nextcloud / server

apps/user_ldap/lib/Access.php

Indentation +1768 added lines, -1768 removed lines

@@ -52,1527 +52,1527 @@ 
  * @package OCA\User_LDAP
  */
 class Access extends LDAPUtility implements IUserTools {
-	/**
-	 * @var \OCA\User_LDAP\Connection
-	 */
-	public $connection;
-	/** @var Manager */
-	public $userManager;
-	//never ever check this var directly, always use getPagedSearchResultState
-	protected $pagedSearchedSuccessful;
-
-	/**
-	 * @var string[] $cookies an array of returned Paged Result cookies
-	 */
-	protected $cookies = array();
-
-	/**
-	 * @var string $lastCookie the last cookie returned from a Paged Results
-	 * operation, defaults to an empty string
-	 */
-	protected $lastCookie = '';
-
-	/**
-	 * @var AbstractMapping $userMapper
-	 */
-	protected $userMapper;
-
-	/**
-	* @var AbstractMapping $userMapper
-	*/
-	protected $groupMapper;
+    /**
+     * @var \OCA\User_LDAP\Connection
+     */
+    public $connection;
+    /** @var Manager */
+    public $userManager;
+    //never ever check this var directly, always use getPagedSearchResultState
+    protected $pagedSearchedSuccessful;
+
+    /**
+     * @var string[] $cookies an array of returned Paged Result cookies
+     */
+    protected $cookies = array();
+
+    /**
+     * @var string $lastCookie the last cookie returned from a Paged Results
+     * operation, defaults to an empty string
+     */
+    protected $lastCookie = '';
+
+    /**
+     * @var AbstractMapping $userMapper
+     */
+    protected $userMapper;
+
+    /**
+     * @var AbstractMapping $userMapper
+     */
+    protected $groupMapper;
 	
-	/**
-	 * @var \OCA\User_LDAP\Helper
-	 */
-	private $helper;
-
-	public function __construct(Connection $connection, ILDAPWrapper $ldap,
-		Manager $userManager, Helper $helper) {
-		parent::__construct($ldap);
-		$this->connection = $connection;
-		$this->userManager = $userManager;
-		$this->userManager->setLdapAccess($this);
-		$this->helper = $helper;
-	}
-
-	/**
-	 * sets the User Mapper
-	 * @param AbstractMapping $mapper
-	 */
-	public function setUserMapper(AbstractMapping $mapper) {
-		$this->userMapper = $mapper;
-	}
-
-	/**
-	 * returns the User Mapper
-	 * @throws \Exception
-	 * @return AbstractMapping
-	 */
-	public function getUserMapper() {
-		if(is_null($this->userMapper)) {
-			throw new \Exception('UserMapper was not assigned to this Access instance.');
-		}
-		return $this->userMapper;
-	}
-
-	/**
-	 * sets the Group Mapper
-	 * @param AbstractMapping $mapper
-	 */
-	public function setGroupMapper(AbstractMapping $mapper) {
-		$this->groupMapper = $mapper;
-	}
-
-	/**
-	 * returns the Group Mapper
-	 * @throws \Exception
-	 * @return AbstractMapping
-	 */
-	public function getGroupMapper() {
-		if(is_null($this->groupMapper)) {
-			throw new \Exception('GroupMapper was not assigned to this Access instance.');
-		}
-		return $this->groupMapper;
-	}
-
-	/**
-	 * @return bool
-	 */
-	private function checkConnection() {
-		return ($this->connection instanceof Connection);
-	}
-
-	/**
-	 * returns the Connection instance
-	 * @return \OCA\User_LDAP\Connection
-	 */
-	public function getConnection() {
-		return $this->connection;
-	}
-
-	/**
-	 * reads a given attribute for an LDAP record identified by a DN
-	 * @param string $dn the record in question
-	 * @param string $attr the attribute that shall be retrieved
-	 *        if empty, just check the record's existence
-	 * @param string $filter
-	 * @return array|false an array of values on success or an empty
-	 *          array if $attr is empty, false otherwise
-	 */
-	public function readAttribute($dn, $attr, $filter = 'objectClass=*') {
-		if(!$this->checkConnection()) {
-			\OCP\Util::writeLog('user_ldap',
-				'No LDAP Connector assigned, access impossible for readAttribute.',
-				\OCP\Util::WARN);
-			return false;
-		}
-		$cr = $this->connection->getConnectionResource();
-		if(!$this->ldap->isResource($cr)) {
-			//LDAP not available
-			\OCP\Util::writeLog('user_ldap', 'LDAP resource not available.', \OCP\Util::DEBUG);
-			return false;
-		}
-		//Cancel possibly running Paged Results operation, otherwise we run in
-		//LDAP protocol errors
-		$this->abandonPagedSearch();
-		// openLDAP requires that we init a new Paged Search. Not needed by AD,
-		// but does not hurt either.
-		$pagingSize = intval($this->connection->ldapPagingSize);
-		// 0 won't result in replies, small numbers may leave out groups
-		// (cf. #12306), 500 is default for paging and should work everywhere.
-		$maxResults = $pagingSize > 20 ? $pagingSize : 500;
-		$attr = mb_strtolower($attr, 'UTF-8');
-		// the actual read attribute later may contain parameters on a ranged
-		// request, e.g. member;range=99-199. Depends on server reply.
-		$attrToRead = $attr;
-
-		$values = [];
-		$isRangeRequest = false;
-		do {
-			$result = $this->executeRead($cr, $dn, $attrToRead, $filter, $maxResults);
-			if(is_bool($result)) {
-				// when an exists request was run and it was successful, an empty
-				// array must be returned
-				return $result ? [] : false;
-			}
-
-			if (!$isRangeRequest) {
-				$values = $this->extractAttributeValuesFromResult($result, $attr);
-				if (!empty($values)) {
-					return $values;
-				}
-			}
-
-			$isRangeRequest = false;
-			$result = $this->extractRangeData($result, $attr);
-			if (!empty($result)) {
-				$normalizedResult = $this->extractAttributeValuesFromResult(
-					[ $attr => $result['values'] ],
-					$attr
-				);
-				$values = array_merge($values, $normalizedResult);
-
-				if($result['rangeHigh'] === '*') {
-					// when server replies with * as high range value, there are
-					// no more results left
-					return $values;
-				} else {
-					$low  = $result['rangeHigh'] + 1;
-					$attrToRead = $result['attributeName'] . ';range=' . $low . '-*';
-					$isRangeRequest = true;
-				}
-			}
-		} while($isRangeRequest);
-
-		\OCP\Util::writeLog('user_ldap', 'Requested attribute '.$attr.' not found for '.$dn, \OCP\Util::DEBUG);
-		return false;
-	}
-
-	/**
-	 * Runs an read operation against LDAP
-	 *
-	 * @param resource $cr the LDAP connection
-	 * @param string $dn
-	 * @param string $attribute
-	 * @param string $filter
-	 * @param int $maxResults
-	 * @return array|bool false if there was any error, true if an exists check
-	 *                    was performed and the requested DN found, array with the
-	 *                    returned data on a successful usual operation
-	 */
-	public function executeRead($cr, $dn, $attribute, $filter, $maxResults) {
-		$this->initPagedSearch($filter, array($dn), array($attribute), $maxResults, 0);
-		$dn = $this->helper->DNasBaseParameter($dn);
-		$rr = @$this->ldap->read($cr, $dn, $filter, array($attribute));
-		if (!$this->ldap->isResource($rr)) {
-			if ($attribute !== '') {
-				//do not throw this message on userExists check, irritates
-				\OCP\Util::writeLog('user_ldap', 'readAttribute failed for DN ' . $dn, \OCP\Util::DEBUG);
-			}
-			//in case an error occurs , e.g. object does not exist
-			return false;
-		}
-		if ($attribute === '' && ($filter === 'objectclass=*' || $this->ldap->countEntries($cr, $rr) === 1)) {
-			\OCP\Util::writeLog('user_ldap', 'readAttribute: ' . $dn . ' found', \OCP\Util::DEBUG);
-			return true;
-		}
-		$er = $this->ldap->firstEntry($cr, $rr);
-		if (!$this->ldap->isResource($er)) {
-			//did not match the filter, return false
-			return false;
-		}
-		//LDAP attributes are not case sensitive
-		$result = \OCP\Util::mb_array_change_key_case(
-			$this->ldap->getAttributes($cr, $er), MB_CASE_LOWER, 'UTF-8');
-
-		return $result;
-	}
-
-	/**
-	 * Normalizes a result grom getAttributes(), i.e. handles DNs and binary
-	 * data if present.
-	 *
-	 * @param array $result from ILDAPWrapper::getAttributes()
-	 * @param string $attribute the attribute name that was read
-	 * @return string[]
-	 */
-	public function extractAttributeValuesFromResult($result, $attribute) {
-		$values = [];
-		if(isset($result[$attribute]) && $result[$attribute]['count'] > 0) {
-			$lowercaseAttribute = strtolower($attribute);
-			for($i=0;$i<$result[$attribute]['count'];$i++) {
-				if($this->resemblesDN($attribute)) {
-					$values[] = $this->helper->sanitizeDN($result[$attribute][$i]);
-				} elseif($lowercaseAttribute === 'objectguid' || $lowercaseAttribute === 'guid') {
-					$values[] = $this->convertObjectGUID2Str($result[$attribute][$i]);
-				} else {
-					$values[] = $result[$attribute][$i];
-				}
-			}
-		}
-		return $values;
-	}
-
-	/**
-	 * Attempts to find ranged data in a getAttribute results and extracts the
-	 * returned values as well as information on the range and full attribute
-	 * name for further processing.
-	 *
-	 * @param array $result from ILDAPWrapper::getAttributes()
-	 * @param string $attribute the attribute name that was read. Without ";range=…"
-	 * @return array If a range was detected with keys 'values', 'attributeName',
-	 *               'attributeFull' and 'rangeHigh', otherwise empty.
-	 */
-	public function extractRangeData($result, $attribute) {
-		$keys = array_keys($result);
-		foreach($keys as $key) {
-			if($key !== $attribute && strpos($key, $attribute) === 0) {
-				$queryData = explode(';', $key);
-				if(strpos($queryData[1], 'range=') === 0) {
-					$high = substr($queryData[1], 1 + strpos($queryData[1], '-'));
-					$data = [
-						'values' => $result[$key],
-						'attributeName' => $queryData[0],
-						'attributeFull' => $key,
-						'rangeHigh' => $high,
-					];
-					return $data;
-				}
-			}
-		}
-		return [];
-	}
+    /**
+     * @var \OCA\User_LDAP\Helper
+     */
+    private $helper;
+
+    public function __construct(Connection $connection, ILDAPWrapper $ldap,
+        Manager $userManager, Helper $helper) {
+        parent::__construct($ldap);
+        $this->connection = $connection;
+        $this->userManager = $userManager;
+        $this->userManager->setLdapAccess($this);
+        $this->helper = $helper;
+    }
+
+    /**
+     * sets the User Mapper
+     * @param AbstractMapping $mapper
+     */
+    public function setUserMapper(AbstractMapping $mapper) {
+        $this->userMapper = $mapper;
+    }
+
+    /**
+     * returns the User Mapper
+     * @throws \Exception
+     * @return AbstractMapping
+     */
+    public function getUserMapper() {
+        if(is_null($this->userMapper)) {
+            throw new \Exception('UserMapper was not assigned to this Access instance.');
+        }
+        return $this->userMapper;
+    }
+
+    /**
+     * sets the Group Mapper
+     * @param AbstractMapping $mapper
+     */
+    public function setGroupMapper(AbstractMapping $mapper) {
+        $this->groupMapper = $mapper;
+    }
+
+    /**
+     * returns the Group Mapper
+     * @throws \Exception
+     * @return AbstractMapping
+     */
+    public function getGroupMapper() {
+        if(is_null($this->groupMapper)) {
+            throw new \Exception('GroupMapper was not assigned to this Access instance.');
+        }
+        return $this->groupMapper;
+    }
+
+    /**
+     * @return bool
+     */
+    private function checkConnection() {
+        return ($this->connection instanceof Connection);
+    }
+
+    /**
+     * returns the Connection instance
+     * @return \OCA\User_LDAP\Connection
+     */
+    public function getConnection() {
+        return $this->connection;
+    }
+
+    /**
+     * reads a given attribute for an LDAP record identified by a DN
+     * @param string $dn the record in question
+     * @param string $attr the attribute that shall be retrieved
+     *        if empty, just check the record's existence
+     * @param string $filter
+     * @return array|false an array of values on success or an empty
+     *          array if $attr is empty, false otherwise
+     */
+    public function readAttribute($dn, $attr, $filter = 'objectClass=*') {
+        if(!$this->checkConnection()) {
+            \OCP\Util::writeLog('user_ldap',
+                'No LDAP Connector assigned, access impossible for readAttribute.',
+                \OCP\Util::WARN);
+            return false;
+        }
+        $cr = $this->connection->getConnectionResource();
+        if(!$this->ldap->isResource($cr)) {
+            //LDAP not available
+            \OCP\Util::writeLog('user_ldap', 'LDAP resource not available.', \OCP\Util::DEBUG);
+            return false;
+        }
+        //Cancel possibly running Paged Results operation, otherwise we run in
+        //LDAP protocol errors
+        $this->abandonPagedSearch();
+        // openLDAP requires that we init a new Paged Search. Not needed by AD,
+        // but does not hurt either.
+        $pagingSize = intval($this->connection->ldapPagingSize);
+        // 0 won't result in replies, small numbers may leave out groups
+        // (cf. #12306), 500 is default for paging and should work everywhere.
+        $maxResults = $pagingSize > 20 ? $pagingSize : 500;
+        $attr = mb_strtolower($attr, 'UTF-8');
+        // the actual read attribute later may contain parameters on a ranged
+        // request, e.g. member;range=99-199. Depends on server reply.
+        $attrToRead = $attr;
+
+        $values = [];
+        $isRangeRequest = false;
+        do {
+            $result = $this->executeRead($cr, $dn, $attrToRead, $filter, $maxResults);
+            if(is_bool($result)) {
+                // when an exists request was run and it was successful, an empty
+                // array must be returned
+                return $result ? [] : false;
+            }
+
+            if (!$isRangeRequest) {
+                $values = $this->extractAttributeValuesFromResult($result, $attr);
+                if (!empty($values)) {
+                    return $values;
+                }
+            }
+
+            $isRangeRequest = false;
+            $result = $this->extractRangeData($result, $attr);
+            if (!empty($result)) {
+                $normalizedResult = $this->extractAttributeValuesFromResult(
+                    [ $attr => $result['values'] ],
+                    $attr
+                );
+                $values = array_merge($values, $normalizedResult);
+
+                if($result['rangeHigh'] === '*') {
+                    // when server replies with * as high range value, there are
+                    // no more results left
+                    return $values;
+                } else {
+                    $low  = $result['rangeHigh'] + 1;
+                    $attrToRead = $result['attributeName'] . ';range=' . $low . '-*';
+                    $isRangeRequest = true;
+                }
+            }
+        } while($isRangeRequest);
+
+        \OCP\Util::writeLog('user_ldap', 'Requested attribute '.$attr.' not found for '.$dn, \OCP\Util::DEBUG);
+        return false;
+    }
+
+    /**
+     * Runs an read operation against LDAP
+     *
+     * @param resource $cr the LDAP connection
+     * @param string $dn
+     * @param string $attribute
+     * @param string $filter
+     * @param int $maxResults
+     * @return array|bool false if there was any error, true if an exists check
+     *                    was performed and the requested DN found, array with the
+     *                    returned data on a successful usual operation
+     */
+    public function executeRead($cr, $dn, $attribute, $filter, $maxResults) {
+        $this->initPagedSearch($filter, array($dn), array($attribute), $maxResults, 0);
+        $dn = $this->helper->DNasBaseParameter($dn);
+        $rr = @$this->ldap->read($cr, $dn, $filter, array($attribute));
+        if (!$this->ldap->isResource($rr)) {
+            if ($attribute !== '') {
+                //do not throw this message on userExists check, irritates
+                \OCP\Util::writeLog('user_ldap', 'readAttribute failed for DN ' . $dn, \OCP\Util::DEBUG);
+            }
+            //in case an error occurs , e.g. object does not exist
+            return false;
+        }
+        if ($attribute === '' && ($filter === 'objectclass=*' || $this->ldap->countEntries($cr, $rr) === 1)) {
+            \OCP\Util::writeLog('user_ldap', 'readAttribute: ' . $dn . ' found', \OCP\Util::DEBUG);
+            return true;
+        }
+        $er = $this->ldap->firstEntry($cr, $rr);
+        if (!$this->ldap->isResource($er)) {
+            //did not match the filter, return false
+            return false;
+        }
+        //LDAP attributes are not case sensitive
+        $result = \OCP\Util::mb_array_change_key_case(
+            $this->ldap->getAttributes($cr, $er), MB_CASE_LOWER, 'UTF-8');
+
+        return $result;
+    }
+
+    /**
+     * Normalizes a result grom getAttributes(), i.e. handles DNs and binary
+     * data if present.
+     *
+     * @param array $result from ILDAPWrapper::getAttributes()
+     * @param string $attribute the attribute name that was read
+     * @return string[]
+     */
+    public function extractAttributeValuesFromResult($result, $attribute) {
+        $values = [];
+        if(isset($result[$attribute]) && $result[$attribute]['count'] > 0) {
+            $lowercaseAttribute = strtolower($attribute);
+            for($i=0;$i<$result[$attribute]['count'];$i++) {
+                if($this->resemblesDN($attribute)) {
+                    $values[] = $this->helper->sanitizeDN($result[$attribute][$i]);
+                } elseif($lowercaseAttribute === 'objectguid' || $lowercaseAttribute === 'guid') {
+                    $values[] = $this->convertObjectGUID2Str($result[$attribute][$i]);
+                } else {
+                    $values[] = $result[$attribute][$i];
+                }
+            }
+        }
+        return $values;
+    }
+
+    /**
+     * Attempts to find ranged data in a getAttribute results and extracts the
+     * returned values as well as information on the range and full attribute
+     * name for further processing.
+     *
+     * @param array $result from ILDAPWrapper::getAttributes()
+     * @param string $attribute the attribute name that was read. Without ";range=…"
+     * @return array If a range was detected with keys 'values', 'attributeName',
+     *               'attributeFull' and 'rangeHigh', otherwise empty.
+     */
+    public function extractRangeData($result, $attribute) {
+        $keys = array_keys($result);
+        foreach($keys as $key) {
+            if($key !== $attribute && strpos($key, $attribute) === 0) {
+                $queryData = explode(';', $key);
+                if(strpos($queryData[1], 'range=') === 0) {
+                    $high = substr($queryData[1], 1 + strpos($queryData[1], '-'));
+                    $data = [
+                        'values' => $result[$key],
+                        'attributeName' => $queryData[0],
+                        'attributeFull' => $key,
+                        'rangeHigh' => $high,
+                    ];
+                    return $data;
+                }
+            }
+        }
+        return [];
+    }
 	
-	/**
-	 * Set password for an LDAP user identified by a DN
-	 *
-	 * @param string $userDN the user in question
-	 * @param string $password the new password
-	 * @return bool
-	 * @throws HintException
-	 * @throws \Exception
-	 */
-	public function setPassword($userDN, $password) {
-		if(intval($this->connection->turnOnPasswordChange) !== 1) {
-			throw new \Exception('LDAP password changes are disabled.');
-		}
-		$cr = $this->connection->getConnectionResource();
-		if(!$this->ldap->isResource($cr)) {
-			//LDAP not available
-			\OCP\Util::writeLog('user_ldap', 'LDAP resource not available.', \OCP\Util::DEBUG);
-			return false;
-		}
+    /**
+     * Set password for an LDAP user identified by a DN
+     *
+     * @param string $userDN the user in question
+     * @param string $password the new password
+     * @return bool
+     * @throws HintException
+     * @throws \Exception
+     */
+    public function setPassword($userDN, $password) {
+        if(intval($this->connection->turnOnPasswordChange) !== 1) {
+            throw new \Exception('LDAP password changes are disabled.');
+        }
+        $cr = $this->connection->getConnectionResource();
+        if(!$this->ldap->isResource($cr)) {
+            //LDAP not available
+            \OCP\Util::writeLog('user_ldap', 'LDAP resource not available.', \OCP\Util::DEBUG);
+            return false;
+        }
 		
-		try {
-			return $this->ldap->modReplace($cr, $userDN, $password);
-		} catch(ConstraintViolationException $e) {
-			throw new HintException('Password change rejected.', \OC::$server->getL10N('user_ldap')->t('Password change rejected. Hint: ').$e->getMessage(), $e->getCode());
-		}
-	}
-
-	/**
-	 * checks whether the given attributes value is probably a DN
-	 * @param string $attr the attribute in question
-	 * @return boolean if so true, otherwise false
-	 */
-	private function resemblesDN($attr) {
-		$resemblingAttributes = array(
-			'dn',
-			'uniquemember',
-			'member',
-			// memberOf is an "operational" attribute, without a definition in any RFC
-			'memberof'
-		);
-		return in_array($attr, $resemblingAttributes);
-	}
-
-	/**
-	 * checks whether the given string is probably a DN
-	 * @param string $string
-	 * @return boolean
-	 */
-	public function stringResemblesDN($string) {
-		$r = $this->ldap->explodeDN($string, 0);
-		// if exploding a DN succeeds and does not end up in
-		// an empty array except for $r[count] being 0.
-		return (is_array($r) && count($r) > 1);
-	}
-
-	/**
-	 * returns a DN-string that is cleaned from not domain parts, e.g.
-	 * cn=foo,cn=bar,dc=foobar,dc=server,dc=org
-	 * becomes dc=foobar,dc=server,dc=org
-	 * @param string $dn
-	 * @return string
-	 */
-	public function getDomainDNFromDN($dn) {
-		$allParts = $this->ldap->explodeDN($dn, 0);
-		if($allParts === false) {
-			//not a valid DN
-			return '';
-		}
-		$domainParts = array();
-		$dcFound = false;
-		foreach($allParts as $part) {
-			if(!$dcFound && strpos($part, 'dc=') === 0) {
-				$dcFound = true;
-			}
-			if($dcFound) {
-				$domainParts[] = $part;
-			}
-		}
-		$domainDN = implode(',', $domainParts);
-		return $domainDN;
-	}
-
-	/**
-	 * returns the LDAP DN for the given internal ownCloud name of the group
-	 * @param string $name the ownCloud name in question
-	 * @return string|false LDAP DN on success, otherwise false
-	 */
-	public function groupname2dn($name) {
-		return $this->groupMapper->getDNByName($name);
-	}
-
-	/**
-	 * returns the LDAP DN for the given internal ownCloud name of the user
-	 * @param string $name the ownCloud name in question
-	 * @return string|false with the LDAP DN on success, otherwise false
-	 */
-	public function username2dn($name) {
-		$fdn = $this->userMapper->getDNByName($name);
-
-		//Check whether the DN belongs to the Base, to avoid issues on multi-
-		//server setups
-		if(is_string($fdn) && $this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) {
-			return $fdn;
-		}
-
-		return false;
-	}
-
-	/**
-	 * returns the internal ownCloud name for the given LDAP DN of the group, false on DN outside of search DN or failure
-	 * @param string $fdn the dn of the group object
-	 * @param string $ldapName optional, the display name of the object
-	 * @return string|false with the name to use in ownCloud, false on DN outside of search DN
-	 */
-	public function dn2groupname($fdn, $ldapName = null) {
-		//To avoid bypassing the base DN settings under certain circumstances
-		//with the group support, check whether the provided DN matches one of
-		//the given Bases
-		if(!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseGroups)) {
-			return false;
-		}
-
-		return $this->dn2ocname($fdn, $ldapName, false);
-	}
-
-	/**
-	 * accepts an array of group DNs and tests whether they match the user
-	 * filter by doing read operations against the group entries. Returns an
-	 * array of DNs that match the filter.
-	 *
-	 * @param string[] $groupDNs
-	 * @return string[]
-	 */
-	public function groupsMatchFilter($groupDNs) {
-		$validGroupDNs = [];
-		foreach($groupDNs as $dn) {
-			$cacheKey = 'groupsMatchFilter-'.$dn;
-			$groupMatchFilter = $this->connection->getFromCache($cacheKey);
-			if(!is_null($groupMatchFilter)) {
-				if($groupMatchFilter) {
-					$validGroupDNs[] = $dn;
-				}
-				continue;
-			}
-
-			// Check the base DN first. If this is not met already, we don't
-			// need to ask the server at all.
-			if(!$this->isDNPartOfBase($dn, $this->connection->ldapBaseGroups)) {
-				$this->connection->writeToCache($cacheKey, false);
-				continue;
-			}
-
-			$result = $this->readAttribute($dn, 'cn', $this->connection->ldapGroupFilter);
-			if(is_array($result)) {
-				$this->connection->writeToCache($cacheKey, true);
-				$validGroupDNs[] = $dn;
-			} else {
-				$this->connection->writeToCache($cacheKey, false);
-			}
-
-		}
-		return $validGroupDNs;
-	}
-
-	/**
-	 * returns the internal ownCloud name for the given LDAP DN of the user, false on DN outside of search DN or failure
-	 * @param string $dn the dn of the user object
-	 * @param string $ldapName optional, the display name of the object
-	 * @return string|false with with the name to use in ownCloud
-	 */
-	public function dn2username($fdn, $ldapName = null) {
-		//To avoid bypassing the base DN settings under certain circumstances
-		//with the group support, check whether the provided DN matches one of
-		//the given Bases
-		if(!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) {
-			return false;
-		}
-
-		return $this->dn2ocname($fdn, $ldapName, true);
-	}
-
-	/**
-	 * returns an internal ownCloud name for the given LDAP DN, false on DN outside of search DN
-	 * @param string $dn the dn of the user object
-	 * @param string $ldapName optional, the display name of the object
-	 * @param bool $isUser optional, whether it is a user object (otherwise group assumed)
-	 * @return string|false with with the name to use in ownCloud
-	 */
-	public function dn2ocname($fdn, $ldapName = null, $isUser = true) {
-		if($isUser) {
-			$mapper = $this->getUserMapper();
-			$nameAttribute = $this->connection->ldapUserDisplayName;
-		} else {
-			$mapper = $this->getGroupMapper();
-			$nameAttribute = $this->connection->ldapGroupDisplayName;
-		}
-
-		//let's try to retrieve the ownCloud name from the mappings table
-		$ocName = $mapper->getNameByDN($fdn);
-		if(is_string($ocName)) {
-			return $ocName;
-		}
-
-		//second try: get the UUID and check if it is known. Then, update the DN and return the name.
-		$uuid = $this->getUUID($fdn, $isUser);
-		if(is_string($uuid)) {
-			$ocName = $mapper->getNameByUUID($uuid);
-			if(is_string($ocName)) {
-				$mapper->setDNbyUUID($fdn, $uuid);
-				return $ocName;
-			}
-		} else {
-			//If the UUID can't be detected something is foul.
-			\OCP\Util::writeLog('user_ldap', 'Cannot determine UUID for '.$fdn.'. Skipping.', \OCP\Util::INFO);
-			return false;
-		}
-
-		if(is_null($ldapName)) {
-			$ldapName = $this->readAttribute($fdn, $nameAttribute);
-			if(!isset($ldapName[0]) && empty($ldapName[0])) {
-				\OCP\Util::writeLog('user_ldap', 'No or empty name for '.$fdn.'.', \OCP\Util::INFO);
-				return false;
-			}
-			$ldapName = $ldapName[0];
-		}
-
-		if($isUser) {
-			$usernameAttribute = strval($this->connection->ldapExpertUsernameAttr);
-			if ($usernameAttribute !== '') {
-				$username = $this->readAttribute($fdn, $usernameAttribute);
-				$username = $username[0];
-			} else {
-				$username = $uuid;
-			}
-			$intName = $this->sanitizeUsername($username);
-		} else {
-			$intName = $ldapName;
-		}
-
-		//a new user/group! Add it only if it doesn't conflict with other backend's users or existing groups
-		//disabling Cache is required to avoid that the new user is cached as not-existing in fooExists check
-		//NOTE: mind, disabling cache affects only this instance! Using it
-		// outside of core user management will still cache the user as non-existing.
-		$originalTTL = $this->connection->ldapCacheTTL;
-		$this->connection->setConfiguration(array('ldapCacheTTL' => 0));
-		if(($isUser && !\OCP\User::userExists($intName))
-			|| (!$isUser && !\OC::$server->getGroupManager()->groupExists($intName))) {
-			if($mapper->map($fdn, $intName, $uuid)) {
-				$this->connection->setConfiguration(array('ldapCacheTTL' => $originalTTL));
-				return $intName;
-			}
-		}
-		$this->connection->setConfiguration(array('ldapCacheTTL' => $originalTTL));
-
-		$altName = $this->createAltInternalOwnCloudName($intName, $isUser);
-		if(is_string($altName) && $mapper->map($fdn, $altName, $uuid)) {
-			return $altName;
-		}
-
-		//if everything else did not help..
-		\OCP\Util::writeLog('user_ldap', 'Could not create unique name for '.$fdn.'.', \OCP\Util::INFO);
-		return false;
-	}
-
-	/**
-	 * gives back the user names as they are used ownClod internally
-	 * @param array $ldapUsers as returned by fetchList()
-	 * @return array an array with the user names to use in ownCloud
-	 *
-	 * gives back the user names as they are used ownClod internally
-	 */
-	public function ownCloudUserNames($ldapUsers) {
-		return $this->ldap2ownCloudNames($ldapUsers, true);
-	}
-
-	/**
-	 * gives back the group names as they are used ownClod internally
-	 * @param array $ldapGroups as returned by fetchList()
-	 * @return array an array with the group names to use in ownCloud
-	 *
-	 * gives back the group names as they are used ownClod internally
-	 */
-	public function ownCloudGroupNames($ldapGroups) {
-		return $this->ldap2ownCloudNames($ldapGroups, false);
-	}
-
-	/**
-	 * @param array $ldapObjects as returned by fetchList()
-	 * @param bool $isUsers
-	 * @return array
-	 */
-	private function ldap2ownCloudNames($ldapObjects, $isUsers) {
-		if($isUsers) {
-			$nameAttribute = $this->connection->ldapUserDisplayName;
-			$sndAttribute  = $this->connection->ldapUserDisplayName2;
-		} else {
-			$nameAttribute = $this->connection->ldapGroupDisplayName;
-		}
-		$ownCloudNames = array();
-
-		foreach($ldapObjects as $ldapObject) {
-			$nameByLDAP = null;
-			if(    isset($ldapObject[$nameAttribute])
-				&& is_array($ldapObject[$nameAttribute])
-				&& isset($ldapObject[$nameAttribute][0])
-			) {
-				// might be set, but not necessarily. if so, we use it.
-				$nameByLDAP = $ldapObject[$nameAttribute][0];
-			}
-
-			$ocName = $this->dn2ocname($ldapObject['dn'][0], $nameByLDAP, $isUsers);
-			if($ocName) {
-				$ownCloudNames[] = $ocName;
-				if($isUsers) {
-					//cache the user names so it does not need to be retrieved
-					//again later (e.g. sharing dialogue).
-					if(is_null($nameByLDAP)) {
-						continue;
-					}
-					$sndName = isset($ldapObject[$sndAttribute][0])
-						? $ldapObject[$sndAttribute][0] : '';
-					$this->cacheUserDisplayName($ocName, $nameByLDAP, $sndName);
-				}
-			}
-		}
-		return $ownCloudNames;
-	}
-
-	/**
-	 * caches the user display name
-	 * @param string $ocName the internal ownCloud username
-	 * @param string|false $home the home directory path
-	 */
-	public function cacheUserHome($ocName, $home) {
-		$cacheKey = 'getHome'.$ocName;
-		$this->connection->writeToCache($cacheKey, $home);
-	}
-
-	/**
-	 * caches a user as existing
-	 * @param string $ocName the internal ownCloud username
-	 */
-	public function cacheUserExists($ocName) {
-		$this->connection->writeToCache('userExists'.$ocName, true);
-	}
-
-	/**
-	 * caches the user display name
-	 * @param string $ocName the internal ownCloud username
-	 * @param string $displayName the display name
-	 * @param string $displayName2 the second display name
-	 */
-	public function cacheUserDisplayName($ocName, $displayName, $displayName2 = '') {
-		$user = $this->userManager->get($ocName);
-		if($user === null) {
-			return;
-		}
-		$displayName = $user->composeAndStoreDisplayName($displayName, $displayName2);
-		$cacheKeyTrunk = 'getDisplayName';
-		$this->connection->writeToCache($cacheKeyTrunk.$ocName, $displayName);
-	}
-
-	/**
-	 * creates a unique name for internal ownCloud use for users. Don't call it directly.
-	 * @param string $name the display name of the object
-	 * @return string|false with with the name to use in ownCloud or false if unsuccessful
-	 *
-	 * Instead of using this method directly, call
-	 * createAltInternalOwnCloudName($name, true)
-	 */
-	private function _createAltInternalOwnCloudNameForUsers($name) {
-		$attempts = 0;
-		//while loop is just a precaution. If a name is not generated within
-		//20 attempts, something else is very wrong. Avoids infinite loop.
-		while($attempts < 20){
-			$altName = $name . '_' . rand(1000,9999);
-			if(!\OCP\User::userExists($altName)) {
-				return $altName;
-			}
-			$attempts++;
-		}
-		return false;
-	}
-
-	/**
-	 * creates a unique name for internal ownCloud use for groups. Don't call it directly.
-	 * @param string $name the display name of the object
-	 * @return string|false with with the name to use in ownCloud or false if unsuccessful.
-	 *
-	 * Instead of using this method directly, call
-	 * createAltInternalOwnCloudName($name, false)
-	 *
-	 * Group names are also used as display names, so we do a sequential
-	 * numbering, e.g. Developers_42 when there are 41 other groups called
-	 * "Developers"
-	 */
-	private function _createAltInternalOwnCloudNameForGroups($name) {
-		$usedNames = $this->groupMapper->getNamesBySearch($name, "", '_%');
-		if(!($usedNames) || count($usedNames) === 0) {
-			$lastNo = 1; //will become name_2
-		} else {
-			natsort($usedNames);
-			$lastName = array_pop($usedNames);
-			$lastNo = intval(substr($lastName, strrpos($lastName, '_') + 1));
-		}
-		$altName = $name.'_'.strval($lastNo+1);
-		unset($usedNames);
-
-		$attempts = 1;
-		while($attempts < 21){
-			// Check to be really sure it is unique
-			// while loop is just a precaution. If a name is not generated within
-			// 20 attempts, something else is very wrong. Avoids infinite loop.
-			if(!\OC::$server->getGroupManager()->groupExists($altName)) {
-				return $altName;
-			}
-			$altName = $name . '_' . ($lastNo + $attempts);
-			$attempts++;
-		}
-		return false;
-	}
-
-	/**
-	 * creates a unique name for internal ownCloud use.
-	 * @param string $name the display name of the object
-	 * @param boolean $isUser whether name should be created for a user (true) or a group (false)
-	 * @return string|false with with the name to use in ownCloud or false if unsuccessful
-	 */
-	private function createAltInternalOwnCloudName($name, $isUser) {
-		$originalTTL = $this->connection->ldapCacheTTL;
-		$this->connection->setConfiguration(array('ldapCacheTTL' => 0));
-		if($isUser) {
-			$altName = $this->_createAltInternalOwnCloudNameForUsers($name);
-		} else {
-			$altName = $this->_createAltInternalOwnCloudNameForGroups($name);
-		}
-		$this->connection->setConfiguration(array('ldapCacheTTL' => $originalTTL));
-
-		return $altName;
-	}
-
-	/**
-	 * fetches a list of users according to a provided loginName and utilizing
-	 * the login filter.
-	 *
-	 * @param string $loginName
-	 * @param array $attributes optional, list of attributes to read
-	 * @return array
-	 */
-	public function fetchUsersByLoginName($loginName, $attributes = array('dn')) {
-		$loginName = $this->escapeFilterPart($loginName);
-		$filter = str_replace('%uid', $loginName, $this->connection->ldapLoginFilter);
-		$users = $this->fetchListOfUsers($filter, $attributes);
-		return $users;
-	}
-
-	/**
-	 * counts the number of users according to a provided loginName and
-	 * utilizing the login filter.
-	 *
-	 * @param string $loginName
-	 * @return array
-	 */
-	public function countUsersByLoginName($loginName) {
-		$loginName = $this->escapeFilterPart($loginName);
-		$filter = str_replace('%uid', $loginName, $this->connection->ldapLoginFilter);
-		$users = $this->countUsers($filter);
-		return $users;
-	}
-
-	/**
-	 * @param string $filter
-	 * @param string|string[] $attr
-	 * @param int $limit
-	 * @param int $offset
-	 * @return array
-	 */
-	public function fetchListOfUsers($filter, $attr, $limit = null, $offset = null) {
-		$ldapRecords = $this->searchUsers($filter, $attr, $limit, $offset);
-		$this->batchApplyUserAttributes($ldapRecords);
-		return $this->fetchList($ldapRecords, (count($attr) > 1));
-	}
-
-	/**
-	 * provided with an array of LDAP user records the method will fetch the
-	 * user object and requests it to process the freshly fetched attributes and
-	 * and their values
-	 * @param array $ldapRecords
-	 */
-	public function batchApplyUserAttributes(array $ldapRecords){
-		$displayNameAttribute = strtolower($this->connection->ldapUserDisplayName);
-		foreach($ldapRecords as $userRecord) {
-			if(!isset($userRecord[$displayNameAttribute])) {
-				// displayName is obligatory
-				continue;
-			}
-			$ocName  = $this->dn2ocname($userRecord['dn'][0]);
-			if($ocName === false) {
-				continue;
-			}
-			$this->cacheUserExists($ocName);
-			$user = $this->userManager->get($ocName);
-			if($user instanceof OfflineUser) {
-				$user->unmark();
-				$user = $this->userManager->get($ocName);
-			}
-			if ($user !== null) {
-				$user->processAttributes($userRecord);
-			} else {
-				\OC::$server->getLogger()->debug(
-					"The ldap user manager returned null for $ocName",
-					['app'=>'user_ldap']
-				);
-			}
-		}
-	}
-
-	/**
-	 * @param string $filter
-	 * @param string|string[] $attr
-	 * @param int $limit
-	 * @param int $offset
-	 * @return array
-	 */
-	public function fetchListOfGroups($filter, $attr, $limit = null, $offset = null) {
-		return $this->fetchList($this->searchGroups($filter, $attr, $limit, $offset), (count($attr) > 1));
-	}
-
-	/**
-	 * @param array $list
-	 * @param bool $manyAttributes
-	 * @return array
-	 */
-	private function fetchList($list, $manyAttributes) {
-		if(is_array($list)) {
-			if($manyAttributes) {
-				return $list;
-			} else {
-				$list = array_reduce($list, function($carry, $item) {
-					$attribute = array_keys($item)[0];
-					$carry[] = $item[$attribute][0];
-					return $carry;
-				}, array());
-				return array_unique($list, SORT_LOCALE_STRING);
-			}
-		}
-
-		//error cause actually, maybe throw an exception in future.
-		return array();
-	}
-
-	/**
-	 * executes an LDAP search, optimized for Users
-	 * @param string $filter the LDAP filter for the search
-	 * @param string|string[] $attr optional, when a certain attribute shall be filtered out
-	 * @param integer $limit
-	 * @param integer $offset
-	 * @return array with the search result
-	 *
-	 * Executes an LDAP search
-	 */
-	public function searchUsers($filter, $attr = null, $limit = null, $offset = null) {
-		return $this->search($filter, $this->connection->ldapBaseUsers, $attr, $limit, $offset);
-	}
-
-	/**
-	 * @param string $filter
-	 * @param string|string[] $attr
-	 * @param int $limit
-	 * @param int $offset
-	 * @return false|int
-	 */
-	public function countUsers($filter, $attr = array('dn'), $limit = null, $offset = null) {
-		return $this->count($filter, $this->connection->ldapBaseUsers, $attr, $limit, $offset);
-	}
-
-	/**
-	 * executes an LDAP search, optimized for Groups
-	 * @param string $filter the LDAP filter for the search
-	 * @param string|string[] $attr optional, when a certain attribute shall be filtered out
-	 * @param integer $limit
-	 * @param integer $offset
-	 * @return array with the search result
-	 *
-	 * Executes an LDAP search
-	 */
-	public function searchGroups($filter, $attr = null, $limit = null, $offset = null) {
-		return $this->search($filter, $this->connection->ldapBaseGroups, $attr, $limit, $offset);
-	}
-
-	/**
-	 * returns the number of available groups
-	 * @param string $filter the LDAP search filter
-	 * @param string[] $attr optional
-	 * @param int|null $limit
-	 * @param int|null $offset
-	 * @return int|bool
-	 */
-	public function countGroups($filter, $attr = array('dn'), $limit = null, $offset = null) {
-		return $this->count($filter, $this->connection->ldapBaseGroups, $attr, $limit, $offset);
-	}
-
-	/**
-	 * returns the number of available objects on the base DN
-	 *
-	 * @param int|null $limit
-	 * @param int|null $offset
-	 * @return int|bool
-	 */
-	public function countObjects($limit = null, $offset = null) {
-		return $this->count('objectclass=*', $this->connection->ldapBase, array('dn'), $limit, $offset);
-	}
-
-	/**
-	 * retrieved. Results will according to the order in the array.
-	 * @param int $limit optional, maximum results to be counted
-	 * @param int $offset optional, a starting point
-	 * @return array|false array with the search result as first value and pagedSearchOK as
-	 * second | false if not successful
-	 */
-	private function executeSearch($filter, $base, &$attr = null, $limit = null, $offset = null) {
-		if(!is_null($attr) && !is_array($attr)) {
-			$attr = array(mb_strtolower($attr, 'UTF-8'));
-		}
-
-		// See if we have a resource, in case not cancel with message
-		$cr = $this->connection->getConnectionResource();
-		if(!$this->ldap->isResource($cr)) {
-			// Seems like we didn't find any resource.
-			// Return an empty array just like before.
-			\OCP\Util::writeLog('user_ldap', 'Could not search, because resource is missing.', \OCP\Util::DEBUG);
-			return false;
-		}
-
-		//check whether paged search should be attempted
-		$pagedSearchOK = $this->initPagedSearch($filter, $base, $attr, intval($limit), $offset);
-
-		$linkResources = array_pad(array(), count($base), $cr);
-		$sr = $this->ldap->search($linkResources, $base, $filter, $attr);
-		$error = $this->ldap->errno($cr);
-		if(!is_array($sr) || $error !== 0) {
-			\OCP\Util::writeLog('user_ldap', 'Attempt for Paging?  '.print_r($pagedSearchOK, true), \OCP\Util::ERROR);
-			return false;
-		}
-
-		return array($sr, $pagedSearchOK);
-	}
-
-	/**
-	 * processes an LDAP paged search operation
-	 * @param array $sr the array containing the LDAP search resources
-	 * @param string $filter the LDAP filter for the search
-	 * @param array $base an array containing the LDAP subtree(s) that shall be searched
-	 * @param int $iFoundItems number of results in the search operation
-	 * @param int $limit maximum results to be counted
-	 * @param int $offset a starting point
-	 * @param bool $pagedSearchOK whether a paged search has been executed
-	 * @param bool $skipHandling required for paged search when cookies to
-	 * prior results need to be gained
-	 * @return bool cookie validity, true if we have more pages, false otherwise.
-	 */
-	private function processPagedSearchStatus($sr, $filter, $base, $iFoundItems, $limit, $offset, $pagedSearchOK, $skipHandling) {
-		$cookie = null;
-		if($pagedSearchOK) {
-			$cr = $this->connection->getConnectionResource();
-			foreach($sr as $key => $res) {
-				if($this->ldap->controlPagedResultResponse($cr, $res, $cookie)) {
-					$this->setPagedResultCookie($base[$key], $filter, $limit, $offset, $cookie);
-				}
-			}
-
-			//browsing through prior pages to get the cookie for the new one
-			if($skipHandling) {
-				return false;
-			}
-			// if count is bigger, then the server does not support
-			// paged search. Instead, he did a normal search. We set a
-			// flag here, so the callee knows how to deal with it.
-			if($iFoundItems <= $limit) {
-				$this->pagedSearchedSuccessful = true;
-			}
-		} else {
-			if(!is_null($limit)) {
-				\OCP\Util::writeLog('user_ldap', 'Paged search was not available', \OCP\Util::INFO);
-			}
-		}
-		/* ++ Fixing RHDS searches with pages with zero results ++
+        try {
+            return $this->ldap->modReplace($cr, $userDN, $password);
+        } catch(ConstraintViolationException $e) {
+            throw new HintException('Password change rejected.', \OC::$server->getL10N('user_ldap')->t('Password change rejected. Hint: ').$e->getMessage(), $e->getCode());
+        }
+    }
+
+    /**
+     * checks whether the given attributes value is probably a DN
+     * @param string $attr the attribute in question
+     * @return boolean if so true, otherwise false
+     */
+    private function resemblesDN($attr) {
+        $resemblingAttributes = array(
+            'dn',
+            'uniquemember',
+            'member',
+            // memberOf is an "operational" attribute, without a definition in any RFC
+            'memberof'
+        );
+        return in_array($attr, $resemblingAttributes);
+    }
+
+    /**
+     * checks whether the given string is probably a DN
+     * @param string $string
+     * @return boolean
+     */
+    public function stringResemblesDN($string) {
+        $r = $this->ldap->explodeDN($string, 0);
+        // if exploding a DN succeeds and does not end up in
+        // an empty array except for $r[count] being 0.
+        return (is_array($r) && count($r) > 1);
+    }
+
+    /**
+     * returns a DN-string that is cleaned from not domain parts, e.g.
+     * cn=foo,cn=bar,dc=foobar,dc=server,dc=org
+     * becomes dc=foobar,dc=server,dc=org
+     * @param string $dn
+     * @return string
+     */
+    public function getDomainDNFromDN($dn) {
+        $allParts = $this->ldap->explodeDN($dn, 0);
+        if($allParts === false) {
+            //not a valid DN
+            return '';
+        }
+        $domainParts = array();
+        $dcFound = false;
+        foreach($allParts as $part) {
+            if(!$dcFound && strpos($part, 'dc=') === 0) {
+                $dcFound = true;
+            }
+            if($dcFound) {
+                $domainParts[] = $part;
+            }
+        }
+        $domainDN = implode(',', $domainParts);
+        return $domainDN;
+    }
+
+    /**
+     * returns the LDAP DN for the given internal ownCloud name of the group
+     * @param string $name the ownCloud name in question
+     * @return string|false LDAP DN on success, otherwise false
+     */
+    public function groupname2dn($name) {
+        return $this->groupMapper->getDNByName($name);
+    }
+
+    /**
+     * returns the LDAP DN for the given internal ownCloud name of the user
+     * @param string $name the ownCloud name in question
+     * @return string|false with the LDAP DN on success, otherwise false
+     */
+    public function username2dn($name) {
+        $fdn = $this->userMapper->getDNByName($name);
+
+        //Check whether the DN belongs to the Base, to avoid issues on multi-
+        //server setups
+        if(is_string($fdn) && $this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) {
+            return $fdn;
+        }
+
+        return false;
+    }
+
+    /**
+     * returns the internal ownCloud name for the given LDAP DN of the group, false on DN outside of search DN or failure
+     * @param string $fdn the dn of the group object
+     * @param string $ldapName optional, the display name of the object
+     * @return string|false with the name to use in ownCloud, false on DN outside of search DN
+     */
+    public function dn2groupname($fdn, $ldapName = null) {
+        //To avoid bypassing the base DN settings under certain circumstances
+        //with the group support, check whether the provided DN matches one of
+        //the given Bases
+        if(!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseGroups)) {
+            return false;
+        }
+
+        return $this->dn2ocname($fdn, $ldapName, false);
+    }
+
+    /**
+     * accepts an array of group DNs and tests whether they match the user
+     * filter by doing read operations against the group entries. Returns an
+     * array of DNs that match the filter.
+     *
+     * @param string[] $groupDNs
+     * @return string[]
+     */
+    public function groupsMatchFilter($groupDNs) {
+        $validGroupDNs = [];
+        foreach($groupDNs as $dn) {
+            $cacheKey = 'groupsMatchFilter-'.$dn;
+            $groupMatchFilter = $this->connection->getFromCache($cacheKey);
+            if(!is_null($groupMatchFilter)) {
+                if($groupMatchFilter) {
+                    $validGroupDNs[] = $dn;
+                }
+                continue;
+            }
+
+            // Check the base DN first. If this is not met already, we don't
+            // need to ask the server at all.
+            if(!$this->isDNPartOfBase($dn, $this->connection->ldapBaseGroups)) {
+                $this->connection->writeToCache($cacheKey, false);
+                continue;
+            }
+
+            $result = $this->readAttribute($dn, 'cn', $this->connection->ldapGroupFilter);
+            if(is_array($result)) {
+                $this->connection->writeToCache($cacheKey, true);
+                $validGroupDNs[] = $dn;
+            } else {
+                $this->connection->writeToCache($cacheKey, false);
+            }
+
+        }
+        return $validGroupDNs;
+    }
+
+    /**
+     * returns the internal ownCloud name for the given LDAP DN of the user, false on DN outside of search DN or failure
+     * @param string $dn the dn of the user object
+     * @param string $ldapName optional, the display name of the object
+     * @return string|false with with the name to use in ownCloud
+     */
+    public function dn2username($fdn, $ldapName = null) {
+        //To avoid bypassing the base DN settings under certain circumstances
+        //with the group support, check whether the provided DN matches one of
+        //the given Bases
+        if(!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) {
+            return false;
+        }
+
+        return $this->dn2ocname($fdn, $ldapName, true);
+    }
+
+    /**
+     * returns an internal ownCloud name for the given LDAP DN, false on DN outside of search DN
+     * @param string $dn the dn of the user object
+     * @param string $ldapName optional, the display name of the object
+     * @param bool $isUser optional, whether it is a user object (otherwise group assumed)
+     * @return string|false with with the name to use in ownCloud
+     */
+    public function dn2ocname($fdn, $ldapName = null, $isUser = true) {
+        if($isUser) {
+            $mapper = $this->getUserMapper();
+            $nameAttribute = $this->connection->ldapUserDisplayName;
+        } else {
+            $mapper = $this->getGroupMapper();
+            $nameAttribute = $this->connection->ldapGroupDisplayName;
+        }
+
+        //let's try to retrieve the ownCloud name from the mappings table
+        $ocName = $mapper->getNameByDN($fdn);
+        if(is_string($ocName)) {
+            return $ocName;
+        }
+
+        //second try: get the UUID and check if it is known. Then, update the DN and return the name.
+        $uuid = $this->getUUID($fdn, $isUser);
+        if(is_string($uuid)) {
+            $ocName = $mapper->getNameByUUID($uuid);
+            if(is_string($ocName)) {
+                $mapper->setDNbyUUID($fdn, $uuid);
+                return $ocName;
+            }
+        } else {
+            //If the UUID can't be detected something is foul.
+            \OCP\Util::writeLog('user_ldap', 'Cannot determine UUID for '.$fdn.'. Skipping.', \OCP\Util::INFO);
+            return false;
+        }
+
+        if(is_null($ldapName)) {
+            $ldapName = $this->readAttribute($fdn, $nameAttribute);
+            if(!isset($ldapName[0]) && empty($ldapName[0])) {
+                \OCP\Util::writeLog('user_ldap', 'No or empty name for '.$fdn.'.', \OCP\Util::INFO);
+                return false;
+            }
+            $ldapName = $ldapName[0];
+        }
+
+        if($isUser) {
+            $usernameAttribute = strval($this->connection->ldapExpertUsernameAttr);
+            if ($usernameAttribute !== '') {
+                $username = $this->readAttribute($fdn, $usernameAttribute);
+                $username = $username[0];
+            } else {
+                $username = $uuid;
+            }
+            $intName = $this->sanitizeUsername($username);
+        } else {
+            $intName = $ldapName;
+        }
+
+        //a new user/group! Add it only if it doesn't conflict with other backend's users or existing groups
+        //disabling Cache is required to avoid that the new user is cached as not-existing in fooExists check
+        //NOTE: mind, disabling cache affects only this instance! Using it
+        // outside of core user management will still cache the user as non-existing.
+        $originalTTL = $this->connection->ldapCacheTTL;
+        $this->connection->setConfiguration(array('ldapCacheTTL' => 0));
+        if(($isUser && !\OCP\User::userExists($intName))
+            || (!$isUser && !\OC::$server->getGroupManager()->groupExists($intName))) {
+            if($mapper->map($fdn, $intName, $uuid)) {
+                $this->connection->setConfiguration(array('ldapCacheTTL' => $originalTTL));
+                return $intName;
+            }
+        }
+        $this->connection->setConfiguration(array('ldapCacheTTL' => $originalTTL));
+
+        $altName = $this->createAltInternalOwnCloudName($intName, $isUser);
+        if(is_string($altName) && $mapper->map($fdn, $altName, $uuid)) {
+            return $altName;
+        }
+
+        //if everything else did not help..
+        \OCP\Util::writeLog('user_ldap', 'Could not create unique name for '.$fdn.'.', \OCP\Util::INFO);
+        return false;
+    }
+
+    /**
+     * gives back the user names as they are used ownClod internally
+     * @param array $ldapUsers as returned by fetchList()
+     * @return array an array with the user names to use in ownCloud
+     *
+     * gives back the user names as they are used ownClod internally
+     */
+    public function ownCloudUserNames($ldapUsers) {
+        return $this->ldap2ownCloudNames($ldapUsers, true);
+    }
+
+    /**
+     * gives back the group names as they are used ownClod internally
+     * @param array $ldapGroups as returned by fetchList()
+     * @return array an array with the group names to use in ownCloud
+     *
+     * gives back the group names as they are used ownClod internally
+     */
+    public function ownCloudGroupNames($ldapGroups) {
+        return $this->ldap2ownCloudNames($ldapGroups, false);
+    }
+
+    /**
+     * @param array $ldapObjects as returned by fetchList()
+     * @param bool $isUsers
+     * @return array
+     */
+    private function ldap2ownCloudNames($ldapObjects, $isUsers) {
+        if($isUsers) {
+            $nameAttribute = $this->connection->ldapUserDisplayName;
+            $sndAttribute  = $this->connection->ldapUserDisplayName2;
+        } else {
+            $nameAttribute = $this->connection->ldapGroupDisplayName;
+        }
+        $ownCloudNames = array();
+
+        foreach($ldapObjects as $ldapObject) {
+            $nameByLDAP = null;
+            if(    isset($ldapObject[$nameAttribute])
+                && is_array($ldapObject[$nameAttribute])
+                && isset($ldapObject[$nameAttribute][0])
+            ) {
+                // might be set, but not necessarily. if so, we use it.
+                $nameByLDAP = $ldapObject[$nameAttribute][0];
+            }
+
+            $ocName = $this->dn2ocname($ldapObject['dn'][0], $nameByLDAP, $isUsers);
+            if($ocName) {
+                $ownCloudNames[] = $ocName;
+                if($isUsers) {
+                    //cache the user names so it does not need to be retrieved
+                    //again later (e.g. sharing dialogue).
+                    if(is_null($nameByLDAP)) {
+                        continue;
+                    }
+                    $sndName = isset($ldapObject[$sndAttribute][0])
+                        ? $ldapObject[$sndAttribute][0] : '';
+                    $this->cacheUserDisplayName($ocName, $nameByLDAP, $sndName);
+                }
+            }
+        }
+        return $ownCloudNames;
+    }
+
+    /**
+     * caches the user display name
+     * @param string $ocName the internal ownCloud username
+     * @param string|false $home the home directory path
+     */
+    public function cacheUserHome($ocName, $home) {
+        $cacheKey = 'getHome'.$ocName;
+        $this->connection->writeToCache($cacheKey, $home);
+    }
+
+    /**
+     * caches a user as existing
+     * @param string $ocName the internal ownCloud username
+     */
+    public function cacheUserExists($ocName) {
+        $this->connection->writeToCache('userExists'.$ocName, true);
+    }
+
+    /**
+     * caches the user display name
+     * @param string $ocName the internal ownCloud username
+     * @param string $displayName the display name
+     * @param string $displayName2 the second display name
+     */
+    public function cacheUserDisplayName($ocName, $displayName, $displayName2 = '') {
+        $user = $this->userManager->get($ocName);
+        if($user === null) {
+            return;
+        }
+        $displayName = $user->composeAndStoreDisplayName($displayName, $displayName2);
+        $cacheKeyTrunk = 'getDisplayName';
+        $this->connection->writeToCache($cacheKeyTrunk.$ocName, $displayName);
+    }
+
+    /**
+     * creates a unique name for internal ownCloud use for users. Don't call it directly.
+     * @param string $name the display name of the object
+     * @return string|false with with the name to use in ownCloud or false if unsuccessful
+     *
+     * Instead of using this method directly, call
+     * createAltInternalOwnCloudName($name, true)
+     */
+    private function _createAltInternalOwnCloudNameForUsers($name) {
+        $attempts = 0;
+        //while loop is just a precaution. If a name is not generated within
+        //20 attempts, something else is very wrong. Avoids infinite loop.
+        while($attempts < 20){
+            $altName = $name . '_' . rand(1000,9999);
+            if(!\OCP\User::userExists($altName)) {
+                return $altName;
+            }
+            $attempts++;
+        }
+        return false;
+    }
+
+    /**
+     * creates a unique name for internal ownCloud use for groups. Don't call it directly.
+     * @param string $name the display name of the object
+     * @return string|false with with the name to use in ownCloud or false if unsuccessful.
+     *
+     * Instead of using this method directly, call
+     * createAltInternalOwnCloudName($name, false)
+     *
+     * Group names are also used as display names, so we do a sequential
+     * numbering, e.g. Developers_42 when there are 41 other groups called
+     * "Developers"
+     */
+    private function _createAltInternalOwnCloudNameForGroups($name) {
+        $usedNames = $this->groupMapper->getNamesBySearch($name, "", '_%');
+        if(!($usedNames) || count($usedNames) === 0) {
+            $lastNo = 1; //will become name_2
+        } else {
+            natsort($usedNames);
+            $lastName = array_pop($usedNames);
+            $lastNo = intval(substr($lastName, strrpos($lastName, '_') + 1));
+        }
+        $altName = $name.'_'.strval($lastNo+1);
+        unset($usedNames);
+
+        $attempts = 1;
+        while($attempts < 21){
+            // Check to be really sure it is unique
+            // while loop is just a precaution. If a name is not generated within
+            // 20 attempts, something else is very wrong. Avoids infinite loop.
+            if(!\OC::$server->getGroupManager()->groupExists($altName)) {
+                return $altName;
+            }
+            $altName = $name . '_' . ($lastNo + $attempts);
+            $attempts++;
+        }
+        return false;
+    }
+
+    /**
+     * creates a unique name for internal ownCloud use.
+     * @param string $name the display name of the object
+     * @param boolean $isUser whether name should be created for a user (true) or a group (false)
+     * @return string|false with with the name to use in ownCloud or false if unsuccessful
+     */
+    private function createAltInternalOwnCloudName($name, $isUser) {
+        $originalTTL = $this->connection->ldapCacheTTL;
+        $this->connection->setConfiguration(array('ldapCacheTTL' => 0));
+        if($isUser) {
+            $altName = $this->_createAltInternalOwnCloudNameForUsers($name);
+        } else {
+            $altName = $this->_createAltInternalOwnCloudNameForGroups($name);
+        }
+        $this->connection->setConfiguration(array('ldapCacheTTL' => $originalTTL));
+
+        return $altName;
+    }
+
+    /**
+     * fetches a list of users according to a provided loginName and utilizing
+     * the login filter.
+     *
+     * @param string $loginName
+     * @param array $attributes optional, list of attributes to read
+     * @return array
+     */
+    public function fetchUsersByLoginName($loginName, $attributes = array('dn')) {
+        $loginName = $this->escapeFilterPart($loginName);
+        $filter = str_replace('%uid', $loginName, $this->connection->ldapLoginFilter);
+        $users = $this->fetchListOfUsers($filter, $attributes);
+        return $users;
+    }
+
+    /**
+     * counts the number of users according to a provided loginName and
+     * utilizing the login filter.
+     *
+     * @param string $loginName
+     * @return array
+     */
+    public function countUsersByLoginName($loginName) {
+        $loginName = $this->escapeFilterPart($loginName);
+        $filter = str_replace('%uid', $loginName, $this->connection->ldapLoginFilter);
+        $users = $this->countUsers($filter);
+        return $users;
+    }
+
+    /**
+     * @param string $filter
+     * @param string|string[] $attr
+     * @param int $limit
+     * @param int $offset
+     * @return array
+     */
+    public function fetchListOfUsers($filter, $attr, $limit = null, $offset = null) {
+        $ldapRecords = $this->searchUsers($filter, $attr, $limit, $offset);
+        $this->batchApplyUserAttributes($ldapRecords);
+        return $this->fetchList($ldapRecords, (count($attr) > 1));
+    }
+
+    /**
+     * provided with an array of LDAP user records the method will fetch the
+     * user object and requests it to process the freshly fetched attributes and
+     * and their values
+     * @param array $ldapRecords
+     */
+    public function batchApplyUserAttributes(array $ldapRecords){
+        $displayNameAttribute = strtolower($this->connection->ldapUserDisplayName);
+        foreach($ldapRecords as $userRecord) {
+            if(!isset($userRecord[$displayNameAttribute])) {
+                // displayName is obligatory
+                continue;
+            }
+            $ocName  = $this->dn2ocname($userRecord['dn'][0]);
+            if($ocName === false) {
+                continue;
+            }
+            $this->cacheUserExists($ocName);
+            $user = $this->userManager->get($ocName);
+            if($user instanceof OfflineUser) {
+                $user->unmark();
+                $user = $this->userManager->get($ocName);
+            }
+            if ($user !== null) {
+                $user->processAttributes($userRecord);
+            } else {
+                \OC::$server->getLogger()->debug(
+                    "The ldap user manager returned null for $ocName",
+                    ['app'=>'user_ldap']
+                );
+            }
+        }
+    }
+
+    /**
+     * @param string $filter
+     * @param string|string[] $attr
+     * @param int $limit
+     * @param int $offset
+     * @return array
+     */
+    public function fetchListOfGroups($filter, $attr, $limit = null, $offset = null) {
+        return $this->fetchList($this->searchGroups($filter, $attr, $limit, $offset), (count($attr) > 1));
+    }
+
+    /**
+     * @param array $list
+     * @param bool $manyAttributes
+     * @return array
+     */
+    private function fetchList($list, $manyAttributes) {
+        if(is_array($list)) {
+            if($manyAttributes) {
+                return $list;
+            } else {
+                $list = array_reduce($list, function($carry, $item) {
+                    $attribute = array_keys($item)[0];
+                    $carry[] = $item[$attribute][0];
+                    return $carry;
+                }, array());
+                return array_unique($list, SORT_LOCALE_STRING);
+            }
+        }
+
+        //error cause actually, maybe throw an exception in future.
+        return array();
+    }
+
+    /**
+     * executes an LDAP search, optimized for Users
+     * @param string $filter the LDAP filter for the search
+     * @param string|string[] $attr optional, when a certain attribute shall be filtered out
+     * @param integer $limit
+     * @param integer $offset
+     * @return array with the search result
+     *
+     * Executes an LDAP search
+     */
+    public function searchUsers($filter, $attr = null, $limit = null, $offset = null) {
+        return $this->search($filter, $this->connection->ldapBaseUsers, $attr, $limit, $offset);
+    }
+
+    /**
+     * @param string $filter
+     * @param string|string[] $attr
+     * @param int $limit
+     * @param int $offset
+     * @return false|int
+     */
+    public function countUsers($filter, $attr = array('dn'), $limit = null, $offset = null) {
+        return $this->count($filter, $this->connection->ldapBaseUsers, $attr, $limit, $offset);
+    }
+
+    /**
+     * executes an LDAP search, optimized for Groups
+     * @param string $filter the LDAP filter for the search
+     * @param string|string[] $attr optional, when a certain attribute shall be filtered out
+     * @param integer $limit
+     * @param integer $offset
+     * @return array with the search result
+     *
+     * Executes an LDAP search
+     */
+    public function searchGroups($filter, $attr = null, $limit = null, $offset = null) {
+        return $this->search($filter, $this->connection->ldapBaseGroups, $attr, $limit, $offset);
+    }
+
+    /**
+     * returns the number of available groups
+     * @param string $filter the LDAP search filter
+     * @param string[] $attr optional
+     * @param int|null $limit
+     * @param int|null $offset
+     * @return int|bool
+     */
+    public function countGroups($filter, $attr = array('dn'), $limit = null, $offset = null) {
+        return $this->count($filter, $this->connection->ldapBaseGroups, $attr, $limit, $offset);
+    }
+
+    /**
+     * returns the number of available objects on the base DN
+     *
+     * @param int|null $limit
+     * @param int|null $offset
+     * @return int|bool
+     */
+    public function countObjects($limit = null, $offset = null) {
+        return $this->count('objectclass=*', $this->connection->ldapBase, array('dn'), $limit, $offset);
+    }
+
+    /**
+     * retrieved. Results will according to the order in the array.
+     * @param int $limit optional, maximum results to be counted
+     * @param int $offset optional, a starting point
+     * @return array|false array with the search result as first value and pagedSearchOK as
+     * second | false if not successful
+     */
+    private function executeSearch($filter, $base, &$attr = null, $limit = null, $offset = null) {
+        if(!is_null($attr) && !is_array($attr)) {
+            $attr = array(mb_strtolower($attr, 'UTF-8'));
+        }
+
+        // See if we have a resource, in case not cancel with message
+        $cr = $this->connection->getConnectionResource();
+        if(!$this->ldap->isResource($cr)) {
+            // Seems like we didn't find any resource.
+            // Return an empty array just like before.
+            \OCP\Util::writeLog('user_ldap', 'Could not search, because resource is missing.', \OCP\Util::DEBUG);
+            return false;
+        }
+
+        //check whether paged search should be attempted
+        $pagedSearchOK = $this->initPagedSearch($filter, $base, $attr, intval($limit), $offset);
+
+        $linkResources = array_pad(array(), count($base), $cr);
+        $sr = $this->ldap->search($linkResources, $base, $filter, $attr);
+        $error = $this->ldap->errno($cr);
+        if(!is_array($sr) || $error !== 0) {
+            \OCP\Util::writeLog('user_ldap', 'Attempt for Paging?  '.print_r($pagedSearchOK, true), \OCP\Util::ERROR);
+            return false;
+        }
+
+        return array($sr, $pagedSearchOK);
+    }
+
+    /**
+     * processes an LDAP paged search operation
+     * @param array $sr the array containing the LDAP search resources
+     * @param string $filter the LDAP filter for the search
+     * @param array $base an array containing the LDAP subtree(s) that shall be searched
+     * @param int $iFoundItems number of results in the search operation
+     * @param int $limit maximum results to be counted
+     * @param int $offset a starting point
+     * @param bool $pagedSearchOK whether a paged search has been executed
+     * @param bool $skipHandling required for paged search when cookies to
+     * prior results need to be gained
+     * @return bool cookie validity, true if we have more pages, false otherwise.
+     */
+    private function processPagedSearchStatus($sr, $filter, $base, $iFoundItems, $limit, $offset, $pagedSearchOK, $skipHandling) {
+        $cookie = null;
+        if($pagedSearchOK) {
+            $cr = $this->connection->getConnectionResource();
+            foreach($sr as $key => $res) {
+                if($this->ldap->controlPagedResultResponse($cr, $res, $cookie)) {
+                    $this->setPagedResultCookie($base[$key], $filter, $limit, $offset, $cookie);
+                }
+            }
+
+            //browsing through prior pages to get the cookie for the new one
+            if($skipHandling) {
+                return false;
+            }
+            // if count is bigger, then the server does not support
+            // paged search. Instead, he did a normal search. We set a
+            // flag here, so the callee knows how to deal with it.
+            if($iFoundItems <= $limit) {
+                $this->pagedSearchedSuccessful = true;
+            }
+        } else {
+            if(!is_null($limit)) {
+                \OCP\Util::writeLog('user_ldap', 'Paged search was not available', \OCP\Util::INFO);
+            }
+        }
+        /* ++ Fixing RHDS searches with pages with zero results ++
 		 * Return cookie status. If we don't have more pages, with RHDS
 		 * cookie is null, with openldap cookie is an empty string and
 		 * to 386ds '0' is a valid cookie. Even if $iFoundItems == 0
 		 */
-		return !empty($cookie) || $cookie === '0';
-	}
-
-	/**
-	 * executes an LDAP search, but counts the results only
-	 * @param string $filter the LDAP filter for the search
-	 * @param array $base an array containing the LDAP subtree(s) that shall be searched
-	 * @param string|string[] $attr optional, array, one or more attributes that shall be
-	 * retrieved. Results will according to the order in the array.
-	 * @param int $limit optional, maximum results to be counted
-	 * @param int $offset optional, a starting point
-	 * @param bool $skipHandling indicates whether the pages search operation is
-	 * completed
-	 * @return int|false Integer or false if the search could not be initialized
-	 *
-	 */
-	private function count($filter, $base, $attr = null, $limit = null, $offset = null, $skipHandling = false) {
-		\OCP\Util::writeLog('user_ldap', 'Count filter:  '.print_r($filter, true), \OCP\Util::DEBUG);
-
-		$limitPerPage = intval($this->connection->ldapPagingSize);
-		if(!is_null($limit) && $limit < $limitPerPage && $limit > 0) {
-			$limitPerPage = $limit;
-		}
-
-		$counter = 0;
-		$count = null;
-		$this->connection->getConnectionResource();
-
-		do {
-			$search = $this->executeSearch($filter, $base, $attr,
-										   $limitPerPage, $offset);
-			if($search === false) {
-				return $counter > 0 ? $counter : false;
-			}
-			list($sr, $pagedSearchOK) = $search;
-
-			/* ++ Fixing RHDS searches with pages with zero results ++
+        return !empty($cookie) || $cookie === '0';
+    }
+
+    /**
+     * executes an LDAP search, but counts the results only
+     * @param string $filter the LDAP filter for the search
+     * @param array $base an array containing the LDAP subtree(s) that shall be searched
+     * @param string|string[] $attr optional, array, one or more attributes that shall be
+     * retrieved. Results will according to the order in the array.
+     * @param int $limit optional, maximum results to be counted
+     * @param int $offset optional, a starting point
+     * @param bool $skipHandling indicates whether the pages search operation is
+     * completed
+     * @return int|false Integer or false if the search could not be initialized
+     *
+     */
+    private function count($filter, $base, $attr = null, $limit = null, $offset = null, $skipHandling = false) {
+        \OCP\Util::writeLog('user_ldap', 'Count filter:  '.print_r($filter, true), \OCP\Util::DEBUG);
+
+        $limitPerPage = intval($this->connection->ldapPagingSize);
+        if(!is_null($limit) && $limit < $limitPerPage && $limit > 0) {
+            $limitPerPage = $limit;
+        }
+
+        $counter = 0;
+        $count = null;
+        $this->connection->getConnectionResource();
+
+        do {
+            $search = $this->executeSearch($filter, $base, $attr,
+                                            $limitPerPage, $offset);
+            if($search === false) {
+                return $counter > 0 ? $counter : false;
+            }
+            list($sr, $pagedSearchOK) = $search;
+
+            /* ++ Fixing RHDS searches with pages with zero results ++
 			 * countEntriesInSearchResults() method signature changed
 			 * by removing $limit and &$hasHitLimit parameters
 			 */
-			$count = $this->countEntriesInSearchResults($sr);
-			$counter += $count;
+            $count = $this->countEntriesInSearchResults($sr);
+            $counter += $count;
 
