mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #9540 from nextcloud/backport/9517/stable13 

[stable13] Improve OAuth
This commit is contained in:
Morris Jobke 2018-05-23 15:42:22 +02:00 committed by GitHub
parent 01d3586a0f 3c002706a4
commit 2f059d1caf
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
21 changed files with 852 additions and 74 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
apps/oauth2/appinfo/info.xml
View File

@ -6,7 +6,7 @@
<licence>agpl</licence>
<author>Lukas Reschke</author>
<namespace>OAuth2</namespace>
<version>1.1.0</version>
<version>1.1.1</version>
<default_enable/>
<types>
<authentication/>
@ -15,6 +15,12 @@
<nextcloud min-version="13" max-version="13" />
</dependencies>
<repair-steps>
<post-migration>
<step>OCA\OAuth2\Migration\SetTokenExpiration</step>
</post-migration>
</repair-steps>
<settings>
<admin>OCA\OAuth2\Settings\Admin</admin>
</settings>

1
apps/oauth2/composer/composer/autoload_classmap.php
View File

@ -15,5 +15,6 @@ return array(
'OCA\\OAuth2\\Db\\ClientMapper' => $baseDir . '/../lib/Db/ClientMapper.php',
'OCA\\OAuth2\\Exceptions\\AccessTokenNotFoundException' => $baseDir . '/../lib/Exceptions/AccessTokenNotFoundException.php',
'OCA\\OAuth2\\Exceptions\\ClientNotFoundException' => $baseDir . '/../lib/Exceptions/ClientNotFoundException.php',
'OCA\\OAuth2\\Migration\\SetTokenExpiration' => $baseDir . '/../lib/Migration/SetTokenExpiration.php',
'OCA\\OAuth2\\Settings\\Admin' => $baseDir . '/../lib/Settings/Admin.php',
);

1
apps/oauth2/composer/composer/autoload_static.php
View File

@ -27,6 +27,7 @@ class ComposerStaticInitOAuth2
'OCA\\OAuth2\\Db\\ClientMapper' => __DIR__ . '/..' . '/../lib/Db/ClientMapper.php',
'OCA\\OAuth2\\Exceptions\\AccessTokenNotFoundException' => __DIR__ . '/..' . '/../lib/Exceptions/AccessTokenNotFoundException.php',
'OCA\\OAuth2\\Exceptions\\ClientNotFoundException' => __DIR__ . '/..' . '/../lib/Exceptions/ClientNotFoundException.php',
'OCA\\OAuth2\\Migration\\SetTokenExpiration' => __DIR__ . '/..' . '/../lib/Migration/SetTokenExpiration.php',
'OCA\\OAuth2\\Settings\\Admin' => __DIR__ . '/..' . '/../lib/Settings/Admin.php',
);

11
apps/oauth2/lib/Controller/LoginRedirectorController.php
View File

@ -61,11 +61,20 @@ class LoginRedirectorController extends Controller {
*
* @param string $client_id
* @param string $state
* @param string $response_type
* @return RedirectResponse
*/
public function authorize($client_id,
$state) {
$state,
$response_type) {
$client = $this->clientMapper->getByIdentifier($client_id);
if ($response_type !== 'code') {
//Fail
$url = $client->getRedirectUri() . '?error=unsupported_response_type&state=' . $state;
return new RedirectResponse($url);
}
$this->session->set('oauth.state', $state);
$targetUrl = $this->urlGenerator->linkToRouteAbsolute(

