Welcome to mirror list, hosted at ThFree Co, Russian Federation.

github.com/nextcloud/server.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
path: root/tests/lib/Security
AgeCommit message (Collapse)Author
2022-04-01Add CSP policy merge priority for booleansbugfix/noid/fix-csp-merging-boolsVincent Petry
When two booleans conflict when merging CSP policies, true will win. Signed-off-by: Vincent Petry <vincent@nextcloud.com>
2022-03-24Migrate from ILogger to LoggerInterface where needed in the testsCôme Chilliet
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2022-03-09Allow to set a strict-dynamic CSP through the APIenh/strict-dynamic-cspJulius Härtl
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2022-01-13Check style updateCarl Schwan
Signed-off-by: Carl Schwan <carl@carlschwan.eu>
2021-11-22Improve normalizer detecting IPv4 inside of IPv6Vincent Petry
The subnet for an IPv4 address inside of IPv6 is now returned in its IPv4 form. Signed-off-by: Vincent Petry <vincent@nextcloud.com>
2021-11-22Fix getting subnet of ipv4 mapped ipv6 addressesVincent Petry
Signed-off-by: Vincent Petry <vincent@nextcloud.com>
2021-10-28Add an OCP for trusted domain helperJoas Schilling
Signed-off-by: Joas Schilling <coding@schilljs.com>
2021-09-27Remove tests that just prove mocked calls and don't actually validate ↵Julius Härtl
anything useful Signed-off-by: Julius Härtl <jus@bitgrid.net>
2021-09-13Merge pull request #28728 from nextcloud/add-database-backend-limiterLukas Reschke
Add database ratelimiting backend
2021-09-09add a job to clean up expired verification tokensArthur Schiwon
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2021-09-09move verification token logic out of lost password controllerArthur Schiwon
- to make it reusable - needed for local email verification Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2021-09-06Adjust testsLukas Reschke
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2021-09-06Adjust logic to store period instead of current timestampLukas Reschke
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2021-05-18Merge pull request #26626 from J0WI/strict-securityRoeland Jago Douma
Make Security module strict
2021-04-21Update CredentialsManagerTest.phpJoas Schilling
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2021-04-20Fix security credentials manager testJoas Schilling
Signed-off-by: Joas Schilling <coding@schilljs.com>
2021-04-19Make Security module strictJ0WI
Signed-off-by: J0WI <J0WI@users.noreply.github.com>
2021-04-07Increase subnet matcherLukas Reschke
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2021-02-18Bump nextcloud/coding-standard from 0.3.0 to 0.5.0dependabot-preview[bot]
Bumps [nextcloud/coding-standard](https://github.com/nextcloud/coding-standard) from 0.3.0 to 0.5.0. - [Release notes](https://github.com/nextcloud/coding-standard/releases) - [Changelog](https://github.com/nextcloud/coding-standard/blob/master/CHANGELOG.md) - [Commits](https://github.com/nextcloud/coding-standard/compare/v0.3.0...v0.5.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2021-01-08Bump doctrine/dbal from 2.12.0 to 3.0.0Christoph Wurst
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-11-03Improve CertificateManager to not be user context dependentMorris Jobke
* removes the ability for users to import their own certificates (for external storage) * reliably returns the same certificate bundles system wide (and not depending on the user context and available sessions) The user specific certificates were broken in some cases anyways, as they are only loaded if the specific user is logged in and thus causing unexpected behavior for background jobs and other non-user triggered code paths. Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2020-10-16Implement unit tests for versions 1 and 2.lynn-stephenson
Signed-off-by: lynn-stephenson <lynn.stephenson@protonmail.com>
2020-10-05Format code to a single space around binary operatorsChristoph Wurst
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-09-10Don't break when the IP is emptyJoas Schilling
Signed-off-by: Joas Schilling <coding@schilljs.com>
2020-08-12Change PHPDoc type hint from PHPUnit_Framework_MockObject_MockObject to ↵Morris Jobke
\PHPUnit\Framework\MockObject\MockObject Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2020-05-11Use random_bytesRoeland Jago Douma
Since we don't care if it is human readbale. The code is backwards compatible with the old format. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2020-04-30Fix Argon2 options checksMichaIng
The minimum for memory cost is 8 KiB per thread. Threads must be checked and set first to allow checking against the correct memory cost mimimum. Options are now applied the following way: - If config.php contains the setting with an integer higher or equal to the minimum, it is applied. - If config.php contains the setting with an integer lower than the minimum, the minimum is applied. - If config.php does not contain the setting or with no integer value, the PHP default is applied. Signed-off-by: MichaIng <micha@dietpi.com> Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2020-04-15fix credentialsManager documentation and ensure userId to be used as stringArthur Schiwon
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2020-04-15add DB tests for credentials managerArthur Schiwon
these are actually expected to FAIL, because NULL as a userid is not allowed in the schema, but documented to be used on the source Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2020-04-10Add visibility to all methods and position of static keywordChristoph Wurst
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-10Format control structures, classes, methods and functionChristoph Wurst
To continue this formatting madness, here's a tiny patch that adds unified formatting for control structures like if and loops as well as classes, their methods and anonymous functions. This basically forces the constructs to start on the same line. This is not exactly what PSR2 wants, but I think we can have a few exceptions with "our" style. The starting of braces on the same line is pracrically standard for our code. This also removes and empty lines from method/function bodies at the beginning and end. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-09Unify function spacing to PSR2 recommendationChristoph Wurst
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-09Use a blank line after the opening tagChristoph Wurst
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-09Use exactly one empty line after the namespace declarationChristoph Wurst
For PSR2 Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-03-27Merge pull request #20170 from nextcloud/techdebt/remove-unused-importsChristoph Wurst
Remove unused imports
2020-03-26Use the short array syntax, everywhereChristoph Wurst
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-03-26Use the shorter phpunit syntax for mocked return valuesChristoph Wurst
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-03-26Remove unused importsChristoph Wurst
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-02-07Add Argon2id supportRoeland Jago Douma
When available we should use argon2id for hashing. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2020-02-03Allow selecting the hashing algorithmRoeland Jago Douma
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-12-07Move overwritehost check to isTrustedDomainJulius Härtl
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2019-11-27Mode to modern phpunitRoeland Jago Douma
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-11-27Make phpunit8 compatibleRoeland Jago Douma
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-11-22Some php-cs fixesRoeland Jago Douma
* Order the imports * No leading slash on imports * Empty line before namespace * One line per import * Empty after imports * Emmpty line at bottom of file Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-10-06make TrustedDomainHelper case insensitiveJohannes Koenig
Signed-off-by: Johannes Koenig <mail@jokoenig.de>
2019-09-14Harden identifyproof openssl codeRoeland Jago Douma
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-08-19Fix report of phpstan in LimiterRoeland Jago Douma
* unneeded arguments to constructor * added return types * let automatic DI do its work Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-08-10Add testsRoeland Jago Douma
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-07-31Update CSP test cases to handle the new form-actionRoeland Jago Douma
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-07-18Add support for CSP_NONCE server variableSam Bull
Allow passing a nonce from the web server, allowing the possibility to enforce a strict CSP from the web server. Signed-off-by: Sam Bull <git@sambull.org> Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-04 00:54:29 +0300