Lukas Reschke [Wed, 12 Nov 2014 14:56:02 +0000 (15:56 +0100)]
Try to read the file only instead of trying to touch
The permissions are already catched properly on the installation so we just have to check whether the file is readable to prevent fatal errors from happening.
Lukas Reschke [Tue, 25 Nov 2014 12:52:44 +0000 (13:52 +0100)]
The "dir" key is used within the public sharing template to indicate in which directory the user currently is when sharing a directory with subdirectories. This is needed by the JS scripts.
However, when not accessing a directory then "dir" was set to the relative path of the file (from the user's home directory), meaning that for every public shared file the sharee can see the path.
(For example if you share the file "foo.txt" from "finances/topsecret/" the sharee would still see the path "finances/topsecret/" from the shared HTML template)
This is not the excpected behaviour and can be considered a privacy problem, this patch addresses this by setting "dir" to an empty key.
Port of https://github.com/owncloud/core/pull/12262, approved with https://github.com/owncloud/core/pull/12262#issuecomment-64394040
Lukas Reschke [Fri, 21 Nov 2014 14:35:14 +0000 (15:35 +0100)]
Use `/` as redirect location if webroot is set to an empty value
If the webroot has been set to an empty value or ownCloud has been installed at the root location (`/``) there is a fair chance that the redirect for password resets does not work at all.
This means that while the password is getting resetted the user is not redirected to the login page.
I'm aware that it might be better to just set the webroot to `/` in those cases but this patch is better in the regard that it cannot break stuff.
Thanks to @PVince81 for helping me debugging this. (I'm a moron and assumed it couldn't be THAT easy)
Vincent Petry [Fri, 14 Nov 2014 11:45:36 +0000 (12:45 +0100)]
Show warning when invalid user was passed
Sometimes there are bugs that cause setupFS() to be called for
non-existing users. Instead of failing hard and breaking the instance,
this fix simply logs a warning.
Joas Schilling [Mon, 25 Aug 2014 12:29:07 +0000 (14:29 +0200)]
Use md5() of the original name instead of uniqid() for slugifying
Previously we used uniqid() here.
However this means that the behaviour is not reproducable, so
when uploading files into a "empty" folder, the folders name is
different.
If there would be a md5() hash collition, the deduplicate check
will spot this and append an index later, so this should not be
a problem.
file size on non-(Linux/BSD/Windows)-installations
Determining the file size using the exec() method is implemented for Linux, BSD, and Windows. However, on systems matching neither platform name (like SunOS), the fall-through path will return a file size result constituting a zero size instead of an invalid null return value.
Lukas Reschke [Thu, 13 Nov 2014 10:15:47 +0000 (11:15 +0100)]
Ignore port for trusted domains
This lead to a lot of confusion in the past and did not really offer any value. Let's remove the port check therefore. (it's anyways not really a part of the domain)
Fixes https://github.com/owncloud/core/issues/12150 and https://github.com/owncloud/core/issues/12123 and also a problem reported by @DeepDiver1975.
Vincent Petry [Tue, 11 Nov 2014 14:20:36 +0000 (15:20 +0100)]
Fix root path handling for WebDAV ext storage
Added missing cleanPath() call that converts "/" to "" when calling
SabreDAV. This is needed because SabreDAV will discard its base URL when
passing "/".
Lukas Reschke [Tue, 11 Nov 2014 16:26:08 +0000 (17:26 +0100)]
Run preupdate before an update
The update routine tries to test the database migration before actually performing the update.
However, this will fail hard if the schema has changed (for example an unique key has been added). App developers can convert the DB in preupdate.php, however it is not called before and therefore the update fails.
This actually breaks ownCloud updates from ownCloud 6 to ownCloud 7 when the files_antivirus app is enabled.
Vincent Petry [Thu, 6 Nov 2014 09:59:36 +0000 (10:59 +0100)]
Convert StorageNotAvailableException to SabreDAV exception
Convert \OCP\Files\StorageNotAvailableException to
\Sabre\DAV\Exception\ServiceUnavailable for every file/directory
operation happening inside of SabreDAV.
This is necessary to avoid having the exception bubble up to remote.php
which would return an exception page instead of an appropriate response.
Arthur Schiwon [Wed, 29 Oct 2014 17:52:55 +0000 (18:52 +0100)]
on xp'ed mode and switching configurations: save raw mode instead of toggling filter mode in tabs since their status is unknown and dealt with by the Wizard. Fixes #11848
Show login again instead of JSON if CSRF check fails
Previously a JSON error page was shown to the user in-case the CSRF token was not valid. This was confusing and prevented people from login.
With this at least the login page is shown again and not a JSON error message. I consider this as sufficient since adding a new error page just for this sake would uneededly make lib/base.php even more cluttered and this is a edge-case which optimally should anyways not happen that often.
This can be tested by opening the login page, then clearing the cookies, and trying to login.
projects / nextcloud-server.git / log