merge master into webdav-injection

53 files changed, 422 insertions, 198 deletions

diff --git a/lib/base.php b/lib/base.php
index 6ea77aa7a58..83f54a8e4db 100644
--- a/lib/base.php
+++ b/lib/base.php
@@ -185,7 +185,6 @@ class OC {
 		if (file_exists(self::$configDir . "/config.php")
 			and !is_writable(self::$configDir . "/config.php")
 		) {
-			$defaults = new OC_Defaults();
 			if (self::$CLI) {
 				echo "Can't write into config directory!\n";
 				echo "This can usually be fixed by giving the webserver write access to the config directory\n";
@@ -213,6 +212,34 @@ class OC {
 		}
 	}
 
+	/*
+	* This function adds some security related headers to all requests served via base.php
+	* The implementation of this function has to happen here to ensure that all third-party 
+	* components (e.g. SabreDAV) also benefit from this headers.
+	*/
+	public static function addSecurityHeaders() {
+		header('X-XSS-Protection: 1; mode=block'); // Enforce browser based XSS filters
+		header('X-Content-Type-Options: nosniff'); // Disable sniffing the content type for IE
+
+		// iFrame Restriction Policy
+		$xFramePolicy = OC_Config::getValue('xframe_restriction', true);
+		if($xFramePolicy) {
+			header('X-Frame-Options: Sameorigin'); // Disallow iFraming from other domains
+		}
+
+		// Content Security Policy
+		// If you change the standard policy, please also change it in config.sample.php
+		$policy = OC_Config::getValue('custom_csp_policy',
+			'default-src \'self\'; '
+			.'script-src \'self\' \'unsafe-eval\'; '
+			.'style-src \'self\' \'unsafe-inline\'; '
+			.'frame-src *; '
+			.'img-src *; '
+			.'font-src \'self\' data:; '
+			.'media-src *');
+		header('Content-Security-Policy:'.$policy);
+	}
+
 	public static function checkSSL() {
 		// redirect to https site if configured
 		if (OC_Config::getValue("forcessl", false)) {
@@ -277,6 +304,11 @@ class OC {
 		}
 	}
 
+	/**
+	 * Checks if the version requires an update and shows
+	 * @param bool $showTemplate Whether an update screen should get shown
+	 * @return bool|void
+	 */
 	public static function checkUpgrade($showTemplate = true) {
 		if (self::needUpgrade()) {
 			if ($showTemplate && !OC_Config::getValue('maintenance', false)) {
@@ -512,6 +544,7 @@ class OC {
 		self::checkConfig();
 		self::checkInstalled();
 		self::checkSSL();
+		self::addSecurityHeaders();
 
 		$errors = OC_Util::checkServer();
 		if (count($errors) > 0) {
@@ -770,6 +803,11 @@ class OC {
 		self::handleLogin();
 	}
 
+	/**
+	 * Load a PHP file belonging to the specified application
+	 * @param array $param The application and file to load
+	 * @return bool Whether the file has been found (will return 404 and false if not)
+	 */
 	public static function loadAppScriptFile($param) {
 		OC_App::loadApps();
 		$app = $param['app'];
@@ -812,6 +850,10 @@ class OC {
 		OC_Util::displayLoginPage(array_unique($error));
 	}
 
+	/**
+	 * Remove outdated and therefore invalid tokens for a user
+	 * @param string $user
+	 */
 	protected static function cleanupLoginTokens($user) {
 		$cutoff = time() - OC_Config::getValue('remember_login_cookie_lifetime', 60 * 60 * 24 * 15);
 		$tokens = OC_Preferences::getKeys($user, 'login_token');
@@ -823,6 +865,10 @@ class OC {
 		}
 	}
 
+	/**
+	 * Try to login a user via HTTP authentication
+	 * @return bool|void
+	 */
 	protected static function tryApacheAuth() {
 		$return = OC_User::handleApacheAuth();
 
@@ -837,6 +883,10 @@ class OC {
 		return is_null($return) ? false : true;
 	}
 
+	/**
+	 * Try to login a user using the remember me cookie.
+	 * @return bool Whether the provided cookie was valid
+	 */
 	protected static function tryRememberLogin() {
 		if (!isset($_COOKIE["oc_remember_login"])
 			|| !isset($_COOKIE["oc_token"])
@@ -878,6 +928,10 @@ class OC {
 		return true;
 	}
 
+	/**
+	 * Tries to login a user using the formbased authentication
+	 * @return bool|void
+	 */
 	protected static function tryFormLogin() {
 		if (!isset($_POST["user"]) || !isset($_POST['password'])) {
 			return false;
@@ -912,6 +966,10 @@ class OC {
 		return true;
 	}
 
+	/**
+	 * Try to login a user using HTTP authentication.
+	 * @return bool
+	 */
 	protected static function tryBasicAuthLogin() {
 		if (!isset($_SERVER["PHP_AUTH_USER"])
 			|| !isset($_SERVER["PHP_AUTH_PW"])
@@ -930,6 +988,10 @@ class OC {
 }
 
 if (!function_exists('get_temp_dir')) {
+	/**
+	 * Get the temporary dir to store uploaded data
+	 * @return null|string Path to the temporary directory or null
+	 */
 	function get_temp_dir() {
 		if ($temp = ini_get('upload_tmp_dir')) return $temp;
 		if ($temp = getenv('TMP')) return $temp;
diff --git a/lib/l10n/ca.php b/lib/l10n/ca.php
index 477cdf2925b..22d8c457f5e 100644
--- a/lib/l10n/ca.php
+++ b/lib/l10n/ca.php
@@ -67,6 +67,7 @@ $TRANSLATIONS = array(
 "_%n month ago_::_%n months ago_" => array("fa %n mes","fa %n mesos"),
 "last year" => "l'any passat",
 "years ago" => "anys enrere",
+"Only the following characters are allowed in a username: \"a-z\", \"A-Z\", \"0-9\", and \"_.@-\"" => "Només els caràcters següents estan permesos en el nom d'usuari: \"a-z\", \"A-Z\", \"0-9\" i \"_.@-\"",
 "A valid username must be provided" => "Heu de facilitar un nom d'usuari vàlid",
 "A valid password must be provided" => "Heu de facilitar una contrasenya vàlida",
 "The username is already being used" => "El nom d'usuari ja està en ús"
diff --git a/lib/l10n/cs_CZ.php b/lib/l10n/cs_CZ.php
index d535b97f631..8348f7ef0dc 100644
--- a/lib/l10n/cs_CZ.php
+++ b/lib/l10n/cs_CZ.php
@@ -67,6 +67,7 @@ $TRANSLATIONS = array(
 "_%n month ago_::_%n months ago_" => array("před %n měsícem","před %n měsíci","před %n měsíci"),
 "last year" => "minulý rok",
 "years ago" => "před lety",
+"Only the following characters are allowed in a username: \"a-z\", \"A-Z\", \"0-9\", and \"_.@-\"" => "Pouze následující znaky jsou povoleny v uživatelském jménu: \"a-z\", \"A-Z\", \"0-9\", and \"_.@-\"",
 "A valid username must be provided" => "Musíte zadat platné uživatelské jméno",
 "A valid password must be provided" => "Musíte zadat platné heslo",
 "The username is already being used" => "Uživatelské jméno je již využíváno"
diff --git a/lib/l10n/el.php b/lib/l10n/el.php
index 244cc50b847..109104e4061 100644
--- a/lib/l10n/el.php
+++ b/lib/l10n/el.php
@@ -6,7 +6,7 @@ $TRANSLATIONS = array(
 "Personal" => "Προσωπικά",
 "Settings" => "Ρυθμίσεις",
 "Users" => "Χρήστες",
-"Admin" => "Διαχειριστής",
+"Admin" => "Διαχείριση",
 "Failed to upgrade \"%s\"." => "Αποτυχία αναβάθμισης του \"%s\".",
 "Unknown filetype" => "Άγνωστος τύπος αρχείου",
 "Invalid image" => "Μη έγκυρη εικόνα",
diff --git a/lib/l10n/gl.php b/lib/l10n/gl.php
index 0da1695e37f..2a62b41e22d 100644
--- a/lib/l10n/gl.php
+++ b/lib/l10n/gl.php
@@ -62,7 +62,7 @@ $TRANSLATIONS = array(
 "_%n hour ago_::_%n hours ago_" => array("hai %n hora","hai %n horas"),
 "today" => "hoxe",
 "yesterday" => "onte",
-"_%n day go_::_%n days ago_" => array("hai %n día","hai %n días"),
+"_%n day go_::_%n days ago_" => array("hai %n día","vai %n días"),
 "last month" => "último mes",
 "_%n month ago_::_%n months ago_" => array("hai %n mes","hai %n meses"),
 "last year" => "último ano",
diff --git a/lib/l10n/sl.php b/lib/l10n/sl.php
index 6f9470401ed..86172b5ab71 100644
--- a/lib/l10n/sl.php
+++ b/lib/l10n/sl.php
@@ -67,7 +67,9 @@ $TRANSLATIONS = array(
 "_%n month ago_::_%n months ago_" => array("pred %n mesecem","pred %n mesecema","pred %n meseci","pred %n meseci"),
 "last year" => "lansko leto",
 "years ago" => "let nazaj",
+"Only the following characters are allowed in a username: \"a-z\", \"A-Z\", \"0-9\", and \"_.@-\"" => "V uporabniškem imenu je dovoljeno uporabiti le znake: \"a-z\", \"A-Z\", \"0-9\", and \"_.@-\"",
 "A valid username must be provided" => "Navedeno mora biti veljavno uporabniško ime",
-"A valid password must be provided" => "Navedeno mora biti veljavno geslo"
+"A valid password must be provided" => "Navedeno mora biti veljavno geslo",
+"The username is already being used" => "Vpisano uporabniško ime je že v uporabi"
 );
 $PLURAL_FORMS = "nplurals=4; plural=(n%100==1 ? 0 : n%100==2 ? 1 : n%100==3 || n%100==4 ? 2 : 3);";
diff --git a/lib/private/activitymanager.php b/lib/private/activitymanager.php
index 685809581ac..66aa039eb18 100755
--- a/lib/private/activitymanager.php
+++ b/lib/private/activitymanager.php
@@ -46,7 +46,7 @@ class ActivityManager implements IManager {
 					$type,
 					$priority);
 				} catch (\Exception $ex) {
-					// TODO: log the excepetion
+					// TODO: log the exception
 				}
 			}
 
