Arthur Schiwon
ca72c0150b
configurable amount of autocomplete results in comments
...
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-10-27 13:50:38 +02:00
Arthur Schiwon
fa2f03979b
add search parameter to autocomplete controller
...
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-10-25 17:26:50 +02:00
Arthur Schiwon
fd6daf8d19
AutoCompletion backend
...
* introduce a Controller for requests
* introduce result sorting mechanism
* extend Comments to retrieve commentors (actors) in a tree
* add commenters sorter
* add share recipients sorter
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-10-22 14:13:32 +02:00
Joas Schilling
3119fd41ce
Set the data from the template
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-10-18 15:12:03 +02:00
Joas Schilling
8b37fe7f65
Set the subject with the email template to allow theming
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-10-18 15:12:03 +02:00
Lukas Reschke
8ad17a66d6
Exclude avatar from Same-Site Cookie requirement
...
Required to work with the upcoming Collabora avatar integration.
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-10-11 14:41:34 +02:00
Lukas Reschke
0bccd5a0d9
Fix "Uninitialized string offset: 0 at \/media\/psf\/stable9\/lib\/private\/URLGenerator.php#224"
...
The URLGenerator doesn't support `` as target for absolute URLs, we need to link to `/` thus.
Regression introduced with 46229a00f3
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-09-07 08:34:02 +02:00
Morris Jobke
504c1abee0
Fix undefined index oauthState
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-09-06 16:38:24 +02:00
Morris Jobke
15cd21d252
Merge pull request #6358 from nextcloud/fix-mixup-of-id-and-name
...
Set the meta data before everything
2017-09-05 16:08:57 +02:00
Joas Schilling
6dbb64c4a2
Merge setMetaData into constructor
...
This ensures that the meta data is set in the beginning
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-09-04 15:07:41 +02:00
Morris Jobke
30ca3b70ed
Merge pull request #6196 from nextcloud/downstream-26539-2
...
Handle invalid ext storage backend to keep mount point visible
2017-09-04 14:17:28 +02:00
Morris Jobke
0326c2c54f
Fix broken tests
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-09-04 14:17:03 +02:00
Julius Härtl
46229a00f3
Add rich link preview to the login page
...
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2017-09-02 21:39:38 +02:00
Joas Schilling
0aff1c9268
Return the user id in case of an error
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-08-29 11:10:30 +02:00
Morris Jobke
2bf15eda26
Merge pull request #6255 from nextcloud/email-meta-data
...
Add meta information to emails for better customisation
2017-08-26 18:53:52 +02:00
Morris Jobke
0b652648cc
Merge pull request #6177 from nextcloud/properly-add-slo-url
...
Properly allow \OCP\Authentication\IApacheBackend to specify logout URL
2017-08-26 18:50:52 +02:00
Christoph Wurst
6676232a56
Allow 2FA providers to specify their custom CSP
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-08-26 13:48:08 +02:00
Joas Schilling
6a130d01e7
Also for reset password
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-08-24 18:02:37 +02:00
Lukas Reschke
2e4cd44556
Inject \OCP\IURLGenerator to make tests work
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-08-18 15:32:40 +02:00
Joas Schilling
d5c6d56170
No password reset for disabled users
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-08-18 13:21:53 +02:00
Lukas Reschke
a04feff9a7
Properly allow \OCP\Authentication\IApacheBackend to specify logout URL
...
Any `\OCP\Authentication\IApacheBackend` previously had to implement `getLogoutAttribute` which returns a string.
This string is directly injected into the logout `<a>` tag, so returning something like `href="foo"` would result
in `<a href="foo">`.
This is rather error prone and also in Nextcloud 12 broken as the logout entry has been moved with
054e161eb5
inside the navigation manager where one cannot simply inject attributes.
Thus this feature is broken in Nextcloud 12 which effectively leads to the bug described at nextcloud/user_saml#112 ,
people cannot logout anymore when using SAML using SLO. Basically in case of SAML you have a SLO url which redirects
you to the IdP and properly logs you out there as well.
