Commit Graph

288 Commits

Author SHA1 Message Date
Roeland Jago Douma 78273cb1e6
Add an endppoint for clients to request an app password
Now that we allow enforcing 2 factor auth it make sense if we also allow
and endpoint where the clients can in the background fetch an
apppassword if they were configured before the login flow was present.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-10-03 19:05:20 +02:00
Michael Weimann a45ec3d324
Refactors the scss svg functions
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
2018-10-02 08:37:55 +02:00
Christoph Wurst 259c0ce11d
Add mandatory 2FA service/class
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-09-30 11:47:29 +02:00
Christoph Wurst 7586b19e52
Only allow 2FA state changs if providers support the operation
Ref https://github.com/nextcloud/server/issues/11019.

Add `twofactorauth:cleanup` command

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-09-25 09:54:20 +02:00
blizzz ef97ef72f6
Merge pull request #10743 from danielkesselberg/bugfix/noid/allow-password-reset-for-duplicate-email
Enable password reset for user with same email address when only one is active
2018-09-13 10:48:30 +02:00
Morris Jobke cf3f4888cc
Change password expiration time from 12h to 7d
We use the same logic for creating accounts without a password and there the 12h is a bit short. Users don't expect that the signup link needs to be clicked within 12h - 7d should be a more expected behavior.

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-08-31 13:31:03 +02:00
Denis Mosolov a0b84bc0fc
Merge pull request #10334 from denismosolov/group-add
Add options to create/remove groups via occ
2018-08-24 13:46:16 +03:00
Daniel Kesselberg 031fdfb1fc
Enable password reset for user with same email address when only one is active
When two or more user share the same email address its not possible to
reset password by email. Even when only one account is active.

This pr reduce list of users returned by getByEmail by disabled users.

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2018-08-19 16:32:46 +02:00
Denis Mosolov 0b18e2c75d Add an options to create and remove groups via occ
Signed-off-by: Denis Mosolov <denismosolov@gmail.com>
2018-08-16 10:31:20 +03:00
Bjoern Schiessle 3c5fb2b52b
update unit tests
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2018-08-15 15:08:36 +02:00
Christoph Wurst c6e47e8a51
Fix login redirection if only one 2FA provider is active
Fixes https://github.com/nextcloud/server/issues/10500.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-08-08 15:25:59 +02:00
Joas Schilling 38fffffe18
Fix unit test
Signed-off-by: Joas Schilling <coding@schilljs.com>
2018-08-01 14:46:44 +02:00
Julius Härtl 4c773891d7
Fix app navigation controller to return an array
This is required to not break compatibility with existing consumers of that endpoint like the apps management or the client

Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-07-25 13:50:46 +02:00
Michael Weimann de7606dc68 Adds disabled user unit tests
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
2018-07-21 13:05:25 +02:00
Michael Weimann 9bd48e7c0d Adds an info if the maintenance mode is already enabled/disabled.
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
2018-07-01 20:56:27 +02:00
Morris Jobke 9444a3fad1
Merge pull request #9632 from nextcloud/enhancement/stateful-2fa-providers
Stateful 2fa providers
2018-06-25 15:49:58 +02:00
Robin Appelman 8ed50d4b63
prefill userid for login after password reset
Signed-off-by: Robin Appelman <robin@icewind.nl>
2018-06-21 15:18:07 +02:00
Christoph Wurst 13d93f5b25
Make 2FA providers stateful
This adds persistence to the Nextcloud server 2FA logic so that the server
knows which 2FA providers are enabled for a specific user at any time, even
when the provider is not available.

The `IStatefulProvider` interface was added as tagging interface for providers
that are compatible with this new API.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-06-20 08:30:26 +02:00
Roeland Jago Douma 362e6b2903
Fix tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-05-14 13:30:22 +02:00
Morris Jobke 058f8123e6
Set the default log rotate size to 100 MB
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-04-11 00:27:51 +02:00
Roeland Jago Douma 2b7d4d5069
Fix tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-04-06 19:58:37 +02:00
Roeland Jago Douma 796b4f19f8
Add Cache-control: immutable
Cache generated CSS forever!
Also cache combined JS forever
Fix tests

