nextcloud

Graf revizí

Autor	SHA1	Zpráva	Datum
Roeland Jago Douma	6dbe417c51	Inlince oc.js if possible! Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	před 7 roky
Lukas Reschke	38b3ac8213	Add ContentSecurityPolicyNonceManager Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	před 7 roky
Lukas Reschke	9e6634814e	Add support for CSP nonces CSP nonces are a feature available with CSP v2. Basically instead of saying "JS resources from the same domain are ok to be served" we now say "Ressources from everywhere are allowed as long as they add a `nonce` attribute to the script tag with the right nonce. At the moment the nonce is basically just a `<?php p(base64_encode($_['requesttoken'])) ?>`, we have to decode the requesttoken since `:` is not an allowed value in the nonce. So if somebody does on their own include JS files (instead of using the `addScript` public API, they now must also include that attribute.) IE does currently not implement CSP v2, thus there is a whitelist included that delivers the new CSP v2 policy to newer browsers. Check http://caniuse.com/#feat=contentsecuritypolicy2 for the current browser support list. An alternative approach would be to just add `'unsafe-inline'` as well as `'unsafe-inline'` is ignored by CSPv2 when a nonce is set. But this would make this security feature unusable at all in IE. Not worth it at the moment IMO. Implementing this offers the following advantages: 1. Security: As we host resources from the same domain by design we don't have to worry about 'self' anymore being in the whitelist 2. Performance: We can move oc.js again to inline JS. This makes the loading way quicker as we don't have to load on every load of a new web page a blocking dynamically non-cached JavaScript file. If you want to toy with CSP see also https://csp-evaluator.withgoogle.com/ Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	před 7 roky
Hendrik Leppelsack	c47833718f	remove svg classes	před 8 roky
Hendrik Leppelsack	e5d8726859	remove ie8+9 support	před 8 roky
Daniel Aleksandersen	7a45f05ed5	Stupid clients only literally understand rel="icon" rel="shortcut icon" hasn’t been relevant in years, isn’t in any standards, and causes problems for simple pattern matching clients. https://www.w3.org/TR/html/links.html#linkTypes	před 8 roky
Hendrik Leppelsack	99b9ec41c1	support print stylesheets	před 9 roky
maprambo	edb1fee610	Added Safari tabbed pin icon Added the necessary code and a black and inverted version of the favicon/ touch icon in svg format	před 8 roky
Morris Jobke	069ed71dbe	Add favicon for IE 8+	před 9 roky
Lukas Reschke	436c149fbb	Prevent referer from being sent Nice hardening for enhanced privacy. Especially useful when using embedded viewers such as files_pdfviewer.	před 8 roky
Jan-Christoph Borchardt	0b27bcba76	add theme-color for better Android browser integration	před 9 roky
Volker E	599ee5ce4e	fixing #15023, getting comments out of HTML output	před 9 roky
Volker E	0d0c73cf2b	fixing #15011 by adding ARIA roles where distinct	před 9 roky
Volker E	790324b313	addressing #14984 removing redundant type attributes	před 9 roky
Volker E	4c46d0c46c	addressing #14983 obsolete Google Chrome Frame	před 9 roky
Volker E	6ad76b5cc2	addressing #14982 self-closing tags ending slash doesn't have a purpose & should be removed	před 9 roky
Volker E	25b77159c4	adressing #14979 meta charset declaration should be first in head	před 9 roky
Volker E	f3cd552797	addressing #14978 - remove html root classes targeting IE6/IE7	před 9 roky
Lode Hoste	27b35500a7	Disable application-specific favicons for non-user pages	před 9 roky
Joas Schilling	4172ba48d4	Deduplicate template code and do not translate the links	před 9 roky
Lukas Reschke	b432ea29c9	Add `rel="noreferrer"` where possible and switch to HTTPS Just to follow good practise and prevent some automated scanners to complain about "Cross-domain Referer leakage".	před 9 roky
Lode Hoste	96f81961ed	Allow application-specific favicons	před 9 roky
