nextcloud / server

apps/oauth2/lib/Controller/LoginRedirectorController.php

Indentation +64 added lines, -64 removed lines

@@ -34,73 +34,73 @@
 use OCP\IURLGenerator;
 
 class LoginRedirectorController extends Controller {
-	/** @var IURLGenerator */
-	private $urlGenerator;
-	/** @var ClientMapper */
-	private $clientMapper;
-	/** @var ISession */
-	private $session;
-	/** @var IL10N */
-	private $l;
+    /** @var IURLGenerator */
+    private $urlGenerator;
+    /** @var ClientMapper */
+    private $clientMapper;
+    /** @var ISession */
+    private $session;
+    /** @var IL10N */
+    private $l;
 
-	/**
-	 * @param string $appName
-	 * @param IRequest $request
-	 * @param IURLGenerator $urlGenerator
-	 * @param ClientMapper $clientMapper
-	 * @param ISession $session
-	 * @param IL10N $l
-	 */
-	public function __construct(string $appName,
-								IRequest $request,
-								IURLGenerator $urlGenerator,
-								ClientMapper $clientMapper,
-								ISession $session,
-								IL10N $l) {
-		parent::__construct($appName, $request);
-		$this->urlGenerator = $urlGenerator;
-		$this->clientMapper = $clientMapper;
-		$this->session = $session;
-		$this->l = $l;
-	}
+    /**
+     * @param string $appName
+     * @param IRequest $request
+     * @param IURLGenerator $urlGenerator
+     * @param ClientMapper $clientMapper
+     * @param ISession $session
+     * @param IL10N $l
+     */
+    public function __construct(string $appName,
+                                IRequest $request,
+                                IURLGenerator $urlGenerator,
+                                ClientMapper $clientMapper,
+                                ISession $session,
+                                IL10N $l) {
+        parent::__construct($appName, $request);
+        $this->urlGenerator = $urlGenerator;
+        $this->clientMapper = $clientMapper;
+        $this->session = $session;
+        $this->l = $l;
+    }
 
-	/**
-	 * @PublicPage
-	 * @NoCSRFRequired
-	 * @UseSession
-	 *
-	 * @param string $client_id
-	 * @param string $state
-	 * @param string $response_type
-	 * @return Response
-	 */
-	public function authorize($client_id,
-							  $state,
-							  $response_type): Response {
-		try {
-			$client = $this->clientMapper->getByIdentifier($client_id);
-		} catch (ClientNotFoundException $e) {
-			$response = new TemplateResponse('core', '404', 'guest');
-			$response->setParams([
-				'content' => $this->l->t('Your client is not authorized to connect. Please inform the administrator of your client.'),
-			]);
-			return $response;
-		}
+    /**
+     * @PublicPage
+     * @NoCSRFRequired
+     * @UseSession
+     *
+     * @param string $client_id
+     * @param string $state
+     * @param string $response_type
+     * @return Response
+     */
+    public function authorize($client_id,
+                                $state,
+                                $response_type): Response {
+        try {
+            $client = $this->clientMapper->getByIdentifier($client_id);
+        } catch (ClientNotFoundException $e) {
+            $response = new TemplateResponse('core', '404', 'guest');
+            $response->setParams([
+                'content' => $this->l->t('Your client is not authorized to connect. Please inform the administrator of your client.'),
+            ]);
+            return $response;
+        }
 
-		if ($response_type !== 'code') {
-			//Fail
-			$url = $client->getRedirectUri() . '?error=unsupported_response_type&state=' . $state;
-			return new RedirectResponse($url);
-		}
+        if ($response_type !== 'code') {
+            //Fail
+            $url = $client->getRedirectUri() . '?error=unsupported_response_type&state=' . $state;
+            return new RedirectResponse($url);
+        }
 
-		$this->session->set('oauth.state', $state);
+        $this->session->set('oauth.state', $state);
 
