mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
57,129 Commits 349 Branches 696 Tags 1.6 GiB
Commit Graph

429 Commits

Author SHA1 Message Date
Roeland Jago Douma aa6d8fcdbf
Fix AvatarController 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-08-01 08:20:15 +02:00
Lukas Reschke f22ab3e665
Add metadata to \OCP\AppFramework\Http\Response::throttle 
Fixes https://github.com/nextcloud/server/issues/5891

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-07-27 14:17:45 +02:00
Morris Jobke 188b87e03b Cleanup legacy user class from unused methods 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-07-24 12:17:53 +02:00
Julius Härtl 51a0741005
Add public capabilities API 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2017-06-30 11:08:04 +02:00
Lukas Reschke 2f87fb6b45
Add Clear-Site-Data header 
This adds a Clear-Site-Data header to the logout response which will delete all relevant data in the caches which may contain potentially sensitive content.

See https://w3c.github.io/webappsec-clear-site-data/#header for the definition of the types.

Ref https://twitter.com/mikewest/status/877149667909406723

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-06-20 19:46:10 +02:00
Lukas Reschke 26ee889fec
Add tests for ClientFlowLoginController 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-05-18 20:49:08 +02:00
Lukas Reschke b07a0f51ba
Add OAuth state to session 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-05-18 20:49:08 +02:00
Bjoern Schiessle 23b296b66e
use name of oauth app to identify auth token 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2017-05-18 20:49:07 +02:00
Bjoern Schiessle a74d67b69c
show error page if no valid client identifier is given and if it is not a API request 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2017-05-18 20:49:06 +02:00
Lukas Reschke e86749121c
Remove special characters 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-05-18 20:49:05 +02:00
Lukas Reschke 5f71805c35
Add basic implementation for OAuth 2.0 Authorization Code Flow 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-05-18 20:49:03 +02:00
Joas Schilling 0828df5ed4
Disable the API endpoints as well 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-05-11 17:03:57 +02:00
Ujjwal Bhardwaj 7c23414eef
Disable reset password link. Issue: #27440 2017-05-11 10:27:33 +02:00
Joas Schilling d418ea550b
Automatic injection for CssController 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-05-10 09:42:40 +02:00
Joas Schilling 9c8fe82000
Automatic injection for JsController 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-05-10 09:42:15 +02:00
Mario Danic e4aac15a92
Update login flow redirection 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-05-04 19:21:22 +02:00
Morris Jobke 23cc309606
Handle more error cases 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-05-02 13:43:48 +02:00
Georg Ehrke 60f9ed6241
add contactsmenu popover 
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
 2017-04-26 09:26:53 +02:00
Jan-Christoph Borchardt 241e397326 Merge branch 'master' into contactsmenu 
Signed-off-by: Jan-Christoph Borchardt <hey@jancborchardt.net>
 2017-04-26 00:50:38 +02:00
Christoph Wurst 36cee1f386 Let apps register contact menu provider via info.xml 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-04-25 20:47:17 +02:00
Christoph Wurst d091793ceb Contacts menu 
* load list of contacts from the server
* show last message of each contact

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-04-25 20:47:17 +02:00
Roeland Jago Douma aae079aa29
AppToken to 72 chars 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-04-25 20:18:49 +02:00
Roeland Jago Douma bb5e5efa6d
Do not remove the state token to early 
we should check the stateToken before we remove it. Else the check will
always fail.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-04-25 20:18:49 +02:00
Lukas Reschke 6a16df7288
Add new auth flow 
This implements the basics for the new app-password based authentication flow for our clients.
The current implementation tries to keep it as simple as possible and works the following way:

1. Unauthenticated client opens `/index.php/login/flow`
2. User will be asked whether they want to grant access to the client
3. If accepted the user has the chance to do so using existing App Token or automatically generate an app password.

If the user chooses to use an existing app token then that one will simply be redirected to the `nc://` protocol handler.
While we can improve on that in the future, I think keeping this smaller at the moment has its advantages. Also, in the
near future we have to think about an automatic migration endpoint so there's that anyways :-)

If the user chooses to use the regular login the following happens:

1. A session state token is written to the session
2. User is redirected to the login page
3. If successfully authenticated they will be redirected to a page redirecting to the POST controller
4. The POST controller will check if the CSRF token as well as the state token is correct, if yes the user will be redirected to the `nc://` protocol handler.

