upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-02-16 17:30:55 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 11
79991 commits 693 branches 1185 tags 6.5 GiB
Commit graph

285 commits

Author SHA1 Message Date
Johannes Endres
76d4138736 fix: Change UserAgent to *cloud 
Co-authored-by: Daniel Kesselberg <mail@danielkesselberg.de>
Signed-off-by: Johannes Endres <je@johannes-endres.de>
 2025-02-21 09:30:10 +00:00
Joas Schilling
77fddb8f23 fix(ratelimit): Allow to bypass rate-limit from bruteforce allowlist 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2025-01-27 13:21:36 +00:00
Joas Schilling
dd101dd0f7
Merge pull request #49515 from nextcloud/bugfix/noid/boolean-false-in-multipart-form-data 
fix(controller): Fix false booleans in multipart/form-data
 2024-11-28 14:46:16 +01:00
Joas Schilling
1909b981a4
fix(controller): Fix false booleans in multipart/form-data 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2024-11-28 12:18:30 +01:00
Louis Chemineau
512f3caf57
test:(PasswordConfirmationMiddleware): Fix constructor call 
Signed-off-by: Louis Chemineau <louis@chmn.me>
 2024-11-28 11:05:10 +01:00
Joas Schilling
54c3aa3f99
fix(entity): Fix mapping of old/sub-types to actually supported database types 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2024-10-23 09:22:05 +02:00
Ferdinand Thiessen
db94e10af0
fix: Prevent breaking change in IQueryBuilder 
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
 2024-10-17 18:31:44 +02:00
Ferdinand Thiessen
ee02e3246d
feat(AppFramework): Add full support for date / time / datetime columns 
This adds support for all Doctrine supported types, for the column types only the immutable variants needed to be added.
But especially those types are the important ones, as our **Entity** class works by detecting changes through setters.
Meaning if it is mutable, changes like `$entity->date->modfiy()` can not be detected, so the immutable types make more sense here.

Similar the parameter types needed to be added.

`Enity` and `QBMapper` needed to be adjusted so they support (auto map) those types, required when insert or update an entity.

Also added more tests, especially to make sure the mapper really serializes the values correctly.

Co-authored-by: Ferdinand Thiessen <opensource@fthiessen.de>
Co-authored-by: Côme Chilliet <91878298+come-nc@users.noreply.github.com>
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
 2024-10-17 18:31:42 +02:00
provokateurin
9836e9b164
chore(deps): Update nextcloud/coding-standard to v1.3.1 
Signed-off-by: provokateurin <kate@provokateurin.de>
 2024-09-19 14:21:20 +02:00
Kate
8a32881633
Merge pull request #48008 from nextcloud/fix/entity/strict-types 2024-09-16 11:08:35 +02:00
Anna
d46f271b1f
Merge pull request #48049 from nextcloud/refactor/void-tests 
refactor: Add void return type to PHPUnit test methods
 2024-09-16 00:11:41 +02:00
Christoph Wurst
49dd79eabb
refactor: Add void return type to PHPUnit test methods 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2024-09-15 22:32:31 +02:00
Christoph Wurst
1ee833efab
refactor: Replace __CLASS__ with ::class references 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2024-09-15 21:40:55 +02:00
provokateurin
247b1dd70e
fix(Entity): Fix magic setter call for custom strong typed setters 
Signed-off-by: provokateurin <kate@provokateurin.de>
 2024-09-15 15:14:54 +02:00
Côme Chilliet
359bbce3af chore: Adapt tests to OC_API refactoring 
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
 2024-09-09 10:46:29 +02:00
Ferdinand Thiessen
4d2556d4cf
refactor(IMenuAction): Make public menu actions use the new Vue UI 
This removes custom rendering code an replaces it with the declarative menu actions.
Also adjust the template to allow the Vue UI to mount.
Custom entries still are possible.

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
 2024-09-03 16:07:49 +02:00
Ferdinand Thiessen
92f3f7e2d2
chore: Remove unused CsrfTokenManager from CSPMiddleware 
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
 2024-08-31 00:34:41 +02:00
Daniel Kesselberg
af6de04e9e
style: update codestyle for coding-standard 1.2.3 
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
 2024-08-25 19:34:58 +02:00
Robin Appelman
8b60df1600
perf: delay getting (sub)admin status for user in the security middleware untill we need it 
Signed-off-by: Robin Appelman <robin@icewind.nl>
 2024-08-23 15:26:40 +02:00
Ferdinand Thiessen
2916e5df7e
feat: Provide CSP nonce as <meta> element 
This way we use the CSP nonce for dynamically loaded scripts.
Important to notice: The CSP nonce must NOT be injected in `content` as
this can lead to value exfiltration using e.g. side-channel attacts (CSS selectors).

