11&&(e=c.pmNames[0]),d=d.replace(/(?:HH?|hh?|mm?|ss?|[tT]{1,2}|[zZ]|[lc]|'.*?')/g,function(a){switch(a){case"HH":return("0"+f).slice(-2);case"H":return f;case"hh":return("0"+convert24to12(f)).slice(-2);case"h":return convert24to12(f);case"mm":return("0"+b.minute).slice(-2);case"m":return b.minute;case"ss":return("0"+b.second).slice(-2);case"s":return b.second;case"l":return("00"+b.millisec).slice(-3);case"c":return("00"+b.microsec).slice(-3);case"z":return $.timepicker.timezoneOffsetString(null===b.timezone?c.timezone:b.timezone,!1);case"Z":return $.timepicker.timezoneOffsetString(null===b.timezone?c.timezone:b.timezone,!0);case"T":return e.charAt(0).toUpperCase();case"TT":return e.toUpperCase();case"t":return e.charAt(0).toLowerCase();case"tt":return e.toLowerCase();default:return a.replace(/'/g,"")}})},$.datepicker._base_selectDate=$.datepicker._selectDate,$.datepicker._selectDate=function(a,b){var c,d=this._getInst($(a)[0]),e=this._get(d,"timepicker");e&&d.settings.showTimepicker?(e._limitMinMaxDateTime(d,!0),c=d.inline,d.inline=d.stay_open=!0,this._base_selectDate(a,b),d.inline=c,d.stay_open=!1,this._notifyChange(d),this._updateDatepicker(d)):this._base_selectDate(a,b)},$.datepicker._base_updateDatepicker=$.datepicker._updateDatepicker,$.datepicker._updateDatepicker=function(a){var b=a.input[0];if(!($.datepicker._curInst&&$.datepicker._curInst!==a&&$.datepicker._datepickerShowing&&$.datepicker._lastInput!==b||"boolean"==typeof a.stay_open&&a.stay_open!==!1)){this._base_updateDatepicker(a);var c=this._get(a,"timepicker");c&&c._addTimePicker(a)}},$.datepicker._base_doKeyPress=$.datepicker._doKeyPress,$.datepicker._doKeyPress=function(a){var b=$.datepicker._getInst(a.target),c=$.datepicker._get(b,"timepicker");if(c&&$.datepicker._get(b,"constrainInput")){var d=c.support.ampm,e=null!==c._defaults.showTimezone?c._defaults.showTimezone:c.support.timezone,f=$.datepicker._possibleChars($.datepicker._get(b,"dateFormat")),g=c._defaults.timeFormat.toString().replace(/[hms]/g,"").replace(/TT/g,d?"APM":"").replace(/Tt/g,d?"AaPpMm":"").replace(/tT/g,d?"AaPpMm":"").replace(/T/g,d?"AP":"").replace(/tt/g,d?"apm":"").replace(/t/g,d?"ap":"")+" "+c._defaults.separator+c._defaults.timeSuffix+(e?c._defaults.timezoneList.join(""):"")+c._defaults.amNames.join("")+c._defaults.pmNames.join("")+f,h=String.fromCharCode(void 0===a.charCode?a.keyCode:a.charCode);return a.ctrlKey||" ">h||!f||g.indexOf(h)>-1}return $.datepicker._base_doKeyPress(a)},$.datepicker._base_updateAlternate=$.datepicker._updateAlternate,$.datepicker._updateAlternate=function(a){var b=this._get(a,"timepicker");if(b){var c=b._defaults.altField;if(c){var d=(b._defaults.altFormat||b._defaults.dateFormat,this._getDate(a)),e=$.datepicker._getFormatConfig(a),f="",g=b._defaults.altSeparator?b._defaults.altSeparator:b._defaults.separator,h=b._defaults.altTimeSuffix?b._defaults.altTimeSuffix:b._defaults.timeSuffix,i=null!==b._defaults.altTimeFormat?b._defaults.altTimeFormat:b._defaults.timeFormat;f+=$.datepicker.formatTime(i,b,b._defaults)+h,b._defaults.timeOnly||b._defaults.altFieldTimeOnly||null===d||(f=b._defaults.altFormat?$.datepicker.formatDate(b._defaults.altFormat,d,e)+g+f:b.formattedDate+g+f),$(c).val(a.input.val()?f:"")}}else $.datepicker._base_updateAlternate(a)},$.datepicker._base_doKeyUp=$.datepicker._doKeyUp,$.datepicker._doKeyUp=function(a){var b=$.datepicker._getInst(a.target),c=$.datepicker._get(b,"timepicker");
