Bump js-yaml from 3.12.0 to 3.13.1 in /build

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 3.12.0 to 3.13.1.
- [Release notes](https://github.com/nodeca/js-yaml/releases)
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/3.12.0...3.13.1)

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #15187 from vitormattos/bugfix-create-database-user

Bugfix: user is not allowed

Merge pull request #16683 from nextcloud/fix/audit/disabled-user-message

Fix enable/disable user audit message

Merge pull request #16686 from nextcloud/fix/16684/return_int_getIf

Properly return an int in the getId function of the cache

[tx-robot] updated from transifex

Bump nextcloud-vue to 0.12.0 (#16681)

Bump nextcloud-vue to 0.12.0

Properly return an int in the getId function of the cache

fixes #16684

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Fix enable/disable user audit message

Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>

Bump nextcloud-vue to 0.12.0

Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>

[tx-robot] updated from transifex

Fix ie app menu loading click (#16667)

Fix ie app menu loading click

Fix ie app menu loading click

Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
Signed-off-by: npmbuildbot[bot] <npmbuildbot[bot]@users.noreply.github.com>

prevent the server's app-navigation's css to overrule the scop… (#16661)

prevent the server's app-navigation's css to overrule the scoped css …

prevent the server's app-navigation's css to overrule the scoped css in vue components

Signed-off-by: Marco Ambrosini <marcoambrosini@pm.me>

[tx-robot] updated from transifex

Merge pull request #16498 from nextcloud/feature/noid/room_metadata

Allow calendar resources/rooms to provide metadata

Merge pull request #16639 from nextcloud/feature/noid/new-types

Adding comparaison types: +regex +wildcard (fulltextsearch)

Merge pull request #16643 from nextcloud/enh/moreDIUsage

Lets use DI where we can

Merge pull request #16649 from nextcloud/dependabot/npm_and_yarn/nextcloud-vue-collections-0.5.6

Bump nextcloud-vue-collections from 0.5.4 to 0.5.6

Bump nextcloud-vue-collections from 0.5.4 to 0.5.6

Bumps [nextcloud-vue-collections](https://github.com/juliushaertl/nextcloud-vue-collections) from 0.5.4 to 0.5.6.
- [Release notes](https://github.com/juliushaertl/nextcloud-vue-collections/releases)
- [Commits](https://github.com/juliushaertl/nextcloud-vue-collections/compare/v0.5.4...v0.5.6)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
Signed-off-by: npmbuildbot[bot] <npmbuildbot[bot]@users.noreply.github.com>

[tx-robot] updated from transifex

Merge pull request #16651 from nextcloud/dependabot/npm_and_yarn/webpack-4.39.1

Bump webpack from 4.38.0 to 4.39.1

Bump webpack from 4.38.0 to 4.39.1

Bumps [webpack](https://github.com/webpack/webpack) from 4.38.0 to 4.39.1.
- [Release notes](https://github.com/webpack/webpack/releases)
- [Commits](https://github.com/webpack/webpack/compare/v4.38.0...v4.39.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
Signed-off-by: npmbuildbot[bot] <npmbuildbot[bot]@users.noreply.github.com>

[tx-robot] updated from transifex

[tx-robot] updated from transifex

Lets use DI where we can

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Add standard metadata key for room-features

Signed-off-by: Georg Ehrke <developer@georgehrke.com>

comparaison types: +regex +wildcard

Signed-off-by: Maxence Lange <maxence@artificial-owl.com>

Merge pull request #16525 from nextcloud/bugfix/external-user-substitution

files_external: proper user context for sharing

fix check for null

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

Adjust tests

Signed-off-by: Julius Härtl <jus@bitgrid.net>

fixes terminology and allows to request an IUser instance

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

adjusts LDAP's home handler to use the correct user object

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

do not send null value when string is expected

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

Provide proper user context from initMountPoints

Signed-off-by: Julius Härtl <jus@bitgrid.net>

files_external: Make sure the correct user context is used in substitution of variables

Signed-off-by: Julius Härtl <jus@bitgrid.net>

[tx-robot] updated from transifex

Allow to do a principal property search based on metadata keys

Signed-off-by: Georg Ehrke <developer@georgehrke.com>

Provide standard metadata keys for contact person of a resource

Signed-off-by: Georg Ehrke <developer@georgehrke.com>

Provide standard metadata keys for location of room

Signed-off-by: Georg Ehrke <developer@georgehrke.com>

Test resource and room principal backend to check that they provide metadata

Signed-off-by: Georg Ehrke <developer@georgehrke.com>

Merge pull request #16624 from nextcloud/bugfix/noid/versions-fetch-owner-only

Make sure we only fetch the file by id for the actual owner

Merge pull request #16622 from nextcloud/design/scrollbar

Standardize scrollbar color and width across Webkit and Firefox

Test sync of resource and room metadata

Signed-off-by: Georg Ehrke <developer@georgehrke.com>

Merge pull request #16586 from nextcloud/feature/16585_adminAuditShareCirclesRemotel/wiswedel

log circles and remote shares in admin_audit

log circles and remote shares in admin_audit

Signed-off-by: Sascha Wiswedel <sascha.wiswedel@nextcloud.com>

Merge pull request #16592 from nextcloud/bugfix/noid/federated-reshare

Fix permission check on incoming federated shares

Make sure we only fetch the file by id for the actual owner

Otherwise this will fetch all mounts for the file id which is quite
expensive and causes long saving times in big sharing structures

