145 Commits (dd08f9320249d8ac7bf96f338a5be70d60af1dce)

Author	SHA1	Message	Date
Joas Schilling	047479ccf9	feat(security): Add public API to allow validating IP Ranges and checking for "in range" ... Signed-off-by: Joas Schilling <coding@schilljs.com> Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	1 year ago
Benjamin Gaussorgues	202e5b1e95	feat(security): restrict admin actions to IP ranges ... Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	1 year ago
provokateurin	e5dcdfb9e0	feat(Security): Warn about using annotations instead of attributes ... Signed-off-by: provokateurin <kate@provokateurin.de>	1 year ago
Arthur Schiwon	340939e688	fix(Session): avoid password confirmation on SSO ... SSO backends like SAML and OIDC tried a trick to suppress password confirmations as they are not possible by design. At least for SAML it was not reliable when existing user backends where used as user repositories. Now we are setting a special scope with the token, and also make sure that the scope is taken over when tokens are regenerated. Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	2 years ago
Andy Scherzinger	dae7c159f7	chore: Add SPDX header ... Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>	2 years ago
Côme Chilliet	ec5133b739	fix: Apply new coding standard to all files ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Florian Klinger	f3a4abd98c	fix: add check for app_api_system session flag to bypass rate limit ... Signed-off-by: Florian Klinger <florian.klinger@nextcloud.com> Signed-off-by: Andrey Borysenko <andrey18106x@gmail.com>	2 years ago
Maxence Lange	e1d7328bb2	adding test ... Signed-off-by: Maxence Lange <maxence@artificial-owl.com>	2 years ago
Maxence Lange	51fa22dc26	fix psalm ... Signed-off-by: Maxence Lange <maxence@artificial-owl.com>	2 years ago
Côme Chilliet	f68d4f7300	Remove deprecated methods Util::writeLog and DIContainer::log ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Andrew Summers	ce74bdcda2	Refactor `OC\Server::getThemingDefaults` ... Signed-off-by: Andrew Summers <18727110+summersab@users.noreply.github.com>	2 years ago
Joas Schilling	25309bcb45	techdebt(DI): Use public IThrottler interface which exists since Nextcloud 25 ... Signed-off-by: Joas Schilling <coding@schilljs.com>	2 years ago
Joas Schilling	2b49861679	Add a debug message when throttling without defining ... Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Christoph Wurst	8d9af3e262	feat(app-framework): Add support for global middlewares ... This allows apps to register middlewares that always register, not just for the app's own requests Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Christoph Wurst	907ff68bfc	perf(app-framework): Make the app middleware registration lazy ... Before this patch, app middlewares were registered on the dispatcher for every app loaded in a Nextcloud process. With the patch, only middlewares belonging to the same app of a dispatcher instance are loaded. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Christoph Wurst	20fcfb5739	feat(app framework)!: Inject services into controller methods ... Usually Nextcloud DI goes through constructor injection. This has the implication that each instance of a class builds the full DI tree. That is the injected services, their services, etc. Occasionally there is a service that is only needed for one controller method. Then the DI tree is build regardless if used or not. If services are injected into the method, we only build the DI tree if that method gets executed. This is also how Laravel allows injection. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Julius Härtl	f0a0bfaaee	Move to str_starts_with ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	3 years ago
Julius Härtl	3899de12b7	Skip querying the app container for server namespace ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	3 years ago
Julius Härtl	d7ecbe32d2	Avoid container dance for appName ... Sicne the appName is always passed for the DIContainer we can avoid using the container query logic and instead store and use a property Signed-off-by: Julius Härtl <jus@bitgrid.net>	3 years ago
Julien Veyssier	4a3f3beb0b	use bruteforce protection on all methods wrapped by PublicShareMiddleware ... if an invalid token is provided or when share password is wrong Signed-off-by: Julien Veyssier <julien-nc@posteo.net>	3 years ago
Christoph Wurst	41b2466d35	Clean up and deprecate app container aliases ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Julius Härtl	0f33453610	Diagnostics event logging to Nextcloud log ... Signed-off-by: Julius Härtl <jus@bitgrid.net> Add config samples Signed-off-by: Julius Härtl <jus@bitgrid.net>	4 years ago
Carl Schwan	6958d8005a	Add admin privilege delegation for admin settings ... This makes it possible for selected groups to access some settings pages. Signed-off-by: Carl Schwan <carl@carlschwan.eu>	4 years ago
John Molakvoæ (skjnldsv)	215aef3cbd	Update php licenses ... Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>	5 years ago
