nextcloud / server

core/templates/twofactorselectchallenge.php

Braces +13 added lines, -5 removed lines

@@ -32,11 +32,15 @@ 
 					<?php p($l->t('Set up two-factor authentication')) ?>
 				</a>
 			<?php } ?>
-		<?php else: ?>
+		<?php else {
+    : ?>
 			<strong><?php p($l->t('Two-factor authentication is enforced but has not been configured on your account. Use one of your backup codes to log in or contact your admin for assistance.')) ?></strong>
-		<?php endif; ?>
+		<?php endif;
+}
+?>
 	</p>
-	<?php else: ?>
+	<?php else {
+    : ?>
 	<ul>
 	<?php foreach ($_['providers'] as $provider): ?>
 		<li>
@@ -50,6 +54,7 @@ 
 				<?php
 				if ($provider instanceof \OCP\Authentication\TwoFactorAuth\IProvidesIcons) {
 					$icon = $provider->getLightIcon();
+}
 				} else {
 					$icon = image_path('core', 'actions/password-white.svg');
 				}
@@ -66,7 +71,8 @@ 
 	<?php endif ?>
 	<?php if (!is_null($_['backupProvider'])): ?>
 	<p>
-		<a class="<?php if ($noProviders): ?>button primary two-factor-primary<?php else: ?>two-factor-secondary<?php endif ?>" href="<?php p(\OCP\Server::get(\OCP\IURLGenerator::class)->linkToRoute('core.TwoFactorChallenge.showChallenge',
+		<a class="<?php if ($noProviders): ?>button primary two-factor-primary<?php else {
+    : ?>two-factor-secondary<?php endif ?>" href="<?php p(\OCP\Server::get(\OCP\IURLGenerator::class)->linkToRoute('core.TwoFactorChallenge.showChallenge',
 			[
 				'challengeProviderId' => $_['backupProvider']->getId(),
 				'redirect_url' => $_['redirect_url'],
@@ -75,7 +81,9 @@ 
 			<?php p($l->t('Use backup code')) ?>
 		</a>
 	</p>
-	<?php endif; ?>
+	<?php endif;
+}
+?>
 	<p><a id="cancel-login" class="two-factor-secondary" href="<?php print_unescaped($_['logout_url']); ?>">
 		<?php p($l->t('Cancel login')) ?>
 	</a></p>

core/Controller/CSRFTokenController.php

Indentation +30 added lines, -30 removed lines

@@ -19,37 +19,37 @@
 use OCP\IRequest;
 
 class CSRFTokenController extends Controller {
-	public function __construct(
-		string $appName,
-		IRequest $request,
-		private CsrfTokenManager $tokenManager,
-	) {
-		parent::__construct($appName, $request);
-	}
+    public function __construct(
+        string $appName,
+        IRequest $request,
+        private CsrfTokenManager $tokenManager,
+    ) {
+        parent::__construct($appName, $request);
+    }
 
-	/**
-	 * Returns a new CSRF token.
-	 *
-	 * @return JSONResponse<Http::STATUS_OK, array{token: string}, array{}>|JSONResponse<Http::STATUS_FORBIDDEN, list<empty>, array{}>
-	 *
-	 * 200: CSRF token returned
-	 * 403: Strict cookie check failed
-	 *
-	 * @NoTwoFactorRequired
-	 */
-	#[PublicPage]
-	#[NoCSRFRequired]
-	#[FrontpageRoute(verb: 'GET', url: '/csrftoken')]
-	#[OpenAPI(scope: OpenAPI::SCOPE_DEFAULT)]
-	public function index(): JSONResponse {
-		if (!$this->request->passesStrictCookieCheck()) {
-			return new JSONResponse([], Http::STATUS_FORBIDDEN);
-		}
+    /**
+     * Returns a new CSRF token.
+     *
+     * @return JSONResponse<Http::STATUS_OK, array{token: string}, array{}>|JSONResponse<Http::STATUS_FORBIDDEN, list<empty>, array{}>
+     *
+     * 200: CSRF token returned
+     * 403: Strict cookie check failed
+     *
+     * @NoTwoFactorRequired
+     */
+    #[PublicPage]
+    #[NoCSRFRequired]
+    #[FrontpageRoute(verb: 'GET', url: '/csrftoken')]
+    #[OpenAPI(scope: OpenAPI::SCOPE_DEFAULT)]
+    public function index(): JSONResponse {
+        if (!$this->request->passesStrictCookieCheck()) {
+            return new JSONResponse([], Http::STATUS_FORBIDDEN);
+        }
 