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-03-19 14:21:53 +01:00
Christoph Wurst b9720703e8 Add CSRF token controller to retrieve the current CSRF token
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2018-03-08 16:48:50 +01:00
Julius Härtl 16ac8eaac9
Fix tests
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-03-07 09:17:18 +01:00
Julius Härtl 11b6cc3f68
Replace logout href to avoid new etag on every request
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-03-06 09:51:28 +01:00
Julius Härtl 723b8764d1
Add ETag to NavigationController
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-03-05 12:19:20 +01:00
Bjoern Schiessle 3a33683364
update unit tests
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2018-03-02 15:20:35 +01:00
Roeland Jago Douma cf83eb5e77
Merge pull request #8336 from nextcloud/cleanup-unused-parameter
Cleanup unused parameter
2018-02-20 10:16:59 +01:00
Morris Jobke bcf1668cc8
Remove config from AutoCompleteController
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-02-13 21:40:30 +01:00
Julius Härtl 5a23b35ddb
Also rewrite icon url
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-02-12 21:20:21 +01:00
Julius Härtl 922cf44c81
Move to OCS endpoint
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-02-12 17:22:33 +01:00
Julius Härtl 8ecac56543
Allow requesting absolute URLs
They might be useful when requesting the navigation from the clients

Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-02-12 17:22:32 +01:00
Julius Härtl 6211d18dc1
Add tests for NavigationController
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2018-02-12 17:22:32 +01:00
Morris Jobke 4ef302c0be
Request->getHeader() should always return a string
PHPDoc (of the public API) says that this method returns string but it also returns null, which is not allowed in some method calls. This fixes that behaviour and returns an empty string and fixes all code paths that explicitly checked for null to be still compliant.

Found while enabling the strict_typing for lib/private for the PHP7+ migration.

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-01-17 09:51:31 +01:00
Roeland Jago Douma b1d8084700
Fix tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-01-15 21:43:11 +01:00
Joas Schilling 7789fbdea6
Add unit test
Signed-off-by: Joas Schilling <coding@schilljs.com>
2018-01-15 00:50:52 +01:00
Roeland Jago Douma 8d1dd1945f
Fix tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-01-13 13:58:06 +01:00
Julius Härtl f5f6ed664d
Hide stay logged in checkbox when flow authentication is used
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2017-12-28 11:15:26 +01:00
Roeland Jago Douma 094d41937a
Fix tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-12-18 21:06:52 +01:00
Roeland Jago Douma c1fcd6fc98
Merge pull request #7324 from nextcloud/no-sorters-no-instances
don't create sorter instances when none was requested
2017-12-11 15:27:44 +01:00
Morris Jobke ed7beb929e
Merge pull request #6876 from nextcloud/always_img_avatar
Always generate avatar
2017-12-08 23:58:17 +01:00
Bjoern Schiessle 555fe7047f
fix tests
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2017-12-08 13:29:33 +01:00
Roeland Jago Douma 8e8fe6b8eb
Fix tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-11-29 14:23:15 +01:00
Arthur Schiwon 96bc03a03a
don't create sorter instances when none was requested
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-11-28 13:30:51 +01:00
Mario Danic c2cd5fc5d3 Fix flow
Signed-off-by: Mario Danic <mario@lovelyhq.com>
2017-11-09 00:29:34 +01:00
Julius Härtl cd1bfea8c4
Theming: theme flow redirection page
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2017-11-08 14:56:32 +01:00
Arthur Schiwon e2805f02aa
Merge branch 'master' into autocomplete-gui 2017-11-01 15:37:29 +01:00
Arthur Schiwon 25aad121e6
meanwhile we can have exact matches. also show those.
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-10-31 14:58:48 +01:00
Arthur Schiwon fa2f03979b
add search parameter to autocomplete controller
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-10-25 17:26:50 +02:00
Morris Jobke 43e498844e
Use ::class in test mocks
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-10-24 17:45:32 +02:00
Arthur Schiwon fd6daf8d19
AutoCompletion backend
* introduce a Controller for requests
* introduce result sorting mechanism
* extend Comments to retrieve commentors (actors) in a tree
* add commenters sorter
* add share recipients sorter

