nextcloud /
server
@@ -32,69 +32,69 @@ |
||
| 32 | 32 | use OCP\Security\ISecureRandom; |
| 33 | 33 | |
| 34 | 34 | class SettingsController extends Controller { |
| 35 | - /** @var IURLGenerator */ |
|
| 36 | - private $urlGenerator; |
|
| 37 | - /** @var ClientMapper */ |
|
| 38 | - private $clientMapper; |
|
| 39 | - /** @var ISecureRandom */ |
|
| 40 | - private $secureRandom; |
|
| 41 | - /** @var AccessTokenMapper */ |
|
| 42 | - private $accessTokenMapper; |
|
| 43 | - /** @var DefaultTokenMapper */ |
|
| 44 | - private $defaultTokenMapper; |
|
| 35 | + /** @var IURLGenerator */ |
|
| 36 | + private $urlGenerator; |
|
| 37 | + /** @var ClientMapper */ |
|
| 38 | + private $clientMapper; |
|
| 39 | + /** @var ISecureRandom */ |
|
| 40 | + private $secureRandom; |
|
| 41 | + /** @var AccessTokenMapper */ |
|
| 42 | + private $accessTokenMapper; |
|
| 43 | + /** @var DefaultTokenMapper */ |
|
| 44 | + private $defaultTokenMapper; |
|
| 45 | 45 | |
| 46 | - const validChars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; |
|
| 46 | + const validChars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; |
|
| 47 | 47 | |
| 48 | - /** |
|
| 49 | - * @param string $appName |
|
| 50 | - * @param IRequest $request |
|
| 51 | - * @param IURLGenerator $urlGenerator |
|
| 52 | - * @param ClientMapper $clientMapper |
|
| 53 | - * @param ISecureRandom $secureRandom |
|
| 54 | - * @param AccessTokenMapper $accessTokenMapper |
|
| 55 | - * @param DefaultTokenMapper $defaultTokenMapper |
|
| 56 | - */ |
|
| 57 | - public function __construct($appName, |
|
| 58 | - IRequest $request, |
|
| 59 | - IURLGenerator $urlGenerator, |
|
| 60 | - ClientMapper $clientMapper, |
|
| 61 | - ISecureRandom $secureRandom, |
|
| 62 | - AccessTokenMapper $accessTokenMapper, |
|
| 63 | - DefaultTokenMapper $defaultTokenMapper |
|
| 64 | - ) { |
|
| 65 | - parent::__construct($appName, $request); |
|
| 66 | - $this->urlGenerator = $urlGenerator; |
|
| 67 | - $this->secureRandom = $secureRandom; |
|
| 68 | - $this->clientMapper = $clientMapper; |
|
| 69 | - $this->accessTokenMapper = $accessTokenMapper; |
|
| 70 | - $this->defaultTokenMapper = $defaultTokenMapper; |
|
| 71 | - } |
|
| 48 | + /** |
|
| 49 | + * @param string $appName |
|
| 50 | + * @param IRequest $request |
|
| 51 | + * @param IURLGenerator $urlGenerator |
|
| 52 | + * @param ClientMapper $clientMapper |
|
| 53 | + * @param ISecureRandom $secureRandom |
|
| 54 | + * @param AccessTokenMapper $accessTokenMapper |
|
| 55 | + * @param DefaultTokenMapper $defaultTokenMapper |
|
| 56 | + */ |
|
| 57 | + public function __construct($appName, |
|
| 58 | + IRequest $request, |
|
| 59 | + IURLGenerator $urlGenerator, |
|
| 60 | + ClientMapper $clientMapper, |
|
| 61 | + ISecureRandom $secureRandom, |
|
| 62 | + AccessTokenMapper $accessTokenMapper, |
|
| 63 | + DefaultTokenMapper $defaultTokenMapper |
|
| 64 | + ) { |
|
| 65 | + parent::__construct($appName, $request); |
|
| 66 | + $this->urlGenerator = $urlGenerator; |
|
| 67 | + $this->secureRandom = $secureRandom; |
|
| 68 | + $this->clientMapper = $clientMapper; |
|
| 69 | + $this->accessTokenMapper = $accessTokenMapper; |
|
| 70 | + $this->defaultTokenMapper = $defaultTokenMapper; |
|
| 71 | + } |
|
| 72 | 72 | |
| 73 | - /** |
|
| 74 | - * @param string $name |
|
| 75 | - * @param string $redirectUri |
|
| 76 | - * @return RedirectResponse |
|
| 77 | - */ |
|
| 78 | - public function addClient($name, |
|
| 79 | - $redirectUri) { |
|
| 80 | - $client = new Client(); |
|
| 81 | - $client->setName($name); |
|
| 82 | - $client->setRedirectUri($redirectUri); |
|
| 83 | - $client->setSecret($this->secureRandom->generate(64, self::validChars)); |
|
| 84 | - $client->setClientIdentifier($this->secureRandom->generate(64, self::validChars)); |
|
| 85 | - $this->clientMapper->insert($client); |
|
| 86 | - return new RedirectResponse($this->urlGenerator->getAbsoluteURL('/index.php/settings/admin/security')); |
|
| 87 | - } |
|
| 73 | + /** |
|
| 74 | + * @param string $name |
|
| 75 | + * @param string $redirectUri |
|
| 76 | + * @return RedirectResponse |
|
| 77 | + */ |
|
| 78 | + public function addClient($name, |
|
| 79 | + $redirectUri) { |
|
| 80 | + $client = new Client(); |
|
| 81 | + $client->setName($name); |
|
| 82 | + $client->setRedirectUri($redirectUri); |
|
| 83 | + $client->setSecret($this->secureRandom->generate(64, self::validChars)); |
|
| 84 | + $client->setClientIdentifier($this->secureRandom->generate(64, self::validChars)); |
|
| 85 | + $this->clientMapper->insert($client); |
|