-			$hasMorePages = $this->processPagedSearchStatus($sr, $filter, $base, $count, $limitPerPage,
-										$offset, $pagedSearchOK, $skipHandling);
-			$offset += $limitPerPage;
-			/* ++ Fixing RHDS searches with pages with zero results ++
+            $hasMorePages = $this->processPagedSearchStatus($sr, $filter, $base, $count, $limitPerPage,
+                                        $offset, $pagedSearchOK, $skipHandling);
+            $offset += $limitPerPage;
+            /* ++ Fixing RHDS searches with pages with zero results ++
 			 * Continue now depends on $hasMorePages value
 			 */
-			$continue = $pagedSearchOK && $hasMorePages;
-		} while($continue && (is_null($limit) || $limit <= 0 || $limit > $counter));
-
-		return $counter;
-	}
-
-	/**
-	 * @param array $searchResults
-	 * @return int
-	 */
-	private function countEntriesInSearchResults($searchResults) {
-		$cr = $this->connection->getConnectionResource();
-		$counter = 0;
-
-		foreach($searchResults as $res) {
-			$count = intval($this->ldap->countEntries($cr, $res));
-			$counter += $count;
-		}
-
-		return $counter;
-	}
-
-	/**
-	 * Executes an LDAP search
-	 * @param string $filter the LDAP filter for the search
-	 * @param array $base an array containing the LDAP subtree(s) that shall be searched
-	 * @param string|string[] $attr optional, array, one or more attributes that shall be
-	 * @param int $limit
-	 * @param int $offset
-	 * @param bool $skipHandling
-	 * @return array with the search result
-	 */
-	private function search($filter, $base, $attr = null, $limit = null, $offset = null, $skipHandling = false) {
-		if($limit <= 0) {
-			//otherwise search will fail
-			$limit = null;
-		}
-
-		/* ++ Fixing RHDS searches with pages with zero results ++
+            $continue = $pagedSearchOK && $hasMorePages;
+        } while($continue && (is_null($limit) || $limit <= 0 || $limit > $counter));
+
+        return $counter;
+    }
+
+    /**
+     * @param array $searchResults
+     * @return int
+     */
+    private function countEntriesInSearchResults($searchResults) {
+        $cr = $this->connection->getConnectionResource();
+        $counter = 0;
+
+        foreach($searchResults as $res) {
+            $count = intval($this->ldap->countEntries($cr, $res));
+            $counter += $count;
+        }
+
+        return $counter;
+    }
+
+    /**
+     * Executes an LDAP search
+     * @param string $filter the LDAP filter for the search
+     * @param array $base an array containing the LDAP subtree(s) that shall be searched
+     * @param string|string[] $attr optional, array, one or more attributes that shall be
+     * @param int $limit
+     * @param int $offset
+     * @param bool $skipHandling
+     * @return array with the search result
+     */
+    private function search($filter, $base, $attr = null, $limit = null, $offset = null, $skipHandling = false) {
+        if($limit <= 0) {
+            //otherwise search will fail
+            $limit = null;
+        }
+
+        /* ++ Fixing RHDS searches with pages with zero results ++
 		 * As we can have pages with zero results and/or pages with less
 		 * than $limit results but with a still valid server 'cookie',
 		 * loops through until we get $continue equals true and
 		 * $findings['count'] < $limit
 		 */
-		$findings = array();
-		$savedoffset = $offset;
-		do {
-			$search = $this->executeSearch($filter, $base, $attr, $limit, $offset);
-			if($search === false) {
-				return array();
-			}
-			list($sr, $pagedSearchOK) = $search;
-			$cr = $this->connection->getConnectionResource();
-
-			if($skipHandling) {
-				//i.e. result do not need to be fetched, we just need the cookie
-				//thus pass 1 or any other value as $iFoundItems because it is not
-				//used
-				$this->processPagedSearchStatus($sr, $filter, $base, 1, $limit,
-								$offset, $pagedSearchOK,
-								$skipHandling);
-				return array();
-			}
-
-			foreach($sr as $res) {
-				$findings = array_merge($findings, $this->ldap->getEntries($cr	, $res ));
-			}
-
-			$continue = $this->processPagedSearchStatus($sr, $filter, $base, $findings['count'],
-								$limit, $offset, $pagedSearchOK,
-										$skipHandling);
-			$offset += $limit;
-		} while ($continue && $pagedSearchOK && $findings['count'] < $limit);
-		// reseting offset
-		$offset = $savedoffset;
-
-		// if we're here, probably no connection resource is returned.
-		// to make ownCloud behave nicely, we simply give back an empty array.
-		if(is_null($findings)) {
-			return array();
-		}
-
-		if(!is_null($attr)) {
-			$selection = array();
-			$i = 0;
-			foreach($findings as $item) {
-				if(!is_array($item)) {
-					continue;
-				}
-				$item = \OCP\Util::mb_array_change_key_case($item, MB_CASE_LOWER, 'UTF-8');
-				foreach($attr as $key) {
-					$key = mb_strtolower($key, 'UTF-8');
-					if(isset($item[$key])) {
-						if(is_array($item[$key]) && isset($item[$key]['count'])) {
-							unset($item[$key]['count']);
-						}
-						if($key !== 'dn') {
-							$selection[$i][$key] = $this->resemblesDN($key) ?
-								$this->helper->sanitizeDN($item[$key])
-								: $item[$key];
-						} else {
-							$selection[$i][$key] = [$this->helper->sanitizeDN($item[$key])];
-						}
-					}
-
-				}
-				$i++;
-			}
-			$findings = $selection;
-		}
-		//we slice the findings, when
-		//a) paged search unsuccessful, though attempted
-		//b) no paged search, but limit set
-		if((!$this->getPagedSearchResultState()
-			&& $pagedSearchOK)
-			|| (
-				!$pagedSearchOK
-				&& !is_null($limit)
-			)
-		) {
-			$findings = array_slice($findings, intval($offset), $limit);
-		}
-		return $findings;
-	}
-
-	/**
-	 * @param string $name
-	 * @return bool|mixed|string
-	 */
-	public function sanitizeUsername($name) {
-		if($this->connection->ldapIgnoreNamingRules) {
-			return $name;
-		}
-
-		// Transliteration
-		// latin characters to ASCII
-		$name = iconv('UTF-8', 'ASCII//TRANSLIT', $name);
-
-		// Replacements
-		$name = str_replace(' ', '_', $name);
-
-		// Every remaining disallowed characters will be removed
-		$name = preg_replace('/[^a-zA-Z0-9_.@-]/u', '', $name);
-
-		return $name;
-	}
-
-	/**
-	* escapes (user provided) parts for LDAP filter
-	* @param string $input, the provided value
-	* @param bool $allowAsterisk whether in * at the beginning should be preserved
-	* @return string the escaped string
-	*/
-	public function escapeFilterPart($input, $allowAsterisk = false) {
-		$asterisk = '';
-		if($allowAsterisk && strlen($input) > 0 && $input[0] === '*') {
-			$asterisk = '*';
-			$input = mb_substr($input, 1, null, 'UTF-8');
-		}
-		$search  = array('*', '\\', '(', ')');
-		$replace = array('\\*', '\\\\', '\\(', '\\)');
-		return $asterisk . str_replace($search, $replace, $input);
-	}
-
-	/**
-	 * combines the input filters with AND
-	 * @param string[] $filters the filters to connect
-	 * @return string the combined filter
-	 */
-	public function combineFilterWithAnd($filters) {
-		return $this->combineFilter($filters, '&');
-	}
-
-	/**
-	 * combines the input filters with OR
-	 * @param string[] $filters the filters to connect
-	 * @return string the combined filter
-	 * Combines Filter arguments with OR
-	 */
-	public function combineFilterWithOr($filters) {
-		return $this->combineFilter($filters, '|');
-	}
-
-	/**
-	 * combines the input filters with given operator
-	 * @param string[] $filters the filters to connect
-	 * @param string $operator either & or |
-	 * @return string the combined filter
-	 */
-	private function combineFilter($filters, $operator) {
-		$combinedFilter = '('.$operator;
-		foreach($filters as $filter) {
-			if ($filter !== '' && $filter[0] !== '(') {
-				$filter = '('.$filter.')';
-			}
-			$combinedFilter.=$filter;
-		}
-		$combinedFilter.=')';
-		return $combinedFilter;
-	}
-
-	/**
-	 * creates a filter part for to perform search for users
-	 * @param string $search the search term
-	 * @return string the final filter part to use in LDAP searches
-	 */
-	public function getFilterPartForUserSearch($search) {
-		return $this->getFilterPartForSearch($search,
-			$this->connection->ldapAttributesForUserSearch,
-			$this->connection->ldapUserDisplayName);
-	}
-
-	/**
-	 * creates a filter part for to perform search for groups
-	 * @param string $search the search term
-	 * @return string the final filter part to use in LDAP searches
-	 */
-	public function getFilterPartForGroupSearch($search) {
-		return $this->getFilterPartForSearch($search,
-			$this->connection->ldapAttributesForGroupSearch,
-			$this->connection->ldapGroupDisplayName);
-	}
-
-	/**
-	 * creates a filter part for searches by splitting up the given search
-	 * string into single words
-	 * @param string $search the search term
-	 * @param string[] $searchAttributes needs to have at least two attributes,
-	 * otherwise it does not make sense :)
-	 * @return string the final filter part to use in LDAP searches
-	 * @throws \Exception
-	 */
-	private function getAdvancedFilterPartForSearch($search, $searchAttributes) {
-		if(!is_array($searchAttributes) || count($searchAttributes) < 2) {
-			throw new \Exception('searchAttributes must be an array with at least two string');
-		}
-		$searchWords = explode(' ', trim($search));
-		$wordFilters = array();
-		foreach($searchWords as $word) {
-			$word = $this->prepareSearchTerm($word);
-			//every word needs to appear at least once
-			$wordMatchOneAttrFilters = array();
-			foreach($searchAttributes as $attr) {
-				$wordMatchOneAttrFilters[] = $attr . '=' . $word;
-			}
-			$wordFilters[] = $this->combineFilterWithOr($wordMatchOneAttrFilters);
-		}
-		return $this->combineFilterWithAnd($wordFilters);
-	}
-
-	/**
-	 * creates a filter part for searches
-	 * @param string $search the search term
-	 * @param string[]|null $searchAttributes
-	 * @param string $fallbackAttribute a fallback attribute in case the user
-	 * did not define search attributes. Typically the display name attribute.
-	 * @return string the final filter part to use in LDAP searches
-	 */
-	private function getFilterPartForSearch($search, $searchAttributes, $fallbackAttribute) {
-		$filter = array();
-		$haveMultiSearchAttributes = (is_array($searchAttributes) && count($searchAttributes) > 0);
-		if($haveMultiSearchAttributes && strpos(trim($search), ' ') !== false) {
-			try {
-				return $this->getAdvancedFilterPartForSearch($search, $searchAttributes);
-			} catch(\Exception $e) {
-				\OCP\Util::writeLog(
-					'user_ldap',
-					'Creating advanced filter for search failed, falling back to simple method.',
-					\OCP\Util::INFO
-				);
-			}
-		}
-
-		$search = $this->prepareSearchTerm($search);
-		if(!is_array($searchAttributes) || count($searchAttributes) === 0) {
-			if ($fallbackAttribute === '') {
-				return '';
-			}
-			$filter[] = $fallbackAttribute . '=' . $search;
-		} else {
-			foreach($searchAttributes as $attribute) {
-				$filter[] = $attribute . '=' . $search;
-			}
-		}
-		if(count($filter) === 1) {
-			return '('.$filter[0].')';
-		}
-		return $this->combineFilterWithOr($filter);
-	}
-
-	/**
-	 * returns the search term depending on whether we are allowed
-	 * list users found by ldap with the current input appended by
-	 * a *
-	 * @return string
-	 */
-	private function prepareSearchTerm($term) {
-		$config = \OC::$server->getConfig();
-
-		$allowEnum = $config->getAppValue('core', 'shareapi_allow_share_dialog_user_enumeration', 'yes');
-
-		$result = $term;
-		if ($term === '') {
-			$result = '*';
-		} else if ($allowEnum !== 'no') {
-			$result = $term . '*';
-		}
-		return $result;
-	}
-
-	/**
-	 * returns the filter used for counting users
-	 * @return string
-	 */
-	public function getFilterForUserCount() {
-		$filter = $this->combineFilterWithAnd(array(
-			$this->connection->ldapUserFilter,
-			$this->connection->ldapUserDisplayName . '=*'
-		));
-
-		return $filter;
-	}
-
-	/**
-	 * @param string $name
-	 * @param string $password
-	 * @return bool
-	 */
-	public function areCredentialsValid($name, $password) {
-		$name = $this->helper->DNasBaseParameter($name);
-		$testConnection = clone $this->connection;
-		$credentials = array(
-			'ldapAgentName' => $name,
-			'ldapAgentPassword' => $password
-		);
-		if(!$testConnection->setConfiguration($credentials)) {
-			return false;
-		}
-		return $testConnection->bind();
-	}
-
-	/**
-	 * reverse lookup of a DN given a known UUID
-	 *
-	 * @param string $uuid
-	 * @return string
-	 * @throws \Exception
-	 */
-	public function getUserDnByUuid($uuid) {
-		$uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
-		$filter       = $this->connection->ldapUserFilter;
-		$base         = $this->connection->ldapBaseUsers;
-
-		if ($this->connection->ldapUuidUserAttribute === 'auto' && $uuidOverride === '') {
-			// Sacrebleu! The UUID attribute is unknown :( We need first an
-			// existing DN to be able to reliably detect it.
-			$result = $this->search($filter, $base, ['dn'], 1);
-			if(!isset($result[0]) || !isset($result[0]['dn'])) {
-				throw new \Exception('Cannot determine UUID attribute');
-			}
-			$dn = $result[0]['dn'][0];
-			if(!$this->detectUuidAttribute($dn, true)) {
-				throw new \Exception('Cannot determine UUID attribute');
-			}
-		} else {
-			// The UUID attribute is either known or an override is given.
-			// By calling this method we ensure that $this->connection->$uuidAttr
-			// is definitely set
-			if(!$this->detectUuidAttribute('', true)) {
-				throw new \Exception('Cannot determine UUID attribute');
-			}
-		}
-
-		$uuidAttr = $this->connection->ldapUuidUserAttribute;
-		if($uuidAttr === 'guid' || $uuidAttr === 'objectguid') {
-			$uuid = $this->formatGuid2ForFilterUser($uuid);
-		}
-
-		$filter = $uuidAttr . '=' . $uuid;
-		$result = $this->searchUsers($filter, ['dn'], 2);
-		if(is_array($result) && isset($result[0]) && isset($result[0]['dn']) && count($result) === 1) {
-			// we put the count into account to make sure that this is
-			// really unique
-			return $result[0]['dn'][0];
-		}
-
-		throw new \Exception('Cannot determine UUID attribute');
-	}
-
-	/**
-	 * auto-detects the directory's UUID attribute
-	 * @param string $dn a known DN used to check against
-	 * @param bool $isUser
-	 * @param bool $force the detection should be run, even if it is not set to auto
-	 * @return bool true on success, false otherwise
-	 */
-	private function detectUuidAttribute($dn, $isUser = true, $force = false) {
-		if($isUser) {
-			$uuidAttr     = 'ldapUuidUserAttribute';
-			$uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
-		} else {
-			$uuidAttr     = 'ldapUuidGroupAttribute';
-			$uuidOverride = $this->connection->ldapExpertUUIDGroupAttr;
-		}
-
-		if(($this->connection->$uuidAttr !== 'auto') && !$force) {
-			return true;
-		}
-
-		if (is_string($uuidOverride) && trim($uuidOverride) !== '' && !$force) {
-			$this->connection->$uuidAttr = $uuidOverride;
-			return true;
-		}
-
-		// for now, supported attributes are entryUUID, nsuniqueid, objectGUID, ipaUniqueID
-		$testAttributes = array('entryuuid', 'nsuniqueid', 'objectguid', 'guid', 'ipauniqueid');
-
-		foreach($testAttributes as $attribute) {
-			$value = $this->readAttribute($dn, $attribute);
-			if(is_array($value) && isset($value[0]) && !empty($value[0])) {
-				\OCP\Util::writeLog('user_ldap',
-									'Setting '.$attribute.' as '.$uuidAttr,
-									\OCP\Util::DEBUG);
-				$this->connection->$uuidAttr = $attribute;
-				return true;
-			}
-		}
-		\OCP\Util::writeLog('user_ldap',
-							'Could not autodetect the UUID attribute',
-							\OCP\Util::ERROR);
-
-		return false;
-	}
-
-	/**
-	 * @param string $dn
-	 * @param bool $isUser
-	 * @return string|bool
-	 */
-	public function getUUID($dn, $isUser = true) {
-		if($isUser) {
-			$uuidAttr     = 'ldapUuidUserAttribute';
-			$uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
-		} else {
-			$uuidAttr     = 'ldapUuidGroupAttribute';
-			$uuidOverride = $this->connection->ldapExpertUUIDGroupAttr;
-		}
-
-		$uuid = false;
-		if($this->detectUuidAttribute($dn, $isUser)) {
-			$uuid = $this->readAttribute($dn, $this->connection->$uuidAttr);
-			if( !is_array($uuid)
-				&& $uuidOverride !== ''
-				&& $this->detectUuidAttribute($dn, $isUser, true)) {
-					$uuid = $this->readAttribute($dn,
-												 $this->connection->$uuidAttr);
-			}
-			if(is_array($uuid) && isset($uuid[0]) && !empty($uuid[0])) {
-				$uuid = $uuid[0];
-			}
-		}
-
-		return $uuid;
-	}
-
-	/**
-	 * converts a binary ObjectGUID into a string representation
-	 * @param string $oguid the ObjectGUID in it's binary form as retrieved from AD
-	 * @return string
-	 * @link http://www.php.net/manual/en/function.ldap-get-values-len.php#73198
-	 */
-	private function convertObjectGUID2Str($oguid) {
-		$hex_guid = bin2hex($oguid);
-		$hex_guid_to_guid_str = '';
-		for($k = 1; $k <= 4; ++$k) {
-			$hex_guid_to_guid_str .= substr($hex_guid, 8 - 2 * $k, 2);
-		}
-		$hex_guid_to_guid_str .= '-';
-		for($k = 1; $k <= 2; ++$k) {
-			$hex_guid_to_guid_str .= substr($hex_guid, 12 - 2 * $k, 2);
-		}
-		$hex_guid_to_guid_str .= '-';
-		for($k = 1; $k <= 2; ++$k) {
-			$hex_guid_to_guid_str .= substr($hex_guid, 16 - 2 * $k, 2);
-		}
-		$hex_guid_to_guid_str .= '-' . substr($hex_guid, 16, 4);
-		$hex_guid_to_guid_str .= '-' . substr($hex_guid, 20);
-
-		return strtoupper($hex_guid_to_guid_str);
-	}
-
-	/**
-	 * the first three blocks of the string-converted GUID happen to be in
-	 * reverse order. In order to use it in a filter, this needs to be
-	 * corrected. Furthermore the dashes need to be replaced and \\ preprended
-	 * to every two hax figures.
-	 *
-	 * If an invalid string is passed, it will be returned without change.
-	 *
-	 * @param string $guid
-	 * @return string
-	 */
-	public function formatGuid2ForFilterUser($guid) {
-		if(!is_string($guid)) {
-			throw new \InvalidArgumentException('String expected');
-		}
-		$blocks = explode('-', $guid);
-		if(count($blocks) !== 5) {
-			/*
+        $findings = array();
+        $savedoffset = $offset;
+        do {
+            $search = $this->executeSearch($filter, $base, $attr, $limit, $offset);
+            if($search === false) {
+                return array();
+            }
+            list($sr, $pagedSearchOK) = $search;
+            $cr = $this->connection->getConnectionResource();
+
+            if($skipHandling) {
+                //i.e. result do not need to be fetched, we just need the cookie
+                //thus pass 1 or any other value as $iFoundItems because it is not
+                //used
+                $this->processPagedSearchStatus($sr, $filter, $base, 1, $limit,
+                                $offset, $pagedSearchOK,
+                                $skipHandling);
+                return array();
+            }
+
+            foreach($sr as $res) {
+                $findings = array_merge($findings, $this->ldap->getEntries($cr	, $res ));
+            }
+
+            $continue = $this->processPagedSearchStatus($sr, $filter, $base, $findings['count'],
+                                $limit, $offset, $pagedSearchOK,
+                                        $skipHandling);
+            $offset += $limit;
+        } while ($continue && $pagedSearchOK && $findings['count'] < $limit);
+        // reseting offset
+        $offset = $savedoffset;
+
+        // if we're here, probably no connection resource is returned.
+        // to make ownCloud behave nicely, we simply give back an empty array.
+        if(is_null($findings)) {
+            return array();
+        }
+
+        if(!is_null($attr)) {
+            $selection = array();
+            $i = 0;
+            foreach($findings as $item) {
+                if(!is_array($item)) {
+                    continue;
+                }
+                $item = \OCP\Util::mb_array_change_key_case($item, MB_CASE_LOWER, 'UTF-8');
+                foreach($attr as $key) {
+                    $key = mb_strtolower($key, 'UTF-8');
+                    if(isset($item[$key])) {
+                        if(is_array($item[$key]) && isset($item[$key]['count'])) {
+                            unset($item[$key]['count']);
+                        }
+                        if($key !== 'dn') {
+                            $selection[$i][$key] = $this->resemblesDN($key) ?
+                                $this->helper->sanitizeDN($item[$key])
+                                : $item[$key];
+                        } else {
+                            $selection[$i][$key] = [$this->helper->sanitizeDN($item[$key])];
+                        }
+                    }
+
+                }
+                $i++;
+            }
+            $findings = $selection;
+        }
+        //we slice the findings, when
+        //a) paged search unsuccessful, though attempted
+        //b) no paged search, but limit set
+        if((!$this->getPagedSearchResultState()
+            && $pagedSearchOK)
+            || (
+                !$pagedSearchOK
+                && !is_null($limit)
+            )
+        ) {
+            $findings = array_slice($findings, intval($offset), $limit);
+        }
+        return $findings;
+    }
+
+    /**
+     * @param string $name
+     * @return bool|mixed|string
+     */
+    public function sanitizeUsername($name) {
+        if($this->connection->ldapIgnoreNamingRules) {
+            return $name;
+        }
+
+        // Transliteration
+        // latin characters to ASCII
+        $name = iconv('UTF-8', 'ASCII//TRANSLIT', $name);
+
+        // Replacements
+        $name = str_replace(' ', '_', $name);
+
+        // Every remaining disallowed characters will be removed
+        $name = preg_replace('/[^a-zA-Z0-9_.@-]/u', '', $name);
+
+        return $name;
+    }
+
+    /**
+     * escapes (user provided) parts for LDAP filter
+     * @param string $input, the provided value
+     * @param bool $allowAsterisk whether in * at the beginning should be preserved
+     * @return string the escaped string
+     */
+    public function escapeFilterPart($input, $allowAsterisk = false) {
+        $asterisk = '';
+        if($allowAsterisk && strlen($input) > 0 && $input[0] === '*') {
+            $asterisk = '*';
+            $input = mb_substr($input, 1, null, 'UTF-8');
+        }
+        $search  = array('*', '\\', '(', ')');
+        $replace = array('\\*', '\\\\', '\\(', '\\)');
+        return $asterisk . str_replace($search, $replace, $input);
+    }
+
+    /**
+     * combines the input filters with AND
+     * @param string[] $filters the filters to connect
+     * @return string the combined filter
+     */
+    public function combineFilterWithAnd($filters) {
+        return $this->combineFilter($filters, '&');
+    }
+
+    /**
+     * combines the input filters with OR
+     * @param string[] $filters the filters to connect
+     * @return string the combined filter
+     * Combines Filter arguments with OR
+     */
+    public function combineFilterWithOr($filters) {
+        return $this->combineFilter($filters, '|');
+    }
+
+    /**
+     * combines the input filters with given operator
+     * @param string[] $filters the filters to connect
+     * @param string $operator either & or |
+     * @return string the combined filter
+     */
+    private function combineFilter($filters, $operator) {
+        $combinedFilter = '('.$operator;
+        foreach($filters as $filter) {
+            if ($filter !== '' && $filter[0] !== '(') {
+                $filter = '('.$filter.')';
+            }
+            $combinedFilter.=$filter;
+        }
+        $combinedFilter.=')';
+        return $combinedFilter;
+    }
+
+    /**
+     * creates a filter part for to perform search for users
+     * @param string $search the search term
+     * @return string the final filter part to use in LDAP searches
+     */
+    public function getFilterPartForUserSearch($search) {
+        return $this->getFilterPartForSearch($search,
+            $this->connection->ldapAttributesForUserSearch,
+            $this->connection->ldapUserDisplayName);
+    }
+
+    /**
+     * creates a filter part for to perform search for groups
+     * @param string $search the search term
+     * @return string the final filter part to use in LDAP searches
+     */
+    public function getFilterPartForGroupSearch($search) {
+        return $this->getFilterPartForSearch($search,
+            $this->connection->ldapAttributesForGroupSearch,
+            $this->connection->ldapGroupDisplayName);
+    }
+
+    /**
+     * creates a filter part for searches by splitting up the given search
+     * string into single words
+     * @param string $search the search term
+     * @param string[] $searchAttributes needs to have at least two attributes,
+     * otherwise it does not make sense :)
+     * @return string the final filter part to use in LDAP searches
+     * @throws \Exception
+     */
+    private function getAdvancedFilterPartForSearch($search, $searchAttributes) {
+        if(!is_array($searchAttributes) || count($searchAttributes) < 2) {
+            throw new \Exception('searchAttributes must be an array with at least two string');
+        }
+        $searchWords = explode(' ', trim($search));
+        $wordFilters = array();
+        foreach($searchWords as $word) {
+            $word = $this->prepareSearchTerm($word);
+            //every word needs to appear at least once
+            $wordMatchOneAttrFilters = array();
+            foreach($searchAttributes as $attr) {
+                $wordMatchOneAttrFilters[] = $attr . '=' . $word;
+            }
+            $wordFilters[] = $this->combineFilterWithOr($wordMatchOneAttrFilters);
+        }
+        return $this->combineFilterWithAnd($wordFilters);
+    }
+
+    /**
+     * creates a filter part for searches
+     * @param string $search the search term
+     * @param string[]|null $searchAttributes
+     * @param string $fallbackAttribute a fallback attribute in case the user
+     * did not define search attributes. Typically the display name attribute.
+     * @return string the final filter part to use in LDAP searches
+     */
+    private function getFilterPartForSearch($search, $searchAttributes, $fallbackAttribute) {
+        $filter = array();
+        $haveMultiSearchAttributes = (is_array($searchAttributes) && count($searchAttributes) > 0);
+        if($haveMultiSearchAttributes && strpos(trim($search), ' ') !== false) {
+            try {
+                return $this->getAdvancedFilterPartForSearch($search, $searchAttributes);
+            } catch(\Exception $e) {
+                \OCP\Util::writeLog(
+                    'user_ldap',
+                    'Creating advanced filter for search failed, falling back to simple method.',
+                    \OCP\Util::INFO
+                );
+            }
+        }
+
+        $search = $this->prepareSearchTerm($search);
+        if(!is_array($searchAttributes) || count($searchAttributes) === 0) {
+            if ($fallbackAttribute === '') {
+                return '';
+            }
+            $filter[] = $fallbackAttribute . '=' . $search;
+        } else {
+            foreach($searchAttributes as $attribute) {
+                $filter[] = $attribute . '=' . $search;
+            }
+        }
+        if(count($filter) === 1) {
+            return '('.$filter[0].')';
+        }
+        return $this->combineFilterWithOr($filter);
+    }
+
+    /**
+     * returns the search term depending on whether we are allowed
+     * list users found by ldap with the current input appended by
+     * a *
+     * @return string
+     */
+    private function prepareSearchTerm($term) {
+        $config = \OC::$server->getConfig();
+
+        $allowEnum = $config->getAppValue('core', 'shareapi_allow_share_dialog_user_enumeration', 'yes');
+
+        $result = $term;
+        if ($term === '') {
+            $result = '*';
+        } else if ($allowEnum !== 'no') {
+            $result = $term . '*';
+        }
+        return $result;
+    }
+
+    /**
+     * returns the filter used for counting users
+     * @return string
+     */
+    public function getFilterForUserCount() {
+        $filter = $this->combineFilterWithAnd(array(
+            $this->connection->ldapUserFilter,
+            $this->connection->ldapUserDisplayName . '=*'
+        ));
+
+        return $filter;
+    }
+
+    /**
+     * @param string $name
+     * @param string $password
+     * @return bool
+     */
+    public function areCredentialsValid($name, $password) {
+        $name = $this->helper->DNasBaseParameter($name);
+        $testConnection = clone $this->connection;
+        $credentials = array(
+            'ldapAgentName' => $name,
+            'ldapAgentPassword' => $password
+        );
+        if(!$testConnection->setConfiguration($credentials)) {
+            return false;
+        }
+        return $testConnection->bind();
+    }
+
+    /**
+     * reverse lookup of a DN given a known UUID
+     *
+     * @param string $uuid
+     * @return string
+     * @throws \Exception
+     */
+    public function getUserDnByUuid($uuid) {
+        $uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
+        $filter       = $this->connection->ldapUserFilter;
+        $base         = $this->connection->ldapBaseUsers;
+
+        if ($this->connection->ldapUuidUserAttribute === 'auto' && $uuidOverride === '') {
+            // Sacrebleu! The UUID attribute is unknown :( We need first an
+            // existing DN to be able to reliably detect it.
+            $result = $this->search($filter, $base, ['dn'], 1);
+            if(!isset($result[0]) || !isset($result[0]['dn'])) {
+                throw new \Exception('Cannot determine UUID attribute');
+            }
+            $dn = $result[0]['dn'][0];
+            if(!$this->detectUuidAttribute($dn, true)) {
+                throw new \Exception('Cannot determine UUID attribute');
+            }
+        } else {
+            // The UUID attribute is either known or an override is given.
+            // By calling this method we ensure that $this->connection->$uuidAttr
+            // is definitely set
+            if(!$this->detectUuidAttribute('', true)) {
+                throw new \Exception('Cannot determine UUID attribute');
+            }
+        }
+
+        $uuidAttr = $this->connection->ldapUuidUserAttribute;
+        if($uuidAttr === 'guid' || $uuidAttr === 'objectguid') {
+            $uuid = $this->formatGuid2ForFilterUser($uuid);
+        }
+
+        $filter = $uuidAttr . '=' . $uuid;
+        $result = $this->searchUsers($filter, ['dn'], 2);
+        if(is_array($result) && isset($result[0]) && isset($result[0]['dn']) && count($result) === 1) {
+            // we put the count into account to make sure that this is
+            // really unique
+            return $result[0]['dn'][0];
+        }
+
+        throw new \Exception('Cannot determine UUID attribute');
+    }
+
+    /**
+     * auto-detects the directory's UUID attribute
+     * @param string $dn a known DN used to check against
+     * @param bool $isUser
+     * @param bool $force the detection should be run, even if it is not set to auto
+     * @return bool true on success, false otherwise
+     */
+    private function detectUuidAttribute($dn, $isUser = true, $force = false) {
+        if($isUser) {
+            $uuidAttr     = 'ldapUuidUserAttribute';
+            $uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
+        } else {
+            $uuidAttr     = 'ldapUuidGroupAttribute';
+            $uuidOverride = $this->connection->ldapExpertUUIDGroupAttr;
+        }
+
+        if(($this->connection->$uuidAttr !== 'auto') && !$force) {
+            return true;
+        }
+
+        if (is_string($uuidOverride) && trim($uuidOverride) !== '' && !$force) {
+            $this->connection->$uuidAttr = $uuidOverride;
+            return true;
+        }
+
+        // for now, supported attributes are entryUUID, nsuniqueid, objectGUID, ipaUniqueID
+        $testAttributes = array('entryuuid', 'nsuniqueid', 'objectguid', 'guid', 'ipauniqueid');
+
+        foreach($testAttributes as $attribute) {
+            $value = $this->readAttribute($dn, $attribute);
+            if(is_array($value) && isset($value[0]) && !empty($value[0])) {
+                \OCP\Util::writeLog('user_ldap',
+                                    'Setting '.$attribute.' as '.$uuidAttr,
+                                    \OCP\Util::DEBUG);
+                $this->connection->$uuidAttr = $attribute;
+                return true;
+            }
+        }
+        \OCP\Util::writeLog('user_ldap',
+                            'Could not autodetect the UUID attribute',
+                            \OCP\Util::ERROR);
+
+        return false;
+    }
+
+    /**
+     * @param string $dn
+     * @param bool $isUser
+     * @return string|bool
+     */
+    public function getUUID($dn, $isUser = true) {
+        if($isUser) {
+            $uuidAttr     = 'ldapUuidUserAttribute';
+            $uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
+        } else {
+            $uuidAttr     = 'ldapUuidGroupAttribute';
+            $uuidOverride = $this->connection->ldapExpertUUIDGroupAttr;
+        }
+
+        $uuid = false;
+        if($this->detectUuidAttribute($dn, $isUser)) {
+            $uuid = $this->readAttribute($dn, $this->connection->$uuidAttr);
+            if( !is_array($uuid)
+                && $uuidOverride !== ''
+                && $this->detectUuidAttribute($dn, $isUser, true)) {
+                    $uuid = $this->readAttribute($dn,
+                                                    $this->connection->$uuidAttr);
+            }
+            if(is_array($uuid) && isset($uuid[0]) && !empty($uuid[0])) {
+                $uuid = $uuid[0];
+            }
+        }
+
+        return $uuid;
+    }
+
+    /**
+     * converts a binary ObjectGUID into a string representation
+     * @param string $oguid the ObjectGUID in it's binary form as retrieved from AD
+     * @return string
+     * @link http://www.php.net/manual/en/function.ldap-get-values-len.php#73198
+     */
+    private function convertObjectGUID2Str($oguid) {
+        $hex_guid = bin2hex($oguid);
+        $hex_guid_to_guid_str = '';
+        for($k = 1; $k <= 4; ++$k) {
+            $hex_guid_to_guid_str .= substr($hex_guid, 8 - 2 * $k, 2);
+        }
+        $hex_guid_to_guid_str .= '-';
+        for($k = 1; $k <= 2; ++$k) {
+            $hex_guid_to_guid_str .= substr($hex_guid, 12 - 2 * $k, 2);
+        }
+        $hex_guid_to_guid_str .= '-';
+        for($k = 1; $k <= 2; ++$k) {
+            $hex_guid_to_guid_str .= substr($hex_guid, 16 - 2 * $k, 2);
+        }
+        $hex_guid_to_guid_str .= '-' . substr($hex_guid, 16, 4);
+        $hex_guid_to_guid_str .= '-' . substr($hex_guid, 20);
+
+        return strtoupper($hex_guid_to_guid_str);
+    }
+
+    /**
+     * the first three blocks of the string-converted GUID happen to be in
+     * reverse order. In order to use it in a filter, this needs to be
+     * corrected. Furthermore the dashes need to be replaced and \\ preprended
+     * to every two hax figures.
+     *
+     * If an invalid string is passed, it will be returned without change.
+     *
+     * @param string $guid
+     * @return string
+     */
+    public function formatGuid2ForFilterUser($guid) {
+        if(!is_string($guid)) {
+            throw new \InvalidArgumentException('String expected');
+        }
+        $blocks = explode('-', $guid);
+        if(count($blocks) !== 5) {
+            /*
 			 * Why not throw an Exception instead? This method is a utility
 			 * called only when trying to figure out whether a "missing" known
 			 * LDAP user was or was not renamed on the LDAP server. And this
@@ -1583,275 +1583,275 @@ 
 			 * an exception here would kill the experience for a valid, acting
 			 * user. Instead we write a log message.
 			 */
-			\OC::$server->getLogger()->info(
-				'Passed string does not resemble a valid GUID. Known UUID ' .
-				'({uuid}) probably does not match UUID configuration.',
-				[ 'app' => 'user_ldap', 'uuid' => $guid ]
-			);
-			return $guid;
-		}
-		for($i=0; $i < 3; $i++) {
-			$pairs = str_split($blocks[$i], 2);
-			$pairs = array_reverse($pairs);
-			$blocks[$i] = implode('', $pairs);
-		}
-		for($i=0; $i < 5; $i++) {
-			$pairs = str_split($blocks[$i], 2);
-			$blocks[$i] = '\\' . implode('\\', $pairs);
-		}
-		return implode('', $blocks);
-	}
-
-	/**
-	 * gets a SID of the domain of the given dn
-	 * @param string $dn
-	 * @return string|bool
-	 */
-	public function getSID($dn) {
-		$domainDN = $this->getDomainDNFromDN($dn);
-		$cacheKey = 'getSID-'.$domainDN;
-		$sid = $this->connection->getFromCache($cacheKey);
-		if(!is_null($sid)) {
-			return $sid;
-		}
-
-		$objectSid = $this->readAttribute($domainDN, 'objectsid');
-		if(!is_array($objectSid) || empty($objectSid)) {
-			$this->connection->writeToCache($cacheKey, false);
-			return false;
-		}
-		$domainObjectSid = $this->convertSID2Str($objectSid[0]);
-		$this->connection->writeToCache($cacheKey, $domainObjectSid);
-
-		return $domainObjectSid;
-	}
-
-	/**
-	 * converts a binary SID into a string representation
-	 * @param string $sid
-	 * @return string
-	 */
-	public function convertSID2Str($sid) {
-		// The format of a SID binary string is as follows:
-		// 1 byte for the revision level
-		// 1 byte for the number n of variable sub-ids
-		// 6 bytes for identifier authority value
-		// n*4 bytes for n sub-ids
-		//
-		// Example: 010400000000000515000000a681e50e4d6c6c2bca32055f
-		//  Legend: RRNNAAAAAAAAAAAA11111111222222223333333344444444
-		$revision = ord($sid[0]);
-		$numberSubID = ord($sid[1]);
-
-		$subIdStart = 8; // 1 + 1 + 6
-		$subIdLength = 4;
-		if (strlen($sid) !== $subIdStart + $subIdLength * $numberSubID) {
-			// Incorrect number of bytes present.
-			return '';
-		}
-
-		// 6 bytes = 48 bits can be represented using floats without loss of
-		// precision (see https://gist.github.com/bantu/886ac680b0aef5812f71)
-		$iav = number_format(hexdec(bin2hex(substr($sid, 2, 6))), 0, '', '');
-
-		$subIDs = array();
-		for ($i = 0; $i < $numberSubID; $i++) {
-			$subID = unpack('V', substr($sid, $subIdStart + $subIdLength * $i, $subIdLength));
-			$subIDs[] = sprintf('%u', $subID[1]);
-		}
-
-		// Result for example above: S-1-5-21-249921958-728525901-1594176202
-		return sprintf('S-%d-%s-%s', $revision, $iav, implode('-', $subIDs));
-	}
-
-	/**
-	 * checks if the given DN is part of the given base DN(s)
-	 * @param string $dn the DN
-	 * @param string[] $bases array containing the allowed base DN or DNs
-	 * @return bool
-	 */
-	public function isDNPartOfBase($dn, $bases) {
-		$belongsToBase = false;
-		$bases = $this->helper->sanitizeDN($bases);
-
-		foreach($bases as $base) {
-			$belongsToBase = true;
-			if(mb_strripos($dn, $base, 0, 'UTF-8') !== (mb_strlen($dn, 'UTF-8')-mb_strlen($base, 'UTF-8'))) {
-				$belongsToBase = false;
-			}
-			if($belongsToBase) {
-				break;
-			}
-		}
-		return $belongsToBase;
-	}
-
-	/**
-	 * resets a running Paged Search operation
-	 */
-	private function abandonPagedSearch() {
-		if($this->connection->hasPagedResultSupport) {
-			$cr = $this->connection->getConnectionResource();
-			$this->ldap->controlPagedResult($cr, 0, false, $this->lastCookie);
-			$this->getPagedSearchResultState();
-			$this->lastCookie = '';
-			$this->cookies = array();
-		}
-	}
-
-	/**
-	 * get a cookie for the next LDAP paged search
-	 * @param string $base a string with the base DN for the search
-	 * @param string $filter the search filter to identify the correct search
-	 * @param int $limit the limit (or 'pageSize'), to identify the correct search well
-	 * @param int $offset the offset for the new search to identify the correct search really good
-	 * @return string containing the key or empty if none is cached
-	 */
-	private function getPagedResultCookie($base, $filter, $limit, $offset) {
-		if($offset === 0) {
-			return '';
-		}
-		$offset -= $limit;
-		//we work with cache here
-		$cacheKey = 'lc' . crc32($base) . '-' . crc32($filter) . '-' . intval($limit) . '-' . intval($offset);
-		$cookie = '';
-		if(isset($this->cookies[$cacheKey])) {
-			$cookie = $this->cookies[$cacheKey];
-			if(is_null($cookie)) {
-				$cookie = '';
-			}
-		}
-		return $cookie;
-	}
-
-	/**
-	 * checks whether an LDAP paged search operation has more pages that can be
-	 * retrieved, typically when offset and limit are provided.
-	 *
-	 * Be very careful to use it: the last cookie value, which is inspected, can
-	 * be reset by other operations. Best, call it immediately after a search(),
-	 * searchUsers() or searchGroups() call. count-methods are probably safe as
-	 * well. Don't rely on it with any fetchList-method.
-	 * @return bool
-	 */
-	public function hasMoreResults() {
-		if(!$this->connection->hasPagedResultSupport) {
-			return false;
-		}
-
-		if(empty($this->lastCookie) && $this->lastCookie !== '0') {
-			// as in RFC 2696, when all results are returned, the cookie will
-			// be empty.
-			return false;
-		}
-
-		return true;
-	}
-
-	/**
-	 * set a cookie for LDAP paged search run
-	 * @param string $base a string with the base DN for the search
-	 * @param string $filter the search filter to identify the correct search
-	 * @param int $limit the limit (or 'pageSize'), to identify the correct search well
-	 * @param int $offset the offset for the run search to identify the correct search really good
-	 * @param string $cookie string containing the cookie returned by ldap_control_paged_result_response
-	 * @return void
-	 */
-	private function setPagedResultCookie($base, $filter, $limit, $offset, $cookie) {
-		// allow '0' for 389ds
-		if(!empty($cookie) || $cookie === '0') {
-			$cacheKey = 'lc' . crc32($base) . '-' . crc32($filter) . '-' .intval($limit) . '-' . intval($offset);
-			$this->cookies[$cacheKey] = $cookie;
-			$this->lastCookie = $cookie;
-		}
-	}
-
-	/**
-	 * Check whether the most recent paged search was successful. It flushed the state var. Use it always after a possible paged search.
-	 * @return boolean|null true on success, null or false otherwise
-	 */
-	public function getPagedSearchResultState() {
-		$result = $this->pagedSearchedSuccessful;
-		$this->pagedSearchedSuccessful = null;
-		return $result;
-	}
-
-	/**
-	 * Prepares a paged search, if possible
-	 * @param string $filter the LDAP filter for the search
-	 * @param string[] $bases an array containing the LDAP subtree(s) that shall be searched
-	 * @param string[] $attr optional, when a certain attribute shall be filtered outside
-	 * @param int $limit
-	 * @param int $offset
-	 * @return bool|true
-	 */
-	private function initPagedSearch($filter, $bases, $attr, $limit, $offset) {
-		$pagedSearchOK = false;
-		if($this->connection->hasPagedResultSupport && ($limit !== 0)) {
-			$offset = intval($offset); //can be null
-			\OCP\Util::writeLog('user_ldap',
-				'initializing paged search for  Filter '.$filter.' base '.print_r($bases, true)
-				.' attr '.print_r($attr, true). ' limit ' .$limit.' offset '.$offset,
-				\OCP\Util::DEBUG);
-			//get the cookie from the search for the previous search, required by LDAP
-			foreach($bases as $base) {
-
-				$cookie = $this->getPagedResultCookie($base, $filter, $limit, $offset);
-				if(empty($cookie) && $cookie !== "0" && ($offset > 0)) {
-					// no cookie known, although the offset is not 0. Maybe cache run out. We need
-					// to start all over *sigh* (btw, Dear Reader, did you know LDAP paged
-					// searching was designed by MSFT?)
-					// 		Lukas: No, but thanks to reading that source I finally know!
-					// '0' is valid, because 389ds
-					$reOffset = ($offset - $limit) < 0 ? 0 : $offset - $limit;
-					//a bit recursive, $offset of 0 is the exit
-					\OCP\Util::writeLog('user_ldap', 'Looking for cookie L/O '.$limit.'/'.$reOffset, \OCP\Util::INFO);
-					$this->search($filter, array($base), $attr, $limit, $reOffset, true);
-					$cookie = $this->getPagedResultCookie($base, $filter, $limit, $offset);
-					//still no cookie? obviously, the server does not like us. Let's skip paging efforts.
-					//TODO: remember this, probably does not change in the next request...
-					if(empty($cookie) && $cookie !== '0') {
-						// '0' is valid, because 389ds
-						$cookie = null;
-					}
-				}
-				if(!is_null($cookie)) {
-					//since offset = 0, this is a new search. We abandon other searches that might be ongoing.
-					$this->abandonPagedSearch();
-					$pagedSearchOK = $this->ldap->controlPagedResult(
-						$this->connection->getConnectionResource(), $limit,
-						false, $cookie);
-					if(!$pagedSearchOK) {
-						return false;
-					}
-					\OCP\Util::writeLog('user_ldap', 'Ready for a paged search', \OCP\Util::DEBUG);
-				} else {
-					\OCP\Util::writeLog('user_ldap',
-						'No paged search for us, Cpt., Limit '.$limit.' Offset '.$offset,
-						\OCP\Util::INFO);
-				}
-
-			}
-		/* ++ Fixing RHDS searches with pages with zero results ++
+            \OC::$server->getLogger()->info(
+                'Passed string does not resemble a valid GUID. Known UUID ' .
+                '({uuid}) probably does not match UUID configuration.',
+                [ 'app' => 'user_ldap', 'uuid' => $guid ]
+            );
+            return $guid;
+        }
+        for($i=0; $i < 3; $i++) {
+            $pairs = str_split($blocks[$i], 2);
+            $pairs = array_reverse($pairs);
+            $blocks[$i] = implode('', $pairs);
+        }
+        for($i=0; $i < 5; $i++) {
+            $pairs = str_split($blocks[$i], 2);
+            $blocks[$i] = '\\' . implode('\\', $pairs);
+        }
+        return implode('', $blocks);
+    }
+
+    /**
+     * gets a SID of the domain of the given dn
+     * @param string $dn
+     * @return string|bool
+     */
+    public function getSID($dn) {
+        $domainDN = $this->getDomainDNFromDN($dn);
+        $cacheKey = 'getSID-'.$domainDN;
+        $sid = $this->connection->getFromCache($cacheKey);
+        if(!is_null($sid)) {
+            return $sid;
+        }
+
+        $objectSid = $this->readAttribute($domainDN, 'objectsid');
+        if(!is_array($objectSid) || empty($objectSid)) {
+            $this->connection->writeToCache($cacheKey, false);
+            return false;
+        }
+        $domainObjectSid = $this->convertSID2Str($objectSid[0]);
+        $this->connection->writeToCache($cacheKey, $domainObjectSid);
+
+        return $domainObjectSid;
+    }
+
+    /**
+     * converts a binary SID into a string representation
+     * @param string $sid
+     * @return string
+     */
+    public function convertSID2Str($sid) {
+        // The format of a SID binary string is as follows:
+        // 1 byte for the revision level
+        // 1 byte for the number n of variable sub-ids
+        // 6 bytes for identifier authority value
+        // n*4 bytes for n sub-ids
+        //
+        // Example: 010400000000000515000000a681e50e4d6c6c2bca32055f
+        //  Legend: RRNNAAAAAAAAAAAA11111111222222223333333344444444
+        $revision = ord($sid[0]);
+        $numberSubID = ord($sid[1]);
+
+        $subIdStart = 8; // 1 + 1 + 6
+        $subIdLength = 4;
+        if (strlen($sid) !== $subIdStart + $subIdLength * $numberSubID) {
+            // Incorrect number of bytes present.
+            return '';
+        }
+
+        // 6 bytes = 48 bits can be represented using floats without loss of
+        // precision (see https://gist.github.com/bantu/886ac680b0aef5812f71)
+        $iav = number_format(hexdec(bin2hex(substr($sid, 2, 6))), 0, '', '');
+
+        $subIDs = array();
+        for ($i = 0; $i < $numberSubID; $i++) {
+            $subID = unpack('V', substr($sid, $subIdStart + $subIdLength * $i, $subIdLength));
+            $subIDs[] = sprintf('%u', $subID[1]);
+        }
+
+        // Result for example above: S-1-5-21-249921958-728525901-1594176202
+        return sprintf('S-%d-%s-%s', $revision, $iav, implode('-', $subIDs));
+    }
+
+    /**
+     * checks if the given DN is part of the given base DN(s)
+     * @param string $dn the DN
+     * @param string[] $bases array containing the allowed base DN or DNs
+     * @return bool
+     */
+    public function isDNPartOfBase($dn, $bases) {
+        $belongsToBase = false;
+        $bases = $this->helper->sanitizeDN($bases);
+
+        foreach($bases as $base) {
+            $belongsToBase = true;
+            if(mb_strripos($dn, $base, 0, 'UTF-8') !== (mb_strlen($dn, 'UTF-8')-mb_strlen($base, 'UTF-8'))) {
+                $belongsToBase = false;
+            }
+            if($belongsToBase) {
+                break;
+            }
+        }
+        return $belongsToBase;
+    }
+
+    /**
+     * resets a running Paged Search operation
+     */
+    private function abandonPagedSearch() {
+        if($this->connection->hasPagedResultSupport) {
+            $cr = $this->connection->getConnectionResource();
+            $this->ldap->controlPagedResult($cr, 0, false, $this->lastCookie);
+            $this->getPagedSearchResultState();
+            $this->lastCookie = '';
+            $this->cookies = array();
+        }
+    }
+
+    /**
+     * get a cookie for the next LDAP paged search
+     * @param string $base a string with the base DN for the search
+     * @param string $filter the search filter to identify the correct search
+     * @param int $limit the limit (or 'pageSize'), to identify the correct search well
+     * @param int $offset the offset for the new search to identify the correct search really good
+     * @return string containing the key or empty if none is cached
+     */
+    private function getPagedResultCookie($base, $filter, $limit, $offset) {
+        if($offset === 0) {
+            return '';
+        }
+        $offset -= $limit;
+        //we work with cache here
+        $cacheKey = 'lc' . crc32($base) . '-' . crc32($filter) . '-' . intval($limit) . '-' . intval($offset);
+        $cookie = '';
+        if(isset($this->cookies[$cacheKey])) {
+            $cookie = $this->cookies[$cacheKey];
+            if(is_null($cookie)) {
+                $cookie = '';
+            }
+        }
+        return $cookie;
+    }
+
+    /**
+     * checks whether an LDAP paged search operation has more pages that can be
+     * retrieved, typically when offset and limit are provided.
+     *
+     * Be very careful to use it: the last cookie value, which is inspected, can
+     * be reset by other operations. Best, call it immediately after a search(),
+     * searchUsers() or searchGroups() call. count-methods are probably safe as
+     * well. Don't rely on it with any fetchList-method.
+     * @return bool
+     */
+    public function hasMoreResults() {
+        if(!$this->connection->hasPagedResultSupport) {
+            return false;
+        }
+
+        if(empty($this->lastCookie) && $this->lastCookie !== '0') {
+            // as in RFC 2696, when all results are returned, the cookie will
+            // be empty.
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * set a cookie for LDAP paged search run
+     * @param string $base a string with the base DN for the search
+     * @param string $filter the search filter to identify the correct search
+     * @param int $limit the limit (or 'pageSize'), to identify the correct search well
+     * @param int $offset the offset for the run search to identify the correct search really good
+     * @param string $cookie string containing the cookie returned by ldap_control_paged_result_response
+     * @return void
+     */
+    private function setPagedResultCookie($base, $filter, $limit, $offset, $cookie) {
+        // allow '0' for 389ds
+        if(!empty($cookie) || $cookie === '0') {
+            $cacheKey = 'lc' . crc32($base) . '-' . crc32($filter) . '-' .intval($limit) . '-' . intval($offset);
+            $this->cookies[$cacheKey] = $cookie;
+            $this->lastCookie = $cookie;
+        }
+    }
+
+    /**
+     * Check whether the most recent paged search was successful. It flushed the state var. Use it always after a possible paged search.
+     * @return boolean|null true on success, null or false otherwise
+     */
+    public function getPagedSearchResultState() {
+        $result = $this->pagedSearchedSuccessful;
+        $this->pagedSearchedSuccessful = null;
+        return $result;
+    }
+
+    /**
+     * Prepares a paged search, if possible
+     * @param string $filter the LDAP filter for the search
+     * @param string[] $bases an array containing the LDAP subtree(s) that shall be searched
+     * @param string[] $attr optional, when a certain attribute shall be filtered outside
+     * @param int $limit
+     * @param int $offset
+     * @return bool|true
+     */
+    private function initPagedSearch($filter, $bases, $attr, $limit, $offset) {
+        $pagedSearchOK = false;
+        if($this->connection->hasPagedResultSupport && ($limit !== 0)) {
+            $offset = intval($offset); //can be null
+            \OCP\Util::writeLog('user_ldap',
+                'initializing paged search for  Filter '.$filter.' base '.print_r($bases, true)
+                .' attr '.print_r($attr, true). ' limit ' .$limit.' offset '.$offset,
+                \OCP\Util::DEBUG);
+            //get the cookie from the search for the previous search, required by LDAP
+            foreach($bases as $base) {
+
+                $cookie = $this->getPagedResultCookie($base, $filter, $limit, $offset);
+                if(empty($cookie) && $cookie !== "0" && ($offset > 0)) {
+                    // no cookie known, although the offset is not 0. Maybe cache run out. We need
+                    // to start all over *sigh* (btw, Dear Reader, did you know LDAP paged
+                    // searching was designed by MSFT?)
+                    // 		Lukas: No, but thanks to reading that source I finally know!
+                    // '0' is valid, because 389ds
+                    $reOffset = ($offset - $limit) < 0 ? 0 : $offset - $limit;
+                    //a bit recursive, $offset of 0 is the exit
+                    \OCP\Util::writeLog('user_ldap', 'Looking for cookie L/O '.$limit.'/'.$reOffset, \OCP\Util::INFO);
+                    $this->search($filter, array($base), $attr, $limit, $reOffset, true);
+                    $cookie = $this->getPagedResultCookie($base, $filter, $limit, $offset);
+                    //still no cookie? obviously, the server does not like us. Let's skip paging efforts.
+                    //TODO: remember this, probably does not change in the next request...
+                    if(empty($cookie) && $cookie !== '0') {
+                        // '0' is valid, because 389ds
+                        $cookie = null;
+                    }
+                }
+                if(!is_null($cookie)) {
+                    //since offset = 0, this is a new search. We abandon other searches that might be ongoing.
+                    $this->abandonPagedSearch();
+                    $pagedSearchOK = $this->ldap->controlPagedResult(
+                        $this->connection->getConnectionResource(), $limit,
+                        false, $cookie);
+                    if(!$pagedSearchOK) {
+                        return false;
+                    }
+                    \OCP\Util::writeLog('user_ldap', 'Ready for a paged search', \OCP\Util::DEBUG);
+                } else {
+                    \OCP\Util::writeLog('user_ldap',
+                        'No paged search for us, Cpt., Limit '.$limit.' Offset '.$offset,
+                        \OCP\Util::INFO);
+                }
+
+            }
+        /* ++ Fixing RHDS searches with pages with zero results ++
 		 * We coudn't get paged searches working with our RHDS for login ($limit = 0),
 		 * due to pages with zero results.
 		 * So we added "&& !empty($this->lastCookie)" to this test to ignore pagination
 		 * if we don't have a previous paged search.
 		 */
-		} else if($this->connection->hasPagedResultSupport && $limit === 0 && !empty($this->lastCookie)) {
-			// a search without limit was requested. However, if we do use
-			// Paged Search once, we always must do it. This requires us to
-			// initialize it with the configured page size.
-			$this->abandonPagedSearch();
-			// in case someone set it to 0 … use 500, otherwise no results will
-			// be returned.
-			$pageSize = intval($this->connection->ldapPagingSize) > 0 ? intval($this->connection->ldapPagingSize) : 500;
-			$pagedSearchOK = $this->ldap->controlPagedResult(
-				$this->connection->getConnectionResource(), $pageSize, false, ''
-			);
-		}
-
-		return $pagedSearchOK;
-	}
+        } else if($this->connection->hasPagedResultSupport && $limit === 0 && !empty($this->lastCookie)) {
+            // a search without limit was requested. However, if we do use
+            // Paged Search once, we always must do it. This requires us to
+            // initialize it with the configured page size.
+            $this->abandonPagedSearch();
+            // in case someone set it to 0 … use 500, otherwise no results will
+            // be returned.
+            $pageSize = intval($this->connection->ldapPagingSize) > 0 ? intval($this->connection->ldapPagingSize) : 500;
+            $pagedSearchOK = $this->ldap->controlPagedResult(
+                $this->connection->getConnectionResource(), $pageSize, false, ''
+            );
+        }
+
+        return $pagedSearchOK;
+    }
 
 }

Spacing +163 added lines, -163 removed lines

@@ -110,7 +110,7 @@ 
 	 * @return AbstractMapping
 	 */
 	public function getUserMapper() {
-		if(is_null($this->userMapper)) {
+		if (is_null($this->userMapper)) {
 			throw new \Exception('UserMapper was not assigned to this Access instance.');
 		}
 		return $this->userMapper;
@@ -130,7 +130,7 @@ 
 	 * @return AbstractMapping
 	 */
 	public function getGroupMapper() {
-		if(is_null($this->groupMapper)) {
+		if (is_null($this->groupMapper)) {
 			throw new \Exception('GroupMapper was not assigned to this Access instance.');
 		}
 		return $this->groupMapper;
@@ -161,14 +161,14 @@ 
 	 *          array if $attr is empty, false otherwise
 	 */
 	public function readAttribute($dn, $attr, $filter = 'objectClass=*') {
-		if(!$this->checkConnection()) {
+		if (!$this->checkConnection()) {
 			\OCP\Util::writeLog('user_ldap',
 				'No LDAP Connector assigned, access impossible for readAttribute.',
 				\OCP\Util::WARN);
 			return false;
 		}
 		$cr = $this->connection->getConnectionResource();
-		if(!$this->ldap->isResource($cr)) {
+		if (!$this->ldap->isResource($cr)) {
 			//LDAP not available
 			\OCP\Util::writeLog('user_ldap', 'LDAP resource not available.', \OCP\Util::DEBUG);
 			return false;
@@ -191,7 +191,7 @@ 
 		$isRangeRequest = false;
 		do {
 			$result = $this->executeRead($cr, $dn, $attrToRead, $filter, $maxResults);
-			if(is_bool($result)) {
+			if (is_bool($result)) {
 				// when an exists request was run and it was successful, an empty
 				// array must be returned
 				return $result ? [] : false;
@@ -208,22 +208,22 @@ 
 			$result = $this->extractRangeData($result, $attr);
 			if (!empty($result)) {
 				$normalizedResult = $this->extractAttributeValuesFromResult(
-					[ $attr => $result['values'] ],
+					[$attr => $result['values']],
 					$attr
 				);
 				$values = array_merge($values, $normalizedResult);
 
-				if($result['rangeHigh'] === '*') {
+				if ($result['rangeHigh'] === '*') {
 					// when server replies with * as high range value, there are
 					// no more results left
 					return $values;
 				} else {
-					$low  = $result['rangeHigh'] + 1;
-					$attrToRead = $result['attributeName'] . ';range=' . $low . '-*';
+					$low = $result['rangeHigh'] + 1;
+					$attrToRead = $result['attributeName'].';range='.$low.'-*';
 					$isRangeRequest = true;
 				}
 			}
-		} while($isRangeRequest);
+		} while ($isRangeRequest);
 
 		\OCP\Util::writeLog('user_ldap', 'Requested attribute '.$attr.' not found for '.$dn, \OCP\Util::DEBUG);
 		return false;
@@ -248,13 +248,13 @@ 
 		if (!$this->ldap->isResource($rr)) {
 			if ($attribute !== '') {
 				//do not throw this message on userExists check, irritates
-				\OCP\Util::writeLog('user_ldap', 'readAttribute failed for DN ' . $dn, \OCP\Util::DEBUG);
+				\OCP\Util::writeLog('user_ldap', 'readAttribute failed for DN '.$dn, \OCP\Util::DEBUG);
 			}
 			//in case an error occurs , e.g. object does not exist
 			return false;
 		}
 		if ($attribute === '' && ($filter === 'objectclass=*' || $this->ldap->countEntries($cr, $rr) === 1)) {
-			\OCP\Util::writeLog('user_ldap', 'readAttribute: ' . $dn . ' found', \OCP\Util::DEBUG);
+			\OCP\Util::writeLog('user_ldap', 'readAttribute: '.$dn.' found', \OCP\Util::DEBUG);
 			return true;
 		}
 		$er = $this->ldap->firstEntry($cr, $rr);
@@ -279,12 +279,12 @@ 
 	 */
 	public function extractAttributeValuesFromResult($result, $attribute) {
 		$values = [];
-		if(isset($result[$attribute]) && $result[$attribute]['count'] > 0) {
+		if (isset($result[$attribute]) && $result[$attribute]['count'] > 0) {
 			$lowercaseAttribute = strtolower($attribute);
-			for($i=0;$i<$result[$attribute]['count'];$i++) {
-				if($this->resemblesDN($attribute)) {
+			for ($i = 0; $i < $result[$attribute]['count']; $i++) {
+				if ($this->resemblesDN($attribute)) {
 					$values[] = $this->helper->sanitizeDN($result[$attribute][$i]);
-				} elseif($lowercaseAttribute === 'objectguid' || $lowercaseAttribute === 'guid') {
+				} elseif ($lowercaseAttribute === 'objectguid' || $lowercaseAttribute === 'guid') {
 					$values[] = $this->convertObjectGUID2Str($result[$attribute][$i]);
 				} else {
 					$values[] = $result[$attribute][$i];
@@ -306,10 +306,10 @@ 
 	 */
 	public function extractRangeData($result, $attribute) {
 		$keys = array_keys($result);
-		foreach($keys as $key) {
-			if($key !== $attribute && strpos($key, $attribute) === 0) {
+		foreach ($keys as $key) {
+			if ($key !== $attribute && strpos($key, $attribute) === 0) {
 				$queryData = explode(';', $key);
-				if(strpos($queryData[1], 'range=') === 0) {
+				if (strpos($queryData[1], 'range=') === 0) {
 					$high = substr($queryData[1], 1 + strpos($queryData[1], '-'));
 					$data = [
 						'values' => $result[$key],
@@ -334,11 +334,11 @@ 
 	 * @throws \Exception
 	 */
 	public function setPassword($userDN, $password) {
-		if(intval($this->connection->turnOnPasswordChange) !== 1) {
+		if (intval($this->connection->turnOnPasswordChange) !== 1) {
 			throw new \Exception('LDAP password changes are disabled.');
 		}
 		$cr = $this->connection->getConnectionResource();
-		if(!$this->ldap->isResource($cr)) {
+		if (!$this->ldap->isResource($cr)) {
 			//LDAP not available
 			\OCP\Util::writeLog('user_ldap', 'LDAP resource not available.', \OCP\Util::DEBUG);
 			return false;
@@ -346,7 +346,7 @@ 
 		
 		try {
 			return $this->ldap->modReplace($cr, $userDN, $password);
-		} catch(ConstraintViolationException $e) {
+		} catch (ConstraintViolationException $e) {
 			throw new HintException('Password change rejected.', \OC::$server->getL10N('user_ldap')->t('Password change rejected. Hint: ').$e->getMessage(), $e->getCode());
 		}
 	}
@@ -388,17 +388,17 @@ 
 	 */
 	public function getDomainDNFromDN($dn) {
 		$allParts = $this->ldap->explodeDN($dn, 0);
-		if($allParts === false) {
+		if ($allParts === false) {
 			//not a valid DN
 			return '';
 		}
 		$domainParts = array();
 		$dcFound = false;
-		foreach($allParts as $part) {
-			if(!$dcFound && strpos($part, 'dc=') === 0) {
+		foreach ($allParts as $part) {
+			if (!$dcFound && strpos($part, 'dc=') === 0) {
 				$dcFound = true;
 			}
-			if($dcFound) {
+			if ($dcFound) {
 				$domainParts[] = $part;
 			}
 		}
@@ -425,7 +425,7 @@ 
 
 		//Check whether the DN belongs to the Base, to avoid issues on multi-
 		//server setups
-		if(is_string($fdn) && $this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) {
+		if (is_string($fdn) && $this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) {
 			return $fdn;
 		}
 
@@ -442,7 +442,7 @@ 
 		//To avoid bypassing the base DN settings under certain circumstances
 		//with the group support, check whether the provided DN matches one of
 		//the given Bases
-		if(!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseGroups)) {
+		if (!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseGroups)) {
 			return false;
 		}
 
@@ -459,11 +459,11 @@ 
 	 */
 	public function groupsMatchFilter($groupDNs) {
 		$validGroupDNs = [];
-		foreach($groupDNs as $dn) {
+		foreach ($groupDNs as $dn) {
 			$cacheKey = 'groupsMatchFilter-'.$dn;
 			$groupMatchFilter = $this->connection->getFromCache($cacheKey);
-			if(!is_null($groupMatchFilter)) {
-				if($groupMatchFilter) {
+			if (!is_null($groupMatchFilter)) {
+				if ($groupMatchFilter) {
 					$validGroupDNs[] = $dn;
 				}
 				continue;
@@ -471,13 +471,13 @@ 
 
 			// Check the base DN first. If this is not met already, we don't
 			// need to ask the server at all.
-			if(!$this->isDNPartOfBase($dn, $this->connection->ldapBaseGroups)) {
+			if (!$this->isDNPartOfBase($dn, $this->connection->ldapBaseGroups)) {
 				$this->connection->writeToCache($cacheKey, false);
 				continue;
 			}
 
 			$result = $this->readAttribute($dn, 'cn', $this->connection->ldapGroupFilter);
-			if(is_array($result)) {
+			if (is_array($result)) {
 				$this->connection->writeToCache($cacheKey, true);
 				$validGroupDNs[] = $dn;
 			} else {
@@ -498,7 +498,7 @@ 
 		//To avoid bypassing the base DN settings under certain circumstances
 		//with the group support, check whether the provided DN matches one of
 		//the given Bases
-		if(!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) {
+		if (!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) {
 			return false;
 		}
 
@@ -513,7 +513,7 @@ 
 	 * @return string|false with with the name to use in ownCloud
 	 */
 	public function dn2ocname($fdn, $ldapName = null, $isUser = true) {
-		if($isUser) {
+		if ($isUser) {
 			$mapper = $this->getUserMapper();
 			$nameAttribute = $this->connection->ldapUserDisplayName;
 		} else {
@@ -523,15 +523,15 @@ 
 
 		//let's try to retrieve the ownCloud name from the mappings table
 		$ocName = $mapper->getNameByDN($fdn);
-		if(is_string($ocName)) {
+		if (is_string($ocName)) {
 			return $ocName;
 		}
 
 		//second try: get the UUID and check if it is known. Then, update the DN and return the name.
 		$uuid = $this->getUUID($fdn, $isUser);
-		if(is_string($uuid)) {
+		if (is_string($uuid)) {
 			$ocName = $mapper->getNameByUUID($uuid);
-			if(is_string($ocName)) {
+			if (is_string($ocName)) {
 				$mapper->setDNbyUUID($fdn, $uuid);
 				return $ocName;
 			}
@@ -541,16 +541,16 @@ 
 			return false;
 		}
 
-		if(is_null($ldapName)) {
+		if (is_null($ldapName)) {
 			$ldapName = $this->readAttribute($fdn, $nameAttribute);
-			if(!isset($ldapName[0]) && empty($ldapName[0])) {
+			if (!isset($ldapName[0]) && empty($ldapName[0])) {
 				\OCP\Util::writeLog('user_ldap', 'No or empty name for '.$fdn.'.', \OCP\Util::INFO);
 				return false;
 			}
 			$ldapName = $ldapName[0];
 		}
 
-		if($isUser) {
+		if ($isUser) {
 			$usernameAttribute = strval($this->connection->ldapExpertUsernameAttr);
 			if ($usernameAttribute !== '') {
 				$username = $this->readAttribute($fdn, $usernameAttribute);
@@ -569,9 +569,9 @@ 
 		// outside of core user management will still cache the user as non-existing.
 		$originalTTL = $this->connection->ldapCacheTTL;
 		$this->connection->setConfiguration(array('ldapCacheTTL' => 0));
-		if(($isUser && !\OCP\User::userExists($intName))
+		if (($isUser && !\OCP\User::userExists($intName))
 			|| (!$isUser && !\OC::$server->getGroupManager()->groupExists($intName))) {
-			if($mapper->map($fdn, $intName, $uuid)) {
+			if ($mapper->map($fdn, $intName, $uuid)) {
 				$this->connection->setConfiguration(array('ldapCacheTTL' => $originalTTL));
 				return $intName;
 			}
@@ -579,7 +579,7 @@ 
 		$this->connection->setConfiguration(array('ldapCacheTTL' => $originalTTL));
 
 		$altName = $this->createAltInternalOwnCloudName($intName, $isUser);
-		if(is_string($altName) && $mapper->map($fdn, $altName, $uuid)) {
+		if (is_string($altName) && $mapper->map($fdn, $altName, $uuid)) {
 			return $altName;
 		}
 
@@ -616,7 +616,7 @@ 
 	 * @return array
 	 */
 	private function ldap2ownCloudNames($ldapObjects, $isUsers) {
-		if($isUsers) {
+		if ($isUsers) {
 			$nameAttribute = $this->connection->ldapUserDisplayName;
 			$sndAttribute  = $this->connection->ldapUserDisplayName2;
 		} else {
@@ -624,9 +624,9 @@ 
 		}
 		$ownCloudNames = array();
 
-		foreach($ldapObjects as $ldapObject) {
+		foreach ($ldapObjects as $ldapObject) {
 			$nameByLDAP = null;
-			if(    isset($ldapObject[$nameAttribute])
+			if (isset($ldapObject[$nameAttribute])
 				&& is_array($ldapObject[$nameAttribute])
 				&& isset($ldapObject[$nameAttribute][0])
 			) {
@@ -635,12 +635,12 @@ 
 			}
 
 			$ocName = $this->dn2ocname($ldapObject['dn'][0], $nameByLDAP, $isUsers);
-			if($ocName) {
+			if ($ocName) {
 				$ownCloudNames[] = $ocName;
-				if($isUsers) {
+				if ($isUsers) {
 					//cache the user names so it does not need to be retrieved
 					//again later (e.g. sharing dialogue).
-					if(is_null($nameByLDAP)) {
+					if (is_null($nameByLDAP)) {
 						continue;
 					}
 					$sndName = isset($ldapObject[$sndAttribute][0])
@@ -678,7 +678,7 @@ 
 	 */
 	public function cacheUserDisplayName($ocName, $displayName, $displayName2 = '') {
 		$user = $this->userManager->get($ocName);
-		if($user === null) {
+		if ($user === null) {
 			return;
 		}
 		$displayName = $user->composeAndStoreDisplayName($displayName, $displayName2);
@@ -698,9 +698,9 @@ 
 		$attempts = 0;
 		//while loop is just a precaution. If a name is not generated within
 		//20 attempts, something else is very wrong. Avoids infinite loop.
-		while($attempts < 20){
-			$altName = $name . '_' . rand(1000,9999);
-			if(!\OCP\User::userExists($altName)) {
+		while ($attempts < 20) {
+			$altName = $name.'_'.rand(1000, 9999);
+			if (!\OCP\User::userExists($altName)) {
 				return $altName;
 			}
 			$attempts++;
@@ -722,25 +722,25 @@ 
 	 */
 	private function _createAltInternalOwnCloudNameForGroups($name) {
 		$usedNames = $this->groupMapper->getNamesBySearch($name, "", '_%');
-		if(!($usedNames) || count($usedNames) === 0) {
+		if (!($usedNames) || count($usedNames) === 0) {
 			$lastNo = 1; //will become name_2
 		} else {
 			natsort($usedNames);
 			$lastName = array_pop($usedNames);
 			$lastNo = intval(substr($lastName, strrpos($lastName, '_') + 1));
 		}
-		$altName = $name.'_'.strval($lastNo+1);
+		$altName = $name.'_'.strval($lastNo + 1);
 		unset($usedNames);
 
 		$attempts = 1;
-		while($attempts < 21){
+		while ($attempts < 21) {
 			// Check to be really sure it is unique
 			// while loop is just a precaution. If a name is not generated within
 			// 20 attempts, something else is very wrong. Avoids infinite loop.
-			if(!\OC::$server->getGroupManager()->groupExists($altName)) {
+			if (!\OC::$server->getGroupManager()->groupExists($altName)) {
 				return $altName;
 			}
-			$altName = $name . '_' . ($lastNo + $attempts);
+			$altName = $name.'_'.($lastNo + $attempts);
 			$attempts++;
 		}
 		return false;
@@ -755,7 +755,7 @@ 
 	private function createAltInternalOwnCloudName($name, $isUser) {
 		$originalTTL = $this->connection->ldapCacheTTL;
 		$this->connection->setConfiguration(array('ldapCacheTTL' => 0));
-		if($isUser) {
+		if ($isUser) {
 			$altName = $this->_createAltInternalOwnCloudNameForUsers($name);
 		} else {
 			$altName = $this->_createAltInternalOwnCloudNameForGroups($name);
@@ -813,20 +813,20 @@ 
 	 * and their values
 	 * @param array $ldapRecords
 	 */
-	public function batchApplyUserAttributes(array $ldapRecords){
+	public function batchApplyUserAttributes(array $ldapRecords) {
 		$displayNameAttribute = strtolower($this->connection->ldapUserDisplayName);
-		foreach($ldapRecords as $userRecord) {
-			if(!isset($userRecord[$displayNameAttribute])) {
+		foreach ($ldapRecords as $userRecord) {
+			if (!isset($userRecord[$displayNameAttribute])) {
 				// displayName is obligatory
 				continue;
 			}
-			$ocName  = $this->dn2ocname($userRecord['dn'][0]);
-			if($ocName === false) {
+			$ocName = $this->dn2ocname($userRecord['dn'][0]);
+			if ($ocName === false) {
 				continue;
 			}
 			$this->cacheUserExists($ocName);
 			$user = $this->userManager->get($ocName);
-			if($user instanceof OfflineUser) {
+			if ($user instanceof OfflineUser) {
 				$user->unmark();
 				$user = $this->userManager->get($ocName);
 			}
@@ -858,8 +858,8 @@ 
 	 * @return array
 	 */
 	private function fetchList($list, $manyAttributes) {
-		if(is_array($list)) {
-			if($manyAttributes) {
+		if (is_array($list)) {
+			if ($manyAttributes) {
 				return $list;
 			} else {
 				$list = array_reduce($list, function($carry, $item) {
@@ -945,13 +945,13 @@ 
 	 * second | false if not successful
 	 */
 	private function executeSearch($filter, $base, &$attr = null, $limit = null, $offset = null) {
-		if(!is_null($attr) && !is_array($attr)) {
+		if (!is_null($attr) && !is_array($attr)) {
 			$attr = array(mb_strtolower($attr, 'UTF-8'));
 		}
 
 		// See if we have a resource, in case not cancel with message
 		$cr = $this->connection->getConnectionResource();
-		if(!$this->ldap->isResource($cr)) {
+		if (!$this->ldap->isResource($cr)) {
 			// Seems like we didn't find any resource.
 			// Return an empty array just like before.
 			\OCP\Util::writeLog('user_ldap', 'Could not search, because resource is missing.', \OCP\Util::DEBUG);
@@ -964,7 +964,7 @@ 
 		$linkResources = array_pad(array(), count($base), $cr);
 		$sr = $this->ldap->search($linkResources, $base, $filter, $attr);
 		$error = $this->ldap->errno($cr);
-		if(!is_array($sr) || $error !== 0) {
+		if (!is_array($sr) || $error !== 0) {
 			\OCP\Util::writeLog('user_ldap', 'Attempt for Paging?  '.print_r($pagedSearchOK, true), \OCP\Util::ERROR);
 			return false;
 		}
@@ -987,26 +987,26 @@ 
 	 */
 	private function processPagedSearchStatus($sr, $filter, $base, $iFoundItems, $limit, $offset, $pagedSearchOK, $skipHandling) {
 		$cookie = null;
-		if($pagedSearchOK) {
+		if ($pagedSearchOK) {
 			$cr = $this->connection->getConnectionResource();
-			foreach($sr as $key => $res) {
-				if($this->ldap->controlPagedResultResponse($cr, $res, $cookie)) {
+			foreach ($sr as $key => $res) {
+				if ($this->ldap->controlPagedResultResponse($cr, $res, $cookie)) {
 					$this->setPagedResultCookie($base[$key], $filter, $limit, $offset, $cookie);
 				}
 			}
 
 			//browsing through prior pages to get the cookie for the new one
-			if($skipHandling) {
+			if ($skipHandling) {
 				return false;
 			}
 			// if count is bigger, then the server does not support
 			// paged search. Instead, he did a normal search. We set a
 			// flag here, so the callee knows how to deal with it.
-			if($iFoundItems <= $limit) {
+			if ($iFoundItems <= $limit) {
 				$this->pagedSearchedSuccessful = true;
 			}
 		} else {
-			if(!is_null($limit)) {
+			if (!is_null($limit)) {
 				\OCP\Util::writeLog('user_ldap', 'Paged search was not available', \OCP\Util::INFO);
 			}
 		}
@@ -1035,7 +1035,7 @@ 
 		\OCP\Util::writeLog('user_ldap', 'Count filter:  '.print_r($filter, true), \OCP\Util::DEBUG);
 
 		$limitPerPage = intval($this->connection->ldapPagingSize);
-		if(!is_null($limit) && $limit < $limitPerPage && $limit > 0) {
+		if (!is_null($limit) && $limit < $limitPerPage && $limit > 0) {
 			$limitPerPage = $limit;
 		}
 
@@ -1046,7 +1046,7 @@ 
 		do {
 			$search = $this->executeSearch($filter, $base, $attr,
 										   $limitPerPage, $offset);
-			if($search === false) {
+			if ($search === false) {
 				return $counter > 0 ? $counter : false;
 			}
 			list($sr, $pagedSearchOK) = $search;
@@ -1065,7 +1065,7 @@ 
 			 * Continue now depends on $hasMorePages value
 			 */
 			$continue = $pagedSearchOK && $hasMorePages;
-		} while($continue && (is_null($limit) || $limit <= 0 || $limit > $counter));
+		} while ($continue && (is_null($limit) || $limit <= 0 || $limit > $counter));
 
 		return $counter;
 	}
@@ -1078,7 +1078,7 @@ 
 		$cr = $this->connection->getConnectionResource();
 		$counter = 0;
 
-		foreach($searchResults as $res) {
+		foreach ($searchResults as $res) {
 			$count = intval($this->ldap->countEntries($cr, $res));
 			$counter += $count;
 		}
@@ -1097,7 +1097,7 @@ 
 	 * @return array with the search result
 	 */
 	private function search($filter, $base, $attr = null, $limit = null, $offset = null, $skipHandling = false) {
-		if($limit <= 0) {
+		if ($limit <= 0) {
 			//otherwise search will fail
 			$limit = null;
 		}
@@ -1112,13 +1112,13 @@ 
 		$savedoffset = $offset;
 		do {
 			$search = $this->executeSearch($filter, $base, $attr, $limit, $offset);
-			if($search === false) {
+			if ($search === false) {
 				return array();
 			}
 			list($sr, $pagedSearchOK) = $search;
 			$cr = $this->connection->getConnectionResource();
 
-			if($skipHandling) {
+			if ($skipHandling) {
 				//i.e. result do not need to be fetched, we just need the cookie
 				//thus pass 1 or any other value as $iFoundItems because it is not
 				//used
@@ -1128,8 +1128,8 @@ 
 				return array();
 			}
 
-			foreach($sr as $res) {
-				$findings = array_merge($findings, $this->ldap->getEntries($cr	, $res ));
+			foreach ($sr as $res) {
+				$findings = array_merge($findings, $this->ldap->getEntries($cr, $res));
 			}
 
 			$continue = $this->processPagedSearchStatus($sr, $filter, $base, $findings['count'],
@@ -1142,25 +1142,25 @@ 
 
 		// if we're here, probably no connection resource is returned.
 		// to make ownCloud behave nicely, we simply give back an empty array.
-		if(is_null($findings)) {
+		if (is_null($findings)) {
 			return array();
 		}
 
-		if(!is_null($attr)) {
+		if (!is_null($attr)) {
 			$selection = array();
 			$i = 0;
-			foreach($findings as $item) {
-				if(!is_array($item)) {
+			foreach ($findings as $item) {
+				if (!is_array($item)) {
 					continue;
 				}
 				$item = \OCP\Util::mb_array_change_key_case($item, MB_CASE_LOWER, 'UTF-8');
-				foreach($attr as $key) {
+				foreach ($attr as $key) {
 					$key = mb_strtolower($key, 'UTF-8');
-					if(isset($item[$key])) {
-						if(is_array($item[$key]) && isset($item[$key]['count'])) {
+					if (isset($item[$key])) {
+						if (is_array($item[$key]) && isset($item[$key]['count'])) {
 							unset($item[$key]['count']);
 						}
-						if($key !== 'dn') {
+						if ($key !== 'dn') {
 							$selection[$i][$key] = $this->resemblesDN($key) ?
 								$this->helper->sanitizeDN($item[$key])
 								: $item[$key];
@@ -1177,7 +1177,7 @@ 
 		//we slice the findings, when
 		//a) paged search unsuccessful, though attempted
 		//b) no paged search, but limit set
-		if((!$this->getPagedSearchResultState()
+		if ((!$this->getPagedSearchResultState()
 			&& $pagedSearchOK)
 			|| (
 				!$pagedSearchOK
@@ -1194,7 +1194,7 @@ 
 	 * @return bool|mixed|string
 	 */
 	public function sanitizeUsername($name) {
-		if($this->connection->ldapIgnoreNamingRules) {
+		if ($this->connection->ldapIgnoreNamingRules) {
 			return $name;
 		}
 
@@ -1219,13 +1219,13 @@ 
 	*/
 	public function escapeFilterPart($input, $allowAsterisk = false) {
 		$asterisk = '';
-		if($allowAsterisk && strlen($input) > 0 && $input[0] === '*') {
+		if ($allowAsterisk && strlen($input) > 0 && $input[0] === '*') {
 			$asterisk = '*';
 			$input = mb_substr($input, 1, null, 'UTF-8');
 		}
 		$search  = array('*', '\\', '(', ')');
 		$replace = array('\\*', '\\\\', '\\(', '\\)');
-		return $asterisk . str_replace($search, $replace, $input);
+		return $asterisk.str_replace($search, $replace, $input);
 	}
 
 	/**
@@ -1255,13 +1255,13 @@ 
 	 */
 	private function combineFilter($filters, $operator) {
 		$combinedFilter = '('.$operator;
-		foreach($filters as $filter) {
+		foreach ($filters as $filter) {
 			if ($filter !== '' && $filter[0] !== '(') {
 				$filter = '('.$filter.')';
 			}
-			$combinedFilter.=$filter;
+			$combinedFilter .= $filter;
 		}
-		$combinedFilter.=')';
+		$combinedFilter .= ')';
 		return $combinedFilter;
 	}
 
@@ -1297,17 +1297,17 @@ 
 	 * @throws \Exception
 	 */
 	private function getAdvancedFilterPartForSearch($search, $searchAttributes) {
-		if(!is_array($searchAttributes) || count($searchAttributes) < 2) {
+		if (!is_array($searchAttributes) || count($searchAttributes) < 2) {
 			throw new \Exception('searchAttributes must be an array with at least two string');
 		}
 		$searchWords = explode(' ', trim($search));
 		$wordFilters = array();
-		foreach($searchWords as $word) {
+		foreach ($searchWords as $word) {
 			$word = $this->prepareSearchTerm($word);
 			//every word needs to appear at least once
 			$wordMatchOneAttrFilters = array();
-			foreach($searchAttributes as $attr) {
-				$wordMatchOneAttrFilters[] = $attr . '=' . $word;
+			foreach ($searchAttributes as $attr) {
+				$wordMatchOneAttrFilters[] = $attr.'='.$word;
 			}
 			$wordFilters[] = $this->combineFilterWithOr($wordMatchOneAttrFilters);
 		}
@@ -1325,10 +1325,10 @@ 
 	private function getFilterPartForSearch($search, $searchAttributes, $fallbackAttribute) {
 		$filter = array();
 		$haveMultiSearchAttributes = (is_array($searchAttributes) && count($searchAttributes) > 0);
-		if($haveMultiSearchAttributes && strpos(trim($search), ' ') !== false) {
+		if ($haveMultiSearchAttributes && strpos(trim($search), ' ') !== false) {
 			try {
 				return $this->getAdvancedFilterPartForSearch($search, $searchAttributes);
-			} catch(\Exception $e) {
+			} catch (\Exception $e) {
 				\OCP\Util::writeLog(
 					'user_ldap',
 					'Creating advanced filter for search failed, falling back to simple method.',
@@ -1338,17 +1338,17 @@ 
 		}
 
 		$search = $this->prepareSearchTerm($search);
-		if(!is_array($searchAttributes) || count($searchAttributes) === 0) {
+		if (!is_array($searchAttributes) || count($searchAttributes) === 0) {
 			if ($fallbackAttribute === '') {
 				return '';
 			}
-			$filter[] = $fallbackAttribute . '=' . $search;
+			$filter[] = $fallbackAttribute.'='.$search;
 		} else {
-			foreach($searchAttributes as $attribute) {
-				$filter[] = $attribute . '=' . $search;
+			foreach ($searchAttributes as $attribute) {
+				$filter[] = $attribute.'='.$search;
 			}
 		}
-		if(count($filter) === 1) {
+		if (count($filter) === 1) {
 			return '('.$filter[0].')';
 		}
 		return $this->combineFilterWithOr($filter);
@@ -1369,7 +1369,7 @@ 
 		if ($term === '') {
 			$result = '*';
 		} else if ($allowEnum !== 'no') {
-			$result = $term . '*';
+			$result = $term.'*';
 		}
 		return $result;
 	}
@@ -1381,7 +1381,7 @@ 
 	public function getFilterForUserCount() {
 		$filter = $this->combineFilterWithAnd(array(
 			$this->connection->ldapUserFilter,
-			$this->connection->ldapUserDisplayName . '=*'
+			$this->connection->ldapUserDisplayName.'=*'
 		));
 
 		return $filter;
@@ -1399,7 +1399,7 @@ 
 			'ldapAgentName' => $name,
 			'ldapAgentPassword' => $password
 		);
-		if(!$testConnection->setConfiguration($credentials)) {
+		if (!$testConnection->setConfiguration($credentials)) {
 			return false;
 		}
 		return $testConnection->bind();
@@ -1421,30 +1421,30 @@ 
 			// Sacrebleu! The UUID attribute is unknown :( We need first an
 			// existing DN to be able to reliably detect it.
 			$result = $this->search($filter, $base, ['dn'], 1);
-			if(!isset($result[0]) || !isset($result[0]['dn'])) {
+			if (!isset($result[0]) || !isset($result[0]['dn'])) {
 				throw new \Exception('Cannot determine UUID attribute');
 			}
 			$dn = $result[0]['dn'][0];
-			if(!$this->detectUuidAttribute($dn, true)) {
+			if (!$this->detectUuidAttribute($dn, true)) {
 				throw new \Exception('Cannot determine UUID attribute');
 			}
 		} else {
 			// The UUID attribute is either known or an override is given.
 			// By calling this method we ensure that $this->connection->$uuidAttr
 			// is definitely set
-			if(!$this->detectUuidAttribute('', true)) {
+			if (!$this->detectUuidAttribute('', true)) {
 				throw new \Exception('Cannot determine UUID attribute');
 			}
 		}
 
 		$uuidAttr = $this->connection->ldapUuidUserAttribute;
-		if($uuidAttr === 'guid' || $uuidAttr === 'objectguid') {
+		if ($uuidAttr === 'guid' || $uuidAttr === 'objectguid') {
 			$uuid = $this->formatGuid2ForFilterUser($uuid);
 		}
 
-		$filter = $uuidAttr . '=' . $uuid;
+		$filter = $uuidAttr.'='.$uuid;
 		$result = $this->searchUsers($filter, ['dn'], 2);
-		if(is_array($result) && isset($result[0]) && isset($result[0]['dn']) && count($result) === 1) {
+		if (is_array($result) && isset($result[0]) && isset($result[0]['dn']) && count($result) === 1) {
 			// we put the count into account to make sure that this is
 			// really unique
 			return $result[0]['dn'][0];
@@ -1461,7 +1461,7 @@ 
 	 * @return bool true on success, false otherwise
 	 */
 	private function detectUuidAttribute($dn, $isUser = true, $force = false) {
-		if($isUser) {
+		if ($isUser) {
 			$uuidAttr     = 'ldapUuidUserAttribute';
 			$uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
 		} else {
@@ -1469,7 +1469,7 @@ 
 			$uuidOverride = $this->connection->ldapExpertUUIDGroupAttr;
 		}
 
-		if(($this->connection->$uuidAttr !== 'auto') && !$force) {
+		if (($this->connection->$uuidAttr !== 'auto') && !$force) {
 			return true;
 		}
 
@@ -1481,9 +1481,9 @@ 
 		// for now, supported attributes are entryUUID, nsuniqueid, objectGUID, ipaUniqueID
 		$testAttributes = array('entryuuid', 'nsuniqueid', 'objectguid', 'guid', 'ipauniqueid');
 
-		foreach($testAttributes as $attribute) {
+		foreach ($testAttributes as $attribute) {
 			$value = $this->readAttribute($dn, $attribute);
-			if(is_array($value) && isset($value[0]) && !empty($value[0])) {
+			if (is_array($value) && isset($value[0]) && !empty($value[0])) {
 				\OCP\Util::writeLog('user_ldap',
 									'Setting '.$attribute.' as '.$uuidAttr,
 									\OCP\Util::DEBUG);
@@ -1504,7 +1504,7 @@ 
 	 * @return string|bool
 	 */
 	public function getUUID($dn, $isUser = true) {
-		if($isUser) {
+		if ($isUser) {
 			$uuidAttr     = 'ldapUuidUserAttribute';
 			$uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
 		} else {
@@ -1513,15 +1513,15 @@ 
 		}
 
 		$uuid = false;
-		if($this->detectUuidAttribute($dn, $isUser)) {
+		if ($this->detectUuidAttribute($dn, $isUser)) {
 			$uuid = $this->readAttribute($dn, $this->connection->$uuidAttr);
-			if( !is_array($uuid)
+			if (!is_array($uuid)
 				&& $uuidOverride !== ''
 				&& $this->detectUuidAttribute($dn, $isUser, true)) {
 					$uuid = $this->readAttribute($dn,
 												 $this->connection->$uuidAttr);
 			}
-			if(is_array($uuid) && isset($uuid[0]) && !empty($uuid[0])) {
+			if (is_array($uuid) && isset($uuid[0]) && !empty($uuid[0])) {
 				$uuid = $uuid[0];
 			}
 		}
@@ -1538,19 +1538,19 @@ 
 	private function convertObjectGUID2Str($oguid) {
 		$hex_guid = bin2hex($oguid);
 		$hex_guid_to_guid_str = '';
-		for($k = 1; $k <= 4; ++$k) {
+		for ($k = 1; $k <= 4; ++$k) {
 			$hex_guid_to_guid_str .= substr($hex_guid, 8 - 2 * $k, 2);
 		}
 		$hex_guid_to_guid_str .= '-';
-		for($k = 1; $k <= 2; ++$k) {
+		for ($k = 1; $k <= 2; ++$k) {
 			$hex_guid_to_guid_str .= substr($hex_guid, 12 - 2 * $k, 2);
 		}
 		$hex_guid_to_guid_str .= '-';
-		for($k = 1; $k <= 2; ++$k) {
+		for ($k = 1; $k <= 2; ++$k) {
 			$hex_guid_to_guid_str .= substr($hex_guid, 16 - 2 * $k, 2);
 		}
-		$hex_guid_to_guid_str .= '-' . substr($hex_guid, 16, 4);
-		$hex_guid_to_guid_str .= '-' . substr($hex_guid, 20);
+		$hex_guid_to_guid_str .= '-'.substr($hex_guid, 16, 4);
+		$hex_guid_to_guid_str .= '-'.substr($hex_guid, 20);
 
 		return strtoupper($hex_guid_to_guid_str);
 	}
@@ -1567,11 +1567,11 @@ 
 	 * @return string
 	 */
 	public function formatGuid2ForFilterUser($guid) {
-		if(!is_string($guid)) {
+		if (!is_string($guid)) {
 			throw new \InvalidArgumentException('String expected');
 		}
 		$blocks = explode('-', $guid);
-		if(count($blocks) !== 5) {
+		if (count($blocks) !== 5) {
 			/*
 			 * Why not throw an Exception instead? This method is a utility
 			 * called only when trying to figure out whether a "missing" known
@@ -1584,20 +1584,20 @@ 
 			 * user. Instead we write a log message.
 			 */
 			\OC::$server->getLogger()->info(
-				'Passed string does not resemble a valid GUID. Known UUID ' .
+				'Passed string does not resemble a valid GUID. Known UUID '.
 				'({uuid}) probably does not match UUID configuration.',
-				[ 'app' => 'user_ldap', 'uuid' => $guid ]
+				['app' => 'user_ldap', 'uuid' => $guid]
 			);
 			return $guid;
 		}
-		for($i=0; $i < 3; $i++) {
+		for ($i = 0; $i < 3; $i++) {
 			$pairs = str_split($blocks[$i], 2);
 			$pairs = array_reverse($pairs);
 			$blocks[$i] = implode('', $pairs);
 		}
-		for($i=0; $i < 5; $i++) {
+		for ($i = 0; $i < 5; $i++) {
 			$pairs = str_split($blocks[$i], 2);
-			$blocks[$i] = '\\' . implode('\\', $pairs);
+			$blocks[$i] = '\\'.implode('\\', $pairs);
 		}
 		return implode('', $blocks);
 	}
@@ -1611,12 +1611,12 @@ 
 		$domainDN = $this->getDomainDNFromDN($dn);
 		$cacheKey = 'getSID-'.$domainDN;
 		$sid = $this->connection->getFromCache($cacheKey);
-		if(!is_null($sid)) {
+		if (!is_null($sid)) {
 			return $sid;
 		}
 
