Merge branch 'master' into master

.github/CODEOWNERS

@@ -70,8 +70,8 @@ ResponseDefinitions.php @provokateurin
 /lib/public/UserStatus              @nickvergessen
 
 # Groupware
-/build/integration/dav_features/caldav.feature    @miaulalala @st3iny @SebastianKrupinski
-/build/integration/dav_features/carddav.feature   @miaulalala @st3iny @SebastianKrupinski
+/build/integration/dav_features/caldav.feature    @st3iny @SebastianKrupinski
+/build/integration/dav_features/carddav.feature   @st3iny @SebastianKrupinski
 
 # Personal interest
 */Activity/*                        @nickvergessen

.github/workflows/command-compile.yml

@@ -76,7 +76,7 @@ jobs:
           fi
 
       - name: Init branch
-        uses: xt0rted/pull-request-comment-branch@d97294d304604fa98a2600a6e2f916a84b596dc7 # v1
+        uses: xt0rted/pull-request-comment-branch@e8b8daa837e8ea7331c0003c9c316a64c6d8b0b1 # v1
         id: comment-branch
 
       - name: Add reaction on failure

.github/workflows/command-pull-3rdparty.yml

@@ -34,7 +34,7 @@ jobs:
           exit 1
 
       - name: Init branch
-        uses: xt0rted/pull-request-comment-branch@d97294d304604fa98a2600a6e2f916a84b596dc7 # v1
+        uses: xt0rted/pull-request-comment-branch@e8b8daa837e8ea7331c0003c9c316a64c6d8b0b1 # v1
         id: comment-branch
 
       - name: Checkout ${{ steps.comment-branch.outputs.head_ref }}

.github/workflows/cypress.yml

@@ -121,7 +121,7 @@ jobs:
         run: ./node_modules/cypress/bin/cypress install
 
       - name: Run ${{ matrix.containers == 'component' && 'component' || 'E2E' }} cypress tests
-        uses: cypress-io/github-action@0da3c06ed8217b912deea9d8ee69630baed1737e # v6.7.6
+        uses: cypress-io/github-action@f1f0912d392f0d06bdd01fb9ebe3b3299e5806fb # v6.7.7
         with:
           # We already installed the dependencies in the init job
           install: false
@@ -142,12 +142,14 @@ jobs:
           SPLIT: ${{ matrix.total-containers }}
           SPLIT_INDEX: ${{ matrix.containers == 'component' && 0 || matrix.containers }}
 
-      - name: Upload snapshots
+      - name: Upload snapshots and videos
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         if: always()
         with:
-          name: snapshots_${{ matrix.containers }}
-          path: cypress/snapshots
+          name: snapshots_videos_${{ matrix.containers }}
+          path: |
+            cypress/snapshots
+            cypress/videos
 
       - name: Extract NC logs
         if: failure() && matrix.containers != 'component'
@@ -162,7 +164,7 @@ jobs:
 
       - name: Create data dir archive
         if: failure() && matrix.containers != 'component'
-        run: docker exec nextcloud-cypress-tests-server tar -cvjf - data > data.tar
+        run: docker exec nextcloud-cypress-tests_server tar -cvjf - data > data.tar
 
       - name: Upload data dir archive
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3

.github/workflows/files-external-ftp.yml

@@ -100,7 +100,7 @@ jobs:
 
       - name: Upload code coverage
         if: ${{ !cancelled() && matrix.coverage }}
-        uses: codecov/codecov-action@v4.6.0
+        uses: codecov/codecov-action@v5.0.7
         with:
           files: ./clover.xml
           flags: phpunit-files-external-ftp

.github/workflows/files-external-s3.yml

@@ -98,7 +98,7 @@ jobs:
 
       - name: Upload code coverage
         if: ${{ !cancelled() && matrix.coverage }}
-        uses: codecov/codecov-action@v4.6.0
+        uses: codecov/codecov-action@v5.0.7
         with:
           files: ./clover.xml
           flags: phpunit-files-external-s3
@@ -165,7 +165,7 @@ jobs:
 
