Commit Graph

23 Commits

Author SHA1 Message Date
Côme Chilliet f7f9a47ceb fix: Do not set last-password-confirm for apptoken sessions
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2026-06-16 11:59:13 +02:00
Côme Chilliet 1ab09ec753 chore: Apply new coding standard to all files
The diff can be checked using: git diff --ignore-all-space --ignore-blank-lines
To see only the changes not related to blank lines.

Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2026-06-01 13:46:39 +02:00
Ferdinand Thiessen e0ba4d71b6 chore: add missing Override attribute to OC
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
2026-04-28 21:29:27 +02:00
Côme Chilliet 447ee17759 fix: Remove code duplication by using the new method
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2026-03-11 11:36:01 +01:00
Christoph Wurst 8a581c230b refactor: improve reflection attribute typing
This allows tools to see the correct usage of
PasswordConfirmationRequired::getStrict

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2025-12-04 17:37:47 +01:00
Ferdinand Thiessen 5981b7eb51 chore: apply new CSFixer rules
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

# Conflicts:
#	apps/settings/lib/SetupChecks/PhpOpcacheSetup.php
2025-07-01 16:26:50 +02:00
Robin Appelman 8b0a3a774d fix: throw a better error if we don't get an authorization header for secutity confirmation
Signed-off-by: Robin Appelman <robin@icewind.nl>
2025-06-24 15:57:20 +02:00
Louis Chemineau 3bff9ee3e1 fix: Use login name to check the password
Signed-off-by: Louis Chemineau <louis@chmn.me>
2025-04-02 15:50:05 +02:00
Louis Chemineau a2f2f7ce93 feat: Use inline password confirmation in external storage settings
Signed-off-by: Louis Chemineau <louis@chmn.me>
2024-11-28 11:01:54 +01:00
provokateurin 9836e9b164 chore(deps): Update nextcloud/coding-standard to v1.3.1
Signed-off-by: provokateurin <kate@provokateurin.de>
2024-09-19 14:21:20 +02:00
Daniel Kesselberg af6de04e9e style: update codestyle for coding-standard 1.2.3
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
2024-08-25 19:34:58 +02:00
provokateurin e5dcdfb9e0 feat(Security): Warn about using annotations instead of attributes
Signed-off-by: provokateurin <kate@provokateurin.de>
2024-07-18 11:25:32 +02:00
Arthur Schiwon f6d6efef3a refactor(Token): introduce scope constants
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2024-06-05 19:01:14 +02:00
Arthur Schiwon 340939e688 fix(Session): avoid password confirmation on SSO
SSO backends like SAML and OIDC tried a trick to suppress password
confirmations as they are not possible by design. At least for SAML it was
not reliable when existing user backends where used as user repositories.

Now we are setting a special scope with the token, and also make sure that
the scope is taken over when tokens are regenerated.

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2024-06-05 19:01:13 +02:00
Andy Scherzinger dae7c159f7 chore: Add SPDX header
Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
2024-05-24 13:11:22 +02:00
Joas Schilling aa5f037af7 chore: apply changes from Nextcloud coding standards 1.1.1
Signed-off-by: Joas Schilling <coding@schilljs.com>
Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
2023-11-23 10:36:13 +01:00
Joas Schilling ecb8b55c5c feat(security): Add PHP \Attribute for remaining security annotations
Signed-off-by: Joas Schilling <coding@schilljs.com>
2023-04-25 14:50:32 +02:00
John Molakvoæ (skjnldsv) 215aef3cbd Update php licenses
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2021-06-04 22:02:41 +02:00
Christoph Wurst 5bf3d1bb38 Update license headers
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2019-12-05 15:38:45 +01:00
Roeland Jago Douma 68748d4f85 Some php-cs fixes
* Order the imports
* No leading slash on imports
* Empty line before namespace
* One line per import
* Empty after imports
* Emmpty line at bottom of file

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-11-22 20:52:10 +01:00
Roeland Jago Douma 603b672a11 Update password confirmation middleware
If the userbackend doesn't allow validating the password for a given uid
then there is no need to perform this check.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-11-02 13:44:45 +01:00
Bjoern Schiessle 85d9f06cb8 add global site selector as user back-end which doesn't support password confirmation
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
2018-10-27 15:43:51 +02:00
Roeland Jago Douma 57050146f6 Move passwordconfirmation to its own midleware
Add tests

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-01-02 21:58:14 +01:00