Commit graph

7649 commits

Author SHA1 Message Date
Morris Jobke
87db9f8eab
Sanitize parameters in createSessionToken() while logging
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-07-11 14:47:49 +02:00
Roeland Jago Douma
a5a272e5d4
Make the token expiration also work for autocasting 0
Some bad databases don't respect the default null apprently.
Now even if they cast it to 0 it should work just fine.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-06-08 16:27:07 +02:00
Roeland Jago Douma
c27722520c
Make sure the log doesn't try to read from PUT if it can't
If a PUT request comes in that is not JSON or from encoded. Then we can
only read it (exactly) once. If that is the case we must assume no
shared secret is set.

If we don't then we either are the first to read it, thus causing the
real read of the data to fail.

Or we are later and then it throws an exception (also failing the
request).

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-05-30 20:27:30 +02:00
Roeland Jago Douma
8d596461d5
Make sure the file is readable before attempting to create a preview
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-05-29 22:04:17 +02:00
Roeland Jago Douma
4b8a9a37d6
Always set the request language to the force language
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-05-24 13:09:21 +02:00
Georg Ehrke
0dc1b3e741
make sure force language is reflected in html lang attribute
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
2018-05-24 13:09:15 +02:00
Robin Appelman
7c8e34f8fd
cleanup locks in scanner on error
Signed-off-by: Robin Appelman <robin@icewind.nl>
2018-05-23 20:06:34 +02:00
Roeland Jago Douma
3e57666093
Properly set expires to NULL when creating a token
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-05-23 17:02:15 +02:00
Roeland Jago Douma
f2a3115157
Certain tokens can expire
However due to the nature of what we store in the token (encrypted
passwords etc). We can't just delete the tokens because that would make
the oauth refresh useless.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-05-23 17:02:15 +02:00
Roeland Jago Douma
0885bd4ee5
Allow the rotation of tokens
This for example will allow rotating the apptoken for oauth

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-05-23 17:02:15 +02:00
Roeland Jago Douma
1b1397b2eb
Merge pull request #9232 from nextcloud/12-9205
[stable12] Provide an option to disable HTML emails
2018-04-19 00:34:59 +02:00
Morris Jobke
7f454fea8e
Provide an option to disable HTML emails
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-04-18 22:53:37 +02:00
Joas Schilling
5f1f6330c9
Show EOL warning in the update section
Signed-off-by: Joas Schilling <coding@schilljs.com>
2018-04-18 13:50:29 +02:00
michaelletzgus
e1762998b3
Fix undefined index problem
Nextcloud 13RC4, error in logfile, triggered by "occ config:list":

Invalid argument supplied for foreach() at lib/private/AppConfig.php#297
PHP	Undefined index: workflowengine at lib/private/AppConfig.php#297

Fix: Check if index exists in array before using it.
2018-03-20 09:18:36 +01:00
Robin Appelman
50162e619c
disable part files for object stores
Signed-off-by: Robin Appelman <robin@icewind.nl>
2018-03-08 13:09:37 +01:00
Morris Jobke
d0500f0b5b
Merge pull request #8692 from nextcloud/stable12-add-missing-import
[stable12] Add missing import
2018-03-06 18:35:52 +01:00
Morris Jobke
36c9b12fd8
Merge pull request #8689 from nextcloud/12-7449
[stable12] Fix 500 on setup page
2018-03-06 18:00:40 +01:00
Daniel Calviño Sánchez
a0d2d0c272 Add missing import
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
2018-03-06 17:20:11 +01:00
Morris Jobke
95f067a613
Merge pull request #8682 from nextcloud/8474_12
[stable12] Log exceptions that happen when writing the app store reply to storage
2018-03-06 13:36:38 +01:00
Morris Jobke
51b79a5df4
Fix 500 on setup page
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-03-06 13:28:31 +01:00
Joas Schilling
22b98ddd41
Log exceptions that happen when writing the app store reply to storage
Signed-off-by: Joas Schilling <coding@schilljs.com>
2018-03-06 11:28:40 +01:00
Robin Müller
e359640899
Don't use double quotes in MySQL queries
MySQL databases with the ANSI_QUOTES mode enabled treat " as an identifier
quote (see https://dev.mysql.com/doc/refman/5.7/en/sql-mode.html#sqlmode_ansi_quotes).
So for such databases the 'occ upgrade' fails with an error message like this:
... unknown column 'oc_*' in where clause.

This fix replaces the doulbe quotes with single quotes that should be always
used in MySQL queries to quote literal strings.

Signed-off-by: Robin Müller <robin.mueller@1und1.de>
2018-03-06 11:25:37 +01:00
Morris Jobke
66cba3e01b
Merge pull request #8611 from nextcloud/css-file-suffix-with-apps-versions-backport
[stable12] Use apps versions to generate suffix when possible
2018-03-05 15:05:14 +01:00
Julius Härtl
251b21bb74
Add throws annotation
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-03-02 17:17:44 +01:00
Julius Härtl
4bd0a3fe4d
Properly encapsulate require_once for app.php
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-03-02 17:17:44 +01:00
John Molakvoæ (skjnldsv)
a7e7b874e4
Use apps versions to generate suffix when possible
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-03-01 20:43:12 +01:00
Morris Jobke
6f4b6bea1c
Merge pull request #8130 from nextcloud/fix-own-avatar-not-updated-when-display-name-is-changed
[stable12] Fix own avatar not updated when display name is changed
2018-02-27 18:40:42 +01:00
Morris Jobke
08a13dde4a
Merge pull request #8101 from nextcloud/s3-uploader-12
[12] Use S3Client::upload instead of splitting single/multipart upload ourselves
2018-02-08 14:31:36 +01:00
Morris Jobke
e328ced179
Merge pull request #8184 from robert-scheck/pki-validation-stable12
[stable12] Handle SSL certificate verifications for others than Let's Encrypt
2018-02-08 11:02:56 +01:00
Robin Appelman
ce4f74bec2
actually return stream from swift
Signed-off-by: Robin Appelman <robin@icewind.nl>
2018-02-08 08:12:51 +01:00
Roeland Jago Douma
10efe528ed
Do not try to get the jailed path if we can't find the id
Fixes #8047

