owncloud / security

tests/bootstrap.php

Spacing +2 added lines, -2 removed lines

@@ -23,9 +23,9 @@
 }

 require_once __DIR__.'/../../../lib/base.php';

 

-OC::$composerAutoloader->addPsr4('Test\\', OC::$SERVERROOT . '/tests/lib', true);

+OC::$composerAutoloader->addPsr4('Test\\', OC::$SERVERROOT.'/tests/lib', true);

 

-if(!class_exists('PHPUnit_Framework_TestCase')) {

+if (!class_exists('PHPUnit_Framework_TestCase')) {

     require_once('PHPUnit/Autoload.php');

 }

 

lib/PasswordValidator.php

Spacing +7 added lines, -7 removed lines

@@ -22,7 +22,7 @@ 
 use OC\HintException;

 use OCP\IL10N;

 

-class PasswordValidator  {

+class PasswordValidator {

 

 	/** @var SecurityConfig */

 	protected $config;

@@ -62,8 +62,8 @@ 
 	 */

 	public function checkPasswordLength($password) {

 		$minPassLength = $this->config->getMinPasswordLength();

-		if(strlen($password) < $minPassLength) {

-			$message = 'Password needs to be at least ' . $minPassLength . ' characters long';

+		if (strlen($password) < $minPassLength) {

+			$message = 'Password needs to be at least '.$minPassLength.' characters long';

 			$hint = $this->l->t(

 				'Password needs to be at least %s characters long', [$minPassLength]

 			);

@@ -78,8 +78,8 @@ 
 	 * @throws HintException

 	 */

 	public function checkUpperLowerCase($password) {

-		$enforceUpperLowerCase= $this->config->getIsUpperLowerCaseEnforced();

-		if($enforceUpperLowerCase === true && $this->hasUpperAndLowerCase($password) === false) {

+		$enforceUpperLowerCase = $this->config->getIsUpperLowerCaseEnforced();

+		if ($enforceUpperLowerCase === true && $this->hasUpperAndLowerCase($password) === false) {

 			$message = 'Password should contain at least one upper and one lower case character.';

 			$hint = $this->l->t(

 				'Password should contain at least one upper and one lower case character.'

@@ -96,7 +96,7 @@ 
 	 */

 	public function checkNumericCharacters($password) {

 		$enforceNumericCharacters = $this->config->getIsNumericCharactersEnforced();

-		if($enforceNumericCharacters === true && $this->hasNumericalCharacters($password) === false) {

+		if ($enforceNumericCharacters === true && $this->hasNumericalCharacters($password) === false) {

 			$message = 'Password should contain at least one numerical character.';

 			$hint = $this->l->t(

 				'Password should contain at least one numerical character.'

@@ -113,7 +113,7 @@ 
 	 */

 	public function checkSpecialCharacters($password) {

 		$enforceSpecialCharacters = $this->config->getIsSpecialCharactersEnforced();

-		if($enforceSpecialCharacters === true && $this->hasSpecialCharacter($password) === false) {

+		if ($enforceSpecialCharacters === true && $this->hasSpecialCharacter($password) === false) {

 			$message = 'Password should contain at least one special character.';

 			$hint = $this->l->t(

 				'Password should contain at least one special character.'

lib/AppInfo/Application.php

Spacing +1 added lines, -1 removed lines

@@ -31,7 +31,7 @@
 

 class Application extends App {

 

-    public function __construct(array $urlParams=array()){

+    public function __construct(array $urlParams = array()) {

         parent::__construct('security', $urlParams);

 

         $container = $this->getContainer();

lib/Hooks.php

Spacing +1 added lines, -1 removed lines

@@ -55,7 +55,7 @@
      * @param PasswordValidator $passValidator
      * @param EventDispatcherInterface $dispatcher
      */
-    public function __construct($userManager, $throttle, $request, $passValidator, $dispatcher){
+    public function __construct($userManager, $throttle, $request, $passValidator, $dispatcher) {
         $this->userManager = $userManager;
         $this->throttle = $throttle;
         $this->request = $request;

templates/settings-personal.php

Spacing +5 added lines, -5 removed lines

@@ -25,15 +25,15 @@
 ?>

 <div id="password-policies" class="hidden">

 	<?php print_unescaped(

-		"<p>". $l->t('Passwords must:'). "</p>");?>

+		"<p>".$l->t('Passwords must:')."</p>"); ?>

 	<ul class="pass-info">

 		<?php print_unescaped(

-			"<li class='pass-info-element'>". $l->t('be at least %s characters long ', $_['minPasswordLength']). "</li>");?>

+			"<li class='pass-info-element'>".$l->t('be at least %s characters long ', $_['minPasswordLength'])."</li>"); ?>

 		<?php if ($_['isUpperLowerCaseEnforced']) print_unescaped(

-			"<li class='pass-info-element'>". $l->t('contain at least one uppercase letter and at least one lowercase letter '). "</li>");?>

