nextcloud-server

Tree: b87e5a0f2e

Author	SHA1	Message	Date
Morris Jobke	0eebff152a	Update license headers Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Roeland Jago Douma	5f227bd93b	More phpstorm inspection fixes Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Joas Schilling	0215b004da	Update with robin	9 years ago
Joas Schilling	ba87db3fcc	Fix others	9 years ago
Lukas Reschke	aba539703c	Update license headers	10 years ago
Roeland Jago Douma	f52c5b31b6	Move more from \OC to PSR-4 * \OC\OCSClient * \OC\Preview * \OC\PreviewManager * \OC\Repair * \OC\RepairException * \OC\Search * \OC\ServerContainer * \OC\ServerNotAvailableException * \OC\ServiceUnavailableException * \OC\Setup * \OC\Streamer * \OC\SubAdmin * \OC\SystemConfig * \OC\TagManager * \OC\Tags * \OC\TempManager * \OC\TemplateLayout * \OC\URLGenerator * \OC\Updater	10 years ago
Stefan Weil	b1a856d7b7	lib: Fix typos (found by codespell) Signed-off-by: Stefan Weil <sw@weilnetz.de>	10 years ago
Lukas Reschke	933f60e314	Update author information Probably nice for the people that contributed to 9.0 to see themselves in the AUTHORS file :)	10 years ago
Thomas Müller	682821c71e	Happy new year!	10 years ago
Lars	3a5087ccdf	tempnam accepts a directory as its first parameter, not a full path and filename. tempnam falls back to creating a file in the system's temp directory. On systems with open_basedir restrictions, this may trigger an error message. By moving this below the checkTemporaryDirectory-loop, tempnam will only be tested if all alternatives fail and the error message is most likely avoided.	10 years ago
Lukas Reschke	3d4cf2e598	Use proper class name This has never worked before. Introduced with https://github.com/owncloud/core/pull/18658	10 years ago
Morris Jobke	728648ad77	Replace new occurences of ini_get with IniWrapper methods	10 years ago
Morris Jobke	8366ce2767	deduplicate @xenopathic	10 years ago
Morris Jobke	b945d71384	update licence headers via script	10 years ago
Robin McCorkell	a0dfaf9be3	Clean up TempManager to follow code guidelines tmpBaseDir can be overridden for unit testing purposes	10 years ago
root	acae208f2f	moved code to /lib/private/tempmanager.php fix for unit test some fixes	11 years ago
Morris Jobke	f63915d0c8	update license headers and authors	11 years ago
Lukas Reschke	155ae44bc6	Fix collision on temporary files + adjust permissions This changeset hardens the temporary file and directory creation to address multiple problems that may lead to exposure of files to other users, data loss or other unexpected behaviour that is impossible to debug. [CWE-668: Exposure of Resource to Wrong Sphere](https://cwe.mitre.org/data/definitions/668.html) The temporary file and folder handling as implemented in ownCloud is performed using a MD5 hash over `time()` concatenated with `rand()`. This is insufficiently and leads to the following security problems: The generated filename could already be used by another user. It is not verified whether the file is already used and thus temporary files might be used for another user as well resulting in all possible stuff such as "user has file of other user". Effectively this leaves us with: 1. A timestamp based on seconds (no entropy at all) 2. `rand()` which returns usually a number between 0 and 2,147,483,647 Considering the birthday paradox and that we use this method quite often (especially when handling external storage) this is quite error prone and needs to get addressed. This behaviour has been fixed by using `tempnam` instead for single temporary files. For creating temporary directories an additional postfix will be appended, the solution is for directories still not absolutely bulletproof but the best I can think about at the moment. Improvement suggestions are welcome. [CWE-378: Creation of Temporary File With Insecure Permissions](https://cwe.mitre.org/data/definitions/378.html) Files were created using `touch()` which defaults to a permission of 0644. Thus other users on the machine may read potentially sensitive information as `/tmp/` is world-readable. However, ownCloud always encourages users to use a dedicated machine to run the ownCloud instance and thus this is no a high severe issue. Permissions have been adjusted to 0600. [CWE-379: Creation of Temporary File in Directory with Incorrect Permissions](https://cwe.mitre.org/data/definitions/379.html) Files were created using `mkdir()` which defaults to a permission of 0777. Thus other users on the machine may read potentially sensitive information as `/tmp/` is world-readable. However, ownCloud always encourages users to use a dedicated machine to run the ownCloud instance and thus this is no a high severe issue. Permissions have been adjusted to 0700.Please enter the commit message for your changes.	11 years ago
Lukas Reschke	9622fbdf29	Filter potential dangerous characters in path name We should not allow / or \ in the postfix here.	11 years ago
Jenkins for ownCloud	b585d87d9d	Update license headers	11 years ago
Olivier Paroz	f890c3ffb1	Make the method compatible with all types of extensions Fix existing tests	11 years ago
Olivier Paroz	8d6b2b8867	Keep the extension in temp files The file extension helps some applications like ImageMagick to properly process files	11 years ago
Morris Jobke	06aef4e8b1	Revert "Updating license headers" This reverts commit `6a1a4880f0`.	11 years ago
Jenkins for ownCloud	6a1a4880f0	Updating license headers	11 years ago
Robin Appelman	45e3cbefc9	Check directory handle before we use it	11 years ago
Robin Appelman	83c74b80ad	Add \OC\TempManager to handle creating and cleaning temporary files	11 years ago

6 Commits (b87e5a0f2e158d7aad91ba8e58b246e3666f6cbf)