Commit graph

79 commits

Author SHA1 Message Date
Martin Urbanec 7eefeed2bc SECURITY: Disallow user JS at our special pages
Bug: T243608
Change-Id: Ib0deea7a986dd37f23ad5a68a1fb9784ac346db6
2020-02-13 14:12:28 -06:00
Dejan Savuljesku c943f75cee Fix removing scratch tokens
Due to using unset(), array keys would be preserved, and therefore, for loop would crash.
Now using array_splice, but had to "reset" the values on construct to fix currently broken
arrays.

Bug: T244308
Change-Id: I6f3dd3df95d5a071b92aa7693ed7ae3fddf35a9d
2020-02-05 10:54:25 +01:00
libraryupgrader 5b1a07906a build: Updating mediawiki/mediawiki-codesniffer to 29.0.0
The following sniffs are failing and were disabled:
* MediaWiki.Commenting.FunctionComment.MissingDocumentationPrivate
* MediaWiki.Commenting.FunctionComment.MissingParamName
* MediaWiki.Commenting.FunctionComment.MissingParamTag
* MediaWiki.Commenting.FunctionComment.MissingReturn

Additional changes:
* Also sorted "composer fix" command to run phpcbf last.

Change-Id: Idb1b91244e653b2ba2e27bceb3eba769577124a9
2020-01-14 08:27:31 +00:00
libraryupgrader 28c468b1ca build: Updating mediawiki/mediawiki-phan-config to 0.9.0
Change-Id: Iaac7b5f78f26a083e8ad2d12f9c9c4a9ed246283
2019-12-28 14:40:25 +00:00
Umherirrender 7f39d94d02 Use WebRequest::getBool to have bool cast
Change-Id: Ic6e4db33f3a919ebfa28ea69db4b22c8c7d173fe
2019-12-13 22:45:21 +01:00
Reedy 86986442f9 Remove Oracle and MSSQL schemas
MSSQL schema wasn't even plumbed in...

Change-Id: I07061b5e3ceb2464e6def363c6fe5b18ad4ce225
2019-12-10 14:27:55 +00:00
Dejan Savuljesku 54fc8a0cbf Define fallback for request IP when persisting user
Bug: T237554
Change-Id: I18f57a523a6515f593963a9c149374bd6f6c73b4
2019-12-03 14:34:58 +00:00
Reedy 18c257fa55 Remove ApiOATHValidate::getCacheMode()
It's not a query module, so this doesn't actually do anything.

Non query modules are private by default, so ApiMain->setCacheMode()
is not needed

Change-Id: I789edbf0693f8b1928fb32c3aedc0d8899aecc40
2019-11-12 16:49:51 +00:00
Reedy 1bc446c9ad Remove and fix remaining phpcs exclusions
Change-Id: Ib93f4c70383e838cf28bb07a05ea5d962263d14c
2019-11-09 07:42:58 +00:00
Reedy 659012e543 Remove and fix phpcs exclusion PSR12.Properties.ConstantVisibility.NotFound
Change-Id: I7840910881e18fe76228571c24256c4fa6549c89
2019-11-09 07:15:26 +00:00
Reedy 3132064fe2 Enable schemaUpdateTOTPToMultipleKeys
Change-Id: I6cb10a877652a10412664e124f94c5d0c58932fe
2019-11-04 18:45:22 +00:00
Dejan Savuljesku 98d151fb27 Ask for user re-auth only on initial requests
Make sure user is asked to re-authenticate (if needed) only on initital request,
not after submitting the form

Bug: T235645
Change-Id: Ic315f49ac5810da0a703ccf4b51f558d17f905fb
2019-10-23 09:49:37 +02:00
Dejan Savuljesku 920136e67b Do not store proper objects in session data
Bug: T233146
Change-Id: I2f75261b276993d27f6c96e066ea7769cf7fc082
2019-10-16 13:04:49 +02:00
Dejan Savuljesku a244d95224 Ask user to reauthenticate before changing 2FA method
Re-auth period set to 60s