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
 2024-08-13 10:32:44 +02:00
Ferdinand Thiessen
009761be58
test: Adjust tests for CSP nonce 
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
 2024-08-13 10:06:32 +02:00
skjnldsv
db28aa8cd1 fix(files_sharing): show proper share not found error message 
Signed-off-by: skjnldsv <skjnldsv@protonmail.com>
 2024-08-06 16:25:10 +02:00
provokateurin
9d1705259c
fix(AppFramework): Allow requests with OCS-APIRequest header to pass CSRF checks 
Signed-off-by: provokateurin <kate@provokateurin.de>
 2024-07-25 17:31:49 +02:00
Joas Schilling
047479ccf9
feat(security): Add public API to allow validating IP Ranges and checking for "in range" 
Signed-off-by: Joas Schilling <coding@schilljs.com>
Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
 2024-07-19 16:28:03 +02:00
Benjamin Gaussorgues
202e5b1e95
feat(security): restrict admin actions to IP ranges 
Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
 2024-07-19 16:28:03 +02:00
provokateurin
e5dcdfb9e0
feat(Security): Warn about using annotations instead of attributes 
Signed-off-by: provokateurin <kate@provokateurin.de>
 2024-07-18 11:25:32 +02:00
provokateurin
5aefdc399e
feat(AppFramework): Add ExAppRequired attribute 
Signed-off-by: provokateurin <kate@provokateurin.de>
 2024-07-01 14:41:20 +02:00
Arthur Schiwon
f6d6efef3a
refactor(Token): introduce scope constants 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2024-06-05 19:01:14 +02:00
Arthur Schiwon
340939e688
fix(Session): avoid password confirmation on SSO 
SSO backends like SAML and OIDC tried a trick to suppress password
confirmations as they are not possible by design. At least for SAML it was
not reliable when existing user backends where used as user repositories.

Now we are setting a special scope with the token, and also make sure that
the scope is taken over when tokens are regenerated.

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2024-06-05 19:01:13 +02:00
Andy Scherzinger
1f7e2ba599
chore: Add SPDX header 
Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
 2024-05-13 17:41:36 +02:00
Côme Chilliet
a0be3ffdf2
fix: Fix tests following OC_App migrations to IAppManager 
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
 2024-04-22 12:21:55 +02:00
Florian Klinger
f3a4abd98c
fix: add check for app_api_system session flag to bypass rate limit 
Signed-off-by: Florian Klinger <florian.klinger@nextcloud.com>
Signed-off-by: Andrey Borysenko <andrey18106x@gmail.com>
 2024-03-18 20:09:15 +02:00
Klaus
747aeded9d fix xml ocs response for serializable objects 
Signed-off-by: sualko <klaus@jsxc.org>
Signed-off-by: skjnldsv <skjnldsv@protonmail.com>
 2024-02-23 14:49:22 +01:00
Joas Schilling
9ed3ab7d87
test(request): Add tests to strip the port when forwarding requests 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2024-02-13 16:51:13 +01:00
Anna Larch
6434ce96c9 Add timezone getter to ITimeFactory 
Signed-off-by: Anna Larch <anna@nextcloud.com>
 2024-02-13 13:29:06 +01:00
Maxence Lange
31c1bc1c62 better tests 
Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
 2024-02-01 13:40:27 -01:00
Maxence Lange
1956be4118 fix lint 
Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
 2024-01-31 21:13:32 -01:00
Maxence Lange
e1d7328bb2 adding test 
Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
 2024-01-31 21:13:32 -01:00
Arthur Schiwon
216b95f8b1 test(unit): fix RequestTest 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2024-01-27 15:11:26 +01:00
Joas Schilling
f6b6776c93
fix(API): Use a distinct exception so apps can react to it and customize the return 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2023-11-28 06:11:57 +01:00
Arthur Schiwon
3fa43a529b
enh(dispatcher): enforce psalm ranges in the http dispatcher 
- allows devs to provide int ranges for API arguments

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2023-11-24 12:46:38 +01:00
Joas Schilling
aa5f037af7
chore: apply changes from Nextcloud coding standards 1.1.1 
Signed-off-by: Joas Schilling <coding@schilljs.com>
Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
 2023-11-23 10:36:13 +01:00
Ferdinand Thiessen
ecf9f0a872
fix(CSP): Only add strict-dynamic when using nonces 
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
 2023-11-17 22:01:02 +01:00
Ferdinand Thiessen
e231abd9bf
fix!(ContentSecurityPolicy): Make strict-dynamic enabled by default on script-src-elem 
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
 2023-11-17 14:42:36 +01:00
Ferdinand Thiessen
7df9eb3351 feat(ContentSecurityPolicy): Allow to set strict-dynamic on script-src-elem only 
This adds the possibility to set `strict-dynamic` on `script-src-elem` only while keep the default rules for `script-src`.
The idea is to allow loading module js which imports other files and thus does not allow nonces on import but on the initial script tag.

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
 2023-11-17 11:12:57 +01:00
Joas Schilling
2fa78f6245
Reverse X-Forwarded-For list to read the correct proxy remote address 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2023-11-16 07:45:19 +01:00
Christoph Wurst
78842348b2
feat(dependencyinjection): Allow optional (nullable) services 
Allows working with classes that might or might not be available.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2023-11-03 11:53:43 +01:00
Ferdinand Thiessen
154a9989a7
Merge pull request #39852 from nextcloud/pragmaHeader 
Stop sending deprecated Pragma header
 2023-10-18 03:30:21 +02:00
Joas Schilling
25309bcb45
techdebt(DI): Use public IThrottler interface which exists since Nextcloud 25 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2023-08-28 15:50:45 +02:00
Git'Fellow
066f6ef16c Stop sending deprecated Pragma header 
Signed-off-by: Git'Fellow <12234510+solracsf@users.noreply.github.com>
 2023-08-28 15:11:22 +02:00