Signed-off-by: Julius Härtl <jus@bitgrid.net>

sync metadata of rooms / resources with cache

Signed-off-by: Georg Ehrke <developer@georgehrke.com>

provide room / resource properties as principal properties

Signed-off-by: Georg Ehrke <developer@georgehrke.com>

add oc_calendar_resources_md and oc_calendar_rooms_md tables

Signed-off-by: Georg Ehrke <developer@georgehrke.com>

Add \OCP\Calendar\IMetadataProvider interface and provider for common metadata keys

Signed-off-by: Georg Ehrke <developer@georgehrke.com>

[tx-robot] updated from transifex

Merge pull request #16618 from nextcloud/enh/csp/form-action

Add form-action CSP element

Standardize scrollbar color and width across Webkit and Firefox

Signed-off-by: Jan-Christoph Borchardt <hey@jancborchardt.net>

Update CSP test cases to handle the new form-action

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Add form-action CSP element

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Fix permission check on incoming federated shares

Since federated shares have their permissions set on the node, we do not need
to check for parent share permissions. Otherwise reshares of incoming federated
have no permission variable defined and creating them will fail

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Merge pull request #16619 from nextcloud/bugfix/16446/theming-url-validate

Validate urls in theming settings and properly handle error messages

Merge pull request #16544 from nextcloud/bugfix/16540

Add missing password reset page to vue

Merge pull request #16616 from nextcloud/dep/setEvalScript

setting unsafe-eval is deprecated

Validate urls in theming settings and properly handle error messages

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Move actual password reset to vue

Signed-off-by: Julius Härtl <jus@bitgrid.net>

[tx-robot] updated from transifex

setting unsafe-eval is deprecated

This will be removed in a future version of Nextcloud.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Merge pull request #16594 from nextcloud/tech-debt/noid/remove-unused-checkPasswordProtectedShare

Remove unused OC\Share\Share::checkPasswordProtectedShare

Merge pull request #16599 from nextcloud/fix/xss/on-favorite-file

Fix/xss/on favorite file

Merge pull request #16593 from nextcloud/fix/noid/more-precise-error-message

More precise error message when expected filesize does not match

Merge pull request #16579 from nextcloud/enh/PostLoginEvent

Add proper PostLoginEvent

Merge pull request #16596 from nextcloud/bugfix/noid/vtooltip-defaults

Set proper defaults for v-tooltip usages

Merge pull request #16595 from nextcloud/tech-debt/noid/no-need-to-document-the-obvious

Do not document the obvious

[tx-robot] updated from transifex

Bump bundles

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Force defaultHtml setting of v-tooltip to be disabled

Signed-off-by: Julius Härtl <jus@bitgrid.net>

prevent potential XSS via unchecked use innerHTML

Signed-off-by: Max Fichtelmann <max.fichtelmann@procilon.de>

fix XSS when adding a file with a malicious name to favorites

Signed-off-by: Max Fichtelmann <max.fichtelmann@procilon.de>

Merge pull request #16502 from nextcloud/bugfix/16474

Check the if we can actually access the storage cache for recent files

Merge pull request #16591 from nextcloud/fix/noid/typo-in-comment

Fix typo in comment

Update tests

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Add proper PostLoginEvent

This can be used by othr mechanisms to listen for this event in a lazy
fashion.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Do not document the obvious

This removes PHPDoc that is already available as source code type hints.

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

Remove unused OC\Share\Share::checkPasswordProtectedShare

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

More precise error message when expected filesize does not match - could be on reading or writing side

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

Fix typo in comment

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

Merge pull request #16582 from nextcloud/enh/split_up_security_middleware

Split up security middleware

Merge pull request #16563 from nextcloud/enh/lostcontroller/better_exceptions

Use proper exception in lostController

Merge pull request #16581 from nextcloud/dep/strict_csps_can_go

No need to have these classes we tighten the default CSP from time to time

Merge pull request #16570 from nextcloud/enh/supress_touch_error

Supress warnings touch can generate

Merge pull request #16571 from nextcloud/enh/update_preview_controller

Update PreviewController

[tx-robot] updated from transifex

Merge pull request #16573 from nextcloud/fix-default-timeouts-in-oc-notification

Fix default timeouts in OC.Notification

Merge pull request #16583 from nextcloud/dependabot/npm_and_yarn/webpack-4.38.0

Bump webpack from 4.36.1 to 4.38.0

[tx-robot] updated from transifex

Bump webpack from 4.36.1 to 4.38.0

Bumps [webpack](https://github.com/webpack/webpack) from 4.36.1 to 4.38.0.
- [Release notes](https://github.com/webpack/webpack/releases)
- [Commits](https://github.com/webpack/webpack/compare/v4.36.1...v4.38.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Use proper exception in lostController

There is no need to log the expcetion of most of the stuff here.
We should properly log them but an exception is excessive.

This moves it to a proper exception which we can catch and then log.
The other exceptions will still be fully logged.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Split up security middleware

With upcoming work for the feature policy header. Splitting this in
smaller classes that just do 1 thing makes sense.

I rather have a few small classes that are tiny and do 1 thing right
(and we all understand what is going on) than have big ones.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

No need to have these classes we tighten the default CSP from time to
time

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Merge pull request #16560 from nextcloud/bugfix/noid/fix_cutype_reporting

fix calendar-user-type reporting

Merge pull request #16558 from nextcloud/enh/less_verbose_locked_logging

Do not log all locked exceptions

[tx-robot] updated from transifex