278 Commits (8904bf645b30fbdfdcb00a2ea607d752ee69d865)

Author	SHA1	Message	Date
Joas Schilling	aa5f037af7	chore: apply changes from Nextcloud coding standards 1.1.1 ... Signed-off-by: Joas Schilling <coding@schilljs.com> Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	2 years ago
Christoph Wurst	a5422a3998	fix: Show error message when CSRF check fails at login ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	2 years ago
Côme Chilliet	d8b42c6131	Allow passing null to PublicKeyToken::setScope, fixes tests ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Côme Chilliet	33a24134a7	Improve docblock annotations for tokens and their exceptions ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Côme Chilliet	58a57a714e	Use more precise typing for setScope method parameter ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Côme Chilliet	1bdf952fde	Make sure that OC interfaces returns OC interfaces for backward compatibility ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Côme Chilliet	b82e25ea7a	Move Exceptions used in OCP to OCP ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Côme Chilliet	356f0291a2	Align PublicKeyToken with interface changes ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Côme Chilliet	f94fb33062	Move IToken and IProvider::getToken to OCP ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	2 years ago
Benjamin Gaussorgues	4361019f2f	fix(twofactor): avoid error in pgsql for duplicate entry ... Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>	2 years ago
Lucas Azevedo	2a36acfc2b	Fix typo ... Signed-off-by: Lucas Azevedo <lhs_azevedo@hotmail.com>	2 years ago
Lucas Azevedo	c93b1634d3	Fixes from static analysis ... Co-authored-by: Joas Schilling <213943+nickvergessen@users.noreply.github.com> Signed-off-by: Lucas Azevedo <lhs_azevedo@hotmail.com>	2 years ago
Lucas Azevedo	fe9b9c1955	Add last-used-before option ... Signed-off-by: Lucas Azevedo <lhs_azevedo@hotmail.com>	2 years ago
Daniel Kesselberg	32303b6ed5	docs: remove superfluous phpdocs ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	2 years ago
Joas Schilling	dac31ad101	fix!: Remove legacy event dispatching Symfony's GenericEvent from 2FA Manager ... Signed-off-by: Joas Schilling <coding@schilljs.com>	2 years ago
Christoph Wurst	14719110b9	chore: Replace \OC::$server->query with \OCP\Server::get in /lib ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Joas Schilling	05aa39d777	Fix event names of 2FA related typed events ... Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Christoph Wurst	5eb768ac5e	fix(auth): Run token statements in atomic transaction ... All or nothing Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Côme Chilliet	426c0341ff	Use typed version of IConfig::getSystemValue as much as possible ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	3 years ago
jld3103	d9f8522003	Fix types for reading and writing config values ... Signed-off-by: jld3103 <jld3103yt@gmail.com>	3 years ago
Artur Neumann	f634badf12	public interface to invalidate tokens of user ... Signed-off-by: Artur Neumann <artur@jankaritech.com>	3 years ago
Ember 'n0emis' Keske	6881d2f2f1	Don't try to hash a nonexisting password ... Allows to log-in via a passwordless authentication provider, eg SSO Signed-off-by: Ember 'n0emis' Keske <git@n0emis.eu>	3 years ago
Joas Schilling	6417ea0265	fix(authentication): Handle null or empty string password hash ... This can happen when the auth.storeCryptedPassword config is used, which previously errored with: Hasher::verify(): Argument #2 ($hash) must be of type string, null given Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Julius Härtl	580feecdbf	fix(authtoken): Store only one hash for authtokens with the current password per user ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	3 years ago
Joas Schilling	7a85a1596e	fix(authentication): Check minimum length when creating app tokens ... Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Joas Schilling	03a585ab4f	fix(performance): Only search for auth tokens when the provided login is long enough ... Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Côme Chilliet	f5c361cf44	composer run cs:fix ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	3 years ago
