| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
| |
Co-authored-by: Ferdinand Thiessen <opensource@fthiessen.de>
Signed-off-by: Côme Chilliet <91878298+come-nc@users.noreply.github.com>
|
|
|
|
|
|
|
| |
Needs to be adapted on each branch to reflect the used PHP version and
help with baseline updating.
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
|
|
|
| |
Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
|
|
|
|
| |
Signed-off-by: Alexander Piskun <bigcat88@icloud.com>
|
|
|
|
| |
Signed-off-by: Andrey Borysenko <andrey18106x@gmail.com>
|
|
|
| |
Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
|
|
|
|
| |
Signed-off-by: jld3103 <jld3103yt@gmail.com>
|
|\
| |
| | |
Set recommended psalm options
|
| |
| |
| |
| | |
Signed-off-by: jld3103 <jld3103yt@gmail.com>
|
|/
|
|
| |
Signed-off-by: jld3103 <jld3103yt@gmail.com>
|
|
|
|
| |
Signed-off-by: Julius Härtl <jus@bitgrid.net>
|
|
|
|
| |
Signed-off-by: John Molakvoæ <skjnldsv@protonmail.com>
|
|
|
|
| |
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
|
|
|
|
| |
Signed-off-by: Carl Schwan <carl@carlschwan.eu>
|
|
|
|
| |
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
|
|
|
|
|
|
| |
This makes sure using resource or GdImage (PHP>=8) behaves the same.
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
|
|
|
|
| |
Signed-off-by: Joas Schilling <coding@schilljs.com>
|
|
|
|
| |
Signed-off-by: Richard Steinmetz <richard@steinmetz.cloud>
|
|
|
|
| |
Signed-off-by: Julius Härtl <jus@bitgrid.net>
|
|
|
|
| |
Signed-off-by: Julius Härtl <jus@bitgrid.net>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This adds the Psalm Security Analysis, as described at
https://psalm.dev/docs/security_analysis/
It also adds a plugin for adding input into AppFramework.
The results can be viewed in the GitHub Security tab at
https://github.com/nextcloud/server/security/code-scanning
**Q&A:**
Q: Why do you not use the shipped Psalm version?
A: I do a lot of changes to the Psalm Taint behaviour. Using released
versions is not gonna get us the results we want.
Q: How do I improve false positives?
A: https://psalm.dev/docs/security_analysis/avoiding_false_positives/
Q: How do I add custom sources?
A: https://psalm.dev/docs/security_analysis/custom_taint_sources/
Q: We should run this on apps!
A: Yes.
Q: What will change in Psalm?
A: Quite some of the PHP core functions are not yet marked to propagate
the taint. This leads to results where the taint flow is lost. That's
something that I am currently working on.
Q: Why is the plugin MIT licensed?
A: Because its the first of its kind (based on GitHub Code Search) and
I want other people to copy it if they want to. Security is for all :)
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
|
|
|
|
|
|
|
|
|
| |
- make User_Proxy and Group_Proxy easy to instantiate
- simplify dependent code
- move commands to info.xml
- make UpdateGroups job class non-static
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
|
|
|
|
| |
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
|
|
|
|
| |
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
|
|
|
|
|
| |
https://github.com/nextcloud/server/blob/6e8e34fef920a073118c22111f0f31eb3b3a91dc/lib/private/legacy/template/functions.php
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
|
|
|
|
| |
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
|
|
|
|
| |
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
|
|
|
|
|
|
| |
It will suppress any error of that kind in the file. That was not intended.
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
|
|
|
|
| |
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
|
|
|
|
| |
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
|
|
|
|
|
|
| |
for some reason they are not loaded by default.
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
|
|
|
|
| |
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
|
|
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
|