summaryrefslogtreecommitdiffstats
path: root/lib/base.php
Commit message (Collapse)AuthorAgeFilesLines
* Happy new year!Thomas Müller2016-01-121-3/+3
|
* getMediumStrengthGenerator is deprecated and does not do anything anymoreRoeland Jago Douma2016-01-111-1/+1
|
* Only '/tests' to be autoloaded when running unit testsRoeland Jago Douma2016-01-101-1/+3
|
* OC autoloader is not allowed to load 3rdpartyRoeland Jago Douma2016-01-101-1/+0
|
* Remove code related to session regeneration after some timeLukas Reschke2016-01-101-11/+1
| | | | I do not really consider this necessary or a real security addition. Let's get rid of it thus, cleans up the code and makes the logic easier.
* Use ISession::clearLukas Reschke2016-01-101-4/+1
| | | | The native approach using the PHP calls will not work properly with the cryptowrapper and thus this code is effectively doing nothing at the moment.
* Check if app does existsLukas Reschke2016-01-071-1/+6
|
* Move regeneration of session ID into session classesLukas Reschke2016-01-041-1/+1
| | | | There were code paths that nowadays call ISession::login directly thus bypassing the desired regeneration of the session ID. This moves the session regeneration deeper into the session handling and thus ensures that it is always called. Furthermore, I also added the session regeneration to the remember me cookie plus added some test case expectations for this.
* Refactor OC_Util::callCheckMorris Jobke2015-12-221-1/+1
|
* Use OCP\Util::getVersion instead of the internal private implementationMorris Jobke2015-12-181-2/+2
|
* Use SystemConfig internallyRoeland Jago Douma2015-12-181-6/+6
|
* Inject Config into SystemConfigRoeland Jago Douma2015-12-181-2/+2
|
* Get rid of legacy OC_ConfigRoeland Jago Douma2015-12-181-6/+11
| | | | | We were still using the lecagy class OC_Config all over the place. Which was a wrapper around the new class OC\Config
* Remove deprecated function OC_User::getManagerRoeland Jago Douma2015-12-171-1/+1
| | | | | Private deprecated function => removed Replaced all instances with suggested replacement
* Use URLGenerator instead of hard-coded WEBROOTLukas Reschke2015-12-031-2/+2
| | | | Fixes https://github.com/owncloud/core/issues/20922
* Execute only for web and not for CLILukas Reschke2015-12-021-7/+7
|
* Ensure that ownCloud is always accessed with a trailing slashLukas Reschke2015-12-021-0/+8
|
* Untangle the linkToDocs method in OC_HelperMorris Jobke2015-11-261-2/+5
| | | | | * now uses the proper URLGenerator interface * add comment about DI problems
* Add warning log entry when user accesses untrusted domainLukas Reschke2015-11-101-0/+9
|
* [autoloader] Make sure to load construct full pathsRoeland Jago Douma2015-11-061-6/+0
| | | | | This reduces a lot of the autoloader magic and makes sure that we generate full paths in the autoloader.
* Use IRequest's `getScriptName` functionality instead of $_SERVER['SCRIPT_NAME']Lukas Reschke2015-10-211-1/+13
|
* Delete cookie instead of emptying valueLukas Reschke2015-10-191-1/+2
| | | | | | | | PHP will handle session cookies with an empty values as an E_WARNING error. ([php/#68063](https://bugs.php.net/bug.php?id=68063)) ownCloud sets the cookie to an empty value in case the session expires, it however after this starts a new session. Due to potential race conditions this can in unlikely cases lead to the fact that the session never gets restarted and the user is left with an empty cookie. PHP tries then to use the empty cookie which makes the instance not usable. To work around any race condition we now tell PHP to explicitly delete the value which can be done by using `null` as value, PHP will then send a cookie with the value "deleted". Also theepiration has been set to -1.