Instead of monkey patching the Navigation manager I decided to instead change `\OCP\Authentication\IApacheBackend` to
use `\OCP\Authentication\IApacheBackend::getLogoutUrl` instead where it can return a string with the appropriate logout
URL. Since this functionality is only prominently used in the SAML plugin. Any custom app would need a small change but
I'm not aware of any and there's simply no way to fix this properly otherwise.
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-08-18 12:22:44 +02:00
Morris Jobke
84c22fdeef
Merge pull request #5907 from nextcloud/add-metadata-to-throttle-call
...
Add metadata to \OCP\AppFramework\Http\Response::throttle
2017-08-01 14:43:47 +02:00
Roeland Jago Douma
75771a108b
Fix OCSController
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-08-01 08:20:15 +02:00
Roeland Jago Douma
e945f2bc3a
Fix ContactsMenuController
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-08-01 08:20:15 +02:00
Roeland Jago Douma
aa6d8fcdbf
Fix AvatarController
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-08-01 08:20:15 +02:00
Lukas Reschke
f22ab3e665
Add metadata to \OCP\AppFramework\Http\Response::throttle
...
Fixes https://github.com/nextcloud/server/issues/5891
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-07-27 14:17:45 +02:00
Morris Jobke
188b87e03b
Cleanup legacy user class from unused methods
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-07-24 12:17:53 +02:00
Julius Härtl
51a0741005
Add public capabilities API
...
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2017-06-30 11:08:04 +02:00
Lukas Reschke
2f87fb6b45
Add Clear-Site-Data header
...
This adds a Clear-Site-Data header to the logout response which will delete all relevant data in the caches which may contain potentially sensitive content.
See https://w3c.github.io/webappsec-clear-site-data/#header for the definition of the types.
Ref https://twitter.com/mikewest/status/877149667909406723
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-06-20 19:46:10 +02:00
Lukas Reschke
26ee889fec
Add tests for ClientFlowLoginController
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-05-18 20:49:08 +02:00
Lukas Reschke
b07a0f51ba
Add OAuth state to session
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-05-18 20:49:08 +02:00
Bjoern Schiessle
23b296b66e
use name of oauth app to identify auth token
...
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2017-05-18 20:49:07 +02:00
Bjoern Schiessle
a74d67b69c
show error page if no valid client identifier is given and if it is not a API request
...
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2017-05-18 20:49:06 +02:00
Lukas Reschke
e86749121c
Remove special characters
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-05-18 20:49:05 +02:00
Lukas Reschke
5f71805c35
Add basic implementation for OAuth 2.0 Authorization Code Flow
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-05-18 20:49:03 +02:00
Joas Schilling
0828df5ed4
Disable the API endpoints as well
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-05-11 17:03:57 +02:00
Ujjwal Bhardwaj
7c23414eef
Disable reset password link. Issue: #27440
2017-05-11 10:27:33 +02:00
Joas Schilling
d418ea550b
Automatic injection for CssController
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-05-10 09:42:40 +02:00
Joas Schilling
9c8fe82000
Automatic injection for JsController
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-05-10 09:42:15 +02:00
Mario Danic
e4aac15a92
Update login flow redirection
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-05-04 19:21:22 +02:00
Morris Jobke
23cc309606
Handle more error cases
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-05-02 13:43:48 +02:00
Georg Ehrke
60f9ed6241
add contactsmenu popover
...
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
2017-04-26 09:26:53 +02:00
Jan-Christoph Borchardt
241e397326
Merge branch 'master' into contactsmenu
...
Signed-off-by: Jan-Christoph Borchardt <hey@jancborchardt.net>
2017-04-26 00:50:38 +02:00
Christoph Wurst
36cee1f386
Let apps register contact menu provider via info.xml
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-04-25 20:47:17 +02:00
Christoph Wurst
d091793ceb
Contacts menu
...
* load list of contacts from the server
* show last message of each contact
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-04-25 20:47:17 +02:00
Roeland Jago Douma
aae079aa29
AppToken to 72 chars
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-04-25 20:18:49 +02:00
Roeland Jago Douma
bb5e5efa6d
Do not remove the state token to early
...
we should check the stateToken before we remove it. Else the check will
always fail.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-04-25 20:18:49 +02:00
Lukas Reschke
6a16df7288
Add new auth flow
...
This implements the basics for the new app-password based authentication flow for our clients.
