246da73a36
fix(oauth2): retain support for legacy ownCloud clients
...
Signed-off-by: Richard Steinmetz <richard@steinmetz.cloud>
2025-04-01 11:25:52 +07:00
75f8bb51ed
fix: Rename config option to skipAuthPickerApplications to match what it does
...
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2025-01-07 10:34:30 +07:00
e7be008dc1
feat(oauth2): Skip page before login as well for authorized applications
...
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2025-01-07 10:34:30 +07:00
085d4c9364
refactor(OpenAPI): Adjust scopes to match previous behavior
...
Signed-off-by: provokateurin <kate@provokateurin.de>
2025-01-06 14:30:40 +07:00
381077028a
refactor(apps): Use constructor property promotion when possible
...
Signed-off-by: provokateurin <kate@provokateurin.de>
2024-10-21 12:37:59 +07:00
1a4978c4ea
chore: Apply rector configuration to apps folder
...
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2024-09-20 17:51:00 +07:00
9836e9b164
chore(deps): Update nextcloud/coding-standard to v1.3.1
...
Signed-off-by: provokateurin <kate@provokateurin.de>
2024-09-19 14:21:20 +07:00
034917b790
fix(oauth2): store hashed secret instead of encrypted
...
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
2024-09-02 14:38:39 +07:00
cc44ec54ad
invalidate oauth2 tokens only for seen users
...
Signed-off-by: Artur Neumann <artur@jankaritech.com>
2024-08-16 10:33:52 +07:00
d8adbce1be
refactor(oauth2): Replace security annotations with respective attributes
...
Signed-off-by: provokateurin <kate@provokateurin.de>
2024-07-29 16:45:54 +07:00
cc1686dba9
chore: Add SPDX header
...
Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
2024-05-31 10:38:47 +07:00
eee9f1eec4
Always catch OCP versions of authentication exceptions
...
And always throw OC versions for BC
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2024-01-11 14:02:15 +07:00
aa5f037af7
chore: apply changes from Nextcloud coding standards 1.1.1
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
2023-11-23 10:36:13 +07:00
d56950a6c9
adjust phpdoc types in OauthApiController
...
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
2023-10-05 14:24:03 +07:00
c6da99474e
rename oauth2_access_token's created_at to code_created_at
...
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
2023-10-05 14:24:02 +07:00
779e1d51ac
delete oauth access token when receiving a code that has expired
...
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
2023-10-05 14:24:02 +07:00
1ab45bad5d
refuse oauth authorization code if a token has already been delivered (active token)
...
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
2023-10-05 14:24:02 +07:00
7bba410997
cleanup access tokens that are still in authorization state and that have expired
...
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
2023-10-05 14:24:02 +07:00
2995b0948f
add tests for oauth2 authorization code expiration
...
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
2023-10-05 14:24:02 +07:00
807f173dec
make oauth2 authorization code expire after 10 minutes
...
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
2023-10-05 14:24:02 +07:00
25309bcb45
techdebt(DI): Use public IThrottler interface which exists since Nextcloud 25
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2023-08-28 15:50:45 +07:00
1c19c567fe
oauth2: Add OpenAPI spec
...
Signed-off-by: jld3103 <jld3103yt@gmail.com>
2023-07-12 07:32:30 +07:00
629adc318f
add bruteforce protection in OauthApiController
...
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
2023-06-19 11:18:06 +07:00
18c742a901
encrypt oauth2 client secrets
...
Signed-off-by: Julien Veyssier <julien-nc@posteo.net>
2023-06-07 11:36:08 +07:00
f634badf12
public interface to invalidate tokens of user
...
Signed-off-by: Artur Neumann <artur@jankaritech.com>
2023-03-14 17:13:29 +07:00
21be557e2a
invalidate existing tokens when deleting an oauth client
...
Signed-off-by: Artur Neumann <artur@jankaritech.com>
2023-03-14 17:13:23 +07:00
9d26671f05
Fix typos in apps/ subdirectory
...