+if(c&&c._defaults.timeOnly&&b.input.val()!==b.lastVal)try{$.datepicker._updateDatepicker(b)}catch(d){$.timepicker.log(d)}return $.datepicker._base_doKeyUp(a)},$.datepicker._base_gotoToday=$.datepicker._gotoToday,$.datepicker._gotoToday=function(a){var b=this._getInst($(a)[0]);this._base_gotoToday(a);var c=this._get(b,"timepicker");if(c){var d=$.timepicker.timezoneOffsetNumber(c.timezone),e=new Date;e.setMinutes(e.getMinutes()+e.getTimezoneOffset()+parseInt(d,10)),this._setTime(b,e),this._setDate(b,e),c._onSelectHandler()}},$.datepicker._disableTimepickerDatepicker=function(a){var b=this._getInst(a);if(b){var c=this._get(b,"timepicker");$(a).datepicker("getDate"),c&&(b.settings.showTimepicker=!1,c._defaults.showTimepicker=!1,c._updateDateTime(b))}},$.datepicker._enableTimepickerDatepicker=function(a){var b=this._getInst(a);if(b){var c=this._get(b,"timepicker");$(a).datepicker("getDate"),c&&(b.settings.showTimepicker=!0,c._defaults.showTimepicker=!0,c._addTimePicker(b),c._updateDateTime(b))}},$.datepicker._setTime=function(a,b){var c=this._get(a,"timepicker");if(c){var d=c._defaults;c.hour=b?b.getHours():d.hour,c.minute=b?b.getMinutes():d.minute,c.second=b?b.getSeconds():d.second,c.millisec=b?b.getMilliseconds():d.millisec,c.microsec=b?b.getMicroseconds():d.microsec,c._limitMinMaxDateTime(a,!0),c._onTimeChange(),c._updateDateTime(a)}},$.datepicker._setTimeDatepicker=function(a,b,c){var d=this._getInst(a);if(d){var e=this._get(d,"timepicker");if(e){this._setDateFromField(d);var f;b&&("string"==typeof b?(e._parseTime(b,c),f=new Date,f.setHours(e.hour,e.minute,e.second,e.millisec),f.setMicroseconds(e.microsec)):(f=new Date(b.getTime()),f.setMicroseconds(b.getMicroseconds())),"Invalid Date"===f.toString()&&(f=void 0),this._setTime(d,f))}}},$.datepicker._base_setDateDatepicker=$.datepicker._setDateDatepicker,$.datepicker._setDateDatepicker=function(a,b){var c=this._getInst(a),d=b;if(c){"string"==typeof b&&(d=new Date(b),d.getTime()||(this._base_setDateDatepicker.apply(this,arguments),d=$(a).datepicker("getDate")));var e,f=this._get(c,"timepicker");d instanceof Date?(e=new Date(d.getTime()),e.setMicroseconds(d.getMicroseconds())):e=d,f&&e&&(f.support.timezone||null!==f._defaults.timezone||(f.timezone=-1*e.getTimezoneOffset()),d=$.timepicker.timezoneAdjust(d,$.timepicker.timezoneOffsetString(-d.getTimezoneOffset()),f.timezone),e=$.timepicker.timezoneAdjust(e,$.timepicker.timezoneOffsetString(-e.getTimezoneOffset()),f.timezone)),this._updateDatepicker(c),this._base_setDateDatepicker.apply(this,arguments),this._setTimeDatepicker(a,e,!0)}},$.datepicker._base_getDateDatepicker=$.datepicker._getDateDatepicker,$.datepicker._getDateDatepicker=function(a,b){var c=this._getInst(a);if(c){var d=this._get(c,"timepicker");if(d){void 0===c.lastVal&&this._setDateFromField(c,b);var e=this._getDate(c),f=null;return f=d.$altInput&&d._defaults.altFieldTimeOnly?d.$input.val()+" "+d.$altInput.val():"INPUT"!==d.$input.get(0).tagName&&d.$altInput?d.$altInput.val():d.$input.val(),e&&d._parseTime(f,!c.settings.timeOnly)&&(e.setHours(d.hour,d.minute,d.second,d.millisec),e.setMicroseconds(d.microsec),null!=d.timezone&&(d.support.timezone||null!