Commit Graph

373 Commits

Author SHA1 Message Date
Roeland Jago Douma da81b71f93
Only allow requesting new CSRF tokens if it passes the SameSite Cookie test
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2020-01-03 13:12:03 +01:00
Christoph Wurst 1b46621cd3
Update license headers for 18
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2019-12-20 09:23:25 +01:00
Roeland Jago Douma 87104ce510
Merge pull request #17784 from nextcloud/enh/disable-clear-site-data-via-config
Disable Clear-Site-Data for Chrom* (and Opera, Brave, etc)
2019-12-12 21:59:42 +01:00
Christoph Wurst 302558cfd2
Add a dedicated page for the recommended apps installation
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
Signed-off-by: npmbuildbot[bot] <npmbuildbot[bot]@users.noreply.github.com>
2019-12-12 08:13:01 +01:00
Christoph Wurst 5bf3d1bb38
Update license headers
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2019-12-05 15:38:45 +01:00
Christoph Wurst a8f2e6914d
Add checkbox to install recommended apps during setup
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
Signed-off-by: npmbuildbot[bot] <npmbuildbot[bot]@users.noreply.github.com>
2019-12-04 14:14:38 +01:00
Joas Schilling 738e6bf079
Merge pull request #17715 from nextcloud/fix/5456/respect_avatar_privacy
Honor avatar visibility settings
2019-12-04 10:28:45 +01:00
Daniel Kesselberg 9378a6b411
Send Clear-Site-Data expect for Chrome
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2019-11-30 15:17:22 +01:00
Christoph Wurst 81e35d0c8a
Trim the login name
Otherwise we keep on using it with leading or trailing whitespaces for
app tokens and other logic. The reason this doesn't throw an error
immediately with local users is that (My)SQL compares strings regardless
of their padding by default. So we look up 'uid ' and get the row for
the user 'uid'.
Other back-ends will lead to a hard error, though, and the user is
unable to log out as all request fail.

Ref https://stackoverflow.com/a/10495807/2239067

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2019-11-28 20:52:05 +01:00
Joas Schilling 06f97c0fd0
Fix autocomplete suggestions with numeric user ids
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-11-26 09:19:49 +01:00
Roeland Jago Douma c7d5b8fc49
Merge pull request #18079 from nextcloud/fixes/phpcs
Some php-cs fixes
2019-11-25 14:07:00 +01:00
Daniel Kesselberg 957c0df01b
Remove exception for settings app from svg controller
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2019-11-24 17:15:06 +01:00
Roeland Jago Douma 68748d4f85
Some php-cs fixes
* Order the imports
* No leading slash on imports
* Empty line before namespace
* One line per import
* Empty after imports
* Emmpty line at bottom of file

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-11-22 20:52:10 +01:00
Roeland Jago Douma 54eb27dab2
Update tests
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-11-13 20:43:20 +01:00
RussellAult 19791b2460
Check getRedirectUri() for queries
Resolves Issue #17885

Check getRedirectUri() for queries, and add a '&' instead of a '?' to $redirectUri if it already has them; otherwise, $redirectUri might end up with two '?'.

Signed-off-by: RussellAult <russellault@users.noreply.github.com>
2019-11-13 14:05:03 +01:00
Roeland Jago Douma 0bd1378f81
Honor avatar visibility settings
Fixes #5456
Only when an avatar is set to public should we show it to the public.
For now this has an open question as to how to solve federated avatars.
But I assume a dedicated paramter or endpooint would make sense there.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-10-28 13:48:34 +01:00
Roeland Jago Douma 2cf068463f
Harden middleware check
These annotations will allow for extra checks. And thus make it harder
to break things.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-10-25 15:44:37 +02:00
Sergej Nikolaev 1b5d85a4ca fix oauth client redirect
Signed-off-by: Sergej Nikolaev <kinolaev@gmail.com>
2019-10-04 21:09:13 +03:00
Roeland Jago Douma cd1f443804
Allow rotation of apppasswords
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-08-27 13:46:06 +02:00
Daniel Kesselberg e32b2c4b76
Stop if there is no encrypted token
Fix Argument 1 passed to OC\Security\Crypto::decrypt() must be of the type string, null given

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2019-08-18 19:58:50 +02:00
Roeland Jago Douma 6dc179ee12
Fix login flow form actions
So fun fact. Chrome considers a redirect after submitting a form part of
the form actions. Since we redirect to a new protocol (nc://login/).
Causing the form submission to work but the redirect failing hard.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-08-11 19:53:49 +02:00
Roeland Jago Douma 436f7b92d5
Merge pull request #16544 from nextcloud/bugfix/16540
Add missing password reset page to vue
2019-07-31 11:02:20 +02:00
Julius Härtl 3b0d13944a
Move actual password reset to vue
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2019-07-31 09:19:07 +02:00
Morris Jobke ec7e837d6a
Merge pull request #16563 from nextcloud/enh/lostcontroller/better_exceptions
Use proper exception in lostController
2019-07-29 10:42:36 +02:00
Roeland Jago Douma b6dd2ebd39
Use proper exception in lostController
There is no need to log the expcetion of most of the stuff here.
We should properly log them but an exception is excessive.