Joas Schilling	2fb4dac7ad	fix(authentication): Update the token when the hash is null or can not be verified ... Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Joas Schilling	28b18d561c	fix(authentication): Only hash the new password when needed ... Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Joas Schilling	c5bb19641c	fix(authentication): Invert the logic to the original intention ... We need to store the new authentication details when the hash did **not** verify the old password. Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Joas Schilling	55d8aec759	fix(authentication): Only verify each hash once ... Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Thomas Citharel	6b7da88b0b	Validate user timezone given from login data before saving it ... Follow-up to #36000 Signed-off-by: Thomas Citharel <tcit@tcit.fr>	3 years ago
Joas Schilling	b4a29644cc	Add a const for the max user password length ... Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Marcel Klehr	adfe367106	PublickKeyTokenProvider: Fix password update routine with password hash ... Signed-off-by: Marcel Klehr <mklehr@gmx.net>	3 years ago
Julius Härtl	6abb37317f	Do not setup a session when not required on WebDAV requests ... If basic auth is used on WebDAV endpoints, we will not setup a session by default but instead set a test cookie. Clients which handle session cookies properly will send back the cookie then on the second request and a session will be initialized which can be resued for authentication. Signed-off-by: Julius Härtl <jus@bitgrid.net>	3 years ago
Roeland Jago Douma	77df92cabf	feat: add event for failed logins ... Apps might also like to know about failed logins. This adds that event. The private interface changes are backwards compatible so all should be fine. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	3 years ago
Julius Härtl	298d2b9b58	Skip general login with email for non-valid addresses and LDAP ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	3 years ago
Carl Schwan	419828c791	Fix the type of the return array in a few more places ... Signed-off-by: Carl Schwan <carl@carlschwan.eu>	3 years ago
Christoph Wurst	c5922e67d3	Run session token renewals in a database transaction ... The session token renewal does 1) Read the old token 2) Write a new token 3) Delete the old token If two processes succeed to read the old token there can be two new tokens because the queries were not run in a transaction. This is particularly problematic on clustered DBs where 1) would go to a read node and 2) and 3) go to a write node. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Christoph Wurst	eff877af03	Pass logger to passwordless auth WebAuthn lib ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Carl Schwan	ef31396727	Mark method as deprecated ... Co-authored-by: Joas Schilling <213943+nickvergessen@users.noreply.github.com> Signed-off-by: Carl Schwan <carl@carlschwan.eu>	3 years ago
Thomas Citharel	3ce1996d5e	Add back TokenCleanupJob to invalidate old temporary tokens ... Signed-off-by: Thomas Citharel <tcit@tcit.fr>	3 years ago
Julius Härtl	9d1ec582ba	Do not update passwords if nothing changed ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	3 years ago
Carl Schwan	702445ba3b	Handle one time password better ... Signed-off-by: Carl Schwan <carl@carlschwan.eu>	3 years ago
luz paz	368f83095d	Fix typos in lib/private subdirectory ... Found via `codespell -q 3 -S l10n -L jus ./lib/private` Signed-off-by: luz paz <luzpaz@github.com>	3 years ago
Carl Schwan	d5c23dbb9f	Move CappedMemoryCache to OCP ... This is an helpful helper that should be used in more place than just server and this is already the case with groupfodlers, deck, user_oidc and more using it, so let's make it public Signed-off-by: Carl Schwan <carl@carlschwan.eu>	4 years ago
Carl Schwan	1c23c029af	Handler large passwords ... For passwords bigger than 250 characters, use a bigger key since the performance impact is minor (around one second to encrypt the password). For passwords bigger than 470 characters, give up earlier and throw exeception recommanding admin to either enable the previously enabled configuration or use smaller passwords. Signed-off-by: Carl Schwan <carl@carlschwan.eu>	4 years ago
Carl Schwan	cdf3b60555	Handle one time passwords ... This adds an option to disable storing passwords in the database. This might be desirable when using single use token as passwords or very large passwords. Signed-off-by: Carl Schwan <carl@carlschwan.eu>	4 years ago
Robin Appelman	db3093a46f	delete files before cleaning cache when cleaning user files ... otherwise, when using object store, we loose track of which files the user owns before we can delete them Signed-off-by: Robin Appelman <robin@icewind.nl>	4 years ago
Christoph Wurst	90c31cfddc	Fix replacing external storage password during debug log ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	4 years ago