If we can't find the file by id there we should just return null instead
of trying to get the jailed path of null.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-02-06 12:21:27 +01:00
Robert Scheck
38c12ca764 Handle SSL certificate verifications for others than Let's Encrypt
Do no longer (wrongly) rewrite URLs like

  * http://example.net/.well-known/pki-validation/file.txt (Comodo)
  * http://example.net/.well-known/pki-validation/fileauth.txt (DigiCert, Thawte, GeoTrust)
  * http://example.net/.well-known/pki-validation/gsdv.txt (GlobalSign)
  * http://example.net/.well-known/pki-validation/starfield.htm (Starfield, GoDaddy)
  * http://example.net/.well-known/pki-validation/swisssign-check.txt (SwissSign)

for automated SSL certificate verifications. All (common commercial)
certificate authorities (CA) except Let's Encrypt (via ACME) seem to
use "pki-validation" rather "acme-challenge" for their domain control
validation (DCV).

Signed-off-by: Robert Scheck <robert@fedoraproject.org>
2018-02-05 15:39:13 +01:00
Daniel Calviño Sánchez
16b0b3f418 Fix own avatar not updated when display name is changed
The avatar endpoint returns the avatar image or, if the user has no
avatar, the display name. In that later case the avatar is generated on
the browser based on the display name. The avatar endpoint response is
cached, so when the display name changes and the avatar is got again the
browser could use the cached value, in which case it would use the same
display name as before and the avatar would not change.

When the avatar is an image the cache is invalidated with the use of
the "version" parameter, which is increased when the image changes. When
the avatar cache was first introduced only the image avatars were
cached, but it was later changed to cache all avatar responses to limit
the requests made to the server. Thus, now the cache of the display name
is invalidated too by increasing the version of the avatar if the
display name changes and there is no explicit avatar set.

Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
2018-01-31 18:32:36 +01:00
Robin Appelman
8d5b86c159
Use S3Client::upload instead of splitting single/multipart upload ourselves
Signed-off-by: Robin Appelman <robin@icewind.nl>
2018-01-29 16:11:23 +01:00
Joas Schilling
c7485fa1ad
Keep all shipped apps enabled because they should be okay
Signed-off-by: Joas Schilling <coding@schilljs.com>
2018-01-16 13:41:33 +01:00
Roeland Jago Douma
323dc4acb1
Merge pull request #7758 from nextcloud/12-7570
[stable12] add option to use legacy v2 auth with s3
2018-01-09 21:19:24 +01:00
Robin Appelman
4ec4a7df93
add option to use legacy v2 auth with s3
Signed-off-by: Robin Appelman <robin@icewind.nl>
2018-01-09 18:21:47 +01:00
Roeland Jago Douma
e2c77e46ab
Use correct L10N files for jsconfig
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-01-09 16:09:57 +01:00
Morris Jobke
db6b9fdb6a
Merge pull request #7745 from nextcloud/7692_12
[stable12] Don't lie about preview types
2018-01-09 11:27:53 +01:00
Morris Jobke
25ba9cbe71
Merge pull request #7684 from nextcloud/backport-ie-fix-invert
[stable12] Fix inverted app icons on IE11
2018-01-09 11:22:54 +01:00
Roeland Jago Douma
1f875eca3c
Merge pull request #7694 from nextcloud/stable12-7611
[stable12] Don't attempt to translate login names to uids when uids are provided
2018-01-08 21:10:11 +01:00
Roeland Jago Douma
87e99651f5
Only return 1 type
Throw proper exception if we can't get the mimetype for a preview. Catch
it later on so we can just return a not found for the preview.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-01-08 20:39:48 +01:00
Roeland Jago Douma
50b880edeb
Don't lie about the preview mimetype
For legacy reasons we stored all the previews with a png extention.
However we did not put png data in them all the time.

This caused the preview endpoints to always report that a preview is a
png file. Which was a lie.

Since we abstract away from the storage etc in the previewmanager. There
is no need anymore to store them as .png files and instead we can use
the actual file extention.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-01-08 20:39:39 +01:00
John Molakvoæ (skjnldsv)
b95d18b85e
Revert rebaseurl function edit
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-01-05 08:35:38 +01:00
John Molakvoæ (skjnldsv)
7a282dee89
Rollback caching fix
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-01-05 08:34:32 +01:00
John Molakvoæ (skjnldsv)
1f2437e2c5
Fixup! Proberly detect variable changes
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-01-04 19:11:41 +01:00
John Molakvoæ (skjnldsv)
cf53560218
Proberly detect variable changes
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-01-04 19:10:27 +01:00
John Molakvoæ (skjnldsv)
fa95733b0d
Fixed url rebase with theming
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-01-04 13:24:21 +01:00
Arthur Schiwon
776d9e6805
never translate login names when requiring with a user id
where appropriate, the preLoginNameUsedAsUserName hook should be thrown.

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2018-01-04 11:47:31 +01:00
John Molakvoæ (skjnldsv)
1ae126a781
Fixed tests
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-01-03 22:05:03 +01:00