Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added parameter to disallow app auth token creating #33879

Closed
wants to merge 1 commit into from
Closed

Added parameter to disallow app auth token creating #33879

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions apps/settings/lib/Controller/AuthSettingsController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
<?php
/**
* @copyright Copyright (c) 2016, ownCloud, Inc.
* @copyright Copyright (c) 2022 Informatyka Boguslawski sp. z o.o. sp.k., http://www.ib.pl/
*
* @author Christoph Wurst <[email protected]>
* @author Daniel Kesselberg <[email protected]>
Expand Down Expand Up @@ -46,6 +47,7 @@
use OCP\AppFramework\Http;
use OCP\AppFramework\Http\JSONResponse;
use OCP\IRequest;
use OCP\IConfig;
use OCP\ISession;
use OCP\IUserSession;
use OCP\Security\ISecureRandom;
Expand All @@ -57,6 +59,9 @@ class AuthSettingsController extends Controller {
/** @var IProvider */
private $tokenProvider;

/** @var IConfig */
private $config;

/** @var ISession */
private $session;

Expand Down Expand Up @@ -93,6 +98,7 @@ class AuthSettingsController extends Controller {
public function __construct(string $appName,
IRequest $request,
IProvider $tokenProvider,
IConfig $config,
ISession $session,
ISecureRandom $random,
?string $userId,
Expand All @@ -103,6 +109,7 @@ public function __construct(string $appName,
parent::__construct($appName, $request);
$this->tokenProvider = $tokenProvider;
$this->uid = $userId;
$this->config = $config;
$this->userSession = $userSession;
$this->session = $session;
$this->random = $random;
Expand All @@ -120,6 +127,12 @@ public function __construct(string $appName,
* @return JSONResponse
*/
public function create($name) {

// Don't create app auth token if disallowed in configuration.
if (($this->config->getSystemValue('allow_create_app_auth_tokens', true) === false)) {
return $this->getServiceNotAvailableResponse();
}

if ($this->checkAppToken()) {
return $this->getServiceNotAvailableResponse();
}
Expand Down
9 changes: 8 additions & 1 deletion apps/settings/lib/Settings/Personal/Security/Authtokens.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@

/**
* @copyright Copyright (c) 2019, Roeland Jago Douma <[email protected]>
* @copyright Copyright (c) 2022 Informatyka Boguslawski sp. z o.o. sp.k., http://www.ib.pl/
*
* @author Roeland Jago Douma <[email protected]>
*
Expand All @@ -26,6 +27,7 @@
namespace OCA\Settings\Settings\Personal\Security;

use OCP\AppFramework\Services\IInitialState;
use OCP\IConfig;
use OCP\IUserSession;
use function array_map;
use OC\Authentication\Exceptions\InvalidTokenException;
Expand All @@ -42,6 +44,9 @@ class Authtokens implements ISettings {
/** @var IAuthTokenProvider */
private $tokenProvider;

/** @var IConfig */
private $config;

/** @var ISession */
private $session;

Expand All @@ -55,11 +60,13 @@ class Authtokens implements ISettings {
private $userSession;

public function __construct(IAuthTokenProvider $tokenProvider,
IConfig $config,
ISession $session,
IUserSession $userSession,
IInitialState $initialState,
?string $UserId) {
$this->tokenProvider = $tokenProvider;
$this->config = $config;
$this->session = $session;
$this->initialState = $initialState;
$this->uid = $UserId;
Expand All @@ -74,7 +81,7 @@ public function getForm(): TemplateResponse {

$this->initialState->provideInitialState(
'can_create_app_token',
$this->userSession->getImpersonatingUserID() === null
($this->userSession->getImpersonatingUserID() === null) && ($this->config->getSystemValue('allow_create_app_auth_tokens', true) !== false)
);

return new TemplateResponse('settings', 'settings/personal/security/authtokens');
Expand Down
6 changes: 6 additions & 0 deletions apps/settings/tests/Controller/AuthSettingsControllerTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
<?php
/**
* @copyright Copyright (c) 2016, ownCloud, Inc.
* @copyright Copyright (c) 2022 Informatyka Boguslawski sp. z o.o. sp.k., http://www.ib.pl/
*
* @author Christoph Wurst <[email protected]>
* @author Daniel Kesselberg <[email protected]>
Expand Down Expand Up @@ -42,6 +43,7 @@
use OCP\Activity\IManager;
use OCP\AppFramework\Http\JSONResponse;
use OCP\IRequest;
use OCP\IConfig;
use OCP\ISession;
use OCP\IUserSession;
use OCP\Security\ISecureRandom;
Expand All @@ -58,6 +60,8 @@ class AuthSettingsControllerTest extends TestCase {
private $request;
/** @var IProvider|MockObject */
private $tokenProvider;
/** @var IConfig */
private $config;
/** @var ISession|MockObject */
private $session;
/**@var IUserSession|MockObject */
Expand All @@ -75,6 +79,7 @@ protected function setUp(): void {

$this->request = $this->createMock(IRequest::class);
$this->tokenProvider = $this->createMock(IProvider::class);
$this->config = $this->createMock(IConfig::class);
$this->session = $this->createMock(ISession::class);
$this->userSession = $this->createMock(IUserSession::class);
$this->secureRandom = $this->createMock(ISecureRandom::class);
Expand All @@ -87,6 +92,7 @@ protected function setUp(): void {
'core',
$this->request,
$this->tokenProvider,
$this->config,
$this->session,
$this->secureRandom,
$this->uid,
Expand Down
6 changes: 6 additions & 0 deletions apps/settings/tests/Settings/Personal/Security/AuthtokensTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@

/**
* @copyright 2019 Christoph Wurst <[email protected]>
* @copyright Copyright (c) 2022 Informatyka Boguslawski sp. z o.o. sp.k., http://www.ib.pl/
*
* @author Roeland Jago Douma <[email protected]>
*
Expand Down Expand Up @@ -40,6 +41,9 @@ class AuthtokensTest extends TestCase {
/** @var IAuthTokenProvider|MockObject */
private $authTokenProvider;

/** @var IConfig */
private $config;

/** @var ISession|MockObject */
private $session;

Expand All @@ -59,13 +63,15 @@ protected function setUp(): void {
parent::setUp();

$this->authTokenProvider = $this->createMock(IAuthTokenProvider::class);
$this->config = $this->createMock(IConfig::class);
$this->session = $this->createMock(ISession::class);
$this->userSession = $this->createMock(IUserSession::class);
$this->initialState = $this->createMock(IInitialState::class);
$this->uid = 'test123';

$this->section = new Authtokens(
$this->authTokenProvider,
$this->config,
$this->session,
$this->userSession,
$this->initialState,
Expand Down
7 changes: 7 additions & 0 deletions config/config.sample.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -305,6 +305,13 @@
*/
'token_auth_activity_update' => 60,

/**
* Allow (when true) or disallow (when false) application authentication token creating.
*
* Defaults to ``true``
*/
'allow_create_app_auth_tokens' => true,

/**
* Whether the bruteforce protection shipped with Nextcloud should be enabled or not.
*
Expand Down