184 Commits (e7f75484f87df41be5ef8dedce670bd2ccd12dc2)

Author	SHA1	Message	Date
Morris Jobke	bf579a153f	fix IE8 user agent detection	10 years ago
Lukas Reschke	6a4f22c61f	Use `/` if installed in main folder ... Otherwise an empty string is used indicating the cookie is only valid for those resources. This can lead to eunexpected behaviour. Fixes https://github.com/owncloud/core/issues/19196	10 years ago
Lukas Reschke	80a232da6a	Add \OCP\IRequest::getHttpProtocol ... Only allow valid HTTP protocols. Ref https://github.com/owncloud/core/pull/19537#discussion_r41252333 + https://github.com/owncloud/security-tracker/issues/119	10 years ago
Morris Jobke	8366ce2767	deduplicate @xenopathic	10 years ago
Morris Jobke	b945d71384	update licence headers via script	10 years ago
Jörn Friedrich Dreyer	d81416c51d	return '' instead of false	10 years ago
Joas Schilling	ee75f9f594	Fix type hint errors in the container and the interface	10 years ago
Robin McCorkell	31a8949adf	Prevent warning decoding content	10 years ago
Bernhard Posselt	fd74522804	make resolve public to avoid boiler plate code ... add resolve to public interface	10 years ago
Roeland Jago Douma	f12caf930e	Properly return 304 ... The ETag set in the IF_NONE_MODIFIED header is wraped in quotes ("). However the ETag that is set in response is not (yet). Also we need to cast the ETag to a string. * Added unit test	10 years ago
Robin McCorkell	e60c4bada1	Decode request content only on getContent	10 years ago
Lukas Reschke	8313a3fcb3	Add mitigation against BREACH ... While BREACH requires the following three factors to be effectively exploitable we should add another mitigation: 1. Application must support HTTP compression 2. Response most reflect user-controlled input 3. Response should contain sensitive data Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed. To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.	11 years ago
Robin McCorkell	8944af57cb	Set default `forwarded_for_headers` to 'HTTP_X_FORWARDED_FOR'	11 years ago
Robin Appelman	58e96e53b0	add method to check if we're inside a transaction	11 years ago
Roeland Jago Douma	f0b617b508	Use DI ... * Register OCP\Capability\IManager at DIContainer * Add register capabilities to appframework * Register capabilities in DI way * Make unit test pass again * Remove CapabiltiesManager from OCP	11 years ago
Robin McCorkell	fcc03e588a	Add \OCP\ISession to AppFramework	11 years ago
Lukas Reschke	90a11efecd	Remove "use" statement ... Ref https://bugs.php.net/bug.php?id=66773	11 years ago
Lukas Reschke	4efa7c09b1	Use StringUtils::equals on CSRF token and add unit tests	11 years ago
Robin McCorkell	182bc17aeb	Sanitize class names before registerService/query ... Leading backslashes are removed, so a `registerService('\\OC\\Foo')` can still be resolved with `query('OC\\Foo')`.	11 years ago
Bernhard Posselt	d8673dabe3	add test for factories ... use ref for factory test use a factory for registerAlias Ensure we construct SimpleContainer Use single instance of DIContainer in routing tests	11 years ago
Joas Schilling	20cd0ae55b	Add a log message when the Doctrine Query Builder is retrieved	11 years ago
Joas Schilling	516f7e8299	Add unit tests and automatic quoting	11 years ago
Joas Schilling	1bfb944d51	Add QueryBuilder, ExpressionBuilder and CompositeExpression wrappers	11 years ago
Lukas Reschke	7dda86f371	Return proper status code in case of a CORS exception ... When returning a 500 statuscode external applications may interpret this as an error instead of handling this more gracefully. This will now make return a 401 thus. Fixes https://github.com/owncloud/core/issues/17742	11 years ago
Bernhard Posselt	a4e3939204	add registerAlias method to shorcut interface registration ... remove unused import add since tag fix typo	11 years ago
Thomas Müller	bd71540c8a	Fixing 'Undefined index: REMOTE_ADDR' - fixes #17460	11 years ago
Morris Jobke	f63915d0c8	update license headers and authors	11 years ago
Lukas Reschke	4d23e06097	Fix undefined offset ... There are cases where no trusted host is specified such as when installing the instance, this lead to an undefined offset warning in the log right after installing. (when another domain than localhost or 127.0.0.1 was used)	11 years ago
