Commit Graph

377 Commits

Author SHA1 Message Date
Julius Härtl 53ac9bdda1
Implement frontend for search/rename
Signed-off-by: Julius Härtl <jus@bitgrid.net>

Move to vuex

Signed-off-by: Julius Härtl <jus@bitgrid.net>
2019-03-01 20:56:18 +01:00
Julius Härtl 88aa3de784
Add iconClass to resources
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2019-03-01 20:56:17 +01:00
Julius Härtl 555afff015
Make sure we query the node before fetching the name
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2019-03-01 20:56:17 +01:00
Julius Härtl a72a6d73a3
Adjust parameter names on createCollectionOnResource
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2019-03-01 20:56:16 +01:00
Joas Schilling 702dcfb728
Make names mandatory
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-01 20:56:16 +01:00
Joas Schilling 5dfc56e925
Allow to create collections
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-01 20:56:15 +01:00
Joas Schilling 136d2c39ac
Provider functionality
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-01 20:56:15 +01:00
Joas Schilling 65a9ab47ea
Add a controller with the most important methods
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-01 20:56:15 +01:00
Joas Schilling 55f627d20b
Add an event to the Autocomplete Controller to allow to filter the results
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-02-26 15:32:14 +01:00
Morris Jobke 5cbe6532a0
Fix typo in info log for autoconfig
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2019-02-25 21:28:22 +01:00
Roeland Jago Douma e819e97829
Login flow V2
This adds the new login flow. The desktop client will open up a browser
and poll a returned endpoint at regular intervals to check if the flow
is done.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-02-25 07:24:50 +01:00
Daniel Kesselberg c583c5e7e2
Emit event if app password created
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2019-02-18 17:47:43 +01:00
Daniel Kesselberg 149a98edf6
Publish activity for app token created by client login flow
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2019-02-17 23:49:54 +01:00
Daniel Kesselberg 2ade2bef8c
Publish activity for app token created by ocs api
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2019-02-17 23:37:22 +01:00
Morris Jobke 0e9903c420
Merge pull request #13969 from nextcloud/enh/additional_scripts_no_on_public_pages
No need to emit additonalscript event on public pages
2019-02-07 15:57:14 +01:00
Michael Weimann bf1253cb49
Implement guest avatar endpoint
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
2019-02-07 14:23:16 +01:00
Roeland Jago Douma 60e5a5eca4
Do not do redirect handling when loggin out
Fixes #12568
Since the clearing of the execution context causes another reload. We
should not do the redirect_uri handling as this results in redirecting
back to the logout page on login.

This adds a simple middleware that will just check if the
ClearExecutionContext session variable is set. If that is the case it
will just redirect back to the login page.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-02-06 11:29:32 +01:00
Roeland Jago Douma b68567e9ba
Add StandaloneTemplateResponse
This can be used by pages that do not have the full Nextcloud UI.
So notifications etc do not load there.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-02-06 11:26:18 +01:00
Roeland Jago Douma deb7d2364f
Merge pull request #13869 from nextcloud/enh/clean_pending_2fa_session_on_password_change
Clean pending 2FA authentication on password reset
2019-01-29 19:50:15 +01:00
Roeland Jago Douma ac8a6e2244
Clean pending 2FA authentication on password reset
When a password is reste we should make sure that all users are properly
logged in. Pending states should be cleared. For example a session where
the 2FA code is not entered yet should be cleared.

The token is now removed so the session will be killed the next time
this is checked (within 5 minutes).

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-01-29 13:08:56 +01:00
Michael Weimann e083e8abc6
Clears the local storage after logout
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
2019-01-29 09:02:52 +01:00
Roeland Jago Douma e6333c8fe3
Honor remember_login_cookie_lifetime
If the remember_login_cookie_lifetime is set to 0 this means we do not
want to use remember me at all. In that case we should also not creatae
a remember me cookie and should create a proper temp token.

Further this specifies that is not 0 the remember me time should always
be larger than the session timeout. Because else the behavior is not
really defined.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-01-23 08:46:24 +01:00
Roeland Jago Douma 66367797df
Fix template paramter
Else we get shown an error page instead of the correct 403.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-01-18 15:30:38 +01:00
Roeland Jago Douma d0397f9b53
Generic message on password reset
There is no need to inform the user if the account existed or not.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-01-15 15:53:43 +01:00
Christoph Wurst 208788173d
Npmize (vendor) scripts
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2019-01-09 15:01:59 +01:00
Roeland Jago Douma e6ac233947
Fix loginflow with apptoken enter on iOS
It seems iOS doesn't like us to change the location. So now we submit it
to the server that geneartes the redirect.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-01-04 21:51:36 +01:00
Roeland Jago Douma 763b52d402
Fix SAML Client login flow on Apple devices
Because the redirect from the SAML/SSO endpoint is a POST the lax/strict
cookies are not properly send.