diff --git a/lib/private/api.php b/lib/private/api.php
index b3b5eb1067b..74887690952 100644
--- a/lib/private/api.php
+++ b/lib/private/api.php
@@ -127,9 +127,9 @@ class OC_API {
 	/**
 	 * merge the returned result objects into one response
 	 * @param array $responses
+	 * @return array|\OC_OCS_Result
 	 */
 	public static function mergeResponses($responses) {
-		$response = array();
 		// Sort into shipped and thirdparty
 		$shipped = array(
 			'succeeded' => array(),
@@ -191,7 +191,7 @@ class OC_API {
 		// Merge the successful responses
 		$data = array();
 
-		foreach($responses as $app => $response) {
+		foreach($responses as $response) {
 			if($response['shipped']) {
 				$data = array_merge_recursive($response['response']->getData(), $data);
 			} else {
diff --git a/lib/private/app.php b/lib/private/app.php
index 58bf67c1d47..2f55b54b328 100644
--- a/lib/private/app.php
+++ b/lib/private/app.php
@@ -459,9 +459,11 @@ class OC_App{
 		return false;
 	}
 	/**
-	* Get the directory for the given app.
-	* If the app is defined in multiple directories, the first one is taken. (false if not found)
-	*/
+	 * Get the directory for the given app.
+	 * If the app is defined in multiple directories, the first one is taken. (false if not found)
+	 * @param string $appid
+	 * @return string|false
+	 */
 	public static function getAppPath($appid) {
 		if( ($dir = self::findAppInDirectories($appid)) != false) {
 			return $dir['path'].'/'.$appid;
@@ -470,9 +472,11 @@ class OC_App{
 	}
 
 	/**
-	* Get the path for the given app on the access
-	* If the app is defined in multiple directories, the first one is taken. (false if not found)
-	*/
+	 * Get the path for the given app on the access
+	 * If the app is defined in multiple directories, the first one is taken. (false if not found)
+	 * @param string $appid
+	 * @return string|false
+	 */
 	public static function getAppWebPath($appid) {
 		if( ($dir = self::findAppInDirectories($appid)) != false) {
 			return OC::$WEBROOT.$dir['url'].'/'.$appid;
@@ -482,6 +486,7 @@ class OC_App{
 
 	/**
 	 * get the last version of the app, either from appinfo/version or from appinfo/info.xml
+	 * @param string $appid
 	 * @return string
 	 */
 	public static function getAppVersion($appid) {
@@ -563,7 +568,7 @@ class OC_App{
 
 	/**
 	 * @brief Returns the navigation
-	 * @return string
+	 * @return array
 	 *
 	 * This function returns an array containing all entries added. The
 	 * entries are sorted by the key 'order' ascending. Additional to the keys
diff --git a/lib/private/appconfig.php b/lib/private/appconfig.php
index fed6989a438..0cd6b3bc35b 100644
--- a/lib/private/appconfig.php
+++ b/lib/private/appconfig.php
@@ -71,6 +71,7 @@ class AppConfig implements \OCP\IAppConfig {
 
 	/**
 	 * @param string $app
+	 * @return \string[]
 	 */
 	private function getAppValues($app) {
 		$appCache = $this->getAppCache($app);
diff --git a/lib/private/appframework/middleware/security/securitymiddleware.php b/lib/private/appframework/middleware/security/securitymiddleware.php
index bb02d565fa4..0f160d224ad 100644
--- a/lib/private/appframework/middleware/security/securitymiddleware.php
+++ b/lib/private/appframework/middleware/security/securitymiddleware.php
@@ -25,8 +25,8 @@
 namespace OC\AppFramework\Middleware\Security;
 
 use OC\AppFramework\Http;
-use OC\AppFramework\Http\RedirectResponse;
 use OC\AppFramework\Utility\MethodAnnotationReader;
+use OCP\AppFramework\Http\RedirectResponse;
 use OCP\AppFramework\Middleware;
 use OCP\AppFramework\Http\Response;
 use OCP\AppFramework\Http\JSONResponse;
diff --git a/lib/private/archive.php b/lib/private/archive.php
index 6f51066ddf8..a62f22cf6d7 100644
--- a/lib/private/archive.php
+++ b/lib/private/archive.php
@@ -10,7 +10,7 @@ abstract class OC_Archive{
 	/**
 	 * open any of the supported archive types
 	 * @param string $path
-	 * @return OC_Archive
+	 * @return OC_Archive|void
 	 */
 	public static function open($path) {
 		$ext=substr($path, strrpos($path, '.'));
@@ -29,6 +29,9 @@ abstract class OC_Archive{
 		}
 	}
 
+	/**
+	 * @param $source
+	 */
 	abstract function __construct($source);
 	/**
 	 * add an empty folder to the archive
@@ -39,7 +42,7 @@ abstract class OC_Archive{
 	/**
 	 * add a file to the archive
 	 * @param string $path
-	 * @param string source either a local file or string data
+	 * @param string $source either a local file or string data
 	 * @return bool
 	 */
 	abstract function addFile($path, $source='');
diff --git a/lib/private/arrayparser.php b/lib/private/arrayparser.php
index d353e486577..a5e1f6653fc 100644
--- a/lib/private/arrayparser.php
+++ b/lib/private/arrayparser.php
@@ -32,6 +32,7 @@ class ArrayParser {
 
 	/**
 	 * @param string $string
+	 * @return array|bool|int|null|string
 	 */
 	function parsePHP($string) {
 		$string = $this->stripPHPTags($string);
@@ -41,6 +42,7 @@ class ArrayParser {
 
 	/**
 	 * @param string $string
+	 * @return string
 	 */
 	function stripPHPTags($string) {
 		$string = trim($string);
@@ -55,6 +57,7 @@ class ArrayParser {
 
 	/**
 	 * @param string $string
+	 * @return string
 	 */
 	function stripAssignAndReturn($string) {
 		$string = trim($string);
@@ -67,6 +70,10 @@ class ArrayParser {
 		return $string;
 	}
 
+	/**
+	 * @param string $string
+	 * @return array|bool|int|null|string
+	 */
 	function parse($string) {
 		$string = trim($string);
 		$string = trim($string, ';');
@@ -85,6 +92,7 @@ class ArrayParser {
 
 	/**
 	 * @param string $string
+	 * @return int
 	 */
 	function getType($string) {
 		$string = strtolower($string);
@@ -104,6 +112,7 @@ class ArrayParser {
 
 	/**
 	 * @param string $string
+	 * @return string
 	 */
 	function parseString($string) {
 		return substr($string, 1, -1);
@@ -111,6 +120,7 @@ class ArrayParser {
 
 	/**
 	 * @param string $string
+	 * @return int
 	 */
 	function parseNum($string) {
 		return intval($string);
@@ -118,6 +128,7 @@ class ArrayParser {
 
 	/**
 	 * @param string $string
+	 * @return bool
 	 */
 	function parseBool($string) {
 		$string = strtolower($string);
@@ -126,6 +137,7 @@ class ArrayParser {
 
 	/**
 	 * @param string $string
+	 * @return array
 	 */
 	function parseArray($string) {
 		$body = substr($string, 5);
@@ -157,6 +169,7 @@ class ArrayParser {
 
 	/**
 	 * @param string $body
+	 * @return array
 	 */
 	function splitArray($body) {
 		$inSingleQuote = false;//keep track if we are inside quotes
diff --git a/lib/private/cache/file.php b/lib/private/cache/file.php
index 2fd77c437fe..feee9cc32b6 100644
--- a/lib/private/cache/file.php
+++ b/lib/private/cache/file.php
@@ -14,7 +14,7 @@ class File {
 
 	/**
 	 * Returns the cache storage for the logged in user
-	 * @return cache storage
+	 * @return \OC\Files\View cache storage
 	 */
 	protected function getStorage() {
 		if (isset($this->storage)) {
diff --git a/lib/private/filechunking.php b/lib/private/filechunking.php
index 1da02fc81e3..990499e40b4 100644
--- a/lib/private/filechunking.php
+++ b/lib/private/filechunking.php
@@ -70,7 +70,7 @@ class OC_FileChunking {
 	 *
 	 * @param string $f target path
 	 *
-	 * @return assembled file size
+	 * @return integer assembled file size
 	 *
 	 * @throws \OC\InsufficientStorageException when file could not be fully
 	 * assembled due to lack of free space
@@ -91,7 +91,7 @@ class OC_FileChunking {
 