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-10-22 14:13:32 +02:00
Joas Schilling 3119fd41ce
Set the data from the template
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-10-18 15:12:03 +02:00
Morris Jobke 444779ce96
Fix tests
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-09-06 16:38:24 +02:00
Morris Jobke 0326c2c54f
Fix broken tests
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-09-04 14:17:03 +02:00
Joas Schilling 0aff1c9268
Return the user id in case of an error
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-08-29 11:10:30 +02:00
Morris Jobke 0b652648cc Merge pull request #6177 from nextcloud/properly-add-slo-url
Properly allow \OCP\Authentication\IApacheBackend to specify logout URL
2017-08-26 18:50:52 +02:00
Joas Schilling d5c6d56170
No password reset for disabled users
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-08-18 13:21:53 +02:00
Lukas Reschke a04feff9a7
Properly allow \OCP\Authentication\IApacheBackend to specify logout URL
Any `\OCP\Authentication\IApacheBackend` previously had to implement `getLogoutAttribute` which returns a string.
This string is directly injected into the logout `<a>` tag, so returning something like `href="foo"` would result
in `<a href="foo">`.

This is rather error prone and also in Nextcloud 12 broken as the logout entry has been moved with
054e161eb5 inside the navigation manager where one cannot simply inject attributes.

Thus this feature is broken in Nextcloud 12 which effectively leads to the bug described at nextcloud/user_saml#112,
people cannot logout anymore when using SAML using SLO. Basically in case of SAML you have a SLO url which redirects
you to the IdP and properly logs you out there as well.

Instead of monkey patching the Navigation manager I decided to instead change `\OCP\Authentication\IApacheBackend` to
use `\OCP\Authentication\IApacheBackend::getLogoutUrl` instead where it can return a string with the appropriate logout
URL. Since this functionality is only prominently used in the SAML plugin. Any custom app would need a small change but
I'm not aware of any and there's simply no way to fix this properly otherwise.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-08-18 12:22:44 +02:00
Roeland Jago Douma ba7cf03daf
Fix LostControllerTest
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-08-09 15:51:13 +02:00
Roeland Jago Douma 3bd104ef7c
Fix LoginController
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-08-09 15:12:02 +02:00
Morris Jobke 84c22fdeef Merge pull request #5907 from nextcloud/add-metadata-to-throttle-call
Add metadata to \OCP\AppFramework\Http\Response::throttle
2017-08-01 14:43:47 +02:00
Morris Jobke 6010c4f267 Merge pull request #5877 from nextcloud/typehint_middleware
Prop argument type for Middleware
2017-08-01 14:28:16 +02:00
Roeland Jago Douma 2fae696d35
Fix tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-08-01 08:20:17 +02:00
Lukas Reschke c25e782dd6
Fix settings/Controller/
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-08-01 08:20:15 +02:00
Roeland Jago Douma f71dc7523f
Fix tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-07-31 16:54:19 +02:00
Lukas Reschke f22ab3e665
Add metadata to \OCP\AppFramework\Http\Response::throttle
Fixes https://github.com/nextcloud/server/issues/5891

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-07-27 14:17:45 +02:00
Morris Jobke 0de90cfc67 Fix 403 and 404 redirect
* Nextcloud is not properly loaded in the standalone version (especially the theming)
* it is already not listed anymore in the Nginx config (see nextcloud/documentation#392)
* the index.php-free version doesn't support this

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-07-26 16:30:09 +02:00
Roeland Jago Douma 86a496d94a Merge pull request #5567 from nextcloud/public-capabilities
Public capabilities API
2017-07-12 13:04:54 +02:00
Morris Jobke efa52ec111 Merge pull request #5441 from nextcloud/custom-theme-update
Add command to apply updates to custom themes
2017-07-05 12:44:43 +02:00
Julius Härtl 2e47210d6f Add command to apply updates to custom themes
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2017-07-05 12:38:07 +02:00
Julius Härtl 01093604d3
Add tests for public capabilties
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2017-06-30 11:21:15 +02:00
Lukas Reschke 2f87fb6b45
Add Clear-Site-Data header
This adds a Clear-Site-Data header to the logout response which will delete all relevant data in the caches which may contain potentially sensitive content.

See https://w3c.github.io/webappsec-clear-site-data/#header for the definition of the types.