Found via `codespell -q 3 -S l10n,./apps/files_external/3rdparty -L adn,ba,boxs,keypair,jus,optionel,ressource,tabel ./apps/`
Signed-off-by: luz paz <luzpaz@github.com>
Signed-off-by: nextcloud-command <nextcloud-command@users.noreply.github.com>
2022-09-05 12:59:54 +07:00
c6ae53096c
More test fixing
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2021-12-01 22:17:19 +07:00
3b656446af
Introduce ISecureRandom::CHAR_ALPHANUMERIC
...
Signed-off-by: J0WI <J0WI@users.noreply.github.com>
2021-07-08 15:11:31 +07:00
215aef3cbd
Update php licenses
...
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2021-06-04 22:02:41 +07:00
cb057829f7
Update license headers for 19
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-29 11:57:22 +07:00
28f8eb5dba
Add visibility to all constants
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-10 16:54:27 +07:00
caff1023ea
Format control structures, classes, methods and function
...
To continue this formatting madness, here's a tiny patch that adds
unified formatting for control structures like if and loops as well as
classes, their methods and anonymous functions. This basically forces
the constructs to start on the same line. This is not exactly what PSR2
wants, but I think we can have a few exceptions with "our" style. The
starting of braces on the same line is pracrically standard for our
code.
This also removes and empty lines from method/function bodies at the
beginning and end.
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-10 14:19:56 +07:00
44577e4345
Remove trailing and in between spaces
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-09 16:07:47 +07:00
1a9330cd69
Update the license headers for Nextcloud 19
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-03-31 14:52:54 +07:00
509af24bc9
Fix invalid instantiation of TemplateResponse if client not found
...
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2020-03-15 11:55:07 +07:00
5bf3d1bb38
Update license headers
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2019-12-05 15:38:45 +07:00
68748d4f85
Some php-cs fixes
...
* Order the imports
* No leading slash on imports
* Empty line before namespace
* One line per import
* Empty after imports
* Emmpty line at bottom of file
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-11-22 20:52:10 +07:00
9e2bb5ef36
Move oauth admin settings to initialstate
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Signed-off-by: npmbuildbot[bot] <npmbuildbot[bot]@users.noreply.github.com>
2019-09-28 13:30:34 +07:00
b9ac258870
Strict controllers
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-12-07 13:43:22 +07:00
1e6711305a
Fail gracefull if an unkown oauth2 client tries to authenticate
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-12-06 21:14:34 +07:00
674930da7f
Move ExpiredTokenException to the correct namespace
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-10-30 19:30:45 +07:00
75456b057d
Reset bruteforce on token refresh OAuth
...
When using atoken obtained via OAuth the token expires. Resulting in
brute force attempts hitting the requesting IP.
This resets the brute force attempts for that UID on a valid refresh of
the token.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-10-30 11:21:27 +07:00
8f9fa9ee13
Remove filter_var flags due to PHP 7.3 deprecation, fixes #10894
...
Signed-off-by: Patrik Kernstock <info@pkern.at>
2018-09-04 00:58:44 +07:00
8370111cf4
Update SettingsController.php
...
Grammar fix. Uppercase URL
See https://www.transifex.com/nextcloud/nextcloud/translate/#de/$/146983238?q=issue%3Aopen
2018-06-30 08:49:44 +07:00
555de27567
Validate OAuth2 redirect uri
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-06-26 16:15:53 +07:00
1ccb36a0f1
Cleanup Controller
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-06-19 11:42:41 +07:00
d2d1e8e375
Migrate OAuth Admin settings to vue
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-06-19 11:42:41 +07:00
3556e78c25
The OAuth endpoint needs to support Basic Auth
...
* Add test
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-05-29 15:17:54 +07:00
5a97148863
Don't use special chars to avoid confusion
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-05-22 09:24:17 +07:00
Richard Steinmetz
Côme Chilliet
provokateurin
Julien Veyssier
Artur Neumann
Andy Scherzinger
Joas Schilling
jld3103
luz paz
J0WI
John Molakvoæ (skjnldsv)
Christoph Wurst
Daniel Kesselberg
Roeland Jago Douma
Patrik Kernstock
rakekniven