 	/**
 	 * Returns the size of the chunks already present
-	 * @return size in bytes
+	 * @return integer size in bytes
 	 */
 	public function getCurrentSize() {
 		$cache = $this->getCache();
@@ -159,7 +159,7 @@ class OC_FileChunking {
 	 *
 	 * @param string $path target path
 	 *
-	 * @return assembled file size or false if file could not be created
+	 * @return boolean assembled file size or false if file could not be created
 	 *
 	 * @throws \OC\InsufficientStorageException when file could not be fully
 	 * assembled due to lack of free space
@@ -216,5 +216,6 @@ class OC_FileChunking {
 				return false;
 			}
 		}
+		return false;
 	}
 }
diff --git a/lib/private/files.php b/lib/private/files.php
index bfe6d3c02da..152595ba697 100644
--- a/lib/private/files.php
+++ b/lib/private/files.php
@@ -231,7 +231,7 @@ class OC_Files {
 			OC_Template::printErrorPage(
 					$l->t('ZIP download is turned off.'),
 					$l->t('Files need to be downloaded one by one.')
-						. '<br/><a href="javascript:history.back()">' . $l->t('Back to Files') . '</a>'
+						. '<br/><a href="'.OCP\Util::linkTo('files', 'index.php', array('dir' => $dir)).'">' . $l->t('Back to Files') . '</a>'
 			);
 			exit;
 		}
@@ -258,8 +258,7 @@ class OC_Files {
 				OC_Template::printErrorPage(
 						$l->t('Selected files too large to generate zip file.'),
 						$l->t('Please download the files separately in smaller chunks or kindly ask your administrator.')
-						.'<br/><a href="javascript:history.back()">'
-						. $l->t('Back to Files') . '</a>'
+						. '<br/><a href="'.OCP\Util::linkTo('files', 'index.php', array('dir' => $dir)).'">' . $l->t('Back to Files') . '</a>'
 				);
 				exit;
 			}
diff --git a/lib/private/files/storage/common.php b/lib/private/files/storage/common.php
index 33b8549ff78..8a263d4ce1e 100644
--- a/lib/private/files/storage/common.php
+++ b/lib/private/files/storage/common.php
@@ -363,6 +363,9 @@ abstract class Common implements \OC\Files\Storage\Storage {
 		return false;
 	}
 
+	/**
+	 * @param string $path
+	 */
 	protected function getCachedFile($path) {
 		if (!isset($this->cachedFiles[$path])) {
 			$this->cachedFiles[$path] = $this->toTmpFile($path);
diff --git a/lib/private/files/storage/local.php b/lib/private/files/storage/local.php
index 571bf7f97c1..ff2949d33b6 100644
--- a/lib/private/files/storage/local.php
+++ b/lib/private/files/storage/local.php
@@ -305,7 +305,11 @@ if (\OC_Util::runningOnWindows()) {
 		 * @return bool
 		 */
 		public function hasUpdated($path, $time) {
-			return $this->filemtime($path) > $time;
+			if ($this->file_exists($path)) {
+				return $this->filemtime($path) > $time;
+			} else {
+				return true;
+			}
 		}
 
 		/**
diff --git a/lib/private/files/storage/mappedlocal.php b/lib/private/files/storage/mappedlocal.php
index 94ee28ca763..75582fd6c83 100644
--- a/lib/private/files/storage/mappedlocal.php
+++ b/lib/private/files/storage/mappedlocal.php
@@ -360,6 +360,9 @@ class MappedLocal extends \OC\Files\Storage\Common{
 		$this->mapper->copy($fullPath1, $fullPath2);
 	}
 
+	/**
+	 * @param string $path
+	 */
 	private function stripLeading($path) {
 		if(strpos($path, '/') === 0) {
 			$path = substr($path, 1);
diff --git a/lib/private/files/view.php b/lib/private/files/view.php
index 94be7114865..519ed250b1f 100644
--- a/lib/private/files/view.php
+++ b/lib/private/files/view.php
@@ -629,10 +629,21 @@ class View {
 	}
 
 	public function fromTmpFile($tmpFile, $path) {
+
 		if (Filesystem::isValidPath($path)) {
+
+			// Get directory that the file is going into
+			$filePath = dirname($path);
+
+			// Create the directories if any
+			if (!$this->file_exists($filePath)) {
+				$this->mkdir($filePath);
+			}
+
 			if (!$tmpFile) {
 				debug_print_backtrace();
 			}
+
 			$source = fopen($tmpFile, 'r');
 			if ($source) {
 				$this->file_put_contents($path, $source);
diff --git a/lib/private/geo.php b/lib/private/geo.php
index 7094d885af6..cd62511f0c1 100644
--- a/lib/private/geo.php
+++ b/lib/private/geo.php
@@ -6,15 +6,11 @@
  * See the COPYING-README file.
  */
 class OC_Geo{
-	/*
-	 * @brief returns the closest timezone to coordinates
-	 * @param (string) $latitude - Latitude
-	 * @param (string) $longitude - Longitude
-	 * @return (string) $timezone - closest timezone
-	 */
 	/**
-	 * @param integer $latitude
-	 * @param integer $longitude
+	 * @brief returns the closest timezone to coordinates
+	 * @param $latitude
+	 * @param $longitude
+	 * @return mixed Closest timezone
 	 */
 	public static function timezone($latitude, $longitude) {
 		$alltimezones = DateTimeZone::listIdentifiers();
diff --git a/lib/private/group.php b/lib/private/group.php
index 4c187b538af..d9f430f833b 100644
--- a/lib/private/group.php
+++ b/lib/private/group.php
@@ -200,6 +200,9 @@ class OC_Group {
 
 	/**
 	 * @brief get a list of all groups
+	 * @param string $search
+	 * @param int|null $limit
+	 * @param int|null $offset
 	 * @returns array with group names
 	 *
 	 * Returns a list with all groups
@@ -225,6 +228,10 @@ class OC_Group {
 
 	/**
 	 * @brief get a list of all users in a group
+	 * @param string $gid
+	 * @param string $search
+	 * @param int $limit
+	 * @param int $offset
 	 * @returns array with user ids
 	 */
 	public static function usersInGroup($gid, $search = '', $limit = -1, $offset = 0) {
@@ -260,6 +267,10 @@ class OC_Group {
 
 	/**
 	 * @brief get a list of all display names in a group
+	 * @param string $gid
+	 * @param string $search
+	 * @param int $limit
+	 * @param int $offset
 	 * @returns array with display names (value) and user ids(key)
 	 */
 	public static function displayNamesInGroup($gid, $search = '', $limit = -1, $offset = 0) {
diff --git a/lib/private/helper.php b/lib/private/helper.php
index d5214823de9..ab1e0d38924 100644
--- a/lib/private/helper.php
+++ b/lib/private/helper.php
@@ -36,7 +36,7 @@ class OC_Helper {
 	 * @param array $parameters
 	 * @return
 	 * @internal param array $args with param=>value, will be appended to the returned url
-	 * @returns the url
+	 * @returns string the url
 	 *
 	 * Returns a url to the given app and file.
 	 */
diff --git a/lib/private/image.php b/lib/private/image.php
index f1b8acc41b7..14aa64d12da 100644
--- a/lib/private/image.php
+++ b/lib/private/image.php
@@ -49,7 +49,7 @@ class OC_Image {
 
 	/**
 	 * @brief Constructor.
-	 * @param resource|string $imageref The path to a local file, a base64 encoded string or a resource created by
+	 * @param resource|string $imageRef The path to a local file, a base64 encoded string or a resource created by
 	 * an imagecreate* function.
 	 * @return \OC_Image False on error
 	 */
@@ -79,7 +79,7 @@ class OC_Image {
 
 	/**
 	* @brief Returns the MIME type of the image or an empty string if no image is loaded.
-	* @return int
+	* @return string
 	*/
 	public function mimeType() {
 		return $this->valid() ? $this->mimeType : '';
@@ -397,7 +397,7 @@ class OC_Image {
 
 	/**
 	 * @brief Loads an image from a local file, a base64 encoded string or a resource created by an imagecreate* function.
-	 * @param resource|string $imageref The path to a local file, a base64 encoded string or a resource created by an imagecreate* function or a file resource (file handle    ).
+	 * @param resource|string $imageRef The path to a local file, a base64 encoded string or a resource created by an imagecreate* function or a file resource (file handle    ).
 	 * @return resource|false An image resource or false on error
 	 */
 	public function load($imageRef) {
diff --git a/lib/private/json.php b/lib/private/json.php
index 4ccdb490a6c..4634d7adfea 100644
--- a/lib/private/json.php
+++ b/lib/private/json.php
@@ -43,8 +43,7 @@ class OC_JSON{
 	}
 
 	/**
-	 * @brief Check an ajax get/post call if the request token is valid.
-	 * @return json Error msg if not valid.
+	 * Check an ajax get/post call if the request token is valid, send json error msg if not.
 	 */
 	public static function callCheck() {
 		if( !OC_Util::isCallRegistered()) {
@@ -55,7 +54,7 @@ class OC_JSON{
 	}
 