-		$requestToken = $this->tokenManager->getToken();
+        $requestToken = $this->tokenManager->getToken();
 
-		return new JSONResponse([
-			'token' => $requestToken->getEncryptedValue(),
-		]);
-	}
+        return new JSONResponse([
+            'token' => $requestToken->getEncryptedValue(),
+        ]);
+    }
 }

core/Controller/TwoFactorChallengeController.php

Indentation +204 added lines, -204 removed lines

@@ -30,232 +30,232 @@
 
 #[OpenAPI(scope: OpenAPI::SCOPE_IGNORE)]
 class TwoFactorChallengeController extends Controller {
-	public function __construct(
-		string $appName,
-		IRequest $request,
-		private Manager $twoFactorManager,
-		private IUserSession $userSession,
-		private ISession $session,
-		private IURLGenerator $urlGenerator,
-		private LoggerInterface $logger,
-	) {
-		parent::__construct($appName, $request);
-	}
+    public function __construct(
+        string $appName,
+        IRequest $request,
+        private Manager $twoFactorManager,
+        private IUserSession $userSession,
+        private ISession $session,
+        private IURLGenerator $urlGenerator,
+        private LoggerInterface $logger,
+    ) {
+        parent::__construct($appName, $request);
+    }
 
-	/**
-	 * @return string
-	 */
-	protected function getLogoutUrl() {
-		return OC_User::getLogoutUrl($this->urlGenerator);
-	}
+    /**
+     * @return string
+     */
+    protected function getLogoutUrl() {
+        return OC_User::getLogoutUrl($this->urlGenerator);
+    }
 
-	/**
-	 * @param IProvider[] $providers
-	 */
-	private function splitProvidersAndBackupCodes(array $providers): array {
-		$regular = [];
-		$backup = null;
-		foreach ($providers as $provider) {
-			if ($provider->getId() === 'backup_codes') {
-				$backup = $provider;
-			} else {
-				$regular[] = $provider;
-			}
-		}
+    /**
+     * @param IProvider[] $providers
+     */
+    private function splitProvidersAndBackupCodes(array $providers): array {
+        $regular = [];
+        $backup = null;
+        foreach ($providers as $provider) {
+            if ($provider->getId() === 'backup_codes') {
+                $backup = $provider;
+            } else {
+                $regular[] = $provider;
+            }
+        }
 
-		return [$regular, $backup];
-	}
+        return [$regular, $backup];
+    }
 
-	/**
-	 * @TwoFactorSetUpDoneRequired
-	 *
-	 * @param string $redirect_url
-	 * @return StandaloneTemplateResponse
-	 */
-	#[NoAdminRequired]
-	#[NoCSRFRequired]
-	#[FrontpageRoute(verb: 'GET', url: '/login/selectchallenge')]
-	public function selectChallenge($redirect_url) {
-		$user = $this->userSession->getUser();
-		$providerSet = $this->twoFactorManager->getProviderSet($user);
-		$allProviders = $providerSet->getProviders();
-		[$providers, $backupProvider] = $this->splitProvidersAndBackupCodes($allProviders);
-		$setupProviders = $this->twoFactorManager->getLoginSetupProviders($user);
+    /**
+     * @TwoFactorSetUpDoneRequired
+     *
+     * @param string $redirect_url
+     * @return StandaloneTemplateResponse
+     */
+    #[NoAdminRequired]
+    #[NoCSRFRequired]
+    #[FrontpageRoute(verb: 'GET', url: '/login/selectchallenge')]
+    public function selectChallenge($redirect_url) {
+        $user = $this->userSession->getUser();
+        $providerSet = $this->twoFactorManager->getProviderSet($user);
+        $allProviders = $providerSet->getProviders();
+        [$providers, $backupProvider] = $this->splitProvidersAndBackupCodes($allProviders);
+        $setupProviders = $this->twoFactorManager->getLoginSetupProviders($user);
 