Robin McCorkell	04b6f67f07	Allow multiple whitespace in type hints in AppFramework ... Type hints such as `@param bool $doSomething` will now correctly get parsed, allowing for alignment of docblock parameters if the app developer so wishes.	11 years ago
Bernhard Posselt	c8e3599cad	disallow cookie auth for cors requests ... testing ... fixes fix test add php doc fix small mistake add another phpdoc remove not working cors annotations from files app	11 years ago
Scrutinizer Auto-Fixer	fdbc21fc6c	Scrutinizer Auto-Fixes ... This commit consists of patches automatically generated for this project on https://scrutinizer-ci.com	11 years ago
Andreas Fischer	e418ced656	Check return value of OC_App::getAppPath() and verify info.xml exists.	11 years ago
Bernhard Posselt	1e58538f0e	add aliases to pascal case constructor paramters to make it possible to auto assemble controllers	11 years ago
Joas Schilling	6da9e1a742	Fix visibility of public API methods	11 years ago
Morris Jobke	ccf47f40aa	Remove unused variables ... * should make scrutinizer a lot more happy * reduces maybe memory footprint	11 years ago
Jenkins for ownCloud	b585d87d9d	Update license headers	11 years ago
Joas Schilling	c2a5bd6a01	Also add a note that clob does not work in the compare array	11 years ago
Joas Schilling	d1511cdbee	Fix doc blocks of insertIfNotExists() method	11 years ago
Joas Schilling	8fa692388b	Allow specifying the compare-array for insertIfNotExists()	11 years ago
Lukas Reschke	bbd5f28415	Let users configure security headers in their Webserver ... Doing this in the PHP code is not the right approach for multiple reasons: 1. A bug in the PHP code prevents them from being added to the response. 2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud) 3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations. This pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS.	11 years ago
Bernhard Posselt	95239ad21e	AppFramework StreamResponse ... First stab at the StreamResponse, see #12988 The idea is to use an interface ICallbackResponse (I'm not 100% happy with the name yet, suggestions?) that allow the response to output things in its own way, for instance stream the file using readfile Unittests are atm lacking, plan is to check if a mock of ICallbackResponse will be used by calling its callback (also unhappy with this name) method Usage is: $response = new StreamResponse('path/to/file'); rename io to output, add additional methods and handle error and not modified cases when using StreamResponse fix indention and uppercasing, also handle forbidden cases fix indention fix indention no forbidden, figuring out if a file is really readable is too complicated to get to work across OSes and streams remove useless import remove useless import fix intendation	11 years ago
Morris Jobke	06aef4e8b1	Revert "Updating license headers" ... This reverts commit 6a1a4880f0.	11 years ago
Thomas Müller	c62eb9d652	owncloud -> ownCloud	11 years ago
Bernhard Posselt	fb84e7d282	migrate to IDBConnection	11 years ago
Lukas Reschke	9adcd15cb3	Use [0] instead of current as HHVM might have problems with that	11 years ago
Lukas Reschke	1c6eae9017	Get the real protocol behind several proxies ... X-Forwarded-Proto contains a list of protocols if ownCloud is behind multiple reverse proxies. This is a revival of https://github.com/owncloud/core/pull/11157 using the new IRequest public API.	11 years ago
Vincent Petry	9f6dcb9d3e	Sabre Update to 2.1 ... - VObject fixes for Sabre\VObject 3.3 - Remove VObject property workarounds - Added prefetching for tags in sabre tags plugin - Moved oc_properties logic to separate PropertyStorage backend (WIP) - Fixed Sabre connector namespaces - Improved files plugin to handle props on-demand - Moved allowed props from server class to files plugin - Fixed tags caching for files that are known to have no tags (less queries) - Added/fixed unit tests for Sabre FilesPlugin, TagsPlugin - Replace OC\Connector\Sabre\Request with direct call to httpRequest->setUrl() - Fix exception detection in DAV client when using Sabre\DAV\Client - Added setETag() on Node instead of using the static FileSystem - Also preload tags/props when depth is infinity	11 years ago
Thomas Müller	0a9b8242ee	properly initialize OC::$WEBROOT and host name	11 years ago
Lukas Reschke	c06a94ecc2	Fix some PHPDocs	11 years ago
Jenkins for ownCloud	6a1a4880f0	Updating license headers	11 years ago