summaryrefslogtreecommitdiffstats
path: root/core
Commit message (Collapse)AuthorAgeFilesLines
* [tx-robot] updated from transifexJenkins for ownCloud2015-12-082-0/+10
|
* Merge pull request #21015 from owncloud/update-redirecttocorrectpageThomas Müller2015-12-071-1/+1
|\ | | | | Redirect to correct URL after updating
| * Redirect to correct URL after updatingVincent Petry2015-12-071-1/+1
| | | | | | | | | | Now requires a trailing slash to make sure we don't land on the forbidden page.
* | Merge pull request #20996 from ↵Thomas Müller2015-12-073-6/+15
|\ \ | |/ |/| | | | | owncloud/issue-12215-remove-password-reset-when-not-possible Issue 12215 remove password reset when not possible
| * Allow specifying a custom reset-password-urlJoas Schilling2015-12-072-4/+9
| |
| * Remove password reset when the user can not change the passwordJoas Schilling2015-12-071-2/+6
| |
* | Merge pull request #21009 from owncloud/share-forbidlinkshare-duplicatefieldThomas Müller2015-12-072-6/+10
|\ \ | | | | | | Fix duplicate bogus share field when link sharing is not allowed
| * | Fix duplicate bogus share field when link sharing is not allowedVincent Petry2015-12-072-6/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | Whenever link share is not allowed, it was outputting a bogus sharing field which name would conflict with the regular sharing field. This fix makes sure that the bogus sharing field with "Resharing not allowed" message only appears when triggered by removed share permissions.
* | | Merge pull request #20991 from owncloud/disabled-checked-checkbox-css-rulesThomas Müller2015-12-071-0/+16
|\ \ \ | |/ / |/| | Disabled checked checkbox css rules
| * | Add rules for checked+disabled and disabled checkbox styleJoas Schilling2015-12-071-0/+16
| |/
* / OC.FilePath has still a valid use case when generating paths to static files ↵Thomas Müller2015-12-071-1/+0
|/ | | | what for generateUrl cannot be used for - closes #15604
* Merge pull request #20530 from owncloud/icons-moreThomas Müller2015-12-0752-91/+96
|\ | | | | add icons for disabled checkbox, radio button, error and colored checkmark
| * add new icon rules to icons.cssJan-Christoph Borchardt2015-11-201-1/+13
| |
| * add icons for checked+disabled checkbox and radioJan-Christoph Borchardt2015-11-204-0/+10
| |
| * compress action iconsJan-Christoph Borchardt2015-11-2022-84/+24
| |
| * add icons for disabled checkbox, radio button, error and colored checkmarkJan-Christoph Borchardt2015-11-2025-6/+49
| |
* | Merge pull request #20480 from owncloud/css-prefixesThomas Müller2015-12-077-41/+11
|\ \ | | | | | | CSS prefixes
| * | remove unneeded css prefixesHendrik Leppelsack2015-11-237-41/+11
| | |
* | | Merge pull request #11131 from owncloud/use-phpini-wrapperThomas Müller2015-12-071-1/+1
|\ \ \ | | | | | | | | Replacing ini_get instances with inigetwrapper usages
| * | | Replacing ini_get instances with inigetwrapper usagesClark Tomlinson2015-11-231-1/+1
| | | |
* | | | [tx-robot] updated from transifexJenkins for ownCloud2015-12-072-0/+2
| | | |
* | | | [tx-robot] updated from transifexJenkins for ownCloud2015-12-0510-2/+12
| | | |
* | | | [Avatars] JS should not load same avatar twiceRoeland Jago Douma2015-12-041-19/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Old code first dit an ajax request to the avatar. Then a new image object with the same src was created and since we do not cache avatars yet :( this resulted in 2 sequential requests to the exact same URL Now if you set the displayname it will first set the placeholder and then load the avatar in the background. Only once this time!