Joas Schilling	df47445c01	Fix unit tests ... Signed-off-by: Joas Schilling <coding@schilljs.com>	5 years ago
Roeland Jago Douma	68ec18323d	Fix types in the Group Manager ... Psalm found an issue. However the issue found was because of lying docblocks. Fixed those and did some typing to make it all better. For #25839 Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	5 years ago
Joas Schilling	3212c074b9	Log the number of queries built and executed ... Signed-off-by: Joas Schilling <coding@schilljs.com>	5 years ago
Christoph Wurst	2a054e6c04	Update the license headers for Nextcloud 20 ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	5 years ago
Christoph Wurst	c889021334	Add a scoped PSR logger for apps ... Just like for ILogger we should have a version that has the app ID pre-set for the context (unless overwritten) so that each log entry can be traced back to the app that produced it. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	4152216bd8	Use PSR container interface and deprecate our own abstraction ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Roeland Jago Douma	fa9dfd83c9	Fix AppFramework services ... * We can't just register an alias as the services need the appId to be injected. if we just register an alias this blows up since the main container doesn't have the appId. * Moved the Authtokens over to show the PoC works Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Roeland Jago Douma	12fa748c49	Move the notmodified check to middleware where it belongs ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Roeland Jago Douma	203d7eb1d3	Add AppFramework GZip middleware to gzip responses ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Roeland Jago Douma	32c93ee08e	Move over the IConfig for globalscale ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Roeland Jago Douma	163463dea5	Add InitialState Appframework service ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Roeland Jago Douma	4e59c6f9b5	Remove double registrations ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Roeland Jago Douma	8a8623c569	Simple AppConfig wrapper for the AppFramework ... 9 out of 10 cases apps want to access their own appconfig. Hence it would be nice not to have to enter the app id all the time. This simple wrapper just passes on the appid in all calls. Basically this allows for simpler code in the apps. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Christoph Wurst	caff1023ea	Format control structures, classes, methods and function ... To continue this formatting madness, here's a tiny patch that adds unified formatting for control structures like if and loops as well as classes, their methods and anonymous functions. This basically forces the constructs to start on the same line. This is not exactly what PSR2 wants, but I think we can have a few exceptions with "our" style. The starting of braces on the same line is pracrically standard for our code. This also removes and empty lines from method/function bodies at the beginning and end. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	14c996d982	Use elseif instead of else if ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	afbd9c4e6e	Unify function spacing to PSR2 recommendation ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	b80ebc9674	Use the short array syntax, everywhere ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	1b46621cd3	Update license headers for 18 ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Daniel Kesselberg	0016480370	Decouple resource provider registration ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	6 years ago
Christoph Wurst	5bf3d1bb38	Update license headers ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Roeland Jago Douma	68748d4f85	Some php-cs fixes ... * Order the imports * No leading slash on imports * Empty line before namespace * One line per import * Empty after imports * Emmpty line at bottom of file Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Roeland Jago Douma	098ab7af4b	Do DI on registered middleware as well ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Roeland Jago Douma	3f12ec95f0	SessionMiddleware: declare session property ... * Remove request since we don't useit * Update tests as well Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Roeland Jago Douma	b8c5008acf	Add feature policy header ... This adds the events and the classes to modify the feature policy. It also adds a default restricted feature policy. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	37a4282c7a	Split up security middleware ... With upcoming work for the feature policy header. Splitting this in smaller classes that just do 1 thing makes sense. I rather have a few small classes that are tiny and do 1 thing right (and we all understand what is going on) than have big ones. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	357263a70b	Do not try to autoload built in types ... This avoids calls to the autoloader (or chain of autoloaders) to see if for example 'principalPrefix' class can be found. While we already know it is a string. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago