nextcloud-server

Commit Graph

Author	SHA1	Message	Date
Morris Jobke	bcf1668cc8	Remove config from AutoCompleteController Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Julius Härtl	5a23b35ddb	Also rewrite icon url Signed-off-by: Julius Härtl <jus@bitgrid.net>	8 years ago
Julius Härtl	922cf44c81	Move to OCS endpoint Signed-off-by: Julius Härtl <jus@bitgrid.net>	8 years ago
Julius Härtl	8ecac56543	Allow requesting absolute URLs They might be useful when requesting the navigation from the clients Signed-off-by: Julius Härtl <jus@bitgrid.net>	8 years ago
Julius Härtl	6211d18dc1	Add tests for NavigationController Signed-off-by: Julius Härtl <jus@bitgrid.net>	8 years ago
Morris Jobke	4ef302c0be	Request->getHeader() should always return a string PHPDoc (of the public API) says that this method returns string but it also returns null, which is not allowed in some method calls. This fixes that behaviour and returns an empty string and fixes all code paths that explicitly checked for null to be still compliant. Found while enabling the strict_typing for lib/private for the PHP7+ migration. Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Roeland Jago Douma	b1d8084700	Fix tests Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Joas Schilling	7789fbdea6	Add unit test Signed-off-by: Joas Schilling <coding@schilljs.com>	8 years ago
Roeland Jago Douma	8d1dd1945f	Fix tests Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Julius Härtl	f5f6ed664d	Hide stay logged in checkbox when flow authentication is used Signed-off-by: Julius Härtl <jus@bitgrid.net>	8 years ago
Bjoern Schiessle	555fe7047f	fix tests Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>	8 years ago
Roeland Jago Douma	8e8fe6b8eb	Fix tests Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Arthur Schiwon	96bc03a03a	don't create sorter instances when none was requested Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	8 years ago
Mario Danic	c2cd5fc5d3	Fix flow Signed-off-by: Mario Danic <mario@lovelyhq.com>	8 years ago
Julius Härtl	cd1bfea8c4	Theming: theme flow redirection page Signed-off-by: Julius Härtl <jus@bitgrid.net>	8 years ago
Arthur Schiwon	25aad121e6	meanwhile we can have exact matches. also show those. Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	8 years ago
Arthur Schiwon	fa2f03979b	add search parameter to autocomplete controller Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	8 years ago
Morris Jobke	43e498844e	Use ::class in test mocks Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Arthur Schiwon	fd6daf8d19	AutoCompletion backend * introduce a Controller for requests * introduce result sorting mechanism * extend Comments to retrieve commentors (actors) in a tree * add commenters sorter * add share recipients sorter Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	8 years ago
Joas Schilling	3119fd41ce	Set the data from the template Signed-off-by: Joas Schilling <coding@schilljs.com>	8 years ago
Morris Jobke	444779ce96	Fix tests Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Morris Jobke	0326c2c54f	Fix broken tests Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Joas Schilling	0aff1c9268	Return the user id in case of an error Signed-off-by: Joas Schilling <coding@schilljs.com>	8 years ago
Joas Schilling	d5c6d56170	No password reset for disabled users Signed-off-by: Joas Schilling <coding@schilljs.com>	8 years ago
Lukas Reschke	a04feff9a7	Properly allow \OCP\Authentication\IApacheBackend to specify logout URL Any `\OCP\Authentication\IApacheBackend` previously had to implement `getLogoutAttribute` which returns a string. This string is directly injected into the logout `<a>` tag, so returning something like `href="foo"` would result in `<a href="foo">`. This is rather error prone and also in Nextcloud 12 broken as the logout entry has been moved with `054e161eb5` inside the navigation manager where one cannot simply inject attributes. Thus this feature is broken in Nextcloud 12 which effectively leads to the bug described at nextcloud/user_saml#112, people cannot logout anymore when using SAML using SLO. Basically in case of SAML you have a SLO url which redirects you to the IdP and properly logs you out there as well. Instead of monkey patching the Navigation manager I decided to instead change `\OCP\Authentication\IApacheBackend` to use `\OCP\Authentication\IApacheBackend::getLogoutUrl` instead where it can return a string with the appropriate logout URL. Since this functionality is only prominently used in the SAML plugin. Any custom app would need a small change but I'm not aware of any and there's simply no way to fix this properly otherwise. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	8 years ago
Roeland Jago Douma	ba7cf03daf	Fix LostControllerTest Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	3bd104ef7c	Fix LoginController Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	2fae696d35	Fix tests Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Lukas Reschke	c25e782dd6	Fix settings/Controller/ Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	f22ab3e665	Add metadata to \OCP\AppFramework\Http\Response::throttle Fixes https://github.com/nextcloud/server/issues/5891 Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Julius Härtl	01093604d3	Add tests for public capabilties Signed-off-by: Julius Härtl <jus@bitgrid.net>	9 years ago
