When requesting a new password for share by mail link, now we correctly
reset the expiration date.
Signed-off-by: Vincent Petry <vincent@nextcloud.com>
of type TYPE_EMAIL, when the "video verification" checkbox isn't checked. Users accessing
non-anonymous public shares (TYPE_EMAIL shares) can now request a temporary password themselves.
- Creates a migration step for the files_sharing app to add the 'password_expiration_time'
attribute to the oc_shares table.
- Makes share temporary passwords' expiration time configurable via a system value.
- Adds a system config value to allow permanent share passwords
-Fixes a typo in a comment in apps/files_sharing/src/components/SharingEntryLink.vue
See https://github.com/nextcloud/server/issues/31005
Signed-off-by: Cyrille Bollu <cyrpub@bollu.be>
Add expiration date field in UI.
Save expiration date when creating or updating federated share.
Read expiration date from DB in federated share provider.
Applies to both federated user and group shares.
Signed-off-by: Vincent Petry <vincent@nextcloud.com>
Use new scope values in settings page.
Adjust all consumers to use the new constants.
Map old scope values to new ones in account property getter.
Signed-off-by: Vincent Petry <vincent@nextcloud.com>
Because the exceptions don't always contain a useful message for the UI,
but also because in some cases we need to find out what went wrong.
In some setups, a ShareNotFoundException might happen during creation
when we try to re-read the just written share. Usually related to Galera
Cluster where node syncing wait is not enabled.
Signed-off-by: Vincent Petry <vincent@nextcloud.com>
\OCP\IShare does not exist; the right name is \OCP\Share\IShare,
although it is already imported as IShare.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
To continue this formatting madness, here's a tiny patch that adds
unified formatting for control structures like if and loops as well as
classes, their methods and anonymous functions. This basically forces
the constructs to start on the same line. This is not exactly what PSR2
wants, but I think we can have a few exceptions with "our" style. The
starting of braces on the same line is pracrically standard for our
code.
This also removes and empty lines from method/function bodies at the
beginning and end.
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
Fixes#15455
The issue is that we have a fallback for shares to use the target. So
when the target exists again we happily format it (not that the shares
are still invalid).
This just tries to get the node. If we can't then boom.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Now that we accept shares we should show an overview of shares that are
pending. This first part is the small API to get a list of the currently
pending shares.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Fixes#18255
A new user setting allows a user to always accept (internal) shares. For
example if they don't like accepting shares manually ;)
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
add tests on non-owner pov
Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
duplicate
Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
small fixes
Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
removed tags
Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
working on users with resharing rights
Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
-getLogger()
Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
cleaning
Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
fix type
Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
Update SharingRightsException.php
* Order the imports
* No leading slash on imports
* Empty line before namespace
* One line per import
* Empty after imports
* Emmpty line at bottom of file
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Geting first element of nodes array instead of element with key 0. In some cases key 0 not exists in this array ie. when file is shared from group folder with member of this group who have no permission to read this file.
Getting the shares of a file no longer returns shares with the current
user for consistency with the results when getting the shares including
subfiles.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
"ShareManager::getSharesBy()" already checks if the share provider
exists before returning the shares and, if the provider does not exist,
it returns an empty array. Therefore it is not needed to explicitly
check if the provider exists or not.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
This provides a better context for apps using the event, for example to
load one script or another depending on whether the share is a file or a
folder.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
A user with reshare permissions on a file is now able to get any share
of that file (just like the owner).
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
Before this change the node you shared was checked for permissions.
This works when you reshare the folder that was shared with you.
However when you reshared a subfolder (e.g. as public link),
you could afterwards update the permissions and grant
create+update permissions although the share you receive was read-only.
Signed-off-by: Joas Schilling <coding@schilljs.com>
Talk no longer uses JavaScript "eval", so the Content Security Policy
can now be configured to prevent its use in the public share
authentication page when the password is protected by Talk.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Due to legacy reasons the password of link shares was returned in the
"share_with" and "share_with_displayname" parameters of the response
data. Now a proper "password" parameter is returned too; the old
"share_with" and "share_with_displayname" parameters are kept, although
deprecated, and they will be removed in a future version of Nextcloud.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
When the "hide download" property of a share is set the public share
page will not show the download button nor the menu with the download,
direct link and "Add to your Nextcloud" actions; the "downloadURL"
hidden field will not be included either in the generated HTML.
Despite that, note that the "downloadURL" parameter is still set and
passed to the template, as this could be needed anyway to generate
previews (for example, of audio files).
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Fixes#10852
A quick hack. Still ensures some type safety however now also accepts
null. Else we'd need to add a whole new layer of middlewares.
This can only happen when a guest user wants to access a controller that
requries the user_id.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Fixes#11030
For https://github.com/orgs/nextcloud/projects/18
This template is now compiled so this no longer has to happen in the
browser. Another step towards a stricter CSP.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
The DeletedShareAPIController and ShareAPIController helpers for room
shares are defined in Talk, so the classes do not exist when Talk is not
installed. Due to this when the object returned by "getRoomShareHelper"
is used Phan complains that the class is not declared.
This is not a problem, though, because when the class is not available
"getRoomShareHelper" throws an exception, which is then caught where
that method was called. Therefore now those warnings from Phan are
suppressed (it would be better to use "@phan-suppress-next-line"
instead, but it is not yet available in our Phan version).
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
In some cases, the DeletedShareAPIController requires explicit handling
of each type of share (for example, to format a share for a
DataResponse). Room shares are implemented in an external app (Nextcloud
Talk), so in order to keep the controller as isolated as possible from
room share specifics all that explicit handling is done in a helper
class provided by the Talk app.
In other cases it is just enough to call the share manager specifying a
room share type; note that the share manager is guarded against share
types for which there is no provider, so it is not necessary to
explicitly check that before passing room shares to the share manager.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
In some cases, the ShareAPIController requires explicit handling of each
type of share (for example, to format a share for a DataResponse). Room
shares are implemented in an external app (Nextcloud Talk), so in order
to keep the controller as isolated as possible from room share specifics
all that explicit handling is done in a helper class provided by the
Talk app.
In other cases it is just enough to call the share manager specifying a
room share type; note that the share manager is guarded against share
types for which there is no provider, so it is not necessary to
explicitly check that before passing room shares to the share manager.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Before the public share authentication page is rendered now an event to
load additional scripts is dispatched. Thanks to this any app can load
its own scripts that, when run on the browser, adjust as needed the page
generated by the server.
Note, however, that during the handling of the event apps are only able
to add scripts or styles to be loaded; they can not render arbitrary
content on the page, or change how the content is rendered by the
original template; all those changes have to be done by the scripts at
run-time.
This implies that the scripts of the apps can use only those parameters,
like the token of the share, added to the page when it is generated by
the "publicshareauth" template. Due to this, and given that the event is
being introduced to be used by Talk to inject the UI needed to request
the password for a share, the token of the share is now provided in the
generated page, just like done in the public share page.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Due to a misplaced "||" instead of "===" the condition was always met,
so every share type in the conditional chain after the remote and remote
group shares was formatted as a remote/remote group share.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
