summaryrefslogtreecommitdiffstats
path: root/lib/private/User/Session.php
Commit message (Collapse)AuthorAgeFilesLines
* Add proper PostLoginEventRoeland Jago Douma2019-07-291-1/+14
| | | | | | | This can be used by othr mechanisms to listen for this event in a lazy fashion. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Add isTokenLogin argument to post login hook/eventChristoph Wurst2019-01-231-2/+7
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Throttle with correct metadataRoeland Jago Douma2019-01-041-1/+1
| | | | | | Fixes #13202 Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Bearer tokens are app tokenRoeland Jago Douma2018-11-201-0/+4
| | | | | | | | | | Fixes #12498 This means that we set that it is a proper app token once it is validated. This will allow the 2FA middleware to just run the same check. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Error out early on an expired tokenRoeland Jago Douma2018-10-301-1/+11
| | | | | | | | | | | | | Fixes #12131 If we hit an expired token there is no need to continue checking. Since we know it is a token. We also should not register this with the bruteforce throttler as it is actually a valid token. Just expired. Instead the authentication should fail. And buisness continues as usual. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Update all the publickey tokens if needed on web loginRoeland Jago Douma2018-10-021-0/+4
| | | | | | | | | | * On weblogin check if we have invalid public key tokens * If so update them all with the new token This ensures that your marked as invalid tokens work again if you once login on the web. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Mark token as invalid if the password doesn't matchRoeland Jago Douma2018-10-021-3/+10
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Make authenticated cookies laxRoeland Jago Douma2018-09-281-4/+31
| | | | | | | | | | | | | | This protects our cookies a bit more. It makes sure that when a 3rdparty websites embededs a public alendar for example. That all the users see this in anonymous mode there. It adds a small helper function. In the future we can think about protecting other cookies like this as well. But for now this is sufficient to not have the user logged in at all when doing 3rdparty requests. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Update the scope of the lockdownmanagerRoeland Jago Douma2018-08-141-0/+3
| | | | | | We have the token anyway. So better the scope as well. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Allow updating the token on session regenerationRoeland Jago Douma2018-06-141-0/+2
| | | | | | | Sometimes when we force a session regeneration we want to update the current token for this session. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* more consistent namingArthur Schiwon2018-04-051-3/+3
| | | | Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* admin_audit and dav listen to announce and revoke signalsArthur Schiwon2018-04-051-0/+3
| | | | | | also place them in doc Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* Remove unused import statementsMorris Jobke2018-02-141-1/+0
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Use proper code flow instead of not needed else branchMorris Jobke2018-01-251-11/+11
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Fix testsRoeland Jago Douma2018-01-231-3/+3
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Don't polute log when loggin into dav with emailRoeland Jago Douma2018-01-231-10/+21
| | | | | | | | | | * We first try the email as username but this fails * Then we get the uid from the email and try again We should not log the first attempt since it polutes the log with failed login attempts while the login actually is valid. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Update license headersMorris Jobke2017-11-061-2/+5
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Fix failing csp/nonce check due to timed out sessionChristoph Wurst2017-09-041-5/+8
| | | | | | | | | | | | | | | | | | | | | | | The CSP nonce is based on the CSRF token. This token does not change, unless you log in (or out). In case of the session data being lost, e.g. because php gets rid of old sessions, a new CSRF token is gen- erated. While this is fine in theory, it actually caused some annoying problems where the browser restored a tab and Nextcloud js was blocked due to an outdated nonce. The main problem here is that, while processing the request, we write out security headers relatively early. At that point the CSRF token is known/generated and transformed into a CSP nonce. During this request, however, we also log the user in because the session information was lost. At that point we also refresh the CSRF token, which eventually causes the browser to block any scripts as the nonce in the header does not match the one which is used to include scripts. This patch adds a flag to indicate whether the CSRF token should be refreshed or not. It is assumed that refreshing is only necessary if we want to re-generate the session id too. To my knowledge, this case only happens on fresh logins, not when we recover from a deleted session file. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Add basic implementation for OAuth 2.0 Authorization Code FlowLukas Reschke2017-05-181-2/+2
| | | | Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Fix encryption + remembered login due to missing login hookChristoph Wurst2017-05-161-1/+7