==d._defaults.timezone||(d.timezone=-1*e.getTimezoneOffset()),e=$.timepicker.timezoneAdjust(e,d.timezone,$.timepicker.timezoneOffsetString(-e.getTimezoneOffset())))),e}return this._base_getDateDatepicker(a,b)}},$.datepicker._base_parseDate=$.datepicker.parseDate,$.datepicker.parseDate=function(a,b,c){var d;try{d=this._base_parseDate(a,b,c)}catch(e){if(!(e.indexOf(":")>=0))throw e;d=this._base_parseDate(a,b.substring(0,b.length-(e.length-e.indexOf(":")-2)),c),$.timepicker.log("Error parsing the date string: "+e+"\ndate string = "+b+"\ndate format = "+a)}return d},$.datepicker._base_formatDate=$.datepicker._formatDate,$.datepicker._formatDate=function(a,b,c,d){var e=this._get(a,"timepicker");return e?(e._updateDateTime(a),e.$input.val()):this._base_formatDate(a)},$.datepicker._base_optionDatepicker=$.datepicker._optionDatepicker,$.datepicker._optionDatepicker=function(a,b,c){var d,e=this._getInst(a);if(!e)return null;var f=this._get(e,"timepicker");if(f){var g,h,i,j,k=null,l=null,m=null,n=f._defaults.evnts,o={};if("string"==typeof b){if("minDate"===b||"minDateTime"===b)k=c;else if("maxDate"===b||"maxDateTime"===b)l=c;else if("onSelect"===b)m=c;else if(n.hasOwnProperty(b)){if("undefined"==typeof c)return n[b];o[b]=c,d={}}}else if("object"==typeof b){b.minDate?k=b.minDate:b.minDateTime?k=b.minDateTime:b.maxDate?l=b.maxDate:b.maxDateTime&&(l=b.maxDateTime);for(g in n)n.hasOwnProperty(g)&&b[g]&&(o[g]=b[g])}for(g in o)o.hasOwnProperty(g)&&(n[g]=o[g],d||(d=$.extend({},b)),delete d[g]);if(d&&isEmptyObject(d))return;if(k?(k=0===k?new Date:new Date(k),f._defaults.minDate=k,f._defaults.minDateTime=k):l?(l=0===l?new Date:new Date(l),f._defaults.maxDate=l,f._defaults.maxDateTime=l):m&&(f._defaults.onSelect=m),k||l)return j=$(a),i=j.datetimepicker("getDate"),h=this._base_optionDatepicker.call($.datepicker,a,d||b,c),j.datetimepicker("setDate",i),h}return void 0===c?this._base_optionDatepicker.call($.datepicker,a,b):this._base_optionDatepicker.call($.datepicker,a,d||b,c)};var isEmptyObject=function(a){var b;for(b in a)if(a.hasOwnProperty(b))return!1;return!0},extendRemove=function(a,b){$.extend(a,b);for(var c in b)(null===b[c]||void 0===b[c])&&(a[c]=b[c]);return a},detectSupport=function(a){var b=a.replace(/'.*?'/g,"").toLowerCase(),c=function(a,b){return-1!==a.indexOf(b)?!0:!1};return{hour:c(b,"h"),minute:c(b,"m"),second:c(b,"s"),millisec:c(b,"l"),microsec:c(b,"c"),timezone:c(b,"z"),ampm:c(b,"t")&&c(a,"h"),iso8601:c(a,"Z")}},convert24to12=function(a){return a%=12,0===a&&(a=12),String(a)},computeEffectiveSetting=function(a,b){return a&&a[b]?a[b]:$.timepicker._defaults[b]},splitDateTime=function(a,b){var c=computeEffectiveSetting(b,"separator"),d=computeEffectiveSetting(b,"timeFormat"),e=d.split(c),f=e.length,g=a.split(c),h=g.length;return h>1?{dateString:g.splice(0,h-f).join(c),timeString:g.splice(0,f).join(c)}:{dateString:a,timeString:""}},parseDateTimeInternal=function(a,b,c,d,e){var f,g,h;if(g=splitDateTime(c,e),f=$.datepicker._base_parseDate(a,g.dateString,d),""===g.timeString)return{date:f};if(h=$.datepicker.parseTime(b,g.timeString,e),!h)throw"Wrong time format";return{date:f,timeObj:h}},selectLocalTimezone=function(a,b){if(a&&a.timezone_select){var c=b||new Date;a.timezone_select.val(-c.getTimezoneOffset())}};$.timepicker=new Timepicker,$.timepicker.timezoneOffsetString=function(a,b){if(isNaN(a)||a>840||-720>a)return a;var c=a,d=c%60,e=(c-d)/60,f=b?":":"",g=(c>=0?"