Added read and share permissions instead of all (default ones)
Added positive case
Check also permissions update
Added tests for resharing with public links when the user doesn't have enough permisssions
Local shares should only be scanned when doing it for the owner to
avoid repeatedly rescanning the same shared storage over and over again
for every recipient.
* Properly expire ext storage versions
System-wide external storages have no real owner so the current user is
used as owner. However when running cron.php there is no current user,
so no expiry can be done.
This fix adds an user argument to the expire() function to tell for
which user to expire files. This information is anyway always available
now through the expire command job.
* Move version expire setupFS into the expire function
* Add comment about not tearing down in version Storage::expire()
When creating link shares from external storage, the filesystem cannot
find an owner in some scenarios (ex: system-wide mounts). In such
cases, fall back to using the current user's trashbin which happens to
also be the user who created the link share.
Fixes an issue where this scenario made deletion impossible due to
missing user information.
This prevents a validation failure where the code checks whether a file
is already shared with another user, but the check disables itself when
the owner is the same. Processing the groups first prevents the check
to kick in too early when the group share still has the old owner while
we try transferring the user share.
When transferring ownership, only the local files will be transferred
during the rename operation. This means that the analyzing code doesn't
need to recurse into any mount points.
Furthermore this fixes issues where FailedStorage might appear as mount
points as a result of inaccessible external storages or shares. So this
makes it more robust.
Prevent newlines and zero byte chars to be used in files UI URL and
redirect to root if one is detected.
Added additional hardening in case the request fails with 400 or the
XMLHttpRequest throw a DOMException, both can happen with invalid paths
as well.
* Escape LIKE parameter
* Escape LIKE parameter
* Escape LIKE parameter
* Escape LIKE parameter
* Escape LIKE parameter
* Use correct method in the AbstractMapping class
* Change the getNamesBySearch method so that input can be properly escaped while still supporting matches
* Don't escape hardcoded wildcard
When unsharing from self in a group share situation, the share items
passed to the post_unshareFromSelf hook were using the wrong format in
which the attribute names (ex: "share_type") have non camel-case format.
This fix makes sure that in group sharing case we use the correct
format. It looks like the code was already producing it but in
array_merge it was not using it and adding the unprocessed one.
Because fetching the user information will also fetch the avatar, the
avatar code sets up the FS and leaves the mount points cached, we need
to call tearDownFS to clear that up.
The call to UserList.add() was wrong and was passing "user.lastLogin"
as the sort argument which would cause the list to be resorted over and
over again for every added item after loading the next page of users.
Because some cron jobs do not always properly clean up their FS usage
and others might not clean up before setting up the FS, this could
cause potential side effects.
To make sure we exclude side effects, we tear down the FS between cron
jobs.
* Password Update Notification
Added an IF ELSE statement to ensure that feedback is provided to the
user on successfully updating a user password in settings.
* Password Update Success Message
Updated the password update success message
Instead of pre-rendering all multiselects with lots of group entries,
the current groups are now displayed as simple labels.
Behind the labels there is a pencil icon like for other fields.
When clicking the pencil icon, the dropdown will be spawned and will
open itself.
Upon closing of the dropdown, the label comes back with the updated
selection and the dropdown is destroyed.
Connection checks will be done by using the configuration id, with the
stored password. LDAP password won't be sent to the client.
Conflicts:
apps/user_ldap/ajax/getConfiguration.php
apps/user_ldap/ajax/testConfiguration.php
Whenever a group share is created after a direct share, the stime order
needs to be properly considered in the repair routine, considering that
the direct user share is appended to the $subShares array and breaking
its order.
Pick the most recent subshare that has no parenthesis from duplication
which should match whichever name the user picked last. If all
subshares have duplicate parenthesis names, use the least recent group
share's target instead.
The repair step was a bit overeager to skip repairing so it missed the
case where a group share exists without subshares but with an
additional direct user share.
Added flag to enforce grouping of received shares even when the method
is called for a user different than the current one. This can happen at
sharing time whenever the recipient's FS is being setup from the
sharer's call.
This fixes duplicated received folders for new shares.
* Next step jenkinsfile (#25622)
* Adding timestamper and evaluation of test results even in case of failure
* Adding build timeout
* use fixed value 120 minutes as timeout for each test executing for now
* Terminate the build as soon as test execution fails
* Adjust external testing as well
* Finalize use of executeAndReport
* Fix discoverymanager tests (#25769)
* Allow testing of the DiscoveryManager
* Array sort order is of no relevance
See issue #25461.
When using a theme with alternative filetype icons `OCA.External.StatusManager.Utils.getIconRoute` should respect that, rather than hard coding the default icon.
Note this change does not affect windows_network_drive and sharepoint icons, which appear not to be easily themeable.
Whenever an LDAP user also has an email address defined in LDAP, the
LDAP code will try and update the email address of the locally known
user. This happens at login time or every time the user's LDAP
attributes are processed.
There is code listening to the email setting hook which updates the
system address book, which also will trigger FS setup due to avatars
and other things.
This fix only sets the email address when really necessary.
