From 5a80acb77d56b28c56ef69ccd6e449433002969d Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Thu, 2 Jul 2026 11:26:09 +0200 Subject: [PATCH 01/32] fix: remove orphaned images --- .../apps/impersonate/impersonate_enable.png | Bin 30273 -> 0 bytes .../impersonate_group_admins_only.png | Bin 23866 -> 0 bytes .../impersonate/impersonate_groups_only.png | Bin 36177 -> 0 bytes .../impersonate/impersonate_oc_admins_only.png | Bin 23736 -> 0 bytes .../apps/impersonate/impersonating-a-user.png | Bin 5714 -> 0 bytes .../picking-a-user-to-impersonate.png | Bin 21085 -> 0 bytes .../sharepoint/sharepoint-1.png | Bin 23399 -> 0 bytes .../sharepoint/sharepoint-2.png | Bin 12119 -> 0 bytes .../sharepoint/sharepoint-3.png | Bin 8705 -> 0 bytes .../sharepoint/sharepoint-4.png | Bin 4074 -> 0 bytes 10 files changed, 0 insertions(+), 0 deletions(-) delete mode 100644 modules/admin_manual/images/apps/impersonate/impersonate_enable.png delete mode 100644 modules/admin_manual/images/apps/impersonate/impersonate_group_admins_only.png delete mode 100644 modules/admin_manual/images/apps/impersonate/impersonate_groups_only.png delete mode 100644 modules/admin_manual/images/apps/impersonate/impersonate_oc_admins_only.png delete mode 100644 modules/admin_manual/images/apps/impersonate/impersonating-a-user.png delete mode 100644 modules/admin_manual/images/apps/impersonate/picking-a-user-to-impersonate.png delete mode 100644 modules/admin_manual/images/enterprise/external_storage/sharepoint/sharepoint-1.png delete mode 100644 modules/admin_manual/images/enterprise/external_storage/sharepoint/sharepoint-2.png delete mode 100644 modules/admin_manual/images/enterprise/external_storage/sharepoint/sharepoint-3.png delete mode 100644 modules/admin_manual/images/enterprise/external_storage/sharepoint/sharepoint-4.png diff --git a/modules/admin_manual/images/apps/impersonate/impersonate_enable.png b/modules/admin_manual/images/apps/impersonate/impersonate_enable.png deleted file mode 100644 index bb44ddedafa38e551150224b1682ed18e5bfe477..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 30273 zcmbrm1yI#(+b>G9=YyI#0`sKBf^mWw;aA|Q-P*4ao)RhfUP*C$xP|!>fXz(Xn zI{x(V57hgHYKkZ|pXhhsHyC#nbQDlf>eKQ5IAFr>alF+n?xUbkvR(fV^*O~mauk#Y zGaAYY#(}m!Utot)sLZ~b!qbREiPA^IVUAr2AtNs3icU0EP$5<(cdsp6ONs3ES5TI! zG$tWNEz3c&lLiw-v1O4XF(+>=_rGv>yV<-TPx|=d@xN86yLbHI*VdQ&{t^Mz`%7JJ zDhTHJKGmxNVntDmvNYmi1uls!}O*&@f82xz!Gi~goDq;eeC9ar=Rn$bH zD2n)R|I>}1IdUv4ENg3PA|fKCI!EZ(*a^OyBPP|BCiAfwY8*t9l=Sp@Sy^lZkC$89 z+b=FJwPJ{mT+C@R`s_+-D7dI?@f$=D%<1uElkt+q2>x}0EBdUo5TNS$R zZ+-ge^|tHw2TE5m#k1Hf;$jW>aiy_770A7H8X|PfK#QDI9d=sz_VKxeg~cQi6QwLI zV@Te`rBeG*bkwA(x)F99P;_}VXC8db=iP8)Rv zpFXx|e}B9fuw3+JZ?U65HY|AkU0QE%?=YXqtE_^8Wjw*o$g($Y9^AQeM_+#&zFmJ` zUqfS~!F;RFdT$K2S&g-YxL-jgr{2|{qHN(7^t+Ii)8TwwY~4E9&C?>&F+ltF!fm zw)=C*X=xuzH8SgPrWM>sNJyTGdnmfCJ)p^YB52nge7fuLwRupWqqTLLHj~Rr&B%o* z`?c}Q$s(l$&VtYe?WZCQlVJm`4oWg1zXmL=T0BjfS+FYX-i9wNEd?)Py?ps{`{3=r ztCZ@2ckjM!Y}iZu{rk5d?AI6g@pw*at=mLA=9>lvlpT0l+uFj8-gAoGo6cw^JfUPb z+bW1Cj4A&5Lh8ZpL`gzpV`G(qwvsEa)o;ZH*T|v zi({SJEY!Z({}n4%XDT`xp$5ETo7rmE;XdpAeyTs-G$6u6nCF&xEZsq)`i_ z370pSu(7ij(T!8NKF53!wIvpO;?iGUhv)r_cv+!h#rFNeWnojqzpHpguAXt`mAE0! zpO^BVVvBd8E?TX7wX&Nr?GKnQ5Kjrv{VQ)S=wWmoVBe+`MlI9%U|egvcu+$Vd3SYZ z#{w=qE(Omp9|hN7Rd@K`_9hci*U5pbMwFM)nWWUzl?!W;*cdj)zkbEP`z*jBQ_IN|3MG4FS z#3UsdSqZ*YO`co?qpZk9dBA59`I&knPQ83(YJtW?VJ;6#tW3?Ybq&;R6j4m(#|AGH z*)R)qX?ZfdG&xY#II`d*nD|6L&dgL&R9tDM{)rwL=~zt5gU2Ff^jhAuE}LEJ3AKr> z*g=?pT{k|3enMri{O<`=89g%N*QOthv5^uPW`PeWHM6OArT>!8eQCTqfm$-l7P;7q zwEs=;LZ>)>vi!Et%M+GoYQ68@<6N*4IQ5WetE=mGCY_y~eQoi2e$F5@j4>}7dfz0> zN|Q)Z$E*9i{PpYam-}zudaw3XR&p7U-dDpGRh)kp*`PFETvD>S_MVS{Sg?dKQ!&4k zN3XP^qC{>xn|q&nh0DCAnw?UU?!DgR#(dLJU zKZiqb``;yzadK$qqNLsOUO^#OpxnX?l-Ji7_UZoPfYLer;#Pnz4B;Ph^}a;dg!IyZ z2l+A~&IBnq2n4l=bE11+WSLgZNbrDYmbhVE=*fhd+o%W}B#Y0ENDT%lzq7+3rni5N zv?3z@1s#8b5#af?*(3OqSy9wa&-o@-7=rMGetd1&r?LyJzxSD^KH#-k?cQWrO4VKA z#f|`~*U#7B4Uo9Vis90qR}XijZlcUvK+gO+Jd6@ioNxF4d2u`@Cur5or}tdx2Y|0} zyPxZ=TeqHO2M|+xE_I&Q!sI!b(pwJuz4$JTE{ET0CRF-4Z>j{-i@wa}6e>Z+51jaR z-#Fq>&;$lNCxuXq4tGDlrrgslpyTq2imehZ19$fyfTJO&yPMy?^EMjG-#hj*BP>a{8WP)6&50m_UZFv!)Qe&V1l_WNBHouv2FbL(kSv8SzljI z65)j;wvr3jqnAQ9GGbg!KV-OdZ@SW9m!VzSfrt2AU2I&O#=7h_od8O?z}SQDGp7d! zk(}n<^`RPtLRaJW;IVFv6)@enqdk@{b8G9GB)lIP*`2CLUx^V{{ zzLoK_vaZ7c|Mz=2;zJg9%qJ(S;+MI()QH}ZY~BQXn#p1nJQcjUQ(!(tTX2u?#0|Pb zgSHXM1bdUf1$=N|XV7YtFXHzo4EA;&fSMVB1#$H9lBidt7C<$MPl%?&Zpv|`h9V+81HpERqbGpZ*(yH{u0+M7<>+wo(mt0SKmdo(>2B^iA)cl^>h9WFAEFWgA8$)RXZgSEDz^)L9G0chmV~Vw)%klbfDitZOPJlgFI^|5n5$`)@@8 zca5GpIvSc(z#d%Qb20=ydt*80L33R%@Ikn8t44 zsSLW|5fYZykSHFdu&lnZ=?oMW7B--jVqs-1DJdy4&^|ah2~Dg`+*PQBpQK1#{kg+B zo}YTj*}*eHS7~w(Oh=fSRrxLSZy~Wu0jFc3f)++ zcl|epA3fo>dctF(xltK)KcTFkpg`zj%>DlPc}rR;&&763B9iBgplU2)$u-Vwt->ea zn<+k=EiC=~%EZWzpcQ_#wXw6Ysb7+ePl@RR6m2u)DZ7#x8W%NDIQjbeK7RaoB#WE% z=Vg|loveU>E-g{C5YrJ`T4&~q7X)25vZNK0X|tLg@#(oLpF6m3Z){{edBQ<}4hS9{ z9X(THlX7rVNJvQUx9Ix%`b6uC7cZJ{xL@hdCkrF+QJYlf+fW&lJAdr#d;unkijH-% zw@7zo18*b1t}{WS^PM~K2?-$~Az$YXnwV7>@=Mqe>ZE=jzkIP!&LSiv3=a?g_)M%L z@Q}q>Yg!mndZ6*{nCUBHoO@i22=2cBe3z)Fb5o?!($dHv&{C7)y&zKRPfkxMIG9!F zHLZlPK2aHS-@0Wr|2t~Vg0ZX^)5^-~cpt^4-H%&XxLzR!D>PC*8SnZP8o&Si`4r~+ zWVfERb>3#WLSsV%^5O2R+DU8hDUaVZiw_N!PbSG~UQ4T}xa;g(dZB9p@1UZhB0Tug z7j)(f?RQ2#DD8ZFF0oo`FsptTJ!#s>4Mc#x1%xT?1F{GglQ;KFN+Oa`w!WY2OcBeH zgacgLwR$s4O3p1WGZ7Y6mS6#am=`w*Y`fZhjrc@GPk=pv6!i7;Q`S+=8HV#b zp9c|&h#>Oh*ru}b^4+j)2@w&)as)HmK6!Q|@E|#pX^*LL9o2}1Y;sY+C79QxqJ9O= zs-FNYGae=;=E{b(FHvyWwf@J9kQqmLpm!n}dUgPUZbHVD3Lmp2o7b$S^J4e4uN?3} zP^fB5VNC$D)^bnP`6|@^jCckHwx*}+W%HPT^}t9^9}43Shz+Qvf7yeB$%$o)N;0`R=PBaOKEq4X^Y+j6BIaG9Nk9#Y8lMjcXK#lBqS&(>E4C`7pd*@mX?4_4jtmyKD(G2<_fRn?&3t^k4|1*``^D`&RBWL z{QGl^N6D9%o}PobLBhp@3NWF??5#rz(t5#Vj7<4Rv*O z;32F$K0W#%_`%wd264AsuRvCLD2v-jz`7N=cOy?G#2>DG@Nas!op;9a8OX?3J*I$z z*V=UW1Fc2JCLB7*npb6;DZ3>ytxgxxfw-0FlgJ&;5%aTd_tT(3WfMX+$YZxBe`ohc<+l%L z_W1g3clTB37;#4uLmN=C_6OgUUqnWtY<%~?>`%;ae3wcyXE9A97ybvxob%H?1L}BM zk{W8>(upd*MrtdouV7l(R}Hk6tD2K@hr~Ym(&AMhInwbUQ3`iXjNZqGRWD4t9xNWY z?DV;3v!wMA|)jS%D|&}tPD<#@Hbai*FI6H zK1mF_uv3#V&Fle22j`V-kL7L#m8+|(*8H89yE{`A;L+^=_)!(0{q}ON1Ky(=+b+wX z%aO-ETmt0$uB=1~E-u?(vaPJHM&ZPNkkxfOBLv@}j|LvIYwY>juQHUaJ-9NoV)sfz zE2qiT9@6{VzfULS$3+{Jlr#Yf3D_@?eS@bsE?>sRYTC5*MyVq0kY$<4nt}dSuT5GWS%}7O)lA-yLZXBX%4HRqf=iS( zL9+BVLN2cZo=S>L-*77ZP0|v-%U>RPdV0>bZ^Lb-F}z1$Y9oWxmDYvGM}!~v_yipe zQcVPvh1aa>rxrF*gzQegM9)#Cm3n1bolIsNsF6Y8@{~nYGT_nv`Z}w&QK78B6--;h zF|MYhFLV?Xm~!eH_8t6|O~kHZmGQ2u1PqB+qYDf}KS+!6&^m7nesP~FPg^2<)!XFf z>-);EEV=1Hk4;=vPf+hed4~BnZWT);rB-k5u@f-lz9+_ez#vojVJ?W4zlxHiD*X|QU+{f!v1KejQt2t zoNe-+yZe#9ZEv+p`DWw-r5AqPw%Rv!UVR%5*LA z0m55}MLo8EuBY(#g{?8Uf1N(-@s)YsCCOR2JZQ0*4Z&<0_<7d{-8O`&68?UNu`wsz4!A+IWuo2~BiDC{|lrTUpeylns4~qN{I7<5D3O z+c|Jd%WJ?FbCuDW`7|>j8l`K#BS0{ZuV0NFmn+&UZq8^P%RYjnpXHab7qfT9%|wPH z9R{OnL+Z(2TwYsLw_cgN<}ivIjKiY>i@vmom5&eK$g)j1HuLMm#3ATo;?{DV=g*#s z8r)IurO)Ym6wu@*K-Mo@dlS_XTCaM|De`{xfxrdOuyKgc`HT+QQKS|k<< z62gbwaJE-rI;x5t(Pv=F853Gdevz4Y!V7(i^2W#h0^^D{`(HB+~J>k1;=zcM=pL6WCcq#^I%{ ztl0b6N|O$f;-Z;J=&8ZM*VNCe?Y`Irjju>6Bzb#1Dz(Q1o6}nc${#7jnPd z>7BE~_3ty)WC>V9e}RzAsi}mGN7vR0J`8ksuew0Rd+2IuIS+&~LokaZ#OLZykdbUH z666$fHM`jWi;9D~mBJq#F@x>-H{T;s(ZM2>0{a)-93Ob{U}4>XxWT!ekZT@>@bo_K z2CjfQpx(*BK_CodAP{F4-)olv^Sgd8@kX~$2{}#F|GoSTx`@;!?DVr)#N|&3PEJmP zWOLH8ZE1hhGN#Z2)OV;!(i(KronW-P(3p|niCmy($NHyXEZIgKfv32S7}g!ucz-f_wF4BCnt6@k`!T_(G~8*nNi9o=S{`Y6e*4jLO}- z;`_$^i%6_yuop)T7ng@hN_0l^ha5pciw5Nd$xI974trImo4(GF=8$n{k6%8|AjP!% z@>#@t1`8e)Bt`^`(z)%Xq%f{l3l(BOlH3Ar__)d~($;E1F(iUVe%L9>_Wv?i`!5vt z58Y((pwb@#*U->EF#XWb(12ZOX7g-rZOvBb6~G@^p50hBpZ)mp=X=fqWhrrSe_&OB ze`3drW1S7~AWW+*lhXNLYUt?|NO%GM`~?$>x$%flYJX*Ayd%KNm5K@IJQcs?2}u9# zFfwr=p#xy^a9A^c#n?BiDl5CsH|>D`wl)yT*7s#oLkPrrd<0e zh)svQY`rY|K_DBh3#~qbhbeYX{zo8WG7o4k1-TDIMz*2t(l>69-Gtm{{PMA9xX;nX zd!T^n;KK9Hv;U$__?Q;M=1-xP|?34nL;Pol*CYVIw*SL$l^x66DT@aa9!;e^F zun1lOD{5@K!QlmOinq5=jRqVQGBx^1tihpEjnGUCiozK9zCr705_Ocmnu$%qNd9*# zqf3wj{k!@LDF$cvNK{#EZSB&~Bol2QanRo*viewXo6c|Ij8QDv)(CqR2$R_tON?A2^=A%bZ zZoa)?jKq%~X+H|xgsHQ%v=q-Y4mXl~;TKR%uH}!02m%6```<=0n3Wj!F1@ekrG^H{ z@(B;KIgiJ)bL(&ej@p>ii&hTSKUvMF2$^fqkn~&xHxYw`jpu1%YNR?VnM!43;kVCb zc7K7G%3c0wjB58%=3eebH!v`8F%8Ywscu=q#l>wnXpW~D?;A{^0teV_;z!7SSHQ)I zYnjDFJ;-z*;3a6G#D_AWC)PjBiswNQ*oB|pZW6jPN`1yn&2*acTBwDjs%We-(m(us zGY80|L99ow*)x&bxEttY>qF^k#1&c3EJzCJICb;%O_{(K2jeSI(tuJ9Va<6$Lt4Jo z08W6is_M*3BkWlo>w37Sx1$IH$HDc9$P(=7D`~0cR;WoW>v)#_J3EQ{NNPBj4y1$4 z+i;nht#ko_dvI_MVIqln%%7B`%l6^hbq3b^s^M#1Ku8P$&f2V9gvuIR$-%sctg#uK z0k!*un#Esm$T;lZ3Vps^U(*N2`upeCzu|4FHLq7(5I01xRwxjT2b@wV0Gkpg?b?<5 z%zFR(41cQ@vA(f+lZydpqlq8`)Q&p$FAWAIs@2wQq-A!Yhbn(BPAT|>8jDwel3$0R zU}7bHo{*`e3wArn9M#uY+1cTSc!*{qs0sfq{_}WjPCP#|R?%xi{AcI=ok{j4>tfk$ zrw()1b0fI2FA55nM06I7FTh0w@o)w=I}s=K zI$%z_Q^Z<~Rteb-C`4uLgw0GnS)7lgL}dN_{UkV!0d)^@CF#ehRPaWtxOyzX=hC>(aAI6OS`ZaFo^TIEz#I@iRDrPD2#JchV1HWSnvMfs+D=<0jVg;o+m zNmUNJy&g)cqm@Dk{?`rrheelrGaT)OJ10M}f)tMaegXpvna0l2fJV`JZAn$?E6_>_ zX_4?~_EYzrPN55setTQxfIl325l$xkjFR6{y&q*d_ScS#oWlGc&KF2Sh#~sUqdgfx zas!(w9+uvvz=ZiUeMyOm=1`d{%82o)kXRoxwqOnuQ7Ke3;X-haS6c~b-dg(pb!;yK z`sU?Fm?3>DN-W@|{YhkEDP3K{k z_Ocg)TA+1~Wf5Fomb1y!&8)(&$?T}wG2o=Gh-hQWouBB= z5<6%p-ED7gf92)N>~AC&YZ8MM78(i}T9RMB=_th^TEYr!-!uSFH(X8s1{@%SKQ-b^=*Vd@Ses>edt5velr{8 zJ;0Tbmi8`<#UY|q8{gIurB^$#bKxS~1cK!)NlaVfwN{A2R%7?pbGwEVEX;SGJ`q-& z!l@Gn8XJX<-F>!}a=bORKUFbS=g?11RR{+Ols;3~2?8S^?tifbfLFce<1zl-|*Cc@0P4Tf+=zxOLf!%_L9% zNWZiiJZ2DPf8bALT*eE*k^?%DN+&_6P{1|VeEr2Av8p*z_}ziO>7pjxAo|wPwpR?D zr>fN{F(@o7ERB)mgnmdjs2=N9;`-UNkzTb;2PJx3I3c6-8Mq$_TyIZjtVX6xv?3*v zGg0{~4MJLJBlXm^q{G=}+)L92^`bk+B&p z+VETOpsvHhow>QWYjIl{Cc~z;@HtEc=b+XFXM&N4CIc!&SN%kCd`)A~8>|6)3+K!K zt`eZKhHrZ}@Q z*~aScd0j}m&JG+7bzCw0fOgRcJH{UU90s)pmNYg7#zJQh+0)bSvuZj6)x}3Ju??~w zKVI9}xoO`M3D<>%kzB=PD~`%`4*Efm9y>tn@CtMth#xb{hw176z}$j3v0h3OVw6?Uz_ch<=7fV%wz9SH+MMnVWM;!B$0Ku3do{j z94yPd$)nke%E%?V=d$0s@3MS?}Jx3x^yJCe!|886H|sZf-7A z9pv*1?TQ()=D&P7h1;Z&$pHnNgCeAfeh*|h$xp87g9aMc$I;Qw;L}&HU%P?4&<{S@ zHmGFW!2gs39WE$9fF&pkg{LCVIk8G}Z|?)%+D^2?k@xST(2_ZsS=AmIm;MBv?V|RB zidmU%Lr=aPvN|x{2pFV{Lv<%+X0DOGatTo57FiEu>_k7`uhPds@mMmT? zaegbsHv3{sNz>KU)wS348R`fNz#?VtC*9rMinE2m5GaKKBVJ*4Oz}pi6LpDvkS*x0 zrmCv=@Y=%j!z!zss&i0E`~j0v{}swC=~u&U3$5#S4CyhB8K?@82$^s>EjfS(&0g-c zljIu^U{*@t$k{zny|S_rNim4+V(=_G8`EoIyrUBeE|5B-P*ZA3ZeOyLQoFyvC^52Lb5y|cU4-s zNMpDqE+usVeWbJRwQr}rCKdWX5sg1{H^XkGprz$0<(HLRIyfbF*V2pD%I1l?P}IO- zo-gbv$S|!k_kpsL8@|gzYkk!txtmx>SV!z1Z(OChP+hG0P$w*OHx^>++3} zhKKs9OIcUTA0u>XoP;FlHVi8K`X{BhV&c9{vT63V{Q;)Z-T~ z!eH(J6ED5>VAt=@*&$4rBo-I?zW3mK;O%>;C@VuVfJIDOxSukG7 z1fS%B8r0X%a3S~_r)$&ZtJ3m{qKW8P3N@vhgH0AxT7ChJ3{z1=4#&ztLX*fbJZ9!E z;Xa4VCqgy?*AwhIdEB}cR}6Q1f1!sb1b=$=E>}O{l2~oS9zdJE^#pp?jIai0}g5FKQM9;Ps?-= z6S(ZNZXe#izZrN?*wWH+F#{r;E^9jyTBIhLe)5`#37-EsKL7iI>wiCKm#*SP59fzm zgqvN&HO9VVfO%cQmchM6$#Ee8Y&)WWIH zp&=WWST^}2({r|MFYlxhrBqbGr2{k&Z4Mke@)yMxP{ef1% z#F1YFKEvJEH2gl3lS;svi$GDGg!Nw;zqq)#hzRsO3u1fT^C=>@t&i;HfjmO9s~Q|X za1mt0#7w@CDylO(?xfQ$p3N2+e#dvs<+yR<{`<%5W75akK=H5f8K%*-4fJFuT2j&v zI1P7j_ zaPlFu0=0a4czC{Dl5TBdGcgZ@V5Z6f@=1y&tRMz)_gt5A7|sx@(@F={%_Sq**>6ME z22D%|UC^|-j=&KG7)$U2%(V^PDTBlJooDH~RRj415dzU;xwp3mc%yb16%{oXTjhX; zH6wvslZCE5XDn%UXS+bcORaheNrBb$9~{#8%zF9yT4bpj_CdH4PM_v2ZWm6c#O8dcKKDpaP_QN4m7UTi}0mm^$HaA3iN z6cxGe>kEk*iU$S%_m{cy)dBjG%i)&_jOO2^5`Zq&Rkxz&`o`|(f}O|L-`R(JBnTf zrSn{TaB#5qG)BEwkStrl-(P&U#bp95yM70BNB7}7I&(~3mI?^D4?YyyDgHKSbR10f zR#C~RyN*`s)A3tyxEnSqn!pu68plGefsvFrzk-Tm6gdfELqjPcqYbPW2Pr8jMGNwe zXc^Bz0KEF@3dF+thU+$hh-j#JT9+m=PvJ3?&@1F>k&%(d@%5@}>+9eO)>0}*N*&OXjI#XP*}*y9H97CkI6z%3!4bqK zr6eXsu`~3yyiO++m6Vu0<^-M`Tn;4T1~VXI$+?eo=2sSb_@Bv!UC>fo7nhDG6oOLa zlOPL;4Wx0!czl2gB@C`)dAOLj(@jFb48A>*^+*iCJeVAs*}T2I4Z5&PlEjmQr5F5S z^{*p5tgPscoCFL)QEM-m)1+9cQG`WKo=;zwT`6Zm*rLm8tlJEs(B!~Esmh@IF;U*e z+B&P1nxB({qfd;ioDuH0H`eMGjZ0YXZ(nB-FG4i1rLCKs?3-v?*5k#^ONz=Q* z!K5Z6pwUs$0!Pe1-p%`}{Dz5l(b3VLi@LISI8DDY!D}d6s3YsKN=-{s(dHQi^T_O_ z;U?(Q?R#*rvlB^uQ!A&k+*~1o-r5QPR`ejJ(9PSROaZ|iypi72`?Ae%htybmo<~|n z2E0Eyfbvlo5H;rY@MzIAQKKaPXEJc8Pf;jhdA$jZu!Xl+^k+MaM)>I_m)P*`h5nkMM? zt&>qe{Sy7bQp4?(ZPF*u-ivW_U3$b8E3JC8)g`_?3l}awP9TKG5q5 zfH(K~KY7DV$oBh2KYe=V4l=@X;%OR8Oz2o$=i>nS?D5hVrA0+W`T|hqN6={VLDz~R zQyLd+pjKUVSb7;Yf2HX?0w_nrM1gS-aZT_P5bueOh%=xqPz6sGAy@Vn$$|uZ>Thkm z046Pv=AS=)0AS4k83*se;{6B@KmX6ZIJ`AahNJ6_EKV^;GCDw<3xtsvX4fjS7WJx?S~H^no}`8eg2$oMv-F|iQPX39*#3h8YQr|053YJx#xO?j!)S~BQmBAFSf(O(T1t?dWSA&9fOxIs zU8D>;ES|g=?cFLwXWO|iDaWHA<>+W{SA3O$PIeJ@RdVderHq$hJWQiZ(-E0BRiRfh z1|~{72M)Kz#;Q2YHwPF%%*59n2vRa_$_4D3P%Qg>cu1ld%YKJ;fk2X^Skc_v93mJ9 zXO%HW4Yvt7I5~KyrllL2NpGBXKdYbN9+KWXSQ`@TvrAyvTM61R1w3(PgNh%wm8<|KU%SuYD zFN$_|WIREo#mUhTNi!*q(!r;wb;G#I+`y#?-3F&ja(U-xQpoU?DdWU;iKFm{3?M;}R60%RqsDgWCxd%p z+Zjlby?L+Qvn1^Fr=m<I7L$BSaT(d#Lcy&?WmVp>VV z!o=kE5oIo&J3N@gTB(+&!jF+GDHNF=*B4xQQAAQC$YLKG%Z#Wten~oMjyFNSrehp) zA^&5q`WPt{F=)v^i#J_QZAn>Q5j0LHKHKbJ<^C5`)v)mApVCGC?wA=~HnsPEH|k@@ zl=!n@&e_>-W0EQMuxij1GoKmVi53$>j1YUNs;X*QVLKm!3pGwMOsPHUfKlX)F6^33 zcMPYtt*tFoel}=O2Le&TrwM5-s65g2d-5hAR0VI>UbLGX+>BNZ7Lv?=yJ`gAGtDE*gQP0r%f) zuCC}J3Du9l3Tl2`tA7JA2U16PJ2D;vdiB!a6WQ)CeJ7U;iM zFC z2bPAwZmOZ^|GI(NH-xxeS*`v5xxMz8R@6h&KIo8(i zQ=>jrL2w_z8BJ7Lt<@;mhzc7*05dS$s5hQ(XlQVE*W9~-{Uao)yhaA-;HgWNpp&>QeJ6|IHOh&EelsVA+e175YVyQ(78@cheR#%y3Ht0n4 zxXc6iar_<-vR|*6MqC{i3=gY6Jw-rWa}0?0bfp1U$5|Hdz)j+bm}H%YGeDo}e7hG1f8`HUYUjj$tbix#Ebv~?6##4=JR4>v zTyUx&njZTF`;y@#>Z=fEholQIX&yk4)je}BoNgO|+hMlJ;J zKL|}TZSB-1ycc9rrH`lx=_NCsJ!^NFD2C3J?C*v9A}xW@4Clb6VO^DF6gV+B8f`#> zK(76RuH*>~=`0;_)j9g60oY9?9Dblj3yX`lO*Jsv zXU1!Hrzl@rLA?j%H!b-O=+o#(!OeN8RNb8ZjnFW1|VtyxSAxt4;Ru@c*%Kr^mKI3p>n5gWd-dAr%8qVQXOOR ztl4(eU7z4#N+ z8>yuUJ4|33`9a?m*7dx+yezz#wi!a(p)SB`2)h&mCR_pnd%%%k7Lx8iL*`yr7=ZQ? zzwcAtfwpg2d7&CY*w16Z3Fy!qhVR0{0x20;z>hf}i0G$nH{W#tKiglf-}0jAyU-nja!A0R1XUW?R|+n$1Bb^dwO@j=N_S5>>H>t@CjT ziD@@baq0)M^#=BL^Gm`+<8*j=S;W&*Q$b_wK@kpY1VETNmQT(GJUx35`ax|0ZA)Bt zKAD0S==aV}MS;JMkHJ1(&33DJ&VS;PT^*F;l7wHdvngafhfAw`dA;ug+H#!a|*9Ue8P){6p}M_0zHv zI74#+@w3~J_P@=lE#t_r7*y$@G>aUyzAY$pC3L#?6uJ?ZVk+g-yBs>t_+Uyvbna3L zl^|BtRDE6i8|zhWqx6`(9w@@DuujFS;XQy~M!+dd$js9Tb>OvibV+LJA;@8pa3Ngi zNA2&8q(hLAU9W-3-T#J9dVsCMfKnd<1t1|7btgXWNWDBs5_0m`DHUV=m`^LE3TsfI z9;$OB_6cTAjBmok!uqxQS<5(tJm38%k&TjKWp1%2W|3QTX=&-r``_#%uKO?AMUYDY zOHckH5KnlCXdy4TUX;wGRtg+~!%4*6=Em~&pe*<|O8mbhSXrH5biq_U`btM@2#INEmIL!%$w-gc3bdke&*NY>ZeW-uro zLz=ehczty)Op035NFfB|ivnIulR;HQI*&18Td2--Pb3 zpgSrqb%$9Q>)!_)ium`JitOu$4_dDD$Ij4x*Zl4K^DWvZ)GS994Xc2g1DJ-^bH2C1 z1dx>RMkS+*Zs?a#PK3pOTLV<2XU`APu51gU=qZYhbX0PRmA=Y26E8cVqd5$E-pZIt z`|y)OKZK4qiQ@CMQMF5=!#?R!?AaR_ENi)FqK?zcBxZi~Z*!}?r@YU5s|LPA>#$CF z%j@I*!@HZf&30rU<m zU8I9rQ!qTBEYhxN8+AvaZF+YGU{~#A7QY~)FUlm3gx+g_a0H1W%bKK}uuzSF?9Kav%V;$aM0P5)d;B4TIEaw%d%;@&hu zptn4H+x9ZTMu6s_(+EM31gS5vDVuZZfev7!7%b9*Vs6OWE2M;JDf(vN&0DN3#3 zY883j`00Nf$})mo-cQtdLo8|pst17i3Ad6{I6M6YenNZv3M>d8d;R3$6Mz=A1q@ES zoZjo+jrC-Qj5E296X92ipWDoL@IK{xVyy%}T<3Wu!xFq(E=?3BY4d?1k6^dW8Ik8` z{SHilU$FXuSK$TbNP~7lOiav@Xk?Q1n?E?-+^{u8D=<;afLhZ91jMvcUCevVXY%_4 zqO|pURh@Cq-Tr;Hm$kpgEKS0}hJHh{_E=S6%x8!6cha=Hns;*|83i?A9HS%-3Hx7& z9>EMqi00zO9cYF1;&IQzpftGh{c)L7M-xK0&2a=4f$P*_pA{&yt8AOyEnMm7h_zXi zjpH*h6|#NX8ZeIUzBu<0*Nf7kQ)C>L)8#NKNu3}GFki`8oqu@43#3D$oqiMaG4gt0 zh~x`9VR5k0Uw<4)Up*D?Gt_5^>;n0!diu9ILIS9Le#x6)%c;ZXp=iql1tLzS3CJ^Q zHgVamVE?x_&=L1zft;OW*mb{&@6)Y#fl~PeMgbRZ!WBcoVpjxx7MdexGHx0`;Ciac zT%x2CY&C#6BNogcHnPqjqXeXd=)6a0?E?E8A` zW`zxM`g;#TtlP1?NJ_O=-0GT$h|V2!rS!G z376ht(zIu@;J7M1cfk<3`yP`hclTx=6Ml+_$P?I=J_7fmhl-GZz{E4#eiq-$4H?R9 z@`{|a?P31J>IiRZxRa8qmp5H>s~3D;NI~ck&J(A1sZqz0_olh31X9wX!ZftCMg2

PuY1FkfR2&5-ry zTi%kwLi1}P$HWl#5p+a~kG;565wJgsuNv}jis*{()02b@aa1hIC~5)5zJXYP=+s~` z$p^v=1ApIGtBrmAN=KMAalGJLn2+!QKy;RD!;eyDfIjH!+V1GBGq{FCG$L%XMLlP% zE}ugjBhiC@{jfOW>Ko|&{9IqsS@L6PQU6gR;dWYM(2>#nieVU}MQb$>Z?8j1IaVer z_PVrF?wR4B9RdFaaw%xEp9A>~-|zYj^5XlCAJ8*5I^?f1rh45 z@hf9jXtluS^FXZ!I|nWACD4sbF-DB!^M(6k4!n|ISH2hf2!S$%&qUd_F+9TKnzy_B zBrRZre&FVfrf}#}?4;`OjSs5ff@_uk*<2{vuZ+CcDh?luvhuPb-w>}@5g6%1Cb@3U zMXA+uM+)m*7!<+@DwtxDIz_UednuWTXooO*4tJqzuya|Pzd=DS8(0VvuXp3U(ROUU zk}2RnOMY+BKX3q)S+CdiDfm#o4t6KLpy)s+F^G1w{vf;snL@QYT5!~{#mxsF(;0QY zfu2%w8LuMd80Fh6FWu~^r#Qwl^KnN*I-K0$lE#-L+kNiV7JWF>7FB2IN1Em&5A5u7 z!)>iiZ+m&67lT$_u)*MXy}p+o>@#y6YN}M)2hKcYx_eAM9pZr?M&1J&FT5#*Qz!z} zXnb5;(tsf$TS-Q6&&eiu1#Z=L{hEi=g(P-O6H!JdWRIfE@G#%gBPk(a2oy!q|5MtR zKvNn1TbqYdGGq$LG37)eLz2WnPN)neLs3YEG>8UKhNBKjlzAv~WK1U|AtEAWN<}GB z8ImC?QSN^K_y2u&SoizxTKBG1t=1~ts}l2S;BcQ~kuNrPZM^ zb=>r-)!LUwUNJqpWPQ)qDamHVJqe0?W!VyOb{Y$4ILCe4S5uiA3DeLqZ zAwoQ%cI()E;{s`&WA~*G!_We4muWZqD%Qja>>AJT{e=1uV(bvszDk1 z1~aGX3NG%{;r{A*=oI22km1$z8NM;u4{t?|1Y4??)@{;_Q2tr6uj<3G4?}gf z4Q0wZUy8J^S8N46E~mIkl3?HJ%?(|1S6ug5ZkPD#XCPS0Sm@LwUDvrQ%rCKwuUGge zTU6Mx^J<_+$C1j&X{Ym^>wf=uSo*JUZtjQr=sVjb+y{1Ai7pdR^!S8ksqOt+iklkm z>|gl|M%Z%6=VE(VKWXW*oDz~2mA?xZNcN_T&Y9^USex*zdp*aN+h(njsBNwD;rAlJ z1DokIZ=tJ@gg1E_eGO$ypod8K5d`sC_|f_Hdom|-4RVVgIscW(kugX*iIxG(Tw%&S z<>>wL2S*LFva-;EU8-@lRLNk*4sug3gCT1|5L7-k8-=Ma<>3itSNPWBdKhwS3`p*y zGsWDVvf+8;O1Pms`=>}kZ3?)-k(qU}+pY^7T{w!d8`>+#L!}^;0naeu+BFT>P7Mm# zNQVFHRl#o_%GP%8|EELQ?HS$?q%z!CyRmanyRTVl{EEWDi8|L)l_0rqFxBn7Bk z8Qv}hJZbqX4GzTT*hM>J#)$HW+<6(ov?CdFTGw)^uycux+p35isf;YyY9VJqxe`?`})cp3jH;d_D*bN{h-viPqAua(tAba z?Ty%YSDQP50b;d&r^F;_sRmwsVX>5s#|$Q~@V>CrgyiHEiE)3%Vml9}6<77__({2O zxx;v+YUNP5L1N<3H(z;=KfIQr@$d}w%)PVD+b=LFHIi$1hQ2DS`F1(OLIMyhTX@Mq zH@Af|y%hDXGk)`DZ|Gt;sJP_ErU!3s{_u|bhN-;m29sC$M=ppbYBwHaZ`Yc9yyeq{ zii+vkjM^s(iQ&~tD?O`6oeS^jJ~8SIR$UW+fMTY8sPSrk<%W~%=Q5ZSRY@8YFstnT zW*^cCr0Yq$A8uLEr~SO6L(nPp`o{~_W~t=gor(gTT=Z5h&-o7%YietLFKU6$^OVup z{P8SSB^uGEl%iw zN}!4$Ow2-g>{UYcH{G5W=UB?gWxR}!Ja;iIQlZoTG|%(^cSEUDHR(KGm*cXB%hU(V z*?cehKWebtZ!pv@K$Tvun9H|(cb>1Df`Umyrk9&Nufey;AT?oyxeIa>sbhIhh1Cte zIi)IuHHX-$X$ZUe(ZXULK8|qTI42OZCT{Zh7f(}K2YCyic#N7suRLZ)e<3TRuzXer z7hfka(+iPK4Zsuhj9?*|NzWFJB#Z!7|RH0tFy!2_ew zno+*P3BfJl+v;xqVFRlB3Ym+Tr`iovYkzz+0v@D5w+}isOlO-zo**-Qy|heze`E?M zu(Wgi-mRvjtTsJp^yXk<=Lbfe3fv+vMFk{D*k@#g03?(%wbe4%AWx5J+7@!wCuwvt z2nxYM0GJ3~{`GWTJYCxt=Q&QHu*a-c#mow?dgI8*h={VSa4v1#-usjA0|YOMI%2bP zbNK${sv-`r0mp$&UDktyA+RxPgJ2c#%2?RZ=fP=*|Z%d#vjfdh* z+z1dJgshB%LlE3*f}{qcwf7SZ(#A%%-5Gl|8@`x?h`8lB;8T!yoDpF z{51!F-wV&{O|MnN$ET<71HlBplzpf)D~0npd?m@h>^GPn^Y`DreY?mA-Y=Ym3^M7I z-~~()4HuGxg74$Wn&hxf4_Id|leJ8aPvGh>x?g(xvpF zWUu9(A+$mb6A8TliEr}V#hB4gzKUA_@#fykflr?l)`#>zz-}?Xu3v7IV~``*R*gyr zyA2v97+M~}qU?h)+s*3%q^qk(A4vj0vc#JPr>qA(7q*66FbvH&m`1NI#cK1Z@BSj# z1t+I`knU(v7A)iv`#X8GREI=?>DTIWCWR_12jin>W@fHb?Ab7DQV6J;m}}>&NGrPd z$MUbsGtO-^vfH$&3QbuJ&?#A)%fBMt0s3EZO`vrJ!uXw=CE&H`j?}!m*tInO#(ZnQ zkUpMti*Og>(DrlsTOV0l))Rl+uDyhl%dhk5m zh_Kags^GukQs}ePr9Z(h*18Fv+a@ z!f3pnVI?6yH=IpL)TYwvaJApb9yCdTPDN?QOh%`>@Si3gmrHR97k0AP@T?-|OxAJ4 z*;suk7}>ttg;BXWha|q8CshS>J^fP?BrBVkxdx8ktOaςnklzQvQ&%NbKX}o9l z%E+W|{-8Z*863RpOZB!~BTD@9819GK2a`BxuD=9cM8#Yem=+h*5VR5U+-OqZou|Gc zhE4tCgVwN0FK~Yio*Anv!x{4O@iwZ#nyr>g6%xvW1*VfM6|;|c=^s;$5YH;L7hgYX zZMcWVbLMb!LB3H^%T;lg=PN%R42hBDS)HdKe%#w6`ZP6?c{=D+_j=RpowUBcUqUV5 zTNPpC{BB<9VhZ_txhUUGQ%$eJ-y>>6UEUhuHLn!?ws&ljXUW-~gq0P3OeIeyzjTH&Oc$tHRLj$DT>6eQRHBg(2557YC}UlO%U+j4bEP zoNzng7*K|%2B*v&{rN9W?cDQq*Lzq6gB~S(ooQHq?riPnsy}N$NEB&(?SEwWv-8Vs zN#CEmO#0*CAFD`@xtKkfQ+$H`9w~Qxbk8Z(Paa3IUC%$5{v29JXkIR6;a`1LCVpUO zo)YVGYHMjGh|A)z8r1DRF{|WLJLcx%7wGP~>QJ&d51G@5yv?ynw}iLgjbrq?jiM=o z&MylL{jZH`&uf+PbDuVQ+(POYqw9-o2--XLNX&m((C$Mo4&6NzJ#8JSzhc*!`J3ms zYm34zqeL7(n9_A&PE@biI=7}qvs{J+=ORea`w-f*&|Nw@89Hz)$)7K-&oRRYdXFul@U1HD<*fVqWI(QzQ4cD z-EgLkAAjlWnWkJ*{)9SWeun1hXy6Tmr7U037ymU80FvL@qPaChUfdt zug!updZRw3!uFi%vXk1}>*UEnpS?!o9appkuJw(*esrw=Rz>Szy1MhC;L4M7D>t6q zvASf7pJW7{S$F=h&e5^r#!W6q`kzuqa-8K#-kMExFqubo%ViW~Ct6#sBAxx}+pvI`F+MSR-QHskOD<0pqK- zo~_h*6L?!y;y{6lBHe=#8ef6u9!EL2gnaEs(2pDD53Z%Xd$L8$bJO{?ZSNYN4;#H$ zo>}1W=Gk{kqX!!(?;37)f2}=IA3vr>IX%Qb(4=~^c|Da;p=9UjZQZqztRP94#pdLE zk*Z9y?&|7T=yQ|&TOCAM}G_mE&h|N>Mjr$}X@J;NMj_|)YXe8U^JZ^iy=(v4(yZKc7x-$YLCa6NPSgA&TO6dPes*knml7vx^4+<#qaxbd+Mz;8 zYv|Ej&aO4*gr`8Om)2dH(=p}PfN|T zTewl(w!*~-vC`&{n<)v>b8g|khKgQ&ndYC~Cdl?`U-E+&F=y1TL|uL5*9E=E zU#w@cg%2Az_?^xQ>3f-UX|XuI^e?Gm)y~%^bZ@(?IQutVge;MrLrX1=SUG#^Lrg;Q zAzR3dLU@HP*+mFXtqZ~q}ZqEW@&^&*?2;cF`+{Fq|QceBMK zALhw_c4OBYb%rL8#QIl@>XeBe{_joM|I3RvyCzhiKD^f-pbST?-tbnSRqoG{V$;*t zLfT{d;YQPP>!tYfi^z7)91vtr?_DNC&Y@+l^lWWzz7G@{A{2#GgcJ--;a+&xvy1Dx zMuK^Q3S1@jM8XJ6T2fN^86ccT-%0%Z@I1W)kC@R@V?92gX`6LlqMbqc1?X-~F?$5& z=-FCD;Ir!hCcBSevH-s(ZoSdqI2q7n$o*FhxpgPVRAS+8V$(&+#IQMEeW1M?)=tiann5($4R9*iy72(eVQRJe>Ete+e9HSibT(WfO%=B~swEu)rV|~>b z%)4Qn5dfvI>#=e2EDut%=|shLH;nX$O0EP8zc67Jfg`<8O|uMFV-rW%?96s zdRJPg3-B&fs7%5I4JbLR_qHBqe`$~klx-3+6?n!!Y7laWu%N}~@8^jFJANQ$kKYpz zS)joTUgjd!ejA(<8Jivm*i;MDzK}!x3@(l-A$%PBUcO-RD_w7reEBe-J@uN zW%(wS3MwtEJCO1PP75U^CE(h3_E@1eM)#eaDZ2*54Xa{P0pq0nbw2C@GJ6Vbw@cXC z3fSuex#z?PSnD950tGUNcVK$3hFG#UVOZr|-WkTY+1sg>fxZIuI`w{}C>m!lrrbi* zWwycjW#iD+!@F2^Z$3UqxAF{gyh!R)!`fia;#32w5F4@5_$#GTW}hiIE;-wI&R7Va zHi+ce^>(q-^>x{S@~uw6MT8+KL`&#=sdrv%{+afh97aY`)x$)@?+wkexI7y zk-Xl-4YUGpyj!rko9TQ1VmZ+aHk(k$L&vSkIw2ehX4yXeYDf&g0O0}%iZql@M@Q57 zH*B~EhYhwMi#GrTU`H`C-X|vQjE}fo38mBP?&>X6S|%=WVYnQIRgM*h)mLrQ*F+CL zJ2P|X$`w;+PVFZY(@RT_y1VBUe94?+)4p5{Gkfkdt<$kbt7kz-eT6ZfQ^9&RFj`^zGv9mBN6TBO*x-Vez zLmixrLu8vJMCGolJ^cQB6O><6HXrGK9r%D=C6J50wEx~wXK<_nL72SWeE5CMAIL}` zWG93hMV&CtA=I(38GYrXkFJc5Cm)TjgqYvAw`VYu82R~r8*o(7Utgy9UjQx0gVl;l z1J6`{TC*_&#xg4F)|FyQ>>d)B9-e&h@w*ui6A5>W{(bzF9&mxyHIQ(9%lR6ERn7v` zXGWf9Pg`u3tVA&4h(3SNq}i3;`D2pl_0kKY3~qjD;TK8*jqe}$dt=PYL*rg5{zxq( zrimwad|>MP_f)8Nt}2)}Xdud6f%KgE0fLiH6BFwYfTXztFB#C(gRclqlm15%?tiCV z_@AA}@sH4-^C)*5%O6AJ#3zr-sTUEs@;o5x{%LX8|eIENPR6c}t)2_)MKcr!04JS(#4MQjtnpT~^)Y8M>2?8>7 zLa21JOh`t(!14$N7mOh{D=L15T@FF!!-NMQ-s-60B4~C089=jz;|bS^Zo;$J;jgOG zLxvZTO=vU&35lPeF+joKBq|w`mZpaxDk7~j3{w%yl$1OW^N>r7R$(80gqO;gAeBiw zK6y1Gn)n679MykJ;i%()rFzu*=yxJ7*`AZaTkv=!0h=~&7?KhF`0YOr~8 zGauuKi}hk6BH@~YEpYY!H9sFE%Q|{$xSf!yc2<;oL4{7W@*IZdmDM45z1h4W4CuXj ziafo&m3@>8L3%2E@U)m)yR_MK1y1j>VlqYG(nzmL|g$*HN1D%P7U{P?Q=m?TQ9`tj8W2^l3_cfI(4uw1VO8_=20v-X_lM!htKCF$)qW3tR`P5xtQ~pcejI-e;!bKlAeJ*zP z*g)V`*dbPnEDFB5xRqMI}O^XCm%B{f*}$mIMA=4E&?o-!zS z%OjKp78&mt?%Pk!`;LwYpUuhbRJX79U7H0sGHl;PSB zLBt9TcQBDfj>KaA2(=jGTai*LSDu|2W=%FyjKtXBI*?Ncm!d@K5G+vA&Vb(C_vX!0 z6=eeQ`~!Ws6hzliQA;dNo%%_*(zZdD$RK@=U@-0@%pkwO>%s#p3mBcuV)*H}RJ_Q!Ke_o4dVz=5Y_% zhh;FDNikW=`$+d%p=YGe0&i6 zsLJkbzF`+7ki|-}?Zqa{kV8|^X?q+q9~4=EsG-1nMpPF`#%7W|K+6LJ8!A$h{S52V$DoV%)#}m%ga6o1SZR>^e?XvrW8(>TaNRMg zFb>}v(rSxZPBOJg^wM%F2}Zm9NMH~K_<(SEkx!CKYYN9>JX26q1ndoR{~TTbLK&_u zbNl?_U*fQ&P#c?!a0qK;{RpBhPTRu1EQ=uKAAj1r^oR$B*zUJe?AyTj_-5GB&CdJb z)kojeEoZN%9}VZAYO~7L9Ive`mhkRaB4x7TYd3;0SE&z}Ly;F5)k{dEl+95|uu2?$4`Ndv>9PI%Sr? z#QMT~roXF;D5AyA-|xkgk?`Z2`1@;edmK zx8rwXYzOvE74i+KzrUZblyPy9orX|^5M2xhy_Yt@QjSFK{fx_l_hj$HErhy2_Py}% zGoq?2-tXv@0)DHMlnN0qHzHnQ5)O7V)Zl|?X2{kMS3s|dcwOmGhG+=#8cy({KZE^3 zRaMnG2PV%5vR#&vuC7B*R|p9%5>qoX#=0^x`vJ2N$KRlZK%t?9C6s@Cg@4$E=Sk|> zSc^yjE%3S`k>J8GgRqQL@^3}vKkfr55iPm|e2s{ZrxII%u+qXHJ%Zyjrc9W*(Od~L zBj|!*z*SXQnK=xiS(ZewbY>m&ua93)mmmW#f{273&+`zZ9Iotbg!KY;zC17TR<%(5)qa9^%t4g#cN%5dWt{BL>8yKp&+E4 z8tH6ZTY~{7Jfam=#aFIeQ4%8LwSvl0MxI+}pc*0~cd&Xo+T+=b;AH_m z_Xr0N37gdXh~E_{25VIf-g*;mgAZ5VcSU3lO^e9Fq%C{>py>fFF0Kl=RO$rBlp&(O z?dY&NRcbLfKF+5e&gA6g-r(73>;^T7En{U0x}-hxe(h$AbaWvOnQGEPOQe!em%i) z%5E({)s$n^x1DI*2 zFdPTQ8k?G;tlN>I%gWS-WY`GC1(g;%@%gi;nAo8;KQu|U7qjodSPBP2pv&W2B5H9% zA7nP7uEj&r#vzAL7jbfMJo3M4ue;A?a61b(DUzKtt|DH4LbvhZfFTFA zK_15)%*!#sudEr*>eyZNL{2tJ3&$azyn`kr&#TwTG(}9Z#+0H zDTmV>?!3^4Mlf1Q#9#!Z4Z?+7W|#Yj$A4(sHT(aqZ5NgNFgy%}3&DcRDrb@W4QUCs zn1VO_%tG$!?&7F7et3aH)|B;O=05_o<3s29dM5y6g(zx(vWdR1V|`nVVd-D68jv)K zuWqARxi&v6y1}IY^y5uGx0w5Bb|oqip-FGOm33uoFGojjU0Rr+hSz~lB6FY1eI`p6 zK5rJototKe$~ql-2-e# zkV=02=sU{IC($4&O81Bmnh_6)8C@ZVLtAe+V24wT)!-LkMa zu>$xmzr|(?gR85b@g@B}+I1`8X^r@HAGslQ0jc{TT^{! zkJRmg37ZmAIqq6B?H~MsEY}6D-f(kw41e2fnD4h%`+N5Fk%f)f53fcsSxtIbI;&K5 z(<6PO&6qE=rybwYV;1Uqp4=*TbkA-n*x9oK$9m*3KZ#reVXB0eUJ{WTqi4m<5aA`y zv2mEQ{9$Wf4}GMWqZ7Vs@Qyd%$bNi`Kr8P2J@OLl*Djh?9JBNz@rKCypd5^=c<3_J zP`!H3Pb>4(P%GrRp(VQZRTpvUgcdHKuIl4LnK6d}zLyKHrM!SQhMb(~MemGawR0#w zXByL(y!4nAqbYW`_K@j%q{v;oQ$ps!b0(gx%1nLmh%%;kgDh zN2tYe*Om^+`jDv4XZ-k-;=#U%wk$k*>*T6@y8zwy-mMx>a`}|zesWk`)a9cW6#DY} zr+9E#NK3z|H!QZ1y__4`+r9fthQ4~k+lWHp2#y3Zsy(UOliK_^(^fgwHo?m#UFON{ c^50vE&uyGoxGJB4V_#Xend~qwq3#d;7dT8|_y7O^ diff --git a/modules/admin_manual/images/apps/impersonate/impersonate_group_admins_only.png b/modules/admin_manual/images/apps/impersonate/impersonate_group_admins_only.png deleted file mode 100644 index 7475eb6c776a3e66a6f37ae5563a15742c5aa1c4..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 23866 zcmc$`bx>VP)bxCVC(79ePF2@u@F4ek!XgFC_9ouI)2!QI^@NPyt(PT=57pL^eL zroO8A>#M1nRFNFA&pCT{@9x!W{hp_Hn6jc2Itnog3=9mqjP!?(Ffee4;B_?;0{EMt zp#~TH1N-Hplo(9;IO#t4<)yi(f+!43RSfEbAw2jU*xal2#gP+I!4H>9do?ixkg22x?;%yi;U3hpXa%fa>aVjMOLVZr2K?HoNANBm+ z)9#n~mT`g6(ea}b?XyS03E|V0mKs;vOwUuk-7HV@bTL01F(j%$EHU{jdF=-#@B;jn zIvnRf`QJ-66ViVVBT=CdA^!JHB=LU#f8U1H9s7U$wn$49*uLix4%;PO*YzNRW-^!g zuH)9r@jj&>i+0K#Lr2fjSIE5*nTfx_waOoTK;*i z{3M*I+@9%YZT#VUResC!)4lHLO55@`*OmQ+dYeNvO;bF`R)SLVoW5_H3<<*7qFqN* zMf=^b_tWj}bqBQRAM{K}LlJg+Fh!gu1TW>!bvOM|+O!*NPa;^`?aBC^?6vLM>N38J z^T{D}%5#ow;p;l7G%VV-G`-brZd`U`BY-i?<2^#mnh2k~Gu2PsmAz#z;5|1M?yQiOj$9{B2;`%cU(=vrwUC-I?hJ1N zx=f{$uE*PB>Imiy?nP_PhU5B0ttBtgcJILvMS){nPqCPadm+fuG)vvg$FN*3>#c$^ zyVmpIZR62Y_LEiL=Q@6Ehdw+OVc)CY>J^us+{1ca=Y6&hH|Kpy2OI;WUm8*0Hg+2A zW6uD&)Yn=Wa8WV#T;^4R>iOrVFA5(&cUt*|# z%pH_hltdn9gw8tQt{awicI}0SHkm3~HxSSW*V>=%K6_%$%zZ_DYjM%A9!%0~nxZ=^ zOaL9LJs-bp!W5uOAZ=f+1z@_!v9{GR?lL4!h&;D?o^>IPy?+mDkiQFVxaleT%kDX$ zzrVy!!0_jm;6p)SDH_eR??x`nvG3gyzCTixh0BNAE>f@1E4*}1$A zi(?AS{A^h9D7218VBc?8^=Z*|{{3lrQi?(-4g26QVAcEjkGbvHT34Z$!-c{OWo~-5 z&z+?JvU!ZqwS9(NdsEW4<_$fDHZaeA+=DM%Iv=1A`O}tntK)fGw|rDHVY`1pa^O5) zX?T*Ts>lw{^kY6`(R?S(oE!ew4-SJ(BF?GtDMjDMfwlGQtLNWIsbw(N?T$$m5VJf_ z_*^H1AdO%EjN3GACl}7#*7wY}+@G`@Uj|_CTU2{UC*(3D9@ow3eE}^fEeM(72eW$K zHSxB*<-`#Tg|_>S=X;Tcn~jLYT}>ikuf~?YQ*sK|gHk$tHSgVH`zU-LCb!4}{M>vG zzP3)A5wd~rw(E0_yW(H%x9o=v7LeqUd}9;I9#W<!!O40#0Qg4C$ zR&;isHE|BYw-ESQI>RR{PITGm2u#n3a@8V5+kPT*rw~%dP@*2f#3j$}Kx8wGNl3$j z6;s30-66p#12nt^n>4>SY^=QT)l?Q%COdsYN($IGe2F4Zq;^LtjnAEB_a-5Q4BO=pj8dF?piR!sv-?Xz;jbxMYb`xMa_5 z15EsGN{e-$ch&UVOC(;HFgGL*c!Wq&|%^?Q=3VlVRlfi8>DnQ(ZiN(3n z=IP35QUAw`M0LN9iq4H}Dy zLx$?+-x$WzCsNC(h{H-&iEDO75EaGdGUudXD~cjXk}|L{WHT)2P#}^hA}e(-MjMgA zE71;P%)Jgu&RJVGl&b31CPOSm2%+$CJ1F6ClN{mA!atnZuBQe#B=^TG}GoT~iQa4*4KAkUAqFZo{i7L8d=1?jUioWk-otuO^Qfc0CTy`TH8|CRBpJffl^n9gkpkd04NQrsmS1?aB2w#&6rV=7B@RbpM?}9M&Fno1bvndj^T>G|@ zMTqRa#zRO~hX0z;gdA5d67HF@jMswVfCe2`w_J{6blCqQ#DNVA9e(F5#PKWhpwNq6 zqFC}smV;nrPBHBZzas-39q+5(bP0ktNAt!pb-xI@qo*#S&x0P;7?lLhkxVl_Goa=Q zMxi@@8h_tcypwLRYJ3%W#v|6a5%~@?%U3M1I~e~lY-hUw;5 z1urE0*&?|5vg{Gn2;TTN9O1ktn&OqO>$fjhkys!hRpelA@mI5J{xQ|3>A+n1s~DPwBEN z*!&{h%;JT!*z(6BnNnKISoITejXz*?ne@LnmY@Iq$2{AH3ERQhZ(W>0Ga3Dqu#2!o zXLVj#eS0hPB4=>=$sv(*(0fpu@I)qc5~L%h_rxZY&{R$#A)N$~A;?m%Ps{(}>qa(w zYqv@aEft1!>?ro?QBuM85M_zYgUwEoiJlUqLyP6+x|Z!^?IjS>wbgFv-e#$%yYi!j zlk|7Fu6mo7VyGxD4KvncStZ_EQF;YEs75=6Gf*NX5px(?NO23T+V`Nl$YR;_y?KE^ z=8m#?Shxf?st@eI?Q(RY4{3jd6{Jc`*Jl}4najxT} z2Oe|<+XO3EPKlWGho!iP%#-e+HNo)YO|(kgWZ8aZn?JHdt|i1#8$>x&+TKj}F?6ss#XHXr;b zWk$oKiDWA;3$BJv_=D_{eqQMp+tHg6HLZCA;%YC31xWZ+BKcj8Ebj4mQ4)-`vpo(< z=+<==10K#Z5fpW)$Fq$!D;hUYTu<8|$p`!G_a~g&m0I(IB<0Vw>bv9LRCzSjUobIe z2KTiiD!NlAGN9#(F*G~ehIu9lG}rNUni+R*^1h208(Jwg{S>XtX5z0J$@_x`S?xkY zV$*~r5)K1l?eFX8WK+A~e?w9X^a@eLt(Z+oS>I$7u=BEE@H&Sfw%l%#Gr`kFDNF?V z-sDq%hR@O^*N__J#q{00eIcmopKnnU{AN2BKUeIxSkqbZB`KWPw>){972E65OrN`b z+lsbpM`*VE^G6lGSR)oD%$86E^Tqr5R}&STof}k^ffMH`m9L@MEf>bvEH7ml?Z{*- zgPpacnW_b^&o>-RWvhg48e;6k*W@{U4#k3e+^uQzyPSt~W`a$b3<0k7vnT>oG=ebb zn7kR437w54W)&}vKRlh!@C2ng9lR2!Z52&P_2}65u!7Tky>%Eb_m=TzxWNoI$G{it zixa*Lk1YCbI(s!=r1hy_Q*ar14i@$Ou;E(xK}0lPFBg!546Zr@#Kz$YRysEtln#f>up0LnwXNAtR;9wt)dpwKVEzjmM z=z4=o9;p!h*MwEJpcD}#=!eeeur?7?oi*}PXuYxqN*E;Fao-vrMZs7JEcQ)z)_64_ zpDfVsxc4i!kQs*<8^MmPYKzodw#-QtM#(!V)=PQ4>Gxr#m&_CF43MQDD+Yq= z58vp6f|bc5Yri87ySvrD#2hs$$V+D{wOU`XuI#fw&9;_sLqG0zH8g&U`9D|T9rioE ztjK(uc4Ysbf6p$G{?ow^yQ}FuGc$gxiB>U_*J2}mvvt`TL9(j_RE7udT0P0KIxQCleSjCRUh-@~Y{DaW$ z_GLHB`!3W~IJ+ZIf^0WC?Hh%A&m1ZV^L+lr!`)hpESW8ls}qf+!=vktL2z% zyu5AZAbrKx>L!1AGJ%@E4U+XL)zo>DF=rVpVTm-ptHBT_6-*V=FW;PJt5j{+!Wr}% zqnhZQ-+Ow9u#Jhb}XbK(MfSbG5;=xd2h(_u|}UG$?K9Aih28U71=>=ZWRgx zZ`WX@{?IXpjV1T`dQKhCpzY_&=L&*~HKcIM9UhYw$&Pt@$zg!(`1!ST2(MS7eRpJ| zi2HX84cPU)iM@a#LCwSEo4+y2Dk%(O44w=}4jmyA!uO-m zBDCnMW*|-BqG3SsB!gzID^_S!c9fOwNsYdOH?>N$`SQ0y1NIkQ$iv+|XWi^4nN||b zq`U@&>&TJx78ukk_7KCGYHAl4ww#(%{Z^-}SiKW(C zXnRe2h9&ZE2*rdlnc=VT6NQG+#4Hdt;d*uI*~3bz^Ow6*psn`gbG!(4Z;C#gbm|zkpA%5DF7EbbMin5kk-P@5|swIOuO1Z%lB359L_*|YL26k zYChi_AP^}TA^kGCj<0Ra-Z1k~4o~FOf6e5Qc*Bk1^Ze)v0gJ>RD_EwNtvlab^*9k= zj12)YxNhq(i+VR}Uo*-P;m!JAFIZ^(V?tW_@eEYKf1XP#+MBiQyWqjBXn%h4{l1Z z4XXO7~*qaKPicR_;xW(7>!jiNud_op4p;G_poriH=3N7(=f zO3P-n!1%Jy{qYGXS>EV<;?wuOO7aAydBo|5cUX$Ex#EbZ^reAN6mxYrS8-!|P`J=s z7Dy!?JP*#O!WT8^11|W(yDbzZqswzpnC#7hnkig70Eyk>{ooCgn zCd0OQe+i^ChxnQ%uXx6|rW=uQ=o(#D+y{hi)&fpKX`(B=KA|9tfb!oGVPK{ga4t(< zaM=8w>BB#C>0ed}d2BOVKwm5k(Ptm+WPTanD1vsEH1*tYSFuXIwXwrHPlOv5%St;c zR4964e1<|jfycko%XtxRt%6}k0kg2Z9OH2{&vGw3TyANAqJ^U`>{sVdrU%ygxkr#X z_99agB<<}s#|i#*-rd#?E-hM$67-l9!$=;TCGJ}M33ijNkK>b8QH zeNNW4)#O0QV{ZF9Wg9}~Vh<2QW)MqQ38rB06;ZRO#v(|FbiL>cxq>k%^d6MBTqR@3 zZAynh1K!Yl(RdX;2Uz7g_mX|j5A;Am%d6wXIR$~^TGJlAGyG)`JWswSC|2XacTTsQ zb)zmy?s=Xx4L})+nIJP5V)((e8{td~&R7`VItTr1>i_gV1+NPOSeh+xJ#UNy(Wyk- z2&2!k2V=haapJtZ<+Q!!^PlR148vfeBjQ9&HG%6zJCPB3$W{%wf4`3#H=}Jq3hKf+ z#+9I(@p4^FN$4u^@fv)r<`95O0o1m1aFTF!g|GJIdTkz>(gZ74LHJsO&;=!#f;;=} z?&_Ah15@a4tml3~%F*S!Ii2Z);E=^CinXc%a!$C3q8bnelOlPt`vJqVb>HxDU3N}c z{4yc546RL^F9AxOcg?V_4if-F<1o-mnIbUSK`Cd8z9)eGW?AP8yZZ=~U-}EpRWf~#STl(JZ7oC9VR`+Y=ZpcT)GW=dc7jm+^3~-%o|FQe-H}&{M zw#nv~CgIJUi(_rEL4bF0Jo4$MFwJC~GvFlkpW~$uPyv(; zAz?G{yP`b^VBZHl(cn3?YoXsyJXM5Ni({CCb*zLb@?g)X|2M37RJ0cD`-mGZc|!Mo z{}tX=$laAO-nJpy^5=@Sr5~l`R+jH)?=GAZoY9!+JC-2npUbP1r`e>)od1zYu9*=h z-C|-C9GlbD=&zo|TMZgO?^hk}32&rO8mU9wE;bPatJa6FGD0|@gCwX@2T^<I zhN;k}sK>aT9wDn@Iq&ga6#TrA;qZMpms(%=T*2aXyPeXfgyIro5Z}NBogVuNnY>k4 z3<5!y6Cxd0^6h<0s6o)!6ZivYlm(bdUwf!E%1XP>FdX|^6I_yC*miD^5 z`d#03EmqsT*Fh1^@)9T2dtCoQ&b=ulZD&3LwLS8Aoxdyt2x-|G556Sz%LaD5ZtFd^b*-51-U^~G=peJN3Q=yZR@2BOL2 zvSDwJCi6qQ$Gsc%i6@(1vkc#Mqp~IrkLw?ZD5oBIV{2{)-C>S=XtZ-fz$Dj!*6Kt2 zHoJ#Ebz5AnwX?}@y#U`m_Ej<V(PvZgEtxTZ}BAv#eZQFg zU5=R8IEZK-;zZbqTPw%{*XjRw^L%@^X3hQ zzgfR>qQ(~M0mo0}dE-SP=r=P^mnw;?fo|P1`At0z4=ybcQ_xhE* z#m-oF#z|ZH!?v(j3O;r(otvO1boeeO5Rmh?PFk)AW77AZkt}r1C55c2*4r;6hBbRU zKSCnZ3wmUP%QBT&+pT9RQd$f)>L&y1hAe)=V`epW(<|X=&0qJd zOc#Idyo|7h+plSM7-b(wT!=e#FGP`Ih#_R}E-wx2d|#FHa$zb)yd5)^yA-=jYYW!B zXo7}w-I2Zg7X>I+I;UjEfkHjnedQK? zw@kSMrby(#q~KGj6-^eS-#rNp?H7^$zlZIzJc@(Moco3^%rb1uj59i-uYo$1Zxh7B z#(l&oZIxox|L;Anaaco~7L@&fEsUOR=H2~$lYW7Xfr@#czw3Q8?0SsNRnFNNS--d* zVJApl?lxLv*j`mm@()LHj$7cM^-Jre@-kGYzgDhJy_wbXw8_xvW}|XwwZ=_eNE_^C zTmPlU;5q38w5jrsjY`-{Om8t~=mV4d7#KuBHS1*LnH0cphz{K_#cF!firfOpoFn!Om+<`npc;Cv*<^jrRMm zk|;;O&J?NGcEIAigk#Z5b!1}$Wn@R6>$AVnM`U>o22uH8aynt$>^&GVc-rfemecy_ zq_Y=y<{XjaLd|Y{uT$BW#wczYXVrdcC1pLnf9QyrK%k>fWH?}tZoDtrjtHy8mgf91 zXac|KM`*J#Bj9>seH<&{0Qsdi_>puFJ?lvE8^0!rN=R#-Ct7@tkIKTvH7ZO3&lLqX z#-JP@k?afFbs*i=rXF(JEX-$R)_zK1)7+v(W#DEwQK6mfAxBZ?>-9n<#ZW@x+icEc6|?JsO3c93AiOEr zg9wj7egrj|4)?=c;_4Z^i)fVyW~s}sqxWqnS>Ihs%%JPvYe&mMG?zL;H|c=d;jUi) zkar`FtfjByVH{R^WGQ_aNcBp(qz%|&E**o`WvWy3JW6ad+V=7ytc~_SYHBlDHWNUE zh=30<>;|RT7oCYLp<`h}TI+?(`1crU8iw$5<+=ikk+O}jIO{-iJ&-9v>`Km)u^+HDVTN79u#YGO z=shq&jAdIjB})xbe}m!(mkHl&bgeZ4u4!}_m$F)>jj<5PmK9AVphbvEB{ula&%^^R zE2@sVA0f;pB}`(OsRSDr-Ka&<_-}|X1F@*1bO2K05BGkT02?lBX@Xw*K8~`rXlY95 z{5u1QTcH&!3L|?LvjiuV;p?2nL{6*F1UkKBH`V0ewh$~O3tr|NE#87aTFZ^NG?O!C zSQIt4x`2rxI7keQZCwGQILQ&n;C5h5{;UkttG_^?J@y35L`%oh?bGYl@7V~lFwU7y zLZuRJ5VzmNCvxooAXq2BXCZzq>yP`SSM3)su^gl>-fci>OzOFpGK0z5p05PA@3xtp zgkbdDTPUeTim+V4QHyd_#`z;gH;kozWD4&f#pXw2LdLTC*HQFt^CdV8>cO%Gf`-na zN!*Da6-D#E9n`e{NLsxsM#MB#itqT|{D#N&AF-@+Q2I^{nv$+1y@0m-qrp6ZMH&zledf?@Bw^YTq%bTgQ)8qiB8J zYv~C_&ye4V)#VP%Cl%8ovVsk!;E?hGJ#sNL|w)pB`&#%H1}zt zQH4eG-$+lB;sC?!%#q4oyv>f)IExvmnIh*e`t35E{SDH6XU`s@DuUJc%MPG#9={B4 z9Egojy}-pp$__!C01ao6l1m~}QT)`Guzmija?1F{n9s5S$ms;< zZSwOvO2o_~Qs{z$-h*)cxVK0}6A1Dq87|k}U+?L_R7=4N z8A)k1_n{Y8oyea8KioW0e3x0!ZFZ`PDq82-?_m(DXuSx(qCc4GK?%@TdGCHqui(%Sk8pYN?#W;-Vno~ZxkVmSZM^k|gFS=LS^qQ;N>G{+B>KBo2 zQ;W|XM%wyUNm4!zxXL`%J_zNzpA>|CRm^`FuhD;)S0vwqWFmw-xPf$j6Jf%HQbAu` zM~N3}-BoXAy4VRC&$t{(5akz0slwF1b_vUczA}W<8L{If3*oxxyej(UlFmrh`_Txg z(&4bIW}L(Bb=97m`5|1ixQUT?(@?x!bmtZqvC-@hO~x)^PFPaK_M~HN7pTXL*=tE7 zh6=gpP{^lnbd$QYr83{jat~}(X-1+!N+Id_Eq5~W%;yWb-Q+en)?FURT4;NVp z-s2+AUM(Vuw1RuTXW^vEIWTXkzBz=_IK{P{4S8xFhSzTp<9g_;kJ=om8XOHzy-kV+ z#;rKX9s1W&U8-H3gYiOg7if3usa~ygy@neS>#T583EnJt1;H=@I{=T=iwcoSu>@j8 z!IImm{lkXA)(i+psMg0Shczm-)FfD-EwkZk%vSUY{J~wzH4l8dehVR|pbE5L{?{s2 ztn`B$qq|aU&6r-(ENXFUE|c%eQqaFfZ9?%sh?vKyI$cTqA7lJ*DZ%vrfg{c8E;FE_ zgY3}f!Sd^4N2lPI#y*1d#V4q92DF>Y8?*+&_biFzdY|Xyp1lJX;K8q#_4cK#9mU$N zNwneF|6MdyIyD{%Vu$?A@)a5HsQ2TtMniA+Wg{(q`XWpFS!=x!j7TKesicEWDSdrLDc?3LZQ4%JF_^Q=>Oq{4Gx{*UB@x)Ct9Q2HH)5$bxWCFOtg^+d7fP7%sa6lBNe`l`PcKsdTLm} zzeWMYh>bx6dh=tz6?Odw$hx0>Z_D`DXcI;MZHdVyFa|k!-~DxXyu12>L$Bxr$WxKP znjc*FDz{*h64SvwHWN(H5L!UjsqglQ+t$0e^ZKHrzULlcl1~q_f9f8BSB2SQxh?`W zmg+vMLjdl<7b!u-TWGM;=K+%a2K_iX5l64ySP)|_nktELf20G{FlRgv&EhlFdJ90o z@+WoO?e@Ea(hYhsF1r=4O9j`%pAF5v&yNi^GB(8(PC;08xlN-J(C9kWCgkzgzRlyx z5!i&(&ola|0IAzCzQ)9o-9ir#c}lkk?)2jkc3h2lv{U7HuA%ooZA7?1?;ty0){tXj z1p?N$`@Q@ad6jbeQeb;@zZjxF{v-$Gx^wk5+C0DpgezjXG79Wm<<5t*wqU9=`%r(l zGz&oIwg(=t$PAZ-3st==c50>O-~W0U0nu30pKP2N5Tq_#xxGE@cy`J5x(HhYmCq8? z2?#YS@@z(O;&<4PI!0M!%J%MTo@M!a-lP98#{IC~a{u+S;6pN3u+PQn4>2`R)gRR_ zyJ$nkcve&2G4#%i#)v%ak-M$=ZwO3g-U1N31dJb_Uwml_|;DTDy-xZDOD zNPVtiGni$98wRPsh!~O0CEOGV7tOT&4>e})2a)fD2;^ulx!FCX1EwP{I=5~C5@-Qz zV4kJp;o=0;udF^ay)($U<~Vfn9_67HD{JUkAG@d0;oJ^VmC~u9=UMLwA$Z2g^D(T; zp;Du)iFX(0SpNVK<{KoNaSVv}x4);UFy+87=yKO;q=78WKkd3rd)~M0V=TCPYfB7v zgRgO#0aCXe9yah(;;?>FW zqM#Jlu;U2JE(YHgRs$4*dbaXF{e=Si-xHRAQB3b)`}+0 zbDmMDXT}`>#okty+Xgb^VuW?^`O7GK$Rgn7x+BRfa@&Ji!Mw_Bp`Sc~< zY>q(NPG1C0piuz{y-F=GIlLM!hM5+fzxVW~66kwPMsk#CCbtaYP|;`Adac_S1`YU1 zrO!YBV>j=B=BUiaO}kl(Mu!@&P#R20+n1rLr1sa%M_HzyThYRI77e}F&e{3rVBl-( z+6y^X0k2;Z)ZK6*N+NkFA@IwGwe4@bcRSQn35EA{K)^7G@{FbsX-^ynZUl437s641 zo-Qq9-2=f=S54op?JBwM7H~g&BheMfk+WeobPp;d}!NowSM^UQs22)UJ9A9?m$%U90|H&lv&s!Bq? z6+|BY;u8Q31(G4y4K-%EEICLeSh9Z6JY=$4G>iKK1*bw##M=Qyygau7Wmi~;mN<7` z1*LLVicz1*ASK_+4{CI~e~Ij7*aw)(dQ$#=e%NY@p4R+8+A_%UYj*eli!_ zcpiD%Qs(yiHPn6!bs1|d#@P)wg4wLGknMe~x&Qb|iq!C8EiC$r`!tl zpL+m++qv{c`47v~?0`tnuuPBUZZ2^UfGJ!FDJ`oGPom=2>purXsReY~^qu8WRyZ&Z zE^Z}O`8DNxLQY&*oPAc@cawI;?8%Fz7SaG#`}>G;G5Djxb>SL-cUSQc43@fAoA!+p z7ksAYHbX0Y@c0^?HdTH2wkf(UjARe55SrS7-Oy$f!sZJ_z}&36aj(`|YK1RBUDpV( z{NfJ&PA0=32Z!uqZx?BIX1M&XiP!+B#qk&%bskQcr5{pl@+w^S6{wq-Fl=nke2d5P zH0`@_CmMjwWk83}_H4Qyu6+;g#^vb-J-lc3?lu+rN`e_aonod25<-?3TjTsaNWn|7 z(BgwwJIe0wp^}I_a7oVI3SyCZx_=cNUughlYAiyc>#V;a=p<@@KRO!%jogI{(g-Z5 zDE_gFo)f67t;!aQ^)^(>l@ZzU)P%oK{jqRY`+9_=V`>e7n=z;pivf+0t#d^@nWOg= zk{(s628utHmOF#Gfim7#nMy3Q`5<7QZNfsbGW@$Yspbk2Y(_Lv-e2YDJ&?o-yVdq& zy0exXPCVeU(YQmKx_DEvBuXx64ZxQhAWF^ul z=h;}J;dX3%I{!rgXIwJVpBUj#2^{c2?8f~Xdc~eQZJ;vIc!tachmF9^QHdmSdU=y; zZu?FhFExEJ+!~Ba#$erPwa7LtGaD`Z`S>^};C^w8gJ>!#xp|Q&C3zElIDLnfeRcF_ z`hXMVIN~ifIcwgptcTeciU)}m>FE@rL8*_~qwy15Tq1L{F>fWZ25H=F-f(?;7m52K z*GY7{sUTTvc*R(E0~VS8XWIlE{%1D!rfEfiF%~ed%ybpO9sx7hYS}ZWdi2>vw9$-3Y4@d z2QW&MOz&$^O{D|w^1Kp*F3z=V>VA(V1f;;dNaMyt(W4sPJryT9Q-g;~Xv4&D`gqx@ zLa#@DR=5_Ik5P=;3hxy%dQ{niu|uT<=iYZQAh&iH*Rd3G8q2=6;uh6C=iu9F;+Fe{ zsx)#pi2s9L8+~|vPks+0s+$b~(6n0!oP(s;Q<=-G4R2OPJ~o!0+Y5npvOu^mi&_l@ zBs`=1ra208n&xB?@E8GzC^4_xQN%k;Ol`qfY2b3B68USxO5%RV^m$PXKTUzgPUs); zbx0pdohD!d<7No9Oa)F5vvF4+};o|CFGD1LA*%rg~=EU-m-O<{Y^;64 z)0#lPDx4JiNwWGck+AV6zbEWjCKw`fP8KEtnYFat_F9~?l;1aCV~FKdJgVq$D8yH2)xN+$T(+?YAo(1f|$&&r0{sQQn*Tb*mOd4 zq<}9swAJBN@B;_mWQAXQl;FTOwyJIvCXL6CB$CLr#?NUmZ2U-@a@2O-rZ$VO^Efgj zR{*wWcK#iEj19ky#CJL2y)MifN*LpgPIA5a>QAKmU#1G?ZTM{gMaBJ!?F*fsUf=yA zr!e#FtC9Eb*aICh&)W7H5g3$#F+7?k1MHSCIA4CfH=RgjwUon4jiV9^k1KIHgWA&? zNImBDk#R;m)7stG(CM7lK2cU|zBoZE9^9~NqH^RzJilDOO=?oQ1U!@M2Z@1@@4}iC z#tKel8CpB$KKj|s|A@!_;XU(&lk~b@WfU!C6}jz9==CUlBKWd1Jy^X8V@UnB9jsLN zaL4*UGpyF^)NHjg+^b!giV@2<+`bz^w8K@~0-2rlsiizWve=NbU>RC}6p6Vkwpbbh zgswdH5#{Jx4yha81Em_ewMp1vD}&CYKS=@0Nh)(71x-M8Z&z<1oBEqyG7xxv!x>}j zpz2pN(#(4x;nIwUH&PTz^nZxcBXuD0i4FQ5^&X8n>3zBb2R?k7IKHx1DCcW#0wtFf zQC@j+q6zVjWbDYdqIIM)$6s|~_4RFs&p>^WyukZlwc6gMz&7}Uo>4dPm(cZm&oc1V zmVenDuXkm9WB$L-$k}GAVwW(nZ~0i&R;X?tRK6>_oNur{x!bW{zR=r}Eip4TfKJ1G zvmuhyjA*=SPf%(#>hO6B7LN8n`K)qEFD#)u!AW0u zQ=lT&Xbsr^&+7+HfYq`}74vg$qG?iGnRjp#LQzqQ-CDz-Q|38d@aND7JK)z7*vkoE zwoyauwseobGpRF<+Sz?Bw$uGVHTdquTQ)n?MfoF5yWg~&KgsRK4o04LKhdL44ZoNr zAhEDW1X~H_+}Q^Wc@s1Kc>@o7ttU=QGD5rwqw&8y3?zXOe})DJ@)xbrZpZl}nU-u}uUTTK))?;AWrCt*yqH(KFV^tf6TQ^%kTNI> zv$ub8g|gDjCd|LPSo^6)SFPptq#z0ymvH!@0%aTT~a*53~YdS z@{maR=9;tY8>Xw+Ed`hbvnytZM;Jv78Ay2wrz+=f;EOq~0b$=BK}x>Pq# zaxvh*y;|3rg#FruUjdU)MPP9d98J-dEXr7}piysfMT@dcZ^AUzY4mHYeKIU;wK{CL zXHAKh@QOGnnzX&1F+h<0wm{)T#wJ6(p9FiW`;-Z(XE*WBz*%8Zt`;E=63xY9IiQTC zqc8N9cux)LuHLr~`QlzE+fI{jm6TeAtuSF6B(PEA3Y2g9V#*>1ldhh3sK;+mlG#~s zy}O9~Bg4kcx%-_+%aU!kYVrnH!MILY2M9KuE{uKgr!M^DH}L2q`xDgFZkfji`}Zi( zXl*32gv0Ve#4=v?OR$){R?0q?d@EHK&$DBK7R;5JG0D=}GbygW)~;DnX!jW`$$Gj! z7~@BH{d5~N#!&9h{HSQ*V3A0=u`Is)jlSM^wr6++3~)Yj#G3EpOmgHeU?z!xze;>D zF}d(VkYT4m!XSVg`dSVW6$-XK z?#Uc~fkv^=k$zY5ZiXO>g3fsOpFUR>&38}xR~#C^@nx~iaV_1 zz8~p!B*UH9Z`Uyiqqis;$mKucJ%=% zj>c1CaWJ~!VifSkl~_tBDkuJ-8*lI~g*~J-knHUYPXdSKfX!F*0PLQ|XpW7=V0Bf> z68&BOYKIFH&#MPF)I>aZEIv877s|`#qWmf=ys# zzCj^Tlb=f86Sjy;+*?!Q9^Zvb;)3+{pSSLg7keKS;+6)sYE!-O8;*mSnqlp{j!xW; zoaY>CJ}qC!y;XkTCKn6SV9#-cthlhq<&z?z2P}Xco{4XmVDSy=*)$v?}9NlmkooZt2X-jq~4 ztWo!3%dq-;PYqXOt|~^kVV{5O>u3j)+n5R7uZj8OJu3>r=1plKC1(b_3n?C^IM`SC z4f{z^vZUwEn^8Pk3ux`kA=NV(Y9WN7feH?+3+TLE{vkCVQZg-Bjac^sbt0JKSj#1b zE=h(mUIdD;omE?+62T=0^Km5d4%CLh!iUn_x%rU=5IA%P#;r#U(rlt5hm+Z?l&I2= z5a93@efy=S62r(LMWlf&ZfGzi>aZdDE^sfY$Ihtbdg1fWvD>y&%t6OSkr^rP?KsUu ziaS_YoCG#KK_f4j{B(~TRxG$93bXBzAc9nTX{D@x6M47_vfjfBu6iv~$QI3WG zN+(`ycCaKF?t8|17a&(R&+4WMqt?af|Hmn;w7hw^AFm%Rdcx$Wiz+Qd_P%~+cgT=* z@gQEu-8uyoYbTSu%Q06a&!>ZSeYttCuOt)M{we zgb36WP6qtMWVm)J8hd+g8hfq09gS5ldq+sP)epSb@6JatV zlrw}!nxN0}Lh};SAVKZ6J=?>17NYI`0UL({j={->22;Cg#39l?uO%P0*zjl#J)X~f zfLsV%L|w@gpvaX$*e68rA&n2xZXSN3t>m4U3rSd-rxA`6yw4Sb(NC2%5XzwHNr5==gKe{`8KY;DsSnD!7CJQ&T4-^iHLJ1yLj~GgE!6p zZ6KfFDwF`MhxqpbLJOt)`nv$qKY?;67M1)7esi8o3zXmMY;OQduTv%hErx&LAp*(Zq;V4ivKb@N{7Fr-ug>cC@EFit`)T%qWRzr1Pl>85zBO74C6T|Davv@Ua0%h<_U2DJBMtC25l5uZ+9|IX0`2{f#=-r zJmIF=`{8`x1fb7~FW)TE1uq6^%7Kax6pB!*k_z{drcu{C%Y+eLgG=^%L?rYdy_XYq z^R8#pN+OzC?ziCTm@|=0MRvc2SkM{pt^oSq=UNBb^cnaap$|_0+J*vXAZG)Jcr8#@ z^2!9)w7hM)WntBG1`dgJrN6*Vs_|0o^b=2OZxXtBmx>hGr(OO@u0Ozk3?=^&r@e{& zpj-FBRv_x2YS`3vEh8lsOqS`-$z7i4d1)kgIckY zD*;>%93xO=@JXgPy0t9uVrLYI=QMb7RJKzResnTG#fsA7hc2^nxMi8U5gg!T+es#SQ4wH+D_UQ`j zhIRh;xftOxaymyc2FOdSC5Fe{;{vDFzW&r;+t4EZeI%{?UjP3tu`s)FD`h!N$vAT> zRCnDrAC`ZCZh0nCVwe*Fj|;%36CM0OiZ%+>;lKudtFql-V}l9)LuLqY`8EO9`hXx3 z)QR3_0y_ED7L4%vL+K)=Y~d3iMsnp_j`Qt0En3$^B?*w8;HkS{t_zfP-kc6jfEi$F zS?TZqG{pL|ivML)PbeS@shAre_Z;;G>DjeUL6VxI6oq%Kwow=@aHvyj1w#cF=#J=F z48S{^>)>y^j)4o^w$l%G_5|&p5$2jm0r0?xpWpO7_Gw*#8lg>c;{M^%GcGhKEZU(3gqtO(ZX$&nlKX@RwmaQ>HX`mrHyE4*;wV;LBaNtO{ke&LM4oh< z8UT|*_ab4g0 z`kd#fz$4#-Fcc;0L-{ex95^8)Z{04fK)B21hXLUfyLWU{3`07+q~f2z(&<*%_BSx5 z4JiFzf^-``K$j0b_ZKK*2U&|ovHM(ddhpvDiL;=~rI?v9eZ-V5t>K6t+WP+f zuA@lt+Ov?N%|+L`lu+zI|-uSbFcdbxajw&Fi;MD+^jAg=+cBDk_aN@>Hv-CZuecAEzzG zF#^Zbaqa*y!&S9MBt{M#jkb41VC6~Ju=7RmLnei6zqo3BvkRKivQp=nCyE;Jiz;}F zjg{vG_Zkk*X`i>>&Ypa5QJu7O7H%}e;zi>Ra0ejTYXiW>*u)S_$-du?+<&U|ZPKF) ztcMv7Idx#Ym99V+O~NTSqg!d&uBP6Od)==suxRf%C4d@tx%|FHR5$M-re$eFMS0YyK%QUF`WYnlI2*$V1qQsSf( z{W2Hk1Pl%x0Ld^!Q#u38PrFKrn#z6mJBd2>j?jf3UrcL89s-usG->zWm@Y9U**@6PQ6mSKXyuFA9; zYjfio(We#$(X!6%sEH3TgJZ<2dDKShmY3#17GGmp8+MCMSahAereEF`k|{ApFl}-( z;vW{n!;4;U)ULF#iRkCe3W+zV)}5Qj+8+G0p#z0vsn;@PReb;>z`kYP7Y@rD7Pm7= zPf$fbE3~<{&}g*smsr>?I{jLl7RkepK>64jOlQ93q;SPGnejy0KFUF_&pr@S$=(UsLAxx68iR&gI=R_swY zV#$nztFXv=Se~zC zXy{$4rNC8Q5WKvZWt;u#`ztq7e)hC+k#G==Pbzr1#L3@_9Xc9gR1wF^6A0e2!thHS zA-n@4I9n(CYnq)aAuJk4CEruH4@>@r9&EUyAg^I$+=F&Obwb}f6ho9$3DC+pA?P;F zTpTdcH4mz+l0Z-_a?z=@0a)jgLs!8AqIXsP7YZ07i#)&bt49*%Tm9-gQZ7tkJ9%#J z7DanhqdmKOFB+i*GwD=tm`iXx?oW_2A?jnQ_(kJ4Ks3ocz%!&&r&?--b}1_bYtt&E zOU+Sl53YsS{XnB*wFfn7s5ijrj5g2BAORP>8(&6yN;B0~{ukWzKoXRAe2Kbe%Nbt* z_HKN*C_P8J!S~4f0a0kg4+loKVJFT`!^dgQX>)s9Q~cO4d1b~mGk7q23@ z@L%NrgzUJTi_0FIP?K9mRet96kH&^%t1TSo0Rz@}-7+z#s96mwU^8UL)&pBs=R=q7 zz=Mn7SPC_Lz+{%?IP?G=YUkg>k*G!%Rwob+2Z|1xFdO9`dIAAchJ~qG$+^S3((y^V z=U@Yl>*8B?jyw{|Zl{86oGL<@gV3j-%A0ZB}dtkbpBp^EjNsy}%blYq)h=}+74 z`63)Ub)$7VkmclZ&GO2?T^0--r$`F`D3I4^VZ(Lewyz1L&ysi$)i4rl z))w4f9pD_fin*T@7@Dg43T@@=9d_4STy1kopn>5u2ZQK)%vSm5SWf5*VC=J7zhgGH zD=b}Mdv7jE;sBQj=;-T?+QVp;cD#=ihN3U%sY18eyr|__?hEIHl`%0&XbOAzwSz!{ zVz=VxSl@Q}$X8}x{GtSZmbsm`kVz+@WM$_yBcp(}3j&GVQIPzgHbXxd+L z$Gl`W&jFh+PpnqtOJvz{PL!!dbNOzwAyWl%c*`GjhY>EtKTN--Ut#>+RYsqt*xiT} zqhc1Tt!P@hatJN>`zU9~o^XJ|(hv+I#>K`_nIT&v6Y{9+M73j~3Ye7NCzxA#ioxHB zbnHm0FVDVx84^`#!nnm~GA=hwiG(b}B^893iTM<=Y8n?fR5!s}ECXGDgtRL0!-;V=k7wcdgp`sKG9S3ynpqMb zLblZ+GK;Jq3jGyVWiTmXmRjyj`=umHW?t{lyAYWh+bPkPm26h{q{*4?b5W=RT<-Zz zW;YQ=lg&hG%gPtHx{SvG$y&-svb0(*oxb%ODO#>I$$BUq*olgo(;QwOex}t=o!k&- z(fgq9D7T$IL%={jo$Y)ei-f`yDRI8)|q&8-eCPehk- zY{R1cxv1m&ITrGPEhVW}X#WLcmmWVvmAqaeGGtB+>g0$h46?vDpxS+v?32k=g5G81 zBa~P(*ZTNkIl)qyOiFy4T4OdpI_FYu#!AJv<@|RV$Wtm9!>SVE7!#Itd@p9vtt5x; z4{57Tq?e)6qaQc0=Xg8+hMwPFCK7ilIN#)2NzMTsB$KmA>OEQZgQOcD`VWRGc45r5 zL&D|R(K8Qic*^7m8?;5lz(3-ZL&y;VC(Jt60hPq_-s0V$ynz<+h%^3SpYjB-gSyMN z>;4#jUp%9QpNwthO{GBFymMAyAr1BSexbxu{uX0h{{H+HlVH_Jx|V`OHMuRB zkT}E3oqK8Am_fM!t#>B`V=3>_-IwTnv#N9tF4M(SL?>3)?UY{BKg}YVS3ytnrKtS| zj0F(?sm%hfO%qEKVg*~vEADv8H^co}9G>fqefSF*{Vv@P(o^? zZfU+Z3Xi7^!)3xic1wm-DS6Y(O9Cu_l{`ggPh7E2G7;ZhqQjq=<2NWmS$rcS#aEY5 z%$eLvZ<b${e0Foz+yquVl0+5T;>8BSyM>FGXuoZLUGQWyCmoM~uYh+&inTZS!Vu zkw5t;i5KeiA{!GHrwr6dm9uKrOokD(t>Om>OQts`0fCp7{}i?%L+|x|+|_&^yj_{e zOxD0P3ZdN8gXX;Sz>b|I>#H^ptR$m4{w{uAV#=poD{}e%*Y-V7-?Xh0iig&2)0&!3 zw3@1_I{@7y>)rRUQ(wqBYNf9guIh3?@v+UJpGkMELg+&!IDwv2BteCdabvwh9tmL6 zchM^A-u*jyJakHFgv`8W<~gV_VWJEeqv z5Ht~Gz$Cv&HfK;5O4k^}3O3sJbWOhaSU3<8w^L$UQJKrNZ;TwRi(%XC()XDdH7eST z*)i=QEd3_1zvRxfYg_G>NN(ab|SqL7%h(ab9njO>2;i}zET z4CNWKm`XwCp+(n0$J+IIf&l;#`nJh82OZJEyAae*ElU$e-a|=!W0lugWgd_3M3y^N z*5@aNlJ?o0|4~qLx)FyRDdPu8D5jOpSm_f8*TG_QBHWPn`wpebYqGg z!Iq|kGXS8?WO_Q;4`d1Ge1%UwUAZT{#s~#cWLnlhM;B8yv(hKGF*ru8cCA<)k!VDL{?Ud@=q{LB@uDcR^BK}}RzspO& z9}3KMcb5r|Z62ezT&7x2x97w5S{JKk7w4_S2MR)TR-TD8^t9qrcDeG!9EmA1`Chya z@7%SqVliA_jmJFB>Z1F;7ZHCSOa;~r?^qg`48byJEQc-dlZxl%1WKELL2<67p36VFC1NSYYajUSOU}H#$u}gN4=7PNGQysA}|EPVLHb7WzaoILHtUlAq zR9a8GeDmeFGC7rd0EXZ{!$T;u8J;npCEl8{Xc&e7T2q!u?teT$6uZV=3SvclsLxWR zdUjKset>+oS%IM4{o_ZU$Mai9oR{k;4hQZ~n5aP66?lykD$I^3SZ?>$@PQcEeRGTs zog~to<@y@2IR;uh{a7JT>O7j&h_mqrl~(4$WgA{P!=*flcJXk$ZYSIb=Fk#88e5I_ zqTPKxrMcp9oQk@kG`MiKc66PXgOIeZ6=7OZ#z3DGzgX^y67fq8v#5&_9?WpFTXVhH zc)P~t_XR#@kP3}Ka7K$y8shbJyA$Yu$--P%UxSE&B0G1{s;i4&3BSFp53mxQ7T+8} zU0xap_@g@!muW#h5Yt1iunwfDDg$+^A~FqH@;yW(M4cbrrL8q zLcUMPegcPDN$yh%UxVLzl327PxPUg(NrylP{kmXTqU>tMmvgL@buf-X@*%uEThFnX zvy4CxUmH6jwli&?Zc^9YLqq4wj$BV({^}UDPKh!%&dN%k_$5y}v2$)H-DTMjPh6DFFE3BPeW|9ooP065t-F`4mMY-; zZrP-Q&6x~%3FEq?HE?4up<^(TZ)v&;3GRS*Fams~Ptk0St>}m+C z$AXE!iKN`MIIqz9vipEOF@Kq(cN9V~d=-6Q|D;QZLs19v6kn)>O60iQ7*b2$56vD+9)BA z?~zjoFBJZ&&l-{`)Helk;+C(xxA z9pDRvydKsqFpZjcV??(Xi85+$X(MMAn8-HpJZ^APVoe($~G z{&W9$$M`XZL)mUN`>egzTyuV&XYObfB^gW*DF_Y@4pUB6QVk9c5%@QJ`3n@_i1D7W z1n?KUo0^O`T-7-F0q_lym6)O!99&Ht`hy8F@I9Kdtd1KT+{@RnKk#yDuTJ6MzU<0L zifMQo9q%Bd$5xL+-Ez%J`>#B+)nmL%qm7HU z%z6$De=3x+-$O1;>%GrR+fF*66^0$Yvki7yc9VHxfAL|rdo)u(jmHu6PnAmz?8EEQZZA;c_w`k zjrV`cmuMo%O*{N<8YQrWW;%?1Z8n~|6 z(R>ZB>$a@G-FA`zQK9_{N~Uri8b{s!^tdW%A_Mn??4YN+zn-svN93cLM=cdn#rfwL z`1o}xta`f8>tpp3jksnTRSX+?;EaY;1mrSLbRstQhOIwi*t%6pF4G0tQwqQ%v;Fy@ z;}ADIT>#SD*SP9yw`7$YU_bL+^%@xV#hbOD6XC)McW^Al@qS^PXVAg0n8?{iU*yu^ z&o0RQXLf_unX#t3-OMEyFol)FQllbk2Ma{$q90$m*~8=sTllv7YVCR?FX+zqu+j<` zr)r0qUoRnS91FJsYwhR5%#I5fNSJJ40;`f9LNr2EZIJf@S2OCB>ZMB8V|;7#BkW!F zYk|;8J#0vp+b=?`W)HY7ZkwrBe!z6$S~anXr0{gMY2N(I+&U2&dN|~C3iWR?X!C5m z7#CPF^gG_UUywP2MtUp+JwMW&Ty9N2o%UfjHO%TVn|YC;z}Hpg2HuzH#o0`kEYwh3}@YCE3p4;{v{-j#U`+s;;`8w6basfr6AUK(oce13vfbsshP z%o%t!0P|pil+Q6MgIgGd5u2QU@^SY^c~ypQlm9%s>Rt9*<1b+oCx*-QqQW-2H)l-c z6{c1>J|%t=7huSn(yUF$X8*nG=wxlL74?aI*W2SHFuCfi%3JCyaXc_58JVuq^LKR7| zOJLSEHOv_<5zf5P2Ub_x^=1rvt8qv#T$rSmuFdP4j67=oHF@?9^SvCuD(1J5s?9r& zJir8KWUg>t8m5aAtaT?rq9*v16L77g^Oo@P0}n0jxORli zaY>FjFb3gNhAO}u_}rP<9P8N3dEQ%1aG=YAK;EOk9yv1`qPh|a^H zrK*L}Rn?wHHQ-ipx)GD7g*vMxzmpED=f{(v<218a7wEfoatso#{v4lO64?JZG_82L zAq#e$ym-h7ytlatOl32enxfI81eq-fKi!)7UH+C?IcMyy0;VH`yYa59G^bYN>9+6b z6zI>w%w{Tb>hqOKLUf}dY>Zg?;&A_&k z@FUsKw-QPJ^uRHpY*N}JO`H-L)t0XiWJN&ESTwa0>PV`}II4nEJURBDN?h@Qh~9SN zjd`SMm|Rb!50{5XeznY)KsbwSP2psQ^OPKeMTZ|2Pe}!L_^E#lWM*AWKI?!_7ST5A zAXb7VSKOXpS70-Wj;pacI6xAUgOxz_1x7(AP27q4exX!J`}_@(wR_p{%vFqW%q(H6 z@bAO~>~jiMN>obkJUbuS>S8!Sr`7fu@|NFMp97SiqW?0X%x3$K*V@#SIo4C+Zd<$; zma{_mM8a*^496d3947iH01wMoFqTdi>4j{lL1MER{>b))vt4>rRFp;+6B@z3lIWNz z{fy`|MF^>WtE_piKY?Y?SU>BQYd;)w9FX27y>e-E?(`18)$$4 zRH%YJacwS9$hqg9=Q3XvhK;fTPLI7;r=tBOfn;0n!)bytoPk*I#cZOx`vBQ0@gTCqaw4A&o>UWwVJOI)RuPtf<7T{?S zqykTik=nA{p@NaX`~|{hUL(JLk{sU)6s>^+>|=DLbV_eRNF-Ibt}o>$skyijwzg5q zz*`gOMbJh|7L6J^cbft;$ zC3Pd(%y1c<)!|yd830>em4E@i0g#Ip`D)1JsZ{Lq;(CzDK=Aq~bZZr#ANE9!frLRJ zpzwiF!_ec;M@TH!&^>#1R^#Db*a#Y}Rm zoRL~oiP^>Zx`eLh=~x+Q3|iD@f!$`e^)GJx??23rlPo~ym2B05MZlGx2WFMuQrOT_ zN>s@<#Bc?J zR5J71E=V@oWReb<4lvs>zHT zXVq+uHN*IJVTcKjz5^6+ikR$PCHb?B1?VU4%o`?lGheua1@IBF#Rqt+bG3tPPh;}2 z1rB5<@yM6usr*HZ{d^=0i}dC(`Ic1{b;X0_o8IU2#h(zr-re(gjX_=dG0M@9^ayxj zY7Mp@^F;Gml{V6YL!mv>2BDhBalP-bf8O68{){Q$_+SzZA;r+8uReS5#S`p*BZzy8 z!#D}W~Yak5+y0gt6%^hHW)i)9tLsE9u`%4rm>_v!-QD}!g!LboB8)|qLP+-Ml!kj}MGu{oG{@rJ{RAyL+^KM{L z$rJ4fIA}qXFCjI!Po8$l2%J=HSjTu(QhhVZJ)vPs^lFxUoFeLlHX}w=*VBEO*N5sH zdqgwh`4Yy50X?UVot&5cGpaH>{+i-G&TVSXr>zR%UI<7z7}*Dn`A2+^or%to>(h5A zAS$2jgzFwusv;qlpFd7BF*q0$40pRVpcXTEgVD+jrw(HR%S z=nGF&Qg>}HMzX|p$3Ki`w*hrb(chULq9MYYsfNB~%(B9_>tR)Gq3rEy>)t?+G|069 zQGhA^D$0{Fw>t2Z_I_$v$vmyqT7c;5&g$qNvai}{UE3Pt)CJo_p-fm&~2N?9Gts? zt4!UqO;7on625}yfueHxj)_bR-OOenmcou9*WWdLshi8iP9H@8s9!HE8oe&}f3sD} zqEEe={~GIX3lsv&5+|}k~~&%FtObY)nbL5G;>yKV})2=Z>g%?jVKW*mW`H$8kn zQ{9U6+qFCIbBEieW>yAd8AyC@QXbmNeOHP6xL*8l5`<5%+IHm!=iK^-#BhN{44??| zusTQ7H~>kG@gqC6vT>>;J#88`UcNBBBdB1MjV0k80EXQp4gt5J-hM9-dc5~E@o8t$ zDHq|LLBegoY{J_-i%(0@5mc@_zZAXV{Fb=W(n|4@a>VL8ozZ7b-=9L4g_988B8z}d zRM)`GE?dj2A9W(utYG;JdQ>kl8K?a`hgOWD%61qsN+*|6a7Mtj^72yQd4S{b&;|4S zOUiblBm9Y#8f~_wn%4$y4dc~D-Wl8>CCd1>0rJ63(@Fv@E_A9soQ}HN8SG2Kv6)&4 zHt*V>kLo5`{atQ1BHJ`u*U#W)W8f0aq64IzMdPL5M17~+?I8|~xf^^f@q+ot)DL9}XYfk(&_S5bCAQ3}ZqB79sI`L|jD8dIcC9NC-q z&^*DHcZiGFO9JjjM1*aW%>c4VaLw0OmYH+%I?LJ406#su z$_BNQf1gd3vusk-SP(^AyM3^`BA829b;^$Rmh}7fOG% zFU|J+{Bhrka(71n34^6@el+XdGyt4RXP6Uq=1#hvA@s`N2w>EYwP->RR=!pPb@tw$ zuTegCSYJtv0t#EbfvISM+{CDm@pcIF1Dp95_%#cXFK$t02UEptIP=bZn8%^$Y}J3Xj8>4* ztQYIcV8p@mw-k}i^V8#T(^{b0$;kQM&#os}>9)`tjt=lLLD1w(mHhF=5JT>_@?!PR z6W`vbAB7Vc%68xZ+z*6B;4O_1{vclSMWIO@vydBZ=RBe&k{Z zDy20h>09RumFi-`Z5Yu5pxL=$61^gfJk`;~^7oSR+VAgZ+EA8Xyjf^)*0!mFpNl-28WX?kCY9bV{Cm0eaGPvbyGf zF=nuMN-Z>i-40+-w)u;Z1ppU)Kz!HrB}wW1P$hoX&5XM8!bT*OV{Xt>i+m=qQB4Ol zZp8{L0x-#_MDN9c*bP@8{t@@}7*MbnE!y_)72!jp9-pq4oZ4;i7*x}J7Il~W%3utny9oZX1;DdKKU+YB>Rckmt!&xNfOM=o83Sm^6B-df(C;PZH_&wJKSX~yT00efA%hQrxopsiwT*U;>GP$Yp#zx1eod9EdX4TE=7|T|{72P&_NVJT5N%o^ zeg+szgYdoEo$t!B(-vOp4lFo)-3y)u$|L<&Lvs8L!N^nIYW;DU9yc}T7F96lF7onf zkEt=zZC~W+4138uNpYDAhp)qbv0n&vcev{TLgBT%(OQU-?fbW^*yo+ndr6ZHE)SE7 zgO{UbF4LbULiaGoOYN~)cb@z+?7FHccHU7%MHR^zj*c9c<_3Ov#cmrd74x!q^^HhM zPp!5k???)({3~?zXmfbBDVJWn$f9;9ne zwOfToCj_7PgbYQ1WHlO~pfklbw{D%!zh$VBb$FM)VIb%WpWX_cD{ut)Y_m=UyPqvd z-_x^0q5*v)xf6BvB0+}I<>W%(!H{>O-dx9i4_KvIt;Y|qACtlvZr&#~--Tad??$iJ zYnf3@)PEsR=;8-V+AvmhKZ_%lBF-`C0}L1 zIN6cYtP7y;KzM48i8{4bFG8YZwZoUMzB9d6_O6Qfq;g`qcP)2;eXn54M2^yMVdHW1>1h0LRgye zS}Z3CsRv(VjFB@Lj5yI#J|Qz8Uvz=7XI)V#qvqL{hgrnSC#|mN}E$Y>z$3;Jn6J{%oOEvFt9xtwo;|% zS~WWB?EE8IVeGK9;JlQ zvpDQ)m&1GH+SX5F3=|+-zDjGCRiC}=m6ovy@RRUy{j~mw6W6Kp3C(oin{9t;T0Bja zymjS@I|4?ovys!03I+Y(2PwWN1T@7)RsJ%3g&yH^bj#}E+_ZsQyg6Qi>W?lPbZu7uM^#o#wpU>3g1iP6O&qPiwR?mBhV)U_#| zViQY0)l)qb^`+IOeo-iTIjiSnv24^5Pp=>U==4hrUPK8#{;DK+qiqT4%n!+W11^D$ z?|7+6xnmgH#}ZKWs+d)(*R>5d9`I118KSIzt1ODhz*tKdv#C{K!qn8t7bJH%jv+lY z@b2uJ0aFQYi${$4sX~K4x!>4)pcd_kTEn87x1bmfdsMC-6vo)2m`!j)@4*aF7v_H% ziY#3%IGg+S3RyVL?ay+Hn}P98&6@vQGxcoJ)+lO=Jz}_0t4~Bz$kn>OG|kM2dqp+Y zD6rN~ECtz<89G2hr~_kNcO?=un?;06(yI)oXj}7}T@(4d0o_HALSPEXG2K-B8$o&+{Has~{h3g9 zL}qLY@sNDGxvHu-Pe7SiCeE?1

u`mnSE1W$cecuctI)YnC9@HUcSrL534!z6*BG z&y%;qg(kWe8E=D;PsuKqgaPU0!%cLqb%U{eq_TQ!lfoX}xr@&Q1u{n<-E?R1ZkG7p z3Y|K&lm4V*?Lqgf2#b+v^1=#%Tlsr^K;*DF80?=XA7J-MPZ@z`jm%pPOmjGXIzdJ+ z-H~ITqJg}tj(^B>dQU*Bq?@pY<~%gA;XyM2t-&-bc~l#`6P0{b@$h<7*?erhM9LBmP@}JbE}w(L6j~LJ(KJv;{OCT?juazwuTv`-sb!H5Hk*Ys;pDgh62Hip+mmUJ}ImsBR;C%@a8jkJ5%k z@VPB}(q8e|f{lNMKcrW)n()(&4r-vt2MuNgPBSWU_errT%lMLjHKIEQ~g z1-r=IbDWWY-)hJHe36G7D*Q({+x1Zz=fd(wH+7KJha~-dropGz@zK5aE`~p1gTpn` z6!!3KSLN`x7bDKs{l&|1S)B<~S~5wYWn9zclMi|%2kSM*>E}iz^}`;kjB)2nVJ_DS4p;UiqyJ=Nc5e%Nnidj>)7`J2TIRx2 zL*$Y}m!}|O^}rOj6#b(<0l{td={?RQ5*QtapR+q@4SOq;kTOzL9jE%Y@AmY!UYX97 zfzZXQCZ~QqJxubjvTANg;&2WBTGltE}ERV-SY?E;ry|>}dZ5xf>ItE6Et?EfyDJ}37{?b#+ENN^xyLJ*_&iM=Wty&PtE zmd4y6o)pIx+rmu>Gkmkqy5ET0-byi_$PNjMOoPdL45xhyGuOQ^1)|E{J{1XBjyW0 z-su^p88)&_T%vLb6i}^O(e;b_PWN6U1hF4>y%|i8AwU=?IR&rGL&uN&6lmZUQ4A z9-}k-UgNhJP3O(HY0T&<U%%Um)_P=&CWf<(A6*Yl?P0PjCYNG*kgPlf%UGx*r1t1 zRxB=*EJPe9gfyJN_NtF(jNphru=(q&yOiUdm)`~TnbNEl_>S;n|ByL0_c%~p;I7vN z4L!FU0rrk61dIk0GQ7~=fp|Eo*YriFJV!OVlCmj)VXDv zeZbh_+NF$)&vO`Fg4pD;^L~BeI4iQ5mEDKk8?~$1=2xdFCFn-DvbmA7D#T4I>rw4r zYW^)WXOvtT6NN!8PuT(V$XjNx!OkGX_CTm({R4!=hb?#-EYO1rHHeAQ zK(+0(v7u3+h6AMZvKNG;jNX^5CBK5ZsX-x#iqAV`4J;^v#$O?d^)GHSsBshi7QhT> zOcKRNAhCM#+s>4?zoap7D&+P{kDR)|qL#oJCI2}i{EO;fM0aosVo3(&D;#xBm9HU5 zJp#@Du-go8G9}~8%jL0fG3({X42B@hnL3hxzP8V*#a{o#F*9UXK>&TCrA?InFUDB} z7_j~wu_0jm4;Ul`Xzl-T3e)2|5Kx>p0nU}S=S)5)!>!zLm{LevEBO7Js0lzFuYr<( zG3%Y1+R3*+6*}B@Yn>gHfN81B>))LerD<5_!OUz>paM2vMqou%sMKw64S|0_UZR+} zD|~Zd-?(5o+w5X?)AH|T2qHn~1lD4=K(@F1oaxwF*5J6Z_?SCH74%>N&_&m0aJtdI zEB{am$FMAU9YUQCm~0vW1pbTZk{kQtoB{zQMU^Cl&A@hR;A@@F#cuH`Crtib(NLd> zaDX`i6TDxt>03YEU)8~A&}^|hk>AtZo_elEB?zzrIDV>ZT7Cc1Q4(0u)-$(&u?!|@ zi@WCv2iT9MaRT-#-CFZ#SQ5hvOA-Yv>11Nv)fH9A8clp8h}v?5{94&O8{k780Cm+8 zfJAP8DH1Y{>n4QjU_~?FcT4dtHPx7Pl`1j?1kj5}s=)oK4p_W`ajNUMpa;4uxj#(& zD#q(v(TX?u=U;f%1-_`KahgTwX?D^BfJ>K~@vYXnGrCS}JK$w={2}{g>|nLSud-!? z2z+3XYG4Ui^(4V6FQ`npT(ifjRxXLYrT>4J<=|WtE}cCG$s{I zJ5u*Xy<{Gpy*=LdHO~TILEOp6wh2u6Ar?|ZtT*PaPZXytd{?wAL@f!}0}_WLUb5;I zt(FNRqk;tK@@WgWQW6e4f22FpJOcF59&lS#$5IF^#)&+o-AkI^N#4}Axb2k~$|*{- zx;PxPYT~Pefv<{)51QF1x4?1Aj|^%p)>7X;rwr+XS`TrFYLrDDXWn~3^qs3!ax4OX zOwiH4A8`BaDV-vsV%2kx^Y@XywT{myH0O9>MvNu$a609P-$`;9jELnNB*p~DHvq75CGaFYtO8ua9+=%V6o9l? zHT&6vCZhwuM=&DodQp@0U&PNKSo)iM67eCyk!y-W$M^939dOV9m)r@Uh%E-30Q4|d z&lA8@21bIqpF^QspVypzcHaN6E7`h=Aak?^kbFjE%>Zdx%LnID)~V1txfouD#bz<_ z2NWnryWtV)_1gbX&|^R_b;rhf_46zfsVVT?l6~FR5r)$d{)3{V<<7mE9N)ihQVn4U zbZHOR=t`mXU<$8#AT8=t7=wSrGxFIXB;zuV(tCN4fGw8_cE z@JF-Gz-#3X*86>GJ(pjEEB<2Jhd=;d&At$-$_4c0hBmgnB$;ljg;)|M6Ton4fMQtDWBgz zyFEx!pnjxn*&6;2QuUHG{aqjh1kX5&YL*ldaN=uuyrCo&TAu=!pLc=hpVHGfOhWyR zS+%RFT>zVEvQO@s$$27!;7uz~`bC>}Zy44+0Om>twzi|%ejoxZ`#%hH+^lBGT6*6s z0x0nY4=_Y4zd~OEr2SXQkZAJ=*^bWxPSt|B5rBH5_$n;4f4wJc#jbxLf^kS8P1evH zZwTX{G4l8WidOVCGG~II4};}+R=TX^V*gB;y1^o#p$oudSw1J6+`0g#_Ol2*`dh>E z?hluMI&>*yuJ<#6PA28<%bIeIIsQ$)PRH2xp{6Qn@N!tSGCKCDKssy zr*KJn_P0FcWwhf;YfJrUSKr>l06=STS_}a!-nPUiEOKfvo9r*63m6@~2uj?)V#g?Z z{f#B;E)Dg;!U$HRM*~Kh(zj!`@{}gIP=_7%pFV37U_U?!`S68GWVK`b)A71jpSH5_ zNHUn)*RPwtCA2P#6h+~S!(2kpW zMn62bh)=ayDVU-G*^Jc|Rxhtxg#*jxD3wEa>lU-bsn$8Z8Bq3C&IDjqy|&lTXdfNn zf^iuwfFLgNAdTMSK0h$9=F+2=LIipo(AfEalJ$4r{QF&#!bxrx z>DCg1hQJT>O9?D0ZEj|@IB6L`*=5S*%(McwC)xwt82%ib4vTM_*ouVaI%Ft)`YE0R zSM$Dm7z>|cFOg)4Ue3c*oqjMS}S|%k2~Dy#*-RP^COx}um1XailEO@pd7smy!)J>y+2{2zY|jP?$(C^0 z93%rwtfqVmzj?MPYaoI(!Ti=zwUTQy+qlPdl)%b}$>d}7S#P$^idvOv_m5-DBn>yu z+g@eHrVX@x_YV=j&5MXnp}9t1ipMnP=-L&e&9dLoT9_f(x zlG!KG^=DWjYDIYhouYqWUP^ez`>Ejiyq6&pgWLddaXN65f+7x0&+ zMC?*@P;(Xz%w6QREghzFq?{nKkqx}!(Kr&Y^=;NeY-kY-$zG$a{BENFs2h#QXDt)* zJ@qBKhd|23Bve8iCW*c&MP#61Nj6^!^hzWj3Xn^V5%9=WsN;ZNvwD_Swf@jU!M}?% zTiW~TKg|s3l*$s!RO~!ZiQ>2Um<)aWh4iEC4S$?>y}8SBE&0Ht&k^D|o=>CT?N?{v z9cl6zW7MB$s^>#gcbgAVF&|FJhk2(my6=)M&}13L|2*H%b?FORJ}zLLQ(mZr4YhFL zU(@Xgb;Uh$X0v>0(etYN*}Qs6!aAR&_t;K(p&F(*=HyI~cG8Q^?%tKaGGDwqPPH`X z6Y1aMn%=y7<`;&F?U@_qz5pY_oO^R|9#+{8PjBLyeO`@o_W9MnbZ$o)A*7C*zUUPh z>GmJk-W4Y8XJap4Z)=BxHfQ$@!`b0MFzO#{vd-F=E&h$2K zmj{(DJi*_2Dohn$gj0_kV~lM!JM(}eHbyS>84)xI#kwLNyKD9>NA z5aFCBL6azmD{YuJxzBtX+RUcsF>6NE<~1u+6+*k9!FGRZFp z@DEgVOQMWLtd&sFZjlk&^?0g4HyY@@UhKdY~@ zA({U)D@`YYy2qb)-CAEc|Xe&c9}v|4>@YVt+EfYCxzx_xo6>h2WA;)&(Q< zebmi&Ms%Y+e$T?#pxF@P*ZM8%zY&abK2Qo z8j~rrNy)8m_Z{x)j?6z*kb*D@nG^eQpS|N!?WUS7MX_AWS;r7~bdzpht0scVk7_k6 zn4Z(w!}~#V^xsfN24}y#l++klC-YPRtQR8+S*I^(T@8$fV@8kc@E6V`mytku(OIM{ zftfLQxK1Vbv@e((+s~x6mRwdm=8_$;5p@b|xh{T%Ct{2mQ_V(y8I=p2)Bk4ozA-w) zqb~x}ji?LOSM-)D3y`MET5RdhF~|Ble6L&^gfK>Fe^!g6S{-S1#q~`COoODnF)aoj zY#&D{v`j6biw!iCS@uO@Px#cbYe?-Ze3p&m-z@p)0U-+IMKN{_DV9gsQ(_yKd4Jx9 zgifGRMvaCYYqUD~k+D7KLDE^;A&B0cCf`_*v`$3Usg+svHrBS7(Q_Nwaoc6+b!xM& zA4(NA>D%v9!&oLRaU{9}`@9l9h)9#)cxnlwh7R@F=ao~90$X64B5Uf0A^)(QbIPSw z;W?m703_K!aE>lV4SHgs)B1$LC9D`h;9h8p_1&O=S0r~m9Q{KH{aY@9@TYa;h_G)@ z^)vT%Se+`$A-S_Ct(qJt!SvPk`*G51D)+55Si%`Q1)8`#p>H{-hI@yyNRjV*RQo0Y zAI?03C)SI`-%WX+5>T=jHwlmm&R;aBrZ*VD zLl+?ABqv}|B1060lQegd51I;YHLa)OK9jco4EC1@vK}z{&7PTY)SRr^fV-!rt3Rw~ zCg(+Q{{`?Z{ehe;Smhp9HEalAS|-_1d>4#aGT>wS={g?8w0}XVu5rjSCpX}&a;R7i zTFGG669!|f=*t@IGH6p(2z*3ph393ISO zR%Azv>fyXy49mu^G^~aC0}-h#9`wE~Z5nwER)i_t#im zo+sar+3HDm;|`r?j#-+yV3F-4&2Z4OCc#uvl{CS5THLb`h!M%df8e>Zn;?9r|KMJi z0_2ld25w2WQ)|7-&i?N0D&Vn&E)qe!Ndv9Ekr}d=iyctMS5W1?YJ$_jqdhcSWeqq2wm+D@AWl1 zEy_&Qob%vpZx)>KsB?`&d;$u79fKtD6O$}UGH9?ca(;COH`*irpjM*9-~h0R--pbP z3ocppl-}#`UJSA8)OMkyZ0ipZC!X6bqIG@mWCP$C@NKP8u*kK2aS|z=I`2vZ7IsLN za8T1zETAF!JHM#OuJI3dZ`e@Ys1WTStKZ4@YJakdiS zC~$~01QiJ|9NV)}WmUH@a#W8zzl6s5-Jo`X8>hFQ2FRS6(X*X;Eyz$Xh}W-!Xb#kW z%d*>kYUZd@G&ZnVHE*lkVFsn@e+ml|NIxIj`WU^nu=jd4=CO~n|EZv1?1Zc_#L}=; z7Dux7$vE(w{EnVz_jQ+Z4`yJlznGW!IXe?`$L6k%GnPqab2E2tE=UoTNymDuNW70d z$zhMUSOv0^r1`PIh$}xi)eY+qufiXow4!xK`h=DDn3lr2coIC%epRW)ZF^&?rGA6K=h3 zbOe@x!do|@5sRf}9nnTRTWuO}W7PyuQOgr1^*U81_4k~#Z8_^nLQE6OQ9ePW38Lhz zr5ozL=nsl!tph^ia|KCc45;DdgLD=87qHx?uo!W;24$AqPXD*%YI)e3)D|2BL_AzB z@h5?jG<;gSyPC#X_QW_6WA9aYu!RbP*qYFp36R}F>F@7ql_-gnumUsU(0pA@D0OM~ z8~ZD1Y-qQI9PNgW>B69~H#Uj8J*IV9X;51gR&?xOZ&oi2dHyRg{a}C;H0N5ab_-sPiP{b9bOw&O7Xd+n@u^{835y~vVV{&x956gGBirB%>!D#=!_?M}AH3xUJ|5JKoU|#3V)ywfR?6h5(MR zux&1vFWGu;q%p|Zd_&Wks|JsX&xT3sWdly9|lHmN6;LlOujq@m}ie~EiR|M z?>N5C>pU8m9kb!X$SKEq)#^| z+U0j@XAp`yZE~e}E2R$se;GV&Mlr{Se&ss+hF=N~6Mp^!f}`cs`L2@+avai!^88=R zuJVgR2Ipn^0Wz<;Z!4w@f3Fg0r%-lQ%=KA!t$8KjwTQ+8r%GvxuF zwrFqS@d!B1L{83hvO-4G0x@0!z&8$hQ6Y|^_Zs`e$ZyzYM4jj0253)3Ud$2` zxen4q68Q5KiQ9Y$wf+(+J0|+<4XOx)<1mPCj+m4PhHq?voNF!EE)gR`#DCRMH2cx; z@fZ*Ds%RF~{!deX^6HiBKdr!)^8Z#i{%;Ya>~fFs;T-Co$yK;L)LmY=Jo>)g=HP#O zuA`iS8h?vCSOzI%X8V>_%vNSBl~8CkRq`3qUB&)K&PW1b5?D@TJ2_#HIdm!HINH@4 zEX-O@Pra{q*wMv1-Mf6pdv;?pG-1`862Y@rVUK#eIF!NXa3uU+)@~J(klyc9^b7G5 z1N6`G^C1FWwXt?pn&)CDA`cIxm=DJ8=UwlI?)Zk@{f`$Ljlf#Y`=KjW`+|^c0oTvL zgf-)r9ZedKRVOB~;FRTro^dH3Z3Os4HB8K-vT5m8!JS>m&?iR*r5 zD!rfJr#<>7Dj`R;zv^y)9@7cE=SWEqK?o5JxSt1f3_vJqFdxG61B|5hfV;ZPYg9Ux z{D593a4c73&9Uv67Ye-RK>dWE6echL&1TO!Kn7e9^!((xldP43(#|skIIk_^gzvut zc2brrrOU7$pQnKy7E^%rD|Fx`h<}{*C@axFDdPXr#`^~7J?3!s+4jOe zo?PK;@+`01Ue&9%j=l;wRwqlw0PT($?XMy}Pw!YSPpI4Xc`WKa`g&BV_My!F`1Sev z;Ct@!^RXtYjxetHb91?JP z>r%vetBivlj9!nhHdQ1nHMehM{cy8BZgAcZ2UG{B{)k^qE`wc+f0cZlkw%SeXLl{eLm;rM^2&pSef;@y~GP||5S@Fq);zA z34J7Zn7Ow+JB!yr7kHD!;s&5v{Ae)Pw!LU1M4xIl>I#HxvhwIz9Lw({Y)Utc5*d2a zT>WTep(Y&d`C-7XnSXFP7+ zighDNd8)O_a*43By!igw1fvh;+=jix!Y_`I7BT=vx_$#nXRlJa#~r`rnmWemN1CYzMet zrDpfv+Rcu#b>5mnfw_1LG>p6Rpi}vuh8*?<{Q0Q0AWi15y=(Rk5e4I4b3NP-z+>D9 zq>in}j?1?vK>yAX!wbM_-eTbosFK$(xdG^Sr~rh5Mqoh{vkH7x)@qIX zN+B@&|Mm9X@mT)<-*C355Taxx8I_T;vPEQXnUR&fNmfW!R~UVNL!a;W`?w$1{ktF6{kVSD)nA`JolfU@9Pi`(dc9xI)sWrQVv&<#W>uiFEpTbd z=E-nb7Olf4GFws4jSd#uM<0t(MuD_u$QtvD@ZM!_3fQ zN=}d+tvlXHMe24R!?b#qd(NW<6f3n>#=vSlTdLe@eob(xLRqe^O9|qv_BQg%>hca=c76e+2w` zQ-DB|l303|xVlGt zN=T9}hj$N{doBk_MUSjefB|VSb4nT=CHTN}+O7CVgjp1Hw8pE<=QDpGjwxUzklURq zJc^h$AUwkHL+b_LquK&P+qD>Gc68zy>d{b-0q{IK*-CSpR<=v--!YwGmU8hh{yGF40*aopx-G4L(&w8-Bj$m0Y z!+@r^KJ~ZPV2aK9xW(ppT##&FiFKE$aEcKz95v@QcGRY3GG=~mjK z6TBRljIQNa7o5Glai!_U+j|6jB=4`=;Zmw9K5yc1Fo0)BaBPn)XpcYQH3wL$G8Kt}i-eZZ64gI@MTPw1{NcWBVdML21Jqx5G+? z4??jHlfDFXZ2em;GkibuT52sfW;^oSx~8cufGZ#;y1_HE79S_O1T^&Cqx)l<0q6+0 z!?q@MCZl$qu`6|Cd<~AW9JymJeQsZI=z8aWev^tru_4;Ncr!sLw%O`mV3PmcC?TvG zROkhEStfG9TSgMYYn=Z^lSH*koTKAzI@hDXBSMA==iE->98{IN2+#c5>x8!McDpe^ zk%CQpQ4N4?tu;vQtd5g+w0Htu*?}VzC1jCpkR_KodA@^OoY7s?rKx?5**{HkWT=ycGvLU%7;AoQ2 zDK zdU$Sc?_Y>X)`7ne)z^hdFKp!%A z5Z_zo?75X})zWpU>9Z@IXxAI`P!D1hV8i#c_`_b&G)bu{(f~G9!eN31dw8Y6rH(v?yjTqRYx#P++ap);no3j*KOO(URtMvs8v| zwJpdU1bDPM96`-XR?X?y(FP9cU-Tp1<0xcxNLBzlr>lXPJEMxh z{aZb14~mtj9ykf%9TXy7{GIwsv_*hz=137dbdWy61 ze5N4Jd+`EP)u`=K)o2cF*EQ9gZ9h%sN2BGP*Yj(RW~^AsjRZu-chgL7KYVpbu?Zc` za#~C9l05nRRn;6`=A_xvEm<^8%_7)chUh58iVwJ(%9r;FNET(n@GC{VeIgff#WP*n za&FIf<&J*<5?beF@>x-QdbQ{U6|2s>%2&&PhY`yWcjwi6hc1Gpdp9nzOAQR}ULv*3 z$qk-&%ZMb%eK6vKIU4`)Rr)Mxq4L1DDEfqlbfcXMv%-&X7Bt$9iKg9J_rg{(&Hezu z<=Dl+)MUyHauu!HpS>4^+BbH+wzojB_jB8B13NBJP$agwv}&XCT4BqwPhZR?_krJs z3uB6w`}`RE&)x41=f>_YDcRHTlPD+2+B{x=n)4&}l5ARBW-DDbu9*N#c@W~=GZC>TprsHbX zR(#?Q6Rgh-TCCpDN3AY>X(YSg(6kg=rKn*#L1?Uhy(~HM?1F%fNbQCFib}D0^ly0n;wpd~?mOYeq;?j(;)cOyfA1Ln#e>jP{<@ zU)L|9A!kv%c_iGVFuR2Cud+6u?WJ;VeBN->=Obllm}X^Fepon%R?^$n)U7pX|3sFI z;%w!-O~rk0*Km#}AxS=wIRBG-BB4)ivWb(n}&H_=cp65}| z!l}929IgpWSMO>)HDVzs-SiK5Vn3Coe7S8c^7p$sq7uDC8H>AFr}Kqa`5hd?ba>rz zf}O4q8*5uDao4#NcMRZ4+>v|P?}xJ1r9KeWlX+a5N!x6^%aG0%?J1sU-g=tvy?xgX z+tYoFg=$VMYQdj>NU<-}>->b`U6X`gfq2OTyR7w>Exj9 zJ>w~Psrih}3q`E(%_pSotc!Q81`B|zGCi-d zf#1D`D{rKiEWn4qa~q4p{q8FwY9fMRBGNs*t746zbsllO(zQhPhN8Q~-U!SlGHpxX z(+(AZDBfuHHg-!05ycRJp3|^-0(ScQuQVzrE5M@p_xY+8q8l})3wIxVs-1|D9`lS| z6NsHm^0Uu&F?Oez5OiBjt`Zsy-h5J(G@;Bq^^9Dk$IDc0*X^|CyB-bXMpG`-`RXlF zYKi;$(aUlD-f1HD?hjuiFk>FI-q`t!=Dgaoi)%@o+W?xlh^6{D7Rx&wOj8oB984Jz zUt7Ld4=_h+i%{3SPstLRdN*=9r0zK~CN0V_nPKMO71v;0I09)40p9L+*2)xrg3+gi%m zA3FCVn}!4Dy6uJ|izqU=e_U5-)lMb8xJc)sXLi>|%BYdw{f$jJr%)lul#pybAx};7 zQJO`qUX4X*#@sJpcG>&d@uO#*!o;dJ)u<1mLS7?klgh+h8^Rr|UM95j7wNH;$;)D4 zH=3vn2nM@$(uxU_iK)B9($*0wii673$nd{!?g4WT&y8q_#w3NmHx=-@gPjSF;(DH& z;`h1Y&D<~N>%D6^NC~#Ow9o@?58cMJ0&Dgwgq_aEJv*LJ#r&wVv$DlCL_OE?D=k;? z89hd=%ghQi@#cpsX3#2kx(u})NXKs*`V*V|Mb>Z$89Sq?9ZLK??|kWqO4L$3l`dco zz7MO_r!{lCzYKo3w?dN;>s##^m?BrsR6N|wLp%Bh;X;XLB$vRss=4oImcaIh`m&a7 z*J!>Lr&hk$=1;ILi{E5Y*S>D-H6-0^e1reDeT66Snnnk`2Mh(AS=__fduYyFdUad5 zdWb^T`^JSc*I#v}$?H+KQfd;JTv$yFc&AFd2h`TeQkz`t3>Wj-wACd(Hzzg=`V zw4C-hMR~O>4=;;&KDC&NuUMFJRDlc0p^#v&@NNO0Fa9@s+_Dq)nGJD`%hHr=iqAf) z*r$sTW4nn?i(4AR;Z%2Dy19OF^XV9KjOizfFvFQAM6;RX8aQINFSCSt?)#|FT+%2f z@!=wne(jXrzZ3fE)7{#mg+3!u{++#_ z5iK{*QdzjkF@Hc^t^~noT3-D*cEJQj-N@_#AvL-CYS#9&eh2L+2~}c>tTN8Q0K+>j$ADFIk=DzdEpFNhsd09Srok7?b*;T`~-}jFw!ywkl6~mb34g zTB2FYE%Eewo1$Ja0*y80xJQwTYjo05tDHTjFLN3tYzQ3$qe;?cHahHvXJxf4g#^+x z0&CnWKDb|{>FM~hmyP#E$6OTu2HHweuRyeLa*XZTSPZYNR!XN#pyyoOIZDR3Ytm*`Hb%D3MH)b!(#nHEM^*s}-mhai3bP d>LG?_MJ$4g7N2! zXV)HIc*xyHkv{J_%k~WTNC5<-yv%A{{yTB-ZFeW{y1$+EVDfAK+V4bLD+8@=B{*)2 z>dc0dJ`*#y=dsWiH-;ZppNWkj9zXrW@zt+5g2eZ%CJT3i{P~rK^F;j4Fy7izNDL9G z!;A85I#?Cl(dTC77bxAdpq!M9ym2)$m^xXypR~F-BOnt1I8$4yc;co9P0}2^Q}Pd9 zX7Z*Tw>3ug)J6Yp*;HL3i!n1%w-n8oH~(m?o~9m=eb*b66VZP9wQm_+T0hkr4q27a zkA*{)*xP&rmf4}?1e}$WW4~foh#uDmZ&>_dCeeD4yLF}ae#%o;>hmRgq1si(j6pUT zO(p}p8o1%6iXnT+144b#BNXB6wuK|*=1Oh_pJLXIr>8$2s2rqWV^MwJ3a^!4E61=V zo4mf!b> zyfLol*ICXv^QB_U)1>~~XO&cAmLTlQiyv$Kj5Drp-e)ejC-sJWgN;P}+J?0{=Fn69 z6Hip{&-r_`jH4UV8J-VPHw%sbyf7r??Fzqc;S4Y9Ex#p{K{&?RigVNJSEe>jfG5+IW@o{VG`mtmL3QsTdCvcx*IfGwj9~Wj# z^^Ji;$XU7uPMl-mMqXb`^ls7vhR0_)7LiK8!lPJl_|i`C5B09xRI-TMuw^65a zje=HvHKoVzpj<^!O$ShXFyoy6>r)+|e*@K+7vHyNmW zsZM@HEKs#E{HWjti(z8k(Su}n0ebtQpkIMsYroRxWL_L?Km1caAAaR#edJ-Ad(e^C z*;q8Ed~(weTJMZklg7ltE>qz}NotY%`Lbg|oxJu~<^`ZANaKr73%xUXnE=nRN^sY! z@5SN#jm(XP`=36$hXrrma8H~oYx*fmzFM7P^XS6sa|y9YoJIG>R9>xm9X~V@NXFq0 z+}#R!-CKIEaZ*@>ps9I(Q@==>!Z4rP&O}vZ4i{UX$Fxz&!