nextcloud

Commit Graph

Author	SHA1	Message	Date
Thomas Müller	682821c71e	Happy new year!	8 years ago
Lukas Reschke	4d0dcd3c53	Add X-Download-Options and X-Permitted-Cross-Domain-Policies Two small security hardenings for our IE users and those with Adobe products. Aligns it more with https://github.com/twitter/secureheaders#secureheaders---	8 years ago
Morris Jobke	8b6b042ffd	Add config switch to disable the .well-known URL check	8 years ago
Morris Jobke	a6c7cdd75e	Show the well-known URL check as info instead of error * ref https://github.com/owncloud/core/pull/21562#issuecomment-170344549	8 years ago
Morris Jobke	0161928fc3	Add check for .well-known URL in the root of the webservers URL * fixes #20012	8 years ago
Joas Schilling	334a6d57a3	Check the correct config for displaying the "notify by email" option	8 years ago
Roeland Jago Douma	6bd15856b2	Added js tests for the Sharee API usage	8 years ago
Roeland Jago Douma	49031e0744	Fix unit tests	8 years ago
Roeland Jago Douma	f99fcd5dd6	Filter out share owner in sharee suggestion list	8 years ago
Roeland Jago Douma	fa7996aa8a	Web sharing uses sharee endpoint	8 years ago
Roeland Jago Douma	2fc458479e	[Avatars] Calculate 'sane' hue precissions We used to get the numeric value of the entrire md5 string which is a 128bit integer. We would then devide this by the maxval of a 128bit int. There is no need for such huge computations. As we just require a value between 0 and 255. Thus using two 16 bit values is more than enough to get the precision we need. By just taking the MSB we get nearly identical results.	8 years ago
Roeland Jago Douma	9be43e10af	Since the server no longer calculates the icon The server no longer calculates the icon. So we have the js side do it for us.	8 years ago
Lukas Reschke	cebeb0e052	Fix unit tests Fixes https://github.com/owncloud/core/issues/21345	8 years ago
Renaud Fortier	83899a5fa1	add _blank to href	8 years ago
Morris Jobke	ed98cdf532	Use OCP\Util::getVersion instead of the internal private implementation	8 years ago
Roeland Jago Douma	c64e827f00	Since avatar.js is now essentially empty remove it	8 years ago
Roeland Jago Douma	6248bad0f7	Add a default size to the avatar placeholders This removed the need to do an avatar request on the "empty" row in the user settings.	8 years ago
Roeland Jago Douma	a81836a42f	Only load the big (128x128) avatar on the perosnal page Before the code was executed on every page if a user was logged in. Now only on the personal page. Thus saving a request on all other pages.	8 years ago
Vincent Petry	181ba7b4e1	Fix files UI mtime parsing from webdav	8 years ago
Vincent Petry	ab9849e72f	Use Authorization headers for public webdav instead of URL Instead of prepending the token as username in the URL, use the Authorization header instead. This is because IE9 considers this a cross-domain call and refuses to do it in the first place.	8 years ago
Roeland Jago Douma	e8d5eb65c6	Files can't have create permissions Fixes #20839	8 years ago
Vincent Petry	69ab047f89	Redirect to correct URL after updating Now requires a trailing slash to make sure we don't land on the forbidden page.	8 years ago
Vincent Petry	5567b6cee2	Fix unshare link click element When clicking on the unshare link (trash icon), the correct link element needs to be used instead of whatever child was clicked. Then, that element might contain a visible loading icon. This fixes the spinner detection and also prevents a full page reload in case the spinner was visible.	8 years ago
Vincent Petry	6735005be0	Fix duplicate bogus share field when link sharing is not allowed Whenever link share is not allowed, it was outputting a bogus sharing field which name would conflict with the regular sharing field. This fix makes sure that the bogus sharing field with "Resharing not allowed" message only appears when triggered by removed share permissions.	8 years ago
Joas Schilling	87bc02c6cd	Allow specifying a custom reset-password-url	8 years ago
Thomas Müller	9c550a07ed	OC.FilePath has still a valid use case when generating paths to static files what for generateUrl cannot be used for - closes #15604	8 years ago
Roeland Jago Douma	50d862e5d1	[Avatars] JS should not load same avatar twice Old code first dit an ajax request to the avatar. Then a new image object with the same src was created and since we do not cache avatars yet :( this resulted in 2 sequential requests to the exact same URL Now if you set the displayname it will first set the placeholder and then load the avatar in the background. Only once this time!	8 years ago
Lukas Reschke	2515cb17be	Support pretty URLs This changeset allows ownCloud to run with pretty URLs, they will be used if mod_rewrite and mod_env are available. This means basically that the `index.php` in the URL is not shown to the user anymore. Also the not deprecated functions to generate URLs have been modified to support this behaviour, old functions such as `filePath` will still behave as before for compatibility reasons. Examples: http://localhost/owncloud/index.php/s/AIDyKbxiRZWAAjP => http://localhost/owncloud/s/AIDyKbxiRZWAAjP http://localhost/owncloud/index.php/apps/files/ => http://localhost/owncloud/apps/files/ Due to the way our CSS and JS is structured the .htaccess uses some hacks for the final result but could be worse... And I was just annoyed by all that users crying for the removal of `index.php` ;-)	9 years ago
