nextcloud-server

Commit Graph

Author	SHA1	Message	Date
Ferdinand Thiessen	ab49a6d8a9	refactor: de-duplicate header styles, add comments and mark deprecations Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	5 months ago
Ferdinand Thiessen	088e5e6e7b	fix(theming): enforce theme also for login Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	9 months ago
Ferdinand Thiessen	182acb1e29	fix(template): Use `<div>` instead of `<main>` to support Vue3 apps mounting Vue3 does not replace the element while mounting but only renders within (replace inner HTML). So it would result in two stacked `<main>` elements which is invalid and an accessibility issue. Instead we just use a `<div>` element for mounting. For Vue2 apps this does not change anything as the whole element will be replaced with a new `<main>` element. For vanilla apps this will slightly decrease the accessibility as the main landmark is now missing, but this is not a hard accessibility issue as it would be for Vue3 apps having two main elements. Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	12 months ago
Ferdinand Thiessen	ec00367f30	fix: Disable auto-zoom on iOS When using iOS and focussing an input element the view should not be zoomed. So if we set a maximum scale iOS will not auto-zoom but still allow users to zoom. But we can not do this by default as this will disable user zoom on Chrome. Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	1 year ago
Ferdinand Thiessen	2916e5df7e	feat: Provide CSP nonce as `<meta>` element This way we use the CSP nonce for dynamically loaded scripts. Important to notice: The CSP nonce must NOT be injected in `content` as this can lead to value exfiltration using e.g. side-channel attacts (CSS selectors). Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	1 year ago
Grigorii K. Shartsev	885ec73603	chore(core): wrap initial state into hidden container Signed-off-by: Grigorii K. Shartsev <me@shgk.me>	1 year ago
Andy Scherzinger	e07a190641	chore: Add SPDX header Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>	2 years ago
Andrii Rublov	7142ea9227	php-cs-fixer fixes Signed-off-by: Andrii Rublov <airublev@outlook.com>	2 years ago
Andrii Rublov	8d22d341c8	[Bugfix]: Titles of pages (dashboard, apps-settings, users-settings) #43327 Signed-off-by: Andrii Rublov <airublev@outlook.com>	2 years ago
Joas Schilling	2fccd090b3	fix(manifest): Check if app exists instead of accessing null as an array Signed-off-by: Joas Schilling <coding@schilljs.com>	2 years ago
Ferdinand Thiessen	f62032e5c2	chore: Compile CSS assets Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	2 years ago
Ferdinand Thiessen	32ac5e7af8	fix(theming): Make sure the footer is hidden if not content is rendered Previously the footer was empty, but the backdrop was still shown. This hides the footer if no text content was defined. Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	2 years ago
Grigorii K. Shartsev	befec8cb3c	fix(core): remove unnecessary role=contentinfo from page footer on login `<footer>` has this role initially then it is a page footer, not inside `section`/`article`, and etc. Signed-off-by: Grigorii K. Shartsev <me@shgk.me>	2 years ago
Grigorii K. Shartsev	0e8abfd24c	fix(core): remove unnecessary role=banner on top level header By default, the HTML's `<header>` element has an identical meaning to the banner landmark, unless it is a descendant of `<aside>`, `<article>`, `<main>`, `<nav>`, or `<section>`. Signed-off-by: Grigorii K. Shartsev <me@shgk.me>	2 years ago
Richard Steinmetz	9a5a392bf9	fix: content info footer on guest pages Signed-off-by: Richard Steinmetz <richard@steinmetz.cloud>	2 years ago
Côme Chilliet	f5c361cf44	composer run cs:fix Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	3 years ago
John Molakvoæ	9af7ee8d11	Revert "Add alt to the logo, adapt css for logo" This reverts commit `bba5ab0532`.	3 years ago
julia.kirschenheuter	bba5ab0532	Add alt to the logo, adapt css for logo Signed-off-by: julia.kirschenheuter <julia.kirschenheuter@nextcloud.com> Signed-off-by: nextcloud-command <nextcloud-command@users.noreply.github.com>	3 years ago
julia.kirschenheuter	a8ff2ff0b0	Place ```<h1>``` into main content Signed-off-by: julia.kirschenheuter <julia.kirschenheuter@nextcloud.com>	3 years ago
Arnout Engelen	087deb9f1b	Disable browser translations This will tell the browser not to translate the text on the page, since this is very confusing given the good existing translation support in Nextcloud and the fact that the language the Nextcloud UI is set to might not match the language the content of the instance is in, leading to surprising effects. Better to disable it and remove the confusion. Fixes #34857 Signed-off-by: Arnout Engelen <arnout@bzzt.net>	3 years ago
Carl Schwan	458c2fa297	Remove OCP\App and OCP\BackgroundJob Both deprecated since NC 23 IAppManager is the replacement for OCP\App unfortunately it can't be dependency injected in classes used by the installed otherwise the database connection is initialised too early Signed-off-by: Carl Schwan <carl@carlschwan.eu>	3 years ago
Christopher Ng	92500e810f	Identify the login page explicitly by the page title Signed-off-by: Christopher Ng <chrng8@gmail.com>	4 years ago
John Molakvoæ (skjnldsv)	a1aaaaa0c8	Update and fix theming images Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>	4 years ago
MichaIng	ea0e45d81e	Remove legacy Internet Explorer headers X-UA-Compatible and X-Download-Options headers are interpreted or relevant for Internet Explorer only. With the deprecation of Internet Explorer support in Nextcloud 20 and planned support removal already in Nextcloud 22, these became obsolete and are hereby removed, including their removal from setup checks. Signed-off-by: MichaIng <micha@dietpi.com>	4 years ago
