migrate therinaldos.com data

wedding-pics/apps/settings/lib/Activity/GroupProvider.php

@@ -0,0 +1,166 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016 Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Activity;
+
+use InvalidArgumentException;
+use OCP\Activity\IEvent;
+use OCP\Activity\IManager;
+use OCP\Activity\IProvider;
+use OCP\IGroup;
+use OCP\IGroupManager;
+use OCP\IURLGenerator;
+use OCP\IUserManager;
+use OCP\L10N\IFactory as L10nFactory;
+
+class GroupProvider implements IProvider {
+	public const ADDED_TO_GROUP = 'group_added';
+	public const REMOVED_FROM_GROUP = 'group_removed';
+
+	/** @var L10nFactory */
+	private $l10n;
+	/** @var IURLGenerator */
+	private $urlGenerator;
+	/** @var IManager */
+	private $activityManager;
+	/** @var IUserManager */
+	protected $userManager;
+	/** @var IGroupManager */
+	protected $groupManager;
+
+	/** @var string[] */
+	protected $groupDisplayNames = [];
+
+
+	public function __construct(L10nFactory $l10n,
+		IURLGenerator $urlGenerator,
+		IManager $activityManager,
+		IUserManager $userManager,
+		IGroupManager $groupManager) {
+		$this->urlGenerator = $urlGenerator;
+		$this->l10n = $l10n;
+		$this->activityManager = $activityManager;
+		$this->userManager = $userManager;
+		$this->groupManager = $groupManager;
+	}
+
+	public function parse($language, IEvent $event, IEvent $previousEvent = null) {
+		if ($event->getType() !== 'group_settings') {
+			throw new InvalidArgumentException();
+		}
+
+		$l = $this->l10n->get('settings', $language);
+
+		$params = $event->getSubjectParameters();
+		$parsedParameters = [
+			'user' => $this->generateUserParameter($params['user']),
+			'group' => $this->generateGroupParameter($params['group']),
+		];
+
+		if (isset($params['actor'])) {
+			$parsedParameters['actor'] = $this->generateUserParameter($params['actor']);
+		}
+
+		switch ($event->getSubject()) {
+			case self::ADDED_TO_GROUP:
+				if (isset($parsedParameters['actor'])) {
+					if ($this->activityManager->getCurrentUserId() === $params['user']) {
+						$subject = $l->t('{actor} added you to group {group}');
+					} elseif (isset($params['actor']) && $this->activityManager->getCurrentUserId() === $params['actor']) {
+						$subject = $l->t('You added {user} to group {group}');
+					} else {
+						$subject = $l->t('{actor} added {user} to group {group}');
+					}
+				} elseif ($this->activityManager->getCurrentUserId() === $params['user']) {
+					$subject = $l->t('An administrator added you to group {group}');
+				} else {
+					$subject = $l->t('An administrator added {user} to group {group}');
+				}
+				break;
+			case self::REMOVED_FROM_GROUP:
+				if (isset($parsedParameters['actor'])) {
+					if ($this->activityManager->getCurrentUserId() === $params['user']) {
+						$subject = $l->t('{actor} removed you from group {group}');
+					} elseif (isset($params['actor']) && $this->activityManager->getCurrentUserId() === $params['actor']) {
+						$subject = $l->t('You removed {user} from group {group}');
+					} else {
+						$subject = $l->t('{actor} removed {user} from group {group}');
+					}
+				} elseif ($this->activityManager->getCurrentUserId() === $params['user']) {
+					$subject = $l->t('An administrator removed you from group {group}');
+				} else {
+					$subject = $l->t('An administrator removed {user} from group {group}');
+				}
+				break;
+			default:
+				throw new InvalidArgumentException();
+		}
+
+		$this->setSubjects($event, $subject, $parsedParameters);
+
+		return $event;
+	}
+
+	/**
+	 * @throws \InvalidArgumentException
+	 */
+	protected function setSubjects(IEvent $event, string $subject, array $parameters): void {
+		$event->setRichSubject($subject, $parameters);
+	}
+
+	/**
+	 * @param string $gid
+	 * @return array
+	 */
+	protected function generateGroupParameter(string $gid): array {
+		if (!isset($this->groupDisplayNames[$gid])) {
+			$this->groupDisplayNames[$gid] = $this->getGroupDisplayName($gid);
+		}
+
+		return [
+			'type' => 'user-group',
+			'id' => $gid,
+			'name' => $this->groupDisplayNames[$gid],
+		];
+	}
+
+	/**
+	 * @param string $gid
+	 * @return string
+	 */
+	protected function getGroupDisplayName(string $gid): string {
+		$group = $this->groupManager->get($gid);
+		if ($group instanceof IGroup) {
+			return $group->getDisplayName();
+		}
+		return $gid;
+	}
+
+	protected function generateUserParameter(string $uid): array {
+		return [
+			'type' => 'user',
+			'id' => $uid,
+			'name' => $this->userManager->getDisplayName($uid) ?? $uid,
+		];
+	}
+}

wedding-pics/apps/settings/lib/Activity/GroupSetting.php

@@ -0,0 +1,98 @@
+<?php
+/**
+ * @copyright Copyright (c) 2017 Joas Schilling <coding@schilljs.com>
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Activity;
+
+use OCP\Activity\ISetting;
+use OCP\IL10N;
+
+class GroupSetting implements ISetting {
+
+	/** @var IL10N */
+	protected $l;
+
+	/**
+	 * @param IL10N $l10n
+	 */
+	public function __construct(IL10N $l10n) {
+		$this->l = $l10n;
+	}
+
+	/**
+	 * @return string Lowercase a-z and underscore only identifier
+	 * @since 11.0.0
+	 */
+	public function getIdentifier(): string {
+		return 'group_settings';
+	}
+
+	/**
+	 * @return string A translated string
+	 * @since 11.0.0
+	 */
+	public function getName(): string {
+		return $this->l->t('Your <strong>group memberships</strong> were modified');
+	}
+
+	/**
+	 * @return int whether the filter should be rather on the top or bottom of
+	 * the admin section. The filters are arranged in ascending order of the
+	 * priority values. It is required to return a value between 0 and 100.
+	 * @since 11.0.0
+	 */
+	public function getPriority(): int {
+		return 0;
+	}
+
+	/**
+	 * @return bool True when the option can be changed for the stream
+	 * @since 11.0.0
+	 */
+	public function canChangeStream(): bool {
+		return false;
+	}
+
+	/**
+	 * @return bool True when the option can be changed for the stream
+	 * @since 11.0.0
+	 */
+	public function isDefaultEnabledStream(): bool {
+		return true;
+	}
+
+	/**
+	 * @return bool True when the option can be changed for the mail
+	 * @since 11.0.0
+	 */
+	public function canChangeMail(): bool {
+		return true;
+	}
+
+	/**
+	 * @return bool True when the option can be changed for the stream
+	 * @since 11.0.0
+	 */
+	public function isDefaultEnabledMail(): bool {
+		return true;
+	}
+}

wedding-pics/apps/settings/lib/Activity/Provider.php

@@ -0,0 +1,201 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2017 Joas Schilling <coding@schilljs.com>
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Daniel Kesselberg <mail@danielkesselberg.de>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Thomas Citharel <nextcloud@tcit.fr>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Activity;
+
+use OCP\Activity\IEvent;
+use OCP\Activity\IManager;
+use OCP\Activity\IProvider;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\IUserManager;
+use OCP\L10N\IFactory;
+
+class Provider implements IProvider {
+	public const PASSWORD_CHANGED_BY = 'password_changed_by';
+	public const PASSWORD_CHANGED_SELF = 'password_changed_self';
+	public const PASSWORD_RESET = 'password_changed';
+	public const PASSWORD_RESET_SELF = 'password_reset_self';
+	public const EMAIL_CHANGED_BY = 'email_changed_by';
+	public const EMAIL_CHANGED_SELF = 'email_changed_self';
+	public const EMAIL_CHANGED = 'email_changed';
+	public const APP_TOKEN_CREATED = 'app_token_created';
+	public const APP_TOKEN_DELETED = 'app_token_deleted';
+	public const APP_TOKEN_RENAMED = 'app_token_renamed';
+	public const APP_TOKEN_FILESYSTEM_GRANTED = 'app_token_filesystem_granted';
+	public const APP_TOKEN_FILESYSTEM_REVOKED = 'app_token_filesystem_revoked';
+
+	/** @var IFactory */
+	protected $languageFactory;
+
+	/** @var IL10N */
+	protected $l;
+
+	/** @var IURLGenerator */
+	protected $url;
+
+	/** @var IUserManager */
+	protected $userManager;
+
+	/** @var IManager */
+	private $activityManager;
+
+	public function __construct(IFactory $languageFactory,
+		IURLGenerator $url,
+		IUserManager $userManager,
+		IManager $activityManager) {
+		$this->languageFactory = $languageFactory;
+		$this->url = $url;
+		$this->userManager = $userManager;
+		$this->activityManager = $activityManager;
+	}
+
+	/**
+	 * @param string $language
+	 * @param IEvent $event
+	 * @param IEvent|null $previousEvent
+	 * @return IEvent
+	 * @throws \InvalidArgumentException
+	 * @since 11.0.0
+	 */
+	public function parse($language, IEvent $event, IEvent $previousEvent = null): IEvent {
+		if ($event->getApp() !== 'settings') {
+			throw new \InvalidArgumentException('Unknown app');
+		}
+
+		$this->l = $this->languageFactory->get('settings', $language);
+
+		if ($this->activityManager->getRequirePNG()) {
+			$event->setIcon($this->url->getAbsoluteURL($this->url->imagePath('settings', 'personal.png')));
+		} else {
+			$event->setIcon($this->url->getAbsoluteURL($this->url->imagePath('settings', 'personal.svg')));
+		}
+
+		if ($event->getSubject() === self::PASSWORD_CHANGED_BY) {
+			$subject = $this->l->t('{actor} changed your password');
+		} elseif ($event->getSubject() === self::PASSWORD_CHANGED_SELF) {
+			$subject = $this->l->t('You changed your password');
+		} elseif ($event->getSubject() === self::PASSWORD_RESET) {
+			$subject = $this->l->t('Your password was reset by an administrator');
+		} elseif ($event->getSubject() === self::PASSWORD_RESET_SELF) {
+			$subject = $this->l->t('Your password was reset');
+		} elseif ($event->getSubject() === self::EMAIL_CHANGED_BY) {
+			$subject = $this->l->t('{actor} changed your email address');
+		} elseif ($event->getSubject() === self::EMAIL_CHANGED_SELF) {
+			$subject = $this->l->t('You changed your email address');
+		} elseif ($event->getSubject() === self::EMAIL_CHANGED) {
+			$subject = $this->l->t('Your email address was changed by an administrator');
+		} elseif ($event->getSubject() === self::APP_TOKEN_CREATED) {
+			if ($event->getAffectedUser() === $event->getAuthor()) {
+				$subject = $this->l->t('You created an app password for a session named "{token}"');
+			} else {
+				$subject = $this->l->t('An administrator created an app password for a session named "{token}"');
+			}
+		} elseif ($event->getSubject() === self::APP_TOKEN_DELETED) {
+			$subject = $this->l->t('You deleted app password "{token}"');
+		} elseif ($event->getSubject() === self::APP_TOKEN_RENAMED) {
+			$subject = $this->l->t('You renamed app password "{token}" to "{newToken}"');
+		} elseif ($event->getSubject() === self::APP_TOKEN_FILESYSTEM_GRANTED) {
+			$subject = $this->l->t('You granted filesystem access to app password "{token}"');
+		} elseif ($event->getSubject() === self::APP_TOKEN_FILESYSTEM_REVOKED) {
+			$subject = $this->l->t('You revoked filesystem access from app password "{token}"');
+		} else {
+			throw new \InvalidArgumentException('Unknown subject');
+		}
+
+		$parsedParameters = $this->getParameters($event);
+		$this->setSubjects($event, $subject, $parsedParameters);
+
+		return $event;
+	}
+
+	/**
+	 * @param IEvent $event
+	 * @return array
+	 * @throws \InvalidArgumentException
+	 */
+	protected function getParameters(IEvent $event): array {
+		$subject = $event->getSubject();
+		$parameters = $event->getSubjectParameters();
+
+		switch ($subject) {
+			case self::PASSWORD_CHANGED_SELF:
+			case self::PASSWORD_RESET:
+			case self::PASSWORD_RESET_SELF:
+			case self::EMAIL_CHANGED_SELF:
+			case self::EMAIL_CHANGED:
+				return [];
+			case self::PASSWORD_CHANGED_BY:
+			case self::EMAIL_CHANGED_BY:
+				return [
+					'actor' => $this->generateUserParameter($parameters[0]),
+				];
+			case self::APP_TOKEN_CREATED:
+			case self::APP_TOKEN_DELETED:
+			case self::APP_TOKEN_FILESYSTEM_GRANTED:
+			case self::APP_TOKEN_FILESYSTEM_REVOKED:
+				return [
+					'token' => [
+						'type' => 'highlight',
+						'id' => $event->getObjectId(),
+						'name' => $parameters['name'],
+					]
+				];
+			case self::APP_TOKEN_RENAMED:
+				return [
+					'token' => [
+						'type' => 'highlight',
+						'id' => $event->getObjectId(),
+						'name' => $parameters['name'],
+					],
+					'newToken' => [
+						'type' => 'highlight',
+						'id' => $event->getObjectId(),
+						'name' => $parameters['newName'],
+					]
+				];
+		}
+
+		throw new \InvalidArgumentException('Unknown subject');
+	}
+
+	/**
+	 * @throws \InvalidArgumentException
+	 */
+	protected function setSubjects(IEvent $event, string $subject, array $parameters): void {
+		$event->setRichSubject($subject, $parameters);
+	}
+
+	protected function generateUserParameter(string $uid): array {
+		return [
+			'type' => 'user',
+			'id' => $uid,
+			'name' => $this->userManager->getDisplayName($uid) ?? $uid,
+		];
+	}
+}

wedding-pics/apps/settings/lib/Activity/SecurityFilter.php

@@ -0,0 +1,65 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016 Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Activity;
+
+use OCP\Activity\IFilter;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+
+class SecurityFilter implements IFilter {
+
+	/** @var IURLGenerator */
+	private $urlGenerator;
+
+	/** @var IL10N */
+	private $l10n;
+
+	public function __construct(IURLGenerator $urlGenerator, IL10N $l10n) {
+		$this->urlGenerator = $urlGenerator;
+		$this->l10n = $l10n;
+	}
+
+	public function allowedApps() {
+		return [];
+	}
+
+	public function filterTypes(array $types) {
+		return array_intersect(['security'], $types);
+	}
+
+	public function getIcon() {
+		return $this->urlGenerator->getAbsoluteURL($this->urlGenerator->imagePath('core', 'actions/password.svg'));
+	}
+
+	public function getIdentifier() {
+		return 'security';
+	}
+
+	public function getName() {
+		return $this->l10n->t('Security');
+	}
+
+	public function getPriority() {
+		return 30;
+	}
+}

wedding-pics/apps/settings/lib/Activity/SecurityProvider.php

@@ -0,0 +1,111 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2016 Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Activity;
+
+use InvalidArgumentException;
+use OCP\Activity\IEvent;
+use OCP\Activity\IManager;
+use OCP\Activity\IProvider;
+use OCP\IURLGenerator;
+use OCP\L10N\IFactory as L10nFactory;
+
+class SecurityProvider implements IProvider {
+
+	/** @var L10nFactory */
+	private $l10n;
+
+	/** @var IURLGenerator */
+	private $urlGenerator;
+
+	/** @var IManager */
+	private $activityManager;
+
+	public function __construct(L10nFactory $l10n, IURLGenerator $urlGenerator, IManager $activityManager) {
+		$this->urlGenerator = $urlGenerator;
+		$this->l10n = $l10n;
+		$this->activityManager = $activityManager;
+	}
+
+	public function parse($language, IEvent $event, IEvent $previousEvent = null) {
+		if ($event->getType() !== 'security') {
+			throw new InvalidArgumentException();
+		}
+
+		$l = $this->l10n->get('settings', $language);
+
+		switch ($event->getSubject()) {
+			case 'twofactor_success':
+				$params = $event->getSubjectParameters();
+				$event->setParsedSubject($l->t('You successfully logged in using two-factor authentication (%1$s)', [
+					$params['provider'],
+				]));
+				if ($this->activityManager->getRequirePNG()) {
+					$event->setIcon($this->urlGenerator->getAbsoluteURL($this->urlGenerator->imagePath('core', 'actions/password.png')));
+				} else {
+					$event->setIcon($this->urlGenerator->getAbsoluteURL($this->urlGenerator->imagePath('core', 'actions/password.svg')));
+				}
+				break;
+			case 'twofactor_failed':
+				$params = $event->getSubjectParameters();
+				$event->setParsedSubject($l->t('A login attempt using two-factor authentication failed (%1$s)', [
+					$params['provider'],
+				]));
+				if ($this->activityManager->getRequirePNG()) {
+					$event->setIcon($this->urlGenerator->getAbsoluteURL($this->urlGenerator->imagePath('core', 'actions/password.png')));
+				} else {
+					$event->setIcon($this->urlGenerator->getAbsoluteURL($this->urlGenerator->imagePath('core', 'actions/password.svg')));
+				}
+				break;
+			case 'remote_wipe_start':
+				$params = $event->getSubjectParameters();
+				$event->setParsedSubject($l->t('Remote wipe was started on %1$s', [
+					$params['name'],
+				]));
+				if ($this->activityManager->getRequirePNG()) {
+					$event->setIcon($this->urlGenerator->getAbsoluteURL($this->urlGenerator->imagePath('core', 'actions/delete.png')));
+				} else {
+					$event->setIcon($this->urlGenerator->getAbsoluteURL($this->urlGenerator->imagePath('core', 'actions/delete.svg')));
+				}
+				break;
+			case 'remote_wipe_finish':
+				$params = $event->getSubjectParameters();
+				$event->setParsedSubject($l->t('Remote wipe has finished on %1$s', [
+					$params['name'],
+				]));
+				if ($this->activityManager->getRequirePNG()) {
+					$event->setIcon($this->urlGenerator->getAbsoluteURL($this->urlGenerator->imagePath('core', 'actions/delete.png')));
+				} else {
+					$event->setIcon($this->urlGenerator->getAbsoluteURL($this->urlGenerator->imagePath('core', 'actions/delete.svg')));
+				}
+				break;
+			default:
+				throw new InvalidArgumentException();
+		}
+		return $event;
+	}
+}

wedding-pics/apps/settings/lib/Activity/SecuritySetting.php

@@ -0,0 +1,64 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016 Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Activity;
+
+use OCP\Activity\ISetting;
+use OCP\IL10N;
+
+class SecuritySetting implements ISetting {
+
+	/** @var IL10N */
+	private $l10n;
+
+	public function __construct(IL10N $l10n) {
+		$this->l10n = $l10n;
+	}
+
+	public function canChangeMail() {
+		return false;
+	}
+
+	public function canChangeStream() {
+		return false;
+	}
+
+	public function getIdentifier() {
+		return 'security';
+	}
+
+	public function getName() {
+		return $this->l10n->t('Security');
+	}
+
+	public function getPriority() {
+		return 30;
+	}
+
+	public function isDefaultEnabledMail() {
+		return true;
+	}
+
+	public function isDefaultEnabledStream() {
+		return true;
+	}
+}

wedding-pics/apps/settings/lib/Activity/Setting.php

@@ -0,0 +1,98 @@
+<?php
+/**
+ * @copyright Copyright (c) 2017 Joas Schilling <coding@schilljs.com>
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Activity;
+
+use OCP\Activity\ISetting;
+use OCP\IL10N;
+
+class Setting implements ISetting {
+
+	/** @var IL10N */
+	protected $l;
+
+	/**
+	 * @param IL10N $l10n
+	 */
+	public function __construct(IL10N $l10n) {
+		$this->l = $l10n;
+	}
+
+	/**
+	 * @return string Lowercase a-z and underscore only identifier
+	 * @since 11.0.0
+	 */
+	public function getIdentifier() {
+		return 'personal_settings';
+	}
+
+	/**
+	 * @return string A translated string
+	 * @since 11.0.0
+	 */
+	public function getName() {
+		return $this->l->t('Your <strong>password</strong> or <strong>email</strong> was modified');
+	}
+
+	/**
+	 * @return int whether the filter should be rather on the top or bottom of
+	 * the admin section. The filters are arranged in ascending order of the
+	 * priority values. It is required to return a value between 0 and 100.
+	 * @since 11.0.0
+	 */
+	public function getPriority() {
+		return 0;
+	}
+
+	/**
+	 * @return bool True when the option can be changed for the stream
+	 * @since 11.0.0
+	 */
+	public function canChangeStream() {
+		return false;
+	}
+
+	/**
+	 * @return bool True when the option can be changed for the stream
+	 * @since 11.0.0
+	 */
+	public function isDefaultEnabledStream() {
+		return true;
+	}
+
+	/**
+	 * @return bool True when the option can be changed for the mail
+	 * @since 11.0.0
+	 */
+	public function canChangeMail() {
+		return false;
+	}
+
+	/**
+	 * @return bool True when the option can be changed for the stream
+	 * @since 11.0.0
+	 */
+	public function isDefaultEnabledMail() {
+		return false;
+	}
+}

wedding-pics/apps/settings/lib/AppInfo/Application.php

@@ -0,0 +1,244 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Björn Schießle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Daniel Kesselberg <mail@danielkesselberg.de>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Robin Appelman <robin@icewind.nl>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ * @author zulan <git@zulan.net>
+ * @author Stephan Orbaugh <stephan.orbaugh@nextcloud.com>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Settings\AppInfo;
+
+use OC\AppFramework\Utility\TimeFactory;
+use OC\Authentication\Events\AppPasswordCreatedEvent;
+use OC\Authentication\Token\IProvider;
+use OC\Server;
+use OCA\Settings\Hooks;
+use OCA\Settings\Listener\AppPasswordCreatedActivityListener;
+use OCA\Settings\Listener\GroupRemovedListener;
+use OCA\Settings\Listener\UserAddedToGroupActivityListener;
+use OCA\Settings\Listener\UserRemovedFromGroupActivityListener;
+use OCA\Settings\Mailer\NewUserMailHelper;
+use OCA\Settings\Middleware\SubadminMiddleware;
+use OCA\Settings\Search\AppSearch;
+use OCA\Settings\Search\SectionSearch;
+use OCA\Settings\Search\UserSearch;
+use OCA\Settings\SetupChecks\AppDirsWithDifferentOwner;
+use OCA\Settings\SetupChecks\BruteForceThrottler;
+use OCA\Settings\SetupChecks\CheckUserCertificates;
+use OCA\Settings\SetupChecks\CodeIntegrity;
+use OCA\Settings\SetupChecks\CronErrors;
+use OCA\Settings\SetupChecks\CronInfo;
+use OCA\Settings\SetupChecks\DatabaseHasMissingColumns;
+use OCA\Settings\SetupChecks\DatabaseHasMissingIndices;
+use OCA\Settings\SetupChecks\DatabaseHasMissingPrimaryKeys;
+use OCA\Settings\SetupChecks\DatabasePendingBigIntConversions;
+use OCA\Settings\SetupChecks\DefaultPhoneRegionSet;
+use OCA\Settings\SetupChecks\EmailTestSuccessful;
+use OCA\Settings\SetupChecks\FileLocking;
+use OCA\Settings\SetupChecks\ForwardedForHeaders;
+use OCA\Settings\SetupChecks\InternetConnectivity;
+use OCA\Settings\SetupChecks\JavaScriptModules;
+use OCA\Settings\SetupChecks\LegacySSEKeyFormat;
+use OCA\Settings\SetupChecks\MaintenanceWindowStart;
+use OCA\Settings\SetupChecks\MemcacheConfigured;
+use OCA\Settings\SetupChecks\OverwriteCliUrl;
+use OCA\Settings\SetupChecks\PhpDefaultCharset;
+use OCA\Settings\SetupChecks\PhpFreetypeSupport;
+use OCA\Settings\SetupChecks\PhpGetEnv;
+use OCA\Settings\SetupChecks\PhpMemoryLimit;
+use OCA\Settings\SetupChecks\PhpModules;
+use OCA\Settings\SetupChecks\PhpOpcacheSetup;
+use OCA\Settings\SetupChecks\PhpOutdated;
+use OCA\Settings\SetupChecks\PhpOutputBuffering;
+use OCA\Settings\SetupChecks\RandomnessSecure;
+use OCA\Settings\SetupChecks\ReadOnlyConfig;
+use OCA\Settings\SetupChecks\SupportedDatabase;
+use OCA\Settings\SetupChecks\SystemIs64bit;
+use OCA\Settings\SetupChecks\TransactionIsolation;
+use OCA\Settings\UserMigration\AccountMigrator;
+use OCA\Settings\WellKnown\ChangePasswordHandler;
+use OCA\Settings\WellKnown\SecurityTxtHandler;
+use OCP\AppFramework\App;
+use OCP\AppFramework\Bootstrap\IBootContext;
+use OCP\AppFramework\Bootstrap\IBootstrap;
+use OCP\AppFramework\Bootstrap\IRegistrationContext;
+use OCP\AppFramework\IAppContainer;
+use OCP\Defaults;
+use OCP\Group\Events\GroupDeletedEvent;
+use OCP\Group\Events\UserAddedEvent;
+use OCP\Group\Events\UserRemovedEvent;
+use OCP\IServerContainer;
+use OCP\Settings\IManager;
+use OCP\Util;
+
+class Application extends App implements IBootstrap {
+	public const APP_ID = 'settings';
+
+	/**
+	 * @param array $urlParams
+	 */
+	public function __construct(array $urlParams = []) {
+		parent::__construct(self::APP_ID, $urlParams);
+	}
+
+	public function register(IRegistrationContext $context): void {
+		// Register Middleware
+		$context->registerServiceAlias('SubadminMiddleware', SubadminMiddleware::class);
+		$context->registerMiddleware(SubadminMiddleware::class);
+		$context->registerSearchProvider(SectionSearch::class);
+		$context->registerSearchProvider(AppSearch::class);
+		$context->registerSearchProvider(UserSearch::class);
+
+		// Register listeners
+		$context->registerEventListener(AppPasswordCreatedEvent::class, AppPasswordCreatedActivityListener::class);
+		$context->registerEventListener(UserAddedEvent::class, UserAddedToGroupActivityListener::class);
+		$context->registerEventListener(UserRemovedEvent::class, UserRemovedFromGroupActivityListener::class);
+		$context->registerEventListener(GroupDeletedEvent::class, GroupRemovedListener::class);
+
+		// Register well-known handlers
+		$context->registerWellKnownHandler(SecurityTxtHandler::class);
+		$context->registerWellKnownHandler(ChangePasswordHandler::class);
+
+		/**
+		 * Core class wrappers
+		 */
+		/** FIXME: Remove once OC_User is non-static and mockable */
+		$context->registerService('isAdmin', function () {
+			return \OC_User::isAdminUser(\OC_User::getUser());
+		});
+		/** FIXME: Remove once OC_SubAdmin is non-static and mockable */
+		$context->registerService('isSubAdmin', function () {
+			$userObject = \OC::$server->getUserSession()->getUser();
+			$isSubAdmin = false;
+			if ($userObject !== null) {
+				$isSubAdmin = \OC::$server->getGroupManager()->getSubAdmin()->isSubAdmin($userObject);
+			}
+			return $isSubAdmin;
+		});
+		$context->registerService(IProvider::class, function (IAppContainer $appContainer) {
+			/** @var IServerContainer $serverContainer */
+			$serverContainer = $appContainer->query(IServerContainer::class);
+			return $serverContainer->query(IProvider::class);
+		});
+		$context->registerService(IManager::class, function (IAppContainer $appContainer) {
+			/** @var IServerContainer $serverContainer */
+			$serverContainer = $appContainer->query(IServerContainer::class);
+			return $serverContainer->getSettingsManager();
+		});
+
+		$context->registerService(NewUserMailHelper::class, function (IAppContainer $appContainer) {
+			/** @var Server $server */
+			$server = $appContainer->query(IServerContainer::class);
+			/** @var Defaults $defaults */
+			$defaults = $server->query(Defaults::class);
+
+			return new NewUserMailHelper(
+				$defaults,
+				$server->getURLGenerator(),
+				$server->getL10NFactory(),
+				$server->getMailer(),
+				$server->getSecureRandom(),
+				new TimeFactory(),
+				$server->getConfig(),
+				$server->getCrypto(),
+				Util::getDefaultEmailAddress('no-reply')
+			);
+		});
+		$context->registerSetupCheck(AppDirsWithDifferentOwner::class);
+		$context->registerSetupCheck(BruteForceThrottler::class);
+		$context->registerSetupCheck(CheckUserCertificates::class);
+		$context->registerSetupCheck(CodeIntegrity::class);
+		$context->registerSetupCheck(CronErrors::class);
+		$context->registerSetupCheck(CronInfo::class);
+		$context->registerSetupCheck(DatabaseHasMissingColumns::class);
+		$context->registerSetupCheck(DatabaseHasMissingIndices::class);
+		$context->registerSetupCheck(DatabaseHasMissingPrimaryKeys::class);
+		$context->registerSetupCheck(DatabasePendingBigIntConversions::class);
+		$context->registerSetupCheck(DefaultPhoneRegionSet::class);
+		$context->registerSetupCheck(EmailTestSuccessful::class);
+		$context->registerSetupCheck(FileLocking::class);
+		$context->registerSetupCheck(ForwardedForHeaders::class);
+		$context->registerSetupCheck(InternetConnectivity::class);
+		$context->registerSetupCheck(JavaScriptModules::class);
+		$context->registerSetupCheck(LegacySSEKeyFormat::class);
+		$context->registerSetupCheck(MaintenanceWindowStart::class);
+		$context->registerSetupCheck(MemcacheConfigured::class);
+		$context->registerSetupCheck(OverwriteCliUrl::class);
+		$context->registerSetupCheck(PhpDefaultCharset::class);
+		$context->registerSetupCheck(PhpFreetypeSupport::class);
+		$context->registerSetupCheck(PhpGetEnv::class);
+		$context->registerSetupCheck(PhpMemoryLimit::class);
+		$context->registerSetupCheck(PhpModules::class);
+		$context->registerSetupCheck(PhpOpcacheSetup::class);
+		$context->registerSetupCheck(PhpOutdated::class);
+		$context->registerSetupCheck(PhpOutputBuffering::class);
+		$context->registerSetupCheck(RandomnessSecure::class);
+		$context->registerSetupCheck(ReadOnlyConfig::class);
+		$context->registerSetupCheck(SupportedDatabase::class);
+		$context->registerSetupCheck(SystemIs64bit::class);
+		$context->registerSetupCheck(TransactionIsolation::class);
+
+		$context->registerUserMigrator(AccountMigrator::class);
+	}
+
+	public function boot(IBootContext $context): void {
+		Util::connectHook('OC_User', 'post_setPassword', $this, 'onChangePassword');
+		Util::connectHook('OC_User', 'changeUser', $this, 'onChangeInfo');
+	}
+
+	/**
+	 * @param array $parameters
+	 * @throws \InvalidArgumentException
+	 * @throws \BadMethodCallException
+	 * @throws \Exception
+	 * @throws \OCP\AppFramework\QueryException
+	 */
+	public function onChangePassword(array $parameters) {
+		/** @var Hooks $hooks */
+		$hooks = $this->getContainer()->query(Hooks::class);
+		$hooks->onChangePassword($parameters['uid']);
+	}
+
+	/**
+	 * @param array $parameters
+	 * @throws \InvalidArgumentException
+	 * @throws \BadMethodCallException
+	 * @throws \Exception
+	 * @throws \OCP\AppFramework\QueryException
+	 */
+	public function onChangeInfo(array $parameters) {
+		if ($parameters['feature'] !== 'eMailAddress') {
+			return;
+		}
+
+		/** @var Hooks $hooks */
+		$hooks = $this->getContainer()->query(Hooks::class);
+		$hooks->onChangeEmail($parameters['user'], $parameters['old_value']);
+	}
+}

wedding-pics/apps/settings/lib/BackgroundJobs/VerifyUserData.php

@@ -0,0 +1,290 @@
+<?php
+/**
+ * @copyright Copyright (c) 2017 Bjoern Schiessle <bjoern@schiessle.org>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Bjoern Schiessle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Patrik Kernstock <info@pkern.at>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\BackgroundJobs;
+
+use OCP\Accounts\IAccountManager;
+use OCP\Accounts\PropertyDoesNotExistException;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\BackgroundJob\IJobList;
+use OCP\BackgroundJob\Job;
+use OCP\Http\Client\IClientService;
+use OCP\IConfig;
+use OCP\ILogger;
+use OCP\IUserManager;
+
+class VerifyUserData extends Job {
+
+	/** @var  bool */
+	private $retainJob = true;
+
+	/** @var int max number of attempts to send the request */
+	private $maxTry = 24;
+
+	/** @var int how much time should be between two tries (1 hour) */
+	private $interval = 3600;
+
+	/** @var IAccountManager */
+	private $accountManager;
+
+	/** @var IUserManager */
+	private $userManager;
+
+	/** @var IClientService */
+	private $httpClientService;
+
+	/** @var ILogger */
+	private $logger;
+
+	/** @var string */
+	private $lookupServerUrl;
+
+	/** @var IConfig */
+	private $config;
+
+	public function __construct(IAccountManager $accountManager,
+		IUserManager $userManager,
+		IClientService $clientService,
+		ILogger $logger,
+		ITimeFactory $timeFactory,
+		IConfig $config
+	) {
+		parent::__construct($timeFactory);
+		$this->accountManager = $accountManager;
+		$this->userManager = $userManager;
+		$this->httpClientService = $clientService;
+		$this->logger = $logger;
+
+		$lookupServerUrl = $config->getSystemValue('lookup_server', 'https://lookup.nextcloud.com');
+		$this->lookupServerUrl = rtrim($lookupServerUrl, '/');
+		$this->config = $config;
+	}
+
+	/**
+	 * run the job, then remove it from the jobList
+	 *
+	 * @param IJobList $jobList
+	 * @param ILogger|null $logger
+	 */
+	public function execute(IJobList $jobList, ILogger $logger = null) {
+		if ($this->shouldRun($this->argument)) {
+			parent::execute($jobList, $logger);
+			$jobList->remove($this, $this->argument);
+			if ($this->retainJob) {
+				$this->reAddJob($jobList, $this->argument);
+			} else {
+				$this->resetVerificationState();
+			}
+		}
+	}
+
+	protected function run($argument) {
+		$try = (int)$argument['try'] + 1;
+
+		switch ($argument['type']) {
+			case IAccountManager::PROPERTY_WEBSITE:
+				$result = $this->verifyWebsite($argument);
+				break;
+			case IAccountManager::PROPERTY_TWITTER:
+			case IAccountManager::PROPERTY_EMAIL:
+				$result = $this->verifyViaLookupServer($argument, $argument['type']);
+				break;
+			default:
+				// no valid type given, no need to retry
+				$this->logger->error($argument['type'] . ' is no valid type for user account data.');
+				$result = true;
+		}
+
+		if ($result === true || $try > $this->maxTry) {
+			$this->retainJob = false;
+		}
+	}
+
+	/**
+	 * verify web page
+	 *
+	 * @param array $argument
+	 * @return bool true if we could check the verification code, otherwise false
+	 */
+	protected function verifyWebsite(array $argument) {
+		$result = false;
+
+		$url = rtrim($argument['data'], '/') . '/.well-known/' . 'CloudIdVerificationCode.txt';
+
+		$client = $this->httpClientService->newClient();
+		try {
+			$response = $client->get($url);
+		} catch (\Exception $e) {
+			return false;
+		}
+
+		if ($response->getStatusCode() === Http::STATUS_OK) {
+			$result = true;
+			$publishedCode = $response->getBody();
+			// remove new lines and spaces
+			$publishedCodeSanitized = trim(preg_replace('/\s\s+/', ' ', $publishedCode));
+			$user = $this->userManager->get($argument['uid']);
+			// we don't check a valid user -> give up
+			if ($user === null) {
+				$this->logger->error($argument['uid'] . ' doesn\'t exist, can\'t verify user data.');
+				return $result;
+			}
+			$userAccount = $this->accountManager->getAccount($user);
+			$websiteProp = $userAccount->getProperty(IAccountManager::PROPERTY_WEBSITE);
+			$websiteProp->setVerified($publishedCodeSanitized === $argument['verificationCode']
+				? IAccountManager::VERIFIED
+				: IAccountManager::NOT_VERIFIED
+			);
+			$this->accountManager->updateAccount($userAccount);
+		}
+
+		return $result;
+	}
+
+	protected function verifyViaLookupServer(array $argument, string $dataType): bool {
+		if (empty($this->lookupServerUrl) ||
+			$this->config->getAppValue('files_sharing', 'lookupServerUploadEnabled', 'yes') !== 'yes' ||
+			$this->config->getSystemValue('has_internet_connection', true) === false) {
+			return true;
+		}
+
+		$user = $this->userManager->get($argument['uid']);
+
+		// we don't check a valid user -> give up
+		if ($user === null) {
+			$this->logger->info($argument['uid'] . ' doesn\'t exist, can\'t verify user data.');
+			return true;
+		}
+
+		$cloudId = $user->getCloudId();
+		$lookupServerData = $this->queryLookupServer($cloudId);
+
+		// for some reasons we couldn't read any data from the lookup server, try again later
+		if (empty($lookupServerData) || empty($lookupServerData[$dataType])) {
+			return false;
+		}
+
+		// lookup server has verification data for wrong user data (e.g. email address), try again later
+		if ($lookupServerData[$dataType]['value'] !== $argument['data']) {
+			return false;
+		}
+
+		// lookup server hasn't verified the email address so far, try again later
+		if ($lookupServerData[$dataType]['verified'] === IAccountManager::NOT_VERIFIED) {
+			return false;
+		}
+
+		try {
+			$userAccount = $this->accountManager->getAccount($user);
+			$property = $userAccount->getProperty($dataType);
+			$property->setVerified(IAccountManager::VERIFIED);
+			$this->accountManager->updateAccount($userAccount);
+		} catch (PropertyDoesNotExistException $e) {
+			return false;
+		}
+
+		return true;
+	}
+
+	/**
+	 * @param string $cloudId
+	 * @return array
+	 */
+	protected function queryLookupServer($cloudId) {
+		try {
+			$client = $this->httpClientService->newClient();
+			$response = $client->get(
+				$this->lookupServerUrl . '/users?search=' . urlencode($cloudId) . '&exactCloudId=1',
+				[
+					'timeout' => 10,
+					'connect_timeout' => 3,
+				]
+			);
+
+			$body = json_decode($response->getBody(), true);
+
+			if (is_array($body) && isset($body['federationId']) && $body['federationId'] === $cloudId) {
+				return $body;
+			}
+		} catch (\Exception $e) {
+			// do nothing, we will just re-try later
+		}
+
+		return [];
+	}
+
+	/**
+	 * re-add background job with new arguments
+	 *
+	 * @param IJobList $jobList
+	 * @param array $argument
+	 */
+	protected function reAddJob(IJobList $jobList, array $argument) {
+		$jobList->add(VerifyUserData::class,
+			[
+				'verificationCode' => $argument['verificationCode'],
+				'data' => $argument['data'],
+				'type' => $argument['type'],
+				'uid' => $argument['uid'],
+				'try' => (int)$argument['try'] + 1,
+				'lastRun' => time()
+			]
+		);
+	}
+
+	/**
+	 * test if it is time for the next run
+	 *
+	 * @param array $argument
+	 * @return bool
+	 */
+	protected function shouldRun(array $argument) {
+		$lastRun = (int)$argument['lastRun'];
+		return ((time() - $lastRun) > $this->interval);
+	}
+
+
+	/**
+	 * reset verification state after max tries are reached
+	 */
+	protected function resetVerificationState(): void {
+		$user = $this->userManager->get($this->argument['uid']);
+		if ($user !== null) {
+			$userAccount = $this->accountManager->getAccount($user);
+			try {
+				$property = $userAccount->getProperty($this->argument['type']);
+				$property->setVerified(IAccountManager::NOT_VERIFIED);
+				$this->accountManager->updateAccount($userAccount);
+			} catch (PropertyDoesNotExistException $e) {
+				return;
+			}
+		}
+	}
+}