Lukas Reschke	4971015544	Add code integrity check This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository. Furthermore, there is a basic implementation to display problems with the code integrity on the update screen. Code signing basically happens the following way: - There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release :wink:). This certificate is not intended to be used for signing directly and only is used to sign new certificates. - Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`, apps need to be signed with a certificate that either has a CN of `core` (shipped apps!) or the AppID. - The command generates a signature.json file of the following format: ```json { "hashes": { "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d", "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9" }, "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----", "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl" } ``` `hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`. Steps to do in other PRs, this is already a quite huge one: - Add nag screen in case the code check fails to ensure that administrators are aware of this. - Add code verification also to OCC upgrade and unify display code more. - Add enforced code verification to apps shipped from the appstore with a level of "official" - Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release - Add some developer documentation on how devs can request their own certificate - Check when installing ownCloud - Add support for CRLs to allow revoking certificates Note: The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature: ``` ➜ master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt Successfully signed "core" ``` Then increase the version and you should see something like the following: ![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png) As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen. For packaging stable releases this requires the following additional steps as a last action before zipping: 1. Run `./occ integrity:sign-core` once 2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.	8 years ago
Vincent Petry	b1ca431852	Fix for parsing pretty printed Webdav responses Update davclient.js + adjust IE workaround for this	8 years ago
Clark Tomlinson	9caf4ffbfc	Replacing ini_get instances with inigetwrapper usages	9 years ago
Vincent Petry	a05e40932c	Now using IE8 workaround of davclient.js for all IE versions	8 years ago
Vincent Petry	7ec83fc9fb	Fix OC.FileInfo to copy all properties This makes it possible to also store custom properties passed through the data object like tags or shareOwner.	8 years ago
Vincent Petry	a1d0682ef8	Use oc:fileid property instead of oc:id	8 years ago
Thomas Müller	ab1d786d87	Fix port issue - options.host already has the port attached	8 years ago
Vincent Petry	dc8ce87a26	Query tags/favorite through Webdav in file list	8 years ago
Vincent Petry	fa2be0750c	Make files app use Webdav for most operations	9 years ago
Vincent Petry	f120846e29	Added OC.Files.Client Webdav-based files client	9 years ago
Vincent Petry	fb3d5c7856	Add evert's davclient.js + es6-promise + IE8 workaround - Add davclient.js lib - Add es6-promise required by that lib - Wrote IE8 workaround lib/shim for davclient.js	8 years ago
Joas Schilling	78c456b895	Allow creating OCS v2 links in JS	8 years ago
Vincent Petry	a2cd9708f6	Set "ie" CSS class for IE10, IE11 Fixed border in file action menu	8 years ago
Joas Schilling	f04151f69b	Close the user menu when clicking it again	8 years ago
Morris Jobke	b32e6fbb62	[tags] remove unneeded variables	8 years ago
Vincent Petry	9c9158e6b7	Fix icon update to be more consistent Makes the details bar show the same icon as in the list.	8 years ago
Tom Needham	628e4a9daf	Add sharee list view js tests	8 years ago
Phil Davis	89ab505c7b	sharedialogviewSpec.js couple of text typos I noticed a new typo in `15ef39d5b9` and looked for others while I am here.	8 years ago
Hendrik Leppelsack	5a01dc44d6	append tipsys to body	8 years ago
Vincent Petry	0d98e5e456	[IE9] Don't send link share password placeholder When exiting the password field in the share dialog, IE9 would mistakenly think that the password has changed and would send the placeholder. This fix prevents changing the password whenever the placeholder is set as value.	8 years ago
Lukas Reschke	8f09d5b67c	Update license headers	8 years ago
Vincent Petry	c64fb46fbf	Fix share link focus on click Clicking on the link share must focus and select it	8 years ago

1 2 3 4 5 ...

1469 Commits (205fbcbfa3cf221fad23cfd3379a412aba0dd314)