# Table of Contents
* [Changelog for 11.0.0](#changelog-for-owncloud-core-1100-2026-07-30)
* [Changelog for 10.16.4](#changelog-for-owncloud-core-10164-2026-07-29)
* [Changelog for 10.16.3](#changelog-for-owncloud-core-10163-2026-05-22)
* [Changelog for 10.16.2](#changelog-for-owncloud-core-10162-2026-04-02)
* [Changelog for 10.16.1](#changelog-for-owncloud-core-10161-2026-02-18)
* [Changelog for 10.16.0](#changelog-for-owncloud-core-10160-2025-10-23)
* [Changelog for 10.15.3](#changelog-for-owncloud-core-10153-2025-07-04)
* [Changelog for 10.15.2](#changelog-for-owncloud-core-10152-2025-03-11)
* [Changelog for 10.15.1](#changelog-for-owncloud-core-10151-2025-03-03)
* [Changelog for 10.15.0](#changelog-for-owncloud-core-10150-2024-06-18)
* [Changelog for 10.14.0](#changelog-for-owncloud-core-10140-2024-02-19)
* [Changelog for 10.13.4](#changelog-for-owncloud-core-10134-2023-12-13)
* [Changelog for 10.13.3](#changelog-for-owncloud-core-10133-2023-11-17)
* [Changelog for 10.13.2](#changelog-for-owncloud-core-10132-2023-10-04)
* [Changelog for 10.13.1](#changelog-for-owncloud-core-10131-2023-09-04)
* [Changelog for 10.13.0](#changelog-for-owncloud-core-10130-2023-08-22)
* [Changelog for 10.12.2](#changelog-for-owncloud-core-10122-2023-05-31)
* [Changelog for 10.12.1](#changelog-for-owncloud-core-10121-2023-04-03)
* [Changelog for 10.12.0](#changelog-for-owncloud-core-10120-2023-02-24)
* [Changelog for 10.11.0](#changelog-for-owncloud-core-10110-2022-08-23)
* [Changelog for 10.10.0](#changelog-for-owncloud-core-10100-2022-05-16)
* [Changelog for 10.9.1](#changelog-for-owncloud-core-1091-2022-01-12)
* [Changelog for 10.9.0](#changelog-for-owncloud-core-1090-2021-12-20)
* [Changelog for 10.8.0](#changelog-for-owncloud-core-1080-2021-07-15)
* [Changelog for 10.7.0](#changelog-for-owncloud-core-1070-2021-03-26)
* [Changelog for 10.6.0](#changelog-for-owncloud-core-1060-2020-11-25)
* [Changelog for 10.5.0](#changelog-for-owncloud-core-1050-2020-07-31)
* [Changelog for 10.4.1](#changelog-for-owncloud-core-1041-2020-03-30)
* [Changelog for 10.4.0](#changelog-for-owncloud-core-1040-2020-02-10)
* [Changelog for 10.3.2](#changelog-for-owncloud-core-1032-2019-12-04)
# Changelog for ownCloud Core [11.0.0] (2026-07-30)
The following sections list the changes in ownCloud core 11.0.0 relevant to
ownCloud admins and users.
[11.0.0]: https://github.com/owncloud/core/compare/v10.16.4...v11.0.0
## Summary
* Security - Prevent params body from overriding validated occ command: [#41577](https://github.com/owncloud/core/pull/41577)
* Security - Remove plaintext federation auth token from error log: [#41578](https://github.com/owncloud/core/pull/41578)
* Security - Replace strcmp token oracle with hash-based comparison in federation: [#41579](https://github.com/owncloud/core/pull/41579)
* Security - Restrict unserialize() allowed classes in CommandJob: [#41582](https://github.com/owncloud/core/pull/41582)
* Security - Sanitize storage connection error messages returned to clients: [#41585](https://github.com/owncloud/core/pull/41585)
* Security - Prevent user enumeration via differential password reset UI: [#41586](https://github.com/owncloud/core/pull/41586)
* Security - Disable group-admin feature by default behind allow_subadmins: [#41634](https://github.com/owncloud/core/pull/41634)
* Security - Do not trust cached binary paths: [#41732](https://github.com/owncloud/core/pull/41732)
* Security - Enforce the read permission in the public share preview endpoint: [#41751](https://github.com/owncloud/core/pull/41751)
* Security - Confine backend provided user homes to the data directory: [#41752](https://github.com/owncloud/core/pull/41752)
* Security - Encode search highlights before they are returned as a DAV property: [#41760](https://github.com/owncloud/core/pull/41760)
* Bugfix - Point documentation help links at the latest server docs: [#5132](https://github.com/owncloud/docs/issues/5132)
* Bugfix - Normalise trashbin original-location PROPFIND response: [#39337](https://github.com/owncloud/core/issues/39337)
* Bugfix - Add missing space to mail footer signature delimiter: [#41364](https://github.com/owncloud/core/issues/41364)
* Bugfix - Fix htaccess RewriteBase rules blocking API requests by file extension: [#41418](https://github.com/owncloud/core/issues/41418)
* Bugfix - Adjust code to avoid PHP8 messages: [#41597](https://github.com/owncloud/core/pull/41597)
* Bugfix - Support federation between systems in subdirectories: [#41599](https://github.com/owncloud/core/pull/41599)
* Bugfix - Remove owncloud.com/federation link from federated cloud settings: [#41608](https://github.com/owncloud/core/pull/41608)
* Bugfix - Fix JS test isolation bugs exposed by Jasmine 5 random test ordering: [#41616](https://github.com/owncloud/core/pull/41616)
* Bugfix - Honor language on anonymous pages: [#41618](https://github.com/owncloud/core/issues/41618)
* Bugfix - Decrypt versions and trashbin so encryption can be disabled: [#41623](https://github.com/owncloud/core/issues/41623)
* Bugfix - Fix user:home:list-dirs and user:home:list-users crashing on PHP 8: [#41630](https://github.com/owncloud/core/issues/41630)
* Bugfix - Add MIME types for OpenDocument formats: [#41648](https://github.com/owncloud/core/pull/41648)
* Bugfix - Handle deprecated code related to comments app: [#41656](https://github.com/owncloud/core/pull/41656)
* Bugfix - Hide navigation icon for apps not enabled for the user: [#41717](https://github.com/owncloud/core/issues/41717)
* Bugfix - Do not crash on malformed translations: [#41720](https://github.com/owncloud/core/issues/41720)
* Bugfix - Reject non-numeric avatar crop coordinates: [#41723](https://github.com/owncloud/core/issues/41723)
* Bugfix - Fix avatar cropper broken by Jcrop 2.0 file rename: [#41723](https://github.com/owncloud/core/issues/41723)
* Bugfix - Rewire legacy ajax routes to extension-free urls: [#41740](https://github.com/owncloud/core/issues/41740)
* Bugfix - Request legacy ajax endpoints through the front controller: [#41740](https://github.com/owncloud/core/issues/41740)
* Change - Update M$ Office icons: [#41347](https://github.com/owncloud/core/pull/41347)
* Change - No longer store auto loader information in any memory cache: [#41376](https://github.com/owncloud/core/pull/41376)
* Change - Raise minimum PHP version to 8.3: [#41449](https://github.com/owncloud/core/pull/41449)
* Change - Update PHP dependencies: [#41450](https://github.com/owncloud/core/pull/41450)
* Change - Drop command db:convert-type: [#41451](https://github.com/owncloud/core/pull/41451)
* Change - Removed legacy and deprecated code from ownCloud 11: [#41455](https://github.com/owncloud/core/pull/41455)
* Change - Use configurable URL for internet connectivity check: [#41506](https://github.com/owncloud/core/pull/41506)
* Change - Use phan major version 6 code analysis: [#41650](https://github.com/owncloud/core/pull/41650)
* Change - Remove msteamsbridge config sample: [#41668](https://github.com/owncloud/core/pull/41668)
* Change - G2 code-signing verifier and G1 signature sunset: [#41680](https://github.com/owncloud/core/pull/41680)
* Change - Remove occ integrity:sign-app and integrity:sign-core commands: [#41712](https://github.com/owncloud/core/pull/41712)
* Change - Remove the caching router: [#41733](https://github.com/owncloud/core/pull/41733)
* Change - Keep host local caches in the local cache tier: [#41734](https://github.com/owncloud/core/pull/41734)
* Change - Cover HTML metacharacters in the username validation allow-list: [#41738](https://github.com/owncloud/core/pull/41738)
* Change - Expose createLocal() on ICacheFactory: [#41753](https://github.com/owncloud/core/pull/41753)
* Change - Escape group names in the users administration group list: [#41758](https://github.com/owncloud/core/pull/41758)
* Change - Honour the write hook veto on legacy chunked WebDAV uploads: [#41762](https://github.com/owncloud/core/pull/41762)
## Details
* Security - Prevent params body from overriding validated occ command: [#41577](https://github.com/owncloud/core/pull/41577)
OccController validated the URL-path command against an allowlist but then
merged it with user-supplied params via array_merge, allowing a command key in
the request body to overwrite the validated value. An authenticated caller with
the updater secret could use this to execute any occ command regardless of the
allowlist. The params array is now stripped of any command key before the merge.
https://github.com/owncloud/core/pull/41577
* Security - Remove plaintext federation auth token from error log: [#41578](https://github.com/owncloud/core/pull/41578)
When getSharedSecret received an invalid token it logged both the submitted
value and the expected valid token in plaintext. Since the endpoint is public,
any unauthenticated caller could trigger this log entry at will for any trusted
server URL, exposing the valid token to anyone with log-read access.
A second leak in the same code path has also been closed: the GetSharedSecret
background job sends the token as a GET query parameter, so on an unexpected
HTTP response the Guzzle exception - whose message embeds the full request URI
including "?token=..." - was logged verbatim. Both log sites no longer emit the
token value.
https://github.com/owncloud/core/pull/41578
* Security - Replace strcmp token oracle with hash-based comparison in federation: [#41579](https://github.com/owncloud/core/pull/41579)
The requestSharedSecret endpoint used strcmp() to compare caller-supplied and
stored federation tokens, returning different HTTP responses based on
lexicographic ordering. This allowed an unauthenticated attacker to recover the
stored token via binary search in approximately 96 requests. Tokens are now
compared by their SHA-256 hashes, removing the plaintext oracle while preserving
the tiebreaking behaviour.
https://github.com/owncloud/core/pull/41579
* Security - Restrict unserialize() allowed classes in CommandJob: [#41582](https://github.com/owncloud/core/pull/41582)
CommandJob::run() called unserialize() without the allowed_classes option on
data sourced from the oc_jobs database table. An attacker with database write
access could inject a crafted PHP object payload to trigger gadget chains from
bundled libraries and achieve remote code execution. Deserialization is now
restricted to verified ICommand implementations only.
https://github.com/owncloud/core/pull/41582
* Security - Sanitize storage connection error messages returned to clients: [#41585](https://github.com/owncloud/core/pull/41585)
The external storage status handler returned raw exception messages including
Guzzle cURL error details such as resolved IP addresses and port numbers in the
JSON response. This allowed authenticated users to distinguish connection states
and map internal network topology. The full exception is now logged server-side
only; a generic message is returned to the client.
https://github.com/owncloud/core/pull/41585
* Security - Prevent user enumeration via differential password reset UI: [#41586](https://github.com/owncloud/core/pull/41586)
The login form showed a "Reset it?" link only when a valid user on a backend
that supports password changes was detected. LDAP users produced a different
response than non-existent users, allowing unauthenticated enumeration of
accounts on those backends. The backend capability check has been removed; the
reset link is now shown uniformly regardless of user existence or backend type.
https://github.com/owncloud/core/pull/41586
* Security - Disable group-admin feature by default behind allow_subadmins: [#41634](https://github.com/owncloud/core/pull/41634)
Disable the subadmin (group-admin) feature by default behind a new
allow_subadmins system config, as a security risk-mitigation. The feature's code
path has known security shortcomings; deployments that rely on it can opt back
in with 'allow_subadmins' => true in config.php. On upgrade, existing
group-admin assignments are ignored until an admin sets 'allow_subadmins' =>
true in config.php.
https://github.com/owncloud/core/pull/41634
* Security - Do not trust cached binary paths: [#41732](https://github.com/owncloud/core/pull/41732)
The paths of the helper binaries used to render previews - ffmpeg, avconv and
AtomicParsley - were cached in the distributed memory cache and used without
being checked, then interpolated unquoted into the shell commands built from
them. A cached path is now stored in the host local cache tier only, is
validated before it is used, and is quoted when the command line is assembled.
https://github.com/owncloud/core/pull/41732
* Security - Enforce the read permission in the public share preview endpoint: [#41751](https://github.com/owncloud/core/pull/41751)
The public share preview endpoint resolved the share by token and rendered the
requested file without consulting the share's permission bitmask. It now returns
404 when the share does not carry the read permission, which makes it consistent
with ShareController::downloadShare() and the public WebDAV route.
https://github.com/owncloud/core/pull/41751
* Security - Confine backend provided user homes to the data directory: [#41752](https://github.com/owncloud/core/pull/41752)
A user backend can supply a per user home directory - the LDAP backend for
instance can be configured to read it from a user attribute such as
homeDirectory. The account sync accepted that value after nothing more than a
check for a leading slash, so a home pointing at the ownCloud code directory
turned the user's file listing into read and write access to the application's
own PHP files. Writing a PHP file into a web reachable location, or modifying
one of the shipped ones, results in remote code execution. The relative form was
concatenated onto the data directory without normalization, so a value
containing ".." escaped it as well.
A backend provided home is now rejected unless it resolves inside the configured
datadirectory. Installations that legitimately keep user homes elsewhere, for
example on a separate NFS mount, can list the permitted base directories in the
new "user.home_base_dirs" config option. Symlinks are resolved before the
comparison, so a symlinked data directory keeps working while a symlink inside
it cannot be used to escape. Every entry in the option has to be an absolute
path; entries that are not are ignored, because a relative one would be resolved
against the working directory of whichever process happens to run the check.
Note that a home is only set when an account has none yet, so accounts that were
provisioned before this change keep the home already stored for them.
https://github.com/owncloud/core/pull/41752
https://github.com/owncloud/user_ldap/pull/849
* Security - Encode search highlights before they are returned as a DAV property: [#41760](https://github.com/owncloud/core/pull/41760)
The search-highlights property of the files search REPORT returned the
elasticsearch highlight fragment unencoded. The fragment is built from file
content, so a user who shared a crafted file could place arbitrary markup in the
property value. The property deliberately carries HTML - line breaks are
substituted with
- so a client rendering it as HTML would execute the
injected markup.
The fragment is now HTML-encoded before the line break substitution, which keeps
the intended
markup intact.
https://github.com/owncloud/core/pull/41760
* Bugfix - Point documentation help links at the latest server docs: [#5132](https://github.com/owncloud/docs/issues/5132)
Contextual documentation links (setup checks, help & tips, app info.xml keys)
were built as /server//go.php?to= using the running server's
concrete version, e.g. /server/10.16/. The documentation site publishes the
current stable release only under /server/latest/, so those links resolved to a
non-existent version path and 404'd. The version segment now defaults to
'latest'; callers may still pass an explicit published version.
https://github.com/owncloud/docs/issues/5132
https://github.com/owncloud/core/pull/41688
* Bugfix - Normalise trashbin original-location PROPFIND response: [#39337](https://github.com/owncloud/core/issues/39337)
In certain situations the trashbin original-location in a PROPFIND response
contained a leading slash. This change ensures that a relative path (without a
leading slash) is always returned.
https://github.com/owncloud/core/issues/39337
https://github.com/owncloud/core/pull/41649
* Bugfix - Add missing space to mail footer signature delimiter: [#41364](https://github.com/owncloud/core/issues/41364)
We've fixed the signature delimiter in the email footer templates. The delimiter
on the first line was missing the trailing space required by the signature block
convention (RFC 3676), so mail clients were unable to recognize and collapse the
signature. The delimiter is now correctly written as "-- " (dash-dash-space).
https://github.com/owncloud/core/issues/41364
https://github.com/owncloud/core/pull/41617
* Bugfix - Fix htaccess RewriteBase rules blocking API requests by file extension: [#41418](https://github.com/owncloud/core/issues/41418)
Files whose names end in extensions like .jpg, .png, .svg, .json and others
could not be marked as favorites or have their tags updated via the files API
when htaccess.RewriteBase was configured. The .htaccess rules generated by `occ
maintenance:update:htaccess` used a URI extension check to skip routing through
index.php, which inadvertently blocked API requests to paths like
`/apps/files/api/v1/files/photo.jpg`, returning 405 Method Not Allowed.
The fix replaces the extension-based condition with `RewriteCond
%{REQUEST_FILENAME} !-f`, which correctly routes virtual API paths through
index.php while still serving actual static files directly.
https://github.com/owncloud/core/issues/41418
* Bugfix - Adjust code to avoid PHP8 messages: [#41597](https://github.com/owncloud/core/pull/41597)
Avoid trying to access array offset on false in the encryption storage wrapper.
Handle passing null to normalizeUrl in the federation DbHandler.
https://github.com/owncloud/core/pull/41597
* Bugfix - Support federation between systems in subdirectories: [#41599](https://github.com/owncloud/core/pull/41599)
If a federated server was installed in a subdirectory like:
Mydomain.com/cloud
Then checks to see that the server is up and responding would fail. This problem
has been corrected.
https://github.com/owncloud/core/pull/41599
* Bugfix - Remove owncloud.com/federation link from federated cloud settings: [#41608](https://github.com/owncloud/core/pull/41608)
The "Add to your website" feature in the personal federation settings was
generating a link to https://owncloud.com/federation# which no longer works
after owncloud.com was restructured. The federation Cloud ID is now displayed
directly without linking to the defunct external page.
https://github.com/owncloud/core/pull/41608
* Bugfix - Fix JS test isolation bugs exposed by Jasmine 5 random test ordering: [#41616](https://github.com/owncloud/core/pull/41616)
Several JS test specs left shared singleton state dirty between tests, causing
intermittent failures when Jasmine 5 ran tests in random order. Fixed
OC._currentMenu leak in fileactionsmenuSpec, stale OCA.Files.fileActions
reference causing infinite recursion in files_sharing/appSpec, and stale models
in the OC.SystemTags.collection singleton in systemtagsinfoviewSpec and
systemtagsinputfieldSpec.
https://github.com/owncloud/core/pull/41616
* Bugfix - Honor language on anonymous pages: [#41618](https://github.com/owncloud/core/issues/41618)
Anonymous pages (the login page and the password-protected public share page)
always rendered in English even when default_language was configured or the
browser sent a matching Accept-Language header, while authenticated pages were
translated correctly. The language factory cached the "en" last-resort fallback
as the per-request language, which then short-circuited every later lookup
before default_language or Accept-Language could be consulted. The fallback is
no longer cached, so anonymous pages honor default_language and Accept-Language.
https://github.com/owncloud/core/issues/41618
* Bugfix - Decrypt versions and trashbin so encryption can be disabled: [#41623](https://github.com/owncloud/core/issues/41623)
"occ encryption:decrypt-all" only walked the regular "files" folder, leaving the
"encrypted" flag set on entries in "files_versions" and "files_trashbin".
Because "occ encryption:disable" refuses while any file cache row is still
flagged as encrypted, administrators were left unable to disable encryption even
though decrypt-all reported success.
Decrypt-all now also descends into "files_versions" and "files_trashbin", and
the disable command now lists the paths that are still flagged as encrypted
together with a hint on how to clean them up, instead of printing a generic
message.
https://github.com/owncloud/core/issues/41623
https://github.com/owncloud/core/pull/41624
* Bugfix - Fix user:home:list-dirs and user:home:list-users crashing on PHP 8: [#41630](https://github.com/owncloud/core/issues/41630)
The occ commands user:home:list-dirs and user:home:list-users --all passed null
as the search pattern to IUserManager::search() to mean "all users". On PHP 8
the null reached Connection::escapeLikeParameter(string $param) and raised a
TypeError, aborting the command. Both commands now pass the empty string, which
is the established "match all" sentinel used by every other caller.
https://github.com/owncloud/core/issues/41630
* Bugfix - Add MIME types for OpenDocument formats: [#41648](https://github.com/owncloud/core/pull/41648)
Add MIME type mappings for additional OpenDocument formats for file types odc,
odi, odm, otc, otg, oth, oti, otp, ots and ott.
Add MIME type aliases for chart and image formats that were currently missing in
the default mimetypealiases.dist.json file.
Update mimetypelist.js using ./occ maintenance:mimetype:update-js
https://github.com/owncloud/core/pull/41648
* Bugfix - Handle deprecated code related to comments app: [#41656](https://github.com/owncloud/core/pull/41656)
Code paths that caused deprecation warnings in PHP 8 have been corrected.
https://github.com/owncloud/core/pull/41656
* Bugfix - Hide navigation icon for apps not enabled for the user: [#41717](https://github.com/owncloud/core/issues/41717)
Apps that were enabled only for a specific group still showed their navigation
icon in the top-left app menu for every user, including users who were not in
that group. Clicking the icon then bounced the user back to the Files app. The
navigation manager now skips apps that are not enabled for the current user,
mirroring the per-user check already used for the web navigation entry.
https://github.com/owncloud/core/issues/41717
* Bugfix - Do not crash on malformed translations: [#41720](https://github.com/owncloud/core/issues/41720)
Changing the language (and any request that rendered a translated string with
parameters) could return an HTTP 500 error. On PHP 8 vsprintf() throws a
ValueError instead of returning false when a translation's format specifiers do
not match the supplied arguments — a common result of translators turning "%s"
into "% s" or "%S", or dropping a specifier. OC_L10N_String::__toString() did
not guard against this, so a single malformed translation string in a shipped
language file crashed the whole request. Such translations now fall back to the
untranslated source text so the request still succeeds.
https://github.com/owncloud/core/issues/41720
* Bugfix - Reject non-numeric avatar crop coordinates: [#41723](https://github.com/owncloud/core/issues/41723)
Submitting a profile picture crop with empty or non-numeric coordinates hit the
image cropping code with invalid values. On PHP 8 this raised a TypeError from
round() and returned an HTTP 500; on PHP 7 it silently produced a broken crop.
The client sends empty coordinates (crop[x]=&crop[y]=...) whenever the cropper
failed to produce a selection. postCroppedAvatar now validates that all four
coordinates are numeric and returns a clean HTTP 400 otherwise, instead of
crashing.
https://github.com/owncloud/core/issues/41723
https://github.com/owncloud/core/pull/41725
* Bugfix - Fix avatar cropper broken by Jcrop 2.0 file rename: [#41723](https://github.com/owncloud/core/issues/41723)
Uploading a non-square profile picture opened a cropper that immediately failed
with "$cropperImage.Jcrop is not a function". Bumping the Jcrop dependency from
0.9.12 to 2.0.4 renamed its distribution files from js/jquery.Jcrop.js and
css/jquery.Jcrop.css to js/Jcrop.js and css/Jcrop.css, but the personal profile
template still referenced the old paths. The script therefore failed to load,
the plugin never registered on jQuery, and the cropper could not be shown. The
template now loads the renamed Jcrop assets.
Original Jcrop PR: https://github.com/owncloud/core/pull/38666
https://github.com/owncloud/core/issues/41723
https://github.com/owncloud/core/pull/41724
* Bugfix - Rewire legacy ajax routes to extension-free urls: [#41740](https://github.com/owncloud/core/issues/41740)
The front controller rewrite only forwards a request to index.php when the
requested path does not exist on disk. A legacy route whose declared url was
itself a real file - for example /settings/ajax/setlanguage.php - therefore
never reached the router: the web server executed the script directly, without
the bootstrap index.php would have performed, and the request died with `Class
"OC" not found` (HTTP 500). Changing the personal language setting, the share
dialog e-mail lookup, the trashbin and public link preview thumbnails and the
Google Drive OAuth entry point were affected.
Every such route url has lost its .php suffix so that no route url resolves to a
file on disk any more, and the affected javascript callers now build routed urls
through OC.generateUrl(). Route names are unchanged, so linkToRoute() callers
keep working. The legacy .php urls are gone and no alias is provided - an alias
would re-introduce the very shadowing this change removes. /core/ajax/update.php
keeps its suffix by design: it bootstraps itself and is excluded from the
rewrite. Five routes whose include target no longer existed were removed.
Third-party apps posting to their own shadowed .php route urls need the same
treatment.
https://github.com/owncloud/core/issues/41740
https://github.com/owncloud/core/pull/41742
* Bugfix - Request legacy ajax endpoints through the front controller: [#41740](https://github.com/owncloud/core/issues/41740)
The front controller rewrite only forwards a request to index.php when the
requested path does not exist on disk. Five javascript call sites requested a
url that was itself a real file, so the web server executed the script directly,
without the bootstrap index.php would have performed, and the request died with
a fatal error (HTTP 500): changing the personal language, the share dialog
e-mail lookup, the Google Drive OAuth entry point, and the trashbin and public
link preview thumbnails.
All five now build their url with an explicit /index.php/ prefix so that the
request no longer matches a file on disk and reaches the router. The prefix has
to be part of the url literal because OC.generateUrl() omits /index.php when
mod_rewrite is active, which is how four of the five came to request the
shadowed url in the first place.
https://github.com/owncloud/core/issues/41740
https://github.com/owncloud/core/pull/41743
* Change - Update M$ Office icons: [#41347](https://github.com/owncloud/core/pull/41347)
Icons have been updated according to the M$ cloud storage partner program
https://github.com/owncloud/core/pull/41347
* Change - No longer store auto loader information in any memory cache: [#41376](https://github.com/owncloud/core/pull/41376)
With composer managing auto loading for a long time this is no longer necessary.
https://github.com/owncloud/core/pull/41376
* Change - Raise minimum PHP version to 8.3: [#41449](https://github.com/owncloud/core/pull/41449)
The minimum required PHP version is now 8.3. Numerous PHP 8.x deprecation
warnings were resolved across the codebase, the mail subsystem was migrated to
symfony/mailer, the unused ext-apc requirement was dropped, and the PHP version
check now runs early in lib/base.php.
https://github.com/owncloud/core/pull/41449
* Change - Update PHP dependencies: [#41450](https://github.com/owncloud/core/pull/41450)
The following have been updated:
* doctrine/dbal (2.13.9 to 3.10.6)
* firebase/php-jwt (7.0.5 to 7.1.0)
* google/apiclient (v2.19.0 to v2.19.4)
* google/apiclient-services (v0.435.0 to v0.452.0)
* google/auth (v1.50.0 to v1.53.0)
* guzzlehttp/guzzle (7.10.0 to 7.15.2)
* guzzlehttp/promises (2.3.0 to 2.5.1)
* guzzlehttp/psr7 (2.8.0 to 2.13.0)
* laravel/serializable-closure (v2.0.10 to v2.0.15)
* league/mime-type-detection (1.16.0 to 1.17.0)
* phpseclib/phpseclib (3.0.49 to 3.0.55)
* pimple/pimple (3.6.1 to 3.6.2)
* sabre/dav (4.7.0 to 4.7.1)
* sabre/event (5.1.7 to 5.1.8)
* sabre/vobject (4.5.8 to 4.6.1)
* symfony/console (v7.4.7 to v7.4.14)
* symfony/event-dispatcher (v7.4.9 to v7.4.14)
* symfony/mailer (v7.4.6 to v7.4.14)
* symfony/process (v7.4.5 to v7.4.13)
* symfony/routing (v7.4.6 to v7.4.13)
* symfony/string (v7.4.6 to v7.4.13)
* symfony/translation (v7.4.6 to v7.4.14)
* symfony/deprecation-contracts (v3.6.0 to v3.7.1)
* symfony/event-dispatcher-contracts (v3.7.0 to v3.7.1)
* symfony/service-contracts (v3.7.0 to v3.7.1)
* symfony/translation-contracts (v3.6.1 to v3.7.1)
https://github.com/owncloud/core/pull/41450
https://github.com/owncloud/core/pull/41477
https://github.com/owncloud/core/pull/41495
https://github.com/owncloud/core/pull/41561
https://github.com/owncloud/core/pull/41564
https://github.com/owncloud/core/pull/41569
https://github.com/owncloud/core/pull/41590
https://github.com/owncloud/core/pull/41613
https://github.com/owncloud/core/pull/41619
https://github.com/owncloud/core/pull/41626
https://github.com/owncloud/core/pull/41635
https://github.com/owncloud/core/pull/41639
https://github.com/owncloud/core/pull/41652
https://github.com/owncloud/core/pull/41660
https://github.com/owncloud/core/pull/41666
https://github.com/owncloud/core/pull/41670
https://github.com/owncloud/core/pull/41677
https://github.com/owncloud/core/pull/41681
https://github.com/owncloud/core/pull/41691
https://github.com/owncloud/core/pull/41697
https://github.com/owncloud/core/pull/41709
https://github.com/owncloud/core/pull/41756
* Change - Drop command db:convert-type: [#41451](https://github.com/owncloud/core/pull/41451)
This experimental command is untested and unsupported and therefore removed.
https://github.com/owncloud/core/pull/41451
* Change - Removed legacy and deprecated code from ownCloud 11: [#41455](https://github.com/owncloud/core/pull/41455)
The following have been removed:
* class OC_DB
* class OC_DB_StatementWrapper
* class OC_Group_Backend
* class OC_Group_Database
* class OC_OCS_Result
* class \OCP\DB
* class MDBSchemaWriter
* interface OC_Group_Interface
* interface OC_User_Interface
* method MDB2SchemaManager::getDbStructure()
* method MDB2SchemaManager::generateChangeScript()
https://github.com/owncloud/core/pull/41455
https://github.com/owncloud/core/pull/41458
https://github.com/owncloud/core/pull/41462
https://github.com/owncloud/core/pull/41464
https://github.com/owncloud/core/pull/41468
* Change - Use configurable URL for internet connectivity check: [#41506](https://github.com/owncloud/core/pull/41506)
Default URL is now configurable and the default is set to an independent
resource: https://detectportal.firefox.com/success.txt This also provides an
IPv6 compatible URL.
https://github.com/owncloud/core/issues/41465
https://github.com/owncloud/core/pull/41506
* Change - Use phan major version 6 code analysis: [#41650](https://github.com/owncloud/core/pull/41650)
Now that PHP 7 support has been dropped, we can use the latest release of the
phan code analyser.
Patch releases before 6.0.7 had a problem with the function signatures for some
Redis methods. That was corrected in https://github.com/phan/phan/pull/5546 and
released in phan version 6.0.7. So that version is required as the minimum here.
https://github.com/owncloud/core/pull/41650
* Change - Remove msteamsbridge config sample: [#41668](https://github.com/owncloud/core/pull/41668)
The owncloud/msteamsbridge integration app is being archived and is no longer
maintained. Its Microsoft Teams Bridge config sample block has been removed from
config.apps.sample.php so the config-to-docs sync no longer re-adds the
parameters to the admin documentation.
https://github.com/owncloud/core/pull/41668
* Change - G2 code-signing verifier and G1 signature sunset: [#41680](https://github.com/owncloud/core/pull/41680)
We've replaced the app-signature verification with a new G2 code-signing
verifier that validates the full certificate chain against bundled trust
anchors, enforces an algorithm allowlist, and checks a fail-closed CRL for
revocation.
Existing G1-signed apps continue to verify during the transition. However, all
G1 signatures stop verifying on 2027-01-01 (the hardcoded sunset at
2026-12-31T23:59:59Z), regardless of individual certificate expiry. After that
cutoff, affected apps must be re-signed with a G2 certificate to install or pass
integrity verification. Administrators running third-party apps signed under G1
should plan for re-signed releases ahead of that date.
https://github.com/owncloud/core/pull/41680
* Change - Remove occ integrity:sign-app and integrity:sign-core commands: [#41712](https://github.com/owncloud/core/pull/41712)
We've removed the occ integrity:sign-app and integrity:sign-core console
commands along with the signing-only code in the integrity checker
(createSignatureData, writeAppSignature and writeCoreSignature). Code signing is
a release and CI concern rather than an operator action performed against a
running instance, so this code was dead weight in the security-sensitive
integrity subsystem.
Integrity verification is unaffected: the integrity:check-app and
integrity:check-core commands and all signature verification continue to work as
before.
https://github.com/owncloud/core/pull/41712
* Change - Remove the caching router: [#41733](https://github.com/owncloud/core/pull/41733)
Generated urls are no longer stored in the memory cache. Measurement showed
generating a url to be faster than a cache round trip, so the cache only added a
place where urls could go stale or be tampered with.
https://github.com/owncloud/core/pull/41733
* Change - Keep host local caches in the local cache tier: [#41734](https://github.com/owncloud/core/pull/41734)
The image paths of the active theme and the mimetype id map were stored in the
distributed memory cache although both are derived from the files and the
database of a single instance. They now use the host local cache tier and their
entries expire, so a stale entry is scoped to one node and no longer lives
forever. The repair step for mimetypes deletes rows from the mimetype table and
now clears the mimetype cache afterwards, and occ upgrade clears both cache
tiers instead of only the distributed one.
https://github.com/owncloud/core/pull/41734
* Change - Cover HTML metacharacters in the username validation allow-list: [#41738](https://github.com/owncloud/core/pull/41738)
The username allow-list in OC\User\Manager::createUser() already rejects every
character outside "a-z", "A-Z", "0-9" and "+_.@-'", which blocks HTML and script
metacharacters from ever reaching a stored username. That behaviour was only
covered by three generic invalid-character cases, none of which resembled an
injection payload.
The invalid-character data provider now also exercises quote, angle-bracket and
full script-tag payloads, so any future relaxation of the allow-list that would
let markup into a username fails the test suite instead of passing unnoticed.
This is test-only coverage; no production behaviour changes.
https://github.com/owncloud/core/pull/41738
* Change - Expose createLocal() on ICacheFactory: [#41753](https://github.com/owncloud/core/pull/41753)
The cache factory has always been able to hand out a cache from the host local
tier, but the method was missing from the public ICacheFactory interface, so
core had to ask for it defensively and apps had no way to use it at all. It is
now part of the interface, which lets values that are only meaningful on the
machine that produced them be kept out of the cache shared between the nodes of
an installation.
Note for app developers: a class implementing OCP\ICacheFactory has to declare
createLocal() from this release on.
https://github.com/owncloud/core/pull/41753
* Change - Escape group names in the users administration group list: [#41758](https://github.com/owncloud/core/pull/41758)
The group list in the users administration panel built each list item by
concatenating the group id and group name into an HTML string, so both values
were interpreted as markup rather than text. Unlike usernames, group names are
not restricted to an allow-listed character set - Group\Manager::createGroup()
only rejects empty and untrimmed names - so a name containing HTML characters
was not rendered verbatim. Both interpolated values are now passed through
escapeHTML(), which makes the encoding consistent with the user rows, and the
behaviour is covered by tests in settings/tests/js/users/groupsSpec.js.
https://github.com/owncloud/core/pull/41758
* Change - Honour the write hook veto on legacy chunked WebDAV uploads: [#41762](https://github.com/owncloud/core/pull/41762)
The legacy WebDAV chunked upload path assembled the final file without
respecting the pre-write hook result, so the filename blacklist that applies to
ordinary uploads was not enforced for chunked uploads. The chunked assembly now
aborts when a write hook vetoes the file, matching the non-chunked upload path.
https://github.com/owncloud/core/pull/41762
# Changelog for ownCloud Core [10.16.4] (2026-07-29)
The following sections list the changes in ownCloud core 10.16.4 relevant to
ownCloud admins and users.
[10.16.4]: https://github.com/owncloud/core/compare/v10.16.3...v10.16.4
## Summary
* Bugfix - Fix subadmin email change updating caller's address instead of target's: [#41574](https://github.com/owncloud/core/pull/41574)
* Change - Honour the write hook veto on legacy chunked WebDAV uploads: [#41763](https://github.com/owncloud/core/pull/41763)
## Details
* Bugfix - Fix subadmin email change updating caller's address instead of target's: [#41574](https://github.com/owncloud/core/pull/41574)
The verification token and confirmation link in the subadmin path of
setMailAddress were associated with the caller's account instead of the target
user's account. Clicking the confirmation link changed the subadmin's email
rather than the intended target's email.
https://github.com/owncloud/core/pull/41574
* Change - Honour the write hook veto on legacy chunked WebDAV uploads: [#41763](https://github.com/owncloud/core/pull/41763)
The legacy WebDAV chunked upload path assembled the final file without
respecting the pre-write hook result, so the filename blacklist that applies to
ordinary uploads was not enforced for chunked uploads. The chunked assembly now
aborts when a write hook vetoes the file, matching the non-chunked upload path.
https://github.com/owncloud/core/pull/41763
# Changelog for ownCloud Core [10.16.3] (2026-05-22)
The following sections list the changes in ownCloud core 10.16.3 relevant to
ownCloud admins and users.
