Bump css-vars-ponyfill from 2.4.1 to 2.4.2

Bumps [css-vars-ponyfill](https://github.com/jhildenbiddle/css-vars-ponyfill) from 2.4.1 to 2.4.2.
- [Release notes](https://github.com/jhildenbiddle/css-vars-ponyfill/releases)
- [Changelog](https://github.com/jhildenbiddle/css-vars-ponyfill/blob/master/CHANGELOG.md)
- [Commits](https://github.com/jhildenbiddle/css-vars-ponyfill/compare/v2.4.1...v2.4.2)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
Signed-off-by: npmbuildbot-nextcloud[bot] <npmbuildbot-nextcloud[bot]@users.noreply.github.com>

Merge pull request #24406 from nextcloud/enhancement/ldap-install-php-to-repair-step

Migrate LDAP's install.php to a repair step

Merge pull request #24440 from nextcloud/techdebt/noid/replace-static-unshare-call-in-test-with-sharemanager

Replace static call to Share::unshare with ShareManager->deleteShare in tests

Merge pull request #24340 from nextcloud/td/psalm/job_execute

Use proper OCP\BackgroundJobs\Job

Merge pull request #23652 from nextcloud/bug/circles-508/circles-public-shares

Fix public calendars shared to circles

Replace static call to Share::unshare with ShareManager->deleteShare in tests

And then cleanup all the code that is dead then...

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

Merge pull request #24439 from nextcloud/techdebt/noid/legacy-share-cleanup

[tx-robot] updated from transifex

Remove now unused methods in Share.php due to the reduced code complexity in Share::getItems

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

Remove unused method Share Helper::generateTarget

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

Reduce code complexity in Share::getItems by tracing all remaining callers

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

Remove unused Share::getItemSharedWithBySource()

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

Merge pull request #24405 from nextcloud-pr-bot/automated/noid/psalm-baseline-update

[Automated] Update psalm-baseline.xml

Update psalm baseline

Signed-off-by: GitHub <noreply@github.com>

[tx-robot] updated from transifex

[tx-robot] updated from transifex

Migrate LDAP's install.php to a repair step

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

Merge pull request #24413 from nextcloud/techdebt/remvoe-ldap-update-php

Remove the obsolete update.php of user_ldap

Remove the obsolete update.php of user_ldap

This was necessary long time ago for backwards compat with older
instances that were upgraded. Since this script has been run many times
with all the previous major versions, it's finally time to remove this.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

Merge pull request #24395 from nextcloud/techdebt/composer-require-simplexml

Require ext-simplexml via composer

[tx-robot] updated from transifex

Merge pull request #24393 from nextcloud/techdebt/unused-updater-check-app-upgrade

Remove dead method \OC\Updater::checkAppUpgrade

Require ext-simplexml via composer

This makes phpunit (and static analysis?) happy

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

Remove dead method \OC\Updater::checkAppUpgrade

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

Merge pull request #24319 from nextcloud/techdebt/noid/streamline-user-creation-and-deletion-events

Streamline user creation and deletion events

Merge pull request #24375 from nextcloud/fix/noid/display-remote-sharers-filelist

formatting remote sharer should take protocol, path into account

formatting remote sharer should take protocol, path into  account

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

Merge pull request #24382 from nextcloud/bugfix/noid/urlencode-inherited-shares

Properly encode path when fetching inherited shares

Properly encode path when fetching inherited shares

Signed-off-by: Julius Härtl <jus@bitgrid.net>

A valid user session is required for circles.

The circles app depends on a valid userId. A public shared calender might be viewed by guests without a user session. For such requests the principal is null.

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>

Update phpdoc for circleToPrincipal

as the QueryException is already catched inside circleToPrincipal.

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>

[tx-robot] updated from transifex

Merge pull request #24374 from nextcloud/bugfix/23542

Use proper bundles for files client and fileinfo

Merge pull request #23912 from nextcloud/objectstore-copy

use in objectstore copy

Files client and info bundles are always loaded so we don't need to load them again

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Use proper OCP\BackgroundJobs\Job

And typehunt the IJobList

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Merge pull request #24357 from nextcloud/fix/vcf-export-group-multiline

Make sure we add new line between vcf groups exports

Merge pull request #24363 from nextcloud/fix/versions-expire-storage-not-available

Catch storage not available in versions expire command

Merge pull request #24361 from nextcloud/fix/noid/fedshares-displaynames-again

send expected format of cloud id

Catch storage not available in versions expire command

External storage with session credentials is not accessible without a
user session, hence background jobs and CLI commands can't work with
them. The previously unhandled exception causes logged errors in the
nextcloud log. This patch catches the specific exception and logs it as
warnings. So for a production instance the error won't spam their logs
for this non-recoverable and technically unsolvable error if the minimum
log level is set to the default of 3 (error).

