2018-10-03 09:48:02 +00:00
|
|
|
<?php
|
2019-12-03 18:57:53 +00:00
|
|
|
|
2018-10-03 09:48:02 +00:00
|
|
|
declare(strict_types=1);
|
2019-12-03 18:57:53 +00:00
|
|
|
|
2018-10-03 09:48:02 +00:00
|
|
|
/**
|
|
|
|
* @copyright Copyright (c) 2018, Roeland Jago Douma <roeland@famdouma.nl>
|
|
|
|
*
|
2019-12-03 18:57:53 +00:00
|
|
|
* @author Daniel Kesselberg <mail@danielkesselberg.de>
|
2018-10-03 09:48:02 +00:00
|
|
|
* @author Roeland Jago Douma <roeland@famdouma.nl>
|
|
|
|
*
|
|
|
|
* @license GNU AGPL version 3 or any later version
|
|
|
|
*
|
|
|
|
* This program is free software: you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU Affero General Public License as
|
|
|
|
* published by the Free Software Foundation, either version 3 of the
|
|
|
|
* License, or (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU Affero General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU Affero General Public License
|
2019-12-03 18:57:53 +00:00
|
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
2018-10-03 09:48:02 +00:00
|
|
|
*
|
|
|
|
*/
|
|
|
|
|
|
|
|
namespace OC\Core\Controller;
|
|
|
|
|
2019-05-17 07:51:47 +00:00
|
|
|
use OC\Authentication\Exceptions\InvalidTokenException;
|
2018-10-03 09:48:02 +00:00
|
|
|
use OC\Authentication\Token\IProvider;
|
|
|
|
use OC\Authentication\Token\IToken;
|
|
|
|
use OCP\AppFramework\Http\DataResponse;
|
|
|
|
use OCP\AppFramework\OCS\OCSForbiddenException;
|
|
|
|
use OCP\Authentication\Exceptions\CredentialsUnavailableException;
|
|
|
|
use OCP\Authentication\Exceptions\PasswordUnavailableException;
|
|
|
|
use OCP\Authentication\LoginCredentials\IStore;
|
|
|
|
use OCP\IRequest;
|
|
|
|
use OCP\ISession;
|
|
|
|
use OCP\Security\ISecureRandom;
|
2019-02-18 16:38:38 +00:00
|
|
|
use Symfony\Component\EventDispatcher\EventDispatcherInterface;
|
|
|
|
use Symfony\Component\EventDispatcher\GenericEvent;
|
2018-10-03 09:48:02 +00:00
|
|
|
|
|
|
|
class AppPasswordController extends \OCP\AppFramework\OCSController {
|
|
|
|
|
|
|
|
/** @var ISession */
|
|
|
|
private $session;
|
|
|
|
|
|
|
|
/** @var ISecureRandom */
|
|
|
|
private $random;
|
|
|
|
|
|
|
|
/** @var IProvider */
|
|
|
|
private $tokenProvider;
|
|
|
|
|
|
|
|
/** @var IStore */
|
|
|
|
private $credentialStore;
|
|
|
|
|
2019-02-18 16:38:38 +00:00
|
|
|
/** @var EventDispatcherInterface */
|
|
|
|
private $eventDispatcher;
|
|
|
|
|
2018-10-03 09:48:02 +00:00
|
|
|
public function __construct(string $appName,
|
|
|
|
IRequest $request,
|
|
|
|
ISession $session,
|
|
|
|
ISecureRandom $random,
|
|
|
|
IProvider $tokenProvider,
|
2019-02-17 21:45:05 +00:00
|
|
|
IStore $credentialStore,
|
2019-02-18 16:38:38 +00:00
|
|
|
EventDispatcherInterface $eventDispatcher) {
|
2018-10-03 09:48:02 +00:00
|
|
|
parent::__construct($appName, $request);
|
|
|
|
|
|
|
|
$this->session = $session;
|
|
|
|
$this->random = $random;
|
|
|
|
$this->tokenProvider = $tokenProvider;
|
|
|
|
$this->credentialStore = $credentialStore;
|
2019-02-18 16:38:38 +00:00
|
|
|
$this->eventDispatcher = $eventDispatcher;
|
2018-10-03 09:48:02 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* @NoAdminRequired
|
|
