demo.owncloud.org: HTTP compression is enabled potentially leading to BREACH attack

Summary

@paresh_parmar reported the BREACH vulnerability on demo.owncloud.org. ownCloud has meanwhile disabled compression on the system. It should be noted that starting with ownCloud 8.2 the CSRF token is randomized for each request.

As per request by the reporter this issue has only been disclosed limited.