Commit Graph

331 Commits

Author SHA1 Message Date
Christoph Wurst 42300d19e9
Fix max length requirements for the throttler metadata
If a failed login is logged, we save the username as metadata
in the bruteforce throttler. To prevent database error due to
very long strings, this truncates the username at 64 bytes in
the assumption that no real username is longer than that.long strings,

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-08-13 15:52:09 +02:00
Christoph Wurst d8197f2b97
Rename providerset method to get primary providers
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-08-08 20:28:21 +02:00
Christoph Wurst c6e47e8a51
Fix login redirection if only one 2FA provider is active
Fixes https://github.com/nextcloud/server/issues/10500.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-08-08 15:25:59 +02:00
Joas Schilling decd196162
Make the info available if the avatar was uploaded or generated
Signed-off-by: Joas Schilling <coding@schilljs.com>
2018-08-01 10:56:22 +02:00
Morris Jobke 70fa73404f
Merge pull request #10391 from nextcloud/bugfix/10389/fix-app-navigation-controller
Fix app navigation controller to return an array
2018-07-25 14:11:49 +02:00
Julius Härtl 4c773891d7
Fix app navigation controller to return an array
This is required to not break compatibility with existing consumers of that endpoint like the apps management or the client

Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-07-25 13:50:46 +02:00
Joas Schilling 12efde520d
Allow to access SVGs as guest
Signed-off-by: Joas Schilling <coding@schilljs.com>
2018-07-25 12:05:18 +02:00
Michael Weimann c92d7429d7 Implements handling for deactivated users
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
2018-07-21 13:05:13 +02:00
John Molakvoæ (skjnldsv) 37a4d2bbbc
Php code bump
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-07-19 22:46:32 +02:00
Julius Härtl bfc6fc8e50
Fix settings icon fetching
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-07-19 08:17:00 +02:00
John Molakvoæ (skjnldsv) 61946819ba
Fixed svg generator regex && added missing icons
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-07-19 08:16:59 +02:00
John Molakvoæ (skjnldsv) 9e5885963c
Fixed icons detection and caching
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-07-19 08:16:58 +02:00
John Molakvoæ (skjnldsv) 8977c71f88
Mixin scss icon api
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-07-19 08:16:58 +02:00
John Molakvoæ (skjnldsv) ccd70a4099
use built in response cacheFor function
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-07-19 08:16:58 +02:00
John Molakvoæ (skjnldsv) 29ff7efe9a
Svg icon api sass function and upgrade of all styles
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-07-19 08:16:57 +02:00
John Molakvoæ (skjnldsv) 98a0113d40
Svg from app
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-07-19 08:16:30 +02:00
John Molakvoæ (skjnldsv) 84e90e26c0
Svg color api
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-07-19 08:16:30 +02:00
Arthur Schiwon ca6094f390
wire the frontend
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2018-07-05 20:29:00 +02:00
Arthur Schiwon 772bbd99be
Backend work to provide NC whats New info to users
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2018-07-05 14:33:08 +02:00
Morris Jobke 9444a3fad1
Merge pull request #9632 from nextcloud/enhancement/stateful-2fa-providers
Stateful 2fa providers
2018-06-25 15:49:58 +02:00
Robin Appelman 8ed50d4b63
prefill userid for login after password reset
Signed-off-by: Robin Appelman <robin@icewind.nl>
2018-06-21 15:18:07 +02:00
Christoph Wurst 13d93f5b25
Make 2FA providers stateful
This adds persistence to the Nextcloud server 2FA logic so that the server
knows which 2FA providers are enabled for a specific user at any time, even
when the provider is not available.

