@@ -43,275 +43,275 @@ |
||
| 43 | 43 | use OCP\Session\Exceptions\SessionNotAvailableException; |
| 44 | 44 | |
| 45 | 45 | class ClientFlowLoginController extends Controller { |
| 46 | - /** @var IUserSession */ |
|
| 47 | - private $userSession; |
|
| 48 | - /** @var IL10N */ |
|
| 49 | - private $l10n; |
|
| 50 | - /** @var Defaults */ |
|
| 51 | - private $defaults; |
|
| 52 | - /** @var ISession */ |
|
| 53 | - private $session; |
|
| 54 | - /** @var IProvider */ |
|
| 55 | - private $tokenProvider; |
|
| 56 | - /** @var ISecureRandom */ |
|
| 57 | - private $random; |
|
| 58 | - /** @var IURLGenerator */ |
|
| 59 | - private $urlGenerator; |
|
| 60 | - /** @var ClientMapper */ |
|
| 61 | - private $clientMapper; |
|
| 62 | - /** @var AccessTokenMapper */ |
|
| 63 | - private $accessTokenMapper; |
|
| 64 | - /** @var ICrypto */ |
|
| 65 | - private $crypto; |
|
| 46 | + /** @var IUserSession */ |
|
| 47 | + private $userSession; |
|
| 48 | + /** @var IL10N */ |
|
| 49 | + private $l10n; |
|
| 50 | + /** @var Defaults */ |
|
| 51 | + private $defaults; |
|
| 52 | + /** @var ISession */ |
|
| 53 | + private $session; |
|
| 54 | + /** @var IProvider */ |
|
| 55 | + private $tokenProvider; |
|
| 56 | + /** @var ISecureRandom */ |
|
| 57 | + private $random; |
|
| 58 | + /** @var IURLGenerator */ |
|
| 59 | + private $urlGenerator; |
|
| 60 | + /** @var ClientMapper */ |
|
| 61 | + private $clientMapper; |
|
| 62 | + /** @var AccessTokenMapper */ |
|
| 63 | + private $accessTokenMapper; |
|
| 64 | + /** @var ICrypto */ |
|
| 65 | + private $crypto; |
|
| 66 | 66 | |
| 67 | - const stateName = 'client.flow.state.token'; |
|
| 67 | + const stateName = 'client.flow.state.token'; |
|
| 68 | 68 | |
| 69 | - /** |
|
| 70 | - * @param string $appName |
|
| 71 | - * @param IRequest $request |
|
| 72 | - * @param IUserSession $userSession |
|
| 73 | - * @param IL10N $l10n |
|
| 74 | - * @param Defaults $defaults |
|
| 75 | - * @param ISession $session |
|
| 76 | - * @param IProvider $tokenProvider |
|
| 77 | - * @param ISecureRandom $random |
|
| 78 | - * @param IURLGenerator $urlGenerator |
|
| 79 | - * @param ClientMapper $clientMapper |
|
| 80 | - * @param AccessTokenMapper $accessTokenMapper |
|
| 81 | - * @param ICrypto $crypto |
|
| 82 | - */ |
|
| 83 | - public function __construct($appName, |
|
| 84 | - IRequest $request, |
|
| 85 | - IUserSession $userSession, |
|
| 86 | - IL10N $l10n, |
|
| 87 | - Defaults $defaults, |
|
| 88 | - ISession $session, |
|
| 89 | - IProvider $tokenProvider, |
|
| 90 | - ISecureRandom $random, |
|
| 91 | - IURLGenerator $urlGenerator, |
|
| 92 | - ClientMapper $clientMapper, |
|
| 93 | - AccessTokenMapper $accessTokenMapper, |
|
| 94 | - ICrypto $crypto) { |
|
| 95 | - parent::__construct($appName, $request); |
|
| 96 | - $this->userSession = $userSession; |
|
| 97 | - $this->l10n = $l10n; |
|
| 98 | - $this->defaults = $defaults; |
|
| 99 | - $this->session = $session; |
|
| 100 | - $this->tokenProvider = $tokenProvider; |
|
| 101 | - $this->random = $random; |
|
| 102 | - $this->urlGenerator = $urlGenerator; |
|
| 103 | - $this->clientMapper = $clientMapper; |
|
| 104 | - $this->accessTokenMapper = $accessTokenMapper; |
|
| 105 | - $this->crypto = $crypto; |
|
| 106 | - } |
|
| 69 | + /** |
|
| 70 | + * @param string $appName |
|
| 71 | + * @param IRequest $request |
|
| 72 | + * @param IUserSession $userSession |
|
| 73 | + * @param IL10N $l10n |
|
| 74 | + * @param Defaults $defaults |
|
| 75 | + * @param ISession $session |
|
| 76 | + * @param IProvider $tokenProvider |
|
| 77 | + * @param ISecureRandom $random |
|
| 78 | + * @param IURLGenerator $urlGenerator |
|
| 79 | + * @param ClientMapper $clientMapper |
|
| 80 | + * @param AccessTokenMapper $accessTokenMapper |
|
| 81 | + * @param ICrypto $crypto |
|
| 82 | + */ |
|
| 83 | + public function __construct($appName, |
|
| 84 | + IRequest $request, |
|
| 85 | + IUserSession $userSession, |
|
| 86 | + IL10N $l10n, |
|
| 87 | + Defaults $defaults, |
|
| 88 | + ISession $session, |
|
| 89 | + IProvider $tokenProvider, |
|
| 90 | + ISecureRandom $random, |
|
| 91 | + IURLGenerator $urlGenerator, |
|
| 92 | + ClientMapper $clientMapper, |
|
| 93 | + AccessTokenMapper $accessTokenMapper, |
|
| 94 | + ICrypto $crypto) { |
|
| 95 | + parent::__construct($appName, $request); |
|
| 96 | + $this->userSession = $userSession; |