108
apps/oauth2/lib/Controller/OauthApiController.php
View File

@ -21,10 +21,17 @@
namespace OCA\OAuth2\Controller;
use OC\Authentication\Token\DefaultTokenMapper;
use OC\Authentication\Exceptions\InvalidTokenException;
use OC\Authentication\Token\ExpiredTokenException;
use OC\Authentication\Token\IProvider as TokenProvider;
use OCA\OAuth2\Db\AccessTokenMapper;
use OCA\OAuth2\Db\ClientMapper;
use OCA\OAuth2\Exceptions\AccessTokenNotFoundException;
use OCA\OAuth2\Exceptions\ClientNotFoundException;
use OCP\AppFramework\Controller;
use OCP\AppFramework\Http;
use OCP\AppFramework\Http\JSONResponse;
use OCP\AppFramework\Utility\ITimeFactory;
use OCP\IRequest;
use OCP\Security\ICrypto;
use OCP\Security\ISecureRandom;
@ -32,56 +39,133 @@ use OCP\Security\ISecureRandom;
class OauthApiController extends Controller {
/** @var AccessTokenMapper */
private $accessTokenMapper;
/** @var ClientMapper */
private $clientMapper;
/** @var ICrypto */
private $crypto;
/** @var DefaultTokenMapper */
private $defaultTokenMapper;
/** @var TokenProvider */
private $tokenProvider;
/** @var ISecureRandom */
private $secureRandom;
/** @var ITimeFactory */
private $time;
/**
* @param string $appName
* @param IRequest $request
* @param ICrypto $crypto
* @param AccessTokenMapper $accessTokenMapper
* @param DefaultTokenMapper $defaultTokenMapper
* @param ClientMapper $clientMapper
* @param TokenProvider $tokenProvider
* @param ISecureRandom $secureRandom
* @param ITimeFactory $time
*/
public function __construct($appName,
IRequest $request,
ICrypto $crypto,
AccessTokenMapper $accessTokenMapper,
DefaultTokenMapper $defaultTokenMapper,
ISecureRandom $secureRandom) {
ClientMapper $clientMapper,
TokenProvider $tokenProvider,
ISecureRandom $secureRandom,
ITimeFactory $time) {
parent::__construct($appName, $request);
$this->crypto = $crypto;
$this->accessTokenMapper = $accessTokenMapper;
$this->defaultTokenMapper = $defaultTokenMapper;
$this->clientMapper = $clientMapper;
$this->tokenProvider = $tokenProvider;
$this->secureRandom = $secureRandom;
$this->time = $time;
}
/**
* @PublicPage
* @NoCSRFRequired
*
* @param string $grant_type
* @param string $code
* @param string $refresh_token
* @param string $client_id
* @param string $client_secret
* @return JSONResponse
*/
public function getToken($code) {
public function getToken($grant_type, $code, $refresh_token, $client_id, $client_secret) {
// We only handle two types
if ($grant_type !== 'authorization_code' && $grant_type !== 'refresh_token') {
return new JSONResponse([
'error' => 'invalid_grant',
], Http::STATUS_BAD_REQUEST);
}
// We handle the initial and refresh tokens the same way
if ($grant_type === 'refresh_token' ) {
$code = $refresh_token;
}
try {
$accessToken = $this->accessTokenMapper->getByCode($code);
} catch (AccessTokenNotFoundException $e) {
return new JSONResponse([
'error' => 'invalid_request',
], Http::STATUS_BAD_REQUEST);
}
try {
$client = $this->clientMapper->getByUid($accessToken->getClientId());
} catch (ClientNotFoundException $e) {
return new JSONResponse([
'error' => 'invalid_request',
], Http::STATUS_BAD_REQUEST);
}
// The client id and secret must match. Else we don't provide an access token!
if ($client->getClientIdentifier() !== $client_id || $client->getSecret() !== $client_secret) {
return new JSONResponse([
'error' => 'invalid_client',
], Http::STATUS_BAD_REQUEST);
}
$decryptedToken = $this->crypto->decrypt($accessToken->getEncryptedToken(), $code);
$newCode = $this->secureRandom->generate(128);
// Obtain the appToken assoicated
try {
$appToken = $this->tokenProvider->getTokenById($accessToken->getTokenId());
} catch (ExpiredTokenException $e) {
$appToken = $e->getToken();
} catch (InvalidTokenException $e) {
//We can't do anything...
$this->accessTokenMapper->delete($accessToken);
return new JSONResponse([
'error' => 'invalid_request',
], Http::STATUS_BAD_REQUEST);
}
// Rotate the apptoken (so the old one becomes invalid basically)
$newToken = $this->secureRandom->generate(72, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS);
$appToken = $this->tokenProvider->rotate(
$appToken,
$decryptedToken,
$newToken
);
// Expiration is in 1 hour again
$appToken->setExpires($this->time->getTime() + 3600);
$this->tokenProvider->updateToken($appToken);
// Generate a new refresh token and encrypt the new apptoken in the DB
$newCode = $this->secureRandom->generate(128, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS);
$accessToken->setHashedCode(hash('sha512', $newCode));
$accessToken->setEncryptedToken($this->crypto->encrypt($decryptedToken, $newCode));
$accessToken->setEncryptedToken($this->crypto->encrypt($newToken, $newCode));
$this->accessTokenMapper->update($accessToken);
return new JSONResponse(
[
'access_token' => $decryptedToken,
'access_token' => $newToken,
'token_type' => 'Bearer',
'expires_in' => 3600,
'refresh_token' => $newCode,
'user_id' => $this->defaultTokenMapper->getTokenById($accessToken->getTokenId())->getUID(),
'user_id' => $appToken->getUID(),
]
);
}

77
apps/oauth2/lib/Migration/SetTokenExpiration.php Normal file
View File

@ -0,0 +1,77 @@
<?php
/**
* @copyright Copyright 2018, Roeland Jago Douma <roeland@famdouma.nl>
*
* @author Roeland Jago Douma <roeland@famdouma.nl>
*
* @license GNU AGPL version 3 or any later version
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
*/
namespace OCA\OAuth2\Migration;
use OC\Authentication\Exceptions\InvalidTokenException;
use OC\Authentication\Token\IProvider as TokenProvider;
use OCA\OAuth2\Db\AccessToken;
use OCP\AppFramework\Utility\ITimeFactory;
use OCP\IDBConnection;
use OCP\Migration\IOutput;
use OCP\Migration\IRepairStep;
class SetTokenExpiration implements IRepairStep {
/** @var IDBConnection */
private $connection;
/** @var ITimeFactory */
private $time;
/** @var TokenProvider */
private $tokenProvider;
public function __construct(IDBConnection $connection,
ITimeFactory $timeFactory,
TokenProvider $tokenProvider) {
$this->connection = $connection;
$this->time = $timeFactory;
$this->tokenProvider = $tokenProvider;
}
public function getName() {
return 'Update OAuth token expiration times';
}
public function run(IOutput $output) {
$qb = $this->connection->getQueryBuilder();
$qb->select('*')
->from('oauth2_access_tokens');
$cursor = $qb->execute();
while($row = $cursor->fetch()) {
$token = AccessToken::fromRow($row);
try {
$appToken = $this->tokenProvider->getTokenById($token->getTokenId());
$appToken->setExpires($this->time->getTime() + 3600);
$this->tokenProvider->updateToken($appToken);
} catch (InvalidTokenException $e) {
//Skip this token
}
}
$cursor->closeCursor();
}
}

