summaryrefslogtreecommitdiffstats
path: root/core/Controller/LostController.php
Commit message (Collapse)AuthorAgeFilesLines
* refactor(core): Make all attribute arguments namedprovokateurin2024-07-271-6/+6
| | | | Signed-off-by: provokateurin <kate@provokateurin.de>
* refactor(core): Replace security annotations with respective attributesprovokateurin2024-07-261-15/+14
| | | | Signed-off-by: provokateurin <kate@provokateurin.de>
* chore: Add SPDX headerAndy Scherzinger2024-05-271-33/+4
| | | | Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
* feat: Limit email input on auth pages to 255 charsfenn-cs2024-03-211-0/+4
| | | | | | | | | Excessively long emails reported make server unresponsive. We could at some point, consider adding a configuration for sysadmins to bypass this setting on their instance if they want. Signed-off-by: fenn-cs <fenn25.fn@gmail.com>
* refactor(core): Switch to attribute based routingprovokateurin2024-02-211-0/+4
| | | | Signed-off-by: provokateurin <kate@provokateurin.de>
* feat: rename users to account or personVincent Petry2024-02-131-1/+1
| | | | | | Replace translated text in most locations Signed-off-by: Vincent Petry <vincent@nextcloud.com>
* refactor: Migrate IgnoreOpenAPI attributes to OpenAPIprovokateurin2024-01-181-2/+2
| | | | Signed-off-by: provokateurin <kate@provokateurin.de>
* chore: apply changes from Nextcloud coding standards 1.1.1Joas Schilling2023-11-231-7/+7
| | | | | Signed-off-by: Joas Schilling <coding@schilljs.com> Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
* core: Add OpenAPI specjld31032023-07-131-0/+3
| | | | Signed-off-by: jld3103 <jld3103yt@gmail.com>
* Applies agreed-upon indentation convention to the changed controllers.Faraz Samapoor2023-06-161-16/+18
| | | | | | Based on https://github.com/nextcloud/server/pull/38636#discussion_r1218167753 Signed-off-by: Faraz Samapoor <f.samapoor@gmail.com>
* Refactors controllers by using PHP8's constructor property promotion.Faraz Samapoor2023-06-161-45/+17
| | | | Signed-off-by: Faraz Samapoor <f.samapoor@gmail.com>
* fix(lostpassword): Also rate limit the setPassword endpointJoas Schilling2023-05-151-6/+12
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Trim user earlierJosh Richards2023-04-041-1/+3
| | | Signed-off-by: Josh Richards <josh.t.richards@gmail.com>
* Trim the user/email provided for password resetsJosh Richards2023-03-301-1/+1
| | | Signed-off-by: Josh Richards <josh.t.richards@gmail.com>
* Add bruteforce protection to password reset pageJoas Schilling2023-02-021-1/+5
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Add a const for the max user password lengthJoas Schilling2023-01-041-1/+1
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Also limit the password length on resetJoas Schilling2023-01-031-0/+4
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Add rate limiting on lost password emailsCôme Chilliet2022-10-181-6/+17
| | | | Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
* Update core/Controller/LostController.phpNoSleep822022-08-211-1/+1
| | | | Co-authored-by: John Molakvoæ <skjnldsv@users.noreply.github.com> Signed-off-by: NoSleep82 <52562874+NoSleep82@users.noreply.github.com>
* Update LostController.phpNoSleep822022-08-191-2/+2
| | | | | i would be useful to know who is trying to reset the password (misspelled username or email, ex user or some sort of attack) Signed-off-by: NoSleep82 <52562874+NoSleep82@users.noreply.github.com>
* Make LostController use IInitialState and LoggerInterfaceThomas Citharel2022-06-101-15/+15
| | | | Signed-off-by: Thomas Citharel <tcit@tcit.fr>
* Add password reset typed eventsThomas Citharel2022-06-101-1/+10
| | | | | | These hooks are only used in the Encryption app from what I can see. Signed-off-by: Thomas Citharel <tcit@tcit.fr>
* Update core to PHP 7.4 standardCarl Schwan2022-05-201-62/+24
| | | | | | | - Typed properties - Port to LoggerInterface Signed-off-by: Carl Schwan <carl@carlschwan.eu>
* Merge pull request #28794 from ↵Pytal2021-09-141-17/+15
|\ | | | | | | | | nextcloud/fix/noid/guest-activation-pwd-reset-disabled allow using of disabled password reset mechanism for special cases
| * allow using of disabled password reset mechanism for special casesArthur Schiwon2021-09-101-17/+15
| | | | | | | | | | | | | | | | | | | | | | | | - LostController has three endpoints - door opener email() still rejects - resetform(), reachable from mail, checks the token first and may report that password reset is disabled - setPassword() got its check removed as it is behind CSFR anyway and still requires a valid token - this allows special cases like activating a freshly created guest account Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* | fixes missing prefix to validate password reset tokenArthur Schiwon2021-09-101-1/+2
|/ | | | | | - also fixes the test which missed asserting the presence of it Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* add a job to clean up expired verification tokensArthur Schiwon2021-09-091-1/+1
| | | | Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* move verification token logic out of lost password controllerArthur Schiwon2021-09-091-82/+30