[10.16.3]: https://github.com/owncloud/core/compare/v10.16.2...v10.16.3
## Summary
* Security - Update phpseclib to 3.0.52 for CVE-2026-40194: [#41529](https://github.com/owncloud/core/pull/41529)
* Security - Restrict AppConfigController read methods to full admins only: [#41550](https://github.com/owncloud/core/pull/41550)
* Security - Update symfony/routing to 5.4.52 for CVE-2026-45065: [#41559](https://github.com/owncloud/core/pull/41559)
* Bugfix - Prevent mounting local storage if not allowed: [#41538](https://github.com/owncloud/core/pull/41538)
* Bugfix - Use the correct user ID when changing email via admin API: [#41539](https://github.com/owncloud/core/pull/41539)
* Bugfix - Prevent IDOR in WebDAV comments API: [#41558](https://github.com/owncloud/core/pull/41558)
## Details
* Security - Update phpseclib to 3.0.52 for CVE-2026-40194: [#41529](https://github.com/owncloud/core/pull/41529)
CVE-2026-40194: Timing attack vulnerability in SSH binary packet processing.
Upgraded phpseclib/phpseclib from 3.0.50 to 3.0.52.
https://github.com/owncloud/core/pull/41529
https://github.com/owncloud/core/pull/41541
https://github.com/phpseclib/phpseclib/releases/tag/3.0.51
* Security - Restrict AppConfigController read methods to full admins only: [#41550](https://github.com/owncloud/core/pull/41550)
Subadmin users could read all oc_appconfig values including SMTP passwords, LDAP
bind credentials, and encryption master keys via the Settings API. Removed
@NoAdminRequired from getApps, getKeys, and getValue so that the AdminMiddleware
enforces full-admin-only access, consistent with the write methods.
https://github.com/owncloud/core/pull/41550
* Security - Update symfony/routing to 5.4.52 for CVE-2026-45065: [#41559](https://github.com/owncloud/core/pull/41559)
CVE-2026-45065: UrlGenerator route-requirement bypass via unanchored regex
alternation allowing off-site URL injection. Upgraded symfony/routing from
5.4.48 to 5.4.52.
https://github.com/owncloud/core/pull/41559
https://symfony.com/cve-2026-45065
* Bugfix - Prevent mounting local storage if not allowed: [#41538](https://github.com/owncloud/core/pull/41538)
Mounting a local storage was possible if the internal class name was used as
backend, despite local storage not allowed to be mounted. This problem is fixed
and the local storage can't be mounted if it was explicitly disallowed in the
configuration.
https://github.com/owncloud/core/pull/41538
* Bugfix - Use the correct user ID when changing email via admin API: [#41539](https://github.com/owncloud/core/pull/41539)
The admin API endpoint for changing a user's email address was incorrectly using
the requesting admin's user ID instead of the target user's ID, causing the
admin's email to be updated rather than the intended user's.
https://github.com/owncloud/core/pull/41539
* Bugfix - Prevent IDOR in WebDAV comments API: [#41558](https://github.com/owncloud/core/pull/41558)
Authenticated users could read, edit, or delete comments on files they have no
access to by supplying an arbitrary comment ID in the WebDAV comments endpoint.
The fix verifies that a requested comment belongs to the file in the URL before
returning it.
https://github.com/owncloud/core/pull/41558
# Changelog for ownCloud Core [10.16.2] (2026-04-02)
The following sections list the changes in ownCloud core 10.16.2 relevant to
ownCloud admins and users.
[10.16.2]: https://github.com/owncloud/core/compare/v10.16.1...v10.16.2
## Summary
* Change - Update dependencies: [#41518](https://github.com/owncloud/core/pull/41518)
## Details
* Change - Update dependencies: [#41518](https://github.com/owncloud/core/pull/41518)
The following have been updated: - phpseclib/phpseclib (3.0.49 to 3.0.50) -
minimatch (3.1.2 to 3.1.5) - underscore.js (1.13.6 to 1.13.8) - brace-expansion
(1.1.12 to 1.1.13)
https://github.com/owncloud/core/pull/41518
# Changelog for ownCloud Core [10.16.1] (2026-02-18)
The following sections list the changes in ownCloud core 10.16.1 relevant to
ownCloud admins and users.
[10.16.1]: https://github.com/owncloud/core/compare/v10.16.0...v10.16.1
## Summary
* Bugfix - Apply SVG sanitization to all file content before using ImageMagick: [#41433](https://github.com/owncloud/core/pull/41433)
* Bugfix - Disallow empty tokens when pairing trusted servers: [#41434](https://github.com/owncloud/core/pull/41434)
* Change - Update PHP dependencies: [#41408](https://github.com/owncloud/core/pull/41408)
* Enhancement - Add mimetype aliases/mapping for .toml and .ovpn: [#41431](https://github.com/owncloud/core/pull/41431)
## Details
* Bugfix - Apply SVG sanitization to all file content before using ImageMagick: [#41433](https://github.com/owncloud/core/pull/41433)
Any file content is now sanitized for SVG threats before being processed by
ImageMagick, preventing potential security vulnerabilities.
https://github.com/owncloud/core/pull/41433
* Bugfix - Disallow empty tokens when pairing trusted servers: [#41434](https://github.com/owncloud/core/pull/41434)
An empty token could be used to pair trusted servers, which is not secure.
https://github.com/owncloud/core/pull/41434
* Change - Update PHP dependencies: [#41408](https://github.com/owncloud/core/pull/41408)
The following have been updated: - monolog/monolog (2.10.0 to 2.11.0) -
pear/pear-core-minimal (v1.10.16 to v1.10.18) - phpseclib/phpseclib (3.0.47 to
3.0.48) - phpseclib/phpseclib (3.0.46 to 3.0.49) - pimple/pimple (3.5.0 to
3.6.0) - sabre/http (5.1.12 to 5.1.13) - sabre/vobject (4.5.7 to 4.5.8) -
symfony/process (5.4.47 to 5.4.51) - theseer/tokenizer (1.2.3 to 1.3.1)
https://github.com/owncloud/core/pull/41408
https://github.com/owncloud/core/pull/41421
https://github.com/owncloud/core/pull/41446
* Enhancement - Add mimetype aliases/mapping for .toml and .ovpn: [#41431](https://github.com/owncloud/core/pull/41431)
Mimetype aliases and mapping for .toml and .ovpn files got added.
https://github.com/owncloud/core/pull/41431
# Changelog for ownCloud Core [10.16.0] (2025-10-23)
The following sections list the changes in ownCloud core 10.16.0 relevant to
ownCloud admins and users.
[10.16.0]: https://github.com/owncloud/core/compare/v10.15.3...v10.16.0
## Summary
* Bugfix - Unavailable shares storage will not block folder listing: [#41338](https://github.com/owncloud/core/pull/41338)
* Bugfix - Subadmins won't add users to groups: [#41405](https://github.com/owncloud/core/pull/41405)
* Bugfix - The phar stream wrapper is disabled by default: [#41406](https://github.com/owncloud/core/pull/41406)
* Change - Update PHP dependencies: [#41287](https://github.com/owncloud/core/pull/41287)
* Change - Add user hint in share dialog that password policy can apply: [#41314](https://github.com/owncloud/core/pull/41314)
* Enhancement - Improve global search experience for Chinese and Japanese input: [#41328](https://github.com/owncloud/core/pull/41328)
## Details
* Bugfix - Unavailable shares storage will not block folder listing: [#41338](https://github.com/owncloud/core/pull/41338)
In case a shared storage is not available in certain situations no folder
listing would be shown to the user.
https://github.com/owncloud/core/pull/41338
* Bugfix - Subadmins won't add users to groups: [#41405](https://github.com/owncloud/core/pull/41405)
Subadmins won't be able to add user to groups, not even to groups they're
managing. Only admins will be able to.
https://github.com/owncloud/core/pull/41405
* Bugfix - The phar stream wrapper is disabled by default: [#41406](https://github.com/owncloud/core/pull/41406)
Previously, it was only disabled for non-cli access, but now it's disabled
globally.
https://github.com/owncloud/core/pull/41406
* Change - Update PHP dependencies: [#41287](https://github.com/owncloud/core/pull/41287)
The following have been updated: - doctrine/deprecations (1.1.3 to 1.1.5) -
google/apiclient (v2.16.0 to v2.16.1) - google/auth (v1.37.1 to v1.37.2) -
guzzlehttp/guzzle (7.8.1 to 7.9.3) - guzzlehttp/promises (2.0.3 to 2.2.0) -
guzzlehttp/psr7 (2.7.0 to 2.7.1) - icewind/smb (3.6.0 to 3.7.0) -
icewind/streams (0.7.7 to 0.7.8) - laravel/serializable-closure (1.3.3 to 1.3.7)
- league/mime-type-detection (1.15.0 to 1.16.0) - mikey179/vfsstream (1.6.11 to
1.6.12) - monolog/monolog (2.9.3 to 2.10.0) - myclabs/deep-copy (1.12.1 to
1.13.4) - pear/pear-core-minimal (v1.10.15 to v1.10.16) - pear/archive_tar
(1.5.0 to 1.6.0) - phpseclib/phpseclib (3.0.39 to 3.0.46) - sabre/dav (4.6.0 to
4.7.0) - sabre/event (5.1.4 to 5.1.7) - sabre/http (5.1.10 to 5.1.12) -
sabre/uri (2.3.3 t0 2.3.4) - sabre/vobject (4.5.4 to 4.5.7) - sabre/xml (2.2.7
to 2.2.11) - symfony/console (5.4.40 to 5.4.47) - symfony/deprecation-contracts
(2.5.3 to 2.5.4) - symfony/event-dispatcher (5.4.40 to 5.4.45) -
symfony/event-dispatcher-contracts (2.5.3 to 2.5.4) - symfony/polyfill-php80
(1.29.0 to 1.33.0) - symfony/process (v5.4.40 to v5.4.47) - symfony/routing
(5.4.40 to 5.4.48) - symfony/service-contracts (2.5.3 to 2.5.4) - symfony/string
(5.4.40 to 5.4.47) - symfony/translation (5.4.40 to 5.4.45) -
symfony/translation-contracts (2.5.3 to 2.5.4)
https://github.com/owncloud/core/pull/41287
https://github.com/owncloud/core/pull/41297
https://github.com/owncloud/core/pull/41306
https://github.com/owncloud/core/pull/41307
https://github.com/owncloud/core/pull/41315
https://github.com/owncloud/core/pull/41320
https://github.com/owncloud/core/pull/41327
https://github.com/owncloud/core/pull/41329
https://github.com/owncloud/core/pull/41333
https://github.com/owncloud/core/pull/41334
https://github.com/owncloud/core/pull/41337
https://github.com/owncloud/core/pull/41341
https://github.com/owncloud/core/pull/41344
https://github.com/owncloud/core/pull/41345
https://github.com/owncloud/core/pull/41363
https://github.com/owncloud/core/pull/41366
https://github.com/owncloud/core/pull/41377
https://github.com/owncloud/core/pull/41382
https://github.com/owncloud/core/pull/41390
* Change - Add user hint in share dialog that password policy can apply: [#41314](https://github.com/owncloud/core/pull/41314)
To avoid user confusion the share dialog informs the user that password policy
can apply in case enabled.
https://github.com/owncloud/core/pull/41314
* Enhancement - Improve global search experience for Chinese and Japanese input: [#41328](https://github.com/owncloud/core/pull/41328)
Now the minimum characters input required is 2 for Chinese/Japanese inputs when
performing global search.
https://github.com/owncloud/core/issues/25021
https://github.com/owncloud/core/issues/9916
https://github.com/owncloud/core/pull/41328
# Changelog for ownCloud Core [10.15.3] (2025-07-04)
The following sections list the changes in ownCloud core 10.15.3 relevant to
ownCloud admins and users.
[10.15.3]: https://github.com/owncloud/core/compare/v10.15.2...v10.15.3
## Summary
* Bugfix - Disable web updater: [#41149](https://github.com/owncloud/core/issues/41149)
* Bugfix - Harden remote service resolution: [#41374](https://github.com/owncloud/core/pull/41374)
## Details
* Bugfix - Disable web updater: [#41149](https://github.com/owncloud/core/issues/41149)
The web updater is a relic of the past and not recommended for a long time. At
the end it can cause more pain than help.
In addition the use of the web updater is discouraged by removing the
integration in the admin ui.
CVE: CVE-2025-53827
https://github.com/owncloud/core/issues/41149
https://github.com/owncloud/core/pull/41385
* Bugfix - Harden remote service resolution: [#41374](https://github.com/owncloud/core/pull/41374)
Remote services such as webdav, caldav, etc, will be loaded from the app or from
a hardcoded list.
CVE: CVE-2025-53829
https://github.com/owncloud/core/pull/41374
# Changelog for ownCloud Core [10.15.2] (2025-03-11)
The following sections list the changes in ownCloud core 10.15.2 relevant to
ownCloud admins and users.
[10.15.2]: https://github.com/owncloud/core/compare/v10.15.1...v10.15.2
## Summary
* Security - Disable phar stream wrapper: [#41358](https://github.com/owncloud/core/pull/41358)
## Details
* Security - Disable phar stream wrapper: [#41358](https://github.com/owncloud/core/pull/41358)
CVE: CVE-2025-32804
https://github.com/owncloud/core/pull/41358
# Changelog for ownCloud Core [10.15.1] (2025-03-03)
The following sections list the changes in ownCloud core 10.15.1 relevant to
ownCloud admins and users.
[10.15.1]: https://github.com/owncloud/core/compare/v10.15.0...v10.15.1
## Summary
* Bugfix - Prevent access to internal app config data: [#41355](https://github.com/owncloud/core/pull/41355)
## Details
* Bugfix - Prevent access to internal app config data: [#41355](https://github.com/owncloud/core/pull/41355)
Prevent access to app config where the key is prefixed with remote_ and public_
via the http api as these are internal configuration settings which are not to
be exposed via the network.
CVE: CVE-2025-27844
https://github.com/owncloud/core/pull/41355
# Changelog for ownCloud Core [10.15.0] (2024-06-18)
The following sections list the changes in ownCloud core 10.15.0 relevant to
ownCloud admins and users.
[10.15.0]: https://github.com/owncloud/core/compare/v10.14.0...v10.15.0
## Summary
* Bugfix - Fail fast on unresponsive remote servers: [#41210](https://github.com/owncloud/core/pull/41210)
* Bugfix - Link in public link notification has to be from a trusted domain: [#41214](https://github.com/owncloud/core/pull/41214)
* Bugfix - User can only change their own external storage configuration: [#41225](https://github.com/owncloud/core/pull/41225)
* Bugfix - Hardening SVG processing: [#41234](https://github.com/owncloud/core/pull/41234)
* Bugfix - Handle no longer existing user in preview cleanup: [#41247](https://github.com/owncloud/core/pull/41247)
* Bugfix - Disallow HTTP API requests for user external storages in case disabled: [#41250](https://github.com/owncloud/core/pull/41250)
* Bugfix - Handle short classes in Autoloader: [#41252](https://github.com/owncloud/core/pull/41252)
* Bugfix - No update check if not connected to the internet: [#41262](https://github.com/owncloud/core/pull/41262)
* Bugfix - Default value of preview_max_dimensions is now 6016x6016: [#41263](https://github.com/owncloud/core/pull/41263)
* Bugfix - AllConfig::getUserKeys to return string[] only: [#41270](https://github.com/owncloud/core/pull/41270)
* Bugfix - Wrong Logic When 'allow_user_mounting' is Initially Undefined: [#41272](https://github.com/owncloud/core/pull/41272)
* Change - Update PHP dependencies: [#41195](https://github.com/owncloud/core/pull/41195)
## Details
* Bugfix - Fail fast on unresponsive remote servers: [#41210](https://github.com/owncloud/core/pull/41210)
In case a remote/federated server is not responding the share will not be added
and any requests will fail faster.
https://github.com/owncloud/core/pull/41210
* Bugfix - Link in public link notification has to be from a trusted domain: [#41214](https://github.com/owncloud/core/pull/41214)
https://github.com/owncloud/core/pull/41214
* Bugfix - User can only change their own external storage configuration: [#41225](https://github.com/owncloud/core/pull/41225)
https://github.com/owncloud/core/pull/41225
* Bugfix - Hardening SVG processing: [#41234](https://github.com/owncloud/core/pull/41234)
Purify SVGs before processing.
https://github.com/owncloud/core/pull/41234
* Bugfix - Handle no longer existing user in preview cleanup: [#41247](https://github.com/owncloud/core/pull/41247)
A no longer existing user no longer causes an exception in the preview cleanup
job.
https://github.com/owncloud/core/pull/41247
* Bugfix - Disallow HTTP API requests for user external storages in case disabled: [#41250](https://github.com/owncloud/core/pull/41250)
API requests for a user's external storages now correctly fail when user mounted
storages are disabled.
https://github.com/owncloud/core/pull/41250
* Bugfix - Handle short classes in Autoloader: [#41252](https://github.com/owncloud/core/pull/41252)
The Autoloader findClass method was emitting a PHP notice "undefined offset" for
class strings at the top OCA level. The code has been corrected so that the PHP
notice is not emitted.
https://github.com/owncloud/core/pull/41252
https://github.com/owncloud/core/pull/41253
* Bugfix - No update check if not connected to the internet: [#41262](https://github.com/owncloud/core/pull/41262)
In case an owncloud instance is not connected to the internet there is no need
in polling for updates in the update notification app.
https://github.com/owncloud/core/pull/41262
* Bugfix - Default value of preview_max_dimensions is now 6016x6016: [#41263](https://github.com/owncloud/core/pull/41263)
This allows processing of 4K portrait images by default.
https://github.com/owncloud/core/pull/41263
* Bugfix - AllConfig::getUserKeys to return string[] only: [#41270](https://github.com/owncloud/core/pull/41270)
The array returned by getUserKeys() is now always an array of strings.
https://github.com/owncloud/core/pull/41270
* Bugfix - Wrong Logic When 'allow_user_mounting' is Initially Undefined: [#41272](https://github.com/owncloud/core/pull/41272)
On a freshly installed system, the checkbox '[ ] Allow users to mount external
storage' is not set, implying 'no'. The code handled this as 'yes' until the
admin once selected and unselected the checkbox.
https://github.com/owncloud/core/pull/41272
https://github.com/owncloud/core/pull/41273
* Change - Update PHP dependencies: [#41195](https://github.com/owncloud/core/pull/41195)
The following have been updated: - deepdiver/zipstreamer (2.0.2 to 2.0.3) -
google/apiclient (v2.15.3 to v2.16.0) - google/apiclient-services (v0.335.0 to
v0.355.0) - google/auth (v1.35.0 to v1.37.1) - monolog/monolog (2.9.2 to 2.9.3)
- paragonie/constant_time_encoding (v2.6.3 to v2.7.0) - pear/archive_tar (1.4.14
to 1.15.0) - pear/pear-core-minimal (v1.10.14 to v1.10.15) - phpseclib/phpseclib
(3.0.35 to 3.0.39) - psr/http-factory (1.0.2 to 1.1.0) - sabre/xml (2.2.6 to
2.2.7) - symfony/event-dispatcher-contracts (v2.5.2 to v2.5.3) -
symfony/service-contracts (v2.5.2 to v2.5.3) - symfony/translation-contracts
(v2.5.2 to v2.5.3) - symfony/console (v5.4.35 to v5.4.40) -
symfony/event-dispatcher (v5.4.35 to v5.4.40) - symfony/process (v5.4.35 to
v5.4.40) - symfony/routing (v5.4.35 to v5.4.40) - symfony/string (v5.4.35 to
v5.4.40) - symfony/translation (v5.4.35 to v5.4.40)
https://github.com/owncloud/core/pull/41195
https://github.com/owncloud/core/pull/41203
https://github.com/owncloud/core/pull/41205
https://github.com/owncloud/core/pull/41212
https://github.com/owncloud/core/pull/41222
https://github.com/owncloud/core/pull/41230
https://github.com/owncloud/core/pull/41242
https://github.com/owncloud/core/pull/41255
https://github.com/owncloud/core/pull/41259
https://github.com/owncloud/core/pull/41267
https://github.com/owncloud/core/pull/41276
# Changelog for ownCloud Core [10.14.0] (2024-02-19)
The following sections list the changes in ownCloud core 10.14.0 relevant to
ownCloud admins and users.
[10.14.0]: https://github.com/owncloud/core/compare/v10.13.4...v10.14.0
## Summary
* Bugfix - Validate comment verb length: [#40965](https://github.com/owncloud/core/pull/40965)
* Bugfix - Log.conditions with `shared_secret` shall not break file uploads: [#41044](https://github.com/owncloud/core/pull/41044)
* Bugfix - Create previews from first page: [#41045](https://github.com/owncloud/core/pull/41045)
* Bugfix - CalDAV query where the time range is not given: [#41050](https://github.com/owncloud/core/pull/41050)
* Bugfix - Store user information in explicit variable: [#41054](https://github.com/owncloud/core/pull/41054)
* Bugfix - Fix expiration date and eliminate duplicate entries in file list: [#41056](https://github.com/owncloud/core/pull/41056)
* Bugfix - LDAP groups will be properly applied to external storages: [#41063](https://github.com/owncloud/core/pull/41063)
* Bugfix - Disallow browsers to translate the frontend: [#41067](https://github.com/owncloud/core/pull/41067)
* Bugfix - Limit performance impact when version meta data is enabled: [#41069](https://github.com/owncloud/core/pull/41069)
* Bugfix - Proper error handling when deleting users or groups: [#41077](https://github.com/owncloud/core/pull/41077)
* Bugfix - Account terms can be removed if they differ with the ones stored: [#41120](https://github.com/owncloud/core/pull/41120)
* Bugfix - "user:list -a" occ command now correctly displays user's creation time: [#41125](https://github.com/owncloud/core/pull/41125)
* Bugfix - Fix log exceptions for mp3 preview: [#41153](https://github.com/owncloud/core/pull/41153)
* Bugfix - Set oc_file_locks.id to bigint: [#41158](https://github.com/owncloud/core/pull/41158)
* Bugfix - Add compatibility to richdocuments.document.index route: [#41161](https://github.com/owncloud/core/pull/41161)
* Bugfix - Sanitize title in dialogs: [#41166](https://github.com/owncloud/core/pull/41166)
* Bugfix - Decommission of templateeditor app: [#41168](https://github.com/owncloud/core/pull/41168)
* Bugfix - Input validation when setting the displayname of a user or self: [#41172](https://github.com/owncloud/core/pull/41172)
* Bugfix - Image dimension validation on avatar upload and preview generation: [#41175](https://github.com/owncloud/core/pull/41175)
* Change - Update PHP dependencies: [#41033](https://github.com/owncloud/core/pull/41033)
* Change - No activities on rejected shares: [#41078](https://github.com/owncloud/core/pull/41078)
* Enhancement - Replace the isAdmin implementation: [#41171](https://github.com/owncloud/core/pull/41171)
## Details
* Bugfix - Validate comment verb length: [#40965](https://github.com/owncloud/core/pull/40965)
User input validation of comment verb
https://github.com/owncloud/core/pull/40965
* Bugfix - Log.conditions with `shared_secret` shall not break file uploads: [#41044](https://github.com/owncloud/core/pull/41044)
Any file upload (or PUT request in general) could cause a 500/Internal Server
Error due to wrong usage of the request object. This is now fixed.
https://github.com/owncloud/core/pull/41044
* Bugfix - Create previews from first page: [#41045](https://github.com/owncloud/core/pull/41045)
On multi-page documents (doc, odt, pdf etc) the preview will now be generated
from the first page and no longer from the last page.
https://github.com/owncloud/core/pull/41045
* Bugfix - CalDAV query where the time range is not given: [#41050](https://github.com/owncloud/core/pull/41050)
Outlook CalDAV plugin is sending `false` as time range which no longer results
in a crash.
https://github.com/owncloud/core/issues/39922
https://github.com/owncloud/core/pull/41050
* Bugfix - Store user information in explicit variable: [#41054](https://github.com/owncloud/core/pull/41054)
Before user information was stored in the browser global object. In some rare
cases browsers seem to loose data stored in the global object. This is fixed
now.
https://github.com/owncloud/enterprise/issues/5873
https://github.com/owncloud/core/pull/41054
* Bugfix - Fix expiration date and eliminate duplicate entries in file list: [#41056](https://github.com/owncloud/core/pull/41056)
We've addressed two visual issues in the web ui file list. Firstly, the problem
where the start of the epoch was mistakenly displayed as an expiration date in
the shared file list has been resolved. Secondly, we've tackled the pesky bug
causing duplicate entries to appear when switching between shared tabs and
clicking on a file list entry.
https://github.com/owncloud/core/pull/41056
* Bugfix - LDAP groups will be properly applied to external storages: [#41063](https://github.com/owncloud/core/pull/41063)
The admin can setup external storages to be used by specific users and groups.
When a LDAP group was setup, there were some issues so users belonging to that
group weren't able to access the external storage even though they should.
Now, users belonging to LDAP groups can access external storages configured to
be accessed by those groups.
https://github.com/owncloud/core/pull/41063
* Bugfix - Disallow browsers to translate the frontend: [#41067](https://github.com/owncloud/core/pull/41067)
Web frontend offers a lot of proper translations. Browser capabilities are not
needed.
https://github.com/owncloud/core/issues/39946
https://github.com/owncloud/core/pull/41067
* Bugfix - Limit performance impact when version meta data is enabled: [#41069](https://github.com/owncloud/core/pull/41069)
Negative performance impact when `file_storage.save_version_metadata` is enabled
has been removed.
https://github.com/owncloud/core/pull/41069
* Bugfix - Proper error handling when deleting users or groups: [#41077](https://github.com/owncloud/core/pull/41077)
https://github.com/owncloud/core/pull/41077
https://github.com/owncloud/core/pull/41075
* Bugfix - Account terms can be removed if they differ with the ones stored: [#41120](https://github.com/owncloud/core/pull/41120)
Search terms for the account can now be removed from the DB if they differ with
the ones stored in the DB. This can happen with the user_ldap app, when user
search attributes are removed from the connection configuration in the LDAP
wizard.
https://github.com/owncloud/core/pull/41120
* Bugfix - "user:list -a" occ command now correctly displays user's creation time: [#41125](https://github.com/owncloud/core/pull/41125)
Previously, the "user:list -a" occ command was not correctly returning the
user's creation time but rather the path to the user's home directory. This has
been now fixed.
https://github.com/owncloud/core/pull/41125
* Bugfix - Fix log exceptions for mp3 preview: [#41153](https://github.com/owncloud/core/pull/41153)
This change fixes log exceptions when previews for mp3 files are being created
https://github.com/owncloud/core/pull/41153
* Bugfix - Set oc_file_locks.id to bigint: [#41158](https://github.com/owncloud/core/pull/41158)
https://github.com/owncloud/core/pull/41158
* Bugfix - Add compatibility to richdocuments.document.index route: [#41161](https://github.com/owncloud/core/pull/41161)
https://github.com/owncloud/core/pull/41161
* Bugfix - Sanitize title in dialogs: [#41166](https://github.com/owncloud/core/pull/41166)
https://github.com/owncloud/core/pull/41166
* Bugfix - Decommission of templateeditor app: [#41168](https://github.com/owncloud/core/pull/41168)
https://github.com/owncloud/core/pull/41168
* Bugfix - Input validation when setting the displayname of a user or self: [#41172](https://github.com/owncloud/core/pull/41172)
https://github.com/owncloud/core/pull/41172
* Bugfix - Image dimension validation on avatar upload and preview generation: [#41175](https://github.com/owncloud/core/pull/41175)
https://github.com/owncloud/core/pull/41175
https://github.com/owncloud/core/pull/41193
* Change - Update PHP dependencies: [#41033](https://github.com/owncloud/core/pull/41033)
The following have been updated: - deepdiver/zipstreamer (2.0.0 to v2.0.2) -
doctrine/deprecations (1.1.2 to 1.1.3) - doctrine/lexer (2.1.0 to 2.1.1) -
firebase/php-jwt (6.8.1 to 6.10.0) - google/apiclient (v2.15.1 to v2.15.3) -
google/apiclient-services (v0.319.0 to v0.335.0) - google/auth (v1.31.0 to
v1.35.0) - guzzlehttp/guzzle (7.8.0 to 7.8.1) - laravel/serializable-closure
(v1.3.1 to v1.3.3) - league/mime-type-detection (1.13.0 to 1.15.0) -
monolog/monolog (2.9.1 to 2.9.2) - phpseclib/phpseclib (3.0.33 to 3.0.35) -
sabre/dav (4.4.0 to 4.6.0) - sabre/vobject (4.5.3 to 4.5.4) - symfony/console
(5.4.28 to 5.4.35) - symfony/event-dispatcher (5.4.26 to 5.4.35) -
symfony/polyfill-php80 (v1.28.0 to v1.29.0) - symfony/process (5.4.28 to 5.4.35)
- symfony/routing (5.4.26 to 5.4.35) - symfony/string (5.4.29 to 5.4.35) -
symfony/translation (5.4.24 to 5.4.35)
https://github.com/owncloud/core/pull/41033
https://github.com/owncloud/core/pull/41071
https://github.com/owncloud/core/pull/41081
https://github.com/owncloud/core/pull/41097
https://github.com/owncloud/core/pull/41101
https://github.com/owncloud/core/pull/41102
https://github.com/owncloud/core/pull/41121
https://github.com/owncloud/core/pull/41126
https://github.com/owncloud/core/pull/41130
https://github.com/owncloud/core/pull/41132
https://github.com/owncloud/core/pull/41133
https://github.com/owncloud/core/pull/41139
https://github.com/owncloud/core/pull/41151
https://github.com/owncloud/core/pull/41152
https://github.com/owncloud/core/pull/41155
https://github.com/owncloud/core/pull/41173
https://github.com/owncloud/core/pull/41182
* Change - No activities on rejected shares: [#41078](https://github.com/owncloud/core/pull/41078)
As soon as a user has rejected a share no activities within this share are
reported via the activity app.
https://github.com/owncloud/core/pull/41078
* Enhancement - Replace the isAdmin implementation: [#41171](https://github.com/owncloud/core/pull/41171)
Instead of asking the backends for the groups an user belongs to, we now get the
admin group and list the members to detect if user is admin or not
https://github.com/owncloud/core/pull/41171
# Changelog for ownCloud Core [10.13.4] (2023-12-13)
The following sections list the changes in ownCloud core 10.13.4 relevant to
ownCloud admins and users.
[10.13.4]: https://github.com/owncloud/core/compare/v10.13.3...v10.13.4
## Summary
* Bugfix - Check 2FA on controllers which are accessible publicly and authenticated: [#41123](https://github.com/owncloud/core/pull/41123)
* Change - Display IoC-Scanner Prompt: [#41137](https://github.com/owncloud/core/pull/41137)
## Details
* Bugfix - Check 2FA on controllers which are accessible publicly and authenticated: [#41123](https://github.com/owncloud/core/pull/41123)
https://github.com/owncloud/core/pull/41123
* Change - Display IoC-Scanner Prompt: [#41137](https://github.com/owncloud/core/pull/41137)
Prompt the admins of licensed instances to run the IoC-Scanner. The prompt
appears in the admin menu and after an upgrade on the CLI.
https://github.com/owncloud/core/pull/41137
# Changelog for ownCloud Core [10.13.3] (2023-11-17)
The following sections list the changes in ownCloud core 10.13.3 relevant to
ownCloud admins and users.
[10.13.3]: https://github.com/owncloud/core/compare/v10.13.2...v10.13.3
## Summary
* Bugfix - Fix potential issue with the PreviewCleanup job in postgresql: [#41051](https://github.com/owncloud/core/pull/41051)
* Bugfix - Revert https://github.com/owncloud/core/pull/41014 for performance: [#41059](https://github.com/owncloud/core/pull/41059)
* Bugfix - Users can only delete their own external storage configurations: [#41092](https://github.com/owncloud/core/pull/41092)
* Enhancement - Update config.apps.sample.php: [#41104](https://github.com/owncloud/core/pull/41104)
## Details
* Bugfix - Fix potential issue with the PreviewCleanup job in postgresql: [#41051](https://github.com/owncloud/core/pull/41051)
One of the filters of the preview cleanup job requires casting a filename, which
is supposed to contain only digits, to an integer. The expected execution of the
DB query should have filtered the results so the condition above should be true,
but the DB's query planner might choose to apply the filters in a different way,
so we could potentially cast random strings to integer. For the case of
postgresql, the cast function will cause an error if the string can't be casted
to an integer (because it has non-digit chars, for example)
This situation is fixed for all the supported DBs, so we don't require the query
planner to execute the query in any particular way.
https://github.com/owncloud/core/pull/41051
* Bugfix - Revert https://github.com/owncloud/core/pull/41014 for performance: [#41059](https://github.com/owncloud/core/pull/41059)
The https://github.com/owncloud/core/pull/41014 PR introduced performance
problems for large installation. We're reverting that change
https://github.com/owncloud/core/pull/41059
* Bugfix - Users can only delete their own external storage configurations: [#41092](https://github.com/owncloud/core/pull/41092)
https://github.com/owncloud/core/pull/41092
* Enhancement - Update config.apps.sample.php: [#41104](https://github.com/owncloud/core/pull/41104)
Comments describing the configuration variables related to kerberos and
windows_network_drive are now updated and in sync with published online
documentation.
https://github.com/owncloud/core/pull/41104
https://github.com/owncloud/core/pull/41106
https://github.com/owncloud/core/pull/41109
# Changelog for ownCloud Core [10.13.2] (2023-10-04)
The following sections list the changes in ownCloud core 10.13.2 relevant to
ownCloud admins and users.
[10.13.2]: https://github.com/owncloud/core/compare/v10.13.1...v10.13.2
## Summary
* Bugfix - Delete all files from object store when user is deleted: [#40959](https://github.com/owncloud/core/pull/40959)
* Bugfix - Allow subadmins to read app config values: [#40961](https://github.com/owncloud/core/pull/40961)
* Bugfix - Remove regular expression from Preview Manager list: [#40990](https://github.com/owncloud/core/pull/40990)
* Bugfix - Check if account creation time exists for migrations: [#40991](https://github.com/owncloud/core/pull/40991)
* Bugfix - Do not mount shared storage which are failing: [#41014](https://github.com/owncloud/core/pull/41014)
* Change - Update PHP dependencies: [#40983](https://github.com/owncloud/core/pull/40983)
* Enhancement - Improve preview cleanup query: [#40974](https://github.com/owncloud/core/pull/40974)
* Enhancement - Remove "Fill E-Tags" Repair-Step: [#40996](https://github.com/owncloud/core/pull/40996)
## Details
* Bugfix - Delete all files from object store when user is deleted: [#40959](https://github.com/owncloud/core/pull/40959)
As soon as a user is deleted files will also be removed from object storage
(s3). In previous versions when a user was deleted, files belonging to this user
were not correctly removed from the object storage (s3) and were therefore left
as remnants taking unnecessary space. This has been corrected and files are now
properly removed.
https://github.com/owncloud/core/pull/40959
* Bugfix - Allow subadmins to read app config values: [#40961](https://github.com/owncloud/core/pull/40961)
Previously, subadmins couldn't read app config values. This caused problems in
the users page for subadmins because some of the functionalities of the page
were depending on the config values that the subadmins couldn't read. Those
problems are now solved.
https://github.com/owncloud/core/pull/40961
* Bugfix - Remove regular expression from Preview Manager list: [#40990](https://github.com/owncloud/core/pull/40990)
We removed the regular expression related to HEIC and HEIF files from the
Preview Manager list as this was preventing the files_mediaviewer app from
correctly interpreting such mime types. The app is now able to open such files.
https://github.com/owncloud/core/pull/40990
* Bugfix - Check if account creation time exists for migrations: [#40991](https://github.com/owncloud/core/pull/40991)
In some rare scenarios it could have happened that the migration responsible for
adding the creation time in the oc_accounts table was not correctly inserted
into oc_migrations with the consequence that it was reattempted i.e. when
upgrading apps, even if the column was already present. This has been now fixed.
https://github.com/owncloud/core/pull/40991
* Bugfix - Do not mount shared storage which are failing: [#41014](https://github.com/owncloud/core/pull/41014)
Some mounts use a shared storage, which points to a different storage. If the
underlying storage is removed, the share mount was still being present as if the
underlying storage could still be accessed. This was causing problems with the
`occ files:remove-storage --show-candidates` command because the removed storage
wasn't shown as possible candidate.
Now, that share storage won't be mounted, and the underlying storage will be
detected as a candidate to be removed with the command above.
https://github.com/owncloud/core/pull/41014
* Change - Update PHP dependencies: [#40983](https://github.com/owncloud/core/pull/40983)
The following have been updated: - phpseclib/phpseclib (3.0.21 to 3.0.23) -
symfony/string (5.4.26 to 5.4.29)
The following have been updated in apps/files_external/3rdparty: -
google/apiclient (2.15.0 to 2.15.1)
https://github.com/owncloud/core/pull/40983
https://github.com/owncloud/core/pull/40986
https://github.com/owncloud/core/pull/41012
* Enhancement - Improve preview cleanup query: [#40974](https://github.com/owncloud/core/pull/40974)
Improve the performance of the query to find the previews we need to cleanup in
the DB
https://github.com/owncloud/core/pull/40974
* Enhancement - Remove "Fill E-Tags" Repair-Step: [#40996](https://github.com/owncloud/core/pull/40996)
This legacy repair-step took very long to run during an upgrade of a large
system and didn't repair anything anymore.
https://github.com/owncloud/core/pull/40996
# Changelog for ownCloud Core [10.13.1] (2023-09-04)
The following sections list the changes in ownCloud core 10.13.1 relevant to
ownCloud admins and users.
