Commit graph

41 commits

Author SHA1 Message Date
Roeland Jago Douma
dd185e383d
Make sure limit is never negative
There were some cases where a negative limit could be passed in. Which
would happily make the query explode.

This is just a quick hack to make sure it never is negative.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-10-28 13:07:43 +01:00
Roeland Jago Douma
145eee91fe
Get the proper UID
Some user backends (like the database backend) allow us to obtain a user
case insensitive. However the UID itself is case sensitive.

Example:
* create a user User1
* login as User1
  - This results the data/User1 folder to be created etc
* now have some code somewhere that obtains the userFolder (from
IRootFolder) but pas in 'uSER1' as uid
  - The code will check if that is a valid user. And in this case it is
  since User1 and uSER1 both map to the same user
  - However the the UID in the user object is used for the folder a new
  folder fill be create data/uSER1

With this PR this is avoided now. Since we obtain the real UID casing in
the backend before creating the user object.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-08-13 09:33:46 +02:00
Christoph Wurst
3174012adf Add event dispatcher to OCP
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2019-06-25 10:02:27 +02:00
Arthur Schiwon
96bab4f969
remove obsolete use statements
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2019-04-24 16:24:53 +02:00
Roeland Jago Douma
0c9a3de68f
Just update password hash without validating
Fixes 

If your password hash changed (becuse your are on 7.2 and we moved to
ARGON2). Then we shold not 'set a new password' but just update the
hash. As else we invoke the password policy again which might lock out
users.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-10-03 00:37:20 +02:00
Robin Appelman
3392302d22
make table name configurable for db user backend
Signed-off-by: Robin Appelman <robin@icewind.nl>
2018-06-19 14:14:44 +02:00
Robin Appelman
4187d2cdb3
use query builder in all places in the db user backend
Signed-off-by: Robin Appelman <robin@icewind.nl>
2018-06-15 14:16:10 +02:00
Arthur Schiwon
38a90130ce
move log constants to ILogger
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2018-04-26 10:45:52 +02:00
Roeland Jago Douma
81f71cb1f9
Numeric only uids are no fun
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-04-24 14:23:50 +02:00
Roeland Jago Douma
074a0e0665
Cast retrieved DB fields to string
Fixes 

If a pure numerical user is in the DB the value might be casted to a int
when returned. Cast it all to a string so we don't break the strict
typing.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-04-24 12:48:52 +02:00
Roeland Jago Douma
8edbeb159e
Use the uid_lower column
This can use a proper index

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-04-06 13:42:52 +02:00
Roeland Jago Douma
471272d456
Move to ABackend
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-03-22 16:32:05 +01:00
Roeland Jago Douma
cbd2be583a
Move Database backend over to new User/Backend interfaces
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-03-22 16:32:05 +01:00
Daniel Calviño Sánchez
0b96a71a68 Fix configuration values matched in user searches
Due to a misplaced closing parenthesis the condition of the left join
clause was just "userid = uid"; the other conditions were passed as
additional parameters to "leftJoin", and thus they were ignored.
Therefore, the result set contained every preference of each user
instead of only the email, so the "WHERE configvalue LIKE XXX" matched
any configuration value of the user.

Besides the closing parenthesis this commit also fixes the literal
values. Although "Literal" objects represent literal values they must be
created through "IExpressionBuilder::literal()" to be properly quoted;
otherwise it is just a plain string, which is treated as a column name.

Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
2018-03-14 23:31:42 +01:00
Robin Appelman
aad01894e3
refactor user searching
add additional user searching tests

Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-12-20 15:51:37 +01:00
Abijeet
ec28c54dbc Adds search by email function on the users screen.
Fixes .

- Updated the query to fetch the users in users > everyone tab.
- Updated the query to fetch the users in users > admin tab.
- Tested to ensure that the disabled users are also being fetched.
- Added test cases.

