wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
44911 commits 157 branches 562 tags 714 MiB
Commit graph

143 commits

Author SHA1 Message Date
Joas Schilling
0828df5ed4
Disable the API endpoints as well 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-05-11 17:03:57 +02:00
Joas Schilling
d418ea550b
Automatic injection for CssController 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-05-10 09:42:40 +02:00
Joas Schilling
9c8fe82000
Automatic injection for JsController 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-05-10 09:42:15 +02:00
Mario Danic
e4aac15a92
Update login flow redirection 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-05-04 19:21:22 +02:00
Georg Ehrke
60f9ed6241
add contactsmenu popover 
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
 2017-04-26 09:26:53 +02:00
Jan-Christoph Borchardt
241e397326 Merge branch 'master' into contactsmenu 
Signed-off-by: Jan-Christoph Borchardt <hey@jancborchardt.net>
 2017-04-26 00:50:38 +02:00
Christoph Wurst
36cee1f386 Let apps register contact menu provider via info.xml 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-04-25 20:47:17 +02:00
Christoph Wurst
d091793ceb Contacts menu 
* load list of contacts from the server
* show last message of each contact

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-04-25 20:47:17 +02:00
Roeland Jago Douma
aae079aa29
AppToken to 72 chars 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-04-25 20:18:49 +02:00
Lukas Reschke
6a16df7288
Add new auth flow 
This implements the basics for the new app-password based authentication flow for our clients.
The current implementation tries to keep it as simple as possible and works the following way:

1. Unauthenticated client opens `/index.php/login/flow`
2. User will be asked whether they want to grant access to the client
3. If accepted the user has the chance to do so using existing App Token or automatically generate an app password.

If the user chooses to use an existing app token then that one will simply be redirected to the `nc://` protocol handler.
While we can improve on that in the future, I think keeping this smaller at the moment has its advantages. Also, in the
near future we have to think about an automatic migration endpoint so there's that anyways :-)

If the user chooses to use the regular login the following happens:

1. A session state token is written to the session
2. User is redirected to the login page
3. If successfully authenticated they will be redirected to a page redirecting to the POST controller
4. The POST controller will check if the CSRF token as well as the state token is correct, if yes the user will be redirected to the `nc://` protocol handler.

This approach is quite simple but also allows to be extended in the future. One could for example allow external websites to consume this authentication endpoint as well.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-25 20:18:49 +02:00
Christoph Wurst
bb1d191f82
Fix remember redirect_url on failed login attempts 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-04-25 09:38:19 +02:00
Morris Jobke
16c4755e03
Rename renderHTML to renderHtml 
* fixes #4383
* improves consistency

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-04-19 15:46:41 -05:00
Roeland Jago Douma
ad24b86013 Merge pull request #4350 from nextcloud/adjust-old-bruteforce-protection-annotations 
Adjust existing bruteforce protection code
 2017-04-19 09:27:23 +02:00
Lukas Reschke
805419bb95
Add bruteforce protection to changePersonalPassword 
While the risk is actually quite low because one would already have the user session and could potentially do other havoc it makes sense to throttle here in case of invalid previous password attempts.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-18 17:55:51 +02:00
Lukas Reschke
727688ebd9
Adjust existing bruteforce protection code 
- Moves code to annotation
- Adds the `throttle()` call on the responses on existing annotations

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-14 13:42:40 +02:00
Lukas Reschke
8149945a91
Make BruteForceProtection annotation more clever 
This makes the new `@BruteForceProtection` annotation more clever and moves the relevant code into it's own middleware.