The current implementation tries to keep it as simple as possible and works the following way:
1. Unauthenticated client opens `/index.php/login/flow`
2. User will be asked whether they want to grant access to the client
3. If accepted the user has the chance to do so using existing App Token or automatically generate an app password.
If the user chooses to use an existing app token then that one will simply be redirected to the `nc://` protocol handler.
While we can improve on that in the future, I think keeping this smaller at the moment has its advantages. Also, in the
near future we have to think about an automatic migration endpoint so there's that anyways :-)
If the user chooses to use the regular login the following happens:
1. A session state token is written to the session
2. User is redirected to the login page
3. If successfully authenticated they will be redirected to a page redirecting to the POST controller
4. The POST controller will check if the CSRF token as well as the state token is correct, if yes the user will be redirected to the `nc://` protocol handler.
This approach is quite simple but also allows to be extended in the future. One could for example allow external websites to consume this authentication endpoint as well.
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-04-25 20:18:49 +02:00
Christoph Wurst
bb1d191f82
Fix remember redirect_url on failed login attempts
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-04-25 09:38:19 +02:00
Joas Schilling
3d671cc536
Merge pull request #4443 from nextcloud/cleanup-unused-imports
...
Remove unused use statements
2017-04-24 11:47:37 +02:00
Lukas Reschke
8a1d3c7e87
Merge pull request #4434 from nextcloud/add-rate-limiting-to-solve-challenge-controller
...
Add rate limit to TOTP solve challenge controller
2017-04-24 10:03:19 +02:00
Morris Jobke
c54a59d51e
Remove unused use statements
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-04-22 19:23:31 -05:00
Lukas Reschke
d0d34d308a
Add at most 10 password reset requests per 5 minutes and IP range
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-04-22 08:12:54 +02:00
Lukas Reschke
c1b8f152d8
Add rate limit to TOTP solve challenge controller
...
Fixes https://github.com/nextcloud/server/issues/2626
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-04-22 07:59:40 +02:00
Morris Jobke
16c4755e03
Rename renderHTML to renderHtml
...
* fixes #4383
* improves consistency
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-04-19 15:46:41 -05:00
Lukas Reschke
727688ebd9
Adjust existing bruteforce protection code
...
- Moves code to annotation
- Adds the `throttle()` call on the responses on existing annotations
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-04-14 13:42:40 +02:00
Lukas Reschke
8149945a91
Make BruteForceProtection annotation more clever
...
This makes the new `@BruteForceProtection` annotation more clever and moves the relevant code into it's own middleware.
Basically you can now set `@BruteForceProtection(action=$key)` as annotation and that will make the controller bruteforce protected. However, the difference to before is that you need to call `$responmse->throttle()` to increase the counter. Before the counter was increased every time which leads to all kind of unexpected problems.
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-04-13 23:05:33 +02:00
Lukas Reschke
81d3732bf5
Merge pull request #4308 from nextcloud/lost-password-email
...
Update email template for lost password email
2017-04-13 20:02:15 +02:00
Morris Jobke
d36751ee38
Merge pull request #2424 from nextcloud/fix-login-controller-test-consolidate-login
...
Fix login controller test and consolidate login
2017-04-13 12:16:38 -05:00
Lukas Reschke
66835476b5
Add support for ratelimiting via annotations
...
This allows adding rate limiting via annotations to controllers, as one example:
```
@UserRateThrottle(limit=5, period=100)
@AnonRateThrottle(limit=1, period=100)
```
Would mean that logged-in users can access the page 5 times within 100 seconds, and anonymous users 1 time within 100 seconds. If only an AnonRateThrottle is specified that one will also be applied to logged-in users.
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-04-13 12:00:16 +02:00
Morris Jobke
7cb6038fca
Merge pull request #3043 from nextcloud/issue-3038-no-logentry-on-email-login
...
Dont create a log entry on email login
2017-04-13 01:04:11 -05:00
Morris Jobke
1f962f9115
Update email template for lost password email
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-04-12 15:19:53 -05:00
Morris Jobke
5b4adf66e5
Move OC_Defaults to OCP\Defaults
...