| 86 | + return new RedirectResponse($this->urlGenerator->getAbsoluteURL('/index.php/settings/admin/security')); |
|
| 87 | + } |
|
| 88 | 88 | |
| 89 | - /** |
|
| 90 | - * @param int $id |
|
| 91 | - * @return RedirectResponse |
|
| 92 | - */ |
|
| 93 | - public function deleteClient($id) { |
|
| 94 | - $client = $this->clientMapper->getByUid($id); |
|
| 95 | - $this->accessTokenMapper->deleteByClientId($id); |
|
| 96 | - $this->defaultTokenMapper->deleteByName($client->getName()); |
|
| 97 | - $this->clientMapper->delete($client); |
|
| 98 | - return new RedirectResponse($this->urlGenerator->getAbsoluteURL('/index.php/settings/admin/security')); |
|
| 99 | - } |
|
| 89 | + /** |
|
| 90 | + * @param int $id |
|
| 91 | + * @return RedirectResponse |
|
| 92 | + */ |
|
| 93 | + public function deleteClient($id) { |
|
| 94 | + $client = $this->clientMapper->getByUid($id); |
|
| 95 | + $this->accessTokenMapper->deleteByClientId($id); |
|
| 96 | + $this->defaultTokenMapper->deleteByName($client->getName()); |
|
| 97 | + $this->clientMapper->delete($client); |
|
| 98 | + return new RedirectResponse($this->urlGenerator->getAbsoluteURL('/index.php/settings/admin/security')); |
|
| 99 | + } |
|
| 100 | 100 | } |
@@ -46,9 +46,9 @@ |
||
| 46 | 46 | </thead> |
| 47 | 47 | <tbody> |
| 48 | 48 | <?php |
| 49 | - $imageUrl = $urlGenerator->imagePath('core', 'actions/toggle.svg'); |
|
| 50 | - foreach ($clients as $client) { |
|
| 51 | - ?> |
|
| 49 | + $imageUrl = $urlGenerator->imagePath('core', 'actions/toggle.svg'); |
|
| 50 | + foreach ($clients as $client) { |
|
| 51 | + ?> |
|
| 52 | 52 | <tr> |
| 53 | 53 | <td><?php p($client->getName()); ?></td> |
| 54 | 54 | <td><?php p($client->getRedirectUri()); ?></td> |
@@ -29,51 +29,51 @@ |
||
| 29 | 29 | use OCP\IURLGenerator; |
| 30 | 30 | |
| 31 | 31 | class LoginRedirectorController extends Controller { |
| 32 | - /** @var IURLGenerator */ |
|
| 33 | - private $urlGenerator; |
|
| 34 | - /** @var ClientMapper */ |
|
| 35 | - private $clientMapper; |
|
| 36 | - /** @var ISession */ |
|
| 37 | - private $session; |
|
| 32 | + /** @var IURLGenerator */ |
|
| 33 | + private $urlGenerator; |
|
| 34 | + /** @var ClientMapper */ |
|
| 35 | + private $clientMapper; |
|
| 36 | + /** @var ISession */ |
|
| 37 | + private $session; |
|
| 38 | 38 | |
| 39 | - /** |
|
| 40 | - * @param string $appName |
|
| 41 | - * @param IRequest $request |
|
| 42 | - * @param IURLGenerator $urlGenerator |
|
| 43 | - * @param ClientMapper $clientMapper |
|
| 44 | - * @param ISession $session |
|
| 45 | - */ |
|
| 46 | - public function __construct($appName, |
|
| 47 | - IRequest $request, |
|
| 48 | - IURLGenerator $urlGenerator, |
|
| 49 | - ClientMapper $clientMapper, |
|
| 50 | - ISession $session) { |
|
| 51 | - parent::__construct($appName, $request); |
|
| 52 | - $this->urlGenerator = $urlGenerator; |
|
| 53 | - $this->clientMapper = $clientMapper; |
|
| 54 | - $this->session = $session; |
|
| 55 | - } |
|
| 39 | + /** |
|
| 40 | + * @param string $appName |
|
| 41 | + * @param IRequest $request |
|
| 42 | + * @param IURLGenerator $urlGenerator |
|
| 43 | + * @param ClientMapper $clientMapper |
|
| 44 | + * @param ISession $session |
|
| 45 | + */ |
|
| 46 | + public function __construct($appName, |
|
| 47 | + IRequest $request, |
|
| 48 | + IURLGenerator $urlGenerator, |
|
| 49 | + ClientMapper $clientMapper, |
|
| 50 | + ISession $session) { |
|
| 51 | + parent::__construct($appName, $request); |
|
| 52 | + $this->urlGenerator = $urlGenerator; |
|
| 53 | + $this->clientMapper = $clientMapper; |
|
| 54 | + $this->session = $session; |
|
| 55 | + } |
|
| 56 | 56 | |
| 57 | - /** |
|
| 58 | - * @PublicPage |
|
| 59 | - * @NoCSRFRequired |
|
| 60 | - * @UseSession |
|
| 61 | - * |
|
| 62 | - * @param string $client_id |
|
| 63 | - * @param string $state |
|
| 64 | - * @return RedirectResponse |
|
| 65 | - */ |
|
| 66 | - public function authorize($client_id, |
|
| 67 | - $state) { |
|
| 68 | - $client = $this->clientMapper->getByIdentifier($client_id); |
|
| 69 | - $this->session->set('oauth.state', $state); |
|
| 57 | + /** |
|
| 58 | + * @PublicPage |
|
| 59 | + * @NoCSRFRequired |
|
| 60 | + * @UseSession |
|
| 61 | + * |
|
| 62 | + * @param string $client_id |
|
| 63 | + * @param string $state |
|
| 64 | + * @return RedirectResponse |
|
| 65 | + */ |
|
| 66 | + public function authorize($client_id, |
|
| 67 | + $state) { |
|
| 68 | + $client = $this->clientMapper->getByIdentifier($client_id); |
|
| 69 | + $this->session->set('oauth.state', $state); |
|
| 70 | 70 | |
| 71 | - $targetUrl = $this->urlGenerator->linkToRouteAbsolute( |
|
