summaryrefslogtreecommitdiffstats
path: root/lib/private/User/Session.php
Commit message (Collapse)AuthorAgeFilesLines
* fix(auth): Fix logging in with email, password and login name mismatchChristoph Wurst2024-01-221-13/+24
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* fix(session): Avoid two useless authtoken DB queries for every anonymous requestGit'Fellow2024-01-171-2/+5
| | | | | | Co-Authored-By: Christoph Wurst <christoph@winzerhof-wurst.at> Signed-off-by: Git'Fellow <12234510+solracsf@users.noreply.github.com> Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* perf: Use more performant way to obtain and check the email as a login name ↵Julius Härtl2024-01-091-2/+11
| | | | | | with token login Signed-off-by: Julius Härtl <jus@bitgrid.net>
* Merge pull request #41383 from nextcloud/backport/41302/stable27Arthur Schiwon2023-11-151-1/+1
|\ | | | | [stable27] Lower log level about invalid session token
| * Lower log level about invalid session tokenPatrick Fischer2023-11-101-1/+1
| |
* | fix(session): Log why session renewal failedChristoph Wurst2023-11-021-1/+2
|/ | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* fix: Log critical session renewal and logout pathsChristoph Wurst2023-10-101-5/+33
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* fix(user): Log affected user of app token login name mismatchChristoph Wurst2023-10-061-0/+2
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* fix(dav): Abort requests with 429 instead of waitingJoas Schilling2023-05-031-2/+2
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Use typed version of IConfig::getSystemValue as much as possibleCôme Chilliet2023-04-051-3/+3
| | | | Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
* chore: use local variable for remote addressDaniel Kesselberg2023-03-101-10/+16
| | | | Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
* feat: add event for failed loginsRoeland Jago Douma2022-11-241-1/+1
| | | | | | | | Apps might also like to know about failed logins. This adds that event. The private interface changes are backwards compatible so all should be fine. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Remove potential mismatching dav session data during loginJulius Härtl2022-11-221-0/+1
| | | | Signed-off-by: Julius Härtl <jus@bitgrid.net>
* Fix errors from PHP 8.2 testingCôme Chilliet2022-11-141-3/+1
| | | | Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
* Fix unsuccessful token login logged as errorChristoph Wurst2022-11-071-1/+1
| | | | | | | | | | | | | The condition of a non-existent login token can happen for concurrent requests. Admins can not do anything about this. So this is to be expected to happen occasionally. This event is only bad if none of the requests is able to re-acquire a session. Luckily this happens rarely. If a login loop persists an admin can still lower the log level to find this info. But a default error log level will no longer write those infos about the failed cookie login of one request. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* dont try email login if the provider username is not a valid emailRobin Appelman2022-09-141-0/+3
| | | | Signed-off-by: Robin Appelman <robin@icewind.nl>
* Log if cookie login failed with token mismatch or session unavailabilityChristoph Wurst2022-08-311-0/+8
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Fix psalm issues related to the user backendCarl Schwan2022-05-201-5/+5
| | | | | | | | | | | | | - Reflect the actual return value returned by the implementation in the the interface. E.g. IUser|bool -> IUser|false - Remove $hasLoggedIn parameter from private countUser implementation. Replace the two call with the equivalent countSeenUser - getBackend is nuallable, add this to the interface - Use backend interface to make psalm happy about call to undefined methods. Also helps with getting rid at some point of the old implementActions Signed-off-by: Carl Schwan <carl@carlschwan.eu>
* Migrate from ILogger to LoggerInterface in lib/privateCôme Chilliet2022-03-241-18/+6
| | | | Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
* Only setupFS when we have to copy the skeletonJoas Schilling2022-02-251-4/+4
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Update Session.phpMarek-Wojtowicz2022-01-121-1/+1
| | | | | | The http headers according to rfc 2616 is iso-8859-1. This patch fixes the behavior when non-ascii characters are present in the header. Signed-off-by: Marek Wójtowicz <Marek.Wojtowicz@agh.edu.pl>
* Remove default token which is deprecated since Nextcloud 13Joas Schilling2021-12-011-2/+2
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Fix missing token updateJoas Schilling2021-11-121-0/+2
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Emit an error log when the app token login name does not matchChristoph Wurst2021-08-131-1/+6
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Update php licensesJohn Molakvoæ (skjnldsv)2021-06-041-1/+0
| | | | Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
