| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | Move \OC\User to PSR-4 | Roeland Jago Douma | 2016-05-10 | 1 | -322/+0 |
| | | |||||
| * | Add occ commands to enable and disable a user + a disabled user can no ↵ | Thomas Müller | 2016-05-02 | 1 | -21/+25 |
| | | | | | longer login - fixes #23838 | ||||
| * | Happy new year! | Thomas Müller | 2016-01-12 | 1 | -2/+3 |
| | | |||||
| * | getMediumStrengthGenerator is deprecated and does not do anything anymore | Roeland Jago Douma | 2016-01-11 | 1 | -1/+1 |
| | | |||||
| * | Move regeneration of session ID into session classes | Lukas Reschke | 2016-01-04 | 1 | -0/+2 |
| | | | | | There were code paths that nowadays call ISession::login directly thus bypassing the desired regeneration of the session ID. This moves the session regeneration deeper into the session handling and thus ensures that it is always called. Furthermore, I also added the session regeneration to the remember me cookie plus added some test case expectations for this. | ||||
| * | More cleanups of OC_Config usage | Morris Jobke | 2015-12-03 | 1 | -1/+1 |
| | | |||||
| * | Remove last occurence of `forcessl` | Lukas Reschke | 2015-08-26 | 1 | -2/+2 |
| | | | | | This shoudl have been adjusted as well, now it's consistent with `setMagicInCookie`. While it does not have a security impact directly some automated scanners reported this all the time. | ||||
| * | more type hints | Robin Appelman | 2015-06-02 | 1 | -2/+2 |
| | | |||||
| * | Update license headers | Jenkins for ownCloud | 2015-03-26 | 1 | -5/+26 |
| | | |||||
| * | Let users configure security headers in their Webserver | Lukas Reschke | 2015-03-02 | 1 | -1/+1 |
| | | | | | | | | | | | Doing this in the PHP code is not the right approach for multiple reasons: 1. A bug in the PHP code prevents them from being added to the response. 2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud) 3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations. This pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS. | ||||
| * | Revert "Updating license headers" | Morris Jobke | 2015-02-26 | 1 | -26/+6 |
| | | | | | This reverts commit 6a1a4880f0d556fb090f19a5019fec31916f5c36. | ||||
| * | Merge pull request #13340 from owncloud/use-http-only | Lukas Reschke | 2015-02-24 | 1 | -10/+13 |
| |\ | | | | | Use "HTTPOnly" for cookies when logging out | ||||
| | * | Use "HTTPOnly" for cookies when logging out | Lukas Reschke | 2015-01-14 | 1 | -10/+13 |
| | | | | | | | | | | | | | This has no other reason than preventing some insane automated scanners from reporting this as security bug (which it obviously isn't as the cookie contains nothing of value) Thus it generally results in an happier Lukas and hopefully less reports to our support and security mail addresses... | ||||
| * | | Updating license headers | Jenkins for ownCloud | 2015-02-23 | 1 | -6/+26 |
| | | | |||||
| * | | Throw an exception when login is canceled by an app | Robin Appelman | 2015-01-22 | 1 | -1/+6 |
| | | | |||||
| * | | Return false if the login is canceled in a hook | Robin Appelman | 2015-01-13 | 1 | -1/+1 |
| |/ | |||||
| * | Merge pull request #12969 from owncloud/clarify-docs | Morris Jobke | 2014-12-22 | 1 | -2/+2 |
| |\ | | | | | Clarify return values | ||||
| | * | Fix typo | Lukas Reschke | 2014-12-19 | 1 | -1/+1 |
| | | | |||||
| | * | Clarify return values | Lukas Reschke | 2014-12-19 | 1 | -1/+1 |
| | | | | | | | | | This function returns `null` when no user is logged-in. | ||||
| * | | Add ultra-slim hack for incognito mode | Lukas Reschke | 2014-12-17 | 1 | -0/+5 |
| |/ | | | | As discussed at https://github.com/owncloud/core/pull/12912#issuecomment-67391155 | ||||
| * | add a isLoggedIn method to the usersession and deprecate the isLoggedIn ↵ | Bernhard Posselt | 2014-12-17 | 1 | -0/+9 |
| | | | | | method on the api | ||||