| 72 | - 'core.ClientFlowLogin.showAuthPickerPage', |
|
| 73 | - [ |
|
| 74 | - 'clientIdentifier' => $client->getClientIdentifier(), |
|
| 75 | - ] |
|
| 76 | - ); |
|
| 77 | - return new RedirectResponse($targetUrl); |
|
| 78 | - } |
|
| 71 | + $targetUrl = $this->urlGenerator->linkToRouteAbsolute( |
|
| 72 | + 'core.ClientFlowLogin.showAuthPickerPage', |
|
| 73 | + [ |
|
| 74 | + 'clientIdentifier' => $client->getClientIdentifier(), |
|
| 75 | + ] |
|
| 76 | + ); |
|
| 77 | + return new RedirectResponse($targetUrl); |
|
| 78 | + } |
|
| 79 | 79 | } |
@@ -30,59 +30,59 @@ |
||
| 30 | 30 | use OCP\Security\ISecureRandom; |
| 31 | 31 | |
| 32 | 32 | class OauthApiController extends Controller { |
| 33 | - /** @var AccessTokenMapper */ |
|
| 34 | - private $accessTokenMapper; |
|
| 35 | - /** @var ICrypto */ |
|
| 36 | - private $crypto; |
|
| 37 | - /** @var DefaultTokenMapper */ |
|
| 38 | - private $defaultTokenMapper; |
|
| 39 | - /** @var ISecureRandom */ |
|
| 40 | - private $secureRandom; |
|
| 33 | + /** @var AccessTokenMapper */ |
|
| 34 | + private $accessTokenMapper; |
|
| 35 | + /** @var ICrypto */ |
|
| 36 | + private $crypto; |
|
| 37 | + /** @var DefaultTokenMapper */ |
|
| 38 | + private $defaultTokenMapper; |
|
| 39 | + /** @var ISecureRandom */ |
|
| 40 | + private $secureRandom; |
|
| 41 | 41 | |
| 42 | - /** |
|
| 43 | - * @param string $appName |
|
| 44 | - * @param IRequest $request |
|
| 45 | - * @param ICrypto $crypto |
|
| 46 | - * @param AccessTokenMapper $accessTokenMapper |
|
| 47 | - * @param DefaultTokenMapper $defaultTokenMapper |
|
| 48 | - * @param ISecureRandom $secureRandom |
|
| 49 | - */ |
|
| 50 | - public function __construct($appName, |
|
| 51 | - IRequest $request, |
|
| 52 | - ICrypto $crypto, |
|
| 53 | - AccessTokenMapper $accessTokenMapper, |
|
| 54 | - DefaultTokenMapper $defaultTokenMapper, |
|
| 55 | - ISecureRandom $secureRandom) { |
|
| 56 | - parent::__construct($appName, $request); |
|
| 57 | - $this->crypto = $crypto; |
|
| 58 | - $this->accessTokenMapper = $accessTokenMapper; |
|
| 59 | - $this->defaultTokenMapper = $defaultTokenMapper; |
|
| 60 | - $this->secureRandom = $secureRandom; |
|
| 61 | - } |
|
| 42 | + /** |
|
| 43 | + * @param string $appName |
|
| 44 | + * @param IRequest $request |
|
| 45 | + * @param ICrypto $crypto |
|
| 46 | + * @param AccessTokenMapper $accessTokenMapper |
|
| 47 | + * @param DefaultTokenMapper $defaultTokenMapper |
|
| 48 | + * @param ISecureRandom $secureRandom |
|
| 49 | + */ |
|
| 50 | + public function __construct($appName, |
|
| 51 | + IRequest $request, |
|
| 52 | + ICrypto $crypto, |
|
| 53 | + AccessTokenMapper $accessTokenMapper, |
|
| 54 | + DefaultTokenMapper $defaultTokenMapper, |
|
| 55 | + ISecureRandom $secureRandom) { |
|
| 56 | + parent::__construct($appName, $request); |
|
| 57 | + $this->crypto = $crypto; |
|
| 58 | + $this->accessTokenMapper = $accessTokenMapper; |
|
| 59 | + $this->defaultTokenMapper = $defaultTokenMapper; |
|
| 60 | + $this->secureRandom = $secureRandom; |
|
| 61 | + } |
|
| 62 | 62 | |
| 63 | - /** |
|
| 64 | - * @PublicPage |
|
| 65 | - * @NoCSRFRequired |
|
| 66 | - * |
|
| 67 | - * @param string $code |
|
| 68 | - * @return JSONResponse |
|
| 69 | - */ |
|
| 70 | - public function getToken($code) { |
|
| 71 | - $accessToken = $this->accessTokenMapper->getByCode($code); |
|
| 72 | - $decryptedToken = $this->crypto->decrypt($accessToken->getEncryptedToken(), $code); |
|
| 73 | - $newCode = $this->secureRandom->generate(128); |
|
| 74 | - $accessToken->setHashedCode(hash('sha512', $newCode)); |
|
| 75 | - $accessToken->setEncryptedToken($this->crypto->encrypt($decryptedToken, $newCode)); |
|
| 76 | - $this->accessTokenMapper->update($accessToken); |
|
| 63 | + /** |
|
| 64 | + * @PublicPage |
|
| 65 | + * @NoCSRFRequired |
|
| 66 | + * |
|
| 67 | + * @param string $code |
|
| 68 | + * @return JSONResponse |
|
| 69 | + */ |
|
| 70 | + public function getToken($code) { |
|
| 71 | + $accessToken = $this->accessTokenMapper->getByCode($code); |
|
| 72 | + $decryptedToken = $this->crypto->decrypt($accessToken->getEncryptedToken(), $code); |
|
| 73 | + $newCode = $this->secureRandom->generate(128); |
|
| 74 | + $accessToken->setHashedCode(hash('sha512', $newCode)); |
|
| 75 | + $accessToken->setEncryptedToken($this->crypto->encrypt($decryptedToken, $newCode)); |
|
| 76 | + $this->accessTokenMapper->update($accessToken); |
|
| 77 | 77 | |
| 78 | - return new JSONResponse( |
|
| 79 | - [ |
|
| 80 | - 'access_token' => $decryptedToken, |
|
| 81 | - 'token_type' => 'Bearer', |
|
| 82 | - 'expires_in' => 3600, |
|
| 83 | - 'refresh_token' => $newCode, |