wedding-pics/apps/settings/lib/Command/AdminDelegation/Add.php

@@ -0,0 +1,76 @@
+<?php
+
+declare(strict_types = 1);
+/**
+ * @copyright Copyright (c) 2023 Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
+ *
+ * @author Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Command\AdminDelegation;
+
+use OC\Core\Command\Base;
+use OCA\Settings\Service\AuthorizedGroupService;
+use OCP\IGroupManager;
+use OCP\Settings\IDelegatedSettings;
+use OCP\Settings\IManager;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+class Add extends Base {
+	public function __construct(
+		private IManager $settingManager,
+		private AuthorizedGroupService $authorizedGroupService,
+		private IGroupManager $groupManager,
+	) {
+		parent::__construct();
+	}
+
+	protected function configure(): void {
+		$this
+			->setName('admin-delegation:add')
+			->setDescription('add setting delegation to a group')
+			->addArgument('settingClass', InputArgument::REQUIRED, 'Admin setting class')
+			->addArgument('groupId', InputArgument::REQUIRED, 'Delegate to group ID')
+			->addUsage('\'OCA\Settings\Settings\Admin\Server\' mygroup')
+		;
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$io = new SymfonyStyle($input, $output);
+		$settingClass = $input->getArgument('settingClass');
+		if (!in_array(IDelegatedSettings::class, (array) class_implements($settingClass), true)) {
+			$io->error('The specified class isn’t a valid delegated setting.');
+			return 2;
+		}
+
+		$groupId = $input->getArgument('groupId');
+		if (!$this->groupManager->groupExists($groupId)) {
+			$io->error('The specified group didn’t exist.');
+			return 3;
+		}
+
+		$this->authorizedGroupService->create($groupId, $settingClass);
+
+		$io->success('Administration of '.$settingClass.' delegated to '.$groupId.'.');
+
+		return 0;
+	}
+}

wedding-pics/apps/settings/lib/Command/AdminDelegation/Remove.php

@@ -0,0 +1,72 @@
+<?php
+
+declare(strict_types = 1);
+/**
+ * @copyright Copyright (c) 2023 Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
+ *
+ * @author Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Command\AdminDelegation;
+
+use OC\Core\Command\Base;
+use OCA\Settings\Service\AuthorizedGroupService;
+use OCP\IGroupManager;
+use OCP\Settings\IManager;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+class Remove extends Base {
+	public function __construct(
+		private IManager $settingManager,
+		private AuthorizedGroupService $authorizedGroupService,
+		private IGroupManager $groupManager,
+	) {
+		parent::__construct();
+	}
+
+	protected function configure(): void {
+		$this
+			->setName('admin-delegation:remove')
+			->setDescription('remove settings delegation from a group')
+			->addArgument('settingClass', InputArgument::REQUIRED, 'Admin setting class')
+			->addArgument('groupId', InputArgument::REQUIRED, 'Group ID to remove')
+			->addUsage('\'OCA\Settings\Settings\Admin\Server\' mygroup')
+		;
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$io = new SymfonyStyle($input, $output);
+		$settingClass = $input->getArgument('settingClass');
+		$groups = $this->authorizedGroupService->findExistingGroupsForClass($settingClass);
+		$groupId = $input->getArgument('groupId');
+		foreach ($groups as $group) {
+			if ($group->getGroupId() === $groupId) {
+				$this->authorizedGroupService->delete($group->getId());
+				$io->success('Removed delegation of '.$settingClass.' to '.$groupId.'.');
+				return 0;
+			}
+		}
+
+		$io->success('Group '.$groupId.' didn’t have delegation for '.$settingClass.'.');
+
+		return 0;
+	}
+}

wedding-pics/apps/settings/lib/Command/AdminDelegation/Show.php

@@ -0,0 +1,94 @@
+<?php
+
+declare(strict_types = 1);
+/**
+ * @copyright Copyright (c) 2023 Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
+ *
+ * @author Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Command\AdminDelegation;
+
+use OC\Core\Command\Base;
+use OC\Settings\AuthorizedGroup;
+use OCA\Settings\Service\AuthorizedGroupService;
+use OCP\Settings\IDelegatedSettings;
+use OCP\Settings\IManager;
+use OCP\Settings\ISettings;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+class Show extends Base {
+	public function __construct(
+		private IManager $settingManager,
+		private AuthorizedGroupService $authorizedGroupService,
+	) {
+		parent::__construct();
+	}
+
+	protected function configure(): void {
+		$this
+			->setName('admin-delegation:show')
+			->setDescription('show delegated settings')
+		;
+	}
+
+	protected function execute(InputInterface $input, OutputInterface $output): int {
+		$io = new SymfonyStyle($input, $output);
+		$io->title('Current delegations');
+
+		$sections = $this->settingManager->getAdminSections();
+		$settings = [];
+		$headers = ['Name', 'SettingId', 'Delegated to groups'];
+		foreach ($sections as $sectionPriority) {
+			foreach ($sectionPriority as $section) {
+				$sectionSettings = $this->settingManager->getAdminSettings($section->getId());
+				$sectionSettings = array_reduce($sectionSettings, [$this, 'getDelegatedSettings'], []);
+				if (empty($sectionSettings)) {
+					continue;
+				}
+
+				$io->section('Section: '.$section->getID());
+				$io->table($headers, array_map(function (IDelegatedSettings $setting) use ($section) {
+					$className = get_class($setting);
+					$groups = array_map(
+						static fn (AuthorizedGroup $group) => $group->getGroupId(),
+						$this->authorizedGroupService->findExistingGroupsForClass($className)
+					);
+					natsort($groups);
+					return [
+						$setting->getName() ?: 'Global',
+						$className,
+						implode(', ', $groups),
+					];
+				}, $sectionSettings));
+			}
+		}
+
+		return 0;
+	}
+
+	/**
+	 * @param IDelegatedSettings[] $settings
+	 * @param array $innerSection
+	 */
+	private function getDelegatedSettings(array $settings, array $innerSection): array {
+		return $settings + array_filter($innerSection, fn (ISettings $setting) => $setting instanceof IDelegatedSettings);
+	}
+}

wedding-pics/apps/settings/lib/Controller/AISettingsController.php

@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023  Marcel Klehr <mklehr@gmx.net>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Settings\Controller;
+
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http\DataResponse;
+use OCP\IConfig;
+use OCP\IRequest;
+
+class AISettingsController extends Controller {
+
+	/**
+	 * @param string $appName
+	 * @param IRequest $request
+	 * @param IConfig $config
+	 */
+	public function __construct(
+		$appName,
+		IRequest $request,
+		private IConfig $config,
+	) {
+		parent::__construct($appName, $request);
+	}
+
+	/**
+	 * Sets the email settings
+	 *
+	 * @AuthorizedAdminSetting(settings=OCA\Settings\Settings\Admin\ArtificialIntelligence)
+	 *
+	 * @param array $settings
+	 * @return DataResponse
+	 */
+	public function update($settings) {
+		$keys = ['ai.stt_provider', 'ai.textprocessing_provider_preferences', 'ai.translation_provider_preferences', 'ai.text2image_provider'];
+		foreach ($keys as $key) {
+			if (!isset($settings[$key])) {
+				continue;
+			}
+			$this->config->setAppValue('core', $key, json_encode($settings[$key]));
+		}
+
+		return new DataResponse();
+	}
+}

wedding-pics/apps/settings/lib/Controller/AdminSettingsController.php

@@ -0,0 +1,123 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Robin Appelman <robin@icewind.nl>
+ * @author Kate Döen <kate.doeen@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Controller;
+
+use OC\AppFramework\Middleware\Security\Exceptions\NotAdminException;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http\Attribute\OpenAPI;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\Group\ISubAdmin;
+use OCP\IGroupManager;
+use OCP\INavigationManager;
+use OCP\IRequest;
+use OCP\IUser;
+use OCP\IUserSession;
+use OCP\Settings\IManager as ISettingsManager;
+use OCP\Template;
+
+#[OpenAPI(scope: OpenAPI::SCOPE_IGNORE)]
+class AdminSettingsController extends Controller {
+	use CommonSettingsTrait;
+
+	public function __construct(
+		$appName,
+		IRequest $request,
+		INavigationManager $navigationManager,
+		ISettingsManager $settingsManager,
+		IUserSession $userSession,
+		IGroupManager $groupManager,
+		ISubAdmin $subAdmin
+	) {
+		parent::__construct($appName, $request);
+		$this->navigationManager = $navigationManager;
+		$this->settingsManager = $settingsManager;
+		$this->userSession = $userSession;
+		$this->groupManager = $groupManager;
+		$this->subAdmin = $subAdmin;
+	}
+
+	/**
+	 * @NoCSRFRequired
+	 * @NoAdminRequired
+	 * @NoSubAdminRequired
+	 * We are checking the permissions in the getSettings method. If there is no allowed
+	 * settings for the given section. The user will be gretted by an error message.
+	 */
+	public function index(string $section): TemplateResponse {
+		return $this->getIndexResponse('admin', $section);
+	}
+
+	/**
+	 * @param string $section
+	 * @return array
+	 */
+	protected function getSettings($section) {
+		/** @var IUser $user */
+		$user = $this->userSession->getUser();
+		$isSubAdmin = !$this->groupManager->isAdmin($user->getUID()) && $this->subAdmin->isSubAdmin($user);
+		$settings = $this->settingsManager->getAllowedAdminSettings($section, $user);
+		if (empty($settings)) {
+			throw new NotAdminException("Logged in user doesn't have permission to access these settings.");
+		}
+		$formatted = $this->formatSettings($settings);
+		// Do not show legacy forms for sub admins
+		if ($section === 'additional' && !$isSubAdmin) {
+			$formatted['content'] .= $this->getLegacyForms();
+		}
+		return $formatted;
+	}
+
+	/**
+	 * @return bool|string
+	 */
+	private function getLegacyForms() {
+		$forms = \OC_App::getForms('admin');
+
+		$forms = array_map(function ($form) {
+			if (preg_match('%(<h2(?P<class>[^>]*)>.*?</h2>)%i', $form, $regs)) {
+				$sectionName = str_replace('<h2' . $regs['class'] . '>', '', $regs[0]);
+				$sectionName = str_replace('</h2>', '', $sectionName);
+				$anchor = strtolower($sectionName);
+				$anchor = str_replace(' ', '-', $anchor);
+
+				return [
+					'anchor' => $anchor,
+					'section-name' => $sectionName,
+					'form' => $form
+				];
+			}
+			return [
+				'form' => $form
+			];
+		}, $forms);
+
+		$out = new Template('settings', 'settings/additional');
+		$out->assign('forms', $forms);
+
+		return $out->fetchPage();
+	}
+}

wedding-pics/apps/settings/lib/Controller/AppSettingsController.php

@@ -0,0 +1,565 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ * @copyright Copyright (c) 2016, Lukas Reschke <lukas@statuscode.ch>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Daniel Kesselberg <mail@danielkesselberg.de>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author John Molakvoæ <skjnldsv@protonmail.com>
+ * @author Julius Härtl <jus@bitgrid.net>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ * @author Thomas Müller <thomas.mueller@tmit.eu>
+ * @author Kate Döen <kate.doeen@nextcloud.com>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Settings\Controller;
+
+use OC\App\AppStore\Bundles\BundleFetcher;
+use OC\App\AppStore\Fetcher\AppFetcher;
+use OC\App\AppStore\Fetcher\CategoryFetcher;
+use OC\App\AppStore\Version\VersionParser;
+use OC\App\DependencyAnalyzer;
+use OC\App\Platform;
+use OC\Installer;
+use OC_App;
+use OCP\App\IAppManager;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\OpenAPI;
+use OCP\AppFramework\Http\ContentSecurityPolicy;
+use OCP\AppFramework\Http\JSONResponse;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\INavigationManager;
+use OCP\IRequest;
+use OCP\IURLGenerator;
+use OCP\L10N\IFactory;
+use Psr\Log\LoggerInterface;
+
+#[OpenAPI(scope: OpenAPI::SCOPE_IGNORE)]
+class AppSettingsController extends Controller {
+
+	/** @var \OCP\IL10N */
+	private $l10n;
+	/** @var IConfig */
+	private $config;
+	/** @var INavigationManager */
+	private $navigationManager;
+	/** @var IAppManager */
+	private $appManager;
+	/** @var CategoryFetcher */
+	private $categoryFetcher;
+	/** @var AppFetcher */
+	private $appFetcher;
+	/** @var IFactory */
+	private $l10nFactory;
+	/** @var BundleFetcher */
+	private $bundleFetcher;
+	/** @var Installer */
+	private $installer;
+	/** @var IURLGenerator */
+	private $urlGenerator;
+	/** @var LoggerInterface */
+	private $logger;
+
+	/** @var array */
+	private $allApps = [];
+
+	/**
+	 * @param string $appName
+	 * @param IRequest $request
+	 * @param IL10N $l10n
+	 * @param IConfig $config
+	 * @param INavigationManager $navigationManager
+	 * @param IAppManager $appManager
+	 * @param CategoryFetcher $categoryFetcher
+	 * @param AppFetcher $appFetcher
+	 * @param IFactory $l10nFactory
+	 * @param BundleFetcher $bundleFetcher
+	 * @param Installer $installer
+	 * @param IURLGenerator $urlGenerator
+	 * @param LoggerInterface $logger
+	 */
+	public function __construct(string $appName,
+		IRequest $request,
+		IL10N $l10n,
+		IConfig $config,
+		INavigationManager $navigationManager,
+		IAppManager $appManager,
+		CategoryFetcher $categoryFetcher,
+		AppFetcher $appFetcher,
+		IFactory $l10nFactory,
+		BundleFetcher $bundleFetcher,
+		Installer $installer,
+		IURLGenerator $urlGenerator,
+		LoggerInterface $logger) {
+		parent::__construct($appName, $request);
+		$this->l10n = $l10n;
+		$this->config = $config;
+		$this->navigationManager = $navigationManager;
+		$this->appManager = $appManager;
+		$this->categoryFetcher = $categoryFetcher;
+		$this->appFetcher = $appFetcher;
+		$this->l10nFactory = $l10nFactory;
+		$this->bundleFetcher = $bundleFetcher;
+		$this->installer = $installer;
+		$this->urlGenerator = $urlGenerator;
+		$this->logger = $logger;
+	}
+
+	/**
+	 * @NoCSRFRequired
+	 *
+	 * @return TemplateResponse
+	 */
+	public function viewApps(): TemplateResponse {
+		$params = [];
+		$params['appstoreEnabled'] = $this->config->getSystemValueBool('appstoreenabled', true);
+		$params['updateCount'] = count($this->getAppsWithUpdates());
+		$params['developerDocumentation'] = $this->urlGenerator->linkToDocs('developer-manual');
+		$params['bundles'] = $this->getBundles();
+		$this->navigationManager->setActiveEntry('core_apps');
+
+		$templateResponse = new TemplateResponse('settings', 'settings-vue', ['serverData' => $params, 'pageTitle' => $this->l10n->t('Apps')]);
+		$policy = new ContentSecurityPolicy();
+		$policy->addAllowedImageDomain('https://usercontent.apps.nextcloud.com');
+		$templateResponse->setContentSecurityPolicy($policy);
+
+		return $templateResponse;
+	}
+
+	private function getAppsWithUpdates() {
+		$appClass = new \OC_App();
+		$apps = $appClass->listAllApps();
+		foreach ($apps as $key => $app) {
+			$newVersion = $this->installer->isUpdateAvailable($app['id']);
+			if ($newVersion === false) {
+				unset($apps[$key]);
+			}
+		}
+		return $apps;
+	}
+
+	private function getBundles() {
+		$result = [];
+		$bundles = $this->bundleFetcher->getBundles();
+		foreach ($bundles as $bundle) {
+			$result[] = [
+				'name' => $bundle->getName(),
+				'id' => $bundle->getIdentifier(),
+				'appIdentifiers' => $bundle->getAppIdentifiers()
+			];
+		}
+		return $result;
+	}
+
+	/**
+	 * Get all available categories
+	 *
+	 * @return JSONResponse
+	 */
+	public function listCategories(): JSONResponse {
+		return new JSONResponse($this->getAllCategories());
+	}
+
+	private function getAllCategories() {
+		$currentLanguage = substr($this->l10nFactory->findLanguage(), 0, 2);
+
+		$formattedCategories = [];
+		$categories = $this->categoryFetcher->get();
+		foreach ($categories as $category) {
+			$formattedCategories[] = [
+				'id' => $category['id'],
+				'ident' => $category['id'],
+				'displayName' => $category['translations'][$currentLanguage]['name'] ?? $category['translations']['en']['name'],
+			];
+		}
+
+		return $formattedCategories;
+	}
+
+	private function fetchApps() {
+		$appClass = new \OC_App();
+		$apps = $appClass->listAllApps();
+		foreach ($apps as $app) {
+			$app['installed'] = true;
+			$this->allApps[$app['id']] = $app;
+		}
+
+		$apps = $this->getAppsForCategory('');
+		$supportedApps = $appClass->getSupportedApps();
+		foreach ($apps as $app) {
+			$app['appstore'] = true;
+			if (!array_key_exists($app['id'], $this->allApps)) {
+				$this->allApps[$app['id']] = $app;
+			} else {
+				$this->allApps[$app['id']] = array_merge($app, $this->allApps[$app['id']]);
+			}
+
+			if (in_array($app['id'], $supportedApps)) {
+				$this->allApps[$app['id']]['level'] = \OC_App::supportedApp;
+			}
+		}
+
+		// add bundle information
+		$bundles = $this->bundleFetcher->getBundles();
+		foreach ($bundles as $bundle) {
+			foreach ($bundle->getAppIdentifiers() as $identifier) {
+				foreach ($this->allApps as &$app) {
+					if ($app['id'] === $identifier) {
+						$app['bundleIds'][] = $bundle->getIdentifier();
+						continue;
+					}
+				}
+			}
+		}
+	}
+
+	private function getAllApps() {
+		return $this->allApps;
+	}
+	/**
+	 * Get all available apps in a category
+	 *
+	 * @return JSONResponse
+	 * @throws \Exception
+	 */
+	public function listApps(): JSONResponse {
+		$this->fetchApps();
+		$apps = $this->getAllApps();
+
+		$dependencyAnalyzer = new DependencyAnalyzer(new Platform($this->config), $this->l10n);
+
+		$ignoreMaxApps = $this->config->getSystemValue('app_install_overwrite', []);
+		if (!is_array($ignoreMaxApps)) {
+			$this->logger->warning('The value given for app_install_overwrite is not an array. Ignoring...');
+			$ignoreMaxApps = [];
+		}
+
+		// Extend existing app details
+		$apps = array_map(function (array $appData) use ($dependencyAnalyzer, $ignoreMaxApps) {
+			if (isset($appData['appstoreData'])) {
+				$appstoreData = $appData['appstoreData'];
+				$appData['screenshot'] = isset($appstoreData['screenshots'][0]['url']) ? 'https://usercontent.apps.nextcloud.com/' . base64_encode($appstoreData['screenshots'][0]['url']) : '';
+				$appData['category'] = $appstoreData['categories'];
+				$appData['releases'] = $appstoreData['releases'];
+			}
+
+			$newVersion = $this->installer->isUpdateAvailable($appData['id']);
+			if ($newVersion) {
+				$appData['update'] = $newVersion;
+			}
+
+			// fix groups to be an array
+			$groups = [];
+			if (is_string($appData['groups'])) {
+				$groups = json_decode($appData['groups']);
+			}
+			$appData['groups'] = $groups;
+			$appData['canUnInstall'] = !$appData['active'] && $appData['removable'];
+
+			// fix licence vs license
+			if (isset($appData['license']) && !isset($appData['licence'])) {
+				$appData['licence'] = $appData['license'];
+			}
+
+			$ignoreMax = in_array($appData['id'], $ignoreMaxApps);
+
+			// analyse dependencies
+			$missing = $dependencyAnalyzer->analyze($appData, $ignoreMax);
+			$appData['canInstall'] = empty($missing);
+			$appData['missingDependencies'] = $missing;
+
+			$appData['missingMinOwnCloudVersion'] = !isset($appData['dependencies']['nextcloud']['@attributes']['min-version']);
+			$appData['missingMaxOwnCloudVersion'] = !isset($appData['dependencies']['nextcloud']['@attributes']['max-version']);
+			$appData['isCompatible'] = $dependencyAnalyzer->isMarkedCompatible($appData);
+
+			return $appData;
+		}, $apps);
+
+		usort($apps, [$this, 'sortApps']);
+
+		return new JSONResponse(['apps' => $apps, 'status' => 'success']);
+	}
+
+	/**
+	 * Get all apps for a category from the app store
+	 *
+	 * @param string $requestedCategory
+	 * @return array
+	 * @throws \Exception
+	 */
+	private function getAppsForCategory($requestedCategory = ''): array {
+		$versionParser = new VersionParser();
+		$formattedApps = [];
+		$apps = $this->appFetcher->get();
+		foreach ($apps as $app) {
+			// Skip all apps not in the requested category
+			if ($requestedCategory !== '') {
+				$isInCategory = false;
+				foreach ($app['categories'] as $category) {
+					if ($category === $requestedCategory) {
+						$isInCategory = true;
+					}
+				}
+				if (!$isInCategory) {
+					continue;
+				}
+			}
+
+			if (!isset($app['releases'][0]['rawPlatformVersionSpec'])) {
+				continue;
+			}
+			$nextCloudVersion = $versionParser->getVersion($app['releases'][0]['rawPlatformVersionSpec']);
+			$nextCloudVersionDependencies = [];
+			if ($nextCloudVersion->getMinimumVersion() !== '') {
+				$nextCloudVersionDependencies['nextcloud']['@attributes']['min-version'] = $nextCloudVersion->getMinimumVersion();
+			}
+			if ($nextCloudVersion->getMaximumVersion() !== '') {
+				$nextCloudVersionDependencies['nextcloud']['@attributes']['max-version'] = $nextCloudVersion->getMaximumVersion();
+			}
+			$phpVersion = $versionParser->getVersion($app['releases'][0]['rawPhpVersionSpec']);
+			$existsLocally = \OC_App::getAppPath($app['id']) !== false;
+			$phpDependencies = [];
+			if ($phpVersion->getMinimumVersion() !== '') {
+				$phpDependencies['php']['@attributes']['min-version'] = $phpVersion->getMinimumVersion();
+			}
+			if ($phpVersion->getMaximumVersion() !== '') {
+				$phpDependencies['php']['@attributes']['max-version'] = $phpVersion->getMaximumVersion();
+			}
+			if (isset($app['releases'][0]['minIntSize'])) {
+				$phpDependencies['php']['@attributes']['min-int-size'] = $app['releases'][0]['minIntSize'];
+			}
+			$authors = '';
+			foreach ($app['authors'] as $key => $author) {
+				$authors .= $author['name'];
+				if ($key !== count($app['authors']) - 1) {
+					$authors .= ', ';
+				}
+			}
+
+			$currentLanguage = substr(\OC::$server->getL10NFactory()->findLanguage(), 0, 2);
+			$enabledValue = $this->config->getAppValue($app['id'], 'enabled', 'no');
+			$groups = null;
+			if ($enabledValue !== 'no' && $enabledValue !== 'yes') {
+				$groups = $enabledValue;
+			}
+
+			$currentVersion = '';
+			if ($this->appManager->isInstalled($app['id'])) {
+				$currentVersion = $this->appManager->getAppVersion($app['id']);
+			} else {
+				$currentVersion = $app['releases'][0]['version'];
+			}
+
+			$formattedApps[] = [
+				'id' => $app['id'],
+				'name' => $app['translations'][$currentLanguage]['name'] ?? $app['translations']['en']['name'],
+				'description' => $app['translations'][$currentLanguage]['description'] ?? $app['translations']['en']['description'],
+				'summary' => $app['translations'][$currentLanguage]['summary'] ?? $app['translations']['en']['summary'],
+				'license' => $app['releases'][0]['licenses'],
+				'author' => $authors,
+				'shipped' => false,
+				'version' => $currentVersion,
+				'default_enable' => '',
+				'types' => [],
+				'documentation' => [
+					'admin' => $app['adminDocs'],
+					'user' => $app['userDocs'],
+					'developer' => $app['developerDocs']
+				],
+				'website' => $app['website'],
+				'bugs' => $app['issueTracker'],
+				'detailpage' => $app['website'],
+				'dependencies' => array_merge(
+					$nextCloudVersionDependencies,
+					$phpDependencies
+				),
+				'level' => ($app['isFeatured'] === true) ? 200 : 100,
+				'missingMaxOwnCloudVersion' => false,
+				'missingMinOwnCloudVersion' => false,
+				'canInstall' => true,
+				'screenshot' => isset($app['screenshots'][0]['url']) ? 'https://usercontent.apps.nextcloud.com/'.base64_encode($app['screenshots'][0]['url']) : '',
+				'score' => $app['ratingOverall'],
+				'ratingNumOverall' => $app['ratingNumOverall'],
+				'ratingNumThresholdReached' => $app['ratingNumOverall'] > 5,
+				'removable' => $existsLocally,
+				'active' => $this->appManager->isEnabledForUser($app['id']),
+				'needsDownload' => !$existsLocally,
+				'groups' => $groups,
+				'fromAppStore' => true,
+				'appstoreData' => $app,
+			];
+		}
+
+		return $formattedApps;
+	}
+
+	/**
+	 * @PasswordConfirmationRequired
+	 *
+	 * @param string $appId
+	 * @param array $groups
+	 * @return JSONResponse
+	 */
+	public function enableApp(string $appId, array $groups = []): JSONResponse {
+		return $this->enableApps([$appId], $groups);
+	}
+
+	/**
+	 * Enable one or more apps
+	 *
+	 * apps will be enabled for specific groups only if $groups is defined
+	 *
+	 * @PasswordConfirmationRequired
+	 * @param array $appIds
+	 * @param array $groups
+	 * @return JSONResponse
+	 */
+	public function enableApps(array $appIds, array $groups = []): JSONResponse {
+		try {
+			$updateRequired = false;
+
+			foreach ($appIds as $appId) {
+				$appId = OC_App::cleanAppId($appId);
+
+				// Check if app is already downloaded
+				/** @var Installer $installer */
+				$installer = \OC::$server->query(Installer::class);
+				$isDownloaded = $installer->isDownloaded($appId);
+
+				if (!$isDownloaded) {
+					$installer->downloadApp($appId);
+				}
+
+				$installer->installApp($appId);
+
+				if (count($groups) > 0) {
+					$this->appManager->enableAppForGroups($appId, $this->getGroupList($groups));
+				} else {
+					$this->appManager->enableApp($appId);
+				}
+				if (\OC_App::shouldUpgrade($appId)) {
+					$updateRequired = true;
+				}
+			}
+			return new JSONResponse(['data' => ['update_required' => $updateRequired]]);
+		} catch (\Exception $e) {
+			$this->logger->error('could not enable apps', ['exception' => $e]);
+			return new JSONResponse(['data' => ['message' => $e->getMessage()]], Http::STATUS_INTERNAL_SERVER_ERROR);
+		}
+	}
+
+	private function getGroupList(array $groups) {
+		$groupManager = \OC::$server->getGroupManager();
+		$groupsList = [];
+		foreach ($groups as $group) {
+			$groupItem = $groupManager->get($group);
+			if ($groupItem instanceof \OCP\IGroup) {
+				$groupsList[] = $groupManager->get($group);
+			}
+		}
+		return $groupsList;
+	}
+
+	/**
+	 * @PasswordConfirmationRequired
+	 *
+	 * @param string $appId
+	 * @return JSONResponse
+	 */
+	public function disableApp(string $appId): JSONResponse {
+		return $this->disableApps([$appId]);
+	}
+
+	/**
+	 * @PasswordConfirmationRequired
+	 *
+	 * @param array $appIds
+	 * @return JSONResponse
+	 */
+	public function disableApps(array $appIds): JSONResponse {
+		try {
+			foreach ($appIds as $appId) {
+				$appId = OC_App::cleanAppId($appId);
+				$this->appManager->disableApp($appId);
+			}
+			return new JSONResponse([]);
+		} catch (\Exception $e) {
+			$this->logger->error('could not disable app', ['exception' => $e]);
+			return new JSONResponse(['data' => ['message' => $e->getMessage()]], Http::STATUS_INTERNAL_SERVER_ERROR);
+		}
+	}
+
+	/**
+	 * @PasswordConfirmationRequired
+	 *
+	 * @param string $appId
+	 * @return JSONResponse
+	 */
+	public function uninstallApp(string $appId): JSONResponse {
+		$appId = OC_App::cleanAppId($appId);
+		$result = $this->installer->removeApp($appId);
+		if ($result !== false) {
+			$this->appManager->clearAppsCache();
+			return new JSONResponse(['data' => ['appid' => $appId]]);
+		}
+		return new JSONResponse(['data' => ['message' => $this->l10n->t('Could not remove app.')]], Http::STATUS_INTERNAL_SERVER_ERROR);
+	}
+
+	/**
+	 * @param string $appId
+	 * @return JSONResponse
+	 */
+	public function updateApp(string $appId): JSONResponse {
+		$appId = OC_App::cleanAppId($appId);
+
+		$this->config->setSystemValue('maintenance', true);
+		try {
+			$result = $this->installer->updateAppstoreApp($appId);
+			$this->config->setSystemValue('maintenance', false);
+		} catch (\Exception $ex) {
+			$this->config->setSystemValue('maintenance', false);
+			return new JSONResponse(['data' => ['message' => $ex->getMessage()]], Http::STATUS_INTERNAL_SERVER_ERROR);
+		}
+
+		if ($result !== false) {
+			return new JSONResponse(['data' => ['appid' => $appId]]);
+		}
+		return new JSONResponse(['data' => ['message' => $this->l10n->t('Could not update app.')]], Http::STATUS_INTERNAL_SERVER_ERROR);
+	}
+
+	private function sortApps($a, $b) {
+		$a = (string)$a['name'];
+		$b = (string)$b['name'];
+		if ($a === $b) {
+			return 0;
+		}
+		return ($a < $b) ? -1 : 1;
+	}
+
+	public function force(string $appId): JSONResponse {
+		$appId = OC_App::cleanAppId($appId);
+		$this->appManager->ignoreNextcloudRequirementForApp($appId);
+		return new JSONResponse();
+	}
+}