* Workaround to check htaccess in case of redirects
In some setups, the web server will redirect any call to "data/" to the
main page. This causes the XHR to return the 200 HTTP status code and
the body contains the HTML page of the main page / files app.
This fix improves the htaccess failure detection by adding a known
string inside the test file "htaccesstest.txt". If we are able to find
this string, it means that the web server didn't block access to that
file.
* Fix setup check unit test (#25439)
* Filelist change dir auto-prepend slash
Prepend a slash to directories in case it was missing since many places
assume that it's there.
* Fix js unit test in filelist spec
* Wait for socket to be open
* Fix call on null
* Allow DB access for MountProviderTest
Makes unit tests pass when using object store, since their FS access is
actually oc_filecache DB access. It is currently not possible to mock
or bypass the logic from "SharedMount::verifyMountPoint()" triggered by
this test.
Scenario:
user0 shares a folder 'foo' with user2
user1 shares a folder 'foo' with user2
user2 logs in
Before: show only the 'foo' from user1
After: show both.
* Added intergration tests
This moves registerMountProviders until after the sharing backends were
registered. In some situations registerMountProviders will trigger
listeners which might require filesystem access which itself would
mount shares, which itself requires the sharing backends to be
initialized.
A share can only be requested by 3 'types' of people
* owner
* initiator
* recipient
So we have to get the path as the current user. Since that is the only
path that has any meaning to the user.
- Fixed tests
* Fixed group share searching for members of
multiple group. Issue #11808.
* Fixed group share searching, continued.
Avoid searching for empty group list in getItemSharedWithUser().
Broke tests in previous commit, #12030.
* Simler check for group count.
* Fix for https://github.com/owncloud/core/issues/24783 , described there
* Now it's #24272, 24783 was a duplicate. Previous change was also not very good. Now we don't create ZIP with a single file inside.
For #24403
When upgrading huge installations this can lead to memory problems as
the cache will only grow and grow.
Capping this memory will make sure we don't run out while during normal
operation still basically cache everything.
getUserGroups:
Using $userDN instead of $uid to query LDAP
Converting groupDN to group name using API instead of substring
Removing cache processing at the end of the method
mb_detect_encoding is in the fallback we ship in the polyfill library, mb_strcut is not. Thus this lead to a false positive and ownCloud would just break.
the login password changed at the user back-end (e.g ldap). Such failures will
be handled after login correctly by allowing the user to adjust the passwords
Whenever part chunks are written, every fwrite in the write loop will
reset the mtime to the current mtime. Only at the end will the touch()
operation set the mtime to now + ttl, in the future.
However the GC code is expecting that every chunk with mtime < now are
old and must be deleted. This causes the GC to sometimes delete part
chunks in which the write loop is slow.
To fix this, a tolerance value is added in the GC code to allow for
more time before a part chunk gets deleted.
E-tag propagation replies on the mtime of the file. Order of events:
1. add file 'foo.txt' with content 'bar'
2. Set mtime to now() - 1
3. Check if etag changed.
Now this goes right often when 1 and 2 happen in the same second.
However imagine
1. add file 'foo.txt' with content 'bar' (at t=0.999)
2. Set mtime to now() - 1 (at t=1.001)
Now the mtime will be set to the same time. Thus not chaning the etag.
Currently testing the updates is a big problem and not really super easy possible. Since we now have a new updater server we should also make this configurable so that people can properly test updates.
The current logic for mod_rewrite relies on the fact that people have properly configured ownCloud, basically it reads from the `overwrite.cli.ur
l` entry and then derives the `RewriteBase` from it.
This usually works. However, since the ownCloud packages seem to install themselves at `/owncloud` (because subfolders are cool or so…) _a lot_ of people have just created a new Virtual Host for it or have simply symlinked the path etc.
This means that `overwrite.cli.url` is wrong, which fails hard if it is used as RewriteBase since Apache does not know where it should serve files from. In the end the ownCloud instance will not be accessible anymore and users will be frustrated. Also some shared hosters like 1&1 (because using shared hosters is so awesome… ;-)) have somewhat dubious Apache configurations or use versions of mod_rewrite from the mediveal age. (because updating is money or so…)
Anyhow. This makes this explicitly an opt-in configuration flag. If `htaccess.RewriteBase` is set then it will configure index.php-less URLs, if
admins set that after installation and don't want to wait until the next ownCloud version they can run `occ maintenance:update:htaccess`.
For ownCloud 9.0 we also have to add a repair step to make sure that instances that already have a RewriteBase configured continue to use it by copying it into the config file. That way all existing URLs stay valid. That one is not in this PR since this is unneccessary in master.
Effectively this reduces another risk of breakage when updating from ownCloud 8 to ownCloud 9.
Fixes https://github.com/owncloud/core/issues/24525, https://github.com/owncloud/core/issues/24426 and probably some more.
When moving files via WebDAV I sometimes got
PHP Fatal error: Nesting level too deep - recursive dependency? in /var/www/owncloud/lib/private/files/view.php on line 729
This small change has fixed the problem for me
The login process needs to be completed before we can safely create
the users home folder. For example we need to give encryption a chance
to initialize the users encryption keys in order to copy the skeleton
files correctly
When running with a user database backend on large installations the
cache can grow to significant sizes. This can be especially problematic
when running big cron/repair jobs.