[10.13.1]: https://github.com/owncloud/core/compare/v10.13.0...v10.13.1
## Summary
* Bugfix - Fix namespace map setting: [#40943](https://github.com/owncloud/core/pull/40943)
* Bugfix - Make sure that parameters are a string when string is expected: [#40944](https://github.com/owncloud/core/pull/40944)
* Bugfix - Fix usort callback functions to return integers: [#40945](https://github.com/owncloud/core/pull/40945)
* Bugfix - Users page generates error logs in owncloud.log: [#40947](https://github.com/owncloud/core/pull/40947)
* Bugfix - No external icons in app registry: [#40955](https://github.com/owncloud/core/pull/40955)
* Bugfix - Remove instance id postfix from file id: [#40958](https://github.com/owncloud/core/pull/40958)
* Bugfix - Disallow pre-signed URL access when the signing key is not initialized: [#40962](https://github.com/owncloud/core/pull/40962)
* Change - Update PHP dependencies: [#40939](https://github.com/owncloud/core/pull/40939)
* Enhancement - Allow disabling background jobs: [#40969](https://github.com/owncloud/core/pull/40969)
## Details
* Bugfix - Fix namespace map setting: [#40943](https://github.com/owncloud/core/pull/40943)
The namespace map setting has been corrected for shares and tags.
https://github.com/owncloud/core/pull/40943
* Bugfix - Make sure that parameters are a string when string is expected: [#40944](https://github.com/owncloud/core/pull/40944)
The code now checks for when variables are null are passed to functions that
expect a string, and handles that correctly.
https://github.com/owncloud/core/pull/40944
* Bugfix - Fix usort callback functions to return integers: [#40945](https://github.com/owncloud/core/pull/40945)
Calls to the PHP usort function have been refactored so that the callback
function used always correctly returns an integer.
https://github.com/owncloud/core/pull/40945
* Bugfix - Users page generates error logs in owncloud.log: [#40947](https://github.com/owncloud/core/pull/40947)
Error logs were being generated in owncloud.log when the admin logged in and
browsed to the users page. The code that processes the available groups has been
corrected so that entries are no longer generated.
https://github.com/owncloud/core/issues/40946
https://github.com/owncloud/core/pull/40947
* Bugfix - No external icons in app registry: [#40955](https://github.com/owncloud/core/pull/40955)
App icons for the app registry are hosted in ownCloud server.
https://github.com/owncloud/core/issues/40953
https://github.com/owncloud/core/pull/40955
* Bugfix - Remove instance id postfix from file id: [#40958](https://github.com/owncloud/core/pull/40958)
On the App Registry endpoints file ids can hold the instance id which needs to
be removed.
https://github.com/owncloud/core/pull/40958
* Bugfix - Disallow pre-signed URL access when the signing key is not initialized: [#40962](https://github.com/owncloud/core/pull/40962)
Disallow pre-signed URL access when the signing key is not initialized.
https://github.com/owncloud/core/pull/40962
* Change - Update PHP dependencies: [#40939](https://github.com/owncloud/core/pull/40939)
The following have been updated: - guzzlehttp/guzzle (7.7.0 to 7.8.0) -
guzzlehttp/psr7 (2.6.0 to 2.6.1) - sabre/http (5.1.7 to 5.1.10) -
symfony/console (5.4.26 to 5.4.28) - symfony/process (5.4.26 to 5.4.28) -
symfony/polyfill-ctype (v1.27.0 to v1.28.0) - symfony/polyfill-iconv (v1.27.0 to
v1.28.0) - symfony/polyfill-intl-grapheme (v1.27.0 to v1.28.0) -
symfony/polyfill-intl-idn (v1.27.0 to v1.28.0) -
symfony/polyfill-intl-normalizer (v1.27.0 to v1.28.0) -
symfony/polyfill-mbstring (v1.27.0 to v1.28.0) - symfony/polyfill-php72 (v1.27.0
to v1.28.0) - symfony/polyfill-php73 (v1.27.0 to v1.28.0) -
symfony/polyfill-php80 (v1.27.0 to v1.28.0)
The following have been updated in apps/files_external/3rdparty: - icewind/smb
(3.5.4 to 3.6.0)
https://github.com/owncloud/core/pull/40939
https://github.com/owncloud/core/pull/40952
https://github.com/owncloud/core/pull/40923
https://github.com/owncloud/core/pull/40960
* Enhancement - Allow disabling background jobs: [#40969](https://github.com/owncloud/core/pull/40969)
Background jobs can now be disabled so they won't run automatically. Those jobs
can still be executed manually if needed even if disabled.
https://github.com/owncloud/core/pull/40969
# Changelog for ownCloud Core [10.13.0] (2023-08-22)
The following sections list the changes in ownCloud core 10.13.0 relevant to
ownCloud admins and users.
[10.13.0]: https://github.com/owncloud/core/compare/v10.12.2...v10.13.0
## Summary
* Bugfix - Align to new accounts.google.com authorization URI: [#40783](https://github.com/owncloud/core/pull/40783)
* Bugfix - Always return an int for the Symfony Command execute method: [#40793](https://github.com/owncloud/core/pull/40793)
* Bugfix - Exit with success when signing-key has been set: [#40794](https://github.com/owncloud/core/pull/40794)
* Bugfix - Fix query used to delete thumbnails: [#40800](https://github.com/owncloud/core/issues/40800)
* Bugfix - Always use json for federation post and get to exchange tokens: [#40815](https://github.com/owncloud/core/pull/40815)
* Bugfix - Rare undefined variable error when using a Google Drive mount: [#40822](https://github.com/owncloud/core/pull/40822)
* Bugfix - Explicitly set open mode in the checksum wrapper: [#40832](https://github.com/owncloud/core/pull/40832)
* Bugfix - Rely on the server to sort the user list: [#40840](https://github.com/owncloud/core/pull/40840)
* Bugfix - Automatically disable online updater for enterprise: [#40841](https://github.com/owncloud/core/pull/40841)
* Bugfix - Verbose command output: [#40844](https://github.com/owncloud/core/pull/40844)
* Bugfix - Versions expire job does not error with federated shares: [#40847](https://github.com/owncloud/core/pull/40847)
* Bugfix - Request header can hold an empty string if not set: [#40856](https://github.com/owncloud/core/pull/40856)
* Bugfix - DAV storage should return false on stat() if connection fails: [#40861](https://github.com/owncloud/core/pull/40861)
* Bugfix - Skip share_folder for guest users: [#40864](https://github.com/owncloud/core/pull/40864)
* Bugfix - Bump files app version: [#40878](https://github.com/owncloud/core/pull/40878)
* Bugfix - Apply same restrictions for all the shares: [#40885](https://github.com/owncloud/core/pull/40885)
* Bugfix - Cleanup storage and database after failed files uploads: [#40892](https://github.com/owncloud/core/pull/40892)
* Change - Upgrade to Symfony 5: [#39630](https://github.com/owncloud/core/issues/39630)
* Change - Update PHP dependencies: [#40724](https://github.com/owncloud/core/pull/40724)
* Change - Fix name length check on federated shares: [#40726](https://github.com/owncloud/core/pull/40726)
* Change - Validate email and string user input in UserController: [#40769](https://github.com/owncloud/core/pull/40769)
* Change - Remove the "add group" button from the dropdowns in the users page: [#40770](https://github.com/owncloud/core/pull/40770)
* Change - Fix hiding Last Login column on Users page: [#40771](https://github.com/owncloud/core/pull/40771)
* Change - Fix name length check on system tag creation: [#40804](https://github.com/owncloud/core/pull/40804)
* Change - Display and delete invalid background jobs: [#40846](https://github.com/owncloud/core/pull/40846)
* Change - Require firebase/php-jwt in core: [#40901](https://github.com/owncloud/core/pull/40901)
* Enhancement - Add support for OCM via ScienceMesh: [#40577](https://github.com/owncloud/core/issues/40577)
* Enhancement - Improve X-Robots-Tag header values check: [#40715](https://github.com/owncloud/core/pull/40715)
* Enhancement - Added occ command to remove obsolete storages: [#40779](https://github.com/owncloud/core/pull/40779)
* Enhancement - Add commands to handle the trusted servers from command line: [#40796](https://github.com/owncloud/core/pull/40796)
* Enhancement - Enforce 2-factor authentication: [#40830](https://github.com/owncloud/core/pull/40830)
* Enhancement - Improve the performance of the occ files:remove-storage command: [#40859](https://github.com/owncloud/core/pull/40859)
## Details
* Bugfix - Align to new accounts.google.com authorization URI: [#40783](https://github.com/owncloud/core/pull/40783)
Core 10.12.1 brought an update of the google/apiclient from version 2.12.6 to
2.13.1. However, in version 2.13.0 the accounts.google.com authorization URI has
been updated. This change breaks old code that uses the
"setApprovalPrompt('force')" instead of the newer "setPrompt('consent')" method,
as this endpoint does not support the legacy approval prompt parameter. This has
been now fixed.
https://github.com/owncloud/core/issues/40777
https://github.com/owncloud/core/pull/40783
* Bugfix - Always return an int for the Symfony Command execute method: [#40793](https://github.com/owncloud/core/pull/40793)
Some occ commands could return an invalid exit status when executed. This has
been corrected. occ commands will now always return an integer exit status. Zero
(0) is success, any other value indicates a problem.
https://github.com/owncloud/core/pull/40793
* Bugfix - Exit with success when signing-key has been set: [#40794](https://github.com/owncloud/core/pull/40794)
The "occ security:sign-key:create" command exited with status 1 even when the
signing key was successfully created. This has been corrected. The command now
exits with status zero (0) when the command succeeded.
For all occ commands, zero (0) is success, any other value indicates a problem.
https://github.com/owncloud/core/pull/40794
* Bugfix - Fix query used to delete thumbnails: [#40800](https://github.com/owncloud/core/issues/40800)
Fixed query that detects unused thumbnails to prevent unnecessary deletes and
potential recreations.
https://github.com/owncloud/core/issues/40800
https://github.com/owncloud/core/pull/40801
* Bugfix - Always use json for federation post and get to exchange tokens: [#40815](https://github.com/owncloud/core/pull/40815)
After update of guzzle, it was no longer possible to request format of response
to be json when adding in query parameter. One of OCSAuthAPIController fed
instances was receiving requests without a hint that JSON needs to be used, and
returned XML. On the other hand, OCSAuthAPIController expects only JSON for
exchange, and thus failed to parse the message. Now the exchange is correctly
done.
WARNING: the patch/fix needs to be applied on all federated severs that are not
yet "paired" and have the issue with guzzle library. Otherwise pairing will not
work.
https://github.com/owncloud/enterprise/issues/5676
https://github.com/owncloud/core/pull/40815
* Bugfix - Rare undefined variable error when using a Google Drive mount: [#40822](https://github.com/owncloud/core/pull/40822)
There can be the rare case that deleting a file from a Google Drive mount can
throw an undefined variable error. Though the process completes without further
issues, no errors should be thrown. This fix initializes the variables for these
cases properly making the error go away.
https://github.com/owncloud/core/issues/40802
https://github.com/owncloud/core/pull/40822
* Bugfix - Explicitly set open mode in the checksum wrapper: [#40832](https://github.com/owncloud/core/pull/40832)
Uploading files to some external storages through the desktop client was causing
issues due to the checksum wrapper. We're using additional wrappers and the mode
wasn't being detected correctly in some cases. Using the right mode in the
checksum wrapper was required in order to decide whether we should discard the
final checksum or not; in this case, the checksum was being discarded, so it was
causing a checksum mismatch.
Now the open mode in the checksum wrapper is set explicitly.
https://github.com/owncloud/core/pull/40832
* Bugfix - Rely on the server to sort the user list: [#40840](https://github.com/owncloud/core/pull/40840)
Previously, the user list was sorted in the browser. This was causing confusion
because the sorting happened with just the items being shown without taking into
account all the items, so there were some weird effects.
There is no sorting in the browser now. The server is expected to return the
list of users already sorted, so the browser just needs to show the list.
https://github.com/owncloud/core/pull/40840
* Bugfix - Automatically disable online updater for enterprise: [#40841](https://github.com/owncloud/core/pull/40841)
Online updater is not recommended for Enterprise installations and is now
automatically disabled in such cases.
https://github.com/owncloud/core/pull/40841
* Bugfix - Verbose command output: [#40844](https://github.com/owncloud/core/pull/40844)
Verbose command output of the background:queue:execute is now displayed.
https://github.com/owncloud/core/pull/40844
* Bugfix - Versions expire job does not error with federated shares: [#40847](https://github.com/owncloud/core/pull/40847)
Versions expire job does not error with federated shares when versioning meta-
data is enabled.
https://github.com/owncloud/core/pull/40847
* Bugfix - Request header can hold an empty string if not set: [#40856](https://github.com/owncloud/core/pull/40856)
Due to Apache rewrite rules originally not existing headers can hold an empty
string.
https://github.com/owncloud/core/pull/40856
* Bugfix - DAV storage should return false on stat() if connection fails: [#40861](https://github.com/owncloud/core/pull/40861)
Trying to connect an external WebDAV storage to a non-WebDAV server will now
fail when trying to initiate the first connection. This prevents connecting to
an invalid server, and thus prevents problems for users.
https://github.com/owncloud/core/pull/40861
* Bugfix - Skip share_folder for guest users: [#40864](https://github.com/owncloud/core/pull/40864)
In https://github.com/owncloud/core/pull/40378 we've fixed the case of (not)
moving the share target when the backend storage becomes temporary unavailable
but we had the collateral effect that guests did not see anymore their received
shares as we were forcing the creation of the target which failed for them as
their storage is read-only. We now skip the share_folder config.php option for
guests and default to root.
https://github.com/owncloud/core/pull/40864
* Bugfix - Bump files app version: [#40878](https://github.com/owncloud/core/pull/40878)
Files app version was not properly increased when the
"OCA\Files\BackgroundJob\CleanupPersistentFileLock" and
"OCA\Files\BackgroundJob\PreviewCleanupJob" background jobs were originally
added. As a result, those two jobs were not correctly inserted into the
"oc_jobs" table upon a core upgrade. First time installations are not affected
as there jobs are correctly added.
https://github.com/owncloud/core/pull/40878
* Bugfix - Apply same restrictions for all the shares: [#40885](https://github.com/owncloud/core/pull/40885)
Remote shares will have the same restrictions as user and group shares. This
means that the in order for a remote user to show up as sharee, the search term
length must be greater than the minimum configured, otherwise only exact matches
will be shown.
https://github.com/owncloud/core/pull/40885
* Bugfix - Cleanup storage and database after failed files uploads: [#40892](https://github.com/owncloud/core/pull/40892)
Storage and database is cleaned up of any remaining items in case a files upload
fails.
https://github.com/owncloud/core/pull/40892
* Change - Upgrade to Symfony 5: [#39630](https://github.com/owncloud/core/issues/39630)
The Symfony PHP framework has been updated from major version 4 to 5.
The following Symfony component versions are provided: - symfony/console
(v5.4.26) - symfony/event-dispatcher (v5.4.26) - symfony/process (v5.4.26) -
symfony/routing (v5.4.26) - symfony/string (v5.4.26) - symfony/translation
(v5.4.24)
https://github.com/owncloud/core/issues/39630
https://github.com/owncloud/core/pull/40518
https://github.com/owncloud/core/pull/40819
https://github.com/owncloud/core/pull/40849
https://github.com/owncloud/core/pull/40895
* Change - Update PHP dependencies: [#40724](https://github.com/owncloud/core/pull/40724)
The following have been updated: - doctrine/deprecations (1.0.0 to 1.1.1) -
egulias/email-validator (3.2.5 to 3.2.6) - guzzlehttp/guzzle (7.5.0 to 7.7.0) -
guzzlehttp/promises (2.0.0 to 2.0.1) - guzzlehttp/psr7 (2.5.0 to 2.6.0) -
league/mime-type-detection (1.11.0 to 1.13.0) - owncloud/tarstreamer (2.0.0 to
2.1.0) - pear/pear-core-minimal (1.10.11 to 1.10.13) - phpseclib/phpseclib
(3.0.19 to 3.0.21) - punic/punic (3.8.0 to 3.8.1) - sabre/http (5.1.6 to 5.1.7)
- sabre/uri (2.3.2 to 2.3.3) - sabre/xml (2.2.5 to 2.2.6)
The following have been updated in apps/files_external/3rdparty: -
google/apiclient (2.13.1 to 2.13.2) - firebase/php-jwt (v6.4.0 to v6.6.0)
https://github.com/owncloud/core/pull/40724
https://github.com/owncloud/core/pull/40731
https://github.com/owncloud/core/pull/40742
https://github.com/owncloud/core/pull/40753
https://github.com/owncloud/core/pull/40789
https://github.com/owncloud/core/pull/40806
https://github.com/owncloud/core/pull/40819
https://github.com/owncloud/core/pull/40825
https://github.com/owncloud/core/pull/40833
https://github.com/owncloud/core/pull/40838
https://github.com/owncloud/core/pull/40839
https://github.com/owncloud/core/pull/40849
https://github.com/owncloud/core/pull/40853
https://github.com/owncloud/core/pull/40854
https://github.com/owncloud/core/pull/40867
https://github.com/owncloud/core/pull/40900
https://github.com/owncloud/core/pull/40907
* Change - Fix name length check on federated shares: [#40726](https://github.com/owncloud/core/pull/40726)
A federated share with a too long name results in potentially inaccessible data.
https://github.com/owncloud/core/pull/40726
* Change - Validate email and string user input in UserController: [#40769](https://github.com/owncloud/core/pull/40769)
User input is validated now in UserController
https://github.com/owncloud/core/pull/40769
* Change - Remove the "add group" button from the dropdowns in the users page: [#40770](https://github.com/owncloud/core/pull/40770)
The "add group" button has been removed from the dropdowns because the behavior
was confusing. You can still create new groups in the users page by using the
"add group" button in the top left corner of the users page. The dropdowns will
only select existing groups, but they won't add new groups.
https://github.com/owncloud/core/pull/40770
* Change - Fix hiding Last Login column on Users page: [#40771](https://github.com/owncloud/core/pull/40771)
The Last Login column on the Users page is now correctly hidden if the setting
is initially unchecked.
https://github.com/owncloud/core/pull/40771
* Change - Fix name length check on system tag creation: [#40804](https://github.com/owncloud/core/pull/40804)
A system tag with a too long name results in potentially inaccessible data.
https://github.com/owncloud/core/pull/40804
* Change - Display and delete invalid background jobs: [#40846](https://github.com/owncloud/core/pull/40846)
Background jobs can be no longer valid because they are from an old version of
an app, or from an app that has been disabled. These jobs can now be listed with
the command:
Occ background:queue:status --display-invalid-jobs
And can be deleted with the command:
Occ background:queue:delete
https://github.com/owncloud/core/pull/40846
https://github.com/owncloud/core/pull/40917
* Change - Require firebase/php-jwt in core: [#40901](https://github.com/owncloud/core/pull/40901)
Firebase/php-jwt version 6 is now part of core and all apps can rely on it
https://github.com/owncloud/core/pull/40901
https://github.com/owncloud/files_texteditor/pull/401
https://github.com/owncloud/wopi/pull/254
* Enhancement - Add support for OCM via ScienceMesh: [#40577](https://github.com/owncloud/core/issues/40577)
We've added an if-statement in the files_sharing ShareesController code that
searches for remote sharees. When the 'sciencemesh' app is installed, use it
instead of the federatedfilesharing app to find sharee matches for OCM sharing.
https://github.com/owncloud/core/issues/40577
https://github.com/pondersource/oc-sciencemesh/pull/39
* Enhancement - Improve X-Robots-Tag header values check: [#40715](https://github.com/owncloud/core/pull/40715)
Setup checks now allows other values other than "none" for X-Robots-Tag header.
If "none" or "noindex" and "nofollow" are missing, a security warning is raised.
Previously a header value with "noindex" and "nofollow" wasn't allowed even
though it was valid.
https://github.com/owncloud/core/pull/40715
* Enhancement - Added occ command to remove obsolete storages: [#40779](https://github.com/owncloud/core/pull/40779)
Metadata coming from storages are stored in the DB. When a storage has been
removed from ownCloud, that metadata remains in the DB.
The new occ command allows you to remove that metadata stored, reducing the
amount of space used by the DB as well as slightly improving the performance
since there will be less entries.
https://github.com/owncloud/core/pull/40779
* Enhancement - Add commands to handle the trusted servers from command line: [#40796](https://github.com/owncloud/core/pull/40796)
New occ commands have been added to handle the trusted servers for federation
from command line. These commands will allow the admin to add list and remove
trusted servers
https://github.com/owncloud/core/pull/40796
* Enhancement - Enforce 2-factor authentication: [#40830](https://github.com/owncloud/core/pull/40830)
2-factor authentication can be enforced now. The feature requires at least an
app implementing the 2-factor, otherwise no enforcement will be done. If the
2-factor authentication is enforced, all users will be required to use a
2-factor authentication app. Some specific groups selected by the admin can be
excluded to let those users bypass the 2-factor authentication.
https://github.com/owncloud/core/pull/40830
* Enhancement - Improve the performance of the occ files:remove-storage command: [#40859](https://github.com/owncloud/core/pull/40859)
The "--show-candidates" option of the "occ files:remove-storage" command will
take less time
https://github.com/owncloud/core/pull/40859
# Changelog for ownCloud Core [10.12.2] (2023-05-31)
The following sections list the changes in ownCloud core 10.12.2 relevant to
ownCloud admins and users.
[10.12.2]: https://github.com/owncloud/core/compare/v10.12.1...v10.12.2
## Summary
* Bugfix - Filter sensitive data in log for Session::loginInOwnCloud: [#40792](https://github.com/owncloud/core/pull/40792)
* Bugfix - Disallow permission tobe upgraded via federated sharing: [#40803](https://github.com/owncloud/core/pull/40803)
## Details
* Bugfix - Filter sensitive data in log for Session::loginInOwnCloud: [#40792](https://github.com/owncloud/core/pull/40792)
https://github.com/owncloud/core/pull/40792
* Bugfix - Disallow permission tobe upgraded via federated sharing: [#40803](https://github.com/owncloud/core/pull/40803)
https://github.com/owncloud/core/pull/40803
# Changelog for ownCloud Core [10.12.1] (2023-04-03)
The following sections list the changes in ownCloud core 10.12.1 relevant to
ownCloud admins and users.
[10.12.1]: https://github.com/owncloud/core/compare/v10.12.0...v10.12.1
## Summary
* Bugfix - Respect User Home Folder Naming Rule home directory for chunks uploads: [#40693](https://github.com/owncloud/core/pull/40693)
* Bugfix - Add rewrite base to .htaccess: [#40697](https://github.com/owncloud/core/pull/40697)
* Bugfix - Prevent 507 Insufficient Storage on 32-bit systems: [#40709](https://github.com/owncloud/core/pull/40709)
* Change - Update PHP dependencies: [#40691](https://github.com/owncloud/core/pull/40691)
* Change - Fix permission bits when enforcing passwords on public links: [#40701](https://github.com/owncloud/core/pull/40701)
* Change - Do not auto-enable user-key encryption: [#40702](https://github.com/owncloud/core/pull/40702)
## Details
* Bugfix - Respect User Home Folder Naming Rule home directory for chunks uploads: [#40693](https://github.com/owncloud/core/pull/40693)
When using the User Home Folder Naming Rule (configurable in the Advanced tab of
the LDAP wizard), which allows to specify the home folder by means of an LDAP
attribute, chunks of users' uploads were wrongly created under the default data
directory rather than inside the configured home directory. We are now using the
getHome() method for getting the user's home so that chunks uploads respect the
configured home directory.
https://github.com/owncloud/core/pull/40693
https://github.com/owncloud/core/pull/40719
* Bugfix - Add rewrite base to .htaccess: [#40697](https://github.com/owncloud/core/pull/40697)
In previous core versions the rewrite base config.php option was not added to
the generated .htaccess file. The use of a more hardened .htaccess file in
version 10.12.0 (being introduced by
https://github.com/owncloud/core/pull/40584) caused the files view in the web UI
to be empty in URL via subfolder plus index.php-less setups. Additionally, the
desktop app was not be able to sync and an error 405 (Method not allowed) was
returned. Rewrite base is now correctly added to the .htaccess file.
https://github.com/owncloud/core/issues/40696
https://github.com/owncloud/core/pull/40697
* Bugfix - Prevent 507 Insufficient Storage on 32-bit systems: [#40709](https://github.com/owncloud/core/pull/40709)
With the introduction of https://github.com/owncloud/core/pull/40567
compatibility to 32-bit systems broke as we are now casting $freeSpace to int
and this caused an integer overflow on such systems when the free space was
above the max supported value. We added therefore an additional check for 32-bit
systems in QuotaPlugin.php.
https://github.com/owncloud/core/pull/40709
https://github.com/owncloud/core/pull/40729
* Change - Update PHP dependencies: [#40691](https://github.com/owncloud/core/pull/40691)
The following have been updated: - guzzlehttp/psr7 (2.4.3 to 2.4.4) -
icewind/streams (0.7.6 to 0.7.7)
The following have been updated in apps/files_external/3rdparty: -
google/apiclient (2.12.6 to 2.13.1) - icewind/streams (0.7.6 to 0.7.7)
https://github.com/owncloud/core/pull/40691
https://github.com/owncloud/core/pull/40683
https://github.com/owncloud/core/pull/40690
* Change - Fix permission bits when enforcing passwords on public links: [#40701](https://github.com/owncloud/core/pull/40701)
It was not possible to enforce passwords on public link files with read + write
permission. The admin can now check 'Enforce password protection for read +
write + delete links' to do so.
https://github.com/owncloud/core/issues/40699
https://github.com/owncloud/core/pull/40701
* Change - Do not auto-enable user-key encryption: [#40702](https://github.com/owncloud/core/pull/40702)
Executing occ encryption:encrypt-all will no longer auto-enable user-key
encryption.
https://github.com/owncloud/enterprise/issues/4939
https://github.com/owncloud/core/pull/40702
https://doc.owncloud.com/docs/next/server_release_notes.html#deprecation-note-for-user-key-storage-encryption
# Changelog for ownCloud Core [10.12.0] (2023-02-24)
The following sections list the changes in ownCloud core 10.12.0 relevant to
ownCloud admins and users.
[10.12.0]: https://github.com/owncloud/core/compare/v10.11.0...v10.12.0
## Summary
* Bugfix - Bump bower_components/clipboard from v2.0.6 to v2.0.11 in /build: [#40064](https://github.com/owncloud/core/pull/40064)
* Bugfix - Properly remove file versions from the trashbin: [#40286](https://github.com/owncloud/core/issues/40286)
* Bugfix - Adjust installation database details: [#40348](https://github.com/owncloud/core/pull/40348)
* Bugfix - "available for" in the mount point configuration will show displaynames: [#40412](https://github.com/owncloud/core/pull/40412)
* Bugfix - Skip public links when updating permissions of share's children: [#40420](https://github.com/owncloud/core/pull/40420)
* Bugfix - Add shib auth support for redirect url: [#40470](https://github.com/owncloud/core/pull/40470)
* Bugfix - Remove empty directories from the files_versions: [#40499](https://github.com/owncloud/core/pull/40499)
* Bugfix - Store checksums only if the whole stream has been read: [#40513](https://github.com/owncloud/core/pull/40513)
* Bugfix - Performance fix when deleting thumbnails: [#40514](https://github.com/owncloud/core/pull/40514)
* Bugfix - Bump minimatch from 3.0.4 to 3.1.2 in /build: [#40522](https://github.com/owncloud/core/pull/40522)
* Bugfix - Bump json5 from 2.2.0 to 2.2.3 in /build: [#40556](https://github.com/owncloud/core/pull/40556)
* Bugfix - Bump karma from 6.3.19 to 6.4.1 in /build: [#40558](https://github.com/owncloud/core/pull/40558)
* Bugfix - Bump moments.js from 2.29.1 to 2.29.4 in /build: [#40560](https://github.com/owncloud/core/pull/40560)
* Bugfix - Set length of oc_calendars.components to 255: [#40563](https://github.com/owncloud/core/pull/40563)
* Bugfix - Prevent creation of empty files/folders when no available quota: [#40567](https://github.com/owncloud/core/pull/40567)
* Bugfix - Bump underscore from 1.13.2 to 1.13.6 in /build: [#40568](https://github.com/owncloud/core/pull/40568)
* Bugfix - Fix the dav:cleanup-chunks command to work with a configured folder: [#40571](https://github.com/owncloud/core/pull/40571)
* Bugfix - Bump bower_components/showdown from 2.0.0 to 2.1.0 in /build: [#40579](https://github.com/owncloud/core/pull/40579)
* Bugfix - Fix orientation of images with exif data: [#40600](https://github.com/owncloud/core/pull/40600)
* Bugfix - Fix header title and claim rendered as escaped HTML: [#40605](https://github.com/owncloud/core/issues/40605)
* Bugfix - Use correct themed l10n app folder when app lives outside of server root: [#40607](https://github.com/owncloud/core/pull/40607)
* Bugfix - Fix share into share move scenario: [#40612](https://github.com/owncloud/core/pull/40612)
* Bugfix - Enable 2FA via provisioning API: [#40617](https://github.com/owncloud/core/issues/40617)
* Bugfix - Add index on oc_filecache: [#40633](https://github.com/owncloud/core/issues/40633)
* Bugfix - Adjust request body options for Guzzle7: [#40652](https://github.com/owncloud/core/pull/40652)
* Change - Update PHP dependencies: [#40337](https://github.com/owncloud/core/pull/40337)
* Change - Allow specifying available space for objectstorages: [#40389](https://github.com/owncloud/core/pull/40389)
* Change - Drop PHP 7.3 support across the platform: [#40394](https://github.com/owncloud/core/pull/40394)
* Change - Test indirect resource existence: [#40406](https://github.com/owncloud/core/pull/40406)
* Change - Detect mime types of hidden files: [#40427](https://github.com/owncloud/core/pull/40427)
* Change - Copy the encryption keys first and then rename the files: [#40433](https://github.com/owncloud/core/pull/40433)
* Change - Drop unneeded Google SDK services: [#40444](https://github.com/owncloud/core/pull/40444)
* Change - Delete action is removed from sharing sections: [#40497](https://github.com/owncloud/core/pull/40497)
* Change - Allow to temporarily ignore invalid federated shares: [#40503](https://github.com/owncloud/core/pull/40503)
* Change - Update Symfony components: [#40521](https://github.com/owncloud/core/pull/40521)
* Enhancement - Add account creation time: [#2298](https://github.com/owncloud/enterprise/issues/2298)
* Enhancement - Show WebDAV Url in personal setting under app passwords: [#40509](https://github.com/owncloud/core/pull/40509)
* Enhancement - Show username on personal profile page: [#40510](https://github.com/owncloud/core/pull/40510)
* Enhancement - Add legal privacy policy and imprint links to personal settings: [#40511](https://github.com/owncloud/core/pull/40511)
* Enhancement - Persistent major file version workflow: [#40531](https://github.com/owncloud/core/pull/40531)
* Enhancement - Add support for login policies: [#40574](https://github.com/owncloud/core/pull/40574)
* Enhancement - Add support for OCM via ScienceMesh: [#40577](https://github.com/owncloud/core/issues/40577)
* Enhancement - Tweak rewrite conditions in .htaccess: [#40584](https://github.com/owncloud/core/pull/40584)
* Enhancement - Improve UX on occ user:sync: [#40640](https://github.com/owncloud/core/pull/40640)
* Enhancement - Drag & Drop folders into public file upload: [#40643](https://github.com/owncloud/core/pull/40643)
* Enhancement - Make sender display name in mail notifications configurable: [#40671](https://github.com/owncloud/core/pull/40671)
## Details
* Bugfix - Bump bower_components/clipboard from v2.0.6 to v2.0.11 in /build: [#40064](https://github.com/owncloud/core/pull/40064)
https://github.com/owncloud/core/pull/40064
* Bugfix - Properly remove file versions from the trashbin: [#40286](https://github.com/owncloud/core/issues/40286)
Previously, restoring or removing a file from inside a folder that was deleted
(so the folder and the contents are in the trashbin) didn't remove the versions
of the file. Those versions were left in both the DB and the FS, taking space
and degrading the performance.
This is now being handled properly, so no additional resource is consumed due to
the versions being left stranded.
https://github.com/owncloud/core/issues/40286
* Bugfix - Adjust installation database details: [#40348](https://github.com/owncloud/core/pull/40348)
The suggested host name and port syntax for the database host on the
installation has been corrected.
https://github.com/owncloud/core/issues/39871
https://github.com/owncloud/core/pull/40348
* Bugfix - "available for" in the mount point configuration will show displaynames: [#40412](https://github.com/owncloud/core/pull/40412)
The "available for" select of the mount configuration of external storages were
using the group id. This wasn't a problem because for local groups the group id
matches the group displayname, and for ldap groups the group id was the "cn"
attribute. Due to recent changes, the ldap group will now use the objectuid
attribute (or a similar attribute) as group id by default. This was causing the
"available for" select to show that objectuid, so identifying the right group
was problematic.
Now, the "available for" select will show the group displayname, which for ldap
is the "cn" attribute by default.
Note that this happens on new installations. There is an automatic migration in
place, so for upgrades, the "cn" attribute will be set as groupname in order to
keep the old behavior
https://github.com/owncloud/core/pull/40412
* Bugfix - Skip public links when updating permissions of share's children: [#40420](https://github.com/owncloud/core/pull/40420)
Currently, updates to permissions of a share are wrongly propagated to public
links children. This has now been fixed and public links are being skipped.
https://github.com/owncloud/core/pull/40420
* Bugfix - Add shib auth support for redirect url: [#40470](https://github.com/owncloud/core/pull/40470)
Without this change, server-side Apache Auth (e.g. Shibboleth) resulted in
redirect to default owncloud page, instead of last visited page. We now
correctly handle redirect_url.
https://github.com/owncloud/enterprise/issues/5450
https://github.com/owncloud/core/pull/40470
https://github.com/owncloud/core/pull/40161
* Bugfix - Remove empty directories from the files_versions: [#40499](https://github.com/owncloud/core/pull/40499)
Empty directories were left when the contained versions were deleted or moved.
Large installations might end up with too many of these empty directories.
Now, when a version is deleted, the containing directory will also be deleted if
there aren't any more versions inside.
https://github.com/owncloud/core/pull/40499
* Bugfix - Store checksums only if the whole stream has been read: [#40513](https://github.com/owncloud/core/pull/40513)
Previously, range downloads (or downloads requesting a specific byte range)
would store a checksum, if needed, based only on the requested range. This
causes problems because the checksum is expected to be for the whole file.
Now, those range downloads won't store a checksum because only a part of the
file has been read, so the checksum would be incomplete.
Some additional cases have been taken into account, mostly based on actions that
could happen on the data stream, but they shouldn't happen normally.
https://github.com/owncloud/core/pull/40513
* Bugfix - Performance fix when deleting thumbnails: [#40514](https://github.com/owncloud/core/pull/40514)
Detecting unused thumbnails is now using a better optimized SQL statements which
consumes less database and web server resources.
https://github.com/owncloud/core/pull/40514
* Bugfix - Bump minimatch from 3.0.4 to 3.1.2 in /build: [#40522](https://github.com/owncloud/core/pull/40522)
https://github.com/owncloud/core/pull/40522
* Bugfix - Bump json5 from 2.2.0 to 2.2.3 in /build: [#40556](https://github.com/owncloud/core/pull/40556)
https://github.com/owncloud/core/pull/40556
* Bugfix - Bump karma from 6.3.19 to 6.4.1 in /build: [#40558](https://github.com/owncloud/core/pull/40558)
https://github.com/owncloud/core/pull/40558
* Bugfix - Bump moments.js from 2.29.1 to 2.29.4 in /build: [#40560](https://github.com/owncloud/core/pull/40560)
https://github.com/owncloud/core/pull/40560
* Bugfix - Set length of oc_calendars.components to 255: [#40563](https://github.com/owncloud/core/pull/40563)
https://github.com/owncloud/core/issues/40537
https://github.com/owncloud/core/pull/40563
* Bugfix - Prevent creation of empty files/folders when no available quota: [#40567](https://github.com/owncloud/core/pull/40567)
Until now it was possible for users having 0 quota or who already reached the
limit of their assigned quota to still create empty files/folders, which
generates confusion. The PR fixes this behaviour.
https://github.com/owncloud/enterprise/issues/5478
https://github.com/owncloud/core/pull/40567
* Bugfix - Bump underscore from 1.13.2 to 1.13.6 in /build: [#40568](https://github.com/owncloud/core/pull/40568)
https://github.com/owncloud/core/pull/40568
* Bugfix - Fix the dav:cleanup-chunks command to work with a configured folder: [#40571](https://github.com/owncloud/core/pull/40571)
The ownCloud's FS was initialized partially to prevent contacting the LDAP
server if it was configured. This was causing problems because the upload folder
where the chunks were expected was a mountpoint, and due to the partial FS
initialization such mountpoint was missing, so we were checking a different
folder (the default one).
