wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
50364 commits 157 branches 562 tags 714 MiB
Commit graph

354 commits

Author SHA1 Message Date
Roeland Jago Douma
d0397f9b53
Generic message on password reset 
There is no need to inform the user if the account existed or not.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-01-15 15:53:43 +01:00
Christoph Wurst
208788173d
Npmize (vendor) scripts 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2019-01-09 15:01:59 +01:00
Roeland Jago Douma
e6ac233947
Fix loginflow with apptoken enter on iOS 
It seems iOS doesn't like us to change the location. So now we submit it
to the server that geneartes the redirect.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-01-04 21:51:36 +01:00
Roeland Jago Douma
763b52d402
Fix SAML Client login flow on Apple devices 
Because the redirect from the SAML/SSO endpoint is a POST the lax/strict
cookies are not properly send.

Note that it is not strictly requried on this endpoint as we do not need
the remember me data. Only the real session info is enough. The endpoint
is also already protected by a state token.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-12-17 12:50:32 +01:00
John Molakvoæ (skjnldsv)
5e4990fadd
Remove redirect page 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2018-11-29 10:27:22 +01:00
Roeland Jago Douma
43d6ae7476
Respect the disabled setting for lost_password_link 
Fixes #11146
As documented when it is set to disabled the user can't request a lost
password.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-11-20 13:28:40 +01:00
Roeland Jago Douma
92582a350d
Use the proper server for the apptoken flow login 
If a user can't authenticate normally (because they have 2FA that is not
available on their devices for example). The redirect that is generated
should be of the proper format.

This means

1. Include the protocol
2. Include the possible subfolder

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-11-01 11:45:35 +01:00
Rayn0r
85eb43baff added possibility to disable autocomplete in login form 
Signed-off-by: Rayn0r <Andre.Weidemann@web.de>
 2018-10-30 11:36:16 +01:00
Julius Härtl
d21ded67a7
Keep list of icons in a separate file for use in the accessibility app 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2018-10-25 12:16:10 +02:00
Morris Jobke
e0f9257be9
Merge pull request #11847 from iPaat/Fix/DeleteCookiesThroughClearSiteData 
Remove cookies from Clear-Site-Data Header
 2018-10-23 17:04:45 +02:00
Thomas Citharel
d63de5471b Don't require Same Site Cookies on assets 
Which can be used for public iframe embeeding

See https://github.com/nextcloud/calendar/issues/169

Signed-off-by: Thomas Citharel <tcit@tcit.fr>
 2018-10-17 09:24:21 +02:00
Patrick Conrad
1806baaeaf
Remove cookies from Clear-Site-Data Header 
In 2f87fb6b45 this header was introduced. The referenced documentation says:

> When delivered with a response from https://example.com/clear, the following header will cause cookies associated with the origin https://example.com to be cleared, as well as cookies on any origin in the same registered domain (e.g. https://www.example.com/ and https://more.subdomains.example.com/).

This also applies if `https://nextcloud.example.com/` sends the `Clear-Site-Data: "cookies"` header.
This is not the behavior we want at this point!

So I removed the deletion of cookies from the header. This has no effect on the logout process as this header is supported only recently and the logout works in old browsers as well.

Signed-off-by: Patrick Conrad <conrad@iza.org>
 2018-10-15 14:46:06 +02:00
Morris Jobke
7971ba5cc6
Merge pull request #10898 from nextcloud/feature/10684/default-logo-color-theme-colors 
Switches the default logo color depending on the primary color
 2018-10-08 10:33:22 +02:00
Roeland Jago Douma
78273cb1e6
Add an endppoint for clients to request an app password 
Now that we allow enforcing 2 factor auth it make sense if we also allow
and endpoint where the clients can in the background fetch an
apppassword if they were configured before the login flow was present.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-10-03 19:05:20 +02:00
Roeland Jago Douma
d9febae5b2
Update all the publickey tokens if needed on web login 
* On weblogin check if we have invalid public key tokens
* If so update them all with the new token

This ensures that your marked as invalid tokens work again if you once
login on the web.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-10-02 19:50:54 +02:00
Michael Weimann
a45ec3d324
Refactors the scss svg functions 
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
 2018-10-02 08:37:55 +02:00
Michael Weimann
d855c38e07
Moves the logo files to logo 
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
 2018-10-02 08:37:54 +02:00
blizzz
ef97ef72f6
Merge pull request #10743 from danielkesselberg/bugfix/noid/allow-password-reset-for-duplicate-email 
Enable password reset for user with same email address when only one is active
 2018-09-13 10:48:30 +02:00
Roeland Jago Douma
be2d8cc4e9
Do not invalidate main token on OAuth 
Fixes #10584

We deleted the main token when using the login flow else mutliple tokens
would show up for a single user.