 	/**
-	* Check if the user is a admin, send json error msg if not
+	* Check if the user is a admin, send json error msg if not.
 	*/
 	public static function checkAdminUser() {
 		if( !OC_User::isAdminUser(OC_User::getUser())) {
@@ -119,8 +118,6 @@ class OC_JSON{
 	* Encode and print $data in json format
 	*/
 	public static function encodedPrint($data, $setContentType=true) {
-		// Disable mimesniffing, don't move this to setContentTypeHeader!
-		header( 'X-Content-Type-Options: nosniff' );
 		if($setContentType) {
 			self::setContentTypeHeader();
 		}
diff --git a/lib/private/l10n.php b/lib/private/l10n.php
index a397945b829..c7e4328161e 100644
--- a/lib/private/l10n.php
+++ b/lib/private/l10n.php
@@ -267,43 +267,18 @@ class OC_L10N implements \OCP\IL10N {
 		$identifier = "_${text_singular}_::_${text_plural}_";
 		if( array_key_exists($identifier, $this->translations)) {
 			return new OC_L10N_String( $this, $identifier, $parameters, $count );
-		}
-		else{
+		}else{
 			if($count === 1) {
 				return new OC_L10N_String($this, $text_singular, $parameters, $count);
-			}
-			else{
+			}else{
 				return new OC_L10N_String($this, $text_plural, $parameters, $count);
 			}
 		}
 	}
 
 	/**
-	 * @brief Translating
-	 * @param $textArray The text array we need a translation for
-	 * @returns Translation or the same text
-	 *
-	 * Returns the translation. If no translation is found, $textArray will be
-	 * returned.
-	 *
-	 *
-	 * @deprecated deprecated since ownCloud version 5.0
-	 * This method will probably be removed with ownCloud 6.0
-	 *
-	 *
-	 */
-	public function tA($textArray) {
-		OC_Log::write('core', 'DEPRECATED: the method tA is deprecated and will be removed soon.', OC_Log::WARN);
-		$result = array();
-		foreach($textArray as $key => $text) {
-			$result[$key] = (string)$this->t($text);
-		}
-		return $result;
-	}
-
-	/**
 	 * @brief getTranslations
-	 * @returns Fetch all translations
+	 * @returns array Fetch all translations
 	 *
 	 * Returns an associative array with all translations
 	 */
@@ -339,7 +314,7 @@ class OC_L10N implements \OCP\IL10N {
 
 	/**
 	 * @brief get localizations
-	 * @returns Fetch all localizations
+	 * @returns array Fetch all localizations
 	 *
 	 * Returns an associative array with all localizations
 	 */
diff --git a/lib/private/migrate.php b/lib/private/migrate.php
index 3fb3e334ea2..5bcc11b061b 100644
--- a/lib/private/migrate.php
+++ b/lib/private/migrate.php
@@ -69,9 +69,9 @@ class OC_Migrate{
 
 	/**
 	 * @brief exports a user, or owncloud instance
-	 * @param optional $uid string user id of user to export if export type is user, defaults to current
-	 * @param ootional $type string type of export, defualts to user
-	 * @param otional $path string path to zip output folder
+	 * @param string $uid user id of user to export if export type is user, defaults to current
+	 * @param string $type type of export, defualts to user
+	 * @param string $path path to zip output folder
 	 * @return string on error, path to zip on success
 	 */
 	public static function export( $uid=null, $type='user', $path=null ) {
@@ -192,11 +192,12 @@ class OC_Migrate{
 	}
 
 	/**
-	* @brief imports a user, or owncloud instance
-	* @param $path string path to zip
-	* @param optional $type type of import (user or instance)
-	* @param optional $uid userid of new user
-	*/
+	 * @brief imports a user, or owncloud instance
+	 * @param string $path path to zip
+	 * @param string $type type of import (user or instance)
+	 * @param string|null|int $uid userid of new user
+	 * @return string
+	 */
 	public static function import( $path, $type='user', $uid=null ) {
 
 		$datadir = OC_Config::getValue( 'datadirectory' );
@@ -307,8 +308,8 @@ class OC_Migrate{
 
 	/**
 	* @brief recursively deletes a directory
-	* @param string $dir string path of dir to delete
-	* $param optional $deleteRootToo bool delete the root directory
+	* @param string $dir path of dir to delete
+	* @param bool $deleteRootToo delete the root directory
 	* @return bool
 	*/
 	private static function unlink_r( $dir, $deleteRootToo=true ) {
@@ -406,7 +407,7 @@ class OC_Migrate{
 
 	/**
 	 * @brief generates json containing export info, and merges any data supplied
-	 * @param optional $array array of data to include in the returned json
+	 * @param array $array of data to include in the returned json
 	 * @return string
 	 */
 	static private function getExportInfo( $array=array() ) {
@@ -430,8 +431,7 @@ class OC_Migrate{
 
 	/**
 	 * @brief connects to migration.db, or creates if not found
-	 * @param $db optional path to migration.db, defaults to user data dir
-	 * @param string $path
+	 * @param string $path to migration.db, defaults to user data dir
 	 * @return bool whether the operation was successful
 	 */
 	static private function connectDB( $path=null ) {
@@ -461,7 +461,7 @@ class OC_Migrate{
 
 	/**
 	 * @brief creates the tables in migration.db from an apps database.xml
-	 * @param string $appid string id of the app
+	 * @param string $appid id of the app
 	 * @return bool whether the operation was successful
 	 */
 	static private function createAppTables( $appid ) {
@@ -499,7 +499,6 @@ class OC_Migrate{
 
 	/**
 	* @brief tries to create the zip
-	* @param $path string path to zip destination
 	* @return bool
 	*/
 	static private function createZip() {
@@ -538,7 +537,7 @@ class OC_Migrate{
 	* @brief imports a new user
 	* @param string $db string path to migration.db
 	* @param $info object of migration info
-	* @param $uid optional uid to use
+	* @param string|null|int $uid uid to use
 	* @return array of apps with import statuses, or false on failure.
 	*/
 	public static function importAppData( $db, $info, $uid=null ) {
@@ -601,10 +600,10 @@ class OC_Migrate{
 
 	}
 
-	/*
-	* @brief creates a new user in the database
-	* @param $uid string user_id of the user to be created
-	* @param $hash string hash of the user to be created
+	/**
+	* creates a new user in the database
+	* @param string $uid user_id of the user to be created
+	* @param string $hash hash of the user to be created
 	* @return bool result of user creation
 	*/
 	public static function createUser( $uid, $hash ) {
diff --git a/lib/private/migration/content.php b/lib/private/migration/content.php
index 43eba89b8d5..b0e7a4e9528 100644
--- a/lib/private/migration/content.php
+++ b/lib/private/migration/content.php
@@ -36,7 +36,7 @@ class OC_Migration_Content{
 	* @brief sets up the
 	* @param ZipArchive $zip ZipArchive object
 	* @param $db a database object (required for exporttype user)
-	* @return boolean|null
+	* @return bool|null
 	*/
 	public function __construct( $zip, $db=null ) {
 
diff --git a/lib/private/ocs.php b/lib/private/ocs.php
index bbe965ce561..211e8222145 100644
--- a/lib/private/ocs.php
+++ b/lib/private/ocs.php
@@ -39,6 +39,7 @@ class OC_OCS {
 	* @return string Data or if the key is not found and no default is set it will exit with a 400 Bad request
 	*/
 	public static function readData($method, $key, $type = 'raw', $default = null) {
+		$data = false;
 		if ($method == 'get') {
 			if (isset($_GET[$key])) {
 				$data = $_GET[$key];
@@ -107,19 +108,19 @@ class OC_OCS {
 
 
 	/**
-	* generates the xml or json response for the API call from an multidimenional data array.
-	* @param string $format
-	* @param string $status
-	* @param string $statuscode
-	* @param string $message
-	* @param array $data
-	* @param string $tag
-	* @param string $tagattribute
-	* @param int $dimension
-	* @param int $itemscount
-	* @param int $itemsperpage
-	* @return string xml/json
-	*/
+	 * generates the xml or json response for the API call from an multidimenional data array.
+	 * @param string $format
+	 * @param string $status
+	 * @param string $statuscode
+	 * @param string $message
+	 * @param array $data
+	 * @param string $tag
+	 * @param string $tagattribute
+	 * @param int $dimension
+	 * @param int|string $itemscount
+	 * @param int|string $itemsperpage
+	 * @return string xml/json
+	 */
 	private static function generateXml($format, $status, $statuscode,
 		$message, $data=array(), $tag='', $tagattribute='', $dimension=-1, $itemscount='', $itemsperpage='') {
 		if($format=='json') {
@@ -212,6 +213,8 @@ class OC_OCS {
 	}
 
 	/**
+	 * @param $writer
+	 * @param $data
 	 * @param string $node
 	 */
 	public static function toXml($writer, $data, $node) {
diff --git a/lib/private/ocsclient.php b/lib/private/ocsclient.php
index 68dc2c2d6ec..b0480caf028 100644
--- a/lib/private/ocsclient.php
+++ b/lib/private/ocsclient.php
@@ -95,7 +95,8 @@ class OC_OCSClient{
 	 * @returns array with application data
 	 *
 	 * This function returns a list of all the applications on the OCS server
-	 * @param integer $page
+	 * @param $categories
+	 * @param int $page
 	 * @param string $filter
 	 */
 	public static function getApplications($categories, $page, $filter) {
@@ -148,6 +149,7 @@ class OC_OCSClient{
 