Now, the ownCloud's FS will be fully initialized instead, so the mountpoint will
be present and we check the right location.
https://github.com/owncloud/core/pull/40571
* Bugfix - Bump bower_components/showdown from 2.0.0 to 2.1.0 in /build: [#40579](https://github.com/owncloud/core/pull/40579)
https://github.com/owncloud/core/pull/40579
* Bugfix - Fix orientation of images with exif data: [#40600](https://github.com/owncloud/core/pull/40600)
Some images with a large exif data had problems with the orientation when they
were shown. This was caused by the native function failing to retrieve the exif
data. Images with small exif data didn't have this problem.
By making the chunk size of the stream bigger, the native function is able to
load the exif data properly and return the information, and with such
information we can fix the orientation of the image.
https://github.com/owncloud/core/pull/40600
* Bugfix - Fix header title and claim rendered as escaped HTML: [#40605](https://github.com/owncloud/core/issues/40605)
The files_sharing application template was escaping the HTML from the title and
claim provided by the theme. This caused raw HTML to be displayed in the page
header.
https://github.com/owncloud/core/issues/40605
https://github.com/owncloud/core/pull/40606
* Bugfix - Use correct themed l10n app folder when app lives outside of server root: [#40607](https://github.com/owncloud/core/pull/40607)
When an app_path is pointing outside of the ownCloud server root or uses an
symlink under certain conditions the l10n folder points to an invalid location
and results in a crash of the server. This happened due to the assumption that
app paths always start with the server root path.
https://github.com/owncloud/core/pull/40607
* Bugfix - Fix share into share move scenario: [#40612](https://github.com/owncloud/core/pull/40612)
Public links were lost upon moving share into another share as the share owner
was not correctly set. This has been now partially fixed.
https://github.com/owncloud/enterprise/issues/5565
https://github.com/owncloud/core/pull/40612
* Bugfix - Enable 2FA via provisioning API: [#40617](https://github.com/owncloud/core/issues/40617)
Two factor authentication can now be enabled using the provisioning api.
https://github.com/owncloud/core/issues/40617
* Bugfix - Add index on oc_filecache: [#40633](https://github.com/owncloud/core/issues/40633)
This index can help to speed-up bulk file operations.
https://github.com/owncloud/core/issues/40633
* Bugfix - Adjust request body options for Guzzle7: [#40652](https://github.com/owncloud/core/pull/40652)
In Guzzle major version 7 the body option of a request must be a string or
similar. Requests that send arrays of items have been adjusted to use the
form_params option. Developers of apps that use
lib/private/Http/Client/IClient.php should check any calls to ensure that arrays
of items are not passed in the body option. See the diffs of PHP docs in the
linked PR for examples.
https://github.com/owncloud/core/issues/40649
https://github.com/owncloud/core/pull/40652
* Change - Update PHP dependencies: [#40337](https://github.com/owncloud/core/pull/40337)
The following have been updated: - doctrine/event-manager (1.1.2 to 1.2.0) -
doctrine/instantiator (1.4.1 to 1.5.0) - doctrine/lexer (1.2.3 to 2.1.0) -
egulias/email-validator (3.2.1 to 3.2.5) - guzzlehttp/guzzle (7.4.5 to 7.5.0) -
guzzlehttp/promises (1.5.1 to 1.5.2) - guzzlehttp/psr7 (2.4.0 to 2.4.3) -
phpseclib/phpseclib (3.0.14 to 3.0.18) - laminas/laminas-filter (2.12.0 to
2.22.0) - laminas/laminas-inputfilter (2.12.1 to 2.21.0) -
laminas/laminas-servicemanager (3.7.0 to 3.17.0) - laminas/laminas-stdlib
(3.11.0 to 3.13.0) - laminas/laminas-validator (2.19.0 to 2.25.0) -
league/flysystem (1.1.9 to 1.1.10) - phpseclib/phpseclib (3.0.18 tp 3.0.19) -
psr/container (1.1.1 to 1.1.2) - punic/punic (3.7.0 to 3.8.0) - sabre/uri (2.2.3
to 2.3.2) - sabre/vobject (4.5.0 to 4.5.3)
The following have been updated in apps/files_external/3rdparty: - google/auth
(v1.21.1 to v1.23.0) - google/apiclient-services (v0.259.0 to v0.272.0) -
guzzlehttp/psr7 (2.4.0 to 2.4.3)
https://github.com/owncloud/core/pull/40337
https://github.com/owncloud/core/pull/40394
https://github.com/owncloud/core/pull/40410
https://github.com/owncloud/core/pull/40424
https://github.com/owncloud/core/pull/40448
https://github.com/owncloud/core/pull/40449
https://github.com/owncloud/core/pull/40494
https://github.com/owncloud/core/pull/40543
https://github.com/owncloud/core/pull/40554
https://github.com/owncloud/core/pull/40568
https://github.com/owncloud/core/pull/40591
https://github.com/owncloud/core/pull/40668
* Change - Allow specifying available space for objectstorages: [#40389](https://github.com/owncloud/core/pull/40389)
Objectstorages are reporting only unknown storage space. This causes problems in
other apps that rely on this storage method, e.g. metrics app that monitors
available space. Now, new configuration in the storage level is added, allowing
for using the system configuration variable by the apps or further extension of
storage class for objectstorage.
https://github.com/owncloud/core/issues/40665
https://github.com/owncloud/enterprise/issues/5384
https://github.com/owncloud/enterprise/issues/5006
https://github.com/owncloud/core/pull/40389
https://github.com/owncloud/core/pull/40669
* Change - Drop PHP 7.3 support across the platform: [#40394](https://github.com/owncloud/core/pull/40394)
Support for security fixes for PHP 7.3 ended in Dec 2021 ownCloud core no longer
supports PHP 7.3. Ensure that you are using PHP 7.4.
https://github.com/owncloud/core/pull/40394
https://www.php.net/supported-versions.php
* Change - Test indirect resource existence: [#40406](https://github.com/owncloud/core/pull/40406)
We now expect a not found error instead of permission denied error for some
trash interactions.
https://github.com/owncloud/core/pull/40406
* Change - Detect mime types of hidden files: [#40427](https://github.com/owncloud/core/pull/40427)
Mime type of hidden files are now properly detected.
https://github.com/owncloud/core/pull/40427
* Change - Copy the encryption keys first and then rename the files: [#40433](https://github.com/owncloud/core/pull/40433)
Having encryption enabled, when a file was renamed, first the actual file was
renamed, and then the encryption keys were moved to the new location. If
something went wrong, it was possible that the keys weren't moved. This caused
the file to become inaccessible because we couldn't decrypt the file due to the
missing keys (which weren't in the right place)
Now, when a file is renamed, the encryption keys will be copied first, and then
the file will be renamed. If the encryption keys fail to be copied, the rename
will fail. After the encryption keys are copied, the file could failed to be
renamed. In this case, the copied keys will be removed, but the file will still
be accessible because we still keep the old keys. The original keys (not the
copy) will be removed if the file is renamed successfully.
https://github.com/owncloud/core/pull/40433
* Change - Drop unneeded Google SDK services: [#40444](https://github.com/owncloud/core/pull/40444)
Unused Google SDK services are removed to reduce package size.
https://github.com/owncloud/core/pull/40444
* Change - Delete action is removed from sharing sections: [#40497](https://github.com/owncloud/core/pull/40497)
In the files apps, the "shared with others" and "shared by link" sections
allowed people to use a delete action on a file or folder present in that list.
This was causing problems because people accidentally removed the folder when,
in fact, they wanted to unshare it.
This delete action isn't present any longer. You can unshare from those views by
accessing the file or folder's details. If you want to delete the file or
folder, you can do it from the regular "all files" section.
https://github.com/owncloud/core/pull/40497
* Change - Allow to temporarily ignore invalid federated shares: [#40503](https://github.com/owncloud/core/pull/40503)
This change is targeted mostly at tightly federated setups
Currently, if federated share is invalid or api endpoint returns not found,
availability check would validate whether this is a problem with a server and if
checks complete that given share is removed. However, in some cases these checks
might not be enough (e.g. complex migrations in tightly federated setups), and
in that case invalidation behaviour can be disabled using below app setting:
Files_sharing.enable_cleanup_invalid_external_shares='no'
https://github.com/owncloud/enterprise/issues/5427
https://github.com/owncloud/core/pull/40503
* Change - Update Symfony components: [#40521](https://github.com/owncloud/core/pull/40521)
The following Symfony components have been updated to: - console 4.4.49 -
translation 4.4.47
The following Symfony polyfill components have been updated: -
symfony/polyfill-iconv (v1.26.0 to v1.27.0) - symfony/polyfill-intl-idn (v1.26.0
to v1.27.0) - symfony/polyfill-intl-normalizer (v1.26.0 to v1.27.0) -
symfony/polyfill-mbstring (v1.26.0 to v1.27.0) - symfony/polyfill-php72 (v1.26.0
to v1.27.0) - symfony/polyfill-php73 (v1.26.0 to v1.27.0) -
symfony/polyfill-php80 (v1.26.0 to v1.27.0)
Https://symfony.com/blog/symfony-4-4-45-released
https://github.com/owncloud/core/pull/40337
https://symfony.com/blog/symfony-4-4-47-released
https://github.com/owncloud/core/pull/40424
https://symfony.com/blog/symfony-4-4-48-released
https://github.com/owncloud/core/pull/40448
https://symfony.com/blog/symfony-4-4-49-released
https://github.com/owncloud/core/pull/40517
Code that has been deprecated in Symfony 4 has been refactored to be ready for
Symfony 5.
https://github.com/owncloud/core/pull/40521
https://github.com/owncloud/core/pull/40575
https://github.com/owncloud/core/pull/40592
* Enhancement - Add account creation time: [#2298](https://github.com/owncloud/enterprise/issues/2298)
Adding account creation time in oc_accounts table
https://github.com/owncloud/enterprise/issues/2298
https://github.com/owncloud/core/pull/40588
* Enhancement - Show WebDAV Url in personal setting under app passwords: [#40509](https://github.com/owncloud/core/pull/40509)
For easy access of files through WebDAV the url is displayed right under the app
password section.
https://github.com/owncloud/core/pull/40509
* Enhancement - Show username on personal profile page: [#40510](https://github.com/owncloud/core/pull/40510)
The username as well as the full name of a user is now shown on their personal
general settings page.
https://github.com/owncloud/core/pull/40510
* Enhancement - Add legal privacy policy and imprint links to personal settings: [#40511](https://github.com/owncloud/core/pull/40511)
The links for legal.privacy_policy_url and legal.imprint_url are now displayed
on the personal general settings page so that they are conveniently available
for all users to see. These are only displayed if they are set.
https://github.com/owncloud/core/pull/40511
* Enhancement - Persistent major file version workflow: [#40531](https://github.com/owncloud/core/pull/40531)
- Restore operation logic changed. Now restore is creating new current version
of the file from one of past noncurrent versions of the file. Current version
also receives incremented mtime for the file, and author of the files is the
user that restored the file. The old noncurrent version is no longer removed
upon restore and current version no longer receives mtime of the version. - The
current version of the file is now shown in the Versions Tab, highlighted with
"gray" background - Versions now persist additional extended metadata on
versioning tags, that allow easier identification of the versions. Each update
increases minor version for the file. Current version of the file now can be
published, which increases major version tag. - Each new edit of the file would
create noncurrent versions. The ones tagged with major version due to
publishing, will be persisted long term and wont be subject to any retention
policies. - Migrate from deprecated save_version_author to save_version_metadata
https://github.com/owncloud/enterprise/issues/5286
https://github.com/owncloud/core/pull/40531
https://github.com/owncloud/core/pull/40641
* Enhancement - Add support for login policies: [#40574](https://github.com/owncloud/core/pull/40574)
Support for login policies has been added in order to block the login of users
under some circumstances. By default, there isn't any restriction, so any user
can login normally (assuming the password is correct)
A group login policy has been added. This policy allows or denies the user from
login based on the login type being used by the user (username + password,
openidconnect, etc) and whether he belongs to specific groups. This can be used
to ensure a group of users are always authenticated using a determined
authentication mechanism.
https://github.com/owncloud/core/pull/40574
* Enhancement - Add support for OCM via ScienceMesh: [#40577](https://github.com/owncloud/core/issues/40577)
We've added an if-statement in the files_sharing ShareesController code that
searches for remote sharees. When the config entry `sharing.remoteShareesSearch`
is set to the name of a class that is registered in the server container and
that implements `IRemoteShareesSearch`, for instance the
'ScienceMeshSearchPlugin' that the 'sciencemesh' app registers, use it instead
of the federatedfilesharing app to find sharee matches for OCM sharing.
https://github.com/owncloud/core/issues/40577
https://github.com/pondersource/oc-sciencemesh/pull/39
* Enhancement - Tweak rewrite conditions in .htaccess: [#40584](https://github.com/owncloud/core/pull/40584)
Changed the RewriteCond rules in the `.htaccess` file to match the expected
paths.
https://github.com/owncloud/core/pull/40584
* Enhancement - Improve UX on occ user:sync: [#40640](https://github.com/owncloud/core/pull/40640)
Backend class aliases have been added to improve usability of this command.
https://github.com/owncloud/core/pull/40640
* Enhancement - Drag & Drop folders into public file upload: [#40643](https://github.com/owncloud/core/pull/40643)
Previously only files were accepted via drag & drop. Users can now also drag
folders into a public link that has the filedrop flag. When adding a folder, the
hierarchy is flattened out and all files are added without any subfolders. Name
collisons are avoided as usual.
https://github.com/owncloud/enterprise/issues/5489
https://github.com/owncloud/core/pull/40643
* Enhancement - Make sender display name in mail notifications configurable: [#40671](https://github.com/owncloud/core/pull/40671)
In some cases mail notifications related to sharing activities are blocked by
mail filters as they are flagged as email impersonation. In such cases it may be
desirable for an oC admin to have a config option for removing the sender
display name from the "From" address. This is now possible by setting the
following config.php parameter:
Remove_sender_display_name => true
https://github.com/owncloud/core/pull/40671
# Changelog for ownCloud Core [10.11.0] (2022-08-23)
The following sections list the changes in ownCloud core 10.11.0 relevant to
ownCloud admins and users.
[10.11.0]: https://github.com/owncloud/core/compare/v10.10.0...v10.11.0
## Summary
* Bugfix - Trigger the right event when the filecache is updated: [#39844](https://github.com/owncloud/core/pull/39844)
* Bugfix - Replace userid with username in login form: [#39870](https://github.com/owncloud/core/pull/39870)
* Bugfix - List apps only once: [#39930](https://github.com/owncloud/core/issues/39930)
* Bugfix - Do not crash while running the cleanup-chunks command: [#40000](https://github.com/owncloud/core/pull/40000)
* Bugfix - Get file size using cURL on Ubuntu 20.04 and 22.04: [#40065](https://github.com/owncloud/core/pull/40065)
* Bugfix - Filter sensitive data in log for Session::createSessionToken: [#40066](https://github.com/owncloud/core/pull/40066)
* Bugfix - Correct Executed Unavailable Migrations and New Migrations: [#40084](https://github.com/owncloud/core/issues/40084)
* Bugfix - Ensure user's directory is always present: [#40091](https://github.com/owncloud/core/pull/40091)
* Bugfix - Allow usernames to be case-insensitive with app passwords: [#40119](https://github.com/owncloud/core/issues/40119)
* Bugfix - Quota can be exceeded by user: [#40140](https://github.com/owncloud/core/issues/40140)
* Bugfix - Application selection menu now appears on shared folders: [#40143](https://github.com/owncloud/core/pull/40143)
* Bugfix - Do not invalidate app tokens when no LDAP connection: [#40152](https://github.com/owncloud/core/pull/40152)
* Bugfix - Convert from utf8_encode to mb_convert_encoding: [#40158](https://github.com/owncloud/core/pull/40158)
* Bugfix - Apps requiring SAML/SSO session now load correctly at first page: [#40161](https://github.com/owncloud/core/pull/40161)
* Bugfix - Display error message when a group cannot be created: [#40162](https://github.com/owncloud/core/issues/40162)
* Bugfix - Error responses to add group API requests are inconsistent: [#40164](https://github.com/owncloud/core/issues/40164)
* Bugfix - Handle exception when adding mount to existing cache or lock: [#40192](https://github.com/owncloud/core/pull/40192)
* Bugfix - CORS on WebDAV is not working: [#40204](https://github.com/owncloud/core/pull/40204)
* Bugfix - Handle extra slashes at start of URI path: [#40216](https://github.com/owncloud/core/pull/40216)
* Bugfix - Use group's displayname in the user's profile and user list: [#40229](https://github.com/owncloud/core/pull/40229)
* Bugfix - Init encryption module before calculating unencrypted block-size: [#40240](https://github.com/owncloud/core/pull/40240)
* Bugfix - Fix personal settings display for apps which are not whitelisted: [#40257](https://github.com/owncloud/core/pull/40257)
* Bugfix - Only call getGroupDetails when the group exists: [#40261](https://github.com/owncloud/core/pull/40261)
* Bugfix - Refactor to not have required params following an optional parameter: [#40303](https://github.com/owncloud/core/pull/40303)
* Bugfix - Prevent expiry for version meta data files: [#40325](https://github.com/owncloud/core/pull/40325)
* Change - Update PHP dependencies: [#39368](https://github.com/owncloud/core/pull/39368)
* Change - Update Symfony components: [#39368](https://github.com/owncloud/core/pull/39368)
* Change - Improve visualization of author's comment in the comments section: [#40142](https://github.com/owncloud/core/pull/40142)
* Enhancement - Add default app setting on a user basis: [#39600](https://github.com/owncloud/core/pull/39600)
* Enhancement - Ignore thumbnails when propagating in home: [#39988](https://github.com/owncloud/core/pull/39988)
* Enhancement - Add language prop to /cloud/user and /cloud/users/{userid} endpoint: [#40087](https://github.com/owncloud/core/pull/40087)
* Enhancement - Add additional columns to background job queue status: [#40113](https://github.com/owncloud/core/pull/40113)
* Enhancement - Add config option to bypass the proxy setting by domain: [#40148](https://github.com/owncloud/core/pull/40148)
* Enhancement - Allow sharing with multiple users at once: [#40155](https://github.com/owncloud/core/pull/40155)
* Enhancement - Allow editing of public link shared single files: [#40264](https://github.com/owncloud/core/pull/40264)
## Details
* Bugfix - Trigger the right event when the filecache is updated: [#39844](https://github.com/owncloud/core/pull/39844)
When the filecache was being updated, an "addToCache" event was triggered. The
event has been changed to an "updateCache" event
https://github.com/owncloud/core/pull/39844
* Bugfix - Replace userid with username in login form: [#39870](https://github.com/owncloud/core/pull/39870)
The login form now replaces a user id with the user name.
https://github.com/owncloud/core/pull/39870
https://github.com/owncloud/oauth2/pull/286
* Bugfix - List apps only once: [#39930](https://github.com/owncloud/core/issues/39930)
`occ app:list --minimal` could display apps twice in the listing. Each app is
now displayed only once.
https://github.com/owncloud/core/issues/39930
https://github.com/owncloud/core/pull/40081
* Bugfix - Do not crash while running the cleanup-chunks command: [#40000](https://github.com/owncloud/core/pull/40000)
Previously, when you run the cleanup-chunks command, any unhandled exception
could crash the command. If this happened, there could be chunks that weren't
deleted.
Now, the command runs through all the chunks. If some chunks give problems, a
message is displayed indicating what error happened in which file.
https://github.com/owncloud/core/pull/40000
* Bugfix - Get file size using cURL on Ubuntu 20.04 and 22.04: [#40065](https://github.com/owncloud/core/pull/40065)
Local file size using the php-curl functions did not work on Ubuntu 20.04 or
22.04. The code has been enhanced so that the file size can be determined using
php-curl on these operating system releases.
https://github.com/owncloud/core/pull/40065
* Bugfix - Filter sensitive data in log for Session::createSessionToken: [#40066](https://github.com/owncloud/core/pull/40066)
https://github.com/owncloud/core/pull/40066
* Bugfix - Correct Executed Unavailable Migrations and New Migrations: [#40084](https://github.com/owncloud/core/issues/40084)
`occ migrations:status` was reporting an incorrect value for these items. The
problem has been corrected.
https://github.com/owncloud/core/issues/40084
https://github.com/owncloud/core/pull/40085
* Bugfix - Ensure user's directory is always present: [#40091](https://github.com/owncloud/core/pull/40091)
There are some scenarios where the user's directory might not be created. This
leads to a state where the user can't upload any file, so the admin might need
to remove the account and create a new one.
While this scenario might still happen, we're now ensuring that the user's
directory is created at some point, so the user can upload files into his
account at any time.
https://github.com/owncloud/core/pull/40091
* Bugfix - Allow usernames to be case-insensitive with app passwords: [#40119](https://github.com/owncloud/core/issues/40119)
When using an app password, the associated username can now be provided in any
case-insensitive way in requests. Username "Alice" and "alice" will work the
same.
https://github.com/owncloud/core/issues/40119
https://github.com/owncloud/core/pull/40281
* Bugfix - Quota can be exceeded by user: [#40140](https://github.com/owncloud/core/issues/40140)
Copying a file in or out of a received share could succeed even if there was not
enough storage quota allowed at the target location. This problem has been
fixed. Copies will now return 507 "Insufficient storage" in this case.
https://github.com/owncloud/core/issues/40140
https://github.com/owncloud/core/pull/39895
* Bugfix - Application selection menu now appears on shared folders: [#40143](https://github.com/owncloud/core/pull/40143)
An app selection menu will appear on public folder links when you click in a
file that could be opened with multiple apps. The behavior is the same as in the
regular file listing.
https://github.com/owncloud/core/pull/40143
* Bugfix - Do not invalidate app tokens when no LDAP connection: [#40152](https://github.com/owncloud/core/pull/40152)
Whenever connection to the LDAP server became unavailable app tokens were
getting deleted after some time causing disconnection of connected clients. App
tokens are now remaining valid until connection is back.
https://github.com/owncloud/core/pull/40152
* Bugfix - Convert from utf8_encode to mb_convert_encoding: [#40158](https://github.com/owncloud/core/pull/40158)
Function `utf8_encode` will be deprecated and removed in future PHP versions. It
has been replaced with function mb_convert_encoding.
https://github.com/owncloud/core/pull/40158
* Bugfix - Apps requiring SAML/SSO session now load correctly at first page: [#40161](https://github.com/owncloud/core/pull/40161)
Apps that require session to load some content at request start, could not be
loaded due to missing SAML/SSO session objects that could only be obtained after
the app loaded or at next visited page when that object was correctly persisted.
Now, after handling apache backend session, auth success confirmation page is
shown that redirects to the owncloud landing page.
https://github.com/owncloud/enterprise/issues/4712
https://github.com/owncloud/enterprise/issues/5225
https://github.com/owncloud/core/issues/31052
https://github.com/owncloud/core/pull/40161
* Bugfix - Display error message when a group cannot be created: [#40162](https://github.com/owncloud/core/issues/40162)
If a new group could not be created on the user-management UI, the error message
text was not displayed. This problem has been fixed.
https://github.com/owncloud/core/issues/40162
https://github.com/owncloud/core/pull/40163
* Bugfix - Error responses to add group API requests are inconsistent: [#40164](https://github.com/owncloud/core/issues/40164)
Some response error messages were contained in a `data` structure. Others were
not. They have now been made consistent. They are not contained in a `data`
structure.
https://github.com/owncloud/core/issues/40164
https://github.com/owncloud/core/pull/40165
* Bugfix - Handle exception when adding mount to existing cache or lock: [#40192](https://github.com/owncloud/core/pull/40192)
In some cases there are can be multiple parallel requests that could in their
logic attempt to create shared file mountpoint for the file or to create lock,
e.g. collaboration software. Exception to add cache or lock that already exists
is now handled
https://github.com/owncloud/enterprise/issues/5198
https://github.com/owncloud/core/pull/40192
* Bugfix - CORS on WebDAV is not working: [#40204](https://github.com/owncloud/core/pull/40204)
The list of allowed domains was not being correctly decoded, resulting in
failure to recognise a valid domain, and thus failure to send the relevant CORS
headers. The decoding of the domains list has been corrected.
https://github.com/owncloud/core/issues/40203
https://github.com/owncloud/core/pull/40204
* Bugfix - Handle extra slashes at start of URI path: [#40216](https://github.com/owncloud/core/pull/40216)
If extra slashes were present in a request URI before the path then a 500 server
error was returned. For example, https://example.com//remote.php/webdav/file.txt
Any extra slashes are now removed and the request works.
https://github.com/owncloud/core/issues/34365
https://github.com/owncloud/core/pull/40216
* Bugfix - Use group's displayname in the user's profile and user list: [#40229](https://github.com/owncloud/core/pull/40229)
Previously, the group id was being used in both the user's profile and the user
list. This hasn't been important because the local groups have matching group id
and displayname, the same for ldap groups.
Due to recent changes with the ldap app (version 0.17.0), the group id and the
displayname could be different, and they'll be different by default in the ldap
app.
In both the user's profile and the user list, the group id was being used
instead of the displayname. This is fixed now, and the displayname will be used
as intended.
https://github.com/owncloud/core/pull/40229
* Bugfix - Init encryption module before calculating unencrypted block-size: [#40240](https://github.com/owncloud/core/pull/40240)
The un-encrypted blocksize was calculated before initializing the encryption-
module. This yields the wrong size after a file-scan if
encryption.use_legacy_encoding is set to true in config.php.
https://github.com/owncloud/core/pull/40240
* Bugfix - Fix personal settings display for apps which are not whitelisted: [#40257](https://github.com/owncloud/core/pull/40257)
Apps can be disabled or enabled for guests. The personal settings for disabled
apps were still being shown to guest users. This problem has been fixed. Only
the settings for enabled apps are displayed now.
https://github.com/owncloud/core/pull/40257
* Bugfix - Only call getGroupDetails when the group exists: [#40261](https://github.com/owncloud/core/pull/40261)
When getting a group, the getGroupDetails method could be called for a group
that does not exist. That is unnecessary and may cause a group backend
implementation to log an error. The code has been refactored to avoid this
happening.
https://github.com/owncloud/core/pull/40261
* Bugfix - Refactor to not have required params following an optional parameter: [#40303](https://github.com/owncloud/core/pull/40303)
All required parameters should be listed first in PHP functions. Adjust the code
to meet this rule.
https://github.com/owncloud/core/pull/40303
* Bugfix - Prevent expiry for version meta data files: [#40325](https://github.com/owncloud/core/pull/40325)
Version meta data files now get ignored during the expiry process. This fixes
the massive amount of error logs being produced during this.
https://github.com/owncloud/core/pull/40325
* Change - Update PHP dependencies: [#39368](https://github.com/owncloud/core/pull/39368)
The following have been updated: - doctrine/cache (2.1.1 to 2.2.0) -
doctrine/event-manager (1.1.1 to 1.1.2) - egulias/email-validator (3.1.2 to
3.2.1) - guzzlehttp/guzzle (v5.3.4 to v7.4.5) - icewind/streams (0.7.5 to 0.7.6)
- laminas/laminas-stdlib (3.7.1 to 3.11.0) - laminas/laminas-validator (2.17.0
to 2.19.0) - paragonie/constant_time_encoding (v2.5.0 to v2.6.3) - sabre/dav
(4.3.1 to 4.4.0) - sabre/http (5.1.3 to 5.1.6) - sabre/uri (2.2.2 to 2.2.3) -
sabre/vobject (4.4.1 to 4.5.0) - webmozart/assert (1.10.0 to 1.11.0)
The following have been updated in apps/files_external/3rdparty: -
firebase/php-jwt (v6.2.0 to v6.3.0) - google/apiclient-services (0.244.0 to
0.259.0) - google/apiclient (2.12.4 to 2.12.6) - guzzlehttp/guzzle (v5.3.4 to
v7.4.5) - icewind/smb (3.5.2 to 3.5.4) - icewind/streams (0.7.5 to 0.7.6) -
monolog/monolog (2.5.0 to 2.8.0)
https://github.com/owncloud/core/pull/39368
https://github.com/owncloud/core/pull/40092
https://github.com/owncloud/core/pull/40110
https://github.com/owncloud/core/pull/40121
https://github.com/owncloud/core/pull/40135
https://github.com/owncloud/core/pull/40136
https://github.com/owncloud/core/pull/40137
https://github.com/owncloud/core/pull/40151
https://github.com/owncloud/core/pull/40154
https://github.com/owncloud/core/pull/40169
https://github.com/owncloud/core/pull/40171
https://github.com/owncloud/core/pull/40191
https://github.com/owncloud/core/pull/40212
https://github.com/owncloud/core/pull/40246
https://github.com/owncloud/core/pull/40250
https://github.com/owncloud/core/pull/40297
https://github.com/owncloud/core/pull/40299
* Change - Update Symfony components: [#39368](https://github.com/owncloud/core/pull/39368)
The following Symfony components have been updated to: - console 4.4.44 -
event-dispatcher 4.4.44 - process 4.4.44 - routing 4.4.44 - translation 4.4.44 -
polyfill-iconv 1.26.0 - polyfill-intl-idn 1.26.0 - polyfill-intl-normalizer
1.26.0 - polyfill-mbstring 1.26.0 - polyfill-php72 1.26.0 - polyfill-php73
1.26.0 - polyfill-php80 1.26.0 - deprecation-contracts v2.5.2 -
service-contracts v2.5.2 - translation-contracts v2.5.2 -
event-dispatcher-contracts v1.1.13
https://github.com/owncloud/core/pull/39368
https://github.com/owncloud/core/pull/40111
https://github.com/owncloud/core/pull/40169
https://github.com/owncloud/core/pull/40175
https://github.com/owncloud/core/pull/40255
https://symfony.com/blog/symfony-4-4-42-released
https://symfony.com/blog/symfony-4-4-43-released
https://symfony.com/blog/symfony-4-4-44-released
* Change - Improve visualization of author's comment in the comments section: [#40142](https://github.com/owncloud/core/pull/40142)
Previously, a long display name for the author's comment could overlap with the
"edit" action and the date. Worst case, the comment might not be edited because
the "edit" action was below the author's display name, so you might not be able
to click the action.
Right now, the author's display name won't overlap with the rest of the
elements. The display name will be cut if needed, but both the "edit" action and
the date will be clearly visible.
https://github.com/owncloud/core/pull/40142
* Enhancement - Add default app setting on a user basis: [#39600](https://github.com/owncloud/core/pull/39600)
https://github.com/owncloud/core/pull/39600
* Enhancement - Ignore thumbnails when propagating in home: [#39988](https://github.com/owncloud/core/pull/39988)
We no longer needlessly propagate the etag and mtime for thumbnails in the
filecache.
https://github.com/owncloud/core/pull/39988
* Enhancement - Add language prop to /cloud/user and /cloud/users/{userid} endpoint: [#40087](https://github.com/owncloud/core/pull/40087)
https://github.com/owncloud/core/pull/40087
* Enhancement - Add additional columns to background job queue status: [#40113](https://github.com/owncloud/core/pull/40113)
Command `occ background:queue:status` now shows additional columns for: - Last
Checked - Reserved At - Execution Duration
https://github.com/owncloud/core/pull/40113
* Enhancement - Add config option to bypass the proxy setting by domain: [#40148](https://github.com/owncloud/core/pull/40148)
The new "proxy_ignore" option allows the admin to set a list of domains that
won't go through the proxy set via the "proxy" option
https://github.com/owncloud/core/pull/40148
* Enhancement - Allow sharing with multiple users at once: [#40155](https://github.com/owncloud/core/pull/40155)
It is now possible to share resources with multiple users at once via the
following format: user1, user2, user3.
https://github.com/owncloud/enterprise/issues/2865
https://github.com/owncloud/core/pull/40155
https://github.com/owncloud/core/pull/40199
https://github.com/owncloud/core/pull/40347
* Enhancement - Allow editing of public link shared single files: [#40264](https://github.com/owncloud/core/pull/40264)
It is now possible to create a public link share of a single file with
Download/View/Edit permissions.
https://github.com/owncloud/core/pull/40264
# Changelog for ownCloud Core [10.10.0] (2022-05-16)
The following sections list the changes in ownCloud core 10.10.0 relevant to
ownCloud admins and users.
