Merge pull request #39365 from nextcloud/backport/39323/39323-stable19

[stable19] getStorage before remove

Merge pull request #39425 from nextcloud/backport/39416/stable19

[stable19] fix(core): Add password confirmation requirement for getapppassword

Merge pull request #39436 from nextcloud/backport/39024/stable19

[stable19] [stable21] Increase from 100000 to 600000 iterations for hash_pbkdf2

Merge pull request #38584 from nextcloud/backport/38206/stable24

[stable24] Increase from 100000 to 600000 iterations for hash_pbkdf2

(cherry picked from commit a7dc41fb5efed25dca8a48be0ed80818be850921)

fix(core): Add password confirmation requirement for getapppassword

Signed-off-by: Joas Schilling <coding@schilljs.com>

getStorage before remove

Signed-off-by: Maxence Lange <maxence@artificial-owl.com>

Merge pull request #39352 from nextcloud/ci/sign-drone-stable19

[stable19] chore(CI): Sign .drone.yml file

chore(CI): Sign .drone.yml file

Signed-off-by: Joas Schilling <coding@schilljs.com>

Merge pull request #38288 from nextcloud/session-auth-check-username-19

[19] check the username when doing external storage session auth

check the username when doing external storage session auth

Signed-off-by: Robin Appelman <robin@icewind.nl>

Merge pull request #32479 from nextcloud/backport/32428/stable19

[stable19] Add Email validation

Add email validation

Signed-off-by: Anna Larch <anna@nextcloud.com>

Merge pull request #28931 from nextcloud/3rdparty-19

[stable19] Bump 3rdparty ref

[stable19] Bump 3rdparty ref

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Merge pull request #31258 from nextcloud/backport/30114/stable19

[stable19] Prevent writing invalid mtime

Prevent writing invalid mtime

Signed-off-by: John Molakvoæ <skjnldsv@protonmail.com>

Merge pull request #30878 from nextcloud/backport/30844/stable19

Prevent merging on EOL branches

Signed-off-by: John Molakvoæ <skjnldsv@protonmail.com>

Merge pull request #29521 from nextcloud/backport/29366/stable19

[stable19] Fix security issues when copying groupfolder with advanced ACL

Fix security issues when copying groupfolder with advanced ACL

Using advanced ACL, it is possible that an user has access to a
directory but not to a subdirectory, so the copying use
Common::copyFromStorage instead of Local::copyFromStorage.

Fix https://github.com/nextcloud/groupfolders/issues/1692

Signed-off-by: Carl Schwan <carl@carlschwan.eu>

Merge pull request #28819 from nextcloud/backport/28728/stable19

[stable19] Add database ratelimiting backend

Merge pull request #28813 from nextcloud/stable19-bump-refs

[stable19] Bump 3rdparty ref

Bump autoloader

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Add database ratelimiting backend

In case no distributed memory cache is specified this adds
a database backend for ratelimit purposes.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

[stable19] Bump 3rdparty ref

Includes https://github.com/nextcloud/3rdparty/pull/802 and https://github.com/nextcloud/3rdparty/pull/797

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Merge pull request #28809 from nextcloud/stable19-bump-ref

[stable19] Bump 3rdparty ref

[stable19] Bump 3rdparty ref

Contains https://github.com/nextcloud/3rdparty/pull/790

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Merge pull request #28756 from nextcloud/backport/28725/stable19

[stable19] Remove 2FA exemption from PublicPage annotation

Merge pull request #28757 from nextcloud/backport/28726/stable19

[stable19] Check if SVG path is valid

Resolve absolute path in tests

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Fix codestyle

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Check if SVG path is valid

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Adjust tests

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Remove 2FA exemption from PublicPage annotation

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

Merge pull request #27709 from nextcloud/version/19.0.13/final

[tx-robot] updated from transifex

[tx-robot] updated from transifex

19.0.13

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

Merge pull request #27619 from nextcloud/version/19.0.13/rc1

Merge pull request #27296 from nextcloud/dependabot/npm_and_yarn/stable19/nextcloud/axios-1.3.3

Bump @nextcloud/axios from 1.3.2 to 1.3.3

Merge pull request #27643 from nextcloud/fix/noid/integration-federation-stable19

[stable19] fix integration-federation_features tests

[tx-robot] updated from transifex

fix integration-federation_features tests

- the constructor was extended with the IConfig dependicy previously

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

update CA bundle

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

19.0.13 RC1

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

Merge pull request #27618 from nextcloud/backport/27610/stable19

[stable19] Throttle on public DAV endpoint

Bump @nextcloud/axios from 1.3.2 to 1.3.3

Bumps [@nextcloud/axios](https://github.com/nextcloud/nextcloud-axios) from 1.3.2 to 1.3.3.
- [Release notes](https://github.com/nextcloud/nextcloud-axios/releases)
- [Changelog](https://github.com/nextcloud/nextcloud-axios/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nextcloud/nextcloud-axios/compare/v1.3.2...v1.3.3)

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: npmbuildbot-nextcloud[bot] <npmbuildbot-nextcloud[bot]@users.noreply.github.com>

More test fixing

Signed-off-by: Joas Schilling <coding@schilljs.com>

Update autoloader map

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Add newline to satisfy phpcs

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Send "429 Too Many Requests" in case of brute force protection

Signed-off-by: Joas Schilling <coding@schilljs.com>

Merge pull request #27598 from nextcloud/backport/27596/stable19

[stable19] [stable20] Properly cleanup entries of WebAuthn on user deletion

Reference correct private variable

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Throttle on public DAV endpoint

We should throttle whenever an invalid request is sent to the public WebDAV endpoint.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

[tx-robot] updated from transifex

Merge pull request #27568 from nextcloud/dependabot/npm_and_yarn/stable19/ws-7.5.0

Remove throwing annotation

This class was just introduced in Nc 21.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Use execute instead of executeStatement

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Properly cleanup entries of WebAuthn on user deletion

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

Merge pull request #27457 from nextcloud/backport/27444/stable19

[stable19] Header must contain a colon

[tx-robot] updated from transifex

[Security] Bump ws from 7.2.3 to 7.5.0

Bumps [ws](https://github.com/websockets/ws) from 7.2.3 to 7.5.0. **This update includes security fixes.**
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](https://github.com/websockets/ws/compare/7.2.3...7.5.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Merge pull request #27572 from nextcloud/dependabot/npm_and_yarn/stable19/postcss-7.0.36

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[Security] Bump postcss from 7.0.18 to 7.0.36

Bumps [postcss](https://github.com/postcss/postcss) from 7.0.18 to 7.0.36. **This update includes a security fix.**
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/7.0.18...7.0.36)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

Header must contain a colon

[tx-robot] updated from transifex

Merge pull request #27223 from nextcloud/dependabot/npm_and_yarn/stable19/webpack-cli-3.3.12

Bump webpack-cli from 3.3.11 to 3.3.12

Merge pull request #27307 from nextcloud/backport/27062/stable19

[stable19] properly use limit and offset for search in Jail wrapper

[tx-robot] updated from transifex

Bump webpack-cli from 3.3.11 to 3.3.12

Bumps [webpack-cli](https://github.com/webpack/webpack-cli) from 3.3.11 to 3.3.12.
- [Release notes](https://github.com/webpack/webpack-cli/releases)
- [Changelog](https://github.com/webpack/webpack-cli/blob/master/CHANGELOG.md)
- [Commits](https://github.com/webpack/webpack-cli/compare/v3.3.11...v3.3.12)

Signed-off-by: dependabot[bot] <support@github.com>

[tx-robot] updated from transifex