 		$objectSid = $this->readAttribute($domainDN, 'objectsid');
-		if(!is_array($objectSid) || empty($objectSid)) {
+		if (!is_array($objectSid) || empty($objectSid)) {
 			$this->connection->writeToCache($cacheKey, false);
 			return false;
 		}
@@ -1674,12 +1674,12 @@ 
 		$belongsToBase = false;
 		$bases = $this->helper->sanitizeDN($bases);
 
-		foreach($bases as $base) {
+		foreach ($bases as $base) {
 			$belongsToBase = true;
-			if(mb_strripos($dn, $base, 0, 'UTF-8') !== (mb_strlen($dn, 'UTF-8')-mb_strlen($base, 'UTF-8'))) {
+			if (mb_strripos($dn, $base, 0, 'UTF-8') !== (mb_strlen($dn, 'UTF-8') - mb_strlen($base, 'UTF-8'))) {
 				$belongsToBase = false;
 			}
-			if($belongsToBase) {
+			if ($belongsToBase) {
 				break;
 			}
 		}
@@ -1690,7 +1690,7 @@ 
 	 * resets a running Paged Search operation
 	 */
 	private function abandonPagedSearch() {
-		if($this->connection->hasPagedResultSupport) {
+		if ($this->connection->hasPagedResultSupport) {
 			$cr = $this->connection->getConnectionResource();
 			$this->ldap->controlPagedResult($cr, 0, false, $this->lastCookie);
 			$this->getPagedSearchResultState();
@@ -1708,16 +1708,16 @@ 
 	 * @return string containing the key or empty if none is cached
 	 */
 	private function getPagedResultCookie($base, $filter, $limit, $offset) {
-		if($offset === 0) {
+		if ($offset === 0) {
 			return '';
 		}
 		$offset -= $limit;
 		//we work with cache here
-		$cacheKey = 'lc' . crc32($base) . '-' . crc32($filter) . '-' . intval($limit) . '-' . intval($offset);
+		$cacheKey = 'lc'.crc32($base).'-'.crc32($filter).'-'.intval($limit).'-'.intval($offset);
 		$cookie = '';
-		if(isset($this->cookies[$cacheKey])) {
+		if (isset($this->cookies[$cacheKey])) {
 			$cookie = $this->cookies[$cacheKey];
-			if(is_null($cookie)) {
+			if (is_null($cookie)) {
 				$cookie = '';
 			}
 		}
@@ -1735,11 +1735,11 @@ 
 	 * @return bool
 	 */
 	public function hasMoreResults() {
-		if(!$this->connection->hasPagedResultSupport) {
+		if (!$this->connection->hasPagedResultSupport) {
 			return false;
 		}
 
-		if(empty($this->lastCookie) && $this->lastCookie !== '0') {
+		if (empty($this->lastCookie) && $this->lastCookie !== '0') {
 			// as in RFC 2696, when all results are returned, the cookie will
 			// be empty.
 			return false;
@@ -1759,8 +1759,8 @@ 
 	 */
 	private function setPagedResultCookie($base, $filter, $limit, $offset, $cookie) {
 		// allow '0' for 389ds
-		if(!empty($cookie) || $cookie === '0') {
-			$cacheKey = 'lc' . crc32($base) . '-' . crc32($filter) . '-' .intval($limit) . '-' . intval($offset);
+		if (!empty($cookie) || $cookie === '0') {
+			$cacheKey = 'lc'.crc32($base).'-'.crc32($filter).'-'.intval($limit).'-'.intval($offset);
 			$this->cookies[$cacheKey] = $cookie;
 			$this->lastCookie = $cookie;
 		}
@@ -1787,17 +1787,17 @@ 
 	 */
 	private function initPagedSearch($filter, $bases, $attr, $limit, $offset) {
 		$pagedSearchOK = false;
-		if($this->connection->hasPagedResultSupport && ($limit !== 0)) {
+		if ($this->connection->hasPagedResultSupport && ($limit !== 0)) {
 			$offset = intval($offset); //can be null
 			\OCP\Util::writeLog('user_ldap',
 				'initializing paged search for  Filter '.$filter.' base '.print_r($bases, true)
-				.' attr '.print_r($attr, true). ' limit ' .$limit.' offset '.$offset,
+				.' attr '.print_r($attr, true).' limit '.$limit.' offset '.$offset,
 				\OCP\Util::DEBUG);
 			//get the cookie from the search for the previous search, required by LDAP
-			foreach($bases as $base) {
+			foreach ($bases as $base) {
 
 				$cookie = $this->getPagedResultCookie($base, $filter, $limit, $offset);
-				if(empty($cookie) && $cookie !== "0" && ($offset > 0)) {
+				if (empty($cookie) && $cookie !== "0" && ($offset > 0)) {
 					// no cookie known, although the offset is not 0. Maybe cache run out. We need
 					// to start all over *sigh* (btw, Dear Reader, did you know LDAP paged
 					// searching was designed by MSFT?)
@@ -1810,18 +1810,18 @@ 
 					$cookie = $this->getPagedResultCookie($base, $filter, $limit, $offset);
 					//still no cookie? obviously, the server does not like us. Let's skip paging efforts.
 					//TODO: remember this, probably does not change in the next request...
-					if(empty($cookie) && $cookie !== '0') {
+					if (empty($cookie) && $cookie !== '0') {
 						// '0' is valid, because 389ds
 						$cookie = null;
 					}
 				}
-				if(!is_null($cookie)) {
+				if (!is_null($cookie)) {
 					//since offset = 0, this is a new search. We abandon other searches that might be ongoing.
 					$this->abandonPagedSearch();
 					$pagedSearchOK = $this->ldap->controlPagedResult(
 						$this->connection->getConnectionResource(), $limit,
 						false, $cookie);
-					if(!$pagedSearchOK) {
+					if (!$pagedSearchOK) {
 						return false;
 					}
 					\OCP\Util::writeLog('user_ldap', 'Ready for a paged search', \OCP\Util::DEBUG);
@@ -1838,7 +1838,7 @@ 
 		 * So we added "&& !empty($this->lastCookie)" to this test to ignore pagination
 		 * if we don't have a previous paged search.
 		 */
-		} else if($this->connection->hasPagedResultSupport && $limit === 0 && !empty($this->lastCookie)) {
+		} else if ($this->connection->hasPagedResultSupport && $limit === 0 && !empty($this->lastCookie)) {
 			// a search without limit was requested. However, if we do use
 			// Paged Search once, we always must do it. This requires us to
 			// initialize it with the configured page size.

apps/user_ldap/appinfo/app.php

Indentation +29 added lines, -29 removed lines

@@ -32,44 +32,44 @@
 $ldapWrapper = new OCA\User_LDAP\LDAP();
 $ocConfig = \OC::$server->getConfig();
 if(count($configPrefixes) === 1) {
-	$dbc = \OC::$server->getDatabaseConnection();
-	$userManager = new OCA\User_LDAP\User\Manager($ocConfig,
-		new OCA\User_LDAP\FilesystemHelper(),
-		new OCA\User_LDAP\LogWrapper(),
-		\OC::$server->getAvatarManager(),
-		new \OCP\Image(),
-		$dbc,
-		\OC::$server->getUserManager()
-	);
-	$connector = new OCA\User_LDAP\Connection($ldapWrapper, $configPrefixes[0]);
-	$ldapAccess = new OCA\User_LDAP\Access($connector, $ldapWrapper, $userManager, $helper);
+    $dbc = \OC::$server->getDatabaseConnection();
+    $userManager = new OCA\User_LDAP\User\Manager($ocConfig,
+        new OCA\User_LDAP\FilesystemHelper(),
+        new OCA\User_LDAP\LogWrapper(),
+        \OC::$server->getAvatarManager(),
+        new \OCP\Image(),
+        $dbc,
+        \OC::$server->getUserManager()
+    );
+    $connector = new OCA\User_LDAP\Connection($ldapWrapper, $configPrefixes[0]);
+    $ldapAccess = new OCA\User_LDAP\Access($connector, $ldapWrapper, $userManager, $helper);
 
-	$ldapAccess->setUserMapper(new OCA\User_LDAP\Mapping\UserMapping($dbc));
-	$ldapAccess->setGroupMapper(new OCA\User_LDAP\Mapping\GroupMapping($dbc));
-	$userBackend  = new OCA\User_LDAP\User_LDAP($ldapAccess, $ocConfig);
-	$groupBackend = new \OCA\User_LDAP\Group_LDAP($ldapAccess);
+    $ldapAccess->setUserMapper(new OCA\User_LDAP\Mapping\UserMapping($dbc));
+    $ldapAccess->setGroupMapper(new OCA\User_LDAP\Mapping\GroupMapping($dbc));
+    $userBackend  = new OCA\User_LDAP\User_LDAP($ldapAccess, $ocConfig);
+    $groupBackend = new \OCA\User_LDAP\Group_LDAP($ldapAccess);
 } else if(count($configPrefixes) > 1) {
-	$userBackend  = new OCA\User_LDAP\User_Proxy(
-		$configPrefixes, $ldapWrapper, $ocConfig
-	);
-	$groupBackend  = new OCA\User_LDAP\Group_Proxy($configPrefixes, $ldapWrapper);
+    $userBackend  = new OCA\User_LDAP\User_Proxy(
+        $configPrefixes, $ldapWrapper, $ocConfig
+    );
+    $groupBackend  = new OCA\User_LDAP\Group_Proxy($configPrefixes, $ldapWrapper);
 }
 
 if(count($configPrefixes) > 0) {
-	// register user backend
-	OC_User::useBackend($userBackend);
-	\OC::$server->getGroupManager()->addBackend($groupBackend);
+    // register user backend
+    OC_User::useBackend($userBackend);
+    \OC::$server->getGroupManager()->addBackend($groupBackend);
 }
 
 \OCP\Util::connectHook(
-	'\OCA\Files_Sharing\API\Server2Server',
-	'preLoginNameUsedAsUserName',
-	'\OCA\User_LDAP\Helper',
-	'loginName2UserName'
+    '\OCA\Files_Sharing\API\Server2Server',
+    'preLoginNameUsedAsUserName',
+    '\OCA\User_LDAP\Helper',
+    'loginName2UserName'
 );
 
 if(OCP\App::isEnabled('user_webdavauth')) {
-	OCP\Util::writeLog('user_ldap',
-		'user_ldap and user_webdavauth are incompatible. You may experience unexpected behaviour',
-		OCP\Util::WARN);
+    OCP\Util::writeLog('user_ldap',
+        'user_ldap and user_webdavauth are incompatible. You may experience unexpected behaviour',
+        OCP\Util::WARN);
 }

Spacing +5 added lines, -5 removed lines

@@ -31,7 +31,7 @@ 
 $configPrefixes = $helper->getServerConfigurationPrefixes(true);
 $ldapWrapper = new OCA\User_LDAP\LDAP();
 $ocConfig = \OC::$server->getConfig();
-if(count($configPrefixes) === 1) {
+if (count($configPrefixes) === 1) {
 	$dbc = \OC::$server->getDatabaseConnection();
 	$userManager = new OCA\User_LDAP\User\Manager($ocConfig,
 		new OCA\User_LDAP\FilesystemHelper(),
@@ -48,14 +48,14 @@ 
 	$ldapAccess->setGroupMapper(new OCA\User_LDAP\Mapping\GroupMapping($dbc));
 	$userBackend  = new OCA\User_LDAP\User_LDAP($ldapAccess, $ocConfig);
 	$groupBackend = new \OCA\User_LDAP\Group_LDAP($ldapAccess);
-} else if(count($configPrefixes) > 1) {
+} else if (count($configPrefixes) > 1) {
 	$userBackend  = new OCA\User_LDAP\User_Proxy(
 		$configPrefixes, $ldapWrapper, $ocConfig
 	);
-	$groupBackend  = new OCA\User_LDAP\Group_Proxy($configPrefixes, $ldapWrapper);
+	$groupBackend = new OCA\User_LDAP\Group_Proxy($configPrefixes, $ldapWrapper);
 }
 
-if(count($configPrefixes) > 0) {
+if (count($configPrefixes) > 0) {
 	// register user backend
 	OC_User::useBackend($userBackend);
 	\OC::$server->getGroupManager()->addBackend($groupBackend);
@@ -68,7 +68,7 @@ 
 	'loginName2UserName'
 );
 
-if(OCP\App::isEnabled('user_webdavauth')) {
+if (OCP\App::isEnabled('user_webdavauth')) {
 	OCP\Util::writeLog('user_ldap',
 		'user_ldap and user_webdavauth are incompatible. You may experience unexpected behaviour',
 		OCP\Util::WARN);

lib/private/Encryption/Util.php

Indentation +365 added lines, -365 removed lines

@@ -36,370 +36,370 @@
 
 class Util {
 
-	const HEADER_START = 'HBEGIN';
-	const HEADER_END = 'HEND';
-	const HEADER_PADDING_CHAR = '-';
-
-	const HEADER_ENCRYPTION_MODULE_KEY = 'oc_encryption_module';
-
-	/**
-	 * block size will always be 8192 for a PHP stream
-	 * @see https://bugs.php.net/bug.php?id=21641
-	 * @var integer
-	 */
-	protected $headerSize = 8192;
-
-	/**
-	 * block size will always be 8192 for a PHP stream
-	 * @see https://bugs.php.net/bug.php?id=21641
-	 * @var integer
-	 */
-	protected $blockSize = 8192;
-
-	/** @var View */
-	protected $rootView;
-
-	/** @var array */
-	protected $ocHeaderKeys;
-
-	/** @var \OC\User\Manager */
-	protected $userManager;
-
-	/** @var IConfig */
-	protected $config;
-
-	/** @var array paths excluded from encryption */
-	protected $excludedPaths;
-
-	/** @var \OC\Group\Manager $manager */
-	protected $groupManager;
-
-	/**
-	 *
-	 * @param View $rootView
-	 * @param \OC\User\Manager $userManager
-	 * @param \OC\Group\Manager $groupManager
-	 * @param IConfig $config
-	 */
-	public function __construct(
-		View $rootView,
-		\OC\User\Manager $userManager,
-		\OC\Group\Manager $groupManager,
-		IConfig $config) {
-
-		$this->ocHeaderKeys = [
-			self::HEADER_ENCRYPTION_MODULE_KEY
-		];
-
-		$this->rootView = $rootView;
-		$this->userManager = $userManager;
-		$this->groupManager = $groupManager;
-		$this->config = $config;
-
-		$this->excludedPaths[] = 'files_encryption';
-		$this->excludedPaths[] = 'appdata_' . $config->getSystemValue('instanceid', null);
-	}
-
-	/**
-	 * read encryption module ID from header
-	 *
-	 * @param array $header
-	 * @return string
-	 * @throws ModuleDoesNotExistsException
-	 */
-	public function getEncryptionModuleId(array $header = null) {
-		$id = '';
-		$encryptionModuleKey = self::HEADER_ENCRYPTION_MODULE_KEY;
-
-		if (isset($header[$encryptionModuleKey])) {
-			$id = $header[$encryptionModuleKey];
-		} elseif (isset($header['cipher'])) {
-			if (class_exists('\OCA\Encryption\Crypto\Encryption')) {
-				// fall back to default encryption if the user migrated from
-				// ownCloud <= 8.0 with the old encryption
-				$id = \OCA\Encryption\Crypto\Encryption::ID;
-			} else {
-				throw new ModuleDoesNotExistsException('Default encryption module missing');
-			}
-		}
-
-		return $id;
-	}
-
-	/**
-	 * create header for encrypted file
-	 *
-	 * @param array $headerData
-	 * @param IEncryptionModule $encryptionModule
-	 * @return string
-	 * @throws EncryptionHeaderToLargeException if header has to many arguments
-	 * @throws EncryptionHeaderKeyExistsException if header key is already in use
-	 */
-	public function createHeader(array $headerData, IEncryptionModule $encryptionModule) {
-		$header = self::HEADER_START . ':' . self::HEADER_ENCRYPTION_MODULE_KEY . ':' . $encryptionModule->getId() . ':';
-		foreach ($headerData as $key => $value) {
-			if (in_array($key, $this->ocHeaderKeys)) {
-				throw new EncryptionHeaderKeyExistsException($key);
-			}
-			$header .= $key . ':' . $value . ':';
-		}
-		$header .= self::HEADER_END;
-
-		if (strlen($header) > $this->getHeaderSize()) {
-			throw new EncryptionHeaderToLargeException();
-		}
-
-		$paddedHeader = str_pad($header, $this->headerSize, self::HEADER_PADDING_CHAR, STR_PAD_RIGHT);
-
-		return $paddedHeader;
-	}
-
-	/**
-	 * go recursively through a dir and collect all files and sub files.
-	 *
-	 * @param string $dir relative to the users files folder
-	 * @return array with list of files relative to the users files folder
-	 */
-	public function getAllFiles($dir) {
-		$result = array();
-		$dirList = array($dir);
-
-		while ($dirList) {
-			$dir = array_pop($dirList);
-			$content = $this->rootView->getDirectoryContent($dir);
-
-			foreach ($content as $c) {
-				if ($c->getType() === 'dir') {
-					$dirList[] = $c->getPath();
-				} else {
-					$result[] =  $c->getPath();
-				}
-			}
-
-		}
-
-		return $result;
-	}
-
-	/**
-	 * check if it is a file uploaded by the user stored in data/user/files
-	 * or a metadata file
-	 *
-	 * @param string $path relative to the data/ folder
-	 * @return boolean
-	 */
-	public function isFile($path) {
-		$parts = explode('/', Filesystem::normalizePath($path), 4);
-		if (isset($parts[2]) && $parts[2] === 'files') {
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * return size of encryption header
-	 *
-	 * @return integer
-	 */
-	public function getHeaderSize() {
-		return $this->headerSize;
-	}
-
-	/**
-	 * return size of block read by a PHP stream
-	 *
-	 * @return integer
-	 */
-	public function getBlockSize() {
-		return $this->blockSize;
-	}
-
-	/**
-	 * get the owner and the path for the file relative to the owners files folder
-	 *
-	 * @param string $path
-	 * @return array
-	 * @throws \BadMethodCallException
-	 */
-	public function getUidAndFilename($path) {
-
-		$parts = explode('/', $path);
-		$uid = '';
-		if (count($parts) > 2) {
-			$uid = $parts[1];
-		}
-		if (!$this->userManager->userExists($uid)) {
-			throw new \BadMethodCallException(
-				'path needs to be relative to the system wide data folder and point to a user specific file'
-			);
-		}
-
-		$ownerPath = implode('/', array_slice($parts, 2));
-
-		return array($uid, Filesystem::normalizePath($ownerPath));
-
-	}
-
-	/**
-	 * Remove .path extension from a file path
-	 * @param string $path Path that may identify a .part file
-	 * @return string File path without .part extension
-	 * @note this is needed for reusing keys
-	 */
-	public function stripPartialFileExtension($path) {
-		$extension = pathinfo($path, PATHINFO_EXTENSION);
-
-		if ( $extension === 'part') {
-
-			$newLength = strlen($path) - 5; // 5 = strlen(".part")
-			$fPath = substr($path, 0, $newLength);
-
-			// if path also contains a transaction id, we remove it too
-			$extension = pathinfo($fPath, PATHINFO_EXTENSION);
-			if(substr($extension, 0, 12) === 'ocTransferId') { // 12 = strlen("ocTransferId")
-				$newLength = strlen($fPath) - strlen($extension) -1;
-				$fPath = substr($fPath, 0, $newLength);
-			}
-			return $fPath;
-
-		} else {
-			return $path;
-		}
-	}
-
-	public function getUserWithAccessToMountPoint($users, $groups) {
-		$result = array();
-		if (in_array('all', $users)) {
-			$result = \OCP\User::getUsers();
-		} else {
-			$result = array_merge($result, $users);
-
-			$groupManager = \OC::$server->getGroupManager();
-			foreach ($groups as $group) {
-				$groupObject = $groupManager->get($group);
-				if ($groupObject) {
-					$foundUsers = $groupObject->searchUsers('', -1, 0);
-					$userIds = [];
-					foreach ($foundUsers as $user) {
-						$userIds[] = $user->getUID();
-					}
-					$result = array_merge($result, $userIds);
-				}
-			}
-		}
-
-		return $result;
-	}
-
-	/**
-	 * check if the file is stored on a system wide mount point
-	 * @param string $path relative to /data/user with leading '/'
-	 * @param string $uid
-	 * @return boolean
-	 */
-	public function isSystemWideMountPoint($path, $uid) {
-		if (\OCP\App::isEnabled("files_external")) {
-			$mounts = \OC_Mount_Config::getSystemMountPoints();
-			foreach ($mounts as $mount) {
-				if (strpos($path, '/files/' . $mount['mountpoint']) === 0) {
-					if ($this->isMountPointApplicableToUser($mount, $uid)) {
-						return true;
-					}
-				}
-			}
-		}
-		return false;
-	}
-
-	/**
-	 * check if mount point is applicable to user
-	 *
-	 * @param array $mount contains $mount['applicable']['users'], $mount['applicable']['groups']
-	 * @param string $uid
-	 * @return boolean
-	 */
-	private function isMountPointApplicableToUser($mount, $uid) {
-		$acceptedUids = array('all', $uid);
-		// check if mount point is applicable for the user
-		$intersection = array_intersect($acceptedUids, $mount['applicable']['users']);
-		if (!empty($intersection)) {
-			return true;
-		}
-		// check if mount point is applicable for group where the user is a member
-		foreach ($mount['applicable']['groups'] as $gid) {
-			if ($this->groupManager->isInGroup($uid, $gid)) {
-				return true;
-			}
-		}
-		return false;
-	}
-
-	/**
-	 * check if it is a path which is excluded by ownCloud from encryption
-	 *
-	 * @param string $path
-	 * @return boolean
-	 */
-	public function isExcluded($path) {
-		$normalizedPath = Filesystem::normalizePath($path);
-		$root = explode('/', $normalizedPath, 4);
-		if (count($root) > 1) {
-
-			// detect alternative key storage root
-			$rootDir = $this->getKeyStorageRoot();
-			if ($rootDir !== '' &&
-				0 === strpos(
-					Filesystem::normalizePath($path),
-					Filesystem::normalizePath($rootDir)
-				)
-			) {
-				return true;
-			}
-
-
-			//detect system wide folders
-			if (in_array($root[1], $this->excludedPaths)) {
-				return true;
-			}
-
-			// detect user specific folders
-			if ($this->userManager->userExists($root[1])
-				&& in_array($root[2], $this->excludedPaths)) {
-
-				return true;
-			}
-		}
-		return false;
-	}
-
-	/**
-	 * check if recovery key is enabled for user
-	 *
-	 * @param string $uid
-	 * @return boolean
-	 */
-	public function recoveryEnabled($uid) {
-		$enabled = $this->config->getUserValue($uid, 'encryption', 'recovery_enabled', '0');
-
-		return ($enabled === '1') ? true : false;
-	}
-
-	/**
-	 * set new key storage root
-	 *
-	 * @param string $root new key store root relative to the data folder
-	 */
-	public function setKeyStorageRoot($root) {
-		$this->config->setAppValue('core', 'encryption_key_storage_root', $root);
-	}
-
-	/**
-	 * get key storage root
-	 *
-	 * @return string key storage root
-	 */
-	public function getKeyStorageRoot() {
-		return $this->config->getAppValue('core', 'encryption_key_storage_root', '');
-	}
+    const HEADER_START = 'HBEGIN';
+    const HEADER_END = 'HEND';
+    const HEADER_PADDING_CHAR = '-';
+
+    const HEADER_ENCRYPTION_MODULE_KEY = 'oc_encryption_module';
+
+    /**
+     * block size will always be 8192 for a PHP stream
+     * @see https://bugs.php.net/bug.php?id=21641
+     * @var integer
+     */
+    protected $headerSize = 8192;
+
+    /**
+     * block size will always be 8192 for a PHP stream
+     * @see https://bugs.php.net/bug.php?id=21641
+     * @var integer
+     */
+    protected $blockSize = 8192;
+
+    /** @var View */
+    protected $rootView;
+
+    /** @var array */
+    protected $ocHeaderKeys;
+
+    /** @var \OC\User\Manager */
+    protected $userManager;
+
+    /** @var IConfig */
+    protected $config;
+
+    /** @var array paths excluded from encryption */
+    protected $excludedPaths;
+
+    /** @var \OC\Group\Manager $manager */
+    protected $groupManager;
+
+    /**
+     *
+     * @param View $rootView
+     * @param \OC\User\Manager $userManager
+     * @param \OC\Group\Manager $groupManager
+     * @param IConfig $config
+     */
+    public function __construct(
+        View $rootView,
+        \OC\User\Manager $userManager,
+        \OC\Group\Manager $groupManager,
+        IConfig $config) {
+
+        $this->ocHeaderKeys = [
+            self::HEADER_ENCRYPTION_MODULE_KEY
+        ];
+
+        $this->rootView = $rootView;
+        $this->userManager = $userManager;
+        $this->groupManager = $groupManager;
+        $this->config = $config;
+
+        $this->excludedPaths[] = 'files_encryption';
+        $this->excludedPaths[] = 'appdata_' . $config->getSystemValue('instanceid', null);
+    }
+
+    /**
+     * read encryption module ID from header
+     *
+     * @param array $header
+     * @return string
+     * @throws ModuleDoesNotExistsException
+     */
+    public function getEncryptionModuleId(array $header = null) {
+        $id = '';
+        $encryptionModuleKey = self::HEADER_ENCRYPTION_MODULE_KEY;
+
+        if (isset($header[$encryptionModuleKey])) {
+            $id = $header[$encryptionModuleKey];
+        } elseif (isset($header['cipher'])) {
+            if (class_exists('\OCA\Encryption\Crypto\Encryption')) {
+                // fall back to default encryption if the user migrated from
+                // ownCloud <= 8.0 with the old encryption
+                $id = \OCA\Encryption\Crypto\Encryption::ID;
+            } else {
+                throw new ModuleDoesNotExistsException('Default encryption module missing');
+            }
+        }
+
+        return $id;
+    }
+
+    /**
+     * create header for encrypted file
+     *
+     * @param array $headerData
+     * @param IEncryptionModule $encryptionModule
+     * @return string
+     * @throws EncryptionHeaderToLargeException if header has to many arguments
+     * @throws EncryptionHeaderKeyExistsException if header key is already in use
+     */
+    public function createHeader(array $headerData, IEncryptionModule $encryptionModule) {
+        $header = self::HEADER_START . ':' . self::HEADER_ENCRYPTION_MODULE_KEY . ':' . $encryptionModule->getId() . ':';
+        foreach ($headerData as $key => $value) {
+            if (in_array($key, $this->ocHeaderKeys)) {
+                throw new EncryptionHeaderKeyExistsException($key);
+            }
+            $header .= $key . ':' . $value . ':';
+        }
+        $header .= self::HEADER_END;
+
+        if (strlen($header) > $this->getHeaderSize()) {
+            throw new EncryptionHeaderToLargeException();
+        }
+
+        $paddedHeader = str_pad($header, $this->headerSize, self::HEADER_PADDING_CHAR, STR_PAD_RIGHT);
+
+        return $paddedHeader;
+    }
+
+    /**
+     * go recursively through a dir and collect all files and sub files.
+     *
+     * @param string $dir relative to the users files folder
+     * @return array with list of files relative to the users files folder
+     */
+    public function getAllFiles($dir) {
+        $result = array();
+        $dirList = array($dir);
+
+        while ($dirList) {
+            $dir = array_pop($dirList);
+            $content = $this->rootView->getDirectoryContent($dir);
+
+            foreach ($content as $c) {
+                if ($c->getType() === 'dir') {
+                    $dirList[] = $c->getPath();
+                } else {
+                    $result[] =  $c->getPath();
+                }
+            }
+
+        }
+
+        return $result;
+    }
+
+    /**
+     * check if it is a file uploaded by the user stored in data/user/files
+     * or a metadata file
+     *
+     * @param string $path relative to the data/ folder
+     * @return boolean
+     */
+    public function isFile($path) {
+        $parts = explode('/', Filesystem::normalizePath($path), 4);
+        if (isset($parts[2]) && $parts[2] === 'files') {
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * return size of encryption header
+     *
+     * @return integer
+     */
+    public function getHeaderSize() {
+        return $this->headerSize;
+    }
+
+    /**
+     * return size of block read by a PHP stream
+     *
+     * @return integer
+     */
+    public function getBlockSize() {
+        return $this->blockSize;
+    }
+
+    /**
+     * get the owner and the path for the file relative to the owners files folder
+     *
+     * @param string $path
+     * @return array
+     * @throws \BadMethodCallException
+     */
+    public function getUidAndFilename($path) {
+
+        $parts = explode('/', $path);
+        $uid = '';
+        if (count($parts) > 2) {
+            $uid = $parts[1];
+        }
+        if (!$this->userManager->userExists($uid)) {
+            throw new \BadMethodCallException(
+                'path needs to be relative to the system wide data folder and point to a user specific file'
+            );
+        }
+
+        $ownerPath = implode('/', array_slice($parts, 2));
+
+        return array($uid, Filesystem::normalizePath($ownerPath));
+
+    }
+
+    /**
+     * Remove .path extension from a file path
+     * @param string $path Path that may identify a .part file
+     * @return string File path without .part extension
+     * @note this is needed for reusing keys
+     */
+    public function stripPartialFileExtension($path) {
+        $extension = pathinfo($path, PATHINFO_EXTENSION);
+
+        if ( $extension === 'part') {
+
+            $newLength = strlen($path) - 5; // 5 = strlen(".part")
+            $fPath = substr($path, 0, $newLength);
+
+            // if path also contains a transaction id, we remove it too
+            $extension = pathinfo($fPath, PATHINFO_EXTENSION);
+            if(substr($extension, 0, 12) === 'ocTransferId') { // 12 = strlen("ocTransferId")
+                $newLength = strlen($fPath) - strlen($extension) -1;
+                $fPath = substr($fPath, 0, $newLength);
+            }
+            return $fPath;
+
+        } else {
+            return $path;
+        }
+    }
+
+    public function getUserWithAccessToMountPoint($users, $groups) {
+        $result = array();
+        if (in_array('all', $users)) {
+            $result = \OCP\User::getUsers();
+        } else {
+            $result = array_merge($result, $users);
+
+            $groupManager = \OC::$server->getGroupManager();
+            foreach ($groups as $group) {
+                $groupObject = $groupManager->get($group);
+                if ($groupObject) {
+                    $foundUsers = $groupObject->searchUsers('', -1, 0);
+                    $userIds = [];
+                    foreach ($foundUsers as $user) {
+                        $userIds[] = $user->getUID();
+                    }
+                    $result = array_merge($result, $userIds);
+                }
+            }
+        }
+
+        return $result;
+    }
+
+    /**
+     * check if the file is stored on a system wide mount point
+     * @param string $path relative to /data/user with leading '/'
+     * @param string $uid
+     * @return boolean
+     */
+    public function isSystemWideMountPoint($path, $uid) {
+        if (\OCP\App::isEnabled("files_external")) {
+            $mounts = \OC_Mount_Config::getSystemMountPoints();
+            foreach ($mounts as $mount) {
+                if (strpos($path, '/files/' . $mount['mountpoint']) === 0) {
+                    if ($this->isMountPointApplicableToUser($mount, $uid)) {
+                        return true;
+                    }
+                }
+            }
+        }
+        return false;
+    }
+
+    /**
+     * check if mount point is applicable to user
+     *
+     * @param array $mount contains $mount['applicable']['users'], $mount['applicable']['groups']
+     * @param string $uid
+     * @return boolean
+     */
+    private function isMountPointApplicableToUser($mount, $uid) {
+        $acceptedUids = array('all', $uid);
+        // check if mount point is applicable for the user
+        $intersection = array_intersect($acceptedUids, $mount['applicable']['users']);
+        if (!empty($intersection)) {
+            return true;
+        }
+        // check if mount point is applicable for group where the user is a member
+        foreach ($mount['applicable']['groups'] as $gid) {
+            if ($this->groupManager->isInGroup($uid, $gid)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * check if it is a path which is excluded by ownCloud from encryption
+     *
+     * @param string $path
+     * @return boolean
+     */
+    public function isExcluded($path) {
+        $normalizedPath = Filesystem::normalizePath($path);
+        $root = explode('/', $normalizedPath, 4);
+        if (count($root) > 1) {
+
+            // detect alternative key storage root
+            $rootDir = $this->getKeyStorageRoot();
+            if ($rootDir !== '' &&
+                0 === strpos(
+                    Filesystem::normalizePath($path),
+                    Filesystem::normalizePath($rootDir)
+                )
+            ) {
+                return true;
+            }
+
+
+            //detect system wide folders
+            if (in_array($root[1], $this->excludedPaths)) {
+                return true;
+            }
+
+            // detect user specific folders
+            if ($this->userManager->userExists($root[1])
+                && in_array($root[2], $this->excludedPaths)) {
+
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * check if recovery key is enabled for user
+     *
+     * @param string $uid
+     * @return boolean
+     */
+    public function recoveryEnabled($uid) {
+        $enabled = $this->config->getUserValue($uid, 'encryption', 'recovery_enabled', '0');
+
+        return ($enabled === '1') ? true : false;
+    }
+
+    /**
+     * set new key storage root
+     *
+     * @param string $root new key store root relative to the data folder
+     */
+    public function setKeyStorageRoot($root) {
+        $this->config->setAppValue('core', 'encryption_key_storage_root', $root);
+    }
+
+    /**
+     * get key storage root
+     *
+     * @return string key storage root
+     */
+    public function getKeyStorageRoot() {
+        return $this->config->getAppValue('core', 'encryption_key_storage_root', '');
+    }
 
 }

lib/private/legacy/user.php

Indentation +559 added lines, -560 removed lines

@@ -57,564 +57,563 @@
  */
 class OC_User {
 
-	/**
-	 * @return \OC\User\Session
-	 */
-	public static function getUserSession() {
-		return OC::$server->getUserSession();
-	}
-
-	private static $_usedBackends = array();
-
-	private static $_setupedBackends = array();
-
-	// bool, stores if a user want to access a resource anonymously, e.g if they open a public link
-	private static $incognitoMode = false;
-
-	/**
-	 * Adds the backend to the list of used backends
-	 *
-	 * @param string|\OCP\UserInterface $backend default: database The backend to use for user management
-	 * @return bool
-	 *
-	 * Set the User Authentication Module
-	 */
-	public static function useBackend($backend = 'database') {
-		if ($backend instanceof \OCP\UserInterface) {
-			self::$_usedBackends[get_class($backend)] = $backend;
-			\OC::$server->getUserManager()->registerBackend($backend);
-		} else {
-			// You'll never know what happens
-			if (null === $backend OR !is_string($backend)) {
-				$backend = 'database';
-			}
-
-			// Load backend
-			switch ($backend) {
-				case 'database':
-				case 'mysql':
-				case 'sqlite':
-					\OCP\Util::writeLog('core', 'Adding user backend ' . $backend . '.', \OCP\Util::DEBUG);
-					self::$_usedBackends[$backend] = new \OC\User\Database();
-					\OC::$server->getUserManager()->registerBackend(self::$_usedBackends[$backend]);
-					break;
-				case 'dummy':
-					self::$_usedBackends[$backend] = new \Test\Util\User\Dummy();
-					\OC::$server->getUserManager()->registerBackend(self::$_usedBackends[$backend]);
-					break;
-				default:
-					\OCP\Util::writeLog('core', 'Adding default user backend ' . $backend . '.', \OCP\Util::DEBUG);
-					$className = 'OC_USER_' . strtoupper($backend);
-					self::$_usedBackends[$backend] = new $className();
-					\OC::$server->getUserManager()->registerBackend(self::$_usedBackends[$backend]);
-					break;
-			}
-		}
-		return true;
-	}
-
-	/**
-	 * remove all used backends
-	 */
-	public static function clearBackends() {
-		self::$_usedBackends = array();
-		\OC::$server->getUserManager()->clearBackends();
-	}
-
-	/**
-	 * setup the configured backends in config.php
-	 */
-	public static function setupBackends() {
-		OC_App::loadApps(['prelogin']);
-		$backends = \OC::$server->getSystemConfig()->getValue('user_backends', []);
-		if (isset($backends['default']) && !$backends['default']) {
-			// clear default backends
-			self::clearBackends();
-		}
-		foreach ($backends as $i => $config) {
-			if (!is_array($config)) {
-				continue;
-			}
-			$class = $config['class'];
-			$arguments = $config['arguments'];
-			if (class_exists($class)) {
-				if (array_search($i, self::$_setupedBackends) === false) {
-					// make a reflection object
-					$reflectionObj = new ReflectionClass($class);
-
-					// use Reflection to create a new instance, using the $args
-					$backend = $reflectionObj->newInstanceArgs($arguments);
-					self::useBackend($backend);
-					self::$_setupedBackends[] = $i;
-				} else {
-					\OCP\Util::writeLog('core', 'User backend ' . $class . ' already initialized.', \OCP\Util::DEBUG);
-				}
-			} else {
-				\OCP\Util::writeLog('core', 'User backend ' . $class . ' not found.', \OCP\Util::ERROR);
-			}
-		}
-	}
-
-	/**
-
-	 * Try to login a user using the magic cookie (remember login)
-	 *
-	 * @deprecated use \OCP\IUserSession::loginWithCookie()
-	 * @param string $uid The username of the user to log in
-	 * @param string $token
-	 * @param string $oldSessionId
-	 * @return bool
-	 */
-	public static function loginWithCookie($uid, $token, $oldSessionId) {
-		return self::getUserSession()->loginWithCookie($uid, $token, $oldSessionId);
-	}
-
-	/**
-	 * Try to login a user, assuming authentication
-	 * has already happened (e.g. via Single Sign On).
-	 *
-	 * Log in a user and regenerate a new session.
-	 *
-	 * @param \OCP\Authentication\IApacheBackend $backend
-	 * @return bool
-	 */
-	public static function loginWithApache(\OCP\Authentication\IApacheBackend $backend) {
-
-		$uid = $backend->getCurrentUserId();
-		$run = true;
-		OC_Hook::emit("OC_User", "pre_login", array("run" => &$run, "uid" => $uid));
-
-		if ($uid) {
-			if (self::getUser() !== $uid) {
-				self::setUserId($uid);
-				$setUidAsDisplayName = true;
-				if($backend instanceof \OCP\UserInterface
-					&& $backend->implementsActions(OC_User_Backend::GET_DISPLAYNAME)) {
-
-					$backendDisplayName = $backend->getDisplayName($uid);
-					if(is_string($backendDisplayName) && trim($backendDisplayName) !== '') {
-						$setUidAsDisplayName = false;
-					}
-				}
-				if($setUidAsDisplayName) {
-					self::setDisplayName($uid);
-				}
-				self::getUserSession()->setLoginName($uid);
-				$request = OC::$server->getRequest();
-				self::getUserSession()->createSessionToken($request, $uid, $uid);
-				// setup the filesystem
-				OC_Util::setupFS($uid);
-				// first call the post_login hooks, the login-process needs to be
-				// completed before we can safely create the users folder.
-				// For example encryption needs to initialize the users keys first
-				// before we can create the user folder with the skeleton files
-				OC_Hook::emit("OC_User", "post_login", array("uid" => $uid, 'password' => ''));
-				//trigger creation of user home and /files folder
-				\OC::$server->getUserFolder($uid);
-			}
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * Verify with Apache whether user is authenticated.
-	 *
-	 * @return boolean|null
-	 *          true: authenticated
-	 *          false: not authenticated
-	 *          null: not handled / no backend available
-	 */
-	public static function handleApacheAuth() {
-		$backend = self::findFirstActiveUsedBackend();
-		if ($backend) {
-			OC_App::loadApps();
-
-			//setup extra user backends
-			self::setupBackends();
-			self::unsetMagicInCookie();
-
-			return self::loginWithApache($backend);
-		}
-
-		return null;
-	}
-
-
-	/**
-	 * Sets user id for session and triggers emit
-	 *
-	 * @param string $uid
-	 */
-	public static function setUserId($uid) {
-		$userSession = \OC::$server->getUserSession();
-		$userManager = \OC::$server->getUserManager();
-		if ($user = $userManager->get($uid)) {
-			$userSession->setUser($user);
-		} else {
-			\OC::$server->getSession()->set('user_id', $uid);
-		}
-	}
-
-	/**
-	 * Sets user display name for session
-	 *
-	 * @param string $uid
-	 * @param string $displayName
-	 * @return bool Whether the display name could get set
-	 */
-	public static function setDisplayName($uid, $displayName = null) {
-		if (is_null($displayName)) {
-			$displayName = $uid;
-		}
-		$user = \OC::$server->getUserManager()->get($uid);
-		if ($user) {
-			return $user->setDisplayName($displayName);
-		} else {
-			return false;
-		}
-	}
-
-	/**
-	 * Check if the user is logged in, considers also the HTTP basic credentials
-	 *
-	 * @deprecated use \OC::$server->getUserSession()->isLoggedIn()
-	 * @return bool
-	 */
-	public static function isLoggedIn() {
-		return \OC::$server->getUserSession()->isLoggedIn();
-	}
-
-	/**
-	 * set incognito mode, e.g. if a user wants to open a public link
-	 *
-	 * @param bool $status
-	 */
-	public static function setIncognitoMode($status) {
-		self::$incognitoMode = $status;
-	}
-
-	/**
-	 * get incognito mode status
-	 *
-	 * @return bool
-	 */
-	public static function isIncognitoMode() {
-		return self::$incognitoMode;
-	}
-
-	/**
-	 * Supplies an attribute to the logout hyperlink. The default behaviour
-	 * is to return an href with '?logout=true' appended. However, it can
-	 * supply any attribute(s) which are valid for <a>.
-	 *
-	 * @return string with one or more HTML attributes.
-	 */
-	public static function getLogoutAttribute() {
-		$backend = self::findFirstActiveUsedBackend();
-		if ($backend) {
-			return $backend->getLogoutAttribute();
-		}
-
-		$logoutUrl = \OC::$server->getURLGenerator()->linkToRouteAbsolute(
-			'core.login.logout',
-			[
-				'requesttoken' => \OCP\Util::callRegister(),
-			]
-		);
-
-		return 'href="'.$logoutUrl.'"';
-	}
-
-	/**
-	 * Check if the user is an admin user
-	 *
-	 * @param string $uid uid of the admin
-	 * @return bool
-	 */
-	public static function isAdminUser($uid) {
-		$group = \OC::$server->getGroupManager()->get('admin');
-		$user = \OC::$server->getUserManager()->get($uid);
-		if ($group && $user && $group->inGroup($user) && self::$incognitoMode === false) {
-			return true;
-		}
-		return false;
-	}
-
-
-	/**
-	 * get the user id of the user currently logged in.
-	 *
-	 * @return string|bool uid or false
-	 */
-	public static function getUser() {
-		$uid = \OC::$server->getSession() ? \OC::$server->getSession()->get('user_id') : null;
-		if (!is_null($uid) && self::$incognitoMode === false) {
-			return $uid;
-		} else {
-			return false;
-		}
-	}
-
-	/**
-	 * get the display name of the user currently logged in.
-	 *
-	 * @param string $uid
-	 * @return string uid or false
-	 */
-	public static function getDisplayName($uid = null) {
-		if ($uid) {
-			$user = \OC::$server->getUserManager()->get($uid);
-			if ($user) {
-				return $user->getDisplayName();
-			} else {
-				return $uid;
-			}
-		} else {
-			$user = self::getUserSession()->getUser();
-			if ($user) {
-				return $user->getDisplayName();
-			} else {
-				return false;
-			}
-		}
-	}
-
-	/**
-	 * Autogenerate a password
-	 *
-	 * @return string
-	 *
-	 * generates a password
-	 */
-	public static function generatePassword() {
-		return \OC::$server->getSecureRandom()->generate(30);
-	}
-
-	/**
-	 * Set password
-	 *
-	 * @param string $uid The username
-	 * @param string $password The new password
-	 * @param string $recoveryPassword for the encryption app to reset encryption keys
-	 * @return bool
-	 *
-	 * Change the password of a user
-	 */
-	public static function setPassword($uid, $password, $recoveryPassword = null) {
-		$user = \OC::$server->getUserManager()->get($uid);
-		if ($user) {
-			return $user->setPassword($password, $recoveryPassword);
-		} else {
-			return false;
-		}
-	}
-
-	/**
-	 * Check whether user can change his avatar
-	 *
-	 * @param string $uid The username
-	 * @return bool
-	 *
-	 * Check whether a specified user can change his avatar
-	 */
-	public static function canUserChangeAvatar($uid) {
-		$user = \OC::$server->getUserManager()->get($uid);
-		if ($user) {
-			return $user->canChangeAvatar();
-		} else {
-			return false;
-		}
-	}
-
-	/**
-	 * Check whether user can change his password
-	 *
-	 * @param string $uid The username
-	 * @return bool
-	 *
-	 * Check whether a specified user can change his password
-	 */
-	public static function canUserChangePassword($uid) {
-		$user = \OC::$server->getUserManager()->get($uid);
-		if ($user) {
-			return $user->canChangePassword();
-		} else {
-			return false;
-		}
-	}
-
-	/**
-	 * Check whether user can change his display name
-	 *
-	 * @param string $uid The username
-	 * @return bool
-	 *
-	 * Check whether a specified user can change his display name
-	 */
-	public static function canUserChangeDisplayName($uid) {
-		$user = \OC::$server->getUserManager()->get($uid);
-		if ($user) {
-			return $user->canChangeDisplayName();
-		} else {
-			return false;
-		}
-	}
-
-	/**
-	 * Check if the password is correct
-	 *
-	 * @param string $uid The username
-	 * @param string $password The password
-	 * @return string|false user id a string on success, false otherwise
-	 *
-	 * Check if the password is correct without logging in the user
-	 * returns the user id or false
-	 */
-	public static function checkPassword($uid, $password) {
-		$manager = \OC::$server->getUserManager();
-		$username = $manager->checkPassword($uid, $password);
-		if ($username !== false) {
-			return $username->getUID();
-		}
-		return false;
-	}
-
-	/**
-	 * @param string $uid The username
-	 * @return string
-	 *
-	 * returns the path to the users home directory
-	 * @deprecated Use \OC::$server->getUserManager->getHome()
-	 */
-	public static function getHome($uid) {
-		$user = \OC::$server->getUserManager()->get($uid);
-		if ($user) {
-			return $user->getHome();
-		} else {
-			return \OC::$server->getSystemConfig()->getValue('datadirectory', OC::$SERVERROOT . '/data') . '/' . $uid;
-		}
-	}
-
-	/**
-	 * Get a list of all users
-	 *
-	 * @return array an array of all uids
-	 *
-	 * Get a list of all users.
-	 * @param string $search
-	 * @param integer $limit
-	 * @param integer $offset
-	 */
-	public static function getUsers($search = '', $limit = null, $offset = null) {
-		$users = \OC::$server->getUserManager()->search($search, $limit, $offset);
-		$uids = array();
-		foreach ($users as $user) {
-			$uids[] = $user->getUID();
-		}
-		return $uids;
-	}
-
-	/**
-	 * Get a list of all users display name
-	 *
-	 * @param string $search
-	 * @param int $limit
-	 * @param int $offset
-	 * @return array associative array with all display names (value) and corresponding uids (key)
-	 *
-	 * Get a list of all display names and user ids.
-	 * @deprecated Use \OC::$server->getUserManager->searchDisplayName($search, $limit, $offset) instead.
-	 */
-	public static function getDisplayNames($search = '', $limit = null, $offset = null) {
-		$displayNames = array();
-		$users = \OC::$server->getUserManager()->searchDisplayName($search, $limit, $offset);
-		foreach ($users as $user) {
-			$displayNames[$user->getUID()] = $user->getDisplayName();
-		}
-		return $displayNames;
-	}
-
-	/**
-	 * check if a user exists
-	 *
-	 * @param string $uid the username
-	 * @return boolean
-	 */
-	public static function userExists($uid) {
-		return \OC::$server->getUserManager()->userExists($uid);
-	}
-
-	/**
-	 * disables a user
-	 *
-	 * @param string $uid the user to disable
-	 */
-	public static function disableUser($uid) {
-		$user = \OC::$server->getUserManager()->get($uid);
-		if ($user) {
-			$user->setEnabled(false);
-		}
-	}
-
-	/**
-	 * enable a user
-	 *
-	 * @param string $uid
-	 */
-	public static function enableUser($uid) {
-		$user = \OC::$server->getUserManager()->get($uid);
-		if ($user) {
-			$user->setEnabled(true);
-		}
-	}
-
-	/**
-	 * checks if a user is enabled
-	 *
-	 * @param string $uid
-	 * @return bool
-	 */
-	public static function isEnabled($uid) {
-		$user = \OC::$server->getUserManager()->get($uid);
-		if ($user) {
-			return $user->isEnabled();
-		} else {
-			return false;
-		}
-	}
-
-	/**
-	 * Set cookie value to use in next page load
-	 *
-	 * @param string $username username to be set
-	 * @param string $token
-	 */
-	public static function setMagicInCookie($username, $token) {
-		self::getUserSession()->setMagicInCookie($username, $token);
-	}
-
-	/**
-	 * Remove cookie for "remember username"
-	 */
-	public static function unsetMagicInCookie() {
-		self::getUserSession()->unsetMagicInCookie();
-	}
-
-	/**
-	 * Returns the first active backend from self::$_usedBackends.
-	 *
-	 * @return OCP\Authentication\IApacheBackend|null if no backend active, otherwise OCP\Authentication\IApacheBackend
-	 */
-	private static function findFirstActiveUsedBackend() {
-		foreach (self::$_usedBackends as $backend) {
-			if ($backend instanceof OCP\Authentication\IApacheBackend) {
-				if ($backend->isSessionActive()) {
-					return $backend;
-				}
-			}
-		}
-
-		return null;
-	}
+    /**
+     * @return \OC\User\Session
+     */
+    public static function getUserSession() {
+        return OC::$server->getUserSession();
+    }
+
+    private static $_usedBackends = array();
+
+    private static $_setupedBackends = array();
+
+    // bool, stores if a user want to access a resource anonymously, e.g if they open a public link
+    private static $incognitoMode = false;
+
+    /**
+     * Adds the backend to the list of used backends
+     *
+     * @param string|\OCP\UserInterface $backend default: database The backend to use for user management
+     * @return bool
+     *
+     * Set the User Authentication Module
+     */
+    public static function useBackend($backend = 'database') {
+        if ($backend instanceof \OCP\UserInterface) {
+            self::$_usedBackends[get_class($backend)] = $backend;
+            \OC::$server->getUserManager()->registerBackend($backend);
+        } else {
+            // You'll never know what happens
+            if (null === $backend OR !is_string($backend)) {
+                $backend = 'database';
+            }
+
+            // Load backend
+            switch ($backend) {
+                case 'database':
+                case 'mysql':
+                case 'sqlite':
+                    \OCP\Util::writeLog('core', 'Adding user backend ' . $backend . '.', \OCP\Util::DEBUG);
+                    self::$_usedBackends[$backend] = new \OC\User\Database();
+                    \OC::$server->getUserManager()->registerBackend(self::$_usedBackends[$backend]);
+                    break;
+                case 'dummy':
+                    self::$_usedBackends[$backend] = new \Test\Util\User\Dummy();
+                    \OC::$server->getUserManager()->registerBackend(self::$_usedBackends[$backend]);
+                    break;
+                default:
+                    \OCP\Util::writeLog('core', 'Adding default user backend ' . $backend . '.', \OCP\Util::DEBUG);
+                    $className = 'OC_USER_' . strtoupper($backend);
+                    self::$_usedBackends[$backend] = new $className();
+                    \OC::$server->getUserManager()->registerBackend(self::$_usedBackends[$backend]);
+                    break;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * remove all used backends
+     */
+    public static function clearBackends() {
+        self::$_usedBackends = array();
+        \OC::$server->getUserManager()->clearBackends();
+    }
+
+    /**
+     * setup the configured backends in config.php
+     */
+    public static function setupBackends() {
+        OC_App::loadApps(['prelogin']);
+        $backends = \OC::$server->getSystemConfig()->getValue('user_backends', []);
+        if (isset($backends['default']) && !$backends['default']) {
+            // clear default backends
+            self::clearBackends();
+        }
+        foreach ($backends as $i => $config) {
+            if (!is_array($config)) {
+                continue;
+            }
+            $class = $config['class'];
+            $arguments = $config['arguments'];
+            if (class_exists($class)) {
+                if (array_search($i, self::$_setupedBackends) === false) {
+                    // make a reflection object
+                    $reflectionObj = new ReflectionClass($class);
+
+                    // use Reflection to create a new instance, using the $args
+                    $backend = $reflectionObj->newInstanceArgs($arguments);
+                    self::useBackend($backend);
+                    self::$_setupedBackends[] = $i;
+                } else {
+                    \OCP\Util::writeLog('core', 'User backend ' . $class . ' already initialized.', \OCP\Util::DEBUG);
+                }
+            } else {
+                \OCP\Util::writeLog('core', 'User backend ' . $class . ' not found.', \OCP\Util::ERROR);
+            }
+        }
+    }
+
+    /**
+     * Try to login a user using the magic cookie (remember login)
+     *
+     * @deprecated use \OCP\IUserSession::loginWithCookie()
+     * @param string $uid The username of the user to log in
+     * @param string $token
+     * @param string $oldSessionId
+     * @return bool
+     */
+    public static function loginWithCookie($uid, $token, $oldSessionId) {
+        return self::getUserSession()->loginWithCookie($uid, $token, $oldSessionId);
+    }
+
+    /**
+     * Try to login a user, assuming authentication
+     * has already happened (e.g. via Single Sign On).
+     *
+     * Log in a user and regenerate a new session.
+     *
+     * @param \OCP\Authentication\IApacheBackend $backend
+     * @return bool
+     */
+    public static function loginWithApache(\OCP\Authentication\IApacheBackend $backend) {
+
+        $uid = $backend->getCurrentUserId();
+        $run = true;
+        OC_Hook::emit("OC_User", "pre_login", array("run" => &$run, "uid" => $uid));
+
+        if ($uid) {
+            if (self::getUser() !== $uid) {
+                self::setUserId($uid);
+                $setUidAsDisplayName = true;
+                if($backend instanceof \OCP\UserInterface
+                    && $backend->implementsActions(OC_User_Backend::GET_DISPLAYNAME)) {
+
+                    $backendDisplayName = $backend->getDisplayName($uid);
+                    if(is_string($backendDisplayName) && trim($backendDisplayName) !== '') {
+                        $setUidAsDisplayName = false;
+                    }
+                }
+                if($setUidAsDisplayName) {
+                    self::setDisplayName($uid);
+                }
+                self::getUserSession()->setLoginName($uid);
+                $request = OC::$server->getRequest();
+                self::getUserSession()->createSessionToken($request, $uid, $uid);
+                // setup the filesystem
+                OC_Util::setupFS($uid);
+                // first call the post_login hooks, the login-process needs to be
+                // completed before we can safely create the users folder.
+                // For example encryption needs to initialize the users keys first
+                // before we can create the user folder with the skeleton files
+                OC_Hook::emit("OC_User", "post_login", array("uid" => $uid, 'password' => ''));
+                //trigger creation of user home and /files folder
+                \OC::$server->getUserFolder($uid);
+            }
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Verify with Apache whether user is authenticated.
+     *
+     * @return boolean|null
+     *          true: authenticated
+     *          false: not authenticated
+     *          null: not handled / no backend available
+     */
+    public static function handleApacheAuth() {
+        $backend = self::findFirstActiveUsedBackend();
+        if ($backend) {
+            OC_App::loadApps();
+
+            //setup extra user backends
+            self::setupBackends();
+            self::unsetMagicInCookie();
+
+            return self::loginWithApache($backend);
+        }
+
+        return null;
+    }
+
+
+    /**
+     * Sets user id for session and triggers emit
+     *
+     * @param string $uid
+     */
+    public static function setUserId($uid) {
+        $userSession = \OC::$server->getUserSession();
+        $userManager = \OC::$server->getUserManager();
+        if ($user = $userManager->get($uid)) {
+            $userSession->setUser($user);
+        } else {
+            \OC::$server->getSession()->set('user_id', $uid);
+        }
+    }
+
+    /**
+     * Sets user display name for session
+     *
+     * @param string $uid
+     * @param string $displayName
+     * @return bool Whether the display name could get set
+     */
+    public static function setDisplayName($uid, $displayName = null) {
+        if (is_null($displayName)) {
+            $displayName = $uid;
+        }
+        $user = \OC::$server->getUserManager()->get($uid);
+        if ($user) {
+            return $user->setDisplayName($displayName);
+        } else {
+            return false;
+        }
+    }
+
+    /**
+     * Check if the user is logged in, considers also the HTTP basic credentials
+     *
+     * @deprecated use \OC::$server->getUserSession()->isLoggedIn()
+     * @return bool
+     */
+    public static function isLoggedIn() {
+        return \OC::$server->getUserSession()->isLoggedIn();
+    }
+
+    /**
+     * set incognito mode, e.g. if a user wants to open a public link
+     *
+     * @param bool $status
+     */
+    public static function setIncognitoMode($status) {
+        self::$incognitoMode = $status;
+    }
+
+    /**
+     * get incognito mode status
+     *
+     * @return bool
+     */
+    public static function isIncognitoMode() {
+        return self::$incognitoMode;
+    }
+
+    /**
+     * Supplies an attribute to the logout hyperlink. The default behaviour
+     * is to return an href with '?logout=true' appended. However, it can
+     * supply any attribute(s) which are valid for <a>.
+     *
+     * @return string with one or more HTML attributes.
+     */
+    public static function getLogoutAttribute() {
+        $backend = self::findFirstActiveUsedBackend();
+        if ($backend) {
+            return $backend->getLogoutAttribute();
+        }
+
+        $logoutUrl = \OC::$server->getURLGenerator()->linkToRouteAbsolute(
+            'core.login.logout',
+            [
+                'requesttoken' => \OCP\Util::callRegister(),
+            ]
+        );
+
+        return 'href="'.$logoutUrl.'"';
+    }
+
+    /**
+     * Check if the user is an admin user
+     *
+     * @param string $uid uid of the admin
+     * @return bool
+     */
+    public static function isAdminUser($uid) {
+        $group = \OC::$server->getGroupManager()->get('admin');
+        $user = \OC::$server->getUserManager()->get($uid);
+        if ($group && $user && $group->inGroup($user) && self::$incognitoMode === false) {
+            return true;
+        }
+        return false;
+    }
+
+
+    /**
+     * get the user id of the user currently logged in.
+     *
+     * @return string|bool uid or false
+     */
+    public static function getUser() {
+        $uid = \OC::$server->getSession() ? \OC::$server->getSession()->get('user_id') : null;
+        if (!is_null($uid) && self::$incognitoMode === false) {
+            return $uid;
+        } else {
+            return false;
+        }
+    }
+
+    /**
+     * get the display name of the user currently logged in.
+     *
+     * @param string $uid
+     * @return string uid or false
+     */
+    public static function getDisplayName($uid = null) {
+        if ($uid) {
+            $user = \OC::$server->getUserManager()->get($uid);
+            if ($user) {
+                return $user->getDisplayName();
+            } else {
+                return $uid;
+            }
+        } else {
+            $user = self::getUserSession()->getUser();
+            if ($user) {
+                return $user->getDisplayName();
+            } else {
+                return false;
+            }
+        }
+    }
+
+    /**
+     * Autogenerate a password
+     *
+     * @return string
+     *
+     * generates a password
+     */
+    public static function generatePassword() {
+        return \OC::$server->getSecureRandom()->generate(30);
+    }
+
+    /**
+     * Set password
+     *
+     * @param string $uid The username
+     * @param string $password The new password
+     * @param string $recoveryPassword for the encryption app to reset encryption keys
+     * @return bool
+     *
+     * Change the password of a user
+     */
+    public static function setPassword($uid, $password, $recoveryPassword = null) {
+        $user = \OC::$server->getUserManager()->get($uid);
+        if ($user) {
+            return $user->setPassword($password, $recoveryPassword);
+        } else {
+            return false;
+        }
+    }
+
+    /**
+     * Check whether user can change his avatar
+     *
+     * @param string $uid The username
+     * @return bool
+     *
+     * Check whether a specified user can change his avatar
+     */
+    public static function canUserChangeAvatar($uid) {
+        $user = \OC::$server->getUserManager()->get($uid);
+        if ($user) {
+            return $user->canChangeAvatar();
+        } else {
+            return false;
+        }
+    }
+
+    /**
+     * Check whether user can change his password
+     *
+     * @param string $uid The username
+     * @return bool
+     *
+     * Check whether a specified user can change his password
+     */
+    public static function canUserChangePassword($uid) {
+        $user = \OC::$server->getUserManager()->get($uid);
+        if ($user) {
+            return $user->canChangePassword();
+        } else {
+            return false;
+        }
+    }
+
+    /**
+     * Check whether user can change his display name
+     *
+     * @param string $uid The username
+     * @return bool
+     *
+     * Check whether a specified user can change his display name
+     */
+    public static function canUserChangeDisplayName($uid) {
+        $user = \OC::$server->getUserManager()->get($uid);
+        if ($user) {
+            return $user->canChangeDisplayName();
+        } else {
+            return false;
+        }
+    }
+
+    /**
+     * Check if the password is correct
+     *
+     * @param string $uid The username
+     * @param string $password The password
+     * @return string|false user id a string on success, false otherwise
+     *
+     * Check if the password is correct without logging in the user
+     * returns the user id or false
+     */
+    public static function checkPassword($uid, $password) {
+        $manager = \OC::$server->getUserManager();
+        $username = $manager->checkPassword($uid, $password);
+        if ($username !== false) {
+            return $username->getUID();
+        }
+        return false;
+    }
+
+    /**
+     * @param string $uid The username
+     * @return string
+     *
+     * returns the path to the users home directory
+     * @deprecated Use \OC::$server->getUserManager->getHome()
+     */
+    public static function getHome($uid) {
+        $user = \OC::$server->getUserManager()->get($uid);
+        if ($user) {
+            return $user->getHome();
+        } else {
+            return \OC::$server->getSystemConfig()->getValue('datadirectory', OC::$SERVERROOT . '/data') . '/' . $uid;
+        }
+    }
+
+    /**
+     * Get a list of all users
+     *
+     * @return array an array of all uids
+     *
+     * Get a list of all users.
+     * @param string $search
+     * @param integer $limit
+     * @param integer $offset
+     */
+    public static function getUsers($search = '', $limit = null, $offset = null) {
+        $users = \OC::$server->getUserManager()->search($search, $limit, $offset);
+        $uids = array();
+        foreach ($users as $user) {
+            $uids[] = $user->getUID();
+        }
+        return $uids;
+    }
+
+    /**
+     * Get a list of all users display name
+     *
+     * @param string $search
+     * @param int $limit
+     * @param int $offset
+     * @return array associative array with all display names (value) and corresponding uids (key)
+     *
+     * Get a list of all display names and user ids.
+     * @deprecated Use \OC::$server->getUserManager->searchDisplayName($search, $limit, $offset) instead.
+     */
+    public static function getDisplayNames($search = '', $limit = null, $offset = null) {
+        $displayNames = array();
+        $users = \OC::$server->getUserManager()->searchDisplayName($search, $limit, $offset);
+        foreach ($users as $user) {
+            $displayNames[$user->getUID()] = $user->getDisplayName();
+        }
+        return $displayNames;
+    }
+
+    /**
+     * check if a user exists
+     *
+     * @param string $uid the username
+     * @return boolean
+     */
+    public static function userExists($uid) {
+        return \OC::$server->getUserManager()->userExists($uid);
+    }
+
+    /**
+     * disables a user
+     *
+     * @param string $uid the user to disable
+     */
+    public static function disableUser($uid) {
+        $user = \OC::$server->getUserManager()->get($uid);
+        if ($user) {
+            $user->setEnabled(false);
+        }
+    }
+
+    /**
+     * enable a user
+     *
+     * @param string $uid
+     */
+    public static function enableUser($uid) {
+        $user = \OC::$server->getUserManager()->get($uid);
+        if ($user) {
+            $user->setEnabled(true);
+        }
+    }
+
+    /**
+     * checks if a user is enabled
+     *
+     * @param string $uid
+     * @return bool
+     */
+    public static function isEnabled($uid) {
+        $user = \OC::$server->getUserManager()->get($uid);
+        if ($user) {
+            return $user->isEnabled();
+        } else {
+            return false;
+        }
+    }
+
+    /**
+     * Set cookie value to use in next page load
+     *
+     * @param string $username username to be set
+     * @param string $token
+     */
+    public static function setMagicInCookie($username, $token) {
+        self::getUserSession()->setMagicInCookie($username, $token);
+    }
+
+    /**
+     * Remove cookie for "remember username"
+     */
+    public static function unsetMagicInCookie() {
+        self::getUserSession()->unsetMagicInCookie();
+    }
+
+    /**
+     * Returns the first active backend from self::$_usedBackends.
+     *
+     * @return OCP\Authentication\IApacheBackend|null if no backend active, otherwise OCP\Authentication\IApacheBackend
+     */
+    private static function findFirstActiveUsedBackend() {
+        foreach (self::$_usedBackends as $backend) {
+            if ($backend instanceof OCP\Authentication\IApacheBackend) {
+                if ($backend->isSessionActive()) {
+                    return $backend;
+                }
+            }
+        }
+
+        return null;
+    }
 }

