Skip to content

Commit d1d82fc

Browse files
MorrisJobkeMorrisJobke
authored
Merge pull request #12160 from Dagefoerde/stable14-oauth-backports
[stable14] Bruteforce protection handling in combination with
2 parents 41c842f + e3f3212 commit d1d82fc

13 files changed

Lines changed: 73 additions & 17 deletions

File tree

‎apps/oauth2/lib/Controller/OauthApiController.php‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,9 @@
2222
namespace OCA\OAuth2\Controller;
2323

2424
use OC\Authentication\Exceptions\InvalidTokenException;
25-
use OC\Authentication\Token\ExpiredTokenException;
25+
use OC\Authentication\Exceptions\ExpiredTokenException;
2626
use OC\Authentication\Token\IProvider as TokenProvider;
27+
use OC\Security\Bruteforce\Throttler;
2728
use OCA\OAuth2\Db\AccessTokenMapper;
2829
use OCA\OAuth2\Db\ClientMapper;
2930
use OCA\OAuth2\Exceptions\AccessTokenNotFoundException;
@@ -49,6 +50,8 @@ class OauthApiController extends Controller {
4950
private $secureRandom;
5051
/** @var ITimeFactory */
5152
private $time;
53+
/** @var Throttler */
54+
private $throttler;
5255

5356
/**
5457
* @param string $appName
@@ -59,6 +62,7 @@ class OauthApiController extends Controller {
5962
* @param TokenProvider $tokenProvider
6063
* @param ISecureRandom $secureRandom
6164
* @param ITimeFactory $time
65+
* @param Throttler $throttler
6266
*/
6367
public function __construct($appName,
6468
IRequest $request,
@@ -67,14 +71,16 @@ public function __construct($appName,
6771
ClientMapper $clientMapper,
6872
TokenProvider $tokenProvider,
6973
ISecureRandom $secureRandom,
70-
ITimeFactory $time) {
74+
ITimeFactory $time,
75+
Throttler $throttler) {
7176
parent::__construct($appName, $request);
7277
$this->crypto = $crypto;
7378
$this->accessTokenMapper = $accessTokenMapper;
7479
$this->clientMapper = $clientMapper;
7580
$this->tokenProvider = $tokenProvider;
7681
$this->secureRandom = $secureRandom;
7782
$this->time = $time;
83+
$this->throttler = $throttler;
7884
}
7985

8086
/**
@@ -164,6 +170,8 @@ public function getToken($grant_type, $code, $refresh_token, $client_id, $client
164170
$accessToken->setEncryptedToken($this->crypto->encrypt($newToken, $newCode));
165171
$this->accessTokenMapper->update($accessToken);
166172

173+
$this->throttler->resetDelay($this->request->getRemoteAddress(), 'login', ['user' => $appToken->getUID()]);
174+
167175
return new JSONResponse(
168176
[
169177
'access_token' => $newToken,

‎apps/oauth2/tests/Controller/OauthApiControllerTest.php‎

Lines changed: 40 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,10 @@
2222
namespace OCA\OAuth2\Tests\Controller;
2323

2424
use OC\Authentication\Exceptions\InvalidTokenException;
25+
use OC\Authentication\Exceptions\ExpiredTokenException;
2526
use OC\Authentication\Token\DefaultToken;
26-
use OC\Authentication\Token\DefaultTokenMapper;
27-
use OC\Authentication\Token\ExpiredTokenException;
2827
use OC\Authentication\Token\IProvider as TokenProvider;
29-
use OC\Authentication\Token\IToken;
28+
use OC\Security\Bruteforce\Throttler;
3029
use OCA\OAuth2\Controller\OauthApiController;
3130
use OCA\OAuth2\Db\AccessToken;
3231
use OCA\OAuth2\Db\AccessTokenMapper;
@@ -57,6 +56,8 @@ class OauthApiControllerTest extends TestCase {
5756
private $secureRandom;
5857
/** @var ITimeFactory|\PHPUnit_Framework_MockObject_MockObject */
5958
private $time;
59+
/** @var Throttler|\PHPUnit_Framework_MockObject_MockObject */
60+
private $throttler;
6061
/** @var OauthApiController */
6162
private $oauthApiController;
6263

@@ -70,6 +71,7 @@ public function setUp() {
7071
$this->tokenProvider = $this->createMock(TokenProvider::class);
7172
$this->secureRandom = $this->createMock(ISecureRandom::class);
7273
$this->time = $this->createMock(ITimeFactory::class);
74+
$this->throttler = $this->createMock(Throttler::class);
7375

