diff --git a/db_structure.xml b/db_structure.xml
index 9188ad346d2ef82f1d5d7a0c2ae4129cf2f10795..b7dacc05d92fa13825719f373d780ecaa7a1236e 100644
--- a/db_structure.xml
+++ b/db_structure.xml
@@ -1084,8 +1084,7 @@
<name>password</name>
<type>clob</type>
<default></default>
- <notnull>true</notnull>
- <length>4000</length>
+ <notnull>false</notnull>
</field>
<field>
diff --git a/lib/private/Authentication/Exceptions/PasswordlessTokenException.php b/lib/private/Authentication/Exceptions/PasswordlessTokenException.php
new file mode 100644
index 0000000000000000000000000000000000000000..dbe0ee8fbcaa5258902e3dd0f49eb323bcf95559
--- /dev/null
+++ b/lib/private/Authentication/Exceptions/PasswordlessTokenException.php
@@ -0,0 +1,29 @@
+<?php
+
+/**
+ * @author Christoph Wurst <christoph@owncloud.com>
+ *
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+namespace OC\Authentication\Exceptions;
+
+use Exception;
+
+class PasswordlessTokenException extends Exception {
+
+}
diff --git a/lib/private/Authentication/Token/DefaultToken.php b/lib/private/Authentication/Token/DefaultToken.php
index 4be43fada0dd43b2729b924583930fc87f361862..299291e34afbb7d5174ac710231d4ba4d8512902 100644
--- a/lib/private/Authentication/Token/DefaultToken.php
+++ b/lib/private/Authentication/Token/DefaultToken.php
@@ -27,7 +27,6 @@ use OCP\AppFramework\Db\Entity;
* @method void setId(int $id)
* @method void setUid(string $uid);
* @method void setLoginName(string $loginName)
- * @method string getLoginName()
* @method void setPassword(string $password)
* @method void setName(string $name)
* @method string getName()
diff --git a/lib/private/Authentication/Token/DefaultTokenProvider.php b/lib/private/Authentication/Token/DefaultTokenProvider.php
index dd6e264ed3d7344ab9aa0ee7eb3c72660e325456..84effc5f87556daa2831f134eabb19212754f5f5 100644
--- a/lib/private/Authentication/Token/DefaultTokenProvider.php
+++ b/lib/private/Authentication/Token/DefaultTokenProvider.php
@@ -23,6 +23,7 @@ namespace OC\Authentication\Token;
use Exception;
use OC\Authentication\Exceptions\InvalidTokenException;
+use OC\Authentication\Exceptions\PasswordlessTokenException;
use OCP\AppFramework\Db\DoesNotExistException;
use OCP\AppFramework\Utility\ITimeFactory;
use OCP\IConfig;
@@ -68,7 +69,7 @@ class DefaultTokenProvider implements IProvider {
* @param string $token
* @param string $uid
* @param string $loginName
- * @param string $password
+ * @param string|null $password
* @param string $name
* @param int $type token type
* @return IToken
@@ -77,7 +78,9 @@ class DefaultTokenProvider implements IProvider {
$dbToken = new DefaultToken();
$dbToken->setUid($uid);
$dbToken->setLoginName($loginName);
- $dbToken->setPassword($this->encryptPassword($password, $token));
+ if (!is_null($password)) {
+ $dbToken->setPassword($this->encryptPassword($password, $token));
+ }
$dbToken->setName($name);
$dbToken->setToken($this->hashToken($token));
$dbToken->setType($type);
@@ -136,10 +139,15 @@ class DefaultTokenProvider implements IProvider {
* @param IToken $savedToken
* @param string $tokenId session token
* @throws InvalidTokenException
+ * @throws PasswordlessTokenException
* @return string
*/
public function getPassword(IToken $savedToken, $tokenId) {
- return $this->decryptPassword($savedToken->getPassword(), $tokenId);
+ $password = $savedToken->getPassword();
+ if (is_null($password)) {
+ throw new PasswordlessTokenException();
+ }
+ return $this->decryptPassword($password, $tokenId);
}
/**
diff --git a/lib/private/Authentication/Token/IProvider.php b/lib/private/Authentication/Token/IProvider.php
index bdfde62d320be93ecdc6cb011dee0117296c0952..fece7dcb5676dc7ae1b996de0bdead33d8850865 100644
--- a/lib/private/Authentication/Token/IProvider.php
+++ b/lib/private/Authentication/Token/IProvider.php
@@ -22,6 +22,7 @@
namespace OC\Authentication\Token;
use OC\Authentication\Exceptions\InvalidTokenException;
