juzim / nc-wishlist

Nextcloud App Tutorial

This is the tutorial app which shows how to develop a very simple notes app.

Try it

To install it change into your Nextcloud's apps directory:

cd nextcloud/apps

Then run:

git clone https://github.com/nextcloud/app-tutorial.git notestutorial

Then install the dependencies using:

make composer

Frontend development

The app tutorial also shows the very basic implementation of an app frontend using Vue.js. To build the frontend code after doing changes to its source in src/ requires to have Node and npm installed.

• 👩‍💻 Run make dev-setup to install the frontend dependencies
• 🏗 To build the Javascript whenever you make changes, run make build-js

To continuously run the build when editing source files you can make use of the make watch-js command.

nc-wishlist's Issues

Workflows are referencing vulnerable actions

Hello, there!

As part of the university research we are currently doing regarding the security of Github Actions, we noticed that one or many of the workflows that are part of this repository are referencing vulnerable versions of the third-party actions. As part of a disclosure process, we decided to open issues to notify GitHub Community.

Please note that there are could be some false positives in our methodology, thus not all of the open issues could be valid. If that is the case, please let us know, so that we can improve on our approach. You can contact me directly using an email: ikoishy [at] ncsu.edu

Thanks in advance

1. The workflow lint.yml is referencing action shivammathur/setup-php using references v1. However this reference is missing the commit 7163319 which may contain fix to the vulnerability.
2. The workflow phpunit.yml is referencing action shivammathur/setup-php using references v1. However this reference is missing the commit 7163319 which may contain fix to the vulnerability.
3. The workflow phpunit.yml is referencing action shivammathur/setup-php using references v1. However this reference is missing the commit 7163319 which may contain fix to the vulnerability.
4. The workflow phpunit.yml is referencing action shivammathur/setup-php using references v1. However this reference is missing the commit 7163319 which may contain fix to the vulnerability.

The vulnerability fix that is missing by actions' versions could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider updating the reference to the action.

If you end up updating the reference, please let us know. We need the stats for the paper :-)