Revert the token scope to not end up with storing the user used in the session

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Merge pull request #36396 from nextcloud/fix/cors

Fix(l10n): 🔠 Update translations from Transifex

Signed-off-by: Nextcloud bot <bot@nextcloud.com>

Merge pull request #36738 from nextcloud/deps/nextcloud/password-confirmation-4.0.4

fix(CORS): CORS should only be bypassed on `PublicPage` if not logged in to prevent CSRF attack vectors

Signed-off-by: Ferdinand Thiessen <rpm@fthiessen.de>

Merge pull request #36515 from nextcloud/fix/sharees-remove-deck

Merge pull request #36687 from nextcloud/release/26.0.0_beta_4

26.0.0 beta 4

Merge pull request #36556 from nextcloud/artonge/fix/expiring_file_versions_empty_db

Handle empty DB while expiring versions

Merge pull request #36735 from nextcloud/fix/32635/fix-vcf-contacts

fix the contacts-menu vcf-contact avatars

Merge pull request #36689 from nextcloud/fix/x-robots-tag-header

Change X-Robots-Tag header from "none" to "noindex, nofollow"

Merge pull request #36737 from nextcloud/enh/noid/fix-entries

fix too long entries in contacts-menu

Fix(l10n): 🔠 Update translations from Transifex

Signed-off-by: Nextcloud bot <bot@nextcloud.com>

Bump @nextcloud/password-confirmation from 4.0.3 to 4.0.4

Signed-off-by: Christopher Ng <chrng8@gmail.com>

fix too long entries in contacts-menu

Signed-off-by: Simon L <szaimen@e.mail.de>
Signed-off-by: nextcloud-command <nextcloud-command@users.noreply.github.com>

fix the contacts-menu vcf-contact avatars

Signed-off-by: Simon L <szaimen@e.mail.de>

Change X-Robots-Tag header from "none" to "noindex, nofollow"

While "none" is indeed equivalent to "noindex, nofollow" for Google, but seems to be not supported by Bing and probably other search engines.

https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta/name#other_metadata_names
https://developers.google.com/search/docs/crawling-indexing/robots-meta-tag?hl=de#comma-separated-list
https://www.bing.com/webmasters/help/which-robots-metatags-does-bing-support-5198d240

Signed-off-by: MichaIng <micha@dietpi.com>

Merge pull request #35365 from nextcloud/enh/check-opcache-file_cache_only

Check for opcache.file_cache_only=1

Merge pull request #36639 from nextcloud/userbackend-local-cache

also cache backend for user in memory instead of always going to redis

Merge pull request #36698 from nextcloud/db-profile-start-time

log start time of queries for profiler

Check for opcache.file_cache_only=1

which disables shared memory based OPcache with disk file cache used only, if enabled. In this case, "opcache.memory_consumption" and others do not apply, so show the correct performance recommendation to enable memory cache.

Signed-off-by: MichaIng <micha@dietpi.com>

Merge pull request #36691 from nextcloud/fix/25175/fix-config-truncating

add a disk_free_space check before writing config

Merge pull request #36443 from nextcloud/fix/23063/fix-login-log-entry

fix the login log entry

Merge pull request #36465 from nextcloud/bugfix/trashbin-concurrency

Compile assets

Signed-off-by: nextcloud-command <nextcloud-command@users.noreply.github.com>

address review by Joas

Signed-off-by: Simon L <szaimen@e.mail.de>

Fix(l10n): 🔠 Update translations from Transifex

Signed-off-by: Nextcloud bot <bot@nextcloud.com>

Merge pull request #36700 from nextcloud/bugfix/noid/bruteforce-protection-not-working

