Commit Graph

347 Commits

Author SHA1 Message Date
Morris Jobke 5c21b29d7f
Merge pull request #16308 from nextcloud/fix/undefined-offset-0
Prevent undefined offset 0 in findByUserIdOrMail
2019-07-10 12:16:36 +02:00
Daniel Kesselberg d57540ac84
Return first value from $users
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2019-07-09 19:29:14 +02:00
Daniel Kesselberg 6235a66aac
Don't send executionContexts for Clear-Site-Data
There are plans to remove executionContexts from the spec: https://github.com/w3c/webappsec-clear-site-data/issues/59

Firefox already removed it https://bugzilla.mozilla.org/show_bug.cgi?id=1548034

Chromium implementation is not finish: https://bugs.chromium.org/p/chromium/issues/detail?id=898503&q=clear-site-data&sort=-modified&colspec=ID%20Pri%20M%20Stars%20ReleaseBlock%20Component%20Status%20Owner%20Summary%20OS%20Modified

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2019-07-09 15:08:25 +02:00
Joas Schilling 05381f00d2
Fall back to black for non-color values
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-06-20 15:23:06 +02:00
Julius Härtl df072471a7
Add extendedSupport to Subscription
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2019-06-17 16:36:23 +02:00
Christoph Wurst 64c4bb5bce
Vueify the login page
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2019-05-29 11:05:16 +02:00
Roeland Jago Douma f03eb7ec3c
Remote wipe support
This allows a user to mark a token for remote wipe.
Clients that support this can then wipe the device properly.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2019-05-20 20:50:27 +02:00
Roeland Jago Douma 528eb1b223
Merge pull request #15304 from nextcloud/enh/2fa_setup_at_login
2FA setup during login
2019-05-17 11:04:42 +02:00
Roeland Jago Douma 579162d7b9
Allow 2FA to be setup on first login
Once 2FA is enforced for a user and they have no 2FA setup yet this will
now prompt them with a setup screen. Given that providers are enabled
that allow setup then.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2019-05-17 10:11:53 +02:00
Roeland Jago Douma 2dcb4cfbd6
Allow clients to delete their own apptoken
Fixes #15480

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-05-17 09:52:06 +02:00
Christoph Wurst 170582d4f5
Add a login chain to reduce the complexity of LoginController::tryLogin
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2019-05-07 18:04:36 +02:00
Roeland Jago Douma 7e7146db7f
Block install without CAN_INSTALL file
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-04-11 09:32:33 +02:00
Joas Schilling c5560117da
Make the endpoint more robust against faulty resource providers
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-28 09:26:38 +01:00
Joas Schilling 21425eb964
Return 200 instead of 404 when asking for collections of a resource
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-19 13:13:53 +01:00
Joas Schilling 3022ef687a
Use rich objects instead of name, link and icon
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-19 13:06:55 +01:00
Joas Schilling 403b673b93
Replace the icon-class with an absolute link to an image
Otherwise the icon can not be displayed in mobile apps

Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-19 13:06:55 +01:00
Joas Schilling eecd9323c5
Also check the access to collections on preparing
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-01 20:56:58 +01:00
Joas Schilling 59c92a7513
Further work on the access cache
Searching for all is still a problem

Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-01 20:56:19 +01:00
Joas Schilling dee6f7f61f
Fix doc blocks
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-01 20:56:18 +01:00
Julius Härtl e404ce7096
Implement search and rename in backend
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2019-03-01 20:56:18 +01:00
Julius Härtl 53ac9bdda1
Implement frontend for search/rename
Signed-off-by: Julius Härtl <jus@bitgrid.net>

