wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
50364 commits 157 branches 562 tags 714 MiB
Commit graph

354 commits

Author SHA1 Message Date
Morris Jobke
245d20f9ac
Merge pull request #9531 from remyj38/master 
Fix translation bug on lost password page
 2018-05-22 16:31:30 +02:00
Roeland Jago Douma
5a97148863
Don't use special chars to avoid confusion 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-05-22 09:24:17 +02:00
Rémy Jacquin
04e1cab5ee
Fix translation bug on lost password page 
Fix nextcloud/password_policy#26

Signed-off-by: Rémy Jacquin <remy@remyj.fr>
 2018-05-20 12:51:50 +02:00
Arthur Schiwon
38a90130ce
move log constants to ILogger 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2018-04-26 10:45:52 +02:00
Roeland Jago Douma
a07f6d46e3
Use proper types 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-04-11 00:21:25 +02:00
Morris Jobke
fd3c97b93b
Avoid to leak a user ID that is not a string to reach a user backend 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2018-04-11 00:03:30 +02:00
Roeland Jago Douma
b2350810e0
Merge pull request #9115 from nextcloud/feature/noid/login_flow_wording 
Improve login flow
 2018-04-09 08:45:27 +02:00
Roeland Jago Douma
177c8972cc
Improve login flow 
* Add page explaining you are about to grant access
* Show grant access page after login

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-04-08 13:42:36 +02:00
Roeland Jago Douma
33b93db953
Remove unused parameter 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-04-06 21:44:23 +02:00
Roeland Jago Douma
2b7d4d5069
Fix tests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-04-06 19:58:37 +02:00
Roeland Jago Douma
caee215120
Always remember me 
Fixes #8004

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-04-06 15:44:28 +02:00
Joas Schilling
dabd7291c3
Make the new autocomplete endpoint OCS 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2018-03-21 09:46:52 +01:00
Roeland Jago Douma
796b4f19f8
Add Cache-control: immutable 
Cache generated CSS forever!
Also cache combined JS forever
Fix tests

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-03-19 14:21:53 +01:00
Roeland Jago Douma
7674e591bd
Move search to proper Controller 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-03-09 14:36:48 +01:00
Christoph Wurst
b9720703e8 Add CSRF token controller to retrieve the current CSRF token 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2018-03-08 16:48:50 +01:00
Julius Härtl
11b6cc3f68
Replace logout href to avoid new etag on every request 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2018-03-06 09:51:28 +01:00
Julius Härtl
723b8764d1
Add ETag to NavigationController 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2018-03-05 12:19:20 +01:00
Bjoern Schiessle
7d0102bf73
expose capabilities in js 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2018-02-27 12:29:25 +01:00
Joas Schilling
226e63695f
Merge pull request #8026 from nextcloud/feature/noid/allow-custom-html-in-html-emails 
Allow custom HTML in HTML Emails
 2018-02-26 13:38:39 +01:00
Arthur Schiwon
ffc05e2fed
don't try login with the same name that just failed 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2018-02-22 13:05:48 +01:00
Roeland Jago Douma
cf83eb5e77
Merge pull request #8336 from nextcloud/cleanup-unused-parameter 
Cleanup unused parameter
 2018-02-20 10:16:59 +01:00
Morris Jobke
14bc9b1714
Merge pull request #8095 from nextcloud/webapps-capabilities 
Expose navigation entries as API endpoint
 2018-02-15 16:55:12 +01:00
Joas Schilling
339e320064
Fix existing usages 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2018-02-15 12:18:51 +01:00
Morris Jobke
d3d045dd5c
Remove unused import statements 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2018-02-14 16:55:43 +01:00
Morris Jobke
bcf1668cc8
Remove config from AutoCompleteController 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2018-02-13 21:40:30 +01:00
Julius Härtl
5a23b35ddb
Also rewrite icon url 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2018-02-12 21:20:21 +01:00
Julius Härtl
922cf44c81
Move to OCS endpoint 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2018-02-12 17:22:33 +01:00
Julius Härtl
8ecac56543
Allow requesting absolute URLs 
They might be useful when requesting the navigation from the clients

Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2018-02-12 17:22:32 +01:00
Julius Härtl
6211d18dc1
Add tests for NavigationController 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2018-02-12 17:22:32 +01:00
Julius Härtl
96480af159
Add navigation endpoint 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2018-02-12 17:22:32 +01:00
Roeland Jago Douma
0224c61530
Add preview endpoint for the fileid 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-01-24 11:24:18 +01:00
Morris Jobke
3d4c698f44
Improve OC_Image code to not guess the type of input, but actually request the specific methods to be called 
Followup to #7836

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2018-01-18 13:40:55 +01:00
Morris Jobke
4ef302c0be
Request->getHeader() should always return a string 
PHPDoc (of the public API) says that this method returns string but it also returns null, which is not allowed in some method calls. This fixes that behaviour and returns an empty string and fixes all code paths that explicitly checked for null to be still compliant.