The `IStatefulProvider` interface was added as tagging interface for providers
that are compatible with this new API.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-06-20 08:30:26 +02:00
John Molakvoæ (skjnldsv) 543188d0cb
Removed debug stack
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-06-15 15:40:10 +02:00
John Molakvoæ (skjnldsv) 156da29cea
Avatar imagick bump
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-06-13 18:46:05 +02:00
John Molakvoæ (skjnldsv) eea6f74ca4
Controller tests fixes
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-06-13 18:46:04 +02:00
John Molakvoæ (skjnldsv) adf3856d35
Return Svg avatars
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-06-13 18:46:04 +02:00
Roeland Jago Douma e5cc8be9d5
Fix usage
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-06-04 08:48:54 +02:00
Morris Jobke 245d20f9ac
Merge pull request #9531 from remyj38/master
Fix translation bug on lost password page
2018-05-22 16:31:30 +02:00
Roeland Jago Douma 5a97148863
Don't use special chars to avoid confusion
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-05-22 09:24:17 +02:00
Rémy Jacquin 04e1cab5ee
Fix translation bug on lost password page
Fix nextcloud/password_policy#26

Signed-off-by: Rémy Jacquin <remy@remyj.fr>
2018-05-20 12:51:50 +02:00
Arthur Schiwon 38a90130ce
move log constants to ILogger
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2018-04-26 10:45:52 +02:00
Roeland Jago Douma a07f6d46e3
Use proper types
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-04-11 00:21:25 +02:00
Morris Jobke fd3c97b93b
Avoid to leak a user ID that is not a string to reach a user backend
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-04-11 00:03:30 +02:00
Roeland Jago Douma b2350810e0
Merge pull request #9115 from nextcloud/feature/noid/login_flow_wording
Improve login flow
2018-04-09 08:45:27 +02:00
Roeland Jago Douma 177c8972cc
Improve login flow
* Add page explaining you are about to grant access
* Show grant access page after login

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-04-08 13:42:36 +02:00
Roeland Jago Douma 33b93db953
Remove unused parameter
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-04-06 21:44:23 +02:00
Roeland Jago Douma 2b7d4d5069
Fix tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-04-06 19:58:37 +02:00
Roeland Jago Douma caee215120
Always remember me
Fixes #8004

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-04-06 15:44:28 +02:00
Joas Schilling dabd7291c3
Make the new autocomplete endpoint OCS
Signed-off-by: Joas Schilling <coding@schilljs.com>
2018-03-21 09:46:52 +01:00
Roeland Jago Douma 796b4f19f8
Add Cache-control: immutable
Cache generated CSS forever!
Also cache combined JS forever
Fix tests

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-03-19 14:21:53 +01:00
Roeland Jago Douma 7674e591bd
Move search to proper Controller
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-03-09 14:36:48 +01:00
Christoph Wurst b9720703e8 Add CSRF token controller to retrieve the current CSRF token
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-03-08 16:48:50 +01:00
Julius Härtl 11b6cc3f68
Replace logout href to avoid new etag on every request
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-03-06 09:51:28 +01:00
Julius Härtl 723b8764d1
Add ETag to NavigationController
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-03-05 12:19:20 +01:00
Bjoern Schiessle 7d0102bf73
expose capabilities in js
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2018-02-27 12:29:25 +01:00
Joas Schilling 226e63695f
Merge pull request #8026 from nextcloud/feature/noid/allow-custom-html-in-html-emails
Allow custom HTML in HTML Emails
2018-02-26 13:38:39 +01:00
Arthur Schiwon ffc05e2fed
don't try login with the same name that just failed
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2018-02-22 13:05:48 +01:00
Roeland Jago Douma cf83eb5e77
Merge pull request #8336 from nextcloud/cleanup-unused-parameter
Cleanup unused parameter
2018-02-20 10:16:59 +01:00
Morris Jobke 14bc9b1714
Merge pull request #8095 from nextcloud/webapps-capabilities
Expose navigation entries as API endpoint
2018-02-15 16:55:12 +01:00
Joas Schilling 339e320064
Fix existing usages
Signed-off-by: Joas Schilling <coding@schilljs.com>
2018-02-15 12:18:51 +01:00
Morris Jobke d3d045dd5c
Remove unused import statements
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-02-14 16:55:43 +01:00
Morris Jobke bcf1668cc8
Remove config from AutoCompleteController
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-02-13 21:40:30 +01:00
Julius Härtl 5a23b35ddb
Also rewrite icon url
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-02-12 21:20:21 +01:00
Julius Härtl 922cf44c81
Move to OCS endpoint
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-02-12 17:22:33 +01:00
Julius Härtl 8ecac56543
Allow requesting absolute URLs
They might be useful when requesting the navigation from the clients

Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-02-12 17:22:32 +01:00
Julius Härtl 6211d18dc1
Add tests for NavigationController
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-02-12 17:22:32 +01:00
Julius Härtl 96480af159
Add navigation endpoint
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-02-12 17:22:32 +01:00
Roeland Jago Douma 0224c61530
Add preview endpoint for the fileid
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-01-24 11:24:18 +01:00
Morris Jobke 3d4c698f44
Improve OC_Image code to not guess the type of input, but actually request the specific methods to be called
Followup to #7836

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-01-18 13:40:55 +01:00
Morris Jobke 4ef302c0be
Request->getHeader() should always return a string
PHPDoc (of the public API) says that this method returns string but it also returns null, which is not allowed in some method calls. This fixes that behaviour and returns an empty string and fixes all code paths that explicitly checked for null to be still compliant.

Found while enabling the strict_typing for lib/private for the PHP7+ migration.

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-01-17 09:51:31 +01:00
Roeland Jago Douma 7cab7feb38
Display message when connection is throttled on logi page
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-01-15 21:43:09 +01:00
Mario Danic cc742ce9e7
Fix bug with proxies
Signed-off-by: Mario Danic <mario@lovelyhq.com>
2018-01-15 00:50:49 +01:00
Morris Jobke 68e205e827
Merge pull request #7712 from nextcloud/jsconfig_l10n
Use correct L10N files for jsconfig
2018-01-05 15:22:10 +01:00
Roeland Jago Douma 30ac28f950
Use correct L10N files for jsconfig
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-01-05 14:33:03 +01:00
Roeland Jago Douma 82f03e1314
Clear login token once apppassword is generated
Fixes #7697

When using the new login flow a token will be generated since we login.
However after that we generate yet another token to return (as we
should).

However we should kill the current session token as we are done with it.
And will never use it again.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-01-04 14:30:40 +01:00
Arthur Schiwon 4f3d52a364
never translate login names when requiring with a user id
where appropriate, the preLoginNameUsedAsUserName hook should be thrown.

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2018-01-03 13:25:00 +01:00
Julius Härtl f5f6ed664d
Hide stay logged in checkbox when flow authentication is used
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2017-12-28 11:15:26 +01:00
Roeland Jago Douma c1fcd6fc98
Merge pull request #7324 from nextcloud/no-sorters-no-instances
don't create sorter instances when none was requested
2017-12-11 15:27:44 +01:00
Morris Jobke ed7beb929e
Merge pull request #6876 from nextcloud/always_img_avatar
Always generate avatar
2017-12-08 23:58:17 +01:00
Roeland Jago Douma ba648eecdf
Move avatar code to Avatar Class
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-11-29 14:23:15 +01:00
Roeland Jago Douma 604596ec16
Always generate avatar
Even if no avatar is set we should just generate the image. This to not
duplicate the code on all the clients. And only server images from the
avtar endpoint.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-11-29 14:23:15 +01:00
Arthur Schiwon 96bc03a03a
don't create sorter instances when none was requested
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-11-28 13:30:51 +01:00
Mario Danic c2cd5fc5d3 Fix flow
Signed-off-by: Mario Danic <mario@lovelyhq.com>
2017-11-09 00:29:34 +01:00
Julius Härtl cd1bfea8c4
Theming: theme flow redirection page
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2017-11-08 14:56:32 +01:00
Morris Jobke 31c5c2a592
Change @georgehrke's email
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-11-06 20:38:59 +01:00
Morris Jobke 0eebff152a
Update license headers
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-11-06 16:56:19 +01:00
Roeland Jago Douma 6ce095b166
Add 204 endpoint
Fixes #6967

This allows clients to check for Walled Garden connections.
The endpoint just responds with a 204 (which is very unlikely with such
a connection)

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-11-02 10:30:16 +01:00
Arthur Schiwon 25aad121e6
meanwhile we can have exact matches. also show those.
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-10-31 14:58:48 +01:00
Arthur Schiwon ca72c0150b
configurable amount of autocomplete results in comments
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-10-27 13:50:38 +02:00
Arthur Schiwon fa2f03979b
add search parameter to autocomplete controller
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-10-25 17:26:50 +02:00
Arthur Schiwon fd6daf8d19
AutoCompletion backend
* introduce a Controller for requests
* introduce result sorting mechanism
* extend Comments to retrieve commentors (actors) in a tree
* add commenters sorter
* add share recipients sorter

