nextcloud-server

Commit Graph

Author	SHA1	Message	Date
Louis Chemineau	009d0c550c	fix: Move CSRF check from base to PublicAuth for public.php This currently prevent directly accessing a ressource when clicking on a link on a third party site. Example, clicking on `https://example.com/public.php/dav/files/pqLWcA269zfzXez/?accept=zip` in a GitHub comment. Skipping the check is an issue with password protected shares, as it allows third party sites to request the ressource when the user already entered the password, aka CSRF. So after removing the check from `base.php`, we need to add the it again in the `PublicAuth` plugin. We also add a redirect to be helpful to the user. Warning: this adds the limitation that clicking on a direct download link for password protected shares will redirect you to the password form, and then to the main share view. Fix #52482 Signed-off-by: Louis Chemineau <louis@chmn.me>	5 months ago
Ferdinand Thiessen	3d113ab6cc	refactor(dav): use Node API instead of private files view for filedrop plugin Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	5 months ago
provokateurin	46f5b07322	feat(dav): Enable chunked upload for public shares Signed-off-by: provokateurin <kate@provokateurin.de>	5 months ago
provokateurin	7f0953d520	refactor(dav): Replace baseuri manipulation with RootCollection for public shares Signed-off-by: provokateurin <kate@provokateurin.de>	5 months ago
Git'Fellow	5dcec08e98	fix(shares): Allow underscores on custom links Signed-off-by: Git'Fellow <12234510+solracsf@users.noreply.github.com>	6 months ago
provokateurin	81acb210ce	fix(dav): Fix share token pattern for base uri extraction Signed-off-by: provokateurin <kate@provokateurin.de>	7 months ago
Côme Chilliet	64863c9d46	chore: Apply new rector configuration to apps folder Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	8 months ago
Côme Chilliet	1580c8612b	chore(apps): Apply new rector configuration to autouse classes Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	12 months ago
John Molakvoæ (skjnldsv)	abd0cddd38	feat: make systemtags public visible Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>	1 year ago
Ferdinand Thiessen	bbc5d32c8e	fix(dav): Public WebDAV endpoint should allow `GET` requests `GET` should be allowed even without Ajax header to allow downloading files, or show files in the viewer. All other requests could be guarded, but this should not. Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	1 year ago
Ferdinand Thiessen	cb1b366baf	fix(dav): Ensure share properties are also set on public remote endpoint Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	1 year ago
skjnldsv	f28d933acc	feat(files_sharing): add public name prompt for files requests Signed-off-by: skjnldsv <skjnldsv@protonmail.com>	1 year ago
Robin Appelman	7a9efcf4cc	perf: remove full filesystem setup for accessing public link share dav endpoints Signed-off-by: Robin Appelman <robin@icewind.nl>	1 year ago
Andy Scherzinger	9d4b944098	chore: Add SPDX header Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>	1 year ago
Côme Chilliet	ec5133b739	fix: Apply new coding standard to all files Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
John Molakvoæ	20a0b9cbaf	fix(dav): ajax request check on public remote endpoints Signed-off-by: John Molakvoæ <skjnldsv@protonmail.com>	2 years ago
John Molakvoæ	9e4c9b97dd	fix(psalm): update baseline and suppress unnecessary issues Signed-off-by: John Molakvoæ <skjnldsv@protonmail.com>	2 years ago
John Molakvoæ	18399fc1cf	fix: improve typing and use \OCP\Server::get Signed-off-by: John Molakvoæ <skjnldsv@protonmail.com>	2 years ago
John Molakvoæ	82b5a19a35	fix: public dav and files_sharing testing fixes Signed-off-by: John Molakvoæ <skjnldsv@protonmail.com>	2 years ago
John Molakvoæ	7b6a650b6e	feat: public dav endpoint v2 Signed-off-by: John Molakvoæ <skjnldsv@protonmail.com>	2 years ago
Faraz Samapoor	0bae21b1d1	Refactors "strpos" calls in /apps/dav to improve code readability. Signed-off-by: Faraz Samapoor <f.samapoor@gmail.com>	2 years ago
John Molakvoæ (skjnldsv)	215aef3cbd	Update php licenses Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>	4 years ago
Robin Appelman	f824f273b6	add event for when a direct download is triggered Signed-off-by: Robin Appelman <robin@icewind.nl>	5 years ago
Christoph Wurst	d89a75be0b	Update all license headers for Nextcloud 21 Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	5 years ago
Christoph Wurst	2a054e6c04	Update the license headers for Nextcloud 20 Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	5 years ago
Morris Jobke	ecbc009e2f	Translate the maintenance mode message in webdav Signed-off-by: Morris Jobke <hey@morrisjobke.de>	5 years ago
Christoph Wurst	5bf3d1bb38	Update license headers Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Roeland Jago Douma	392337fa13	Throttle requests to unknown tokens Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	b3e7865d9b	Dav endpoint returns proper data Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	f984664bee	First step of DAV endpoint Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Morris Jobke	0eebff152a	Update license headers Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Vincent Petry	a829ac787a	Let apps register Sabre plugins or collections upstream #26761 Signed-off-by: Julius Härtl <jus@bitgrid.net>	8 years ago
Ko-	0024b67aaf	Check that set_time_limit is not disabled before calling it Signed-off-by: Ko- <k.stoffelen@cs.ru.nl>	9 years ago
Vincent Petry	0aaf209c66	Prevent PHP request to get killed when using fclose callback (#26775 ) * Prevent PHP request to get killed when using fclose callback * Add ignore_user_abort everywhere where the time limit is set to 0 Signed-off-by: Robin Appelman <robin@icewind.nl>	9 years ago
Joas Schilling	813f0a0f40	Fix apps/	9 years ago
Thomas Müller	682821c71e	Happy new year!	10 years ago
Thomas Müller	c79496b5a3	Introduced the new webdav endpoint remote.php/dav holding the principals and the files collection	10 years ago

37 Commits (5981b7eb512aa411f51cad541d01c5c6e93476f0)