This approach is quite simple but also allows to be extended in the future. One could for example allow external websites to consume this authentication endpoint as well.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-25 20:18:49 +02:00
Christoph Wurst bb1d191f82
Fix remember redirect_url on failed login attempts 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-04-25 09:38:19 +02:00
Joas Schilling 3d671cc536 Merge pull request #4443 from nextcloud/cleanup-unused-imports 
Remove unused use statements
 2017-04-24 11:47:37 +02:00
Lukas Reschke 8a1d3c7e87 Merge pull request #4434 from nextcloud/add-rate-limiting-to-solve-challenge-controller 
Add rate limit to TOTP solve challenge controller
 2017-04-24 10:03:19 +02:00
Morris Jobke c54a59d51e
Remove unused use statements 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-04-22 19:23:31 -05:00
Lukas Reschke d0d34d308a
Add at most 10 password reset requests per 5 minutes and IP range 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-22 08:12:54 +02:00
Lukas Reschke c1b8f152d8
Add rate limit to TOTP solve challenge controller 
Fixes https://github.com/nextcloud/server/issues/2626

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-22 07:59:40 +02:00
Morris Jobke 16c4755e03
Rename renderHTML to renderHtml 
* fixes #4383
* improves consistency

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-04-19 15:46:41 -05:00
Lukas Reschke 727688ebd9
Adjust existing bruteforce protection code 
- Moves code to annotation
- Adds the `throttle()` call on the responses on existing annotations

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-14 13:42:40 +02:00
Lukas Reschke 8149945a91
Make BruteForceProtection annotation more clever 
This makes the new `@BruteForceProtection` annotation more clever and moves the relevant code into it's own middleware.

Basically you can now set `@BruteForceProtection(action=$key)` as annotation and that will make the controller bruteforce protected. However, the difference to before is that you need to call `$responmse->throttle()` to increase the counter. Before the counter was increased every time which leads to all kind of unexpected problems.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-13 23:05:33 +02:00
Lukas Reschke 81d3732bf5 Merge pull request #4308 from nextcloud/lost-password-email 
Update email template for lost password email
 2017-04-13 20:02:15 +02:00
Morris Jobke d36751ee38 Merge pull request #2424 from nextcloud/fix-login-controller-test-consolidate-login 
Fix login controller test and consolidate login
 2017-04-13 12:16:38 -05:00
Lukas Reschke 66835476b5
Add support for ratelimiting via annotations 
This allows adding rate limiting via annotations to controllers, as one example:

```
@UserRateThrottle(limit=5, period=100)
@AnonRateThrottle(limit=1, period=100)
```

Would mean that logged-in users can access the page 5 times within 100 seconds, and anonymous users 1 time within 100 seconds. If only an AnonRateThrottle is specified that one will also be applied to logged-in users.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-13 12:00:16 +02:00
Morris Jobke 7cb6038fca Merge pull request #3043 from nextcloud/issue-3038-no-logentry-on-email-login 
Dont create a log entry on email login
 2017-04-13 01:04:11 -05:00
Morris Jobke 1f962f9115
Update email template for lost password email 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-04-12 15:19:53 -05:00
Morris Jobke 5b4adf66e5
Move OC_Defaults to OCP\Defaults 
* currently there are two ways to access default values:
  OCP\Defaults or OC_Defaults (which is extended by
  OCA\Theming\ThemingDefaults)
* our code used a mixture of both of them, which made
  it hard to work on theme values
* this extended the public interface with the missing
  methods and uses them everywhere to only rely on the
  public interface

