Serge Latyntsev
233e0e7aa0
ENH PasswordExpirationMiddleware implementation ( #9207 )
2019-09-12 14:34:06 +12:00
Robbie Averill
e8c2f963fd
FIX Member::getLastName() now correctly returns the Member surname
2019-09-06 12:12:27 -07:00
Robbie Averill
11a7d6ccb4
Rename test to be clearer about its intent
...
Co-Authored-By: Guy Marriott <guy@scopey.co.nz>
2019-08-16 09:49:36 +12:00
Robbie Averill
bae7e32680
FIX Member::changePassword() no longer applies password validation rules to the hashed value
2019-08-16 09:06:07 +12:00
Serge Latyntsev
7ef13e7ef6
FIX Confirmation components to respect SS_BASE_URL ( #9074 )
2019-07-05 16:05:41 +12:00
Aaron Carlino
c747b1f8d3
Merge branch '4.3' into 4.4
2019-06-10 17:32:07 +12:00
Aaron Carlino
f766555d61
Merge branch '4.2' into 4.3
2019-06-10 17:27:05 +12:00
Serge Latyntcev
ca56e8d78e
[CVE-2019-12246] Denial of Service on flush and development URL tools
2019-06-10 17:23:56 +12:00
Robbie Averill
8a06682e31
Merge branch '4.3' into 4
...
# Conflicts:
# src/ORM/Connect/DBSchemaManager.php
2019-04-11 11:24:17 +12:00
Robbie Averill
123d483213
MemberTest and SecurityTest now set the default authenticator to use
2019-04-05 11:26:29 +13:00
Robbie Averill
7c96feef37
Merge branch '4.3' into 4
2019-01-08 12:27:48 +01:00
Robbie Averill
1ac36611a6
Update tests to pass in CWP kitchen sink context
2018-12-02 23:04:34 +00:00
Loz Calver
3f8551df41
Merge pull request #8462 from sminnee/nondestructive-enum
...
FIX: Make all enums non-destructive, not just ClassName
2018-11-28 16:42:12 +01:00
Robbie Averill
1f1c344272
Merge branch '4.3' into 4
...
# Conflicts:
# tests/php/Forms/ConfirmedPasswordFieldTest.php
2018-11-26 12:15:17 +01:00
Robbie Averill
7d1d6d0f7b
FIX Ensure that tests setting passwords have stubbed configuration
2018-11-14 11:54:17 +02:00
Robbie Averill
0bb94b018b
FIX Remove default password validation rules before running unit tests
2018-11-13 14:09:08 +02:00
Sam Minnee
bd5a815909
FIX: Make all enums non-destructive, not just ClassName
...
This change also renders a portion of DBSchemaManager irrelevant, that
destructively “fixes” old values. This is in keeping with the
non-destructive principle of dev/build, and some suggestions to move
away from enum fields altogether.
Fixes https://github.com/silverstripe/silverstripe-framework/issues/1387
2018-11-10 12:10:25 +13:00
Sam Minnee
5bb2d9484a
FIX: Update “original” DataObject data to be the content of the last write
...
FIX: Compare to original when determining fields changes
This fixes a number of edge-case issues relating to change detection.
Fixes #8443
Fixes #3821
Fixes #4561
2018-11-05 23:09:24 +13:00
Robbie Averill
ee24413c30
Merge branch '4.2' into 4
2018-10-03 15:28:05 +02:00
Robbie Averill
231d6d9a9f
FIX New members now receive the configured default locale, not the current locale
2018-09-28 16:25:10 +02:00
Robbie Averill
f842ee2eec
Update deprecation PHPDocs to be PSR-5 compliant
...
See: https://github.com/php-fig/fig-standards/blob/master/proposed/phpdoc-tags.md#55-deprecated
2018-09-28 10:49:14 +02:00
Robbie Averill
dbab696690
FIX Message when changing password with invalid token now contains correct links to login
...
The Security controller should be used to return these links rather than the
ChangePasswordHandler
2018-08-20 22:30:12 +12:00
Ingo Schommer
c541283093
Test coverage for session data change
2018-07-20 15:13:26 +12:00
Daniel Hensby
560fe9820a
FIX remove personal information from password reset confirmation screen
2018-07-05 14:19:15 +12:00
Damian Mooyman
6da72d686f
Maybe fix it?
2018-06-20 14:46:50 +12:00
Robbie Averill
6d98a912c9
Merge branch 'heads/4.1.1' into 4.1
2018-05-28 18:26:20 +12:00
Robbie Averill
722202fef4
Merge remote-tracking branch 'origin/4.0.4' into 4.1.1
...
# Conflicts:
# src/Control/Director.php
2018-05-24 15:41:11 +12:00
Robbie Averill
e7e32d13a3
FIX Add namespace and encryptor to tests that expect blowfish to be available
2018-05-24 11:24:56 +12:00
Robbie Averill
5887201dd5
Merge pull request #64 from silverstripe-security/pulls/4.0/ss-2018-010
...
[SS-2018-010] Fix regression of SS-2017-002
2018-05-14 17:12:45 +12:00
Robbie Averill
beec0c0d47
[SS-2018-010] Fix regression of SS-2017-002
2018-05-14 17:12:07 +12:00
Damian Mooyman
e409d6f673
[ss-2018-001] Restrict non-admins from being assigned to admin groups
2018-05-14 17:10:22 +12:00
Damian Mooyman
9a12fac218
BUG Prevent password validator min score producing false negatives
...