The previous logic did not necessarily trigger in every case. This logic is more error-resistant, the autoload_classmap.php file has a guaranteed different hash on 9.0.0, 9.0.1 and 9.0.2
Fixes https://github.com/owncloud/updater/issues/342
jquery.fileupload offers the [`pastezone`](https://github.com/blueimp/jQuery-File-Upload/wiki/Options#pastezone) functionality. This functionality is enabled by default and if somebody copy-pastes something into Chrome it will automatically trigger an upload of the content to any configured jquery.fileupload element embedded in the JS.
This implementation triggers some problems:
1. The pastezone is defined globally by default (🙈). So if there are multiple fileupload's on a page (such as in the personal settings) then stuff is going to be uploaded to all embedded uploads.
2. Our server code is not able to parse the data. For example for uploads in the files app we expect a file name which is not specified => Just an error is thrown. You can reproduce this by taking a file into your clipboard and in Chrome then pressing <kbd>CTRL + V</kbd>.
3. When copy-pasting some string from MS Office on the personal page a temporary avatar with said content is created.
Considering that this is anyways was never working at all and causes bugs I've set the `pastezone` to `null`. This mens that upload via copy and paste will be disabled.
Lesson learned: Third-party JS libraries can have some weird details.
* getFromCache is wrapped in isCached
* inbetween the two calls the cache entry hits it's TTL
* getFromCache returns null
* this fix only checkes if the returned value is null and
return only non-null values
For one, it solves potential conflicts when using the resource. For the
other, one on the login check (the only place where a clone happens
currently) we do not need to rebind after confirming the user's login
was successful.
In theory, if your instance ever creates more jobs then your system cron can
handle, the default background jobs get never executed anymore. Because
everytime when the joblist returns the next job it looks for the next ID,
however there is always a new next ID, so it will never wrap back to execute
the low IDs. But when we change the sort order to be DESC, we make sure that
these low IDs are always executed, before the system jumps back up to
execute the new IDs.
In some scenarios initMountPoints is called with an empty user, and
also there is no user in the session.
In such cases, it is unsafe to let the code move on with an empty user.
The new updater as shipped with ownCloud 9.0.x invokes `occ` via `shell_exec`. This means that the `\OC::$CLI` code is used when updating.
This removes the manual `.htaccess` modifications, effectively leading to the fact that URLs without index.php in it stop working. This also affects share URLs which could be considered a rather serious regression.
- User installs 9.0.0 via web
- User shares /s/1234
- User updates to 9.0.1 via ownCloud updater
- Link to /s/1234 is broken, /index.php/s/1234 works
The updater as shipped with ownCloud =< 9.0.1 has several bugs leading to a not properly executed update. For example the third-party changes are not copied.
This pull request:
1. Ships the third-party files changed since ownCloud 9.0.1 in the resources folder. On update the files are replaced. (https://github.com/owncloud/updater/issues/316)
2. Adds updater/* and _oc_upgrade/* as an exemption to the code integrity checker since the updater is updating in the wrong order. (https://github.com/owncloud/updater/issues/318)
Fixes#24032
Since we have a slightly different UI for the federated shares our
normal logic fails us. This makes sure to add the correct permissions
when it is a federated share.
Composer 1.1 has since yesterday a new performance improvement that will be automatically used for PHP >= 5.6, however this file is incompatible with older PHP versions and thus we need to exclude it from the checks.
Note that this performance improvement is only used on >= 5.6 so ownCloud will still run fine on older PHP versions as well.
This is ugly as hell. But if we directly access `\OCP\IUserSession::getUser` here PHP throws a segfault on some servers:
```
gdb /usr/sbin/apache2 --batch --quiet -ex "run -f /etc/apache2/apache2.conf -DNO_DETACH -DONE_PROCESS -DDEBUG $defines" -ex "quit"
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 172.17.0.6. Set the 'ServerName' directive globally to suppress this message
warning: the debug information found in "/usr/lib/debug//usr/lib/php5/20121212/mysql.so" does not match "/usr/lib/php5/20121212/mysql.so" (CRC mismatch).
warning: the debug information found in "/usr/lib/debug/usr/lib/php5/20121212/mysql.so" does not match "/usr/lib/php5/20121212/mysql.so" (CRC mismatch).
warning: the debug information found in "/usr/lib/debug//usr/lib/php5/20121212/mysqli.so" does not match "/usr/lib/php5/20121212/mysqli.so" (CRC mismatch).
warning: the debug information found in "/usr/lib/debug/usr/lib/php5/20121212/mysqli.so" does not match "/usr/lib/php5/20121212/mysqli.so" (CRC mismatch).
warning: the debug information found in "/usr/lib/debug//usr/lib/php5/20121212/pdo_mysql.so" does not match "/usr/lib/php5/20121212/pdo_mysql.so" (CRC mismatch).
warning: the debug information found in "/usr/lib/debug/usr/lib/php5/20121212/pdo_mysql.so" does not match "/usr/lib/php5/20121212/pdo_mysql.so" (CRC mismatch).
