upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-07-12 11:06:50 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 46
88250 commits 1052 branches 1229 tags 7.8 GiB
Commit graph

8190 commits

Author SHA1 Message Date
Andy Scherzinger
8f17492064
Merge pull request #61888 from nextcloud/backport/61615/stable34 
[stable34] fix(core): Throttle lost-password reset form when link is disabled
 2026-07-08 21:32:35 +02:00
Andy Scherzinger
2f6d8bc5e3
Merge pull request #61886 from nextcloud/backport/61686/stable34
Some checks are pending
Integration sqlite / changes (push) Waiting to run
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, --tags ~@large files_features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, capabilities_features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, collaboration_features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, comments_features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, dav_features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, federation_features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, file_conversions) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, files_reminders) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, filesdrop_features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, guests_features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, ldap_features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, openldap_features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, openldap_numerical_features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, remoteapi_features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, routing_features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, setup_features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, sharees_features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, sharing_features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, theming_features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite (stable34, main, 8.4, stable34, videoverification_features) (push) Blocked by required conditions
Details
Integration sqlite / integration-sqlite-summary (push) Blocked by required conditions
Details
Psalm static code analysis / changes (push) Waiting to run
Details
Psalm static code analysis / static-code-analysis (push) Blocked by required conditions
Details
Psalm static code analysis / static-code-analysis-security (push) Blocked by required conditions
Details
Psalm static code analysis / static-code-analysis-ocp (push) Blocked by required conditions
Details
Psalm static code analysis / static-code-analysis-ncu (push) Blocked by required conditions
Details
Psalm static code analysis / static-code-analysis-strict (push) Blocked by required conditions
Details
Psalm static code analysis / static-code-analysis-summary (push) Blocked by required conditions
Details 
[stable34] fix(bruteforce): Don't throttle requests with failing CSRF
 2026-07-07 20:01:36 +02:00
nfebe
d2cd591963 fix(core): Throttle lost-password reset form when link is disabled 
When password reset links were disabled, the reset form did not rate-limit
failed token attempts, leaving that endpoint open to unthrottled token
guessing. Failed attempts on the form are now always throttled, consistent
with the other reset steps.

Signed-off-by: nfebe <fenn25.fn@gmail.com>
 2026-07-07 16:56:45 +00:00
Andy Scherzinger
eefefe589e
Merge pull request #61873 from nextcloud/backport/61858/stable34 
[stable34] test: fix HEIC tests
 2026-07-07 18:37:57 +02:00
Andy Scherzinger
221c88fdc4
Merge pull request #61876 from nextcloud/backport/61845/stable34 
[stable34] fix(DeclarativeManager): Fix admin delegation
 2026-07-07 18:36:20 +02:00
Daniel Kesselberg
8a8feead27 fix(bruteforce): Don't throttle requests with failing CSRF 
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
 2026-07-07 16:34:55 +00:00
Marcel Klehr
3c445d614f fix(DeclarativeManagerTest): Fix testAdminFormUserUnauthorized 
Assisted-by: ClaudeCode:claude-opus-4-8
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
 2026-07-07 13:58:06 +00:00
Ferdinand Thiessen
3609734414 test: fix HEIC tests 
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
 2026-07-07 13:10:16 +00:00
provokateurin
95ecc8373f
refactor(files_sharing,Share20): Use Interaction API to apply restrictions 
Signed-off-by: provokateurin <kate@provokateurin.de>
 2026-07-07 13:13:54 +02:00
provokateurin
69483cd73d
refactor(Share20\Manager): Rename generalChecks method and remove unused parameter 
Signed-off-by: provokateurin <kate@provokateurin.de>
 2026-07-07 12:55:13 +02:00
provokateurin
9c80187199
feat(Interaction): Implement all existing restrictions 
Signed-off-by: provokateurin <kate@provokateurin.de>
 2026-07-07 12:55:06 +02:00
provokateurin
54b09c496a
feat(OCP): Add Interaction API 
Signed-off-by: provokateurin <kate@provokateurin.de>
 2026-07-07 12:52:15 +02:00
Joas Schilling
ed96926232
test: Don't fail due to deprecations from guzzlehttp 7.12 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2026-07-02 13:59:29 +02:00
Joas Schilling
0bb230247e fix(config): Decrypt sensitive appconfigs when requested 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2026-06-29 16:48:17 +00:00
Andy Scherzinger
7ee254c3ee
Merge pull request #60785 from nextcloud/backport/60742/stable34 
[stable34] test: replace checkbox assertions with real assertions or DoesNotPerformAssertions
 2026-06-18 00:03:49 +02:00
Andy Scherzinger
74b1d75b57
Merge pull request #60759 from nextcloud/backport/60748/stable34 
[stable34] test: replace checkbox assertions with DoesNotPerformAssertions (middleware)
 2026-06-18 00:03:19 +02:00
Andy Scherzinger
15db395016
Merge pull request #61105 from nextcloud/backport/60735/stable34 
[stable34] fix(security): don't propagate ValueError from Crypto::decrypt() fallback
 2026-06-17 23:01:58 +02:00
Yoan Bozhilov
3f3f9c6464 fix(taskprocessing): guard lockTask on scheduled, record started_at, Oracle fallback 
Address review feedback (@marcelklehr, Copilot):
- lockTask claims only SCHEDULED tasks (was status != RUNNING) and stamps
  started_at in the same atomic UPDATE, so a finished task cannot be re-claimed
  and the external-provider claim path records started_at as well.
- claimWithBoundedRetry re-reads after lockTask instead of a follow-up UPDATE.
- Oracle joins SQLite on the bounded-retry fallback: Oracle cannot combine a
  row-limiting clause with FOR UPDATE (ORA-02014), which failed the claim tests
  on Oracle CI.
- Reword the worker docblock/comments to "prefer oldest available" (parallel
  SKIP LOCKED does not guarantee a strict global order).
- Add a regression test that lockTask does not resurrect a finished task.