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-04-09 21:43:01 -05:00
Joas Schilling 7ad791efb4
Dont create a log entry on email login 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-04-07 10:15:20 +02:00
Arthur Schiwon 7b3fdfeeaa
do login routine only once when done via LoginController 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2017-04-06 15:22:42 +02:00
Arthur Schiwon 2994cbc586
fix login controller tests 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2017-04-06 15:20:17 +02:00
Roeland Jago Douma 6bdd3a167d Merge pull request #4123 from nextcloud/allow-password-reset-with-email 
Allow to reset the password with the email as an input
 2017-04-05 09:12:41 +02:00
Morris Jobke 9813023aab
Fix gzip files for Safari 
* Safari support gzip only if the filename does not
  end on .gz - so this renames them to .gzip

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-03-29 00:11:51 -06:00
Roeland Jago Douma 54f9b35f71
Allow to gzip CSS/JS files 
Since in production the SCSS files are compiled once and the javascript
files are combined once we can just as well gzip them aggresively.

This means that once they are requested and the browser supports gzip we
can just serve the gzipped file saving precious bandwidth.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-03-28 21:46:23 +02:00
Joas Schilling 4bae7ef96d
Allow to reset the password with the email as an input 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-03-28 21:17:37 +02:00
Roeland Jago Douma 8e89ad21a2
[PoC] JS Combiner 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-03-24 10:58:10 +01:00
blizzz 19fc68cbdc Merge pull request #2606 from temparus/master 
Add preLoginValidation hook
 2017-02-15 21:47:47 +01:00
Joas Schilling ac841ee002 Merge pull request #3362 from nextcloud/fix/nc-token-cookie-name 
oc_token should be nc_token
 2017-02-09 10:07:59 +01:00
Sandro Lutz 9b6f99ab08 Update license header 
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
 2017-02-07 01:25:39 +01:00
Sandro Lutz fa1d607bfa Merge remote-tracking branch 'nextcloud/master' 
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
 2017-02-07 00:15:30 +01:00
Sandro Lutz ff3fa538e4 Add missing use statement for PublicEmitter 
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
 2017-02-07 00:12:19 +01:00
Christoph Wurst 5e728d0eda oc_token should be nc_token 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-02-02 21:56:44 +01:00
Sandro Lutz 20f878b014 Fix typo for UserManager variable 
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
 2017-02-01 21:54:00 +01:00
Sandro Lutz 6feff0ceba Add check if UserManager is of type PublicEmitter before calling preLogin hook 
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
 2017-02-01 21:53:50 +01:00
Sandro Lutz e30d28f7eb Change where preLogin hook gets called 
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
 2017-02-01 21:53:42 +01:00
Sandro Lutz 6ab0a3215d Remove preLoginValidation hook 
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
 2017-02-01 21:53:29 +01:00
Sandro Lutz e14d50eb1f Fix indentation 
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
 2017-02-01 21:50:47 +01:00
Sandro Lutz 4ebcd5ac0b Add preLoginValidation hook 
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
 2017-02-01 21:50:25 +01:00
John Molakvoæ (skjnldsv) 2c9d7eeb76
Fix public page css fallback loading 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2017-02-01 18:03:51 +01:00
Morris Jobke 5bad417e57 Merge pull request #2044 from nextcloud/login-credential-store 
Login credential store
 2017-01-30 19:30:04 -06:00
Bjoern Schiessle 5086335643
unify endpoints form core and the the provisioning api 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2017-01-25 11:20:35 +01:00
Lukas Reschke bde1150d04 Merge pull request #3004 from nextcloud/fix-installation-css 
Fixed installation page
 2017-01-22 18:28:33 +01:00
Bjoern Schiessle 927d3865a0
add brute force protection to password reset to make it harder to guess user logins 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2017-01-19 10:12:45 +01:00
Bjoern Schiessle cdf01feba7
add action to existing brute force protection 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2017-01-18 15:25:16 +01:00
Morris Jobke 622101f2dd Merge pull request #2918 from nextcloud/encryption-recovery-improvements 
create new encryption keys on password reset and backup the old one
 2017-01-13 11:28:43 +01:00
Christoph Wurst 140555b786
always allow remembered login 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-01-11 19:20:11 +01:00
Christoph Wurst 243c9c0941
fix coding style and increase code coverage 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-01-11 11:01:54 +01:00
Cornelius Kölbel e077e01bf2
Add a TwoFactorException 
A Two Factor third party App may throw a TwoFactorException()
with a more detailed error message in case the authentication fails.
The 2FA Controller will then display the message of this Exception
to the user.

