aboutsummaryrefslogtreecommitdiffstats
path: root/core/Controller/LostController.php
Commit message (Collapse)AuthorAgeFilesLines
* Make LostController use IInitialState and LoggerInterfaceThomas Citharel2022-06-101-15/+15
| | | | Signed-off-by: Thomas Citharel <tcit@tcit.fr>
* Add password reset typed eventsThomas Citharel2022-06-101-1/+10
| | | | | | These hooks are only used in the Encryption app from what I can see. Signed-off-by: Thomas Citharel <tcit@tcit.fr>
* Update core to PHP 7.4 standardCarl Schwan2022-05-201-62/+24
| | | | | | | - Typed properties - Port to LoggerInterface Signed-off-by: Carl Schwan <carl@carlschwan.eu>
* Merge pull request #28794 from ↵Pytal2021-09-141-17/+15
|\ | | | | | | | | nextcloud/fix/noid/guest-activation-pwd-reset-disabled allow using of disabled password reset mechanism for special cases
| * allow using of disabled password reset mechanism for special casesArthur Schiwon2021-09-101-17/+15
| | | | | | | | | | | | | | | | | | | | | | | | - LostController has three endpoints - door opener email() still rejects - resetform(), reachable from mail, checks the token first and may report that password reset is disabled - setPassword() got its check removed as it is behind CSFR anyway and still requires a valid token - this allows special cases like activating a freshly created guest account Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* | fixes missing prefix to validate password reset tokenArthur Schiwon2021-09-101-1/+2
|/ | | | | | - also fixes the test which missed asserting the presence of it Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* add a job to clean up expired verification tokensArthur Schiwon2021-09-091-1/+1
| | | | Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* move verification token logic out of lost password controllerArthur Schiwon2021-09-091-82/+30
| | | | | | | - to make it reusable - needed for local email verification Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* Migrate HintException to OCPGary Kim2021-06-301-3/+3
| | | | Signed-off-by: Gary Kim <gary@garykim.dev>
* Update php licensesJohn Molakvoæ (skjnldsv)2021-06-041-1/+0
| | | | Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
* Send emails on password reset to the displaynameJoas Schilling2021-02-181-1/+1
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Format code to a single space around binary operatorsChristoph Wurst2020-10-051-3/+3
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Format control structures, classes, methods and functionChristoph Wurst2020-04-101-4/+4
| | | | | | | | | | | | | | | To continue this formatting madness, here's a tiny patch that adds unified formatting for control structures like if and loops as well as classes, their methods and anonymous functions. This basically forces the constructs to start on the same line. This is not exactly what PSR2 wants, but I think we can have a few exceptions with "our" style. The starting of braces on the same line is pracrically standard for our code. This also removes and empty lines from method/function bodies at the beginning and end. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Unify function spacing to PSR2 recommendationChristoph Wurst2020-04-091-1/+1
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Fix (array) indent style to always use one tabChristoph Wurst2020-04-091-2/+2
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Update the license headers for Nextcloud 19Christoph Wurst2020-03-311-1/+1
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Use the short array syntax, everywhereChristoph Wurst2020-03-261-7/+7
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Update license headersChristoph Wurst2019-12-051-1/+6
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Some php-cs fixesRoeland Jago Douma2019-11-221-8/+8
| | | | | | | | | | | * Order the imports * No leading slash on imports * Empty line before namespace * One line per import * Empty after imports * Emmpty line at bottom of file Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Stop if there is no encrypted tokenDaniel Kesselberg2019-08-181-1/+5
| | | | | | Fix Argument 1 passed to OC\Security\Crypto::decrypt() must be of the type string, null given Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* Merge pull request #16544 from nextcloud/bugfix/16540Roeland Jago Douma2019-07-311-5/+12
|\ | | | | Add missing password reset page to vue
| * Move actual password reset to vueJulius Härtl2019-07-311-5/+12
| | | | | | | | Signed-off-by: Julius Härtl <jus@bitgrid.net>
* | Use proper exception in lostControllerRoeland Jago Douma2019-07-271-18/+13
|/ | | | | | | | | | There is no need to log the expcetion of most of the stuff here. We should properly log them but an exception is excessive. This moves it to a proper exception which we can catch and then log. The other exceptions will still be fully logged. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Return first value from $usersDaniel Kesselberg2019-07-091-3/+6
| | | | Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* Clean pending 2FA authentication on password resetRoeland Jago Douma2019-01-291-2/+8
