fix error when using CORS with no auth credentials

Merge pull request #27622 from nextcloud/dependabot/npm_and_yarn/stable21/dompurify-2.2.9

Bump dompurify from 2.2.8 to 2.2.9

Bump dompurify from 2.2.8 to 2.2.9

Bumps [dompurify](https://github.com/cure53/DOMPurify) from 2.2.8 to 2.2.9.
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](https://github.com/cure53/DOMPurify/compare/2.2.8...2.2.9)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: npmbuildbot-nextcloud[bot] <npmbuildbot-nextcloud[bot]@users.noreply.github.com>

Merge pull request #27616 from nextcloud/backport/27610/stable21

[stable21] Throttle on public DAV endpoint

Merge pull request #27237 from nextcloud/dependabot/npm_and_yarn/stable21/moment-timezone-0.5.33

Bump moment-timezone from 0.5.32 to 0.5.33

Merge pull request #27231 from nextcloud/dependabot/npm_and_yarn/stable21/vue-loader-15.9.7

Bump vue-loader from 15.9.6 to 15.9.7

Reference correct private variable

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Throttle on public DAV endpoint

We should throttle whenever an invalid request is sent to the public WebDAV endpoint.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

[tx-robot] updated from transifex

Bump moment-timezone from 0.5.32 to 0.5.33

Bumps [moment-timezone](https://github.com/moment/moment-timezone) from 0.5.32 to 0.5.33.
- [Release notes](https://github.com/moment/moment-timezone/releases)
- [Changelog](https://github.com/moment/moment-timezone/blob/develop/changelog.md)
- [Commits](https://github.com/moment/moment-timezone/compare/0.5.32...0.5.33)

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: npmbuildbot-nextcloud[bot] <npmbuildbot-nextcloud[bot]@users.noreply.github.com>

Merge pull request #27250 from nextcloud/dependabot/npm_and_yarn/stable21/ws-7.4.6

[Security] Bump ws from 7.3.1 to 7.4.6

Merge pull request #27599 from nextcloud/backport/27596/stable21

[stable21] [stable20] Properly cleanup entries of WebAuthn on user deletion

Remove throwing annotation

This class was just introduced in Nc 21.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Use execute instead of executeStatement

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Properly cleanup entries of WebAuthn on user deletion

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

Merge pull request #27569 from nextcloud/dependabot/npm_and_yarn/stable21/postcss-7.0.36

[Security] Bump postcss from 7.0.35 to 7.0.36

Bumps [postcss](https://github.com/postcss/postcss) from 7.0.35 to 7.0.36. **This update includes a security fix.**
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/7.0.35...7.0.36)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

Merge pull request #27415 from nextcloud/backport/26494/stable21

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[tx-robot] updated from transifex

Merge pull request #27455 from nextcloud/backport/27444/stable21

[stable21] Header must contain a colon

[tx-robot] updated from transifex

Header must contain a colon

Merge pull request #27446 from nextcloud/backport/27429/stable21

[stable21] Don't pass a column object to addOrderBy

[tx-robot] updated from transifex

Merge pull request #27324 from nextcloud/stable21-backport-27024

[stable21] Properly log expiration date removal in audit log

Fix #26085

addOrderBy expects a order expression. For the migration scenario we have column objects. Column objects are not supported by quoteColumnName yet.

A column object as order expression is most likely an edgy thing when migration database information.

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>

Merge pull request #27303 from nextcloud/backport/27062/stable21

[stable21] properly use limit and offset for search in Jail wrapper

[tx-robot] updated from transifex

[tx-robot] updated from transifex

Check whether output buffering is active before turning it off

Before we just turned it off and @suppressed the error if ob was not active.
In PHP 8 this error is no longer suppressed, so try to not cause it at all.

Signed-off-by: Richard de Boer <git@tubul.net>

Fix a usort comparison function returning a boolean instead of an integer

PHP 8 shows deprecation warnings about this, see #25806

Signed-off-by: Richard de Boer <git@tubul.net>

Fix functions taking optional parameters before required ones

PHP 8 shows deprecation warnings about this, see #25806
Removes the "default" values, as they actually are required parameters anyway.