|
|
*
|
|
|
|
* @return DataResponse
|
|
|
|
* @throws OCSForbiddenException
|
|
|
|
*/
|
|
|
|
public function getAppPassword(): DataResponse {
|
|
|
|
// We do not allow the creation of new tokens if this is an app password
|
|
|
|
if ($this->session->exists('app_password')) {
|
|
|
|
throw new OCSForbiddenException('You cannot request an new apppassword with an apppassword');
|
|
|
|
}
|
|
|
|
|
|
|
|
try {
|
|
|
|
$credentials = $this->credentialStore->getLoginCredentials();
|
|
|
|
} catch (CredentialsUnavailableException $e) {
|
|
|
|
throw new OCSForbiddenException();
|
|
|
|
}
|
|
|
|
|
|
|
|
try {
|
|
|
|
$password = $credentials->getPassword();
|
|
|
|
} catch (PasswordUnavailableException $e) {
|
|
|
|
$password = null;
|
|
|
|
}
|
|
|
|
|
|
|
|
$userAgent = $this->request->getHeader('USER_AGENT');
|
|
|
|
|
|
|
|
$token = $this->random->generate(72, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS);
|
|
|
|
|
2019-02-17 21:45:05 +00:00
|
|
|
$generatedToken = $this->tokenProvider->generateToken(
|
2018-10-03 09:48:02 +00:00
|
|
|
$token,
|
|
|
|
$credentials->getUID(),
|
|
|
|
$credentials->getLoginName(),
|
|
|
|
$password,
|
|
|
|
$userAgent,
|
|
|
|
IToken::PERMANENT_TOKEN,
|
|
|
|
IToken::DO_NOT_REMEMBER
|
|
|
|
);
|
|
|
|
|
2019-02-18 16:38:38 +00:00
|
|
|
$event = new GenericEvent($generatedToken);
|
|
|
|
$this->eventDispatcher->dispatch('app_password_created', $event);
|
2019-02-17 21:45:05 +00:00
|
|
|
|
2018-10-03 09:48:02 +00:00
|
|
|
return new DataResponse([
|
|
|
|
'apppassword' => $token
|
|
|
|
]);
|
|
|
|
}
|
2019-05-17 07:51:47 +00:00
|
|
|
|
|
|
|
/**
|
|
|
|
* @NoAdminRequired
|
|
|
|
*
|
|
|
|
* @return DataResponse
|
|
|
|
*/
|
|
|
|
public function deleteAppPassword() {
|
|
|
|
if (!$this->session->exists('app_password')) {
|
|
|
|
throw new OCSForbiddenException('no app password in use');
|
|
|
|
}
|
|
|
|
|
|
|
|
$appPassword = $this->session->get('app_password');
|
|
|
|
|
|
|
|
try {
|
|
|
|
$token = $this->tokenProvider->getToken($appPassword);
|
|
|
|
} catch (InvalidTokenException $e) {
|
|
|
|
throw new OCSForbiddenException('could not remove apptoken');
|
|
|
|
}
|
|
|
|
|
|
|
|
$this->tokenProvider->invalidateTokenById($token->getUID(), $token->getId());
|
|
|
|
return new DataResponse();
|
|
|
|
}
|
2019-08-27 11:46:06 +00:00
|
|
|
|
|
|
|
/**
|
|
|
|
* @NoAdminRequired
|
|
|
|
*/
|
|
|
|
public function rotateAppPassword(): DataResponse {
|
|
|
|
if (!$this->session->exists('app_password')) {
|
|
|
|
throw new OCSForbiddenException('no app password in use');
|
|
|
|
}
|
|
|
|
|
|
|
|
$appPassword = $this->session->get('app_password');
|
|
|
|
|
|
|
|
try {
|
|
|
|
$token = $this->tokenProvider->getToken($appPassword);
|
|
|
|
} catch (InvalidTokenException $e) {
|
|
|
|
throw new OCSForbiddenException('could not rotate apptoken');
|
|
|
|
}
|
|
|
|
|
|
|
|
$newToken = $this->random->generate(72, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS);
|
|
|
|
$this->tokenProvider->rotate($token, $appPassword, $newToken);
|
|
|
|
|
|
|
|
return new DataResponse([
|
|
|
|
'apppassword' => $newToken,
|
|
|
|
]);
|
|
|
|
}
|
2018-10-03 09:48:02 +00:00
|
|
|
}
|