869 Commits (4eef8afe9b40e69b8a429b262ebe7952199ba74c)

Author	SHA1	Message	Date
Joachim Bauch	0173063923	Pass checked host as "domain" variable to "untrustedDomain" template. ... Currently the "SERVER_NAME" is passed to the template, which in some cases doesn't match the host returned by "getInsecureServerHost" (or is empty).	10 years ago
Thomas Müller	b01d50216e	The local address book is replaced now by the system addressbook as part of the dav app	10 years ago
Lukas Reschke	f32827e903	Ignore GD JPEG warnings ... Fixes https://github.com/owncloud/core/issues/21873	10 years ago
Morris Jobke	06fe4cabfc	move setup controller to core/controller	10 years ago
Thomas Müller	682821c71e	Happy new year!	10 years ago
Roeland Jago Douma	876fb83ddc	getMediumStrengthGenerator is deprecated and does not do anything anymore	10 years ago
Roeland Jago Douma	1a592e5745	Only '/tests' to be autoloaded when running unit tests	10 years ago
Roeland Jago Douma	fce8c42240	OC autoloader is not allowed to load 3rdparty	10 years ago
Lukas Reschke	74876fa6e7	Remove code related to session regeneration after some time ... I do not really consider this necessary or a real security addition. Let's get rid of it thus, cleans up the code and makes the logic easier.	10 years ago
Lukas Reschke	a58ca89e7f	Use ISession::clear ... The native approach using the PHP calls will not work properly with the cryptowrapper and thus this code is effectively doing nothing at the moment.	10 years ago
Lukas Reschke	0e561afe79	Check if app does exists	10 years ago
Lukas Reschke	fec41e7539	Move regeneration of session ID into session classes ... There were code paths that nowadays call ISession::login directly thus bypassing the desired regeneration of the session ID. This moves the session regeneration deeper into the session handling and thus ensures that it is always called. Furthermore, I also added the session regeneration to the remember me cookie plus added some test case expectations for this.	10 years ago
Morris Jobke	6f00729124	Refactor OC_Util::callCheck	10 years ago
Morris Jobke	ed98cdf532	Use OCP\Util::getVersion instead of the internal private implementation	10 years ago
Roeland Jago Douma	6fb60815c5	Use SystemConfig internally	10 years ago
Roeland Jago Douma	0a09004d39	Inject Config into SystemConfig	10 years ago
Roeland Jago Douma	82bf99c0cf	Get rid of legacy OC_Config ... We were still using the lecagy class OC_Config all over the place. Which was a wrapper around the new class OC\Config	10 years ago
Roeland Jago Douma	7e44ea5da0	Remove deprecated function OC_User::getManager ... Private deprecated function => removed Replaced all instances with suggested replacement	10 years ago
Lukas Reschke	1f69dcb593	Use URLGenerator instead of hard-coded WEBROOT ... Fixes https://github.com/owncloud/core/issues/20922	10 years ago
Lukas Reschke	4d9af08f12	Execute only for web and not for CLI	10 years ago
Lukas Reschke	125b7e7512	Ensure that ownCloud is always accessed with a trailing slash	10 years ago
Morris Jobke	675417a75c	Untangle the linkToDocs method in OC_Helper ... * now uses the proper URLGenerator interface * add comment about DI problems	10 years ago
Lukas Reschke	ba67dd9818	Add warning log entry when user accesses untrusted domain	10 years ago
Roeland Jago Douma	0bb5eadf89	[autoloader] Make sure to load construct full paths ... This reduces a lot of the autoloader magic and makes sure that we generate full paths in the autoloader.	10 years ago
Lukas Reschke	23e22c52b0	Use IRequest's `getScriptName` functionality instead of $_SERVER['SCRIPT_NAME']	10 years ago
Lukas Reschke	5588c5f262	Delete cookie instead of emptying value ... PHP will handle session cookies with an empty values as an E_WARNING error. ([php/#68063](https://bugs.php.net/bug.php?id=68063)) ownCloud sets the cookie to an empty value in case the session expires, it however after this starts a new session. Due to potential race conditions this can in unlikely cases lead to the fact that the session never gets restarted and the user is left with an empty cookie. PHP tries then to use the empty cookie which makes the instance not usable. To work around any race condition we now tell PHP to explicitly delete the value which can be done by using `null` as value, PHP will then send a cookie with the value "deleted". Also theepiration has been set to -1.	10 years ago
Joas Schilling	13dd62f7b0	Make sure that remote shares use the correct uid casing	10 years ago
Morris Jobke	b945d71384	update licence headers via script	10 years ago
