summaryrefslogtreecommitdiffstats
path: root/lib
diff options
context:
space:
mode:
Diffstat (limited to 'lib')
-rw-r--r--lib/base.php193
-rw-r--r--lib/private/Authentication/Exceptions/InvalidTokenException.php29
-rw-r--r--lib/private/Authentication/Token/DefaultToken.php81
-rw-r--r--lib/private/Authentication/Token/DefaultTokenCleanupJob.php36
-rw-r--r--lib/private/Authentication/Token/DefaultTokenMapper.php86
-rw-r--r--lib/private/Authentication/Token/DefaultTokenProvider.php205
-rw-r--r--lib/private/Authentication/Token/IProvider.php42
-rw-r--r--lib/private/Authentication/Token/IToken.php46
-rw-r--r--lib/private/Server.php30
-rw-r--r--lib/private/Setup.php15
-rw-r--r--lib/private/Updater.php2
-rw-r--r--lib/private/User/Session.php310
-rw-r--r--lib/private/legacy/api.php44
-rw-r--r--lib/private/legacy/user.php55
-rw-r--r--lib/private/legacy/util.php3
15 files changed, 886 insertions, 291 deletions
diff --git a/lib/base.php b/lib/base.php
index 0ea8a117e98..16ce0973a95 100644
--- a/lib/base.php
+++ b/lib/base.php
@@ -856,7 +856,7 @@ class OC {
} else {
// For guests: Load only filesystem and logging
OC_App::loadApps(array('filesystem', 'logging'));
- \OC_User::tryBasicAuthLogin();
+ self::handleLogin($request);
}
}
@@ -878,17 +878,6 @@ class OC {
}
}
- // Handle redirect URL for logged in users
- if (isset($_REQUEST['redirect_url']) && OC_User::isLoggedIn()) {
- $location = \OC::$server->getURLGenerator()->getAbsoluteURL(urldecode($_REQUEST['redirect_url']));
-
- // Deny the redirect if the URL contains a @
- // This prevents unvalidated redirects like ?redirect_url=:user@domain.com
- if (strpos($location, '@') === false) {
- header('Location: ' . $location);
- return;
- }
- }
// Handle WebDAV
if ($_SERVER['REQUEST_METHOD'] == 'PROPFIND') {
// not allowed any more to prevent people
@@ -904,12 +893,33 @@ class OC {
OC_App::loadApps();
OC_User::setupBackends();
OC_Util::setupFS();
+ // FIXME
// Redirect to default application
OC_Util::redirectToDefaultPage();
} else {
// Not handled and not logged in
- self::handleLogin();
+ header('Location: '.\OC::$server->getURLGenerator()->linkToRouteAbsolute('core.login.showLoginForm'));
+ }
+ }
+
+ /**
+ * Check login: apache auth, auth token, basic auth
+ *
+ * @param OCP\IRequest $request
+ * @return boolean
+ */
+ private static function handleLogin(OCP\IRequest $request) {
+ $userSession = self::$server->getUserSession();
+ if (OC_User::handleApacheAuth()) {
+ return true;
}
+ if ($userSession->tryTokenLogin($request)) {
+ return true;
+ }
+ if ($userSession->tryBasicAuthLogin($request)) {
+ return true;
+ }
+ return false;
}
protected static function handleAuthHeaders() {
@@ -932,163 +942,6 @@ class OC {
}
}
}
-
- protected static function handleLogin() {
- OC_App::loadApps(array('prelogin'));
- $error = array();
- $messages = [];
-
- try {
- // auth possible via apache module?
- if (OC::tryApacheAuth()) {
- $error[] = 'apacheauthfailed';
- } // remember was checked after last login
- elseif (OC::tryRememberLogin()) {
- $error[] = 'invalidcookie';
- } // logon via web form
- elseif (OC::tryFormLogin()) {
- $error[] = 'invalidpassword';
- }
- } catch (\OC\User\LoginException $e) {
- $messages[] = $e->getMessage();
- } catch (\Exception $ex) {
- \OCP\Util::logException('handleLogin', $ex);
- // do not disclose information. show generic error
- $error[] = 'internalexception';
- }
-
- if(!\OC::$server->getUserSession()->isLoggedIn()) {
- $loginMessages = array(array_unique($error), $messages);
- \OC::$server->getSession()->set('loginMessages', $loginMessages);
- // Read current user and append if possible
- $args = [];
- if(isset($_POST['user'])) {
- $args['user'] = $_POST['user'];
- }
-
- $redirectionTarget = \OC::$server->getURLGenerator()->linkToRoute('core.login.showLoginForm', $args);
- header('Location: ' . $redirectionTarget);
- }
- }
-
- /**
- * Remove outdated and therefore invalid tokens for a user
- * @param string $user
- */
- protected static function cleanupLoginTokens($user) {
- $config = \OC::$server->getConfig();
- $cutoff = time() - $config->getSystemValue('remember_login_cookie_lifetime', 60 * 60 * 24 * 15);
- $tokens = $config->getUserKeys($user, 'login_token');
- foreach ($tokens as $token) {
- $time = $config->getUserValue($user, 'login_token', $token);
- if ($time < $cutoff) {
- $config->deleteUserValue($user, 'login_token', $token);
- }
- }
- }
-
- /**
- * Try to login a user via HTTP authentication
- * @return bool|void
- */
- protected static function tryApacheAuth() {
- $return = OC_User::handleApacheAuth();
-
- // if return is true we are logged in -> redirect to the default page
- if ($return === true) {
- $_REQUEST['redirect_url'] = \OC::$server->getRequest()->getRequestUri();
- OC_Util::redirectToDefaultPage();
- exit;
- }
-
- // in case $return is null apache based auth is not enabled
- return is_null($return) ? false : true;
- }
-
- /**
- * Try to login a user using the remember me cookie.