| | | | | | | - to make it reusable - needed for local email verification Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* Migrate HintException to OCPGary Kim2021-06-301-3/+3
| | | | Signed-off-by: Gary Kim <gary@garykim.dev>
* Update php licensesJohn Molakvoæ (skjnldsv)2021-06-041-1/+0
| | | | Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
* Send emails on password reset to the displaynameJoas Schilling2021-02-181-1/+1
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Format code to a single space around binary operatorsChristoph Wurst2020-10-051-3/+3
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Format control structures, classes, methods and functionChristoph Wurst2020-04-101-4/+4
| | | | | | | | | | | | | | | To continue this formatting madness, here's a tiny patch that adds unified formatting for control structures like if and loops as well as classes, their methods and anonymous functions. This basically forces the constructs to start on the same line. This is not exactly what PSR2 wants, but I think we can have a few exceptions with "our" style. The starting of braces on the same line is pracrically standard for our code. This also removes and empty lines from method/function bodies at the beginning and end. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Unify function spacing to PSR2 recommendationChristoph Wurst2020-04-091-1/+1
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Fix (array) indent style to always use one tabChristoph Wurst2020-04-091-2/+2
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Update the license headers for Nextcloud 19Christoph Wurst2020-03-311-1/+1
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Use the short array syntax, everywhereChristoph Wurst2020-03-261-7/+7
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Update license headersChristoph Wurst2019-12-051-1/+6
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Some php-cs fixesRoeland Jago Douma2019-11-221-8/+8
| | | | | | | | | | | * Order the imports * No leading slash on imports * Empty line before namespace * One line per import * Empty after imports * Emmpty line at bottom of file Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Stop if there is no encrypted tokenDaniel Kesselberg2019-08-181-1/+5
| | | | | | Fix Argument 1 passed to OC\Security\Crypto::decrypt() must be of the type string, null given Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* Merge pull request #16544 from nextcloud/bugfix/16540Roeland Jago Douma2019-07-311-5/+12
|\ | | | | Add missing password reset page to vue
| * Move actual password reset to vueJulius Härtl2019-07-311-5/+12
| | | | | | | | Signed-off-by: Julius Härtl <jus@bitgrid.net>
* | Use proper exception in lostControllerRoeland Jago Douma2019-07-271-18/+13
|/ | | | | | | | | | There is no need to log the expcetion of most of the stuff here. We should properly log them but an exception is excessive. This moves it to a proper exception which we can catch and then log. The other exceptions will still be fully logged. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Return first value from $usersDaniel Kesselberg2019-07-091-3/+6
| | | | Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* Clean pending 2FA authentication on password resetRoeland Jago Douma2019-01-291-2/+8
| | | | | | | | | | | When a password is reste we should make sure that all users are properly logged in. Pending states should be cleared. For example a session where the 2FA code is not entered yet should be cleared. The token is now removed so the session will be killed the next time this is checked (within 5 minutes). Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Generic message on password resetRoeland Jago Douma2019-01-151-5/+11
| | | | | | There is no need to inform the user if the account existed or not. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Merge pull request #10743 from ↵blizzz2018-09-131-9/+12
|\ | | | | | | | | danielkesselberg/bugfix/noid/allow-password-reset-for-duplicate-email Enable password reset for user with same email address when only one is active
| * Enable password reset for user with same email address when only one is activeDaniel Kesselberg2018-08-191-9/+12
| | | | | | | | | | | | | | | | | | When two or more user share the same email address its not possible to reset password by email. Even when only one account is active. This pr reduce list of users returned by getByEmail by disabled users. Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* | Change password expiration time from 12h to 7dMorris Jobke2018-08-311-1/+1
|/ | | | | | We use the same logic for creating accounts without a password and there the 12h is a bit short. Users don't expect that the signup link needs to be clicked within 12h - 7d should be a more expected behavior. Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* only warn about data lose on password reset if per-user keys are usedBjoern Schiessle2018-08-151-1/+10
| | | | Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-23 05:19:50 +0000