dillard
ad0ce047e5
query() runs arbitrary admin SQL (including DELETE/UPDATE) and was exempted from CSRF protection — a leftover from the original upstream code, which had this alongside @PublicPage (no auth at all) before our admin-check hardening. The client already goes through the standard $.ajax() flow that auto-attaches Nextcloud's CSRF token, exactly like OccController::cmd() does without any such exemption, so removing it has no functional cost. Also bump nextcloud max-version to 36 to match nc01's current core version, now that AIO auto-updates the core nightly. Version bump to 0.3.4.
29 lines
1.1 KiB
XML
29 lines
1.1 KiB
XML
<?xml version="1.0"?>
|
|
<info xmlns:xsi= "http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:noNamespaceSchemaLocation="https://apps.nextcloud.com/schema/apps/info.xsd">
|
|
<id>occweb</id>
|
|
<name>Extended OCC Web</name>
|
|
<summary>OCC Commands in a web terminal</summary>
|
|
<description><![CDATA[Run OCC Commands in a web terminal]]></description>
|
|
<version>0.3.4</version>
|
|
<licence>agpl</licence>
|
|
<author mail="ebugaev@itkey.com" >Egor</author>
|
|
<namespace>OCCWeb</namespace>
|
|
<category>tools</category>
|
|
<website>https://github.com/fanategorius/occweb</website>
|
|
<bugs>https://github.com/fanategorius/occweb/issues</bugs>
|
|
<repository>https://github.com/fanategorius/occweb</repository>
|
|
<screenshot>https://github.com/fanategorius/occweb/raw/main/appinfo/screenshot.png</screenshot>
|
|
<dependencies>
|
|
<nextcloud min-version="30" max-version="36"/>
|
|
</dependencies>
|
|
<navigations>
|
|
<navigation role="admin">
|
|
<name>OCCWeb</name>
|
|
<route>occweb.occ.index</route>
|
|
<icon>app.svg</icon>
|
|
<type>link</type>
|
|
</navigation>
|
|
</navigations>
|
|
</info>
|