+l3dYKGtBAotHz{myy= zhu+drQlRw`A<;Z8&!3Akf^-+(Na*YuT}|L3VJCCeogUO3c)w0ZLOrvs zclj&b+9v5uI#LOrhka=)*}-8eL?k6|HJWwHfA&;>DaU-HW^nccTbu`?8`eA| z$rLiuI`xY?oLu?A>?e5%e}|PK-tdM2{HKqLp&-PBUU6`EsLns{hPnd>+rM z@k*9H&LH6&bp|l7)@73K=y$6dQ7NGD^%6Il*_sJip7jM2xSKB7bw1-38^}2=<1-lQ zy9J}4$ll|}NgesKMz&o)BkqM$ZV2HeaMiIy_G&Bj2wqki^9>+q-b?%>u|X5S8UBa} zLyKMy0vHlKS`s7Tk;C26cThb`vb-)@wxbV>AG>34j0J-qBn@uo0c z$y@~G1~W>6?t*Mwko<;#>(C?I9&dSUcJ5^Q8Uy^bNUa$6t3;#fWOKM}hW1*#bS1K; zSk-5;JRDt&51vk5#S-!r-rEYfQ6wXH-znH5+*EW15oopJp{~xqEBI8~+}pnKvs1b` zVTsK2Y??H`xmo@g?s#VHoX}ne@j@y8LYrp~m7Y~|P3GkG?W$;^wld9 zb4kK(jSV8!6$;5hC zocXH{<9Af($qAI#%in(rj=FS_gVE$^-tfRx|#7$0jb;%GCb_K*zEFbsUmrX1z6ouu1MOL~aGj*h9<*yps zf%@1hhj@f-7tdC$=g2V1?yR0o)rVP?C{_o{_gNbs!1ifXJaAx$UQnnEKM`o3WfK~s7`Ta1l$Zx2mPFvdNi zH=d;?dCn$7j-)b4CGD2V(A&M37Wsh%4FSBJ!t6vrcFuz+<4^{^U$>d}#rjQsy?a&C zw0_J=c~yN-lqFH<8l`x%=#_U#kB{3Z?b~#u68dR_mVKkvbH|Cs#neWr3-ZTb;H|pNl!diF>?daa=qA zgay>1_o_A8M!%t&>eQt}C6;dyH4h(R5{_ks1}wQxB|L9N)4s%FK2tUAT^%rSHcuJs z&eRGs>DPUCXg`f#p|OJ(AIR&QbXz8P zjx8eOV_G2hk(5hXek|1+quNnYH--(I=NB(4>;;ydKEt%&;_^QH7Evj7fIY*< z+bzZ5_azxCt%B!0v8k4gYHniGU^h>n6g_vGMZ)ECH2dhF_XvXs%~Un{sne4}eK>bV zeCQ5usK%7x6E(LqVdRu2ad1Sb`F0KL4G_1gJ>8PYUP)!rWWP1Mg|o+$dDlyE@R;dI zxyYDyo0^|D_jXZGc(WsKI2u5_^Iys6RkNPIp-dc!y)+=8>pQI-FDF$D` zX9ZNKOZh?2L8!#o93qGUdo#?F2R(nxc;ZGaYPl;>IWu{-o8D$)9{uj z*PPeZ5@&}N`Kb=uam`TcjGps@$Io>f%Ij+U51)g(xvVx0o+zF_t_}%U zT`l{)$dSHNJs-9-l)A)O;i9Rnxi8G^uv?tdyHzWKTG-c1TXOO$>XkbVPt!q7(2jmH z>s1;G*6l6R?Ea%wX1CjnG7l@BL>;-QUrlPLiAt&L zm*6W#5a~C)_vr6bn4O&;ol0VNCJ8x1K-|nA-t4Cylk6)|(?uqZ-9NroY~Ak0tLye7 z%hn*$!9TR$s$tNoVf&9x@s>`paD$@HQEQq@0XoNwYMHwgk4S!sL+0zk0#zPzgAJ{) z$(4k?)}uAI*ZgBtkh^@nC9Igeyhu>qP3cs&)Rp%dSVR<=?@i879L~ZWLMMu)f3q!eIC>gjIiddBoesFiHmS?-n5{x)_ z@BW^#0UNa{Ai?K|AS)y>S1#?^pi@&Yhccn7sA@XHk81|eVzOM%gN)%6?(8InRU&g;5R)i=t>fld(^MjZlMy57d0<_*kB8T zt8Pi6kIH(eZi#xwV7ecYa|cWl!O~CF^dAxEz-7>mDle^AH6CH+Ql7qS1w*ifK||a`q9NKA3tdTpBg^*=iJv~R~`}@M3MKB)WFVb z)6Ii=b@(Bk#nx&cF|;}{)qF;K_{yBg6C4O_r!kY}D$yrDD%DRNU@39q3piFS`vm}h zxE(x@mL^!9AU==QFafZg_L%^F0eop$4c_~2GqO7$nz_gux4kL_bGw?AJwVo$0hlbs zBfc;M;&TLIcWlP$hx;;qpwdOCh-@2-lzFT=6s$j0%e_HeFoFP~h|@P>EyHU$kXsM{ z#8j#g_@vf=pvyL>`T1=D8vF!7jCC(`Ekig0a2?orq&wUmJzKmch^XI$4uR#VW%GOb zbDlt%al=azdRwsXcR@!aKCG5^9kF21b)SnF$28LPf%&&JsFZBSK}C53ahfw#NW9~4 zvgJv>msP1?Rpw8->+(Luv6Bq}cZ z5RmR9HewLu6VF|gMEn!zCV%<`AS%)w?kkb$`QKEeX-yFk@Y-+0`fLmd2Y|s{QRS2G zjOKD;Af~hd4Ah04Kpd2O)jcVKqkx>hc_xi8c`_|Eo~4UfVf6~93o19N^=B&}PhwWF z#kENevBRx3l_xvJ=3nEdutOnbBPM}`|9i+ftdHDnE)*UBOwqR2f$%ac=AjMlr^2_F6F zUrF~r=hzSSa%2K_yTYO>li86CeX=*Cyn8+^;8K8~>cQd~Zca|>v(9Y!gz0%N0Jb|l z@5|w?^*Vj4 zwSJ8!uS3iPbp!Jtp*$twaEHMoRy4F4#ycfMAeAmCf!Pz`~&KzI1!`7tziJY#%aS{!6m6r%zyB7 zo7}9WhT)0fW}XaeNV|d?Ci`;LH25?JSPjQs`x8zF-}TTtPrIWN5o0_pwYB=q7YjM0 zN>(31Og&39J=HsNYC|MJ8OpXZGZxFq!a}#R zhDHmo#P1MZqIUcE@ri*Q$klCMH3Md53%Yntef&Zi@Z@q44|!ye9lZAY@(V*^84>dF zG}kc)Y1DObF4DtShJj*!FoQ^wQb6u1BW2-8JL|WVc^G9@A$+UxA~?X4R3gTcKq(;M z(|oS!=c)X(X?w&-nl&E#kI_sAo|tPkMtHx-*Vx~ZG3@;AoY>g*DV$HO;7mz=36-k&Ht8pP)hI7 zF$;pv^La$D#KhiK@gB_ue;wn932fPusBf>qS)KR;Yjr_SQ3``pEGT}q z^12AQ=&C~3d6W$qxZUV79?@1GXNq-Uc)X?)2#|p&iH+dldaJ(HJA?uQs22z7wLNU~ z^}d}d=)&CK3MPfUv^za+->Ofl7q2^snHj@voWz+kX7l2fV;gTqqf}>BDZJbf4$a9pVXxwq^>(_O?5;0RM*tOO}XpmSk5Xk+%!Ig;BjAcSCcxSVkjw{7(84 zO=Kbd%3Z$p15PiblnvK2kk6g>^t#)FTOHJ_yR5v_-5a9h)v_mFCq(LES6sCa#%EnP z>V4!+?yUX%-~a#CF_t3wp|4+WNoNgmd191IIoa@GrOg*}7b3U$GjVLW`o!yBvA2~8 z%~VbG;Fm;ol4}gA*2=w?t8HV2*MJebvbJ1^)Pyhg8{d<@JGJwns{97syA!()LM|@jNR*-@K7M(+&%F(ZDEa;8Aa?e@t zHe5KeJjxJ8W#o9IkSa7>R5ML<02Z$LSB}F4S4)7TT7z9HedQ2*b)E4XkGauEaY015 zo4v^bw|UHiAy(ueSYz5COt8)0d)MOh9>ZCqA;||au(knNub*p#es~+mQX^p1s)p`C zTzN}?Q-lHq*ZiOxc>W?R{$a#99T76(}>4I;2m84IB5jmg)ze16Pc-F!C5aLT%zP(wcR*mjMcEjTko| zY#Si)2%$QkSJ{k?fLP8HoF*K4G<}hC3}QTSVpPCPj*|+;8P3(-C-;#@UnN52$#|Vh zLXlVn(TP6`P-_MReP)i%(caB8h?y*sf`-81m&R#7Vla)vWflLbL|S6l>^C6z{b!M+ zGWj4Jx(=Y|s}&>9o}^__#-(@mQvp;X&@tH~GO|26cmdbPc=1ow zV~(Lnc9N+j96po)1=nsX53A&P)F-JR#N=i0OhDX|;ZKx=I{XMRHangWjqk#RZ*x!jG9MHLyaoF}#OtAY;#t-A z`!uz>soW%++(YiW>r+Vh8dTT# zD3YlVve)fHyf+oWAcF5EXckuDEO-=R5j*(gVf)2yO4`m>*3nJ*R`!0oR^TB1UbLgz&ljdt}Mwd_iNJ}$L zL~i-mc;O)!@)QC+I7=<%u1kUK`0G0TW2(ICmMZ_PA%6c0UrLIM)mij?nDBv*RgQs1 zfk)4;NoHhCkOeFKPgY8K(K50}k6!wCz<#uf$&!nURg{apS?ZK#XLeLK=(Z_2Jhic= zikZ8QdZ%c`TXp48Z)t1wqYh15ow6})ANI;>>7FVP|Lmbh#BsGdA2!eFbZ?{IyDxt5 zJpS(Hv@*eWTp?=C?y&YYb5w=)z-5GS)Cz3fD^wb0x8q^-^l9IRt2NczPN(CQz`AbE zYGp{JU8UcTFv8*soC-tzYl`K8=)}a6lM~Z;d$n!+esKYZSM1PHdrv8B9=gCul+6LJ zX{Ii^YXKz4)t2hd_*NpWKkC*szpY+Y(y;Txc;$tlx1(<>RtNTeR$#Sax5o4@^F#xSFO}!=)1`4TJ@DIn-vabG`i@#D?M6>5w&i&MGs%xQ79>9 z`C1*lV{NLx^N5E>%S_O^CL^U1{hoKKH^6l|MReGRFRYwOG|@=SoU@cAP`-RA?O@z? z8B^b|`6GGYZ?9@um2sLvhqrKn2tBaTe|No~o_M7yj%C!U)qGfUiPs^(WqB|!ftc`V zT5m$cg%{H3R7;X3p3irytV~#ztICp4R)aOE!mkex3pvf}QO3+1B|bYTCTX6cy{<|e zc3~P?_G{*4GcOfvnlnsY(I45en%q3Nf9`tsVUL!0UG>-u)wUh>L?Q|qRcR;`(z$GU z&TH9|989-2jiJLv_*{MXbn{Eu^^)xi&l=%~q*{>YaFi(wvL>M3jeh_3eQ`75aFJ8D zR7GEFs5jf_=&tRNcS0HKmSXT?$Ig?&lXaeF6T+qnCMf~Wo?L9g54l2%a+79n zm5s3POweq~oh@4$D80R-|M}(k2j3;WFMobDp~`Ir zt)}O76O+y7%(nXL?);|1dV%atGB#>=d?j3rNjHkLyw~uJZqq*Nhv2)SOdkK(a2P=j z^R!o1R_gLO7ZPIJo?4CO-n&Y3e6K_3WLK(u@Ew=v>@QUCE3VUetD=%R^HXt*&Lje#lJ~#D>8mn{HmHU<^5Ml3)ln`B!Z6vW30C{&n}1lHnrNT&0_OU zZ{2Os-i*B;9!8ka_1!2%%W-q%hjBr@Q{NT7@N)0g?40?(*HRy@W&AC-JlX~|xr2q( zLcQi>4w3P2>zUL?A2-Pk<6lHHB`wq)TrRUAu3x6Nk*&v0Y3#l3I^UQ-vWupwt7pOM zPG}nF8L^|(8Y0kt`7Gr_olU7LIWVA;E6ne_C`1=UEj_#Az0s1q`A@-;+Wg2PpIkQ- zK3tn+rGJVmAZcF6@xW4^C7!D@oeFmJ>|eJos2Ss%T*+%H$uI9rkO)TbI|Z zTGq7xIKFboVAuYBfhHDqTquc+4T1Ie*st%&QDx5BEzAnK)?R^%)hLmqglAe%R+(-K z+bdXxWDrt>Tx7q1qC*YNb1Du+-^;GMa5f_Lbn4)Tsb68s^Ksssn@G}`3aDj-zadPkM@Z+6Ionpfq1I5No z3XhWinZeAfrAM~LiGq1O9?)0oCRZv{)Rr8qbp@~PiTEd@X=9FO&5`{wDpA%~;+&9k zm^thE*MOzEiW^>zn+hyNt93NDsOt{;qn-Jfkk{pD+=HI zkluqy1TIoYn9hGo1nmD;_4x7_#7w+qU*iXmP$IIZxj^iIn-IO};Q^*%|1?6e^#Aoc zzRkqm33sa@)|R*7SZr zLO~%c$`E|u1NA}CV>VeWd+3lxCc1+P&HE?zwn>Lae8Y01?%%8EB;| z^S_fY4h=z;o@((iuX)eq1JG?)gKd>-z#fBlQo8>IUl?X*PJ{*S?J3YdeF~`|_Uu=k z<^GPw9>80s%aM(HgHd@5^w@{g0pPdyEsQNay|)5n6FKv{2n?i0EJ@uYRn62UCTRhR zJ{S@_io)}lSOVG0;+ic)*=EhKAT!!JsemSFs_Q!EFG277&ogbtn%Mkx_&?1y%Jj)e ztDOxaMg|_OxePh7nJb5D;g<#a;KYZsa}g)|wBr8u%903okL;6fz_LgyyP1S?$lS!+um z%7K614kQs-?B~S~x8XtgHJBx&A3$v`?#9%n$Hi3-^1;==^+rLRLO%iyU~VW&dyr+- z3KFUWvG7k;WeaUSzko}$2l_15m62A@3NHKh3{Nh@gu!4W0r!t)?rpQLB>)C>h25U) zk)0E_YJtPv+Ugf1)RwjOUB7JC)U#_MkpQdA*cS5*A=IgI$s;ENZt4JRUG zmOWdy{q4s>(ADq~n47;@40%J`g*0^l49}Qk|LMAGN+XgK3)Nc3 z)A_$4xgDr$!SxKtuq9}Kf{21hGE^>Gd?jCq!@ots|Miaif9NF&-wBAox$7-r zT9c=B(pRZcLgx3$fBoB&H4!@9Y^5~YlannBZ8dWgX-8pkAts&WF`7CZhz(_8{wD+p z0`*}f3{Xb9>!CCZgVewhp=74{z#!BWMDMzcQTE0D@e4ptDS@X=cq@E3SLNL@h)~Nl z3w3}V=L4&6Ag8u;6&7raF3BK^5E6Wi#7pGNpMZ~S-f$@T3i>w49hOBx%$H$tx#1l) z`xA^F?rj!AB#8yyF{0N+HV3Fbs4;T{u0!@ws2$S=b`{_6+opCzv*a}X=9{-c6{S>K z^tUz8-F430`uV*T$qqVzkvgI^K2iJ`GAfpceRBkfFp@ZAGgjkJ<-Dj$BjQ8zU$clG>xG=ODF1=i@$}E{>x`P4WvQxhoKN za$+}|*n~tp0WQ~p>`>i_JWiXh=!8eSR#k!)s*(LctH0Ng;0(1PoRZ35wlMe$Rcr@k z#wFkwGA>bITu(oIo$L>Mgj$BVk2oYZkB&iuYYaY`O1 z5Tp_cyUY!FRK8ZP3unkXFs_C4bzjaMmsEl=j%gK{(xlw58Cw^GoMUzPh&L`I=p{Y-yGNG89$5k?n%2;{hc*(r`U^XA3r_C!KTK> zYop@o`RD_|^bqOfhX!*-37sw+@zejDAr#c__$SO{oI+x~>SO&8=%OL}WCk@1iP~=x z^D|F1A<0MxNMk^*$Mq#ayiXh%k{x&t+(8BCH{(9Hq2ATO|ZtLIx$s^lTKI zA;+FU226_qpsn0XS5J1=Xk_>IP1V^)++ZizLW>@VL-9-nyM9~Owu|NuAwpiR{>FE1 z2=+R&(^L&T&M*wLW+!rzQ~>hQk7I}^Jp)xjYbV3{A#>q*7&SP}upwb4h%xKfz3C@0 ze@_g-Nbxobpo9*A*U61Oqe>)*;mS}7;lPL*KT8c^h6ic07^#2IMIW)VqFDGdw0`;t z)cGY(e@}m~4Y<^Hx9Lxxoa>;rdF|i}=*Vite4B?)o@yQq6=&fQfY|koj$tgx*3e4k zlb1yj@hF{!)a`nPz0#GG*cUKV>JoPH#rk68EQ(;b^)%KeV;R3{($VKK?CaWcz)Ag07SSFnU;do+)8Uw1TvP!^k1D60AK7h z%+e!_W3TXfH6xOKzJe%pNvw#kJ~cdS0gvO=x=R7K!Y4se>(pz4L@tcmx&0dG092Wd zPwXxgzQh_h7_V~3d7_jGx?r5UlG=5$VX5{HJa}<%kO_k-#a4_n&IUQp>fdRPeq-8M zvAcgDic(m3AH<|L8j{XGNipR51CI480A~JkD0%p=Li9V%IcA%jGEzO<4fh}$8p_S7!W+j}b}BWa=X)(DFXaEd&cWCL*z3xCtBIc& zmLUNzYl6ouA7#|~vi3LSD}6v1kXP}9Auj?`sp5vg@$)Vb!rQF0U%pPxL#Z1LQ{V>- z?njz3Qq?RkL&za)ENs}9zTW(N|9=|({QvRM{;ypo{!hP4_I*4eB)|?iIlyt`U_kJ* z1tf1F5%D81id6d>4mfbr<@|#@OxL;{r*75PBc-<}rT@nu3t46|MhKL*Loe8lY=v9U zqNE_{crHt^11lR%G8!tVcM!C=DgV7%2YGprIx`;870~0Bl^VBa8=N!{H`9s`_zKqbF*-w!(%a_2?8$}L1J4Z;BdwJ%f z>PP^Q^Sfujg!tD{sXiE!=CLZUBX~0(ZnrBU?fHA$fo~kQ*8n^1Fd~&lXb0pN48Q|< zN^-j{8;8#j#>HUqBhgX7(8tTPQNVQQgu0uWc)J=5UPo@VU!ECEF@2F!q+ef$KABsx zNy6C(c9n9(GXJcmH{byJQ^!zs5vS~7_=HJL%InadPtGq57A7IbBim!7C8B%w^U4AI zHZ`Y&2Kc+}1maX`)}1()4S6Rz?cucJ3xX>Z(F&j<1|WhTUa~g!?98P*U+{3L|6l4P z2Y)T_LHhgxN&t`;f^&)mWaX9cO+0O7KL9OCDGy4oA7GOdCz@MkU#aUMZeIO-8!)9P)TJM6fPwoU^aKBl*gA6nh5*yzPvBN+h-AzIRiv*$I_w1JXgb^oMNV`L zaUH;r8Fxczo73_Q1zPx@lXIBx@%cCF7x9kt2vd*2R;KRb zOBXv}WYL0kHpdr+vqQ1qC0^5uJgSmJDk~7cqG$PQ@%pDP#|%V$&b=KPK@-p%6aq&l zPs_)uFEbbc)AO{hvEw`6&bY?#2svTGS{ng3=agp)c0ia&?M}GOViiZ)I1qoE%_R46EK@7vkw=s;0=_lvB^ICAmIYXDt)zr;9T7&KMG(*D(XlHq~@Ah;9 z=gN@kcM{>wS~>Ou**eE2upDl^r2RQt4Sb3#pw9 zhBi&E!m`fm|6p!JT5wePX*S!AE2#j7QwhtS7Ugy1^fS(2(MGwRgxPHu?ZX!~Z(&$i zuiInek9|v8@eDVvE1odI7loXrX-JyQahYG$PWt#EI3rn9i0Xv~>Tb)FcH z%c(RT&ya>+S}Or0ePsG`sMExFE_Z2oWao zkkwB55s%$HnKP+pX8e5iX$T8$TZAaEn6wD-t53}-N>QqWDq*~dhLGcfg;#G}h44p=iy&kLRWPfQ&-+_4(0)e`mLr}NlY#JvwDtB*e6j6IFiU7vD3 zsYC&}(d$2Ut{mG~_V1;Q#_tE~{P{O1ATu|!og?%xY(Z>yf&Z!VgXy<6LZN=<(#RIu z{cl+3lG5j_v|NhJ^OT32sv02~QsRz)A?}VU1h}S?_LSsTKeU`VmdQLRFf#7QKT~EJioe&bt*5gY_Ks>e z>VExqB*(_tss5%=GUP!mHXh?x1K-0Z(b=5kx&+rBBFhE-RrO6Ct8N~pc*uhuu`9_& z{>3DVcY3pX3?4V2bxe%Cm7aV>Qi5g9yh&gcRC$?kQ!1geOLO~tp6tJB=cXIrKw14z zR&5|bEsMN3@bKGE<9;Ck&HW!^Z#q3f3P{wMUnm}{e(O@330vQlVTZ;aa2$Y&`snWO zI#6Y1MUz~hxFe$xLdm*o=$rmgNdzbfUJO$UJ7~lbD(XDNpQBm-Q}j%@nEeid(;{L( zSa>gC;46`BcttCn^bkqMFmXSBbL>DuRE^k*piu>3LT-WeQR;7z;-k}NQG{p7{5 zeU9AxPG}ObT2n2JB&T+laQr79VQSMRF(K+Pz!34nJ2vDZP4!D7XgX=&P5pt2eP;I~ z13w-@tIo4@$0KTHqrQxbgDbjs(t*f4OP|cion+vLzp7UzBX5COr#N^1&=aWP@TaTZ z{wvPNzg*UAyC+nfk$#*8>_(_2Ce3HVum-v`dHRdrM5n<0f zX2EV9Gx><~pVyFcEFS>bd};?SROb87=O`lC2nie0+NY5s5-X?DEXEI)i{S@*u~;*) z&oxUjB5LGcIzz4>-Vlp?tWhM^tj2}3k*c>S7-UM>{xu^Q`Lc|`x<)gOPQ{@aKLvjt MNGVDdNf`S557mOg00000 diff --git a/modules/admin_manual/images/apps/impersonate/impersonate_oc_admins_only.png b/modules/admin_manual/images/apps/impersonate/impersonate_oc_admins_only.png deleted file mode 100644 index f9a42fb67fa1acc5cb861725af60c2c7f4e476c9..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 23736 zcmcGWbySpF{O&=dyStPaLQ14VS{eii>6R`j>29P$xAHK)`Ndjy z-L>voH~u)D0iAc=cgHtA&$B07MM(w|jSLMA4h~cHjpSQ6I0S6)x&#FY{8{v3k`nw6 z-ubPJI9$az#V+{asfC!L7#v*nXY@NGMDR1J!y9d9I5;AD*njY{Z|R_LaJq`Jl49!a z`iGgwsRaE~p-UN@I~mSIgw9y0&g1+n)I$aYoOzH42r~_Xy83tcK0kQQ{5)fEPI&1q zIP;I4-jRnccByHZ3oETlfNVva#6wF0{&%b>$HLX2q?8Opn%5?kH3@yb`ByQ;;HtZnGUu)Z>Jp9PKeY#{xfD@{iBe7mUvyQ zhaT+~XS20gQ$Qy#_hv@DAFg*QoOj0U_P;f{I!_3@{d}EjmaM(J5y^h!x@5~c*Y4@o zcze{kv@^qCt5?u$cd=mMCePkpr(@T=ec%fl&@d~SO)+lfRo}<!@< zURMroeYi4O?r-r(2+r&GVjI{db!Ac~(=4)fl>`sDgIQ6*yYsBT{6(V~y^0=_q4wVT zo$03E*oP-iAYw@|IV<&IIt@0BMT(|EVbYsm=(*WHnQZb(^D1@|Wj?@Xeq6qs`Bv4aZ^K`i}jCu;H@sMMa=Jx{K!hpABNTRou=*1h$;Ng>rE2srNmh=bSa))Ue7zGn9SF|4O z&1zdv3VJi3`fiN(VvE{X)-G_TA~7CH27gnbCf0Y)72GSyUna9IU;pL%=zaM^0=pSo z$my}k8MJrsRtoY<#d!#9!ZLkh&B7;FCJ`u0jf0~?Ke<~5JLp+DlX z;~=F)wujfM@afR=!@rPI`D`P^kYl)o1^3P96}Hxc4I*t*+*?+(k=tR$>?W{$CLWR( zGbq0^dU)*?rYx^@2d-!uc$*#j-@JEU4_18OS^V(4@$PhVX$Q7xKX~oUxW6uyP!;DF zzFG@hsTpOn9uY*_0nfg3)cNT1l12q*K1^Uj=xp8-BY4dPTL|hWc)gXN7>5#6gkUJRx#RFx3SSMN z-+r#qc(Yg5n*Ukk6EpqH9CGLF-znvlDx+Qn{>`nds&4Tl(er6F*Z2uAb?ZE&f~aXIw-bJP9h>gpnY2A0t6LG2M(YEDbGjhRbMqc0S9 z&ul|E-3KY%=68@OKmJfZkEN3^f-JFAwr$vTT${^d7rJ&_|E@iTIInhiuehyx?>rno zK1{r5-ip8QcrP7Iw$0YOg_j_Fiu-PyTZPK>B$V2R!(-6UuoK=z?3d+Bj12F~mBxdX zH=ddHn{=D-y;RT1pC|JS%uCFcSVs-PBOo<_rQN-SlFyGJ&1w7jj%NQa@yPxyg>BEP z0>#cglw3Q`5Z{|!Mz@)Fn$2K`FHkxS(VDZGI5-{4CNQL}ORcV2m3`A4O@4vyMgZnm z(&VLtet1(3)R#d;NrmkMZ9@?=pvSK!=t)$-;DBNxa$BEYK)1chhH6O&2B~obQ3RLV zN2q|%!(IQ&s5t)s+^4~~l}wi=W^htLAHB&SmLzx(8i+VV9wPqW`B^gv+TnUI|MOeR z-d9%x8ce07^%5nFG|`8vUJc>^xuQyJjKZJ!GOZVfOX+T}yr^l++ue?TnL};BwkxW- zu4~eaBzp1vP50UU*&6EaTD4*&^NbuncuT0xUij+y?$jVbPZh85yvWvZhVyv!MUI`f z$lVD1VF+h{f503chMB1gd~e`!pzWaB^nD<<$cOXoByZ(-j9?ECWXs1n9#p=ZC?#kb zm=kDfh-i5%I`m=|$0yLm5))XR%IZ0Zt7 z&L!?bV0BAqWOnObk-|sIcBxjlKli!hRO#kWZXuB(1 zX=eA1@uV3g`C8!b@24tDwbWp1jkFW>a{NQ*_AlK)qgIfP-gn}|X62Bh-dsmYT#12jOI$p(TCsR**h*}z3a!x~|V;G2`_4$W2 zx&KjZgSyIef9+ilrOtAQ=}*;xst&W`FjZZ7`Y% zapBdRf$s}lRkEIj51w0$%-=DF1f7%?%MZAD%DIfL`p=d3Nb}bRseQTg`B0Eh22gGB zc!GrfKG(qFcpI>;kU=2z#fw`1-9L|Pt5!LHkc;9@v)QGl2tmlw?_t?k6ChaTG#MZe zNh901+)Sjw9ud`7NhHM}!lqKeKu)C5pom}dOf)0thd^i5vgn|8&dO0?tWa_cVh!>Q z0v>EM&VfK*6)l1~?DM#%5gc>}Zz%I2 zvJf~zy_w9&Q2N&dcr1|GPar%t7k%>jBlr=xfn0>evG_`FnK2U`PaQ{JG}4ht8bQ1A zhw}bj<0Q~=EDu>v%c1A|NgiPt5g5Q?q2Go)c0{YvJl^bA_7pD|O7M6na!L9Nx@u<^JB@sPr{=8LdA{)W71EP|KNl!C;&6Va-*!B zi|{hG!a>)U!2Qg_o!IF4;bOfr@5;x7+u!N-a?Cq@+h=m8cF1DYz3x{ROZK)i&oCnN zn9SzX!cPrQg9c-LM^xoh5w~)5B^Xf-hl&oUgg?zQ$!(EHKn%3u|X)#p#IsH_OZ z+45o%w?2|7g~)!Qbe%UkI&55JyUX)Z;hqpY77`o|xrejJa10^En^DhGfvSAsOx`@9A5c`kEpZ(Iv};FhoGI0pz3MrdlUv=8x`O(B+teY z!8ZIRhawraW6qtUm(>@|tE*9`*Uc8aOc81+YSP!kGSxQk*3I-Th#8TV z09A^QSyZ+1t;`e;;yi}p6=ktcwZ|fPd-)!&RS2sC8omtfV7DAinL`Ff$Vpc>V#Y(? z&*lS6T-Y7ja>DM=NGZCod^6bWB`*@{079|!$(o>VhFNn?Uo}%Y6wjByyuRz@cZB;e z?VWXZAp?I4IfrSxMU@g(_2&eoZz06LT(dS`L*AuYj_Hj1q)jP{t{m3S>4Q97QTvWx zLlZ@213tWMCrO$L#d_nKlEhF*G6pL2fOkO$D{mKbwMnpp#tQgv@U~;dCT-qh4oo=b zVaVC*UP(y=;PoR6@Es*F9wYGz-g*_Sm_{?E;yXf*G<0$q>4K5_*2OFm+$l&zlMa${ zGKWO79^QwA7gKSX29Sq^?_Q?&6u*j<5+7mfxZ2qGiYCoY>mkJWY(I;!V#kBo=B>qf z7!Idx32dsYLd}hYa)t_3OE|gsDzjA3HK>Ik2SN_}Al-jMMI=OwP{HPrHaT$j65)hQ zLexnlNU-}3G|Bhk-$lPI)~zO{sj$5(TFQAwg;;F()2<$8Ab?Y{Bd{37D9Xu{$#& zPt30Q8<&4n#~XOZw49FFMdH$((2TO0t9Qlr;lPX*v>ELcv^nh6i}4qKE6WS`_2gl7 zKBjyv2bBsJA8&So!G=(0Unzd5qOMC~W5(DB#LsQTMYBDGJ+70Rk=m#)ho+)#QZ87z z=(PwFg6A`c8o}~rX>nFfG1YPFaR+_&wh9(S<{otuaq$lmZfMYc({lw&-mF)zm*|B# zK93E7^6N9Xz{fx8*jLt&CdTynQnihnlLzF55Bbr{Xe{N1rxI;G8lXK{+$Vd|Gt7~P zQaO66i@8;(P99G+@a%Lv+z1R;PzmOj;FH(iJwU!yY(AJNO9>Wm4<@4D>L)g+Be5Zf zL%`zeYHKvQI*66Pa(toFP^Xqc<^5Mx?MZvQ#3y&{@Z;a}<4)O43U{It=xf3Leosi+ zkbf<$)+HcgJ7HG+31JUQO3ZxUo2X`(8y5y-uHP9nS?GwgxhAG z16|Ju`|0IQu<9AK7ki26t<9627Cw}Tyzd!{TM`2$p;cThzdr3RlnRk3CbG{DEGG!$ zh?Ht3-qkrw{A%}Xg%$5nnTDQls|jrBJ>fe$rc9@JAvb)W79RVtKD1)k3TI>&`gtYTNmx=i(L*Xcy`P|aOQGuQOD_AtY1hy$Tje}+gUBohimOgU@Ot>Hb4? z0M*m@CFEo$tKbGj{05=}Nul<+%4PD`hnJM?Ntfq$TXvMW6~&q~qK1?q~;s2Hc12I+^-Y&lu9}YqG@PP(&n?1OBAQkNj^_ zKE0@qkZ6UfTSX}wFs>~T<=amw^45DpRBKWj*yQw5rUxv|2sb9z&wTE0(sU1+cd{D3 z5FcQ_?%-hFm9Ha3LI@$2hCd%;#wxS!j{e<28RuJpS2br@)k!OMK-5cCFCI6-5GqBFS*4kCi1DpB#?QxEP35c3&k9g8}kJX-&RgHRS#7^W&-}9my}z{mC;$0CLeKz<=itr%wKI&^Fb)AHFxYpQ5(qxto2`2+kT=#WpWOXotP!G@0oA z--O${vkCO$pj1~-^4TA3tFFR6uE>^|iwdc22u*zau>DZL?x^_zU5xDFA?2tc)WA{C z&SO&lPIP0cI@mr_Z`A(ka8u&Vb8_Fu`$kW|z4St{D3`^MDYq_GeSN{c9&83-X6F8C z^K)?7$j&Hx=SRQ}6xK6Kf=)IETgNj6TT$^D2tj|@6;7oGEgxtyPac3*JecR75j$RDARqsoe$QKQ%>2@u<%LTFt%OC(A z!srGJnl+uz>Qq7_58BSg1!1s)H_-I`MmS?uRj1%_TkSpJGgf@XX8SuZa7UoLc3{l* zs!8`eYDUk7?Y3v=W|cw?U-8oO19Rov7)h|Y+(?M2eB{ZFqwnnBJq!1JxE_oOe5aw^ zpXqb6Yj@I5%-ak9JHuJ25lleq%L$<=7+mxQVDh3l_2LSYtjnOrID7z~*26f1Tu8>= z_Q9tOuo82+@S+K9(Yv)HkX3sG!AH;J*lhZ5YVp4tmMEFLL=6cnA zA7oBo)4ZK5l~4N}Fr9r+5F=k6)K0W8Q_#_Wp>a>$f5{zG)m+(e^A)PZ%?q%_yDMdG zmw{+GufMHqs&*K*rY$w9!lH@;+ltu6BypI;Z4Zi5?_QWRT z>Jz@0H))V_9APR>6_Z=c_Bsvs+=`P~22*Z5$6i1EmVw&3ygDQab)o6+q&zy4vOi%J zI$Kjts{P2_S|D}{j2lhvIG+x92RezrPc#C6$fe!$(ly)rB8{|jC(F}L)h;k-A1{_^ z?}@t*D zjO=&g?ElOU4JJL!4BfZyymxIpY*=b3Ov%EV1ocvR!=lwJPn{}`kNirl!9WV;LLN13 z*+ES`9}EV_CW|rZ@Qu=Oj+C*5|Eh2r{0*=AF4lxmFzQY~kr1#eeNMO) zdUI|@YVy>y1i=;y+uhil zj>^E~Ea58RAm)JDNN+?7wX%FY`ZmNu2;^YaL^GkQdn^lz7F);1C*=9HKOX*29U9KQy$jG5 zI$l_3I}VWA`6CilSqGv`&R3h*zP8}PR?_b>g;Na)4*hG9)y?k8%(=L7b+7NNXOEfAo zikIe5Gq*ows1K6?V>Ko-3JwoXnMfm0-BYnkHAKcFGYxqFG_WyAoTkh>Mx6IZ?w(~r!Q)i z`t1?YU+mqKTza}-_ii`T9+9owT@&c%`bohvRQ~#p(W{WfhytePoeU} z6?AKAcBv>r?t&*7^)?GN?k~)w9BFhTYZ(1cCHe0pdkhjWq7aW|rK)>$8vBWKQuA=z zu(MthTyiX@ghz5+2}saN=H~0GFgFvgt}i?@JpfUV`A&e0L6Jc+ig6O|!HK#<9*zG7 zbUcdHIu6~4hgof@1**@yJmL-GfAiM)SF&Jt7Ta{!G2y!e=Y2sUP}k5eAvWOIn;TsL zf{=Z-2j8oxmK~90cJyg{Ie4Ucc0pgxWjQ7^%Po3Lh%V#<#9~O`bbTK)kRp(B8%$5b2%L5hEiEwqQ^KpdIxjD7mB!xp2ox-Cm9XBH_#sFlH2B$7giTv zY%w(s+P$S5rmPDj9A4~!mhA3pRr&--D3hcRM%8717)&NQB3Gr6j&4ISjZqo z3Q_KSX)|laG3X|CI|!V8f2quw0l_*VOhVqn50DclNh~PN z`o!GOE+>}BA$#jt2wx}~{q{|Vs(@FC63$WRPa+;N)H$R6T#DGV;RMDdxz{RbtSMD( z1^x{K?j~k0FwUh{bHBg#IVtyi4xjd0aEl7t!J!hK1<^}M_-(O!V6PJj3Db0IrCJn1 zBK;915<;p_BEsQkcvDpOM8;aAmXy0$0;HZqgr-=3i-Md@}xQ5;*f1sd{0VxOm+4wC8mc zaWMf#Mi6t5m?IN119xJ<+JGQ~G(kQTjtYtXGDh&IYAP4{?8f446&+;|YW?yZd12jw+oH7m`p_j%Kw-u}%NB#Q0o3m1jyqCz6rZcB>ujhp2Mz z>rvyS^(Xx{0*$FPoP-b7Y5rmlu}36|7NSWI@#pBP_-Mb&dr>NrNKcJ7AdKQ6uoWv2 zVY^{aZdaw*H^+1z9oq+q-E`Wc;m)0l`gI5bG+Lc`}tI< zT5;)K9C5Bo(3Jbe;Juo7Z&%#&l;=7#etW+gjR$MrhL& z*jo>{&eYFx`atRwQ4P0M@SyeXS#07h!>XeXL1w}J%aSO7flTl<2e+%pZIx=BSlX2D zLRT_S%n8(?(zDOmI~xlL>PU^m^;$kwbC8P1#+F(!t;niN_>{fFwtSv0HQjHNFDlN;kX?m)^zxhjCMkNsfj++L0H=F+`}P_Ge9uYNkT5i6crRG zS^r{$1S<$Y{{B676x*>8;&gX;eu6!O8#YGnU^A=*vtEIb=X6QAWQHWqoVSWa_E{qD zq-_Z*>ZnkrOzbrib9*8_^3lDDFw~=uCQphtht-?qiMB#r6*}ccfh!V$p~RRdG^`+r zZ)$m*_;RR+TVG>#(nr^E{BhQQWrQ7+w3hof@C5?DMV|8=72^j<+lun1iK;xtH~Fuo z3MP;gW3c}wpz6O?Dx!T<5Sa;>cfep~VB13|^bf~<&YY^ufY&1$7QCHEU4cOGBF05B z4qbVu{^_+hVD+pTzm#vhq_txa8Dw8quT2vsqVDx}#v4A_k@Dii7nn;x8htQAz)_|> z^{bW=3D~U_BcS(lEo%3_=^qVScKD)JpYy#p6r26m;7(eqtH^3v8~} z*B^NI0@@rXJ@TXUr8izbETnW7scpfvmE#KZ@JZ-=+U&cu9FZuIH~C9FfQP|i$_sH8 zIt#kHnxV|W$QbWC$sNj1(HRL=>rUZE^$ESqoWb~>j`xf~OjzPcP06bV0H!2M6RFVgHBuA?X(?eK@+4=v%xeE0 zqa&g^w)5_C{H)*w5#7ospg0+}6zKb&Aj5OX>4#rtFqVJDSCm+L7QVhcugo*X8Rvk- zpEXb8ejA1_jk-hfn&+&VmZXwhjz+)!eZPIt7OQiNdVvxu{OfQT2IvQbGMpgpoVK^r z)1q=>c#vu#HNUYCp-z9r)FEOPtp_hxY%~sRcjG*BiRU{Px6xm=a)GglXZI{t{B*uT zPq1um&Es~)uTDi_K5D{y=wfjB9Uoh;HHLgU3-W3hSa&TMe@*ve`0?sC5y z2|ew0m&on8rM`HRfAG_nZxXM$u#IAHq?S5>OMdAG!{3=m_Kx|HK^KzyI`&h8h;I#x zBZ;pnidoA^;Jq(_j$St-xR@yPW1z1hq0#EFdIW7+8!B_uxtkfdUha6QT@iRWA zXm71)Y!f)_o_xig;w~vMZ)brY!2Ds-x#Ke=bT0nB4t`qG+bquDmowK-U_G(89NY~; z?wI_v_D1_RylBHqEJsO>nw`%+!F4WDI*yoVos}%Vc`jr*TnjBzoCaY9nw&OvIQp6V zFC2HTAr#)5B~(|d$+wYP2G^bFxnHNhSiEUK-}N3kxaA6ULS`WUcDy zDk~+&n%A@mF>yABZjk^U1Os{Wdt>e&*c>7-$XECn(-~7W_7`Bn9{5Y{S9>pPWd8+} zKihtc{6BKomx_h`iJ_2N>eg;W{#C;5a0&`ZlfxfGg%|lP$F_^2* zJl&S(R{!6pP`y>R5vrPmf~Ixh(Ym6!NC()P4j=h|R4ND{(DA~fWySwYMvY(~3Q#~x zW(hxQutNJ07*0f7BhVhwDn-+449UEFr)qf%j{nkyL$!Nloc43!xB8;aQh*K z+zc9oMyTSUO5Dlo61;LyfTxMag3DF?IT;r`CJ-4zig2085?%q$AFZnbwgg6HR~R7M z9EfJ|+E|8x&VMeSI!hx|3H*RWS#uO!O`WGBEGsDnKH683VMSx0iaCPWjV=K>0HcO= zo>YO8C%~O_eO;KMU(?*EoGnse(CK3bsvu@BH9?R$s`$Sk(flpRXh**b@x})JoBYD0 zBmikYW6<=2bySp@sN5wIj;5!^h>+Vv3f7LyqM z0Yy>o-Cg!kk~sPmx$Enl>=m;VJ#$~F&9~HNVX3Y=JDraYOVJekleVDIu}juAcLV}T zX1d4kH1yS3EVIu}CWA5cNF}BdPde!_FBDD901L1K{LRI{_r6{`L0n<<4m67}O`D|+ zUoj2lpiC~;ZXv=%kdu2+QBi6zhXuH#)j}MectLQIJOvJD!QIvq77IXOVZo=~`{{Xf zQ@-A&q0>EpI=TRIEJv_Z`~iAJZ4a-wLORYOkL6@RkKoV5?(}8do?l;{xZk8ITj8GX zFB(mks0Kd|t&!dw3m>RQU2+G{2 zyOY5cFgu67G4(6JD5eK|IFZ|LbV491ufvjH!2P*!>hdwLwmDU{oklDH;PJgxO26t8 z%;eCx_qA-%rQqy8Szr`Txl!`ekQ#^X3nl}1Yc1N-)i{Rpb}--z$5~#dvhtq5L0dmB zqLCP2OB!t72wb7l$ye^3F!L+u@)utKS z6+CL%JTM9!BD?HcJKwdb>PBK}r$C7D+;&L}K zweDc=>x@m943Oo0p)DV|A1kqE23)o5y64mdzTib`04O;F8`A%o6Qo}SIPakQV6VyhH*8bl=0s$w{VGcY&c;C%`Xa`Y4SP-+Dkmq z-+z6aQiQp98y`9 z5VcKb<^*j$fl+QzjI|@0Bs9=Fd4eg@Uj9Oft?q}o9gs{MS`TU>(?Lu)XrUQ8mm=0P zHR%YwhGD)&5B|s~xK;XdQi@t2`-G0Y_|9(>Yi62w6CS`H#7~%(lTC~KkEs$^B=-~9 zOO@k`-(D;9Ji5Nm&JJ|&X3}G}x+{K^JP(v+TrEkv2A6ccmL360h(WOONGSK4NbV^P zkJBw(AH$JtWNOce?YZ07tGVgxj9cjG7P6SBCYjGv!cNyphR4Dn%6q{a+|6xI^sh|OuHi*fh~s-&KQtllUJGP! zTfSwphioBXQ`sETDw5_6p_{Xbo@||pTW#m+dIYkhWYalc!wX*mkz@NbAcLIOE@MXT z@@T~w2+!5lfl%RXat=ekLex99)deTeLNfUv$zGF*c)4dDH~IRkjcp@u>FQfTX2pCq zs!xA2`jx_j{Sk7(WTNfOBwon3sI8v~)F@7eOO1^!(93ntBgf5XUg_WaU&|_L8ct5T z?1x#LWb}Tpd4+yg5xpMHi|t9|Zi=z?>#UP1R?2jOX>8TwSCLUaes`4LZ3}1L?qAs) z%vU$7=1VW!@#3sX;Znv5j3HJ_g;b7Qhwa3V!w622SpjXp{E#eT8o=$Y$~J(< zPVRUa@wJlG7TwY;`9WNy9m8Yel;|C{s>)meCE_kpXIVkTUcO!rl=7ZetJ5Qx)~%mV zQ|l2n)gS^|GFH%ghmm~-nX|3*H_lp1gm` ze5Ri*;$8lDYaJ-L?Y|#OJwn`-0c}JBfTKv9o^D1eeB3^QqYfpRG)x z>x=LJuIKrx9wX15dkvn;dWTFLwVf%IO>oq)x4dy^Ly_=2)e-f95_>#XG%%;3cJ$^_ z6iN7Tr<=msLg4Z2^HzOw>7h#;%BlGNX_AhY+^bn8szk5ihD+_P4YQd|;4ycWXKOCd zE`Ir)BTzfGoJ$BuKdz!j{=A5v1CT3OvIxru?j+5rFt8b4uRF>Hc;YxoE&9nA&gr?m zszjM}px;84KKtuH#|D?IpKi{;HasCDXk>Bn1OHk#Zo(3LQRhIc4V8lTevp*G9)YMa$E!907qPVe95m5z*5 ziMM@rnTz4xdWw+Jjvas8_q#b?sZD4tx;tNnQia%^{0b{=!6=k6VuC*$!K2^VFQt3# zxoOZ`-uQz<>rI?0@OH3;yvjEnoC&QCuJhrP?<2bXV9BdI*%hMz4f^7$_yF} zG+xJMOj>j9Ls_5pN{zFPmGN1kVOmHg*N-9)oU;0#A$JD`4~7dN<{H%0G_D1pzb9*p zrM_uMi7r1+YOtk^{>~8hFR^-M+8We-7C{{A*w-6De4qSrK4B*pGnU@8fuc!9ONsvg zLD|hgDePIKmuc`xWKzl+i5#i6i{YKA5d2_-y;Vdfm!DzHGR$7S;_dCdYQ!F+bd>jAVgr-y1-mS%K{+3PPg2>-B)wLghUMl~J$cz-*2L}t?nE#4<66=6fHbhY1csB~G$@u@ zvPLxGCA}(GJT;*y3H~2mqH1ZU*$m zvLgl3U|0E_AzN!cGaFfvk>2>mZR0*h)29vg_5IU<^D52n13U_HQ zjc%xJXf(2TV%rIB&>fe@^-lVa#<-o5s(~bp_rrUlC3l8&GJ2y={Z++N4JowuS!|aE zaFZA4YGx(q3rfpEY*IKN%0p?szcDYn{rlX%TlaiXgkRlV-tccovW-CQgsq&9Ig-~2D@ufXhZ&^g#V?RA(8I7sM(Ug69! z?wgdOes-A}x%+;+ua;uPI>JTO_L{R>GeY^f+?!q+o4)N!AORXz-S2NDDD$8TL|?L@ zWG;H5_53K&8uoGONe?Ex0SRQmlPp~+=!etFPPVUI_9MuAMUu32vJUneWDD%wzc5Gq zQ~I!-lDeeROU4!TLXlk)TS`p2{!oz6CeouZum!d2`hRX^{~_B;mBNu2O(JEi`dR37 zD32BAY%dpM>+|2du*KLQ);?Qx<5(u-$*A~hjvqfy zvLo0ng<;mjTLE`BPHG`CR2~KM1KpY+q1ZeT*ARBx%_}&n9;B)ONwh+z(XPRbnbqQ- zX%Z((Q+x(P@rx~1C9bFvnfV+wd+2<*Ds?I$Cr`K@JnUbdJ<&W;J^6aSI-S;lKe}_0}K;zZc)lKx9*} zvT6g4@8N3G_VX&}B5jI!G$btLS)N8zl+*4`v zM@2_;ZzX627?U*9PyVw;&;9V9rAZ+wb9V0RWsutuQNiHra2GAyz%#f#Hs4P zsP5CCQxHuSDUzQZ)$;rN$Pqg)5)6`Evd|KHzJ=tC!149xtN27y)6DAtR{_vBt$@RI zmb)7z->qJ!EH%CoRVD`wrQvegvj_&5Wls1X{r!axwp zLf+VeN@jo~c%{gm0;pzxSzZ{GARv9_9uZ57TC0y>VL8XyiH2Lmm_TNE6_kK@hGXM< zs=N}fPhcr7MTUMF%^Snz#7tPMnz)%Z#Jq_qtJ_LLT&{5KlcgTwWK@_i^$wa>jd8g7 z4WPZr5gR-hqfUhKjg*!-g|})F_|$*7>GhEKgHFTSr&*gF$!9P0%aT%k40qtIhWW_3 z4c?vv#trCs?R}N`)}N+Z_cBs2s4`>oO;3j0NDnicNGG07ShVG7G^a5xybN&5m?0L= z+fQfp4#6SaOWEh7;h^Jy#CI)C_#j^xZyfwJfpkvb&Faan{&xG4{h0ryMg4_p!^!J| zXHTR<&qjN-*LXi7O@>7TVgyQ!<=_%-qAFlP2DFjj61|=ZGpmQmMtW|noEmO%z{T79 z>?127NfV&8-ICxICZZGUl+d$cBsl20^Z!_1pp%Bc4N}+C`~)md0sC*h0)~1}U@$Tc zl1Uqy!mR#UJ11#JvKY%(MJ*z;a|VoUMmpAEI1`oij`i@!)tcea-mTY7q~~NIF;s00 z$zoZl6bTHEO$}pUd{Ld&FJC=fcOE$~2}>AJVTvLTV!HOxG&oPvFo$P%NOY^7{6w?5 zC5qtzsV~K;nSNIobWDhNE}M!MK|OcUiCl;%@%i{_l|@xGR_ROC!az=ZXw@f@^fc#q zjB2{nvw0M6Pz|PDrf#M=%3W8BV#<2FW;pqZU$i;QT;@e&7G#o$^ES8_cX zVKbkME52~T{dsEshhcJOE+i?u?_+<6e$npcvOBESsZWCCJ4au}Hlq$%a);A^FTr4@ zkA&~8?|3#9@-ycHSL}dC>>pMkmH(Cx4jq1|dLU(Wh3cxhgKy^_hK# zHz{0I4e31pc31CK7lVb8Q4UtAd_}iI_~{MDPkeLf4^NPg<~HdIevu9(XuKimOM}b{ z{XUkuJ+bj$JBA33o&!o$H9W!o_%;NY+Uv(+XZ%em&opt?a|Y{?r&~#dsv}8snve{I z@7}1-sy^)Nzj`>Y9*ntg6yl_hT*GJ&d|1}lw8xi z2|NIdD&=l*ROFXmHLSlw?>paTRpC*JF{;d=w)d~eqj_c_yT)loUlrdRF63~EncMuA z-eBUdKX6Sig=`v%zF{e&5_j&q{0K${b70f#X_Mw*ZZ(&@p736E#W- zawIA0ejl)EPH&wpHjxt@>qzi}?l}oZ%lzubAlqc24aJ*S?&6Tr0()zptS_uB>T0=p z`Q9WrUJz^a*%vYS`~yPgf>P=%*^Nba3v?q{tQ2&yz zSi|?QkfbiCheW~4Pf&!*WtdI&`3Lmj1_`Zw?vCa&>zRg{o5r1l1XTy}bOO@DYM=nk zm=*U79>g_`;i`%c5$`StGVTxbLV;%uUNwa^$Xe-Vo~zWc+lIa+pKnH<)k0+cA|x_1 zSho4~kt9gdpT9PsL0S+!7)?QE=UPwBVs)8`J;X!Q7foEMdKuc$WAT@9V2-XSIaDb3 zL!RHWP}rf`J@+2+$R?jm!iYM4`O;~shzS3ps&Gj)1$47{M z_r-y7lhRn~3HqYWI6(1|1VNTKs;?DX=W8P@NRSDCt=HxDJR|2r;K%T*A|l1gOD>5x zSv!$0cgI(K%SqsV0<==SFJnLRyynXjKgz+Ey)Gvh-ed>PQ`E#cIuseRBta{K^b!j3 zD(%vV8UwMgkesgr5;#4{9N@j3A4s&s%~z3)XuIQB#!P6!pZWYADg-I3u=n}Qo>Y>y{>1@PX!A>5kACoj zA_*(5OW!usQkkVZse&$qP=0dL{Gy_twdZ2+3g-`c^MvOlSwOF8+S?Ljt~G8-S?-X>=(YktNAz4 z@?S;d3m;HbzHy@jwM@pn<7z^b>>4o+b- zEOwzGRDvpCH43pSl|J z*PsEX#;GsC=e7dWHVreYUMv6$p^5LcLfHEdJAQD)#0@aDW^kIK8)#@&6~LQfH_pGq zs{8Y!<+vH_kmVOa!psKA5dgWbf#f9_(rg<*)p`e}D1S5}Wl79HBM+b?5dM0HyagbTs~tGM&gS(t9ro=G zb}KG(E-(Pyo(=oT1VCji9(n0u{#3W`oP$lf#gFzS;mqXYL9pU`+$E0(=G%k8bM#|L zXV|wHd<2?vO3#9yXE)jljvRly0nV-f$0h7Qt@9DsakbaUX}@3t_9L<0`CG=BP3MK5W_*&- z&%dRW4T(|HJVCn3U${%56|Psn$gcQ^H^pNHy!~AsK%QTgCbw0uhF4X34`_PFVIv>V z4-~_~J7M186@`~$>P^NYcx0Z>w2Uw1UA0E5fUSMWAm<94Oib?AH<86BtLZ^wX_CO= z@B7wvI&wjU4VNycEU;T3kS?&`2h;ysK#STQ!_KNwRec4hbE|E`!oUb6 z24f_1YbcaP!{N?ttJr?EBN>T&iTcwYT6Few?~8>MV87yfx2Ssc$@}k5nU$fq=ZE*q zW#t<&A~zozr{BsGR(ug}!T=9bxdha=ZTKzJ3JuU_B3X*9Q2}rOalEtATu=qX+LIaa(=z2#);MRFR#^w}4YqLBsx`ByWv7 zVDmD{dpLUOd03yK1EvgJQ>wR}+Vg<(68P4M_niTfbw#Fd@Y^Q*5c$uknM<3_`wJj` z#IUrL$$z=Ky3hkdV`BhcoOyjp>2tL%#eW%e`}E!l*u@=S-+@5cO%ZfM&1D*P$i6{U zPoB z!Raj>fvs%U^+h!${(f8F@po1Ha`9v@jE4`bzT&;(I@I$w!nel(r~jjsGk=HrZTq-& z?8cs*K@7$kB4gi|46>#e43T}bklk1+d-gSJ5k(@DeVJ^9F;SX`v6R9X#Neyv(|sS$ zaX&vkKivPo9LLOD*Lj}T`Fg+KDX^8(%0)(MpGn5d^J}9*Rk5pD<}NAOVcj3ZqDcwu zhhAw4zH1VbFer;%cH9dO;A?O7gm|z10Di}p7`ggJpw7SF0uKAS-x~mn1eP(3TR`1H zKQ27YaWaLtfRIF;f7CU5k8TMlMICMj-Oh*x*jU%=)cZXey;HBUf~%7G&~AY*lfMA? z@L^Q?;6Dk`NgIqL?=-QCVsWQohd}voD-CKLlimh^m13rr{+s_*ya(zM4_C`on_glC z3xelfC)M9$%*|7zAh&DT&EGm`iNjO4A9e2Zp1c9d5Ztb!^|#0|gs8nob7=4(+i1Ie z^^w(r`m}8;XDycw^=bETXDD#}z8vu+{p2@mC=?3r99aB|Lq=W>OifKj_V#vL7icdf zSA7`t29Ax=_TR`EE2Tz4t%&!S*dA>VqLkX3W6fk~H{3u|2PZ!K$e9qmyew+mrtHMY zCq^HWbR*v`ZdCn*(#dD`8}L5fJT%vKKe_`4VlpIuo^SYir0BnB?&iUp(`VsJ&NWhO z?p!+qitC`vnvr0wNr`_EkmRDcG!srS7+BmpiKbos+pwZ`C_u;s8n8WFE}!ZGDG*`*A&%b7!tg}^L>%Fp0rpY-0&=xv!U>s-!AI9eZufR3;fq&tQ z!zuaT0%_9QZsgjVTR-eiSqFW;r)Ry{+&~{DeVlW!o(ah9j7s=G8C9-Q>@JWeG^6z} zEL7*f^emb}Nq=3#))m4*HhwFWqoG%ef#3c2O25b}N<7>^i$Ql|aalLv)Xpr@yAR+O zQEM_*0Z&h*?5qo0k2Dx3_>A*24)Jju$A*A&G(3{_t>)ZxEM;I}n>%@m`}Sb_wTt)m z{c^QelkRM&1JlDbKvs^X3@o9t0x&3lB`iO-Bvi1!2kK0Es~K5S7PQdz5>5L!Up@pc z(<+uPvru~HMwz6}Ho|RoeO2K_u+H*tVjS)*5SkNCe3#WRI-_bqqQA5WlFj#BMIu^X`#9(ra~3M@{FqID7h>QeD{WQj2tiAYL5FG?ThnpDio!u}iO~0dxqowaqDvDCR(2s} zcapm>xP+p}j$3(C8BFiGmNGS)`Eqi(EvBV88@#XYaaO<2p9+AG9{G#q*tzPY|92!C*kpO1XziCkqyo*Y7;+* z;WX==ExwWHeX~pKu#VM*5K-Nt=GNx7>{}LQy0^exlFT3@yqU98xz33dT6U&665-Po z1uCS^<9yoN>1GV_AD?D)B)7Tp4qParo43~;H>5-?Umg<5P~WaP+x`9vAgUuLq;os; z2bmk{jFg+7TkG<_%!~Z+njx+s)yJcf`CO3H0b)BN)`_>Gdv^8wUsZ`A>O&4s`#s(9 z$nsDTJ{|W`DKaMIqtIbxM!cGz_T~fLl1kP(h*fO88C)#lK{Rk?BLrPXb`K`cAl;S! zVj#fb1xBlT>$`j3uAc`-*zjEo9q@XC_sqMY$g-OHQNt;Zv>Ab5a)-g^2r|qls;pVy z>5H02i&RKBHIh~#S>5JYtz@0n4V~K+$9~P?gp06{JZ|tNz`lL_oh3rTPJvRiK2ZHt zV8cA?WOnXvMnZc?EKdGfxhSr(nex$l;qg76Yflui+mTwkjH+iK3;CK;pFr7 z-Tfj$1oKb%$LsK7_X?f#q0*q&#Tgc7;aDHs{z3VjOpFEgZ-Q9tJ9D_}XPj@>R zVlqA+*rT4O!d7`@I&hZqb#e^yD|pGp>v0O+N{y2d$UV!n7$;dm?r+bEeIj)nP%<0wkL_yWB}AfurseY5 zA++W!u7Kz&_ZyuJ8n=jg_c{w9&xOmH?U`+a>tF^>z4 z54p~o^^En}vZ^C3N{FZ>yD!1KP)vP6Qd=V@QhouR-+$NN zSlyVvn>j)YhY+aeq8|PkPesejRPaiSu^4IhMEPE4rltqd z5QQrPZsD&O9$~W|`7PpjlL&F6N&${RWz9-xSTmHv9W;iP0gsE__Ncs|DlTpCnPlw& z2z$1Hh$+}>-rY%2oOm3oi(L`}b>;Kw1(p?@g;9y5;TTw62x>7r!gVF>DI{28?+A@; z=l!7~o|NBUj~W992{=CPE$=Zfdn^vp{?vEc2((*`Wysw;CIMD#ofEgTz&NivCzO86 zT#tD|2P8FaZTlqV^AO%SivB^aBN-Dto3b|U#)X$3cPu+(LilOr3LS`kR3c)Vp`D5u z>GmM6pRRR`6VOJPh)HTk6@B;=%N(4CNymjQj&AR}e)#R1)P z`+VPJiRT2Ah__veD?M=KQi1naseq^fZR!5^#!0*7I~yZq*iXgAEnnfQIbo??lIDb? z^8fqqxh47$EDJo~wFX!H`&s&*a7fPpN~`%u6=kH0!`no-T1khXfb#CNDwN8~02ql{ zqP+XR9hhGg9JERmf7MmEH2n?cPp&Wx*|dEEyx_iSRIA>8WelXM+6CR&jx~CsNcN2 zc#~d3(R55kNqT~W5@Xn7Vz|=gKa1_Y6L>1D=4adUUQ%@R(Fp-~67kKAq+ER*$2!vH z&?qXG5ShdF$u9Dn<9jW(cOU;|62soguMxLmj7JCXuwGh)1X~oraS$Bzo?VbRg=iS#LjCYne8Qy> zql}9gJ_Mv_;uf(dKO(KVeut@>YxJV~)$vgjwvv0Jc<{tBYB~RY;HYy zvza>;vD_73s|#qHisk4j)$S{sYV5~!Sa22Xa4oJ+b0)FVcV%PN_Wf@!>&m{Q2f2|8 z4^C3wb;8I6#trvIE?fTw!fH)-vF<`=NW?b8Y}e$71L!6sPyxe$vQbrsvNj67mo}I z;|8me&4^b!&F4W5RJYIRWuta1%j!kT!uOX#^c`XxF|8R4O|fzhGkN9*a=%@KLrT=D zS3-t39`>Vs9LmI6?j@{Tf9B0lwTGKt#IYLEha(D#;rv>R>Xh{kMtNlA| zoi2?n9wr}_$0si<0yvz*Z+Xgg%7o=v>w6lQnC~8Q_x<9%8}ci;c|@Db@dl%k`=k1w zpB)5viJP9qStrNGyUKp80`o(M!v$Q6JdU8ut@}I%cGMXP~PwAobuP>DbTbW6H@*G;FK|j0CyT0E}}0?t9(L(`*?nMhO01Zt3+F{F|wi=Q^`pT%q z++7E7GKy+0pfj|o-obFZo4l;o$kC`bRQtTeO+7P z$k)1>YOD2O-&gDFgchyM&SKA27gKCv4Psgvwlk|3D{k6g5DRP+7^1+ea|EF&-N(6# zN@vY#ABwxL$o#caFeRMO#+0faMVllLRP~*49j$HWB7JOqAAAA-x;7Ef@50GDKk2f5 zB757E(pjMyY$FHRvRuswyML#DcI`{@IpVpk_jEsqNJ`n6#r0QqDg-m3hi$5s0!8@G zCn=AXeK0?ZJ7vQKZE>=9Nr!kQ@_M<0>&E>yFd)EqpY5_eV?9qdJ3%stUPZRbZ@L9$@kn=>4StKgIf4Ub+vF)Y5;XviwcwgE zwil)L5iv^TSBoVY_}LK#!R8Mz0WL4aS08xylX^)4U=w0}3-T*j3%tEjB|SWE|0l0> zO>3NYad>Ex`rX9LYvC_rXmNiI#JEw^sj(OH}39!p;XJDnM zPWx-#OYe3>69U@@uEf*4r`zd4zyi=x=fi$jh%$qiH*{)v(J&)N?wVwv&rY&{UX0r^!_20S|X$M zb4HLO`kthx6%j`+_NQ_b6!)`c?#i>VbESt?k*DHTQFgv4UV-)d=1bro@}uza%lz2O zt7Xxu+tZIVDaonx6qPovNFzwiA1{td?Pa!9^sxlpz5^;u6l4($y+9Bao`-k16@+B7* ziy&7Eo#8s6HET;6*NwYyp2Cf3kM==GH1(kw3DF6h(9@Fn} z&R5B+XdL}C&r;UU^Iw;|#ik^gUTndR5Faif?&QcIT(G$G450q3UqwE?(sKHXcf^86 z`h9oKYv9S+Bm>O4SEYuN28p+QZC9E-&g+wQjlC6i3nyoDFymWoG;Cu@24BBHnC22X z*du2e1RG=dVY>w7m(xtfvnjn}v5=Lu(hICU!idz4%mLl+oKKdP|5@JWVRvRkY_c&` zsGF*!nUrT*Du`XpXe;bd3MVDy(53*C?5@NC3Yr(o3;r{qR0TFFl`bYs^VCjK@>~(Z822j>WB*Wl4!L*+9bwDF zj`VyxCn?uAyZ}ImCmCq)5@BpF6iIsTc2>Rz$wes(J$wc@=K3a6e3H1*tNPRaP||mB zftkS{IM`RG;m@0D^7H$v)R2K0A7dn>otJpmE|_snvw47R1PWb$$hVXt<7>??f z`fOPJZ>y4hV?}JAe#If1X-hvwE*0Syy8jbi{a*xE|FyvE|FE$C_eaufoQW0kT`AuT T5#|BX#;Gh!Y>ZzRA`|}yQ6BFZ diff --git a/modules/admin_manual/images/apps/impersonate/impersonating-a-user.png b/modules/admin_manual/images/apps/impersonate/impersonating-a-user.png deleted file mode 100644 index ef9ca9a3afd565156d49483d39044f1f07bcaf82..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 5714 zcmaJl2T)Vnwt+yT3ZnF0gwQqg-m6Fl=|u^k^bkOh-UMj^0Sq8Q=tVAqR4IzoPz9w( z2Scv`gh>0*``?@UXWsi~&aAc1Dtq?Yd$oPy4fVAs$(YCh0050_ticXZi6R*_tyUw0gM$^vj8S!3 zfY8f3C?Rwl1eFNpM#t6u27ixH!P8P}o*&Y9uXpTCwKfC}$9v2){CV|z{Cm>xD)q_h zK)yfVE%cH8gA!)v&*E@LLfkx z2?;4TNV}#JCC3xoB)k{#d=J+acwyCh6)d!FcQdLMse+4;kYdpaxZir{U?nN}4VZ6l zK!g>uN3br7e1B$*%}mny_U2Iw-{n(rZ@1^CuFvdL2YumN_BW%jY91hHR4tIGgN2F< zb$0~$>-CU~!&VM3(0*s&YDxR!()mNLdABWC$LzBh?1hud<<=H#BY3Vz{Hn=*ZzOA} zU4h~B%zgcX8jffGAbI~g?k}-|k&_=c_Ai!#{m_DYUPHtOm#0(>kU~M@$V9KIk%%;6 z{zQjT176hzQTZ!z6Yh6m!^9fHTeYrKN~{C)N(xt@0@~Qq{s<%l?16Q<1sm71D08#= zW9D>zBCCDg@%kf!xPlGExr~&<&eQ~5I&E62R<4xHM19IFo~M`lw{{%oYY+piTbX6U zWpOSp6t}LRE7B>4Q?)|hlPWaLz&|TMzEjV?rEemSKJ02k#(Za67`p;Ap+*M&;%k24$xh!=?h3e94V$Ha8=F``# znMHd(x=v;@AciQ=ASi}j-C9ENe)Q7I$QBUb6_jn#h7srD2=q_(m77480gF1zOjM;cu-<9)N*T1=uktRJ!rJR4(-Y~?~(3T#M67RC1DL@x(ebommbU7 zG#%c-pAm4zlev3`wn{R#(MoD0yEvIDUsM&l$me=Tpk%}%%sH^&vq6f$E(`1n)#-X(5L7IxR>krimrK}%z-^)kH)EYwvwZQf zuErfE-P{fy3mkM?qa1X1;|OEo^L$thW9zPi_p)>PsbgSvOf%f1yfi{s#(kZQ@FbNe zzW|jPY?;*ti2xPX35FXvE>`r!3i%*%eW5UG5MLSBsF7T66jEaPd)er&)9@^ zlF#1}>2CP*i9)#&iAp}H%XxR9u{8GZhCyDeUl5Ul1z%BYkrW8}g6gZcS;R1F_BN8R zAIzu_n=bJDR#?2s)h~LdUm0Aliw%ntB~Q9O6i^(o8v0lDtC9V&jq%+?B~%E;aN5bw z!xNNVC$I0I4$btRx~gjbl_)b`b&wxsRDOrLrL(xaurH8 zPRybyhUUg{M4vILIA~y`qL@qia)8^jGscf5ILM6doQ8^0Bx$MWyC7SaU#X@K8-T#G zt#r^u{M8oNem}yqH>-{$V#NrYjj$jt{ zZxTi;50VYi^|H-V%+KD^By5V7Q%wlgzWOyGMN{WG*5w^U<3q#{# zt^j@+H{Ty8a&uv6E}E&)X^rzEzR2I{*WJ*cfn=g1KL4GMRZp1A(Cjm2w|Y3d;whUZ zIEN82B*G#ZTv>yXpe#L{$eDIId!fK_#fgu6XA@1+mW5QO9;IdA@xmB>A{)&ojNf-n zlFmit{5XEs8$jPeP^w#O$}FO?#OB-o1F~Uw?tcQE^Q_zI73u^GyHY2qHoqkO3-W_> zYF^+elmVU2=Htksal`cB1@f9R`qDm`Gxfl?AOMPj0}Y6SgoAaoE*hMbZBiFaFx_77R3{#@wH2Sdo4K zQKmJ@E8&l>u|^m$8-dhuV+r;PC#c}t;o}z<7eV!J-n=P!T=JL(;|9px-Q8tlW1FZ< zS~=;#QCLRD$8RjbKk$EK{vqOpj4t2U%AMb5B3Y5Xyt*R( z`M_&qtSU#KUy{UvWI)ma$(t|`*EJ5=>Y&hq#0ymYXr}Gc+qgO6@g-N0H-4-+zH-fNK5~+cXX9QEhq`vW zho1rMsa3W8-}CQHUYGb-W;dUJwLRS+Hcxy4m%#*98P&IisC_ap+r7=NG~iVQy8rzH zDd)5yf?T;9w`m0mmx_9p16!B1wO4PMkTh({FltBu*iE1!N3KbL%6@&a(4J2%sF{@u zWa?fD-5J(6YA4L+9AV7uCE|>hUj=8K(sS|>my}hp#Bp5UI=A*SDKPQPx7mLsfW_pf zZ^#h;sB*jEmcxuqq6io;B{27rT(DZBpAhVu$;>M5!!h{bQn{m1+qd0B!)+@=8qT7- zjefr7?rQLDW~GEoSAs|AR*H)@?s`@T2!z6?i1Ih?#bQp8FLLumZsK>5<}Xh|cP#@+ z%%b6gJViN54W|iou_VSaNS+mAephx-L-!|_Nfs&RElk&%f;!wpQ>KdXMFl&B%crik zDU~NCs~zz$EUt5pjbKVZGIo3#4)=3>ZT}p9LXi9pQDY;!qpx>FF@f&vcZ9Z)ADFFV z$f`|1NBa8-2mXF0-%{4N#=OiKGV|<-|C}imJ;?aS+ZKwK~|;Zor~eQ@YFPc z%I(pa49}xvg%623M;AdYEqmyWcHfZ@Q586x-@xW!`CBCrvv9*KIUh!T>rFgULoQ5e zV|IOgy~(B;-;N{oN(Kk@U`+3yp|xrY_=o9W?T_JX{V-F1R(>hglhL-V#%a++M9NI}d8CJ;^<%_#h~ve3Rni`lbzam_=?viUwGk9Gx1a9 zr$TXzQtgK#YK&PH1ooC!1ZokXxNsc#ucx-7eO9Q#@wcfwq_^C$#YIKYr(+fmp>5J& zuyJ00Y|ynv*&4M9sdt>>O;hH?oYT!0A^s78yE)Vww3)Md+Q2M5U&Wjcjid@3q^Rfb zo5zA;{8afrZ%d2tlV6g|Sohw!ADh}8G5Z3$8Md5W$GM|=4_SL@yUNOaPC;O&AnC59 z);qh{$QDao@x5SGt%+6ERU=CwgUfWws~lMaDD99J>b@VoiTpGup#o&(B6!ho8Duib zwYhNH{Ek4?VW`v{ZkjD`ZZalmhv22*JmxtfCH0-KU=3=qkx)IiAt>Io3+LYJ&()}j zyjZ>FS~6Cej*j37-GpB8?8TYv9m&E)Y^5vYo8z5d9pAUn+7OB)%bFKNLS2~p0$$!N zRcp`VTCWX|Ve*!2dqsKIxsxg4N6|1JboB21d|5l^1{~B*p1(IZUz_n3X^Y+>NhHc9 zXMDEnEs-2Oj+PV*EvvCikV_Pmzw1s_Z9O2Fzns&QMDbZj_grqqbEIE~+0|j*YW1Vn zmn7j?v~^HEB1G}MLT&^XbJaEGxMclCV6+>`Rko-7^vBm7dqVTMm)U~45iaPrioD1B z!!$MLDl^7+By?pGcdV;rfUIp|V(e+Uy4T-2sl{5MtJ{v_sLL?wDI+XFr zzPKGWNkI1{WSDGN6>Ug2x%hDZaRD#pL@|!!!3Hy1yY#!|FydyLdSv)AMYz=QKv z%5Zqg)?+qSlU!bjTtD-@6XlZhhjlsck&q0C#N!;nl>o_Gw^{`x{f~eei^_Ce!Ohn^sbK3-r%suVColX9qVOd4F`Mv3_LllV!EF zOo*Pqc`tq0D!DLpbKEDM7-eDd8JbfP6P{|H)4;q?Okr|;lm*4?snu1!WwpbzU+nl! z#FFlG?7S9~`*il=Q>+#8eS9&wlHsmbxVIw!X3SrxS?TEH6LuO)_(gbN`NlJ=0&OW! zCf22g!ZPz4^MrX*4Z%T0u36dXZdCGhi>V*vv-cHQC8RQ01pHpGQTdPuO4qxd5M{z9 zUQ8lX>e4JJd`b888GGoNj`ug~njf1P*Y$Fnc_#~$r{80|iXkp*9{I5ze@{5DyR|V} z3^w3M;Jb#;l9WpnnB;(KUDGP9h)uH#w(bYsnpvN2{;6($IVFw=3zrRKK~B~G0DjsBo2-` zX*MDcbah`eW_w673lXv%nN2&_FpWQ|Gkb&;Thh&~L}r`1y*P=iy6gMFW2;H$**Byn z(`@^`XVOeD%B*dnSVFAky6`vR>aK$9E4MX~NM;!nfFgjQdTG{|RQeg2m|f>!KR^Ee zOsbNAYwIlab4EYuD?{9p`#5a5RmhU&h*HwJe4ZwGG_!{{St|cuL5dMS+ zP()EoP(-2p_zxQ|g;)MF=YLfmjf%r=Eey6_Wf-wu*w+^;1J}hk&V=g$P;43=KJ-A)aq?ksO8nq zXn9J2W=Kd#6XT?xA2tpfJ<9$aY;lnL-a@jEX1Xw?$qZ$KxuhYZomi(EOenbc)_#%J z{a1yrqNVM)scrgt(}Ro3s(03VtD%p;nqMs>eZp4%-7yOn2jho z)SP>1X=&T{q(l#z3!lN=Pm!zohTZ^+p zRYwlUj!S{EhbhB(=yd1Z$Szah7l5V1SFbBOE=4|5!4xX9y^v)RKbNYx`9-^6^85=>1mBz!cfwWB9v-@B9Ny;Ki8jPy938*=U~)T@dD z=Mc+24emKMfve6(R~jgWRsD5b^*keZ?G>%u6Y+2g`RqxtM`S1=#}H^|MaWF!9tkZ@ zc9?Cw?sdIU=pzkNKD`!8TPet29*B`3|0MmsH$GYMwPjXfOO?K6gIQuQzhA&bY5fr` zWC;Z@-uM@4yx@2*|M68st~5By2U65*xPXyK)JVhifAYs1g2eDazAGx z2?^T*?|HI9ZEKfhkn{%AY#CIZ$b(4ZC*@~aHH$}Ey}MpdUJRwq6=Q$NiTUfsanJOk zS0?EZ$eXAK(Q{0P%ZAqH@M|AWLdy3efY;-(5_7(pljhf?_CMqE~(+-t>>>Rm+j)&g^zfZs;b!O@3aFT z>Gypf^fIY8ui==&yDbXm614Eq<&Bgu0)4ES_F>WS6=#B$PyotPz(8dI{C!m!VSnW; ziTC_nL)i>!%ujrb-~%%b`~LBG&`-$L1mM2~=x-^=AMPbkN3|dDUEeb4_uXAbLtnjG I)gkhK0RAYM7ytkO diff --git a/modules/admin_manual/images/apps/impersonate/picking-a-user-to-impersonate.png b/modules/admin_manual/images/apps/impersonate/picking-a-user-to-impersonate.png deleted file mode 100644 index 156f0618c2aef5eade1e6e7ededc80a9ab3dd440..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 21085 zcmb5V1yCH#+b@a+S%QZpxCIHa5Zv9}ebE4c;1C=FgaBD2IKd&fB}njv;O@cQ-50mB zF41pz^WPF_k}%M)>bvK1Er0So!(w+K_>Gu>jT%zA*7)e$1X7Z?)42mnD0gn$4= z_&*+@H@bf`0rb9;o8HZbDaXD~9pLBwihmm@eL6ARqzzHewMOg|Ia3qVBZ0U($j zHX$f5d5O=8{@r10XvCNc0w_|^mHiUSIN1)d_oi@pNk zHADWEKAiwRcOCWLx=$fQ_tVgH=M;##FKL^DY82u{6u4Q31pG8b#= zkslq(ue#;EpE0l4|3zWv^kE^9==9aMHz#c!08M%@okVaIDmkPm2?B)d#ALq>Sv_g| zVTJ$5Bus_Anr6<@)YD-kBLj zR5WRQ^P~=8!wgy`B_V+|pybr(vO|`JpP^(=n0j*f-JE&wI~Wg_g>?7nUw6lpCav_) zJRAAOY5kBp>T?9WY&tQ|QJw#t27&p^$|odq1eT0+say@rql}oU2JLdY1Z9>vp_B zYvkuv9Er)}W$Gegrm^yxX~W?iLoLgLuSr_NAkTa6M*MP(jrEmuvL%6(pq)V<5q^!O zrX-N$Bgqoo4OT7XRKD;U?z75H*G|YuRKRiuWqIXyi;w>0i{6^^M4M5j{e!m9FsjFVvq>nqEL}#-R2<~O6hE~jX`joL z7!>P*vFe7XYq-x)GFU-sTn-``?X@^b3&64WoEt-tJZHwb1RewRACe;=6pYQVC+ zS1Hi#h6%BjTs(XILzP&SsTsY{GkX+FEYrRXPl|C;J|oP9S3?#Qn7Dr5+A53OLjBdOFyCXWFrL|G2(oBfH1$dW0!|^EB(r^2DR&@5<~=ET_S|qPj$unFoDM zWTYVioocUibq24p+K9}WOBGrPEB($E>1#_{ zA()?mvpd@#cqgxul< zBU`0gg;6Pn>#-1>3nCElju#GU+TsPBZ7>dhVqXwrJ-wjRS*R|< zcj&p)Ig@g4x?L#b2<0Qi-NMX0$o7kfVoSc*Hi@}WwUxMuGyMrKsb9c0s6e3nfSKjo zr5FapyYvcNj9Hvp!6oOdltx~bw&PQY@2!NDw}j5hy<^p@w&`cm$9XZ0?QF zPn<$O=ml)YM#3$Dxjfi5O%A;;l}^`EQ_B-;5~CXF1eAh(-MD@t(Yk2hJpSGdxtaPo zh}Mtbpw#Ty<+<{sYd3@qT)Hw`X{x%v(Z`p7tKc%`^s43k7Ik76P>z*YpXNFz!H{~9 zCSR$E{oHB|RenWFFBGWz0WTIA+czm4l@J#fRgHvRj~rw}nx)njgnlK21+u~eaXsda z8VD*H*yH?)88i4w>?;ZGBe+T(t8u7>)_V|@mw};b$S4B_>QG{Kt#c&z9je|}lg0fO zwfGt|&YV0b`mzup)jsrNl!|`hPvJOv(wBS|WgAL-)PwTsvuIyF`08%H|3kTZ!0tev zKHNJR^}$4lTE4@kbvC@ndd7!321$dzmY<5%<|N0B=<^Bd)`fDRv7Y{_RySSSs`cw8 zHC@n6Nmwdpjm@V?75D^W+MgQ-lkeb!Z6l`M`tmECYigRZjybZMRtA&=txf-GUyqQ21!Dw=Nc+EG7Qy$oT(xsuI)1FM;_d}Ciasggf&p+?G7hUzx1_(iNP zPmYwTW)5OJt%WEjPKo?6b@jD&|M-h*oWX1R0RsRhq$eW0vG?YiD}^hnHP^H z7DqJ)8_7ezqQ7(al(-^ume*2znzzD9JPvw{Fcy%$*AGS8g~&V}G!kRzlS#0R820FwN{4%^B47+#N;i6gLZYFu^2KEz~qo7xD(AX zeZKr+r$vtOO4@Zo8Gb_yF8uL&6bx)sT*|s^djpQ(=ZI6!ORm~=`h;mHrGBLt%KPAi zlFB?`@b;-2L@yvQ@t~_WK&L-te-2*41x{Oh)zpJZZD`)?;1+un>V857e)lId^8TaB z-rL}i((7sSCXm2#5I?J_XzL@eP_FwWir}B@d}rlzBs!cwy2U?FkL#KcLTMlG?u;+0 zRwzHR>!I4M@_qPRNgGS*_v^)LjZcZ#lFK1XXWy4GW18>v{R1Qr?;ko|r%;he^Q>X@)prbPu(2+)bxx}I{kz~J|{J0a{0 z-as89GfRggby~SOxKu+1euugiXj(HJ*7LM_#;8^WN58w&Hd5NQ*n!kN2fMYmB z_%`Y{Ad7b0ey^PR19TJt7WHzyZ28viv(#p`g!{LG^M^!}r6HfB0fVhuNU9(66YN{> z91VoF45c;A9i>wJZ6E_&bu#shQnmcTD2$^ILh=<@HS@mSXfyn)1}62o1nu6b%~Y3( z^;qyi24v8)LhsKor0*9BX$-J^>Fio4FaBE&>u2EO)P{|nF~#BZmEA_?kn@>&#CLlR z;&L3`_sXoT@m}h8q!L$B?$nWFnjeZ87Kv0n-Djpp2!S z9}ZW z;9&eO07ig=;*cf;gFblLPLZB+_&-lHpF5*Tf3VzAn8TN?Ic{mVT)X$IZQ+Hqy2)~u zFR)LuFOR`GA)jZ^@<=0}MNpyN%yW>Squ4dLmJCr#n-%ElX7t`N`Q7Bkrj;!UXm2;% zeet9|B>nWs0Ud7)BG^Vc_NQ`|36D-iyC3@Ahg!nhxgx!N8eK*X#76PRO8TBgDUVz~ zR_8op%Y7`CuHa(njpK!O88iKw6;I>RuFqQdQsh!4|Hu3T;$LW2FKZ~0a^0p#Io%A< zQfD?$q;20y&hb|~9!o?ZN_ej{#nZ`qbYLlE(RE~|fsdz&O{TkMj63vRHZU3v z2UyTutS21@92Co&dg+eu*+KEgx}gM1CenWzbi%N+)CsrJRlS#d1u=pI6CC)_T8eXhQ zN|w{=ymlw%P6#e(&BVS2gTD4|u*>)7uG!KH_Q}s-Xj41-?!~U?0%S=%1c`QK>Th2= zl5A`8c&0~M^UO*Va@*yXS7n_p`hUqz{pHFQidWcRhMhS!qnDfN83 z=oG9;XlRLCCKTkT6ONsGJHJ&RF|UwM9#8tc(`Iw0yl$q)_P*`CIAdJhsX_z$=KFja z78LQyN*`BPP8FSeuSRz*>E2Cz8qNq{+n#Y|p0l{g;X-Cd+Nm-gA5Wd{h3Wu$ug&zL zA3b0Mz~9<(;*{d8bA-~c8F}ww0IQw!HEb*Xaz~kVfqC+y=%-DEUALT>X4xFBT}-ux z&e+oH+a8jg`o<@0xEIhg`@c$;Z)< zUs%XfOyHDXQ#(*lLw`%%$K-LD$eY$}-QwPW{$NCimad%`g@6fyXypLk{E)QynN-z= zIBa~9S%)*R)WZ5yU0*~yC#A6ri0xGoxWE#Y+>F~ODl@*d`JWooF5wvB3|nO`B(+afbhJr(P5`F2&1NyC zoTNxqVcL4@U#BjJ66x7JU-8Jmf*i|V3P)c$;YL9c2zJi-Z} zwLo7fbo6ptG(UW=QP^tU3h&0-XyL-&Ml1gIdNL=%nO}__H#84>F@fd7C%ptFS@AzE zyI1d{!eoQd{LnEFwSha*y%a8jeQCd!B~DQ4UEj6REjI(k*r`K`FCe3ZRUyibI0m}sXL}|Q`@CYVQL+V!4sj`@OfeVrsGs#)S5sD zO4o0jjZbVLbxG<&Dy>Npn7JK?((F)1Ys)NJUAtx={O!zq9)LHp7Wn`7IvESJes{HXj zYFl@wb46(G^`g7cR$(=L2YTAyDNlOE7IOmy%z6Dt7i zYqENFP*|V&5jFvB&g##@$-XA13@=Wso5nogAt1rt6Kw>59{c<(b{w!m_jp1@VPJR` zBxL=e6A_X8Mz#EyMHeyq*3R}bAQNcHbt27yv45vS?Jd8Ujc^Q z@B+&NOM(6@Iu*!tYWCPgFSfrSyg_f`PDAxWo@`0oFypLU*giAHzk7wfY823#P7x_W z0rE!7{&nugRkcZQ-K@sXABEYQJ=Dis9L%G1Q!D!i^=+;Xb#Hs{8!geg%}_W_aThm2 zxc;dZ@4sl#b8f=X5q$f7`KMUuORf>c)}dRcLO+QP6w$!CD5{O&`Vdh}6|(N@-@gO; zEHOSjf9d{->N*1F)zq5};@=_DIaho>zC8~k7#1zJ&)EkbXBsWYKAJKjw0pR!#ML2~ zeL!TRYBSL*NIL(sDkQLxa1%@IiugJOQm?GM*;^Tt}Uu%Hv6w?29dCJfBG z4!3{g<`i8R{w}-Zh=}kpK4=#eQ4K0~4mUDJ_>r=J2;T5gFx;Ye+GPQGrI$?YWq(eO zpLr`@DxU93R*zuXYkd8H0sjx64no*II>KSY{tf@l?{rRkCZkB4IKIl1t5ieEQ?EpT z2ZJI2dRV!X0j$^v_l9w110i6y^UP!omhw0(0V#Mhdbr+*V(i3Ntn~1GnlY4^6vvgJ z2a8Am_bt}niy(k|CeW~mYE|Rv*e7LXj_u{jF z^9-@EA^%lS(Gv)7F+k4XYg-5j;lH&iYy!bbErz+-f^_}W_Ui}rVR{VN8znNl|Gv&xP@>cy8FWU}%CO>G$Sd>_FqbWmb`n=uHO z+uIoBd)M*vNyv$uBRl@RV~NC7NSKKTMKcAT>^Mym1VpZqg^UQJ!9}O*($da*?0tn( z2~PGf?%%4WbK>bCgvzzL0d-|VnfS>TW%sE4geCT>xDjQ#&lGd{aFXiyXMInP)>?mn z;vQ@_vc;hh;;D)jCoM+jUFCz1A{ig_Uan>k8hA)M7Dc_#AG2r9;~UOsqWO(92G|a< zpDVlR&p@YKcyOeXX_3(Z)}Mo89YHaP-D`HIi?ctK%nN(AqMVA>m`w~SJ=i}SjA*xy z1X>G8(tJn1NwF+wKXl@$(;heOGA;<+urkTyfEIy2OdqJ!FH)*F)2?Ml3Cz5!6)fHZ zUB1l%qiD-MxRSC6lvJ4%o?bXNt&A^JEOQROZ`v!^`|dqD;dvZ*UVlU+)ZR!jbXzzH zu8A6FnG<=pkFmpF!XO}v6q?!a*xA+&Ds6$BnTTkRBYi6ej+6YE(d3XRT6^GG+_#%V z^K1aAuIX{m`cfn;$^Fu=J+_Y;_;?uI!aviY0XyY}GDaB$QBaN#jrbj#Y&21>`|Mfm z?A5bnZ_US^OY-i76yD0S1QxQ~OqTT*p&$`O!Ml0&(g-ocV0H%7f>#@ec+O%>a=Gih z^7@*hGkOnm%-)CJ;dm|PMz%6{YU69h+29Y>mJfdRnQC{7!pyH6gf#1ROR8QL+N$v{ zf=%8AN}zSI|D6jS^Dbql^vm75{y>(3poZS#B&CaGvAJ*wJfY(QdI;eLVS-ClWEk z{PQQn7YxRqtQ9G!k(XbiG9h_AAOCRLs@F7)ivwhd%c#BRyoqiB4s+~wHum8%M0B7z zA#8U_j6%wF9r9kI;?z({<8nl;%hm2U>!4w~2pa`hCki%Q2rd1J8j%ycx@#!-c=bixpZFDgsFo5nM{jr#^MMoFqH@E z0|d6+xp7FY`FvMMELecyt>snRdbh^fDui>FzgY{^{@~|u_`RguJ?L&HR#!k-Qc!u9 z-8sOB?L~z!-8_vxNarUwnG|sZg8CiUS7YaWl3A0K`uRi3pTK42HmB>-b?o>KyY6|p zE_OBR+HcNRp{pS%nyl0n3gTK5B~0(=D*m)iL=B8VZa4+2Sk-wP=H-}6@$xIuPAY)( z?o>S#a-d?q&@V(7-ewBu&t4aj=AnB#kAIFyO%?nR`l05+2ZiJCoFv$9&>{%kE!W$I zp=I#P5|Qk>iK+oK%h?vAR`lqwe+h>=XeCMf6@wc>-fU`8B{2{!X{fCwze)=5#& zVf`_)VQ#3Nsia^wa0D`B{20j{%f%m<}Rv_7#|@f1ci}|C-h}sRBkh#71g3#*N*ggj4ms|``3(~LFYk*TpaL-BD z8yzCb1fN_?HJmoy=#GL_z2BoEbf5+%*xGUSj&JJ&7bfcA`HnJ@d*Qn!{_^C zc;|W6Y5wfLP{9cXyGEs&Cepw2JOYeH+nDaKoMDs|4toB<6A%m<+5_Hq#Op+V!v29S zPvz{B>{j!N5@z#tiHX%F{Bh<66h#3FIV8>D(4+4;9y(4Lq zehtTCPk`hJf&p;0;enox{y{GY+tL7p9V@3t4+6?h2io0+4oD-1e6d%$kz`l?00e|w zLM;&S$6eH7AOgb2A-umx2>}jY;6vCz;NLhIfdY0@t>2q#73R(^sznq4Wh3;c?~?Sw z{r*d>Oo5=r0wVU$c-QPUkpgiB8RA{)A>DH(+=YdDl zPb{+%qKHn$`HS_$Kn_|B(^LAwG&xu}`~;T|<#WOn9>-&mn8fCI|J7pvDbu$y8=-#9 zDR`})$jau*=jPaniFgxnz?;LREAWZ(g}z428#)K{?de)CpLzx66^}&4+86a(Envnk z=G^0xlk|U|>KHaGsDV9p4|RObQDJV*yHb_C6nK^w(4l?W-_8+A40MmS7Zo5je3Vaw zIT)PN^zP)5i)8v#(%r+_j!NTotb@RX#kSmW#TD>(cs9q;?>cc+oTCxmQyT9F?Hh|F zp860@MzRK|OBO^bYwA0;^?kX=X-iH6n$^{*gl=a5YY|Zm&S4C`gA_htJ3JY#L0R<{ z9%5$oYM~Y>??La7r~w_&4ylm?&%=?*_lfDWt+_T~DUC$4WS1NdXg7MbE zPd;O)e5WT7_E+KI6+GYR#LwB9%zY+}HI&=MG{njpN#_=Q&t1^rLQohsFgRyXo zC%YJ(>x%5`-s@&K(vh5m3f6hY%wn*YzxJV%H+ZdloK&(n{p)&3k;A;U1>0Mz+pDgF z+>fz5c9k&TO2zm72}F%9rI30J&N8|6ojGz=Yf2vM8_|?yKl=`Q@D7*4$BkHUV(=3M ze#Mb{HdGwPo4O7w9CVliThK9vIkn=yb9Z1v18l5x1b`h}H~R8UklXRl!v9Pq$q&Hc zyKeF$V4PB63-+Pc7m1D|D(_A+cDFOxJ8)O*qzf9f?b&`@vY@HOe6^k=Z(?xmj;-_1 zURIS0)G7}Pc>jqf8@O^Wic90Ll_6dQyeNK+x>jtf;RH`r$^8$VSg=$fxrV%1eiDiG zhVqDmZGUMp0A*WR&3%8~vq0MV;N~2*WbR{KP~!P(BjiSma;qmVdg1Jkv;R*IKAiF@ z_LtHR~`i;tGx95z3&FLy3aT)U_<*S=>4z?WoA0Sv5ift|5*!akMZlik&v zu%8j44$%&Y%^7>ET$!@u5eqae)s~>Lv#da0FTQdnvS^PeCqb#VqqPpkV4=b-mYBq( z5(3erjgNh8aJuvLfl-)wM-55TO<%D5JI~`}Uj2tPsQZ{zTzbYKilc#`S8@-n{@5Br zK5?U7EAnCj=(15a z@DAYXjEo2s*tINJI4mr0nNJGzc3!QYtKw}w(7A1ZzECwhe7G*h#HP!~U`Ri`*+?vW(U5;G$_F(Y{8eWq9s%=9}nyeQW&1WsSIv}|O?Xkep<%^fg-|0-9@pxqU@nvdhu1A<8ZnsnL zVY^SVgmsv&hs403oC}S^PEr{4xCqEhz1@BtURYeiI zm-qMg5KT}Qj(_MwB%4hd-lY97IVJTUs(#pe=EZ?Wt}bBq^{G6uPiqo2?-h{wQmdy% z)qa99>HT;Jw?yl$!uG07HejnPc4}LJ`q3%LH@M{EjzwXwSFe@C;b>=8A6c0bk1T7k zV#T+Zg+M}Xn!CuU0+Y!%N}$(@6jgdW2f{8jrN`2hpJ;rxEWJe>+S{(5A=Y;db-!>WDX!NPb6M&O66iP`*lDHF~n%)WS*u zid*24`}p(T&pS(pSzKI671Z=LQPlWUVN0qx*nbeD2hAd*KhZ3$=HK&ft@_9i`q_(3 z1Ih=3zVN+HHjx-)Fo~zziB4R2@C38T|8_fXYl7T1ZEF)=Ze}{N9q+#FY%z8(m7G!h zQId76-kYm+5@)j+?nEQ2WF0Y1;|0f6vUB4auds`{PpNK|ld}8iw>o(>^Y#4$28EZm z^#=pq17sDoIMB)B%)d82dI?XMY{=! zT>$H$I%LAT{q=%MUF}BgJkPy!XQ*Brv??m+&ocZy(94dzV7jPu|GbO(m_^S$GU^%V zGU>nym}ke{+^aTl_Nf!%Vo9zTie_r_j@fGsmT{Zn}{7qM#a z(Xpk$6JciRN|_&r!!j7`+4!mv=qsM zRs-}ZG5eM&2TOZ>Zh_24(ISyoVj%&C>%n^0YrnXNL(EEO`ydo6a(_7AvzX<_sa{V* zwhv^&4HDG3w=feMinvZ>OR(o+m?@y&ZGa`1cm zoNDl|6-`50)cX4?w8onaX!X#GN;l5`3&r4#gUwcNQ{(muRHRRpRh^L zgXjLV-o(<;HxoiMcyTF@PD~Oi{sQ|0p4H&Z*0lu{dHGrz&pV(zoV2e+0tto8{y={D zlB|=Fdbo)8uRDJol5Z7ORh9+$%P!Ce#2k0~gsKF;4Rk_ zaVkzPj=CGK;yzpQ?PUkB(mDl9X4E;xWb_t9B3k16qZ~-z&AsR7I%Dh4|H{DsZ7&bg zvvcCHK%)xN%rMo_54st~xs(?lofrv;Fx2=4%sAu8<^5;}#F}Cv#sS{Hy9G&tsL>)P z=PiyRR6mQ)n=V2S%p$hy$v8R-hdX@8)4F_~9}`1T!i@vho!N0(#v;yxM5Fs+JdlMD zWws`zpn7yB?__G%u1az8J&voeTAp*CMpr&8nfRI9s4QNa(lyj}yPm|bu<_?&o+iAA zed)c+A_VQN{00mU|DFss9+$ z5JHl60J22mYJZ{X_**C?fQ@ksu1PHMBM}9HiLE+lD5f8a1mh_@h2HVJlRD*-YXRd% zEshsW0BqF|ezN~VhVwHb#TXYx7lI3Yq?4%Et*-2;MQpY_T3t!IA%| zS|CZ1TN3l`{Qp)hy7W~3IxA1If|7ApRycEhJeEQh7a^+{T-JFK3Q$M5>{VcGLUw!@ zD1Q9P71g>f5X?+g-t7(M%>lP7z&VSb$f<3|&x$u|QQzgKy zBm{u!lXdd+(F>e^|E2Z_Ft{+{###5+7>?6+QM|^=i)iCPCVy8VgYDb$Di8iaO)(G) zZb(hQwG6Q>bhz}fjrt_VAi&Hw|A`YIS$E?Uec+M44ARLcXs(ALmL*>7T|5hdp4d|jCxG&}1j2T%5-3Fk;}sAh^}lHs z+nxVIy7({62S7l*bgU%}De5QwpX$(Z18QTZGFxWTtoZ+1y1+o#lmcmKmz9=Q8Sk7+bzVzb^4Qr{sDF*AkKm7; zML^9&Hnt4X)q&AtrxD&iOM(IdWDB-4?ytNMB@x(Dy|Wp=Oeh)7r9pR}+Fh}G2m3sx zx;u=v6^8^>BW;79Ezr=#pX;imXW?7YV^CSg1J~y>q1roV_#DU2jB{EBQx( zxOh?^0Mc_8`ho;)D?zWGT0mOE&mo|nkav61E3YiSf44{6JP$GzQVW6 zH^P=&hS6wA@}3u3C&~5qPh_o(hp*^_9OHD=a@(sprscSymmLT2M{4?JJd-}bA{mkz zFHe{HF^enAQ%t^;j03-)EEnlJ3)*T7C^6@@v|eO$^*u>T+Tc_e9KQ}&U)f^XmHCpN zyda#sQXu037YB{H)`>6XXx#^WX{vIehHHp4S;dIsYqpw^6xeEiBKU2)aIr}Y=mfso z8}Nu;lKo0Mrc!FZ_C2iD@nKN;UcTPSJ#%~aPMFff!u}3r-a5n3-YZ{ZBnkc`!of<` z4G@CH8(Qec zE9$OlfGCHQQB3&h{_eaHHc?+YTx7{_EF-i~UNj_4G#2b2UwPfB+gxpVlttAhTl<*m zd8#3AU>t7+m;JvQj+jE~;Jr)W&6~=e^VKT*e!boPGsie{AtMb=w%v%So{HE^l8Xj{ zGk15Vk-fXTc^@VT-7n1e*_a(kI{v~L7kfEVi6rHHt$GYSkMSlYl;9Tb3xaD2A6{~A zJQ#PcO6bDMd#92%vCu{poc_UP5esik=>E?+IENQaTb1dOBzLbIcks}fGCAxQgKj%f zESY~>E+F-2WT4PZ+&asMMD@^7MGrjs9%OA^k3&{jyBpn`!cdthVkbHn8QT{T7opWV!V%2&r)>F}1DIyLUa}wDc3Tfgd8iRPbiIlL`AI|V+5^i_Gqyn*M zbI+q7eC@RM1$X28YQD}kdhKIIK6irzOPe~D@^CTZI^$d}5q8zfc9^|P`cm9u_=Ub3 zT9Z!rJ$y#<{BpnAHr`SYUS2%S0SV4JMpWkfp;_k;i+;`%uAG}d8 zfUOq)7_!PL7T@sn@yp{VzoIc(D)Jz1R|(*I8ySJ)6|sUDir>ox^&EG(tdSs-F>8Z^w`LZ-B5f{Y1Cxg;O@ndWDQprn9Y9*91D;Rpep0~Le>-4 zyv0Q!ao=e9$L!yY!p-`&_Xcqa&-~J1<`h2SKjz>{2r(4lue6c0yCJZ~ZQkS?yRM1B zZbCs6Ax=Im*F#ZP63bb1v}S-^#*#EC<(Ixg^)}NLN^I)_uKf1Z$Bm=#jVyE8AR+ml z#(OJE4=U+M^nkVVoupq_km#+15|X9slDOJ=O|_?;h+q2cZ7=cm z$@MB8@6pC!w<3A7P2#0dYx|vy?~OM{(w5}3B9F$}WMXr5W;E0(?v+dh^j+eRHJgAe zeiBaR;ekbw2b$Hp5647vfj&v{9pv=|!5q-5*5X@NH=d34eF3jm;o#%JLuO{jt-D*^ z$M=SdUXzfk!O=qOllBF?Gy6ZKz{ht!*S^HF7|>D@rero znzj1r9Bxs)pL>8ZyWID4pOA2vh{&JD?Q|wNev<&z`DwPzkBzFmV`Jxf4ltK8QPHNwGlBB&!>o51WPNLBhsQO4NE|eduI+AX*8W&9kYSekQS#B1o+9&N zdQCIZ;V@g7Qyxa6yhXs*xMwD?9@phRD|dFCjPaQ)jgxeXlb2HIoEdn#?x!0u0WtNA zh~nWtdFbs`tr%l+?Z)Ik0=RBzUh-B~t#)9Lpk+Nng0+q^QR>bZE;(puKdA}jE&Z^=yV)vs zCs_SlQR*WtwBN)Td^Nqu^$mQSzqYfVnF2uzB*I@Tw{uw zAEF{Kt#ZAl5@wQh`t7gedf;r;_mO10xP~=ul??s~T*jK4CN0bme5H5zsJvIJq$eSJ za&gpgM#+4pA@?Zd?-ugze{*Y*$<521>iWRzlMik)!vWudcTt~%>UVKlwId@#?QUfpUCfNxuAknB!i;oRwuK2BpFLitnP^G~z=DLS$S^~s zkqEI}r?KA3YAm61;yTi;!GfOg7?|%fI;-W5YY#-{c$z$@PVIGmm_pk#|5lIMIH@co zLatQ=;t@sy?cwxbfEmkL0>Q^Pm1#VYKF5Qt*G@Pg7*K<+B0Mb0vP&Ou0n>C{jnN@)p?)bG&FC ziy&$_FwMGg!eLEPl7@ubBv=V$CmwBo2$yw3+D4^E&D1dBVilO`Jew3jgwwF1?++b^ zZ+5xmkohtReW?X8#9sq#*~eSHrrWj%k*gJv;XfI=$udQ%u{jnQw%kvy^incO-p-n- z?Rn7ORcLTZ2&Xk4!MUDD5tie||E#zBTTl#HU(*%*59xb?)v+yAd@>HiOcR~@2N z{g)OXAR{BQV|}%S$|ZBBp#(Lju`IrO;!sNr5{>_^Xv_MX{fPsgUb&`^djhUB~i5>Q?nMF=}vx-@E_k3At1;x6@n4qUbGgR{2`>% z!gB(@n|GTeG3F;=xLV;w1ovRf{ScOuJUiJu-5yc8Xl&9D~_K zd(K>$OY>GPH-%zjOmk>@2{cP>E#;oqR1Dh=TAX224U*yX585I-0uTeSI2M4{52sqS|!6A1Kl; ze>uO%u9u&J;_|fCR&vE+X$c-Os4a>Ek#wGu!TOtCgle= z2^p7E&Py{^k|^o+>ekeV#&yys6Ra)g`L`1IssK&I_CK6RP{!t0d!dJfd(ubQ2l&p0 zF@_(dOM$H)i=W}Q6KYGsKSvQ;e&#a}>AE-mIl$p25IkVo0QsEFj#FbZLXj4X!H#r_ z*!x?byBK(BDK7)A`tXI3d>9n7DrB@eInhy}6$|czCehqIb5Lp&>%`g2v@CP2sI+Mw z3L`$>e>`P$ImN5u@_bJu0YqsM5DZ<4f=Y{^ zpunO6L1HLIKtPB{QHo;dO{xe|gn)nn5_*YT5h6+nm_VdNYTzE+b;sGcJA3cHCz&(f zmow+f^S;05&7fqrn>*vP`jU7T#iR4^*8KxHA0sDx&A&@{lv}3I#=SbZnV~T4&8PGm z@Vr~46TzLwr(&PzWdI$XcK+|Ej9IY2{zuiXosK?jbbSD|ys=ekj+|@LW-uV^sR^r{09E)@i@2))SLmWZ>1R zV?R*+fEH0yBrPqCb%Me^R+pR~<|cyB-|bljkn_EVCv5p9mFA%r@Le2DQccNHQ)@Ml z61?0o(eS_zx8Qf>X5oFqGCE=bQI*Z5TzkakwRM#>Hr5}`o@Ksjy@?_*w|rtmAiTGS zh?ezZHqMwj=pJSZqBdH5(h(IhbSBUXnnPX38jlK=>n({AFesx7cDK;8+*NlwK0wsQ zVM~)ZwCTGyhcS@ub+;ST{xa^m^O?ETDS5fz&LvG8p*U z?6A#gy}}Myze_zbj5lp($-(r z@7fx{?>*a@CX4@;tSe(Wa2`(G9GScdHL|eOzg74AWZIlJQJOCL{5h0YBr1ZEgfUBo z+I9FX1Vj(2IRHJ0N!+oNPOnH=LtsYk5db~XvU<~BBbxUIu9Udll59!8baZ0*dvs>8 z+X30_X*Yp(^r%stVy#%2WZR3Q>lZj?33iup-THRnq=oP6W>=jS7PzlvQe5}zus%OI zp$3~&jZ_jflUZ8+l0{C|7%{ML*n=fLL$`7W3*s^llOO1o@Y#4(&!lM#aKkpcv2$&$S_dK%W`t+^vC?DEvrU2( zO;r5*tW|m2D5w?rqCqSc(tkzAhoKf-E4|_$-;MwbL!8SHGWf+-51oNTN;u21$Rxw? zeME1O%l7D?M?I`GO!ZMlFb552Sh$`nHI>b2YLd7LeO4ZOWlK(H7b-%%LrwQ{OkJAv zo0TA^HLUz#g^fhbNKr{sfq99wc#p;ZQ2#s}#Qp$(Ue!ij8e_!TnxJHakLQ+fsAp<+ zp6S}hW1S>bGd?pbuwk-W{OChDt2>4zJ+4C!Y8y}4IA9F%CYr&9VTiXXen=#Bt*__Z zls+R>a-HK7?g#eszmAe}pD_ybl`&qo`q-(ZDYgBqlYiQ+4AGabl0e+)O#NEasPN9I zYn@&qf@MwDbKGn6(o@Vw#0IfD1-WfEBaWrqO2?z<;*x!d^?O{W}A-bsyZ6vCn zx>>i;#86aJP|&4%pV)X8yPO?b1g@W(b4u16r{nst*mA4Nz+J79YUANAqB|=>16Vml z1&IYA!iu>5z8oq#qmt|=1KyUi))D3KW)Z#wA3BKeX7De9-Gp=A{_ z>^TuDy=_$vH(A{Rm2xY~nFoU%Ptoi0!GT#}7tDwT>E19O%Rvw}F$ReJuJGD6@h~@>-v+0i46^GA0>7IRk z^F&_k10K}vhOK@&){P=>Y$m=ryZ&3CO~XRZfj|vT-^OpA<_~KuhoUUvF%1R_uW31M zG_9aQWj>#H3BfduPz3DT5NmWVx>X@1Bj-TI{3DI6U`l0GvEo}Yc7|%LEa3fR6V0|9 zw#pKG940ZIp`|7)eu&9wyhl20-NuD|!x#_lHZs5Df<5j^Mq^@1 z+o0 z{AIJ!;8^Nf*wp4AKyW{>>t*iUP(&^#fOAJdxoOR;Pq?%wrR0uKMh(E+X7(~;REscT*ja%RYp2_={bboy_L)m=8IK1zrq)KU}4^X{hlN z(eKTwXrEyeU1t$vre^S0)K6TL1p(H@>6ex9ff37DAVPg*zO0Zm-Zp31FV zPW%^!$NVdJy|p@>e?p<2f7htNVAa7(qTjk40DdRUhMuV~IR^0u3|!DXhUl(Uvr1E} z@aR6Z@CY9DBvs%lP<|{+{aaQ0Pi+7FQW#Ab$iNz&-+hq+4FCMlWdoZ-q!jE66;$Ox znMGdi?s;UdBzOBkbyZ+zJH-g;g^K5CF0hw%mm0_)g>pRbBqhaI3J_C)x{P;*u>TEQ zof`EyKaTSmjE3QN7;CxV$E@KYz^m zXZ`|w>f-yA@FWkrBwTK{}Fso~y{YXYF3_zgS^_(&*X)u|N- zTt>9nRae*U9VxWK4{J$OEdhHIK{Z9zz zg2b)D6oNFMP{v%MmClYlJVQ9U^3dO(OUi?BHvMD}OL`)EUfzD7{>2bB+4z;r8(?%M zWd(3}H0L4wk~!Rm^3(Zd;0s6X_52Ggp+;mw|ED`TcvE_YF?a%K^=50Cp4_=Bd~JUG zNpj!%+B+9)@|QAbE_i6w;*&h{k0``qhTRUzqh#pXZ5$`?-w}WR3BgZxFD-yZs*>74 z{i&GMcB6MvkS&*kPMg9(Csn_$r}J zlyXw80s7KC_=|rk0dmUWEkJUS&c|45w8w#@B_-nbKex*X^tDQMn>?X(@w!g>Whugr z^4YY4e-Z?R*TPQaJ7=yq?zox8e8>NAci|kne-Zo6D8m%Z-go zOya1_6(pb()r~qa0e1$1EN5E)M|MuVdge;B7IaUDeY+Q|oUrH}(op8fSB5y$m5J&l z-3d8Hk0z^G-pbhf#$RWxno5u&Z-DU?oL2;G~BP72qVFJO8lsb`1X zwN41hZVsS|W2ZtDV`x$5d(anYNy#I4M~2LtPn57uJ&KXcf2lrTuA4^K=Dltk5QZ+_ St^f`wkSW~qOqqd8*na>vbG;G( diff --git a/modules/admin_manual/images/enterprise/external_storage/sharepoint/sharepoint-1.png b/modules/admin_manual/images/enterprise/external_storage/sharepoint/sharepoint-1.png deleted file mode 100644 index 9a67f7879e01f120e6a00b23c150b0dace4d98ca..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 23399 zcmb5VV|XV`&^MY5Hrm+U*tR#eZQFLTv2EM7ZQI5_ww*WkeLwGW&WH2m%v>|o-P5S4 zYkI1x>(`;O(jqWWm{34KKrmvWg7QE>z$D-4KnURP`%Zg->o1Yz#WC+6m8TtnwsHI#2VnI7+p+*d947?C#Au>`yJJ!i%lC_YmAaX*|TV|Urt-p=- zM2FjU`p269oJn@Q!^MM!#f8^2N$-#E!GM6?Mg9P{{hI=kh5eW2VE>o>!~QS*YyV&N zAKv~s#{O%U0P`G=3TU{{ePY6JVOqafu5OR1KmFUfPd z%O4yr?t;_SPm87Ec9OPx-eEsObtKuR`2f%d&SEJ7cfQf}QS2{bH2EHE@&%|+CWvS) zfxCRstM+uwa}wPx|2qCHW5Q_H>J8fW&FS@5g#8vt7=u`1$KWSs$Dj2V?4$OtbNu$aRYkM+h^v6eG?r#Iv zSDnR|=)#rGpqet~fJCRs_o4nad1U#PsTPR~)(yra-^E&+;yT|zNRjYtc~(ngX=t>F^)^jj@cS7s|K^i1U3jbx2uzx=SfPjT8yWT+$}P5 zxdp|3&-_&Le@9XeS)YY{|rIcvW1P%-j?$xtijz3%tqCh;JaJil09zku~ z@$6PkjC%Bz{#HBny^FT`j<|`B2?WdN*pF*IHOJv{EH9(2jn&{3{pNK&E?DgszxPgP zU9p2=2vdkK39!U3E+f1#SDoeT$WAGz9O)hGm29$MJ<%37wvH?#*34)ZUK|-yZ|YaV zubPI>(z%GCm)3Sqr}W7(e{0_6bnbo9CUP6M&Ef=cx&-UJ#vA}-;5ESWh>MGRpPrL* zkmN7dBrA-JG;U=Cswk1IAUAJ+)?Ft-#lS!k4Csp{pe1E6c zobs@j4!KP+1vZ{9L#_)8Uay3HyRyEr78F~A<0dgek%Z!3Cg(qnFp!#IcDFkEChs@x#+3^ zl~+Qmj`wxU;wPZRW;k00>;1eUmG z~|&jko(=vsW+e-8!#@j8atQ z$daCh(a6o;fnWMZvM=m9VA%uMk<-Vug&vOD+p%v`k0%dBwW1?<{3sM#TnBS5=aeqe zUmw#}Um)qm*CyyhX3dSeK54KtVu-L1^Xh7=_AD8I~rxY|!;mR!br; zt_>9x7Zq)Fda%A&bG%eJGwDaN3Ug-gI3+~}rluyI)g|h{WhDvEgGkngJR*3Cb@!bH zf*x$W*-_}9*0GOL6vh3fdFmP+WW=saDP4+`@=C>bVZUsdbSVa_$qdUTZHu?l>Hs2V z{P=9F+jXioD`Gq{cBMabJPvJ%tW=P81luc#Kowmht>n($FI4*>())Xi-qKTQ$DVoU zbuhn5uR9{*>1Xq~lGFyXmXO{L9&c}L4)sfdiY4}njoyF+2eEs4_m{un_=k*gux`tN zb?{gBFG%TrTMtc>54*}MBraU5JJ`LrJD3zle|^_RJcsb9kbW6 zN@r;A+W5mB38`G0c=ow++TMnRYdUk%k0Nz6$*QTMsz7eph1Hh~u!OqNS8noGw@3wW513>NQhG^m6gr)h-J|LdB zT9sEiyE65QSf@{L|51;Bzi`LY!Z@eTgJeUm(!xZLI@ntf#!g}k7Cr=b5HonAru6(r%GBWi>}VE@8Vpskaw^|T(Qi4wi<)4j+^d;{;pYqH$l+q!sXR)(>Oao z4GZduVD92)Z^2&_Ae}#A6)R!nI8>E7PQUc4$k(rm5`QPm;r>sgbneXC4yU#Lxpdm!FvH*!Id@~fO_0Z&>BBun-h zH9YJPx!!TttsJ}$fU&cjlJToYwac`}RXcL2ie4Pf(hSaFq7(R5?B1+nFLWL!+KL{M&YAaRD zDSa7+8!ToClVg%XC(G{E_yt)SaK5mTmlJR8SyHOJ_xnlwOUKtz%3}-9ChG2s)_PGk z4LWyzSHF1fQW~mX5RsY5@$$oKYX~*G85V@yPA)$$eq54S**Qd5AiYzEy)OAHD^#9D z$&Qni!#8epDDd`SqQf!#=O;^`*IMGlg3buRd#J(Q(MEJb8xWi>>1GpFHorGe%r_8`3{`NkmP-0f%UV`=Ip?+ z%BCr+B%Bet$COs;wnGTcxtoOlO^&B2V8KNu^AMO64-XEGwYVTj0871RucSE@3Xhex zJEo@W=7Mw@cPo@!psgD~(9AfCIA6>%JdWte)zKG6VXX%yce&+eQ~Sfrr^ErFtRY7j z_n?{T5W91y{tz}&QSf*?oZumuhG1hf+TnTf6AyDvf{@(*75jF zJ7zfm@AmsN*&TfPj+Pv+tMKgBmR_ON1S$n&UXq!xH! zZD8NkWnp`4d}U@?8)@w{_jUmQK)kK1JSY#{KgR2Smg_%tzBB*y{4W9e|6}(4Z`+J7 zUi5MrZ0&a?hj)hcjjgBZ&ezuF)|dTiwd6!rt=5xNClCc458aNY5)148&X=a9tZh3% z_j1Z2pYeBai?QvGI~^!@C9Rn+ym#}b^`W>&nRHSZ#bhh=sld>!w&eORPu_&ix9Y4k zN?J^fq_1>}hI{K4@B9Ah~(8X`T;WjSWTp$vRoGn{AS$ zDXS}PLd4H*?6g{jP2#R94pOQGJ1XzCYk!ks6m8`UWPDol!`$|bWdgJ}Y-XDHe4R>5 z(x$(x<5(@6b_IJUY)VF~YvxR(5jV#sBR_-!acrHFaR^9fe~Pc#uri{R*$_W`wkMX~ z(08vwj7wJlC8~cEMNe?j;fj%F{r;GZ+UTw9HiT^C)Il{iIE-0nQT~BP(s(c-8vke` z-O#I#BPIrA5u_T?u9Cp1u)Hp2V7wmhXmf@`Sk&HV()P2W13xGe==Ou1qIGxV}! z;{LEz1Ge0^;dgsRt<;vA%3j8c{rrYKb-~ID=pb?70f1;A;AMq*&#ncQgrVy4OMfag z^Vp5~Ej-P#uFQUCnXK~Wyct{|UHMaM?4-$1_eq0S?@mcs_4JI{*WXvWsWs#_KsS0Z z7z_z^4Glt2+!dv(zOJt0zP?snOHEx}6W`O-=mnZjIQ{fimd5-`E^m)TdU5dqjdQc0 zHCrF1#K*bX$Eh*{(AczNoTe0EQ{CAKx@dNC1+#A8omT8xoHr#c-eg&CP7p~_u`oAx zJI62!LP^O>X+)PPM+MP20UPBlGBeURj{ZY^9EN7H7#HW`?0KldyYN#dDLF}*{0s+LZ0}Uv+<~ZFh$hc`+^FPnWwH9G_R-Tu@y{T3Ez!PC_SINY z1BABbOWNJ@kmSuRsP6!RGcdf#WRgrxk7S@*%d# zPMcV2^&p8Hl*}8Q1vRw-G&GXdxQHyijdf@i7mb12n>Pg$l1<%=NpIAENIX(P&{S5| zB`Y(sQeXQHS-+=3LS9hdx>Wi6+mkH@TN6?SB)85PX)kS+Nlv~6BBZ>zU;zwu_4>Ldia`z}-+_DCh=j=c!c?E2z|k5| z#jUnE9d>gI;N-+vKu#E>HhjBHf*~WOu>~gqNUZ4$?39QIf<+lqSI^qYATQT)53ZYa zxypMH$@-5;MOIKzVPR=h>(TXcb<3w4cpqW7!;XD{-vJHEsPd7 zqlSZllmeV8PUj?}qH`3>+A}P~0@0C0E?hlvpk-c)GTlFPMZ9HV};3_xfBA>__Yq9<`$QwzcU{0M(xD zEKlnNsewUqc(198VBOBgd2B1%^CJtlWx2kbc|XwH&tdK-sVZO+0q63=2vJR7k6>swrip>b^k2FYb z5L|R#kGFF}Gsl=%T;*9Br(%gYygk)sC)i@Pwil<0AMCnxp2+kn4~o-}%)J}U$B^H1Q}EIh+R$*_oZ2dYm4OFrP0dX$97#a+h7i;H1|g|} zD1ORGiIy9LO5IuPqL2|1Egmf^xRy7$$ViE%Wh6>2Cs~=n31avNL zET>BTGL~;o$65Lhzh9*9BD0kv!ON+R^K}EEOfuFbciy?ch%5lE(alY85Hy8Gw6zDy znCgwIeZq;|InCj=vcBcyef@m`&4}nFRgK8u4Fb8JpL-bJo}HLkiTx&D1j9Ok(A<$o zDlqbJL+G*I@&4!MU`?8s3s-G=LaL0a+yjX(QRj`K9_J(t89@)eURIRGsj^8yQGpRc zGDDd!>2X0a1>*;MRQQp!t;Hsv!Jn*RZ?@_astHlA*@_==#vYK)uzKX$sK!#!P=>EU z5OY_Y{nWX7IfJ78F*6@F3ew#dZkHZsyTynGxI(VN54YI~1QB=l+X;w+QMyBJ_Sqh= z(_LJC?^(i%3Tm=5)i=Gy}v4 zFu0v6y2=40_EGh1ZtR$N=`%UGP=R+DbbE?IlpG1h7g;|>S2dihA(=dRarFqVk*B-{ z6!?fx=DoI(rH#EwqGr|19s~&6S4xd`VLo06l$SXklLe^p{g`$MSDfO*2iT8bJDvpa zpe3BDeOFKvr^K(c+!mS|6isr^1xsMCA{sYqR3;YnwGmT{;)N`4r)4z+-XF1;8_M6{xNM-d_z_RXCJMSu!x|52BJd*EOw?WzW%)4_4@-Knl z_Y;6QkpedtiwMY?VQYnib(24%%QsR!-pZSS8pu72kmo>O1S`Y3D~)uv6OLYl!3eb< z&(;?TqV{kqI3YD8K`K)uDV5;YWA@mwh3EnY*vhvP7H)M5qJbqcJ7oLLrpbcF55j`O zco*hx88KKG|M_}5F3DloCniUK4%+eU>QQj7X<1T-DknrD)bQ;MaDDCc>M=_GiPQ}~ zJS)m{;#3;*%I%uL*kNR_Q&(@3y6+DL7O_AP5L`H|?9Pa1Py=15{gkv46+lqew3be; zC*gTL*W*9WVLMXZE0-b-PHTyjx|EgD){rFc%Xk`g)J zvFitEdql`=VMfiy{dWyybp@lztd!2r;EpI3nhbS9I zX!KLDB_fYvnF0v*BswDMne|mYL<$kFECg}2d&7O9(dj;ST%xD=?|avbSSO026{u81 zg>?`a4RE8)&wgLp38lA9eSEts%wnj&3nB6Tf-$f2y~Yq3+U~y>Oos{)EP9_w`S4j| zKJf(}#wf997L9l_Jo!y7KUJhk8w*gstM;}TR4c%&E%C8quE_?_=nP5JuMH!(3R`J% zk`o5OBONsXx2ghbR=vMC95#;lDbXNd7?3a^WlqcUT9IgTrAQU6b*_j0#$2-=brinE zZ;FUJ67?R%Nks7q>X(Pxo%I-Tc@796=FmIK#-v+Y%yo48ydI4((#&DFYb_7S^S--= z0IVi#`DELl(_DjAR|68Xb`|(y)NUNbSW?|PP&PS)52C~wKpQbuE}Ut!ozb> zR7;_DTfv$cHiUU`Pkh@f5R)Y!HpdZv+MD&QmQ_m)Ba3M^g&Yg^H}}!NU&JqvxW%9gCe9z z*EtC8=!8m;Q;DldDIqalC5F2{j|*Z`&5vvtd=c?+PE)^4y0y~gOItTGn!*vHy{a)W zfpWOMXyV31miiEPJ|0(3-@w0YdV=UV2PUcb4>vv^bNT|u04LU6!Kw>r851KC5+R7r z$ZuZ^rr2qUJ7gJlefZ_q(_4o6+Ik&BJ)@%-WygSf%dmseGh6KXXRb-34z}oHEY5t! z5w%zm!FBxdST@OSI!wc2YC>vi+CFI#Rz4q+|)4 zmE|gWwlCW3h6rxC5dgpO7vD1OV?*K>9A)0({*HY}T9Q+VC6L(m=j{yR;z3K9VVHsS zLK`C1@V~&Dc#*^FKU>=w(GGx`cX}xaNJ~rmJ{{mIsk$tyg_{0uV-mTkFoP>Qd~Zxd zK~6{%N;$FVX$ZVSF{Btg9E&L^;AT=Os`EV1*TZnvCFvO%m>B9C7#Nrswt22+PDtDU z%6IrhusWjZc9TW>zhO|-4@bBDRT+Ef zRItII)()}9CI@&CV0fN+GofV05p|hZUQK;P)qM)9FlELZ%R(1+sf61dZdw`V!C28x z=@lv<%-zj#=_yjm4U4062bkn)bo+V4TR3Js{vyJrs-QZrfSTE_?zbwKudS_8=JLeZ z%}1X#*v%gZmv9}!=p_S391@(pqiSOncteOyk!~G*+que|*El3-kM@Z);$%M&oI!N= zYbXWl%WXOh&E$0Zku`y)+9J5{E4TFJ6BjR8dPKAIp)3DZV4xiX(c0YJ!PZvOuo&M! z(w~A(!S1q!#n_!XKp|c(Q{RxsCo48KR&0Peu;<0P+ffyWc&JO)OI%x2h|1JK;gs3n zMEVF8JfRP16u{-=Iy_{wNC5}Pcf9A~z||U=xUAJPih&$l0=vA+dMfKHsz)V^S0>Tt zP#AU9zo{!&=VBtA;!pEU4b=LZ%xQLzU%I2`HSv;?P{5YD@I>j#j^>Ix1urMf>`VQy z5gz*Xv*7*BMl{5DhZ%TTZD2gL9tDX{1tV!ZJ14>4BN3mf#Qe-vYWor4rl<(E%F7ZI zV}H(2=4?l0@QtBLg9Kr;*Pl{+_xZ^ywG^+vPhrqSGuCzTJ+d|o_jN(C1LRGMEtrpW zm6;YiF9Tb&6K~`GPLn?6Lvs!ow_g0ptce!dzU9#=h zHfU*nt}Pv*$lrd$_`#i0-yI8axN>7#hgx|Go^%uLq;aAb2xiblneacb;n`)9*f)e? z`okAH@@p-lU^k7&a!a}Mkb&J~o~O}1{~@B!1wn61cqW>}F8@v8Y5t7Hf# z8tKZ#d$FSrM=KngA^l*XHPf9gOb0g?ld&Aw5c7SfQlH_AqIk<9?1Bw0?mAqF!b~fj z>Um`)mzbeW$ewLHbvBs$0icq(?uOe-H-z%2cPeaw4%bLiuYDMM7m!FK<|;F}-R1ai zzhpWF%Yw19s@o%E*kCt>Ew_F0Fn zavYtpO=(hBM>mIB{{0NGm4&$Cms~^p6rokg)1CtS9N38w>CDJb7SHeBye5G@GPskNCWxzHH6I|Kv|AJBl;pGK z*RhS{dC$N_=fpw~rsOJ-zaJH(0V}6$HJdyE+3z&|nAd0b3~yOAbW(z^$+b1^<{Ao> zpRouDV#WDfIy)Dc;D2_&GqU=Z70j`KDK|^|q_Y^15g=v|@R*vOKZ$^f%d7yJfK=>E zidE07luAR0A`M^EJj~?S73T-dvO4K_nq(VqWQ|&@B^aJ1Q%N*e^J^SXdX6v_ikQ2; z1Bf^R69w%Tew7VrG#qn3x9p%vOP)ryr{yJSyXJoN(3XykKd`>6X}oL~CG`8r#__QT zchmm^QsNUyKNl_9DEPjVm~`Iqmq}Q5}_f;*m-ViU<);0z>+E574|bfx9*% z<&ss^P^)nFLK+>bdbA8t zQQP{|BjF`syBHq%aRZ7YUl1$3XBSG!C$d% z(zj5_k`C4`lT@i3y(}t6E$o8L;+Ge?=H{MxM-Tphh-yO z%H0m3r$}-tbSO&I-ssMV!N54Q0;e7-l*Vs=YM6N0Jw>T?^bCon_6{9fE>cb6Dfa{Z zd5glvyhrZYI{PK|*|+0!C7vO;$;3rXtT1S0kQlbf2Q<{aJxoeblfZk^EQ-bmT1y+` z&Ar07Kth9Yq{fdCCQn@gjIEl>lFpEM*$x11~VnWKX1lW`EV;V-MNKMXoh>d z%`1LjJggEB&>rQ}7v3@1d5rS3zSgLz$(4ReTd9tt40?i4#c z{slf)Qq%^B^aGjAk;XP=K#@SZp9YS|MCSNPy8@MMfE2~W%QQ{Hbhfv zwr8e>SV zq5R5mI_0JTRzwYZcHGiDil^YY6U+xrc&G#frVeOUXIN> z`+KGC!o!j#r~=^F(A>-JQ?+lrSc6|JeRct!f_tPqycxIk z)_+4J`XPgwk<-~>oMmJoEAL=dfSO#)^$<>TLKG6rS}SXt&m*3`4e&aL+o6G7-talj zkkJfk9y2o+Hd@g2AZv>s?O~=TvC7;kc5tG;I#6C3)Ilp?v&W!tAW==Zhe)5UcT7>* zO0vTynQu#nKdTgJOs4_X>;Cijk;h8E>{7^n&c>el*?GQp>$qHgIV0M%nM6=*3_UgB zpu*Li{_4q)Au+jnMV7S?^%b6Q$Fe1-t*wk1bif?FFhtkP$t_wic30Mtk`mFTL|#N# zoUKj?Y1Zo1Lru!5)=1#nSfjxzGP`1<(hFnwWhT>BotGAtmR9EX8>{$GVK0-WJXL#0 zp1{w1X*y@B;*J5DpoRt2-Jz;XJXDNAb$=NVvk$vauwVi==^=3KP~W39DPIf5sDL<8 zipyPBF4g@QD?q(Jdz{d6e&&P$$Gn`X;PMu>IquMOHeewKe?eJUaPHRI$;fC3%e09$ z@|jmEh}sv;Zp}V!Z%@8CFXs1&W^}#6^~7`&KY;!8a9;p2Gq(!Y3LT)>j=?>A>Er6E zrJ*kVTBkH)A^L~ZJ`#m^aA3g7@0QN0lWEVYh=K;c5&$oL0M}vBU@s6kliFUyD(Cdf z!7HjDEvc!@NM?f#NuvYV|I_90gxN_>4&`g&vO$pz>b{g#Oa-^BJ7B(^VUMEQN4Juk zx)L!~V-E`o%gZLb-$n)TeaOIWU|3R$pI^P7=K#mfgO_FKY&2X#r-@9M&46yV3azUX z=JKan4aqyAOFu5&Y~~V=j9sg(LA2NTB$J}bEPaD01oV^eNHNQhlCr#}I3H;j$Q=pq zf-pK+NVs_UM%eIkN6)sTrs@)YRsPHBB&vS4L(W02A9^=8VuM%WQ8fuUQL#^XqU-X; z-B}x?C{leD7Fs`vTyc4qUrES_(V6Z9vbJf1`~j-VZ-{4_j$3-A#H4vinz8N&AiO4Y zuL`r1&{i=KA)|*09f8A}uhef;a#;?l5#7a0xx_nR)LuBnf zalZUEhN0%-IHXe~9=liu^FiYin~9?v00V-Bid-Rn$h7_!4@3h4g9VFRNOTn9_H;J< zQY+0k*7$=VIZs;)DzQooG^OLtP(da>GRNQknUvsuqx0IWeq3EqS4cafs{WJVzVhWK zvW$_P9!!wjhJbJ;l{l$ZQ5k1_8w=O6J+9HB<9zowzI7H`EE18LvoSsm0#AjbX zjhbicGLsQ8pfN9B5|Z8+M5Lg-%cy6|F?L#F)lru+{3#d(8T?j&Xy>iEs|VUG19U_hQ|U`@LZq`y0%w9KLYvS}=iV(PJrIzsK7?q6#d z8=jFNU$$x4O-MuJA8Niqr{ZJgK{B`WD31ifPci%p(~TB49~S1f=GL{9fum0r_;M*$ ztc;LER1Eu7lSU{)%-rjB_`tUsxDE3z!WGIJqQ*H*0zAsr#(%rQIv$z3VLJ>MS>HDl zwUk#!qJP)$*nhRfW_0+qjZQ*Egz$VXE{juW3N@wg9JbqAIVCDNRnFb4yVc`3ZtN|8 z)IY(5Dyxe_jis?><={UgPH-xRmHkAh+*hM9POL$W_CQZp?9TW?BR^Umc#p|VeM>8~ z;CEqwevdfy!S3JFdzxD^u8RWl#;{ORB|4;O|$3~hxK0e;c%4)J3N}VO|#RuWy z;sTG?+Wv3v^Rugkg~c5nX!j7Ai?j38^t3+)G|;t3ZboWqs!FxCFU^|?Jp)5si)h1- z_sMitc);JRm*SebItDg2h}R!LJJI~?F?ky~96vr0Iy|1Nt)q_f(LO#tax^}{e!;-_ zN`K?GK;)+SfS+%EnDt zNj2U|>7Bj3_}NBDCV?~tZQVRPUyU0>f=a`TVLOAjB0_1jn_p-Xn(=4TaZ$EkGwo^N zCSO0Qme{wgqBt5?FJ_9b3mC~gbOSeZ`i*`T!=2rsK7)Oz2WcMSZlE{`T~6gW;03S? z47Sw&HVT`S_!N+^45F5%qrNJ|sP+ZIW!3lyC0V=whc2H+br@C>b4 z^EU8|_59+yB}5xI+wQB1Z5%oA_jsZoU3=>3Hp%S7CqUnE3$#Qlb?Lv7WX~?kdJhda zNbk0Oxf#am+P+1LyE2Wt#&bJv83aAquxb8mv08`o@yE@ZQzJb7Gm9rG`q}XiY_;BG z{Sg!ppor-6^Ua(S3nO8@d4^M?dmGru5}iFDR=kNgVO^(tv+cX$)#oG3XcKhebM~Wh z8lG=lm%l>OCrlfMn^h#~ISqg6JB-*1EX8pN?q|i`sOBl2Sl8+;cgF37&UfNcI}G7{ zfDw!=ntHpR*6R(e#GcaS?j!grhahnC z?EB09Mj_+d3(Z7pOM&0mz4VRI{S6-~LRU7x8^?(bPwQ22nCw7HkR{xR3m2xsX0K~e z{|d1DdG8bP`-7Uu71h(O+8QDc!$blAqsPqjMWD6>-E?M<3AjSY%HmWjw#TY}x^qg2 zqIB)(YX@8T+9$72*#SqDw+P+;j8lpf4um-sU|x3Y0G~UpSkVTZSjO#=YN2VeDM8b^M)ES)%8~b!|9kX z|1HSL*2jVESg)6dv(3k)$M}F48M&b0I_vhuN_+M%X?)H z@NNpSvOQo{A4rfFPHcrUyVE|aZQ+iz80_jZSr;0j==ZxwRvMGXqM!HsSzh2V_9KsR zmuq!SGC=m~Hp28zYbLmmA`B62EXa2h)%Wwl6k>+<~fq!B#&z+q(!? z`;MWbMH4tiv%9uCP4MP&{NJA9tlyFZ4@f+iU#Y3T=V&#Ca9cM&7ac`|6-3-Ham!VvQafRh_Ci`Tdsl z&I$ZYTm2gxB-Itsl4V#2Ehakavy~EjwJ0-b`dAgH7)6r64>I0FCXuF3(VY9 zgNUgqoPvP3`&+h{<**%$@2!VREN%gtV?a_=R#sF{+Ud@x*BdNOaEe-Dmi}@VNP=Q; zEV4R1+2eb^Cp z`*^Nqk1Ovmfd$h>IJ~@#ZWp-3YZPqj>pmCW%Pk*xY6y2o3bXCUE8_Vgd=-d))Kw04 zisC)39cb>4MlL1iH@k0`L$EX|9#UFIo;TQG@+wKB#nX(2H3LJf>Cbs@Nl!YsK`6ZT zNYCxtUE(x&N12|nl&UNwNs~-+`>nHbG(dDE&2@TD!%dy)7CU5TYQCp*HHb$JqqNQ@ zIQx-nYuG-+drz>cN3Ljsz4&SgU|Sz<3d4fG=)*6+jIH<%O@Y;(QIi<20DFA6Py z`3ldzT4f{FfN3|V?N?CXp$8`AbH7rX4&S{S$TxS@trs@DyC&uA-R>WOO+fc*FdQ{IJNF0dV(V3< zm}kR)aH;d{Q2B4v-+Rut#pFldX<<)VGBX!