Commit Graph

97 Commits

Author SHA1 Message Date
Christoph Wurst 67c3730fbb
Add admin interface to enforce 2FA
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-10-10 14:34:52 +02:00
Julius Härtl 0a7ab6f66f
Reorder routes to avoid conflicts
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-06-06 11:40:09 +02:00
Julius Härtl bb50ee08e9
Fix app enabling for groups and allow requesting all apps
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-06-06 11:40:09 +02:00
Julius Härtl 05b60ee170
Fix category navigation
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-06-06 11:40:09 +02:00
Julius Härtl 8594fdc493
Move to AppFramework Controller
Signed-off-by: Julius Härtl <jus@bitgrid.net>

Move app management ajax code to AppSettingsController

Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-06-06 11:40:06 +02:00
John Molakvoæ (skjnldsv) 2963fdc879
Bump user controller, cleaned old legacy and added route history mode
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-05-16 09:50:22 +02:00
John Molakvoæ (skjnldsv) c8f670dd8f
Settings to vuejs
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2018-05-16 09:50:20 +02:00
Morris Jobke 0d5142be70
Show a link to the docs instead of a button on the untrusted domain page
Before there was a button to "quickly" add the untrusted domain to the config. This button often didn't worked, because the generated URL was often untrusted as well. Thus removing it and providing proper docs seems to be the better approach to handle this rare case.

Also the log should not be spammed by messages for the untrusted domain accesses, because they are user related and not necessarily an administrative issue.

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-04-17 17:47:11 +02:00
Julius Härtl 570ee078a0
Use new navigation endpoint and get rid of the legacy navigationdetect ajax
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-04-10 14:23:30 +02:00
Morris Jobke 31c5c2a592
Change @georgehrke's email
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-11-06 20:38:59 +01:00
Morris Jobke 0eebff152a
Update license headers
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-11-06 16:56:19 +01:00
Arthur Schiwon 045f652ef2
completing PersonalInfo
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-06-23 12:36:37 +02:00
Arthur Schiwon 247b305b79
add route and controller. consolidate common settings functions in a trait.
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-06-23 12:36:17 +02:00
Joas Schilling 7816c54625
Allow to force a language and set it via the ocs api
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-06-21 11:34:52 +02:00
Thomas Pulzer 637c75bca1
Implemented visual feedback if a user is disabled in admin user menu.
Implemented visuals for enabling/disabling user from admin user list.
Added the controller functions for enabling/disabling a user.

Added the route for changing user status (enabled/disabled) and added an additional route handler in the user controller.
 Finished the visuals to reflect current user status and changed user status respectively.

Changed the single icon for enabling/disabling a user into a menu where deletion and state toggling of a user is selectable.

Added displaying of disabled user count.
Improved style of user action menu.

Added proper counting of disabled users.
Removed visual indicator for disabled users.

Moved pseudo-group detection for disabled users from frontend to the controller.
Changed units for newly introduced css values from em to px.
Removed unnecessary png and optimized svg with scour.
Changed the userlist template to display the user action menu with correct width.

Style fixes for better readability and coding style conformity.

Changed the icons for enabling, disabling and deleting a user in the action menu.
2017-04-29 00:54:30 -03:00
Bjoern Schiessle c9ccdca1ec
add verification dialog
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2017-04-28 23:41:35 -03:00
Roeland Jago Douma 2850f09bf2
Make group settings routes explicit
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-04-18 22:00:22 +02:00
Bjoern Schiessle 0de685c562
bring back setEmailAddress for the user management
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2016-11-25 10:26:48 +01:00
Björn Schießle de1f3f05fd
allow to change display names in the user settings again
keep display name and email address in sync with the accounts table

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-21 11:29:54 +01:00
Christoph Wurst d1233b47b0
use PUT to update user settings
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-21 11:29:38 +01:00
Christoph Wurst 20739c93a6
Persist settings on the server
Persist personal settings federated sharing scopes