Basically you can now set `@BruteForceProtection(action=$key)` as annotation and that will make the controller bruteforce protected. However, the difference to before is that you need to call `$responmse->throttle()` to increase the counter. Before the counter was increased every time which leads to all kind of unexpected problems.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-13 23:05:33 +02:00
Lukas Reschke
81d3732bf5 Merge pull request #4308 from nextcloud/lost-password-email 
Update email template for lost password email
 2017-04-13 20:02:15 +02:00
Morris Jobke
d36751ee38 Merge pull request #2424 from nextcloud/fix-login-controller-test-consolidate-login 
Fix login controller test and consolidate login
 2017-04-13 12:16:38 -05:00
Morris Jobke
7cb6038fca Merge pull request #3043 from nextcloud/issue-3038-no-logentry-on-email-login 
Dont create a log entry on email login
 2017-04-13 01:04:11 -05:00
Morris Jobke
1f962f9115
Update email template for lost password email 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-04-12 15:19:53 -05:00
Morris Jobke
5b4adf66e5
Move OC_Defaults to OCP\Defaults 
* currently there are two ways to access default values:
  OCP\Defaults or OC_Defaults (which is extended by
  OCA\Theming\ThemingDefaults)
* our code used a mixture of both of them, which made
  it hard to work on theme values
* this extended the public interface with the missing
  methods and uses them everywhere to only rely on the
  public interface

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-04-09 21:43:01 -05:00
Joas Schilling
7ad791efb4
Dont create a log entry on email login 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-04-07 10:15:20 +02:00
Arthur Schiwon
7b3fdfeeaa
do login routine only once when done via LoginController 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2017-04-06 15:22:42 +02:00
Arthur Schiwon
2994cbc586
fix login controller tests 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2017-04-06 15:20:17 +02:00
Roeland Jago Douma
6bdd3a167d Merge pull request #4123 from nextcloud/allow-password-reset-with-email 
Allow to reset the password with the email as an input
 2017-04-05 09:12:41 +02:00
Morris Jobke
9813023aab
Fix gzip files for Safari 
* Safari support gzip only if the filename does not
  end on .gz - so this renames them to .gzip

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-03-29 00:11:51 -06:00
Roeland Jago Douma
3a0ef65f33
Fix controller tests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-03-28 23:42:20 +02:00
Joas Schilling
4bae7ef96d
Allow to reset the password with the email as an input 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-03-28 21:17:37 +02:00
Roeland Jago Douma
677e11b1a4
Tests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-03-24 11:31:48 +01:00
Christoph Wurst
5e728d0eda oc_token should be nc_token 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-02-02 21:56:44 +01:00
Morris Jobke
5bad417e57 Merge pull request #2044 from nextcloud/login-credential-store 
Login credential store
 2017-01-30 19:30:04 -06:00
Bjoern Schiessle
5086335643
unify endpoints form core and the the provisioning api 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2017-01-25 11:20:35 +01:00
Morris Jobke
622101f2dd Merge pull request #2918 from nextcloud/encryption-recovery-improvements 
create new encryption keys on password reset and backup the old one
 2017-01-13 11:28:43 +01:00
Christoph Wurst
140555b786
always allow remembered login 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-01-11 19:20:11 +01:00
Christoph Wurst
243c9c0941
fix coding style and increase code coverage 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-01-11 11:01:54 +01:00
Cornelius Kölbel
b8d41752ca
Fix tests 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-01-11 11:01:54 +01:00
Bjoern Schiessle
fcda3a20f4
create new encryption keys on password reset and backup the old one 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2017-01-10 17:04:32 +01:00
Roeland Jago Douma
350b7ebc86
Adds CssControllerTests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-01-06 09:42:39 +01:00
Roeland Jago Douma
31a3e9847f
Adds user controller tests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-12-30 13:26:26 +01:00
Christoph Wurst
eff904473d
Set redirect_url on 2FA challenge page 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2016-12-23 20:53:26 +01:00
Morris Jobke
998f235474 Merge pull request #2563 from nextcloud/fix-password-reset 
fix password reset if encryption is enabled
 2016-12-22 11:18:04 +01:00
Bjoern Schiessle
16bbd3fd7c
fix password reset if encryption is enabled 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2016-12-08 12:08:05 +01:00
Joas Schilling
924358ef96
Save the timezone on login again 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-12-08 10:45:24 +01:00
Lukas Reschke
8bf4111368
Fix changing display names for subadmins 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2016-11-21 11:30:00 +01:00
Roeland Jago Douma
74c68d8761
Add OCSControllerTests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-11-16 19:49:51 +01:00
Morris Jobke
ac61f64190 Merge pull request #1109 from nextcloud/add-more-secrets-to-password-reset-link 
Use mail for encrypting the password reset token as well
 2016-11-03 22:11:43 +01:00
Roeland Jago Douma
dca9184a12
Fix tests 
* Tests fixed and controller coverage to 100%

