feat: move csrf validation out of request

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>

Merge pull request #47225 from nextcloud/dependabot/npm_and_yarn/is-svg-5.1.0

chore(deps): bump is-svg from 5.0.1 to 5.1.0

Bumps [is-svg](https://github.com/sindresorhus/is-svg) from 5.0.1 to 5.1.0.
- [Release notes](https://github.com/sindresorhus/is-svg/releases)
- [Commits](https://github.com/sindresorhus/is-svg/compare/v5.0.1...v5.1.0)

---
updated-dependencies:
- dependency-name: is-svg
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #47212 from nextcloud/chore/master-is-now-31

Merge pull request #46809 from nextcloud/refactor/files_external/security-attributes

Merge pull request #47211 from nextcloud/fix/core/limit-valid-avatar-sizes

Merge pull request #47201 from nextcloud/fix/also-run-user-status-automation-for-start-and-end

fix(userstatus): run user status automation job for start and end events

Merge pull request #46887 from nextcloud/fix/versions-catch-insertion-error

fix(3rdparty): Update 3rdparty after dependabot changes

Signed-off-by: Joas Schilling <coding@schilljs.com>

Merge pull request #46966 from nextcloud/fix/cache-uploader-get-content-function

chore(assets): Recompile assets

Signed-off-by: Joas Schilling <coding@schilljs.com>

feat(branchoff): Bump versions and requirements in apps

Signed-off-by: Joas Schilling <coding@schilljs.com>

feat(release)!: Bump Server version to 31

Signed-off-by: Joas Schilling <coding@schilljs.com>

fix(security): Update expiration date in security.txt

Signed-off-by: Joas Schilling <coding@schilljs.com>

fix(CI)!: Add stable30 to and remove stable27 from GitHub Actions

Signed-off-by: Joas Schilling <coding@schilljs.com>

chore: compile assets

Signed-off-by: skjnldsv <skjnldsv@protonmail.com>

perf(files): Cache `getContents` function used for uploader

Instead of trigger a PROPFIND for every new-menu entry clicks,
or conflict handling of uploads, we can just use the cached content from the file store.
If we do not have any cache entry we fetch new, but otherwise this is not needed.

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

Merge pull request #46813 from nextcloud/refactor/files_versions/security-attributes

Merge pull request #46812 from nextcloud/refactor/files_trashbin/security-attributes

refactor(files_external): Replace security annotations with respective attributes

Signed-off-by: provokateurin <kate@provokateurin.de>

fix(userstatus): run user status automation job for start and end events

Signed-off-by: Anna Larch <anna@nextcloud.com>
Signed-off-by: Richard Steinmetz <richard@steinmetz.cloud>

Merge pull request #47016 from nextcloud/refactor/cleanup-files-view

Merge pull request #46806 from nextcloud/refactor/federation/security-attributes

Merge pull request #46814 from nextcloud/refactor/oauth2/security-attributes

Merge pull request #46816 from nextcloud/refactor/settings/security-attributes

Merge pull request #46821 from nextcloud/refactor/updatenotification/security-attributes

Merge pull request #47207 from nextcloud/fix/sticky-nav-item

chore(assets): Recompile assets

Signed-off-by: nextcloud-command <nextcloud-command@users.noreply.github.com>

refactor(files): Drop unneeded initial state

The initial state is no longer used, it was only used in legacy UI and in the f2v rewrite
it was only used for the `id` which can be loaded just from the URL.

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

fix(core): Limit valid avatar sizes

Signed-off-by: provokateurin <kate@provokateurin.de>

fix(files): Fix non-sticky sticky views in files nav

Signed-off-by: Christopher Ng <chrng8@gmail.com>
Signed-off-by: nextcloud-command <nextcloud-command@users.noreply.github.com>

Merge pull request #47209 from nextcloud/rakekniven-patch-2

chore(i18n): Improved grammar

Reported at Transifex.