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

[tx-robot] updated from transifex

send expected format of cloud id

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

Make sure we add new line between vcf groups exports

Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>

Merge pull request #24162 from nextcloud/fix/noid/fedshares-displaynamez

set the display name of federated sharees from addressbook

Merge pull request #24341 from nextcloud/fix/sharing-enforce-expire-checkbox

Fix the config key on the sharing expire checkbox

use in objectstore copy

Signed-off-by: Robin Appelman <robin@icewind.nl>

Merge pull request #24331 from nextcloud/bugfix/fix-contactsmenu-position

Fix contacts menu position and show uid as a tooltip

Fix the config key on the sharing expire checkbox

We don't use `shareapi_internal_enforce_expire_date` anywhere.
`shareapi_enforce_internal_expire_date` is the one we want.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

Merge pull request #24324 from nextcloud/td/psalm/backgroundjob_job

Fix the OCP\BackgroundJob\Job to make it compatible with  its interface

set the display name of federated sharees from addressbook

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

Fix contacts menu position and show uid as a tooltip

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Merge pull request #24315 from nextcloud/fix/23174/flow-ops-fix-default-value

avoid empty null default with value that will be inserted anyways

Merge pull request #24272 from nextcloud/dependabot/npm_and_yarn/jquery-migrate-3.3.2

Merge pull request #24323 from nextcloud/fix/comments-tab-missing

Fix reverse registration and missing comments tab

Fix the OCP\BackgroundJob\Job to make it compatible with  its interface

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Bump jquery-migrate from 3.3.1 to 3.3.2

Bumps [jquery-migrate](https://github.com/jquery/jquery-migrate) from 3.3.1 to 3.3.2.
- [Release notes](https://github.com/jquery/jquery-migrate/releases)
- [Commits](https://github.com/jquery/jquery-migrate/compare/3.3.1...3.3.2)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
Signed-off-by: npmbuildbot-nextcloud[bot] <npmbuildbot-nextcloud[bot]@users.noreply.github.com>

Merge pull request #24312 from nextcloud/bugfix/noid/fix-router-alias

Add proper alias for internal router class

Merge pull request #24271 from nextcloud/dependabot/npm_and_yarn/babel/preset-env-7.12.7

Bump @babel/preset-env from 7.12.1 to 7.12.7

Merge pull request #24320 from nextcloud/typo/noid/fix-typo-in-deprecated

Fix typo in @deprecated PHPDoc tag

Merge pull request #24321 from nextcloud-pr-bot/automated/noid/psalm-baseline-update

[Automated] Update psalm-baseline.xml

Fix reverse registration and missing comments tab

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

Add proper alias for internal router class

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Update psalm baseline

Signed-off-by: GitHub <noreply@github.com>

[tx-robot] updated from transifex

Fix typo in @deprecated PHPDoc tag

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

Streamline user creation and deletion events

CreateUserEvent was the only one that didn't matched the naming scheme of BeforePASTTENSEEvent and PASTTENSEEvent. The event wasn't used at all so this just removes it again as there is BeforeUserCreatedEvent that is also available since 18.

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

avoid empty null default with value that will be inserted anyways

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

Merge pull request #24288 from nextcloud/techdebt/noid/encryption-setup-dependency-cleanup

Remove unused dependencies in encryption app setup

Bump @babel/preset-env from 7.12.1 to 7.12.7

Bumps [@babel/preset-env](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-env) from 7.12.1 to 7.12.7.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.12.7/packages/babel-preset-env)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
Signed-off-by: npmbuildbot-nextcloud[bot] <npmbuildbot-nextcloud[bot]@users.noreply.github.com>

Merge pull request #24289 from nextcloud/techdebt/noid/encryption-make-application-class-dependency-free

[encryption] Remove dependency fetching inside the constructor and mo…

Remove unused dependencies in encryption app setup

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

Merge pull request #24310 from nextcloud/perf/noid/theming-capabilities

Optimize check if background is themed

Merge pull request #24273 from nextcloud/dependabot/npm_and_yarn/babel/core-7.12.7

Bump @babel/core from 7.12.3 to 7.12.7

Optimize chek if background is themed

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Bump @babel/core from 7.12.3 to 7.12.7

Bumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.12.3 to 7.12.7.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.12.7/packages/babel-core)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
Signed-off-by: npmbuildbot-nextcloud[bot] <npmbuildbot-nextcloud[bot]@users.noreply.github.com>