Show new settings fields in read-only mode too

Insert values on page load

Return updated values; show inline success feedback

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-21 11:29:24 +01:00
Roeland Jago Douma 78efb1972e
Fix route and js
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-06 14:05:53 +01:00
Lukas Reschke 32cf661215
Use new appstore API
This change introduces the new appstore API in Nextcloud.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-10-31 17:17:44 +01:00
Roeland Jago Douma 32a6f5f182
Moved ChangePassword to an actual Controller
* Still no full DI because of encryption fu
* Remove old "Controller"
2016-08-17 10:21:14 +02:00
Arthur Schiwon ceeb44bd04
Initial work on Apps page split:
* interfaces for the Admin settings (IAdmin) and section (ISection)
* SettingsManager service
* example setup with LDAP app
2016-08-09 18:05:09 +02:00
Joas Schilling 0215b004da
Update with robin 2016-07-21 18:13:58 +02:00
Joas Schilling ba87db3fcc
Fix others 2016-07-21 18:13:57 +02:00
Lukas Reschke aba539703c
Update license headers 2016-05-26 19:57:24 +02:00
Christoph Wurst 12431aa399
list user's auth tokens on the personal settings page 2016-05-23 09:11:12 +02:00
Lukas Reschke 933f60e314 Update author information
Probably nice for the people that contributed to 9.0 to see themselves in the AUTHORS file :)
2016-03-01 17:25:15 +01:00
Thomas Müller c5a200c419 Merge pull request #21653 from owncloud/update-license-headers-2016
Update license headers 2016
2016-01-13 08:29:42 +01:00
Thomas Müller 682821c71e Happy new year! 2016-01-12 15:02:18 +01:00
Robin Appelman c15cab7ed6 Allow admins to add system wide root certificates 2016-01-12 12:50:59 +01:00
Lukas Reschke 4971015544 Add code integrity check
This PR implements the base foundation of the code signing and integrity check. In this PR implemented is the signing and verification logic, as well as commands to sign single apps or the core repository.

Furthermore, there is a basic implementation to display problems with the code integrity on the update screen.

Code signing basically happens the following way:

- There is a ownCloud Root Certificate authority stored `resources/codesigning/root.crt` (in this PR I also ship the private key which we obviously need to change before a release 😉). This certificate is not intended to be used for signing directly and only is used to sign new certificates.
- Using the `integrity:sign-core` and `integrity:sign-app` commands developers can sign either the core release or a single app. The core release needs to be signed with a certificate that has a CN of `core`,  apps need to be signed with a certificate that either has a CN of `core` (shipped apps!)  or the AppID.
- The command generates a signature.json file of the following format:
```json
{
    "hashes": {
        "/filename.php": "2401fed2eea6f2c1027c482a633e8e25cd46701f811e2d2c10dc213fd95fa60e350bccbbebdccc73a042b1a2799f673fbabadc783284cc288e4f1a1eacb74e3d",
        "/lib/base.php": "55548cc16b457cd74241990cc9d3b72b6335f2e5f45eee95171da024087d114fcbc2effc3d5818a6d5d55f2ae960ab39fd0414d0c542b72a3b9e08eb21206dd9"
    },
    "certificate": "-----BEGIN CERTIFICATE-----MIIBvTCCASagAwIBAgIUPvawyqJwCwYazcv7iz16TWxfeUMwDQYJKoZIhvcNAQEF\nBQAwIzEhMB8GA1UECgwYb3duQ2xvdWQgQ29kZSBTaWduaW5nIENBMB4XDTE1MTAx\nNDEzMTcxMFoXDTE2MTAxNDEzMTcxMFowEzERMA8GA1UEAwwIY29udGFjdHMwgZ8w\nDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANoQesGdCW0L2L+a2xITYipixkScrIpB\nkX5Snu3fs45MscDb61xByjBSlFgR4QI6McoCipPw4SUr28EaExVvgPSvqUjYLGps\nfiv0Cvgquzbx/X3mUcdk9LcFo1uWGtrTfkuXSKX41PnJGTr6RQWGIBd1V52q1qbC\nJKkfzyeMeuQfAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAvF/KIhRMQ3tYTmgHWsiM\nwDMgIDb7iaHF0fS+/Nvo4PzoTO/trev6tMyjLbJ7hgdCpz/1sNzE11Cibf6V6dsz\njCE9invP368Xv0bTRObRqeSNsGogGl5ceAvR0c9BG+NRIKHcly3At3gLkS2791bC\niG+UxI/MNcWV0uJg9S63LF8=\n-----END CERTIFICATE-----",
    "signature": "U29tZVNpZ25lZERhdGFFeGFtcGxl"
}
```
`hashes` is an array of all files in the folder with their corresponding SHA512 hashes (this is actually quite cheap to calculate), the `certificate` is the  certificate used for signing. It has to be issued by the ownCloud Root Authority and it's CN needs to be permitted to perform the required action. The `signature` is then a signature of the `hashes` which can be verified using the `certificate`.