-		$data = [
-			'providers' => $providers,
-			'backupProvider' => $backupProvider,
-			'providerMissing' => $providerSet->isProviderMissing(),
-			'redirect_url' => $redirect_url,
-			'logout_url' => $this->getLogoutUrl(),
-			'hasSetupProviders' => !empty($setupProviders),
-		];
-		Util::addScript('core', 'twofactor-request-token');
-		return new StandaloneTemplateResponse($this->appName, 'twofactorselectchallenge', $data, 'guest');
-	}
+        $data = [
+            'providers' => $providers,
+            'backupProvider' => $backupProvider,
+            'providerMissing' => $providerSet->isProviderMissing(),
+            'redirect_url' => $redirect_url,
+            'logout_url' => $this->getLogoutUrl(),
+            'hasSetupProviders' => !empty($setupProviders),
+        ];
+        Util::addScript('core', 'twofactor-request-token');
+        return new StandaloneTemplateResponse($this->appName, 'twofactorselectchallenge', $data, 'guest');
+    }
 
-	/**
-	 * @TwoFactorSetUpDoneRequired
-	 *
-	 * @param string $challengeProviderId
-	 * @param string $redirect_url
-	 * @return StandaloneTemplateResponse|RedirectResponse
-	 */
-	#[NoAdminRequired]
-	#[NoCSRFRequired]
-	#[UseSession]
-	#[FrontpageRoute(verb: 'GET', url: '/login/challenge/{challengeProviderId}')]
-	public function showChallenge($challengeProviderId, $redirect_url) {
-		$user = $this->userSession->getUser();
-		$providerSet = $this->twoFactorManager->getProviderSet($user);
-		$provider = $providerSet->getProvider($challengeProviderId);
+    /**
+     * @TwoFactorSetUpDoneRequired
+     *
+     * @param string $challengeProviderId
+     * @param string $redirect_url
+     * @return StandaloneTemplateResponse|RedirectResponse
+     */
+    #[NoAdminRequired]
+    #[NoCSRFRequired]
+    #[UseSession]
+    #[FrontpageRoute(verb: 'GET', url: '/login/challenge/{challengeProviderId}')]
+    public function showChallenge($challengeProviderId, $redirect_url) {
+        $user = $this->userSession->getUser();
+        $providerSet = $this->twoFactorManager->getProviderSet($user);
+        $provider = $providerSet->getProvider($challengeProviderId);
 
-		if (is_null($provider)) {
-			return new RedirectResponse($this->urlGenerator->linkToRoute('core.TwoFactorChallenge.selectChallenge'));
-		}
+        if (is_null($provider)) {
+            return new RedirectResponse($this->urlGenerator->linkToRoute('core.TwoFactorChallenge.selectChallenge'));
+        }
 
-		$backupProvider = $providerSet->getProvider('backup_codes');
-		if (!is_null($backupProvider) && $backupProvider->getId() === $provider->getId()) {
-			// Don't show the backup provider link if we're already showing that provider's challenge
-			$backupProvider = null;
-		}
+        $backupProvider = $providerSet->getProvider('backup_codes');
+        if (!is_null($backupProvider) && $backupProvider->getId() === $provider->getId()) {
+            // Don't show the backup provider link if we're already showing that provider's challenge
+            $backupProvider = null;
+        }
 