+use OC\Authentication\Exceptions\PasswordlessTokenException;
use OCP\IUser;
interface IProvider {
@@ -32,7 +33,7 @@ interface IProvider {
* @param string $token
* @param string $uid
* @param string $loginName
- * @param string $password
+ * @param string|null $password
* @param string $name
* @param int $type token type
* @return IToken
@@ -94,6 +95,7 @@ interface IProvider {
* @param IToken $token
* @param string $tokenId
* @throws InvalidTokenException
+ * @throws PasswordlessTokenException
* @return string
*/
public function getPassword(IToken $token, $tokenId);
diff --git a/lib/private/User/Session.php b/lib/private/User/Session.php
index 20f1812077e4bdb67185b63292b5dd7e7b9db00b..362468d4109864a40bfca941b52206ee8088b1fe 100644
--- a/lib/private/User/Session.php
+++ b/lib/private/User/Session.php
@@ -32,6 +32,7 @@ namespace OC\User;
use OC;
use OC\Authentication\Exceptions\InvalidTokenException;
+use OC\Authentication\Exceptions\PasswordlessTokenException;
use OC\Authentication\Token\IProvider;
use OC\Authentication\Token\IToken;
use OC\Hooks\Emitter;
@@ -46,6 +47,7 @@ use OCP\IUser;
use OCP\IUserManager;
use OCP\IUserSession;
use OCP\Session\Exceptions\SessionNotAvailableException;
+use OCP\Util;
/**
* Class Session
@@ -220,6 +222,10 @@ class Session implements IUserSession, Emitter {
// An invalid token password was used -> log user out
$this->logout();
return;
+ } catch (PasswordlessTokenException $ex) {
+ // Token has no password, nothing to check
+ $this->session->set('last_login_check', $now);
+ return;
}
if ($this->manager->checkPassword($token->getLoginName(), $pwd) === false
@@ -297,8 +303,12 @@ class Session implements IUserSession, Emitter {
// When logging in with token, the password must be decrypted first before passing to login hook
try {
$token = $this->tokenProvider->getToken($password);
- $password = $this->tokenProvider->getPassword($token, $password);
- $this->manager->emit('\OC\User', 'preLogin', array($uid, $password));
+ try {
+ $password = $this->tokenProvider->getPassword($token, $password);
+ $this->manager->emit('\OC\User', 'preLogin', array($uid, $password));
+ } catch (PasswordlessTokenException $ex) {
+ $this->manager->emit('\OC\User', 'preLogin', array($uid, ''));
+ }
} catch (InvalidTokenException $ex) {
// Invalid token, nothing to do
}
@@ -359,7 +369,7 @@ class Session implements IUserSession, Emitter {
}
protected function isTwoFactorEnforced($username) {
- \OCP\Util::emitHook(
+ Util::emitHook(
'\OCA\Files_Sharing\API\Server2Server',
'preLoginNameUsedAsUserName',
array('uid' => &$username)
@@ -452,7 +462,7 @@ class Session implements IUserSession, Emitter {
* @param string $password
* @return boolean
*/
- public function createSessionToken(IRequest $request, $uid, $loginName, $password) {
+ public function createSessionToken(IRequest $request, $uid, $loginName, $password = null) {
if (is_null($this->manager->get($uid))) {
// User does not exist
return false;
diff --git a/lib/private/legacy/user.php b/lib/private/legacy/user.php
index 6e113bd4742229dda0b592624d6c68e327b86010..d4d84ed3fa2bcfbd1118e3fab00f9c13c6cb53fe 100644
--- a/lib/private/legacy/user.php
+++ b/lib/private/legacy/user.php
@@ -180,6 +180,8 @@ class OC_User {
self::setUserId($uid);
self::setDisplayName($uid);
self::getUserSession()->setLoginName($uid);
+ $request = OC::$server->getRequest();
+ self::getUserSession()->createSessionToken($request, $uid, $uid);
// setup the filesystem
OC_Util::setupFS($uid);
// first call the post_login hooks, the login-process needs to be
diff --git a/settings/Controller/AuthSettingsController.php b/settings/Controller/AuthSettingsController.php
index 2417f5f8218accbe6c55b88d3905851899cbcd24..fba663b034de2f6dec0b98049c71b784cfc14ac9 100644
--- a/settings/Controller/AuthSettingsController.php
+++ b/settings/Controller/AuthSettingsController.php
@@ -23,6 +23,7 @@ namespace OC\Settings\Controller;
use OC\AppFramework\Http;
