25ed6714c7
dont update the auth token twice
...
Signed-off-by: Robin Appelman <robin@icewind.nl>
2016-10-11 11:05:25 +02:00
1273d82e8b
Cache non existing DB user
...
We always query the database backend. Even if we use a different one
(ldap for example). Now we do this everytime we try to get a user object
so caching that a user is not in the DB safes some queries on each
request then (at least 2 what I found).
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-10 09:30:36 +02:00
4d1acfd4ef
Only trigger postDelete hooks when the user was deleted...
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-09-29 15:40:53 +02:00
5b7b8f8dac
Remove notifications upon user deletion
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-09-29 15:40:52 +02:00
57f9117843
Merge pull request #1087 from nextcloud/get-delay-twice
...
dont get bruteforce delay twice
2016-08-30 18:43:01 +02:00
82e8762c84
Fix issues where some user settings cannot be loaded when the user id differs in case sensitivity - fixes #25684 ( #25686 )
2016-08-29 14:33:16 +02:00
6c93fe08f5
dont get bruteforce delay twice
2016-08-29 13:36:49 +02:00
6c360ad79f
Add PHPdoc
2016-08-15 11:14:28 +02:00
291b3fd8b4
missing PHPDoc
2016-08-14 19:37:52 +02:00
da5633c31a
Type compatability
2016-08-14 19:37:37 +02:00
3593668413
Method is deprecated
2016-08-14 19:37:11 +02:00
5aef60d2ca
Unreachable statement
2016-08-14 19:36:42 +02:00
d2a16c4dc8
Unnecessary fully qualified names
2016-08-14 19:36:06 +02:00
5fb39bd0cb
Apply password policy on user creation
2016-08-03 11:52:15 +02:00
0215b004da
Update with robin
2016-07-21 18:13:58 +02:00
ba87db3fcc
Fix others
2016-07-21 18:13:57 +02:00
c1589f163c
Mitigate race condition
2016-07-20 23:09:27 +02:00
ba4f12baa0
Implement brute force protection
...
Class Throttler implements the bruteforce protection for security actions in
Nextcloud.
It is working by logging invalid login attempts to the database and slowing
down all login attempts from the same subnet. The max delay is 30 seconds and
the starting delay are 200 milliseconds. (after the first failed login)
2016-07-20 22:08:56 +02:00
179a355b2c
Merge remote-tracking branch 'upstream/master' into master-sync-upstream
2016-07-01 11:36:35 +02:00
1710de8afb
Login hooks ( #25260 )
...
* fix login hooks
* adjust user session tests
* fix login return value of successful token logins
* trigger preLogin hook earlier; extract method 'loginWithPassword'
* call postLogin hook earlier; add PHPDoc
2016-06-27 22:16:22 +02:00
6670d37658
Merge remote-tracking branch 'upstream/master' into master-sync-upstream
2016-06-27 18:23:00 +02:00
2a990a0db5
verify user password on change
2016-06-27 14:08:11 +02:00
89198e62e8
check login name when authenticating with client token
2016-06-24 13:57:09 +02:00
3db5de95bd
Merge pull request #25172 from owncloud/token-login-validation
...
Token login validation
2016-06-22 13:58:56 +02:00
b805908dca
update session token password on user password change
2016-06-21 10:24:25 +02:00
56199eba37
fix unit test warning/errors
2016-06-20 10:41:23 +02:00
9d74ff02a4
fix nitpick
2016-06-20 09:13:47 +02:00
1889df5c7c
dont create a session token for clients, validate the app password instead
2016-06-17 15:42:28 +02:00
0c0a216f42
store last check timestamp in token instead of session
2016-06-17 15:42:28 +02:00
c4149c59c2
use token last_activity instead of session value
2016-06-17 15:42:28 +02:00
82b50d126c
add PasswordLoginForbiddenException
2016-06-17 11:02:07 +02:00
465807490d
create session token only for clients that support cookies
2016-06-13 19:44:05 +02:00
331d88bcab
create session token on all APIs
2016-06-13 15:38:34 +02:00
6ba18934e6
Merge pull request #25000 from owncloud/fix-email-login-dav
...
Allow login by email address via webdav as well
2016-06-09 16:28:06 +02:00
f20c617154
Allow login by email address via webdav as well - fixes #24791
2016-06-09 12:08:49 +02:00
46e26f6b49
catch sessionnotavailable exception if memory session is used
2016-06-08 15:03:15 +02:00
ec929f07f2
When creating a session token, make sure it's the login password and not a device token
2016-06-08 13:31:55 +02:00
c58d8159d7
Create session tokens for apache auth users
2016-05-31 17:07:49 +02:00
aba539703c
Update license headers
2016-05-26 19:57:24 +02:00
a922957f76
add default token auth config on install, upgrade and add it to sample config
2016-05-24 18:02:52 +02:00
28ce7dd262
do not allow client password logins if token auth is enforced or 2FA is enabled
2016-05-24 17:54:02 +02:00
ad10485cec
when generating browser/device token, save the login name for later password checks
2016-05-24 11:49:15 +02:00
4128b853e5
login explicitly
2016-05-24 09:48:02 +02:00
5a8af2f0be
Merge pull request #24729 from owncloud/try-token-login-first
...
try token login first
2016-05-23 20:50:57 +02:00
4f6670d759
Merge pull request #24658 from owncloud/invalidate-disabled-user-session
...
invalidate user session if the user was disabled
2016-05-23 20:50:25 +02:00
dfb4d426c2
Add two factor auth to core
2016-05-23 11:21:10 +02:00
c20cdc2213
invalidate user session if the user is disabled
2016-05-23 10:32:16 +02:00
11dc97da43
try token login first
2016-05-20 10:52:39 +02:00
f824f3e5f3
don't allow token login for disabled users
2016-05-18 21:10:37 +02:00
98b465a8b9
a single token provider suffices
2016-05-18 09:20:48 +02:00
Robin Appelman
Roeland Jago Douma
Joas Schilling
Lukas Reschke
Thomas Müller
Jörn Friedrich Dreyer
michag86
Lukas Reschke
Christoph Wurst
Bjoern Schiessle
Christoph Wurst
Vincent Petry
Thomas Müller