wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
47095 commits 157 branches 562 tags 714 MiB
Commit graph

158 commits

Author SHA1 Message Date
Morris Jobke
444779ce96
Fix tests 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-09-06 16:38:24 +02:00
Morris Jobke
0326c2c54f
Fix broken tests 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-09-04 14:17:03 +02:00
Joas Schilling
0aff1c9268
Return the user id in case of an error 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-08-29 11:10:30 +02:00
Morris Jobke
0b652648cc Merge pull request #6177 from nextcloud/properly-add-slo-url 
Properly allow \OCP\Authentication\IApacheBackend to specify logout URL
 2017-08-26 18:50:52 +02:00
Joas Schilling
d5c6d56170
No password reset for disabled users 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-08-18 13:21:53 +02:00
Lukas Reschke
a04feff9a7
Properly allow \OCP\Authentication\IApacheBackend to specify logout URL 
Any `\OCP\Authentication\IApacheBackend` previously had to implement `getLogoutAttribute` which returns a string.
This string is directly injected into the logout `<a>` tag, so returning something like `href="foo"` would result
in `<a href="foo">`.

This is rather error prone and also in Nextcloud 12 broken as the logout entry has been moved with
054e161eb5 inside the navigation manager where one cannot simply inject attributes.

Thus this feature is broken in Nextcloud 12 which effectively leads to the bug described at nextcloud/user_saml#112,
people cannot logout anymore when using SAML using SLO. Basically in case of SAML you have a SLO url which redirects
you to the IdP and properly logs you out there as well.

Instead of monkey patching the Navigation manager I decided to instead change `\OCP\Authentication\IApacheBackend` to
use `\OCP\Authentication\IApacheBackend::getLogoutUrl` instead where it can return a string with the appropriate logout
URL. Since this functionality is only prominently used in the SAML plugin. Any custom app would need a small change but
I'm not aware of any and there's simply no way to fix this properly otherwise.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-08-18 12:22:44 +02:00
Roeland Jago Douma
ba7cf03daf
Fix LostControllerTest 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-08-09 15:51:13 +02:00
Roeland Jago Douma
3bd104ef7c
Fix LoginController 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-08-09 15:12:02 +02:00
Morris Jobke
84c22fdeef Merge pull request #5907 from nextcloud/add-metadata-to-throttle-call 
Add metadata to \OCP\AppFramework\Http\Response::throttle
 2017-08-01 14:43:47 +02:00
Roeland Jago Douma
2fae696d35
Fix tests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-08-01 08:20:17 +02:00
Lukas Reschke
c25e782dd6
Fix settings/Controller/ 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-08-01 08:20:15 +02:00
Lukas Reschke
f22ab3e665
Add metadata to \OCP\AppFramework\Http\Response::throttle 
Fixes https://github.com/nextcloud/server/issues/5891

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-07-27 14:17:45 +02:00
Julius Härtl
01093604d3
Add tests for public capabilties 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2017-06-30 11:21:15 +02:00
Lukas Reschke
2f87fb6b45
Add Clear-Site-Data header 
This adds a Clear-Site-Data header to the logout response which will delete all relevant data in the caches which may contain potentially sensitive content.

See https://w3c.github.io/webappsec-clear-site-data/#header for the definition of the types.

Ref https://twitter.com/mikewest/status/877149667909406723

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-06-20 19:46:10 +02:00
Lukas Reschke
26ee889fec
Add tests for ClientFlowLoginController 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-05-18 20:49:08 +02:00
Joas Schilling
0828df5ed4
Disable the API endpoints as well 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-05-11 17:03:57 +02:00
Joas Schilling
d418ea550b
Automatic injection for CssController 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-05-10 09:42:40 +02:00
Joas Schilling
9c8fe82000
Automatic injection for JsController 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-05-10 09:42:15 +02:00
Mario Danic
e4aac15a92
Update login flow redirection 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-05-04 19:21:22 +02:00
Georg Ehrke
60f9ed6241
add contactsmenu popover 
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
 2017-04-26 09:26:53 +02:00
Jan-Christoph Borchardt
241e397326 Merge branch 'master' into contactsmenu 
Signed-off-by: Jan-Christoph Borchardt <hey@jancborchardt.net>
 2017-04-26 00:50:38 +02:00
Christoph Wurst
36cee1f386 Let apps register contact menu provider via info.xml 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-04-25 20:47:17 +02:00
Christoph Wurst
d091793ceb Contacts menu 
* load list of contacts from the server
* show last message of each contact

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-04-25 20:47:17 +02:00
Roeland Jago Douma
aae079aa29
AppToken to 72 chars 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-04-25 20:18:49 +02:00
Lukas Reschke
6a16df7288
Add new auth flow 
This implements the basics for the new app-password based authentication flow for our clients.
The current implementation tries to keep it as simple as possible and works the following way:

1. Unauthenticated client opens `/index.php/login/flow`
2. User will be asked whether they want to grant access to the client
3. If accepted the user has the chance to do so using existing App Token or automatically generate an app password.