Note that it is not strictly requried on this endpoint as we do not need
the remember me data. Only the real session info is enough. The endpoint
is also already protected by a state token.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-12-17 12:50:32 +01:00
John Molakvoæ (skjnldsv) 5e4990fadd
Remove redirect page
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-11-29 10:27:22 +01:00
Roeland Jago Douma 43d6ae7476
Respect the disabled setting for lost_password_link
Fixes #11146
As documented when it is set to disabled the user can't request a lost
password.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-11-20 13:28:40 +01:00
Roeland Jago Douma 92582a350d
Use the proper server for the apptoken flow login
If a user can't authenticate normally (because they have 2FA that is not
available on their devices for example). The redirect that is generated
should be of the proper format.

This means

1. Include the protocol
2. Include the possible subfolder

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-11-01 11:45:35 +01:00
Rayn0r 85eb43baff added possibility to disable autocomplete in login form
Signed-off-by: Rayn0r <Andre.Weidemann@web.de>
2018-10-30 11:36:16 +01:00
Julius Härtl d21ded67a7
Keep list of icons in a separate file for use in the accessibility app
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-10-25 12:16:10 +02:00
Morris Jobke e0f9257be9
Merge pull request #11847 from iPaat/Fix/DeleteCookiesThroughClearSiteData
Remove cookies from Clear-Site-Data Header
2018-10-23 17:04:45 +02:00
Thomas Citharel d63de5471b Don't require Same Site Cookies on assets
Which can be used for public iframe embeeding

See https://github.com/nextcloud/calendar/issues/169

Signed-off-by: Thomas Citharel <tcit@tcit.fr>
2018-10-17 09:24:21 +02:00
Patrick Conrad 1806baaeaf
Remove cookies from Clear-Site-Data Header
In 2f87fb6b45 this header was introduced. The referenced documentation says:

> When delivered with a response from https://example.com/clear, the following header will cause cookies associated with the origin https://example.com to be cleared, as well as cookies on any origin in the same registered domain (e.g. https://www.example.com/ and https://more.subdomains.example.com/).

This also applies if `https://nextcloud.example.com/` sends the `Clear-Site-Data: "cookies"` header.
This is not the behavior we want at this point!

So I removed the deletion of cookies from the header. This has no effect on the logout process as this header is supported only recently and the logout works in old browsers as well.

Signed-off-by: Patrick Conrad <conrad@iza.org>
2018-10-15 14:46:06 +02:00
Morris Jobke 7971ba5cc6
Merge pull request #10898 from nextcloud/feature/10684/default-logo-color-theme-colors
Switches the default logo color depending on the primary color
2018-10-08 10:33:22 +02:00
Roeland Jago Douma 78273cb1e6
Add an endppoint for clients to request an app password
Now that we allow enforcing 2 factor auth it make sense if we also allow
and endpoint where the clients can in the background fetch an
apppassword if they were configured before the login flow was present.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-10-03 19:05:20 +02:00
Roeland Jago Douma d9febae5b2
Update all the publickey tokens if needed on web login
* On weblogin check if we have invalid public key tokens
* If so update them all with the new token

This ensures that your marked as invalid tokens work again if you once
login on the web.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-10-02 19:50:54 +02:00
Michael Weimann a45ec3d324
Refactors the scss svg functions
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
2018-10-02 08:37:55 +02:00
Michael Weimann d855c38e07
Moves the logo files to logo
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
2018-10-02 08:37:54 +02:00
blizzz ef97ef72f6
Merge pull request #10743 from danielkesselberg/bugfix/noid/allow-password-reset-for-duplicate-email
Enable password reset for user with same email address when only one is active
2018-09-13 10:48:30 +02:00
Roeland Jago Douma be2d8cc4e9
Do not invalidate main token on OAuth
Fixes #10584

We deleted the main token when using the login flow else mutliple tokens
would show up for a single user.

However in the case of OAuth this is perfectly fine as the
authentication happens really in your browser:

1. You are already logged in, no need to log you out
2. You are not logged in yet, but since you log in into the exact same
browser the expected behavior is to stay logged in.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-09-06 08:30:52 +02:00
Morris Jobke cf3f4888cc
Change password expiration time from 12h to 7d
We use the same logic for creating accounts without a password and there the 12h is a bit short. Users don't expect that the signup link needs to be clicked within 12h - 7d should be a more expected behavior.

