163 Commits (dd08f9320249d8ac7bf96f338a5be70d60af1dce)

Author	SHA1	Message	Date
Christoph Wurst	7aa16e1559	fix setup	10 years ago
Christoph Wurst	7e7d5a2ef2	Add fallback to allow user:token basic auth	10 years ago
Christoph Wurst	fdc2cd7554	Add token auth for OCS APIs	10 years ago
Christoph Wurst	8d48502187	Add index on 'last_activity' ... add token type column and delete only temporary tokens in the background job debounce token updates; fix wrong class import	10 years ago
Christoph Wurst	53636c73d6	Add controller to generate client tokens	10 years ago
Christoph Wurst	3ab922601a	Check if session token is valid and log user out if the check fails ... * Update last_activity timestamp of the session token * Check user backend credentials once in 5 minutes	10 years ago
Christoph Wurst	2fa5e0a24e	invalidate (delete) session token on logout ... add 'last_activity' column to session tokens and delete old ones via a background job	10 years ago
Christoph Wurst	d8cde414bd	token based auth ... * Add InvalidTokenException * add DefaultTokenMapper and use it to check if a auth token exists * create new token for the browser session if none exists hash stored token; save user agent * encrypt login password when creating the token	10 years ago
Roeland Jago Douma	9504500e5f	Move \OC\User to PSR-4	10 years ago
Thomas Müller	9c9fec36dd	Add occ commands to enable and disable a user + a disabled user can no longer login - fixes #23838	10 years ago
Thomas Müller	682821c71e	Happy new year!	10 years ago
Roeland Jago Douma	876fb83ddc	getMediumStrengthGenerator is deprecated and does not do anything anymore	10 years ago
Lukas Reschke	fec41e7539	Move regeneration of session ID into session classes ... There were code paths that nowadays call ISession::login directly thus bypassing the desired regeneration of the session ID. This moves the session regeneration deeper into the session handling and thus ensures that it is always called. Furthermore, I also added the session regeneration to the remember me cookie plus added some test case expectations for this.	10 years ago
Morris Jobke	c60c793cf2	More cleanups of OC_Config usage	10 years ago
Lukas Reschke	3d2ee95f1e	Remove last occurence of `forcessl` ... This shoudl have been adjusted as well, now it's consistent with `setMagicInCookie`. While it does not have a security impact directly some automated scanners reported this all the time.	11 years ago
Robin Appelman	0497534a6e	more type hints	11 years ago
Jenkins for ownCloud	b585d87d9d	Update license headers	11 years ago
Lukas Reschke	bbd5f28415	Let users configure security headers in their Webserver ... Doing this in the PHP code is not the right approach for multiple reasons: 1. A bug in the PHP code prevents them from being added to the response. 2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud) 3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations. This pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS.	11 years ago
Morris Jobke	06aef4e8b1	Revert "Updating license headers" ... This reverts commit 6a1a4880f0.	11 years ago
Jenkins for ownCloud	6a1a4880f0	Updating license headers	11 years ago
Robin Appelman	8eda661761	Throw an exception when login is canceled by an app	11 years ago
Lukas Reschke	a2e355a7fe	Use "HTTPOnly" for cookies when logging out ... This has no other reason than preventing some insane automated scanners from reporting this as security bug (which it obviously isn't as the cookie contains nothing of value) Thus it generally results in an happier Lukas and hopefully less reports to our support and security mail addresses...	11 years ago
Robin Appelman	857695ec87	Return false if the login is canceled in a hook	11 years ago
Lukas Reschke	dbbf568192	Fix typo	11 years ago
Lukas Reschke	a022e65285	Clarify return values ... This function returns `null` when no user is logged-in.	11 years ago
Lukas Reschke	e3230b5bc2	Add ultra-slim hack for incognito mode ... As discussed at https://github.com/owncloud/core/pull/12912#issuecomment-67391155	11 years ago
Bernhard Posselt	236632702c	add a isLoggedIn method to the usersession and deprecate the isLoggedIn method on the api	11 years ago
Bernhard Posselt	9ae48e184b	add a isLoggedIn method to the usersession and deprecate the isLoggedIn method on the api	11 years ago
Morris Jobke	0d4f0ab871	reduce OC_Preferences, OC_Config and \OCP\Config usage ... * files_encryption * files_versions * files_trashbin * tests * status.php * core * server container	11 years ago
Thomas Müller	5097d4dc05	remove deprecated \OC:$session	11 years ago
Lukas Reschke	770c62c5d8	Clear session after logout ... Fixes https://github.com/owncloud/core/issues/8420	11 years ago
Robin Appelman	912fbfab01	Unset the cached active user when using a different session object	11 years ago
Lukas Reschke	63a90a129b	Use proper RNG generator ... OC_Util::generateRandomBytes() only returns lowercase alphanumeric values. We should use the new RNG which has a broader characterset.	12 years ago
Jörn Friedrich Dreyer	f551917a3c	kill OC::$session ... maintain deprecated \OC::$session when getting or setting the session via the server container or UserSession restore order os OC::$session and OC::$CLI remove unneded initialization of dummy session write back session when $useCustomSession is true log warning when deprecated app is used	12 years ago
Joas Schilling	4865c52aa6	Fix isLoggedIn() check for user '0' ... Fix #9972	12 years ago
Robin Appelman	20c1ce7f47	Add public interfaces for User, UserManager and UserSession	12 years ago
Arthur Schiwon	748a219243	add preRememberedLogin hook and document this and postRememberedLogin in class descripttion. Also fixes documentation of postLogin hook	12 years ago
Arthur Schiwon	2c89962919	clean up tryRememberLogin and save the timestamp of users last login	12 years ago
Robin McCorkell	bac8962bbc	Fix Scrutinizer errors	12 years ago
Lukas Reschke	f7fa8662e2	Remove `session_id_regenerate` from here ... Jenkins somewhat complains that there are already sent headers.	12 years ago
Jörn Friedrich Dreyer	2a6a9a8cef	polish documentation based on scrutinizer patches	12 years ago
Thomas Müller	9b7c3a5c66	fixing PHPDoc and use cameCase names	12 years ago
NARUKAWA Hiroki	068688063e	Security Update: session fixation ... Previous version is vulnerable to session fixation attack in some situations, guessing non-apache-module-php5 environment. Regeneration of session id should be done here.	12 years ago
Arthur Schiwon	91d6a6dd7c	On webdav sesssions, loginname was compared to username which does not need to match necessarily	12 years ago
Vincent Petry	013444813e	Now removing stray old cookies from 5.0.12 ... Cookies from 5.0.12 seemed to have an extra slash in the path. Firefox doesn't allow to remove them if the trailing slash isn't there, thus making it impossible to logout correctly. This fix adds extra code to delete such stray cookies. Ported from stable5 branch 99e5c6f7eb	12 years ago
Thomas Müller	9c9dc276b7	move the private namespace OC into lib/private - OCP will stay in lib/public ... Conflicts: lib/private/vcategories.php	12 years ago
Arthur Schiwon	d101ff42f1	User: move checkPassword from User to Manager to not break API	12 years ago
Bart Visscher	0c6dcdba6b	Add missing implements and fix parameters in IConfig	12 years ago
Thomas Tanghus	9e9c323acd	Set path in cookie.	13 years ago
Jan-Christoph Borchardt	d70d4f435e	apply @LukasReschke's cookie changes, hopefully finally fix #854	13 years ago