 	/**
 	 * @brief Get an the applications from the OCS server
+	 * @param string $id
 	 * @returns array with application data
 	 *
 	 * This function returns an  applications from the OCS server
@@ -189,12 +191,13 @@ class OC_OCSClient{
 	}
 
 	/**
-		* @brief Get the download url for an application from the OCS server
-		* @returns array with application data
-		*
-		* This function returns an download url for an applications from the OCS server
-		* @param integer $item
-		*/
+	 * @brief Get the download url for an application from the OCS server
+	 * @returns array with application data
+	 *
+	 * This function returns an download url for an applications from the OCS server
+	 * @param string $id
+	 * @param integer $item
+	 */
 	public static function getApplicationDownload($id, $item) {
 		if(OC_Config::getValue('appstoreenabled', true)==false) {
 			return null;
diff --git a/lib/private/preview.php b/lib/private/preview.php
index 0187b4aacbb..cdf22240382 100755
--- a/lib/private/preview.php
+++ b/lib/private/preview.php
@@ -72,6 +72,7 @@ class Preview {
 	 * @param int $maxX The maximum X size of the thumbnail. It can be smaller depending on the shape of the image
 	 * @param int $maxY The maximum Y size of the thumbnail. It can be smaller depending on the shape of the image
 	 * @param bool $scalingUp Disable/Enable upscaling of previews
+	 * @throws \Exception
 	 * @return mixed (bool / string)
 	 *                    false if thumbnail does not exist
 	 *                    path to thumbnail if thumbnail exists
@@ -172,6 +173,9 @@ class Preview {
 		return $this->configMaxY;
 	}
 
+	/**
+	 * @return false|Files\FileInfo|\OCP\Files\FileInfo
+	 */
 	protected function getFileInfo() {
 		$absPath = $this->fileView->getAbsolutePath($this->file);
 		$absPath = Files\Filesystem::normalizePath($absPath);
@@ -211,6 +215,7 @@ class Preview {
 	/**
 	 * @brief set the the max width of the preview
 	 * @param int $maxX
+	 * @throws \Exception
 	 * @return $this
 	 */
 	public function setMaxX($maxX = 1) {
@@ -231,6 +236,7 @@ class Preview {
 	/**
 	 * @brief set the the max height of the preview
 	 * @param int $maxY
+	 * @throws \Exception
 	 * @return $this
 	 */
 	public function setMaxY($maxY = 1) {
@@ -401,6 +407,10 @@ class Preview {
 		return $possibleThumbnails;
 	}
 
+	/**
+	 * @param string $name
+	 * @return array
+	 */
 	private function getDimensionsFromFilename($name) {
 			$size = explode('-', $name);
 			$x = (int) $size[0];
@@ -409,6 +419,11 @@ class Preview {
 			return array($x, $y, $aspectRatio);
 	}
 
+	/**
+	 * @param int $x
+	 * @param int $y
+	 * @return bool
+	 */
 	private function unscalable($x, $y) {
 		
 		$maxX = $this->getMaxX();
@@ -707,6 +722,7 @@ class Preview {
 
 	/**
 	 * @param string $mimeType
+	 * @return bool
 	 */
 	public static function isMimeSupported($mimeType) {
 		if (!\OC_Config::getValue('enable_previews', true)) {
diff --git a/lib/private/preview/movies.php b/lib/private/preview/movies.php
index 7e0ff51ad2e..72ccfadc6e9 100644
--- a/lib/private/preview/movies.php
+++ b/lib/private/preview/movies.php
@@ -42,7 +42,6 @@ if (!\OC_Util::runningOnWindows()) {
 			public function getThumbnail($path, $maxX, $maxY, $scalingup, $fileview) {
 				// TODO: use proc_open() and stream the source file ?
 				$absPath = \OC_Helper::tmpFile();
-				$tmpPath = \OC_Helper::tmpFile();
 
 				$handle = $fileview->fopen($path, 'rb');
 
@@ -51,14 +50,39 @@ if (!\OC_Util::runningOnWindows()) {
 				$firstmb = stream_get_contents($handle, 5242880);
 				file_put_contents($absPath, $firstmb);
 
+				$result = $this->generateThumbNail($maxX, $maxY, $absPath, 5);
+				if ($result === false) {
+					$result = $this->generateThumbNail($maxX, $maxY, $absPath, 1);
+					if ($result === false) {
+						$result = $this->generateThumbNail($maxX, $maxY, $absPath, 0);
+					}
+				}
+
+				unlink($absPath);
+
+
+				return $result;
+			}
+
+			/**
+			 * @param int $maxX
+			 * @param int $maxY
+			 * @param string $absPath
+			 * @param string $tmpPath
+			 * @param int $second
+			 * @return bool|\OC_Image
+			 */
+			private function generateThumbNail($maxX, $maxY, $absPath, $second)
+			{
+				$tmpPath = \OC_Helper::tmpFile();
+
 				if (self::$avconvBinary) {
-					$cmd = self::$avconvBinary . ' -an -y -ss 5'.
+					$cmd = self::$avconvBinary . ' -an -y -ss ' . escapeshellarg($second) .
 						' -i ' . escapeshellarg($absPath) .
 						' -f mjpeg -vframes 1 -vsync 1 ' . escapeshellarg($tmpPath) .
 						' > /dev/null 2>&1';
-				}
-				else {
-					$cmd = self::$ffmpegBinary . ' -y -ss 5' .
+				} else {
+					$cmd = self::$ffmpegBinary . ' -y -ss ' . escapeshellarg($second) .
 						' -i ' . escapeshellarg($absPath) .
 						' -f mjpeg -vframes 1' .
 						' -s ' . escapeshellarg($maxX) . 'x' . escapeshellarg($maxY) .
@@ -68,14 +92,13 @@ if (!\OC_Util::runningOnWindows()) {
 
 				exec($cmd, $output, $returnCode);
 
-				unlink($absPath);
-
 				if ($returnCode === 0) {
 					$image = new \OC_Image();
 					$image->loadFromFile($tmpPath);
 					unlink($tmpPath);
 					return $image->valid() ? $image : false;
 				}
+				unlink($tmpPath);
 				return false;
 			}
 		}
diff --git a/lib/private/request.php b/lib/private/request.php
index 7cbbb0676b1..90f7488eea5 100755
--- a/lib/private/request.php
+++ b/lib/private/request.php
@@ -31,7 +31,7 @@ class OC_Request {
 	 * of trusted domains. If no trusted domains have been configured, returns
 	 * true.
 	 * This is used to prevent Host Header Poisoning.
-	 * @param string $host
+	 * @param string $domain
 	 * @return bool true if the given domain is trusted or if no trusted domains
 	 * have been configured
 	 */
@@ -76,7 +76,7 @@ class OC_Request {
 	/**
 	 * Returns the overwritehost setting from the config if set and
 	 * if the overwrite condition is met
-	 * @return overwritehost value or null if not defined or the defined condition
+	 * @return string|null overwritehost value or null if not defined or the defined condition
 	 * isn't met
 	 */
 	public static function getOverwriteHost() {
@@ -201,6 +201,7 @@ class OC_Request {
 
 	/**
 	 * @brief get Path info from request, not urldecoded
+	 * @throws Exception
 	 * @return string Path info or false when not found
 	 */
 	public static function getRawPathInfo() {
diff --git a/lib/private/response.php b/lib/private/response.php
index 983c682bf3f..1aa5e629b8b 100644
--- a/lib/private/response.php
+++ b/lib/private/response.php
@@ -50,7 +50,7 @@ class OC_Response {
 
 	/**
 	* @brief Set response status
-	* @param $status a HTTP status code, see also the STATUS constants
+	* @param int $status a HTTP status code, see also the STATUS constants
 	*/
 	static public function setStatus($status) {
 		$protocol = $_SERVER['SERVER_PROTOCOL'];
diff --git a/lib/private/route/cachingrouter.php b/lib/private/route/cachingrouter.php
index ad25372391f..6412ceb0418 100644
--- a/lib/private/route/cachingrouter.php
+++ b/lib/private/route/cachingrouter.php
@@ -31,7 +31,8 @@ class CachingRouter extends Router {
 	 * @return string
 	 */
 	public function generate($name, $parameters = array(), $absolute = false) {
-		$key = $name . json_encode($parameters) . $absolute;
+		sort($parameters);
+		$key = $this->context->getHost() . '#' . $this->context->getBaseUrl() . $name . json_encode($parameters) . intval($absolute);
 		if ($this->cache->hasKey($key)) {
 			return $this->cache->get($key);
 		} else {
diff --git a/lib/private/route/route.php b/lib/private/route/route.php
index 6ade9ec15f6..df80facf9c1 100644
--- a/lib/private/route/route.php
+++ b/lib/private/route/route.php
@@ -25,6 +25,7 @@ class Route extends SymfonyRoute implements IRoute {
 
 	/**
 	 * Specify POST as the method to use with this route
+	 * @return \OC\Route\Route
 	 */
 	public function post() {
 		$this->method('POST');
@@ -33,6 +34,7 @@ class Route extends SymfonyRoute implements IRoute {
 