20
apps/oauth2/tests/Controller/LoginRedirectorControllerTest.php
View File

@ -86,6 +86,24 @@ class LoginRedirectorControllerTest extends TestCase {
->willReturn('https://example.com/?clientIdentifier=foo');
$expected = new RedirectResponse('https://example.com/?clientIdentifier=foo');
$this->assertEquals($expected, $this->loginRedirectorController->authorize('MyClientId', 'MyState'));
$this->assertEquals($expected, $this->loginRedirectorController->authorize('MyClientId', 'MyState', 'code'));
}
public function testAuthorizeWrongResponseType() {
$client = new Client();
$client->setClientIdentifier('MyClientIdentifier');
$client->setRedirectUri('http://foo.bar');
$this->clientMapper
->expects($this->once())
->method('getByIdentifier')
->with('MyClientId')
->willReturn($client);
$this->session
->expects($this->never())
->method('set');
$expected = new RedirectResponse('http://foo.bar?error=unsupported_response_type&state=MyState');
$this->assertEquals($expected, $this->loginRedirectorController->authorize('MyClientId', 'MyState', 'wrongcode'));
}
}

342
apps/oauth2/tests/Controller/OauthApiControllerTest.php
View File

@ -21,12 +21,22 @@
namespace OCA\OAuth2\Tests\Controller;
use OC\Authentication\Exceptions\InvalidTokenException;
use OC\Authentication\Token\DefaultToken;
use OC\Authentication\Token\DefaultTokenMapper;
use OC\Authentication\Token\ExpiredTokenException;
use OC\Authentication\Token\IProvider as TokenProvider;
use OC\Authentication\Token\IToken;
use OCA\OAuth2\Controller\OauthApiController;
use OCA\OAuth2\Db\AccessToken;
use OCA\OAuth2\Db\AccessTokenMapper;
use OCA\OAuth2\Db\Client;
use OCA\OAuth2\Db\ClientMapper;
use OCA\OAuth2\Exceptions\AccessTokenNotFoundException;
use OCA\OAuth2\Exceptions\ClientNotFoundException;
use OCP\AppFramework\Http;
use OCP\AppFramework\Http\JSONResponse;
use OCP\AppFramework\Utility\ITimeFactory;
use OCP\IRequest;
use OCP\Security\ICrypto;
use OCP\Security\ISecureRandom;
@ -39,10 +49,14 @@ class OauthApiControllerTest extends TestCase {
private $crypto;
/** @var AccessTokenMapper|\PHPUnit_Framework_MockObject_MockObject */
private $accessTokenMapper;
/** @var DefaultTokenMapper|\PHPUnit_Framework_MockObject_MockObject */
private $defaultTokenMapper;
/** @var ClientMapper|\PHPUnit_Framework_MockObject_MockObject */
private $clientMapper;
/** @var TokenProvider|\PHPUnit_Framework_MockObject_MockObject */
private $tokenProvider;
/** @var ISecureRandom|\PHPUnit_Framework_MockObject_MockObject */
private $secureRandom;
/** @var ITimeFactory|\PHPUnit_Framework_MockObject_MockObject */
private $time;
/** @var OauthApiController */
private $oauthApiController;
@ -52,55 +66,307 @@ class OauthApiControllerTest extends TestCase {
$this->request = $this->createMock(IRequest::class);
$this->crypto = $this->createMock(ICrypto::class);
$this->accessTokenMapper = $this->createMock(AccessTokenMapper::class);
$this->defaultTokenMapper = $this->createMock(DefaultTokenMapper::class);
$this->clientMapper = $this->createMock(ClientMapper::class);
$this->tokenProvider = $this->createMock(TokenProvider::class);
$this->secureRandom = $this->createMock(ISecureRandom::class);
$this->time = $this->createMock(ITimeFactory::class);
$this->oauthApiController = new OauthApiController(
'oauth2',
$this->request,
$this->crypto,
$this->accessTokenMapper,
$this->defaultTokenMapper,
$this->secureRandom
$this->clientMapper,
$this->tokenProvider,
$this->secureRandom,
$this->time
);
}
public function testGetToken() {
$accessToken = new AccessToken();
$accessToken->setEncryptedToken('MyEncryptedToken');
$accessToken->setTokenId(123);
$this->accessTokenMapper
->expects($this->once())
->method('getByCode')
->willReturn($accessToken);
$this->crypto
->expects($this->once())
->method('decrypt')
->with('MyEncryptedToken', 'MySecretCode')
->willReturn('MyDecryptedToken');
$this->secureRandom
->expects($this->once())
->method('generate')
->with(128)
->willReturn('NewToken');
$token = new DefaultToken();
$token->setUid('JohnDoe');
$this->defaultTokenMapper
->expects($this->once())
->method('getTokenById')
->with(123)
->willReturn($token);
public function testGetTokenInvalidGrantType() {
$expected = new JSONResponse([
'error' => 'invalid_grant',
], Http::STATUS_BAD_REQUEST);
$expected = new JSONResponse(
[
'access_token' => 'MyDecryptedToken',
$this->assertEquals($expected, $this->oauthApiController->getToken('foo', null, null, null, null));
}
public function testGetTokenInvalidCode() {
$expected = new JSONResponse([
'error' => 'invalid_request',
], Http::STATUS_BAD_REQUEST);
$this->accessTokenMapper->method('getByCode')
->with('invalidcode')
->willThrowException(new AccessTokenNotFoundException());
$this->assertEquals($expected, $this->oauthApiController->getToken('authorization_code', 'invalidcode', null, null, null));
}
public function testGetTokenInvalidRefreshToken() {
$expected = new JSONResponse([
'error' => 'invalid_request',
], Http::STATUS_BAD_REQUEST);
$this->accessTokenMapper->method('getByCode')
->with('invalidrefresh')
->willThrowException(new AccessTokenNotFoundException());
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'invalidrefresh', null, null));
}
public function testGetTokenClientDoesNotExist() {
$expected = new JSONResponse([
'error' => 'invalid_request',
], Http::STATUS_BAD_REQUEST);
$accessToken = new AccessToken();
$accessToken->setClientId(42);
$this->accessTokenMapper->method('getByCode')
->with('validrefresh')
->willReturn($accessToken);
$this->clientMapper->method('getByUid')
->with(42)
->willThrowException(new ClientNotFoundException());
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'validrefresh', null, null));
}
public function invalidClientProvider() {
return [
['invalidClientId', 'invalidClientSecret'],