Christoph Wurst	caff1023ea	Format control structures, classes, methods and function To continue this formatting madness, here's a tiny patch that adds unified formatting for control structures like if and loops as well as classes, their methods and anonymous functions. This basically forces the constructs to start on the same line. This is not exactly what PSR2 wants, but I think we can have a few exceptions with "our" style. The starting of braces on the same line is pracrically standard for our code. This also removes and empty lines from method/function bodies at the beginning and end. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	44577e4345	Remove trailing and in between spaces Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Julius Härtl	3e081c43d9	Only add the app-itunes-app tag if the id is set Signed-off-by: Julius Härtl <jus@bitgrid.net>	6 years ago
Gary Kim	72b8083c11	Remove precomposed from apple-touch-icon-precomposed Signed-off-by: Gary Kim <gary@garykim.dev>	7 years ago
Dominik Wasielewski	782e828889	Remove unnecessary meta tags. Signed-off-by: Dominik Wasielewski <d-wasi@web.de>	7 years ago
Joas Schilling	08688af275	Fix OC.getCurrentUser() on guest pages Signed-off-by: Joas Schilling <coding@schilljs.com>	7 years ago
Roeland Jago Douma	f30877ea7c	Provide initial state Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	7b848368d5	Add locale to templates It was already added to the user template but we should add it to all templates. Else apps that want the locale but use special templating (hi richdocuments!) will fail. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Jan-Christoph Borchardt	0f9ba852bc	Fix form labels and main landmark on log in page Signed-off-by: Jan-Christoph Borchardt <hey@jancborchardt.net>	8 years ago
Jan-Christoph Borchardt	1c00f82ea5	Do not restrict zooming in Signed-off-by: Jan-Christoph Borchardt <hey@jancborchardt.net>	8 years ago
Ralph Slooten	be42df8e48	Referrer fix (no-referrer) Blocking referrer information should be done with "no-referrer" and not "never". See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy Signed-off-by: Ralph Slooten <axllent@gmail.com>	8 years ago
Morris Jobke	a661f043e1	Remove unneeded semicolon and parentheses Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
John Molakvoæ (skjnldsv)	21fbcba68d	Removed unwanted and unused spacer Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>	8 years ago
Julius Härtl	699c64c750	Add manifest.json to the login page Signed-off-by: Julius Härtl <jus@bitgrid.net>	8 years ago
Morris Jobke	585e5c6ea5	Logo claim is not used anymore Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Michael Letzgus	0d320fba4b	Streamline templates, more DRY Use Unified function to emit <link> tags for css loading, obey "Don't Repeat Yourself" ;-) (Next step might by to combine this with the emit <script> function (even more DRY?) AND move all this to a better place?) Signed-off-by: Michael Letzgus <michaelletzgus@users.noreply.github.com>	9 years ago
Michael Letzgus	fb9f13d4c1	Make page loading faster by deferred script loading: * Create generalized function for emmitting <script defer src=""> tags to templates * Remove type attribute from inline_js * Add defer attribute to external <script> tags Signed-off-by: Michael Letzgus <michaelletzgus@users.noreply.github.com>	9 years ago
Lukas Reschke	26f7a3b462	Check if Nextcloud is installed Fixes https://github.com/nextcloud/server/issues/4735 Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Robin Appelman	c50b7addc7	smaller max logo sizes and cleaner code Signed-off-by: Robin Appelman <robin@icewind.nl>	9 years ago
Robin Appelman	fa52f906e3	show non landscape icons bigger on the login page Signed-off-by: Robin Appelman <robin@icewind.nl>	9 years ago
Jan-Christoph Borchardt	9a75714c22	rename confusing getMailHeaderColor to getColorPrimary, ref #3491 Signed-off-by: Jan-Christoph Borchardt <hey@jancborchardt.net>	9 years ago
Roeland Jago Douma	1ae56b054b	Moving the inline js before the CSS This allows browsers to do smarted parallel downloads Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Jan-Christoph Borchardt	ea517b489f	use theming colors for favicon on macOS Signed-off-by: Jan-Christoph Borchardt <hey@jancborchardt.net>	9 years ago
Roeland Jago Douma	6dbe417c51	Inlince oc.js if possible! Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Lukas Reschke	38b3ac8213	Add ContentSecurityPolicyNonceManager Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	9e6634814e	Add support for CSP nonces CSP nonces are a feature available with CSP v2. Basically instead of saying "JS resources from the same domain are ok to be served" we now say "Ressources from everywhere are allowed as long as they add a `nonce` attribute to the script tag with the right nonce. At the moment the nonce is basically just a `<?php p(base64_encode($_['requesttoken'])) ?>`, we have to decode the requesttoken since `:` is not an allowed value in the nonce. So if somebody does on their own include JS files (instead of using the `addScript` public API, they now must also include that attribute.) IE does currently not implement CSP v2, thus there is a whitelist included that delivers the new CSP v2 policy to newer browsers. Check http://caniuse.com/#feat=contentsecuritypolicy2 for the current browser support list. An alternative approach would be to just add `'unsafe-inline'` as well as `'unsafe-inline'` is ignored by CSPv2 when a nonce is set. But this would make this security feature unusable at all in IE. Not worth it at the moment IMO. Implementing this offers the following advantages: 1. Security: As we host resources from the same domain by design we don't have to worry about 'self' anymore being in the whitelist 2. Performance: We can move oc.js again to inline JS. This makes the loading way quicker as we don't have to load on every load of a new web page a blocking dynamically non-cached JavaScript file. If you want to toy with CSP see also https://csp-evaluator.withgoogle.com/ Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago

1 2 3 4

151 Commits (9f3da00aacba89f525678395f2cd8302ff7d4e69)