- * @return bool Whether the provided cookie was valid
- */
- protected static function tryRememberLogin() {
- if (!isset($_COOKIE["oc_remember_login"])
- || !isset($_COOKIE["oc_token"])
- || !isset($_COOKIE["oc_username"])
- || !$_COOKIE["oc_remember_login"]
- || !OC_Util::rememberLoginAllowed()
- ) {
- return false;
- }
-
- if (\OC::$server->getConfig()->getSystemValue('debug', false)) {
- \OCP\Util::writeLog('core', 'Trying to login from cookie', \OCP\Util::DEBUG);
- }
-
- if(OC_User::userExists($_COOKIE['oc_username'])) {
- self::cleanupLoginTokens($_COOKIE['oc_username']);
- // verify whether the supplied "remember me" token was valid
- $granted = OC_User::loginWithCookie(
- $_COOKIE['oc_username'], $_COOKIE['oc_token']);
- if($granted === true) {
- OC_Util::redirectToDefaultPage();
- // doesn't return
- }
- \OCP\Util::writeLog('core', 'Authentication cookie rejected for user ' .
- $_COOKIE['oc_username'], \OCP\Util::WARN);
- // if you reach this point you have changed your password
- // or you are an attacker
- // we can not delete tokens here because users may reach
- // this point multiple times after a password change
- }
-
- OC_User::unsetMagicInCookie();
- return true;
- }
-
- /**
- * Tries to login a user using the form based authentication
- * @return bool|void
- */
- protected static function tryFormLogin() {
- if (!isset($_POST["user"]) || !isset($_POST['password'])) {
- return false;
- }
-
- if(!(\OC::$server->getRequest()->passesCSRFCheck())) {
- return false;
- }
- OC_App::loadApps();
-
- //setup extra user backends
- OC_User::setupBackends();
-
- if (OC_User::login((string)$_POST["user"], (string)$_POST["password"])) {
- $userId = OC_User::getUser();
-
- // setting up the time zone
- if (isset($_POST['timezone-offset'])) {
- self::$server->getSession()->set('timezone', (string)$_POST['timezone-offset']);
- self::$server->getConfig()->setUserValue($userId, 'core', 'timezone', (string)$_POST['timezone']);
- }
-
- self::cleanupLoginTokens($userId);
- if (!empty($_POST["remember_login"])) {
- $config = self::$server->getConfig();
- if ($config->getSystemValue('debug', false)) {
- self::$server->getLogger()->debug('Setting remember login to cookie', array('app' => 'core'));
- }
- $token = \OC::$server->getSecureRandom()->generate(32);
- $config->setUserValue($userId, 'login_token', $token, time());
- OC_User::setMagicInCookie($userId, $token);
- } else {
- OC_User::unsetMagicInCookie();
- }
- OC_Util::redirectToDefaultPage();
- exit();
- }
- return true;
- }
-
}
-
OC::init();
diff --git a/lib/private/Authentication/Exceptions/InvalidTokenException.php b/lib/private/Authentication/Exceptions/InvalidTokenException.php
new file mode 100644
index 00000000000..3e52d3b78f0
--- /dev/null
+++ b/lib/private/Authentication/Exceptions/InvalidTokenException.php
@@ -0,0 +1,29 @@
+<?php
+
+/**
+ * @author Christoph Wurst <christoph@owncloud.com>
+ *
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+namespace OC\Authentication\Exceptions;
+
+use Exception;
+
+class InvalidTokenException extends Exception {
+
+}
diff --git a/lib/private/Authentication/Token/DefaultToken.php b/lib/private/Authentication/Token/DefaultToken.php
new file mode 100644
index 00000000000..25caf675a43
--- /dev/null
+++ b/lib/private/Authentication/Token/DefaultToken.php
@@ -0,0 +1,81 @@
+<?php
+
+/**
+ * @author Christoph Wurst <christoph@owncloud.com>
+ *
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+namespace OC\Authentication\Token;
+
+use OCP\AppFramework\Db\Entity;
+
+/**
+ * @method void setId(int $id)
+ * @method void setUid(string $uid);
+ * @method void setPassword(string $password)
+ * @method string getPassword()
+ * @method void setName(string $name)
+ * @method string getName()
+ * @method void setToken(string $token)
+ * @method string getToken()
+ * @method void setType(string $type)
+ * @method int getType()
+ * @method void setLastActivity(int $lastActivity)
+ * @method int getLastActivity()
+ */
+class DefaultToken extends Entity implements IToken {
+
+ /**
+ * @var string user UID
+ */
+ protected $uid;
+
+ /**
+ * @var string encrypted user password
+ */
+ protected $password;
+
+ /**
+ * @var string token name (e.g. browser/OS)
+ */
+ protected $name;
+
+ /**
+ * @var string
+ */
+ protected $token;
+
+ /**
+ * @var int
+ */
+ protected $type;
+
+ /**
+ * @var int
+ */
+ protected $lastActivity;
+
+ public function getId() {
+ return $this->id;
+ }
+
+ public function getUID() {
+ return $this->uid;
+ }
+
+}
diff --git a/lib/private/Authentication/Token/DefaultTokenCleanupJob.php b/lib/private/Authentication/Token/DefaultTokenCleanupJob.php
new file mode 100644
index 00000000000..4d1290eb623
--- /dev/null
+++ b/lib/private/Authentication/Token/DefaultTokenCleanupJob.php
@@ -0,0 +1,36 @@
+<?php
+
+/**
+ * @author Christoph Wurst <christoph@owncloud.com>
+ *
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+namespace OC\Authentication\Token;
+
+use OC;
+use OC\BackgroundJob\Job;
+
+class DefaultTokenCleanupJob extends Job {
+
+ protected function run($argument) {
+ /* @var $provider DefaultTokenProvider */
+ $provider = OC::$server->query('OC\Authentication\Token\DefaultTokenProvider');
