61 Commits (d9c079937726bfa37a48ef8a2f206741f3fa12e3)

Author	SHA1	Message	Date
Arthur Schiwon	a843d3c5db	allow using of disabled password reset mechanism for special cases ... - LostController has three endpoints - door opener email() still rejects - resetform(), reachable from mail, checks the token first and may report that password reset is disabled - setPassword() got its check removed as it is behind CSFR anyway and still requires a valid token - this allows special cases like activating a freshly created guest account Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	4 years ago
Arthur Schiwon	6857136f06	fixes missing prefix to validate password reset token ... - also fixes the test which missed asserting the presence of it Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	4 years ago
Arthur Schiwon	a20de15b43	add a job to clean up expired verification tokens ... Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	4 years ago
Arthur Schiwon	19cc757531	move verification token logic out of lost password controller ... - to make it reusable - needed for local email verification Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	4 years ago
Gary Kim	b78f3a57d1	Migrate HintException to OCP ... Signed-off-by: Gary Kim <gary@garykim.dev>	5 years ago
John Molakvoæ (skjnldsv)	215aef3cbd	Update php licenses ... Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>	5 years ago
Joas Schilling	6ed4aaeeea	Send emails on password reset to the displayname ... Signed-off-by: Joas Schilling <coding@schilljs.com>	5 years ago
Christoph Wurst	d9015a8c94	Format code to a single space around binary operators ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	5 years ago
Christoph Wurst	caff1023ea	Format control structures, classes, methods and function ... To continue this formatting madness, here's a tiny patch that adds unified formatting for control structures like if and loops as well as classes, their methods and anonymous functions. This basically forces the constructs to start on the same line. This is not exactly what PSR2 wants, but I think we can have a few exceptions with "our" style. The starting of braces on the same line is pracrically standard for our code. This also removes and empty lines from method/function bodies at the beginning and end. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	afbd9c4e6e	Unify function spacing to PSR2 recommendation ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	2fbad1ed72	Fix (array) indent style to always use one tab ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	1a9330cd69	Update the license headers for Nextcloud 19 ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	b80ebc9674	Use the short array syntax, everywhere ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Christoph Wurst	5bf3d1bb38	Update license headers ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	6 years ago
Roeland Jago Douma	68748d4f85	Some php-cs fixes ... * Order the imports * No leading slash on imports * Empty line before namespace * One line per import * Empty after imports * Emmpty line at bottom of file Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	6 years ago
Daniel Kesselberg	e32b2c4b76	Stop if there is no encrypted token ... Fix Argument 1 passed to OC\Security\Crypto::decrypt() must be of the type string, null given Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	6 years ago
Julius Härtl	3b0d13944a	Move actual password reset to vue ... Signed-off-by: Julius Härtl <jus@bitgrid.net>	7 years ago
Roeland Jago Douma	b6dd2ebd39	Use proper exception in lostController ... There is no need to log the expcetion of most of the stuff here. We should properly log them but an exception is excessive. This moves it to a proper exception which we can catch and then log. The other exceptions will still be fully logged. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Daniel Kesselberg	d57540ac84	Return first value from $users ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	7 years ago
Roeland Jago Douma	ac8a6e2244	Clean pending 2FA authentication on password reset ... When a password is reste we should make sure that all users are properly logged in. Pending states should be cleared. For example a session where the 2FA code is not entered yet should be cleared. The token is now removed so the session will be killed the next time this is checked (within 5 minutes). Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Roeland Jago Douma	d0397f9b53	Generic message on password reset ... There is no need to inform the user if the account existed or not. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>	7 years ago
Morris Jobke	cf3f4888cc	Change password expiration time from 12h to 7d ... We use the same logic for creating accounts without a password and there the 12h is a bit short. Users don't expect that the signup link needs to be clicked within 12h - 7d should be a more expected behavior. Signed-off-by: Morris Jobke <hey@morrisjobke.de>	7 years ago
