186 Commits (c9c49bfef8ff39eb052d9bddb796882290467c98)

Author	SHA1	Message	Date
Côme Chilliet	426c0341ff	Use typed version of IConfig::getSystemValue as much as possible ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	3 years ago
Côme Chilliet	ea05544213	Fix return type of methods returning false on error ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	3 years ago
Joas Schilling	454281af03	feat(security): Allow to opt-out of ratelimit protection, e.g. for testing on CI ... Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
Côme Chilliet	f5c361cf44	composer run cs:fix ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	3 years ago
Christoph Wurst	8aea25b5b9	Add remote host validation API ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Côme Chilliet	71ee292650	Add rate limiting on lost password emails ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	3 years ago
Carl Schwan	ef31396727	Mark method as deprecated ... Co-authored-by: Joas Schilling <213943+nickvergessen@users.noreply.github.com> Signed-off-by: Carl Schwan <carl@carlschwan.eu>	3 years ago
Carl Schwan	48d9c4d2b0	Port existing server code to new interface ... Signed-off-by: Carl Schwan <carl@carlschwan.eu>	3 years ago
Joas Schilling	c0f47af2d0	Add a public interface for the bruteforce throttler and register for injection ... Signed-off-by: Joas Schilling <coding@schilljs.com>	3 years ago
luz paz	368f83095d	Fix typos in lib/private subdirectory ... Found via `codespell -q 3 -S l10n -L jus ./lib/private` Signed-off-by: luz paz <luzpaz@github.com>	3 years ago
Joas Schilling	8274c05e19	Only ignore attempts of the same action ... Signed-off-by: Joas Schilling <coding@schilljs.com>	4 years ago
Carl Schwan	ca3cd5a625	Fix detection of firefox in ContentSecurityPolicyNonceManager ... Reuse Request::USER_AGENT_FIREFOX, and also update the safari detection since safari < 12 is not supported anymore and we can remove a bit of code duplication Signed-off-by: Carl Schwan <carl@carlschwan.eu>	4 years ago
Vincent Petry	01dbd22c9c	Validate requested length is random string generator ... Signed-off-by: Vincent Petry <vincent@nextcloud.com>	4 years ago
Carl Schwan	69b36fc2c5	Don't inject Bruteforce capability info in the webui ... This capability do DB access and as far I know is not used by the webui. This remove one DB query for each page load. Signed-off-by: Carl Schwan <carl@carlschwan.eu>	4 years ago
Vincent Petry	18c013d8fc	Add CSP policy merge priority for booleans ... When two booleans conflict when merging CSP policies, true will win. Signed-off-by: Vincent Petry <vincent@nextcloud.com>	4 years ago
Côme Chilliet	6be7aa112f	Migrate from ILogger to LoggerInterface in lib/private ... Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	4 years ago
Robin Appelman	4f594dbf53	cache the path of the certificate bundle ... Signed-off-by: Robin Appelman <robin@icewind.nl>	4 years ago
Robin Appelman	a887553ddb	return default bundle when there is an error getting the bundle ... Signed-off-by: Robin Appelman <robin@icewind.nl>	4 years ago
Julius Härtl	a6796b4247	Fix decryption fallback after adding a secret ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	4 years ago
Julius Härtl	81f8719cc0	Add fallback routines for empty secret cases ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	4 years ago
Julius Härtl	bd03dd37be	Allow to set a strict-dynamic CSP through the API ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	4 years ago
Joas Schilling	b8e0a3dbdd	Use the new option to signaling insensitivity ... Signed-off-by: Joas Schilling <coding@schilljs.com>	4 years ago
Joas Schilling	b59df35426	Make the DB query simpler (as we just deleted all other entries) ... Signed-off-by: Joas Schilling <coding@schilljs.com>	4 years ago
Joas Schilling	c6d000f87f	Log bruteforce throttle and blocking ... Signed-off-by: Joas Schilling <coding@schilljs.com>	4 years ago
Carl Schwan	6312c0df69	Check style update ... Signed-off-by: Carl Schwan <carl@carlschwan.eu>	4 years ago
Joas Schilling	1d550ab95e	Don't query the bruteforce attempts when we just deleted them ... Signed-off-by: Joas Schilling <coding@schilljs.com>	4 years ago