Lukas Reschke	2f87fb6b45	Add Clear-Site-Data header This adds a Clear-Site-Data header to the logout response which will delete all relevant data in the caches which may contain potentially sensitive content. See https://w3c.github.io/webappsec-clear-site-data/#header for the definition of the types. Ref https://twitter.com/mikewest/status/877149667909406723 Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	26ee889fec	Add tests for ClientFlowLoginController Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Joas Schilling	0828df5ed4	Disable the API endpoints as well Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Joas Schilling	d418ea550b	Automatic injection for CssController Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Joas Schilling	9c8fe82000	Automatic injection for JsController Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Mario Danic	e4aac15a92	Update login flow redirection Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Georg Ehrke	60f9ed6241	add contactsmenu popover Signed-off-by: Georg Ehrke <developer@georgehrke.com>	9 years ago
Christoph Wurst	36cee1f386	Let apps register contact menu provider via info.xml Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	9 years ago
Christoph Wurst	d091793ceb	Contacts menu * load list of contacts from the server * show last message of each contact Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	9 years ago
Roeland Jago Douma	aae079aa29	AppToken to 72 chars Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Lukas Reschke	6a16df7288	Add new auth flow This implements the basics for the new app-password based authentication flow for our clients. The current implementation tries to keep it as simple as possible and works the following way: 1. Unauthenticated client opens `/index.php/login/flow` 2. User will be asked whether they want to grant access to the client 3. If accepted the user has the chance to do so using existing App Token or automatically generate an app password. If the user chooses to use an existing app token then that one will simply be redirected to the `nc://` protocol handler. While we can improve on that in the future, I think keeping this smaller at the moment has its advantages. Also, in the near future we have to think about an automatic migration endpoint so there's that anyways :-) If the user chooses to use the regular login the following happens: 1. A session state token is written to the session 2. User is redirected to the login page 3. If successfully authenticated they will be redirected to a page redirecting to the POST controller 4. The POST controller will check if the CSRF token as well as the state token is correct, if yes the user will be redirected to the `nc://` protocol handler. This approach is quite simple but also allows to be extended in the future. One could for example allow external websites to consume this authentication endpoint as well. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Christoph Wurst	bb1d191f82	Fix remember redirect_url on failed login attempts Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	9 years ago
Morris Jobke	16c4755e03	Rename renderHTML to renderHtml * fixes #4383 * improves consistency Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Lukas Reschke	805419bb95	Add bruteforce protection to changePersonalPassword While the risk is actually quite low because one would already have the user session and could potentially do other havoc it makes sense to throttle here in case of invalid previous password attempts. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	727688ebd9	Adjust existing bruteforce protection code - Moves code to annotation - Adds the `throttle()` call on the responses on existing annotations Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	8149945a91	Make BruteForceProtection annotation more clever This makes the new `@BruteForceProtection` annotation more clever and moves the relevant code into it's own middleware. Basically you can now set `@BruteForceProtection(action=$key)` as annotation and that will make the controller bruteforce protected. However, the difference to before is that you need to call `$responmse->throttle()` to increase the counter. Before the counter was increased every time which leads to all kind of unexpected problems. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Morris Jobke	1f962f9115	Update email template for lost password email Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Morris Jobke	5b4adf66e5	Move OC_Defaults to OCP\Defaults * currently there are two ways to access default values: OCP\Defaults or OC_Defaults (which is extended by OCA\Theming\ThemingDefaults) * our code used a mixture of both of them, which made it hard to work on theme values * this extended the public interface with the missing methods and uses them everywhere to only rely on the public interface Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Joas Schilling	7ad791efb4	Dont create a log entry on email login Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago

1 2 3

132 Commits (0ee45d3d20ce53db97b6835acb00a95e27ee072d)