69 Commits (3fede00732c48508c19dd0c6b7ac010b1c735749)

Author	SHA1	Message	Date
Ferdinand Thiessen	3fede00732	feat(login): Clear login form (password) after IDLE timeout ... For security reasons it is recommended to stop the login process at a defined time, this could prevent password leaks by e.g. user forgetting that they entered their password on public devices. Enforced e.g. by the BSI ORP.4.A13 rule. Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>	2 years ago
Eduardo Morales	685145714a	chore: update logincontroller tests ... Signed-off-by: Eduardo Morales <emoral435@gmail.com>	2 years ago
Joas Schilling	2ee5c7a8f9	fix(tests): Fix remaining tests ... Signed-off-by: Joas Schilling <coding@schilljs.com>	2 years ago
Louis Chemineau	db11313152	Fix tests after slow logout fix ... Signed-off-by: Louis Chemineau <louis@chmn.me>	2 years ago
Gaspard d'Hautefeuille	85911cbab2	Cancel PR #37405, remove regression code ... Signed-off-by: Gaspard d'Hautefeuille <github@dhautefeuille.eu>	2 years ago
Joas Schilling	aa5f037af7	chore: apply changes from Nextcloud coding standards 1.1.1 ... Signed-off-by: Joas Schilling <coding@schilljs.com> Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	3 years ago
Joas Schilling	25309bcb45	techdebt(DI): Use public IThrottler interface which exists since Nextcloud 25 ... Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Git'Fellow	346054f854	Fix tests ... Signed-off-by: Git'Fellow <12234510+solracsf@users.noreply.github.com>	3 years ago
Côme Chilliet	003cc2b45a	Fix tests failures (number of calls differed with last rebase) ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	3 years ago
Carl Schwan	a23cd7b961	Fix a bunch of deprecation in the phpunit for core ... Signed-off-by: Carl Schwan <carl@carlschwan.eu>	3 years ago
Côme Chilliet	f5c361cf44	composer run cs:fix ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	3 years ago
Christoph Wurst	20fcfb5739	feat(app framework)!: Inject services into controller methods ... Usually Nextcloud DI goes through constructor injection. This has the implication that each instance of a class builds the full DI tree. That is the injected services, their services, etc. Occasionally there is a service that is only needed for one controller method. Then the DI tree is build regardless if used or not. If services are injected into the method, we only build the DI tree if that method gets executed. This is also how Laravel allows injection. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Christoph Wurst	f22101d421	Fix login loop if login CSRF fails and user is not logged in ... If CSRF fails but the user is logged in that they probably logged in in another tab. This is fine. We can just redirect. If CSRF fails and the user is also not logged in then something is fishy. E.g. because Nextcloud contantly regenrates the session and the CSRF token and the user is stuck in an endless login loop. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Christoph Wurst	138deec333	chore: Make the LoginController strict ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	4 years ago
Joas Schilling	67ecd72972	Fix unit tests ... Signed-off-by: Joas Schilling <coding@schilljs.com>	4 years ago
Arthur Schiwon	b3b6f2d581	fix Controller tests ... - added pageTitle in code was missing in expectations - fixed warnings of superflouos parameter - fixed wrong type of mock Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	4 years ago
Carl Schwan	b70c6a128f	Update core to PHP 7.4 standard ... - Typed properties - Port to LoggerInterface Signed-off-by: Carl Schwan <carl@carlschwan.eu>	4 years ago
Vitor Mattos	d613b32045	add check isFairUseOfFreePushService on login ... Signed-off-by: Vitor Mattos <vitor@php.rio>	5 years ago
Daniel Rudolf	e478db9161	Deprecate RedirectToDefaultAppResponse ... Signed-off-by: Daniel Rudolf <github.com@daniel-rudolf.de>	5 years ago
Daniel Rudolf	12059eb65b	Add IUrlGenerator::linkToDefaultPageUrl() ... Replaces the deprecated \OC_Util::getDefaultPageUrl() and makes this API public. Signed-off-by: Daniel Rudolf <github.com@daniel-rudolf.de>	5 years ago
Vincent Petry	95e03fba2d	Fix more controller tests in Core subdir ... Signed-off-by: Vincent Petry <vincent@nextcloud.com>	5 years ago
John Molakvoæ (skjnldsv)	6c49dc2d1f	Fix absolute redirect ... Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>	6 years ago
Christoph Wurst	afbd9c4e6e	Unify function spacing to PSR2 recommendation ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	2fbad1ed72	Fix (array) indent style to always use one tab ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Roeland Jago Douma	53db05a1f6	Start with webauthn ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl> Signed-off-by: npmbuildbot[bot] <npmbuildbot[bot]@users.noreply.github.com>	6 years ago
Christoph Wurst	2ee65f177e	Use the shorter phpunit syntax for mocked return values ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Daniel Kesselberg	9378a6b411	Send Clear-Site-Data expect for Chrome ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	7 years ago