Working on #26593

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-01-11 11:01:52 +01:00
John Molakvoæ (skjnldsv) e4b3ba6590
Create unified css file and merge all needed data into this file 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2017-01-10 17:50:29 +01:00
Bjoern Schiessle fcda3a20f4
create new encryption keys on password reset and backup the old one 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2017-01-10 17:04:32 +01:00
John Molakvoæ (skjnldsv) 67467873c2
Removed jquery scss 
- Switched to setup.css
- Disable scss when displaying the update page
- Improved setup css
- Fixed loading failure of other styles on setup & update page
- Improved scss compiler with an ignore scss compilation option

Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2017-01-10 11:06:03 +01:00
Roeland Jago Douma 350b7ebc86
Adds CssControllerTests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-01-06 09:42:39 +01:00
Roeland Jago Douma 1e44a15dd1
No need for the CssManager 
* It is a simple wrapper we can always add it later if needed

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-01-06 09:42:14 +01:00
Roeland Jago Douma 95d85ba8eb
Do not add ICssManager to OCP 
We can add it later if needed

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-01-06 09:42:13 +01:00
Roeland Jago Douma 2816177ecb
Code cleanup 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-01-06 09:42:13 +01:00
John Molakvoæ (skjnldsv) 6380d503af
Css cache folder name fix, route fix and various fixes 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2017-01-06 09:42:13 +01:00
John Molakvoæ (skjnldsv) 3b62003c9c
Injection fix and log appname fix 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2017-01-06 09:42:13 +01:00
John Molakvoæ (skjnldsv) 1caaa7f4cd
Appdata integration 2 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2017-01-06 09:42:13 +01:00
Joas Schilling 2f21eaaf47
Use login name to fix password confirm with ldap users 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-01-05 12:17:30 +01:00
Christoph Wurst eff904473d
Set redirect_url on 2FA challenge page 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2016-12-23 20:53:26 +01:00
Morris Jobke 998f235474 Merge pull request #2563 from nextcloud/fix-password-reset 
fix password reset if encryption is enabled
 2016-12-22 11:18:04 +01:00
Bjoern Schiessle 16bbd3fd7c
fix password reset if encryption is enabled 
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
 2016-12-08 12:08:05 +01:00
Joas Schilling 924358ef96
Save the timezone on login again 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-12-08 10:45:24 +01:00
Morris Jobke 9eb1ea41ce Merge pull request #2428 from justin-sleep/upstream 
Fix #2427 by converting $remember to integer
 2016-12-03 11:10:22 +01:00
justin-sleep 25a5c655f7 Move integer casting to the top of the chain 
Signed-off-by: justin-sleep <justin@quarterfull.com>
 2016-12-02 14:07:45 -06:00
Roeland Jago Douma 5c602f3217
Cache all avatar responses 
* Cache for 30 minutes
* Also cache when avatar can't be found

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-11-30 09:43:36 +01:00
Lukas Reschke fb91bf6a5b
Add a signer class for signing 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2016-11-21 11:30:00 +01:00
Lukas Reschke 6f4cb12be2
Add identity proof 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2016-11-21 11:30:00 +01:00
Joas Schilling d75e35b75e
Introduce the UI for password confirmation 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-11-18 11:57:16 +01:00
Roeland Jago Douma 1baa2b8deb
Move OC\OCS\Person to OCSController 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-11-16 19:21:00 +01:00
Morris Jobke ac61f64190 Merge pull request #1109 from nextcloud/add-more-secrets-to-password-reset-link 
Use mail for encrypting the password reset token as well
 2016-11-03 22:11:43 +01:00
Lukas Reschke 6d686c213b
[WIP] Use mail for encrypting the password reset token as well 2016-11-03 14:27:26 +01:00
Roeland Jago Douma 9e6b26dcd0
Add cache 1 day cache to preview endpoint 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-11-03 14:00:33 +01:00
Roeland Jago Douma 55af6b45f7
More tests 
* PreviewController test
* PublicPreview test
* Versions Preview test
* Trash Preview test

