the new countUsersTotal method where it makes sense Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	1 year ago
Git'Fellow	33d7019f58	fix(status): Avoid session creation for status requests Signed-off-by: Git'Fellow <12234510+solracsf@users.noreply.github.com>	1 year ago
Ferdinand Thiessen	0cd626a059	fix: Do not check for strict cookie when running webcron Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	1 year ago
Julius Knorr	606241caeb	chore(legacy): Introduce public version ct plass and drop version methods from OC_Util Signed-off-by: Julius Knorr <jus@bitgrid.net>	1 year ago
provokateurin	9836e9b164	chore(deps): Update nextcloud/coding-standard to v1.3.1 Signed-off-by: provokateurin <kate@provokateurin.de>	1 year ago
Ferdinand Thiessen	9e979d42b4	fix(setup-checks): Ensure URL with webroot works We basically mock the way `URLGenerator::getAbsoluteURL` works, so we must make sure that the URL might already contain the webroot. Because `baseURL` and `cliURL` also contain the webroot we need to remove the webroot from the URL first. Co-authored-by: Ferdinand Thiessen <opensource@fthiessen.de> Co-authored-by: Daniel <mail@danielkesselberg.de> Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	1 year ago
Maxence Lange	9100b8757e	fix(setup): ignore long session login during installation Signed-off-by: Maxence Lange <maxence@artificial-owl.com>	1 year ago
Daniel Kesselberg	af6de04e9e	style: update codestyle for coding-standard 1.2.3 Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	1 year ago
Josh Richards	8032b6ac63	(base) Give a hint in web interface if SimpleXML (php-xml) is missing Fixes #2180 And prevents #31473, #23970, #18610, #15708 Avoids a 500 error and also gives a useful error message on the web interface if this module isn't installed, gets overlooked during a PHP upgrade, etc. While we check for it later, it's too late for session. Inspired by #17163 Signed-off-by: Josh Richards <josh.t.richards@gmail.com>	2 years ago
Christoph Wurst	2b38d6ae7e	fix(session): Log when session_* calls are slow Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	2 years ago
Côme Chilliet	5b9966feba	fix(occ): Use the const instead of hardcoded string for --debug-log option Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Côme Chilliet	9baf8fea8c	fix(occ): Move debug log listener setup to a static method, add option for level Also changed option from --debug to --debug-log to avoid conflicts Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Côme Chilliet	2ba0819243	feat(occ): Add a --debug option to output all log levels to the output Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Andy Scherzinger	dae7c159f7	chore: Add SPDX header Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>	2 years ago
Daniel Kesselberg	fedc80d4ea	chore: remove unnecessary ini_set Changing gc_maxlifetime cannot have any effect because this configuration option does not exist. There is a configuration option named session.gc_maxlifetime. I removed the ini_set call because autoconfiguring is error-prone, and the current code could never have worked as intended. Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	2 years ago
Côme Chilliet	b7acecd006	fix: Fix default values for ini var in lib/base.php Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Côme Chilliet	f2c36a55fe	fix: Remove unused endpoint from base.php It’s not called anymore, and app loading cannot break boot anymore Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
MichaIng	7b137ddd75	feat(updater): hide overwrites from disabled apps list on upgrade If an incompatible app is enabled manually, it is added to the "app_install_overwrite" array in config.php. Nextcloud upgrades won't disable any app in this array, but they were still shown on the upgrade page and logs as being disabled. This commit assures that only apps which are really disabled, i.e. which are not in the "app_install_overwrite" array, are shown and logged as disabled during upgrades. Signed-off-by: MichaIng <micha@dietpi.com>	2 years ago
Côme Chilliet	ccc66e912b	fix: Use DI for Setup class and move away from deprecated methods Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