Move to vuex

Signed-off-by: Julius Härtl <jus@bitgrid.net>
2019-03-01 20:56:18 +01:00
Julius Härtl 88aa3de784
Add iconClass to resources
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2019-03-01 20:56:17 +01:00
Julius Härtl 555afff015
Make sure we query the node before fetching the name
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2019-03-01 20:56:17 +01:00
Julius Härtl a72a6d73a3
Adjust parameter names on createCollectionOnResource
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2019-03-01 20:56:16 +01:00
Joas Schilling 702dcfb728
Make names mandatory
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-01 20:56:16 +01:00
Joas Schilling 5dfc56e925
Allow to create collections
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-01 20:56:15 +01:00
Joas Schilling 136d2c39ac
Provider functionality
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-01 20:56:15 +01:00
Joas Schilling 65a9ab47ea
Add a controller with the most important methods
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-01 20:56:15 +01:00
Joas Schilling 55f627d20b
Add an event to the Autocomplete Controller to allow to filter the results
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-02-26 15:32:14 +01:00
Morris Jobke 5cbe6532a0
Fix typo in info log for autoconfig
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2019-02-25 21:28:22 +01:00
Roeland Jago Douma e819e97829
Login flow V2
This adds the new login flow. The desktop client will open up a browser
and poll a returned endpoint at regular intervals to check if the flow
is done.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-02-25 07:24:50 +01:00
Daniel Kesselberg c583c5e7e2
Emit event if app password created
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2019-02-18 17:47:43 +01:00
Daniel Kesselberg 149a98edf6
Publish activity for app token created by client login flow
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2019-02-17 23:49:54 +01:00
Daniel Kesselberg 2ade2bef8c
Publish activity for app token created by ocs api
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2019-02-17 23:37:22 +01:00
Morris Jobke 0e9903c420
Merge pull request #13969 from nextcloud/enh/additional_scripts_no_on_public_pages
No need to emit additonalscript event on public pages
2019-02-07 15:57:14 +01:00
Michael Weimann bf1253cb49
Implement guest avatar endpoint
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
2019-02-07 14:23:16 +01:00
Roeland Jago Douma 60e5a5eca4
Do not do redirect handling when loggin out
Fixes #12568
Since the clearing of the execution context causes another reload. We
should not do the redirect_uri handling as this results in redirecting
back to the logout page on login.

This adds a simple middleware that will just check if the
ClearExecutionContext session variable is set. If that is the case it
will just redirect back to the login page.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-02-06 11:29:32 +01:00
Roeland Jago Douma b68567e9ba
Add StandaloneTemplateResponse
This can be used by pages that do not have the full Nextcloud UI.
So notifications etc do not load there.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-02-06 11:26:18 +01:00
Roeland Jago Douma deb7d2364f
Merge pull request #13869 from nextcloud/enh/clean_pending_2fa_session_on_password_change
Clean pending 2FA authentication on password reset
2019-01-29 19:50:15 +01:00
Roeland Jago Douma ac8a6e2244
Clean pending 2FA authentication on password reset
When a password is reste we should make sure that all users are properly
logged in. Pending states should be cleared. For example a session where
the 2FA code is not entered yet should be cleared.

The token is now removed so the session will be killed the next time
this is checked (within 5 minutes).

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-01-29 13:08:56 +01:00
Michael Weimann e083e8abc6
Clears the local storage after logout
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
2019-01-29 09:02:52 +01:00
Roeland Jago Douma e6333c8fe3
Honor remember_login_cookie_lifetime
If the remember_login_cookie_lifetime is set to 0 this means we do not
want to use remember me at all. In that case we should also not creatae
a remember me cookie and should create a proper temp token.

Further this specifies that is not 0 the remember me time should always
be larger than the session timeout. Because else the behavior is not
really defined.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-01-23 08:46:24 +01:00
Roeland Jago Douma 66367797df
Fix template paramter
Else we get shown an error page instead of the correct 403.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-01-18 15:30:38 +01:00
Roeland Jago Douma d0397f9b53
Generic message on password reset
There is no need to inform the user if the account existed or not.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-01-15 15:53:43 +01:00
Christoph Wurst 208788173d
Npmize (vendor) scripts
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2019-01-09 15:01:59 +01:00
Roeland Jago Douma e6ac233947
Fix loginflow with apptoken enter on iOS
It seems iOS doesn't like us to change the location. So now we submit it
to the server that geneartes the redirect.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-01-04 21:51:36 +01:00
Roeland Jago Douma 763b52d402
Fix SAML Client login flow on Apple devices
Because the redirect from the SAML/SSO endpoint is a POST the lax/strict
cookies are not properly send.

Note that it is not strictly requried on this endpoint as we do not need
the remember me data. Only the real session info is enough. The endpoint
is also already protected by a state token.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-12-17 12:50:32 +01:00
John Molakvoæ (skjnldsv) 5e4990fadd
Remove redirect page
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-11-29 10:27:22 +01:00
Roeland Jago Douma 43d6ae7476
Respect the disabled setting for lost_password_link
Fixes #11146
As documented when it is set to disabled the user can't request a lost
password.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-11-20 13:28:40 +01:00
Roeland Jago Douma 92582a350d
Use the proper server for the apptoken flow login
If a user can't authenticate normally (because they have 2FA that is not
available on their devices for example). The redirect that is generated
should be of the proper format.

This means

1. Include the protocol
2. Include the possible subfolder

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-11-01 11:45:35 +01:00