merge back Release/10.12.2

.drone.star

@@ -285,7 +285,7 @@ config = {
                 "cliEncryption",
             ],
             "extraApps": {
-                "encryption": "composer install",
+                "encryption": "git checkout v1.5.3; composer install",
             },
             "testingRemoteSystem": False,
             "extraSetup": [{
@@ -294,6 +294,8 @@ config = {
                 "commands": [
                     "php occ maintenance:singleuser --on",
                     "php occ encryption:enable",
+                    "php occ app:list encryption",
+                    "php occ encryption:select-encryption-type masterkey --yes",
                     "php occ encryption:encrypt-all --yes",
                     "php occ encryption:status",
                     "php occ maintenance:singleuser --off",

apps/dav/lib/Connector/Sabre/Node.php

@@ -220,7 +220,7 @@ public function setETag($etag) {
 	 * size because the actual size value isn't returned by google. This function
 	 * will return null in this case)
 	 *
-	 * @return integer|null
+	 * @return integer|float|null
 	 */
 	public function getSize() {
 		$size = $this->info->getSize();

apps/dav/lib/Connector/Sabre/QuotaPlugin.php

@@ -179,8 +179,8 @@ public function handleBeforeCreateFile($uri, $data, $parent, $modified) {
 	 * This method is called before any HTTP method and validates there is enough free space to store the file
 	 *
 	 * @param string $path path of the user's home
-	 * @param int $length size to check whether it fits
-	 * @param int $extraSpace additional space granted, usually used when overwriting files
+	 * @param int|float $length size to check whether it fits
+	 * @param int|float $extraSpace additional space granted, usually used when overwriting files
 	 * @throws InsufficientStorage
 	 * @return bool
 	 */
@@ -204,25 +204,20 @@ public function checkQuota($path, $length = null, $extraSpace = 0) {
 				$path = \rtrim($parentPath, '/') . '/' . $info['name'];
 			}
 			$freeSpace = $this->getFreeSpace($path);
-			// workaround to guarantee compatibility on 32-bit systems as otherwise this would cause an int overflow on such systems
-			// when $freeSpace is above the max supported value. $freeSpace should be a float so we are using the <= 0.0 comparison
-			if (PHP_INT_SIZE === 4) {
-				$availableSpace = $freeSpace + $extraSpace;
-				if ($freeSpace !== FileInfo::SPACE_UNKNOWN && $freeSpace !== FileInfo::SPACE_UNLIMITED && (($length > $availableSpace) || ($availableSpace <= 0.0))) {
-					if (isset($chunkHandler)) {
-						$chunkHandler->cleanup();
-					}
-					throw new InsufficientStorage();
-				}
-			} else {
-				// freeSpace might be false, or an int. Anyway, make sure that availableSpace will be an int.
-				$availableSpace = (int) $freeSpace + $extraSpace;
-				if ($freeSpace !== FileInfo::SPACE_UNKNOWN && $freeSpace !== FileInfo::SPACE_UNLIMITED && (($length > $availableSpace) || ($availableSpace === 0))) {
-					if (isset($chunkHandler)) {
-						$chunkHandler->cleanup();
-					}
-					throw new InsufficientStorage();
+			if ($freeSpace === false) {
+				$freeSpace = 0;
+			}
+			// There could be cases where both $freeSpace and $extraSpace are floats:
+			// * $freeSpace could come from local storage, which calls disk_free_space, which returns float
+			// * $extraSpace could come from the DB. "size" column is bigint, which is returned as string. The storage
+			// cache uses `0 + $data['size']` where the $data['size'] should be a string, which should return an int if
+			// the result fits inside, but it could also be a float if it doesn't (more likely in 32 bits)
+			$availableSpace = $freeSpace + $extraSpace;
+			if ($freeSpace !== FileInfo::SPACE_UNKNOWN && $freeSpace !== FileInfo::SPACE_UNLIMITED && (($length > $availableSpace) || ($availableSpace <= 0.0))) {
+				if (isset($chunkHandler)) {
+					$chunkHandler->cleanup();
 				}
+				throw new InsufficientStorage();
 			}
 		}
 		return true;

apps/dav/lib/Upload/ChunkingPlugin.php

@@ -98,6 +98,7 @@ private function verifySize() {
 			return;
 		}
 		$actualSize = $this->sourceNode->getSize();
+		// $actualSize could be either an int or a float
 		if ($expectedSize != $actualSize) {
 			throw new BadRequest("Chunks on server do not sum up to $expectedSize but to $actualSize");
 		}

apps/federatedfilesharing/lib/AppInfo/Application.php

@@ -148,16 +148,7 @@ function ($c) use ($server) {
 		$container->registerService(
 			'NotificationManager',
 			function ($c) {
-				return new NotificationManager(
-					$c->query('Permissions')
-				);
-			}
-		);
-
-		$container->registerService(
-			'Permissions',
-			function ($c) {
-				return new Permissions();
+				return new NotificationManager();
 			}
 		);
 
