nextcloud / server

core/Controller/LostController.php

Indentation +272 added lines, -272 removed lines

@@ -73,276 +73,276 @@
  * @package OC\Core\Controller
  */
 class LostController extends Controller {
-	protected IURLGenerator $urlGenerator;
-	protected IUserManager $userManager;
-	protected Defaults $defaults;
-	protected IL10N $l10n;
-	protected string $from;
-	protected IManager $encryptionManager;
-	protected IConfig $config;
-	protected IMailer $mailer;
-	private LoggerInterface $logger;
-	private Manager $twoFactorManager;
-	private IInitialState $initialState;
-	private IVerificationToken $verificationToken;
-	private IEventDispatcher $eventDispatcher;
-	private Limiter $limiter;
-
-	public function __construct(
-		string $appName,
-		IRequest $request,
-		IURLGenerator $urlGenerator,
-		IUserManager $userManager,
-		Defaults $defaults,
-		IL10N $l10n,
-		IConfig $config,
-		string $defaultMailAddress,
-		IManager $encryptionManager,
-		IMailer $mailer,
-		LoggerInterface $logger,
-		Manager $twoFactorManager,
-		IInitialState $initialState,
-		IVerificationToken $verificationToken,
-		IEventDispatcher $eventDispatcher,
-		Limiter $limiter
-	) {
-		parent::__construct($appName, $request);
-		$this->urlGenerator = $urlGenerator;
-		$this->userManager = $userManager;
-		$this->defaults = $defaults;
-		$this->l10n = $l10n;
-		$this->from = $defaultMailAddress;
-		$this->encryptionManager = $encryptionManager;
-		$this->config = $config;
-		$this->mailer = $mailer;
-		$this->logger = $logger;
-		$this->twoFactorManager = $twoFactorManager;
-		$this->initialState = $initialState;
-		$this->verificationToken = $verificationToken;
-		$this->eventDispatcher = $eventDispatcher;
-		$this->limiter = $limiter;
-	}
-
-	/**
-	 * Someone wants to reset their password:
-	 *
-	 * @PublicPage
-	 * @NoCSRFRequired
-	 */
-	public function resetform(string $token, string $userId): TemplateResponse {
-		try {
-			$this->checkPasswordResetToken($token, $userId);
-		} catch (Exception $e) {
-			if ($this->config->getSystemValue('lost_password_link', '') !== 'disabled'
-				|| ($e instanceof InvalidTokenException
-					&& !in_array($e->getCode(), [InvalidTokenException::TOKEN_NOT_FOUND, InvalidTokenException::USER_UNKNOWN]))
-			) {
-				return new TemplateResponse(
-					'core', 'error', [
-						"errors" => [["error" => $e->getMessage()]]
-					],
-					TemplateResponse::RENDER_AS_GUEST
-				);
-			}
-			return new TemplateResponse('core', 'error', [
-				'errors' => [['error' => $this->l10n->t('Password reset is disabled')]]
-			],
-				TemplateResponse::RENDER_AS_GUEST
-			);
-		}
-		$this->initialState->provideInitialState('resetPasswordUser', $userId);
-		$this->initialState->provideInitialState('resetPasswordTarget',
-			$this->urlGenerator->linkToRouteAbsolute('core.lost.setPassword', ['userId' => $userId, 'token' => $token])
-		);
-
-		return new TemplateResponse(
-			'core',
-			'login',
-			[],
-			'guest'
-		);
-	}
-
-	/**
-	 * @throws Exception
-	 */
-	protected function checkPasswordResetToken(string $token, string $userId): void {
-		try {
-			$user = $this->userManager->get($userId);
-			$this->verificationToken->check($token, $user, 'lostpassword', $user ? $user->getEMailAddress() : '', true);
-		} catch (InvalidTokenException $e) {
-			$error = $e->getCode() === InvalidTokenException::TOKEN_EXPIRED
-				? $this->l10n->t('Could not reset password because the token is expired')
-				: $this->l10n->t('Could not reset password because the token is invalid');
-			throw new Exception($error, (int)$e->getCode(), $e);
-		}
-	}
-
-	private function error(string $message, array $additional = []): array {
-		return array_merge(['status' => 'error', 'msg' => $message], $additional);
-	}
-
-	private function success(array $data = []): array {
-		return array_merge($data, ['status' => 'success']);
-	}
-
-	/**
-	 * @PublicPage
-	 * @BruteForceProtection(action=passwordResetEmail)
-	 * @AnonRateThrottle(limit=10, period=300)
-	 */
-	public function email(string $user): JSONResponse {
-		if ($this->config->getSystemValue('lost_password_link', '') !== '') {
-			return new JSONResponse($this->error($this->l10n->t('Password reset is disabled')));
-		}
-
-		\OCP\Util::emitHook(
-			'\OCA\Files_Sharing\API\Server2Server',
-			'preLoginNameUsedAsUserName',
-			['uid' => &$user]
-		);
-
-		// FIXME: use HTTP error codes
-		try {
-			$this->sendEmail($user);
-		} catch (ResetPasswordException $e) {
-			// Ignore the error since we do not want to leak this info
-			$this->logger->warning('Could not send password reset email: ' . $e->getMessage());
-		} catch (Exception $e) {
-			$this->logger->error($e->getMessage(), ['exception' => $e]);
-		}
-
-		$response = new JSONResponse($this->success());
-		$response->throttle();
-		return $response;
-	}
-
-	/**
-	 * @PublicPage
-	 */
-	public function setPassword(string $token, string $userId, string $password, bool $proceed): array {
-		if ($this->encryptionManager->isEnabled() && !$proceed) {
-			$encryptionModules = $this->encryptionManager->getEncryptionModules();
-			foreach ($encryptionModules as $module) {
-				/** @var IEncryptionModule $instance */
-				$instance = call_user_func($module['callback']);
-				// this way we can find out whether per-user keys are used or a system wide encryption key
-				if ($instance->needDetailedAccessList()) {
-					return $this->error('', ['encryption' => true]);
-				}
-			}
-		}
-
-		try {