lib/private/Share/Share.php

Indentation +2837 added lines, -2837 removed lines

@@ -60,2874 +60,2874 @@
  */
 class Share extends Constants {
 
-	/** CRUDS permissions (Create, Read, Update, Delete, Share) using a bitmask
-	 * Construct permissions for share() and setPermissions with Or (|) e.g.
-	 * Give user read and update permissions: PERMISSION_READ | PERMISSION_UPDATE
-	 *
-	 * Check if permission is granted with And (&) e.g. Check if delete is
-	 * granted: if ($permissions & PERMISSION_DELETE)
-	 *
-	 * Remove permissions with And (&) and Not (~) e.g. Remove the update
-	 * permission: $permissions &= ~PERMISSION_UPDATE
-	 *
-	 * Apps are required to handle permissions on their own, this class only
-	 * stores and manages the permissions of shares
-	 * @see lib/public/constants.php
-	 */
-
-	/**
-	 * Register a sharing backend class that implements OCP\Share_Backend for an item type
-	 * @param string $itemType Item type
-	 * @param string $class Backend class
-	 * @param string $collectionOf (optional) Depends on item type
-	 * @param array $supportedFileExtensions (optional) List of supported file extensions if this item type depends on files
-	 * @return boolean true if backend is registered or false if error
-	 */
-	public static function registerBackend($itemType, $class, $collectionOf = null, $supportedFileExtensions = null) {
-		if (self::isEnabled()) {
-			if (!isset(self::$backendTypes[$itemType])) {
-				self::$backendTypes[$itemType] = array(
-					'class' => $class,
-					'collectionOf' => $collectionOf,
-					'supportedFileExtensions' => $supportedFileExtensions
-				);
-				if(count(self::$backendTypes) === 1) {
-					\OC_Util::addScript('core', 'shareconfigmodel');
-					\OC_Util::addScript('core', 'shareitemmodel');
-					\OC_Util::addScript('core', 'sharedialogresharerinfoview');
-					\OC_Util::addScript('core', 'sharedialoglinkshareview');
-					\OC_Util::addScript('core', 'sharedialogexpirationview');
-					\OC_Util::addScript('core', 'sharedialogshareelistview');
-					\OC_Util::addScript('core', 'sharedialogview');
-					\OC_Util::addScript('core', 'share');
-					\OC_Util::addStyle('core', 'share');
-				}
-				return true;
-			}
-			\OCP\Util::writeLog('OCP\Share',
-				'Sharing backend '.$class.' not registered, '.self::$backendTypes[$itemType]['class']
-				.' is already registered for '.$itemType,
-				\OCP\Util::WARN);
-		}
-		return false;
-	}
-
-	/**
-	 * Check if the Share API is enabled
-	 * @return boolean true if enabled or false
-	 *
-	 * The Share API is enabled by default if not configured
-	 */
-	public static function isEnabled() {
-		if (\OC::$server->getAppConfig()->getValue('core', 'shareapi_enabled', 'yes') == 'yes') {
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * Find which users can access a shared item
-	 * @param string $path to the file
-	 * @param string $ownerUser owner of the file
-	 * @param IUserManager $userManager
-	 * @param ILogger $logger
-	 * @param boolean $includeOwner include owner to the list of users with access to the file
-	 * @param boolean $returnUserPaths Return an array with the user => path map
-	 * @param boolean $recursive take all parent folders into account (default true)
-	 * @return array
-	 * @note $path needs to be relative to user data dir, e.g. 'file.txt'
-	 *       not '/admin/data/file.txt'
-	 * @throws \OC\User\NoUserException
-	 */
-	public static function getUsersSharingFile($path,
-											   $ownerUser,
-											   IUserManager $userManager,
-											   ILogger $logger,
-											   $includeOwner = false,
-											   $returnUserPaths = false,
-											   $recursive = true) {
-		$userObject = $userManager->get($ownerUser);
-
-		if (is_null($userObject)) {
-			$logger->error(
-				sprintf(
-					'Backends provided no user object for %s',
-					$ownerUser
-				),
-				[
-					'app' => 'files',
-				]
-			);
-			throw new \OC\User\NoUserException('Backends provided no user object');
-		}
-
-		$ownerUser = $userObject->getUID();
-
-		Filesystem::initMountPoints($ownerUser);
-		$shares = $sharePaths = $fileTargets = array();
-		$publicShare = false;
-		$remoteShare = false;
-		$source = -1;
-		$cache = $mountPath = false;
-
-		$view = new \OC\Files\View('/' . $ownerUser . '/files');
-		$meta = $view->getFileInfo($path);
-		if ($meta) {
-			$path = substr($meta->getPath(), strlen('/' . $ownerUser . '/files'));
-		} else {
-			// if the file doesn't exists yet we start with the parent folder
-			$meta = $view->getFileInfo(dirname($path));
-		}
-
-		if($meta !== false) {
-			$source = $meta['fileid'];
-			$cache = new \OC\Files\Cache\Cache($meta['storage']);
-
-			$mountPath = $meta->getMountPoint()->getMountPoint();
-			if ($mountPath !== false) {
-				$mountPath = substr($mountPath, strlen('/' . $ownerUser . '/files'));
-			}
-		}
-
-		$paths = [];
-		while ($source !== -1) {
-			// Fetch all shares with another user
-			if (!$returnUserPaths) {
-				$query = \OC_DB::prepare(
-					'SELECT `share_with`, `file_source`, `file_target`
+    /** CRUDS permissions (Create, Read, Update, Delete, Share) using a bitmask
+     * Construct permissions for share() and setPermissions with Or (|) e.g.
+     * Give user read and update permissions: PERMISSION_READ | PERMISSION_UPDATE
+     *
+     * Check if permission is granted with And (&) e.g. Check if delete is
+     * granted: if ($permissions & PERMISSION_DELETE)
+     *
+     * Remove permissions with And (&) and Not (~) e.g. Remove the update
+     * permission: $permissions &= ~PERMISSION_UPDATE
+     *
+     * Apps are required to handle permissions on their own, this class only
+     * stores and manages the permissions of shares
+     * @see lib/public/constants.php
+     */
+
+    /**
+     * Register a sharing backend class that implements OCP\Share_Backend for an item type
+     * @param string $itemType Item type
+     * @param string $class Backend class
+     * @param string $collectionOf (optional) Depends on item type
+     * @param array $supportedFileExtensions (optional) List of supported file extensions if this item type depends on files
+     * @return boolean true if backend is registered or false if error
+     */
+    public static function registerBackend($itemType, $class, $collectionOf = null, $supportedFileExtensions = null) {
+        if (self::isEnabled()) {
+            if (!isset(self::$backendTypes[$itemType])) {
+                self::$backendTypes[$itemType] = array(
+                    'class' => $class,
+                    'collectionOf' => $collectionOf,
+                    'supportedFileExtensions' => $supportedFileExtensions
+                );
+                if(count(self::$backendTypes) === 1) {
+                    \OC_Util::addScript('core', 'shareconfigmodel');
+                    \OC_Util::addScript('core', 'shareitemmodel');
+                    \OC_Util::addScript('core', 'sharedialogresharerinfoview');
+                    \OC_Util::addScript('core', 'sharedialoglinkshareview');
+                    \OC_Util::addScript('core', 'sharedialogexpirationview');
+                    \OC_Util::addScript('core', 'sharedialogshareelistview');
+                    \OC_Util::addScript('core', 'sharedialogview');
+                    \OC_Util::addScript('core', 'share');
+                    \OC_Util::addStyle('core', 'share');
+                }
+                return true;
+            }
+            \OCP\Util::writeLog('OCP\Share',
+                'Sharing backend '.$class.' not registered, '.self::$backendTypes[$itemType]['class']
+                .' is already registered for '.$itemType,
+                \OCP\Util::WARN);
+        }
+        return false;
+    }
+
+    /**
+     * Check if the Share API is enabled
+     * @return boolean true if enabled or false
+     *
+     * The Share API is enabled by default if not configured
+     */
+    public static function isEnabled() {
+        if (\OC::$server->getAppConfig()->getValue('core', 'shareapi_enabled', 'yes') == 'yes') {
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Find which users can access a shared item
+     * @param string $path to the file
+     * @param string $ownerUser owner of the file
+     * @param IUserManager $userManager
+     * @param ILogger $logger
+     * @param boolean $includeOwner include owner to the list of users with access to the file
+     * @param boolean $returnUserPaths Return an array with the user => path map
+     * @param boolean $recursive take all parent folders into account (default true)
+     * @return array
+     * @note $path needs to be relative to user data dir, e.g. 'file.txt'
+     *       not '/admin/data/file.txt'
+     * @throws \OC\User\NoUserException
+     */
+    public static function getUsersSharingFile($path,
+                                                $ownerUser,
+                                                IUserManager $userManager,
+                                                ILogger $logger,
+                                                $includeOwner = false,
+                                                $returnUserPaths = false,
+                                                $recursive = true) {
+        $userObject = $userManager->get($ownerUser);
+
+        if (is_null($userObject)) {
+            $logger->error(
+                sprintf(
+                    'Backends provided no user object for %s',
+                    $ownerUser
+                ),
+                [
+                    'app' => 'files',
+                ]
+            );
+            throw new \OC\User\NoUserException('Backends provided no user object');
+        }
+
+        $ownerUser = $userObject->getUID();
+
+        Filesystem::initMountPoints($ownerUser);
+        $shares = $sharePaths = $fileTargets = array();
+        $publicShare = false;
+        $remoteShare = false;
+        $source = -1;
+        $cache = $mountPath = false;
+
+        $view = new \OC\Files\View('/' . $ownerUser . '/files');
+        $meta = $view->getFileInfo($path);
+        if ($meta) {
+            $path = substr($meta->getPath(), strlen('/' . $ownerUser . '/files'));
+        } else {
+            // if the file doesn't exists yet we start with the parent folder
+            $meta = $view->getFileInfo(dirname($path));
+        }
+
+        if($meta !== false) {
+            $source = $meta['fileid'];
+            $cache = new \OC\Files\Cache\Cache($meta['storage']);
+
+            $mountPath = $meta->getMountPoint()->getMountPoint();
+            if ($mountPath !== false) {
+                $mountPath = substr($mountPath, strlen('/' . $ownerUser . '/files'));
+            }
+        }
+
+        $paths = [];
+        while ($source !== -1) {
+            // Fetch all shares with another user
+            if (!$returnUserPaths) {
+                $query = \OC_DB::prepare(
+                    'SELECT `share_with`, `file_source`, `file_target`
 					FROM
 					`*PREFIX*share`
 					WHERE
 					`item_source` = ? AND `share_type` = ? AND `item_type` IN (\'file\', \'folder\')'
-				);
-				$result = $query->execute(array($source, self::SHARE_TYPE_USER));
-			} else {
-				$query = \OC_DB::prepare(
-					'SELECT `share_with`, `file_source`, `file_target`
+                );
+                $result = $query->execute(array($source, self::SHARE_TYPE_USER));
+            } else {
+                $query = \OC_DB::prepare(
+                    'SELECT `share_with`, `file_source`, `file_target`
 				FROM
 				`*PREFIX*share`
 				WHERE
 				`item_source` = ? AND `share_type` IN (?, ?) AND `item_type` IN (\'file\', \'folder\')'
-				);
-				$result = $query->execute(array($source, self::SHARE_TYPE_USER, self::$shareTypeGroupUserUnique));
-			}
-
-			if (\OCP\DB::isError($result)) {
-				\OCP\Util::writeLog('OCP\Share', \OC_DB::getErrorMessage(), \OCP\Util::ERROR);
-			} else {
-				while ($row = $result->fetchRow()) {
-					$shares[] = $row['share_with'];
-					if ($returnUserPaths) {
-						$fileTargets[(int) $row['file_source']][$row['share_with']] = $row;
-					}
-				}
-			}
-
-			// We also need to take group shares into account
-			$query = \OC_DB::prepare(
-				'SELECT `share_with`, `file_source`, `file_target`
+                );
+                $result = $query->execute(array($source, self::SHARE_TYPE_USER, self::$shareTypeGroupUserUnique));
+            }
+
+            if (\OCP\DB::isError($result)) {
+                \OCP\Util::writeLog('OCP\Share', \OC_DB::getErrorMessage(), \OCP\Util::ERROR);
+            } else {
+                while ($row = $result->fetchRow()) {
+                    $shares[] = $row['share_with'];
+                    if ($returnUserPaths) {
+                        $fileTargets[(int) $row['file_source']][$row['share_with']] = $row;
+                    }
+                }
+            }
+
+            // We also need to take group shares into account
+            $query = \OC_DB::prepare(
+                'SELECT `share_with`, `file_source`, `file_target`
 				FROM
 				`*PREFIX*share`
 				WHERE
 				`item_source` = ? AND `share_type` = ? AND `item_type` IN (\'file\', \'folder\')'
-			);
-
-			$result = $query->execute(array($source, self::SHARE_TYPE_GROUP));
-
-			if (\OCP\DB::isError($result)) {
-				\OCP\Util::writeLog('OCP\Share', \OC_DB::getErrorMessage(), \OCP\Util::ERROR);
-			} else {
-				$groupManager = \OC::$server->getGroupManager();
-				while ($row = $result->fetchRow()) {
-
-					$usersInGroup = [];
-					$group = $groupManager->get($row['share_with']);
-					if ($group) {
-						$users = $group->searchUsers('', -1, 0);
-						$userIds = array();
-						foreach ($users as $user) {
-							$userIds[] = $user->getUID();
-						}
-						$usersInGroup = $userIds;
-					}
-					$shares = array_merge($shares, $usersInGroup);
-					if ($returnUserPaths) {
-						foreach ($usersInGroup as $user) {
-							if (!isset($fileTargets[(int) $row['file_source']][$user])) {
-								// When the user already has an entry for this file source
-								// the file is either shared directly with him as well, or
-								// he has an exception entry (because of naming conflict).
-								$fileTargets[(int) $row['file_source']][$user] = $row;
-							}
-						}
-					}
-				}
-			}
-
-			//check for public link shares
-			if (!$publicShare) {
-				$query = \OC_DB::prepare('
+            );
+
+            $result = $query->execute(array($source, self::SHARE_TYPE_GROUP));
+
+            if (\OCP\DB::isError($result)) {
+                \OCP\Util::writeLog('OCP\Share', \OC_DB::getErrorMessage(), \OCP\Util::ERROR);
+            } else {
+                $groupManager = \OC::$server->getGroupManager();
+                while ($row = $result->fetchRow()) {
+
+                    $usersInGroup = [];
+                    $group = $groupManager->get($row['share_with']);
+                    if ($group) {
+                        $users = $group->searchUsers('', -1, 0);
+                        $userIds = array();
+                        foreach ($users as $user) {
+                            $userIds[] = $user->getUID();
+                        }
+                        $usersInGroup = $userIds;
+                    }
+                    $shares = array_merge($shares, $usersInGroup);
+                    if ($returnUserPaths) {
+                        foreach ($usersInGroup as $user) {
+                            if (!isset($fileTargets[(int) $row['file_source']][$user])) {
+                                // When the user already has an entry for this file source
+                                // the file is either shared directly with him as well, or
+                                // he has an exception entry (because of naming conflict).
+                                $fileTargets[(int) $row['file_source']][$user] = $row;
+                            }
+                        }
+                    }
+                }
+            }
+
+            //check for public link shares
+            if (!$publicShare) {
+                $query = \OC_DB::prepare('
 					SELECT `share_with`
 					FROM `*PREFIX*share`
 					WHERE `item_source` = ? AND `share_type` = ? AND `item_type` IN (\'file\', \'folder\')', 1
-				);
-
-				$result = $query->execute(array($source, self::SHARE_TYPE_LINK));
-
-				if (\OCP\DB::isError($result)) {
-					\OCP\Util::writeLog('OCP\Share', \OC_DB::getErrorMessage(), \OCP\Util::ERROR);
-				} else {
-					if ($result->fetchRow()) {
-						$publicShare = true;
-					}
-				}
-			}
-
-			//check for remote share
-			if (!$remoteShare) {
-				$query = \OC_DB::prepare('
+                );
+
+                $result = $query->execute(array($source, self::SHARE_TYPE_LINK));
+
+                if (\OCP\DB::isError($result)) {
+                    \OCP\Util::writeLog('OCP\Share', \OC_DB::getErrorMessage(), \OCP\Util::ERROR);
+                } else {
+                    if ($result->fetchRow()) {
+                        $publicShare = true;
+                    }
+                }
+            }
+
+            //check for remote share
+            if (!$remoteShare) {
+                $query = \OC_DB::prepare('
 					SELECT `share_with`
 					FROM `*PREFIX*share`
 					WHERE `item_source` = ? AND `share_type` = ? AND `item_type` IN (\'file\', \'folder\')', 1
-				);
-
-				$result = $query->execute(array($source, self::SHARE_TYPE_REMOTE));
-
-				if (\OCP\DB::isError($result)) {
-					\OCP\Util::writeLog('OCP\Share', \OC_DB::getErrorMessage(), \OCP\Util::ERROR);
-				} else {
-					if ($result->fetchRow()) {
-						$remoteShare = true;
-					}
-				}
-			}
-
-			// let's get the parent for the next round
-			$meta = $cache->get((int)$source);
-			if ($recursive === true && $meta !== false) {
-				$paths[$source] = $meta['path'];
-				$source = (int)$meta['parent'];
-			} else {
-				$source = -1;
-			}
-		}
-
-		// Include owner in list of users, if requested
-		if ($includeOwner) {
-			$shares[] = $ownerUser;
-		}
-
-		if ($returnUserPaths) {
-			$fileTargetIDs = array_keys($fileTargets);
-			$fileTargetIDs = array_unique($fileTargetIDs);
-
-			if (!empty($fileTargetIDs)) {
-				$query = \OC_DB::prepare(
-					'SELECT `fileid`, `path`
+                );
+
+                $result = $query->execute(array($source, self::SHARE_TYPE_REMOTE));
+
+                if (\OCP\DB::isError($result)) {
+                    \OCP\Util::writeLog('OCP\Share', \OC_DB::getErrorMessage(), \OCP\Util::ERROR);
+                } else {
+                    if ($result->fetchRow()) {
+                        $remoteShare = true;
+                    }
+                }
+            }
+
+            // let's get the parent for the next round
+            $meta = $cache->get((int)$source);
+            if ($recursive === true && $meta !== false) {
+                $paths[$source] = $meta['path'];
+                $source = (int)$meta['parent'];
+            } else {
+                $source = -1;
+            }
+        }
+
+        // Include owner in list of users, if requested
+        if ($includeOwner) {
+            $shares[] = $ownerUser;
+        }
+
+        if ($returnUserPaths) {
+            $fileTargetIDs = array_keys($fileTargets);
+            $fileTargetIDs = array_unique($fileTargetIDs);
+
+            if (!empty($fileTargetIDs)) {
+                $query = \OC_DB::prepare(
+                    'SELECT `fileid`, `path`
 					FROM `*PREFIX*filecache`
 					WHERE `fileid` IN (' . implode(',', $fileTargetIDs) . ')'
-				);
-				$result = $query->execute();
-
-				if (\OCP\DB::isError($result)) {
-					\OCP\Util::writeLog('OCP\Share', \OC_DB::getErrorMessage(), \OCP\Util::ERROR);
-				} else {
-					while ($row = $result->fetchRow()) {
-						foreach ($fileTargets[$row['fileid']] as $uid => $shareData) {
-							if ($mountPath !== false) {
-								$sharedPath = $shareData['file_target'];
-								$sharedPath .= substr($path, strlen($mountPath) + strlen($paths[$row['fileid']]));
-								$sharePaths[$uid] = $sharedPath;
-							} else {
-								$sharedPath = $shareData['file_target'];
-								$sharedPath .= substr($path, strlen($row['path']) -5);
-								$sharePaths[$uid] = $sharedPath;
-							}
-						}
-					}
-				}
-			}
-
-			if ($includeOwner) {
-				$sharePaths[$ownerUser] = $path;
-			} else {
-				unset($sharePaths[$ownerUser]);
-			}
-
-			return $sharePaths;
-		}
-
-		return array('users' => array_unique($shares), 'public' => $publicShare, 'remote' => $remoteShare);
-	}
-
-	/**
-	 * Get the items of item type shared with the current user
-	 * @param string $itemType
-	 * @param int $format (optional) Format type must be defined by the backend
-	 * @param mixed $parameters (optional)
-	 * @param int $limit Number of items to return (optional) Returns all by default
-	 * @param boolean $includeCollections (optional)
-	 * @return mixed Return depends on format
-	 */
-	public static function getItemsSharedWith($itemType, $format = self::FORMAT_NONE,
-											  $parameters = null, $limit = -1, $includeCollections = false) {
-		return self::getItems($itemType, null, self::$shareTypeUserAndGroups, \OC_User::getUser(), null, $format,
-			$parameters, $limit, $includeCollections);
-	}
-
-	/**
-	 * Get the items of item type shared with a user
-	 * @param string $itemType
-	 * @param string $user id for which user we want the shares
-	 * @param int $format (optional) Format type must be defined by the backend
-	 * @param mixed $parameters (optional)
-	 * @param int $limit Number of items to return (optional) Returns all by default
-	 * @param boolean $includeCollections (optional)
-	 * @return mixed Return depends on format
-	 */
-	public static function getItemsSharedWithUser($itemType, $user, $format = self::FORMAT_NONE,
-												  $parameters = null, $limit = -1, $includeCollections = false) {
-		return self::getItems($itemType, null, self::$shareTypeUserAndGroups, $user, null, $format,
-			$parameters, $limit, $includeCollections);
-	}
-
-	/**
-	 * Get the item of item type shared with the current user
-	 * @param string $itemType
-	 * @param string $itemTarget
-	 * @param int $format (optional) Format type must be defined by the backend
-	 * @param mixed $parameters (optional)
-	 * @param boolean $includeCollections (optional)
-	 * @return mixed Return depends on format
-	 */
-	public static function getItemSharedWith($itemType, $itemTarget, $format = self::FORMAT_NONE,
-											 $parameters = null, $includeCollections = false) {
-		return self::getItems($itemType, $itemTarget, self::$shareTypeUserAndGroups, \OC_User::getUser(), null, $format,
-			$parameters, 1, $includeCollections);
-	}
-
-	/**
-	 * Get the item of item type shared with a given user by source
-	 * @param string $itemType
-	 * @param string $itemSource
-	 * @param string $user User to whom the item was shared
-	 * @param string $owner Owner of the share
-	 * @param int $shareType only look for a specific share type
-	 * @return array Return list of items with file_target, permissions and expiration
-	 */
-	public static function getItemSharedWithUser($itemType, $itemSource, $user, $owner = null, $shareType = null) {
-		$shares = array();
-		$fileDependent = false;
-
-		$where = 'WHERE';
-		$fileDependentWhere = '';
-		if ($itemType === 'file' || $itemType === 'folder') {
-			$fileDependent = true;
-			$column = 'file_source';
-			$fileDependentWhere = 'INNER JOIN `*PREFIX*filecache` ON `file_source` = `*PREFIX*filecache`.`fileid` ';
-			$fileDependentWhere .= 'INNER JOIN `*PREFIX*storages` ON `numeric_id` = `*PREFIX*filecache`.`storage` ';
-		} else {
-			$column = 'item_source';
-		}
-
-		$select = self::createSelectStatement(self::FORMAT_NONE, $fileDependent);
-
-		$where .= ' `' . $column . '` = ? AND `item_type` = ? ';
-		$arguments = array($itemSource, $itemType);
-		// for link shares $user === null
-		if ($user !== null) {
-			$where .= ' AND `share_with` = ? ';
-			$arguments[] = $user;
-		}
-
-		if ($shareType !== null) {
-			$where .= ' AND `share_type` = ? ';
-			$arguments[] = $shareType;
-		}
-
-		if ($owner !== null) {
-			$where .= ' AND `uid_owner` = ? ';
-			$arguments[] = $owner;
-		}
-
-		$query = \OC_DB::prepare('SELECT ' . $select . ' FROM `*PREFIX*share` '. $fileDependentWhere . $where);
-
-		$result = \OC_DB::executeAudited($query, $arguments);
-
-		while ($row = $result->fetchRow()) {
-			if ($fileDependent && !self::isFileReachable($row['path'], $row['storage_id'])) {
-				continue;
-			}
-			if ($fileDependent && (int)$row['file_parent'] === -1) {
-				// if it is a mount point we need to get the path from the mount manager
-				$mountManager = \OC\Files\Filesystem::getMountManager();
-				$mountPoint = $mountManager->findByStorageId($row['storage_id']);
-				if (!empty($mountPoint)) {
-					$path = $mountPoint[0]->getMountPoint();
-					$path = trim($path, '/');
-					$path = substr($path, strlen($owner) + 1); //normalize path to 'files/foo.txt`
-					$row['path'] = $path;
-				} else {
-					\OC::$server->getLogger()->warning(
-						'Could not resolve mount point for ' . $row['storage_id'],
-						['app' => 'OCP\Share']
-					);
-				}
-			}
-			$shares[] = $row;
-		}
-
-		//if didn't found a result than let's look for a group share.
-		if(empty($shares) && $user !== null) {
-			$userObject = \OC::$server->getUserManager()->get($user);
-			$groups = [];
-			if ($userObject) {
-				$groups = \OC::$server->getGroupManager()->getUserGroupIds($userObject);
-			}
-
-			if (!empty($groups)) {
-				$where = $fileDependentWhere . ' WHERE `' . $column . '` = ? AND `item_type` = ? AND `share_with` in (?)';
-				$arguments = array($itemSource, $itemType, $groups);
-				$types = array(null, null, IQueryBuilder::PARAM_STR_ARRAY);
-
-				if ($owner !== null) {
-					$where .= ' AND `uid_owner` = ?';
-					$arguments[] = $owner;
-					$types[] = null;
-				}
-
-				// TODO: inject connection, hopefully one day in the future when this
-				// class isn't static anymore...
-				$conn = \OC::$server->getDatabaseConnection();
-				$result = $conn->executeQuery(
-					'SELECT ' . $select . ' FROM `*PREFIX*share` ' . $where,
-					$arguments,
-					$types
-				);
-
-				while ($row = $result->fetch()) {
-					$shares[] = $row;
-				}
-			}
-		}
-
-		return $shares;
-
-	}
-
-	/**
-	 * Get the item of item type shared with the current user by source
-	 * @param string $itemType
-	 * @param string $itemSource
-	 * @param int $format (optional) Format type must be defined by the backend
-	 * @param mixed $parameters
-	 * @param boolean $includeCollections
-	 * @param string $shareWith (optional) define against which user should be checked, default: current user
-	 * @return array
-	 */
-	public static function getItemSharedWithBySource($itemType, $itemSource, $format = self::FORMAT_NONE,
-													 $parameters = null, $includeCollections = false, $shareWith = null) {
-		$shareWith = ($shareWith === null) ? \OC_User::getUser() : $shareWith;
-		return self::getItems($itemType, $itemSource, self::$shareTypeUserAndGroups, $shareWith, null, $format,
-			$parameters, 1, $includeCollections, true);
-	}
-
-	/**
-	 * Get the item of item type shared by a link
-	 * @param string $itemType
-	 * @param string $itemSource
-	 * @param string $uidOwner Owner of link
-	 * @return array
-	 */
-	public static function getItemSharedWithByLink($itemType, $itemSource, $uidOwner) {
-		return self::getItems($itemType, $itemSource, self::SHARE_TYPE_LINK, null, $uidOwner, self::FORMAT_NONE,
-			null, 1);
-	}
-
-	/**
-	 * Based on the given token the share information will be returned - password protected shares will be verified
-	 * @param string $token
-	 * @param bool $checkPasswordProtection
-	 * @return array|boolean false will be returned in case the token is unknown or unauthorized
-	 */
-	public static function getShareByToken($token, $checkPasswordProtection = true) {
-		$query = \OC_DB::prepare('SELECT * FROM `*PREFIX*share` WHERE `token` = ?', 1);
-		$result = $query->execute(array($token));
-		if ($result === false) {
-			\OCP\Util::writeLog('OCP\Share', \OC_DB::getErrorMessage() . ', token=' . $token, \OCP\Util::ERROR);
-		}
-		$row = $result->fetchRow();
-		if ($row === false) {
-			return false;
-		}
-		if (is_array($row) and self::expireItem($row)) {
-			return false;
-		}
-
-		// password protected shares need to be authenticated
-		if ($checkPasswordProtection && !\OCP\Share::checkPasswordProtectedShare($row)) {
-			return false;
-		}
-
-		return $row;
-	}
-
-	/**
-	 * resolves reshares down to the last real share
-	 * @param array $linkItem
-	 * @return array file owner
-	 */
-	public static function resolveReShare($linkItem)
-	{
-		if (isset($linkItem['parent'])) {
-			$parent = $linkItem['parent'];
-			while (isset($parent)) {
-				$query = \OC_DB::prepare('SELECT * FROM `*PREFIX*share` WHERE `id` = ?', 1);
-				$item = $query->execute(array($parent))->fetchRow();
-				if (isset($item['parent'])) {
-					$parent = $item['parent'];
-				} else {
-					return $item;
-				}
-			}
-		}
-		return $linkItem;
-	}
-
-
-	/**
-	 * Get the shared items of item type owned by the current user
-	 * @param string $itemType
-	 * @param int $format (optional) Format type must be defined by the backend
-	 * @param mixed $parameters
-	 * @param int $limit Number of items to return (optional) Returns all by default
-	 * @param boolean $includeCollections
-	 * @return mixed Return depends on format
-	 */
-	public static function getItemsShared($itemType, $format = self::FORMAT_NONE, $parameters = null,
-										  $limit = -1, $includeCollections = false) {
-		return self::getItems($itemType, null, null, null, \OC_User::getUser(), $format,
-			$parameters, $limit, $includeCollections);
-	}
-
-	/**
-	 * Get the shared item of item type owned by the current user
-	 * @param string $itemType
-	 * @param string $itemSource
-	 * @param int $format (optional) Format type must be defined by the backend
-	 * @param mixed $parameters
-	 * @param boolean $includeCollections
-	 * @return mixed Return depends on format
-	 */
-	public static function getItemShared($itemType, $itemSource, $format = self::FORMAT_NONE,
-										 $parameters = null, $includeCollections = false) {
-		return self::getItems($itemType, $itemSource, null, null, \OC_User::getUser(), $format,
-			$parameters, -1, $includeCollections);
-	}
-
-	/**
-	 * Get all users an item is shared with
-	 * @param string $itemType
-	 * @param string $itemSource
-	 * @param string $uidOwner
-	 * @param boolean $includeCollections
-	 * @param boolean $checkExpireDate
-	 * @return array Return array of users
-	 */
-	public static function getUsersItemShared($itemType, $itemSource, $uidOwner, $includeCollections = false, $checkExpireDate = true) {
-
-		$users = array();
-		$items = self::getItems($itemType, $itemSource, null, null, $uidOwner, self::FORMAT_NONE, null, -1, $includeCollections, false, $checkExpireDate);
-		if ($items) {
-			foreach ($items as $item) {
-				if ((int)$item['share_type'] === self::SHARE_TYPE_USER) {
-					$users[] = $item['share_with'];
-				} else if ((int)$item['share_type'] === self::SHARE_TYPE_GROUP) {
-
-					$group = \OC::$server->getGroupManager()->get($item['share_with']);
-					$userIds = [];
-					if ($group) {
-						$users = $group->searchUsers('', -1, 0);
-						foreach ($users as $user) {
-							$userIds[] = $user->getUID();
-						}
-						return $userIds;
-					}
-
-					$users = array_merge($users, $userIds);
-				}
-			}
-		}
-		return $users;
-	}
-
-	/**
-	 * Share an item with a user, group, or via private link
-	 * @param string $itemType
-	 * @param string $itemSource
-	 * @param int $shareType SHARE_TYPE_USER, SHARE_TYPE_GROUP, or SHARE_TYPE_LINK
-	 * @param string $shareWith User or group the item is being shared with
-	 * @param int $permissions CRUDS
-	 * @param string $itemSourceName
-	 * @param \DateTime $expirationDate
-	 * @param bool $passwordChanged
-	 * @return boolean|string Returns true on success or false on failure, Returns token on success for links
-	 * @throws \OC\HintException when the share type is remote and the shareWith is invalid
-	 * @throws \Exception
-	 */
-	public static function shareItem($itemType, $itemSource, $shareType, $shareWith, $permissions, $itemSourceName = null, \DateTime $expirationDate = null, $passwordChanged = null) {
-
-		$backend = self::getBackend($itemType);
-		$l = \OC::$server->getL10N('lib');
-
-		if ($backend->isShareTypeAllowed($shareType) === false) {
-			$message = 'Sharing %s failed, because the backend does not allow shares from type %i';
-			$message_t = $l->t('Sharing %s failed, because the backend does not allow shares from type %i', array($itemSourceName, $shareType));
-			\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $shareType), \OCP\Util::DEBUG);
-			throw new \Exception($message_t);
-		}
-
-		$uidOwner = \OC_User::getUser();
-		$shareWithinGroupOnly = self::shareWithGroupMembersOnly();
-
-		if (is_null($itemSourceName)) {
-			$itemSourceName = $itemSource;
-		}
-		$itemName = $itemSourceName;
-
-		// check if file can be shared
-		if ($itemType === 'file' or $itemType === 'folder') {
-			$path = \OC\Files\Filesystem::getPath($itemSource);
-			$itemName = $path;
-
-			// verify that the file exists before we try to share it
-			if (!$path) {
-				$message = 'Sharing %s failed, because the file does not exist';
-				$message_t = $l->t('Sharing %s failed, because the file does not exist', array($itemSourceName));
-				\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName), \OCP\Util::DEBUG);
-				throw new \Exception($message_t);
-			}
-			// verify that the user has share permission
-			if (!\OC\Files\Filesystem::isSharable($path) || \OCP\Util::isSharingDisabledForUser()) {
-				$message = 'You are not allowed to share %s';
-				$message_t = $l->t('You are not allowed to share %s', [$path]);
-				\OCP\Util::writeLog('OCP\Share', sprintf($message, $path), \OCP\Util::DEBUG);
-				throw new \Exception($message_t);
-			}
-		}
-
-		//verify that we don't share a folder which already contains a share mount point
-		if ($itemType === 'folder') {
-			$path = '/' . $uidOwner . '/files' . \OC\Files\Filesystem::getPath($itemSource) . '/';
-			$mountManager = \OC\Files\Filesystem::getMountManager();
-			$mounts = $mountManager->findIn($path);
-			foreach ($mounts as $mount) {
-				if ($mount->getStorage()->instanceOfStorage('\OCA\Files_Sharing\ISharedStorage')) {
-					$message = 'Sharing "' . $itemSourceName . '" failed, because it contains files shared with you!';
-					\OCP\Util::writeLog('OCP\Share', $message, \OCP\Util::DEBUG);
-					throw new \Exception($message);
-				}
-
-			}
-		}
-
-		// single file shares should never have delete permissions
-		if ($itemType === 'file') {
-			$permissions = (int)$permissions & ~\OCP\Constants::PERMISSION_DELETE;
-		}
-
-		//Validate expirationDate
-		if ($expirationDate !== null) {
-			try {
-				/*
+                );
+                $result = $query->execute();
+
+                if (\OCP\DB::isError($result)) {
+                    \OCP\Util::writeLog('OCP\Share', \OC_DB::getErrorMessage(), \OCP\Util::ERROR);
+                } else {
+                    while ($row = $result->fetchRow()) {
+                        foreach ($fileTargets[$row['fileid']] as $uid => $shareData) {
+                            if ($mountPath !== false) {
+                                $sharedPath = $shareData['file_target'];
+                                $sharedPath .= substr($path, strlen($mountPath) + strlen($paths[$row['fileid']]));
+                                $sharePaths[$uid] = $sharedPath;
+                            } else {
+                                $sharedPath = $shareData['file_target'];
+                                $sharedPath .= substr($path, strlen($row['path']) -5);
+                                $sharePaths[$uid] = $sharedPath;
+                            }
+                        }
+                    }
+                }
+            }
+
+            if ($includeOwner) {
+                $sharePaths[$ownerUser] = $path;
+            } else {
+                unset($sharePaths[$ownerUser]);
+            }
+
+            return $sharePaths;
+        }
+
+        return array('users' => array_unique($shares), 'public' => $publicShare, 'remote' => $remoteShare);
+    }
+
+    /**
+     * Get the items of item type shared with the current user
+     * @param string $itemType
+     * @param int $format (optional) Format type must be defined by the backend
+     * @param mixed $parameters (optional)
+     * @param int $limit Number of items to return (optional) Returns all by default
+     * @param boolean $includeCollections (optional)
+     * @return mixed Return depends on format
+     */
+    public static function getItemsSharedWith($itemType, $format = self::FORMAT_NONE,
+                                                $parameters = null, $limit = -1, $includeCollections = false) {
+        return self::getItems($itemType, null, self::$shareTypeUserAndGroups, \OC_User::getUser(), null, $format,
+            $parameters, $limit, $includeCollections);
+    }
+
+    /**
+     * Get the items of item type shared with a user
+     * @param string $itemType
+     * @param string $user id for which user we want the shares
+     * @param int $format (optional) Format type must be defined by the backend
+     * @param mixed $parameters (optional)
+     * @param int $limit Number of items to return (optional) Returns all by default
+     * @param boolean $includeCollections (optional)
+     * @return mixed Return depends on format
+     */
+    public static function getItemsSharedWithUser($itemType, $user, $format = self::FORMAT_NONE,
+                                                    $parameters = null, $limit = -1, $includeCollections = false) {
+        return self::getItems($itemType, null, self::$shareTypeUserAndGroups, $user, null, $format,
+            $parameters, $limit, $includeCollections);
+    }
+
+    /**
+     * Get the item of item type shared with the current user
+     * @param string $itemType
+     * @param string $itemTarget
+     * @param int $format (optional) Format type must be defined by the backend
+     * @param mixed $parameters (optional)
+     * @param boolean $includeCollections (optional)
+     * @return mixed Return depends on format
+     */
+    public static function getItemSharedWith($itemType, $itemTarget, $format = self::FORMAT_NONE,
+                                                $parameters = null, $includeCollections = false) {
+        return self::getItems($itemType, $itemTarget, self::$shareTypeUserAndGroups, \OC_User::getUser(), null, $format,
+            $parameters, 1, $includeCollections);
+    }
+
+    /**
+     * Get the item of item type shared with a given user by source
+     * @param string $itemType
+     * @param string $itemSource
+     * @param string $user User to whom the item was shared
+     * @param string $owner Owner of the share
+     * @param int $shareType only look for a specific share type
+     * @return array Return list of items with file_target, permissions and expiration
+     */
+    public static function getItemSharedWithUser($itemType, $itemSource, $user, $owner = null, $shareType = null) {
+        $shares = array();
+        $fileDependent = false;
+
+        $where = 'WHERE';
+        $fileDependentWhere = '';
+        if ($itemType === 'file' || $itemType === 'folder') {
+            $fileDependent = true;
+            $column = 'file_source';
+            $fileDependentWhere = 'INNER JOIN `*PREFIX*filecache` ON `file_source` = `*PREFIX*filecache`.`fileid` ';
+            $fileDependentWhere .= 'INNER JOIN `*PREFIX*storages` ON `numeric_id` = `*PREFIX*filecache`.`storage` ';
+        } else {
+            $column = 'item_source';
+        }
+
+        $select = self::createSelectStatement(self::FORMAT_NONE, $fileDependent);
+
+        $where .= ' `' . $column . '` = ? AND `item_type` = ? ';
+        $arguments = array($itemSource, $itemType);
+        // for link shares $user === null
+        if ($user !== null) {
+            $where .= ' AND `share_with` = ? ';
+            $arguments[] = $user;
+        }
+
+        if ($shareType !== null) {
+            $where .= ' AND `share_type` = ? ';
+            $arguments[] = $shareType;
+        }
+
+        if ($owner !== null) {
+            $where .= ' AND `uid_owner` = ? ';
+            $arguments[] = $owner;
+        }
+
+        $query = \OC_DB::prepare('SELECT ' . $select . ' FROM `*PREFIX*share` '. $fileDependentWhere . $where);
+
+        $result = \OC_DB::executeAudited($query, $arguments);
+
+        while ($row = $result->fetchRow()) {
+            if ($fileDependent && !self::isFileReachable($row['path'], $row['storage_id'])) {
+                continue;
+            }
+            if ($fileDependent && (int)$row['file_parent'] === -1) {
+                // if it is a mount point we need to get the path from the mount manager
+                $mountManager = \OC\Files\Filesystem::getMountManager();
+                $mountPoint = $mountManager->findByStorageId($row['storage_id']);
+                if (!empty($mountPoint)) {
+                    $path = $mountPoint[0]->getMountPoint();
+                    $path = trim($path, '/');
+                    $path = substr($path, strlen($owner) + 1); //normalize path to 'files/foo.txt`
+                    $row['path'] = $path;
+                } else {
+                    \OC::$server->getLogger()->warning(
+                        'Could not resolve mount point for ' . $row['storage_id'],
+                        ['app' => 'OCP\Share']
+                    );
+                }
+            }
+            $shares[] = $row;
+        }
+
+        //if didn't found a result than let's look for a group share.
+        if(empty($shares) && $user !== null) {
+            $userObject = \OC::$server->getUserManager()->get($user);
+            $groups = [];
+            if ($userObject) {
+                $groups = \OC::$server->getGroupManager()->getUserGroupIds($userObject);
+            }
+
+            if (!empty($groups)) {
+                $where = $fileDependentWhere . ' WHERE `' . $column . '` = ? AND `item_type` = ? AND `share_with` in (?)';
+                $arguments = array($itemSource, $itemType, $groups);
+                $types = array(null, null, IQueryBuilder::PARAM_STR_ARRAY);
+
+                if ($owner !== null) {
+                    $where .= ' AND `uid_owner` = ?';
+                    $arguments[] = $owner;
+                    $types[] = null;
+                }
+
+                // TODO: inject connection, hopefully one day in the future when this
+                // class isn't static anymore...
+                $conn = \OC::$server->getDatabaseConnection();
+                $result = $conn->executeQuery(
+                    'SELECT ' . $select . ' FROM `*PREFIX*share` ' . $where,
+                    $arguments,
+                    $types
+                );
+
+                while ($row = $result->fetch()) {
+                    $shares[] = $row;
+                }
+            }
+        }
+
+        return $shares;
+
+    }
+
+    /**
+     * Get the item of item type shared with the current user by source
+     * @param string $itemType
+     * @param string $itemSource
+     * @param int $format (optional) Format type must be defined by the backend
+     * @param mixed $parameters
+     * @param boolean $includeCollections
+     * @param string $shareWith (optional) define against which user should be checked, default: current user
+     * @return array
+     */
+    public static function getItemSharedWithBySource($itemType, $itemSource, $format = self::FORMAT_NONE,
+                                                        $parameters = null, $includeCollections = false, $shareWith = null) {
+        $shareWith = ($shareWith === null) ? \OC_User::getUser() : $shareWith;
+        return self::getItems($itemType, $itemSource, self::$shareTypeUserAndGroups, $shareWith, null, $format,
+            $parameters, 1, $includeCollections, true);
+    }
+
+    /**
+     * Get the item of item type shared by a link
+     * @param string $itemType
+     * @param string $itemSource
+     * @param string $uidOwner Owner of link
+     * @return array
+     */
+    public static function getItemSharedWithByLink($itemType, $itemSource, $uidOwner) {
+        return self::getItems($itemType, $itemSource, self::SHARE_TYPE_LINK, null, $uidOwner, self::FORMAT_NONE,
+            null, 1);
+    }
+
+    /**
+     * Based on the given token the share information will be returned - password protected shares will be verified
+     * @param string $token
+     * @param bool $checkPasswordProtection
+     * @return array|boolean false will be returned in case the token is unknown or unauthorized
+     */
+    public static function getShareByToken($token, $checkPasswordProtection = true) {
+        $query = \OC_DB::prepare('SELECT * FROM `*PREFIX*share` WHERE `token` = ?', 1);
+        $result = $query->execute(array($token));
+        if ($result === false) {
+            \OCP\Util::writeLog('OCP\Share', \OC_DB::getErrorMessage() . ', token=' . $token, \OCP\Util::ERROR);
+        }
+        $row = $result->fetchRow();
+        if ($row === false) {
+            return false;
+        }
+        if (is_array($row) and self::expireItem($row)) {
+            return false;
+        }
+
+        // password protected shares need to be authenticated
+        if ($checkPasswordProtection && !\OCP\Share::checkPasswordProtectedShare($row)) {
+            return false;
+        }
+
+        return $row;
+    }
+
+    /**
+     * resolves reshares down to the last real share
+     * @param array $linkItem
+     * @return array file owner
+     */
+    public static function resolveReShare($linkItem)
+    {
+        if (isset($linkItem['parent'])) {
+            $parent = $linkItem['parent'];
+            while (isset($parent)) {
+                $query = \OC_DB::prepare('SELECT * FROM `*PREFIX*share` WHERE `id` = ?', 1);
+                $item = $query->execute(array($parent))->fetchRow();
+                if (isset($item['parent'])) {
+                    $parent = $item['parent'];
+                } else {
+                    return $item;
+                }
+            }
+        }
+        return $linkItem;
+    }
+
+
+    /**
+     * Get the shared items of item type owned by the current user
+     * @param string $itemType
+     * @param int $format (optional) Format type must be defined by the backend
+     * @param mixed $parameters
+     * @param int $limit Number of items to return (optional) Returns all by default
+     * @param boolean $includeCollections
+     * @return mixed Return depends on format
+     */
+    public static function getItemsShared($itemType, $format = self::FORMAT_NONE, $parameters = null,
+                                            $limit = -1, $includeCollections = false) {
+        return self::getItems($itemType, null, null, null, \OC_User::getUser(), $format,
+            $parameters, $limit, $includeCollections);
+    }
+
+    /**
+     * Get the shared item of item type owned by the current user
+     * @param string $itemType
+     * @param string $itemSource
+     * @param int $format (optional) Format type must be defined by the backend
+     * @param mixed $parameters
+     * @param boolean $includeCollections
+     * @return mixed Return depends on format
+     */
+    public static function getItemShared($itemType, $itemSource, $format = self::FORMAT_NONE,
+                                            $parameters = null, $includeCollections = false) {
+        return self::getItems($itemType, $itemSource, null, null, \OC_User::getUser(), $format,
+            $parameters, -1, $includeCollections);
+    }
+
+    /**
+     * Get all users an item is shared with
+     * @param string $itemType
+     * @param string $itemSource
+     * @param string $uidOwner
+     * @param boolean $includeCollections
+     * @param boolean $checkExpireDate
+     * @return array Return array of users
+     */
+    public static function getUsersItemShared($itemType, $itemSource, $uidOwner, $includeCollections = false, $checkExpireDate = true) {
+
+        $users = array();
+        $items = self::getItems($itemType, $itemSource, null, null, $uidOwner, self::FORMAT_NONE, null, -1, $includeCollections, false, $checkExpireDate);
+        if ($items) {
+            foreach ($items as $item) {
+                if ((int)$item['share_type'] === self::SHARE_TYPE_USER) {
+                    $users[] = $item['share_with'];
+                } else if ((int)$item['share_type'] === self::SHARE_TYPE_GROUP) {
+
+                    $group = \OC::$server->getGroupManager()->get($item['share_with']);
+                    $userIds = [];
+                    if ($group) {
+                        $users = $group->searchUsers('', -1, 0);
+                        foreach ($users as $user) {
+                            $userIds[] = $user->getUID();
+                        }
+                        return $userIds;
+                    }
+
+                    $users = array_merge($users, $userIds);
+                }
+            }
+        }
+        return $users;
+    }
+
+    /**
+     * Share an item with a user, group, or via private link
+     * @param string $itemType
+     * @param string $itemSource
+     * @param int $shareType SHARE_TYPE_USER, SHARE_TYPE_GROUP, or SHARE_TYPE_LINK
+     * @param string $shareWith User or group the item is being shared with
+     * @param int $permissions CRUDS
+     * @param string $itemSourceName
+     * @param \DateTime $expirationDate
+     * @param bool $passwordChanged
+     * @return boolean|string Returns true on success or false on failure, Returns token on success for links
+     * @throws \OC\HintException when the share type is remote and the shareWith is invalid
+     * @throws \Exception
+     */
+    public static function shareItem($itemType, $itemSource, $shareType, $shareWith, $permissions, $itemSourceName = null, \DateTime $expirationDate = null, $passwordChanged = null) {
+
+        $backend = self::getBackend($itemType);
+        $l = \OC::$server->getL10N('lib');
+
+        if ($backend->isShareTypeAllowed($shareType) === false) {
+            $message = 'Sharing %s failed, because the backend does not allow shares from type %i';
+            $message_t = $l->t('Sharing %s failed, because the backend does not allow shares from type %i', array($itemSourceName, $shareType));
+            \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $shareType), \OCP\Util::DEBUG);
+            throw new \Exception($message_t);
+        }
+
+        $uidOwner = \OC_User::getUser();
+        $shareWithinGroupOnly = self::shareWithGroupMembersOnly();
+
+        if (is_null($itemSourceName)) {
+            $itemSourceName = $itemSource;
+        }
+        $itemName = $itemSourceName;
+
+        // check if file can be shared
+        if ($itemType === 'file' or $itemType === 'folder') {
+            $path = \OC\Files\Filesystem::getPath($itemSource);
+            $itemName = $path;
+
+            // verify that the file exists before we try to share it
+            if (!$path) {
+                $message = 'Sharing %s failed, because the file does not exist';
+                $message_t = $l->t('Sharing %s failed, because the file does not exist', array($itemSourceName));
+                \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName), \OCP\Util::DEBUG);
+                throw new \Exception($message_t);
+            }
+            // verify that the user has share permission
+            if (!\OC\Files\Filesystem::isSharable($path) || \OCP\Util::isSharingDisabledForUser()) {
+                $message = 'You are not allowed to share %s';
+                $message_t = $l->t('You are not allowed to share %s', [$path]);
+                \OCP\Util::writeLog('OCP\Share', sprintf($message, $path), \OCP\Util::DEBUG);
+                throw new \Exception($message_t);
+            }
+        }
+
+        //verify that we don't share a folder which already contains a share mount point
+        if ($itemType === 'folder') {
+            $path = '/' . $uidOwner . '/files' . \OC\Files\Filesystem::getPath($itemSource) . '/';
+            $mountManager = \OC\Files\Filesystem::getMountManager();
+            $mounts = $mountManager->findIn($path);
+            foreach ($mounts as $mount) {
+                if ($mount->getStorage()->instanceOfStorage('\OCA\Files_Sharing\ISharedStorage')) {
+                    $message = 'Sharing "' . $itemSourceName . '" failed, because it contains files shared with you!';
+                    \OCP\Util::writeLog('OCP\Share', $message, \OCP\Util::DEBUG);
+                    throw new \Exception($message);
+                }
+
+            }
+        }
+
+        // single file shares should never have delete permissions
+        if ($itemType === 'file') {
+            $permissions = (int)$permissions & ~\OCP\Constants::PERMISSION_DELETE;
+        }
+
+        //Validate expirationDate
+        if ($expirationDate !== null) {
+            try {
+                /*
 				 * Reuse the validateExpireDate.
 				 * We have to pass time() since the second arg is the time
 				 * the file was shared, since it is not shared yet we just use
 				 * the current time.
 				 */
-				$expirationDate = self::validateExpireDate($expirationDate->format('Y-m-d'), time(), $itemType, $itemSource);
-			} catch (\Exception $e) {
-				throw new \OC\HintException($e->getMessage(), $e->getMessage(), 404);
-			}
-		}
-
-		// Verify share type and sharing conditions are met
-		if ($shareType === self::SHARE_TYPE_USER) {
-			if ($shareWith == $uidOwner) {
-				$message = 'Sharing %s failed, because you can not share with yourself';
-				$message_t = $l->t('Sharing %s failed, because you can not share with yourself', [$itemName]);
-				\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName), \OCP\Util::DEBUG);
-				throw new \Exception($message_t);
-			}
-			if (!\OC_User::userExists($shareWith)) {
-				$message = 'Sharing %s failed, because the user %s does not exist';
-				$message_t = $l->t('Sharing %s failed, because the user %s does not exist', array($itemSourceName, $shareWith));
-				\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $shareWith), \OCP\Util::DEBUG);
-				throw new \Exception($message_t);
-			}
-			if ($shareWithinGroupOnly) {
-				$userManager = \OC::$server->getUserManager();
-				$groupManager = \OC::$server->getGroupManager();
-				$userOwner = $userManager->get($uidOwner);
-				$userShareWith = $userManager->get($shareWith);
-				$groupsOwner = [];
-				$groupsShareWith = [];
-				if ($userOwner) {
-					$groupsOwner = $groupManager->getUserGroupIds($userOwner);
-				}
-				if ($userShareWith) {
-					$groupsShareWith = $groupManager->getUserGroupIds($userShareWith);
-				}
-				$inGroup = array_intersect($groupsOwner, $groupsShareWith);
-				if (empty($inGroup)) {
-					$message = 'Sharing %s failed, because the user '
-						.'%s is not a member of any groups that %s is a member of';
-					$message_t = $l->t('Sharing %s failed, because the user %s is not a member of any groups that %s is a member of', array($itemName, $shareWith, $uidOwner));
-					\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemName, $shareWith, $uidOwner), \OCP\Util::DEBUG);
-					throw new \Exception($message_t);
-				}
-			}
-			// Check if the item source is already shared with the user, either from the same owner or a different user
-			if ($checkExists = self::getItems($itemType, $itemSource, self::$shareTypeUserAndGroups,
-				$shareWith, null, self::FORMAT_NONE, null, 1, true, true)) {
-				// Only allow the same share to occur again if it is the same
-				// owner and is not a user share, this use case is for increasing
-				// permissions for a specific user
-				if ($checkExists['uid_owner'] != $uidOwner || $checkExists['share_type'] == $shareType) {
-					$message = 'Sharing %s failed, because this item is already shared with %s';
-					$message_t = $l->t('Sharing %s failed, because this item is already shared with %s', array($itemSourceName, $shareWith));
-					\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $shareWith), \OCP\Util::DEBUG);
-					throw new \Exception($message_t);
-				}
-			}
-			if ($checkExists = self::getItems($itemType, $itemSource, self::SHARE_TYPE_USER,
-				$shareWith, null, self::FORMAT_NONE, null, 1, true, true)) {
-				// Only allow the same share to occur again if it is the same
-				// owner and is not a user share, this use case is for increasing
-				// permissions for a specific user
-				if ($checkExists['uid_owner'] != $uidOwner || $checkExists['share_type'] == $shareType) {
-					$message = 'Sharing %s failed, because this item is already shared with user %s';
-					$message_t = $l->t('Sharing %s failed, because this item is already shared with user %s', array($itemSourceName, $shareWith));
-					\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $shareWith), \OCP\Util::ERROR);
-					throw new \Exception($message_t);
-				}
-			}
-		} else if ($shareType === self::SHARE_TYPE_GROUP) {
-			if (!\OC::$server->getGroupManager()->groupExists($shareWith)) {
-				$message = 'Sharing %s failed, because the group %s does not exist';
-				$message_t = $l->t('Sharing %s failed, because the group %s does not exist', array($itemSourceName, $shareWith));
-				\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $shareWith), \OCP\Util::DEBUG);
-				throw new \Exception($message_t);
-			}
-			if ($shareWithinGroupOnly && !\OC_Group::inGroup($uidOwner, $shareWith)) {
-				$group = \OC::$server->getGroupManager()->get($shareWith);
-				$user = \OC::$server->getUserManager()->get($uidOwner);
-				if (!$group || !$user || !$group->inGroup($user)) {
-					$message = 'Sharing %s failed, because '
-						. '%s is not a member of the group %s';
-					$message_t = $l->t('Sharing %s failed, because %s is not a member of the group %s', array($itemSourceName, $uidOwner, $shareWith));
-					\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $uidOwner, $shareWith), \OCP\Util::DEBUG);
-					throw new \Exception($message_t);
-				}
-			}
-			// Check if the item source is already shared with the group, either from the same owner or a different user
-			// The check for each user in the group is done inside the put() function
-			if ($checkExists = self::getItems($itemType, $itemSource, self::SHARE_TYPE_GROUP, $shareWith,
-				null, self::FORMAT_NONE, null, 1, true, true)) {
-
-				if ($checkExists['share_with'] === $shareWith && $checkExists['share_type'] === \OCP\Share::SHARE_TYPE_GROUP) {
-					$message = 'Sharing %s failed, because this item is already shared with %s';
-					$message_t = $l->t('Sharing %s failed, because this item is already shared with %s', array($itemSourceName, $shareWith));
-					\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $shareWith), \OCP\Util::DEBUG);
-					throw new \Exception($message_t);
-				}
-			}
-			// Convert share with into an array with the keys group and users
-			$group = $shareWith;
-			$shareWith = array();
-			$shareWith['group'] = $group;
-
-
-			$groupObject = \OC::$server->getGroupManager()->get($group);
-			$userIds = [];
-			if ($groupObject) {
-				$users = $groupObject->searchUsers('', -1, 0);
-				foreach ($users as $user) {
-					$userIds[] = $user->getUID();
-				}
-			}
-
-			$shareWith['users'] = array_diff($userIds, array($uidOwner));
-		} else if ($shareType === self::SHARE_TYPE_LINK) {
-			$updateExistingShare = false;
-			if (\OC::$server->getAppConfig()->getValue('core', 'shareapi_allow_links', 'yes') == 'yes') {
-
-				// IF the password is changed via the old ajax endpoint verify it before deleting the old share
-				if ($passwordChanged === true) {
-					self::verifyPassword($shareWith);
-				}
-
-				// when updating a link share
-				// FIXME Don't delete link if we update it
-				if ($checkExists = self::getItems($itemType, $itemSource, self::SHARE_TYPE_LINK, null,
-					$uidOwner, self::FORMAT_NONE, null, 1)) {
-					// remember old token
-					$oldToken = $checkExists['token'];
-					$oldPermissions = $checkExists['permissions'];
-					//delete the old share
-					Helper::delete($checkExists['id']);
-					$updateExistingShare = true;
-				}
-
-				if ($passwordChanged === null) {
-					// Generate hash of password - same method as user passwords
-					if (is_string($shareWith) && $shareWith !== '') {
-						self::verifyPassword($shareWith);
-						$shareWith = \OC::$server->getHasher()->hash($shareWith);
-					} else {
-						// reuse the already set password, but only if we change permissions
-						// otherwise the user disabled the password protection
-						if ($checkExists && (int)$permissions !== (int)$oldPermissions) {
-							$shareWith = $checkExists['share_with'];
-						}
-					}
-				} else {
-					if ($passwordChanged === true) {
-						if (is_string($shareWith) && $shareWith !== '') {
-							self::verifyPassword($shareWith);
-							$shareWith = \OC::$server->getHasher()->hash($shareWith);
-						}
-					} else if ($updateExistingShare) {
-						$shareWith = $checkExists['share_with'];
-					}
-				}
-
-				if (\OCP\Util::isPublicLinkPasswordRequired() && empty($shareWith)) {
-					$message = 'You need to provide a password to create a public link, only protected links are allowed';
-					$message_t = $l->t('You need to provide a password to create a public link, only protected links are allowed');
-					\OCP\Util::writeLog('OCP\Share', $message, \OCP\Util::DEBUG);
-					throw new \Exception($message_t);
-				}
-
-				if ($updateExistingShare === false &&
-					self::isDefaultExpireDateEnabled() &&
-					empty($expirationDate)) {
-					$expirationDate = Helper::calcExpireDate();
-				}
-
-				// Generate token
-				if (isset($oldToken)) {
-					$token = $oldToken;
-				} else {
-					$token = \OC::$server->getSecureRandom()->generate(self::TOKEN_LENGTH,
-						\OCP\Security\ISecureRandom::CHAR_LOWER.\OCP\Security\ISecureRandom::CHAR_UPPER.
-						\OCP\Security\ISecureRandom::CHAR_DIGITS
-					);
-				}
-				$result = self::put($itemType, $itemSource, $shareType, $shareWith, $uidOwner, $permissions,
-					null, $token, $itemSourceName, $expirationDate);
-				if ($result) {
-					return $token;
-				} else {
-					return false;
-				}
-			}
-			$message = 'Sharing %s failed, because sharing with links is not allowed';
-			$message_t = $l->t('Sharing %s failed, because sharing with links is not allowed', array($itemSourceName));
-			\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName), \OCP\Util::DEBUG);
-			throw new \Exception($message_t);
-		} else if ($shareType === self::SHARE_TYPE_REMOTE) {
-
-			/*
+                $expirationDate = self::validateExpireDate($expirationDate->format('Y-m-d'), time(), $itemType, $itemSource);
+            } catch (\Exception $e) {
+                throw new \OC\HintException($e->getMessage(), $e->getMessage(), 404);
+            }
+        }
+
+        // Verify share type and sharing conditions are met
+        if ($shareType === self::SHARE_TYPE_USER) {
+            if ($shareWith == $uidOwner) {
+                $message = 'Sharing %s failed, because you can not share with yourself';
+                $message_t = $l->t('Sharing %s failed, because you can not share with yourself', [$itemName]);
+                \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName), \OCP\Util::DEBUG);
+                throw new \Exception($message_t);
+            }
+            if (!\OC_User::userExists($shareWith)) {
+                $message = 'Sharing %s failed, because the user %s does not exist';
+                $message_t = $l->t('Sharing %s failed, because the user %s does not exist', array($itemSourceName, $shareWith));
+                \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $shareWith), \OCP\Util::DEBUG);
+                throw new \Exception($message_t);
+            }
+            if ($shareWithinGroupOnly) {
+                $userManager = \OC::$server->getUserManager();
+                $groupManager = \OC::$server->getGroupManager();
+                $userOwner = $userManager->get($uidOwner);
+                $userShareWith = $userManager->get($shareWith);
+                $groupsOwner = [];
+                $groupsShareWith = [];
+                if ($userOwner) {
+                    $groupsOwner = $groupManager->getUserGroupIds($userOwner);
+                }
+                if ($userShareWith) {
+                    $groupsShareWith = $groupManager->getUserGroupIds($userShareWith);
+                }
+                $inGroup = array_intersect($groupsOwner, $groupsShareWith);
+                if (empty($inGroup)) {
+                    $message = 'Sharing %s failed, because the user '
+                        .'%s is not a member of any groups that %s is a member of';
+                    $message_t = $l->t('Sharing %s failed, because the user %s is not a member of any groups that %s is a member of', array($itemName, $shareWith, $uidOwner));
+                    \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemName, $shareWith, $uidOwner), \OCP\Util::DEBUG);
+                    throw new \Exception($message_t);
+                }
+            }
+            // Check if the item source is already shared with the user, either from the same owner or a different user
+            if ($checkExists = self::getItems($itemType, $itemSource, self::$shareTypeUserAndGroups,
+                $shareWith, null, self::FORMAT_NONE, null, 1, true, true)) {
+                // Only allow the same share to occur again if it is the same
+                // owner and is not a user share, this use case is for increasing
+                // permissions for a specific user
+                if ($checkExists['uid_owner'] != $uidOwner || $checkExists['share_type'] == $shareType) {
+                    $message = 'Sharing %s failed, because this item is already shared with %s';
+                    $message_t = $l->t('Sharing %s failed, because this item is already shared with %s', array($itemSourceName, $shareWith));
+                    \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $shareWith), \OCP\Util::DEBUG);
+                    throw new \Exception($message_t);
+                }
+            }
+            if ($checkExists = self::getItems($itemType, $itemSource, self::SHARE_TYPE_USER,
+                $shareWith, null, self::FORMAT_NONE, null, 1, true, true)) {
+                // Only allow the same share to occur again if it is the same
+                // owner and is not a user share, this use case is for increasing
+                // permissions for a specific user
+                if ($checkExists['uid_owner'] != $uidOwner || $checkExists['share_type'] == $shareType) {
+                    $message = 'Sharing %s failed, because this item is already shared with user %s';
+                    $message_t = $l->t('Sharing %s failed, because this item is already shared with user %s', array($itemSourceName, $shareWith));
+                    \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $shareWith), \OCP\Util::ERROR);
+                    throw new \Exception($message_t);
+                }
+            }
+        } else if ($shareType === self::SHARE_TYPE_GROUP) {
+            if (!\OC::$server->getGroupManager()->groupExists($shareWith)) {
+                $message = 'Sharing %s failed, because the group %s does not exist';
+                $message_t = $l->t('Sharing %s failed, because the group %s does not exist', array($itemSourceName, $shareWith));
+                \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $shareWith), \OCP\Util::DEBUG);
+                throw new \Exception($message_t);
+            }
+            if ($shareWithinGroupOnly && !\OC_Group::inGroup($uidOwner, $shareWith)) {
+                $group = \OC::$server->getGroupManager()->get($shareWith);
+                $user = \OC::$server->getUserManager()->get($uidOwner);
+                if (!$group || !$user || !$group->inGroup($user)) {
+                    $message = 'Sharing %s failed, because '
+                        . '%s is not a member of the group %s';
+                    $message_t = $l->t('Sharing %s failed, because %s is not a member of the group %s', array($itemSourceName, $uidOwner, $shareWith));
+                    \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $uidOwner, $shareWith), \OCP\Util::DEBUG);
+                    throw new \Exception($message_t);
+                }
+            }
+            // Check if the item source is already shared with the group, either from the same owner or a different user
+            // The check for each user in the group is done inside the put() function
+            if ($checkExists = self::getItems($itemType, $itemSource, self::SHARE_TYPE_GROUP, $shareWith,
+                null, self::FORMAT_NONE, null, 1, true, true)) {
+
+                if ($checkExists['share_with'] === $shareWith && $checkExists['share_type'] === \OCP\Share::SHARE_TYPE_GROUP) {
+                    $message = 'Sharing %s failed, because this item is already shared with %s';
+                    $message_t = $l->t('Sharing %s failed, because this item is already shared with %s', array($itemSourceName, $shareWith));
+                    \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $shareWith), \OCP\Util::DEBUG);
+                    throw new \Exception($message_t);
+                }
+            }
+            // Convert share with into an array with the keys group and users
+            $group = $shareWith;
+            $shareWith = array();
+            $shareWith['group'] = $group;
+
+
+            $groupObject = \OC::$server->getGroupManager()->get($group);
+            $userIds = [];
+            if ($groupObject) {
+                $users = $groupObject->searchUsers('', -1, 0);
+                foreach ($users as $user) {
+                    $userIds[] = $user->getUID();
+                }
+            }
+
+            $shareWith['users'] = array_diff($userIds, array($uidOwner));
+        } else if ($shareType === self::SHARE_TYPE_LINK) {
+            $updateExistingShare = false;
+            if (\OC::$server->getAppConfig()->getValue('core', 'shareapi_allow_links', 'yes') == 'yes') {
+
+                // IF the password is changed via the old ajax endpoint verify it before deleting the old share
+                if ($passwordChanged === true) {
+                    self::verifyPassword($shareWith);
+                }
+
+                // when updating a link share
+                // FIXME Don't delete link if we update it
+                if ($checkExists = self::getItems($itemType, $itemSource, self::SHARE_TYPE_LINK, null,
+                    $uidOwner, self::FORMAT_NONE, null, 1)) {
+                    // remember old token
+                    $oldToken = $checkExists['token'];
+                    $oldPermissions = $checkExists['permissions'];
+                    //delete the old share
+                    Helper::delete($checkExists['id']);
+                    $updateExistingShare = true;
+                }
+
+                if ($passwordChanged === null) {
+                    // Generate hash of password - same method as user passwords
+                    if (is_string($shareWith) && $shareWith !== '') {
+                        self::verifyPassword($shareWith);
+                        $shareWith = \OC::$server->getHasher()->hash($shareWith);
+                    } else {
+                        // reuse the already set password, but only if we change permissions
+                        // otherwise the user disabled the password protection
+                        if ($checkExists && (int)$permissions !== (int)$oldPermissions) {
+                            $shareWith = $checkExists['share_with'];
+                        }
+                    }
+                } else {
+                    if ($passwordChanged === true) {
+                        if (is_string($shareWith) && $shareWith !== '') {
+                            self::verifyPassword($shareWith);
+                            $shareWith = \OC::$server->getHasher()->hash($shareWith);
+                        }
+                    } else if ($updateExistingShare) {
+                        $shareWith = $checkExists['share_with'];
+                    }
+                }
+
+                if (\OCP\Util::isPublicLinkPasswordRequired() && empty($shareWith)) {
+                    $message = 'You need to provide a password to create a public link, only protected links are allowed';
+                    $message_t = $l->t('You need to provide a password to create a public link, only protected links are allowed');
+                    \OCP\Util::writeLog('OCP\Share', $message, \OCP\Util::DEBUG);
+                    throw new \Exception($message_t);
+                }
+
+                if ($updateExistingShare === false &&
+                    self::isDefaultExpireDateEnabled() &&
+                    empty($expirationDate)) {
+                    $expirationDate = Helper::calcExpireDate();
+                }
+
+                // Generate token
+                if (isset($oldToken)) {
+                    $token = $oldToken;
+                } else {
+                    $token = \OC::$server->getSecureRandom()->generate(self::TOKEN_LENGTH,
+                        \OCP\Security\ISecureRandom::CHAR_LOWER.\OCP\Security\ISecureRandom::CHAR_UPPER.
+                        \OCP\Security\ISecureRandom::CHAR_DIGITS
+                    );
+                }
+                $result = self::put($itemType, $itemSource, $shareType, $shareWith, $uidOwner, $permissions,
+                    null, $token, $itemSourceName, $expirationDate);
+                if ($result) {
+                    return $token;
+                } else {
+                    return false;
+                }
+            }
+            $message = 'Sharing %s failed, because sharing with links is not allowed';
+            $message_t = $l->t('Sharing %s failed, because sharing with links is not allowed', array($itemSourceName));
+            \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName), \OCP\Util::DEBUG);
+            throw new \Exception($message_t);
+        } else if ($shareType === self::SHARE_TYPE_REMOTE) {
+
+            /*
 			 * Check if file is not already shared with the remote user
 			 */
-			if ($checkExists = self::getItems($itemType, $itemSource, self::SHARE_TYPE_REMOTE,
-				$shareWith, $uidOwner, self::FORMAT_NONE, null, 1, true, true)) {
-					$message = 'Sharing %s failed, because this item is already shared with %s';
-					$message_t = $l->t('Sharing %s failed, because this item is already shared with %s', array($itemSourceName, $shareWith));
-					\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $shareWith), \OCP\Util::DEBUG);
-					throw new \Exception($message_t);
-			}
-
-			// don't allow federated shares if source and target server are the same
-			list($user, $remote) = Helper::splitUserRemote($shareWith);
-			$currentServer = self::removeProtocolFromUrl(\OC::$server->getURLGenerator()->getAbsoluteURL('/'));
-			$currentUser = \OC::$server->getUserSession()->getUser()->getUID();
-			if (Helper::isSameUserOnSameServer($user, $remote, $currentUser, $currentServer)) {
-				$message = 'Not allowed to create a federated share with the same user.';
-				$message_t = $l->t('Not allowed to create a federated share with the same user');
-				\OCP\Util::writeLog('OCP\Share', $message, \OCP\Util::DEBUG);
-				throw new \Exception($message_t);
-			}
-
-			$token = \OC::$server->getSecureRandom()->generate(self::TOKEN_LENGTH, \OCP\Security\ISecureRandom::CHAR_LOWER . \OCP\Security\ISecureRandom::CHAR_UPPER .
-				\OCP\Security\ISecureRandom::CHAR_DIGITS);
-
-			$shareWith = $user . '@' . $remote;
-			$shareId = self::put($itemType, $itemSource, $shareType, $shareWith, $uidOwner, $permissions, null, $token, $itemSourceName);
-
-			$send = false;
-			if ($shareId) {
-				$send = self::sendRemoteShare($token, $shareWith, $itemSourceName, $shareId, $uidOwner);
-			}
-
-			if ($send === false) {
-				$currentUser = \OC::$server->getUserSession()->getUser()->getUID();
-				self::unshare($itemType, $itemSource, $shareType, $shareWith, $currentUser);
-				$message_t = $l->t('Sharing %s failed, could not find %s, maybe the server is currently unreachable.', array($itemSourceName, $shareWith));
-				throw new \Exception($message_t);
-			}
-
-			return $send;
-		} else {
-			// Future share types need to include their own conditions
-			$message = 'Share type %s is not valid for %s';
-			$message_t = $l->t('Share type %s is not valid for %s', array($shareType, $itemSource));
-			\OCP\Util::writeLog('OCP\Share', sprintf($message, $shareType, $itemSource), \OCP\Util::DEBUG);
-			throw new \Exception($message_t);
-		}
-
-		// Put the item into the database
-		$result = self::put($itemType, $itemSource, $shareType, $shareWith, $uidOwner, $permissions, null, null, $itemSourceName, $expirationDate);
-
-		return $result ? true : false;
-	}
-
-	/**
-	 * Unshare an item from a user, group, or delete a private link
-	 * @param string $itemType
-	 * @param string $itemSource
-	 * @param int $shareType SHARE_TYPE_USER, SHARE_TYPE_GROUP, or SHARE_TYPE_LINK
-	 * @param string $shareWith User or group the item is being shared with
-	 * @param string $owner owner of the share, if null the current user is used
-	 * @return boolean true on success or false on failure
-	 */
-	public static function unshare($itemType, $itemSource, $shareType, $shareWith, $owner = null) {
-
-		// check if it is a valid itemType
-		self::getBackend($itemType);
-
-		$items = self::getItemSharedWithUser($itemType, $itemSource, $shareWith, $owner, $shareType);
-
-		$toDelete = array();
-		$newParent = null;
-		$currentUser = $owner ? $owner : \OC_User::getUser();
-		foreach ($items as $item) {
-			// delete the item with the expected share_type and owner
-			if ((int)$item['share_type'] === (int)$shareType && $item['uid_owner'] === $currentUser) {
-				$toDelete = $item;
-				// if there is more then one result we don't have to delete the children
-				// but update their parent. For group shares the new parent should always be
-				// the original group share and not the db entry with the unique name
-			} else if ((int)$item['share_type'] === self::$shareTypeGroupUserUnique) {
-				$newParent = $item['parent'];
-			} else {
-				$newParent = $item['id'];
-			}
-		}
-
-		if (!empty($toDelete)) {
-			self::unshareItem($toDelete, $newParent);
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * Unshare an item from all users, groups, and remove all links
-	 * @param string $itemType
-	 * @param string $itemSource
-	 * @return boolean true on success or false on failure
-	 */
-	public static function unshareAll($itemType, $itemSource) {
-		// Get all of the owners of shares of this item.
-		$query = \OC_DB::prepare( 'SELECT `uid_owner` from `*PREFIX*share` WHERE `item_type`=? AND `item_source`=?' );
-		$result = $query->execute(array($itemType, $itemSource));
-		$shares = array();
-		// Add each owner's shares to the array of all shares for this item.
-		while ($row = $result->fetchRow()) {
-			$shares = array_merge($shares, self::getItems($itemType, $itemSource, null, null, $row['uid_owner']));
-		}
-		if (!empty($shares)) {
-			// Pass all the vars we have for now, they may be useful
-			$hookParams = array(
-				'itemType' => $itemType,
-				'itemSource' => $itemSource,
-				'shares' => $shares,
-			);
-			\OC_Hook::emit('OCP\Share', 'pre_unshareAll', $hookParams);
-			foreach ($shares as $share) {
-				self::unshareItem($share);
-			}
-			\OC_Hook::emit('OCP\Share', 'post_unshareAll', $hookParams);
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * Unshare an item shared with the current user
-	 * @param string $itemType
-	 * @param string $itemOrigin Item target or source
-	 * @param boolean $originIsSource true if $itemOrigin is the source, false if $itemOrigin is the target (optional)
-	 * @return boolean true on success or false on failure
-	 *
-	 * Unsharing from self is not allowed for items inside collections
-	 */
-	public static function unshareFromSelf($itemType, $itemOrigin, $originIsSource = false) {
-		$originType = ($originIsSource) ? 'source' : 'target';
-		$uid = \OCP\User::getUser();
-
-		if ($itemType === 'file' || $itemType === 'folder') {
-			$statement = 'SELECT * FROM `*PREFIX*share` WHERE `item_type` = ? and `file_' . $originType . '` = ?';
-		} else {
-			$statement = 'SELECT * FROM `*PREFIX*share` WHERE `item_type` = ? and `item_' . $originType . '` = ?';
-		}
-
-		$query = \OCP\DB::prepare($statement);
-		$result = $query->execute(array($itemType, $itemOrigin));
-
-		$shares = $result->fetchAll();
-
-		$listOfUnsharedItems = array();
-
-		$itemUnshared = false;
-		foreach ($shares as $share) {
-			if ((int)$share['share_type'] === \OCP\Share::SHARE_TYPE_USER &&
-				$share['share_with'] === $uid) {
-				$deletedShares = Helper::delete($share['id']);
-				$shareTmp = array(
-					'id' => $share['id'],
-					'shareWith' => $share['share_with'],
-					'itemTarget' => $share['item_target'],
-					'itemType' => $share['item_type'],
-					'shareType' => (int)$share['share_type'],
-				);
-				if (isset($share['file_target'])) {
-					$shareTmp['fileTarget'] = $share['file_target'];
-				}
-				$listOfUnsharedItems = array_merge($listOfUnsharedItems, $deletedShares, array($shareTmp));
-				$itemUnshared = true;
-				break;
-			} elseif ((int)$share['share_type'] === \OCP\Share::SHARE_TYPE_GROUP) {
-				$group = \OC::$server->getGroupManager()->get($share['share_with']);
-				$user = \OC::$server->getUserManager()->get($uid);
-				if ($group && $user && $group->inGroup($user)) {
-					$groupShare = $share;
-				}
-			} elseif ((int)$share['share_type'] === self::$shareTypeGroupUserUnique &&
-				$share['share_with'] === $uid) {
-				$uniqueGroupShare = $share;
-			}
-		}
-
-		if (!$itemUnshared && isset($groupShare) && !isset($uniqueGroupShare)) {
-			$query = \OC_DB::prepare('INSERT INTO `*PREFIX*share`'
-				.' (`item_type`, `item_source`, `item_target`, `parent`, `share_type`,'
-				.' `share_with`, `uid_owner`, `permissions`, `stime`, `file_source`, `file_target`)'
-				.' VALUES (?,?,?,?,?,?,?,?,?,?,?)');
-			$query->execute(array($groupShare['item_type'], $groupShare['item_source'], $groupShare['item_target'],
-				$groupShare['id'], self::$shareTypeGroupUserUnique,
-				\OC_User::getUser(), $groupShare['uid_owner'], 0, $groupShare['stime'], $groupShare['file_source'],
-				$groupShare['file_target']));
-			$shareTmp = array(
-				'id' => $groupShare['id'],
-				'shareWith' => $groupShare['share_with'],
-				'itemTarget' => $groupShare['item_target'],
-				'itemType' => $groupShare['item_type'],
-				'shareType' => (int)$groupShare['share_type'],
-			);
-			if (isset($groupShare['file_target'])) {
-				$shareTmp['fileTarget'] = $groupShare['file_target'];
-			}
-			$listOfUnsharedItems = array_merge($listOfUnsharedItems, [$shareTmp]);
-			$itemUnshared = true;
-		} elseif (!$itemUnshared && isset($uniqueGroupShare)) {
-			$query = \OC_DB::prepare('UPDATE `*PREFIX*share` SET `permissions` = ? WHERE `id` = ?');
-			$query->execute(array(0, $uniqueGroupShare['id']));
-			$shareTmp = array(
-				'id' => $uniqueGroupShare['id'],
-				'shareWith' => $uniqueGroupShare['share_with'],
-				'itemTarget' => $uniqueGroupShare['item_target'],
-				'itemType' => $uniqueGroupShare['item_type'],
-				'shareType' => (int)$uniqueGroupShare['share_type'],
-			);
-			if (isset($uniqueGroupShare['file_target'])) {
-				$shareTmp['fileTarget'] = $uniqueGroupShare['file_target'];
-			}
-			$listOfUnsharedItems = array_merge($listOfUnsharedItems, [$shareTmp]);
-			$itemUnshared = true;
-		}
-
-		if ($itemUnshared) {
-			\OC_Hook::emit('OCP\Share', 'post_unshareFromSelf',
-				array('unsharedItems' => $listOfUnsharedItems, 'itemType' => $itemType));
-		}
-
-		return $itemUnshared;
-	}
-
-	/**
-	 * sent status if users got informed by mail about share
-	 * @param string $itemType
-	 * @param string $itemSource
-	 * @param int $shareType SHARE_TYPE_USER, SHARE_TYPE_GROUP, or SHARE_TYPE_LINK
-	 * @param string $recipient with whom was the file shared
-	 * @param boolean $status
-	 */
-	public static function setSendMailStatus($itemType, $itemSource, $shareType, $recipient, $status) {
-		$status = $status ? 1 : 0;
-
-		$query = \OC_DB::prepare(
-			'UPDATE `*PREFIX*share`
+            if ($checkExists = self::getItems($itemType, $itemSource, self::SHARE_TYPE_REMOTE,
+                $shareWith, $uidOwner, self::FORMAT_NONE, null, 1, true, true)) {
+                    $message = 'Sharing %s failed, because this item is already shared with %s';
+                    $message_t = $l->t('Sharing %s failed, because this item is already shared with %s', array($itemSourceName, $shareWith));
+                    \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $shareWith), \OCP\Util::DEBUG);
+                    throw new \Exception($message_t);
+            }
+
+            // don't allow federated shares if source and target server are the same
+            list($user, $remote) = Helper::splitUserRemote($shareWith);
+            $currentServer = self::removeProtocolFromUrl(\OC::$server->getURLGenerator()->getAbsoluteURL('/'));
+            $currentUser = \OC::$server->getUserSession()->getUser()->getUID();
+            if (Helper::isSameUserOnSameServer($user, $remote, $currentUser, $currentServer)) {
+                $message = 'Not allowed to create a federated share with the same user.';
+                $message_t = $l->t('Not allowed to create a federated share with the same user');
+                \OCP\Util::writeLog('OCP\Share', $message, \OCP\Util::DEBUG);
+                throw new \Exception($message_t);
+            }
+
+            $token = \OC::$server->getSecureRandom()->generate(self::TOKEN_LENGTH, \OCP\Security\ISecureRandom::CHAR_LOWER . \OCP\Security\ISecureRandom::CHAR_UPPER .
+                \OCP\Security\ISecureRandom::CHAR_DIGITS);
+
+            $shareWith = $user . '@' . $remote;
+            $shareId = self::put($itemType, $itemSource, $shareType, $shareWith, $uidOwner, $permissions, null, $token, $itemSourceName);
+
+            $send = false;
+            if ($shareId) {
+                $send = self::sendRemoteShare($token, $shareWith, $itemSourceName, $shareId, $uidOwner);
+            }
+
+            if ($send === false) {
+                $currentUser = \OC::$server->getUserSession()->getUser()->getUID();
+                self::unshare($itemType, $itemSource, $shareType, $shareWith, $currentUser);
+                $message_t = $l->t('Sharing %s failed, could not find %s, maybe the server is currently unreachable.', array($itemSourceName, $shareWith));
+                throw new \Exception($message_t);
+            }
+
+            return $send;
+        } else {
+            // Future share types need to include their own conditions
+            $message = 'Share type %s is not valid for %s';
+            $message_t = $l->t('Share type %s is not valid for %s', array($shareType, $itemSource));
+            \OCP\Util::writeLog('OCP\Share', sprintf($message, $shareType, $itemSource), \OCP\Util::DEBUG);
+            throw new \Exception($message_t);
+        }
+
+        // Put the item into the database
+        $result = self::put($itemType, $itemSource, $shareType, $shareWith, $uidOwner, $permissions, null, null, $itemSourceName, $expirationDate);
+
+        return $result ? true : false;
+    }
+
+    /**
+     * Unshare an item from a user, group, or delete a private link
+     * @param string $itemType
+     * @param string $itemSource
+     * @param int $shareType SHARE_TYPE_USER, SHARE_TYPE_GROUP, or SHARE_TYPE_LINK
+     * @param string $shareWith User or group the item is being shared with
+     * @param string $owner owner of the share, if null the current user is used
+     * @return boolean true on success or false on failure
+     */
+    public static function unshare($itemType, $itemSource, $shareType, $shareWith, $owner = null) {
+
+        // check if it is a valid itemType
+        self::getBackend($itemType);
+
+        $items = self::getItemSharedWithUser($itemType, $itemSource, $shareWith, $owner, $shareType);
+
+        $toDelete = array();
+        $newParent = null;
+        $currentUser = $owner ? $owner : \OC_User::getUser();
+        foreach ($items as $item) {
+            // delete the item with the expected share_type and owner
+            if ((int)$item['share_type'] === (int)$shareType && $item['uid_owner'] === $currentUser) {
+                $toDelete = $item;
+                // if there is more then one result we don't have to delete the children
+                // but update their parent. For group shares the new parent should always be
+                // the original group share and not the db entry with the unique name
+            } else if ((int)$item['share_type'] === self::$shareTypeGroupUserUnique) {
+                $newParent = $item['parent'];
+            } else {
+                $newParent = $item['id'];
+            }
+        }
+
+        if (!empty($toDelete)) {
+            self::unshareItem($toDelete, $newParent);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Unshare an item from all users, groups, and remove all links
+     * @param string $itemType
+     * @param string $itemSource
+     * @return boolean true on success or false on failure
+     */
+    public static function unshareAll($itemType, $itemSource) {
+        // Get all of the owners of shares of this item.
+        $query = \OC_DB::prepare( 'SELECT `uid_owner` from `*PREFIX*share` WHERE `item_type`=? AND `item_source`=?' );
+        $result = $query->execute(array($itemType, $itemSource));
+        $shares = array();
+        // Add each owner's shares to the array of all shares for this item.
+        while ($row = $result->fetchRow()) {
+            $shares = array_merge($shares, self::getItems($itemType, $itemSource, null, null, $row['uid_owner']));
+        }
+        if (!empty($shares)) {
+            // Pass all the vars we have for now, they may be useful
+            $hookParams = array(
+                'itemType' => $itemType,
+                'itemSource' => $itemSource,
+                'shares' => $shares,
+            );
+            \OC_Hook::emit('OCP\Share', 'pre_unshareAll', $hookParams);
+            foreach ($shares as $share) {
+                self::unshareItem($share);
+            }
+            \OC_Hook::emit('OCP\Share', 'post_unshareAll', $hookParams);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Unshare an item shared with the current user
+     * @param string $itemType
+     * @param string $itemOrigin Item target or source
+     * @param boolean $originIsSource true if $itemOrigin is the source, false if $itemOrigin is the target (optional)
+     * @return boolean true on success or false on failure
+     *
+     * Unsharing from self is not allowed for items inside collections
+     */
+    public static function unshareFromSelf($itemType, $itemOrigin, $originIsSource = false) {
+        $originType = ($originIsSource) ? 'source' : 'target';
+        $uid = \OCP\User::getUser();
+
+        if ($itemType === 'file' || $itemType === 'folder') {
+            $statement = 'SELECT * FROM `*PREFIX*share` WHERE `item_type` = ? and `file_' . $originType . '` = ?';
+        } else {
+            $statement = 'SELECT * FROM `*PREFIX*share` WHERE `item_type` = ? and `item_' . $originType . '` = ?';
+        }
+
+        $query = \OCP\DB::prepare($statement);
+        $result = $query->execute(array($itemType, $itemOrigin));
+
+        $shares = $result->fetchAll();
+
+        $listOfUnsharedItems = array();
+
+        $itemUnshared = false;
+        foreach ($shares as $share) {
+            if ((int)$share['share_type'] === \OCP\Share::SHARE_TYPE_USER &&
+                $share['share_with'] === $uid) {
+                $deletedShares = Helper::delete($share['id']);
+                $shareTmp = array(
+                    'id' => $share['id'],
+                    'shareWith' => $share['share_with'],
+                    'itemTarget' => $share['item_target'],
+                    'itemType' => $share['item_type'],
+                    'shareType' => (int)$share['share_type'],
+                );
+                if (isset($share['file_target'])) {
+                    $shareTmp['fileTarget'] = $share['file_target'];
+                }
+                $listOfUnsharedItems = array_merge($listOfUnsharedItems, $deletedShares, array($shareTmp));
+                $itemUnshared = true;
+                break;
+            } elseif ((int)$share['share_type'] === \OCP\Share::SHARE_TYPE_GROUP) {
+                $group = \OC::$server->getGroupManager()->get($share['share_with']);
+                $user = \OC::$server->getUserManager()->get($uid);
+                if ($group && $user && $group->inGroup($user)) {
+                    $groupShare = $share;
+                }
+            } elseif ((int)$share['share_type'] === self::$shareTypeGroupUserUnique &&
+                $share['share_with'] === $uid) {
+                $uniqueGroupShare = $share;
+            }
+        }
+
+        if (!$itemUnshared && isset($groupShare) && !isset($uniqueGroupShare)) {
+            $query = \OC_DB::prepare('INSERT INTO `*PREFIX*share`'
+                .' (`item_type`, `item_source`, `item_target`, `parent`, `share_type`,'
+                .' `share_with`, `uid_owner`, `permissions`, `stime`, `file_source`, `file_target`)'
+                .' VALUES (?,?,?,?,?,?,?,?,?,?,?)');
+            $query->execute(array($groupShare['item_type'], $groupShare['item_source'], $groupShare['item_target'],
+                $groupShare['id'], self::$shareTypeGroupUserUnique,
+                \OC_User::getUser(), $groupShare['uid_owner'], 0, $groupShare['stime'], $groupShare['file_source'],
+                $groupShare['file_target']));
+            $shareTmp = array(
+                'id' => $groupShare['id'],
+                'shareWith' => $groupShare['share_with'],
+                'itemTarget' => $groupShare['item_target'],
+                'itemType' => $groupShare['item_type'],
+                'shareType' => (int)$groupShare['share_type'],
+            );
+            if (isset($groupShare['file_target'])) {
+                $shareTmp['fileTarget'] = $groupShare['file_target'];
+            }
+            $listOfUnsharedItems = array_merge($listOfUnsharedItems, [$shareTmp]);
+            $itemUnshared = true;
+        } elseif (!$itemUnshared && isset($uniqueGroupShare)) {
+            $query = \OC_DB::prepare('UPDATE `*PREFIX*share` SET `permissions` = ? WHERE `id` = ?');
+            $query->execute(array(0, $uniqueGroupShare['id']));
+            $shareTmp = array(
+                'id' => $uniqueGroupShare['id'],
+                'shareWith' => $uniqueGroupShare['share_with'],
+                'itemTarget' => $uniqueGroupShare['item_target'],
+                'itemType' => $uniqueGroupShare['item_type'],
+                'shareType' => (int)$uniqueGroupShare['share_type'],
+            );
+            if (isset($uniqueGroupShare['file_target'])) {
+                $shareTmp['fileTarget'] = $uniqueGroupShare['file_target'];
+            }
+            $listOfUnsharedItems = array_merge($listOfUnsharedItems, [$shareTmp]);
+            $itemUnshared = true;
+        }
+
+        if ($itemUnshared) {
+            \OC_Hook::emit('OCP\Share', 'post_unshareFromSelf',
+                array('unsharedItems' => $listOfUnsharedItems, 'itemType' => $itemType));
+        }
+
+        return $itemUnshared;
+    }
+
+    /**
+     * sent status if users got informed by mail about share
+     * @param string $itemType
+     * @param string $itemSource
+     * @param int $shareType SHARE_TYPE_USER, SHARE_TYPE_GROUP, or SHARE_TYPE_LINK
+     * @param string $recipient with whom was the file shared
+     * @param boolean $status
+     */
+    public static function setSendMailStatus($itemType, $itemSource, $shareType, $recipient, $status) {
+        $status = $status ? 1 : 0;
+
+        $query = \OC_DB::prepare(
+            'UPDATE `*PREFIX*share`
 					SET `mail_send` = ?
 					WHERE `item_type` = ? AND `item_source` = ? AND `share_type` = ? AND `share_with` = ?');
 