['clientId', 'invalidClientSecret'],
['invalidClientId', 'clientSecret'],
];
}
/**
* @dataProvider invalidClientProvider
*
* @param string $clientId
* @param string $clientSecret
*/
public function testGetTokenInvalidClient($clientId, $clientSecret) {
$expected = new JSONResponse([
'error' => 'invalid_client',
], Http::STATUS_BAD_REQUEST);
$accessToken = new AccessToken();
$accessToken->setClientId(42);
$this->accessTokenMapper->method('getByCode')
->with('validrefresh')
->willReturn($accessToken);
$client = new Client();
$client->setClientIdentifier('clientId');
$client->setSecret('clientSecret');
$this->clientMapper->method('getByUid')
->with(42)
->willReturn($client);
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'validrefresh', $clientId, $clientSecret));
}
public function testGetTokenInvalidAppToken() {
$expected = new JSONResponse([
'error' => 'invalid_request',
], Http::STATUS_BAD_REQUEST);
$accessToken = new AccessToken();
$accessToken->setClientId(42);
$accessToken->setTokenId(1337);
$accessToken->setEncryptedToken('encryptedToken');
$this->accessTokenMapper->method('getByCode')
->with('validrefresh')
->willReturn($accessToken);
$client = new Client();
$client->setClientIdentifier('clientId');
$client->setSecret('clientSecret');
$this->clientMapper->method('getByUid')
->with(42)
->willReturn($client);
$this->crypto->method('decrypt')
->with(
'encryptedToken',
'validrefresh'
)->willReturn('decryptedToken');
$this->tokenProvider->method('getTokenById')
->with(1337)
->willThrowException(new InvalidTokenException());
$this->accessTokenMapper->expects($this->once())
->method('delete')
->with($accessToken);
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'validrefresh', 'clientId', 'clientSecret'));
}
public function testGetTokenValidAppToken() {
$accessToken = new AccessToken();
$accessToken->setClientId(42);
$accessToken->setTokenId(1337);
$accessToken->setEncryptedToken('encryptedToken');
$this->accessTokenMapper->method('getByCode')
->with('validrefresh')
->willReturn($accessToken);
$client = new Client();
$client->setClientIdentifier('clientId');
$client->setSecret('clientSecret');
$this->clientMapper->method('getByUid')
->with(42)
->willReturn($client);
$this->crypto->method('decrypt')
->with(
'encryptedToken',
'validrefresh'
)->willReturn('decryptedToken');
$appToken = new DefaultToken();
$appToken->setUid('userId');
$this->tokenProvider->method('getTokenById')
->with(1337)
->willThrowException(new ExpiredTokenException($appToken));
$this->accessTokenMapper->expects($this->never())
->method('delete')
->with($accessToken);
$this->secureRandom->method('generate')
->will($this->returnCallback(function ($len) {
return 'random'.$len;
}));
$this->tokenProvider->expects($this->once())
->method('rotate')
->with(
$appToken,
'decryptedToken',
'random72'
)->willReturn($appToken);
$this->time->method('getTime')
->willReturn(1000);
$this->tokenProvider->expects($this->once())
->method('updateToken')
->with(
$this->callback(function (DefaultToken $token) {
return $token->getExpires() === 4600;
})
);
$this->crypto->method('encrypt')
->with('random72', 'random128')
->willReturn('newEncryptedToken');
$this->accessTokenMapper->expects($this->once())
->method('update')
->with(
$this->callback(function (AccessToken $token) {
return $token->getHashedCode() === hash('sha512', 'random128') &&
$token->getEncryptedToken() === 'newEncryptedToken';
})
);
$expected = new JSONResponse([
'access_token' => 'random72',
'token_type' => 'Bearer',
'expires_in' => 3600,
'refresh_token' => 'NewToken',
'user_id' => 'JohnDoe',
]
);
$this->assertEquals($expected, $this->oauthApiController->getToken('MySecretCode'));
'refresh_token' => 'random128',
'user_id' => 'userId',
]);
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'validrefresh', 'clientId', 'clientSecret'));
}
public function testGetTokenExpiredAppToken() {
$accessToken = new AccessToken();
$accessToken->setClientId(42);
$accessToken->setTokenId(1337);
$accessToken->setEncryptedToken('encryptedToken');
$this->accessTokenMapper->method('getByCode')
->with('validrefresh')
->willReturn($accessToken);
$client = new Client();
$client->setClientIdentifier('clientId');
$client->setSecret('clientSecret');
$this->clientMapper->method('getByUid')
->with(42)
->willReturn($client);
$this->crypto->method('decrypt')
->with(
'encryptedToken',
'validrefresh'
)->willReturn('decryptedToken');
$appToken = new DefaultToken();
$appToken->setUid('userId');
$this->tokenProvider->method('getTokenById')
->with(1337)
->willReturn($appToken);
$this->accessTokenMapper->expects($this->never())
->method('delete')
->with($accessToken);
$this->secureRandom->method('generate')
->will($this->returnCallback(function ($len) {
return 'random'.$len;
}));
$this->tokenProvider->expects($this->once())
->method('rotate')
->with(
$appToken,
'decryptedToken',
'random72'
)->willReturn($appToken);
$this->time->method('getTime')
->willReturn(1000);
$this->tokenProvider->expects($this->once())
->method('updateToken')
->with(
$this->callback(function (DefaultToken $token) {
return $token->getExpires() === 4600;
})
);
$this->crypto->method('encrypt')
->with('random72', 'random128')
->willReturn('newEncryptedToken');
$this->accessTokenMapper->expects($this->once())
->method('update')
->with(
$this->callback(function (AccessToken $token) {
return $token->getHashedCode() === hash('sha512', 'random128') &&
$token->getEncryptedToken() === 'newEncryptedToken';
})
);
$expected = new JSONResponse([
'access_token' => 'random72',
'token_type' => 'Bearer',
'expires_in' => 3600,
'refresh_token' => 'random128',
'user_id' => 'userId',
]);
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'validrefresh', 'clientId', 'clientSecret'));
}
}