|
| 84 | - 'user_id' => $this->defaultTokenMapper->getTokenById($accessToken->getTokenId())->getUID(), |
|
| 85 | - ] |
|
| 86 | - ); |
|
| 87 | - } |
|
| 78 | + return new JSONResponse( |
|
| 79 | + [ |
|
| 80 | + 'access_token' => $decryptedToken, |
|
| 81 | + 'token_type' => 'Bearer', |
|
| 82 | + 'expires_in' => 3600, |
|
| 83 | + 'refresh_token' => $newCode, |
|
| 84 | + 'user_id' => $this->defaultTokenMapper->getTokenById($accessToken->getTokenId())->getUID(), |
|
| 85 | + ] |
|
| 86 | + ); |
|
| 87 | + } |
|
| 88 | 88 | } |
@@ -43,267 +43,267 @@ |
||
| 43 | 43 | use OCP\Session\Exceptions\SessionNotAvailableException; |
| 44 | 44 | |
| 45 | 45 | class ClientFlowLoginController extends Controller { |
| 46 | - /** @var IUserSession */ |
|
| 47 | - private $userSession; |
|
| 48 | - /** @var IL10N */ |
|
| 49 | - private $l10n; |
|
| 50 | - /** @var Defaults */ |
|
| 51 | - private $defaults; |
|
| 52 | - /** @var ISession */ |
|
| 53 | - private $session; |
|
| 54 | - /** @var IProvider */ |
|
| 55 | - private $tokenProvider; |
|
| 56 | - /** @var ISecureRandom */ |
|
| 57 | - private $random; |
|
| 58 | - /** @var IURLGenerator */ |
|
| 59 | - private $urlGenerator; |
|
| 60 | - /** @var ClientMapper */ |
|
| 61 | - private $clientMapper; |
|
| 62 | - /** @var AccessTokenMapper */ |
|
| 63 | - private $accessTokenMapper; |
|
| 64 | - /** @var ICrypto */ |
|
| 65 | - private $crypto; |
|
| 46 | + /** @var IUserSession */ |
|
| 47 | + private $userSession; |
|
| 48 | + /** @var IL10N */ |
|
| 49 | + private $l10n; |
|
| 50 | + /** @var Defaults */ |
|
| 51 | + private $defaults; |
|
| 52 | + /** @var ISession */ |
|
| 53 | + private $session; |
|
| 54 | + /** @var IProvider */ |
|
| 55 | + private $tokenProvider; |
|
| 56 | + /** @var ISecureRandom */ |
|
| 57 | + private $random; |
|
| 58 | + /** @var IURLGenerator */ |
|
| 59 | + private $urlGenerator; |
|
| 60 | + /** @var ClientMapper */ |
|
| 61 | + private $clientMapper; |
|
| 62 | + /** @var AccessTokenMapper */ |
|
| 63 | + private $accessTokenMapper; |
|
| 64 | + /** @var ICrypto */ |
|
| 65 | + private $crypto; |
|
| 66 | 66 | |
| 67 | - const stateName = 'client.flow.state.token'; |
|
| 67 | + const stateName = 'client.flow.state.token'; |
|
| 68 | 68 | |
| 69 | - /** |
|
| 70 | - * @param string $appName |
|
| 71 | - * @param IRequest $request |
|
| 72 | - * @param IUserSession $userSession |
|
| 73 | - * @param IL10N $l10n |
|
| 74 | - * @param Defaults $defaults |
|
| 75 | - * @param ISession $session |
|
| 76 | - * @param IProvider $tokenProvider |
|
| 77 | - * @param ISecureRandom $random |
|
| 78 | - * @param IURLGenerator $urlGenerator |
|
| 79 | - * @param ClientMapper $clientMapper |
|
| 80 | - * @param AccessTokenMapper $accessTokenMapper |
|
| 81 | - * @param ICrypto $crypto |
|
| 82 | - */ |
|
| 83 | - public function __construct($appName, |
|
| 84 | - IRequest $request, |
|
| 85 | - IUserSession $userSession, |
|
| 86 | - IL10N $l10n, |
|
| 87 | - Defaults $defaults, |
|
| 88 | - ISession $session, |
|
| 89 | - IProvider $tokenProvider, |
|
| 90 | - ISecureRandom $random, |
|
| 91 | - IURLGenerator $urlGenerator, |
|
| 92 | - ClientMapper $clientMapper, |
|
| 93 | - AccessTokenMapper $accessTokenMapper, |
|
| 94 | - ICrypto $crypto) { |
|
| 95 | - parent::__construct($appName, $request); |
|
| 96 | - $this->userSession = $userSession; |
|
| 97 | - $this->l10n = $l10n; |
|
| 98 | - $this->defaults = $defaults; |
|
| 99 | - $this->session = $session; |
|
| 100 | - $this->tokenProvider = $tokenProvider; |
|
| 101 | - $this->random = $random; |
|
| 102 | - $this->urlGenerator = $urlGenerator; |
|
| 103 | - $this->clientMapper = $clientMapper; |
|
| 104 | - $this->accessTokenMapper = $accessTokenMapper; |
|
| 105 | - $this->crypto = $crypto; |
|
| 106 | - } |
|
| 69 | + /** |
|
| 70 | + * @param string $appName |
|
| 71 | + * @param IRequest $request |
|
| 72 | + * @param IUserSession $userSession |
|
| 73 | + * @param IL10N $l10n |
|
| 74 | + * @param Defaults $defaults |
|
| 75 | + * @param ISession $session |
|
| 76 | + * @param IProvider $tokenProvider |
|
| 77 | + * @param ISecureRandom $random |
|
| 78 | + * @param IURLGenerator $urlGenerator |
|
| 79 | + * @param ClientMapper $clientMapper |
|
| 80 | + * @param AccessTokenMapper $accessTokenMapper |
|
| 81 | + * @param ICrypto $crypto |
|
| 82 | + */ |
|
| 83 | + public function __construct($appName, |
|
| 84 | + IRequest $request, |
|
| 85 | + IUserSession $userSession, |
|
| 86 | + IL10N $l10n, |
|
| 87 | + Defaults $defaults, |
|
| 88 | + ISession $session, |
|