|
| 97 | + $this->l10n = $l10n; |
|
| 98 | + $this->defaults = $defaults; |
|
| 99 | + $this->session = $session; |
|
| 100 | + $this->tokenProvider = $tokenProvider; |
|
| 101 | + $this->random = $random; |
|
| 102 | + $this->urlGenerator = $urlGenerator; |
|
| 103 | + $this->clientMapper = $clientMapper; |
|
| 104 | + $this->accessTokenMapper = $accessTokenMapper; |
|
| 105 | + $this->crypto = $crypto; |
|
| 106 | + } |
|
| 107 | 107 | |
| 108 | - /** |
|
| 109 | - * @return string |
|
| 110 | - */ |
|
| 111 | - private function getClientName() { |
|
| 112 | - return $this->request->getHeader('USER_AGENT') !== null ? $this->request->getHeader('USER_AGENT') : 'unknown'; |
|
| 113 | - } |
|
| 108 | + /** |
|
| 109 | + * @return string |
|
| 110 | + */ |
|
| 111 | + private function getClientName() { |
|
| 112 | + return $this->request->getHeader('USER_AGENT') !== null ? $this->request->getHeader('USER_AGENT') : 'unknown'; |
|
| 113 | + } |
|
| 114 | 114 | |
| 115 | - /** |
|
| 116 | - * @param string $stateToken |
|
| 117 | - * @return bool |
|
| 118 | - */ |
|
| 119 | - private function isValidToken($stateToken) { |
|
| 120 | - $currentToken = $this->session->get(self::stateName); |
|
| 121 | - if(!is_string($stateToken) || !is_string($currentToken)) { |
|
| 122 | - return false; |
|
| 123 | - } |
|
| 124 | - return hash_equals($currentToken, $stateToken); |
|
| 125 | - } |
|
| 115 | + /** |
|
| 116 | + * @param string $stateToken |
|
| 117 | + * @return bool |
|
| 118 | + */ |
|
| 119 | + private function isValidToken($stateToken) { |
|
| 120 | + $currentToken = $this->session->get(self::stateName); |
|
| 121 | + if(!is_string($stateToken) || !is_string($currentToken)) { |
|
| 122 | + return false; |
|
| 123 | + } |
|
| 124 | + return hash_equals($currentToken, $stateToken); |
|
| 125 | + } |
|
| 126 | 126 | |
| 127 | - /** |
|
| 128 | - * @return TemplateResponse |
|
| 129 | - */ |
|
| 130 | - private function stateTokenForbiddenResponse() { |
|
| 131 | - $response = new TemplateResponse( |
|
| 132 | - $this->appName, |
|
| 133 | - '403', |
|
| 134 | - [ |
|
| 135 | - 'file' => $this->l10n->t('State token does not match'), |
|
| 136 | - ], |
|
| 137 | - 'guest' |
|
| 138 | - ); |
|
| 139 | - $response->setStatus(Http::STATUS_FORBIDDEN); |
|
| 140 | - return $response; |
|
| 141 | - } |
|
| 127 | + /** |
|
| 128 | + * @return TemplateResponse |
|
| 129 | + */ |
|
| 130 | + private function stateTokenForbiddenResponse() { |
|
| 131 | + $response = new TemplateResponse( |
|
| 132 | + $this->appName, |
|
| 133 | + '403', |
|
| 134 | + [ |
|
| 135 | + 'file' => $this->l10n->t('State token does not match'), |
|
| 136 | + ], |
|
| 137 | + 'guest' |
|
| 138 | + ); |
|
| 139 | + $response->setStatus(Http::STATUS_FORBIDDEN); |
|
| 140 | + return $response; |
|
| 141 | + } |
|
| 142 | 142 | |
| 143 | - /** |
|
| 144 | - * @PublicPage |
|
| 145 | - * @NoCSRFRequired |
|
| 146 | - * @UseSession |
|
| 147 | - * |
|
| 148 | - * @param string $clientIdentifier |
|
| 149 | - * |
|
| 150 | - * @return TemplateResponse |
|
| 151 | - */ |
|
| 152 | - public function showAuthPickerPage($clientIdentifier = '', |
|
| 153 | - $oauthState = '') { |
|
| 143 | + /** |
|
| 144 | + * @PublicPage |
|
| 145 | + * @NoCSRFRequired |
|
| 146 | + * @UseSession |
|
| 147 | + * |
|
| 148 | + * @param string $clientIdentifier |
|
| 149 | + * |
|
| 150 | + * @return TemplateResponse |
|
| 151 | + */ |
|
| 152 | + public function showAuthPickerPage($clientIdentifier = '', |
|
| 153 | + $oauthState = '') { |
|
| 154 | 154 | |
| 155 | 155 | |
| 156 | - $clientName = $this->getClientName(); |
|
| 157 | - $client = null; |
|
| 158 | - if($clientIdentifier !== '') { |
|
| 159 | - $client = $this->clientMapper->getByIdentifier($clientIdentifier); |
|
| 160 | - $clientName = $client->getName(); |
|
| 161 | - } |
|
| 156 | + $clientName = $this->getClientName(); |
|
| 157 | + $client = null; |
|
| 158 | + if($clientIdentifier !== '') { |
|
| 159 | + $client = $this->clientMapper->getByIdentifier($clientIdentifier); |
|
| 160 | + $clientName = $client->getName(); |
|
| 161 | + } |
|
| 162 | 162 | |
| 163 | - $validClient = $client !== null && $client->getClientIdentifier() !== null; |
|
| 164 | - $cookieCheckSuccessful = $this->request->passesStrictCookieCheck(); |
|
| 163 | + $validClient = $client !== null && $client->getClientIdentifier() !== null; |