+			"<li class='pass-info-element'>".$l->t('contain at least one uppercase letter and at least one lowercase letter ')."</li>"); ?>

 		<?php if ($_['isNumericalCharsEnforced']) print_unescaped(

-			"<li class='pass-info-element'>". $l->t('contain at least one numerical character'). "</li>");?>

+			"<li class='pass-info-element'>".$l->t('contain at least one numerical character')."</li>"); ?>

 		<?php if ($_['isSpecialCharsEnforced']) print_unescaped(

-			"<li class='pass-info-element'>". $l->t('contain at least one special character'). "</li>");?>

+			"<li class='pass-info-element'>".$l->t('contain at least one special character')."</li>"); ?>

 	</ul>

 </div>

templates/settings-admin.php

Spacing +5 added lines, -5 removed lines

@@ -32,7 +32,7 @@ 
         <input type="number" id="security-bfp-fail-tolerance"  value="<?php p($_['bruteForceProtectionFailTolerance']) ?>"><br>

         <label for="security-bfp-ban-period"><?php p($l->t('Ban for how many seconds?')) ?></label><br>

         <input type="number" id="security-bfp-ban-period" value="<?php p($_['bruteForceProtectionBanPeriod']) ?>"><br>

-        <button id="save-bfp-settings" class="save"><?php p($l->t('Save settings'));?></button>

+        <button id="save-bfp-settings" class="save"><?php p($l->t('Save settings')); ?></button>

 	</div>

 </div>

 <div id="security-password-policy" class="section">

@@ -40,22 +40,22 @@ 
     <div>

 		<label for="security-min-password-length"><?php p($l->t('Determine minimum password length')) ?></label>

 		<input type="number" id="security-min-password-length" min="6" value="<?php p($_['minPasswordLength']) ?>">

-        <button id="save-pass-length" class="save"><?php p($l->t('Save length'));?></button>

+        <button id="save-pass-length" class="save"><?php p($l->t('Save length')); ?></button>

         <span id="security-min-password-length-message" class="msg"></span>

 	</div>

 	<div>

 		<input type="checkbox" class="checkbox" id="security-enforce-upper-lower-case"

-			<?php if ($_['isUpperLowerCaseEnforced']) p("checked");?> >

+			<?php if ($_['isUpperLowerCaseEnforced']) p("checked"); ?> >

 		<label for="security-enforce-upper-lower-case"><?php p($l->t('Enforce at least one upper and one lower case character on passwords')) ?></label>

 	</div>

 	<div>

 		<input type="checkbox" class="checkbox" id="security-enforce-numerical-characters"

-			<?php if ($_['isNumericalCharsEnforced']) p("checked");?> >

+			<?php if ($_['isNumericalCharsEnforced']) p("checked"); ?> >

 		<label for="security-enforce-numerical-characters"><?php p($l->t('Enforce at least one numerical characters on passwords')) ?></label>

 	</div>

 	<div>

 		<input type="checkbox" class="checkbox" id="security-enforce-special-characters"

-			<?php if ($_['isSpecialCharsEnforced']) p("checked");?> >

+			<?php if ($_['isSpecialCharsEnforced']) p("checked"); ?> >

 		<label for="security-enforce-special-characters"><?php p($l->t('Enforce at least one special characters on passwords')) ?></label>

 	</div>

 </div>
\ No newline at end of file

lib/Throttle.php

Spacing +4 added lines, -4 removed lines

@@ -79,14 +79,14 @@
      * @param string $ip

      * @throws LoginException

      */

-    public function applyBruteForcePolicy($uid ,$ip) {

+    public function applyBruteForcePolicy($uid, $ip) {

         $banPeriod = $this->config->getBruteForceProtectionBanPeriod();

-        $banUntil = $this->dbConnection->getLastFailedLoginAttemptTimeForIp($ip)+$banPeriod;

-        if($this->dbConnection->getSuspiciousActivityCountForUidIpCombination($uid, $ip) >=

+        $banUntil = $this->dbConnection->getLastFailedLoginAttemptTimeForIp($ip) + $banPeriod;

+        if ($this->dbConnection->getSuspiciousActivityCountForUidIpCombination($uid, $ip) >=

             $this->config->getBruteForceProtectionFailTolerance() &&

             $banUntil > $this->timeFactory->getTime()) {

             throw new LoginException($this->l->t("Too many failed login attempts. Try again in %s minutes.",

-                ceil($banPeriod/60))

+                ceil($banPeriod / 60))

             );

         }

     }

tests/ThrottleTest.php

Spacing +2 added lines, -2 removed lines

@@ -88,7 +88,7 @@ 
             ->will($this->returnValue($lastAttempt));

         $this->dbServiceMock->expects($this->once())

             ->method('getSuspiciousActivityCountForUidIpCombination')

-            ->with('test','192.168.1.1')

+            ->with('test', '192.168.1.1')

             ->will($this->returnValue($attemptCount));