Signed-off-by: Yoan Bozhilov <bygadd@gmail.com>
Assisted-by: Claude Code:claude-opus-4-8
 2026-06-17 19:00:53 +02:00
Yoan Bozhilov
aa5f45cecd fix(taskprocessing): claim tasks atomically with SKIP LOCKED + composite index 
Replace the worker retry/ignore-list claim-loop with a single atomic
SELECT ... FOR UPDATE SKIP LOCKED claim (SQLite bounded-retry fallback),
preserving the no-duplicate guarantee while removing the thundering-herd
contention that throttled backlog draining. Add a (status,type,last_updated)
index via the table-creating migration + db:add-missing-indices listener.

Signed-off-by: Yoan Bozhilov <bygadd@gmail.com>
Assisted-by: Claude Code:claude-opus-4-8
 2026-06-17 19:00:53 +02:00
Benjamin Gaussorgues
fc8a7884d5
fix(ci): fix Memcached CI job 
Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
 2026-06-17 14:20:05 +02:00
Andy Scherzinger
f0486b9e9c
Merge pull request #61341 from nextcloud/backport/61150/stable34 
[stable34] Speedup tests execution
 2026-06-16 20:20:21 +02:00
Côme Chilliet
de970b65fe fix: Do not set last-password-confirm for apptoken sessions 
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
 2026-06-16 14:28:20 +00:00
Louis Chmn
ae08b8f843 test(View): Setup users and groups once 
Signed-off-by: Louis Chmn <louis@chmn.me>
 2026-06-16 14:21:05 +00:00
Carl Schwan
a3e0b2d084 perf(UserConfigTest): Don't recreate database between invocation 
Signed-off-by: Carl Schwan <carlschwan@kde.org>
 2026-06-16 14:21:05 +00:00
Louis Chmn
e92d435120 test(App): Setup users and groups once 
Signed-off-by: Louis Chmn <louis@chmn.me>
 2026-06-16 14:21:04 +00:00
Carl Schwan
0a807f2bb5 perf(AppConfigIntegrationTest): Avoid creating too many times AppConfig 
Reuse instance by merging some tests based on DataProviders

Signed-off-by: Carl Schwan <carlschwan@kde.org>
 2026-06-16 14:21:04 +00:00
Carl Schwan
8a270ee825 perf: Test chunking with a lower amount of entries 
Use a lower array_chunk values when running the code in the tests for
the comment manager.

Signed-off-by: Carl Schwan <carlschwan@kde.org>
 2026-06-16 14:21:04 +00:00
Carl Schwan
33f30d1086 perf(tests): Cache encryption result in UserConfigTest 
So that we don't need to encrypt stuff all the time.

Signed-off-by: Carl Schwan <carlschwan@kde.org>
 2026-06-16 14:21:04 +00:00
Carl Schwan
011d979e7e perf(tests): Don't encrypt the same value each time 
We have a static class, so we can save the results accross the > 100
tests cases in this class.

Signed-off-by: Carl Schwan <carlschwan@kde.org>
 2026-06-16 14:21:04 +00:00
Carl Schwan
4e88fa4060 perf(tests): Remove worked command tests that relies on timeout 
It's testing something basic and takes more than a second each time to
run.