|
| 164 | + $cookieCheckSuccessful = $this->request->passesStrictCookieCheck(); |
|
| 165 | 165 | |
| 166 | - // no valid clientIdentifier given and no valid API Request (APIRequest header not set) |
|
| 167 | - if ($cookieCheckSuccessful === false && $validClient === false) { |
|
| 168 | - return new TemplateResponse( |
|
| 169 | - $this->appName, |
|
| 170 | - 'error', |
|
| 171 | - ['errors' => |
|
| 172 | - [ |
|
| 173 | - ['error' => 'Access Forbidden', 'hint' => 'Invalid request'] |
|
| 174 | - ] |
|
| 175 | - ] |
|
| 176 | - ); |
|
| 177 | - } |
|
| 166 | + // no valid clientIdentifier given and no valid API Request (APIRequest header not set) |
|
| 167 | + if ($cookieCheckSuccessful === false && $validClient === false) { |
|
| 168 | + return new TemplateResponse( |
|
| 169 | + $this->appName, |
|
| 170 | + 'error', |
|
| 171 | + ['errors' => |
|
| 172 | + [ |
|
| 173 | + ['error' => 'Access Forbidden', 'hint' => 'Invalid request'] |
|
| 174 | + ] |
|
| 175 | + ] |
|
| 176 | + ); |
|
| 177 | + } |
|
| 178 | 178 | |
| 179 | - $stateToken = $this->random->generate( |
|
| 180 | - 64, |
|
| 181 | - ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_DIGITS |
|
| 182 | - ); |
|
| 183 | - $this->session->set(self::stateName, $stateToken); |
|
| 179 | + $stateToken = $this->random->generate( |
|
| 180 | + 64, |
|
| 181 | + ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_DIGITS |
|
| 182 | + ); |
|
| 183 | + $this->session->set(self::stateName, $stateToken); |
|
| 184 | 184 | |
| 185 | - return new TemplateResponse( |
|
| 186 | - $this->appName, |
|
| 187 | - 'loginflow/authpicker', |
|
| 188 | - [ |
|
| 189 | - 'client' => $clientName, |
|
| 190 | - 'clientIdentifier' => $clientIdentifier, |
|
| 191 | - 'oauthState' => $oauthState, |
|
| 192 | - 'instanceName' => $this->defaults->getName(), |
|
| 193 | - 'urlGenerator' => $this->urlGenerator, |
|
| 194 | - 'stateToken' => $stateToken, |
|
| 195 | - 'serverHost' => $this->request->getServerHost(), |
|
| 196 | - ], |
|
| 197 | - 'guest' |
|
| 198 | - ); |
|
| 199 | - } |
|
| 185 | + return new TemplateResponse( |
|
| 186 | + $this->appName, |
|
| 187 | + 'loginflow/authpicker', |
|
| 188 | + [ |
|
| 189 | + 'client' => $clientName, |
|
| 190 | + 'clientIdentifier' => $clientIdentifier, |
|
| 191 | + 'oauthState' => $oauthState, |
|
| 192 | + 'instanceName' => $this->defaults->getName(), |
|
| 193 | + 'urlGenerator' => $this->urlGenerator, |
|
| 194 | + 'stateToken' => $stateToken, |
|
| 195 | + 'serverHost' => $this->request->getServerHost(), |
|
| 196 | + ], |
|
| 197 | + 'guest' |
|
| 198 | + ); |
|
| 199 | + } |
|
| 200 | 200 | |
| 201 | - /** |
|
| 202 | - * @NoAdminRequired |
|
| 203 | - * @NoCSRFRequired |
|
| 204 | - * @UseSession |
|
| 205 | - * |
|
| 206 | - * @param string $stateToken |
|
| 207 | - * @param string $clientIdentifier |
|
| 208 | - * @param string $oauthState |
|
| 209 | - * @return TemplateResponse |
|
| 210 | - */ |
|
| 211 | - public function redirectPage($stateToken = '', |
|
| 212 | - $clientIdentifier = '', |
|
| 213 | - $oauthState = '') { |
|
| 214 | - if(!$this->isValidToken($stateToken)) { |
|
| 215 | - return $this->stateTokenForbiddenResponse(); |
|
| 216 | - } |
|
| 201 | + /** |
|
| 202 | + * @NoAdminRequired |
|
| 203 | + * @NoCSRFRequired |
|
| 204 | + * @UseSession |
|
| 205 | + * |
|
| 206 | + * @param string $stateToken |
|
| 207 | + * @param string $clientIdentifier |
|
| 208 | + * @param string $oauthState |
|
| 209 | + * @return TemplateResponse |
|
| 210 | + */ |
|
| 211 | + public function redirectPage($stateToken = '', |
|
| 212 | + $clientIdentifier = '', |
|
| 213 | + $oauthState = '') { |
|
| 214 | + if(!$this->isValidToken($stateToken)) { |
|
| 215 | + return $this->stateTokenForbiddenResponse(); |
|
| 216 | + } |
|
| 217 | 217 | |
| 218 | - return new TemplateResponse( |
|
| 219 | - $this->appName, |
|
| 220 | - 'loginflow/redirect', |
|
| 221 | - [ |
|
| 222 | - 'urlGenerator' => $this->urlGenerator, |
|
| 223 | - 'stateToken' => $stateToken, |
|
| 224 | - 'clientIdentifier' => $clientIdentifier, |
|
| 225 | - 'oauthState' => $oauthState, |
|
| 226 | - ], |
|
| 227 | - 'empty' |
|
| 228 | - ); |
|
| 229 | - } |
|
| 218 | + return new TemplateResponse( |
|
| 219 | + $this->appName, |
|
| 220 | + 'loginflow/redirect', |
|
| 221 | + [ |