2
core/Controller/ClientFlowLoginController.php
View File

@ -291,7 +291,7 @@ class ClientFlowLoginController extends Controller {
);
if($client) {
$code = $this->random->generate(128);
$code = $this->random->generate(128, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS);
$accessToken = new AccessToken();
$accessToken->setClientId($client->getId());
$accessToken->setEncryptedToken($this->crypto->encrypt($token, $code));

56
core/Migrations/Version13000Date20180516101403.php Normal file
View File

@ -0,0 +1,56 @@
<?php
/**
* @copyright Copyright (c) 2018 Roeland Jago Douma <roeland@famdouma.nl>
*
* @author Roeland Jago Douma <roeland@famdouma.nl>
*
* @license GNU AGPL version 3 or any later version
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
*/
namespace OC\Core\Migrations;
use OCP\DB\ISchemaWrapper;
use OCP\Migration\SimpleMigrationStep;
use OCP\Migration\IOutput;
class Version13000Date20180516101403 extends SimpleMigrationStep {
/**
* @param IOutput $output
* @param \Closure $schemaClosure The `\Closure` returns a `ISchemaWrapper`
* @param array $options
* @return null|ISchemaWrapper
*/
public function changeSchema(IOutput $output, \Closure $schemaClosure, array $options) {
/** @var ISchemaWrapper $schema */
$schema = $schemaClosure();
$table = $schema->getTable('authtoken');
if (!$table->hasColumn('expires')) {
$table->addColumn('expires', 'integer', [
'notnull' => false,
'length' => 4,
'default' => null,
'unsigned' => true,
]);
return $schema;
}
return null;
}
}

15
lib/composer/composer/ClassLoader.php
View File

@ -43,8 +43,7 @@ namespace Composer\Autoload;
class ClassLoader
{
// PSR-4
private $firstCharsPsr4 = array();
private $prefixLengthsPsr4 = array(); // For BC with legacy static maps
private $prefixLengthsPsr4 = array();
private $prefixDirsPsr4 = array();
private $fallbackDirsPsr4 = array();
@ -171,10 +170,11 @@ class ClassLoader
}
} elseif (!isset($this->prefixDirsPsr4[$prefix])) {
// Register directories for a new namespace.
if ('\\' !== substr($prefix, -1)) {
$length = strlen($prefix);
if ('\\' !== $prefix[$length - 1]) {
throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator.");
}
$this->firstCharsPsr4[$prefix[0]] = true;
$this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length;
$this->prefixDirsPsr4[$prefix] = (array) $paths;
} elseif ($prepend) {
// Prepend directories for an already registered namespace.
@ -221,10 +221,11 @@ class ClassLoader
if (!$prefix) {
$this->fallbackDirsPsr4 = (array) $paths;
} else {
if ('\\' !== substr($prefix, -1)) {
$length = strlen($prefix);
if ('\\' !== $prefix[$length - 1]) {
throw new \InvalidArgumentException("A non-empty PSR-4 prefix must end with a namespace separator.");
}
$this->firstCharsPsr4[$prefix[0]] = true;
$this->prefixLengthsPsr4[$prefix[0]][$prefix] = $length;
$this->prefixDirsPsr4[$prefix] = (array) $paths;
}
}
@ -372,7 +373,7 @@ class ClassLoader
$logicalPathPsr4 = strtr($class, '\\', DIRECTORY_SEPARATOR) . $ext;
$first = $class[0];
if (isset($this->firstCharsPsr4[$first]) || isset($this->prefixLengthsPsr4[$first])) {
if (isset($this->prefixLengthsPsr4[$first])) {
$subPath = $class;
while (false !== $lastPos = strrpos($subPath, '\\')) {
$subPath = substr($subPath, 0, $lastPos);