 	/**
 	 * Specify GET as the method to use with this route
+	 * @return \OC\Route\Route
 	 */
 	public function get() {
 		$this->method('GET');
@@ -41,6 +43,7 @@ class Route extends SymfonyRoute implements IRoute {
 
 	/**
 	 * Specify PUT as the method to use with this route
+	 * @return \OC\Route\Route
 	 */
 	public function put() {
 		$this->method('PUT');
@@ -49,6 +52,7 @@ class Route extends SymfonyRoute implements IRoute {
 
 	/**
 	 * Specify DELETE as the method to use with this route
+	 * @return \OC\Route\Route
 	 */
 	public function delete() {
 		$this->method('DELETE');
@@ -57,6 +61,7 @@ class Route extends SymfonyRoute implements IRoute {
 
 	/**
 	 * Specify PATCH as the method to use with this route
+	 * @return \OC\Route\Route
 	 */
 	public function patch() {
 		$this->method('PATCH');
@@ -120,6 +125,7 @@ class Route extends SymfonyRoute implements IRoute {
 	 * The action to execute when this route matches, includes a file like
 	 * it is called directly
 	 * @param $file
+	 * @return void
 	 */
 	public function actionInclude($file) {
 		$function = create_function('$param',
diff --git a/lib/private/route/router.php b/lib/private/route/router.php
index fa0ad6ab95b..f7900362bec 100644
--- a/lib/private/route/router.php
+++ b/lib/private/route/router.php
@@ -81,6 +81,9 @@ class Router implements IRouter {
 		return $this->routingFiles;
 	}
 
+	/**
+	 * @return string
+	 */
 	public function getCacheKey() {
 		if (!isset($this->cacheKey)) {
 			$files = $this->getRoutingFiles();
@@ -94,6 +97,7 @@ class Router implements IRouter {
 
 	/**
 	 * loads the api routes
+	 * @return void
 	 */
 	public function loadRoutes($app = null) {
 		if ($this->loaded) {
@@ -152,6 +156,7 @@ class Router implements IRouter {
 	 * Sets the collection to use for adding routes
 	 *
 	 * @param string $name Name of the collection to use.
+	 * @return void
 	 */
 	public function useCollection($name) {
 		$this->collection = $this->getCollection($name);
@@ -177,6 +182,7 @@ class Router implements IRouter {
 	 *
 	 * @param string $url The url to find
 	 * @throws \Exception
+	 * @return void
 	 */
 	public function match($url) {
 		if (substr($url, 0, 6) === '/apps/') {
@@ -207,6 +213,7 @@ class Router implements IRouter {
 
 	/**
 	 * Get the url generator
+	 * @return \Symfony\Component\Routing\Generator\UrlGenerator
 	 *
 	 */
 	public function getGenerator() {
diff --git a/lib/private/search.php b/lib/private/search.php
index 70d670e048e..3f540090fdd 100644
--- a/lib/private/search.php
+++ b/lib/private/search.php
@@ -45,7 +45,7 @@ class OC_Search{
 
 	/**
 	 * search all provider for $query
-	 * @param string query
+	 * @param string $query
 	 * @return array An array of OC_Search_Result's
 	 */
 	public static function search($query) {
diff --git a/lib/private/subadmin.php b/lib/private/subadmin.php
index 8cda7240ac9..5b6072987ad 100644
--- a/lib/private/subadmin.php
+++ b/lib/private/subadmin.php
@@ -32,8 +32,8 @@ class OC_SubAdmin{
 
 	/**
 	 * @brief add a SubAdmin
-	 * @param $uid uid of the SubAdmin
-	 * @param $gid gid of the group
+	 * @param string $uid uid of the SubAdmin
+	 * @param string $gid gid of the group
 	 * @return boolean
 	 */
 	public static function createSubAdmin($uid, $gid) {
@@ -45,8 +45,8 @@ class OC_SubAdmin{
 
 	/**
 	 * @brief delete a SubAdmin
-	 * @param $uid uid of the SubAdmin
-	 * @param $gid gid of the group
+	 * @param string $uid uid of the SubAdmin
+	 * @param string $gid gid of the group
 	 * @return boolean
 	 */
 	public static function deleteSubAdmin($uid, $gid) {
@@ -58,7 +58,7 @@ class OC_SubAdmin{
 
 	/**
 	 * @brief get groups of a SubAdmin
-	 * @param $uid uid of the SubAdmin
+	 * @param string $uid uid of the SubAdmin
 	 * @return array
 	 */
 	public static function getSubAdminsGroups($uid) {
@@ -73,7 +73,7 @@ class OC_SubAdmin{
 
 	/**
 	 * @brief get SubAdmins of a group
-	 * @param $gid gid of the group
+	 * @param string $gid gid of the group
 	 * @return array
 	 */
 	public static function getGroupsSubAdmins($gid) {
@@ -102,8 +102,8 @@ class OC_SubAdmin{
 
 	/**
 	 * @brief checks if a user is a SubAdmin of a group
-	 * @param $uid uid of the subadmin
-	 * @param $gid gid of the group
+	 * @param string $uid uid of the subadmin
+	 * @param string $gid gid of the group
 	 * @return bool
 	 */
 	public static function isSubAdminofGroup($uid, $gid) {
@@ -118,7 +118,7 @@ class OC_SubAdmin{
 
 	/**
 	 * @brief checks if a user is a SubAdmin
-	 * @param $uid uid of the subadmin
+	 * @param string $uid uid of the subadmin
 	 * @return bool
 	 */
 	public static function isSubAdmin($uid) {
@@ -138,8 +138,8 @@ class OC_SubAdmin{
 
 	/**
 	 * @brief checks if a user is a accessible by a subadmin
-	 * @param $subadmin uid of the subadmin
-	 * @param $user uid of the user
+	 * @param string $subadmin uid of the subadmin
+	 * @param string $user uid of the user
 	 * @return bool
 	 */
 	public static function isUserAccessible($subadmin, $user) {
diff --git a/lib/private/template.php b/lib/private/template.php
index c6851c6cc8d..3d18b52bac9 100644
--- a/lib/private/template.php
+++ b/lib/private/template.php
@@ -64,29 +64,6 @@ class OC_Template extends \OC\Template\Base {
 		$this->path = $path;
 
 		parent::__construct($template, $requesttoken, $l10n, $themeDefaults);
-
-		// Some headers to enhance security
-		header('X-XSS-Protection: 1; mode=block'); // Enforce browser based XSS filters
-		header('X-Content-Type-Options: nosniff'); // Disable sniffing the content type for IE
-
-		// iFrame Restriction Policy
-		$xFramePolicy = OC_Config::getValue('xframe_restriction', true);
-		if($xFramePolicy) {
-			header('X-Frame-Options: Sameorigin'); // Disallow iFraming from other domains
-		}
-		
-		// Content Security Policy
-		// If you change the standard policy, please also change it in config.sample.php
-		$policy = OC_Config::getValue('custom_csp_policy',
-			'default-src \'self\'; '
-			.'script-src \'self\' \'unsafe-eval\'; '
-			.'style-src \'self\' \'unsafe-inline\'; '
-			.'frame-src *; '
-			.'img-src *; '
-			.'font-src \'self\' data:; '
-			.'media-src *');
-		header('Content-Security-Policy:'.$policy); // Standard
-
 	}
 
 	/**
@@ -159,6 +136,7 @@ class OC_Template extends \OC\Template\Base {
 	 * @param string $theme
 	 * @param string $app
 	 * @param string $fext
+	 * @return array
 	 */
 	protected function findTemplate($theme, $app, $name, $fext) {
 		// Check if it is a app template or not.
@@ -255,7 +233,7 @@ class OC_Template extends \OC\Template\Base {
 	 * @brief Shortcut to print a simple page for guests
 	 * @param string $application The application we render the template for
 	 * @param string $name Name of the template
-	 * @param string $parameters Parameters for the template
+	 * @param array|string $parameters Parameters for the template
 	 * @return bool
 	 */
 	public static function printGuestPage( $application, $name, $parameters = array() ) {
@@ -284,7 +262,6 @@ class OC_Template extends \OC\Template\Base {
 	 * print error page using Exception details
 	 * @param Exception $exception
 	 */
-	
 	public static function printExceptionErrorPage(Exception $exception) {
 		$error_msg = $exception->getMessage();
 		if ($exception->getCode()) {
diff --git a/lib/private/templatelayout.php b/lib/private/templatelayout.php
index af17adb11c6..b7ac02a753d 100644
--- a/lib/private/templatelayout.php
+++ b/lib/private/templatelayout.php
@@ -1,8 +1,6 @@
 <?php
 use Assetic\Asset\AssetCollection;
 use Assetic\Asset\FileAsset;
-use Assetic\Asset\GlobAsset;
-use Assetic\AssetManager;
 use Assetic\AssetWriter;
 use Assetic\Filter\CssRewriteFilter;
 
@@ -66,7 +64,7 @@ class OC_TemplateLayout extends OC_Template {
 		}
 
 		$versionParameter = '?v=' . md5(implode(OC_Util::getVersion()));
-		$useAssetPipeline = OC_Config::getValue('asset-pipeline.enabled', false);
+		$useAssetPipeline = $this->isAssetPipelineEnabled();
 		if ($useAssetPipeline) {
 