@d(zsEIXU8BaYZ? zhykMrx}j4;7!%fMX^1}G+SRk0xBF~J!O|1sD9*?wJc_zlLwotxBXYNblhpLzi#o%H z#$9Z?{8hmVrp$kJKGJ4@GRIuYx7E<&Ab30Rh#IE#d8YhFh5liu3mQ}t978Y})_8{~ z@0U0}Ed^@S``ICWM>4*bvV-DEeI$?>R>*t%j)rD;1L64MHur|TtabcF_Cp=*nR|n~ zNdQhxS`~e9&M%+)?jm$h{CK#an=138E9-0Jas`10P39$m^MonfRr*vta!xW}Lrz!(_7=KspBkPM(8o zUM2u9@ZR86oFeffp`au2Ab8UQe;dL*_!NH7x3j>9c=ZC#?%`+yY1>NxiX8*K89NC3 z*Y_CCpQ#6`Sg^~76!li52h2DD(0N5gze(5YJvbl06v$Z7(x^3@FYpPA3xuK9x^32< zIGG7@U%Sy>k_mzXX`IWX8xOnTCey0ky$f$`De5b)OQuW#~fwsiaUVE!|GkPS}0 z*WxZXT$Ni-Ur@TrwMII%887?Sy>nzAr<~fY!Dz1}l}FQGa}4dZM9DxmNth3v<6yLF zAOReXUO-)TPh4v7ZG^A$f7bvO<7^v}4izmH6ps1yV+s1xGVNlc3m;IjykrLy(@|RO zT6e_?0O_*jeGA6L0>>mjN7_h-9WCn%#RhaN?bFI&8r0~%hZbTN>!+v-G-PW6?5EkV z;QYt=?`aj_?(QYPf4kpg)$aV!U~%+#)rHS~7|~>YJ-210;l1)WU$t3K(C%`%@~DD{ zn8?4N)c%D8Il6Qq%NldJ)oJk-tXTghNIk04bn(|c!f{!K)92lKoCkrl zAtyaD6@L4;7VTk3=y31L)}`N?ic4b>4qE}jpp}Mc}7q%wIz0$E~B$(&Rsv}uLcLs z1S}ckQ#oVV7|*-SrVCMj=Zlrc{q4{9X3pbK(9EUn*ci+8A84S&d}eP`;-C z=M_`(r>j*NyEL_)N?m7aqq65JwllLZ5RXT>nL6lFBgA)QirpZdb+a@tk0<$W3z6BL zlr5}kSX%iSd9s(=18yd>)$p~%nH%5~M}ao47xv)+E1TI)hWRIEF5Oij7)I&6u zubcB*6$Ry7zpgqs0}Kk&`2bqmu|rC;aA?8BpLiYLl1c!%*7(NB8UsW9UymT;>zAda z<$re851@p*?4RF%sK30Z04f?9KN^sPJC7e3P*6bE-@%vv^~9!{v8&e(VoN^InOC*sE)3@O`}#nwpvUeqNlP zXJluCGok|RzzP1h@$6q;C(teqHm|qkkJI9LnP!vSjzhhtg84T5i{G%^(x@{`hB4IMdL1#JL@fLEz0II> zc4-yyVjs#AGpL5Uvk#fj(>I#znF^Svq1*R^K;n%3GoO0-U2mVO6sMX`gfV~Ni)rCdCNtiVHYr0*WyqerTZL;m8uKb#zug*nqzj|z^3r04}`hL9clA92PosGQw^<1da!bInvT9tH) z|1~Uap@v>176v6VQpRth6*LF-QKzDmdSgc(xc`i|(~Val6B!;BHIB{q9rHt^yiBW; z+j%Y9BghgOIudYr7(cMxE`Es(OL)$6Zip#6A1FylKtpc-KDib|el_d5OL49aVBcdMXcBxm3{ zb%S=cZUlb|bu7rL_e!*r<@a=d8c^weo%c>uq5$D_3bv>9;K8bxii#2=yHIyw(q1|e z77^sN8FJNqG4j%PR8{m;Uq^Qa{-a|gtmrCfH>{x#S1c>?caoZ{&K&uPfVBzg!|7x~ zSJ_k2)1AC*=rvn4jI^^?bGj+7C1v1t%h$tmcppBHl~pklXqmV2?jh)vcEOM|AXo&M z2^OE^kBqgwrl6~()Aldr?4mU^m_l+f$kf6MEG;rA*hRnHwu+XOgLjp)!#7JcVNXX( z^JUIFMi`#%%Tnx~l{YITWstRi(Z`0Anvs-&v>%da-PU8_p&?Tis+>tCjW2HImYVKj zaz%5EZvhxA!D({zI#RS$-qFWBv27bEAtMvFxJ*tpMaJ(=E}GBv?s-uIoz@e~ zdLFULD~y%)AJ=&*g)%Rztyg>>>|tk+3~}Qar?g^Gp;BhJI?Jb0FXVD^kWK=O14UYN z)ft5LX9`DT?_aKM&6L*Dy z5g_IMs24hQjM@^MB1^0A7^AWFm&{FU+c+pmc~1K@bA;jw6^8w*lX2?BJ|mxz8WW?q z7U?+k9s^AZmVHq_kcSIwoN;n)X+}OOB`#fw@fv_-GbSo2I#H>E6s!XCGK+w4LY!hX zllJ8aRsXW3=-iWE!@<19O~0lYgNl}|$sW@2l)IS*$k~`IStx^aB|EDl#1ECEb!P-; zdc=#c2YxwbhGyOJjNc{3iu7cvxFAPr7SnccF)Ba_PeF6c7mdCE-Chjqnk_0g^NVXL z={l(tBQLu$A8VyGfWWG}yMUCpHWN%z{P1U-Fs~I-!nje3kBJ(&J=!%`bO37m{BjF%_6K^tjBx)*_|dIohF(ZeX5>6Fi`&xb`eE_V zK?0;y4!<2sV@6X}TSv+{sw!VJcbt-K$kk<4JMlEO;%ls~cDKDeN?7py7@B5Sxfz6~ z@@h+Jlbx`Zi`2OlPrvB#)vgK4Tq#{A6;HQQ+LgM}v@Tx`4a`TVq-bh&f!GaJQiGF< zp)i*XXiMa(o>Jm;Hd;UG{g|%0rn8rhM-xl7EsW+TC(Nn8Gd+qyzSn0F)MKKc zZ##j)Wq$<+m=>W`YV-3;8mX^j3!G(sGwNlyc? zaSUJ00r)@hj?rF!_$nbl2)N6O?jAS5W<>-fb> z$LlX%x+}$WImXP~CIW!U3LC=YVxlH{y@#ByS7P?d5`T%QfRa;3OfH@AXv_ipkdFM}xf1bB1NNmp1rb&wM^l23UR0DE^~O7c4j?p9T&~`p zb;fMJb@#F~lwlsmz^0JZJ&*`)b>#_pi%}cvIaAxPm-*XPYvbTy;cULw!DD(#`~9YPES#C_)-wd*60CYMYx{! zp`lvf@Z>g}$n43nPahX!bc+ZgS<=vLhMaWgiz0S!!KX3o?G_+W5ia~^9JuN$w~P?A zTb%JgfXrm^G)|NQ^A`s6;jVAD_g9SnMn25=wCwheS!N@sD7%!#Dto@_$dXbJz6_FG zy2cHF-iYsg&pG3dAM44K-7|cVDk%eTwZUD#jBii5`Wh-x+S$%WycW1dpRi|_pRupr=@Glfq>TBpXG{-^GbxoO+?Z&;r zjzGt9f`rz_iuz?Xln~p4)#9L4qGk*EwdnE4dkmO6#IOrv-U{x|r2LJg`yg$zJ(*Br z(D}>m$u}b>J7bTHyo^6ZspdTyn?_Jmf{=-=NV<2FlMel=Mt*jwE;Z^MVT)>`2JQ}yjTlJc%czs}fTyu3X9 zhp{yPVfZ---ph87BUm_|C$JgETQWI5cpk-C(HC=_LeyK&u>W>Uz16ACw+lbIsf=;~ z!~fb%_rzpHzwJ#D&Vx}o-524@mFF+efYcvbXX)i{`>d`C;w-I=82K4sHc+3v{MCc4 zuDNVJc%%Z^;E!BEhWv=>uH`rP)Cd?n0!79sYxBYL?T<;qK1HFOw!;4Oy02 z(Vz4jMxu$m=p50RlIhnsPjMoKetCU?fvNI7gp6k~eap-m zrjX|sPMh%LoiDI{9-1<`?PT3K+oeS?t-SWdKP6-jFM_`0_2#|`$%odM(bBI5eL9Hv z8S#>i>AYTWzd5a~C`$^h ze#1j*c8%6yASSNKZd1b_^~srN@v~9m(~Dz9Lh{# zmT15WjXgadqi1s1498hB*r~1A*tA0(SHt+N$xylLv^-#%Wtn#L z;@{Fj#=i{VS(bP$A1`0G_|9IB{>gjHeoroq8pGN#ffTMq7 zi11nGSAPgmI-UX3HtUr|zpsh$2GT*4iM*4hBH>=8mVE&^k0y>1&GU>rzi1^a=VB>f z+^qdWarI8xOA<&xld$>FaHO{`Z4dfrl@luAOZgBJBExT^95Ki@?-UbyDORHw8e4XH zn`J#Z2w22TpE{6juPlnkQek8Qo@U)tt$qHZXYo;inZKL}WUi4|ne}6PD~WYV2B>4M zRXgjNvf|c3ico0g_^-jRp@f}rFvL#vtD7P{>vnEiEkG5~@J&aT zA{+;C3Q;MdX&1ITfPLiP5TS;g!^b>+QI^^0^j_BD(hKRmv!x1|2Hmz&YIV9SaLA%+ z!QFHz_@YzgkZp@O(W>?AJd&qAJ=8sx&X}&n^~|}n3285&T9IK(HrMLr~ zM0>$OO0>yLUQl!y6lGqK6d$@(Lo`)^4luWD@T))fB%oKC{0P_cC9b>_{Tn84j*$z& zs8yz~OnoctdQ~J^x`PQ^JDao7N?I|*&MYwD-6&q*y{a{p$e(a_*1LrRTrOF5-Gyk? zb$|%*4#TBOvV#-*o7~FFt@Cf9wC6(Zg^ug(_L)G}In=zbn53`rvGlDOl#^;F%=54f zDF(nw!svyiB5TJsgdz;=rx;TXpg0}$>TfINUJAjcvHD;3@%;PAQn7O^e)lQ~8iZ1N znT#w(y!J5R@K;>bG zE7AImc`!2$8J_0o{=FdK=HgsuafTBAAWZXd7bro|QXX1&mh>DK9uiNHo_bTPB2R`xZEOakpcH{G6G+->bC@GEO)-CtAW!A z=*NaB?kKNCuacdZOy=D~YtG&lY4Pre@tPA}1a*r_#iXgvu;v#PQg>^KBh3$7oacsz ztLvI-=2foHfLyJBpKKzDS|w^t?W-O;bSmo^anH*MNWL(;^@_Xl~&&dTD;kIpjY z>Rwh4EOYs(-0=yoN6WtZQs#RkYhlLEP9y90MhQmrY~PmVay0$;^N--oc-rR)_s4Hn%D28X7R+A)4oMp5+C&Z z6-`^qGxiKV9F3+;IbH*o8`E`*R6a4=5w$;jqqd48?a5@=B)XO0R6)dsrnd~+fMrX6^17g}?uX7MTGS{&yye+=ZNnFKL5Ql&p_ z>U2vx$n9t)6`+a+dn#YP`u4iJ6MF#M#_}S2`XY4a5Orp_7IFGJP}LkqYHDBaEy42E zr2~PCnZ}5~G=z zT?Bu1Fp<%eZzPQSN;tUZOw{=bX1q-}mMt7fKd1RwpMvR4a`kt=iDh;2L8+@RNaUsm zI9T!}R#pJCrq29VQ%@Sn^WMO&+R4b)t?>er)V(s8>wux}jGE56W4|jnoBzk}jR^@z z^otdllCu(T5bum=T?%&-s;&&nY+Bs*;~~LH_N4M?)d78q)>fgYA|Oz>OJRb5Tvc&# za6{x4n1xdjs_kCDQ5m7*W^L>N;n^}DUF4cHr@duuC^q1vuIJUu;&hclUj6!XiXN4U z%KekYIjAHBQ+xwVV{qlNAoXGX9Kb=|S5;Kr3GJt4CupX#B z^RdQk;nM@SUU(~)pYoGSpvQ07g|sqKBE97QG+&}4@Px1+z@#lpUWcS zQ2EBeu)ogCXj+8{IHrgdBf}t>_AbpETm3W7ki;;8ue6F`3@ih*wj$-zue91izt&dF z2f`x<&%K5RzN2_B#%fL)pO;nlpH(1B;$>m0p~w!o_Tni z8U!cS7Ll2lcI&(C>LZ++HHf z^H&bHQrZw%S%+!5mD+%5jr92B`SELqU-a)9F9@#wIPyX{xaPj5Wu&GXpvh&f{+?~4 zwu1_JRmG#MPUQw2xVYt>nI%L|7IO8ELt#5r>GB64+wY z!rL!YydEQAGYRQ+12^7zZN&QYy1!uGd-%@$J>7}4sxmf=Z?5J;JHJD>wlXH`c{cCe z<-9HQ6nq@!=P)N65V`etaUbRh;B39)3d5?^W?hDLSU>rkBZ6fBQr}BsGRx9 zWpS2XFq$YrcuYxNVf4M@)BH|YNKsw}6j7TFyy>`&@BLm|o43Pvk&Rl6i!wJq7c4;O zct7MDvG8!*6V)&@#dEu7EwKIael0nD$VF2#*O!8<-b?v6!op$~%I&7wUUDd%oG-+3 zuBoY6gMKh`o_Sn8^1KscK+5hQB||+$*Qv>KAvw`Y%s4#MObFo&?4YfxzB(EK&3iR` z@~aZ)+ny$M+tvUi8*R6GU3Elk$h%umNXVT3grVBc0@`P7`BqP#u=D1a0B& z2U{cKIBuI7O33Qz+1RK!ztF2p8tAy=u)7qkd*;Cz)Sox=@QJ{GoLvoe{^Wo6ul`85!hxR$<=w-G_uNQhU7d4dQZL&a|kWolUI$2mHx>SFsUbSR}h| zXdJt3r|66^vrJX)ny69U>ulH?Su^>}TN+B23v7Ed)%Z^eEm;^ zEOcrB|MV7Dm5r6vuJJ|fZu{rlC)<JoK!>TaGAT`&hn36gw9_{8TA+#KB~`N;1~#(cG9kYf{5 zT{$PxmQGTRH5qk`MVd-kN-LU+GhYlTtKYPNv98`u`P%EFD}#m z#ijX$afC=aqRP)u;x74EF3iD`JIPMqF8t@8EM-*6N`bYjB0|*c2jU2EfxoctpOTa4Fz8Y+D&hfI-u+xn(1 zv9a!_g)eOLM(|_Blc4Qwo=RICE7iMLoG|fqz=E5LQo)Jco}F07ZrNer{tgFLQ|N-H z#T^eAHb=%}L$+8}?!Q}Y?L#B?eTb=)>i()+NI#{>8ZGwYreVFko$Hz{W7G>EUP|S) z`Qd|~l5O?kdmd&WN*G(rFzXTdBH^+0m1LOS&m@xFl=i1_Ay5)=C9ZRUme#GW!QY^^ zqqRrty4VT|3sLax?@sOArnc5+>WnQ^sp)Ainsk4Y3V7wgy*Yc2nIN@HmL7Su%;j`q zd}3@uGZy~aB(TrC`+bDtBQJEqpUBe;H9nqh3WZ-wbDW9PhJ`>CU)TSQ7$X=*34pjvo?MP6tG2ivL};ZS}_bg4eYcZL>NF4kco zukmo{C}_NLX$H#0Oy1c$j%4!FL#YXE>LTfa2~dg@>MPHT%$qHi=tMC%)_mfBtkp)2qe8Qzl4>(ztY3>AfM0>Njb7*`-J5y-U8H3P>EEP{GxEf& zyFpLq%_5HC^&3MlwP3C^d7ZTJp45_CBmg{0tM&IRiHYza;8H{rKikAeI?LrI5qZva z^CD$xOiK|?#ynn~AC=GK4?2&dy?e3k=A}29t(o3;0oB2&pHA01mPDlsHy`)JxLKWM z*fDJ3X~+{o!%)AYk1jjt+z3`?&#s7-;@rXc)+Rm456qF(dhbCs@ss^18)i!`P2M8( zDF>IYqNXhx7Ka(~K{Bbd5UKb$SAS#;Wm07(lN#L^D1=$({r9e;z#*{J!VIZ0kzaI= z(jGT*?mhdctEkHR$zPWYQPU0$`XdZ*J%)r43G|jW|57k)Qd2ggKQz>691!tie)?A` z+#0F|<47ImC9fj65^U1adE{tw=pmvkogp3JkDoTla|2{i=V7(4F=QuW)6s3zo~}OH_nvCFw9GP2)|S)CptwW*~9-m3qO`bS}X%3 zQx^|h6E{bCN`BmcsnUOX0C86O6*Bq6byx!1E6sV~_;}i5->WX$V6~MJaaWWpLvGi1 z3SC=R(fFb5nLOnrA}hA50{%U|muY$?T9bQCw)0s>hE%b@h29J&!&dG;HSrUehNY}Z z&MjckM7N9+itibBk~%!JKd;Rb6CGoseIV2)5~s)S;_PetvvOQk0$M;YHN6T@T;Gwi zfSpCYEPiu=keAH`7!C^Cv2W-*xbQYm2_sdW^w5!WvWi{I<4d>0E}lKO@DaxTHk~si zNJL9O#e4R_j4*5}CeFFVjwn%fP*E^wKTlh)s?)4qaG5fDY}Z*JUZ0y2vR$_ZOQ3_V z7}W_ly{nwv{y}>{lCOFHMQ8JCezZl)lnkQ_ZNsl=g|UTXBd6k6mYxVOe|+DObOa)A zd{-0$o16Gx>#f;4;^+Ne6OX7>n9m9{^0p|5q(3@`hm@5<8;q^d2^8ic7 z@7#a5Tci#`=Q^8fZgf}Gm61WCR}09qL_0bes%gDKLUNHgm*Pl(JR+aNY%CFxL3N|; z#wwQ|Xx$k-1|2iXX=2Q%X+N!tlQwSwUTjkX0MwD?{+H1%hd0&ad5v@;o?Hw$Nwn)D z;^w10vj}{UzzQCL)oY2K>y9H+=%%yaAwxk%N$umB=LGGbF+RtjvoXQpc&Gwaev&C~ zuCZkX`fomB>j16T6csbhedzh~bXI#5G1ao=SEySzt(P&W1lNlmp`~F(&!0!>eekkIGc<|Ss6XJWn>EY)(KZLdk zxcq4PtvMC4ZI~ZWAN0u0#P7sGUwDdy-?!)4X=pD^2J`r&Ld@hpk5|PQPuJ$iE9jEu ze3%7PAZ_xlFqZ<~k$Hvsct%{P*1vB&yv=zQ=;WFEyD<0M++I7y3q~$qn5JrQxT#M;ay7Z%Fs5BLLwof1 z_MRMM9A=t2iX{d5JZJGVi(k{>hXm0Tn&he_UsG~TW5blLUJLj!GwTd)2Y+A!EtFUO zkTHl1eDk`SUoznxP=`t&B{NQlPp?O^N}53jAWurO6@@Pw*@H90RVdshEel9;A*CS- z*H(vglLL&PAmXeg3F@^pCT zJ$qyypJss{-ne?d%=`erLqq#>aHv1avs$rz5nMo?t-`uCP*K&Fs#jAvp&BWJ9~6s= zj6EyjI4$*r|J>`X;Z%^X@u_1&^6i$dZ9oZQyV+@QyQj2?_shqb3)di!QM03--OBm? zZ?gP%U8}qxD4ptcSl=k1T!>rHA%kMul?JTKD7)6$|C-!KMiw%LEz}xqmFqQqoXQ~ ztpBFp1G&GyKfBJOUT9dDx-u6x_l{yQ91dsqebjsP>ebp9&OeXhgAz;4?gtOI7lz1j zSmz^B^w?c7WPGEULa4L5XA%hk{Y%f6BeGfk6@&iox8Xm2&j0QI$K&~L{r~g-zRCY` ceN_3LkhA4kh9bLKM*l9#%cw}hB#nap4-^`~;Q#;t diff --git a/modules/admin_manual/images/enterprise/external_storage/sharepoint/sharepoint-2.png b/modules/admin_manual/images/enterprise/external_storage/sharepoint/sharepoint-2.png deleted file mode 100644 index 7cbd5aa1f4dcf82391ba010661cb0a895ff49fd1..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 12119 zcmZv?1ymbf^sWuGxVAv?Qk>!?xVE^vQ{0NXySo>M;O_3O#e!2TxH|;5oBsay-nG8F zzLk~inR8|`IoW5<-p{)yTtQA89fc4D1_lOQQbI%t1_mwyx~+r+2mSoHV^{+<$aWH% zjxaD71OMKzN%R;*&_+ZjNm)_Ejdujtn5>%^f&S1Y1Vd?Y5tz4subj@}L>L&R9Z8WN zDsIcCS%_{#i%IA4b?r;uOA|J?(pQ7_qmid<-CniZTunw}a+Je$^F*qQvt==rViBF# zC!MY}t{+c2!#nTjTp~JMBi_U2bvW+BeUXT-n>Uo=^F4fbj)vfh;CRm8?Knv?UPDQX zgAy#1+mx!|hNAG_Hede#$GVB-{^q7>!4u_rF-jzP**RSV4I#3pmhkQD!n=Vzn zeUvzVSVw2Tx;h1-C$~xSjSej|D%IH5Ty)L5n6$EuZ|RGz>21v*;mNOWOvUBo?9iEV z6}K-k@kvEbRH<7(8ye>Kck*>ahQi<3D3EUIH2?X0W~x05*0j`JMj`&$5h&ar@az@Y z7N*G*jznk_r66T7^b%{_Rq02vMyt2u(dJZDuX~*Zyrf#`K)leNQIYN3-fsP1&?}&u zdDYdfH)g;_-5MLQSkcYiYt>Ie9+U}_+`=4gnrPbvu$WzHr!O5k;tyw(%BZ# zrY&>x=~qkP7wq9w2AeUqZwQr&Ha?XzJ}ID^LtKfXbR~w(pyTu;%(&ZB+UOf|s*=iU zwiqI_$?dG4o)jd`=z$QigyfAo)h82^5RJptDK=S4?IIV3Il(A39>qlcoFY?w(yG*6 z{I4-n?WJX7CV1z7MjEdnw1* zx~n#Hc9pdm2vyFV+KizB7L*oQ?N3d`Oo=!T7B1pqFWL7UX8b)J-#OcW*{-GX7YZpx zTC6f}`=q?93GaDz6Mq%hD<__UJ4TGdGtsWY-Z4$?wa|z@)h>xO{cxvT2WZ%oR95*Y zt1dRH`S30M04GISVsQ8O8cLA2l9<~ItLkVg0~&)X7?2wSH_y`)nir}W8zrrhn5p6I z9wqJ-6XrQH56k*vERz`S+^BxrTr+)X$(o2cPOA0zJ2?{zJikQ~B$+4jXvz(on?j<2 zv%XQawFtrUKLw)g1q{kK}TAzy#k6;AG158 zp{(r!d-qktgXopPUFE&UTUj4b-+u1lG`8cn_xP1V<{~S|-pP*?BTB4MDc1P1Ep;)1 zD!pW}7O_i)CCe>sY|JeJ)o=>AYb{e9HL!Mo>49vC+E0aQhO`- z7uC#hxjh-0x;6R{_l8BMo#d+Pk`*{vB811xo71$WpGc1Ac|;7ef@|i~$nWVVV8vYQ z3!0Le6wp2QP?_eB|Ki2V8tUZPCSqc)ImFNty{12T>XGp_=&;Ui0SDj1DL128T^9gD z<+-qH6$a$m;Y|_+O=<lniH&Ztz@Z{|ziGB^S$*!LK z3I`j;8W)Fk_?N1R6!WIfrhT??BGj4vaEcGY%Htg4E;MBa4IF>1m)1Jn|N6rxu%?cE zaip))J>a3wwY?L2tf@V8A>I08JCAGfaIJi1GJ}e!_7Gd*?jKfl@r1|;J675wnzipD zldCE@W=O%}whe*IM%$4mbL4bLY90=mkN`{kdeZ7+xe8?+KT)#nTGiopPPs6$jT#n6 z4uJNnDNnGBE&Y|fMoJ(F5<60vwycra$^pP_&oN3SWB)*Wye~~>U$eZOQf<`moN8IU z>}6@*xY*S@3Zj%w(9e@#e5N(t!F_a^4Ph4r^_i0fd%J!L`GhWYUGajPoJ5k<z4 z!pnCi6VL?$KZkG>5F{^OubuZgD(H&q>Ahw3ensvcU0~I^6{F_$vMZ!dnT5GQhO6K= z{&8nz=SFAVTBmQ+R2m!{T-fU01f)URC-=-sNV^$c`J^v2V{Wt*GZ3v2WtYP7oOOjG z&*{pHsI24rv4hio{9}oFmjaP{d2mxs64j<`Y9RN@%uL_v>cICE#!E|#obrUgBmCi+ z^@Uhq90PBn%ZFNR|Iz{JT}%}OkNyXjg+?0gkhCiXfSnn14xcN)GtAHHXTg!-TD&UID%_PyxP{5iz;42gHzw53zJ||_y5bbd@7nR$Y(%!5U;+4rLhbHtMT-=xUcEq0nNBx|6CPTZPoPUnj9{M zH&-0|YE~SmF9FMd5}BxjZHW0@AC8Mg6Ib#qh@_VWT;$vA2Xb=g7mHyJMlov=w%rA| zGP#;aft6=zv~6a<2Up5a^=etNyvbhl13Uno?dXOwny1fWW5H?_Hblf1vo2&_*RlO|rmt)XOS zZo(+eKzMJO0MuoQ1ESllO}jbgQ=EqDhiulMh1>fW)A{#?`#(=-7OL z$=c{zq0(3IRlFMh5jV|;VjgYG$Pdyb>=Bn2esWEJe;;ZJGWP@8Njy%BLo8W3eab+r zep^f5L|o8~OqBFzmpym_mPAq1xiC~jcfs*;?6H)ocxYjCKhaQA`P}L<-jPg6Q^hw? z8LNiI{_uLE9$qA}*_9<)Y`8shu;0n`gtqF5l=#rZN=ugkve z9L-i_<^o`3s$i{$#pX0AK5sWo>Clz4NNP}hfncXiy(EX8UM$mhh4e)W5e`JSnda^9 zBKa<@I?A`0e@UZatXZs1nVcGLCD2*~gnmmh(v!33A|m`qUu|5$(_*FHHPl~n8_(?P z^`7skQVi4=Z-KgQMXl+z(%S>irEyk-{ih&XBmno%nzje^4xQztU9G=)PHLK`%U2!1 z-Rfp})@rRsI;&0;ZI|sst7)`kvUVL`8o|bjfm)S&zKjF!oL{04VORI>)A+t9k?8?i zZZmfdt-`yg0#ni#hoeapM5`sWTc9FLc`Nmsgem95pDHclt@1@r$zs#NSzLoOC*9n| z@hD<1y^cyJVw8Q;^D3`OZ~icB`s?*z^jlM>&)xw<`u$B~G=pg(0K6Gu=`4a}wSqKi z=~mrl$-J7$SuR+f2?zfwve~zxu_#%u;GGJU1AP0`5jWPJk(#8;slggQmZB|c$3^^* z-M-CNb|xvt#n)SWS@Y0ZieGRYJxfWDIgu!!qEbNgZ47JjZ^4tj4R%>3DoNM!Wa<{W zwWyr>a8Kb5>^~bv^cX6xRP}u%n=U_CJ-en7EH=_6c3R;Ru_@7h-Eh(pD&c=Hy7?qf zTF{QXOadXM8Ck8@{k&An)w>j9T6g{_SQ{?^-{6Z#sB#;1BPTagXWNNfa;MJwA7bf& z=A^Y^eK4H97D;XSjKm2%2N&6TN(W1Q9}p>y4XL@(&YA2k$hfjA43*}vGihm z8I&`~y$@UXuEqFplS^gzE?j_kLEV#`@8teYo-cUbag-tk!>&Z7P?9kWgPWO_wI=s<9hZoexcwuJ=n+cVvg-zQgqqYp|oC zn_iqGm%A9*KQ*{yNJr&RU!0qpn^Ed66}@25%&;n}EVABQqkF;VFlI)TMQ3;26Dn&m zcC}WOO-Ws@c!mquzlD<^J;A75PQ`BH_st zG2SE=7lXptwTre8vt5giw7lQdg@tvLLHuo*0i0tK$+~m1I>c3#xycIhZ4SKpTr)%J z2j~#C2yWhA%1o~;FVlUBOcM?19ux5rgS%(Os;H0sW6%)BT}YHP(h z|J?#cyUoZm{pci*Ke#U)R<+NyM zX`xKR18axF%zAY?Fd)Z+fOlrS5enoxn3z!`Kyk*sv!{p1=^DzJ2aaP0^oqETTAwVg zB`X-?LY7qM9i~k_^mgQl)V&E&f6+7b>ke`gUb zh?h}rU>O}99d~#42uo@j8gtlHJ}w|)C6+*AO$`h@KD<0c+)!3l78e&+&usNUMx*le z_4Vq?!O(AD>uH;S)`uCm=smi+`n=le*x1;Ji8o@)%qNfcbb4p$H8ZS*k6YXEN4tt< zy)sQl2kJh^?X7_0-Z)1uK$4sJI#{MUlJ$9Rum=o=n(+(Lehj*mnC zG7{ad!1A&(6&01ttgJ&*1q^ib7s#yqA$e+gdOBegkaNnxcjf_`rdqGtLvsaNXf8NC z?oLj}`1r6ym#0qoPe4E&&w`Su=;_sA{?RlgyGn`oURdzqK54e`diuLD+l$yS_3Cn< zpvT{?FvRoa&Rfgj6FxJdL{u}7Lp#2@2iI}p%WzkV%V}R)zD={3el{KH31PsEvWe&V zx|yN5dEVRL)06XNbnC}+SKY_mCEuTpqp6B~5+=Ly&4@s%9@8#AIRJCE_xak_@SVMk zZgW%Osnu)SlM!n8m3__hW_9|s!?5RTO-HT0=Md*yC2|7x=LOeNB3|iqkr~gc7bBV6 z>l8tLHZ(@J7wZL78jIA_;k!t|+VYXlq2l`zwDm&wQU4}*(b<^|FE2046pdV_pIk;p z#uFI@7n3InOCw-sZ`>Y^6`mN-b9K(j$Vl`&nxY{C2YBcc(e``%{aUfq?JGE!otB17s-mX$ znS`X!HZ3)knAe4Yf9s1w!|a-lf4z9OB! zpOEm8g5o1S)a|AwCVwu`@R{i70@MNl$i+B$*3esvONGmy7$dX^)%xd=kUxP4pKZmZ zwmK6JZuMSPd4TSlI25}V-T3caY(FwM|%VR-Fx!m6uoC!DVr z_^FgA`V^rK%!el})CM5cyqTFWtIm2P?x0@_L>x9S@3Pqcs{JT-TZ=c5D$h;oQN0U% zUU2CJu%t0-VF9ov$SO`3Xd5KK5ZJYF$%-PlYbxB-tNe2$gPgGeqs7feho`Zn`P zpU+9<_M%xWJs}z>5pfa`%$>JdK~5+Jxn%dg8tZ?HvBj7-v5?_=%)V_ATy}5+D=RC% zj>D)Zz`XvsO#b~_WbC_wRHL6Cj2{8S?hEN*m7}9Vh>#q{;RKw&-`f)FU|;!E0~$l+z|P#v!M75e8&sJfd$q07#hO4 zpm^r8+g2Z{#$(B0$Y%Gr76U&8joBUTxD|E6?da+Bnbao=&1yuP*zk^f=h{1rDug##}Rk z7Ibs(*?yO;pv2>I6;)P6Q*pU+qtxK^Sh^eCt=*RmawWA)JRLupX%$7*JDqSe zPnD`CS2go36em^--_9kO7=y;EpvfrVlMAAS?(X~1YTd{AF=hdfM<~~~Ry^=(Je9N! zXSEvZ`k?o5z}%RqkR9+7obRM##284yBy5^t*aF3Y{EY1#CE{zkYp5T3$S}+=7DgW5se=0gL>ew^O2a zgfN>pAgnB3TI>^{%km#=6)kSB&+b|^_4R?3esM7| z2|_0el%KTRz@((4;BjWz%*@P<9UMHoe)G^GSj;F7)3ANS-*&xcM>Oz!f0Q(PdSM8k zr4lf^urM$TCmy!jWag+lUKVO$?zJrooa$sa+PrLksaLi-fnE1Oo$UvFE{EmfBRzn% zJA;~&8Kw#B>@Z4t9z@KzTn^>jftcS5jz{o15&Q3Kn=hKa0;wGMnz`#VhQ&=X`L6;= zwd5sGn4b?To$9P!g_BVn&GEmhFeEd?{(e15nnf#d>>4v%D+zANX>CZn=hDf{8jh+X zV_kZ?e!H=xlv93SbeOPSJ{0Uo{^A^furfxFxNz6!+abiNhR+XmMM^&ITBI2j6;&IO z0hNMF{{g`XJHK35$uGJLF%Z^>61MMVAAEX6$N|APKaM`XmxaDQOc;22dUI~fv-;JPD z+u7_E^OKRm5|Wh2B(BWP&JGO?O<6#HL&FE$OSDrYAEK18LIkYK4l!vRh^vWcglyUj;F*mL+ z*}i5&JT*q~PG0HP?Wj#w+2kZ;xzT757R;5c&xLD3G$Auj z4xUK)SFWo}!bHQ^Hb|SQiqC!yTdyol<`*tkXXnJ&PBTIfTyMme;e&1d`0c9+)0fz; zD^bPT>2U0ajlD2_un#y77Xjru@c=hhq$9!n?b7${F4nhsU#sA%JY>pathL?uGJ9RW zR`>pUAUGz?m*&Z~`?=cob<9IY$W=jQi!5XbBA+UBtqdZWeTjubdxnvY~yW zSiZBHV$&FBeTC8~JIA~BfH)$FcOAtsqI!CyS)K^=A~MPPN zm9tQCkkS%a^hVR+1(lpHJEOHeq3>vHJidlHL z=sw{9)-S-3lZ}B7&2>_QPdgb5tEGQrB->P{f8g<29;ae7D6CVVf50O|887vn9U5J5oZYSz4J1u6_GhD@RL6yLSUw+??be9OrQEx zg%s4so{d|@((OG&szwInJmj7dRKrW1Y$ZV5foYHREBgL(D+>>&ptx9&IGXbAX91($ zZ<^-r9qn%`zRuTIIV*38(+nRa6+mhZPnUmAnFY~-eS2>Be2LQi2QTf(g?HBp;JL(A z3z5g{-a3d65HgfGvl1zJ&RQo%e@yw?ou?tfWGPzaJ^j^F(2RB{8Sn!rcF6v+?O|}j zO$g90e}D(l+r?MV9&Z26CupzP0kJ(3{=4`YA7pL4^T@ri`>1Uz#Vw`SIj-J)FiX<880X@}T>MGkckK zlYkwc%m)G95_8bh$k$ge>hFzWwH-wz()rtKK2nT{00;p&2 z)n@RI%oRL6pM?2>;r^Ybs7DU#E`ft`!?Jbh20H3r{fB)2LFxaoVP>r!o}QMLmd6U( zVmGYpISQEc?#z9#!9v!W|9^~m>DGaPbCfG$`$d>EHS9ku94<{xPHt^&75&#vddkVd z@_(swVQmgufxnZT4FIUecvr&c#w*`ZN`nF&E&mTb=5Np(8;%z>2&g!BQnt4cR+ZuY zF<=>rkz(TFhZNtiK-!-`Dq&`Gf|}&gXrB`FRC8L88KqU@v`S~9HsRvPNi{cvxc8d)ZfaJHsh)7ARtE^&=Vrx$K4PzX=HVSXrTg@V6cghX5N244;Gv(3mv)v9#hR#%Tr&KY06` zqV%|@4I6P3XU9d}%{O+8E4%ryU7Hv2;JZysO#EA3LXM7(Mkgjze+p-Rm~>LO6kavM zc_f0k&`yb`3$#+4pPo*PjxJxo9MI;3`nPpIK0S?%j#3iw%XyLjv9Ynw2kWS=PCFp2YR#pZE3Mwm4r(IvHjuYhtxV;}CH^+-#{i=Vq zek33$4Kw2cK>c1;Ru&Tzv%S4Nw@_MI`saF6Ato~N>3%ylmyexYl)nR->O+HM@g~E5 za~56pMQ#-i4YloUTvl*yo9ML5;V#i8!TrcKs@h1)d6<5!MhN3fw6c8nl?Mtk!?^E= zk~O99_W>5?;H6};(|khI5)35t|H**zp+MrdL?8yk7giu>{Qh|JCO=jnuR*~1Nag$Y zp3VMH*fyNMKYsiO#UPoPoz0hDf@(ZPxX_#E-Bqr>g#`~MCn5=E6ReSripu+cVR$n` z2)5^Na}yT6=1L(pIr)<_9L8t9gPolQ-#4EPdJ$(Dc_5$f>+|?Hnl~zv{mI|j%uHfY zzUJm;y$-j_nL=r-PRUf7*{L#p@#7*DOA8A>F&-YC8gvF~Dk`Y_&>JQ z1Ox;ZpR8)2$VPUt7jwGYYL8L&lUs~$w&GLf$ zX8QW~6_dKFk!I8%_fXRSaaKN>gO7pgf)_bNW^`|d%mfAcFT~QFqR9!^l0_>zx zEBD>6q0?cY83-86-Xr)Zkh&2R^j=HA1MjyySMj;J_`;E*hw1Zvq?cj1PYFomDMk#vYMj_cX9 zySl#KjkL?$_|_BO58iCd&wuCgLrlSghd;H`^G=DBoRU&RT^%pv;^3g9uI{Qn+Kj7{ z&3o(UsI8{vyKFqvEzmgqiuK_GY}R|N;gJ!fOd37C^|f}_evgYy9Qq(?j&I*!rNi8G zc~^@@na_P~_b0PRf%O~jaLR@6N`6^*JJ{{>`hp$VgXGAQLVuC0zT9=6{WbTt#QKEF z2FgT5;b}frH8~3ssT-N*Y4%)vY8T)m8Ph<15`0~tpxJ&bmLmPkqs}&DXWFXybT7`k z?s@*gPh+I5Pcue$eol@no1DextaVH}I*j2{qr61ow}xlrc3I(|E6J_L0NW1Wl0evm zKp=vzmk%zz*R0vhSgfxF_cKqtLzErNulEj!m&;Vmlijrx88}wiX69hEi;`uE*XP>S zxt8a2=g(Ht_)mIWp6Qb8xAKhr+2OP2uhE%y21}SeE`%qBy^SOlq;FK6k@pg?i(nR7 z>RcIZ#7qAm`XJE1_3$NerP*dJ&&0xPcMsnW4;NQ-46AhpZiCoOEPo#rkIBu$gKknj z@U-ZIs)dDxj0_r1Pe8Wmdw9b4G&D5AnNq%+=yvc3vs^bv^W`-N0qR<+KYtQWDSlp5 z;+q}p=-~6C9|WLra#@v-=J`sY(s7|7o#S+WokMUQ#q%FvWSntYfUX3%-`;Hp%MH_= zK?sH%KW}JK!fnl{z-pKu9VqYx&Wcr&UEJLjyMpo{P%tt3->-OvfuLydp<%*I3e3BH9pDV*0zgwINpWe&jJEcW-7Z5XJDnT{_ zYGc|>Qw|Z|y0yRA#n1ZyT&aEDA>Nn-uAJWU2F+e1oGa$88{Pkl`t({D_x#5W?BU6c z>krd!E3Wnad$f74$ynl5)Ud_g(3~Y5p6fR6%ghvUPq_CJc3M!?|B&iZJoa

PO=P5ixulwp;m)-Pmekv%e;_CIV@6eID+7pSMZ%JYPUh zF~@y`-FJFhQZ&ih;8ocgkKKNwE2q|*LPzP3UEob&?Dq`wG_rYzk7f1DhiWXEnz!tt zG$_v|o}Qs*Hx8rDZq%(m93=7G>F?1$9c#Z`p4$2z^RB-l98-{Pz3O=-ih;`iSc_e+ ztu`}DB(9uwn|iA;@;bN5b-&!%u6#nKa)qp`Iw-E%CSO_F7ST;!fZB9CB5&G{BkL{* zprUS9>=(2oJ$=#Bir83Cqvc|cML(H;VUfEWQYi@uiNW;3!l%cNSa>q^O-&qbD{QUa zXRF+9!PXm$_g~;YXRRPuRuvY)E3$U%o}J0rW7M*zj9FV+&Q4GJd%(azd0(mFW`kfP z->mJUuC%GUlqVuq%sW^Zy0lDHhR^}7bBAlC=Zm4nJ* z>02STn>#!2BNfQdcX!)EYGvwIS71R?8qh4J0d1|irUok=$kZp92wK9!!wcMor-@EY zUDCAE(?_@V;Bl5M#@yI;XN5ummTiNo@WVEpe~|iTH(H5^{olgOVrc%_ZZ9<`Su#gp zdseL1IfAcQWpO?=1IOvAPw8dPt}ip$U}L-7qj}*V`jDsFp)v40e<8zfBqz+zUzpBh zcI}nTKUbX0p)Sj0Aup%U;CeNbt5^T=t*?!~;M)Kho*pIGuwT92`5uiW;^?|%P4a6$ zOL&;$ry=1;yY&ZmyI;d$Kd1?U40UMmoY&1wgu;-|x+vNXKmNI>(tBnL|H~=qNzy9n z_?QM21!`n0vxz$q}dDTW^V7m_2Vk9_A0Z{WK}P_H!JLV`SQPaaUrrg?STb+@384N<#;5EYy!o9Q)hNy!d z`H$bXOrIieUKZtBPoKg28%a!s9aq&m7S(UpPx8z7C?Ix`*AUI?RRM8UO#9nL&aF=c zjt(}%8c_nb)UO{BSN1kn0bA}yT!JI93Ee1!WR#UvRYm4AH1_ZZ0MZegolB%3`8v$i zVY5Wsg_klL=R@$F=&?Zm&$Gu9cYMrnvrV_cMEI4z0}NdO10D4J(W_$S3wgW?^+~mx z&XNM3Ox4mK zSNsi`%x(Uaz>`fROun_d*+Oof>_R(DkuokUsb*@EvbQS(rkbE^S00+FC;Yx1Y4*5c zV(z;(1zSu%NDl!TcwP0EA(BMR5M|J=o{Dg&1krnSI1pWSw3>gqaL=nIF0>9dctYC; zbJ*vIz{MX(o^Jt38?n1(?b$nIX#Oqisbr$KU&U%NhCl`g-VM0SQ+P`#x|TC^fQ=`pxUV%PV5~n>{K-LQ~tY zTT@PcV}m3cK0`vNnUBFDc;AW#>K$ExUckBUJC=`jv1P- z0|L;`sIih;{w-y|Z z&@yfB?ilIl2KSiuf-_Q#jFu>gmbybo0-F0efH^$7VZ%>OE`28oY6Gsx1uIhBo-&Iz zphE9>Ke2b^!^DK(y!nu>m7b1gxry;j^wV7hX6ZA0uwi{m9!8Jk9m^QfJ9I$H#XD6K z410uNFXEJu9>7x);x&9rWsGkCC89cP_y+u?6R;WQl~6Wt1(^Br2# z@gdDh*o`9jykgSXy>HVfsPWx!h=zE5cpG@xcvJW(dG-0W_=J=5o+gHnif&TqkXsel zB(ezu9eoddRTWVS7bk8r zOBZu1ZXc%?=zYS#5cd&9vrbkXW?&yDM`w3Y9|^`kBSg{sZ8Hxe_|Fgz2MI=fRSmG5 zi<=c#fcp_QFQX(b7z`G7v$Ph~l860E9Q`K2XzSteLX?Nc+uNJlo1fdo&4vdmA|k@W z%g4jV$Auoj<;;BlE3GXw{o{|vwPuT=i&^$o!89V#nVHAk?~g1zdwJi z)5^#0KboA~|78~1K%Uzk9w;|2&%ftJi;Ca2ifY*TSUKv;+c{Y|yQ6hT@(b{b{~7;( z_54TUKO_zQBMBAe`={hTdj2IT&U0(PKMeZITYp;7?vlh6=lQqmC2=_jF-kBn=-(;H z%jo#b?teJcCe>@|zk(dQE$+Q<8Hg#HE!J88`qaSCP=IG8IjOpQFV=haB~!_#4ePgC zeGTlYDEd+tmTWc@=2fb?alOw^iB7S35nF2H39`q9c!*-t}M1_#Qz5|LfE4JqT%R%^D5z+ z*L6ZH*OUhmE{~{=e)WAUtg0J%(Ar;;BcN7TGk!ue2XZXoF8Ao&*gB3Xu#K8XJ$xlO zXb3{BiG7$N)W=bP4L@BL#A>do3?d&RE8}86=}SNicyH)Qu|ZmDt!fu~^nXr~i{Lrr z#vL6i=1>BJ+ac#{E(*iiNPfmHHbw}2)akPAKz>mVBQ=4dimwwB?N}!fN@&;m`h`AT zKR%4~tB-}|$R_GMY&mh5iTKn{+_=5K?clL~H#{yf+_<8DQ=M8d&`QlFb%^5Lu0Yl^ zE^#^v&5=Wt-<1qk+G*HHQ08>u`~vEDQZVa*SuV(yx5YBLBhk+S)NNyQXgRLyceuva z`lYbfVnLP!Lf=;gkE+em4DN|w=!N?T+j_7eUAGls;<$IAj~>pppcFn|Qmga5E$iWs zm65&CQ^4u73S(}H?sz#XYZE<~#@zj7wpjILEsRJWm2-KyeVov@^?{TyMOLCIev-za zBwbQZ|4@Y#(UZ;fg{L^bju+d_=l*w(16qxd9p>+#Y+%y5rE_{w9&e0mPL zG?i-@u{$gAsU2+UC@bUhJnGobWhTWECAg;NO^NL%KIMndxZgaMGx$2uL!xy7Sr6;d zckvO=$o4k7s;-80>wRqGlxjsBSVA0OVdaZ;>8x1vT{jSU;C?@lcG9YAEm7 zb`|zZyvGZ9s{d#^3 zCxxj<)u?17WDW9g5|dGo={`E=qq4!pZ-pt((w-;{KG!#T`ZOUOY2)2UxXYF+mfTUI zW+Cs_3iB>7(VF@B89rl;>X1=?KtEdsXV!!Iwc~kaDQagb_CVTZaSdG7ly~IgL4>M7 z5kY6Sl+aQRfN+av9Ej=+kvvtF|V_NO8al-a-W<y*NjF&A;H?SkMtMH3$z-Zql4Ze$Y|Adda5P3tvLRvqTLOlCjDYZ~RF6#_2m7%T_n zNjaH|q4iJ&r9j0;^mtyAq9lX>;yt*fHQF~_@NJ4zD!)Q0^MQ)fm$~{i+js!G1@xKj zGp|H`-KsbI$>J;j=o37pz403zzM^>*TG((o2VP=Ld# z%H=V*4~t_?VyxT5ZT+$}j8r31|8E=ZClB_V%O z69zqGT=1)*~rQVK8)(tlGth*aTkk|2f| z<+4Q&a&Dj-UCU%NNvZxxW|}5zpQYl|TLZyuJ0{{joR^q#beL^Cvan%lqTm^tiWc6Y z`-_Y%2yc>UEndr|1B@8E>fOh43&)j;qTN5T1!hA%h4TA$!^R!q9=`??;ME+8Jf>7fLlt zEGn~y>QmFY^zJfQtu1-nyusH4p-on=lT-<3vd+>_hmH=TJ)zPQPogXgwL?G(XrBp! zw$KV510OlL3n!029@_$!l75b5gp`;DhCW5t&6JFK z%zX+Y?&(OcxNkY%rzY3zGu0#k&-=DR`lr^8^X@+Dm>{6ozen-xUEvU0#Nt_=(^A+n z^o?Jtu~#R5USqZPGh2b=*;?+&agXd)WwLh_-ok=UJ?}O(0n!dWPgptgo_or8$|!$= zG$jOX9IqEk9hNkhaP(MrZ$?b_+a^3>>GNrgqE1Kt@#P5RI9F>!x7C3FjTxQ>D$s%c# zu_)GQ^jN6O95`#+wQY13ba9NCn^tG*hzkWl_obci77^{#Jf*+yFd@o9CousyDdTwTn*zi z8}?O>o0Owy$7KyIiUQ}h^KSTy#gKvDzD^{oz2Y_zzW;!A5QX(vh=599r;w+`;W3XyCpCpHl|>B+ zElm2E%==XWb(78>iqwlObcn}^G+d+OCHoF@=ybq;zc2PMJHs*e%Ve>sq1k6@i~M-c zrBauav%*?@-35D1#OjbGiS2Q9`a;m0{F3#MqwpC}#(@s~pTgMmh`;uopZww0kNNRcJ zg1F5*xR>*CDUaIO$C|IThk9nlIi7!yLP-`1W~8YXmz7EQo!VMy2?z-28|1x@2h~{h zJcij_826<&Zp{2vQ=OQZ z#$qP^rM(sYGarNG0rGPyNgS$g5&klEkg336Lb*!(K%meUrB0%;O5 zbW5{WPFIP`I=5;BWhK5bLac}2V^ojUzO`~IOAML3^A~68-M=Wz{Ly~-^J%UJ zvc$Ff^dU}vr&l5YUBJlE@wJ!XV#aDF`>K&1P|d_$_^du^nB_t!#a_zx*S$u`$6t?U zae(XZo@cA{71a_pV!VWP3r`xe6b!jNm)pnjWR+ucx&kYs*u9^Bb!e&@EB?N|c7v28QqfWZPBM z0Z-U>K+I#nP~X?D8qFdAJ#Q17H79coZAaZzI8)`MdsdHF*T=XOB%0p&0V94RZUBBxG} zN5sVy-c-2I%88ScL5KiAEG6cRO*e~Awf!X}dKG@H3lH_m(J9{R*97%*s<0pW!+*qy z2!OZ|*nqWJ@reWxBU}00vD3`m70Q(=BxNX(G6cki%SwD0RZ;_g)WeVisaUWv~4zg)GSGZ?^=I@*FE!kg&*C z%s=YTbk)>X+2?0f+on_-BX%&?cA2Oc0;$d1a4B{3EfQENPNEjq%~LG9^m*a%!es7S ztnzUi-g3KG$;InSqCQ<-AA#wp(aO-!rk$%R31ohrovmCpeMfQRcAu6QHKMCx7blNM z*LL~S_4}jX#P7fSx9@vc>Y+R+Bp*&cp~f-eWOgGVg`A~tMU`~T-eEGp7e}veU;xe) zo?0;-7pM*dx%Jwi0v#ivEVzqpVC31|GCk40)_9P@$t6yxLv^G3OFXu3Mc&Wm0y@0 zjk4Eq>J`iFwq$&C!tylEtj(BAC<4_2R>jY0l1g4}rQ0Mg*kHh}H;M!9sUwS6R6ghh z#m9pl*I7NgE-=$jOQMP6n5~EtFrqGUS0vi$>{Nq7wliVF zgm}wXw4riq6qSnxbh67wU*$LA-XvGn3t%^D_?w!_A{M`keW#lwSoMG{u{l%9Q+)PS z?5#2Hp=quN7kYa%_sh{)kdV*3iXSk9tLuied#u_EXZ{4LOqeT^7jrxkkMq& z?(x-DOeqAL(UtvCJ#KxDjj7gGzNyV9w6#6vHW4bH`=1qt-yz|A!Yfrm96`H+d-QaS zxG%7e*_x1_SN0g_%WF3TEP9@gUl(aIP578;j@r<^p0{gJ%FIlDcM7>fhv4#!aEl=$ zKac4f&GhaNAAq9~LtM4vdx@yfrPLx8h_ya8z&Lrga268G(;Au@FgdV!d#+J;B`tcd zmA3CQT^?6=r0>6vL*E;e;>%7~&OJgwf{mw!<;%U zgw6g4j@E@P)%-6HEi64k+ZT&{HPe%mq<&XOmqUoXxB^TZiV*fcE1lRL9vR`{=05Wg zXQQH{3q0R0)Xdl>h6=lH3_D&fPR#|D5(}~fb zvzqK|hCX_#DoQF4Ze-9=j0vYf^;%i|!fdtG(0INwh!D7abmW>i8iD~$v6{J^5ARMu zFan80+B!IBXX=$bOZxN)ohN<*qW6jq&==Bmygp>+l5xUZJYomX@>`=w`3Q-J3J$aI&HLh`zO>RtwO1(;GuEB}F!? z0ld+xFc#ov{7#wt%SByX-QVBe#3XZP)g|cU{mu^hhRb~9qK+lN$G5a^Nd+|!A~gk4 z7$M}s5Zu=w_1xo4aYiPWA1*$Zvv5u|A z3O8+WTYutuv0a$iWj&f9F^EyZ&{$be03(yU*sI}b`4Ps8UPCcuK1c(ro&V=dA<9+OB?$-4k3NS)yxc~q)D@vYQWd2DWyGh9(%aZ%GQG)Hwu^5 zi8uqF4Gs=k_O*Fz6BA*(5F>@xQGQWTQDYcYGB$dp`V5Flfn-?Q`A*6Bz}3aioAc@R zmo|ZvWzRg%PwniKl$2gI5pKuoA*88M!~CQ0hfH7+5|Y2x*+om!fEy3yw{&-}iMIEh zM1s;a62r{A)w zuki0AvBK>?xv%uxE9&|>Gd_S$6OfVjItphk+Wsj1adFikvO8VT?-uU*7{-YUOMLgP z>+RZRPd7JUtn5c=Ll##}s*5PZLy*Qz?)3>ldxf zlfjtKMnBY!z)R!cD^Dgoxc*0jk>#D#{IaTiVnm%;ye*nYEciI6sy)~C$w`eZ~fq+O_{Bm%(BCc}+f2)+p%{%9|oArd!JWzmn1 z=umkb{Or0ZK@r2|c(gl;aEQ6CkDouMwsuOZ!fAD4(ZMvkD&V)9ueoeI2rm`%g*7t( zpb~(Z(gV5~F@uoFl*G>~J2$1l7^A@#bBk+@nD`w)_I_E5i2~J>h0v5ZscXvJ;GP%i z>Z9m8X2nr=#iyXFOIA5PJ`Sh{KF-62>!MmP66Pg&cnFU~czHEUOyU;qy?1kStDN6D zI0!mu+|0u@v`}u11|7e-8zDROtCZ4g&c_U^;mh1yjJy)|;=_s-^Es4UV`T6-9 z(c>d*F@*59MP*O$KQ_aCf5v7}idrH400-cR|*dRP=uU}z!UOfJ3NUIzlh{BDn; z@MD)2PH7B+01fYL@AiuizdhN}tFVN@C-09~hWIX=J^Tb`G;&~1|EAkCml|vF(%K-h z>_`G-`|=EU_-o3M&m4N26937IZ!@v1KREiIg2VsLp#Nr2|ruf$7(YlmwYy8=SDsP6J#h{n%F$aRVu@H$;@ck$phV`?C}00TS_w;R%dW6o#z5x;Si)t5h^q9x$MUc7M)d(|d2; z`F<7;5B&q=LSM@zlqTkBg>fux=cW3Wou~&v(ix0%0bSu%ncR3B;1D z#%+BN4Kw<6`&C5b_+2*X=Rdj$f6FE!^o0>`t`3JU0*k*W_#mU)?bV)&23P$$-#)%5KZJ8};Mb7JHKQ1I&iuX?9%T59sOt(=8kSl%d4#itMQ(%a@>s6o znE0t|t;pM|M&l`_ZwI6X!$=0Zy1n#yG-i%kSy^rSVp02Uk2C)|+}`dy9s~$SBYdi< zLh+m#}Oh?0aLM2T(*qPJ)XR!LTg5=8XX!m80;gy>~guP@PSl+_k_LkM9B z*2-$Dx6RsQby@3MzdwF6@Au7of82A=Gk5OHea@Ua^PKo+Mo$^&IOwRTs2KEgwLw%= zm&Pdk3GHPHeq&nQplnwlntGmvBq@WV|2i_kRiP|X;d8da5o!=DtqQ*E!1`^R+CBf375+S-gRN?HzMihktE7(9aE zCYXt4#eIK}`;DV`tmBi4O|!MwXjv9_cB+1mlZf`ZHKLcn0PGG1#}#$GY|s&@sHhlv z8!%O2NG|4nBXe{(0N&5bFlj8X>p}TWwI}*38gkl#**8T_h2wVKw450p;QLd~)eL;o zQxgrUJJ9kZd%t6+z^5it{l5ne(yWq8Y654S^9%3py4BCKmd`KhdtcAphGMOj1>i{? z-6Ly-0`?&j3vdbS?1ASiPzdSRhYzl8rV|Au=WqRFR3|<5lM@p9N>JF1kD!BN81U;) zw1OLvpHRMsf$}Nd#%nXY&rj#EWbT~Jj(FTj&3>$Xw$S~fqpI7dAI<`naff96=!Ug; z%zb=C_%-m;T)t_ArW=oCf`Ht%rVwl$@PyEj5ompU52kG z{GDlN^3&ostEm+N*bN54#FC6)&d zU-#kge;I(8CO0GsD8^q4OR~x~3kdt7hrFR|VZVm8YRt$7C0#3glHa;F{?)vFKNzIN z6J1tI&taXy_P~QT-z**&9r}6$iRdW3moTf`;X9>y%WZ5Z#?Q$XcU4I0eYJ)UWL$#l zn=zWGQ4LGP{ZWz4qSICiwFNsQ$zB;TL6ckgynqvUb}MR~ZMs%Rpy==Y#;|RU@TFrC zu`6$X90bHY9#fk)w-FXU=6^k@PcY~_JA{r(WO~K(tdv$?wNpzTel0TmoroB8&XoJq z>{Bf41hx5Yrul%G*7{NuY}Vmx3UhjWZ7qL|e(Q9IDsIBE1>@0VL9(^S+KriS%7uMo zKzU5#BOZ=4!G@5k67p3LBlWwvff7kaHWFyJ!1m<1_v4kdhMt;8Pve{0aBDcw-Ernk zSXV_=|IuY5!rjeU6TMk3LrIqcqq#3jFhmb5u}=e$DmZxVTOKjFTfp9JUOJO=&K^iF z)Mn_Z3&e))l5vcyFuC^q-ClXEnFx?e{matwe#@8s+vdV7-w1|j_=X90=Sh;(r`BG` zo3+@b=P?>RtAY_gEzSg0)uExTXixr|YKIf(LXI#?Le!UFY0ag%yc^9QN^l<*@Xd#X zBW8mDM$Pg3K%X$kR!H5e5hN|rB@AQ6Q7I+QIM+E10$xuDJzic$j?LU^(;oH8Gv*wuCpqMi0?MuHS zrVWiee(@JiSzAp_!fHoVm2hc|7#LC7;;790x|w(&lK}ZO?g-z`djqY6l_t&#Ez~{m zMW^r`pl35B{3E(gVM=GDU!*;-!_UaCj(9LZOx~Ha82bHVJ-I$HqZ)a;aAE(myzSes z3fGK0lBL>{6v7CvymH}|$sd5x3RnwhW`*3Of~JmxKDUJ3{jxxpt=oWm*&W4vCb-2e z^J{Ua7pg6i?gO7K9FX)hVZ!QD{L&|*`RfOR`-U*3Rp`ft8@k{rzP1Jx(sIQt(X2=# zCwMRS&Z6SJqUrZ_=XV=onle598^?gIZY`IFqZGvsV{#OWdQYwK)X#8N7~MOL-gZ=% zCqWsY{?z>l+tlTD=XRyo67;v*a}M=XmGiB~e(#=w-Pi+&bIG#fcxj=Oc?l=D_EP;2 z)T)t~E>Zpc>rY(4(Tw-cs8d>I0j6_0rgtcFb8{9c)xh0(!AqqdwY0Rj3k4#K3=Ejo z1+eyvuL+IPRYD&tG&>M>>g} zfm(tCV~w8oGatcfmayfV%)Qsm=8iwmi|=O*vWpHc$oNx))NU?ZB=PyycY)!kR?Yk3R}K1ny?%@bauO>sh9B&7HijS=J3BuX>_Dr@op+zVnPB^ zQi_Tq8uf9~>N(jIDb*z5qRS~cpO8s$?dGm{)=sOo`DqaI8i#9&ZZV23*%H*yt z=km+L_U^bdeyYEy>pzzxzSOi$v&Vb;&?^OjPtytovVHk*(@ zmp!uXr}P4a?%zP>BM=CDfbvO3==+nL;D#1$ekClbMa$?d3zww3PNCE@ha^G#kfrx+ zaC3ev4Ov$<>j=|X%^A~Ffg{+V1lhlx{w)5%B{Q2-ZMAcExwYWdnPdS*x;Y`Fkp#RdM|zDSzQ7A6NDmt-$3p>6!8yjL$x2=QDG_Iq_O- zdl`KziA{f2hRW}im$Z7ij`g(WJ&!2LRf~Mq&lb*_s7`$47&@s$SR-8<(a#R8UhwhW z-Q(X$WEV|EP2L3G!LJ0a3=u$k+kkkz{e{taB@_p7#sy$DMthz`5!Y+Sk8*wTJLsz_w!R;ZVNk)jfc9rf8}iZ5T~g*!Pp zX@fSY@7?^0X>sA_=N~S1RK;O*)hK_9#3P3;sMK!?!Y;u22q|c;aOv@h2v(dT*mRRb zUg|+Q6$i~))J^565{A*Xkh_$JCUl3&yTnYiVBAU2t?x~nBwVi&KAW-1S7yuOY~9+LM`${ssZ>C$NfJr+(SgqmKlD!}m6h7|=`K z04Ct~`8OSRvdK!3N)vu%)e-1o5Ta7a_|Db|$J5GP#QqvOd{yGxXjzOg%*yJcZ+VuP z^pSz_88^9HU?8hr*(k6TFPme&SX=Ix)6&yxRV3LxS{7#{`AIU=##yqd%M@)2WneV6==uQVWFbod;YcIyFaC_gBKxTco_qZ#AKg}t{k>Q#9YtLM+u zFo7)t1P93m2MO8Z%MQQ9-+Cy-*nNFws6geXFL6Dxg*163FqtgpIow}6+^=-qT^KGa zD;tg+hCm=^DOVuA>KkiNhgh`g+|hBZVGX<7Y%`!j%N4|6?Mrwgm(p?uYG^x?`n7BB z|GX<*{A08FIk4G1|7x({@-i=cdV2bykR1)gcUwveSA=h=NPAfAjBy=l$+=mtC+jiX zBh!*zfFHJHf7`MSo_Q*Ceq(c*+N8ClZ#DH}gAmf0S{wtu5wabjJ>h_7vsUtSo0<47wlf-O9F}dNB0pIwNCsjN*w>E)1B$ zZgu3*2rS9albw2Eoi*SWXINto+%3#aUh^P?sC8$1x)*&N2}p+Vj6YCODP!GO!#NsB zC_1|?wDioNSOlk=Jz8^R>4{00cd_zim9EaR{{YBR^jX5$gAB80y$7;FKPb+HgwKHTcDe>x3)<4>%tX?EXO5^R z*4wib5DohJwZNPl97;+`cQ@A7Ombimor<0NIVJw%htrotVBmAP*;+@Vd&f#SrZQ!R zoJ|5)*RewqJ+~CK3xGzZl`h@$I8V_2Ns(SqkS@hmm#89nUDpp0*i&rC;HRI|RJ5I_ zmExQW|M9>t!fP4pzXI)l-TD6o+W$J6NBmel5~SVmD1u&q5_qZfbd0ncG+#yi4;D@8 AQUCw| From 48f594e0dc4a1870dfd26ce66e348635165b7ae1 Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Thu, 2 Jul 2026 11:49:22 +0200 Subject: [PATCH 02/32] sync config sample from core --- .../server/config_sample_php_parameters.adoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/modules/admin_manual/pages/configuration/server/config_sample_php_parameters.adoc b/modules/admin_manual/pages/configuration/server/config_sample_php_parameters.adoc index c35bcca3a..a78329a2b 100644 --- a/modules/admin_manual/pages/configuration/server/config_sample_php_parameters.adoc +++ b/modules/admin_manual/pages/configuration/server/config_sample_php_parameters.adoc @@ -314,6 +314,24 @@ These appear on the User page, on user's Personal pages and are used by some app 'allow_user_to_change_mail_address' => true, .... +=== Allow or disallow the group administrator (subadmin) feature +`true` allows administrators to delegate user management of specific groups +to non-admin users (group admins / subadmins). + +`false` (default) disables the feature entirely: existing group-admin +assignments are ignored and no new ones can be created. + +SECURITY NOTE: this feature is disabled by default as a risk-mitigation. +Only enable it if you require delegated group administration and understand +that group admins can manage users within their groups. + +==== Code Sample + +[source,php] +.... +'allow_subadmins' => false, +.... + === Define the lifetime of the remember-login cookie The remember-login cookie is set when the user clicks the `remember` checkbox on the login screen. The default is 15 days, expressed in seconds. @@ -1619,6 +1637,7 @@ server configuration above and perform HA on the hostname. Redis Cluster support requires the php module phpredis in version 3.0.0 or higher. Available failover modes: + - \RedisCluster::FAILOVER_NONE - only send commands to primary nodes (default) - \RedisCluster::FAILOVER_ERROR - failover to replicas for read commands if primary is unavailable - \RedisCluster::FAILOVER_DISTRIBUTE - randomly distribute read commands across primary and replica nodes From 6af8b39922b5563e9147155ea0eb40795c393a6c Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Thu, 2 Jul 2026 12:39:20 +0200 Subject: [PATCH 03/32] add envvar list --- .../pages/configuration/envvars/envvars.adoc | 513 ++++++++++++++++++ modules/admin_manual/partials/nav.adoc | 2 + 2 files changed, 515 insertions(+) create mode 100644 modules/admin_manual/pages/configuration/envvars/envvars.adoc diff --git a/modules/admin_manual/pages/configuration/envvars/envvars.adoc b/modules/admin_manual/pages/configuration/envvars/envvars.adoc new file mode 100644 index 000000000..6a646b607 --- /dev/null +++ b/modules/admin_manual/pages/configuration/envvars/envvars.adoc @@ -0,0 +1,513 @@ += Environment Variables +:toc: right +:description: This page provides a list of available environment variables. + +{description} + +- `OWNCLOUD_ACCESSLOG_LOCATION=/dev/stdout` + + Location of the access log. +- `OWNCLOUD_ACCOUNTS_ENABLE_MEDIAL_SEARCH=` + + Allow medial search on user account properties (see xref:configuration/server/config_sample_php_parameters.adoc#allow-medial-search-on-user-account-properties[documentation]). +- `OWNCLOUD_ACTIVITY_EXPIRE_DAYS=` + + Activity expiration in days (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-activity[documentation]). +- `OWNCLOUD_ADMIN_AUDIT_GROUPS=` + + Restrict audit logging to specific groups. Comma-separated list of group names (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-admin-audit[documentation]). +- `OWNCLOUD_ANTIVIRUS_AV_CMD_OPTIONS=` + + Command line options for the clamscan antivirus scanner (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-files-antivirus[documentation]). +- `OWNCLOUD_ANTIVIRUS_AV_PATH=` + + Path to the clamscan binary in the container (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-files-antivirus[documentation]). +- `OWNCLOUD_ADMIN_PASSWORD=admin` + + ownCloud admin password. +- `OWNCLOUD_ADMIN_USERNAME=admin` + + ownCloud admin username. +- `OWNCLOUD_ALLOW_SUBADMINS=` + + Enable or disable the subadmin (group admin) feature. Set to `true` to enable; unset leaves it disabled (ownCloud core default) (see xref:configuration/server/config_sample_php_parameters.adoc#allow-or-disallow-the-group-administrator-subadmin-feature[documentation]). +- `OWNCLOUD_ALLOW_USER_TO_CHANGE_DISPLAY_NAME=` + + Allow or disallow users to change their display names (see xref:configuration/server/config_sample_php_parameters.adoc#allow-or-disallow-users-to-change-their-display-names[documentation]). +- `OWNCLOUD_ALLOW_USER_TO_CHANGE_MAIL_ADDRESS=` + + Allow or disallow users to change their email addresses (see xref:configuration/server/config_sample_php_parameters.adoc#allow-or-disallow-users-to-change-their-email-addresses[documentation]). +- `OWNCLOUD_APPS_DEPRECATED=` + + List of deprecated apps that must be removed (automatically) before performing an ownCloud upgrade to avoid upgrade issues. +- `OWNCLOUD_APPS_DISABLE=` + + List of apps to disable on container startup. +- `OWNCLOUD_APPS_ENABLE=$\{OWNCLOUD_APPS_INSTALL}` + + List of apps to enable on container startup. +- `OWNCLOUD_APPS_INSTALL=` + + List of apps to install on container startup. +- `OWNCLOUD_APPS_INSTALL_MAJOR=false` + + By default ownCloud will not install a new major version of an already installed app. To enforce major updates for apps this option need to be set to `true`. +- `OWNCLOUD_APPS_UNINSTALL=` + + List of apps to remove on container startup. +- `OWNCLOUD_BACKGROUND_MODE=cron` + + Service to execute ownCloud backgrouns jobs. It is recommended to keep the default (see xref:configuration/server/background_jobs_configuration.adoc[documentation]). +- `OWNCLOUD_BLACKLISTED_FILES=` + + Define blacklisted files (see xref:configuration/server/config_sample_php_parameters.adoc#define-blacklisted-files[documentation]). +- `OWNCLOUD_BLACKLISTED_FILES_REGEX=` + + Define blacklisted files using regular expressions. Comma-separated list of regex patterns (see xref:configuration/server/config_sample_php_parameters.adoc#define-blacklisted-files[documentation]). +- `OWNCLOUD_CACHE_CHUNK_GC_TTL=` + + Define the TTL for garbage collection (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-ttl-for-garbage-collection[documentation]). +- `OWNCLOUD_CACHE_PATH=` + + Define the location of the cache folder (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-location-of-the-cache-folder[documentation]). +- `OWNCLOUD_CHECK_FOR_WORKING_WELLKNOWN_SETUP=` + + Check for a .well-known setup (see xref:configuration/server/config_sample_php_parameters.adoc#check-for-a-well-known-setup[documentation]). +- `OWNCLOUD_CIPHER=` + + Define the default cipher for encrypting files (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-default-cipher-for-encrypting-files[documentation]). +- `OWNCLOUD_COLLABORA_GROUP=` + + Restrict access to Collabora/Richdocuments to a specific group. Only one group can be defined. Default is empty (no restriction) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-richdocuments[documentation]). +- `OWNCLOUD_COMMENTS_MANAGER_FACTORY=` + + Define an alternative Comments Manager (see xref:configuration/server/config_sample_php_parameters.adoc#define-an-alternative-comments-manager[documentation]). +- `OWNCLOUD_CORS_ALLOWED_DOMAINS=` + + Define global list of CORS domains (see xref:configuration/server/config_sample_php_parameters.adoc#define-global-list-of-cors-domains[documentation]). +- `OWNCLOUD_CROND_ENABLED=true` + + Enable or disable the system cron service. Required for `OWNCLOUD_BACKGROUND_MODE=cron`. +- `OWNCLOUD_CROND_SCHEDULE="*/1 * * * *"` + + Cron schedule to run ownCloud background jobs. +- `OWNCLOUD_CRON_LOG=` + + Define logging if cron ran successfully(see xref:configuration/server/config_sample_php_parameters.adoc#define-logging-if-cron-ran-successfully)) +- `OWNCLOUD_CSRF_DISABLED=` + + Enable or disable ownCloud’s built-in CSRF protection mechanism (see xref:configuration/server/config_sample_php_parameters.adoc#enable-or-disable-ownclouds-built-in-csrf-protection-mechanism[documentation]). +- `OWNCLOUD_CUSTOMCLIENT_ANDROID=` + + Override the Android client download URL shown in the first-run wizard (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-firstrunwizard[documentation]). +- `OWNCLOUD_CUSTOMCLIENT_DESKTOP=` + + Override the desktop client download URL shown in the first-run wizard (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-firstrunwizard[documentation]). +- `OWNCLOUD_CUSTOMCLIENT_IOS=` + + Override the iOS client download URL shown in the first-run wizard (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-firstrunwizard[documentation]). +- `OWNCLOUD_DAV_CHUNK_BASE_DIR=` + + Define the DAV chunk base directory (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-dav-chunk-base-directory[documentation]). +- `OWNCLOUD_DAV_ENABLE_ASYNC=` + + Enable or disable async DAV extensions (see xref:configuration/server/config_sample_php_parameters.adoc#enable-or-disable-async-dav-extensions[documentation]). +- `OWNCLOUD_DAV_PROPFIND_DEPTH_INFINITY=` + + Allow Depth: infinity PROPFIND requests (see xref:configuration/server/config_sample_php_parameters.adoc#enable-or-disable-async-dav-extensions[documentation]). +- `OWNCLOUD_DB_FAIL=true` + + Exit container if the database can't reached during the startup. +- `OWNCLOUD_DB_HOST=` + + Define the database server host name (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-database-server-host-name[documentation]). +- `OWNCLOUD_DB_NAME=owncloud` + + Define the ownCloud database name (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-owncloud-database-name[documentation]). +- `OWNCLOUD_DB_PASSWORD=` + + Define the password for the database user (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-password-for-the-database-user[documentation]). +- `OWNCLOUD_DB_PREFIX=oc_` + + Define the prefix for the ownCloud tables in the database (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-prefix-for-the-owncloud-tables-in-the-database[documentation]). +- `OWNCLOUD_DB_TIMEOUT=180` + + Time to wait for a successful connection to the database on container startup. +- `OWNCLOUD_DB_PLATFORM=` + + Force a specific Doctrine DBAL platform class, e.g. for MariaDB compatibility (see xref:configuration/server/config_sample_php_parameters.adoc#identify-the-database-used-with-this-installation[documentation]). +- `OWNCLOUD_DB_TYPE=sqlite` + + Identify the database used with this installation (see xref:configuration/server/config_sample_php_parameters.adoc#identify-the-database-used-with-this-installation[documentation]). +- `OWNCLOUD_DB_USERNAME=` + + Define the ownCloud database user (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-owncloud-database-user[documentation]). +- `OWNCLOUD_DEBUG=` + + Place this ownCloud instance into debugging mode (see xref:configuration/server/config_sample_php_parameters.adoc#place-this-owncloud-instance-into-debugging-mode[documentation]). +- `OWNCLOUD_DEFAULT_APP=` + + Define the default app to open on user login (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-default-app-to-open-on-user-login[documentation]). +- `OWNCLOUD_DEFAULT_LANGUAGE=en` + + Define the default language of your ownCloud instance (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-default-language-of-your-owncloud-instance[documentation]). +- `OWNCLOUD_DOMAIN=localhost` + + Base domain used in `OWNCLOUD_OVERWRITE_CLI_URL` by default. +- `OWNCLOUD_TRUSTED_DOMAINS=$\{OWNCLOUD_DOMAIN}` + + List of trusted domains to prevent host header poisoning (see xref:configuration/server/config_sample_php_parameters.adoc#define-list-of-trusted-domains-that-users-can-log-into[documentation]). Multiple domains need to be comma-separated. +- `OWNCLOUD_ENABLED_PREVIEW_PROVIDERS=` + + Define preview providers (see xref:configuration/server/config_sample_php_parameters.adoc#define-preview-providers[documentation]). +- `OWNCLOUD_ENABLE_AVATARS=` + + Enable or disable avatars or user profile photos (see xref:configuration/server/config_sample_php_parameters.adoc#enable-or-disable-avatars-or-user-profile-photos[documentation]). +- `OWNCLOUD_ENABLE_CERTIFICATE_MANAGEMENT=` + + Allow the configuration of system-wide trusted certificates (see xref:configuration/server/config_sample_php_parameters.adoc#allow-the-configuration-of-system-wide-trusted-certificates[documentation]). +- `OWNCLOUD_ENABLE_PREVIEWS=` + + Enable preview generation (see xref:configuration/server/config_sample_php_parameters.adoc#enable-preview-generation[documentation]). +- `OWNCLOUD_ENABLE_OIDC_REWRITE_URL=false` + + Rewrites OpenID Connect wellknown URL `.well-known/openid-configuration` to the ownCloud OIDC configuration endpoint (see xref:configuration/user/oidc/oidc.adoc#set-up-service-discovery[documentation]). +- `OWNCLOUD_ENTRYPOINT_INITIALIZED=true` + + Enable or disable loading of files from `/etc/entrypoint.d`. It is recommended to keep the default. +- `OWNCLOUD_ERRORLOG_LOCATION=/dev/stderr` + + Output location for the Apache error log. +- `OWNCLOUD_EXCLUDED_DIRECTORIES=` + + Define excluded directories (see xref:configuration/server/config_sample_php_parameters.adoc#define-excluded-directories[documentation]). +- `OWNCLOUD_EXCLUDED_DIRECTORIES_REGEX=` + + Define excluded directories using regular expressions. Comma-separated list of regex patterns (see xref:configuration/server/config_sample_php_parameters.adoc#define-excluded-directories[documentation]). +- `OWNCLOUD_FILELOCKING_ENABLED=${OWNCLOUD_LOCKING_ENABLED:-true}` + + Enable transactional file locking (see xref:configuration/server/config_sample_php_parameters.adoc#enable-transactional-file-locking[documentation]). +- `OWNCLOUD_FILELOCKING_TTL=` + + Define the TTL for file locking (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-ttl-for-file-locking[documentation]). +- `OWNCLOUD_FILESYSTEM_CACHE_READONLY=` + + Prevent cache changes due to changes in the filesystem (see xref:configuration/server/config_sample_php_parameters.adoc#prevent-cache-changes-due-to-changes-in-the-filesystem[documentation]). +- `OWNCLOUD_FILESYSTEM_CHECK_CHANGES=` + + Define how often filesystem changes are detected (see xref:configuration/server/config_sample_php_parameters.adoc#define-how-often-filesystem-changes-are-detected[documentation]). +- `OWNCLOUD_FILESYSTEM_MAX_MOUNTPOINT_MOVE_ATTEMPTS=` + + Maximum number of failed mountpoint rename attempts before giving up (see xref:configuration/server/config_sample_php_parameters.adoc#define-how-often-filesystem-changes-are-detected[documentation]). +- `OWNCLOUD_FILES_EXTERNAL_ALLOW_NEW_LOCAL=$\{OWNCLOUD_ALLOW_EXTERNAL_LOCAL_STORAGE}` + + Enable or disable the files_external local mount option (see xref:configuration/server/config_sample_php_parameters.adoc#enable-or-disable-the-files_external-local-mount-option[documentation]). +- `OWNCLOUD_GRACE_PERIOD_DEMO_KEY_LINK=` + + Override the link shown in the grace period popup (see xref:enterprise/installation/install.adoc#license-keys[documentation]). +- `OWNCLOUD_GRACE_PERIOD_DEMO_KEY_SHOW_POPUP=` + + Show or hide the grace period demo key popup (see xref:enterprise/installation/install.adoc#license-keys[documentation]). +- `OWNCLOUD_FORWARDED_FOR_HEADERS=` + + Define forwarded_for_headers (see xref:configuration/server/config_sample_php_parameters.adoc#define-forwarded_for_headers[documentation]). +- `OWNCLOUD_GROUPS_ENABLE_MEDIAL_SEARCH=` + + Allow medial search on group IDs (see xref:configuration/server/config_sample_php_parameters.adoc#allow-medial-search-on-user-account-properties[documentation]). +- `OWNCLOUD_HASHING_COST=` + + Define the hashing cost (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-hashing-cost[documentation]). +- `OWNCLOUD_HAS_INTERNET_CONNECTION=` + + Check for an internet connection (see xref:configuration/server/config_sample_php_parameters.adoc#check-for-an-internet-connection[documentation]). +- `OWNCLOUD_INTERNET_CONNECTIVITY_DETECT_URL=` + + URL used to detect internet connectivity (see xref:configuration/server/config_sample_php_parameters.adoc#check-for-an-internet-connection[documentation]). +- `OWNCLOUD_HTACCESS_REWRITE_BASE=$\{OWNCLOUD_SUB_URL}` + + Define clean URLs without /index.php (see xref:configuration/server/config_sample_php_parameters.adoc#define-clean-urls-without-index-php[documentation]). +- `OWNCLOUD_HTTP_COOKIE_SAMESITE=` + + Define how to relax same site cookie settings (see xref:configuration/server/config_sample_php_parameters.adoc#define-how-to-relax-same-site-cookie-settings[documentation]). +- `OWNCLOUD_INTEGRITY_EXCLUDED_FILES=` + + Define files that are excluded from integrity checking (see xref:configuration/server/config_sample_php_parameters.adoc#define-files-that-are-excluded-from-integrity-checking[documentation]). +- `OWNCLOUD_INTEGRITY_IGNORE_MISSING_APP_SIGNATURE=` + + Define apps or themes that are excluded from integrity checking (see xref:configuration/server/config_sample_php_parameters.adoc#define-apps-or-themes-that-are-excluded-from-integrity-checking[documentation]). +- `OWNCLOUD_KNOWLEDGEBASE_ENABLED=` +- `OWNCLOUD_APPSTORE_ENABLED=` +- `OWNCLOUD_LDAP_IGNORE_NAMING_RULES=` + + Ignore LDAP naming rules (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-ldap[documentation]). +- `OWNCLOUD_LICENSE_KEY=` + + ownCloud Enterprise License Key (see xref:enterprise/installation/install.adoc#license-keys[documentation]). +- `OWNCLOUD_LICENSE_CLASS=` +- `OWNCLOUD_LOGIN_ALTERNATIVES=` + + Define additional login buttons on the logon screen (see xref:configuration/server/config_sample_php_parameters.adoc#define-additional-login-buttons-on-the-logon-screen[documentation]). +- `OWNCLOUD_LOGIN_POLICY_ORDER=` + + Ordered list of login policy class names. Comma-separated (see xref:configuration/server/config_sample_php_parameters.adoc#define-additional-login-buttons-on-the-logon-screen[documentation]). +- `OWNCLOUD_LOG_CONDITIONS=` + + Define conditional logging rules as a JSON-encoded array of condition objects, e.g. `[{"apps":["files_external"],"loglevel":0}]` (see xref:configuration/server/config_sample_php_parameters.adoc#define-log-conditions[documentation]). +- `OWNCLOUD_LOG_DATE_FORMAT=` + + Define the log date format (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-log-date-format[documentation]). +- `OWNCLOUD_LOG_FILE=$\{OWNCLOUD_VOLUME_FILES}/owncloud.log` + + Define the log path (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-log-path[documentation]). +- `OWNCLOUD_LOG_LEVEL=` + + Define the log level (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-log-level[documentation]). +- `OWNCLOUD_LOG_ROTATE_SIZE=$\{OWNCLOUD_LOGSIZE}` + + Define the maximum log rotation file size (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-maximum-log-rotation-file-size[documentation]). +- `OWNCLOUD_LOG_TIMEZONE=` + + Define the log timezone (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-log-timezone[documentation]). +- `OWNCLOUD_LOST_PASSWORD_LINK=` + + Define a custom link to reset passwords (see xref:configuration/server/config_sample_php_parameters.adoc#define-a-custom-link-to-reset-passwords[documentation]). +- `OWNCLOUD_MAIL_DOMAIN=` + + Define the email RETURN address (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-email-return-address[documentation]). +- `OWNCLOUD_MAIL_FROM_ADDRESS=` + + Define the email FROM address (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-email-from-address[documentation]). +- `OWNCLOUD_MAIL_REMOVE_SENDER_DISPLAY_NAME=` + + Strip the display name from the From header in sharing notification emails (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-email-from-address[documentation]). +- `OWNCLOUD_MAIL_SMTP_AUTH=` + + Define the SMTP authentication (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-smtp-authentication[documentation]). +- `OWNCLOUD_MAIL_SMTP_AUTH_TYPE=` + + Define the SMTP authentication type (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-smtp-authentication-type[documentation]). +- `OWNCLOUD_MAIL_SMTP_DEBUG=` + + Enable or disable SMTP class debugging (see xref:configuration/server/config_sample_php_parameters.adoc#enable-or-disable-smtp-class-debugging[documentation]). +- `OWNCLOUD_MAIL_SMTP_HOST=` + + Define the IP address of your mail server host (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-ip-address-of-your-mail-server-host[documentation]). +- `OWNCLOUD_MAIL_SMTP_MODE=` + + Define the mode for sending an email (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-mode-for-sending-an-email[documentation]). +- `OWNCLOUD_MAIL_SMTP_NAME=` + + Define the SMTP authentication username (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-smtp-authentication-username[documentation]). +- `OWNCLOUD_MAIL_SMTP_PASSWORD=` + + Define the SMTP authentication password (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-smtp-authentication-password[documentation]). +- `OWNCLOUD_MAIL_SMTP_PORT=` + + Define the port for sending an email (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-port-for-sending-an-email[documentation]). +- `OWNCLOUD_MAIL_SMTP_SECURE=` + + Define the SMTP security style (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-smtp-security-style[documentation]). +- `OWNCLOUD_MAIL_SMTP_TIMEOUT=` + + Define the SMTP server timeout (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-smtp-server-timeout[documentation]). +- `OWNCLOUD_MAINTENANCE=$\{OWNCLOUD_MAINTENANCE_MODE}` + + Enable maintenance mode to disable ownCloud (see xref:configuration/server/config_sample_php_parameters.adoc#enable-maintenance-mode-to-disable-owncloud[documentation]). +- `OWNCLOUD_MARKETPLACE_CA=` + + Developer option to connect to Marketplace testing instances. +- `OWNCLOUD_MARKETPLACE_KEY=$\{OWNCLOUD_MARKETPLACE_APIKEY}` + + Developer option to get access to unreleased Apps in your Marketplace account. +- `OWNCLOUD_MEMCACHED_ENABLED=false` + + Enabled memory caching via memcached (see xref:configuration/server/config_sample_php_parameters.adoc#memory-caching-backend-for-distributed-data[documentation]). +- `OWNCLOUD_MEMCACHED_HOST=memcached` + + Defines the hosts for memcached (see xref:configuration/server/config_sample_php_parameters.adoc#define-server-details-for-memcached-servers-to-use-for-memory-caching[documentation]). +- `OWNCLOUD_MEMCACHED_OPTIONS=` + + Define connection options for memcached (see xref:configuration/server/config_sample_php_parameters.adoc#define-connection-options-for-memcached[documentation]). +- `OWNCLOUD_MEMCACHED_PORT=11211` + + Defines the ports for memcached (see xref:configuration/server/config_sample_php_parameters.adoc#define-server-details-for-memcached-servers-to-use-for-memory-caching[documentation]). +- `OWNCLOUD_MEMCACHED_STARTUP_TIMEOUT=180` + + Time to wait for a successful connection to the memcached service on container startup. +- `OWNCLOUD_MEMCACHE_LOCAL=${OWNCLOUD_CACHING_CLASS:-\\OC\\Memcache\\APCu}` + + Memory caching backend for locally stored data (see xref:configuration/server/config_sample_php_parameters.adoc#memory-caching-backend-for-locally-stored-data[documentation]). +- `OWNCLOUD_MEMCACHE_LOCKING=` + + Define the memory caching backend for file locking (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-memory-caching-backend-for-file-locking[documentation]). +- `OWNCLOUD_METRICS_SHARED_SECRET=` + + Secret required to access the Metrics dashboard (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-metrics[documentation]). +- `OWNCLOUD_MAX_EXECUTION_TIME=3600` + + Sets PHP option `max_execution_time`. It is recommended to keep the default (see xref:configuration/files/big_file_upload_configuration.adoc#configuring-via-php-global-settings[documentation]). +- `OWNCLOUD_MAX_FILESIZE_ANIMATED_GIFS_PUBLIC_SHARING=` + + Define the maximum filesize for animated GIF´s (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-maximum-filesize-for-animated-gifs[documentation]). +- `OWNCLOUD_MAX_INPUT_TIME=3600` + + Sets PHP option `max_input_time`. It is recommended to keep the default (see xref:configuration/files/big_file_upload_configuration.adoc#configuring-via-php-global-settings[documentation]). +- `OWNCLOUD_MAX_UPLOAD=20G` + + Sets PHP option `upload_max_filesize` and `post_max_size`. It is recommended to keep the default (see xref:configuration/files/big_file_upload_configuration.adoc#configuring-via-php-global-settings[documentation]). +- `OWNCLOUD_MEMORY_LIMIT=512M` + + Sets PHP option `memory_limit`. It is recommended to keep the default (see xref:configuration/files/big_file_upload_configuration.adoc#configuring-via-php-global-settings[documentation]). +- `OWNCLOUD_MINIMUM_SUPPORTED_DESKTOP_VERSION=` + + Define the minimum supported ownCloud desktop client version (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-minimum-supported-owncloud-desktop-client-version[documentation]). +- `OWNCLOUD_MOUNT_FILE=` +- `OWNCLOUD_MYSQL_UTF8MB4=$\{owncloud_utf8mb4_enabled}` + + Define MySQL 3/4 byte character handling (see xref:configuration/server/config_sample_php_parameters.adoc#define-mysql-34-byte-character-handling[documentation]). +- `OWNCLOUD_OBJECTSTORE_BUCKET=owncloud` + + Bucket name to store data. +- `OWNCLOUD_OBJECTSTORE_CLASS=OCA\Files_Primary_S3\S3Storage` + + Class to use for the objectstore. It is recommended to keep the default (see xref:configuration/files/external_storage/s3_compatible_object_storage_as_primary.adoc[documentation]). +- `OWNCLOUD_OBJECTSTORE_ENABLED=false` + + Enabled or disables the objectstore configuration. +- `OWNCLOUD_OBJECTSTORE_ENDPOINT=https://s3.