2
lib/composer/composer/autoload_classmap.php
View File

@ -394,6 +394,7 @@ return array(
'OC\\Authentication\\Token\\DefaultTokenCleanupJob' => $baseDir . '/lib/private/Authentication/Token/DefaultTokenCleanupJob.php',
'OC\\Authentication\\Token\\DefaultTokenMapper' => $baseDir . '/lib/private/Authentication/Token/DefaultTokenMapper.php',
'OC\\Authentication\\Token\\DefaultTokenProvider' => $baseDir . '/lib/private/Authentication/Token/DefaultTokenProvider.php',
'OC\\Authentication\\Token\\ExpiredTokenException' => $baseDir . '/lib/private/Authentication/Exceptions/ExpiredTokenException.php',
'OC\\Authentication\\Token\\IProvider' => $baseDir . '/lib/private/Authentication/Token/IProvider.php',
'OC\\Authentication\\Token\\IToken' => $baseDir . '/lib/private/Authentication/Token/IToken.php',
'OC\\Authentication\\TwoFactorAuth\\Manager' => $baseDir . '/lib/private/Authentication/TwoFactorAuth/Manager.php',
@ -537,6 +538,7 @@ return array(
'OC\\Core\\Migrations\\Version13000Date20170814074715' => $baseDir . '/core/Migrations/Version13000Date20170814074715.php',
'OC\\Core\\Migrations\\Version13000Date20170919121250' => $baseDir . '/core/Migrations/Version13000Date20170919121250.php',
'OC\\Core\\Migrations\\Version13000Date20170926101637' => $baseDir . '/core/Migrations/Version13000Date20170926101637.php',
'OC\\Core\\Migrations\\Version13000Date20180516101403' => $baseDir . '/core/Migrations/Version13000Date20180516101403.php',
'OC\\DB\\Adapter' => $baseDir . '/lib/private/DB/Adapter.php',
'OC\\DB\\AdapterMySQL' => $baseDir . '/lib/private/DB/AdapterMySQL.php',
'OC\\DB\\AdapterOCI8' => $baseDir . '/lib/private/DB/AdapterOCI8.php',

14
lib/composer/composer/autoload_static.php
View File

@ -6,8 +6,14 @@ namespace Composer\Autoload;
class ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c
{
public static $firstCharsPsr4 = array (
'O' => true,
public static $prefixLengthsPsr4 = array (
'O' =>
array (
'OC\\Settings\\' => 12,
'OC\\Core\\' => 8,
'OC\\' => 3,
'OCP\\' => 4,
),
);
public static $prefixDirsPsr4 = array (
@ -418,6 +424,7 @@ class ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c
'OC\\Authentication\\Token\\DefaultTokenCleanupJob' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/DefaultTokenCleanupJob.php',
'OC\\Authentication\\Token\\DefaultTokenMapper' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/DefaultTokenMapper.php',
'OC\\Authentication\\Token\\DefaultTokenProvider' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/DefaultTokenProvider.php',
'OC\\Authentication\\Token\\ExpiredTokenException' => __DIR__ . '/../../..' . '/lib/private/Authentication/Exceptions/ExpiredTokenException.php',
'OC\\Authentication\\Token\\IProvider' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/IProvider.php',
'OC\\Authentication\\Token\\IToken' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/IToken.php',
'OC\\Authentication\\TwoFactorAuth\\Manager' => __DIR__ . '/../../..' . '/lib/private/Authentication/TwoFactorAuth/Manager.php',
@ -561,6 +568,7 @@ class ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c
'OC\\Core\\Migrations\\Version13000Date20170814074715' => __DIR__ . '/../../..' . '/core/Migrations/Version13000Date20170814074715.php',
'OC\\Core\\Migrations\\Version13000Date20170919121250' => __DIR__ . '/../../..' . '/core/Migrations/Version13000Date20170919121250.php',
'OC\\Core\\Migrations\\Version13000Date20170926101637' => __DIR__ . '/../../..' . '/core/Migrations/Version13000Date20170926101637.php',
'OC\\Core\\Migrations\\Version13000Date20180516101403' => __DIR__ . '/../../..' . '/core/Migrations/Version13000Date20180516101403.php',
'OC\\DB\\Adapter' => __DIR__ . '/../../..' . '/lib/private/DB/Adapter.php',
'OC\\DB\\AdapterMySQL' => __DIR__ . '/../../..' . '/lib/private/DB/AdapterMySQL.php',
'OC\\DB\\AdapterOCI8' => __DIR__ . '/../../..' . '/lib/private/DB/AdapterOCI8.php',
@ -986,7 +994,7 @@ class ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c
public static function getInitializer(ClassLoader $loader)
{
return \Closure::bind(function () use ($loader) {
$loader->firstCharsPsr4 = ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c::$firstCharsPsr4;
$loader->prefixLengthsPsr4 = ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c::$prefixLengthsPsr4;
$loader->prefixDirsPsr4 = ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c::$prefixDirsPsr4;
$loader->classMap = ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c::$classMap;

40
lib/private/Authentication/Exceptions/ExpiredTokenException.php Normal file
View File

