Commit Graph

1503 Commits

Author SHA1 Message Date
Dionisio Pozo e71ef59a04 Merge pull request #571 from EdouardVanbelle/fix/cached-elements
fix(front): unregister cache prio to 0.8.0
2026-07-13 09:36:51 +02:00
Dionisio Pozo 22e09c09be Merge pull request #538 from swissiety/webdav-litmus-compliance
implement dead properties for nextcloud handler and fixup frontend migration leftover
2026-07-13 09:36:43 +02:00
Dionisio Pozo 8301e0c2cb Merge pull request #569 from EdouardVanbelle/feat/grants-cleanup
feat(grant): clean up expired grants
2026-07-13 09:36:29 +02:00
M.Schmidt 7011fdff5a Merge origin/main into webdav-litmus-compliance 2026-07-12 22:25:12 +02:00
Edouard Vanbelle f4d2a7cd61 fix(front): unregister cache prio to 0.8.0
this fix issue https://github.com/AtalayaLabs/OxiCloud/issues/560

    previous version where caching assets, now sveltekit is fully autonomous,
    use a sw.js that clears the cache and unregisters it self
2026-07-12 22:02:11 +02:00
Edouard Vanbelle b6df05f4d8 refactor: rustc 1.97.0 (useless borrows in formatting) 2026-07-12 18:53:39 +02:00
Edouard Vanbelle ba620166ee feat(grant): clean up expired grants 2026-07-12 18:37:13 +02:00
Dionisio Pozo 968c768dd4 Merge pull request #567 from moduvoice/i18n/complete-korean
i18n: complete Korean (ko) locale
2026-07-12 17:13:09 +02:00
moduvoice a3801f5836 i18n: complete Korean (ko) locale
The ko.json locale existed but was missing 377 of 1392 keys (~27%),
covering entire feature areas added since the initial translation:
admin plugin management, storage/OIDC/SMTP settings, photos, music
playlists, device pairing, search filters, share dialogs, and more.

Filled in all missing keys with natural Korean translations matching
the existing tone and terminology in the file (파일/폴더/공유/업로드
등), verified full key parity with en.json (1392/1392) and matching
{{placeholder}} interpolation tokens on every translated string.
2026-07-11 23:10:35 +07:00
Dionisio Pozo 9ed360443a Merge pull request #531 from illogic-al/fix/pdf-extract-panic-abort 2026-07-09 21:36:43 +02:00
Dionisio Pozo b4c0915bd3 Merge pull request #562 from EdouardVanbelle/fix/front-from-legacy
restore frontend features from legacy
2026-07-08 19:00:16 +02:00
Dionisio Pozo b22ba4a26a Merge pull request #563 from EdouardVanbelle/feat/music-authz 2026-07-08 15:00:03 +02:00
Dionisio Pozo faac580c70 Merge pull request #553 from EdouardVanbelle/feat/caldav-carddav-to-authz 2026-07-08 14:59:47 +02:00
Dionisio Pozo 7fb14efa79 Merge pull request #564 from EdouardVanbelle/chore/bump+security 2026-07-08 14:59:20 +02:00
Edouard Vanbelle 75f067acf5 test(contact+calendar): cover grants tests 2026-07-08 01:04:03 +02:00
Edouard Vanbelle c1e46910b0 feat(music): move playlist to authz engine 2026-07-08 01:04:03 +02:00
Edouard Vanbelle 57bea52125 test(calendar,addressbook): correct test 2026-07-08 01:03:25 +02:00
Edouard Vanbelle 28108fe8b2 feat(calendar,addressbook): remove share tables 2026-07-08 01:03:25 +02:00
Edouard Vanbelle 0e341758af feat(calendar,addressbook): remove old sharing code 2026-07-08 01:03:25 +02:00
Edouard Vanbelle a2ad7757c3 feat(calendar,addressbook): add tests for authz 2026-07-08 01:03:25 +02:00
Edouard Vanbelle 0fcd617fd1 feat(calendar,addressbook): migrate share to authz engine
migrate DB entries to authz engine
    and wire authz engine to caldav and carddav
2026-07-08 01:03:25 +02:00
Edouard Vanbelle b5881c7114 feat(calendar,addressbook): prepare authz engine 2026-07-08 01:03:25 +02:00
Edouard Vanbelle 484f933f77 security: bump crossbeam-epoch to fix security audit
RUSTSEC-2026-0204
2026-07-08 01:01:27 +02:00
Edouard Vanbelle ddb6cf3f5d chore: bump OxiCloud to 0.8.2 to reflect git tag 2026-07-08 01:01:27 +02:00
Dionisio Pozo b9d0b569ba Merge pull request #561 from EdouardVanbelle/fix/front-user-change 2026-07-07 22:06:24 +02:00
Edouard Vanbelle 0e71eeb58a fix(thumbnail): restore thumb gen PDD|img|video
client can generate thumbnail for PDF, image, video if not found
    2 cases:
        - offload CPU to client side
        - permit E2EE (encryption)
2026-07-07 21:58:34 +02:00
Edouard Vanbelle bc756ae8f9 fix(favicon): restore favicon from legacy front 2026-07-07 21:54:54 +02:00
Edouard Vanbelle e4ff1f2d86 fix(frontent): ensure API is called once
sveltekit was doing 3x API call to draw the page
2026-07-07 21:54:54 +02:00
Edouard Vanbelle 3108fed228 fix(front): clean localStorage on user change
- fix issue with selected drive and user logout/login via another user
    (was raising a "404 not found")
    - normalize all localStorage to "oxi-" prefix
    - add a specific frontend/AGENTS.md for frontend part (stop increasing the global AGENTS.md)
2026-07-07 21:37:00 +02:00
Dionisio Pozo 4fb2acf160 Merge pull request #557 from EdouardVanbelle/fix/webdav-drive 2026-07-06 23:40:52 +02:00
Edouard Vanbelle f7deb7aaf4 fix(authz): invalidate role cache on change 2026-07-06 23:07:49 +02:00
Edouard Vanbelle 79f4792709 fix(quota): pre-check quota for COPY/MOVE
check qouta for a cross drive MOVE
    check quota for a COPY
2026-07-06 22:14:50 +02:00
Edouard Vanbelle 7e34045ff8 feat(drive): fix webdav back-compat
add env variable `OXICLOUD_WEBDAV_DRIVE_LISTING_PREFIX`
    which is by default:
    `OXICLOUD_WEBDAV_DRIVE_LISTING_PREFIX="@drive"`