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-11-03 19:08:56 +01:00
Lukas Reschke
6d686c213b
[WIP] Use mail for encrypting the password reset token as well 2016-11-03 14:27:26 +01:00
Roeland Jago Douma
9e6b26dcd0
Add cache 1 day cache to preview endpoint 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-11-03 14:00:33 +01:00
Roeland Jago Douma
55af6b45f7
More tests 
* PreviewController test
* PublicPreview test
* Versions Preview test
* Trash Preview test

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-11-03 14:00:33 +01:00
Christoph Wurst
d907666232
bring back remember-me 
* try to reuse the old session token for remember me login
* decrypt/encrypt token password and set the session id accordingly
* create remember-me cookies only if checkbox is checked and 2fa solved
* adjust db token cleanup to store remembered tokens longer
* adjust unit tests

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2016-11-02 13:39:16 +01:00
Joas Schilling
656e3f7a24
Check the mimetype before reading the content and catch exception 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-10-18 16:22:20 +02:00
Joas Schilling
a0b34dfd2f Merge pull request #1629 from nextcloud/cleanup-settings-application 
Cleanup settings Application class
 2016-10-06 16:57:39 +02:00
Joas Schilling
ed30b1f645
Use our base class everywhere 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-10-06 14:11:04 +02:00
Morris Jobke
c84dc6aa1c Properly catch password policy hint for personal page password changes 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2016-10-06 10:55:33 +02:00
Joas Schilling
a1e4b17ff4
Remove unused endpoint 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-09-30 10:21:08 +02:00
Joas Schilling
877cb06bfe
Use magic DI for core controllers 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-09-30 10:00:26 +02:00
Lukas Reschke
06fa486706 Merge pull request #1158 from nextcloud/cache_avatars 
Cache avatars
 2016-09-05 15:08:43 +02:00
Christoph Wurst
8acb734854
add 2fa backup codes app 
* add backup codes app unit tests
* add integration tests for the backup codes app
 2016-09-05 08:51:13 +02:00
Christoph Wurst
8e5c4c91fa check same URL in unit tests 2016-08-30 13:28:04 +02:00
Christoph Wurst
0a0c7a9b92 redirect to default app after solving the 2FA challenge 2016-08-30 11:10:45 +02:00
Roeland Jago Douma
6a85882f61
Fix tests 2016-08-30 09:00:22 +02:00
Morris Jobke
e341bde8b9 Merge pull request #1172 from nextcloud/core_cleanup 
Core controller cleanup
 2016-08-30 08:32:55 +02:00
Roeland Jago Douma
b1a090f357
AvatarController use proper JSONResponse 
* Do not rely on DataResponse magic. We want JSON so use JSON
* Fix tests
 2016-08-29 21:52:14 +02:00
Roeland Jago Douma
f6423f74e3
Minor cleanup in core Controllers 2016-08-29 21:52:09 +02:00
Christoph Wurst
291dd0bd31 redirect to 2fa provider if there's only one active for the user 2016-08-29 18:36:39 +02:00
Roeland Jago Douma
2f03853fb9
AvatarController cleanup 
* Use all DI components
* Let the AppFramework resolve the AvatarController
* Update unit tests
* Unit tests no longer require DB
 2016-08-25 21:39:14 +02:00
Joas Schilling
736e884e9a
Move the reset token to core app 2016-08-23 15:01:38 +02:00
Joas Schilling
139fb8de94
Remove "password reset token" after successful login 2016-08-23 12:54:45 +02:00
Roeland Jago Douma
789082e014
Add tests for ChangePasswordController 2016-08-17 10:21:18 +02:00
Roeland Jago Douma
87ac72d004
We have to mock the is_uploaded_file in the OC\Core\Controller namespace 2016-08-15 20:08:20 +02:00
Roeland Jago Douma
09f4ce4389
Fix mock call in AvatarControllerTest 2016-08-15 20:07:07 +02:00
Lukas Reschke
cf3cfca356
Use generated URL 2016-08-15 17:37:55 +02:00
Lukas Reschke
75d135d8d4
Fix tests for LoginController 2016-08-15 17:19:32 +02:00
Lukas Reschke
65d1472005
Don't use create mock 
Not compatible with this PHPunit version
 2016-08-15 17:08:27 +02:00
Lukas Reschke
72b5f9bfac
Use createMock instead of deprecated getMock 2016-08-11 15:22:29 +02:00
Lukas Reschke
9ca25e857c
Redirect users when already logged-in on login form 2016-08-11 15:22:29 +02:00
Lukas Reschke
c1589f163c
Mitigate race condition 2016-07-20 23:09:27 +02:00
Lukas Reschke
ba4f12baa0
Implement brute force protection 
Class Throttler implements the bruteforce protection for security actions in
Nextcloud.

