upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-03-22 10:30:49 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 7
65433 commits 775 branches 1188 tags 6.5 GiB
Commit graph

56 commits

Author SHA1 Message Date
Christoph Wurst
138deec333
chore: Make the LoginController strict 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2022-12-15 10:52:28 +01:00
Joas Schilling
67ecd72972
Fix unit tests 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2022-08-31 20:54:39 +02:00
Arthur Schiwon
b3b6f2d581
fix Controller tests 
- added pageTitle in code was missing in expectations
- fixed warnings of superflouos parameter
- fixed wrong type of mock

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2022-07-22 22:15:41 +02:00
Carl Schwan
b70c6a128f Update core to PHP 7.4 standard 
- Typed properties
- Port to LoggerInterface

Signed-off-by: Carl Schwan <carl@carlschwan.eu>
 2022-05-20 22:18:06 +02:00
Vitor Mattos
d613b32045
add check isFairUseOfFreePushService on login 
Signed-off-by: Vitor Mattos <vitor@php.rio>
 2021-10-23 00:54:50 +02:00
Daniel Rudolf
e478db9161
Deprecate RedirectToDefaultAppResponse 
Signed-off-by: Daniel Rudolf <github.com@daniel-rudolf.de>
 2021-07-01 15:13:08 +02:00
Daniel Rudolf
12059eb65b
Add IUrlGenerator::linkToDefaultPageUrl() 
Replaces the deprecated \OC_Util::getDefaultPageUrl() and makes this API public.

Signed-off-by: Daniel Rudolf <github.com@daniel-rudolf.de>
 2021-06-30 16:20:57 +02:00
Vincent Petry
95e03fba2d
Fix more controller tests in Core subdir 
Signed-off-by: Vincent Petry <vincent@nextcloud.com>
 2021-03-24 09:02:19 +01:00
John Molakvoæ (skjnldsv)
6c49dc2d1f
Fix absolute redirect 
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
 2020-04-10 08:58:54 +02:00
Christoph Wurst
afbd9c4e6e
Unify function spacing to PSR2 recommendation 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2020-04-09 13:54:22 +02:00
Christoph Wurst
2fbad1ed72
Fix (array) indent style to always use one tab 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2020-04-09 10:16:08 +02:00
Roeland Jago Douma
53db05a1f6
Start with webauthn 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Signed-off-by: npmbuildbot[bot] <npmbuildbot[bot]@users.noreply.github.com>
 2020-03-31 22:17:07 +02:00
Christoph Wurst
2ee65f177e
Use the shorter phpunit syntax for mocked return values 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2020-03-25 22:21:27 +01:00
Daniel Kesselberg
9378a6b411
Send Clear-Site-Data expect for Chrome 
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
 2019-11-30 15:17:22 +01:00
Roeland Jago Douma
3a7cf40aaa
Mode to modern phpunit 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-11-27 15:27:18 +01:00
Roeland Jago Douma
c007ca624f
Make phpunit8 compatible 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-11-27 13:34:41 +01:00
Daniel Kesselberg
6235a66aac
Don't send executionContexts for Clear-Site-Data 
There are plans to remove executionContexts from the spec: https://github.com/w3c/webappsec-clear-site-data/issues/59

Firefox already removed it https://bugzilla.mozilla.org/show_bug.cgi?id=1548034

Chromium implementation is not finish: https://bugs.chromium.org/p/chromium/issues/detail?id=898503&q=clear-site-data&sort=-modified&colspec=ID%20Pri%20M%20Stars%20ReleaseBlock%20Component%20Status%20Owner%20Summary%20OS%20Modified

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
 2019-07-09 15:08:25 +02:00
Christoph Wurst
64c4bb5bce
Vueify the login page 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2019-05-29 11:05:16 +02:00
Christoph Wurst
170582d4f5
Add a login chain to reduce the complexity of LoginController::tryLogin 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2019-05-07 18:04:36 +02:00
Roeland Jago Douma
e6333c8fe3
Honor remember_login_cookie_lifetime 
If the remember_login_cookie_lifetime is set to 0 this means we do not
want to use remember me at all. In that case we should also not creatae
a remember me cookie and should create a proper temp token.

Further this specifies that is not 0 the remember me time should always
be larger than the session timeout. Because else the behavior is not
really defined.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2019-01-23 08:46:24 +01:00
Rayn0r
82c2c10b25 adapted automated test for autocomplete changes 
Signed-off-by: Rayn0r <Andre.Weidemann@web.de>
 2018-10-30 11:36:16 +01:00
Patrick Conrad
1806baaeaf
Remove cookies from Clear-Site-Data Header 
In 2f87fb6b45 this header was introduced. The referenced documentation says:

> When delivered with a response from https://example.com/clear, the following header will cause cookies associated with the origin https://example.com to be cleared, as well as cookies on any origin in the same registered domain (e.g. https://www.example.com/ and https://more.subdomains.example.com/).

This also applies if `https://nextcloud.example.com/` sends the `Clear-Site-Data: "cookies"` header.
This is not the behavior we want at this point!