| 89 | + IProvider $tokenProvider, |
|
| 90 | + ISecureRandom $random, |
|
| 91 | + IURLGenerator $urlGenerator, |
|
| 92 | + ClientMapper $clientMapper, |
|
| 93 | + AccessTokenMapper $accessTokenMapper, |
|
| 94 | + ICrypto $crypto) { |
|
| 95 | + parent::__construct($appName, $request); |
|
| 96 | + $this->userSession = $userSession; |
|
| 97 | + $this->l10n = $l10n; |
|
| 98 | + $this->defaults = $defaults; |
|
| 99 | + $this->session = $session; |
|
| 100 | + $this->tokenProvider = $tokenProvider; |
|
| 101 | + $this->random = $random; |
|
| 102 | + $this->urlGenerator = $urlGenerator; |
|
| 103 | + $this->clientMapper = $clientMapper; |
|
| 104 | + $this->accessTokenMapper = $accessTokenMapper; |
|
| 105 | + $this->crypto = $crypto; |
|
| 106 | + } |
|
| 107 | 107 | |
| 108 | - /** |
|
| 109 | - * @return string |
|
| 110 | - */ |
|
| 111 | - private function getClientName() { |
|
| 112 | - $userAgent = $this->request->getHeader('USER_AGENT'); |
|
| 113 | - return $userAgent !== null ? $userAgent : 'unknown'; |
|
| 114 | - } |
|
| 108 | + /** |
|
| 109 | + * @return string |
|
| 110 | + */ |
|
| 111 | + private function getClientName() { |
|
| 112 | + $userAgent = $this->request->getHeader('USER_AGENT'); |
|
| 113 | + return $userAgent !== null ? $userAgent : 'unknown'; |
|
| 114 | + } |
|
| 115 | 115 | |
| 116 | - /** |
|
| 117 | - * @param string $stateToken |
|
| 118 | - * @return bool |
|
| 119 | - */ |
|
| 120 | - private function isValidToken($stateToken) { |
|
| 121 | - $currentToken = $this->session->get(self::stateName); |
|
| 122 | - if(!is_string($stateToken) || !is_string($currentToken)) { |
|
| 123 | - return false; |
|
| 124 | - } |
|
| 125 | - return hash_equals($currentToken, $stateToken); |
|
| 126 | - } |
|
| 116 | + /** |
|
| 117 | + * @param string $stateToken |
|
| 118 | + * @return bool |
|
| 119 | + */ |
|
| 120 | + private function isValidToken($stateToken) { |
|
| 121 | + $currentToken = $this->session->get(self::stateName); |
|
| 122 | + if(!is_string($stateToken) || !is_string($currentToken)) { |
|
| 123 | + return false; |
|
| 124 | + } |
|
| 125 | + return hash_equals($currentToken, $stateToken); |
|
| 126 | + } |
|
| 127 | 127 | |
| 128 | - /** |
|
| 129 | - * @return TemplateResponse |
|
| 130 | - */ |
|
| 131 | - private function stateTokenForbiddenResponse() { |
|
| 132 | - $response = new TemplateResponse( |
|
| 133 | - $this->appName, |
|
| 134 | - '403', |
|
| 135 | - [ |
|
| 136 | - 'file' => $this->l10n->t('State token does not match'), |
|
| 137 | - ], |
|
| 138 | - 'guest' |
|
| 139 | - ); |
|
| 140 | - $response->setStatus(Http::STATUS_FORBIDDEN); |
|
| 141 | - return $response; |
|
| 142 | - } |
|
| 128 | + /** |
|
| 129 | + * @return TemplateResponse |
|
| 130 | + */ |
|
| 131 | + private function stateTokenForbiddenResponse() { |
|
| 132 | + $response = new TemplateResponse( |
|
| 133 | + $this->appName, |
|
| 134 | + '403', |
|
| 135 | + [ |
|
| 136 | + 'file' => $this->l10n->t('State token does not match'), |
|
| 137 | + ], |
|
| 138 | + 'guest' |
|
| 139 | + ); |
|
| 140 | + $response->setStatus(Http::STATUS_FORBIDDEN); |
|
| 141 | + return $response; |
|
| 142 | + } |
|
| 143 | 143 | |
| 144 | - /** |
|
| 145 | - * @PublicPage |
|
| 146 | - * @NoCSRFRequired |
|
| 147 | - * @UseSession |
|
| 148 | - * |
|
| 149 | - * @param string $clientIdentifier |
|
| 150 | - * |
|
| 151 | - * @return TemplateResponse |
|
| 152 | - */ |
|
| 153 | - public function showAuthPickerPage($clientIdentifier = '') { |
|
| 154 | - $clientName = $this->getClientName(); |
|
| 155 | - $client = null; |
|
| 156 | - if($clientIdentifier !== '') { |
|
| 157 | - $client = $this->clientMapper->getByIdentifier($clientIdentifier); |
|
| 158 | - $clientName = $client->getName(); |
|
| 159 | - } |
|
| 144 | + /** |
|
| 145 | + * @PublicPage |
|
| 146 | + * @NoCSRFRequired |
|
| 147 | + * @UseSession |
|
| 148 | + * |
|
| 149 | + * @param string $clientIdentifier |
|
| 150 | + * |
|
| 151 | + * @return TemplateResponse |
|
| 152 | + */ |
|
| 153 | + public function showAuthPickerPage($clientIdentifier = '') { |
|
| 154 | + $clientName = $this->getClientName(); |
|
| 155 | + $client = null; |
|
| 156 | + if($clientIdentifier !== '') { |
|
| 157 | + $client = $this->clientMapper->getByIdentifier($clientIdentifier); |
|
| 158 | + $clientName = $client->getName(); |
|
| 159 | + } |
|
| 160 | 160 | |
| 161 | - // No valid clientIdentifier given and no valid API Request (APIRequest header not set) |
|
| 162 | - $clientRequest = $this->request->getHeader('OCS-APIREQUEST'); |
|
| 163 | - if ($clientRequest !== 'true' && $client === null) { |
