26874 commits

Author	SHA1	Message	Date
Andy Scherzinger	e76295e084	Merge pull request #60920 from nextcloud/backport/60728/stable33 ... [stable33] fix(MailPlugin): Stop applying the offset twice and the limit per wide/exact	2026-06-17 20:55:55 +02:00
Andy Scherzinger	93079747ef	Merge pull request #60928 from nextcloud/backport/60809/stable33 ... [stable33] fix(Share): Add missing optional parameter to IManager::shareApiAllowLinks()	2026-06-17 19:34:57 +02:00
Andy Scherzinger	82fc3b1747	Merge pull request #61104 from nextcloud/backport/60735/stable33 ... [stable33] fix(security): don't propagate ValueError from Crypto::decrypt() fallback	2026-06-17 19:09:59 +02:00
Andy Scherzinger	5c0c52cba7	Merge pull request #60722 from nextcloud/backport/60649/stable33 ... [stable33] fix(http): avoid iconv for header ascii fallback	2026-06-17 19:03:42 +02:00
Benjamin Gaussorgues	e28705c808	fix: prevent editing delegated admins ... Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	2026-06-17 09:28:30 +00:00
Arthur Schiwon	5fe630b4f1	fix: ensure file names are string-typed ... - `$child` was used as an array key earlier. If they are numeric, they are automatically converted to ints, leading to type issues later. Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	2026-06-17 05:25:33 +00:00
Nextcloud bot	4bde3822b3	fix(l10n): Update translations from Transifex ... Signed-off-by: Nextcloud bot <bot@nextcloud.com>	2026-06-17 00:23:12 +00:00
Cristian Scheid	1d19c13de5	fix(team-manager): ensure team resources are only retrived for members ... Signed-off-by: Cristian Scheid <cristianscheid@gmail.com>	2026-06-16 18:34:56 +00:00
Andy Scherzinger	43f25d9c42	Merge pull request #61343 from nextcloud/backport/61322/stable33 ... [stable33] fix: Do not set last-password-confirm for apptoken sessions	2026-06-16 20:14:54 +02:00
Côme Chilliet	23fe11b9af	fix: Do not set last-password-confirm for apptoken sessions ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2026-06-16 14:28:41 +00:00
niv	d29c43d91e	fix: trim duplicate search results for external share ... Signed-off-by: Maksim Sukharev <antreesy.web@gmail.com>	2026-06-16 14:13:36 +00:00
Côme Chilliet	a6dff07a00	Merge pull request #61306 from nextcloud/backport/61305/stable33 ... [stable33] fix: Use token expiration for ephemeral sessions	2026-06-16 08:26:03 +02:00
Nextcloud bot	d4c350011c	fix(l10n): Update translations from Transifex ... Signed-off-by: Nextcloud bot <bot@nextcloud.com>	2026-06-16 00:23:21 +00:00
Côme Chilliet	c0f5b569b9	fix: Use token expiration for ephemeral sessions ... This simplifies the code a lot. Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2026-06-15 16:53:43 +02:00
Nextcloud bot	ed6250d870	fix(l10n): Update translations from Transifex ... Signed-off-by: Nextcloud bot <bot@nextcloud.com>	2026-06-15 00:23:36 +00:00
Nextcloud bot	762576a52f	fix(l10n): Update translations from Transifex ... Signed-off-by: Nextcloud bot <bot@nextcloud.com>	2026-06-14 00:22:59 +00:00
Nextcloud bot	dfe7746630	fix(l10n): Update translations from Transifex ... Signed-off-by: Nextcloud bot <bot@nextcloud.com>	2026-06-13 00:24:35 +00:00
Nextcloud bot	fb5529297b	fix(l10n): Update translations from Transifex ... Signed-off-by: Nextcloud bot <bot@nextcloud.com>	2026-06-12 00:46:07 +00:00
Cristian Scheid	abb11a6967	fix(search-query): fix psalm type error ... Signed-off-by: Cristian Scheid <cristianscheid@gmail.com>	2026-06-11 12:02:47 +02:00
Louis	e5c479c329	Merge pull request #61183 from nextcloud/backport/60916/stable33 ... [stable33] fix(previews): ffprobe hangs	2026-06-11 11:38:39 +02:00
Stephan Orbaugh	d404f58353	Merge pull request #60792 from nextcloud/backport/60733/stable33 ... [stable33] fix(DB): Enforce foreign key constraints in SQLite	2026-06-11 11:33:50 +02:00
Andy Scherzinger	9d478bb5af	Merge pull request #60984 from nextcloud/backport/60884/stable33 ... [stable33] fix(TaskProcessing): restrict allowed_classes in Manager cache deserialization	2026-06-11 10:24:35 +02:00
Louis	39c41d3e50	Merge pull request #61156 from nextcloud/backport/60844/stable33 ... [stable33] feat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache	2026-06-11 10:17:28 +02:00
