nextcloud-server

Commit Graph

Author	SHA1	Message	Date
Georg Ehrke	60f9ed6241	add contactsmenu popover Signed-off-by: Georg Ehrke <developer@georgehrke.com>	9 years ago
Christoph Wurst	36cee1f386	Let apps register contact menu provider via info.xml Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	9 years ago
Christoph Wurst	d091793ceb	Contacts menu * load list of contacts from the server * show last message of each contact Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	9 years ago
Roeland Jago Douma	aae079aa29	AppToken to 72 chars Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	bb5e5efa6d	Do not remove the state token to early we should check the stateToken before we remove it. Else the check will always fail. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Lukas Reschke	6a16df7288	Add new auth flow This implements the basics for the new app-password based authentication flow for our clients. The current implementation tries to keep it as simple as possible and works the following way: 1. Unauthenticated client opens `/index.php/login/flow` 2. User will be asked whether they want to grant access to the client 3. If accepted the user has the chance to do so using existing App Token or automatically generate an app password. If the user chooses to use an existing app token then that one will simply be redirected to the `nc://` protocol handler. While we can improve on that in the future, I think keeping this smaller at the moment has its advantages. Also, in the near future we have to think about an automatic migration endpoint so there's that anyways :-) If the user chooses to use the regular login the following happens: 1. A session state token is written to the session 2. User is redirected to the login page 3. If successfully authenticated they will be redirected to a page redirecting to the POST controller 4. The POST controller will check if the CSRF token as well as the state token is correct, if yes the user will be redirected to the `nc://` protocol handler. This approach is quite simple but also allows to be extended in the future. One could for example allow external websites to consume this authentication endpoint as well. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Christoph Wurst	bb1d191f82	Fix remember redirect_url on failed login attempts Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	9 years ago
Morris Jobke	c54a59d51e	Remove unused use statements Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Lukas Reschke	d0d34d308a	Add at most 10 password reset requests per 5 minutes and IP range Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	c1b8f152d8	Add rate limit to TOTP solve challenge controller Fixes https://github.com/nextcloud/server/issues/2626 Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Morris Jobke	16c4755e03	Rename renderHTML to renderHtml * fixes #4383 * improves consistency Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Lukas Reschke	727688ebd9	Adjust existing bruteforce protection code - Moves code to annotation - Adds the `throttle()` call on the responses on existing annotations Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	8149945a91	Make BruteForceProtection annotation more clever This makes the new `@BruteForceProtection` annotation more clever and moves the relevant code into it's own middleware. Basically you can now set `@BruteForceProtection(action=$key)` as annotation and that will make the controller bruteforce protected. However, the difference to before is that you need to call `$responmse->throttle()` to increase the counter. Before the counter was increased every time which leads to all kind of unexpected problems. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	66835476b5	Add support for ratelimiting via annotations This allows adding rate limiting via annotations to controllers, as one example: ``` @UserRateThrottle(limit=5, period=100) @AnonRateThrottle(limit=1, period=100) ``` Would mean that logged-in users can access the page 5 times within 100 seconds, and anonymous users 1 time within 100 seconds. If only an AnonRateThrottle is specified that one will also be applied to logged-in users. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Morris Jobke	1f962f9115	Update email template for lost password email Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Morris Jobke	5b4adf66e5	Move OC_Defaults to OCP\Defaults * currently there are two ways to access default values: OCP\Defaults or OC_Defaults (which is extended by OCA\Theming\ThemingDefaults) * our code used a mixture of both of them, which made it hard to work on theme values * this extended the public interface with the missing methods and uses them everywhere to only rely on the public interface Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Joas Schilling	7ad791efb4	Dont create a log entry on email login Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Arthur Schiwon	7b3fdfeeaa	do login routine only once when done via LoginController Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	9 years ago
Arthur Schiwon	2994cbc586	fix login controller tests Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	9 years ago
Morris Jobke	9813023aab	Fix gzip files for Safari * Safari support gzip only if the filename does not end on .gz - so this renames them to .gzip Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Roeland Jago Douma	54f9b35f71	Allow to gzip CSS/JS files Since in production the SCSS files are compiled once and the javascript files are combined once we can just as well gzip them aggresively. This means that once they are requested and the browser supports gzip we can just serve the gzipped file saving precious bandwidth. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Joas Schilling	4bae7ef96d	Allow to reset the password with the email as an input Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Roeland Jago Douma	8e89ad21a2	[PoC] JS Combiner Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Sandro Lutz	9b6f99ab08	Update license header Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>	9 years ago
Sandro Lutz	ff3fa538e4	Add missing use statement for PublicEmitter Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>	9 years ago
Christoph Wurst	5e728d0eda	oc_token should be nc_token Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	9 years ago
Sandro Lutz	20f878b014	Fix typo for UserManager variable Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>	9 years ago
Sandro Lutz	6feff0ceba	Add check if UserManager is of type PublicEmitter before calling preLogin hook Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>	9 years ago
Sandro Lutz	e30d28f7eb	Change where preLogin hook gets called Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>	9 years ago
Sandro Lutz	6ab0a3215d	Remove preLoginValidation hook Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>	9 years ago
Sandro Lutz	e14d50eb1f	Fix indentation Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>	9 years ago
Sandro Lutz	4ebcd5ac0b	Add preLoginValidation hook Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>	9 years ago
John Molakvoæ (skjnldsv)	2c9d7eeb76	Fix public page css fallback loading Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>	9 years ago
Bjoern Schiessle	5086335643	unify endpoints form core and the the provisioning api Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>	9 years ago
Bjoern Schiessle	927d3865a0	add brute force protection to password reset to make it harder to guess user logins Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>	9 years ago
Bjoern Schiessle	cdf01feba7	add action to existing brute force protection Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>	9 years ago
Christoph Wurst	140555b786	always allow remembered login Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	9 years ago
Christoph Wurst	243c9c0941	fix coding style and increase code coverage Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	9 years ago
Cornelius Kölbel	e077e01bf2	Add a TwoFactorException A Two Factor third party App may throw a TwoFactorException() with a more detailed error message in case the authentication fails. The 2FA Controller will then display the message of this Exception to the user. Working on #26593 Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
John Molakvoæ (skjnldsv)	e4b3ba6590	Create unified css file and merge all needed data into this file Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>	9 years ago
Bjoern Schiessle	fcda3a20f4	create new encryption keys on password reset and backup the old one Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>	9 years ago
John Molakvoæ (skjnldsv)	67467873c2	Removed jquery scss - Switched to setup.css - Disable scss when displaying the update page - Improved setup css - Fixed loading failure of other styles on setup & update page - Improved scss compiler with an ignore scss compilation option Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>	9 years ago
Roeland Jago Douma	350b7ebc86	Adds CssControllerTests Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	1e44a15dd1	No need for the CssManager * It is a simple wrapper we can always add it later if needed Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	95d85ba8eb	Do not add ICssManager to OCP We can add it later if needed Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
Roeland Jago Douma	2816177ecb	Code cleanup Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	9 years ago
John Molakvoæ (skjnldsv)	6380d503af	Css cache folder name fix, route fix and various fixes Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>	9 years ago
John Molakvoæ (skjnldsv)	3b62003c9c	Injection fix and log appname fix Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>	9 years ago
John Molakvoæ (skjnldsv)	1caaa7f4cd	Appdata integration 2 Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>	9 years ago
Joas Schilling	2f21eaaf47	Use login name to fix password confirm with ldap users Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago

1 2 3 4

162 Commits (897bd5cfefde22b4bdfc6d9dd67aa3bd865af306)