+ $provider->invalidateOldTokens();
+ }
+
+}
diff --git a/lib/private/Authentication/Token/DefaultTokenMapper.php b/lib/private/Authentication/Token/DefaultTokenMapper.php
new file mode 100644
index 00000000000..18adbe48d78
--- /dev/null
+++ b/lib/private/Authentication/Token/DefaultTokenMapper.php
@@ -0,0 +1,86 @@
+<?php
+
+/**
+ * @author Christoph Wurst <christoph@owncloud.com>
+ *
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+namespace OC\Authentication\Token;
+
+use OCP\AppFramework\Db\DoesNotExistException;
+use OCP\AppFramework\Db\Mapper;
+use OCP\DB\QueryBuilder\IQueryBuilder;
+use OCP\IDBConnection;
+
+class DefaultTokenMapper extends Mapper {
+
+ public function __construct(IDBConnection $db) {
+ parent::__construct($db, 'authtoken');
+ }
+
+ /**
+ * Invalidate (delete) a given token
+ *
+ * @param string $token
+ */
+ public function invalidate($token) {
+ $qb = $this->db->getQueryBuilder();
+ $qb->delete('authtoken')
+ ->andWhere($qb->expr()->eq('token', $qb->createParameter('token')))
+ ->setParameter('token', $token)
+ ->execute();
+ }
+
+ /**
+ * @param int $olderThan
+ */
+ public function invalidateOld($olderThan) {
+ /* @var $qb IQueryBuilder */
+ $qb = $this->db->getQueryBuilder();
+ $qb->delete('authtoken')
+ ->where($qb->expr()->lt('last_activity', $qb->createParameter('last_activity')))
+ ->andWhere($qb->expr()->eq('type', $qb->createParameter('type')))
+ ->setParameter('last_activity', $olderThan, IQueryBuilder::PARAM_INT)
+ ->setParameter('type', IToken::TEMPORARY_TOKEN, IQueryBuilder::PARAM_INT)
+ ->execute();
+ }
+
+ /**
+ * Get the user UID for the given token
+ *
+ * @param string $token
+ * @throws DoesNotExistException
+ * @return DefaultToken
+ */
+ public function getToken($token) {
+ /* @var $qb IQueryBuilder */
+ $qb = $this->db->getQueryBuilder();
+ $result = $qb->select('id', 'uid', 'password', 'name', 'type', 'token', 'last_activity')
+ ->from('authtoken')
+ ->where($qb->expr()->eq('token', $qb->createParameter('token')))
+ ->setParameter('token', $token)
+ ->execute();
+
+ $data = $result->fetch();
+ if ($data === false) {
+ throw new DoesNotExistException('token does not exist');
+ }
+ return DefaultToken::fromRow($data);
+ }
+
+}
diff --git a/lib/private/Authentication/Token/DefaultTokenProvider.php b/lib/private/Authentication/Token/DefaultTokenProvider.php
new file mode 100644
index 00000000000..a6641277cf9
--- /dev/null
+++ b/lib/private/Authentication/Token/DefaultTokenProvider.php
@@ -0,0 +1,205 @@
+<?php
+
+/**
+ * @author Christoph Wurst <christoph@owncloud.com>
+ *
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+namespace OC\Authentication\Token;
+
+use Exception;
+use OC\Authentication\Exceptions\InvalidTokenException;
+use OCP\AppFramework\Db\DoesNotExistException;
+use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\IConfig;
+use OCP\ILogger;
+use OCP\Security\ICrypto;
+
+class DefaultTokenProvider implements IProvider {
+
+ /** @var DefaultTokenMapper */
+ private $mapper;
+
+ /** @var ICrypto */
+ private $crypto;
+
+ /** @var IConfig */
+ private $config;
+
+ /** @var ILogger $logger */
+ private $logger;
+
+ /** @var ITimeFactory $time */
+ private $time;
+
+ /**
+ * @param DefaultTokenMapper $mapper
+ * @param ICrypto $crypto
+ * @param IConfig $config
+ * @param ILogger $logger
+ * @param ITimeFactory $time
+ */
+ public function __construct(DefaultTokenMapper $mapper, ICrypto $crypto, IConfig $config, ILogger $logger, ITimeFactory $time) {
+ $this->mapper = $mapper;
+ $this->crypto = $crypto;
+ $this->config = $config;
+ $this->logger = $logger;
+ $this->time = $time;
+ }
+
+ /**
+ * Create and persist a new token
+ *
+ * @param string $token
+ * @param string $uid
+ * @param string $password
+ * @param string $name
+ * @param int $type token type
+ * @return DefaultToken
+ */
+ public function generateToken($token, $uid, $password, $name, $type = IToken::TEMPORARY_TOKEN) {
+ $dbToken = new DefaultToken();
+ $dbToken->setUid($uid);
+ $dbToken->setPassword($this->encryptPassword($password, $token));
+ $dbToken->setName($name);
+ $dbToken->setToken($this->hashToken($token));
+ $dbToken->setType($type);
+ $dbToken->setLastActivity($this->time->getTime());
+
+ $this->mapper->insert($dbToken);
+
+ return $dbToken;
+ }
+
+ /**
+ * Update token activity timestamp
+ *
+ * @throws InvalidTokenException
+ * @param IToken $token
+ */
+ public function updateToken(IToken $token) {
+ if (!($token instanceof DefaultToken)) {
+ throw new InvalidTokenException();
+ }
+ /** @var DefaultToken $token */
+ $token->setLastActivity($this->time->getTime());
+
+ $this->mapper->update($token);
+ }
+
+ /**
+ * @param string $token
+ * @throws InvalidTokenException
+ * @return DefaultToken
+ */
+ public function getToken($token) {
+ try {
+ return $this->mapper->getToken($this->hashToken($token));
+ } catch (DoesNotExistException $ex) {
+ throw new InvalidTokenException();
+ }
+ }
+
+ /**
+ * @param DefaultToken $savedToken
+ * @param string $token session token
+ * @return string
+ */
+ public function getPassword(DefaultToken $savedToken, $token) {
