nextcloud/lib/private
XananasX7 02a9591463 fix(TaskProcessing): add allowed_classes to unserialize() in Manager cache
The availableTaskTypes cache stores serialized arrays containing
ShapeDescriptor objects, ShapeEnumValue objects, and EShapeType enum
values. The unserialize() call did not restrict which classes could
be instantiated.

Restrict deserialization to the three known types:
- OCP\TaskProcessing\ShapeDescriptor
- OCP\TaskProcessing\ShapeEnumValue
- OCP\TaskProcessing\EShapeType

This prevents PHP Object Injection if an attacker gains write access
to the distributed cache backend (e.g., a Redis instance without
authentication or with weak ACLs), which is a known real-world attack
vector in shared hosting and container environments.
2026-06-04 13:13:09 +00:00
..
Accounts fix: Use strict array comparisons in lib/ 2026-01-18 18:45:07 +01:00
Activity fix(activity): do not loop affected userIDs twice 2025-11-05 12:49:38 +00:00
App fix(appstore): address review comments on GenericFileException handling 2026-05-20 00:51:53 +00:00
AppFramework fix(tests): Adapt Middleware tests to API change 2026-03-20 11:00:58 +01:00
Archive
Authentication feat: Add SetupCheck to warn about missing second factor provider 2026-02-05 15:25:52 +00:00
Avatar feat(avatars): use different colors for guests for the same name 2025-09-02 11:31:14 +02:00
BackgroundJob fix(bg_jobs): store job argument as a text, increase length cap from 4000 to 32000 2026-03-19 11:38:40 +01:00
Blurhash/Listener fix(blurhash): Skip generation the if previews are disabled. 2025-05-27 12:26:42 +02:00
Broadcast/Events
Cache Revert "perf(base): Stop setting up the FS for every basic auth request" 2025-08-28 17:11:31 +02:00
Calendar Merge pull request #55763 from nextcloud/backport/54819/stable32 2025-10-16 10:07:57 +02:00
Collaboration feat(UserPlugin): Also full match on additional email addresses 2026-01-21 16:02:03 +01:00
Command fix(jobs): Limit command jobs to known cases 2025-11-05 11:05:36 +01:00
Comments fix(comments): Don's catch invalid DriverException 2025-09-02 11:55:58 +02:00
Config fix(appconfig,userconfig): restore pre-migration fallback for ownCloud migration 2026-05-28 18:42:40 +00:00
Console chore: apply new CSFixer rules 2025-07-01 16:26:50 +02:00
Contacts/ContactsMenu fix: Unify handling of exclude groups in contacts menu and sharing 2026-01-07 17:05:52 +00:00
ContextChat fix: add strict typing to ContextChat classes 2025-07-15 08:16:25 -07:00
Dashboard
DB fix(propagator): Improve lock behavior of propagator 2026-02-17 10:39:11 +01:00
Diagnostics refactor: extract slow operation logging into trait 2026-01-08 13:07:04 +00:00
DirectEditing chore: apply new CSFixer rules 2025-07-01 16:26:50 +02:00
Encryption chore(encryption): Cleanup typing in EncryptAll/DecryptAll 2025-09-11 21:18:37 +02:00
EventDispatcher fix: Do not use deprecated IServerContainer in EventDispatcher 2025-07-08 13:32:15 +02:00
Federation fix(federation): Allow outgoing federation with oCIS federated cloud ids 2025-10-24 09:56:23 +00:00
Files perf: remove unneeded sort in getFolderContentsById 2026-05-20 17:56:12 +00:00
FilesMetadata
FullTextSearch chore: apply new CSFixer rules 2025-07-01 16:26:50 +02:00
GlobalScale chore: apply new CSFixer rules 2025-07-01 16:26:50 +02:00
Group fix: join accounts_data instead of preferences when searching users 2025-10-23 10:12:40 +00:00
Hooks chore: apply new CSFixer rules 2025-07-01 16:26:50 +02:00