* Make sure that remote shares use the correct uid casingJoas Schilling2015-10-061-0/+8
|
* update licence headers via scriptMorris Jobke2015-10-051-1/+3
|
* cache result of \OCP\Util::needUpgrade()Individual IT Services2015-09-291-6/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | reduce calls of \OCP\Util::needUpgrade() where \OCP\Util::needUpgrade() is called we can call as well self::checkUpgrade and use the cached result In line 877 the call way unnecessary anyway because of the first part of the if statement move caching to \OCP\Util::needUpgrade renaming variable fixing testNeedUpgradeCore() cache result of checkUpgrade() in self::$needUpgrade reduce calls of \OCP\Util::needUpgrade() where \OCP\Util::needUpgrade() is called we can call as well self::checkUpgrade and use the cached result In line 877 the call way unnecessary anyway because of the first part of the if statement move caching to \OCP\Util::needUpgrade renaming variable fixing testNeedUpgradeCore() fix typo in variable name deleting tabs
* Merge pull request #19293 from owncloud/individual-it-move_initTemplateThomas Müller2015-09-251-65/+1
|\ | | | | [jenkins] do not load unnecessary code in case of webdav
| * do not load unnecessary code in case of webdavIndividual IT Services2015-09-231-65/+1
| | | | | | | | | | | | | | | | | | | | | | | | changing from "protected static" to "protected" as suggested by @nickvergessen https://github.com/owncloud/core/pull/19114#discussion_r39719851 moving initTemplate() into template constr. reduce to move initTemplate only cleanup spaces
* | Merge pull request #15098 from owncloud/fix_preview_versions_revert_issueThomas Müller2015-09-241-1/+2
|\ \ | |/ |/| fix issue with version rollback and thumbnails
| * delete cached preview when rolling back file's versionGeorg Ehrke2015-09-201-1/+2
| | | | | | | | | | | | | | | | add random number using OC.parseQueryString and _.extend() version rollback: add missing prefix to OC\Preview::post_delete add test to assure that the rollback hook is called
* | Minor text typosPhil Davis2015-09-211-3/+3
|/ | | | that I noticed while looking at some code.
* Merge pull request #19024 from owncloud/remove-get_temp_dirThomas Müller2015-09-151-8/+0
|\ | | | | Remove get_temp_dir()
| * Remove get_temp_dir()Robin McCorkell2015-09-151-8/+0
| |
* | Allow /tests folder in autoloader by defaultLukas Reschke2015-09-151-1/+2
|/ | | | | | Given the fact that "/tests" is not shipped by default and this has broken some applications and frustrated quite some people we should add "/tests" to the default allowed autoloading set. I do consider the security impact marginally since the /tests folder is not shipped within the release as well as usually has a hard requirement on being called by phpunit.
* Merge pull request #18658 from owncloud/configurable-tempFrank Karlitschek2015-09-121-14/+3
|\ | | | | Configurable temporary directory
| * moved code to /lib/private/tempmanager.phproot2015-08-291-14/+3
| | | | | | | | | | | | fix for unit test some fixes
* | Only add valid root for enabled appsRobin McCorkell2015-09-051-4/+0
| |
* | Merge pull request #18794 from individual-it/reuse_systemConfigIndividual IT Services2015-09-041-1/+1
|\ \ | | | | | | reuse existing $systemConfig variable
| * | reuse existing $systemConfig variableIndividual IT Services2015-09-031-1/+1
| | |
* | | Proper details about git submodule updateMorris Jobke2015-09-031-1/+1
|/ / | | | | | | * fixes #18801
* / verify the path in the autoloaderRobin Appelman2015-09-011-4/+15
|/
* Remove DEBUG constant and use config valueMorris Jobke2015-08-241-4/+5
| | | | | * introduces config.php option 'debug' that defaults to false * migrate DEBUG constant to config value
* Merge pull request #18482 from owncloud/encrypt-session-dataMorris Jobke2015-08-241-5/+7
|\ | | | | Add a session wrapper to encrypt the data before storing it on disk
| * Add a session wrapper to encrypt the data before storing it on diskJoas Schilling2015-08-211-5/+7
| |
* | Merge pull request #18254 from owncloud/mitigate-breachMorris Jobke2015-08-241-12/+1
|\ \ | |/ |/| Add mitigation against BREACH
| * Add mitigation against BREACHLukas Reschke2015-08-141-12/+1
| | | | | | | | | | | | | | | | | | | | | | | | While BREACH requires the following three factors to be effectively exploitable we should add another mitigation: 1. Application must support HTTP compression 2. Response most reflect user-controlled input 3. Response should contain sensitive data Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed. To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.
* | Merge pull request #17434 from owncloud/update-showappnameonappupdateMorris Jobke2015-08-201-21/+36
|\ \ | |/ |/| Display app names in update page for app updates
| * Additions to update pageVincent Petry2015-08-201-4/+5
| | | | | | | | | | | | | | Apps to update and to disable will always be shown. Main title changes only when apps need updated, not core. Added bullet style. Exclude incompatible apps from updated apps list.
| * Display app names in update page for app updatesVincent Petry2015-08-191-21/+35
| | | | | | | | | | Whenever the update page is displayed for apps, show app names instead of the core update text.
* | load backbone universallyArthur Schiwon2015-08-061-0/+2
| |
* | - more injectionThomas Müller2015-07-301-1/+3
| | | | | | | | | | | | - less static calls - use params on sql queries - handle sql exception on database and user creation gracefully
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-04 07:38:40 +0000