         $this->configMock->expects($this->once())

             ->method('getBruteForceProtectionBanPeriod')

@@ -100,7 +100,7 @@ 
             ->method('getTime')

             ->will($this->returnValue($time));

         $this->expectException('OC\User\LoginException');

-        $this->throttle->applyBruteForcePolicy('test','192.168.1.1');

+        $this->throttle->applyBruteForcePolicy('test', '192.168.1.1');

     }

     public function bruteForceTestData() {

         return [

lib/Db/DbService.php

Spacing +8 added lines, -8 removed lines

@@ -62,7 +62,7 @@ 
     /**

      * @param string $uid

      */

-    public function addFailedLoginAttempt($uid, $ip){

+    public function addFailedLoginAttempt($uid, $ip) {

         $builder = $this->connection->getQueryBuilder();

         $builder->insert('failed_login_attempts')

             ->setValue('ip', $builder->createNamedParameter($ip))

@@ -78,7 +78,7 @@ 
      */

     public function getSuspiciousActivityCountForUidIpCombination($uid, $ip) {

         $builder = $this->connection->getQueryBuilder();

-        $thresholdTime = (new \DateTime())->modify("-". $this->config->getBruteForceProtectionTimeThreshold() . "second")->getTimestamp();

+        $thresholdTime = (new \DateTime())->modify("-".$this->config->getBruteForceProtectionTimeThreshold()."second")->getTimestamp();

         $attempts = $builder->selectAlias($builder->createFunction('COUNT(*)'), 'count')

             ->from('failed_login_attempts')

             ->where($builder->expr()->gt('attempted_at', $builder->createNamedParameter($thresholdTime)))

@@ -95,7 +95,7 @@ 
      */

     public function getSuspiciousActivityCountForUid($uid) {

         $builder = $this->connection->getQueryBuilder();

-        $thresholdTime = (new \DateTime())->modify("-". $this->config->getBruteForceProtectionTimeThreshold() . "second")->getTimestamp();

+        $thresholdTime = (new \DateTime())->modify("-".$this->config->getBruteForceProtectionTimeThreshold()."second")->getTimestamp();

         $attempts = $builder->selectAlias($builder->createFunction('COUNT(*)'), 'count')

             ->from('failed_login_attempts')

             ->where($builder->expr()->gt('attempted_at', $builder->createNamedParameter($thresholdTime)))

@@ -111,7 +111,7 @@ 
      */

     public function getSuspiciousActivityCountForIp($ip) {

         $builder = $this->connection->getQueryBuilder();

-        $thresholdTime = (new \DateTime())->modify("-". $this->config->getBruteForceProtectionTimeThreshold() . "second")->getTimestamp();

+        $thresholdTime = (new \DateTime())->modify("-".$this->config->getBruteForceProtectionTimeThreshold()."second")->getTimestamp();

         $attempts = $builder->selectAlias($builder->createFunction('COUNT(*)'), 'count')

             ->from('failed_login_attempts')

             ->where($builder->expr()->gt('attempted_at', $builder->createNamedParameter($thresholdTime)))

@@ -127,12 +127,12 @@ 
      */

     public function getLastFailedLoginAttemptTimeForIp($ip) {

         $builder = $this->connection->getQueryBuilder();

-        $thresholdTime = (new \DateTime())->modify("-". $this->config->getBruteForceProtectionTimeThreshold() . "second")->getTimestamp();

+        $thresholdTime = (new \DateTime())->modify("-".$this->config->getBruteForceProtectionTimeThreshold()."second")->getTimestamp();

         $lastAttempt = $builder->select('attempted_at')

             ->from('failed_login_attempts')

             ->where($builder->expr()->gt('attempted_at', $builder->createNamedParameter($thresholdTime)))

             ->andWhere($builder->expr()->eq('ip', $builder->createNamedParameter($ip)))

-            ->orderBy('attempted_at','DESC')

+            ->orderBy('attempted_at', 'DESC')

             ->setMaxResults(1)

             ->execute()

             ->fetch();

@@ -145,7 +145,7 @@ 
     public function deleteSuspiciousAttemptsForIp($ip) {

         $builder = $this->connection->getQueryBuilder();

         $builder->delete('failed_login_attempts')

-            ->where($builder->expr()->eq('ip',$builder->createNamedParameter($ip)))

+            ->where($builder->expr()->eq('ip', $builder->createNamedParameter($ip)))

             ->execute();

     }

 

@@ -156,7 +156,7 @@ 
     public function deleteSuspiciousAttemptsForUidIpCombination($uid, $ip) {

         $builder = $this->connection->getQueryBuilder();

         $builder->delete('failed_login_attempts')

-            ->where($builder->expr()->eq('uid',$builder->createNamedParameter($uid)))

+            ->where($builder->expr()->eq('uid', $builder->createNamedParameter($uid)))

             ->andWhere($builder->expr()->eq('ip', $builder->createNamedParameter($ip)))

             ->execute();

     }