Http perf: log slow DNS operations 2026-01-08 13:07:04 +00:00
IntegrityCheck chore: Get rid of AppLocator helper 2025-08-18 17:09:40 +02:00
KnownUser
L10N fix(L10N): stop stripping _ from language codes 2026-02-25 15:55:06 +00:00
LDAP
legacy chore: remove mbstring.func_overload check from checkserver() 2025-08-25 13:19:36 +02:00
Lock
Lockdown chore: Fix all method calls with too many arguments 2025-07-22 12:34:49 +02:00
Log feat(log): Add script name and occ command to log details 2025-12-15 16:57:16 +01:00
Mail fix(Mailer): Log errors 2025-10-30 11:03:21 +00:00
Memcache feat: Add memcache_customprefix 2026-04-20 18:17:49 +02:00
Migration chore: apply new CSFixer rules 2025-07-01 16:26:50 +02:00
Net fix: handle NAT64 addresses in isLocalAddress 2026-05-19 15:37:53 +00:00
Notification fix(notifications): Require absolute links for support of desktop and mobile clients 2026-04-13 15:33:57 +00:00
OCM fix(ocm): align discovery process with OCM spec 2025-11-10 09:55:19 +00:00
OCS fix(OCS): Add IRequest::getFormat to determine the response Content-Type the same way everywhere 2025-08-26 09:50:03 +02:00
Preview fix(previex): Validate preview MIME type 2026-03-09 18:25:26 +01:00
Profile fix(config): fix tests+psalm 2025-08-08 11:00:49 -01:00
Profiler feat(profiler): Use gzdecode/gzencode to parse profiles 2025-11-30 19:23:01 +01:00
Remote chore: apply new CSFixer rules 2025-07-01 16:26:50 +02:00
Repair fix(lexicon): switch bool value to non-lazy 2025-10-21 12:19:01 +00:00
RichObjectStrings Revert "refactor(RichObjectStrings): Only log error if key or value is not string in validator" 2025-04-09 08:35:56 +02:00
Route fix: Fix caching routes by users with an active session 2025-12-15 09:53:32 +00:00
Search feat(unified-search): Use existing min search length config 2025-09-29 10:55:51 +02:00
Security fix(initializeSession): only log HMAC problem to critical logs if indeed critical 2026-03-17 18:20:39 +00:00
Session fix(initializeSession): only log HMAC problem to critical logs if indeed critical 2026-03-17 18:20:39 +00:00
Settings chore: apply new CSFixer rules 2025-07-01 16:26:50 +02:00
Setup refactor(querybuilder): Port away from qb::execute() in lib/ 2025-09-02 11:55:56 +02:00
SetupCheck
Share feat(preset): share link expiration date 2025-08-14 16:07:32 -01:00
Share20 fix(sharing): Don't give a reason when share from disabled user is no longer working 2026-04-13 14:11:27 +00:00
SpeechToText
Support fix: Fix issues and tests in DIContainer and friends 2025-07-08 13:32:14 +02:00
SystemTag feat(SystemTag): Add typed events for tag mapper events 2025-09-04 09:21:13 +00:00
Tagging
Talk feat(talk): Allow to create conversations that are meetings 2026-04-07 13:39:53 +02:00
TaskProcessing fix(TaskProcessing): add allowed_classes to unserialize() in Manager cache 2026-06-04 13:13:09 +00:00
Teams fix(teams-api): adjust resource filtering 2026-04-27 08:35:40 -03:00
Template fix(lib): templates core path detection 2026-04-02 09:27:39 +00:00
TextProcessing fix(textprocessing): accept scheduling a task if there are equivalent taskprocessing providers only 2024-11-13 16:59:46 +01:00
TextToImage
Translation
Updater test(Updater): Harden flaky test 2026-02-04 10:04:34 +00:00
User feat(users): Check assertion when enabling user 2026-05-20 16:21:38 +00:00
UserStatus fix(container): Reduce general deprecation spam on all requests 2025-08-09 11:53:30 +02:00