|
| 222 | + 'urlGenerator' => $this->urlGenerator, |
|
| 223 | + 'stateToken' => $stateToken, |
|
| 224 | + 'clientIdentifier' => $clientIdentifier, |
|
| 225 | + 'oauthState' => $oauthState, |
|
| 226 | + ], |
|
| 227 | + 'empty' |
|
| 228 | + ); |
|
| 229 | + } |
|
| 230 | 230 | |
| 231 | - /** |
|
| 232 | - * @NoAdminRequired |
|
| 233 | - * @UseSession |
|
| 234 | - * |
|
| 235 | - * @param string $stateToken |
|
| 236 | - * @param string $clientIdentifier |
|
| 237 | - * @param string $state |
|
| 238 | - * @param string $oauthState |
|
| 239 | - * @return Http\RedirectResponse|Response |
|
| 240 | - */ |
|
| 241 | - public function generateAppPassword($stateToken, |
|
| 242 | - $clientIdentifier = '', |
|
| 243 | - $state = '', |
|
| 244 | - $oauthState = '') { |
|
| 245 | - if(!$this->isValidToken($stateToken)) { |
|
| 246 | - $this->session->remove(self::stateName); |
|
| 247 | - return $this->stateTokenForbiddenResponse(); |
|
| 248 | - } |
|
| 231 | + /** |
|
| 232 | + * @NoAdminRequired |
|
| 233 | + * @UseSession |
|
| 234 | + * |
|
| 235 | + * @param string $stateToken |
|
| 236 | + * @param string $clientIdentifier |
|
| 237 | + * @param string $state |
|
| 238 | + * @param string $oauthState |
|
| 239 | + * @return Http\RedirectResponse|Response |
|
| 240 | + */ |
|
| 241 | + public function generateAppPassword($stateToken, |
|
| 242 | + $clientIdentifier = '', |
|
| 243 | + $state = '', |
|
| 244 | + $oauthState = '') { |
|
| 245 | + if(!$this->isValidToken($stateToken)) { |
|
| 246 | + $this->session->remove(self::stateName); |
|
| 247 | + return $this->stateTokenForbiddenResponse(); |
|
| 248 | + } |
|
| 249 | 249 | |
| 250 | - $this->session->remove(self::stateName); |
|
| 250 | + $this->session->remove(self::stateName); |
|
| 251 | 251 | |
| 252 | - try { |
|
| 253 | - $sessionId = $this->session->getId(); |
|
| 254 | - } catch (SessionNotAvailableException $ex) { |
|
| 255 | - $response = new Response(); |
|
| 256 | - $response->setStatus(Http::STATUS_FORBIDDEN); |
|
| 257 | - return $response; |
|
| 258 | - } |
|
| 252 | + try { |
|
| 253 | + $sessionId = $this->session->getId(); |
|
| 254 | + } catch (SessionNotAvailableException $ex) { |
|
| 255 | + $response = new Response(); |
|
| 256 | + $response->setStatus(Http::STATUS_FORBIDDEN); |
|
| 257 | + return $response; |
|
| 258 | + } |
|
| 259 | 259 | |
| 260 | - try { |
|
| 261 | - $sessionToken = $this->tokenProvider->getToken($sessionId); |
|
| 262 | - $loginName = $sessionToken->getLoginName(); |
|
| 263 | - try { |
|
| 264 | - $password = $this->tokenProvider->getPassword($sessionToken, $sessionId); |
|
| 265 | - } catch (PasswordlessTokenException $ex) { |
|
| 266 | - $password = null; |
|
| 267 | - } |
|
| 268 | - } catch (InvalidTokenException $ex) { |
|
| 269 | - $response = new Response(); |
|
| 270 | - $response->setStatus(Http::STATUS_FORBIDDEN); |
|
| 271 | - return $response; |
|
| 272 | - } |
|
| 260 | + try { |
|
| 261 | + $sessionToken = $this->tokenProvider->getToken($sessionId); |
|
| 262 | + $loginName = $sessionToken->getLoginName(); |
|
| 263 | + try { |
|
| 264 | + $password = $this->tokenProvider->getPassword($sessionToken, $sessionId); |
|
| 265 | + } catch (PasswordlessTokenException $ex) { |
|
| 266 | + $password = null; |
|
| 267 | + } |
|
| 268 | + } catch (InvalidTokenException $ex) { |
|
| 269 | + $response = new Response(); |
|
| 270 | + $response->setStatus(Http::STATUS_FORBIDDEN); |
|
| 271 | + return $response; |
|
| 272 | + } |
|
| 273 | 273 | |
| 274 | - $clientName = $this->getClientName(); |
|
| 275 | - $oAuthClient = false; |
|
| 276 | - if($clientIdentifier !== '') { |
|
| 277 | - $client = $this->clientMapper->getByIdentifier($clientIdentifier); |
|
| 278 | - $clientName = $client->getName(); |
|
| 279 | - $oAuthClient = true; |
|
| 280 | - } |
|
| 274 | + $clientName = $this->getClientName(); |
|
| 275 | + $oAuthClient = false; |
|
| 276 | + if($clientIdentifier !== '') { |
|
| 277 | + $client = $this->clientMapper->getByIdentifier($clientIdentifier); |
|
| 278 | + $clientName = $client->getName(); |
|
| 279 | + $oAuthClient = true; |
|
| 280 | + } |
|
| 281 | 281 | |
| 282 | - $token = $this->random->generate(72, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS); |
|
| 283 | - $uid = $this->userSession->getUser()->getUID(); |
|