| | | | | | | | | | The encryption app relies on the post_login hook to initialize its keys. Since we do not emit it on a remembered login, the keys were always un- initialized and the user was asked to log out and in again. This patch *translates* the postRememberedLogin hook to a post_login hook. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* handle permissions errors when copying the skeleton for a read only userRobin Appelman2017-05-051-2/+7
| | | | Signed-off-by: Robin Appelman <robin@icewind.nl>
* Improve PHPDocMorris Jobke2017-04-131-1/+1
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* use known LockdownManagerArthur Schiwon2017-04-061-1/+1
| | | | Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* Save correct login nameArthur Schiwon2017-04-061-1/+8
| | | | Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* don't regenerate Session ID twice, also fixes testsArthur Schiwon2017-04-061-4/+7
| | | | Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* regenerate session id on successful login, fixes integration testArthur Schiwon2017-04-061-0/+4
| | | | Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* do login routine only once when done via LoginControllerArthur Schiwon2017-04-061-43/+40
| | | | Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* Save the scope of an auth token in the sessionRobin Appelman2017-04-051-18/+27
| | | | Signed-off-by: Robin Appelman <robin@icewind.nl>
* Add postLogout hook to finish sessions from external session managers (#27048)Felix Rupp2017-03-191-0/+3
| | | | | | | | * Add postLogout hook to finish sessions from external session managers like CAS * Add postLogout hook to finish sessions from external session managers like CAS Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Merge pull request #2606 from temparus/masterblizzz2017-02-151-3/+6
|\ | | | | Add preLoginValidation hook
| * Update license headerSandro Lutz2017-02-071-0/+2
| | | | | | | | Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
| * Merge remote-tracking branch 'nextcloud/master'Sandro Lutz2017-02-071-3/+4
| |\ | | | | | | | | | Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
| * | Add check if UserManager is of type PublicEmitter before calling preLogin hookSandro Lutz2017-02-011-1/+3
| | | | | | | | | | | | Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
| * | Change where preLogin hook gets calledSandro Lutz2017-02-011-3/+2
| | | | | | | | | | | | Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
* | | Save the used token id in the session so it can be used later onJoas Schilling2017-02-091-2/+20
| |/ |/| | | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* | add action to existing brute force protectionBjoern Schiessle2017-01-181-3/+3
| | | | | | | | Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
* | Make sure the loginname is set when logging in via cookieJoas Schilling2017-01-051-0/+1
|/ | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Set last-login-check on basic authRoeland Jago Douma2016-12-051-0/+5
| | | | | | | | | Else the last-login-check fails hard because the session value is not set and thus defaults to 0. * Started with tests Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* do not remember session tokens by defaultChristoph Wurst2016-11-271-1/+1
| | | | | | | | We have to respect the value of the remember-me checkbox. Due to an error in the source code the default value for the session token was to remember it. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* fix warning with token loginRobin Appelman2016-11-161-1/+1
| | | | Signed-off-by: Robin Appelman <robin@icewind.nl>
* read lockdown scope from tokenRobin Appelman2016-11-161-2/+1
| | | | Signed-off-by: Robin Appelman <icewind@owncloud.com>
* basic lockdown logicRobin Appelman2016-11-161-0/+2
| | | | Signed-off-by: Robin Appelman <icewind@owncloud.com>
* Introduce an event for first time login based on the last login time stampThomas Müller2016-11-141-6/+19
| | | | | | | | | | | | Use firstLogin event to trigger creation of default calendar and default address book Delay login of admin user after setup so that firstLogin event can properly be processed for the admin Fixing tests ... Skeleton files are not copied over -> only 3 cache entries are remaining Use updateLastLoginTimestamp to properly setup lastLogin value for a test user
* inject ISecureRandom into user session and use injected config tooChristoph Wurst2016-11-021-11/+18
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* bring back remember-meChristoph Wurst2016-11-021-19/+51
| | | | | | | | | | * try to reuse the old session token for remember me login * decrypt/encrypt token password and set the session id accordingly * create remember-me cookies only if checkbox is checked and 2fa solved * adjust db token cleanup to store remembered tokens longer * adjust unit tests Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Fix logClientIn for non-existing users (#26292)Vincent Petry2016-10-251-0/+3
| | | | | | | The check for two factor enforcement would return true for non-existing users. This fix makes it return false in order to be able to perform the regular login which will then fail and return false. This prevents throwing PasswordLoginForbidden for non-existing users.
* dont update the auth token twiceRobin Appelman2016-10-111-2/+0
| | | | Signed-off-by: Robin Appelman <robin@icewind.nl>
* dont get bruteforce delay twiceRobin Appelman2016-08-291-2/+1
|
* missing PHPDocJörn Friedrich Dreyer2016-08-141-0/+1
|
* Type compatabilityJörn Friedrich Dreyer2016-08-141-1/+1
|
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-09 01:35:56 +0000