 			$this->append( 'jsfiles', OC_Helper::linkToRoute('js_config') . $versionParameter);
@@ -99,6 +97,10 @@ class OC_TemplateLayout extends OC_Template {
 		}
 	}
 
+	/**
+	 * @param $styles
+	 * @return array
+	 */
 	static public function findStylesheetFiles($styles) {
 		// Read the selected theme from the config file
 		$theme = OC_Util::getTheme();
@@ -113,6 +115,10 @@ class OC_TemplateLayout extends OC_Template {
 		return $locator->getResources();
 	}
 
+	/**
+	 * @param $scripts
+	 * @return array
+	 */
 	static public function findJavascriptFiles($scripts) {
 		// Read the selected theme from the config file
 		$theme = OC_Util::getTheme();
@@ -168,6 +174,10 @@ class OC_TemplateLayout extends OC_Template {
 		$this->append('cssfiles', OC_Helper::linkTo('assets', "$cssHash.css"));
 	}
 
+	/**
+	 * @param $files
+	 * @return string
+	 */
 	private static function hashScriptNames($files)
 	{
 		$files = array_map(function ($item) {
@@ -179,4 +189,33 @@ class OC_TemplateLayout extends OC_Template {
 		sort($files);
 		return hash('md5', implode('', $files));
 	}
+
+	/**
+	 * @return bool
+	 */
+	private function isAssetPipelineEnabled() {
+		// asset management enabled?
+		$useAssetPipeline = OC_Config::getValue('asset-pipeline.enabled', false);
+		if (!$useAssetPipeline) {
+			return false;
+		}
+
+		// assets folder exists?
+		$assetDir = \OC::$SERVERROOT . '/assets';
+		if (!is_dir($assetDir)) {
+			if (!mkdir($assetDir)) {
+				\OCP\Util::writeLog('assets',
+					"Folder <$assetDir> does not exist and/or could not be generated.", \OCP\Util::ERROR);
+				return false;
+			}
+		}
+
+		// assets folder can be accessed?
+		if (!touch($assetDir."/.oc")) {
+			\OCP\Util::writeLog('assets',
+				"Folder <$assetDir> could not be accessed.", \OCP\Util::ERROR);
+			return false;
+		}
+		return $useAssetPipeline;
+	}
 }
diff --git a/lib/private/urlgenerator.php b/lib/private/urlgenerator.php
index 260eeb15108..a56b0fe3378 100644
--- a/lib/private/urlgenerator.php
+++ b/lib/private/urlgenerator.php
@@ -32,9 +32,8 @@ class URLGenerator implements IURLGenerator {
 	 * @brief Creates an url using a defined route
 	 * @param $route
 	 * @param array $parameters
-	 * @return
 	 * @internal param array $args with param=>value, will be appended to the returned url
-	 * @returns string the url
+	 * @return string the url
 	 *
 	 * Returns a url to the given app and file.
 	 */
@@ -96,6 +95,7 @@ class URLGenerator implements IURLGenerator {
 	 * @brief Creates path to an image
 	 * @param string $app app
 	 * @param string $image image name
+	 * @throws \RuntimeException If the image does not exist
 	 * @return string the url
 	 *
 	 * Returns the path to the image.
diff --git a/lib/private/user.php b/lib/private/user.php
index dc4c7ec3b61..7106d664aca 100644
--- a/lib/private/user.php
+++ b/lib/private/user.php
@@ -37,6 +37,10 @@
  *   logout()
  */
 class OC_User {
+
+	/**
+	 * @return \OC\User\Session
+	 */
 	public static function getUserSession() {
 		return OC::$server->getUserSession();
 	}
@@ -220,8 +224,8 @@ class OC_User {
 
 	/**
 	 * @brief Try to login a user
-	 * @param $uid The username of the user to log in
-	 * @param $password The password of the user
+	 * @param string $uid The username of the user to log in
+	 * @param string $password The password of the user
 	 * @return boolean|null
 	 *
 	 * Log in a user and regenerate a new session - if the password is ok
@@ -291,6 +295,8 @@ class OC_User {
 	/**
 	 * @brief Sets user display name for session
 	 * @param string $uid
+	 * @param null $displayName
+	 * @return bool Whether the display name could get set
 	 */
 	public static function setDisplayName($uid, $displayName = null) {
 		if (is_null($displayName)) {
@@ -514,6 +520,7 @@ class OC_User {
 	 * @returns array with all uids
 	 *
 	 * Get a list of all users.
+	 * @param string $search
 	 * @param integer $limit
 	 * @param integer $offset
 	 */
diff --git a/lib/private/user/database.php b/lib/private/user/database.php
index 15e6643dfb3..994a47011e6 100644
--- a/lib/private/user/database.php
+++ b/lib/private/user/database.php
@@ -121,7 +121,7 @@ class OC_User_Database extends OC_User_Backend {
 	 */
 	public function setDisplayName($uid, $displayName) {
 		if ($this->userExists($uid)) {
-			$query = OC_DB::prepare('UPDATE `*PREFIX*users` SET `displayname` = ? WHERE LOWER(`uid`) = ?');
+			$query = OC_DB::prepare('UPDATE `*PREFIX*users` SET `displayname` = ? WHERE LOWER(`uid`) = LOWER(?)');
 			$query->execute(array($displayName, $uid));
 			return true;
 		} else {
diff --git a/lib/private/util.php b/lib/private/util.php
index e20de308e87..e6aa7b061b5 100755
--- a/lib/private/util.php
+++ b/lib/private/util.php
@@ -87,7 +87,9 @@ class OC_Util {
 	}
 
 	/**
+	 * Get the quota of a user
 	 * @param string $user
+	 * @return int Quota bytes
 	 */
 	public static function getUserQuota($user){
 		$config = \OC::$server->getConfig();
@@ -301,8 +303,6 @@ class OC_Util {
 			return $errors;
 		}
 
-		$defaults = new \OC_Defaults();
-
 		$webServerRestart = false;
 		//check for database drivers
 		if(!(is_callable('sqlite_open') or class_exists('SQLite3'))
@@ -598,11 +598,11 @@ class OC_Util {
 	}
 
 	/**
-	 * @return void
+	 * @param array $errors
 	 */
 	public static function displayLoginPage($errors = array()) {
 		$parameters = array();
-		foreach( $errors as $key => $value ) {
+		foreach( $errors as $value ) {
 			$parameters[$value] = true;
 		}
 		if (!empty($_POST['user'])) {
@@ -827,12 +827,13 @@ class OC_Util {
 	}
 
 	/**
-	 * @brief Check if the htaccess file is working
+	 * @brief Check if the .htaccess file is working
+	 * @throws OC\HintException If the testfile can't get written.
 	 * @return bool
-	 * @description Check if the htaccess file is working by creating a test
+	 * @description Check if the .htaccess file is working by creating a test
 	 * file in the data directory and trying to access via http
 	 */
-	public static function isHtAccessWorking() {
+	public static function isHtaccessWorking() {
 		if (!\OC_Config::getValue("check_for_working_htaccess", true)) {
 			return true;
 		}
diff --git a/lib/private/vobject.php b/lib/private/vobject.php
index 267176ebc07..a3e9f7ef790 100644
--- a/lib/private/vobject.php
+++ b/lib/private/vobject.php
@@ -36,8 +36,8 @@ class OC_VObject{
 
 	/**
 	 * @brief Parses the VObject
-	 * @param string VObject as string
-	 * @returns Sabre_VObject or null
+	 * @param string $data VObject as string
+	 * @returns Sabre\VObject\Reader|null
 	 */
 	public static function parse($data) {
 		try {
@@ -55,7 +55,7 @@ class OC_VObject{
 
 	/**
 	 * @brief Escapes semicolons
-	 * @param string $value
+	 * @param array $value
 	 * @return string
 	 */
 	public static function escapeSemicolons($value) {
@@ -88,7 +88,7 @@ class OC_VObject{
 	}
 
 	/**
-	 * Constuctor
+	 * Constructor
 	 * @param Sabre\VObject\Component or string
 	 */
 	public function __construct($vobject_or_name) {
@@ -99,6 +99,11 @@ class OC_VObject{
 		}
 	}
 
+	/**
+	 * @todo Write documentation
+	 * @param $item
+	 * @param null $itemValue
+	 */
 	public function add($item, $itemValue = null) {
 		if ($item instanceof OC_VObject) {
 			$item = $item->getVObject();
@@ -110,8 +115,8 @@ class OC_VObject{
 	 * @brief Add property to vobject
 	 * @param object $name of property
 	 * @param object $value of property
-	 * @param object $parameters of property
-	 * @returns Sabre_VObject_Property newly created
+	 * @param array|object $parameters of property
+	 * @returns Sabre\VObject\Property newly created
 	 */
 	public function addProperty($name, $value, $parameters=array()) {
 		if(is_array($value)) {
@@ -131,6 +136,11 @@ class OC_VObject{
 		$this->vobject->add('UID', $uid);
 	}
 
+	/**
+	 * @todo Write documentation
+	 * @param mixed  $name
+	 * @param string $string
+	 */
 	public function setString($name, $string) {
 		if ($string != '') {
 			$string = strtr($string, array("\r\n"=>"\n"));
@@ -145,7 +155,7 @@ class OC_VObject{
 	 * When $datetime is set to 'now', use the current time
 	 * When $datetime is null, unset the property
 	 *
-	 * @param string property name
+	 * @param string $name
 	 * @param DateTime $datetime
 	 * @param int $dateType
 	 * @return void
@@ -163,12 +173,22 @@ class OC_VObject{
 		}
 	}
 