-		$targetUrl = $this->urlGenerator->linkToRouteAbsolute(
-			'core.ClientFlowLogin.showAuthPickerPage',
-			[
-				'clientIdentifier' => $client->getClientIdentifier(),
-			]
-		);
-		return new RedirectResponse($targetUrl);
-	}
+        $targetUrl = $this->urlGenerator->linkToRouteAbsolute(
+            'core.ClientFlowLogin.showAuthPickerPage',
+            [
+                'clientIdentifier' => $client->getClientIdentifier(),
+            ]
+        );
+        return new RedirectResponse($targetUrl);
+    }
 }

apps/oauth2/lib/Controller/OauthApiController.php

Indentation +133 added lines, -133 removed lines

@@ -39,137 +39,137 @@
 use OCP\Security\ISecureRandom;
 
 class OauthApiController extends Controller {
-	/** @var AccessTokenMapper */
-	private $accessTokenMapper;
-	/** @var ClientMapper */
-	private $clientMapper;
-	/** @var ICrypto */
-	private $crypto;
-	/** @var TokenProvider */
-	private $tokenProvider;
-	/** @var ISecureRandom */
-	private $secureRandom;
-	/** @var ITimeFactory */
-	private $time;
-	/** @var Throttler */
-	private $throttler;
-
-	public function __construct(string $appName,
-								IRequest $request,
-								ICrypto $crypto,
-								AccessTokenMapper $accessTokenMapper,
-								ClientMapper $clientMapper,
-								TokenProvider $tokenProvider,
-								ISecureRandom $secureRandom,
-								ITimeFactory $time,
-								Throttler $throttler) {
-		parent::__construct($appName, $request);
-		$this->crypto = $crypto;
-		$this->accessTokenMapper = $accessTokenMapper;
-		$this->clientMapper = $clientMapper;
-		$this->tokenProvider = $tokenProvider;
-		$this->secureRandom = $secureRandom;
-		$this->time = $time;
-		$this->throttler = $throttler;
-	}
-
-	/**
-	 * @PublicPage
-	 * @NoCSRFRequired
-	 *
-	 * @param string $grant_type
-	 * @param string $code
-	 * @param string $refresh_token
-	 * @param string $client_id
-	 * @param string $client_secret
-	 * @return JSONResponse
-	 */
-	public function getToken($grant_type, $code, $refresh_token, $client_id, $client_secret): JSONResponse {
-
-		// We only handle two types
-		if ($grant_type !== 'authorization_code' && $grant_type !== 'refresh_token') {
-			return new JSONResponse([
-				'error' => 'invalid_grant',
-			], Http::STATUS_BAD_REQUEST);
-		}
-
-		// We handle the initial and refresh tokens the same way
-		if ($grant_type === 'refresh_token' ) {
-			$code = $refresh_token;
-		}
-
-		try {
-			$accessToken = $this->accessTokenMapper->getByCode($code);
-		} catch (AccessTokenNotFoundException $e) {
-			return new JSONResponse([
-				'error' => 'invalid_request',
-			], Http::STATUS_BAD_REQUEST);
-		}
-
-		try {
-			$client = $this->clientMapper->getByUid($accessToken->getClientId());
-		} catch (ClientNotFoundException $e) {
-			return new JSONResponse([
-				'error' => 'invalid_request',
-			], Http::STATUS_BAD_REQUEST);
-		}
-
-		if (isset($this->request->server['PHP_AUTH_USER'])) {
-			$client_id = $this->request->server['PHP_AUTH_USER'];
-			$client_secret = $this->request->server['PHP_AUTH_PW'];
-		}
-
-		// The client id and secret must match. Else we don't provide an access token!
-		if ($client->getClientIdentifier() !== $client_id || $client->getSecret() !== $client_secret) {
-			return new JSONResponse([
-				'error' => 'invalid_client',
-			], Http::STATUS_BAD_REQUEST);
-		}
-
-		$decryptedToken = $this->crypto->decrypt($accessToken->getEncryptedToken(), $code);
-
-		// Obtain the appToken assoicated
-		try {
-			$appToken = $this->tokenProvider->getTokenById($accessToken->getTokenId());
-		} catch (ExpiredTokenException $e) {
-			$appToken = $e->getToken();
-		} catch (InvalidTokenException $e) {
-			//We can't do anything...
-			$this->accessTokenMapper->delete($accessToken);
-			return new JSONResponse([
-				'error' => 'invalid_request',
-			], Http::STATUS_BAD_REQUEST);
-		}
-
-		// Rotate the apptoken (so the old one becomes invalid basically)
-		$newToken = $this->secureRandom->generate(72, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS);
-
-		$appToken = $this->tokenProvider->rotate(
-			$appToken,
-			$decryptedToken,
-			$newToken
-		);
-
-		// Expiration is in 1 hour again
-		$appToken->setExpires($this->time->getTime() + 3600);
-		$this->tokenProvider->updateToken($appToken);
-
-		// Generate a new refresh token and encrypt the new apptoken in the DB
-		$newCode = $this->secureRandom->generate(128, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS);
-		$accessToken->setHashedCode(hash('sha512', $newCode));
-		$accessToken->setEncryptedToken($this->crypto->encrypt($newToken, $newCode));
-		$this->accessTokenMapper->update($accessToken);
-
-		$this->throttler->resetDelay($this->request->getRemoteAddress(), 'login', ['user' => $appToken->getUID()]);
-
-		return new JSONResponse(
-			[
-				'access_token' => $newToken,
-				'token_type' => 'Bearer',
-				'expires_in' => 3600,
-				'refresh_token' => $newCode,
-				'user_id' => $appToken->getUID(),
-			]
-		);
-	}
+    /** @var AccessTokenMapper */
+    private $accessTokenMapper;