+":"-")+("0"+Math.abs(e)).slice(-2)+f+("0"+Math.abs(d)).slice(-2);return"+00:00"===g?"Z":g},$.timepicker.timezoneOffsetNumber=function(a){var b=a.toString().replace(":","");return"Z"===b.toUpperCase()?0:/^(\-|\+)\d{4}$/.test(b)?("-"===b.substr(0,1)?-1:1)*(60*parseInt(b.substr(1,2),10)+parseInt(b.substr(3,2),10)):parseInt(a,10)},$.timepicker.timezoneAdjust=function(a,b,c){var d=$.timepicker.timezoneOffsetNumber(b),e=$.timepicker.timezoneOffsetNumber(c);return isNaN(e)||a.setMinutes(a.getMinutes()+-d- -e),a},$.timepicker.timeRange=function(a,b,c){return $.timepicker.handleRange("timepicker",a,b,c)},$.timepicker.datetimeRange=function(a,b,c){$.timepicker.handleRange("datetimepicker",a,b,c)},$.timepicker.dateRange=function(a,b,c){$.timepicker.handleRange("datepicker",a,b,c)},$.timepicker.handleRange=function(a,b,c,d){function e(e,f){var g=b[a]("getDate"),h=c[a]("getDate"),i=e[a]("getDate");if(null!==g){var j=new Date(g.getTime()),k=new Date(g.getTime());j.setMilliseconds(j.getMilliseconds()+d.minInterval),k.setMilliseconds(k.getMilliseconds()+d.maxInterval),d.minInterval>0&&j>h?c[a]("setDate",j):d.maxInterval>0&&h>k?c[a]("setDate",k):g>h&&f[a]("setDate",i)}}function f(b,c,e){if(b.val()){var f=b[a].call(b,"getDate");null!==f&&d.minInterval>0&&("minDate"===e&&f.setMilliseconds(f.getMilliseconds()+d.minInterval),"maxDate"===e&&f.setMilliseconds(f.getMilliseconds()-d.minInterval)),f.getTime&&c[a].call(c,"option",e,f)}}d=$.extend({},{minInterval:0,maxInterval:0,start:{},end:{}},d);var g=!1;return"timepicker"===a&&(g=!0,a="datetimepicker"),$.fn[a].call(b,$.extend({timeOnly:g,onClose:function(a,b){e($(this),c)},onSelect:function(a){f($(this),c,"minDate")}},d,d.start)),$.fn[a].call(c,$.extend({timeOnly:g,onClose:function(a,c){e($(this),b)},onSelect:function(a){f($(this),b,"maxDate")}},d,d.end)),e(b,c),f(b,c,"minDate"),f(c,b,"maxDate"),$([b.get(0),c.get(0)])},$.timepicker.log=function(){window.console&&window.console.log&&window.console.log.apply&&window.console.log.apply(window.console,Array.prototype.slice.call(arguments))},$.timepicker._util={_extendRemove:extendRemove,_isEmptyObject:isEmptyObject,_convert24to12:convert24to12,_detectSupport:detectSupport,_selectLocalTimezone:selectLocalTimezone,_computeEffectiveSetting:computeEffectiveSetting,_splitDateTime:splitDateTime,_parseDateTimeInternal:parseDateTimeInternal},Date.prototype.getMicroseconds||(Date.prototype.microseconds=0,Date.prototype.getMicroseconds=function(){return this.microseconds},Date.prototype.setMicroseconds=function(a){return this.setMilliseconds(this.getMilliseconds()+Math.floor(a/1e3)),this.microseconds=a%1e3,this}),$.timepicker.version="1.6.3"}});
diff --git a/js/settings-admin.js b/js/settings-admin.js
index 4999636..3a64d37 100644
--- a/js/settings-admin.js
+++ b/js/settings-admin.js
@@ -123,14 +123,6 @@ $(document).ready(function() {
});
});
- $c.find('[name="REGENERATE_OWNCLOUD_TEMPORARY_PASSWORD_SIGNING_KEY"]').click(function(e) {
- regenerateTemporaryPasswordSigningKey(function() {
- $c.find('.OWNCLOUD_TEMPORARY_PASSWORD_SIGNING_KEY')
- .removeClass('hidden');
- }, function(error) {
-
- });
- });
$c.find('[name="GENERATE_SPREED_WEBRTC_CONFIG"]').click(function(e) {
generateSpreedWebRTCConfig(function(config) {
$c.find('.SPREED_WEBRTC_CONFIG')