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-08-31 13:31:03 +02:00
Morris Jobke 6099786c8d
Merge pull request #10670 from nextcloud/fix/login-throttle-username-length
Fix max length requirements for the throttler metadata
2018-08-24 16:25:35 +02:00
Daniel Kesselberg 031fdfb1fc
Enable password reset for user with same email address when only one is active
When two or more user share the same email address its not possible to
reset password by email. Even when only one account is active.

This pr reduce list of users returned by getByEmail by disabled users.

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2018-08-19 16:32:46 +02:00
Bjoern Schiessle dfec66ca02
only warn about data lose on password reset if per-user keys are used
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2018-08-15 15:08:34 +02:00
Christoph Wurst 42300d19e9
Fix max length requirements for the throttler metadata
If a failed login is logged, we save the username as metadata
in the bruteforce throttler. To prevent database error due to
very long strings, this truncates the username at 64 bytes in
the assumption that no real username is longer than that.long strings,

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-08-13 15:52:09 +02:00
Christoph Wurst d8197f2b97
Rename providerset method to get primary providers
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-08-08 20:28:21 +02:00
Christoph Wurst c6e47e8a51
Fix login redirection if only one 2FA provider is active
Fixes https://github.com/nextcloud/server/issues/10500.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-08-08 15:25:59 +02:00
Joas Schilling decd196162
Make the info available if the avatar was uploaded or generated
Signed-off-by: Joas Schilling <coding@schilljs.com>
2018-08-01 10:56:22 +02:00
Morris Jobke 70fa73404f
Merge pull request #10391 from nextcloud/bugfix/10389/fix-app-navigation-controller
Fix app navigation controller to return an array
2018-07-25 14:11:49 +02:00
Julius Härtl 4c773891d7
Fix app navigation controller to return an array
This is required to not break compatibility with existing consumers of that endpoint like the apps management or the client

Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-07-25 13:50:46 +02:00
Joas Schilling 12efde520d
Allow to access SVGs as guest
Signed-off-by: Joas Schilling <coding@schilljs.com>
2018-07-25 12:05:18 +02:00
Michael Weimann c92d7429d7 Implements handling for deactivated users
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
2018-07-21 13:05:13 +02:00
John Molakvoæ (skjnldsv) 37a4d2bbbc
Php code bump
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-07-19 22:46:32 +02:00
Julius Härtl bfc6fc8e50
Fix settings icon fetching
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-07-19 08:17:00 +02:00
John Molakvoæ (skjnldsv) 61946819ba
Fixed svg generator regex && added missing icons
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-07-19 08:16:59 +02:00
John Molakvoæ (skjnldsv) 9e5885963c
Fixed icons detection and caching
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-07-19 08:16:58 +02:00
John Molakvoæ (skjnldsv) 8977c71f88
Mixin scss icon api
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-07-19 08:16:58 +02:00
John Molakvoæ (skjnldsv) ccd70a4099
use built in response cacheFor function
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-07-19 08:16:58 +02:00
John Molakvoæ (skjnldsv) 29ff7efe9a
Svg icon api sass function and upgrade of all styles
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-07-19 08:16:57 +02:00
John Molakvoæ (skjnldsv) 98a0113d40
Svg from app
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-07-19 08:16:30 +02:00
John Molakvoæ (skjnldsv) 84e90e26c0
Svg color api
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-07-19 08:16:30 +02:00
Arthur Schiwon ca6094f390
wire the frontend
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2018-07-05 20:29:00 +02:00
Arthur Schiwon 772bbd99be
Backend work to provide NC whats New info to users
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2018-07-05 14:33:08 +02:00
Morris Jobke 9444a3fad1
Merge pull request #9632 from nextcloud/enhancement/stateful-2fa-providers
Stateful 2fa providers
2018-06-25 15:49:58 +02:00
Robin Appelman 8ed50d4b63
prefill userid for login after password reset
Signed-off-by: Robin Appelman <robin@icewind.nl>
2018-06-21 15:18:07 +02:00
Christoph Wurst 13d93f5b25
Make 2FA providers stateful
This adds persistence to the Nextcloud server 2FA logic so that the server
knows which 2FA providers are enabled for a specific user at any time, even
when the provider is not available.

