summaryrefslogtreecommitdiffstats
path: root/lib/private/User
Commit message (Collapse)AuthorAgeFilesLines
* Update the scope of the lockdownmanagerRoeland Jago Douma2018-08-141-0/+3
| | | | | | We have the token anyway. So better the scope as well. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Allow updating the token on session regenerationRoeland Jago Douma2018-07-091-0/+2
| | | | | | | Sometimes when we force a session regeneration we want to update the current token for this session. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Move on with the next user if we found the user on one user back-endBjoern Schiessle2018-04-041-1/+2
| | | | Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
* Fix testsRoeland Jago Douma2018-01-251-3/+3
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Don't polute log when loggin into dav with emailRoeland Jago Douma2018-01-251-10/+21
| | | | | | | | | | * We first try the email as username but this fails * Then we get the uid from the email and try again We should not log the first attempt since it polutes the log with failed login attempts while the login actually is valid. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* never translate login names when requiring with a user idArthur Schiwon2018-01-031-10/+0
| | | | | | where appropriate, the preLoginNameUsedAsUserName hook should be thrown. Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* Fix search in user managent when no group is selectedMorris Jobke2017-11-141-0/+2
| | | | | | * also allows to search by displayname Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Change @georgehrke's emailMorris Jobke2017-11-061-1/+1
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Update license headersMorris Jobke2017-11-065-5/+11
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Fix failing csp/nonce check due to timed out sessionChristoph Wurst2017-09-041-5/+8
| | | | | | | | | | | | | | | | | | | | | | | The CSP nonce is based on the CSRF token. This token does not change, unless you log in (or out). In case of the session data being lost, e.g. because php gets rid of old sessions, a new CSRF token is gen- erated. While this is fine in theory, it actually caused some annoying problems where the browser restored a tab and Nextcloud js was blocked due to an outdated nonce. The main problem here is that, while processing the request, we write out security headers relatively early. At that point the CSRF token is known/generated and transformed into a CSP nonce. During this request, however, we also log the user in because the session information was lost. At that point we also refresh the CSRF token, which eventually causes the browser to block any scripts as the nonce in the header does not match the one which is used to include scripts. This patch adds a flag to indicate whether the CSRF token should be refreshed or not. It is assumed that refreshing is only necessary if we want to re-generate the session id too. To my knowledge, this case only happens on fresh logins, not when we recover from a deleted session file. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Prevent SQL error message in case of errorLukas Reschke2017-08-172-2/+9
| | | | | | | | | | | | | | `\OC\User\Database::createUser` can throw a PHP exception in case the UID is longer than permitted in the database. This is against it's PHPDocs and we should cast this to `false`, so that the regular error handling triggers in. The easiest way to reproduce is on MySQL: 1. Create user `aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa` in admin panel 2. Create user `aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa` in admin panel again 3. See SQL exception as error message Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Can not insert auto increment on oracleJoas Schilling2017-08-021-1/+2
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* null users dont existRobin Appelman2017-07-131-0/+3
| | | | Signed-off-by: Robin Appelman <robin@icewind.nl>
* Create users in non default backends firstJoas Schilling2017-06-201-0/+13
| | | | | | | | | Most of the time, when people have multiple backends or add a custom backend, they want to create the users there and not in the default backend. But since that is registered first, users were always created there. Signed-off-by: Joas Schilling <coding@schilljs.com>
* emit changeUser only if there really was a change (quota, displayname)Arthur Schiwon2017-06-011-2/+7
| | | | Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* Add basic implementation for OAuth 2.0 Authorization Code FlowLukas Reschke2017-05-181-2/+2
| | | | Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Fix encryption + remembered login due to missing login hookChristoph Wurst2017-05-161-1/+7
| | | | | | | | | | The encryption app relies on the post_login hook to initialize its keys. Since we do not emit it on a remembered login, the keys were always un- initialized and the user was asked to log out and in again. This patch *translates* the postRememberedLogin hook to a post_login hook. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Remove account data on user deletionJoas Schilling2017-05-151-0/+5