    so `/webdav/` -> points to user's personal drive (**backward compatibilit**y)
    `/web/dav/@drive/{uuid|drive name}/` points to the respective drive

    if admins want directly `/webdav/` pointing to list of drives they need to:
    `OXICLOUD_WEBDAV_DRIVE_LISTING_PREFIX=""`

    + ensure lock is per user (RFC 4918 §9.11)

    fix: #554
2026-07-06 22:14:50 +02:00
Dionisio Pozo 3d74bed326 Merge pull request #549 from Candinya/fix/docker-publish-ci-fail
fix(ci): workflow fail caused by uppercase of image name
2026-07-06 18:12:04 +02:00
Dionisio Pozo ed61dc08aa Merge pull request #552 from steel97/fix/ui
fix(ui): token revoke buttons on light theme, nextcloud login page
2026-07-06 08:58:41 +02:00
Ivan Yv 0b33ed7b2b fix(ui): token revoke buttons on light theme, nextcloud login page 2026-07-06 07:25:00 +03:00
Dionisio Pozo 1f35200b15 Merge pull request #551 from EdouardVanbelle/security/authz 2026-07-06 00:03:03 +02:00
Edouard Vanbelle 0870990e1b fix(locale): correct IT i18n 2026-07-05 23:31:48 +02:00
Edouard Vanbelle 75601beb43 security(wopi): add authz to Wopi 2026-07-05 23:31:44 +02:00
Edouard Vanbelle 1786fe4111 security(nextcloud): chroot-aware display paths + recent race fix
strip_chroot_prefix replaces the hardcoded "Personal/" strip
    in NC trashbin PROPFIND, OCS unified search, and REPORT
    (favorites + search). Handles composed chroots, drops
    cross-chroot items instead of surfacing malformed paths, and
    fixes the leading-slash mismatch (FolderDto path has '/', DB
    paths don't) that silently dropped every NC trashbin item
    post-D3. OCS keeps a first-segment fallback (results
    legitimately span drives, no single chroot).

    uploads_handler switches to nc_to_internal_path(chroot, …)
    for the two remaining hardcoded "Personal/" sites, closing
    the D1 TODO markers.

    RecentService::record_item_access is split from a new
    record_item_access_internal (no authz) used by
    RecentRecordingHook. Round 1's authz.require widened the
    tokio::spawn race past tests/api/recent.hurl step 7; the
    internal path skips the redundant Read gate — upstream
    _with_perms already enforced it.

    Tests: 8 unit tests pin strip_chroot_prefix (leading slash,
    composed chroots, sibling-leak rejection, partial-prefix,
    empty-chroot). drives_membership.hurl step 21b/22b cover
    Editor upload → 201 / Viewer upload → 404 fresh + overwrite
    with fixture cleanup at 30c. test_nc_move_copy_delete_trash
    K1 pins the actual original-location value.
2026-07-05 22:53:05 +02:00
Edouard Vanbelle 0342bae300 security(nextcloud): add authz to PUT verb 2026-07-05 22:53:05 +02:00
Edouard Vanbelle b95e740b2f security(music): ensure read permission via authz 2026-07-05 22:53:05 +02:00
Edouard Vanbelle 2cda8e7e22 security(favorite,recent): ensure read permission 2026-07-05 22:53:05 +02:00
Edouard Vanbelle cf5423b723 security(public link): require share permission
issue was: a user can reshare publicly a resource
    on owner revocation, the attacker keep it's own share
    request now share permission
2026-07-05 22:53:05 +02:00
Edouard Vanbelle f115fed5a6 feat(drive): cleanup of useless owner_id 2026-07-05 22:53:05 +02:00
Nya Candy ce10b83b64 chore: add quote to prevent possible yaml parse error 2026-07-05 23:36:06 +08:00
Nya Candy 3fdd2eaf1c fix: workflow fail caused by uppercase of image name 2026-07-05 23:18:01 +08:00
Dionisio Pozo 025045e4af Merge pull request #547 from albanobattistella/main 2026-07-05 13:58:59 +02:00
albanobattistella bde40c6042 Update Italian translation 2026-07-05 13:49:59 +02:00
Dionisio Pozo af07cab673 Merge pull request #546 from Candinya/feat/publish-to-ghcr
feat(ci): also publish docker image to ghcr
2026-07-05 08:10:30 +02:00