@ -0,0 +1,40 @@
<?php
/**
* @copyright Copyright (c) 2018 Roeland Jago Douma <roeland@famdouma.nl>
*
* @author Roeland Jago Douma <roeland@famdouma.nl>
*
* @license GNU AGPL version 3 or any later version
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
*/
namespace OC\Authentication\Token;
use OC\Authentication\Exceptions\InvalidTokenException;
class ExpiredTokenException extends InvalidTokenException {
/** @var IToken */
private $token;
public function __construct(IToken $token) {
parent::__construct();
$this->token = $token;
}
public function getToken() {
return $this->token;
}
}

26
lib/private/Authentication/Token/DefaultToken.php
View File

@ -29,10 +29,8 @@ use OCP\AppFramework\Db\Entity;
* @method void setId(int $id)
* @method void setUid(string $uid);
* @method void setLoginName(string $loginName)
* @method void setPassword(string $password)
* @method void setName(string $name)
* @method string getName()
* @method void setToken(string $token)
* @method string getToken()
* @method void setType(string $type)
* @method int getType()
@ -93,10 +91,15 @@ class DefaultToken extends Entity implements IToken {
*/
protected $scope;
/** @var int */
protected $expires;
public function __construct() {
$this->addType('type', 'int');
$this->addType('lastActivity', 'int');
$this->addType('lastCheck', 'int');
$this->addType('scope', 'string');
$this->addType('expires', 'int');
}
public function getId() {
@ -174,4 +177,23 @@ class DefaultToken extends Entity implements IToken {
parent::setScope((string)$scope);
}
}
public function setToken($token) {
parent::setToken($token);
}
public function setPassword($password = null) {
parent::setPassword($password);
}
public function setExpires($expires) {
parent::setExpires($expires);
}
/**
* @return int|null
*/
public function getExpires() {
return parent::getExpires();
}
}

6
lib/private/Authentication/Token/DefaultTokenMapper.php
View File

@ -78,7 +78,7 @@ class DefaultTokenMapper extends Mapper {
public function getToken($token) {
/* @var $qb IQueryBuilder */
$qb = $this->db->getQueryBuilder();
$result = $qb->select('id', 'uid', 'login_name', 'password', 'name', 'type', 'remember', 'token', 'last_activity', 'last_check', 'scope')
$result = $qb->select('*')
->from('authtoken')
->where($qb->expr()->eq('token', $qb->createNamedParameter($token)))
->execute();
@ -101,7 +101,7 @@ class DefaultTokenMapper extends Mapper {
public function getTokenById($id) {
/* @var $qb IQueryBuilder */
$qb = $this->db->getQueryBuilder();
$result = $qb->select('id', 'uid', 'login_name', 'password', 'name', 'type', 'token', 'last_activity', 'last_check', 'scope')
$result = $qb->select('*')
->from('authtoken')
->where($qb->expr()->eq('id', $qb->createNamedParameter($id)))
->execute();
@ -126,7 +126,7 @@ class DefaultTokenMapper extends Mapper {
public function getTokenByUser(IUser $user) {
/* @var $qb IQueryBuilder */
$qb = $this->db->getQueryBuilder();
$qb->select('id', 'uid', 'login_name', 'password', 'name', 'type', 'remember', 'token', 'last_activity', 'last_check', 'scope')
$qb->select('*')
->from('authtoken')
->where($qb->expr()->eq('uid', $qb->createNamedParameter($user->getUID())))
->setMaxResults(1000);

41
lib/private/Authentication/Token/DefaultTokenProvider.php
View File

@ -155,13 +155,20 @@ class DefaultTokenProvider implements IProvider {
* @param string $tokenId
* @throws InvalidTokenException
* @return DefaultToken
* @throws ExpiredTokenException
*/
public function getToken($tokenId) {
try {
return $this->mapper->getToken($this->hashToken($tokenId));
$token = $this->mapper->getToken($this->hashToken($tokenId));
} catch (DoesNotExistException $ex) {
throw new InvalidTokenException();
}
if ($token->getExpires() !== null && $token->getExpires() < $this->time->getTime()) {
throw new ExpiredTokenException($token);
}
return $token;
}
/**
@ -170,13 +177,21 @@ class DefaultTokenProvider implements IProvider {
* @param string $tokenId
* @throws InvalidTokenException
* @return DefaultToken
* @throws ExpiredTokenException
* @return IToken
*/
public function getTokenById($tokenId) {
try {
return $this->mapper->getTokenById($tokenId);
$token = $this->mapper->getTokenById($tokenId);
} catch (DoesNotExistException $ex) {
throw new InvalidTokenException();
}
if ($token->getExpires() !== null && $token->getExpires() < $this->time->getTime()) {
throw new ExpiredTokenException($token);
}
return $token;
}
/**
@ -266,6 +281,28 @@ class DefaultTokenProvider implements IProvider {
$this->mapper->invalidateOld($rememberThreshold, IToken::REMEMBER);
}
/**
* Rotate the token. Usefull for for example oauth tokens
*
* @param IToken $token
* @param string $oldTokenId
* @param string $newTokenId
* @return IToken
*/
public function rotate(IToken $token, $oldTokenId, $newTokenId) {
try {
$password = $this->getPassword($token, $oldTokenId);
$token->setPassword($this->encryptPassword($password, $newTokenId));
} catch (PasswordlessTokenException $e) {
}
$token->setToken($this->hashToken($newTokenId));
$this->updateToken($token);
return $token;
}
/**
* @param string $token
* @return string