* currently there are two ways to access default values:
OCP\Defaults or OC_Defaults (which is extended by
OCA\Theming\ThemingDefaults)
* our code used a mixture of both of them, which made
it hard to work on theme values
* this extended the public interface with the missing
methods and uses them everywhere to only rely on the
public interface
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-04-09 21:43:01 -05:00
Joas Schilling
7ad791efb4
Dont create a log entry on email login
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-04-07 10:15:20 +02:00
Arthur Schiwon
7b3fdfeeaa
do login routine only once when done via LoginController
...
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-04-06 15:22:42 +02:00
Arthur Schiwon
2994cbc586
fix login controller tests
...
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-04-06 15:20:17 +02:00
Roeland Jago Douma
6bdd3a167d
Merge pull request #4123 from nextcloud/allow-password-reset-with-email
...
Allow to reset the password with the email as an input
2017-04-05 09:12:41 +02:00
Morris Jobke
9813023aab
Fix gzip files for Safari
...
* Safari support gzip only if the filename does not
end on .gz - so this renames them to .gzip
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-03-29 00:11:51 -06:00
Roeland Jago Douma
54f9b35f71
Allow to gzip CSS/JS files
...
Since in production the SCSS files are compiled once and the javascript
files are combined once we can just as well gzip them aggresively.
This means that once they are requested and the browser supports gzip we
can just serve the gzipped file saving precious bandwidth.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-03-28 21:46:23 +02:00
Joas Schilling
4bae7ef96d
Allow to reset the password with the email as an input
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-03-28 21:17:37 +02:00
Roeland Jago Douma
8e89ad21a2
[PoC] JS Combiner
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-03-24 10:58:10 +01:00
blizzz
19fc68cbdc
Merge pull request #2606 from temparus/master
...
Add preLoginValidation hook
2017-02-15 21:47:47 +01:00
Joas Schilling
ac841ee002
Merge pull request #3362 from nextcloud/fix/nc-token-cookie-name
...
oc_token should be nc_token
2017-02-09 10:07:59 +01:00
Sandro Lutz
9b6f99ab08
Update license header
...
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
2017-02-07 01:25:39 +01:00
Sandro Lutz
fa1d607bfa
Merge remote-tracking branch 'nextcloud/master'
...
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
2017-02-07 00:15:30 +01:00
Sandro Lutz
ff3fa538e4
Add missing use statement for PublicEmitter
...
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
2017-02-07 00:12:19 +01:00
Christoph Wurst
5e728d0eda
oc_token should be nc_token
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-02-02 21:56:44 +01:00
Sandro Lutz
20f878b014
Fix typo for UserManager variable
...
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
2017-02-01 21:54:00 +01:00
Sandro Lutz
6feff0ceba
Add check if UserManager is of type PublicEmitter before calling preLogin hook
...
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
2017-02-01 21:53:50 +01:00
Sandro Lutz
e30d28f7eb
Change where preLogin hook gets called
...
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
2017-02-01 21:53:42 +01:00
Sandro Lutz
6ab0a3215d
Remove preLoginValidation hook
...
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
2017-02-01 21:53:29 +01:00
Sandro Lutz
e14d50eb1f
Fix indentation
...
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
2017-02-01 21:50:47 +01:00
Sandro Lutz
4ebcd5ac0b
Add preLoginValidation hook
...
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
2017-02-01 21:50:25 +01:00
John Molakvoæ (skjnldsv)
2c9d7eeb76
Fix public page css fallback loading
...
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2017-02-01 18:03:51 +01:00
Morris Jobke
5bad417e57
Merge pull request #2044 from nextcloud/login-credential-store
...
Login credential store
2017-01-30 19:30:04 -06:00
Bjoern Schiessle
5086335643
unify endpoints form core and the the provisioning api
...
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2017-01-25 11:20:35 +01:00
Lukas Reschke
bde1150d04
Merge pull request #3004 from nextcloud/fix-installation-css
...
Fixed installation page
2017-01-22 18:28:33 +01:00
Bjoern Schiessle
927d3865a0
add brute force protection to password reset to make it harder to guess user logins
...
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2017-01-19 10:12:45 +01:00
Bjoern Schiessle
cdf01feba7
add action to existing brute force protection
...