Found while enabling the strict_typing for lib/private for the PHP7+ migration.

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2018-01-17 09:51:31 +01:00
Roeland Jago Douma
7cab7feb38
Display message when connection is throttled on logi page 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-01-15 21:43:09 +01:00
Mario Danic
cc742ce9e7
Fix bug with proxies 
Signed-off-by: Mario Danic <mario@lovelyhq.com>
 2018-01-15 00:50:49 +01:00
Morris Jobke
68e205e827
Merge pull request #7712 from nextcloud/jsconfig_l10n 
Use correct L10N files for jsconfig
 2018-01-05 15:22:10 +01:00
Roeland Jago Douma
30ac28f950
Use correct L10N files for jsconfig 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-01-05 14:33:03 +01:00
Roeland Jago Douma
82f03e1314
Clear login token once apppassword is generated 
Fixes #7697

When using the new login flow a token will be generated since we login.
However after that we generate yet another token to return (as we
should).

However we should kill the current session token as we are done with it.
And will never use it again.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-01-04 14:30:40 +01:00
Arthur Schiwon
4f3d52a364
never translate login names when requiring with a user id 
where appropriate, the preLoginNameUsedAsUserName hook should be thrown.

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2018-01-03 13:25:00 +01:00
Julius Härtl
f5f6ed664d
Hide stay logged in checkbox when flow authentication is used 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2017-12-28 11:15:26 +01:00
Roeland Jago Douma
c1fcd6fc98
Merge pull request #7324 from nextcloud/no-sorters-no-instances 
don't create sorter instances when none was requested
 2017-12-11 15:27:44 +01:00
Morris Jobke
ed7beb929e
Merge pull request #6876 from nextcloud/always_img_avatar 
Always generate avatar
 2017-12-08 23:58:17 +01:00
Roeland Jago Douma
ba648eecdf
Move avatar code to Avatar Class 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-11-29 14:23:15 +01:00
Roeland Jago Douma
604596ec16
Always generate avatar 
Even if no avatar is set we should just generate the image. This to not
duplicate the code on all the clients. And only server images from the
avtar endpoint.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-11-29 14:23:15 +01:00
Arthur Schiwon
96bc03a03a
don't create sorter instances when none was requested 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2017-11-28 13:30:51 +01:00
Mario Danic
c2cd5fc5d3 Fix flow 
Signed-off-by: Mario Danic <mario@lovelyhq.com>
 2017-11-09 00:29:34 +01:00
Julius Härtl
cd1bfea8c4
Theming: theme flow redirection page 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2017-11-08 14:56:32 +01:00
Morris Jobke
31c5c2a592
Change @georgehrke's email 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-11-06 20:38:59 +01:00
Morris Jobke
0eebff152a
Update license headers 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-11-06 16:56:19 +01:00
Roeland Jago Douma
6ce095b166
Add 204 endpoint 
Fixes #6967

This allows clients to check for Walled Garden connections.
The endpoint just responds with a 204 (which is very unlikely with such
a connection)

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-11-02 10:30:16 +01:00
Arthur Schiwon
25aad121e6
meanwhile we can have exact matches. also show those. 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2017-10-31 14:58:48 +01:00
Arthur Schiwon
ca72c0150b
configurable amount of autocomplete results in comments 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2017-10-27 13:50:38 +02:00
Arthur Schiwon
fa2f03979b
add search parameter to autocomplete controller 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2017-10-25 17:26:50 +02:00
Arthur Schiwon
fd6daf8d19
AutoCompletion backend 
* introduce a Controller for requests
* introduce result sorting mechanism
* extend Comments to retrieve commentors (actors) in a tree
* add commenters sorter
* add share recipients sorter

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2017-10-22 14:13:32 +02:00
Joas Schilling
3119fd41ce
Set the data from the template 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-10-18 15:12:03 +02:00
Joas Schilling
8b37fe7f65
Set the subject with the email template to allow theming 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-10-18 15:12:03 +02:00
Lukas Reschke
8ad17a66d6
Exclude avatar from Same-Site Cookie requirement 
Required to work with the upcoming Collabora avatar integration.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-10-11 14:41:34 +02:00
Lukas Reschke
0bccd5a0d9
Fix "Uninitialized string offset: 0 at \/media\/psf\/stable9\/lib\/private\/URLGenerator.php#224" 
The URLGenerator doesn't support `` as target for absolute URLs, we need to link to `/` thus.

