nextcloud-server

Commit Graph

Author	SHA1	Message	Date
Morris Jobke	0eebff152a	Update license headers Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Morris Jobke	ce0c45a4ea	Use proper DI for security middleware for app enabled check Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Roeland Jago Douma	c257cd57d4	Handle SameSiteCookie check for index.php in AppFramework Middleware Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Joas Schilling	c4b3198ac2	Rethrow the correct exception when there was an error in an app container Signed-off-by: Joas Schilling <coding@schilljs.com>	8 years ago
Bjoern Schiessle	9524badccc	extend the identity proof manager to allow system wide key pairs Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>	9 years ago
Roeland Jago Douma	ede15f0988	Fix L10N::t Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	5f227bd93b	More phpstorm inspection fixes Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Bjoern Schiessle	7c2d473d76	add new config switched for the global scale architecture Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>	9 years ago
Joas Schilling	ca39940614	Automatic creation of Identity manager Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Lukas Reschke	8149945a91	Make BruteForceProtection annotation more clever This makes the new `@BruteForceProtection` annotation more clever and moves the relevant code into it's own middleware. Basically you can now set `@BruteForceProtection(action=$key)` as annotation and that will make the controller bruteforce protected. However, the difference to before is that you need to call `$responmse->throttle()` to increase the counter. Before the counter was increased every time which leads to all kind of unexpected problems. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Roeland Jago Douma	aef95b9b7d	Not needed in the DIContainer anymore Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	0c2dc3bc8c	Fix comments Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Lukas Reschke	a1ae5275f9	Move to dedicated MiddleWare Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	d729bde98c	Register in ServerContainer Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	66835476b5	Add support for ratelimiting via annotations This allows adding rate limiting via annotations to controllers, as one example: ``` @UserRateThrottle(limit=5, period=100) @AnonRateThrottle(limit=1, period=100) ``` Would mean that logged-in users can access the page 5 times within 100 seconds, and anonymous users 1 time within 100 seconds. If only an AnonRateThrottle is specified that one will also be applied to logged-in users. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Roeland Jago Douma	53bca14a27	Do proper DI Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Bjoern Schiessle	45aee2e479	provide public discovery service to discover OCS end-points on another server Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>	9 years ago
Joas Schilling	5695a4ec92	Don't do a recursive search Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Joas Schilling	9208f6379c	buildAppNamespace already has the fallback Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Roeland Jago Douma	67909cf87b	Make DI work for all apps As stated in https://github.com/nextcloud/server/pull/3901#issuecomment-288135309 appid's don't have to match the namespace. Work around this Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	92f50c7d87	Core is also a special app Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	48c34522ed	Move a lot of stuff over to the ServerContainer Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	c92b9ce2c4	Fix settings tests Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	21641302a9	Add DI intergration tests * Moved some interface definitions to Server.php (more to come) * Build/Query only for existing classes in the AppContainer * Build/Query only for classes of the App in the AppContainer * Offload other stuff to the servercontainer Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	7cece61ff6	Extend DI tests Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	246e9ce547	More elegant handling of recursion Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	df14684817	PoC of moving the interface classes to the servercontainer Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	886202123c	Update query method for DIContainer To align with https://github.com/nextcloud/server/issues/2043#issuecomment-287348294 This would mean that AppContainers only hold the AppSpecific services Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Sebastian Wessalowski	e399097e3a	Remove deprecated OC_User::isLoggedIn Signed-off-by: Sebastian Wessalowski <sebastian@wessalowski.org>	9 years ago
Morris Jobke	552921d429	Fix injection of defaults Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Morris Jobke	50f3efad6f	OCS API endpoint to resend welcome message * send a POST request to ocs/v1.php/cloud/users/USERNAME/resendWelcomeMessage to trigger the welcome message to be send * fixes #3367 example curl statement: curl -i https://example.org/ocs/v1.php/cloud/users/USERNAME/welcome -H "OCS-APIRequest: true" -u admin:password -X POST Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Joas Schilling	0be2921966	Fix DI of the cloud id manager into apps Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Joas Schilling	efdc51c155	Make sure to use the right appdata directory Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Bjoern Schiessle	df296249d6	introduce brute force protection for api calls Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>	9 years ago