Roeland Jago Douma	3a7cf40aaa	Mode to modern phpunit ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	c007ca624f	Make phpunit8 compatible ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Daniel Kesselberg	6235a66aac	Don't send executionContexts for Clear-Site-Data ... There are plans to remove executionContexts from the spec: https://github.com/w3c/webappsec-clear-site-data/issues/59 Firefox already removed it https://bugzilla.mozilla.org/show_bug.cgi?id=1548034 Chromium implementation is not finish: https://bugs.chromium.org/p/chromium/issues/detail?id=898503&q=clear-site-data&sort=-modified&colspec=ID%20Pri%20M%20Stars%20ReleaseBlock%20Component%20Status%20Owner%20Summary%20OS%20Modified Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	7 years ago
Christoph Wurst	64c4bb5bce	Vueify the login page ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	7 years ago
Christoph Wurst	170582d4f5	Add a login chain to reduce the complexity of LoginController::tryLogin ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	7 years ago
Roeland Jago Douma	e6333c8fe3	Honor remember_login_cookie_lifetime ... If the remember_login_cookie_lifetime is set to 0 this means we do not want to use remember me at all. In that case we should also not creatae a remember me cookie and should create a proper temp token. Further this specifies that is not 0 the remember me time should always be larger than the session timeout. Because else the behavior is not really defined. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Rayn0r	82c2c10b25	adapted automated test for autocomplete changes ... Signed-off-by: Rayn0r <Andre.Weidemann@web.de>	8 years ago
Patrick Conrad	1806baaeaf	Remove cookies from Clear-Site-Data Header ... In 2f87fb6b45 this header was introduced. The referenced documentation says: > When delivered with a response from https://example.com/clear, the following header will cause cookies associated with the origin https://example.com to be cleared, as well as cookies on any origin in the same registered domain (e.g. https://www.example.com/ and https://more.subdomains.example.com/). This also applies if `https://nextcloud.example.com/` sends the `Clear-Site-Data: "cookies"` header. This is not the behavior we want at this point! So I removed the deletion of cookies from the header. This has no effect on the logout process as this header is supported only recently and the logout works in old browsers as well. Signed-off-by: Patrick Conrad <conrad@iza.org>	8 years ago
Christoph Wurst	c6e47e8a51	Fix login redirection if only one 2FA provider is active ... Fixes https://github.com/nextcloud/server/issues/10500. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	8 years ago
Michael Weimann	de7606dc68	Adds disabled user unit tests ... Signed-off-by: Michael Weimann <mail@michael-weimann.eu>	8 years ago
Christoph Wurst	13d93f5b25	Make 2FA providers stateful ... This adds persistence to the Nextcloud server 2FA logic so that the server knows which 2FA providers are enabled for a specific user at any time, even when the provider is not available. The `IStatefulProvider` interface was added as tagging interface for providers that are compatible with this new API. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	8 years ago
Roeland Jago Douma	2b7d4d5069	Fix tests ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	8 years ago
Roeland Jago Douma	b1d8084700	Fix tests ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Julius Härtl	f5f6ed664d	Hide stay logged in checkbox when flow authentication is used ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	9 years ago
Morris Jobke	0326c2c54f	Fix broken tests ... Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Roeland Jago Douma	3bd104ef7c	Fix LoginController ... Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Lukas Reschke	f22ab3e665	Add metadata to \OCP\AppFramework\Http\Response::throttle ... Fixes https://github.com/nextcloud/server/issues/5891 Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	2f87fb6b45	Add Clear-Site-Data header ... This adds a Clear-Site-Data header to the logout response which will delete all relevant data in the caches which may contain potentially sensitive content. See https://w3c.github.io/webappsec-clear-site-data/#header for the definition of the types. Ref https://twitter.com/mikewest/status/877149667909406723 Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Christoph Wurst	bb1d191f82	Fix remember redirect_url on failed login attempts ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	9 years ago
Lukas Reschke	8149945a91	Make BruteForceProtection annotation more clever ... This makes the new `@BruteForceProtection` annotation more clever and moves the relevant code into it's own middleware. Basically you can now set `@BruteForceProtection(action=$key)` as annotation and that will make the controller bruteforce protected. However, the difference to before is that you need to call `$responmse->throttle()` to increase the counter. Before the counter was increased every time which leads to all kind of unexpected problems. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Joas Schilling	7ad791efb4	Dont create a log entry on email login ... Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Arthur Schiwon	7b3fdfeeaa	do login routine only once when done via LoginController ... Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	9 years ago
Arthur Schiwon	2994cbc586	fix login controller tests ... Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	9 years ago