Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

The URLGenerator doesn't support `` as target for absolute URLs, we need to link to `/` thus.

Regression introduced with https://github.com/nextcloud/server/commit/46229a00f39e507249dbe3ceb7507277da3fa4f8



Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Signed-off-by: Morris Jobke <hey@morrisjobke.de>

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Fixes https://github.com/nextcloud/server/issues/5891



Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

This adds a Clear-Site-Data header to the logout response which will delete all relevant data in the caches which may contain potentially sensitive content.

See https://w3c.github.io/webappsec-clear-site-data/#header for the definition of the types.

Ref https://twitter.com/mikewest/status/877149667909406723



Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

This makes the new `@BruteForceProtection` annotation more clever and moves the relevant code into it's own middleware.

Basically you can now set `@BruteForceProtection(action=$key)` as annotation and that will make the controller bruteforce protected. However, the difference to before is that you need to call `$responmse->throttle()` to increase the counter. Before the counter was increased every time which leads to all kind of unexpected problems.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

Signed-off-by: Joas Schilling <coding@schilljs.com>

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>

Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>

Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>

Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>

Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>

Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>

Signed-off-by: Sandro Lutz <sandro.lutz@temparus.ch>

Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>

Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>

Signed-off-by: Joas Schilling <coding@schilljs.com>

Signed-off-by: Joas Schilling <coding@schilljs.com>

Signed-off-by: justin-sleep <justin@quarterfull.com>

Signed-off-by: Joas Schilling <coding@schilljs.com>

* try to reuse the old session token for remember me login
* decrypt/encrypt token password and set the session id accordingly
* create remember-me cookies only if checkbox is checked and 2fa solved
* adjust db token cleanup to store remembered tokens longer
* adjust unit tests

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

Signed-off-by: Joas Schilling <coding@schilljs.com>