summaryrefslogtreecommitdiffstats
path: root/core/lostpassword/controller/lostcontroller.php
diff options
context:
space:
mode:
Diffstat (limited to 'core/lostpassword/controller/lostcontroller.php')
-rw-r--r--core/lostpassword/controller/lostcontroller.php169
1 files changed, 83 insertions, 86 deletions
diff --git a/core/lostpassword/controller/lostcontroller.php b/core/lostpassword/controller/lostcontroller.php
index e4d51fde077..aee4001ed37 100644
--- a/core/lostpassword/controller/lostcontroller.php
+++ b/core/lostpassword/controller/lostcontroller.php
@@ -9,68 +9,73 @@
namespace OC\Core\LostPassword\Controller;
use \OCP\AppFramework\Controller;
-use \OCP\AppFramework\Http\JSONResponse;
use \OCP\AppFramework\Http\TemplateResponse;
use \OCP\IURLGenerator;
use \OCP\IRequest;
use \OCP\IL10N;
use \OCP\IConfig;
-use \OCP\IUserSession;
-use \OC\Core\LostPassword\EncryptedDataException;
+use OCP\IUserManager;
+use OCP\Security\ISecureRandom;
+use \OC_Defaults;
+use OCP\Security\StringUtils;
+/**
+ * Class LostController
+ *
+ * Successfully changing a password will emit the post_passwordReset hook.
+ *
+ * @package OC\Core\LostPassword\Controller
+ */
class LostController extends Controller {
- /**
- * @var \OCP\IURLGenerator
- */
+ /** @var IURLGenerator */
protected $urlGenerator;
-
- /**
- * @var \OCP\IUserManager
- */
+ /** @var IUserManager */
protected $userManager;
-
- /**
- * @var \OC_Defaults
- */
+ /** @var OC_Defaults */
protected $defaults;
-
- /**
- * @var IL10N
- */
+ /** @var IL10N */
protected $l10n;
+ /** @var string */
protected $from;
+ /** @var bool */
protected $isDataEncrypted;
-
- /**
- * @var IConfig
- */
+ /** @var IConfig */
protected $config;
+ /** @var ISecureRandom */
+ protected $secureRandom;
/**
- * @var IUserSession
+ * @param string $appName
+ * @param IRequest $request
+ * @param IURLGenerator $urlGenerator
+ * @param IUserManager $userManager
+ * @param OC_Defaults $defaults
+ * @param IL10N $l10n
+ * @param IConfig $config
+ * @param ISecureRandom $secureRandom
+ * @param string $from
+ * @param string $isDataEncrypted
*/
- protected $userSession;
-
public function __construct($appName,
- IRequest $request,
- IURLGenerator $urlGenerator,
- $userManager,
- $defaults,
- IL10N $l10n,
- IConfig $config,
- IUserSession $userSession,
- $from,
- $isDataEncrypted) {
+ IRequest $request,
+ IURLGenerator $urlGenerator,
+ IUserManager $userManager,
+ OC_Defaults $defaults,
+ IL10N $l10n,
+ IConfig $config,
+ ISecureRandom $secureRandom,
+ $from,
+ $isDataEncrypted) {
parent::__construct($appName, $request);
$this->urlGenerator = $urlGenerator;
$this->userManager = $userManager;
$this->defaults = $defaults;
$this->l10n = $l10n;
+ $this->secureRandom = $secureRandom;
$this->from = $from;
$this->isDataEncrypted = $isDataEncrypted;
$this->config = $config;
- $this->userSession = $userSession;
}
/**
@@ -81,23 +86,31 @@ class LostController extends Controller {
*
* @param string $token
* @param string $userId
+ * @return TemplateResponse
*/
public function resetform($token, $userId) {
return new TemplateResponse(
'core/lostpassword',
'resetpassword',
array(
- 'isEncrypted' => $this->isDataEncrypted,
- 'link' => $this->getLink('core.lost.setPassword', $userId, $token),
+ 'link' => $this->urlGenerator->linkToRouteAbsolute('core.lost.setPassword', array('userId' => $userId, 'token' => $token)),
),
'guest'
);
}
+ /**
+ * @param $message
+ * @param array $additional
+ * @return array
+ */
private function error($message, array $additional=array()) {
return array_merge(array('status' => 'error', 'msg' => $message), $additional);
}
+ /**
+ * @return array
+ */
private function success() {
return array('status'=>'success');
}
@@ -106,14 +119,12 @@ class LostController extends Controller {
* @PublicPage
*
* @param string $user
- * @param bool $proceed
+ * @return array
*/
- public function email($user, $proceed){