wedding-pics/apps/settings/lib/Controller/AuthSettingsController.php

@@ -0,0 +1,329 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Daniel Kesselberg <mail@danielkesselberg.de>
+ * @author Fabrizio Steiner <fabrizio.steiner@gmail.com>
+ * @author Greta Doci <gretadoci@gmail.com>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Marcel Waldvogel <marcel.waldvogel@uni-konstanz.de>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Robin Appelman <robin@icewind.nl>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ * @author Sergej Nikolaev <kinolaev@gmail.com>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Settings\Controller;
+
+use BadMethodCallException;
+use OC\Authentication\Exceptions\InvalidTokenException as OcInvalidTokenException;
+use OC\Authentication\Exceptions\PasswordlessTokenException;
+use OC\Authentication\Token\INamedToken;
+use OC\Authentication\Token\IProvider;
+use OC\Authentication\Token\RemoteWipe;
+use OCA\Settings\Activity\Provider;
+use OCP\Activity\IManager;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\JSONResponse;
+use OCP\Authentication\Exceptions\ExpiredTokenException;
+use OCP\Authentication\Exceptions\InvalidTokenException;
+use OCP\Authentication\Exceptions\WipeTokenException;
+use OCP\Authentication\Token\IToken;
+use OCP\IRequest;
+use OCP\ISession;
+use OCP\IUserSession;
+use OCP\Security\ISecureRandom;
+use OCP\Session\Exceptions\SessionNotAvailableException;
+use Psr\Log\LoggerInterface;
+
+class AuthSettingsController extends Controller {
+	/** @var IProvider */
+	private $tokenProvider;
+
+	/** @var ISession */
+	private $session;
+
+	/** @var IUserSession */
+	private $userSession;
+
+	/** @var string */
+	private $uid;
+
+	/** @var ISecureRandom */
+	private $random;
+
+	/** @var IManager */
+	private $activityManager;
+
+	/** @var RemoteWipe */
+	private $remoteWipe;
+
+	/** @var LoggerInterface */
+	private $logger;
+
+	/**
+	 * @param string $appName
+	 * @param IRequest $request
+	 * @param IProvider $tokenProvider
+	 * @param ISession $session
+	 * @param ISecureRandom $random
+	 * @param string|null $userId
+	 * @param IUserSession $userSession
+	 * @param IManager $activityManager
+	 * @param RemoteWipe $remoteWipe
+	 * @param LoggerInterface $logger
+	 */
+	public function __construct(string $appName,
+		IRequest $request,
+		IProvider $tokenProvider,
+		ISession $session,
+		ISecureRandom $random,
+		?string $userId,
+		IUserSession $userSession,
+		IManager $activityManager,
+		RemoteWipe $remoteWipe,
+		LoggerInterface $logger) {
+		parent::__construct($appName, $request);
+		$this->tokenProvider = $tokenProvider;
+		$this->uid = $userId;
+		$this->userSession = $userSession;
+		$this->session = $session;
+		$this->random = $random;
+		$this->activityManager = $activityManager;
+		$this->remoteWipe = $remoteWipe;
+		$this->logger = $logger;
+	}
+
+	/**
+	 * @NoAdminRequired
+	 * @NoSubAdminRequired
+	 * @PasswordConfirmationRequired
+	 *
+	 * @param string $name
+	 * @return JSONResponse
+	 */
+	public function create($name) {
+		if ($this->checkAppToken()) {
+			return $this->getServiceNotAvailableResponse();
+		}
+
+		try {
+			$sessionId = $this->session->getId();
+		} catch (SessionNotAvailableException $ex) {
+			return $this->getServiceNotAvailableResponse();
+		}
+		if ($this->userSession->getImpersonatingUserID() !== null) {
+			return $this->getServiceNotAvailableResponse();
+		}
+
+		try {
+			$sessionToken = $this->tokenProvider->getToken($sessionId);
+			$loginName = $sessionToken->getLoginName();
+			try {
+				$password = $this->tokenProvider->getPassword($sessionToken, $sessionId);
+			} catch (PasswordlessTokenException $ex) {
+				$password = null;
+			}
+		} catch (InvalidTokenException $ex) {
+			return $this->getServiceNotAvailableResponse();
+		}
+
+		if (mb_strlen($name) > 128) {
+			$name = mb_substr($name, 0, 120) . '…';
+		}
+
+		$token = $this->generateRandomDeviceToken();
+		$deviceToken = $this->tokenProvider->generateToken($token, $this->uid, $loginName, $password, $name, IToken::PERMANENT_TOKEN);
+		$tokenData = $deviceToken->jsonSerialize();
+		$tokenData['canDelete'] = true;
+		$tokenData['canRename'] = true;
+
+		$this->publishActivity(Provider::APP_TOKEN_CREATED, $deviceToken->getId(), ['name' => $deviceToken->getName()]);
+
+		return new JSONResponse([
+			'token' => $token,
+			'loginName' => $loginName,
+			'deviceToken' => $tokenData,
+		]);
+	}
+
+	/**
+	 * @return JSONResponse
+	 */
+	private function getServiceNotAvailableResponse() {
+		$resp = new JSONResponse();
+		$resp->setStatus(Http::STATUS_SERVICE_UNAVAILABLE);
+		return $resp;
+	}
+
+	/**
+	 * Return a 25 digit device password
+	 *
+	 * Example: AbCdE-fGhJk-MnPqR-sTwXy-23456
+	 *
+	 * @return string
+	 */
+	private function generateRandomDeviceToken() {
+		$groups = [];
+		for ($i = 0; $i < 5; $i++) {
+			$groups[] = $this->random->generate(5, ISecureRandom::CHAR_HUMAN_READABLE);
+		}
+		return implode('-', $groups);
+	}
+
+	private function checkAppToken(): bool {
+		return $this->session->exists('app_password');
+	}
+
+	/**
+	 * @NoAdminRequired
+	 * @NoSubAdminRequired
+	 *
+	 * @param int $id
+	 * @return array|JSONResponse
+	 */
+	public function destroy($id) {
+		if ($this->checkAppToken()) {
+			return new JSONResponse([], Http::STATUS_BAD_REQUEST);
+		}
+
+		try {
+			$token = $this->findTokenByIdAndUser($id);
+		} catch (WipeTokenException $e) {
+			//continue as we can destroy tokens in wipe
+			$token = $e->getToken();
+		} catch (InvalidTokenException $e) {
+			return new JSONResponse([], Http::STATUS_NOT_FOUND);
+		}
+
+		$this->tokenProvider->invalidateTokenById($this->uid, $token->getId());
+		$this->publishActivity(Provider::APP_TOKEN_DELETED, $token->getId(), ['name' => $token->getName()]);
+		return [];
+	}
+
+	/**
+	 * @NoAdminRequired
+	 * @NoSubAdminRequired
+	 *
+	 * @param int $id
+	 * @param array $scope
+	 * @param string $name
+	 * @return array|JSONResponse
+	 */
+	public function update($id, array $scope, string $name) {
+		if ($this->checkAppToken()) {
+			return new JSONResponse([], Http::STATUS_BAD_REQUEST);
+		}
+
+		try {
+			$token = $this->findTokenByIdAndUser($id);
+		} catch (InvalidTokenException $e) {
+			return new JSONResponse([], Http::STATUS_NOT_FOUND);
+		}
+
+		$currentName = $token->getName();
+
+		if ($scope !== $token->getScopeAsArray()) {
+			$token->setScope(['filesystem' => $scope['filesystem']]);
+			$this->publishActivity($scope['filesystem'] ? Provider::APP_TOKEN_FILESYSTEM_GRANTED : Provider::APP_TOKEN_FILESYSTEM_REVOKED, $token->getId(), ['name' => $currentName]);
+		}
+
+		if (mb_strlen($name) > 128) {
+			$name = mb_substr($name, 0, 120) . '…';
+		}
+
+		if ($token instanceof INamedToken && $name !== $currentName) {
+			$token->setName($name);
+			$this->publishActivity(Provider::APP_TOKEN_RENAMED, $token->getId(), ['name' => $currentName, 'newName' => $name]);
+		}
+
+		$this->tokenProvider->updateToken($token);
+		return [];
+	}
+
+	/**
+	 * @param string $subject
+	 * @param int $id
+	 * @param array $parameters
+	 */
+	private function publishActivity(string $subject, int $id, array $parameters = []): void {
+		$event = $this->activityManager->generateEvent();
+		$event->setApp('settings')
+			->setType('security')
+			->setAffectedUser($this->uid)
+			->setAuthor($this->uid)
+			->setSubject($subject, $parameters)
+			->setObject('app_token', $id, 'App Password');
+
+		try {
+			$this->activityManager->publish($event);
+		} catch (BadMethodCallException $e) {
+			$this->logger->warning('could not publish activity', ['exception' => $e]);
+		}
+	}
+
+	/**
+	 * Find a token by given id and check if uid for current session belongs to this token
+	 *
+	 * @param int $id
+	 * @return IToken
+	 * @throws InvalidTokenException
+	 */
+	private function findTokenByIdAndUser(int $id): IToken {
+		try {
+			$token = $this->tokenProvider->getTokenById($id);
+		} catch (ExpiredTokenException $e) {
+			$token = $e->getToken();
+		}
+		if ($token->getUID() !== $this->uid) {
+			/** @psalm-suppress DeprecatedClass We have to throw the OC version so both OC and OCP catches catch it */
+			throw new OcInvalidTokenException('This token does not belong to you!');
+		}
+		return $token;
+	}
+
+	/**
+	 * @NoAdminRequired
+	 * @NoSubAdminRequired
+	 * @PasswordConfirmationRequired
+	 *
+	 * @param int $id
+	 * @return JSONResponse
+	 * @throws InvalidTokenException
+	 * @throws ExpiredTokenException
+	 */
+	public function wipe(int $id): JSONResponse {
+		if ($this->checkAppToken()) {
+			return new JSONResponse([], Http::STATUS_BAD_REQUEST);
+		}
+
+		try {
+			$token = $this->findTokenByIdAndUser($id);
+		} catch (InvalidTokenException $e) {
+			return new JSONResponse([], Http::STATUS_NOT_FOUND);
+		}
+
+		if (!$this->remoteWipe->markTokenForWipe($token)) {
+			return new JSONResponse([], Http::STATUS_BAD_REQUEST);
+		}
+
+		return new JSONResponse([]);
+	}
+}

wedding-pics/apps/settings/lib/Controller/AuthorizedGroupController.php

@@ -0,0 +1,80 @@
+<?php
+
+/**
+ * @copyright Copyright (c) 2021 Carl Schwan <carl@carlschwan.eu>
+ *
+ * @author Carl Schwan <carl@carlschwan.eu>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Controller;
+
+use OC\Settings\AuthorizedGroup;
+use OCA\Settings\Service\AuthorizedGroupService;
+use OCA\Settings\Service\NotFoundException;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http\DataResponse;
+use OCP\DB\Exception;
+use OCP\IRequest;
+
+class AuthorizedGroupController extends Controller {
+	/** @var AuthorizedGroupService $authorizedGroupService */
+	private $authorizedGroupService;
+
+	public function __construct(string $AppName, IRequest $request, AuthorizedGroupService $authorizedGroupService) {
+		parent::__construct($AppName, $request);
+		$this->authorizedGroupService = $authorizedGroupService;
+	}
+
+	/**
+	 * @throws NotFoundException
+	 * @throws Exception
+	 */
+	public function saveSettings(array $newGroups, string $class): DataResponse {
+		$currentGroups = $this->authorizedGroupService->findExistingGroupsForClass($class);
+
+		foreach ($currentGroups as $group) {
+			/** @var AuthorizedGroup $group */
+			$removed = true;
+			foreach ($newGroups as $groupData) {
+				if ($groupData['gid'] === $group->getGroupId()) {
+					$removed = false;
+					break;
+				}
+			}
+			if ($removed) {
+				$this->authorizedGroupService->delete($group->getId());
+			}
+		}
+
+		foreach ($newGroups as $groupData) {
+			$added = true;
+			foreach ($currentGroups as $group) {
+				/** @var AuthorizedGroup $group */
+				if ($groupData['gid'] === $group->getGroupId()) {
+					$added = false;
+					break;
+				}
+			}
+			if ($added) {
+				$this->authorizedGroupService->create($groupData['gid'], $class);
+			}
+		}
+		
+		return new DataResponse(['valid' => true]);
+	}
+}

wedding-pics/apps/settings/lib/Controller/ChangePasswordController.php

@@ -0,0 +1,255 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016 Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Daniel Calviño Sánchez <danxuliu@gmail.com>
+ * @author Daniel Kesselberg <mail@danielkesselberg.de>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Julius Härtl <jus@bitgrid.net>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Matthew Setter <matthew@matthewsetter.com>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+// FIXME: disabled for now to be able to inject IGroupManager and also use
+// getSubAdmin()
+//declare(strict_types=1);
+
+namespace OCA\Settings\Controller;
+
+use OC\Group\Manager as GroupManager;
+use OC\User\Session;
+use OCP\App\IAppManager;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http\JSONResponse;
+use OCP\HintException;
+use OCP\IGroupManager;
+use OCP\IL10N;
+use OCP\IRequest;
+use OCP\IUser;
+use OCP\IUserManager;
+use OCP\IUserSession;
+
+class ChangePasswordController extends Controller {
+	private ?string $userId;
+	private IUserManager $userManager;
+	private IL10N $l;
+	private GroupManager $groupManager;
+	private Session $userSession;
+	private IAppManager $appManager;
+
+	public function __construct(string $appName,
+		IRequest $request,
+		?string $userId,
+		IUserManager $userManager,
+		IUserSession $userSession,
+		IGroupManager $groupManager,
+		IAppManager $appManager,
+		IL10N $l) {
+		parent::__construct($appName, $request);
+
+		$this->userId = $userId;
+		$this->userManager = $userManager;
+		$this->userSession = $userSession;
+		$this->groupManager = $groupManager;
+		$this->appManager = $appManager;
+		$this->l = $l;
+	}
+
+	/**
+	 * @NoAdminRequired
+	 * @NoSubAdminRequired
+	 * @BruteForceProtection(action=changePersonalPassword)
+	 */
+	public function changePersonalPassword(string $oldpassword = '', string $newpassword = null): JSONResponse {
+		$loginName = $this->userSession->getLoginName();
+		/** @var IUser $user */
+		$user = $this->userManager->checkPassword($loginName, $oldpassword);
+		if ($user === false) {
+			$response = new JSONResponse([
+				'status' => 'error',
+				'data' => [
+					'message' => $this->l->t('Wrong password'),
+				],
+			]);
+			$response->throttle();
+			return $response;
+		}
+
+		try {
+			if ($newpassword === null || strlen($newpassword) > IUserManager::MAX_PASSWORD_LENGTH || $user->setPassword($newpassword) === false) {
+				return new JSONResponse([
+					'status' => 'error',
+					'data' => [
+						'message' => $this->l->t('Unable to change personal password'),
+					],
+				]);
+			}
+			// password policy app throws exception
+		} catch (HintException $e) {
+			return new JSONResponse([
+				'status' => 'error',
+				'data' => [
+					'message' => $e->getHint(),
+				],
+			]);
+		}
+
+		$this->userSession->updateSessionTokenPassword($newpassword);
+
+		return new JSONResponse([
+			'status' => 'success',
+			'data' => [
+				'message' => $this->l->t('Saved'),
+			],
+		]);
+	}
+
+	/**
+	 * @NoAdminRequired
+	 * @PasswordConfirmationRequired
+	 */
+	public function changeUserPassword(string $username = null, string $password = null, string $recoveryPassword = null): JSONResponse {
+		if ($username === null) {
+			return new JSONResponse([
+				'status' => 'error',
+				'data' => [
+					'message' => $this->l->t('No user supplied'),
+				],
+			]);
+		}
+
+		if ($password === null) {
+			return new JSONResponse([
+				'status' => 'error',
+				'data' => [
+					'message' => $this->l->t('Unable to change password'),
+				],
+			]);
+		}
+
+		if (strlen($password) > IUserManager::MAX_PASSWORD_LENGTH) {
+			return new JSONResponse([
+				'status' => 'error',
+				'data' => [
+					'message' => $this->l->t('Unable to change password. Password too long.'),
+				],
+			]);
+		}
+
+		$currentUser = $this->userSession->getUser();
+		$targetUser = $this->userManager->get($username);
+		if ($currentUser === null || $targetUser === null ||
+			!($this->groupManager->isAdmin($this->userId) ||
+			 $this->groupManager->getSubAdmin()->isUserAccessible($currentUser, $targetUser))
+		) {
+			return new JSONResponse([
+				'status' => 'error',
+				'data' => [
+					'message' => $this->l->t('Authentication error'),
+				],
+			]);
+		}
+
+		if ($this->appManager->isEnabledForUser('encryption')) {
+			//handle the recovery case
+			$keyManager = \OCP\Server::get(\OCA\Encryption\KeyManager::class);
+			$recovery = \OCP\Server::get(\OCA\Encryption\Recovery::class);
+			$recoveryAdminEnabled = $recovery->isRecoveryKeyEnabled();
+
+			$validRecoveryPassword = false;
+			$recoveryEnabledForUser = false;
+			if ($recoveryAdminEnabled) {
+				$validRecoveryPassword = $keyManager->checkRecoveryPassword($recoveryPassword);
+				$recoveryEnabledForUser = $recovery->isRecoveryEnabledForUser($username);
+			}
+
+			if ($recoveryEnabledForUser && $recoveryPassword === '') {
+				return new JSONResponse([
+					'status' => 'error',
+					'data' => [
+						'message' => $this->l->t('Please provide an admin recovery password; otherwise, all user data will be lost.'),
+					]
+				]);
+			} elseif ($recoveryEnabledForUser && ! $validRecoveryPassword) {
+				return new JSONResponse([
+					'status' => 'error',
+					'data' => [
+						'message' => $this->l->t('Wrong admin recovery password. Please check the password and try again.'),
+					]
+				]);
+			} else { // now we know that everything is fine regarding the recovery password, let's try to change the password
+				try {
+					$result = $targetUser->setPassword($password, $recoveryPassword);
+					// password policy app throws exception
+				} catch (HintException $e) {
+					return new JSONResponse([
+						'status' => 'error',
+						'data' => [
+							'message' => $e->getHint(),
+						],
+					]);
+				}
+				if (!$result && $recoveryEnabledForUser) {
+					return new JSONResponse([
+						'status' => 'error',
+						'data' => [
+							'message' => $this->l->t('Backend does not support password change, but the user\'s encryption key was updated.'),
+						]
+					]);
+				} elseif (!$result && !$recoveryEnabledForUser) {
+					return new JSONResponse([
+						'status' => 'error',
+						'data' => [
+							'message' => $this->l->t('Unable to change password'),
+						]
+					]);
+				}
+			}
+		} else {
+			try {
+				if ($targetUser->setPassword($password) === false) {
+					return new JSONResponse([
+						'status' => 'error',
+						'data' => [
+							'message' => $this->l->t('Unable to change password'),
+						],
+					]);
+				}
+				// password policy app throws exception
+			} catch (HintException $e) {
+				return new JSONResponse([
+					'status' => 'error',
+					'data' => [
+						'message' => $e->getHint(),
+					],
+				]);
+			}
+		}
+
+		return new JSONResponse([
+			'status' => 'success',
+			'data' => [
+				'username' => $username,
+			],
+		]);
+	}
+}

wedding-pics/apps/settings/lib/Controller/CheckSetupController.php

@@ -0,0 +1,307 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Bjoern Schiessle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Cthulhux <git@tuxproject.de>
+ * @author Daniel Kesselberg <mail@danielkesselberg.de>
+ * @author Derek <derek.kelly27@gmail.com>
+ * @author Georg Ehrke <oc.list@georgehrke.com>
+ * @author J0WI <J0WI@users.noreply.github.com>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Julius Härtl <jus@bitgrid.net>
+ * @author Ko- <k.stoffelen@cs.ru.nl>
+ * @author Lauris Binde <laurisb@users.noreply.github.com>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Michael Weimann <mail@michael-weimann.eu>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author nhirokinet <nhirokinet@nhiroki.net>
+ * @author Robin Appelman <robin@icewind.nl>
+ * @author Robin McCorkell <robin@mccorkell.me.uk>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ * @author Sven Strickroth <email@cs-ware.de>
+ * @author Sylvia van Os <sylvia@hackerchick.me>
+ * @author timm2k <timm2k@gmx.de>
+ * @author Timo Förster <tfoerster@webfoersterei.de>
+ * @author Valdnet <47037905+Valdnet@users.noreply.github.com>
+ * @author MichaIng <micha@dietpi.com>
+ * @author Kate Döen <kate.doeen@nextcloud.com>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Settings\Controller;
+
+use OC\AppFramework\Http;
+use OC\IntegrityCheck\Checker;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http\Attribute\OpenAPI;
+use OCP\AppFramework\Http\DataDisplayResponse;
+use OCP\AppFramework\Http\DataResponse;
+use OCP\AppFramework\Http\RedirectResponse;
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\IRequest;
+use OCP\ITempManager;
+use OCP\IURLGenerator;
+use OCP\Notification\IManager;
+use OCP\SetupCheck\ISetupCheckManager;
+use Psr\Log\LoggerInterface;
+
+#[OpenAPI(scope: OpenAPI::SCOPE_IGNORE)]
+class CheckSetupController extends Controller {
+	/** @var IConfig */
+	private $config;
+	/** @var IURLGenerator */
+	private $urlGenerator;
+	/** @var IL10N */
+	private $l10n;
+	/** @var Checker */
+	private $checker;
+	/** @var LoggerInterface */
+	private $logger;
+	/** @var ITempManager */
+	private $tempManager;
+	/** @var IManager */
+	private $manager;
+	private ISetupCheckManager $setupCheckManager;
+
+	public function __construct($AppName,
+		IRequest $request,
+		IConfig $config,
+		IURLGenerator $urlGenerator,
+		IL10N $l10n,
+		Checker $checker,
+		LoggerInterface $logger,
+		ITempManager $tempManager,
+		IManager $manager,
+		ISetupCheckManager $setupCheckManager,
+	) {
+		parent::__construct($AppName, $request);
+		$this->config = $config;
+		$this->urlGenerator = $urlGenerator;
+		$this->l10n = $l10n;
+		$this->checker = $checker;
+		$this->logger = $logger;
+		$this->tempManager = $tempManager;
+		$this->manager = $manager;
+		$this->setupCheckManager = $setupCheckManager;
+	}
+
+	/**
+	 * @NoAdminRequired
+	 * @NoCSRFRequired
+	 * @return DataResponse
+	 */
+	public function setupCheckManager(): DataResponse {
+		return new DataResponse($this->setupCheckManager->runAll());
+	}
+
+	/**
+	 * Check if is fair use of free push service
+	 * @return bool
+	 */
+	private function isFairUseOfFreePushService(): bool {
+		$rateLimitReached = (int) $this->config->getAppValue('notifications', 'rate_limit_reached', '0');
+		if ($rateLimitReached >= (time() - 7 * 24 * 3600)) {
+			// Notifications app is showing a message already
+			return true;
+		}
+		return $this->manager->isFairUseOfFreePushService();
+	}
+
+	/**
+	 * Checks if the correct memcache module for PHP is installed. Only
+	 * fails if memcached is configured and the working module is not installed.
+	 *
+	 * @return bool
+	 */
+	private function isCorrectMemcachedPHPModuleInstalled() {
+		$memcacheDistributedClass = $this->config->getSystemValue('memcache.distributed', null);
+		if ($memcacheDistributedClass === null || ltrim($memcacheDistributedClass, '\\') !== \OC\Memcache\Memcached::class) {
+			return true;
+		}
+
+		// there are two different memcache modules for PHP
+		// we only support memcached and not memcache
+		// https://code.google.com/p/memcached/wiki/PHPClientComparison
+		return !(!extension_loaded('memcached') && extension_loaded('memcache'));
+	}
+
+	/**
+	 * Checks if set_time_limit is not disabled.
+	 *
+	 * @return bool
+	 */
+	private function isSettimelimitAvailable() {
+		if (function_exists('set_time_limit')
+			&& !str_contains(ini_get('disable_functions'), 'set_time_limit')) {
+			return true;
+		}
+
+		return false;
+	}
+
+	/**
+	 * @NoCSRFRequired
+	 * @return RedirectResponse
+	 * @AuthorizedAdminSetting(settings=OCA\Settings\Settings\Admin\Overview)
+	 */
+	public function rescanFailedIntegrityCheck(): RedirectResponse {
+		$this->checker->runInstanceVerification();
+		return new RedirectResponse(
+			$this->urlGenerator->linkToRoute('settings.AdminSettings.index', ['section' => 'overview'])
+		);
+	}
+
+	/**
+	 * @NoCSRFRequired
+	 * @AuthorizedAdminSetting(settings=OCA\Settings\Settings\Admin\Overview)
+	 */
+	public function getFailedIntegrityCheckFiles(): DataDisplayResponse {
+		if (!$this->checker->isCodeCheckEnforced()) {
+			return new DataDisplayResponse('Integrity checker has been disabled. Integrity cannot be verified.');
+		}
+
+		$completeResults = $this->checker->getResults();
+
+		if (!empty($completeResults)) {
+			$formattedTextResponse = 'Technical information
+=====================
+The following list covers which files have failed the integrity check. Please read
+the previous linked documentation to learn more about the errors and how to fix
+them.
+
+Results
+=======
+';
+			foreach ($completeResults as $context => $contextResult) {
+				$formattedTextResponse .= "- $context\n";
+
+				foreach ($contextResult as $category => $result) {
+					$formattedTextResponse .= "\t- $category\n";
+					if ($category !== 'EXCEPTION') {
+						foreach ($result as $key => $results) {
+							$formattedTextResponse .= "\t\t- $key\n";
+						}
+					} else {
+						foreach ($result as $key => $results) {
+							$formattedTextResponse .= "\t\t- $results\n";
+						}
+					}
+				}
+			}
+
+			$formattedTextResponse .= '
+Raw output
+==========
+';
+			$formattedTextResponse .= print_r($completeResults, true);
+		} else {
+			$formattedTextResponse = 'No errors have been found.';
+		}
+
+
+		return new DataDisplayResponse(
+			$formattedTextResponse,
+			Http::STATUS_OK,
+			[
+				'Content-Type' => 'text/plain',
+			]
+		);
+	}
+
+	private function isTemporaryDirectoryWritable(): bool {
+		try {
+			if (!empty($this->tempManager->getTempBaseDir())) {
+				return true;
+			}
+		} catch (\Exception $e) {
+		}
+		return false;
+	}
+
+	protected function areWebauthnExtensionsEnabled(): bool {
+		if (!extension_loaded('bcmath')) {
+			return false;
+		}
+		if (!extension_loaded('gmp')) {
+			return false;
+		}
+		return true;
+	}
+
+	protected function isMysqlUsedWithoutUTF8MB4(): bool {
+		return ($this->config->getSystemValue('dbtype', 'sqlite') === 'mysql') && ($this->config->getSystemValue('mysql.utf8mb4', false) === false);
+	}
+
+	protected function isEnoughTempSpaceAvailableIfS3PrimaryStorageIsUsed(): bool {
+		$objectStore = $this->config->getSystemValue('objectstore', null);
+		$objectStoreMultibucket = $this->config->getSystemValue('objectstore_multibucket', null);
+
+		if (!isset($objectStoreMultibucket) && !isset($objectStore)) {
+			return true;
+		}
+
+		if (isset($objectStoreMultibucket['class']) && $objectStoreMultibucket['class'] !== 'OC\\Files\\ObjectStore\\S3') {
+			return true;
+		}
+
+		if (isset($objectStore['class']) && $objectStore['class'] !== 'OC\\Files\\ObjectStore\\S3') {
+			return true;
+		}
+
+		$tempPath = sys_get_temp_dir();
+		if (!is_dir($tempPath)) {
+			$this->logger->error('Error while checking the temporary PHP path - it was not properly set to a directory. Returned value: ' . $tempPath);
+			return false;
+		}
+		$freeSpaceInTemp = function_exists('disk_free_space') ? disk_free_space($tempPath) : false;
+		if ($freeSpaceInTemp === false) {
+			$this->logger->error('Error while checking the available disk space of temporary PHP path or no free disk space returned. Temporary path: ' . $tempPath);
+			return false;
+		}
+
+		$freeSpaceInTempInGB = $freeSpaceInTemp / 1024 / 1024 / 1024;
+		if ($freeSpaceInTempInGB > 50) {
+			return true;
+		}
+
+		$this->logger->warning('Checking the available space in the temporary path resulted in ' . round($freeSpaceInTempInGB, 1) . ' GB instead of the recommended 50GB. Path: ' . $tempPath);
+		return false;
+	}
+
+	/**
+	 * @return DataResponse
+	 * @AuthorizedAdminSetting(settings=OCA\Settings\Settings\Admin\Overview)
+	 */
+	public function check() {
+		return new DataResponse(
+			[
+				'isFairUseOfFreePushService' => $this->isFairUseOfFreePushService(),
+				'reverseProxyDocs' => $this->urlGenerator->linkToDocs('admin-reverse-proxy'),
+				'isCorrectMemcachedPHPModuleInstalled' => $this->isCorrectMemcachedPHPModuleInstalled(),
+				'isSettimelimitAvailable' => $this->isSettimelimitAvailable(),
+				'areWebauthnExtensionsEnabled' => $this->areWebauthnExtensionsEnabled(),
+				'isMysqlUsedWithoutUTF8MB4' => $this->isMysqlUsedWithoutUTF8MB4(),
+				'isEnoughTempSpaceAvailableIfS3PrimaryStorageIsUsed' => $this->isEnoughTempSpaceAvailableIfS3PrimaryStorageIsUsed(),
+				'reverseProxyGeneratedURL' => $this->urlGenerator->getAbsoluteURL('index.php'),
+				'temporaryDirectoryWritable' => $this->isTemporaryDirectoryWritable(),
+				'generic' => $this->setupCheckManager->runAll(),
+			]
+		);
+	}
+}

wedding-pics/apps/settings/lib/Controller/CommonSettingsTrait.php

@@ -0,0 +1,161 @@
+<?php
+/**
+ * @copyright Copyright (c) 2017 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Julius Härtl <jus@bitgrid.net>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Robin Appelman <robin@icewind.nl>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Controller;
+
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\Group\ISubAdmin;
+use OCP\IGroupManager;
+use OCP\INavigationManager;
+use OCP\IUserSession;
+use OCP\Settings\IIconSection;
+use OCP\Settings\IManager as ISettingsManager;
+use OCP\Settings\ISettings;
+
+trait CommonSettingsTrait {
+
+	/** @var ISettingsManager */
+	private $settingsManager;
+
+	/** @var INavigationManager */
+	private $navigationManager;
+
+	/** @var IUserSession */
+	private $userSession;
+
+	/** @var IGroupManager */
+	private $groupManager;
+
+	/** @var ISubAdmin */
+	private $subAdmin;
+
+	/**
+	 * @return array{forms: array{personal: array, admin: array}}
+	 */
+	private function getNavigationParameters(string $currentType, string $currentSection): array {
+		$templateParameters = [
+			'personal' => $this->formatPersonalSections($currentType, $currentSection),
+			'admin' => []
+		];
+
+		$templateParameters['admin'] = $this->formatAdminSections(
+			$currentType,
+			$currentSection
+		);
+
+		return [
+			'forms' => $templateParameters
+		];
+	}
+
+	/**
+	 * @param IIconSection[][] $sections
+	 * @psam-param 'admin'|'personal' $type
+	 * @return list<array{anchor: string, section-name: string, active: bool, icon: string}>
+	 */
+	protected function formatSections(array $sections, string $currentSection, string $type, string $currentType): array {
+		$templateParameters = [];
+		foreach ($sections as $prioritizedSections) {
+			foreach ($prioritizedSections as $section) {
+				if ($type === 'admin') {
+					$settings = $this->settingsManager->getAllowedAdminSettings($section->getID(), $this->userSession->getUser());
+				} elseif ($type === 'personal') {
+					$settings = $this->settingsManager->getPersonalSettings($section->getID());
+				}
+				if (empty($settings) && !($section->getID() === 'additional' && count(\OC_App::getForms('admin')) > 0)) {
+					continue;
+				}
+
+				$icon = $section->getIcon();
+
+				$active = $section->getID() === $currentSection
+					&& $type === $currentType;
+
+				$templateParameters[] = [
+					'anchor' => $section->getID(),
+					'section-name' => $section->getName(),
+					'active' => $active,
+					'icon' => $icon,
+				];
+			}
+		}
+		return $templateParameters;
+	}
+
+	protected function formatPersonalSections(string $currentType, string $currentSections): array {
+		$sections = $this->settingsManager->getPersonalSections();
+		return $this->formatSections($sections, $currentSections, 'personal', $currentType);
+	}
+
+	protected function formatAdminSections(string $currentType, string $currentSections): array {
+		$sections = $this->settingsManager->getAdminSections();
+		return $this->formatSections($sections, $currentSections, 'admin', $currentType);
+	}
+
+	/**
+	 * @param array<int, list<\OCP\Settings\ISettings>> $settings
+	 * @return array{content: string}
+	 */
+	private function formatSettings(array $settings): array {
+		$html = '';
+		foreach ($settings as $prioritizedSettings) {
+			foreach ($prioritizedSettings as $setting) {
+				/** @var ISettings $setting */
+				$form = $setting->getForm();
+				$html .= $form->renderAs('')->render();
+			}
+		}
+		return ['content' => $html];
+	}
+
+	private function getIndexResponse(string $type, string $section): TemplateResponse {
+		if ($type === 'personal') {
+			if ($section === 'theming') {
+				$this->navigationManager->setActiveEntry('accessibility_settings');
+			} else {
+				$this->navigationManager->setActiveEntry('settings');
+			}
+		} elseif ($type === 'admin') {
+			$this->navigationManager->setActiveEntry('admin_settings');
+		}
+
+		$templateParams = [];
+		$templateParams = array_merge($templateParams, $this->getNavigationParameters($type, $section));
+		$templateParams = array_merge($templateParams, $this->getSettings($section));
+		$activeSection = $this->settingsManager->getSection($type, $section);
+		if ($activeSection) {
+			$templateParams['pageTitle'] = $activeSection->getName();
+			$templateParams['activeSectionId'] = $activeSection->getID();
+			$templateParams['activeSectionType'] = $type;
+		}
+
+		return new TemplateResponse('settings', 'settings/frame', $templateParams);
+	}
+
+	abstract protected function getSettings($section);
+}

wedding-pics/apps/settings/lib/Controller/HelpController.php

@@ -0,0 +1,124 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2019 Julius Härtl <jus@bitgrid.net>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Daniel Kesselberg <mail@danielkesselberg.de>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Julius Härtl <jus@bitgrid.net>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ * @author Kate Döen <kate.doeen@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Controller;
+
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http\Attribute\OpenAPI;
+use OCP\AppFramework\Http\ContentSecurityPolicy;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\IConfig;
+use OCP\IGroupManager;
+use OCP\IL10N;
+use OCP\INavigationManager;
+use OCP\IRequest;
+use OCP\IURLGenerator;
+
+#[OpenAPI(scope: OpenAPI::SCOPE_IGNORE)]
+class HelpController extends Controller {
+
+	/** @var INavigationManager */
+	private $navigationManager;
+	/** @var IURLGenerator */
+	private $urlGenerator;
+	/** @var IGroupManager */
+	private $groupManager;
+	/** @var IL10N */
+	private $l10n;
+
+	/** @var string */
+	private $userId;
+
+	/** @var IConfig */
+	private $config;
+
+	public function __construct(
+		string $appName,
+		IRequest $request,
+		INavigationManager $navigationManager,
+		IURLGenerator $urlGenerator,
+		?string $userId,
+		IGroupManager $groupManager,
+		IL10N $l10n,
+		IConfig $config,
+	) {
+		parent::__construct($appName, $request);
+		$this->navigationManager = $navigationManager;
+		$this->urlGenerator = $urlGenerator;
+		$this->userId = $userId;
+		$this->groupManager = $groupManager;
+		$this->l10n = $l10n;
+		$this->config = $config;
+	}
+
+	/**
+	 * @return TemplateResponse
+	 *
+	 * @NoCSRFRequired
+	 * @NoAdminRequired
+	 * @NoSubAdminRequired
+	 */
+	public function help(string $mode = 'user'): TemplateResponse {
+		$this->navigationManager->setActiveEntry('help');
+		$pageTitle = $this->l10n->t('Administrator documentation');
+		if ($mode !== 'admin') {
+			$pageTitle = $this->l10n->t('User documentation');
+			$mode = 'user';
+		}
+
+		$documentationUrl = $this->urlGenerator->getAbsoluteURL(
+			$this->urlGenerator->linkTo('', 'core/doc/' . $mode . '/index.html')
+		);
+
+		$urlUserDocs = $this->urlGenerator->linkToRoute('settings.Help.help', ['mode' => 'user']);
+		$urlAdminDocs = $this->urlGenerator->linkToRoute('settings.Help.help', ['mode' => 'admin']);
+
+		$knowledgebaseEmbedded = $this->config->getSystemValueBool('knowledgebase.embedded', false);
+		if (!$knowledgebaseEmbedded) {
+			$pageTitle = $this->l10n->t('Nextcloud help overview');
+			$urlUserDocs = $this->urlGenerator->linkToDocs('user');
+			$urlAdminDocs = $this->urlGenerator->linkToDocs('admin');
+		}
+
+		$response = new TemplateResponse('settings', 'help', [
+			'admin' => $this->groupManager->isAdmin($this->userId),
+			'url' => $documentationUrl,
+			'urlUserDocs' => $urlUserDocs,
+			'urlAdminDocs' => $urlAdminDocs,
+			'mode' => $mode,
+			'pageTitle' => $pageTitle,
+			'knowledgebaseEmbedded' => $knowledgebaseEmbedded,
+		]);
+		$policy = new ContentSecurityPolicy();
+		$policy->addAllowedFrameDomain('\'self\'');
+		$response->setContentSecurityPolicy($policy);
+		return $response;
+	}
+}

wedding-pics/apps/settings/lib/Controller/LogSettingsController.php

@@ -0,0 +1,68 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Georg Ehrke <oc.list@georgehrke.com>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ * @author Thomas Müller <thomas.mueller@tmit.eu>
+ * @author Kate Döen <kate.doeen@nextcloud.com>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Settings\Controller;
+
+use OC\Log;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\StreamResponse;
+use OCP\IRequest;
+
+class LogSettingsController extends Controller {
+
+	/** @var Log */
+	private $log;
+
+	public function __construct(string $appName, IRequest $request, Log $logger) {
+		parent::__construct($appName, $request);
+		$this->log = $logger;
+	}
+
+	/**
+	 * download logfile
+	 *
+	 * @NoCSRFRequired
+	 *
+	 * @psalm-suppress MoreSpecificReturnType The value of Content-Disposition is not relevant
+	 * @psalm-suppress LessSpecificReturnStatement The value of Content-Disposition is not relevant
+	 * @return StreamResponse<Http::STATUS_OK, array{Content-Type: 'application/octet-stream', 'Content-Disposition': string}>
+	 *
+	 * 200: Logfile returned
+	 */
+	public function download() {
+		if (!$this->log instanceof Log) {
+			throw new \UnexpectedValueException('Log file not available');
+		}
+		$resp = new StreamResponse($this->log->getLogPath());
+		$resp->setHeaders([
+			'Content-Type' => 'application/octet-stream',
+			'Content-Disposition' => 'attachment; filename="nextcloud.log"',
+		]);
+		return $resp;
+	}
+}