| * | reduce OC_Preferences, OC_Config and \OCP\Config usage | Morris Jobke | 2014-12-08 | 1 | -3/+3 |
| | | | | | | | | | | | * files_encryption * files_versions * files_trashbin * tests * status.php * core * server container | ||||
| * | remove deprecated \OC:$session | Thomas Müller | 2014-11-26 | 1 | -17/+0 |
| | | |||||
| * | Clear session after logout | Lukas Reschke | 2014-10-30 | 1 | -0/+1 |
| | | | | | Fixes https://github.com/owncloud/core/issues/8420 | ||||
| * | Unset the cached active user when using a different session object | Robin Appelman | 2014-10-13 | 1 | -11/+12 |
| | | |||||
| * | Use proper RNG generator | Lukas Reschke | 2014-09-03 | 1 | -1/+1 |
| | | | | | | OC_Util::generateRandomBytes() only returns lowercase alphanumeric values. We should use the new RNG which has a broader characterset. | ||||
| * | kill OC::$session | Jörn Friedrich Dreyer | 2014-08-29 | 1 | -3/+41 |
| | | | | | | | | | | | | | maintain deprecated \OC::$session when getting or setting the session via the server container or UserSession restore order os OC::$session and OC::$CLI remove unneded initialization of dummy session write back session when $useCustomSession is true log warning when deprecated app is used | ||||
| * | Merge pull request #10144 from owncloud/issue/9972 | Thomas Müller | 2014-08-06 | 1 | -1/+1 |
| |\ | | | | | Issue/9972 Fix issues with group and username `0` | ||||
| | * | Fix isLoggedIn() check for user '0' | Joas Schilling | 2014-08-04 | 1 | -1/+1 |
| | | | | | | | | | Fix #9972 | ||||
| * | | Add public interfaces for User, UserManager and UserSession | Robin Appelman | 2014-07-14 | 1 | -1/+2 |
| |/ | |||||
| * | add preRememberedLogin hook and document this and postRememberedLogin in ↵ | Arthur Schiwon | 2014-05-26 | 1 | -1/+4 |
| | | | | | class descripttion. Also fixes documentation of postLogin hook | ||||
| * | clean up tryRememberLogin and save the timestamp of users last login | Arthur Schiwon | 2014-05-21 | 1 | -0/+32 |
| | | |||||
| * | Fix Scrutinizer errors | Robin McCorkell | 2014-05-13 | 1 | -3/+3 |
| | | |||||
| * | Remove `session_id_regenerate` from here | Lukas Reschke | 2014-02-21 | 1 | -1/+0 |
| | | | | Jenkins somewhat complains that there are already sent headers. | ||||
| * | Merge pull request #6519 from nhirokinet/master | Lukas Reschke | 2014-02-20 | 1 | -0/+1 |
| |\ | | | | | Security Update: session fixation | ||||
| | * | Security Update: session fixation | NARUKAWA Hiroki | 2013-12-20 | 1 | -0/+1 |
| | | | | | | | Previous version is vulnerable to session fixation attack in some situations, guessing non-apache-module-php5 environment. Regeneration of session id should be done here. | ||||
| * | | polish documentation based on scrutinizer patches | Jörn Friedrich Dreyer | 2014-02-06 | 1 | -1/+1 |
| | | | |||||
| * | | fixing PHPDoc and use cameCase names | Thomas Müller | 2014-01-09 | 1 | -7/+7 |
| |/ | |||||
| * | On webdav sesssions, loginname was compared to username which does not need ↵ | Arthur Schiwon | 2013-12-13 | 1 | -0/+34 |
| | | | | | to match necessarily | ||||
| * | Now removing stray old cookies from 5.0.12 | Vincent Petry | 2013-11-07 | 1 | -0/+5 |
| | | | | | | | | | | | | Cookies from 5.0.12 seemed to have an extra slash in the path. Firefox doesn't allow to remove them if the trailing slash isn't there, thus making it impossible to logout correctly. This fix adds extra code to delete such stray cookies. Ported from stable5 branch 99e5c6f7eb58404be2cc5448ec380f29c9a71225 | ||||
| * | move the private namespace OC into lib/private - OCP will stay in lib/public | Thomas Müller | 2013-09-30 | 1 | -0/+174 |
| Conflicts: lib/private/vcategories.php | |||||
 |
index : nextcloud-server.git | |
| Nextcloud server, a safe home for all your data: https://github.com/nextcloud/server | www-data |
| summaryrefslogtreecommitdiffstats |