+    /** @var ClientMapper */
+    private $clientMapper;
+    /** @var ICrypto */
+    private $crypto;
+    /** @var TokenProvider */
+    private $tokenProvider;
+    /** @var ISecureRandom */
+    private $secureRandom;
+    /** @var ITimeFactory */
+    private $time;
+    /** @var Throttler */
+    private $throttler;
+
+    public function __construct(string $appName,
+                                IRequest $request,
+                                ICrypto $crypto,
+                                AccessTokenMapper $accessTokenMapper,
+                                ClientMapper $clientMapper,
+                                TokenProvider $tokenProvider,
+                                ISecureRandom $secureRandom,
+                                ITimeFactory $time,
+                                Throttler $throttler) {
+        parent::__construct($appName, $request);
+        $this->crypto = $crypto;
+        $this->accessTokenMapper = $accessTokenMapper;
+        $this->clientMapper = $clientMapper;
+        $this->tokenProvider = $tokenProvider;
+        $this->secureRandom = $secureRandom;
+        $this->time = $time;
+        $this->throttler = $throttler;
+    }
+
+    /**
+     * @PublicPage
+     * @NoCSRFRequired
+     *
+     * @param string $grant_type
+     * @param string $code
+     * @param string $refresh_token
+     * @param string $client_id
+     * @param string $client_secret
+     * @return JSONResponse
+     */
+    public function getToken($grant_type, $code, $refresh_token, $client_id, $client_secret): JSONResponse {
+
+        // We only handle two types
+        if ($grant_type !== 'authorization_code' && $grant_type !== 'refresh_token') {
+            return new JSONResponse([
+                'error' => 'invalid_grant',
+            ], Http::STATUS_BAD_REQUEST);
+        }
+
+        // We handle the initial and refresh tokens the same way
+        if ($grant_type === 'refresh_token' ) {
+            $code = $refresh_token;
+        }
+
+        try {
+            $accessToken = $this->accessTokenMapper->getByCode($code);
+        } catch (AccessTokenNotFoundException $e) {
+            return new JSONResponse([
+                'error' => 'invalid_request',
+            ], Http::STATUS_BAD_REQUEST);
+        }
+
+        try {
+            $client = $this->clientMapper->getByUid($accessToken->getClientId());
+        } catch (ClientNotFoundException $e) {
+            return new JSONResponse([
+                'error' => 'invalid_request',
+            ], Http::STATUS_BAD_REQUEST);
+        }
+
+        if (isset($this->request->server['PHP_AUTH_USER'])) {
+            $client_id = $this->request->server['PHP_AUTH_USER'];
+            $client_secret = $this->request->server['PHP_AUTH_PW'];
+        }
+
+        // The client id and secret must match. Else we don't provide an access token!
+        if ($client->getClientIdentifier() !== $client_id || $client->getSecret() !== $client_secret) {
+            return new JSONResponse([
+                'error' => 'invalid_client',
+            ], Http::STATUS_BAD_REQUEST);
+        }
+
+        $decryptedToken = $this->crypto->decrypt($accessToken->getEncryptedToken(), $code);
+
+        // Obtain the appToken assoicated
+        try {
+            $appToken = $this->tokenProvider->getTokenById($accessToken->getTokenId());
+        } catch (ExpiredTokenException $e) {
+            $appToken = $e->getToken();
+        } catch (InvalidTokenException $e) {
+            //We can't do anything...
+            $this->accessTokenMapper->delete($accessToken);
+            return new JSONResponse([
+                'error' => 'invalid_request',
+            ], Http::STATUS_BAD_REQUEST);
+        }
+
+        // Rotate the apptoken (so the old one becomes invalid basically)
+        $newToken = $this->secureRandom->generate(72, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS);
+
+        $appToken = $this->tokenProvider->rotate(
+            $appToken,
+            $decryptedToken,
+            $newToken
+        );
+
+        // Expiration is in 1 hour again
+        $appToken->setExpires($this->time->getTime() + 3600);
+        $this->tokenProvider->updateToken($appToken);
+
+        // Generate a new refresh token and encrypt the new apptoken in the DB
+        $newCode = $this->secureRandom->generate(128, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS);
+        $accessToken->setHashedCode(hash('sha512', $newCode));
+        $accessToken->setEncryptedToken($this->crypto->encrypt($newToken, $newCode));
+        $this->accessTokenMapper->update($accessToken);
+
+        $this->throttler->resetDelay($this->request->getRemoteAddress(), 'login', ['user' => $appToken->getUID()]);
+
+        return new JSONResponse(
+            [
+                'access_token' => $newToken,
+                'token_type' => 'Bearer',
+                'expires_in' => 3600,
+                'refresh_token' => $newCode,
+                'user_id' => $appToken->getUID(),
+            ]
+        );
+    }
 }