$\{OWNCLOUD_OBJECTSTORE_REGION}.amazonaws.com` + + Endpoint of the objectstore provider (see xref:configuration/files/external_storage/s3_compatible_object_storage_as_primary.adoc[documentation]). +- `OWNCLOUD_OBJECTSTORE_KEY=` + + Access key for the objectstore (see xref:configuration/files/external_storage/s3_compatible_object_storage_as_primary.adoc[documentation]). +- `OWNCLOUD_OBJECTSTORE_PATHSTYLE=false` + + Enabled or disables path style for the objectstore (see xref:configuration/files/external_storage/s3_compatible_object_storage_as_primary.adoc[documentation]). +- `OWNCLOUD_OBJECTSTORE_REGION=us-east-1` + + Objectstore region to use (see xref:configuration/files/external_storage/s3_compatible_object_storage_as_primary.adoc[documentation]). +- `OWNCLOUD_OBJECTSTORE_SECRET=` + + Secret key for the objectstore (see xref:configuration/files/external_storage/s3_compatible_object_storage_as_primary.adoc[documentation]). +- `OWNCLOUD_OBJECTSTORE_VERSION=2006-03-01` + + Objectstore version to use (see xref:configuration/files/external_storage/s3_compatible_object_storage_as_primary.adoc[documentation]). +- `OWNCLOUD_OBJECTSTORE_PART_SIZE=5242880` + + Part size, in bytes, applies to uploads between ownCloud and S3 (see xref:configuration/files/external_storage/s3_compatible_object_storage_as_primary.adoc[documentation]). +- `OWNCLOUD_OBJECTSTORE_CONCURRENCY=3` + + Maximum number of concurrent UploadPart operations allowed during the multipart upload (see xref:configuration/files/external_storage/s3_compatible_object_storage_as_primary.adoc[documentation]). +- `OWNCLOUD_OBJECTSTORE_AVAILABLE_STORAGE=` + + Indicates available storage size in the objectstore in bytes (see xref:configuration/files/external_storage/s3_compatible_object_storage_as_primary.adoc[documentation]). +- `OWNCLOUD_OPENSSL_CONFIG=` + + Path to a custom `openssl.cnf` file, e.g. when using a custom PKI or CA in the container (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-default-cipher-for-encrypting-files[documentation]). +- `OWNCLOUD_OPERATION_MODE=` + + Define ownCloud operation modes (see xref:configuration/server/config_sample_php_parameters.adoc#define-owncloud-operation-modes[documentation]). +- `OWNCLOUD_OVERWRITE_CLI_URL=\${\{OWNCLOUD_PROTOCOL}://\$\{OWNCLOUD_DOMAIN}$\{OWNCLOUD_SUB_URL}` + + Override cli URL (see xref:configuration/server/config_sample_php_parameters.adoc#override-cli-url[documentation]). +- `OWNCLOUD_OVERWRITE_COND_ADDR=` + + Override condition for the remote IP address with a regular expression (see xref:configuration/server/config_sample_php_parameters.adoc#override-condition-for-the-remote-ip-address-with-a-regular-expression[documentation]). +- `OWNCLOUD_OVERWRITE_HOST=` + + Override automatic proxy detection (see xref:configuration/server/config_sample_php_parameters.adoc#override-automatic-proxy-detection[documentation]). +- `OWNCLOUD_OVERWRITE_PROTOCOL=` + + Override protocol (http/https) usage (see xref:configuration/server/config_sample_php_parameters.adoc#override-protocol-httphttps-usage[documentation]). +- `OWNCLOUD_OVERWRITE_WEBROOT=` + + Override ownClouds webroot (see xref:configuration/server/config_sample_php_parameters.adoc#override-ownclouds-webroot[documentation]). +- `OWNCLOUD_PDF_VIEWER_ENABLE_SCRIPTING=` + + Allow JavaScript execution in PDF files. Security risk — only enable if required (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-files-pdf-viewer[documentation]). +- `OWNCLOUD_PART_FILE_IN_STORAGE=` + + Define where part files are located (see xref:configuration/server/config_sample_php_parameters.adoc#define-where-part-files-are-located[documentation]). +- `OWNCLOUD_POLLINTERVAL=` + + Suggested client polling interval in milliseconds (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-ttl-for-garbage-collection[documentation]). +- `OWNCLOUD_POST_CRONJOB_PATH=/etc/post_cronjob.d` + + Path to custom scripts that need to be executed after a cron run. +- `OWNCLOUD_POST_INSTALL_PATH=/etc/post_install.d` + + Path to custom scripts that need to be executed after an ownCoud installation command. +- `OWNCLOUD_POST_SERVER_PATH=/etc/post_server.d` + + Path to custom scripts that need to be executed after an ownCloud server startup. +- `OWNCLOUD_PREVIEW_JPEG_IMAGE_DISPLAY_QUALITY=` + + JPEG preview display quality from 1 to 100 (`-1` uses the PHP default of ~75%) (see xref:configuration/server/config_sample_php_parameters.adoc#enable-preview-generation[documentation]). +- `OWNCLOUD_PREVIEW_LIBREOFFICE_PATH=` + + Define the custom path for the LibreOffice / OpenOffice binary (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-custom-path-for-the-libreoffice-openoffice-binary[documentation]). +- `OWNCLOUD_PREVIEW_MAX_DIMENSIONS=` + + Define the maximum dimensions of the original image for preview generation (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-maximum-dimensions-of-the-original-image-for-preview-generation[documentation]). +- `OWNCLOUD_PREVIEW_MAX_FILESIZE_IMAGE=` + + Define the maximum preview filesize limit (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-maximum-preview-filesize-limit[documentation]). +- `OWNCLOUD_PREVIEW_MAX_SCALE_FACTOR=` + + Define the maximum preview scale factor (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-maximum-preview-scale-factor[documentation]). +- `OWNCLOUD_PREVIEW_MAX_X=` + + Define the maximum x-axis width for previews (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-maximum-x-axis-width-for-previews[documentation]). +- `OWNCLOUD_PREVIEW_MAX_Y=` + + Define the maximum y-axis width for previews (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-maximum-y-axis-width-for-previews[documentation]). +- `OWNCLOUD_PREVIEW_OFFICE_CL_PARAMETERS=` + + Define additional arguments for LibreOffice / OpenOffice (see xref:configuration/server/config_sample_php_parameters.adoc#define-additional-arguments-for-libreoffice-openoffice[documentation]). +- `OWNCLOUD_PRE_CRONJOB_PATH=/etc/pre_cronjob.d` + + Path to custom scripts that need to be executed before a cron run. +- `OWNCLOUD_PRE_INSTALL_PATH=/etc/pre_install.d` + + Path to custom scripts that need to be executed before an ownCoud installation command. +- `OWNCLOUD_PRE_SERVER_PATH=/etc/pre_server.d` + + Path to custom scripts that need to be executed before an ownCloud server startup. +- `\{OWNCLOUD_PROTOCOL=http` + + Protocol used in `OWNCLOUD_OVERWRITE_CLI_URL` by default. +- `OWNCLOUD_PROXY_IGNORE=` + + Comma-separated list of hostnames that bypass the proxy (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-url-of-your-proxy-server[documentation]). +- `OWNCLOUD_PROXY=` + + Define the URL of your proxy server (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-url-of-your-proxy-server[documentation]). +- `OWNCLOUD_PROXY_USERPWD=` + + Define proxy authentication (see xref:configuration/server/config_sample_php_parameters.adoc#define-proxy-authentication[documentation]). +- `OWNCLOUD_QUOTA_INCLUDE_EXTERNAL_STORAGE=` + + Define whether to include external storage in quota calculation (see xref:configuration/server/config_sample_php_parameters.adoc#define-whether-to-include-external-storage-in-quota-calculation[documentation]). +- `OWNCLOUD_REDIS_DB=` + + Define Redis connection details sets the dbindex (see xref:configuration/server/config_sample_php_parameters.adoc#define-redis-connection-details[documentation]). +- `OWNCLOUD_REDIS_ENABLED=false` + + Sets memcache to Redis (see xref:configuration/server/config_sample_php_parameters.adoc#memory-caching-backend-for-distributed-data[documentation]). If sessions need to be stored in redis as well, you must also set `OWNCLOUD_SESSION_SAVE_HANDLER=redis`. +- `OWNCLOUD_REDIS_FAILOVER_MODE=` + + Sets redis failover mode (see xref:configuration/server/config_sample_php_parameters.adoc#define-redis-cluster-connection-details[documentation]). Possible values: `FAILOVER_NONE` for `\RedisCluster::FAILOVER_NONE`, `FAILOVER_ERROR` for `\RedisCluster::FAILOVER_ERROR` or `FAILOVER_DISTRIBUTE` for `\RedisCluster::FAILOVER_DISTRIBUTE`. +- `OWNCLOUD_REDIS_HOST=redis` + + Sets redis host (see xref:configuration/server/config_sample_php_parameters.adoc#define-redis-connection-details[documentation]). +- `OWNCLOUD_REDIS_PASSWORD=` + + Set redis password (see xref:configuration/server/config_sample_php_parameters.adoc#define-redis-connection-details[documentation]). +- `OWNCLOUD_REDIS_PORT=6379` + + Set redis port (see xref:configuration/server/config_sample_php_parameters.adoc#define-redis-connection-details[documentation]). +- `OWNCLOUD_REDIS_READ_TIMEOUT=` + + Sets redis read timeout (see xref:configuration/server/config_sample_php_parameters.adoc#define-redis-cluster-connection-details[documentation]). +- `OWNCLOUD_REDIS_SEEDS=` + + Sets the redis cluster servers (see xref:configuration/server/config_sample_php_parameters.adoc#define-redis-cluster-connection-details[documentation]). +- `OWNCLOUD_REDIS_SESSION_LOCKING_ENABLED=1` + + Sets PHP option `redis.session.locking_enabled` if `OWNCLOUD_SESSION_SAVE_HANDLER=redis`. +- `OWNCLOUD_REDIS_SESSION_LOCK_RETRIES=750` + + Sets PHP option `redis.session.lock_retries` if `OWNCLOUD_SESSION_SAVE_HANDLER=redis`. +- `OWNCLOUD_REDIS_SESSION_LOCK_WAIT_TIME=20000` + + Sets PHP option `redis.session.lock_wait_time` if `OWNCLOUD_SESSION_SAVE_HANDLER=redis`. +- `OWNCLOUD_REDIS_STARTUP_TIMEOUT=180` + + Time to wait for a successful connection to the redis service on container startup. +- `OWNCLOUD_REDIS_TIMEOUT=` + + Sets the redis timeout value (see xref:configuration/server/config_sample_php_parameters.adoc#define-redis-cluster-connection-details[documentation]). +- `OWNCLOUD_REDIS_TLS_ALLOW_SELF_SIGNED=` + + Allow self-signed certificates on the Redis server (`true`/`false`) (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). +- `OWNCLOUD_REDIS_TLS_CAFILE=` + + Path to CA certificate file for TLS-secured Redis connections (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). +- `OWNCLOUD_REDIS_TLS_CAPATH=` + + Directory containing CA certificates for TLS-secured Redis connections (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). +- `OWNCLOUD_REDIS_TLS_CIPHERS=` + + OpenSSL cipher list for Redis TLS connections (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). +- `OWNCLOUD_REDIS_TLS_LOCAL_CERT=` + + Path to client certificate file for mutual TLS to Redis (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). +- `OWNCLOUD_REDIS_TLS_LOCAL_PK=` + + Path to client private key file for mutual TLS to Redis (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). +- `OWNCLOUD_REDIS_TLS_PASSPHRASE=` + + Passphrase for an encrypted Redis client private key (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). +- `OWNCLOUD_REDIS_TLS_PEER_NAME=` + + Expected hostname in the Redis server certificate, overrides the connection host for SNI (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). +- `OWNCLOUD_REDIS_TLS_VERIFY_PEER=` + + Validate the Redis server certificate against the CA (`true`/`false`) (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). +- `OWNCLOUD_REDIS_TLS_VERIFY_PEER_NAME=` + + Validate that the Redis server certificate CN/SAN matches the peer name (`true`/`false`) (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). +- `OWNCLOUD_REMEMBER_LOGIN_COOKIE_LIFETIME=` + + Define the lifetime of the remember-login cookie (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-lifetime-of-the-remember-login-cookie[documentation]). +- `OWNCLOUD_SAVE_VERSION_METADATA=` + + Enabled extened version metadata (see [description](https://doc.owncloud.com/server/latest/admin_manual/configuration/files/file_versioning.adoc#extended-version-metadata) and [documentation](https://doc.owncloud.com/server/next/admin_manual/configuration/server/config_sample_php_parameters.adoc#save-additional-metadata-for-versions[documentation]). +- `OWNCLOUD_SECRET=` + + Define ownClouds internal secret (see xref:configuration/server/config_sample_php_parameters.adoc#define-ownclouds-internal-secret[documentation]). +- `OWNCLOUD_SESSION_KEEPALIVE=` + + Enable or disable session keep-alive when a user is logged in to the Web UI (see xref:configuration/server/config_sample_php_parameters.adoc#enable-or-disable-session-keep-alive-when-a-user-is-logged-in-to-the-web-ui[documentation]). +- `OWNCLOUD_SESSION_LIFETIME=` + + Define the lifetime of a session after inactivity (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-lifetime-of-a-session-after-inactivity[documentation]). +- `OWNCLOUD_SESSION_FORCED_LOGOUT_TIMEOUT=` + + Force the user to get logged out after the specified number of seconds when the tab or browser gets closed. Please read the documentation carefully before changing this option (see xref:configuration/server/config_sample_php_parameters.adoc#enable-to-force-user-logout[documentation]). +- `OWNCLOUD_SESSION_SAVE_HANDLER=files` + + Sets PHP option `session.save_handler`. +- `OWNCLOUD_DEFAULT_SOCKET_TIMEOUT=60` + + Sets PHP option `default_socket_timeout`. +- `OWNCLOUD_SESSION_SAVE_PATH=$\{OWNCLOUD_VOLUME_SESSIONS}` + + Sets the PHP option `session.save_path`. If `OWNCLOUD_SESSION_SAVE_HANDLER=redis` is used, this must be set to a proper connection URL including authentication parameters if required by the redis server. It usually follows the following scheme: `tcp://IPADDRESS:PORT?auth=REDISPASSWORD`. +- `OWNCLOUD_SHARE_FOLDER=` + + Define a default folder for shared files and folders other than root (see xref:configuration/server/config_sample_php_parameters.adoc#define-a-default-folder-for-shared-files-and-folders-other-than-root[documentation]). +- `OWNCLOUD_SHARING_FEDERATION_ALLOW_HTTP_FALLBACK=` + + Allow schema fallback for federated sharing servers (see xref:configuration/server/config_sample_php_parameters.adoc#allow-schema-fallback-for-federated-sharing-servers[documentation]). +- `OWNCLOUD_SHARING_MANAGER_FACTORY=` + + Define an alternative Share Provider (see xref:configuration/server/config_sample_php_parameters.adoc#define-an-alternative-share-provider[documentation]). +- `OWNCLOUD_SHARING_SHOW_PUBLIC_LINK_QUICK_ACTION=` + + Show a quick-action button for creating public links in the file list (see xref:configuration/server/config_sample_php_parameters.adoc#define-an-alternative-share-provider[documentation]). +- `OWNCLOUD_SHOW_SERVER_HOSTNAME=` + + Show or hide the server hostname in status.php (see xref:configuration/server/config_sample_php_parameters.adoc#show-or-hide-the-server-hostname-in-status-php[documentation]). +- `OWNCLOUD_SINGLEUSER=` + + Enable or disable single user mode (see xref:configuration/server/config_sample_php_parameters.adoc#enable-or-disable-single-user-mode[documentation]). +- `OWNCLOUD_SKELETON_DIRECTORY=` + + Define the directory where the skeleton files are located (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-directory-where-the-skeleton-files-are-located[documentation]). +- `OWNCLOUD_SKIP_CHMOD=false` + + Enable or disable automatic file permissions correction on container startup. +- `OWNCLOUD_SKIP_CHOWN=false` + + Enable or disable automatic file ownership correction on container startup. +- `OWNCLOUD_SMB_LOGGING_ENABLE=` + + Enable or disable debug logging for SMB access (see xref:configuration/server/config_sample_php_parameters.adoc#enable-or-disable-debug-logging-for-smb-access[documentation]). +- `OWNCLOUD_SQLITE_JOURNAL_MODE=` + + Define sqlite3 journal mode (see xref:configuration/server/config_sample_php_parameters.adoc#define-sqlite3-journal-mode[documentation]). +- `OWNCLOUD_STRICT_LOGIN_ENFORCED=` + + Only validate the exact login name entered by the user, not alternative formats (see xref:configuration/server/config_sample_php_parameters.adoc#enforce-token-only-authentication-for-apps-and-clients-connecting-to-owncloud[documentation]). +- `OWNCLOUD_SUB_URL=/` + + URL path if ownCloud is deployed to a URL sub-path of a domain. +- `OWNCLOUD_SYSTEMTAGS_MANAGER_FACTORY=` + + Define an alternative System Tags Manager (see xref:configuration/server/config_sample_php_parameters.adoc#define-an-alternative-system-tags-manager[documentation]). +- `OWNCLOUD_TELEMETRY_ENABLED=` + + Send daily telemetry reports (Enterprise only) (see xref:configuration/server/config_sample_php_parameters.adoc#define-owncloud-operation-modes[documentation]). +- `OWNCLOUD_TEMP_DIRECTORY=` + + Define the location for temporary files (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-location-for-temporary-files[documentation]). +- `OWNCLOUD_TOKEN_AUTH_ENFORCED=` + + Enforce token only authentication for apps and clients connecting to ownCloud (see xref:configuration/server/config_sample_php_parameters.adoc#enforce-token-only-authentication-for-apps-and-clients-connecting-to-owncloud[documentation]). +- `OWNCLOUD_TRASHBIN_SKIP_DIRECTORIES=` + + Comma-separated list of directory names that bypass the trash bin (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-trashbin-retention-obligation[documentation]). +- `OWNCLOUD_TRASHBIN_SKIP_EXTENSIONS=` + + Comma-separated list of file extensions that bypass the trash bin (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-trashbin-retention-obligation[documentation]). +- `OWNCLOUD_TRASHBIN_SKIP_SIZE_THRESHOLD=` + + Files larger than this size bypass the trash bin (e.g. `1GB`) (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-trashbin-retention-obligation[documentation]). +- `OWNCLOUD_TRASHBIN_PURGE_LIMIT=` + + Define the trashbin purge limit (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-trashbin-purge-limit[documentation]). +- `OWNCLOUD_TRASHBIN_RETENTION_OBLIGATION=` + + Define the trashbin retention obligation (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-trashbin-retention-obligation[documentation]). +- `OWNCLOUD_TRUSTED_PROXIES=` + + Define list of trusted proxy servers (see xref:configuration/server/config_sample_php_parameters.adoc#define-list-of-trusted-proxy-servers[documentation]). +- `OWNCLOUD_UPDATER_SERVER_URL=` + + Define the updatechecker URL (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-updatechecker-url[documentation]). +- `OWNCLOUD_UPDATE_CHECKER=` + + Enable or disable updatechecker (see xref:configuration/server/config_sample_php_parameters.adoc#enable-or-disable-updatechecker[documentation]). +- `OWNCLOUD_UPGRADE_AUTOMATIC_APP_UPDATES=` + + Define whether or not to enable automatic update of market apps (see xref:configuration/server/config_sample_php_parameters.adoc#define-whether-or-not-to-enable-automatic-update-of-market-apps[documentation]). +- `OWNCLOUD_USE_RELATIVE_DOMAIN_NAME=` + + Use only the short hostname (no FQDN) in `status.php` (see xref:configuration/server/config_sample_php_parameters.adoc#show-or-hide-the-server-hostname-in-status-php[documentation]). +- `OWNCLOUD_USER_LDAP_ENABLE_MEDIAL_SEARCH=` + + Enable medial search in the LDAP user backend (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-ldap[documentation]). +- `OWNCLOUD_USER_SEARCH_MIN_LENGTH=` + + Define minimum characters entered before a search returns results (see xref:configuration/server/config_sample_php_parameters.adoc#define-minimum-characters-entered-before-a-search-returns-results[documentation]). +- `OWNCLOUD_WEB_BASEURL=` + + Base URL for the ownCloud Web UI (see xref:configuration/server/config_sample_php_parameters.adoc#override-cli-url[documentation]). +- `OWNCLOUD_WEB_REWRITE_LINKS=` + + Redirect public/private links to the ownCloud Web UI (see xref:configuration/server/config_sample_php_parameters.adoc#override-cli-url[documentation]). +- `OWNCLOUD_WND_ACTIVITY_REGISTER_EXTENSION=` + + Register the Windows Network Drive app with the Activity app to report what `wnd:process-queue` is doing (`true`/`false`) (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-windows-network-drive-wnd[documentation]). +- `OWNCLOUD_WND_ACTIVITY_SEND_TO_SHAREES=` + + Send activity notifications to sharees of Windows Network Drive files and folders; requires `OWNCLOUD_WND_ACTIVITY_REGISTER_EXTENSION` (`true`/`false`) (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-windows-network-drive-wnd[documentation]). +- `OWNCLOUD_WND_CONNECTOR_OPTS_TIMEOUT=` + + Timeout in milliseconds applied to all Windows Network Drive backend operations and connections (default `20000`) (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-windows-network-drive-wnd[documentation]). +- `OWNCLOUD_WND_ERROR_CODES_PASSWORD_RESET=` + + Comma-separated list of error codes that trigger a password reset for Windows Network Drive (default `13` = access denied); empty disables it (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-windows-network-drive-wnd[documentation]). +- `OWNCLOUD_WND_FILE_INFO_PARSE_ATTRS_MODE=` + + How Windows Network Drive evaluates file attributes: `none`, `stat` (default) or `getxattr` (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-windows-network-drive-wnd[documentation]). +- `OWNCLOUD_WND_GROUP_MEMBERSHIP_CHECK_USER_FIRST=` + + Make the Windows Network Drive group membership component assume an ACL entry is a user and check users first (`true`/`false`) (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-windows-network-drive-wnd[documentation]). +- `OWNCLOUD_WND_IN_MEMORY_NOTIFIER_ENABLE=` + + Enable the in-memory notifier so Windows Network Drive storages reset passwords on detecting a wrong password (`true`/`false`, default `true`) (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-windows-network-drive-wnd[documentation]). +- `OWNCLOUD_WND_LISTEN_EVENTS_SMB_ACL=` + + Listen to events from the `smb_acl` app to update Windows Network Drive storages when an ACL changes (`true`/`false`) (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-windows-network-drive-wnd[documentation]). +- `OWNCLOUD_WND_LISTEN_RECONNECT_AFTER_TIME=` + + Interval in seconds after which the Windows Network Drive listener reconnects to the database to avoid crashes from idle connections (default `28800`) (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-windows-network-drive-wnd[documentation]). +- `OWNCLOUD_WND_LOGGING_ENABLE=` + + Enable additional debug logging for the Windows Network Drive app (`true`/`false`) (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-windows-network-drive-wnd[documentation]). +- `OWNCLOUD_WND_PERMISSION_MANAGER_CACHE_SIZE=` + + Maximum number of items in the Windows Network Drive permission manager per-request cache (default `512`) (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-windows-network-drive-wnd[documentation]). +- `OWNCLOUD_WND2_CACHE_WRAPPER_NORMALIZE=` + + Probe both NFC/NFD UTF-8 forms in the Windows Network Drive collaborative cache wrapper, needed for macOS HFS+ mounts (`true`/`false`) (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-windows-network-drive-wnd[documentation]). +- `OWNCLOUD_WND2_CACHE_WRAPPER_TTL=` + + TTL in seconds for the Windows Network Drive collaborative cache wrapper (default `1800`); use a negative value to disable (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-windows-network-drive-wnd[documentation]). +- `OWNCLOUD_WORKFLOW_RETENTION_ENGINE=` + + Retention engine for the workflow/tagging app: `tagbased` (default) or `userbased` (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-workflow-tagging[documentation]). +- `OWNCLOUD_WOPI_BUSINESS_FLOW_ENABLED=` + + Enable the Microsoft Office 365 business flow for WOPI (`yes`/`no`) (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-microsoft-office-online-wopi[documentation]). +- `OWNCLOUD_WOPI_GROUP=` + + Restrict Microsoft Office Online access to a specific group (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-microsoft-office-online-wopi[documentation]). +- `OWNCLOUD_WOPI_OFFICE_ONLINE_SERVER=` + + URL of the Microsoft Office Online server (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-microsoft-office-online-wopi[documentation]). +- `OWNCLOUD_WOPI_PROXY_URL=` + + Business proxy URL for Microsoft Office 365 (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-microsoft-office-online-wopi[documentation]). +- `OWNCLOUD_WOPI_TOKEN_KEY=` + + Random key (minimum 32 bytes) used to sign WOPI JWT tokens (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-microsoft-office-online-wopi[documentation]). +- `OWNCLOUD_VERSIONS_RETENTION_OBLIGATION=` + + Define the files versions retention obligation (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-files-versions-retention-obligation[documentation]). +- `OWNCLOUD_VERSION_HIDE=` + + Show or hide the ownCloud version information in status.php (see xref:configuration/server/config_sample_php_parameters.adoc#show-or-hide-the-owncloud-version-information-in-status-php[documentation]). +- `OWNCLOUD_VOLUME_APPS=$\{OWNCLOUD_VOLUME_ROOT}/apps` + + Base directory used to store custom installed apps. +- `OWNCLOUD_VOLUME_CONFIG=$\{OWNCLOUD_VOLUME_ROOT}/config` + + Base directory used to store the ownCloud configuration. +- `OWNCLOUD_VOLUME_FILES=$\{OWNCLOUD_VOLUME_ROOT}/files` + + Define the directory where user files are stored (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-directory-where-user-files-are-stored[documentation]). +- `OWNCLOUD_VOLUME_ROOT=/mnt/data` + + Base data directory for ownCloud. +- `OWNCLOUD_VOLUME_SESSIONS=$\{OWNCLOUD_VOLUME_ROOT}/sessions` + + Base directory to store session files. Only used if `OWNCLOUD_SESSION_SAVE_HANDLER=file`. +- `OWNCLOUD_PHP_DISABLE_FUNCTIONS=pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,system,phpinfo,show_source,fopen_with_path,dbmopen,dbase_open,filepro_retrieve,posix_mkfifo` + + Some insecure PHP functions are disabled by default, and this option should not be changed for production setup. Use it with caution. +- `OWNCLOUD_IOC_SCANNER_CONFIRMATION=` + + To suppress Indicators of Compromise (IoC) messages the environment variable need to be set to `EXECUTED_ON_ALL_NODES`. This feature requires a valid `OWNCLOUD_LICENSE_KEY`. + diff --git a/modules/admin_manual/partials/nav.adoc b/modules/admin_manual/partials/nav.adoc index 07dbac6b5..40717038e 100644 --- a/modules/admin_manual/partials/nav.adoc +++ b/modules/admin_manual/partials/nav.adoc @@ -19,6 +19,8 @@ **** xref:admin_manual:installation/apps_supported.adoc[Supported Apps] ** Configuration +*** xref:admin_manual:configuration/envvars/envvars.adoc[Environment Variables] + *** xref:admin_manual:configuration/database/linux_database_configuration.adoc[Database Configuration] *** xref:admin_manual:configuration/files/encryption/index.adoc[Encryption] From 134c1339330bd50a66ba5fbae028e9ddf7c5d7cb Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Thu, 2 Jul 2026 20:24:52 +0200 Subject: [PATCH 04/32] mostly enterprise changes --- .../pages/configuration/files/mimetypes.adoc | 6 +-- .../files/previews_configuration.adoc | 2 +- .../pages/configuration/important_notes.adoc | 50 +++++++++++++++++++ .../authentication/enterprise_only_auth.adoc | 8 +-- .../enterprise/authentication/kerberos.adoc | 16 ++---- .../collaboration/collabora_secure_view.adoc | 11 ++-- .../partials/manual_config_file.adoc | 1 + modules/admin_manual/partials/nav.adoc | 3 +- 8 files changed, 70 insertions(+), 27 deletions(-) create mode 100644 modules/admin_manual/pages/configuration/important_notes.adoc create mode 100644 modules/admin_manual/partials/manual_config_file.adoc diff --git a/modules/admin_manual/pages/configuration/files/mimetypes.adoc b/modules/admin_manual/pages/configuration/files/mimetypes.adoc index a0e627c9f..c518ba03b 100644 --- a/modules/admin_manual/pages/configuration/files/mimetypes.adoc +++ b/modules/admin_manual/pages/configuration/files/mimetypes.adoc @@ -14,12 +14,10 @@ By default, the folder containing the relevant configuration is not part of the [source,docker] ---- -/var/www/owncloud/resources --> -/var/www/owncloud/core/img/filetypes --> + --> /var/www/owncloud/resources + --> /var/www/owncloud/core/img/filetypes ---- - - The folder for the ownCloud config is already a mounted Docker volume and accessible under `/config`. == Mimetype Aliases diff --git a/modules/admin_manual/pages/configuration/files/previews_configuration.adoc b/modules/admin_manual/pages/configuration/files/previews_configuration.adoc index 58507ab6d..c118e80fe 100644 --- a/modules/admin_manual/pages/configuration/files/previews_configuration.adoc +++ b/modules/admin_manual/pages/configuration/files/previews_configuration.adoc @@ -64,7 +64,7 @@ IMPORTANT: The ownCloud Docker Image provides the `imagic` php extension, but no Starting with version 7 of ImageMagick, additional file formats like SVG or HEIC and many others can be processed. -You can check your ImageMagick version installed in your image by issuing the following command: +You can check your ImageMagick version, if installed in your image, by issuing the following command: [source,docker] ---- diff --git a/modules/admin_manual/pages/configuration/important_notes.adoc b/modules/admin_manual/pages/configuration/important_notes.adoc new file mode 100644 index 000000000..8e527e6ab --- /dev/null +++ b/modules/admin_manual/pages/configuration/important_notes.adoc @@ -0,0 +1,50 @@ += Important Configuration Notes +:toc: right +:description: This page provides some important configuration notes. + +== Introduction + +{description} + +Due to this version's Docker-only approach, some aspects of configuring your ownCloud Classic Server have changed. With a few exceptions, using environment variables is the only way to configure the instance. + +== Environment Variables + +The majority of config keys that are provided by ownCloud can be found in the xref:configuration/envvars/envvars.adoc[Environment Variables] documentation. For the few exceptions, the traditional configuration key approach must be used. The documentation for the configuration keys also refers to the corresponding environment variables. + +== Using Configuration Keys + +IMPORTANT: This approach should only be used if there is no environment variable available. This is noted in the relevant section of the documentation. + +=== Preparation + +In order to add configuration keys instead of using environment variables, some preparation is required. + +* Change to the mounted docker volume where the configuration is stored. ++ +[source,bash] +---- +cd /config +---- + +* Next, create a new file with the same owner and permissions as the existing files. The naming must follow the scheme `.config.php`. Replace `` with the name of choice but consider that the order in which configuration files are read is alphabetical. ++ +IMPORTANT: If a key/value pair exists in a file, it will take precedence over any existing ones defined in a config file that is read earlier. It is therefore crucial that you use a name that makes the file last read. + +* This file must have the following mandatory content: ++ +[source,php] +---- +`). @@ -442,7 +444,7 @@ Tickets destroyed Note that if you issue this command during regular operation, all sessions for users using ownCloud with Kerberos will end and need to re-login. -- -. Create a new ownCloud config file `/path-to-owncloud/config/kerberos.config.php` with the following contents or add only the comment and key to an existing `config.php` file. More Kerberos config options can be found in the xref:configuration/server/config_apps_sample_php_parameters.adoc#app-kerberos[Config Apps Sample] description: +. Add the following contents to your own config file. More Kerberos config options can be found in the xref:configuration/server/config_apps_sample_php_parameters.adoc#app-kerberos[Config Apps Sample] description: + -- [source,php] @@ -456,7 +458,6 @@ Note that if you issue this command during regular operation, all sessions for u ]; ---- -- -A new file will be read xref:configuration/server/config_sample_php_parameters.adoc#introduction[additionally] to existing config files. See the xref:configuration/server/config_apps_sample_php_parameters.adoc[Apps Config.php Parameters] for more Kerberos configuration options. //// === Webserver Side @@ -479,15 +480,6 @@ A new file will be read xref:configuration/server/config_sample_php_parameters.a See the https://modauthkerb.sourceforge.net/configure.html[mod-auth-kerb,window=_blank] documentation for more details on the settings used. -- - -* Restart Apache: -+ --- -[source,bash] ----- -sudo apachectl -k graceful ----- --- //// == Browser Prerequisites diff --git a/modules/admin_manual/pages/enterprise/collaboration/collabora_secure_view.adoc b/modules/admin_manual/pages/enterprise/collaboration/collabora_secure_view.adoc index 3c158493b..f2dc51512 100644 --- a/modules/admin_manual/pages/enterprise/collaboration/collabora_secure_view.adoc +++ b/modules/admin_manual/pages/enterprise/collaboration/collabora_secure_view.adoc @@ -33,9 +33,8 @@ If a file or folder has been shared multiple times to different groups with diff == Prerequisites -* ownCloud *10.3* or above * _Enterprise Edition_ -* {oc-marketplace-url}/apps/richdocuments[ownCloud Collabora Online] app version *2.2.0* or above +* The ownCloud Collabora Online app * Collabora Online Server *4.0.10* or above, set up and integrated == Configure ownCloud for Collabora Online / Secure View @@ -71,11 +70,11 @@ image:enterprise/collaboration/access-denied.png[Access denied to a document whe == Limitations and Security Hardening -To make sure that the secure view feature is deployed securely and cannot be circumvented, it is important to disable the following extensions: +To ensure the Secure View feature is deployed securely and cannot be bypassed, disable the following apps if they were enabled beforehand: -* {oc-marketplace-url}/apps/onlyoffice[ONLYOFFICE] -* {oc-marketplace-url}/apps/wopi[Microsoft Office Online] -* {oc-marketplace-url}/apps/files_texteditor[Text editor] +* ONLYOFFICE +* Microsoft Office Online +* Text editor Additionally, you might want to _disable public link sharing_ via menu:Settings[Admin > Sharing > Allow users to share via link] so that users cannot accidentally share files publicly without secure view protection. diff --git a/modules/admin_manual/partials/manual_config_file.adoc b/modules/admin_manual/partials/manual_config_file.adoc new file mode 100644 index 000000000..4f0fb9cad --- /dev/null +++ b/modules/admin_manual/partials/manual_config_file.adoc @@ -0,0 +1 @@ +IMPORTANT: This setup requires a configuration with configuration keys. No environment variables are available. See the xref:configuration/important_notes.adoc[Important Configuration Notes] documentation for details. diff --git a/modules/admin_manual/partials/nav.adoc b/modules/admin_manual/partials/nav.adoc index 40717038e..db581397b 100644 --- a/modules/admin_manual/partials/nav.adoc +++ b/modules/admin_manual/partials/nav.adoc @@ -19,8 +19,9 @@ **** xref:admin_manual:installation/apps_supported.adoc[Supported Apps] ** Configuration -*** xref:admin_manual:configuration/envvars/envvars.adoc[Environment Variables] +*** xref:admin_manual:configuration/important_notes.adoc[Important Notes] +*** xref:admin_manual:configuration/envvars/envvars.adoc[Environment Variables] *** xref:admin_manual:configuration/database/linux_database_configuration.adoc[Database Configuration] *** xref:admin_manual:configuration/files/encryption/index.adoc[Encryption] From eb45a9e69b90829586b9d81de8f8998170cc9c7b Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Fri, 3 Jul 2026 09:51:09 +0200 Subject: [PATCH 05/32] safe work --- .../collaboration/collabora_secure_view.adoc | 15 +++++++- .../msoffice-wopi-integration.adoc | 22 +++++------ .../ldap_home_connector_configuration.adoc | 38 +++++++++++-------- 3 files changed, 45 insertions(+), 30 deletions(-) diff --git a/modules/admin_manual/pages/enterprise/collaboration/collabora_secure_view.adoc b/modules/admin_manual/pages/enterprise/collaboration/collabora_secure_view.adoc index f2dc51512..9a4fefdd1 100644 --- a/modules/admin_manual/pages/enterprise/collaboration/collabora_secure_view.adoc +++ b/modules/admin_manual/pages/enterprise/collaboration/collabora_secure_view.adoc @@ -3,6 +3,17 @@ :secure-view-label: Secure View (with watermarks) :page-aliases: collabora_online_integration.adoc, enterprise/collaboration/index.adoc +//// + +Secure View is under review. +The required marketplace app is not in ownClouds responsibility but a necessity for the functionality. +If the functionality is dropped, a new OC image is provided no longer showing the sec view capabilities. +Note that in this case, we ned to also remove entries in config.apps.samle (richdocuments) and do a config-to-docs run. +Then we can remove the page, all of the images related and all occ commands that manage sec view (richdocuments). +If the functionality is kept, the app needs to be OC11 ready and either provided in the image or downloadable. + +//// + == Introduction Collabora Online allows you to work with all kinds of Collabora office documents directly in your browser. This application can connect to a Collabora Online (or other) server (WOPI-like client) where ownCloud is the WOPI host. @@ -34,7 +45,7 @@ If a file or folder has been shared multiple times to different groups with diff == Prerequisites * _Enterprise Edition_ -* The ownCloud Collabora Online app +* {oc-marketplace-url}/apps/richdocuments[ownCloud Collabora Online] app version *2.2.0* or above * Collabora Online Server *4.0.10* or above, set up and integrated == Configure ownCloud for Collabora Online / Secure View @@ -66,7 +77,7 @@ NOTE: Admins can specify that all shares are "_secure view_" by default and that When "_{secure-view-label}_" is enabled, any attempts to download the file will be blocked as shown in the screenshot below. In addition, copy & paste is disabled. -image:enterprise/collaboration/access-denied.png[Access denied to a document when it is protected by secure view, width=80%] +image:enterprise/collaboration/access-denied.png[Access denied to a document when it is protected by secure view, width=350] == Limitations and Security Hardening diff --git a/modules/admin_manual/pages/enterprise/collaboration/msoffice-wopi-integration.adoc b/modules/admin_manual/pages/enterprise/collaboration/msoffice-wopi-integration.adoc index dfd3d2961..4473dde85 100644 --- a/modules/admin_manual/pages/enterprise/collaboration/msoffice-wopi-integration.adoc +++ b/modules/admin_manual/pages/enterprise/collaboration/msoffice-wopi-integration.adoc @@ -1,6 +1,5 @@ = Microsoft Office Online / WOPI Integration :toc: right -:toclevels: 1 :msoffice-online-server-url: https://www.microsoft.com/en-us/microsoft-365/blog/2016/05/04/office-online-server-now-available/ :office365-url: https://products.office.com/en-us/business/office :wopi-protocol-url: https://docs.microsoft.com/en-us/microsoft-365/cloud-storage-partner-program/rest/ @@ -27,7 +26,6 @@ Please bear in mind: * WOPI is only available for ownCloud enterprise. It _is not available_ in the community version. * Out-of-the box only the on-premise version of Microsoft Office Online Server is supported. * If you want to integrate the {office365-url}[Office 365 (cloud)] version of Microsoft Office Online, you need to {oc-support-url}[get in touch with us]. -* This app requires at minimum ownCloud Version 10.5 and php 7.1. ==== == Procedure using Microsoft 365 @@ -52,7 +50,7 @@ All involved servers (Office Online Server and the ownCloud server) need to be a == Configuring the WOPI App in ownCloud -To configure the WOPI app in your ownCloud installation, add the following configuration to `config/config.php`, and adjust it based on the details of your setup: +To configure the WOPI app in your ownCloud installation, add the following environment variables, adjusting them as necessary based on the details of your setup: [source,php,subs="post_replacements,attributes+"] ---- @@ -63,7 +61,7 @@ To configure the WOPI app in your ownCloud installation, add the following confi # For Office 365 (cloud): Request the string from us # (this has to match the `O365_PROXY_SHARED_KEY` # configuration of the O365 proxy) -'wopi.token.key' => 'REPLACE_WITH_WOPI_TOKEN_KEY' +OWNCLOUD_WOPI_TOKEN_KEY= # Office server URL # For Office Online Server: Enter your https://your.office.online.server.tld @@ -73,7 +71,7 @@ To configure the WOPI app in your ownCloud installation, add the following confi # https://ffc-onenote.officeapps.live.com/hosting/discovery # For Office 365 production upstream URL: # https://onenote.officeapps.live.com/hosting/discovery -'wopi.office-online.server' => 'https://THE_OFFICE_SERVER_URL', +OWNCLOUD_WOPI_OFFICE_ONLINE_SERVER='https://THE_OFFICE_SERVER_URL' # Proxy URL # Only for Office 365 (cloud), not needed for Office Online Server @@ -81,27 +79,27 @@ To configure the WOPI app in your ownCloud installation, add the following confi # Note that you will get a working URL from ownCloud Support # post a written declaration that your company has an eligible # Microsoft Business contract. -'wopi.proxy.url' => 'https://o365.example.com', +OWNCLOUD_WOPI_PROXY_URL='https://o365.example.com' # Enable Business Flow # Only for Office 365 (cloud), not needed for Office Online Server # Necessary for the O365 proxy key above. -'wopi.business-flow.enabled' => 'yes', +OWNCLOUD_WOPI_BUSINESS_FLOW_ENABLED=yes # Samesite Cookie # Only for Office 365 (cloud), not needed for Office Online Server # Necessary to allow e.g. opening ownCloud sharing from O365. # Use `None` if you are using OpenID Connect. -'http.cookie.samesite' => 'Lax', +OWNCLOUD_HTTP_COOKIE_SAMESITE=Lax ---- == Restrict Usage to Users in a Specific Group -Microsoft Office Online access can be restricted to users in a specific group, by use of the `wopi_group` configuration key (in `config/config.php`), as in the following example. +Access to Microsoft Office Online can be restricted to users in a specific group by using the `OWNCLOUD_WOPI_GROUP` environment variable, as shown in the following example: -[source,php] +[source,.env] ---- -'wopi_group' => 'admin' +OWNCLOUD_WOPI_GROUP=admin ---- In the example above, only users in the `admin` group would be able to access Microsoft Office Online. @@ -118,7 +116,7 @@ You can always click on the lock icon next to your file name and unlock it manua === Lock Timeout -If a user is editing a file and loses their internet connection, the lock will timeout, freeing the lock after 30 minutes. Refer to {wopi-timeout-documentation-url}[the WOPI documentation] for further information. +If a user is editing a file and loses their internet connection, the lock will timeout, freeing the lock after 30 minutes. Refer to the {wopi-timeout-documentation-url}[WOPI documentation] for further information. == Known Issues diff --git a/modules/admin_manual/pages/enterprise/external_storage/ldap_home_connector_configuration.adoc b/modules/admin_manual/pages/enterprise/external_storage/ldap_home_connector_configuration.adoc index 81bbef55a..380931bfc 100644 --- a/modules/admin_manual/pages/enterprise/external_storage/ldap_home_connector_configuration.adoc +++ b/modules/admin_manual/pages/enterprise/external_storage/ldap_home_connector_configuration.adoc @@ -3,7 +3,7 @@ == Introduction -The {oc-marketplace-url}/apps/files_ldap_home[LDAP Home Connector] app enables you to configure your ownCloud server to display your users’ Windows home directories on the ownCloud Files pages view, just like any other folder. +The `LDAP Home Connector` app enables you to configure your ownCloud server to display your users’ Windows home directories on the ownCloud Files pages view, just like any other folder. Typically, Windows home directories are stored on a network server in a root folder, such as Home, which then contains individual folders for each user. @@ -70,61 +70,67 @@ image:enterprise/external_storage/ldap-home-connector/ldap-home-connector-diagra The following prerequisites are required: -* Mounting cifs is available on the server where ownCloud is installed -* The {oc-marketplace-url}/apps/user_ldap[LDAP Integration] app is enabled and has a working LDAP/Active Directory configuration in ownCloud. - -* The {oc-marketplace-url}/apps/files_ldap_home[LDAP Home Connector] app is installed. +* Mounting cifs is available on the server where ownCloud is hosted. +* The `LDAP Integration` app is enabled and has a working LDAP/Active Directory configuration in ownCloud. +* The `LDAP Home Connector` app is enabled. == Configuration The configuration is done in several steps: -. Mount the root Windows home directory to the ownCloud server +. Mount the root Windows home directory to the server hosting ownCloud +. Provide this mount as volume to the Docker container . Configure Active Directory/LDAP by adding a LDAP attribute to the user profile . Use the LDAP Home Connector app to connect it to ownCloud === Mount the Home Directory -For enhanced security, create a file where the credentials are stored accessing the cifs share like: - +* For enhanced security, create a file where the credentials are stored accessing the cifs share in the server hosting ownCloud such as: ++ [source,plaintext] ---- /etc/credentials ---- -with the username and password on separate lines, replacing the values according your setup: - +* With the username and password on separate lines, replacing the values according your setup: ++ [source,plaintext] ---- username=winhomeuser password=winhomepassword ---- -Create an entry in `/etc/fstab` for the remote Windows root home directory mount and use the credentials file created above, substitute and adapt your parameters and filenames: - +* Create an entry in `/etc/fstab` for the remote Windows root home directory mount and use the credentials file created above, substitute and adapt your parameters and filenames: ++ [source,plaintext] ---- //192.168.1.58/home /mnt/share/users cifs credentials=/etc/credentials,uid=33,gid=33 ---- +* Provide this mount point as volume to the ownCloud container. See the xref:installation/installing_with_docker.adoc#compose-setup[Compose Setup] in the installation documentation for a general example for how to do so. To make handling easier, use the same paths for the source and the container. + === Configure the LDAP Server In Active Directory, open the user profile. Scroll to the *Extensions* section and open the *Attribute Editor* tab. -image:enterprise/external_storage/ldap-home-connector/ldap-home-connector-2.png[Active Directory Attribute editor.] +image:enterprise/external_storage/ldap-home-connector/ldap-home-connector-2.png[Active Directory Attribute editor, width=350] Use any LDAP attribute that is not already in use (UserSharedFolder in this instance) and click *Edit*. Enter the user's home directory. -image:enterprise/external_storage/ldap-home-connector/ldap-home-connector-3.png[Editing the LDAP attribute.] +image:enterprise/external_storage/ldap-home-connector/ldap-home-connector-3.png[Editing the LDAP attribute, width=350] + +NOTE: If different paths are used, it is important that you use the mounted volume of the container as the path and not the source of the mount. This is because this is the one seen by the ownCloud instance. Save your changes. === Configure the LDAP Home Connector * Enable the LDAP Home Connector app. -* Go to the LDAP Home Connector form on your ownCloud admin page. In the *Display folder as:* field enter the name as you want it to appear on your users’ File pages. +* Go to the LDAP Home Connector form on your ownCloud admin page. + +In the *Display folder as:* field enter the name as you want it to appear on your users’ File pages. + * In the *Attribute name:* field enter the LDAP attribute name from above that contains the home directory and press btn:[Save]. -image:enterprise/external_storage/ldap-home-connector/ldap-home-connector-1.png[LDAP Home Connector configuration.] +image:enterprise/external_storage/ldap-home-connector/ldap-home-connector-1.png[LDAP Home Connector configuration, width=350] The Windows user's home directory is now available to the user when they log on in ownCloud. From 913b7c88a0a51cb3797b36ab25792fdc651d54f2 Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Fri, 3 Jul 2026 11:18:11 +0200 Subject: [PATCH 06/32] save work --- .../windows-network-drive_configuration.adoc | 62 ++++++++++--------- .../file_management/files_lifecycle.adoc | 7 ++- .../file_management/files_tagging.adoc | 30 +++++---- .../enterprise/firewall/file_firewall.adoc | 8 +-- 4 files changed, 57 insertions(+), 50 deletions(-) diff --git a/modules/admin_manual/pages/enterprise/external_storage/windows-network-drive_configuration.adoc b/modules/admin_manual/pages/enterprise/external_storage/windows-network-drive_configuration.adoc index 84448c10c..8dcc90e7d 100644 --- a/modules/admin_manual/pages/enterprise/external_storage/windows-network-drive_configuration.adoc +++ b/modules/admin_manual/pages/enterprise/external_storage/windows-network-drive_configuration.adoc @@ -94,7 +94,7 @@ Mounts to a Windows or Samba file server are labeled with a little four-pane Win Files are synchronized bidirectionally, and you can create, upload and delete files and folders. ownCloud server admins can create Windows Network Drive mounts and optionally allow users to set up their own personal Windows Network Drive mounts. -Depending on the authentication method, passwords for each mount are encrypted and stored in the ownCloud database, using a long random secret key stored in `config.php`. This allows ownCloud to access the shares when the users who own the mounts are not logged in. This access will not work if the mount is session based, where passwords are not stored and are available only for the current active session. In case other users are granted access to this mount, they will see a red triangle with an exclamation mark on the bottom right of the mount icon identifying lack of access. +Depending on the authentication method, passwords for each mount are encrypted and stored in the ownCloud database, using a long random secret key stored in the configuration file. This allows ownCloud to access the shares when the users who own the mounts are not logged in. This access will not work if the mount is session based, where passwords are not stored and are available only for the current active session. In case other users are granted access to this mount, they will see a red triangle with an exclamation mark on the bottom right of the mount icon identifying lack of access. [IMPORTANT] ==== @@ -168,20 +168,20 @@ Follow this procedure to create a new mount point based on WND:: Admins can define that mount points can be shared to all (default), or be restricted to individuals or groups. Note that sharing is not available for all authorization methods. For details please see the xref:enterprise/external_storage/enterprise_only_auth.adoc#authentication-option-details[Enterprise-Only Authentication Options]. In this case, you will also see the following on the mount point: + -image::enterprise/external_storage/windows_network_drive/wnd-available-for.png[WND Sharing Options,width=400] +image:enterprise/external_storage/windows_network_drive/wnd-available-for.png[WND Sharing Options,width=400] .. All menu:Settings[General > Storage]: + If sharing of mounts is allowed by the admin via menu:Settings[Admin > Storage > Allow sharing on user-mounted external storages], users can share the mount via menu:Files[Mountpoint > Details > Sharing]. To avoid accidentally sharing resources, the user must allow sharing a mount in the mount points view upfront by clicking on the gear icon as shown below. btn:[Enable sharing] appears only if sharing is generally allowed by the admin, see above. . Click the gear icon for additional mount options. Previews are enabled by default, but when using large storages with many files, you may want to disable previews as this can significantly increase performance. + -image::enterprise/external_storage/windows_network_drive/wnd-gear-icon.png[WND Gear Icon,width=300] +image:enterprise/external_storage/windows_network_drive/wnd-gear-icon.png[WND Gear Icon,width=300] . Your changes are saved automatically. . Finally, the mount point is created and will look like this example if a user has set it up: + -image::enterprise/external_storage/windows_network_drive/wnd-username-pwd.png[WND mount point created,width=500] +image:enterprise/external_storage/windows_network_drive/wnd-username-pwd.png[WND mount point created,width=500] NOTE: When you create a new mountpoint using login credentials (session-based), you must log out of ownCloud and then log back in so you can access the share. You only have to do this the first time. -- @@ -190,7 +190,7 @@ NOTE: When you create a new mountpoint using login credentials (session-based), The `Config key` to be entered as shown in the screen below, must be taken as described in xref:enterprise/authentication/enterprise_only_auth.adoc#value-to-be-entered-in-the-mount-point-config-key-field[Value to be entered in the mount point config key field]. -image::enterprise/external_storage/windows_network_drive/wnd-config-key.png[WND mountpoint and hardcoded credentials, width=500] +image:enterprise/external_storage/windows_network_drive/wnd-config-key.png[WND mountpoint and hardcoded credentials, width=500] Note that this authentication method can only be used by ordinary users if the admin hands over the `Config key` created. This is secure, as no password is exposed. @@ -198,7 +198,9 @@ Note that this authentication method can only be used by ordinary users if the a NOTE: See the linked section for important information when planning to use xref:#collaborative-wnd[Collaborative WND]. -When the xref:enterprise/authentication/kerberos.adoc[Kerberos Authentication] has been set up, a necessary config key xref:configuration/server/config_apps_sample_php_parameters.adoc#a-map-of-servers-with-the-required-kerberos-data[wnd.kerberos.servers] needs to be provided upfront in `config.php`. +include::partial$manual_config_file.adoc[] + +When the xref:enterprise/authentication/kerberos.adoc[Kerberos Authentication] has been set up, a necessary config key xref:configuration/server/config_apps_sample_php_parameters.adoc#a-map-of-servers-with-the-required-kerberos-data[wnd.kerberos.servers] needs to be provided upfront in the configuration. * `Kerberos Server ID` + This ID can be chosen from the config parameter section `wnd.kerberos.servers` and defines required parameters for the WND Kerberos setup. Multiple ID's with different setups can be created. @@ -278,7 +280,7 @@ IMPORTANT: The ownCloud LDAP Integration app must configure the `sAMAccountName` [TIP] ==== -Some groups, such as `everyone` might not be handled properly. This is because such groups don't exist in the LDAP server, or might not be found if the domain is different, such as `nt authority\system` or `builtin\domain-users`. +Some groups, such as `everyone` might not be handled properly. This is because such groups don't exist in the LDAP server, or might not be found if the domain is different, such as `authority\system` or `builtin\domain-users`. ==== The value to select for this provider is: `ocLdapPermissionManager`. @@ -311,6 +313,7 @@ Process saved listener changes from the database . wnd:listen:: This command listens to changes for each host and share configured and stores all notifications gathered in the database. + +-- [NOTE] ==== * This command needs configuration in the xref:installation/installing_with_docker.adoc[docker compose environment] to be activated. A prepared example is given but needs configuration. You need to create as many services as you need listeners. @@ -319,16 +322,15 @@ This command listens to changes for each host and share configured and stores al * A _read-only_ permission for the used account should be enough, but may need to be increased. ==== -+ + The command does not produce any output by default, unless an error happens. Each stored notification will be further processed by the `wnd:process-queue` which is described in teh next chapter and will be removed from the database after processing. -+ + The password is a required parameter in the compose example and can be provided in different ways. Replace "password" in the compose example with one of the options below. The password value is always in plain text. -+ + * Directly added as value. * Read from a file. + Neither spaces nor newline characters will be removed from the file by default, unless the `--password-trim` option is added. The password file must be readable by the Apache user `www-data`. Note that you need to add a volume to pass the file to the service. + --- [source,docker] ---- --password-file=/run/secrets/wnd_password --password-trim @@ -337,11 +339,10 @@ Neither spaces nor newline characters will be removed from the file by default, Make sure that the password file is outside of any directory handled by apache (web-readable) for security reasons. + NOTE: If you use the `--password-file` switch, the entire contents of the file will be used for the password, please be careful with newlines. --- + * Using the `service account password`. + -This password is already stored in the ownCloud database if you setup WND in collaborative mode. In this mode, you set the username and the option for the `occ` command to reuse the password stored in the database. The example command looks like: +This password is already stored in the ownCloud database if you setup WND in collaborative mode. In this mode, you set the username and the option for the `occ` command to reuse the password stored in the database. The example parameter for the command is as follows: + --- [source,docker] ---- --password-from-service-account @@ -409,7 +410,7 @@ Check {flock-docs-url}[flock's documentation] for details and more options. === Activity Extension -From version 2.0.0 the Windows Network Drive app includes an extension of the Activity app. This extension will allow the app to send events to the Activity app so the users know what happened in the Windows Network Drive storage. +The Windows Network Drive app includes an extension of the Activity app. This extension will allow the app to send events to the Activity app so the users know what happened in the Windows Network Drive storage. Please see the following figure how a notification can look like. In this example, one user accessing the same host/share has changed a file. Other users will now get an activity notification about this change. @@ -424,11 +425,11 @@ This extension requires the following components: For setting up the `wnd:listen` and `wnd:process-queue` commands, see their respective sections above. -This extension is disabled by default. This means that no activity will reach the users. In order to enable this extension, you can edit your _additional_ xref:installation/configuration_notes.adoc#using-a-configuration-file[configuration file] and add the following configuration: +This extension is disabled by default. This means that no activity will reach the users. In order to enable this extension, you need to add the following environment variable: -[source,php] +[source,.env] ---- -'wnd.activity.registerExtension' => true, +OWNCLOUD_WND_ACTIVITY_REGISTER_EXTENSION=true ---- NOTE: This configuration will affect all the WND mount points. @@ -439,14 +440,14 @@ The events are expected to reach only to the affected users. This filters out th As part of the Activity app configuration, users can decide which events they want to be notified about and how, in the activity stream or via email. -Users who can access the Windows Network Drive storage via share won't receive activity notifications by default. You can edit your _additional_ xref:installation/configuration_notes.adoc#using-a-configuration-file[configuration file] and add the following configuration to enable sending the activity notification to those users: +Users who can access the Windows Network Drive storage via share won't receive activity notifications by default. You can add the following environment variable to enable sending the activity notification to those users: -[source,php] +[source,.env] ---- -'wnd.activity.sendToSharees' => true, +OWNCLOUD_WND_ACTIVITY_SEND_TO_SHAREES=true ---- -NOTE: The `wnd.activity.sendToSharees` key depends on the `wnd.activity.registerExtension` key to take effect. +NOTE: `OWNCLOUD_WND_ACTIVITY_SEND_TO_SHAREES` depends on `OWNCLOUD_WND_ACTIVITY_REGISTER_EXTENSION` to take effect. === Collaborative WND @@ -512,7 +513,7 @@ image:enterprise/external_storage/windows_network_drive/cwnd_fields.png[Enter Co If you encounter issues using Windows network drive, then try the following troubleshooting steps: -First check the connection to the share by using {smbclient-manpage-url}[smbclient] on the command line of the ownCloud hosting server. Here is an example: +First check the connection to the share by using {smbclient-manpage-url}[smbclient] on the command line of the server hosting ownCloud. Here is an example: [source,console,subs="attributes+"] ---- @@ -587,11 +588,11 @@ On the one hand the memory usage is reduced, on the other hand there is more net === Reduce WND Notifier Memory Usage -The WND in-memory notifier for password changes provides the ability to notify all _affected_ WND storages to reset their passwords. This feature is intended to prevent a password lockout for the user in the backend. However, this functionality _can_ consume a significant amount of memory. To disable it, edit your _additional_ xref:installation/configuration_notes.adoc#using-a-configuration-file[configuration file] and add the following key: +The WND in-memory notifier for password changes provides the ability to notify all _affected_ WND storages to reset their passwords. This feature is intended to prevent a password lockout for the user in the backend. However, this functionality _can_ consume a significant amount of memory. To disable it, add the following environment variable: -[source,php] +[source,.env] ---- -'wnd.in_memory_notifier.enable' => false, +OWNCLOUD_WND_IN_MEMORY_NOTIFIER_ENABLE=false ---- NOTE: The password will be reset on the next request, regardless of the flag setting. @@ -612,7 +613,8 @@ To optimize this, `wnd:process-queue` make use of two switches: `–serializer-t | Allowed Values | `--serializer-type` -| `file`. Other valid values may be added in the future, as more implementations are requested. +| `file` + +Other valid values may be added in the future, as more implementations are requested. | `--serializer-param` | Depends on `--serializer-type`, because those will be the parameters that the chosen serializer will use. For the `file` serializer, you need to provide a file location in the host filesystem where the storages will be serialized. You can use `--serializer-param file=/tmp/file` as an example. @@ -711,9 +713,9 @@ It's intended to be run in a different schedule, so there are several executions === Performance on High Number of ACL Targeting Users -The WND app doesn’t know about the users or groups associated with ACLs. This means that an ACL containing "admin" might refer to a user called "admin" or a group called "admin". By default, the group membership component considers the ACLs to target groups, and as such, it will try to get the information for such a group. This works fine if the majority of the ACLs target groups. If the majority of the ACLs contain users, this might be problematic. The cost of getting information on a group is usually higher than getting information on a user. This option makes the group membership component assume the ACL contains a user and checks whether there is a user in ownCloud with such a name first. If the name doesn’t refer to a user, it will get the group information. Note that this will have performance implications if the group membership component can’t discard users in a large number of cases. It is recommended to enable this option only if there are a high