-		$errorMessage = '';
-		$error = false;
-		if ($this->session->exists('two_factor_auth_error')) {
-			$this->session->remove('two_factor_auth_error');
-			$error = true;
-			$errorMessage = $this->session->get('two_factor_auth_error_message');
-			$this->session->remove('two_factor_auth_error_message');
-		}
-		$tmpl = $provider->getTemplate($user);
-		$tmpl->assign('redirect_url', $redirect_url);
-		$data = [
-			'error' => $error,
-			'error_message' => $errorMessage,
-			'provider' => $provider,
-			'backupProvider' => $backupProvider,
-			'logout_url' => $this->getLogoutUrl(),
-			'redirect_url' => $redirect_url,
-			'template' => $tmpl->fetchPage(),
-		];
-		$response = new StandaloneTemplateResponse($this->appName, 'twofactorshowchallenge', $data, 'guest');
-		if ($provider instanceof IProvidesCustomCSP) {
-			$response->setContentSecurityPolicy($provider->getCSP());
-		}
-		Util::addScript('core', 'twofactor-request-token');
-		return $response;
-	}
+        $errorMessage = '';
+        $error = false;
+        if ($this->session->exists('two_factor_auth_error')) {
+            $this->session->remove('two_factor_auth_error');
+            $error = true;
+            $errorMessage = $this->session->get('two_factor_auth_error_message');
+            $this->session->remove('two_factor_auth_error_message');
+        }
+        $tmpl = $provider->getTemplate($user);
+        $tmpl->assign('redirect_url', $redirect_url);
+        $data = [
+            'error' => $error,
+            'error_message' => $errorMessage,
+            'provider' => $provider,
+            'backupProvider' => $backupProvider,
+            'logout_url' => $this->getLogoutUrl(),
+            'redirect_url' => $redirect_url,
+            'template' => $tmpl->fetchPage(),
+        ];
+        $response = new StandaloneTemplateResponse($this->appName, 'twofactorshowchallenge', $data, 'guest');
+        if ($provider instanceof IProvidesCustomCSP) {
+            $response->setContentSecurityPolicy($provider->getCSP());
+        }
+        Util::addScript('core', 'twofactor-request-token');
+        return $response;
+    }
 
-	/**
-	 * @TwoFactorSetUpDoneRequired
-	 *
-	 * @UserRateThrottle(limit=5, period=100)
-	 *
-	 * @param string $challengeProviderId
-	 * @param string $challenge
-	 * @param string $redirect_url
-	 * @return RedirectResponse
-	 */
-	#[NoAdminRequired]
-	#[NoCSRFRequired]
-	#[UseSession]
-	#[FrontpageRoute(verb: 'POST', url: '/login/challenge/{challengeProviderId}')]
-	public function solveChallenge($challengeProviderId, $challenge, $redirect_url = null) {
-		$user = $this->userSession->getUser();
-		$provider = $this->twoFactorManager->getProvider($user, $challengeProviderId);
-		if (is_null($provider)) {
-			return new RedirectResponse($this->urlGenerator->linkToRoute('core.TwoFactorChallenge.selectChallenge'));
-		}
+    /**
+     * @TwoFactorSetUpDoneRequired
+     *
+     * @UserRateThrottle(limit=5, period=100)
+     *
+     * @param string $challengeProviderId
+     * @param string $challenge
+     * @param string $redirect_url
+     * @return RedirectResponse
+     */
+    #[NoAdminRequired]
+    #[NoCSRFRequired]
+    #[UseSession]
+    #[FrontpageRoute(verb: 'POST', url: '/login/challenge/{challengeProviderId}')]
+    public function solveChallenge($challengeProviderId, $challenge, $redirect_url = null) {
+        $user = $this->userSession->getUser();
+        $provider = $this->twoFactorManager->getProvider($user, $challengeProviderId);
+        if (is_null($provider)) {
+            return new RedirectResponse($this->urlGenerator->linkToRoute('core.TwoFactorChallenge.selectChallenge'));
+        }
 