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-11-03 14:00:33 +01:00
Roeland Jago Douma 5466fbf761
Move Ipreview to more of DI thingy 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-11-03 14:00:33 +01:00
Roeland Jago Douma d6f1287ae6
Move file 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-11-03 14:00:33 +01:00
Roeland Jago Douma 02525fd98b
Move preview endpoint to controller 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-11-03 14:00:33 +01:00
Christoph Wurst d907666232
bring back remember-me 
* try to reuse the old session token for remember me login
* decrypt/encrypt token password and set the session id accordingly
* create remember-me cookies only if checkbox is checked and 2fa solved
* adjust db token cleanup to store remembered tokens longer
* adjust unit tests

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2016-11-02 13:39:16 +01:00
Roeland Jago Douma b05fe45d52
Fix avatar on exif rotated images 
Fixes #1928

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-10-26 21:37:11 +02:00
Lukas Reschke 015affb082
Missing returns + autoloader file 
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2016-10-25 22:13:09 +02:00
Roeland Jago Douma d5589a15d5
Move oc.js to a proper class 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2016-10-25 22:03:02 +02:00
Joas Schilling 656e3f7a24
Check the mimetype before reading the content and catch exception 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-10-18 16:22:20 +02:00
Joas Schilling a1e4b17ff4
Remove unused endpoint 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-09-30 10:21:08 +02:00
Joas Schilling 877cb06bfe
Use magic DI for core controllers 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-09-30 10:00:26 +02:00
Joas Schilling 7c0951244a
Deprecate getEditionString() 2016-09-06 16:05:28 +02:00
Roeland Jago Douma 6740c627b8
Move AvatarController over to FileDisplayResponse 2016-09-05 15:11:45 +02:00
Lukas Reschke 06fa486706 Merge pull request #1158 from nextcloud/cache_avatars 
Cache avatars
 2016-09-05 15:08:43 +02:00
Christoph Wurst 8acb734854
add 2fa backup codes app 
* add backup codes app unit tests
* add integration tests for the backup codes app
 2016-09-05 08:51:13 +02:00
Christoph Wurst 0a0c7a9b92 redirect to default app after solving the 2FA challenge 2016-08-30 11:10:45 +02:00
Roeland Jago Douma 14136295b7
Cache avatars properly 
* Set proper caching headers for avatars (15 minutes)
* For our own avatar use some extra logic to invalidate when we update
 2016-08-30 09:00:16 +02:00
Morris Jobke e341bde8b9 Merge pull request #1172 from nextcloud/core_cleanup 
Core controller cleanup
 2016-08-30 08:32:55 +02:00
Roeland Jago Douma b1a090f357
AvatarController use proper JSONResponse 
* Do not rely on DataResponse magic. We want JSON so use JSON
* Fix tests
 2016-08-29 21:52:14 +02:00
Roeland Jago Douma f6423f74e3
Minor cleanup in core Controllers 2016-08-29 21:52:09 +02:00
Roeland Jago Douma c0ed865ab2
UserController does not require Defaults 2016-08-29 21:14:50 +02:00
Christoph Wurst 291dd0bd31 redirect to 2fa provider if there's only one active for the user 2016-08-29 18:36:39 +02:00
Roeland Jago Douma 2f03853fb9
AvatarController cleanup 
* Use all DI components
* Let the AppFramework resolve the AvatarController
* Update unit tests
* Unit tests no longer require DB
 2016-08-25 21:39:14 +02:00
Joas Schilling 736e884e9a
Move the reset token to core app 2016-08-23 15:01:38 +02:00
Joas Schilling 139fb8de94
Remove "password reset token" after successful login 2016-08-23 12:54:45 +02:00
Roeland Jago Douma 0963397cb8
we are Nextcloud :) 2016-08-18 09:37:11 +02:00
Roeland Jago Douma 6bc1c6590c
Move /config over to Core OCSController 2016-08-18 09:37:09 +02:00
Roeland Jago Douma 0cb8f74cd1
Delete IE8 support in the avatar controller 2016-08-16 20:48:04 +02:00
Lukas Reschke 9ca25e857c
Redirect users when already logged-in on login form 2016-08-11 15:22:29 +02:00
Roeland Jago Douma ba922c9f73 Merge pull request #807 from nextcloud/ocs_dataresponse 
OCSController requires DataResponse
 2016-08-10 22:36:25 +02:00
Roeland Jago Douma 9544c97ffe
Fix Core's OCSController response 2016-08-10 20:53:13 +02:00
Thomas Müller 4cf2f97a16
Add missing array element - fixes #25714 2016-08-10 11:11:23 +02:00
Roeland Jago Douma 69da896785
Move /cloud/user to Core app 2016-08-09 20:56:31 +02:00
Roeland Jago Douma 02449c8336
Move getCapabilities over to Core 2016-08-09 20:56:31 +02:00
Roeland Jago Douma 575875e8d0
Allow OCS routes in Core and Settings 2016-08-09 20:56:31 +02:00
Damjan Georgievski 4d559267bd SetupController should use \OC::$configDir too 2016-08-02 15:28:19 +02:00
Bjoern Schiessle 4ecd16c555
Redirect to default page after login 2016-07-27 12:11:58 +02:00
Joas Schilling 0215b004da
Update with robin 2016-07-21 18:13:58 +02:00
Joas Schilling ba87db3fcc
Fix others 2016-07-21 18:13:57 +02:00
Lukas Reschke c1589f163c
Mitigate race condition 2016-07-20 23:09:27 +02:00
Lukas Reschke ba4f12baa0
Implement brute force protection 
Class Throttler implements the bruteforce protection for security actions in
Nextcloud.