+ public function email($user){
// FIXME: use HTTP error codes
try {
- $this->sendEmail($user, $proceed);
- } catch (EncryptedDataException $e){
- return $this->error('', array('encryption' => '1'));
+ $this->sendEmail($user);
} catch (\Exception $e){
return $this->error($e->getMessage());
}
@@ -121,15 +132,23 @@ class LostController extends Controller {
return $this->success();
}
-
/**
* @PublicPage
+ * @param string $token
+ * @param string $userId
+ * @param string $password
+ * @param boolean $proceed
+ * @return array
*/
- public function setPassword($token, $userId, $password) {
+ public function setPassword($token, $userId, $password, $proceed) {
+ if ($this->isDataEncrypted && !$proceed){
+ return $this->error('', array('encryption' => true));
+ }
+
try {
$user = $this->userManager->get($userId);
- if (!$this->checkToken($userId, $token)) {
+ if (!StringUtils::equals($this->config->getUserValue($userId, 'owncloud', 'lostpassword'), $token)) {
throw new \Exception($this->l10n->t('Couldn\'t reset password because the token is invalid'));
}
@@ -137,9 +156,10 @@ class LostController extends Controller {
throw new \Exception();
}
- // FIXME: should be added to the all config at some point
- \OC_Preferences::deleteKey($userId, 'owncloud', 'lostpassword');
- $this->userSession->unsetMagicInCookie();
+ \OC_Hook::emit('\OC\Core\LostPassword\Controller\LostController', 'post_passwordReset', array('uid' => $userId, 'password' => $password));
+
+ $this->config->deleteUserValue($userId, 'owncloud', 'lostpassword');
+ @\OC_User::unsetMagicInCookie();
} catch (\Exception $e){
return $this->error($e->getMessage());
@@ -148,36 +168,32 @@ class LostController extends Controller {
return $this->success();
}
-
- protected function sendEmail($user, $proceed) {
- if ($this->isDataEncrypted && !$proceed){
- throw new EncryptedDataException();
- }
-
+ /**
+ * @param string $user
+ * @throws \Exception
+ */
+ protected function sendEmail($user) {
if (!$this->userManager->userExists($user)) {
- throw new \Exception(
- $this->l10n->t('Couldn\'t send reset email. Please make sure '.
- 'your username is correct.'));
+ throw new \Exception($this->l10n->t('Couldn\'t send reset email. Please make sure your username is correct.'));
}
- $token = hash('sha256', \OC_Util::generateRandomBytes(30));
-
- // Hash the token again to prevent timing attacks
- $this->config->setUserValue(
- $user, 'owncloud', 'lostpassword', hash('sha256', $token)
- );
-
$email = $this->config->getUserValue($user, 'settings', 'email');
if (empty($email)) {
throw new \Exception(
$this->l10n->t('Couldn\'t send reset email because there is no '.
- 'email address for this username. Please ' .
- 'contact your administrator.')
+ 'email address for this username. Please ' .
+ 'contact your administrator.')
);
}
- $link = $this->getLink('core.lost.resetform', $user, $token);
+ $token = $this->secureRandom->getMediumStrengthGenerator()->generate(21,
+ ISecureRandom::CHAR_DIGITS.
+ ISecureRandom::CHAR_LOWER.
+ ISecureRandom::CHAR_UPPER);
+ $this->config->setUserValue($user, 'owncloud', 'lostpassword', $token);
+
+ $link = $this->urlGenerator->linkToRouteAbsolute('core.lost.resetform', array('userId' => $user, 'token' => $token));
$tmpl = new \OC_Template('core/lostpassword', 'email');
$tmpl->assign('link', $link, false);
@@ -200,23 +216,4 @@ class LostController extends Controller {
}
}
-
- protected function getLink($route, $user, $token){
- $parameters = array(
- 'token' => $token,
- 'userId' => $user
- );
- $link = $this->urlGenerator->linkToRoute($route, $parameters);
-
- return $this->urlGenerator->getAbsoluteUrl($link);
- }
-
-
- protected function checkToken($user, $token) {
- return $this->config->getUserValue(
- $user, 'owncloud', 'lostpassword'
- ) === hash('sha256', $token);
- }
-
-
}
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-05 04:12:21 +0000