ac841ee002
Merge pull request #3362 from nextcloud/fix/nc-token-cookie-name
...
oc_token should be nc_token
2017-02-09 10:07:59 +01:00
9b6f99ab08
Update license header
...
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
2017-02-07 01:25:39 +01:00
fa1d607bfa
Merge remote-tracking branch 'nextcloud/master'
...
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
2017-02-07 00:15:30 +01:00
ff3fa538e4
Add missing use statement for PublicEmitter
...
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
2017-02-07 00:12:19 +01:00
5e728d0eda
oc_token should be nc_token
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-02-02 21:56:44 +01:00
20f878b014
Fix typo for UserManager variable
...
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
2017-02-01 21:54:00 +01:00
6feff0ceba
Add check if UserManager is of type PublicEmitter before calling preLogin hook
...
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
2017-02-01 21:53:50 +01:00
e30d28f7eb
Change where preLogin hook gets called
...
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
2017-02-01 21:53:42 +01:00
6ab0a3215d
Remove preLoginValidation hook
...
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
2017-02-01 21:53:29 +01:00
e14d50eb1f
Fix indentation
...
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
2017-02-01 21:50:47 +01:00
4ebcd5ac0b
Add preLoginValidation hook
...
Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
2017-02-01 21:50:25 +01:00
2c9d7eeb76
Fix public page css fallback loading
...
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2017-02-01 18:03:51 +01:00
5bad417e57
Merge pull request #2044 from nextcloud/login-credential-store
...
Login credential store
2017-01-30 19:30:04 -06:00
bde1150d04
Merge pull request #3004 from nextcloud/fix-installation-css
...
Fixed installation page
2017-01-22 18:28:33 +01:00
cdf01feba7
add action to existing brute force protection
...
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2017-01-18 15:25:16 +01:00
140555b786
always allow remembered login
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-01-11 19:20:11 +01:00
e4b3ba6590
Create unified css file and merge all needed data into this file
...
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2017-01-10 17:50:29 +01:00
2f21eaaf47
Use login name to fix password confirm with ldap users
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-01-05 12:17:30 +01:00
924358ef96
Save the timezone on login again
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-12-08 10:45:24 +01:00
25a5c655f7
Move integer casting to the top of the chain
...
Signed-off-by: justin-sleep <justin@quarterfull.com>
2016-12-02 14:07:45 -06:00
d75e35b75e
Introduce the UI for password confirmation
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-11-18 11:57:16 +01:00
d907666232
bring back remember-me
...
* try to reuse the old session token for remember me login
* decrypt/encrypt token password and set the session id accordingly
* create remember-me cookies only if checkbox is checked and 2fa solved
* adjust db token cleanup to store remembered tokens longer
* adjust unit tests
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2016-11-02 13:39:16 +01:00
877cb06bfe
Use magic DI for core controllers
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-09-30 10:00:26 +02:00
e341bde8b9
Merge pull request #1172 from nextcloud/core_cleanup
...
Core controller cleanup
2016-08-30 08:32:55 +02:00
f6423f74e3
Minor cleanup in core Controllers
2016-08-29 21:52:09 +02:00
291dd0bd31
redirect to 2fa provider if there's only one active for the user
2016-08-29 18:36:39 +02:00
736e884e9a
Move the reset token to core app
2016-08-23 15:01:38 +02:00
139fb8de94
Remove "password reset token" after successful login
2016-08-23 12:54:45 +02:00
9ca25e857c
Redirect users when already logged-in on login form
2016-08-11 15:22:29 +02:00
4cf2f97a16
Add missing array element - fixes #25714
2016-08-10 11:11:23 +02:00
4ecd16c555
Redirect to default page after login
2016-07-27 12:11:58 +02:00
ba87db3fcc
Fix others
2016-07-21 18:13:57 +02:00
c1589f163c
Mitigate race condition
2016-07-20 23:09:27 +02:00
ba4f12baa0
Implement brute force protection
...
Class Throttler implements the bruteforce protection for security actions in
Nextcloud.
It is working by logging invalid login attempts to the database and slowing
down all login attempts from the same subnet. The max delay is 30 seconds and
the starting delay are 200 milliseconds. (after the first failed login)
2016-07-20 22:08:56 +02:00
232d735893
Do not leak the login name - fixes #25047
2016-06-09 16:44:31 +02:00
5e71d23ded
remember redirect_url when solving the 2FA challenge
2016-06-01 14:43:47 +02:00
235f03da64
Merge pull request #24795 from owncloud/issue-24789-reset-password-link-new-window
...
Allow opening the password reset link in a new window when its a URL
2016-05-31 10:12:30 +02:00
aba539703c
Update license headers
2016-05-26 19:57:24 +02:00
ad10485cec
when generating browser/device token, save the login name for later password checks
2016-05-24 11:49:15 +02:00
4128b853e5
login explicitly
2016-05-24 09:48:02 +02:00
5c063cf7c9
Allow opening the password reset link in a new window when its a URL
2016-05-24 09:23:25 +02:00
dfb4d426c2
Add two factor auth to core
2016-05-23 11:21:10 +02:00
e077d78ec9
Show login error message correctly ( #24599 )
2016-05-12 16:53:50 +02:00
ee0ebd192a
Use proper URL generation function ( #24576 )
...
Fixes the redirection after login, otherwise `core/files/index` is opened which fails.
2016-05-11 19:39:57 +02:00
0486d750aa
use the UID for creating the session token, not the login name
2016-05-11 13:36:46 +02:00
214aa6639c
fix login with email
2016-05-11 13:36:46 +02:00
46bdf6ea2b
fix PHPDoc and other minor issues
2016-05-11 13:36:46 +02:00
3ffa7d986a
show login error
2016-05-11 13:36:46 +02:00
aa85edd224
increase token column width
...
add some range to time() assertions
2016-05-11 13:36:46 +02:00
aafd660b97
fix LoginController unit tests
2016-05-11 13:36:46 +02:00
7aa16e1559
fix setup
2016-05-11 13:36:46 +02:00
fdc2cd7554
Add token auth for OCS APIs
2016-05-11 13:36:46 +02:00
3ab922601a
Check if session token is valid and log user out if the check fails
...
* Update last_activity timestamp of the session token
* Check user backend credentials once in 5 minutes
2016-05-11 13:36:46 +02:00
d8cde414bd
token based auth
...
* Add InvalidTokenException
* add DefaultTokenMapper and use it to check if a auth token exists
* create new token for the browser session if none exists
hash stored token; save user agent
* encrypt login password when creating the token
2016-05-11 13:36:46 +02:00
8222ad5157
Move logout to controller
...
Testable code. Yay.
2016-04-18 21:21:52 +02:00
d4a93893bb
Also check for an empty string
...
PHP. Yay.
2016-04-15 19:53:14 +02:00
fee95084ae
Rename `username` to `loginName`
...
UID and login name are two different things.
2016-04-15 19:02:19 +02:00
8a650a51be
Use !== instead of empty
...
Users can be named null
2016-04-15 18:57:11 +02:00
331e4efacb
Move login form into controller
...
First step on getting the authorisation stuff cleaned up. This is only for the login form, all other stuff is still where it is.
2016-04-15 17:36:23 +02:00
Joas Schilling
Sandro Lutz
Christoph Wurst
John Molakvoæ (skjnldsv)
Morris Jobke
Lukas Reschke
Bjoern Schiessle
justin-sleep
Roeland Jago Douma
Thomas Müller
Christoph Wurst
Vincent Petry
Lukas Reschke
Joas Schilling
Christoph Wurst