wedding-pics/apps/settings/lib/Controller/MailSettingsController.php

@@ -0,0 +1,185 @@
+<?php
+/**
+ * @copyright Copyright (c) 2017  Joas Schilling <coding@schilljs.com>
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Daniel Kesselberg <mail@danielkesselberg.de>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Settings\Controller;
+
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\DataResponse;
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\IRequest;
+use OCP\IURLGenerator;
+use OCP\IUserSession;
+use OCP\Mail\IMailer;
+
+class MailSettingsController extends Controller {
+
+	/** @var IL10N */
+	private $l10n;
+	/** @var IConfig */
+	private $config;
+	/** @var IUserSession */
+	private $userSession;
+	/** @var IMailer */
+	private $mailer;
+	/** @var IURLGenerator */
+	private $urlGenerator;
+
+	/**
+	 * @param string $appName
+	 * @param IRequest $request
+	 * @param IL10N $l10n
+	 * @param IConfig $config
+	 * @param IUserSession $userSession
+	 * @param IURLGenerator $urlGenerator,
+	 * @param IMailer $mailer
+	 */
+	public function __construct($appName,
+		IRequest $request,
+		IL10N $l10n,
+		IConfig $config,
+		IUserSession $userSession,
+		IURLGenerator $urlGenerator,
+		IMailer $mailer) {
+		parent::__construct($appName, $request);
+		$this->l10n = $l10n;
+		$this->config = $config;
+		$this->userSession = $userSession;
+		$this->urlGenerator = $urlGenerator;
+		$this->mailer = $mailer;
+	}
+
+	/**
+	 * Sets the email settings
+	 *
+	 * @PasswordConfirmationRequired
+	 * @AuthorizedAdminSetting(settings=OCA\Settings\Settings\Admin\Overview)
+	 *
+	 * @param string $mail_domain
+	 * @param string $mail_from_address
+	 * @param string $mail_smtpmode
+	 * @param string $mail_smtpsecure
+	 * @param string $mail_smtphost
+	 * @param int $mail_smtpauth
+	 * @param string $mail_smtpport
+	 * @return DataResponse
+	 */
+	public function setMailSettings($mail_domain,
+		$mail_from_address,
+		$mail_smtpmode,
+		$mail_smtpsecure,
+		$mail_smtphost,
+		$mail_smtpauth,
+		$mail_smtpport,
+		$mail_sendmailmode) {
+		$params = get_defined_vars();
+		$configs = [];
+		foreach ($params as $key => $value) {
+			$configs[$key] = empty($value) ? null : $value;
+		}
+
+		// Delete passwords from config in case no auth is specified
+		if ($params['mail_smtpauth'] !== 1) {
+			$configs['mail_smtpname'] = null;
+			$configs['mail_smtppassword'] = null;
+		}
+
+		$this->config->setSystemValues($configs);
+
+		$this->config->setAppValue('core', 'emailTestSuccessful', '0');
+
+		return new DataResponse();
+	}
+
+	/**
+	 * Store the credentials used for SMTP in the config
+	 *
+	 * @PasswordConfirmationRequired
+	 * @AuthorizedAdminSetting(settings=OCA\Settings\Settings\Admin\Overview)
+	 *
+	 * @param string $mail_smtpname
+	 * @param string $mail_smtppassword
+	 * @return DataResponse
+	 */
+	public function storeCredentials($mail_smtpname, $mail_smtppassword) {
+		if ($mail_smtppassword === '********') {
+			return new DataResponse($this->l10n->t('Invalid SMTP password.'), Http::STATUS_BAD_REQUEST);
+		}
+
+		$this->config->setSystemValues([
+			'mail_smtpname' => $mail_smtpname,
+			'mail_smtppassword' => $mail_smtppassword,
+		]);
+
+		$this->config->setAppValue('core', 'emailTestSuccessful', '0');
+
+		return new DataResponse();
+	}
+
+	/**
+	 * Send a mail to test the settings
+	 * @AuthorizedAdminSetting(settings=OCA\Settings\Settings\Admin\Overview)
+	 * @return DataResponse
+	 */
+	public function sendTestMail() {
+		$email = $this->config->getUserValue($this->userSession->getUser()->getUID(), $this->appName, 'email', '');
+		if (!empty($email)) {
+			try {
+				$displayName = $this->userSession->getUser()->getDisplayName();
+
+				$template = $this->mailer->createEMailTemplate('settings.TestEmail', [
+					'displayname' => $displayName,
+				]);
+
+				$template->setSubject($this->l10n->t('Email setting test'));
+				$template->addHeader();
+				$template->addHeading($this->l10n->t('Well done, %s!', [$displayName]));
+				$template->addBodyText($this->l10n->t('If you received this email, the email configuration seems to be correct.'));
+				$template->addFooter();
+
+				$message = $this->mailer->createMessage();
+				$message->setTo([$email => $displayName]);
+				$message->useTemplate($template);
+				$errors = $this->mailer->send($message);
+				if (!empty($errors)) {
+					$this->config->setAppValue('core', 'emailTestSuccessful', '0');
+					throw new \RuntimeException($this->l10n->t('Email could not be sent. Check your mail server log'));
+				}
+				// Store the successful config in the app config
+				$this->config->setAppValue('core', 'emailTestSuccessful', '1');
+				return new DataResponse();
+			} catch (\Exception $e) {
+				$this->config->setAppValue('core', 'emailTestSuccessful', '0');
+				return new DataResponse($this->l10n->t('A problem occurred while sending the email. Please revise your settings. (Error: %s)', [$e->getMessage()]), Http::STATUS_BAD_REQUEST);
+			}
+		}
+
+		$this->config->setAppValue('core', 'emailTestSuccessful', '0');
+		return new DataResponse($this->l10n->t('You need to set your user email before being able to send test emails. Go to %s for that.', [$this->urlGenerator->linkToRouteAbsolute('settings.PersonalSettings.index')]), Http::STATUS_BAD_REQUEST);
+	}
+}

wedding-pics/apps/settings/lib/Controller/PersonalSettingsController.php

@@ -0,0 +1,112 @@
+<?php
+/**
+ * @copyright Copyright (c) 2017 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Robin Appelman <robin@icewind.nl>
+ * @author Kate Döen <kate.doeen@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Controller;
+
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http\Attribute\OpenAPI;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\Group\ISubAdmin;
+use OCP\IGroupManager;
+use OCP\INavigationManager;
+use OCP\IRequest;
+use OCP\IUserSession;
+use OCP\Settings\IManager as ISettingsManager;
+use OCP\Template;
+
+#[OpenAPI(scope: OpenAPI::SCOPE_IGNORE)]
+class PersonalSettingsController extends Controller {
+	use CommonSettingsTrait;
+
+	public function __construct(
+		$appName,
+		IRequest $request,
+		INavigationManager $navigationManager,
+		ISettingsManager $settingsManager,
+		IUserSession $userSession,
+		IGroupManager $groupManager,
+		ISubAdmin $subAdmin
+	) {
+		parent::__construct($appName, $request);
+		$this->navigationManager = $navigationManager;
+		$this->settingsManager = $settingsManager;
+		$this->userSession = $userSession;
+		$this->subAdmin = $subAdmin;
+		$this->groupManager = $groupManager;
+	}
+
+	/**
+	 * @NoCSRFRequired
+	 * @NoAdminRequired
+	 * @NoSubAdminRequired
+	 */
+	public function index(string $section): TemplateResponse {
+		return $this->getIndexResponse('personal', $section);
+	}
+
+	/**
+	 * @param string $section
+	 * @return array
+	 */
+	protected function getSettings($section) {
+		$settings = $this->settingsManager->getPersonalSettings($section);
+		$formatted = $this->formatSettings($settings);
+		if ($section === 'additional') {
+			$formatted['content'] .= $this->getLegacyForms();
+		}
+		return $formatted;
+	}
+
+	/**
+	 * @return bool|string
+	 */
+	private function getLegacyForms() {
+		$forms = \OC_App::getForms('personal');
+
+		$forms = array_map(function ($form) {
+			if (preg_match('%(<h2(?P<class>[^>]*)>.*?</h2>)%i', $form, $regs)) {
+				$sectionName = str_replace('<h2' . $regs['class'] . '>', '', $regs[0]);
+				$sectionName = str_replace('</h2>', '', $sectionName);
+				$anchor = strtolower($sectionName);
+				$anchor = str_replace(' ', '-', $anchor);
+
+				return [
+					'anchor' => $anchor,
+					'section-name' => $sectionName,
+					'form' => $form
+				];
+			}
+			return [
+				'form' => $form
+			];
+		}, $forms);
+
+		$out = new Template('settings', 'settings/additional');
+		$out->assign('forms', $forms);
+
+		return $out->fetchPage();
+	}
+}

wedding-pics/apps/settings/lib/Controller/ReasonsController.php

@@ -0,0 +1,49 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020, Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Jan C. Borchardt <hey@jancborchardt.net>
+ * @author Kate Döen <kate.doeen@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Controller;
+
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http\Attribute\OpenAPI;
+use OCP\AppFramework\Http\DataDisplayResponse;
+
+#[OpenAPI(scope: OpenAPI::SCOPE_IGNORE)]
+class ReasonsController extends Controller {
+
+	/**
+	 * @NoCSRFRequired
+	 * @NoAdminRequired
+	 * @NoSubAdminRequired
+	 */
+	public function getPdf() {
+		$data = file_get_contents(__DIR__ . '/../../data/Reasons to use Nextcloud.pdf');
+
+		$resp = new DataDisplayResponse($data);
+		$resp->addHeader('Content-Type', 'application/pdf');
+
+		return $resp;
+	}
+}

wedding-pics/apps/settings/lib/Controller/TwoFactorSettingsController.php

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright 2018 Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Controller;
+
+use OC\Authentication\TwoFactorAuth\EnforcementState;
+use OC\Authentication\TwoFactorAuth\MandatoryTwoFactor;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http\JSONResponse;
+use OCP\IRequest;
+
+class TwoFactorSettingsController extends Controller {
+
+	/** @var MandatoryTwoFactor */
+	private $mandatoryTwoFactor;
+
+	public function __construct(string $appName,
+		IRequest $request,
+		MandatoryTwoFactor $mandatoryTwoFactor) {
+		parent::__construct($appName, $request);
+
+		$this->mandatoryTwoFactor = $mandatoryTwoFactor;
+	}
+
+	public function index(): JSONResponse {
+		return new JSONResponse($this->mandatoryTwoFactor->getState());
+	}
+
+	public function update(bool $enforced, array $enforcedGroups = [], array $excludedGroups = []): JSONResponse {
+		$this->mandatoryTwoFactor->setState(
+			new EnforcementState($enforced, $enforcedGroups, $excludedGroups)
+		);
+
+		return new JSONResponse($this->mandatoryTwoFactor->getState());
+	}
+}

wedding-pics/apps/settings/lib/Controller/UsersController.php

@@ -0,0 +1,604 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Bjoern Schiessle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Daniel Calviño Sánchez <danxuliu@gmail.com>
+ * @author Daniel Kesselberg <mail@danielkesselberg.de>
+ * @author GretaD <gretadoci@gmail.com>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author John Molakvoæ <skjnldsv@protonmail.com>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ * @author Vincent Petry <vincent@nextcloud.com>
+ * @author Kate Döen <kate.doeen@nextcloud.com>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+// FIXME: disabled for now to be able to inject IGroupManager and also use
+// getSubAdmin()
+
+namespace OCA\Settings\Controller;
+
+use InvalidArgumentException;
+use OC\AppFramework\Http;
+use OC\Encryption\Exceptions\ModuleDoesNotExistsException;
+use OC\ForbiddenException;
+use OC\Group\Manager as GroupManager;
+use OC\KnownUser\KnownUserService;
+use OC\L10N\Factory;
+use OC\Security\IdentityProof\Manager;
+use OC\User\Manager as UserManager;
+use OCA\Settings\BackgroundJobs\VerifyUserData;
+use OCA\Settings\Events\BeforeTemplateRenderedEvent;
+use OCA\User_LDAP\User_Proxy;
+use OCP\Accounts\IAccount;
+use OCP\Accounts\IAccountManager;
+use OCP\Accounts\PropertyDoesNotExistException;
+use OCP\App\IAppManager;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http\Attribute\OpenAPI;
+use OCP\AppFramework\Http\DataResponse;
+use OCP\AppFramework\Http\JSONResponse;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\BackgroundJob\IJobList;
+use OCP\Encryption\IManager;
+use OCP\EventDispatcher\IEventDispatcher;
+use OCP\IConfig;
+use OCP\IGroupManager;
+use OCP\IL10N;
+use OCP\IRequest;
+use OCP\IUser;
+use OCP\IUserManager;
+use OCP\IUserSession;
+use OCP\L10N\IFactory;
+use OCP\Mail\IMailer;
+use function in_array;
+
+#[OpenAPI(scope: OpenAPI::SCOPE_IGNORE)]
+class UsersController extends Controller {
+	/** @var UserManager */
+	private $userManager;
+	/** @var GroupManager */
+	private $groupManager;
+	/** @var IUserSession */
+	private $userSession;
+	/** @var IConfig */
+	private $config;
+	/** @var bool */
+	private $isAdmin;
+	/** @var IL10N */
+	private $l10n;
+	/** @var IMailer */
+	private $mailer;
+	/** @var Factory */
+	private $l10nFactory;
+	/** @var IAppManager */
+	private $appManager;
+	/** @var IAccountManager */
+	private $accountManager;
+	/** @var Manager */
+	private $keyManager;
+	/** @var IJobList */
+	private $jobList;
+	/** @var IManager */
+	private $encryptionManager;
+	/** @var KnownUserService */
+	private $knownUserService;
+	/** @var IEventDispatcher */
+	private $dispatcher;
+
+
+	public function __construct(
+		string $appName,
+		IRequest $request,
+		IUserManager $userManager,
+		IGroupManager $groupManager,
+		IUserSession $userSession,
+		IConfig $config,
+		bool $isAdmin,
+		IL10N $l10n,
+		IMailer $mailer,
+		IFactory $l10nFactory,
+		IAppManager $appManager,
+		IAccountManager $accountManager,
+		Manager $keyManager,
+		IJobList $jobList,
+		IManager $encryptionManager,
+		KnownUserService $knownUserService,
+		IEventDispatcher $dispatcher
+	) {
+		parent::__construct($appName, $request);
+		$this->userManager = $userManager;
+		$this->groupManager = $groupManager;
+		$this->userSession = $userSession;
+		$this->config = $config;
+		$this->isAdmin = $isAdmin;
+		$this->l10n = $l10n;
+		$this->mailer = $mailer;
+		$this->l10nFactory = $l10nFactory;
+		$this->appManager = $appManager;
+		$this->accountManager = $accountManager;
+		$this->keyManager = $keyManager;
+		$this->jobList = $jobList;
+		$this->encryptionManager = $encryptionManager;
+		$this->knownUserService = $knownUserService;
+		$this->dispatcher = $dispatcher;
+	}
+
+
+	/**
+	 * @NoCSRFRequired
+	 * @NoAdminRequired
+	 *
+	 * Display users list template
+	 *
+	 * @return TemplateResponse
+	 */
+	public function usersListByGroup(): TemplateResponse {
+		return $this->usersList();
+	}
+
+	/**
+	 * @NoCSRFRequired
+	 * @NoAdminRequired
+	 *
+	 * Display users list template
+	 *
+	 * @return TemplateResponse
+	 */
+	public function usersList(): TemplateResponse {
+		$user = $this->userSession->getUser();
+		$uid = $user->getUID();
+
+		\OC::$server->getNavigationManager()->setActiveEntry('core_users');
+
+		/* SORT OPTION: SORT_USERCOUNT or SORT_GROUPNAME */
+		$sortGroupsBy = \OC\Group\MetaData::SORT_USERCOUNT;
+		$isLDAPUsed = false;
+		if ($this->config->getSystemValue('sort_groups_by_name', false)) {
+			$sortGroupsBy = \OC\Group\MetaData::SORT_GROUPNAME;
+		} else {
+			if ($this->appManager->isEnabledForUser('user_ldap')) {
+				$isLDAPUsed =
+					$this->groupManager->isBackendUsed('\OCA\User_LDAP\Group_Proxy');
+				if ($isLDAPUsed) {
+					// LDAP user count can be slow, so we sort by group name here
+					$sortGroupsBy = \OC\Group\MetaData::SORT_GROUPNAME;
+				}
+			}
+		}
+
+		$canChangePassword = $this->canAdminChangeUserPasswords();
+
+		/* GROUPS */
+		$groupsInfo = new \OC\Group\MetaData(
+			$uid,
+			$this->isAdmin,
+			$this->groupManager,
+			$this->userSession
+		);
+
+		$groupsInfo->setSorting($sortGroupsBy);
+		[$adminGroup, $groups] = $groupsInfo->get();
+
+		if (!$isLDAPUsed && $this->appManager->isEnabledForUser('user_ldap')) {
+			$isLDAPUsed = (bool)array_reduce($this->userManager->getBackends(), function ($ldapFound, $backend) {
+				return $ldapFound || $backend instanceof User_Proxy;
+			});
+		}
+
+		$disabledUsers = -1;
+		$userCount = 0;
+
+		if (!$isLDAPUsed) {
+			if ($this->isAdmin) {
+				$disabledUsers = $this->userManager->countDisabledUsers();
+				$userCount = array_reduce($this->userManager->countUsers(), function ($v, $w) {
+					return $v + (int)$w;
+				}, 0);
+			} else {
+				// User is subadmin !
+				// Map group list to names to retrieve the countDisabledUsersOfGroups
+				$userGroups = $this->groupManager->getUserGroups($user);
+				$groupsNames = [];
+
+				foreach ($groups as $key => $group) {
+					// $userCount += (int)$group['usercount'];
+					$groupsNames[] = $group['name'];
+					// we prevent subadmins from looking up themselves
+					// so we lower the count of the groups he belongs to
+					if (array_key_exists($group['id'], $userGroups)) {
+						$groups[$key]['usercount']--;
+						$userCount -= 1; // we also lower from one the total count
+					}
+				}
+				$userCount += $this->userManager->countUsersOfGroups($groupsInfo->getGroups());
+				$disabledUsers = $this->userManager->countDisabledUsersOfGroups($groupsNames);
+			}
+
+			$userCount -= $disabledUsers;
+		}
+
+		$disabledUsersGroup = [
+			'id' => 'disabled',
+			'name' => 'Disabled users',
+			'usercount' => $disabledUsers
+		];
+
+		/* QUOTAS PRESETS */
+		$quotaPreset = $this->parseQuotaPreset($this->config->getAppValue('files', 'quota_preset', '1 GB, 5 GB, 10 GB'));
+		$allowUnlimitedQuota = $this->config->getAppValue('files', 'allow_unlimited_quota', '1') === '1';
+		if (!$allowUnlimitedQuota && count($quotaPreset) > 0) {
+			$defaultQuota = $this->config->getAppValue('files', 'default_quota', $quotaPreset[0]);
+		} else {
+			$defaultQuota = $this->config->getAppValue('files', 'default_quota', 'none');
+		}
+
+		$event = new BeforeTemplateRenderedEvent();
+		$this->dispatcher->dispatch('OC\Settings\Users::loadAdditionalScripts', $event);
+		$this->dispatcher->dispatchTyped($event);
+
+		/* LANGUAGES */
+		$languages = $this->l10nFactory->getLanguages();
+
+		/* FINAL DATA */
+		$serverData = [];
+		// groups
+		$serverData['groups'] = array_merge_recursive($adminGroup, [$disabledUsersGroup], $groups);
+		// Various data
+		$serverData['isAdmin'] = $this->isAdmin;
+		$serverData['sortGroups'] = $sortGroupsBy;
+		$serverData['quotaPreset'] = $quotaPreset;
+		$serverData['allowUnlimitedQuota'] = $allowUnlimitedQuota;
+		$serverData['userCount'] = $userCount;
+		$serverData['languages'] = $languages;
+		$serverData['defaultLanguage'] = $this->config->getSystemValue('default_language', 'en');
+		$serverData['forceLanguage'] = $this->config->getSystemValue('force_language', false);
+		// Settings
+		$serverData['defaultQuota'] = $defaultQuota;
+		$serverData['canChangePassword'] = $canChangePassword;
+		$serverData['newUserGenerateUserID'] = $this->config->getAppValue('core', 'newUser.generateUserID', 'no') === 'yes';
+		$serverData['newUserRequireEmail'] = $this->config->getAppValue('core', 'newUser.requireEmail', 'no') === 'yes';
+		$serverData['newUserSendEmail'] = $this->config->getAppValue('core', 'newUser.sendEmail', 'yes') === 'yes';
+
+		return new TemplateResponse('settings', 'settings-vue', ['serverData' => $serverData, 'pageTitle' => $this->l10n->t('Users')]);
+	}
+
+	/**
+	 * @param string $key
+	 * @param string $value
+	 *
+	 * @return JSONResponse
+	 */
+	public function setPreference(string $key, string $value): JSONResponse {
+		$allowed = ['newUser.sendEmail'];
+		if (!in_array($key, $allowed, true)) {
+			return new JSONResponse([], Http::STATUS_FORBIDDEN);
+		}
+
+		$this->config->setAppValue('core', $key, $value);
+
+		return new JSONResponse([]);
+	}
+
+	/**
+	 * Parse the app value for quota_present
+	 *
+	 * @param string $quotaPreset
+	 * @return array
+	 */
+	protected function parseQuotaPreset(string $quotaPreset): array {
+		// 1 GB, 5 GB, 10 GB => [1 GB, 5 GB, 10 GB]
+		$presets = array_filter(array_map('trim', explode(',', $quotaPreset)));
+		// Drop default and none, Make array indexes numerically
+		return array_values(array_diff($presets, ['default', 'none']));
+	}
+
+	/**
+	 * check if the admin can change the users password
+	 *
+	 * The admin can change the passwords if:
+	 *
+	 *   - no encryption module is loaded and encryption is disabled
+	 *   - encryption module is loaded but it doesn't require per user keys
+	 *
+	 * The admin can not change the passwords if:
+	 *
+	 *   - an encryption module is loaded and it uses per-user keys
+	 *   - encryption is enabled but no encryption modules are loaded
+	 *
+	 * @return bool
+	 */
+	protected function canAdminChangeUserPasswords(): bool {
+		$isEncryptionEnabled = $this->encryptionManager->isEnabled();
+		try {
+			$noUserSpecificEncryptionKeys = !$this->encryptionManager->getEncryptionModule()->needDetailedAccessList();
+			$isEncryptionModuleLoaded = true;
+		} catch (ModuleDoesNotExistsException $e) {
+			$noUserSpecificEncryptionKeys = true;
+			$isEncryptionModuleLoaded = false;
+		}
+		$canChangePassword = ($isEncryptionModuleLoaded && $noUserSpecificEncryptionKeys)
+			|| (!$isEncryptionModuleLoaded && !$isEncryptionEnabled);
+
+		return $canChangePassword;
+	}
+
+	/**
+	 * @NoAdminRequired
+	 * @NoSubAdminRequired
+	 * @PasswordConfirmationRequired
+	 *
+	 * @param string|null $avatarScope
+	 * @param string|null $displayname
+	 * @param string|null $displaynameScope
+	 * @param string|null $phone
+	 * @param string|null $phoneScope
+	 * @param string|null $email
+	 * @param string|null $emailScope
+	 * @param string|null $website
+	 * @param string|null $websiteScope
+	 * @param string|null $address
+	 * @param string|null $addressScope
+	 * @param string|null $twitter
+	 * @param string|null $twitterScope
+	 * @param string|null $fediverse
+	 * @param string|null $fediverseScope
+	 *
+	 * @return DataResponse
+	 */
+	public function setUserSettings(?string $avatarScope = null,
+		?string $displayname = null,
+		?string $displaynameScope = null,
+		?string $phone = null,
+		?string $phoneScope = null,
+		?string $email = null,
+		?string $emailScope = null,
+		?string $website = null,
+		?string $websiteScope = null,
+		?string $address = null,
+		?string $addressScope = null,
+		?string $twitter = null,
+		?string $twitterScope = null,
+		?string $fediverse = null,
+		?string $fediverseScope = null
+	) {
+		$user = $this->userSession->getUser();
+		if (!$user instanceof IUser) {
+			return new DataResponse(
+				[
+					'status' => 'error',
+					'data' => [
+						'message' => $this->l10n->t('Invalid user')
+					]
+				],
+				Http::STATUS_UNAUTHORIZED
+			);
+		}
+
+		$email = !is_null($email) ? strtolower($email) : $email;
+		if (!empty($email) && !$this->mailer->validateMailAddress($email)) {
+			return new DataResponse(
+				[
+					'status' => 'error',
+					'data' => [
+						'message' => $this->l10n->t('Invalid mail address')
+					]
+				],
+				Http::STATUS_UNPROCESSABLE_ENTITY
+			);
+		}
+
+		$userAccount = $this->accountManager->getAccount($user);
+		$oldPhoneValue = $userAccount->getProperty(IAccountManager::PROPERTY_PHONE)->getValue();
+
+		$updatable = [
+			IAccountManager::PROPERTY_AVATAR => ['value' => null, 'scope' => $avatarScope],
+			IAccountManager::PROPERTY_DISPLAYNAME => ['value' => $displayname, 'scope' => $displaynameScope],
+			IAccountManager::PROPERTY_EMAIL => ['value' => $email, 'scope' => $emailScope],
+			IAccountManager::PROPERTY_WEBSITE => ['value' => $website, 'scope' => $websiteScope],
+			IAccountManager::PROPERTY_ADDRESS => ['value' => $address, 'scope' => $addressScope],
+			IAccountManager::PROPERTY_PHONE => ['value' => $phone, 'scope' => $phoneScope],
+			IAccountManager::PROPERTY_TWITTER => ['value' => $twitter, 'scope' => $twitterScope],
+			IAccountManager::PROPERTY_FEDIVERSE => ['value' => $fediverse, 'scope' => $fediverseScope],
+		];
+		$allowUserToChangeDisplayName = $this->config->getSystemValueBool('allow_user_to_change_display_name', true);
+		foreach ($updatable as $property => $data) {
+			if ($allowUserToChangeDisplayName === false
+				&& in_array($property, [IAccountManager::PROPERTY_DISPLAYNAME, IAccountManager::PROPERTY_EMAIL], true)) {
+				continue;
+			}
+			$property = $userAccount->getProperty($property);
+			if (null !== $data['value']) {
+				$property->setValue($data['value']);
+			}
+			if (null !== $data['scope']) {
+				$property->setScope($data['scope']);
+			}
+		}
+
+		try {
+			$this->saveUserSettings($userAccount);
+			if ($oldPhoneValue !== $userAccount->getProperty(IAccountManager::PROPERTY_PHONE)->getValue()) {
+				$this->knownUserService->deleteByContactUserId($user->getUID());
+			}
+			return new DataResponse(
+				[
+					'status' => 'success',
+					'data' => [
+						'userId' => $user->getUID(),
+						'avatarScope' => $userAccount->getProperty(IAccountManager::PROPERTY_AVATAR)->getScope(),
+						'displayname' => $userAccount->getProperty(IAccountManager::PROPERTY_DISPLAYNAME)->getValue(),
+						'displaynameScope' => $userAccount->getProperty(IAccountManager::PROPERTY_DISPLAYNAME)->getScope(),
+						'phone' => $userAccount->getProperty(IAccountManager::PROPERTY_PHONE)->getValue(),
+						'phoneScope' => $userAccount->getProperty(IAccountManager::PROPERTY_PHONE)->getScope(),
+						'email' => $userAccount->getProperty(IAccountManager::PROPERTY_EMAIL)->getValue(),
+						'emailScope' => $userAccount->getProperty(IAccountManager::PROPERTY_EMAIL)->getScope(),
+						'website' => $userAccount->getProperty(IAccountManager::PROPERTY_WEBSITE)->getValue(),
+						'websiteScope' => $userAccount->getProperty(IAccountManager::PROPERTY_WEBSITE)->getScope(),
+						'address' => $userAccount->getProperty(IAccountManager::PROPERTY_ADDRESS)->getValue(),
+						'addressScope' => $userAccount->getProperty(IAccountManager::PROPERTY_ADDRESS)->getScope(),
+						'twitter' => $userAccount->getProperty(IAccountManager::PROPERTY_TWITTER)->getValue(),
+						'twitterScope' => $userAccount->getProperty(IAccountManager::PROPERTY_TWITTER)->getScope(),
+						'fediverse' => $userAccount->getProperty(IAccountManager::PROPERTY_FEDIVERSE)->getValue(),
+						'fediverseScope' => $userAccount->getProperty(IAccountManager::PROPERTY_FEDIVERSE)->getScope(),
+						'message' => $this->l10n->t('Settings saved'),
+					],
+				],
+				Http::STATUS_OK
+			);
+		} catch (ForbiddenException | InvalidArgumentException | PropertyDoesNotExistException $e) {
+			return new DataResponse([
+				'status' => 'error',
+				'data' => [
+					'message' => $e->getMessage()
+				],
+			]);
+		}
+	}
+	/**
+	 * update account manager with new user data
+	 *
+	 * @throws ForbiddenException
+	 * @throws InvalidArgumentException
+	 */
+	protected function saveUserSettings(IAccount $userAccount): void {
+		// keep the user back-end up-to-date with the latest display name and email
+		// address
+		$oldDisplayName = $userAccount->getUser()->getDisplayName();
+		if ($oldDisplayName !== $userAccount->getProperty(IAccountManager::PROPERTY_DISPLAYNAME)->getValue()) {
+			$result = $userAccount->getUser()->setDisplayName($userAccount->getProperty(IAccountManager::PROPERTY_DISPLAYNAME)->getValue());
+			if ($result === false) {
+				throw new ForbiddenException($this->l10n->t('Unable to change full name'));
+			}
+		}
+
+		$oldEmailAddress = $userAccount->getUser()->getSystemEMailAddress();
+		$oldEmailAddress = strtolower((string)$oldEmailAddress);
+		if ($oldEmailAddress !== strtolower($userAccount->getProperty(IAccountManager::PROPERTY_EMAIL)->getValue())) {
+			// this is the only permission a backend provides and is also used
+			// for the permission of setting a email address
+			if (!$userAccount->getUser()->canChangeDisplayName()) {
+				throw new ForbiddenException($this->l10n->t('Unable to change email address'));
+			}
+			$userAccount->getUser()->setSystemEMailAddress($userAccount->getProperty(IAccountManager::PROPERTY_EMAIL)->getValue());
+		}
+
+		try {
+			$this->accountManager->updateAccount($userAccount);
+		} catch (InvalidArgumentException $e) {
+			if ($e->getMessage() === IAccountManager::PROPERTY_PHONE) {
+				throw new InvalidArgumentException($this->l10n->t('Unable to set invalid phone number'));
+			}
+			if ($e->getMessage() === IAccountManager::PROPERTY_WEBSITE) {
+				throw new InvalidArgumentException($this->l10n->t('Unable to set invalid website'));
+			}
+			throw new InvalidArgumentException($this->l10n->t('Some account data was invalid'));
+		}
+	}
+
+	/**
+	 * Set the mail address of a user
+	 *
+	 * @NoAdminRequired
+	 * @NoSubAdminRequired
+	 * @PasswordConfirmationRequired
+	 *
+	 * @param string $account
+	 * @param bool $onlyVerificationCode only return verification code without updating the data
+	 * @return DataResponse
+	 */
+	public function getVerificationCode(string $account, bool $onlyVerificationCode): DataResponse {
+		$user = $this->userSession->getUser();
+
+		if ($user === null) {
+			return new DataResponse([], Http::STATUS_BAD_REQUEST);
+		}
+
+		$userAccount = $this->accountManager->getAccount($user);
+		$cloudId = $user->getCloudId();
+		$message = 'Use my Federated Cloud ID to share with me: ' . $cloudId;
+		$signature = $this->signMessage($user, $message);
+
+		$code = $message . ' ' . $signature;
+		$codeMd5 = $message . ' ' . md5($signature);
+
+		switch ($account) {
+			case 'verify-twitter':
+				$msg = $this->l10n->t('In order to verify your Twitter account, post the following tweet on Twitter (please make sure to post it without any line breaks):');
+				$code = $codeMd5;
+				$type = IAccountManager::PROPERTY_TWITTER;
+				break;
+			case 'verify-website':
+				$msg = $this->l10n->t('In order to verify your Website, store the following content in your web-root at \'.well-known/CloudIdVerificationCode.txt\' (please make sure that the complete text is in one line):');
+				$type = IAccountManager::PROPERTY_WEBSITE;
+				break;
+			default:
+				return new DataResponse([], Http::STATUS_BAD_REQUEST);
+		}
+
+		$userProperty = $userAccount->getProperty($type);
+		$userProperty
+			->setVerified(IAccountManager::VERIFICATION_IN_PROGRESS)
+			->setVerificationData($signature);
+
+		if ($onlyVerificationCode === false) {
+			$this->accountManager->updateAccount($userAccount);
+
+			$this->jobList->add(VerifyUserData::class,
+				[
+					'verificationCode' => $code,
+					'data' => $userProperty->getValue(),
+					'type' => $type,
+					'uid' => $user->getUID(),
+					'try' => 0,
+					'lastRun' => $this->getCurrentTime()
+				]
+			);
+		}
+
+		return new DataResponse(['msg' => $msg, 'code' => $code]);
+	}
+
+	/**
+	 * get current timestamp
+	 *
+	 * @return int
+	 */
+	protected function getCurrentTime(): int {
+		return time();
+	}
+
+	/**
+	 * sign message with users private key
+	 *
+	 * @param IUser $user
+	 * @param string $message
+	 *
+	 * @return string base64 encoded signature
+	 */
+	protected function signMessage(IUser $user, string $message): string {
+		$privateKey = $this->keyManager->getKey($user)->getPrivate();
+		openssl_sign(json_encode($message), $signature, $privateKey, OPENSSL_ALGO_SHA512);
+		return base64_encode($signature);
+	}
+}

wedding-pics/apps/settings/lib/Controller/WebAuthnController.php

@@ -0,0 +1,108 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020, Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ * @author Kate Döen <kate.doeen@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Controller;
+
+use OC\Authentication\WebAuthn\Manager;
+use OCA\Settings\AppInfo\Application;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\OpenAPI;
+use OCP\AppFramework\Http\JSONResponse;
+use OCP\IRequest;
+use OCP\ISession;
+use OCP\IUserSession;
+use Psr\Log\LoggerInterface;
+use Webauthn\PublicKeyCredentialCreationOptions;
+
+#[OpenAPI(scope: OpenAPI::SCOPE_IGNORE)]
+class WebAuthnController extends Controller {
+	private const WEBAUTHN_REGISTRATION = 'webauthn_registration';
+
+	public function __construct(
+		IRequest $request,
+		private LoggerInterface $logger,
+		private Manager $manager,
+		private IUserSession $userSession,
+		private ISession $session,
+	) {
+		parent::__construct(Application::APP_ID, $request);
+	}
+
+	/**
+	 * @NoAdminRequired
+	 * @NoSubAdminRequired
+	 * @PasswordConfirmationRequired
+	 * @UseSession
+	 * @NoCSRFRequired
+	 */
+	public function startRegistration(): JSONResponse {
+		$this->logger->debug('Starting WebAuthn registration');
+
+		$credentialOptions = $this->manager->startRegistration($this->userSession->getUser(), $this->request->getServerHost());
+
+		// Set this in the session since we need it on finish
+		$this->session->set(self::WEBAUTHN_REGISTRATION, $credentialOptions);
+
+		return new JSONResponse($credentialOptions);
+	}
+
+	/**
+	 * @NoAdminRequired
+	 * @NoSubAdminRequired
+	 * @PasswordConfirmationRequired
+	 * @UseSession
+	 */
+	public function finishRegistration(string $name, string $data): JSONResponse {
+		$this->logger->debug('Finishing WebAuthn registration');
+
+		if (!$this->session->exists(self::WEBAUTHN_REGISTRATION)) {
+			$this->logger->debug('Trying to finish WebAuthn registration without session data');
+			return new JSONResponse([], Http::STATUS_BAD_REQUEST);
+		}
+
+		// Obtain the publicKeyCredentialOptions from when we started the registration
+		$publicKeyCredentialCreationOptions = PublicKeyCredentialCreationOptions::createFromArray($this->session->get(self::WEBAUTHN_REGISTRATION));
+
+		$this->session->remove(self::WEBAUTHN_REGISTRATION);
+
+		return new JSONResponse($this->manager->finishRegister($publicKeyCredentialCreationOptions, $name, $data));
+	}
+
+	/**
+	 * @NoAdminRequired
+	 * @NoSubAdminRequired
+	 * @PasswordConfirmationRequired
+	 */
+	public function deleteRegistration(int $id): JSONResponse {
+		$this->logger->debug('Finishing WebAuthn registration');
+
+		$this->manager->deleteRegistration($this->userSession->getUser(), $id);
+
+		return new JSONResponse([]);
+	}
+}

wedding-pics/apps/settings/lib/Events/BeforeTemplateRenderedEvent.php

@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Events;
+
+use OCP\EventDispatcher\Event;
+
+/**
+ * This event is triggered right before the user management template is rendered.
+ *
+ * @since 20.0.0
+ */
+class BeforeTemplateRenderedEvent extends Event {
+}