-			$this->checkPasswordResetToken($token, $userId);
-			$user = $this->userManager->get($userId);
-
-			$this->eventDispatcher->dispatchTyped(new BeforePasswordResetEvent($user, $password));
-			\OC_Hook::emit('\OC\Core\LostPassword\Controller\LostController', 'pre_passwordReset', ['uid' => $userId, 'password' => $password]);
-
-			if (strlen($password) > 469) {
-				throw new HintException('Password too long', $this->l10n->t('Password is too long. Maximum allowed length is 469 characters.'));
-			}
-
-			if (!$user->setPassword($password)) {
-				throw new Exception();
-			}
-
-			$this->eventDispatcher->dispatchTyped(new PasswordResetEvent($user, $password));
-			\OC_Hook::emit('\OC\Core\LostPassword\Controller\LostController', 'post_passwordReset', ['uid' => $userId, 'password' => $password]);
-
-			$this->twoFactorManager->clearTwoFactorPending($userId);
-
-			$this->config->deleteUserValue($userId, 'core', 'lostpassword');
-			@\OC::$server->getUserSession()->unsetMagicInCookie();
-		} catch (HintException $e) {
-			return $this->error($e->getHint());
-		} catch (Exception $e) {
-			return $this->error($e->getMessage());
-		}
-
-		return $this->success(['user' => $userId]);
-	}
-
-	/**
-	 * @throws ResetPasswordException
-	 * @throws \OCP\PreConditionNotMetException
-	 */
-	protected function sendEmail(string $input): void {
-		$user = $this->findUserByIdOrMail($input);
-		$email = $user->getEMailAddress();
-
-		if (empty($email)) {
-			throw new ResetPasswordException('Could not send reset e-mail since there is no email for username ' . $input);
-		}
-
-		try {
-			$this->limiter->registerUserRequest('lostpasswordemail', 5, 1800, $user);
-		} catch (RateLimitExceededException $e) {
-			throw new ResetPasswordException('Could not send reset e-mail, 5 of them were already sent in the last 30 minutes', 0, $e);
-		}
-
-		// Generate the token. It is stored encrypted in the database with the
-		// secret being the users' email address appended with the system secret.
-		// This makes the token automatically invalidate once the user changes
-		// their email address.
-		$token = $this->verificationToken->create($user, 'lostpassword', $email);
-
-		$link = $this->urlGenerator->linkToRouteAbsolute('core.lost.resetform', ['userId' => $user->getUID(), 'token' => $token]);
-
-		$emailTemplate = $this->mailer->createEMailTemplate('core.ResetPassword', [
-			'link' => $link,
-		]);
-
-		$emailTemplate->setSubject($this->l10n->t('%s password reset', [$this->defaults->getName()]));
-		$emailTemplate->addHeader();
-		$emailTemplate->addHeading($this->l10n->t('Password reset'));
-
-		$emailTemplate->addBodyText(
-			htmlspecialchars($this->l10n->t('Click the following button to reset your password. If you have not requested the password reset, then ignore this email.')),
-			$this->l10n->t('Click the following link to reset your password. If you have not requested the password reset, then ignore this email.')
-		);
-
-		$emailTemplate->addBodyButton(
-			htmlspecialchars($this->l10n->t('Reset your password')),
-			$link,
-			false
-		);
-		$emailTemplate->addFooter();
-
-		try {
-			$message = $this->mailer->createMessage();
-			$message->setTo([$email => $user->getDisplayName()]);
-			$message->setFrom([$this->from => $this->defaults->getName()]);
-			$message->useTemplate($emailTemplate);
-			$this->mailer->send($message);
-		} catch (Exception $e) {
-			// Log the exception and continue
-			$this->logger->error($e->getMessage(), ['app' => 'core', 'exception' => $e]);
-		}
-	}
-
-	/**
-	 * @throws ResetPasswordException
-	 */
-	protected function findUserByIdOrMail(string $input): IUser {
-		$user = $this->userManager->get($input);
-		if ($user instanceof IUser) {
-			if (!$user->isEnabled()) {
-				throw new ResetPasswordException('User ' . $user->getUID() . ' is disabled');
-			}
-
-			return $user;
-		}
-
-		$users = array_filter($this->userManager->getByEmail($input), function (IUser $user) {
-			return $user->isEnabled();
-		});
-
-		if (count($users) === 1) {
-			return reset($users);
-		}
-
-		throw new ResetPasswordException('Could not find user ' . $input);
-	}
+    protected IURLGenerator $urlGenerator;
+    protected IUserManager $userManager;
+    protected Defaults $defaults;
+    protected IL10N $l10n;
+    protected string $from;
+    protected IManager $encryptionManager;
+    protected IConfig $config;
+    protected IMailer $mailer;
+    private LoggerInterface $logger;
+    private Manager $twoFactorManager;
+    private IInitialState $initialState;
+    private IVerificationToken $verificationToken;
+    private IEventDispatcher $eventDispatcher;
+    private Limiter $limiter;
+
+    public function __construct(
+        string $appName,
+        IRequest $request,
+        IURLGenerator $urlGenerator,
+        IUserManager $userManager,
+        Defaults $defaults,
+        IL10N $l10n,
+        IConfig $config,
+        string $defaultMailAddress,
+        IManager $encryptionManager,
+        IMailer $mailer,
+        LoggerInterface $logger,
+        Manager $twoFactorManager,
+        IInitialState $initialState,
+        IVerificationToken $verificationToken,
+        IEventDispatcher $eventDispatcher,
+        Limiter $limiter
+    ) {
+        parent::__construct($appName, $request);
+        $this->urlGenerator = $urlGenerator;
+        $this->userManager = $userManager;
+        $this->defaults = $defaults;
+        $this->l10n = $l10n;
+        $this->from = $defaultMailAddress;