It is working by logging invalid login attempts to the database and slowing
down all login attempts from the same subnet. The max delay is 30 seconds and
the starting delay are 200 milliseconds. (after the first failed login)
 2016-07-20 22:08:56 +02:00
Joas Schilling 2c988ecbf4
Use the themed Defaults everywhere 2016-07-15 09:17:30 +02:00
Morris Jobke 2791b8f00d Revert "occ web executor (#24957)" 
This reverts commit 854352d9a0.
 2016-07-07 12:14:45 +02:00
Lukas Reschke 7a9d60d87e
Merge remote-tracking branch 'upstream/master' into master-upstream-sync 2016-06-26 12:55:05 +02:00
VicDeo 854352d9a0 occ web executor (#24957) 
* Initial web executor

* Fix PHPDoc

Fix broken integration test

OccControllerTests do not require database access - moch them all!

Kill unused sprintf
 2016-06-22 13:12:36 +02:00
Arthur Schiwon 42c66efea5
Merge branch 'master' of https://github.com/owncloud/core into downstream-160611 2016-06-11 15:34:43 +02:00
Lukas Reschke 5fdde426eb
Add fancy layout 2016-06-09 17:55:26 +02:00
Thomas Müller 232d735893
Do not leak the login name - fixes #25047 2016-06-09 16:44:31 +02:00
Joas Schilling 7f88645eab
Allow to cancel 2FA after login 2016-06-09 14:00:02 +02:00
Christoph Wurst 60e15e934c
do not generate device token if 2FA is enable for user 2016-06-09 14:00:00 +02:00
Vincent Petry 7dcc47dc94 Merge pull request #25011 from owncloud/issue-24745-allow-to-cancel-2fa 
Allow to cancel 2FA after login
 2016-06-08 10:27:21 +02:00
Joas Schilling 3e3b326c85
Allow to cancel 2FA after login 2016-06-07 18:17:29 +02:00
Christoph Wurst 8f7a4aaa4d
do not generate device token if 2FA is enable for user 2016-06-07 09:09:51 +02:00
Christoph Wurst 5e71d23ded
remember redirect_url when solving the 2FA challenge 2016-06-01 14:43:47 +02:00
Vincent Petry 235f03da64 Merge pull request #24795 from owncloud/issue-24789-reset-password-link-new-window 
Allow opening the password reset link in a new window when its a URL
 2016-05-31 10:12:30 +02:00
Lukas Reschke aba539703c
Update license headers 2016-05-26 19:57:24 +02:00
Vincent Petry 25e6026fa6 Merge pull request #24735 from juliushaertl/passwordreset-invalid 
Show error messages if a password reset link is invalid or expired
 2016-05-25 11:08:46 +02:00
Christoph Wurst ad10485cec
when generating browser/device token, save the login name for later password checks 2016-05-24 11:49:15 +02:00
Christoph Wurst a0ccebfdcb
generate device token for UID, not login name 
fixes #24785
 2016-05-24 09:49:40 +02:00
Christoph Wurst 4128b853e5
login explicitly 2016-05-24 09:48:02 +02:00
Joas Schilling 5c063cf7c9
Allow opening the password reset link in a new window when its a URL 2016-05-24 09:23:25 +02:00
Julius Haertl 8ee2cb47d0 Show error messages if a password reset link is invalid or expired 
- Moved token validation to method checkPasswordResetToken
- Render error with message from exceptions