John Molakvoæ	3214324b72	fix(l10n): invalid translation of a number fix https://github.com/nextcloud/server/issues/35252 Signed-off-by: John Molakvoæ <skjnldsv@users.noreply.github.com>	2 years ago
Joas Schilling	7998afe8b3	Talk federation authentication Signed-off-by: Joas Schilling <coding@schilljs.com>	2 years ago
Côme Chilliet	f68d4f7300	Remove deprecated methods Util::writeLog and DIContainer::log Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Arthur Schiwon	603a659a37	fix(autoloader): no apcu no side effects apcu lead to side effects especially with app management and (soft) inter-dependencies, and lead also to 500 server errors. While we could add management to clear apcu cache in many cases (may stil leave edge cases) the performance benefit is marginally as also class maps are already cached in opcache. Hence, the simple and effective way to go is to not use apcu for autoloading. Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	2 years ago
Alexander Piskun	01a11641f4	new name of AppEcosystem is AppAPI Signed-off-by: Alexander Piskun <bigcat88@icloud.com>	2 years ago
Joas Schilling	25309bcb45	techdebt(DI): Use public IThrottler interface which exists since Nextcloud 25 Signed-off-by: Joas Schilling <coding@schilljs.com>	2 years ago
Andrey Borysenko	d3583d3f30	Fix psalm ci (stub). Wrap server container with try-catch Signed-off-by: Andrey Borysenko <andrey18106x@gmail.com>	3 years ago
Alexander Piskun	ca76ab98bd	added Application Ecosystem V2 login handler Signed-off-by: Alexander Piskun <bigcat88@icloud.com>	3 years ago
Joas Schilling	0c5d0c2127	fix: Migrate collaboration listener and remove legacy adapter Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Joas Schilling	2014e7b836	fix(apps): Fix loading info.xml file Ref: https://bugs.php.net/bug.php?id=62577 Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Simon L	918859cafd	allow to specify upgrade.cli-upgrade-link in order to link to the correct documentation Signed-off-by: Simon L <szaimen@e.mail.de>	3 years ago
Simon L	d293293cda	Fixed bug which 'overwritewebroot' does not work with 'overwritecondaddr'. Signed-off-by: Takahiro Nagai <78393959+takahiro-blab@users.noreply.github.com> Signed-off-by: Simon L <szaimen@e.mail.de>	3 years ago
Simon L	84b88c01c7	adjust wording Signed-off-by: Simon L <szaimen@e.mail.de>	3 years ago
Simon L	6e5a307757	adjust wording for update hint when files of a specific app are not there Signed-off-by: Simon L <szaimen@e.mail.de>	3 years ago
Arthur Schiwon	bb4b34ff69	Read mtime of version.php only once - in most cases it would read again in \OC_Util::loadVersion anyway - remove some unused use statements Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	3 years ago
Arthur Schiwon	7519949f37	add the server roots and version info hash to apcu prefix fixes collissions when more than one instance is running on the same system For the memcaches we use a more complex prefix, where version and instance ID are incorporated. We do not have this data at hand at this point of time. But we can get the mtime of the version.php file relatively cheap. Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	3 years ago
Christoph Wurst	a06898a2d0	fix(security)!: Use consistent HTTP status for strict cookie checks Before: 503/412 Now: 412 + json body explaining the error Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Maxence Lange	fc29b0d1b7	app type extended_authentication Signed-off-by: Maxence Lange <maxence@artificial-owl.com>	3 years ago
Côme Chilliet	426c0341ff	Use typed version of IConfig::getSystemValue as much as possible Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	3 years ago
Joas Schilling	705165d3d1	fix(session): Fix DAVx5 sync problems by partial reverting session changes Temporary disabled the short cut again to solve issues with CalDAV/CardDAV clients like DAVx5 that use cookies and need a session. See https://github.com/nextcloud/server/issues/37277#issuecomment-1476366147 and the other comments for further information. Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Christoph Wurst	0e6fccf9e1	fix(security): Log failing strict cookie check The error is silent otherwise and makes it very hard to debug on a production system. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago

1 2 3 4 5 ...

1184 Commits (stable31)