shipped apps are now defined in core/shipped.json - the shipped tag in info.xml is ignored from now on - never trust an app 🙊

core/shipped.json

@@ -0,0 +1,25 @@
+{
+  "_comment" : "As shipped with owncloud-8.0.2.tar.bz2",
+  "core-version": "8.1.0.0",
+  "shippedApps": [
+    "activity",
+    "files",
+    "files_external",
+    "files_pdfviewer",
+    "files_texteditor",
+    "files_versions",
+    "firstrunwizard",
+    "templateeditor",
+    "user_external",
+    "user_webdavauth external",
+    "files_encryption",
+    "files_locking",
+    "files_sharing",
+    "files_trashbin",
+    "files_videoviewer",
+    "gallery",
+    "provisioning_api",
+    "updater",
+    "user_ldap"
+  ]
+}

lib/private/app.php

@@ -42,6 +42,7 @@ class OC_App {
 	static private $appTypes = array();
 	static private $loadedApps = array();
 	static private $altLogin = array();
+	private static $shippedApps = null;
 
 	/**
 	 * clean the appId
@@ -182,12 +183,18 @@ class OC_App {
 	 * Check if an app that is installed is a shipped app or installed from the appstore.
 	 */
 	public static function isShipped($appId) {
-		$info = self::getAppInfo($appId);
-		if (isset($info['shipped']) && $info['shipped'] == 'true') {
-			return true;
-		} else {
-			return false;
+		if (is_null(self::$shippedApps)) {
+			$shippedJson = \OC::$SERVERROOT . '/core/shipped.json';
+			if (file_exists($shippedJson)) {
+				self::$shippedApps = json_decode(file_get_contents($shippedJson), true);
+				self::$shippedApps = self::$shippedApps['shippedApps'];
+			} else {
+				self::$shippedApps = ['files', 'files_encryption', 'files_external',
+					'files_sharing', 'files_trashbin', 'files_versions', 'provisioning_api',
+					'user_ldap', 'user_webdavauth'];
+			}
 		}
+		return in_array($appId, self::$shippedApps);
 	}
 
 	/**