The `IStatefulProvider` interface was added as tagging interface for providers
that are compatible with this new API.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-06-20 08:30:26 +02:00
John Molakvoæ (skjnldsv) 543188d0cb
Removed debug stack
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-06-15 15:40:10 +02:00
John Molakvoæ (skjnldsv) 156da29cea
Avatar imagick bump
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-06-13 18:46:05 +02:00
John Molakvoæ (skjnldsv) eea6f74ca4
Controller tests fixes
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-06-13 18:46:04 +02:00
John Molakvoæ (skjnldsv) adf3856d35
Return Svg avatars
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-06-13 18:46:04 +02:00
Roeland Jago Douma e5cc8be9d5
Fix usage
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-06-04 08:48:54 +02:00
Morris Jobke 245d20f9ac
Merge pull request #9531 from remyj38/master
Fix translation bug on lost password page
2018-05-22 16:31:30 +02:00
Roeland Jago Douma 5a97148863
Don't use special chars to avoid confusion
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-05-22 09:24:17 +02:00
Rémy Jacquin 04e1cab5ee
Fix translation bug on lost password page
Fix nextcloud/password_policy#26

Signed-off-by: Rémy Jacquin <remy@remyj.fr>
2018-05-20 12:51:50 +02:00
Arthur Schiwon 38a90130ce
move log constants to ILogger
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2018-04-26 10:45:52 +02:00
Roeland Jago Douma a07f6d46e3
Use proper types
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-04-11 00:21:25 +02:00
Morris Jobke fd3c97b93b
Avoid to leak a user ID that is not a string to reach a user backend
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-04-11 00:03:30 +02:00
Roeland Jago Douma b2350810e0
Merge pull request #9115 from nextcloud/feature/noid/login_flow_wording
Improve login flow
2018-04-09 08:45:27 +02:00
Roeland Jago Douma 177c8972cc
Improve login flow
* Add page explaining you are about to grant access
* Show grant access page after login

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-04-08 13:42:36 +02:00
Roeland Jago Douma 33b93db953
Remove unused parameter
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-04-06 21:44:23 +02:00
Roeland Jago Douma 2b7d4d5069
Fix tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-04-06 19:58:37 +02:00
Roeland Jago Douma caee215120
Always remember me
Fixes #8004

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-04-06 15:44:28 +02:00
Joas Schilling dabd7291c3
Make the new autocomplete endpoint OCS
Signed-off-by: Joas Schilling <coding@schilljs.com>
2018-03-21 09:46:52 +01:00
Roeland Jago Douma 796b4f19f8
Add Cache-control: immutable
Cache generated CSS forever!
Also cache combined JS forever
Fix tests

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-03-19 14:21:53 +01:00
Roeland Jago Douma 7674e591bd
Move search to proper Controller
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-03-09 14:36:48 +01:00
Christoph Wurst b9720703e8 Add CSRF token controller to retrieve the current CSRF token
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-03-08 16:48:50 +01:00
Julius Härtl 11b6cc3f68
Replace logout href to avoid new etag on every request
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-03-06 09:51:28 +01:00
Julius Härtl 723b8764d1
Add ETag to NavigationController
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-03-05 12:19:20 +01:00
Bjoern Schiessle 7d0102bf73
expose capabilities in js
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2018-02-27 12:29:25 +01:00
Joas Schilling 226e63695f
Merge pull request #8026 from nextcloud/feature/noid/allow-custom-html-in-html-emails
Allow custom HTML in HTML Emails
2018-02-26 13:38:39 +01:00
Arthur Schiwon ffc05e2fed
don't try login with the same name that just failed
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2018-02-22 13:05:48 +01:00
Roeland Jago Douma cf83eb5e77
Merge pull request #8336 from nextcloud/cleanup-unused-parameter
Cleanup unused parameter
2018-02-20 10:16:59 +01:00
Morris Jobke 14bc9b1714
Merge pull request #8095 from nextcloud/webapps-capabilities
Expose navigation entries as API endpoint
2018-02-15 16:55:12 +01:00
Joas Schilling 339e320064
Fix existing usages
Signed-off-by: Joas Schilling <coding@schilljs.com>
2018-02-15 12:18:51 +01:00
Morris Jobke d3d045dd5c
Remove unused import statements
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-02-14 16:55:43 +01:00
Morris Jobke bcf1668cc8
Remove config from AutoCompleteController
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-02-13 21:40:30 +01:00
Julius Härtl 5a23b35ddb
Also rewrite icon url
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-02-12 21:20:21 +01:00
Julius Härtl 922cf44c81
Move to OCS endpoint
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-02-12 17:22:33 +01:00