mirrors/nextcloud - nextcloud - source @ dussan.org

コミットグラフ

作成者	SHA1	メッセージ	日付
Morris Jobke	c8f2198aa0	Remove recommendation for opcache on CLI Signed-off-by: Morris Jobke <hey@morrisjobke.de>	5年前
Morris Jobke	060b637b70	Show a setup warning in case S3 object storage is used as primary storage * checks for at least 50 GB of free space Signed-off-by: Morris Jobke <hey@morrisjobke.de>	5年前
Morris Jobke	6c7ccbecbf	Add setup check for missing UTF8MB4 on mysql Signed-off-by: Morris Jobke <hey@morrisjobke.de>	5年前
Morris Jobke	faef05730a	Add unit tests and provide better message Signed-off-by: Morris Jobke <hey@morrisjobke.de>	5年前
Daniel Kesselberg	248e824f48	Remove check for outdated caches Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	5年前
Morris Jobke	17b2827bbf	Add setup check for pending bigint conversion Signed-off-by: Morris Jobke <hey@morrisjobke.de>	5年前
Morris Jobke	f5ad80fc57	Add setup check for recommended PHP modules (i.e. Imagick, intl) Signed-off-by: Morris Jobke <hey@morrisjobke.de>	5年前
Morris Jobke	f5894b653d	Add check for missing .woff2 rule in Nginx via setup check Signed-off-by: Morris Jobke <hey@morrisjobke.de>	5年前
Daniel Peukert	7a5d6ac15c	Fix failing tests and add some more Signed-off-by: Daniel Peukert <dan.peukert@gmail.com>	5年前
Moritz Beck	b68661ed6e	Allow "same-origin" as "Referrer-Policy" Fixes #11531 Although "same-origin" is more strict than e.g. strict-origin it showed up a warning in setupcheck Based on https://scotthelme.co.uk/a-new-security-header-referrer-policy/ Signed-off-by: Moritz Beck <git@birkenstab.de>	5年前
Daniel Calviño Sánchez	d143b43a04	Make possible to set the expected status of the well known URL check The check is based on the HTTP status returned by the URL, and different URLs may return different status (for example, DAV returns 207, while a service like WebFinger would return 200), so the expected status needs to be set depending on the URL. Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>	5年前
Morris Jobke	b8d54bd53a	Fix a misleading setup check for .well-known/caldav & carddav The problem is that the version without the slash is the correct one. Signed-off-by: Morris Jobke <hey@morrisjobke.de>	5年前
Timo Förster	006e150c87	Change check if secure randomness is possible. Signed-off-by: Timo Förster <tfoerster@webfoersterei.de>	6年前
Michael Weimann	7aed47f776	Adds tests for the memory checks Signed-off-by: Michael Weimann <mail@michael-weimann.eu>	6年前
Michael Weimann	1d2bc9c45e	Adds tests for the setup memory limit checks Signed-off-by: Michael Weimann <mail@michael-weimann.eu>	6年前
Michael Weimann	ebcfe33d0d	Extends the setup check js tests Signed-off-by: Michael Weimann <mail@michael-weimann.eu>	6年前
Morris Jobke	83b1de4493	Fix unit tests - follow up to #10197 Signed-off-by: Morris Jobke <hey@morrisjobke.de>	6年前
Cthulhux	f6f49c77f7	opcache module check Improved the speed of isOpcacheProperlySetup() (instant return instead of continuing when we're already failed), added a check for the opcache extension itself. Potentially fixes #9410 Signed-off-by: Morris Jobke <hey@morrisjobke.de>	6年前
Morris Jobke	9c4aecb539	Merge all setup checks into one controller * renamed hasMissingIndexes to missingIndexes Signed-off-by: Morris Jobke <hey@morrisjobke.de>	6年前
Morris Jobke	4a0b7aaf6c	Merge tips & tricks section into setup checks Signed-off-by: Morris Jobke <hey@morrisjobke.de>	6年前
Morris Jobke	624d191ef6	Fix wrong hint about missing indexes Signed-off-by: Morris Jobke <hey@morrisjobke.de>	6年前
Roeland Jago Douma	4b70c9f89d	Add referrer policy setup check Fixes #9122 Based on https://www.w3.org/TR/referrer-policy/ and https://scotthelme.co.uk/a-new-security-header-referrer-policy/ Setting a sane Referrer-Policy will tell the browser if/when to send referrer headers when accessing a link from Nextcloud. When configured properly this results in less tracking and less leaking of (possibly) sensitive urls * Fix tests Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6年前
Allan Nordhøy	e81f30b124	Spelling: FreeType	6年前
Roeland Jago Douma	ee20741526	Add tests Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6年前
Morris Jobke	4af12dcab1	Fix unit tests Signed-off-by: Morris Jobke <hey@morrisjobke.de>	6年前
Markus Staab	db34b59238	Prevent XSS in links which open a new browser window	6年前
Morris Jobke	582fb5d129	Update the URLs in tests to use example.org Signed-off-by: Morris Jobke <hey@morrisjobke.de>	7年前
rakekniven	f2d999aa70	Update setupchecks.js Fixed typo and removed doclink symbol. Reported at transifex Update util.php Another l10n improvement from transifex. Signed-off-by: Morris Jobke <hey@morrisjobke.de>	7年前
Morris Jobke	1fedf450ac	Update Opcache recommendation Signed-off-by: Morris Jobke <hey@morrisjobke.de>	7年前
Joas Schilling	1c0bffe87f	Fix translations Signed-off-by: Joas Schilling <coding@schilljs.com>	7年前