Also copy meta data when converting DataResponse to JSONRe…

Also copy bruteforce meta data when converting DataResponse to JSONResponse

Signed-off-by: Joas Schilling <coding@schilljs.com>

log start time of queries for profiler

Signed-off-by: Robin Appelman <robin@icewind.nl>

Merge pull request #36603 from nextcloud/imagick-cache-formats

cache formats supported by imagick

Merge pull request #36656 from nextcloud/route-instrumentation

Merge pull request #36675 from nextcloud/rakekniven-patch-3

l10n: Fixed grammar

Fix(l10n): 🔠 Update translations from Transifex

Signed-off-by: Nextcloud bot <bot@nextcloud.com>

DI for Router

Signed-off-by: Robin Appelman <robin@icewind.nl>

add a disk_free_space check before writing config

Signed-off-by: Simon L <szaimen@e.mail.de>

cache formats supported by imagick

turns out this can be quite slow

Signed-off-by: Robin Appelman <robin@icewind.nl>

Merge pull request #36643 from nextcloud/fs-setup-instrimuntion

more filesystem setup performance instrumentation

Merge pull request #36670 from nextcloud/automated/noid/master-update-psalm-baseline

[master] Update psalm-baseline.xml

Merge pull request #36674 from nextcloud/rakekniven-patch-2

l10n: Fixed grammar

26.0.0 beta 4

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

Merge pull request #36633 from nextcloud/fix/36632-create_an_accessible_name_for_logo

Create an accessible name for logo on logged in page

Merge pull request #36525 from nextcloud/fix/noid/params-put

fix: Only get params from PUT content if possible

Merge pull request #36646 from nextcloud/perf/files-setupfs

l10n: Fixed grammar

Reported at Transifex.

Signed-off-by: rakekniven <2069590+rakekniven@users.noreply.github.com>
Signed-off-by: rakekniven <2069590+rakekniven@users.noreply.github.com>
Signed-off-by: nextcloud-command <nextcloud-command@users.noreply.github.com>

Merge pull request #36641 from nextcloud/instrument-app-register

Add more profiler instrumentation to app loading

Create an accessible name for logo on logged in page

Signed-off-by: julia.kirschenheuter <julia.kirschenheuter@nextcloud.com>

Merge pull request #36568 from nextcloud/perf/flow-events

perf(workflowengine): Cache query that is performed on every request

Update psalm baseline

Signed-off-by: GitHub <noreply@github.com>

Fix(l10n): 🔠 Update translations from Transifex

Signed-off-by: Nextcloud bot <bot@nextcloud.com>

Merge pull request #36673 from nextcloud/rakekniven-patch-1

l10n: Fixed grammar

Fix(l10n): 🔠 Update translations from Transifex

Signed-off-by: Nextcloud bot <bot@nextcloud.com>

l10n: Fixed grammar

Reported at Transifex.

Signed-off-by: rakekniven <2069590+rakekniven@users.noreply.github.com>
Signed-off-by: rakekniven <2069590+rakekniven@users.noreply.github.com>

l10n: Fixed grammar

Reported at Transifex.

Signed-off-by: rakekniven <2069590+rakekniven@users.noreply.github.com>
Signed-off-by: rakekniven <2069590+rakekniven@users.noreply.github.com>

Merge pull request #36232 from nextcloud/enh/a11y-user-menu

Port user menu to Vue

Fix(l10n): 🔠 Update translations from Transifex

Signed-off-by: Nextcloud bot <bot@nextcloud.com>

perf(workflowengine): Cache query that is performed on every request

Signed-off-by: Julius Härtl <jus@bitgrid.net>

also cache backend for user in memory instead of always going to redis

Signed-off-by: Robin Appelman <robin@icewind.nl>

Merge pull request #36608 from nextcloud/storageinfo-no-explicit-setup

more routing performance instrumentation

Signed-off-by: Robin Appelman <robin@icewind.nl>

more filesystem setup performance instrumentation

Signed-off-by: Robin Appelman <robin@icewind.nl>

Merge pull request #36610 from nextcloud/folder-lazy-submounts

Fix(l10n): 🔠 Update translations from Transifex

Signed-off-by: Nextcloud bot <bot@nextcloud.com>

Port user menu to Vue

Signed-off-by: Christopher Ng <chrng8@gmail.com>

Merge pull request #36621 from nextcloud/perf/noid/only-check-for-token-when-it-can-actually-be

fix(performance): Only search for auth tokens when the provided login…

perf: No need to setup the full filesystem for getting storage info

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Merge pull request #36637 from nextcloud/fix/noid/file-ref-provider-safer-match