[New Thread 0x7fffdd206700 (LWP 28386)]
[Thread 0x7fffdd206700 (LWP 28386) exited]
[New Thread 0x7fffdd206700 (LWP 28387)]
[New Thread 0x7fffdc975700 (LWP 28388)]
Program received signal SIGSEGV, Segmentation fault.
zend_parse_parameters (num_args=2, type_spec=type_spec@entry=0x7ffff3f85227 "s|s") at /build/php5-pO28mL/php5-5.5.9+dfsg/Zend/zend_API.c:923
923 /build/php5-pO28mL/php5-5.5.9+dfsg/Zend/zend_API.c: No such file or directory.
A debugging session is active.
Inferior 1 [process 28382] will be killed.
Quit anyway? (y or n) [answered Y; input not from terminal]
```
I'm still struggling to get a minimal example of this (also considering that it doesn't happen on every system :party). Anyways, it's a functional workaround until I determined the root cause… (also given the fact that patches may never be backported to distributions 🙈
* Read available l10n files also from theme folder
The old behaviour was that only languages could be used for an app
that are already present in the apps/$app/l10n folder. If there is
a themed l10n that is not present in the apps default l10n folder
the language could not be used and the texts are not translated.
With this change this is possible and also the l10n files are
loaded even if the default l10n doesn't contain the l10n file.
* Inject server root - allows proper testing and separation of concerns
Whenever a user navigates away, all ajax calls will fail with the same
result like a cross-domain redirect (SSO). To distinguish these cases,
we need to detect whether the error is a result of the user navigating
away. For this, we introduce a new flag that will be set in
"beforeunload".
Additional handling was required for false positives in case "beforeunload" is
used (ex: cancelled upload) and the user cancelled the navigation.
in order to create a 1:1 copy of a file if a version gets created
we need to store this information on copyBetweenStorage(). This
allows us to by-pass the encryption wrapper if we read the source file.
The code path called when using external storage with WebDAV is using `\OC\Files\Storage\Wrapper\Encryption::getMetaData` which did not contain the actual encrypted version inside the cache entry version. This lead to the following:
1. User uploaded a file
2. File is created and `\OC\Files\Storage\Wrapper\Encryption::getMetaData` is called. It has an empty `encryptedVersion` but sets `encrypted` to either `true` or `false`.
3. The call when updating the file cache will use the old version.
The one we ship may cause problems since Equifax is not included anymore (SHA-1 certs) are deprecated. We should just be consistent here and also use the certificate file which is used by the other calls in the library.
Fixes#23536
The new sharing code is much stricter in checking permissions. However
for non moveable mounts the permissions UPDATE+DELETE are not reported
on the mount point.
This is just a quick fix.
* Updated unit tests
There are authentication backends such as Shibboleth that do send no Basic Auth credentials for DAV requests. This means that the ownCloud DAV backend would consider these requests coming from an untrusted source and require higher levels of security checks. (e.g. a CSRF check)
While an elegant solution would rely on authenticating via token (so that one can properly ensure that the request came indeed from a trusted client) this is a okay'ish workaround for this problem until we have something more reliable in the authentication code.
Since the library can only store the full response in memory on
download, we use an alternate client lib and set the correct headers to
be able to stream the content to a temp file.
When installing ownCloud with autotest and MySQL some log entries may be created which will invoke the logging class. IUserSession has a dependency on the database which will make the installation fail => 💣
- removed leading spaces before markup which can affect rendering in
some cases
- added shareOption CSS class to group and keep share option checkbox +
label
- moved ".showCruds" arrow into the matching shareOption to keep the
arrow together with the checkbox
Intergration tests to ensure the share-types property is set correctly.
* Unshared item
* Shared with user
* Shared with group
* Shared by link
* Shared with user & group & link
PATH_INFO will be empty at this point and thus the logic in base.php did not catch this. Changing this to "getRawPathInfo" will ensure that the path info is properly read.
Fixes https://github.com/owncloud/core/issues/23199
The ownCloud update routine also runs the "updateHtaccess" code in case only an application gets updated. This leads to having entries multiple time in the .htaccess file leading to unpredictable behaviour.
With 9.0 we added the "#### DO NOT CHANGE ANYTHING ABOVE THIS LINE ####" entry to the .htaccess file, this change uses it to ensure that only to the .htaccess gets written if the file has not been modified already. Since the .htaccess modifications are optional this is not a big deal.
Without this change updates of applications can break the rewrite rules (ending in endless redirects) as well as breaking the code integrity checker.
Fixes#23325
It can happen that a user shares a folder with public upload. And some
time later the admin disables public upload on the server.
To make sure this is handled correctly we need to check the config value
and reduce the permissions.
Fix is kept small to be easy backportable.
A PreconditionNotMetException must only be thrown if explicit
preconditions are specified for setValues(), not if the value is merely
the same as was already in the DB.
In case of a move operation from an unencrypted to an encrypted
storage the old encrypted version would stay with "0" while the
correct value would be "1". Thus we manually set the value to "1"
for those cases.