Regression introduced with 46229a00f3

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-09-07 08:34:02 +02:00
Morris Jobke
504c1abee0
Fix undefined index oauthState 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-09-06 16:38:24 +02:00
Morris Jobke
15cd21d252 Merge pull request #6358 from nextcloud/fix-mixup-of-id-and-name 
Set the meta data before everything
 2017-09-05 16:08:57 +02:00
Joas Schilling
6dbb64c4a2
Merge setMetaData into constructor 
This ensures that the meta data is set in the beginning

Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-09-04 15:07:41 +02:00
Morris Jobke
30ca3b70ed Merge pull request #6196 from nextcloud/downstream-26539-2 
Handle invalid ext storage backend to keep mount point visible
 2017-09-04 14:17:28 +02:00
Morris Jobke
0326c2c54f
Fix broken tests 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-09-04 14:17:03 +02:00
Julius Härtl
46229a00f3
Add rich link preview to the login page 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2017-09-02 21:39:38 +02:00
Joas Schilling
0aff1c9268
Return the user id in case of an error 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-08-29 11:10:30 +02:00
Morris Jobke
2bf15eda26 Merge pull request #6255 from nextcloud/email-meta-data 
Add meta information to emails for better customisation
 2017-08-26 18:53:52 +02:00
Morris Jobke
0b652648cc Merge pull request #6177 from nextcloud/properly-add-slo-url 
Properly allow \OCP\Authentication\IApacheBackend to specify logout URL
 2017-08-26 18:50:52 +02:00
Christoph Wurst
6676232a56
Allow 2FA providers to specify their custom CSP 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-08-26 13:48:08 +02:00
Joas Schilling
6a130d01e7
Also for reset password 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-08-24 18:02:37 +02:00
Lukas Reschke
2e4cd44556
Inject \OCP\IURLGenerator to make tests work 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-08-18 15:32:40 +02:00
Joas Schilling
d5c6d56170
No password reset for disabled users 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-08-18 13:21:53 +02:00
Lukas Reschke
a04feff9a7
Properly allow \OCP\Authentication\IApacheBackend to specify logout URL 
Any `\OCP\Authentication\IApacheBackend` previously had to implement `getLogoutAttribute` which returns a string.
This string is directly injected into the logout `<a>` tag, so returning something like `href="foo"` would result
in `<a href="foo">`.

This is rather error prone and also in Nextcloud 12 broken as the logout entry has been moved with
054e161eb5 inside the navigation manager where one cannot simply inject attributes.

Thus this feature is broken in Nextcloud 12 which effectively leads to the bug described at nextcloud/user_saml#112,
people cannot logout anymore when using SAML using SLO. Basically in case of SAML you have a SLO url which redirects
you to the IdP and properly logs you out there as well.

Instead of monkey patching the Navigation manager I decided to instead change `\OCP\Authentication\IApacheBackend` to
use `\OCP\Authentication\IApacheBackend::getLogoutUrl` instead where it can return a string with the appropriate logout
URL. Since this functionality is only prominently used in the SAML plugin. Any custom app would need a small change but
I'm not aware of any and there's simply no way to fix this properly otherwise.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-08-18 12:22:44 +02:00
Morris Jobke
84c22fdeef Merge pull request #5907 from nextcloud/add-metadata-to-throttle-call 
Add metadata to \OCP\AppFramework\Http\Response::throttle
 2017-08-01 14:43:47 +02:00
Roeland Jago Douma
75771a108b
Fix OCSController 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-08-01 08:20:15 +02:00
Roeland Jago Douma
e945f2bc3a
Fix ContactsMenuController 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-08-01 08:20:15 +02:00
Roeland Jago Douma
aa6d8fcdbf
Fix AvatarController 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-08-01 08:20:15 +02:00
Lukas Reschke
f22ab3e665
Add metadata to \OCP\AppFramework\Http\Response::throttle 
Fixes https://github.com/nextcloud/server/issues/5891

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-07-27 14:17:45 +02:00
Morris Jobke
188b87e03b Cleanup legacy user class from unused methods 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-07-24 12:17:53 +02:00
Julius Härtl
51a0741005
Add public capabilities API 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2017-06-30 11:08:04 +02:00
Lukas Reschke
2f87fb6b45
Add Clear-Site-Data header 
This adds a Clear-Site-Data header to the logout response which will delete all relevant data in the caches which may contain potentially sensitive content.

