251 Commits (49cf5ba318add68160aede0e2ad624800983d183)

Author	SHA1	Message	Date
Joas Schilling	c1655bcde7	fix(ratelimit): Allow to bypass rate-limit from bruteforce allowlist ... Signed-off-by: Joas Schilling <coding@schilljs.com>	11 months ago
Maxence Lange	a6e8d41c25	fix(signed-request): trigger metadata insert with default value manually ... Signed-off-by: Maxence Lange <maxence@artificial-owl.com>	1 year ago
Maxence Lange	15b72281df	fix(signatory): details on interfaces ... Signed-off-by: Maxence Lange <maxence@artificial-owl.com>	1 year ago
Maxence Lange	4df3155523	fix(signed-request): removing unstable from public ... Signed-off-by: Maxence Lange <maxence@artificial-owl.com>	1 year ago
Maxence Lange	948547bd5d	fix(ocm): signatory mapper ... Signed-off-by: Maxence Lange <maxence@artificial-owl.com>	1 year ago
Maxence Lange	4b06620055	feat(signatory): switch to qbmapper ... Signed-off-by: Maxence Lange <maxence@artificial-owl.com>	1 year ago
Maxence Lange	862a411118	fix(ocm): simpler code ... Signed-off-by: Maxence Lange <maxence@artificial-owl.com>	1 year ago
Maxence Lange	f08d053290	fix(ocm): switching to IdentityProof ... Signed-off-by: Maxence Lange <maxence@artificial-owl.com>	1 year ago
Maxence Lange	4591430c9c	feat(ocm): signing ocm requests ... Signed-off-by: Maxence Lange <maxence@artificial-owl.com>	1 year ago
Benjamin Gaussorgues	1fd19685f1	chore(bruteforce): allows to configure max attempts before request abort ... Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	1 year ago
Christoph Wurst	1323e5bcb1	fix(migration): Decrypt ownCloud secrets v2 ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	1 year ago
Josh	077eea18b5	fix(security): Handle IPv6 zone IDs used in link-local addresses ... Signed-off-by: Josh <josh.t.richards@gmail.com>	1 year ago
Josh	4873dcbf1e	fix(security): Handle IPv6 zone IDs used in link-local addresses ... Signed-off-by: Josh <josh.t.richards@gmail.com>	1 year ago
dependabot[bot]	bb598c8451	chore(deps): Bump nextcloud/coding-standard in /vendor-bin/cs-fixer ... Bumps [nextcloud/coding-standard](https://github.com/nextcloud/coding-standard) from 1.3.1 to 1.3.2. - [Release notes](https://github.com/nextcloud/coding-standard/releases) - [Changelog](https://github.com/nextcloud/coding-standard/blob/master/CHANGELOG.md) - [Commits](https://github.com/nextcloud/coding-standard/compare/v1.3.1...v1.3.2) --- updated-dependencies: - dependency-name: nextcloud/coding-standard dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: provokateurin <kate@provokateurin.de>	1 year ago
Git'Fellow	a1681b0756	chore(db): Apply query prepared statements ... Fix: psalm fix: bad file fix: bug chore: add batch chore: add batch chore: add batch fix: psalm	1 year ago
Ferdinand Thiessen	db94e10af0	fix: Prevent breaking change in IQueryBuilder ... Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	1 year ago
Ferdinand Thiessen	e314d52118	fix: Adjust parameter type usage and add SQLite support ... Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	1 year ago
Git'Fellow	c254855222	chore(db): Correctly apply query types ... fix: psalm fix: error fix: add batch fix: fatal error fix: add batch chore: add batch chore: add batch fix: psalm fix: typo fix: psalm fix: return bool fix: revert Manager	1 year ago
provokateurin	54ec472d9a	fix(BackgroundJobs): Adjust intervals and time sensitivities ... Signed-off-by: provokateurin <kate@provokateurin.de>	1 year ago
Richard Steinmetz	19ad13571c	fix: gracefully parse non-standard trusted certificates ... Signed-off-by: Richard Steinmetz <richard@steinmetz.cloud>	1 year ago
provokateurin	9836e9b164	chore(deps): Update nextcloud/coding-standard to v1.3.1 ... Signed-off-by: provokateurin <kate@provokateurin.de>	1 year ago
Christoph Wurst	1ee833efab	refactor: Replace __CLASS__ with ::class references ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	1 year ago
Anna Larch	8af7ecb257	chore: adjust code to adhere to coding standard ... Signed-off-by: Anna Larch <anna@nextcloud.com>	1 year ago
Daniel Kesselberg	af6de04e9e	style: update codestyle for coding-standard 1.2.3 ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	1 year ago
Ferdinand Thiessen	2916e5df7e	feat: Provide CSP nonce as `<meta>` element ... This way we use the CSP nonce for dynamically loaded scripts. Important to notice: The CSP nonce must NOT be injected in `content` as this can lead to value exfiltration using e.g. side-channel attacts (CSS selectors). Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	1 year ago