[10.10.0]: https://github.com/owncloud/core/compare/v10.9.1...v10.10.0
## Summary
* Security - Prevent stored mail settings password from showing in the webUI: [#39833](https://github.com/owncloud/core/pull/39833)
* Bugfix - Properly setup share owner file system on public link shares: [#39518](https://github.com/owncloud/core/pull/39518)
* Bugfix - Prevent group names starting or ending with white space: [#39540](https://github.com/owncloud/core/pull/39540)
* Bugfix - Set page title for the tags file list: [#39556](https://github.com/owncloud/core/issues/39556)
* Bugfix - Don't resend invitation mail if a user is guest: [#39602](https://github.com/owncloud/core/pull/39602)
* Bugfix - Text previews had faulty content if BOM was present: [#39669](https://github.com/owncloud/core/pull/39669)
* Bugfix - Fix files:checksums:verify for a single file: [#39683](https://github.com/owncloud/core/pull/39683)
* Bugfix - Moving a file from one folder into a folder that is a number fails: [#39702](https://github.com/owncloud/core/issues/39702)
* Bugfix - Make licenses expire at the end of the expiration date: [#39735](https://github.com/owncloud/core/pull/39735)
* Bugfix - Subadmin will be shown only his assignable groups in the users page: [#39752](https://github.com/owncloud/core/pull/39752)
* Bugfix - Fix wrong formatted XML in public-files dav endpoint: [#39797](https://github.com/owncloud/core/pull/39797)
* Bugfix - Fix issue restoring versions from the trashbin after sharing: [#39822](https://github.com/owncloud/core/pull/39822)
* Bugfix - Fix issue when encryption is enabled and a file is moved out of the share: [#39829](https://github.com/owncloud/core/pull/39829)
* Bugfix - Avoid sending unneeded passwords in the files_external app: [#39841](https://github.com/owncloud/core/pull/39841)
* Bugfix - Fix issue with requesting an invalid share id: [#39868](https://github.com/owncloud/core/issues/39868)
* Bugfix - Remove fr_FR language variant: [#39931](https://github.com/owncloud/core/issues/39931)
* Bugfix - Limit the width of the form on login page: [#39962](https://github.com/owncloud/core/pull/39962)
* Bugfix - Allow re-uploading the same folder after being renamed: [#39966](https://github.com/owncloud/core/pull/39966)
* Bugfix - Default for propfind depth infinity adjusted: [#40016](https://github.com/owncloud/core/pull/40016)
* Bugfix - Allow partial initialization of the FS: [#40031](https://github.com/owncloud/core/pull/40031)
* Bugfix - Filter sensitive data in log for Session::createSessionToken: [#40066](https://github.com/owncloud/core/pull/40066)
* Change - Update the default poll-interval in capabilities: [#39143](https://github.com/owncloud/core/pull/39143)
* Change - Update PHP dependencies: [#39526](https://github.com/owncloud/core/pull/39526)
* Change - Update Symfony components: [#39526](https://github.com/owncloud/core/pull/39526)
* Change - Update JavaScript dependencies: [#39709](https://github.com/owncloud/core/pull/39709)
* Change - Private keys for SFTP storage will be stored in credentials table: [#39935](https://github.com/owncloud/core/pull/39935)
* Enhancement - Allow OPTIONS request handling in framework controllers: [#38758](https://github.com/owncloud/core/pull/38758)
* Enhancement - Unify API responses when setting permissions for public links: [#39194](https://github.com/owncloud/core/pull/39194)
* Enhancement - Show detailed error message if moving a mount into another fails: [#39584](https://github.com/owncloud/core/pull/39584)
* Enhancement - Add warnings for commands that are incompatible with object storage: [#39604](https://github.com/owncloud/core/pull/39604)
* Enhancement - Cache some data in memory from the filecache: [#39847](https://github.com/owncloud/core/pull/39847)
* Enhancement - Add product to version in capabilities response: [#39851](https://github.com/owncloud/core/pull/39851)
* Enhancement - Allow files_external app to be disabled: [#39856](https://github.com/owncloud/core/pull/39856)
* Enhancement - Improve FileDrop view: [#39900](https://github.com/owncloud/core/pull/39900)
* Enhancement - Align "close" for messages: [#39907](https://github.com/owncloud/core/pull/39907)
* Enhancement - Changes regarding cookie handling: [#39916](https://github.com/owncloud/core/pull/39916)
* Enhancement - Expose user type of share receiver in share api: [#40013](https://github.com/owncloud/core/pull/40013)
* Enhancement - Use the same string in the header also in public view: [#40032](https://github.com/owncloud/core/pull/40032)
## Details
* Security - Prevent stored mail settings password from showing in the webUI: [#39833](https://github.com/owncloud/core/pull/39833)
https://github.com/owncloud/enterprise/issues/5035
https://github.com/owncloud/core/pull/39833
* Bugfix - Properly setup share owner file system on public link shares: [#39518](https://github.com/owncloud/core/pull/39518)
https://github.com/owncloud/core/pull/39518
* Bugfix - Prevent group names starting or ending with white space: [#39540](https://github.com/owncloud/core/pull/39540)
https://github.com/owncloud/core/pull/39540
* Bugfix - Set page title for the tags file list: [#39556](https://github.com/owncloud/core/issues/39556)
https://github.com/owncloud/core/issues/39556
https://github.com/owncloud/core/pull/39585
* Bugfix - Don't resend invitation mail if a user is guest: [#39602](https://github.com/owncloud/core/pull/39602)
With this change the resend invitation mail action in the user management UI for
guest users has been removed, it is not appropriate for this type of user.
https://github.com/owncloud/enterprise/issues/4868
https://github.com/owncloud/core/pull/39602
* Bugfix - Text previews had faulty content if BOM was present: [#39669](https://github.com/owncloud/core/pull/39669)
The BOM was incorrectly detected and was causing ownCloud to choose the wrong
font for the text, showing unexpected results. The BOM is now processed
correctly and the preview is shown as expected
https://github.com/owncloud/core/pull/39669
* Bugfix - Fix files:checksums:verify for a single file: [#39683](https://github.com/owncloud/core/pull/39683)
Fixed an issue where running files:checksums:verify for a single file would
fail.
https://github.com/owncloud/core/pull/39683
* Bugfix - Moving a file from one folder into a folder that is a number fails: [#39702](https://github.com/owncloud/core/issues/39702)
The issue is fixed by updating sabre/dav from 4.3.0 to 4.3.1
https://github.com/owncloud/core/issues/39702
https://github.com/owncloud/core/pull/39703
* Bugfix - Make licenses expire at the end of the expiration date: [#39735](https://github.com/owncloud/core/pull/39735)
https://github.com/owncloud/core/pull/39735
* Bugfix - Subadmin will be shown only his assignable groups in the users page: [#39752](https://github.com/owncloud/core/pull/39752)
Previously, the subadmin could see all groups even if he could only assign users
to a bunch of them. Now the subadmin will see the groups he can assign to the
user
https://github.com/owncloud/core/pull/39752
* Bugfix - Fix wrong formatted XML in public-files dav endpoint: [#39797](https://github.com/owncloud/core/pull/39797)
Previously, trying to perform a PROPFIND over the public-files endpoint could
cause an exception to be thrown, which would generate a wrong formatted XML
response. Now, the XML response is properly formatted and can be parsed without
problems.
https://github.com/owncloud/core/pull/39797
* Bugfix - Fix issue restoring versions from the trashbin after sharing: [#39822](https://github.com/owncloud/core/pull/39822)
Previously, having encryption enabled, if a user shared a folder with another
user, and that new user removed a file inside that shared folder, that file
ended up in the new user's trashbin along with the file's versions. Restoring
that file from the trashbin caused the versions of that file to get broken due
to a bad signature. The file was restored correctly. Now, the versions are also
restored correctly from the trashbin too.
https://github.com/owncloud/core/pull/39822
* Bugfix - Fix issue when encryption is enabled and a file is moved out of the share: [#39829](https://github.com/owncloud/core/pull/39829)
When encryption was used, moving a file out of a shared folder caused the
versions of the file to get broken. The file was moved correctly though. This
happened due to the key file not being copied to the new location and a new key
file being generated for the file. Now, the key file is properly copied to the
new location, so the versions can be decrypted properly.
https://github.com/owncloud/core/pull/39829
* Bugfix - Avoid sending unneeded passwords in the files_external app: [#39841](https://github.com/owncloud/core/pull/39841)
Some passwords were being sent to the web UI in the external storage
configuration. These passwords aren't required and they're now replaced in the
web UI in order not to leak the actual password
https://github.com/owncloud/core/pull/39841
* Bugfix - Fix issue with requesting an invalid share id: [#39868](https://github.com/owncloud/core/issues/39868)
When using the pgsql database and requesting an invalid share id, a 500 error
status could be returned. This has been fixed. A 404 "not found" is now
returned.
https://github.com/owncloud/core/issues/39868
https://github.com/owncloud/core/pull/39873
* Bugfix - Remove fr_FR language variant: [#39931](https://github.com/owncloud/core/issues/39931)
French translations were in both the "fr" and the "fr_FR" language codes.
"fr_FR" had very few translations and could cause missing translations when the
system did not automatically choose "fr". The "fr_FR" translations have been
removed. Translators should use "fr" when doing translations in Transifex.
https://github.com/owncloud/core/issues/39931
https://github.com/owncloud/core/pull/39939
* Bugfix - Limit the width of the form on login page: [#39962](https://github.com/owncloud/core/pull/39962)
The login form breaks if error messages and info messages are longer.
https://github.com/owncloud/core/pull/39962
* Bugfix - Allow re-uploading the same folder after being renamed: [#39966](https://github.com/owncloud/core/pull/39966)
Previously, you couldn't upload a folder, rename it in the web UI and then
re-upload the same folder.
This behavior is fixed, so you can now re-upload the folder after renaming it
https://github.com/owncloud/core/pull/39966
* Bugfix - Default for propfind depth infinity adjusted: [#40016](https://github.com/owncloud/core/pull/40016)
Fixed potential cause for performance issues under certain conditions with
infinite propfind being enabled by default.
https://github.com/owncloud/enterprise/issues/5154
https://github.com/owncloud/core/pull/40016
* Bugfix - Allow partial initialization of the FS: [#40031](https://github.com/owncloud/core/pull/40031)
Previously, when the FS was initialized, we needed to make a request to the LDAP
server in order to fetch the possible group shares of the user. Some commands
only accessed to the trashbin or versions, and operated for a target user, so
accessing to the LDAP server to fetch groups that wouldn't be used doesn't make
much sense.
Now, the commands have the ability to initialize the FS partially, meaning that
no additional mount point other than the home one will be mounted. In
particular, this affects shares and external storages. Anyway, the commands that
have been modified don't need such access. The main advantage is that now, those
commands can operate without a working connection to the LDAP server because the
users will be fetched from the DB and they don't operate with groups.
https://github.com/owncloud/core/pull/40031
* Bugfix - Filter sensitive data in log for Session::createSessionToken: [#40066](https://github.com/owncloud/core/pull/40066)
https://github.com/owncloud/core/pull/40066
* Change - Update the default poll-interval in capabilities: [#39143](https://github.com/owncloud/core/pull/39143)
The default pollinterval advertised in capabilities has been set to 30000
milliseconds. Previously it was 60 milliseconds.
https://github.com/owncloud/core/pull/39143
* Change - Update PHP dependencies: [#39526](https://github.com/owncloud/core/pull/39526)
The following have been updated: - christophwurst/id3parser (v0.1.3 to v0.1.4) -
doctrine/dbal (2.13.5 to 2.13.9) - doctrine/lexer (1.2.1 to 1.2.3) -
laminas/laminas-inputfilter (2.12.0 to 2.12.1) - laminas/laminas-stdlib (3.6.1
to 3.7.1) - laminas/laminas-validator (2.15.0 to 2.17.0) -
laminas/laminas-zendframework-bridge (1.4.0 to 1.4.1) - league/flysystem (1.1.5
to 1.1.9) - league/mime-type-detection (1.8.0 to 1.11.0) - opis/closure (3.6.2
to 3.6.3) - paragonie/constant_time_encoding (2.4.0 to 2.5.0) -
phpseclib/phpseclib (3.0.11 to 3.0.14) - sabre/dav (4.2.0 to 4.3.1) -
sabre/vobject (4.4.0 to 4.4.1)
The following have been updated in apps/files_external/3rdparty: -
google/apiclient (2.11.0 to 2.12.4) - google/apiclient-services (0.231.0 to
0.244.0) - guzzlehttp/psr7 (1.8.3 to 1.8.5) - icewind/smb (3.5.1 to 3.5.2) -
monolog/monolog (2.3.5 to 2.5.0) - paragonie/constant_time_encoding (v2.4.0 to
v2.5.0) - phpseclib/phpseclib (3.0.11 to 3.0.14) - react/promise (v2.8.0 to
v2.9.0)
https://github.com/owncloud/core/pull/39526
https://github.com/owncloud/core/pull/39567
https://github.com/owncloud/core/pull/39631
https://github.com/owncloud/core/pull/39649
https://github.com/owncloud/core/pull/39693
https://github.com/owncloud/core/pull/39695
https://github.com/owncloud/core/pull/39703
https://github.com/owncloud/core/pull/39713
https://github.com/owncloud/core/pull/39717
https://github.com/owncloud/core/pull/39731
https://github.com/owncloud/core/pull/39780
https://github.com/owncloud/core/pull/39838
https://github.com/owncloud/core/pull/39839
https://github.com/owncloud/core/pull/39859
https://github.com/owncloud/core/pull/39949
https://github.com/owncloud/core/pull/39956
https://github.com/owncloud/core/pull/39999
https://github.com/owncloud/core/pull/40001
https://github.com/owncloud/core/pull/40003
https://github.com/owncloud/core/pull/40038
* Change - Update Symfony components: [#39526](https://github.com/owncloud/core/pull/39526)
The following Symfony components have been updated to: - console 4.4.41 -
event-dispatcher 4.4.37 - event-dispatcher-contracts 4.4.34 - process 4.4.41 -
routing 4.4.41 - service-contracts 4.4.34 - translation 4.4.41 -
translation-contracts 2.5.0
The following Symfony polyfill components have been updated to: -
symfony/polyfill-ctype v1.25.0 - symfony/polyfill-iconv v1.25.0 -
symfony/polyfill-intl-idn v1.25.0 - symfony/polyfill-intl-normalizer v1.25.0 -
symfony/polyfill-mbstring v1.25.0 - symfony/polyfill-php72 v1.25.0 -
symfony/polyfill-php73 v1.25.0 - symfony/polyfill-php80 v1.25.0
The following Symfony contract components have been updated to: -
symfony/deprecation-contracts (v2.5.0 to v2.5.1) -
symfony/event-dispatcher-contracts (v1.1.11 to v1.1.12) -
symfony/service-contracts (v2.5.0 to v2.5.1) - symfony/translation-contracts
(v2.5.0 to v2.5.1)
https://github.com/owncloud/core/pull/39526
https://github.com/owncloud/core/pull/39631
https://github.com/owncloud/core/pull/39646
https://github.com/owncloud/core/pull/39731
https://github.com/owncloud/core/pull/39838
https://github.com/owncloud/core/pull/39855
https://github.com/owncloud/core/pull/39940
https://github.com/owncloud/core/pull/39955
https://github.com/owncloud/core/pull/40026
https://symfony.com/blog/symfony-4-4-34-released
https://symfony.com/blog/symfony-4-4-36-released
https://symfony.com/blog/symfony-4-4-37-released
https://symfony.com/blog/symfony-4-4-38-released
https://symfony.com/blog/symfony-4-4-40-released
https://symfony.com/blog/symfony-4-4-41-released
* Change - Update JavaScript dependencies: [#39709](https://github.com/owncloud/core/pull/39709)
The following have been updated: - ansi-regex (3.0.0 to 3.0.1) -
bower_components/backbone (1.4.0 to 1.4.1) - bower_components/showdown (1.9.1 to
2.0.0) - bower_components/underscore (1.13.1 to 1.13.2) - follow-redirects
(1.14.2 to 1.14.8) - karma (6.3.8 to 6.3.19) - karma-coverage (2.0.3 to 2.2.0) -
log4js (6.3.0 to 6.4.1) - minimist (1.2.5 to 1.2.6)
https://github.com/owncloud/core/pull/39709
https://github.com/owncloud/core/pull/39763
https://github.com/owncloud/core/pull/39764
https://github.com/owncloud/core/pull/39785
https://github.com/owncloud/core/pull/39788
https://github.com/owncloud/core/pull/39814
https://github.com/owncloud/core/pull/39816
https://github.com/owncloud/core/pull/39838
https://github.com/owncloud/core/pull/39839
https://github.com/owncloud/core/pull/39926
https://github.com/owncloud/core/pull/39941
https://github.com/owncloud/core/pull/39989
* Change - Private keys for SFTP storage will be stored in credentials table: [#39935](https://github.com/owncloud/core/pull/39935)
Previously, both private and public keys were part of the configuration of the
SFTP mount point. Although encrypted, there were some scenarios where the
private key could be visible.
The following changes have been implemented: * The private key will never leave
the ownCloud server. * The private key will be stored encrypted inside the
oc_credentials table. * A random token will be created to refer to the private
key. This token will be part of the SFTP mount point configuration. * The public
key will be treated as a normal configuration parameter. This means that it
won't be neither encrypted nor encoded in any way.
The overall behavior remains the same. ownCloud will generate a key pair, whose
public key will need to be placed in the SFTP server.
https://github.com/owncloud/core/pull/39935
* Enhancement - Allow OPTIONS request handling in framework controllers: [#38758](https://github.com/owncloud/core/pull/38758)
https://github.com/owncloud/core/pull/38758
* Enhancement - Unify API responses when setting permissions for public links: [#39194](https://github.com/owncloud/core/pull/39194)
Setting (and changing) the permissions of public links via the OCS API will now
return proper and unified API responses. Adding create permissions while public
uploading is disabled globally will always return a 403 response.
https://github.com/owncloud/core/issues/36442
https://github.com/owncloud/core/issues/36443
https://github.com/owncloud/core/pull/39194
* Enhancement - Show detailed error message if moving a mount into another fails: [#39584](https://github.com/owncloud/core/pull/39584)
With this change, a detailed error message is shown when moving a mount point
into another mount point fails. This is for example the case while moving a
shared folder into a SFTP external storage.
https://github.com/owncloud/core/issues/39550
https://github.com/owncloud/core/pull/39584
* Enhancement - Add warnings for commands that are incompatible with object storage: [#39604](https://github.com/owncloud/core/pull/39604)
The following commands are affected:
* `user:home:list-users` * `user:home:list-dirs` * `user:move` * `user:report`
https://github.com/owncloud/core/issues/39590
https://github.com/owncloud/core/pull/39604
* Enhancement - Cache some data in memory from the filecache: [#39847](https://github.com/owncloud/core/pull/39847)
Some data from the filecache will be cached from the DB after accessing. This
will improve the performance a bit.
https://github.com/owncloud/core/pull/39847
* Enhancement - Add product to version in capabilities response: [#39851](https://github.com/owncloud/core/pull/39851)
https://github.com/owncloud/core/pull/39851
* Enhancement - Allow files_external app to be disabled: [#39856](https://github.com/owncloud/core/pull/39856)
Previously, the files_external app couldn't be disabled. The corresponding
section in the settings page had a checkbox to show or not the settings for the
files_external app. Now, if the app is disabled, that section won't appear. The
behavior will be the same as any other disabled app.
https://github.com/owncloud/core/pull/39856
* Enhancement - Improve FileDrop view: [#39900](https://github.com/owncloud/core/pull/39900)
Small change in the design and behavior of the FileDrop view of Public Links.
- The font is bigger and thicker - Background color was added to the list of
files - The text in the "Dropbox" is wrapped properly, line-height was removed -
Don't hide the logo on small resolutions
https://github.com/owncloud/core/pull/39900
* Enhancement - Align "close" for messages: [#39907](https://github.com/owncloud/core/pull/39907)
The close button for messages (yellow banner) was slightly displaced.
https://github.com/owncloud/core/pull/39907
* Enhancement - Changes regarding cookie handling: [#39916](https://github.com/owncloud/core/pull/39916)
The following changes have been implemented: * The expiration set for the
passphrase cookie will be refreshed each time a page is loaded or when the
"heartbeat" endpoint is hit * If the "session_keepalive" config option is set to
true, a periodic request to the "heartbeat" endpoint will be made automatically
regardless of any activity going on. This will extend the session lifetime
preventing its expiration. * If the "session_keepalive" config option is set to
false, a "heartbeat" will be sent based on activity in order to extend the
session lifetime. If we don't detect any activity, the session might expire, and
the user will need to login again. * The new "session_forced_logout_timeout"
option has been added to the config.php. It's disabled by default, and setting a
positive (non-zero) value will enable the feature. If it's enabled, the
passphrase cookie will expire after those number of seconds pass, when the tab
or the browser closes. This will force the user to login again.
https://github.com/owncloud/core/pull/39916
* Enhancement - Expose user type of share receiver in share api: [#40013](https://github.com/owncloud/core/pull/40013)
https://github.com/owncloud/core/pull/40013
* Enhancement - Use the same string in the header also in public view: [#40032](https://github.com/owncloud/core/pull/40032)
In the public view, a different string was used next to the logo than in the
internal header. This can cause problems with branding.
The string HTMLName from defaults.php is now only used for the header. Name is
used exclusively for the mail templates.
https://github.com/owncloud/core/pull/40032
# Changelog for ownCloud Core [10.9.1] (2022-01-12)
The following sections list the changes in ownCloud core 10.9.1 relevant to
ownCloud admins and users.
[10.9.1]: https://github.com/owncloud/core/compare/v10.9.0...v10.9.1
## Summary
* Bugfix - Prevent encrypted files from being corrupted when overwriting them: [#39623](https://github.com/owncloud/core/pull/39623)
* Bugfix - Getting the file owner for share recipients: [#39670](https://github.com/owncloud/core/pull/39670)
* Bugfix - Prevent version author from being overwritten with wrong uid: [#39673](https://github.com/owncloud/core/pull/39673)
## Details
* Bugfix - Prevent encrypted files from being corrupted when overwriting them: [#39623](https://github.com/owncloud/core/pull/39623)
Fixed an issue where overwriting an encrypted file by a share recipient would
corrupt it. This is a regression which was introduced by #39516.
https://github.com/owncloud/encryption/issues/315
https://github.com/owncloud/core/pull/39623
* Bugfix - Getting the file owner for share recipients: [#39670](https://github.com/owncloud/core/pull/39670)
Fixed a bug where a wrong file owner was retrieved when saving version authors.
This scenario happened for share recipients if they had a file with the same
name as the shared file.
https://github.com/owncloud/core/issues/39662
https://github.com/owncloud/core/pull/39670
* Bugfix - Prevent version author from being overwritten with wrong uid: [#39673](https://github.com/owncloud/core/pull/39673)
Fixed an issue where restoring a previous version could lead to a wrong version
author being saved, basically overwriting the correct author.
https://github.com/owncloud/core/issues/39672
https://github.com/owncloud/core/pull/39673
# Changelog for ownCloud Core [10.9.0] (2021-12-20)
The following sections list the changes in ownCloud core 10.9.0 relevant to
ownCloud admins and users.
[10.9.0]: https://github.com/owncloud/core/compare/v10.8.0...v10.9.0
## Summary
* Security - Patch jquery ui: [#39451](https://github.com/owncloud/core/pull/39451)
* Security - Patch jquery ui CVE-2016-7103: [#39545](https://github.com/owncloud/core/pull/39545)
* Bugfix - Do not try to login via auth module if the user is disabled: [#36257](https://github.com/owncloud/core/pull/36257)
* Bugfix - Don't show exact search results with empty sharee search query: [#38501](https://github.com/owncloud/core/issues/38501)
* Bugfix - Do not allow empty system or app config keys: [#38996](https://github.com/owncloud/core/pull/38996)
* Bugfix - Allow subadministrators to add users to groups they manage: [#39013](https://github.com/owncloud/core/pull/39013)
* Bugfix - Update and upgrade words are inconsistent on the web UI: [#39028](https://github.com/owncloud/core/issues/39028)
* Bugfix - Avoid potential open_basedir errors after upgrade to PHP 7.4.21: [#39034](https://github.com/owncloud/core/issues/39034)
* Bugfix - Allow copying file keys when storage has multiple mount points: [#39058](https://github.com/owncloud/core/pull/39058)
* Bugfix - Show previews in profile picture setting, select from files: [#39067](https://github.com/owncloud/core/pull/39067)
* Bugfix - Do not try to delete the folder twice: [#39070](https://github.com/owncloud/core/pull/39070)
* Bugfix - Close open menus if click is on an iFrame: [#39093](https://github.com/owncloud/core/issues/39093)
* Bugfix - Prevent unneeded call to LDAP during login with local users: [#39105](https://github.com/owncloud/core/pull/39105)
* Bugfix - Clarify the description of the manual file locking option: [#39106](https://github.com/owncloud/core/pull/39106)
* Bugfix - Update appinfo cache only if the app version is newer: [#39108](https://github.com/owncloud/core/pull/39108)
* Bugfix - Fix logo size on login screen: [#39129](https://github.com/owncloud/core/pull/39129)
* Bugfix - Image orientation: [#39140](https://github.com/owncloud/core/pull/39140)
* Bugfix - Fix display of tag selection in sidebar: [#39146](https://github.com/owncloud/core/pull/39146)
* Bugfix - Keep pagination active with empty search queries: [#39155](https://github.com/owncloud/core/pull/39155)
* Bugfix - File conflict dialog when dragging a file into a folder: [#39162](https://github.com/owncloud/core/pull/39162)
* Bugfix - Return proper error if part file name is too long: [#39168](https://github.com/owncloud/core/pull/39168)
* Bugfix - Set file name to download.zip while downloading the whole user directory: [#39198](https://github.com/owncloud/core/pull/39198)
* Bugfix - Preview rendering for sharees: [#39202](https://github.com/owncloud/core/pull/39202)
* Bugfix - Add permission check when restoring from trashbin: [#39210](https://github.com/owncloud/core/pull/39210)
* Bugfix - Show missing delete button in file list on mobile view: [#39221](https://github.com/owncloud/core/issues/39221)
* Bugfix - Don't count non-user folder in occ user:report command: [#39223](https://github.com/owncloud/core/pull/39223)
* Bugfix - Return proper error when destination header is missing: [#39235](https://github.com/owncloud/core/pull/39235)
* Bugfix - Show the correct expiring date in 'Shared by link' files list: [#39238](https://github.com/owncloud/core/pull/39238)
* Bugfix - Hide share owner file path for share receiver: [#39241](https://github.com/owncloud/core/pull/39241)
* Bugfix - Spelling errors: [#39252](https://github.com/owncloud/core/pull/39252)
* Bugfix - Command occ 'user:report' might not count 'user directories' correctly: [#39254](https://github.com/owncloud/core/pull/39254)
* Bugfix - Simplify set password text for new passwords: [#39257](https://github.com/owncloud/core/pull/39257)
* Bugfix - Allow user:list and group:list to filter on short strings: [#39258](https://github.com/owncloud/core/pull/39258)
* Bugfix - Fix doc placeholder URL in "general"-settings: [#39267](https://github.com/owncloud/core/pull/39267)
* Bugfix - Setting 0 as user display name: [#39272](https://github.com/owncloud/core/pull/39272)
* Bugfix - Fix malformed error message while accepting a share is not possible: [#39287](https://github.com/owncloud/core/pull/39287)
* Bugfix - Decouple change email from 'allow_user_to_change_display_name' setting: [#39288](https://github.com/owncloud/core/pull/39288)
* Bugfix - Don't show empty brackets in lock owner information if mail not set: [#39292](https://github.com/owncloud/core/pull/39292)
* Bugfix - Use original UID when setting the share receiver: [#39293](https://github.com/owncloud/core/pull/39293)
* Bugfix - Versions for files named "0": [#39300](https://github.com/owncloud/core/pull/39300)
* Bugfix - Sanitize data send to the server while creating users via webUI: [#39306](https://github.com/owncloud/core/pull/39306)
* Bugfix - File version names for share recipients: [#39314](https://github.com/owncloud/core/pull/39314)
* Bugfix - Allow renaming two files with the same name but different paths: [#39315](https://github.com/owncloud/core/pull/39315)
* Bugfix - No sensitive data on exception page: [#39334](https://github.com/owncloud/core/pull/39334)
* Bugfix - Hide legacy login button animation: [#39352](https://github.com/owncloud/core/pull/39352)
* Bugfix - Prohibit email/displayname change via API when not allowed: [#39353](https://github.com/owncloud/core/pull/39353)
* Bugfix - Clicking in the middle of the row in the file list downloads the file: [#39361](https://github.com/owncloud/core/pull/39361)
* Bugfix - Adjust text of occ encryption command messages: [#39395](https://github.com/owncloud/core/pull/39395)
* Bugfix - Faulty file list entry after accepting a federated share: [#39411](https://github.com/owncloud/core/pull/39411)
* Bugfix - Add missing `remoteshare.accepted` event parameters: [#39449](https://github.com/owncloud/core/pull/39449)
* Bugfix - Group administrator permissions: [#39477](https://github.com/owncloud/core/pull/39477)
* Bugfix - Load l10n js files from the correct app folder: [#39482](https://github.com/owncloud/core/pull/39482)
* Bugfix - Fix issue searching inside a shared external storage: [#39500](https://github.com/owncloud/core/pull/39500)
* Bugfix - Fix favicon, cloud symbol on Safari not visible: [#39506](https://github.com/owncloud/core/pull/39506)
* Bugfix - Clicking the eye icon in password input field does not show the password: [#39528](https://github.com/owncloud/core/pull/39528)
* Bugfix - Group select in user create panel allows empty and pre-existing groups: [#39532](https://github.com/owncloud/core/pull/39532)
* Bugfix - An app config value of null could be entered but not updated: [#39554](https://github.com/owncloud/core/pull/39554)
* Bugfix - Directory name in error message when file name already exists: [#39569](https://github.com/owncloud/core/pull/39569)
* Bugfix - Prohibit username htaccesstest.txt: [#39572](https://github.com/owncloud/core/pull/39572)
* Bugfix - Use ViewOnlyPlugin when requesting a meta endpoint using WebDAV v2: [#39575](https://github.com/owncloud/core/pull/39575)
* Bugfix - Provisioning API quota is incomplete when username casing is not exact: [#39586](https://github.com/owncloud/core/pull/39586)
* Change - Enable streaming for propfind requests: [#38583](https://github.com/owncloud/core/pull/38583)
* Change - Update PHP dependencies: [#38907](https://github.com/owncloud/core/pull/38907)
* Change - Update url for sync client button and docs: [#38962](https://github.com/owncloud/core/pull/38962)
* Change - Update Symfony components: [#39061](https://github.com/owncloud/core/pull/39061)
* Change - Clarify days parameter of the occ dav:cleanup-chunks command: [#39090](https://github.com/owncloud/core/pull/39090)
* Change - Drop PHP 7.2 support across the platform: [#39134](https://github.com/owncloud/core/issues/39134)
* Change - Add index.html to invalid username list: [#39206](https://github.com/owncloud/core/pull/39206)
* Change - Update JavaScript dependencies: [#39385](https://github.com/owncloud/core/pull/39385)
* Change - Allow setting multiple default file actions: [#39541](https://github.com/owncloud/core/pull/39541)
* Change - Use "federated" rather than "remote" for shares: [#39578](https://github.com/owncloud/core/pull/39578)
* Enhancement - Add setting to limit public link share creation to certain groups: [#3632](https://github.com/owncloud/enterprise/issues/3632)
* Enhancement - Save and display the author of a file version: [#4518](https://github.com/owncloud/enterprise/issues/4518)
* Enhancement - Add tooltips for group names in user settings and sharing overview: [#4695](https://github.com/owncloud/enterprise/issues/4695)
* Enhancement - Quick action for creating public links: [#4718](https://github.com/owncloud/enterprise/issues/4718)
* Enhancement - Special user groups can break persistent locks: [#38222](https://github.com/owncloud/core/pull/38222)
* Enhancement - Allow oc_sessionPassphrase cookie to expire with session_lifetime: [#38991](https://github.com/owncloud/core/issues/38991)
* Enhancement - Log number of mounts when moving encryption keys fails: [#39015](https://github.com/owncloud/core/pull/39015)
* Enhancement - Include new DB index to speed up addressbook searches: [#39017](https://github.com/owncloud/core/pull/39017)
* Enhancement - Add command to verify all available doc links: [#39026](https://github.com/owncloud/core/pull/39026)
* Enhancement - Show create and cancel buttons in the 'New file menu': [#39056](https://github.com/owncloud/core/pull/39056)
* Enhancement - Extend transfer ownership cmd with option to transfer entire user: [#39118](https://github.com/owncloud/core/pull/39118)
* Enhancement - Add console command to move a user's home folder: [#39136](https://github.com/owncloud/core/pull/39136)
* Enhancement - Confirmation dialog for deleting tags: [#39157](https://github.com/owncloud/core/issues/39157)
* Enhancement - Display clickable links during web UI upgrade process: [#39184](https://github.com/owncloud/core/pull/39184)
* Enhancement - Don't show updater if setting 'upgrade.disable-web' is set to true: [#39185](https://github.com/owncloud/core/pull/39185)
* Enhancement - Hide accept and decline share text on mobile view: [#39224](https://github.com/owncloud/core/pull/39224)
* Enhancement - Add option to hide the upload estimation in WebUI: [#39228](https://github.com/owncloud/core/pull/39228)
* Enhancement - Allow skeletondirectory to be an empty string: [#39230](https://github.com/owncloud/core/pull/39230)
* Enhancement - Improve mobile view for "Shared by link" file list: [#39232](https://github.com/owncloud/core/pull/39232)
* Enhancement - Use icons + buttons instead of text for file actions in mobile view: [#39233](https://github.com/owncloud/core/pull/39233)
* Enhancement - Hide restore text in deleted files list on mobile device: [#39236](https://github.com/owncloud/core/pull/39236)
* Enhancement - Redesign group list in the user settings view: [#39262](https://github.com/owncloud/core/pull/39262)
* Enhancement - Previews for text files including non-latin characters: [#39271](https://github.com/owncloud/core/pull/39271)
* Enhancement - Allow empty folder uploads via webUI: [#39285](https://github.com/owncloud/core/pull/39285)
* Enhancement - Add support for MariaDB 10.6: [#39286](https://github.com/owncloud/core/pull/39286)
* Enhancement - Optimized preview for text files: [#39296](https://github.com/owncloud/core/pull/39296)
* Enhancement - Add test receiver mail in Email Settings Admin Panel: [#39297](https://github.com/owncloud/core/pull/39297)
* Enhancement - Change user casing log level to "debug": [#39299](https://github.com/owncloud/core/pull/39299)
* Enhancement - Hide the "Remove Password" button on public links: [#39302](https://github.com/owncloud/core/pull/39302)
* Enhancement - Trim spaces while creating, uploading or renaming entities in webUI: [#39310](https://github.com/owncloud/core/pull/39310)
* Enhancement - Bring back minimalistic view to occ app:list with '-m' option: [#39326](https://github.com/owncloud/core/pull/39326)
* Enhancement - Add quality setting for JP(E)G preview images: [#39349](https://github.com/owncloud/core/pull/39349)
* Enhancement - Add last_login to Provisioning API get user response: [#39351](https://github.com/owncloud/core/pull/39351)
* Enhancement - Added needed code for webp thumbnail generation to occur: [#39358](https://github.com/owncloud/core/issues/39358)
* Enhancement - Add priority for JavaScript plugins: [#39359](https://github.com/owncloud/core/pull/39359)
* Enhancement - Add show-all-attributes option to occ user:list command: [#39366](https://github.com/owncloud/core/pull/39366)
* Enhancement - Add text to root element of breadcrumb: [#39367](https://github.com/owncloud/core/pull/39367)
* Enhancement - Extend occ dav:cleanup-chunks command with local option: [#39394](https://github.com/owncloud/core/pull/39394)
* Enhancement - Add activity translations for rename and move actions: [#39430](https://github.com/owncloud/core/pull/39430)
* Enhancement - Add capability for blacklisted files regex: [#39493](https://github.com/owncloud/core/pull/39493)
* Enhancement - Change the size of the ownCloud logo in the mail header image: [#39501](https://github.com/owncloud/core/pull/39501)
* Enhancement - Add user:home:list-dirs and user:home:list-users commands: [#39579](https://github.com/owncloud/core/pull/39579)
* Enhancement - Expand file name area to click: [#39592](https://github.com/owncloud/core/pull/39592)
* Enhancement - Add support for the x-office/drawing mimetype: [#39594](https://github.com/owncloud/core/pull/39594)
## Details
* Security - Patch jquery ui: [#39451](https://github.com/owncloud/core/pull/39451)
Patched jquery ui issues:
* CVE-2021-41182 * CVE-2021-41183 * CVE-2021-41184
https://github.com/owncloud/core/pull/39451
* Security - Patch jquery ui CVE-2016-7103: [#39545](https://github.com/owncloud/core/pull/39545)
Patched a CVE regarding the jquery dialog widget. This widget is currently not
being used so this is a preventive patch.
https://github.com/owncloud/core/pull/39545
* Bugfix - Do not try to login via auth module if the user is disabled: [#36257](https://github.com/owncloud/core/pull/36257)
Trying to login via an auth module (such as OAuth2) created a new session token
even if the user was disabled. This was causing errors to appear in the logs
because the new session token created after enabling the user was in use. Now, a
disabled user won't create that session token.
https://github.com/owncloud/core/pull/36257
* Bugfix - Don't show exact search results with empty sharee search query: [#38501](https://github.com/owncloud/core/issues/38501)
When setting user.search_min_length to 0 and using an empty query to search for
sharees, there won't be any exact search results.
https://github.com/owncloud/core/issues/38501
https://github.com/owncloud/core/pull/39186
* Bugfix - Do not allow empty system or app config keys: [#38996](https://github.com/owncloud/core/pull/38996)
It was possible to add empty config keys with the occ config:app:set or
config:system:set commands. That is no longer allowed.
https://github.com/owncloud/core/pull/38996
* Bugfix - Allow subadministrators to add users to groups they manage: [#39013](https://github.com/owncloud/core/pull/39013)
https://github.com/owncloud/core/pull/39013
* Bugfix - Update and upgrade words are inconsistent on the web UI: [#39028](https://github.com/owncloud/core/issues/39028)
The words about "upgrade needed" on the web UI sometimes used "update". The
upgrade messages now consistently use the word "upgrade", which matches with the
occ upgrade command.
https://github.com/owncloud/core/issues/39028
https://github.com/owncloud/core/pull/39032
* Bugfix - Avoid potential open_basedir errors after upgrade to PHP 7.4.21: [#39034](https://github.com/owncloud/core/issues/39034)
PHP 7.4.21 checks open_basedir settings more exactly. Calls to file_exists can
emit log messages like "file_exists(): open_basedir restriction in effect" that
were not emitted by PHP 7.4.20.
This change fixes an incorrect file_exists check. The open_basedir message will
no longer be emitted in this case.
https://github.com/owncloud/core/issues/39034
https://github.com/owncloud/core/pull/39035
* Bugfix - Allow copying file keys when storage has multiple mount points: [#39058](https://github.com/owncloud/core/pull/39058)
https://github.com/owncloud/core/pull/39058
* Bugfix - Show previews in profile picture setting, select from files: [#39067](https://github.com/owncloud/core/pull/39067)
Before this PR, image previews was not shown anymore in
Settings->Personal->Profile picture->Select from Files, as well the UI was
cropped. This has been fixed with this PR.
https://github.com/owncloud/enterprise/issues/4689
https://github.com/owncloud/core/pull/39067
* Bugfix - Do not try to delete the folder twice: [#39070](https://github.com/owncloud/core/pull/39070)
Previously, when a folder was moved to the trashbin from an external storage,
the usual action was to copy the contents to the trashbin and then remove them
from the source, and additionally another remove operation on the source was
triggered. This second delete request was performed but the result was ignored,
and the storages didn't log anything.
With this change, this second delete request won't happen. The behaviour is
still the same: copy to the trashbin and then remove from the source.
https://github.com/owncloud/core/pull/39070
* Bugfix - Close open menus if click is on an iFrame: [#39093](https://github.com/owncloud/core/issues/39093)
Before this PR click events was caught by iFrames due to this circumstances for
example the settings menu was never closed while clicking inside the
files_pdfviewer viewer. With this PR a new event has been added and closes the
menu.
https://github.com/owncloud/core/issues/39093
https://github.com/owncloud/core/pull/39094
* Bugfix - Prevent unneeded call to LDAP during login with local users: [#39105](https://github.com/owncloud/core/pull/39105)
Previously, when the user_ldap app was enabled, any login with a local user
would check the LDAP server for that user even though it shouldn't be needed.
Now, such call won't happen if it has been handled by a different component. In
particular, login with a local user won't trigger that request to LDAP.
https://github.com/owncloud/core/pull/39105
https://github.com/owncloud/user_ldap/pull/675
* Bugfix - Clarify the description of the manual file locking option: [#39106](https://github.com/owncloud/core/pull/39106)
The administrator can enable manual file locking in the admin settings. That
enables manual file locking on the web interface, not on all clients. The text
has been changed to describe this correctly.
https://github.com/owncloud/core/pull/39106
* Bugfix - Update appinfo cache only if the app version is newer: [#39108](https://github.com/owncloud/core/pull/39108)
Previously, in case there were multiple copies of the same app with different
versions, the information being cached was the latest one found based on the
locations defined in the config.php file, which might not be the one from the
latest app version. This might be a problem in some scenarios specially checking
the version of the app. Note that the code used was the one from the latest app
version found.