Signed-off-by: Carl Schwan <carlschwan@kde.org>
 2026-06-16 14:21:04 +00:00
Josh
93c0b9c541
test(s3): drop unnecessarily added fclose 
Signed-off-by: Josh <josh.t.richards@gmail.com>
 2026-06-16 15:15:51 +02:00
Josh
8528a2095d
test(s3): make testFileSizes EOF assertion more robust 
Signed-off-by: Josh <josh.t.richards@gmail.com>
 2026-06-16 15:15:34 +02:00
Andy Scherzinger
9882418ba8
Merge pull request #61249 from nextcloud/backport/60972/stable34 
[stable34] Job run history cleanup
 2026-06-16 13:11:25 +02:00
Côme Chilliet
d29d978900
chore: Fix CreateSessionTokenCommandTest and add test for ephemeral session 
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
 2026-06-15 16:48:13 +02:00
Benjamin Gaussorgues
a570d6dc5d
feat(snowflake): allows to generate Snowflake IDs matching a timestamp 
Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
 2026-06-12 19:40:16 +02:00
Benjamin Gaussorgues
368c4ae515
feat(utils): add getter for serverid with proper default 
Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
 2026-06-12 19:40:16 +02:00
Anna Larch
c0b57cd298 fix(security): don't propagate ValueError from Crypto::decrypt() fallback 
When decrypting a v3 ciphertext with a mismatched secret, the first
attempt throws an Exception (HMAC mismatch). The fallback then calls
decryptWithoutSecret() with an empty string, which causes hash_hkdf()
to throw a ValueError. Since ValueError extends \Error rather than
\Exception, it bypassed the catch block and propagated as an unhandled
error, crashing the whole request.

Wrap the fallback in its own try/catch(\Throwable) and rethrow the
original Exception so callers get a meaningful HMAC mismatch error.

Signed-off-by: Anna Larch <anna@nextcloud.com>
AI-Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-09 13:15:27 +00:00
Joas Schilling
fa23d8ea77
fix(settings): Fix appstore icon color in settings menu 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2026-06-09 14:57:59 +02:00
John Molakvoæ
677044db61
Revert "[stable34] refactor(NavigationManager): move navigation definitions into apps" 2026-06-05 10:39:22 +02:00
Ferdinand Thiessen
e5297a1d04 refactor(NavigationManager): move navigation definitions into apps 
The manager itself does not need to know what hardcoded-things an app provides,
instead the apps itself should handle this.

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
 2026-06-03 20:09:48 +02:00
Andy Scherzinger
8a84c44882
Merge pull request #60921 from nextcloud/backport/60728/stable34 
[stable34]  fix(MailPlugin): Stop applying the offset twice and the limit per wide/exact
 2026-06-03 08:42:59 +02:00
Andy Scherzinger
132929bd61
Merge pull request #60924 from nextcloud/backport/59813/stable34 
[stable34] fix(sharing): set STATUS_ACCEPTED when creating USERGROUP subshare on…
 2026-06-03 08:42:07 +02:00
Josh
5d86468ca8 test(cache): avoid ordering assumptions in testExtended 
Signed-off-by: Josh <josh.t.richards@gmail.com>
 2026-06-02 11:56:50 +00:00
Anna Larch
9af4a2bb5a fix(sharing): restore STATUS_ACCEPTED for OC-migrated group share subshares 
When an ownCloud-migrated group share (which has no per-user USERGROUP
subshare) is renamed for the first time, DefaultShareProvider::move()
inserted a new USERGROUP row without setting `accepted`. The column
defaulted to 0 (STATUS_PENDING), causing MountProvider to skip the
share on the next login — the shared file disappeared for the recipient.

Fix: set accepted = STATUS_ACCEPTED explicitly on the INSERT in
DefaultShareProvider::move() for the TYPE_GROUP branch.

Secondary fix: SharedMount::moveMount() silently returned true when
updateFileTarget() threw (e.g. group no longer exists on an OC-migrated
instance). Set $result = false in the catch block so View::rename()
propagates the failure instead of silently corrupting VFS state.

An opt-in occ command (sharing:fix-owncloud-group-shares) with --dry-run
support is included to repair existing broken instances. It targets only
TYPE_USERGROUP subshares with accepted=STATUS_PENDING and permissions!=0
(shares that were accepted but broken by the missing column default),
leaving explicitly declined shares (permissions=0) untouched.

AI-Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Anna Larch <anna@nextcloud.com>
 2026-06-02 09:14:34 +00:00
provokateurin
f603358186
fix(MailPlugin): Stop applying the offset twice and the limit per wide/exact 
Signed-off-by: provokateurin <kate@provokateurin.de>
 2026-06-02 08:21:45 +02:00
provokateurin
2e9f3b3c63
perf(MailPlugin): Optimize checking group memberships 
Signed-off-by: provokateurin <kate@provokateurin.de>
 2026-06-02 08:19:54 +02:00
provokateurin
b2ccbd389b
fix(MailPlugin): Use correct type for exact id match 
Signed-off-by: provokateurin <kate@provokateurin.de>
 2026-06-02 08:19:54 +02:00
Andy Scherzinger
92034d8288
Merge pull request #60812 from nextcloud/backport/60751/stable34 
[stable34] test(share20): replace addToAssertionCount checkbox tests in Share20 ManagerTest
 2026-06-02 00:30:23 +02:00
Andy Scherzinger
0d5267d64c
Merge pull request #60781 from nextcloud/backport/60739/stable34 
[stable34] test(ci): enforce PHPUnit time limits with sensible timeout values
 2026-06-01 23:32:05 +02:00
Andy Scherzinger
a11567ef0e
Merge pull request #60762 from nextcloud/backport/60744/stable34 
[stable34] test(db): call parent::tearDown() in DB test classes that skipped it
 2026-06-01 23:29:28 +02:00