       - name: Upload code coverage
         if: ${{ !cancelled() && matrix.coverage }}
-        uses: codecov/codecov-action@v4.6.0
+        uses: codecov/codecov-action@v5.0.7
         with:
           files: ./clover.xml
           flags: phpunit-files-external-s3

.github/workflows/files-external-sftp.yml

@@ -89,7 +89,7 @@ jobs:
 
       - name: Upload code coverage
         if: ${{ !cancelled() && matrix.coverage }}
-        uses: codecov/codecov-action@v4.6.0
+        uses: codecov/codecov-action@v5.0.7
         with:
           files: ./clover.xml
           flags: phpunit-files-external-sftp

.github/workflows/files-external-smb-kerberos.yml

@@ -34,7 +34,7 @@ jobs:
               - '**.php'
 
   files-external-smb-kerberos:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     needs: changes
 
     if: ${{ github.repository_owner != 'nextcloud-gmbh' && needs.changes.outputs.src != 'false' }}
@@ -53,6 +53,12 @@ jobs:
           repository: nextcloud/user_saml
           path: apps/user_saml
 
+      - name: Install user_saml
+        run: |
+          cd apps/user_saml
+          composer i
+          cd ../..
+
       - name: Pull images
         run: |
           docker pull ghcr.io/icewind1991/samba-krb-test-dc

.github/workflows/files-external-smb.yml

@@ -94,7 +94,7 @@ jobs:
 
       - name: Upload code coverage
         if: ${{ !cancelled() && matrix.coverage }}
-        uses: codecov/codecov-action@e43f28e103e52bb26d252b5a97fcdfa06175321e # v4.1.1
+        uses: codecov/codecov-action@015f24e6818733317a2da2edd6290ab26238649a # v4.1.1
         with:
           files: ./clover.xml
           flags: phpunit-files-external-smb

.github/workflows/files-external-webdav.yml

@@ -91,7 +91,7 @@ jobs:
 
       - name: Upload code coverage
         if: ${{ !cancelled() && matrix.coverage }}
-        uses: codecov/codecov-action@e43f28e103e52bb26d252b5a97fcdfa06175321e # v4.1.1
+        uses: codecov/codecov-action@015f24e6818733317a2da2edd6290ab26238649a # v4.1.1
         with:
           files: ./clover.xml
           flags: phpunit-files-external-webdav

.github/workflows/files-external.yml

@@ -74,12 +74,12 @@ jobs:
           ./occ app:enable --force files_external
 
       - name: PHPUnit
-        run: composer run test:files_external \
+        run: composer run test:files_external -- \
           ${{ matrix.coverage && ' --coverage-clover ./clover.xml' || '' }}
 
       - name: Upload code coverage
         if: ${{ !cancelled() && matrix.coverage }}
-        uses: codecov/codecov-action@v4.6.0
+        uses: codecov/codecov-action@v5.0.7
         with:
           files: ./clover.xml
           flags: phpunit-files-external-generic

.github/workflows/lint-stylelint.yml

@@ -0,0 +1,51 @@
+# This workflow is provided via the organization template repository
+#
+# https://github.com/nextcloud/.github
+# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
+#
+# SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: MIT
+
+name: Lint stylelint
+
+on: pull_request
+
+permissions:
+  contents: read
+
+concurrency:
+  group: lint-stylelint-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    name: stylelint
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Read package.json node and npm engines version
+        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+        id: versions
+        with:
+          fallbackNode: '^20'
+          fallbackNpm: '^10'
+
+      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          node-version: ${{ steps.versions.outputs.nodeVersion }}
+
+      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
+        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+
+      - name: Install dependencies
+        env:
+          CYPRESS_INSTALL_BINARY: 0
+        run: npm ci
+
+      - name: Lint
+        run: npm run stylelint

