summaryrefslogtreecommitdiffstats
path: root/tests
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request #15596 from owncloud/issue/15589Morris Jobke2015-04-291-2/+56
|\ | | | | Correctly generate the feedback URL for remote share
| * Add tests for the correct share id on the call aswellJoas Schilling2015-04-281-5/+8
| |
| * make scrutinizer happyJoas Schilling2015-04-281-1/+1
| |
| * Add tests for the remote sharing urlJoas Schilling2015-04-281-2/+53
| |
* | Merge pull request #15906 from rullzer/fix_15777Morris Jobke2015-04-291-0/+46
|\ \ | | | | | | Password set via OCS API should not be double escaped
| * | Added unit testRoeland Jago Douma2015-04-281-0/+46
| | |
* | | Filter potential dangerous filenames for avatarsLukas Reschke2015-04-281-0/+23
| |/ |/| | | | | We don't want to have users misusing this API resulting in a potential file disclosure of "avatar.(jpg|png)" files.
* | Merge pull request #14764 from owncloud/shared-etag-propagateMorris Jobke2015-04-282-2/+3
|\ \ | |/ |/| Propagate etags across shared storages
| * fix testRobin Appelman2015-04-271-1/+0
| |
| * dont use our now non existing hookRobin Appelman2015-04-271-1/+3
| |
* | Merge pull request #15886 from owncloud/fix-15848-masterThomas Müller2015-04-271-0/+3
|\ \ | | | | | | Adjust isLocal() on encryption wrapper
| * | fixes #15848Thomas Müller2015-04-271-0/+3
| |/
* | Merge pull request #15860 from owncloud/enc_fallback_old_encryptionThomas Müller2015-04-271-1/+1
|\ \ | |/ |/| [encryption] handle encrypted files correctly which where encrypted with a old version of ownCloud (<=oc6)
| * fall back to the ownCloud default encryption module and aes128 if we read a ↵Bjoern Schiessle2015-04-271-1/+1
| | | | | | | | encrypted file without a header
* | Fix new testsJoas Schilling2015-04-272-5/+2
| |
* | Add unit tests for the commandsJoas Schilling2015-04-273-0/+274
| |
* | Make getDefaultModuleId public and get module protectedJoas Schilling2015-04-271-4/+6
| |
* | Deduplicate module mockJoas Schilling2015-04-271-41/+34
| |
* | Add test for setDefaultEncryptionModuleJoas Schilling2015-04-271-0/+31
| |
* | Add a test that the default module is returned before we fall backJoas Schilling2015-04-271-1/+35
|/
* Merge pull request #15834 from owncloud/make-temporary-file-really-uniqueLukas Reschke2015-04-251-4/+25
|\ | | | | Fix collision on temporary files + adjust permissions
| * Fix collision on temporary files + adjust permissionsLukas Reschke2015-04-231-4/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This changeset hardens the temporary file and directory creation to address multiple problems that may lead to exposure of files to other users, data loss or other unexpected behaviour that is impossible to debug. **[CWE-668: Exposure of Resource to Wrong Sphere](https://cwe.mitre.org/data/definitions/668.html)** The temporary file and folder handling as implemented in ownCloud is performed using a MD5 hash over `time()` concatenated with `rand()`. This is insufficiently and leads to the following security problems: The generated filename could already be used by another user. It is not verified whether the file is already used and thus temporary files might be used for another user as well resulting in all possible stuff such as "user has file of other user". Effectively this leaves us with: 1. A timestamp based on seconds (no entropy at all) 2. `rand()` which returns usually a number between 0 and 2,147,483,647 Considering the birthday paradox and that we use this method quite often (especially when handling external storage) this is quite error prone and needs to get addressed. This behaviour has been fixed by using `tempnam` instead for single temporary files. For creating temporary directories an additional postfix will be appended, the solution is for directories still not absolutely bulletproof but the best I can think about at the moment. Improvement suggestions are welcome. **[CWE-378: Creation of Temporary File With Insecure Permissions](https://cwe.mitre.org/data/definitions/378.html)** Files were created using `touch()` which defaults to a permission of 0644. Thus other users on the machine may read potentially sensitive information as `/tmp/` is world-readable. However, ownCloud always encourages users to use a dedicated machine to run the ownCloud instance and thus this is no a high severe issue. Permissions have been adjusted to 0600. **[CWE-379: Creation of Temporary File in Directory with Incorrect Permissions](https://cwe.mitre.org/data/definitions/379.html)** Files were created using `mkdir()` which defaults to a permission of 0777. Thus other users on the machine may read potentially sensitive information as `/tmp/` is world-readable. However, ownCloud always encourages users to use a dedicated machine to run the ownCloud instance and thus this is no a high severe issue. Permissions have been adjusted to 0700.Please enter the commit message for your changes.