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2017-01-18 15:25:16 +01:00
Morris Jobke
622101f2dd
Merge pull request #2918 from nextcloud/encryption-recovery-improvements
...
create new encryption keys on password reset and backup the old one
2017-01-13 11:28:43 +01:00
Christoph Wurst
140555b786
always allow remembered login
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-01-11 19:20:11 +01:00
Christoph Wurst
243c9c0941
fix coding style and increase code coverage
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-01-11 11:01:54 +01:00
Cornelius Kölbel
e077e01bf2
Add a TwoFactorException
...
A Two Factor third party App may throw a TwoFactorException()
with a more detailed error message in case the authentication fails.
The 2FA Controller will then display the message of this Exception
to the user.
Working on #26593
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-01-11 11:01:52 +01:00
John Molakvoæ (skjnldsv)
e4b3ba6590
Create unified css file and merge all needed data into this file
...
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2017-01-10 17:50:29 +01:00
Bjoern Schiessle
fcda3a20f4
create new encryption keys on password reset and backup the old one
...
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2017-01-10 17:04:32 +01:00
John Molakvoæ (skjnldsv)
67467873c2
Removed jquery scss
...
- Switched to setup.css
- Disable scss when displaying the update page
- Improved setup css
- Fixed loading failure of other styles on setup & update page
- Improved scss compiler with an ignore scss compilation option
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2017-01-10 11:06:03 +01:00
Roeland Jago Douma
350b7ebc86
Adds CssControllerTests
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-01-06 09:42:39 +01:00
Roeland Jago Douma
1e44a15dd1
No need for the CssManager
...
* It is a simple wrapper we can always add it later if needed
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-01-06 09:42:14 +01:00
Roeland Jago Douma
95d85ba8eb
Do not add ICssManager to OCP
...
We can add it later if needed
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-01-06 09:42:13 +01:00
Roeland Jago Douma
2816177ecb
Code cleanup
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-01-06 09:42:13 +01:00
John Molakvoæ (skjnldsv)
6380d503af
Css cache folder name fix, route fix and various fixes
...
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2017-01-06 09:42:13 +01:00
John Molakvoæ (skjnldsv)
3b62003c9c
Injection fix and log appname fix
...
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2017-01-06 09:42:13 +01:00
John Molakvoæ (skjnldsv)
1caaa7f4cd
Appdata integration 2
...
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2017-01-06 09:42:13 +01:00
Joas Schilling
2f21eaaf47
Use login name to fix password confirm with ldap users
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-01-05 12:17:30 +01:00
Christoph Wurst
eff904473d
Set redirect_url on 2FA challenge page
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2016-12-23 20:53:26 +01:00
Morris Jobke
998f235474
Merge pull request #2563 from nextcloud/fix-password-reset
...
fix password reset if encryption is enabled
2016-12-22 11:18:04 +01:00
Bjoern Schiessle
16bbd3fd7c
fix password reset if encryption is enabled
...
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2016-12-08 12:08:05 +01:00
Joas Schilling
924358ef96
Save the timezone on login again
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-12-08 10:45:24 +01:00
Morris Jobke
9eb1ea41ce
Merge pull request #2428 from justin-sleep/upstream
...
Fix #2427 by converting $remember to integer
2016-12-03 11:10:22 +01:00
justin-sleep
25a5c655f7
Move integer casting to the top of the chain
...
Signed-off-by: justin-sleep <justin@quarterfull.com>
2016-12-02 14:07:45 -06:00
Roeland Jago Douma
5c602f3217
Cache all avatar responses
...
* Cache for 30 minutes
* Also cache when avatar can't be found
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-30 09:43:36 +01:00
Lukas Reschke
fb91bf6a5b
Add a signer class for signing
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-11-21 11:30:00 +01:00
Lukas Reschke
6f4cb12be2
Add identity proof
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-11-21 11:30:00 +01:00
Joas Schilling
d75e35b75e
Introduce the UI for password confirmation
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-11-18 11:57:16 +01:00
Roeland Jago Douma
1baa2b8deb
Move OC\OCS\Person to OCSController
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-16 19:21:00 +01:00
Morris Jobke
ac61f64190
Merge pull request #1109 from nextcloud/add-more-secrets-to-password-reset-link
...