 2016-05-23 16:48:10 +02:00
Christoph Wurst dfb4d426c2
Add two factor auth to core 2016-05-23 11:21:10 +02:00
Christoph Wurst e077d78ec9 Show login error message correctly (#24599) 2016-05-12 16:53:50 +02:00
Lukas Reschke ee0ebd192a Use proper URL generation function (#24576) 
Fixes the redirection after login, otherwise `core/files/index` is opened which fails.
 2016-05-11 19:39:57 +02:00
Christoph Wurst 0486d750aa
use the UID for creating the session token, not the login name 2016-05-11 13:36:46 +02:00
Christoph Wurst 214aa6639c
fix login with email 2016-05-11 13:36:46 +02:00
Christoph Wurst 46bdf6ea2b
fix PHPDoc and other minor issues 2016-05-11 13:36:46 +02:00
Christoph Wurst 3ffa7d986a
show login error 2016-05-11 13:36:46 +02:00
Christoph Wurst f0f8bdd495
PHPDoc and other minor fixes 2016-05-11 13:36:46 +02:00
Christoph Wurst fbb5768587
add unit tests for all new classes 2016-05-11 13:36:46 +02:00
Christoph Wurst aa85edd224
increase token column width 
add some range to time() assertions
 2016-05-11 13:36:46 +02:00
Christoph Wurst aafd660b97
fix LoginController unit tests 2016-05-11 13:36:46 +02:00
Christoph Wurst 7aa16e1559
fix setup 2016-05-11 13:36:46 +02:00
Christoph Wurst fdc2cd7554
Add token auth for OCS APIs 2016-05-11 13:36:46 +02:00
Christoph Wurst 8d48502187
Add index on 'last_activity' 
add token type column and delete only temporary tokens in the background job

debounce token updates; fix wrong class import
 2016-05-11 13:36:46 +02:00
Christoph Wurst 53636c73d6
Add controller to generate client tokens 2016-05-11 13:36:46 +02:00
Christoph Wurst 3ab922601a
Check if session token is valid and log user out if the check fails 
* Update last_activity timestamp of the session token
* Check user backend credentials once in 5 minutes
 2016-05-11 13:36:46 +02:00
Christoph Wurst d8cde414bd
token based auth 
* Add InvalidTokenException
* add DefaultTokenMapper and use it to check if a auth token exists
* create new token for the browser session if none exists
hash stored token; save user agent
* encrypt login password when creating the token
 2016-05-11 13:36:46 +02:00
Lukas Reschke 8222ad5157
Move logout to controller 
Testable code. Yay.
 2016-04-18 21:21:52 +02:00
Lukas Reschke d4a93893bb
Also check for an empty string 
PHP. Yay.
 2016-04-15 19:53:14 +02:00
Lukas Reschke fee95084ae
Rename `username` to `loginName` 
UID and login name are two different things.
 2016-04-15 19:02:19 +02:00
Lukas Reschke 8a650a51be
Use !== instead of empty 
Users can be named null
 2016-04-15 18:57:11 +02:00
Lukas Reschke 331e4efacb
Move login form into controller 
First step on getting the authorisation stuff cleaned up. This is only for the login form, all other stuff is still where it is.
 2016-04-15 17:36:23 +02:00
Lukas Reschke a4b19a5b1e
Rename files to be PSR-4 compliant 2016-04-06 11:00:52 +02:00