Ferdinand Thiessen	86f01a3358	fix: Make sure CSP nonce is not double base64 encoded ... Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	1 year ago
Ferdinand Thiessen	9716b0d735	refactor: Migrate some legacy and core functions to `IFilenameValidator` ... Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	1 year ago
Benjamin Gaussorgues	f1d97a3188	feat(Security): add Factory for IP addresses and ranges ... Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	1 year ago
Joas Schilling	047479ccf9	feat(security): Add public API to allow validating IP Ranges and checking for "in range" ... Signed-off-by: Joas Schilling <coding@schilljs.com> Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	1 year ago
Benjamin Gaussorgues	202e5b1e95	feat(security): restrict admin actions to IP ranges ... Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	1 year ago
Christopher Ng	415edcac9b	chore: More explicit splitHash typing ... Signed-off-by: Christopher Ng <chrng8@gmail.com>	2 years ago
Christopher Ng	d9bf6c432e	feat: Add method to validate an IHasher hash ... Signed-off-by: Christopher Ng <chrng8@gmail.com>	2 years ago
Robin Appelman	e140907123	fix: don't use custom certificate bundle if no customer certificates are configured ... Signed-off-by: Robin Appelman <robin@icewind.nl>	2 years ago
Andy Scherzinger	dae7c159f7	chore: Add SPDX header ... Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>	2 years ago
Joas Schilling	b627e6efe4	fix: Correctly check result of function ... Signed-off-by: Joas Schilling <coding@schilljs.com>	2 years ago
Ferdinand Thiessen	5a513c924f	fix(CSP): Add CSP nonce by default and convert `browserSupportsCspV3` to blocklist ... Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	2 years ago
Andrew Summers	f9ce6bfdff	Refactor `OC\Server::getHasher` ... Signed-off-by: Andrew Summers <18727110+summersab@users.noreply.github.com>	2 years ago
Julius Härtl	02d6d3f5b1	fix: Add edge as supported user agent for CSPv3 nonces ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	2 years ago
Joas Schilling	33e1c8b236	fix(security): Handle idn_to_utf8 returning false ... Signed-off-by: Joas Schilling <coding@schilljs.com>	2 years ago
Joas Schilling	aa5f037af7	chore: apply changes from Nextcloud coding standards 1.1.1 ... Signed-off-by: Joas Schilling <coding@schilljs.com> Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	2 years ago
Ferdinand Thiessen	7df9eb3351	feat(ContentSecurityPolicy): Allow to set `strict-dynamic` on `script-src-elem` only ... This adds the possibility to set `strict-dynamic` on `script-src-elem` only while keep the default rules for `script-src`. The idea is to allow loading module js which imports other files and thus does not allow nonces on import but on the initial script tag. Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	2 years ago
Benjamin Gaussorgues	f04035caa0	Simplify IP address normalizer with IP masks ... Remove dead code Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	2 years ago
Faraz Samapoor	f313ca92e7	Refactors lib/private/Security. ... Mainly using PHP8's constructor property promotion. Signed-off-by: Faraz Samapoor <fsa@adlas.at>	2 years ago
Faraz Samapoor	1c023e6666	Update lib/private/Security/Certificate.php ... Co-authored-by: Côme Chilliet <91878298+come-nc@users.noreply.github.com> Signed-off-by: Faraz Samapoor <f.samapoor@gmail.com>	2 years ago
Faraz Samapoor	f9596edb00	Updates the typed properties. ... Based on: https://github.com/nextcloud/server/pull/39013#discussion_r1242340826 Co-authored-by: Côme Chilliet <91878298+come-nc@users.noreply.github.com> Signed-off-by: Faraz Samapoor <fsa@adlas.at>	2 years ago
Faraz Samapoor	4f46656d39	Refactors lib/private/Security. ... Mainly using PHP8's constructor property promotion. Signed-off-by: Faraz Samapoor <fsa@adlas.at>	2 years ago
Christoph Wurst	e477bb7eaf	feat(appframework): Expose programmatic rate limiter ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	2 years ago
Andrew Summers	1395a53602	Refactor `OC\Server::getSecureRandom` ... Signed-off-by: Andrew Summers <18727110+summersab@users.noreply.github.com>	2 years ago
Joas Schilling	124588d4a6	fix: Make bypass function public API ... Signed-off-by: Joas Schilling <coding@schilljs.com>	2 years ago
Joas Schilling	fd9b2d488e	feat: Expose if the own IP is allowed to bypass bruteforce protection ... Signed-off-by: Joas Schilling <coding@schilljs.com>	2 years ago