+        $this->encryptionManager = $encryptionManager;
+        $this->config = $config;
+        $this->mailer = $mailer;
+        $this->logger = $logger;
+        $this->twoFactorManager = $twoFactorManager;
+        $this->initialState = $initialState;
+        $this->verificationToken = $verificationToken;
+        $this->eventDispatcher = $eventDispatcher;
+        $this->limiter = $limiter;
+    }
+
+    /**
+     * Someone wants to reset their password:
+     *
+     * @PublicPage
+     * @NoCSRFRequired
+     */
+    public function resetform(string $token, string $userId): TemplateResponse {
+        try {
+            $this->checkPasswordResetToken($token, $userId);
+        } catch (Exception $e) {
+            if ($this->config->getSystemValue('lost_password_link', '') !== 'disabled'
+                || ($e instanceof InvalidTokenException
+                    && !in_array($e->getCode(), [InvalidTokenException::TOKEN_NOT_FOUND, InvalidTokenException::USER_UNKNOWN]))
+            ) {
+                return new TemplateResponse(
+                    'core', 'error', [
+                        "errors" => [["error" => $e->getMessage()]]
+                    ],
+                    TemplateResponse::RENDER_AS_GUEST
+                );
+            }
+            return new TemplateResponse('core', 'error', [
+                'errors' => [['error' => $this->l10n->t('Password reset is disabled')]]
+            ],
+                TemplateResponse::RENDER_AS_GUEST
+            );
+        }
+        $this->initialState->provideInitialState('resetPasswordUser', $userId);
+        $this->initialState->provideInitialState('resetPasswordTarget',
+            $this->urlGenerator->linkToRouteAbsolute('core.lost.setPassword', ['userId' => $userId, 'token' => $token])
+        );
+
+        return new TemplateResponse(
+            'core',
+            'login',
+            [],
+            'guest'
+        );
+    }
+
+    /**
+     * @throws Exception
+     */
+    protected function checkPasswordResetToken(string $token, string $userId): void {
+        try {
+            $user = $this->userManager->get($userId);
+            $this->verificationToken->check($token, $user, 'lostpassword', $user ? $user->getEMailAddress() : '', true);
+        } catch (InvalidTokenException $e) {
+            $error = $e->getCode() === InvalidTokenException::TOKEN_EXPIRED
+                ? $this->l10n->t('Could not reset password because the token is expired')
+                : $this->l10n->t('Could not reset password because the token is invalid');
+            throw new Exception($error, (int)$e->getCode(), $e);
+        }
+    }
+
+    private function error(string $message, array $additional = []): array {
+        return array_merge(['status' => 'error', 'msg' => $message], $additional);
+    }
+
+    private function success(array $data = []): array {
+        return array_merge($data, ['status' => 'success']);
+    }
+
+    /**
+     * @PublicPage
+     * @BruteForceProtection(action=passwordResetEmail)
+     * @AnonRateThrottle(limit=10, period=300)
+     */
+    public function email(string $user): JSONResponse {
+        if ($this->config->getSystemValue('lost_password_link', '') !== '') {
+            return new JSONResponse($this->error($this->l10n->t('Password reset is disabled')));
+        }
+
+        \OCP\Util::emitHook(
+            '\OCA\Files_Sharing\API\Server2Server',
+            'preLoginNameUsedAsUserName',
+            ['uid' => &$user]
+        );
+
+        // FIXME: use HTTP error codes
+        try {
+            $this->sendEmail($user);
+        } catch (ResetPasswordException $e) {
+            // Ignore the error since we do not want to leak this info
+            $this->logger->warning('Could not send password reset email: ' . $e->getMessage());
+        } catch (Exception $e) {
+            $this->logger->error($e->getMessage(), ['exception' => $e]);
+        }
+
+        $response = new JSONResponse($this->success());
+        $response->throttle();
+        return $response;
+    }
+
+    /**
+     * @PublicPage
+     */
+    public function setPassword(string $token, string $userId, string $password, bool $proceed): array {
+        if ($this->encryptionManager->isEnabled() && !$proceed) {
+            $encryptionModules = $this->encryptionManager->getEncryptionModules();
+            foreach ($encryptionModules as $module) {
+                /** @var IEncryptionModule $instance */
+                $instance = call_user_func($module['callback']);
+                // this way we can find out whether per-user keys are used or a system wide encryption key
+                if ($instance->needDetailedAccessList()) {
+                    return $this->error('', ['encryption' => true]);
+                }
+            }
+        }
+
+        try {
+            $this->checkPasswordResetToken($token, $userId);
+            $user = $this->userManager->get($userId);
+
+            $this->eventDispatcher->dispatchTyped(new BeforePasswordResetEvent($user, $password));
+            \OC_Hook::emit('\OC\Core\LostPassword\Controller\LostController', 'pre_passwordReset', ['uid' => $userId, 'password' => $password]);
+
+            if (strlen($password) > 469) {
+                throw new HintException('Password too long', $this->l10n->t('Password is too long. Maximum allowed length is 469 characters.'));
+            }
+
+            if (!$user->setPassword($password)) {