wedding-pics/apps/settings/lib/Hooks.php

@@ -0,0 +1,225 @@
+<?php
+/**
+ * @copyright Copyright (c) 2017 Joas Schilling <coding@schilljs.com>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Thomas Citharel <nextcloud@tcit.fr>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings;
+
+use OCA\Settings\Activity\Provider;
+use OCP\Activity\IManager as IActivityManager;
+use OCP\Defaults;
+use OCP\IConfig;
+use OCP\IGroupManager;
+use OCP\IURLGenerator;
+use OCP\IUser;
+use OCP\IUserManager;
+use OCP\IUserSession;
+use OCP\L10N\IFactory;
+use OCP\Mail\IMailer;
+
+class Hooks {
+
+	/** @var IActivityManager */
+	protected $activityManager;
+	/** @var IGroupManager|\OC\Group\Manager */
+	protected $groupManager;
+	/** @var IUserManager */
+	protected $userManager;
+	/** @var IUserSession */
+	protected $userSession;
+	/** @var IURLGenerator */
+	protected $urlGenerator;
+	/** @var IMailer */
+	protected $mailer;
+	/** @var IConfig */
+	protected $config;
+	/** @var IFactory */
+	protected $languageFactory;
+	/** @var Defaults */
+	protected $defaults;
+
+	public function __construct(IActivityManager $activityManager,
+		IGroupManager $groupManager,
+		IUserManager $userManager,
+		IUserSession $userSession,
+		IURLGenerator $urlGenerator,
+		IMailer $mailer,
+		IConfig $config,
+		IFactory $languageFactory,
+		Defaults $defaults) {
+		$this->activityManager = $activityManager;
+		$this->groupManager = $groupManager;
+		$this->userManager = $userManager;
+		$this->userSession = $userSession;
+		$this->urlGenerator = $urlGenerator;
+		$this->mailer = $mailer;
+		$this->config = $config;
+		$this->languageFactory = $languageFactory;
+		$this->defaults = $defaults;
+	}
+
+	/**
+	 * @param string $uid
+	 * @throws \InvalidArgumentException
+	 * @throws \BadMethodCallException
+	 * @throws \Exception
+	 */
+	public function onChangePassword($uid) {
+		$user = $this->userManager->get($uid);
+
+		if (!$user instanceof IUser || $user->getLastLogin() === 0) {
+			// User didn't login, so don't create activities and emails.
+			return;
+		}
+
+		$event = $this->activityManager->generateEvent();
+		$event->setApp('settings')
+			->setType('personal_settings')
+			->setAffectedUser($user->getUID());
+
+		$instanceName = $this->defaults->getName();
+		$instanceUrl = $this->urlGenerator->getAbsoluteURL('/');
+		$language = $this->languageFactory->getUserLanguage($user);
+		$l = $this->languageFactory->get('settings', $language);
+
+		$actor = $this->userSession->getUser();
+		if ($actor instanceof IUser) {
+			if ($actor->getUID() !== $user->getUID()) {
+				// Admin changed the password through the user panel
+				$text = $l->t('%1$s changed your password on %2$s.', [$actor->getDisplayName(), $instanceUrl]);
+				$event->setAuthor($actor->getUID())
+					->setSubject(Provider::PASSWORD_CHANGED_BY, [$actor->getUID()]);
+			} else {
+				// User changed their password themselves through settings
+				$text = $l->t('Your password on %s was changed.', [$instanceUrl]);
+				$event->setAuthor($actor->getUID())
+					->setSubject(Provider::PASSWORD_CHANGED_SELF);
+			}
+		} else {
+			if (\OC::$CLI) {
+				// Admin used occ to reset the password
+				$text = $l->t('Your password on %s was reset by an administrator.', [$instanceUrl]);
+				$event->setSubject(Provider::PASSWORD_RESET);
+			} else {
+				// User reset their password from Lost page
+				$text = $l->t('Your password on %s was reset.', [$instanceUrl]);
+				$event->setSubject(Provider::PASSWORD_RESET_SELF);
+			}
+		}
+
+		$this->activityManager->publish($event);
+
+		if ($user->getEMailAddress() !== null) {
+			$template = $this->mailer->createEMailTemplate('settings.PasswordChanged', [
+				'displayname' => $user->getDisplayName(),
+				'emailAddress' => $user->getEMailAddress(),
+				'instanceUrl' => $instanceUrl,
+			]);
+
+			$template->setSubject($l->t('Password for %1$s changed on %2$s', [$user->getDisplayName(), $instanceName]));
+			$template->addHeader();
+			$template->addHeading($l->t('Password changed for %s', [$user->getDisplayName()]), false);
+			$template->addBodyText($text . ' ' . $l->t('If you did not request this, please contact an administrator.'));
+			$template->addFooter();
+
+
+			$message = $this->mailer->createMessage();
+			$message->setTo([$user->getEMailAddress() => $user->getDisplayName()]);
+			$message->useTemplate($template);
+			$this->mailer->send($message);
+		}
+	}
+
+	/**
+	 * @param IUser $user
+	 * @param string|null $oldMailAddress
+	 * @throws \InvalidArgumentException
+	 * @throws \BadMethodCallException
+	 */
+	public function onChangeEmail(IUser $user, $oldMailAddress) {
+		if ($oldMailAddress === $user->getEMailAddress() ||
+			$user->getLastLogin() === 0) {
+			// Email didn't really change or user didn't login,
+			// so don't create activities and emails.
+			return;
+		}
+
+		$event = $this->activityManager->generateEvent();
+		$event->setApp('settings')
+			->setType('personal_settings')
+			->setAffectedUser($user->getUID());
+
+		$instanceUrl = $this->urlGenerator->getAbsoluteURL('/');
+		$language = $this->languageFactory->getUserLanguage($user);
+		$l = $this->languageFactory->get('settings', $language);
+
+		$actor = $this->userSession->getUser();
+		if ($actor instanceof IUser) {
+			$subject = Provider::EMAIL_CHANGED_SELF;
+			if ($actor->getUID() !== $user->getUID()) {
+				// set via the OCS API
+				if ($this->config->getAppValue('settings', 'disable_activity.email_address_changed_by_admin', 'no') === 'yes') {
+					return;
+				}
+				$subject = Provider::EMAIL_CHANGED;
+			}
+			$text = $l->t('Your email address on %s was changed.', [$instanceUrl]);
+			$event->setAuthor($actor->getUID())
+				->setSubject($subject);
+		} else {
+			// set with occ
+			if ($this->config->getAppValue('settings', 'disable_activity.email_address_changed_by_admin', 'no') === 'yes') {
+				return;
+			}
+			$text = $l->t('Your email address on %s was changed by an administrator.', [$instanceUrl]);
+			$event->setSubject(Provider::EMAIL_CHANGED);
+		}
+		$this->activityManager->publish($event);
+
+
+		if ($oldMailAddress !== null) {
+			$template = $this->mailer->createEMailTemplate('settings.EmailChanged', [
+				'displayname' => $user->getDisplayName(),
+				'newEMailAddress' => $user->getEMailAddress(),
+				'oldEMailAddress' => $oldMailAddress,
+				'instanceUrl' => $instanceUrl,
+			]);
+
+			$template->setSubject($l->t('Email address for %1$s changed on %2$s', [$user->getDisplayName(), $instanceUrl]));
+			$template->addHeader();
+			$template->addHeading($l->t('Email address changed for %s', [$user->getDisplayName()]), false);
+			$template->addBodyText($text . ' ' . $l->t('If you did not request this, please contact an administrator.'));
+			if ($user->getEMailAddress()) {
+				$template->addBodyText($l->t('The new email address is %s', [$user->getEMailAddress()]));
+			}
+			$template->addFooter();
+
+
+			$message = $this->mailer->createMessage();
+			$message->setTo([$oldMailAddress => $user->getDisplayName()]);
+			$message->useTemplate($template);
+			$this->mailer->send($message);
+		}
+	}
+}

wedding-pics/apps/settings/lib/Listener/AppPasswordCreatedActivityListener.php

@@ -0,0 +1,79 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright 2021 Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Listener;
+
+use BadMethodCallException;
+use OC\Authentication\Events\AppPasswordCreatedEvent;
+use OCA\Settings\Activity\Provider;
+use OCP\Activity\IManager as IActivityManager;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use OCP\IUserSession;
+use Psr\Log\LoggerInterface;
+
+/**
+ * @template-implements IEventListener<\OC\Authentication\Events\AppPasswordCreatedEvent>
+ */
+class AppPasswordCreatedActivityListener implements IEventListener {
+	/** @var IActivityManager */
+	private $activityManager;
+
+	/** @var IUserSession */
+	private $userSession;
+
+	/** @var LoggerInterface */
+	private $logger;
+
+	public function __construct(IActivityManager $activityManager,
+		IUserSession $userSession,
+		LoggerInterface $logger) {
+		$this->activityManager = $activityManager;
+		$this->userSession = $userSession;
+		$this->logger = $logger;
+	}
+
+	public function handle(Event $event): void {
+		if (!($event instanceof AppPasswordCreatedEvent)) {
+			return;
+		}
+
+		$activity = $this->activityManager->generateEvent();
+		$activity->setApp('settings')
+			->setType('security')
+			->setAffectedUser($event->getToken()->getUID())
+			->setAuthor($this->userSession->getUser() ? $this->userSession->getUser()->getUID() : '')
+			->setSubject(Provider::APP_TOKEN_CREATED, ['name' => $event->getToken()->getName()])
+			->setObject('app_token', $event->getToken()->getId());
+
+		try {
+			$this->activityManager->publish($activity);
+		} catch (BadMethodCallException $e) {
+			$this->logger->warning('Could not publish activity: ' . $e->getMessage(), [
+				'exception' => $e
+			]);
+		}
+	}
+}

wedding-pics/apps/settings/lib/Listener/GroupRemovedListener.php

@@ -0,0 +1,51 @@
+<?php
+/**
+ * @copyright Copyright (c) 2021 Carl Schwan <carl@carlschwan.eu>
+ *
+ * @author Carl Schwan <carl@carlschwan.eu>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Settings\Listener;
+
+use OCA\Settings\Service\AuthorizedGroupService;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use OCP\Group\Events\GroupDeletedEvent;
+
+class GroupRemovedListener implements IEventListener {
+
+	/** @var AuthorizedGroupService $authorizedGroupService */
+	private $authorizedGroupService;
+
+	public function __construct(AuthorizedGroupService $authorizedGroupService) {
+		$this->authorizedGroupService = $authorizedGroupService;
+	}
+
+	/**
+	 * @inheritDoc
+	 */
+	public function handle(Event $event): void {
+		if (!($event instanceof GroupDeletedEvent)) {
+			return;
+		}
+
+		/** @var GroupDeletedEvent $event */
+		$this->authorizedGroupService->removeAuthorizationAssociatedTo($event->getGroup());
+	}
+}

wedding-pics/apps/settings/lib/Listener/UserAddedToGroupActivityListener.php

@@ -0,0 +1,95 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2021 Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Listener;
+
+use OC\Group\Manager;
+use OCA\Settings\Activity\GroupProvider;
+use OCP\Activity\IManager;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use OCP\Group\Events\UserAddedEvent;
+use OCP\IUser;
+use OCP\IUserSession;
+
+class UserAddedToGroupActivityListener implements IEventListener {
+
+	/** @var Manager */
+	private $groupManager;
+
+	/** @var IManager */
+	private $activityManager;
+
+	/** @var IUserSession */
+	private $userSession;
+
+	public function __construct(
+		Manager $groupManager,
+		IManager $activityManager,
+		IUserSession $userSession
+	) {
+		$this->groupManager = $groupManager;
+		$this->activityManager = $activityManager;
+		$this->userSession = $userSession;
+	}
+
+	public function handle(Event $event): void {
+		if (!($event instanceof UserAddedEvent)) {
+			return;
+		}
+
+		$user = $event->getUser();
+		$group = $event->getGroup();
+
+		$subAdminManager = $this->groupManager->getSubAdmin();
+		$usersToNotify = $subAdminManager->getGroupsSubAdmins($group);
+		$usersToNotify[] = $user;
+
+
+		$event = $this->activityManager->generateEvent();
+		$event->setApp('settings')
+			->setType('group_settings');
+
+		$actor = $this->userSession->getUser();
+		if ($actor instanceof IUser) {
+			$event->setAuthor($actor->getUID())
+				->setSubject(GroupProvider::ADDED_TO_GROUP, [
+					'user' => $user->getUID(),
+					'group' => $group->getGID(),
+					'actor' => $actor->getUID(),
+				]);
+		} else {
+			$event->setSubject(GroupProvider::ADDED_TO_GROUP, [
+				'user' => $user->getUID(),
+				'group' => $group->getGID(),
+			]);
+		}
+
+		foreach ($usersToNotify as $userToNotify) {
+			$event->setAffectedUser($userToNotify->getUID());
+			$this->activityManager->publish($event);
+		}
+	}
+}

wedding-pics/apps/settings/lib/Listener/UserRemovedFromGroupActivityListener.php

@@ -0,0 +1,95 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2021 Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Listener;
+
+use OC\Group\Manager;
+use OCA\Settings\Activity\GroupProvider;
+use OCP\Activity\IManager;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use OCP\Group\Events\UserRemovedEvent;
+use OCP\IUser;
+use OCP\IUserSession;
+
+class UserRemovedFromGroupActivityListener implements IEventListener {
+
+	/** @var Manager */
+	private $groupManager;
+
+	/** @var IManager */
+	private $activityManager;
+
+	/** @var IUserSession */
+	private $userSession;
+
+	public function __construct(
+		Manager $groupManager,
+		IManager $activityManager,
+		IUserSession $userSession
+	) {
+		$this->groupManager = $groupManager;
+		$this->activityManager = $activityManager;
+		$this->userSession = $userSession;
+	}
+
+	public function handle(Event $event): void {
+		if (!($event instanceof UserRemovedEvent)) {
+			return;
+		}
+
+		$user = $event->getUser();
+		$group = $event->getGroup();
+
+		$subAdminManager = $this->groupManager->getSubAdmin();
+		$usersToNotify = $subAdminManager->getGroupsSubAdmins($group);
+		$usersToNotify[] = $user;
+
+
+		$event = $this->activityManager->generateEvent();
+		$event->setApp('settings')
+			->setType('group_settings');
+
+		$actor = $this->userSession->getUser();
+		if ($actor instanceof IUser) {
+			$event->setAuthor($actor->getUID())
+				->setSubject(GroupProvider::REMOVED_FROM_GROUP, [
+					'user' => $user->getUID(),
+					'group' => $group->getGID(),
+					'actor' => $actor->getUID(),
+				]);
+		} else {
+			$event->setSubject(GroupProvider::REMOVED_FROM_GROUP, [
+				'user' => $user->getUID(),
+				'group' => $group->getGID(),
+			]);
+		}
+
+		foreach ($usersToNotify as $userToNotify) {
+			$event->setAffectedUser($userToNotify->getUID());
+			$this->activityManager->publish($event);
+		}
+	}
+}

wedding-pics/apps/settings/lib/Mailer/NewUserMailHelper.php

@@ -0,0 +1,188 @@
+<?php
+/**
+ * @copyright Copyright (c) 2017 Lukas Reschke <lukas@statuscode.ch>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Julius Härtl <jus@bitgrid.net>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ * @author zulan <git@zulan.net>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Mailer;
+
+use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\Defaults;
+use OCP\IConfig;
+use OCP\IURLGenerator;
+use OCP\IUser;
+use OCP\L10N\IFactory;
+use OCP\Mail\Headers\AutoSubmitted;
+use OCP\Mail\IEMailTemplate;
+use OCP\Mail\IMailer;
+use OCP\Security\ICrypto;
+use OCP\Security\ISecureRandom;
+
+class NewUserMailHelper {
+	/** @var Defaults */
+	private $themingDefaults;
+	/** @var IURLGenerator */
+	private $urlGenerator;
+	/** @var IFactory */
+	private $l10nFactory;
+	/** @var IMailer */
+	private $mailer;
+	/** @var ISecureRandom */
+	private $secureRandom;
+	/** @var ITimeFactory */
+	private $timeFactory;
+	/** @var IConfig */
+	private $config;
+	/** @var ICrypto */
+	private $crypto;
+	/** @var string */
+	private $fromAddress;
+
+	/**
+	 * @param Defaults $themingDefaults
+	 * @param IURLGenerator $urlGenerator
+	 * @param IFactory $l10nFactory
+	 * @param IMailer $mailer
+	 * @param ISecureRandom $secureRandom
+	 * @param ITimeFactory $timeFactory
+	 * @param IConfig $config
+	 * @param ICrypto $crypto
+	 * @param string $fromAddress
+	 */
+	public function __construct(Defaults $themingDefaults,
+		IURLGenerator $urlGenerator,
+		IFactory $l10nFactory,
+		IMailer $mailer,
+		ISecureRandom $secureRandom,
+		ITimeFactory $timeFactory,
+		IConfig $config,
+		ICrypto $crypto,
+		$fromAddress) {
+		$this->themingDefaults = $themingDefaults;
+		$this->urlGenerator = $urlGenerator;
+		$this->l10nFactory = $l10nFactory;
+		$this->mailer = $mailer;
+		$this->secureRandom = $secureRandom;
+		$this->timeFactory = $timeFactory;
+		$this->config = $config;
+		$this->crypto = $crypto;
+		$this->fromAddress = $fromAddress;
+	}
+
+	/**
+	 * @param IUser $user
+	 * @param bool $generatePasswordResetToken
+	 * @return IEMailTemplate
+	 */
+	public function generateTemplate(IUser $user, $generatePasswordResetToken = false) {
+		$userId = $user->getUID();
+		$lang = $this->l10nFactory->getUserLanguage($user);
+		$l10n = $this->l10nFactory->get('settings', $lang);
+
+		if ($generatePasswordResetToken) {
+			$token = $this->secureRandom->generate(
+				21,
+				ISecureRandom::CHAR_ALPHANUMERIC
+			);
+			$tokenValue = $this->timeFactory->getTime() . ':' . $token;
+			$mailAddress = (null !== $user->getEMailAddress()) ? $user->getEMailAddress() : '';
+			$encryptedValue = $this->crypto->encrypt($tokenValue, $mailAddress . $this->config->getSystemValue('secret'));
+			$this->config->setUserValue($user->getUID(), 'core', 'lostpassword', $encryptedValue);
+			$link = $this->urlGenerator->linkToRouteAbsolute('core.lost.resetform', ['userId' => $user->getUID(), 'token' => $token]);
+		} else {
+			$link = $this->urlGenerator->getAbsoluteURL('/');
+		}
+		$displayName = $user->getDisplayName();
+
+		$emailTemplate = $this->mailer->createEMailTemplate('settings.Welcome', [
+			'link' => $link,
+			'displayname' => $displayName,
+			'userid' => $userId,
+			'instancename' => $this->themingDefaults->getName(),
+			'resetTokenGenerated' => $generatePasswordResetToken,
+		]);
+
+		$emailTemplate->setSubject($l10n->t('Your %s account was created', [$this->themingDefaults->getName()]));
+		$emailTemplate->addHeader();
+		if ($displayName === $userId) {
+			$emailTemplate->addHeading($l10n->t('Welcome aboard'));
+		} else {
+			$emailTemplate->addHeading($l10n->t('Welcome aboard %s', [$displayName]));
+		}
+		$emailTemplate->addBodyText($l10n->t('Welcome to your %s account, you can add, protect, and share your data.', [$this->themingDefaults->getName()]));
+		if ($user->getBackendClassName() !== 'LDAP') {
+			$emailTemplate->addBodyText($l10n->t('Your username is: %s', [$userId]));
+		}
+		if ($generatePasswordResetToken) {
+			$leftButtonText = $l10n->t('Set your password');
+		} else {
+			$leftButtonText = $l10n->t('Go to %s', [$this->themingDefaults->getName()]);
+		}
+
+		$clientDownload = $this->config->getSystemValue('customclient_desktop', 'https://nextcloud.com/install/#install-clients');
+		if ($clientDownload === '') {
+			$emailTemplate->addBodyButton(
+				$leftButtonText,
+				$link
+			);
+		} else {
+			$emailTemplate->addBodyButtonGroup(
+				$leftButtonText,
+				$link,
+				$l10n->t('Install Client'),
+				$clientDownload
+			);
+		}
+
+		$emailTemplate->addFooter('', $lang);
+
+		return $emailTemplate;
+	}
+
+	/**
+	 * Sends a welcome mail to $user
+	 *
+	 * @param IUser $user
+	 * @param IEmailTemplate $emailTemplate
+	 * @throws \Exception If mail could not be sent
+	 */
+	public function sendMail(IUser $user,
+		IEMailTemplate $emailTemplate): void {
+
+		// Be sure to never try to send to an empty e-mail
+		$email = $user->getEMailAddress();
+		if ($email === null) {
+			return;
+		}
+
+		$message = $this->mailer->createMessage();
+		$message->setTo([$email => $user->getDisplayName()]);
+		$message->setFrom([$this->fromAddress => $this->themingDefaults->getName()]);
+		$message->useTemplate($emailTemplate);
+		$message->setAutoSubmitted(AutoSubmitted::VALUE_AUTO_GENERATED);
+		$this->mailer->send($message);
+	}
+}

wedding-pics/apps/settings/lib/Middleware/SubadminMiddleware.php

@@ -0,0 +1,92 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OCA\Settings\Middleware;
+
+use OC\AppFramework\Http;
+use OC\AppFramework\Middleware\Security\Exceptions\NotAdminException;
+use OC\AppFramework\Utility\ControllerMethodReflector;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\AppFramework\Middleware;
+use OCP\IL10N;
+
+/**
+ * Verifies whether an user has at least subadmin rights.
+ * To bypass use the `@NoSubAdminRequired` annotation
+ */
+class SubadminMiddleware extends Middleware {
+	/** @var bool */
+	protected $isSubAdmin;
+	/** @var ControllerMethodReflector */
+	protected $reflector;
+	/** @var IL10N */
+	private $l10n;
+
+	/**
+	 * @param ControllerMethodReflector $reflector
+	 * @param bool $isSubAdmin
+	 * @param IL10N $l10n
+	 */
+	public function __construct(ControllerMethodReflector $reflector,
+		$isSubAdmin,
+		IL10N $l10n) {
+		$this->reflector = $reflector;
+		$this->isSubAdmin = $isSubAdmin;
+		$this->l10n = $l10n;
+	}
+
+	/**
+	 * Check if sharing is enabled before the controllers is executed
+	 * @param Controller $controller
+	 * @param string $methodName
+	 * @throws \Exception
+	 */
+	public function beforeController($controller, $methodName) {
+		if (!$this->reflector->hasAnnotation('NoSubAdminRequired') && !$this->reflector->hasAnnotation('AuthorizedAdminSetting')) {
+			if (!$this->isSubAdmin) {
+				throw new NotAdminException($this->l10n->t('Logged in user must be a subadmin'));
+			}
+		}
+	}
+
+	/**
+	 * Return 403 page in case of an exception
+	 * @param Controller $controller
+	 * @param string $methodName
+	 * @param \Exception $exception
+	 * @return TemplateResponse
+	 * @throws \Exception
+	 */
+	public function afterException($controller, $methodName, \Exception $exception) {
+		if ($exception instanceof NotAdminException) {
+			$response = new TemplateResponse('core', '403', [], 'guest');
+			$response->setStatus(Http::STATUS_FORBIDDEN);
+			return $response;
+		}
+
+		throw $exception;
+	}
+}

wedding-pics/apps/settings/lib/Search/AppSearch.php

@@ -0,0 +1,94 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020 Joas Schilling <coding@schilljs.com>
+ *
+ * @author Joas Schilling <coding@schilljs.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Search;
+
+use OCP\IL10N;
+use OCP\INavigationManager;
+use OCP\IUser;
+use OCP\Search\IProvider;
+use OCP\Search\ISearchQuery;
+use OCP\Search\SearchResult;
+use OCP\Search\SearchResultEntry;
+
+class AppSearch implements IProvider {
+	public function __construct(
+		protected INavigationManager $navigationManager,
+		protected IL10N $l,
+	) {
+	}
+
+	public function getId(): string {
+		return 'settings_apps';
+	}
+
+	public function getName(): string {
+		return $this->l->t('Apps');
+	}
+
+	public function getOrder(string $route, array $routeParameters): int {
+		return $route === 'settings.AppSettings.viewApps' ? -50 : 100;
+	}
+
+	public function search(IUser $user, ISearchQuery $query): SearchResult {
+		$entries = $this->navigationManager->getAll('all');
+
+		$searchTitle = $this->l->t('Apps');
+		$term = $query->getFilter('term')?->get();
+		if (empty($term)) {
+			return SearchResult::complete($searchTitle, []);
+		}
+
+		$result = [];
+		foreach ($entries as $entry) {
+			if (
+				stripos($entry['name'], $term) === false &&
+				stripos($entry['id'], $term) === false
+			) {
+				continue;
+			}
+
+			if (str_starts_with($query->getRoute(), $entry['id'] . '.')) {
+				// Skip the current app, unlikely this is intended
+				continue;
+			}
+
+			if ($entry['href'] === '') {
+				// Nothing we can open, so ignore
+				continue;
+			}
+
+			$result[] = new SearchResultEntry(
+				'',
+				$entry['name'],
+				'',
+				$entry['href'],
+				'icon-confirm'
+			);
+		}
+
+		return SearchResult::complete($searchTitle, $result);
+	}
+}

wedding-pics/apps/settings/lib/Search/SectionSearch.php

@@ -0,0 +1,153 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020 Joas Schilling <coding@schilljs.com>
+ *
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author John Molakvoæ <skjnldsv@protonmail.com>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Search;
+
+use OCP\IGroupManager;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\IUser;
+use OCP\Search\IProvider;
+use OCP\Search\ISearchQuery;
+use OCP\Search\SearchResult;
+use OCP\Search\SearchResultEntry;
+use OCP\Settings\IIconSection;
+use OCP\Settings\IManager;
+
+class SectionSearch implements IProvider {
+
+	/** @var IManager */
+	protected $settingsManager;
+
+	/** @var IGroupManager */
+	protected $groupManager;
+
+	/** @var IURLGenerator */
+	protected $urlGenerator;
+
+	/** @var IL10N */
+	protected $l;
+
+	public function __construct(IManager $settingsManager,
+		IGroupManager $groupManager,
+		IURLGenerator $urlGenerator,
+		IL10N $l) {
+		$this->settingsManager = $settingsManager;
+		$this->groupManager = $groupManager;
+		$this->urlGenerator = $urlGenerator;
+		$this->l = $l;
+	}
+
+	/**
+	 * @inheritDoc
+	 */
+	public function getId(): string {
+		return 'settings';
+	}
+
+	/**
+	 * @inheritDoc
+	 */
+	public function getName(): string {
+		return $this->l->t('Settings');
+	}
+
+	/**
+	 * @inheritDoc
+	 */
+	public function getOrder(string $route, array $routeParameters): int {
+		if ($route === 'settings.PersonalSettings.index' || $route === 'settings.AdminSettings.index') {
+			return -1;
+		}
+		// At the very bottom
+		return 500;
+	}
+
+	/**
+	 * @inheritDoc
+	 */
+	public function search(IUser $user, ISearchQuery $query): SearchResult {
+		$isAdmin = $this->groupManager->isAdmin($user->getUID());
+
+		$result = $this->searchSections(
+			$query,
+			$this->settingsManager->getPersonalSections(),
+			$isAdmin ? $this->l->t('Personal') : '',
+			'settings.PersonalSettings.index'
+		);
+
+		if ($this->groupManager->isAdmin($user->getUID())) {
+			$result = array_merge($result, $this->searchSections(
+				$query,
+				$this->settingsManager->getAdminSections(),
+				$this->l->t('Administration'),
+				'settings.AdminSettings.index'
+			));
+		}
+
+		return SearchResult::complete(
+			$this->l->t('Settings'),
+			$result
+		);
+	}
+
+	/**
+	 * @param ISearchQuery $query
+	 * @param IIconSection[][] $sections
+	 * @param string $subline
+	 * @param string $routeName
+	 * @return array
+	 */
+	public function searchSections(ISearchQuery $query, array $sections, string $subline, string $routeName): array {
+		$result = [];
+		foreach ($sections as $priority => $sectionsByPriority) {
+			foreach ($sectionsByPriority as $section) {
+				if (
+					stripos($section->getName(), $query->getTerm()) === false &&
+					stripos($section->getID(), $query->getTerm()) === false
+				) {
+					continue;
+				}
+
+				/**
+				 * We can't use the icon URL at the moment as they don't invert correctly for dark theme
+				 * $iconUrl = $section->getIcon();
+				 */
+
+				$result[] = new SearchResultEntry(
+					'',
+					$section->getName(),
+					$subline,
+					$this->urlGenerator->linkToRouteAbsolute($routeName, ['section' => $section->getID()]),
+					'icon-settings-dark'
+				);
+			}
+		}
+
+		return $result;
+	}
+}

wedding-pics/apps/settings/lib/Search/UserSearch.php

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Stephan Orbaugh <stephan.orbaugh@nextcloud.com>
+ *
+ * @author Stephan Orbaugh <stephan.orbaugh@nextcloud.com>
+ * @author Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Search;
+
+use OCP\IL10N;
+use OCP\IUser;
+use OCP\Search\IProvider;
+use OCP\Search\ISearchQuery;
+use OCP\Search\SearchResult;
+
+class UserSearch implements IProvider {
+	public function __construct(
+		private IL10N $l,
+	) {
+	}
+
+	public function getId(): string {
+		return 'users';
+	}
+
+	public function getName(): string {
+		return $this->l->t('Users');
+	}
+
+	public function getOrder(string $route, array $routeParameters): ?int {
+		return $route === 'settings.Users.usersList'
+			? 300
+			: null;
+	}
+
+	public function search(IUser $user, ISearchQuery $query): SearchResult {
+		return SearchResult::complete($this->l->t('Users'), []);
+	}
+}

wedding-pics/apps/settings/lib/Sections/Admin/Additional.php

@@ -0,0 +1,60 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020, Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Sections\Admin;
+
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\Settings\IIconSection;
+
+class Additional implements IIconSection {
+
+	/** @var IL10N */
+	private $l;
+
+	/** @var IURLGenerator */
+	private $urlGenerator;
+
+	public function __construct(IL10N $l, IURLGenerator $urlGenerator) {
+		$this->l = $l;
+		$this->urlGenerator = $urlGenerator;
+	}
+
+	public function getIcon(): string {
+		return $this->urlGenerator->imagePath('core', 'actions/settings-dark.svg');
+	}
+
+	public function getID(): string {
+		return 'additional';
+	}
+
+	public function getName(): string {
+		return $this->l->t('Additional settings');
+	}
+
+	public function getPriority(): int {
+		return 98;
+	}
+}

wedding-pics/apps/settings/lib/Sections/Admin/ArtificialIntelligence.php

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Marcel Klehr <mklehr@gmx.net>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Sections\Admin;
+
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\Settings\IIconSection;
+
+class ArtificialIntelligence implements IIconSection {
+
+	/** @var IL10N */
+	private $l;
+
+	/** @var IURLGenerator */
+	private $urlGenerator;
+
+	public function __construct(IL10N $l, IURLGenerator $urlGenerator) {
+		$this->l = $l;
+		$this->urlGenerator = $urlGenerator;
+	}
+
+	public function getIcon(): string {
+		return $this->urlGenerator->imagePath('settings', 'ai.svg');
+	}
+
+	public function getID(): string {
+		return 'ai';
+	}
+
+	public function getName(): string {
+		return $this->l->t('Artificial Intelligence');
+	}
+
+	public function getPriority(): int {
+		return 40;
+	}
+}

wedding-pics/apps/settings/lib/Sections/Admin/Delegation.php

@@ -0,0 +1,76 @@
+<?php
+/**
+ * @copyright Copyright (c) 2021 Nextcloud GmbH
+ *
+ * @author Carl Schwan <carl@carlschwan.eu>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Settings\Sections\Admin;
+
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\Settings\IIconSection;
+
+class Delegation implements IIconSection {
+	/** @var IL10N */
+	private $l;
+	/** @var IURLGenerator */
+	private $url;
+
+	/**
+	 * @param IURLGenerator $url
+	 * @param IL10N $l
+	 */
+	public function __construct(IURLGenerator $url, IL10N $l) {
+		$this->url = $url;
+		$this->l = $l;
+	}
+
+	/**
+	 * {@inheritdoc}
+	 * @return string
+	 */
+	public function getID() {
+		return 'admindelegation';
+	}
+
+	/**
+	 * {@inheritdoc}
+	 * @return string
+	 */
+	public function getName() {
+		return $this->l->t('Administration privileges');
+	}
+
+	/**
+	 * {@inheritdoc}
+	 * @return int
+	 */
+	public function getPriority() {
+		return 54;
+	}
+
+	/**
+	 * {@inheritdoc}
+	 * @return string
+	 */
+	public function getIcon() {
+		return $this->url->imagePath('core', 'actions/user-admin.svg');
+	}
+}

wedding-pics/apps/settings/lib/Sections/Admin/Groupware.php

@@ -0,0 +1,60 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020, Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Sections\Admin;
+
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\Settings\IIconSection;
+
+class Groupware implements IIconSection {
+
+	/** @var IL10N */
+	private $l;
+
+	/** @var IURLGenerator */
+	private $urlGenerator;
+
+	public function __construct(IL10N $l, IURLGenerator $urlGenerator) {
+		$this->l = $l;
+		$this->urlGenerator = $urlGenerator;
+	}
+
+	public function getIcon(): string {
+		return $this->urlGenerator->imagePath('core', 'places/contacts.svg');
+	}
+
+	public function getID(): string {
+		return 'groupware';
+	}
+
+	public function getName(): string {
+		return $this->l->t('Groupware');
+	}
+
+	public function getPriority(): int {
+		return 50;
+	}
+}

wedding-pics/apps/settings/lib/Sections/Admin/Overview.php

@@ -0,0 +1,60 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020, Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Sections\Admin;
+
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\Settings\IIconSection;
+
+class Overview implements IIconSection {
+
+	/** @var IL10N */
+	private $l;
+
+	/** @var IURLGenerator */
+	private $urlGenerator;
+
+	public function __construct(IL10N $l, IURLGenerator $urlGenerator) {
+		$this->l = $l;
+		$this->urlGenerator = $urlGenerator;
+	}
+
+	public function getIcon(): string {
+		return $this->urlGenerator->imagePath('settings', 'admin.svg');
+	}
+
+	public function getID(): string {
+		return 'overview';
+	}
+
+	public function getName(): string {
+		return $this->l->t('Overview');
+	}
+
+	public function getPriority(): int {
+		return 0;
+	}
+}

wedding-pics/apps/settings/lib/Sections/Admin/Security.php

@@ -0,0 +1,60 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020, Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Sections\Admin;
+
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\Settings\IIconSection;
+
+class Security implements IIconSection {
+
+	/** @var IL10N */
+	private $l;
+
+	/** @var IURLGenerator */
+	private $urlGenerator;
+
+	public function __construct(IL10N $l, IURLGenerator $urlGenerator) {
+		$this->l = $l;
+		$this->urlGenerator = $urlGenerator;
+	}
+
+	public function getIcon(): string {
+		return $this->urlGenerator->imagePath('core', 'actions/password.svg');
+	}
+
+	public function getID(): string {
+		return 'security';
+	}
+
+	public function getName(): string {
+		return $this->l->t('Security');
+	}
+
+	public function getPriority(): int {
+		return 10;
+	}
+}

wedding-pics/apps/settings/lib/Sections/Admin/Server.php

@@ -0,0 +1,60 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020, Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Sections\Admin;
+
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\Settings\IIconSection;
+
+class Server implements IIconSection {
+
+	/** @var IL10N */
+	private $l;
+
+	/** @var IURLGenerator */
+	private $urlGenerator;
+
+	public function __construct(IL10N $l, IURLGenerator $urlGenerator) {
+		$this->l = $l;
+		$this->urlGenerator = $urlGenerator;
+	}
+
+	public function getIcon(): string {
+		return $this->urlGenerator->imagePath('core', 'actions/settings-dark.svg');
+	}
+
+	public function getID(): string {
+		return 'server';
+	}
+
+	public function getName(): string {
+		return $this->l->t('Basic settings');
+	}
+
+	public function getPriority(): int {
+		return 1;
+	}
+}

wedding-pics/apps/settings/lib/Sections/Admin/Sharing.php

@@ -0,0 +1,60 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020, Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Sections\Admin;
+
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\Settings\IIconSection;
+
+class Sharing implements IIconSection {
+
+	/** @var IL10N */
+	private $l;
+
+	/** @var IURLGenerator */
+	private $urlGenerator;
+
+	public function __construct(IL10N $l, IURLGenerator $urlGenerator) {
+		$this->l = $l;
+		$this->urlGenerator = $urlGenerator;
+	}
+
+	public function getIcon(): string {
+		return $this->urlGenerator->imagePath('core', 'actions/share.svg');
+	}
+
+	public function getID(): string {
+		return 'sharing';
+	}
+
+	public function getName(): string {
+		return $this->l->t('Sharing');
+	}
+
+	public function getPriority(): int {
+		return 5;
+	}
+}

wedding-pics/apps/settings/lib/Sections/Personal/Availability.php

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * Mail
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+namespace OCA\Settings\Sections\Personal;
+
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\Settings\IIconSection;
+
+class Availability implements IIconSection {
+
+	/** @var IL10N */
+	private $l;
+
+	/** @var IURLGenerator */
+	private $urlGenerator;
+
+	public function __construct(IL10N $l, IURLGenerator $urlGenerator) {
+		$this->l = $l;
+		$this->urlGenerator = $urlGenerator;
+	}
+
+	public function getIcon(): string {
+		return $this->urlGenerator->imagePath('dav', 'schedule.svg');
+	}
+
+	public function getID(): string {
+		return 'availability';
+	}
+
+	public function getName(): string {
+		return $this->l->t('Availability');
+	}
+
+	public function getPriority(): int {
+		return 50;
+	}
+}