See also https://github.com/owncloud/core/issues/23078
**Before:**
> Your PHP version (5.4.16) is no longer supported by PHP. We encourage you to upgrade your PHP version to take advantage of performance and security updates provided by PHP.
**After:**
> You are currently running PHP 5.4.0. We encourage you to upgrade your PHP version to take advantage of performance and security updates provided by the PHP Group as soon as your distribution supports it.
Fixes https://github.com/owncloud/enterprise/issues/1170
The setup uses `\OCP\IRequest::getInsecureServerHost` which in some cases can also include a port. This makes the trusted domain check fail thus.
I've decided to add this here that way because adjusting the setup would require parsing the host properly. This is not something that can be done very good in PHP. Check the following example for why `parse_url` is not our friend: https://3v4l.org/k501Z
In the case of shared files, we have to call free_space() on the file
name. This has the side-effect that when uploading to a local storage
without quota set, it will call disk_free_space with the file name,
which fails.
This fix uses the parent folder in case the given path is a file.
The SabreDAV release in 9.0 requires XMLReader, while this is usually compiled in by default some distributions like Gentoo don't.
Without this ownCloud gives a fatal 500 error instead of telling people to enable XMLReader.
Fixes https://github.com/owncloud/core/issues/23003
Fixes#22601
Before we did a full test on all chunks to verify if a chunked upload
was completed. This is unneeded since if we are missing one chunk we can
already fail.
Also we look from back to front since it is much more likely that we
find a missing chunk thus can error out early.
If the check is negative it would depending on the used cache store the value as an empty string. When reading the value this check would thus return "false" even if a value exists.
When download a public link share folder using the button on the top
right, it doesn't provide a list of files.
This fix makes sure to trigger the correct logic when no file list was
given.
A federated share can report unlimited quota as -3, so the
ajax/upload.php code needs to be adjusted to block uploads when the free
space is unlimited.
TEXT defaults to a length of 255 which is going to fail in some cases as the timezone can be rather long.
This changes it back to a CLOB as it has been before as well: owncloudarchive/calendar@8d8bb68. I'm not super convinced that CLOB is the best choice here but at least it seems to work.
Fixes#22876
Backport of https://github.com/owncloud/core/pull/22878 to stable9
* fixes#22819
The old way fired a DELETE statement on each destruction of the
DBLockingProvider. Which could cause a lot of queries. It's enough
to run this every 5 minutes in a background job, which in the end
could result in file locks that exists 5 minutes longer - in the
worst case and for not properly released locks.
This makes the DB based locking a lot more performant and could
result in a similar performance to the Redis based locking provider.
When calling `\OC\Files\View::copy` we should also keep the version to ensure that the file will always have the correct version attached and can be successfully decrypted.
To test this the following steps are necessary (from https://github.com/owncloud/core/issues/22781#issuecomment-191328982):
1. setup a new ownCloud 9.0 beta2
2. enable encryption
2. upload a docx (5.7MB large)
3. upload the same file again and overwrite the existing file
4. I can download the original file and the first version
5. I restore the first version
6. restored version can no longer be downloaded with the error described above
The manual cache operation in `\OCA\Files_Versions\Storage` is unfortunately necessary since `\OCA\Files_Versions\Storage::copyFileContents` is not using `\OCP\Files\Storage::moveFromStorage` in the case when an object storage is used. Due to the workaround added in https://github.com/owncloud/core/commit/54cea05271b887f1c8062c034741df869bc0f055 the stream is directly copied and thus bypassing the FS.
If you have questions about how to install or use Nextcloud, please direct these to our [forum][forum]. We are also available on [IRC][irc].
### Short version
* The [**issue templates can be found here**][templates] but be aware of the different repositories! See list below. Please always use an issue template when reporting issues.
### Guidelines
* Please search the existing issues first, it's likely that your issue was already reported or even fixed.
- Go to one of the repositories, click "issues" and type any word in the top search/command bar.
- You can also filter by appending e. g. "state:open" to the search string.
- More info on [search syntax within github](https://help.github.com/articles/searching-issues)
* This repository ([server](https://github.com/nextcloud/server/issues)) is *only* for issues within the Nextcloud Server code. This also includes the apps: files, encryption, external storage, sharing, deleted files, versions, LDAP, and WebDAV Auth
* __SECURITY__: Report any potential security bug to us via [our HackerOne page](https://hackerone.com/nextcloud) following our [security policy](https://nextcloud.com/security/) instead of filing an issue in our bug tracker.
* The issues in other components should be reported in their respective repositories: You will find them in our [GitHub Organization](https://github.com/nextcloud/)
* Report the issue using one of our [templates][templates], they include all the information we need to track down the issue.
Help us to maximize the effort we can spend fixing issues and adding new features, by not reporting duplicate issues.
Thanks for wanting to contribute source code to Nextcloud. That's great!
Please read the [Developer Manuals][devmanual] to learn how to create your first application or how to test the Nextcloud code with PHPUnit.
### Tests
In order to constantly increase the quality of our software we can no longer accept pull request which submit un-tested code.