+                throw new Exception();
+            }
+
+            $this->eventDispatcher->dispatchTyped(new PasswordResetEvent($user, $password));
+            \OC_Hook::emit('\OC\Core\LostPassword\Controller\LostController', 'post_passwordReset', ['uid' => $userId, 'password' => $password]);
+
+            $this->twoFactorManager->clearTwoFactorPending($userId);
+
+            $this->config->deleteUserValue($userId, 'core', 'lostpassword');
+            @\OC::$server->getUserSession()->unsetMagicInCookie();
+        } catch (HintException $e) {
+            return $this->error($e->getHint());
+        } catch (Exception $e) {
+            return $this->error($e->getMessage());
+        }
+
+        return $this->success(['user' => $userId]);
+    }
+
+    /**
+     * @throws ResetPasswordException
+     * @throws \OCP\PreConditionNotMetException
+     */
+    protected function sendEmail(string $input): void {
+        $user = $this->findUserByIdOrMail($input);
+        $email = $user->getEMailAddress();
+
+        if (empty($email)) {
+            throw new ResetPasswordException('Could not send reset e-mail since there is no email for username ' . $input);
+        }
+
+        try {
+            $this->limiter->registerUserRequest('lostpasswordemail', 5, 1800, $user);
+        } catch (RateLimitExceededException $e) {
+            throw new ResetPasswordException('Could not send reset e-mail, 5 of them were already sent in the last 30 minutes', 0, $e);
+        }
+
+        // Generate the token. It is stored encrypted in the database with the
+        // secret being the users' email address appended with the system secret.
+        // This makes the token automatically invalidate once the user changes
+        // their email address.
+        $token = $this->verificationToken->create($user, 'lostpassword', $email);
+
+        $link = $this->urlGenerator->linkToRouteAbsolute('core.lost.resetform', ['userId' => $user->getUID(), 'token' => $token]);
+
+        $emailTemplate = $this->mailer->createEMailTemplate('core.ResetPassword', [
+            'link' => $link,
+        ]);
+
+        $emailTemplate->setSubject($this->l10n->t('%s password reset', [$this->defaults->getName()]));
+        $emailTemplate->addHeader();
+        $emailTemplate->addHeading($this->l10n->t('Password reset'));
+
+        $emailTemplate->addBodyText(
+            htmlspecialchars($this->l10n->t('Click the following button to reset your password. If you have not requested the password reset, then ignore this email.')),
+            $this->l10n->t('Click the following link to reset your password. If you have not requested the password reset, then ignore this email.')
+        );
+
+        $emailTemplate->addBodyButton(
+            htmlspecialchars($this->l10n->t('Reset your password')),
+            $link,
+            false
+        );
+        $emailTemplate->addFooter();
+
+        try {
+            $message = $this->mailer->createMessage();
+            $message->setTo([$email => $user->getDisplayName()]);
+            $message->setFrom([$this->from => $this->defaults->getName()]);
+            $message->useTemplate($emailTemplate);
+            $this->mailer->send($message);
+        } catch (Exception $e) {
+            // Log the exception and continue
+            $this->logger->error($e->getMessage(), ['app' => 'core', 'exception' => $e]);
+        }
+    }
+
+    /**
+     * @throws ResetPasswordException
+     */
+    protected function findUserByIdOrMail(string $input): IUser {
+        $user = $this->userManager->get($input);
+        if ($user instanceof IUser) {
+            if (!$user->isEnabled()) {
+                throw new ResetPasswordException('User ' . $user->getUID() . ' is disabled');
+            }
+
+            return $user;
+        }
+
+        $users = array_filter($this->userManager->getByEmail($input), function (IUser $user) {
+            return $user->isEnabled();
+        });
+
+        if (count($users) === 1) {
+            return reset($users);
+        }
+
+        throw new ResetPasswordException('Could not find user ' . $input);
+    }
 }

core/Controller/LoginController.php

Indentation +323 added lines, -323 removed lines

@@ -60,327 +60,327 @@
 use OCP\Util;
 
 class LoginController extends Controller {
-	public const LOGIN_MSG_INVALIDPASSWORD = 'invalidpassword';
-	public const LOGIN_MSG_USERDISABLED = 'userdisabled';
-
-	private IUserManager $userManager;
-	private IConfig $config;
-	private ISession $session;
-	/** @var IUserSession|Session */
-	private $userSession;
-	private IURLGenerator $urlGenerator;
-	private Defaults $defaults;
-	private Throttler $throttler;
-	private Chain $loginChain;
-	private IInitialStateService $initialStateService;
-	private WebAuthnManager $webAuthnManager;
-	private IManager $manager;
-	private IL10N $l10n;
-
-	public function __construct(?string $appName,
-								IRequest $request,
-								IUserManager $userManager,
-								IConfig $config,
-								ISession $session,
-								IUserSession $userSession,
-								IURLGenerator $urlGenerator,
-								Defaults $defaults,
-								Throttler $throttler,
-								Chain $loginChain,
-								IInitialStateService $initialStateService,
-								WebAuthnManager $webAuthnManager,
-								IManager $manager,
-								IL10N $l10n) {
-		parent::__construct($appName, $request);
-		$this->userManager = $userManager;
-		$this->config = $config;