Now, the information cached is always from the latest version found. In the
weird case that both versions are the same, the information from the first one
will be kept. This shouldn't be a problem because the information is expected to
be the same.
https://github.com/owncloud/core/pull/39108
* Bugfix - Fix logo size on login screen: [#39129](https://github.com/owncloud/core/pull/39129)
The previous fixed logo size resulted in a cut off logo in some cases. This was
fixed by using a dynamically logo resize css rule.
https://github.com/owncloud/core/pull/39129
* Bugfix - Image orientation: [#39140](https://github.com/owncloud/core/pull/39140)
Fix the retrieval an image's exif information to ensure it's rotated correctly
in thumbnails and preview.
https://github.com/owncloud/core/issues/39114
https://github.com/owncloud/enterprise/issues/4666
https://github.com/owncloud/core/pull/39140
* Bugfix - Fix display of tag selection in sidebar: [#39146](https://github.com/owncloud/core/pull/39146)
This PR add small CSS fixes to the Tags selection dialogue: - Fixed grey tag
space if clear icon (x) is not displayed - Align checkmark in selection list
vertically - Use correct HTML elements (div instead of span)
https://github.com/owncloud/core/pull/39146
https://github.com/owncloud/core/pull/39517
https://github.com/owncloud/core/pull/39563
* Bugfix - Keep pagination active with empty search queries: [#39155](https://github.com/owncloud/core/pull/39155)
Before this fix, an empty search string would pre-render all rows in the file
list, ignoring the pagination. This fix ensures that the file list is paginated
correctly in combination with an empty search query.
https://github.com/owncloud/enterprise/issues/4615
https://github.com/owncloud/core/pull/39155
* Bugfix - File conflict dialog when dragging a file into a folder: [#39162](https://github.com/owncloud/core/pull/39162)
When dragging a file into a folder, while another file with an identical name
exists in the parent directory, the UI falsely showed a conflict dialog alert.
This has been fixed.
https://github.com/owncloud/core/issues/39133
https://github.com/owncloud/core/pull/39162
https://github.com/owncloud/core/pull/39170
* Bugfix - Return proper error if part file name is too long: [#39168](https://github.com/owncloud/core/pull/39168)
https://github.com/owncloud/enterprise/issues/4692
https://github.com/owncloud/core/pull/39168
* Bugfix - Set file name to download.zip while downloading the whole user directory: [#39198](https://github.com/owncloud/core/pull/39198)
Before this PR, selecting all files and folders in the webUI and clicking the
download button, resulted in a file downloaded with the name ".zip". With this
PR the file name is now "download.zip".
https://github.com/owncloud/core/issues/39187
https://github.com/owncloud/core/pull/39198
https://github.com/owncloud/core/pull/39239
* Bugfix - Preview rendering for sharees: [#39202](https://github.com/owncloud/core/pull/39202)
Previous to this fix, the previews of updated shared files did not change for
sharees. Those previews now get re-generated if the content of the files
changed.
https://github.com/owncloud/core/issues/39202
https://github.com/owncloud/core/issues/31855
https://github.com/owncloud/core/pull/39202
* Bugfix - Add permission check when restoring from trashbin: [#39210](https://github.com/owncloud/core/pull/39210)
This fixes an issue where a user was able to restore a file or folder into a
read-only shared folder.
https://github.com/owncloud/core/issues/35900
https://github.com/owncloud/core/pull/39210
* Bugfix - Show missing delete button in file list on mobile view: [#39221](https://github.com/owncloud/core/issues/39221)
https://github.com/owncloud/core/issues/39221
https://github.com/owncloud/core/pull/39227
* Bugfix - Don't count non-user folder in occ user:report command: [#39223](https://github.com/owncloud/core/pull/39223)
Before this PR several folders, for example 'avatars', have been counted as user
folders via the occ user:report command. With this PR a list of folders has been
added which should not be counted as user folders. The user directory count is
now correct.
https://github.com/owncloud/core/pull/39223
* Bugfix - Return proper error when destination header is missing: [#39235](https://github.com/owncloud/core/pull/39235)
Move- and copy-requests without destination header now give a proper error
response: "The destination header was not supplied"
https://github.com/owncloud/core/issues/38898
https://github.com/owncloud/core/pull/39235
* Bugfix - Show the correct expiring date in 'Shared by link' files list: [#39238](https://github.com/owncloud/core/pull/39238)
Before this PR the "Expiration date" column did not respect that shares
expiration is set to the end of date and showing wrong values. This has been
fixed with this PR
https://github.com/owncloud/core/issues/39234
https://github.com/owncloud/core/pull/39238
https://github.com/owncloud/core/pull/39246
* Bugfix - Hide share owner file path for share receiver: [#39241](https://github.com/owncloud/core/pull/39241)
This fixes an issue where a share receiver could see the share owner's full file
path before accepting the share.
https://github.com/owncloud/core/issues/38027
https://github.com/owncloud/core/pull/39241
* Bugfix - Spelling errors: [#39252](https://github.com/owncloud/core/pull/39252)
Various spelling errors have been corrected in messages.
https://github.com/owncloud/core/pull/39252
* Bugfix - Command occ 'user:report' might not count 'user directories' correctly: [#39254](https://github.com/owncloud/core/pull/39254)
Before this PR the underlying function of 'user:report' just looked up in the
'datadirectory' set in 'config.php'. This implies that user directories which
are symlinks or even not in the 'datadirectory', have not been taken into
account. With this PR we check if the user's home path exists and increase the
'user directories' count.
https://github.com/owncloud/enterprise/issues/4742
https://github.com/owncloud/core/pull/39254
* Bugfix - Simplify set password text for new passwords: [#39257](https://github.com/owncloud/core/pull/39257)
https://github.com/owncloud/core/pull/39257
* Bugfix - Allow user:list and group:list to filter on short strings: [#39258](https://github.com/owncloud/core/pull/39258)
The occ user:list and group:list commands can now be used to list users and
groups that match a short string, regardless of the setting of
user.search_min_length
https://github.com/owncloud/core/issues/31117
https://github.com/owncloud/core/pull/39258
* Bugfix - Fix doc placeholder URL in "general"-settings: [#39267](https://github.com/owncloud/core/pull/39267)
https://github.com/owncloud/core/issues/27666
https://github.com/owncloud/core/pull/39267
* Bugfix - Setting 0 as user display name: [#39272](https://github.com/owncloud/core/pull/39272)
Setting the display name of a user to 0 was allowed before, but the UI showed
the UID instead. This has been fixed.
https://github.com/owncloud/core/issues/30657
https://github.com/owncloud/core/pull/39272
* Bugfix - Fix malformed error message while accepting a share is not possible: [#39287](https://github.com/owncloud/core/pull/39287)
https://github.com/owncloud/core/issues/36181
https://github.com/owncloud/core/pull/39287
* Bugfix - Decouple change email from 'allow_user_to_change_display_name' setting: [#39288](https://github.com/owncloud/core/pull/39288)
Before this change, with setting 'allow_user_to_change_display_name' false, the
user was not able to change the mail address in Settings->Personal->General via
the webUI.
With this change, the setting 'allow_user_to_change_mail_address' has been
introduced and change mail address has been decoupled from setting
`allow_user_to_change_display_name`.
'allow_user_to_change_mail_address' must be set explicitly to false, to take
effect.
https://github.com/owncloud/core/issues/35103
https://github.com/owncloud/core/pull/39288
* Bugfix - Don't show empty brackets in lock owner information if mail not set: [#39292](https://github.com/owncloud/core/pull/39292)
https://github.com/owncloud/core/issues/37878
https://github.com/owncloud/core/pull/39292
* Bugfix - Use original UID when setting the share receiver: [#39293](https://github.com/owncloud/core/pull/39293)
This fixes an issue where a share reciever was not set properly when passing the
username with an incorrect casing. As usernames are case insensitive in general,
this is more consistent now.
https://github.com/owncloud/core/issues/26273
https://github.com/owncloud/core/pull/39293
* Bugfix - Versions for files named "0": [#39300](https://github.com/owncloud/core/pull/39300)
This fixes an issue where files named "0" were missing their versions in the
WebUI.
https://github.com/owncloud/core/issues/36000
https://github.com/owncloud/core/pull/39300
* Bugfix - Sanitize data send to the server while creating users via webUI: [#39306](https://github.com/owncloud/core/pull/39306)
Before this change toggle between 'Set password for new users' option, may
preserve and send unwanted password or email information. This has been fixed,
the webUI will not send email data to the server if the option 'Set password for
new users' is active, vice versa password won't be sent if the option is
disabled.
https://github.com/owncloud/core/issues/32619
https://github.com/owncloud/core/pull/39306
* Bugfix - File version names for share recipients: [#39314](https://github.com/owncloud/core/pull/39314)
With this fix, file version names now match with the actual file name for share
recipients. Before, the name has been the timestamp of the version file.
https://github.com/owncloud/core/issues/36228
https://github.com/owncloud/core/pull/39314
https://github.com/owncloud/core/pull/39415
* Bugfix - Allow renaming two files with the same name but different paths: [#39315](https://github.com/owncloud/core/pull/39315)
With this change, we allow renaming a file to an existing file name, when the
path differs. This happens for example when the user creates the file
'/mydirname/text.txt' and '/mytext.txt' then marks both as favorite, and then
navigates to the Favorites and renames 'mytext.txt' to 'text.txt'
https://github.com/owncloud/core/issues/20722
https://github.com/owncloud/core/issues/35174
https://github.com/owncloud/core/pull/39315
* Bugfix - No sensitive data on exception page: [#39334](https://github.com/owncloud/core/pull/39334)
In debug mode any exception stack trace is rendered to the browser which can
hold sensitive data like passwords as method arguments. They are now filtered
and no longer exposed to the user.
https://github.com/owncloud/core/pull/39334
* Bugfix - Hide legacy login button animation: [#39352](https://github.com/owncloud/core/pull/39352)
In some cases the old animation was still displayed on login buttons. This PR
hides it in favour of the newly introduced animation.
https://github.com/owncloud/core/pull/39352
* Bugfix - Prohibit email/displayname change via API when not allowed: [#39353](https://github.com/owncloud/core/pull/39353)
When the configs `allow_user_to_change_mail_address` or
`allow_user_to_change_display_name` are set to `false`, changing the
corresponding values via the provisioning API is no longer possible.
https://github.com/owncloud/core/issues/39332
https://github.com/owncloud/core/pull/39353
* Bugfix - Clicking in the middle of the row in the file list downloads the file: [#39361](https://github.com/owncloud/core/pull/39361)
This change addresses the issue if the user clicks in on a row in the file list,
the file gets downloaded or open with the default viewer. This was not intended,
the download or default opening should only happen if the user clicks directly
on the file name. Problems with mobile devices, where the file name was too long
to display, has been also solved.
https://github.com/owncloud/core/issues/39329
https://github.com/owncloud/core/pull/39361
* Bugfix - Adjust text of occ encryption command messages: [#39395](https://github.com/owncloud/core/pull/39395)
The text of some encryption command messages has been improved.
https://github.com/owncloud/core/pull/39395
* Bugfix - Faulty file list entry after accepting a federated share: [#39411](https://github.com/owncloud/core/pull/39411)
With this change, we reload the shared with you file list if the user accepts or
declines a share. This solves the issue after accepting a federated share the
table record was not pointing to the correct location.
https://github.com/owncloud/enterprise/issues/4823
https://github.com/owncloud/core/pull/39411
* Bugfix - Add missing `remoteshare.accepted` event parameters: [#39449](https://github.com/owncloud/core/pull/39449)
This fix adds missing parameters to the `remoteshare.accepted` event when
triggered via controller: `shareId`, `fileId`, `shareRecipient`. The bugfix is a
complement to https://github.com/owncloud/core/pull/38880.
https://github.com/owncloud/core/pull/39449
* Bugfix - Group administrator permissions: [#39477](https://github.com/owncloud/core/pull/39477)
This fixes an issue where group administrators were unable to change email
addresses and resend invitation emails for users in their groups.
https://github.com/owncloud/core/issues/39475
https://github.com/owncloud/core/issues/39476
https://github.com/owncloud/core/pull/39477
* Bugfix - Load l10n js files from the correct app folder: [#39482](https://github.com/owncloud/core/pull/39482)
With this PR, we ensure that the translations will be loaded from the correct
app folder path. For example, if you have two versions of an app, where one
version is in the apps folder and the other one in the apps-external folder. The
change also ensures that theme translations will be loaded additionally instead
of replacing the whole app translations. This has the advantage that the user
can cherry-pick single words to translate.
https://github.com/owncloud/core/pull/39482
* Bugfix - Fix issue searching inside a shared external storage: [#39500](https://github.com/owncloud/core/pull/39500)
Previously, if an external storage was shared with a user, that user wasn't able
to search files inside that share. Now, such user can search inside that share
https://github.com/owncloud/core/pull/39500
* Bugfix - Fix favicon, cloud symbol on Safari not visible: [#39506](https://github.com/owncloud/core/pull/39506)
https://github.com/owncloud/core/pull/39506
* Bugfix - Clicking the eye icon in password input field does not show the password: [#39528](https://github.com/owncloud/core/pull/39528)
During the installation, the user should be able to click the eye icon in the
admin user and database password field to see the password, this recently
stopped to work and has been fixed with this change.
https://github.com/owncloud/core/issues/39527
https://github.com/owncloud/core/pull/39528
* Bugfix - Group select in user create panel allows empty and pre-existing groups: [#39532](https://github.com/owncloud/core/pull/39532)
Before this change, the admin could create groups with empty name or multiple
times with the same name. This has been fixed with this change.
https://github.com/owncloud/enterprise/issues/4890
https://github.com/owncloud/core/pull/39532
* Bugfix - An app config value of null could be entered but not updated: [#39554](https://github.com/owncloud/core/pull/39554)
An app config value now cannot be set to null. Any existing null values are now
treated as the empty string.
https://github.com/owncloud/core/pull/39554
* Bugfix - Directory name in error message when file name already exists: [#39569](https://github.com/owncloud/core/pull/39569)
This fixes an issue where the wrong directory name was shown when trying to
rename a file to a name that already exists in the same directory.
https://github.com/owncloud/core/issues/39552
https://github.com/owncloud/core/pull/39569
* Bugfix - Prohibit username htaccesstest.txt: [#39572](https://github.com/owncloud/core/pull/39572)
Htaccesstest.txt is a special file that can be in the data directory. That is
not allowed as a username.
https://github.com/owncloud/core/issues/39570
https://github.com/owncloud/core/pull/39572
* Bugfix - Use ViewOnlyPlugin when requesting a meta endpoint using WebDAV v2: [#39575](https://github.com/owncloud/core/pull/39575)
This fixes an issue where versions of shared files were downloadable using the
new WebDAV API despite missing permissions, e.g. when shared via secure view.
https://github.com/owncloud/enterprise/issues/4916
https://github.com/owncloud/core/pull/39575
* Bugfix - Provisioning API quota is incomplete when username casing is not exact: [#39586](https://github.com/owncloud/core/pull/39586)
The Provisioning API now returns all the quota information for a user even when
the username casing is different in the API request.
https://github.com/owncloud/core/issues/39577
https://github.com/owncloud/core/pull/39586
* Change - Enable streaming for propfind requests: [#38583](https://github.com/owncloud/core/pull/38583)
Propfind requests will now be streamed to reduce memory usage with large
responses. Additionally, the new config `dav.propfind.depth_infinity` has been
added to tell clients whether `depth=infinity` is allowed for propfind requests.
It defaults to true.
https://github.com/owncloud/core/pull/38583
* Change - Update PHP dependencies: [#38907](https://github.com/owncloud/core/pull/38907)
The following have been updated: - christophwurst/id3parser (0.1.2 to 0.1.3) -
doctrine/cache (2.0.3 to 2.1.1) - doctrine/dbal (2.13.2 to 2.13.5) -
egulias/email-validator (3.1.1 to 3.1.2) - laminas/laminas-filter (2.11.1 to
2.12.0) - laminas/laminas-stdlib (3.5.0 to 3.6.1) - laminas/laminas-validator
(2.14.5 to 2.15.0) - laminas/laminas-zendframework-bridge (1.3.0 to 1.4.0) -
league/flysystem (1.1.4 to 1.1.5) - mikey179/vfsstream (v1.6.8 to v1.6.9) -
nikic/php-parser (v4.11.0 to v4.13.0) - pear/archive_tar (1.4.13 to 1.4.14) -
phpseclib/phpseclib (3.0.9 to 3.0.11) - pimple/pimple (3.2.3 to 3.5.0) -
punic/punic (3.6.0 to 3.7.0) - sabre/dav (4.1.5 to 4.2.0) - sabre/event (5.1.2
to 5.1.4) - sabre/http (5.1.1 to 5.1.3) - sabre/vobject (4.3.5 to 4.4.0) -
sabre/uri (2.2.1 to 2.2.2) - sabre/xml (2.2.3 to 2.2.5) -
swiftmailer/swiftmailer (v6.2.7 to v6.3.0)
The following have been updated in files_external/3rdparty: - firebase/php-jwt
(v5.4.0 to v5.5.1) - google/apiclient (v2.9.2 to v2.11.0) -
google/apiclient-services (v0.213.0 to v0.221.0) - guzzlehttp/psr7 (1.8.2 to
1.8.3) - icewind/smb (v3.4.1 to v3.5.1) - monolog/monolog (2.3.4 to 2.3.5) -
phpseclib/phpseclib (3.0.10 to 3.0.11)
https://github.com/owncloud/core/pull/38907
https://github.com/owncloud/core/pull/39030
https://github.com/owncloud/core/pull/39047
https://github.com/owncloud/core/pull/39065
https://github.com/owncloud/core/pull/39116
https://github.com/owncloud/core/pull/39124
https://github.com/owncloud/core/pull/39201
https://github.com/owncloud/core/pull/39214
https://github.com/owncloud/core/pull/39259
https://github.com/owncloud/core/pull/39317
https://github.com/owncloud/core/pull/39369
https://github.com/owncloud/core/pull/39422
https://github.com/owncloud/core/pull/39427
https://github.com/owncloud/core/pull/39433
https://github.com/owncloud/core/pull/39434
https://github.com/owncloud/core/pull/39453
https://github.com/owncloud/core/pull/39456
https://github.com/owncloud/core/pull/39466
https://github.com/owncloud/core/pull/39479
https://github.com/owncloud/core/pull/39485
https://github.com/owncloud/core/pull/39487
https://github.com/owncloud/core/pull/39492
https://github.com/owncloud/core/pull/39495
https://github.com/owncloud/core/pull/39496
* Change - Update url for sync client button and docs: [#38962](https://github.com/owncloud/core/pull/38962)
https://github.com/owncloud/core/issues/38957
https://github.com/owncloud/core/pull/38962
* Change - Update Symfony components: [#39061](https://github.com/owncloud/core/pull/39061)
The following Symfony components have been updated to: - console 4.4.33 -
event-dispatcher 4.4.30 - process 4.4.30 - routing 4.4.30 - translation 4.4.32
The following Symfony polyfill components have been updated to: -
symfony/polyfill-mbstring v1.23.1 - symfony/polyfill-php80 v1.23.1
https://github.com/owncloud/core/pull/39061
https://github.com/owncloud/core/pull/39079
https://github.com/owncloud/core/pull/39153
https://github.com/owncloud/core/pull/39298
https://github.com/owncloud/core/pull/39440
https://symfony.com/blog/symfony-4-4-27-released
https://symfony.com/blog/symfony-4-4-29-released
https://symfony.com/blog/symfony-4-4-30-released
https://symfony.com/blog/symfony-4-4-31-released
https://symfony.com/blog/symfony-4-4-32-released
https://symfony.com/blog/symfony-4-4-33-released
* Change - Clarify days parameter of the occ dav:cleanup-chunks command: [#39090](https://github.com/owncloud/core/pull/39090)
The days parameter is the minimum age of uploads to cleanup. This has been
clarified in the command help.
https://github.com/owncloud/core/pull/39090
* Change - Drop PHP 7.2 support across the platform: [#39134](https://github.com/owncloud/core/issues/39134)
Support for security fixes for PHP 7.2 ended in Dec 2020 ownCloud core no longer
supports PHP 7.2. Ensure that you are using PHP 7.3 or 7.4. PHP 7.4 is
recommended.
https://github.com/owncloud/core/issues/39134
https://github.com/owncloud/core/pull/38697
https://www.php.net/supported-versions.php
* Change - Add index.html to invalid username list: [#39206](https://github.com/owncloud/core/pull/39206)
With this PR the invalid username list gets expanded with "index.html". As well
the error message has been updated in favor of the known translation scheme.
https://github.com/owncloud/core/issues/39205
https://github.com/owncloud/core/pull/39206
* Change - Update JavaScript dependencies: [#39385](https://github.com/owncloud/core/pull/39385)
The following have been updated: - karma (4.4.1 to 6.3.8) - minimist (1.2.3 to
1.2.5) - sinon (7.5.0 to 12.0.1) - bower_components/base64 (1.0.2 to 1.1.0) -
bower_components/clipboard (2.0.4 to 2.0.6) - bower_components/handlebars (4.5.3
to 4.7.7) - bower_components/moment (2.24.0 to 2.29.1) -
bower_components/underscore (1.9.1 to 1.13.1)
https://github.com/owncloud/core/pull/39385
https://github.com/owncloud/core/pull/39145
https://github.com/owncloud/core/pull/38670
https://github.com/owncloud/core/pull/38671
https://github.com/owncloud/core/pull/39407
https://github.com/owncloud/core/pull/36633
https://github.com/owncloud/core/pull/39421
https://github.com/owncloud/core/pull/39417
https://github.com/owncloud/core/pull/39447
https://github.com/owncloud/core/pull/39464
https://github.com/owncloud/core/pull/39468
* Change - Allow setting multiple default file actions: [#39541](https://github.com/owncloud/core/pull/39541)
This change allows a mime type to have multiple default file actions. In the
past, registering an action as default would overwrite existing defaults.
In case multiple file actions apply to a mime type, clicking on a file will show
the app drawer context menu.
https://github.com/owncloud/enterprise/issues/4634
https://github.com/owncloud/core/pull/39541
* Change - Use "federated" rather than "remote" for shares: [#39578](https://github.com/owncloud/core/pull/39578)
Shares from one ownCloud to another ownCloud were referred to in some places as
remote shares and in other places as federated shares. References to remote
shares in error messages and on the user interface have been changed to
references to federated shares. All user-facing text now calls these federated
shares.
https://github.com/owncloud/core/issues/38871
https://github.com/owncloud/core/pull/39578
https://github.com/owncloud/core/pull/38877
* Enhancement - Add setting to limit public link share creation to certain groups: [#3632](https://github.com/owncloud/enterprise/issues/3632)
With this PR a new setting in settings->admin-sharing has been introduced which
allows the admin to limit public link share creation to certain groups.
https://github.com/owncloud/enterprise/issues/3632
https://github.com/owncloud/core/pull/38980
* Enhancement - Save and display the author of a file version: [#4518](https://github.com/owncloud/enterprise/issues/4518)
The author attribute will be saved and shown in the version list grid for each
new file version. This will allow the users to see who performed the changes on
a specific file and when. Also, the author attribute will retain on renaming,
copying, and deletion/restoration of the file.
https://github.com/owncloud/enterprise/issues/4518
https://github.com/owncloud/core/pull/39126
https://github.com/owncloud/core/pull/39516
* Enhancement - Add tooltips for group names in user settings and sharing overview: [#4695](https://github.com/owncloud/enterprise/issues/4695)
https://github.com/owncloud/enterprise/issues/4695
https://github.com/owncloud/core/pull/39160
* Enhancement - Quick action for creating public links: [#4718](https://github.com/owncloud/enterprise/issues/4718)
This feature introduces a quick action in the filelist for creating read-only
public links. It can be enabled via 'sharing.showPublicLinkQuickAction' in the
config.php.
https://github.com/owncloud/enterprise/issues/4718
https://github.com/owncloud/core/pull/39130
https://github.com/owncloud/core/pull/39163
https://github.com/owncloud/core/pull/39167
* Enhancement - Special user groups can break persistent locks: [#38222](https://github.com/owncloud/core/pull/38222)
Not only the owner of a lock can unlock a resource but the lock breaker groups
are allowed to break locks as well.
https://github.com/owncloud/core/pull/38222
* Enhancement - Allow oc_sessionPassphrase cookie to expire with session_lifetime: [#38991](https://github.com/owncloud/core/issues/38991)
Before this PR the session cookie oc_sessionPassphrase has expiration time 0
regardless of the value of `session_lifetime` in config.php
Now the behavior will be that after setting `session_lifetime` in config.php
will make oc_sessionPassphrase cookie to expire in that period of time
invalidating the current session and forcing a log out. In the other hand, if
session_lifetime is not defined or 0, oc_sessionPassphrase will assume its
original value before this PR of 0.
https://github.com/owncloud/core/issues/38991
https://github.com/owncloud/core/pull/38992
* Enhancement - Log number of mounts when moving encryption keys fails: [#39015](https://github.com/owncloud/core/pull/39015)
Due to wrong configuration or bugs it is possible that more than one mount is
returned. In this case we should log the mount-count for easier debugging.
https://github.com/owncloud/core/pull/39015
* Enhancement - Include new DB index to speed up addressbook searches: [#39017](https://github.com/owncloud/core/pull/39017)
https://github.com/owncloud/core/pull/39017
* Enhancement - Add command to verify all available doc links: [#39026](https://github.com/owncloud/core/pull/39026)
All available doc links can now be tested and verified via `make
test-doc-links`. It is also possible to specify the ownCloud version to look for
in the docs via `make test-doc-links DOC_LINK_VERSION=10.7`. It defaults to the
ownCloud version of the current installation.
https://github.com/owncloud/enterprise/issues/4671
https://github.com/owncloud/core/pull/39026
* Enhancement - Show create and cancel buttons in the 'New file menu': [#39056](https://github.com/owncloud/core/pull/39056)
If the user hits the '+' button in the UI, a context menu will be shown, where
the user is able to choose for example 'Folder'. A form will show up to set the
new folder name, the user needs to confirm by hitting the enter key. This might
not been understood by every user at the first glance. Therefore, with this PR a
create and cancel button has been added.
https://github.com/owncloud/enterprise/issues/4684
https://github.com/owncloud/core/pull/39056
* Enhancement - Extend transfer ownership cmd with option to transfer entire user: [#39118](https://github.com/owncloud/core/pull/39118)
Command occ files:transfer-ownership now includes flag
--destination-use-user-folder that allows to transfer all user files
and shares to destination user that has never logged in. This is helpful in
situation when users need to be migrated to new accounts.
https://github.com/owncloud/enterprise/issues/4686
https://github.com/owncloud/core/pull/39118
* Enhancement - Add console command to move a user's home folder: [#39136](https://github.com/owncloud/core/pull/39136)
Occ user:move-home
https://github.com/owncloud/core/pull/39136
* Enhancement - Confirmation dialog for deleting tags: [#39157](https://github.com/owncloud/core/issues/39157)
This feature introduces confirmation dialog while deleting a tag to prevent
unwanted data-loss
https://github.com/owncloud/core/issues/39157
https://github.com/owncloud/core/pull/39158
* Enhancement - Display clickable links during web UI upgrade process: [#39184](https://github.com/owncloud/core/pull/39184)
Before this PR, error messages can contain links that have not been clickable.
With this PR, links are clickable and open them in a new tab.
https://github.com/owncloud/core/issues/39178
https://github.com/owncloud/core/pull/39184
* Enhancement - Don't show updater if setting 'upgrade.disable-web' is set to true: [#39185](https://github.com/owncloud/core/pull/39185)
With this PR the update section in Settings->Admin->General will be not shown if
setting 'upgrade.disable-web' is set to true.
https://github.com/owncloud/core/issues/39183
https://github.com/owncloud/core/pull/39185
* Enhancement - Hide accept and decline share text on mobile view: [#39224](https://github.com/owncloud/core/pull/39224)
Before this PR within the "Shared with you" files list, a text for accept and
decline was shown next to the associated icon. These texts were using excessive
space in the mobile view and might leave the "State" column not completely
visible. This has been fixed with this PR through hiding those unnecessary
texts.
https://github.com/owncloud/core/pull/39224
* Enhancement - Add option to hide the upload estimation in WebUI: [#39228](https://github.com/owncloud/core/pull/39228)
The upload estimation can now be hidden when setting `hide_upload_estimation` to
"yes" via occ command: occ config:app:set files hide_upload_estimation
--value="yes"
https://github.com/owncloud/enterprise/issues/4743
https://github.com/owncloud/core/pull/39228
* Enhancement - Allow skeletondirectory to be an empty string: [#39230](https://github.com/owncloud/core/pull/39230)
Skeletondirectory can now be set to an empty string in config.php to indicate
that no skeleton is required.
https://github.com/owncloud/core/pull/39230
* Enhancement - Improve mobile view for "Shared by link" file list: [#39232](https://github.com/owncloud/core/pull/39232)
With this PR, the "Expiration date" column won't be displayed in mobile view
anymore to gather space.
https://github.com/owncloud/core/pull/39232
* Enhancement - Use icons + buttons instead of text for file actions in mobile view: [#39233](https://github.com/owncloud/core/pull/39233)
Before this PR, as files were selected in the files list, actions was shown with
icon and text, for example: 'Download' and 'Delete'. This uses much space and UI
glitches are possible due to limited screen size. With this PR we now show
buttons with the associated icons without any text.
https://github.com/owncloud/core/pull/39233
* Enhancement - Hide restore text in deleted files list on mobile device: [#39236](https://github.com/owncloud/core/pull/39236)
With this PR restore text next to the associated icon will be hidden to grant
space for the file and folder names.
https://github.com/owncloud/core/pull/39236
* Enhancement - Redesign group list in the user settings view: [#39262](https://github.com/owncloud/core/pull/39262)
Before this PR, the group list settings were confusing as the user needs to
click on a group first before the trash bin icon appears to delete a group. As
well the user count was nondescript. With this PR, a redesign takes care of
those issues and also fixes the problem that while deleting a group in the group
list, it was still available in the user group list. Furthermore, after deleting
a group, the user will be redirected to the 'Everyone' group summary view. Also
fixes an issue where the 'active'-class on a newly created group was duplicated.
https://github.com/owncloud/core/issues/36273
https://github.com/owncloud/core/issues/29057
https://github.com/owncloud/core/pull/39262
https://github.com/owncloud/core/pull/39307
* Enhancement - Previews for text files including non-latin characters: [#39271](https://github.com/owncloud/core/pull/39271)
Generate and display previews for text files that include non-latin characters
like Chinese, Japanese, Korean and Arabic.
https://github.com/owncloud/core/issues/16229
https://github.com/owncloud/core/pull/39271
* Enhancement - Allow empty folder uploads via webUI: [#39285](https://github.com/owncloud/core/pull/39285)
Before this change, drag and drop of an empty folder did not work, there was no
response in the webUI. While uploading a folder with a text file and an empty
folder, the folder with the text file was created but the empty folder wasn't.
These empty folder upload scenarios work now.
https://github.com/owncloud/core/issues/32235
https://github.com/owncloud/enterprise/issues/3117
https://github.com/owncloud/core/pull/39285
* Enhancement - Add support for MariaDB 10.6: [#39286](https://github.com/owncloud/core/pull/39286)
With this change support for MariaDB 10.6 has been added. If it is a fresh
ownCloud installation, MariaDB 10.6 can be used right away. For upgrading from
an older version the command 'occ db:restore-default-row-format' has been
introduced to remove the deprecated row_format 'compressed' from the ownCloud
database tables and set it to the default value.
https://github.com/owncloud/core/issues/39283
https://github.com/owncloud/core/pull/39286
* Enhancement - Optimized preview for text files: [#39296](https://github.com/owncloud/core/pull/39296)
Previews for text files are generated a bit faster. The preview will be
generated based on the first 2 KB of content. In addition to common Latin
script, texts using Han, Hiragana, Katakana, Hangul, Devanagari and Arabic
scripts will also be shown. Note that a text with mixed scripts won't be
previewed properly.
https://github.com/owncloud/core/pull/39296
* Enhancement - Add test receiver mail in Email Settings Admin Panel: [#39297](https://github.com/owncloud/core/pull/39297)
With this change the admin needs to provide a test receiver mail address while
sending test mails in the Email Settings Admin Panel. This has the advantage
that the admin does not need to go back to user settings and set the own mail
address. The user's own email will be set as preselected value if set.
https://github.com/owncloud/core/issues/33018
https://github.com/owncloud/core/pull/39297
* Enhancement - Change user casing log level to "debug": [#39299](https://github.com/owncloud/core/pull/39299)
https://github.com/owncloud/core/issues/36139
https://github.com/owncloud/core/pull/39299
* Enhancement - Hide the "Remove Password" button on public links: [#39302](https://github.com/owncloud/core/pull/39302)
This change hides the "Remove Password" button when editing a public link if a
password in mandatory.
https://github.com/owncloud/core/issues/35684
https://github.com/owncloud/core/pull/39302
* Enhancement - Trim spaces while creating, uploading or renaming entities in webUI: [#39310](https://github.com/owncloud/core/pull/39310)
With this change starting or trailing spaces will be removed while: * Creating
files and folders in the webUI * Uploading files using the 'Upload' button in
the webUI * Uploading files and folders using drag & drop in the webUI *
Renaming files and folders in the webUI
This also solves problems when the sync client can't sync files and folders with
trailing spaces based on the underlying file system.
https://github.com/owncloud/enterprise/issues/4772
https://github.com/owncloud/core/issues/35017
https://github.com/owncloud/core/pull/39310
* Enhancement - Bring back minimalistic view to occ app:list with '-m' option: [#39326](https://github.com/owncloud/core/pull/39326)
https://github.com/owncloud/core/pull/39326
* Enhancement - Add quality setting for JP(E)G preview images: [#39349](https://github.com/owncloud/core/pull/39349)
A new config setting `previewJPEGImageDisplayQuality` has been introduced with
which the quality of generated JP(E)G previews can be determined.
https://github.com/owncloud/enterprise/issues/4702
https://github.com/owncloud/core/pull/39349
* Enhancement - Add last_login to Provisioning API get user response: [#39351](https://github.com/owncloud/core/pull/39351)
The response to a Provisioning API GET request to the cloud/users/username
endpoint now includes the last_login time in the response. The value is a Unix
timestamp in seconds.
https://github.com/owncloud/core/pull/39351
* Enhancement - Added needed code for webp thumbnail generation to occur: [#39358](https://github.com/owncloud/core/issues/39358)
Previously thumbnail previews for image files of the webp format with the .webp
extension were not generated. Instead a generic placeholder icon was shown. This
enhancement/fix caused the generation of preview thumbnails, just as was
standard with other image formats.
https://github.com/owncloud/core/issues/39358
https://github.com/owncloud/core/pull/39360
* Enhancement - Add priority for JavaScript plugins: [#39359](https://github.com/owncloud/core/pull/39359)
JavaScript plugins can now be registered with a specific priority. A higher
priority means the plugin will be attached/detached before others.
https://github.com/owncloud/core/pull/39359
* Enhancement - Add show-all-attributes option to occ user:list command: [#39366](https://github.com/owncloud/core/pull/39366)
https://github.com/owncloud/enterprise/issues/4794
https://github.com/owncloud/core/pull/39366
* Enhancement - Add text to root element of breadcrumb: [#39367](https://github.com/owncloud/core/pull/39367)
https://github.com/owncloud/enterprise/issues/4807
https://github.com/owncloud/core/pull/39367
* Enhancement - Extend occ dav:cleanup-chunks command with local option: [#39394](https://github.com/owncloud/core/pull/39394)
If an admin runs a setup with multiple servers, connected to the same database
and sets the configuration for the chunking directory 'dav.chunk_base_dir' to a
unique place on the server, the command occ dav:cleanup-chunks might fail. This
happens as the oc_filecache table doesn't give us the information on which
server the directory is. Therefore the local option has been added to the
command, with this precondition only files that are on the local filesystem will
be removed.
https://github.com/owncloud/enterprise/issues/4824
https://github.com/owncloud/core/pull/39394
* Enhancement - Add activity translations for rename and move actions: [#39430](https://github.com/owncloud/core/pull/39430)
https://github.com/owncloud/enterprise/issues/4806
https://github.com/owncloud/activity/issues/375
https://github.com/owncloud/core/pull/39430
https://github.com/owncloud/core/pull/39438
https://github.com/owncloud/core/pull/39450
* Enhancement - Add capability for blacklisted files regex: [#39493](https://github.com/owncloud/core/pull/39493)
https://github.com/owncloud/core/pull/39493
* Enhancement - Change the size of the ownCloud logo in the mail header image: [#39501](https://github.com/owncloud/core/pull/39501)
https://github.com/owncloud/core/pull/39501
* Enhancement - Add user:home:list-dirs and user:home:list-users commands: [#39579](https://github.com/owncloud/core/pull/39579)
Added two new users commands:
* `occ user:home:list-dirs` List all homes which are currently used by users *
`occ user:home:list-users ` List all users who have their home in a given
path * `occ user:home:list-users --all` List all users for every home path
https://github.com/owncloud/core/issues/39502
https://github.com/owncloud/core/pull/39579
https://github.com/owncloud/core/pull/39583
* Enhancement - Expand file name area to click: [#39592](https://github.com/owncloud/core/pull/39592)
With this change, the file name area to click will expand, this is helpful with
very small file or folder names (e.g. single digit).
https://github.com/owncloud/core/issues/39591
https://github.com/owncloud/core/pull/39592
* Enhancement - Add support for the x-office/drawing mimetype: [#39594](https://github.com/owncloud/core/pull/39594)
https://github.com/owncloud/core/issues/39593
https://github.com/owncloud/core/pull/39594
# Changelog for ownCloud Core [10.8.0] (2021-07-15)
The following sections list the changes in ownCloud core 10.8.0 relevant to
ownCloud admins and users.