|
| 164 | - return new TemplateResponse( |
|
| 165 | - $this->appName, |
|
| 166 | - 'error', |
|
| 167 | - [ |
|
| 168 | - 'errors' => |
|
| 169 | - [ |
|
| 170 | - [ |
|
| 171 | - 'error' => 'Access Forbidden', |
|
| 172 | - 'hint' => 'Invalid request', |
|
| 173 | - ], |
|
| 174 | - ], |
|
| 175 | - ], |
|
| 176 | - 'guest' |
|
| 177 | - ); |
|
| 178 | - } |
|
| 161 | + // No valid clientIdentifier given and no valid API Request (APIRequest header not set) |
|
| 162 | + $clientRequest = $this->request->getHeader('OCS-APIREQUEST'); |
|
| 163 | + if ($clientRequest !== 'true' && $client === null) { |
|
| 164 | + return new TemplateResponse( |
|
| 165 | + $this->appName, |
|
| 166 | + 'error', |
|
| 167 | + [ |
|
| 168 | + 'errors' => |
|
| 169 | + [ |
|
| 170 | + [ |
|
| 171 | + 'error' => 'Access Forbidden', |
|
| 172 | + 'hint' => 'Invalid request', |
|
| 173 | + ], |
|
| 174 | + ], |
|
| 175 | + ], |
|
| 176 | + 'guest' |
|
| 177 | + ); |
|
| 178 | + } |
|
| 179 | 179 | |
| 180 | - $stateToken = $this->random->generate( |
|
| 181 | - 64, |
|
| 182 | - ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_DIGITS |
|
| 183 | - ); |
|
| 184 | - $this->session->set(self::stateName, $stateToken); |
|
| 180 | + $stateToken = $this->random->generate( |
|
| 181 | + 64, |
|
| 182 | + ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_DIGITS |
|
| 183 | + ); |
|
| 184 | + $this->session->set(self::stateName, $stateToken); |
|
| 185 | 185 | |
| 186 | - return new TemplateResponse( |
|
| 187 | - $this->appName, |
|
| 188 | - 'loginflow/authpicker', |
|
| 189 | - [ |
|
| 190 | - 'client' => $clientName, |
|
| 191 | - 'clientIdentifier' => $clientIdentifier, |
|
| 192 | - 'instanceName' => $this->defaults->getName(), |
|
| 193 | - 'urlGenerator' => $this->urlGenerator, |
|
| 194 | - 'stateToken' => $stateToken, |
|
| 195 | - 'serverHost' => $this->request->getServerHost(), |
|
| 196 | - ], |
|
| 197 | - 'guest' |
|
| 198 | - ); |
|
| 199 | - } |
|
| 186 | + return new TemplateResponse( |
|
| 187 | + $this->appName, |
|
| 188 | + 'loginflow/authpicker', |
|
| 189 | + [ |
|
| 190 | + 'client' => $clientName, |
|
| 191 | + 'clientIdentifier' => $clientIdentifier, |
|
| 192 | + 'instanceName' => $this->defaults->getName(), |
|
| 193 | + 'urlGenerator' => $this->urlGenerator, |
|
| 194 | + 'stateToken' => $stateToken, |
|
| 195 | + 'serverHost' => $this->request->getServerHost(), |
|
| 196 | + ], |
|
| 197 | + 'guest' |
|
| 198 | + ); |
|
| 199 | + } |
|
| 200 | 200 | |
| 201 | - /** |
|
| 202 | - * @NoAdminRequired |
|
| 203 | - * @NoCSRFRequired |
|
| 204 | - * @UseSession |
|
| 205 | - * |
|
| 206 | - * @param string $stateToken |
|
| 207 | - * @param string $clientIdentifier |
|
| 208 | - * @return TemplateResponse |
|
| 209 | - */ |
|
| 210 | - public function redirectPage($stateToken = '', |
|
| 211 | - $clientIdentifier = '') { |
|
| 212 | - if(!$this->isValidToken($stateToken)) { |
|
| 213 | - return $this->stateTokenForbiddenResponse(); |
|
| 214 | - } |
|
| 201 | + /** |
|
| 202 | + * @NoAdminRequired |
|
| 203 | + * @NoCSRFRequired |
|
| 204 | + * @UseSession |
|
| 205 | + * |
|
| 206 | + * @param string $stateToken |
|
| 207 | + * @param string $clientIdentifier |
|
| 208 | + * @return TemplateResponse |
|
| 209 | + */ |
|
| 210 | + public function redirectPage($stateToken = '', |
|
| 211 | + $clientIdentifier = '') { |
|
| 212 | + if(!$this->isValidToken($stateToken)) { |
|
| 213 | + return $this->stateTokenForbiddenResponse(); |
|
| 214 | + } |
|
| 215 | 215 | |
| 216 | - return new TemplateResponse( |
|
| 217 | - $this->appName, |
|
| 218 | - 'loginflow/redirect', |
|
| 219 | - [ |
|
| 220 | - 'urlGenerator' => $this->urlGenerator, |
|
| 221 | - 'stateToken' => $stateToken, |
|
| 222 | - 'clientIdentifier' => $clientIdentifier, |
|
| 223 | - 'oauthState' => $this->session->get('oauth.state'), |
|
| 224 | - ], |
|
| 225 | - 'empty' |
|
| 226 | - ); |
|
| 227 | - } |
|
| 216 | + return new TemplateResponse( |
|
| 217 | + $this->appName, |
|
| 218 | + 'loginflow/redirect', |
|
| 219 | + [ |
|
| 220 | + 'urlGenerator' => $this->urlGenerator, |
|
| 221 | + 'stateToken' => $stateToken, |
|
| 222 | + 'clientIdentifier' => $clientIdentifier, |
|
| 223 | + 'oauthState' => $this->session->get('oauth.state'), |
|
| 224 | + ], |
|
| 225 | + 'empty' |
|
| 226 | + ); |
|
| 227 | + } |
|
| 228 | 228 | |
| 229 | - /** |
|
| 230 | - * @NoAdminRequired |
|
| 231 | - * @UseSession |
|
| 232 | - * |
|
| 233 | - * @param string $stateToken |
|
| 234 | - * @param string $clientIdentifier |
|
| 235 | - * @return Http\RedirectResponse|Response |