-		$this->session = $session;
-		$this->userSession = $userSession;
-		$this->urlGenerator = $urlGenerator;
-		$this->defaults = $defaults;
-		$this->throttler = $throttler;
-		$this->loginChain = $loginChain;
-		$this->initialStateService = $initialStateService;
-		$this->webAuthnManager = $webAuthnManager;
-		$this->manager = $manager;
-		$this->l10n = $l10n;
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @UseSession
-	 *
-	 * @return RedirectResponse
-	 */
-	public function logout() {
-		$loginToken = $this->request->getCookie('nc_token');
-		if (!is_null($loginToken)) {
-			$this->config->deleteUserValue($this->userSession->getUser()->getUID(), 'login_token', $loginToken);
-		}
-		$this->userSession->logout();
-
-		$response = new RedirectResponse($this->urlGenerator->linkToRouteAbsolute(
-			'core.login.showLoginForm',
-			['clear' => true] // this param the code in login.js may be removed when the "Clear-Site-Data" is working in the browsers
-		));
-
-		$this->session->set('clearingExecutionContexts', '1');
-		$this->session->close();
-
-		if (!$this->request->isUserAgent([Request::USER_AGENT_CHROME, Request::USER_AGENT_ANDROID_MOBILE_CHROME])) {
-			$response->addHeader('Clear-Site-Data', '"cache", "storage"');
-		}
-
-		return $response;
-	}
-
-	/**
-	 * @PublicPage
-	 * @NoCSRFRequired
-	 * @UseSession
-	 *
-	 * @param string $user
-	 * @param string $redirect_url
-	 *
-	 * @return TemplateResponse|RedirectResponse
-	 */
-	public function showLoginForm(string $user = null, string $redirect_url = null): Http\Response {
-		if ($this->userSession->isLoggedIn()) {
-			return new RedirectResponse($this->urlGenerator->linkToDefaultPageUrl());
-		}
-
-		$loginMessages = $this->session->get('loginMessages');
-		if (!$this->manager->isFairUseOfFreePushService()) {
-			if (!is_array($loginMessages)) {
-				$loginMessages = [[], []];
-			}
-			$loginMessages[1][] = $this->l10n->t('This community release of Nextcloud is unsupported and push notifications are limited.');
-		}
-		if (is_array($loginMessages)) {
-			[$errors, $messages] = $loginMessages;
-			$this->initialStateService->provideInitialState('core', 'loginMessages', $messages);
-			$this->initialStateService->provideInitialState('core', 'loginErrors', $errors);
-		}
-		$this->session->remove('loginMessages');
-
-		if ($user !== null && $user !== '') {
-			$this->initialStateService->provideInitialState('core', 'loginUsername', $user);
-		} else {
-			$this->initialStateService->provideInitialState('core', 'loginUsername', '');
-		}
-
-		$this->initialStateService->provideInitialState(
-			'core',
-			'loginAutocomplete',
-			$this->config->getSystemValue('login_form_autocomplete', true) === true
-		);
-
-		if (!empty($redirect_url)) {
-			[$url, ] = explode('?', $redirect_url);
-			if ($url !== $this->urlGenerator->linkToRoute('core.login.logout')) {
-				$this->initialStateService->provideInitialState('core', 'loginRedirectUrl', $redirect_url);
-			}
-		}
-
-		$this->initialStateService->provideInitialState(
-			'core',
-			'loginThrottleDelay',
-			$this->throttler->getDelay($this->request->getRemoteAddress())
-		);
-
-		$this->setPasswordResetInitialState($user);
-
-		$this->initialStateService->provideInitialState('core', 'webauthn-available', $this->webAuthnManager->isWebAuthnAvailable());
-
-		$this->initialStateService->provideInitialState('core', 'hideLoginForm', $this->config->getSystemValueBool('hide_login_form', false));
-
-		// OpenGraph Support: http://ogp.me/
-		Util::addHeader('meta', ['property' => 'og:title', 'content' => Util::sanitizeHTML($this->defaults->getName())]);
-		Util::addHeader('meta', ['property' => 'og:description', 'content' => Util::sanitizeHTML($this->defaults->getSlogan())]);
-		Util::addHeader('meta', ['property' => 'og:site_name', 'content' => Util::sanitizeHTML($this->defaults->getName())]);
-		Util::addHeader('meta', ['property' => 'og:url', 'content' => $this->urlGenerator->getAbsoluteURL('/')]);
-		Util::addHeader('meta', ['property' => 'og:type', 'content' => 'website']);
-		Util::addHeader('meta', ['property' => 'og:image', 'content' => $this->urlGenerator->getAbsoluteURL($this->urlGenerator->imagePath('core', 'favicon-touch.png'))]);
-
-		$parameters = [
-			'alt_login' => OC_App::getAlternativeLogIns(),
-			'pageTitle' => $this->l10n->t('Login'),
-		];
-
-		$this->initialStateService->provideInitialState('core', 'countAlternativeLogins', count($parameters['alt_login']));
-		$this->initialStateService->provideInitialState('core', 'alternativeLogins', $parameters['alt_login']);
-
-		return new TemplateResponse(
-			$this->appName,
-			'login',
-			$parameters,
-			TemplateResponse::RENDER_AS_GUEST,
-		);
-	}
-
-	/**
-	 * Sets the password reset state
-	 *
-	 * @param string $username
-	 */
-	private function setPasswordResetInitialState(?string $username): void {
-		if ($username !== null && $username !== '') {
-			$user = $this->userManager->get($username);
-		} else {
-			$user = null;
-		}
-
-		$passwordLink = $this->config->getSystemValueString('lost_password_link', '');
-
-		$this->initialStateService->provideInitialState(
-			'core',
-			'loginResetPasswordLink',
-			$passwordLink
-		);
-
-		$this->initialStateService->provideInitialState(
-			'core',
-			'loginCanResetPassword',
-			$this->canResetPassword($passwordLink, $user)
-		);
-	}
-
-	/**
-	 * @param string|null $passwordLink
-	 * @param IUser|null $user
-	 *
-	 * Users may not change their passwords if:
-	 * - The account is disabled
-	 * - The backend doesn't support password resets
-	 * - The password reset function is disabled
-	 *
-	 * @return bool
-	 */
-	private function canResetPassword(?string $passwordLink, ?IUser $user): bool {
-		if ($passwordLink === 'disabled') {
-			return false;
-		}
-
-		if (!$passwordLink && $user !== null) {
-			return $user->canChangePassword();
-		}
-
-		if ($user !== null && $user->isEnabled() === false) {
-			return false;
-		}
-
-		return true;
-	}
-
-	private function generateRedirect(?string $redirectUrl): RedirectResponse {
-		if ($redirectUrl !== null && $this->userSession->isLoggedIn()) {
-			$location = $this->urlGenerator->getAbsoluteURL($redirectUrl);
-			// Deny the redirect if the URL contains a @
-			// This prevents unvalidated redirects like ?redirect_url=:user@domain.com
-			if (strpos($location, '@') === false) {
-				return new RedirectResponse($location);
-			}
-		}
-		return new RedirectResponse($this->urlGenerator->linkToDefaultPageUrl());
-	}
-
-	/**
-	 * @PublicPage
-	 * @UseSession
-	 * @NoCSRFRequired
-	 * @BruteForceProtection(action=login)
-	 *
-	 * @param string $user
-	 * @param string $password
-	 * @param string $redirect_url
-	 * @param string $timezone
-	 * @param string $timezone_offset
-	 *
-	 * @return RedirectResponse
-	 */
-	public function tryLogin(string $user,
-							 string $password,
-							 string $redirect_url = null,
-							 string $timezone = '',
-							 string $timezone_offset = ''): RedirectResponse {
-		// If the user is already logged in and the CSRF check does not pass then
-		// simply redirect the user to the correct page as required. This is the
-		// case when an user has already logged-in, in another tab.
-		if (!$this->request->passesCSRFCheck()) {
-			return $this->generateRedirect($redirect_url);
-		}
-
-		$data = new LoginData(
-			$this->request,
-			trim($user),
-			$password,
-			$redirect_url,
-			$timezone,
-			$timezone_offset
-		);
-		$result = $this->loginChain->process($data);
-		if (!$result->isSuccess()) {
-			return $this->createLoginFailedResponse(
-				$data->getUsername(),
-				$user,
-				$redirect_url,
-				$result->getErrorMessage()
-			);
-		}
-
-		if ($result->getRedirectUrl() !== null) {
-			return new RedirectResponse($result->getRedirectUrl());
-		}
-		return $this->generateRedirect($redirect_url);
-	}
-
-	/**
-	 * Creates a login failed response.
-	 *
-	 * @param string $user
-	 * @param string $originalUser
-	 * @param string $redirect_url
-	 * @param string $loginMessage
-	 *
-	 * @return RedirectResponse
-	 */
-	private function createLoginFailedResponse(
-		$user, $originalUser, $redirect_url, string $loginMessage) {
-		// Read current user and append if possible we need to
-		// return the unmodified user otherwise we will leak the login name
-		$args = $user !== null ? ['user' => $originalUser, 'direct' => 1] : [];
-		if ($redirect_url !== null) {
-			$args['redirect_url'] = $redirect_url;
-		}
-		$response = new RedirectResponse(
-			$this->urlGenerator->linkToRoute('core.login.showLoginForm', $args)
-		);
-		$response->throttle(['user' => substr($user, 0, 64)]);
-		$this->session->set('loginMessages', [
-			[$loginMessage], []
-		]);
-		return $response;
-	}
-
-	/**
-	 * @NoAdminRequired
-	 * @UseSession
-	 * @BruteForceProtection(action=sudo)
-	 *
-	 * @license GNU AGPL version 3 or any later version
-	 *
-	 */
-	public function confirmPassword(string $password): DataResponse {
-		$loginName = $this->userSession->getLoginName();
-		$loginResult = $this->userManager->checkPassword($loginName, $password);
-		if ($loginResult === false) {
-			$response = new DataResponse([], Http::STATUS_FORBIDDEN);
-			$response->throttle();
-			return $response;
-		}
-
-		$confirmTimestamp = time();
-		$this->session->set('last-password-confirm', $confirmTimestamp);
-		return new DataResponse(['lastLogin' => $confirmTimestamp], Http::STATUS_OK);
-	}
+    public const LOGIN_MSG_INVALIDPASSWORD = 'invalidpassword';
+    public const LOGIN_MSG_USERDISABLED = 'userdisabled';
+
+    private IUserManager $userManager;
+    private IConfig $config;
+    private ISession $session;
+    /** @var IUserSession|Session */
+    private $userSession;
+    private IURLGenerator $urlGenerator;
+    private Defaults $defaults;
+    private Throttler $throttler;
+    private Chain $loginChain;
+    private IInitialStateService $initialStateService;
+    private WebAuthnManager $webAuthnManager;
+    private IManager $manager;
+    private IL10N $l10n;
+
+    public function __construct(?string $appName,
+                                IRequest $request,
+                                IUserManager $userManager,
+                                IConfig $config,
+                                ISession $session,
+                                IUserSession $userSession,
+                                IURLGenerator $urlGenerator,
+                                Defaults $defaults,
+                                Throttler $throttler,
+                                Chain $loginChain,
+                                IInitialStateService $initialStateService,
+                                WebAuthnManager $webAuthnManager,
+                                IManager $manager,
+                                IL10N $l10n) {
+        parent::__construct($appName, $request);
+        $this->userManager = $userManager;
+        $this->config = $config;
+        $this->session = $session;