-		$result = $query->execute(array($status, $itemType, $itemSource, $shareType, $recipient));
-
-		if($result === false) {
-			\OCP\Util::writeLog('OCP\Share', 'Couldn\'t set send mail status', \OCP\Util::ERROR);
-		}
-	}
-
-	/**
-	 * Set the permissions of an item for a specific user or group
-	 * @param string $itemType
-	 * @param string $itemSource
-	 * @param int $shareType SHARE_TYPE_USER, SHARE_TYPE_GROUP, or SHARE_TYPE_LINK
-	 * @param string $shareWith User or group the item is being shared with
-	 * @param int $permissions CRUDS permissions
-	 * @return boolean true on success or false on failure
-	 * @throws \Exception when trying to grant more permissions then the user has himself
-	 */
-	public static function setPermissions($itemType, $itemSource, $shareType, $shareWith, $permissions) {
-		$l = \OC::$server->getL10N('lib');
-		$connection = \OC::$server->getDatabaseConnection();
-
-		$intArrayToLiteralArray = function($intArray, $eb) {
-			return array_map(function($int) use ($eb) {
-				return $eb->literal((int)$int, 'integer');
-			}, $intArray);
-		};
-		$sanitizeItem = function($item) {
-			$item['id'] = (int)$item['id'];
-			$item['premissions'] = (int)$item['permissions'];
-			return $item;
-		};
-
-		if ($rootItem = self::getItems($itemType, $itemSource, $shareType, $shareWith,
-			\OC_User::getUser(), self::FORMAT_NONE, null, 1, false)) {
-			// Check if this item is a reshare and verify that the permissions
-			// granted don't exceed the parent shared item
-			if (isset($rootItem['parent'])) {
-				$qb = $connection->getQueryBuilder();
-				$qb->select('permissions')
-					->from('share')
-					->where($qb->expr()->eq('id', $qb->createParameter('id')))
-					->setParameter(':id', $rootItem['parent']);
-				$dbresult = $qb->execute();
-
-				$result = $dbresult->fetch();
-				$dbresult->closeCursor();
-				if (~(int)$result['permissions'] & $permissions) {
-					$message = 'Setting permissions for %s failed,'
-						.' because the permissions exceed permissions granted to %s';
-					$message_t = $l->t('Setting permissions for %s failed, because the permissions exceed permissions granted to %s', array($itemSource, \OC_User::getUser()));
-					\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSource, \OC_User::getUser()), \OCP\Util::DEBUG);
-					throw new \Exception($message_t);
-				}
-			}
-			$qb = $connection->getQueryBuilder();
-			$qb->update('share')
-				->set('permissions', $qb->createParameter('permissions'))
-				->where($qb->expr()->eq('id', $qb->createParameter('id')))
-				->setParameter(':id', $rootItem['id'])
-				->setParameter(':permissions', $permissions);
-			$qb->execute();
-			if ($itemType === 'file' || $itemType === 'folder') {
-				\OC_Hook::emit('OCP\Share', 'post_update_permissions', array(
-					'itemType' => $itemType,
-					'itemSource' => $itemSource,
-					'shareType' => $shareType,
-					'shareWith' => $shareWith,
-					'uidOwner' => \OC_User::getUser(),
-					'permissions' => $permissions,
-					'path' => $rootItem['path'],
-					'share' => $rootItem
-				));
-			}
-
-			// Share id's to update with the new permissions
-			$ids = [];
-			$items = [];
-
-			// Check if permissions were removed
-			if ((int)$rootItem['permissions'] & ~$permissions) {
-				// If share permission is removed all reshares must be deleted
-				if (($rootItem['permissions'] & \OCP\Constants::PERMISSION_SHARE) && (~$permissions & \OCP\Constants::PERMISSION_SHARE)) {
-					// delete all shares, keep parent and group children
-					Helper::delete($rootItem['id'], true, null, null, true);
-				}
-
-				// Remove permission from all children
-				$parents = [$rootItem['id']];
-				while (!empty($parents)) {
-					$parents = $intArrayToLiteralArray($parents, $qb->expr());
-					$qb = $connection->getQueryBuilder();
-					$qb->select('id', 'permissions', 'item_type')
-						->from('share')
-						->where($qb->expr()->in('parent', $parents));
-					$result = $qb->execute();
-					// Reset parents array, only go through loop again if
-					// items are found that need permissions removed
-					$parents = [];
-					while ($item = $result->fetch()) {
-						$item = $sanitizeItem($item);
-
-						$items[] = $item;
-						// Check if permissions need to be removed
-						if ($item['permissions'] & ~$permissions) {
-							// Add to list of items that need permissions removed
-							$ids[] = $item['id'];
-							$parents[] = $item['id'];
-						}
-					}
-					$result->closeCursor();
-				}
-
-				// Remove the permissions for all reshares of this item
-				if (!empty($ids)) {
-					$ids = "'".implode("','", $ids)."'";
-					// TODO this should be done with Doctrine platform objects
-					if (\OC::$server->getConfig()->getSystemValue("dbtype") === 'oci') {
-						$andOp = 'BITAND(`permissions`, ?)';
-					} else {
-						$andOp = '`permissions` & ?';
-					}
-					$query = \OC_DB::prepare('UPDATE `*PREFIX*share` SET `permissions` = '.$andOp
-						.' WHERE `id` IN ('.$ids.')');
-					$query->execute(array($permissions));
-				}
-
-			}
-
-			/*
+        $result = $query->execute(array($status, $itemType, $itemSource, $shareType, $recipient));
+
+        if($result === false) {
+            \OCP\Util::writeLog('OCP\Share', 'Couldn\'t set send mail status', \OCP\Util::ERROR);
+        }
+    }
+
+    /**
+     * Set the permissions of an item for a specific user or group
+     * @param string $itemType
+     * @param string $itemSource
+     * @param int $shareType SHARE_TYPE_USER, SHARE_TYPE_GROUP, or SHARE_TYPE_LINK
+     * @param string $shareWith User or group the item is being shared with
+     * @param int $permissions CRUDS permissions
+     * @return boolean true on success or false on failure
+     * @throws \Exception when trying to grant more permissions then the user has himself
+     */
+    public static function setPermissions($itemType, $itemSource, $shareType, $shareWith, $permissions) {
+        $l = \OC::$server->getL10N('lib');
+        $connection = \OC::$server->getDatabaseConnection();
+
+        $intArrayToLiteralArray = function($intArray, $eb) {
+            return array_map(function($int) use ($eb) {
+                return $eb->literal((int)$int, 'integer');
+            }, $intArray);
+        };
+        $sanitizeItem = function($item) {
+            $item['id'] = (int)$item['id'];
+            $item['premissions'] = (int)$item['permissions'];
+            return $item;
+        };
+
+        if ($rootItem = self::getItems($itemType, $itemSource, $shareType, $shareWith,
+            \OC_User::getUser(), self::FORMAT_NONE, null, 1, false)) {
+            // Check if this item is a reshare and verify that the permissions
+            // granted don't exceed the parent shared item
+            if (isset($rootItem['parent'])) {
+                $qb = $connection->getQueryBuilder();
+                $qb->select('permissions')
+                    ->from('share')
+                    ->where($qb->expr()->eq('id', $qb->createParameter('id')))
+                    ->setParameter(':id', $rootItem['parent']);
+                $dbresult = $qb->execute();
+
+                $result = $dbresult->fetch();
+                $dbresult->closeCursor();
+                if (~(int)$result['permissions'] & $permissions) {
+                    $message = 'Setting permissions for %s failed,'
+                        .' because the permissions exceed permissions granted to %s';
+                    $message_t = $l->t('Setting permissions for %s failed, because the permissions exceed permissions granted to %s', array($itemSource, \OC_User::getUser()));
+                    \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSource, \OC_User::getUser()), \OCP\Util::DEBUG);
+                    throw new \Exception($message_t);
+                }
+            }
+            $qb = $connection->getQueryBuilder();
+            $qb->update('share')
+                ->set('permissions', $qb->createParameter('permissions'))
+                ->where($qb->expr()->eq('id', $qb->createParameter('id')))
+                ->setParameter(':id', $rootItem['id'])
+                ->setParameter(':permissions', $permissions);
+            $qb->execute();
+            if ($itemType === 'file' || $itemType === 'folder') {
+                \OC_Hook::emit('OCP\Share', 'post_update_permissions', array(
+                    'itemType' => $itemType,
+                    'itemSource' => $itemSource,
+                    'shareType' => $shareType,
+                    'shareWith' => $shareWith,
+                    'uidOwner' => \OC_User::getUser(),
+                    'permissions' => $permissions,
+                    'path' => $rootItem['path'],
+                    'share' => $rootItem
+                ));
+            }
+
+            // Share id's to update with the new permissions
+            $ids = [];
+            $items = [];
+
+            // Check if permissions were removed
+            if ((int)$rootItem['permissions'] & ~$permissions) {
+                // If share permission is removed all reshares must be deleted
+                if (($rootItem['permissions'] & \OCP\Constants::PERMISSION_SHARE) && (~$permissions & \OCP\Constants::PERMISSION_SHARE)) {
+                    // delete all shares, keep parent and group children
+                    Helper::delete($rootItem['id'], true, null, null, true);
+                }
+
+                // Remove permission from all children
+                $parents = [$rootItem['id']];
+                while (!empty($parents)) {
+                    $parents = $intArrayToLiteralArray($parents, $qb->expr());
+                    $qb = $connection->getQueryBuilder();
+                    $qb->select('id', 'permissions', 'item_type')
+                        ->from('share')
+                        ->where($qb->expr()->in('parent', $parents));
+                    $result = $qb->execute();
+                    // Reset parents array, only go through loop again if
+                    // items are found that need permissions removed
+                    $parents = [];
+                    while ($item = $result->fetch()) {
+                        $item = $sanitizeItem($item);
+
+                        $items[] = $item;
+                        // Check if permissions need to be removed
+                        if ($item['permissions'] & ~$permissions) {
+                            // Add to list of items that need permissions removed
+                            $ids[] = $item['id'];
+                            $parents[] = $item['id'];
+                        }
+                    }
+                    $result->closeCursor();
+                }
+
+                // Remove the permissions for all reshares of this item
+                if (!empty($ids)) {
+                    $ids = "'".implode("','", $ids)."'";
+                    // TODO this should be done with Doctrine platform objects
+                    if (\OC::$server->getConfig()->getSystemValue("dbtype") === 'oci') {
+                        $andOp = 'BITAND(`permissions`, ?)';
+                    } else {
+                        $andOp = '`permissions` & ?';
+                    }
+                    $query = \OC_DB::prepare('UPDATE `*PREFIX*share` SET `permissions` = '.$andOp
+                        .' WHERE `id` IN ('.$ids.')');
+                    $query->execute(array($permissions));
+                }
+
+            }
+
+            /*
 			 * Permissions were added
 			 * Update all USERGROUP shares. (So group shares where the user moved their mountpoint).
 			 */
-			if ($permissions & ~(int)$rootItem['permissions']) {
-				$qb = $connection->getQueryBuilder();
-				$qb->select('id', 'permissions', 'item_type')
-					->from('share')
-					->where($qb->expr()->eq('parent', $qb->createParameter('parent')))
-					->andWhere($qb->expr()->eq('share_type', $qb->createParameter('share_type')))
-					->andWhere($qb->expr()->neq('permissions', $qb->createParameter('shareDeleted')))
-					->setParameter(':parent', (int)$rootItem['id'])
-					->setParameter(':share_type', 2)
-					->setParameter(':shareDeleted', 0);
-				$result = $qb->execute();
-
-				$ids = [];
-				while ($item = $result->fetch()) {
-					$item = $sanitizeItem($item);
-					$items[] = $item;
-					$ids[] = $item['id'];
-				}
-				$result->closeCursor();
-
-				// Add permssions for all USERGROUP shares of this item
-				if (!empty($ids)) {
-					$ids = $intArrayToLiteralArray($ids, $qb->expr());
-
-					$qb = $connection->getQueryBuilder();
-					$qb->update('share')
-						->set('permissions', $qb->createParameter('permissions'))
-						->where($qb->expr()->in('id', $ids))
-						->setParameter(':permissions', $permissions);
-					$qb->execute();
-				}
-			}
-
-			foreach ($items as $item) {
-				\OC_Hook::emit('OCP\Share', 'post_update_permissions', ['share' => $item]);
-			}
-
-			return true;
-		}
-		$message = 'Setting permissions for %s failed, because the item was not found';
-		$message_t = $l->t('Setting permissions for %s failed, because the item was not found', array($itemSource));
-
-		\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSource), \OCP\Util::DEBUG);
-		throw new \Exception($message_t);
-	}
-
-	/**
-	 * validate expiration date if it meets all constraints
-	 *
-	 * @param string $expireDate well formatted date string, e.g. "DD-MM-YYYY"
-	 * @param string $shareTime timestamp when the file was shared
-	 * @param string $itemType
-	 * @param string $itemSource
-	 * @return \DateTime validated date
-	 * @throws \Exception when the expire date is in the past or further in the future then the enforced date
-	 */
-	private static function validateExpireDate($expireDate, $shareTime, $itemType, $itemSource) {
-		$l = \OC::$server->getL10N('lib');
-		$date = new \DateTime($expireDate);
-		$today = new \DateTime('now');
-
-		// if the user doesn't provide a share time we need to get it from the database
-		// fall-back mode to keep API stable, because the $shareTime parameter was added later
-		$defaultExpireDateEnforced = \OCP\Util::isDefaultExpireDateEnforced();
-		if ($defaultExpireDateEnforced && $shareTime === null) {
-			$items = self::getItemShared($itemType, $itemSource);
-			$firstItem = reset($items);
-			$shareTime = (int)$firstItem['stime'];
-		}
-
-		if ($defaultExpireDateEnforced) {
-			// initialize max date with share time
-			$maxDate = new \DateTime();
-			$maxDate->setTimestamp($shareTime);
-			$maxDays = \OCP\Config::getAppValue('core', 'shareapi_expire_after_n_days', '7');
-			$maxDate->add(new \DateInterval('P' . $maxDays . 'D'));
-			if ($date > $maxDate) {
-				$warning = 'Cannot set expiration date. Shares cannot expire later than ' . $maxDays . ' after they have been shared';
-				$warning_t = $l->t('Cannot set expiration date. Shares cannot expire later than %s after they have been shared', array($maxDays));
-				\OCP\Util::writeLog('OCP\Share', $warning, \OCP\Util::WARN);
-				throw new \Exception($warning_t);
-			}
-		}
-
-		if ($date < $today) {
-			$message = 'Cannot set expiration date. Expiration date is in the past';
-			$message_t = $l->t('Cannot set expiration date. Expiration date is in the past');
-			\OCP\Util::writeLog('OCP\Share', $message, \OCP\Util::WARN);
-			throw new \Exception($message_t);
-		}
-
-		return $date;
-	}
-
-	/**
-	 * Set expiration date for a share
-	 * @param string $itemType
-	 * @param string $itemSource
-	 * @param string $date expiration date
-	 * @param int $shareTime timestamp from when the file was shared
-	 * @return boolean
-	 * @throws \Exception when the expire date is not set, in the past or further in the future then the enforced date
-	 */
-	public static function setExpirationDate($itemType, $itemSource, $date, $shareTime = null) {
-		$user = \OC_User::getUser();
-		$l = \OC::$server->getL10N('lib');
-
-		if ($date == '') {
-			if (\OCP\Util::isDefaultExpireDateEnforced()) {
-				$warning = 'Cannot clear expiration date. Shares are required to have an expiration date.';
-				$warning_t = $l->t('Cannot clear expiration date. Shares are required to have an expiration date.');
-				\OCP\Util::writeLog('OCP\Share', $warning, \OCP\Util::WARN);
-				throw new \Exception($warning_t);
-			} else {
-				$date = null;
-			}
-		} else {
-			$date = self::validateExpireDate($date, $shareTime, $itemType, $itemSource);
-		}
-		$query = \OC_DB::prepare('UPDATE `*PREFIX*share` SET `expiration` = ? WHERE `item_type` = ? AND `item_source` = ?  AND `uid_owner` = ? AND `share_type` = ?');
-		$query->bindValue(1, $date, 'datetime');
-		$query->bindValue(2, $itemType);
-		$query->bindValue(3, $itemSource);
-		$query->bindValue(4, $user);
-		$query->bindValue(5, \OCP\Share::SHARE_TYPE_LINK);
-
-		$query->execute();
-
-		\OC_Hook::emit('OCP\Share', 'post_set_expiration_date', array(
-			'itemType' => $itemType,
-			'itemSource' => $itemSource,
-			'date' => $date,
-			'uidOwner' => $user
-		));
-
-		return true;
-	}
-
-	/**
-	 * Retrieve the owner of a connection
-	 *
-	 * @param IDBConnection $connection
-	 * @param int $shareId
-	 * @throws \Exception
-	 * @return string uid of share owner
-	 */
-	private static function getShareOwner(IDBConnection $connection, $shareId) {
-		$qb = $connection->getQueryBuilder();
-
-		$qb->select('uid_owner')
-			->from('share')
-			->where($qb->expr()->eq('id', $qb->createParameter('shareId')))
-			->setParameter(':shareId', $shareId);
-		$result = $qb->execute();
-		$result = $result->fetch();
-
-		if (empty($result)) {
-			throw new \Exception('Share not found');
-		}
-
-		return $result['uid_owner'];
-	}
-
-	/**
-	 * Set password for a public link share
-	 *
-	 * @param IUserSession $userSession
-	 * @param IDBConnection $connection
-	 * @param IConfig $config
-	 * @param int $shareId
-	 * @param string $password
-	 * @throws \Exception
-	 * @return boolean
-	 */
-	public static function setPassword(IUserSession $userSession,
-	                                   IDBConnection $connection,
-	                                   IConfig $config,
-	                                   $shareId, $password) {
-		$user = $userSession->getUser();
-		if (is_null($user)) {
-			throw new \Exception("User not logged in");
-		}
-
-		$uid = self::getShareOwner($connection, $shareId);
-
-		if ($uid !== $user->getUID()) {
-			throw new \Exception('Cannot update share of a different user');
-		}
-
-		if ($password === '') {
-			$password = null;
-		}
-
-		//If passwords are enforced the password can't be null
-		if (self::enforcePassword($config) && is_null($password)) {
-			throw new \Exception('Cannot remove password');
-		}
-
-		self::verifyPassword($password);
-
-		$qb = $connection->getQueryBuilder();
-		$qb->update('share')
-			->set('share_with', $qb->createParameter('pass'))
-			->where($qb->expr()->eq('id', $qb->createParameter('shareId')))
-			->setParameter(':pass', is_null($password) ? null : \OC::$server->getHasher()->hash($password))
-			->setParameter(':shareId', $shareId);
-
-		$qb->execute();
-
-		return true;
-	}
-
-	/**
-	 * Checks whether a share has expired, calls unshareItem() if yes.
-	 * @param array $item Share data (usually database row)
-	 * @return boolean True if item was expired, false otherwise.
-	 */
-	protected static function expireItem(array $item) {
-
-		$result = false;
-
-		// only use default expiration date for link shares
-		if ((int) $item['share_type'] === self::SHARE_TYPE_LINK) {
-
-			// calculate expiration date
-			if (!empty($item['expiration'])) {
-				$userDefinedExpire = new \DateTime($item['expiration']);
-				$expires = $userDefinedExpire->getTimestamp();
-			} else {
-				$expires = null;
-			}
-
-
-			// get default expiration settings
-			$defaultSettings = Helper::getDefaultExpireSetting();
-			$expires = Helper::calculateExpireDate($defaultSettings, $item['stime'], $expires);
-
-
-			if (is_int($expires)) {
-				$now = time();
-				if ($now > $expires) {
-					self::unshareItem($item);
-					$result = true;
-				}
-			}
-		}
-		return $result;
-	}
-
-	/**
-	 * Unshares a share given a share data array
-	 * @param array $item Share data (usually database row)
-	 * @param int $newParent parent ID
-	 * @return null
-	 */
-	protected static function unshareItem(array $item, $newParent = null) {
-
-		$shareType = (int)$item['share_type'];
-		$shareWith = null;
-		if ($shareType !== \OCP\Share::SHARE_TYPE_LINK) {
-			$shareWith = $item['share_with'];
-		}
-
-		// Pass all the vars we have for now, they may be useful
-		$hookParams = array(
-			'id'            => $item['id'],
-			'itemType'      => $item['item_type'],
-			'itemSource'    => $item['item_source'],
-			'shareType'     => $shareType,
-			'shareWith'     => $shareWith,
-			'itemParent'    => $item['parent'],
-			'uidOwner'      => $item['uid_owner'],
-		);
-		if($item['item_type'] === 'file' || $item['item_type'] === 'folder') {
-			$hookParams['fileSource'] = $item['file_source'];
-			$hookParams['fileTarget'] = $item['file_target'];
-		}
-
-		\OC_Hook::emit('OCP\Share', 'pre_unshare', $hookParams);
-		$deletedShares = Helper::delete($item['id'], false, null, $newParent);
-		$deletedShares[] = $hookParams;
-		$hookParams['deletedShares'] = $deletedShares;
-		\OC_Hook::emit('OCP\Share', 'post_unshare', $hookParams);
-		if ((int)$item['share_type'] === \OCP\Share::SHARE_TYPE_REMOTE && \OC::$server->getUserSession()->getUser()) {
-			list(, $remote) = Helper::splitUserRemote($item['share_with']);
-			self::sendRemoteUnshare($remote, $item['id'], $item['token']);
-		}
-	}
-
-	/**
-	 * Get the backend class for the specified item type
-	 * @param string $itemType
-	 * @throws \Exception
-	 * @return \OCP\Share_Backend
-	 */
-	public static function getBackend($itemType) {
-		$l = \OC::$server->getL10N('lib');
-		if (isset(self::$backends[$itemType])) {
-			return self::$backends[$itemType];
-		} else if (isset(self::$backendTypes[$itemType]['class'])) {
-			$class = self::$backendTypes[$itemType]['class'];
-			if (class_exists($class)) {
-				self::$backends[$itemType] = new $class;
-				if (!(self::$backends[$itemType] instanceof \OCP\Share_Backend)) {
-					$message = 'Sharing backend %s must implement the interface OCP\Share_Backend';
-					$message_t = $l->t('Sharing backend %s must implement the interface OCP\Share_Backend', array($class));
-					\OCP\Util::writeLog('OCP\Share', sprintf($message, $class), \OCP\Util::ERROR);
-					throw new \Exception($message_t);
-				}
-				return self::$backends[$itemType];
-			} else {
-				$message = 'Sharing backend %s not found';
-				$message_t = $l->t('Sharing backend %s not found', array($class));
-				\OCP\Util::writeLog('OCP\Share', sprintf($message, $class), \OCP\Util::ERROR);
-				throw new \Exception($message_t);
-			}
-		}
-		$message = 'Sharing backend for %s not found';
-		$message_t = $l->t('Sharing backend for %s not found', array($itemType));
-		\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemType), \OCP\Util::ERROR);
-		throw new \Exception($message_t);
-	}
-
-	/**
-	 * Check if resharing is allowed
-	 * @return boolean true if allowed or false
-	 *
-	 * Resharing is allowed by default if not configured
-	 */
-	public static function isResharingAllowed() {
-		if (!isset(self::$isResharingAllowed)) {
-			if (\OC::$server->getAppConfig()->getValue('core', 'shareapi_allow_resharing', 'yes') == 'yes') {
-				self::$isResharingAllowed = true;
-			} else {
-				self::$isResharingAllowed = false;
-			}
-		}
-		return self::$isResharingAllowed;
-	}
-
-	/**
-	 * Get a list of collection item types for the specified item type
-	 * @param string $itemType
-	 * @return array
-	 */
-	private static function getCollectionItemTypes($itemType) {
-		$collectionTypes = array($itemType);
-		foreach (self::$backendTypes as $type => $backend) {
-			if (in_array($backend['collectionOf'], $collectionTypes)) {
-				$collectionTypes[] = $type;
-			}
-		}
-		// TODO Add option for collections to be collection of themselves, only 'folder' does it now...
-		if (isset(self::$backendTypes[$itemType]) && (!self::getBackend($itemType) instanceof \OCP\Share_Backend_Collection || $itemType != 'folder')) {
-			unset($collectionTypes[0]);
-		}
-		// Return array if collections were found or the item type is a
-		// collection itself - collections can be inside collections
-		if (count($collectionTypes) > 0) {
-			return $collectionTypes;
-		}
-		return false;
-	}
-
-	/**
-	 * Get the owners of items shared with a user.
-	 *
-	 * @param string $user The user the items are shared with.
-	 * @param string $type The type of the items shared with the user.
-	 * @param boolean $includeCollections Include collection item types (optional)
-	 * @param boolean $includeOwner include owner in the list of users the item is shared with (optional)
-	 * @return array
-	 */
-	public static function getSharedItemsOwners($user, $type, $includeCollections = false, $includeOwner = false) {
-		// First, we find out if $type is part of a collection (and if that collection is part of
-		// another one and so on).
-		$collectionTypes = array();
-		if (!$includeCollections || !$collectionTypes = self::getCollectionItemTypes($type)) {
-			$collectionTypes[] = $type;
-		}
-
-		// Of these collection types, along with our original $type, we make a
-		// list of the ones for which a sharing backend has been registered.
-		// FIXME: Ideally, we wouldn't need to nest getItemsSharedWith in this loop but just call it
-		// with its $includeCollections parameter set to true. Unfortunately, this fails currently.
-		$allMaybeSharedItems = array();
-		foreach ($collectionTypes as $collectionType) {
-			if (isset(self::$backends[$collectionType])) {
-				$allMaybeSharedItems[$collectionType] = self::getItemsSharedWithUser(
-					$collectionType,
-					$user,
-					self::FORMAT_NONE
-				);
-			}
-		}
-
-		$owners = array();
-		if ($includeOwner) {
-			$owners[] = $user;
-		}
-
-		// We take a look at all shared items of the given $type (or of the collections it is part of)
-		// and find out their owners. Then, we gather the tags for the original $type from all owners,
-		// and return them as elements of a list that look like "Tag (owner)".
-		foreach ($allMaybeSharedItems as $collectionType => $maybeSharedItems) {
-			foreach ($maybeSharedItems as $sharedItem) {
-				if (isset($sharedItem['id'])) { //workaround for https://github.com/owncloud/core/issues/2814
-					$owners[] = $sharedItem['uid_owner'];
-				}
-			}
-		}
-
-		return $owners;
-	}
-
-	/**
-	 * Get shared items from the database
-	 * @param string $itemType
-	 * @param string $item Item source or target (optional)
-	 * @param int $shareType SHARE_TYPE_USER, SHARE_TYPE_GROUP, SHARE_TYPE_LINK, $shareTypeUserAndGroups, or $shareTypeGroupUserUnique
-	 * @param string $shareWith User or group the item is being shared with
-	 * @param string $uidOwner User that is the owner of shared items (optional)
-	 * @param int $format Format to convert items to with formatItems() (optional)
-	 * @param mixed $parameters to pass to formatItems() (optional)
-	 * @param int $limit Number of items to return, -1 to return all matches (optional)
-	 * @param boolean $includeCollections Include collection item types (optional)
-	 * @param boolean $itemShareWithBySource (optional)
-	 * @param boolean $checkExpireDate
-	 * @return array
-	 *
-	 * See public functions getItem(s)... for parameter usage
-	 *
-	 */
-	public static function getItems($itemType, $item = null, $shareType = null, $shareWith = null,
-									$uidOwner = null, $format = self::FORMAT_NONE, $parameters = null, $limit = -1,
-									$includeCollections = false, $itemShareWithBySource = false, $checkExpireDate  = true) {
-		if (!self::isEnabled()) {
-			return array();
-		}
-		$backend = self::getBackend($itemType);
-		$collectionTypes = false;
-		// Get filesystem root to add it to the file target and remove from the
-		// file source, match file_source with the file cache
-		if ($itemType == 'file' || $itemType == 'folder') {
-			if(!is_null($uidOwner)) {
-				$root = \OC\Files\Filesystem::getRoot();
-			} else {
-				$root = '';
-			}
-			$where = 'INNER JOIN `*PREFIX*filecache` ON `file_source` = `*PREFIX*filecache`.`fileid` ';
-			if (!isset($item)) {
-				$where .= ' AND `file_target` IS NOT NULL ';
-			}
-			$where .= 'INNER JOIN `*PREFIX*storages` ON `numeric_id` = `*PREFIX*filecache`.`storage` ';
-			$fileDependent = true;
-			$queryArgs = array();
-		} else {
-			$fileDependent = false;
-			$root = '';
-			$collectionTypes = self::getCollectionItemTypes($itemType);
-			if ($includeCollections && !isset($item) && $collectionTypes) {
-				// If includeCollections is true, find collections of this item type, e.g. a music album contains songs
-				if (!in_array($itemType, $collectionTypes)) {
-					$itemTypes = array_merge(array($itemType), $collectionTypes);
-				} else {
-					$itemTypes = $collectionTypes;
-				}
-				$placeholders = join(',', array_fill(0, count($itemTypes), '?'));
-				$where = ' WHERE `item_type` IN ('.$placeholders.'))';
-				$queryArgs = $itemTypes;
-			} else {
-				$where = ' WHERE `item_type` = ?';
-				$queryArgs = array($itemType);
-			}
-		}
-		if (\OC::$server->getAppConfig()->getValue('core', 'shareapi_allow_links', 'yes') !== 'yes') {
-			$where .= ' AND `share_type` != ?';
-			$queryArgs[] = self::SHARE_TYPE_LINK;
-		}
-		if (isset($shareType)) {
-			// Include all user and group items
-			if ($shareType == self::$shareTypeUserAndGroups && isset($shareWith)) {
-				$where .= ' AND ((`share_type` in (?, ?) AND `share_with` = ?) ';
-				$queryArgs[] = self::SHARE_TYPE_USER;
-				$queryArgs[] = self::$shareTypeGroupUserUnique;
-				$queryArgs[] = $shareWith;
-
-				$user = \OC::$server->getUserManager()->get($shareWith);
-				$groups = [];
-				if ($user) {
-					$groups = \OC::$server->getGroupManager()->getUserGroupIds($user);
-				}
-				if (!empty($groups)) {
-					$placeholders = join(',', array_fill(0, count($groups), '?'));
-					$where .= ' OR (`share_type` = ? AND `share_with` IN ('.$placeholders.')) ';
-					$queryArgs[] = self::SHARE_TYPE_GROUP;
-					$queryArgs = array_merge($queryArgs, $groups);
-				}
-				$where .= ')';
-				// Don't include own group shares
-				$where .= ' AND `uid_owner` != ?';
-				$queryArgs[] = $shareWith;
-			} else {
-				$where .= ' AND `share_type` = ?';
-				$queryArgs[] = $shareType;
-				if (isset($shareWith)) {
-					$where .= ' AND `share_with` = ?';
-					$queryArgs[] = $shareWith;
-				}
-			}
-		}
-		if (isset($uidOwner)) {
-			$where .= ' AND `uid_owner` = ?';
-			$queryArgs[] = $uidOwner;
-			if (!isset($shareType)) {
-				// Prevent unique user targets for group shares from being selected
-				$where .= ' AND `share_type` != ?';
-				$queryArgs[] = self::$shareTypeGroupUserUnique;
-			}
-			if ($fileDependent) {
-				$column = 'file_source';
-			} else {
-				$column = 'item_source';
-			}
-		} else {
-			if ($fileDependent) {
-				$column = 'file_target';
-			} else {
-				$column = 'item_target';
-			}
-		}
-		if (isset($item)) {
-			$collectionTypes = self::getCollectionItemTypes($itemType);
-			if ($includeCollections && $collectionTypes && !in_array('folder', $collectionTypes)) {
-				$where .= ' AND (';
-			} else {
-				$where .= ' AND';
-			}
-			// If looking for own shared items, check item_source else check item_target
-			if (isset($uidOwner) || $itemShareWithBySource) {
-				// If item type is a file, file source needs to be checked in case the item was converted
-				if ($fileDependent) {
-					$where .= ' `file_source` = ?';
-					$column = 'file_source';
-				} else {
-					$where .= ' `item_source` = ?';
-					$column = 'item_source';
-				}
-			} else {
-				if ($fileDependent) {
-					$where .= ' `file_target` = ?';
-					$item = \OC\Files\Filesystem::normalizePath($item);
-				} else {
-					$where .= ' `item_target` = ?';
-				}
-			}
-			$queryArgs[] = $item;
-			if ($includeCollections && $collectionTypes && !in_array('folder', $collectionTypes)) {
-				$placeholders = join(',', array_fill(0, count($collectionTypes), '?'));
-				$where .= ' OR `item_type` IN ('.$placeholders.'))';
-				$queryArgs = array_merge($queryArgs, $collectionTypes);
-			}
-		}
-
-		if ($shareType == self::$shareTypeUserAndGroups && $limit === 1) {
-			// Make sure the unique user target is returned if it exists,
-			// unique targets should follow the group share in the database
-			// If the limit is not 1, the filtering can be done later
-			$where .= ' ORDER BY `*PREFIX*share`.`id` DESC';
-		} else {
-			$where .= ' ORDER BY `*PREFIX*share`.`id` ASC';
-		}
-
-		if ($limit != -1 && !$includeCollections) {
-			// The limit must be at least 3, because filtering needs to be done
-			if ($limit < 3) {
-				$queryLimit = 3;
-			} else {
-				$queryLimit = $limit;
-			}
-		} else {
-			$queryLimit = null;
-		}
-		$select = self::createSelectStatement($format, $fileDependent, $uidOwner);
-		$root = strlen($root);
-		$query = \OC_DB::prepare('SELECT '.$select.' FROM `*PREFIX*share` '.$where, $queryLimit);
-		$result = $query->execute($queryArgs);
-		if ($result === false) {
-			\OCP\Util::writeLog('OCP\Share',
-				\OC_DB::getErrorMessage() . ', select=' . $select . ' where=',
-				\OCP\Util::ERROR);
-		}
-		$items = array();
-		$targets = array();
-		$switchedItems = array();
-		$mounts = array();
-		while ($row = $result->fetchRow()) {
-			self::transformDBResults($row);
-			// Filter out duplicate group shares for users with unique targets
-			if ($fileDependent && !self::isFileReachable($row['path'], $row['storage_id'])) {
-				continue;
-			}
-			if ($row['share_type'] == self::$shareTypeGroupUserUnique && isset($items[$row['parent']])) {
-				$row['share_type'] = self::SHARE_TYPE_GROUP;
-				$row['unique_name'] = true; // remember that we use a unique name for this user
-				$row['share_with'] = $items[$row['parent']]['share_with'];
-				// if the group share was unshared from the user we keep the permission, otherwise
-				// we take the permission from the parent because this is always the up-to-date
-				// permission for the group share
-				if ($row['permissions'] > 0) {
-					$row['permissions'] = $items[$row['parent']]['permissions'];
-				}
-				// Remove the parent group share
-				unset($items[$row['parent']]);
-				if ($row['permissions'] == 0) {
-					continue;
-				}
-			} else if (!isset($uidOwner)) {
-				// Check if the same target already exists
-				if (isset($targets[$row['id']])) {
-					// Check if the same owner shared with the user twice
-					// through a group and user share - this is allowed
-					$id = $targets[$row['id']];
-					if (isset($items[$id]) && $items[$id]['uid_owner'] == $row['uid_owner']) {
-						// Switch to group share type to ensure resharing conditions aren't bypassed
-						if ($items[$id]['share_type'] != self::SHARE_TYPE_GROUP) {
-							$items[$id]['share_type'] = self::SHARE_TYPE_GROUP;
-							$items[$id]['share_with'] = $row['share_with'];
-						}
-						// Switch ids if sharing permission is granted on only
-						// one share to ensure correct parent is used if resharing
-						if (~(int)$items[$id]['permissions'] & \OCP\Constants::PERMISSION_SHARE
-							&& (int)$row['permissions'] & \OCP\Constants::PERMISSION_SHARE) {
-							$items[$row['id']] = $items[$id];
-							$switchedItems[$id] = $row['id'];
-							unset($items[$id]);
-							$id = $row['id'];
-						}
-						$items[$id]['permissions'] |= (int)$row['permissions'];
-
-					}
-					continue;
-				} elseif (!empty($row['parent'])) {
-					$targets[$row['parent']] = $row['id'];
-				}
-			}
-			// Remove root from file source paths if retrieving own shared items
-			if (isset($uidOwner) && isset($row['path'])) {
-				if (isset($row['parent'])) {
-					$query = \OC_DB::prepare('SELECT `file_target` FROM `*PREFIX*share` WHERE `id` = ?');
-					$parentResult = $query->execute(array($row['parent']));
-					if ($result === false) {
-						\OCP\Util::writeLog('OCP\Share', 'Can\'t select parent: ' .
-							\OC_DB::getErrorMessage() . ', select=' . $select . ' where=' . $where,
-							\OCP\Util::ERROR);
-					} else {
-						$parentRow = $parentResult->fetchRow();
-						$tmpPath = $parentRow['file_target'];
-						// find the right position where the row path continues from the target path
-						$pos = strrpos($row['path'], $parentRow['file_target']);
-						$subPath = substr($row['path'], $pos);
-						$splitPath = explode('/', $subPath);
-						foreach (array_slice($splitPath, 2) as $pathPart) {
-							$tmpPath = $tmpPath . '/' . $pathPart;
-						}
-						$row['path'] = $tmpPath;
-					}
-				} else {
-					if (!isset($mounts[$row['storage']])) {
-						$mountPoints = \OC\Files\Filesystem::getMountByNumericId($row['storage']);
-						if (is_array($mountPoints) && !empty($mountPoints)) {
-							$mounts[$row['storage']] = current($mountPoints);
-						}
-					}
-					if (!empty($mounts[$row['storage']])) {
-						$path = $mounts[$row['storage']]->getMountPoint().$row['path'];
-						$relPath = substr($path, $root); // path relative to data/user
-						$row['path'] = rtrim($relPath, '/');
-					}
-				}
-			}
-
-			if($checkExpireDate) {
-				if (self::expireItem($row)) {
-					continue;
-				}
-			}
-			// Check if resharing is allowed, if not remove share permission
-			if (isset($row['permissions']) && (!self::isResharingAllowed() | \OCP\Util::isSharingDisabledForUser())) {
-				$row['permissions'] &= ~\OCP\Constants::PERMISSION_SHARE;
-			}
-			// Add display names to result
-			$row['share_with_displayname'] = $row['share_with'];
-			if ( isset($row['share_with']) && $row['share_with'] != '' &&
-				$row['share_type'] === self::SHARE_TYPE_USER) {
-				$row['share_with_displayname'] = \OCP\User::getDisplayName($row['share_with']);
-			} else if(isset($row['share_with']) && $row['share_with'] != '' &&
-				$row['share_type'] === self::SHARE_TYPE_REMOTE) {
-				$addressBookEntries = \OC::$server->getContactsManager()->search($row['share_with'], ['CLOUD']);
-				foreach ($addressBookEntries as $entry) {
-					foreach ($entry['CLOUD'] as $cloudID) {
-						if ($cloudID === $row['share_with']) {
-							$row['share_with_displayname'] = $entry['FN'];
-						}
-					}
-				}
-			}
-			if ( isset($row['uid_owner']) && $row['uid_owner'] != '') {
-				$row['displayname_owner'] = \OCP\User::getDisplayName($row['uid_owner']);
-			}
-
-			if ($row['permissions'] > 0) {
-				$items[$row['id']] = $row;
-			}
-
-		}
-
-		// group items if we are looking for items shared with the current user
-		if (isset($shareWith) && $shareWith === \OCP\User::getUser()) {
-			$items = self::groupItems($items, $itemType);
-		}
-
-		if (!empty($items)) {
-			$collectionItems = array();
-			foreach ($items as &$row) {
-				// Return only the item instead of a 2-dimensional array
-				if ($limit == 1 && $row[$column] == $item && ($row['item_type'] == $itemType || $itemType == 'file')) {
-					if ($format == self::FORMAT_NONE) {
-						return $row;
-					} else {
-						break;
-					}
-				}
-				// Check if this is a collection of the requested item type
-				if ($includeCollections && $collectionTypes && $row['item_type'] !== 'folder' && in_array($row['item_type'], $collectionTypes)) {
-					if (($collectionBackend = self::getBackend($row['item_type']))
-						&& $collectionBackend instanceof \OCP\Share_Backend_Collection) {
-						// Collections can be inside collections, check if the item is a collection
-						if (isset($item) && $row['item_type'] == $itemType && $row[$column] == $item) {
-							$collectionItems[] = $row;
-						} else {
-							$collection = array();
-							$collection['item_type'] = $row['item_type'];
-							if ($row['item_type'] == 'file' || $row['item_type'] == 'folder') {
-								$collection['path'] = basename($row['path']);
-							}
-							$row['collection'] = $collection;
-							// Fetch all of the children sources
-							$children = $collectionBackend->getChildren($row[$column]);
-							foreach ($children as $child) {
-								$childItem = $row;
-								$childItem['item_type'] = $itemType;
-								if ($row['item_type'] != 'file' && $row['item_type'] != 'folder') {
-									$childItem['item_source'] = $child['source'];
-									$childItem['item_target'] = $child['target'];
-								}
-								if ($backend instanceof \OCP\Share_Backend_File_Dependent) {
-									if ($row['item_type'] == 'file' || $row['item_type'] == 'folder') {
-										$childItem['file_source'] = $child['source'];
-									} else { // TODO is this really needed if we already know that we use the file backend?
-										$meta = \OC\Files\Filesystem::getFileInfo($child['file_path']);
-										$childItem['file_source'] = $meta['fileid'];
-									}
-									$childItem['file_target'] =
-										\OC\Files\Filesystem::normalizePath($child['file_path']);
-								}
-								if (isset($item)) {
-									if ($childItem[$column] == $item) {
-										// Return only the item instead of a 2-dimensional array
-										if ($limit == 1) {
-											if ($format == self::FORMAT_NONE) {
-												return $childItem;
-											} else {
-												// Unset the items array and break out of both loops
-												$items = array();
-												$items[] = $childItem;
-												break 2;
-											}
-										} else {
-											$collectionItems[] = $childItem;
-										}
-									}
-								} else {
-									$collectionItems[] = $childItem;
-								}
-							}
-						}
-					}
-					// Remove collection item
-					$toRemove = $row['id'];
-					if (array_key_exists($toRemove, $switchedItems)) {
-						$toRemove = $switchedItems[$toRemove];
-					}
-					unset($items[$toRemove]);
-				} elseif ($includeCollections && $collectionTypes && in_array($row['item_type'], $collectionTypes)) {
-					// FIXME: Thats a dirty hack to improve file sharing performance,
-					// see github issue #10588 for more details
-					// Need to find a solution which works for all back-ends
-					$collectionBackend = self::getBackend($row['item_type']);
-					$sharedParents = $collectionBackend->getParents($row['item_source']);
-					foreach ($sharedParents as $parent) {
-						$collectionItems[] = $parent;
-					}
-				}
-			}
-			if (!empty($collectionItems)) {
-				$collectionItems = array_unique($collectionItems, SORT_REGULAR);
-				$items = array_merge($items, $collectionItems);
-			}
-
-			// filter out invalid items, these can appear when subshare entries exist
-			// for a group in which the requested user isn't a member any more
-			$items = array_filter($items, function($item) {
-				return $item['share_type'] !== self::$shareTypeGroupUserUnique;
-			});
-
-			return self::formatResult($items, $column, $backend, $format, $parameters);
-		} elseif ($includeCollections && $collectionTypes && in_array('folder', $collectionTypes)) {
-			// FIXME: Thats a dirty hack to improve file sharing performance,
-			// see github issue #10588 for more details
-			// Need to find a solution which works for all back-ends
-			$collectionItems = array();
-			$collectionBackend = self::getBackend('folder');
-			$sharedParents = $collectionBackend->getParents($item, $shareWith, $uidOwner);
-			foreach ($sharedParents as $parent) {
-				$collectionItems[] = $parent;
-			}
-			if ($limit === 1) {
-				return reset($collectionItems);
-			}
-			return self::formatResult($collectionItems, $column, $backend, $format, $parameters);
-		}
-
-		return array();
-	}
-
-	/**
-	 * group items with link to the same source
-	 *
-	 * @param array $items
-	 * @param string $itemType
-	 * @return array of grouped items
-	 */
-	protected static function groupItems($items, $itemType) {
-
-		$fileSharing = ($itemType === 'file' || $itemType === 'folder') ? true : false;
-
-		$result = array();
-
-		foreach ($items as $item) {
-			$grouped = false;
-			foreach ($result as $key => $r) {
-				// for file/folder shares we need to compare file_source, otherwise we compare item_source
-				// only group shares if they already point to the same target, otherwise the file where shared
-				// before grouping of shares was added. In this case we don't group them toi avoid confusions
-				if (( $fileSharing && $item['file_source'] === $r['file_source'] && $item['file_target'] === $r['file_target']) ||
-					(!$fileSharing && $item['item_source'] === $r['item_source'] && $item['item_target'] === $r['item_target'])) {
-					// add the first item to the list of grouped shares
-					if (!isset($result[$key]['grouped'])) {
-						$result[$key]['grouped'][] = $result[$key];
-					}
-					$result[$key]['permissions'] = (int) $item['permissions'] | (int) $r['permissions'];
-					$result[$key]['grouped'][] = $item;
-					$grouped = true;
-					break;
-				}
-			}
-
-			if (!$grouped) {
-				$result[] = $item;
-			}
-
-		}
-
-		return $result;
-	}
-
-	/**
-	 * Put shared item into the database
-	 * @param string $itemType Item type
-	 * @param string $itemSource Item source
-	 * @param int $shareType SHARE_TYPE_USER, SHARE_TYPE_GROUP, or SHARE_TYPE_LINK
-	 * @param string $shareWith User or group the item is being shared with
-	 * @param string $uidOwner User that is the owner of shared item
-	 * @param int $permissions CRUDS permissions
-	 * @param boolean|array $parentFolder Parent folder target (optional)
-	 * @param string $token (optional)
-	 * @param string $itemSourceName name of the source item (optional)
-	 * @param \DateTime $expirationDate (optional)
-	 * @throws \Exception
-	 * @return mixed id of the new share or false
-	 */
-	private static function put($itemType, $itemSource, $shareType, $shareWith, $uidOwner,
-								$permissions, $parentFolder = null, $token = null, $itemSourceName = null, \DateTime $expirationDate = null) {
-
-		$queriesToExecute = array();
-		$suggestedItemTarget = null;
-		$groupFileTarget = $fileTarget = $suggestedFileTarget = $filePath = '';
-		$groupItemTarget = $itemTarget = $fileSource = $parent = 0;
-
-		$result = self::checkReshare($itemType, $itemSource, $shareType, $shareWith, $uidOwner, $permissions, $itemSourceName, $expirationDate);
-		if(!empty($result)) {
-			$parent = $result['parent'];
-			$itemSource = $result['itemSource'];
-			$fileSource = $result['fileSource'];
-			$suggestedItemTarget = $result['suggestedItemTarget'];
-			$suggestedFileTarget = $result['suggestedFileTarget'];
-			$filePath = $result['filePath'];
-		}
-
-		$isGroupShare = false;
-		if ($shareType == self::SHARE_TYPE_GROUP) {
-			$isGroupShare = true;
-			if (isset($shareWith['users'])) {
-				$users = $shareWith['users'];
-			} else {
-				$group = \OC::$server->getGroupManager()->get($shareWith['group']);
-				if ($group) {
-					$users = $group->searchUsers('', -1, 0);
-					$userIds = [];
-					foreach ($users as $user) {
-						$userIds[] = $user->getUID();
-					}
-					$users = $userIds;
-				} else {
-					$users = [];
-				}
-			}
-			// remove current user from list
-			if (in_array(\OCP\User::getUser(), $users)) {
-				unset($users[array_search(\OCP\User::getUser(), $users)]);
-			}
-			$groupItemTarget = Helper::generateTarget($itemType, $itemSource,
-				$shareType, $shareWith['group'], $uidOwner, $suggestedItemTarget);
-			$groupFileTarget = Helper::generateTarget($itemType, $itemSource,
-				$shareType, $shareWith['group'], $uidOwner, $filePath);
-
-			// add group share to table and remember the id as parent
-			$queriesToExecute['groupShare'] = array(
-				'itemType'			=> $itemType,
-				'itemSource'		=> $itemSource,
-				'itemTarget'		=> $groupItemTarget,
-				'shareType'			=> $shareType,
-				'shareWith'			=> $shareWith['group'],
-				'uidOwner'			=> $uidOwner,
-				'permissions'		=> $permissions,
-				'shareTime'			=> time(),
-				'fileSource'		=> $fileSource,
-				'fileTarget'		=> $groupFileTarget,
-				'token'				=> $token,
-				'parent'			=> $parent,
-				'expiration'		=> $expirationDate,
-			);
-
-		} else {
-			$users = array($shareWith);
-			$itemTarget = Helper::generateTarget($itemType, $itemSource, $shareType, $shareWith, $uidOwner,
-				$suggestedItemTarget);
-		}
-
-		$run = true;
-		$error = '';
-		$preHookData = array(
-			'itemType' => $itemType,
-			'itemSource' => $itemSource,
-			'shareType' => $shareType,
-			'uidOwner' => $uidOwner,
-			'permissions' => $permissions,
-			'fileSource' => $fileSource,
-			'expiration' => $expirationDate,
-			'token' => $token,
-			'run' => &$run,
-			'error' => &$error
-		);
-
-		$preHookData['itemTarget'] = ($isGroupShare) ? $groupItemTarget : $itemTarget;
-		$preHookData['shareWith'] = ($isGroupShare) ? $shareWith['group'] : $shareWith;
-
-		\OC_Hook::emit('OCP\Share', 'pre_shared', $preHookData);
-
-		if ($run === false) {
-			throw new \Exception($error);
-		}
-
-		foreach ($users as $user) {
-			$sourceId = ($itemType === 'file' || $itemType === 'folder') ? $fileSource : $itemSource;
-			$sourceExists = self::getItemSharedWithBySource($itemType, $sourceId, self::FORMAT_NONE, null, true, $user);
-
-			$userShareType = ($isGroupShare) ? self::$shareTypeGroupUserUnique : $shareType;
-
-			if ($sourceExists && $sourceExists['item_source'] === $itemSource) {
-				$fileTarget = $sourceExists['file_target'];
-				$itemTarget = $sourceExists['item_target'];
-
-				// for group shares we don't need a additional entry if the target is the same
-				if($isGroupShare && $groupItemTarget === $itemTarget) {
-					continue;
-				}
-
-			} elseif(!$sourceExists && !$isGroupShare)  {
-
-				$itemTarget = Helper::generateTarget($itemType, $itemSource, $userShareType, $user,
-					$uidOwner, $suggestedItemTarget, $parent);
-				if (isset($fileSource)) {
-					if ($parentFolder) {
-						if ($parentFolder === true) {
-							$fileTarget = Helper::generateTarget('file', $filePath, $userShareType, $user,
-								$uidOwner, $suggestedFileTarget, $parent);
-							if ($fileTarget != $groupFileTarget) {
-								$parentFolders[$user]['folder'] = $fileTarget;
-							}
-						} else if (isset($parentFolder[$user])) {
-							$fileTarget = $parentFolder[$user]['folder'].$itemSource;
-							$parent = $parentFolder[$user]['id'];
-						}
-					} else {
-						$fileTarget = Helper::generateTarget('file', $filePath, $userShareType,
-							$user, $uidOwner, $suggestedFileTarget, $parent);
-					}
-				} else {
-					$fileTarget = null;
-				}
-
-			} else {
-
-				// group share which doesn't exists until now, check if we need a unique target for this user
-
-				$itemTarget = Helper::generateTarget($itemType, $itemSource, self::SHARE_TYPE_USER, $user,
-					$uidOwner, $suggestedItemTarget, $parent);
-
-				// do we also need a file target
-				if (isset($fileSource)) {
-					$fileTarget = Helper::generateTarget('file', $filePath, self::SHARE_TYPE_USER, $user,
-						$uidOwner, $suggestedFileTarget, $parent);
-				} else {
-					$fileTarget = null;
-				}
-
-				if (($itemTarget === $groupItemTarget) &&
-					(!isset($fileSource) || $fileTarget === $groupFileTarget)) {
-					continue;
-				}
-			}
-
-			$queriesToExecute[] = array(
-				'itemType'			=> $itemType,
-				'itemSource'		=> $itemSource,
-				'itemTarget'		=> $itemTarget,
-				'shareType'			=> $userShareType,
-				'shareWith'			=> $user,
-				'uidOwner'			=> $uidOwner,
-				'permissions'		=> $permissions,
-				'shareTime'			=> time(),
-				'fileSource'		=> $fileSource,
-				'fileTarget'		=> $fileTarget,
-				'token'				=> $token,
-				'parent'			=> $parent,
-				'expiration'		=> $expirationDate,
-			);
-
-		}
-
-		$id = false;
-		if ($isGroupShare) {
-			$id = self::insertShare($queriesToExecute['groupShare']);
-			// Save this id, any extra rows for this group share will need to reference it
-			$parent = \OC::$server->getDatabaseConnection()->lastInsertId('*PREFIX*share');
-			unset($queriesToExecute['groupShare']);
-		}
-
-		foreach ($queriesToExecute as $shareQuery) {
-			$shareQuery['parent'] = $parent;
-			$id = self::insertShare($shareQuery);
-		}
-
-		$postHookData = array(
-			'itemType' => $itemType,
-			'itemSource' => $itemSource,
-			'parent' => $parent,
-			'shareType' => $shareType,
-			'uidOwner' => $uidOwner,
-			'permissions' => $permissions,
-			'fileSource' => $fileSource,
-			'id' => $parent,
-			'token' => $token,
-			'expirationDate' => $expirationDate,
-		);
-
-		$postHookData['shareWith'] = ($isGroupShare) ? $shareWith['group'] : $shareWith;
-		$postHookData['itemTarget'] = ($isGroupShare) ? $groupItemTarget : $itemTarget;
-		$postHookData['fileTarget'] = ($isGroupShare) ? $groupFileTarget : $fileTarget;
-
-		\OC_Hook::emit('OCP\Share', 'post_shared', $postHookData);
-
-
-		return $id ? $id : false;
-	}
-
-	/**
-	 * @param string $itemType
-	 * @param string $itemSource
-	 * @param int $shareType
-	 * @param string $shareWith
-	 * @param string $uidOwner
-	 * @param int $permissions
-	 * @param string|null $itemSourceName
-	 * @param null|\DateTime $expirationDate
-	 */
-	private static function checkReshare($itemType, $itemSource, $shareType, $shareWith, $uidOwner, $permissions, $itemSourceName, $expirationDate) {
-		$backend = self::getBackend($itemType);
-
-		$l = \OC::$server->getL10N('lib');
-		$result = array();
-
-		$column = ($itemType === 'file' || $itemType === 'folder') ? 'file_source' : 'item_source';
-
-		$checkReshare = self::getItemSharedWithBySource($itemType, $itemSource, self::FORMAT_NONE, null, true);
-		if ($checkReshare) {
-			// Check if attempting to share back to owner
-			if ($checkReshare['uid_owner'] == $shareWith && $shareType == self::SHARE_TYPE_USER) {
-				$message = 'Sharing %s failed, because the user %s is the original sharer';
-				$message_t = $l->t('Sharing failed, because the user %s is the original sharer', [$shareWith]);
-
-				\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $shareWith), \OCP\Util::DEBUG);
-				throw new \Exception($message_t);
-			}
-		}
-
-		if ($checkReshare && $checkReshare['uid_owner'] !== \OC_User::getUser()) {
-			// Check if share permissions is granted
-			if (self::isResharingAllowed() && (int)$checkReshare['permissions'] & \OCP\Constants::PERMISSION_SHARE) {
-				if (~(int)$checkReshare['permissions'] & $permissions) {
-					$message = 'Sharing %s failed, because the permissions exceed permissions granted to %s';
-					$message_t = $l->t('Sharing %s failed, because the permissions exceed permissions granted to %s', array($itemSourceName, $uidOwner));
-
-					\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $uidOwner), \OCP\Util::DEBUG);
-					throw new \Exception($message_t);
-				} else {
-					// TODO Don't check if inside folder
-					$result['parent'] = $checkReshare['id'];
-
-					$result['expirationDate'] = $expirationDate;
-					// $checkReshare['expiration'] could be null and then is always less than any value
-					if(isset($checkReshare['expiration']) && $checkReshare['expiration'] < $expirationDate) {
-						$result['expirationDate'] = $checkReshare['expiration'];
-					}
-
-					// only suggest the same name as new target if it is a reshare of the
-					// same file/folder and not the reshare of a child
-					if ($checkReshare[$column] === $itemSource) {
-						$result['filePath'] = $checkReshare['file_target'];
-						$result['itemSource'] = $checkReshare['item_source'];
-						$result['fileSource'] = $checkReshare['file_source'];
-						$result['suggestedItemTarget'] = $checkReshare['item_target'];
-						$result['suggestedFileTarget'] = $checkReshare['file_target'];
-					} else {
-						$result['filePath'] = ($backend instanceof \OCP\Share_Backend_File_Dependent) ? $backend->getFilePath($itemSource, $uidOwner) : null;
-						$result['suggestedItemTarget'] = null;
-						$result['suggestedFileTarget'] = null;
-						$result['itemSource'] = $itemSource;
-						$result['fileSource'] = ($backend instanceof \OCP\Share_Backend_File_Dependent) ? $itemSource : null;
-					}
-				}
-			} else {
-				$message = 'Sharing %s failed, because resharing is not allowed';
-				$message_t = $l->t('Sharing %s failed, because resharing is not allowed', array($itemSourceName));
-
-				\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName), \OCP\Util::DEBUG);
-				throw new \Exception($message_t);
-			}
-		} else {
-			$result['parent'] = null;
-			$result['suggestedItemTarget'] = null;
-			$result['suggestedFileTarget'] = null;
-			$result['itemSource'] = $itemSource;
-			$result['expirationDate'] = $expirationDate;
-			if (!$backend->isValidSource($itemSource, $uidOwner)) {
-				$message = 'Sharing %s failed, because the sharing backend for '
-					.'%s could not find its source';
-				$message_t = $l->t('Sharing %s failed, because the sharing backend for %s could not find its source', array($itemSource, $itemType));
-				\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSource, $itemType), \OCP\Util::DEBUG);
-				throw new \Exception($message_t);
-			}
-			if ($backend instanceof \OCP\Share_Backend_File_Dependent) {
-				$result['filePath'] = $backend->getFilePath($itemSource, $uidOwner);
-				if ($itemType == 'file' || $itemType == 'folder') {
-					$result['fileSource'] = $itemSource;
-				} else {
-					$meta = \OC\Files\Filesystem::getFileInfo($result['filePath']);
-					$result['fileSource'] = $meta['fileid'];
-				}
-				if ($result['fileSource'] == -1) {
-					$message = 'Sharing %s failed, because the file could not be found in the file cache';
-					$message_t = $l->t('Sharing %s failed, because the file could not be found in the file cache', array($itemSource));
-
-					\OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSource), \OCP\Util::DEBUG);
-					throw new \Exception($message_t);
-				}
-			} else {
-				$result['filePath'] = null;
-				$result['fileSource'] = null;
-			}
-		}
-
-		return $result;
-	}
-
-	/**
-	 *
-	 * @param array $shareData
-	 * @return mixed false in case of a failure or the id of the new share
-	 */
-	private static function insertShare(array $shareData) {
-
-		$query = \OC_DB::prepare('INSERT INTO `*PREFIX*share` ('
-			.' `item_type`, `item_source`, `item_target`, `share_type`,'
-			.' `share_with`, `uid_owner`, `permissions`, `stime`, `file_source`,'
-			.' `file_target`, `token`, `parent`, `expiration`) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)');
-		$query->bindValue(1, $shareData['itemType']);
-		$query->bindValue(2, $shareData['itemSource']);
-		$query->bindValue(3, $shareData['itemTarget']);
-		$query->bindValue(4, $shareData['shareType']);
-		$query->bindValue(5, $shareData['shareWith']);
-		$query->bindValue(6, $shareData['uidOwner']);
-		$query->bindValue(7, $shareData['permissions']);
-		$query->bindValue(8, $shareData['shareTime']);
-		$query->bindValue(9, $shareData['fileSource']);
-		$query->bindValue(10, $shareData['fileTarget']);
-		$query->bindValue(11, $shareData['token']);
-		$query->bindValue(12, $shareData['parent']);
-		$query->bindValue(13, $shareData['expiration'], 'datetime');
-		$result = $query->execute();
-
-		$id = false;
-		if ($result) {
-			$id =  \OC::$server->getDatabaseConnection()->lastInsertId('*PREFIX*share');
-		}
-
-		return $id;
-
-	}
-
-	/**
-	 * Delete all shares with type SHARE_TYPE_LINK
-	 */
-	public static function removeAllLinkShares() {
-		// Delete any link shares
-		$query = \OC_DB::prepare('SELECT `id` FROM `*PREFIX*share` WHERE `share_type` = ?');
-		$result = $query->execute(array(self::SHARE_TYPE_LINK));
-		while ($item = $result->fetchRow()) {
-			Helper::delete($item['id']);
-		}
-	}
-
-	/**
-	 * In case a password protected link is not yet authenticated this function will return false
-	 *
-	 * @param array $linkItem
-	 * @return boolean
-	 */
-	public static function checkPasswordProtectedShare(array $linkItem) {
-		if (!isset($linkItem['share_with'])) {
-			return true;
-		}
-		if (!isset($linkItem['share_type'])) {
-			return true;
-		}
-		if (!isset($linkItem['id'])) {
-			return true;
-		}
-
-		if ($linkItem['share_type'] != \OCP\Share::SHARE_TYPE_LINK) {
-			return true;
-		}
-
-		if ( \OC::$server->getSession()->exists('public_link_authenticated')
-			&& \OC::$server->getSession()->get('public_link_authenticated') === (string)$linkItem['id'] ) {
-			return true;
-		}
-
-		return false;
-	}
-
-	/**
-	 * construct select statement
-	 * @param int $format
-	 * @param boolean $fileDependent ist it a file/folder share or a generla share
-	 * @param string $uidOwner
-	 * @return string select statement
-	 */
-	private static function createSelectStatement($format, $fileDependent, $uidOwner = null) {
-		$select = '*';
-		if ($format == self::FORMAT_STATUSES) {
-			if ($fileDependent) {
-				$select = '`*PREFIX*share`.`id`, `*PREFIX*share`.`parent`, `share_type`, `path`, `storage`, '
-					. '`share_with`, `uid_owner` , `file_source`, `stime`, `*PREFIX*share`.`permissions`, '
-					. '`*PREFIX*storages`.`id` AS `storage_id`, `*PREFIX*filecache`.`parent` as `file_parent`, '
-					. '`uid_initiator`';
-			} else {
-				$select = '`id`, `parent`, `share_type`, `share_with`, `uid_owner`, `item_source`, `stime`, `*PREFIX*share`.`permissions`';
-			}
-		} else {
-			if (isset($uidOwner)) {
-				if ($fileDependent) {
-					$select = '`*PREFIX*share`.`id`, `item_type`, `item_source`, `*PREFIX*share`.`parent`,'
-						. ' `share_type`, `share_with`, `file_source`, `file_target`, `path`, `*PREFIX*share`.`permissions`, `stime`,'
-						. ' `expiration`, `token`, `storage`, `mail_send`, `uid_owner`, '
-						. '`*PREFIX*storages`.`id` AS `storage_id`, `*PREFIX*filecache`.`parent` as `file_parent`';
-				} else {
-					$select = '`id`, `item_type`, `item_source`, `parent`, `share_type`, `share_with`, `*PREFIX*share`.`permissions`,'
-						. ' `stime`, `file_source`, `expiration`, `token`, `mail_send`, `uid_owner`';
-				}
-			} else {
-				if ($fileDependent) {
-					if ($format == \OCA\Files_Sharing\ShareBackend\File::FORMAT_GET_FOLDER_CONTENTS || $format == \OCA\Files_Sharing\ShareBackend\File::FORMAT_FILE_APP_ROOT) {
-						$select = '`*PREFIX*share`.`id`, `item_type`, `item_source`, `*PREFIX*share`.`parent`, `uid_owner`, '
-							. '`share_type`, `share_with`, `file_source`, `path`, `file_target`, `stime`, '
-							. '`*PREFIX*share`.`permissions`, `expiration`, `storage`, `*PREFIX*filecache`.`parent` as `file_parent`, '
-							. '`name`, `mtime`, `mimetype`, `mimepart`, `size`, `encrypted`, `etag`, `mail_send`';
-					} else {
-						$select = '`*PREFIX*share`.`id`, `item_type`, `item_source`, `item_target`,'
-							. '`*PREFIX*share`.`parent`, `share_type`, `share_with`, `uid_owner`,'
-							. '`file_source`, `path`, `file_target`, `*PREFIX*share`.`permissions`,'
-						    . '`stime`, `expiration`, `token`, `storage`, `mail_send`,'
-							. '`*PREFIX*storages`.`id` AS `storage_id`, `*PREFIX*filecache`.`parent` as `file_parent`';
-					}
-				}
-			}
-		}
-		return $select;
-	}
-
-
-	/**
-	 * transform db results
-	 * @param array $row result
-	 */
-	private static function transformDBResults(&$row) {
-		if (isset($row['id'])) {
-			$row['id'] = (int) $row['id'];
-		}
-		if (isset($row['share_type'])) {
-			$row['share_type'] = (int) $row['share_type'];
-		}
-		if (isset($row['parent'])) {
-			$row['parent'] = (int) $row['parent'];
-		}
-		if (isset($row['file_parent'])) {
-			$row['file_parent'] = (int) $row['file_parent'];
-		}
-		if (isset($row['file_source'])) {
-			$row['file_source'] = (int) $row['file_source'];
-		}
-		if (isset($row['permissions'])) {
-			$row['permissions'] = (int) $row['permissions'];
-		}
-		if (isset($row['storage'])) {
-			$row['storage'] = (int) $row['storage'];
-		}
-		if (isset($row['stime'])) {
-			$row['stime'] = (int) $row['stime'];
-		}
-		if (isset($row['expiration']) && $row['share_type'] !== self::SHARE_TYPE_LINK) {
-			// discard expiration date for non-link shares, which might have been
-			// set by ancient bugs
-			$row['expiration'] = null;
-		}
-	}
-
-	/**
-	 * format result
-	 * @param array $items result
-	 * @param string $column is it a file share or a general share ('file_target' or 'item_target')
-	 * @param \OCP\Share_Backend $backend sharing backend
-	 * @param int $format
-	 * @param array $parameters additional format parameters
-	 * @return array format result
-	 */
-	private static function formatResult($items, $column, $backend, $format = self::FORMAT_NONE , $parameters = null) {
-		if ($format === self::FORMAT_NONE) {
-			return $items;
-		} else if ($format === self::FORMAT_STATUSES) {
-			$statuses = array();
-			foreach ($items as $item) {
-				if ($item['share_type'] === self::SHARE_TYPE_LINK) {
-					if ($item['uid_initiator'] !== \OC::$server->getUserSession()->getUser()->getUID()) {
-						continue;
-					}
-					$statuses[$item[$column]]['link'] = true;
-				} else if (!isset($statuses[$item[$column]])) {
-					$statuses[$item[$column]]['link'] = false;
-				}
-				if (!empty($item['file_target'])) {
-					$statuses[$item[$column]]['path'] = $item['path'];
-				}
-			}
-			return $statuses;
-		} else {
-			return $backend->formatItems($items, $format, $parameters);
-		}
-	}
-
-	/**
-	 * remove protocol from URL
-	 *
-	 * @param string $url
-	 * @return string
-	 */
-	public static function removeProtocolFromUrl($url) {
-		if (strpos($url, 'https://') === 0) {
-			return substr($url, strlen('https://'));
-		} else if (strpos($url, 'http://') === 0) {
-			return substr($url, strlen('http://'));
-		}
-
-		return $url;
-	}
-
-	/**
-	 * try http post first with https and then with http as a fallback
-	 *
-	 * @param string $remoteDomain
-	 * @param string $urlSuffix
-	 * @param array $fields post parameters
-	 * @return array
-	 */
-	private static function tryHttpPostToShareEndpoint($remoteDomain, $urlSuffix, array $fields) {
-		$protocol = 'https://';
-		$result = [
-			'success' => false,
-			'result' => '',
-		];
-		$try = 0;
-		$discoveryManager = new DiscoveryManager(
-			\OC::$server->getMemCacheFactory(),
-			\OC::$server->getHTTPClientService()
-		);
-		while ($result['success'] === false && $try < 2) {
-			$endpoint = $discoveryManager->getShareEndpoint($protocol . $remoteDomain);
-			$result = \OC::$server->getHTTPHelper()->post($protocol . $remoteDomain . $endpoint . $urlSuffix . '?format=' . self::RESPONSE_FORMAT, $fields);
-			$try++;
-			$protocol = 'http://';
-		}
-
-		return $result;
-	}
-
-	/**
-	 * send server-to-server share to remote server
-	 *
-	 * @param string $token
-	 * @param string $shareWith
-	 * @param string $name
-	 * @param int $remote_id
-	 * @param string $owner
-	 * @return bool
-	 */
-	private static function sendRemoteShare($token, $shareWith, $name, $remote_id, $owner) {
-
-		list($user, $remote) = Helper::splitUserRemote($shareWith);
-
-		if ($user && $remote) {
-			$url = $remote;
-
-			$local = \OC::$server->getURLGenerator()->getAbsoluteURL('/');
-
-			$fields = array(
-				'shareWith' => $user,
-				'token' => $token,
-				'name' => $name,
-				'remoteId' => $remote_id,
-				'owner' => $owner,
-				'remote' => $local,
-			);
-
-			$url = self::removeProtocolFromUrl($url);
-			$result = self::tryHttpPostToShareEndpoint($url, '', $fields);
-			$status = json_decode($result['result'], true);
-
-			if ($result['success'] && ($status['ocs']['meta']['statuscode'] === 100 || $status['ocs']['meta']['statuscode'] === 200)) {
-				\OC_Hook::emit('OCP\Share', 'federated_share_added', ['server' => $remote]);
-				return true;
-			}
-
-		}
-
-		return false;
-	}
-
-	/**
-	 * send server-to-server unshare to remote server
-	 *
-	 * @param string $remote url
-	 * @param int $id share id
-	 * @param string $token
-	 * @return bool
-	 */
-	private static function sendRemoteUnshare($remote, $id, $token) {
-		$url = rtrim($remote, '/');
-		$fields = array('token' => $token, 'format' => 'json');
-		$url = self::removeProtocolFromUrl($url);
-		$result = self::tryHttpPostToShareEndpoint($url, '/'.$id.'/unshare', $fields);
-		$status = json_decode($result['result'], true);
-
-		return ($result['success'] && ($status['ocs']['meta']['statuscode'] === 100 || $status['ocs']['meta']['statuscode'] === 200));
-	}
-
-	/**
-	 * check if user can only share with group members
-	 * @return bool
-	 */
-	public static function shareWithGroupMembersOnly() {
-		$value = \OC::$server->getAppConfig()->getValue('core', 'shareapi_only_share_with_group_members', 'no');
-		return ($value === 'yes') ? true : false;
-	}
-
-	/**
-	 * @return bool
-	 */
-	public static function isDefaultExpireDateEnabled() {
-		$defaultExpireDateEnabled = \OCP\Config::getAppValue('core', 'shareapi_default_expire_date', 'no');
-		return ($defaultExpireDateEnabled === "yes") ? true : false;
-	}
-
-	/**
-	 * @return bool
-	 */
-	public static function enforceDefaultExpireDate() {
-		$enforceDefaultExpireDate = \OCP\Config::getAppValue('core', 'shareapi_enforce_expire_date', 'no');
-		return ($enforceDefaultExpireDate === "yes") ? true : false;
-	}
-
-	/**
-	 * @return int
-	 */
-	public static function getExpireInterval() {
-		return (int)\OCP\Config::getAppValue('core', 'shareapi_expire_after_n_days', '7');
-	}
-
-	/**
-	 * Checks whether the given path is reachable for the given owner
-	 *
-	 * @param string $path path relative to files
-	 * @param string $ownerStorageId storage id of the owner
-	 *
-	 * @return boolean true if file is reachable, false otherwise
-	 */
-	private static function isFileReachable($path, $ownerStorageId) {
-		// if outside the home storage, file is always considered reachable
-		if (!(substr($ownerStorageId, 0, 6) === 'home::' ||
-			substr($ownerStorageId, 0, 13) === 'object::user:'
-		)) {
-			return true;
-		}
-
-		// if inside the home storage, the file has to be under "/files/"
-		$path = ltrim($path, '/');
-		if (substr($path, 0, 6) === 'files/') {
-			return true;
-		}
-
-		return false;
-	}
-
-	/**
-	 * @param IConfig $config
-	 * @return bool 
-	 */
-	public static function enforcePassword(IConfig $config) {
-		$enforcePassword = $config->getAppValue('core', 'shareapi_enforce_links_password', 'no');
-		return ($enforcePassword === "yes") ? true : false;
-	}
-
-	/**
-	 * Get all share entries, including non-unique group items
-	 *
-	 * @param string $owner
-	 * @return array
-	 */
-	public static function getAllSharesForOwner($owner) {
-		$query = 'SELECT * FROM `*PREFIX*share` WHERE `uid_owner` = ?';
-		$result = \OC::$server->getDatabaseConnection()->executeQuery($query, [$owner]);
-		return $result->fetchAll();
-	}
-
-	/**
-	 * Get all share entries, including non-unique group items for a file
-	 *
-	 * @param int $id
-	 * @return array
-	 */
-	public static function getAllSharesForFileId($id) {
-		$query = 'SELECT * FROM `*PREFIX*share` WHERE `file_source` = ?';
-		$result = \OC::$server->getDatabaseConnection()->executeQuery($query, [$id]);
-		return $result->fetchAll();
-	}
-
-	/**
-	 * @param string $password
-	 * @throws \Exception
-	 */
-	private static function verifyPassword($password) {
-
-		$accepted = true;
-		$message = '';
-		\OCP\Util::emitHook('\OC\Share', 'verifyPassword', [
-			'password' => $password,
-			'accepted' => &$accepted,
-			'message' => &$message
-		]);
-
-		if (!$accepted) {
-			throw new \Exception($message);
-		}
-	}
+            if ($permissions & ~(int)$rootItem['permissions']) {
+                $qb = $connection->getQueryBuilder();
+                $qb->select('id', 'permissions', 'item_type')
+                    ->from('share')
+                    ->where($qb->expr()->eq('parent', $qb->createParameter('parent')))
+                    ->andWhere($qb->expr()->eq('share_type', $qb->createParameter('share_type')))
+                    ->andWhere($qb->expr()->neq('permissions', $qb->createParameter('shareDeleted')))
+                    ->setParameter(':parent', (int)$rootItem['id'])
+                    ->setParameter(':share_type', 2)
+                    ->setParameter(':shareDeleted', 0);
+                $result = $qb->execute();
+
+                $ids = [];
+                while ($item = $result->fetch()) {
+                    $item = $sanitizeItem($item);
+                    $items[] = $item;
+                    $ids[] = $item['id'];
+                }
+                $result->closeCursor();
+
+                // Add permssions for all USERGROUP shares of this item
+                if (!empty($ids)) {
+                    $ids = $intArrayToLiteralArray($ids, $qb->expr());
+
+                    $qb = $connection->getQueryBuilder();
+                    $qb->update('share')
+                        ->set('permissions', $qb->createParameter('permissions'))
+                        ->where($qb->expr()->in('id', $ids))
+                        ->setParameter(':permissions', $permissions);
+                    $qb->execute();
+                }
+            }
+
+            foreach ($items as $item) {
+                \OC_Hook::emit('OCP\Share', 'post_update_permissions', ['share' => $item]);
+            }
+
+            return true;
+        }
+        $message = 'Setting permissions for %s failed, because the item was not found';
+        $message_t = $l->t('Setting permissions for %s failed, because the item was not found', array($itemSource));
+
+        \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSource), \OCP\Util::DEBUG);
+        throw new \Exception($message_t);
+    }
+
+    /**
+     * validate expiration date if it meets all constraints
+     *
+     * @param string $expireDate well formatted date string, e.g. "DD-MM-YYYY"
+     * @param string $shareTime timestamp when the file was shared
+     * @param string $itemType
+     * @param string $itemSource
+     * @return \DateTime validated date
+     * @throws \Exception when the expire date is in the past or further in the future then the enforced date
+     */
+    private static function validateExpireDate($expireDate, $shareTime, $itemType, $itemSource) {
+        $l = \OC::$server->getL10N('lib');
+        $date = new \DateTime($expireDate);
+        $today = new \DateTime('now');
+
+        // if the user doesn't provide a share time we need to get it from the database
+        // fall-back mode to keep API stable, because the $shareTime parameter was added later
+        $defaultExpireDateEnforced = \OCP\Util::isDefaultExpireDateEnforced();
+        if ($defaultExpireDateEnforced && $shareTime === null) {
+            $items = self::getItemShared($itemType, $itemSource);
+            $firstItem = reset($items);
+            $shareTime = (int)$firstItem['stime'];
+        }
+
+        if ($defaultExpireDateEnforced) {
+            // initialize max date with share time
+            $maxDate = new \DateTime();
+            $maxDate->setTimestamp($shareTime);
+            $maxDays = \OCP\Config::getAppValue('core', 'shareapi_expire_after_n_days', '7');
+            $maxDate->add(new \DateInterval('P' . $maxDays . 'D'));
+            if ($date > $maxDate) {
+                $warning = 'Cannot set expiration date. Shares cannot expire later than ' . $maxDays . ' after they have been shared';
+                $warning_t = $l->t('Cannot set expiration date. Shares cannot expire later than %s after they have been shared', array($maxDays));
+                \OCP\Util::writeLog('OCP\Share', $warning, \OCP\Util::WARN);
+                throw new \Exception($warning_t);
+            }
+        }
+
+        if ($date < $today) {
+            $message = 'Cannot set expiration date. Expiration date is in the past';
+            $message_t = $l->t('Cannot set expiration date. Expiration date is in the past');
+            \OCP\Util::writeLog('OCP\Share', $message, \OCP\Util::WARN);
+            throw new \Exception($message_t);
+        }
+
+        return $date;
+    }
+
+    /**
+     * Set expiration date for a share
+     * @param string $itemType
+     * @param string $itemSource
+     * @param string $date expiration date
+     * @param int $shareTime timestamp from when the file was shared
+     * @return boolean
+     * @throws \Exception when the expire date is not set, in the past or further in the future then the enforced date
+     */
+    public static function setExpirationDate($itemType, $itemSource, $date, $shareTime = null) {
+        $user = \OC_User::getUser();
+        $l = \OC::$server->getL10N('lib');
+
+        if ($date == '') {
+            if (\OCP\Util::isDefaultExpireDateEnforced()) {
+                $warning = 'Cannot clear expiration date. Shares are required to have an expiration date.';
+                $warning_t = $l->t('Cannot clear expiration date. Shares are required to have an expiration date.');
+                \OCP\Util::writeLog('OCP\Share', $warning, \OCP\Util::WARN);
+                throw new \Exception($warning_t);
+            } else {
+                $date = null;
+            }
+        } else {
+            $date = self::validateExpireDate($date, $shareTime, $itemType, $itemSource);
+        }
+        $query = \OC_DB::prepare('UPDATE `*PREFIX*share` SET `expiration` = ? WHERE `item_type` = ? AND `item_source` = ?  AND `uid_owner` = ? AND `share_type` = ?');
+        $query->bindValue(1, $date, 'datetime');
+        $query->bindValue(2, $itemType);
+        $query->bindValue(3, $itemSource);
+        $query->bindValue(4, $user);
+        $query->bindValue(5, \OCP\Share::SHARE_TYPE_LINK);
+
+        $query->execute();
+
+        \OC_Hook::emit('OCP\Share', 'post_set_expiration_date', array(
+            'itemType' => $itemType,
+            'itemSource' => $itemSource,
+            'date' => $date,
+            'uidOwner' => $user
+        ));
+
+        return true;
+    }
+
+    /**
+     * Retrieve the owner of a connection
+     *
+     * @param IDBConnection $connection
+     * @param int $shareId
+     * @throws \Exception
+     * @return string uid of share owner
+     */
+    private static function getShareOwner(IDBConnection $connection, $shareId) {
+        $qb = $connection->getQueryBuilder();
+
+        $qb->select('uid_owner')
+            ->from('share')
+            ->where($qb->expr()->eq('id', $qb->createParameter('shareId')))
+            ->setParameter(':shareId', $shareId);
+        $result = $qb->execute();
+        $result = $result->fetch();
+
+        if (empty($result)) {
+            throw new \Exception('Share not found');
+        }
+
+        return $result['uid_owner'];
+    }
+
+    /**
+     * Set password for a public link share
+     *
+     * @param IUserSession $userSession
+     * @param IDBConnection $connection
+     * @param IConfig $config
+     * @param int $shareId
+     * @param string $password
+     * @throws \Exception
+     * @return boolean
+     */
+    public static function setPassword(IUserSession $userSession,
+                                        IDBConnection $connection,
+                                        IConfig $config,
+                                        $shareId, $password) {
+        $user = $userSession->getUser();
+        if (is_null($user)) {
+            throw new \Exception("User not logged in");
+        }
+
+        $uid = self::getShareOwner($connection, $shareId);
+
+        if ($uid !== $user->getUID()) {
+            throw new \Exception('Cannot update share of a different user');
+        }
+
+        if ($password === '') {
+            $password = null;
+        }
+
+        //If passwords are enforced the password can't be null
+        if (self::enforcePassword($config) && is_null($password)) {
+            throw new \Exception('Cannot remove password');
+        }
+
+        self::verifyPassword($password);
+
+        $qb = $connection->getQueryBuilder();
+        $qb->update('share')
+            ->set('share_with', $qb->createParameter('pass'))
+            ->where($qb->expr()->eq('id', $qb->createParameter('shareId')))
+            ->setParameter(':pass', is_null($password) ? null : \OC::$server->getHasher()->hash($password))
+            ->setParameter(':shareId', $shareId);
+
+        $qb->execute();
+
+        return true;
+    }
+
+    /**
+     * Checks whether a share has expired, calls unshareItem() if yes.
+     * @param array $item Share data (usually database row)
+     * @return boolean True if item was expired, false otherwise.
+     */
+    protected static function expireItem(array $item) {
+
+        $result = false;
+
+        // only use default expiration date for link shares
+        if ((int) $item['share_type'] === self::SHARE_TYPE_LINK) {
+
+            // calculate expiration date
+            if (!empty($item['expiration'])) {
+                $userDefinedExpire = new \DateTime($item['expiration']);
+                $expires = $userDefinedExpire->getTimestamp();
+            } else {
+                $expires = null;
+            }
+
+
+            // get default expiration settings
+            $defaultSettings = Helper::getDefaultExpireSetting();
+            $expires = Helper::calculateExpireDate($defaultSettings, $item['stime'], $expires);
+
+
+            if (is_int($expires)) {
+                $now = time();
+                if ($now > $expires) {
+                    self::unshareItem($item);
+                    $result = true;
+                }
+            }
+        }
+        return $result;
+    }
+
+    /**
+     * Unshares a share given a share data array
+     * @param array $item Share data (usually database row)
+     * @param int $newParent parent ID
+     * @return null
+     */
+    protected static function unshareItem(array $item, $newParent = null) {
+
+        $shareType = (int)$item['share_type'];
+        $shareWith = null;
+        if ($shareType !== \OCP\Share::SHARE_TYPE_LINK) {
+            $shareWith = $item['share_with'];
+        }
+
+        // Pass all the vars we have for now, they may be useful
+        $hookParams = array(
+            'id'            => $item['id'],
+            'itemType'      => $item['item_type'],
+            'itemSource'    => $item['item_source'],
+            'shareType'     => $shareType,
+            'shareWith'     => $shareWith,
+            'itemParent'    => $item['parent'],
+            'uidOwner'      => $item['uid_owner'],
+        );
+        if($item['item_type'] === 'file' || $item['item_type'] === 'folder') {
+            $hookParams['fileSource'] = $item['file_source'];
+            $hookParams['fileTarget'] = $item['file_target'];
+        }
+
+        \OC_Hook::emit('OCP\Share', 'pre_unshare', $hookParams);
+        $deletedShares = Helper::delete($item['id'], false, null, $newParent);
+        $deletedShares[] = $hookParams;
+        $hookParams['deletedShares'] = $deletedShares;
+        \OC_Hook::emit('OCP\Share', 'post_unshare', $hookParams);
+        if ((int)$item['share_type'] === \OCP\Share::SHARE_TYPE_REMOTE && \OC::$server->getUserSession()->getUser()) {
+            list(, $remote) = Helper::splitUserRemote($item['share_with']);
+            self::sendRemoteUnshare($remote, $item['id'], $item['token']);
+        }
+    }
+
+    /**
+     * Get the backend class for the specified item type
+     * @param string $itemType
+     * @throws \Exception
+     * @return \OCP\Share_Backend
+     */
+    public static function getBackend($itemType) {
+        $l = \OC::$server->getL10N('lib');
+        if (isset(self::$backends[$itemType])) {
+            return self::$backends[$itemType];
+        } else if (isset(self::$backendTypes[$itemType]['class'])) {
+            $class = self::$backendTypes[$itemType]['class'];
+            if (class_exists($class)) {
+                self::$backends[$itemType] = new $class;
+                if (!(self::$backends[$itemType] instanceof \OCP\Share_Backend)) {
+                    $message = 'Sharing backend %s must implement the interface OCP\Share_Backend';
+                    $message_t = $l->t('Sharing backend %s must implement the interface OCP\Share_Backend', array($class));
+                    \OCP\Util::writeLog('OCP\Share', sprintf($message, $class), \OCP\Util::ERROR);
+                    throw new \Exception($message_t);
+                }
+                return self::$backends[$itemType];
+            } else {
+                $message = 'Sharing backend %s not found';
+                $message_t = $l->t('Sharing backend %s not found', array($class));
+                \OCP\Util::writeLog('OCP\Share', sprintf($message, $class), \OCP\Util::ERROR);
+                throw new \Exception($message_t);
+            }
+        }
+        $message = 'Sharing backend for %s not found';
+        $message_t = $l->t('Sharing backend for %s not found', array($itemType));
+        \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemType), \OCP\Util::ERROR);
+        throw new \Exception($message_t);
+    }
+
+    /**
+     * Check if resharing is allowed
+     * @return boolean true if allowed or false
+     *
+     * Resharing is allowed by default if not configured
+     */
+    public static function isResharingAllowed() {
+        if (!isset(self::$isResharingAllowed)) {
+            if (\OC::$server->getAppConfig()->getValue('core', 'shareapi_allow_resharing', 'yes') == 'yes') {
+                self::$isResharingAllowed = true;
+            } else {
+                self::$isResharingAllowed = false;
+            }
+        }
+        return self::$isResharingAllowed;
+    }
+
+    /**
+     * Get a list of collection item types for the specified item type
+     * @param string $itemType
+     * @return array
+     */
+    private static function getCollectionItemTypes($itemType) {
+        $collectionTypes = array($itemType);
+        foreach (self::$backendTypes as $type => $backend) {
+            if (in_array($backend['collectionOf'], $collectionTypes)) {
+                $collectionTypes[] = $type;
+            }
+        }
+        // TODO Add option for collections to be collection of themselves, only 'folder' does it now...
+        if (isset(self::$backendTypes[$itemType]) && (!self::getBackend($itemType) instanceof \OCP\Share_Backend_Collection || $itemType != 'folder')) {
+            unset($collectionTypes[0]);
+        }
+        // Return array if collections were found or the item type is a
+        // collection itself - collections can be inside collections
+        if (count($collectionTypes) > 0) {
+            return $collectionTypes;
+        }
+        return false;
+    }
+
+    /**
+     * Get the owners of items shared with a user.
+     *
+     * @param string $user The user the items are shared with.
+     * @param string $type The type of the items shared with the user.
+     * @param boolean $includeCollections Include collection item types (optional)
+     * @param boolean $includeOwner include owner in the list of users the item is shared with (optional)
+     * @return array
+     */
+    public static function getSharedItemsOwners($user, $type, $includeCollections = false, $includeOwner = false) {
+        // First, we find out if $type is part of a collection (and if that collection is part of
+        // another one and so on).
+        $collectionTypes = array();
+        if (!$includeCollections || !$collectionTypes = self::getCollectionItemTypes($type)) {
+            $collectionTypes[] = $type;
+        }
+
+        // Of these collection types, along with our original $type, we make a
+        // list of the ones for which a sharing backend has been registered.
+        // FIXME: Ideally, we wouldn't need to nest getItemsSharedWith in this loop but just call it
+        // with its $includeCollections parameter set to true. Unfortunately, this fails currently.
+        $allMaybeSharedItems = array();
+        foreach ($collectionTypes as $collectionType) {
+            if (isset(self::$backends[$collectionType])) {
+                $allMaybeSharedItems[$collectionType] = self::getItemsSharedWithUser(
+                    $collectionType,
+                    $user,
+                    self::FORMAT_NONE
+                );
+            }
+        }
+
+        $owners = array();
+        if ($includeOwner) {
+            $owners[] = $user;
+        }
+
+        // We take a look at all shared items of the given $type (or of the collections it is part of)
+        // and find out their owners. Then, we gather the tags for the original $type from all owners,
+        // and return them as elements of a list that look like "Tag (owner)".
+        foreach ($allMaybeSharedItems as $collectionType => $maybeSharedItems) {
+            foreach ($maybeSharedItems as $sharedItem) {
+                if (isset($sharedItem['id'])) { //workaround for https://github.com/owncloud/core/issues/2814
+                    $owners[] = $sharedItem['uid_owner'];
+                }
+            }
+        }
+
+        return $owners;
+    }
+
+    /**
+     * Get shared items from the database
+     * @param string $itemType
+     * @param string $item Item source or target (optional)
+     * @param int $shareType SHARE_TYPE_USER, SHARE_TYPE_GROUP, SHARE_TYPE_LINK, $shareTypeUserAndGroups, or $shareTypeGroupUserUnique
+     * @param string $shareWith User or group the item is being shared with
+     * @param string $uidOwner User that is the owner of shared items (optional)
+     * @param int $format Format to convert items to with formatItems() (optional)
+     * @param mixed $parameters to pass to formatItems() (optional)
+     * @param int $limit Number of items to return, -1 to return all matches (optional)
+     * @param boolean $includeCollections Include collection item types (optional)
+     * @param boolean $itemShareWithBySource (optional)
+     * @param boolean $checkExpireDate
+     * @return array
+     *
+     * See public functions getItem(s)... for parameter usage
+     *
+     */
+    public static function getItems($itemType, $item = null, $shareType = null, $shareWith = null,
+                                    $uidOwner = null, $format = self::FORMAT_NONE, $parameters = null, $limit = -1,
+                                    $includeCollections = false, $itemShareWithBySource = false, $checkExpireDate  = true) {
+        if (!self::isEnabled()) {
+            return array();
+        }
+        $backend = self::getBackend($itemType);
+        $collectionTypes = false;
+        // Get filesystem root to add it to the file target and remove from the
+        // file source, match file_source with the file cache
+        if ($itemType == 'file' || $itemType == 'folder') {
+            if(!is_null($uidOwner)) {
+                $root = \OC\Files\Filesystem::getRoot();
+            } else {
+                $root = '';
+            }
+            $where = 'INNER JOIN `*PREFIX*filecache` ON `file_source` = `*PREFIX*filecache`.`fileid` ';
+            if (!isset($item)) {
+                $where .= ' AND `file_target` IS NOT NULL ';
+            }
+            $where .= 'INNER JOIN `*PREFIX*storages` ON `numeric_id` = `*PREFIX*filecache`.`storage` ';
+            $fileDependent = true;
+            $queryArgs = array();
+        } else {
+            $fileDependent = false;
+            $root = '';
+            $collectionTypes = self::getCollectionItemTypes($itemType);
+            if ($includeCollections && !isset($item) && $collectionTypes) {
+                // If includeCollections is true, find collections of this item type, e.g. a music album contains songs
+                if (!in_array($itemType, $collectionTypes)) {
+                    $itemTypes = array_merge(array($itemType), $collectionTypes);
+                } else {
+                    $itemTypes = $collectionTypes;
+                }
+                $placeholders = join(',', array_fill(0, count($itemTypes), '?'));
+                $where = ' WHERE `item_type` IN ('.$placeholders.'))';
+                $queryArgs = $itemTypes;
+            } else {
+                $where = ' WHERE `item_type` = ?';
+                $queryArgs = array($itemType);
+            }
+        }
+        if (\OC::$server->getAppConfig()->getValue('core', 'shareapi_allow_links', 'yes') !== 'yes') {
+            $where .= ' AND `share_type` != ?';
+            $queryArgs[] = self::SHARE_TYPE_LINK;
+        }
+        if (isset($shareType)) {
+            // Include all user and group items
+            if ($shareType == self::$shareTypeUserAndGroups && isset($shareWith)) {
+                $where .= ' AND ((`share_type` in (?, ?) AND `share_with` = ?) ';
+                $queryArgs[] = self::SHARE_TYPE_USER;
+                $queryArgs[] = self::$shareTypeGroupUserUnique;
+                $queryArgs[] = $shareWith;
+
+                $user = \OC::$server->getUserManager()->get($shareWith);
+                $groups = [];
+                if ($user) {
+                    $groups = \OC::$server->getGroupManager()->getUserGroupIds($user);
+                }
+                if (!empty($groups)) {
+                    $placeholders = join(',', array_fill(0, count($groups), '?'));
+                    $where .= ' OR (`share_type` = ? AND `share_with` IN ('.$placeholders.')) ';
+                    $queryArgs[] = self::SHARE_TYPE_GROUP;
+                    $queryArgs = array_merge($queryArgs, $groups);
+                }
+                $where .= ')';
+                // Don't include own group shares
+                $where .= ' AND `uid_owner` != ?';
+                $queryArgs[] = $shareWith;
+            } else {
+                $where .= ' AND `share_type` = ?';
+                $queryArgs[] = $shareType;
+                if (isset($shareWith)) {
+                    $where .= ' AND `share_with` = ?';
+                    $queryArgs[] = $shareWith;
+                }
+            }
+        }
+        if (isset($uidOwner)) {
+            $where .= ' AND `uid_owner` = ?';
+            $queryArgs[] = $uidOwner;
+            if (!isset($shareType)) {
+                // Prevent unique user targets for group shares from being selected
+                $where .= ' AND `share_type` != ?';
+                $queryArgs[] = self::$shareTypeGroupUserUnique;
+            }
+            if ($fileDependent) {
+                $column = 'file_source';
+            } else {
+                $column = 'item_source';
+            }
+        } else {
+            if ($fileDependent) {
+                $column = 'file_target';
+            } else {
+                $column = 'item_target';
+            }
+        }
+        if (isset($item)) {
+            $collectionTypes = self::getCollectionItemTypes($itemType);
+            if ($includeCollections && $collectionTypes && !in_array('folder', $collectionTypes)) {
+                $where .= ' AND (';
+            } else {
+                $where .= ' AND';
+            }
+            // If looking for own shared items, check item_source else check item_target
+            if (isset($uidOwner) || $itemShareWithBySource) {
+                // If item type is a file, file source needs to be checked in case the item was converted
+                if ($fileDependent) {
+                    $where .= ' `file_source` = ?';
+                    $column = 'file_source';
+                } else {
+                    $where .= ' `item_source` = ?';
+                    $column = 'item_source';
+                }
+            } else {
+                if ($fileDependent) {
+                    $where .= ' `file_target` = ?';
+                    $item = \OC\Files\Filesystem::normalizePath($item);
+                } else {
+                    $where .= ' `item_target` = ?';
+                }
+            }
+            $queryArgs[] = $item;
+            if ($includeCollections && $collectionTypes && !in_array('folder', $collectionTypes)) {
+                $placeholders = join(',', array_fill(0, count($collectionTypes), '?'));
+                $where .= ' OR `item_type` IN ('.$placeholders.'))';
+                $queryArgs = array_merge($queryArgs, $collectionTypes);
+            }
+        }
+
+        if ($shareType == self::$shareTypeUserAndGroups && $limit === 1) {
+            // Make sure the unique user target is returned if it exists,
+            // unique targets should follow the group share in the database
+            // If the limit is not 1, the filtering can be done later
+            $where .= ' ORDER BY `*PREFIX*share`.`id` DESC';
+        } else {
+            $where .= ' ORDER BY `*PREFIX*share`.`id` ASC';
+        }
+
+        if ($limit != -1 && !$includeCollections) {
+            // The limit must be at least 3, because filtering needs to be done
+            if ($limit < 3) {
+                $queryLimit = 3;
+            } else {
+                $queryLimit = $limit;
+            }
+        } else {
+            $queryLimit = null;
+        }
+        $select = self::createSelectStatement($format, $fileDependent, $uidOwner);
+        $root = strlen($root);
+        $query = \OC_DB::prepare('SELECT '.$select.' FROM `*PREFIX*share` '.$where, $queryLimit);
+        $result = $query->execute($queryArgs);
+        if ($result === false) {
+            \OCP\Util::writeLog('OCP\Share',
+                \OC_DB::getErrorMessage() . ', select=' . $select . ' where=',
+                \OCP\Util::ERROR);
+        }
+        $items = array();
+        $targets = array();
+        $switchedItems = array();
+        $mounts = array();
+        while ($row = $result->fetchRow()) {
+            self::transformDBResults($row);
+            // Filter out duplicate group shares for users with unique targets
+            if ($fileDependent && !self::isFileReachable($row['path'], $row['storage_id'])) {
+                continue;
+            }
+            if ($row['share_type'] == self::$shareTypeGroupUserUnique && isset($items[$row['parent']])) {
+                $row['share_type'] = self::SHARE_TYPE_GROUP;
+                $row['unique_name'] = true; // remember that we use a unique name for this user
+                $row['share_with'] = $items[$row['parent']]['share_with'];
+                // if the group share was unshared from the user we keep the permission, otherwise
+                // we take the permission from the parent because this is always the up-to-date
+                // permission for the group share
+                if ($row['permissions'] > 0) {
+                    $row['permissions'] = $items[$row['parent']]['permissions'];
+                }
+                // Remove the parent group share
+                unset($items[$row['parent']]);
+                if ($row['permissions'] == 0) {
+                    continue;
+                }
+            } else if (!isset($uidOwner)) {
+                // Check if the same target already exists
+                if (isset($targets[$row['id']])) {
+                    // Check if the same owner shared with the user twice
+                    // through a group and user share - this is allowed
+                    $id = $targets[$row['id']];
+                    if (isset($items[$id]) && $items[$id]['uid_owner'] == $row['uid_owner']) {
+                        // Switch to group share type to ensure resharing conditions aren't bypassed
+                        if ($items[$id]['share_type'] != self::SHARE_TYPE_GROUP) {
+                            $items[$id]['share_type'] = self::SHARE_TYPE_GROUP;
+                            $items[$id]['share_with'] = $row['share_with'];
+                        }
+                        // Switch ids if sharing permission is granted on only
+                        // one share to ensure correct parent is used if resharing
+                        if (~(int)$items[$id]['permissions'] & \OCP\Constants::PERMISSION_SHARE
+                            && (int)$row['permissions'] & \OCP\Constants::PERMISSION_SHARE) {
+                            $items[$row['id']] = $items[$id];
+                            $switchedItems[$id] = $row['id'];
+                            unset($items[$id]);
+                            $id = $row['id'];
+                        }
+                        $items[$id]['permissions'] |= (int)$row['permissions'];
+
+                    }
+                    continue;
+                } elseif (!empty($row['parent'])) {
+                    $targets[$row['parent']] = $row['id'];
+                }
+            }
+            // Remove root from file source paths if retrieving own shared items
+            if (isset($uidOwner) && isset($row['path'])) {
+                if (isset($row['parent'])) {
+                    $query = \OC_DB::prepare('SELECT `file_target` FROM `*PREFIX*share` WHERE `id` = ?');
+                    $parentResult = $query->execute(array($row['parent']));
+                    if ($result === false) {
+                        \OCP\Util::writeLog('OCP\Share', 'Can\'t select parent: ' .
+                            \OC_DB::getErrorMessage() . ', select=' . $select . ' where=' . $where,
+                            \OCP\Util::ERROR);
+                    } else {
+                        $parentRow = $parentResult->fetchRow();
+                        $tmpPath = $parentRow['file_target'];
+                        // find the right position where the row path continues from the target path
+                        $pos = strrpos($row['path'], $parentRow['file_target']);
+                        $subPath = substr($row['path'], $pos);
+                        $splitPath = explode('/', $subPath);
+                        foreach (array_slice($splitPath, 2) as $pathPart) {
+                            $tmpPath = $tmpPath . '/' . $pathPart;
+                        }
+                        $row['path'] = $tmpPath;
+                    }
+                } else {
+                    if (!isset($mounts[$row['storage']])) {
+                        $mountPoints = \OC\Files\Filesystem::getMountByNumericId($row['storage']);
+                        if (is_array($mountPoints) && !empty($mountPoints)) {
+                            $mounts[$row['storage']] = current($mountPoints);
+                        }
+                    }
+                    if (!empty($mounts[$row['storage']])) {
+                        $path = $mounts[$row['storage']]->getMountPoint().$row['path'];
+                        $relPath = substr($path, $root); // path relative to data/user
+                        $row['path'] = rtrim($relPath, '/');
+                    }
+                }
+            }
+
+            if($checkExpireDate) {
+                if (self::expireItem($row)) {
+                    continue;
+                }
+            }
+            // Check if resharing is allowed, if not remove share permission
+            if (isset($row['permissions']) && (!self::isResharingAllowed() | \OCP\Util::isSharingDisabledForUser())) {
+                $row['permissions'] &= ~\OCP\Constants::PERMISSION_SHARE;
+            }
+            // Add display names to result
+            $row['share_with_displayname'] = $row['share_with'];
+            if ( isset($row['share_with']) && $row['share_with'] != '' &&
+                $row['share_type'] === self::SHARE_TYPE_USER) {
+                $row['share_with_displayname'] = \OCP\User::getDisplayName($row['share_with']);
+            } else if(isset($row['share_with']) && $row['share_with'] != '' &&
+                $row['share_type'] === self::SHARE_TYPE_REMOTE) {
+                $addressBookEntries = \OC::$server->getContactsManager()->search($row['share_with'], ['CLOUD']);
+                foreach ($addressBookEntries as $entry) {
+                    foreach ($entry['CLOUD'] as $cloudID) {
+                        if ($cloudID === $row['share_with']) {
+                            $row['share_with_displayname'] = $entry['FN'];
+                        }
+                    }
+                }
+            }
+            if ( isset($row['uid_owner']) && $row['uid_owner'] != '') {
+                $row['displayname_owner'] = \OCP\User::getDisplayName($row['uid_owner']);
+            }
+
+            if ($row['permissions'] > 0) {
+                $items[$row['id']] = $row;
+            }
+
+        }
+
+        // group items if we are looking for items shared with the current user
+        if (isset($shareWith) && $shareWith === \OCP\User::getUser()) {
+            $items = self::groupItems($items, $itemType);
+        }
+
+        if (!empty($items)) {
+            $collectionItems = array();
+            foreach ($items as &$row) {
+                // Return only the item instead of a 2-dimensional array
+                if ($limit == 1 && $row[$column] == $item && ($row['item_type'] == $itemType || $itemType == 'file')) {
+                    if ($format == self::FORMAT_NONE) {
+                        return $row;
+                    } else {
+                        break;
+                    }
+                }
+                // Check if this is a collection of the requested item type
+                if ($includeCollections && $collectionTypes && $row['item_type'] !== 'folder' && in_array($row['item_type'], $collectionTypes)) {
+                    if (($collectionBackend = self::getBackend($row['item_type']))
+                        && $collectionBackend instanceof \OCP\Share_Backend_Collection) {
+                        // Collections can be inside collections, check if the item is a collection
+                        if (isset($item) && $row['item_type'] == $itemType && $row[$column] == $item) {
+                            $collectionItems[] = $row;
+                        } else {
+                            $collection = array();
+                            $collection['item_type'] = $row['item_type'];
+                            if ($row['item_type'] == 'file' || $row['item_type'] == 'folder') {
+                                $collection['path'] = basename($row['path']);
+                            }
+                            $row['collection'] = $collection;
+                            // Fetch all of the children sources
+                            $children = $collectionBackend->getChildren($row[$column]);
+                            foreach ($children as $child) {
+                                $childItem = $row;
+                                $childItem['item_type'] = $itemType;
+                                if ($row['item_type'] != 'file' && $row['item_type'] != 'folder') {
+                                    $childItem['item_source'] = $child['source'];
+                                    $childItem['item_target'] = $child['target'];
+                                }
+                                if ($backend instanceof \OCP\Share_Backend_File_Dependent) {
+                                    if ($row['item_type'] == 'file' || $row['item_type'] == 'folder') {
+                                        $childItem['file_source'] = $child['source'];
+                                    } else { // TODO is this really needed if we already know that we use the file backend?
+                                        $meta = \OC\Files\Filesystem::getFileInfo($child['file_path']);
+                                        $childItem['file_source'] = $meta['fileid'];
+                                    }
+                                    $childItem['file_target'] =
+                                        \OC\Files\Filesystem::normalizePath($child['file_path']);
+                                }
+                                if (isset($item)) {
+                                    if ($childItem[$column] == $item) {
+                                        // Return only the item instead of a 2-dimensional array
+                                        if ($limit == 1) {
+                                            if ($format == self::FORMAT_NONE) {
+                                                return $childItem;
+                                            } else {
+                                                // Unset the items array and break out of both loops
+                                                $items = array();
+                                                $items[] = $childItem;
+                                                break 2;
+                                            }
+                                        } else {
+                                            $collectionItems[] = $childItem;
+                                        }
+                                    }
+                                } else {
+                                    $collectionItems[] = $childItem;
+                                }
+                            }
+                        }
+                    }
+                    // Remove collection item
+                    $toRemove = $row['id'];
+                    if (array_key_exists($toRemove, $switchedItems)) {
+                        $toRemove = $switchedItems[$toRemove];
+                    }
+                    unset($items[$toRemove]);
+                } elseif ($includeCollections && $collectionTypes && in_array($row['item_type'], $collectionTypes)) {
+                    // FIXME: Thats a dirty hack to improve file sharing performance,
+                    // see github issue #10588 for more details
+                    // Need to find a solution which works for all back-ends
+                    $collectionBackend = self::getBackend($row['item_type']);
+                    $sharedParents = $collectionBackend->getParents($row['item_source']);
+                    foreach ($sharedParents as $parent) {
+                        $collectionItems[] = $parent;
+                    }
+                }
+            }
+            if (!empty($collectionItems)) {
+                $collectionItems = array_unique($collectionItems, SORT_REGULAR);
+                $items = array_merge($items, $collectionItems);
+            }
+
+            // filter out invalid items, these can appear when subshare entries exist
+            // for a group in which the requested user isn't a member any more
+            $items = array_filter($items, function($item) {
+                return $item['share_type'] !== self::$shareTypeGroupUserUnique;
+            });
+
+            return self::formatResult($items, $column, $backend, $format, $parameters);
+        } elseif ($includeCollections && $collectionTypes && in_array('folder', $collectionTypes)) {
+            // FIXME: Thats a dirty hack to improve file sharing performance,
+            // see github issue #10588 for more details
+            // Need to find a solution which works for all back-ends
+            $collectionItems = array();
+            $collectionBackend = self::getBackend('folder');
+            $sharedParents = $collectionBackend->getParents($item, $shareWith, $uidOwner);
+            foreach ($sharedParents as $parent) {
+                $collectionItems[] = $parent;
+            }
+            if ($limit === 1) {
+                return reset($collectionItems);
+            }
+            return self::formatResult($collectionItems, $column, $backend, $format, $parameters);
+        }
+
+        return array();
+    }
+
+    /**
+     * group items with link to the same source
+     *
+     * @param array $items
+     * @param string $itemType
+     * @return array of grouped items
+     */
+    protected static function groupItems($items, $itemType) {
+
+        $fileSharing = ($itemType === 'file' || $itemType === 'folder') ? true : false;
+
+        $result = array();
+
+        foreach ($items as $item) {
+            $grouped = false;
+            foreach ($result as $key => $r) {
+                // for file/folder shares we need to compare file_source, otherwise we compare item_source
+                // only group shares if they already point to the same target, otherwise the file where shared
+                // before grouping of shares was added. In this case we don't group them toi avoid confusions
+                if (( $fileSharing && $item['file_source'] === $r['file_source'] && $item['file_target'] === $r['file_target']) ||
+                    (!$fileSharing && $item['item_source'] === $r['item_source'] && $item['item_target'] === $r['item_target'])) {
+                    // add the first item to the list of grouped shares
+                    if (!isset($result[$key]['grouped'])) {
+                        $result[$key]['grouped'][] = $result[$key];
+                    }
+                    $result[$key]['permissions'] = (int) $item['permissions'] | (int) $r['permissions'];
+                    $result[$key]['grouped'][] = $item;
+                    $grouped = true;
+                    break;
+                }
+            }
+
+            if (!$grouped) {
+                $result[] = $item;
+            }
+
+        }
+
+        return $result;
+    }
+
+    /**
+     * Put shared item into the database
+     * @param string $itemType Item type
+     * @param string $itemSource Item source
+     * @param int $shareType SHARE_TYPE_USER, SHARE_TYPE_GROUP, or SHARE_TYPE_LINK
+     * @param string $shareWith User or group the item is being shared with
+     * @param string $uidOwner User that is the owner of shared item
+     * @param int $permissions CRUDS permissions
+     * @param boolean|array $parentFolder Parent folder target (optional)
+     * @param string $token (optional)
+     * @param string $itemSourceName name of the source item (optional)
+     * @param \DateTime $expirationDate (optional)
+     * @throws \Exception
+     * @return mixed id of the new share or false
+     */
+    private static function put($itemType, $itemSource, $shareType, $shareWith, $uidOwner,
+                                $permissions, $parentFolder = null, $token = null, $itemSourceName = null, \DateTime $expirationDate = null) {
+
+        $queriesToExecute = array();
+        $suggestedItemTarget = null;
+        $groupFileTarget = $fileTarget = $suggestedFileTarget = $filePath = '';
+        $groupItemTarget = $itemTarget = $fileSource = $parent = 0;
+
+        $result = self::checkReshare($itemType, $itemSource, $shareType, $shareWith, $uidOwner, $permissions, $itemSourceName, $expirationDate);
+        if(!empty($result)) {
+            $parent = $result['parent'];
+            $itemSource = $result['itemSource'];
+            $fileSource = $result['fileSource'];
+            $suggestedItemTarget = $result['suggestedItemTarget'];
+            $suggestedFileTarget = $result['suggestedFileTarget'];
+            $filePath = $result['filePath'];
+        }
+
+        $isGroupShare = false;
+        if ($shareType == self::SHARE_TYPE_GROUP) {
+            $isGroupShare = true;
+            if (isset($shareWith['users'])) {
+                $users = $shareWith['users'];
+            } else {
+                $group = \OC::$server->getGroupManager()->get($shareWith['group']);
+                if ($group) {
+                    $users = $group->searchUsers('', -1, 0);
+                    $userIds = [];
+                    foreach ($users as $user) {
+                        $userIds[] = $user->getUID();
+                    }
+                    $users = $userIds;
+                } else {
+                    $users = [];
+                }
+            }
+            // remove current user from list
+            if (in_array(\OCP\User::getUser(), $users)) {
+                unset($users[array_search(\OCP\User::getUser(), $users)]);
+            }
+            $groupItemTarget = Helper::generateTarget($itemType, $itemSource,
+                $shareType, $shareWith['group'], $uidOwner, $suggestedItemTarget);
+            $groupFileTarget = Helper::generateTarget($itemType, $itemSource,
+                $shareType, $shareWith['group'], $uidOwner, $filePath);
+
+            // add group share to table and remember the id as parent
+            $queriesToExecute['groupShare'] = array(
+                'itemType'			=> $itemType,
+                'itemSource'		=> $itemSource,
+                'itemTarget'		=> $groupItemTarget,
+                'shareType'			=> $shareType,
+                'shareWith'			=> $shareWith['group'],
+                'uidOwner'			=> $uidOwner,
+                'permissions'		=> $permissions,
+                'shareTime'			=> time(),
+                'fileSource'		=> $fileSource,
+                'fileTarget'		=> $groupFileTarget,
+                'token'				=> $token,
+                'parent'			=> $parent,
+                'expiration'		=> $expirationDate,
+            );
+
+        } else {
+            $users = array($shareWith);
+            $itemTarget = Helper::generateTarget($itemType, $itemSource, $shareType, $shareWith, $uidOwner,
+                $suggestedItemTarget);
+        }
+
+        $run = true;
+        $error = '';
+        $preHookData = array(
+            'itemType' => $itemType,
+            'itemSource' => $itemSource,
+            'shareType' => $shareType,
+            'uidOwner' => $uidOwner,
+            'permissions' => $permissions,
+            'fileSource' => $fileSource,
+            'expiration' => $expirationDate,
+            'token' => $token,
+            'run' => &$run,
+            'error' => &$error
+        );
+
+        $preHookData['itemTarget'] = ($isGroupShare) ? $groupItemTarget : $itemTarget;
+        $preHookData['shareWith'] = ($isGroupShare) ? $shareWith['group'] : $shareWith;
+
+        \OC_Hook::emit('OCP\Share', 'pre_shared', $preHookData);
+
+        if ($run === false) {
+            throw new \Exception($error);
+        }
+
+        foreach ($users as $user) {
+            $sourceId = ($itemType === 'file' || $itemType === 'folder') ? $fileSource : $itemSource;
+            $sourceExists = self::getItemSharedWithBySource($itemType, $sourceId, self::FORMAT_NONE, null, true, $user);
+
+            $userShareType = ($isGroupShare) ? self::$shareTypeGroupUserUnique : $shareType;
+
+            if ($sourceExists && $sourceExists['item_source'] === $itemSource) {
+                $fileTarget = $sourceExists['file_target'];
+                $itemTarget = $sourceExists['item_target'];
+
+                // for group shares we don't need a additional entry if the target is the same
+                if($isGroupShare && $groupItemTarget === $itemTarget) {
+                    continue;
+                }
+
+            } elseif(!$sourceExists && !$isGroupShare)  {
+
+                $itemTarget = Helper::generateTarget($itemType, $itemSource, $userShareType, $user,
+                    $uidOwner, $suggestedItemTarget, $parent);
+                if (isset($fileSource)) {
+                    if ($parentFolder) {
+                        if ($parentFolder === true) {
+                            $fileTarget = Helper::generateTarget('file', $filePath, $userShareType, $user,
+                                $uidOwner, $suggestedFileTarget, $parent);
+                            if ($fileTarget != $groupFileTarget) {
+                                $parentFolders[$user]['folder'] = $fileTarget;
+                            }
+                        } else if (isset($parentFolder[$user])) {
+                            $fileTarget = $parentFolder[$user]['folder'].$itemSource;
+                            $parent = $parentFolder[$user]['id'];
+                        }
+                    } else {
+                        $fileTarget = Helper::generateTarget('file', $filePath, $userShareType,
+                            $user, $uidOwner, $suggestedFileTarget, $parent);
+                    }
+                } else {
+                    $fileTarget = null;
+                }
+
+            } else {
+
+                // group share which doesn't exists until now, check if we need a unique target for this user
+
+                $itemTarget = Helper::generateTarget($itemType, $itemSource, self::SHARE_TYPE_USER, $user,
+                    $uidOwner, $suggestedItemTarget, $parent);
+
+                // do we also need a file target
+                if (isset($fileSource)) {
+                    $fileTarget = Helper::generateTarget('file', $filePath, self::SHARE_TYPE_USER, $user,
+                        $uidOwner, $suggestedFileTarget, $parent);
+                } else {
+                    $fileTarget = null;
+                }
+
+                if (($itemTarget === $groupItemTarget) &&
+                    (!isset($fileSource) || $fileTarget === $groupFileTarget)) {
+                    continue;
+                }
+            }
+
+            $queriesToExecute[] = array(
+                'itemType'			=> $itemType,
+                'itemSource'		=> $itemSource,
+                'itemTarget'		=> $itemTarget,
+                'shareType'			=> $userShareType,
+                'shareWith'			=> $user,
+                'uidOwner'			=> $uidOwner,
+                'permissions'		=> $permissions,
+                'shareTime'			=> time(),
+                'fileSource'		=> $fileSource,
+                'fileTarget'		=> $fileTarget,
+                'token'				=> $token,
+                'parent'			=> $parent,
+                'expiration'		=> $expirationDate,
+            );
+
+        }
+
+        $id = false;
+        if ($isGroupShare) {
+            $id = self::insertShare($queriesToExecute['groupShare']);
+            // Save this id, any extra rows for this group share will need to reference it
+            $parent = \OC::$server->getDatabaseConnection()->lastInsertId('*PREFIX*share');
+            unset($queriesToExecute['groupShare']);
+        }
+
+        foreach ($queriesToExecute as $shareQuery) {
+            $shareQuery['parent'] = $parent;
+            $id = self::insertShare($shareQuery);
+        }
+
+        $postHookData = array(
+            'itemType' => $itemType,
+            'itemSource' => $itemSource,
+            'parent' => $parent,
+            'shareType' => $shareType,
+            'uidOwner' => $uidOwner,
+            'permissions' => $permissions,
+            'fileSource' => $fileSource,
+            'id' => $parent,
+            'token' => $token,
+            'expirationDate' => $expirationDate,
+        );
+
+        $postHookData['shareWith'] = ($isGroupShare) ? $shareWith['group'] : $shareWith;
+        $postHookData['itemTarget'] = ($isGroupShare) ? $groupItemTarget : $itemTarget;
+        $postHookData['fileTarget'] = ($isGroupShare) ? $groupFileTarget : $fileTarget;
+
+        \OC_Hook::emit('OCP\Share', 'post_shared', $postHookData);
+
+
+        return $id ? $id : false;
+    }
+
+    /**
+     * @param string $itemType
+     * @param string $itemSource
+     * @param int $shareType
+     * @param string $shareWith
+     * @param string $uidOwner
+     * @param int $permissions
+     * @param string|null $itemSourceName
+     * @param null|\DateTime $expirationDate
+     */
+    private static function checkReshare($itemType, $itemSource, $shareType, $shareWith, $uidOwner, $permissions, $itemSourceName, $expirationDate) {
+        $backend = self::getBackend($itemType);
+
+        $l = \OC::$server->getL10N('lib');
+        $result = array();
+
+        $column = ($itemType === 'file' || $itemType === 'folder') ? 'file_source' : 'item_source';
+
+        $checkReshare = self::getItemSharedWithBySource($itemType, $itemSource, self::FORMAT_NONE, null, true);
+        if ($checkReshare) {
+            // Check if attempting to share back to owner
+            if ($checkReshare['uid_owner'] == $shareWith && $shareType == self::SHARE_TYPE_USER) {
+                $message = 'Sharing %s failed, because the user %s is the original sharer';
+                $message_t = $l->t('Sharing failed, because the user %s is the original sharer', [$shareWith]);
+
+                \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $shareWith), \OCP\Util::DEBUG);
+                throw new \Exception($message_t);
+            }
+        }
+
+        if ($checkReshare && $checkReshare['uid_owner'] !== \OC_User::getUser()) {
+            // Check if share permissions is granted
+            if (self::isResharingAllowed() && (int)$checkReshare['permissions'] & \OCP\Constants::PERMISSION_SHARE) {
+                if (~(int)$checkReshare['permissions'] & $permissions) {
+                    $message = 'Sharing %s failed, because the permissions exceed permissions granted to %s';
+                    $message_t = $l->t('Sharing %s failed, because the permissions exceed permissions granted to %s', array($itemSourceName, $uidOwner));
+
+                    \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName, $uidOwner), \OCP\Util::DEBUG);
+                    throw new \Exception($message_t);
+                } else {
+                    // TODO Don't check if inside folder
+                    $result['parent'] = $checkReshare['id'];
+
+                    $result['expirationDate'] = $expirationDate;
+                    // $checkReshare['expiration'] could be null and then is always less than any value
+                    if(isset($checkReshare['expiration']) && $checkReshare['expiration'] < $expirationDate) {
+                        $result['expirationDate'] = $checkReshare['expiration'];
+                    }
+
+                    // only suggest the same name as new target if it is a reshare of the
+                    // same file/folder and not the reshare of a child
+                    if ($checkReshare[$column] === $itemSource) {
+                        $result['filePath'] = $checkReshare['file_target'];
+                        $result['itemSource'] = $checkReshare['item_source'];
+                        $result['fileSource'] = $checkReshare['file_source'];
+                        $result['suggestedItemTarget'] = $checkReshare['item_target'];
+                        $result['suggestedFileTarget'] = $checkReshare['file_target'];
+                    } else {
+                        $result['filePath'] = ($backend instanceof \OCP\Share_Backend_File_Dependent) ? $backend->getFilePath($itemSource, $uidOwner) : null;
+                        $result['suggestedItemTarget'] = null;
+                        $result['suggestedFileTarget'] = null;
+                        $result['itemSource'] = $itemSource;
+                        $result['fileSource'] = ($backend instanceof \OCP\Share_Backend_File_Dependent) ? $itemSource : null;
+                    }
+                }
+            } else {
+                $message = 'Sharing %s failed, because resharing is not allowed';
+                $message_t = $l->t('Sharing %s failed, because resharing is not allowed', array($itemSourceName));
+
+                \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSourceName), \OCP\Util::DEBUG);
+                throw new \Exception($message_t);
+            }
+        } else {
+            $result['parent'] = null;
+            $result['suggestedItemTarget'] = null;
+            $result['suggestedFileTarget'] = null;
+            $result['itemSource'] = $itemSource;
+            $result['expirationDate'] = $expirationDate;
+            if (!$backend->isValidSource($itemSource, $uidOwner)) {
+                $message = 'Sharing %s failed, because the sharing backend for '
+                    .'%s could not find its source';
+                $message_t = $l->t('Sharing %s failed, because the sharing backend for %s could not find its source', array($itemSource, $itemType));
+                \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSource, $itemType), \OCP\Util::DEBUG);
+                throw new \Exception($message_t);
+            }
+            if ($backend instanceof \OCP\Share_Backend_File_Dependent) {
+                $result['filePath'] = $backend->getFilePath($itemSource, $uidOwner);
+                if ($itemType == 'file' || $itemType == 'folder') {
+                    $result['fileSource'] = $itemSource;
+                } else {
+                    $meta = \OC\Files\Filesystem::getFileInfo($result['filePath']);
+                    $result['fileSource'] = $meta['fileid'];
+                }
+                if ($result['fileSource'] == -1) {
+                    $message = 'Sharing %s failed, because the file could not be found in the file cache';
+                    $message_t = $l->t('Sharing %s failed, because the file could not be found in the file cache', array($itemSource));
+
+                    \OCP\Util::writeLog('OCP\Share', sprintf($message, $itemSource), \OCP\Util::DEBUG);
+                    throw new \Exception($message_t);
+                }
+            } else {
+                $result['filePath'] = null;
+                $result['fileSource'] = null;
+            }
+        }
+
+        return $result;
+    }
+
+    /**
+     *
+     * @param array $shareData
+     * @return mixed false in case of a failure or the id of the new share
+     */
+    private static function insertShare(array $shareData) {
+
+        $query = \OC_DB::prepare('INSERT INTO `*PREFIX*share` ('
+            .' `item_type`, `item_source`, `item_target`, `share_type`,'
+            .' `share_with`, `uid_owner`, `permissions`, `stime`, `file_source`,'
+            .' `file_target`, `token`, `parent`, `expiration`) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)');
+        $query->bindValue(1, $shareData['itemType']);
+        $query->bindValue(2, $shareData['itemSource']);
+        $query->bindValue(3, $shareData['itemTarget']);
+        $query->bindValue(4, $shareData['shareType']);
+        $query->bindValue(5, $shareData['shareWith']);
+        $query->bindValue(6, $shareData['uidOwner']);
+        $query->bindValue(7, $shareData['permissions']);
+        $query->bindValue(8, $shareData['shareTime']);
+        $query->bindValue(9, $shareData['fileSource']);
+        $query->bindValue(10, $shareData['fileTarget']);
+        $query->bindValue(11, $shareData['token']);
+        $query->bindValue(12, $shareData['parent']);
+        $query->bindValue(13, $shareData['expiration'], 'datetime');
+        $result = $query->execute();
+
+        $id = false;
+        if ($result) {
+            $id =  \OC::$server->getDatabaseConnection()->lastInsertId('*PREFIX*share');
+        }
+
+        return $id;
+
+    }
+
+    /**
+     * Delete all shares with type SHARE_TYPE_LINK
+     */
+    public static function removeAllLinkShares() {
+        // Delete any link shares
+        $query = \OC_DB::prepare('SELECT `id` FROM `*PREFIX*share` WHERE `share_type` = ?');
+        $result = $query->execute(array(self::SHARE_TYPE_LINK));
+        while ($item = $result->fetchRow()) {
+            Helper::delete($item['id']);
+        }
+    }
+
+    /**
+     * In case a password protected link is not yet authenticated this function will return false
+     *
+     * @param array $linkItem
+     * @return boolean
+     */
+    public static function checkPasswordProtectedShare(array $linkItem) {
+        if (!isset($linkItem['share_with'])) {
+            return true;
+        }
+        if (!isset($linkItem['share_type'])) {
+            return true;
+        }
+        if (!isset($linkItem['id'])) {
+            return true;
+        }
+
+        if ($linkItem['share_type'] != \OCP\Share::SHARE_TYPE_LINK) {
+            return true;
+        }
+
+        if ( \OC::$server->getSession()->exists('public_link_authenticated')
+            && \OC::$server->getSession()->get('public_link_authenticated') === (string)$linkItem['id'] ) {
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * construct select statement
+     * @param int $format
+     * @param boolean $fileDependent ist it a file/folder share or a generla share
+     * @param string $uidOwner
+     * @return string select statement
+     */
+    private static function createSelectStatement($format, $fileDependent, $uidOwner = null) {
+        $select = '*';
+        if ($format == self::FORMAT_STATUSES) {
+            if ($fileDependent) {
+                $select = '`*PREFIX*share`.`id`, `*PREFIX*share`.`parent`, `share_type`, `path`, `storage`, '
+                    . '`share_with`, `uid_owner` , `file_source`, `stime`, `*PREFIX*share`.`permissions`, '
+                    . '`*PREFIX*storages`.`id` AS `storage_id`, `*PREFIX*filecache`.`parent` as `file_parent`, '
+                    . '`uid_initiator`';
+            } else {
+                $select = '`id`, `parent`, `share_type`, `share_with`, `uid_owner`, `item_source`, `stime`, `*PREFIX*share`.`permissions`';
+            }
+        } else {
+            if (isset($uidOwner)) {
+                if ($fileDependent) {
+                    $select = '`*PREFIX*share`.`id`, `item_type`, `item_source`, `*PREFIX*share`.`parent`,'
+                        . ' `share_type`, `share_with`, `file_source`, `file_target`, `path`, `*PREFIX*share`.`permissions`, `stime`,'
+                        . ' `expiration`, `token`, `storage`, `mail_send`, `uid_owner`, '
+                        . '`*PREFIX*storages`.`id` AS `storage_id`, `*PREFIX*filecache`.`parent` as `file_parent`';
+                } else {
+                    $select = '`id`, `item_type`, `item_source`, `parent`, `share_type`, `share_with`, `*PREFIX*share`.`permissions`,'
+                        . ' `stime`, `file_source`, `expiration`, `token`, `mail_send`, `uid_owner`';
+                }
+            } else {
+                if ($fileDependent) {
+                    if ($format == \OCA\Files_Sharing\ShareBackend\File::FORMAT_GET_FOLDER_CONTENTS || $format == \OCA\Files_Sharing\ShareBackend\File::FORMAT_FILE_APP_ROOT) {
+                        $select = '`*PREFIX*share`.`id`, `item_type`, `item_source`, `*PREFIX*share`.`parent`, `uid_owner`, '
+                            . '`share_type`, `share_with`, `file_source`, `path`, `file_target`, `stime`, '
+                            . '`*PREFIX*share`.`permissions`, `expiration`, `storage`, `*PREFIX*filecache`.`parent` as `file_parent`, '
+                            . '`name`, `mtime`, `mimetype`, `mimepart`, `size`, `encrypted`, `etag`, `mail_send`';
+                    } else {
+                        $select = '`*PREFIX*share`.`id`, `item_type`, `item_source`, `item_target`,'
+                            . '`*PREFIX*share`.`parent`, `share_type`, `share_with`, `uid_owner`,'
+                            . '`file_source`, `path`, `file_target`, `*PREFIX*share`.`permissions`,'
+                            . '`stime`, `expiration`, `token`, `storage`, `mail_send`,'
+                            . '`*PREFIX*storages`.`id` AS `storage_id`, `*PREFIX*filecache`.`parent` as `file_parent`';
+                    }
+                }
+            }
+        }
+        return $select;
+    }
+
+
+    /**
+     * transform db results
+     * @param array $row result
+     */
+    private static function transformDBResults(&$row) {
+        if (isset($row['id'])) {
+            $row['id'] = (int) $row['id'];
+        }
+        if (isset($row['share_type'])) {
+            $row['share_type'] = (int) $row['share_type'];
+        }
+        if (isset($row['parent'])) {
+            $row['parent'] = (int) $row['parent'];
+        }
+        if (isset($row['file_parent'])) {
+            $row['file_parent'] = (int) $row['file_parent'];
+        }
+        if (isset($row['file_source'])) {
+            $row['file_source'] = (int) $row['file_source'];
+        }
+        if (isset($row['permissions'])) {
+            $row['permissions'] = (int) $row['permissions'];
+        }
+        if (isset($row['storage'])) {
+            $row['storage'] = (int) $row['storage'];
+        }
+        if (isset($row['stime'])) {
+            $row['stime'] = (int) $row['stime'];
+        }
+        if (isset($row['expiration']) && $row['share_type'] !== self::SHARE_TYPE_LINK) {
+            // discard expiration date for non-link shares, which might have been
+            // set by ancient bugs
+            $row['expiration'] = null;
+        }
+    }
+
+    /**
+     * format result
+     * @param array $items result
+     * @param string $column is it a file share or a general share ('file_target' or 'item_target')
+     * @param \OCP\Share_Backend $backend sharing backend
+     * @param int $format
+     * @param array $parameters additional format parameters
+     * @return array format result
+     */
+    private static function formatResult($items, $column, $backend, $format = self::FORMAT_NONE , $parameters = null) {
+        if ($format === self::FORMAT_NONE) {
+            return $items;
+        } else if ($format === self::FORMAT_STATUSES) {
+            $statuses = array();
+            foreach ($items as $item) {
+                if ($item['share_type'] === self::SHARE_TYPE_LINK) {
+                    if ($item['uid_initiator'] !== \OC::$server->getUserSession()->getUser()->getUID()) {
+                        continue;
+                    }
+                    $statuses[$item[$column]]['link'] = true;
+                } else if (!isset($statuses[$item[$column]])) {
+                    $statuses[$item[$column]]['link'] = false;
+                }
+                if (!empty($item['file_target'])) {
+                    $statuses[$item[$column]]['path'] = $item['path'];
+                }
+            }
+            return $statuses;
+        } else {
+            return $backend->formatItems($items, $format, $parameters);
+        }
+    }
+
+    /**
+     * remove protocol from URL
+     *
+     * @param string $url
+     * @return string
+     */
+    public static function removeProtocolFromUrl($url) {
+        if (strpos($url, 'https://') === 0) {
+            return substr($url, strlen('https://'));
+        } else if (strpos($url, 'http://') === 0) {
+            return substr($url, strlen('http://'));
+        }
+
+        return $url;
+    }
+
+    /**
+     * try http post first with https and then with http as a fallback
+     *
+     * @param string $remoteDomain
+     * @param string $urlSuffix
+     * @param array $fields post parameters
+     * @return array
+     */
+    private static function tryHttpPostToShareEndpoint($remoteDomain, $urlSuffix, array $fields) {
+        $protocol = 'https://';
+        $result = [
+            'success' => false,
+            'result' => '',
+        ];
+        $try = 0;
+        $discoveryManager = new DiscoveryManager(
+            \OC::$server->getMemCacheFactory(),
+            \OC::$server->getHTTPClientService()
+        );
+        while ($result['success'] === false && $try < 2) {
+            $endpoint = $discoveryManager->getShareEndpoint($protocol . $remoteDomain);
+            $result = \OC::$server->getHTTPHelper()->post($protocol . $remoteDomain . $endpoint . $urlSuffix . '?format=' . self::RESPONSE_FORMAT, $fields);
+            $try++;
+            $protocol = 'http://';
+        }
+
+        return $result;
+    }
+
+    /**
+     * send server-to-server share to remote server
+     *
+     * @param string $token
+     * @param string $shareWith
+     * @param string $name
+     * @param int $remote_id
+     * @param string $owner
+     * @return bool
+     */
+    private static function sendRemoteShare($token, $shareWith, $name, $remote_id, $owner) {
+
+        list($user, $remote) = Helper::splitUserRemote($shareWith);
+
+        if ($user && $remote) {
+            $url = $remote;
+
+            $local = \OC::$server->getURLGenerator()->getAbsoluteURL('/');
+
+            $fields = array(
+                'shareWith' => $user,
+                'token' => $token,
+                'name' => $name,
+                'remoteId' => $remote_id,
+                'owner' => $owner,
+                'remote' => $local,
+            );
+
+            $url = self::removeProtocolFromUrl($url);
+            $result = self::tryHttpPostToShareEndpoint($url, '', $fields);
+            $status = json_decode($result['result'], true);
+
+            if ($result['success'] && ($status['ocs']['meta']['statuscode'] === 100 || $status['ocs']['meta']['statuscode'] === 200)) {
+                \OC_Hook::emit('OCP\Share', 'federated_share_added', ['server' => $remote]);
+                return true;
+            }
+
+        }
+
+        return false;
+    }
+
+    /**
+     * send server-to-server unshare to remote server
+     *
+     * @param string $remote url
+     * @param int $id share id
+     * @param string $token
+     * @return bool
+     */
+    private static function sendRemoteUnshare($remote, $id, $token) {
+        $url = rtrim($remote, '/');
+        $fields = array('token' => $token, 'format' => 'json');
+        $url = self::removeProtocolFromUrl($url);
+        $result = self::tryHttpPostToShareEndpoint($url, '/'.$id.'/unshare', $fields);
+        $status = json_decode($result['result'], true);
+
+        return ($result['success'] && ($status['ocs']['meta']['statuscode'] === 100 || $status['ocs']['meta']['statuscode'] === 200));
+    }
+
+    /**
+     * check if user can only share with group members
+     * @return bool
+     */
+    public static function shareWithGroupMembersOnly() {
+        $value = \OC::$server->getAppConfig()->getValue('core', 'shareapi_only_share_with_group_members', 'no');
+        return ($value === 'yes') ? true : false;
+    }
+
+    /**
+     * @return bool
+     */
+    public static function isDefaultExpireDateEnabled() {
+        $defaultExpireDateEnabled = \OCP\Config::getAppValue('core', 'shareapi_default_expire_date', 'no');
+        return ($defaultExpireDateEnabled === "yes") ? true : false;
+    }
+
+    /**
+     * @return bool
+     */
+    public static function enforceDefaultExpireDate() {
+        $enforceDefaultExpireDate = \OCP\Config::getAppValue('core', 'shareapi_enforce_expire_date', 'no');
+        return ($enforceDefaultExpireDate === "yes") ? true : false;
+    }
+
+    /**
+     * @return int
+     */
+    public static function getExpireInterval() {
+        return (int)\OCP\Config::getAppValue('core', 'shareapi_expire_after_n_days', '7');
+    }
+
+    /**
+     * Checks whether the given path is reachable for the given owner
+     *
+     * @param string $path path relative to files
+     * @param string $ownerStorageId storage id of the owner
+     *
+     * @return boolean true if file is reachable, false otherwise
+     */
+    private static function isFileReachable($path, $ownerStorageId) {
+        // if outside the home storage, file is always considered reachable
+        if (!(substr($ownerStorageId, 0, 6) === 'home::' ||
+            substr($ownerStorageId, 0, 13) === 'object::user:'
+        )) {
+            return true;
+        }
+
+        // if inside the home storage, the file has to be under "/files/"
+        $path = ltrim($path, '/');
+        if (substr($path, 0, 6) === 'files/') {
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * @param IConfig $config
+     * @return bool 
+     */
+    public static function enforcePassword(IConfig $config) {
+        $enforcePassword = $config->getAppValue('core', 'shareapi_enforce_links_password', 'no');
+        return ($enforcePassword === "yes") ? true : false;
+    }
+
+    /**
+     * Get all share entries, including non-unique group items
+     *
+     * @param string $owner
+     * @return array
+     */
+    public static function getAllSharesForOwner($owner) {
+        $query = 'SELECT * FROM `*PREFIX*share` WHERE `uid_owner` = ?';
+        $result = \OC::$server->getDatabaseConnection()->executeQuery($query, [$owner]);
+        return $result->fetchAll();
+    }
+
+    /**
+     * Get all share entries, including non-unique group items for a file
+     *
+     * @param int $id
+     * @return array
+     */
+    public static function getAllSharesForFileId($id) {
+        $query = 'SELECT * FROM `*PREFIX*share` WHERE `file_source` = ?';
+        $result = \OC::$server->getDatabaseConnection()->executeQuery($query, [$id]);
+        return $result->fetchAll();
+    }
+
+    /**
+     * @param string $password
+     * @throws \Exception
+     */
+    private static function verifyPassword($password) {
+
+        $accepted = true;
+        $message = '';
+        \OCP\Util::emitHook('\OC\Share', 'verifyPassword', [
+            'password' => $password,
+            'accepted' => &$accepted,
+            'message' => &$message
+        ]);
+
+        if (!$accepted) {
+            throw new \Exception($message);
+        }
+    }
 }