number of ACLs targeting users. In order to enable this setting, edit your _additional_ xref:installation/configuration_notes.adoc#using-a-configuration-file[configuration file] and add the following key: +The WND app doesn’t know about the users or groups associated with ACLs. This means that an ACL containing "admin" might refer to a user called "admin" or a group called "admin". By default, the group membership component considers the ACLs to target groups, and as such, it will try to get the information for such a group. This works fine if the majority of the ACLs target groups. If the majority of the ACLs contain users, this might be problematic. The cost of getting information on a group is usually higher than getting information on a user. This option makes the group membership component assume the ACL contains a user and checks whether there is a user in ownCloud with such a name first. If the name doesn’t refer to a user, it will get the group information. Note that this will have performance implications if the group membership component can’t discard users in a large number of cases. It is recommended to enable this option only if there are a high number of ACLs targeting users. In order to enable this setting, add the following environment variable: -[source,php] +[source,.env] ---- -'wnd.groupmembership.checkUserFirst' => true, +OWNCLOUD_WND_GROUP_MEMBERSHIP_CHECK_USER_FIRST=true ---- diff --git a/modules/admin_manual/pages/enterprise/file_management/files_lifecycle.adoc b/modules/admin_manual/pages/enterprise/file_management/files_lifecycle.adoc index b8c12b4b0..5418de5f1 100644 --- a/modules/admin_manual/pages/enterprise/file_management/files_lifecycle.adoc +++ b/modules/admin_manual/pages/enterprise/file_management/files_lifecycle.adoc @@ -1,14 +1,15 @@ = File Lifecycle Management :toc: right +:description: The File Lifecycle Management extension allows service providers to manage the lifecycle of files == Introduction -The File Lifecycle Management extension allows service providers to manage the lifecycle of files within ownCloud to +{description} within ownCloud to: - keep storage usage under control by limiting the time users can work with files before they are cleaned up automatically - comply with regulations (like GDPR or company policies) by imposing automated retention and deletion policies for files that contain e.g., personal data and may only be stored in the company for a certain period of time. -To impose a workflow of Use => Archive => Delete, the extension equips ownCloud with a dedicated archive and allows administrators to define rules for automated archiving (days passed since upload) and subsequent deletion of files (days passed since archiving). Only files are archived as folders do not consume storage space and existing folder structures should be kept available. The archiving and deletion processes are controlled by background jobs. +To impose a workflow of *Use => Archive => Delete*, the extension equips ownCloud with a dedicated archive and allows administrators to define rules for automated archiving (days passed since upload) and subsequent deletion of files (days passed since archiving). Only files are archived as folders do not consume storage space and existing folder structures should be kept available. The archiving and deletion processes are controlled by background jobs. Depending on the desired level of enforcement, the extension provides two policies to control the restoration of files from the archive if they are still needed: @@ -17,7 +18,7 @@ Depending on the desired level of enforcement, the extension provides two polici Users can view the lifecycle status for a file and see when the file is scheduled for archiving or deletion. All lifecycle events of a file are displayed transparently. They can be tracked for individual files as well as for a whole user account using the {oc-marketplace-url}/apps/activity[Activity] stream. -image:apps/files_lifecycle/file-lifecycle-events.png[File Lifecycle Events, width=30%] +image:apps/files_lifecycle/file-lifecycle-events.png[File Lifecycle Events, width=250] To stay informed, users can also receive regular Activity summaries by email. For auditing purposes, the extension integrates with the {oc-marketplace-url}/apps/admin_audit[Auditing] app to provide all events of interest in the logs. diff --git a/modules/admin_manual/pages/enterprise/file_management/files_tagging.adoc b/modules/admin_manual/pages/enterprise/file_management/files_tagging.adoc index 4e559db3c..a7747ce25 100644 --- a/modules/admin_manual/pages/enterprise/file_management/files_tagging.adoc +++ b/modules/admin_manual/pages/enterprise/file_management/files_tagging.adoc @@ -10,9 +10,7 @@ The {oc-marketplace-url}/apps/workflow[Workflow App] enables admins to specify r * Automatic Tagging * Retention -The Workflow App should be enabled by default (Apps page), and the three configuration modules will be visible on your ownCloud Admin page. See -xref:classic_ui:files/webgui/tagging.adoc[Tagging Files] -in the ownCloud User manual to learn how to apply and filter tags on files. +The Workflow App should be enabled by default (Apps page), and the three configuration modules will be visible on your ownCloud Admin page. See xref:classic_ui:files/webgui/tagging.adoc[Tagging Files] in the ownCloud User manual to learn how to apply and filter tags on files. == Tag Manager @@ -34,11 +32,11 @@ Tags are visible only to ownCloud admins. To access this functionality, select menu:Settings[Admin > Workflow & Tags]. -image:enterprise/file_management/workflow-1.png[Tag Manager] +image:enterprise/file_management/workflow-1.png[Tag Manager, width=250] This is an example of what your tags look like in the *Tags* view on your files page. Non-admin users will not see invisible tags, but visible and restricted tags only. -image:enterprise/file_management/workflow-5.png[Tag Manager] +image:enterprise/file_management/workflow-5.png[Tag Manager example, width=250] == Automatic Tagging @@ -46,17 +44,17 @@ The Automatic Tagging module operates on newly-uploaded files. Create a set of c For example, you can assign the invisible tag *iOS Uploads* to all files uploaded from iOS devices. This tag is visible only to admins. -image:enterprise/file_management/workflow-2.png[Automatic tagging] +image:enterprise/file_management/workflow-2.png[Automatic tagging, width=350] When files with this tag are shared with you, you can view them with the Tags filter on the Files page. -image:enterprise/file_management/workflow-3.png[Viewing tagged files] +image:enterprise/file_management/workflow-3.png[Viewing tagged files, width=250] Automatic Tagging is especially useful with the Retention module. The settings of a workflow can be fine-tuned post creation, see the example below: -image:enterprise/file_management/update_workflow.png[Update Workflow, width=50%] +image:enterprise/file_management/update_workflow.png[Update Workflow, width=350] == Retention @@ -64,7 +62,7 @@ The Retention module is your housecleaning power tool, because it automatically NOTE: ownCloud does not preserve directory mtimes (modification time), though it does update file mtimes. -image:enterprise/file_management/workflow-4.png[Setting retention times via tag] +image:enterprise/file_management/workflow-4.png[Setting retention times via tag, width=350] For best performance, retention tags should be applied high in your file hierarchy. If subfolders have the same tags as their parent folders, their tags must also be processed, so it will take a little longer. @@ -73,18 +71,24 @@ For best performance, retention tags should be applied high in your file hierarc There are two retention engines that further allow you to fine-tune your retention settings: TagBasedRetention:: -This is the default setting and checks files that have a particular tag assigned. Then it checks (depth-first) the children of the tagged item, before continuing with the other tagged items. Children that have already been checked will not be checked a second time. + +-- +This is the default setting and checks files that have a particular tag assigned. Then it checks (depth-first) the children of the tagged item, before continuing with the other tagged items. Children that have already been checked will not be checked a second time. + This is optimised for processing smaller numbers of files that have multiple retention tags. +-- UserBasedRetention:: ++ +-- Examines files per user. It first iterates over all files and folders (siblings first), then examines the tags for those items and checks their respective retention periods. This is optimised for many files with few retention tags. -You can define the way that the retention engine behaves by adding the following `config.php` setting. The value can be either +You can define the way that the retention engine behaves by adding the following environment variable. The value can be either `tagbased` (default) or `userbased`. -[source,php] +[source,.env] ---- -'workflow.retention_engine' => 'userbased', +OWNCLOUD_WORKFLOW_RETENTION_ENGINE=userbased ---- +-- diff --git a/modules/admin_manual/pages/enterprise/firewall/file_firewall.adoc b/modules/admin_manual/pages/enterprise/firewall/file_firewall.adoc index 089126fc3..9ad4ecf33 100644 --- a/modules/admin_manual/pages/enterprise/firewall/file_firewall.adoc +++ b/modules/admin_manual/pages/enterprise/firewall/file_firewall.adoc @@ -22,11 +22,11 @@ NOTE: The File Firewall app cannot lock out administrators from the web interfac Figure 1 shows an empty firewall configuration panel. Set your logging level to *Blocked Requests Only* for debugging, and create a new rule set by clicking btn:[Add Group]. After setting up your rules you must click btn:[Save Rules]. -image:enterprise/firewall/firewall-1.png[Figure 1: Empty File Firewall configuration panel] +image:enterprise/firewall/firewall-1.png[Figure 1: Empty File Firewall configuration panel, width=350] Figure 2 shows two rules. The first rule, *No Support outside office hours*, prevents members of the support group from logging into the ownCloud Web interface from 5pm-9am and also blocks client syncing. The second rule prevents members of the "qa-team" group from accessing the Web UI from IP addresses that are outside of the local network. -image:enterprise/firewall/firewall-2.png[Figure 2: Two example rules that restrict logins per user group] +image:enterprise/firewall/firewall-2.png[Figure 2: Two example rules that restrict logins per user group, width=350] All other users are not affected, and can log in anytime from anywhere. @@ -115,11 +115,11 @@ You can combine multiple rules into one rule, e.g., if a rule applies to both th Regular Expression > ^(support|qa-team)$ > is > User group ---- -CAUTION: We do not recommend modifying the configuration values directly in your `config.php`. These use JSON encoding, so the values are difficult to read and a single typo will break all of your rules. +CAUTION: Rules are saved into the configuration file. We do not recommend manipulating it. These rules use JSON encoding, so the values are difficult to read and a single typo will break all of your rules. === Controlling Access to Folders -The easiest way to block access to a folder, starting with ownCloud 9.0, is to use a system tag. A new rule type was added which allows you to block access to files and folders, where at least one of the parents has a given tag. +The easiest way to block access to a folder, is to use a system tag. A new rule type was added which allows you to block access to files and folders, where at least one of the parents has a given tag. Now you just need to add the tag to the folder or file, and then block the tag with the File Firewall. This example blocks access to any folder with the tag "Confidential" from outside access. From 0a0a4d0b6da055ac854c19ccdc3bbe36f3ec85ce Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Fri, 3 Jul 2026 14:05:28 +0200 Subject: [PATCH 07/32] enterprise section is done --- .../enterprise/logging/admin_auditing.png | Bin 13388 -> 5877 bytes .../enterprise/authentication/kerberos.adoc | 10 +- .../pages/enterprise/logging/admin_audit.adoc | 1369 +++++++++++++---- .../pages/enterprise/reporting/metrics.adoc | 44 +- .../security/ransomware-protection.adoc | 171 +- .../user_management/saml_2.0_sso.adoc | 10 +- .../user_management/user_auth_shibboleth.adoc | 101 +- .../providing_logs_and_config_files.adoc | 12 +- 8 files changed, 1189 insertions(+), 528 deletions(-) diff --git a/modules/admin_manual/images/enterprise/logging/admin_auditing.png b/modules/admin_manual/images/enterprise/logging/admin_auditing.png index 9cb9a4e4c072aa6066cea2241d54a84e6790e1d7..eadd2c3de025c0b866533e51c3ae201b9eb82d4d 100644 GIT binary patch literal 5877 zcmaJ_XHb*T(nds30YRlou^@=_-Z4s*-is82ROwO!7!pMR0qI?uA|Ta(AlEi1U~P-d;fep&(7I>c4p_yIkP*n8)s^)%Y6C9Wf~e9X1&K+<}@_t(Err! z;`x6}LGrcme@BR^p{4fOe}u3{JtGm1$b{wn{r$7up7}%SA!cxCa~F+9AI>-YSUH-W zp4uKN85td|o5Z0|sH(p8^&c_gKM;+LzY;qCPL_q0e<_C|W|0Y={y77c5pL1ZF>W!f z>E3p)d?UdjC6Ue!c5YF=HdfX)zSdUO%rEE;X=pf9^|T&YhRtq&mVrTmxn6 zD&KBuu?;K_>pW_hB51ak}v0+yh<>kS^U;8NZ=1F1(LLC2RO|Dy`t=6Sk z&v;8zuI@V3BIJbq_cLw7_#^1X2_Z*M}Ve3!DvF+@b@09*X4=o+7 z4Vb+WP}05|cojsTHW|0BEL|)Neg41ulbKeXZ*z?sG$X(=`W9(je{k?3&-9rGo2 zj1!EsIY>Cvp{gHJ8^147cAF<}P#&NW_SZgBIw-AQh6tjtjVa2Os`8>n5RhdNb zZ)S^1V2>gO4BMHy{7ndS#O0|PlU7H#TUPw>L7Pm2z>zQzD*wD%hqz8~ayO{>%Zybm zwhhLbsZAeLHFW?~Xp-e~WHNYiAj%*5wOwU=APPqqK+T}55BD3tl*1LC3n{) z@wN>f*_Ltxw+c}zz(UYu?#!JOilSM9_tusPKi$rdCj=_y<)Lw1W@h+PTJ~*KXb6?a6>&+8pciR% z6d>VzY&qC7{ES=)6h*?*z6}R;_>vF%)De$6n^?i(r@C^`dZB~%JB@pTH}cqX#Gwb> z7&>=GG^&pK^-QNCWLv?hVtRU*%UW)L5xrf<^J=|{Ye4TQF>Axyv)I6emya!r19{v5IOc$PX;`i1dS{` zUDaPuRZ@IVl<9aqw?Dh}W%F3`z{4blLkwXc)W}ic8r@dKtP3ZBatcR=}>92@p@H_9rhsGM%(S=?5P|iXZx92! zNE)=@T*z7F)(K)h`gsJwJRDnun6KIic#!iu``RvO6${ad&JuK?SJ9^pD`}%ruJ0lX z{?J*GTMk5$gV|jS)YccWl$G})an$6a4R3a4E%RuVg`bLS%0dbUA+t>Rn=F-i7f4G5 zE1&$^;WMYuO}D7v1XuwF;Ez!~5@U>|K@3WrXQ8H087h7WSRZ>0y^$JRc^vZ0xjg50 zIm;8l+tvHSA)w$EY0RqG&#BhEPok0H!V*DC55?kGnT%AAxg)=p9oReDa!Swh+?-{f zl)-I*G-XB;t=6~Rgp3CDxR`R2VEw0`t|0vDeCrwmZZdH}0*sA(ur?tNIQ*$j&bMLlRLwR_~AEE2j!--dgbl3>k z=e4)WQYAB?SKVg?xXRU*UnVzH$BuEeJeg3B!N_%cBQruID!EWzvZ#m1o8RC~0(b^} zy}@YPp?hlGj}|Ho*GKR4JQ`U|MbW%oqA<=sW9{`gVGgIelpmyd704gXMa5>(*lbHD zaq*WO1Q6aU-LCt2eEkRw>29tpWC85WtYdiJjdwrPiAqqqx9`3=btGGr&Q2G7!m<;4nb9|52HS()xUSu&WyUl`t#b_BCCVnwUCVwMZf0+0i* zOu+Yo3as4*-P*APp3iF;t+#B;J*x#RYBNNP#P@^y71{dY_qj(<-5&Y=@G3NKUj1*I z@YjnmzGmEQPj8B!zv8Z%A)d?3?h&TA$Ih)`nu@Osi_koG&m(gzjfte!<53ANWj)pd z9-BSmR(=Hf*>QsuLHi|Io0>)6dKOMifZVH5C^7_MhNO;G+nAJW3Ab)SgqYm_Ws80n z=1aedEng5dA{Pk_c>K>QBr3SDnv_vPSeMIu> zCbvnUf1XV0PB(=6MXh_4DY;^jc5z|~AbgLz=qCQQLoDowg1RLnSN-bl8{|XDS2Eg2 z)7i+j{#8#g=i=bF%%j=QzdcwHOLs<>haH^@_fKQ2mtPoIjf02h1N5*x@6f)rB0|_kgUhK{2q}z zu;oGlhk4iJJ0>70!=LFAz7&zyX-|djSl>9~c;&-tbUJJ0~*Nbu)Ry;qQk!MnGId-HhQ;sW*}-5R)d zXZGnkfo$CVS@av+GY0gpQ(YvcYX61u#H1*aPJe4=6db?oU5&kzpRr60>$s&|#?!_0#AD8Aoewda>L zt>2#CMxH~_!@iJ3zh8EPWcdQe_KYkI~S)5)B|K}*uK zU7;2QPjjeZvlbfW__7-5l|n@yT*>%=h*jLF#~0iseM+{p_hUWzQ8pY}DwNZRl4mjI zNEFQ!i1ec?l;sGrm>K%s=|uQI_;wB~;!(@2F=k!3(?0n-+0a)+zHeak`kfl1z%-|T zXbtb$;8|BE@OMM()2NJ%cwe~$EqVD0c->W73D?L^46YkA6uWs*_aU3xihVw+*K#^1 z<1og8j6H?7uDP3DHyo0@BJZng`jlOf;BPd0O8^>>;(z$p05OG;m$v=Ew!3YA`}6Nl zynRqw^MUT|zK0j$s^Zd9w)I<;ogqe6{1IGN1DhQ)#+0=~N}5Ng z4-?4NP%|pXd@t>Ztac1N`ZXuM@jc;S4c*q8p|-(-#KnrbBKO4^9QuQX;5FB?Z$B;( zo#a>BWvt=&kaQ8no-ZszA)}g@kZ|_eTSQt$6E&WsqHtDd0La{4U|xU50Ur(T;5>~U ztikgsmMfmGXF^I{d9#%D&_@6wqrMRc*J(~;?x*a6?_ys%!LPi*f%Yfp9k$|pyAt1> zm&bf%;CQ>;V2+suTwk2uSSk1}N`%Q1PtAVcC?q<62-)J>nR#r``b^5m7*%$Ol_(PF zaKg!XQ>OSgRq;p%$&B=mLBIJiL#lQ*-`kn865Y<>7vzgF%KbfdR}_YR-q{jD(w@}l zvvc>W?KC;l$Ll-_WSNK8umx%_ZbsqC<`QhxS+;KOdxd>Q=n(ao$*n2kac zc$VF)ypf|`ye*|5nO>c|RW-%F(;O4ejnyt8n!0{;A{M9;$=gAK$;0Tlem%j+Y0DAH>t0 zl+B=OuIh3`oO##%Uh_)<;vpTd$N2x@Y!K(YyA^$!+j6vuI4Ovn6qU_s4(Mv}-<#uu z5JJmjfKt^MYzJ&AagN)4v3YCIp>8r!lj?z-7CiCpLhOse*l4Q9GiWjeb4{yyor`b$bSKK=lGeB-z z%Pn>YaOmog?wTvTFTbf6v$!VVL(py*tfF`s)T;xMPj)SB6~-`f2iW-lPZvr2n+47R z;eNi&CG56W{mj76e$q^`b6Y(cR6*RMj0ppC4WF)*-v_&}xvgbH*&=*0_?z#~YW!aB z#)Sm#R7wKHa;Y~l9->b)wTb7g(QY_TM^Nl?CFe@9Ow{}B&h~HaW*^>C+>`SArdf_e zuaF3uMgiY?ee$0Fn2oX4HA1i181!!zkM|pcoD3avbYK$**fvS;Y3W;&t0cG2GNvnv z@4dtLb|LrtgAMg+WzO`o9KZiP7CmhxO~f>}M=qr{LuOBIB>djP?a>z82Z zK`$;VgT{#rvt2()Hi0j_^}VhEGH2F$Q~y?7N-H*`%%uK=Mi~%^N;p3zt@@p0L)C|Q zD7UH0b>K7xT(=N-VW{!3unLe`wRO{(7ekkbjfvV1UMKzjEF z3?pW9bQ=iN<8|*;Faw&({vc8|zX#{&Ry3Yc`pMb%ZbT%?{()S7FqF#5134$)fpJ0O|I zIIf1vR$d&&@$JH~MjsT%+s;BJtYE*^0}ATFj)2|YlLIL3Z5vFx*3|Z3go1UH*-5g$ z8~Q2B3!MjU2@rDCxm4xa3JZB&Qrt&9Yib@sU~M?6 zc)(d{2h)^+%-F7#_gTfBtAz?P?TUcPz<>y|O-5l!?3gu*yh`SIJ%t5;k>j94;W0)g zC}`u#|CD?Ju4$FL^FP$TjzDJI21T5fbRFE=r`W22IELZf2Sp5c=g-o$k^+sg=E?hF i@c(K*|7GT|foQ^4`wxG;Y{~l%t*33Q^;N?u>i+;NuO@;3 literal 13388 zcmeHuWmHtr+b-}fAaNh9OapgXIWNPT%8 z`2`^f$#1YY+$oQ+Hxo2?r-G zs6Y%4C+-!)Fa$z_j>(OKgAs%Tg+PL`|6d(e*Sh;YeG-)_>uxsr`czn#*bFJd>G;jjjnoO&&iG3BEr|gqId;VxzxUf zgbgJQX+UVQOu2_G%@f(Tt6#?XB#eluWogxO-pz;{b>ZzN>)1OnX_SPw#QQJ$oIu^r zXDphs{H__#e;a(*)NyE;Sa9kgU)O*5I3Sr{HNqg%Cn%rH>}23~^({@vvnoy0-*0!K zj^sh9NT{XDqgU6IS>C+=74DNWMRB;5tNc+}6AJU7YR z*ON3GT_?5Z&#jG3dSYB-MXoI)#_q3o%I$lK@@aCAZ^?GY`)>sOtj#!gdE>t~7bioaa|cKNCW<%j&&vI^+K6!nJ5AJS`-L{X zn#>oZ+5h_$O={umd@6j6lTv~`2>0Ht46~UmNo`3+f4C=uG@p*j+y9CphR?@4CVf>u zuaspi45jll*%(N*Uu^cYKN;k!W0$P6U)Y7%cTnqmh>c`xosK3G7|rlG?z11x7PmiK zZr=|?qi{qc|M=zQJ+|m=g-)xF=Pvm->Ou;yt=DO2IgY!PJ+nf0!EIOU@-M}`FBaUJ zzGwN(?$xix?4Qp$)OiY@3~=o??vz!x*2%NAj9t@$ z{;t!DyS$m{T}I09m|ZHEqub_pH%$gPjszpSYxx zN&+_h-TmehMJ!e85N=FsAGjj_Zl`c_rXgi&s=se%5VcA=x~3&!DYmaGfTwxx;~P%u@@#Yv(IZc z`=K=I%Ly7O)z#ywHUfV{pq*w1*HUSJiaEwoH$NIpDY^*j;Xo|e9TEbZg7|3qYU-V20VXqIe{x^Gdm6{I{V{3&fdGlpW`_?Nd=x7AU z>xV0ydjXO(ON_%bY?pLW9ZVEF+?WoiVWzmyH0EH5^d`*2e7OX=GO)NRmz;ywt0`!$ zhO+~qTwva(nfzZ5^ONU#o@`WVPC~NB9;8`HYg&2Ye6q#laUSML9hxhjePS32zMvEQ zTfV#1p9B9=5uNOLEJFt*7V!z{^aM{~Uy1K)$q5c%HI{;TY=Kf~s0ls{kCo52I_^S78%HRN$x~xQ) zq116864d!~K(2onUXr|I`)~F$iDpA5kzA`JH9UTSH04!OH|tLNjF0ipVj7l%u;%{= z9+VhetFq%;#&bPIy}DeDwfiaa=1%2woxLQB$@g&a`166%@s=i)t{S-qZik&7onrb{ z>-9e-ckr-YPJ9w*i@9lb+E49Jz>EM_4mDhfSAKda`z2nmAR+k>s{wAbm#L6h)xf@ru0x)v78Gm!h9>C|q75 zHRrHTf+wy1BY`^w+qQNrRS3yq@znH)+aCyuKR4C(+Ljw)zHcZI@bo#Y44o?N%<-hf;pa zjD1(CYkdPF?GGBB@!BcfOXrZ@@YId@Y(t3qF;?`xJ|v^O9Y@UMS5zg|4y$%eFKct! zQ>erIhlDFfs7zVKN^rD9)`lYMxI8pui5v&f4QsaT^j^f1zxfp{Jwr$9boo zhPp+sVoNdEQ>U$*u*Q==fpc=k5CsG_7Wx{{K3kEm3Oy$w|L$)Kp>0ZO04b`5qs!+F$=pHHwq zZl=4$@VF#@%w<2>Nat^5dc3S&UEGx;DWSD_7@2c83SySYX=6fBt~o^c#lLx^P|uTu zNE8dKl-9rRZsuWOkuOBg#?_>PC2m(MdnjBiGCd1;N}aoXuLY%!wHz-bnHUj-VnVks zm3ZGpdpe%Nw#|jDiG||zN?#}0A!@qF^2RFsjn`N8NM_O5u&-Z1CFN)YeLMMWe4IAT zN>2c>#6lf@_*z=FwPg{iSQU)q;JbgQr)gg7XR`|C3k^sT65HCrHH7^itZzOjA7)GtoT zg5jgo&-Fr@MknafEtwuctkCHU<66NP$Mom}+T=H(IiwI+e$aui`<&ugmm`dU_-W@L zw13QkA)W<=(sKP-wKC&)KDS=u$I60VMxCKA1yk7Kwu+t$?p8>?gC1xu6p*t`-$U#%G@%-MsecL`_kko5yZ;{GK(w9Fuq0 z^5MIuV!R2Bg_UM=Av%h-5p@lJMj#X15$%b;B3ZCly;m>56#MWQb5cP|^+5$p@pe=a z&HmxTm3SvD>X<4nsX#iatNd3t!$d+k>`df0jFhNN;o+u|;;1A%v8Gcq32l{G9^v8Y zs3?NJcg8k9L#z-8tEMhkT=Ca&$$`K z?+e)R;(jxKE#9*@p|ODp3baLH)jIDh-u}drCU9oOPQm!=BVhk7)v5uV>)9M(oDc5! zo(U(h^(TV5LHYso*s5jxCqdEP{$|!hcc6h(>2s-NN63mWUefgxR-r=QpmV~w1;kS~ z29KG8FAnuL+M78!67@IJB4o`7)w64@C*GVh3)e&MyCU$$yr7VcZlP57x8JF8>&#_Yre4JCnq0c)R;hR=!V?ZZqdAc_@#bY}?{Ju!FneRM zCA$cKXaWhdhDcAT6c(y0dWR=0I(K3XWa#k<@JU9U8-8L5nz-w;9UVKH_1{UAnz+=L z7&&fxv$PqSoGGr0ScyRgQ%XNU+-c!>U~&o5mz z`Rmx{oWU36uxpED^}mYvHu6++-ipjU;r!20O3>WrqlmefmHGPw=7Kr?bCB(^<8Q`0 z^}Vr{nR%Y5%c=tzEq@%eK~gKHE=QKw3S0o7wA5miJn7wu-QM*oDH^WhbM2Vz`a?Ub z`bzWG=dtCQ<(W31>Fm}G^i5cFVGMMJVY|C*3`De4(Ur}PlpBa@7HhCv0K72wGa7)x z>4PJpm%kaLklx(mez<+ad%VjgfXlo&sglZPSN|uriY`ok@v0xW>=FR%lWB+4goCWO zaM>SkTob5kvwhwJuszL%gCi&P?KwB=ADv{T8VjtQ#33Uls`%Jr-r+a>FE{au2HZ(r z;4qeh)mB!N5{<-1d7zjc?P|PK6)Odih^q^hQ0?xm{XA*OFztW25;pD7(Cv!M$4?qLO!Y@sHT?txD&wkU}zSI5TJxn=+s&#CFA`# zIh%ir6Q}UzQf&3d={9=pBPlzDzh)LB@3$~e|HX6`8IJFh{aO!dJO1V0coE(Wi}we* ze#J1KZ7h78KKLu7XbBgHyBN&nu>yFxoq6I-6a+W zR{FPE_^;+sVWs^4S!61-Qj?2GO2L83)cHMlgxF6f>@o8dp^yfbz3@yOzY!PJ0OBRu=$HcZ-=HCYd{=#&vZSO1JQJ2DTH?m zDk2U&^BWHY>U|H}(H1hj_qS(jtnj=i1U_rt(;Ikg)AG6Pez*WsbGqFgaQk_2G;-4{ z*DBwi-rp5c|LXhSx$@c1*XLf?SG1$r#|oc2>e$sLE!f>P9kfmZ@K;p| zn}PkXp}w`x#+|e^@(PEaz2(9D`LGA;(xnJ zX`cY)t@P~{fAKJvK(7QpKr3e)zSkJ`1w-$err#y)Q^HRq8+1QdT*z==^mI#96i4&p zY;>Emt7Dn=8^NKLo?iV?T;|;3eF3L)H|Q;|ozyOK+5Dq%7^ZruinqR;VHZ6K=Qku3 z^=rPFYP&bfay{kR;1YefJz=R3x!$7oUZAeY^gY+oY;v=6pD|0BK@42d^r0sznf$Jl z^^Q_M0^c^!XcB2jw zw7Bt#!i(3|t(^1v+vEOHx$e49HN#<{ghJPJzYxLw`cBMIQx8g+VM2Y69Kp3OlDMoU?LjE} zp``YX@+qvfODzH}8}*Om-A|fBcu-{=?svUSZ_{d={bENB@68=`51C8U-5+iWnWZe> z^VFTWI)@NUrj4t4m!XCP#kWP4S|!-fR2BRvFr7M;u7|f?G7rg?2G5Atf5J;a^{gz4 zU#-qPZ-13smE9L}-vtgefZHF0N7&^x#JK(ybOx%&>|1irwYYt-jw{b%dumSkuFfoG z!Nzfm9%9q86j?(E*|^wh?*mnFH#_9MES}qDa^SJO4Q2`po`0^st5{Fg`4><_hRHd6 znQQsgYkOKr=$II>BO8780jy>@KFi@(OyLxMmqvVErIF2$*y;Z zGSMsRDF$vpd}u^b$Td@5wGfl`Y3FnOr>rc5(2WuIdNj>os@x!r*$S<>t*g<&rW&UB77TWQ&x#ct0a0?Bdo~3f~-Riv%x^p zUqyKRd71hPTg$2HjbIiB8ul(>E7SHbi=V+~5!yiNn^2awA;>4o^N-Oco~C%7{PCy0 z2nw-f)a~a7s(#qC($RPPHBwY`GEhLu058-)KgL$1#HvldSn^-Oj0Ej|PLw~y4BzMs zJcULm-vYN4;_o=lkiWzh=|=5DdcPRIr~lRWJ$ujOQ^+!M^v6;%HqT))_C7NLkDlP> z4;02-G;PVNxW2X2=0DQQRj~+ob=FIbahi4^jM~q-Y>6ZkG6!MgZeLlRa2s$C-$qK`i7Lm}LD zW^^*_OLjwYaE_%KIl5k}l3&}Q)-a{q3HcmBn*lo1Iyi!2eE-rf=@SVDTJ-J%L#zAI z>l92>#P_E+Dyc7R6HKfgbd$&*>SyY0T%}xhr$=DAe`_sAIxyLm5@jt_>LFM()>OB` zB+N&bnaVcr#&xBmL!Y}X&37&g33SkZ{Hg4MNfi2lO$R;@gpEIY8|`}fRdfzFwj*Zy zPKfFA-gm87am1ri{9QJrByGAK9S!^r9|B|?5m3J(P6^dRB$))d#c}k1S(M zvyfIgN5<~g6y~v3)rN`wszb3xY1IgSG7g7~2hbp+OO6e{{dt9r_ zjI*a1&(m!-u^Bu*dF@+>qmkfS`!jX1%TH4Nwh`j5I=56bzG0v#EOIiHM@afq@W#G4 zVXHU&3Quta#}k<_M^25d7HLUcE`hX`50g<5lTNokGQm^eqOhie6$dthK6*J4Md9no zUHpyHG}A68cGSe+#5;FG<=mi#F7D~3!bne#*P2Atfyffqx!w<+7IoS=3m>*CAFB>l zj9PwJRo>v#>A|SQPFg*!D`=q%4uvY&Djp+KiP*vP|DmbA2Db9ACkKe$W^GZXYzV`$ zbA1iS?$kPSP=CTlZQpCNL@d7^#(lQ)y<(-Q6Q@$<0VjlGr`!APwx|Wi2cH{RM=R`` zjLJ^lE7M_lt+byEUx-JAeJ&ku2J*fVb}m|Fo=LW1eAHLM&qQ{qQHrqpTOH23<8@lz z9eb+q35I%;poTd*;qZar>5S62fA5a1L1TH?_Jxa20GF)kW`;W)@onEV7e)ttrbh>A z>7_Vx_W6)|Y+OUbbXW*;xR|7tBnt^bjpj+n=3N6iFJSgsXp=1!7f&uj0CKjTN)j;Y9yn@O$_&nk)CI2x}})YbtBdDu_s(*|{ciEPV3d9LG{ zE~_*$=j_M@aaAU_zY70#P?FWmb2!H=cJGNDeCF4J`;xEJ&1bZsC6CqU#L)N?VvgTm z4yZI63`z4g&sD_KnB?3k<2J)iZh~o&d*IH(UF2@lIhJktST`xHQxKz}%`W#)rUFN= zaBO^9 ztg!hLIS=gqran@v#&@LLv)!8=Rnx@lJAAy&30SXcopN;&DoAc z9?4y+k{h}7EF>T6w2Y5kJn)E^<}(z@(dYqMZ7&$;yD65 z#PwoMf=J^R`x7YpQ?Kwg&R|*A5oAR?R%lPWpg6C58{q9YmkI|V^D>zv()mZASt7!`A>sKFfpqZ}^;0^) zN16ZfTJrOLAU)MLAo;B2#E=U%(#j{-H@Iy6(#MG#-RiPttoxk#LHLnwY=6&c#8VO) z@%!Fq_h|kU=EXPz@uzC)r`?``_a4v1N*HD1)yd}E(p&d^+k?DR+~$iALj4M>`ULlC z^TGK?mf&@i;BlkTWakJQCu+}MA0``%qcy|>XfK;7*rt)Uv z3m+XYi^gh#7r?H2^x?Gd^1~Aq1L@Y2qs6EP9<8A|V7)c9oX_@8lp8Ds1qMWsTF`AmL2)vUAE1G0u%TFe1|j!b|`@el3VA8G7HL8RQ4Uj%_t8z~X( z&n02=JCSjJ+9b9%TN^O$kZejK7a%&n#Hx7|CvWfWapL05YWgb82Vs>KxG-B^_(AhY zjLjUp6o{Ig%s-V&wRxIsYOz~@;yrB#Ai6y;+3MJz1d5Bjz#Or0eDo^I{2%V^i%a2E zUyx3|C3n^G7DWX9q^b8h-__zK7v)>@Sj}apKHb`UyH_(-@~hWNg>-lHTjbyYsIDv| zMVG*q)Cr*UzdeHQEA*V|HM!Nk$`o)ZfD%gWC7fM>$7Ea{E-S}LVwq%Dqiq%+J(S#$ zP6EByUxHSDdHr3nIGs(`S00<> zV!bB#1jXtI4e>K-q)7HtXuitcY;E;=w@F4}w6$TltTngZCM!WKFVIBTQz8jjVV;5Oh4_~g>XJMSoY(Mug$-?ZOY{6TELW=s(yrEe9O=Zur| z8XDuwMTpl0?{OGWf+Zl%Mgw0tiVxZz?x!7!H6OGB<_`K(*y@&2SajfC%Rd8)+wRVF zZiM613y!`%1Ry@ywP=pN-vBG$`mBf2zxlcyjk0D_?Yp9$?--QtWvPQ4VBb|BS1 z`g~KpQFjg4g_g<8z{8NTg4I1$m6z);8%wHnsRW&!$x=JRo~)&b>EdpVXFR{+3*-o4 zC^~RkD`+$rPLuHWtmwGdZ#khdcr?^+R-J_9VKl28UufQ5NX>KsMVxkhI~WEc3OCiLR@B7pw*<@| zmi7Iv%%)m>y|IX4Gy=5Ci{1yWdD78uw4d+D5IL2;i#?=Hw}P9B48(2|{S|$LI^Ky7 zq~3PzUm5{eN*XUQg&glkL+e^oB$f}A7PMN zeDs*-u8fX+b&mW^5PAXawWNQ4!iQ?l4m(;7#-I%VJuH~Et;un(#kT$?JG{}y99 z-Fi9fGWZLqbAun#`FbK|(=#hNp9|ub5(d6&Th_A3c>gz>2-CxZ(`}do=+Axkn#le{B0a5>|ma zX!jae_Doo;ht)u~@77P~V7Hs)79_&K>Ek1Y;#uo~4VwnbK@uPI>WinXTms^%{I4`J znOKTF7_Xf*G?MlR8gp6<%2qElkoU|WnayCIPAOA& zoUdnz50sN)oMRCM(5_2CZ+Z;GoHtzn-ab17i2JyoR{|ZhYSskwQ{(ayM!yD|(%R&m z>B_vv1Q3rvRhi0?|3k}TpP8`z@xFLt(!k$WhxOoO%fb|Z_*pI>ceH9a~XpxI5GfgPUw*#CESzzLHFV@Why zyv}SzZlkx`EhbBK_-;tQ9t`J5?ltsyo$XAOZ?%kEb(AyJeuT#YYGT^B1$PCgefxixb!Ry|3 zdmK3jSZO4T;VPq50LFsBQSi->#&RodXCyDI1#Z}m1a|zAR$H?F0jR6?D}4t#_6^^l zXp<{o?^guX0%UQnEi@UnUc~|u4o)L)RW0#8e6r@I(Yi?GvY0*gWj_)eyV#u>E7-iF zmWipcI~uHL&3f#&1iglDC)2*XzQn*55jjU0Vm!s5KuVly{J5=J;x=$ji^(mKxXu6K zmE~9Zc73tGTKw15v4>Vx77&6x{L?5~J?(>ODWon=9OUWFqlD zBFkq$rkOc++Zt{!c!?uNw@Us2KNJ9+=$E_THd^oU4dp*g5#LP%RVw$(3VjHf%nezs z_ma;^w9R63gUwW#-bf8T>=OnGEebt4&W3!rCo)REQ6osV2%P^jsHF+&BK#epe5od@ z_EUN)?kxL-xv;Q=83?Cnc;F#?5{P}qJNRM~c$?6|!eENw$H^ zMi2K0$EY#!_J-b`=&^iMB&LLdwQsca#_{Sn6G zt5abGYDhe@%^M>^a!_1krjr7V#FCByUN+tOVa(gn3T$6Bqc{An9bqo`JF*NZJPOmv z0Fvqq3iycz-gUucHv2`EPr`dF+CQ#iyvHfht-`gW2%)Pj&2XFT!}PlL_>0vKK`|7< zOD8$~B7R&5_lO5;D9it1w|c1T zh=|iP{4B6C27i{@SGBhdX#0}~UEX=q=E;;xv0u?oA`MdFX)w9iv(!amJ-+SH>u5SGs{D|`mM7)@pZ{s)TmE_UvNg4D|G}NW}C|_t7PLoFA2uxk;rG}NmFO9_zS`U z3YXLNO?#iMgGdwBQ%KK~8q`rqh;``;Y14)oWJgey7AdDlyp=G4>EXwny z;t=YGOaP6FT7Ghp(-3VAS(GfKDSrQRit2CLyOv9Hj^v%RmulU&TJ+cCT1wJZxixlW z;g{M~J%|BI8&!s0=e|BHV@hDX*iAWhd;=%B!jYt_W&L45? zud>Bf-r-T#ierv$8Dd;V5YcojdFZREk^7sFpbB+S4-g^XcGrxfTWK?6PbL%yQrL3w z)IsKSRZiV$F?l+&NQ$vN&rNdge|qfFUtbfY$8QCMv`WCCpjU1uj)>)b$v@nbT_Ci* z%`g9KG<#~4R2LB&NI8&ZwAso|MFL#SHFW_u2nj-Ms2X?O!Y$Y}fkYY;5 z(PI_8v;1l4kKb?X6?%0-(T4ps2Ej~NyaF$DMENzc07{_pY5TyIQb$0}ZtFvYC#PMN zw#geJ^iCn)=+9@X*#WIW$=f*UC0IKocS3kZTf%dln=4aEOEV5W&riR74$oJU9+J%K z`)qWLA2Y800e?^hnRru(gJg)$g2S%LMu6^yl!s996P*GBbCEFnX_`xo54s2bC8&ax z&y->*FU7xBW`g4S?yVTrXY;nLhzVq*JA-jdfsBB&s9ZUh+sh+f_7GpOaNLjSS=}x{ zpROt?2GV>bhPiAraRNu^MB4`M*G%9EvoCyI$2|()<9J1s(f9c&e54?m8{oafD=vz_ zk$u__o5_pNk#K@CLr`Fn#bL}n5;4IXd)E%HjAjmNRa5i~pFBku5?Lw*S;=T^9XbD# zub~O80&HJ~D9LsmDfA8&TlRn{y3!docYit-F8iU%xz@MO0GWheQ~{FzWgYkhfCXp# zZ%zGw0-fRP7mpcQ>;KyT=u^pjr5DJ;+Rs#(Jz7 zRvU217ElOvms=n1Z>Ed4FXkND8bCoE%y8_$*nd<4TC_O}OuQC*ZloYI)yGuB=6}++ z|GeE{#tPV49amFweT=4(a+=DHl&a-EqVPwTQZvh-*~4k~Jq}J$)Ny0zIRMU04y{+e zo{@0(>N)q(+K=YTRkq!J1MR5{*dT6W{ix4Ky7WP;_%}m2QmOqy>cUcG}~Ij8}qsZ$lWI~`ki4ATJ!ayMNJ)DB{^)0m0zvPqB~ zo_6RPS@QraX66KhZ>E5X@H^8R*j27T(W^^)>-ytAk=m=Z1UYDt3m~z%S2le1Z^8xm ze{R71^d4!M-+IynD)U0U(<-x=W~ugirvJSspTnY1-K4fn!ybI@&mORQ%K&iT72cBc z2CisiX?f3i>tP3$Js|5ESRmHust0lb3yOk!iKBO`ewQm~Q=m~#J5W&t1rgy(43+}M z?Z#G7-g^BTiJ7<~4E7ibwhf#r(c-d!tqH715qWSMagzHwDRkB}KSc8_R(R5o3><+- ztWG_LXve{$Eq&+%h%DauN%zfhKidKr(GH!$SHpvgep6v|*E5vQ;fYG^QO@}@aj*fl zwp&%^#J_`CqD#;;-ob(v;1e$R-=9!oy^xmFcbhS@2R>B{bXymY@&zeEy|w-N)#qt3 zJ%AKjBEI#z^>~C(-37O#MqYmeHtWGUTUY>?3rHk?s<(Thh*yDn@-poW2Wt6K3Zd!D zEa%^h{|W7yJtyNIwrkuj(8wd_F#dF>2Z8)9Fhq(j5MHv?RAnguyj3FsaLm*jaAz3~ zD!?ubJ*z%)kKJgA=AA8^wi*9w`9}v>%ff%{8rGA`fHqwAF6qtrvOsyDwr1{y2k2L6 zKm>5fcUvp<<-PvFk=G=f(0XV9{Vz=#??$oNv+kk;16Z@i|W zig>AzJ)*g8!wR^5Wmbgp+^qk@-NJ|r<=(%ka)-eLCE>Hg=wu%tqT4Q`ZSj$^8wO7E&z7eRgP+;L)JGmrCx?baabWV|&^VEH2)4ENI2{ zOvgcwQa44W;bHspK5z2m(QX9`bN}+~kA{0Y+%W+_S8$eEU_5`9`XKyE(nyC^`MHMgN zNp5-S#PRRoUvW7c?+0;1Jy2Vcr)e%got*vo*%azO9*<6L(4Qwaie2}8DcW4le_xvl zK+pzKLAR1;yesW4*1k_6M)}5aJMccbv}pmi@hyFyqwZWfS#~yQC4Eho| zZD++DIB)BR2aR03;=AT8m(}2^Ebv?a!?BC6v1Hd!O6d=+ls;vOVSzf(3nCjH>X8wf3K23mNY8G*$`?r@up& zQF@^iIy@FJ0SfoJ>$B+WZ9t$hs=EbDi=IwqZ%925ixy#UESrGl!8`qTRGzJt{fYR= zkpKOdv=r_;WX$pm&y7_39&+~@tG^tV!D2$kz0`I;Be3PJ7jum?aIKxvDP`~&I?uFZ zC`#BgF-K^d!Ooy(v$j;_1sXwkNs*znz~}JrM96G-3%?&4IXIX;9TiQm%|U7YzX${ ze%a~f`&gRin}h5ijvO=7<51$QfFAw-P?A7MzwzG}$HG6WCS?Hs0fZnYr3fjLFbw)1 DP#Q9+ diff --git a/modules/admin_manual/pages/enterprise/authentication/kerberos.adoc b/modules/admin_manual/pages/enterprise/authentication/kerberos.adoc index efdca41f1..484b0f20b 100644 --- a/modules/admin_manual/pages/enterprise/authentication/kerberos.adoc +++ b/modules/admin_manual/pages/enterprise/authentication/kerberos.adoc @@ -9,6 +9,10 @@ With the Kerberos app, you can reuse the authentication ticket generated from a user's Windows domain login for ownCloud and access file server resources via ownCloud without re-authentication. +IMPORTANT: The Docker image does not provide the required Kerberos `krb5` PHP extension and the `krb5-user` CLI tool. This tool is an actual requirement, the Kerberos implementation in the WND app requires the `kvno` command which is contained in the package installed. To mitigate this issue, you need to manually create an image that installs and enables these requirements. Please note that the app will not enable unless the `kvno` tool exists. + +include::partial$manual_config_file.adoc[] + == General Information When using the Kerberos app, the Windows login session from the user is taken to log in to ownCloud. This is very convenient, as the user does not need to re-authenticate for using ownCloud as he already has authenticated to his Domain. In addition by using the Kerberos ticket, the user can also use file resources via the xref:enterprise/external_storage/windows-network-drive_configuration.adoc[Windows Network Drive (WND)] app without the need to re-authenticate. This generates a seamless user experience. This is done by the configuration made, which enables the webserver to make the ticket available for PHP for further processing. @@ -135,12 +139,6 @@ The administration server. This is typically the same as the LDAP/Active Directo ** If this is not the case, you need to https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member[Setting up Samba as a Domain Member]. //// -* {empty} -+ -IMPORTANT: The Docker image does not provide the required Kerberos `krb5` PHP extension and the `krb5-user` CLI tool. This tool is an actual requirement, the Kerberos implementation in the WND app requires the `kvno` command which is contained in the package installed. To mitigate this issue, you need to manually create an image that installs and enables these requirements. Please note that the app will not enable unless the `kvno` tool exists. -+ -include::partial$manual_config_file.adoc[] - * DNS records + Create a DNS record for the public FQDN of the ownCloud instance (``). ** If there is only a single web site on the web server, the simplest option is to make sure that the public URL of the site is the same as the FQDN of the server configured in the `/etc/hosts` configuration file. Create an A DNS record for this FQDN pointing directly to the server’s IP address. diff --git a/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc b/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc index 20d00f48c..6227f0bae 100644 --- a/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc +++ b/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc @@ -7,7 +7,7 @@ == Introduction -The {oc-marketplace-url}/apps/admin_audit[Auditing] app is an Enterprise only app and available on the marketplace. It traces user and admin actions, in particular the following events: +The `Auditing` app is an Enterprise only app and available on the marketplace. It traces user and admin actions, in particular the following events: * Login and logout events of users * File system operations (create / delete / move; including actions on the trash bin and versioning) @@ -23,25 +23,20 @@ The {oc-marketplace-url}/apps/admin_audit[Auditing] app is an Enterprise only ap TIP: You may also want to check out the {splunk-url}[_ownCloud App for Splunk_]. For more information, read this xref:configuration/integration/splunk.adoc[section]. -== Installation and Enabling +== Enabling -Download the {oc-marketplace-url}/apps/admin_audit[Auditing] app from the marketplace and enable it in the ownCloud app settings. +Enable the Auditing app in the ownCloud app settings. .Figure 1 Auditing -image:enterprise/logging/admin_auditing.png[Auditing] +image:enterprise/logging/admin_auditing.png[Auditing, width=350] == Configuration -It is advised to redirect messages into a separate file. To do so, add these lines to `config.php` and adjust the target path accordingly. Otherwise make sure to adjust the server log level to 1 (or 0), or else the Auditing app won't log anything. Configuring a separate file circumvents the global log level. Note that the target path must be writable for the web server user: +It is recommended that messages are redirected to a separate file. To do so, add the relevant environment variable and adjust the parameters accordingly. Note that the path used in the example is the default mounted as a Docker volume, which allows you to read the logs without extra effort. Ensure that you adjust the server log level to 1 (or 0); otherwise, the Auditing app will not log anything. Configuring a separate file bypasses the global log level: -[source,php] +[source,.env] ---- -'log.conditions' => [ - [ - 'apps' => ['admin_audit'], - 'logfile' => '/var/www/owncloud/data/admin_audit.log' - ] -] +OWNCLOUD_LOG_CONDITIONS=[{"apps":["files_external"],"loglevel":0,"logfile":'/mnt/data/files/admin_audit.log'}] ---- NOTE: All messages regardless of log level will be logged there. @@ -55,14 +50,11 @@ To ignore all CLI triggered events (default is to include them), set the followi == Grouped Logging -With each log message, a number of users are calculated to be the 'audit context'. This is the list of users which are related to the log message. Additionally, each log message includes a list of groups that the users are a member of, to enable filtering / splitting of the log messages at a later date. In cases when users are members of many groups, to reduce the data output, the group list can be filtered by adding the following to your `config.php`. Change the groups needed accordingly: +With each log message, a number of users are calculated to be the 'audit context'. This is the list of users which are related to the log message. Additionally, each log message includes a list of groups that the users are a member of, to enable filtering / splitting of the log messages at a later date. In cases when users are members of many groups, to reduce the data output, the group list can be filtered by adding the following environment variable. Change the groups needed accordingly: -[source,php] +[source,.env] ---- -'admin_audit.groups' => [ - 'group1', - 'group2' -] +OWNCLOUD_ADMIN_AUDIT_GROUPS='group1','group2' ---- When the filter is configured, only the filtered list of groups will be output in _auditGroups_, else, all groups that the _auditUsers_ are a member of are output. @@ -71,7 +63,7 @@ When the filter is configured, only the filtered list of groups will be output i NOTE: If you have configured a different logfile than the default, you must download it manually. -To download your logfile on your admin page. Click menu:Settings[Admin > Download logfile]. The default location for manually downloading the standard ownCloud log is `data/owncloud.log`. +To download your logfile via your browsers admin page, click menu:Settings[Admin > Download logfile]. The default location of the standard ownCloud log file is `mount_point/files/owncloud.log`. TIP: See xref:configuration/server/logging/logging_configuration.adoc[Logging Configuration] and xref:enterprise/file_management/files_tagging.adoc[File Tagging] for more information on logging and tagging. @@ -89,11 +81,11 @@ Connect to the deployment server, change `input-prd-your-server-here` according === Monitor the `admin_audit.log` -To Monitor the ownCloud Splunk audit log, add this to `inputs.conf`, assuming you use the custom logging path/file from above: +To Monitor the ownCloud Splunk audit log, add this to `inputs.conf`, assuming you use the default containers mount point: [source,plaintext] ---- -[monitor://var/www/owncloud/data/admin_audit.log] +[monitor://files/admin_audit.log] disabled = false sourcetype = _json index = main @@ -118,20 +110,55 @@ Log entries are based upon the internal ownCloud logging system, but utilise ext [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `remoteAddr` | string | The remote client IP -| `user` | string | The UID of the user performing the action, + +| Key +| Type +| Description + +| `remoteAddr` +| string +| The remote client IP + +| `user` +| string +| The UID of the user performing the action, + or `IP x.x.x.x.`, `cron`, `CLI`, `unknown` -| `url` | string | The process request URI -| `method` | string | The HTTP request method -| `userAgent` | string | The HTTP request user agent -| `time` | string | The time of the event e.g.: `2018-05-08T08:26:00+00:00` -| `app` | string | Always `admin_audit` -| `message` | string | Sentence explaining the action -| `action` | string | Unique action identifier e.g.: + + +| `url` +| string +| The process request URI + +| `method` +| string +| The HTTP request method + +| `userAgent` +| string +| The HTTP request user agent + +| `time` +| string +| The time of the event e.g.: `2018-05-08T08:26:00+00:00` + +| `app` +| string +| Always `admin_audit` + +| `message` +| string +| Sentence explaining the action + +| `action` +| string +| Unique action identifier e.g.: + `file_delete` or `public_link_created` -| `CLI` | boolean | If the action was performed from the CLI -| `level` | integer | The log level of the entry (usually `1` for audit events) + +| `CLI` +| boolean +| If the action was performed from the CLI + +| `level` +| integer +| The log level of the entry (usually `1` for audit events) |=== === Output @@ -144,10 +171,21 @@ When a file is created. [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `path` | string | The full path to the create file -| `owner` | string | The UID of the owner of the file -| `fileId` | string | The newly created files identifier +| Key +| Type +| Description + +| `path` +| string +| The full path to the create file + +| `owner` +| string +| The UID of the owner of the file + +| `fileId` +| string +| The newly created files identifier |=== ===== file_read @@ -156,92 +194,197 @@ When a file is read. [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `path` | string | The full path to the file -| `owner` | string | The UID of the owner of the file -| `fileId` | string | The files identifier +| Key +| Type +| Description + +| `path` +| string +| The full path to the file + +| `owner` +| string +| The UID of the owner of the file + +| `fileId` +| string +| The files identifier |=== ===== file_update [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `path` | string | The full path to the updated file -| `owner`| string | The UID of the owner of the file -| `fileId` | string | The updated files identifier +| Key +| Type +| Description + +| `path` +| string +| The full path to the updated file + +| `owner` +| string +| The UID of the owner of the file + +| `fileId` +| string +| The updated files identifier |=== ===== file_delete [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `path` | string | The full path to the updated file -| `owner` | string | The UID of the owner of the file -| `fileId` | string | The updated files identifier +| Key +| Type +| Description + +| `path` +| string +| The full path to the updated file + +| `owner` +| string +| The UID of the owner of the file + +| `fileId` +| string +| The updated files identifier |=== ===== file_copy [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `oldPath` | string | The full path to the source file -| `path` | string | The full path to the new file -| `sourceOwner` | string | The UID of the owner of the source file -| `owner` | string | The UID of the owner of the file -| `sourceFileId` | string | The source files identifier -| `fileId` | string | The new files identifier +| Key +| Type +| Description + +| `oldPath` +| string +| The full path to the source file + +| `path` +| string +| The full path to the new file + +| `sourceOwner` +| string +| The UID of the owner of the source file + +| `owner` +| string +| The UID of the owner of the file + +| `sourceFileId` +| string +| The source files identifier + +| `fileId` +| string +| The new files identifier |=== ===== file_rename [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `oldPath` | string | The original path file -| `path` | string | The new path file -| `fileId` | string | The files identifier +| Key +| Type +| Description + +| `oldPath` +| string +| The original path file + +| `path` +| string +| The new path file + +| `fileId` +| string +| The files identifier |=== ===== file_trash_delete [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `owner` | string | The UID of the owner of the file -| `path` | string | The full path to the deleted file +| Key +| Type +| Description + +| `owner` +| string +| The UID of the owner of the file + +| `path` +| string +| The full path to the deleted file |=== ===== file_trash_restore [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `owner` | string | The UID of the owner of the file -| `fileId` | string | The restored files identifier -| `oldPath` | string | The original path to the file -| `newPath` | string | The new path to the file -| `owner` | string | The UID of the owner of the file +| Key +| Type +| Description + +| `owner` +| string +| The UID of the owner of the file + +| `fileId` +| string +| The restored files identifier + +| `oldPath` +| string +| The original path to the file + +| `newPath` +| string +| The new path to the file + +| `owner` +| string +| The UID of the owner of the file |=== ===== file_version_delete [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `path` | string | The full path to the version file deleted -| `trigger` | string | The delete trigger reasoning +| Key +| Type +| Description + +| `path` +| string +| The full path to the version file deleted + +| `trigger` +| string +| The delete trigger reasoning |=== ===== file_version_restore [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `path` | string | The full path to the file being restored to the new version -| `revision` | string | The revision of the file restored +| Key +| Type +| Description + +| `path` +| string +| The full path to the file being restored to the new version + +| `revision` +| string +| The revision of the file restored |=== ==== Users @@ -250,78 +393,141 @@ When a file is read. [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `targetUser` | string | The UID of the created user +| Key +| Type +| Description + +| `targetUser` +| string +| The UID of the created user |=== ===== user_password_reset [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `targetUser` | string | The UID of the user +| Key +| Type +| Description + +| `targetUser` +| string +| The UID of the user |=== ===== group_member_added [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `targetUser` | string | The UID of the user -| `group` | string | The GID of the group +| Key +| Type +| Description + +| `targetUser` +| string +| The UID of the user + +| `group` +| string +| The GID of the group |=== ===== user_deleted [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `targetUser` | string | The UID of the user +| Key +| Type +| Description + +| `targetUser` +| string +| The UID of the user |=== ===== group_member_removed [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `targetUser` | string | The UID of the user -| `group` | string | The GID of the group +| Key +| Type +| Description + +| `targetUser` +| string +| The UID of the user + +| `group` +| string +| The GID of the group |=== ===== user_state_changed [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `targetUser` | string | The UID of the user -| `enabled` | boolean | If the user is enabled or not +| Key +| Type +| Description + +| `targetUser` +| string +| The UID of the user + +| `enabled` +| boolean +| If the user is enabled or not |=== ===== group_created [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `group` | string | The GID of the group +| Key +| Type +| Description + +| `group` +| string +| The GID of the group |=== ===== group_deleted [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `group` | string | The GID of the group +| Key +| Type +| Description + +| `group` +| string +| The GID of the group |=== ===== user_feature_changed [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `targetUser` | string | The UID of the user -| `group` | string | The GID of the group (or empty string) -| `feature` | string | The feature that was changed -| `value` | string | The new value +| Key +| Type +| Description + +| `targetUser` +| string +| The UID of the user + +| `group` +| string +| The GID of the group (or empty string) + +| `feature` +| string +| The feature that was changed + +| `value` +| string +| The new value |=== ==== Sharing @@ -330,11 +536,25 @@ Sharing events come with a default set of fields [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `fileId` | string | The file identifier for the item shared -| `owner` | string | The UID of the owner of the shared item -| `path` | string | The path to the shared item -| `shareId` | string | The sharing identifier + +| Key +| Type +| Description + +| `fileId` +| string +| The file identifier for the item shared + +| `owner` +| string +| The UID of the owner of the shared item + +| `path` +| string +| The path to the shared item + +| `shareId` +| string +| The sharing identifier + (not available for public_link_accessed or when recipient unshares) |=== @@ -342,165 +562,369 @@ Sharing events come with a default set of fields [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `itemType` | string | `file` or `folder` -| `expirationDate` | string | The text expiration date in format `yyyy-mm-dd` -| `sharePass` | boolean | If the share is password protected -| `permissions` | string | The permissions string e.g.: "READ" -| `shareType` | string | `group` `user` or `link` -| `shareWith` | string | The UID or GID of the share recipient + +| Key +| Type +| Description + +| `itemType` +| string +| `file` or `folder` + +| `expirationDate` +| string +| The text expiration date in format `yyyy-mm-dd` + +| `sharePass` +| boolean +| If the share is password protected + +| `permissions` +| string +| The permissions string e.g.: "READ" + +| `shareType` +| string +| `group` `user` or `link` + +| `shareWith` +| string +| The UID or GID of the share recipient + (not available for public link) -| `shareOwner` | string | The UID of the share owner -| `shareToken` | string | For link shares the `unique token`, else `null` + +| `shareOwner` +| string +| The UID of the share owner + +| `shareToken` +| string +| For link shares the `unique token`, else `null` |=== ===== file_unshared [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `itemType` | string | `file` or `folder` -| `shareType` | string | `group` `user` or `link` -| `shareWith` | string | The UID or GID of the share recipient +| Key +| Type +| Description + +| `itemType` +| string +| `file` or `folder` + +| `shareType` +| string +| `group` `user` or `link` + +| `shareWith` +| string +| The UID or GID of the share recipient |=== ===== share_permission_update [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `itemType` | string | `file` or `folder` -| `shareType` | string | `group` `user` or `link` -| `shareOwner` | string | The UID of the share owner -| `permissions` | string | The new permissions string e.g.: "READ" -| `shareWith` | string | The UID or GID of the share recipient + +| Key +| Type +| Description + +| `itemType` +| string +| `file` or `folder` + +| `shareType` +| string +| `group` `user` or `link` + +| `shareOwner` +| string +| The UID of the share owner + +| `permissions` +| string +| The new permissions string e.g.: "READ" + +| `shareWith` +| string +| The UID or GID of the share recipient + (not available for public link) -| `oldPermissions` | string | The old permissions string e.g.: "READ" + +| `oldPermissions` +| string +| The old permissions string e.g.: "READ" |=== ===== share_name_updated [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `oldShareName` | string | The previous share name -| `shareName` | string | The updated share name +| Key +| Type +| Description + +| `oldShareName` +| string +| The previous share name + +| `shareName` +| string +| The updated share name |=== ===== share_password_updated [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `itemType` | string | `file` or `folder` -| `shareOwner` | string | The UID of the share owner -| `permissions` | string | The full permissions string e.g.: "READ" -| `shareToken` | string | The share token -| `sharePass` | boolean | If the share is password protected +| Key +| Type +| Description + +| `itemType` +| string +| `file` or `folder` + +| `shareOwner` +| string +| The UID of the share owner + +| `permissions` +| string +| The full permissions string e.g.: "READ" + +| `shareToken` +| string +| The share token + +| `sharePass` +| boolean +| If the share is password protected |=== ===== share_expiration_date_updated [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `itemType` | string | `file` or `folder` -| `shareType` | string | `group`, `user` or `link` -| `shareOwner` | string | The UID of the owner of the share -| `permissions` | string | The permissions string e.g.: "READ" -| `expirationDate` | string | The new text expiration date in format `yyyy-mm-dd` -| `oldExpirationDate` | string | The old text expiration date in format `yyyy-mm-dd` +| Key +| Type +| Description + +| `itemType` +| string +| `file` or `folder` + +| `shareType` +| string +| `group`, `user` or `link` + +| `shareOwner` +| string +| The UID of the owner of the share + +| `permissions` +| string +| The permissions string e.g.: "READ" + +| `expirationDate` +| string +| The new text expiration date in format `yyyy-mm-dd` + +| `oldExpirationDate` +| string +| The old text expiration date in format `yyyy-mm-dd` |=== ===== share_accepted [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `itemType` | string | `file` or `folder` -| `path` | string | The path of the shared item -| `owner` | string | The UID of the owner of the shared item -| `fileId` | string | The file identifier for the item shared -| `shareId` | string | The sharing identifier (not available for public_link_accessed) -| `shareType` | string | `group` or `user` +| Key +| Type +| Description + +| `itemType` +| string +| `file` or `folder` + +| `path` +| string +| The path of the shared item + +| `owner` +| string +| The UID of the owner of the shared item + +| `fileId` +| string +| The file identifier for the item shared + +| `shareId` +| string +| The sharing identifier (not available for public_link_accessed) + +| `shareType` +| string +| `group` or `user` |=== ===== share_declined [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `itemType` | string | `file` or `folder` -| `path` | string | The path of the shared item -| `owner` | string | The UID of the owner of the shared item -| `fileId` | string | The file identifier for the item shared -| `shareId` | string | The sharing identifier (not available for public_link_accessed) -| `shareType` | string | `group` or `user` +| Key +| Type +| Description + +| `itemType` +| string +| `file` or `folder` + +| `path` +| string +| The path of the shared item + +| `owner` +| string +| The UID of the owner of the shared item + +| `fileId` +| string +| The file identifier for the item shared + +| `shareId` +| string +| The sharing identifier (not available for public_link_accessed) + +| `shareType` +| string +| `group` or `user` |=== ===== federated_share_received [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `name` | string | The path of shared item -| `targetuser` | string | The target user who sent the item -| `shareType` | string | `remote` +| Key +| Type +| Description + +| `name` +| string +| The path of shared item + +| `targetuser` +| string +| The target user who sent the item + +| `shareType` +| string +| `remote` |=== ===== federated_share_accepted [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `itemType` | string | The path of shared item -| `targetUser` | string | The target user who sent the item -| `shareType` | string | `remote` +| Key +| Type +| Description + +| `itemType` +| string +| The path of shared item + +| `targetUser` +| string +| The target user who sent the item + +| `shareType` +| string +| `remote` |=== ===== federated_share_declined [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `itemType` | string | The path of shared item -| `targetuser` | string | The target user who sent the item -| `shareType` | string | `remote` +| Key +| Type +| Description + +| `itemType` +| string +| The path of shared item + +| `targetuser` +| string +| The target user who sent the item + +| `shareType` +| string +| `remote` |=== ===== public_link_accessed [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `shareToken` | string | The share token -| `success` | boolean | If the request was successful `tue` or `false` +| Key +| Type +| Description + +| `shareToken` +| string +| The share token + +| `success` +| boolean +| If the request was successful `tue` or `false` |=== ===== public_link_removed [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `shareType` | string | `link` +| Key +| Type +| Description + +| `shareType` +| string +| `link` |=== ===== public_link_accessed_webdav [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `token` | string | The token used to access the url +| Key +| Type +| Description + +| `token` +| string +| The token used to access the url |=== ===== federated_share_unshared [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `targetUser` | string | The user who initiated the unshare action -| `targetmount` | string | The file/folder unshared -| `shareType` | string | `remote` +| Key +| Type +| Description + +| `targetUser` +| string +| The user who initiated the unshare action + +| `targetmount` +| string +| The file/folder unshared + +| `shareType` +| string +| `remote` |=== ==== Custom Groups @@ -509,51 +933,109 @@ Sharing events come with a default set of fields [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `removedUser` | string | The UID of the user that was removed from the group -| `group` | string | The custom group name +| Key +| Type +| Description + +| `removedUser` +| string +| The UID of the user that was removed from the group + +| `group` +| string +| The custom group name |=== ===== custom_group_user_left [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `removedUser` | string | The UID of the user that left the group -| `group` | string | The custom group name -| `groupId` | integer | The custom group id +| Key +| Type +| Description + +| `removedUser` +| string +| The UID of the user that left the group + +| `group` +| string +| The custom group name + +| `groupId` +| integer +| The custom group id |=== ===== custom_group_user_role_changed [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `targetUser` | string | The UID of the user that changed role -| `group` | string | The custom group name -| `groupId` | integer | The custom group id -| `roleNumber` | integer | The new role number: 0 = member, 1= admin +| Key +| Type +| Description + +| `targetUser` +| string +| The UID of the user that changed role + +| `group` +| string +| The custom group name + +| `groupId` +| integer +| The custom group id + +| `roleNumber` +| integer +| The new role number: 0 = member, 1= admin |=== ===== custom_group_renamed [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `oldGroup` | string | The old custom group name -| `group` | string | The new custom group name -| `groupId` | integer | The custom group id +| Key +| Type +| Description + +| `oldGroup` +| string +| The old custom group name + +| `group` +| string +| The new custom group name + +| `groupId` +| integer +| The custom group id |=== ===== custom_group_created [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `group` | string | The custom group name created -| `groupId` | string | The custom group id -| `addedUser` | string | The UID of the user added -| `admin` | boolean | `true` or `false` +| Key +| Type +| Description + +| `group` +| string +| The custom group name created + +| `groupId` +| string +| The custom group id + +| `addedUser` +| string +| The UID of the user added + +| `admin` +| boolean +| `true` or `false` |=== ==== Comments @@ -562,10 +1044,21 @@ All comment events have the same data: [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `commentId` | string | The comment identifier -| `path` | string | The path to the file that the comment is attached to -| `fileId` | string | The file identifier +| Key +| Type +| Description + +| `commentId` +| string +| The comment identifier + +| `path` +| string +| The path to the file that the comment is attached to + +| `fileId` +| string +| The file identifier |=== // ===== comment_created @@ -580,19 +1073,38 @@ All comment events have the same data: [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `settingName` | string | The key -| `settingValue` | string | The new value -| `oldValue` | string | The old value -| `created` | boolean | If the setting is created for the first time +| Key +| Type +| Description + +| `settingName` +| string +| The key + +| `settingValue` +| string +| The new value + +| `oldValue` +| string +| The old value + +| `created` +| boolean +| If the setting is created for the first time |=== ===== config_delete [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `settingName` | string | The key +| Key +| Type +| Description + +| `settingName` +| string +| The key |=== ==== Console @@ -601,8 +1113,13 @@ All comment events have the same data: [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `command` | string | The exact command that was executed +| Key +| Type +| Description + +| `command` +| string +| The exact command that was executed |=== ==== Tags @@ -611,45 +1128,85 @@ All comment events have the same data: [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `tagName` | string | The tag name +| Key +| Type +| Description + +| `tagName` +| string +| The tag name |=== ===== tag_deleted [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `tagName` | string | The tag name +| Key +| Type +| Description + +| `tagName` +| string +| The tag name |=== ===== tag_updated [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `oldTag` | string | The old tag name -| `tagName` | string | The new tag name +| Key +| Type +| Description + +| `oldTag` +| string +| The old tag name + +| `tagName` +| string +| The new tag name |=== ===== tag_assigned [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `tagName` | string | The tag name -| `fileId` | string | The file identifier to which the tag was assigned -| `path` | string | The path to the file +| Key +| Type +| Description + +| `tagName` +| string +| The tag name + +| `fileId` +| string +| The file identifier to which the tag was assigned + +| `path` +| string +| The path to the file |=== ===== tag_unassigned [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `tagName` | string | The tag name -| `fileId` | string | The file identifier from which the tag was unassigned -| `path` | string | The path to the file +| Key +| Type +| Description + +| `tagName` +| string +| The tag name + +| `fileId` +| string +| The file identifier from which the tag was unassigned + +| `path` +| string +| The path to the file |=== ==== Apps @@ -658,17 +1215,30 @@ All comment events have the same data: [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `targetApp` | string | The app ID of the enabled app -| `groups` | string [] | Array of group IDs if the app was enabled for certain groups +| Key +| Type +| Description + +| `targetApp` +| string +| The app ID of the enabled app + +| `groups` +| string [] +| Array of group IDs if the app was enabled for certain groups |=== ===== app_disabled [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `targetApp` | string | The app ID of the disabled app +| Key +| Type +| Description + +| `targetApp` +| string +| The app ID of the disabled app |=== ==== Auth @@ -677,9 +1247,17 @@ All comment events have the same data: [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `success` | boolean | If the login was successful -| `login` | string | The attempted login value +| Key +| Type +| Description + +| `success` +| boolean +| If the login was successful + +| `login` +| string +| The attempted login value |=== ===== user_logout @@ -696,75 +1274,148 @@ All comment events have the same data: [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `path` | string | The path to the file that was archived -| `owner` | string | The UID of the owner of the file that was deleted -| `fileId` | integer | The file ID for the file that was archived +| Key +| Type +| Description + +| `path` +| string +| The path to the file that was archived + +| `owner` +| string +| The UID of the owner of the file that was deleted + +| `fileId` +| integer +| The file ID for the file that was archived |=== ===== lifecycle_restored [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `path` | string | The path to the file that was restored -| `fileId` | integer | The file ID for the file that was restored +| Key +| Type +| Description + +| `path` +| string +| The path to the file that was restored + +| `fileId` +| integer +| The file ID for the file that was restored |=== ===== lifecycle_expired [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `fileId` | integer | The file id of the file that was expired +| Key +| Type +| Description + +| `fileId` +| integer +| The file id of the file that was expired |=== ===== update_user_preference_value [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `key` | string | The key -| `value` | string | The value associated with the key -| `appname` | string | The name of the app -| `user` | string | The UID of the user who has the preference key-value for the app +| Key +| Type +| Description + +| `key` +| string +| The key + +| `value` +| string +| The value associated with the key + +| `appname` +| string +| The name of the app + +| `user` +| string +| The UID of the user who has the preference key-value for the app |=== ===== user_preference_set [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `key` | string | The key -| `value` | string | The value associated with the key -| `appname` | string | The name of the app -| `user` | string | The UID of the user who has the preference key-value for the app +| Key +| Type +| Description + +| `key` +| string +| The key + +| `value` +| string +| The value associated with the key + +| `appname` +| string +| The name of the app + +| `user` +| string +| The UID of the user who has the preference key-value for the app |=== ===== remove_user_preference_key [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `key` | string | The key -| `appname` | string | The name of the app -| `user` | string | The UID of the user whose preference key is deleted for the app +| Key +| Type +| Description + +| `key` +| string +| The key + +| `appname` +| string +| The name of the app + +| `user` +| string +| The UID of the user whose preference key is deleted for the app |=== ===== remove_preferences_of_user [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `user` | string | The UID of the user whose user preferences are deleted +| Key +| Type +| Description + +| `user` +| string +| The UID of the user whose user preferences are deleted |=== ===== delete_all_user_preference_of_app [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `appname` | string | The name of the app whose user preferences are deleted +| Key +| Type +| Description + +| `appname` +| string +| The name of the app whose user preferences are deleted |=== ==== Impersonate @@ -773,17 +1424,30 @@ All comment events have the same data: [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `user` | string | The current user who did an impersonate action -| `targetUser` | string | The user who is being impersonated +| Key +| Type +| Description + +| `user` +| string +| The current user who did an impersonate action + +| `targetUser` +| string +| The user who is being impersonated |=== ===== impersonate_logout [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `user` | string | The user who performed impersonate action +| Key +| Type +| Description + +| `user` +| string +| The user who performed impersonate action |=== ==== SMB ACL @@ -792,74 +1456,175 @@ All comment events have the same data: [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `user` | string | The user who is trying to set the ACL -| `ocPath` | string | The owncloud instance path -| `smbPath` | string | The SMB path -| `descriptor` | array | The descriptor array. It contains to following keys: +| Key +| Type +| Description + +| `user` +| string +| The user who is trying to set the ACL + +| `ocPath` +| string +| The owncloud instance path + +| `smbPath` +| string +| The SMB path + +| `descriptor` +| array +| The descriptor array. It contains to following keys: |=== [caption=] .