AllConfig.php feat(AppConfig): cache app config in local cache if available 2025-08-18 13:24:18 +02:00
AppConfig.php fix(appconfig,userconfig): restore pre-migration fallback for ownCloud migration 2026-05-28 18:42:40 +00:00
AppScriptDependency.php chore: apply new CSFixer rules 2025-07-01 16:26:50 +02:00
AppScriptSort.php chore: apply new CSFixer rules 2025-07-01 16:26:50 +02:00
BinaryFinder.php
CapabilitiesManager.php feat(api): File conversion API 2025-01-15 16:38:18 -05:00
Color.php chore: apply new CSFixer rules 2025-07-01 16:26:50 +02:00
Config.php feat(Config.php): change array_merge to array_replace_recursive when merging configs 2026-01-07 11:05:27 +00:00
ContactsManager.php fix(cardav): only show useres from enabled addressBooks in contacts menu 2025-03-17 11:56:34 +01:00
DatabaseException.php
DatabaseSetupException.php
DateTimeFormatter.php
DateTimeZone.php feat(IDateTimeZone): allow to fetch timezone of specified user 2025-08-18 14:26:52 +02:00
EmojiHelper.php chore: apply new CSFixer rules 2025-07-01 16:26:50 +02:00
EventSource.php
EventSourceFactory.php
ForbiddenException.php
HintException.php
Image.php chore: apply new CSFixer rules 2025-07-01 16:26:50 +02:00
InitialStateService.php fix(container): Reduce general deprecation spam on all requests 2025-08-09 11:53:30 +02:00
Installer.php fix: Log that using an appinfo/install.php file is deprecated 2025-08-18 17:25:07 +02:00
LargeFileHelper.php fix: remove executable flag from source files 2025-09-05 01:20:07 +02:00
Log.php fix: Use configured loglevel even when log.condition matches is set 2026-02-27 15:02:30 +00:00
MemoryInfo.php
NaturalSort.php
NaturalSort_DefaultCollator.php
NavigationManager.php fix(navigation): Fix default app icon 2026-05-04 08:38:57 +00:00
NeedsUpdateException.php
NotSquareException.php
PhoneNumberUtil.php
PreviewManager.php fix: disable mp3 preview provider 2025-10-13 17:54:37 +02:00
PreviewNotAvailableException.php chore: apply new CSFixer rules 2025-07-01 16:26:50 +02:00
RedisFactory.php fix(cache): Set default Redis port to 0 for UNIX sockets 2025-09-08 09:12:07 +00:00
Repair.php Merge pull request #55884 from nextcloud/backport/55864/stable32 2025-10-21 17:07:33 +02:00
RepairException.php
Server.php fix(theming): fix broken custom images introduced by #58224 2026-05-20 15:50:07 +00:00
ServerContainer.php feat: Improve init a bit, and add more profiling steps 2025-05-13 16:08:49 +02:00
ServerNotAvailableException.php
ServiceUnavailableException.php
Setup.php fix(Setup): Ensure instanceid is generated during installation 2026-05-11 11:47:49 +00:00
Streamer.php refactor(Streamer): inject IDateTimeZone as constructor arg 2025-08-14 17:19:28 +02:00
StreamImage.php
SubAdmin.php
SystemConfig.php feat: allow admins to configure additional sensitive config values 2025-08-05 19:16:14 +02:00
TagManager.php fix: Fix user in Tags class, do not depend upon session 2026-04-21 11:00:56 +02:00
Tags.php fix: Fix user in Tags class, do not depend upon session 2026-04-21 11:00:56 +02:00
TemplateLayout.php fix(core): provide valid initial state also on public templates 2026-04-30 21:31:49 +00:00
TempManager.php chore: move implementation from OC legacy to OCP\Files 2025-05-14 14:55:45 +02:00
Updater.php fix(upgrade): restore missing apps on upgrade 2026-04-17 11:17:40 +00:00
URLGenerator.php fix: make core application bootstrapable by coordinator 2025-06-02 15:58:54 +02:00