Spacing +76 added lines, -76 removed lines

@@ -91,7 +91,7 @@ 
 					'collectionOf' => $collectionOf,
 					'supportedFileExtensions' => $supportedFileExtensions
 				);
-				if(count(self::$backendTypes) === 1) {
+				if (count(self::$backendTypes) === 1) {
 					\OC_Util::addScript('core', 'shareconfigmodel');
 					\OC_Util::addScript('core', 'shareitemmodel');
 					\OC_Util::addScript('core', 'sharedialogresharerinfoview');
@@ -170,22 +170,22 @@ 
 		$source = -1;
 		$cache = $mountPath = false;
 
-		$view = new \OC\Files\View('/' . $ownerUser . '/files');
+		$view = new \OC\Files\View('/'.$ownerUser.'/files');
 		$meta = $view->getFileInfo($path);
 		if ($meta) {
-			$path = substr($meta->getPath(), strlen('/' . $ownerUser . '/files'));
+			$path = substr($meta->getPath(), strlen('/'.$ownerUser.'/files'));
 		} else {
 			// if the file doesn't exists yet we start with the parent folder
 			$meta = $view->getFileInfo(dirname($path));
 		}
 
-		if($meta !== false) {
+		if ($meta !== false) {
 			$source = $meta['fileid'];
 			$cache = new \OC\Files\Cache\Cache($meta['storage']);
 
 			$mountPath = $meta->getMountPoint()->getMountPoint();
 			if ($mountPath !== false) {
-				$mountPath = substr($mountPath, strlen('/' . $ownerUser . '/files'));
+				$mountPath = substr($mountPath, strlen('/'.$ownerUser.'/files'));
 			}
 		}
 
@@ -303,10 +303,10 @@ 
 			}
 
 			// let's get the parent for the next round
-			$meta = $cache->get((int)$source);
+			$meta = $cache->get((int) $source);
 			if ($recursive === true && $meta !== false) {
 				$paths[$source] = $meta['path'];
-				$source = (int)$meta['parent'];
+				$source = (int) $meta['parent'];
 			} else {
 				$source = -1;
 			}
@@ -325,7 +325,7 @@ 
 				$query = \OC_DB::prepare(
 					'SELECT `fileid`, `path`
 					FROM `*PREFIX*filecache`
-					WHERE `fileid` IN (' . implode(',', $fileTargetIDs) . ')'
+					WHERE `fileid` IN (' . implode(',', $fileTargetIDs).')'
 				);
 				$result = $query->execute();
 
@@ -340,7 +340,7 @@ 
 								$sharePaths[$uid] = $sharedPath;
 							} else {
 								$sharedPath = $shareData['file_target'];
-								$sharedPath .= substr($path, strlen($row['path']) -5);
+								$sharedPath .= substr($path, strlen($row['path']) - 5);
 								$sharePaths[$uid] = $sharedPath;
 							}
 						}
@@ -432,7 +432,7 @@ 
 
 		$select = self::createSelectStatement(self::FORMAT_NONE, $fileDependent);
 
-		$where .= ' `' . $column . '` = ? AND `item_type` = ? ';
+		$where .= ' `'.$column.'` = ? AND `item_type` = ? ';
 		$arguments = array($itemSource, $itemType);
 		// for link shares $user === null
 		if ($user !== null) {
@@ -450,7 +450,7 @@ 
 			$arguments[] = $owner;
 		}
 
-		$query = \OC_DB::prepare('SELECT ' . $select . ' FROM `*PREFIX*share` '. $fileDependentWhere . $where);
+		$query = \OC_DB::prepare('SELECT '.$select.' FROM `*PREFIX*share` '.$fileDependentWhere.$where);
 
 		$result = \OC_DB::executeAudited($query, $arguments);
 
@@ -458,7 +458,7 @@ 
 			if ($fileDependent && !self::isFileReachable($row['path'], $row['storage_id'])) {
 				continue;
 			}
-			if ($fileDependent && (int)$row['file_parent'] === -1) {
+			if ($fileDependent && (int) $row['file_parent'] === -1) {
 				// if it is a mount point we need to get the path from the mount manager
 				$mountManager = \OC\Files\Filesystem::getMountManager();
 				$mountPoint = $mountManager->findByStorageId($row['storage_id']);
@@ -469,7 +469,7 @@ 
 					$row['path'] = $path;
 				} else {
 					\OC::$server->getLogger()->warning(
-						'Could not resolve mount point for ' . $row['storage_id'],
+						'Could not resolve mount point for '.$row['storage_id'],
 						['app' => 'OCP\Share']
 					);
 				}
@@ -478,7 +478,7 @@ 
 		}
 
 		//if didn't found a result than let's look for a group share.
-		if(empty($shares) && $user !== null) {
+		if (empty($shares) && $user !== null) {
 			$userObject = \OC::$server->getUserManager()->get($user);
 			$groups = [];
 			if ($userObject) {
@@ -486,7 +486,7 @@ 
 			}
 
 			if (!empty($groups)) {
-				$where = $fileDependentWhere . ' WHERE `' . $column . '` = ? AND `item_type` = ? AND `share_with` in (?)';
+				$where = $fileDependentWhere.' WHERE `'.$column.'` = ? AND `item_type` = ? AND `share_with` in (?)';
 				$arguments = array($itemSource, $itemType, $groups);
 				$types = array(null, null, IQueryBuilder::PARAM_STR_ARRAY);
 
@@ -500,7 +500,7 @@ 
 				// class isn't static anymore...
 				$conn = \OC::$server->getDatabaseConnection();
 				$result = $conn->executeQuery(
-					'SELECT ' . $select . ' FROM `*PREFIX*share` ' . $where,
+					'SELECT '.$select.' FROM `*PREFIX*share` '.$where,
 					$arguments,
 					$types
 				);
@@ -554,7 +554,7 @@ 
 		$query = \OC_DB::prepare('SELECT * FROM `*PREFIX*share` WHERE `token` = ?', 1);
 		$result = $query->execute(array($token));
 		if ($result === false) {
-			\OCP\Util::writeLog('OCP\Share', \OC_DB::getErrorMessage() . ', token=' . $token, \OCP\Util::ERROR);
+			\OCP\Util::writeLog('OCP\Share', \OC_DB::getErrorMessage().', token='.$token, \OCP\Util::ERROR);
 		}
 		$row = $result->fetchRow();
 		if ($row === false) {
@@ -640,9 +640,9 @@ 
 		$items = self::getItems($itemType, $itemSource, null, null, $uidOwner, self::FORMAT_NONE, null, -1, $includeCollections, false, $checkExpireDate);
 		if ($items) {
 			foreach ($items as $item) {
-				if ((int)$item['share_type'] === self::SHARE_TYPE_USER) {
+				if ((int) $item['share_type'] === self::SHARE_TYPE_USER) {
 					$users[] = $item['share_with'];
-				} else if ((int)$item['share_type'] === self::SHARE_TYPE_GROUP) {
+				} else if ((int) $item['share_type'] === self::SHARE_TYPE_GROUP) {
 
 					$group = \OC::$server->getGroupManager()->get($item['share_with']);
 					$userIds = [];
@@ -718,12 +718,12 @@ 
 
 		//verify that we don't share a folder which already contains a share mount point
 		if ($itemType === 'folder') {
-			$path = '/' . $uidOwner . '/files' . \OC\Files\Filesystem::getPath($itemSource) . '/';
+			$path = '/'.$uidOwner.'/files'.\OC\Files\Filesystem::getPath($itemSource).'/';
 			$mountManager = \OC\Files\Filesystem::getMountManager();
 			$mounts = $mountManager->findIn($path);
 			foreach ($mounts as $mount) {
 				if ($mount->getStorage()->instanceOfStorage('\OCA\Files_Sharing\ISharedStorage')) {
-					$message = 'Sharing "' . $itemSourceName . '" failed, because it contains files shared with you!';
+					$message = 'Sharing "'.$itemSourceName.'" failed, because it contains files shared with you!';
 					\OCP\Util::writeLog('OCP\Share', $message, \OCP\Util::DEBUG);
 					throw new \Exception($message);
 				}
@@ -733,7 +733,7 @@ 
 
 		// single file shares should never have delete permissions
 		if ($itemType === 'file') {
-			$permissions = (int)$permissions & ~\OCP\Constants::PERMISSION_DELETE;
+			$permissions = (int) $permissions & ~\OCP\Constants::PERMISSION_DELETE;
 		}
 
 		//Validate expirationDate
@@ -887,7 +887,7 @@ 
 					} else {
 						// reuse the already set password, but only if we change permissions
 						// otherwise the user disabled the password protection
-						if ($checkExists && (int)$permissions !== (int)$oldPermissions) {
+						if ($checkExists && (int) $permissions !== (int) $oldPermissions) {
 							$shareWith = $checkExists['share_with'];
 						}
 					}
@@ -960,10 +960,10 @@ 
 				throw new \Exception($message_t);
 			}
 
-			$token = \OC::$server->getSecureRandom()->generate(self::TOKEN_LENGTH, \OCP\Security\ISecureRandom::CHAR_LOWER . \OCP\Security\ISecureRandom::CHAR_UPPER .
+			$token = \OC::$server->getSecureRandom()->generate(self::TOKEN_LENGTH, \OCP\Security\ISecureRandom::CHAR_LOWER.\OCP\Security\ISecureRandom::CHAR_UPPER.
 				\OCP\Security\ISecureRandom::CHAR_DIGITS);
 
-			$shareWith = $user . '@' . $remote;
+			$shareWith = $user.'@'.$remote;
 			$shareId = self::put($itemType, $itemSource, $shareType, $shareWith, $uidOwner, $permissions, null, $token, $itemSourceName);
 
 			$send = false;
@@ -1014,12 +1014,12 @@ 
 		$currentUser = $owner ? $owner : \OC_User::getUser();
 		foreach ($items as $item) {
 			// delete the item with the expected share_type and owner
-			if ((int)$item['share_type'] === (int)$shareType && $item['uid_owner'] === $currentUser) {
+			if ((int) $item['share_type'] === (int) $shareType && $item['uid_owner'] === $currentUser) {
 				$toDelete = $item;
 				// if there is more then one result we don't have to delete the children
 				// but update their parent. For group shares the new parent should always be
 				// the original group share and not the db entry with the unique name
-			} else if ((int)$item['share_type'] === self::$shareTypeGroupUserUnique) {
+			} else if ((int) $item['share_type'] === self::$shareTypeGroupUserUnique) {
 				$newParent = $item['parent'];
 			} else {
 				$newParent = $item['id'];
@@ -1041,7 +1041,7 @@ 
 	 */
 	public static function unshareAll($itemType, $itemSource) {
 		// Get all of the owners of shares of this item.
-		$query = \OC_DB::prepare( 'SELECT `uid_owner` from `*PREFIX*share` WHERE `item_type`=? AND `item_source`=?' );
+		$query = \OC_DB::prepare('SELECT `uid_owner` from `*PREFIX*share` WHERE `item_type`=? AND `item_source`=?');
 		$result = $query->execute(array($itemType, $itemSource));
 		$shares = array();
 		// Add each owner's shares to the array of all shares for this item.
@@ -1079,9 +1079,9 @@ 
 		$uid = \OCP\User::getUser();
 
 		if ($itemType === 'file' || $itemType === 'folder') {
-			$statement = 'SELECT * FROM `*PREFIX*share` WHERE `item_type` = ? and `file_' . $originType . '` = ?';
+			$statement = 'SELECT * FROM `*PREFIX*share` WHERE `item_type` = ? and `file_'.$originType.'` = ?';
 		} else {
-			$statement = 'SELECT * FROM `*PREFIX*share` WHERE `item_type` = ? and `item_' . $originType . '` = ?';
+			$statement = 'SELECT * FROM `*PREFIX*share` WHERE `item_type` = ? and `item_'.$originType.'` = ?';
 		}
 
 		$query = \OCP\DB::prepare($statement);
@@ -1093,7 +1093,7 @@ 
 
 		$itemUnshared = false;
 		foreach ($shares as $share) {
-			if ((int)$share['share_type'] === \OCP\Share::SHARE_TYPE_USER &&
+			if ((int) $share['share_type'] === \OCP\Share::SHARE_TYPE_USER &&
 				$share['share_with'] === $uid) {
 				$deletedShares = Helper::delete($share['id']);
 				$shareTmp = array(
@@ -1101,7 +1101,7 @@ 
 					'shareWith' => $share['share_with'],
 					'itemTarget' => $share['item_target'],
 					'itemType' => $share['item_type'],
-					'shareType' => (int)$share['share_type'],
+					'shareType' => (int) $share['share_type'],
 				);
 				if (isset($share['file_target'])) {
 					$shareTmp['fileTarget'] = $share['file_target'];
@@ -1109,13 +1109,13 @@ 
 				$listOfUnsharedItems = array_merge($listOfUnsharedItems, $deletedShares, array($shareTmp));
 				$itemUnshared = true;
 				break;
-			} elseif ((int)$share['share_type'] === \OCP\Share::SHARE_TYPE_GROUP) {
+			} elseif ((int) $share['share_type'] === \OCP\Share::SHARE_TYPE_GROUP) {
 				$group = \OC::$server->getGroupManager()->get($share['share_with']);
 				$user = \OC::$server->getUserManager()->get($uid);
 				if ($group && $user && $group->inGroup($user)) {
 					$groupShare = $share;
 				}
-			} elseif ((int)$share['share_type'] === self::$shareTypeGroupUserUnique &&
+			} elseif ((int) $share['share_type'] === self::$shareTypeGroupUserUnique &&
 				$share['share_with'] === $uid) {
 				$uniqueGroupShare = $share;
 			}
@@ -1135,7 +1135,7 @@ 
 				'shareWith' => $groupShare['share_with'],
 				'itemTarget' => $groupShare['item_target'],
 				'itemType' => $groupShare['item_type'],
-				'shareType' => (int)$groupShare['share_type'],
+				'shareType' => (int) $groupShare['share_type'],
 			);
 			if (isset($groupShare['file_target'])) {
 				$shareTmp['fileTarget'] = $groupShare['file_target'];
@@ -1150,7 +1150,7 @@ 
 				'shareWith' => $uniqueGroupShare['share_with'],
 				'itemTarget' => $uniqueGroupShare['item_target'],
 				'itemType' => $uniqueGroupShare['item_type'],
-				'shareType' => (int)$uniqueGroupShare['share_type'],
+				'shareType' => (int) $uniqueGroupShare['share_type'],
 			);
 			if (isset($uniqueGroupShare['file_target'])) {
 				$shareTmp['fileTarget'] = $uniqueGroupShare['file_target'];
@@ -1185,7 +1185,7 @@ 
 
 		$result = $query->execute(array($status, $itemType, $itemSource, $shareType, $recipient));
 
-		if($result === false) {
+		if ($result === false) {
 			\OCP\Util::writeLog('OCP\Share', 'Couldn\'t set send mail status', \OCP\Util::ERROR);
 		}
 	}
@@ -1206,12 +1206,12 @@ 
 
 		$intArrayToLiteralArray = function($intArray, $eb) {
 			return array_map(function($int) use ($eb) {
-				return $eb->literal((int)$int, 'integer');
+				return $eb->literal((int) $int, 'integer');
 			}, $intArray);
 		};
 		$sanitizeItem = function($item) {
-			$item['id'] = (int)$item['id'];
-			$item['premissions'] = (int)$item['permissions'];
+			$item['id'] = (int) $item['id'];
+			$item['premissions'] = (int) $item['permissions'];
 			return $item;
 		};
 
@@ -1229,7 +1229,7 @@ 
 
 				$result = $dbresult->fetch();
 				$dbresult->closeCursor();
-				if (~(int)$result['permissions'] & $permissions) {
+				if (~(int) $result['permissions'] & $permissions) {
 					$message = 'Setting permissions for %s failed,'
 						.' because the permissions exceed permissions granted to %s';
 					$message_t = $l->t('Setting permissions for %s failed, because the permissions exceed permissions granted to %s', array($itemSource, \OC_User::getUser()));
@@ -1262,7 +1262,7 @@ 
 			$items = [];
 
 			// Check if permissions were removed
-			if ((int)$rootItem['permissions'] & ~$permissions) {
+			if ((int) $rootItem['permissions'] & ~$permissions) {
 				// If share permission is removed all reshares must be deleted
 				if (($rootItem['permissions'] & \OCP\Constants::PERMISSION_SHARE) && (~$permissions & \OCP\Constants::PERMISSION_SHARE)) {
 					// delete all shares, keep parent and group children
@@ -1315,14 +1315,14 @@ 
 			 * Permissions were added
 			 * Update all USERGROUP shares. (So group shares where the user moved their mountpoint).
 			 */
-			if ($permissions & ~(int)$rootItem['permissions']) {
+			if ($permissions & ~(int) $rootItem['permissions']) {
 				$qb = $connection->getQueryBuilder();
 				$qb->select('id', 'permissions', 'item_type')
 					->from('share')
 					->where($qb->expr()->eq('parent', $qb->createParameter('parent')))
 					->andWhere($qb->expr()->eq('share_type', $qb->createParameter('share_type')))
 					->andWhere($qb->expr()->neq('permissions', $qb->createParameter('shareDeleted')))
-					->setParameter(':parent', (int)$rootItem['id'])
+					->setParameter(':parent', (int) $rootItem['id'])
 					->setParameter(':share_type', 2)
 					->setParameter(':shareDeleted', 0);
 				$result = $qb->execute();
@@ -1382,7 +1382,7 @@ 
 		if ($defaultExpireDateEnforced && $shareTime === null) {
 			$items = self::getItemShared($itemType, $itemSource);
 			$firstItem = reset($items);
-			$shareTime = (int)$firstItem['stime'];
+			$shareTime = (int) $firstItem['stime'];
 		}
 
 		if ($defaultExpireDateEnforced) {
@@ -1390,9 +1390,9 @@ 
 			$maxDate = new \DateTime();
 			$maxDate->setTimestamp($shareTime);
 			$maxDays = \OCP\Config::getAppValue('core', 'shareapi_expire_after_n_days', '7');
-			$maxDate->add(new \DateInterval('P' . $maxDays . 'D'));
+			$maxDate->add(new \DateInterval('P'.$maxDays.'D'));
 			if ($date > $maxDate) {
-				$warning = 'Cannot set expiration date. Shares cannot expire later than ' . $maxDays . ' after they have been shared';
+				$warning = 'Cannot set expiration date. Shares cannot expire later than '.$maxDays.' after they have been shared';
 				$warning_t = $l->t('Cannot set expiration date. Shares cannot expire later than %s after they have been shared', array($maxDays));
 				\OCP\Util::writeLog('OCP\Share', $warning, \OCP\Util::WARN);
 				throw new \Exception($warning_t);
@@ -1572,7 +1572,7 @@ 
 	 */
 	protected static function unshareItem(array $item, $newParent = null) {
 
-		$shareType = (int)$item['share_type'];
+		$shareType = (int) $item['share_type'];
 		$shareWith = null;
 		if ($shareType !== \OCP\Share::SHARE_TYPE_LINK) {
 			$shareWith = $item['share_with'];
@@ -1588,7 +1588,7 @@ 
 			'itemParent'    => $item['parent'],
 			'uidOwner'      => $item['uid_owner'],
 		);
-		if($item['item_type'] === 'file' || $item['item_type'] === 'folder') {
+		if ($item['item_type'] === 'file' || $item['item_type'] === 'folder') {
 			$hookParams['fileSource'] = $item['file_source'];
 			$hookParams['fileTarget'] = $item['file_target'];
 		}
@@ -1598,7 +1598,7 @@ 
 		$deletedShares[] = $hookParams;
 		$hookParams['deletedShares'] = $deletedShares;
 		\OC_Hook::emit('OCP\Share', 'post_unshare', $hookParams);
-		if ((int)$item['share_type'] === \OCP\Share::SHARE_TYPE_REMOTE && \OC::$server->getUserSession()->getUser()) {
+		if ((int) $item['share_type'] === \OCP\Share::SHARE_TYPE_REMOTE && \OC::$server->getUserSession()->getUser()) {
 			list(, $remote) = Helper::splitUserRemote($item['share_with']);
 			self::sendRemoteUnshare($remote, $item['id'], $item['token']);
 		}
@@ -1759,7 +1759,7 @@ 
 		// Get filesystem root to add it to the file target and remove from the
 		// file source, match file_source with the file cache
 		if ($itemType == 'file' || $itemType == 'folder') {
-			if(!is_null($uidOwner)) {
+			if (!is_null($uidOwner)) {
 				$root = \OC\Files\Filesystem::getRoot();
 			} else {
 				$root = '';
@@ -1904,7 +1904,7 @@ 
 		$result = $query->execute($queryArgs);
 		if ($result === false) {
 			\OCP\Util::writeLog('OCP\Share',
-				\OC_DB::getErrorMessage() . ', select=' . $select . ' where=',
+				\OC_DB::getErrorMessage().', select='.$select.' where=',
 				\OCP\Util::ERROR);
 		}
 		$items = array();
@@ -1946,14 +1946,14 @@ 
 						}
 						// Switch ids if sharing permission is granted on only
 						// one share to ensure correct parent is used if resharing
-						if (~(int)$items[$id]['permissions'] & \OCP\Constants::PERMISSION_SHARE
-							&& (int)$row['permissions'] & \OCP\Constants::PERMISSION_SHARE) {
+						if (~(int) $items[$id]['permissions'] & \OCP\Constants::PERMISSION_SHARE
+							&& (int) $row['permissions'] & \OCP\Constants::PERMISSION_SHARE) {
 							$items[$row['id']] = $items[$id];
 							$switchedItems[$id] = $row['id'];
 							unset($items[$id]);
 							$id = $row['id'];
 						}
-						$items[$id]['permissions'] |= (int)$row['permissions'];
+						$items[$id]['permissions'] |= (int) $row['permissions'];
 
 					}
 					continue;
@@ -1967,8 +1967,8 @@ 
 					$query = \OC_DB::prepare('SELECT `file_target` FROM `*PREFIX*share` WHERE `id` = ?');
 					$parentResult = $query->execute(array($row['parent']));
 					if ($result === false) {
-						\OCP\Util::writeLog('OCP\Share', 'Can\'t select parent: ' .
-							\OC_DB::getErrorMessage() . ', select=' . $select . ' where=' . $where,
+						\OCP\Util::writeLog('OCP\Share', 'Can\'t select parent: '.
+							\OC_DB::getErrorMessage().', select='.$select.' where='.$where,
 							\OCP\Util::ERROR);
 					} else {
 						$parentRow = $parentResult->fetchRow();
@@ -1978,7 +1978,7 @@ 
 						$subPath = substr($row['path'], $pos);
 						$splitPath = explode('/', $subPath);
 						foreach (array_slice($splitPath, 2) as $pathPart) {
-							$tmpPath = $tmpPath . '/' . $pathPart;
+							$tmpPath = $tmpPath.'/'.$pathPart;
 						}
 						$row['path'] = $tmpPath;
 					}
@@ -1997,7 +1997,7 @@ 
 				}
 			}
 
-			if($checkExpireDate) {
+			if ($checkExpireDate) {
 				if (self::expireItem($row)) {
 					continue;
 				}
@@ -2008,10 +2008,10 @@ 
 			}
 			// Add display names to result
 			$row['share_with_displayname'] = $row['share_with'];
-			if ( isset($row['share_with']) && $row['share_with'] != '' &&
+			if (isset($row['share_with']) && $row['share_with'] != '' &&
 				$row['share_type'] === self::SHARE_TYPE_USER) {
 				$row['share_with_displayname'] = \OCP\User::getDisplayName($row['share_with']);
-			} else if(isset($row['share_with']) && $row['share_with'] != '' &&
+			} else if (isset($row['share_with']) && $row['share_with'] != '' &&
 				$row['share_type'] === self::SHARE_TYPE_REMOTE) {
 				$addressBookEntries = \OC::$server->getContactsManager()->search($row['share_with'], ['CLOUD']);
 				foreach ($addressBookEntries as $entry) {
@@ -2022,7 +2022,7 @@ 
 					}
 				}
 			}
-			if ( isset($row['uid_owner']) && $row['uid_owner'] != '') {
+			if (isset($row['uid_owner']) && $row['uid_owner'] != '') {
 				$row['displayname_owner'] = \OCP\User::getDisplayName($row['uid_owner']);
 			}
 
@@ -2170,7 +2170,7 @@ 
 				// for file/folder shares we need to compare file_source, otherwise we compare item_source
 				// only group shares if they already point to the same target, otherwise the file where shared
 				// before grouping of shares was added. In this case we don't group them toi avoid confusions
-				if (( $fileSharing && $item['file_source'] === $r['file_source'] && $item['file_target'] === $r['file_target']) ||
+				if (($fileSharing && $item['file_source'] === $r['file_source'] && $item['file_target'] === $r['file_target']) ||
 					(!$fileSharing && $item['item_source'] === $r['item_source'] && $item['item_target'] === $r['item_target'])) {
 					// add the first item to the list of grouped shares
 					if (!isset($result[$key]['grouped'])) {
@@ -2216,7 +2216,7 @@ 
 		$groupItemTarget = $itemTarget = $fileSource = $parent = 0;
 
 		$result = self::checkReshare($itemType, $itemSource, $shareType, $shareWith, $uidOwner, $permissions, $itemSourceName, $expirationDate);
-		if(!empty($result)) {
+		if (!empty($result)) {
 			$parent = $result['parent'];
 			$itemSource = $result['itemSource'];
 			$fileSource = $result['fileSource'];
@@ -2310,11 +2310,11 @@ 
 				$itemTarget = $sourceExists['item_target'];
 
 				// for group shares we don't need a additional entry if the target is the same
-				if($isGroupShare && $groupItemTarget === $itemTarget) {
+				if ($isGroupShare && $groupItemTarget === $itemTarget) {
 					continue;
 				}
 
-			} elseif(!$sourceExists && !$isGroupShare)  {
+			} elseif (!$sourceExists && !$isGroupShare) {
 
 				$itemTarget = Helper::generateTarget($itemType, $itemSource, $userShareType, $user,
 					$uidOwner, $suggestedItemTarget, $parent);
@@ -2445,8 +2445,8 @@ 
 
 		if ($checkReshare && $checkReshare['uid_owner'] !== \OC_User::getUser()) {
 			// Check if share permissions is granted
-			if (self::isResharingAllowed() && (int)$checkReshare['permissions'] & \OCP\Constants::PERMISSION_SHARE) {
-				if (~(int)$checkReshare['permissions'] & $permissions) {
+			if (self::isResharingAllowed() && (int) $checkReshare['permissions'] & \OCP\Constants::PERMISSION_SHARE) {
+				if (~(int) $checkReshare['permissions'] & $permissions) {
 					$message = 'Sharing %s failed, because the permissions exceed permissions granted to %s';
 					$message_t = $l->t('Sharing %s failed, because the permissions exceed permissions granted to %s', array($itemSourceName, $uidOwner));
 
@@ -2458,7 +2458,7 @@ 
 
 					$result['expirationDate'] = $expirationDate;
 					// $checkReshare['expiration'] could be null and then is always less than any value
-					if(isset($checkReshare['expiration']) && $checkReshare['expiration'] < $expirationDate) {
+					if (isset($checkReshare['expiration']) && $checkReshare['expiration'] < $expirationDate) {
 						$result['expirationDate'] = $checkReshare['expiration'];
 					}
 
@@ -2550,7 +2550,7 @@ 
 
 		$id = false;
 		if ($result) {
-			$id =  \OC::$server->getDatabaseConnection()->lastInsertId('*PREFIX*share');
+			$id = \OC::$server->getDatabaseConnection()->lastInsertId('*PREFIX*share');
 		}
 
 		return $id;
@@ -2590,8 +2590,8 @@ 
 			return true;
 		}
 
-		if ( \OC::$server->getSession()->exists('public_link_authenticated')
-			&& \OC::$server->getSession()->get('public_link_authenticated') === (string)$linkItem['id'] ) {
+		if (\OC::$server->getSession()->exists('public_link_authenticated')
+			&& \OC::$server->getSession()->get('public_link_authenticated') === (string) $linkItem['id']) {
 			return true;
 		}
 
@@ -2693,7 +2693,7 @@ 
 	 * @param array $parameters additional format parameters
 	 * @return array format result
 	 */
-	private static function formatResult($items, $column, $backend, $format = self::FORMAT_NONE , $parameters = null) {
+	private static function formatResult($items, $column, $backend, $format = self::FORMAT_NONE, $parameters = null) {
 		if ($format === self::FORMAT_NONE) {
 			return $items;
 		} else if ($format === self::FORMAT_STATUSES) {
@@ -2753,8 +2753,8 @@ 
 			\OC::$server->getHTTPClientService()
 		);
 		while ($result['success'] === false && $try < 2) {
-			$endpoint = $discoveryManager->getShareEndpoint($protocol . $remoteDomain);
-			$result = \OC::$server->getHTTPHelper()->post($protocol . $remoteDomain . $endpoint . $urlSuffix . '?format=' . self::RESPONSE_FORMAT, $fields);
+			$endpoint = $discoveryManager->getShareEndpoint($protocol.$remoteDomain);
+			$result = \OC::$server->getHTTPHelper()->post($protocol.$remoteDomain.$endpoint.$urlSuffix.'?format='.self::RESPONSE_FORMAT, $fields);
 			$try++;
 			$protocol = 'http://';
 		}
@@ -2851,7 +2851,7 @@ 
 	 * @return int
 	 */
 	public static function getExpireInterval() {
-		return (int)\OCP\Config::getAppValue('core', 'shareapi_expire_after_n_days', '7');
+		return (int) \OCP\Config::getAppValue('core', 'shareapi_expire_after_n_days', '7');
 	}
 
 	/**

lib/private/AppFramework/Http/Request.php

Indentation +806 added lines, -806 removed lines

@@ -55,811 +55,811 @@
  */
 class Request implements \ArrayAccess, \Countable, IRequest {
 