* Throw "401 Unauthenticated" when authentication is provided but invalidJoas Schilling2021-04-221-0/+2
| | | | | | E.g. with an AppToken that has been revoked Signed-off-by: Joas Schilling <coding@schilljs.com>
* token login: emit preLogin event with LoginNameLionel Elie Mamane2021-02-191-1/+1
| | | | | | to bring it in line with normal (non-token) login. Signed-off-by: Lionel Elie Mamane <lionel@mamane.lu>
* Update all license headers for Nextcloud 21Christoph Wurst2020-12-161-1/+1
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Fix typo Morris Jobke2020-12-041-1/+1
| | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Remember me is not an app_passwordRoeland Jago Douma2020-12-041-2/+12
| | | | | | | | While technically they are stored the same. This session variable is used to indicate that a user is using an app password to authenticate. Like from a client. Or when having it generated automatically. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Bearer must be in the start of the auth headerRoeland Jago Douma2020-11-061-3/+3
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Update license headers for Nextcloud 20 (again)Christoph Wurst2020-09-071-0/+1
| | | | | | | There are still lots of outdated headers, so time for another round of updates. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Return correct loginname in credentials,Lionel Elie Mamane2020-08-201-1/+3
| | | | | | | | | | | | | | | even when token is invalid or has no password. Returning the uid as loginname is wrong, and leads to problems when these differ. E.g. the getapppassword API was creating app token with the uid as loginname. In a scenario with external authentication (such as LDAP), these tokens were then invalidated next time their underlying password was checked, and systematically ceased to function. Co-authored-by: kesselb <mail@danielkesselberg.de> for: switch to consistent camelCase Signed-off-by: Lionel Elie Mamane <lionel@mamane.lu>
* Log why a token is not valid during password checkChristoph Wurst2020-05-271-0/+4
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Format control structures, classes, methods and functionChristoph Wurst2020-04-101-12/+5
| | | | | | | | | | | | | | | To continue this formatting madness, here's a tiny patch that adds unified formatting for control structures like if and loops as well as classes, their methods and anonymous functions. This basically forces the constructs to start on the same line. This is not exactly what PSR2 wants, but I think we can have a few exceptions with "our" style. The starting of braces on the same line is pracrically standard for our code. This also removes and empty lines from method/function bodies at the beginning and end. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Use elseif instead of else ifChristoph Wurst2020-04-101-1/+1
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Remove trailing and in between spacesChristoph Wurst2020-04-091-1/+1
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Fix multiline commentsChristoph Wurst2020-04-081-2/+0
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* [POC] Event for failed login attemptsRoeland Jago Douma2020-03-311-1/+7
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Use the short array syntax, everywhereChristoph Wurst2020-03-261-4/+4
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Fix mismatching docblock return typesChristoph Wurst2020-03-061-1/+1
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Add typed events for all user hooks and legacy eventsChristoph Wurst2019-12-111-3/+3
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Update license headersChristoph Wurst2019-12-051-2/+3
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Make the post login event publicChristoph Wurst2019-11-201-4/+3
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Make renewSessionToken return the new tokenRoeland Jago Douma2019-10-091-2/+1
| | | | | | | Avoids directly getting the token again. We just inserted it so it and have all the info. So that query is just a waste. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Disable app token creation for impersonated people, ref #15539Greta Doci2019-09-151-0/+23
| | | | Signed-off-by: Greta Doci <gretadoci@gmail.com>
* Add proper PostLoginEventRoeland Jago Douma2019-07-291-1/+14
| | | | | | | This can be used by othr mechanisms to listen for this event in a lazy fashion. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Add isTokenLogin argument to post login hook/eventChristoph Wurst2019-01-231-2/+7
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Throttle with correct metadataRoeland Jago Douma2019-01-041-1/+1
| | | | | | Fixes #13202 Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Bearer tokens are app tokenRoeland Jago Douma2018-11-201-0/+4
| | | | | | | | | | Fixes #12498 This means that we set that it is a proper app token once it is validated. This will allow the 2FA middleware to just run the same check. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-14 07:26:15 +0000