It is a must have that changed and added code segments are unit tested.
In some areas unit testing is hard (aka almost impossible) as of today - in these areas refactoring WHILE fixing a bug is encouraged to enable unit testing.
### Sign your work
We use the Developer Certificate of Origin (DCO) as a additional safeguard
for the Nextcloud project. This is a well established and widely used
mechanism to assure contributors have confirmed their right to license
Note: This is the **issue tracker of Nextcloud**, please do NOT use this to get answers to your questions or get help for fixing your installation. This is a place to report bugs to developers, after your server has been debugged. You can find help debugging your system on our home user forums: https://help.nextcloud.com or, if you use Nextcloud in a large organization, ask our engineers on https://portal.nextcloud.com. See also https://nextcloud.com/support for support options.
Nextcloud is an open source project backed by Nextcloud GmbH. Most of our volunteers are home users and thus primarily care about issues that affect home users. Our paid engineers prioritize issues of our customers. If you are neither a home user nor a customer, consider paying somebody to fix your issue, do it yourself or become a customer.
Guidelines for submitting issues:
* Please search the existing issues first, it's likely that your issue was already reported or even fixed.
- Go to https://github.com/nextcloud and type any word in the top search/command bar. You probably see something like "We couldn’t find any repositories matching ..." then click "Issues" in the left navigation.
- You can also filter by appending e. g. "state:open" to the search string.
- More info on search syntax within github: https://help.github.com/articles/searching-issues
* This repository https://github.com/nextcloud/server/issues is *only* for issues within the Nextcloud Server code. This also includes the apps: files, encryption, external storage, sharing, deleted files, versions, LDAP, and WebDAV Auth
* SECURITY: Report any potential security bug to us via our HackerOne page (https://hackerone.com/nextcloud) following our security policy (https://nextcloud.com/security/) instead of filing an issue in our bug tracker.
* The issues in other components should be reported in their respective repositories: You will find them in our GitHub Organization (https://github.com/nextcloud/)
* You can also use the Issue Template app to prefill most of the required information: https://apps.nextcloud.com/apps/issuetemplate
-->
<!--- Please keep this note for other contributors -->
### How to use GitHub
* Please use the 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to show that you are affected by the same issue.
* Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
* Subscribe to receive notifications on status change and new comments.
### Steps to reproduce
1.
2.
3.
### Expected behaviour
Tell us what should happen
### Actual behaviour
Tell us what happens instead
### Server configuration
**Operating system:**
**Web server:**
**Database:**
**PHP version:**
**Nextcloud version:** (see Nextcloud admin page)
**Updated from an older Nextcloud/ownCloud or fresh install:**
**Where did you install Nextcloud from:**
**Signing status:**
<details>
<summary>Signing status</summary>
```
Login as admin user into your Nextcloud and access
Note: This is the **issue tracker of Nextcloud**, please do NOT use this to get answers to your questions or get help for fixing your installation. This is a place to report bugs to developers, after your server has been debugged. You can find help debugging your system on our home user forums: https://help.nextcloud.com or, if you use Nextcloud in a large organization, ask our engineers on https://portal.nextcloud.com. See also https://nextcloud.com/support for support options.
Nextcloud is an open source project backed by Nextcloud GmbH. Most of our volunteers are home users and thus primarily care about issues that affect home users. Our paid engineers prioritize issues of our customers. If you are neither a home user nor a customer, consider paying somebody to fix your issue, do it yourself or become a customer.
Guidelines for submitting issues:
* Please search the existing issues first, it's likely that your issue was already reported or even fixed.
- Go to https://github.com/nextcloud and type any word in the top search/command bar. You probably see something like "We couldn’t find any repositories matching ..." then click "Issues" in the left navigation.
- You can also filter by appending e. g. "state:open" to the search string.
- More info on search syntax within github: https://help.github.com/articles/searching-issues
* This repository https://github.com/nextcloud/server/issues is *only* for issues within the Nextcloud Server code. This also includes the apps: files, encryption, external storage, sharing, deleted files, versions, LDAP, and WebDAV Auth
* SECURITY: Report any potential security bug to us via our HackerOne page (https://hackerone.com/nextcloud) following our security policy (https://nextcloud.com/security/) instead of filing an issue in our bug tracker.
* The issues in other components should be reported in their respective repositories: You will find them in our GitHub Organization (https://github.com/nextcloud/)
-->
<!--- Please keep this note for other contributors -->
### How to use GitHub
* Please use the 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to show that you are interested into the same feature.
* Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
* Subscribe to receive notifications on status change and new comments.
**Is your feature request related to a problem? Please describe.**
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
**Describe the solution you'd like**
A clear and concise description of what you want to happen.
**Describe alternatives you've considered**
A clear and concise description of any alternative solutions or features you've considered.
**Additional context**
Add any other context or screenshots about the feature request here.
Thanks for your first pull request and welcome to the community!
Feel free to keep them coming! If you are looking for issues to tackle then have a look at this selection: https://github.com/nextcloud/server/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22
In the Nextcloud community, participants from all over the world come together to create Free Software for a free internet. This is made possible by the support, hard work and enthusiasm of thousands of people, including those who create and use Nextcloud software.