Signed-off-by: Richard de Boer <git@tubul.net>

Merge pull request #27411 from nextcloud/backport/27375/stable21

[stable21] Don't update statuses to offline again and again

Merge pull request #27015 from nextcloud/backport/26980-stable21

[stable21] Use parent wrapper to properly handle moves on the same source/target storage

Don't update statuses to offline again and again

Signed-off-by: Joas Schilling <coding@schilljs.com>

Merge pull request #27336 from nextcloud/backport/27329/stable21

[stable21] Propagate throttling on OCS response

Merge pull request #27359 from nextcloud/backport/27354/stable21

[stable21] Escape filename in Content-Disposition

[tx-robot] updated from transifex

Merge pull request #27333 from nextcloud/backport/27328/stable21

[stable21] emit UserLoggedInEvent on apache auth

[tx-robot] updated from transifex

[tx-robot] updated from transifex

Merge pull request #27350 from nextcloud/backport/25280/stable21

[stable21] Set umask before operations that create local files

Set umask before operations that create local files

this solves issues where "other php stuff" is messing with the umask

Signed-off-by: Robin Appelman <robin@icewind.nl>

Merge pull request #27347 from nextcloud/backport/27053/stable21

[stable21] Don't throw when comments is disabled

Merge pull request #27334 from nextcloud/backport/25770/stable21

[stable21] Don't allow executing cli if cache backend is unavailable

[tx-robot] updated from transifex

[tx-robot] updated from transifex

Merge pull request #27346 from nextcloud/debt/noid/missing-import

[stable21] Replace OCSController with OCP\API

Escape filename in Content-Disposition

We should escape all occurences of ' and \ in here.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Don't throw when comments is disabled

Signed-off-by: Joas Schilling <coding@schilljs.com>

Replace OCSController with OCP\API

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>

[tx-robot] updated from transifex

Propagate throttling on OCS response

The BaseResponse converter did not take over any throttling state from the DataResponse.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Don't allow executing cli if cache backend is unavailable

Signed-off-by: Richard Steinmetz <richard@steinmetz.cloud>

emit UserLoggedInEvent on apache auth

- post_login OC_Hook is barely used or listened to

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

Properly log expiration date removal in audit log

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Merge pull request #27318 from nextcloud/backport/27099/stable21

[stable21] Make user:report command scale

Make user:report command scale

Signed-off-by: Joas Schilling <coding@schilljs.com>

[tx-robot] updated from transifex

properly use limit and offset for search in Jail wrapper

Signed-off-by: Robin Appelman <robin@icewind.nl>

Merge pull request #27195 from nextcloud/backport/27188/stable21

[stable21] Fix the get editable fields endpoint without a user id

[tx-robot] updated from transifex

[tx-robot] updated from transifex

[Security] Bump ws from 7.3.1 to 7.4.6

Bumps [ws](https://github.com/websockets/ws) from 7.3.1 to 7.4.6. **This update includes security fixes.**
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](https://github.com/websockets/ws/compare/7.3.1...7.4.6)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Merge pull request #27248 from nextcloud/dependabot/npm_and_yarn/stable21/browserslist-4.16.6

[Security] Bump browserslist from 4.16.0 to 4.16.6

Bumps [browserslist](https://github.com/browserslist/browserslist) from 4.16.0 to 4.16.6. **This update includes a security fix.**
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](https://github.com/browserslist/browserslist/compare/4.16.0...4.16.6)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bump vue-loader from 15.9.6 to 15.9.7

Bumps [vue-loader](https://github.com/vuejs/vue-loader) from 15.9.6 to 15.9.7.
- [Release notes](https://github.com/vuejs/vue-loader/releases)
- [Changelog](https://github.com/vuejs/vue-loader/blob/master/CHANGELOG.md)
- [Commits](https://github.com/vuejs/vue-loader/compare/v15.9.6...v15.9.7)

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #27208 from nextcloud/backport/27199/stable21

[stable21] Use noreply@ as email address for share emails

Use noreply@ as email address for share emails

Fixes #26683

Before it used the instance name, which a) doesn't make sense to randomly guess email addresses and b) could contain characters that are not allowed in email addresses like spaces.