Individual IT Services	fbe43e6a26	cache result of \OCP\Util::needUpgrade() ... reduce calls of \OCP\Util::needUpgrade() where \OCP\Util::needUpgrade() is called we can call as well self::checkUpgrade and use the cached result In line 877 the call way unnecessary anyway because of the first part of the if statement move caching to \OCP\Util::needUpgrade renaming variable fixing testNeedUpgradeCore() cache result of checkUpgrade() in self::$needUpgrade reduce calls of \OCP\Util::needUpgrade() where \OCP\Util::needUpgrade() is called we can call as well self::checkUpgrade and use the cached result In line 877 the call way unnecessary anyway because of the first part of the if statement move caching to \OCP\Util::needUpgrade renaming variable fixing testNeedUpgradeCore() fix typo in variable name deleting tabs	10 years ago
Individual IT Services	bf1cb20e90	do not load unnecessary code in case of webdav ... changing from "protected static" to "protected" as suggested by @nickvergessen https://github.com/owncloud/core/pull/19114#discussion_r39719851 moving initTemplate() into template constr. reduce to move initTemplate only cleanup spaces	10 years ago
Phil Davis	a165710e99	Minor text typos ... that I noticed while looking at some code.	10 years ago
Georg Ehrke	b3ff773bbf	delete cached preview when rolling back file's version ... add random number using OC.parseQueryString and _.extend() version rollback: add missing prefix to OC\Preview::post_delete add test to assure that the rollback hook is called	10 years ago
Robin McCorkell	f8619870ea	Remove get_temp_dir()	10 years ago
Lukas Reschke	65ebba44ce	Allow /tests folder in autoloader by default ... Given the fact that "/tests" is not shipped by default and this has broken some applications and frustrated quite some people we should add "/tests" to the default allowed autoloading set. I do consider the security impact marginally since the /tests folder is not shipped within the release as well as usually has a hard requirement on being called by phpunit.	10 years ago
Robin McCorkell	b3acf09c60	Only add valid root for enabled apps	10 years ago
Morris Jobke	038b09b0b0	Proper details about git submodule update ... * fixes #18801	10 years ago
Individual IT Services	cd0a5372ee	reuse existing $systemConfig variable	10 years ago
Robin Appelman	e9b91b1798	verify the path in the autoloader	10 years ago
root	acae208f2f	moved code to /lib/private/tempmanager.php ... fix for unit test some fixes	10 years ago
Morris Jobke	e88b380973	Remove DEBUG constant and use config value ... * introduces config.php option 'debug' that defaults to false * migrate DEBUG constant to config value	11 years ago
Joas Schilling	36eef2ddab	Add a session wrapper to encrypt the data before storing it on disk	11 years ago
Vincent Petry	a2674b2b30	Additions to update page ... Apps to update and to disable will always be shown. Main title changes only when apps need updated, not core. Added bullet style. Exclude incompatible apps from updated apps list.	11 years ago
Vincent Petry	b919ae96f0	Display app names in update page for app updates ... Whenever the update page is displayed for apps, show app names instead of the core update text.	11 years ago
Lukas Reschke	8313a3fcb3	Add mitigation against BREACH ... While BREACH requires the following three factors to be effectively exploitable we should add another mitigation: 1. Application must support HTTP compression 2. Response most reflect user-controlled input 3. Response should contain sensitive data Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed. To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.	11 years ago
Arthur Schiwon	ffaf5fed0e	load backbone universally	11 years ago
Thomas Müller	c3cac887f5	- more injection ... - less static calls - use params on sql queries - handle sql exception on database and user creation gracefully	11 years ago
Morris Jobke	5265a44260	Remove commented code	11 years ago
Bjoern Schiessle	058d910f5e	intproduce pre_addToGroup hook. we need to calculate the possible unique ... targets before the user was added to the group otherwise we will always detect a name collision	11 years ago
Roeland Jago Douma	c8145cdbd6	Javascript mimetype icon resolver ... This makes it possible to retrieve the icon for mimetypes in javascript. It makes no additional queries to the server to retrieve the mimetype. * config/mimetypealiases.json added * mimetype.js: this is where the logic resides to convert from mimetype to icon url * mimetypelist.js: generated file with a list of mimetype mapping (aliases) and the list of icon files * ./occ maintenance:mimetypesjs : new command for occ to gernerate mimetypes.js * unit tests updated and still work * javascript tests added * theming support * folder of the theme is now present in javascript (OC.theme.folder)	11 years ago
Thomas Müller	d3ac73c0c9	Remove OC_Log	11 years ago