diff --git a/security/security.php b/security/security.php
index f0ddec6..02a2995 100644
--- a/security/security.php
+++ b/security/security.php
@@ -11,7 +11,6 @@
namespace OCA\SpreedME\Security;
-use OCA\SpreedME\Errors\ErrorCodes;
use OCA\SpreedME\Helper\Helper;
use OCA\SpreedME\Settings\Settings;
@@ -22,7 +21,6 @@ class Security {
// Increase this with every major update of the signing process to invalidate old signatures
const COMBO_VERSION = 2;
- const TP_VERSION = 2;
private function __construct() {
@@ -65,136 +63,16 @@ public static function getSignedCombo($userid, $expiration = 0) {
}
}
- private static function requireEnabledTemporaryPassword() {
- if (Helper::getConfigValue('OWNCLOUD_TEMPORARY_PASSWORD_LOGIN_ENABLED') !== true) {
- throw new \Exception('Temporary Passwords not enabled in config/config.php', ErrorCodes::TEMPORARY_PASSWORD_NOT_ENABLED);
- }
- }
-
- private static function decorateUserId($userid, $prefix) {
- // Prefix userid with ext/ or int/ and append /uniqueid
- $uniqueid = uniqid('', true);
- return sprintf('%s/%s/%s', $prefix, $userid, $uniqueid);
- }
-
- // TODO(leon): Refactor, this is shitty
- public static function generateTemporaryPassword($userid, $expiration = 0, $version = self::TP_VERSION, $forValidation = false) {
- if (!$forValidation) {
- self::requireEnabledTemporaryPassword();
- }
-
- // Only prevent certain characters and decorate userid if we don't want to validate a given TP
- if (!$forValidation) {
- $disallowed = array(':', '/');
- foreach ($disallowed as $char) {
- if (strpos($userid, $char) !== false) {
- throw new \Exception('userid may not contain one of these symbols: ' . join(' or ', $disallowed), ErrorCodes::TEMPORARY_PASSWORD_INVALID_USERID);
- }
- }
-
- $userid = self::decorateUserId($userid, 'ext');
- }
-
- $key = Helper::getConfigValue('OWNCLOUD_TEMPORARY_PASSWORD_SIGNING_KEY');
- $max_age = 60 * 60 * 2;
-
- if ($expiration > 0) {
- // Use a fixed expiration date
- $signed_combo_array = self::getSignedUsercomboArray(
- $version,
- $userid,
- $key,
- false,
- $expiration
- );
- } else {
- // Dynamically expire after x seconds
- $signed_combo_array = self::getSignedUsercomboArray(
- $version,
- $userid,
- $key,
- $max_age
- );
- }
-
- return $signed_combo_array['useridcombo'] . ':' . $signed_combo_array['secret'];
- }
-
- public static function validateTemporaryPassword($tp) {
- $split = explode(':', $tp);
-
- // The 4 parts: expiraton, userid, version, hmac (signature of previous 3 parts)
- if (count($split) !== 4) {
- // Invalid tp part length
- return false;
- }
-
- list($expiration, $userid, $version, $hmac) = $split;
-
- if (time() > $expiration) {
- // Expired
- return false;
- }
-
- if (intval($version) !== self::TP_VERSION) {
- // Unsupported / outdated version
- return false;
- }
-
- $calctp = self::generateTemporaryPassword($userid, $expiration, $version, true); // Set forValidation flag
- if (self::constantTimeEquals($tp, $calctp) !== true) {
- // Incorrect hmac
- return false;
- }
-
- return true;
- }
-
- public static function getSignedComboFromTemporaryPassword($tp) {
- self::requireEnabledTemporaryPassword();
-
- if (self::validateTemporaryPassword($tp) !== true) {
- throw new \Exception('Invalid Temporary Password', ErrorCodes::TEMPORARY_PASSWORD_INVALID);
- }
-
- // TODO(leon): Do we need to split again?