[10.8.0]: https://github.com/owncloud/core/compare/v10.7.0...v10.8.0
## Summary
* Bugfix - Expire shares at end of day: [#4324](https://github.com/owncloud/enterprise/issues/4324)
* Bugfix - When validating rereshare permission make sure to check parent mountpoint: [#4497](https://github.com/owncloud/enterprise/issues/4497)
* Bugfix - Use trusted domains to compute the signature of signed urls: [#38465](https://github.com/owncloud/core/pull/38465)
* Bugfix - Handle exceptions with inaccesible federated share: [#38474](https://github.com/owncloud/core/pull/38474)
* Bugfix - Fix mispositioned ui elements after leaving viewerMode: [#38547](https://github.com/owncloud/core/issues/38547)
* Bugfix - Fix move operation from encrypted storage to unencrypted storage: [#38567](https://github.com/owncloud/core/pull/38567)
* Bugfix - Creating self group-reshare should not not share to self: [#38581](https://github.com/owncloud/core/pull/38581)
* Bugfix - Check quota on the necessary move operations: [#38591](https://github.com/owncloud/core/pull/38591)
* Bugfix - Normalize web.baseUrl before using it: [#38600](https://github.com/owncloud/core/issues/38600)
* Bugfix - Don't rewrite private/public links when web app disabled: [#38602](https://github.com/owncloud/core/issues/38602)
* Bugfix - Objectids for comments and tags are strings: [#38682](https://github.com/owncloud/core/pull/38682)
* Bugfix - Hide sensible information on share download: [#38689](https://github.com/owncloud/core/pull/38689)
* Bugfix - Hide file drop content: [#38691](https://github.com/owncloud/core/pull/38691)
* Bugfix - Regenerate session after authenticate a password protected public share: [#38693](https://github.com/owncloud/core/pull/38693)
* Bugfix - Add check when updating the permissions of a federated share: [#38698](https://github.com/owncloud/core/pull/38698)
* Bugfix - Prevent renaming or deleting a SMB mount point: [#38709](https://github.com/owncloud/core/pull/38709)
* Bugfix - String to bool conversion in systemtags API: [#38719](https://github.com/owncloud/core/pull/38719)
* Bugfix - Database query filter when getting a tag: [#38725](https://github.com/owncloud/core/pull/38725)
* Bugfix - Fix federated share download bug happens on some providers: [#38738](https://github.com/owncloud/core/pull/38738)
* Bugfix - Correctly parse different ocm-provider api responses: [#38751](https://github.com/owncloud/core/pull/38751)
* Bugfix - Move files_antivirus executable mode config options into config.php: [#38753](https://github.com/owncloud/core/pull/38753)
* Bugfix - Delay getting the file info until it's going to be used: [#38767](https://github.com/owncloud/core/pull/38767)
* Bugfix - Image preview for file versions: [#38778](https://github.com/owncloud/core/pull/38778)
* Bugfix - Prevent files:checksum:verify from crashing on exception: [#38785](https://github.com/owncloud/core/pull/38785)
* Bugfix - Include incoming and parent permissions in Share UI subfolder reshares: [#38788](https://github.com/owncloud/core/pull/38788)
* Bugfix - Always allow renaming shared mounts: [#38794](https://github.com/owncloud/core/pull/38794)
* Bugfix - Adjust position of the share autocomplete element: [#38831](https://github.com/owncloud/core/pull/38831)
* Bugfix - Fix docs link to federated sharing docs: [#38859](https://github.com/owncloud/core/issues/38859)
* Bugfix - Fix file locks for public shares: [#38922](https://github.com/owncloud/core/pull/38922)
* Change - Update PHP dependencies: [#38524](https://github.com/owncloud/core/pull/38524)
* Change - Bump doctrine/dbal from 2.10.4 to 2.13.1: [#38647](https://github.com/owncloud/core/pull/38647)
* Change - Improve performance for the MOVE operation: [#38649](https://github.com/owncloud/core/pull/38649)
* Change - Optimize share rename: [#38656](https://github.com/owncloud/core/pull/38656)
* Change - All mount configuration items marked as passwords will be encrypted: [#38728](https://github.com/owncloud/core/pull/38728)
* Change - Change favicon and color references to match the new CI: [#38750](https://github.com/owncloud/core/pull/38750)
* Change - Update PHP dependencies: [#38891](https://github.com/owncloud/core/pull/38891)
* Change - Update Symfony components: [#38924](https://github.com/owncloud/core/pull/38924)
* Change - Update PHP minimum version to 7.2.5: [#38934](https://github.com/owncloud/core/pull/38934)
* Change - Update url for sync client button and docs: [#38962](https://github.com/owncloud/core/pull/38962)
* Enhancement - Command occ user:report shows additional row for guests: [#3467](https://github.com/owncloud/enterprise/issues/3467)
* Enhancement - Improve public share federation user interface: [#4393](https://github.com/owncloud/enterprise/issues/4393)
* Enhancement - Show notification if video playback is not possible on public share: [#4632](https://github.com/owncloud/enterprise/issues/4632)
* Enhancement - Improve login form: [#38506](https://github.com/owncloud/core/pull/38506)
* Enhancement - Automations in activity stream: [#38605](https://github.com/owncloud/core/pull/38605)
* Enhancement - Add html template for calens: [#38616](https://github.com/owncloud/core/pull/38616)
* Enhancement - Expired shares in activity stream: [#38631](https://github.com/owncloud/core/pull/38631)
* Enhancement - Use relative notification URLs: [#38639](https://github.com/owncloud/core/pull/38639)
* Enhancement - Add excludeActions parameter to registerDefaultActions function: [#38643](https://github.com/owncloud/core/pull/38643)
* Enhancement - Improve tab headers UI: [#38653](https://github.com/owncloud/core/pull/38653)
* Enhancement - Add trashbin skip list to config: [#38704](https://github.com/owncloud/core/pull/38704)
* Enhancement - Remove google+ share button from personal settings: [#38705](https://github.com/owncloud/core/pull/38705)
* Enhancement - Adjust the return type of the querybuilder's execute method: [#38714](https://github.com/owncloud/core/pull/38714)
* Enhancement - Communicate user profile picture capability: [#38722](https://github.com/owncloud/core/pull/38722)
* Enhancement - Allow apps to implement their own license: [#38737](https://github.com/owncloud/core/pull/38737)
* Enhancement - Improve mobile user interface on files list: [#38748](https://github.com/owncloud/core/pull/38748)
* Enhancement - Resend invitation email: [#38774](https://github.com/owncloud/core/pull/38774)
* Enhancement - Add more properties to the REPORT result: [#38787](https://github.com/owncloud/core/pull/38787)
* Enhancement - Improve admin external storage settings UI: [#38795](https://github.com/owncloud/core/pull/38795)
* Enhancement - Introduce new state to prevent scanning of shallow scanned folders: [#38804](https://github.com/owncloud/core/pull/38804)
* Enhancement - Improve performance of the SMB log when it is inactive: [#38819](https://github.com/owncloud/core/pull/38819)
* Enhancement - Introduce the patch for CVE-2019-11358: [#38841](https://github.com/owncloud/core/pull/38841)
* Enhancement - Introduce a remove license button in WebUI: [#38843](https://github.com/owncloud/core/issues/38843)
* Enhancement - Trigger file scan after accepting a federated share: [#38880](https://github.com/owncloud/core/pull/38880)
* Enhancement - Allow to pass password on redis cluster connection: [#38917](https://github.com/owncloud/core/pull/38917)
## Details
* Bugfix - Expire shares at end of day: [#4324](https://github.com/owncloud/enterprise/issues/4324)
The Expire Share background job was immediately expiring shares that had an
expiration date of today. But those shares should continue to work for the rest
of the day. The behaviour has been corrected. All shares will now work until the
end of the day that they expire.
https://github.com/owncloud/enterprise/issues/4324
https://github.com/owncloud/core/pull/38775
* Bugfix - When validating rereshare permission make sure to check parent mountpoint: [#4497](https://github.com/owncloud/enterprise/issues/4497)
When receiving reshare for a group from parent folder and subfolder of that
folder with lower permission, further reshares were subject to subfolder reshare
permissions due to issue with resolving parent mountpoint. With this change we
now ensure to take parent mountpoint out of received mountpoints
https://github.com/owncloud/enterprise/issues/4497
https://github.com/owncloud/enterprise/issues/4382
https://github.com/owncloud/core/pull/38625
https://github.com/owncloud/core/pull/38651
https://github.com/owncloud/core/pull/38862
* Bugfix - Use trusted domains to compute the signature of signed urls: [#38465](https://github.com/owncloud/core/pull/38465)
All configured trusted domains are used when computing the signature of a signed
url. The server has no real true understanding for which domain the request is
sent. Especially in proxy scenarios this is a must have.
https://github.com/owncloud/core/pull/38465
* Bugfix - Handle exceptions with inaccesible federated share: [#38474](https://github.com/owncloud/core/pull/38474)
In a scenario federation share storage is inaccessible and returns connection
timeouts, federated share storage now does not return not found but storage not
available. Additionaly logging and notifications handling has been improved.
https://github.com/owncloud/enterprise/issues/4311
https://github.com/owncloud/core/pull/38474
* Bugfix - Fix mispositioned ui elements after leaving viewerMode: [#38547](https://github.com/owncloud/core/issues/38547)
Until today, after leaving the viewer mode (e.G Pdf viewer) the action header
table in the files list was mispositioned while checking an item. The download
action and following items went out of sight.
https://github.com/owncloud/core/issues/38547
https://github.com/owncloud/core/pull/38552
* Bugfix - Fix move operation from encrypted storage to unencrypted storage: [#38567](https://github.com/owncloud/core/pull/38567)
On a move operation from encrypted storage to unencrypted storage, the moved
file was remaining encrypted. This problem has been fixed.
https://github.com/owncloud/encryption/issues/256
https://github.com/owncloud/encryption/issues/257
https://github.com/owncloud/core/pull/38567
* Bugfix - Creating self group-reshare should not not share to self: [#38581](https://github.com/owncloud/core/pull/38581)
In a scenario where resharing with group that user belongs to, permissions and
attributes were incorrectly handled in share mount logic when permissions for
that share got adjusted, or that share got again reshared to another user that
again reshared with prior user. This bugfix prevents creation of self share
mount in root folder of the user
https://github.com/owncloud/enterprise/issues/4382
https://github.com/owncloud/core/pull/38581
* Bugfix - Check quota on the necessary move operations: [#38591](https://github.com/owncloud/core/pull/38591)
When encryption is active, a move operation between two different storages was
leading to a broken copy on target storage if the target has not enough quota.
This data loss problem has been resolved.
https://github.com/owncloud/core/pull/38591
* Bugfix - Normalize web.baseUrl before using it: [#38600](https://github.com/owncloud/core/issues/38600)
`web.baseUrl` was used for rewriting private and public links to the new web UI
without normalizing it. This leads to broken authentication if the `web.baseUrl`
was configured with a trailing slash.
https://github.com/owncloud/core/issues/38600
* Bugfix - Don't rewrite private/public links when web app disabled: [#38602](https://github.com/owncloud/core/issues/38602)
When oc10 app is installed but disabled, we still showed the nav item and
rewrote the URLs for private and public links.
https://github.com/owncloud/core/issues/38602
https://github.com/owncloud/core/pull/38603
* Bugfix - Objectids for comments and tags are strings: [#38682](https://github.com/owncloud/core/pull/38682)
We were using integers when asking for some information related to comments and
tag. This was working fine, but PHP 7.4.18 made some changes in the postgresql
driver making things more strict. As result, some queries were failing because
that information was stored as string, not integer.
This problem is now fixed, and the queries can run without problems.
https://github.com/owncloud/core/pull/38682
* Bugfix - Hide sensible information on share download: [#38689](https://github.com/owncloud/core/pull/38689)
Sensible information could be exposed when downloading a share via public link.
We now throw a generic exception that overwrites the original exception message.
Also fixed an error which caused such behavior when appending a null byte to the
download URL.
https://github.com/owncloud/enterprise/issues/4536
https://github.com/owncloud/core/pull/38689
* Bugfix - Hide file drop content: [#38691](https://github.com/owncloud/core/pull/38691)
Requesting file drop share with the deprecated shareinfo API, exposed
information about the content of the file drop share. We will now deliver empty
content on the children entry.
https://github.com/owncloud/enterprise/issues/4540
https://github.com/owncloud/core/pull/38691
* Bugfix - Regenerate session after authenticate a password protected public share: [#38693](https://github.com/owncloud/core/pull/38693)
Session has been has not been regenerated after authenticate a password
protected public share. Now we regenerate the session and delete the old one for
anonymous users.
https://github.com/owncloud/enterprise/issues/4535
https://github.com/owncloud/core/pull/38693
* Bugfix - Add check when updating the permissions of a federated share: [#38698](https://github.com/owncloud/core/pull/38698)
This fixes a security issue where a federated share recipient could increase
permissions on his share. We now limit the permission updates to federated
re-shares only.
https://github.com/owncloud/enterprise/issues/4537
https://github.com/owncloud/core/pull/38698
* Bugfix - Prevent renaming or deleting a SMB mount point: [#38709](https://github.com/owncloud/core/pull/38709)
Renaming or deleting a SMB mount point will throw a 403 error code
https://github.com/owncloud/core/pull/38709
* Bugfix - String to bool conversion in systemtags API: [#38719](https://github.com/owncloud/core/pull/38719)
String values like "true" and "false" were always converted to true when
creating a tag via API. We now use filter_var() to fix this behavior.
https://github.com/owncloud/core/pull/38719
* Bugfix - Database query filter when getting a tag: [#38725](https://github.com/owncloud/core/pull/38725)
The filter values for userAssignable and userEditable were swapped, causing a
wrong result in certain cases.
https://github.com/owncloud/core/pull/38725
* Bugfix - Fix federated share download bug happens on some providers: [#38738](https://github.com/owncloud/core/pull/38738)
Some WebDAV service providers are not able to respond properly when the HTTP
client request_fulluri option set without proxy. Now, the HTTP client
request_fulluri option set only if a proxy configured.
https://github.com/owncloud/core/pull/38738
* Bugfix - Correctly parse different ocm-provider api responses: [#38751](https://github.com/owncloud/core/pull/38751)
Some WebDAV service providers returns different responses for ocm-provider API
and we were not able to parse these responses. This problem has been fixed.
https://github.com/owncloud/core/pull/38751
* Bugfix - Move files_antivirus executable mode config options into config.php: [#38753](https://github.com/owncloud/core/pull/38753)
Executable mode of the files_antivirus app is now configured in the core
config.php file.
https://github.com/owncloud/core/pull/38753
https://github.com/owncloud/files_antivirus/pull/442
* Bugfix - Delay getting the file info until it's going to be used: [#38767](https://github.com/owncloud/core/pull/38767)
Some operations require getting the file info to perform the action. Previously,
this file info was fetched and stored before any operation. In some cases
fetching the file info triggered a file scan that could delay the whole request
considerably.
Now, we fetch the file info only in those operations that require it. There are
some node operations such as getting the file path that don't require fetching
the file info, so those operation won't fetch it, and so a potential file scan
is prevented (for those operations)
https://github.com/owncloud/core/pull/38767
* Bugfix - Image preview for file versions: [#38778](https://github.com/owncloud/core/pull/38778)
Changed the way how preview thumbnails are being rendered so they will be
rendered properly for file versions.
https://github.com/owncloud/core/issues/38766
https://github.com/owncloud/core/pull/38778
* Bugfix - Prevent files:checksum:verify from crashing on exception: [#38785](https://github.com/owncloud/core/pull/38785)
The command now skips files with exceptions instead of crashing. A proper
message will be displayed to the user who fires the command.
https://github.com/owncloud/core/issues/38782
https://github.com/owncloud/core/pull/38785
https://github.com/owncloud/core/pull/39005
* Bugfix - Include incoming and parent permissions in Share UI subfolder reshares: [#38788](https://github.com/owncloud/core/pull/38788)
Before this fix SharePanel in Share UI did not include permissions of both
incoming and parent shares for subfolder reshares. It caused lack of possibility
of resharing such files/folder even though server-side permissions allowed it.
https://github.com/owncloud/enterprise/issues/4497
https://github.com/owncloud/core/pull/38788
* Bugfix - Always allow renaming shared mounts: [#38794](https://github.com/owncloud/core/pull/38794)
We now skip the initial permission check when renaming a shared mount as this
should always be possible.
https://github.com/owncloud/enterprise/issues/4582
https://github.com/owncloud/core/issues/30325
https://github.com/owncloud/core/pull/38794
* Bugfix - Adjust position of the share autocomplete element: [#38831](https://github.com/owncloud/core/pull/38831)
We now append the share autocomplete element to #shareTabView to prevent the
autocomplete dialog from being hidden in certain scenarios. This happened with
Safari for example as soon as the filelist was long enough to have a vertical
scrollbar.
https://github.com/owncloud/enterprise/issues/4603
https://github.com/owncloud/core/pull/38831
* Bugfix - Fix docs link to federated sharing docs: [#38859](https://github.com/owncloud/core/issues/38859)
The link in the share dialogue on the info icon was broken. Was fixed by
pointing to the correct config value.
https://github.com/owncloud/core/issues/38859
https://github.com/owncloud/core/pull/38860
* Bugfix - Fix file locks for public shares: [#38922](https://github.com/owncloud/core/pull/38922)
When using the new WebDAV API, the node which is used to retrieve file locks is
either of type SharedFile or SharedFolder. Both these types do not implement our
own node class, so we need to handle them separately. This is needed to properly
handle file locks on public shares when using the new WebDAV API.
https://github.com/owncloud/core/issues/38912
https://github.com/owncloud/core/issues/36064
https://github.com/owncloud/core/pull/38922
* Change - Update PHP dependencies: [#38524](https://github.com/owncloud/core/pull/38524)
The following have been updated: - doctrine/cache (1.10.2 to 2.0.3) -
doctrine/dbal (2.13.1 to 2.13.2) - egulias/email-validator (3.1.0 to 3.1.1) -
icewind/streams (0.7.3 to 0.7.5) - opis/closure (3.6.1 to 3.6.2) -
pear/pear_exception (v1.0.1 to v1.0.2) - phpseclib/phpseclib (3.0.6 to 3.0.9) -
psr/log (1.1.3 to 1.1.4)
The following have been updated in files_external/3rdparty: - firebase/php-jwt
(v5.2.1 to v5.3.0) - google/apiclient (v2.9.1 to v2.9.2) -
google/apiclient-services (v0.164.0 to v0.181.0) - google/auth (v1.15.0 to
v1.15.1) - guzzlehttp/psr7 (1.7.0 to 1.8.2) - icewind/smb (3.3.1 to 3.4.1) -
icewind/streams (0.7.3 to 0.7.5) - phpseclib/phpseclib (3.0.6 to 3.0.9) -
psr/log (1.1.3 to 1.1.4)
https://github.com/owncloud/core/pull/38524
https://github.com/owncloud/core/pull/38598
https://github.com/owncloud/core/pull/38620
https://github.com/owncloud/core/pull/38646
https://github.com/owncloud/core/pull/38648
https://github.com/owncloud/core/pull/38659
https://github.com/owncloud/core/pull/38688
https://github.com/owncloud/core/pull/38749
https://github.com/owncloud/core/pull/38786
https://github.com/owncloud/core/pull/38839
https://github.com/owncloud/core/pull/38845
https://github.com/owncloud/core/pull/38878
* Change - Bump doctrine/dbal from 2.10.4 to 2.13.1: [#38647](https://github.com/owncloud/core/pull/38647)
Implemented the new method executeStatement in our DB Connection class as
Doctrine calls this method now instead of the deprecated executeUpdate.
https://github.com/owncloud/core/issues/38681
https://github.com/owncloud/core/pull/38647
* Change - Improve performance for the MOVE operation: [#38649](https://github.com/owncloud/core/pull/38649)
Previously, in order to move a folder, we needed to get all the content and
replace the path of each one one by one. Now we replace the path of all the
content in one DB query, which reduces the network traffic and allows better
optimization in the DB. This change affects MySQL, MariaDB, Postgresql, and
Oracle. Sqlite is excluded from this optimization and will use the previous
behaviour.
https://github.com/owncloud/core/pull/38649
* Change - Optimize share rename: [#38656](https://github.com/owncloud/core/pull/38656)
Renaming a received share could cause a file scan to be triggered. This could
potentially be a performance problem if the file scan took a while.
Now, renaming a received share won't trigger that file scan, so the performance
will be faster.
https://github.com/owncloud/core/pull/38656
* Change - All mount configuration items marked as passwords will be encrypted: [#38728](https://github.com/owncloud/core/pull/38728)
Previously, only some known configuration items were encrypted. This was a
problem for new items that required protection because this required changes in
the core product.
Now, all the items marked as passwords will be encrypted. This will be done
automatically without 3rd party apps needing to do anything. A migration is also
provided to update the items if needed.
https://github.com/owncloud/core/pull/38728
* Change - Change favicon and color references to match the new CI: [#38750](https://github.com/owncloud/core/pull/38750)
We changed some color references to match the new CI-color of ownCloud. Also a
new header image for the mail templates and the ownCloud logo without the "X"
reference was added.
https://github.com/owncloud/core/pull/38750
* Change - Update PHP dependencies: [#38891](https://github.com/owncloud/core/pull/38891)
The following have been updated: - league/flysystem (1.0.70 => 1.1.4) -
punic/punic (3.5.1 => 3.6.0) - symfony/service-contracts (v1.1.9 => v2.4.0) -
symfony/translation-contracts (v1.1.10 => v2.4.0)
https://github.com/owncloud/core/pull/38891
* Change - Update Symfony components: [#38924](https://github.com/owncloud/core/pull/38924)
The following Symfony components have been updated from 4.4.20 to: - console
4.4.26 - event-dispatcher 4.4.25 - process 4.4.26 - routing 4.4.25 - translation
4.4.25
The following Symfony polyfill components have been updated : -
symfony/polyfill-ctype (v1.22.1 to v1.23.0) - symfony/polyfill-iconv (v1.22.1 to
v1.23.0) - symfony/polyfill-intl-idn (v1.22.1 to v1.23.0) -
symfony/polyfill-intl-normalizer (v1.22.1 to v1.23.0) -
symfony/polyfill-mbstring (v1.22.1 to v1.23.0) - symfony/polyfill-php72 (v1.22.1
to v1.23.0) - symfony/polyfill-php73 (v1.22.1 to v1.23.0) -
symfony/polyfill-php80 (v1.22.1 to v1.23.0)
https://github.com/owncloud/core/pull/38924
https://github.com/owncloud/core/pull/38797
https://github.com/owncloud/core/pull/38755
https://github.com/owncloud/core/pull/38730
https://github.com/owncloud/core/pull/38680
https://github.com/owncloud/core/pull/38598
https://github.com/owncloud/core/pull/38786
https://symfony.com/blog/symfony-4-4-26-released
https://symfony.com/blog/symfony-4-4-25-released
https://symfony.com/blog/symfony-4-4-24-released
https://symfony.com/blog/symfony-4-4-23-released
https://symfony.com/blog/symfony-4-4-22-released
https://symfony.com/blog/symfony-4-4-21-released
* Change - Update PHP minimum version to 7.2.5: [#38934](https://github.com/owncloud/core/pull/38934)
The minimum supported PHP version is now 7.2.5. This supports some dependencies
that require at least 7.2.5.
PHP 7.2 security patches finished in December 2020. PHP 7.3 security patches
finish on 6 December 2021. It is recommended that you plan an upgrade to PHP 7.4
now.
https://github.com/owncloud/core/pull/38934
https://www.php.net/supported-versions.php
* Change - Update url for sync client button and docs: [#38962](https://github.com/owncloud/core/pull/38962)
https://github.com/owncloud/core/issues/38957
https://github.com/owncloud/core/pull/38962
* Enhancement - Command occ user:report shows additional row for guests: [#3467](https://github.com/owncloud/enterprise/issues/3467)
With this improvement, a new row will be rendered for guest user count on the
occ user:report command.
https://github.com/owncloud/enterprise/issues/3467
https://github.com/owncloud/core/pull/38742
* Enhancement - Improve public share federation user interface: [#4393](https://github.com/owncloud/enterprise/issues/4393)
This adjustment provides a new way to add a public share to ownCloud. A new
button will be displayed where you can easily add the share to the current
server without entering the string, this requires less user input. Next to this
button, a dropdown menu will be displayed, where you can see the current server
or change the server. Hitting change a server will now display a prompt with a
detailed explanation and more space to enter another server address.
https://github.com/owncloud/enterprise/issues/4393
https://github.com/owncloud/core/pull/38712
https://github.com/owncloud/core/pull/38928
https://github.com/owncloud/core/pull/38942
https://github.com/owncloud/core/pull/38948
* Enhancement - Show notification if video playback is not possible on public share: [#4632](https://github.com/owncloud/enterprise/issues/4632)
Before this PR no error notification was shown if a video can't be played due to
browser incompatibility, for example, mov files on chrome.
(https://stackoverflow.com/questions/28746645)
Now we will show a dedicated notification.
https://github.com/owncloud/enterprise/issues/4632
https://github.com/owncloud/core/pull/38858
* Enhancement - Improve login form: [#38506](https://github.com/owncloud/core/pull/38506)
This adjustment improves the overall look and feel of the login form.
Furthermore, the placeholders have been replaced in favor of labels, the confirm
button has been expunged from the password field and placed under the input
fields.
https://github.com/owncloud/core/pull/38506
https://github.com/owncloud/core/pull/38853
https://github.com/owncloud/core/pull/38894
* Enhancement - Automations in activity stream: [#38605](https://github.com/owncloud/core/pull/38605)
This adjustment provides a way to handle the activity stream for actions that
were triggered by an automation (like the workflow app e.g.).
https://github.com/owncloud/enterprise/issues/4222
https://github.com/owncloud/core/pull/38605
https://github.com/owncloud/core/pull/38630
https://github.com/owncloud/core/pull/38970
* Enhancement - Add html template for calens: [#38616](https://github.com/owncloud/core/pull/38616)
Added an html template to render the changelog also in html format. This will
give us better control over the rendering on the website.
https://github.com/owncloud/core/pull/38616
* Enhancement - Expired shares in activity stream: [#38631](https://github.com/owncloud/core/pull/38631)
Add a proper message in the activity stream for shares which expired
automatically. Previous to this, the expiry was authored by a user, which is
technically not true.
https://github.com/owncloud/enterprise/issues/4455
https://github.com/owncloud/core/pull/38631
* Enhancement - Use relative notification URLs: [#38639](https://github.com/owncloud/core/pull/38639)
Previous to this fix, absolute URLs were passed to the notification app. This
could cause some CORS issues, hence we now use relative ones.
https://github.com/owncloud/enterprise/issues/4250
https://github.com/owncloud/core/pull/38639
* Enhancement - Add excludeActions parameter to registerDefaultActions function: [#38643](https://github.com/owncloud/core/pull/38643)
With this change we can pass now excludeActions to the registerDefaultActions
function in fileactions.js, this allows us technically to omit specific file
actions.
https://github.com/owncloud/core/pull/38643
* Enhancement - Improve tab headers UI: [#38653](https://github.com/owncloud/core/pull/38653)
With this change, tab headers will have a similar style to other nav elements,
like the side nav. Also improved the UI on small display ratio, where elements
in the second row were not properly left-aligned.
https://github.com/owncloud/core/pull/38653
* Enhancement - Add trashbin skip list to config: [#38704](https://github.com/owncloud/core/pull/38704)
With this change new config parameters has been introduced. Admins can now
decide, based on file extensions, directory names and size, if a resource should
not be observed by the trashbin and deleted immediately.
https://github.com/owncloud/core/pull/38704
https://github.com/owncloud/core/pull/38960
* Enhancement - Remove google+ share button from personal settings: [#38705](https://github.com/owncloud/core/pull/38705)
Due to the google+ service has been declined, we won't show the google+ share
button anymore.
https://github.com/owncloud/core/pull/38705
* Enhancement - Adjust the return type of the querybuilder's execute method: [#38714](https://github.com/owncloud/core/pull/38714)
The return type changed with the recent update of doctrine/dbal to version 2.13.
https://github.com/owncloud/core/pull/38714
* Enhancement - Communicate user profile picture capability: [#38722](https://github.com/owncloud/core/pull/38722)
A new capability "profile_picture" has been added so that clients can know
whether to fetch and render avatar images of users.
https://github.com/owncloud/core/pull/38722
* Enhancement - Allow apps to implement their own license: [#38737](https://github.com/owncloud/core/pull/38737)
Apps can implement their own license parser by extending the
\OCP\License\AbstractLicense class. Note that storing the license will still be
performed by ownCloud. This custom license can provide additional information
that can be queried through the ILicenseManager.
https://github.com/owncloud/core/pull/38737
* Enhancement - Improve mobile user interface on files list: [#38748](https://github.com/owncloud/core/pull/38748)
This improvement solves the problem that files and folders with a longer name
than 10 chars will cut off to 7 chars by hiding non-essential meta data. As well
the uploading indicator text on a folders table row will now be displayed at the
beginning to avoid UI glitches.
https://github.com/owncloud/core/pull/38748
* Enhancement - Resend invitation email: [#38774](https://github.com/owncloud/core/pull/38774)
Implemented an action to resend the invitation email for a user that has never
been logged in yet.
https://github.com/owncloud/enterprise/issues/4577
https://github.com/owncloud/core/pull/38774
https://github.com/owncloud/core/pull/38963
* Enhancement - Add more properties to the REPORT result: [#38787](https://github.com/owncloud/core/pull/38787)
File Search should be done in the future via WebDAV REPORT requests. ownCloud
web is using it. In some cases with other search backends we have more
properties to return. `` => returns am html formatted
excerpt of the file content which is highlighting the matching words.
`` returns a float number score value.
https://github.com/owncloud/core/pull/38787
* Enhancement - Improve admin external storage settings UI: [#38795](https://github.com/owncloud/core/pull/38795)
Before this PR no error notification was shown while an external mount point
configuration was not able to load. This was only indicated with a red square
with a long list of external mount points, this was not handy. Therefore an
error notification will be shown with the dedicated external mount point which
fails to load.
As well improved the add external mount point functionality with opening the
available for select while adding an external mount point. The select will have
now a 'select all' item. These changes prevents the admin to expose the mount
point unwanted to all users immediately.
https://github.com/owncloud/enterprise/issues/4585
https://github.com/owncloud/core/pull/38795
* Enhancement - Introduce new state to prevent scanning of shallow scanned folders: [#38804](https://github.com/owncloud/core/pull/38804)
Folders can be partially scanned, this means that a folder could have its
closest contents scanned (the first level), but not deeper contents. Folder "/A"
could be scanned but not "/A/B/C".
Previously, we couldn't detect that a folder had been partially scanned, so we
triggered another scan on that folder even though we already had data in the DB.
Now, we can detect that the folder has been partially scanned to avoid another
scan if it isn't needed. This leads to notable performance improvements in cases
where a FS hasn't been scanned fully. Note that an initial scan is still
required, and the performance will remain the same in this case.
https://github.com/owncloud/core/pull/38804
* Enhancement - Improve performance of the SMB log when it is inactive: [#38819](https://github.com/owncloud/core/pull/38819)
The SMB connector includes very verbose logs to trace what could have gone
wrong. These logs are disabled by default, but although they're disabled we
still need to check the state to decide whether we want to log or not.
Now, the state check is faster and it takes less time to decide, so the overall
performance of the connector is improved.
https://github.com/owncloud/core/pull/38819
* Enhancement - Introduce the patch for CVE-2019-11358: [#38841](https://github.com/owncloud/core/pull/38841)
Patched jQuery's `$.extend` method. The code in core doesn't contain any
vulnerable invocations of `$.extend` this is just a preventive patch.
https://github.com/owncloud/core/pull/38841
https://nvd.nist.gov/vuln/detail/CVE-2019-11358
https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
https://github.com/DanielRuf/snyk-js-jquery-174006?files=1
* Enhancement - Introduce a remove license button in WebUI: [#38843](https://github.com/owncloud/core/issues/38843)
Before this PR, it was not possible, to remove any ownCloud license. This lead
to an issue if someone enters an invalid license, a permanent message indicator
was shown in the WebUI. With this PR it is possible to remove the license.
https://github.com/owncloud/core/issues/38843
https://github.com/owncloud/core/pull/38844
* Enhancement - Trigger file scan after accepting a federated share: [#38880](https://github.com/owncloud/core/pull/38880)
This is necessary as we need the fileId to pass it to the `remoteshare.accepted`
event. The activity app can then hook onto this event and update the activity by
setting the correct fileId.
Also added a short translation for the SUBJECT_REMOTE_SHARE_RECEIVED activity.
https://github.com/owncloud/activity/issues/970
https://github.com/owncloud/core/pull/38880
https://github.com/owncloud/core/pull/38889
* Enhancement - Allow to pass password on redis cluster connection: [#38917](https://github.com/owncloud/core/pull/38917)
https://github.com/owncloud/enterprise/issues/4658
https://github.com/owncloud/core/pull/38917
# Changelog for ownCloud Core [10.7.0] (2021-03-26)
The following sections list the changes in ownCloud core 10.7.0 relevant to
ownCloud admins and users.
