24608 Commits (132ce04f319661ac33d3f83e013075a4d4e942d9)

 

All Branches   

Search

Author	SHA1	Message	Date
Vincent Petry	a672e9d556	Merge pull request #15814 from owncloud/public-reshare-webdav ... Fix webdav access for public reshare	10 years ago
Lukas Reschke	155ae44bc6	Fix collision on temporary files + adjust permissions ... This changeset hardens the temporary file and directory creation to address multiple problems that may lead to exposure of files to other users, data loss or other unexpected behaviour that is impossible to debug. **[CWE-668: Exposure of Resource to Wrong Sphere](https://cwe.mitre.org/data/definitions/668.html)** The temporary file and folder handling as implemented in ownCloud is performed using a MD5 hash over `time()` concatenated with `rand()`. This is insufficiently and leads to the following security problems: The generated filename could already be used by another user. It is not verified whether the file is already used and thus temporary files might be used for another user as well resulting in all possible stuff such as "user has file of other user". Effectively this leaves us with: 1. A timestamp based on seconds (no entropy at all) 2. `rand()` which returns usually a number between 0 and 2,147,483,647 Considering the birthday paradox and that we use this method quite often (especially when handling external storage) this is quite error prone and needs to get addressed. This behaviour has been fixed by using `tempnam` instead for single temporary files. For creating temporary directories an additional postfix will be appended, the solution is for directories still not absolutely bulletproof but the best I can think about at the moment. Improvement suggestions are welcome. **[CWE-378: Creation of Temporary File With Insecure Permissions](https://cwe.mitre.org/data/definitions/378.html)** Files were created using `touch()` which defaults to a permission of 0644. Thus other users on the machine may read potentially sensitive information as `/tmp/` is world-readable. However, ownCloud always encourages users to use a dedicated machine to run the ownCloud instance and thus this is no a high severe issue. Permissions have been adjusted to 0600. **[CWE-379: Creation of Temporary File in Directory with Incorrect Permissions](https://cwe.mitre.org/data/definitions/379.html)** Files were created using `mkdir()` which defaults to a permission of 0777. Thus other users on the machine may read potentially sensitive information as `/tmp/` is world-readable. However, ownCloud always encourages users to use a dedicated machine to run the ownCloud instance and thus this is no a high severe issue. Permissions have been adjusted to 0700.Please enter the commit message for your changes.	10 years ago
Thomas Müller	d1ef96dc9b	Merge pull request #15828 from owncloud/smb-1.0.1 ... update icewind/smb to 1.0.1	10 years ago
Thomas Müller	3b1a3cc27b	Merge pull request #15831 from owncloud/enc2-unittestcleanuptmpfile ... Delete temp files after testing encryption stream wrapper	10 years ago
Thomas Müller	6d3f120d23	Merge pull request #15617 from mmattel/getenv_system_check_and_warning ... Checks if getenv returns proper system environment variable results	10 years ago
Thomas Müller	8997d2f0d1	Merge pull request #15830 from owncloud/enc2-ajaxstatuswhenloggedin ... Only get encryption status when logged in	10 years ago
Robin Appelman	7a3a8e4032	fix subfolder reshares over webdav	10 years ago
Vincent Petry	b88d0ba0ac	Delete temp files after testing encryption stream wrapper	10 years ago
Vincent Petry	cc3bc6345b	Only get encryption status when logged in ... This removes useless warnings in the logs.	10 years ago
Joas Schilling	cb641b4c29	Fix file names	10 years ago
Joas Schilling	cfa23e60d3	Add tests for occ user:lastseen	10 years ago
Joas Schilling	eec92a16d6	Unify the output of the user commands and use DI	10 years ago
Joas Schilling	bb5b6e5f63	Add unit tests for occ user:delete	10 years ago
Joas Schilling	07627084e4	Check if the user exists before trying to delete him	10 years ago