-		try {
-			if ($this->twoFactorManager->verifyChallenge($challengeProviderId, $user, $challenge)) {
-				if (!is_null($redirect_url)) {
-					return new RedirectResponse($this->urlGenerator->getAbsoluteURL(urldecode($redirect_url)));
-				}
-				return new RedirectResponse($this->urlGenerator->linkToDefaultPageUrl());
-			}
-		} catch (TwoFactorException $e) {
-			/*
+        try {
+            if ($this->twoFactorManager->verifyChallenge($challengeProviderId, $user, $challenge)) {
+                if (!is_null($redirect_url)) {
+                    return new RedirectResponse($this->urlGenerator->getAbsoluteURL(urldecode($redirect_url)));
+                }
+                return new RedirectResponse($this->urlGenerator->linkToDefaultPageUrl());
+            }
+        } catch (TwoFactorException $e) {
+            /*
 			 * The 2FA App threw an TwoFactorException. Now we display more
 			 * information to the user. The exception text is stored in the
 			 * session to be used in showChallenge()
 			 */
-			$this->session->set('two_factor_auth_error_message', $e->getMessage());
-		}
+            $this->session->set('two_factor_auth_error_message', $e->getMessage());
+        }
 
-		$ip = $this->request->getRemoteAddress();
-		$uid = $user->getUID();
-		$this->logger->warning("Two-factor challenge failed: $uid (Remote IP: $ip)");
-		$this->session->set('two_factor_auth_error', true);
-		return new RedirectResponse($this->urlGenerator->linkToRoute('core.TwoFactorChallenge.showChallenge', [
-			'challengeProviderId' => $provider->getId(),
-			'redirect_url' => $redirect_url,
-		]));
-	}
+        $ip = $this->request->getRemoteAddress();
+        $uid = $user->getUID();
+        $this->logger->warning("Two-factor challenge failed: $uid (Remote IP: $ip)");
+        $this->session->set('two_factor_auth_error', true);
+        return new RedirectResponse($this->urlGenerator->linkToRoute('core.TwoFactorChallenge.showChallenge', [
+            'challengeProviderId' => $provider->getId(),
+            'redirect_url' => $redirect_url,
+        ]));
+    }
 
-	#[NoAdminRequired]
-	#[NoCSRFRequired]
-	#[FrontpageRoute(verb: 'GET', url: 'login/setupchallenge')]
-	public function setupProviders(?string $redirect_url = null): StandaloneTemplateResponse {
-		$user = $this->userSession->getUser();
-		$setupProviders = $this->twoFactorManager->getLoginSetupProviders($user);
+    #[NoAdminRequired]
+    #[NoCSRFRequired]
+    #[FrontpageRoute(verb: 'GET', url: 'login/setupchallenge')]
+    public function setupProviders(?string $redirect_url = null): StandaloneTemplateResponse {
+        $user = $this->userSession->getUser();
+        $setupProviders = $this->twoFactorManager->getLoginSetupProviders($user);
 
-		$data = [
-			'providers' => $setupProviders,
-			'logout_url' => $this->getLogoutUrl(),
-			'redirect_url' => $redirect_url,
-		];
+        $data = [
+            'providers' => $setupProviders,
+            'logout_url' => $this->getLogoutUrl(),
+            'redirect_url' => $redirect_url,
+        ];
 
-		Util::addScript('core', 'twofactor-request-token');
-		return new StandaloneTemplateResponse($this->appName, 'twofactorsetupselection', $data, 'guest');
-	}
+        Util::addScript('core', 'twofactor-request-token');
+        return new StandaloneTemplateResponse($this->appName, 'twofactorsetupselection', $data, 'guest');
+    }
 