However in the case of OAuth this is perfectly fine as the
authentication happens really in your browser:

1. You are already logged in, no need to log you out
2. You are not logged in yet, but since you log in into the exact same
browser the expected behavior is to stay logged in.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-09-06 08:30:52 +02:00
Morris Jobke
cf3f4888cc
Change password expiration time from 12h to 7d 
We use the same logic for creating accounts without a password and there the 12h is a bit short. Users don't expect that the signup link needs to be clicked within 12h - 7d should be a more expected behavior.

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2018-08-31 13:31:03 +02:00
Morris Jobke
6099786c8d
Merge pull request #10670 from nextcloud/fix/login-throttle-username-length 
Fix max length requirements for the throttler metadata
 2018-08-24 16:25:35 +02:00
Daniel Kesselberg
031fdfb1fc
Enable password reset for user with same email address when only one is active 
When two or more user share the same email address its not possible to
reset password by email. Even when only one account is active.

This pr reduce list of users returned by getByEmail by disabled users.

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
 2018-08-19 16:32:46 +02:00
Bjoern Schiessle
dfec66ca02
only warn about data lose on password reset if per-user keys are used 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2018-08-15 15:08:34 +02:00
Christoph Wurst
42300d19e9
Fix max length requirements for the throttler metadata 
If a failed login is logged, we save the username as metadata
in the bruteforce throttler. To prevent database error due to
very long strings, this truncates the username at 64 bytes in
the assumption that no real username is longer than that.long strings,

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2018-08-13 15:52:09 +02:00
Christoph Wurst
d8197f2b97
Rename providerset method to get primary providers 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2018-08-08 20:28:21 +02:00
Christoph Wurst
c6e47e8a51
Fix login redirection if only one 2FA provider is active 
Fixes https://github.com/nextcloud/server/issues/10500.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2018-08-08 15:25:59 +02:00
Joas Schilling
decd196162
Make the info available if the avatar was uploaded or generated 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2018-08-01 10:56:22 +02:00
Morris Jobke
70fa73404f
Merge pull request #10391 from nextcloud/bugfix/10389/fix-app-navigation-controller 
Fix app navigation controller to return an array
 2018-07-25 14:11:49 +02:00
Julius Härtl
4c773891d7
Fix app navigation controller to return an array 
This is required to not break compatibility with existing consumers of that endpoint like the apps management or the client

Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2018-07-25 13:50:46 +02:00
Joas Schilling
12efde520d
Allow to access SVGs as guest 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2018-07-25 12:05:18 +02:00
Michael Weimann
c92d7429d7 Implements handling for deactivated users 
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
 2018-07-21 13:05:13 +02:00
John Molakvoæ (skjnldsv)
37a4d2bbbc
Php code bump 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2018-07-19 22:46:32 +02:00
Julius Härtl
bfc6fc8e50
Fix settings icon fetching 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2018-07-19 08:17:00 +02:00
John Molakvoæ (skjnldsv)
61946819ba
Fixed svg generator regex && added missing icons 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2018-07-19 08:16:59 +02:00
John Molakvoæ (skjnldsv)
9e5885963c
Fixed icons detection and caching 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2018-07-19 08:16:58 +02:00
John Molakvoæ (skjnldsv)
8977c71f88
Mixin scss icon api 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2018-07-19 08:16:58 +02:00
John Molakvoæ (skjnldsv)
ccd70a4099
use built in response cacheFor function 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2018-07-19 08:16:58 +02:00
John Molakvoæ (skjnldsv)
29ff7efe9a
Svg icon api sass function and upgrade of all styles 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2018-07-19 08:16:57 +02:00
John Molakvoæ (skjnldsv)
98a0113d40
Svg from app 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2018-07-19 08:16:30 +02:00
John Molakvoæ (skjnldsv)
84e90e26c0
Svg color api 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2018-07-19 08:16:30 +02:00
Arthur Schiwon
ca6094f390
wire the frontend 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2018-07-05 20:29:00 +02:00
Arthur Schiwon
772bbd99be
Backend work to provide NC whats New info to users 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2018-07-05 14:33:08 +02:00
Morris Jobke
9444a3fad1
Merge pull request #9632 from nextcloud/enhancement/stateful-2fa-providers 
Stateful 2fa providers
 2018-06-25 15:49:58 +02:00
Robin Appelman
8ed50d4b63
prefill userid for login after password reset 
Signed-off-by: Robin Appelman <robin@icewind.nl>
 2018-06-21 15:18:07 +02:00
Christoph Wurst
13d93f5b25
Make 2FA providers stateful 
This adds persistence to the Nextcloud server 2FA logic so that the server
knows which 2FA providers are enabled for a specific user at any time, even
when the provider is not available.

