805419bb95
Add bruteforce protection to changePersonalPassword
...
While the risk is actually quite low because one would already have the user session and could potentially do other havoc it makes sense to throttle here in case of invalid previous password attempts.
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-04-18 17:55:51 +02:00
8149945a91
Make BruteForceProtection annotation more clever
...
This makes the new `@BruteForceProtection` annotation more clever and moves the relevant code into it's own middleware.
Basically you can now set `@BruteForceProtection(action=$key)` as annotation and that will make the controller bruteforce protected. However, the difference to before is that you need to call `$responmse->throttle()` to increase the counter. Before the counter was increased every time which leads to all kind of unexpected problems.
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-04-13 23:05:33 +02:00
81d3732bf5
Merge pull request #4308 from nextcloud/lost-password-email
...
Update email template for lost password email
2017-04-13 20:02:15 +02:00
d36751ee38
Merge pull request #2424 from nextcloud/fix-login-controller-test-consolidate-login
...
Fix login controller test and consolidate login
2017-04-13 12:16:38 -05:00
7cb6038fca
Merge pull request #3043 from nextcloud/issue-3038-no-logentry-on-email-login
...
Dont create a log entry on email login
2017-04-13 01:04:11 -05:00
1f962f9115
Update email template for lost password email
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-04-12 15:19:53 -05:00
5b4adf66e5
Move OC_Defaults to OCP\Defaults
...
* currently there are two ways to access default values:
OCP\Defaults or OC_Defaults (which is extended by
OCA\Theming\ThemingDefaults)
* our code used a mixture of both of them, which made
it hard to work on theme values
* this extended the public interface with the missing
methods and uses them everywhere to only rely on the
public interface
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-04-09 21:43:01 -05:00
7ad791efb4
Dont create a log entry on email login
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-04-07 10:15:20 +02:00
7b3fdfeeaa
do login routine only once when done via LoginController
...
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-04-06 15:22:42 +02:00
2994cbc586
fix login controller tests
...
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-04-06 15:20:17 +02:00
6bdd3a167d
Merge pull request #4123 from nextcloud/allow-password-reset-with-email
...
Allow to reset the password with the email as an input
2017-04-05 09:12:41 +02:00
9813023aab
Fix gzip files for Safari
...
* Safari support gzip only if the filename does not
end on .gz - so this renames them to .gzip
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-03-29 00:11:51 -06:00
3a0ef65f33
Fix controller tests
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-03-28 23:42:20 +02:00
4bae7ef96d
Allow to reset the password with the email as an input
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-03-28 21:17:37 +02:00
677e11b1a4
Tests
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-03-24 11:31:48 +01:00
9533f4e5ed
Clean up single user mode
...
Single user mode basically disables WebDAV, OCS and cron execution. Since
we heavily rely on WebDAV and OCS also in the web UI it's basically useless.
An admin only sees a broken interface and can't even change any settings nor
sees any files. Also sharing is not possible.
As this is at least the case since Nextcloud 9 and we haven't received any
reports for this it seems that this feature is not used at all so I removed it.
The encryption commands now rely on the well tested maintenance mode.
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-02-22 23:02:31 -06:00
5e728d0eda
oc_token should be nc_token
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-02-02 21:56:44 +01:00
5bad417e57
Merge pull request #2044 from nextcloud/login-credential-store
...
Login credential store
2017-01-30 19:30:04 -06:00
5086335643
unify endpoints form core and the the provisioning api
...
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2017-01-25 11:20:35 +01:00
012708e1ba
Merge pull request #3023 from nextcloud/issue-2915-filter-out-sensitive-appconfigs
...
Filter out sensitive appconfig values
2017-01-17 11:01:42 +01:00
622101f2dd
Merge pull request #2918 from nextcloud/encryption-recovery-improvements
...
create new encryption keys on password reset and backup the old one
2017-01-13 11:28:43 +01:00
5dc6899d1a
Fix tests
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-01-12 10:49:22 +01:00
140555b786
always allow remembered login
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-01-11 19:20:11 +01:00
243c9c0941
fix coding style and increase code coverage
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-01-11 11:01:54 +01:00
b8d41752ca
Fix tests
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-01-11 11:01:54 +01:00
fcda3a20f4
create new encryption keys on password reset and backup the old one
...
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2017-01-10 17:04:32 +01:00
350b7ebc86
Adds CssControllerTests
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-01-06 09:42:39 +01:00
15efd3b38d
Merge pull request #2892 from nextcloud/usercontroller_tests
...
Adds user controller tests
2016-12-30 14:58:52 +01:00
31a3e9847f
Adds user controller tests
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-12-30 13:26:26 +01:00
b5a23c9754
User command enable/disable tests
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-12-30 13:17:41 +01:00
a7d9b7c876
Add Group Command tests
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-12-29 11:48:57 +01:00
eff904473d
Set redirect_url on 2FA challenge page
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2016-12-23 20:53:26 +01:00
998f235474
Merge pull request #2563 from nextcloud/fix-password-reset
...
fix password reset if encryption is enabled
2016-12-22 11:18:04 +01:00
09caadac05
Add tests for 2FA commands
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-12-20 16:36:58 +01:00
16bbd3fd7c
fix password reset if encryption is enabled
...
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2016-12-08 12:08:05 +01:00
924358ef96
Save the timezone on login again
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-12-08 10:45:24 +01:00
8bf4111368
Fix changing display names for subadmins
...
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-11-21 11:30:00 +01:00
74c68d8761
Add OCSControllerTests
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-16 19:49:51 +01:00
ac61f64190
Merge pull request #1109 from nextcloud/add-more-secrets-to-password-reset-link
...
Use mail for encrypting the password reset token as well
2016-11-03 22:11:43 +01:00
dca9184a12
Fix tests
...
* Tests fixed and controller coverage to 100%
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-03 19:08:56 +01:00
6d686c213b
[WIP] Use mail for encrypting the password reset token as well
2016-11-03 14:27:26 +01:00
9e6b26dcd0
Add cache 1 day cache to preview endpoint
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-03 14:00:33 +01:00
55af6b45f7
More tests
...
* PreviewController test
* PublicPreview test
* Versions Preview test
* Trash Preview test
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-03 14:00:33 +01:00
d907666232
bring back remember-me
...
* try to reuse the old session token for remember me login
* decrypt/encrypt token password and set the session id accordingly
* create remember-me cookies only if checkbox is checked and 2fa solved
* adjust db token cleanup to store remembered tokens longer
* adjust unit tests
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2016-11-02 13:39:16 +01:00
656e3f7a24
Check the mimetype before reading the content and catch exception
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-10-18 16:22:20 +02:00
a0b34dfd2f
Merge pull request #1629 from nextcloud/cleanup-settings-application
...
Cleanup settings Application class
2016-10-06 16:57:39 +02:00
ed30b1f645
Use our base class everywhere
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-10-06 14:11:04 +02:00
c84dc6aa1c
Properly catch password policy hint for personal page password changes
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2016-10-06 10:55:33 +02:00
a1e4b17ff4
Remove unused endpoint
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-09-30 10:21:08 +02:00
877cb06bfe
Use magic DI for core controllers
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-09-30 10:00:26 +02:00
Lukas Reschke
Morris Jobke
Joas Schilling
Arthur Schiwon
Roeland Jago Douma
Roeland Jago Douma
Christoph Wurst
Bjoern Schiessle
Christoph Wurst
Cornelius Kölbel