* | Merge pull request #15683 from owncloud/block-legacy-clientsLukas Reschke2015-04-241-0/+129
|\ \ | | | | | | Block old legacy clients
| * | Catch not existing User-Agent headerLukas Reschke2015-04-231-1/+12
| | | | | | | | | | | | In case of an not sent UA header consider the client as valid
| * | Use 403 instead a 50x responseLukas Reschke2015-04-201-1/+2
| | |
| * | Block old legacy clientsLukas Reschke2015-04-201-0/+117
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This Pull Request introduces a SabreDAV plugin that will block all older clients than 1.6.1 to connect and sync with the ownCloud instance. This has multiple reasons: 1. Old ownCloud client versions before 1.6.0 are not properly working with sticky cookies for load balancers and thus generating sessions en masse 2. Old ownCloud client versions tend to be horrible buggy In some cases we had in 80minutes about 10'000 sessions created by a single user. While this change set does not really "fix" the problem as 3rdparty legacy clients are affected as well, it is a good work-around and hopefully should force users to update their client
* | | fix unit testsBjoern Schiessle2015-04-241-5/+16
| | |
* | | enable testWriteWriteReadjknockaert2015-04-241-14/+14
| | |
* | | enable testRewindjknockaert2015-04-241-14/+14
| | |
* | | Update encryption.phpjknockaert2015-04-241-14/+14
| | |
* | | disable r+ testjknockaert2015-04-241-14/+14
| | |
* | | add two testsjknockaert2015-04-241-0/+30
| | | | | | | | | testRewind tests reading and writing after rewind on an encrypted stream; testWriteWriteRead tests r+ mode
* | | Merge pull request #15839 from owncloud/enc_fix_moving_shared_filesJoas Schilling2015-04-243-23/+272
|\ \ \ | | | | | | | | [encryption] fix moving files to a shared folder
| * | | Add test "operation on keys failed"Joas Schilling2015-04-241-7/+10
| | | |
| * | | Deduplicate data provider and fix method visibilityJoas Schilling2015-04-242-19/+15
| | | |
| * | | only update share keys if the file was encryptedBjoern Schiessle2015-04-241-2/+4
| | | |
| * | | update share keys if file gets copiedBjoern Schiessle2015-04-231-16/+67
| | | |
| * | | update share keys if a file is moved to a shared folderBjoern Schiessle2015-04-233-6/+203
| | |/ | |/|
* | | Merge pull request #15826 from owncloud/issue-15804-occ-user-delete-exceptionblizzz2015-04-232-0/+211
|\ \ \ | | | | | | | | Issue 15804 occ user delete exception
| * | | Fix file namesJoas Schilling2015-04-232-0/+0
| | | |
| * | | Add tests for occ user:lastseenJoas Schilling2015-04-231-0/+105
| | | |
| * | | Add unit tests for occ user:deleteJoas Schilling2015-04-231-0/+106
| |/ /
* / / Delete temp files after testing encryption stream wrapperVincent Petry2015-04-231-0/+6
|/ /
* | Merge pull request #15809 from owncloud/view-null-rootVincent Petry2015-04-221-2/+19
|\ \ | | | | | | dont allow using null as view root
| * | add unit tests for null handling in viewRobin Appelman2015-04-221-2/+19
| | |
* | | pass KeyStorage via ctorThomas Müller2015-04-221-26/+1
| | |
* | | calling renameKeys() on directory level as well - fixes #15778Thomas Müller2015-04-221-2/+15
| | |
* | | add $encryptionModuleId to methods of Keys/IStorageThomas Müller2015-04-222-15/+14
|/ /
* | Merge pull request #15757 from owncloud/enc-fixfeofforlastblockBjörn Schießle2015-04-223-6/+90
|\ \ | | | | | | Fix encryption feof to not return too early
| * | Fix encryption feof to not return too earlyVincent Petry2015-04-203-6/+90
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is because stream_read will pre-cache the next block which causes feof($this->source) to return true prematurely. So we cannot rely on it. Fixed encryption stream wrapper unit tests to actually simulate 6k/8k blocks to make sure we cover the matching logic. Added two data files with 8192 and 8193 bytes.
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-26 16:12:48 +0000