This moves it to a proper exception which we can catch and then log.
The other exceptions will still be fully logged.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-07-27 20:12:16 +02:00
Roeland Jago Douma a2a53848b0
Update PreviewController
The constructor is called with the userId. However if a user is not
logged in this is null. Which means that we get an exception instead of
this being handled gracefully in the middleware.

There are cleaner solutions. But this is the solution that is the
easiest to apply without lots of work and risk of breaking things
(handling the logged in middleware before initializing the controller
etc).

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-07-26 17:37:11 +02:00
Morris Jobke 5c21b29d7f
Merge pull request #16308 from nextcloud/fix/undefined-offset-0
Prevent undefined offset 0 in findByUserIdOrMail
2019-07-10 12:16:36 +02:00
Daniel Kesselberg d57540ac84
Return first value from $users
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2019-07-09 19:29:14 +02:00
Daniel Kesselberg 6235a66aac
Don't send executionContexts for Clear-Site-Data
There are plans to remove executionContexts from the spec: https://github.com/w3c/webappsec-clear-site-data/issues/59

Firefox already removed it https://bugzilla.mozilla.org/show_bug.cgi?id=1548034

Chromium implementation is not finish: https://bugs.chromium.org/p/chromium/issues/detail?id=898503&q=clear-site-data&sort=-modified&colspec=ID%20Pri%20M%20Stars%20ReleaseBlock%20Component%20Status%20Owner%20Summary%20OS%20Modified

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2019-07-09 15:08:25 +02:00
Joas Schilling 05381f00d2
Fall back to black for non-color values
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-06-20 15:23:06 +02:00
Julius Härtl df072471a7
Add extendedSupport to Subscription
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2019-06-17 16:36:23 +02:00
Christoph Wurst 64c4bb5bce
Vueify the login page
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2019-05-29 11:05:16 +02:00
Roeland Jago Douma f03eb7ec3c
Remote wipe support
This allows a user to mark a token for remote wipe.
Clients that support this can then wipe the device properly.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2019-05-20 20:50:27 +02:00
Roeland Jago Douma 528eb1b223
Merge pull request #15304 from nextcloud/enh/2fa_setup_at_login
2FA setup during login
2019-05-17 11:04:42 +02:00
Roeland Jago Douma 579162d7b9
Allow 2FA to be setup on first login
Once 2FA is enforced for a user and they have no 2FA setup yet this will
now prompt them with a setup screen. Given that providers are enabled
that allow setup then.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2019-05-17 10:11:53 +02:00
Roeland Jago Douma 2dcb4cfbd6
Allow clients to delete their own apptoken
Fixes #15480

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-05-17 09:52:06 +02:00
Christoph Wurst 170582d4f5
Add a login chain to reduce the complexity of LoginController::tryLogin
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2019-05-07 18:04:36 +02:00
Roeland Jago Douma 7e7146db7f
Block install without CAN_INSTALL file
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-04-11 09:32:33 +02:00
Joas Schilling c5560117da
Make the endpoint more robust against faulty resource providers
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-28 09:26:38 +01:00
Joas Schilling 21425eb964
Return 200 instead of 404 when asking for collections of a resource
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-19 13:13:53 +01:00
Joas Schilling 3022ef687a
Use rich objects instead of name, link and icon
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-19 13:06:55 +01:00
Joas Schilling 403b673b93
Replace the icon-class with an absolute link to an image
Otherwise the icon can not be displayed in mobile apps

Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-19 13:06:55 +01:00
Joas Schilling eecd9323c5
Also check the access to collections on preparing
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-01 20:56:58 +01:00
Joas Schilling 59c92a7513
Further work on the access cache
Searching for all is still a problem

Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-01 20:56:19 +01:00
Joas Schilling dee6f7f61f
Fix doc blocks
Signed-off-by: Joas Schilling <coding@schilljs.com>
2019-03-01 20:56:18 +01:00
Julius Härtl e404ce7096
Implement search and rename in backend
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2019-03-01 20:56:18 +01:00
Julius Härtl 53ac9bdda1
Implement frontend for search/rename
Signed-off-by: Julius Härtl <jus@bitgrid.net>

Move to vuex

Signed-off-by: Julius Härtl <jus@bitgrid.net>
2019-03-01 20:56:18 +01:00
Julius Härtl 88aa3de784
Add iconClass to resources
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2019-03-01 20:56:17 +01:00
Julius Härtl 555afff015
Make sure we query the node before fetching the name
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2019-03-01 20:56:17 +01:00
Julius Härtl a72a6d73a3
Adjust parameter names on createCollectionOnResource
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2019-03-01 20:56:16 +01:00