wedding-pics/apps/settings/lib/Sections/Personal/Calendar.php

@@ -0,0 +1,55 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ *
+ * Mail
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+namespace OCA\Settings\Sections\Personal;
+
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\Settings\IIconSection;
+
+class Calendar implements IIconSection {
+
+	private IL10N $l;
+	private IURLGenerator $urlGenerator;
+
+	public function __construct(IL10N $l, IURLGenerator $urlGenerator) {
+		$this->l = $l;
+		$this->urlGenerator = $urlGenerator;
+	}
+
+	public function getIcon(): string {
+		return $this->urlGenerator->imagePath('dav', 'calendar.svg');
+	}
+
+	public function getID(): string {
+		return 'calendar';
+	}
+
+	public function getName(): string {
+		return $this->l->t('Calendar');
+	}
+
+	public function getPriority(): int {
+		return 50;
+	}
+}

wedding-pics/apps/settings/lib/Sections/Personal/PersonalInfo.php

@@ -0,0 +1,60 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020, Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Sections\Personal;
+
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\Settings\IIconSection;
+
+class PersonalInfo implements IIconSection {
+
+	/** @var IL10N */
+	private $l;
+
+	/** @var IURLGenerator */
+	private $urlGenerator;
+
+	public function __construct(IL10N $l, IURLGenerator $urlGenerator) {
+		$this->l = $l;
+		$this->urlGenerator = $urlGenerator;
+	}
+
+	public function getIcon() {
+		return $this->urlGenerator->imagePath('core', 'actions/user.svg');
+	}
+
+	public function getID(): string {
+		return 'personal-info';
+	}
+
+	public function getName(): string {
+		return $this->l->t('Personal info');
+	}
+
+	public function getPriority(): int {
+		return 0;
+	}
+}

wedding-pics/apps/settings/lib/Sections/Personal/Security.php

@@ -0,0 +1,60 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020, Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Sections\Personal;
+
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\Settings\IIconSection;
+
+class Security implements IIconSection {
+
+	/** @var IL10N */
+	private $l;
+
+	/** @var IURLGenerator */
+	private $urlGenerator;
+
+	public function __construct(IL10N $l, IURLGenerator $urlGenerator) {
+		$this->l = $l;
+		$this->urlGenerator = $urlGenerator;
+	}
+
+	public function getIcon() {
+		return $this->urlGenerator->imagePath('settings', 'password.svg');
+	}
+
+	public function getID(): string {
+		return 'security';
+	}
+
+	public function getName(): string {
+		return $this->l->t('Security');
+	}
+
+	public function getPriority(): int {
+		return 5;
+	}
+}

wedding-pics/apps/settings/lib/Sections/Personal/SyncClients.php

@@ -0,0 +1,60 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020, Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Sections\Personal;
+
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\Settings\IIconSection;
+
+class SyncClients implements IIconSection {
+
+	/** @var IL10N */
+	private $l;
+
+	/** @var IURLGenerator */
+	private $urlGenerator;
+
+	public function __construct(IL10N $l, IURLGenerator $urlGenerator) {
+		$this->l = $l;
+		$this->urlGenerator = $urlGenerator;
+	}
+
+	public function getIcon() {
+		return $this->urlGenerator->imagePath('core', 'clients/phone.svg');
+	}
+
+	public function getID(): string {
+		return 'sync-clients';
+	}
+
+	public function getName(): string {
+		return $this->l->t('Mobile & desktop');
+	}
+
+	public function getPriority(): int {
+		return 15;
+	}
+}

wedding-pics/apps/settings/lib/Service/AuthorizedGroupService.php

@@ -0,0 +1,116 @@
+<?php
+
+/**
+ * @copyright Copyright (c) 2021 Nextcloud GmbH
+ *
+ * @author Carl Schwan <carl@carlschwan.eu>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Settings\Service;
+
+use OC\Settings\AuthorizedGroup;
+use OC\Settings\AuthorizedGroupMapper;
+
+use OCP\AppFramework\Db\DoesNotExistException;
+use OCP\AppFramework\Db\MultipleObjectsReturnedException;
+use OCP\DB\Exception;
+use OCP\IGroup;
+
+class AuthorizedGroupService {
+
+	/** @var AuthorizedGroupMapper $mapper */
+	private $mapper;
+
+	public function __construct(AuthorizedGroupMapper $mapper) {
+		$this->mapper = $mapper;
+	}
+
+	/**
+	 * @return AuthorizedGroup[]
+	 */
+	public function findAll(): array {
+		return $this->mapper->findAll();
+	}
+
+	/**
+	 * Find AuthorizedGroup by id.
+	 *
+	 * @param int $id
+	 */
+	public function find(int $id): ?AuthorizedGroup {
+		return $this->mapper->find($id);
+	}
+
+	/**
+	 * @param $e
+	 * @throws NotFoundException
+	 */
+	private function handleException(\Exception $e): void {
+		if ($e instanceof DoesNotExistException ||
+			$e instanceof MultipleObjectsReturnedException) {
+			throw new NotFoundException("AuthorizedGroup not found");
+		} else {
+			throw $e;
+		}
+	}
+
+	/**
+	 * Create a new AuthorizedGroup
+	 *
+	 * @param string $groupId
+	 * @param string $class
+	 * @return AuthorizedGroup
+	 * @throws Exception
+	 */
+	public function create(string $groupId, string $class): AuthorizedGroup {
+		$authorizedGroup = new AuthorizedGroup();
+		$authorizedGroup->setGroupId($groupId);
+		$authorizedGroup->setClass($class);
+		return $this->mapper->insert($authorizedGroup);
+	}
+
+	/**
+	 * @throws NotFoundException
+	 */
+	public function delete(int $id): void {
+		try {
+			$authorizedGroup = $this->mapper->find($id);
+			$this->mapper->delete($authorizedGroup);
+		} catch (\Exception $e) {
+			$this->handleException($e);
+		}
+	}
+
+	public function findExistingGroupsForClass(string $class): array {
+		try {
+			$authorizedGroup = $this->mapper->findExistingGroupsForClass($class);
+			return $authorizedGroup;
+		} catch (\Exception $e) {
+			return [];
+		}
+	}
+
+	public function removeAuthorizationAssociatedTo(IGroup $group): void {
+		try {
+			$this->mapper->removeGroup($group->getGID());
+		} catch (\Exception $e) {
+			$this->handleException($e);
+		}
+	}
+}

wedding-pics/apps/settings/lib/Service/NotFoundException.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @copyright Copyright (c) 2021 Carl Schwan <carl@carlschwan.eu>
+ *
+ * @author Carl Schwan <carl@carlschwan.eu>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Service;
+
+class NotFoundException extends ServiceException {
+}

wedding-pics/apps/settings/lib/Service/ServiceException.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * @copyright Copyright (c) 2021 Nextcloud GmbH
+ *
+ * @author Carl Schwan <carl@carlschwan.eu>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Service;
+
+class ServiceException extends \Exception {
+}

wedding-pics/apps/settings/lib/Settings/Admin/ArtificialIntelligence.php

@@ -0,0 +1,177 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Marcel Klehr <mklehr@gmx.net>
+ *
+ * @author Marcel Klehr <mklehr@gmx.net>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Settings\Admin;
+
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\AppFramework\Services\IInitialState;
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\Settings\IDelegatedSettings;
+use OCP\SpeechToText\ISpeechToTextManager;
+use OCP\TextProcessing\IManager;
+use OCP\TextProcessing\IProvider;
+use OCP\TextProcessing\ITaskType;
+use OCP\Translation\ITranslationManager;
+use Psr\Container\ContainerExceptionInterface;
+use Psr\Container\ContainerInterface;
+use Psr\Container\NotFoundExceptionInterface;
+
+class ArtificialIntelligence implements IDelegatedSettings {
+	public function __construct(
+		private IConfig $config,
+		private IL10N $l,
+		private IInitialState $initialState,
+		private ITranslationManager $translationManager,
+		private ISpeechToTextManager $sttManager,
+		private IManager $textProcessingManager,
+		private ContainerInterface $container,
+		private \OCP\TextToImage\IManager $text2imageManager,
+	) {
+	}
+
+	/**
+	 * @return TemplateResponse
+	 */
+	public function getForm() {
+		$translationProviders = [];
+		$translationPreferences = [];
+		foreach ($this->translationManager->getProviders() as $provider) {
+			$translationProviders[] = [
+				'class' => $provider::class,
+				'name' => $provider->getName(),
+			];
+			$translationPreferences[] = $provider::class;
+		}
+
+		$sttProviders = [];
+		foreach ($this->sttManager->getProviders() as $provider) {
+			$sttProviders[] = [
+				'class' => $provider::class,
+				'name' => $provider->getName(),
+			];
+		}
+
+		$textProcessingProviders = [];
+		/** @var array<class-string<ITaskType>, class-string<IProvider>> $textProcessingSettings */
+		$textProcessingSettings = [];
+		foreach ($this->textProcessingManager->getProviders() as $provider) {
+			$textProcessingProviders[] = [
+				'class' => $provider::class,
+				'name' => $provider->getName(),
+				'taskType' => $provider->getTaskType(),
+			];
+			$textProcessingSettings[$provider->getTaskType()] = $provider::class;
+		}
+		$textProcessingTaskTypes = [];
+		foreach ($textProcessingSettings as $taskTypeClass => $providerClass) {
+			/** @var ITaskType $taskType */
+			try {
+				$taskType = $this->container->get($taskTypeClass);
+			} catch (NotFoundExceptionInterface $e) {
+				continue;
+			} catch (ContainerExceptionInterface $e) {
+				continue;
+			}
+			$textProcessingTaskTypes[] = [
+				'class' => $taskTypeClass,
+				'name' => $taskType->getName(),
+				'description' => $taskType->getDescription(),
+			];
+		}
+
+		$text2imageProviders = [];
+		foreach ($this->text2imageManager->getProviders() as $provider) {
+			$text2imageProviders[] = [
+				'id' => $provider->getId(),
+				'name' => $provider->getName(),
+			];
+		}
+
+		$this->initialState->provideInitialState('ai-stt-providers', $sttProviders);
+		$this->initialState->provideInitialState('ai-translation-providers', $translationProviders);
+		$this->initialState->provideInitialState('ai-text-processing-providers', $textProcessingProviders);
+		$this->initialState->provideInitialState('ai-text-processing-task-types', $textProcessingTaskTypes);
+		$this->initialState->provideInitialState('ai-text2image-providers', $text2imageProviders);
+
+		$settings = [
+			'ai.stt_provider' => count($sttProviders) > 0 ? $sttProviders[0]['class'] : null,
+			'ai.textprocessing_provider_preferences' => $textProcessingSettings,
+			'ai.translation_provider_preferences' => $translationPreferences,
+			'ai.text2image_provider' => count($text2imageProviders) > 0 ? $text2imageProviders[0]['id'] : null,
+		];
+		foreach ($settings as $key => $defaultValue) {
+			$value = $defaultValue;
+			$json = $this->config->getAppValue('core', $key, '');
+			if ($json !== '') {
+				$value = json_decode($json, true);
+				switch($key) {
+					case 'ai.textprocessing_provider_preferences':
+						// fill $value with $defaultValue values
+						$value = array_merge($defaultValue, $value);
+						break;
+					case 'ai.translation_provider_preferences':
+						$value += array_diff($defaultValue, $value); // Add entries from $defaultValue that are not in $value to the end of $value
+						break;
+					default:
+						break;
+				}
+			}
+			$settings[$key] = $value;
+		}
+
+		$this->initialState->provideInitialState('ai-settings', $settings);
+
+		return new TemplateResponse('settings', 'settings/admin/ai');
+	}
+
+	/**
+	 * @return string the section ID, e.g. 'sharing'
+	 */
+	public function getSection() {
+		return 'ai';
+	}
+
+	/**
+	 * @return int whether the form should be rather on the top or bottom of
+	 * the admin section. The forms are arranged in ascending order of the
+	 * priority values. It is required to return a value between 0 and 100.
+	 *
+	 * E.g.: 70
+	 */
+	public function getPriority() {
+		return 10;
+	}
+
+	public function getName(): ?string {
+		return $this->l->t('Artificial Intelligence');
+	}
+
+	public function getAuthorizedAppConfig(): array {
+		return [
+			'core' => ['/ai..*/'],
+		];
+	}
+}

wedding-pics/apps/settings/lib/Settings/Admin/Delegation.php

@@ -0,0 +1,148 @@
+<?php
+/**
+ * @copyright Copyright (c) 2021 Carl Schwan <carl@carlschwan.eu>
+ *
+ * @author Carl Schwan <carl@carlschwan.eu>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Settings\Settings\Admin;
+
+use OCA\Settings\AppInfo\Application;
+use OCA\Settings\Service\AuthorizedGroupService;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\AppFramework\Services\IInitialState;
+use OCP\IGroupManager;
+use OCP\IURLGenerator;
+use OCP\Settings\IDelegatedSettings;
+use OCP\Settings\IManager;
+use OCP\Settings\ISettings;
+
+class Delegation implements ISettings {
+	private IManager $settingManager;
+	private IInitialState $initialStateService;
+	private IGroupManager $groupManager;
+	private AuthorizedGroupService $authorizedGroupService;
+	private IURLGenerator $urlGenerator;
+
+	public function __construct(
+		IManager $settingManager,
+		IInitialState $initialStateService,
+		IGroupManager $groupManager,
+		AuthorizedGroupService $authorizedGroupService,
+		IURLGenerator $urlGenerator
+	) {
+		$this->settingManager = $settingManager;
+		$this->initialStateService = $initialStateService;
+		$this->groupManager = $groupManager;
+		$this->authorizedGroupService = $authorizedGroupService;
+		$this->urlGenerator = $urlGenerator;
+	}
+
+	/**
+	 * Filter out the ISettings that are not IDelegatedSettings from $innerSection
+	 * and add them to $settings.
+	 *
+	 * @param IDelegatedSettings[] $settings
+	 * @param ISettings[] $innerSection
+	 * @return IDelegatedSettings[]
+	 */
+	private function getDelegatedSettings(array $settings, array $innerSection): array {
+		foreach ($innerSection as $setting) {
+			if ($setting instanceof IDelegatedSettings) {
+				$settings[] = $setting;
+			}
+		}
+		return $settings;
+	}
+
+	private function initSettingState(): void {
+		// Available settings page initialization
+		$sections = $this->settingManager->getAdminSections();
+		$settings = [];
+		foreach ($sections as $sectionPriority) {
+			foreach ($sectionPriority as $section) {
+				$sectionSettings = $this->settingManager->getAdminSettings($section->getId());
+				$sectionSettings = array_reduce($sectionSettings, [$this, 'getDelegatedSettings'], []);
+				$settings = array_merge(
+					$settings,
+					array_map(function (IDelegatedSettings $setting) use ($section) {
+						$sectionName = $section->getName() . ($setting->getName() !== null ? ' - ' . $setting->getName() : '');
+						return [
+							'class' => get_class($setting),
+							'sectionName' => $sectionName,
+							'id' => mb_strtolower(str_replace(' ', '-', $sectionName)),
+							'priority' => $section->getPriority(),
+						];
+					}, $sectionSettings)
+				);
+			}
+		}
+		usort($settings, function (array $a, array $b) {
+			if ($a['priority'] == $b['priority']) {
+				return 0;
+			}
+			return ($a['priority'] < $b['priority']) ? -1 : 1;
+		});
+		$this->initialStateService->provideInitialState('available-settings', $settings);
+	}
+
+	public function initAvailableGroupState(): void {
+		// Available groups initialization
+		$groups = [];
+		$groupsClass = $this->groupManager->search('');
+		foreach ($groupsClass as $group) {
+			if ($group->getGID() === 'admin') {
+				continue; // Admin already have access to everything
+			}
+			$groups[] = [
+				'displayName' => $group->getDisplayName(),
+				'gid' => $group->getGID(),
+			];
+		}
+		$this->initialStateService->provideInitialState('available-groups', $groups);
+	}
+
+	public function initAuthorizedGroupState(): void {
+		// Already set authorized groups
+		$this->initialStateService->provideInitialState('authorized-groups', $this->authorizedGroupService->findAll());
+	}
+
+	public function getForm(): TemplateResponse {
+		$this->initSettingState();
+		$this->initAvailableGroupState();
+		$this->initAuthorizedGroupState();
+		$this->initialStateService->provideInitialState('authorized-settings-doc-link', $this->urlGenerator->linkToDocs('admin-delegation'));
+
+		return new TemplateResponse(Application::APP_ID, 'settings/admin/delegation', [], '');
+	}
+
+	/**
+	 * @return string the section ID, e.g. 'sharing'
+	 */
+	public function getSection() {
+		return 'admindelegation';
+	}
+
+	/*
+	 * @inheritdoc
+	 */
+	public function getPriority() {
+		return 75;
+	}
+}

wedding-pics/apps/settings/lib/Settings/Admin/Mail.php

@@ -0,0 +1,106 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Julius Härtl <jus@bitgrid.net>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Settings\Admin;
+
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\Settings\IDelegatedSettings;
+
+class Mail implements IDelegatedSettings {
+	/** @var IConfig */
+	private $config;
+
+	/** @var IL10N $l */
+	private $l;
+
+	/**
+	 * @param IConfig $config
+	 * @param IL10N $l
+	 */
+	public function __construct(IConfig $config, IL10N $l) {
+		$this->config = $config;
+		$this->l = $l;
+	}
+
+	/**
+	 * @return TemplateResponse
+	 */
+	public function getForm() {
+		$parameters = [
+			// Mail
+			'sendmail_is_available' => (bool) \OC_Helper::findBinaryPath('sendmail'),
+			'mail_domain' => $this->config->getSystemValue('mail_domain', ''),
+			'mail_from_address' => $this->config->getSystemValue('mail_from_address', ''),
+			'mail_smtpmode' => $this->config->getSystemValue('mail_smtpmode', ''),
+			'mail_smtpsecure' => $this->config->getSystemValue('mail_smtpsecure', ''),
+			'mail_smtphost' => $this->config->getSystemValue('mail_smtphost', ''),
+			'mail_smtpport' => $this->config->getSystemValue('mail_smtpport', ''),
+			'mail_smtpauth' => $this->config->getSystemValue('mail_smtpauth', false),
+			'mail_smtpname' => $this->config->getSystemValue('mail_smtpname', ''),
+			'mail_smtppassword' => $this->config->getSystemValue('mail_smtppassword', ''),
+			'mail_sendmailmode' => $this->config->getSystemValue('mail_sendmailmode', 'smtp'),
+		];
+
+		if ($parameters['mail_smtppassword'] !== '') {
+			$parameters['mail_smtppassword'] = '********';
+		}
+
+		if ($parameters['mail_smtpmode'] === '' || $parameters['mail_smtpmode'] === 'php') {
+			$parameters['mail_smtpmode'] = 'smtp';
+		}
+
+		return new TemplateResponse('settings', 'settings/admin/additional-mail', $parameters, '');
+	}
+
+	/**
+	 * @return string the section ID, e.g. 'sharing'
+	 */
+	public function getSection() {
+		return 'server';
+	}
+
+	/**
+	 * @return int whether the form should be rather on the top or bottom of
+	 * the admin section. The forms are arranged in ascending order of the
+	 * priority values. It is required to return a value between 0 and 100.
+	 *
+	 * E.g.: 70
+	 */
+	public function getPriority() {
+		return 10;
+	}
+
+	public function getName(): ?string {
+		return $this->l->t('Email server');
+	}
+
+	public function getAuthorizedAppConfig(): array {
+		return [];
+	}
+}

wedding-pics/apps/settings/lib/Settings/Admin/Overview.php

@@ -0,0 +1,81 @@
+<?php
+/**
+ * @copyright Copyright (c) 2018 Julius Härtl <jus@bitgrid.net>
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Julius Härtl <jus@bitgrid.net>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Settings\Admin;
+
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\Settings\IDelegatedSettings;
+
+class Overview implements IDelegatedSettings {
+	/** @var IConfig */
+	private $config;
+
+	/** @var IL10N $l*/
+	private $l;
+
+	public function __construct(IConfig $config, IL10N $l) {
+		$this->config = $config;
+		$this->l = $l;
+	}
+
+	/**
+	 * @return TemplateResponse
+	 */
+	public function getForm() {
+		$parameters = [
+			'checkForWorkingWellKnownSetup' => $this->config->getSystemValue('check_for_working_wellknown_setup', true),
+		];
+
+		return new TemplateResponse('settings', 'settings/admin/overview', $parameters, '');
+	}
+
+	/**
+	 * @return string the section ID, e.g. 'sharing'
+	 */
+	public function getSection() {
+		return 'overview';
+	}
+
+	/**
+	 * @return int whether the form should be rather on the top or bottom of
+	 * the admin section. The forms are arranged in ascending order of the
+	 * priority values. It is required to return a value between 0 and 100.
+	 *
+	 * E.g.: 70
+	 */
+	public function getPriority() {
+		return 10;
+	}
+
+	public function getName(): ?string {
+		return $this->l->t('Security & setup warnings');
+	}
+
+	public function getAuthorizedAppConfig(): array {
+		return [];
+	}
+}

wedding-pics/apps/settings/lib/Settings/Admin/Security.php

@@ -0,0 +1,99 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Julius Härtl <jus@bitgrid.net>
+ * @author Robin Appelman <robin@icewind.nl>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Settings\Admin;
+
+use OC\Authentication\TwoFactorAuth\MandatoryTwoFactor;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\AppFramework\Services\IInitialState;
+use OCP\Encryption\IManager;
+use OCP\IURLGenerator;
+use OCP\IUserManager;
+use OCP\Settings\ISettings;
+
+class Security implements ISettings {
+	private IManager $manager;
+	private IUserManager $userManager;
+	private MandatoryTwoFactor $mandatoryTwoFactor;
+	private IInitialState $initialState;
+	private IURLGenerator $urlGenerator;
+
+	public function __construct(IManager $manager,
+		IUserManager $userManager,
+		MandatoryTwoFactor $mandatoryTwoFactor,
+		IInitialState $initialState,
+		IURLGenerator $urlGenerator) {
+		$this->manager = $manager;
+		$this->userManager = $userManager;
+		$this->mandatoryTwoFactor = $mandatoryTwoFactor;
+		$this->initialState = $initialState;
+		$this->urlGenerator = $urlGenerator;
+	}
+
+	/**
+	 * @return TemplateResponse
+	 */
+	public function getForm(): TemplateResponse {
+		$encryptionModules = $this->manager->getEncryptionModules();
+		$defaultEncryptionModuleId = $this->manager->getDefaultEncryptionModuleId();
+		$encryptionModuleList = [];
+		foreach ($encryptionModules as $module) {
+			$encryptionModuleList[$module['id']]['displayName'] = $module['displayName'];
+			$encryptionModuleList[$module['id']]['default'] = false;
+			if ($module['id'] === $defaultEncryptionModuleId) {
+				$encryptionModuleList[$module['id']]['default'] = true;
+			}
+		}
+
+		$this->initialState->provideInitialState('mandatory2FAState', $this->mandatoryTwoFactor->getState());
+		$this->initialState->provideInitialState('two-factor-admin-doc', $this->urlGenerator->linkToDocs('admin-2fa'));
+		$this->initialState->provideInitialState('encryption-enabled', $this->manager->isEnabled());
+		$this->initialState->provideInitialState('encryption-ready', $this->manager->isReady());
+		$this->initialState->provideInitialState('external-backends-enabled', count($this->userManager->getBackends()) > 1);
+		$this->initialState->provideInitialState('encryption-modules', $encryptionModuleList);
+		$this->initialState->provideInitialState('encryption-admin-doc', $this->urlGenerator->linkToDocs('admin-encryption'));
+
+		return new TemplateResponse('settings', 'settings/admin/security', [], '');
+	}
+
+	/**
+	 * @return string the section ID, e.g. 'sharing'
+	 */
+	public function getSection(): string {
+		return 'security';
+	}
+
+	/**
+	 * @return int whether the form should be rather on the top or bottom of
+	 * the admin section. The forms are arranged in ascending order of the
+	 * priority values. It is required to return a value between 0 and 100.
+	 *
+	 * E.g.: 70
+	 */
+	public function getPriority(): int {
+		return 10;
+	}
+}

wedding-pics/apps/settings/lib/Settings/Admin/Server.php

@@ -0,0 +1,135 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Settings\Admin;
+
+use OC\Profile\ProfileManager;
+use OC\Profile\TProfileHelper;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\AppFramework\Services\IInitialState;
+use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\IConfig;
+use OCP\IDBConnection;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\Settings\IDelegatedSettings;
+
+class Server implements IDelegatedSettings {
+	use TProfileHelper;
+
+	private IDBConnection $connection;
+	private IInitialState $initialStateService;
+	private ProfileManager $profileManager;
+	private ITimeFactory $timeFactory;
+	private IConfig $config;
+	private IL10N $l;
+	private IURLGenerator $urlGenerator;
+
+	public function __construct(IDBConnection $connection,
+		IInitialState $initialStateService,
+		ProfileManager $profileManager,
+		ITimeFactory $timeFactory,
+		IURLGenerator $urlGenerator,
+		IConfig $config,
+		IL10N $l) {
+		$this->connection = $connection;
+		$this->initialStateService = $initialStateService;
+		$this->profileManager = $profileManager;
+		$this->timeFactory = $timeFactory;
+		$this->config = $config;
+		$this->l = $l;
+		$this->urlGenerator = $urlGenerator;
+	}
+
+	/**
+	 * @return TemplateResponse
+	 */
+	public function getForm() {
+		// Background jobs
+		$this->initialStateService->provideInitialState('backgroundJobsMode', $this->config->getAppValue('core', 'backgroundjobs_mode', 'ajax'));
+		$this->initialStateService->provideInitialState('lastCron', (int)$this->config->getAppValue('core', 'lastcron', '0'));
+		$this->initialStateService->provideInitialState('cronMaxAge', $this->cronMaxAge());
+		$this->initialStateService->provideInitialState('cronErrors', $this->config->getAppValue('core', 'cronErrors'));
+		$this->initialStateService->provideInitialState('cliBasedCronPossible', function_exists('posix_getpwuid'));
+		$this->initialStateService->provideInitialState('cliBasedCronUser', function_exists('posix_getpwuid') ? posix_getpwuid(fileowner(\OC::$configDir . 'config.php'))['name'] : '');
+		$this->initialStateService->provideInitialState('backgroundJobsDocUrl', $this->urlGenerator->linkToDocs('admin-background-jobs'));
+
+		// Profile page
+		$this->initialStateService->provideInitialState('profileEnabledGlobally', $this->profileManager->isProfileEnabled());
+		$this->initialStateService->provideInitialState('profileEnabledByDefault', $this->isProfileEnabledByDefault($this->config));
+
+		return new TemplateResponse('settings', 'settings/admin/server', [
+			'profileEnabledGlobally' => $this->profileManager->isProfileEnabled(),
+		], '');
+	}
+
+	protected function cronMaxAge(): int {
+		$query = $this->connection->getQueryBuilder();
+		$query->select('last_checked')
+			->from('jobs')
+			->orderBy('last_checked', 'ASC')
+			->setMaxResults(1);
+
+		$result = $query->execute();
+		if ($row = $result->fetch()) {
+			$maxAge = (int) $row['last_checked'];
+		} else {
+			$maxAge = $this->timeFactory->getTime();
+		}
+		$result->closeCursor();
+
+		return $maxAge;
+	}
+
+	/**
+	 * @return string the section ID, e.g. 'sharing'
+	 */
+	public function getSection(): string {
+		return 'server';
+	}
+
+	/**
+	 * @return int whether the form should be rather on the top or bottom of
+	 * the admin section. The forms are arranged in ascending order of the
+	 * priority values. It is required to return a value between 0 and 100.
+	 *
+	 * E.g.: 70
+	 */
+	public function getPriority(): int {
+		return 0;
+	}
+
+	public function getName(): ?string {
+		return $this->l->t('Background jobs');
+	}
+
+	public function getAuthorizedAppConfig(): array {
+		return [
+			'core' => [
+				'/mail_general_settings/',
+			],
+		];
+	}
+}

wedding-pics/apps/settings/lib/Settings/Admin/Sharing.php

@@ -0,0 +1,144 @@
+<?php
+/**
+ * @copyright Copyright (c) 2016 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Bjoern Schiessle <bjoern@schiessle.org>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Robin Appelman <robin@icewind.nl>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ * @author Sascha Wiswedel <sascha.wiswedel@nextcloud.com>
+ * @author Vincent Petry <vincent@nextcloud.com>
+ * @author Thomas Citharel <nextcloud@tcit.fr>
+ * @author Ferdinand Thiessen <opensource@fthiessen.de>
+ *
+ * @license AGPL-3.0-or-later
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Settings\Admin;
+
+use OCP\App\IAppManager;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\AppFramework\Services\IInitialState;
+use OCP\Constants;
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\Settings\IDelegatedSettings;
+use OCP\Share\IManager;
+use OCP\Util;
+
+class Sharing implements IDelegatedSettings {
+	public function __construct(
+		private IConfig $config,
+		private IL10N $l,
+		private IManager $shareManager,
+		private IAppManager $appManager,
+		private IURLGenerator $urlGenerator,
+		private IInitialState $initialState,
+		private string $appName,
+	) {
+	}
+
+	/**
+	 * @return TemplateResponse
+	 */
+	public function getForm() {
+		$excludedGroups = $this->config->getAppValue('core', 'shareapi_exclude_groups_list', '');
+		$linksExcludedGroups = $this->config->getAppValue('core', 'shareapi_allow_links_exclude_groups', '');
+		$excludedPasswordGroups = $this->config->getAppValue('core', 'shareapi_enforce_links_password_excluded_groups', '');
+
+		$parameters = [
+			// Built-In Sharing
+			'enabled' => $this->getHumanBooleanConfig('core', 'shareapi_enabled', true),
+			'allowGroupSharing' => $this->getHumanBooleanConfig('core', 'shareapi_allow_group_sharing', true),
+			'allowLinks' => $this->getHumanBooleanConfig('core', 'shareapi_allow_links', true),
+			'allowLinksExcludeGroups' => json_decode($linksExcludedGroups, true) ?? [],
+			'allowPublicUpload' => $this->getHumanBooleanConfig('core', 'shareapi_allow_public_upload', true),
+			'allowResharing' => $this->getHumanBooleanConfig('core', 'shareapi_allow_resharing', true),
+			'allowShareDialogUserEnumeration' => $this->getHumanBooleanConfig('core', 'shareapi_allow_share_dialog_user_enumeration', true),
+			'restrictUserEnumerationToGroup' => $this->getHumanBooleanConfig('core', 'shareapi_restrict_user_enumeration_to_group'),
+			'restrictUserEnumerationToPhone' => $this->getHumanBooleanConfig('core', 'shareapi_restrict_user_enumeration_to_phone'),
+			'restrictUserEnumerationFullMatch' => $this->getHumanBooleanConfig('core', 'shareapi_restrict_user_enumeration_full_match', true),
+			'restrictUserEnumerationFullMatchUserId' => $this->getHumanBooleanConfig('core', 'shareapi_restrict_user_enumeration_full_match_userid', true),
+			'restrictUserEnumerationFullMatchEmail' => $this->getHumanBooleanConfig('core', 'shareapi_restrict_user_enumeration_full_match_email', true),
+			'restrictUserEnumerationFullMatchIgnoreSecondDN' => $this->getHumanBooleanConfig('core', 'shareapi_restrict_user_enumeration_full_match_ignore_second_dn'),
+			'enforceLinksPassword' => Util::isPublicLinkPasswordRequired(false),
+			'passwordExcludedGroups' => json_decode($excludedPasswordGroups) ?? [],
+			'passwordExcludedGroupsFeatureEnabled' => $this->config->getSystemValueBool('sharing.allow_disabled_password_enforcement_groups', false),
+			'onlyShareWithGroupMembers' => $this->shareManager->shareWithGroupMembersOnly(),
+			'defaultExpireDate' => $this->getHumanBooleanConfig('core', 'shareapi_default_expire_date'),
+			'expireAfterNDays' => $this->config->getAppValue('core', 'shareapi_expire_after_n_days', '7'),
+			'enforceExpireDate' => $this->getHumanBooleanConfig('core', 'shareapi_enforce_expire_date'),
+			'excludeGroups' => $this->getHumanBooleanConfig('core', 'shareapi_exclude_groups'),
+			'excludeGroupsList' => json_decode($excludedGroups, true) ?? [],
+			'publicShareDisclaimerText' => $this->config->getAppValue('core', 'shareapi_public_link_disclaimertext', null),
+			'enableLinkPasswordByDefault' => $this->getHumanBooleanConfig('core', 'shareapi_enable_link_password_by_default'),
+			'defaultPermissions' => (int)$this->config->getAppValue('core', 'shareapi_default_permissions', (string)Constants::PERMISSION_ALL),
+			'defaultInternalExpireDate' => $this->getHumanBooleanConfig('core', 'shareapi_default_internal_expire_date'),
+			'internalExpireAfterNDays' => $this->config->getAppValue('core', 'shareapi_internal_expire_after_n_days', '7'),
+			'enforceInternalExpireDate' => $this->getHumanBooleanConfig('core', 'shareapi_enforce_internal_expire_date'),
+			'defaultRemoteExpireDate' => $this->getHumanBooleanConfig('core', 'shareapi_default_remote_expire_date'),
+			'remoteExpireAfterNDays' => $this->config->getAppValue('core', 'shareapi_remote_expire_after_n_days', '7'),
+			'enforceRemoteExpireDate' => $this->getHumanBooleanConfig('core', 'shareapi_enforce_remote_expire_date'),
+		];
+
+		$this->initialState->provideInitialState('sharingAppEnabled', $this->appManager->isEnabledForUser('files_sharing'));
+		$this->initialState->provideInitialState('sharingDocumentation', $this->urlGenerator->linkToDocs('admin-sharing'));
+		$this->initialState->provideInitialState('sharingSettings', $parameters);
+
+		\OCP\Util::addScript($this->appName, 'vue-settings-admin-sharing');
+		return new TemplateResponse($this->appName, 'settings/admin/sharing', [], '');
+	}
+
+	/**
+	 * Helper function to retrive boolean values from human readable strings ('yes' / 'no')
+	 */
+	private function getHumanBooleanConfig(string $app, string $key, bool $default = false): bool {
+		return $this->config->getAppValue($app, $key, $default ? 'yes' : 'no') === 'yes';
+	}
+
+	/**
+	 * @return string the section ID, e.g. 'sharing'
+	 */
+	public function getSection() {
+		return 'sharing';
+	}
+
+	/**
+	 * @return int whether the form should be rather on the top or bottom of
+	 * the admin section. The forms are arranged in ascending order of the
+	 * priority values. It is required to return a value between 0 and 100.
+	 *
+	 * E.g.: 70
+	 */
+	public function getPriority() {
+		return 0;
+	}
+
+	public function getAuthorizedAppConfig(): array {
+		return [
+			'core' => ['/shareapi_.*/'],
+		];
+	}
+
+	public function getName(): ?string {
+		return null;
+	}
+}

wedding-pics/apps/settings/lib/Settings/Personal/Additional.php

@@ -0,0 +1,58 @@
+<?php
+/**
+ * @copyright Copyright (c) 2017 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Settings\Personal;
+
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\Settings\ISettings;
+
+class Additional implements ISettings {
+
+	/**
+	 * @return TemplateResponse returns the instance with all parameters set, ready to be rendered
+	 * @since 9.1
+	 */
+	public function getForm(): TemplateResponse {
+		return new TemplateResponse('settings', 'settings/empty');
+	}
+
+	/**
+	 * @return string the section ID, e.g. 'sharing'
+	 * @since 9.1
+	 */
+	public function getSection(): string {
+		return 'additional';
+	}
+
+	/**
+	 * @return int whether the form should be rather on the top or bottom of
+	 * the admin section. The forms are arranged in ascending order of the
+	 * priority values. It is required to return a value between 0 and 100.
+	 *
+	 * E.g.: 70
+	 * @since 9.1
+	 */
+	public function getPriority(): int {
+		return 5;
+	}
+}

