9141eb473f
feat: Close sessions created for login flow v2
Sessions created during the login flow v2 should be short lived to not leave an unexpected opened session in the browser.
This commit add a property to the session object to track its origin, and will close it as soon as possible, i.e., on the first non public page request.
Signed-off-by: Louis Chemineau <louis@chmn.me>
[skip ci]
Signed-off-by: Louis Chemineau <louis@chmn.me>
8 months ago
3737727a04
fix(ReferenceApiController): Bump rate limit for public resolve endpoint
E.g. text documents might contain hundreds of links whose previews need
to get loaded.
Fixes : nextcloud/collectives#1607
Signed-off-by: Jonas <jonas@freesources.org>
11 months ago
25f558d004
fix(TaskProcessing): Set up fs in getFileContentsInternal
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
11 months ago
7a309e7a99
fix(TaskProcessingApiController): Don't use + to merge non-assoc. arrays
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
1 year ago
e77d6c913d
fix(core): Limit valid avatar sizes
Signed-off-by: provokateurin <kate@provokateurin.de>
1 year ago
1aa29441e3
fix: Add direct parameter to flow auth v2
Signed-off-by: Julius Härtl <jus@bitgrid.net>
1 year ago
a6d421e767
chore: Remove deprecated legacy search backend
Signed-off-by: Julius Härtl <jus@bitgrid.net>
1 year ago
bc5c0262af
refactor(core): Make all attribute arguments named
Signed-off-by: provokateurin <kate@provokateurin.de>
1 year ago
c57c3c1573
refactor(core): Replace security annotations with respective attributes
Signed-off-by: provokateurin <kate@provokateurin.de>
1 year ago
90e108e548
fix(core): Document CSRF token endpoint
Signed-off-by: provokateurin <kate@provokateurin.de>
1 year ago
060fb26686
fix(taskprocessing): run cs:fix
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
1 year ago
799ee8fd51
feat(TaskProcessing): Implement enums and default values
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
1 year ago
6c1e896a03
fix: Ignore preview requests for invalid file ids
Signed-off-by: Julius Härtl <jus@bitgrid.net>
1 year ago
fffc784769
feat(taskprocessing): add support for webhooks (http or AppAPI) in the task processing API
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
1 year ago
9716b0d735
refactor: Migrate some legacy and core functions to `IFilenameValidator`
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
1 year ago
9fe4edca2c
fix(ReferenceApiController): Remove accidently added AnonRateLimit
Signed-off-by: Jonas <jonas@freesources.org>
1 year ago
0d07ad98b0
fix(TaskProcessing): Update openapi specs
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
1 year ago
eb0b5f29fb
fix(TaskProcessingApiController): Address review comments
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
1 year ago
4ac1ac673e
fix: psalm errors
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
1 year ago
4ac7f8275b
feat(TaskProcessing): Allow setting task results for file slots
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
1 year ago
1671bf3ef2
feat(Reference): Add public API endpoints to get references
Calling the public API endpoints will check for matching registered
reference providers that implement `IPublicReferenceProvider` and call
their respective functions. If no matching provider is found, the
default `LinkReferenceProvider` will be used to provide open graph data.
The frontend reference widget components will call these endpoints from
unauthorized sessions, e.g. in public shares.
If present, the sharing token of the origin URL is passed to
`resolveReferencePublic()` as additional information for the reference
provider to determine the access scope. This allows the respective
reference providers to determine whether the origin share has access to
the linked resource.
`getCacheKeyPublic` also gets the sharing token so it can scope the cached
entry to it.
Contributes to #45978
Signed-off-by: Jonas <jonas@freesources.org>
1 year ago
2d84d0f5bf
fix(core): use OC namespace for core ReponseDefinitions instead of OCA
Signed-off-by: Julien CHATY-CAPELLE <julien@chaty-capelle.fr>
1 year ago
a229723b8c
feat: Add new forbidden filename options to Capabilities
Allow clients to access the new filename validation options
and make frontend name validation possible.
Co-authored-by: Ferdinand Thiessen <opensource@fthiessen.de>
Co-authored-by: Kate <26026535+provokateurin@users.noreply.github.com>
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
1 year ago
e5275dbada
feat: don't count failed CSRF as failed login attempt
Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
1 year ago
f5ff8136ac
feat(TaskProcessingApi): Add endpoint for getting the next task
Signed-off-by: provokateurin <kate@provokateurin.de>
1 year ago
98eb190e04
test: add tests for ProfilePageController
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
1 year ago
c8e767878d
fix(core): Return X-NC-IsCustomAvatar for guest avatars too
Signed-off-by: provokateurin <kate@provokateurin.de>
1 year ago
8bed23288b
fix(files_sharing): dark avatar support
Signed-off-by: skjnldsv <skjnldsv@protonmail.com>
1 year ago
fb11672df6
fix(core): allow guest avatar fallback
Signed-off-by: skjnldsv <skjnldsv@protonmail.com>
1 year ago
340939e688
fix(Session): avoid password confirmation on SSO
SSO backends like SAML and OIDC tried a trick to suppress password
confirmations as they are not possible by design. At least for SAML it was
not reliable when existing user backends where used as user repositories.
Now we are setting a special scope with the token, and also make sure that
the scope is taken over when tokens are regenerated.
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2 years ago
fc3ee65526
fix(core): unsupported browser redirect url
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
1 year ago
e07a190641
chore: Add SPDX header
Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
1 year ago
a8abe9d3c2
fix(TaskProcessingApi): Cleanup error handling
Signed-off-by: provokateurin <kate@provokateurin.de>
1 year ago
4c375c98a4
docs(TaskProcessingApi): Set correct status code messages
Signed-off-by: provokateurin <kate@provokateurin.de>
1 year ago
eabbb73173
docs(TaskProcessingApi): Cleanup endpoint descriptions
Signed-off-by: provokateurin <kate@provokateurin.de>
1 year ago
79e153735c
docs(TaskProcessingApi): Fix result endpoint description
Signed-off-by: provokateurin <kate@provokateurin.de>
1 year ago
2bd54d30e5
fix(search): Limit maximum number of search results
Signed-off-by: Joas Schilling <coding@schilljs.com>
1 year ago
a8afa7f23d
fix(OCS-API): Add endpoint to list user tasks
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
2 years ago
f3a88f04ec
fix(OCS-API): No csrf required for /tasks/taskId/file/fileId
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
2 years ago
ec94a672d7
fix(ocs): change /tasktypes response to combine optional and non-optional IO slots
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
2 years ago
c079a61181
feat: Add cancel endpoint to OCS API
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
2 years ago
4d9a0eab5f
fix: update openai specs
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
2 years ago
4a3b9b826e
refactor: identifier is now customId/custom_id
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
2 years ago
ec27c538b5
fix: address review comments
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
2 years ago
2c878099f1
fix: address review comments
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
2 years ago
b85a0edc92
fix: Update autoloaders
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
2 years ago
a5053d33c2
fix: Run cs:fix
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
2 years ago
8ccb29ae3b
fix: psalm issues
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
2 years ago
6203c1c7da
fix: Check if user is authorized to use the files they mentioned
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
2 years ago
b150d779f3
refactor: rename getTaskType to getTaskTypeId
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
2 years ago
Louis Chemineau
Jonas
Marcel Klehr
provokateurin
Julius Härtl
Julien Veyssier
Ferdinand Thiessen
Julien CHATY-CAPELLE
Benjamin Gaussorgues
Daniel Kesselberg
skjnldsv
Arthur Schiwon
Andy Scherzinger
Joas Schilling