116 Commits (0a9150b2dadaf0ffd5ea096312683ccb792ae50d)

Author	SHA1	Message	Date
Lukas Reschke	8f09d5b67c	Update license headers	10 years ago
Vincent Petry	c7aef6c368	Fix uploading avatar and root certs in IE8	10 years ago
Lukas Reschke	6a4f22c61f	Use `/` if installed in main folder ... Otherwise an empty string is used indicating the cookie is only valid for those resources. This can lead to eunexpected behaviour. Fixes https://github.com/owncloud/core/issues/19196	10 years ago
Morris Jobke	b945d71384	update licence headers via script	10 years ago
Lukas Reschke	e735a9915c	Add blob: scheme to default CSP policy ... Fixes https://github.com/owncloud/core/issues/19438	10 years ago
Lukas Reschke	f9e90e92d4	Encode HTML tags in JSON ... While not encoding the HTML tags in the JSON response is perfectly fine since we set the proper mimetype as well as disable content sniffing a lot of automated code scanner do report this as security bug. Encoding them leads to less discussions and a lot of saved time.	10 years ago
Lukas Reschke	a7e4785be9	Cleanup OCS code ... This removes unused code from `OC_OCS` which nobody understood what it really was for anyways.	10 years ago
Thomas Müller	1d219cf799	With V2 we should ensure that the status codes are kept in sync	10 years ago
Roeland Jago Douma	f0b617b508	Use DI ... * Register OCP\Capability\IManager at DIContainer * Add register capabilities to appframework * Register capabilities in DI way * Make unit test pass again * Remove CapabiltiesManager from OCP	10 years ago
sualko	ead25de628	add data: to allowed image domains	10 years ago
Thomas Müller	3ecf7fce79	Fix unit test within OCSController	10 years ago
Thomas Müller	649cc2fa89	Remove duplicate and unused code	10 years ago
Lukas Reschke	62e3de1bdb	Check if response could get generated ... `json_encode` fails hard on PHP >= 5.5 if a non UTF-8 value is specified by returning false. Older PHP versions just nullify the value which makes it at least somewhat usable. This leads to very confusing errors which are very hard to debug since developers are usually not aware of this. In this case I'd consider throwing a fatal exception – since it arguably is an error situation – is a fair solution since this makes developers and administrators aware of any occurence of the problem so that these bugs can get fixed. Fixes https://github.com/owncloud/core/issues/17265	10 years ago
Morris Jobke	f63915d0c8	update license headers and authors	10 years ago
Morris Jobke	eddbdb8f21	Fix missing @since tags in OCP	10 years ago
Lukas Reschke	34f5541088	Add `no-store` to AppFramework	10 years ago
Lukas Reschke	a62190a72d	Add support for disallowing domains to the ContentSecurityPolicy ... For enhanced security it is important that there is also a way to disallow domains, including the default ones. With this commit every method gets added a new "disallow" function.	10 years ago
Morris Jobke	c056c52010	Add version to @deprecated tags	10 years ago
Morris Jobke	f72dabb4eb	fix wrong variable names in PHPDoc	10 years ago
Morris Jobke	7644950b48	Add @since tags to all methods in public namespace ... * enhance the app development experience - you can look up the method introduction right inside the code without searching via git blame * easier to write apps for multiple versions	10 years ago
Morris Jobke	1d30efdd73	Fix private member access of parent class in ocsresponse ... * noticed while checking PHPDoc	10 years ago
Jenkins for ownCloud	b585d87d9d	Update license headers	10 years ago
Lukas Reschke	e2453d78c0	Properly catch whether a share is `null` ... Despite it's PHPDoc the function might return `null` which was not properly catched and thus in some situations the share was resolved to the sharing users root directory. To test this perform the following steps: * Share file in owncloud 7 (7.0.4.2) * Delete the parent folder of the shared file * The share stays is in the DB and the share via the sharelink is inaccessible. (which is good) * Upgrade to owncloud 8 (8.0.2) (This step is crucial. The bug is not reproduceable without upgrading from 7 to 8. It seems like the old tokens are handled different than the newer ones) * Optional Step: Logout, Reset Browser Session, etc. * Access the share via the old share url: almost empty page, but there is a dowload button which adds a "/download" to the URL. * Upon clicking, a download.zip is downloaded which contains EVERYTHING from the owncloud directory (of the user who shared the file) * No exception is thrown and no error is logged. This will add a check whether the share is a valid one and also adds unit tests to prevent further regressions in the future. Needs to be backported to ownCloud 8. Adding a proper clean-up of the orphaned shares is out-of-scope and would probably require some kind of FK or so. Fixes https://github.com/owncloud/core/issues/15097	10 years ago