- $split = explode(':', $tp);
- list($expiration, $userid, $version, $hmac) = $split;
-
- return self::getSignedCombo($userid);
- }
-
- public static function getRandomHexString($length) {
- return \OC::$server->getSecureRandom()->getMediumStrengthGenerator()->generate($length, '0123456789abcdef');
+ public static function getRandomString($length, $charset = '0123456789abcdef') {
+ return \OC::$server->getSecureRandom()->getMediumStrengthGenerator()->generate($length, $charset);
}
public static function regenerateSharedSecret() {
- $key = Security::getRandomHexString(256 / 4); // 256 bit
+ $key = Security::getRandomString(256 / 4); // 256 bit
Helper::setDatabaseConfigValueIfEnabled('SPREED_WEBRTC_SHAREDSECRET', $key);
return $key;
}
- public static function regenerateTemporaryPasswordSigningKey() {
- $key = Security::getRandomHexString(256 / 4); // 256 bit
- Helper::setDatabaseConfigValueIfEnabled('OWNCLOUD_TEMPORARY_PASSWORD_SIGNING_KEY', $key);
- }
-
- public static function constantTimeEquals($a, $b) {
- $alen = mb_strlen($a, '8bit');
- $blen = mb_strlen($b, '8bit');
-
- if ($alen !== $blen) {
- return false;
- }
-
- $result = 0;
- for ($i = 0; $i < $alen; $i++) {
- $result |= (ord($a[$i]) ^ ord($b[$i]));
- }
-
- return $result === 0;
- }
-
public static function getAllowedIframeDomains() {
$origin = Helper::getSpreedWebRtcOrigin();
diff --git a/security/temporarypasswordmanager.php b/security/temporarypasswordmanager.php
new file mode 100644
index 0000000..ac46f62
--- /dev/null
+++ b/security/temporarypasswordmanager.php
@@ -0,0 +1,143 @@
+
+ * @copyright struktur AG 2016
+ */
+
+namespace OCA\SpreedME\Security;
+
+use OCA\SpreedME\Errors\ErrorCodes;
+use OCA\SpreedME\Helper\Helper;
+use OCA\SpreedME\Security\Security;
+use OCP\IDBConnection;
+
+class TemporaryPasswordManager {
+
+ private $db;
+ private $tableName = 'spreedme_tps';
+ private $hashFuncName = 'sha256';
+ private $maxUserLength = 64; // Keep in sync with database.xml
+ private $disallowedUserChars = array(':', '/');
+ private $temporaryPasswordLength = 12;
+ private $temporaryPasswordAllowedChars = '0123456789';
+
+ public function __construct(IDBConnection $db) {
+ $this->db = $db;
+ }
+
+ // So we don't leak anything due to timing side channels
+ private function hashTemporaryPassword($tp) {
+ return hash($this->hashFuncName, $tp);
+ }
+
+ private function getNewTemporaryPassword() {
+ do {
+ $pass = Security::getRandomString($this->temporaryPasswordLength, $this->temporaryPasswordAllowedChars);
+ } while ($pass[0] === '0'); // Make sure we don't have a leading 0
+ return $pass;
+ }
+
+ private function requireEnabledTemporaryPassword() {
+ if (Helper::getConfigValue('OWNCLOUD_TEMPORARY_PASSWORD_LOGIN_ENABLED') !== true) {
+ throw new \Exception('Temporary Passwords not enabled in config/config.php', ErrorCodes::TEMPORARY_PASSWORD_NOT_ENABLED);
+ }
+ }
+
+ private function decorateUserId($userid, $prefix) {
+ // Prefix userid with ext/ or int/ and append /uniqueid
+ $uniqueid = uniqid('', true);
+ return sprintf('%s/%s/%s', $prefix, $userid, $uniqueid);
+ }
+
+ private function getFormattedDate($date) {
+ return $date->format('Y-m-d H:i:s');
+ }
+