@@ -208,9 +199,7 @@ protected function initFederatedShareProvider() {
 			\OC::$server->getMemCacheFactory(),
 			\OC::$server->getHTTPClientService()
 		);
-		$notificationManager = new NotificationManager(
-			new Permissions()
-		);
+		$notificationManager = new NotificationManager();
 		$notifications = new Notifications(
 			$addressHandler,
 			\OC::$server->getHTTPClientService(),

apps/federatedfilesharing/lib/FedShareManager.php

@@ -69,11 +69,6 @@ class FedShareManager {
 	 */
 	private $addressHandler;
 
-	/**
-	 * @var Permissions
-	 */
-	private $permissions;
-
 	/**
 	 * @var EventDispatcherInterface
 	 */
@@ -88,7 +83,6 @@ class FedShareManager {
 	 * @param ActivityManager $activityManager
 	 * @param NotificationManager $notificationManager
 	 * @param AddressHandler $addressHandler
-	 * @param Permissions $permissions
 	 * @param EventDispatcherInterface $eventDispatcher
 	 */
 	public function __construct(
@@ -98,7 +92,6 @@ public function __construct(
 		ActivityManager $activityManager,
 		NotificationManager $notificationManager,
 		AddressHandler $addressHandler,
-		Permissions $permissions,
 		EventDispatcherInterface $eventDispatcher
 	) {
 		$this->federatedShareProvider = $federatedShareProvider;
@@ -107,7 +100,6 @@ public function __construct(
 		$this->activityManager = $activityManager;
 		$this->notificationManager = $notificationManager;
 		$this->addressHandler = $addressHandler;
-		$this->permissions = $permissions;
 		$this->eventDispatcher = $eventDispatcher;
 	}
 
@@ -316,7 +308,7 @@ public function undoReshare(IShare $share) {
 	 * @return void
 	 */
 	public function updateOcmPermissions(IShare $share, $ocmPermissions) {
-		$permissions = $this->permissions->toOcPermissions($ocmPermissions);
+		$permissions = Permissions::toOcPermissions($ocmPermissions);
 		$this->updatePermissions($share, $permissions);
 	}
 
@@ -328,8 +320,9 @@ public function updateOcmPermissions(IShare $share, $ocmPermissions) {
 	 *
 	 * @return void
 	 */
-	public function updatePermissions(IShare $share, $permissions) {
-		if ($share->getPermissions() !== $permissions) {
+	public function updatePermissions(IShare $share, int $permissions): void {
+		# permissions can only be reduced but not upgraded
+		if (Permissions::isNewPermissionHigher($share->getPermissions(), $permissions)) {
 			$share->setPermissions($permissions);
 			$this->federatedShareProvider->update($share);
 		}

apps/federatedfilesharing/lib/Ocm/NotificationManager.php

@@ -29,20 +29,6 @@
  * @package OCA\FederatedFileSharing\Ocm
  */
 class NotificationManager {
-	/**
-	 * @var Permissions
-	 */
-	protected $permissions;
-
-	/**
-	 * NotificationManager constructor.
-	 *
-	 * @param Permissions $permissions
-	 */
-	public function __construct(Permissions $permissions) {
-		$this->permissions = $permissions;
-	}
-
 	/**
 	 * @param string $type
 	 *
@@ -87,7 +73,7 @@ public function convertToOcmFileNotification($remoteId, $token, $action, $data =
 		$notification->addNotificationData('message', $messages[$action]);
 
 		if ($action === 'permissions') {
-			$ocmPermissions = $this->permissions->toOcmPermissions($data['permissions']);
+			$ocmPermissions = Permissions::toOcmPermissions($data['permissions']);
 			$notification->addNotificationData('permission', $ocmPermissions);
 		}
 