-	#[NoAdminRequired]
-	#[NoCSRFRequired]
-	#[FrontpageRoute(verb: 'GET', url: 'login/setupchallenge/{providerId}')]
-	public function setupProvider(string $providerId, ?string $redirect_url = null) {
-		$user = $this->userSession->getUser();
-		$providers = $this->twoFactorManager->getLoginSetupProviders($user);
+    #[NoAdminRequired]
+    #[NoCSRFRequired]
+    #[FrontpageRoute(verb: 'GET', url: 'login/setupchallenge/{providerId}')]
+    public function setupProvider(string $providerId, ?string $redirect_url = null) {
+        $user = $this->userSession->getUser();
+        $providers = $this->twoFactorManager->getLoginSetupProviders($user);
 
-		$provider = null;
-		foreach ($providers as $p) {
-			if ($p->getId() === $providerId) {
-				$provider = $p;
-				break;
-			}
-		}
+        $provider = null;
+        foreach ($providers as $p) {
+            if ($p->getId() === $providerId) {
+                $provider = $p;
+                break;
+            }
+        }
 
-		if ($provider === null) {
-			return new RedirectResponse($this->urlGenerator->linkToRoute('core.TwoFactorChallenge.selectChallenge'));
-		}
+        if ($provider === null) {
+            return new RedirectResponse($this->urlGenerator->linkToRoute('core.TwoFactorChallenge.selectChallenge'));
+        }
 
-		/** @var IActivatableAtLogin $provider */
-		$tmpl = $provider->getLoginSetup($user)->getBody();
-		$data = [
-			'provider' => $provider,
-			'logout_url' => $this->getLogoutUrl(),
-			'redirect_url' => $redirect_url,
-			'template' => $tmpl->fetchPage(),
-		];
-		$response = new StandaloneTemplateResponse($this->appName, 'twofactorsetupchallenge', $data, 'guest');
-		Util::addScript('core', 'twofactor-request-token');
-		return $response;
-	}
+        /** @var IActivatableAtLogin $provider */
+        $tmpl = $provider->getLoginSetup($user)->getBody();
+        $data = [
+            'provider' => $provider,
+            'logout_url' => $this->getLogoutUrl(),
+            'redirect_url' => $redirect_url,
+            'template' => $tmpl->fetchPage(),
+        ];
+        $response = new StandaloneTemplateResponse($this->appName, 'twofactorsetupchallenge', $data, 'guest');
+        Util::addScript('core', 'twofactor-request-token');
+        return $response;
+    }
 
-	/**
-	 * @todo handle the extreme edge case of an invalid provider ID and redirect to the provider selection page
-	 */
-	#[NoAdminRequired]
-	#[NoCSRFRequired]
-	#[FrontpageRoute(verb: 'POST', url: 'login/setupchallenge/{providerId}')]
-	public function confirmProviderSetup(string $providerId, ?string $redirect_url = null) {
-		return new RedirectResponse($this->urlGenerator->linkToRoute(
-			'core.TwoFactorChallenge.showChallenge',
-			[
-				'challengeProviderId' => $providerId,
-				'redirect_url' => $redirect_url,
-			]
-		));
-	}
+    /**
+     * @todo handle the extreme edge case of an invalid provider ID and redirect to the provider selection page
+     */
+    #[NoAdminRequired]
+    #[NoCSRFRequired]
+    #[FrontpageRoute(verb: 'POST', url: 'login/setupchallenge/{providerId}')]
+    public function confirmProviderSetup(string $providerId, ?string $redirect_url = null) {
+        return new RedirectResponse($this->urlGenerator->linkToRoute(
+            'core.TwoFactorChallenge.showChallenge',
+            [
+                'challengeProviderId' => $providerId,
+                'redirect_url' => $redirect_url,
+            ]
+        ));
+    }
 }