| 284 | - $generatedToken = $this->tokenProvider->generateToken( |
|
| 285 | - $token, |
|
| 286 | - $uid, |
|
| 287 | - $loginName, |
|
| 288 | - $password, |
|
| 289 | - $clientName, |
|
| 290 | - IToken::PERMANENT_TOKEN, |
|
| 291 | - IToken::DO_NOT_REMEMBER |
|
| 292 | - ); |
|
| 282 | + $token = $this->random->generate(72, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS); |
|
| 283 | + $uid = $this->userSession->getUser()->getUID(); |
|
| 284 | + $generatedToken = $this->tokenProvider->generateToken( |
|
| 285 | + $token, |
|
| 286 | + $uid, |
|
| 287 | + $loginName, |
|
| 288 | + $password, |
|
| 289 | + $clientName, |
|
| 290 | + IToken::PERMANENT_TOKEN, |
|
| 291 | + IToken::DO_NOT_REMEMBER |
|
| 292 | + ); |
|
| 293 | 293 | |
| 294 | - if($oAuthClient) { |
|
| 295 | - $client = $this->clientMapper->getByIdentifier($clientIdentifier); |
|
| 294 | + if($oAuthClient) { |
|
| 295 | + $client = $this->clientMapper->getByIdentifier($clientIdentifier); |
|
| 296 | 296 | |
| 297 | - $code = $this->random->generate(128); |
|
| 298 | - $accessToken = new AccessToken(); |
|
| 299 | - $accessToken->setClientId($client->getId()); |
|
| 300 | - $accessToken->setEncryptedToken($this->crypto->encrypt($token, $code)); |
|
| 301 | - $accessToken->setHashedCode(hash('sha512', $code)); |
|
| 302 | - $accessToken->setTokenId($generatedToken->getId()); |
|
| 303 | - $this->accessTokenMapper->insert($accessToken); |
|
| 297 | + $code = $this->random->generate(128); |
|
| 298 | + $accessToken = new AccessToken(); |
|
| 299 | + $accessToken->setClientId($client->getId()); |
|
| 300 | + $accessToken->setEncryptedToken($this->crypto->encrypt($token, $code)); |
|
| 301 | + $accessToken->setHashedCode(hash('sha512', $code)); |
|
| 302 | + $accessToken->setTokenId($generatedToken->getId()); |
|
| 303 | + $this->accessTokenMapper->insert($accessToken); |
|
| 304 | 304 | |
| 305 | - $redirectUri = sprintf( |
|
| 306 | - '%s?state=%s&code=%s', |
|
| 307 | - $client->getRedirectUri(), |
|
| 308 | - urlencode($oauthState), |
|
| 309 | - urlencode($code) |
|
| 310 | - ); |
|
| 311 | - } else { |
|
| 312 | - $redirectUri = 'nc://login/server:' . $this->request->getServerHost() . '&user:' . urlencode($loginName) . '&password:' . urlencode($token); |
|
| 313 | - } |
|
| 305 | + $redirectUri = sprintf( |
|
| 306 | + '%s?state=%s&code=%s', |
|
| 307 | + $client->getRedirectUri(), |
|
| 308 | + urlencode($oauthState), |
|
| 309 | + urlencode($code) |
|
| 310 | + ); |
|
| 311 | + } else { |
|
| 312 | + $redirectUri = 'nc://login/server:' . $this->request->getServerHost() . '&user:' . urlencode($loginName) . '&password:' . urlencode($token); |
|
| 313 | + } |
|
| 314 | 314 | |
| 315 | - return new Http\RedirectResponse($redirectUri); |
|
| 316 | - } |
|
| 315 | + return new Http\RedirectResponse($redirectUri); |
|
| 316 | + } |
|
| 317 | 317 | } |
@@ -118,7 +118,7 @@ discard block |
||
| 118 | 118 | */ |
| 119 | 119 | private function isValidToken($stateToken) { |
| 120 | 120 | $currentToken = $this->session->get(self::stateName); |
| 121 | - if(!is_string($stateToken) || !is_string($currentToken)) { |
|
| 121 | + if (!is_string($stateToken) || !is_string($currentToken)) { |
|
| 122 | 122 | return false; |
| 123 | 123 | } |
| 124 | 124 | return hash_equals($currentToken, $stateToken); |
@@ -155,7 +155,7 @@ discard block |
||
| 155 | 155 | |
| 156 | 156 | $clientName = $this->getClientName(); |
| 157 | 157 | $client = null; |
| 158 | - if($clientIdentifier !== '') { |
|
| 158 | + if ($clientIdentifier !== '') { |
|
| 159 | 159 | $client = $this->clientMapper->getByIdentifier($clientIdentifier); |
| 160 | 160 | $clientName = $client->getName(); |
| 161 | 161 | } |
@@ -211,7 +211,7 @@ discard block |
||
| 211 | 211 | public function redirectPage($stateToken = '', |
| 212 | 212 | $clientIdentifier = '', |
| 213 | 213 | $oauthState = '') { |
| 214 | - if(!$this->isValidToken($stateToken)) { |
|
| 214 | + if (!$this->isValidToken($stateToken)) { |
|
| 215 | 215 | return $this->stateTokenForbiddenResponse(); |
| 216 | 216 | } |
| 217 | 217 | |
@@ -242,7 +242,7 @@ discard block |
||
| 242 | 242 | $clientIdentifier = '', |
| 243 | 243 | $state = '', |
| 244 | 244 | $oauthState = '') { |
| 245 | - if(!$this->isValidToken($stateToken)) { |
|
| 245 | + if (!$this->isValidToken($stateToken)) { |
|
| 246 | 246 | $this->session->remove(self::stateName); |