apps/federatedfilesharing/lib/Ocm/Permissions.php

@@ -40,11 +40,11 @@ class Permissions {
 	 *
 	 * @return array
 	 */
-	public function toOcmPermissions($ocPermissions) {
+	public static function toOcmPermissions(int $ocPermissions): array {
 		$ocPermissions = (int) $ocPermissions;
 		$ocmPermissions = [];
 		if ($ocPermissions & Constants::PERMISSION_READ) {
-			$ocmPermissions[] = self::OCM_PERMISSION_READ . '';
+			$ocmPermissions[] = self::OCM_PERMISSION_READ;
 		}
 		if (($ocPermissions & Constants::PERMISSION_CREATE)
 			|| ($ocPermissions & Constants::PERMISSION_UPDATE)
@@ -62,7 +62,7 @@ public function toOcmPermissions($ocPermissions) {
 	 *
 	 * @return int
 	 */
-	public function toOcPermissions($ocmPermissions) {
+	public static function toOcPermissions(array $ocmPermissions): int {
 		$permissionMap = [
 			self::OCM_PERMISSION_READ => Constants::PERMISSION_READ,
 			self::OCM_PERMISSION_WRITE => Constants::PERMISSION_CREATE + Constants::PERMISSION_UPDATE,
@@ -77,4 +77,8 @@ public function toOcPermissions($ocmPermissions) {
 
 		return $ocPermissions;
 	}
+
+	public static function isNewPermissionHigher(int $existingPermission, int $newPermission): bool {
+		return ($existingPermission | $newPermission) === $existingPermission;
+	}
 }

apps/federatedfilesharing/tests/Controller/RequestHandlerTest.php

@@ -447,6 +447,7 @@ public function testUpdatePermissions() {
 		$this->ocmMiddleware->expects($this->once())
 			->method('getValidShare')
 			->willReturn($share);
+		$this->ocmMiddleware->method('normalizePermissions')->willReturnArgument(0);
 		$this->fedShareManager->expects($this->once())
 			->method('isFederatedReShare')
 			->willReturn(true);

apps/federatedfilesharing/tests/FedShareManagerTest.php

@@ -64,9 +64,6 @@ class FedShareManagerTest extends TestCase {
 	/** @var AddressHandler | \PHPUnit\Framework\MockObject\MockObject */
 	private $addressHandler;
 
-	/** @var Permissions | \PHPUnit\Framework\MockObject\MockObject */
-	private $permissions;
-
 	/** @var EventDispatcherInterface | \PHPUnit\Framework\MockObject\MockObject */
 	private $eventDispatcher;
 
@@ -87,8 +84,6 @@ protected function setUp(): void {
 		$this->addressHandler = $this->getMockBuilder(AddressHandler::class)
 			->disableOriginalConstructor()->getMock();
 
-		$this->permissions = $this->createMock(Permissions::class);
-
 		$this->eventDispatcher = $this->getMockBuilder(EventDispatcherInterface::class)
 			->getMock();
 
@@ -101,7 +96,6 @@ protected function setUp(): void {
 					$this->activityManager,
 					$this->notificationManager,
 					$this->addressHandler,
-					$this->permissions,
 					$this->eventDispatcher
 				]
 			)
@@ -298,4 +292,31 @@ public function testIsFederatedReShare() {
 			$isFederatedShared
 		);
 	}
+
+	public function providesPermissions(): \Generator {
+		$read = Permissions::toOcPermissions(['read']);
+		$readWrite = Permissions::toOcPermissions(['read', 'write']);
+		$readShare = Permissions::toOcPermissions(['read', 'share']);
+		$readWriteShare = Permissions::toOcPermissions(['read', 'write', 'share']);
+
+		yield 'read -> write is not allowed' => [$read, $readWrite, false];
+		yield 'write -> read is allowed' => [$readWrite, $read, true];
+		yield 'read+share -> write is not allowed' => [$readShare, $readWrite, false];
+		yield 'write+share -> read is allowed' => [$readWriteShare, $read, true];
+	}
+
+	/**
+	 * @dataProvider providesPermissions
+	 */
+	public function testGrantingHigherPermission(int $currentPermissions, int $newPermissions, bool $allowed): void {
+		$share = $this->getMockBuilder(IShare::class)
+			->disableOriginalConstructor()->getMock();
+		$share->method('getPermissions')->willReturn($currentPermissions);
+
+		$this->federatedShareProvider->expects($allowed ? $this->once() : $this->never())
+			->method('update')
+			->with($share);
+
+		$this->fedShareManager->updatePermissions($share, $newPermissions);
+	}
 }

apps/federatedfilesharing/tests/NotificationsTest.php

@@ -65,9 +65,7 @@ public function setUp(): void {
 		$this->config = $this->createMock(IConfig::class);
 		$this->discoveryManager = $this->getMockBuilder(DiscoveryManager::class)
 			->disableOriginalConstructor()->getMock();
-		$this->notificationManager = new NotificationManager(
-			$this->createMock(Permissions::class)
-		);
+		$this->notificationManager = new NotificationManager();
 		$this->httpClientService = $this->createMock(IClientService::class);
 		$this->addressHandler = $this->getMockBuilder(AddressHandler::class)
 			->disableOriginalConstructor()->getMock();