7476
$this->oauthApiController = new OauthApiController(
7577
'oauth2',
@@ -79,7 +81,8 @@ public function setUp() {
7981
$this->clientMapper,
8082
$this->tokenProvider,
8183
$this->secureRandom,
82-
$this->time
84+
$this->time,
85+
$this->throttler
8386
);
8487
}
8588

@@ -286,6 +289,17 @@ public function testGetTokenValidAppToken() {
286289
'user_id' => 'userId',
287290
]);
288291

292+
$this->request->method('getRemoteAddress')
293+
->willReturn('1.2.3.4');
294+
295+
$this->throttler->expects($this->once())
296+
->method('resetDelay')
297+
->with(
298+
'1.2.3.4',
299+
'login',
300+
['user' => 'userId']
301+
);
302+
289303
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'validrefresh', 'clientId', 'clientSecret'));
290304
}
291305

@@ -370,6 +384,17 @@ public function testGetTokenValidAppTokenBasicAuth() {
370384
$this->request->server['PHP_AUTH_USER'] = 'clientId';
371385
$this->request->server['PHP_AUTH_PW'] = 'clientSecret';
372386

387+
$this->request->method('getRemoteAddress')
388+
->willReturn('1.2.3.4');
389+
390+
$this->throttler->expects($this->once())
391+
->method('resetDelay')
392+
->with(
393+
'1.2.3.4',
394+
'login',
395+
['user' => 'userId']
396+
);
397+
373398
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'validrefresh', null, null));
374399
}
375400

@@ -451,6 +476,17 @@ public function testGetTokenExpiredAppToken() {
451476
'user_id' => 'userId',
452477
]);
453478

479+
$this->request->method('getRemoteAddress')
480+
->willReturn('1.2.3.4');
481+
482+
$this->throttler->expects($this->once())
483+
->method('resetDelay')
484+
->with(
485+
'1.2.3.4',
486+
'login',
487+
['user' => 'userId']
488+
);
489+
454490
$this->assertEquals($expected, $this->oauthApiController->getToken('refresh_token', null, 'validrefresh', 'clientId', 'clientSecret'));
455491
}
456492
}

‎lib/composer/composer/autoload_classmap.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -430,6 +430,7 @@
430430
'OC\\Archive\\Archive' => $baseDir . '/lib/private/Archive/Archive.php',
431431
'OC\\Archive\\TAR' => $baseDir . '/lib/private/Archive/TAR.php',
432432
'OC\\Archive\\ZIP' => $baseDir . '/lib/private/Archive/ZIP.php',
433+
'OC\\Authentication\\Exceptions\\ExpiredTokenException' => $baseDir . '/lib/private/Authentication/Exceptions/ExpiredTokenException.php',
433434
'OC\\Authentication\\Exceptions\\InvalidTokenException' => $baseDir . '/lib/private/Authentication/Exceptions/InvalidTokenException.php',
434435
'OC\\Authentication\\Exceptions\\LoginRequiredException' => $baseDir . '/lib/private/Authentication/Exceptions/LoginRequiredException.php',
435436
'OC\\Authentication\\Exceptions\\PasswordLoginForbiddenException' => $baseDir . '/lib/private/Authentication/Exceptions/PasswordLoginForbiddenException.php',
@@ -442,7 +443,6 @@
442443
'OC\\Authentication\\Token\\DefaultTokenCleanupJob' => $baseDir . '/lib/private/Authentication/Token/DefaultTokenCleanupJob.php',
443444
'OC\\Authentication\\Token\\DefaultTokenMapper' => $baseDir . '/lib/private/Authentication/Token/DefaultTokenMapper.php',
444445
'OC\\Authentication\\Token\\DefaultTokenProvider' => $baseDir . '/lib/private/Authentication/Token/DefaultTokenProvider.php',
445-
'OC\\Authentication\\Token\\ExpiredTokenException' => $baseDir . '/lib/private/Authentication/Exceptions/ExpiredTokenException.php',
446446
'OC\\Authentication\\Token\\IProvider' => $baseDir . '/lib/private/Authentication/Token/IProvider.php',
447447
'OC\\Authentication\\Token\\IToken' => $baseDir . '/lib/private/Authentication/Token/IToken.php',
448448
'OC\\Authentication\\Token\\Manager' => $baseDir . '/lib/private/Authentication/Token/Manager.php',