Ref https://twitter.com/mikewest/status/877149667909406723

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-06-20 19:46:10 +02:00
Lukas Reschke 26ee889fec
Add tests for ClientFlowLoginController
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-05-18 20:49:08 +02:00
Joas Schilling 0828df5ed4
Disable the API endpoints as well
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-05-11 17:03:57 +02:00
Joas Schilling d418ea550b
Automatic injection for CssController
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-05-10 09:42:40 +02:00
Joas Schilling 9c8fe82000
Automatic injection for JsController
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-05-10 09:42:15 +02:00
Mario Danic e4aac15a92
Update login flow redirection
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-05-04 19:21:22 +02:00
Georg Ehrke 60f9ed6241
add contactsmenu popover
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
2017-04-26 09:26:53 +02:00
Jan-Christoph Borchardt 241e397326 Merge branch 'master' into contactsmenu
Signed-off-by: Jan-Christoph Borchardt <hey@jancborchardt.net>
2017-04-26 00:50:38 +02:00
Christoph Wurst 36cee1f386 Let apps register contact menu provider via info.xml
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-04-25 20:47:17 +02:00
Christoph Wurst d091793ceb Contacts menu
* load list of contacts from the server
* show last message of each contact

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-04-25 20:47:17 +02:00
Roeland Jago Douma aae079aa29
AppToken to 72 chars
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-04-25 20:18:49 +02:00
Lukas Reschke 6a16df7288
Add new auth flow
This implements the basics for the new app-password based authentication flow for our clients.
The current implementation tries to keep it as simple as possible and works the following way:

1. Unauthenticated client opens `/index.php/login/flow`
2. User will be asked whether they want to grant access to the client
3. If accepted the user has the chance to do so using existing App Token or automatically generate an app password.

If the user chooses to use an existing app token then that one will simply be redirected to the `nc://` protocol handler.
While we can improve on that in the future, I think keeping this smaller at the moment has its advantages. Also, in the
near future we have to think about an automatic migration endpoint so there's that anyways :-)

If the user chooses to use the regular login the following happens:

1. A session state token is written to the session
2. User is redirected to the login page
3. If successfully authenticated they will be redirected to a page redirecting to the POST controller
4. The POST controller will check if the CSRF token as well as the state token is correct, if yes the user will be redirected to the `nc://` protocol handler.

This approach is quite simple but also allows to be extended in the future. One could for example allow external websites to consume this authentication endpoint as well.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-04-25 20:18:49 +02:00
Christoph Wurst bb1d191f82
Fix remember redirect_url on failed login attempts
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-04-25 09:38:19 +02:00
Morris Jobke 16c4755e03
Rename renderHTML to renderHtml
* fixes #4383
* improves consistency

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-04-19 15:46:41 -05:00
Roeland Jago Douma ad24b86013 Merge pull request #4350 from nextcloud/adjust-old-bruteforce-protection-annotations
Adjust existing bruteforce protection code
2017-04-19 09:27:23 +02:00
Lukas Reschke 805419bb95
Add bruteforce protection to changePersonalPassword
While the risk is actually quite low because one would already have the user session and could potentially do other havoc it makes sense to throttle here in case of invalid previous password attempts.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-04-18 17:55:51 +02:00
Lukas Reschke 727688ebd9
Adjust existing bruteforce protection code
- Moves code to annotation
- Adds the `throttle()` call on the responses on existing annotations

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-04-14 13:42:40 +02:00
Lukas Reschke 8149945a91
Make BruteForceProtection annotation more clever
This makes the new `@BruteForceProtection` annotation more clever and moves the relevant code into it's own middleware.

Basically you can now set `@BruteForceProtection(action=$key)` as annotation and that will make the controller bruteforce protected. However, the difference to before is that you need to call `$responmse->throttle()` to increase the counter. Before the counter was increased every time which leads to all kind of unexpected problems.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-04-13 23:05:33 +02:00
Lukas Reschke 81d3732bf5 Merge pull request #4308 from nextcloud/lost-password-email
Update email template for lost password email
2017-04-13 20:02:15 +02:00
Morris Jobke d36751ee38 Merge pull request #2424 from nextcloud/fix-login-controller-test-consolidate-login
Fix login controller test and consolidate login
2017-04-13 12:16:38 -05:00
Morris Jobke 7cb6038fca Merge pull request #3043 from nextcloud/issue-3038-no-logentry-on-email-login
Dont create a log entry on email login
2017-04-13 01:04:11 -05:00
Morris Jobke 1f962f9115
Update email template for lost password email
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-04-12 15:19:53 -05:00
Morris Jobke 5b4adf66e5
Move OC_Defaults to OCP\Defaults
* currently there are two ways to access default values:
  OCP\Defaults or OC_Defaults (which is extended by
  OCA\Theming\ThemingDefaults)
* our code used a mixture of both of them, which made
  it hard to work on theme values
* this extended the public interface with the missing
  methods and uses them everywhere to only rely on the
  public interface