.github/workflows/node-test.yml

@@ -99,7 +99,7 @@ jobs:
         run: npm run test:coverage --if-present
 
       - name: Collect coverage
-        uses: codecov/codecov-action@e43f28e103e52bb26d252b5a97fcdfa06175321e # v4.3.1
+        uses: codecov/codecov-action@015f24e6818733317a2da2edd6290ab26238649a # v4.3.1
         with:
           files: ./coverage/lcov.info
 

.github/workflows/object-storage-azure.yml

@@ -105,7 +105,7 @@ jobs:
 
       - name: Upload code coverage
         if: ${{ !cancelled() && matrix.coverage }}
-        uses: codecov/codecov-action@v4.6.0
+        uses: codecov/codecov-action@v5.0.7
         with:
           files: ./clover.xml
           flags: phpunit-azure

.github/workflows/object-storage-s3.yml

@@ -111,7 +111,7 @@ jobs:
 
       - name: Upload code coverage
         if: ${{ !cancelled() && matrix.coverage }}
-        uses: codecov/codecov-action@v4.6.0
+        uses: codecov/codecov-action@v5.0.7
         with:
           files: ./clover.xml
           flags: phpunit-s3

.github/workflows/object-storage-swift.yml

@@ -101,7 +101,7 @@ jobs:
 
       - name: Upload code coverage
         if: ${{ !cancelled() && matrix.coverage }}
-        uses: codecov/codecov-action@v4.6.0
+        uses: codecov/codecov-action@v5.0.7
         with:
           files: ./clover.xml
           flags: phpunit-swift

.github/workflows/phpunit-mariadb.yml

@@ -124,7 +124,7 @@ jobs:
 
       - name: Upload db code coverage
         if: ${{ !cancelled() && matrix.coverage }}
-        uses: codecov/codecov-action@v4.6.0
+        uses: codecov/codecov-action@v5.0.7
         with:
           files: ./clover.db.xml
           flags: phpunit-mariadb

.github/workflows/phpunit-memcached.yml

@@ -101,7 +101,7 @@ jobs:
 
       - name: Upload code coverage
         if: ${{ !cancelled() && matrix.coverage }}
-        uses: codecov/codecov-action@v4.6.0
+        uses: codecov/codecov-action@v5.0.7
         with:
           files: ./clover.xml
           flags: phpunit-memcached

.github/workflows/phpunit-mysql-sharding.yml

@@ -159,7 +159,7 @@ jobs:
 
       - name: Upload db code coverage
         if: ${{ !cancelled() && matrix.coverage }}
-        uses: codecov/codecov-action@v4.6.0
+        uses: codecov/codecov-action@v5.0.7
         with:
           files: ./clover.db.xml
           flags: phpunit-mysql

.github/workflows/phpunit-mysql.yml

@@ -124,7 +124,7 @@ jobs:
 
       - name: Upload db code coverage
         if: ${{ !cancelled() && matrix.coverage }}
-        uses: codecov/codecov-action@v4.6.0
+        uses: codecov/codecov-action@v5.0.7
         with:
           files: ./clover.db.xml
           flags: phpunit-mysql

.github/workflows/phpunit-nodb.yml

@@ -106,7 +106,7 @@ jobs:
 
       - name: Upload nodb code coverage
         if: ${{ !cancelled() && matrix.coverage }}
-        uses: codecov/codecov-action@v4.6.0
+        uses: codecov/codecov-action@v5.0.7
         with:
           files: ./clover.nodb.xml
           flags: phpunit-nodb

.github/workflows/phpunit-oci.yml

@@ -129,7 +129,7 @@ jobs:
 
       - name: Upload db code coverage
         if: ${{ !cancelled() && matrix.coverage }}
-        uses: codecov/codecov-action@v4.6.0
+        uses: codecov/codecov-action@v5.0.7
         with:
           files: ./clover.db.xml
           flags: phpunit-oci