If the user chooses to use an existing app token then that one will simply be redirected to the `nc://` protocol handler.
While we can improve on that in the future, I think keeping this smaller at the moment has its advantages. Also, in the
near future we have to think about an automatic migration endpoint so there's that anyways :-)

If the user chooses to use the regular login the following happens:

1. A session state token is written to the session
2. User is redirected to the login page
3. If successfully authenticated they will be redirected to a page redirecting to the POST controller
4. The POST controller will check if the CSRF token as well as the state token is correct, if yes the user will be redirected to the `nc://` protocol handler.

This approach is quite simple but also allows to be extended in the future. One could for example allow external websites to consume this authentication endpoint as well.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-25 20:18:49 +02:00
Christoph Wurst
bb1d191f82
Fix remember redirect_url on failed login attempts 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-04-25 09:38:19 +02:00
Morris Jobke
16c4755e03
Rename renderHTML to renderHtml 
* fixes #4383
* improves consistency

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-04-19 15:46:41 -05:00
Roeland Jago Douma
ad24b86013 Merge pull request #4350 from nextcloud/adjust-old-bruteforce-protection-annotations 
Adjust existing bruteforce protection code
 2017-04-19 09:27:23 +02:00
Lukas Reschke
805419bb95
Add bruteforce protection to changePersonalPassword 
While the risk is actually quite low because one would already have the user session and could potentially do other havoc it makes sense to throttle here in case of invalid previous password attempts.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-18 17:55:51 +02:00
Lukas Reschke
727688ebd9
Adjust existing bruteforce protection code 
- Moves code to annotation
- Adds the `throttle()` call on the responses on existing annotations

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-14 13:42:40 +02:00
Lukas Reschke
8149945a91
Make BruteForceProtection annotation more clever 
This makes the new `@BruteForceProtection` annotation more clever and moves the relevant code into it's own middleware.

Basically you can now set `@BruteForceProtection(action=$key)` as annotation and that will make the controller bruteforce protected. However, the difference to before is that you need to call `$responmse->throttle()` to increase the counter. Before the counter was increased every time which leads to all kind of unexpected problems.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-13 23:05:33 +02:00
Lukas Reschke
81d3732bf5 Merge pull request #4308 from nextcloud/lost-password-email 
Update email template for lost password email
 2017-04-13 20:02:15 +02:00
Morris Jobke
d36751ee38 Merge pull request #2424 from nextcloud/fix-login-controller-test-consolidate-login 
Fix login controller test and consolidate login
 2017-04-13 12:16:38 -05:00
Morris Jobke
7cb6038fca Merge pull request #3043 from nextcloud/issue-3038-no-logentry-on-email-login 
Dont create a log entry on email login
 2017-04-13 01:04:11 -05:00
Morris Jobke
1f962f9115
Update email template for lost password email 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-04-12 15:19:53 -05:00
Morris Jobke
5b4adf66e5
Move OC_Defaults to OCP\Defaults 
* currently there are two ways to access default values:
  OCP\Defaults or OC_Defaults (which is extended by
  OCA\Theming\ThemingDefaults)
* our code used a mixture of both of them, which made
  it hard to work on theme values
* this extended the public interface with the missing
  methods and uses them everywhere to only rely on the
  public interface

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-04-09 21:43:01 -05:00
Joas Schilling
7ad791efb4
Dont create a log entry on email login 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-04-07 10:15:20 +02:00
Arthur Schiwon
7b3fdfeeaa
do login routine only once when done via LoginController 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2017-04-06 15:22:42 +02:00
Arthur Schiwon
2994cbc586
fix login controller tests 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2017-04-06 15:20:17 +02:00
Roeland Jago Douma
6bdd3a167d Merge pull request #4123 from nextcloud/allow-password-reset-with-email 
Allow to reset the password with the email as an input
 2017-04-05 09:12:41 +02:00
Morris Jobke
9813023aab
Fix gzip files for Safari 
* Safari support gzip only if the filename does not
  end on .gz - so this renames them to .gzip

