nextcloud-server

Commit Graph

Author	SHA1	Message	Date
Roeland Jago Douma	def82c5077	Remove reflect method form public interface The reflect method is (and should) only every be called internally. Since if you call it again it would otherwise start mixing and matching arguments etc. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Roeland Jago Douma	35db32f504	Add deprecation warning Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Roeland Jago Douma	c40fe8b819	Do not enforce the parent constructor of response to be called If there is no policy set we just take the default empty ones. That way no obscure errors get thrown if the constructor is not called. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Roeland Jago Douma	c4cafae884	frame-src doesn't respect the nonce attribute Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Roeland Jago Douma	b8c5008acf	Add feature policy header This adds the events and the classes to modify the feature policy. It also adds a default restricted feature policy. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Roeland Jago Douma	f94ee72507	Add form-action CSP element Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	cd243b0876	No need to have these classes we tighten the default CSP from time to time Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	96e51b5f6f	Redirect to the right token on public shares If the token doesn't match (or isn't set) during the redirect. We should properly set it. Else we might redirect to a later auth display that set these values. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	7276735eb4	Set empty CSP by default For #14179 By default responses should have the strictest (and simplest) CSP possible. Only template responses should require an actual CSP. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Marius David Wieschollek	5aeb8eac2b	[#11236 ] Set parameter type in QBMapper Signed-off-by: Marius David Wieschollek <git.public@mdns.eu>	7 years ago
Roeland Jago Douma	4d8e1f6c67	CSP: set nonce for iframes This for now uses the jsNonce. That way we can easily backport it. For 17 I will fix it properly. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Joas Schilling	c5ab74348c	Avoid duplicate App container creation Signed-off-by: Joas Schilling <coding@schilljs.com>	7 years ago
Joas Schilling	3203d3e806	Allow apps to redirect to the default app Signed-off-by: Joas Schilling <coding@schilljs.com>	7 years ago
Morris Jobke	94b1b1593b	Remove public interface that was only needed for testing Signed-off-by: Morris Jobke <hey@morrisjobke.de>	7 years ago
Michael Weimann	bf1253cb49	Implement guest avatar endpoint Signed-off-by: Michael Weimann <mail@michael-weimann.eu>	7 years ago
Roeland Jago Douma	b68567e9ba	Add StandaloneTemplateResponse This can be used by pages that do not have the full Nextcloud UI. So notifications etc do not load there. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	d182037bce	Emit to load additionalscripts Fixes #13662 This will fire of an event after a Template Response has been returned. There is an event for the generic loading and one when logged in. So apps can chose to load only on loged in pages. This is a more generic approach than the files app event. As some things we might want to load on other pages as well besides the files app. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	ad676c0102	Set default frame-ancestors to 'self' For #13042 Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	64244e1a4f	CSP: Allow fonts to be provided in data Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Daniel Kesselberg	8a952b73d6	Access id property without getter. Some implementations typehint getId to integer but default is null. Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	7 years ago
Daniel Kesselberg	21b80a89b0	Fetch lastInsertId only when id null When id column has no autoincrement flag query for lastInsertId fails on postgres because no value has been generated. Call lastInsertId only if id is null. Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	7 years ago
Roeland Jago Douma	3ddc68f91b	Add IMapperException This way code using the DB mappers can have try catch blocks on this type of exceptions if they do not care if there was non or to many. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	58345e02d2	Basic CSP no longer deprecated Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	579822b6a5	Add report-uri to CSP Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	5b61ef9213	Disallow unsafe-eval by default Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Joas Schilling	840dd4b39c	Allow to inject/mock `new \DateTime()` similar to time() Signed-off-by: Joas Schilling <coding@schilljs.com>	7 years ago
Morris Jobke	bcbffdb644	Add PHPDoc Signed-off-by: Morris Jobke <hey@morrisjobke.de>	7 years ago
Roeland Jago Douma	7d9052d4b9	fixup! Add fix response Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	a891f42a5d	fixup! Add fix response Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Jakob Sack	a9fa220e68	Add fix response implements #7589	7 years ago
Christoph Wurst	3f594fc1b7	Document possibly thrown excption of QBMapper::insertOrUpdate Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	7 years ago
Christoph Wurst	40fdff5b80	Add QBMapper::insertOrUpdate() This allows elegant upserts where the entity ID is provided (e.g. by an external system) and when that data is fed into our database multiple times. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	7 years ago
Roeland Jago Douma	8354c50911	Deprecate the childSrc functions Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	c8fe4b4fc8	Add workerSrc to CSP Fixes #11035 Since the child-src directive is deprecated (we should kill it at some point) we need to have the proper worker-src available Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	c21cee248c	Disallow eval on the StrictEvalCSP Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	5455045a9b	Fix direct access to authen page Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	6de656e435	Update token on regeneration for public login Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	1bb8bc8ff9	Add AuthPublicShareControllerTest Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	61e445da88	Add PublicShareControllerTests Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	31392c2443	Move public auth page over Now this is in core so the basics (that 99% of the app will want to use) looks always the same. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	f36ef8ca80	Add the new PublicShareController and PublicShareMiddleware Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	b38fa573e1	Add stricter CSPs * Deprecate our default CSP * Add strict CSP that is always our strictest setting * Add strict eval CSP (disable unsafe-eval) * Add strict inline CSP (disables inline styles) This is just to move forward and have a incremental improvement of our CSP Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	a34495933e	Move caching logic to response This avoids having to do it at all the places we want cached responses. We can't inject the ITimeFactor without breaking public API. However we can perfectly overwrite the service (resulting in the same testable effect). Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	ed7b4839d9	The column is not user input so suppress the phan warning Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	74d7f6d4ca	Add a QueryBuilder Mapper Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Julius Härtl	6ded1c46b7	Add since tags Signed-off-by: Julius Härtl <jus@bitgrid.net>	8 years ago
Julius Härtl	2e60f91ab1	Move external share saving to template Signed-off-by: Julius Härtl <jus@bitgrid.net>	8 years ago
Julius Härtl	30e76f9f14	Add footer to public page template Signed-off-by: Julius Härtl <jus@bitgrid.net>	8 years ago
Julius Härtl	eb19899f8e	Move common menu templates to public API Signed-off-by: Julius Härtl <jus@bitgrid.net>	8 years ago
Roeland Jago Douma	129a608ebe	OCP\AppFramework\App strict Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago

1 2 3

108 Commits (4f31b7b9cc2dac060194de2c769b149a2ac861ba)