The `IStatefulProvider` interface was added as tagging interface for providers
that are compatible with this new API.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2018-06-20 08:30:26 +02:00
John Molakvoæ (skjnldsv)
543188d0cb
Removed debug stack 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2018-06-15 15:40:10 +02:00
John Molakvoæ (skjnldsv)
156da29cea
Avatar imagick bump 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2018-06-13 18:46:05 +02:00
John Molakvoæ (skjnldsv)
eea6f74ca4
Controller tests fixes 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2018-06-13 18:46:04 +02:00
John Molakvoæ (skjnldsv)
adf3856d35
Return Svg avatars 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2018-06-13 18:46:04 +02:00
Roeland Jago Douma
e5cc8be9d5
Fix usage 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-06-04 08:48:54 +02:00
Morris Jobke
245d20f9ac
Merge pull request #9531 from remyj38/master 
Fix translation bug on lost password page
 2018-05-22 16:31:30 +02:00
Roeland Jago Douma
5a97148863
Don't use special chars to avoid confusion 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-05-22 09:24:17 +02:00
Rémy Jacquin
04e1cab5ee
Fix translation bug on lost password page 
Fix nextcloud/password_policy#26

Signed-off-by: Rémy Jacquin <remy@remyj.fr>
 2018-05-20 12:51:50 +02:00
Arthur Schiwon
38a90130ce
move log constants to ILogger 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2018-04-26 10:45:52 +02:00
Roeland Jago Douma
a07f6d46e3
Use proper types 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-04-11 00:21:25 +02:00
Morris Jobke
fd3c97b93b
Avoid to leak a user ID that is not a string to reach a user backend 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2018-04-11 00:03:30 +02:00
Roeland Jago Douma
b2350810e0
Merge pull request #9115 from nextcloud/feature/noid/login_flow_wording 
Improve login flow
 2018-04-09 08:45:27 +02:00
Roeland Jago Douma
177c8972cc
Improve login flow 
* Add page explaining you are about to grant access
* Show grant access page after login

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-04-08 13:42:36 +02:00
Roeland Jago Douma
33b93db953
Remove unused parameter 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-04-06 21:44:23 +02:00
Roeland Jago Douma
2b7d4d5069
Fix tests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-04-06 19:58:37 +02:00
Roeland Jago Douma
caee215120
Always remember me 
Fixes #8004

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-04-06 15:44:28 +02:00
Joas Schilling
dabd7291c3
Make the new autocomplete endpoint OCS 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2018-03-21 09:46:52 +01:00
Roeland Jago Douma
796b4f19f8
Add Cache-control: immutable 
Cache generated CSS forever!
Also cache combined JS forever
Fix tests

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-03-19 14:21:53 +01:00
Roeland Jago Douma
7674e591bd
Move search to proper Controller 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-03-09 14:36:48 +01:00
Christoph Wurst
b9720703e8 Add CSRF token controller to retrieve the current CSRF token 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2018-03-08 16:48:50 +01:00
Julius Härtl
11b6cc3f68
Replace logout href to avoid new etag on every request 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2018-03-06 09:51:28 +01:00
Julius Härtl
723b8764d1
Add ETag to NavigationController 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2018-03-05 12:19:20 +01:00
Bjoern Schiessle
7d0102bf73
expose capabilities in js 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2018-02-27 12:29:25 +01:00
Joas Schilling
226e63695f
Merge pull request #8026 from nextcloud/feature/noid/allow-custom-html-in-html-emails 
Allow custom HTML in HTML Emails
 2018-02-26 13:38:39 +01:00
Arthur Schiwon
ffc05e2fed
don't try login with the same name that just failed 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2018-02-22 13:05:48 +01:00
Roeland Jago Douma
cf83eb5e77
Merge pull request #8336 from nextcloud/cleanup-unused-parameter 
Cleanup unused parameter
 2018-02-20 10:16:59 +01:00
Morris Jobke
14bc9b1714
Merge pull request #8095 from nextcloud/webapps-capabilities 
Expose navigation entries as API endpoint
 2018-02-15 16:55:12 +01:00
Joas Schilling
339e320064
Fix existing usages 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2018-02-15 12:18:51 +01:00
Morris Jobke
d3d045dd5c
Remove unused import statements 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2018-02-14 16:55:43 +01:00
Morris Jobke
bcf1668cc8
Remove config from AutoCompleteController 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2018-02-13 21:40:30 +01:00
Julius Härtl
5a23b35ddb
Also rewrite icon url 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2018-02-12 21:20:21 +01:00
Julius Härtl
922cf44c81
Move to OCS endpoint 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2018-02-12 17:22:33 +01:00
Julius Härtl
8ecac56543
Allow requesting absolute URLs 
They might be useful when requesting the navigation from the clients

Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2018-02-12 17:22:32 +01:00
Julius Härtl
6211d18dc1
Add tests for NavigationController 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2018-02-12 17:22:32 +01:00
Julius Härtl
96480af159
Add navigation endpoint 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2018-02-12 17:22:32 +01:00
Roeland Jago Douma
0224c61530
Add preview endpoint for the fileid 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-01-24 11:24:18 +01:00
Morris Jobke
3d4c698f44
Improve OC_Image code to not guess the type of input, but actually request the specific methods to be called 
Followup to #7836

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2018-01-18 13:40:55 +01:00
Morris Jobke
4ef302c0be
Request->getHeader() should always return a string 
PHPDoc (of the public API) says that this method returns string but it also returns null, which is not allowed in some method calls. This fixes that behaviour and returns an empty string and fixes all code paths that explicitly checked for null to be still compliant.

Found while enabling the strict_typing for lib/private for the PHP7+ migration.

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2018-01-17 09:51:31 +01:00
Roeland Jago Douma
7cab7feb38
Display message when connection is throttled on logi page 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-01-15 21:43:09 +01:00
Mario Danic
cc742ce9e7
Fix bug with proxies 
Signed-off-by: Mario Danic <mario@lovelyhq.com>
 2018-01-15 00:50:49 +01:00
Morris Jobke
68e205e827
Merge pull request #7712 from nextcloud/jsconfig_l10n 
Use correct L10N files for jsconfig
 2018-01-05 15:22:10 +01:00
Roeland Jago Douma
30ac28f950
Use correct L10N files for jsconfig 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-01-05 14:33:03 +01:00
Roeland Jago Douma
82f03e1314
Clear login token once apppassword is generated 
Fixes #7697

When using the new login flow a token will be generated since we login.
However after that we generate yet another token to return (as we
should).

However we should kill the current session token as we are done with it.
And will never use it again.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-01-04 14:30:40 +01:00
Arthur Schiwon
4f3d52a364
never translate login names when requiring with a user id 
where appropriate, the preLoginNameUsedAsUserName hook should be thrown.

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2018-01-03 13:25:00 +01:00
Julius Härtl
f5f6ed664d
Hide stay logged in checkbox when flow authentication is used 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2017-12-28 11:15:26 +01:00
Roeland Jago Douma
c1fcd6fc98
Merge pull request #7324 from nextcloud/no-sorters-no-instances 
don't create sorter instances when none was requested
 2017-12-11 15:27:44 +01:00
Morris Jobke
ed7beb929e
Merge pull request #6876 from nextcloud/always_img_avatar 
Always generate avatar
 2017-12-08 23:58:17 +01:00
Roeland Jago Douma
ba648eecdf
Move avatar code to Avatar Class 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-11-29 14:23:15 +01:00
Roeland Jago Douma
604596ec16
Always generate avatar 
Even if no avatar is set we should just generate the image. This to not
duplicate the code on all the clients. And only server images from the
avtar endpoint.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-11-29 14:23:15 +01:00
Arthur Schiwon
96bc03a03a
don't create sorter instances when none was requested 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2017-11-28 13:30:51 +01:00
Mario Danic
c2cd5fc5d3 Fix flow 
Signed-off-by: Mario Danic <mario@lovelyhq.com>
 2017-11-09 00:29:34 +01:00
Julius Härtl
cd1bfea8c4
Theming: theme flow redirection page 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2017-11-08 14:56:32 +01:00
Morris Jobke
31c5c2a592
Change @georgehrke's email 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-11-06 20:38:59 +01:00
Morris Jobke
0eebff152a
Update license headers 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-11-06 16:56:19 +01:00
Roeland Jago Douma
6ce095b166
Add 204 endpoint 
Fixes #6967

This allows clients to check for Walled Garden connections.
The endpoint just responds with a 204 (which is very unlikely with such
a connection)

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-11-02 10:30:16 +01:00