See https://w3c.github.io/webappsec-clear-site-data/#header for the definition of the types.

Ref https://twitter.com/mikewest/status/877149667909406723

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-06-20 19:46:10 +02:00
Lukas Reschke
26ee889fec
Add tests for ClientFlowLoginController 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-05-18 20:49:08 +02:00
Lukas Reschke
b07a0f51ba
Add OAuth state to session 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-05-18 20:49:08 +02:00
Bjoern Schiessle
23b296b66e
use name of oauth app to identify auth token 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2017-05-18 20:49:07 +02:00
Bjoern Schiessle
a74d67b69c
show error page if no valid client identifier is given and if it is not a API request 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2017-05-18 20:49:06 +02:00
Lukas Reschke
e86749121c
Remove special characters 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-05-18 20:49:05 +02:00
Lukas Reschke
5f71805c35
Add basic implementation for OAuth 2.0 Authorization Code Flow 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-05-18 20:49:03 +02:00
Joas Schilling
0828df5ed4
Disable the API endpoints as well 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-05-11 17:03:57 +02:00
Ujjwal Bhardwaj
7c23414eef
Disable reset password link. Issue: #27440 2017-05-11 10:27:33 +02:00
Joas Schilling
d418ea550b
Automatic injection for CssController 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-05-10 09:42:40 +02:00
Joas Schilling
9c8fe82000
Automatic injection for JsController 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-05-10 09:42:15 +02:00
Mario Danic
e4aac15a92
Update login flow redirection 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-05-04 19:21:22 +02:00
Morris Jobke
23cc309606
Handle more error cases 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-05-02 13:43:48 +02:00
Georg Ehrke
60f9ed6241
add contactsmenu popover 
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
 2017-04-26 09:26:53 +02:00
Jan-Christoph Borchardt
241e397326 Merge branch 'master' into contactsmenu 
Signed-off-by: Jan-Christoph Borchardt <hey@jancborchardt.net>
 2017-04-26 00:50:38 +02:00
Christoph Wurst
36cee1f386 Let apps register contact menu provider via info.xml 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-04-25 20:47:17 +02:00
Christoph Wurst
d091793ceb Contacts menu 
* load list of contacts from the server
* show last message of each contact

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-04-25 20:47:17 +02:00
Roeland Jago Douma
aae079aa29
AppToken to 72 chars 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-04-25 20:18:49 +02:00
Roeland Jago Douma
bb5e5efa6d
Do not remove the state token to early 
we should check the stateToken before we remove it. Else the check will
always fail.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-04-25 20:18:49 +02:00
Lukas Reschke
6a16df7288
Add new auth flow 
This implements the basics for the new app-password based authentication flow for our clients.
The current implementation tries to keep it as simple as possible and works the following way:

1. Unauthenticated client opens `/index.php/login/flow`
2. User will be asked whether they want to grant access to the client
3. If accepted the user has the chance to do so using existing App Token or automatically generate an app password.

If the user chooses to use an existing app token then that one will simply be redirected to the `nc://` protocol handler.
While we can improve on that in the future, I think keeping this smaller at the moment has its advantages. Also, in the
near future we have to think about an automatic migration endpoint so there's that anyways :-)

If the user chooses to use the regular login the following happens:

1. A session state token is written to the session
2. User is redirected to the login page
3. If successfully authenticated they will be redirected to a page redirecting to the POST controller
4. The POST controller will check if the CSRF token as well as the state token is correct, if yes the user will be redirected to the `nc://` protocol handler.