‎lib/composer/composer/autoload_static.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -460,6 +460,7 @@ class ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c
460460
'OC\\Archive\\Archive' => __DIR__ . '/../../..' . '/lib/private/Archive/Archive.php',
461461
'OC\\Archive\\TAR' => __DIR__ . '/../../..' . '/lib/private/Archive/TAR.php',
462462
'OC\\Archive\\ZIP' => __DIR__ . '/../../..' . '/lib/private/Archive/ZIP.php',
463+
'OC\\Authentication\\Exceptions\\ExpiredTokenException' => __DIR__ . '/../../..' . '/lib/private/Authentication/Exceptions/ExpiredTokenException.php',
463464
'OC\\Authentication\\Exceptions\\InvalidTokenException' => __DIR__ . '/../../..' . '/lib/private/Authentication/Exceptions/InvalidTokenException.php',
464465
'OC\\Authentication\\Exceptions\\LoginRequiredException' => __DIR__ . '/../../..' . '/lib/private/Authentication/Exceptions/LoginRequiredException.php',
465466
'OC\\Authentication\\Exceptions\\PasswordLoginForbiddenException' => __DIR__ . '/../../..' . '/lib/private/Authentication/Exceptions/PasswordLoginForbiddenException.php',
@@ -472,7 +473,6 @@ class ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c
472473
'OC\\Authentication\\Token\\DefaultTokenCleanupJob' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/DefaultTokenCleanupJob.php',
473474
'OC\\Authentication\\Token\\DefaultTokenMapper' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/DefaultTokenMapper.php',
474475
'OC\\Authentication\\Token\\DefaultTokenProvider' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/DefaultTokenProvider.php',
475-
'OC\\Authentication\\Token\\ExpiredTokenException' => __DIR__ . '/../../..' . '/lib/private/Authentication/Exceptions/ExpiredTokenException.php',
476476
'OC\\Authentication\\Token\\IProvider' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/IProvider.php',
477477
'OC\\Authentication\\Token\\IToken' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/IToken.php',
478478
'OC\\Authentication\\Token\\Manager' => __DIR__ . '/../../..' . '/lib/private/Authentication/Token/Manager.php',

‎lib/private/Authentication/Exceptions/ExpiredTokenException.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@
2121
* along with this program. If not, see <http://www.gnu.org/licenses/>.
2222
*
2323
*/
24-
namespace OC\Authentication\Token;
24+
namespace OC\Authentication\Exceptions;
2525

26-
use OC\Authentication\Exceptions\InvalidTokenException;
26+
use OC\Authentication\Token\IToken;
2727

2828
class ExpiredTokenException extends InvalidTokenException {
2929
/** @var IToken */

‎lib/private/Authentication/Token/DefaultTokenProvider.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
namespace OC\Authentication\Token;
3030

3131
use Exception;
32+
use OC\Authentication\Exceptions\ExpiredTokenException;
3233
use OC\Authentication\Exceptions\InvalidTokenException;
3334
use OC\Authentication\Exceptions\PasswordlessTokenException;
3435
use OCP\AppFramework\Db\DoesNotExistException;

‎lib/private/Authentication/Token/IProvider.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626

2727
namespace OC\Authentication\Token;
2828

29+
use OC\Authentication\Exceptions\ExpiredTokenException;
2930
use OC\Authentication\Exceptions\InvalidTokenException;
3031
use OC\Authentication\Exceptions\PasswordlessTokenException;
3132

‎lib/private/Authentication/Token/Manager.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323

2424
namespace OC\Authentication\Token;
2525

26+
use OC\Authentication\Exceptions\ExpiredTokenException;
2627
use OC\Authentication\Exceptions\InvalidTokenException;
2728
use OC\Authentication\Exceptions\PasswordlessTokenException;
2829

‎lib/private/Authentication/Token/PublicKeyTokenProvider.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323

2424
namespace OC\Authentication\Token;
2525

26+
use OC\Authentication\Exceptions\ExpiredTokenException;
2627
use OC\Authentication\Exceptions\InvalidTokenException;
2728
use OC\Authentication\Exceptions\PasswordlessTokenException;
2829
use OCP\AppFramework\Db\DoesNotExistException;

‎lib/private/Server.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -753,14 +753,15 @@ public function __construct($webRoot, \OC\Config $config) {
753753
$this->registerService('TrustedDomainHelper', function ($c) {
754754
return new TrustedDomainHelper($this->getConfig());
755755
});
756-
$this->registerService('Throttler', function (Server $c) {
756+
$this->registerService(Throttler::class, function (Server $c) {
757757
return new Throttler(
758758
$c->getDatabaseConnection(),
759759
new TimeFactory(),
760760
$c->getLogger(),
761761
$c->getConfig()
762762
);
763763
});
764+
$this->registerAlias('Throttler', Throttler::class);
764765
$this->registerService('IntegrityCodeChecker', function (Server $c) {
765766
// IConfig and IAppManager requires a working database. This code
766767
// might however be called when ownCloud is not yet setup.

0 commit comments

Comments
 (0)