mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #22276 from owncloud/harden-updater-auth 

Harden updater authentication
This commit is contained in:
Thomas Müller 2016-02-10 17:31:38 +01:00
parent 6ffb83ae19 5680743c2b
commit 6b836325cf
3 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
apps/updatenotification/controller/admincontroller.php
View File

@ -77,8 +77,8 @@ class AdminController extends Controller {
$this->config->setAppValue('core', 'updater.secret.created', $this->timeFactory->getTime()); $this->config->setAppValue('core', 'updater.secret.created', $this->timeFactory->getTime());
// Create a new token // Create a new token
$newToken = $this->secureRandom->generate(32); $newToken = $this->secureRandom->generate(64);
$this->config->setSystemValue('updater.secret', $newToken); $this->config->setSystemValue('updater.secret', password_hash($newToken, PASSWORD_DEFAULT));
return new DataResponse($newToken); return new DataResponse($newToken);
} }

3
apps/updatenotification/lib/resettokenbackgroundjob.php
View File

@ -67,7 +67,8 @@ class ResetTokenBackgroundJob extends TimedJob {
* @param $argument * @param $argument
*/ */
protected function run($argument) { protected function run($argument) {
if($this->timeFactory->getTime() - $this->config->getAppValue('core', 'updater.secret.created', $this->timeFactory->getTime()) >= 86400) { // Delete old tokens after 2 days
if($this->timeFactory->getTime() - $this->config->getAppValue('core', 'updater.secret.created', $this->timeFactory->getTime()) >= 172800) {
$this->config->deleteSystemValue('updater.secret'); $this->config->deleteSystemValue('updater.secret');
} }
} }

4
apps/updatenotification/tests/controller/AdminControllerTest.php
View File

@ -77,12 +77,12 @@ class AdminControllerTest extends TestCase {
$this->secureRandom $this->secureRandom
->expects($this->once()) ->expects($this->once())
->method('generate') ->method('generate')
->with(32) ->with(64)
->willReturn('MyGeneratedToken'); ->willReturn('MyGeneratedToken');
$this->config $this->config
->expects($this->once()) ->expects($this->once())
->method('setSystemValue') ->method('setSystemValue')
->with('updater.secret', 'MyGeneratedToken'); ->with('updater.secret');
$this->timeFactory $this->timeFactory
->expects($this->once()) ->expects($this->once())
->method('getTime') ->method('getTime')