Signed-off-by: rakekniven <2069590+rakekniven@users.noreply.github.com>
Signed-off-by: nextcloud-command <nextcloud-command@users.noreply.github.com>

Merge pull request #46888 from nextcloud/jtr/bfp-settings-app-default-enable

Merge pull request #46723 from nextcloud/feat/add-delta-sync-to-subscription-calendars

feat(webcal): only update modified and deleted events from webcal calendars

Merge pull request #45435 from nextcloud/feat/dav/upcoming-events-api

feat(dav): Add an API for upcoming events

Fix(l10n): Update translations from Transifex

Signed-off-by: Nextcloud bot <bot@nextcloud.com>

feat(dav): Add an API for upcoming events

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

Merge pull request #47200 from nextcloud/fix/issue-47193

fix: test variables before returning

Merge pull request #47202 from nextcloud/chore/nextcloud-auth-2_4

chore(deps): Update `@nextcloud/auth` to v2.4.0 and use `getCSPNonce` where possible

chore(assets): Recompile assets

Signed-off-by: nextcloud-command <nextcloud-command@users.noreply.github.com>

chore(deps): Update `@nextcloud/auth` to v2.4.0 and use `getCSPNonce` where possible

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

Merge pull request #43573 from nextcloud/HolgerHees-fix-csp-nonce-handling

Fix for ignored `CSP_NONCE` in ContentSecurity Header

Merge pull request #45786 from nextcloud/fix/caldav/default-vjournal

fix(caldav): allow VJOURNAL if no supported component set is specified

Merge pull request #45221 from nextcloud/feat/auth/authtoken-clean-up

feat(auth): Clean-up unused auth tokens and wipe tokens

fix: test variables before returning

Signed-off-by: SebastianKrupinski <krupinskis05@gmail.com>

fix(caldav): allow VJOURNAL if no supported component set is specified

This is mandated by the RFCs.

Signed-off-by: Richard Steinmetz <richard@steinmetz.cloud>

Merge pull request #47195 from nextcloud/bugfix/noid/return-correct-userid-on-fed-invites

fix(federation): Return the used userID to allow the inviting server …

Merge pull request #47198 from nextcloud/fix/issue-46700

Change label "Allow download" for better l10n

chore(assets): Recompile assets

Signed-off-by: Joas Schilling <coding@schilljs.com>

fix: Update translation string

Signed-off-by: Archisman Das <archisman.officials@gmail.com>

fix(federation): Return the used userID to allow the inviting server to react to the famous `mapUid` result

Signed-off-by: Joas Schilling <coding@schilljs.com>

Merge pull request #47189 from nextcloud/feat/noid/ship-twofactor_nextcloud_notification

chore: Ship twofactor_nextcloud_notification

feat(webcal): only update modified and deleted events from webcal calendars

Signed-off-by: Anna Larch <anna@nextcloud.com>

feat(auth): Clean-up unused auth tokens and wipe tokens

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

Merge pull request #41740 from nextcloud/Fix/duplicate-reminders

fix(dav): Handle duplicate event reminder

Merge pull request #47180 from nextcloud/fix/apply-group-limit-on-remove-from-group

Apply group limit on remove from group

Merge pull request #47181 from nextcloud/fix/new-folder-messae

fix(files): Add messages when "new folder" fails or gets cancelled

fix: handle-duplicate-reminder

Signed-off-by: hamza221 <hamzamahjoubi221@gmail.com>

Merge pull request #47188 from nextcloud/spreed/12950/avatar-menu-icon-color

fix(avatar): Fix icon-color for action-router contacts menu options

chore: Ship twofactor_nextcloud_notification

Signed-off-by: Joas Schilling <coding@schilljs.com>

fix(avatar): Fix icon-color for action-router contacts menu options

Signed-off-by: Joas Schilling <coding@schilljs.com>

chore(assets): Recompile assets

Signed-off-by: nextcloud-command <nextcloud-command@users.noreply.github.com>

feat: Provide CSP nonce as `<meta>` element

This way we use the CSP nonce for dynamically loaded scripts.
Important to notice: The CSP nonce must NOT be injected in `content` as
this can lead to value exfiltration using e.g. side-channel attacts (CSS selectors).

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

fix(files): Add messages when "new folder" fails or gets cancelled

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

test: Adjust tests for CSP nonce

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

fix: Make sure CSP nonce is not double base64 encoded

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

fix: Use `CSP_NONCE` env variable in ContentSecurity Header

We should use 'cspNonceManager' for requesting the NONCE value, because it is doing the same as before, except that it honors a CPS_NONCE environment variable if available.