Use mail for encrypting the password reset token as well
2016-11-03 22:11:43 +01:00
Lukas Reschke
6d686c213b
[WIP] Use mail for encrypting the password reset token as well
2016-11-03 14:27:26 +01:00
Roeland Jago Douma
9e6b26dcd0
Add cache 1 day cache to preview endpoint
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-03 14:00:33 +01:00
Roeland Jago Douma
55af6b45f7
More tests
...
* PreviewController test
* PublicPreview test
* Versions Preview test
* Trash Preview test
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-03 14:00:33 +01:00
Roeland Jago Douma
5466fbf761
Move Ipreview to more of DI thingy
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-03 14:00:33 +01:00
Roeland Jago Douma
d6f1287ae6
Move file
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-03 14:00:33 +01:00
Roeland Jago Douma
02525fd98b
Move preview endpoint to controller
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-03 14:00:33 +01:00
Christoph Wurst
d907666232
bring back remember-me
...
* try to reuse the old session token for remember me login
* decrypt/encrypt token password and set the session id accordingly
* create remember-me cookies only if checkbox is checked and 2fa solved
* adjust db token cleanup to store remembered tokens longer
* adjust unit tests
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2016-11-02 13:39:16 +01:00
Roeland Jago Douma
b05fe45d52
Fix avatar on exif rotated images
...
Fixes #1928
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-26 21:37:11 +02:00
Lukas Reschke
015affb082
Missing returns + autoloader file
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-10-25 22:13:09 +02:00
Roeland Jago Douma
d5589a15d5
Move oc.js to a proper class
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-10-25 22:03:02 +02:00
Joas Schilling
656e3f7a24
Check the mimetype before reading the content and catch exception
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-10-18 16:22:20 +02:00
Joas Schilling
a1e4b17ff4
Remove unused endpoint
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-09-30 10:21:08 +02:00
Joas Schilling
877cb06bfe
Use magic DI for core controllers
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-09-30 10:00:26 +02:00
Joas Schilling
7c0951244a
Deprecate getEditionString()
2016-09-06 16:05:28 +02:00
Roeland Jago Douma
6740c627b8
Move AvatarController over to FileDisplayResponse
2016-09-05 15:11:45 +02:00
Lukas Reschke
06fa486706
Merge pull request #1158 from nextcloud/cache_avatars
...
Cache avatars
2016-09-05 15:08:43 +02:00
Christoph Wurst
8acb734854
add 2fa backup codes app
...
* add backup codes app unit tests
* add integration tests for the backup codes app
2016-09-05 08:51:13 +02:00
Christoph Wurst
0a0c7a9b92
redirect to default app after solving the 2FA challenge
2016-08-30 11:10:45 +02:00
Roeland Jago Douma
14136295b7
Cache avatars properly
...
* Set proper caching headers for avatars (15 minutes)
* For our own avatar use some extra logic to invalidate when we update
2016-08-30 09:00:16 +02:00
Morris Jobke
e341bde8b9
Merge pull request #1172 from nextcloud/core_cleanup
...
Core controller cleanup
2016-08-30 08:32:55 +02:00
Roeland Jago Douma
b1a090f357
AvatarController use proper JSONResponse
...
* Do not rely on DataResponse magic. We want JSON so use JSON
* Fix tests
2016-08-29 21:52:14 +02:00
Roeland Jago Douma
f6423f74e3
Minor cleanup in core Controllers
2016-08-29 21:52:09 +02:00
Roeland Jago Douma
c0ed865ab2
UserController does not require Defaults
2016-08-29 21:14:50 +02:00
Christoph Wurst
291dd0bd31
redirect to 2fa provider if there's only one active for the user
2016-08-29 18:36:39 +02:00
Roeland Jago Douma
2f03853fb9
AvatarController cleanup
...