This approach is quite simple but also allows to be extended in the future. One could for example allow external websites to consume this authentication endpoint as well.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-25 20:18:49 +02:00
Christoph Wurst
bb1d191f82
Fix remember redirect_url on failed login attempts 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-04-25 09:38:19 +02:00
Joas Schilling
3d671cc536 Merge pull request #4443 from nextcloud/cleanup-unused-imports 
Remove unused use statements
 2017-04-24 11:47:37 +02:00
Lukas Reschke
8a1d3c7e87 Merge pull request #4434 from nextcloud/add-rate-limiting-to-solve-challenge-controller 
Add rate limit to TOTP solve challenge controller
 2017-04-24 10:03:19 +02:00
Morris Jobke
c54a59d51e
Remove unused use statements 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-04-22 19:23:31 -05:00
Lukas Reschke
d0d34d308a
Add at most 10 password reset requests per 5 minutes and IP range 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-22 08:12:54 +02:00
Lukas Reschke
c1b8f152d8
Add rate limit to TOTP solve challenge controller 
Fixes https://github.com/nextcloud/server/issues/2626

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-22 07:59:40 +02:00
Morris Jobke
16c4755e03
Rename renderHTML to renderHtml 
* fixes #4383
* improves consistency

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-04-19 15:46:41 -05:00
Lukas Reschke
727688ebd9
Adjust existing bruteforce protection code 
- Moves code to annotation
- Adds the `throttle()` call on the responses on existing annotations

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-14 13:42:40 +02:00
Lukas Reschke
8149945a91
Make BruteForceProtection annotation more clever 
This makes the new `@BruteForceProtection` annotation more clever and moves the relevant code into it's own middleware.

Basically you can now set `@BruteForceProtection(action=$key)` as annotation and that will make the controller bruteforce protected. However, the difference to before is that you need to call `$responmse->throttle()` to increase the counter. Before the counter was increased every time which leads to all kind of unexpected problems.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-13 23:05:33 +02:00
Lukas Reschke
81d3732bf5 Merge pull request #4308 from nextcloud/lost-password-email 
Update email template for lost password email
 2017-04-13 20:02:15 +02:00
Morris Jobke
d36751ee38 Merge pull request #2424 from nextcloud/fix-login-controller-test-consolidate-login 
Fix login controller test and consolidate login
 2017-04-13 12:16:38 -05:00
Lukas Reschke
66835476b5
Add support for ratelimiting via annotations 
This allows adding rate limiting via annotations to controllers, as one example:

```
@UserRateThrottle(limit=5, period=100)
@AnonRateThrottle(limit=1, period=100)
```

Would mean that logged-in users can access the page 5 times within 100 seconds, and anonymous users 1 time within 100 seconds. If only an AnonRateThrottle is specified that one will also be applied to logged-in users.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-13 12:00:16 +02:00
Morris Jobke
7cb6038fca Merge pull request #3043 from nextcloud/issue-3038-no-logentry-on-email-login 
Dont create a log entry on email login
 2017-04-13 01:04:11 -05:00
Morris Jobke
1f962f9115
Update email template for lost password email 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-04-12 15:19:53 -05:00
Morris Jobke
5b4adf66e5
Move OC_Defaults to OCP\Defaults 
* currently there are two ways to access default values:
  OCP\Defaults or OC_Defaults (which is extended by
  OCA\Theming\ThemingDefaults)
* our code used a mixture of both of them, which made
  it hard to work on theme values
* this extended the public interface with the missing
  methods and uses them everywhere to only rely on the
  public interface

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-04-09 21:43:01 -05:00
Joas Schilling
7ad791efb4
Dont create a log entry on email login 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-04-07 10:15:20 +02:00
Arthur Schiwon
7b3fdfeeaa
do login routine only once when done via LoginController 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2017-04-06 15:22:42 +02:00
Arthur Schiwon
2994cbc586
fix login controller tests 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2017-04-06 15:20:17 +02:00
Roeland Jago Douma
6bdd3a167d Merge pull request #4123 from nextcloud/allow-password-reset-with-email 
Allow to reset the password with the email as an input
 2017-04-05 09:12:41 +02:00
Morris Jobke
9813023aab
Fix gzip files for Safari 
* Safari support gzip only if the filename does not
  end on .gz - so this renames them to .gzip

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-03-29 00:11:51 -06:00
Roeland Jago Douma
54f9b35f71
Allow to gzip CSS/JS files 
Since in production the SCSS files are compiled once and the javascript
files are combined once we can just as well gzip them aggresively.