-	const USER_AGENT_IE = '/(MSIE)|(Trident)/';
-	// Microsoft Edge User Agent from https://msdn.microsoft.com/en-us/library/hh869301(v=vs.85).aspx
-	const USER_AGENT_MS_EDGE = '/^Mozilla\/5\.0 \([^)]+\) AppleWebKit\/[0-9.]+ \(KHTML, like Gecko\) Chrome\/[0-9.]+ (Mobile Safari|Safari)\/[0-9.]+ Edge\/[0-9.]+$/';
-	// Firefox User Agent from https://developer.mozilla.org/en-US/docs/Web/HTTP/Gecko_user_agent_string_reference
-	const USER_AGENT_FIREFOX = '/^Mozilla\/5\.0 \([^)]+\) Gecko\/[0-9.]+ Firefox\/[0-9.]+$/';
-	// Chrome User Agent from https://developer.chrome.com/multidevice/user-agent
-	const USER_AGENT_CHROME = '/^Mozilla\/5\.0 \([^)]+\) AppleWebKit\/[0-9.]+ \(KHTML, like Gecko\)( Ubuntu Chromium\/[0-9.]+|) Chrome\/[0-9.]+ (Mobile Safari|Safari)\/[0-9.]+$/';
-	// Safari User Agent from http://www.useragentstring.com/pages/Safari/
-	const USER_AGENT_SAFARI = '/^Mozilla\/5\.0 \([^)]+\) AppleWebKit\/[0-9.]+ \(KHTML, like Gecko\) Version\/[0-9.]+ Safari\/[0-9.A-Z]+$/';
-	// Android Chrome user agent: https://developers.google.com/chrome/mobile/docs/user-agent
-	const USER_AGENT_ANDROID_MOBILE_CHROME = '#Android.*Chrome/[.0-9]*#';
-	const USER_AGENT_FREEBOX = '#^Mozilla/5\.0$#';
-	const REGEX_LOCALHOST = '/^(127\.0\.0\.1|localhost)$/';
-
-	/**
-	 * @deprecated use \OCP\IRequest::USER_AGENT_CLIENT_IOS instead
-	 */
-	const USER_AGENT_OWNCLOUD_IOS = '/^Mozilla\/5\.0 \(iOS\) (ownCloud|Nextcloud)\-iOS.*$/';
-	/**
-	 * @deprecated use \OCP\IRequest::USER_AGENT_CLIENT_ANDROID instead
-	 */
-	const USER_AGENT_OWNCLOUD_ANDROID = '/^Mozilla\/5\.0 \(Android\) ownCloud\-android.*$/';
-	/**
-	 * @deprecated use \OCP\IRequest::USER_AGENT_CLIENT_DESKTOP instead
-	 */
-	const USER_AGENT_OWNCLOUD_DESKTOP = '/^Mozilla\/5\.0 \([A-Za-z ]+\) (mirall|csyncoC)\/.*$/';
-
-	protected $inputStream;
-	protected $content;
-	protected $items = array();
-	protected $allowedKeys = array(
-		'get',
-		'post',
-		'files',
-		'server',
-		'env',
-		'cookies',
-		'urlParams',
-		'parameters',
-		'method',
-		'requesttoken',
-	);
-	/** @var ISecureRandom */
-	protected $secureRandom;
-	/** @var IConfig */
-	protected $config;
-	/** @var string */
-	protected $requestId = '';
-	/** @var ICrypto */
-	protected $crypto;
-	/** @var CsrfTokenManager|null */
-	protected $csrfTokenManager;
-
-	/** @var bool */
-	protected $contentDecoded = false;
-
-	/**
-	 * @param array $vars An associative array with the following optional values:
-	 *        - array 'urlParams' the parameters which were matched from the URL
-	 *        - array 'get' the $_GET array
-	 *        - array|string 'post' the $_POST array or JSON string
-	 *        - array 'files' the $_FILES array
-	 *        - array 'server' the $_SERVER array
-	 *        - array 'env' the $_ENV array
-	 *        - array 'cookies' the $_COOKIE array
-	 *        - string 'method' the request method (GET, POST etc)
-	 *        - string|false 'requesttoken' the requesttoken or false when not available
-	 * @param ISecureRandom $secureRandom
-	 * @param IConfig $config
-	 * @param CsrfTokenManager|null $csrfTokenManager
-	 * @param string $stream
-	 * @see http://www.php.net/manual/en/reserved.variables.php
-	 */
-	public function __construct(array $vars=array(),
-								ISecureRandom $secureRandom = null,
-								IConfig $config,
-								CsrfTokenManager $csrfTokenManager = null,
-								$stream = 'php://input') {
-		$this->inputStream = $stream;
-		$this->items['params'] = array();
-		$this->secureRandom = $secureRandom;
-		$this->config = $config;
-		$this->csrfTokenManager = $csrfTokenManager;
-
-		if(!array_key_exists('method', $vars)) {
-			$vars['method'] = 'GET';
-		}
-
-		foreach($this->allowedKeys as $name) {
-			$this->items[$name] = isset($vars[$name])
-				? $vars[$name]
-				: array();
-		}
-
-		$this->items['parameters'] = array_merge(
-			$this->items['get'],
-			$this->items['post'],
-			$this->items['urlParams'],
-			$this->items['params']
-		);
-
-	}
-	/**
-	 * @param array $parameters
-	 */
-	public function setUrlParameters(array $parameters) {
-		$this->items['urlParams'] = $parameters;
-		$this->items['parameters'] = array_merge(
-			$this->items['parameters'],
-			$this->items['urlParams']
-		);
-	}
-
-	/**
-	 * Countable method
-	 * @return int
-	 */
-	public function count() {
-		return count(array_keys($this->items['parameters']));
-	}
-
-	/**
-	* ArrayAccess methods
-	*
-	* Gives access to the combined GET, POST and urlParams arrays
-	*
-	* Examples:
-	*
-	* $var = $request['myvar'];
-	*
-	* or
-	*
-	* if(!isset($request['myvar']) {
-	* 	// Do something
-	* }
-	*
-	* $request['myvar'] = 'something'; // This throws an exception.
-	*
-	* @param string $offset The key to lookup
-	* @return boolean
-	*/
-	public function offsetExists($offset) {
-		return isset($this->items['parameters'][$offset]);
-	}
-
-	/**
-	* @see offsetExists
-	*/
-	public function offsetGet($offset) {
-		return isset($this->items['parameters'][$offset])
-			? $this->items['parameters'][$offset]
-			: null;
-	}
-
-	/**
-	* @see offsetExists
-	*/
-	public function offsetSet($offset, $value) {
-		throw new \RuntimeException('You cannot change the contents of the request object');
-	}
-
-	/**
-	* @see offsetExists
-	*/
-	public function offsetUnset($offset) {
-		throw new \RuntimeException('You cannot change the contents of the request object');
-	}
-
-	/**
-	 * Magic property accessors
-	 * @param string $name
-	 * @param mixed $value
-	 */
-	public function __set($name, $value) {
-		throw new \RuntimeException('You cannot change the contents of the request object');
-	}
-
-	/**
-	* Access request variables by method and name.
-	* Examples:
-	*
-	* $request->post['myvar']; // Only look for POST variables
-	* $request->myvar; or $request->{'myvar'}; or $request->{$myvar}
-	* Looks in the combined GET, POST and urlParams array.
-	*
-	* If you access e.g. ->post but the current HTTP request method
-	* is GET a \LogicException will be thrown.
-	*
-	* @param string $name The key to look for.
-	* @throws \LogicException
-	* @return mixed|null
-	*/
-	public function __get($name) {
-		switch($name) {
-			case 'put':
-			case 'patch':
-			case 'get':
-			case 'post':
-				if($this->method !== strtoupper($name)) {
-					throw new \LogicException(sprintf('%s cannot be accessed in a %s request.', $name, $this->method));
-				}
-				return $this->getContent();
-			case 'files':
-			case 'server':
-			case 'env':
-			case 'cookies':
-			case 'urlParams':
-			case 'method':
-				return isset($this->items[$name])
-					? $this->items[$name]
-					: null;
-			case 'parameters':
-			case 'params':
-				return $this->getContent();
-			default;
-				return isset($this[$name])
-					? $this[$name]
-					: null;
-		}
-	}
-
-	/**
-	 * @param string $name
-	 * @return bool
-	 */
-	public function __isset($name) {
-		if (in_array($name, $this->allowedKeys, true)) {
-			return true;
-		}
-		return isset($this->items['parameters'][$name]);
-	}
-
-	/**
-	 * @param string $id
-	 */
-	public function __unset($id) {
-		throw new \RuntimeException('You cannot change the contents of the request object');
-	}
-
-	/**
-	 * Returns the value for a specific http header.
-	 *
-	 * This method returns null if the header did not exist.
-	 *
-	 * @param string $name
-	 * @return string
-	 */
-	public function getHeader($name) {
-
-		$name = strtoupper(str_replace(array('-'),array('_'),$name));
-		if (isset($this->server['HTTP_' . $name])) {
-			return $this->server['HTTP_' . $name];
-		}
-
-		// There's a few headers that seem to end up in the top-level
-		// server array.
-		switch($name) {
-			case 'CONTENT_TYPE' :
-			case 'CONTENT_LENGTH' :
-				if (isset($this->server[$name])) {
-					return $this->server[$name];
-				}
-				break;
-
-		}
-
-		return null;
-	}
-
-	/**
-	 * Lets you access post and get parameters by the index
-	 * In case of json requests the encoded json body is accessed
-	 *
-	 * @param string $key the key which you want to access in the URL Parameter
-	 *                     placeholder, $_POST or $_GET array.
-	 *                     The priority how they're returned is the following:
-	 *                     1. URL parameters
-	 *                     2. POST parameters
-	 *                     3. GET parameters
-	 * @param mixed $default If the key is not found, this value will be returned
-	 * @return mixed the content of the array
-	 */
-	public function getParam($key, $default = null) {
-		return isset($this->parameters[$key])
-			? $this->parameters[$key]
-			: $default;
-	}
-
-	/**
-	 * Returns all params that were received, be it from the request
-	 * (as GET or POST) or throuh the URL by the route
-	 * @return array the array with all parameters
-	 */
-	public function getParams() {
-		return $this->parameters;
-	}
-
-	/**
-	 * Returns the method of the request
-	 * @return string the method of the request (POST, GET, etc)
-	 */
-	public function getMethod() {
-		return $this->method;
-	}
-
-	/**
-	 * Shortcut for accessing an uploaded file through the $_FILES array
-	 * @param string $key the key that will be taken from the $_FILES array
-	 * @return array the file in the $_FILES element
-	 */
-	public function getUploadedFile($key) {
-		return isset($this->files[$key]) ? $this->files[$key] : null;
-	}
-
-	/**
-	 * Shortcut for getting env variables
-	 * @param string $key the key that will be taken from the $_ENV array
-	 * @return array the value in the $_ENV element
-	 */
-	public function getEnv($key) {
-		return isset($this->env[$key]) ? $this->env[$key] : null;
-	}
-
-	/**
-	 * Shortcut for getting cookie variables
-	 * @param string $key the key that will be taken from the $_COOKIE array
-	 * @return string the value in the $_COOKIE element
-	 */
-	public function getCookie($key) {
-		return isset($this->cookies[$key]) ? $this->cookies[$key] : null;
-	}
-
-	/**
-	 * Returns the request body content.
-	 *
-	 * If the HTTP request method is PUT and the body
-	 * not application/x-www-form-urlencoded or application/json a stream
-	 * resource is returned, otherwise an array.
-	 *
-	 * @return array|string|resource The request body content or a resource to read the body stream.
-	 *
-	 * @throws \LogicException
-	 */
-	protected function getContent() {
-		// If the content can't be parsed into an array then return a stream resource.
-		if ($this->method === 'PUT'
-			&& strpos($this->getHeader('Content-Type'), 'application/x-www-form-urlencoded') === false
-			&& strpos($this->getHeader('Content-Type'), 'application/json') === false
-		) {
-			if ($this->content === false) {
-				throw new \LogicException(
-					'"put" can only be accessed once if not '
-					. 'application/x-www-form-urlencoded or application/json.'
-				);
-			}
-			$this->content = false;
-			return fopen($this->inputStream, 'rb');
-		} else {
-			$this->decodeContent();
-			return $this->items['parameters'];
-		}
-	}
-
-	/**
-	 * Attempt to decode the content and populate parameters
-	 */
-	protected function decodeContent() {
-		if ($this->contentDecoded) {
-			return;
-		}
-		$params = [];
-
-		// 'application/json' must be decoded manually.
-		if (strpos($this->getHeader('Content-Type'), 'application/json') !== false) {
-			$params = json_decode(file_get_contents($this->inputStream), true);
-			if(count($params) > 0) {
-				$this->items['params'] = $params;
-				if($this->method === 'POST') {
-					$this->items['post'] = $params;
-				}
-			}
-
-		// Handle application/x-www-form-urlencoded for methods other than GET
-		// or post correctly
-		} elseif($this->method !== 'GET'
-				&& $this->method !== 'POST'
-				&& strpos($this->getHeader('Content-Type'), 'application/x-www-form-urlencoded') !== false) {
-
-			parse_str(file_get_contents($this->inputStream), $params);
-			if(is_array($params)) {
-				$this->items['params'] = $params;
-			}
-		}
-
-		if (is_array($params)) {
-			$this->items['parameters'] = array_merge($this->items['parameters'], $params);
-		}
-		$this->contentDecoded = true;
-	}
-
-
-	/**
-	 * Checks if the CSRF check was correct
-	 * @return bool true if CSRF check passed
-	 */
-	public function passesCSRFCheck() {
-		if($this->csrfTokenManager === null) {
-			return false;
-		}
-
-		if(!$this->passesStrictCookieCheck()) {
-			return false;
-		}
-
-		if (isset($this->items['get']['requesttoken'])) {
-			$token = $this->items['get']['requesttoken'];
-		} elseif (isset($this->items['post']['requesttoken'])) {
-			$token = $this->items['post']['requesttoken'];
-		} elseif (isset($this->items['server']['HTTP_REQUESTTOKEN'])) {
-			$token = $this->items['server']['HTTP_REQUESTTOKEN'];
-		} else {
-			//no token found.
-			return false;
-		}
-		$token = new CsrfToken($token);
-
-		return $this->csrfTokenManager->isTokenValid($token);
-	}
-
-	/**
-	 * Whether the cookie checks are required
-	 *
-	 * @return bool
-	 */
-	private function cookieCheckRequired() {
-		if ($this->getHeader('OCS-APIREQUEST')) {
-			return false;
-		}
-		if($this->getCookie(session_name()) === null && $this->getCookie('nc_token') === null) {
-			return false;
-		}
-
-		return true;
-	}
-
-	/**
-	 * Wrapper around session_get_cookie_params
-	 *
-	 * @return array
-	 */
-	protected function getCookieParams() {
-		return session_get_cookie_params();
-	}
-
-	/**
-	 * Appends the __Host- prefix to the cookie if applicable
-	 *
-	 * @param string $name
-	 * @return string
-	 */
-	protected function getProtectedCookieName($name) {
-		$cookieParams = $this->getCookieParams();
-		$prefix = '';
-		if($cookieParams['secure'] === true && $cookieParams['path'] === '/') {
-			$prefix = '__Host-';
-		}
-
-		return $prefix.$name;
-	}
-
-	/**
-	 * Checks if the strict cookie has been sent with the request if the request
-	 * is including any cookies.
-	 *
-	 * @return bool
-	 * @since 9.1.0
-	 */
-	public function passesStrictCookieCheck() {
-		if(!$this->cookieCheckRequired()) {
-			return true;
-		}
-
-		$cookieName = $this->getProtectedCookieName('nc_sameSiteCookiestrict');
-		if($this->getCookie($cookieName) === 'true'
-			&& $this->passesLaxCookieCheck()) {
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * Checks if the lax cookie has been sent with the request if the request
-	 * is including any cookies.
-	 *
-	 * @return bool
-	 * @since 9.1.0
-	 */
-	public function passesLaxCookieCheck() {
-		if(!$this->cookieCheckRequired()) {
-			return true;
-		}
-
-		$cookieName = $this->getProtectedCookieName('nc_sameSiteCookielax');
-		if($this->getCookie($cookieName) === 'true') {
-			return true;
-		}
-		return false;
-	}
-
-
-	/**
-	 * Returns an ID for the request, value is not guaranteed to be unique and is mostly meant for logging
-	 * If `mod_unique_id` is installed this value will be taken.
-	 * @return string
-	 */
-	public function getId() {
-		if(isset($this->server['UNIQUE_ID'])) {
-			return $this->server['UNIQUE_ID'];
-		}
-
-		if(empty($this->requestId)) {
-			$this->requestId = $this->secureRandom->generate(20);
-		}
-
-		return $this->requestId;
-	}
-
-	/**
-	 * Returns the remote address, if the connection came from a trusted proxy
-	 * and `forwarded_for_headers` has been configured then the IP address
-	 * specified in this header will be returned instead.
-	 * Do always use this instead of $_SERVER['REMOTE_ADDR']
-	 * @return string IP address
-	 */
-	public function getRemoteAddress() {
-		$remoteAddress = isset($this->server['REMOTE_ADDR']) ? $this->server['REMOTE_ADDR'] : '';
-		$trustedProxies = $this->config->getSystemValue('trusted_proxies', []);
-
-		if(is_array($trustedProxies) && in_array($remoteAddress, $trustedProxies)) {
-			$forwardedForHeaders = $this->config->getSystemValue('forwarded_for_headers', [
-				'HTTP_X_FORWARDED_FOR'
-				// only have one default, so we cannot ship an insecure product out of the box
-			]);
-
-			foreach($forwardedForHeaders as $header) {
-				if(isset($this->server[$header])) {
-					foreach(explode(',', $this->server[$header]) as $IP) {
-						$IP = trim($IP);
-						if (filter_var($IP, FILTER_VALIDATE_IP) !== false) {
-							return $IP;
-						}
-					}
-				}
-			}
-		}
-
-		return $remoteAddress;
-	}
-
-	/**
-	 * Check overwrite condition
-	 * @param string $type
-	 * @return bool
-	 */
-	private function isOverwriteCondition($type = '') {
-		$regex = '/' . $this->config->getSystemValue('overwritecondaddr', '')  . '/';
-		$remoteAddr = isset($this->server['REMOTE_ADDR']) ? $this->server['REMOTE_ADDR'] : '';
-		return $regex === '//' || preg_match($regex, $remoteAddr) === 1
-		|| $type !== 'protocol';
-	}
-
-	/**
-	 * Returns the server protocol. It respects one or more reverse proxies servers
-	 * and load balancers
-	 * @return string Server protocol (http or https)
-	 */
-	public function getServerProtocol() {
-		if($this->config->getSystemValue('overwriteprotocol') !== ''
-			&& $this->isOverwriteCondition('protocol')) {
-			return $this->config->getSystemValue('overwriteprotocol');
-		}
-
-		if (isset($this->server['HTTP_X_FORWARDED_PROTO'])) {
-			if (strpos($this->server['HTTP_X_FORWARDED_PROTO'], ',') !== false) {
-				$parts = explode(',', $this->server['HTTP_X_FORWARDED_PROTO']);
-				$proto = strtolower(trim($parts[0]));
-			} else {
-				$proto = strtolower($this->server['HTTP_X_FORWARDED_PROTO']);
-			}
-
-			// Verify that the protocol is always HTTP or HTTPS
-			// default to http if an invalid value is provided
-			return $proto === 'https' ? 'https' : 'http';
-		}
-
-		if (isset($this->server['HTTPS'])
-			&& $this->server['HTTPS'] !== null
-			&& $this->server['HTTPS'] !== 'off'
-			&& $this->server['HTTPS'] !== '') {
-			return 'https';
-		}
-
-		return 'http';
-	}
-
-	/**
-	 * Returns the used HTTP protocol.
-	 *
-	 * @return string HTTP protocol. HTTP/2, HTTP/1.1 or HTTP/1.0.
-	 */
-	public function getHttpProtocol() {
-		$claimedProtocol = strtoupper($this->server['SERVER_PROTOCOL']);
-
-		$validProtocols = [
-			'HTTP/1.0',
-			'HTTP/1.1',
-			'HTTP/2',
-		];
-
-		if(in_array($claimedProtocol, $validProtocols, true)) {
-			return $claimedProtocol;
-		}
-
-		return 'HTTP/1.1';
-	}
-
-	/**
-	 * Returns the request uri, even if the website uses one or more
-	 * reverse proxies
-	 * @return string
-	 */
-	public function getRequestUri() {
-		$uri = isset($this->server['REQUEST_URI']) ? $this->server['REQUEST_URI'] : '';
-		if($this->config->getSystemValue('overwritewebroot') !== '' && $this->isOverwriteCondition()) {
-			$uri = $this->getScriptName() . substr($uri, strlen($this->server['SCRIPT_NAME']));
-		}
-		return $uri;
-	}
-
-	/**
-	 * Get raw PathInfo from request (not urldecoded)
-	 * @throws \Exception
-	 * @return string Path info
-	 */
-	public function getRawPathInfo() {
-		$requestUri = isset($this->server['REQUEST_URI']) ? $this->server['REQUEST_URI'] : '';
-		// remove too many leading slashes - can be caused by reverse proxy configuration
-		if (strpos($requestUri, '/') === 0) {
-			$requestUri = '/' . ltrim($requestUri, '/');
-		}
-
-		$requestUri = preg_replace('%/{2,}%', '/', $requestUri);
-
-		// Remove the query string from REQUEST_URI
-		if ($pos = strpos($requestUri, '?')) {
-			$requestUri = substr($requestUri, 0, $pos);
-		}
-
-		$scriptName = $this->server['SCRIPT_NAME'];
-		$pathInfo = $requestUri;
-
-		// strip off the script name's dir and file name
-		// FIXME: Sabre does not really belong here
-		list($path, $name) = \Sabre\HTTP\URLUtil::splitPath($scriptName);
-		if (!empty($path)) {
-			if($path === $pathInfo || strpos($pathInfo, $path.'/') === 0) {
-				$pathInfo = substr($pathInfo, strlen($path));
-			} else {
-				throw new \Exception("The requested uri($requestUri) cannot be processed by the script '$scriptName')");
-			}
-		}
-		if (strpos($pathInfo, '/'.$name) === 0) {
-			$pathInfo = substr($pathInfo, strlen($name) + 1);
-		}
-		if (strpos($pathInfo, $name) === 0) {
-			$pathInfo = substr($pathInfo, strlen($name));
-		}
-		if($pathInfo === false || $pathInfo === '/'){
-			return '';
-		} else {
-			return $pathInfo;
-		}
-	}
-
-	/**
-	 * Get PathInfo from request
-	 * @throws \Exception
-	 * @return string|false Path info or false when not found
-	 */
-	public function getPathInfo() {
-		$pathInfo = $this->getRawPathInfo();
-		// following is taken from \Sabre\HTTP\URLUtil::decodePathSegment
-		$pathInfo = rawurldecode($pathInfo);
-		$encoding = mb_detect_encoding($pathInfo, ['UTF-8', 'ISO-8859-1']);
-
-		switch($encoding) {
-			case 'ISO-8859-1' :
-				$pathInfo = utf8_encode($pathInfo);
-		}
-		// end copy
-
-		return $pathInfo;
-	}
-
-	/**
-	 * Returns the script name, even if the website uses one or more
-	 * reverse proxies
-	 * @return string the script name
-	 */
-	public function getScriptName() {
-		$name = $this->server['SCRIPT_NAME'];
-		$overwriteWebRoot =  $this->config->getSystemValue('overwritewebroot');
-		if ($overwriteWebRoot !== '' && $this->isOverwriteCondition()) {
-			// FIXME: This code is untestable due to __DIR__, also that hardcoded path is really dangerous
-			$serverRoot = str_replace('\\', '/', substr(__DIR__, 0, -strlen('lib/private/appframework/http/')));
-			$suburi = str_replace('\\', '/', substr(realpath($this->server['SCRIPT_FILENAME']), strlen($serverRoot)));
-			$name = '/' . ltrim($overwriteWebRoot . $suburi, '/');
-		}
-		return $name;
-	}
-
-	/**
-	 * Checks whether the user agent matches a given regex
-	 * @param array $agent array of agent names
-	 * @return bool true if at least one of the given agent matches, false otherwise
-	 */
-	public function isUserAgent(array $agent) {
-		if (!isset($this->server['HTTP_USER_AGENT'])) {
-			return false;
-		}
-		foreach ($agent as $regex) {
-			if (preg_match($regex, $this->server['HTTP_USER_AGENT'])) {
-				return true;
-			}
-		}
-		return false;
-	}
-
-	/**
-	 * Returns the unverified server host from the headers without checking
-	 * whether it is a trusted domain
-	 * @return string Server host
-	 */
-	public function getInsecureServerHost() {
-		$host = 'localhost';
-		if (isset($this->server['HTTP_X_FORWARDED_HOST'])) {
-			if (strpos($this->server['HTTP_X_FORWARDED_HOST'], ',') !== false) {
-				$parts = explode(',', $this->server['HTTP_X_FORWARDED_HOST']);
-				$host = trim(current($parts));
-			} else {
-				$host = $this->server['HTTP_X_FORWARDED_HOST'];
-			}
-		} else {
-			if (isset($this->server['HTTP_HOST'])) {
-				$host = $this->server['HTTP_HOST'];
-			} else if (isset($this->server['SERVER_NAME'])) {
-				$host = $this->server['SERVER_NAME'];
-			}
-		}
-		return $host;
-	}
-
-
-	/**
-	 * Returns the server host from the headers, or the first configured
-	 * trusted domain if the host isn't in the trusted list
-	 * @return string Server host
-	 */
-	public function getServerHost() {
-		// overwritehost is always trusted
-		$host = $this->getOverwriteHost();
-		if ($host !== null) {
-			return $host;
-		}
-
-		// get the host from the headers
-		$host = $this->getInsecureServerHost();
-
-		// Verify that the host is a trusted domain if the trusted domains
-		// are defined
-		// If no trusted domain is provided the first trusted domain is returned
-		$trustedDomainHelper = new TrustedDomainHelper($this->config);
-		if ($trustedDomainHelper->isTrustedDomain($host)) {
-			return $host;
-		} else {
-			$trustedList = $this->config->getSystemValue('trusted_domains', []);
-			if(!empty($trustedList)) {
-				return $trustedList[0];
-			} else {
-				return '';
-			}
-		}
-	}
-
-	/**
-	 * Returns the overwritehost setting from the config if set and
-	 * if the overwrite condition is met
-	 * @return string|null overwritehost value or null if not defined or the defined condition
-	 * isn't met
-	 */
-	private function getOverwriteHost() {
-		if($this->config->getSystemValue('overwritehost') !== '' && $this->isOverwriteCondition()) {
-			return $this->config->getSystemValue('overwritehost');
-		}
-		return null;
-	}
+    const USER_AGENT_IE = '/(MSIE)|(Trident)/';
+    // Microsoft Edge User Agent from https://msdn.microsoft.com/en-us/library/hh869301(v=vs.85).aspx
+    const USER_AGENT_MS_EDGE = '/^Mozilla\/5\.0 \([^)]+\) AppleWebKit\/[0-9.]+ \(KHTML, like Gecko\) Chrome\/[0-9.]+ (Mobile Safari|Safari)\/[0-9.]+ Edge\/[0-9.]+$/';
+    // Firefox User Agent from https://developer.mozilla.org/en-US/docs/Web/HTTP/Gecko_user_agent_string_reference
+    const USER_AGENT_FIREFOX = '/^Mozilla\/5\.0 \([^)]+\) Gecko\/[0-9.]+ Firefox\/[0-9.]+$/';
+    // Chrome User Agent from https://developer.chrome.com/multidevice/user-agent
+    const USER_AGENT_CHROME = '/^Mozilla\/5\.0 \([^)]+\) AppleWebKit\/[0-9.]+ \(KHTML, like Gecko\)( Ubuntu Chromium\/[0-9.]+|) Chrome\/[0-9.]+ (Mobile Safari|Safari)\/[0-9.]+$/';
+    // Safari User Agent from http://www.useragentstring.com/pages/Safari/
+    const USER_AGENT_SAFARI = '/^Mozilla\/5\.0 \([^)]+\) AppleWebKit\/[0-9.]+ \(KHTML, like Gecko\) Version\/[0-9.]+ Safari\/[0-9.A-Z]+$/';
+    // Android Chrome user agent: https://developers.google.com/chrome/mobile/docs/user-agent
+    const USER_AGENT_ANDROID_MOBILE_CHROME = '#Android.*Chrome/[.0-9]*#';
+    const USER_AGENT_FREEBOX = '#^Mozilla/5\.0$#';
+    const REGEX_LOCALHOST = '/^(127\.0\.0\.1|localhost)$/';
+
+    /**
+     * @deprecated use \OCP\IRequest::USER_AGENT_CLIENT_IOS instead
+     */
+    const USER_AGENT_OWNCLOUD_IOS = '/^Mozilla\/5\.0 \(iOS\) (ownCloud|Nextcloud)\-iOS.*$/';
+    /**
+     * @deprecated use \OCP\IRequest::USER_AGENT_CLIENT_ANDROID instead
+     */
+    const USER_AGENT_OWNCLOUD_ANDROID = '/^Mozilla\/5\.0 \(Android\) ownCloud\-android.*$/';
+    /**
+     * @deprecated use \OCP\IRequest::USER_AGENT_CLIENT_DESKTOP instead
+     */
+    const USER_AGENT_OWNCLOUD_DESKTOP = '/^Mozilla\/5\.0 \([A-Za-z ]+\) (mirall|csyncoC)\/.*$/';
+
+    protected $inputStream;
+    protected $content;
+    protected $items = array();
+    protected $allowedKeys = array(
+        'get',
+        'post',
+        'files',
+        'server',
+        'env',
+        'cookies',
+        'urlParams',
+        'parameters',
+        'method',
+        'requesttoken',
+    );
+    /** @var ISecureRandom */
+    protected $secureRandom;
+    /** @var IConfig */
+    protected $config;
+    /** @var string */
+    protected $requestId = '';
+    /** @var ICrypto */
+    protected $crypto;
+    /** @var CsrfTokenManager|null */
+    protected $csrfTokenManager;
+
+    /** @var bool */
+    protected $contentDecoded = false;
+
+    /**
+     * @param array $vars An associative array with the following optional values:
+     *        - array 'urlParams' the parameters which were matched from the URL
+     *        - array 'get' the $_GET array
+     *        - array|string 'post' the $_POST array or JSON string
+     *        - array 'files' the $_FILES array
+     *        - array 'server' the $_SERVER array
+     *        - array 'env' the $_ENV array
+     *        - array 'cookies' the $_COOKIE array
+     *        - string 'method' the request method (GET, POST etc)
+     *        - string|false 'requesttoken' the requesttoken or false when not available
+     * @param ISecureRandom $secureRandom
+     * @param IConfig $config
+     * @param CsrfTokenManager|null $csrfTokenManager
+     * @param string $stream
+     * @see http://www.php.net/manual/en/reserved.variables.php
+     */
+    public function __construct(array $vars=array(),
+                                ISecureRandom $secureRandom = null,
+                                IConfig $config,
+                                CsrfTokenManager $csrfTokenManager = null,
+                                $stream = 'php://input') {
+        $this->inputStream = $stream;
+        $this->items['params'] = array();
+        $this->secureRandom = $secureRandom;
+        $this->config = $config;
+        $this->csrfTokenManager = $csrfTokenManager;
+
+        if(!array_key_exists('method', $vars)) {
+            $vars['method'] = 'GET';
+        }
+
+        foreach($this->allowedKeys as $name) {
+            $this->items[$name] = isset($vars[$name])
+                ? $vars[$name]
+                : array();
+        }
+
+        $this->items['parameters'] = array_merge(
+            $this->items['get'],
+            $this->items['post'],
+            $this->items['urlParams'],
+            $this->items['params']
+        );
+
+    }
+    /**
+     * @param array $parameters
+     */
+    public function setUrlParameters(array $parameters) {
+        $this->items['urlParams'] = $parameters;
+        $this->items['parameters'] = array_merge(
+            $this->items['parameters'],
+            $this->items['urlParams']
+        );
+    }
+
+    /**
+     * Countable method
+     * @return int
+     */
+    public function count() {
+        return count(array_keys($this->items['parameters']));
+    }
+
+    /**
+     * ArrayAccess methods
+     *
+     * Gives access to the combined GET, POST and urlParams arrays
+     *
+     * Examples:
+     *
+     * $var = $request['myvar'];
+     *
+     * or
+     *
+     * if(!isset($request['myvar']) {
+     * 	// Do something
+     * }
+     *
+     * $request['myvar'] = 'something'; // This throws an exception.
+     *
+     * @param string $offset The key to lookup
+     * @return boolean
+     */
+    public function offsetExists($offset) {
+        return isset($this->items['parameters'][$offset]);
+    }
+
+    /**
+     * @see offsetExists
+     */
+    public function offsetGet($offset) {
+        return isset($this->items['parameters'][$offset])
+            ? $this->items['parameters'][$offset]
+            : null;
+    }
+
+    /**
+     * @see offsetExists
+     */
+    public function offsetSet($offset, $value) {
+        throw new \RuntimeException('You cannot change the contents of the request object');
+    }
+
+    /**
+     * @see offsetExists
+     */
+    public function offsetUnset($offset) {
+        throw new \RuntimeException('You cannot change the contents of the request object');
+    }
+
+    /**
+     * Magic property accessors
+     * @param string $name
+     * @param mixed $value
+     */
+    public function __set($name, $value) {
+        throw new \RuntimeException('You cannot change the contents of the request object');
+    }
+
+    /**
+     * Access request variables by method and name.
+     * Examples:
+     *
+     * $request->post['myvar']; // Only look for POST variables
+     * $request->myvar; or $request->{'myvar'}; or $request->{$myvar}
+     * Looks in the combined GET, POST and urlParams array.
+     *
+     * If you access e.g. ->post but the current HTTP request method
+     * is GET a \LogicException will be thrown.
+     *
+     * @param string $name The key to look for.
+     * @throws \LogicException
+     * @return mixed|null
+     */
+    public function __get($name) {
+        switch($name) {
+            case 'put':
+            case 'patch':
+            case 'get':
+            case 'post':
+                if($this->method !== strtoupper($name)) {
+                    throw new \LogicException(sprintf('%s cannot be accessed in a %s request.', $name, $this->method));
+                }
+                return $this->getContent();
+            case 'files':
+            case 'server':
+            case 'env':
+            case 'cookies':
+            case 'urlParams':
+            case 'method':
+                return isset($this->items[$name])
+                    ? $this->items[$name]
+                    : null;
+            case 'parameters':
+            case 'params':
+                return $this->getContent();
+            default;
+                return isset($this[$name])
+                    ? $this[$name]
+                    : null;
+        }
+    }
+
+    /**
+     * @param string $name
+     * @return bool
+     */
+    public function __isset($name) {
+        if (in_array($name, $this->allowedKeys, true)) {
+            return true;
+        }
+        return isset($this->items['parameters'][$name]);
+    }
+
+    /**
+     * @param string $id
+     */
+    public function __unset($id) {
+        throw new \RuntimeException('You cannot change the contents of the request object');
+    }
+
+    /**
+     * Returns the value for a specific http header.
+     *
+     * This method returns null if the header did not exist.
+     *
+     * @param string $name
+     * @return string
+     */
+    public function getHeader($name) {
+
+        $name = strtoupper(str_replace(array('-'),array('_'),$name));
+        if (isset($this->server['HTTP_' . $name])) {
+            return $this->server['HTTP_' . $name];
+        }
+
+        // There's a few headers that seem to end up in the top-level
+        // server array.
+        switch($name) {
+            case 'CONTENT_TYPE' :
+            case 'CONTENT_LENGTH' :
+                if (isset($this->server[$name])) {
+                    return $this->server[$name];
+                }
+                break;
+
+        }
+
+        return null;
+    }
+
+    /**
+     * Lets you access post and get parameters by the index
+     * In case of json requests the encoded json body is accessed
+     *
+     * @param string $key the key which you want to access in the URL Parameter
+     *                     placeholder, $_POST or $_GET array.
+     *                     The priority how they're returned is the following:
+     *                     1. URL parameters
+     *                     2. POST parameters
+     *                     3. GET parameters
+     * @param mixed $default If the key is not found, this value will be returned
+     * @return mixed the content of the array
+     */
+    public function getParam($key, $default = null) {
+        return isset($this->parameters[$key])
+            ? $this->parameters[$key]
+            : $default;
+    }
+
+    /**
+     * Returns all params that were received, be it from the request
+     * (as GET or POST) or throuh the URL by the route
+     * @return array the array with all parameters
+     */
+    public function getParams() {
+        return $this->parameters;
+    }
+
+    /**
+     * Returns the method of the request
+     * @return string the method of the request (POST, GET, etc)
+     */
+    public function getMethod() {
+        return $this->method;
+    }
+
+    /**
+     * Shortcut for accessing an uploaded file through the $_FILES array
+     * @param string $key the key that will be taken from the $_FILES array
+     * @return array the file in the $_FILES element
+     */
+    public function getUploadedFile($key) {
+        return isset($this->files[$key]) ? $this->files[$key] : null;
+    }
+
+    /**
+     * Shortcut for getting env variables
+     * @param string $key the key that will be taken from the $_ENV array
+     * @return array the value in the $_ENV element
+     */
+    public function getEnv($key) {
+        return isset($this->env[$key]) ? $this->env[$key] : null;
+    }
+
+    /**
+     * Shortcut for getting cookie variables
+     * @param string $key the key that will be taken from the $_COOKIE array
+     * @return string the value in the $_COOKIE element
+     */
+    public function getCookie($key) {
+        return isset($this->cookies[$key]) ? $this->cookies[$key] : null;
+    }
+
+    /**
+     * Returns the request body content.
+     *
+     * If the HTTP request method is PUT and the body
+     * not application/x-www-form-urlencoded or application/json a stream
+     * resource is returned, otherwise an array.
+     *
+     * @return array|string|resource The request body content or a resource to read the body stream.
+     *
+     * @throws \LogicException
+     */
+    protected function getContent() {
+        // If the content can't be parsed into an array then return a stream resource.
+        if ($this->method === 'PUT'
+            && strpos($this->getHeader('Content-Type'), 'application/x-www-form-urlencoded') === false
+            && strpos($this->getHeader('Content-Type'), 'application/json') === false
+        ) {
+            if ($this->content === false) {
+                throw new \LogicException(
+                    '"put" can only be accessed once if not '
+                    . 'application/x-www-form-urlencoded or application/json.'
+                );
+            }
+            $this->content = false;
+            return fopen($this->inputStream, 'rb');
+        } else {
+            $this->decodeContent();
+            return $this->items['parameters'];
+        }
+    }
+
+    /**
+     * Attempt to decode the content and populate parameters
+     */
+    protected function decodeContent() {
+        if ($this->contentDecoded) {
+            return;
+        }
+        $params = [];
+
+        // 'application/json' must be decoded manually.
+        if (strpos($this->getHeader('Content-Type'), 'application/json') !== false) {
+            $params = json_decode(file_get_contents($this->inputStream), true);
+            if(count($params) > 0) {
+                $this->items['params'] = $params;
+                if($this->method === 'POST') {
+                    $this->items['post'] = $params;
+                }
+            }
+
+        // Handle application/x-www-form-urlencoded for methods other than GET
+        // or post correctly
+        } elseif($this->method !== 'GET'
+                && $this->method !== 'POST'
+                && strpos($this->getHeader('Content-Type'), 'application/x-www-form-urlencoded') !== false) {
+
+            parse_str(file_get_contents($this->inputStream), $params);
+            if(is_array($params)) {
+                $this->items['params'] = $params;
+            }
+        }
+
+        if (is_array($params)) {
+            $this->items['parameters'] = array_merge($this->items['parameters'], $params);
+        }
+        $this->contentDecoded = true;
+    }
+
+
+    /**
+     * Checks if the CSRF check was correct
+     * @return bool true if CSRF check passed
+     */
+    public function passesCSRFCheck() {
+        if($this->csrfTokenManager === null) {
+            return false;
+        }
+
+        if(!$this->passesStrictCookieCheck()) {
+            return false;
+        }
+
+        if (isset($this->items['get']['requesttoken'])) {
+            $token = $this->items['get']['requesttoken'];
+        } elseif (isset($this->items['post']['requesttoken'])) {
+            $token = $this->items['post']['requesttoken'];
+        } elseif (isset($this->items['server']['HTTP_REQUESTTOKEN'])) {
+            $token = $this->items['server']['HTTP_REQUESTTOKEN'];
+        } else {
+            //no token found.
+            return false;
+        }
+        $token = new CsrfToken($token);
+
+        return $this->csrfTokenManager->isTokenValid($token);
+    }
+
+    /**
+     * Whether the cookie checks are required
+     *
+     * @return bool
+     */
+    private function cookieCheckRequired() {
+        if ($this->getHeader('OCS-APIREQUEST')) {
+            return false;
+        }
+        if($this->getCookie(session_name()) === null && $this->getCookie('nc_token') === null) {
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Wrapper around session_get_cookie_params
+     *
+     * @return array
+     */
+    protected function getCookieParams() {
+        return session_get_cookie_params();
+    }
+
+    /**
+     * Appends the __Host- prefix to the cookie if applicable
+     *
+     * @param string $name
+     * @return string
+     */
+    protected function getProtectedCookieName($name) {
+        $cookieParams = $this->getCookieParams();
+        $prefix = '';
+        if($cookieParams['secure'] === true && $cookieParams['path'] === '/') {
+            $prefix = '__Host-';
+        }
+
+        return $prefix.$name;
+    }
+
+    /**
+     * Checks if the strict cookie has been sent with the request if the request
+     * is including any cookies.
+     *
+     * @return bool
+     * @since 9.1.0
+     */
+    public function passesStrictCookieCheck() {
+        if(!$this->cookieCheckRequired()) {
+            return true;
+        }
+
+        $cookieName = $this->getProtectedCookieName('nc_sameSiteCookiestrict');
+        if($this->getCookie($cookieName) === 'true'
+            && $this->passesLaxCookieCheck()) {
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Checks if the lax cookie has been sent with the request if the request
+     * is including any cookies.
+     *
+     * @return bool
+     * @since 9.1.0
+     */
+    public function passesLaxCookieCheck() {
+        if(!$this->cookieCheckRequired()) {
+            return true;
+        }
+
+        $cookieName = $this->getProtectedCookieName('nc_sameSiteCookielax');
+        if($this->getCookie($cookieName) === 'true') {
+            return true;
+        }
+        return false;
+    }
+
+
+    /**
+     * Returns an ID for the request, value is not guaranteed to be unique and is mostly meant for logging
+     * If `mod_unique_id` is installed this value will be taken.
+     * @return string
+     */
+    public function getId() {
+        if(isset($this->server['UNIQUE_ID'])) {
+            return $this->server['UNIQUE_ID'];
+        }
+
+        if(empty($this->requestId)) {
+            $this->requestId = $this->secureRandom->generate(20);
+        }
+
+        return $this->requestId;
+    }
+
+    /**
+     * Returns the remote address, if the connection came from a trusted proxy
+     * and `forwarded_for_headers` has been configured then the IP address
+     * specified in this header will be returned instead.
+     * Do always use this instead of $_SERVER['REMOTE_ADDR']
+     * @return string IP address
+     */
+    public function getRemoteAddress() {
+        $remoteAddress = isset($this->server['REMOTE_ADDR']) ? $this->server['REMOTE_ADDR'] : '';
+        $trustedProxies = $this->config->getSystemValue('trusted_proxies', []);
+
+        if(is_array($trustedProxies) && in_array($remoteAddress, $trustedProxies)) {
+            $forwardedForHeaders = $this->config->getSystemValue('forwarded_for_headers', [
+                'HTTP_X_FORWARDED_FOR'
+                // only have one default, so we cannot ship an insecure product out of the box
+            ]);
+
+            foreach($forwardedForHeaders as $header) {
+                if(isset($this->server[$header])) {
+                    foreach(explode(',', $this->server[$header]) as $IP) {
+                        $IP = trim($IP);
+                        if (filter_var($IP, FILTER_VALIDATE_IP) !== false) {
+                            return $IP;
+                        }
+                    }
+                }
+            }
+        }
+
+        return $remoteAddress;
+    }
+
+    /**
+     * Check overwrite condition
+     * @param string $type
+     * @return bool
+     */
+    private function isOverwriteCondition($type = '') {
+        $regex = '/' . $this->config->getSystemValue('overwritecondaddr', '')  . '/';
+        $remoteAddr = isset($this->server['REMOTE_ADDR']) ? $this->server['REMOTE_ADDR'] : '';
+        return $regex === '//' || preg_match($regex, $remoteAddr) === 1
+        || $type !== 'protocol';
+    }
+
+    /**
+     * Returns the server protocol. It respects one or more reverse proxies servers
+     * and load balancers
+     * @return string Server protocol (http or https)
+     */
+    public function getServerProtocol() {
+        if($this->config->getSystemValue('overwriteprotocol') !== ''
+            && $this->isOverwriteCondition('protocol')) {
+            return $this->config->getSystemValue('overwriteprotocol');
+        }
+
+        if (isset($this->server['HTTP_X_FORWARDED_PROTO'])) {
+            if (strpos($this->server['HTTP_X_FORWARDED_PROTO'], ',') !== false) {
+                $parts = explode(',', $this->server['HTTP_X_FORWARDED_PROTO']);
+                $proto = strtolower(trim($parts[0]));
+            } else {
+                $proto = strtolower($this->server['HTTP_X_FORWARDED_PROTO']);
+            }
+
+            // Verify that the protocol is always HTTP or HTTPS
+            // default to http if an invalid value is provided
+            return $proto === 'https' ? 'https' : 'http';
+        }
+
+        if (isset($this->server['HTTPS'])
+            && $this->server['HTTPS'] !== null
+            && $this->server['HTTPS'] !== 'off'
+            && $this->server['HTTPS'] !== '') {
+            return 'https';
+        }
+
+        return 'http';
+    }
+
+    /**
+     * Returns the used HTTP protocol.
+     *
+     * @return string HTTP protocol. HTTP/2, HTTP/1.1 or HTTP/1.0.
+     */
+    public function getHttpProtocol() {
+        $claimedProtocol = strtoupper($this->server['SERVER_PROTOCOL']);
+
+        $validProtocols = [
+            'HTTP/1.0',
+            'HTTP/1.1',
+            'HTTP/2',
+        ];
+
+        if(in_array($claimedProtocol, $validProtocols, true)) {
+            return $claimedProtocol;
+        }
+
+        return 'HTTP/1.1';
+    }
+
+    /**
+     * Returns the request uri, even if the website uses one or more
+     * reverse proxies
+     * @return string
+     */
+    public function getRequestUri() {
+        $uri = isset($this->server['REQUEST_URI']) ? $this->server['REQUEST_URI'] : '';
+        if($this->config->getSystemValue('overwritewebroot') !== '' && $this->isOverwriteCondition()) {
+            $uri = $this->getScriptName() . substr($uri, strlen($this->server['SCRIPT_NAME']));
+        }
+        return $uri;
+    }
+
+    /**
+     * Get raw PathInfo from request (not urldecoded)
+     * @throws \Exception
+     * @return string Path info
+     */
+    public function getRawPathInfo() {
+        $requestUri = isset($this->server['REQUEST_URI']) ? $this->server['REQUEST_URI'] : '';
+        // remove too many leading slashes - can be caused by reverse proxy configuration
+        if (strpos($requestUri, '/') === 0) {
+            $requestUri = '/' . ltrim($requestUri, '/');
+        }
+
+        $requestUri = preg_replace('%/{2,}%', '/', $requestUri);
+
+        // Remove the query string from REQUEST_URI
+        if ($pos = strpos($requestUri, '?')) {
+            $requestUri = substr($requestUri, 0, $pos);
+        }
+
+        $scriptName = $this->server['SCRIPT_NAME'];
+        $pathInfo = $requestUri;
+
+        // strip off the script name's dir and file name
+        // FIXME: Sabre does not really belong here
+        list($path, $name) = \Sabre\HTTP\URLUtil::splitPath($scriptName);
+        if (!empty($path)) {
+            if($path === $pathInfo || strpos($pathInfo, $path.'/') === 0) {
+                $pathInfo = substr($pathInfo, strlen($path));
+            } else {
+                throw new \Exception("The requested uri($requestUri) cannot be processed by the script '$scriptName')");
+            }
+        }
+        if (strpos($pathInfo, '/'.$name) === 0) {
+            $pathInfo = substr($pathInfo, strlen($name) + 1);
+        }
+        if (strpos($pathInfo, $name) === 0) {
+            $pathInfo = substr($pathInfo, strlen($name));
+        }
+        if($pathInfo === false || $pathInfo === '/'){
+            return '';
+        } else {
+            return $pathInfo;
+        }
+    }
+
+    /**
+     * Get PathInfo from request
+     * @throws \Exception
+     * @return string|false Path info or false when not found
+     */
+    public function getPathInfo() {
+        $pathInfo = $this->getRawPathInfo();
+        // following is taken from \Sabre\HTTP\URLUtil::decodePathSegment
+        $pathInfo = rawurldecode($pathInfo);
+        $encoding = mb_detect_encoding($pathInfo, ['UTF-8', 'ISO-8859-1']);
+
+        switch($encoding) {
+            case 'ISO-8859-1' :
+                $pathInfo = utf8_encode($pathInfo);
+        }
+        // end copy
+
+        return $pathInfo;
+    }
+
+    /**
+     * Returns the script name, even if the website uses one or more
+     * reverse proxies
+     * @return string the script name
+     */
+    public function getScriptName() {
+        $name = $this->server['SCRIPT_NAME'];
+        $overwriteWebRoot =  $this->config->getSystemValue('overwritewebroot');
+        if ($overwriteWebRoot !== '' && $this->isOverwriteCondition()) {
+            // FIXME: This code is untestable due to __DIR__, also that hardcoded path is really dangerous
+            $serverRoot = str_replace('\\', '/', substr(__DIR__, 0, -strlen('lib/private/appframework/http/')));
+            $suburi = str_replace('\\', '/', substr(realpath($this->server['SCRIPT_FILENAME']), strlen($serverRoot)));
+            $name = '/' . ltrim($overwriteWebRoot . $suburi, '/');
+        }
+        return $name;
+    }
+
+    /**
+     * Checks whether the user agent matches a given regex
+     * @param array $agent array of agent names
+     * @return bool true if at least one of the given agent matches, false otherwise
+     */
+    public function isUserAgent(array $agent) {
+        if (!isset($this->server['HTTP_USER_AGENT'])) {
+            return false;
+        }
+        foreach ($agent as $regex) {
+            if (preg_match($regex, $this->server['HTTP_USER_AGENT'])) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * Returns the unverified server host from the headers without checking
+     * whether it is a trusted domain
+     * @return string Server host
+     */
+    public function getInsecureServerHost() {
+        $host = 'localhost';
+        if (isset($this->server['HTTP_X_FORWARDED_HOST'])) {
+            if (strpos($this->server['HTTP_X_FORWARDED_HOST'], ',') !== false) {
+                $parts = explode(',', $this->server['HTTP_X_FORWARDED_HOST']);
+                $host = trim(current($parts));
+            } else {
+                $host = $this->server['HTTP_X_FORWARDED_HOST'];
+            }
+        } else {
+            if (isset($this->server['HTTP_HOST'])) {
+                $host = $this->server['HTTP_HOST'];
+            } else if (isset($this->server['SERVER_NAME'])) {
+                $host = $this->server['SERVER_NAME'];
+            }
+        }
+        return $host;
+    }
+
+
+    /**
+     * Returns the server host from the headers, or the first configured
+     * trusted domain if the host isn't in the trusted list
+     * @return string Server host
+     */
+    public function getServerHost() {
+        // overwritehost is always trusted
+        $host = $this->getOverwriteHost();
+        if ($host !== null) {
+            return $host;
+        }
+
+        // get the host from the headers
+        $host = $this->getInsecureServerHost();
+
+        // Verify that the host is a trusted domain if the trusted domains
+        // are defined
+        // If no trusted domain is provided the first trusted domain is returned
+        $trustedDomainHelper = new TrustedDomainHelper($this->config);
+        if ($trustedDomainHelper->isTrustedDomain($host)) {
+            return $host;
+        } else {
+            $trustedList = $this->config->getSystemValue('trusted_domains', []);
+            if(!empty($trustedList)) {
+                return $trustedList[0];
+            } else {
+                return '';
+            }
+        }
+    }
+
+    /**
+     * Returns the overwritehost setting from the config if set and
+     * if the overwrite condition is met
+     * @return string|null overwritehost value or null if not defined or the defined condition
+     * isn't met
+     */
+    private function getOverwriteHost() {
+        if($this->config->getSystemValue('overwritehost') !== '' && $this->isOverwriteCondition()) {
+            return $this->config->getSystemValue('overwritehost');
+        }
+        return null;
+    }
 
 }

Spacing +40 added lines, -40 removed lines

@@ -128,7 +128,7 @@ 
 	 * @param string $stream
 	 * @see http://www.php.net/manual/en/reserved.variables.php
 	 */
-	public function __construct(array $vars=array(),
+	public function __construct(array $vars = array(),
 								ISecureRandom $secureRandom = null,
 								IConfig $config,
 								CsrfTokenManager $csrfTokenManager = null,
@@ -139,11 +139,11 @@ 
 		$this->config = $config;
 		$this->csrfTokenManager = $csrfTokenManager;
 
-		if(!array_key_exists('method', $vars)) {
+		if (!array_key_exists('method', $vars)) {
 			$vars['method'] = 'GET';
 		}
 
-		foreach($this->allowedKeys as $name) {
+		foreach ($this->allowedKeys as $name) {
 			$this->items[$name] = isset($vars[$name])
 				? $vars[$name]
 				: array();
@@ -248,12 +248,12 @@ 
 	* @return mixed|null
 	*/
 	public function __get($name) {
-		switch($name) {
+		switch ($name) {
 			case 'put':
 			case 'patch':
 			case 'get':
 			case 'post':
-				if($this->method !== strtoupper($name)) {
+				if ($this->method !== strtoupper($name)) {
 					throw new \LogicException(sprintf('%s cannot be accessed in a %s request.', $name, $this->method));
 				}
 				return $this->getContent();
@@ -304,14 +304,14 @@ 
 	 */
 	public function getHeader($name) {
 
-		$name = strtoupper(str_replace(array('-'),array('_'),$name));
-		if (isset($this->server['HTTP_' . $name])) {
-			return $this->server['HTTP_' . $name];
+		$name = strtoupper(str_replace(array('-'), array('_'), $name));
+		if (isset($this->server['HTTP_'.$name])) {
+			return $this->server['HTTP_'.$name];
 		}
 
 		// There's a few headers that seem to end up in the top-level
 		// server array.
-		switch($name) {
+		switch ($name) {
 			case 'CONTENT_TYPE' :
 			case 'CONTENT_LENGTH' :
 				if (isset($this->server[$name])) {
@@ -430,21 +430,21 @@ 
 		// 'application/json' must be decoded manually.
 		if (strpos($this->getHeader('Content-Type'), 'application/json') !== false) {
 			$params = json_decode(file_get_contents($this->inputStream), true);
-			if(count($params) > 0) {
+			if (count($params) > 0) {
 				$this->items['params'] = $params;
-				if($this->method === 'POST') {
+				if ($this->method === 'POST') {
 					$this->items['post'] = $params;
 				}
 			}
 
 		// Handle application/x-www-form-urlencoded for methods other than GET
 		// or post correctly
-		} elseif($this->method !== 'GET'
+		} elseif ($this->method !== 'GET'
 				&& $this->method !== 'POST'
 				&& strpos($this->getHeader('Content-Type'), 'application/x-www-form-urlencoded') !== false) {
 
 			parse_str(file_get_contents($this->inputStream), $params);
-			if(is_array($params)) {
+			if (is_array($params)) {
 				$this->items['params'] = $params;
 			}
 		}
@@ -461,11 +461,11 @@ 
 	 * @return bool true if CSRF check passed
 	 */
 	public function passesCSRFCheck() {
-		if($this->csrfTokenManager === null) {
+		if ($this->csrfTokenManager === null) {
 			return false;
 		}
 
-		if(!$this->passesStrictCookieCheck()) {
+		if (!$this->passesStrictCookieCheck()) {
 			return false;
 		}
 
@@ -493,7 +493,7 @@ 
 		if ($this->getHeader('OCS-APIREQUEST')) {
 			return false;
 		}
-		if($this->getCookie(session_name()) === null && $this->getCookie('nc_token') === null) {
+		if ($this->getCookie(session_name()) === null && $this->getCookie('nc_token') === null) {
 			return false;
 		}
 
@@ -518,7 +518,7 @@ 
 	protected function getProtectedCookieName($name) {
 		$cookieParams = $this->getCookieParams();
 		$prefix = '';
-		if($cookieParams['secure'] === true && $cookieParams['path'] === '/') {
+		if ($cookieParams['secure'] === true && $cookieParams['path'] === '/') {
 			$prefix = '__Host-';
 		}
 
@@ -533,12 +533,12 @@ 
 	 * @since 9.1.0
 	 */
 	public function passesStrictCookieCheck() {
-		if(!$this->cookieCheckRequired()) {
+		if (!$this->cookieCheckRequired()) {
 			return true;
 		}
 
 		$cookieName = $this->getProtectedCookieName('nc_sameSiteCookiestrict');
-		if($this->getCookie($cookieName) === 'true'
+		if ($this->getCookie($cookieName) === 'true'
 			&& $this->passesLaxCookieCheck()) {
 			return true;
 		}
@@ -553,12 +553,12 @@ 
 	 * @since 9.1.0
 	 */
 	public function passesLaxCookieCheck() {
-		if(!$this->cookieCheckRequired()) {
+		if (!$this->cookieCheckRequired()) {
 			return true;
 		}
 
 		$cookieName = $this->getProtectedCookieName('nc_sameSiteCookielax');
-		if($this->getCookie($cookieName) === 'true') {
+		if ($this->getCookie($cookieName) === 'true') {
 			return true;
 		}
 		return false;
@@ -571,11 +571,11 @@ 
 	 * @return string
 	 */
 	public function getId() {
-		if(isset($this->server['UNIQUE_ID'])) {
+		if (isset($this->server['UNIQUE_ID'])) {
 			return $this->server['UNIQUE_ID'];
 		}
 
-		if(empty($this->requestId)) {
+		if (empty($this->requestId)) {
 			$this->requestId = $this->secureRandom->generate(20);
 		}
 
@@ -593,15 +593,15 @@ 
 		$remoteAddress = isset($this->server['REMOTE_ADDR']) ? $this->server['REMOTE_ADDR'] : '';
 		$trustedProxies = $this->config->getSystemValue('trusted_proxies', []);
 
-		if(is_array($trustedProxies) && in_array($remoteAddress, $trustedProxies)) {
+		if (is_array($trustedProxies) && in_array($remoteAddress, $trustedProxies)) {
 			$forwardedForHeaders = $this->config->getSystemValue('forwarded_for_headers', [
 				'HTTP_X_FORWARDED_FOR'
 				// only have one default, so we cannot ship an insecure product out of the box
 			]);
 
-			foreach($forwardedForHeaders as $header) {
-				if(isset($this->server[$header])) {
-					foreach(explode(',', $this->server[$header]) as $IP) {
+			foreach ($forwardedForHeaders as $header) {
+				if (isset($this->server[$header])) {
+					foreach (explode(',', $this->server[$header]) as $IP) {
 						$IP = trim($IP);
 						if (filter_var($IP, FILTER_VALIDATE_IP) !== false) {
 							return $IP;
@@ -620,7 +620,7 @@ 
 	 * @return bool
 	 */
 	private function isOverwriteCondition($type = '') {
-		$regex = '/' . $this->config->getSystemValue('overwritecondaddr', '')  . '/';
+		$regex = '/'.$this->config->getSystemValue('overwritecondaddr', '').'/';
 		$remoteAddr = isset($this->server['REMOTE_ADDR']) ? $this->server['REMOTE_ADDR'] : '';
 		return $regex === '//' || preg_match($regex, $remoteAddr) === 1
 		|| $type !== 'protocol';
@@ -632,7 +632,7 @@ 
 	 * @return string Server protocol (http or https)
 	 */
 	public function getServerProtocol() {
-		if($this->config->getSystemValue('overwriteprotocol') !== ''
+		if ($this->config->getSystemValue('overwriteprotocol') !== ''
 			&& $this->isOverwriteCondition('protocol')) {
 			return $this->config->getSystemValue('overwriteprotocol');
 		}
@@ -674,7 +674,7 @@ 
 			'HTTP/2',
 		];
 
-		if(in_array($claimedProtocol, $validProtocols, true)) {
+		if (in_array($claimedProtocol, $validProtocols, true)) {
 			return $claimedProtocol;
 		}
 
@@ -688,8 +688,8 @@ 
 	 */
 	public function getRequestUri() {
 		$uri = isset($this->server['REQUEST_URI']) ? $this->server['REQUEST_URI'] : '';
-		if($this->config->getSystemValue('overwritewebroot') !== '' && $this->isOverwriteCondition()) {
-			$uri = $this->getScriptName() . substr($uri, strlen($this->server['SCRIPT_NAME']));
+		if ($this->config->getSystemValue('overwritewebroot') !== '' && $this->isOverwriteCondition()) {
+			$uri = $this->getScriptName().substr($uri, strlen($this->server['SCRIPT_NAME']));
 		}
 		return $uri;
 	}
@@ -703,7 +703,7 @@ 
 		$requestUri = isset($this->server['REQUEST_URI']) ? $this->server['REQUEST_URI'] : '';
 		// remove too many leading slashes - can be caused by reverse proxy configuration
 		if (strpos($requestUri, '/') === 0) {
-			$requestUri = '/' . ltrim($requestUri, '/');
+			$requestUri = '/'.ltrim($requestUri, '/');
 		}
 
 		$requestUri = preg_replace('%/{2,}%', '/', $requestUri);
@@ -720,7 +720,7 @@ 
 		// FIXME: Sabre does not really belong here
 		list($path, $name) = \Sabre\HTTP\URLUtil::splitPath($scriptName);
 		if (!empty($path)) {
-			if($path === $pathInfo || strpos($pathInfo, $path.'/') === 0) {
+			if ($path === $pathInfo || strpos($pathInfo, $path.'/') === 0) {
 				$pathInfo = substr($pathInfo, strlen($path));
 			} else {
 				throw new \Exception("The requested uri($requestUri) cannot be processed by the script '$scriptName')");
@@ -732,7 +732,7 @@ 
 		if (strpos($pathInfo, $name) === 0) {
 			$pathInfo = substr($pathInfo, strlen($name));
 		}
-		if($pathInfo === false || $pathInfo === '/'){
+		if ($pathInfo === false || $pathInfo === '/') {
 			return '';
 		} else {
 			return $pathInfo;
@@ -750,7 +750,7 @@ 
 		$pathInfo = rawurldecode($pathInfo);
 		$encoding = mb_detect_encoding($pathInfo, ['UTF-8', 'ISO-8859-1']);
 
-		switch($encoding) {
+		switch ($encoding) {
 			case 'ISO-8859-1' :
 				$pathInfo = utf8_encode($pathInfo);
 		}
@@ -766,12 +766,12 @@ 
 	 */
 	public function getScriptName() {
 		$name = $this->server['SCRIPT_NAME'];
-		$overwriteWebRoot =  $this->config->getSystemValue('overwritewebroot');
+		$overwriteWebRoot = $this->config->getSystemValue('overwritewebroot');
 		if ($overwriteWebRoot !== '' && $this->isOverwriteCondition()) {
 			// FIXME: This code is untestable due to __DIR__, also that hardcoded path is really dangerous
 			$serverRoot = str_replace('\\', '/', substr(__DIR__, 0, -strlen('lib/private/appframework/http/')));
 			$suburi = str_replace('\\', '/', substr(realpath($this->server['SCRIPT_FILENAME']), strlen($serverRoot)));
-			$name = '/' . ltrim($overwriteWebRoot . $suburi, '/');
+			$name = '/'.ltrim($overwriteWebRoot.$suburi, '/');
 		}
 		return $name;
 	}
@@ -841,7 +841,7 @@ 
 			return $host;
 		} else {
 			$trustedList = $this->config->getSystemValue('trusted_domains', []);
-			if(!empty($trustedList)) {
+			if (!empty($trustedList)) {
 				return $trustedList[0];
 			} else {
 				return '';
@@ -856,7 +856,7 @@ 
 	 * isn't met
 	 */
 	private function getOverwriteHost() {
-		if($this->config->getSystemValue('overwritehost') !== '' && $this->isOverwriteCondition()) {
+		if ($this->config->getSystemValue('overwritehost') !== '' && $this->isOverwriteCondition()) {
 			return $this->config->getSystemValue('overwritehost');
 		}
 		return null;

lib/private/User/User.php

Indentation +398 added lines, -398 removed lines

@@ -42,402 +42,402 @@
 use \OCP\IUserBackend;
 
 class User implements IUser {
-	/** @var string $uid */
-	private $uid;
-
-	/** @var string $displayName */
-	private $displayName;
-
-	/** @var UserInterface $backend */
-	private $backend;
-
-	/** @var bool $enabled */
-	private $enabled;
-
-	/** @var Emitter|Manager $emitter */
-	private $emitter;
-
-	/** @var string $home */
-	private $home;
-
-	/** @var int $lastLogin */
-	private $lastLogin;
-
-	/** @var \OCP\IConfig $config */
-	private $config;
-
-	/** @var IAvatarManager */
-	private $avatarManager;
-
-	/** @var IURLGenerator */
-	private $urlGenerator;
-
-	/**
-	 * @param string $uid
-	 * @param UserInterface $backend
-	 * @param \OC\Hooks\Emitter $emitter
-	 * @param IConfig|null $config
-	 * @param IURLGenerator $urlGenerator
-	 */
-	public function __construct($uid, $backend, $emitter = null, IConfig $config = null, $urlGenerator = null) {
-		$this->uid = $uid;
-		$this->backend = $backend;
-		$this->emitter = $emitter;
-		if(is_null($config)) {
-			$config = \OC::$server->getConfig();
-		}
-		$this->config = $config;
-		$this->urlGenerator = $urlGenerator;
-		$enabled = $this->config->getUserValue($uid, 'core', 'enabled', 'true');
-		$this->enabled = ($enabled === 'true');
-		$this->lastLogin = $this->config->getUserValue($uid, 'login', 'lastLogin', 0);
-		if (is_null($this->urlGenerator)) {
-			$this->urlGenerator = \OC::$server->getURLGenerator();
-		}
-	}
-
-	/**
-	 * get the user id
-	 *
-	 * @return string
-	 */
-	public function getUID() {
-		return $this->uid;
-	}
-
-	/**
-	 * get the display name for the user, if no specific display name is set it will fallback to the user id
-	 *
-	 * @return string
-	 */
-	public function getDisplayName() {
-		if (!isset($this->displayName)) {
-			$displayName = '';
-			if ($this->backend and $this->backend->implementsActions(Backend::GET_DISPLAYNAME)) {
-				// get display name and strip whitespace from the beginning and end of it
-				$backendDisplayName = $this->backend->getDisplayName($this->uid);
-				if (is_string($backendDisplayName)) {
-					$displayName = trim($backendDisplayName);
-				}
-			}
-
-			if (!empty($displayName)) {
-				$this->displayName = $displayName;
-			} else {
-				$this->displayName = $this->uid;
-			}
-		}
-		return $this->displayName;
-	}
-
-	/**
-	 * set the displayname for the user
-	 *
-	 * @param string $displayName
-	 * @return bool
-	 */
-	public function setDisplayName($displayName) {
-		$displayName = trim($displayName);
-		if ($this->backend->implementsActions(Backend::SET_DISPLAYNAME) && !empty($displayName)) {
-			$result = $this->backend->setDisplayName($this->uid, $displayName);
-			if ($result) {
-				$this->displayName = $displayName;
-				$this->triggerChange('displayName', $displayName);
-			}
-			return $result !== false;
-		} else {
-			return false;
-		}
-	}
-
-	/**
-	 * set the email address of the user
-	 *
-	 * @param string|null $mailAddress
-	 * @return void
-	 * @since 9.0.0
-	 */
-	public function setEMailAddress($mailAddress) {
-		if($mailAddress === '') {
-			$this->config->deleteUserValue($this->uid, 'settings', 'email');
-		} else {
-			$this->config->setUserValue($this->uid, 'settings', 'email', $mailAddress);
-		}
-		$this->triggerChange('eMailAddress', $mailAddress);
-	}
-
-	/**
-	 * returns the timestamp of the user's last login or 0 if the user did never
-	 * login
-	 *
-	 * @return int
-	 */
-	public function getLastLogin() {
-		return $this->lastLogin;
-	}
-
-	/**
-	 * updates the timestamp of the most recent login of this user
-	 */
-	public function updateLastLoginTimestamp() {
-		$firstTimeLogin = ($this->lastLogin === 0);
-		$this->lastLogin = time();
-		$this->config->setUserValue(
-			$this->uid, 'login', 'lastLogin', $this->lastLogin);
-
-		return $firstTimeLogin;
-	}
-
-	/**
-	 * Delete the user
-	 *
-	 * @return bool
-	 */
-	public function delete() {
-		if ($this->emitter) {
-			$this->emitter->emit('\OC\User', 'preDelete', array($this));
-		}
-		// get the home now because it won't return it after user deletion
-		$homePath = $this->getHome();
-		$result = $this->backend->deleteUser($this->uid);
-		if ($result) {
-
-			// FIXME: Feels like an hack - suggestions?
-
-			$groupManager = \OC::$server->getGroupManager();
-			// We have to delete the user from all groups
-			foreach ($groupManager->getUserGroupIds($this) as $groupId) {
-				$group = $groupManager->get($groupId);
-				if ($group) {
-					\OC_Hook::emit("OC_Group", "pre_removeFromGroup", ["run" => true, "uid" => $this->uid, "gid" => $groupId]);
-					$group->removeUser($this);
-					\OC_Hook::emit("OC_User", "post_removeFromGroup", ["uid" => $this->uid, "gid" => $groupId]);
-				}
-			}
-			// Delete the user's keys in preferences
-			\OC::$server->getConfig()->deleteAllUserValues($this->uid);
-
-			// Delete user files in /data/
-			if ($homePath !== false) {
-				// FIXME: this operates directly on FS, should use View instead...
-				// also this is not testable/mockable...
-				\OC_Helper::rmdirr($homePath);
-			}
-
-			// Delete the users entry in the storage table
-			Storage::remove('home::' . $this->uid);
-
-			\OC::$server->getCommentsManager()->deleteReferencesOfActor('users', $this->uid);
-			\OC::$server->getCommentsManager()->deleteReadMarksFromUser($this);
-
-			$notification = \OC::$server->getNotificationManager()->createNotification();
-			$notification->setUser($this->uid);
-			\OC::$server->getNotificationManager()->markProcessed($notification);
-
-			if ($this->emitter) {
-				$this->emitter->emit('\OC\User', 'postDelete', array($this));
-			}
-		}
-		return !($result === false);
-	}
-
-	/**
-	 * Set the password of the user
-	 *
-	 * @param string $password
-	 * @param string $recoveryPassword for the encryption app to reset encryption keys
-	 * @return bool
-	 */
-	public function setPassword($password, $recoveryPassword = null) {
-		if ($this->emitter) {
-			$this->emitter->emit('\OC\User', 'preSetPassword', array($this, $password, $recoveryPassword));
-		}
-		if ($this->backend->implementsActions(Backend::SET_PASSWORD)) {
-			$result = $this->backend->setPassword($this->uid, $password);
-			if ($this->emitter) {
-				$this->emitter->emit('\OC\User', 'postSetPassword', array($this, $password, $recoveryPassword));
-			}
-			return !($result === false);
-		} else {
-			return false;
-		}
-	}
-
-	/**
-	 * get the users home folder to mount
-	 *
-	 * @return string
-	 */
-	public function getHome() {
-		if (!$this->home) {
-			if ($this->backend->implementsActions(Backend::GET_HOME) and $home = $this->backend->getHome($this->uid)) {
-				$this->home = $home;
-			} elseif ($this->config) {
-				$this->home = $this->config->getSystemValue('datadirectory', \OC::$SERVERROOT . '/data') . '/' . $this->uid;
-			} else {
-				$this->home = \OC::$SERVERROOT . '/data/' . $this->uid;
-			}
-		}
-		return $this->home;
-	}
-
-	/**
-	 * Get the name of the backend class the user is connected with
-	 *
-	 * @return string
-	 */
-	public function getBackendClassName() {
-		if($this->backend instanceof IUserBackend) {
-			return $this->backend->getBackendName();
-		}
-		return get_class($this->backend);
-	}
-
-	/**
-	 * check if the backend allows the user to change his avatar on Personal page
-	 *
-	 * @return bool
-	 */
-	public function canChangeAvatar() {
-		if ($this->backend->implementsActions(Backend::PROVIDE_AVATAR)) {
-			return $this->backend->canChangeAvatar($this->uid);
-		}
-		return true;
-	}
-
-	/**
-	 * check if the backend supports changing passwords
-	 *
-	 * @return bool
-	 */
-	public function canChangePassword() {
-		return $this->backend->implementsActions(Backend::SET_PASSWORD);
-	}
-
-	/**
-	 * check if the backend supports changing display names
-	 *
-	 * @return bool
-	 */
-	public function canChangeDisplayName() {
-		if ($this->config->getSystemValue('allow_user_to_change_display_name') === false) {
-			return false;
-		}
-		return $this->backend->implementsActions(Backend::SET_DISPLAYNAME);
-	}
-
-	/**
-	 * check if the user is enabled
-	 *
-	 * @return bool
-	 */
-	public function isEnabled() {
-		return $this->enabled;
-	}
-
-	/**
-	 * set the enabled status for the user
-	 *
-	 * @param bool $enabled
-	 */
-	public function setEnabled($enabled) {
-		$this->enabled = $enabled;
-		$enabled = ($enabled) ? 'true' : 'false';
-		$this->config->setUserValue($this->uid, 'core', 'enabled', $enabled);
-	}
-
-	/**
-	 * get the users email address
-	 *
-	 * @return string|null
-	 * @since 9.0.0
-	 */
-	public function getEMailAddress() {
-		return $this->config->getUserValue($this->uid, 'settings', 'email', null);
-	}
-
-	/**
-	 * get the users' quota
-	 *
-	 * @return string
-	 * @since 9.0.0
-	 */
-	public function getQuota() {
-		$quota = $this->config->getUserValue($this->uid, 'files', 'quota', 'default');
-		if($quota === 'default') {
-			$quota = $this->config->getAppValue('files', 'default_quota', 'none');
-		}
-		return $quota;
-	}
-
-	/**
-	 * set the users' quota
-	 *
-	 * @param string $quota
-	 * @return void
-	 * @since 9.0.0
-	 */
-	public function setQuota($quota) {
-		if($quota !== 'none' and $quota !== 'default') {
-			$quota = OC_Helper::computerFileSize($quota);
-			$quota = OC_Helper::humanFileSize($quota);
-		}
-		$this->config->setUserValue($this->uid, 'files', 'quota', $quota);
-		$this->triggerChange('quota', $quota);
-	}
-
-	/**
-	 * get the avatar image if it exists
-	 *
-	 * @param int $size
-	 * @return IImage|null
-	 * @since 9.0.0
-	 */
-	public function getAvatarImage($size) {
-		// delay the initialization
-		if (is_null($this->avatarManager)) {
-			$this->avatarManager = \OC::$server->getAvatarManager();
-		}
-
-		$avatar = $this->avatarManager->getAvatar($this->uid);
-		$image = $avatar->get(-1);
-		if ($image) {
-			return $image;
-		}
-
-		return null;
-	}
-
-	/**
-	 * get the federation cloud id
-	 *
-	 * @return string
-	 * @since 9.0.0
-	 */
-	public function getCloudId() {
-		$uid = $this->getUID();
-		$server = $this->urlGenerator->getAbsoluteURL('/');
-		$server =  rtrim( $this->removeProtocolFromUrl($server), '/');
-		return \OC::$server->getCloudIdManager()->getCloudId($uid, $server)->getId();
-	}
-
-	/**
-	 * @param string $url
-	 * @return string
-	 */
-	private function removeProtocolFromUrl($url) {
-		if (strpos($url, 'https://') === 0) {
-			return substr($url, strlen('https://'));
-		} else if (strpos($url, 'http://') === 0) {
-			return substr($url, strlen('http://'));
-		}
-
-		return $url;
-	}
-
-	public function triggerChange($feature, $value = null) {
-		if ($this->emitter) {
-			$this->emitter->emit('\OC\User', 'changeUser', array($this, $feature, $value));
-		}
-	}
+    /** @var string $uid */
+    private $uid;
+
+    /** @var string $displayName */
+    private $displayName;
+
+    /** @var UserInterface $backend */
+    private $backend;
+
+    /** @var bool $enabled */
+    private $enabled;
+
+    /** @var Emitter|Manager $emitter */
+    private $emitter;
+
+    /** @var string $home */
+    private $home;
+
+    /** @var int $lastLogin */
+    private $lastLogin;
+
+    /** @var \OCP\IConfig $config */
+    private $config;
+
+    /** @var IAvatarManager */
+    private $avatarManager;
+
+    /** @var IURLGenerator */
+    private $urlGenerator;
+
+    /**
+     * @param string $uid
+     * @param UserInterface $backend
+     * @param \OC\Hooks\Emitter $emitter
+     * @param IConfig|null $config
+     * @param IURLGenerator $urlGenerator
+     */
+    public function __construct($uid, $backend, $emitter = null, IConfig $config = null, $urlGenerator = null) {
+        $this->uid = $uid;
+        $this->backend = $backend;
+        $this->emitter = $emitter;
+        if(is_null($config)) {
+            $config = \OC::$server->getConfig();
+        }
+        $this->config = $config;
+        $this->urlGenerator = $urlGenerator;
+        $enabled = $this->config->getUserValue($uid, 'core', 'enabled', 'true');
+        $this->enabled = ($enabled === 'true');
+        $this->lastLogin = $this->config->getUserValue($uid, 'login', 'lastLogin', 0);
+        if (is_null($this->urlGenerator)) {
+            $this->urlGenerator = \OC::$server->getURLGenerator();
+        }
+    }
+
+    /**
+     * get the user id
+     *
+     * @return string
+     */
+    public function getUID() {
+        return $this->uid;
+    }
+
+    /**
+     * get the display name for the user, if no specific display name is set it will fallback to the user id
+     *
+     * @return string
+     */
+    public function getDisplayName() {
+        if (!isset($this->displayName)) {
+            $displayName = '';
+            if ($this->backend and $this->backend->implementsActions(Backend::GET_DISPLAYNAME)) {
+                // get display name and strip whitespace from the beginning and end of it
+                $backendDisplayName = $this->backend->getDisplayName($this->uid);
+                if (is_string($backendDisplayName)) {
+                    $displayName = trim($backendDisplayName);
+                }
+            }
+
+            if (!empty($displayName)) {
+                $this->displayName = $displayName;
+            } else {
+                $this->displayName = $this->uid;
+            }
+        }
+        return $this->displayName;
+    }
+
+    /**
+     * set the displayname for the user
+     *
+     * @param string $displayName
+     * @return bool
+     */
+    public function setDisplayName($displayName) {
+        $displayName = trim($displayName);
+        if ($this->backend->implementsActions(Backend::SET_DISPLAYNAME) && !empty($displayName)) {
+            $result = $this->backend->setDisplayName($this->uid, $displayName);
+            if ($result) {
+                $this->displayName = $displayName;
+                $this->triggerChange('displayName', $displayName);
+            }
+            return $result !== false;
+        } else {
+            return false;
+        }
+    }
+
+    /**
+     * set the email address of the user
+     *
+     * @param string|null $mailAddress
+     * @return void
+     * @since 9.0.0
+     */
+    public function setEMailAddress($mailAddress) {
+        if($mailAddress === '') {
+            $this->config->deleteUserValue($this->uid, 'settings', 'email');
+        } else {
+            $this->config->setUserValue($this->uid, 'settings', 'email', $mailAddress);
+        }
+        $this->triggerChange('eMailAddress', $mailAddress);
+    }
+
+    /**
+     * returns the timestamp of the user's last login or 0 if the user did never
+     * login
+     *
+     * @return int
+     */
+    public function getLastLogin() {
+        return $this->lastLogin;
+    }
+
+    /**
+     * updates the timestamp of the most recent login of this user
+     */
+    public function updateLastLoginTimestamp() {
+        $firstTimeLogin = ($this->lastLogin === 0);
+        $this->lastLogin = time();
+        $this->config->setUserValue(
+            $this->uid, 'login', 'lastLogin', $this->lastLogin);
+
+        return $firstTimeLogin;
+    }
+
+    /**
+     * Delete the user
+     *
+     * @return bool
+     */
+    public function delete() {
+        if ($this->emitter) {
+            $this->emitter->emit('\OC\User', 'preDelete', array($this));
+        }
+        // get the home now because it won't return it after user deletion
+        $homePath = $this->getHome();
+        $result = $this->backend->deleteUser($this->uid);
+        if ($result) {
+
+            // FIXME: Feels like an hack - suggestions?
+
+            $groupManager = \OC::$server->getGroupManager();
+            // We have to delete the user from all groups
+            foreach ($groupManager->getUserGroupIds($this) as $groupId) {
+                $group = $groupManager->get($groupId);
+                if ($group) {
+                    \OC_Hook::emit("OC_Group", "pre_removeFromGroup", ["run" => true, "uid" => $this->uid, "gid" => $groupId]);
+                    $group->removeUser($this);
+                    \OC_Hook::emit("OC_User", "post_removeFromGroup", ["uid" => $this->uid, "gid" => $groupId]);
+                }
+            }
+            // Delete the user's keys in preferences
+            \OC::$server->getConfig()->deleteAllUserValues($this->uid);
+
+            // Delete user files in /data/
+            if ($homePath !== false) {
+                // FIXME: this operates directly on FS, should use View instead...
+                // also this is not testable/mockable...
+                \OC_Helper::rmdirr($homePath);
+            }
+
+            // Delete the users entry in the storage table
+            Storage::remove('home::' . $this->uid);
+
+            \OC::$server->getCommentsManager()->deleteReferencesOfActor('users', $this->uid);
+            \OC::$server->getCommentsManager()->deleteReadMarksFromUser($this);
+
+            $notification = \OC::$server->getNotificationManager()->createNotification();
+            $notification->setUser($this->uid);
+            \OC::$server->getNotificationManager()->markProcessed($notification);
+
+            if ($this->emitter) {
+                $this->emitter->emit('\OC\User', 'postDelete', array($this));
+            }
+        }
+        return !($result === false);
+    }
+
+    /**
+     * Set the password of the user
+     *
+     * @param string $password
+     * @param string $recoveryPassword for the encryption app to reset encryption keys
+     * @return bool
+     */
+    public function setPassword($password, $recoveryPassword = null) {
+        if ($this->emitter) {
+            $this->emitter->emit('\OC\User', 'preSetPassword', array($this, $password, $recoveryPassword));
+        }
+        if ($this->backend->implementsActions(Backend::SET_PASSWORD)) {
+            $result = $this->backend->setPassword($this->uid, $password);
+            if ($this->emitter) {
+                $this->emitter->emit('\OC\User', 'postSetPassword', array($this, $password, $recoveryPassword));
+            }
+            return !($result === false);
+        } else {
+            return false;
+        }
+    }
+
+    /**
+     * get the users home folder to mount
+     *
+     * @return string
+     */
+    public function getHome() {
+        if (!$this->home) {
+            if ($this->backend->implementsActions(Backend::GET_HOME) and $home = $this->backend->getHome($this->uid)) {
+                $this->home = $home;
+            } elseif ($this->config) {
+                $this->home = $this->config->getSystemValue('datadirectory', \OC::$SERVERROOT . '/data') . '/' . $this->uid;
+            } else {
+                $this->home = \OC::$SERVERROOT . '/data/' . $this->uid;
+            }
+        }
+        return $this->home;
+    }
+
+    /**
+     * Get the name of the backend class the user is connected with
+     *
+     * @return string
+     */
+    public function getBackendClassName() {
+        if($this->backend instanceof IUserBackend) {
+            return $this->backend->getBackendName();
+        }
+        return get_class($this->backend);
+    }
+
+    /**
+     * check if the backend allows the user to change his avatar on Personal page
+     *
+     * @return bool
+     */
+    public function canChangeAvatar() {
+        if ($this->backend->implementsActions(Backend::PROVIDE_AVATAR)) {
+            return $this->backend->canChangeAvatar($this->uid);
+        }
+        return true;
+    }
+
+    /**
+     * check if the backend supports changing passwords
+     *
+     * @return bool
+     */
+    public function canChangePassword() {
+        return $this->backend->implementsActions(Backend::SET_PASSWORD);
+    }
+
+    /**
+     * check if the backend supports changing display names
+     *
+     * @return bool
+     */
+    public function canChangeDisplayName() {
+        if ($this->config->getSystemValue('allow_user_to_change_display_name') === false) {
+            return false;
+        }
+        return $this->backend->implementsActions(Backend::SET_DISPLAYNAME);
+    }
+
+    /**
+     * check if the user is enabled
+     *
+     * @return bool
+     */
+    public function isEnabled() {
+        return $this->enabled;
+    }
+
+    /**
+     * set the enabled status for the user
+     *
+     * @param bool $enabled
+     */
+    public function setEnabled($enabled) {
+        $this->enabled = $enabled;
+        $enabled = ($enabled) ? 'true' : 'false';
+        $this->config->setUserValue($this->uid, 'core', 'enabled', $enabled);
+    }
+
+    /**
+     * get the users email address
+     *
+     * @return string|null
+     * @since 9.0.0
+     */
+    public function getEMailAddress() {
+        return $this->config->getUserValue($this->uid, 'settings', 'email', null);
+    }
+
+    /**
+     * get the users' quota
+     *
+     * @return string
+     * @since 9.0.0
+     */
+    public function getQuota() {
+        $quota = $this->config->getUserValue($this->uid, 'files', 'quota', 'default');
+        if($quota === 'default') {
+            $quota = $this->config->getAppValue('files', 'default_quota', 'none');
+        }
+        return $quota;
+    }
+
+    /**
+     * set the users' quota
+     *
+     * @param string $quota
+     * @return void
+     * @since 9.0.0
+     */
+    public function setQuota($quota) {
+        if($quota !== 'none' and $quota !== 'default') {
+            $quota = OC_Helper::computerFileSize($quota);
+            $quota = OC_Helper::humanFileSize($quota);
+        }
+        $this->config->setUserValue($this->uid, 'files', 'quota', $quota);
+        $this->triggerChange('quota', $quota);
+    }
+
+    /**
+     * get the avatar image if it exists
+     *
+     * @param int $size
+     * @return IImage|null
+     * @since 9.0.0
+     */
+    public function getAvatarImage($size) {
+        // delay the initialization
+        if (is_null($this->avatarManager)) {
+            $this->avatarManager = \OC::$server->getAvatarManager();
+        }
+
+        $avatar = $this->avatarManager->getAvatar($this->uid);
+        $image = $avatar->get(-1);
+        if ($image) {
+            return $image;
+        }
+
+        return null;
+    }
+
+    /**
+     * get the federation cloud id
+     *
+     * @return string
+     * @since 9.0.0
+     */
+    public function getCloudId() {
+        $uid = $this->getUID();
+        $server = $this->urlGenerator->getAbsoluteURL('/');
+        $server =  rtrim( $this->removeProtocolFromUrl($server), '/');
+        return \OC::$server->getCloudIdManager()->getCloudId($uid, $server)->getId();
+    }
+
+    /**
+     * @param string $url
+     * @return string
+     */
+    private function removeProtocolFromUrl($url) {
+        if (strpos($url, 'https://') === 0) {
+            return substr($url, strlen('https://'));
+        } else if (strpos($url, 'http://') === 0) {
+            return substr($url, strlen('http://'));
+        }
+
+        return $url;
+    }
+
+    public function triggerChange($feature, $value = null) {
+        if ($this->emitter) {
+            $this->emitter->emit('\OC\User', 'changeUser', array($this, $feature, $value));
+        }
+    }
 }