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-10-22 14:13:32 +02:00
Joas Schilling 3119fd41ce
Set the data from the template
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-10-18 15:12:03 +02:00
Joas Schilling 8b37fe7f65
Set the subject with the email template to allow theming
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-10-18 15:12:03 +02:00
Lukas Reschke 8ad17a66d6
Exclude avatar from Same-Site Cookie requirement
Required to work with the upcoming Collabora avatar integration.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-10-11 14:41:34 +02:00
Lukas Reschke 0bccd5a0d9
Fix "Uninitialized string offset: 0 at \/media\/psf\/stable9\/lib\/private\/URLGenerator.php#224"
The URLGenerator doesn't support `` as target for absolute URLs, we need to link to `/` thus.

Regression introduced with 46229a00f3

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-09-07 08:34:02 +02:00
Morris Jobke 504c1abee0
Fix undefined index oauthState
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-09-06 16:38:24 +02:00
Morris Jobke 15cd21d252 Merge pull request #6358 from nextcloud/fix-mixup-of-id-and-name
Set the meta data before everything
2017-09-05 16:08:57 +02:00
Joas Schilling 6dbb64c4a2
Merge setMetaData into constructor
This ensures that the meta data is set in the beginning

Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-09-04 15:07:41 +02:00
Morris Jobke 30ca3b70ed Merge pull request #6196 from nextcloud/downstream-26539-2
Handle invalid ext storage backend to keep mount point visible
2017-09-04 14:17:28 +02:00
Morris Jobke 0326c2c54f
Fix broken tests
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-09-04 14:17:03 +02:00
Julius Härtl 46229a00f3
Add rich link preview to the login page
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2017-09-02 21:39:38 +02:00
Joas Schilling 0aff1c9268
Return the user id in case of an error
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-08-29 11:10:30 +02:00
Morris Jobke 2bf15eda26 Merge pull request #6255 from nextcloud/email-meta-data
Add meta information to emails for better customisation
2017-08-26 18:53:52 +02:00
Morris Jobke 0b652648cc Merge pull request #6177 from nextcloud/properly-add-slo-url
Properly allow \OCP\Authentication\IApacheBackend to specify logout URL
2017-08-26 18:50:52 +02:00
Christoph Wurst 6676232a56
Allow 2FA providers to specify their custom CSP
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-08-26 13:48:08 +02:00
Joas Schilling 6a130d01e7
Also for reset password
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-08-24 18:02:37 +02:00
Lukas Reschke 2e4cd44556
Inject \OCP\IURLGenerator to make tests work
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-08-18 15:32:40 +02:00
Joas Schilling d5c6d56170
No password reset for disabled users
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-08-18 13:21:53 +02:00
Lukas Reschke a04feff9a7
Properly allow \OCP\Authentication\IApacheBackend to specify logout URL
Any `\OCP\Authentication\IApacheBackend` previously had to implement `getLogoutAttribute` which returns a string.
This string is directly injected into the logout `<a>` tag, so returning something like `href="foo"` would result
in `<a href="foo">`.

This is rather error prone and also in Nextcloud 12 broken as the logout entry has been moved with
054e161eb5 inside the navigation manager where one cannot simply inject attributes.

Thus this feature is broken in Nextcloud 12 which effectively leads to the bug described at nextcloud/user_saml#112,
people cannot logout anymore when using SAML using SLO. Basically in case of SAML you have a SLO url which redirects
you to the IdP and properly logs you out there as well.

Instead of monkey patching the Navigation manager I decided to instead change `\OCP\Authentication\IApacheBackend` to
use `\OCP\Authentication\IApacheBackend::getLogoutUrl` instead where it can return a string with the appropriate logout
URL. Since this functionality is only prominently used in the SAML plugin. Any custom app would need a small change but
I'm not aware of any and there's simply no way to fix this properly otherwise.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-08-18 12:22:44 +02:00
Morris Jobke 84c22fdeef Merge pull request #5907 from nextcloud/add-metadata-to-throttle-call
Add metadata to \OCP\AppFramework\Http\Response::throttle
2017-08-01 14:43:47 +02:00