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-04-09 21:43:01 -05:00
Joas Schilling 7ad791efb4
Dont create a log entry on email login
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-04-07 10:15:20 +02:00
Arthur Schiwon 7b3fdfeeaa
do login routine only once when done via LoginController
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-04-06 15:22:42 +02:00
Arthur Schiwon 2994cbc586
fix login controller tests
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-04-06 15:20:17 +02:00
Roeland Jago Douma 6bdd3a167d Merge pull request #4123 from nextcloud/allow-password-reset-with-email
Allow to reset the password with the email as an input
2017-04-05 09:12:41 +02:00
Morris Jobke 9813023aab
Fix gzip files for Safari
* Safari support gzip only if the filename does not
  end on .gz - so this renames them to .gzip

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-03-29 00:11:51 -06:00
Roeland Jago Douma 3a0ef65f33
Fix controller tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-03-28 23:42:20 +02:00
Joas Schilling 4bae7ef96d
Allow to reset the password with the email as an input
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-03-28 21:17:37 +02:00
Roeland Jago Douma 677e11b1a4
Tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-03-24 11:31:48 +01:00
Morris Jobke 9533f4e5ed
Clean up single user mode
Single user mode basically disables WebDAV, OCS and cron execution. Since
we heavily rely on WebDAV and OCS also in the web UI it's basically useless.
An admin only sees a broken interface and can't even change any settings nor
sees any files. Also sharing is not possible.

As this is at least the case since Nextcloud 9 and we haven't received any
reports for this it seems that this feature is not used at all so I removed it.

The encryption commands now rely on the well tested maintenance mode.

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-02-22 23:02:31 -06:00
Christoph Wurst 5e728d0eda oc_token should be nc_token
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-02-02 21:56:44 +01:00
Morris Jobke 5bad417e57 Merge pull request #2044 from nextcloud/login-credential-store
Login credential store
2017-01-30 19:30:04 -06:00
Bjoern Schiessle 5086335643
unify endpoints form core and the the provisioning api
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2017-01-25 11:20:35 +01:00
Christoph Wurst 012708e1ba Merge pull request #3023 from nextcloud/issue-2915-filter-out-sensitive-appconfigs
Filter out sensitive appconfig values
2017-01-17 11:01:42 +01:00
Morris Jobke 622101f2dd Merge pull request #2918 from nextcloud/encryption-recovery-improvements
create new encryption keys on password reset and backup the old one
2017-01-13 11:28:43 +01:00
Joas Schilling 5dc6899d1a
Fix tests
Signed-off-by: Joas Schilling <coding@schilljs.com>
2017-01-12 10:49:22 +01:00
Christoph Wurst 140555b786
always allow remembered login
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-01-11 19:20:11 +01:00
Christoph Wurst 243c9c0941
fix coding style and increase code coverage
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2017-01-11 11:01:54 +01:00
Cornelius Kölbel b8d41752ca
Fix tests
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-01-11 11:01:54 +01:00
Bjoern Schiessle fcda3a20f4
create new encryption keys on password reset and backup the old one
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2017-01-10 17:04:32 +01:00
Roeland Jago Douma 350b7ebc86
Adds CssControllerTests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-01-06 09:42:39 +01:00
Roeland Jago Douma 15efd3b38d Merge pull request #2892 from nextcloud/usercontroller_tests
Adds user controller tests
2016-12-30 14:58:52 +01:00
Roeland Jago Douma 31a3e9847f
Adds user controller tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-12-30 13:26:26 +01:00
Roeland Jago Douma b5a23c9754
User command enable/disable tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-12-30 13:17:41 +01:00
Roeland Jago Douma a7d9b7c876
Add Group Command tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-12-29 11:48:57 +01:00
Christoph Wurst eff904473d
Set redirect_url on 2FA challenge page
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2016-12-23 20:53:26 +01:00
Morris Jobke 998f235474 Merge pull request #2563 from nextcloud/fix-password-reset
fix password reset if encryption is enabled
2016-12-22 11:18:04 +01:00
Roeland Jago Douma 09caadac05
Add tests for 2FA commands
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-12-20 16:36:58 +01:00
Bjoern Schiessle 16bbd3fd7c
fix password reset if encryption is enabled
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2016-12-08 12:08:05 +01:00
Joas Schilling 924358ef96
Save the timezone on login again
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-12-08 10:45:24 +01:00
Lukas Reschke 8bf4111368
Fix changing display names for subadmins
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2016-11-21 11:30:00 +01:00
Roeland Jago Douma 74c68d8761
Add OCSControllerTests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-16 19:49:51 +01:00
Morris Jobke ac61f64190 Merge pull request #1109 from nextcloud/add-more-secrets-to-password-reset-link
Use mail for encrypting the password reset token as well
2016-11-03 22:11:43 +01:00
Roeland Jago Douma dca9184a12
Fix tests
* Tests fixed and controller coverage to 100%