[10.7.0]: https://github.com/owncloud/core/compare/v10.6.0...v10.7.0
## Summary
* Bugfix - Show non-generic messages for 403 HTTP status to end user: [#395](https://github.com/owncloud/files_antivirus/issues/395)
* Bugfix - Fix some code smells reported by SonarCloud: [#38147](https://github.com/owncloud/core/pull/38147)
* Bugfix - Don't redirect if the browser ask for a .properties file: [#38181](https://github.com/owncloud/core/pull/38181)
* Bugfix - Show the share list even if some shares point to unavailable storages: [#38190](https://github.com/owncloud/core/pull/38190)
* Bugfix - Fix a regression with theming of settings menu icons: [#38246](https://github.com/owncloud/core/pull/38246)
* Bugfix - Determine unencrypted block size after begin operation: [#38249](https://github.com/owncloud/core/pull/38249)
* Bugfix - Allow all users to see which groups they manage: [#38281](https://github.com/owncloud/core/pull/38281)
* Bugfix - Fix the position of the user afterLogin-event: [#38289](https://github.com/owncloud/core/pull/38289)
* Bugfix - Fix file_target in response when creating a public link share: [#38291](https://github.com/owncloud/core/issues/38291)
* Bugfix - Fix rendering of leading/trailing spaces in the file name: [#38316](https://github.com/owncloud/core/issues/38316)
* Bugfix - Fix broken signature when a backup copy is generated: [#38375](https://github.com/owncloud/core/pull/38375)
* Bugfix - Prevent multiple calls by not registering the same listener twice: [#38385](https://github.com/owncloud/core/pull/38385)
* Bugfix - Prevent getting a version expiry list when no versions available: [#38390](https://github.com/owncloud/core/pull/38390)
* Bugfix - Add the owner to public link shares: [#38396](https://github.com/owncloud/core/pull/38396)
* Bugfix - Fix issues with duplicated file names in the same directory: [#38415](https://github.com/owncloud/core/pull/38415)
* Bugfix - Fix command maintenance:mimetype:update-db --repair-filecache: [#38425](https://github.com/owncloud/core/issues/38425)
* Bugfix - Fix storage lookup in versions when storing a new version: [#38430](https://github.com/owncloud/core/pull/38430)
* Bugfix - Fix behavior for user search at the API level: [#38489](https://github.com/owncloud/core/pull/38489)
* Bugfix - Fix mispositioned ui elements after leaving viewerMode: [#38547](https://github.com/owncloud/core/issues/38547)
* Bugfix - Fix problems moving files inside Gdrive storages: [#38553](https://github.com/owncloud/core/pull/38553)
* Change - Use OcsController and routes instead of API::register: [#37272](https://github.com/owncloud/core/pull/37272)
* Change - API changes to remove shares pointing to missing files: [#38152](https://github.com/owncloud/core/pull/38152)
* Change - Update PHP dependencies: [#38188](https://github.com/owncloud/core/pull/38188)
* Change - Rename phoenix to web: [#38199](https://github.com/owncloud/core/pull/38199)
* Change - Change X-XSS-Protection "1; block" -> "0": [#38236](https://github.com/owncloud/core/issues/38236)
* Change - Update symfony/polyfill (1.20.0 => 1.22.1): [#38275](https://github.com/owncloud/core/pull/38275)
* Change - Remove package patchwork/utf8: [#38286](https://github.com/owncloud/core/pull/38286)
* Change - Update Symfony components to 4.4.20: [#38462](https://github.com/owncloud/core/pull/38462)
* Change - Update icewind/smb from 3.2.7 to 3.3.1 in files_external: [#38462](https://github.com/owncloud/core/pull/38462)
* Enhancement - Context menu for files in case multiple actions apply: [#38132](https://github.com/owncloud/core/pull/38132)
* Enhancement - New external storage: SMB Collaborative (shared file IDs)): [#38151](https://github.com/owncloud/core/pull/38151)
* Enhancement - Allow mounting a subfolder from Google Drive: [#38161](https://github.com/owncloud/core/pull/38161)
* Enhancement - Make the right scrollbar more visible on the UI: [#38183](https://github.com/owncloud/core/pull/38183)
* Enhancement - Improve file list tag management: [#38197](https://github.com/owncloud/core/pull/38197)
* Enhancement - Improve the UX in the external storage settings page: [#38288](https://github.com/owncloud/core/pull/38288)
* Enhancement - Prevent group assignment in Web UI if not supported: [#38298](https://github.com/owncloud/core/pull/38298)
* Enhancement - Display path in the occ app:list command: [#38309](https://github.com/owncloud/core/pull/38309)
* Enhancement - New config parameter to define the encrypted file format: [#38337](https://github.com/owncloud/core/pull/38337)
* Enhancement - Display error/success message while changing the log level: [#38340](https://github.com/owncloud/core/pull/38340)
* Enhancement - Implement pre-signed download urls for public links: [#38376](https://github.com/owncloud/core/pull/38376)
* Enhancement - Allow force set DB patforms: [#38379](https://github.com/owncloud/core/pull/38379)
* Enhancement - Added additional connection parameters to redis config: [#38386](https://github.com/owncloud/core/pull/38386)
* Enhancement - Hide federated user suggestions if system users are found: [#38389](https://github.com/owncloud/core/pull/38389)
* Enhancement - Indicate existing guest-user as a guest in the share tab: [#38440](https://github.com/owncloud/core/pull/38440)
* Enhancement - Add config parameter 'http.cookie.samesite': [#38458](https://github.com/owncloud/core/pull/38458)
* Enhancement - Add exception messages whenever a node cannot be moved: [#38481](https://github.com/owncloud/core/pull/38481)
* Enhancement - UI improvement external storage: [#38483](https://github.com/owncloud/core/pull/38483)
* Enhancement - Improve systemtags UI for delete and fix case sensitivity problem: [#38498](https://github.com/owncloud/core/pull/38498)
## Details
* Bugfix - Show non-generic messages for 403 HTTP status to end user: [#395](https://github.com/owncloud/files_antivirus/issues/395)
The real reason why 3rd party app canceled upload was ignored by Web UI and a
generic 'You are not allowed to upload here' message was shown instead. Now 'You
are not allowed to upload here' is shown only if a real reason is empty.
https://github.com/owncloud/files_antivirus/issues/395
https://github.com/owncloud/core/pull/38416
* Bugfix - Fix some code smells reported by SonarCloud: [#38147](https://github.com/owncloud/core/pull/38147)
https://github.com/owncloud/core/pull/38147
* Bugfix - Don't redirect if the browser ask for a .properties file: [#38181](https://github.com/owncloud/core/pull/38181)
In order to provide translations, the files_pdfviewer app requested a
.properties file. This request failed because the server redirected it to the
default page (the files view), so the app couldn't get the translations
This redirection doesn't happen any longer, and the app can translate the UI
elements now.
https://github.com/owncloud/core/pull/38181
* Bugfix - Show the share list even if some shares point to unavailable storages: [#38190](https://github.com/owncloud/core/pull/38190)
Previously, if some shares pointed to file nodes that belonged to unavailable
storages, the share list wouldn't show any share due to the exception not being
handled correctly.
Now, the exception is handled. The affected shares will be ignored (an error
message will appear in the log with the exception), and the rest of the shares
will show in the web UI.
Note that the steps to reproduce the problem are still unclear, and it might be
impossible to reproduce the issue using recent ownCloud versions. So far, not
only it seems required to have a share pointing to an unavailable storage, but
also there has to be a pending modification for ownCloud to scan the file. Such
conditions shouldn't be possible at the same time.
https://github.com/owncloud/core/pull/38190
* Bugfix - Fix a regression with theming of settings menu icons: [#38246](https://github.com/owncloud/core/pull/38246)
Default icons were loaded instead of the overrides from the enabled app-theme in
the settings menu.
https://github.com/owncloud/core/pull/38246
* Bugfix - Determine unencrypted block size after begin operation: [#38249](https://github.com/owncloud/core/pull/38249)
Unencrypted block size of encrypted file can change with different encoding
types. Unencrypted block size determination has been moved after begin operation
in stream opening. In this way, EncryptionModule can decide block size after
reading the header of the file.
https://github.com/owncloud/core/pull/38249
* Bugfix - Allow all users to see which groups they manage: [#38281](https://github.com/owncloud/core/pull/38281)
https://github.com/owncloud/core/pull/38281
* Bugfix - Fix the position of the user afterLogin-event: [#38289](https://github.com/owncloud/core/pull/38289)
Move the emitting event "user.afterlogin" in the method loginWithPassword.
Previously it was placed after the prepareUserLogin-call which caused some
issues with the encryption app using Symfony event listeners.
https://github.com/owncloud/core/pull/38289
* Bugfix - Fix file_target in response when creating a public link share: [#38291](https://github.com/owncloud/core/issues/38291)
The value of share_folder (if set in config.php) was being prepended to the
file_target field in the response to a request to create a public link share.
share_folder is not relevant to public link shares. It is no longer prepended.
https://github.com/owncloud/core/issues/38291
https://github.com/owncloud/core/pull/38295
* Bugfix - Fix rendering of leading/trailing spaces in the file name: [#38316](https://github.com/owncloud/core/issues/38316)
Leading and trailing spaces in the file name were stripped in the Web UI
https://github.com/owncloud/core/issues/38316
https://github.com/owncloud/core/pull/38319
* Bugfix - Fix broken signature when a backup copy is generated: [#38375](https://github.com/owncloud/core/pull/38375)
Previously, when a user uploaded a file and then moved it to a shared folder in
order for a second user to get the file, a copy of the file was generated inside
the share owner's trashbin. This allowed the share owner to restore the file
into the share again if needed. Using encryption, that backup copy was wrongly
generated and couldn't be decrypted due to a wrong signature.
This issue is now fixed, and the backup copy can be restored normally.
https://github.com/owncloud/encryption/issues/244
https://github.com/owncloud/core/pull/38375
https://github.com/owncloud/core/pull/38452
* Bugfix - Prevent multiple calls by not registering the same listener twice: [#38385](https://github.com/owncloud/core/pull/38385)
Going back and forth among the file sections ("all files", "shared with you",
etc) was making some event listeners to be registered twice or more times. This
was causing the same ajax request to be called several times causing unnecessary
load in the server.
Now, these additional requests won't happen
https://github.com/owncloud/core/pull/38385
* Bugfix - Prevent getting a version expiry list when no versions available: [#38390](https://github.com/owncloud/core/pull/38390)
Previous to this fix, when getting a version expiry list with an empty version
array, ownCloud ran into an error. Not a critical one, but still not nice and
spams the owncloud.log file.
https://github.com/owncloud/core/issues/38373
https://github.com/owncloud/core/pull/38390
* Bugfix - Add the owner to public link shares: [#38396](https://github.com/owncloud/core/pull/38396)
Add the owner to public link shares because we cannot retrieve this information
otherwise.
https://github.com/owncloud/files_spaces/issues/51
https://github.com/owncloud/core/pull/38396
* Bugfix - Fix issues with duplicated file names in the same directory: [#38415](https://github.com/owncloud/core/pull/38415)
In some views like the "Shared by link"-list it is possible to have one or more
files with the same name in one directory. This fix corrects plenty of wrong
behaviors that such a scenario caused in the UI.
https://github.com/owncloud/enterprise/issues/4412
https://github.com/owncloud/core/pull/38415
* Bugfix - Fix command maintenance:mimetype:update-db --repair-filecache: [#38425](https://github.com/owncloud/core/issues/38425)
While running the command maintenance:mimetype:update-db --repair-filecache,
existing records in the filecache table were not updated due to a faulty sql
statement.
https://github.com/owncloud/core/issues/38425
https://github.com/owncloud/core/pull/38426
* Bugfix - Fix storage lookup in versions when storing a new version: [#38430](https://github.com/owncloud/core/pull/38430)
Versioning has been integrated with the new storage based versioning
IVersionedStorage. Until today this was only tested with objectstore versioning
which is hooked up as primary storage. When trying to access a versioned storage
which is mounted as non-root this logic did not work out.
https://github.com/owncloud/core/pull/38430
* Bugfix - Fix behavior for user search at the API level: [#38489](https://github.com/owncloud/core/pull/38489)
The 'user.search_min_length' restriction could be circumvented when accessing
the API directly.
https://github.com/owncloud/core/pull/38489
* Bugfix - Fix mispositioned ui elements after leaving viewerMode: [#38547](https://github.com/owncloud/core/issues/38547)
Until today, after leaving the viewer mode (e.G Pdf viewer) the action header
table in the files list was mispositioned while checking an item. The download
action and following items went out of sight.
https://github.com/owncloud/core/issues/38547
https://github.com/owncloud/core/pull/38552
* Bugfix - Fix problems moving files inside Gdrive storages: [#38553](https://github.com/owncloud/core/pull/38553)
Moving files inside a Gdrive storage broke, likely due to changes in the Gdrive
server. This PR ensures it works again Moving files from local storage into the
Gdrive storage is also fixed.
https://github.com/owncloud/core/pull/38553
* Change - Use OcsController and routes instead of API::register: [#37272](https://github.com/owncloud/core/pull/37272)
Implemented OcsController and removed a separate file to register ocs routes.
Also some deprecated and legacy OC_OCS classes removed. OcsController now checks
CSRF token instead of OCS_API_REQUEST header.
https://github.com/owncloud/core/issues/12454
https://github.com/owncloud/core/pull/37272
* Change - API changes to remove shares pointing to missing files: [#38152](https://github.com/owncloud/core/pull/38152)
If a file was completely deleted without unsharing first, the share would still
exist in the DB even though it wouldn't be shown to the users. This change
prepares a way to remove those shares.
https://github.com/owncloud/core/pull/38152
* Change - Update PHP dependencies: [#38188](https://github.com/owncloud/core/pull/38188)
The following have been updated: - christophwurst/id3parser (v0.1.1 to v0.1.2) -
egulias/email-validator (2.1.24 to 3.1.0) - icewind/streams from (0.7.2 to
0.7.3) - laminas/laminas-validator (2.13.4 to 2.13.5) -
laminas/laminas-servicemanager (3.4.1 to 3.5.2) - nikic/php-parser (4.10.2 to
4.10.4) - pear/archive_tar (1.4.11 to 1.4.13) - phpseclib/phpseclib (2.0.29 to
3.0.6) - psr/container (1.0.0 to 1.1.1) - sabre/dav (4.1.3 to 4.1.5) -
sabre/vobject (4.3.3 to 4.3.5) - swiftmailer/swiftmailer (v6.2.3 to v6.2.7) -
webmozart/assert (1.9.1 to 1.10.0)
The following have been updated in files_external/3rdparty: - google/apiclient
(v2.8.3 to v2.9.1) - firebase/php-jwt (v5.2.0 to v5.2.1) -
google/apiclient-services (v0.153 to v0.163.0) - google/auth (v1.14.3 to
v1.15.0) - icewind/smb (3.2.7 to 3.3.1) - icewind/streams (0.7.2 to 0.7.3) -
monolog/monolog (2.1.1 to 2.2.0) - phpseclib/phpseclib (2.0.29 to 3.0.6)
https://github.com/owncloud/core/pull/38188
https://github.com/owncloud/core/pull/38191
https://github.com/owncloud/core/pull/38198
https://github.com/owncloud/core/pull/38238
https://github.com/owncloud/core/pull/38244
https://github.com/owncloud/core/pull/38255
https://github.com/owncloud/core/pull/38275
https://github.com/owncloud/core/pull/38285
https://github.com/owncloud/core/pull/38306
https://github.com/owncloud/core/pull/38312
https://github.com/owncloud/core/pull/38344
https://github.com/owncloud/core/pull/38380
https://github.com/owncloud/core/pull/38387
https://github.com/owncloud/core/pull/38399
https://github.com/owncloud/core/pull/38434
https://github.com/owncloud/core/pull/38453
https://github.com/owncloud/core/pull/38462
https://github.com/owncloud/core/pull/38487
https://github.com/owncloud/core/pull/38508
* Change - Rename phoenix to web: [#38199](https://github.com/owncloud/core/pull/38199)
Phoenix has been renamed to Web. You can now set these keys in config.php to
control Web:
- web.baseUrl - web.icon - web.label
https://github.com/owncloud/core/pull/38199
https://github.com/owncloud/core/pull/38201
https://github.com/owncloud/core/pull/38212
* Change - Change X-XSS-Protection "1; block" -> "0": [#38236](https://github.com/owncloud/core/issues/38236)
OWASP/CheatSheetSeries#376 (comment)
https://github.com/OWASP/CheatSheetSeries/issues/376#issuecomment-602663932
Suggest remove vs. "0"
https://github.com/helmetjs/helmet/issues/230#issuecomment-614106165
X-XSS-Protection header has been deprecated
https://owasp.org/www-project-secure-headers/#x-xss-protection
https://github.com/owncloud/core/issues/38236
https://github.com/owncloud/core/pull/38305
* Change - Update symfony/polyfill (1.20.0 => 1.22.1): [#38275](https://github.com/owncloud/core/pull/38275)
The following symfony/polyfill components have been updated to version 1.22.1:
Symfony/polyfill-ctype symfony/polyfill-iconv symfony/polyfill-intl-idn
symfony/polyfill-intl-normalizer symfony/polyfill-mbstring
symfony/polyfill-php72 symfony/polyfill-php73 symfony/polyfill-php80
https://github.com/owncloud/core/pull/38275
https://github.com/owncloud/core/pull/38419
* Change - Remove package patchwork/utf8: [#38286](https://github.com/owncloud/core/pull/38286)
https://github.com/owncloud/core/pull/38286
https://github.com/owncloud/core/pull/38315
* Change - Update Symfony components to 4.4.20: [#38462](https://github.com/owncloud/core/pull/38462)
The following Symfony components have been updated from 4.4.16 to 4.4.20 -
console - event-dispatcher - process - routing - translation
https://github.com/owncloud/core/pull/38462
https://github.com/owncloud/core/pull/38355
https://github.com/owncloud/core/pull/38234
https://github.com/owncloud/core/pull/38163
https://symfony.com/blog/symfony-4-4-20-released
https://symfony.com/blog/symfony-4-4-19-released
https://symfony.com/blog/symfony-4-4-18-released
https://symfony.com/blog/symfony-4-4-17-released
* Change - Update icewind/smb from 3.2.7 to 3.3.1 in files_external: [#38462](https://github.com/owncloud/core/pull/38462)
https://github.com/owncloud/core/pull/38462
* Enhancement - Context menu for files in case multiple actions apply: [#38132](https://github.com/owncloud/core/pull/38132)
When triggering the default action for a file which can be opened or edited with
more than one app, a new context menu is displayed. This menu will ask the user
with which app the corresponding file should be opened.
This also solves the problem with some apps which set themselves as default
without asking or even informing the user.
https://github.com/owncloud/enterprise/issues/4261
https://github.com/owncloud/core/pull/38132
* Enhancement - New external storage: SMB Collaborative (shared file IDs)): [#38151](https://github.com/owncloud/core/pull/38151)
This new external storage allows the shared use of SMB/CIFS shares among users.
Independent of the use all files and folders will have the same file id. This
allows better collaboration especially in the area of tagging, comments, private
links and any document collaboration like Office Online Server, Collabora and
OnlyOffice.
https://github.com/owncloud/core/pull/38151
* Enhancement - Allow mounting a subfolder from Google Drive: [#38161](https://github.com/owncloud/core/pull/38161)
You can now define a subfolder from your Google Drive when mounting. This gives
the ability to: subfolder = empty (like you have it without this enhancment)
subfolder = name subfolder = name/$user When using encryption, only the
subfolder when used gets encrypted.
https://github.com/owncloud/core/pull/38161
https://github.com/owncloud/core/pull/38192
* Enhancement - Make the right scrollbar more visible on the UI: [#38183](https://github.com/owncloud/core/pull/38183)
https://github.com/owncloud/core/pull/38183
The
scrollbar
has
been
made
wider
and
darker.
* Enhancement - Improve file list tag management: [#38197](https://github.com/owncloud/core/pull/38197)
1. Introduce a new tab, where the tag input field will be displayed 1.1 Keyboard
navigation in the input field's dropdown works now proper, in the past the user
needed to hover over on item in the dropdown before the arrow keys could be used
2. Replace the tag input field in the file list by a read only tag list 2.1
Improving tag appearance to clarify that these are tags and no shares 2.2
Clicking on a tag opens the tag tab 2.3 Tag tab and tag list are in sync, means
that editing (select, unselect, rename, remove) tags will appear in the tag list
immediately
https://github.com/owncloud/core/pull/38197
* Enhancement - Improve the UX in the external storage settings page: [#38288](https://github.com/owncloud/core/pull/38288)
When a user adds or edits an external storage, the user will see a notification
if the storage has been added or an error occured. When a user hovers over the
status indicator, the user will see a pointer cursor, this clarifies that a
click will result in a config (re-)check.
https://github.com/owncloud/core/pull/38288
* Enhancement - Prevent group assignment in Web UI if not supported: [#38298](https://github.com/owncloud/core/pull/38298)
This enhancement checks if users can be assigned to (or removed from) groups via
Web UI. All group backends which do not support this functionality will be
disabled in corresponding menus.
https://github.com/owncloud/guests/issues/431
https://github.com/owncloud/core/issues/38580
https://github.com/owncloud/core/pull/38298
* Enhancement - Display path in the occ app:list command: [#38309](https://github.com/owncloud/core/pull/38309)
Occ app:list Additionally displays the located app path
https://github.com/owncloud/core/pull/38309
* Enhancement - New config parameter to define the encrypted file format: [#38337](https://github.com/owncloud/core/pull/38337)
A new config parameter has been introduced to define if encrypted files are
written in the old or new format. The new format has a significant reduced
filesize and is set to default. Files in the old format are still readable, only
new encrypted files are written in the new format.
https://github.com/owncloud/core/pull/38337
https://github.com/owncloud/encryption/pull/224
* Enhancement - Display error/success message while changing the log level: [#38340](https://github.com/owncloud/core/pull/38340)
In order to provide instant user feedback, changing the log level in
settings->administration->general will display an error/success message next to
the select box.
https://github.com/owncloud/core/pull/38340
* Enhancement - Implement pre-signed download urls for public links: [#38376](https://github.com/owncloud/core/pull/38376)
Added pre-signed download urls for password protected public links to support
clients which don't use cookies.
https://github.com/owncloud/core/pull/38376
https://github.com/owncloud/core/pull/38532
* Enhancement - Allow force set DB patforms: [#38379](https://github.com/owncloud/core/pull/38379)
A new 'db.platform' option added to config.php. It allows using a specific
database platform and do not rely on autodetection.
https://github.com/owncloud/core/pull/38379
* Enhancement - Added additional connection parameters to redis config: [#38386](https://github.com/owncloud/core/pull/38386)
In order to provide redis SLL/TLS support a new section connection_parameters
added to redis and redis.cluster configuration in config.php. Requirements for
connection_parameters: php-redis extension >= 5.3.0 Requirements for redis
ssl/tls: redis server >= 6.0
https://github.com/owncloud/core/pull/38386
* Enhancement - Hide federated user suggestions if system users are found: [#38389](https://github.com/owncloud/core/pull/38389)
Hide federated user suggestions when sharing if system users are found. This
improves the usability of sharing resources with existing users via email
address.
https://github.com/owncloud/enterprise/issues/4392
https://github.com/owncloud/core/pull/38389
* Enhancement - Indicate existing guest-user as a guest in the share tab: [#38440](https://github.com/owncloud/core/pull/38440)
Previously, after sharing a file via email with a guest, enter the same email in
the tab view on another file, indicates the guest as a user. With this fix, we
will see guest instead of user.
https://github.com/owncloud/core/issues/38422
https://github.com/owncloud/core/pull/38440
* Enhancement - Add config parameter 'http.cookie.samesite': [#38458](https://github.com/owncloud/core/pull/38458)
Allows to relax ownClouds same site cookie settings. Possible values: Strict,
Lax or None Setting the same site cookie to none is necessary in case of OpenID
Connect.
https://github.com/owncloud/core/pull/38458
https://github.com/owncloud/core/pull/38477
* Enhancement - Add exception messages whenever a node cannot be moved: [#38481](https://github.com/owncloud/core/pull/38481)
https://github.com/owncloud/enterprise/issues/4427
https://github.com/owncloud/core/pull/38481
* Enhancement - UI improvement external storage: [#38483](https://github.com/owncloud/core/pull/38483)
When selecting external storage and set the auth mechanism to 'Log-in
credentials, save in session', the 'Enable sharing' option in the mount options
dropdown will be disabled and a tooltip will show up due to incompatibility.
https://github.com/owncloud/enterprise/issues/4444
https://github.com/owncloud/core/pull/38483
* Enhancement - Improve systemtags UI for delete and fix case sensitivity problem: [#38498](https://github.com/owncloud/core/pull/38498)
Previously, a system tag could be deleted within the rename step. Now, users can
delete tags directly from the system tags tab view dropdown menu. Also,
inconsistency on tag name casing has been fixed.
https://github.com/owncloud/core/issues/38494
https://github.com/owncloud/core/issues/38495
https://github.com/owncloud/core/issues/38496
https://github.com/owncloud/core/pull/38498
# Changelog for ownCloud Core [10.6.0] (2020-11-25)
The following sections list the changes in ownCloud core 10.6.0 relevant to
ownCloud admins and users.
[10.6.0]: https://github.com/owncloud/core/compare/v10.5.0...v10.6.0
## Summary
* Bugfix - OCS and Public WebDAV Apis should handle LoginException: [#112](https://github.com/owncloud/brute_force_protection/issues/112)
* Bugfix - Do not emit "share.failedpasswordcheck" events for authenticated links: [#138](https://github.com/owncloud/brute_force_protection/issues/138)
* Bugfix - Avoid retrieving user root iteratively in share controller: [#4107](https://github.com/owncloud/enterprise/issues/4107)
* Bugfix - Reshares using files:transfer-ownership cannot be transferred: [#4121](https://github.com/owncloud/enterprise/issues/4121)
* Bugfix - SSL check when adding a public link to your ownCloud: [#4241](https://github.com/owncloud/enterprise/issues/4241)
* Bugfix - Cleaning up `autocapitalize="off"` in files: [#15399](https://github.com/owncloud/core/issues/15399)
* Bugfix - Google Drive file modifications should not create duplicate files: [#25826](https://github.com/owncloud/core/issues/25826)
* Bugfix - Fix exit codes of security:certificates commands: [#35364](https://github.com/owncloud/core/issues/35364)
* Bugfix - Allow federated share name up to 255 character: [#36730](https://github.com/owncloud/core/issues/36730)
* Bugfix - Translate public link sharing email subject: [#37321](https://github.com/owncloud/core/issues/37321)
* Bugfix - Fix problem with the market app installing an app using OpenIDConnect: [#37715](https://github.com/owncloud/core/pull/37715)
* Bugfix - Fix federated share accepting problem which occurs with some apps enabled: [#37719](https://github.com/owncloud/core/issues/37719)
* Bugfix - Fix expiring a wrong share entry problem: [#37729](https://github.com/owncloud/core/pull/37729)
* Bugfix - Fix decoding of calendars uri: [#37750](https://github.com/owncloud/core/pull/37750)
* Bugfix - Add openid client secret to the sensitive values list: [#37782](https://github.com/owncloud/core/pull/37782)
* Bugfix - Show all shares in the "shared with you" section: [#37786](https://github.com/owncloud/core/pull/37786)
* Bugfix - Prevent server error when loading invalid/corrupt translations: [#37799](https://github.com/owncloud/core/issues/37799)
* Bugfix - "Passwords do not match" message was not being translated: [#37826](https://github.com/owncloud/core/pull/37826)
* Bugfix - Fix application id used for sharing settings translation: [#37846](https://github.com/owncloud/core/pull/37846)
* Bugfix - Add metrics shared secret to the sensitive values list: [#37848](https://github.com/owncloud/core/pull/37848)
* Bugfix - Fix list of apps returned by OCS Provisioning API apps endpoint: [#37884](https://github.com/owncloud/core/issues/37884)
* Bugfix - Add very minimal empty ODF files: [#37896](https://github.com/owncloud/core/pull/37896)
* Bugfix - Checksums will be kept when a file is uploaded or a version is created: [#37934](https://github.com/owncloud/core/pull/37934)
* Bugfix - Fix invisible notification container blocking mouse events: [#37941](https://github.com/owncloud/core/pull/37941)
* Bugfix - Fix display of public link shares in case avatars are disabled: [#37945](https://github.com/owncloud/core/pull/37945)
* Bugfix - Clean the user's preferences only if they exist during user sync: [#37947](https://github.com/owncloud/core/pull/37947)
* Bugfix - Properly exit and log during error in user sync command: [#37951](https://github.com/owncloud/core/pull/37951)
* Bugfix - Add a configurable number of retries on unsuccessful mountpoint move: [#37956](https://github.com/owncloud/core/pull/37956)
* Bugfix - Fix icon alignment when avatars are disabled: [#37964](https://github.com/owncloud/core/pull/37964)
* Bugfix - Fix file target in the accept share API call: [#37973](https://github.com/owncloud/core/pull/37973)
* Bugfix - Fix for Google Docs not syncing with error "server reported no size": [#37997](https://github.com/owncloud/core/issues/37997)
* Bugfix - Fix request token check for ocs requests: [#38019](https://github.com/owncloud/core/pull/38019)
* Bugfix - Fix logging when loading an apps fails: [#38037](https://github.com/owncloud/core/pull/38037)
* Bugfix - Properly handle StorageNotAvailableException in share external: [#38042](https://github.com/owncloud/core/pull/38042)
* Bugfix - Pick the translations from templates included from other apps: [#38072](https://github.com/owncloud/core/pull/38072)
* Bugfix - Override browser Accept-Language header in ajax requests: [#38073](https://github.com/owncloud/core/pull/38073)
* Bugfix - Only allow http/https protocol on CORS: [#38101](https://github.com/owncloud/core/pull/38101)
* Bugfix - Fix translations of some strings in settings: [#38119](https://github.com/owncloud/core/pull/38119)
* Change - Update deepdiver/zipstreamer (1.1.1 => 2.0.0): [#37159](https://github.com/owncloud/core/issues/37159)
* Change - Update sabre dependencies: [#37684](https://github.com/owncloud/core/pull/37684)
* Change - Update google/apiclient from 2.5.0 to 2.6.0 and related dependencies: [#37687](https://github.com/owncloud/core/pull/37687)
* Change - Update symfony/polyfill (1.17.0 => 1.18.0): [#37694](https://github.com/owncloud/core/pull/37694)
* Change - Update icewind/smb from 3.2.5 to 3.2.6 in files_external: [#37712](https://github.com/owncloud/core/pull/37712)
* Change - Add settings checkbox to enable manual file locking: [#37720](https://github.com/owncloud/core/pull/37720)
* Change - Update Symfony components to 4.4.11: [#37727](https://github.com/owncloud/core/pull/37727)
* Change - Update league/flysystem (1.0.69 => 1.0.70): [#37730](https://github.com/owncloud/core/pull/37730)
* Change - Make core/signature.json and core/skeleton/ inaccessible: [#37734](https://github.com/owncloud/core/issues/37734)
* Change - Update google/apiclient from 2.6.0 to 2.7.0 and related dependencies: [#37739](https://github.com/owncloud/core/pull/37739)
* Change - Add values to the invalid uid list: [#37765](https://github.com/owncloud/core/issues/37765)
* Change - Update doctrine/event-manager (1.1.0 => 1.1.1): [#37768](https://github.com/owncloud/core/pull/37768)
* Change - Update symfony/polyfill (1.18.0 => 1.18.1): [#37772](https://github.com/owncloud/core/pull/37772)
* Change - Update egulias/email-validator (2.1.18 => 2.1.19): [#37790](https://github.com/owncloud/core/pull/37790)
* Change - Update opis/closure (3.5.5 => 3.5.6): [#37804](https://github.com/owncloud/core/pull/37804)
* Change - Add system config to load a different license implementation: [#37827](https://github.com/owncloud/core/pull/37827)
* Change - Update laminas/laminas-zendframework-bridge (1.0.4 => 1.1.0): [#37843](https://github.com/owncloud/core/pull/37843)
* Change - Use a debug log level if a share download is aborted: [#37856](https://github.com/owncloud/core/pull/37856)
* Change - Update Symfony components to 4.4.12: [#37862](https://github.com/owncloud/core/pull/37862)
* Change - Update doctrine/dbal (2.10.2 => 2.10.3): [#37870](https://github.com/owncloud/core/pull/37870)
* Change - Update Symfony components to 4.4.13: [#37876](https://github.com/owncloud/core/pull/37876)
* Change - Update opis/closure (3.5.6 => 3.5.7): [#37892](https://github.com/owncloud/core/pull/37892)
* Change - Update egulias/email-validator (2.1.19 => 2.1.20): [#37892](https://github.com/owncloud/core/pull/37892)
* Change - Update phpseclib/phpseclib (2.0.28 => 2.0.29): [#37893](https://github.com/owncloud/core/pull/37893)
* Change - Update icewind/smb from 3.2.6 to 3.2.7 in files_external: [#37894](https://github.com/owncloud/core/pull/37894)
* Change - Update doctrine/dbal (2.10.3 => 2.10.4): [#37904](https://github.com/owncloud/core/pull/37904)
* Change - Update symfony/translation-contracts (v1.1.9 => v1.1.10): [#37904](https://github.com/owncloud/core/pull/37904)
* Change - Reduce the log level of locked exceptions: [#37907](https://github.com/owncloud/core/pull/37907)
* Change - Update google/apiclient from 2.7.0 to 2.7.1 and related dependencies: [#37912](https://github.com/owncloud/core/pull/37912)
* Change - Update sabre/event (5.1.0 => 5.1.1): [#37921](https://github.com/owncloud/core/pull/37921)
* Change - Update laminas/laminas-zendframework-bridge (1.1.0 => 1.1.1): [#37921](https://github.com/owncloud/core/pull/37921)
* Change - New defaults for phoenix app switcher icon and label: [#37923](https://github.com/owncloud/core/pull/37923)
* Change - Update pear/archive_tar (1.4.9 => 1.4.10): [#37926](https://github.com/owncloud/core/pull/37926)
* Change - Update egulias/email-validator (2.1.20 => 2.1.21): [#37926](https://github.com/owncloud/core/pull/37926)
* Change - Update egulias/email-validator (2.1.21 => 2.1.22): [#37949](https://github.com/owncloud/core/pull/37949)
* Change - Update Symfony components to 4.4.14: [#37949](https://github.com/owncloud/core/pull/37949)
* Change - Add command to troubleshoot transfer ownership runs for issues: [#37950](https://github.com/owncloud/core/pull/37950)
* Change - DropOldTables repair job won't show a progress bar: [#37953](https://github.com/owncloud/core/pull/37953)
* Change - Update sabre dependencies: [#37975](https://github.com/owncloud/core/pull/37975)
* Change - Update Symfony components to 4.4.15: [#37975](https://github.com/owncloud/core/pull/37975)
* Change - Update opis/closure (3.5.7 => 3.6.0): [#38004](https://github.com/owncloud/core/pull/38004)
* Change - Update symfony/polyfill (1.18.1 => 1.19.0): [#38032](https://github.com/owncloud/core/pull/38032)
* Change - Update symfony/polyfill (1.19.0 => 1.20.0): [#38033](https://github.com/owncloud/core/pull/38033)
* Change - Update google/apiclient from 2.7.1 to 2.8.0 and related dependencies: [#38043](https://github.com/owncloud/core/pull/38043)
* Change - Update dg/composer-cleaner (v2.1 => v2.2): [#38044](https://github.com/owncloud/core/pull/38044)
* Change - Update Symfony components to 4.4.16: [#38046](https://github.com/owncloud/core/pull/38046)
* Change - Update egulias/email-validator (2.1.22 => 2.1.23): [#38061](https://github.com/owncloud/core/pull/38061)
* Change - Update sabre/vobject (4.3.2 => 4.3.3): [#38091](https://github.com/owncloud/core/pull/38091)
* Change - Update opis/closure (3.6.0 => 3.6.1): [#38091](https://github.com/owncloud/core/pull/38091)
* Change - Update sabre/dav (4.1.2 => 4.1.3): [#38092](https://github.com/owncloud/core/pull/38092)
* Change - Update egulias/email-validator (2.1.23 => 2.1.24): [#38116](https://github.com/owncloud/core/pull/38116)
* Change - Update pear/archive_tar (1.4.10 => 1.4.11): [#38137](https://github.com/owncloud/core/pull/38137)
* Change - Rename phoenix to web: [#38199](https://github.com/owncloud/core/pull/38199)
* Enhancement - Cleanup encryption config values on disabling encryption: [#35980](https://github.com/owncloud/core/pull/35980)
* Enhancement - Add support for date expiration on remote shares: [#37548](https://github.com/owncloud/core/pull/37548)
* Enhancement - Support pre-signed urls: [#37634](https://github.com/owncloud/core/pull/37634)
* Enhancement - Add capability for the favorite files feature: [#37673](https://github.com/owncloud/core/pull/37673)
* Enhancement - Add Support for SGI Image Previews: [#37758](https://github.com/owncloud/core/pull/37758)
* Enhancement - Allow getting the share list filtered by share type via API: [#38000](https://github.com/owncloud/core/pull/38000)
* Enhancement - GetShare API request's "subfiles" parameter allows new interactions: [#38053](https://github.com/owncloud/core/pull/38053)
* Enhancement - Add new method in the PHP API interface: [#38054](https://github.com/owncloud/core/pull/38054)
## Details
* Bugfix - OCS and Public WebDAV Apis should handle LoginException: [#112](https://github.com/owncloud/brute_force_protection/issues/112)
OCS api and new public webdav api was not handle LoginException. This situation
was causing HTTP 500 error in response. This bug has been resolved.
https://github.com/owncloud/brute_force_protection/issues/112
https://github.com/owncloud/core/pull/37948
* Bugfix - Do not emit "share.failedpasswordcheck" events for authenticated links: [#138](https://github.com/owncloud/brute_force_protection/issues/138)
ShareManager was checking password of already authenticated public links. This
situation led to wrong "share.failedpasswordcheck" events emitting in already
authenticated links. This problem has been resolved by first checking link
already authenticated.
https://github.com/owncloud/brute_force_protection/issues/138
https://github.com/owncloud/core/pull/38016
* Bugfix - Avoid retrieving user root iteratively in share controller: [#4107](https://github.com/owncloud/enterprise/issues/4107)
There was a performance problem that with many shares, the "share tab" was slow
to display entries. Now the performance of displaying that tab should be better
as we avoid retrieving the same information for all the shares
https://github.com/owncloud/enterprise/issues/4107
https://github.com/owncloud/core/pull/38055
* Bugfix - Reshares using files:transfer-ownership cannot be transferred: [#4121](https://github.com/owncloud/enterprise/issues/4121)
Received shares that have been reshared further now will not be transferred
using files:transfer-ownership. Fixes issue with mismatching ownership after
executing transfer.
https://github.com/owncloud/enterprise/issues/4121
https://github.com/owncloud/core/pull/37791
* Bugfix - SSL check when adding a public link to your ownCloud: [#4241](https://github.com/owncloud/enterprise/issues/4241)
Prior to this fix, a SSL certificate check was performed when adding a public
link to your ownCloud. As this check was done on the base URL of the server, it
could cause some issues, for example endless redirect loops. This fix gets rid
of the SSL check because the storage-check afterwards also checks the validity
of the server's SSL certificate. This check is being made on /status.php, thus
it likely wont end up in a redirect loop.
https://github.com/owncloud/enterprise/issues/4241
https://github.com/owncloud/core/pull/38107
* Bugfix - Cleaning up `autocapitalize="off"` in files: [#15399](https://github.com/owncloud/core/issues/15399)
All instances of deprecated `autocapitalize="off"` HTML attributes were replaced
with `autocapitalize="none"` in the parent