wedding-pics/apps/settings/lib/Settings/Personal/PersonalInfo.php

@@ -0,0 +1,375 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2017 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Christopher Ng <chrng8@gmail.com>
+ * @author Georg Ehrke <oc.list@georgehrke.com>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author John Molakvoæ <skjnldsv@protonmail.com>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Robin Appelman <robin@icewind.nl>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ * @author Thomas Citharel <nextcloud@tcit.fr>
+ * @author Vincent Petry <vincent@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Settings\Settings\Personal;
+
+use OC\Profile\ProfileManager;
+use OCA\FederatedFileSharing\FederatedShareProvider;
+use OCP\Accounts\IAccount;
+use OCP\Accounts\IAccountManager;
+use OCP\Accounts\IAccountProperty;
+use OCP\App\IAppManager;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\AppFramework\Services\IInitialState;
+use OCP\Files\FileInfo;
+use OCP\IConfig;
+use OCP\IGroup;
+use OCP\IGroupManager;
+use OCP\IL10N;
+use OCP\IUser;
+use OCP\IUserManager;
+use OCP\L10N\IFactory;
+use OCP\Notification\IManager;
+use OCP\Settings\ISettings;
+
+class PersonalInfo implements ISettings {
+
+	/** @var IConfig */
+	private $config;
+
+	/** @var IUserManager */
+	private $userManager;
+
+	/** @var IAccountManager */
+	private $accountManager;
+
+	/** @var ProfileManager */
+	private $profileManager;
+
+	/** @var IGroupManager */
+	private $groupManager;
+
+	/** @var IAppManager */
+	private $appManager;
+
+	/** @var IFactory */
+	private $l10nFactory;
+
+	/** @var IL10N */
+	private $l;
+
+	/** @var IInitialState */
+	private $initialStateService;
+
+	/** @var IManager */
+	private $manager;
+
+	public function __construct(
+		IConfig $config,
+		IUserManager $userManager,
+		IGroupManager $groupManager,
+		IAccountManager $accountManager,
+		ProfileManager $profileManager,
+		IAppManager $appManager,
+		IFactory $l10nFactory,
+		IL10N $l,
+		IInitialState $initialStateService,
+		IManager $manager
+	) {
+		$this->config = $config;
+		$this->userManager = $userManager;
+		$this->accountManager = $accountManager;
+		$this->profileManager = $profileManager;
+		$this->groupManager = $groupManager;
+		$this->appManager = $appManager;
+		$this->l10nFactory = $l10nFactory;
+		$this->l = $l;
+		$this->initialStateService = $initialStateService;
+		$this->manager = $manager;
+	}
+
+	public function getForm(): TemplateResponse {
+		$federationEnabled = $this->appManager->isEnabledForUser('federation');
+		$federatedFileSharingEnabled = $this->appManager->isEnabledForUser('federatedfilesharing');
+		$lookupServerUploadEnabled = false;
+		if ($federatedFileSharingEnabled) {
+			/** @var FederatedShareProvider $shareProvider */
+			$shareProvider = \OC::$server->query(FederatedShareProvider::class);
+			$lookupServerUploadEnabled = $shareProvider->isLookupServerUploadEnabled();
+		}
+
+		$uid = \OC_User::getUser();
+		$user = $this->userManager->get($uid);
+		$account = $this->accountManager->getAccount($user);
+
+		// make sure FS is setup before querying storage related stuff...
+		\OC_Util::setupFS($user->getUID());
+
+		$storageInfo = \OC_Helper::getStorageInfo('/');
+		if ($storageInfo['quota'] === FileInfo::SPACE_UNLIMITED) {
+			$totalSpace = $this->l->t('Unlimited');
+		} else {
+			$totalSpace = \OC_Helper::humanFileSize($storageInfo['total']);
+		}
+
+		$messageParameters = $this->getMessageParameters($account);
+
+		$parameters = [
+			'lookupServerUploadEnabled' => $lookupServerUploadEnabled,
+			'isFairUseOfFreePushService' => $this->isFairUseOfFreePushService(),
+			'profileEnabledGlobally' => $this->profileManager->isProfileEnabled(),
+		] + $messageParameters;
+
+		$personalInfoParameters = [
+			'userId' => $uid,
+			'avatar' => $this->getProperty($account, IAccountManager::PROPERTY_AVATAR),
+			'groups' => $this->getGroups($user),
+			'quota' => $storageInfo['quota'],
+			'totalSpace' => $totalSpace,
+			'usage' => \OC_Helper::humanFileSize($storageInfo['used']),
+			'usageRelative' => round($storageInfo['relative']),
+			'displayName' => $this->getProperty($account, IAccountManager::PROPERTY_DISPLAYNAME),
+			'emailMap' => $this->getEmailMap($account),
+			'phone' => $this->getProperty($account, IAccountManager::PROPERTY_PHONE),
+			'defaultPhoneRegion' => $this->config->getSystemValueString('default_phone_region'),
+			'location' => $this->getProperty($account, IAccountManager::PROPERTY_ADDRESS),
+			'website' => $this->getProperty($account, IAccountManager::PROPERTY_WEBSITE),
+			'twitter' => $this->getProperty($account, IAccountManager::PROPERTY_TWITTER),
+			'fediverse' => $this->getProperty($account, IAccountManager::PROPERTY_FEDIVERSE),
+			'languageMap' => $this->getLanguageMap($user),
+			'localeMap' => $this->getLocaleMap($user),
+			'profileEnabledGlobally' => $this->profileManager->isProfileEnabled(),
+			'profileEnabled' => $this->profileManager->isProfileEnabled($user),
+			'organisation' => $this->getProperty($account, IAccountManager::PROPERTY_ORGANISATION),
+			'role' => $this->getProperty($account, IAccountManager::PROPERTY_ROLE),
+			'headline' => $this->getProperty($account, IAccountManager::PROPERTY_HEADLINE),
+			'biography' => $this->getProperty($account, IAccountManager::PROPERTY_BIOGRAPHY),
+		];
+
+		$accountParameters = [
+			'avatarChangeSupported' => $user->canChangeAvatar(),
+			'displayNameChangeSupported' => $user->canChangeDisplayName(),
+			'federationEnabled' => $federationEnabled,
+			'lookupServerUploadEnabled' => $lookupServerUploadEnabled,
+		];
+
+		$profileParameters = [
+			'profileConfig' => $this->profileManager->getProfileConfigWithMetadata($user, $user),
+		];
+
+		$this->initialStateService->provideInitialState('profileEnabledGlobally', $this->profileManager->isProfileEnabled());
+		$this->initialStateService->provideInitialState('personalInfoParameters', $personalInfoParameters);
+		$this->initialStateService->provideInitialState('accountParameters', $accountParameters);
+		$this->initialStateService->provideInitialState('profileParameters', $profileParameters);
+
+		return new TemplateResponse('settings', 'settings/personal/personal.info', $parameters, '');
+	}
+
+	/**
+	 * Check if is fair use of free push service
+	 * @return boolean
+	 */
+	private function isFairUseOfFreePushService(): bool {
+		return $this->manager->isFairUseOfFreePushService();
+	}
+
+	/**
+	 * returns the property data in an
+	 * associative array
+	 */
+	private function getProperty(IAccount $account, string $property): array {
+		$property = [
+			'name' => $account->getProperty($property)->getName(),
+			'value' => $account->getProperty($property)->getValue(),
+			'scope' => $account->getProperty($property)->getScope(),
+			'verified' => $account->getProperty($property)->getVerified(),
+		];
+
+		return $property;
+	}
+
+	/**
+	 * returns the section ID string, e.g. 'sharing'
+	 * @since 9.1
+	 */
+	public function getSection(): string {
+		return 'personal-info';
+	}
+
+	/**
+	 * @return int whether the form should be rather on the top or bottom of
+	 * the admin section. The forms are arranged in ascending order of the
+	 * priority values. It is required to return a value between 0 and 100.
+	 *
+	 * E.g.: 70
+	 * @since 9.1
+	 */
+	public function getPriority(): int {
+		return 10;
+	}
+
+	/**
+	 * returns a sorted list of the user's group GIDs
+	 */
+	private function getGroups(IUser $user): array {
+		$groups = array_map(
+			static function (IGroup $group) {
+				return $group->getDisplayName();
+			},
+			$this->groupManager->getUserGroups($user)
+		);
+		sort($groups);
+
+		return $groups;
+	}
+
+	/**
+	 * returns the primary email and additional emails in an
+	 * associative array
+	 */
+	private function getEmailMap(IAccount $account): array {
+		$systemEmail = [
+			'name' => $account->getProperty(IAccountManager::PROPERTY_EMAIL)->getName(),
+			'value' => $account->getProperty(IAccountManager::PROPERTY_EMAIL)->getValue(),
+			'scope' => $account->getProperty(IAccountManager::PROPERTY_EMAIL)->getScope(),
+			'verified' => $account->getProperty(IAccountManager::PROPERTY_EMAIL)->getVerified(),
+		];
+
+		$additionalEmails = array_map(
+			function (IAccountProperty $property) {
+				return [
+					'name' => $property->getName(),
+					'value' => $property->getValue(),
+					'scope' => $property->getScope(),
+					'verified' => $property->getVerified(),
+					'locallyVerified' => $property->getLocallyVerified(),
+				];
+			},
+			$account->getPropertyCollection(IAccountManager::COLLECTION_EMAIL)->getProperties(),
+		);
+
+		$emailMap = [
+			'primaryEmail' => $systemEmail,
+			'additionalEmails' => $additionalEmails,
+			'notificationEmail' => (string)$account->getUser()->getPrimaryEMailAddress(),
+		];
+
+		return $emailMap;
+	}
+
+	/**
+	 * returns the user's active language, common languages, and other languages in an
+	 * associative array
+	 */
+	private function getLanguageMap(IUser $user): array {
+		$forceLanguage = $this->config->getSystemValue('force_language', false);
+		if ($forceLanguage !== false) {
+			return [];
+		}
+
+		$uid = $user->getUID();
+
+		$userConfLang = $this->config->getUserValue($uid, 'core', 'lang', $this->l10nFactory->findLanguage());
+		$languages = $this->l10nFactory->getLanguages();
+
+		// associate the user language with the proper array
+		$userLangIndex = array_search($userConfLang, array_column($languages['commonLanguages'], 'code'));
+		$userLang = $languages['commonLanguages'][$userLangIndex];
+		// search in the other languages
+		if ($userLangIndex === false) {
+			$userLangIndex = array_search($userConfLang, array_column($languages['otherLanguages'], 'code'));
+			$userLang = $languages['otherLanguages'][$userLangIndex];
+		}
+		// if user language is not available but set somehow: show the actual code as name
+		if (!is_array($userLang)) {
+			$userLang = [
+				'code' => $userConfLang,
+				'name' => $userConfLang,
+			];
+		}
+
+		return array_merge(
+			['activeLanguage' => $userLang],
+			$languages
+		);
+	}
+
+	private function getLocaleMap(IUser $user): array {
+		$forceLanguage = $this->config->getSystemValue('force_locale', false);
+		if ($forceLanguage !== false) {
+			return [];
+		}
+
+		$uid = $user->getUID();
+		$userLocaleString = $this->config->getUserValue($uid, 'core', 'locale', $this->l10nFactory->findLocale());
+		$userLang = $this->config->getUserValue($uid, 'core', 'lang', $this->l10nFactory->findLanguage());
+		$localeCodes = $this->l10nFactory->findAvailableLocales();
+		$userLocale = array_filter($localeCodes, fn ($value) => $userLocaleString === $value['code']);
+
+		if (!empty($userLocale)) {
+			$userLocale = reset($userLocale);
+		}
+
+		$localesForLanguage = array_values(array_filter($localeCodes, fn ($localeCode) => str_starts_with($localeCode['code'], $userLang)));
+		$otherLocales = array_values(array_filter($localeCodes, fn ($localeCode) => !str_starts_with($localeCode['code'], $userLang)));
+
+		if (!$userLocale) {
+			$userLocale = [
+				'code' => 'en',
+				'name' => 'English'
+			];
+		}
+
+		return [
+			'activeLocaleLang' => $userLocaleString,
+			'activeLocale' => $userLocale,
+			'localesForLanguage' => $localesForLanguage,
+			'otherLocales' => $otherLocales,
+		];
+	}
+
+	/**
+	 * returns the message parameters
+	 */
+	private function getMessageParameters(IAccount $account): array {
+		$needVerifyMessage = [IAccountManager::PROPERTY_EMAIL, IAccountManager::PROPERTY_WEBSITE, IAccountManager::PROPERTY_TWITTER];
+		$messageParameters = [];
+		foreach ($needVerifyMessage as $property) {
+			switch ($account->getProperty($property)->getVerified()) {
+				case IAccountManager::VERIFIED:
+					$message = $this->l->t('Verifying');
+					break;
+				case IAccountManager::VERIFICATION_IN_PROGRESS:
+					$message = $this->l->t('Verifying …');
+					break;
+				default:
+					$message = $this->l->t('Verify');
+			}
+			$messageParameters[$property . 'Message'] = $message;
+		}
+		return $messageParameters;
+	}
+}

wedding-pics/apps/settings/lib/Settings/Personal/Security/Authtokens.php

@@ -0,0 +1,117 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2019, Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Settings\Personal\Security;
+
+use OC\Authentication\Token\INamedToken;
+use OC\Authentication\Token\IProvider as IAuthTokenProvider;
+use OC\Authentication\Token\IToken;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\AppFramework\Services\IInitialState;
+use OCP\Authentication\Exceptions\InvalidTokenException;
+use OCP\ISession;
+use OCP\IUserSession;
+use OCP\Session\Exceptions\SessionNotAvailableException;
+use OCP\Settings\ISettings;
+use function array_map;
+
+class Authtokens implements ISettings {
+
+	/** @var IAuthTokenProvider */
+	private $tokenProvider;
+
+	/** @var ISession */
+	private $session;
+
+	/** @var IInitialState */
+	private $initialState;
+
+	/** @var string|null */
+	private $uid;
+
+	/** @var IUserSession */
+	private $userSession;
+
+	public function __construct(IAuthTokenProvider $tokenProvider,
+		ISession $session,
+		IUserSession $userSession,
+		IInitialState $initialState,
+		?string $UserId) {
+		$this->tokenProvider = $tokenProvider;
+		$this->session = $session;
+		$this->initialState = $initialState;
+		$this->uid = $UserId;
+		$this->userSession = $userSession;
+	}
+
+	public function getForm(): TemplateResponse {
+		$this->initialState->provideInitialState(
+			'app_tokens',
+			$this->getAppTokens()
+		);
+
+		$this->initialState->provideInitialState(
+			'can_create_app_token',
+			$this->userSession->getImpersonatingUserID() === null
+		);
+
+		return new TemplateResponse('settings', 'settings/personal/security/authtokens');
+	}
+
+	public function getSection(): string {
+		return 'security';
+	}
+
+	public function getPriority(): int {
+		return 100;
+	}
+
+	private function getAppTokens(): array {
+		$tokens = $this->tokenProvider->getTokenByUser($this->uid);
+
+		try {
+			$sessionId = $this->session->getId();
+		} catch (SessionNotAvailableException $ex) {
+			return [];
+		}
+		try {
+			$sessionToken = $this->tokenProvider->getToken($sessionId);
+		} catch (InvalidTokenException $ex) {
+			return [];
+		}
+
+		return array_map(function (IToken $token) use ($sessionToken) {
+			$data = $token->jsonSerialize();
+			$data['canDelete'] = true;
+			$data['canRename'] = $token instanceof INamedToken && $data['type'] !== IToken::WIPE_TOKEN;
+			if ($sessionToken->getId() === $token->getId()) {
+				$data['canDelete'] = false;
+				$data['canRename'] = false;
+				$data['current'] = true;
+			}
+			return $data;
+		}, $tokens);
+	}
+}

wedding-pics/apps/settings/lib/Settings/Personal/Security/Password.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2017 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Julius Härtl <jus@bitgrid.net>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Settings\Personal\Security;
+
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\IUserManager;
+use OCP\Settings\ISettings;
+
+class Password implements ISettings {
+
+	/** @var IUserManager */
+	private $userManager;
+
+	/** @var string|null */
+	private $uid;
+
+	public function __construct(IUserManager $userManager,
+		?string $UserId) {
+		$this->userManager = $userManager;
+		$this->uid = $UserId;
+	}
+
+	public function getForm(): TemplateResponse {
+		$user = $this->userManager->get($this->uid);
+		$passwordChangeSupported = false;
+		if ($user !== null) {
+			$passwordChangeSupported = $user->canChangePassword();
+		}
+
+		return new TemplateResponse('settings', 'settings/personal/security/password', [
+			'passwordChangeSupported' => $passwordChangeSupported,
+		]);
+	}
+
+	public function getSection(): string {
+		return 'security';
+	}
+
+	public function getPriority(): int {
+		return 10;
+	}
+}

wedding-pics/apps/settings/lib/Settings/Personal/Security/TwoFactor.php

@@ -0,0 +1,136 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2019, Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Settings\Personal\Security;
+
+use Exception;
+use OC\Authentication\TwoFactorAuth\MandatoryTwoFactor;
+use OC\Authentication\TwoFactorAuth\ProviderLoader;
+use OCA\TwoFactorBackupCodes\Provider\BackupCodesProvider;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\Authentication\TwoFactorAuth\IProvider;
+use OCP\Authentication\TwoFactorAuth\IProvidesPersonalSettings;
+use OCP\IConfig;
+use OCP\IUserSession;
+use OCP\Settings\ISettings;
+use function array_filter;
+use function array_map;
+use function is_null;
+
+class TwoFactor implements ISettings {
+
+	/** @var ProviderLoader */
+	private $providerLoader;
+
+	/** @var MandatoryTwoFactor */
+	private $mandatoryTwoFactor;
+
+	/** @var IUserSession */
+	private $userSession;
+
+	/** @var string|null */
+	private $uid;
+
+	/** @var IConfig */
+	private $config;
+
+	public function __construct(ProviderLoader $providerLoader,
+		MandatoryTwoFactor $mandatoryTwoFactor,
+		IUserSession $userSession,
+		IConfig $config,
+		?string $UserId) {
+		$this->providerLoader = $providerLoader;
+		$this->mandatoryTwoFactor = $mandatoryTwoFactor;
+		$this->userSession = $userSession;
+		$this->uid = $UserId;
+		$this->config = $config;
+	}
+
+	public function getForm(): TemplateResponse {
+		return new TemplateResponse('settings', 'settings/personal/security/twofactor', [
+			'twoFactorProviderData' => $this->getTwoFactorProviderData(),
+		]);
+	}
+
+	public function getSection(): ?string {
+		if (!$this->shouldShow()) {
+			return null;
+		}
+		return 'security';
+	}
+
+	public function getPriority(): int {
+		return 15;
+	}
+
+	private function shouldShow(): bool {
+		$user = $this->userSession->getUser();
+		if (is_null($user)) {
+			// Actually impossible, but still …
+			return false;
+		}
+
+		// Anyone who's supposed to use 2FA should see 2FA settings
+		if ($this->mandatoryTwoFactor->isEnforcedFor($user)) {
+			return true;
+		}
+
+		// If there is at least one provider with personal settings but it's not
+		// the backup codes provider, then these settings should show.
+		try {
+			$providers = $this->providerLoader->getProviders($user);
+		} catch (Exception $e) {
+			// Let's hope for the best
+			return true;
+		}
+		foreach ($providers as $provider) {
+			if ($provider instanceof IProvidesPersonalSettings
+				&& !($provider instanceof BackupCodesProvider)) {
+				return true;
+			}
+		}
+		return false;
+	}
+
+	private function getTwoFactorProviderData(): array {
+		$user = $this->userSession->getUser();
+		if (is_null($user)) {
+			// Actually impossible, but still …
+			return [];
+		}
+
+		return [
+			'providers' => array_map(function (IProvidesPersonalSettings $provider) use ($user) {
+				return [
+					'provider' => $provider,
+					'settings' => $provider->getPersonalSettings($user)
+				];
+			}, array_filter($this->providerLoader->getProviders($user), function (IProvider $provider) {
+				return $provider instanceof IProvidesPersonalSettings;
+			}))
+		];
+	}
+}

wedding-pics/apps/settings/lib/Settings/Personal/Security/WebAuthn.php

@@ -0,0 +1,81 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020, Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Settings\Personal\Security;
+
+use OC\Authentication\WebAuthn\Db\PublicKeyCredentialMapper;
+use OC\Authentication\WebAuthn\Manager;
+use OCA\Settings\AppInfo\Application;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\IInitialStateService;
+use OCP\Settings\ISettings;
+
+class WebAuthn implements ISettings {
+
+	/** @var PublicKeyCredentialMapper */
+	private $mapper;
+
+	/** @var string */
+	private $uid;
+
+	/** @var IInitialStateService */
+	private $initialStateService;
+
+	/** @var Manager */
+	private $manager;
+
+	public function __construct(PublicKeyCredentialMapper $mapper,
+		string $UserId,
+		IInitialStateService $initialStateService,
+		Manager $manager) {
+		$this->mapper = $mapper;
+		$this->uid = $UserId;
+		$this->initialStateService = $initialStateService;
+		$this->manager = $manager;
+	}
+
+	public function getForm() {
+		$this->initialStateService->provideInitialState(
+			Application::APP_ID,
+			'webauthn-devices',
+			$this->mapper->findAllForUid($this->uid)
+		);
+
+		return new TemplateResponse('settings', 'settings/personal/security/webauthn', [
+		]);
+	}
+
+	public function getSection(): ?string {
+		if (!$this->manager->isWebAuthnAvailable()) {
+			return null;
+		}
+
+		return 'security';
+	}
+
+	public function getPriority(): int {
+		return 20;
+	}
+}

wedding-pics/apps/settings/lib/Settings/Personal/ServerDevNotice.php

@@ -0,0 +1,120 @@
+<?php
+/**
+ * @copyright 2016, Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @author Jan C. Borchardt <hey@jancborchardt.net>
+ * @author Julius Härtl <jus@bitgrid.net>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\Settings\Personal;
+
+use OCA\Viewer\Event\LoadViewer;
+use OCP\AppFramework\Http\TemplateResponse;
+use OCP\AppFramework\Services\IInitialState;
+use OCP\EventDispatcher\IEventDispatcher;
+use OCP\Files\IRootFolder;
+use OCP\IURLGenerator;
+use OCP\IUserSession;
+use OCP\Settings\ISettings;
+use OCP\Support\Subscription\IRegistry;
+use OCP\Util;
+
+class ServerDevNotice implements ISettings {
+
+	/** @var IRegistry */
+	private $registry;
+
+	/** @var IEventDispatcher */
+	private $eventDispatcher;
+
+	/** @var IRootFolder */
+	private $rootFolder;
+
+	/** @var IUserSession */
+	private $userSession;
+
+	/** @var IInitialState */
+	private $initialState;
+
+	/** @var IURLGenerator */
+	private $urlGenerator;
+
+	public function __construct(IRegistry $registry,
+		IEventDispatcher $eventDispatcher,
+		IRootFolder $rootFolder,
+		IUserSession $userSession,
+		IInitialState $initialState,
+		IURLGenerator $urlGenerator) {
+		$this->registry = $registry;
+		$this->eventDispatcher = $eventDispatcher;
+		$this->rootFolder = $rootFolder;
+		$this->userSession = $userSession;
+		$this->initialState = $initialState;
+		$this->urlGenerator = $urlGenerator;
+	}
+
+	/**
+	 * @return TemplateResponse
+	 */
+	public function getForm(): TemplateResponse {
+		$userFolder = $this->rootFolder->getUserFolder($this->userSession->getUser()->getUID());
+
+		$hasInitialState = false;
+
+		// If the Reasons to use Nextcloud.pdf file is here, let's init Viewer, also check that Viewer is there
+		if (class_exists(LoadViewer::class) && $userFolder->nodeExists('Reasons to use Nextcloud.pdf')) {
+			/**
+			 * @psalm-suppress UndefinedClass, InvalidArgument
+			 */
+			$this->eventDispatcher->dispatch(LoadViewer::class, new LoadViewer());
+			$hasInitialState = true;
+		}
+
+		// Always load the script
+		Util::addScript('settings', 'vue-settings-nextcloud-pdf');
+		$this->initialState->provideInitialState('has-reasons-use-nextcloud-pdf', $hasInitialState);
+
+		return new TemplateResponse('settings', 'settings/personal/development.notice', [
+			'reasons-use-nextcloud-pdf-link' => $this->urlGenerator->linkToRoute('settings.Reasons.getPdf')
+		]);
+	}
+
+	/**
+	 * @return string|null the section ID, e.g. 'sharing'
+	 */
+	public function getSection(): ?string {
+		if ($this->registry->delegateHasValidSubscription()) {
+			return null;
+		}
+
+		return 'personal-info';
+	}
+
+	/**
+	 * @return int whether the form should be rather on the top or bottom of
+	 * the admin section. The forms are arranged in ascending order of the
+	 * priority values. It is required to return a value between 0 and 100.
+	 *
+	 * E.g.: 70
+	 */
+	public function getPriority(): int {
+		return 1000;
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/AppDirsWithDifferentOwner.php

@@ -0,0 +1,104 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IL10N;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class AppDirsWithDifferentOwner implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+	) {
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('App directories owner');
+	}
+
+	public function getCategory(): string {
+		return 'security';
+	}
+
+	/**
+	 * Iterates through the configured app roots and
+	 * tests if the subdirectories are owned by the same user than the current user.
+	 *
+	 * @return string[]
+	 */
+	private function getAppDirsWithDifferentOwner(int $currentUser): array {
+		$appDirsWithDifferentOwner = [[]];
+
+		foreach (\OC::$APPSROOTS as $appRoot) {
+			if ($appRoot['writable'] === true) {
+				$appDirsWithDifferentOwner[] = $this->getAppDirsWithDifferentOwnerForAppRoot($currentUser, $appRoot);
+			}
+		}
+
+		$appDirsWithDifferentOwner = array_merge(...$appDirsWithDifferentOwner);
+		sort($appDirsWithDifferentOwner);
+
+		return $appDirsWithDifferentOwner;
+	}
+
+	/**
+	 * Tests if the directories for one apps directory are writable by the current user.
+	 *
+	 * @param int $currentUser The current user
+	 * @param array $appRoot The app root config
+	 * @return string[] The none writable directory paths inside the app root
+	 */
+	private function getAppDirsWithDifferentOwnerForAppRoot(int $currentUser, array $appRoot): array {
+		$appDirsWithDifferentOwner = [];
+		$appsPath = $appRoot['path'];
+		$appsDir = new \DirectoryIterator($appRoot['path']);
+
+		foreach ($appsDir as $fileInfo) {
+			if ($fileInfo->isDir() && !$fileInfo->isDot()) {
+				$absAppPath = $appsPath . DIRECTORY_SEPARATOR . $fileInfo->getFilename();
+				$appDirUser = fileowner($absAppPath);
+				if ($appDirUser !== $currentUser) {
+					$appDirsWithDifferentOwner[] = $absAppPath;
+				}
+			}
+		}
+
+		return $appDirsWithDifferentOwner;
+	}
+
+	public function run(): SetupResult {
+		$currentUser = posix_getuid();
+		$currentUserInfos = posix_getpwuid($currentUser) ?: [];
+		$appDirsWithDifferentOwner = $this->getAppDirsWithDifferentOwner($currentUser);
+		if (count($appDirsWithDifferentOwner) > 0) {
+			return SetupResult::warning(
+				$this->l10n->t("Some app directories are owned by a different user than the web server one. This may be the case if apps have been installed manually. Check the permissions of the following app directories:\n%s", implode("\n", $appDirsWithDifferentOwner))
+			);
+		} else {
+			return SetupResult::success($this->l10n->t('App directories have the correct owner "%s"', [$currentUserInfos['name'] ?? '']));
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/BruteForceThrottler.php

@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IL10N;
+use OCP\IRequest;
+use OCP\IURLGenerator;
+use OCP\Security\Bruteforce\IThrottler;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class BruteForceThrottler implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IURLGenerator $urlGenerator,
+		private IRequest $request,
+		private IThrottler $throttler,
+	) {
+	}
+
+	public function getCategory(): string {
+		return 'system';
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Brute-force Throttle');
+	}
+
+	public function run(): SetupResult {
+		$address = $this->request->getRemoteAddress();
+		if ($address === '') {
+			if (\OC::$CLI) {
+				/* We were called from CLI */
+				return SetupResult::info($this->l10n->t('Your remote address could not be determined.'));
+			} else {
+				/* Should never happen */
+				return SetupResult::error($this->l10n->t('Your remote address could not be determined.'));
+			}
+		} elseif ($this->throttler->showBruteforceWarning($address)) {
+			return SetupResult::error(
+				$this->l10n->t('Your remote address was identified as "%s" and is brute-force throttled at the moment slowing down the performance of various requests. If the remote address is not your address this can be an indication that a proxy is not configured correctly.', [$address]),
+				$this->urlGenerator->linkToDocs('admin-reverse-proxy')
+			);
+		} else {
+			return SetupResult::success(
+				$this->l10n->t('Your remote address "%s" is not brute-force throttled.', [$address])
+			);
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/CheckUserCertificates.php

@@ -0,0 +1,62 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020 Morris Jobke <hey@morrisjobke.de>
+ * @copyright Copyright (c) 2022 Carl Schwan <carl@carlschwan.eu>
+ *
+ * @author Morris Jobke <hey@morrisjobke.de>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class CheckUserCertificates implements ISetupCheck {
+	private string $configValue;
+
+	public function __construct(
+		private IL10N $l10n,
+		IConfig $config,
+	) {
+		$this->configValue = $config->getAppValue('files_external', 'user_certificate_scan', '');
+	}
+
+	public function getCategory(): string {
+		return 'security';
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Old user imported certificates');
+	}
+
+	public function run(): SetupResult {
+		// all fine if neither "not-run-yet" nor a result
+		if ($this->configValue === '') {
+			return SetupResult::success();
+		}
+		if ($this->configValue === 'not-run-yet') {
+			return SetupResult::info($this->l10n->t('A background job is pending that checks for user imported SSL certificates. Please check back later.'));
+		}
+		return SetupResult::error($this->l10n->t('There are some user imported SSL certificates present, that are not used anymore with Nextcloud 21. They can be imported on the command line via "occ security:certificates:import" command. Their paths inside the data directory are shown below.'));
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/CodeIntegrity.php

@@ -0,0 +1,76 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use OC\IntegrityCheck\Checker;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class CodeIntegrity implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IURLGenerator $urlGenerator,
+		private Checker $checker,
+	) {
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Code integrity');
+	}
+
+	public function getCategory(): string {
+		return 'security';
+	}
+
+	public function run(): SetupResult {
+		if (!$this->checker->isCodeCheckEnforced()) {
+			return SetupResult::info($this->l10n->t('Integrity checker has been disabled. Integrity cannot be verified.'));
+		} elseif ($this->checker->hasPassedCheck()) {
+			return SetupResult::success($this->l10n->t('No altered files'));
+		} else {
+			return SetupResult::error(
+				$this->l10n->t('Some files have not passed the integrity check. {link1} {link2}'),
+				$this->urlGenerator->linkToDocs('admin-code-integrity'),
+				[
+					'link1' => [
+						'type' => 'highlight',
+						'id' => 'getFailedIntegrityCheckFiles',
+						'name' => 'List of invalid files…',
+						'link' => $this->urlGenerator->linkToRoute('settings.CheckSetup.getFailedIntegrityCheckFiles'),
+					],
+					'link2' => [
+						'type' => 'highlight',
+						'id' => 'rescanFailedIntegrityCheck',
+						'name' => 'Rescan…',
+						'link' => $this->urlGenerator->linkToRoute('settings.CheckSetup.rescanFailedIntegrityCheck'),
+					],
+				],
+			);
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/CronErrors.php

@@ -0,0 +1,62 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class CronErrors implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IConfig $config,
+	) {
+	}
+
+	public function getCategory(): string {
+		return 'system';
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Cron errors');
+	}
+
+	public function run(): SetupResult {
+		$errors = json_decode($this->config->getAppValue('core', 'cronErrors', ''), true);
+		if (is_array($errors) && count($errors) > 0) {
+			return SetupResult::error(
+				$this->l10n->t(
+					"It was not possible to execute the cron job via CLI. The following technical errors have appeared:\n%s",
+					implode("\n", array_map(fn (array $error) => '- '.$error['error'].' '.$error['hint'], $errors))
+				)
+			);
+		} else {
+			return SetupResult::success($this->l10n->t('The last cron job ran without errors.'));
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/CronInfo.php

@@ -0,0 +1,81 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IConfig;
+use OCP\IDateTimeFormatter;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class CronInfo implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IConfig $config,
+		private IURLGenerator $urlGenerator,
+		private IDateTimeFormatter $dateTimeFormatter,
+	) {
+	}
+
+	public function getCategory(): string {
+		return 'system';
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Cron last run');
+	}
+
+	public function run(): SetupResult {
+		$lastCronRun = (int)$this->config->getAppValue('core', 'lastcron', '0');
+		$relativeTime = $this->dateTimeFormatter->formatTimeSpan($lastCronRun);
+
+		if ((time() - $lastCronRun) > 3600) {
+			return SetupResult::error(
+				$this->l10n->t(
+					'Last background job execution ran %s. Something seems wrong. {link}.',
+					[$relativeTime]
+				),
+				descriptionParameters:[
+					'link' => [
+						'type' => 'highlight',
+						'id' => 'backgroundjobs',
+						'name' => 'Check the background job settings',
+						'link' => $this->urlGenerator->linkToRoute('settings.AdminSettings.index', ['section' => 'server']) . '#backgroundjobs',
+					],
+				],
+			);
+		} else {
+			return SetupResult::success(
+				$this->l10n->t(
+					'Last background job execution ran %s.',
+					[$relativeTime]
+				)
+			);
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/DatabaseHasMissingColumns.php

@@ -0,0 +1,89 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use OC\DB\Connection;
+use OC\DB\MissingColumnInformation;
+use OC\DB\SchemaWrapper;
+use OCP\DB\Events\AddMissingColumnsEvent;
+use OCP\EventDispatcher\IEventDispatcher;
+use OCP\IL10N;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class DatabaseHasMissingColumns implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private Connection $connection,
+		private IEventDispatcher $dispatcher,
+	) {
+	}
+
+	public function getCategory(): string {
+		return 'database';
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Database missing columns');
+	}
+
+	private function getMissingColumns(): array {
+		$columnInfo = new MissingColumnInformation();
+		// Dispatch event so apps can also hint for pending column updates if needed
+		$event = new AddMissingColumnsEvent();
+		$this->dispatcher->dispatchTyped($event);
+		$missingColumns = $event->getMissingColumns();
+
+		if (!empty($missingColumns)) {
+			$schema = new SchemaWrapper($this->connection);
+			foreach ($missingColumns as $missingColumn) {
+				if ($schema->hasTable($missingColumn['tableName'])) {
+					$table = $schema->getTable($missingColumn['tableName']);
+					if (!$table->hasColumn($missingColumn['columnName'])) {
+						$columnInfo->addHintForMissingColumn($missingColumn['tableName'], $missingColumn['columnName']);
+					}
+				}
+			}
+		}
+
+		return $columnInfo->getListOfMissingColumns();
+	}
+
+	public function run(): SetupResult {
+		$missingColumns = $this->getMissingColumns();
+		if (empty($missingColumns)) {
+			return SetupResult::success('None');
+		} else {
+			$list = '';
+			foreach ($missingColumns as $missingColumn) {
+				$list .= "\n".$this->l10n->t('Missing optional column "%s" in table "%s".', [$missingColumn['columnName'], $missingColumn['tableName']]);
+			}
+			return SetupResult::warning(
+				$this->l10n->t('The database is missing some optional columns. Due to the fact that adding columns on big tables could take some time they were not added automatically when they can be optional. By running "occ db:add-missing-columns" those missing columns could be added manually while the instance keeps running. Once the columns are added some features might improve responsiveness or usability.').$list
+			);
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/DatabaseHasMissingIndices.php

@@ -0,0 +1,89 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use OC\DB\Connection;
+use OC\DB\MissingIndexInformation;
+use OC\DB\SchemaWrapper;
+use OCP\DB\Events\AddMissingIndicesEvent;
+use OCP\EventDispatcher\IEventDispatcher;
+use OCP\IL10N;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class DatabaseHasMissingIndices implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private Connection $connection,
+		private IEventDispatcher $dispatcher,
+	) {
+	}
+
+	public function getCategory(): string {
+		return 'database';
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Database missing indices');
+	}
+
+	private function getMissingIndices(): array {
+		$indexInfo = new MissingIndexInformation();
+		// Dispatch event so apps can also hint for pending index updates if needed
+		$event = new AddMissingIndicesEvent();
+		$this->dispatcher->dispatchTyped($event);
+		$missingIndices = $event->getMissingIndices();
+
+		if (!empty($missingIndices)) {
+			$schema = new SchemaWrapper($this->connection);
+			foreach ($missingIndices as $missingIndex) {
+				if ($schema->hasTable($missingIndex['tableName'])) {
+					$table = $schema->getTable($missingIndex['tableName']);
+					if (!$table->hasIndex($missingIndex['indexName'])) {
+						$indexInfo->addHintForMissingIndex($missingIndex['tableName'], $missingIndex['indexName']);
+					}
+				}
+			}
+		}
+
+		return $indexInfo->getListOfMissingIndices();
+	}
+
+	public function run(): SetupResult {
+		$missingIndices = $this->getMissingIndices();
+		if (empty($missingIndices)) {
+			return SetupResult::success('None');
+		} else {
+			$list = '';
+			foreach ($missingIndices as $missingIndex) {
+				$list .= "\n".$this->l10n->t('Missing optional index "%s" in table "%s".', [$missingIndex['indexName'], $missingIndex['tableName']]);
+			}
+			return SetupResult::warning(
+				$this->l10n->t('The database is missing some indexes. Due to the fact that adding indexes on big tables could take some time they were not added automatically. By running "occ db:add-missing-indices" those missing indexes could be added manually while the instance keeps running. Once the indexes are added queries to those tables are usually much faster.').$list
+			);
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/DatabaseHasMissingPrimaryKeys.php