Christoph Wurst	a6dca9e7a0	add login credential store Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	9 years ago
Roeland Jago Douma	1e44a15dd1	No need for the CssManager * It is a simple wrapper we can always add it later if needed Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
John Molakvoæ (skjnldsv)	1f769e6e76	Fix php docs Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>	9 years ago
John Molakvoæ (skjnldsv)	1caaa7f4cd	Appdata integration 2 Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>	9 years ago
Joas Schilling	bc3da3a8f5	Remove IDb interface which was deprecated for 3 years already Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Joas Schilling	da9468522b	Add an event merger and use it for the files activities Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Joas Schilling	827b6a610e	Introduce PasswordConfirmRequired annotation Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Christoph Wurst	d907666232	bring back remember-me * try to reuse the old session token for remember me login * decrypt/encrypt token password and set the session id accordingly * create remember-me cookies only if checkbox is checked and 2fa solved * adjust db token cleanup to store remembered tokens longer * adjust unit tests Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	9 years ago
Roeland Jago Douma	740659a04c	Move away from OC_L10N Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	e351ba56f1	Move browserSupportsCspV3 to CSPNonceManager Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Lukas Reschke	9e6634814e	Add support for CSP nonces CSP nonces are a feature available with CSP v2. Basically instead of saying "JS resources from the same domain are ok to be served" we now say "Ressources from everywhere are allowed as long as they add a `nonce` attribute to the script tag with the right nonce. At the moment the nonce is basically just a `<?php p(base64_encode($_['requesttoken'])) ?>`, we have to decode the requesttoken since `:` is not an allowed value in the nonce. So if somebody does on their own include JS files (instead of using the `addScript` public API, they now must also include that attribute.) IE does currently not implement CSP v2, thus there is a whitelist included that delivers the new CSP v2 policy to newer browsers. Check http://caniuse.com/#feat=contentsecuritypolicy2 for the current browser support list. An alternative approach would be to just add `'unsafe-inline'` as well as `'unsafe-inline'` is ignored by CSPv2 when a nonce is set. But this would make this security feature unusable at all in IE. Not worth it at the moment IMO. Implementing this offers the following advantages: 1. Security: As we host resources from the same domain by design we don't have to worry about 'self' anymore being in the whitelist 2. Performance: We can move oc.js again to inline JS. This makes the loading way quicker as we don't have to load on every load of a new web page a blocking dynamically non-cached JavaScript file. If you want to toy with CSP see also https://csp-evaluator.withgoogle.com/ Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Joas Schilling	2098648850	Add Rich Object Definitions and a validator Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Thomas Müller	c5ca71ee82	[9.2] Register commands in info.xml (#26248 ) * Use DI to load console commands from the apps - class name to be defined in the info.xml * Load commands from info.xml * Fix unit test * Allow Di magic for IMountManager Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Arthur Schiwon	e1073cf442	Notificacations for simple @-mentioning in comments (WIP) notify user when mentioned in comments Fix doc, and create absolute URL for as notification link. PSR-4 compatibility changes also move notification creation to comments app Do not notify yourself unit test for controller and application smaller fixes - translatable app name - remove doubles in mention array - micro perf optimization - display name: special label for deleted users, keep user id for users that could not be fetched from userManager Comment Notification-Listener Unit Test fix email adresses remove notification when triggering comment was deleted add and adjust tests add missing @license tags simplify NotificationsController registration appinfo simplification, php docs make string easier to translate adjust test replace dispatcher-based listeners with a registration method and interface safer to not pass optional data parameter to setSubject for marking as processed. ID and mention suffices Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de> update comment Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	9 years ago
Roeland Jago Douma	3260f69590	Add for proper DI Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Arthur Schiwon	75a73a5a73	satisfy dependencies for files_external	10 years ago

1 2

65 Commits (ba648eecdff7dcb4feff676ca2cfc9c8b4f01ef5)