CVE-2020-8294

A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format.

A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format.

A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format.

A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format.

A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format.

This update for nextcloud fixes the following issues:

• nextcloud was upgraded to version 20.0.7
  • CVE-2020-8294: Fixed a missing link validation (boo#1181803)
  • CVE-2020-8295: Fixed a denial of service attack (boo#1181804)
  • CVE-2020-8293: Fixed an input validation issue (boo#1181445)

This update for nextcloud fixes the following issues:

• nextcloud was upgraded to version 20.0.7
  • CVE-2020-8294: Fixed a missing link validation (boo#1181803)
  • CVE-2020-8295: Fixed a denial of service attack (boo#1181804)
  • CVE-2020-8293: Fixed an input validation issue (boo#1181445)

This update was imported from the openSUSE:Leap:15.2:Update update project.

This update for nextcloud fixes the following issues:

nextcloud was updated to 20.0.11:

• Fix boo#1188247 - CVE-2021-32678: OCS API response ratelimits are not applied
• Fix boo#1188248 - CVE-2021-32679: filenames where not escaped by default in controllers using DownloadResponse
• Fix boo#1188249 - CVE-2021-32680: share expiration date wasn't properly logged
• Fix boo#1188250 - CVE-2021-32688: lacking permission check with application specific tokens
• Fix boo#1188251 - CVE-2021-32703: lack of ratelimiting on the shareinfo endpoint
• Fix boo#1188252 - CVE-2021-32705: lack of ratelimiting on the public DAV endpoint
• Fix boo#1188253 - CVE-2021-32725: default share permissions were not being respected for federated reshares of files and folders
• Fix boo#1188254 - CVE-2021-32726: webauthn tokens were not deleted after a user has been deleted
• Fix boo#1188255 - CVE-2021-32734: possible full path disclosure on shared files
• Fix boo#1188256 - CVE-2021-32741: lack of ratelimiting on the public share link mount endpoint
• Bump handlebars from 4.7.6 to 4.7.7 (server#26900)
• Bump lodash from 4.17.20 to 4.17.21 (server#26909)
• Bump hosted-git-info from 2.8.8 to 2.8.9 (server#26920)
• Don't break OCC if an app is breaking in it's Application class (server#26954)
• Add bruteforce protection to the shareinfo endpoint (server#26956)
• Ignore readonly flag for directories (server#26965)
• Throttle MountPublicLinkController when share is not found (server#26971)
• Respect default share permissions for federated reshares (server#27001)
• Harden apptoken check (server#27014)
• Use parent wrapper to properly handle moves on the same source/target storage (server#27016)
• Fix error when using CORS with no auth credentials (server#27027)
• Fix return value of getStorageInfo when 'quota_include_external_storage' is enabled (server#27108)
• Bump patch dependencies (server#27183)
• Use noreply@ as email address for share emails (server#27209)
• Bump p-queue from 6.6.1 to 6.6.2 (server#27226)
• Bump browserslist from 4.14.0 to 4.16.6 (server#27247)
• Bump webpack from 4.44.1 to 4.44.2 (server#27297)
• Properly use limit and offset for search in Jail wrapper (server#27308)
• Make user:report command scale (server#27319)
• Properly log expiration date removal in audit log (server#27325)
• Propagate throttling on OCS response (server#27337)
• Set umask before operations that create local files (server#27349)
• Escape filename in Content-Disposition (server#27360)
• Don't update statuses to offline again and again (server#27412)
• Header must contain a colon (server#27456)
• Activate constraint check for oracle / pqsql also for 20 (server#27523)
• Only allow removing existing shares that would not be allowed due to reshare restrictions (server#27552)
• Bump ws from 7.3.1 to 7.5.0 (server#27570)
• Properly cleanup entries of WebAuthn on user deletion (server#27596)
• Throttle on public DAV endpoint (server#27617)
• Bump vue-loader from 15.9.3 to 15.9.7 (server#27639)
• Bump eslint-plugin-standard from 4.0.1 to 4.0.2 (server#27651)
• Validate the theming color also on CLI (server#27680)
• Downstream encryption:fix-encrypted-version for repairing bad signature errors (server#27728)
• Remove encodeURI code (files_pdfviewer#396)
• Only ask for permissions on HTTPS (notifications#998)
• Fix sorting if one of the file name is only composed with number (photos#785)
• Backport 20 fix Photos not shown in large browser windows #630 (#686) (photos#810)
• Update File.vue (photos#813)
• Update chart.js (serverinfo#309)
• Only return workspace property for top node in a propfind request (text#1611)
• ViewerComponent: pass on autofocus to EditorWrapper (text#1647)
• Use text/plain as content type for fetching the document (text#1692)
• Log exceptions that happen on unknown exception and return generic messages (text#1698)
• Add fixup (viewer#924)
• Fix: fullscreen for Firefox (viewer#929)

Update to 20.0.7

• Catch NotFoundException when querying quota…