Jan-Christoph Borchardt	ea548cdaaa	fix accessibility of logos	před 9 roky
Jan-Christoph Borchardt	45c6ec8582	introduce h1, use either ownCloud name or current app name	před 9 roky
Lukas Reschke	510d0b2cf3	Fix the "addHeader($tag, $attributes, $text)" methods to not ignore the $text parameter Also support closing tags with no text content given Conflicts: lib/private/template.php	před 9 roky
Clark Tomlinson	ca5abe5744	Setting moment locale based on user selection	před 9 roky
Lukas Reschke	7d2c521b46	Step one, open guest layout for different styles. Conflicts: core/templates/layout.guest.php Step one, open guest layout for different styles.	před 9 roky
Lukas Reschke	bce5c2dae9	Add X-UA-Compatible to all templates Replaces https://github.com/owncloud/core/pull/10850	před 9 roky
Jan-Christoph Borchardt	bd56619e7a	also add no-JavaScript notice to log in and sharing pages because they do not work without JS either	před 9 roky
Pascal de Bruijn	73f50287ff	templates: use p() for getiTunesAppId	před 10 roky
Pascal de Bruijn	49da0a7943	defaults: add customizable defaultiTunesAppId	před 10 roky
Clark Tomlinson	e0a8321b23	Adding type to favicon	před 10 roky
Thomas Müller	cbe3595f64	using flush() here is pointless as we render the layout into a memory buffer and actually transmit the data later	před 10 roky
Morris Jobke	cea7d4961e	move to updated version of placeholder	před 10 roky
Thomas Müller	30168169b9	Flush the Buffer Early - right after head	před 10 roky
jbtbnl	b10bf72999	Vertically align public layout to better fit small mobile screens	před 10 roky
Jan-Christoph Borchardt	d2de6e7a66	fix SVG replacement for logo so it works in IE8, fix #7866	před 10 roky
Jan-Christoph Borchardt	3e803b5e36	restrict zooming on mobile devices for the publicly accessible, optimized pages	před 10 roky
Vincent Petry	f8c865993f	Fixed viewport layout using commas instead of semicolons Fixes #5285	před 10 roky
Jake Wilson	5144def99b	Moved Core Theme Logos to CSS In order to make it easier for a user/developer to replace logos in the core theme, I removed the hardcoded `logo.svg` and `logo-wide.svg` from the html, and replaced them with `div`s that use css background-image instead. This has multiple advantages: 1. The user can now use any filename they want for the logo. They are no longer forced to use logo.svg or logo-wide.svg. 2. The user can now easily use a JPG, PNG or GIF logo instead of SVG (SVG's are awesome, but used by an unfortunately small percentage of web developers at the current time. Most probably don't even know how to make an SVG…). 3. The user doesn't have to resort to hacking the core theme template files in order to use a different filename or file type. 4. Greatly simplifies documentation instructions for how to change the logos (http://owncloud.org/theming/). Signed-off-by: Jake Wilson <jakew@huebnerpetersen.com>	před 10 roky
Jan-Christoph Borchardt	94ae66c651	fix web interface showing very small when accessed on smartphone	před 10 roky
Björn Schießle	75fd6d4fde	initialize OC_Defaults in template constructorX	před 11 roky
Jan-Christoph Borchardt	38bfae57fe	sticky footer	před 11 roky
Jan-Christoph Borchardt	14edfa52ea	input field adjustments for new full-color background on log in	před 11 roky
Jan-Christoph Borchardt	107ace42b8	rip out unneeded #login div, replace with existing body-login	před 11 roky
Jan-Christoph Borchardt	aacca494c5	introduce shortname themable string and split from title, use for image alt text	před 11 roky
Björn Schießle	3c691c9ec9	move to non-static OC_Defaults Conflicts: lib/mail.php	před 11 roky
Björn Schießle	d46e62886a	Add init funtion to OC_Defaults to be able to wrap translatable strings	před 11 roky
Björn Schießle	d97d00fe0f	add logo claim to defaults.php	před 11 roky
Björn Schießle	23cc69b816	construct the foother in defaults.php so that we use always the same footer Conflicts: settings/templates/admin.php	před 11 roky

1 2 3

105 Revize (21641302a97815c2779f65ffd9efc95cf314e48d)