Bug: T218211
Change-Id: I17a84b8e60da2ada35c6b86cf6b66d75fb3f13fe
2019-10-09 20:45:30 +00:00
Dejan Savuljesku 8ca4dabd70 Add warning page before method gets disabled
- When explictly disabling a method
- When method is implicity disabled if user switches to another method

Bug: T232008
Change-Id: I97a96ca7c1935ecb3a81aea35f607b8ff9f8817d
2019-09-28 16:22:41 +00:00
Dejan Savuljesku ae53dc5c60 Make sure key is of correct type before running operations on it
Bug: T231786
Change-Id: I54aad0753fa3eda48e7f382b27b1c89069f40d36
2019-09-04 11:53:22 +00:00
Dejan Savuljesku 36485440ee Improve ManageForm
Make sure that particular form is only loaded when it actually makes sense
for it to load, not when its just requested.

Bug: T218211
Change-Id: Ibae0279451b4a6a4a1d1ce212bbbbf919900a46d
2019-09-03 14:17:48 +02:00
Dejan Savuljesku 630a17da01 UI upgrade
Help messages for 2FA in general and for TOTP module are taken from Wikipedia.
Those could probably be improved, any suggestions are welcome

Bug: T218214
Bug: T226056
Change-Id: Ifc81a3c0e1adc9f6d0d49e7eee086714fc2c0f81
2019-08-29 10:38:10 +00:00
Dejan Savuljesku 019cf6ccdd Add method to clear all keys associated with the user
This is needed when changing modules, we need to remove all keys
from the old module

Change-Id: Iaada3df631260dbd612cce01f5477e93e6da4596
2019-08-26 12:13:23 +00:00
Aaron Schulz cb4e6a15a6 Make TOTPKey use the main stash for the token key
Change-Id: Idd20c778f7ea1d2393f1e08eb3cf7f74b8ee2b2d
2019-08-12 18:10:10 -07:00
Dejan Savuljesku 6c09ac0c53 Allow revocation of user rights if 2FA isn't enabled on an account
Bug: T199118
Bug: T218215

Change-Id: I7036dd0d95598b90654a1fcf3130c6bdc6b635b4
2019-07-31 13:36:33 +00:00
DannyS712 a9af4e59e1 Hide Special:OATHManage from users who can't use it
Bug: T228609
Change-Id: I3bce2b8ae9316ccc9ee77140de56f616ed981b24
2019-07-27 09:53:33 +00:00
James D. Forrester 142bda9170 build: Upgrade phan-taint-check-plugin from 1.5.x to 2.0.1
Change-Id: I456638fd0b59b0acebcc0e873f171d1ef0f69564
2019-07-11 14:09:30 +00:00
Dejan Savuljesku 017d8c8126 Support for multiple keys, improved module form logic #2
Removed unused classes, missed in previous commits

Bug: T218210

Change-Id: Iaf9facb54cd9693f20ed2f48d22b076c4b626705
2019-07-05 20:23:26 +00:00
rvogel b9f768e20a Refactor includes to src #2
Bug: T218210

Change-Id: I079e6e819c079b68bbfecdac0d873b26d4e16e86
2019-07-04 13:36:13 +00:00
rvogel b04722a1eb Rework the way user interacts with 2FA settings
Bug: T218210

Change-Id: Iaa6f6ae1c25f47ef43a0e6467474284d89a7a213
2019-07-04 12:45:27 +00:00
Reedy 707f33398f Disable autocomplete on 2FA verification fields
For both enabling and disabling 2FA TOTP

Bug: T226049
Change-Id: Ib0f4c8d1d19fe6cdc403ba306ec44dadbe6320c9
2019-06-19 13:21:29 +01:00
Reedy 8099c0ac7d Make token fields always ltr
Bug: T153556
Change-Id: Iff116722e60dee3e370905c9d7d0b2269e1c4c87
2019-06-18 23:36:20 +01:00
Dejan Savuljesku ea984e5c2b Refactor the extension to support multiple auth modules
Please note, this patch requires a schema change before merging

Change-Id: I71286534d21d95083436d64d79811943c1a1d032
ERM: #14484
Bug: T218210
2019-06-18 10:45:21 +00:00