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* handle permissions errors when copying the skeleton for a read only userRobin Appelman2017-05-051-2/+7
| | | | Signed-off-by: Robin Appelman <robin@icewind.nl>
* UserManager can now count disabled usersArthur Schiwon2017-04-291-0/+22
| | | | | | Users page takes advantage of that Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* Use the new method in the old one to remove duplicate codeJoas Schilling2017-04-271-30/+28
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Allow to create a user for a specific backendJoas Schilling2017-04-261-0/+18
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Trigger change when a user is enabled/disabledJoas Schilling2017-04-251-1/+5
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Better validation of allowed user namesJoas Schilling2017-04-181-1/+5
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Merge pull request #4330 from nextcloud/activities-for-password-mail-changeRoeland Jago Douma2017-04-141-3/+4
|\ | | | | Add activities when email or password is changed
| * Allow to read the old email on the hook as wellJoas Schilling2017-04-131-3/+4
| | | | | | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* | Merge pull request #2424 from ↵Morris Jobke2017-04-131-43/+54
|\ \ | |/ |/| | | | | nextcloud/fix-login-controller-test-consolidate-login Fix login controller test and consolidate login
| * Improve PHPDocMorris Jobke2017-04-131-1/+1
| | | | | | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
| * use known LockdownManagerArthur Schiwon2017-04-061-1/+1
| | | | | | | | Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
| * Save correct login nameArthur Schiwon2017-04-061-1/+8
| | | | | | | | Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
| * don't regenerate Session ID twice, also fixes testsArthur Schiwon2017-04-061-4/+7
| | | | | | | | Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
| * regenerate session id on successful login, fixes integration testArthur Schiwon2017-04-061-0/+4
| | | | | | | | Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
| * do login routine only once when done via LoginControllerArthur Schiwon2017-04-061-43/+40
| | | | | | | | Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
* | Dont create a log entry on email loginJoas Schilling2017-04-071-2/+19
|/ | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Save the scope of an auth token in the sessionRobin Appelman2017-04-051-18/+27
| | | | Signed-off-by: Robin Appelman <robin@icewind.nl>
* user ids are stringsRobin Appelman2017-03-301-1/+2
| | | | Signed-off-by: Robin Appelman <robin@icewind.nl>
* Merge pull request #3889 from nextcloud/downstream-26950Morris Jobke2017-03-232-3/+3
|\ | | | | Sharing dialog: make autocomplete sorting case insensitive
| * fix sorting in the backendMorris Jobke2017-03-232-3/+3
| | | | | | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* | Merge pull request #3929 from nextcloud/downstream-27068Joas Schilling2017-03-201-2/+7
|\ \ | | | | | | cache loadUser if not exists
| * | Add tests for database user backend cachingVincent Petry2017-03-201-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | Add comment, closeCursor in user DB query Invalidate user in cache after successful creation Signed-off-by: Morris Jobke <hey@morrisjobke.de>
| * | cache loadUser if not existsJörn Friedrich Dreyer2017-03-201-1/+1
| | | | | | | | | | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* | | Add postLogout hook to finish sessions from external session managers (#27048)Felix Rupp2017-03-191-0/+3
|/ / | | | | | | | | | | | | | | * Add postLogout hook to finish sessions from external session managers like CAS * Add postLogout hook to finish sessions from external session managers like CAS Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* | Don't call function in constructorLukas Reschke2017-03-161-7/+3
| | | | | | | | | | | | The constructor is iniitiated already very early in base.php, thus requiring this here will break the setup and some more. For now we probably have to live with a static function call here thus. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* | Escape like parameters in database user backendLukas Reschke2017-03-151-3/+7
|/ | | | Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Remove legacy class OC_Group and OC_UserMorris Jobke2017-03-091-2/+8
| | | | | | * basically a straight replacement of the wrapped code at the calling code parts Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Merge pull request #2606 from temparus/masterblizzz2017-02-151-3/+6
|\ | | | | Add preLoginValidation hook
| * Update license headerSandro Lutz2017-02-071-0/+2
| | | | | | | | Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
| * Merge remote-tracking branch 'nextcloud/master'Sandro Lutz2017-02-073-5/+18
| |\ | | | | | | | | | Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
| * | Add check if UserManager is of type PublicEmitter before calling preLogin hookSandro Lutz2017-02-011-1/+3
| | | | | | | | | | | | Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
| * | Change where preLogin hook gets calledSandro Lutz2017-02-011-3/+2
| | | | | | | | | | | | Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-22 11:58:39 +0000