Vincent Petry	19f41a60a0	Type hint in IpAddress ... Signed-off-by: Vincent Petry <vincent@nextcloud.com> Co-authored-by: Côme Chilliet <91878298+come-nc@users.noreply.github.com>	4 years ago
Vincent Petry	f01ad7b8d8	Improve normalizer detecting IPv4 inside of IPv6 ... The subnet for an IPv4 address inside of IPv6 is now returned in its IPv4 form. Signed-off-by: Vincent Petry <vincent@nextcloud.com>	4 years ago
Vincent Petry	7e08a4ab15	Fix getting subnet of ipv4 mapped ipv6 addresses ... Signed-off-by: Vincent Petry <vincent@nextcloud.com>	4 years ago
Joas Schilling	c42f5bc5f6	Add an OCP for trusted domain helper ... Signed-off-by: Joas Schilling <coding@schilljs.com>	4 years ago
Daniel Kesselberg	240eb02585	Set associative = true for cleanup job ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	4 years ago
Lukas Reschke	474a5b55d3	Implement review feedback ... Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	4 years ago
Lukas Reschke	358eaba7dd	Apply suggestions from code review ... Signed-off-by: Lukas Reschke <lukas@statuscode.ch> Co-authored-by: Joas Schilling <213943+nickvergessen@users.noreply.github.com>	4 years ago
Arthur Schiwon	0dee717c94	Confirm mails only per POST ... - this is to avoid automatic confirmation by certain softwares that open links Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	4 years ago
Arthur Schiwon	a20de15b43	add a job to clean up expired verification tokens ... Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	4 years ago
Arthur Schiwon	19cc757531	move verification token logic out of lost password controller ... - to make it reusable - needed for local email verification Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	4 years ago
Lukas Reschke	471167019c	Implement PR review feedback ... Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	4 years ago
Lukas Reschke	a915372c56	phpcs ... Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	4 years ago
Lukas Reschke	378cc922c4	Adjust logic to store period instead of current timestamp ... Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	4 years ago
Lukas Reschke	d4f97affc1	Add database ratelimiting backend ... In case no distributed memory cache is specified this adds a database backend for ratelimit purposes. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	4 years ago
Daniel Kesselberg	0a15043f69	Throw exception if encrypting the data failed. ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	5 years ago
John Molakvoæ (skjnldsv)	215aef3cbd	Update php licenses ... Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>	5 years ago
J0WI	ca7b37ce5a	Make Security module strict ... Signed-off-by: J0WI <J0WI@users.noreply.github.com>	5 years ago
Lukas Reschke	e5a4236e68	Increase subnet matcher ... Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	5 years ago
Roeland Jago Douma	16652ac6c6	Explicitly check hex2bin input ... For #23197 Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	5 years ago
dependabot-preview[bot]	eb502c02ff	Bump nextcloud/coding-standard from 0.3.0 to 0.5.0 ... Bumps [nextcloud/coding-standard](https://github.com/nextcloud/coding-standard) from 0.3.0 to 0.5.0. - [Release notes](https://github.com/nextcloud/coding-standard/releases) - [Changelog](https://github.com/nextcloud/coding-standard/blob/master/CHANGELOG.md) - [Commits](https://github.com/nextcloud/coding-standard/compare/v0.3.0...v0.5.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	5 years ago
Morris Jobke	24d436cb60	Remove unneeded casts that were found by Psalm ... In preparation of the update of Psalm from 4.2.1 to 4.3.1+ (see https://github.com/nextcloud/server/pull/24521) Signed-off-by: Morris Jobke <hey@morrisjobke.de>	5 years ago
Christoph Wurst	d89a75be0b	Update all license headers for Nextcloud 21 ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	5 years ago
Julius Härtl	f5501ca276	Avoid checking for brute force protection capabilities when upgrading ... This might happen a releases that doesn't have this table yet Signed-off-by: Julius Härtl <jus@bitgrid.net>	5 years ago
Joas Schilling	5b5aebbf66	Replace the credentials table with one that can have empty user ... Primary key columns on Oracle can not have empty strings Signed-off-by: Joas Schilling <coding@schilljs.com>	5 years ago