| 247 | 247 | return $this->stateTokenForbiddenResponse(); |
| 248 | 248 | } |
@@ -273,7 +273,7 @@ discard block |
||
| 273 | 273 | |
| 274 | 274 | $clientName = $this->getClientName(); |
| 275 | 275 | $oAuthClient = false; |
| 276 | - if($clientIdentifier !== '') { |
|
| 276 | + if ($clientIdentifier !== '') { |
|
| 277 | 277 | $client = $this->clientMapper->getByIdentifier($clientIdentifier); |
| 278 | 278 | $clientName = $client->getName(); |
| 279 | 279 | $oAuthClient = true; |
@@ -291,7 +291,7 @@ discard block |
||
| 291 | 291 | IToken::DO_NOT_REMEMBER |
| 292 | 292 | ); |
| 293 | 293 | |
| 294 | - if($oAuthClient) { |
|
| 294 | + if ($oAuthClient) { |
|
| 295 | 295 | $client = $this->clientMapper->getByIdentifier($clientIdentifier); |
| 296 | 296 | |
| 297 | 297 | $code = $this->random->generate(128); |
@@ -309,7 +309,7 @@ discard block |
||
| 309 | 309 | urlencode($code) |
| 310 | 310 | ); |
| 311 | 311 | } else { |
| 312 | - $redirectUri = 'nc://login/server:' . $this->request->getServerHost() . '&user:' . urlencode($loginName) . '&password:' . urlencode($token); |
|
| 312 | + $redirectUri = 'nc://login/server:'.$this->request->getServerHost().'&user:'.urlencode($loginName).'&password:'.urlencode($token); |
|
| 313 | 313 | } |
| 314 | 314 | |
| 315 | 315 | return new Http\RedirectResponse($redirectUri); |
@@ -27,39 +27,39 @@ |
||
| 27 | 27 | |
| 28 | 28 | class AccessTokenMapper extends Mapper { |
| 29 | 29 | |
| 30 | - /** |
|
| 31 | - * @param IDBConnection $db |
|
| 32 | - */ |
|
| 33 | - public function __construct(IDBConnection $db) { |
|
| 34 | - parent::__construct($db, 'oauth2_access_tokens'); |
|
| 35 | - } |
|
| 30 | + /** |
|
| 31 | + * @param IDBConnection $db |
|
| 32 | + */ |
|
| 33 | + public function __construct(IDBConnection $db) { |
|
| 34 | + parent::__construct($db, 'oauth2_access_tokens'); |
|
| 35 | + } |
|
| 36 | 36 | |
| 37 | - /** |
|
| 38 | - * @param string $code |
|
| 39 | - * @return AccessToken |
|
| 40 | - */ |
|
| 41 | - public function getByCode($code) { |
|
| 42 | - $qb = $this->db->getQueryBuilder(); |
|
| 43 | - $qb |
|
| 44 | - ->select('*') |
|
| 45 | - ->from($this->tableName) |
|
| 46 | - ->where($qb->expr()->eq('hashed_code', $qb->createNamedParameter(hash('sha512', $code)))); |
|
| 47 | - $result = $qb->execute(); |
|
| 48 | - $row = $result->fetch(); |
|
| 49 | - $result->closeCursor(); |
|
| 50 | - return AccessToken::fromRow($row); |
|
| 51 | - } |
|
| 37 | + /** |
|
| 38 | + * @param string $code |
|
| 39 | + * @return AccessToken |
|
| 40 | + */ |
|
| 41 | + public function getByCode($code) { |
|
| 42 | + $qb = $this->db->getQueryBuilder(); |
|
| 43 | + $qb |
|
| 44 | + ->select('*') |
|
| 45 | + ->from($this->tableName) |
|
| 46 | + ->where($qb->expr()->eq('hashed_code', $qb->createNamedParameter(hash('sha512', $code)))); |
|
| 47 | + $result = $qb->execute(); |
|
| 48 | + $row = $result->fetch(); |
|
| 49 | + $result->closeCursor(); |
|
| 50 | + return AccessToken::fromRow($row); |
|
| 51 | + } |
|
| 52 | 52 | |
| 53 | - /** |
|
| 54 | - * delete all access token from a given client |
|
| 55 | - * |
|
| 56 | - * @param int $id |
|
| 57 | - */ |
|
| 58 | - public function deleteByClientId($id) { |
|
| 59 | - $qb = $this->db->getQueryBuilder(); |
|
| 60 | - $qb |
|
| 61 | - ->delete($this->tableName) |
|
| 62 | - ->where($qb->expr()->eq('client_id', $qb->createNamedParameter($id, IQueryBuilder::PARAM_INT))); |
|
| 63 | - $qb->execute(); |
|
| 64 | - } |
|
| 53 | + /** |
|
| 54 | + * delete all access token from a given client |
|
| 55 | + * |
|
| 56 | + * @param int $id |
|
| 57 | + */ |
|
| 58 | + public function deleteByClientId($id) { |
|
| 59 | + $qb = $this->db->getQueryBuilder(); |
|
| 60 | + $qb |
|
| 61 | + ->delete($this->tableName) |
|
| 62 | + ->where($qb->expr()->eq('client_id', $qb->createNamedParameter($id, IQueryBuilder::PARAM_INT))); |
|
| 63 | + $qb->execute(); |
|
| 64 | + } |
|
| 65 | 65 | } |
@@ -27,64 +27,64 @@ |
||
| 27 | 27 | |
| 28 | 28 | class ClientMapper extends Mapper { |
| 29 | 29 | |
| 30 | - /** |
|
| 31 | - * @param IDBConnection $db |
|
| 32 | - */ |
|
| 33 | - public function __construct(IDBConnection $db) { |
|
| 34 | - parent::__construct($db, 'oauth2_clients'); |
|
| 35 | - } |
|
| 30 | + /** |
|
| 31 | + * @param IDBConnection $db |
|
| 32 | + */ |
|
| 33 | + public function __construct(IDBConnection $db) { |