.github/workflows/phpunit-pgsql.yml

@@ -119,7 +119,7 @@ jobs:
 
       - name: Upload db code coverage
         if: ${{ !cancelled() && matrix.coverage }}
-        uses: codecov/codecov-action@v4.6.0
+        uses: codecov/codecov-action@v5.0.7
         with:
           files: ./clover.db.xml
           flags: phpunit-postgres

.github/workflows/phpunit-sqlite.yml

@@ -105,7 +105,7 @@ jobs:
 
       - name: Upload db code coverage
         if: ${{ !cancelled() && matrix.coverage }}
-        uses: codecov/codecov-action@v4.6.0
+        uses: codecov/codecov-action@v5.0.7
         with:
           files: ./clover.db.xml
           flags: phpunit-sqlite

.github/workflows/reuse.yml

@@ -19,4 +19,4 @@ jobs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: REUSE Compliance Check
-      uses: fsfe/reuse-action@3ae3c6bdf1257ab19397fab11fd3312144692083 # v4.0.0
+      uses: fsfe/reuse-action@bb774aa972c2a89ff34781233d275075cbddf542 # v5.0.0

.github/workflows/static-code-analysis.yml

@@ -111,3 +111,29 @@ jobs:
       - name: Show potential changes in Psalm baseline
         if: always()
         run: git diff --exit-code -- . ':!lib/composer'
+
+  static-code-analysis-ncu:
+    runs-on: ubuntu-latest
+
+    if: ${{ github.event_name != 'push' && github.repository_owner != 'nextcloud-gmbh' }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          submodules: true
+
+      - name: Set up php
+        uses: shivammathur/setup-php@c541c155eee45413f5b09a52248675b1a2575231 #v2.31.1
+        with:
+          php-version: '8.1'
+          extensions: ctype,curl,dom,fileinfo,gd,imagick,intl,json,mbstring,openssl,pdo_sqlite,posix,sqlite,xml,zip
+          coverage: none
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Composer install
+        run: composer i
+
+      - name: Psalm
+        run: composer run psalm:ncu -- --threads=1 --monochrome --no-progress --output-format=github

.htaccess

@@ -15,11 +15,18 @@
 
   <IfModule mod_env.c>
     # Add security and privacy related headers
-
     # Avoid doubled headers by unsetting headers in "onsuccess" table,
     # then add headers to "always" table: https://github.com/nextcloud/server/pull/19002
-    Header onsuccess unset Referrer-Policy
-    Header always set Referrer-Policy "no-referrer"
+
+    <If "%{REQUEST_URI} =~ m#/login$#">
+      # Only on the login page we need any Origin or Referer header set.
+      Header onsuccess unset Referrer-Policy
+      Header always set Referrer-Policy "same-origin"
+    </If>
+    <Else>
+      Header onsuccess unset Referrer-Policy
+      Header always set Referrer-Policy "no-referrer"
+    </Else>
 
     Header onsuccess unset X-Content-Type-Options
     Header always set X-Content-Type-Options "nosniff"
@@ -103,7 +110,7 @@
 #  - https://docs.cyberduck.io/mountainduck/issues/fastcgi/
 #  - https://docs.nextcloud.com/server/latest/admin_manual/issues/general_troubleshooting.html#troubleshooting-webdav
 <IfModule mod_setenvif.c>
-  SetEnvIf Transfer-Encoding "chunked" proxy-sendcl=1
+  SetEnvIfNoCase Transfer-Encoding "chunked" proxy-sendcl=1
 </IfModule>
 
 # Apache disabled the sending of the server-side content-length header

AUTHORS

@@ -314,6 +314,7 @@
  - Max <[email protected]>
  - Max Kovalenko <[email protected]>
  - Max Kunzelmann <[email protected]>
+ - Max Schmit <[email protected]>
  - Maxence Lange <[email protected]>
  - Maxence Lange <[email protected]>
  - Maxence Lange <[email protected]>