`descriptor[] keys` [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `revision` | integer | Always `1` -| `owner` | string | The SMB owner -| `group` | string | The SMB group -| `acl` | array | A list of ACEs. The list could be empty. Each ACE contains following keys: +| Key +| Type +| Description + +| `revision` +| integer +| Always `1` + +| `owner` +| string +| The SMB owner + +| `group` +| string +| The SMB group + +| `acl` +| array +| A list of ACEs. The list could be empty. Each ACE contains following keys: |=== [caption=] .`acl[] keys` [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `trustee` | string | The SMB user affected by this ACE -| `mode` | string | `allowed` or `denied` -| `flags` | string | Inheritance flags -| `mask` | string | Permission mask -| `flagsAsInt` | integer | The inheritance flags as integer value -| `maskAsInt` | integer | The permission mask as integer value +| Key +| Type +| Description + +| `trustee` +| string +| The SMB user affected by this ACE + +| `mode` +| string +| `allowed` or `denied` + +| `flags` +| string +| Inheritance flags + +| `mask` +| string +| Permission mask + +| `flagsAsInt` +| integer +| The inheritance flags as integer value + +| `maskAsInt` +| integer +| The permission mask as integer value |=== ===== after_set_acl [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `user` | string | The user who is trying to set the ACL -| `ocPath` | string | The owncloud instance path -| `smbPath` | string | The SMB path -| `descriptor` | array | The descriptor array. It contains to following keys: +| Key +| Type +| Description + +| `user` +| string +| The user who is trying to set the ACL + +| `ocPath` +| string +| The owncloud instance path + +| `smbPath` +| string +| The SMB path + +| `descriptor` +| array +| The descriptor array. It contains to following keys: |=== [caption=] .`descriptor[] keys` [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `revision` | integer | Always `1` -| `owner` | string | The SMB owner -| `group` | string | The SMB group -| `acl` | array | A list of ACEs. The list could be empty. Each ACE contains following keys: +| Key +| Type +| Description + +| `revision` +| integer +| Always `1` + +| `owner +| string +| The SMB owner + +| `group` +| string +| The SMB group + +| `acl` +| array +| A list of ACEs. The list could be empty. Each ACE contains following keys: |=== [caption=] .`acl[] keys` [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `trustee` | string | The SMB user affected by this ACE -| `mode` | string | `allowed` or `denied` -| `flags` | string | Inheritance flags -| `mask` | string | Permission mask -| `flagsAsInt` | integer | The inheritance flags as integer value -| `maskAsInt` | integer | The permission mask as integer value +| Key +| Type +| Description + +| `trustee` +| string +| The SMB user affected by this ACE + +| `mode` +| string +| `allowed` or `denied` + +| `flags` +| string +| Inheritance flags + +| `mask` +| string +| Permission mask + +| `flagsAsInt` +| integer +| The inheritance flags as integer value + +| `maskAsInt` +| integer +| The permission mask as integer value |=== [width="100%",cols="25%,20%,100%",options="header"] |=== -| Key | Type | Description -| `oldDescriptor` | array\|false | The previous descriptor array or false if the previous descriptor couldn't be fetched. The previous descriptor will have the same keys +| Key +| Type +| Description + +| `oldDescriptor` +| array\|false +| The previous descriptor array or false if the previous descriptor couldn't be fetched. The previous descriptor will have the same keys |=== diff --git a/modules/admin_manual/pages/enterprise/reporting/metrics.adoc b/modules/admin_manual/pages/enterprise/reporting/metrics.adoc index 646e1e21c..c443ee905 100644 --- a/modules/admin_manual/pages/enterprise/reporting/metrics.adoc +++ b/modules/admin_manual/pages/enterprise/reporting/metrics.adoc @@ -5,19 +5,9 @@ == Introduction -The {oc-marketplace-url}/apps/metrics[Metrics App] provides a building block for reporting of ownCloud -Server. For simple use cases, it ships with an integrated dashboard that summarizes information -about users, storage as well as shares and allows exporting it to a CSV file. Additionally, it adds a -Metrics HTTP API endpoint to ownCloud Classic, which can be used to obtain the Metrics data in regular -intervals. Thus, more sophisticated analysis and visualizations can be conducted. +The `Metrics App` provides a building block for reporting of ownCloud Server. For simple use cases, it ships with an integrated dashboard that summarizes information about users, storage as well as shares and allows exporting it to a CSV file. Additionally, it adds a Metrics HTTP API endpoint to ownCloud Classic, which can be used to obtain the Metrics data in regular intervals. Thus, more sophisticated analysis and visualizations can be conducted. -The Metrics data are provided as snapshot values in the JSON format and are optimized to be consumed by -professional data analyzers (like Splunk, ELK or Prometheus/Grafana) to collect statistics, derive -visualizations and to set alerts for certain events of interest. They can be perfectly combined with the -ownCloud Audit Logs (provided by the {oc-marketplace-url}/apps/admin_audit[Auditing App]) to gather time -series data and to create a reporting engine for ownCloud. - -NOTE: Internet Explorer 11 is not compatible with Metrics, because new web technologies have been used that are not supported by IE 11. +The metrics data is provided as snapshot values in JSON format and is optimised for consumption by professional data analysers, such as Splunk, ELK and Prometheus/Grafana, for the collection of statistics, the creation of visualisations and the setting of alerts for certain events of interest. They can be seamlessly integrated with the ownCloud Audit Logs, which are provided by the xref:enterprise/logging/admin_audit.adoc[Auditing App] to collect time series data and create a reporting engine for ownCloud. If you want to use Splunk in addition, check out xref:configuration/integration/splunk.adoc[ownCloud App for Splunk]. @@ -27,18 +17,18 @@ Specifically, the Metrics extension adds: - API endpoints for downloading metrics as CSV files - a dashboard that displays the snapshot data in the ownCloud Web UI and offers a CSV download in the system view and the user view. -TIP: If you're operating very large instances with regard to users, files or shares, better use a -special setup so you won't put the production database under huge load when gathering the values. For -this, replicate your installation (application server and read-only database) and install and use the -Metrics app on the replica. +TIP: If you're operating very large instances with regard to users, files or shares, better use a special setup so you won't put the production database under huge load when gathering the values. For this, replicate your installation (application server and read-only database) and install and use the Metrics app on the replica. The following screenshots give you an impression of the Metrics app. -.Figure 1. Metrics System Overview -image:enterprise/reporting/metrics/metrics-system.png[Metrics System Overview] +[width=100%,cols="50%,50%,options="header"] +|=== +^| *Metrics System Overview* +^| *Metrics User Overview* -.Figure 2. Metrics User Overview -image:enterprise/reporting/metrics/metrics-user.png[Metrics User Overview] +| image:enterprise/reporting/metrics/metrics-system.png[Metrics System Overview] +| image:enterprise/reporting/metrics/metrics-user.png[Metrics User Overview] +|=== == Available Data @@ -92,8 +82,7 @@ See the following occ command on how to set it. Make up a passphrase, referred t {occ-command-example-prefix-docker} config:system:set "metrics_shared_secret" --value "" ---- -TIP: This token gets stored in config.php as `metrics_shared_secret`, which could also be done manually -instead of using the occ command. +TIP: This token gets stored in config.php as `metrics_shared_secret`, which could also be done manually instead of using the occ command. === Dashboard User Interface @@ -132,14 +121,11 @@ curl -H "OC-MetricsApiKey: " \ "https:///ocs/v1.php/apps/metrics/api/v1/metrics?users=true&files=true&shares=true"a=true&userData=true&format=json" ---- -TIP: Replace `` with your respective system config value and `` -with the URL of your ownCloud instance. +TIP: Replace `` with your respective system config value and `` with the URL of your ownCloud instance. ==== CSV Download Endpoints -Downloading the current user and system metrics as CSV files is possible via the Web UI. If you want to -set up cron jobs for downloading the metrics regularly without admin permissions, there are also public -endpoints that require the configured token instead of admin privileges. +Downloading the current user and system metrics as CSV files is possible via the Web UI. If you want to set up cron jobs for downloading the metrics regularly without admin permissions, there are also public endpoints that require the configured token instead of admin privileges. TIP: In the following `curl` examples, replace `` with your respective system config value and `` with the URL of your ownCloud instance. @@ -165,6 +151,4 @@ curl -H "Content-Type: application/csv" \ == Limitations -The Metrics app was designed for ownCloud deployments up to 250 users. -On deployments with more than 250 users, it can take considerably longer to gather the requested data. -To reduce the time needed, exclude _userData_ and _quota_. +The Metrics app was designed for ownCloud deployments up to 250 users. On deployments with more than 250 users, it can take considerably longer to gather the requested data. To reduce the time needed, exclude _userData_ and _quota_. diff --git a/modules/admin_manual/pages/enterprise/security/ransomware-protection.adoc b/modules/admin_manual/pages/enterprise/security/ransomware-protection.adoc index 90cc29c4f..b5f2812cf 100644 --- a/modules/admin_manual/pages/enterprise/security/ransomware-protection.adoc +++ b/modules/admin_manual/pages/enterprise/security/ransomware-protection.adoc @@ -7,112 +7,61 @@ enterprise/security/index.adoc == Introduction -Ransomware is -https://www.google.de/search?q=ransomware&source=lnms&tbm=nws&sa=X&ved=0ahUKEwiqmvL9rdfXAhWCyaQKHSkgDosQ_AUICigB&biw=1680&bih=908[an ever-present threat], -both for large enterprises as well as for individuals. Once infected, a whole hard disk (or just parts of it) can -become encrypted, leading to unrecoverable data loss. +Ransomware is https://www.google.de/search?q=ransomware&source=lnms&tbm=nws&sa=X&ved=0ahUKEwiqmvL9rdfXAhWCyaQKHSkgDosQ_AUICigB&biw=1680&bih=908[an ever-present threat], both for large enterprises as well as for individuals. Once infected, a whole hard disk (or just parts of it) can become encrypted, leading to unrecoverable data loss. -Once this happens, attackers usually ask victims to pay a ransom, often -via cryptocurrencies such as Bitcoin, in exchange for the decryption key -required to decrypt their data. +Once this happens, attackers usually ask victims to pay a ransom, often via cryptocurrencies such as Bitcoin, in exchange for the decryption key required to decrypt their data. -While paying the ransom works in some cases, it is not recommended, as -there is no guarantee that the attackers will supply the key after -payment is made. To help mitigate such threats and ensure ongoing access -to user data, ownCloud provides the Ransomware Protection app. +While paying the ransom works in some cases, it is not recommended, as there is no guarantee that the attackers will supply the key after payment is made. To help mitigate such threats and ensure ongoing access to user data, ownCloud provides the Ransomware Protection app. -NOTE: It is essential to be aware that user data needs to be synchronized with you ownCloud Classic using the -ownCloud Desktop synchronization client. Data that is not synchronized and stored in ownCloud cannot be protected. +NOTE: It is essential to be aware that user data needs to be synchronized with you ownCloud Classic using the ownCloud Desktop synchronization client. Data that is not synchronized and stored in ownCloud cannot be protected. == About Ransomware Protection -The app is tasked with _detecting_, _preventing_, and _reverting_ -anomalies. Anomalies are file operations (including _create_, _update_, -_delete_, and _move_) not intentionally conducted by the user. It aims -to do so in two ways: xref:prevention-blocking-common-ransomware-file-extensions[prevention], and -xref:other-elements-of-ransomware-protection[protection]. +The app is tasked with _detecting_, _preventing_, and _reverting_ anomalies. Anomalies are file operations (including _create_, _update_, _delete_, and _move_) not intentionally conducted by the user. It aims to do so in two ways: xref:prevention-blocking-common-ransomware-file-extensions[prevention], and xref:other-elements-of-ransomware-protection[protection]. == Prevention: Blocking Common Ransomware File Extensions -Like other forms of cyberattack, ransomware has a range of diverse -characteristics. On the one hand it makes them hard to detect and on the -other it makes them even harder to prevent. Recent ransomware attacks -either encrypt a user’s files and add a specific file extension to them -(e.g., `.crypt`), or they replace the original files with an encrypted -copy and add a particular file extension. +Like other forms of cyberattack, ransomware has a range of diverse characteristics. On the one hand it makes them hard to detect and on the other it makes them even harder to prevent. Recent ransomware attacks either encrypt a user’s files and add a specific file extension to them (e.g., `.crypt`), or they replace the original files with an encrypted copy and add a particular file extension. === File Extension Blacklist -The first line of defense against such threats is a blacklist that -blocks write access to file extensions known to originate from -ransomware. +The first line of defense against such threats is a blacklist that blocks write access to file extensions known to originate from ransomware. -Ransomware Protection ships with https://fsrm.experiant.ca[a static extension list] -of more than 3,000 file extensions. As new extensions are -regularly created, this list also needs to be regularly reviewed and -updated. Future releases of Ransomware Protection will include an -updated list and the ability to update the list via syncing with -https://fsrm.experiant.ca/api/v1/combined[FSRM’s API] by using an -xref:configuration/server/occ_command.adoc[occ command] +Ransomware Protection ships with https://fsrm.experiant.ca[a static extension list] of more than 3,000 file extensions. As new extensions are regularly created, this list also needs to be regularly reviewed and updated. Future releases of Ransomware Protection will include an updated list and the ability to update the list via syncing with https://fsrm.experiant.ca/api/v1/combined[FSRM’s API] by using an xref:configuration/server/occ_command.adoc[occ command] NOTE: Please check the provided ransomware blacklist! It is *strongly recommended* to check the provided ransomware blacklist to ensure that it fits your needs. In some cases, the patterns might be too generic and result in false positives. === File Blocking -The second line of defense is file blocking. As files are uploaded, they -are compared against the file extension blacklist. If a match is found, -the upload is denied. +The second line of defense is file blocking. As files are uploaded, they are compared against the file extension blacklist. If a match is found, the upload is denied. NOTE: File blocking is always enabled. === Account Locking -The third line of defense is account locking. If a client uploads a file -matching a pattern in the ransomware blacklist, the account is locked -(set as read-only) for client access (_create_, _change_, _move_, and -_delete_ operations). Doing this prevents further, malicious, changes. +The third line of defense is account locking. If a client uploads a file matching a pattern in the ransomware blacklist, the account is locked (set as read-only) for client access (_create_, _change_, _move_, and _delete_ operations). Doing this prevents further, malicious, changes. -Following this, clients receive an error (403 Access Forbidden) which -notifies the user that the account is locked by Ransomware Protection. +Following this, clients receive an error (403 Access Forbidden) which notifies the user that the account is locked by Ransomware Protection. NOTE: Write access (e.g., moving and deleting files) is still possible for users when they log in with their web browser. -When an account is locked, administrators can unlock the account using -the `occ ransomguard:unlock` command. Administrators can also manually -lock user accounts, using the `occ ransomguard:lock` command. +When an account is locked, administrators can unlock the account using the `occ ransomguard:unlock` command. Administrators can also manually lock user accounts, using the `occ ransomguard:lock` command. NOTE: When an account is locked, it will still be fully usable from the ownCloud web UI. However, ownCloud clients (as well as other WebDAV clients) will see the account as set to read-only mode. -Users will see a yellow notification banner in the ownCloud web UI -directing them to menu:Settings[Personal > Security] -(`__Ransomware detected: Your account is locked (read-only) for client access to -protect your data. Click here to unlock.__`), where additional -information is displayed and users can unlock their account when -ransomware issues are resolved locally. +Users will see a yellow notification banner in the ownCloud web UI directing them to menu:Settings[Personal > Security] (`__Ransomware detected: Your account is locked (read-only) for client access to protect your data. Click here to unlock.__`), where additional information is displayed and users can unlock their account when ransomware issues are resolved locally. -NOTE: Locking is enabled by default. If this is not desired, an administrator can disable it in the -menu:Settings[Admin > Security] panel. +NOTE: Locking is enabled by default. If this is not desired, an administrator can disable it in the menu:Settings[Admin > Security] panel. == Protection: Data Retention and Rollback -While Ransomware Prevention mitigates risks of a range of ransomware -attacks, it is not a future-proof solution, because ransomware is -becoming ever-more sophisticated. There are known attacks that change -file extensions randomly or keep them unchanged which makes them harder -to detect. +While Ransomware Prevention mitigates risks of a range of ransomware attacks, it is not a future-proof solution, because ransomware is becoming ever-more sophisticated. There are known attacks that change file extensions randomly or keep them unchanged which makes them harder to detect. -Ultimately there is a consensus that only one solution can provide -future-proof protection from ransomware attacks: retaining data and -providing the means to roll back to a particular point in time. +Ultimately there is a consensus that only one solution can provide future-proof protection from ransomware attacks: retaining data and providing the means to roll back to a particular point in time. -ownCloud Ransomware Protection will, therefore, record all changes on an -ownCloud Classic and allow administrators to rollback user data to a -particular point in time, making use of ownCloud’s integrated Versioning -and Trash bin features. +ownCloud Ransomware Protection will, therefore, record all changes on an ownCloud Classic and allow administrators to rollback user data to a particular point in time, making use of ownCloud’s integrated Versioning and Trash bin features. -Doing so allows all user data that is synchronized with the server to be -rolled back to its state before the attack occurred. A combination of -Ransomware prevention and protection reduces risks to a minimum acceptable level. +Doing so allows all user data that is synchronized with the server to be rolled back to its state before the attack occurred. A combination of Ransomware prevention and protection reduces risks to a minimum acceptable level. == Other Elements of Ransomware Protection @@ -127,11 +76,11 @@ Ransomware prevention and protection reduces risks to a minimum acceptable level | First line of defense against ransomware attacks. Ransomware Protection uses a file name pattern blacklist to prevent uploading files that have file extensions associated with ransomware (e.g. `.crypt`) thereby preserving the original files on the ownCloud Classic server. | Ransomguard Scanner -| `occ ransomguard:scan ` +| `occ ransomguard:scan ` *^1^* | A command to scan the ownCloud database for changes in order to discover anomalies in a user’s account and their origin. It enables an administrator to determine the point in time when undesired actions happened as a prerequisite for restoration. | Ransomguard Restorer -| `occ ransomguard:restore ` +| `occ ransomguard:restore ` *^1^* | A command for administrators to revert all operations in a user account that occurred after a certain point in time. | Ransomguard Lock @@ -155,67 +104,47 @@ Ransomware prevention and protection reduces risks to a minimum acceptable level | Update the blacklist file with content from a URL. |=== -`` must be in the Linux timestamp format. +(1) ... `` must be in the Linux timestamp format. == Requirements === Mandatory -1. *File Firewall rule (previous approach for ransomware protection).* -If you have configured the File Firewall rule which was provided as a -preliminary protection mechanism, please remove it. The functionality -(Blocking) is covered by Ransomware Protection in an improved way. -2. *Ransomware Protection.* Ransomware protection needs to be in -operation before an attack occurs, as it needs to record file operations -to be able to revert them, in case of an attack. -3. *ownCloud Versions App.* Required to restore older file versions. -The capabilities of Ransomware Protection depend on its configuration -regarding version retention. -4. *ownCloud Trash Bin App.* Required to restore deleted files. The -capabilities of Ransomware Protection depend on its configuration -regarding trash bin retention. +. *File Firewall rule (previous approach for ransomware protection).* + +If you have configured the File Firewall rule which was provided as a preliminary protection mechanism, please remove it. The functionality (Blocking) is covered by Ransomware Protection in an improved way. + +. *Ransomware Protection.* + +Ransomware protection needs to be in operation before an attack occurs, as it needs to record file operations to be able to revert them, in case of an attack. + +. *ownCloud Versions App.* + +Required to restore older file versions. The capabilities of Ransomware Protection depend on its configuration regarding version retention. + +. *ownCloud Trash Bin App.* + +Required to restore deleted files. The capabilities of Ransomware Protection depend on its configuration regarding trash bin retention. === Optional -1. *Activity app.* For viewing activity logs. +. *Activity app.* + +For viewing activity logs. == Limitations -* Ransomware Protection works with master-key based storage encryption. -With credential-based storage encryption, only Ransomware Prevention +* Ransomware Protection works with master-key based storage encryption. With credential-based storage encryption, only Ransomware Prevention (Blocking) works. + * Rollback is not based on snapshots: -** The -xref:admin_manual:configuration/server/config_sample_php_parameters.adoc#deleted-items-trash-bin[trash bin retention policy] -may delete files, making them unrecoverable. To -avoid this, set `trashbin\_retention\_obligation` to `disabled`, or -choose a conservative policy for trash bin retention. However, please be -aware that this may increase storage requirements. -** Trash bin items may be deleted by the user making them unrecoverable -by Ransomware Protection => Users need to know this. -** Versions have -xref:admin_manual:configuration/server/config_sample_php_parameters.adoc#file-versions[a built-in `thin-out` policy] -which makes it possible that required file -versions are unrecoverable by Ransomware Protection. To help avoid this, -set `versions\_retention\_obligation` to `disabled` or choose a -conservative policy for version retention. Please be aware that this -might increase your storage needs. -+ -* A specific version of a file that is needed for rollback might have -been manually restored, making this version potentially unrecoverable by -Ransomware Protection. Currently, after restoration the restored version -is not a version anymore, e.g., the version is not present in -versioning. -* Recovery capabilities in received shared folders are currently -limited. Changed file contents and deletions can be restored but MOVE -operations can’t. The case when a ransomware attack renames files in a -received shared folder is therefore not yet covered. -* Contents in secondary storages, such as _Windows network drives_, -_Dropbox_, and _Google Drive_, are unrecoverable by Ransomware -Protection, because they do not have versioning or trash bin enabled in -ownCloud. -* Rolling files forward is not _currently_ supported or tested. -Therefore it is vital to: +** The xref:admin_manual:configuration/server/config_sample_php_parameters.adoc#deleted-items-trash-bin[trash bin retention policy] may delete files, making them unrecoverable. To avoid this, set `trashbin\_retention\_obligation` to `disabled`, or choose a conservative policy for trash bin retention. However, please be aware that this may increase storage requirements. + +** Trash bin items may be deleted by the user making them unrecoverable by Ransomware Protection => Users need to know this. + +** Versions have xref:admin_manual:configuration/server/config_sample_php_parameters.adoc#file-versions[a built-in `thin-out` policy] which makes it possible that required file versions are unrecoverable by Ransomware Protection. To help avoid this, set `versions\_retention\_obligation` to `disabled` or choose a conservative policy for version retention. Please be aware that this might increase your storage needs. + +* A specific version of a file that is needed for rollback might have been manually restored, making this version potentially unrecoverable by Ransomware Protection. Currently, after restoration the restored version is not a version anymore, e.g., the version is not present in versioning. + +* Recovery capabilities in received shared folders are currently limited. Changed file contents and deletions can be restored but MOVE operations can’t. The case when a ransomware attack renames files in a received shared folder is therefore not yet covered. + +* Contents in secondary storages, such as _Windows network drives_, _Dropbox_, and _Google Drive_, are unrecoverable by Ransomware Protection, because they do not have versioning or trash bin enabled in ownCloud. + +* Rolling files forward is not _currently_ supported or tested. Therefore it is vital to: ** Carefully decide the point in time to rollback to. -** To have proper backups to be able to conduct the rollback again, if -necessary. +** To have proper backups to be able to conduct the rollback again, if necessary. diff --git a/modules/admin_manual/pages/enterprise/user_management/saml_2.0_sso.adoc b/modules/admin_manual/pages/enterprise/user_management/saml_2.0_sso.adoc index f4fd5fdcc..d7a2b632b 100644 --- a/modules/admin_manual/pages/enterprise/user_management/saml_2.0_sso.adoc +++ b/modules/admin_manual/pages/enterprise/user_management/saml_2.0_sso.adoc @@ -17,11 +17,15 @@ :shibboleth-xml-metadata-provider-url: https://shibboleth.atlassian.net/wiki/spaces/SHIB2/pages/2577072307/NativeSPMetadataProvider :shibboleth-nativespservicesso-url: https://shibboleth.atlassian.net/wiki/spaces/SHIB2/pages/2577072444/NativeSPServiceSSO +== Introduction + +IMPORTANT: The Docker image does not provide the necessary modules for the embedded Apache web server. A customised image must be built for Shibboleth authentication. + +The following description is based on a standard installation and must be adapted to work with the Dockerfile in order to create the required image. + == Preparation -Before you can setup SAML 2.0 based Single Sign-On with -{adfs-url}[Active Directory Federation Services (ADFS)] -and mod-shib, ask your ADFS admin for the relevant server URLs. These are: +Before you can setup SAML 2.0 based Single Sign-On with {adfs-url}[Active Directory Federation Services (ADFS)] and mod-shib, ask your ADFS admin for the relevant server URLs. These are: - The SAML 2.0 single sign-on service URL, e.g., `\https:///ADFS/ls` - The IdP metadata URL, e.g., `\https:///FederationMetadata/2007-06/FederationMetadata.xml` diff --git a/modules/admin_manual/pages/enterprise/user_management/user_auth_shibboleth.adoc b/modules/admin_manual/pages/enterprise/user_management/user_auth_shibboleth.adoc index a7cb57098..477bf81bd 100644 --- a/modules/admin_manual/pages/enterprise/user_management/user_auth_shibboleth.adoc +++ b/modules/admin_manual/pages/enterprise/user_management/user_auth_shibboleth.adoc @@ -6,18 +6,22 @@ == Introduction -The ownCloud Shibboleth user backend application integrates ownCloud with a {shibboleth-url}[Shibboleth] Service Provider (SP) and allows operations in federated and single-sign-on (SSO) infrastructures. +The ownCloud Shibboleth user backend application integrates ownCloud with a {shibboleth-url}[Shibboleth] Service Provider (SP) and allows operations in federated and single-sign-on (SSO) infrastructures. + +IMPORTANT: The Docker image does not provide the necessary modules for the embedded Apache web server. A customised image must be built for Shibboleth authentication. + +include::partial$manual_config_file.adoc[] + Setting up Shibboleth has two big steps: -1. Enable and configure the Apache Shibboleth module. -2. Enable and configure the ownCloud Shibboleth app. +. Enable and configure the Apache Shibboleth module. +. Enable and configure the ownCloud Shibboleth app. -== The Apache Shibboleth module +== The Apache Shibboleth Module -Currently supported installations are based on the {native-apache-integration-url}[native Apache integration]. -The individual configuration of the service provider is highly dependent on the operating system, as well as on the integration with the Identity Providers (IdP), and require case-by-case analysis and installation. +Currently supported installations are based on the {native-apache-integration-url}[native Apache integration]. The individual configuration of the service provider is dependent on the operating system used for the image (Ubuntu), as well as on the integration with the Identity Providers (IdP), and require case-by-case analysis and installation. -A good starting point for the service provider installation can be found in {shibboleth-nativesplinuxinstall-url}[the official Shibboleth Wiki]. +A good starting point for the service provider installation can be found in the {shibboleth-nativesplinuxinstall-url}[official Shibboleth Wiki]. A successful installation and configuration will populate Apache environment variables with at least a unique user id which is then used by the ownCloud Shibboleth app to login a user. @@ -25,16 +29,14 @@ A successful installation and configuration will populate Apache environment var This is an example configuration as installed and operated on a Linux server running the Apache 2.4 Web server. These configurations are highly operating system specific and require a high degree of customization. -The ownCloud instance itself is installed in `/var/www/owncloud/`. -Further Shibboleth specific configuration as defined in `/etc/apache2/conf.d/shib.conf`. +The ownCloud instance itself is installed in `/var/www/owncloud/`. Further Shibboleth specific configuration as defined in `/etc/apache2/conf.d/shib.conf`. [source,apache] ---- include::example$enterprise/user_management/shibboleth/apache-2.4-configuration.conf[] ---- -To allow users to login via the IdP, add a login alternative with the `login.alternatives` option in `config/config.php`. -Depending on the ownCloud Shibboleth app mode, you may need to revisit this configuration. +To allow users to login via the IdP, add a login alternative with the `login.alternatives` option in `config/config.php`. Depending on the ownCloud Shibboleth app mode, you may need to revisit this configuration. == The ownCloud Shibboleth App @@ -44,9 +46,7 @@ image:shib-gui5.png[figure 1: Enabling Shibboleth on the ownCloud Admin page] === Choosing the App Mode -After enabling the app it will be in *Not active* mode, which ignores a Shibboleth session and allows you to login as an administrator and inspect the currently available Apache environment variables. -Use this mode to set up the environment mapping for the other modes, and in case you locked yourself out of the system. -You can also change the app mode and environment mappings by using the `occ` command, like this example on Ubuntu Linux: +After enabling the app it will be in *Not active* mode, which ignores a Shibboleth session and allows you to login as an administrator and inspect the currently available Apache environment variables. Use this mode to set up the environment mapping for the other modes, and in case you locked yourself out of the system. You can also change the app mode and environment mappings by using the `occ` command, like this example on Ubuntu Linux: [source,bash,subs="attributes+"] ---- @@ -54,33 +54,19 @@ You can also change the app mode and environment mappings by using the `occ` com {occ-command-example-prefix-docker} shibboleth:mapping --uid login ---- -In *Single sign-on only* mode the app checks if the environment variable for the Shibboleth session, by default *Shib-Session-Id*, is set. -If that is the case it will take the value of the environment variable as the `uid`, by default `eppn`, and check if a user is known by that `uid`. -In effect, this allows another user backend, e.g., the LDAP app, to provide the `displayname`, `email` and `avatar`. +In *Single sign-on only* mode the app checks if the environment variable for the Shibboleth session, by default *Shib-Session-Id*, is set. If that is the case it will take the value of the environment variable as the `uid`, by default `eppn`, and check if a user is known by that `uid`. In effect, this allows another user backend, e.g., the LDAP app, to provide the `displayname`, `email` and `avatar`. -As an example the IdP can send the `userPrincipalName` which the Apache Shibboleth module writes to a custom Apache environment variable called `login`. -The ownCloud Shibboleth app reads that `login` environment variable and tries to find an LDAP user with that `username`. -For this to work `userPrincipalName` needs to be added to the *Additional Search Attributes* in the LDAP directory settings on xref:configuration/user/user_auth_ldap.adoc[the advanced tab]. -We recommend using a scoped login attribute like `userPrincipalName` or `mail` because otherwise the search might find multiple users and prevent login. +As an example the IdP can send the `userPrincipalName` which the Apache Shibboleth module writes to a custom Apache environment variable called `login`. The ownCloud Shibboleth app reads that `login` environment variable and tries to find an LDAP user with that `username`. For this to work `userPrincipalName` needs to be added to the *Additional Search Attributes* in the LDAP directory settings on xref:configuration/user/user_auth_ldap.adoc[the advanced tab]. We recommend using a scoped login attribute like `userPrincipalName` or `mail` because otherwise the search might find multiple users and prevent login. -In many scenarios Shibboleth is not intended to hide the user's password from the service provider, but only to implement SSO. -If that is the case it is sufficient to protect the ownCloud base URL with Shibboleth. -This will send Web users to the IdP but allow desktop and mobile clients to continue using username and password, preventing popups due to an expired Shibboleth session lifetime. +In many scenarios Shibboleth is not intended to hide the user's password from the service provider, but only to implement SSO. If that is the case it is sufficient to protect the ownCloud base URL with Shibboleth. This will send Web users to the IdP but allow desktop and mobile clients to continue using username and password, preventing popups due to an expired Shibboleth session lifetime. In *Autoprovision Users* mode the app will not ask another user backend, but instead provision users on the fly by reading the two additional environment variables for display name and email address. -image:shib-gui6.png[figure 2: Mapping Shibboleth environment configuration variables to ownCloud user attributes] - -[NOTE] -==== -In ownCloud 8.1 the Shibboleth environment variable mapping was stored in `apps/user_shibboleth/config.php`. -This file was overwritten on upgrades, preventing a seamless upgrade procedure. -In ownCloud 8.2+ the variables are stored in the ownCloud database, making Shibboleth automatically upgradeable. -==== +image:shib-gui6.png[Figure 2: Mapping Shibboleth environment configuration variables to ownCloud user attributes] === Mapping ownCloud User IDs -From 3.1.2 you can now specify a mapper that is used on inbound ownCloud user IDs, to adjust them before usage in ownCloud. You can set the mapper using `occ`: +You can specify a mapper that is used on inbound ownCloud user IDs, to adjust them before usage in ownCloud. You can set the mapper using `occ`: [source,bash,subs="attributes+"] ---- @@ -99,33 +85,32 @@ The following mappers are provided with the app: [cols="2",options="header"] |=== -|Class |Description -|`OCA\User_Shibboleth\Mapper\NoOpMapper` |The default, does not alter the UID -|`OCA\User_Shibboleth\Mapper\ADFSMapper` |Splits the UID around a `;` character and takes the first piece -|`OCA\User_Shibboleth\Mapper\GUIDInMemoryMapper` |Maps in binary GUIDs to strings +|Class +| Description + +|`OCA\User_Shibboleth\Mapper\NoOpMapper` +|The default, does not alter the UID + +|`OCA\User_Shibboleth\Mapper\ADFSMapper` +| Splits the UID around a `;` character and takes the first piece + +|`OCA\User_Shibboleth\Mapper\GUIDInMemoryMapper` +| Maps in binary GUIDs to strings |=== == Shibboleth with Desktop and Mobile Clients -The ownCloud Desktop Client can interact with an ownCloud instance running inside a Shibboleth Service Provider by using OAuth2 tokens to authenticate. -The ownCloud Android and iOS mobile apps also work with OAuth2 tokens. +The ownCloud Desktop Client can interact with an ownCloud instance running inside a Shibboleth Service Provider by using OAuth2 tokens to authenticate.The ownCloud Android and iOS mobile apps also work with OAuth2 tokens. == WebDAV Support -Users of standard WebDAV clients can generate an App Password on the Personal settings page. -Use of App Passwords may be enforced with the `token_auth_enforced` option in `config/config.php`. +Users of standard WebDAV clients can generate an App Password on the Personal settings page. Use of App Passwords may be enforced with the OWNCLOUD_TOKEN_AUTH_ENFORCED environment variable. == Known Limitations === Encryption -File encryption can only be used together with Shibboleth when xref:configuration/server/occ_command.adoc#encryption[master key-based encryption] is used because the per-user encryption requires the user's password to unlock the private encryption key. -Due to the nature of Shibboleth the user's password is not known to the service provider. - -=== PHP-FPM is incompatible - -The provided shibd, apache and ownCloud configuration only works with mod_php. Make sure that you have disable PHP-FPM and enabled mod_php on your server. -CentOS 8 now installs PHP-FPM by default, so make sure to swap. +File encryption can only be used together with Shibboleth when xref:configuration/server/occ_command.adoc#encryption[master key-based encryption] is used because the per-user encryption requires the user's password to unlock the private encryption key. Due to the nature of Shibboleth the user's password is not known to the service provider. === Other Login Mechanisms @@ -136,24 +121,20 @@ You can allow other login mechanisms (e.g., LDAP or ownCloud native) by creating include::example$enterprise/user_management/shibboleth/other-login-mechanisms-vhost.conf[] ---- -NOTE: The second location in the above configuration is *not* protected by Shibboleth, and you can use your other ownCloud login mechanisms. - -NOTE: The above configuration can be used with multi-factor authentication as well. +[NOTE] +==== +* The second location in the above configuration is *not* protected by Shibboleth, and you can use your other ownCloud login mechanisms. +* The above configuration can be used with multi-factor authentication as well. +==== -If you use the above configuration, after it's enabled, configure the alternative logins option with a button to point to `/login-shib`. -This will trigger the Shibboleth session and redirect the user back to `/login`. -At this point, the existing session will be picked up, continuing with the authentication process. +If you use the above configuration, after it's enabled, configure the alternative logins option with a button to point to `/login-shib`. This will trigger the Shibboleth session and redirect the user back to `/login`. At this point, the existing session will be picked up, continuing with the authentication process. === Session Timeout -Session timeout on Shibboleth is controlled by the IdP. -It is not possible to have a session length longer than the length controlled by the IdP. -In extreme cases this could result in re-login on mobile clients and desktop clients every hour. +Session timeout on Shibboleth is controlled by the IdP. It is not possible to have a session length longer than the length controlled by the IdP. In extreme cases this could result in re-login on mobile clients and desktop clients every hour. === UID Considerations and Windows Network Drive Compatibility -To log in LDAP users via SAML for Single Sign On the user in LDAP must be uniquely resolvable by searching for the username that was sent in the SAML token. -For this to work the LDAP attribute containing the username needs to be added to the *Additional Search Attributes* in the LDAP directory settings on xref:configuration/user/user_auth_ldap.adoc[the advanced tab]. -We recommend using a scoped login attribute like `userPrincipalName` or `mail` because otherwise the search might find multiple users and prevent login. +To log in LDAP users via SAML for Single Sign On the user in LDAP must be uniquely resolvable by searching for the username that was sent in the SAML token. For this to work the LDAP attribute containing the username needs to be added to the *Additional Search Attributes* in the LDAP directory settings on the xref:configuration/user/user_auth_ldap.adoc#advanced-settings[advanced settings] tab. We recommend using a scoped login attribute like `userPrincipalName` or `mail` because otherwise the search might find multiple users and prevent login. `user_shibboleth` will do the authentication, and `user_ldap` will provide user details such as `email` and `displayname`. diff --git a/modules/admin_manual/pages/troubleshooting/providing_logs_and_config_files.adoc b/modules/admin_manual/pages/troubleshooting/providing_logs_and_config_files.adoc index f49664aa0..a6b08060e 100644 --- a/modules/admin_manual/pages/troubleshooting/providing_logs_and_config_files.adoc +++ b/modules/admin_manual/pages/troubleshooting/providing_logs_and_config_files.adoc @@ -29,7 +29,7 @@ Enable it if it was formerly disabled: === Generate via webUI To generate a config report using the webUI, navigate to: + -menu:Settings[Admin > General > "Generate Config report" > "Download ownCloud config report"]. +menu:Settings[Admin > General > "Generate Config report" > "Download ownCloud config report"] === Generate via Command Line @@ -49,19 +49,19 @@ menu:Settings[Admin > General > Log > "Download logfile"]. === Generate via Command Line -If the log file is too big, you will need to transfer it from the command line. By default it is named `owncloud.log` and located at the Docker Volume `/files`. +If the log file is too big, transferring it via the GUI may cause issues and you will need to do this from the command line. By default it is named `owncloud.log` and located at the Docker Volume `/files`. -Note that you may need to compress the logfile before uploading. +The location of the logfile can be customized. -When not using the default location for the logfile, it can be specified via your _additional_ xref:installation/configuration_notes.adoc#using-a-configuration-file[configuration file]: +include::partial$manual_config_file.adoc[] + +NOTE: You must create a Docker Volume to make the configured path available to the host. [source,php] ---- 'logfile' => '/owncloud.log', ---- -NOTE: You must create a Docker Volume to make the configured path available. - == LDAP Config If LDAP is used, viewing the LDAP configuration is important when checking for errors between your ownCloud instance and your LDAP server. To get the output file, execute this command: From bb125b0ccba107dfccead67a0ce8c3688af69463 Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Fri, 3 Jul 2026 16:31:03 +0200 Subject: [PATCH 08/32] safe work --- .../admin_manual/pages/configuration/user/login_policies.adoc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/admin_manual/pages/configuration/user/login_policies.adoc b/modules/admin_manual/pages/configuration/user/login_policies.adoc index 7bc6c0bf6..899a30812 100644 --- a/modules/admin_manual/pages/configuration/user/login_policies.adoc +++ b/modules/admin_manual/pages/configuration/user/login_policies.adoc @@ -9,6 +9,8 @@ Login policies will emit a `failed login` event if the user isn't allowed to log in. +// if there will be no one envvar for loginPolicy.groupLoginPolicy.forbidMap , we need to add: include::partial$manual_config_file.adoc[] + == Use Cases Login policies can be used to restrict members of particular groups to use only particular login types. This is especially true for guest users as they do not have an ownCloud account and cannot be validated via OpenID Connect but can log in using their email and password. From 6ef43fa52265879ac7bbc9948ca455b1503f745d Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Mon, 6 Jul 2026 13:08:47 +0200 Subject: [PATCH 09/32] cleanup, more to come --- .../files/previews_configuration.adoc | 4 +- .../pages/configuration/important_notes.adoc | 1 + .../windows-network-drive_configuration.adoc | 5 +- modules/admin_manual/pages/index.adoc | 11 +++-- .../apps_management_installation.adoc | 7 +-- .../{ => apps}/apps_supported.adoc | 5 +- .../installation/configuration_notes.adoc | 17 ------- .../deployment_considerations.adoc | 3 +- .../deployment_recommendations.adoc | 2 +- .../clustered_shared_storage.adoc | 1 + .../deployment_recommendations/nfs.adoc | 1 + .../installation/installing_with_docker.adoc | 14 +++--- .../pages/maintenance/migrating.adoc | 46 +++++++------------ .../maintenance/upgrading/manual_upgrade.adoc | 2 +- .../troubleshooting/path_filename_length.adoc | 2 +- modules/admin_manual/partials/nav.adoc | 15 +++--- 16 files changed, 58 insertions(+), 78 deletions(-) rename modules/admin_manual/pages/installation/{ => apps}/apps_management_installation.adoc (82%) rename modules/admin_manual/pages/installation/{ => apps}/apps_supported.adoc (94%) delete mode 100644 modules/admin_manual/pages/installation/configuration_notes.adoc rename modules/admin_manual/pages/installation/{ => deployment}/deployment_considerations.adoc (98%) rename modules/admin_manual/pages/installation/{ => deployment}/deployment_recommendations.adoc (99%) rename modules/admin_manual/pages/installation/{ => deployment}/deployment_recommendations/clustered_shared_storage.adoc (99%) rename modules/admin_manual/pages/installation/{ => deployment}/deployment_recommendations/nfs.adoc (99%) diff --git a/modules/admin_manual/pages/configuration/files/previews_configuration.adoc b/modules/admin_manual/pages/configuration/files/previews_configuration.adoc index c118e80fe..e0cb16537 100644 --- a/modules/admin_manual/pages/configuration/files/previews_configuration.adoc +++ b/modules/admin_manual/pages/configuration/files/previews_configuration.adoc @@ -20,6 +20,8 @@ ownCloud supports the preview generation of file types such as PDF, SVG or vario IMPORTANT: Be careful enabling preview thumbnail generation for documents which could contain or reference executable code! ownCloud does NOT take any responsibility for any issues. +IMPORTANT: The ownCloud Docker image provides the `imagick` PHP extension but not the ImageMagick binary, which is required for an enhanced configuration. To resolve this, you need to create a custom image that installs this requirement manually. Please note that other binaries may be required; these are listed in the relevant sections below. + == Important Considerations . Rendering takes place when the user accesses the folder and the preview has not been generated before. This means that each first folder access may create additional load on the server. @@ -60,8 +62,6 @@ If you want to add or change the default list, you MUST define all elements. If When defining your own preview providers, some things need to be considered. For some file types, ownCloud uses ImageMagick to generate previews. -IMPORTANT: The ownCloud Docker Image provides the `imagic` php extension, but not the ImageMagick binary. To mitigate this issue, you need to manually create an image that installs this requirement. Please note that other binaries may be required, which are listed in the relevant sections below. - Starting with version 7 of ImageMagick, additional file formats like SVG or HEIC and many others can be processed. You can check your ImageMagick version, if installed in your image, by issuing the following command: diff --git a/modules/admin_manual/pages/configuration/important_notes.adoc b/modules/admin_manual/pages/configuration/important_notes.adoc index 8e527e6ab..c7155ff36 100644 --- a/modules/admin_manual/pages/configuration/important_notes.adoc +++ b/modules/admin_manual/pages/configuration/important_notes.adoc @@ -1,5 +1,6 @@ = Important Configuration Notes :toc: right +:page-aliases: installation/configuration_notes.adoc :description: This page provides some important configuration notes. == Introduction diff --git a/modules/admin_manual/pages/enterprise/external_storage/windows-network-drive_configuration.adoc b/modules/admin_manual/pages/enterprise/external_storage/windows-network-drive_configuration.adoc index 8dcc90e7d..01c0e37d2 100644 --- a/modules/admin_manual/pages/enterprise/external_storage/windows-network-drive_configuration.adoc +++ b/modules/admin_manual/pages/enterprise/external_storage/windows-network-drive_configuration.adoc @@ -36,7 +36,9 @@ Compared to standard SMB access, WND has advanced features like: . Enhanced ACL support . Collaborative WND (CWND) -.Brief Description of Advanced Features: +IMPORTANT: The Docker image does not provide the `smbclient` CLI tool. To mitigate this issue, you need to manually create an image that installs and enables this requirement. + +=== Brief Description of Advanced Features User lockout prevention and password reset:: Depending on the Windows or Samba policy, users could get locked out of their account if they enter a wrong password a number of times. The lockout prevention tries to avoid this from happening by resetting the password if it is wrong. This is also true for Collaborative WND when using `login credentials saved in database` and a repeatedly running files-scan job which may use outdated credentials. In the case of ownCloud's standard SMB connector, the password won't be reset. It could happen that users get locked out of the file server. @@ -99,7 +101,6 @@ Depending on the authentication method, passwords for each mount are encrypted a [IMPORTANT] ==== * For more information on SMB/CIFS in ownCloud, refer to the xref:configuration/files/external_storage/smb.adoc[Samba File Server Configuration] documentation. -* Please