Andrey Dyakov	b507204ab7	fix(previews): ffprobe hangs ... Signed-off-by: Andrey Dyakov <adduxa@gmail.com>	2026-06-11 07:58:57 +00:00
Nextcloud bot	4951eeee73	fix(l10n): Update translations from Transifex ... Signed-off-by: Nextcloud bot <bot@nextcloud.com>	2026-06-11 00:23:27 +00:00
Cristian Scheid	7cc173b2e0	feat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache ... Signed-off-by: Cristian Scheid <cristianscheid@gmail.com>	2026-06-10 17:02:33 +02:00
Louis	890fe9047d	Merge pull request #61117 from nextcloud/backport/61067/stable33 ... [stable33] fix: use correct permissions mask for non-home storage public links	2026-06-10 09:56:53 +02:00
Louis	7f9fe20461	Merge pull request #61112 from nextcloud/backport/61100/stable33 ... [stable33] fix: Correctly detect appid for dist css files	2026-06-10 09:56:40 +02:00
Nextcloud bot	4b7fdf0ce2	fix(l10n): Update translations from Transifex ... Signed-off-by: Nextcloud bot <bot@nextcloud.com>	2026-06-10 00:23:07 +00:00
Robin Appelman	faaeaac2d7	chore: psalm fix ... Signed-off-by: Robin Appelman <robin@icewind.nl>	2026-06-09 15:25:32 +00:00
Côme Chilliet	61b77436e4	fix(psalm): Use end instead of array_last because psalm does not find the polyfill ... I’m not sure why psalm cannot see we have a polyfill for array_last. Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2026-06-09 15:12:27 +00:00
Côme Chilliet	b732339531	fix: Correctly detect appid for dist css files ... Follow-up of ab551c4c8a Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2026-06-09 15:12:27 +00:00
Anna Larch	0cff2cdbaf	fix(security): don't propagate ValueError from Crypto::decrypt() fallback ... When decrypting a v3 ciphertext with a mismatched secret, the first attempt throws an Exception (HMAC mismatch). The fallback then calls decryptWithoutSecret() with an empty string, which causes hash_hkdf() to throw a ValueError. Since ValueError extends \Error rather than \Exception, it bypassed the catch block and propagated as an unhandled error, crashing the whole request. Wrap the fallback in its own try/catch(\Throwable) and rethrow the original Exception so callers get a meaningful HMAC mismatch error. Signed-off-by: Anna Larch <anna@nextcloud.com> AI-Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-09 13:15:10 +00:00
Joas Schilling	399643c121	fix(comments): Use capped memory cache for comments ... Signed-off-by: Joas Schilling <coding@schilljs.com>	2026-06-09 08:59:21 +00:00
Josh	dff4dcdd35	chore(FileInfo): fixup code typo ... Signed-off-by: Josh <josh.t.richards@gmail.com>	2026-06-08 12:17:02 +00:00
Josh	ae53b140dc	fix(FileInfo): harden getChecksum() ... - `checksum` is already optional/derived metadata in practice - callers already treat `null`l / `''` as "no checksum" Signed-off-by: Josh <josh.t.richards@gmail.com>	2026-06-08 12:17:02 +00:00
Nextcloud bot	39803b04e6	fix(l10n): Update translations from Transifex ... Signed-off-by: Nextcloud bot <bot@nextcloud.com>	2026-06-06 00:23:11 +00:00
El Mehdi Abenhazou	af5f9aebeb	fix(TaskProcessing): restrict allowed_classes in Manager cache deserialization ... The availableTaskTypes cache stores serialized arrays containing ShapeDescriptor objects, ShapeEnumValue objects, and EShapeType enum values. The unserialize() call did not restrict which classes could be instantiated. Restrict deserialization to the three known types: - OCP\TaskProcessing\ShapeDescriptor - OCP\TaskProcessing\ShapeEnumValue - OCP\TaskProcessing\EShapeType This prevents PHP Object Injection if an attacker gains write access to the distributed cache backend. Signed-off-by: El Mehdi Abenhazou <mehdiananas007@gmail.com>	2026-06-04 13:12:54 +00:00
XananasX7	a8a2529827	fix(TaskProcessing): add allowed_classes to unserialize() in Manager cache ... The availableTaskTypes cache stores serialized arrays containing ShapeDescriptor objects, ShapeEnumValue objects, and EShapeType enum values. The unserialize() call did not restrict which classes could be instantiated. Restrict deserialization to the three known types: - OCP\TaskProcessing\ShapeDescriptor - OCP\TaskProcessing\ShapeEnumValue - OCP\TaskProcessing\EShapeType This prevents PHP Object Injection if an attacker gains write access to the distributed cache backend (e.g., a Redis instance without authentication or with weak ACLs), which is a known real-world attack vector in shared hosting and container environments.	2026-06-04 13:12:54 +00:00