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

Merge pull request #27184 from nextcloud/dependabot/npm_and_yarn/stable21/various

[tx-robot] updated from transifex

Add integration tests for the editable fields

Signed-off-by: Joas Schilling <coding@schilljs.com>

Fix the get editable fields endpoint without a user id

Signed-off-by: Joas Schilling <coding@schilljs.com>

Npm build

Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>

Bump @babel/plugin-proposal-class-properties from 7.12.1 to 7.12.13

Bumps [@babel/plugin-proposal-class-properties](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-proposal-class-properties) from 7.12.1 to 7.12.13.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.12.13/packages/babel-plugin-proposal-class-properties)

Signed-off-by: dependabot[bot] <support@github.com>

Bump @nextcloud/capabilities from 1.0.2 to 1.0.4

Bumps [@nextcloud/capabilities](https://github.com/nextcloud/nextcloud-capabilities) from 1.0.2 to 1.0.4.
- [Release notes](https://github.com/nextcloud/nextcloud-capabilities/releases)
- [Changelog](https://github.com/nextcloud/nextcloud-capabilities/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nextcloud/nextcloud-capabilities/commits)

Signed-off-by: dependabot[bot] <support@github.com>

Bump dompurify from 2.2.6 to 2.2.8

Bumps [dompurify](https://github.com/cure53/DOMPurify) from 2.2.6 to 2.2.8.
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](https://github.com/cure53/DOMPurify/compare/2.2.6...2.2.8)

Signed-off-by: dependabot[bot] <support@github.com>

Bump autosize from 4.0.2 to 4.0.4

Bumps [autosize](https://github.com/jackmoore/autosize) from 4.0.2 to 4.0.4.
- [Release notes](https://github.com/jackmoore/autosize/releases)
- [Changelog](https://github.com/jackmoore/autosize/blob/master/changelog.md)
- [Commits](https://github.com/jackmoore/autosize/compare/4.0.2...4.0.4)

Signed-off-by: dependabot[bot] <support@github.com>

Bump css-vars-ponyfill from 2.4.2 to 2.4.5

Bumps [css-vars-ponyfill](https://github.com/jhildenbiddle/css-vars-ponyfill) from 2.4.2 to 2.4.5.
- [Release notes](https://github.com/jhildenbiddle/css-vars-ponyfill/releases)
- [Changelog](https://github.com/jhildenbiddle/css-vars-ponyfill/blob/master/CHANGELOG.md)
- [Commits](https://github.com/jhildenbiddle/css-vars-ponyfill/compare/v2.4.2...v2.4.5)

Signed-off-by: dependabot[bot] <support@github.com>

[tx-robot] updated from transifex

Merge pull request #27121 from nextcloud/backport/27117/stable21

[stable21] Add DB exception '@throws' tag to QBMapper PHPDoc

Merge pull request #27124 from nextcloud/backport/26282/stable21

[stable21] improve type handling of Avatar::generateAvatarFromSvg

improve type handling of Avatar::generateAvatarFromSv

Signed-off-by: Robin Appelman <robin@icewind.nl>

Merge pull request #27109 from nextcloud/backport/26466/stable21

[stable21] Move remnants of ocs api requests to v2 endpoint

Add DB exception throws tag to QBMapper PHPDoc

Signed-off-by: Anna Larch <anna@nextcloud.com>

Move remnants of ocs api requests to v2 endpoint

Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
Signed-off-by: npmbuildbot-nextcloud[bot] <npmbuildbot-nextcloud[bot]@users.noreply.github.com>

[tx-robot] updated from transifex

Merge pull request #27097 from nextcloud/backport/27040/stable21

[stable21] Avoid reading ~/.aws/config when using S3 provider

Avoid reading ~/.aws/config when using S3 provider

When using S3 storage, we sometimes have open_basedir errors due to aws-sdk-php trying to read ~/.aws/config which is out of open_basedir restrictions.
Christoph Wurst already added csm=false config in #21406 but it wasn't enough, we also need to set use_arn_region=false, added in this commit.

Signed-off-by: Florent <florent@coppint.com>

[tx-robot] updated from transifex