So I removed the deletion of cookies from the header. This has no effect on the logout process as this header is supported only recently and the logout works in old browsers as well.

Signed-off-by: Patrick Conrad <conrad@iza.org>
 2018-10-15 14:46:06 +02:00
Christoph Wurst
c6e47e8a51
Fix login redirection if only one 2FA provider is active 
Fixes https://github.com/nextcloud/server/issues/10500.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2018-08-08 15:25:59 +02:00
Michael Weimann
de7606dc68 Adds disabled user unit tests 
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
 2018-07-21 13:05:25 +02:00
Christoph Wurst
13d93f5b25
Make 2FA providers stateful 
This adds persistence to the Nextcloud server 2FA logic so that the server
knows which 2FA providers are enabled for a specific user at any time, even
when the provider is not available.

The `IStatefulProvider` interface was added as tagging interface for providers
that are compatible with this new API.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2018-06-20 08:30:26 +02:00
Roeland Jago Douma
2b7d4d5069
Fix tests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-04-06 19:58:37 +02:00
Roeland Jago Douma
b1d8084700
Fix tests 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2018-01-15 21:43:11 +01:00
Julius Härtl
f5f6ed664d
Hide stay logged in checkbox when flow authentication is used 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
 2017-12-28 11:15:26 +01:00
Morris Jobke
0326c2c54f
Fix broken tests 
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
 2017-09-04 14:17:03 +02:00
Roeland Jago Douma
3bd104ef7c
Fix LoginController 
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
 2017-08-09 15:12:02 +02:00
Lukas Reschke
f22ab3e665
Add metadata to \OCP\AppFramework\Http\Response::throttle 
Fixes https://github.com/nextcloud/server/issues/5891

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-07-27 14:17:45 +02:00
Lukas Reschke
2f87fb6b45
Add Clear-Site-Data header 
This adds a Clear-Site-Data header to the logout response which will delete all relevant data in the caches which may contain potentially sensitive content.

See https://w3c.github.io/webappsec-clear-site-data/#header for the definition of the types.

Ref https://twitter.com/mikewest/status/877149667909406723

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-06-20 19:46:10 +02:00
Christoph Wurst
bb1d191f82
Fix remember redirect_url on failed login attempts 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-04-25 09:38:19 +02:00
Lukas Reschke
8149945a91
Make BruteForceProtection annotation more clever 
This makes the new `@BruteForceProtection` annotation more clever and moves the relevant code into it's own middleware.

Basically you can now set `@BruteForceProtection(action=$key)` as annotation and that will make the controller bruteforce protected. However, the difference to before is that you need to call `$responmse->throttle()` to increase the counter. Before the counter was increased every time which leads to all kind of unexpected problems.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
 2017-04-13 23:05:33 +02:00
Morris Jobke
d36751ee38 Merge pull request #2424 from nextcloud/fix-login-controller-test-consolidate-login 
Fix login controller test and consolidate login
 2017-04-13 12:16:38 -05:00
Joas Schilling
7ad791efb4
Dont create a log entry on email login 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2017-04-07 10:15:20 +02:00
Arthur Schiwon
7b3fdfeeaa
do login routine only once when done via LoginController 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2017-04-06 15:22:42 +02:00
Arthur Schiwon
2994cbc586
fix login controller tests 
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
 2017-04-06 15:20:17 +02:00
Christoph Wurst
5e728d0eda oc_token should be nc_token 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-02-02 21:56:44 +01:00
Christoph Wurst
140555b786
always allow remembered login 
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2017-01-11 19:20:11 +01:00
Joas Schilling
924358ef96
Save the timezone on login again 
Signed-off-by: Joas Schilling <coding@schilljs.com>
 2016-12-08 10:45:24 +01:00
Christoph Wurst
d907666232
bring back remember-me 
* try to reuse the old session token for remember me login
* decrypt/encrypt token password and set the session id accordingly
* create remember-me cookies only if checkbox is checked and 2fa solved
* adjust db token cleanup to store remembered tokens longer
* adjust unit tests

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
 2016-11-02 13:39:16 +01:00
Christoph Wurst
291dd0bd31 redirect to 2fa provider if there's only one active for the user 2016-08-29 18:36:39 +02:00
Joas Schilling
736e884e9a
Move the reset token to core app 2016-08-23 15:01:38 +02:00
Joas Schilling
139fb8de94
Remove "password reset token" after successful login 2016-08-23 12:54:45 +02:00
Lukas Reschke
cf3cfca356
Use generated URL 2016-08-15 17:37:55 +02:00
Lukas Reschke
75d135d8d4
Fix tests for LoginController 2016-08-15 17:19:32 +02:00
Lukas Reschke
65d1472005
Don't use create mock 
Not compatible with this PHPunit version
 2016-08-15 17:08:27 +02:00
Lukas Reschke
72b5f9bfac
Use createMock instead of deprecated getMock 2016-08-11 15:22:29 +02:00
Lukas Reschke
9ca25e857c
Redirect users when already logged-in on login form 2016-08-11 15:22:29 +02:00