use OC\Authentication\Exceptions\InvalidTokenException;
+use OC\Authentication\Exceptions\PasswordlessTokenException;
use OC\Authentication\Token\IProvider;
use OC\Authentication\Token\IToken;
use OCP\AppFramework\Controller;
@@ -101,7 +102,11 @@ class AuthSettingsController extends Controller {
try {
$sessionToken = $this->tokenProvider->getToken($sessionId);
$loginName = $sessionToken->getLoginName();
- $password = $this->tokenProvider->getPassword($sessionToken, $sessionId);
+ try {
+ $password = $this->tokenProvider->getPassword($sessionToken, $sessionId);
+ } catch (PasswordlessTokenException $ex) {
+ $password = null;
+ }
} catch (InvalidTokenException $ex) {
$resp = new JSONResponse();
$resp->setStatus(Http::STATUS_SERVICE_UNAVAILABLE);
diff --git a/tests/lib/Authentication/Token/DefaultTokenProviderTest.php b/tests/lib/Authentication/Token/DefaultTokenProviderTest.php
index e04424e46281aa0bae1203d3e30d2da1973b1623..98cee208065e934760aee2ec7a29c40e22232c94 100644
--- a/tests/lib/Authentication/Token/DefaultTokenProviderTest.php
+++ b/tests/lib/Authentication/Token/DefaultTokenProviderTest.php
@@ -134,6 +134,17 @@ class DefaultTokenProviderTest extends TestCase {
$this->assertEquals('passme', $actual);
}
+ /**
+ * @expectedException \OC\Authentication\Exceptions\PasswordlessTokenException
+ */
+ public function testGetPasswordPasswordLessToken() {
+ $token = 'token1234';
+ $tk = new DefaultToken();
+ $tk->setPassword(null);
+
+ $this->tokenProvider->getPassword($tk, $token);
+ }
+
/**
* @expectedException \OC\Authentication\Exceptions\InvalidTokenException
*/
diff --git a/tests/lib/User/SessionTest.php b/tests/lib/User/SessionTest.php
index 5ff2a16acb91977cab1a364dfb7fabf4c867daa0..36f14e85492df6de00d700d6f36abc086e822822 100644
--- a/tests/lib/User/SessionTest.php
+++ b/tests/lib/User/SessionTest.php
@@ -621,4 +621,42 @@ class SessionTest extends \Test\TestCase {
$this->invokePrivate($userSession, 'validateSession', [$user]);
}
+ public function testValidateSessionNoPassword() {
+ $userManager = $this->getMock('\OCP\IUserManager');
+ $session = $this->getMock('\OCP\ISession');
+ $timeFactory = $this->getMock('\OCP\AppFramework\Utility\ITimeFactory');
+ $tokenProvider = $this->getMock('\OC\Authentication\Token\IProvider');
+ $userSession = $this->getMockBuilder('\OC\User\Session')
+ ->setConstructorArgs([$userManager, $session, $timeFactory, $tokenProvider, $this->config])
+ ->setMethods(['logout'])
+ ->getMock();
+
+ $user = $this->getMock('\OCP\IUser');
+ $token = $this->getMock('\OC\Authentication\Token\IToken');
+
+ $session->expects($this->once())
+ ->method('getId')
+ ->will($this->returnValue('sessionid'));
+ $tokenProvider->expects($this->once())
+ ->method('getToken')
+ ->with('sessionid')
+ ->will($this->returnValue($token));
+ $session->expects($this->once())
+ ->method('get')
+ ->with('last_login_check')
+ ->will($this->returnValue(1000));
+ $timeFactory->expects($this->once())
+ ->method('getTime')
+ ->will($this->returnValue(5000));
+ $tokenProvider->expects($this->once())
+ ->method('getPassword')
+ ->with($token, 'sessionid')
+ ->will($this->throwException(new \OC\Authentication\Exceptions\PasswordlessTokenException()));
+ $session->expects($this->once())
+ ->method('set')
+ ->with('last_login_check', 5000);
+
+ $this->invokePrivate($userSession, 'validateSession', [$user]);
+ }
+
}
diff --git a/version.php b/version.php
index ffbafb72fe6d8a884deb9729872b747f1c164791..967f2690276de51a3a2db6ebb251de2a9b51812d 100644
--- a/version.php
+++ b/version.php
@@ -25,7 +25,7 @@
// We only can count up. The 4. digit is only for the internal patchlevel to trigger DB upgrades
// between betas, final and RCs. This is _not_ the public version number. Reset minor/patchlevel
// when updating major/minor version number.
-$OC_Version = array(9, 1, 0, 6);
+$OC_Version = array(9, 1, 0, 7);
// The human readable string
$OC_VersionString = '9.1.0 beta 1';