note that the referenced document provides additional information on testing an SMB connection with `smbclient`. This CLI tool is not included in the shipped image, but can be added. * If you encounter errors when using the WND app like `NT_STATUS_REVISION_MISMATCH`, please get in touch by {oc-support-url}[Opening a Service Request]. ==== diff --git a/modules/admin_manual/pages/index.adoc b/modules/admin_manual/pages/index.adoc index aa09f362a..cdf66456d 100644 --- a/modules/admin_manual/pages/index.adoc +++ b/modules/admin_manual/pages/index.adoc @@ -2,9 +2,14 @@ Welcome to the ownCloud Classic Administration Guide. This guide describes administration tasks for ownCloud, the flexible open source file synchronization and sharing solution. -== Installation Changes - -IMPORTANT: Unlike previous releases, ownCloud Classic 11 is only available as a Docker image containing the necessary libraries, such as PHP 8. +== Important Changes + +[IMPORTANT] +==== +* Unlike previous releases, ownCloud Classic 11 is only available as a Docker image containing the necessary libraries, such as PHP 8, as well as an embedded, preconfigured Apache web server. Therefore, to access ownCloud Classic 11, you need to use a proxy web server that handles certificates. +* The majority of apps provided by ownCloud that were formerly available from the Marketplace are now included in the image, including Enterprise-only apps. These apps have been updated to PHP 8. The only requirement is to enable them. For Enterprise-only apps, a licence key is required before they can be enabled. Apps not provided by ownCloud can still be used as long as they meet the PHP 8 compliance prerequisite. +* Some apps, such as the Enterprise-only Sharepoint app have been retired and are not part of the image. +==== == Target Audience diff --git a/modules/admin_manual/pages/installation/apps_management_installation.adoc b/modules/admin_manual/pages/installation/apps/apps_management_installation.adoc similarity index 82% rename from modules/admin_manual/pages/installation/apps_management_installation.adoc rename to modules/admin_manual/pages/installation/apps/apps_management_installation.adoc index a146ac63b..4ddbd9b1d 100644 --- a/modules/admin_manual/pages/installation/apps_management_installation.adoc +++ b/modules/admin_manual/pages/installation/apps/apps_management_installation.adoc @@ -1,15 +1,16 @@ = Installing and Managing Apps :toc: right +:page-aliases: installation/apps_management_installation.adoc :description: After installing ownCloud, you may provide added functionality by installing applications. == Introduction -{description} The Docker image comes with all apps provided by ownCloud, regardless of the licensing scheme. Apps that are not part of the image can be installed at any time. +{description} The Docker image comes with all apps provided by ownCloud, regardless of the licensing scheme. [IMPORTANT] ==== * Any apps that came with the image will reappear when the container is restarted - if you uninstall them. -* Any apps that are installed manually *must be compatible with PHP 8*; otherwise, they will most likely fail to work and make your instance unstable. +* Manually installed apps *must be compatible with PHP 8*; otherwise, they will most likely fail to work and make your instance unstable. ==== == Installing and Managing Apps @@ -26,7 +27,7 @@ NOTE: If you would like to create or add (your own) ownCloud app, please refer t === Installing Apps Manually -All apps that are installed manually, regardless of using the Marketplace or you copy them, will be placed into the `apps` folder of the ownCloud volume. This volume is either the Docker volume or a defined bind mount. This apps folder corresponds to the `apps-external` folder. For more and important details see: xref:installation/mount_folder_structure.adoc[Mount Folder Structure]. +All apps that are installed manually, regardless of the source, will be placed into the `/apps` folder. This volume is either the Docker volume or a defined bind mount. This apps folder corresponds to the `apps-external` folder. For more and important details see: xref:installation/mount_folder_structure.adoc[Mount Folder Structure]. Once the tarball has been extracted into the default app folder. Enable the application, diff --git a/modules/admin_manual/pages/installation/apps_supported.adoc b/modules/admin_manual/pages/installation/apps/apps_supported.adoc similarity index 94% rename from modules/admin_manual/pages/installation/apps_supported.adoc rename to modules/admin_manual/pages/installation/apps/apps_supported.adoc index 300616866..fc789e274 100644 --- a/modules/admin_manual/pages/installation/apps_supported.adoc +++ b/modules/admin_manual/pages/installation/apps/apps_supported.adoc @@ -1,11 +1,10 @@ = Supported Apps in ownCloud :toc: right -:toclevels: 1 -:page-aliases: installation/apps/mediaviewer/index.adoc +:page-aliases: installation/apps/mediaviewer/index.adoc, installation/apps_supported.adoc == AGPL Apps -Please note that apps without a link are now fully integrated into the core system and self-explanatory. +Please note that apps without a link are fully integrated into the core system and self-explanatory. * {oc-marketplace-url}/apps/activity[Activity] * {oc-marketplace-url}/apps/files_antivirus[Anti-Virus] diff --git a/modules/admin_manual/pages/installation/configuration_notes.adoc b/modules/admin_manual/pages/installation/configuration_notes.adoc deleted file mode 100644 index fa6732312..000000000 --- a/modules/admin_manual/pages/installation/configuration_notes.adoc +++ /dev/null @@ -1,17 +0,0 @@ -= Configuration Notes -:toc: right -:description: There are multiple ways to configure ownCloud to run in a Dockerized environment. - -== Introduction - -{description} - -== Using Environment Variables - -The image provides additional environment variables that can be configured for the use with the container. To identify available ones, see the file `overwrite.config.php` which can be found in the `config` folder. This folder is located in `/mnt/data` in the container or locally at the respective bind mount. - -== Using a Configuration File - -Rather than using environment variables to configure your ownCloud instance, you can use *additional* configuration files, as was possible with earlier releases of ownCloud. This configuration method is only possible when using bind mounts, because access to the `config` sub folder is required. - -For more and important details see: xref:installation/mount_folder_structure.adoc[Mount Folder Structure]. diff --git a/modules/admin_manual/pages/installation/deployment_considerations.adoc b/modules/admin_manual/pages/installation/deployment/deployment_considerations.adoc similarity index 98% rename from modules/admin_manual/pages/installation/deployment_considerations.adoc rename to modules/admin_manual/pages/installation/deployment/deployment_considerations.adoc index 3c6a6a619..e1d8fc962 100644 --- a/modules/admin_manual/pages/installation/deployment_considerations.adoc +++ b/modules/admin_manual/pages/installation/deployment/deployment_considerations.adoc @@ -1,5 +1,6 @@ = Deployment Considerations :toc: right +:page-aliases: installation/deployment_considerations.adoc == Hardware @@ -74,7 +75,7 @@ What about the other DBMS? === Docker Volume -When using bind mounts with the Docker volume, consider using a shared directory, such as NFS, as the mount point. This is important if you plan to implement Active-Passive failover scenarios, since the instance taking over must be able to access the configuration and app data.. +When using bind mounts with the Docker volume, consider using a shared directory, such as NFS, as the mount point. This is important if you plan to implement Active-Passive failover scenarios, since the instance taking over must be able to access the configuration and app data. === File Storage diff --git a/modules/admin_manual/pages/installation/deployment_recommendations.adoc b/modules/admin_manual/pages/installation/deployment/deployment_recommendations.adoc similarity index 99% rename from modules/admin_manual/pages/installation/deployment_recommendations.adoc rename to modules/admin_manual/pages/installation/deployment/deployment_recommendations.adoc index 5760c9db3..eb6549d95 100644 --- a/modules/admin_manual/pages/installation/deployment_recommendations.adoc +++ b/modules/admin_manual/pages/installation/deployment/deployment_recommendations.adoc @@ -1,6 +1,6 @@ = Deployment Recommendations :toc: right -:toclevels: 2 +:page-aliases: installation/deployment_recommendations.adoc :owncloud-edition-url: https://owncloud.com/find-the-right-edition/ :ibm-elastic-storage-server-url: https://www.ibm.com/us-en/marketplace/ibm-elastic-storage-server :redhat-ceph-url: https://www.redhat.com/en/technologies/storage/ceph diff --git a/modules/admin_manual/pages/installation/deployment_recommendations/clustered_shared_storage.adoc b/modules/admin_manual/pages/installation/deployment/deployment_recommendations/clustered_shared_storage.adoc similarity index 99% rename from modules/admin_manual/pages/installation/deployment_recommendations/clustered_shared_storage.adoc rename to modules/admin_manual/pages/installation/deployment/deployment_recommendations/clustered_shared_storage.adoc index b5b698c89..f112d4be7 100644 --- a/modules/admin_manual/pages/installation/deployment_recommendations/clustered_shared_storage.adoc +++ b/modules/admin_manual/pages/installation/deployment/deployment_recommendations/clustered_shared_storage.adoc @@ -2,6 +2,7 @@ :toc: right :toclevels: 2 :keywords: cluster, shared storage, nfs, kubernetes, swarm, scale-out, redis, locking, chown +:page-aliases: installation/deployment_recommendations/clsutered_shared_storage.adoc :description: How to run the ownCloud Docker image across multiple application nodes that share a common file storage (for example NFS), and the pitfalls to avoid. :k8s-fsgroup-url: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ diff --git a/modules/admin_manual/pages/installation/deployment_recommendations/nfs.adoc b/modules/admin_manual/pages/installation/deployment/deployment_recommendations/nfs.adoc similarity index 99% rename from modules/admin_manual/pages/installation/deployment_recommendations/nfs.adoc rename to modules/admin_manual/pages/installation/deployment/deployment_recommendations/nfs.adoc index 759914f24..defeb2b75 100644 --- a/modules/admin_manual/pages/installation/deployment_recommendations/nfs.adoc +++ b/modules/admin_manual/pages/installation/deployment/deployment_recommendations/nfs.adoc @@ -2,6 +2,7 @@ :toc: right :toclevels: 1 :keywords: nfs, network file system, nfsv4, mtu, async, noasync +:page-aliases: installation/deployment_recommendations/nfs.adoc :description: This guide covers the official ownCloud NFS (Network File System) deployment recommendations. :autofs-url: https://help.ubuntu.com/community/Autofs diff --git a/modules/admin_manual/pages/installation/installing_with_docker.adoc b/modules/admin_manual/pages/installation/installing_with_docker.adoc index faf39ffbb..98626cef4 100644 --- a/modules/admin_manual/pages/installation/installing_with_docker.adoc +++ b/modules/admin_manual/pages/installation/installing_with_docker.adoc @@ -156,15 +156,15 @@ Only a few settings are required, these are: a| `{latest-server-download-version}` or `latest` | `OWNCLOUD_DOMAIN` *^1^* -a| A single ownCloud domain --- -IMPORTANT: Either use: + +a| Only for the use with a single ownCloud domain + +The same rules trusted domains apply to everything else. +[IMPORTANT] +==== +Either use: + pass:[ ] `OWNCLOUD_DOMAIN` + pass:[  ] _OR_ + -pass:[ ] `OWNCLOUD_TRUSTED_DOMAINS`. + -Only use a single domain. + -The same trusted domains rules apply to everything else. --- +pass:[ ] `OWNCLOUD_TRUSTED_DOMAINS`. +==== | `my_domain` or `my_ip` ... diff --git a/modules/admin_manual/pages/maintenance/migrating.adoc b/modules/admin_manual/pages/maintenance/migrating.adoc index 8f001094c..00d70d79a 100644 --- a/modules/admin_manual/pages/maintenance/migrating.adoc +++ b/modules/admin_manual/pages/maintenance/migrating.adoc @@ -24,7 +24,7 @@ To issue any occ commands, you must enter the directory where the ownCloud compo + [source,bash,subs="attributes+"] ---- -cd /var/www/owncloud/ +cd {occ-command-example-prefix-docker} maintenance:mode --on ---- @@ -32,7 +32,7 @@ cd /var/www/owncloud/ + [source,bash,subs="attributes+"] ---- -cd /var/www/owncloud/ +cd {occ-command-example-prefix-docker} maintenance:mode --off ---- @@ -60,45 +60,31 @@ As the ownCloud Classic 11 image provides an embedded Apache web server, you nee ==== Managing Trusted Domains -All URLs used to access your ownCloud server must be white-listed in your configuration file, under the `trusted_domains` setting or via environment variables. Users are allowed to log into ownCloud only when they point their browsers to a URL that is listed in the `trusted_domains` setting. +All URLs used to access your ownCloud server must be white-listed using a environment variable. Users are allowed to log into ownCloud only when they point their browsers to a URL that is listed in the `OWNCLOUD_TRUSTED_DOMAINS` setting. NOTE: This setting is important when changing or moving to a new domain name. You may use IP addresses and domain names. -NOTE: The loopback address, `127.0.0.1`, is automatically white-listed, so as long as you have access to the physical server you can always log in. In the event that a load-balancer is in place, there will be no issues as long as it sends the correct `X-Forwarded-Host` header. +NOTE: The loopback address, `127.0.0.1`, is automatically whitelisted. In the event that a load-balancer is in place, there will be no issues as long as it sends the correct `X-Forwarded-Host` header. +A typical configuration looks like this: -A typical configuration via the configuration file looks like this:: -+ --- -[source,php] +[source,.env] ---- -'trusted_domains' => [ - 0 => 'localhost', - 1 => 'server1.example.com', - 2 => '192.168.1.50', -], +OWNCLOUD_TRUSTED_DOMAINS='server1.example.com','192.168.1.50' ---- --- -Here is an example of how this can be used from within a docker-compose.yml file:: -+ --- -In case of a docker based setup, the trusted_domains setting is controlled by the environment variables `OWNCLOUD_TRUSTED_DOMAINS` or `OWNCLOUD_DOMAIN`. The latter only takes effect, if `OWNCLOUD_TRUSTED_DOMAINS` is undefined and can provide one IP-address or hostname. `OWNCLOUD_TRUSTED_DOMAINS` can specify multiple values as a comma-separated list. For more details on environment variables see the xref:installation/installing_with_docker.adoc[Installing With Docker] documentation. +=== ownCloud Classic Migration -This will allow access to ownCloud under two different names, and one IP-address, in addition to localhost and 127.0.0.1: +=== Docker to Docker -[source,yaml,subs="attributes+"] ----- -services: - owncloud: - image: owncloud/server:{latest-server-download-version} - environment: - OWNCLOUD_TRUSTED_DOMAINS: "myowncloud.mydomain.com, myowncloud, 12.23.34.45" -... ----- --- +If you have previously used a Docker-based installation with ownCloud Classic 10, no data migration is required. -=== ownCloud Classic Migration +The main migration steps are the following: + +* Put your instance into maintenance modes +. + +=== Native to Docker This section describes the migration of *ownCloud Classic 10* to *ownCloud Classic 11*, if ownCloud Classic 10 was installed natively. It only focuses on ownCloud but not on any migration of the database! diff --git a/modules/admin_manual/pages/maintenance/upgrading/manual_upgrade.adoc b/modules/admin_manual/pages/maintenance/upgrading/manual_upgrade.adoc index fe93ecc2a..f71882193 100644 --- a/modules/admin_manual/pages/maintenance/upgrading/manual_upgrade.adoc +++ b/modules/admin_manual/pages/maintenance/upgrading/manual_upgrade.adoc @@ -34,7 +34,7 @@ First, backup ownCloud and the server database as described in section xref:main === Review Third-Party Apps Review any installed third-party apps for compatibility with the new ownCloud release. Ensure that they are all disabled before beginning the upgrade. -Third party apps are all apps that are not distributed by {oc-marketplace-url}/publishers/owncloud[ownCloud] or not listed in xref:installation/apps_supported.adoc[Supported Apps in ownCloud]. +Third party apps are all apps that are not distributed by {oc-marketplace-url}/publishers/owncloud[ownCloud] or not listed in xref:installation/apps/apps_supported.adoc[Supported Apps in ownCloud]. . Disable Apps via Command Line + diff --git a/modules/admin_manual/pages/troubleshooting/path_filename_length.adoc b/modules/admin_manual/pages/troubleshooting/path_filename_length.adoc index 48119c1dd..46989dd43 100644 --- a/modules/admin_manual/pages/troubleshooting/path_filename_length.adoc +++ b/modules/admin_manual/pages/troubleshooting/path_filename_length.adoc @@ -10,7 +10,7 @@ Depending on the underlying filesystem of a mount point, the maximum length of a == Limitations -See the {fs-limits-url}[comparison of file systems] for in depth details on various filesystem path and file name limitations. +See the {fs-limits-url}[comparison of file systems, window=_blank] for in depth details on various filesystem path and file name limitations. NOTE: While a filesystem can handle the limits as described in the table below, applications like Explorer, Finder, the Shell or other apps may have issues handling these limits. See the special notes below the table. diff --git a/modules/admin_manual/partials/nav.adoc b/modules/admin_manual/partials/nav.adoc index db581397b..7df1759fc 100644 --- a/modules/admin_manual/partials/nav.adoc +++ b/modules/admin_manual/partials/nav.adoc @@ -6,17 +6,18 @@ ** xref:admin_manual:gdpr.adoc[GDPR] ** Installation -*** xref:admin_manual:installation/deployment_considerations.adoc[Deployment Considerations] -*** xref:admin_manual:installation/deployment_recommendations.adoc[Deployment Recommendations] -**** xref:admin_manual:installation/deployment_recommendations/clustered_shared_storage.adoc[Clustered Deployments with Shared Storage] -**** xref:admin_manual:installation/deployment_recommendations/nfs.adoc[NFS] +*** Deployment +**** xref:admin_manual:installation/deployment/deployment_considerations.adoc[Deployment Considerations] +**** xref:admin_manual:installation/deployment/deployment_recommendations.adoc[Deployment Recommendations] +**** xref:admin_manual:installation/deployment/deployment_recommendations/clustered_shared_storage.adoc[Clustered Deployments with Shared Storage] +**** xref:admin_manual:installation/deployment/deployment_recommendations/nfs.adoc[NFS] *** xref:admin_manual:installation/system_requirements.adoc[System Requirements] *** xref:admin_manual:installation/installing_with_docker.adoc[Installing With Docker] *** xref:admin_manual:installation/create_own_image.adoc[Create an own Docker Image] *** xref:admin_manual:installation/mount_folder_structure.adoc[Mount Folder Structure] -*** xref:admin_manual:installation/configuration_notes.adoc[Configuration Notes] -*** xref:admin_manual:installation/apps_management_installation.adoc[Apps Management] -**** xref:admin_manual:installation/apps_supported.adoc[Supported Apps] +*** Apps +**** xref:admin_manual:installation/apps/apps_management_installation.adoc[Apps Management] +**** xref:admin_manual:installation//apps/apps_supported.adoc[Supported Apps] ** Configuration From 839fc200f2cd54d01e3e195efa54a957bb2fb539 Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Mon, 6 Jul 2026 18:35:48 +0200 Subject: [PATCH 10/32] migration --- ...-folders.adoc => migrate-data-folder.adoc} | 102 ++++++++++++------ .../pages/maintenance/migrating.adoc | 67 ++++++------ .../maintenance/upgrading/manual_upgrade.adoc | 10 +- modules/admin_manual/partials/nav.adoc | 2 +- 4 files changed, 115 insertions(+), 66 deletions(-) rename modules/admin_manual/pages/maintenance/{manually-moving-data-folders.adoc => migrate-data-folder.adoc} (50%) diff --git a/modules/admin_manual/pages/maintenance/manually-moving-data-folders.adoc b/modules/admin_manual/pages/maintenance/migrate-data-folder.adoc similarity index 50% rename from modules/admin_manual/pages/maintenance/manually-moving-data-folders.adoc rename to modules/admin_manual/pages/maintenance/migrate-data-folder.adoc index 9ae9316ab..5c6c8aa3a 100644 --- a/modules/admin_manual/pages/maintenance/manually-moving-data-folders.adoc +++ b/modules/admin_manual/pages/maintenance/migrate-data-folder.adoc @@ -1,34 +1,48 @@ = Manually Move the Data Directory :toc: right -:description: Use these instructions if you intend to move your ownCloud's data directory from its current location to another without using a symbolic link. +:page-aliases: maintenance/manually-moving-data-folders.adoc +:description: Follow these instructions if you need to migrate the data directory to a Dockerized installation. :mysql-string-replace-function-url: http://www.mysqltutorial.org/mysql-string-replace-function.aspx - -// this needs review for oc10 -> oc11 +:mariadb-docker-url: https://mariadb.com/docs/server/server-management/automated-mariadb-deployment-and-administration/docker-and-mariadb/installing-and-using-mariadb-via-docker == Introduction {description} -As ownCloud is deployed via Docker, it is easy to move any data for a Dockerised deployment, as this simply involves relocating the contents of the mount point. Additional steps need to be taken into account when upgrading from a standard installation to Docker because the database needs to be updated. +Migrating the data directory, where ownCloud hosts user data, is a critical migration. + +Different steps need to be taken when migrating from an existing installation to a Dockerised one in the following scenarios using ownCloud Classic 11. *In both cases, updating the database is required*: + +. Local, no NFS: + +Copy the `data` directory to a new location. + +. The `data` directory is part of an existing NFS export: + +The old export can be removed and a new export with only the `data` directory needs to be provided and mounted. This guide assumes that: -* The current Docker volume folder is: `/oc` -* The new Docker volume folder is: `/oc-new` -* ownCloud's database name is `owncloud` -* For a standard installation, the data directory is `var/www/owncloud/data` -* The internal "data folder of a Dockerized installation is `/mnt/data/files` +* The data directory of a local installation is: + +`/var/www/owncloud/data` + +* The Docker volume data directory is: + +`/files` + +* The internal data directory of a Dockerized installation is: + +`/mnt/data/files` + +* The ownCloud's database name is: + +`owncloud` Please change the paths above to reflect your environment. -== Summary +== Overview of Steps -The following steps are necessary to move the data directory. +The following steps are necessary to migrate the data directory. -. Stop the web proxy server +. Stop access via the web (proxy) server . Enable maintenance mode -. Sync your Data directory +. Sync / remount your Data directory . Adjust ownCloud's configuration . Check permissions . Disable maintenance mode @@ -36,11 +50,13 @@ The following steps are necessary to move the data directory. Look at each section below for a detailed description. -== Stop the Web Proxy Server +== Preparation -To ensure there are no active user connections to your ownCloud instance, stop access to it from the web proxy server. Follow the web proxy server description to find out how to do this. +=== Prevent User Access via the Web (Proxy) Server -== Enable Maintenance Mode +To prevent any active user connections to your ownCloud instance, stop access to it via the web (proxy) server. Refer to the web (proxy) server description to find out how to do this. + +=== Enable Maintenance Mode It is necessary to enable maintenance mode to avoid running cron jobs. To enable maintenance mode, run the following command. @@ -49,25 +65,34 @@ It is necessary to enable maintenance mode to avoid running cron jobs. To enable {occ-command-example-prefix-docker} maintenance:mode --on ---- -== Sync your Data Directory +=== Database -[source,bash] ----- -sudo rsync -avz /files /mnt/ ----- +Back up your database by making a copy or an export. This way, you can always revert if something goes horribly wrong. + +== Data Directory + +Depending on the Setup, the `data` directory either needs to be copied or remounted. + +For small instances with limited data, copying is probably the best option. For anything with more user data, such as an existing NFS mount, remounting to a different location is preferable. If you have more user data that you are currently hosting locally, now might be a good time to switch to NFS. -Make sure that `.ocdata` and `.htaccess` were synced to the new directory. +=== Sync to a new Location + +Please note that the target mount point is used intentionally as the Docker volume mount point for ease of handling. In this example, the source and target are on the same server and the source path is the ownCloud's default. Adapt accordingly to suit your needs. [source,bash] ---- -ls -a | grep -i "^\.[A-Z]" +sudo rsync -avz /var/www/owncloud/data /files ---- -== Adjust ownCloud's configuration +=== Mounting with NFS + +If the data directory is already part of a NFS mount point such as `/mnt/owncloud/data`, unmount it, remove the export, create a new export including the data directory and mount it to `/files`. -=== Adjust oc_storages table +IMPORTANT: Only mount the data directory from the source and not the full owncloud directory including the data directory. -Connect to your database and enter following commands: +== Adjust ownCloud Database Configuration + +{mariadb-docker-url}#connecting-to-mariadb-from-outside-the-container[Connect to your database, window=_blank] and enter the following command to select the ownCloud database: Adapt the database name if it is not named as shown: [source,sql] ---- @@ -76,13 +101,30 @@ use owncloud; === Update the oc_storages Table -Run the SQL below: +First print all the affected paths to be changed: [source,sql] ---- -UPDATE oc_storages - SET id='local::/mnt/owncloud/data/' - WHERE id='local::/var/www/owncloud/data/'; +select * from oc_storages where id like 'local::%'; +---- + +Then update the database paths and adapt them accordingly: + +[source,sql] +---- +BEGIN TRANSACTION; + +UPDATE oc_storages + SET id = REPLACE(id, '/var/www/owncloud/data', '/mnt/data/files') +WHERE id LIKE 'local::%'`; + +# check with the select statement above +# in case something went wrong +# ROLLBACK; + +# otherwise use +# COMMIT; + ---- === Update the oc_accounts Table diff --git a/modules/admin_manual/pages/maintenance/migrating.adoc b/modules/admin_manual/pages/maintenance/migrating.adoc index 00d70d79a..43e7daa13 100644 --- a/modules/admin_manual/pages/maintenance/migrating.adoc +++ b/modules/admin_manual/pages/maintenance/migrating.adoc @@ -16,47 +16,32 @@ Note that any database migration is not covered here. IMPORTANT: During the migration process, do not make any changes to the original system except to put it into maintenance mode. This ensures that, should anything unforeseen happen, you can revert to your existing installation and resume its availability while debugging the problem. -== Maintenance Mode +You can find details of the steps for your ownCloud instance in the xref:maintenance/upgrading/manual_upgrade.adoc[Manual ownCloud Upgrade] documentation. -To issue any occ commands, you must enter the directory where the ownCloud compose file is located. - -* To enable maintenance mode, issue the following command: -+ -[source,bash,subs="attributes+"] ----- -cd -{occ-command-example-prefix-docker} maintenance:mode --on ----- - -* To disable maintenance mode, issue the following command: -+ -[source,bash,subs="attributes+"] ----- -cd -{occ-command-example-prefix-docker} maintenance:mode --off ----- - -== Migration +== Special Migrations === Host Migration Migration to a different host is easy with Docker. -. Enable maintenance mode -. Down the container +. Enable maintenance mode. +. Prevent browser access via the proxy. +. Down the container. . Make the data available on the new host: .. Either copy the Docker volume if not using a shared mount point to the new host, or -.. Create a new shared mount point -. Copy / adapt the compose yaml file to reflect your changes -. Bring up the container -. Disable maintenance mode +.. Create a new shared mount point. +. Copy / adapt the compose yaml file to reflect your changes. +. Bring up the container. +. Disable maintenance mode. +. Reconfigure proxy access to the ownCloud Instance. +. Reenable browser access via the proxy. === Domain Migration As the ownCloud Classic 11 image provides an embedded Apache web server, you need a proxy to handle security and other web-related settings anyway. To migrate or add a domain, two steps are required: -. Update your proxy server settings -. Update the ownCloud trusted domain settings +. Update your proxy server settings. +. Update the ownCloud trusted domain settings. ==== Managing Trusted Domains @@ -73,16 +58,36 @@ A typical configuration looks like this: OWNCLOUD_TRUSTED_DOMAINS='server1.example.com','192.168.1.50' ---- -=== ownCloud Classic Migration +== ownCloud Classic Migration === Docker to Docker If you have previously used a Docker-based installation with ownCloud Classic 10, no data migration is required. +[IMPORTANT] +==== +* The steps shown do not cover any measures that may be necessary when the ownCloud-provided image was customised . +* Any third party app used needs to be PHP 8 compliant. In doubt, disable it and do not re-enable until this prerequisite is met. +==== + +[NOTE] +==== +With a few exceptions, ownCloud 11 provides nearly all configuration keys as environment variables. Therefore, it is highly recommended that any configuration keys are migrated to envvars, if possible. See the xref:configuration/important_notes.adoc[Important Configuration Notes] documentation for more details. +==== + The main migration steps are the following: -* Put your instance into maintenance modes -. +* Put your instance into maintenance mode. +* Disable and then delete any app that is provided by ownCloud. + +The deleted ownCloud apps were written in PHP 7. + +The updated apps, which are now compliant with PHP 8, are embedded in the image. +* Prevent browser access via the proxy. +* Down the compose environment. +* Define the OC11 image that will be used with the container, then pull it. +* Start the compose environment. +* Turn Maintenance mode off. +* Start the occ upgrade process. +* Reenable browser access via the proxy. === Native to Docker diff --git a/modules/admin_manual/pages/maintenance/upgrading/manual_upgrade.adoc b/modules/admin_manual/pages/maintenance/upgrading/manual_upgrade.adoc index f71882193..38b8d8555 100644 --- a/modules/admin_manual/pages/maintenance/upgrading/manual_upgrade.adoc +++ b/modules/admin_manual/pages/maintenance/upgrading/manual_upgrade.adoc @@ -11,7 +11,7 @@ NOTE: This guide assumes that you have basic knowledge about Unix terminology, c NOTE: To run any occ commands, you must first change to the directory containing the Compose YAML file. -NOTE: Accessing the webroot of ownCloud needs extra compose configuration that is not covered here. +NOTE: Accessing the webroot of ownCloud needs extra deployment configuration that is not covered here. == General Preparation @@ -38,19 +38,21 @@ Third party apps are all apps that are not distributed by {oc-marketplace-url}/p . Disable Apps via Command Line + +-- This command lists all apps by and app version: -+ + [source,bash,subs="attributes+"] ---- {occ-command-example-prefix-docker} app:list ---- -+ + This command disables the app with the given : -+ + [source,bash,subs="attributes+"] ---- {occ-command-example-prefix-docker} app:disable ---- +-- . Disable via Browser + Go to menu:Settings[Admin > Apps] and disable all third-party apps. diff --git a/modules/admin_manual/partials/nav.adoc b/modules/admin_manual/partials/nav.adoc index 7df1759fc..37ba2ea6d 100644 --- a/modules/admin_manual/partials/nav.adoc +++ b/modules/admin_manual/partials/nav.adoc @@ -118,7 +118,7 @@ **** xref:admin_manual:maintenance/backup_and_restore/restore.adoc[Restore] *** xref:admin_manual:maintenance/enable_maintenance.adoc[Maintenance Mode] *** xref:admin_manual:maintenance/export_import_instance_data.adoc[Export and Import Instance Data] -*** xref:admin_manual:maintenance/manually-moving-data-folders.adoc[Manually Moving Data Folders] +*** xref:admin_manual:maintenance/migrate-data-folder.adoc[Migrate the Data Folder] *** Encryption **** xref:admin_manual:maintenance/encryption/migrating-from-user-key-to-master-key.adoc[Migrating from User Key to Master Key Encryption] *** xref:admin_manual:maintenance/migrating.adoc[Migrating ownCloud] From 9850cab578895b2cd62dc2df20d645cd84c5bcf6 Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Tue, 7 Jul 2026 13:06:36 +0200 Subject: [PATCH 11/32] finalize migration --- .../admin_manual/pages/found_a_mistake.adoc | 4 +- .../migrate-datadirectory.adoc} | 139 +++++++++++------- .../{ => migrate_owncloud}/migrating.adoc | 71 ++++++--- modules/admin_manual/partials/nav.adoc | 5 +- 4 files changed, 140 insertions(+), 79 deletions(-) rename modules/admin_manual/pages/maintenance/{migrate-data-folder.adoc => migrate_owncloud/migrate-datadirectory.adoc} (60%) rename modules/admin_manual/pages/maintenance/{ => migrate_owncloud}/migrating.adoc (59%) diff --git a/modules/admin_manual/pages/found_a_mistake.adoc b/modules/admin_manual/pages/found_a_mistake.adoc index 4a45851f5..c80e2104c 100644 --- a/modules/admin_manual/pages/found_a_mistake.adoc +++ b/modules/admin_manual/pages/found_a_mistake.adoc @@ -1,4 +1,4 @@ = Have You Found a Mistake In The Documentation? -:new-issue-url: https://github.com/owncloud/docs-server/issues/new +:new-issue-url: https://github.com/owncloud/docs/issues/new -If you have found a mistake in the documentation, no matter how large or small, please let us know by creating a new issue in the {new-issue-url}[docs-server repository]. +If you have found a mistake in the documentation, no matter how large or small, please let us know by creating a new issue in the {new-issue-url}[docs repository]. diff --git a/modules/admin_manual/pages/maintenance/migrate-data-folder.adoc b/modules/admin_manual/pages/maintenance/migrate_owncloud/migrate-datadirectory.adoc similarity index 60% rename from modules/admin_manual/pages/maintenance/migrate-data-folder.adoc rename to modules/admin_manual/pages/maintenance/migrate_owncloud/migrate-datadirectory.adoc index 5c6c8aa3a..3d77aa7ad 100644 --- a/modules/admin_manual/pages/maintenance/migrate-data-folder.adoc +++ b/modules/admin_manual/pages/maintenance/migrate_owncloud/migrate-datadirectory.adoc @@ -1,4 +1,4 @@ -= Manually Move the Data Directory += Migrate the Datadirectory :toc: right :page-aliases: maintenance/manually-moving-data-folders.adoc :description: Follow these instructions if you need to migrate the data directory to a Dockerized installation. @@ -40,25 +40,53 @@ Please change the paths above to reflect your environment. The following steps are necessary to migrate the data directory. -. Stop access via the web (proxy) server +. Stop browser access via the web proxy server . Enable maintenance mode . Sync / remount your Data directory . Adjust ownCloud's configuration -. Check permissions +. Check files . Disable maintenance mode -. Start the web proxy server +. Reenable browser access via the web proxy server Look at each section below for a detailed description. == Preparation -=== Prevent User Access via the Web (Proxy) Server +=== Prevent User Access via the Browser To prevent any active user connections to your ownCloud instance, stop access to it via the web (proxy) server. Refer to the web (proxy) server description to find out how to do this. +=== Check the datadirectory Settings + +When using a Dockerized ownCloud deployment:: ++ +-- +Run the following command to check the current datadirectory setting of the container: + +[source,bash,subs="attributes+"] +---- +{occ-command-example-prefix-docker} config:system:get datadirectory +---- + +This should print out the path which defaults to `/mnt/data/files`. +-- + +When using a native deployment you want to migrate to a dockerized deployment:: ++ +-- +Run the following command to check the current datadirectory setting of the native installation: + +[source,bash,subs="attributes+"] +---- +sudo -uwww-data ./occ config:system:get datadirectory +---- + +This should print out the path which defaults to `/var/www/owncloud/data`. +-- + === Enable Maintenance Mode -It is necessary to enable maintenance mode to avoid running cron jobs. To enable maintenance mode, run the following command. +It is necessary to enable maintenance mode to avoid running cron jobs. To enable maintenance mode, run the following command. Use the respective command for the native installation you want to migrate. [source,bash,subs="attributes+"] ---- @@ -90,7 +118,11 @@ If the data directory is already part of a NFS mount point such as `/mnt/ownclou IMPORTANT: Only mount the data directory from the source and not the full owncloud directory including the data directory. -== Adjust ownCloud Database Configuration +For more information follow the complete MySQL {mysql-string-replace-function-url}[REPLACE] command syntax. + +== Adjust the ownCloud Database Configuration + +CAUTION: Please do not copy and paste this example verbatim, or any of the others. They are just examples. {mariadb-docker-url}#connecting-to-mariadb-from-outside-the-container[Connect to your database, window=_blank] and enter the following command to select the ownCloud database: Adapt the database name if it is not named as shown: @@ -105,18 +137,22 @@ First print all the affected paths to be changed: [source,sql] ---- -select * from oc_storages where id like 'local::%'; +SELECT * FROM oc_storages WHERE id LIKE 'local::%'; ---- -Then update the database paths and adapt them accordingly: +Then update the database paths and adapt them accordingly. Please note that the internal default for a Dockerized ownCloud deployment is `mnt/data/files` unless otherwise defined: [source,sql] ---- BEGIN TRANSACTION; UPDATE oc_storages - SET id = REPLACE(id, '/var/www/owncloud/data', '/mnt/data/files') -WHERE id LIKE 'local::%'`; + SET id = REPLACE( + id, + '/var/www/owncloud/data', + '/mnt/data/files' + ) + WHERE id LIKE 'local::%'`; # check with the select statement above # in case something went wrong @@ -124,85 +160,83 @@ WHERE id LIKE 'local::%'`; # otherwise use # COMMIT; - ---- === Update the oc_accounts Table -You next need to update the `home` column in the `oc_accounts` table. -This column contains the absolute path for user folders, e.g., `/mnt/owncloud/data/my_user`. - -If a user does not have the path already set, you have to identify the users `id` and set the path with the following command, user by user. -This example assumes the user name is `my_user` and their id is `1`. Note that id's are incremental, meaning the account you created first will have id `1` and so on. +Next to be updated is the `home` column in the `oc_accounts` table. This column contains the _absolute path_ for user folders, for example, `/var/www/owncloud/data/my_user`. -Run the SQL below: +First print all the affected path to be changed. The path without the user component is important for the next step: [source,sql] ---- -UPDATE oc_accounts SET home='/mnt/owncloud/data/my_user' - WHERE id=1; +SELECT * FROM oc_accounts Where home LIKE '%'; ---- -For all users who already have a path like `/var/www/owncloud/data/` in your database, you can use the `REPLACE` command: +Then update the database paths and adapt them accordingly. Please note that the internal default for a Dockerized ownCloud deployment is `/mnt/data/files` unless otherwise defined: [source,sql] ---- -UPDATE oc_accounts +BEGIN TRANSACTION; + +UPDATE oc_accounts SET home = REPLACE( home, - '/var/www/owncloud/data/', - '/mnt/owncloud/data/' - ); ----- + '/var/www/owncloud/data', + '/mnt/data/files' + ) + WHERE home LIKE '/var/www/owncloud/data%'`; -For more information follow the complete MySQL {mysql-string-replace-function-url}[REPLACE] command syntax. +# check with the select statement above +# in case something went wrong +# ROLLBACK; -CAUTION: Please don’t copy and paste this example verbatim — nor any of the others. They are examples only. +# otherwise use +# COMMIT; +---- === Update the oc_jobs table -The next area to check is the `oc_jobs` table. -The logrotate process may have hard-coded a non-standard (or old) value for the data path. -To check it, run the SQL below and see if any results are returned: +The next area to check is the `oc_jobs` table. The logrotate process may have hard-coded a non-standard (or old) value for the data path. To check it, run the SQL query below and see if any results are returned. Note the use of the backslash notation required for proper escaping: [source,sql] ---- -SELECT * FROM oc_jobs - WHERE class = 'OC\Log\Rotate'; +SELECT * FROM oc_jobs WHERE class LIKE 'OC\\\\Log\\\\Rotate%'; ---- -If results are returned, run the SQL below to update them, changing the id value as appropriate. +If any results are returned, run the SQL query below to update them, changing the `id` value as necessary. [source,sql] ---- +BEGIN TRANSACTION; + UPDATE oc_jobs SET argument = REPLACE( argument, '\\/var\\/www\\/owncloud\\/data\\/', - '\\/mnt\\/owncloud/data\\/' + '\\/mnt\\/data\\/files\\/' ) WHERE id = ; + +# check with the select statement above +# in case something went wrong +# ROLLBACK; + +# otherwise use +# COMMIT; ---- -CAUTION: The old data path will be written with `\/`. -Therefore you must add one, additional, backslash, like this: `\\/`. +CAUTION: The old data path will be written with `\/`. Therefore you must add one, additional, backslash, like this: `\\/`. -== Fix the config.php Settings +== Scan the Files -To fix the config.php settings: +This command checks all files from all users. Please note that this can take a while. [source,bash,subs="attributes+"] ---- -{occ-command-example-prefix-docker} config:system:set --value /mnt/owncloud/data datadirectory +{occ-command-example-prefix-docker} files:scan --all ---- -=== Adjust config.php - -. Change the `datadirectory` key in your `config.php` to the new path. - To do so, start an editor of your choice and open `/var/www/owncloud/config/config.php` - -. Change the value of the key from `'datadirectory' => '/var/www/owncloud/data',` to `'datadirectory' => '/mnt/owncloud/data',`. - == Disable Maintenance Mode To disable maintenance mode of your instance run the following command: @@ -212,13 +246,6 @@ To disable maintenance mode of your instance run the following command: {occ-command-example-prefix-docker} maintenance:mode --off ---- -== Start the Web Proxy Server - -Follow the web proxies server description for how to enable access to teh ownCloud instance. +== Reenable Browser Access -== Scan the Files - -[source,bash,subs="attributes+"] ----- -{occ-command-example-prefix-docker} files:scan --all ----- +Follow the web proxies server description for how to enable access to the ownCloud instance. diff --git a/modules/admin_manual/pages/maintenance/migrating.adoc b/modules/admin_manual/pages/maintenance/migrate_owncloud/migrating.adoc similarity index 59% rename from modules/admin_manual/pages/maintenance/migrating.adoc rename to modules/admin_manual/pages/maintenance/migrate_owncloud/migrating.adoc index 43e7daa13..567d76f25 100644 --- a/modules/admin_manual/pages/maintenance/migrating.adoc +++ b/modules/admin_manual/pages/maintenance/migrate_owncloud/migrating.adoc @@ -1,4 +1,4 @@ -= Migrating ownCloud += Migrating an Instance :toc: right :description: There are several situations where ownCloud needs to be migrated. @@ -60,13 +60,9 @@ OWNCLOUD_TRUSTED_DOMAINS='server1.example.com','192.168.1.50' == ownCloud Classic Migration -=== Docker to Docker - -If you have previously used a Docker-based installation with ownCloud Classic 10, no data migration is required. - [IMPORTANT] ==== -* The steps shown do not cover any measures that may be necessary when the ownCloud-provided image was customised . +* The steps shown do not cover any measures that may be necessary when the ownCloud-provided image was or needs to be customised . * Any third party app used needs to be PHP 8 compliant. In doubt, disable it and do not re-enable until this prerequisite is met. ==== @@ -75,6 +71,10 @@ If you have previously used a Docker-based installation with ownCloud Classic 10 With a few exceptions, ownCloud 11 provides nearly all configuration keys as environment variables. Therefore, it is highly recommended that any configuration keys are migrated to envvars, if possible. See the xref:configuration/important_notes.adoc[Important Configuration Notes] documentation for more details. ==== +=== Docker to Docker + +If you have previously used a Docker-based installation with ownCloud Classic 10, no data migration is required. + The main migration steps are the following: * Put your instance into maintenance mode. @@ -91,22 +91,55 @@ The updated apps, which are now compliant with PHP 8, are embedded in the image. === Native to Docker -This section describes the migration of *ownCloud Classic 10* to *ownCloud Classic 11*, if ownCloud Classic 10 was installed natively. It only focuses on ownCloud but not on any migration of the database! +This section describes the migration of *ownCloud Classic 10* to *ownCloud Classic 11*, if ownCloud Classic 10 was installed natively. Due to the wide range of installation types, the description focuses on the main steps rather than the details. When using encryption with the ownCloud Classic 10 instance, the openSSL requirements must be met without circumventing retired ciphers. See the ownCloud Classic 10 encryption documentation for more details. -. Enable maintenance mode on ownCloud Classic 10 -. Create a mount point to bind mount the Docker volume. + -For more details see the xref:installation/mount_folder_structure.adoc[Mount Folder Structure] documentation. -. Install ownCloud Classic 11 using a bind mount and down the container. + -This will install/prepare ownCloud Classic 11 in a basic way but it is not configured to your needs. + -For details see: xref:installation/installing_with_docker.adoc[Installing With Docker]. -. Adapt the compose yaml file to your needs. + -Remove any environment variables from the compose file that are no longer relevant, such as those for the database. These settings are now covered by a new configuration file, see below. -. Migrate the `data/files` directory into `mount-point/files`. -. Migrate all apps from ownCloud Classic 10 that are NOT part of ownCloud Classic 11 into the `mount-point/apps` directory. + +[IMPORTANT] +==== +* If you have used the following apps or customised particular settings, you must create your own image based on the provided one. This is because the provided image does not contain the required binaries. + +** The following apps or functionalities are affected: + +xref:enterprise/authentication/kerberos.adoc[Kerberos Authentication], xref:enterprise/external_storage/windows-network-drive_configuration.adoc[Windows Network Drive] and the xref:configuration/files/previews_configuration.adoc[Preview Configuration]. + +* The setup requires a proxy server that points to the Apache server embedded in the image. This proxy server handles all certificates and terminates the user access. This setup step is *NOT* covered here. +==== + +NOTE: This procedure assumes that the server hosting the native deployment of ownCloud Classic 10 is different from the server hosting ownCloud Classic 11. This is because the _old_ server required a native PHP 7 environment. + +. Prepare the server hosting ownCloud Classic 11. +.. Plan your deployment with regards to the database and the cache that will be used. +.. For details see the xref:installation/installing_with_docker.adoc[Installing with Docker] documentation. +.. For more details see the xref:installation/mount_folder_structure.adoc[Mount Folder Structure] documentation. +.. Please note that starting the container with the default compose configuration will create an empty instance with a new database. This can be beneficial to see if the deployment works but needs to be adapted for the final setup. The generated data must be destroyed! + +. Enable maintenance mode on ownCloud Classic 10. + +. Disable any app that is enabled in ownCloud Classic 10. + +The old ownCloud apps were written in PHP 7. + +The updated ownCloud apps, which are now compliant with PHP 8, are embedded in the image. + +. On the new server, create mount points to bind mount the required Docker volumes. + +. Migrate the data directory. + +More details can be found in the xref:maintenance/migrate_owncloud/migrate-datadirectory.adoc[Migrate the Datadirectory] documentation. + +. Adapt the `docker-compose.yml` and the `.env` file to your needs. ++ +[IMPORTANT] +==== +* Migrate any configurations formerly added to config.php to an environment variable. +* Avoid redefining the `data` or `apps` directory based on your old config. Use the default settings the image provides. +* If any config setting has no environment variable, read the xref:configuration/important_notes.adoc[Important Configuration Notes] documentation for more details. +==== + +. Migrate all apps from ownCloud Classic 10 that are *NOT* part of ownCloud Classic 11 and PHP 8 compliant into the `/apps` directory. + For more details see the xref:installation/apps_management_installation.adoc[Apps Management] documentation. -. Make a copy of your existing `config.php` file *with a new name* and remove any setting that addresses the `data` directory and `apps` / `apps-external` directories into the `mount-point/config` directory. + -See the important note with regards to the config in the xref:installation/mount_folder_structure.adoc[Mount Folder Structure] documentation. + . Bring up the ownCloud Classic 11 container. + +. Re-enable any available apps that were previously disabled. + . Disable maintenance mode. + +. Enable user access via the proxy web server. diff --git a/modules/admin_manual/partials/nav.adoc b/modules/admin_manual/partials/nav.adoc index 37ba2ea6d..4da43a60d 100644 --- a/modules/admin_manual/partials/nav.adoc +++ b/modules/admin_manual/partials/nav.adoc @@ -118,10 +118,11 @@ **** xref:admin_manual:maintenance/backup_and_restore/restore.adoc[Restore] *** xref:admin_manual:maintenance/enable_maintenance.adoc[Maintenance Mode] *** xref:admin_manual:maintenance/export_import_instance_data.adoc[Export and Import Instance Data] -*** xref:admin_manual:maintenance/migrate-data-folder.adoc[Migrate the Data Folder] *** Encryption **** xref:admin_manual:maintenance/encryption/migrating-from-user-key-to-master-key.adoc[Migrating from User Key to Master Key Encryption] -*** xref:admin_manual:maintenance/migrating.adoc[Migrating ownCloud] +*** Migrating ownCloud +**** xref:admin_manual:maintenance/migrate_owncloud/migrating.adoc[Migrating an Instance] +**** xref:admin_manual:maintenance/migrate_owncloud/migrate-datadirectory.adoc[Migrate the Datadirectory] *** xref:admin_manual:maintenance/migrating_to_kiteworks.adoc[Migrating to Kiteworks PDN] *** xref:admin_manual:maintenance/migrating_to_ocis.adoc[Migrating to ownCloud Infinite Scale] From a1329c0b33ae42084818eb7f99fbe60606422010 Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Tue, 7 Jul 2026 15:19:51 +0200 Subject: [PATCH 12/32] remove orphaned backticks in SQL --- .../maintenance/migrate_owncloud/migrate-datadirectory.adoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/admin_manual/pages/maintenance/migrate_owncloud/migrate-datadirectory.adoc b/modules/admin_manual/pages/maintenance/migrate_owncloud/migrate-datadirectory.adoc index 3d77aa7ad..e796aa4af 100644 --- a/modules/admin_manual/pages/maintenance/migrate_owncloud/migrate-datadirectory.adoc +++ b/modules/admin_manual/pages/maintenance/migrate_owncloud/migrate-datadirectory.adoc @@ -152,7 +152,7 @@ UPDATE oc_storages '/var/www/owncloud/data', '/mnt/data/files' ) - WHERE id LIKE 'local::%'`; + WHERE id LIKE 'local::%'; # check with the select statement above # in case something went wrong @@ -185,7 +185,7 @@ UPDATE oc_accounts '/var/www/owncloud/data', '/mnt/data/files' ) - WHERE home LIKE '/var/www/owncloud/data%'`; + WHERE home LIKE '/var/www/owncloud/data%'; # check with the select statement above # in case something went wrong From 556b6d72156ffb4db9349895772570dd3a1de302 Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Tue, 7 Jul 2026 15:22:04 +0200 Subject: [PATCH 13/32] fix double slash in nav.adoc --- modules/admin_manual/partials/nav.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/admin_manual/partials/nav.adoc b/modules/admin_manual/partials/nav.adoc index 4da43a60d..86c025994 100644 --- a/modules/admin_manual/partials/nav.adoc +++ b/modules/admin_manual/partials/nav.adoc @@ -17,7 +17,7 @@ *** xref:admin_manual:installation/mount_folder_structure.adoc[Mount Folder Structure] *** Apps **** xref:admin_manual:installation/apps/apps_management_installation.adoc[Apps Management] -**** xref:admin_manual:installation//apps/apps_supported.adoc[Supported Apps] +**** xref:admin_manual:installation/apps/apps_supported.adoc[Supported Apps] ** Configuration From e526f3ad174c44f288ad3fc3abb2ce7626d5f326 Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Tue, 7 Jul 2026 15:24:04 +0200 Subject: [PATCH 14/32] fix missing backtick in admin_audit.adoc --- modules/admin_manual/pages/enterprise/logging/admin_audit.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc b/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc index 6227f0bae..790c01e79 100644 --- a/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc +++ b/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc @@ -1572,7 +1572,7 @@ All comment events have the same data: | integer | Always `1` -| `owner +| `owner` | string | The SMB owner From f5d310d4ad60c4e520dbd2f2c5317615ca32a22c Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Tue, 7 Jul 2026 15:30:51 +0200 Subject: [PATCH 15/32] fix license key links --- .../admin_manual/pages/configuration/envvars/envvars.adoc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/admin_manual/pages/configuration/envvars/envvars.adoc b/modules/admin_manual/pages/configuration/envvars/envvars.adoc index 6a646b607..87fbb0d47 100644 --- a/modules/admin_manual/pages/configuration/envvars/envvars.adoc +++ b/modules/admin_manual/pages/configuration/envvars/envvars.adoc @@ -137,9 +137,9 @@ - `OWNCLOUD_FILES_EXTERNAL_ALLOW_NEW_LOCAL=$\{OWNCLOUD_ALLOW_EXTERNAL_LOCAL_STORAGE}` + Enable or disable the files_external local mount option (see xref:configuration/server/config_sample_php_parameters.adoc#enable-or-disable-the-files_external-local-mount-option[documentation]). - `OWNCLOUD_GRACE_PERIOD_DEMO_KEY_LINK=` + - Override the link shown in the grace period popup (see xref:enterprise/installation/install.adoc#license-keys[documentation]). + Override the link shown in the grace period popup (see xref:installation/installing_with_docker.adoc#enterprise-license-keys[documentation]). - `OWNCLOUD_GRACE_PERIOD_DEMO_KEY_SHOW_POPUP=` + - Show or hide the grace period demo key popup (see xref:enterprise/installation/install.adoc#license-keys[documentation]). + Show or hide the grace period demo key popup (see xref:installation/installing_with_docker.adoc#enterprise-license-keys[documentation]). - `OWNCLOUD_FORWARDED_FOR_HEADERS=` + Define forwarded_for_headers (see xref:configuration/server/config_sample_php_parameters.adoc#define-forwarded_for_headers[documentation]). - `OWNCLOUD_GROUPS_ENABLE_MEDIAL_SEARCH=` + @@ -163,7 +163,7 @@ - `OWNCLOUD_LDAP_IGNORE_NAMING_RULES=` + Ignore LDAP naming rules (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-ldap[documentation]). - `OWNCLOUD_LICENSE_KEY=` + - ownCloud Enterprise License Key (see xref:enterprise/installation/install.adoc#license-keys[documentation]). + ownCloud Enterprise License Key (see xref:installation/installing_with_docker.adoc#enterprise-license-keys[documentation]). - `OWNCLOUD_LICENSE_CLASS=` - `OWNCLOUD_LOGIN_ALTERNATIVES=` + Define additional login buttons on the logon screen (see xref:configuration/server/config_sample_php_parameters.adoc#define-additional-login-buttons-on-the-logon-screen[documentation]). From 3f429dad1c6453fed5d1c54016d5eab9e33107a4 Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Tue, 7 Jul 2026 15:41:25 +0200 Subject: [PATCH 16/32] fix xref segment in general troubleshooting --- .../pages/troubleshooting/general_troubleshooting.