Lukas Reschke	6c8d48b0f6	Harden t() with DOMPurify This mitigates issues where developers pass untrusted user-input through t() which may lead to XSS issues. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	7年前
Roeland Jago Douma	bb2ec51bbb	Fix unit tests of master Follow up to #3802 Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7年前
Morris Jobke	cee8853658	Show info in admin settings about PHP opcache if disabled Signed-off-by: Morris Jobke <hey@morrisjobke.de>	7年前
Morris Jobke	a2867c0664	Properly check the data dir * fixes #1364 Signed-off-by: Morris Jobke <hey@morrisjobke.de>	7年前
Joas Schilling	0f06034239	Replace more vendor naming Signed-off-by: Joas Schilling <coding@schilljs.com>	7年前
Arthur Schiwon	9b01574465	adjust js tests	8年前
Derek	b236100619	Alters 'No Internet Connection' error message. #181	8年前
Vincent Petry	fb087a0261	Use temporary htaccesstest.txt for data dir security check	8年前
Morris Jobke	e03d289b70	Use 6 months as SSL STS header threshold * this uses 6 months (6 * 30 * 24 * 60 * 60 = `15552000`) * old value was half a year (365 / 2 * 24 * 60 * 60 = `15768000`) * fixes #23957	8年前
Lukas Reschke	6ad957906e	Consistently use rel=noreferrer When linking to external entities we should consistently use rel=noreferrer	8年前
Lukas Reschke	2ca3c0d461	Adjust wording a bit Before: > Your PHP version (5.4.16) is no longer supported by PHP. We encourage you to upgrade your PHP version to take advantage of performance and security updates provided by PHP. After: > You are currently running PHP 5.4.0. We encourage you to upgrade your PHP version to take advantage of performance and security updates provided by the PHP Group as soon as your distribution supports it. Fixes https://github.com/owncloud/enterprise/issues/1170	8年前
Thomas Müller	8abdcb8085	Fix error ins source language strings https://www.transifex.com/owncloud-org/owncloud/translate/#en_GB/core/50786279 https://www.transifex.com/owncloud-org/owncloud/translate/#en_GB/settings-1/50555028	8年前
Vincent Chan	faf48e42b7	Move data protection check to javascript fixes #20199	8年前
Lukas Reschke	4d0dcd3c53	Add X-Download-Options and X-Permitted-Cross-Domain-Policies Two small security hardenings for our IE users and those with Adobe products. Aligns it more with https://github.com/twitter/secureheaders#secureheaders---	8年前
Morris Jobke	8b6b042ffd	Add config switch to disable the .well-known URL check	8年前
Morris Jobke	a6c7cdd75e	Show the well-known URL check as info instead of error * ref https://github.com/owncloud/core/pull/21562#issuecomment-170344549	8年前
Morris Jobke	0161928fc3	Add check for .well-known URL in the root of the webservers URL * fixes #20012	8年前
Lukas Reschke	cebeb0e052	Fix unit tests Fixes https://github.com/owncloud/core/issues/21345	8年前
Lukas Reschke	4971015544	Add code integrity check This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository. Furthermore, there is a basic implementation to display problems with the code integrity on the update screen. Code signing basically happens the following way: - There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release :wink:). This certificate is not intended to be used for signing directly and only is used to sign new certificates. - Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`, apps need to be signed with a certificate that either has a CN of `core` (shipped apps!) or the AppID. - The command generates a signature.json file of the following format: ```json { "hashes": { "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d", "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9" }, "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----", "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl" } ``` `hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`. Steps to do in other PRs, this is already a quite huge one: - Add nag screen in case the code check fails to ensure that administrators are aware of this. - Add code verification also to OCC upgrade and unify display code more. - Add enforced code verification to apps shipped from the appstore with a level of "official" - Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release - Add some developer documentation on how devs can request their own certificate - Check when installing ownCloud - Add support for CRLs to allow revoking certificates Note: The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature: ``` ➜ master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt Successfully signed "core" ``` Then increase the version and you should see something like the following: ![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png) As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen. For packaging stable releases this requires the following additional steps as a last action before zipping: 1. Run `./occ integrity:sign-core` once 2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.	8年前
Morris Jobke	b519965408	[admin] check for correct PHP memcached module	8年前

1 2