Nextcloud bot	6f2ec3c6b6	fix(l10n): Update translations from Transifex ... Signed-off-by: Nextcloud bot <bot@nextcloud.com>	2026-06-04 00:24:05 +00:00
Anna Larch	705590e7d5	fix(appconfig,userconfig): restore pre-migration fallback for ownCloud migration ... AppConfig and UserConfig unconditionally queried NC-only columns (type, lazy, flags, indexed) that don't exist in ownCloud's database schema, breaking ownCloud → Nextcloud upgrades entirely before the schema migration steps could run. Restore the fallback pattern in both classes: on first loadConfig() call, if a DBException with REASON_INVALID_FIELD_NAME is thrown, set $migrationCompleted = false and retry selecting only the columns present in ownCloud's schema. INSERT and UPDATE statements also omit NC-only columns when $migrationCompleted is false. The catch block also guards against infinite recursion: if $migrationCompleted is already false when the exception fires, the exception is re-thrown instead of triggering another recursive call. Fixes: https://github.com/nextcloud/server/issues/57340 Signed-off-by: Anna Larch <anna@nextcloud.com> AI-Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-03 08:55:11 +02:00
Andy Scherzinger	ac7f4298b4	Merge pull request #60925 from nextcloud/backport/59813/stable33 ... [stable33] fix(sharing): set STATUS_ACCEPTED when creating USERGROUP subshare on…	2026-06-03 08:42:28 +02:00
Nextcloud bot	107f433747	fix(l10n): Update translations from Transifex ... Signed-off-by: Nextcloud bot <bot@nextcloud.com>	2026-06-03 00:36:24 +00:00
Josh	27131f9094	chore(DAV): fixup proxyexclude default value check ... Co-authored-by: Kate <26026535+provokateurin@users.noreply.github.com> Signed-off-by: Josh <josh.t.richards@gmail.com>	2026-06-02 16:02:14 +00:00
Josh	21b476ae6c	chore(DAV): fixup for lint ... Signed-off-by: Josh <josh.t.richards@gmail.com>	2026-06-02 16:02:14 +00:00
Josh	a93d904a46	fix(Storage): use proxyexclude parameter in DAV client ... Signed-off-by: Josh <josh.t.richards@gmail.com>	2026-06-02 16:02:14 +00:00
provokateurin	148ebf92d0	fix(Share): Add missing optional parameter to IManager::shareApiAllowLinks() ... Signed-off-by: provokateurin <kate@provokateurin.de>	2026-06-02 09:27:32 +00:00
Anna Larch	85202d7f4e	fix(sharing): restore STATUS_ACCEPTED for OC-migrated group share subshares ... When an ownCloud-migrated group share (which has no per-user USERGROUP subshare) is renamed for the first time, DefaultShareProvider::move() inserted a new USERGROUP row without setting `accepted`. The column defaulted to 0 (STATUS_PENDING), causing MountProvider to skip the share on the next login — the shared file disappeared for the recipient. Fix: set accepted = STATUS_ACCEPTED explicitly on the INSERT in DefaultShareProvider::move() for the TYPE_GROUP branch. Secondary fix: SharedMount::moveMount() silently returned true when updateFileTarget() threw (e.g. group no longer exists on an OC-migrated instance). Set $result = false in the catch block so View::rename() propagates the failure instead of silently corrupting VFS state. An opt-in occ command (sharing:fix-owncloud-group-shares) with --dry-run support is included to repair existing broken instances. It targets only TYPE_USERGROUP subshares with accepted=STATUS_PENDING and permissions!=0 (shares that were accepted but broken by the missing column default), leaving explicitly declined shares (permissions=0) untouched. AI-Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Anna Larch <anna@nextcloud.com>	2026-06-02 09:14:52 +00:00
provokateurin	a0a84f7041	fix(MailPlugin): Stop applying the offset twice and the limit per wide/exact ... Signed-off-by: provokateurin <kate@provokateurin.de>	2026-06-02 08:25:25 +02:00
provokateurin	b217889702	perf(MailPlugin): Optimize checking group memberships ... Signed-off-by: provokateurin <kate@provokateurin.de>	2026-06-02 08:24:38 +02:00