diff options
author | Roeland Jago Douma <roeland@famdouma.nl> | 2019-01-22 18:16:55 +0300 |
---|---|---|
committer | Roeland Jago Douma <roeland@famdouma.nl> | 2019-01-23 10:46:24 +0300 |
commit | e6333c8fe389aca4e1e8349f276de0058c20c6bb (patch) | |
tree | 09a98cfa0ed7706d830896a96fad7b33d10a7780 | |
parent | af36746d7cbcdb9a5be1c6843bf2bc658678490b (diff) |
Honor remember_login_cookie_lifetime
If the remember_login_cookie_lifetime is set to 0 this means we do not
want to use remember me at all. In that case we should also not creatae
a remember me cookie and should create a proper temp token.
Further this specifies that is not 0 the remember me time should always
be larger than the session timeout. Because else the behavior is not
really defined.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
-rw-r--r-- | config/config.sample.php | 4 | ||||
-rw-r--r-- | core/Controller/LoginController.php | 9 | ||||
-rw-r--r-- | tests/Core/Controller/LoginControllerTest.php | 24 |
3 files changed, 34 insertions, 3 deletions
diff --git a/config/config.sample.php b/config/config.sample.php index 299e67c98fe..9c3cc470995 100644 --- a/config/config.sample.php +++ b/config/config.sample.php @@ -225,8 +225,8 @@ $CONFIG = array( 'allow_user_to_change_display_name' => true, /** - * Lifetime of the remember login cookie, which is set when the user clicks - * the ``remember`` checkbox on the login screen. + * Lifetime of the remember login cookie. This should be larger than the + * session_lifetime. If it is set to 0 remember me is disabled. * * Defaults to ``60*60*24*15`` seconds (15 days) */ diff --git a/core/Controller/LoginController.php b/core/Controller/LoginController.php index 40e13b43c80..64899304d78 100644 --- a/core/Controller/LoginController.php +++ b/core/Controller/LoginController.php @@ -329,7 +329,14 @@ class LoginController extends Controller { // TODO: remove password checks from above and let the user session handle failures // requires https://github.com/owncloud/core/pull/24616 $this->userSession->completeLogin($loginResult, ['loginName' => $user, 'password' => $password]); - $this->userSession->createSessionToken($this->request, $loginResult->getUID(), $user, $password, IToken::REMEMBER); + + $tokenType = IToken::REMEMBER; + if ((int)$this->config->getSystemValue('remember_login_cookie_lifetime', 60*60*24*15) === 0) { + $remember_login = false; + $tokenType = IToken::DO_NOT_REMEMBER; + } + + $this->userSession->createSessionToken($this->request, $loginResult->getUID(), $user, $password, $tokenType); $this->userSession->updateTokens($loginResult->getUID(), $password); // User has successfully logged in, now remove the password reset link, when it is available diff --git a/tests/Core/Controller/LoginControllerTest.php b/tests/Core/Controller/LoginControllerTest.php index efe85d81e1c..bb21903b653 100644 --- a/tests/Core/Controller/LoginControllerTest.php +++ b/tests/Core/Controller/LoginControllerTest.php @@ -449,6 +449,10 @@ class LoginControllerTest extends TestCase { $this->config->expects($this->once()) ->method('setUserValue') ->with('uid', 'core', 'timezone', 'Europe/Berlin'); + $this->config + ->method('getSystemValue') + ->with('remember_login_cookie_lifetime') + ->willReturn(1234); $this->userSession->expects($this->never()) ->method('createRememberMeToken'); @@ -493,6 +497,10 @@ class LoginControllerTest extends TestCase { $this->config->expects($this->once()) ->method('deleteUserValue') ->with('uid', 'core', 'lostpassword'); + $this->config + ->method('getSystemValue') + ->with('remember_login_cookie_lifetime') + ->willReturn(1234); $this->userSession->expects($this->once()) ->method('createRememberMeToken') ->with($user); @@ -553,6 +561,10 @@ class LoginControllerTest extends TestCase { ->method('deleteUserValue'); $this->userSession->expects($this->never()) ->method('createRememberMeToken'); + $this->config + ->method('getSystemValue') + ->with('remember_login_cookie_lifetime') + ->willReturn(1234); $expected = new \OCP\AppFramework\Http\RedirectResponse($redirectUrl); $this->assertEquals($expected, $this->loginController->tryLogin('Jane', $password, $originalUrl)); @@ -590,6 +602,10 @@ class LoginControllerTest extends TestCase { $this->config->expects($this->once()) ->method('deleteUserValue') ->with('jane', 'core', 'lostpassword'); + $this->config + ->method('getSystemValue') + ->with('remember_login_cookie_lifetime') + ->willReturn(1234); $expected = new \OCP\AppFramework\Http\RedirectResponse(urldecode($redirectUrl)); $this->assertEquals($expected, $this->loginController->tryLogin('Jane', $password, $originalUrl)); @@ -642,6 +658,10 @@ class LoginControllerTest extends TestCase { $this->config->expects($this->once()) ->method('deleteUserValue') ->with('john', 'core', 'lostpassword'); + $this->config + ->method('getSystemValue') + ->with('remember_login_cookie_lifetime') + ->willReturn(1234); $this->userSession->expects($this->never()) ->method('createRememberMeToken'); @@ -694,6 +714,10 @@ class LoginControllerTest extends TestCase { $this->config->expects($this->once()) ->method('deleteUserValue') ->with('john', 'core', 'lostpassword'); + $this->config + ->method('getSystemValue') + ->with('remember_login_cookie_lifetime') + ->willReturn(1234); $this->userSession->expects($this->never()) ->method('createRememberMeToken'); |