apps/federatedfilesharing/tests/Ocm/PermissionsTest.php

@@ -32,24 +32,14 @@
  * @group DB
  */
 class PermissionsTest extends TestCase {
-	/**
-	 * @var Permissions
-	 */
-	private $permissions;
-
-	protected function setUp(): void {
-		parent::setUp();
-		$this->permissions = new Permissions();
-	}
-
 	/**
 	 * @dataProvider dataTestToOcPermissions
 	 *
 	 * @param string[] $ocmPermissions
 	 * @param int $expectedOcPermissions
 	 */
-	public function testToOcPermissions($ocmPermissions, $expectedOcPermissions) {
-		$ocPermissions = $this->permissions->toOcPermissions($ocmPermissions);
+	public function testToOcPermissions(array $ocmPermissions, int $expectedOcPermissions): void {
+		$ocPermissions = Permissions::toOcPermissions($ocmPermissions);
 		$this->assertEquals($expectedOcPermissions, $ocPermissions);
 	}
 
@@ -91,8 +81,8 @@ public function dataTestToOcPermissions() {
 	 * @param int $ocPermissions
 	 * @param string[] $expectedOcmPermissions
 	 */
-	public function testToOcmPermissions($ocPermissions, $expectedOcmPermissions) {
-		$ocmPermissions = $this->permissions->toOcmPermissions($ocPermissions);
+	public function testToOcmPermissions(int $ocPermissions, array $expectedOcmPermissions): void {
+		$ocmPermissions = Permissions::toOcmPermissions($ocPermissions);
 		$this->assertEquals($expectedOcmPermissions, $ocmPermissions);
 	}
 

changelog/unreleased/40693 → changelog/10.12.1_2023-04-03/40693

@@ -3,3 +3,4 @@ Bugfix: Respect User Home Folder Naming Rule home directory for chunks uploads
 When using the User Home Folder Naming Rule (configurable in the Advanced tab of the LDAP wizard), which allows to specify the home folder by means of an LDAP attribute, chunks of users' uploads were wrongly created under the default data directory rather than inside the configured home directory. We are now using the getHome() method for getting the user's home so that chunks uploads respect the configured home directory.
 
 https://github.com/owncloud/core/pull/40693
+https://github.com/owncloud/core/pull/40719

changelog/unreleased/40697 → changelog/10.12.1_2023-04-03/40697

@@ -8,5 +8,5 @@ setups. Additionally, the desktop app was not be able to sync and an error 405
 (Method not allowed) was returned. Rewrite base is now correctly added to the
 .htaccess file.
 
-https://github.com/owncloud/core/issues/40696
 https://github.com/owncloud/core/pull/40697
+https://github.com/owncloud/core/issues/40696

changelog/unreleased/40709 → changelog/10.12.1_2023-04-03/40709

@@ -1,3 +1,7 @@
 Bugfix: Prevent 507 Insufficient Storage on 32-bit systems
 
 With the introduction of https://github.com/owncloud/core/pull/40567 compatibility to 32-bit systems broke as we are now casting $freeSpace to int and this caused an integer overflow on such systems when the free space was above the max supported value. We added therefore an additional check for 32-bit systems in QuotaPlugin.php.
+
+https://github.com/owncloud/core/pull/40709
+https://github.com/owncloud/core/pull/40729
+

changelog/10.12.2_2023-05-31/40792

@@ -0,0 +1,3 @@
+Bugfix: Filter sensitive data in log for Session::loginInOwnCloud
+
+https://github.com/owncloud/core/pull/40792

changelog/10.12.2_2023-05-31/40803

@@ -0,0 +1,3 @@
+Bugfix: Disallow permission tobe upgraded via federated sharing
+
+https://github.com/owncloud/core/pull/40803

core/Command/Encryption/EncryptAll.php

@@ -115,7 +115,10 @@ protected function execute(InputInterface $input, OutputInterface $output) {
 		$masterKeyEnabled = $this->config->getAppValue('encryption', 'useMasterKey', '');
 		$userKeyEnabled = $this->config->getAppValue('encryption', 'userSpecificKey', '');
 		if (($masterKeyEnabled === '') && ($userKeyEnabled === '')) {
-			throw new \Exception('None of the encryption modules is enabled');
+			/**
+			 * Enable user specific encryption if nothing is enabled.
+			 */
+			$this->config->setAppValue('encryption', 'userSpecificKey', '1');
 		}
 
 		$output->writeln("\n");