This means that once they are requested and the browser supports gzip we
can just serve the gzipped file saving precious bandwidth.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-03-28 21:46:23 +02:00
Joas Schilling
4bae7ef96d
Allow to reset the password with the email as an input 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-03-28 21:17:37 +02:00
Roeland Jago Douma
8e89ad21a2
[PoC] JS Combiner 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-03-24 10:58:10 +01:00
blizzz
19fc68cbdc Merge pull request #2606 from temparus/master 
Add preLoginValidation hook
 2017-02-15 21:47:47 +01:00
Joas Schilling
ac841ee002 Merge pull request #3362 from nextcloud/fix/nc-token-cookie-name 
oc_token should be nc_token
 2017-02-09 10:07:59 +01:00
Sandro Lutz
9b6f99ab08 Update license header 
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
 2017-02-07 01:25:39 +01:00
Sandro Lutz
fa1d607bfa Merge remote-tracking branch 'nextcloud/master' 
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
 2017-02-07 00:15:30 +01:00
Sandro Lutz
ff3fa538e4 Add missing use statement for PublicEmitter 
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
 2017-02-07 00:12:19 +01:00
Christoph Wurst
5e728d0eda oc_token should be nc_token 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-02-02 21:56:44 +01:00
Sandro Lutz
20f878b014 Fix typo for UserManager variable 
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
 2017-02-01 21:54:00 +01:00
Sandro Lutz
6feff0ceba Add check if UserManager is of type PublicEmitter before calling preLogin hook 
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
 2017-02-01 21:53:50 +01:00
Sandro Lutz
e30d28f7eb Change where preLogin hook gets called 
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
 2017-02-01 21:53:42 +01:00
Sandro Lutz
6ab0a3215d Remove preLoginValidation hook 
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
 2017-02-01 21:53:29 +01:00
Sandro Lutz
e14d50eb1f Fix indentation 
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
 2017-02-01 21:50:47 +01:00
Sandro Lutz
4ebcd5ac0b Add preLoginValidation hook 
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
 2017-02-01 21:50:25 +01:00
John Molakvoæ (skjnldsv)
2c9d7eeb76
Fix public page css fallback loading 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2017-02-01 18:03:51 +01:00
Morris Jobke
5bad417e57 Merge pull request #2044 from nextcloud/login-credential-store 
Login credential store
 2017-01-30 19:30:04 -06:00
Bjoern Schiessle
5086335643
unify endpoints form core and the the provisioning api 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2017-01-25 11:20:35 +01:00
Lukas Reschke
bde1150d04 Merge pull request #3004 from nextcloud/fix-installation-css 
Fixed installation page
 2017-01-22 18:28:33 +01:00
Bjoern Schiessle
927d3865a0
add brute force protection to password reset to make it harder to guess user logins 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2017-01-19 10:12:45 +01:00
Bjoern Schiessle
cdf01feba7
add action to existing brute force protection 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2017-01-18 15:25:16 +01:00
Morris Jobke
622101f2dd Merge pull request #2918 from nextcloud/encryption-recovery-improvements 
create new encryption keys on password reset and backup the old one
 2017-01-13 11:28:43 +01:00
Christoph Wurst
140555b786
always allow remembered login 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-01-11 19:20:11 +01:00
Christoph Wurst
243c9c0941
fix coding style and increase code coverage 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-01-11 11:01:54 +01:00
Cornelius Kölbel
e077e01bf2
Add a TwoFactorException 
A Two Factor third party App may throw a TwoFactorException()
with a more detailed error message in case the authentication fails.
The 2FA Controller will then display the message of this Exception
to the user.

Working on #26593

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-01-11 11:01:52 +01:00
John Molakvoæ (skjnldsv)
e4b3ba6590
Create unified css file and merge all needed data into this file 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2017-01-10 17:50:29 +01:00
Bjoern Schiessle
fcda3a20f4
create new encryption keys on password reset and backup the old one 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2017-01-10 17:04:32 +01:00
John Molakvoæ (skjnldsv)
67467873c2
Removed jquery scss 
- Switched to setup.css
- Disable scss when displaying the update page
- Improved setup css
- Fixed loading failure of other styles on setup & update page
- Improved scss compiler with an ignore scss compilation option

Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2017-01-10 11:06:03 +01:00
Roeland Jago Douma
350b7ebc86
Adds CssControllerTests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-01-06 09:42:39 +01:00
Roeland Jago Douma
1e44a15dd1
No need for the CssManager 
* It is a simple wrapper we can always add it later if needed

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-01-06 09:42:14 +01:00
Roeland Jago Douma
95d85ba8eb
Do not add ICssManager to OCP 
We can add it later if needed

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-01-06 09:42:13 +01:00