- Dec 02, 2015
-
-
Thomas Müller authored
Check the expiration date for null
-
Jenkins for ownCloud authored
-
Roeland Jago Douma authored
DI in avatar code
-
- Dec 01, 2015
-
-
Roeland Jago Douma authored
* DI in avatar code * Use the node API * More unit tests * Unit tests no longer require DB
-
Morris Jobke authored
* null is always less than any value -> expirationDate gets null which is "no date set" * ref https://github.com/owncloud/core/issues/20590#issuecomment-158393075
-
Lukas Reschke authored
Support pretty URLs
-
Lukas Reschke authored
This changeset allows ownCloud to run with pretty URLs, they will be used if mod_rewrite and mod_env are available. This means basically that the `index.php` in the URL is not shown to the user anymore. Also the not deprecated functions to generate URLs have been modified to support this behaviour, old functions such as `filePath` will still behave as before for compatibility reasons. Examples: http://localhost/owncloud/index.php/s/AIDyKbxiRZWAAjP => http://localhost/owncloud/s/AIDyKbxiRZWAAjP http://localhost/owncloud/index.php/apps/files/ => http://localhost/owncloud/apps/files/ Due to the way our CSS and JS is structured the .htaccess uses some hacks for the final result but could be worse... And I was just annoyed by all that users crying for the removal of `index.php` ;-)
-
Thomas Müller authored
Add code integrity checker foundation
-
Thomas Müller authored
Add command to get and set config for external mounts
-
Thomas Müller authored
Revert "Fix column width of mtime column"
-
Thomas Müller authored
Fix the docs of the exceptions and remove hardcoded language from the…
-
Robin Appelman authored
-
Robin Appelman authored
-
Robin Appelman authored
-
Morris Jobke authored
-
Thomas Müller authored
Make autotest.sh able to output proper coverage again
-
Joas Schilling authored
-
Roeland Jago Douma authored
The usage of single quotes make sure that a string is used verbatim in bash. And no variables are subsituted.
-
Lukas Reschke authored
This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository. Furthermore, there is a basic implementation to display problems with the code integrity on the update screen. Code signing basically happens the following way: - There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release
😉 ). This certificate is not intended to be used for signing directly and only is used to sign new certificates. - Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`, apps need to be signed with a certificate that either has a CN of `core` (shipped apps!) or the AppID. - The command generates a signature.json file of the following format: ```json { "hashes": { "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d", "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9" }, "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----", "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl" } ``` `hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`. Steps to do in other PRs, this is already a quite huge one: - Add nag screen in case the code check fails to ensure that administrators are aware of this. - Add code verification also to OCC upgrade and unify display code more. - Add enforced code verification to apps shipped from the appstore with a level of "official" - Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release - Add some developer documentation on how devs can request their own certificate - Check when installing ownCloud - Add support for CRLs to allow revoking certificates **Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature: ``` ➜ master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt Successfully signed "core" ``` Then increase the version and you should see something like the following:  As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen. For packaging stable releases this requires the following additional steps as a last action before zipping: 1. Run `./occ integrity:sign-core` once 2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder. -
Thomas Müller authored
tail the server log and exit with the exit code of behat
-
Thomas Müller authored
Use .text instead of .html
-
Thomas Müller authored
[3rdparty] Bump php-parser
-
Thomas Müller authored
-
Thomas Müller authored
Scrutinizer Auto-Fixes
-
Roeland Jago Douma authored
-
Thomas Müller authored
[3rdparty] Remove some unrequired files
-
Lukas Reschke authored
-
Jenkins for ownCloud authored
-
- Nov 30, 2015
-
-
Lukas Reschke authored
Makes some static source code analyzers happier.
-
Thomas Müller authored
Sharing integration test 20645, added sabre dav and propfind check.
-
Thomas Müller authored
-
Scrutinizer Auto-Fixer authored
This commit consists of patches automatically generated for this project on https://scrutinizer-ci.com
-
Thomas Müller authored
Fix column width of mtime column
-
Thomas Müller authored
[3rdparty] bump jeremeamia/superclosure to 2.1.0
-
Thomas Müller authored
Fix already defined warning from dav test bootstrap
-
Thomas Müller authored
Allow DI the system tag stuff without Application class
-
Thomas Müller authored
Activity oracle sql error for favorites
-
Thomas Müller authored
Update some JS dependencies
-
Thomas Müller authored
Fix the width of the share with input
-
Thomas Müller authored
Use XMLWriter to generate response
-