* Use all DI components
* Let the AppFramework resolve the AvatarController
* Update unit tests
* Unit tests no longer require DB
2016-08-25 21:39:14 +02:00
Joas Schilling
736e884e9a
Move the reset token to core app
2016-08-23 15:01:38 +02:00
Joas Schilling
139fb8de94
Remove "password reset token" after successful login
2016-08-23 12:54:45 +02:00
Roeland Jago Douma
0963397cb8
we are Nextcloud :)
2016-08-18 09:37:11 +02:00
Roeland Jago Douma
6bc1c6590c
Move /config over to Core OCSController
2016-08-18 09:37:09 +02:00
Roeland Jago Douma
0cb8f74cd1
Delete IE8 support in the avatar controller
2016-08-16 20:48:04 +02:00
Lukas Reschke
9ca25e857c
Redirect users when already logged-in on login form
2016-08-11 15:22:29 +02:00
Roeland Jago Douma
ba922c9f73
Merge pull request #807 from nextcloud/ocs_dataresponse
...
OCSController requires DataResponse
2016-08-10 22:36:25 +02:00
Roeland Jago Douma
9544c97ffe
Fix Core's OCSController response
2016-08-10 20:53:13 +02:00
Thomas Müller
4cf2f97a16
Add missing array element - fixes #25714
2016-08-10 11:11:23 +02:00
Roeland Jago Douma
69da896785
Move /cloud/user to Core app
2016-08-09 20:56:31 +02:00
Roeland Jago Douma
02449c8336
Move getCapabilities over to Core
2016-08-09 20:56:31 +02:00
Roeland Jago Douma
575875e8d0
Allow OCS routes in Core and Settings
2016-08-09 20:56:31 +02:00
Damjan Georgievski
4d559267bd
SetupController should use \OC::$configDir too
2016-08-02 15:28:19 +02:00
Bjoern Schiessle
4ecd16c555
Redirect to default page after login
2016-07-27 12:11:58 +02:00
Joas Schilling
0215b004da
Update with robin
2016-07-21 18:13:58 +02:00
Joas Schilling
ba87db3fcc
Fix others
2016-07-21 18:13:57 +02:00
Lukas Reschke
c1589f163c
Mitigate race condition
2016-07-20 23:09:27 +02:00
Lukas Reschke
ba4f12baa0
Implement brute force protection
...
Class Throttler implements the bruteforce protection for security actions in
Nextcloud.
It is working by logging invalid login attempts to the database and slowing
down all login attempts from the same subnet. The max delay is 30 seconds and
the starting delay are 200 milliseconds. (after the first failed login)
2016-07-20 22:08:56 +02:00
Joas Schilling
2c988ecbf4
Use the themed Defaults everywhere
2016-07-15 09:17:30 +02:00
Morris Jobke
2791b8f00d
Revert "occ web executor ( #24957 )"
...
This reverts commit 854352d9a0
.
2016-07-07 12:14:45 +02:00
Lukas Reschke
7a9d60d87e
Merge remote-tracking branch 'upstream/master' into master-upstream-sync
2016-06-26 12:55:05 +02:00
VicDeo
854352d9a0
occ web executor ( #24957 )
...
* Initial web executor
* Fix PHPDoc
Fix broken integration test
OccControllerTests do not require database access - moch them all!
Kill unused sprintf
2016-06-22 13:12:36 +02:00
Arthur Schiwon
42c66efea5
Merge branch 'master' of https://github.com/owncloud/core into downstream-160611
2016-06-11 15:34:43 +02:00
Lukas Reschke
5fdde426eb
Add fancy layout
2016-06-09 17:55:26 +02:00
Thomas Müller
232d735893
Do not leak the login name - fixes #25047
2016-06-09 16:44:31 +02:00
Joas Schilling
7f88645eab
Allow to cancel 2FA after login
2016-06-09 14:00:02 +02:00
Christoph Wurst
60e15e934c
do not generate device token if 2FA is enable for user
2016-06-09 14:00:00 +02:00
Vincent Petry
7dcc47dc94
Merge pull request #25011 from owncloud/issue-24745-allow-to-cancel-2fa
...
Allow to cancel 2FA after login
2016-06-08 10:27:21 +02:00
Joas Schilling
3e3b326c85
Allow to cancel 2FA after login
2016-06-07 18:17:29 +02:00
Christoph Wurst
8f7a4aaa4d
do not generate device token if 2FA is enable for user
2016-06-07 09:09:51 +02:00
Christoph Wurst
5e71d23ded
remember redirect_url when solving the 2FA challenge
2016-06-01 14:43:47 +02:00
Vincent Petry
235f03da64
Merge pull request #24795 from owncloud/issue-24789-reset-password-link-new-window
...