root	35dbef55b5	Checks if getenv returns proper system variable results ... Updated texts and changed the variable name to match the query Updated text + info which path for php config is used removed the term ownCloud and squashed the commits Updated text	10 years ago
Jenkins for ownCloud	f8f354b351	[tx-robot] updated from transifex	10 years ago
Morris Jobke	37a5b62abb	Merge pull request #15639 from rullzer/fix_15368 ... Reset sharedialog values	10 years ago
Robin Appelman	57f49391dc	remove unneeded readonlycache	10 years ago
Robin Appelman	7eabd96e4c	update icewind/smb to 1.0.1	10 years ago
Robin Appelman	2adb79c794	resolve reshares in public webdav	10 years ago
Robin Appelman	03b7f1d015	use the permissions mask cache wrapper instead of the read only cache	10 years ago
Morris Jobke	42d9ba0f83	Merge pull request #15787 from owncloud/trash-partfiles ... Do not trash part files, delete directly	10 years ago
Morris Jobke	a971fa8a90	Merge pull request #15549 from owncloud/jcf-fix-cache-update ... don't update identical values	10 years ago
Martin	676e86b314	Improve error messge text for app upgrade try (#15375)	10 years ago
Björn Schießle	570718fb6b	Merge pull request #15757 from owncloud/enc-fixfeofforlastblock ... Fix encryption feof to not return too early	10 years ago
Jenkins for ownCloud	d7bdf60559	[tx-robot] updated from transifex	10 years ago
Thomas Müller	40fcc7480c	Merge pull request #15734 from owncloud/add-deprecate-tags ... Add @deprecated to all methods with a proper method in \OCP	10 years ago
Vincent Petry	ffc796edcb	Do not trash part files, delete directly	10 years ago
Morris Jobke	9dc12d40d8	Merge pull request #15782 from owncloud/hide-modified-multiselect ... hide modified header when multiselect is active, fix #15779	10 years ago
Thomas Müller	438cb27471	Merge pull request #15721 from oparoz/fix-readonly-cache ... Fix read-only cache	10 years ago
Björn Schießle	1ee2ee8432	Merge pull request #15690 from owncloud/enc_fix_upload ... [encryption] fix upload to sftp	10 years ago
Jan-Christoph Borchardt	723804ffd7	hide modified header when multiselect is active, fix #15779	10 years ago
Jan-Christoph Borchardt	1d1e188a7a	Merge pull request #15769 from owncloud/files-emptycontentreadonly ... Added empty content message for empty read-only folders	10 years ago
Morris Jobke	503243e191	Merge pull request #15770 from owncloud/fix-15764 ... bring back border in host input field for consistency	10 years ago
Bjoern Schiessle	19e8c4fcb1	get dirname from sharePath	10 years ago
Olivier Paroz	9695e33e34	Renamed class + split methods	10 years ago
Vincent Petry	53a23364ef	Added empty content message for empty read-only folders	10 years ago
Arthur Schiwon	52025e9839	save configs when requesting a config ID. They are empty, but avoid configID collisioning when creating many new configs in the wizard without saving anything directly.	10 years ago
Arthur Schiwon	8593415c12	LDAP Wizard: have always-increasing 'nth Server' number per full page load, fixes #15766	10 years ago
Morris Jobke	4b968da9e6	Merge pull request #15713 from owncloud/fix-15707-master ... [enc2] Fixing JS errors	10 years ago
Arthur Schiwon	19a2a22de1	bring back border in host input field for consistency	10 years ago
Thomas Müller	490e779424	doc and indent	10 years ago
Thomas Müller	4a2f8f81ca	Don't pollute the global namespace	10 years ago
Björn Schießle	b0fcf0fa0e	Merge pull request #15636 from owncloud/enc2_performance_improvement ... [encryption2] set size and unencrypted size to zero at the beginning of a write operation	10 years ago
Thomas Müller	edbcb834c7	Merge pull request #15753 from owncloud/remove-app-version-from-disabled-list ... Remove the app version from disabled app list	10 years ago
Jenkins for ownCloud	c548066d2c	[tx-robot] updated from transifex	10 years ago
Lukas Reschke	21ad4400af	Reword configuration text	10 years ago
Thomas Müller	55962c5f5a	make jshint happy ... This reverts commit ae681f0061.	10 years ago
Thomas Müller	3bc5c1c3cf	use a simple function - OC.Encryption is already defined - fixes #15707 ... This reverts commit 0ca6398aa3.	10 years ago
Thomas Müller	b78e76a1cb	Merge pull request #15677 from owncloud/enc_reset_private_key_password ... [encryption] let user update the private key password	10 years ago