|
| 34 | + parent::__construct($db, 'oauth2_clients'); |
|
| 35 | + } |
|
| 36 | 36 | |
| 37 | - /** |
|
| 38 | - * @param string $clientIdentifier |
|
| 39 | - * @return Client |
|
| 40 | - */ |
|
| 41 | - public function getByIdentifier($clientIdentifier) { |
|
| 42 | - $qb = $this->db->getQueryBuilder(); |
|
| 43 | - $qb |
|
| 44 | - ->select('*') |
|
| 45 | - ->from($this->tableName) |
|
| 46 | - ->where($qb->expr()->eq('client_identifier', $qb->createNamedParameter($clientIdentifier))); |
|
| 47 | - $result = $qb->execute(); |
|
| 48 | - $row = $result->fetch(); |
|
| 49 | - $result->closeCursor(); |
|
| 37 | + /** |
|
| 38 | + * @param string $clientIdentifier |
|
| 39 | + * @return Client |
|
| 40 | + */ |
|
| 41 | + public function getByIdentifier($clientIdentifier) { |
|
| 42 | + $qb = $this->db->getQueryBuilder(); |
|
| 43 | + $qb |
|
| 44 | + ->select('*') |
|
| 45 | + ->from($this->tableName) |
|
| 46 | + ->where($qb->expr()->eq('client_identifier', $qb->createNamedParameter($clientIdentifier))); |
|
| 47 | + $result = $qb->execute(); |
|
| 48 | + $row = $result->fetch(); |
|
| 49 | + $result->closeCursor(); |
|
| 50 | 50 | |
| 51 | - if (!is_array($row)) { |
|
| 52 | - $row = []; |
|
| 53 | - } |
|
| 51 | + if (!is_array($row)) { |
|
| 52 | + $row = []; |
|
| 53 | + } |
|
| 54 | 54 | |
| 55 | - return Client::fromRow($row); |
|
| 56 | - } |
|
| 55 | + return Client::fromRow($row); |
|
| 56 | + } |
|
| 57 | 57 | |
| 58 | - /** |
|
| 59 | - * @param string $uid internal uid of the client |
|
| 60 | - * @return Client |
|
| 61 | - */ |
|
| 62 | - public function getByUid($uid) { |
|
| 63 | - $qb = $this->db->getQueryBuilder(); |
|
| 64 | - $qb |
|
| 65 | - ->select('*') |
|
| 66 | - ->from($this->tableName) |
|
| 67 | - ->where($qb->expr()->eq('id', $qb->createNamedParameter($uid, IQueryBuilder::PARAM_INT))); |
|
| 68 | - $result = $qb->execute(); |
|
| 69 | - $row = $result->fetch(); |
|
| 70 | - $result->closeCursor(); |
|
| 58 | + /** |
|
| 59 | + * @param string $uid internal uid of the client |
|
| 60 | + * @return Client |
|
| 61 | + */ |
|
| 62 | + public function getByUid($uid) { |
|
| 63 | + $qb = $this->db->getQueryBuilder(); |
|
| 64 | + $qb |
|
| 65 | + ->select('*') |
|
| 66 | + ->from($this->tableName) |
|
| 67 | + ->where($qb->expr()->eq('id', $qb->createNamedParameter($uid, IQueryBuilder::PARAM_INT))); |
|
| 68 | + $result = $qb->execute(); |
|
| 69 | + $row = $result->fetch(); |
|
| 70 | + $result->closeCursor(); |
|
| 71 | 71 | |
| 72 | - if (!is_array($row)) { |
|
| 73 | - $row = []; |
|
| 74 | - } |
|
| 72 | + if (!is_array($row)) { |
|
| 73 | + $row = []; |
|
| 74 | + } |
|
| 75 | 75 | |
| 76 | - return Client::fromRow($row); |
|
| 77 | - } |
|
| 76 | + return Client::fromRow($row); |
|
| 77 | + } |
|
| 78 | 78 | |
| 79 | - /** |
|
| 80 | - * @return Client[] |
|
| 81 | - */ |
|
| 82 | - public function getClients() { |
|
| 83 | - $qb = $this->db->getQueryBuilder(); |
|
| 84 | - $qb |
|
| 85 | - ->select('*') |
|
| 86 | - ->from($this->tableName); |
|
| 79 | + /** |
|
| 80 | + * @return Client[] |
|
| 81 | + */ |
|
| 82 | + public function getClients() { |
|
| 83 | + $qb = $this->db->getQueryBuilder(); |
|
| 84 | + $qb |
|
| 85 | + ->select('*') |
|
| 86 | + ->from($this->tableName); |
|
| 87 | 87 | |
| 88 | - return $this->findEntities($qb->getSQL()); |
|
| 89 | - } |
|
| 88 | + return $this->findEntities($qb->getSQL()); |
|
| 89 | + } |
|
| 90 | 90 | } |
@@ -31,64 +31,64 @@ |
||
| 31 | 31 | use OCP\Security\ISecureRandom; |
| 32 | 32 | |
| 33 | 33 | class SettingsController extends Controller { |
| 34 | - /** @var IURLGenerator */ |
|
| 35 | - private $urlGenerator; |
|
| 36 | - /** @var ClientMapper */ |
|
| 37 | - private $clientMapper; |
|
| 38 | - /** @var ISecureRandom */ |
|
| 39 | - private $secureRandom; |
|
| 40 | - /** @var AccessTokenMapper */ |
|
| 41 | - private $accessTokenMapper; |
|
| 34 | + /** @var IURLGenerator */ |
|
| 35 | + private $urlGenerator; |
|
| 36 | + /** @var ClientMapper */ |
|
| 37 | + private $clientMapper; |
|
| 38 | + /** @var ISecureRandom */ |
|
| 39 | + private $secureRandom; |
|
| 40 | + /** @var AccessTokenMapper */ |
|
| 41 | + private $accessTokenMapper; |
|
| 42 | 42 | |
| 43 | - const validChars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; |
|
| 43 | + const validChars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; |