+        $this->userSession = $userSession;
+        $this->urlGenerator = $urlGenerator;
+        $this->defaults = $defaults;
+        $this->throttler = $throttler;
+        $this->loginChain = $loginChain;
+        $this->initialStateService = $initialStateService;
+        $this->webAuthnManager = $webAuthnManager;
+        $this->manager = $manager;
+        $this->l10n = $l10n;
+    }
+
+    /**
+     * @NoAdminRequired
+     * @UseSession
+     *
+     * @return RedirectResponse
+     */
+    public function logout() {
+        $loginToken = $this->request->getCookie('nc_token');
+        if (!is_null($loginToken)) {
+            $this->config->deleteUserValue($this->userSession->getUser()->getUID(), 'login_token', $loginToken);
+        }
+        $this->userSession->logout();
+
+        $response = new RedirectResponse($this->urlGenerator->linkToRouteAbsolute(
+            'core.login.showLoginForm',
+            ['clear' => true] // this param the code in login.js may be removed when the "Clear-Site-Data" is working in the browsers
+        ));
+
+        $this->session->set('clearingExecutionContexts', '1');
+        $this->session->close();
+
+        if (!$this->request->isUserAgent([Request::USER_AGENT_CHROME, Request::USER_AGENT_ANDROID_MOBILE_CHROME])) {
+            $response->addHeader('Clear-Site-Data', '"cache", "storage"');
+        }
+
+        return $response;
+    }
+
+    /**
+     * @PublicPage
+     * @NoCSRFRequired
+     * @UseSession
+     *
+     * @param string $user
+     * @param string $redirect_url
+     *
+     * @return TemplateResponse|RedirectResponse
+     */
+    public function showLoginForm(string $user = null, string $redirect_url = null): Http\Response {
+        if ($this->userSession->isLoggedIn()) {
+            return new RedirectResponse($this->urlGenerator->linkToDefaultPageUrl());
+        }
+
+        $loginMessages = $this->session->get('loginMessages');
+        if (!$this->manager->isFairUseOfFreePushService()) {
+            if (!is_array($loginMessages)) {
+                $loginMessages = [[], []];
+            }
+            $loginMessages[1][] = $this->l10n->t('This community release of Nextcloud is unsupported and push notifications are limited.');
+        }
+        if (is_array($loginMessages)) {
+            [$errors, $messages] = $loginMessages;
+            $this->initialStateService->provideInitialState('core', 'loginMessages', $messages);
+            $this->initialStateService->provideInitialState('core', 'loginErrors', $errors);
+        }
+        $this->session->remove('loginMessages');
+
+        if ($user !== null && $user !== '') {
+            $this->initialStateService->provideInitialState('core', 'loginUsername', $user);
+        } else {
+            $this->initialStateService->provideInitialState('core', 'loginUsername', '');
+        }
+
+        $this->initialStateService->provideInitialState(
+            'core',
+            'loginAutocomplete',
+            $this->config->getSystemValue('login_form_autocomplete', true) === true
+        );
+
+        if (!empty($redirect_url)) {
+            [$url, ] = explode('?', $redirect_url);
+            if ($url !== $this->urlGenerator->linkToRoute('core.login.logout')) {
+                $this->initialStateService->provideInitialState('core', 'loginRedirectUrl', $redirect_url);
+            }
+        }
+
+        $this->initialStateService->provideInitialState(
+            'core',
+            'loginThrottleDelay',
+            $this->throttler->getDelay($this->request->getRemoteAddress())
+        );
+
+        $this->setPasswordResetInitialState($user);
+
+        $this->initialStateService->provideInitialState('core', 'webauthn-available', $this->webAuthnManager->isWebAuthnAvailable());
+
+        $this->initialStateService->provideInitialState('core', 'hideLoginForm', $this->config->getSystemValueBool('hide_login_form', false));
+
+        // OpenGraph Support: http://ogp.me/
+        Util::addHeader('meta', ['property' => 'og:title', 'content' => Util::sanitizeHTML($this->defaults->getName())]);
+        Util::addHeader('meta', ['property' => 'og:description', 'content' => Util::sanitizeHTML($this->defaults->getSlogan())]);
+        Util::addHeader('meta', ['property' => 'og:site_name', 'content' => Util::sanitizeHTML($this->defaults->getName())]);
+        Util::addHeader('meta', ['property' => 'og:url', 'content' => $this->urlGenerator->getAbsoluteURL('/')]);
+        Util::addHeader('meta', ['property' => 'og:type', 'content' => 'website']);
+        Util::addHeader('meta', ['property' => 'og:image', 'content' => $this->urlGenerator->getAbsoluteURL($this->urlGenerator->imagePath('core', 'favicon-touch.png'))]);
+
+        $parameters = [
+            'alt_login' => OC_App::getAlternativeLogIns(),
+            'pageTitle' => $this->l10n->t('Login'),
+        ];
+
+        $this->initialStateService->provideInitialState('core', 'countAlternativeLogins', count($parameters['alt_login']));
+        $this->initialStateService->provideInitialState('core', 'alternativeLogins', $parameters['alt_login']);
+
+        return new TemplateResponse(
+            $this->appName,
+            'login',
+            $parameters,
+            TemplateResponse::RENDER_AS_GUEST,
+        );
+    }
+
+    /**
+     * Sets the password reset state
+     *
+     * @param string $username
+     */
+    private function setPasswordResetInitialState(?string $username): void {