+ public function generateTemporaryPassword($userid, $expirationUnix) {
+ // TODO(leon): Let this get called by cron
+ $this->cleanup();
+
+ // Validate userid length
+ if (strlen($userid) > $this->maxUserLength) {
+ throw new \Exception('userid too long', ErrorCodes::TEMPORARY_PASSWORD_USERID_TOO_LONG);
+ }
+
+ // Prevent certain characters in userid
+ foreach ($this->disallowedUserChars as $char) {
+ if (strpos($userid, $char) !== false) {
+ throw new \Exception('userid may not contain one of these symbols: ' . join(' or ', $this->disallowedUserChars), ErrorCodes::TEMPORARY_PASSWORD_INVALID_USERID);
+ }
+ }
+
+ $expiration = new \DateTime();
+ $expiration->setTimestamp($expirationUnix);
+
+ // Generate TP and insert it to the DB in hashed form
+ // Repeat until we inserted an unique one
+ while (true) {
+ $tp = $this->getNewTemporaryPassword();
+ $query = $this->db->getQueryBuilder();
+ try {
+ $query->insert($this->tableName)->values(array(
+ 'tp' => $query->createNamedParameter($this->hashTemporaryPassword($tp)),
+ 'userid' => $query->createNamedParameter($userid),
+ 'expiration' => $query->createNamedParameter($this->getFormattedDate($expiration)),
+ ))->execute();
+ return $tp;
+ } catch (\Doctrine\DBAL\Exception\UniqueConstraintViolationException $e) {
+ // Whoops, hash collision
+ // You are likely one of the first people to find a $this->hashFuncName collision
+ // Unfortunately I don't tell you about it ;) Fame = vanished
+ }
+ }
+ }
+
+ // Returns false or the TP's decorated userid
+ public function validateTemporaryPassword($tp) {
+ $now = new \DateTime();
+ $query = $this->db->getQueryBuilder();
+ $useridField = 'userid';
+ $query
+ ->select($useridField)
+ ->from($this->tableName)
+ ->where($query->expr()->eq('tp', $query->createNamedParameter($this->hashTemporaryPassword($tp))))
+ ->andWhere($query->expr()->gte('expiration', $query->createNamedParameter($this->getFormattedDate($now))))
+ ->execute();
+
+ $result = $query->execute();
+ $user = false;
+ // TODO(leon): Why do we loop?
+ while ($row = $result->fetch()) {
+ $user = $this->decorateUserId($row[$useridField], 'ext');
+ }
+ $result->closeCursor();
+ return $user;
+ }
+
+ public function getSignedComboFromTemporaryPassword($tp) {
+ $this->requireEnabledTemporaryPassword();
+
+ $userid = $this->validateTemporaryPassword($tp);
+ if ($this->validateTemporaryPassword($tp) === false) {
+ throw new \Exception('Invalid Temporary Password', ErrorCodes::TEMPORARY_PASSWORD_INVALID);
+ }
+
+ return Security::getSignedCombo($userid);
+ }
+
+ public function cleanup() {
+ // Cleanup expired TPs
+ $now = new \DateTime();
+ $query = $this->db->getQueryBuilder();
+ $query
+ ->delete($this->tableName)
+ ->where($query->expr()->lt('expiration', $query->createNamedParameter($this->getFormattedDate($now))))
+ ->execute();
+ }
+
+}
diff --git a/templates/settings-admin.php b/templates/settings-admin.php
index e9ba692..85a4f80 100644
--- a/templates/settings-admin.php
+++ b/templates/settings-admin.php
@@ -78,14 +78,6 @@ class="needs-confirmation" data-confirmation-message="Do you really want to gene
/>
-
- A new OWNCLOUD_TEMPORARY_PASSWORD_SIGNING_KEY was generated.
Previously generated 'Temporary Passwords' are no longer valid.
-
-
-
-
-