@@ -0,0 +1,89 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use OC\DB\Connection;
+use OC\DB\MissingPrimaryKeyInformation;
+use OC\DB\SchemaWrapper;
+use OCP\DB\Events\AddMissingPrimaryKeyEvent;
+use OCP\EventDispatcher\IEventDispatcher;
+use OCP\IL10N;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class DatabaseHasMissingPrimaryKeys implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private Connection $connection,
+		private IEventDispatcher $dispatcher,
+	) {
+	}
+
+	public function getCategory(): string {
+		return 'database';
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Database missing primary keys');
+	}
+
+	private function getMissingPrimaryKeys(): array {
+		$primaryKeyInfo = new MissingPrimaryKeyInformation();
+		// Dispatch event so apps can also hint for pending primary key updates if needed
+		$event = new AddMissingPrimaryKeyEvent();
+		$this->dispatcher->dispatchTyped($event);
+		$missingPrimaryKeys = $event->getMissingPrimaryKeys();
+
+		if (!empty($missingPrimaryKeys)) {
+			$schema = new SchemaWrapper($this->connection);
+			foreach ($missingPrimaryKeys as $missingPrimaryKey) {
+				if ($schema->hasTable($missingPrimaryKey['tableName'])) {
+					$table = $schema->getTable($missingPrimaryKey['tableName']);
+					if ($table->getPrimaryKey() === null) {
+						$primaryKeyInfo->addHintForMissingPrimaryKey($missingPrimaryKey['tableName']);
+					}
+				}
+			}
+		}
+
+		return $primaryKeyInfo->getListOfMissingPrimaryKeys();
+	}
+
+	public function run(): SetupResult {
+		$missingPrimaryKeys = $this->getMissingPrimaryKeys();
+		if (empty($missingPrimaryKeys)) {
+			return SetupResult::success('None');
+		} else {
+			$list = '';
+			foreach ($missingPrimaryKeys as $missingPrimaryKey) {
+				$list .= "\n".$this->l10n->t('Missing primary key on table "%s".', [$missingPrimaryKey['tableName']]);
+			}
+			return SetupResult::warning(
+				$this->l10n->t('The database is missing some primary keys. Due to the fact that adding primary keys on big tables could take some time they were not added automatically. By running "occ db:add-missing-primary-keys" those missing primary keys could be added manually while the instance keeps running.').$list
+			);
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/DatabasePendingBigIntConversions.php

@@ -0,0 +1,99 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use Doctrine\DBAL\Types\BigIntType;
+use OC\Core\Command\Db\ConvertFilecacheBigInt;
+use OC\DB\Connection;
+use OC\DB\SchemaWrapper;
+use OCP\EventDispatcher\IEventDispatcher;
+use OCP\IDBConnection;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class DatabasePendingBigIntConversions implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IURLGenerator $urlGenerator,
+		private Connection $db,
+		private IEventDispatcher $dispatcher,
+		private IDBConnection $connection,
+	) {
+	}
+
+	public function getCategory(): string {
+		return 'database';
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Database pending bigint migrations');
+	}
+
+	protected function getBigIntConversionPendingColumns(): array {
+		$tables = ConvertFilecacheBigInt::getColumnsByTable();
+
+		$schema = new SchemaWrapper($this->db);
+		$isSqlite = $this->connection->getDatabaseProvider() === IDBConnection::PLATFORM_SQLITE;
+		$pendingColumns = [];
+
+		foreach ($tables as $tableName => $columns) {
+			if (!$schema->hasTable($tableName)) {
+				continue;
+			}
+
+			$table = $schema->getTable($tableName);
+			foreach ($columns as $columnName) {
+				$column = $table->getColumn($columnName);
+				$isAutoIncrement = $column->getAutoincrement();
+				$isAutoIncrementOnSqlite = $isSqlite && $isAutoIncrement;
+				if (!($column->getType() instanceof BigIntType) && !$isAutoIncrementOnSqlite) {
+					$pendingColumns[] = $tableName . '.' . $columnName;
+				}
+			}
+		}
+
+		return $pendingColumns;
+	}
+
+	public function run(): SetupResult {
+		$pendingColumns = $this->getBigIntConversionPendingColumns();
+		if (empty($pendingColumns)) {
+			return SetupResult::success('None');
+		} else {
+			$list = '';
+			foreach ($pendingColumns as $pendingColumn) {
+				$list .= "\n$pendingColumn";
+			}
+			$list .= "\n";
+			return SetupResult::info(
+				$this->l10n->t('Some columns in the database are missing a conversion to big int. Due to the fact that changing column types on big tables could take some time they were not changed automatically. By running "occ db:convert-filecache-bigint" those pending changes could be applied manually. This operation needs to be made while the instance is offline.').$list,
+				$this->urlGenerator->linkToDocs('admin-bigint-conversion')
+			);
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/DefaultPhoneRegionSet.php

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class DefaultPhoneRegionSet implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IConfig $config,
+	) {
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Default phone region');
+	}
+
+	public function getCategory(): string {
+		return 'config';
+	}
+
+	public function run(): SetupResult {
+		if ($this->config->getSystemValueString('default_phone_region', '') !== '') {
+			return SetupResult::success($this->config->getSystemValueString('default_phone_region', ''));
+		} else {
+			return SetupResult::info(
+				$this->l10n->t('Your installation has no default phone region set. This is required to validate phone numbers in the profile settings without a country code. To allow numbers without a country code, please add "default_phone_region" with the respective ISO 3166-1 code of the region to your config file.'),
+				'https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2#Officially_assigned_code_elements'
+			);
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/EmailTestSuccessful.php

@@ -0,0 +1,76 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class EmailTestSuccessful implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IConfig $config,
+		private IURLGenerator $urlGenerator,
+	) {
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Email test');
+	}
+
+	public function getCategory(): string {
+		return 'config';
+	}
+
+	protected function wasEmailTestSuccessful(): bool {
+		// Handle the case that the configuration was set before the check was introduced or it was only set via command line and not from the UI
+		if ($this->config->getAppValue('core', 'emailTestSuccessful', '') === '' && $this->config->getSystemValue('mail_domain', '') === '') {
+			return false;
+		}
+
+		// The mail test was unsuccessful or the config was changed using the UI without verifying with a testmail, hence return false
+		if ($this->config->getAppValue('core', 'emailTestSuccessful', '') === '0') {
+			return false;
+		}
+
+		return true;
+	}
+
+	public function run(): SetupResult {
+		if ($this->wasEmailTestSuccessful()) {
+			return SetupResult::success($this->l10n->t('Email test was successfully sent'));
+		} else {
+			// If setup check could link to settings pages, this one should link to OC.generateUrl('/settings/admin')
+			return SetupResult::info(
+				$this->l10n->t('You have not set or verified your email server configuration, yet. Please head over to the "Basic settings" in order to set them. Afterwards, use the "Send email" button below the form to verify your settings.'),
+				$this->urlGenerator->linkToDocs('admin-email')
+			);
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/FileLocking.php

@@ -0,0 +1,78 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Settings\SetupChecks;
+
+use OC\Lock\DBLockingProvider;
+use OC\Lock\NoopLockingProvider;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\Lock\ILockingProvider;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class FileLocking implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IURLGenerator $urlGenerator,
+		private ILockingProvider $lockingProvider,
+	) {
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('File locking');
+	}
+
+	public function getCategory(): string {
+		return 'system';
+	}
+
+	protected function hasWorkingFileLocking(): bool {
+		return !($this->lockingProvider instanceof NoopLockingProvider);
+	}
+
+	protected function hasDBFileLocking(): bool {
+		return ($this->lockingProvider instanceof DBLockingProvider);
+	}
+
+	public function run(): SetupResult {
+		if (!$this->hasWorkingFileLocking()) {
+			return SetupResult::warning(
+				$this->l10n->t('Transactional file locking is disabled, this might lead to issues with race conditions. Enable "filelocking.enabled" in config.php to avoid these problems.'),
+				$this->urlGenerator->linkToDocs('admin-transactional-locking')
+			);
+		}
+
+		if ($this->hasDBFileLocking()) {
+			return SetupResult::info(
+				$this->l10n->t('The database is used for transactional file locking. To enhance performance, please configure memcache, if available.'),
+				$this->urlGenerator->linkToDocs('admin-transactional-locking')
+			);
+		}
+
+		return SetupResult::success();
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/ForwardedForHeaders.php

@@ -0,0 +1,94 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\IRequest;
+use OCP\IURLGenerator;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class ForwardedForHeaders implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IConfig $config,
+		private IURLGenerator $urlGenerator,
+		private IRequest $request,
+	) {
+	}
+
+	public function getCategory(): string {
+		return 'security';
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Forwarded for headers');
+	}
+
+	public function run(): SetupResult {
+		$trustedProxies = $this->config->getSystemValue('trusted_proxies', []);
+		$remoteAddress = $this->request->getHeader('REMOTE_ADDR');
+		$detectedRemoteAddress = $this->request->getRemoteAddress();
+
+		if (!\is_array($trustedProxies)) {
+			return SetupResult::error($this->l10n->t('Your "trusted_proxies" setting is not correctly set, it should be an array.'));
+		}
+
+		if (($remoteAddress === '') && ($detectedRemoteAddress === '')) {
+			if (\OC::$CLI) {
+				/* We were called from CLI */
+				return SetupResult::info($this->l10n->t('Your remote address could not be determined.'));
+			} else {
+				/* Should never happen */
+				return SetupResult::error($this->l10n->t('Your remote address could not be determined.'));
+			}
+		}
+
+		if (empty($trustedProxies) && $this->request->getHeader('X-Forwarded-Host') !== '') {
+			return SetupResult::error(
+				$this->l10n->t('The reverse proxy header configuration is incorrect. This is a security issue and can allow an attacker to spoof their IP address as visible to the Nextcloud.'),
+				$this->urlGenerator->linkToDocs('admin-reverse-proxy')
+			);
+		}
+
+		if (\in_array($remoteAddress, $trustedProxies, true) && ($remoteAddress !== '127.0.0.1')) {
+			if ($remoteAddress !== $detectedRemoteAddress) {
+				/* Remote address was successfuly fixed */
+				return SetupResult::success($this->l10n->t('Your IP address was resolved as %s', [$detectedRemoteAddress]));
+			} else {
+				return SetupResult::warning(
+					$this->l10n->t('The reverse proxy header configuration is incorrect, or you are accessing Nextcloud from a trusted proxy. If not, this is a security issue and can allow an attacker to spoof their IP address as visible to the Nextcloud.'),
+					$this->urlGenerator->linkToDocs('admin-reverse-proxy')
+				);
+			}
+		}
+
+		/* Either not enabled or working correctly */
+		return SetupResult::success();
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/InternetConnectivity.php

@@ -0,0 +1,100 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use OCP\Http\Client\IClientService;
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+use Psr\Log\LoggerInterface;
+
+/**
+ * Checks if the server can connect to the internet using HTTPS and HTTP
+ */
+class InternetConnectivity implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IConfig $config,
+		private IClientService $clientService,
+		private LoggerInterface $logger,
+	) {
+	}
+
+	public function getCategory(): string {
+		return 'network';
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Internet connectivity');
+	}
+
+	public function run(): SetupResult {
+		if ($this->config->getSystemValue('has_internet_connection', true) === false) {
+			return SetupResult::success($this->l10n->t('Internet connectivity is disabled in configuration file.'));
+		}
+
+		$siteArray = $this->config->getSystemValue('connectivity_check_domains', [
+			'www.nextcloud.com', 'www.startpage.com', 'www.eff.org', 'www.edri.org'
+		]);
+
+		foreach ($siteArray as $site) {
+			if ($this->isSiteReachable($site)) {
+				return SetupResult::success();
+			}
+		}
+		return SetupResult::warning($this->l10n->t('This server has no working internet connection: Multiple endpoints could not be reached. This means that some of the features like mounting external storage, notifications about updates or installation of third-party apps will not work. Accessing files remotely and sending of notification emails might not work, either. Establish a connection from this server to the internet to enjoy all features.'));
+	}
+
+	/**
+	 * Checks if the Nextcloud server can connect to a specific URL
+	 * @param string $site site domain or full URL with http/https protocol
+	 */
+	private function isSiteReachable(string $site): bool {
+		try {
+			$client = $this->clientService->newClient();
+			// if there is no protocol, test http:// AND https://
+			if (preg_match('/^https?:\/\//', $site) !== 1) {
+				$httpSite = 'http://' . $site . '/';
+				$client->get($httpSite);
+				$httpsSite = 'https://' . $site . '/';
+				$client->get($httpsSite);
+			} else {
+				$client->get($site);
+			}
+		} catch (\Exception $e) {
+			$this->logger->error('Cannot connect to: ' . $site, [
+				'app' => 'internet_connection_check',
+				'exception' => $e,
+			]);
+			return false;
+		}
+		return true;
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/JavaScriptModules.php

@@ -0,0 +1,86 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Ferdinand Thiessen <opensource@fthiessen.de>
+ *
+ * @author Ferdinand Thiessen <opensource@fthiessen.de>
+ *
+ * @license AGPL-3.0-or-later
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use OCP\Http\Client\IClientService;
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+use Psr\Log\LoggerInterface;
+
+/**
+ * Checks if the webserver serves '.mjs' files using the correct MIME type
+ */
+class JavaScriptModules implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IConfig $config,
+		private IURLGenerator $urlGenerator,
+		private IClientService $clientService,
+		private LoggerInterface $logger,
+	) {
+	}
+
+	public function getCategory(): string {
+		return 'network';
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('JavaScript modules support');
+	}
+
+	public function run(): SetupResult {
+		$testFile = $this->urlGenerator->linkTo('settings', 'js/esm-test.mjs');
+		$testURLs = array_merge(
+			[$this->urlGenerator->getAbsoluteURL($testFile)],
+			array_map(fn (string $host): string => $host . $testFile, $this->config->getSystemValue('trusted_domains', []))
+		);
+
+		foreach ($testURLs as $testURL) {
+			try {
+				$client = $this->clientService->newClient();
+				$response = $client->head($testURL, [
+					'connect_timeout' => 10,
+					// Disable SSL certificate checks to allow self signed certs
+					'verify' => false,
+					// Allow to connect to local server
+					'nextcloud' => [
+						'allow_local_address' => true,
+					],
+				]);
+				if (preg_match('/(text|application)\/javascript/i', $response->getHeader('Content-Type'))) {
+					return SetupResult::success();
+				}
+			} catch (\Throwable $e) {
+				$this->logger->debug('Can not connect to local server for checking JavaScript modules support', ['exception' => $e, 'url' => $testURL]);
+				return SetupResult::warning($this->l10n->t('Could not check for JavaScript support. Please check manually if your webserver serves `.mjs` files using the JavaScript MIME type.'));
+			}
+		}
+		return SetupResult::error($this->l10n->t('Your webserver does not serve `.mjs` files using the JavaScript MIME type. This will break some apps by preventing browsers from executing the JavaScript files. You should configure your webserver to serve `.mjs` files with either the `text/javascript` or `application/javascript` MIME type.'));
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/LegacySSEKeyFormat.php

@@ -0,0 +1,56 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020 Morris Jobke <hey@morrisjobke.de>
+ *
+ * @author Morris Jobke <hey@morrisjobke.de>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class LegacySSEKeyFormat implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IConfig $config,
+		private IURLGenerator $urlGenerator,
+	) {
+	}
+
+	public function getCategory(): string {
+		return 'security';
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Old server-side-encryption');
+	}
+
+	public function run(): SetupResult {
+		if ($this->config->getSystemValueBool('encryption.legacy_format_support', false) === false) {
+			return SetupResult::success($this->l10n->t('Disabled'));
+		}
+		return SetupResult::warning($this->l10n->t('The old server-side-encryption format is enabled. We recommend disabling this.'), $this->urlGenerator->linkToDocs('admin-sse-legacy-format'));
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/MaintenanceWindowStart.php

@@ -0,0 +1,70 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Joas Schilling <coding@schilljs.com>
+ *
+ * @author Joas Schilling <coding@schilljs.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class MaintenanceWindowStart implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IURLGenerator $urlGenerator,
+		private IConfig $config,
+	) {
+	}
+
+	public function getCategory(): string {
+		return 'system';
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Maintenance window start');
+	}
+
+	public function run(): SetupResult {
+		$configValue = $this->config->getSystemValue('maintenance_window_start', null);
+		if ($configValue === null) {
+			return SetupResult::warning(
+				$this->l10n->t('Server has no maintenance window start time configured. This means resource intensive daily background jobs will also be executed during your main usage time. We recommend to set it to a time of low usage, so users are less impacted by the load caused from these heavy tasks.'),
+				$this->urlGenerator->linkToDocs('admin-background-jobs')
+			);
+		}
+
+		$startValue = (int) $configValue;
+		$endValue = ($startValue + 6) % 24;
+		return SetupResult::success(
+			str_replace(
+				['{start}', '{end}'],
+				[$startValue, $endValue],
+				$this->l10n->t('Maintenance window to execute heavy background jobs is between {start}:00 UTC and {end}:00 UTC')
+			)
+		);
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/MemcacheConfigured.php

@@ -0,0 +1,60 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class MemcacheConfigured implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IConfig $config,
+		private IURLGenerator $urlGenerator,
+	) {
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Memcache');
+	}
+
+	public function getCategory(): string {
+		return 'system';
+	}
+
+	public function run(): SetupResult {
+		if ($this->config->getSystemValue('memcache.local', null) !== null) {
+			return SetupResult::success($this->l10n->t('Configured'));
+		} else {
+			return SetupResult::info(
+				$this->l10n->t('No memory cache has been configured. To enhance performance, please configure a memcache, if available.'),
+				$this->urlGenerator->linkToDocs('admin-performance')
+			);
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/OverwriteCliUrl.php

@@ -0,0 +1,81 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\IRequest;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class OverwriteCliUrl implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IConfig $config,
+		private IRequest $request,
+	) {
+	}
+
+	public function getCategory(): string {
+		return 'config';
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Overwrite cli URL');
+	}
+
+	public function run(): SetupResult {
+		$currentOverwriteCliUrl = $this->config->getSystemValue('overwrite.cli.url', '');
+		$suggestedOverwriteCliUrl = $this->request->getServerProtocol() . '://' . $this->request->getInsecureServerHost() . \OC::$WEBROOT;
+
+		// Check correctness by checking if it is a valid URL
+		if (filter_var($currentOverwriteCliUrl, FILTER_VALIDATE_URL)) {
+			if ($currentOverwriteCliUrl == $suggestedOverwriteCliUrl) {
+				return SetupResult::success(
+					$this->l10n->t(
+						'The "overwrite.cli.url" option in your config.php is correctly set to "%s".',
+						[$currentOverwriteCliUrl]
+					)
+				);
+			} else {
+				return SetupResult::success(
+					$this->l10n->t(
+						'The "overwrite.cli.url" option in your config.php is set to "%s" which is a correct URL. Suggested URL is "%s".',
+						[$currentOverwriteCliUrl, $suggestedOverwriteCliUrl]
+					)
+				);
+			}
+		} else {
+			return SetupResult::warning(
+				$this->l10n->t(
+					'Please make sure to set the "overwrite.cli.url" option in your config.php file to the URL that your users mainly use to access this Nextcloud. Suggestion: "%s". Otherwise there might be problems with the URL generation via cron. (It is possible though that the suggested URL is not the URL that your users mainly use to access this Nextcloud. Best is to double check this in any case.)',
+					[$suggestedOverwriteCliUrl]
+				)
+			);
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/PhpDefaultCharset.php

@@ -0,0 +1,53 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020 Daniel Kesselberg <mail@danielkesselberg.de>
+ *
+ * @author Daniel Kesselberg <mail@danielkesselberg.de>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IL10N;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class PhpDefaultCharset implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+	) {
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('PHP default charset');
+	}
+
+	public function getCategory(): string {
+		return 'php';
+	}
+
+	public function run(): SetupResult {
+		if (strtoupper(trim(ini_get('default_charset'))) === 'UTF-8') {
+			return SetupResult::success('UTF-8');
+		} else {
+			return SetupResult::warning($this->l10n->t('PHP configuration option "default_charset" should be UTF-8'));
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/PhpFreetypeSupport.php

@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IL10N;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class PhpFreetypeSupport implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+	) {
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Freetype');
+	}
+
+	public function getCategory(): string {
+		return 'php';
+	}
+
+	/**
+	 * Check if the required FreeType functions are present
+	 */
+	protected function hasFreeTypeSupport(): bool {
+		return function_exists('imagettfbbox') && function_exists('imagettftext');
+	}
+
+	public function run(): SetupResult {
+		if ($this->hasFreeTypeSupport()) {
+			return SetupResult::success($this->l10n->t('Supported'));
+		} else {
+			return SetupResult::info(
+				$this->l10n->t('Your PHP does not have FreeType support, resulting in breakage of profile pictures and the settings interface.'),
+			);
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/PhpGetEnv.php

@@ -0,0 +1,55 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020 Daniel Kesselberg <mail@danielkesselberg.de>
+ *
+ * @author Daniel Kesselberg <mail@danielkesselberg.de>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class PhpGetEnv implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IURLGenerator $urlGenerator,
+	) {
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('PHP getenv');
+	}
+
+	public function getCategory(): string {
+		return 'php';
+	}
+
+	public function run(): SetupResult {
+		if (!empty(getenv('PATH'))) {
+			return SetupResult::success();
+		} else {
+			return SetupResult::warning($this->l10n->t('PHP does not seem to be setup properly to query system environment variables. The test with getenv("PATH") only returns an empty response.'), $this->urlGenerator->linkToDocs('admin-php-fpm'));
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/PhpMemoryLimit.php

@@ -0,0 +1,57 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Settings\SetupChecks;
+
+use OC\MemoryInfo;
+use OCP\IL10N;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+use OCP\Util;
+
+class PhpMemoryLimit implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private MemoryInfo $memoryInfo,
+	) {
+	}
+
+	public function getCategory(): string {
+		return 'php';
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('PHP memory limit');
+	}
+
+	public function run(): SetupResult {
+		if ($this->memoryInfo->isMemoryLimitSufficient()) {
+			return SetupResult::success(Util::humanFileSize($this->memoryInfo->getMemoryLimit()));
+		} else {
+			return SetupResult::error($this->l10n->t('The PHP memory limit is below the recommended value of %s.', Util::humanFileSize(MemoryInfo::RECOMMENDED_MEMORY_LIMIT)));
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/PhpModules.php

@@ -0,0 +1,102 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class PhpModules implements ISetupCheck {
+	protected const REQUIRED_MODULES = [
+		'ctype',
+		'curl',
+		'dom',
+		'fileinfo',
+		'gd',
+		'json',
+		'mbstring',
+		'openssl',
+		'posix',
+		'session',
+		'xml',
+		'xmlreader',
+		'xmlwriter',
+		'zip',
+		'zlib',
+	];
+	protected const RECOMMENDED_MODULES = [
+		'exif',
+		'intl',
+		'sodium',
+		'sysvsem',
+	];
+
+	public function __construct(
+		private IL10N $l10n,
+		private IURLGenerator $urlGenerator,
+	) {
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('PHP modules');
+	}
+
+	public function getCategory(): string {
+		return 'system';
+	}
+
+	public function run(): SetupResult {
+		$missingRecommendedModules = $this->getMissingModules(self::RECOMMENDED_MODULES);
+		$missingRequiredModules = $this->getMissingModules(self::REQUIRED_MODULES);
+		if (!empty($missingRequiredModules)) {
+			return SetupResult::error(
+				$this->l10n->t('This instance is missing some required PHP modules. It is required to install them: %s.', implode(', ', $missingRequiredModules)),
+				$this->urlGenerator->linkToDocs('admin-php-modules')
+			);
+		} elseif (!empty($missingRecommendedModules)) {
+			return SetupResult::info(
+				$this->l10n->t('This instance is missing some recommended PHP modules. For improved performance and better compatibility it is highly recommended to install them: %s.', implode(', ', $missingRecommendedModules)),
+				$this->urlGenerator->linkToDocs('admin-php-modules')
+			);
+		} else {
+			return SetupResult::success();
+		}
+	}
+
+	/**
+	 * Checks for potential PHP modules that would improve the instance
+	 *
+	 * @param string[] $modules modules to test
+	 * @return string[] A list of PHP modules which are missing
+	 */
+	protected function getMissingModules(array $modules): array {
+		return array_values(array_filter(
+			$modules,
+			fn (string $module) => !extension_loaded($module),
+		));
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/PhpOpcacheSetup.php

@@ -0,0 +1,148 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use bantu\IniGetWrapper\IniGetWrapper;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class PhpOpcacheSetup implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IURLGenerator $urlGenerator,
+		private IniGetWrapper $iniGetWrapper,
+	) {
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('PHP opcache');
+	}
+
+	public function getCategory(): string {
+		return 'php';
+	}
+
+	/**
+	 * Checks whether a PHP OPcache is properly set up
+	 * @return array{'warning'|'error',list<string>} The level and the list of OPcache setup recommendations
+	 */
+	protected function getOpcacheSetupRecommendations(): array {
+		$level = 'warning';
+
+		// If the module is not loaded, return directly to skip inapplicable checks
+		if (!extension_loaded('Zend OPcache')) {
+			return ['error',[$this->l10n->t('The PHP OPcache module is not loaded. For better performance it is recommended to load it into your PHP installation.')]];
+		}
+
+		$recommendations = [];
+
+		// Check whether Nextcloud is allowed to use the OPcache API
+		$isPermitted = true;
+		$permittedPath = (string)$this->iniGetWrapper->getString('opcache.restrict_api');
+		if ($permittedPath !== '' && !str_starts_with(\OC::$SERVERROOT, rtrim($permittedPath, '/'))) {
+			$isPermitted = false;
+		}
+
+		if (!$this->iniGetWrapper->getBool('opcache.enable')) {
+			$recommendations[] = $this->l10n->t('OPcache is disabled. For better performance, it is recommended to apply "opcache.enable=1" to your PHP configuration.');
+			$level = 'error';
+		} elseif ($this->iniGetWrapper->getBool('opcache.file_cache_only')) {
+			$recommendations[] = $this->l10n->t('The shared memory based OPcache is disabled. For better performance, it is recommended to apply "opcache.file_cache_only=0" to your PHP configuration and use the file cache as second level cache only.');
+		} else {
+			// Check whether opcache_get_status has been explicitly disabled an in case skip usage based checks
+			$disabledFunctions = $this->iniGetWrapper->getString('disable_functions');
+			if (isset($disabledFunctions) && str_contains($disabledFunctions, 'opcache_get_status')) {
+				return [$level, $recommendations];
+			}
+
+			$status = opcache_get_status(false);
+
+			if ($status === false) {
+				$recommendations[] = $this->l10n->t('OPcache is not working as it should, opcache_get_status() returns false, please check configuration.');
+				$level = 'error';
+			}
+
+			// Recommend to raise value, if more than 90% of max value is reached
+			if (
+				empty($status['opcache_statistics']['max_cached_keys']) ||
+				($status['opcache_statistics']['num_cached_keys'] / $status['opcache_statistics']['max_cached_keys'] > 0.9)
+			) {
+				$recommendations[] = $this->l10n->t('The maximum number of OPcache keys is nearly exceeded. To assure that all scripts can be kept in the cache, it is recommended to apply "opcache.max_accelerated_files" to your PHP configuration with a value higher than "%s".', [($this->iniGetWrapper->getNumeric('opcache.max_accelerated_files') ?: 'currently')]);
+			}
+
+			if (
+				empty($status['memory_usage']['free_memory']) ||
+				($status['memory_usage']['used_memory'] / $status['memory_usage']['free_memory'] > 9)
+			) {
+				$recommendations[] = $this->l10n->t('The OPcache buffer is nearly full. To assure that all scripts can be hold in cache, it is recommended to apply "opcache.memory_consumption" to your PHP configuration with a value higher than "%s".', [($this->iniGetWrapper->getNumeric('opcache.memory_consumption') ?: 'currently')]);
+			}
+
+			if (
+				// Do not recommend to raise the interned strings buffer size above a quarter of the total OPcache size
+				($this->iniGetWrapper->getNumeric('opcache.interned_strings_buffer') ?? 0 < $this->iniGetWrapper->getNumeric('opcache.memory_consumption') ?? 0 / 4) &&
+				(
+					empty($status['interned_strings_usage']['free_memory']) ||
+					($status['interned_strings_usage']['used_memory'] / $status['interned_strings_usage']['free_memory'] > 9)
+				)
+			) {
+				$recommendations[] = $this->l10n->t('The OPcache interned strings buffer is nearly full. To assure that repeating strings can be effectively cached, it is recommended to apply "opcache.interned_strings_buffer" to your PHP configuration with a value higher than "%s".', [($this->iniGetWrapper->getNumeric('opcache.interned_strings_buffer') ?: 'currently')]);
+			}
+		}
+
+		// Check for saved comments only when OPcache is currently disabled. If it was enabled, opcache.save_comments=0 would break Nextcloud in the first place.
+		if (!$this->iniGetWrapper->getBool('opcache.save_comments')) {
+			$recommendations[] = $this->l10n->t('OPcache is configured to remove code comments. With OPcache enabled, "opcache.save_comments=1" must be set for Nextcloud to function.');
+			$level = 'error';
+		}
+
+		if (!$isPermitted) {
+			$recommendations[] = $this->l10n->t('Nextcloud is not allowed to use the OPcache API. With OPcache enabled, it is highly recommended to include all Nextcloud directories with "opcache.restrict_api" or unset this setting to disable OPcache API restrictions, to prevent errors during Nextcloud core or app upgrades.');
+			$level = 'error';
+		}
+
+		return [$level, $recommendations];
+	}
+
+	public function run(): SetupResult {
+		[$level,$recommendations] = $this->getOpcacheSetupRecommendations();
+		if (!empty($recommendations)) {
+			return match($level) {
+				'error' => SetupResult::error(
+					$this->l10n->t('The PHP OPcache module is not properly configured. %s.', implode("\n", $recommendations)),
+					$this->urlGenerator->linkToDocs('admin-php-opcache')
+				),
+				default => SetupResult::warning(
+					$this->l10n->t('The PHP OPcache module is not properly configured. %s.', implode("\n", $recommendations)),
+					$this->urlGenerator->linkToDocs('admin-php-opcache')
+				),
+			};
+		} else {
+			return SetupResult::success($this->l10n->t('Correctly configured'));
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/PhpOutdated.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2022 Carl Schwan <carl@carlschwan.eu>
+ *
+ * @author Carl Schwan <carl@carlschwan.eu>
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IL10N;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class PhpOutdated implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+	) {
+	}
+
+	public function getCategory(): string {
+		return 'security';
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('PHP version');
+	}
+
+	public function run(): SetupResult {
+		if (PHP_VERSION_ID < 80100) {
+			return SetupResult::warning($this->l10n->t('You are currently running PHP %s. PHP 8.0 is now deprecated in Nextcloud 27. Nextcloud 28 may require at least PHP 8.1. Please upgrade to one of the officially supported PHP versions provided by the PHP Group as soon as possible.', [PHP_VERSION]), 'https://secure.php.net/supported-versions.php');
+		}
+		return SetupResult::success($this->l10n->t('You are currently running PHP %s.', [PHP_VERSION]));
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/PhpOutputBuffering.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2020 Daniel Kesselberg <mail@danielkesselberg.de>
+ *
+ * @author Daniel Kesselberg <mail@danielkesselberg.de>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IL10N;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class PhpOutputBuffering implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+	) {
+	}
+
+	public function getCategory(): string {
+		return 'php';
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('PHP "output_buffering" option');
+	}
+
+	public function run(): SetupResult {
+		$value = trim(ini_get('output_buffering'));
+		if ($value === '' || $value === '0') {
+			return SetupResult::success($this->l10n->t('Disabled'));
+		} else {
+			return SetupResult::error($this->l10n->t('PHP configuration option "output_buffering" must be disabled'));
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/RandomnessSecure.php

@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\Security\ISecureRandom;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class RandomnessSecure implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IConfig $config,
+		private IURLGenerator $urlGenerator,
+		private ISecureRandom $secureRandom,
+	) {
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Random generator');
+	}
+
+	public function getCategory(): string {
+		return 'security';
+	}
+
+	public function run(): SetupResult {
+		try {
+			$this->secureRandom->generate(1);
+		} catch (\Exception $ex) {
+			return SetupResult::error(
+				$this->l10n->t('No suitable source for randomness found by PHP which is highly discouraged for security reasons.'),
+				$this->urlGenerator->linkToDocs('admin-security')
+			);
+		}
+		return SetupResult::success($this->l10n->t('Secure'));
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/ReadOnlyConfig.php

@@ -0,0 +1,55 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @author Côme Chilliet <come.chilliet@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use OCP\IConfig;
+use OCP\IL10N;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class ReadOnlyConfig implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IConfig $config,
+	) {
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Configuration file access rights');
+	}
+
+	public function getCategory(): string {
+		return 'config';
+	}
+
+	public function run(): SetupResult {
+		if ($this->config->getSystemValueBool('config_is_read_only', false)) {
+			return SetupResult::info($this->l10n->t('The read-only config has been enabled. This prevents setting some configurations via the web-interface. Furthermore, the file needs to be made writable manually for every update.'));
+		} else {
+			return SetupResult::success($this->l10n->t('Nextcloud configuration file is writable'));
+		}
+	}
+}

wedding-pics/apps/settings/lib/SetupChecks/SupportedDatabase.php

@@ -0,0 +1,95 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2021 Morris Jobke <hey@morrisjobke.de>
+ *
+ * @author Claas Augner <github@caugner.de>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Vincent Petry <vincent@nextcloud.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OCA\Settings\SetupChecks;
+
+use Doctrine\DBAL\Platforms\MySQLPlatform;
+use Doctrine\DBAL\Platforms\OraclePlatform;
+use Doctrine\DBAL\Platforms\PostgreSQLPlatform;
+use Doctrine\DBAL\Platforms\SqlitePlatform;
+use OCP\IDBConnection;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\SetupCheck\ISetupCheck;
+use OCP\SetupCheck\SetupResult;
+
+class SupportedDatabase implements ISetupCheck {
+	public function __construct(
+		private IL10N $l10n,
+		private IURLGenerator $urlGenerator,
+		private IDBConnection $connection,
+	) {
+	}
+
+	public function getCategory(): string {
+		return 'database';
+	}
+
+	public function getName(): string {
+		return $this->l10n->t('Database version');
+	}
+
+	public function run(): SetupResult {
+		$version = null;
+		$databasePlatform = $this->connection->getDatabasePlatform();
+		if ($databasePlatform instanceof MySQLPlatform) {
+			$result = $this->connection->prepare("SHOW VARIABLES LIKE 'version';");
+			$result->execute();
+			$row = $result->fetch();
+			$version = $row['Value'];
+			$versionlc = strtolower($version);
+
+			if (str_contains($versionlc, 'mariadb')) {
+				if (version_compare($versionlc, '10.2', '<')) {
+					return SetupResult::warning($this->l10n->t('MariaDB version "%s" is used. Nextcloud 21 and higher do not support this version and require MariaDB 10.2 or higher.', $version));
+				}
+			} else {
+				if (version_compare($versionlc, '8', '<')) {
+					return SetupResult::warning($this->l10n->t('MySQL version "%s" is used. Nextcloud 21 and higher do not support this version and require MySQL 8.0 or MariaDB 10.2 or higher.', $version));
+				}
+			}
+		} elseif ($databasePlatform instanceof PostgreSQLPlatform) {
+			$result = $this->connection->prepare('SHOW server_version;');
+			$result->execute();
+			$row = $result->fetch();
+			$version = $row['server_version'];
+			if (version_compare(strtolower($version), '9.6', '<')) {
+				return SetupResult::warning($this->l10n->t('PostgreSQL version "%s" is used. Nextcloud 21 and higher do not support this version and require PostgreSQL 9.6 or higher.', $version));
+			}
+		} elseif ($databasePlatform instanceof OraclePlatform) {
+			$version = 'Oracle';
+		} elseif ($databasePlatform instanceof SqlitePlatform) {
+			return SetupResult::warning(
+				$this->l10n->t('SQLite is currently being used as the backend database. For larger installations we recommend that you switch to a different database backend. This is particularly recommended when using the desktop client for file synchronisation. To migrate to another database use the command line tool: "occ db:convert-type".'),
+				$this->urlGenerator->linkToDocs('admin-db-conversion')
+			);
+		} else {
+			return SetupResult::error($this->l10n->t('Unknown database platform'));
+		}
+		return SetupResult::success($version);
+	}
+}