12
lib/private/Authentication/Token/IProvider.php
View File

@ -51,6 +51,7 @@ interface IProvider {
*
* @param string $tokenId
* @throws InvalidTokenException
* @throws ExpiredTokenException
* @return IToken
*/
public function getToken($tokenId);
@ -61,6 +62,7 @@ interface IProvider {
* @param string $tokenId
* @throws InvalidTokenException
* @return DefaultToken
* @throws ExpiredTokenException
*/
public function getTokenById($tokenId);
@ -138,4 +140,14 @@ interface IProvider {
* @throws InvalidTokenException
*/
public function setPassword(IToken $token, $tokenId, $password);
/**
* Rotate the token. Usefull for for example oauth tokens
*
* @param IToken $token
* @param string $oldTokenId
* @param string $newTokenId
* @return IToken
*/
public function rotate(IToken $token, $oldTokenId, $newTokenId);
}

21
lib/private/Authentication/Token/IToken.php
View File

@ -94,4 +94,25 @@ interface IToken extends JsonSerializable {
* @param array $scope
*/
public function setScope($scope);
/**
* Set the token
*
* @param string $token
*/
public function setToken($token);
/**
* Set the password
*
* @param string $password
*/
public function setPassword($password);
/**
* Set the expiration time of the token
*
* @param int|null $expires
*/
public function setExpires($expires);
}

117
tests/lib/Authentication/Token/DefaultTokenProviderTest.php
View File

@ -25,6 +25,7 @@ namespace Test\Authentication\Token;
use OC\Authentication\Exceptions\InvalidTokenException;
use OC\Authentication\Token\DefaultToken;
use OC\Authentication\Token\DefaultTokenProvider;
use OC\Authentication\Token\ExpiredTokenException;
use OC\Authentication\Token\IToken;
use OCP\AppFramework\Db\DoesNotExistException;
use OCP\AppFramework\Db\Mapper;
@ -397,6 +398,63 @@ class DefaultTokenProviderTest extends TestCase {
$this->tokenProvider->renewSessionToken('oldId', 'newId');
}
public function testGetToken() {
$token = new DefaultToken();
$this->config->method('getSystemValue')
->with('secret')
->willReturn('mysecret');
$this->mapper->method('getToken')
->with(
$this->callback(function ($token) {
return hash('sha512', 'unhashedTokenmysecret') === $token;
})
)->willReturn($token);
$this->assertSame($token, $this->tokenProvider->getToken('unhashedToken'));
}
public function testGetInvalidToken() {
$this->expectException(InvalidTokenException::class);
$this->config->method('getSystemValue')
->with('secret')
->willReturn('mysecret');
$this->mapper->method('getToken')
->with(
$this->callback(function ($token) {
return hash('sha512', 'unhashedTokenmysecret') === $token;
})
)->willThrowException(new InvalidTokenException());
$this->tokenProvider->getToken('unhashedToken');
}
public function testGetExpiredToken() {
$token = new DefaultToken();
$token->setExpires(42);
$this->config->method('getSystemValue')
->with('secret')
->willReturn('mysecret');
$this->mapper->method('getToken')
->with(
$this->callback(function ($token) {
return hash('sha512', 'unhashedTokenmysecret') === $token;
})
)->willReturn($token);
try {
$this->tokenProvider->getToken('unhashedToken');
} catch (ExpiredTokenException $e) {
$this->assertSame($token, $e->getToken());
}
}
public function testGetTokenById() {
$token = $this->createMock(DefaultToken::class);
@ -418,4 +476,63 @@ class DefaultTokenProviderTest extends TestCase {
$this->tokenProvider->getTokenById(42);
}
public function testGetExpiredTokenById() {
$token = new DefaultToken();
$token->setExpires(42);
$this->mapper->expects($this->once())
->method('getTokenById')
->with($this->equalTo(42))
->willReturn($token);
try {
$this->tokenProvider->getTokenById(42);
$this->fail();
} catch (ExpiredTokenException $e) {
$this->assertSame($token, $e->getToken());
}
}
public function testRotate() {
$token = new DefaultToken();
$token->setPassword('oldencryptedpassword');
$this->config->method('getSystemValue')
->with('secret')
->willReturn('mysecret');
$this->crypto->method('decrypt')
->with('oldencryptedpassword', 'oldtokenmysecret')
->willReturn('mypassword');
$this->crypto->method('encrypt')
->with('mypassword', 'newtokenmysecret')
->willReturn('newencryptedpassword');
$this->mapper->expects($this->once())
->method('update')
->with($this->callback(function (DefaultToken $token) {
return $token->getPassword() === 'newencryptedpassword' &&
$token->getToken() === hash('sha512', 'newtokenmysecret');
}));
$this->tokenProvider->rotate($token, 'oldtoken', 'newtoken');
}
public function testRotateNoPassword() {
$token = new DefaultToken();
$this->config->method('getSystemValue')
->with('secret')
->willReturn('mysecret');
$this->mapper->expects($this->once())
->method('update')
->with($this->callback(function (DefaultToken $token) {
return $token->getPassword() === null &&
$token->getToken() === hash('sha512', 'newtokenmysecret');
}));
$this->tokenProvider->rotate($token, 'oldtoken', 'newtoken');
}
}

2
version.php
View File

@ -29,7 +29,7 @@
// between betas, final and RCs. This is _not_ the public version number. Reset minor/patchlevel
// when updating major/minor version number.
$OC_Version = array(13, 0, 2, 1);
$OC_Version = array(13, 0, 2, 2);
// The human readable string
$OC_VersionString = '13.0.2';