Our code of conduct offers some guidance to ensure Nextcloud participants can cooperate effectively in a positive and inspiring atmosphere, and to explain how together we can strengthen and support each other.
The Code of Conduct is shared by all contributors and users who engage with the Nextcloud team and its community services. It presents a summary of the shared values and “common sense” thinking in our community.
You can find our full code of conduct on our website: https://nextcloud.com/code-of-conduct/
Please, keep our CoC in mind when you contribute! That way, everyone can be a part of our community in a productive, positive, creative and fun way.
If you have questions about how to install or use ownCloud, please direct these to the [mailing list][mailinglist] or our [forum][forum]. We are also available on [IRC][irc].
### Short version
* The [**issue template can be found here**][template] but be aware of the different repositories! See list below. Please always use the issue template when reporting issues.
### Guidelines
* Please search the existing issues first, it's likely that your issue was already reported or even fixed.
- Go to one of the repositories, click "issues" and type any word in the top search/command bar.
- You can also filter by appending e. g. "state:open" to the search string.
- More info on [search syntax within github](https://help.github.com/articles/searching-issues)
* This repository ([core](https://github.com/owncloud/core/issues)) is *only* for issues within the ownCloud core code. This also includes the apps: files, encryption, external storage, sharing, deleted files, versions, LDAP, and WebDAV Auth
* __SECURITY__: Report any potential security bug to us via [our HackerOne page](https://hackerone.com/owncloud) or security@owncloud.com following our [security policy](https://owncloud.org/security/) instead of filing an issue in our bug tracker
* The issues in other components should be reported in their respective repositories:
Thanks for wanting to contribute source code to ownCloud. That's great!
Before we're able to merge your code into the ownCloud core, you need to sign our [Contributor Agreement][agreement].
Please read the [Developer Manuals][devmanual] to learn how to create your first application or how to test the ownCloud code with PHPUnit.
In order to constantly increase the quality of our software we can no longer accept pull request which submit un-tested code.
It is a must have that changed and added code segments are unit tested.
In some areas unit testing is hard (aka almost impossible) as of today - in these areas refactoring WHILE fixing a bug is encouraged to enable unit testing.
* 📁 **Access your Data** You can store your files, contacts, calendars and more on a server of your choosing.
*🔄 **Sync your Data** You keep your files, contacts, calendars and more synchronized amongst your devices.
*🙌**Share your Data**…by giving others access to the stuff you want them to see or to collaborate with.
*🚀 **Expandable with hundreds of Apps** ...like [Calendar](https://github.com/nextcloud/calendar), [Contacts](https://github.com/nextcloud/contacts), [Mail](https://github.com/nextcloud/mail), [Video Chat](https://github.com/nextcloud/spreed) and all those you can discover in our [App Store](https://apps.nextcloud.com)
*🔒 **Security** with our encryption mechanisms, [HackerOne bounty program](https://hackerone.com/nextcloud) and two-factor authentication.
## Why is this so awesome?
*:file_folder: **Access your Data** You can store your files, contacts, calendars and more on a server of your choosing.
*:package:**Sync your Data**You keep your files, contacts, calendars and more synchronized amongst your devices.
*:arrows_counterclockwise: **Share your Data** You share your data with others, and give them access to your latest photo galleries, your calendar or anything else you want them to see.
*:rocket: **Expandable with dozens of Apps** ...like Calendar, Contacts, Mail or News.
* :cloud: **All Benefits of the Cloud** ...on your own Server.
* :lock: **Encryption** You can encrypt data in transit with secure https connections. You can enable the encryption app to encrypt data on storage for improved security and privacy.
* ...
You want to learn more about how you can use Nextcloud to access, share and protect your files, calendars, contacts, communication & more at home and at your organization? [**Learn about all our Features**](https://nextcloud.com/athome/).
- ☑️ [**Simply sign up**](https://nextcloud.com/signup/) at one of our providers either through our website or through the apps directly.
- 🖥 [**Install** a server by yourself](https://nextcloud.com/install/#instructions-server) on your own hardware or by using one of our ready to use **appliances**
- 📦 Buy one of the [awesome **devices** coming with a preinstalled Nextcloud](https://nextcloud.com/devices/)
- 🏢 Find a [service **provider**](https://nextcloud.com/providers/) who hosts Nextcloud for you or your company
## Support
Learn about the different ways you can get support for ownCloud: https://owncloud.org/support/
Enterprise? Public Sector or Education user? You may want to have a look into [**Nextcloud Enterprise**](https://nextcloud.com/enterprise/) provided by Nextcloud GmbH.
You can also [get support for Nextcloud](https://nextcloud.com/support)!
