summaryrefslogtreecommitdiffstats
path: root/core/Controller
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request #5907 from nextcloud/add-metadata-to-throttle-callMorris Jobke2017-08-011-1/+1
|\ | | | | Add metadata to \OCP\AppFramework\Http\Response::throttle
| * Add metadata to \OCP\AppFramework\Http\Response::throttleLukas Reschke2017-07-271-1/+1
| | | | | | | | | | | | Fixes https://github.com/nextcloud/server/issues/5891 Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* | Fix OCSControllerRoeland Jago Douma2017-08-011-3/+3
| | | | | | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* | Fix ContactsMenuControllerRoeland Jago Douma2017-08-011-4/+3
| | | | | | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* | Fix AvatarControllerRoeland Jago Douma2017-08-011-2/+3
|/ | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Cleanup legacy user class from unused methodsMorris Jobke2017-07-241-1/+1
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Add public capabilities APIJulius Härtl2017-06-301-2/+7
| | | | Signed-off-by: Julius Härtl <jus@bitgrid.net>
* Add Clear-Site-Data headerLukas Reschke2017-06-201-1/+3
| | | | | | | | | | This adds a Clear-Site-Data header to the logout response which will delete all relevant data in the caches which may contain potentially sensitive content. See https://w3c.github.io/webappsec-clear-site-data/#header for the definition of the types. Ref https://twitter.com/mikewest/status/877149667909406723 Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Add tests for ClientFlowLoginControllerLukas Reschke2017-05-181-6/+4
| | | | Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Add OAuth state to sessionLukas Reschke2017-05-181-24/+18
| | | | Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* use name of oauth app to identify auth tokenBjoern Schiessle2017-05-181-2/+10
| | | | Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
* show error page if no valid client identifier is given and if it is not a ↵Bjoern Schiessle2017-05-181-5/+24
| | | | | | API request Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
* Remove special charactersLukas Reschke2017-05-181-1/+1
| | | | Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Add basic implementation for OAuth 2.0 Authorization Code FlowLukas Reschke2017-05-181-20/+72
| | | | Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Disable the API endpoints as wellJoas Schilling2017-05-111-0/+16
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Disable reset password link. Issue: #27440Ujjwal Bhardwaj2017-05-111-0/+2
|
* Automatic injection for CssControllerJoas Schilling2017-05-101-3/+4
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Automatic injection for JsControllerJoas Schilling2017-05-101-3/+4
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Update login flow redirectionMario Danic2017-05-041-1/+1
| | | | Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Handle more error casesMorris Jobke2017-05-021-0/+2
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* add contactsmenu popoverGeorg Ehrke2017-04-261-0/+17
| | | | Signed-off-by: Georg Ehrke <developer@georgehrke.com>
* Merge branch 'master' into contactsmenuJan-Christoph Borchardt2017-04-261-0/+238
|\ | | | | | | Signed-off-by: Jan-Christoph Borchardt <hey@jancborchardt.net>
| * AppToken to 72 charsRoeland Jago Douma2017-04-251-1/+1
| | | | | | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
| * Do not remove the state token to earlyRoeland Jago Douma2017-04-251-1/+3
| | | | | | | | | | | | | | we should check the stateToken before we remove it. Else the check will always fail. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
| * Add new auth flowLukas Reschke2017-04-251-0/+236
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This implements the basics for the new app-password based authentication flow for our clients. The current implementation tries to keep it as simple as possible and works the following way: 1. Unauthenticated client opens `/index.php/login/flow` 2. User will be asked whether they want to grant access to the client 3. If accepted the user has the chance to do so using existing App Token or automatically generate an app password. If the user chooses to use an existing app token then that one will simply be redirected to the `nc://` protocol handler. While we can improve on that in the future, I think keeping this smaller at the moment has its advantages. Also, in the near future we have to think about an automatic migration endpoint so there's that anyways :-) If the user chooses to use the regular login the following happens: 1. A session state token is written to the session 2. User is redirected to the login page 3. If successfully authenticated they will be redirected to a page redirecting to the POST controller 4. The POST controller will check if the CSRF token as well as the state token is correct, if yes the user will be redirected to the `nc://` protocol handler. This approach is quite simple but also allows to be extended in the future. One could for example allow external websites to consume this authentication endpoint as well. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* | Let apps register contact menu provider via info.xmlChristoph Wurst2017-04-251-6/+7
| | | | | | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* | Contacts menuChristoph Wurst2017-04-251-0/+61