+ return $this->decryptPassword($savedToken->getPassword(), $token);
+ }
+
+ /**
+ * Invalidate (delete) the given session token
+ *
+ * @param string $token
+ */
+ public function invalidateToken($token) {
+ $this->mapper->invalidate($this->hashToken($token));
+ }
+
+ /**
+ * Invalidate (delete) old session tokens
+ */
+ public function invalidateOldTokens() {
+ $olderThan = $this->time->getTime() - (int) $this->config->getSystemValue('session_lifetime', 60 * 60 * 24);
+ $this->logger->info('Invalidating tokens older than ' . date('c', $olderThan));
+ $this->mapper->invalidateOld($olderThan);
+ }
+
+ /**
+ * @param string $token
+ * @throws InvalidTokenException
+ * @return DefaultToken user UID
+ */
+ public function validateToken($token) {
+ $this->logger->debug('validating default token <' . $token . '>');
+ try {
+ $dbToken = $this->mapper->getToken($this->hashToken($token));
+ $this->logger->debug('valid token for ' . $dbToken->getUID());
+ return $dbToken;
+ } catch (DoesNotExistException $ex) {
+ $this->logger->warning('invalid token');
+ throw new InvalidTokenException();
+ }
+ }
+
+ /**
+ * @param string $token
+ * @return string
+ */
+ private function hashToken($token) {
+ $secret = $this->config->getSystemValue('secret');
+ return hash('sha512', $token . $secret);
+ }
+
+ /**
+ * Encrypt the given password
+ *
+ * The token is used as key
+ *
+ * @param string $password
+ * @param string $token
+ * @return string encrypted password
+ */
+ private function encryptPassword($password, $token) {
+ $secret = $this->config->getSystemValue('secret');
+ return $this->crypto->encrypt($password, $token . $secret);
+ }
+
+ /**
+ * Decrypt the given password
+ *
+ * The token is used as key
+ *
+ * @param string $password
+ * @param string $token
+ * @return string the decrypted key
+ */
+ private function decryptPassword($password, $token) {
+ $secret = $this->config->getSystemValue('secret');
+ try {
+ return $this->crypto->decrypt($password, $token . $secret);
+ } catch (Exception $ex) {
+ // Delete the invalid token
+ $this->invalidateToken($token);
+ throw new InvalidTokenException();
+ }
+ }
+
+}
diff --git a/lib/private/Authentication/Token/IProvider.php b/lib/private/Authentication/Token/IProvider.php
new file mode 100644
index 00000000000..f8a3262ca8b
--- /dev/null
+++ b/lib/private/Authentication/Token/IProvider.php
@@ -0,0 +1,42 @@
+<?php
+
+/**
+ * @author Christoph Wurst <christoph@owncloud.com>
+ *
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+namespace OC\Authentication\Token;
+
+use OC\Authentication\Exceptions\InvalidTokenException;
+
+interface IProvider {
+
+ /**
+ * @param string $token
+ * @throws InvalidTokenException
+ * @return IToken
+ */
+ public function validateToken($token);
+
+ /**
+ * Update token activity timestamp
+ *
+ * @param IToken $token
+ */
+ public function updateToken(IToken $token);
+}
diff --git a/lib/private/Authentication/Token/IToken.php b/lib/private/Authentication/Token/IToken.php
new file mode 100644
index 00000000000..9b2bd18f83b
--- /dev/null
+++ b/lib/private/Authentication/Token/IToken.php
@@ -0,0 +1,46 @@
+<?php
+
+/**
+ * @author Christoph Wurst <christoph@owncloud.com>
+ *
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+namespace OC\Authentication\Token;
+
+/**
+ * @since 9.1.0
+ */
+interface IToken {
+
+ const TEMPORARY_TOKEN = 0;
+ const PERMANENT_TOKEN = 1;
+
+ /**
+ * Get the token ID
+ *
+ * @return string
+ */
+ public function getId();
+
+ /**
+ * Get the user UID
+ *
+ * @return string
+ */
+ public function getUID();
+}
diff --git a/lib/private/Server.php b/lib/private/Server.php
index bbe6b88876f..cbab1f09ebd 100644
--- a/lib/private/Server.php
+++ b/lib/private/Server.php
@@ -5,6 +5,7 @@
* @author Bernhard Posselt <dev@bernhard-posselt.com>
* @author Bernhard Reiter <ockham@raz.or.at>
* @author Björn Schießle <schiessle@owncloud.com>
+ * @author Christoph Wurst <christoph@owncloud.com>
* @author Christopher Schäpers <kondou@ts.unde.re>
* @author Joas Schilling <nickvergessen@owncloud.com>
* @author Jörn Friedrich Dreyer <jfd@butonic.de>
@@ -208,12 +209,35 @@ class Server extends ServerContainer implements IServerContainer {
});
return $groupManager;
});
+ $this->registerService('OC\Authentication\Token\DefaultTokenMapper', function (Server $c) {
+ $dbConnection = $c->getDatabaseConnection();
+ return new Authentication\Token\DefaultTokenMapper($dbConnection);
+ });
+ $this->registerService('OC\Authentication\Token\DefaultTokenProvider', function (Server $c) {
+ $mapper = $c->query('OC\Authentication\Token\DefaultTokenMapper');
+ $crypto = $c->getCrypto();
+ $config = $c->getConfig();
+ $logger = $c->getLogger();
+ $timeFactory = new TimeFactory();
+ return new \OC\Authentication\Token\DefaultTokenProvider($mapper, $crypto, $config, $logger, $timeFactory);
+ });
$this->registerService('UserSession', function (Server $c) {
$manager = $c->getUserManager();
-
$session = new \OC\Session\Memory('');
-
- $userSession = new \OC\User\Session($manager, $session);
+ $timeFactory = new TimeFactory();
+ // Token providers might require a working database. This code
+ // might however be called when ownCloud is not yet setup.