Allow opening the password reset link in a new window when its a URL
2016-05-31 10:12:30 +02:00
Lukas Reschke
aba539703c
Update license headers
2016-05-26 19:57:24 +02:00
Vincent Petry
25e6026fa6
Merge pull request #24735 from juliushaertl/passwordreset-invalid
...
Show error messages if a password reset link is invalid or expired
2016-05-25 11:08:46 +02:00
Christoph Wurst
ad10485cec
when generating browser/device token, save the login name for later password checks
2016-05-24 11:49:15 +02:00
Christoph Wurst
a0ccebfdcb
generate device token for UID, not login name
...
fixes #24785
2016-05-24 09:49:40 +02:00
Christoph Wurst
4128b853e5
login explicitly
2016-05-24 09:48:02 +02:00
Joas Schilling
5c063cf7c9
Allow opening the password reset link in a new window when its a URL
2016-05-24 09:23:25 +02:00
Julius Haertl
8ee2cb47d0
Show error messages if a password reset link is invalid or expired
...
- Moved token validation to method checkPasswordResetToken
- Render error with message from exceptions
2016-05-23 16:48:10 +02:00
Christoph Wurst
dfb4d426c2
Add two factor auth to core
2016-05-23 11:21:10 +02:00
Christoph Wurst
e077d78ec9
Show login error message correctly ( #24599 )
2016-05-12 16:53:50 +02:00
Lukas Reschke
ee0ebd192a
Use proper URL generation function ( #24576 )
...
Fixes the redirection after login, otherwise `core/files/index` is opened which fails.
2016-05-11 19:39:57 +02:00
Christoph Wurst
0486d750aa
use the UID for creating the session token, not the login name
2016-05-11 13:36:46 +02:00
Christoph Wurst
214aa6639c
fix login with email
2016-05-11 13:36:46 +02:00
Christoph Wurst
46bdf6ea2b
fix PHPDoc and other minor issues
2016-05-11 13:36:46 +02:00
Christoph Wurst
3ffa7d986a
show login error
2016-05-11 13:36:46 +02:00
Christoph Wurst
f0f8bdd495
PHPDoc and other minor fixes
2016-05-11 13:36:46 +02:00
Christoph Wurst
fbb5768587
add unit tests for all new classes
2016-05-11 13:36:46 +02:00
Christoph Wurst
aa85edd224
increase token column width
...
add some range to time() assertions
2016-05-11 13:36:46 +02:00
Christoph Wurst
aafd660b97
fix LoginController unit tests
2016-05-11 13:36:46 +02:00
Christoph Wurst
7aa16e1559
fix setup
2016-05-11 13:36:46 +02:00
Christoph Wurst
fdc2cd7554
Add token auth for OCS APIs
2016-05-11 13:36:46 +02:00
Christoph Wurst
8d48502187
Add index on 'last_activity'
...
add token type column and delete only temporary tokens in the background job
debounce token updates; fix wrong class import
2016-05-11 13:36:46 +02:00
Christoph Wurst
53636c73d6
Add controller to generate client tokens
2016-05-11 13:36:46 +02:00
Christoph Wurst
3ab922601a
Check if session token is valid and log user out if the check fails
...
* Update last_activity timestamp of the session token
* Check user backend credentials once in 5 minutes
2016-05-11 13:36:46 +02:00
Christoph Wurst
d8cde414bd
token based auth
...
* Add InvalidTokenException
* add DefaultTokenMapper and use it to check if a auth token exists
* create new token for the browser session if none exists
hash stored token; save user agent
* encrypt login password when creating the token
2016-05-11 13:36:46 +02:00
Lukas Reschke
8222ad5157
Move logout to controller
...
Testable code. Yay.
2016-04-18 21:21:52 +02:00
Lukas Reschke
d4a93893bb
Also check for an empty string
...
PHP. Yay.
2016-04-15 19:53:14 +02:00
Lukas Reschke
fee95084ae
Rename `username` to `loginName`
...
UID and login name are two different things.
2016-04-15 19:02:19 +02:00