apps/oauth2/lib/Migration/SetTokenExpiration.php

Indentation +33 added lines, -33 removed lines

@@ -34,45 +34,45 @@
 
 class SetTokenExpiration implements IRepairStep {
 
-	/** @var IDBConnection */
-	private $connection;
+    /** @var IDBConnection */
+    private $connection;
 
-	/** @var ITimeFactory */
-	private $time;
+    /** @var ITimeFactory */
+    private $time;
 
-	/** @var TokenProvider */
-	private $tokenProvider;
+    /** @var TokenProvider */
+    private $tokenProvider;
 
-	public function __construct(IDBConnection $connection,
-								ITimeFactory $timeFactory,
-								TokenProvider $tokenProvider) {
-		$this->connection = $connection;
-		$this->time = $timeFactory;
-		$this->tokenProvider = $tokenProvider;
-	}
+    public function __construct(IDBConnection $connection,
+                                ITimeFactory $timeFactory,
+                                TokenProvider $tokenProvider) {
+        $this->connection = $connection;
+        $this->time = $timeFactory;
+        $this->tokenProvider = $tokenProvider;
+    }
 
-	public function getName(): string {
-		return 'Update OAuth token expiration times';
-	}
+    public function getName(): string {
+        return 'Update OAuth token expiration times';
+    }
 
-	public function run(IOutput $output) {
-		$qb = $this->connection->getQueryBuilder();
-		$qb->select('*')
-			->from('oauth2_access_tokens');
+    public function run(IOutput $output) {
+        $qb = $this->connection->getQueryBuilder();
+        $qb->select('*')
+            ->from('oauth2_access_tokens');
 
-		$cursor = $qb->execute();
+        $cursor = $qb->execute();
 
-		while($row = $cursor->fetch()) {
-			$token = AccessToken::fromRow($row);
-			try {
-				$appToken = $this->tokenProvider->getTokenById($token->getTokenId());
-				$appToken->setExpires($this->time->getTime() + 3600);
-				$this->tokenProvider->updateToken($appToken);
-			} catch (InvalidTokenException $e) {
-				//Skip this token
-			}
-		}
-		$cursor->closeCursor();
-	}
+        while($row = $cursor->fetch()) {
+            $token = AccessToken::fromRow($row);
+            try {
+                $appToken = $this->tokenProvider->getTokenById($token->getTokenId());
+                $appToken->setExpires($this->time->getTime() + 3600);
+                $this->tokenProvider->updateToken($appToken);
+            } catch (InvalidTokenException $e) {
+                //Skip this token
+            }
+        }
+        $cursor->closeCursor();
+    }
 
 }