|
| 236 | - */ |
|
| 237 | - public function generateAppPassword($stateToken, |
|
| 238 | - $clientIdentifier = '') { |
|
| 239 | - if(!$this->isValidToken($stateToken)) { |
|
| 240 | - $this->session->remove(self::stateName); |
|
| 241 | - return $this->stateTokenForbiddenResponse(); |
|
| 242 | - } |
|
| 229 | + /** |
|
| 230 | + * @NoAdminRequired |
|
| 231 | + * @UseSession |
|
| 232 | + * |
|
| 233 | + * @param string $stateToken |
|
| 234 | + * @param string $clientIdentifier |
|
| 235 | + * @return Http\RedirectResponse|Response |
|
| 236 | + */ |
|
| 237 | + public function generateAppPassword($stateToken, |
|
| 238 | + $clientIdentifier = '') { |
|
| 239 | + if(!$this->isValidToken($stateToken)) { |
|
| 240 | + $this->session->remove(self::stateName); |
|
| 241 | + return $this->stateTokenForbiddenResponse(); |
|
| 242 | + } |
|
| 243 | 243 | |
| 244 | - $this->session->remove(self::stateName); |
|
| 244 | + $this->session->remove(self::stateName); |
|
| 245 | 245 | |
| 246 | - try { |
|
| 247 | - $sessionId = $this->session->getId(); |
|
| 248 | - } catch (SessionNotAvailableException $ex) { |
|
| 249 | - $response = new Response(); |
|
| 250 | - $response->setStatus(Http::STATUS_FORBIDDEN); |
|
| 251 | - return $response; |
|
| 252 | - } |
|
| 246 | + try { |
|
| 247 | + $sessionId = $this->session->getId(); |
|
| 248 | + } catch (SessionNotAvailableException $ex) { |
|
| 249 | + $response = new Response(); |
|
| 250 | + $response->setStatus(Http::STATUS_FORBIDDEN); |
|
| 251 | + return $response; |
|
| 252 | + } |
|
| 253 | 253 | |
| 254 | - try { |
|
| 255 | - $sessionToken = $this->tokenProvider->getToken($sessionId); |
|
| 256 | - $loginName = $sessionToken->getLoginName(); |
|
| 257 | - try { |
|
| 258 | - $password = $this->tokenProvider->getPassword($sessionToken, $sessionId); |
|
| 259 | - } catch (PasswordlessTokenException $ex) { |
|
| 260 | - $password = null; |
|
| 261 | - } |
|
| 262 | - } catch (InvalidTokenException $ex) { |
|
| 263 | - $response = new Response(); |
|
| 264 | - $response->setStatus(Http::STATUS_FORBIDDEN); |
|
| 265 | - return $response; |
|
| 266 | - } |
|
| 254 | + try { |
|
| 255 | + $sessionToken = $this->tokenProvider->getToken($sessionId); |
|
| 256 | + $loginName = $sessionToken->getLoginName(); |
|
| 257 | + try { |
|
| 258 | + $password = $this->tokenProvider->getPassword($sessionToken, $sessionId); |
|
| 259 | + } catch (PasswordlessTokenException $ex) { |
|
| 260 | + $password = null; |
|
| 261 | + } |
|
| 262 | + } catch (InvalidTokenException $ex) { |
|
| 263 | + $response = new Response(); |
|
| 264 | + $response->setStatus(Http::STATUS_FORBIDDEN); |
|
| 265 | + return $response; |
|
| 266 | + } |
|
| 267 | 267 | |
| 268 | - $clientName = $this->getClientName(); |
|
| 269 | - $client = false; |
|
| 270 | - if($clientIdentifier !== '') { |
|
| 271 | - $client = $this->clientMapper->getByIdentifier($clientIdentifier); |
|
| 272 | - $clientName = $client->getName(); |
|
| 273 | - } |
|
| 268 | + $clientName = $this->getClientName(); |
|
| 269 | + $client = false; |
|
| 270 | + if($clientIdentifier !== '') { |
|
| 271 | + $client = $this->clientMapper->getByIdentifier($clientIdentifier); |
|
| 272 | + $clientName = $client->getName(); |
|
| 273 | + } |
|
| 274 | 274 | |
| 275 | - $token = $this->random->generate(72, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS); |
|
| 276 | - $uid = $this->userSession->getUser()->getUID(); |
|
| 277 | - $generatedToken = $this->tokenProvider->generateToken( |
|
| 278 | - $token, |
|
| 279 | - $uid, |
|
| 280 | - $loginName, |
|
| 281 | - $password, |
|
| 282 | - $clientName, |
|
| 283 | - IToken::PERMANENT_TOKEN, |
|
| 284 | - IToken::DO_NOT_REMEMBER |
|
| 285 | - ); |
|
| 275 | + $token = $this->random->generate(72, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS); |
|
| 276 | + $uid = $this->userSession->getUser()->getUID(); |
|
| 277 | + $generatedToken = $this->tokenProvider->generateToken( |
|
| 278 | + $token, |
|
| 279 | + $uid, |
|
| 280 | + $loginName, |
|
| 281 | + $password, |
|
| 282 | + $clientName, |
|
| 283 | + IToken::PERMANENT_TOKEN, |
|
| 284 | + IToken::DO_NOT_REMEMBER |
|
| 285 | + ); |
|
| 286 | 286 | |
| 287 | - if($client) { |
|
| 288 | - $code = $this->random->generate(128); |
|
| 289 | - $accessToken = new AccessToken(); |
|
| 290 | - $accessToken->setClientId($client->getId()); |
|
| 291 | - $accessToken->setEncryptedToken($this->crypto->encrypt($token, $code)); |
|
| 292 | - $accessToken->setHashedCode(hash('sha512', $code)); |
|
| 293 | - $accessToken->setTokenId($generatedToken->getId()); |