Daniel Kesselberg	031fdfb1fc	Enable password reset for user with same email address when only one is active ... When two or more user share the same email address its not possible to reset password by email. Even when only one account is active. This pr reduce list of users returned by getByEmail by disabled users. Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	7 years ago
Bjoern Schiessle	dfec66ca02	only warn about data lose on password reset if per-user keys are used ... Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>	7 years ago
Robin Appelman	8ed50d4b63	prefill userid for login after password reset ... Signed-off-by: Robin Appelman <robin@icewind.nl>	8 years ago
Rémy Jacquin	04e1cab5ee	Fix translation bug on lost password page ... Fix nextcloud/password_policy#26 Signed-off-by: Rémy Jacquin <remy@remyj.fr>	8 years ago
Joas Schilling	339e320064	Fix existing usages ... Signed-off-by: Joas Schilling <coding@schilljs.com>	8 years ago
Arthur Schiwon	4f3d52a364	never translate login names when requiring with a user id ... where appropriate, the preLoginNameUsedAsUserName hook should be thrown. Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>	8 years ago
Morris Jobke	0eebff152a	Update license headers ... Signed-off-by: Morris Jobke <hey@morrisjobke.de>	8 years ago
Joas Schilling	3119fd41ce	Set the data from the template ... Signed-off-by: Joas Schilling <coding@schilljs.com>	8 years ago
Joas Schilling	8b37fe7f65	Set the subject with the email template to allow theming ... Signed-off-by: Joas Schilling <coding@schilljs.com>	8 years ago
Joas Schilling	6dbb64c4a2	Merge setMetaData into constructor ... This ensures that the meta data is set in the beginning Signed-off-by: Joas Schilling <coding@schilljs.com>	8 years ago
Joas Schilling	6a130d01e7	Also for reset password ... Signed-off-by: Joas Schilling <coding@schilljs.com>	8 years ago
Joas Schilling	d5c6d56170	No password reset for disabled users ... Signed-off-by: Joas Schilling <coding@schilljs.com>	8 years ago
Morris Jobke	188b87e03b	Cleanup legacy user class from unused methods ... Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Joas Schilling	0828df5ed4	Disable the API endpoints as well ... Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Morris Jobke	c54a59d51e	Remove unused use statements ... Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Lukas Reschke	d0d34d308a	Add at most 10 password reset requests per 5 minutes and IP range ... Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Morris Jobke	16c4755e03	Rename renderHTML to renderHtml ... * fixes #4383 * improves consistency Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Lukas Reschke	727688ebd9	Adjust existing bruteforce protection code ... - Moves code to annotation - Adds the `throttle()` call on the responses on existing annotations Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Lukas Reschke	66835476b5	Add support for ratelimiting via annotations ... This allows adding rate limiting via annotations to controllers, as one example: ``` @UserRateThrottle(limit=5, period=100) @AnonRateThrottle(limit=1, period=100) ``` Would mean that logged-in users can access the page 5 times within 100 seconds, and anonymous users 1 time within 100 seconds. If only an AnonRateThrottle is specified that one will also be applied to logged-in users. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	9 years ago
Morris Jobke	1f962f9115	Update email template for lost password email ... Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Morris Jobke	5b4adf66e5	Move OC_Defaults to OCP\Defaults ... * currently there are two ways to access default values: OCP\Defaults or OC_Defaults (which is extended by OCA\Theming\ThemingDefaults) * our code used a mixture of both of them, which made it hard to work on theme values * this extended the public interface with the missing methods and uses them everywhere to only rely on the public interface Signed-off-by: Morris Jobke <hey@morrisjobke.de>	9 years ago
Joas Schilling	4bae7ef96d	Allow to reset the password with the email as an input ... Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Bjoern Schiessle	927d3865a0	add brute force protection to password reset to make it harder to guess user logins ... Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>	9 years ago
Bjoern Schiessle	fcda3a20f4	create new encryption keys on password reset and backup the old one ... Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>	9 years ago
Bjoern Schiessle	16bbd3fd7c	fix password reset if encryption is enabled ... Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>	9 years ago
Lukas Reschke	6d686c213b	[WIP] Use mail for encrypting the password reset token as well	9 years ago
Joas Schilling	877cb06bfe	Use magic DI for core controllers ... Signed-off-by: Joas Schilling <coding@schilljs.com>	9 years ago
Roeland Jago Douma	f6423f74e3	Minor cleanup in core Controllers	9 years ago