Merge pull request #36469 from nextcloud/perf/autoloading/files-external-authoritative-autoloader

Merge pull request #36192 from nextcloud/fix/caldav-reminders/fix-timezone-drift-all-day-reminders

fix(caldav): Fix reminder timezone drift for all-day events

instrumentation for app booting

Signed-off-by: Robin Appelman <robin@icewind.nl>

add more performance instrumentation for app registering

Signed-off-by: Robin Appelman <robin@icewind.nl>

Fix unit tests

Signed-off-by: Joas Schilling <coding@schilljs.com>

Merge pull request #36562 from nextcloud/debug/session-hash-slowdown

perf(autoloading): Add authoritative autoloader for files_external

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

fix(caldav): Fix reminder timezone drift for all-day events

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

Merge pull request #36625 from nextcloud/automated/noid/master-update-psalm-baseline

[master] Update psalm-baseline.xml

safer URL match in FileReferenceProvider

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

Merge pull request #36629 from nextcloud/release/26.0.0_beta_3

26.0.0 beta 3

fix(authtoken): Store only one hash for authtokens with the current password per user

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Merge pull request #36626 from nextcloud/perf/dav-auth-setupfs

Merge pull request #36590 from nextcloud/enh/load-app-once

Make sure application are only loaded once

only fetch the data for mounts inside a folder when needed

for most operations we don't actually care about any mounts inside a folder, only for metadata that needs to propagate across storage boundaries (size, etag, mtime) do we need all the submount info.

By only loading this data when needed we can save a bunch of storage setup in a number of cases

Signed-off-by: Robin Appelman <robin@icewind.nl>

Merge pull request #36587 from nextcloud/revert/34906

Revert "update 64-bit check wording"

26.0.0 beta 3

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

perf(dav): Do not call general setupFS on ever dav auth

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Merge pull request #36627 from nextcloud/dependabot/npm_and_yarn/sideway/formula-3.0.1

fix(authentication): Check minimum length when creating app tokens

Signed-off-by: Joas Schilling <coding@schilljs.com>

chore(deps): Bump @sideway/formula from 3.0.0 to 3.0.1

Bumps [@sideway/formula](https://github.com/sideway/formula) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/sideway/formula/releases)
- [Commits](https://github.com/sideway/formula/compare/v3.0.0...v3.0.1)

---
updated-dependencies:
- dependency-name: "@sideway/formula"
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Update psalm baseline

Signed-off-by: GitHub <noreply@github.com>

Fix(l10n): 🔠 Update translations from Transifex

Signed-off-by: Nextcloud bot <bot@nextcloud.com>

fix(performance): Only search for auth tokens when the provided login is long enough

Signed-off-by: Joas Schilling <coding@schilljs.com>

Merge pull request #36566 from nextcloud/mount-find-by-numeric-id

Handle empty DB while expiring versions

Version on the FS can have no equivalent in the DB if they were created before the version naming feature. This makes sure that we catch the resulting exception and proceed as usual.

Fix https://github.com/nextcloud/server/issues/36541

Signed-off-by: Louis Chemineau <louis@chmn.me>

remove explicit setup when getting storage info

the implicit setup gets enough data without having to do a full setup.

Saves having to do a full fs setup for the files webui template

Signed-off-by: Robin Appelman <robin@icewind.nl>

Merge pull request #36598 from nextcloud/automated/noid/master-update-psalm-baseline

[master] Update psalm-baseline.xml

Merge pull request #36583 from nextcloud/artonge/fix/dont_scroll_hover_files-controls

Prevent scrolling hover .files-controls

Merge pull request #36564 from nextcloud/artonge/fix/restore_copy_button_text_on_error

Restore copy button text on directory fetch error

Merge pull request #36546 from nextcloud/enh/36543/allow-further-previews

imaginary - fix generation of heif, pdf, illustrator and svg thumbnails

Restore copy button text on directory fetch error

Signed-off-by: Louis Chemineau <louis@chmn.me>

Prevent scrolling hover .files-controls

Signed-off-by: Louis Chemineau <louis@chmn.me>

Merge pull request #29010 from mattian/fix/19218/birthday-leap-day

dav: fix birthday calendar event generation for leap days