+	/**
+	 * @todo Write documentation
+	 * @param $name
+	 * @return string
+	 */
 	public function getAsString($name) {
 		return $this->vobject->__isset($name) ?
 			$this->vobject->__get($name)->value :
 			'';
 	}
 
+	/**
+	 * @todo Write documentation
+	 * @param $name
+	 * @return array
+	 */
 	public function getAsArray($name) {
 		$values = array();
 		if ($this->vobject->__isset($name)) {
@@ -178,6 +198,11 @@ class OC_VObject{
 		return $values;
 	}
 
+	/**
+	 * @todo Write documentation
+	 * @param $name
+	 * @return array|OC_VObject|\Sabre\VObject\Property
+	 */
 	public function &__get($name) {
 		if ($name == 'children') {
 			return $this->vobject->children;
@@ -189,18 +214,38 @@ class OC_VObject{
 		return $return;
 	}
 
+	/**
+	 * @todo Write documentation
+	 * @param string $name
+	 * @param string $value
+	 */
 	public function __set($name, $value) {
 		return $this->vobject->__set($name, $value);
 	}
 
+	/**
+	 * @todo Write documentation
+	 * @param string $name
+	 */
 	public function __unset($name) {
 		return $this->vobject->__unset($name);
 	}
 
+	/**
+	 * @todo Write documentation
+	 * @param string $name
+	 * @return bool
+	 */
 	public function __isset($name) {
 		return $this->vobject->__isset($name);
 	}
 
+	/**
+	 * @todo Write documentation
+	 * @param $function
+	 * @param $arguments
+	 * @return mixed
+	 */
 	public function __call($function, $arguments) {
 		return call_user_func_array(array($this->vobject, $function), $arguments);
 	}
diff --git a/lib/private/appframework/http/downloadresponse.php b/lib/public/appframework/http/downloadresponse.php
index 67b9542dba6..d3c2818e828 100644
--- a/lib/private/appframework/http/downloadresponse.php
+++ b/lib/public/appframework/http/downloadresponse.php
@@ -22,7 +22,7 @@
  */
 
 
-namespace OC\AppFramework\Http;
+namespace OCP\AppFramework\Http;
 
 
 /**
diff --git a/lib/public/appframework/http/jsonresponse.php b/lib/public/appframework/http/jsonresponse.php
index 6628c4514d9..6d029b7464a 100644
--- a/lib/public/appframework/http/jsonresponse.php
+++ b/lib/public/appframework/http/jsonresponse.php
@@ -49,7 +49,6 @@ class JSONResponse extends Response {
 	public function __construct($data=array(), $statusCode=Http::STATUS_OK) {
 		$this->data = $data;
 		$this->setStatus($statusCode);
-		$this->addHeader('X-Content-Type-Options', 'nosniff');
 		$this->addHeader('Content-type', 'application/json; charset=utf-8');
 	}
 
diff --git a/lib/private/appframework/http/redirectresponse.php b/lib/public/appframework/http/redirectresponse.php
index 05353349065..416e1533635 100644
--- a/lib/private/appframework/http/redirectresponse.php
+++ b/lib/public/appframework/http/redirectresponse.php
@@ -22,7 +22,7 @@
  */
 
 
-namespace OC\AppFramework\Http;
+namespace OCP\AppFramework\Http;
 
 use OCP\AppFramework\Http\Response;
 use OCP\AppFramework\Http;
diff --git a/lib/public/route/iroute.php b/lib/public/route/iroute.php
index 66fdb841821..d5610e762a8 100644
--- a/lib/public/route/iroute.php
+++ b/lib/public/route/iroute.php
@@ -10,6 +10,7 @@ namespace OCP\Route;
 interface IRoute {
 	/**
 	 * Specify PATCH as the method to use with this route
+	 * @return \OCP\Route\IRoute
 	 */
 	public function patch();
 
@@ -26,21 +27,25 @@ interface IRoute {
 	 * it is called directly
 	 *
 	 * @param $file
+	 * @return void
 	 */
 	public function actionInclude($file);
 
 	/**
 	 * Specify GET as the method to use with this route
+	 * @return \OCP\Route\IRoute
 	 */
 	public function get();
 
 	/**
 	 * Specify POST as the method to use with this route
+	 * @return \OCP\Route\IRoute
 	 */
 	public function post();
 
 	/**
 	 * Specify DELETE as the method to use with this route
+	 * @return \OCP\Route\IRoute
 	 */
 	public function delete();
 
@@ -74,6 +79,7 @@ interface IRoute {
 
 	/**
 	 * Specify PUT as the method to use with this route
+	 * @return \OCP\Route\IRoute
 	 */
 	public function put();
 }
diff --git a/lib/public/route/irouter.php b/lib/public/route/irouter.php
index 125cd29e81b..1c003c7b4b9 100644
--- a/lib/public/route/irouter.php
+++ b/lib/public/route/irouter.php
@@ -17,10 +17,14 @@ interface IRouter {
 	 */
 	public function getRoutingFiles();
 
+	/**
+	 * @return string
+	 */
 	public function getCacheKey();
 
 	/**
 	 * loads the api routes
+	 * @return void
 	 */
 	public function loadRoutes($app = null);
 
@@ -28,6 +32,7 @@ interface IRouter {
 	 * Sets the collection to use for adding routes
 	 *
 	 * @param string $name Name of the collection to use.
+	 * @return void
 	 */
 	public function useCollection($name);
 
@@ -47,6 +52,7 @@ interface IRouter {
 	 *
 	 * @param string $url The url to find
 	 * @throws \Exception
+	 * @return void
 	 */
 	public function match($url);
 
diff --git a/lib/public/template.php b/lib/public/template.php
index 9a994c1bea8..6cc984b12d5 100644
--- a/lib/public/template.php
+++ b/lib/public/template.php
@@ -67,7 +67,7 @@ function preview_icon( $path ) {
  * Returns the path to the preview of the image.
  * @param string $path of file
  * @param string $token
- * @return link to the preview
+ * @return string link to the preview
  */
 function publicPreview_icon ( $path, $token ) {
 	return(\publicPreview_icon( $path, $token ));
diff --git a/lib/public/util.php b/lib/public/util.php
index f02213f2446..f06ddd66641 100644
--- a/lib/public/util.php
+++ b/lib/public/util.php
@@ -57,7 +57,7 @@ class Util {
 	 * @param string $mailtext
 	 * @param string $fromaddress
 	 * @param string $fromname
-	 * @param bool $html
+	 * @param int $html
 	 * @param string $altbody
 	 * @param string $ccaddress
 	 * @param string $ccname
@@ -85,7 +85,7 @@ class Util {
 	 * write exception into the log. Include the stack trace
 	 * if DEBUG mode is enabled
 	 * @param string $app app name
-	 * @param Exception $ex exception to log
+	 * @param \Exception $ex exception to log
 	 */
 	public static function logException( $app, \Exception $ex ) {
 		$class = get_class($ex);
@@ -156,6 +156,7 @@ class Util {
 	 * formats a timestamp in the "right" way
 	 * @param int $timestamp $timestamp
 	 * @param bool $dateOnly option to omit time from the result
+	 * @return string timestamp
 	 */
 	public static function formatDate( $timestamp, $dateOnly=false) {
 		return(\OC_Util::formatDate( $timestamp, $dateOnly ));
@@ -203,9 +204,8 @@ class Util {
 	 * Creates an url using a defined route
 	 * @param $route
 	 * @param array $parameters
-	 * @return
 	 * @internal param array $args with param=>value, will be appended to the returned url
-	 * @return the url
+	 * @return string the url
 	 */
 	public static function linkToRoute( $route, $parameters = array() ) {
 		return \OC_Helper::linkToRoute($route, $parameters);
@@ -284,8 +284,7 @@ class Util {
 
 	/**
 	 * Returns the request uri, even if the website uses one or more reverse proxies
-	 *
-	 * @return the request uri
+	 * @return string the request uri
 	 */
 	public static function getRequestUri() {
 		return(\OC_Request::requestUri());
@@ -293,8 +292,7 @@ class Util {
 
 	/**
 	 * Returns the script name, even if the website uses one or more reverse proxies
-	 *
-	 * @return the script name
+	 * @returns string the script name
 	 */
 	public static function getScriptName() {
 		return(\OC_Request::scriptName());
@@ -350,7 +348,7 @@ class Util {
 	 * Emits a signal. To get data from the slot use references!
 	 * @param string $signalclass class name of emitter
 	 * @param string $signalname name of signal
-	 * @param string $params defautl: array() array with additional data
+	 * @param array $params default: array() array with additional data
 	 * @return bool true if slots exists or false if not
 	 *
 	 * TODO: write example
@@ -467,9 +465,8 @@ class Util {
 
 	/**
 	 * Calculate free space left within user quota
-	 * 
-	 * @param $dir the current folder where the user currently operates
-	 * @return number of bytes representing
+	 * @param string $dir the current folder where the user currently operates
+	 * @return int number of bytes representing
 	 */
 	public static function freeSpace($dir) {
 		return \OC_Helper::freeSpace($dir);