## Join the team 👪
There are many ways to contribute, of which development is only one! Find out [how to get involved](https://nextcloud.com/contribute/), including as translator, designer, tester, helping others and much more! 😍
### Development setup 👩💻
1. 🚀 [Set up your local development environment](https://docs.nextcloud.com/server/latest/developer_manual/getting_started/devenv.html)
2. 🐛 [Pick a good first issue](https://github.com/nextcloud/server/labels/good%20first%20issue)
3. 👩🔧 Create a branch and make your changes. Remember to sign off your commits using `git commit -sm "Your commit message"`
4. ⬆ Create a [pull request](https://opensource.guide/how-to-contribute/#opening-a-pull-request) and `@mention` the people from the issue to review
5. 👍 Fix things that come up during review
6. 🎉 Wait for it to get merged!
Third-party components are handled as git submodules which have to be initialized first. So aside from the regular git checkout invoking `git submodule update --init` or a similar command is needed, for details see Git documentation.
Several apps that are included by default in regular releases such as [First run wizard](https://github.com/nextcloud/firstrunwizard) or [Activity](https://github.com/nextcloud/activity) are missing in `master` and have to be installed manually by cloning them into the `apps` subfolder.
Otherwise, git checkouts can be handled the same as release archives, by using the `stable*` branches. Note they should never be used on production systems.
### Working with front-end code 🏗
#### Building
We are moving more and more towards using Vue.js in the frontend, starting with Settings. For building the code on changes, use these terminal commands in the root folder:
```bash
# install dependencies
make dev-setup
# build for development
make build-js
# build for development and watch edits
make watch-js
# build for production with minification
make build-js-production
```
#### Committing changes
**When making changes, also commit the compiled files!**
We still use Handlebars templates some places in Files and Settings. We will replace these step-by-step with Vue.js, but in the meantime you need to compile them separately.
If you don’t have Handlebars installed yet, you can do it with this terminal command:
```bash
sudo npm install -g handlebars
```
Then inside the root folder of your local Nextcloud development installation, run this command in the terminal every time you changed a `.handlebars` file to compile it:
```bash
./build/compile-handlebars-templates.sh
```
Before checking in JS changes, make sure to also build for production:
```bash
make build-js-production
```
Then add the compiled files for committing.
To save some time, to only rebuild for a specific app, use the following and replace the module with the app name:
```bash
MODULE=user_status make build-js-production
```
Please note that if you used `make build-js` or `make watch-js` before, you'll notice that a lot of files were marked as changed, so might need to clear the workspace first.
### Working with back-end code 🏗
When changing back-end PHP code, in general no additional steps are needed before checking in.
However, if new files were created, you will need to run the following command to update the autoloader files:
```bash
build/autoloaderchecker.sh
```
After that, please also include the autoloader file changes in your commits.
### Tools we use 🛠
- [👀 BrowserStack](https://browserstack.com) for cross-browser testing
- [🌊 WAVE](https://wave.webaim.org/extension/) for accessibility testing
- [🚨 Lighthouse](https://developers.google.com/web/tools/lighthouse/) for testing of performance, accessibility and more
## Contribution guidelines 📜
All contributions to this repository from June, 16 2016 on are considered to be
licensed under the AGPLv3 or any later version.
Nextcloud doesn't require a CLA (Contributor License Agreement).
The copyright belongs to all the individual contributors. Therefore we recommend
that every contributor adds following line to the header of a file, if they
Please read the [Code of Conduct](https://nextcloud.com/community/code-of-conduct/). This document offers some guidance to ensure Nextcloud participants can cooperate effectively in a positive and inspiring atmosphere, and to explain how together we can strengthen and support each other.
Please review the [guidelines for contributing](.github/CONTRIBUTING.md) to this repository.
More information how to contribute: [https://nextcloud.com/contribute/](https://nextcloud.com/contribute/)
thrownew\OutOfBoundsException('Package "'.$packageName.'" is not installed');
}
/**
* @param string $packageName
* @return string|null If the package is being replaced or provided but is not really installed, null will be returned as version, use satisfies or getVersionRanges if you need to know if a given version is present
thrownew\OutOfBoundsException('Package "'.$packageName.'" is not installed');
}
/**
* @param string $packageName
* @return string|null If the package is being replaced or provided but is not really installed, null will be returned as version, use satisfies or getVersionRanges if you need to know if a given version is present
thrownew\OutOfBoundsException('Package "'.$packageName.'" is not installed');
}
/**
* @param string $packageName
* @return string|null If the package is being replaced or provided but is not really installed, null will be returned as install path. Packages of type metapackages also have a null install path.
* Returns the raw installed.php data for custom implementations
*
* @deprecated Use getAllRawData() instead which returns all datasets for all autoloaders present in the process. getRawData only returns the first dataset loaded, which may not be what you expect.
@trigger_error('getRawData only returns the first dataset loaded, which may not be what you expect. Use getAllRawData() instead which returns all datasets for all autoloaders present in the process.',E_USER_DEPRECATED);
if(null===self::$installed){
// only require the installed.php file if this file is loaded from its dumped location,
// and not from its source location in the composer/composer package, see https://github.com/composer/composer/issues/9937
if(substr(__DIR__,-8,1)!=='C'){
self::$installed=include__DIR__.'/installed.php';
}else{
self::$installed=array();
}
}
returnself::$installed;
}
/**
* Returns the raw data of all installed.php which are currently loaded for custom implementations
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.