| | | | | | | | | | | When a password is reste we should make sure that all users are properly logged in. Pending states should be cleared. For example a session where the 2FA code is not entered yet should be cleared. The token is now removed so the session will be killed the next time this is checked (within 5 minutes). Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Generic message on password resetRoeland Jago Douma2019-01-151-5/+11
| | | | | | There is no need to inform the user if the account existed or not. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Merge pull request #10743 from ↵blizzz2018-09-131-9/+12
|\ | | | | | | | | danielkesselberg/bugfix/noid/allow-password-reset-for-duplicate-email Enable password reset for user with same email address when only one is active
| * Enable password reset for user with same email address when only one is activeDaniel Kesselberg2018-08-191-9/+12
| | | | | | | | | | | | | | | | | | When two or more user share the same email address its not possible to reset password by email. Even when only one account is active. This pr reduce list of users returned by getByEmail by disabled users. Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* | Change password expiration time from 12h to 7dMorris Jobke2018-08-311-1/+1
|/ | | | | | We use the same logic for creating accounts without a password and there the 12h is a bit short. Users don't expect that the signup link needs to be clicked within 12h - 7d should be a more expected behavior. Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* only warn about data lose on password reset if per-user keys are usedBjoern Schiessle2018-08-151-1/+10
| | | | Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
* prefill userid for login after password resetRobin Appelman2018-06-211-3/+4
| | | | Signed-off-by: Robin Appelman <robin@icewind.nl>
* Fix translation bug on lost password pageRémy Jacquin2018-05-201-0/+3
| | | | | | Fix nextcloud/password_policy#26 Signed-off-by: Rémy Jacquin <remy@remyj.fr>
* Fix existing usagesJoas Schilling2018-02-151-2/+2
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* never translate login names when requiring with a user idArthur Schiwon2018-01-031-0/+6
| | | | | | where appropriate, the preLoginNameUsedAsUserName hook should be thrown. Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* Update license headersMorris Jobke2017-11-061-0/+1
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Set the data from the templateJoas Schilling2017-10-181-3/+1
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Set the subject with the email template to allow themingJoas Schilling2017-10-181-1/+2
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Merge setMetaData into constructorJoas Schilling2017-09-041-2/+1
| | | | | | This ensures that the meta data is set in the beginning Signed-off-by: Joas Schilling <coding@schilljs.com>
* Also for reset passwordJoas Schilling2017-08-241-0/+3
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* No password reset for disabled usersJoas Schilling2017-08-181-3/+12
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Cleanup legacy user class from unused methodsMorris Jobke2017-07-241-1/+1
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Disable the API endpoints as wellJoas Schilling2017-05-111-0/+16
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Merge pull request #4443 from nextcloud/cleanup-unused-importsJoas Schilling2017-04-241-1/+0
|\ | | | | Remove unused use statements
| * Remove unused use statementsMorris Jobke2017-04-221-1/+0
| | | | | | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* | Add at most 10 password reset requests per 5 minutes and IP rangeLukas Reschke2017-04-221-0/+1
|/ | | | Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Rename renderHTML to renderHtmlMorris Jobke2017-04-191-1/+1
| | | | | | | * fixes #4383 * improves consistency Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Adjust existing bruteforce protection codeLukas Reschke2017-04-141-3/+8
| | | | | | | - Moves code to annotation - Adds the `throttle()` call on the responses on existing annotations Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Merge pull request #4308 from nextcloud/lost-password-emailLukas Reschke2017-04-131-4/+18
|\ | | | | Update email template for lost password email
| * Update email template for lost password emailMorris Jobke2017-04-121-4/+18
| | | | | | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* | Add support for ratelimiting via annotationsLukas Reschke2017-04-131-1/+1
|/ | | | | | | | | | | | | This allows adding rate limiting via annotations to controllers, as one example: ``` @UserRateThrottle(limit=5, period=100) @AnonRateThrottle(limit=1, period=100) ``` Would mean that logged-in users can access the page 5 times within 100 seconds, and anonymous users 1 time within 100 seconds. If only an AnonRateThrottle is specified that one will also be applied to logged-in users. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-11 02:53:48 +0000