It is working by logging invalid login attempts to the database and slowing
down all login attempts from the same subnet. The max delay is 30 seconds and
the starting delay are 200 milliseconds. (after the first failed login)
 2016-07-20 22:08:56 +02:00
Morris Jobke
2791b8f00d Revert "occ web executor (#24957)" 
This reverts commit 854352d9a0.
 2016-07-07 12:14:45 +02:00
VicDeo
854352d9a0 occ web executor (#24957) 
* Initial web executor

* Fix PHPDoc

Fix broken integration test

OccControllerTests do not require database access - moch them all!

Kill unused sprintf
 2016-06-22 13:12:36 +02:00
Thomas Müller
232d735893
Do not leak the login name - fixes #25047 2016-06-09 16:44:31 +02:00
Vincent Petry
7dcc47dc94 Merge pull request #25011 from owncloud/issue-24745-allow-to-cancel-2fa 
Allow to cancel 2FA after login
 2016-06-08 10:27:21 +02:00
Joas Schilling
3e3b326c85
Allow to cancel 2FA after login 2016-06-07 18:17:29 +02:00
Christoph Wurst
8f7a4aaa4d
do not generate device token if 2FA is enable for user 2016-06-07 09:09:51 +02:00
Christoph Wurst
5e71d23ded
remember redirect_url when solving the 2FA challenge 2016-06-01 14:43:47 +02:00
Vincent Petry
7f20203006 Merge pull request #24836 from owncloud/auth-tests-to-psr4 
Move parallel merged auth tests to PSR-4
 2016-05-25 15:15:19 +02:00
Joas Schilling
8afbd80328
Move parallel merged auth tests to PSR-4 2016-05-25 12:02:05 +02:00
Vincent Petry
25e6026fa6 Merge pull request #24735 from juliushaertl/passwordreset-invalid 
Show error messages if a password reset link is invalid or expired
 2016-05-25 11:08:46 +02:00
Christoph Wurst
ad10485cec
when generating browser/device token, save the login name for later password checks 2016-05-24 11:49:15 +02:00
Julius Haertl
d065980814 Add more tests for OC\Core\Controller\LostController 
- remove testResetFormUnsuccessful as it is now splitted up in different test cases
- add testResetFormInvalidToken to check if timestamp and token are present
- add testResetFormInvalidTokenMatch to check if the saved token matches the provided
- add testResetFormExpiredToken to check if expiration detection works
- add testResetFormValidToken to check if detection of valid tokens works
 2016-05-23 16:48:10 +02:00
Christoph Wurst
dfb4d426c2
Add two factor auth to core 2016-05-23 11:21:10 +02:00
Joas Schilling
392bc0c6b9
Move tests/core/ to PSR-4 2016-05-19 11:18:25 +02:00