Age | Commit message (Collapse) | Author |
|
Signed-off-by: Joas Schilling <coding@schilljs.com>
|
|
Searching for all is still a problem
Signed-off-by: Joas Schilling <coding@schilljs.com>
|
|
Signed-off-by: Joas Schilling <coding@schilljs.com>
|
|
Signed-off-by: Julius Härtl <jus@bitgrid.net>
|
|
Signed-off-by: Julius Härtl <jus@bitgrid.net>
Move to vuex
Signed-off-by: Julius Härtl <jus@bitgrid.net>
|
|
Signed-off-by: Julius Härtl <jus@bitgrid.net>
|
|
Signed-off-by: Julius Härtl <jus@bitgrid.net>
|
|
Signed-off-by: Julius Härtl <jus@bitgrid.net>
|
|
Signed-off-by: Joas Schilling <coding@schilljs.com>
|
|
Signed-off-by: Joas Schilling <coding@schilljs.com>
|
|
Signed-off-by: Joas Schilling <coding@schilljs.com>
|
|
Signed-off-by: Joas Schilling <coding@schilljs.com>
|
|
Signed-off-by: Joas Schilling <coding@schilljs.com>
|
|
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
|
|
This adds the new login flow. The desktop client will open up a browser
and poll a returned endpoint at regular intervals to check if the flow
is done.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
|
|
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
|
|
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
|
|
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
|
|
nextcloud/enh/additional_scripts_no_on_public_pages
No need to emit additonalscript event on public pages
|
|
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
|
|
Fixes #12568
Since the clearing of the execution context causes another reload. We
should not do the redirect_uri handling as this results in redirecting
back to the logout page on login.
This adds a simple middleware that will just check if the
ClearExecutionContext session variable is set. If that is the case it
will just redirect back to the login page.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
|
|
This can be used by pages that do not have the full Nextcloud UI.
So notifications etc do not load there.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
|
|
nextcloud/enh/clean_pending_2fa_session_on_password_change
Clean pending 2FA authentication on password reset
|
|
When a password is reste we should make sure that all users are properly
logged in. Pending states should be cleared. For example a session where
the 2FA code is not entered yet should be cleared.
The token is now removed so the session will be killed the next time
this is checked (within 5 minutes).
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
|
|
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
|
|
If the remember_login_cookie_lifetime is set to 0 this means we do not
want to use remember me at all. In that case we should also not creatae
a remember me cookie and should create a proper temp token.
Further this specifies that is not 0 the remember me time should always
be larger than the session timeout. Because else the behavior is not
really defined.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
|
|
Else we get shown an error page instead of the correct 403.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
|
|
There is no need to inform the user if the account existed or not.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
|
|
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
|
|
It seems iOS doesn't like us to change the location. So now we submit it
to the server that geneartes the redirect.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
|
|
Because the redirect from the SAML/SSO endpoint is a POST the lax/strict
cookies are not properly send.
Note that it is not strictly requried on this endpoint as we do not need
the remember me data. Only the real session info is enough. The endpoint
is also already protected by a state token.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
|
|
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
|
|
Fixes #11146
As documented when it is set to disabled the user can't request a lost
password.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
|
|
If a user can't authenticate normally (because they have 2FA that is not
available on their devices for example). The redirect that is generated
should be of the proper format.
This means
1. Include the protocol
2. Include the possible subfolder
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
|
|
Signed-off-by: Rayn0r <Andre.Weidemann@web.de>
|
|
Signed-off-by: Julius Härtl <jus@bitgrid.net>
|
|
Remove cookies from Clear-Site-Data Header
|
|
Which can be used for public iframe embeeding
See https://github.com/nextcloud/calendar/issues/169
Signed-off-by: Thomas Citharel <tcit@tcit.fr>
|
|
In https://github.com/nextcloud/server/commit/2f87fb6b456fd109c90a5093c31b7a3f62a32040 this header was introduced. The referenced documentation says:
> When delivered with a response from https://example.com/clear, the following header will cause cookies associated with the origin https://example.com to be cleared, as well as cookies on any origin in the same registered domain (e.g. https://www.example.com/ and https://more.subdomains.example.com/).
This also applies if `https://nextcloud.example.com/` sends the `Clear-Site-Data: "cookies"` header.
This is not the behavior we want at this point!
So I removed the deletion of cookies from the header. This has no effect on the logout process as this header is supported only recently and the logout works in old browsers as well.
Signed-off-by: Patrick Conrad <conrad@iza.org>
|
|
nextcloud/feature/10684/default-logo-color-theme-colors
Switches the default logo color depending on the primary color
|
|
Now that we allow enforcing 2 factor auth it make sense if we also allow
and endpoint where the clients can in the background fetch an
apppassword if they were configured before the login flow was present.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
|
|
* On weblogin check if we have invalid public key tokens
* If so update them all with the new token
This ensures that your marked as invalid tokens work again if you once
login on the web.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
|
|
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
|
|
Signed-off-by: Michael Weimann <mail@michael-weimann.eu>
|
|
danielkesselberg/bugfix/noid/allow-password-reset-for-duplicate-email
Enable password reset for user with same email address when only one is active
|
|
Fixes #10584
We deleted the main token when using the login flow else mutliple tokens
would show up for a single user.
However in the case of OAuth this is perfectly fine as the
authentication happens really in your browser:
1. You are already logged in, no need to log you out
2. You are not logged in yet, but since you log in into the exact same
browser the expected behavior is to stay logged in.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
|
|
We use the same logic for creating accounts without a password and there the 12h is a bit short. Users don't expect that the signup link needs to be clicked within 12h - 7d should be a more expected behavior.
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
|
|
Fix max length requirements for the throttler metadata
|
|
When two or more user share the same email address its not possible to
reset password by email. Even when only one account is active.
This pr reduce list of users returned by getByEmail by disabled users.
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
|
|
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
|