+        if ($username !== null && $username !== '') {
+            $user = $this->userManager->get($username);
+        } else {
+            $user = null;
+        }
+
+        $passwordLink = $this->config->getSystemValueString('lost_password_link', '');
+
+        $this->initialStateService->provideInitialState(
+            'core',
+            'loginResetPasswordLink',
+            $passwordLink
+        );
+
+        $this->initialStateService->provideInitialState(
+            'core',
+            'loginCanResetPassword',
+            $this->canResetPassword($passwordLink, $user)
+        );
+    }
+
+    /**
+     * @param string|null $passwordLink
+     * @param IUser|null $user
+     *
+     * Users may not change their passwords if:
+     * - The account is disabled
+     * - The backend doesn't support password resets
+     * - The password reset function is disabled
+     *
+     * @return bool
+     */
+    private function canResetPassword(?string $passwordLink, ?IUser $user): bool {
+        if ($passwordLink === 'disabled') {
+            return false;
+        }
+
+        if (!$passwordLink && $user !== null) {
+            return $user->canChangePassword();
+        }
+
+        if ($user !== null && $user->isEnabled() === false) {
+            return false;
+        }
+
+        return true;
+    }
+
+    private function generateRedirect(?string $redirectUrl): RedirectResponse {
+        if ($redirectUrl !== null && $this->userSession->isLoggedIn()) {
+            $location = $this->urlGenerator->getAbsoluteURL($redirectUrl);
+            // Deny the redirect if the URL contains a @
+            // This prevents unvalidated redirects like ?redirect_url=:user@domain.com
+            if (strpos($location, '@') === false) {
+                return new RedirectResponse($location);
+            }
+        }
+        return new RedirectResponse($this->urlGenerator->linkToDefaultPageUrl());
+    }
+
+    /**
+     * @PublicPage
+     * @UseSession
+     * @NoCSRFRequired
+     * @BruteForceProtection(action=login)
+     *
+     * @param string $user
+     * @param string $password
+     * @param string $redirect_url
+     * @param string $timezone
+     * @param string $timezone_offset
+     *
+     * @return RedirectResponse
+     */
+    public function tryLogin(string $user,
+                                string $password,
+                                string $redirect_url = null,
+                                string $timezone = '',
+                                string $timezone_offset = ''): RedirectResponse {
+        // If the user is already logged in and the CSRF check does not pass then
+        // simply redirect the user to the correct page as required. This is the
+        // case when an user has already logged-in, in another tab.
+        if (!$this->request->passesCSRFCheck()) {
+            return $this->generateRedirect($redirect_url);
+        }
+
+        $data = new LoginData(
+            $this->request,
+            trim($user),
+            $password,
+            $redirect_url,
+            $timezone,
+            $timezone_offset
+        );
+        $result = $this->loginChain->process($data);
+        if (!$result->isSuccess()) {
+            return $this->createLoginFailedResponse(
+                $data->getUsername(),
+                $user,
+                $redirect_url,
+                $result->getErrorMessage()
+            );
+        }
+
+        if ($result->getRedirectUrl() !== null) {
+            return new RedirectResponse($result->getRedirectUrl());
+        }
+        return $this->generateRedirect($redirect_url);
+    }
+
+    /**
+     * Creates a login failed response.
+     *
+     * @param string $user
+     * @param string $originalUser
+     * @param string $redirect_url
+     * @param string $loginMessage
+     *
+     * @return RedirectResponse
+     */
+    private function createLoginFailedResponse(
+        $user, $originalUser, $redirect_url, string $loginMessage) {
+        // Read current user and append if possible we need to
+        // return the unmodified user otherwise we will leak the login name
+        $args = $user !== null ? ['user' => $originalUser, 'direct' => 1] : [];
+        if ($redirect_url !== null) {
+            $args['redirect_url'] = $redirect_url;
+        }
+        $response = new RedirectResponse(
+            $this->urlGenerator->linkToRoute('core.login.showLoginForm', $args)
+        );
+        $response->throttle(['user' => substr($user, 0, 64)]);
+        $this->session->set('loginMessages', [
+            [$loginMessage], []
+        ]);
+        return $response;
+    }
+
+    /**
+     * @NoAdminRequired
+     * @UseSession
+     * @BruteForceProtection(action=sudo)
+     *
+     * @license GNU AGPL version 3 or any later version
+     *
+     */
+    public function confirmPassword(string $password): DataResponse {
+        $loginName = $this->userSession->getLoginName();
+        $loginResult = $this->userManager->checkPassword($loginName, $password);
+        if ($loginResult === false) {
+            $response = new DataResponse([], Http::STATUS_FORBIDDEN);
+            $response->throttle();
+            return $response;
+        }
+
+        $confirmTimestamp = time();
+        $this->session->set('last-password-confirm', $confirmTimestamp);
+        return new DataResponse(['lastLogin' => $confirmTimestamp], Http::STATUS_OK);
+    }
 }