Signed-off-by: Holger Hees <holger.hees@gmail.com>

Fix(l10n): Update translations from Transifex

Signed-off-by: Nextcloud bot <bot@nextcloud.com>

Merge pull request #47177 from nextcloud/fix/noid/preferred-taskprocessing-providers

[Task processing] Fix preferred providers

feat(taskprocessing): add text2text, text2image, contextWrite, transcribe and translate providers in the testing app

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

chore(tests): Fix import in cypress test limit_to_same_group.cy.ts

Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>

chore(tests): Fix SPDX license header on new cypress test

Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>

fix(tests): Adapt tests to change of DefaultShareProvider constructor

Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>

fix: Remove shares only if there are no more common groups between users

Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>

chore(tests): Test limiting sharing to same group

Signed-off-by: Louis Chemineau <louis@chmn.me>

fix(files_sharing): Delete user shares if needed when user is removed from a group

Signed-off-by: Louis Chemineau <louis@chmn.me>

fix(taskprocessing): select preferred provider when running sync task, fix task type values according to preferred provider

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

Merge pull request #46987 from nextcloud/fix/dav-public

fix(dav): Ensure share properties are also set on public remote endpoint

feat: Make `ISharedStorage` public API and reuse where possible

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

fix(dav): Ensure share properties are also set on public remote endpoint

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

Fix(l10n): Update translations from Transifex

Signed-off-by: Nextcloud bot <bot@nextcloud.com>

Fix(l10n): Update translations from Transifex

Signed-off-by: Nextcloud bot <bot@nextcloud.com>

Merge pull request #47157 from nextcloud/perf/prevent-extra-requests

perf(files): Prevent extraneous requests when tree children are loading

Merge pull request #47153 from nextcloud/trashbin-fix-folder-extract

fix: fix getting the folder node from the dav response

chore(assets): Recompile assets

Signed-off-by: nextcloud-command <nextcloud-command@users.noreply.github.com>

fix: fix getting the folder node from the dav response

Signed-off-by: Robin Appelman <robin@icewind.nl>

Fix(l10n): Update translations from Transifex

Signed-off-by: Nextcloud bot <bot@nextcloud.com>

chore: compile assets

Signed-off-by: Christopher Ng <chrng8@gmail.com>

perf(files): Prevent extraneous requests when tree children are loading

Signed-off-by: Christopher Ng <chrng8@gmail.com>

Merge pull request #47152 from nextcloud/fix/guest-layout

fix(styles): Guest layout should follow the new design

Merge pull request #47135 from nextcloud/fix/open-tags-in-folder

fix(systemtags): Sub folders should be opened in files

fix(systemtags): Sub folders should be opened in files

Currently this is simply broken and here are two ways:
1. Open subfolders in files view
2. Implement logic to save last request

1 is the way this is now implemented, basically copy-paste from the recent view.
2 is much more complicated because if we get `/2/foo/bar` as the path we need to know the source of `foo`, so we would need at least 2 requests or cache the previous directory. We do not do it like this for any view so lets just stick with 1 for now.

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

chore: Compile assets

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

fix(styles): Guest layout should follow the new design

1. Adjust some places that used the old pill-style design
2. Make indention consistent using tabs
3. Remove duplicates styles for inputs (also included in server.css) that conflic with nextcloud-vue styles

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

Merge pull request #47147 from nextcloud/fix/trim-new-folder

fix(files): trim names on new node creation

fix(files): trim names on new node creation

Signed-off-by: skjnldsv <skjnldsv@protonmail.com>
Signed-off-by: nextcloud-command <nextcloud-command@users.noreply.github.com>

Merge pull request #47149 from nextcloud/fix/disable-tags-editing

fix(files): Disable tags editing for shared files/folders with view only permission

chore(assets): Recompile assets

Signed-off-by: nextcloud-command <nextcloud-command@users.noreply.github.com>

fix(files): Disable tags editing for shared files/folders with view only permission

Signed-off-by: Konstantin Myakshin <molodchick@gmail.com>