* | | | [tx-robot] updated from transifexJenkins for ownCloud2015-12-0484-84/+6
| | | |
* | | | Merge pull request #20860 from ↵Thomas Müller2015-12-032-11/+16
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | owncloud/use-user-getEMailAddress-all-over-the-place User IUser::getEMailAddress() all over the place
| * | | | User IUser::getEMailAddress() all over the placeThomas Müller2015-12-022-11/+16
| | | | |
* | | | | [tx-robot] updated from transifexJenkins for ownCloud2015-12-0314-0/+58
|/ / / /
* | | | Support pretty URLsLukas Reschke2015-12-012-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This changeset allows ownCloud to run with pretty URLs, they will be used if mod_rewrite and mod_env are available. This means basically that the `index.php` in the URL is not shown to the user anymore. Also the not deprecated functions to generate URLs have been modified to support this behaviour, old functions such as `filePath` will still behave as before for compatibility reasons. Examples: http://localhost/owncloud/index.php/s/AIDyKbxiRZWAAjP => http://localhost/owncloud/s/AIDyKbxiRZWAAjP http://localhost/owncloud/index.php/apps/files/ => http://localhost/owncloud/apps/files/ Due to the way our CSS and JS is structured the .htaccess uses some hacks for the final result but could be worse... And I was just annoyed by all that users crying for the removal of `index.php` ;-)
* | | | Add code integrity checkLukas Reschke2015-12-018-3/+277
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository. Furthermore, there is a basic implementation to display problems with the code integrity on the update screen. Code signing basically happens the following way: - There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release :wink:). This certificate is not intended to be used for signing directly and only is used to sign new certificates. - Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`, apps need to be signed with a certificate that either has a CN of `core` (shipped apps!) or the AppID. - The command generates a signature.json file of the following format: ```json { "hashes": { "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d", "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9" }, "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----", "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl" } ``` `hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`. Steps to do in other PRs, this is already a quite huge one: - Add nag screen in case the code check fails to ensure that administrators are aware of this. - Add code verification also to OCC upgrade and unify display code more. - Add enforced code verification to apps shipped from the appstore with a level of "official" - Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release - Add some developer documentation on how devs can request their own certificate - Check when installing ownCloud - Add support for CRLs to allow revoking certificates **Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature: ``` ➜ master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt Successfully signed "core" ``` Then increase the version and you should see something like the following: ![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png) As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen. For packaging stable releases this requires the following additional steps as a last action before zipping: 1. Run `./occ integrity:sign-core` once 2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.
* | | | [tx-robot] updated from transifexJenkins for ownCloud2015-12-012-0/+106
| | | |
* | | | update bootstrap from 3.3.5 to 3.3.6Morris Jobke2015-11-301-2/+2
| | | |
* | | | update backbone.js from 1.2.1 to 1.2.3Morris Jobke2015-11-302-117/+137
| | | |
* | | | Don't trust update serverLukas Reschke2015-11-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | In case the update server may deliver malicious content this would allow an adversary to inject arbitrary HTML into the response. So very bad stuff. While signing the response would be better and something we can also do in the future (considering the code signing work), this is already a good first start.
* | | | [tx-robot] updated from transifexJenkins for ownCloud2015-11-282-0/+4
| | | |
* | | | Add Workflow app to shipped listJoas Schilling2015-11-271-2/+3
| | | |
* | | | [tx-robot] updated from transifexJenkins for ownCloud2015-11-274-2/+6
| | | |
* | | | [tx-robot] updated from transifexJenkins for ownCloud2015-11-262-0/+24
| | | |
* | | | Merge pull request #19212 from owncloud/search-shortcutThomas Müller2015-11-251-0/+12
|\ \ \ \ | | | | | | | | | | Add Ctrl+F shortcut for the search bar
| * | | | add search fallback to browserHendrik Leppelsack2015-11-241-1/+6
| | | | |
| * | | | add Ctrl+F shortcut for the search barHendrik Leppelsack2015-11-121-0/+7
| | | | |
* | | | | update page: fix heading whitespace and unbold less important sectionsJan-Christoph Borchardt2015-11-252-5/+4
| | | | |
* | | | | fix error page button text when label too longJan-Christoph Borchardt2015-11-251-0/+2
| | | | |
* | | | | Fix for parsing pretty printed Webdav responsesVincent Petry2015-11-242-9/+29
| | | | | | | | | | | | | | | | | | | | Update davclient.js + adjust IE workaround for this
* | | | | [tx-robot] updated from transifexJenkins for ownCloud2015-11-242-0/+6
| |/ / / |/| | |
* | | | Merge pull request #20222 from owncloud/federated_sharing_auto_completeThomas Müller2015-11-231-1/+2
|\ \ \ \ | | | | | | | | | | federated sharing auto-complete, first step
| * | | | add federation to shipped.jsonBjörn Schießle2015-11-191-1/+2
| | |_|/ | |/| |
* | | | Merge pull request #20623 from owncloud/app-list-enhancementsThomas Müller2015-11-231-0/+17
|\ \ \ \ | | | | | | | | | | Add cmdline key to show shipped/non-shipped apps only
| * | | | Add cmdline key to show shipped/non-shipped apps onlyVictor Dubiniuk2015-11-231-0/+17
| | |_|/ | |/| |
* | | | Merge pull request #16902 from owncloud/jsocclientThomas Müller2015-11-2317-4/+3121
|\ \ \ \ | |/ / / |/| | | Web UI uses Webdav instead of ajax/* calls
| * | | Now using IE8 workaround of davclient.js for all IE versionsVincent Petry2015-11-221-1/+1
| | | |
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-30 16:40:07 +0000