+ if (\OC::$server->getSystemConfig()->getValue('installed', false)) {
+ $defaultTokenProvider = $c->query('OC\Authentication\Token\DefaultTokenProvider');
+ $tokenProviders = [
+ $defaultTokenProvider,
+ ];
+ } else {
+ $defaultTokenProvider = null;
+ $tokenProviders = [];
+ }
+
+ $userSession = new \OC\User\Session($manager, $session, $timeFactory, $defaultTokenProvider, $tokenProviders);
$userSession->listen('\OC\User', 'preCreateUser', function ($uid, $password) {
\OC_Hook::emit('OC_User', 'pre_createUser', array('run' => true, 'uid' => $uid, 'password' => $password));
});
diff --git a/lib/private/Setup.php b/lib/private/Setup.php
index 23c66f98b7c..67d714188ac 100644
--- a/lib/private/Setup.php
+++ b/lib/private/Setup.php
@@ -364,7 +364,14 @@ class Setup {
$group =\OC::$server->getGroupManager()->createGroup('admin');
$group->addUser($user);
- \OC_User::login($username, $password);
+
+ // Create a session token for the newly created user
+ // The token provider requires a working db, so it's not injected on setup
+ /* @var $userSession User\Session */
+ $userSession = \OC::$server->getUserSession();
+ $defaultTokenProvider = \OC::$server->query('OC\Authentication\Token\DefaultTokenProvider');
+ $userSession->setTokenProvider($defaultTokenProvider);
+ $userSession->createSessionToken($request, $username, $password);
//guess what this does
Installer::installShippedApps();
@@ -382,6 +389,8 @@ class Setup {
$config->setSystemValue('logtimezone', date_default_timezone_get());
}
+ self::installBackgroundJobs();
+
//and we are done
$config->setSystemValue('installed', true);
}
@@ -389,6 +398,10 @@ class Setup {
return $error;
}
+ public static function installBackgroundJobs() {
+ \OC::$server->getJobList()->add('\OC\Authentication\Token\DefaultTokenCleanupJob');
+ }
+
/**
* @return string Absolute path to htaccess
*/
diff --git a/lib/private/Updater.php b/lib/private/Updater.php
index 7ca3cd09362..dbcaccaad26 100644
--- a/lib/private/Updater.php
+++ b/lib/private/Updater.php
@@ -216,6 +216,8 @@ class Updater extends BasicEmitter {
try {
Setup::updateHtaccess();
Setup::protectDataDirectory();
+ // TODO: replace with the new repair step mechanism https://github.com/owncloud/core/pull/24378
+ Setup::installBackgroundJobs();
} catch (\Exception $e) {
throw new \Exception($e->getMessage());
}
diff --git a/lib/private/User/Session.php b/lib/private/User/Session.php
index c7f8a6920de..c9f42d7e414 100644
--- a/lib/private/User/Session.php
+++ b/lib/private/User/Session.php
@@ -1,7 +1,9 @@
<?php
+
/**
* @author Arthur Schiwon <blizzz@owncloud.com>
* @author Bernhard Posselt <dev@bernhard-posselt.com>
+ * @author Christoph Wurst <christoph@owncloud.com>
* @author Joas Schilling <nickvergessen@owncloud.com>
* @author Jörn Friedrich Dreyer <jfd@butonic.de>
* @author Lukas Reschke <lukas@owncloud.com>
@@ -31,10 +33,22 @@
namespace OC\User;
+use OC;
+use OC\Authentication\Exceptions\InvalidTokenException;
+use OC\Authentication\Token\DefaultTokenProvider;
+use OC\Authentication\Token\IProvider;
+use OC\Authentication\Token\IToken;
use OC\Hooks\Emitter;
+use OC_User;
+use OC_Util;
+use OCA\DAV\Connector\Sabre\Auth;
+use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\IRequest;
use OCP\ISession;
+use OCP\IUser;
use OCP\IUserManager;
use OCP\IUserSession;
+use OCP\Session\Exceptions\SessionNotAvailableException;
/**
* Class Session
@@ -55,22 +69,57 @@ use OCP\IUserSession;
* @package OC\User
*/
class Session implements IUserSession, Emitter {
- /** @var \OC\User\Manager $manager */
+ /*
+ * @var Manager $manager
+ */
+
private $manager;
- /** @var \OC\Session\Session $session */
+ /*
+ * @var ISession $session
+ */
private $session;
- /** @var \OC\User\User $activeUser */
+ /*
+ * @var ITimeFactory
+ */
+ private $timeFacory;
+
+ /**
+ * @var DefaultTokenProvider
+ */
+ private $tokenProvider;
+
+ /**
+ * @var IProvider[]
+ */
+ private $tokenProviders;
+
+ /**
+ * @var User $activeUser
+ */
protected $activeUser;
/**
* @param IUserManager $manager
* @param ISession $session
+ * @param ITimeFactory $timeFacory
+ * @param IProvider $tokenProvider
+ * @param IProvider[] $tokenProviders
*/
- public function __construct(IUserManager $manager, ISession $session) {
+ public function __construct(IUserManager $manager, ISession $session, ITimeFactory $timeFacory, $tokenProvider, array $tokenProviders = []) {
$this->manager = $manager;
$this->session = $session;
+ $this->timeFacory = $timeFacory;
+ $this->tokenProvider = $tokenProvider;
+ $this->tokenProviders = $tokenProviders;
+ }
+
+ /**
+ * @param DefaultTokenProvider $provider
+ */
+ public function setTokenProvider(DefaultTokenProvider $provider) {
+ $this->tokenProvider = $provider;
}
/**
@@ -94,7 +143,7 @@ class Session implements IUserSession, Emitter {
/**
* get the manager object
*
- * @return \OC\User\Manager
+ * @return Manager
*/
public function getManager() {
return $this->manager;
@@ -125,7 +174,7 @@ class Session implements IUserSession, Emitter {
/**
* set the currently active user
*
- * @param \OC\User\User|null $user
+ * @param User|null $user
*/
public function setUser($user) {
if (is_null($user)) {