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-03 19:08:56 +01:00
Lukas Reschke 6d686c213b
[WIP] Use mail for encrypting the password reset token as well 2016-11-03 14:27:26 +01:00
Roeland Jago Douma 9e6b26dcd0
Add cache 1 day cache to preview endpoint
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-03 14:00:33 +01:00
Roeland Jago Douma 55af6b45f7
More tests
* PreviewController test
* PublicPreview test
* Versions Preview test
* Trash Preview test

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2016-11-03 14:00:33 +01:00
Christoph Wurst d907666232
bring back remember-me
* try to reuse the old session token for remember me login
* decrypt/encrypt token password and set the session id accordingly
* create remember-me cookies only if checkbox is checked and 2fa solved
* adjust db token cleanup to store remembered tokens longer
* adjust unit tests

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2016-11-02 13:39:16 +01:00
Joas Schilling 656e3f7a24
Check the mimetype before reading the content and catch exception
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-10-18 16:22:20 +02:00
Joas Schilling a0b34dfd2f Merge pull request #1629 from nextcloud/cleanup-settings-application
Cleanup settings Application class
2016-10-06 16:57:39 +02:00
Joas Schilling ed30b1f645
Use our base class everywhere
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-10-06 14:11:04 +02:00
Morris Jobke c84dc6aa1c Properly catch password policy hint for personal page password changes
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2016-10-06 10:55:33 +02:00
Joas Schilling a1e4b17ff4
Remove unused endpoint
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-09-30 10:21:08 +02:00
Joas Schilling 877cb06bfe
Use magic DI for core controllers
Signed-off-by: Joas Schilling <coding@schilljs.com>
2016-09-30 10:00:26 +02:00
Roeland Jago Douma 8a5af2d335
Fix tests
* hasParameterOption has an additional default value which we must match
  in the return map
* Fix deprecated getMock calls
2016-09-06 21:20:01 +02:00
Roeland Jago Douma 3a3a17b2e3
Fix getMock TwoFactorMiddlewareTest 2016-09-06 09:29:27 +02:00
Lukas Reschke 06fa486706 Merge pull request #1158 from nextcloud/cache_avatars
Cache avatars
2016-09-05 15:08:43 +02:00
Christoph Wurst 8acb734854
add 2fa backup codes app
* add backup codes app unit tests
* add integration tests for the backup codes app
2016-09-05 08:51:13 +02:00
Roeland Jago Douma 74fdaab870
Fix depreccated getMock in Core/Command tests 2016-09-01 09:20:54 +02:00
Christoph Wurst 8e5c4c91fa check same URL in unit tests 2016-08-30 13:28:04 +02:00
Christoph Wurst 0a0c7a9b92 redirect to default app after solving the 2FA challenge 2016-08-30 11:10:45 +02:00
Roeland Jago Douma 6a85882f61
Fix tests 2016-08-30 09:00:22 +02:00
Morris Jobke e341bde8b9 Merge pull request #1172 from nextcloud/core_cleanup
Core controller cleanup
2016-08-30 08:32:55 +02:00
Roeland Jago Douma b1a090f357
AvatarController use proper JSONResponse
* Do not rely on DataResponse magic. We want JSON so use JSON
* Fix tests
2016-08-29 21:52:14 +02:00
Roeland Jago Douma f6423f74e3
Minor cleanup in core Controllers 2016-08-29 21:52:09 +02:00
Christoph Wurst 291dd0bd31 redirect to 2fa provider if there's only one active for the user 2016-08-29 18:36:39 +02:00
Lukas Reschke 8bf9be2167 Merge pull request #1058 from nextcloud/avatarController_cleanup
Avatar controller cleanup
2016-08-27 22:25:34 +02:00