Merge pull request #24275 from nextcloud/dependabot/npm_and_yarn/moment-timezone-0.5.32

Bump moment-timezone from 0.5.31 to 0.5.32

Merge pull request #24251 from nextcloud/fix/sabre-parse-xml-errors

Update sabre/xml to fix XML parsing errors (with empty strings)

Bump moment-timezone from 0.5.31 to 0.5.32

Bumps [moment-timezone](https://github.com/moment/moment-timezone) from 0.5.31 to 0.5.32.
- [Release notes](https://github.com/moment/moment-timezone/releases)
- [Changelog](https://github.com/moment/moment-timezone/blob/develop/changelog.md)
- [Commits](https://github.com/moment/moment-timezone/compare/0.5.31...0.5.32)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
Signed-off-by: npmbuildbot-nextcloud[bot] <npmbuildbot-nextcloud[bot]@users.noreply.github.com>

Update sabre/xml to fix XML parsing errors (with empty strings)

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

Merge pull request #24290 from nextcloud/propagate-taint

Add IRequest taint sources

Merge pull request #24293 from nextcloud/dependabot/composer/vimeo/psalm-4.2.1

Bump vimeo/psalm from 4.2.0 to 4.2.1

Bump vimeo/psalm from 4.2.0 to 4.2.1

Bumps [vimeo/psalm](https://github.com/vimeo/psalm) from 4.2.0 to 4.2.1.
- [Release notes](https://github.com/vimeo/psalm/releases)
- [Commits](https://github.com/vimeo/psalm/compare/4.2.0...4.2.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

[tx-robot] updated from transifex

Add IRequest taint sources

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

[encryption] Remove dependency fetching inside the constructor and move them to method call parameters

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

Merge pull request #24267 from nextcloud/techdebt/noid/auto-wire-encryption-app-view-dependent

Auto-wire remaining encryption app services that depend on View

Auto-wire remaining encryption app services that depend on View

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

Merge pull request #24269 from nextcloud/taint-specialize

Mark getAppPath as specialized taint

Merge pull request #24268 from nextcloud/add-app-as-sanitizer-for-include

Mark cleanAppId as sanitizer for include

[tx-robot] updated from transifex

Merge pull request #24276 from nextcloud/dependabot/npm_and_yarn/vue-material-design-icons-4.11.0

Bump vue-material-design-icons from 4.10.0 to 4.11.0

Bump vue-material-design-icons from 4.10.0 to 4.11.0

Bumps [vue-material-design-icons](https://github.com/robcresswell/vue-material-design-icons) from 4.10.0 to 4.11.0.
- [Release notes](https://github.com/robcresswell/vue-material-design-icons/releases)
- [Changelog](https://github.com/robcresswell/vue-material-design-icons/blob/dev/CHANGELOG.md)
- [Commits](https://github.com/robcresswell/vue-material-design-icons/compare/4.10.0...4.11.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

[tx-robot] updated from transifex

Mark getAppPath as specialized taint

Should remove some false positives.

https://psalm.dev/docs/security_analysis/avoiding_false_positives/

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Mark cleanAppId as sanitizer for include

Should remove a bunch of false positive code scanning results.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Allow View to be used via DI

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

Merge pull request #24064 from nextcloud/techdebt/noid/auto-wire-encryption-app

Auto-wire as much as possible in the encryption app

Merge pull request #24246 from LukasReschke/add-taint-flow-analysis

Add Psalm Security Analysis

Auto-wire as much as possible in the encryption app

Also cleans up only non-classname services in the server container

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

Add Psalm Taint Flow Analysis

This adds the Psalm Security Analysis, as described at
https://psalm.dev/docs/security_analysis/

It also adds a plugin for adding input into AppFramework.

The results can be viewed in the GitHub Security tab at
https://github.com/nextcloud/server/security/code-scanning

**Q&A:**

Q: Why do you not use the shipped Psalm version?
A: I do a lot of changes to the Psalm Taint behaviour. Using released
versions is not gonna get us the results we want.

Q: How do I improve false positives?
A: https://psalm.dev/docs/security_analysis/avoiding_false_positives/

Q: How do I add custom sources?
A: https://psalm.dev/docs/security_analysis/custom_taint_sources/

Q: We should run this on apps!
A: Yes.

Q: What will change in Psalm?
A: Quite some of the PHP core functions are not yet marked to propagate
the taint. This leads to results where the taint flow is lost. That's
something that I am currently working on.

Q: Why is the plugin MIT licensed?
A: Because its the first of its kind (based on GitHub Code Search) and
I want other people to copy it if they want to. Security is for all :)

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>