@@ -139,25 +188,65 @@ class Session implements IUserSession, Emitter {
/**
* get the current active user
*
- * @return \OCP\IUser|null Current user, otherwise null
+ * @return IUser|null Current user, otherwise null
*/
public function getUser() {
// FIXME: This is a quick'n dirty work-around for the incognito mode as
// described at https://github.com/owncloud/core/pull/12912#issuecomment-67391155
- if (\OC_User::isIncognitoMode()) {
+ if (OC_User::isIncognitoMode()) {
return null;
}
- if ($this->activeUser) {
- return $this->activeUser;
- } else {
+ if (is_null($this->activeUser)) {
$uid = $this->session->get('user_id');
- if ($uid !== null) {
- $this->activeUser = $this->manager->get($uid);
- return $this->activeUser;
- } else {
+ if (is_null($uid)) {
+ return null;
+ }
+ $this->activeUser = $this->manager->get($uid);
+ if (is_null($this->activeUser)) {
return null;
}
+ $this->validateSession($this->activeUser);
}
+ return $this->activeUser;
+ }
+
+ protected function validateSession(IUser $user) {
+ try {
+ $sessionId = $this->session->getId();
+ } catch (SessionNotAvailableException $ex) {
+ return;
+ }
+ try {
+ $token = $this->tokenProvider->getToken($sessionId);
+ } catch (InvalidTokenException $ex) {
+ // Session was invalidated
+ $this->logout();
+ return;
+ }
+
+ // Check whether login credentials are still valid
+ // This check is performed each 5 minutes
+ $lastCheck = $this->session->get('last_login_check') ? : 0;
+ $now = $this->timeFacory->getTime();
+ if ($lastCheck < ($now - 60 * 5)) {
+ try {
+ $pwd = $this->tokenProvider->getPassword($token, $sessionId);
+ } catch (InvalidTokenException $ex) {
+ // An invalid token password was used -> log user out
+ $this->logout();
+ return;
+ }
+
+ if ($this->manager->checkPassword($user->getUID(), $pwd) === false) {
+ // Password has changed -> log user out
+ $this->logout();
+ return;
+ }
+ $this->session->set('last_login_check', $now);
+ }
+
+ // Session is valid, so the token can be refreshed
+ $this->updateToken($this->tokenProvider, $token);
}
/**
@@ -218,6 +307,11 @@ class Session implements IUserSession, Emitter {
$this->session->regenerateId();
$this->manager->emit('\OC\User', 'preLogin', array($uid, $password));
$user = $this->manager->checkPassword($uid, $password);
+ if ($user === false) {
+ if ($this->validateToken($password)) {
+ $user = $this->getUser();
+ }
+ }
if ($user !== false) {
if (!is_null($user)) {
if ($user->isEnabled()) {
@@ -225,6 +319,7 @@ class Session implements IUserSession, Emitter {
$this->setLoginName($uid);
$this->manager->emit('\OC\User', 'postLogin', array($user, $password));
if ($this->isLoggedIn()) {
+ $this->prepareUserLogin();
return true;
} else {
// injecting l10n does not work - there is a circular dependency between session and \OCP\L10N\IFactory
@@ -241,6 +336,142 @@ class Session implements IUserSession, Emitter {
return false;
}
+ protected function prepareUserLogin() {
+ // TODO: mock/inject/use non-static
+ // Refresh the token
+ \OC::$server->getCsrfTokenManager()->refreshToken();
+ //we need to pass the user name, which may differ from login name
+ $user = $this->getUser()->getUID();
+ OC_Util::setupFS($user);
+ //trigger creation of user home and /files folder
+ \OC::$server->getUserFolder($user);
+ }
+
+ /**
+ * Tries to login the user with HTTP Basic Authentication
+ *
+ * @param IRequest $request
+ * @return boolean if the login was successful
+ */
+ public function tryBasicAuthLogin(IRequest $request) {
+ if (!empty($request->server['PHP_AUTH_USER']) && !empty($request->server['PHP_AUTH_PW'])) {
+ $result = $this->login($request->server['PHP_AUTH_USER'], $request->server['PHP_AUTH_PW']);
+ if ($result === true) {
+ /**
+ * Add DAV authenticated. This should in an ideal world not be
+ * necessary but the iOS App reads cookies from anywhere instead
+ * only the DAV endpoint.
+ * This makes sure that the cookies will be valid for the whole scope
+ * @see https://github.com/owncloud/core/issues/22893
+ */
+ $this->session->set(
+ Auth::DAV_AUTHENTICATED, $this->getUser()->getUID()
+ );
+ return true;
+ }
+ }
+ return false;
+ }
+
+ private function loginWithToken($uid) {
+ // TODO: $this->manager->emit('\OC\User', 'preTokenLogin', array($uid));
+ $user = $this->manager->get($uid);
+ if (is_null($user)) {
+ // user does not exist
+ return false;
+ }
+
+ //login
+ $this->setUser($user);
+ // TODO: $this->manager->emit('\OC\User', 'postTokenLogin', array($user));
+ return true;
+ }
+
+ /**
+ * Create a new session token for the given user credentials
+ *
+ * @param IRequest $request
+ * @param string $uid user UID
+ * @param string $password
+ * @return boolean
+ */
+ public function createSessionToken(IRequest $request, $uid, $password) {
+ if (is_null($this->manager->get($uid))) {
+ // User does not exist
+ return false;
+ }
+ $name = isset($request->server['HTTP_USER_AGENT']) ? $request->server['HTTP_USER_AGENT'] : 'unknown browser';
+ $loggedIn = $this->login($uid, $password);
+ if ($loggedIn) {
+ try {
+ $sessionId = $this->session->getId();
+ $this->tokenProvider->generateToken($sessionId, $uid, $password, $name);