|
| 294 | - $this->accessTokenMapper->insert($accessToken); |
|
| 287 | + if($client) { |
|
| 288 | + $code = $this->random->generate(128); |
|
| 289 | + $accessToken = new AccessToken(); |
|
| 290 | + $accessToken->setClientId($client->getId()); |
|
| 291 | + $accessToken->setEncryptedToken($this->crypto->encrypt($token, $code)); |
|
| 292 | + $accessToken->setHashedCode(hash('sha512', $code)); |
|
| 293 | + $accessToken->setTokenId($generatedToken->getId()); |
|
| 294 | + $this->accessTokenMapper->insert($accessToken); |
|
| 295 | 295 | |
| 296 | - $redirectUri = sprintf( |
|
| 297 | - '%s?state=%s&code=%s', |
|
| 298 | - $client->getRedirectUri(), |
|
| 299 | - urlencode($this->session->get('oauth.state')), |
|
| 300 | - urlencode($code) |
|
| 301 | - ); |
|
| 302 | - $this->session->remove('oauth.state'); |
|
| 303 | - } else { |
|
| 304 | - $redirectUri = 'nc://login/server:' . $this->request->getServerHost() . '&user:' . urlencode($loginName) . '&password:' . urlencode($token); |
|
| 305 | - } |
|
| 296 | + $redirectUri = sprintf( |
|
| 297 | + '%s?state=%s&code=%s', |
|
| 298 | + $client->getRedirectUri(), |
|
| 299 | + urlencode($this->session->get('oauth.state')), |
|
| 300 | + urlencode($code) |
|
| 301 | + ); |
|
| 302 | + $this->session->remove('oauth.state'); |
|
| 303 | + } else { |
|
| 304 | + $redirectUri = 'nc://login/server:' . $this->request->getServerHost() . '&user:' . urlencode($loginName) . '&password:' . urlencode($token); |
|
| 305 | + } |
|
| 306 | 306 | |
| 307 | - return new Http\RedirectResponse($redirectUri); |
|
| 308 | - } |
|
| 307 | + return new Http\RedirectResponse($redirectUri); |
|
| 308 | + } |
|
| 309 | 309 | } |
@@ -119,7 +119,7 @@ discard block |
||
| 119 | 119 | */ |
| 120 | 120 | private function isValidToken($stateToken) { |
| 121 | 121 | $currentToken = $this->session->get(self::stateName); |
| 122 | - if(!is_string($stateToken) || !is_string($currentToken)) { |
|
| 122 | + if (!is_string($stateToken) || !is_string($currentToken)) { |
|
| 123 | 123 | return false; |
| 124 | 124 | } |
| 125 | 125 | return hash_equals($currentToken, $stateToken); |
@@ -153,7 +153,7 @@ discard block |
||
| 153 | 153 | public function showAuthPickerPage($clientIdentifier = '') { |
| 154 | 154 | $clientName = $this->getClientName(); |
| 155 | 155 | $client = null; |
| 156 | - if($clientIdentifier !== '') { |
|
| 156 | + if ($clientIdentifier !== '') { |
|
| 157 | 157 | $client = $this->clientMapper->getByIdentifier($clientIdentifier); |
| 158 | 158 | $clientName = $client->getName(); |
| 159 | 159 | } |
@@ -209,7 +209,7 @@ discard block |
||
| 209 | 209 | */ |
| 210 | 210 | public function redirectPage($stateToken = '', |
| 211 | 211 | $clientIdentifier = '') { |
| 212 | - if(!$this->isValidToken($stateToken)) { |
|
| 212 | + if (!$this->isValidToken($stateToken)) { |
|
| 213 | 213 | return $this->stateTokenForbiddenResponse(); |
| 214 | 214 | } |
| 215 | 215 | |
@@ -236,7 +236,7 @@ discard block |
||
| 236 | 236 | */ |
| 237 | 237 | public function generateAppPassword($stateToken, |
| 238 | 238 | $clientIdentifier = '') { |
| 239 | - if(!$this->isValidToken($stateToken)) { |
|
| 239 | + if (!$this->isValidToken($stateToken)) { |
|
| 240 | 240 | $this->session->remove(self::stateName); |
| 241 | 241 | return $this->stateTokenForbiddenResponse(); |
| 242 | 242 | } |
@@ -267,7 +267,7 @@ discard block |
||
| 267 | 267 | |
| 268 | 268 | $clientName = $this->getClientName(); |
| 269 | 269 | $client = false; |
| 270 | - if($clientIdentifier !== '') { |
|
| 270 | + if ($clientIdentifier !== '') { |
|
| 271 | 271 | $client = $this->clientMapper->getByIdentifier($clientIdentifier); |
| 272 | 272 | $clientName = $client->getName(); |
| 273 | 273 | } |
@@ -284,7 +284,7 @@ discard block |
||
| 284 | 284 | IToken::DO_NOT_REMEMBER |
| 285 | 285 | ); |
| 286 | 286 | |
| 287 | - if($client) { |
|
| 287 | + if ($client) { |
|
| 288 | 288 | $code = $this->random->generate(128); |
| 289 | 289 | $accessToken = new AccessToken(); |
| 290 | 290 | $accessToken->setClientId($client->getId()); |
@@ -301,7 +301,7 @@ discard block |
||
| 301 | 301 | ); |
| 302 | 302 | $this->session->remove('oauth.state'); |
| 303 | 303 | } else { |
| 304 | - $redirectUri = 'nc://login/server:' . $this->request->getServerHost() . '&user:' . urlencode($loginName) . '&password:' . urlencode($token); |
|
| 304 | + $redirectUri = 'nc://login/server:'.$this->request->getServerHost().'&user:'.urlencode($loginName).'&password:'.urlencode($token); |
|
| 305 | 305 | } |
| 306 | 306 | |
| 307 | 307 | return new Http\RedirectResponse($redirectUri); |