Steps to do in other PRs, this is already a quite huge one:
- Add nag screen in case the code check fails to ensure that administrators are aware of this.
- Add code verification also to OCC upgrade and unify display code more.
- Add enforced code verification to apps shipped from the appstore with a level of "official"
- Add enfocrced code verification to apps shipped from the appstore that were already signed in a previous release
- Add some developer documentation on how devs can request their own certificate
- Check when installing ownCloud
- Add support for CRLs to allow revoking certificates

**Note:** The upgrade checks are only run when the instance has a defined release channel of `stable` (defined in `version.php`). If you want to test this, you need to change the channel thus and then generate the core signature:

```
➜  master git:(add-integrity-checker) ✗ ./occ integrity:sign-core --privateKey=resources/codesigning/core.key --certificate=resources/codesigning/core.crt
Successfully signed "core"
```

Then increase the version and you should see something like the following:

![2015-11-04_12-02-57](https://cloud.githubusercontent.com/assets/878997/10936336/6adb1d14-82ec-11e5-8f06-9a74801c9abf.png)

As you can see a failed code check will not prevent the further update. It will instead just be a notice to the admin. In a next step we will add some nag screen.

For packaging stable releases this requires the following additional steps as a last action before zipping:
1. Run `./occ integrity:sign-core` once
2. Run `./occ integrity:sign-app` _for each_ app. However, this can be simply automated using a simple foreach on the apps folder.
2015-12-01 11:55:20 +01:00
Roeland Jago Douma 0265bcfdae Moved changedisplayname to usercontroller
Killed the old static route to change a users display name and moved it
to a properly testable controller.
2015-11-20 16:05:43 +01:00
Vincent Petry 781bca2437 Fix everyone count for subadmins
Also moved the logic to the UsersController
2015-10-29 17:41:49 +01:00
Morris Jobke f63915d0c8 update license headers and authors 2015-06-25 14:13:49 +02:00
Lukas Reschke 20a6073a9f Migrate personal certificate handling into AppFramework controllers
Also added unit-tests and better error-handling
2015-04-20 12:58:58 +02:00
Bjoern Schiessle d2ef73367c allow user to start migration in admin settings if no external user back-ends are enabled 2015-04-16 14:15:04 +02:00
Lukas Reschke ba52f6f8fc Merge pull request #15314 from owncloud/app-categories-15274
Add different trust levels to AppStore interface
2015-04-09 10:07:32 +02:00
Thomas Müller bf809ac85a Removing left overs from old encryption app 2015-04-07 13:30:29 +02:00
Lukas Reschke 0816cf9142 Add experimental applications switch
Allows administrators to disable or enabled experimental applications as well as show the trust level.
2015-04-03 13:21:24 +02:00
Lukas Reschke 65202d2a18 Add check for activated local memcache
Also used the opportunity to refactor it into an AppFramework controller so that we can unit test it.

Fixes https://github.com/owncloud/core/issues/14956
2015-03-28 13:59:22 +01:00
Jenkins for ownCloud b585d87d9d Update license headers 2015-03-26 11:44:36 +01:00
Lukas Reschke bbd5f28415 Let users configure security headers in their Webserver
Doing this in the PHP code is not the right approach for multiple reasons:

1. A bug in the PHP code prevents them from being added to the response.
2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud)
3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations.

This pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS.
2015-03-02 19:07:46 +01:00
Morris Jobke 06aef4e8b1 Revert "Updating license headers"
This reverts commit 6a1a4880f0.
2015-02-26 11:37:37 +01:00
Jenkins for ownCloud 6a1a4880f0 Updating license headers 2015-02-23 12:13:59 +01:00
Lukas Reschke 7e45f5d27b Remove unused function and correct PHPDoc 2015-02-16 13:46:45 +01:00
Georg Ehrke f579f2bd94 add Download logfile button to admin settings
add logSettingsController

add download logfile button

move getEntries to LogSettingsController

move set log level to logsettingscontroller.php

add warning if logfile is bigger than 100MB

add unit test for set log level

fix typecasting, add new line at EoF

show log and logfile download only if log_type is set to owncloud

add unit test for getFilenameForDownload
2015-01-07 14:55:53 +01:00
Morris Jobke 5913af8a72 Mail address of users is now changable in the user management
* introduced new route settings/users/{id}/mailAddress
* kept old responses
* better error messages
* dropped lostpassword.php from settings/ajax
* cleaned up the UserList.add() and hand in user object instead of
  each attribute as another parameter
* check for change permission of mail address
* proper response messages
2014-12-18 22:43:09 +01:00