+ } catch (SessionNotAvailableException $ex) {
+
+ }
+ }
+ return $loggedIn;
+ }
+
+ /**
+ * @param string $token
+ * @return boolean
+ */
+ private function validateToken($token) {
+ foreach ($this->tokenProviders as $provider) {
+ try {
+ $token = $provider->validateToken($token);
+ if (!is_null($token)) {
+ $result = $this->loginWithToken($token->getUID());
+ if ($result) {
+ // Login success
+ $this->updateToken($provider, $token);
+ return true;
+ }
+ }
+ } catch (InvalidTokenException $ex) {
+
+ }
+ }
+ return false;
+ }
+
+ /**
+ * @param IProvider $provider
+ * @param IToken $token
+ */
+ private function updateToken(IProvider $provider, IToken $token) {
+ // To save unnecessary DB queries, this is only done once a minute
+ $lastTokenUpdate = $this->session->get('last_token_update') ? : 0;
+ $now = $this->timeFacory->getTime();
+ if ($lastTokenUpdate < ($now - 60)) {
+ $provider->updateToken($token);
+ $this->session->set('last_token_update', $now);
+ }
+ }
+
+ /**
+ * Tries to login the user with auth token header
+ *
+ * @todo check remember me cookie
+ * @return boolean
+ */
+ public function tryTokenLogin(IRequest $request) {
+ $authHeader = $request->getHeader('Authorization');
+ if (strpos($authHeader, 'token ') === false) {
+ // No auth header, let's try session id
+ try {
+ $sessionId = $this->session->getId();
+ return $this->validateToken($sessionId);
+ } catch (SessionNotAvailableException $ex) {
+ return false;
+ }
+ } else {
+ $token = substr($authHeader, 6);
+ return $this->validateToken($token);
+ }
+ }
+
/**
* perform login using the magic cookie (remember login)
*
@@ -258,15 +489,15 @@ class Session implements IUserSession, Emitter {
}
// get stored tokens
- $tokens = \OC::$server->getConfig()->getUserKeys($uid, 'login_token');
+ $tokens = OC::$server->getConfig()->getUserKeys($uid, 'login_token');
// test cookies token against stored tokens
if (!in_array($currentToken, $tokens, true)) {
return false;
}
// replace successfully used token with a new one
- \OC::$server->getConfig()->deleteUserValue($uid, 'login_token', $currentToken);
- $newToken = \OC::$server->getSecureRandom()->generate(32);
- \OC::$server->getConfig()->setUserValue($uid, 'login_token', $newToken, time());
+ OC::$server->getConfig()->deleteUserValue($uid, 'login_token', $currentToken);
+ $newToken = OC::$server->getSecureRandom()->generate(32);
+ OC::$server->getConfig()->setUserValue($uid, 'login_token', $newToken, time());
$this->setMagicInCookie($user->getUID(), $newToken);
//login
@@ -280,6 +511,14 @@ class Session implements IUserSession, Emitter {
*/
public function logout() {
$this->manager->emit('\OC\User', 'logout');
+ $user = $this->getUser();
+ if (!is_null($user)) {
+ try {
+ $this->tokenProvider->invalidateToken($this->session->getId());
+ } catch (SessionNotAvailableException $ex) {
+
+ }
+ }
$this->setUser(null);
$this->setLoginName(null);
$this->unsetMagicInCookie();
@@ -293,11 +532,11 @@ class Session implements IUserSession, Emitter {
* @param string $token
*/
public function setMagicInCookie($username, $token) {
- $secureCookie = \OC::$server->getRequest()->getServerProtocol() === 'https';
- $expires = time() + \OC::$server->getConfig()->getSystemValue('remember_login_cookie_lifetime', 60 * 60 * 24 * 15);
- setcookie("oc_username", $username, $expires, \OC::$WEBROOT, '', $secureCookie, true);
- setcookie("oc_token", $token, $expires, \OC::$WEBROOT, '', $secureCookie, true);
- setcookie("oc_remember_login", "1", $expires, \OC::$WEBROOT, '', $secureCookie, true);
+ $secureCookie = OC::$server->getRequest()->getServerProtocol() === 'https';
+ $expires = time() + OC::$server->getConfig()->getSystemValue('remember_login_cookie_lifetime', 60 * 60 * 24 * 15);
+ setcookie('oc_username', $username, $expires, OC::$WEBROOT, '', $secureCookie, true);
+ setcookie('oc_token', $token, $expires, OC::$WEBROOT, '', $secureCookie, true);
+ setcookie('oc_remember_login', '1', $expires, OC::$WEBROOT, '', $secureCookie, true);
}
/**
@@ -305,18 +544,19 @@ class Session implements IUserSession, Emitter {
*/
public function unsetMagicInCookie() {
//TODO: DI for cookies and IRequest
- $secureCookie = \OC::$server->getRequest()->getServerProtocol() === 'https';
-
- unset($_COOKIE["oc_username"]); //TODO: DI
- unset($_COOKIE["oc_token"]);
- unset($_COOKIE["oc_remember_login"]);
- setcookie('oc_username', '', time() - 3600, \OC::$WEBROOT, '',$secureCookie, true);
- setcookie('oc_token', '', time() - 3600, \OC::$WEBROOT, '', $secureCookie, true);
- setcookie('oc_remember_login', '', time() - 3600, \OC::$WEBROOT, '', $secureCookie, true);
+ $secureCookie = OC::$server->getRequest()->getServerProtocol() === 'https';
+
+ unset($_COOKIE['oc_username']); //TODO: DI
+ unset($_COOKIE['oc_token']);
+ unset($_COOKIE['oc_remember_login']);
+ setcookie('oc_username', '', time() - 3600, OC::$WEBROOT, '', $secureCookie, true);
+ setcookie('oc_token', '', time() - 3600, OC::$WEBROOT, '', $secureCookie, true);
+ setcookie('oc_remember_login', '', time() - 3600, OC::$WEBROOT, '', $secureCookie, true);
// old cookies might be stored under /webroot/ instead of /webroot
// and Firefox doesn't like it!