Signed-off-by: Abijeet <abijeetpatro@gmail.com>
2017-12-16 17:18:05 +05:30
Morris Jobke
eb0f3ebf75
Fix search in user managent when no group is selected
* also allows to search by displayname

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-11-14 17:32:03 +01:00
Morris Jobke
31c5c2a592
Change @georgehrke's email
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-11-06 20:38:59 +01:00
Morris Jobke
0eebff152a
Update license headers
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-11-06 16:56:19 +01:00
Lukas Reschke
ed8a98eaa1
Prevent SQL error message in case of error
`\OC\User\Database::createUser` can throw a PHP exception in case the UID is longer than
permitted in the database. This is against it's PHPDocs and we should cast this to `false`,
so that the regular error handling triggers in.

The easiest way to reproduce is on MySQL:

1. Create user `aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa` in admin panel
2. Create user `aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa` in admin panel again
3. See SQL exception as error message

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-08-17 12:08:40 +02:00
Robin Appelman
0aeb595784
user ids are strings
Signed-off-by: Robin Appelman <robin@icewind.nl>
2017-03-30 12:24:46 +02:00
Morris Jobke
d197f609a8 Merge pull request from nextcloud/downstream-26950
Sharing dialog: make autocomplete sorting case insensitive
2017-03-23 23:45:28 -06:00
Morris Jobke
dbaebc53b0
fix sorting in the backend
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-03-23 15:41:25 -06:00
Vincent Petry
aacfef463c
Add tests for database user backend caching
Add comment, closeCursor in user DB query

Invalidate user in cache after successful creation

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-03-20 02:03:03 -06:00
Jörn Friedrich Dreyer
592c04a9db
cache loadUser if not exists
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-03-20 02:01:41 -06:00
Lukas Reschke
d134dea508
Don't call function in constructor
The constructor is iniitiated already very early in base.php, thus requiring this here will break the setup and some more. For now we probably have to live with a static function call here thus.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-03-16 21:59:47 +01:00
Lukas Reschke
085891a15d
Escape like parameters in database user backend
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-03-15 22:46:40 +01:00
Loki3000
8ab16f87ac spaces added 2017-01-10 16:44:14 +03:00
Loki3000
5c77923360 allowed '0' uid 2017-01-10 16:39:10 +03:00
Loki3000
b0ff59d42f remove non required db requests 2017-01-10 13:09:33 +03:00
Loki3000
135198bf0d Default value for null user
For guest users on every request executes query:
SELECT `uid`, `displayname` FROM `users` WHERE LOWER(`uid`) = LOWER(null)
as I see, uid can't be equal to null by design.
2017-01-09 23:34:23 +03:00
Roeland Jago Douma
1273d82e8b
Cache non existing DB user
We always query the database backend. Even if we use a different one
(ldap for example). Now we do this everytime we try to get a user object
so caching that a user is not in the DB safes some queries on each
request then (at least 2 what I found).

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-10 09:30:36 +02:00
Roeland Jago Douma
6c360ad79f
Add PHPdoc 2016-08-15 11:14:28 +02:00
Jörn Friedrich Dreyer
d2a16c4dc8
Unnecessary fully qualified names 2016-08-14 19:36:06 +02:00
michag86
5fb39bd0cb Apply password policy on user creation 2016-08-03 11:52:15 +02:00
Joas Schilling
0215b004da
Update with robin 2016-07-21 18:13:58 +02:00
Joas Schilling
ba87db3fcc
Fix others 2016-07-21 18:13:57 +02:00
Bjoern Schiessle
2a990a0db5
verify user password on change 2016-06-27 14:08:11 +02:00
Lukas Reschke
aba539703c
Update license headers 2016-05-26 19:57:24 +02:00
Roeland Jago Douma
f6ee738ba8
Add \OC\User\Backend
Since some apps (ldap et al) still depend on OC_User_Backend this seemed
like the cleanest approach.
2016-05-10 19:53:36 +02:00
Roeland Jago Douma
9e1d9871a8
Move OC_User_Database to \OC\User\Database 2016-05-10 19:53:36 +02:00
Renamed from lib/private/legacy/user/database.php (Browse further)