diff --git a/lib/Controller/ApiController.php b/lib/Controller/ApiController.php index 130dd6ba..fcfea413 100644 --- a/lib/Controller/ApiController.php +++ b/lib/Controller/ApiController.php @@ -12,6 +12,7 @@ use OCA\UserOIDC\Db\UserMapper; use OCP\AppFramework\Controller; use OCP\AppFramework\Http; +use OCP\AppFramework\Http\Attribute\NoCSRFRequired; use OCP\AppFramework\Http\DataResponse; use OCP\Files\IRootFolder; use OCP\Files\NotPermittedException; @@ -30,8 +31,6 @@ public function __construct( } /** - * @NoCSRFRequired - * * @param int $providerId * @param string $userId * @param string|null $displayName @@ -39,6 +38,7 @@ public function __construct( * @param string|null $quota * @return DataResponse */ + #[NoCSRFRequired] public function createUser(int $providerId, string $userId, ?string $displayName = null, ?string $email = null, ?string $quota = null): DataResponse { $backendUser = $this->userMapper->getOrCreate($providerId, $userId); @@ -71,11 +71,10 @@ public function createUser(int $providerId, string $userId, ?string $displayName } /** - * @NoCSRFRequired - * * @param string $userId * @return DataResponse */ + #[NoCSRFRequired] public function deleteUser(string $userId): DataResponse { $user = $this->userManager->get($userId); if (is_null($user) || $user->getBackendClassName() !== Application::APP_ID) { diff --git a/lib/Controller/Id4meController.php b/lib/Controller/Id4meController.php index 8d072566..72d6728c 100644 --- a/lib/Controller/Id4meController.php +++ b/lib/Controller/Id4meController.php @@ -20,6 +20,10 @@ use OCP\AppFramework\Db\DoesNotExistException; use OCP\AppFramework\Db\MultipleObjectsReturnedException; use OCP\AppFramework\Http; +use OCP\AppFramework\Http\Attribute\BruteForceProtection; +use OCP\AppFramework\Http\Attribute\NoCSRFRequired; +use OCP\AppFramework\Http\Attribute\PublicPage; +use OCP\AppFramework\Http\Attribute\UseSession; use OCP\AppFramework\Http\JSONResponse; use OCP\AppFramework\Http\RedirectResponse; use OCP\AppFramework\Http\TemplateResponse; @@ -71,11 +75,9 @@ public function __construct( $this->id4me = new Service($clientHelper); } - /** - * @PublicPage - * @NoCSRFRequired - * @UseSession - */ + #[PublicPage] + #[NoCSRFRequired] + #[UseSession] public function showLogin() { if (!$this->id4MeService->getID4ME()) { $message = $this->l10n->t('ID4Me is disabled'); @@ -94,13 +96,12 @@ public function showLogin() { } /** - * @PublicPage - * @UseSession - * @BruteForceProtection(action=userOidcId4MeLogin) - * * @param string $domain * @return RedirectResponse|TemplateResponse */ + #[PublicPage] + #[UseSession] + #[BruteForceProtection(action: 'userOidcId4MeLogin')] public function login(string $domain) { if (!$this->id4MeService->getID4ME()) { $message = $this->l10n->t('ID4Me is disabled'); @@ -164,17 +165,16 @@ private function registerClient(string $authorityName, OpenIdConfig $openIdConfi } /** - * @PublicPage - * @NoCSRFRequired - * @UseSession - * @BruteForceProtection(action=userOidcId4MeCode) - * * @param string $state * @param string $code * @param string $scope * @return JSONResponse|RedirectResponse|TemplateResponse * @throws \Exception */ + #[PublicPage] + #[NoCSRFRequired] + #[UseSession] + #[BruteForceProtection(action: 'userOidcId4MeCode')] public function code(string $state = '', string $code = '', string $scope = '') { if (!$this->id4MeService->getID4ME()) { $message = $this->l10n->t('ID4Me is disabled'); diff --git a/lib/Controller/LoginController.php b/lib/Controller/LoginController.php index 8bd798a8..d7515df5 100644 --- a/lib/Controller/LoginController.php +++ b/lib/Controller/LoginController.php @@ -33,6 +33,11 @@ use OCP\AppFramework\Db\DoesNotExistException; use OCP\AppFramework\Db\MultipleObjectsReturnedException; use OCP\AppFramework\Http; +use OCP\AppFramework\Http\Attribute\BruteForceProtection; +use OCP\AppFramework\Http\Attribute\NoAdminRequired; +use OCP\AppFramework\Http\Attribute\NoCSRFRequired; +use OCP\AppFramework\Http\Attribute\PublicPage; +use OCP\AppFramework\Http\Attribute\UseSession; use OCP\AppFramework\Http\DataDisplayResponse; use OCP\AppFramework\Http\JSONResponse; use OCP\AppFramework\Http\RedirectResponse; @@ -128,15 +133,14 @@ private function getRedirectResponse(?string $redirectUrl = null): RedirectRespo } /** - * @PublicPage - * @NoCSRFRequired - * @UseSession - * @BruteForceProtection(action=userOidcLogin) - * * @param int $providerId * @param string|null $redirectUrl * @return DataDisplayResponse|RedirectResponse|TemplateResponse */ + #[PublicPage] + #[NoCSRFRequired] + #[UseSession] + #[BruteForceProtection(action: 'userOidcLogin')] public function login(int $providerId, ?string $redirectUrl = null) { if ($this->userSession->isLoggedIn()) { return $this->getRedirectResponse($redirectUrl); @@ -298,11 +302,6 @@ public function login(int $providerId, ?string $redirectUrl = null) { } /** - * @PublicPage - * @NoCSRFRequired - * @UseSession - * @BruteForceProtection(action=userOidcCode) - * * @param string $state * @param string $code * @param string $scope @@ -314,6 +313,10 @@ public function login(int $providerId, ?string $redirectUrl = null) { * @throws SessionNotAvailableException * @throws \JsonException */ + #[PublicPage] + #[NoCSRFRequired] + #[UseSession] + #[BruteForceProtection(action: 'userOidcCode')] public function code(string $state = '', string $code = '', string $scope = '', string $error = '', string $error_description = '') { if (!$this->isSecure()) { return $this->buildProtocolErrorResponse(); @@ -650,17 +653,16 @@ public function code(string $state = '', string $code = '', string $scope = '', /** * Endpoint called by NC to logout in the IdP before killing the current session * - * @PublicPage - * @NoAdminRequired - * @NoCSRFRequired - * @UseSession - * @BruteForceProtection(action=userOidcSingleLogout) - * * @return RedirectResponse|TemplateResponse * @throws Exception * @throws SessionNotAvailableException * @throws \JsonException */ + #[PublicPage] + #[NoAdminRequired] + #[NoCSRFRequired] + #[UseSession] + #[BruteForceProtection(action: 'userOidcSingleLogout')] public function singleLogoutService() { // TODO throttle in all failing cases $oidcSystemConfig = $this->config->getSystemValue('user_oidc', []); @@ -738,15 +740,14 @@ public function singleLogoutService() { * which leads to the auth token that we can invalidate * Implemented according to https://openid.net/specs/openid-connect-backchannel-1_0.html * - * @PublicPage - * @NoCSRFRequired - * * @param string $providerIdentifier * @param string $logout_token * @return JSONResponse * @throws Exception * @throws \JsonException */ + #[PublicPage] + #[NoCSRFRequired] public function backChannelLogout(string $providerIdentifier, string $logout_token = ''): JSONResponse { // get the provider $provider = $this->providerService->getProviderByIdentifier($providerIdentifier); diff --git a/lib/Controller/TimezoneController.php b/lib/Controller/TimezoneController.php index e3bc6b17..f672cd94 100644 --- a/lib/Controller/TimezoneController.php +++ b/lib/Controller/TimezoneController.php @@ -9,6 +9,8 @@ namespace OCA\UserOIDC\Controller; use OCP\AppFramework\Controller; +use OCP\AppFramework\Http\Attribute\NoAdminRequired; +use OCP\AppFramework\Http\Attribute\UseSession; use OCP\AppFramework\Http\JSONResponse; use OCP\IConfig; use OCP\IRequest; @@ -27,14 +29,13 @@ public function __construct( } /** - * @NoAdminRequired - * @UseSession - * * @param string $timezone * @param int $timezoneOffset * @return JSONResponse * @throws \OCP\PreConditionNotMetException */ + #[NoAdminRequired] + #[UseSession] public function setTimezone(string $timezone, int $timezoneOffset) { $this->config->setUserValue($this->userId, 'core', 'timezone', $timezone); $this->session->set('timezone', $timezoneOffset); diff --git a/src/components/AdminSettings.vue b/src/components/AdminSettings.vue index 54558282..379a82ea 100644 --- a/src/components/AdminSettings.vue +++ b/src/components/AdminSettings.vue @@ -10,40 +10,34 @@

{{ t('user_oidc', 'Allows users to authenticate via OpenID Connect providers.') }}

-

- - {{ t('user_oidc', 'Enable ID4me') }} - -

-

- - {{ t('user_oidc', 'Store login tokens') }} - - - - -

+
+ + + {{ t('user_oidc', 'Enable ID4me') }} + + + {{ t('user_oidc', 'Store login tokens') }} + + + + {{ t('user_oidc', '"Store login tokens" is needed if you are using other apps that want to use user_oidc\'s token exchange or simply get the login token') }} + +
-

+

{{ t('user_oidc', 'Registered Providers') }} - - - - {{ t('user_oidc', 'Register new provider') }} - - + + +