Bernhard Posselt	df24a014b8	If the execute method on the mapper receives an assoc array, it binds by value instead of index	10 years ago
Bernhard Posselt	f77ae37f23	also use backwards compatible method for mapper	10 years ago
Bernhard Posselt	c52bd10361	fix backwards compatibility for mapper execute method	10 years ago
Roeland Jago Douma	1a0f9c375b	Avatar controller moved to AppFrameWork ... * Original avatarcontroller migrated to the appframework * Added DataDisplayResponse that show data inline in the browser (used to retrun the image) * Removed some unneeded code * Added unit tests for the avatarcontroller	10 years ago
Lukas Reschke	cdced56f2b	Fix PHPDoc ... That apparently went lost when changing the signature.	10 years ago
Lukas Reschke	b29940d956	Add support for 'child-src' directive ... This is required when working with stuff such as PDF.js in the files_pdfviewer application. Opt-in only. Master change only because the stable CSP policies has a failback that allows nearly anything 🙈	10 years ago
Bernhard Posselt	95239ad21e	AppFramework StreamResponse ... First stab at the StreamResponse, see #12988 The idea is to use an interface ICallbackResponse (I'm not 100% happy with the name yet, suggestions?) that allow the response to output things in its own way, for instance stream the file using readfile Unittests are atm lacking, plan is to check if a mock of ICallbackResponse will be used by calling its callback (also unhappy with this name) method Usage is: $response = new StreamResponse('path/to/file'); rename io to output, add additional methods and handle error and not modified cases when using StreamResponse fix indention and uppercasing, also handle forbidden cases fix indention fix indention no forbidden, figuring out if a file is really readable is too complicated to get to work across OSes and streams remove useless import remove useless import fix intendation	10 years ago
Morris Jobke	06aef4e8b1	Revert "Updating license headers" ... This reverts commit 6a1a4880f0.	10 years ago
Bernhard Posselt	7b2fdbfb0b	use IDBConnection and close cursors after insert/update/delete	10 years ago
Bernhard Posselt	fb84e7d282	migrate to IDBConnection	10 years ago
Jenkins for ownCloud	6a1a4880f0	Updating license headers	10 years ago
Lukas Reschke	a9d1a01440	Rename to allowEval	10 years ago
Lukas Reschke	b20174bdad	Allow AppFramework applications to specify a custom CSP header ... This change allows AppFramework applications to specify a custom CSP header for example when the default policy is too strict. Furthermore this allows us to partially migrate away from CSS and allowed eval() in our JavaScript components. Legacy ownCloud components will still use the previous policy. Application developers can use this as following in their controllers: ```php $response = new TemplateResponse('activity', 'list', []); $cspHelper = new ContentSecurityPolicyHelper(); $cspHelper->addAllowedScriptDomain('www.owncloud.org'); $response->addHeader('Content-Security-Policy', $cspHelper->getPolicy()); return $response; ``` Fixes https://github.com/owncloud/core/issues/11857 which is a pre-requisite for https://github.com/owncloud/core/issues/13458 and https://github.com/owncloud/core/issues/11925	10 years ago
Bernhard Posselt	b89ddcfe41	fix license email	10 years ago
Bernhard Posselt	fdc64e370c	add a controller and reponse for ocs	10 years ago
Bernhard Posselt	37e8969d34	ignore cursorclosing	10 years ago