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-03-29 00:11:51 -06:00
Roeland Jago Douma
3a0ef65f33
Fix controller tests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-03-28 23:42:20 +02:00
Joas Schilling
4bae7ef96d
Allow to reset the password with the email as an input 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-03-28 21:17:37 +02:00
Roeland Jago Douma
677e11b1a4
Tests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-03-24 11:31:48 +01:00
Christoph Wurst
5e728d0eda oc_token should be nc_token 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-02-02 21:56:44 +01:00
Morris Jobke
5bad417e57 Merge pull request #2044 from nextcloud/login-credential-store 
Login credential store
 2017-01-30 19:30:04 -06:00
Bjoern Schiessle
5086335643
unify endpoints form core and the the provisioning api 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2017-01-25 11:20:35 +01:00
Morris Jobke
622101f2dd Merge pull request #2918 from nextcloud/encryption-recovery-improvements 
create new encryption keys on password reset and backup the old one
 2017-01-13 11:28:43 +01:00
Christoph Wurst
140555b786
always allow remembered login 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-01-11 19:20:11 +01:00
Christoph Wurst
243c9c0941
fix coding style and increase code coverage 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-01-11 11:01:54 +01:00
Cornelius Kölbel
b8d41752ca
Fix tests 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-01-11 11:01:54 +01:00
Bjoern Schiessle
fcda3a20f4
create new encryption keys on password reset and backup the old one 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2017-01-10 17:04:32 +01:00
Roeland Jago Douma
350b7ebc86
Adds CssControllerTests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-01-06 09:42:39 +01:00
Roeland Jago Douma
31a3e9847f
Adds user controller tests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-12-30 13:26:26 +01:00
Christoph Wurst
eff904473d
Set redirect_url on 2FA challenge page 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2016-12-23 20:53:26 +01:00
Morris Jobke
998f235474 Merge pull request #2563 from nextcloud/fix-password-reset 
fix password reset if encryption is enabled
 2016-12-22 11:18:04 +01:00
Bjoern Schiessle
16bbd3fd7c
fix password reset if encryption is enabled 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2016-12-08 12:08:05 +01:00
Joas Schilling
924358ef96
Save the timezone on login again 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-12-08 10:45:24 +01:00
Lukas Reschke
8bf4111368
Fix changing display names for subadmins 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2016-11-21 11:30:00 +01:00
Roeland Jago Douma
74c68d8761
Add OCSControllerTests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-11-16 19:49:51 +01:00
Morris Jobke
ac61f64190 Merge pull request #1109 from nextcloud/add-more-secrets-to-password-reset-link 
Use mail for encrypting the password reset token as well
 2016-11-03 22:11:43 +01:00
Roeland Jago Douma
dca9184a12
Fix tests 
* Tests fixed and controller coverage to 100%

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-11-03 19:08:56 +01:00
Lukas Reschke
6d686c213b
[WIP] Use mail for encrypting the password reset token as well 2016-11-03 14:27:26 +01:00
Roeland Jago Douma
9e6b26dcd0
Add cache 1 day cache to preview endpoint 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-11-03 14:00:33 +01:00
Roeland Jago Douma
55af6b45f7
More tests 
* PreviewController test
* PublicPreview test
* Versions Preview test
* Trash Preview test

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-11-03 14:00:33 +01:00
Christoph Wurst
d907666232
bring back remember-me 
* try to reuse the old session token for remember me login
* decrypt/encrypt token password and set the session id accordingly
* create remember-me cookies only if checkbox is checked and 2fa solved
* adjust db token cleanup to store remembered tokens longer
* adjust unit tests