|/ | | | | | | * load list of contacts from the server * show last message of each contact Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Fix remember redirect_url on failed login attemptsChristoph Wurst2017-04-251-0/+3
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Merge pull request #4443 from nextcloud/cleanup-unused-importsJoas Schilling2017-04-241-1/+0
|\ | | | | Remove unused use statements
| * Remove unused use statementsMorris Jobke2017-04-221-1/+0
| | | | | | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* | Merge pull request #4434 from ↵Lukas Reschke2017-04-241-0/+2
|\ \ | | | | | | | | | | | | nextcloud/add-rate-limiting-to-solve-challenge-controller Add rate limit to TOTP solve challenge controller
| * | Add rate limit to TOTP solve challenge controllerLukas Reschke2017-04-221-0/+2
| |/ | | | | | | | | | | Fixes https://github.com/nextcloud/server/issues/2626 Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* / Add at most 10 password reset requests per 5 minutes and IP rangeLukas Reschke2017-04-221-0/+1
|/ | | | Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Rename renderHTML to renderHtmlMorris Jobke2017-04-191-1/+1
| | | | | | | * fixes #4383 * improves consistency Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Adjust existing bruteforce protection codeLukas Reschke2017-04-142-12/+13
| | | | | | | - Moves code to annotation - Adds the `throttle()` call on the responses on existing annotations Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Make BruteForceProtection annotation more cleverLukas Reschke2017-04-131-25/+11
| | | | | | | | This makes the new `@BruteForceProtection` annotation more clever and moves the relevant code into it's own middleware. Basically you can now set `@BruteForceProtection(action=$key)` as annotation and that will make the controller bruteforce protected. However, the difference to before is that you need to call `$responmse->throttle()` to increase the counter. Before the counter was increased every time which leads to all kind of unexpected problems. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Merge pull request #4308 from nextcloud/lost-password-emailLukas Reschke2017-04-131-4/+18
|\ | | | | Update email template for lost password email
| * Update email template for lost password emailMorris Jobke2017-04-121-4/+18
| | | | | | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* | Merge pull request #2424 from ↵Morris Jobke2017-04-131-1/+4
|\ \ | | | | | | | | | | | | nextcloud/fix-login-controller-test-consolidate-login Fix login controller test and consolidate login
| * | do login routine only once when done via LoginControllerArthur Schiwon2017-04-061-1/+1
| | | | | | | | | | | | Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
| * | fix login controller testsArthur Schiwon2017-04-061-0/+3
| | | | | | | | | | | | Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* | | Add support for ratelimiting via annotationsLukas Reschke2017-04-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This allows adding rate limiting via annotations to controllers, as one example: ``` @UserRateThrottle(limit=5, period=100) @AnonRateThrottle(limit=1, period=100) ``` Would mean that logged-in users can access the page 5 times within 100 seconds, and anonymous users 1 time within 100 seconds. If only an AnonRateThrottle is specified that one will also be applied to logged-in users. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* | | Merge pull request #3043 from nextcloud/issue-3038-no-logentry-on-email-loginMorris Jobke2017-04-131-2/+10
|\ \ \ | |_|/ |/| | Dont create a log entry on email login
| * | Dont create a log entry on email loginJoas Schilling2017-04-071-2/+10
| |/ | | | | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* / Move OC_Defaults to OCP\DefaultsMorris Jobke2017-04-092-5/+7
|/ | | | | | | | | | | | | * currently there are two ways to access default values: OCP\Defaults or OC_Defaults (which is extended by OCA\Theming\ThemingDefaults) * our code used a mixture of both of them, which made it hard to work on theme values * this extended the public interface with the missing methods and uses them everywhere to only rely on the public interface Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Merge pull request #4123 from nextcloud/allow-password-reset-with-emailRoeland Jago Douma2017-04-051-13/+26
|\ | | | | Allow to reset the password with the email as an input
| * Allow to reset the password with the email as an inputJoas Schilling2017-03-281-13/+26
| | | | | | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* | Fix gzip files for SafariMorris Jobke2017-03-292-2/+2
| | | | | | | | | | | | | | * Safari support gzip only if the filename does not end on .gz - so this renames them to .gzip Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* | Allow to gzip CSS/JS filesRoeland Jago Douma2017-03-282-4/+60
|/ | | | | | | | | | Since in production the SCSS files are compiled once and the javascript files are combined once we can just as well gzip them aggresively. This means that once they are requested and the browser supports gzip we can just serve the gzipped file saving precious bandwidth. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* [PoC] JS CombinerRoeland Jago Douma2017-03-241-0/+80
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-29 11:34:28 +0000