Georg Ehrke	f579f2bd94	add Download logfile button to admin settings ... add logSettingsController add download logfile button move getEntries to LogSettingsController move set log level to logsettingscontroller.php add warning if logfile is bigger than 100MB add unit test for set log level fix typecasting, add new line at EoF show log and logfile download only if log_type is set to owncloud add unit test for getFilenameForDownload	10 years ago
Bernhard Posselt	f195123765	Intelligent container ... * resolves dependencies by type hint or variable name * simpler route.php * implementation of https://github.com/owncloud/core/issues/12829 Generates and injects parameters automatically. You can now build full classes like $c->query('MyClassName') without having to register it as a service. The resolved object's instance will be saved by using registerService. If a constructor parameter is not type hinted, the parameter name will be taken. Therefore the following two implementations are identical: class Class1 { function __construct(MyClassName $class) class Class1 { function __construct($MyClassName) This makes it possible to also inject primitive values such as strings, arrays etc. In addition if the query could not be resolved, a `QueryException` is now thrown Routes can now be returned as an array from `routes.php` and an `appinfo/application.php` is optional Old commit messages: make it possible to return the routes instead of having to intialize the application try to get the controller by convention add first implementation of automatic resolve add another test just to be sure store the resolved object more tests add phpdoc to public app.php method use the same variable for the public app.php method deprecate old methods and add services for public interfaces deprecated getServer method disallow private api injection for apps other than core or settings (settings should be an app goddamnit :D) register userid because its such an often used variable fix indention and leading slash use test namespace add deprecation reasons, remove private api usage checks and remove deprecation from getServer() add additional public interfaces add public interface for rootfolder fix syntax error remove deprecation from methods where no alternative is there yet remove deprecated from method which has no alternative add timezone public service for #12881 add another deprecation hint move deprecation into separate branch remove dead comment first try to get the namespace from the info.xml, if it does not exist, just uppercase the first letter also trim the namespace name add an interface for timefactory move timefactory to public and add icontrollermethodreflector keep core interface fix copyright date in headers	10 years ago
Bernhard Posselt	ba03b0b843	add an interface for the timefactory class ... fix indention	10 years ago
Bernhard Posselt	6779bf113d	add isAdmin and isInGroup methods for the group manager	10 years ago
Bernhard Posselt	236632702c	add a isLoggedIn method to the usersession and deprecate the isLoggedIn method on the api	10 years ago
Bernhard Posselt	d59c4e832f	first round of deprecation	10 years ago
Bernhard Posselt	9ae48e184b	add a isLoggedIn method to the usersession and deprecate the isLoggedIn method on the api	10 years ago
Olivier Paroz	469fd3b3a3	Olivier Paroz \OCP\AppFramework\Utility\IControllerMethodReflector	10 years ago
Lukas Reschke	db9765b4d5	Merge headers ... Otherwise the headers from `JSONResponse` are gone and the Content-Type of the response would be `text/html` instead of `application/json; charset=utf-8`. This leads to broken scripts since we set the `nosniff` tag, furthermore this is very bad from a security PoV.	10 years ago
Lukas Reschke	048139074d	Add functions to modify cookies to response class ... Currently there is no AppFramework way to modify cookies, which makes it unusable for quite some use-cases or results in untestable code. This PR adds some basic functionalities to add and invalidate cookies. Usage: ```php $response = new TemplateResponse(...); $response->addCookie('foo', 'bar'); $response->invalidateCookie('foo'); $response->addCookie('bar', 'foo', new \DateTime('2015-01-01 00:00')); ``` Existing cookies can be accessed with the AppFramework using `$this->request->getCookie($name)`.	10 years ago
Lukas Reschke	4302a78b27	Deprecate older API wrappers and calls ... Those old classes have now non-static pendants and can be deprecated IMHO.	10 years ago