lib/base.php

Indentation +986 added lines, -986 removed lines

@@ -59,992 +59,992 @@
  * OC_autoload!
  */
 class OC {
-	/**
-	 * Associative array for autoloading. classname => filename
-	 */
-	public static $CLASSPATH = array();
-	/**
-	 * The installation path for Nextcloud  on the server (e.g. /srv/http/nextcloud)
-	 */
-	public static $SERVERROOT = '';
-	/**
-	 * the current request path relative to the Nextcloud root (e.g. files/index.php)
-	 */
-	private static $SUBURI = '';
-	/**
-	 * the Nextcloud root path for http requests (e.g. nextcloud/)
-	 */
-	public static $WEBROOT = '';
-	/**
-	 * The installation path array of the apps folder on the server (e.g. /srv/http/nextcloud) 'path' and
-	 * web path in 'url'
-	 */
-	public static $APPSROOTS = array();
-
-	/**
-	 * @var string
-	 */
-	public static $configDir;
-
-	/**
-	 * requested app
-	 */
-	public static $REQUESTEDAPP = '';
-
-	/**
-	 * check if Nextcloud runs in cli mode
-	 */
-	public static $CLI = false;
-
-	/**
-	 * @var \OC\Autoloader $loader
-	 */
-	public static $loader = null;
-
-	/** @var \Composer\Autoload\ClassLoader $composerAutoloader */
-	public static $composerAutoloader = null;
-
-	/**
-	 * @var \OC\Server
-	 */
-	public static $server = null;
-
-	/**
-	 * @var \OC\Config
-	 */
-	private static $config = null;
-
-	/**
-	 * @throws \RuntimeException when the 3rdparty directory is missing or
-	 * the app path list is empty or contains an invalid path
-	 */
-	public static function initPaths() {
-		if(defined('PHPUNIT_CONFIG_DIR')) {
-			self::$configDir = OC::$SERVERROOT . '/' . PHPUNIT_CONFIG_DIR . '/';
-		} elseif(defined('PHPUNIT_RUN') and PHPUNIT_RUN and is_dir(OC::$SERVERROOT . '/tests/config/')) {
-			self::$configDir = OC::$SERVERROOT . '/tests/config/';
-		} elseif($dir = getenv('NEXTCLOUD_CONFIG_DIR')) {
-			self::$configDir = rtrim($dir, '/') . '/';
-		} else {
-			self::$configDir = OC::$SERVERROOT . '/config/';
-		}
-		self::$config = new \OC\Config(self::$configDir);
-
-		OC::$SUBURI = str_replace("\\", "/", substr(realpath($_SERVER["SCRIPT_FILENAME"]), strlen(OC::$SERVERROOT)));
-		/**
-		 * FIXME: The following lines are required because we can't yet instantiiate
-		 *        \OC::$server->getRequest() since \OC::$server does not yet exist.
-		 */
-		$params = [
-			'server' => [
-				'SCRIPT_NAME' => $_SERVER['SCRIPT_NAME'],
-				'SCRIPT_FILENAME' => $_SERVER['SCRIPT_FILENAME'],
-			],
-		];
-		$fakeRequest = new \OC\AppFramework\Http\Request($params, null, new \OC\AllConfig(new \OC\SystemConfig(self::$config)));
-		$scriptName = $fakeRequest->getScriptName();
-		if (substr($scriptName, -1) == '/') {
-			$scriptName .= 'index.php';
-			//make sure suburi follows the same rules as scriptName
-			if (substr(OC::$SUBURI, -9) != 'index.php') {
-				if (substr(OC::$SUBURI, -1) != '/') {
-					OC::$SUBURI = OC::$SUBURI . '/';
-				}
-				OC::$SUBURI = OC::$SUBURI . 'index.php';
-			}
-		}
-
-
-		if (OC::$CLI) {
-			OC::$WEBROOT = self::$config->getValue('overwritewebroot', '');
-		} else {
-			if (substr($scriptName, 0 - strlen(OC::$SUBURI)) === OC::$SUBURI) {
-				OC::$WEBROOT = substr($scriptName, 0, 0 - strlen(OC::$SUBURI));
-
-				if (OC::$WEBROOT != '' && OC::$WEBROOT[0] !== '/') {
-					OC::$WEBROOT = '/' . OC::$WEBROOT;
-				}
-			} else {
-				// The scriptName is not ending with OC::$SUBURI
-				// This most likely means that we are calling from CLI.
-				// However some cron jobs still need to generate
-				// a web URL, so we use overwritewebroot as a fallback.
-				OC::$WEBROOT = self::$config->getValue('overwritewebroot', '');
-			}
-
-			// Resolve /nextcloud to /nextcloud/ to ensure to always have a trailing
-			// slash which is required by URL generation.
-			if($_SERVER['REQUEST_URI'] === \OC::$WEBROOT &&
-					substr($_SERVER['REQUEST_URI'], -1) !== '/') {
-				header('Location: '.\OC::$WEBROOT.'/');
-				exit();
-			}
-		}
-
-		// search the apps folder
-		$config_paths = self::$config->getValue('apps_paths', array());
-		if (!empty($config_paths)) {
-			foreach ($config_paths as $paths) {
-				if (isset($paths['url']) && isset($paths['path'])) {
-					$paths['url'] = rtrim($paths['url'], '/');
-					$paths['path'] = rtrim($paths['path'], '/');
-					OC::$APPSROOTS[] = $paths;
-				}
-			}
-		} elseif (file_exists(OC::$SERVERROOT . '/apps')) {
-			OC::$APPSROOTS[] = array('path' => OC::$SERVERROOT . '/apps', 'url' => '/apps', 'writable' => true);
-		} elseif (file_exists(OC::$SERVERROOT . '/../apps')) {
-			OC::$APPSROOTS[] = array(
-				'path' => rtrim(dirname(OC::$SERVERROOT), '/') . '/apps',
-				'url' => '/apps',
-				'writable' => true
-			);
-		}
-
-		if (empty(OC::$APPSROOTS)) {
-			throw new \RuntimeException('apps directory not found! Please put the Nextcloud apps folder in the Nextcloud folder'
-				. ' or the folder above. You can also configure the location in the config.php file.');
-		}
-		$paths = array();
-		foreach (OC::$APPSROOTS as $path) {
-			$paths[] = $path['path'];
-			if (!is_dir($path['path'])) {
-				throw new \RuntimeException(sprintf('App directory "%s" not found! Please put the Nextcloud apps folder in the'
-					. ' Nextcloud folder or the folder above. You can also configure the location in the'
-					. ' config.php file.', $path['path']));
-			}
-		}
-
-		// set the right include path
-		set_include_path(
-			implode(PATH_SEPARATOR, $paths)
-		);
-	}
-
-	public static function checkConfig() {
-		$l = \OC::$server->getL10N('lib');
-
-		// Create config if it does not already exist
-		$configFilePath = self::$configDir .'/config.php';
-		if(!file_exists($configFilePath)) {
-			@touch($configFilePath);
-		}
-
-		// Check if config is writable
-		$configFileWritable = is_writable($configFilePath);
-		if (!$configFileWritable && !OC_Helper::isReadOnlyConfigEnabled()
-			|| !$configFileWritable && self::checkUpgrade(false)) {
-
-			$urlGenerator = \OC::$server->getURLGenerator();
-
-			if (self::$CLI) {
-				echo $l->t('Cannot write into "config" directory!')."\n";
-				echo $l->t('This can usually be fixed by giving the webserver write access to the config directory')."\n";
-				echo "\n";
-				echo $l->t('See %s', [ $urlGenerator->linkToDocs('admin-dir_permissions') ])."\n";
-				exit;
-			} else {
-				OC_Template::printErrorPage(
-					$l->t('Cannot write into "config" directory!'),
-					$l->t('This can usually be fixed by '
-					. '%sgiving the webserver write access to the config directory%s.',
-					 array('<a href="' . $urlGenerator->linkToDocs('admin-dir_permissions') . '" target="_blank" rel="noreferrer">', '</a>'))
-				);
-			}
-		}
-	}
-
-	public static function checkInstalled() {
-		if (defined('OC_CONSOLE')) {
-			return;
-		}
-		// Redirect to installer if not installed
-		if (!\OC::$server->getSystemConfig()->getValue('installed', false) && OC::$SUBURI !== '/index.php' && OC::$SUBURI !== '/status.php') {
-			if (OC::$CLI) {
-				throw new Exception('Not installed');
-			} else {
-				$url = OC::$WEBROOT . '/index.php';
-				header('Location: ' . $url);
-			}
-			exit();
-		}
-	}
-
-	public static function checkMaintenanceMode() {
-		// Allow ajax update script to execute without being stopped
-		if (\OC::$server->getSystemConfig()->getValue('maintenance', false) && OC::$SUBURI != '/core/ajax/update.php') {
-			// send http status 503
-			header('HTTP/1.1 503 Service Temporarily Unavailable');
-			header('Status: 503 Service Temporarily Unavailable');
-			header('Retry-After: 120');
-
-			// render error page
-			$template = new OC_Template('', 'update.user', 'guest');
-			OC_Util::addScript('maintenance-check');
-			$template->printPage();
-			die();
-		}
-	}
-
-	/**
-	 * Checks if the version requires an update and shows
-	 * @param bool $showTemplate Whether an update screen should get shown
-	 * @return bool|void
-	 */
-	public static function checkUpgrade($showTemplate = true) {
-		if (\OCP\Util::needUpgrade()) {
-			$systemConfig = \OC::$server->getSystemConfig();
-			if ($showTemplate && !$systemConfig->getValue('maintenance', false)) {
-				self::printUpgradePage();
-				exit();
-			} else {
-				return true;
-			}
-		}
-		return false;
-	}
-
-	/**
-	 * Prints the upgrade page
-	 */
-	private static function printUpgradePage() {
-		$systemConfig = \OC::$server->getSystemConfig();
-
-		$disableWebUpdater = $systemConfig->getValue('upgrade.disable-web', false);
-		$tooBig = false;
-		if (!$disableWebUpdater) {
-			$apps = \OC::$server->getAppManager();
-			$tooBig = $apps->isInstalled('user_ldap') || $apps->isInstalled('user_shibboleth');
-			if (!$tooBig) {
-				// count users
-				$stats = \OC::$server->getUserManager()->countUsers();
-				$totalUsers = array_sum($stats);
-				$tooBig = ($totalUsers > 50);
-			}
-		}
-		if ($disableWebUpdater || $tooBig) {
-			// send http status 503
-			header('HTTP/1.1 503 Service Temporarily Unavailable');
-			header('Status: 503 Service Temporarily Unavailable');
-			header('Retry-After: 120');
-
-			// render error page
-			$template = new OC_Template('', 'update.use-cli', 'guest');
-			$template->assign('productName', 'nextcloud'); // for now
-			$template->assign('version', OC_Util::getVersionString());
-			$template->assign('tooBig', $tooBig);
-
-			$template->printPage();
-			die();
-		}
-
-		// check whether this is a core update or apps update
-		$installedVersion = $systemConfig->getValue('version', '0.0.0');
-		$currentVersion = implode('.', \OCP\Util::getVersion());
-
-		// if not a core upgrade, then it's apps upgrade
-		$isAppsOnlyUpgrade = (version_compare($currentVersion, $installedVersion, '='));
-
-		$oldTheme = $systemConfig->getValue('theme');
-		$systemConfig->setValue('theme', '');
-		OC_Util::addScript('config'); // needed for web root
-		OC_Util::addScript('update');
-
-		/** @var \OC\App\AppManager $appManager */
-		$appManager = \OC::$server->getAppManager();
-
-		$tmpl = new OC_Template('', 'update.admin', 'guest');
-		$tmpl->assign('version', OC_Util::getVersionString());
-		$tmpl->assign('isAppsOnlyUpgrade', $isAppsOnlyUpgrade);
-
-		// get third party apps
-		$ocVersion = \OCP\Util::getVersion();
-		$incompatibleApps = $appManager->getIncompatibleApps($ocVersion);
-		$incompatibleShippedApps = [];
-		foreach ($incompatibleApps as $appInfo) {
-			if ($appManager->isShipped($appInfo['id'])) {
-				$incompatibleShippedApps[] = $appInfo['name'] . ' (' . $appInfo['id'] . ')';
-			}
-		}
-
-		if (!empty($incompatibleShippedApps)) {
-			$l = \OC::$server->getL10N('core');
-			$hint = $l->t('The files of the app %$1s were not replaced correctly. Make sure it is a version compatible with the server.', [implode(', ', $incompatibleShippedApps)]);
-			throw new \OC\HintException('The files of the app ' . implode(', ', $incompatibleShippedApps) . ' were not replaced correctly. Make sure it is a version compatible with the server.', $hint);
-		}
-
-		$tmpl->assign('appsToUpgrade', $appManager->getAppsNeedingUpgrade($ocVersion));
-		$tmpl->assign('incompatibleAppsList', $incompatibleApps);
-		$tmpl->assign('productName', 'Nextcloud'); // for now
-		$tmpl->assign('oldTheme', $oldTheme);
-		$tmpl->printPage();
-	}
-
-	public static function initSession() {
-		// prevents javascript from accessing php session cookies
-		ini_set('session.cookie_httponly', true);
-
-		// set the cookie path to the Nextcloud directory
-		$cookie_path = OC::$WEBROOT ? : '/';
-		ini_set('session.cookie_path', $cookie_path);
-
-		// Let the session name be changed in the initSession Hook
-		$sessionName = OC_Util::getInstanceId();
-
-		try {
-			// Allow session apps to create a custom session object
-			$useCustomSession = false;
-			$session = self::$server->getSession();
-			OC_Hook::emit('OC', 'initSession', array('session' => &$session, 'sessionName' => &$sessionName, 'useCustomSession' => &$useCustomSession));
-			if (!$useCustomSession) {
-				// set the session name to the instance id - which is unique
-				$session = new \OC\Session\Internal($sessionName);
-			}
-
-			$cryptoWrapper = \OC::$server->getSessionCryptoWrapper();
-			$session = $cryptoWrapper->wrapSession($session);
-			self::$server->setSession($session);
-
-			// if session can't be started break with http 500 error
-		} catch (Exception $e) {
-			\OCP\Util::logException('base', $e);
-			//show the user a detailed error page
-			OC_Response::setStatus(OC_Response::STATUS_INTERNAL_SERVER_ERROR);
-			OC_Template::printExceptionErrorPage($e);
-			die();
-		}
-
-		$sessionLifeTime = self::getSessionLifeTime();
-
-		// session timeout
-		if ($session->exists('LAST_ACTIVITY') && (time() - $session->get('LAST_ACTIVITY') > $sessionLifeTime)) {
-			if (isset($_COOKIE[session_name()])) {
-				setcookie(session_name(), null, -1, self::$WEBROOT ? : '/');
-			}
-			\OC::$server->getUserSession()->logout();
-		}
-
-		$session->set('LAST_ACTIVITY', time());
-	}
-
-	/**
-	 * @return string
-	 */
-	private static function getSessionLifeTime() {
-		return \OC::$server->getConfig()->getSystemValue('session_lifetime', 60 * 60 * 24);
-	}
-
-	public static function loadAppClassPaths() {
-		foreach (OC_App::getEnabledApps() as $app) {
-			$appPath = OC_App::getAppPath($app);
-			if ($appPath === false) {
-				continue;
-			}
-
-			$file = $appPath . '/appinfo/classpath.php';
-			if (file_exists($file)) {
-				require_once $file;
-			}
-		}
-	}
-
-	/**
-	 * Try to set some values to the required Nextcloud default
-	 */
-	public static function setRequiredIniValues() {
-		@ini_set('default_charset', 'UTF-8');
-		@ini_set('gd.jpeg_ignore_warning', 1);
-	}
-
-	/**
-	 * Send the same site cookies
-	 */
-	private static function sendSameSiteCookies() {
-		$cookieParams = session_get_cookie_params();
-		$secureCookie = ($cookieParams['secure'] === true) ? 'secure; ' : '';
-		$policies = [
-			'lax',
-			'strict',
-		];
-
-		// Append __Host to the cookie if it meets the requirements
-		$cookiePrefix = '';
-		if($cookieParams['secure'] === true && $cookieParams['path'] === '/') {
-			$cookiePrefix = '__Host-';
-		}
-
-		foreach($policies as $policy) {
-			header(
-				sprintf(
-					'Set-Cookie: %snc_sameSiteCookie%s=true; path=%s; httponly;' . $secureCookie . 'expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=%s',
-					$cookiePrefix,
-					$policy,
-					$cookieParams['path'],
-					$policy
-				),
-				false
-			);
-		}
-	}
-
-	/**
-	 * Same Site cookie to further mitigate CSRF attacks. This cookie has to
-	 * be set in every request if cookies are sent to add a second level of
-	 * defense against CSRF.
-	 *
-	 * If the cookie is not sent this will set the cookie and reload the page.
-	 * We use an additional cookie since we want to protect logout CSRF and
-	 * also we can't directly interfere with PHP's session mechanism.
-	 */
-	private static function performSameSiteCookieProtection() {
-		$request = \OC::$server->getRequest();
-
-		// Some user agents are notorious and don't really properly follow HTTP
-		// specifications. For those, have an automated opt-out. Since the protection
-		// for remote.php is applied in base.php as starting point we need to opt out
-		// here.
-		$incompatibleUserAgents = [
-			// OS X Finder
-			'/^WebDAVFS/',
-		];
-		if($request->isUserAgent($incompatibleUserAgents)) {
-			return;
-		}
-
-		if(count($_COOKIE) > 0) {
-			$requestUri = $request->getScriptName();
-			$processingScript = explode('/', $requestUri);
-			$processingScript = $processingScript[count($processingScript)-1];
-			// FIXME: In a SAML scenario we don't get any strict or lax cookie
-			// send for the ACS endpoint. Since we have some legacy code in Nextcloud
-			// (direct PHP files) the enforcement of lax cookies is performed here
-			// instead of the middleware.
-			//
-			// This means we cannot exclude some routes from the cookie validation,
-			// which normally is not a problem but is a little bit cumbersome for
-			// this use-case.
-			// Once the old legacy PHP endpoints have been removed we can move
-			// the verification into a middleware and also adds some exemptions.
-			//
-			// Questions about this code? Ask Lukas ;-)
-			$currentUrl = substr(explode('?',$request->getRequestUri(), 2)[0], strlen(\OC::$WEBROOT));
-			if($currentUrl === '/index.php/apps/user_saml/saml/acs' || $currentUrl === '/apps/user_saml/saml/acs') {
-				return;
-			}
-			// For the "index.php" endpoint only a lax cookie is required.
-			if($processingScript === 'index.php') {
-				if(!$request->passesLaxCookieCheck()) {
-					self::sendSameSiteCookies();
-					header('Location: '.$_SERVER['REQUEST_URI']);
-					exit();
-				}
-			} else {
-				// All other endpoints require the lax and the strict cookie
-				if(!$request->passesStrictCookieCheck()) {
-					self::sendSameSiteCookies();
-					// Debug mode gets access to the resources without strict cookie
-					// due to the fact that the SabreDAV browser also lives there.
-					if(!\OC::$server->getConfig()->getSystemValue('debug', false)) {
-						http_response_code(\OCP\AppFramework\Http::STATUS_SERVICE_UNAVAILABLE);
-						exit();
-					}
-				}
-			}
-		} elseif(!isset($_COOKIE['nc_sameSiteCookielax']) || !isset($_COOKIE['nc_sameSiteCookiestrict'])) {
-			self::sendSameSiteCookies();
-		}
-	}
-
-	public static function init() {
-		// calculate the root directories
-		OC::$SERVERROOT = str_replace("\\", '/', substr(__DIR__, 0, -4));
-
-		// register autoloader
-		$loaderStart = microtime(true);
-		require_once __DIR__ . '/autoloader.php';
-		self::$loader = new \OC\Autoloader([
-			OC::$SERVERROOT . '/lib/private/legacy',
-		]);
-		if (defined('PHPUNIT_RUN')) {
-			self::$loader->addValidRoot(OC::$SERVERROOT . '/tests');
-		}
-		spl_autoload_register(array(self::$loader, 'load'));
-		$loaderEnd = microtime(true);
-
-		self::$CLI = (php_sapi_name() == 'cli');
-
-		// Add default composer PSR-4 autoloader
-		self::$composerAutoloader = require_once OC::$SERVERROOT . '/lib/composer/autoload.php';
-
-		try {
-			self::initPaths();
-			// setup 3rdparty autoloader
-			$vendorAutoLoad = OC::$SERVERROOT. '/3rdparty/autoload.php';
-			if (!file_exists($vendorAutoLoad)) {
-				throw new \RuntimeException('Composer autoloader not found, unable to continue. Check the folder "3rdparty". Running "git submodule update --init" will initialize the git submodule that handles the subfolder "3rdparty".');
-			}
-			require_once $vendorAutoLoad;
-
-		} catch (\RuntimeException $e) {
-			if (!self::$CLI) {
-				$claimedProtocol = strtoupper($_SERVER['SERVER_PROTOCOL']);
-				$protocol = in_array($claimedProtocol, ['HTTP/1.0', 'HTTP/1.1', 'HTTP/2']) ? $claimedProtocol : 'HTTP/1.1';
-				header($protocol . ' ' . OC_Response::STATUS_SERVICE_UNAVAILABLE);
-			}
-			// we can't use the template error page here, because this needs the
-			// DI container which isn't available yet
-			print($e->getMessage());
-			exit();
-		}
-
-		// setup the basic server
-		self::$server = new \OC\Server(\OC::$WEBROOT, self::$config);
-		\OC::$server->getEventLogger()->log('autoloader', 'Autoloader', $loaderStart, $loaderEnd);
-		\OC::$server->getEventLogger()->start('boot', 'Initialize');
-
-		// Don't display errors and log them
-		error_reporting(E_ALL | E_STRICT);
-		@ini_set('display_errors', 0);
-		@ini_set('log_errors', 1);
-
-		if(!date_default_timezone_set('UTC')) {
-			throw new \RuntimeException('Could not set timezone to UTC');
-		};
-
-		//try to configure php to enable big file uploads.
-		//this doesn´t work always depending on the webserver and php configuration.
-		//Let´s try to overwrite some defaults anyway
-
-		//try to set the maximum execution time to 60min
-		@set_time_limit(3600);
-		@ini_set('max_execution_time', 3600);
-		@ini_set('max_input_time', 3600);
-
-		//try to set the maximum filesize to 10G
-		@ini_set('upload_max_filesize', '10G');
-		@ini_set('post_max_size', '10G');
-		@ini_set('file_uploads', '50');
-
-		self::setRequiredIniValues();
-		self::handleAuthHeaders();
-		self::registerAutoloaderCache();
-
-		// initialize intl fallback is necessary
-		\Patchwork\Utf8\Bootup::initIntl();
-		OC_Util::isSetLocaleWorking();
-
-		if (!defined('PHPUNIT_RUN')) {
-			OC\Log\ErrorHandler::setLogger(\OC::$server->getLogger());
-			$debug = \OC::$server->getConfig()->getSystemValue('debug', false);
-			OC\Log\ErrorHandler::register($debug);
-		}
-
-		\OC::$server->getEventLogger()->start('init_session', 'Initialize session');
-		OC_App::loadApps(array('session'));
-		if (!self::$CLI) {
-			self::initSession();
-		}
-		\OC::$server->getEventLogger()->end('init_session');
-		self::checkConfig();
-		self::checkInstalled();
-
-		OC_Response::addSecurityHeaders();
-		if(self::$server->getRequest()->getServerProtocol() === 'https') {
-			ini_set('session.cookie_secure', true);
-		}
-
-		self::performSameSiteCookieProtection();
-
-		if (!defined('OC_CONSOLE')) {
-			$errors = OC_Util::checkServer(\OC::$server->getConfig());
-			if (count($errors) > 0) {
-				if (self::$CLI) {
-					// Convert l10n string into regular string for usage in database
-					$staticErrors = [];
-					foreach ($errors as $error) {
-						echo $error['error'] . "\n";
-						echo $error['hint'] . "\n\n";
-						$staticErrors[] = [
-							'error' => (string)$error['error'],
-							'hint' => (string)$error['hint'],
-						];
-					}
-
-					try {
-						\OC::$server->getConfig()->setAppValue('core', 'cronErrors', json_encode($staticErrors));
-					} catch (\Exception $e) {
-						echo('Writing to database failed');
-					}
-					exit(1);
-				} else {
-					OC_Response::setStatus(OC_Response::STATUS_SERVICE_UNAVAILABLE);
-					OC_Util::addStyle('guest');
-					OC_Template::printGuestPage('', 'error', array('errors' => $errors));
-					exit;
-				}
-			} elseif (self::$CLI && \OC::$server->getConfig()->getSystemValue('installed', false)) {
-				\OC::$server->getConfig()->deleteAppValue('core', 'cronErrors');
-			}
-		}
-		//try to set the session lifetime
-		$sessionLifeTime = self::getSessionLifeTime();
-		@ini_set('gc_maxlifetime', (string)$sessionLifeTime);
-
-		$systemConfig = \OC::$server->getSystemConfig();
-
-		// User and Groups
-		if (!$systemConfig->getValue("installed", false)) {
-			self::$server->getSession()->set('user_id', '');
-		}
-
-		OC_User::useBackend(new \OC\User\Database());
-		\OC::$server->getGroupManager()->addBackend(new \OC\Group\Database());
-
-		// Subscribe to the hook
-		\OCP\Util::connectHook(
-			'\OCA\Files_Sharing\API\Server2Server',
-			'preLoginNameUsedAsUserName',
-			'\OC\User\Database',
-			'preLoginNameUsedAsUserName'
-		);
-
-		//setup extra user backends
-		if (!self::checkUpgrade(false)) {
-			OC_User::setupBackends();
-		} else {
-			// Run upgrades in incognito mode
-			OC_User::setIncognitoMode(true);
-		}
-
-		self::registerCacheHooks();
-		self::registerFilesystemHooks();
-		self::registerShareHooks();
-		self::registerLogRotate();
-		self::registerEncryptionWrapper();
-		self::registerEncryptionHooks();
-		self::registerAccountHooks();
-		self::registerSettingsHooks();
-
-		//make sure temporary files are cleaned up
-		$tmpManager = \OC::$server->getTempManager();
-		register_shutdown_function(array($tmpManager, 'clean'));
-		$lockProvider = \OC::$server->getLockingProvider();
-		register_shutdown_function(array($lockProvider, 'releaseAll'));
-
-		// Check whether the sample configuration has been copied
-		if($systemConfig->getValue('copied_sample_config', false)) {
-			$l = \OC::$server->getL10N('lib');
-			header('HTTP/1.1 503 Service Temporarily Unavailable');
-			header('Status: 503 Service Temporarily Unavailable');
-			OC_Template::printErrorPage(
-				$l->t('Sample configuration detected'),
-				$l->t('It has been detected that the sample configuration has been copied. This can break your installation and is unsupported. Please read the documentation before performing changes on config.php')
-			);
-			return;
-		}
-
-		$request = \OC::$server->getRequest();
-		$host = $request->getInsecureServerHost();
-		/**
-		 * if the host passed in headers isn't trusted
-		 * FIXME: Should not be in here at all :see_no_evil:
-		 */
-		if (!OC::$CLI
-			// overwritehost is always trusted, workaround to not have to make
-			// \OC\AppFramework\Http\Request::getOverwriteHost public
-			&& self::$server->getConfig()->getSystemValue('overwritehost') === ''
-			&& !\OC::$server->getTrustedDomainHelper()->isTrustedDomain($host)
-			&& self::$server->getConfig()->getSystemValue('installed', false)
-		) {
-			// Allow access to CSS resources
-			$isScssRequest = false;
-			if(strpos($request->getPathInfo(), '/css/') === 0) {
-				$isScssRequest = true;
-			}
-
-			if (!$isScssRequest) {
-				header('HTTP/1.1 400 Bad Request');
-				header('Status: 400 Bad Request');
-
-				\OC::$server->getLogger()->warning(
-					'Trusted domain error. "{remoteAddress}" tried to access using "{host}" as host.',
-					[
-						'app' => 'core',
-						'remoteAddress' => $request->getRemoteAddress(),
-						'host' => $host,
-					]
-				);
-
-				$tmpl = new OCP\Template('core', 'untrustedDomain', 'guest');
-				$tmpl->assign('domain', $host);
-				$tmpl->printPage();
-
-				exit();
-			}
-		}
-		\OC::$server->getEventLogger()->end('boot');
-	}
-
-	/**
-	 * register hooks for the cache
-	 */
-	public static function registerCacheHooks() {
-		//don't try to do this before we are properly setup
-		if (\OC::$server->getSystemConfig()->getValue('installed', false) && !self::checkUpgrade(false)) {
-
-			// NOTE: This will be replaced to use OCP
-			$userSession = self::$server->getUserSession();
-			$userSession->listen('\OC\User', 'postLogin', function () {
-				try {
-					$cache = new \OC\Cache\File();
-					$cache->gc();
-				} catch (\OC\ServerNotAvailableException $e) {
-					// not a GC exception, pass it on
-					throw $e;
-				} catch (\Exception $e) {
-					// a GC exception should not prevent users from using OC,
-					// so log the exception
-					\OC::$server->getLogger()->warning('Exception when running cache gc: ' . $e->getMessage(), array('app' => 'core'));
-				}
-			});
-		}
-	}
-
-	public static function registerSettingsHooks() {
-		$dispatcher = \OC::$server->getEventDispatcher();
-		$dispatcher->addListener(OCP\App\ManagerEvent::EVENT_APP_DISABLE, function($event) {
-			/** @var \OCP\App\ManagerEvent $event */
-			\OC::$server->getSettingsManager()->onAppDisabled($event->getAppID());
-		});
-		$dispatcher->addListener(OCP\App\ManagerEvent::EVENT_APP_UPDATE, function($event) {
-			/** @var \OCP\App\ManagerEvent $event */
-			$jobList = \OC::$server->getJobList();
-			$job = 'OC\\Settings\\RemoveOrphaned';
-			if(!($jobList->has($job, null))) {
-				$jobList->add($job);
-			}
-		});
-	}
-
-	private static function registerEncryptionWrapper() {
-		$manager = self::$server->getEncryptionManager();
-		\OCP\Util::connectHook('OC_Filesystem', 'preSetup', $manager, 'setupStorage');
-	}
-
-	private static function registerEncryptionHooks() {
-		$enabled = self::$server->getEncryptionManager()->isEnabled();
-		if ($enabled) {
-			\OCP\Util::connectHook('OCP\Share', 'post_shared', 'OC\Encryption\HookManager', 'postShared');
-			\OCP\Util::connectHook('OCP\Share', 'post_unshare', 'OC\Encryption\HookManager', 'postUnshared');
-			\OCP\Util::connectHook('OC_Filesystem', 'post_rename', 'OC\Encryption\HookManager', 'postRename');
-			\OCP\Util::connectHook('\OCA\Files_Trashbin\Trashbin', 'post_restore', 'OC\Encryption\HookManager', 'postRestore');
-		}
-	}
-
-	private static function registerAccountHooks() {
-		$hookHandler = new \OC\Accounts\Hooks(\OC::$server->getLogger());
-		\OCP\Util::connectHook('OC_User', 'changeUser', $hookHandler, 'changeUserHook');
-	}
-
-	/**
-	 * register hooks for the cache
-	 */
-	public static function registerLogRotate() {
-		$systemConfig = \OC::$server->getSystemConfig();
-		if ($systemConfig->getValue('installed', false) && $systemConfig->getValue('log_rotate_size', false) && !self::checkUpgrade(false)) {
-			//don't try to do this before we are properly setup
-			//use custom logfile path if defined, otherwise use default of nextcloud.log in data directory
-			\OC::$server->getJobList()->add('OC\Log\Rotate');
-		}
-	}
-
-	/**
-	 * register hooks for the filesystem
-	 */
-	public static function registerFilesystemHooks() {
-		// Check for blacklisted files
-		OC_Hook::connect('OC_Filesystem', 'write', 'OC\Files\Filesystem', 'isBlacklisted');
-		OC_Hook::connect('OC_Filesystem', 'rename', 'OC\Files\Filesystem', 'isBlacklisted');
-	}
-
-	/**
-	 * register hooks for sharing
-	 */
-	public static function registerShareHooks() {
-		if (\OC::$server->getSystemConfig()->getValue('installed')) {
-			OC_Hook::connect('OC_User', 'post_deleteUser', 'OC\Share20\Hooks', 'post_deleteUser');
-			OC_Hook::connect('OC_User', 'post_removeFromGroup', 'OC\Share20\Hooks', 'post_removeFromGroup');
-			OC_Hook::connect('OC_User', 'post_deleteGroup', 'OC\Share20\Hooks', 'post_deleteGroup');
-		}
-	}
-
-	protected static function registerAutoloaderCache() {
-		// The class loader takes an optional low-latency cache, which MUST be
-		// namespaced. The instanceid is used for namespacing, but might be
-		// unavailable at this point. Furthermore, it might not be possible to
-		// generate an instanceid via \OC_Util::getInstanceId() because the
-		// config file may not be writable. As such, we only register a class
-		// loader cache if instanceid is available without trying to create one.
-		$instanceId = \OC::$server->getSystemConfig()->getValue('instanceid', null);
-		if ($instanceId) {
-			try {
-				$memcacheFactory = \OC::$server->getMemCacheFactory();
-				self::$loader->setMemoryCache($memcacheFactory->createLocal('Autoloader'));
-			} catch (\Exception $ex) {
-			}
-		}
-	}
-
-	/**
-	 * Handle the request
-	 */
-	public static function handleRequest() {
-
-		\OC::$server->getEventLogger()->start('handle_request', 'Handle request');
-		$systemConfig = \OC::$server->getSystemConfig();
-		// load all the classpaths from the enabled apps so they are available
-		// in the routing files of each app
-		OC::loadAppClassPaths();
-
-		// Check if Nextcloud is installed or in maintenance (update) mode
-		if (!$systemConfig->getValue('installed', false)) {
-			\OC::$server->getSession()->clear();
-			$setupHelper = new OC\Setup(\OC::$server->getConfig(), \OC::$server->getIniWrapper(),
-				\OC::$server->getL10N('lib'), \OC::$server->getThemingDefaults(), \OC::$server->getLogger(),
-				\OC::$server->getSecureRandom());
-			$controller = new OC\Core\Controller\SetupController($setupHelper);
-			$controller->run($_POST);
-			exit();
-		}
-
-		$request = \OC::$server->getRequest();
-		$requestPath = $request->getRawPathInfo();
-		if ($requestPath === '/heartbeat') {
-			return;
-		}
-		if (substr($requestPath, -3) !== '.js') { // we need these files during the upgrade
-			self::checkMaintenanceMode();
-			self::checkUpgrade();
-		}
-
-		// emergency app disabling
-		if ($requestPath === '/disableapp'
-			&& $request->getMethod() === 'POST'
-			&& ((string)$request->getParam('appid')) !== ''
-		) {
-			\OCP\JSON::callCheck();
-			\OCP\JSON::checkAdminUser();
-			$appId = (string)$request->getParam('appid');
-			$appId = \OC_App::cleanAppId($appId);
-
-			\OC_App::disable($appId);
-			\OC_JSON::success();
-			exit();
-		}
-
-		// Always load authentication apps
-		OC_App::loadApps(['authentication']);
-
-		// Load minimum set of apps
-		if (!self::checkUpgrade(false)
-			&& !$systemConfig->getValue('maintenance', false)) {
-			// For logged-in users: Load everything
-			if(\OC::$server->getUserSession()->isLoggedIn()) {
-				OC_App::loadApps();
-			} else {
-				// For guests: Load only filesystem and logging
-				OC_App::loadApps(array('filesystem', 'logging'));
-				self::handleLogin($request);
-			}
-		}
-
-		if (!self::$CLI) {
-			try {
-				if (!$systemConfig->getValue('maintenance', false) && !self::checkUpgrade(false)) {
-					OC_App::loadApps(array('filesystem', 'logging'));
-					OC_App::loadApps();
-				}
-				OC_Util::setupFS();
-				OC::$server->getRouter()->match(\OC::$server->getRequest()->getRawPathInfo());
-				return;
-			} catch (Symfony\Component\Routing\Exception\ResourceNotFoundException $e) {
-				//header('HTTP/1.0 404 Not Found');
-			} catch (Symfony\Component\Routing\Exception\MethodNotAllowedException $e) {
-				OC_Response::setStatus(405);
-				return;
-			}
-		}
-
-		// Handle WebDAV
-		if ($_SERVER['REQUEST_METHOD'] == 'PROPFIND') {
-			// not allowed any more to prevent people
-			// mounting this root directly.
-			// Users need to mount remote.php/webdav instead.
-			header('HTTP/1.1 405 Method Not Allowed');
-			header('Status: 405 Method Not Allowed');
-			return;
-		}
-
-		// Someone is logged in
-		if (\OC::$server->getUserSession()->isLoggedIn()) {
-			OC_App::loadApps();
-			OC_User::setupBackends();
-			OC_Util::setupFS();
-			// FIXME
-			// Redirect to default application
-			OC_Util::redirectToDefaultPage();
-		} else {
-			// Not handled and not logged in
-			header('Location: '.\OC::$server->getURLGenerator()->linkToRouteAbsolute('core.login.showLoginForm'));
-		}
-	}
-
-	/**
-	 * Check login: apache auth, auth token, basic auth
-	 *
-	 * @param OCP\IRequest $request
-	 * @return boolean
-	 */
-	static function handleLogin(OCP\IRequest $request) {
-		$userSession = self::$server->getUserSession();
-		if (OC_User::handleApacheAuth()) {
-			return true;
-		}
-		if ($userSession->tryTokenLogin($request)) {
-			return true;
-		}
-		if (isset($_COOKIE['nc_username'])
-			&& isset($_COOKIE['nc_token'])
-			&& isset($_COOKIE['nc_session_id'])
-			&& $userSession->loginWithCookie($_COOKIE['nc_username'], $_COOKIE['nc_token'], $_COOKIE['nc_session_id'])) {
-			return true;
-		}
-		if ($userSession->tryBasicAuthLogin($request, \OC::$server->getBruteForceThrottler())) {
-			return true;
-		}
-		return false;
-	}
-
-	protected static function handleAuthHeaders() {
-		//copy http auth headers for apache+php-fcgid work around
-		if (isset($_SERVER['HTTP_XAUTHORIZATION']) && !isset($_SERVER['HTTP_AUTHORIZATION'])) {
-			$_SERVER['HTTP_AUTHORIZATION'] = $_SERVER['HTTP_XAUTHORIZATION'];
-		}
-
-		// Extract PHP_AUTH_USER/PHP_AUTH_PW from other headers if necessary.
-		$vars = array(
-			'HTTP_AUTHORIZATION', // apache+php-cgi work around
-			'REDIRECT_HTTP_AUTHORIZATION', // apache+php-cgi alternative
-		);
-		foreach ($vars as $var) {
-			if (isset($_SERVER[$var]) && preg_match('/Basic\s+(.*)$/i', $_SERVER[$var], $matches)) {
-				list($name, $password) = explode(':', base64_decode($matches[1]), 2);
-				$_SERVER['PHP_AUTH_USER'] = $name;
-				$_SERVER['PHP_AUTH_PW'] = $password;
-				break;
-			}
-		}
-	}
+    /**
+     * Associative array for autoloading. classname => filename
+     */
+    public static $CLASSPATH = array();
+    /**
+     * The installation path for Nextcloud  on the server (e.g. /srv/http/nextcloud)
+     */
+    public static $SERVERROOT = '';
+    /**
+     * the current request path relative to the Nextcloud root (e.g. files/index.php)
+     */
+    private static $SUBURI = '';
+    /**
+     * the Nextcloud root path for http requests (e.g. nextcloud/)
+     */
+    public static $WEBROOT = '';
+    /**
+     * The installation path array of the apps folder on the server (e.g. /srv/http/nextcloud) 'path' and
+     * web path in 'url'
+     */
+    public static $APPSROOTS = array();
+
+    /**
+     * @var string
+     */
+    public static $configDir;
+
+    /**
+     * requested app
+     */
+    public static $REQUESTEDAPP = '';
+
+    /**
+     * check if Nextcloud runs in cli mode
+     */
+    public static $CLI = false;
+
+    /**
+     * @var \OC\Autoloader $loader
+     */
+    public static $loader = null;
+
+    /** @var \Composer\Autoload\ClassLoader $composerAutoloader */
+    public static $composerAutoloader = null;
+
+    /**
+     * @var \OC\Server
+     */
+    public static $server = null;
+
+    /**
+     * @var \OC\Config
+     */
+    private static $config = null;
+
+    /**
+     * @throws \RuntimeException when the 3rdparty directory is missing or
+     * the app path list is empty or contains an invalid path
+     */
+    public static function initPaths() {
+        if(defined('PHPUNIT_CONFIG_DIR')) {
+            self::$configDir = OC::$SERVERROOT . '/' . PHPUNIT_CONFIG_DIR . '/';
+        } elseif(defined('PHPUNIT_RUN') and PHPUNIT_RUN and is_dir(OC::$SERVERROOT . '/tests/config/')) {
+            self::$configDir = OC::$SERVERROOT . '/tests/config/';
+        } elseif($dir = getenv('NEXTCLOUD_CONFIG_DIR')) {
+            self::$configDir = rtrim($dir, '/') . '/';
+        } else {
+            self::$configDir = OC::$SERVERROOT . '/config/';
+        }
+        self::$config = new \OC\Config(self::$configDir);
+
+        OC::$SUBURI = str_replace("\\", "/", substr(realpath($_SERVER["SCRIPT_FILENAME"]), strlen(OC::$SERVERROOT)));
+        /**
+         * FIXME: The following lines are required because we can't yet instantiiate
+         *        \OC::$server->getRequest() since \OC::$server does not yet exist.
+         */
+        $params = [
+            'server' => [
+                'SCRIPT_NAME' => $_SERVER['SCRIPT_NAME'],
+                'SCRIPT_FILENAME' => $_SERVER['SCRIPT_FILENAME'],
+            ],
+        ];
+        $fakeRequest = new \OC\AppFramework\Http\Request($params, null, new \OC\AllConfig(new \OC\SystemConfig(self::$config)));
+        $scriptName = $fakeRequest->getScriptName();
+        if (substr($scriptName, -1) == '/') {
+            $scriptName .= 'index.php';
+            //make sure suburi follows the same rules as scriptName
+            if (substr(OC::$SUBURI, -9) != 'index.php') {
+                if (substr(OC::$SUBURI, -1) != '/') {
+                    OC::$SUBURI = OC::$SUBURI . '/';
+                }
+                OC::$SUBURI = OC::$SUBURI . 'index.php';
+            }
+        }
+
+
+        if (OC::$CLI) {
+            OC::$WEBROOT = self::$config->getValue('overwritewebroot', '');
+        } else {
+            if (substr($scriptName, 0 - strlen(OC::$SUBURI)) === OC::$SUBURI) {
+                OC::$WEBROOT = substr($scriptName, 0, 0 - strlen(OC::$SUBURI));
+
+                if (OC::$WEBROOT != '' && OC::$WEBROOT[0] !== '/') {
+                    OC::$WEBROOT = '/' . OC::$WEBROOT;
+                }
+            } else {
+                // The scriptName is not ending with OC::$SUBURI
+                // This most likely means that we are calling from CLI.
+                // However some cron jobs still need to generate
+                // a web URL, so we use overwritewebroot as a fallback.
+                OC::$WEBROOT = self::$config->getValue('overwritewebroot', '');
+            }
+
+            // Resolve /nextcloud to /nextcloud/ to ensure to always have a trailing
+            // slash which is required by URL generation.
+            if($_SERVER['REQUEST_URI'] === \OC::$WEBROOT &&
+                    substr($_SERVER['REQUEST_URI'], -1) !== '/') {
+                header('Location: '.\OC::$WEBROOT.'/');
+                exit();
+            }
+        }
+
+        // search the apps folder
+        $config_paths = self::$config->getValue('apps_paths', array());
+        if (!empty($config_paths)) {
+            foreach ($config_paths as $paths) {
+                if (isset($paths['url']) && isset($paths['path'])) {
+                    $paths['url'] = rtrim($paths['url'], '/');
+                    $paths['path'] = rtrim($paths['path'], '/');
+                    OC::$APPSROOTS[] = $paths;
+                }
+            }
+        } elseif (file_exists(OC::$SERVERROOT . '/apps')) {
+            OC::$APPSROOTS[] = array('path' => OC::$SERVERROOT . '/apps', 'url' => '/apps', 'writable' => true);
+        } elseif (file_exists(OC::$SERVERROOT . '/../apps')) {
+            OC::$APPSROOTS[] = array(
+                'path' => rtrim(dirname(OC::$SERVERROOT), '/') . '/apps',
+                'url' => '/apps',
+                'writable' => true
+            );
+        }
+
+        if (empty(OC::$APPSROOTS)) {
+            throw new \RuntimeException('apps directory not found! Please put the Nextcloud apps folder in the Nextcloud folder'
+                . ' or the folder above. You can also configure the location in the config.php file.');
+        }
+        $paths = array();
+        foreach (OC::$APPSROOTS as $path) {
+            $paths[] = $path['path'];
+            if (!is_dir($path['path'])) {
+                throw new \RuntimeException(sprintf('App directory "%s" not found! Please put the Nextcloud apps folder in the'
+                    . ' Nextcloud folder or the folder above. You can also configure the location in the'
+                    . ' config.php file.', $path['path']));
+            }
+        }
+
+        // set the right include path
+        set_include_path(
+            implode(PATH_SEPARATOR, $paths)
+        );
+    }
+
+    public static function checkConfig() {
+        $l = \OC::$server->getL10N('lib');
+
+        // Create config if it does not already exist
+        $configFilePath = self::$configDir .'/config.php';
+        if(!file_exists($configFilePath)) {
+            @touch($configFilePath);
+        }
+
+        // Check if config is writable
+        $configFileWritable = is_writable($configFilePath);
+        if (!$configFileWritable && !OC_Helper::isReadOnlyConfigEnabled()
+            || !$configFileWritable && self::checkUpgrade(false)) {
+
+            $urlGenerator = \OC::$server->getURLGenerator();
+
+            if (self::$CLI) {
+                echo $l->t('Cannot write into "config" directory!')."\n";
+                echo $l->t('This can usually be fixed by giving the webserver write access to the config directory')."\n";
+                echo "\n";
+                echo $l->t('See %s', [ $urlGenerator->linkToDocs('admin-dir_permissions') ])."\n";
+                exit;
+            } else {
+                OC_Template::printErrorPage(
+                    $l->t('Cannot write into "config" directory!'),
+                    $l->t('This can usually be fixed by '
+                    . '%sgiving the webserver write access to the config directory%s.',
+                        array('<a href="' . $urlGenerator->linkToDocs('admin-dir_permissions') . '" target="_blank" rel="noreferrer">', '</a>'))
+                );
+            }
+        }
+    }
+
+    public static function checkInstalled() {
+        if (defined('OC_CONSOLE')) {
+            return;
+        }
+        // Redirect to installer if not installed
+        if (!\OC::$server->getSystemConfig()->getValue('installed', false) && OC::$SUBURI !== '/index.php' && OC::$SUBURI !== '/status.php') {
+            if (OC::$CLI) {
+                throw new Exception('Not installed');
+            } else {
+                $url = OC::$WEBROOT . '/index.php';
+                header('Location: ' . $url);
+            }
+            exit();
+        }
+    }
+
+    public static function checkMaintenanceMode() {
+        // Allow ajax update script to execute without being stopped
+        if (\OC::$server->getSystemConfig()->getValue('maintenance', false) && OC::$SUBURI != '/core/ajax/update.php') {
+            // send http status 503
+            header('HTTP/1.1 503 Service Temporarily Unavailable');
+            header('Status: 503 Service Temporarily Unavailable');
+            header('Retry-After: 120');
+
+            // render error page
+            $template = new OC_Template('', 'update.user', 'guest');
+            OC_Util::addScript('maintenance-check');
+            $template->printPage();
+            die();
+        }
+    }
+
+    /**
+     * Checks if the version requires an update and shows
+     * @param bool $showTemplate Whether an update screen should get shown
+     * @return bool|void
+     */
+    public static function checkUpgrade($showTemplate = true) {
+        if (\OCP\Util::needUpgrade()) {
+            $systemConfig = \OC::$server->getSystemConfig();
+            if ($showTemplate && !$systemConfig->getValue('maintenance', false)) {
+                self::printUpgradePage();
+                exit();
+            } else {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * Prints the upgrade page
+     */
+    private static function printUpgradePage() {
+        $systemConfig = \OC::$server->getSystemConfig();
+
+        $disableWebUpdater = $systemConfig->getValue('upgrade.disable-web', false);
+        $tooBig = false;
+        if (!$disableWebUpdater) {
+            $apps = \OC::$server->getAppManager();
+            $tooBig = $apps->isInstalled('user_ldap') || $apps->isInstalled('user_shibboleth');
+            if (!$tooBig) {
+                // count users
+                $stats = \OC::$server->getUserManager()->countUsers();
+                $totalUsers = array_sum($stats);
+                $tooBig = ($totalUsers > 50);
+            }
+        }
+        if ($disableWebUpdater || $tooBig) {
+            // send http status 503
+            header('HTTP/1.1 503 Service Temporarily Unavailable');
+            header('Status: 503 Service Temporarily Unavailable');
+            header('Retry-After: 120');
+
+            // render error page
+            $template = new OC_Template('', 'update.use-cli', 'guest');
+            $template->assign('productName', 'nextcloud'); // for now
+            $template->assign('version', OC_Util::getVersionString());
+            $template->assign('tooBig', $tooBig);
+
+            $template->printPage();
+            die();
+        }
+
+        // check whether this is a core update or apps update
+        $installedVersion = $systemConfig->getValue('version', '0.0.0');
+        $currentVersion = implode('.', \OCP\Util::getVersion());
+
+        // if not a core upgrade, then it's apps upgrade
+        $isAppsOnlyUpgrade = (version_compare($currentVersion, $installedVersion, '='));
+
+        $oldTheme = $systemConfig->getValue('theme');
+        $systemConfig->setValue('theme', '');
+        OC_Util::addScript('config'); // needed for web root
+        OC_Util::addScript('update');
+
+        /** @var \OC\App\AppManager $appManager */
+        $appManager = \OC::$server->getAppManager();
+
+        $tmpl = new OC_Template('', 'update.admin', 'guest');
+        $tmpl->assign('version', OC_Util::getVersionString());
+        $tmpl->assign('isAppsOnlyUpgrade', $isAppsOnlyUpgrade);
+
+        // get third party apps
+        $ocVersion = \OCP\Util::getVersion();
+        $incompatibleApps = $appManager->getIncompatibleApps($ocVersion);
+        $incompatibleShippedApps = [];
+        foreach ($incompatibleApps as $appInfo) {
+            if ($appManager->isShipped($appInfo['id'])) {
+                $incompatibleShippedApps[] = $appInfo['name'] . ' (' . $appInfo['id'] . ')';
+            }
+        }
+
+        if (!empty($incompatibleShippedApps)) {
+            $l = \OC::$server->getL10N('core');
+            $hint = $l->t('The files of the app %$1s were not replaced correctly. Make sure it is a version compatible with the server.', [implode(', ', $incompatibleShippedApps)]);
+            throw new \OC\HintException('The files of the app ' . implode(', ', $incompatibleShippedApps) . ' were not replaced correctly. Make sure it is a version compatible with the server.', $hint);
+        }
+
+        $tmpl->assign('appsToUpgrade', $appManager->getAppsNeedingUpgrade($ocVersion));
+        $tmpl->assign('incompatibleAppsList', $incompatibleApps);
+        $tmpl->assign('productName', 'Nextcloud'); // for now
+        $tmpl->assign('oldTheme', $oldTheme);
+        $tmpl->printPage();
+    }
+
+    public static function initSession() {
+        // prevents javascript from accessing php session cookies
+        ini_set('session.cookie_httponly', true);
+
+        // set the cookie path to the Nextcloud directory
+        $cookie_path = OC::$WEBROOT ? : '/';
+        ini_set('session.cookie_path', $cookie_path);
+
+        // Let the session name be changed in the initSession Hook
+        $sessionName = OC_Util::getInstanceId();
+
+        try {
+            // Allow session apps to create a custom session object
+            $useCustomSession = false;
+            $session = self::$server->getSession();
+            OC_Hook::emit('OC', 'initSession', array('session' => &$session, 'sessionName' => &$sessionName, 'useCustomSession' => &$useCustomSession));
+            if (!$useCustomSession) {
+                // set the session name to the instance id - which is unique
+                $session = new \OC\Session\Internal($sessionName);
+            }
+
+            $cryptoWrapper = \OC::$server->getSessionCryptoWrapper();
+            $session = $cryptoWrapper->wrapSession($session);
+            self::$server->setSession($session);
+
+            // if session can't be started break with http 500 error
+        } catch (Exception $e) {
+            \OCP\Util::logException('base', $e);
+            //show the user a detailed error page
+            OC_Response::setStatus(OC_Response::STATUS_INTERNAL_SERVER_ERROR);
+            OC_Template::printExceptionErrorPage($e);
+            die();
+        }
+
+        $sessionLifeTime = self::getSessionLifeTime();
+
+        // session timeout
+        if ($session->exists('LAST_ACTIVITY') && (time() - $session->get('LAST_ACTIVITY') > $sessionLifeTime)) {
+            if (isset($_COOKIE[session_name()])) {
+                setcookie(session_name(), null, -1, self::$WEBROOT ? : '/');
+            }
+            \OC::$server->getUserSession()->logout();
+        }
+
+        $session->set('LAST_ACTIVITY', time());
+    }
+
+    /**
+     * @return string
+     */
+    private static function getSessionLifeTime() {
+        return \OC::$server->getConfig()->getSystemValue('session_lifetime', 60 * 60 * 24);
+    }
+
+    public static function loadAppClassPaths() {
+        foreach (OC_App::getEnabledApps() as $app) {
+            $appPath = OC_App::getAppPath($app);
+            if ($appPath === false) {
+                continue;
+            }
+
+            $file = $appPath . '/appinfo/classpath.php';
+            if (file_exists($file)) {
+                require_once $file;
+            }
+        }
+    }
+
+    /**
+     * Try to set some values to the required Nextcloud default
+     */
+    public static function setRequiredIniValues() {
+        @ini_set('default_charset', 'UTF-8');
+        @ini_set('gd.jpeg_ignore_warning', 1);
+    }
+
+    /**
+     * Send the same site cookies
+     */
+    private static function sendSameSiteCookies() {
+        $cookieParams = session_get_cookie_params();
+        $secureCookie = ($cookieParams['secure'] === true) ? 'secure; ' : '';
+        $policies = [
+            'lax',
+            'strict',
+        ];
+
+        // Append __Host to the cookie if it meets the requirements
+        $cookiePrefix = '';
+        if($cookieParams['secure'] === true && $cookieParams['path'] === '/') {
+            $cookiePrefix = '__Host-';
+        }
+
+        foreach($policies as $policy) {
+            header(
+                sprintf(
+                    'Set-Cookie: %snc_sameSiteCookie%s=true; path=%s; httponly;' . $secureCookie . 'expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=%s',
+                    $cookiePrefix,
+                    $policy,
+                    $cookieParams['path'],
+                    $policy
+                ),
+                false
+            );
+        }
+    }
+
+    /**
+     * Same Site cookie to further mitigate CSRF attacks. This cookie has to
+     * be set in every request if cookies are sent to add a second level of
+     * defense against CSRF.
+     *
+     * If the cookie is not sent this will set the cookie and reload the page.
+     * We use an additional cookie since we want to protect logout CSRF and
+     * also we can't directly interfere with PHP's session mechanism.
+     */
+    private static function performSameSiteCookieProtection() {
+        $request = \OC::$server->getRequest();
+
+        // Some user agents are notorious and don't really properly follow HTTP
+        // specifications. For those, have an automated opt-out. Since the protection
+        // for remote.php is applied in base.php as starting point we need to opt out
+        // here.
+        $incompatibleUserAgents = [
+            // OS X Finder
+            '/^WebDAVFS/',
+        ];
+        if($request->isUserAgent($incompatibleUserAgents)) {
+            return;
+        }
+
+        if(count($_COOKIE) > 0) {
+            $requestUri = $request->getScriptName();
+            $processingScript = explode('/', $requestUri);
+            $processingScript = $processingScript[count($processingScript)-1];
+            // FIXME: In a SAML scenario we don't get any strict or lax cookie
+            // send for the ACS endpoint. Since we have some legacy code in Nextcloud
+            // (direct PHP files) the enforcement of lax cookies is performed here
+            // instead of the middleware.
+            //
+            // This means we cannot exclude some routes from the cookie validation,
+            // which normally is not a problem but is a little bit cumbersome for
+            // this use-case.
+            // Once the old legacy PHP endpoints have been removed we can move
+            // the verification into a middleware and also adds some exemptions.
+            //
+            // Questions about this code? Ask Lukas ;-)
+            $currentUrl = substr(explode('?',$request->getRequestUri(), 2)[0], strlen(\OC::$WEBROOT));
+            if($currentUrl === '/index.php/apps/user_saml/saml/acs' || $currentUrl === '/apps/user_saml/saml/acs') {
+                return;
+            }
+            // For the "index.php" endpoint only a lax cookie is required.
+            if($processingScript === 'index.php') {
+                if(!$request->passesLaxCookieCheck()) {
+                    self::sendSameSiteCookies();
+                    header('Location: '.$_SERVER['REQUEST_URI']);
+                    exit();
+                }
+            } else {
+                // All other endpoints require the lax and the strict cookie
+                if(!$request->passesStrictCookieCheck()) {
+                    self::sendSameSiteCookies();
+                    // Debug mode gets access to the resources without strict cookie
+                    // due to the fact that the SabreDAV browser also lives there.
+                    if(!\OC::$server->getConfig()->getSystemValue('debug', false)) {
+                        http_response_code(\OCP\AppFramework\Http::STATUS_SERVICE_UNAVAILABLE);
+                        exit();
+                    }
+                }
+            }
+        } elseif(!isset($_COOKIE['nc_sameSiteCookielax']) || !isset($_COOKIE['nc_sameSiteCookiestrict'])) {
+            self::sendSameSiteCookies();
+        }
+    }
+
+    public static function init() {
+        // calculate the root directories
+        OC::$SERVERROOT = str_replace("\\", '/', substr(__DIR__, 0, -4));
+
+        // register autoloader
+        $loaderStart = microtime(true);
+        require_once __DIR__ . '/autoloader.php';
+        self::$loader = new \OC\Autoloader([
+            OC::$SERVERROOT . '/lib/private/legacy',
+        ]);
+        if (defined('PHPUNIT_RUN')) {
+            self::$loader->addValidRoot(OC::$SERVERROOT . '/tests');
+        }
+        spl_autoload_register(array(self::$loader, 'load'));
+        $loaderEnd = microtime(true);
+
+        self::$CLI = (php_sapi_name() == 'cli');
+
+        // Add default composer PSR-4 autoloader
+        self::$composerAutoloader = require_once OC::$SERVERROOT . '/lib/composer/autoload.php';
+
+        try {
+            self::initPaths();
+            // setup 3rdparty autoloader
+            $vendorAutoLoad = OC::$SERVERROOT. '/3rdparty/autoload.php';
+            if (!file_exists($vendorAutoLoad)) {
+                throw new \RuntimeException('Composer autoloader not found, unable to continue. Check the folder "3rdparty". Running "git submodule update --init" will initialize the git submodule that handles the subfolder "3rdparty".');
+            }
+            require_once $vendorAutoLoad;
+
+        } catch (\RuntimeException $e) {
+            if (!self::$CLI) {
+                $claimedProtocol = strtoupper($_SERVER['SERVER_PROTOCOL']);
+                $protocol = in_array($claimedProtocol, ['HTTP/1.0', 'HTTP/1.1', 'HTTP/2']) ? $claimedProtocol : 'HTTP/1.1';
+                header($protocol . ' ' . OC_Response::STATUS_SERVICE_UNAVAILABLE);
+            }
+            // we can't use the template error page here, because this needs the
+            // DI container which isn't available yet
+            print($e->getMessage());
+            exit();
+        }
+
+        // setup the basic server
+        self::$server = new \OC\Server(\OC::$WEBROOT, self::$config);
+        \OC::$server->getEventLogger()->log('autoloader', 'Autoloader', $loaderStart, $loaderEnd);
+        \OC::$server->getEventLogger()->start('boot', 'Initialize');
+
+        // Don't display errors and log them
+        error_reporting(E_ALL | E_STRICT);
+        @ini_set('display_errors', 0);
+        @ini_set('log_errors', 1);
+
+        if(!date_default_timezone_set('UTC')) {
+            throw new \RuntimeException('Could not set timezone to UTC');
+        };
+
+        //try to configure php to enable big file uploads.
+        //this doesn´t work always depending on the webserver and php configuration.
+        //Let´s try to overwrite some defaults anyway
+
+        //try to set the maximum execution time to 60min
+        @set_time_limit(3600);
+        @ini_set('max_execution_time', 3600);
+        @ini_set('max_input_time', 3600);
+
+        //try to set the maximum filesize to 10G
+        @ini_set('upload_max_filesize', '10G');
+        @ini_set('post_max_size', '10G');
+        @ini_set('file_uploads', '50');
+
+        self::setRequiredIniValues();
+        self::handleAuthHeaders();
+        self::registerAutoloaderCache();
+
+        // initialize intl fallback is necessary
+        \Patchwork\Utf8\Bootup::initIntl();
+        OC_Util::isSetLocaleWorking();
+
+        if (!defined('PHPUNIT_RUN')) {
+            OC\Log\ErrorHandler::setLogger(\OC::$server->getLogger());
+            $debug = \OC::$server->getConfig()->getSystemValue('debug', false);
+            OC\Log\ErrorHandler::register($debug);
+        }
+
+        \OC::$server->getEventLogger()->start('init_session', 'Initialize session');
+        OC_App::loadApps(array('session'));
+        if (!self::$CLI) {
+            self::initSession();
+        }
+        \OC::$server->getEventLogger()->end('init_session');
+        self::checkConfig();
+        self::checkInstalled();
+
+        OC_Response::addSecurityHeaders();
+        if(self::$server->getRequest()->getServerProtocol() === 'https') {
+            ini_set('session.cookie_secure', true);
+        }
+
+        self::performSameSiteCookieProtection();
+
+        if (!defined('OC_CONSOLE')) {
+            $errors = OC_Util::checkServer(\OC::$server->getConfig());
+            if (count($errors) > 0) {
+                if (self::$CLI) {
+                    // Convert l10n string into regular string for usage in database
+                    $staticErrors = [];
+                    foreach ($errors as $error) {
+                        echo $error['error'] . "\n";
+                        echo $error['hint'] . "\n\n";
+                        $staticErrors[] = [
+                            'error' => (string)$error['error'],
+                            'hint' => (string)$error['hint'],
+                        ];
+                    }
+
+                    try {
+                        \OC::$server->getConfig()->setAppValue('core', 'cronErrors', json_encode($staticErrors));
+                    } catch (\Exception $e) {
+                        echo('Writing to database failed');
+                    }
+                    exit(1);
+                } else {
+                    OC_Response::setStatus(OC_Response::STATUS_SERVICE_UNAVAILABLE);
+                    OC_Util::addStyle('guest');
+                    OC_Template::printGuestPage('', 'error', array('errors' => $errors));
+                    exit;
+                }
+            } elseif (self::$CLI && \OC::$server->getConfig()->getSystemValue('installed', false)) {
+                \OC::$server->getConfig()->deleteAppValue('core', 'cronErrors');
+            }
+        }
+        //try to set the session lifetime
+        $sessionLifeTime = self::getSessionLifeTime();
+        @ini_set('gc_maxlifetime', (string)$sessionLifeTime);
+
+        $systemConfig = \OC::$server->getSystemConfig();
+
+        // User and Groups
+        if (!$systemConfig->getValue("installed", false)) {
+            self::$server->getSession()->set('user_id', '');
+        }
+
+        OC_User::useBackend(new \OC\User\Database());
+        \OC::$server->getGroupManager()->addBackend(new \OC\Group\Database());
+
+        // Subscribe to the hook
+        \OCP\Util::connectHook(
+            '\OCA\Files_Sharing\API\Server2Server',
+            'preLoginNameUsedAsUserName',
+            '\OC\User\Database',
+            'preLoginNameUsedAsUserName'
+        );
+
+        //setup extra user backends
+        if (!self::checkUpgrade(false)) {
+            OC_User::setupBackends();
+        } else {
+            // Run upgrades in incognito mode
+            OC_User::setIncognitoMode(true);
+        }
+
+        self::registerCacheHooks();
+        self::registerFilesystemHooks();
+        self::registerShareHooks();
+        self::registerLogRotate();
+        self::registerEncryptionWrapper();
+        self::registerEncryptionHooks();
+        self::registerAccountHooks();
+        self::registerSettingsHooks();
+
+        //make sure temporary files are cleaned up
+        $tmpManager = \OC::$server->getTempManager();
+        register_shutdown_function(array($tmpManager, 'clean'));
+        $lockProvider = \OC::$server->getLockingProvider();
+        register_shutdown_function(array($lockProvider, 'releaseAll'));
+
+        // Check whether the sample configuration has been copied
+        if($systemConfig->getValue('copied_sample_config', false)) {
+            $l = \OC::$server->getL10N('lib');
+            header('HTTP/1.1 503 Service Temporarily Unavailable');
+            header('Status: 503 Service Temporarily Unavailable');
+            OC_Template::printErrorPage(
+                $l->t('Sample configuration detected'),
+                $l->t('It has been detected that the sample configuration has been copied. This can break your installation and is unsupported. Please read the documentation before performing changes on config.php')
+            );
+            return;
+        }
+
+        $request = \OC::$server->getRequest();
+        $host = $request->getInsecureServerHost();
+        /**
+         * if the host passed in headers isn't trusted
+         * FIXME: Should not be in here at all :see_no_evil:
+         */
+        if (!OC::$CLI
+            // overwritehost is always trusted, workaround to not have to make
+            // \OC\AppFramework\Http\Request::getOverwriteHost public
+            && self::$server->getConfig()->getSystemValue('overwritehost') === ''
+            && !\OC::$server->getTrustedDomainHelper()->isTrustedDomain($host)
+            && self::$server->getConfig()->getSystemValue('installed', false)
+        ) {
+            // Allow access to CSS resources
+            $isScssRequest = false;
+            if(strpos($request->getPathInfo(), '/css/') === 0) {
+                $isScssRequest = true;
+            }
+
+            if (!$isScssRequest) {
+                header('HTTP/1.1 400 Bad Request');
+                header('Status: 400 Bad Request');
+
+                \OC::$server->getLogger()->warning(
+                    'Trusted domain error. "{remoteAddress}" tried to access using "{host}" as host.',
+                    [
+                        'app' => 'core',
+                        'remoteAddress' => $request->getRemoteAddress(),
+                        'host' => $host,
+                    ]
+                );
+
+                $tmpl = new OCP\Template('core', 'untrustedDomain', 'guest');
+                $tmpl->assign('domain', $host);
+                $tmpl->printPage();
+
+                exit();
+            }
+        }
+        \OC::$server->getEventLogger()->end('boot');
+    }
+
+    /**
+     * register hooks for the cache
+     */
+    public static function registerCacheHooks() {
+        //don't try to do this before we are properly setup
+        if (\OC::$server->getSystemConfig()->getValue('installed', false) && !self::checkUpgrade(false)) {
+
+            // NOTE: This will be replaced to use OCP
+            $userSession = self::$server->getUserSession();
+            $userSession->listen('\OC\User', 'postLogin', function () {
+                try {
+                    $cache = new \OC\Cache\File();
+                    $cache->gc();
+                } catch (\OC\ServerNotAvailableException $e) {
+                    // not a GC exception, pass it on
+                    throw $e;
+                } catch (\Exception $e) {
+                    // a GC exception should not prevent users from using OC,
+                    // so log the exception
+                    \OC::$server->getLogger()->warning('Exception when running cache gc: ' . $e->getMessage(), array('app' => 'core'));
+                }
+            });
+        }
+    }
+
+    public static function registerSettingsHooks() {
+        $dispatcher = \OC::$server->getEventDispatcher();
+        $dispatcher->addListener(OCP\App\ManagerEvent::EVENT_APP_DISABLE, function($event) {
+            /** @var \OCP\App\ManagerEvent $event */
+            \OC::$server->getSettingsManager()->onAppDisabled($event->getAppID());
+        });
+        $dispatcher->addListener(OCP\App\ManagerEvent::EVENT_APP_UPDATE, function($event) {
+            /** @var \OCP\App\ManagerEvent $event */
+            $jobList = \OC::$server->getJobList();
+            $job = 'OC\\Settings\\RemoveOrphaned';
+            if(!($jobList->has($job, null))) {
+                $jobList->add($job);
+            }
+        });
+    }
+
+    private static function registerEncryptionWrapper() {
+        $manager = self::$server->getEncryptionManager();
+        \OCP\Util::connectHook('OC_Filesystem', 'preSetup', $manager, 'setupStorage');
+    }
+
+    private static function registerEncryptionHooks() {
+        $enabled = self::$server->getEncryptionManager()->isEnabled();
+        if ($enabled) {
+            \OCP\Util::connectHook('OCP\Share', 'post_shared', 'OC\Encryption\HookManager', 'postShared');
+            \OCP\Util::connectHook('OCP\Share', 'post_unshare', 'OC\Encryption\HookManager', 'postUnshared');
+            \OCP\Util::connectHook('OC_Filesystem', 'post_rename', 'OC\Encryption\HookManager', 'postRename');
+            \OCP\Util::connectHook('\OCA\Files_Trashbin\Trashbin', 'post_restore', 'OC\Encryption\HookManager', 'postRestore');
+        }
+    }
+
+    private static function registerAccountHooks() {
+        $hookHandler = new \OC\Accounts\Hooks(\OC::$server->getLogger());
+        \OCP\Util::connectHook('OC_User', 'changeUser', $hookHandler, 'changeUserHook');
+    }
+
+    /**
+     * register hooks for the cache
+     */
+    public static function registerLogRotate() {
+        $systemConfig = \OC::$server->getSystemConfig();
+        if ($systemConfig->getValue('installed', false) && $systemConfig->getValue('log_rotate_size', false) && !self::checkUpgrade(false)) {
+            //don't try to do this before we are properly setup
+            //use custom logfile path if defined, otherwise use default of nextcloud.log in data directory
+            \OC::$server->getJobList()->add('OC\Log\Rotate');
+        }
+    }
+
+    /**
+     * register hooks for the filesystem
+     */
+    public static function registerFilesystemHooks() {
+        // Check for blacklisted files
+        OC_Hook::connect('OC_Filesystem', 'write', 'OC\Files\Filesystem', 'isBlacklisted');
+        OC_Hook::connect('OC_Filesystem', 'rename', 'OC\Files\Filesystem', 'isBlacklisted');
+    }
+
+    /**
+     * register hooks for sharing
+     */
+    public static function registerShareHooks() {
+        if (\OC::$server->getSystemConfig()->getValue('installed')) {
+            OC_Hook::connect('OC_User', 'post_deleteUser', 'OC\Share20\Hooks', 'post_deleteUser');
+            OC_Hook::connect('OC_User', 'post_removeFromGroup', 'OC\Share20\Hooks', 'post_removeFromGroup');
+            OC_Hook::connect('OC_User', 'post_deleteGroup', 'OC\Share20\Hooks', 'post_deleteGroup');
+        }
+    }
+
+    protected static function registerAutoloaderCache() {
+        // The class loader takes an optional low-latency cache, which MUST be
+        // namespaced. The instanceid is used for namespacing, but might be
+        // unavailable at this point. Furthermore, it might not be possible to
+        // generate an instanceid via \OC_Util::getInstanceId() because the
+        // config file may not be writable. As such, we only register a class
+        // loader cache if instanceid is available without trying to create one.
+        $instanceId = \OC::$server->getSystemConfig()->getValue('instanceid', null);
+        if ($instanceId) {
+            try {
+                $memcacheFactory = \OC::$server->getMemCacheFactory();
+                self::$loader->setMemoryCache($memcacheFactory->createLocal('Autoloader'));
+            } catch (\Exception $ex) {
+            }
+        }
+    }
+
+    /**
+     * Handle the request
+     */
+    public static function handleRequest() {
+
+        \OC::$server->getEventLogger()->start('handle_request', 'Handle request');
+        $systemConfig = \OC::$server->getSystemConfig();
+        // load all the classpaths from the enabled apps so they are available
+        // in the routing files of each app
+        OC::loadAppClassPaths();
+
+        // Check if Nextcloud is installed or in maintenance (update) mode
+        if (!$systemConfig->getValue('installed', false)) {
+            \OC::$server->getSession()->clear();
+            $setupHelper = new OC\Setup(\OC::$server->getConfig(), \OC::$server->getIniWrapper(),
+                \OC::$server->getL10N('lib'), \OC::$server->getThemingDefaults(), \OC::$server->getLogger(),
+                \OC::$server->getSecureRandom());
+            $controller = new OC\Core\Controller\SetupController($setupHelper);
+            $controller->run($_POST);
+            exit();
+        }
+
+        $request = \OC::$server->getRequest();
+        $requestPath = $request->getRawPathInfo();
+        if ($requestPath === '/heartbeat') {
+            return;
+        }
+        if (substr($requestPath, -3) !== '.js') { // we need these files during the upgrade
+            self::checkMaintenanceMode();
+            self::checkUpgrade();
+        }
+
+        // emergency app disabling
+        if ($requestPath === '/disableapp'
+            && $request->getMethod() === 'POST'
+            && ((string)$request->getParam('appid')) !== ''
+        ) {
+            \OCP\JSON::callCheck();
+            \OCP\JSON::checkAdminUser();
+            $appId = (string)$request->getParam('appid');
+            $appId = \OC_App::cleanAppId($appId);
+
+            \OC_App::disable($appId);
+            \OC_JSON::success();
+            exit();
+        }
+
+        // Always load authentication apps
+        OC_App::loadApps(['authentication']);
+
+        // Load minimum set of apps
+        if (!self::checkUpgrade(false)
+            && !$systemConfig->getValue('maintenance', false)) {
+            // For logged-in users: Load everything
+            if(\OC::$server->getUserSession()->isLoggedIn()) {
+                OC_App::loadApps();
+            } else {
+                // For guests: Load only filesystem and logging
+                OC_App::loadApps(array('filesystem', 'logging'));
+                self::handleLogin($request);
+            }
+        }
+
+        if (!self::$CLI) {
+            try {
+                if (!$systemConfig->getValue('maintenance', false) && !self::checkUpgrade(false)) {
+                    OC_App::loadApps(array('filesystem', 'logging'));
+                    OC_App::loadApps();
+                }
+                OC_Util::setupFS();
+                OC::$server->getRouter()->match(\OC::$server->getRequest()->getRawPathInfo());
+                return;
+            } catch (Symfony\Component\Routing\Exception\ResourceNotFoundException $e) {
+                //header('HTTP/1.0 404 Not Found');
+            } catch (Symfony\Component\Routing\Exception\MethodNotAllowedException $e) {
+                OC_Response::setStatus(405);
+                return;
+            }
+        }
+
+        // Handle WebDAV
+        if ($_SERVER['REQUEST_METHOD'] == 'PROPFIND') {
+            // not allowed any more to prevent people
+            // mounting this root directly.
+            // Users need to mount remote.php/webdav instead.
+            header('HTTP/1.1 405 Method Not Allowed');
+            header('Status: 405 Method Not Allowed');
+            return;
+        }
+
+        // Someone is logged in
+        if (\OC::$server->getUserSession()->isLoggedIn()) {
+            OC_App::loadApps();
+            OC_User::setupBackends();
+            OC_Util::setupFS();
+            // FIXME
+            // Redirect to default application
+            OC_Util::redirectToDefaultPage();
+        } else {
+            // Not handled and not logged in
+            header('Location: '.\OC::$server->getURLGenerator()->linkToRouteAbsolute('core.login.showLoginForm'));
+        }
+    }
+
+    /**
+     * Check login: apache auth, auth token, basic auth
+     *
+     * @param OCP\IRequest $request
+     * @return boolean
+     */
+    static function handleLogin(OCP\IRequest $request) {
+        $userSession = self::$server->getUserSession();
+        if (OC_User::handleApacheAuth()) {
+            return true;
+        }
+        if ($userSession->tryTokenLogin($request)) {
+            return true;
+        }
+        if (isset($_COOKIE['nc_username'])
+            && isset($_COOKIE['nc_token'])
+            && isset($_COOKIE['nc_session_id'])
+            && $userSession->loginWithCookie($_COOKIE['nc_username'], $_COOKIE['nc_token'], $_COOKIE['nc_session_id'])) {
+            return true;
+        }
+        if ($userSession->tryBasicAuthLogin($request, \OC::$server->getBruteForceThrottler())) {
+            return true;
+        }
+        return false;
+    }
+
+    protected static function handleAuthHeaders() {
+        //copy http auth headers for apache+php-fcgid work around
+        if (isset($_SERVER['HTTP_XAUTHORIZATION']) && !isset($_SERVER['HTTP_AUTHORIZATION'])) {
+            $_SERVER['HTTP_AUTHORIZATION'] = $_SERVER['HTTP_XAUTHORIZATION'];
+        }
+
+        // Extract PHP_AUTH_USER/PHP_AUTH_PW from other headers if necessary.
+        $vars = array(
+            'HTTP_AUTHORIZATION', // apache+php-cgi work around
+            'REDIRECT_HTTP_AUTHORIZATION', // apache+php-cgi alternative
+        );
+        foreach ($vars as $var) {
+            if (isset($_SERVER[$var]) && preg_match('/Basic\s+(.*)$/i', $_SERVER[$var], $matches)) {
+                list($name, $password) = explode(':', base64_decode($matches[1]), 2);
+                $_SERVER['PHP_AUTH_USER'] = $name;
+                $_SERVER['PHP_AUTH_PW'] = $password;
+                break;
+            }
+        }
+    }
 }
 
 OC::init();