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2016-11-02 13:39:16 +01:00
Joas Schilling
656e3f7a24
Check the mimetype before reading the content and catch exception 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-10-18 16:22:20 +02:00
Joas Schilling
a0b34dfd2f Merge pull request #1629 from nextcloud/cleanup-settings-application 
Cleanup settings Application class
 2016-10-06 16:57:39 +02:00
Joas Schilling
ed30b1f645
Use our base class everywhere 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-10-06 14:11:04 +02:00
Morris Jobke
c84dc6aa1c Properly catch password policy hint for personal page password changes 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2016-10-06 10:55:33 +02:00
Joas Schilling
a1e4b17ff4
Remove unused endpoint 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-09-30 10:21:08 +02:00
Joas Schilling
877cb06bfe
Use magic DI for core controllers 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-09-30 10:00:26 +02:00
Lukas Reschke
06fa486706 Merge pull request #1158 from nextcloud/cache_avatars 
Cache avatars
 2016-09-05 15:08:43 +02:00
Christoph Wurst
8acb734854
add 2fa backup codes app 
* add backup codes app unit tests
* add integration tests for the backup codes app
 2016-09-05 08:51:13 +02:00
Christoph Wurst
8e5c4c91fa check same URL in unit tests 2016-08-30 13:28:04 +02:00
Christoph Wurst
0a0c7a9b92 redirect to default app after solving the 2FA challenge 2016-08-30 11:10:45 +02:00
Roeland Jago Douma
6a85882f61
Fix tests 2016-08-30 09:00:22 +02:00
Morris Jobke
e341bde8b9 Merge pull request #1172 from nextcloud/core_cleanup 
Core controller cleanup
 2016-08-30 08:32:55 +02:00
Roeland Jago Douma
b1a090f357
AvatarController use proper JSONResponse 
* Do not rely on DataResponse magic. We want JSON so use JSON
* Fix tests
 2016-08-29 21:52:14 +02:00
Roeland Jago Douma
f6423f74e3
Minor cleanup in core Controllers 2016-08-29 21:52:09 +02:00
Christoph Wurst
291dd0bd31 redirect to 2fa provider if there's only one active for the user 2016-08-29 18:36:39 +02:00
Roeland Jago Douma
2f03853fb9
AvatarController cleanup 
* Use all DI components
* Let the AppFramework resolve the AvatarController
* Update unit tests
* Unit tests no longer require DB
 2016-08-25 21:39:14 +02:00
Joas Schilling
736e884e9a
Move the reset token to core app 2016-08-23 15:01:38 +02:00
Joas Schilling
139fb8de94
Remove "password reset token" after successful login 2016-08-23 12:54:45 +02:00
Roeland Jago Douma
789082e014
Add tests for ChangePasswordController 2016-08-17 10:21:18 +02:00
Roeland Jago Douma
87ac72d004
We have to mock the is_uploaded_file in the OC\Core\Controller namespace 2016-08-15 20:08:20 +02:00
Roeland Jago Douma
09f4ce4389
Fix mock call in AvatarControllerTest 2016-08-15 20:07:07 +02:00
Lukas Reschke
cf3cfca356
Use generated URL 2016-08-15 17:37:55 +02:00
Lukas Reschke
75d135d8d4
Fix tests for LoginController 2016-08-15 17:19:32 +02:00
Lukas Reschke
65d1472005
Don't use create mock 
Not compatible with this PHPunit version
 2016-08-15 17:08:27 +02:00
Lukas Reschke
72b5f9bfac
Use createMock instead of deprecated getMock 2016-08-11 15:22:29 +02:00
Lukas Reschke
9ca25e857c
Redirect users when already logged-in on login form 2016-08-11 15:22:29 +02:00
Lukas Reschke
c1589f163c
Mitigate race condition 2016-07-20 23:09:27 +02:00
Lukas Reschke
ba4f12baa0
Implement brute force protection 
Class Throttler implements the bruteforce protection for security actions in
Nextcloud.

It is working by logging invalid login attempts to the database and slowing
down all login attempts from the same subnet. The max delay is 30 seconds and
the starting delay are 200 milliseconds. (after the first failed login)
 2016-07-20 22:08:56 +02:00
Morris Jobke
2791b8f00d Revert "occ web executor (#24957)" 
This reverts commit 854352d9a0.
 2016-07-07 12:14:45 +02:00
VicDeo
854352d9a0 occ web executor (#24957) 
* Initial web executor

* Fix PHPDoc

Fix broken integration test

OccControllerTests do not require database access - moch them all!

Kill unused sprintf
 2016-06-22 13:12:36 +02:00
Thomas Müller
232d735893
Do not leak the login name - fixes #25047 2016-06-09 16:44:31 +02:00
Vincent Petry
7dcc47dc94 Merge pull request #25011 from owncloud/issue-24745-allow-to-cancel-2fa 
Allow to cancel 2FA after login
 2016-06-08 10:27:21 +02:00
Joas Schilling
3e3b326c85
Allow to cancel 2FA after login 2016-06-07 18:17:29 +02:00
Christoph Wurst
8f7a4aaa4d
do not generate device token if 2FA is enable for user 2016-06-07 09:09:51 +02:00