- setcookie('oc_username', '', time() - 3600, \OC::$WEBROOT . '/', '', $secureCookie, true);
- setcookie('oc_token', '', time() - 3600, \OC::$WEBROOT . '/', '', $secureCookie, true);
- setcookie('oc_remember_login', '', time() - 3600, \OC::$WEBROOT . '/', '', $secureCookie, true);
+ setcookie('oc_username', '', time() - 3600, OC::$WEBROOT . '/', '', $secureCookie, true);
+ setcookie('oc_token', '', time() - 3600, OC::$WEBROOT . '/', '', $secureCookie, true);
+ setcookie('oc_remember_login', '', time() - 3600, OC::$WEBROOT . '/', '', $secureCookie, true);
}
+
}
diff --git a/lib/private/legacy/api.php b/lib/private/legacy/api.php
index 702b9df1927..60300c88b57 100644
--- a/lib/private/legacy/api.php
+++ b/lib/private/legacy/api.php
@@ -337,7 +337,7 @@ class OC_API {
}
// reuse existing login
- $loggedIn = OC_User::isLoggedIn();
+ $loggedIn = \OC::$server->getUserSession()->isLoggedIn();
if ($loggedIn === true) {
$ocsApiRequest = isset($_SERVER['HTTP_OCS_APIREQUEST']) ? $_SERVER['HTTP_OCS_APIREQUEST'] === 'true' : false;
if ($ocsApiRequest) {
@@ -353,35 +353,25 @@ class OC_API {
// basic auth - because OC_User::login will create a new session we shall only try to login
// if user and pass are set
- if(isset($_SERVER['PHP_AUTH_USER']) && isset($_SERVER['PHP_AUTH_PW']) ) {
- $authUser = $_SERVER['PHP_AUTH_USER'];
- $authPw = $_SERVER['PHP_AUTH_PW'];
- try {
- $return = OC_User::login($authUser, $authPw);
- } catch (\OC\User\LoginException $e) {
- return false;
+ $userSession = \OC::$server->getUserSession();
+ $request = \OC::$server->getRequest();
+ try {
+ $loginSuccess = $userSession->tryTokenLogin($request);
+ if (!$loginSuccess) {
+ $loginSuccess = $userSession->tryBasicAuthLogin($request);
}
- if ($return === true) {
- self::$logoutRequired = true;
-
- // initialize the user's filesystem
- \OC_Util::setUpFS(\OC_User::getUser());
- self::$isLoggedIn = true;
+ } catch (\OC\User\LoginException $e) {
+ return false;
+ }
+
+ if ($loginSuccess === true) {
+ self::$logoutRequired = true;
- /**
- * Add DAV authenticated. This should in an ideal world not be
- * necessary but the iOS App reads cookies from anywhere instead
- * only the DAV endpoint.
- * This makes sure that the cookies will be valid for the whole scope
- * @see https://github.com/owncloud/core/issues/22893
- */
- \OC::$server->getSession()->set(
- \OCA\DAV\Connector\Sabre\Auth::DAV_AUTHENTICATED,
- \OC::$server->getUserSession()->getUser()->getUID()
- );
+ // initialize the user's filesystem
+ \OC_Util::setUpFS(\OC_User::getUser());
+ self::$isLoggedIn = true;
- return \OC_User::getUser();
- }
+ return \OC_User::getUser();
}
return false;
diff --git a/lib/private/legacy/user.php b/lib/private/legacy/user.php
index 7855b5e7059..499e916994a 100644
--- a/lib/private/legacy/user.php
+++ b/lib/private/legacy/user.php
@@ -6,6 +6,7 @@
* @author Bart Visscher <bartv@thisnet.nl>
* @author Bartek Przybylski <bart.p.pl@gmail.com>
* @author Björn Schießle <schiessle@owncloud.com>
+ * @author Christoph Wurst <christoph@owncloud.com>
* @author Florian Preinstorfer <nblock@archlinux.us>
* @author Georg Ehrke <georg@owncloud.com>
* @author Jakob Sack <mail@jakobsack.de>
@@ -67,7 +68,7 @@ class OC_User {
private static $_setupedBackends = array();
- // bool, stores if a user want to access a resource anonymously, e.g if he opens a public link
+ // bool, stores if a user want to access a resource anonymously, e.g if they open a public link
private static $incognitoMode = false;
/**
@@ -148,37 +149,7 @@ class OC_User {
}
/**
- * Try to login a user
- *
- * @param string $loginName The login name of the user to log in
- * @param string $password The password of the user
- * @return boolean|null
- *
- * Log in a user and regenerate a new session - if the password is ok
- */
- public static function login($loginName, $password) {
- $result = self::getUserSession()->login($loginName, $password);
- if (!$result) {
- $users = \OC::$server->getUserManager()->getByEmail($loginName);
- // we only allow login by email if unique
- if (count($users) === 1) {
- $result = self::getUserSession()->login($users[0]->getUID(), $password);
- }
- }
- if ($result) {
- // Refresh the token
- \OC::$server->getCsrfTokenManager()->refreshToken();
- //we need to pass the user name, which may differ from login name
- $user = self::getUserSession()->getUser()->getUID();
- OC_Util::setupFS($user);
- //trigger creation of user home and /files folder
- \OC::$server->getUserFolder($user);
- }
- return $result;
- }
-
- /**
* Try to login a user using the magic cookie (remember login)
*
* @deprecated use \OCP\IUserSession::loginWithCookie()
@@ -284,28 +255,6 @@ class OC_User {
}
/**
- * Tries to login the user with HTTP Basic Authentication
- */
- public static function tryBasicAuthLogin() {
- if (!empty($_SERVER['PHP_AUTH_USER']) && !empty($_SERVER['PHP_AUTH_PW'])) {
- $result = \OC_User::login($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']);
- if($result === true) {
- /**
- * Add DAV authenticated. This should in an ideal world not be
- * necessary but the iOS App reads cookies from anywhere instead
- * only the DAV endpoint.
- * This makes sure that the cookies will be valid for the whole scope
- * @see https://github.com/owncloud/core/issues/22893
- */
- \OC::$server->getSession()->set(
- \OCA\DAV\Connector\Sabre\Auth::DAV_AUTHENTICATED,
- \OC::$server->getUserSession()->getUser()->getUID()
- );
- }
- }
- }
-
- /**
* Check if the user is logged in, considers also the HTTP basic credentials
*
* @deprecated use \OC::$server->getUserSession()->isLoggedIn()
diff --git a/lib/private/legacy/util.php b/lib/private/legacy/util.php
index b3432470f03..4f7a8668dfc 100644
--- a/lib/private/legacy/util.php
+++ b/lib/private/legacy/util.php
@@ -957,8 +957,7 @@ class OC_Util {
public static function checkLoggedIn() {
// Check if we are a user
if (!OC_User::isLoggedIn()) {
- header('Location: ' . \OC::$server->getURLGenerator()->linkToRoute(
- 'core.login.showLoginForm',
+ header('Location: ' . \OCP\Util::linkToAbsolute('', 'index.php',
[
'redirect_url' => \OC::$server->getRequest()->getRequestUri()
]
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-25 09:36:25 +0000