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/admin_manual/pages/troubleshooting/general_troubleshooting.adoc b/modules/admin_manual/pages/troubleshooting/general_troubleshooting.adoc index 9d335a4d9..e14f4d172 100644 --- a/modules/admin_manual/pages/troubleshooting/general_troubleshooting.adoc +++ b/modules/admin_manual/pages/troubleshooting/general_troubleshooting.adoc @@ -128,7 +128,7 @@ docker compose logs owncloud -f In a standard ownCloud installation the log level is set to `Normal`. -* To find any issues you need to raise the log level to `All` in your _additional_ xref:installation/configuration_notes.adoc#using-a-configuration-file[configuration file], or to *Everything* on your ownCloud Admin page. Please see xref:configuration/server/logging/logging_configuration.adoc[Logging Configuration] for more information on these log levels. +* To find any issues you need to raise the log level to `All` or to `Everything` via the `OWNCLOUD_LOG_LEVEL` environment variable or via your ownCloud Admin page. Please see xref:configuration/server/logging/logging_configuration.adoc[Logging Configuration] for more information on these log levels. * Some logging - for example JavaScript console logging - needs debugging enabled. + Edit the config and change `'debug' => false,` to `'debug' => true,` Be sure to change it back when you are finished. From 028bef7faf940748217355ff44da2537d3993daa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <1005065+DeepDiver1975@users.noreply.github.com> Date: Wed, 8 Jul 2026 00:07:16 +0200 Subject: [PATCH 17/32] fix: correct malformed env var entries in envvars.adoc MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - OWNCLOUD_PROTOCOL: restore the variable name (was replaced by escape junk) - OWNCLOUD_OVERWRITE_CLI_URL: remove the doubled brace in the default value and use consistent escaping - OWNCLOUD_CRON_LOG: add the missing xref link label and fix the doubled paren - OWNCLOUD_SAVE_VERSION_METADATA and OWNCLOUD_REDIS_TLS_*: replace Markdown link syntax with AsciiDoc link macros Co-Authored-By: Claude Opus 4.8 Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com> --- .../pages/configuration/envvars/envvars.adoc | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/modules/admin_manual/pages/configuration/envvars/envvars.adoc b/modules/admin_manual/pages/configuration/envvars/envvars.adoc index 87fbb0d47..8deac7c9a 100644 --- a/modules/admin_manual/pages/configuration/envvars/envvars.adoc +++ b/modules/admin_manual/pages/configuration/envvars/envvars.adoc @@ -63,7 +63,7 @@ - `OWNCLOUD_CROND_SCHEDULE="*/1 * * * *"` + Cron schedule to run ownCloud background jobs. - `OWNCLOUD_CRON_LOG=` + - Define logging if cron ran successfully(see xref:configuration/server/config_sample_php_parameters.adoc#define-logging-if-cron-ran-successfully)) + Define logging if cron ran successfully (see xref:configuration/server/config_sample_php_parameters.adoc#define-logging-if-cron-ran-successfully[documentation]). - `OWNCLOUD_CSRF_DISABLED=` + Enable or disable ownCloud’s built-in CSRF protection mechanism (see xref:configuration/server/config_sample_php_parameters.adoc#enable-or-disable-ownclouds-built-in-csrf-protection-mechanism[documentation]). - `OWNCLOUD_CUSTOMCLIENT_ANDROID=` + @@ -274,7 +274,7 @@ Path to a custom `openssl.cnf` file, e.g. when using a custom PKI or CA in the container (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-default-cipher-for-encrypting-files[documentation]). - `OWNCLOUD_OPERATION_MODE=` + Define ownCloud operation modes (see xref:configuration/server/config_sample_php_parameters.adoc#define-owncloud-operation-modes[documentation]). -- `OWNCLOUD_OVERWRITE_CLI_URL=\${\{OWNCLOUD_PROTOCOL}://\$\{OWNCLOUD_DOMAIN}$\{OWNCLOUD_SUB_URL}` + +- `OWNCLOUD_OVERWRITE_CLI_URL=$\{OWNCLOUD_PROTOCOL}://$\{OWNCLOUD_DOMAIN}$\{OWNCLOUD_SUB_URL}` + Override cli URL (see xref:configuration/server/config_sample_php_parameters.adoc#override-cli-url[documentation]). - `OWNCLOUD_OVERWRITE_COND_ADDR=` + Override condition for the remote IP address with a regular expression (see xref:configuration/server/config_sample_php_parameters.adoc#override-condition-for-the-remote-ip-address-with-a-regular-expression[documentation]). @@ -318,7 +318,7 @@ Path to custom scripts that need to be executed before an ownCoud installation command. - `OWNCLOUD_PRE_SERVER_PATH=/etc/pre_server.d` + Path to custom scripts that need to be executed before an ownCloud server startup. -- `\{OWNCLOUD_PROTOCOL=http` + +- `OWNCLOUD_PROTOCOL=http` + Protocol used in `OWNCLOUD_OVERWRITE_CLI_URL` by default. - `OWNCLOUD_PROXY_IGNORE=` + Comma-separated list of hostnames that bypass the proxy (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-url-of-your-proxy-server[documentation]). @@ -355,29 +355,29 @@ - `OWNCLOUD_REDIS_TIMEOUT=` + Sets the redis timeout value (see xref:configuration/server/config_sample_php_parameters.adoc#define-redis-cluster-connection-details[documentation]). - `OWNCLOUD_REDIS_TLS_ALLOW_SELF_SIGNED=` + - Allow self-signed certificates on the Redis server (`true`/`false`) (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). + Allow self-signed certificates on the Redis server (`true`/`false`) (see the https://github.com/phpredis/phpredis[phpredis docs]). - `OWNCLOUD_REDIS_TLS_CAFILE=` + - Path to CA certificate file for TLS-secured Redis connections (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). + Path to CA certificate file for TLS-secured Redis connections (see the https://github.com/phpredis/phpredis[phpredis docs]). - `OWNCLOUD_REDIS_TLS_CAPATH=` + - Directory containing CA certificates for TLS-secured Redis connections (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). + Directory containing CA certificates for TLS-secured Redis connections (see the https://github.com/phpredis/phpredis[phpredis docs]). - `OWNCLOUD_REDIS_TLS_CIPHERS=` + - OpenSSL cipher list for Redis TLS connections (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). + OpenSSL cipher list for Redis TLS connections (see the https://github.com/phpredis/phpredis[phpredis docs]). - `OWNCLOUD_REDIS_TLS_LOCAL_CERT=` + - Path to client certificate file for mutual TLS to Redis (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). + Path to client certificate file for mutual TLS to Redis (see the https://github.com/phpredis/phpredis[phpredis docs]). - `OWNCLOUD_REDIS_TLS_LOCAL_PK=` + - Path to client private key file for mutual TLS to Redis (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). + Path to client private key file for mutual TLS to Redis (see the https://github.com/phpredis/phpredis[phpredis docs]). - `OWNCLOUD_REDIS_TLS_PASSPHRASE=` + - Passphrase for an encrypted Redis client private key (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). + Passphrase for an encrypted Redis client private key (see the https://github.com/phpredis/phpredis[phpredis docs]). - `OWNCLOUD_REDIS_TLS_PEER_NAME=` + - Expected hostname in the Redis server certificate, overrides the connection host for SNI (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). + Expected hostname in the Redis server certificate, overrides the connection host for SNI (see the https://github.com/phpredis/phpredis[phpredis docs]). - `OWNCLOUD_REDIS_TLS_VERIFY_PEER=` + - Validate the Redis server certificate against the CA (`true`/`false`) (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). + Validate the Redis server certificate against the CA (`true`/`false`) (see the https://github.com/phpredis/phpredis[phpredis docs]). - `OWNCLOUD_REDIS_TLS_VERIFY_PEER_NAME=` + - Validate that the Redis server certificate CN/SAN matches the peer name (`true`/`false`) (see [phpredis docs](https://github.com/phpredis/phpredis[documentation]). + Validate that the Redis server certificate CN/SAN matches the peer name (`true`/`false`) (see the https://github.com/phpredis/phpredis[phpredis docs]). - `OWNCLOUD_REMEMBER_LOGIN_COOKIE_LIFETIME=` + Define the lifetime of the remember-login cookie (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-lifetime-of-the-remember-login-cookie[documentation]). - `OWNCLOUD_SAVE_VERSION_METADATA=` + - Enabled extened version metadata (see [description](https://doc.owncloud.com/server/latest/admin_manual/configuration/files/file_versioning.adoc#extended-version-metadata) and [documentation](https://doc.owncloud.com/server/next/admin_manual/configuration/server/config_sample_php_parameters.adoc#save-additional-metadata-for-versions[documentation]). + Enable extended version metadata (see https://doc.owncloud.com/server/latest/admin_manual/configuration/files/file_versioning.adoc#extended-version-metadata[description] and https://doc.owncloud.com/server/next/admin_manual/configuration/server/config_sample_php_parameters.adoc#save-additional-metadata-for-versions[documentation]). - `OWNCLOUD_SECRET=` + Define ownClouds internal secret (see xref:configuration/server/config_sample_php_parameters.adoc#define-ownclouds-internal-secret[documentation]). - `OWNCLOUD_SESSION_KEEPALIVE=` + From f5d811207ceac4a495bce7c1c5140586c386e77d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <1005065+DeepDiver1975@users.noreply.github.com> Date: Wed, 8 Jul 2026 00:08:01 +0200 Subject: [PATCH 18/32] fix: correct audit log example in admin_audit.adoc MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - OWNCLOUD_LOG_CONDITIONS: target the admin_audit app instead of files_external, and use valid JSON (double-quoted logfile value) - fix `tue` -> `true` typo in the public_link_accessed table Co-Authored-By: Claude Opus 4.8 Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com> --- .../admin_manual/pages/enterprise/logging/admin_audit.adoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc b/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc index 790c01e79..9a79d0f16 100644 --- a/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc +++ b/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc @@ -36,7 +36,7 @@ It is recommended that messages are redirected to a separate file. To do so, add [source,.env] ---- -OWNCLOUD_LOG_CONDITIONS=[{"apps":["files_external"],"loglevel":0,"logfile":'/mnt/data/files/admin_audit.log'}] +OWNCLOUD_LOG_CONDITIONS=[{"apps":["admin_audit"],"loglevel":0,"logfile":"/mnt/data/files/admin_audit.log"}] ---- NOTE: All messages regardless of log level will be logged there. @@ -877,7 +877,7 @@ Sharing events come with a default set of fields | `success` | boolean -| If the request was successful `tue` or `false` +| If the request was successful `true` or `false` |=== ===== public_link_removed From 7b126d4ede0c5079ec6064aa788f2aedb6843648 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <1005065+DeepDiver1975@users.noreply.github.com> Date: Wed, 8 Jul 2026 00:09:57 +0200 Subject: [PATCH 19/32] fix: table render, page alias and WND account name MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - metrics.adoc: close the cols quote so the two-column table renders - clustered_shared_storage.adoc: fix "clsutered" page-alias typo so the pre-move URL redirects - windows-network-drive_configuration.adoc: restore the valid "nt authority\system" account name Co-Authored-By: Claude Opus 4.8 Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com> --- .../external_storage/windows-network-drive_configuration.adoc | 2 +- modules/admin_manual/pages/enterprise/reporting/metrics.adoc | 2 +- .../deployment_recommendations/clustered_shared_storage.adoc | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/admin_manual/pages/enterprise/external_storage/windows-network-drive_configuration.adoc b/modules/admin_manual/pages/enterprise/external_storage/windows-network-drive_configuration.adoc index 01c0e37d2..e83219460 100644 --- a/modules/admin_manual/pages/enterprise/external_storage/windows-network-drive_configuration.adoc +++ b/modules/admin_manual/pages/enterprise/external_storage/windows-network-drive_configuration.adoc @@ -281,7 +281,7 @@ IMPORTANT: The ownCloud LDAP Integration app must configure the `sAMAccountName` [TIP] ==== -Some groups, such as `everyone` might not be handled properly. This is because such groups don't exist in the LDAP server, or might not be found if the domain is different, such as `authority\system` or `builtin\domain-users`. +Some groups, such as `everyone` might not be handled properly. This is because such groups don't exist in the LDAP server, or might not be found if the domain is different, such as `nt authority\system` or `builtin\domain-users`. ==== The value to select for this provider is: `ocLdapPermissionManager`. diff --git a/modules/admin_manual/pages/enterprise/reporting/metrics.adoc b/modules/admin_manual/pages/enterprise/reporting/metrics.adoc index c443ee905..4b0dbe3de 100644 --- a/modules/admin_manual/pages/enterprise/reporting/metrics.adoc +++ b/modules/admin_manual/pages/enterprise/reporting/metrics.adoc @@ -21,7 +21,7 @@ TIP: If you're operating very large instances with regard to users, files or sha The following screenshots give you an impression of the Metrics app. -[width=100%,cols="50%,50%,options="header"] +[width=100%,cols="50%,50%",options="header"] |=== ^| *Metrics System Overview* ^| *Metrics User Overview* diff --git a/modules/admin_manual/pages/installation/deployment/deployment_recommendations/clustered_shared_storage.adoc b/modules/admin_manual/pages/installation/deployment/deployment_recommendations/clustered_shared_storage.adoc index f112d4be7..069d8bcea 100644 --- a/modules/admin_manual/pages/installation/deployment/deployment_recommendations/clustered_shared_storage.adoc +++ b/modules/admin_manual/pages/installation/deployment/deployment_recommendations/clustered_shared_storage.adoc @@ -2,7 +2,7 @@ :toc: right :toclevels: 2 :keywords: cluster, shared storage, nfs, kubernetes, swarm, scale-out, redis, locking, chown -:page-aliases: installation/deployment_recommendations/clsutered_shared_storage.adoc +:page-aliases: installation/deployment_recommendations/clustered_shared_storage.adoc :description: How to run the ownCloud Docker image across multiple application nodes that share a common file storage (for example NFS), and the pitfalls to avoid. :k8s-fsgroup-url: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ From a5c99c5f58a68339efb0d1a9e25ad5e151929a12 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <1005065+DeepDiver1975@users.noreply.github.com> Date: Wed, 8 Jul 2026 00:10:23 +0200 Subject: [PATCH 20/32] fix: WOPI source language tag and typo MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - msoffice-wopi-integration.adoc: the env-var block was still tagged as php; switch to .env (keeping subs for the {oc-support-url} attribute) - enterprise_only_auth.adoc: fix "teh" -> "the" typo Co-Authored-By: Claude Opus 4.8 Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com> --- .../pages/enterprise/authentication/enterprise_only_auth.adoc | 2 +- .../enterprise/collaboration/msoffice-wopi-integration.adoc | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/admin_manual/pages/enterprise/authentication/enterprise_only_auth.adoc b/modules/admin_manual/pages/enterprise/authentication/enterprise_only_auth.adoc index c24febf77..3a38b188e 100644 --- a/modules/admin_manual/pages/enterprise/authentication/enterprise_only_auth.adoc +++ b/modules/admin_manual/pages/enterprise/authentication/enterprise_only_auth.adoc @@ -174,7 +174,7 @@ In general, when using this authentication method, the user and the password use For example, ownCloud user "Alice" with password "mysecret" (or even without password) will use "Alice" as username and the password from the config.php file to access the storage. Note that for LDAP, the `user id` is usually like _1223-cbdf-cacc-1234...,_ unless the configuration in the user_ldap app is changed. * The password will be fetched from a key inside the configuration file. + -For details see the section below. Even if the account doesn't have a password like OAuth or OpenIDConnect, etc., the connection with the storage will use the password from teh configuration file. +For details see the section below. Even if the account doesn't have a password like OAuth or OpenIDConnect, etc., the connection with the storage will use the password from the configuration file. + NOTE: The password will be the same for any user accessing the particular mount! diff --git a/modules/admin_manual/pages/enterprise/collaboration/msoffice-wopi-integration.adoc b/modules/admin_manual/pages/enterprise/collaboration/msoffice-wopi-integration.adoc index 4473dde85..60b034861 100644 --- a/modules/admin_manual/pages/enterprise/collaboration/msoffice-wopi-integration.adoc +++ b/modules/admin_manual/pages/enterprise/collaboration/msoffice-wopi-integration.adoc @@ -52,7 +52,7 @@ All involved servers (Office Online Server and the ownCloud server) need to be a To configure the WOPI app in your ownCloud installation, add the following environment variables, adjusting them as necessary based on the details of your setup: -[source,php,subs="post_replacements,attributes+"] +[source,.env,subs="post_replacements,attributes+"] ---- # ownCloud Support URL: {oc-support-url} From 80bab9db8e5f8c1f1fd6a13fa44dde1a56adb9a7 Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Wed, 8 Jul 2026 08:56:38 +0200 Subject: [PATCH 21/32] fix anchor in envvars.adoc --- .../admin_manual/pages/configuration/envvars/envvars.adoc | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/admin_manual/pages/configuration/envvars/envvars.adoc b/modules/admin_manual/pages/configuration/envvars/envvars.adoc index 8deac7c9a..4099a81e2 100644 --- a/modules/admin_manual/pages/configuration/envvars/envvars.adoc +++ b/modules/admin_manual/pages/configuration/envvars/envvars.adoc @@ -232,15 +232,15 @@ - `OWNCLOUD_METRICS_SHARED_SECRET=` + Secret required to access the Metrics dashboard (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-metrics[documentation]). - `OWNCLOUD_MAX_EXECUTION_TIME=3600` + - Sets PHP option `max_execution_time`. It is recommended to keep the default (see xref:configuration/files/big_file_upload_configuration.adoc#configuring-via-php-global-settings[documentation]). + Sets PHP option `max_execution_time`. It is recommended to keep the default (see xref:configuration/files/big_file_upload_configuration.adoc[documentation]). - `OWNCLOUD_MAX_FILESIZE_ANIMATED_GIFS_PUBLIC_SHARING=` + Define the maximum filesize for animated GIF´s (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-maximum-filesize-for-animated-gifs[documentation]). - `OWNCLOUD_MAX_INPUT_TIME=3600` + - Sets PHP option `max_input_time`. It is recommended to keep the default (see xref:configuration/files/big_file_upload_configuration.adoc#configuring-via-php-global-settings[documentation]). + Sets PHP option `max_input_time`. It is recommended to keep the default (see xref:configuration/files/big_file_upload_configuration.adoc[documentation]). - `OWNCLOUD_MAX_UPLOAD=20G` + - Sets PHP option `upload_max_filesize` and `post_max_size`. It is recommended to keep the default (see xref:configuration/files/big_file_upload_configuration.adoc#configuring-via-php-global-settings[documentation]). + Sets PHP option `upload_max_filesize` and `post_max_size`. It is recommended to keep the default (see xref:configuration/files/big_file_upload_configuration.adoc[documentation]). - `OWNCLOUD_MEMORY_LIMIT=512M` + - Sets PHP option `memory_limit`. It is recommended to keep the default (see xref:configuration/files/big_file_upload_configuration.adoc#configuring-via-php-global-settings[documentation]). + Sets PHP option `memory_limit`. It is recommended to keep the default (see xref:configuration/files/big_file_upload_configuration.adoc[documentation]). - `OWNCLOUD_MINIMUM_SUPPORTED_DESKTOP_VERSION=` + Define the minimum supported ownCloud desktop client version (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-minimum-supported-owncloud-desktop-client-version[documentation]). - `OWNCLOUD_MOUNT_FILE=` From 781cfc38714bd46d438f788e436ea25214018b35 Mon Sep 17 00:00:00 2001 From: Martin Date: Wed, 8 Jul 2026 09:11:57 +0200 Subject: [PATCH 22/32] Apply suggestions from code review Co-authored-by: Phil Davis --- .../pages/configuration/envvars/envvars.adoc | 16 ++++++++-------- .../collaboration/collabora_secure_view.adoc | 2 +- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/modules/admin_manual/pages/configuration/envvars/envvars.adoc b/modules/admin_manual/pages/configuration/envvars/envvars.adoc index 4099a81e2..b4bb1c688 100644 --- a/modules/admin_manual/pages/configuration/envvars/envvars.adoc +++ b/modules/admin_manual/pages/configuration/envvars/envvars.adoc @@ -35,11 +35,11 @@ - `OWNCLOUD_APPS_INSTALL=` + List of apps to install on container startup. - `OWNCLOUD_APPS_INSTALL_MAJOR=false` + - By default ownCloud will not install a new major version of an already installed app. To enforce major updates for apps this option need to be set to `true`. + By default ownCloud will not install a new major version of an already installed app. To enforce major updates for apps this option needs to be set to `true`. - `OWNCLOUD_APPS_UNINSTALL=` + List of apps to remove on container startup. - `OWNCLOUD_BACKGROUND_MODE=cron` + - Service to execute ownCloud backgrouns jobs. It is recommended to keep the default (see xref:configuration/server/background_jobs_configuration.adoc[documentation]). + Service to execute ownCloud background jobs. It is recommended to keep the default (see xref:configuration/server/background_jobs_configuration.adoc[documentation]). - `OWNCLOUD_BLACKLISTED_FILES=` + Define blacklisted files (see xref:configuration/server/config_sample_php_parameters.adoc#define-blacklisted-files[documentation]). - `OWNCLOUD_BLACKLISTED_FILES_REGEX=` + @@ -79,7 +79,7 @@ - `OWNCLOUD_DAV_PROPFIND_DEPTH_INFINITY=` + Allow Depth: infinity PROPFIND requests (see xref:configuration/server/config_sample_php_parameters.adoc#enable-or-disable-async-dav-extensions[documentation]). - `OWNCLOUD_DB_FAIL=true` + - Exit container if the database can't reached during the startup. + Exit container if the database can't be reached during the startup. - `OWNCLOUD_DB_HOST=` + Define the database server host name (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-database-server-host-name[documentation]). - `OWNCLOUD_DB_NAME=owncloud` + @@ -216,7 +216,7 @@ - `OWNCLOUD_MARKETPLACE_KEY=$\{OWNCLOUD_MARKETPLACE_APIKEY}` + Developer option to get access to unreleased Apps in your Marketplace account. - `OWNCLOUD_MEMCACHED_ENABLED=false` + - Enabled memory caching via memcached (see xref:configuration/server/config_sample_php_parameters.adoc#memory-caching-backend-for-distributed-data[documentation]). + Enable memory caching via memcached (see xref:configuration/server/config_sample_php_parameters.adoc#memory-caching-backend-for-distributed-data[documentation]). - `OWNCLOUD_MEMCACHED_HOST=memcached` + Defines the hosts for memcached (see xref:configuration/server/config_sample_php_parameters.adoc#define-server-details-for-memcached-servers-to-use-for-memory-caching[documentation]). - `OWNCLOUD_MEMCACHED_OPTIONS=` + @@ -251,13 +251,13 @@ - `OWNCLOUD_OBJECTSTORE_CLASS=OCA\Files_Primary_S3\S3Storage` + Class to use for the objectstore. It is recommended to keep the default (see xref:configuration/files/external_storage/s3_compatible_object_storage_as_primary.adoc[documentation]). - `OWNCLOUD_OBJECTSTORE_ENABLED=false` + - Enabled or disables the objectstore configuration. + Enables or disables the objectstore configuration. - `OWNCLOUD_OBJECTSTORE_ENDPOINT=https://s3.$\{OWNCLOUD_OBJECTSTORE_REGION}.amazonaws.com` + Endpoint of the objectstore provider (see xref:configuration/files/external_storage/s3_compatible_object_storage_as_primary.adoc[documentation]). - `OWNCLOUD_OBJECTSTORE_KEY=` + Access key for the objectstore (see xref:configuration/files/external_storage/s3_compatible_object_storage_as_primary.adoc[documentation]). - `OWNCLOUD_OBJECTSTORE_PATHSTYLE=false` + - Enabled or disables path style for the objectstore (see xref:configuration/files/external_storage/s3_compatible_object_storage_as_primary.adoc[documentation]). + Enables or disables path style for the objectstore (see xref:configuration/files/external_storage/s3_compatible_object_storage_as_primary.adoc[documentation]). - `OWNCLOUD_OBJECTSTORE_REGION=us-east-1` + Objectstore region to use (see xref:configuration/files/external_storage/s3_compatible_object_storage_as_primary.adoc[documentation]). - `OWNCLOUD_OBJECTSTORE_SECRET=` + @@ -329,7 +329,7 @@ - `OWNCLOUD_QUOTA_INCLUDE_EXTERNAL_STORAGE=` + Define whether to include external storage in quota calculation (see xref:configuration/server/config_sample_php_parameters.adoc#define-whether-to-include-external-storage-in-quota-calculation[documentation]). - `OWNCLOUD_REDIS_DB=` + - Define Redis connection details sets the dbindex (see xref:configuration/server/config_sample_php_parameters.adoc#define-redis-connection-details[documentation]). + Define Redis connection details. Sets the dbindex (see xref:configuration/server/config_sample_php_parameters.adoc#define-redis-connection-details[documentation]). - `OWNCLOUD_REDIS_ENABLED=false` + Sets memcache to Redis (see xref:configuration/server/config_sample_php_parameters.adoc#memory-caching-backend-for-distributed-data[documentation]). If sessions need to be stored in redis as well, you must also set `OWNCLOUD_SESSION_SAVE_HANDLER=redis`. - `OWNCLOUD_REDIS_FAILOVER_MODE=` + @@ -509,5 +509,5 @@ - `OWNCLOUD_PHP_DISABLE_FUNCTIONS=pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,system,phpinfo,show_source,fopen_with_path,dbmopen,dbase_open,filepro_retrieve,posix_mkfifo` + Some insecure PHP functions are disabled by default, and this option should not be changed for production setup. Use it with caution. - `OWNCLOUD_IOC_SCANNER_CONFIRMATION=` + - To suppress Indicators of Compromise (IoC) messages the environment variable need to be set to `EXECUTED_ON_ALL_NODES`. This feature requires a valid `OWNCLOUD_LICENSE_KEY`. + To suppress Indicators of Compromise (IoC) messages the environment variable needs to be set to `EXECUTED_ON_ALL_NODES`. This feature requires a valid `OWNCLOUD_LICENSE_KEY`. diff --git a/modules/admin_manual/pages/enterprise/collaboration/collabora_secure_view.adoc b/modules/admin_manual/pages/enterprise/collaboration/collabora_secure_view.adoc index 9a4fefdd1..10b672c26 100644 --- a/modules/admin_manual/pages/enterprise/collaboration/collabora_secure_view.adoc +++ b/modules/admin_manual/pages/enterprise/collaboration/collabora_secure_view.adoc @@ -8,7 +8,7 @@ Secure View is under review. The required marketplace app is not in ownClouds responsibility but a necessity for the functionality. If the functionality is dropped, a new OC image is provided no longer showing the sec view capabilities. -Note that in this case, we ned to also remove entries in config.apps.samle (richdocuments) and do a config-to-docs run. +Note that in this case, we need to also remove entries in config.apps.sample (richdocuments) and do a config-to-docs run. Then we can remove the page, all of the images related and all occ commands that manage sec view (richdocuments). If the functionality is kept, the app needs to be OC11 ready and either provided in the image or downloadable. From 28b33b55c1a2d1e9c347f6c8a056161b84180dd8 Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Wed, 8 Jul 2026 10:42:59 +0200 Subject: [PATCH 23/32] remove docs for firewall.branded_clients config --- .../enterprise/firewall/file_firewall.adoc | 50 ------------------- 1 file changed, 50 deletions(-) diff --git a/modules/admin_manual/pages/enterprise/firewall/file_firewall.adoc b/modules/admin_manual/pages/enterprise/firewall/file_firewall.adoc index 9ad4ecf33..d30f16ba2 100644 --- a/modules/admin_manual/pages/enterprise/firewall/file_firewall.adoc +++ b/modules/admin_manual/pages/enterprise/firewall/file_firewall.adoc @@ -150,53 +150,3 @@ The firewall logs blocked requests to the system log at **warning** level. To se The firewall logs blocked and successful requests to the system log at **warning** and **info** levels respectively. To see all these logs, the system log level must be set to a minimum level of **info**. NOTE: Logging all requests can generate a large amount of log data. It is recommended to only select all requests for short-term checking of rule settings. - -=== Custom Configuration for Branded Clients - -If you are using branded ownCloud clients, you may define `firewall.branded_clients` in your `config.php` to identify your branded clients in the firewall *"User Device"* rule. - -The configuration is a `User-Agent` => `Device` map. `Device` must be one of the following: - -* android -* android_branded -* ios -* ios_branded -* desktop -* desktop_branded - -The `User-Agent` is always compared all lowercase. By default the agent is compared with `equals`. When a trailing or leading asterisk, `*`, is found, the agent is compared with `starts with` or `ends with`. If the agent has both a leading and a trailing `*`, the string must appear anywhere. For technical reasons the `User-Agent` string must be at least 4 characters, including wildcards. When you build your branded client you have the option to create a custom User Agent. - -In this example configuration you need to replace the example User Agent strings, for example `'android_branded'`, with your own User Agent strings: - -[source,php] ----- -// config.php - -'firewall.branded_clients' => array( - 'my ownbrander android user agent string' => 'android_branded', - 'my ownbrander second android user agent string' => 'android_branded', - 'my ownbrander ios user agent string' => 'ios_branded', - 'my ownbrander second ios user agent string' => 'ios_branded', - 'my ownbrander desktop user agent string' => 'desktop_branded', - 'my ownbrander second desktop user agent string' => 'desktop_branded', -), ----- - -The Web UI dropdown then expands to the following options: - -* Android Client - always visible -* iOS Client - always visible -* Desktop Client - always visible -* Android Client (Branded) - visible when at least one `android_branded` is defined -* iOS Client (Branded) - visible when at least one `ios_branded` is defined -* Desktop Client (Branded) - visible when at least one `desktop_branded` is defined -* All branded clients - visible when at least one of `android_branded`, `ios_branded` or `desktop_branded` is defined -* All non-branded clients - visible when at least one of `android_branded`, `ios_branded` or `desktop_branded` is defined -* Others (Browsers, etc.) - always visible - -Then these options operate this way: - -* The `* Client` options only match `android`, `ios` and `desktop` respectively. -* The `* Client (Branded)` options match the `*_branded` agents equivalent. -* `All branded clients` matches: `android_branded`, `ios_branded` and `desktop_branded` -* `All non-branded clients` matches: `android`, `ios` and `desktop` From d60a7c0165430826009b5eda9f659dba66c78be5 Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Wed, 8 Jul 2026 10:51:25 +0200 Subject: [PATCH 24/32] remove unused envvars from envvar list --- modules/admin_manual/pages/configuration/envvars/envvars.adoc | 3 --- 1 file changed, 3 deletions(-) diff --git a/modules/admin_manual/pages/configuration/envvars/envvars.adoc b/modules/admin_manual/pages/configuration/envvars/envvars.adoc index 4099a81e2..d77c4188a 100644 --- a/modules/admin_manual/pages/configuration/envvars/envvars.adoc +++ b/modules/admin_manual/pages/configuration/envvars/envvars.adoc @@ -158,13 +158,10 @@ Define files that are excluded from integrity checking (see xref:configuration/server/config_sample_php_parameters.adoc#define-files-that-are-excluded-from-integrity-checking[documentation]). - `OWNCLOUD_INTEGRITY_IGNORE_MISSING_APP_SIGNATURE=` + Define apps or themes that are excluded from integrity checking (see xref:configuration/server/config_sample_php_parameters.adoc#define-apps-or-themes-that-are-excluded-from-integrity-checking[documentation]). -- `OWNCLOUD_KNOWLEDGEBASE_ENABLED=` -- `OWNCLOUD_APPSTORE_ENABLED=` - `OWNCLOUD_LDAP_IGNORE_NAMING_RULES=` + Ignore LDAP naming rules (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-ldap[documentation]). - `OWNCLOUD_LICENSE_KEY=` + ownCloud Enterprise License Key (see xref:installation/installing_with_docker.adoc#enterprise-license-keys[documentation]). -- `OWNCLOUD_LICENSE_CLASS=` - `OWNCLOUD_LOGIN_ALTERNATIVES=` + Define additional login buttons on the logon screen (see xref:configuration/server/config_sample_php_parameters.adoc#define-additional-login-buttons-on-the-logon-screen[documentation]). - `OWNCLOUD_LOGIN_POLICY_ORDER=` + From a84ee704b8e78342bb0074d11e0d22e597622729 Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Wed, 8 Jul 2026 11:01:54 +0200 Subject: [PATCH 25/32] remove one more unused envvar from the envvar list --- modules/admin_manual/pages/configuration/envvars/envvars.adoc | 1 - 1 file changed, 1 deletion(-) diff --git a/modules/admin_manual/pages/configuration/envvars/envvars.adoc b/modules/admin_manual/pages/configuration/envvars/envvars.adoc index 9702ef29d..20211f062 100644 --- a/modules/admin_manual/pages/configuration/envvars/envvars.adoc +++ b/modules/admin_manual/pages/configuration/envvars/envvars.adoc @@ -240,7 +240,6 @@ Sets PHP option `memory_limit`. It is recommended to keep the default (see xref:configuration/files/big_file_upload_configuration.adoc[documentation]). - `OWNCLOUD_MINIMUM_SUPPORTED_DESKTOP_VERSION=` + Define the minimum supported ownCloud desktop client version (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-minimum-supported-owncloud-desktop-client-version[documentation]). -- `OWNCLOUD_MOUNT_FILE=` - `OWNCLOUD_MYSQL_UTF8MB4=$\{owncloud_utf8mb4_enabled}` + Define MySQL 3/4 byte character handling (see xref:configuration/server/config_sample_php_parameters.adoc#define-mysql-34-byte-character-handling[documentation]). - `OWNCLOUD_OBJECTSTORE_BUCKET=owncloud` + From 931b7853472651764f81e6187662f44efdf85cc2 Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Wed, 8 Jul 2026 11:21:52 +0200 Subject: [PATCH 26/32] remove impersonate from admin_audit --- .../pages/enterprise/logging/admin_audit.adoc | 32 ------------------- 1 file changed, 32 deletions(-) diff --git a/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc b/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc index 9a79d0f16..90ccb9a4e 100644 --- a/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc +++ b/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc @@ -1418,38 +1418,6 @@ All comment events have the same data: | The name of the app whose user preferences are deleted |=== -==== Impersonate - -===== impersonated - -[width="100%",cols="25%,20%,100%",options="header"] -|=== -| Key -| Type -| Description - -| `user` -| string -| The current user who did an impersonate action - -| `targetUser` -| string -| The user who is being impersonated -|=== - -===== impersonate_logout - -[width="100%",cols="25%,20%,100%",options="header"] -|=== -| Key -| Type -| Description - -| `user` -| string -| The user who performed impersonate action -|=== - ==== SMB ACL ===== before_set_acl From 3d45a4d1305f6a9be617c51a2d0d287870cd1a63 Mon Sep 17 00:00:00 2001 From: Martin Date: Wed, 8 Jul 2026 11:25:48 +0200 Subject: [PATCH 27/32] Apply suggestions from code review Co-authored-by: Phil Davis --- .../pages/enterprise/security/ransomware-protection.adoc | 4 ++-- .../pages/installation/installing_with_docker.adoc | 4 ++-- .../pages/maintenance/migrate_owncloud/migrating.adoc | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/modules/admin_manual/pages/enterprise/security/ransomware-protection.adoc b/modules/admin_manual/pages/enterprise/security/ransomware-protection.adoc index b5f2812cf..9d79f4792 100644 --- a/modules/admin_manual/pages/enterprise/security/ransomware-protection.adoc +++ b/modules/admin_manual/pages/enterprise/security/ransomware-protection.adoc @@ -13,7 +13,7 @@ Once this happens, attackers usually ask victims to pay a ransom, often via cryp While paying the ransom works in some cases, it is not recommended, as there is no guarantee that the attackers will supply the key after payment is made. To help mitigate such threats and ensure ongoing access to user data, ownCloud provides the Ransomware Protection app. -NOTE: It is essential to be aware that user data needs to be synchronized with you ownCloud Classic using the ownCloud Desktop synchronization client. Data that is not synchronized and stored in ownCloud cannot be protected. +NOTE: It is essential to be aware that user data needs to be synchronized with your ownCloud Classic server using the ownCloud Desktop synchronization client. Data that is not synchronized and stored in ownCloud cannot be protected. == About Ransomware Protection @@ -59,7 +59,7 @@ While Ransomware Prevention mitigates risks of a range of ransomware attacks, it Ultimately there is a consensus that only one solution can provide future-proof protection from ransomware attacks: retaining data and providing the means to roll back to a particular point in time. -ownCloud Ransomware Protection will, therefore, record all changes on an ownCloud Classic and allow administrators to rollback user data to a particular point in time, making use of ownCloud’s integrated Versioning and Trash bin features. +ownCloud Ransomware Protection will, therefore, record all changes on an ownCloud Classic server and allow administrators to rollback user data to a particular point in time, making use of ownCloud’s integrated Versioning and Trash bin features. Doing so allows all user data that is synchronized with the server to be rolled back to its state before the attack occurred. A combination of Ransomware prevention and protection reduces risks to a minimum acceptable level. diff --git a/modules/admin_manual/pages/installation/installing_with_docker.adoc b/modules/admin_manual/pages/installation/installing_with_docker.adoc index 98626cef4..4a4bcc118 100644 --- a/modules/admin_manual/pages/installation/installing_with_docker.adoc +++ b/modules/admin_manual/pages/installation/installing_with_docker.adoc @@ -156,8 +156,8 @@ Only a few settings are required, these are: a| `{latest-server-download-version}` or `latest` | `OWNCLOUD_DOMAIN` *^1^* -a| Only for the use with a single ownCloud domain + -The same rules trusted domains apply to everything else. +a| Only for use with a single ownCloud domain + +The same rules for trusted domains apply to everything else. [IMPORTANT] ==== Either use: + diff --git a/modules/admin_manual/pages/maintenance/migrate_owncloud/migrating.adoc b/modules/admin_manual/pages/maintenance/migrate_owncloud/migrating.adoc index 567d76f25..f768a3749 100644 --- a/modules/admin_manual/pages/maintenance/migrate_owncloud/migrating.adoc +++ b/modules/admin_manual/pages/maintenance/migrate_owncloud/migrating.adoc @@ -63,7 +63,7 @@ OWNCLOUD_TRUSTED_DOMAINS='server1.example.com','192.168.1.50' [IMPORTANT] ==== * The steps shown do not cover any measures that may be necessary when the ownCloud-provided image was or needs to be customised . -* Any third party app used needs to be PHP 8 compliant. In doubt, disable it and do not re-enable until this prerequisite is met. +* Any third party app used needs to be PHP 8 compliant. If in doubt, disable it and do not re-enable until this prerequisite is met. ==== [NOTE] From ae560ca810d96a3a1c3cd4a44a994acab7537a83 Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Wed, 8 Jul 2026 11:28:19 +0200 Subject: [PATCH 28/32] use start transaction instead of begin transaction --- .../maintenance/migrate_owncloud/migrate-datadirectory.adoc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/admin_manual/pages/maintenance/migrate_owncloud/migrate-datadirectory.adoc b/modules/admin_manual/pages/maintenance/migrate_owncloud/migrate-datadirectory.adoc index e796aa4af..9688b739e 100644 --- a/modules/admin_manual/pages/maintenance/migrate_owncloud/migrate-datadirectory.adoc +++ b/modules/admin_manual/pages/maintenance/migrate_owncloud/migrate-datadirectory.adoc @@ -144,7 +144,7 @@ Then update the database paths and adapt them accordingly. Please note that the [source,sql] ---- -BEGIN TRANSACTION; +START TRANSACTION; UPDATE oc_storages SET id = REPLACE( @@ -177,7 +177,7 @@ Then update the database paths and adapt them accordingly. Please note that the [source,sql] ---- -BEGIN TRANSACTION; +START TRANSACTION; UPDATE oc_accounts SET home = REPLACE( @@ -208,7 +208,7 @@ If any results are returned, run the SQL query below to update them, changing th [source,sql] ---- -BEGIN TRANSACTION; +START TRANSACTION; UPDATE oc_jobs SET argument = REPLACE( From 1986ee77ec45579c68760d50095f095b72b0da5b Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Wed, 8 Jul 2026 11:30:17 +0200 Subject: [PATCH 29/32] add lost slash in admin_audit --- modules/admin_manual/pages/enterprise/logging/admin_audit.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc b/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc index 90ccb9a4e..8ebacea43 100644 --- a/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc +++ b/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc @@ -85,7 +85,7 @@ To Monitor the ownCloud Splunk audit log, add this to `inputs.conf`, assuming yo [source,plaintext] ---- -[monitor://files/admin_audit.log] +[monitor:///files/admin_audit.log] disabled = false sourcetype = _json index = main From 416b74c762b69648822c3a06443003c0e0fef880 Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Wed, 8 Jul 2026 11:37:29 +0200 Subject: [PATCH 30/32] more fixes to envvars list --- .../pages/configuration/envvars/envvars.adoc | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/modules/admin_manual/pages/configuration/envvars/envvars.adoc b/modules/admin_manual/pages/configuration/envvars/envvars.adoc index 20211f062..a42a0fc96 100644 --- a/modules/admin_manual/pages/configuration/envvars/envvars.adoc +++ b/modules/admin_manual/pages/configuration/envvars/envvars.adoc @@ -165,7 +165,7 @@ - `OWNCLOUD_LOGIN_ALTERNATIVES=` + Define additional login buttons on the logon screen (see xref:configuration/server/config_sample_php_parameters.adoc#define-additional-login-buttons-on-the-logon-screen[documentation]). - `OWNCLOUD_LOGIN_POLICY_ORDER=` + - Ordered list of login policy class names. Comma-separated (see xref:configuration/server/config_sample_php_parameters.adoc#define-additional-login-buttons-on-the-logon-screen[documentation]). + Ordered list of login policy class names. Comma-separated (see xref:configuration/server/config_sample_php_parameters.adoc#order-of-login-policies[documentation]). - `OWNCLOUD_LOG_CONDITIONS=` + Define conditional logging rules as a JSON-encoded array of condition objects, e.g. `[{"apps":["files_external"],"loglevel":0}]` (see xref:configuration/server/config_sample_php_parameters.adoc#define-log-conditions[documentation]). - `OWNCLOUD_LOG_DATE_FORMAT=` + @@ -285,7 +285,7 @@ - `OWNCLOUD_PART_FILE_IN_STORAGE=` + Define where part files are located (see xref:configuration/server/config_sample_php_parameters.adoc#define-where-part-files-are-located[documentation]). - `OWNCLOUD_POLLINTERVAL=` + - Suggested client polling interval in milliseconds (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-ttl-for-garbage-collection[documentation]). + Suggested client polling interval in milliseconds (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-suggested-poll-interval-for-clients[documentation]). - `OWNCLOUD_POST_CRONJOB_PATH=/etc/post_cronjob.d` + Path to custom scripts that need to be executed after a cron run. - `OWNCLOUD_POST_INSTALL_PATH=/etc/post_install.d` + @@ -373,7 +373,7 @@ - `OWNCLOUD_REMEMBER_LOGIN_COOKIE_LIFETIME=` + Define the lifetime of the remember-login cookie (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-lifetime-of-the-remember-login-cookie[documentation]). - `OWNCLOUD_SAVE_VERSION_METADATA=` + - Enable extended version metadata (see https://doc.owncloud.com/server/latest/admin_manual/configuration/files/file_versioning.adoc#extended-version-metadata[description] and https://doc.owncloud.com/server/next/admin_manual/configuration/server/config_sample_php_parameters.adoc#save-additional-metadata-for-versions[documentation]). + Enable extended version metadata (see xref:configuration/files/file_versioning.adoc#extended-version-metadata[description] and xref:configuration/server/config_sample_php_parameters.adoc#save-additional-metadata-for-versions[documentation]). - `OWNCLOUD_SECRET=` + Define ownClouds internal secret (see xref:configuration/server/config_sample_php_parameters.adoc#define-ownclouds-internal-secret[documentation]). - `OWNCLOUD_SESSION_KEEPALIVE=` + @@ -395,7 +395,7 @@ - `OWNCLOUD_SHARING_MANAGER_FACTORY=` + Define an alternative Share Provider (see xref:configuration/server/config_sample_php_parameters.adoc#define-an-alternative-share-provider[documentation]). - `OWNCLOUD_SHARING_SHOW_PUBLIC_LINK_QUICK_ACTION=` + - Show a quick-action button for creating public links in the file list (see xref:configuration/server/config_sample_php_parameters.adoc#define-an-alternative-share-provider[documentation]). + Show a quick-action button for creating public links in the file list (see xref:configuration/server/config_sample_php_parameters.adoc#show-a-quick-action-for-the-public-link-creation[documentation]). - `OWNCLOUD_SHOW_SERVER_HOSTNAME=` + Show or hide the server hostname in status.php (see xref:configuration/server/config_sample_php_parameters.adoc#show-or-hide-the-server-hostname-in-status-php[documentation]). - `OWNCLOUD_SINGLEUSER=` + @@ -411,13 +411,13 @@ - `OWNCLOUD_SQLITE_JOURNAL_MODE=` + Define sqlite3 journal mode (see xref:configuration/server/config_sample_php_parameters.adoc#define-sqlite3-journal-mode[documentation]). - `OWNCLOUD_STRICT_LOGIN_ENFORCED=` + - Only validate the exact login name entered by the user, not alternative formats (see xref:configuration/server/config_sample_php_parameters.adoc#enforce-token-only-authentication-for-apps-and-clients-connecting-to-owncloud[documentation]). + Only validate the exact login name entered by the user, not alternative formats (see xref:configuration/server/config_sample_php_parameters.adoc#enforce-a-strict-login-check-with-the-user-backend[documentation]). - `OWNCLOUD_SUB_URL=/` + URL path if ownCloud is deployed to a URL sub-path of a domain. - `OWNCLOUD_SYSTEMTAGS_MANAGER_FACTORY=` + Define an alternative System Tags Manager (see xref:configuration/server/config_sample_php_parameters.adoc#define-an-alternative-system-tags-manager[documentation]). - `OWNCLOUD_TELEMETRY_ENABLED=` + - Send daily telemetry reports (Enterprise only) (see xref:configuration/server/config_sample_php_parameters.adoc#define-owncloud-operation-modes[documentation]). + Send daily telemetry reports (Enterprise only) (see xref:configuration/server/config_sample_php_parameters.adoc#enable-sending-telemetry-reports-for-enterprise-customers[documentation]). - `OWNCLOUD_TEMP_DIRECTORY=` + Define the location for temporary files (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-location-for-temporary-files[documentation]). - `OWNCLOUD_TOKEN_AUTH_ENFORCED=` + @@ -447,9 +447,9 @@ - `OWNCLOUD_USER_SEARCH_MIN_LENGTH=` + Define minimum characters entered before a search returns results (see xref:configuration/server/config_sample_php_parameters.adoc#define-minimum-characters-entered-before-a-search-returns-results[documentation]). - `OWNCLOUD_WEB_BASEURL=` + - Base URL for the ownCloud Web UI (see xref:configuration/server/config_sample_php_parameters.adoc#override-cli-url[documentation]). + Base URL for the ownCloud Web UI (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-web-base-url[documentation]). - `OWNCLOUD_WEB_REWRITE_LINKS=` + - Redirect public/private links to the ownCloud Web UI (see xref:configuration/server/config_sample_php_parameters.adoc#override-cli-url[documentation]). + Redirect public/private links to the ownCloud Web UI (see xref:configuration/server/config_sample_php_parameters.adoc#define-rewrite-private-and-public-links[documentation]). - `OWNCLOUD_WND_ACTIVITY_REGISTER_EXTENSION=` + Register the Windows Network Drive app with the Activity app to report what `wnd:process-queue` is doing (`true`/`false`) (Enterprise only) (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-windows-network-drive-wnd[documentation]). - `OWNCLOUD_WND_ACTIVITY_SEND_TO_SHAREES=` + From 1db2adcb3912e23e0f74b3c6ff9781127b0eaa53 Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Wed, 8 Jul 2026 11:38:55 +0200 Subject: [PATCH 31/32] text fix --- .../pages/enterprise/user_management/user_auth_shibboleth.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/admin_manual/pages/enterprise/user_management/user_auth_shibboleth.adoc b/modules/admin_manual/pages/enterprise/user_management/user_auth_shibboleth.adoc index 477bf81bd..17dbc868c 100644 --- a/modules/admin_manual/pages/enterprise/user_management/user_auth_shibboleth.adoc +++ b/modules/admin_manual/pages/enterprise/user_management/user_auth_shibboleth.adoc @@ -100,7 +100,7 @@ The following mappers are provided with the app: == Shibboleth with Desktop and Mobile Clients -The ownCloud Desktop Client can interact with an ownCloud instance running inside a Shibboleth Service Provider by using OAuth2 tokens to authenticate.The ownCloud Android and iOS mobile apps also work with OAuth2 tokens. +The ownCloud Desktop Client can interact with an ownCloud instance running inside a Shibboleth Service Provider by using OAuth2 tokens to authenticate. The ownCloud Android and iOS mobile apps also work with OAuth2 tokens. == WebDAV Support From 03b47a7e6772506eaf5dac03266d4703066fedf7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <1005065+DeepDiver1975@users.noreply.github.com> Date: Wed, 8 Jul 2026 12:25:08 +0200 Subject: [PATCH 32/32] fix: correct typos and grammar in OC11 admin docs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Apply proofreading findings from PR review: - envvars.adoc: "GIF´s" -> "GIFs", "ownClouds" -> "ownCloud's" (x2), "ownCoud" -> "ownCloud" (x2) - admin_audit.adoc: "browsers admin page" -> "browser's admin page" - migrating.adoc: "a environment variable" -> "an environment variable"; remove stray space before period - migrate-datadirectory.adoc: "a NFS" -> "an NFS" - kerberos.adoc: "app will not enable unless" -> "app will not be enabled unless"; drop trailing whitespace Co-Authored-By: Claude Opus 4.8 Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com> --- .../pages/configuration/envvars/envvars.adoc | 10 +++++----- .../pages/enterprise/authentication/kerberos.adoc | 2 +- .../pages/enterprise/logging/admin_audit.adoc | 2 +- .../migrate_owncloud/migrate-datadirectory.adoc | 2 +- .../pages/maintenance/migrate_owncloud/migrating.adoc | 4 ++-- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/modules/admin_manual/pages/configuration/envvars/envvars.adoc b/modules/admin_manual/pages/configuration/envvars/envvars.adoc index a42a0fc96..741bd87de 100644 --- a/modules/admin_manual/pages/configuration/envvars/envvars.adoc +++ b/modules/admin_manual/pages/configuration/envvars/envvars.adoc @@ -231,7 +231,7 @@ - `OWNCLOUD_MAX_EXECUTION_TIME=3600` + Sets PHP option `max_execution_time`. It is recommended to keep the default (see xref:configuration/files/big_file_upload_configuration.adoc[documentation]). - `OWNCLOUD_MAX_FILESIZE_ANIMATED_GIFS_PUBLIC_SHARING=` + - Define the maximum filesize for animated GIF´s (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-maximum-filesize-for-animated-gifs[documentation]). + Define the maximum filesize for animated GIFs (see xref:configuration/server/config_sample_php_parameters.adoc#define-the-maximum-filesize-for-animated-gifs[documentation]). - `OWNCLOUD_MAX_INPUT_TIME=3600` + Sets PHP option `max_input_time`. It is recommended to keep the default (see xref:configuration/files/big_file_upload_configuration.adoc[documentation]). - `OWNCLOUD_MAX_UPLOAD=20G` + @@ -279,7 +279,7 @@ - `OWNCLOUD_OVERWRITE_PROTOCOL=` + Override protocol (http/https) usage (see xref:configuration/server/config_sample_php_parameters.adoc#override-protocol-httphttps-usage[documentation]). - `OWNCLOUD_OVERWRITE_WEBROOT=` + - Override ownClouds webroot (see xref:configuration/server/config_sample_php_parameters.adoc#override-ownclouds-webroot[documentation]). + Override ownCloud's webroot (see xref:configuration/server/config_sample_php_parameters.adoc#override-ownclouds-webroot[documentation]). - `OWNCLOUD_PDF_VIEWER_ENABLE_SCRIPTING=` + Allow JavaScript execution in PDF files. Security risk — only enable if required (see xref:configuration/server/config_apps_sample_php_parameters.adoc#app-files-pdf-viewer[documentation]). - `OWNCLOUD_PART_FILE_IN_STORAGE=` + @@ -289,7 +289,7 @@ - `OWNCLOUD_POST_CRONJOB_PATH=/etc/post_cronjob.d` + Path to custom scripts that need to be executed after a cron run. - `OWNCLOUD_POST_INSTALL_PATH=/etc/post_install.d` + - Path to custom scripts that need to be executed after an ownCoud installation command. + Path to custom scripts that need to be executed after an ownCloud installation command. - `OWNCLOUD_POST_SERVER_PATH=/etc/post_server.d` + Path to custom scripts that need to be executed after an ownCloud server startup. - `OWNCLOUD_PREVIEW_JPEG_IMAGE_DISPLAY_QUALITY=` + @@ -311,7 +311,7 @@ - `OWNCLOUD_PRE_CRONJOB_PATH=/etc/pre_cronjob.d` + Path to custom scripts that need to be executed before a cron run. - `OWNCLOUD_PRE_INSTALL_PATH=/etc/pre_install.d` + - Path to custom scripts that need to be executed before an ownCoud installation command. + Path to custom scripts that need to be executed before an ownCloud installation command. - `OWNCLOUD_PRE_SERVER_PATH=/etc/pre_server.d` + Path to custom scripts that need to be executed before an ownCloud server startup. - `OWNCLOUD_PROTOCOL=http` + @@ -375,7 +375,7 @@ - `OWNCLOUD_SAVE_VERSION_METADATA=` + Enable extended version metadata (see xref:configuration/files/file_versioning.adoc#extended-version-metadata[description] and xref:configuration/server/config_sample_php_parameters.adoc#save-additional-metadata-for-versions[documentation]). - `OWNCLOUD_SECRET=` + - Define ownClouds internal secret (see xref:configuration/server/config_sample_php_parameters.adoc#define-ownclouds-internal-secret[documentation]). + Define ownCloud's internal secret (see xref:configuration/server/config_sample_php_parameters.adoc#define-ownclouds-internal-secret[documentation]). - `OWNCLOUD_SESSION_KEEPALIVE=` + Enable or disable session keep-alive when a user is logged in to the Web UI (see xref:configuration/server/config_sample_php_parameters.adoc#enable-or-disable-session-keep-alive-when-a-user-is-logged-in-to-the-web-ui[documentation]). - `OWNCLOUD_SESSION_LIFETIME=` + diff --git a/modules/admin_manual/pages/enterprise/authentication/kerberos.adoc b/modules/admin_manual/pages/enterprise/authentication/kerberos.adoc index 484b0f20b..42bd7bac8 100644 --- a/modules/admin_manual/pages/enterprise/authentication/kerberos.adoc +++ b/modules/admin_manual/pages/enterprise/authentication/kerberos.adoc @@ -9,7 +9,7 @@ With the Kerberos app, you can reuse the authentication ticket generated from a user's Windows domain login for ownCloud and access file server resources via ownCloud without re-authentication. -IMPORTANT: The Docker image does not provide the required Kerberos `krb5` PHP extension and the `krb5-user` CLI tool. This tool is an actual requirement, the Kerberos implementation in the WND app requires the `kvno` command which is contained in the package installed. To mitigate this issue, you need to manually create an image that installs and enables these requirements. Please note that the app will not enable unless the `kvno` tool exists. +IMPORTANT: The Docker image does not provide the required Kerberos `krb5` PHP extension and the `krb5-user` CLI tool. This tool is an actual requirement, the Kerberos implementation in the WND app requires the `kvno` command which is contained in the package installed. To mitigate this issue, you need to manually create an image that installs and enables these requirements. Please note that the app will not be enabled unless the `kvno` tool exists. include::partial$manual_config_file.adoc[] diff --git a/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc b/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc index 8ebacea43..c2e475d83 100644 --- a/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc +++ b/modules/admin_manual/pages/enterprise/logging/admin_audit.adoc @@ -63,7 +63,7 @@ When the filter is configured, only the filtered list of groups will be output i NOTE: If you have configured a different logfile than the default, you must download it manually. -To download your logfile via your browsers admin page, click menu:Settings[Admin > Download logfile]. The default location of the standard ownCloud log file is `mount_point/files/owncloud.log`. +To download your logfile via your browser's admin page, click menu:Settings[Admin > Download logfile]. The default location of the standard ownCloud log file is `mount_point/files/owncloud.log`. TIP: See xref:configuration/server/logging/logging_configuration.adoc[Logging Configuration] and xref:enterprise/file_management/files_tagging.adoc[File Tagging] for more information on logging and tagging. diff --git a/modules/admin_manual/pages/maintenance/migrate_owncloud/migrate-datadirectory.adoc b/modules/admin_manual/pages/maintenance/migrate_owncloud/migrate-datadirectory.adoc index 9688b739e..cd3fd7531 100644 --- a/modules/admin_manual/pages/maintenance/migrate_owncloud/migrate-datadirectory.adoc +++ b/modules/admin_manual/pages/maintenance/migrate_owncloud/migrate-datadirectory.adoc @@ -114,7 +114,7 @@ sudo rsync -avz /var/www/owncloud/data /files === Mounting with NFS -If the data directory is already part of a NFS mount point such as `/mnt/owncloud/data`, unmount it, remove the export, create a new export including the data directory and mount it to `/files`. +If the data directory is already part of an NFS mount point such as `/mnt/owncloud/data`, unmount it, remove the export, create a new export including the data directory and mount it to `/files`. IMPORTANT: Only mount the data directory from the source and not the full owncloud directory including the data directory. diff --git a/modules/admin_manual/pages/maintenance/migrate_owncloud/migrating.adoc b/modules/admin_manual/pages/maintenance/migrate_owncloud/migrating.adoc index f768a3749..fade75e40 100644 --- a/modules/admin_manual/pages/maintenance/migrate_owncloud/migrating.adoc +++ b/modules/admin_manual/pages/maintenance/migrate_owncloud/migrating.adoc @@ -45,7 +45,7 @@ As the ownCloud Classic 11 image provides an embedded Apache web server, you nee ==== Managing Trusted Domains -All URLs used to access your ownCloud server must be white-listed using a environment variable. Users are allowed to log into ownCloud only when they point their browsers to a URL that is listed in the `OWNCLOUD_TRUSTED_DOMAINS` setting. +All URLs used to access your ownCloud server must be white-listed using an environment variable. Users are allowed to log into ownCloud only when they point their browsers to a URL that is listed in the `OWNCLOUD_TRUSTED_DOMAINS` setting. NOTE: This setting is important when changing or moving to a new domain name. You may use IP addresses and domain names. @@ -62,7 +62,7 @@ OWNCLOUD_TRUSTED_DOMAINS='server1.example.com','192.168.1.50' [IMPORTANT] ==== -* The steps shown do not cover any measures that may be necessary when the ownCloud-provided image was or needs to be customised . +* The steps shown do not cover any measures that may be necessary when the ownCloud-provided image was or needs to be customised. * Any third party app used needs to be PHP 8 compliant. If in doubt, disable it and do not re-enable until this prerequisite is met. ====