|
| 44 | 44 | |
| 45 | - /** |
|
| 46 | - * @param string $appName |
|
| 47 | - * @param IRequest $request |
|
| 48 | - * @param IURLGenerator $urlGenerator |
|
| 49 | - * @param ClientMapper $clientMapper |
|
| 50 | - * @param ISecureRandom $secureRandom |
|
| 51 | - * @param AccessTokenMapper $accessTokenMapper |
|
| 52 | - */ |
|
| 53 | - public function __construct($appName, |
|
| 54 | - IRequest $request, |
|
| 55 | - IURLGenerator $urlGenerator, |
|
| 56 | - ClientMapper $clientMapper, |
|
| 57 | - ISecureRandom $secureRandom, |
|
| 58 | - AccessTokenMapper $accessTokenMapper |
|
| 59 | - ) { |
|
| 60 | - parent::__construct($appName, $request); |
|
| 61 | - $this->urlGenerator = $urlGenerator; |
|
| 62 | - $this->secureRandom = $secureRandom; |
|
| 63 | - $this->clientMapper = $clientMapper; |
|
| 64 | - $this->accessTokenMapper = $accessTokenMapper; |
|
| 65 | - } |
|
| 45 | + /** |
|
| 46 | + * @param string $appName |
|
| 47 | + * @param IRequest $request |
|
| 48 | + * @param IURLGenerator $urlGenerator |
|
| 49 | + * @param ClientMapper $clientMapper |
|
| 50 | + * @param ISecureRandom $secureRandom |
|
| 51 | + * @param AccessTokenMapper $accessTokenMapper |
|
| 52 | + */ |
|
| 53 | + public function __construct($appName, |
|
| 54 | + IRequest $request, |
|
| 55 | + IURLGenerator $urlGenerator, |
|
| 56 | + ClientMapper $clientMapper, |
|
| 57 | + ISecureRandom $secureRandom, |
|
| 58 | + AccessTokenMapper $accessTokenMapper |
|
| 59 | + ) { |
|
| 60 | + parent::__construct($appName, $request); |
|
| 61 | + $this->urlGenerator = $urlGenerator; |
|
| 62 | + $this->secureRandom = $secureRandom; |
|
| 63 | + $this->clientMapper = $clientMapper; |
|
| 64 | + $this->accessTokenMapper = $accessTokenMapper; |
|
| 65 | + } |
|
| 66 | 66 | |
| 67 | - /** |
|
| 68 | - * @param string $name |
|
| 69 | - * @param string $redirectUri |
|
| 70 | - * @return RedirectResponse |
|
| 71 | - */ |
|
| 72 | - public function addClient($name, |
|
| 73 | - $redirectUri) { |
|
| 74 | - $client = new Client(); |
|
| 75 | - $client->setName($name); |
|
| 76 | - $client->setRedirectUri($redirectUri); |
|
| 77 | - $client->setSecret($this->secureRandom->generate(64, self::validChars)); |
|
| 78 | - $client->setClientIdentifier($this->secureRandom->generate(64, self::validChars)); |
|
| 79 | - $this->clientMapper->insert($client); |
|
| 80 | - return new RedirectResponse($this->urlGenerator->getAbsoluteURL('/index.php/settings/admin/security')); |
|
| 81 | - } |
|
| 67 | + /** |
|
| 68 | + * @param string $name |
|
| 69 | + * @param string $redirectUri |
|
| 70 | + * @return RedirectResponse |
|
| 71 | + */ |
|
| 72 | + public function addClient($name, |
|
| 73 | + $redirectUri) { |
|
| 74 | + $client = new Client(); |
|
| 75 | + $client->setName($name); |
|
| 76 | + $client->setRedirectUri($redirectUri); |
|
| 77 | + $client->setSecret($this->secureRandom->generate(64, self::validChars)); |
|
| 78 | + $client->setClientIdentifier($this->secureRandom->generate(64, self::validChars)); |
|
| 79 | + $this->clientMapper->insert($client); |
|
| 80 | + return new RedirectResponse($this->urlGenerator->getAbsoluteURL('/index.php/settings/admin/security')); |
|
| 81 | + } |
|
| 82 | 82 | |
| 83 | - /** |
|
| 84 | - * @param int $id |
|
| 85 | - * @return RedirectResponse |
|
| 86 | - */ |
|
| 87 | - public function deleteClient($id) { |
|
| 88 | - $client = $this->clientMapper->getByUid($id); |
|
| 89 | - $this->accessTokenMapper->deleteByClientId($id); |
|
| 90 | - // ToDo delete from oc_authtoken all entries with name=$client->getName() |
|
| 91 | - $this->clientMapper->delete($client); |
|
| 92 | - return new RedirectResponse($this->urlGenerator->getAbsoluteURL('/index.php/settings/admin/security')); |
|
| 93 | - } |
|
| 83 | + /** |
|
| 84 | + * @param int $id |
|
| 85 | + * @return RedirectResponse |
|
| 86 | + */ |
|
| 87 | + public function deleteClient($id) { |
|
| 88 | + $client = $this->clientMapper->getByUid($id); |
|
| 89 | + $this->accessTokenMapper->deleteByClientId($id); |
|
| 90 | + // ToDo delete from oc_authtoken all entries with name=$client->getName() |
|
| 91 | + $this->clientMapper->delete($client); |
|
| 92 | + return new RedirectResponse($this->urlGenerator->getAbsoluteURL('/index.php/settings/admin/security')); |
|
| 93 | + } |
|
| 94 | 94 | } |