Replaces #7995
2018-04-18 10:35:31 +12:00
Daniel Hensby
c04ff8c55a
Merge branch '4.0' into 4.1
2018-02-21 13:40:30 +00:00
Damian Mooyman
0e26c06644
BUG Fix behaviour towards versioned but unstagable records
2018-02-20 12:20:18 +13:00
Daniel Hensby
7ec5fa2c8d
Merge branch '4.0' into 4.1
2018-02-09 15:19:15 +00:00
Daniel Hensby
e298fcc345
Merge branch '3.6' into 4.0
2018-02-09 14:32:58 +00:00
Damian Mooyman
2f1f5c0caa
Merge remote-tracking branch 'origin/4.0' into 4
2018-02-07 11:48:46 +13:00
Daniel Hensby
660dfd34a8
FIX Issue where default admin has no password encryption
2018-02-06 20:18:32 +00:00
Christopher Joe
456871fd91
Enhancement Updated PasswordValidator to fallback to config options - still retains instance variables
2018-01-31 10:54:43 +13:00
Damian Mooyman
a3c52f901a
Merge remote-tracking branch 'origin/4.0' into 4
...
# Conflicts:
# src/Core/TempFolder.php
# src/ORM/DataObject.php
# src/View/ThemeResourceLoader.php
# src/includes/constants.php
# tests/php/Control/SimpleResourceURLGeneratorTest.php
# tests/php/Forms/HTMLEditor/HTMLEditorFieldTest.php
# tests/php/View/RequirementsTest.php
2018-01-22 14:57:05 +13:00
Daniel Hensby
db610aaf3b
Fixing string concat CS issues
2018-01-16 18:39:30 +00:00
Daniel Hensby
c959160375
FIX Misnamed test namespaces
2018-01-16 17:41:18 +00:00
Damian Mooyman
c4ff8443bb
API Shift basic auth checking into middleware
...
Fixes #7554
2017-12-20 11:39:04 +13:00
Chris Joe
4ad9ceca6b
Merge pull request #7702 from open-sausages/pulls/4/fix-message-casting-permissions
...
BUG Fix message casting for html security messages
2017-12-18 15:43:35 +13:00
Daniel Hensby
e4bf9a31ed
Merge branch '4.0' into 4
2017-12-14 21:20:11 +00:00
Daniel Hensby
1c72d6946d
Merge branch '3.6' into 4.0
2017-12-14 21:01:35 +00:00
Damian Mooyman
140ed72e2a
BUG Fix message casting for html security messages
2017-12-14 14:49:58 +13:00
Damian Mooyman
33b2d50d59
Cache warming in InheritedPermissions::getCachePermissions()
...
Simplify Group::Members() code
Remove cms-only config
2017-12-12 09:01:43 +13:00
Aaron Carlino
2be902ef2f
Adapt to new MemberCacheFlusher interface
2017-12-11 17:50:11 +13:00
Aaron Carlino
aefb0aeaa8
Make InheritedPermissions use cache and implement cache flushing
2017-12-11 17:50:11 +13:00
Damian Mooyman
ee27329728
Minor linting / style updates
2017-12-11 16:46:59 +13:00
Aaron Carlino
86458941be
Refactor to MemberCacheFlusher
2017-12-11 16:46:59 +13:00
Aaron Carlino
4857816c9e
Revisions per robbieaverill
2017-12-11 16:46:59 +13:00
Aaron Carlino
eecb9f64d3
Add new InheritedPermissionFlusher extension, CacheFlusher service
2017-12-11 16:46:59 +13:00
Damian Mooyman
f1dd3d6f03
[ss-2017-009] Prevent disclosure of sensitive information via LoginAttempt
2017-11-30 17:00:49 +13:00
Damian Mooyman
6a73466b41
BUG Fix basicauth
2017-11-03 12:08:38 +13:00
Robbie Averill
6b52412693
NEW Make Member::changePassword extensible
2017-10-05 11:18:34 +13:00
Mike Cochrane
41d1b2a882
Test fix: Don't hard code the security page_class controller
2017-09-16 11:27:16 +12:00
Daniel Hensby
c0211927aa
Merge branch '3' into 4
2017-08-14 21:18:03 +01:00
Damian Mooyman
b6a8e45888
BUG Ensure mocked controller has request assigned
...
Fixes #7237
2017-08-03 15:52:31 +12:00
Robbie Averill
da4e46e4de
FIX Use merge and set instead of update for config calls
2017-07-17 17:59:40 +12:00
Damian Mooyman
85359ad59e
BUG Ensure that installer can create an initial admin account
...
Fixes #7124
2017-07-06 13:30:04 +12:00
Damian Mooyman
f65e3627dc
BUG Implement or exclude all pending upgrader deltas
2017-07-03 12:21:47 +12:00
Daniel Hensby
c69a565b08
Merge pull request #7046 from andrewandante/FEAT/add_inGroup_to_Group
...
add inGroup(s) methods to Group
2017-06-30 16:38:55 +01:00
Andrew Aitken-Fincham
ab60a167e6
add inGroup(s) methods to Group
2017-06-30 12:47:37 +01:00
Daniel Hensby
30986b4ea3
[SS-2017-002] FIX Lock out users who dont exist in the DB
2017-06-29 13:58:55 +12:00
Ingo Schommer
60a3c8754a
Simplify SecurityTest redirect assertion
...
It causes inexplicable failures in the installer test,
while it's passing running in framework standalone.
This might be related to the cms module being present (with framework tests executed).
Either way, testing that FunctionalTest can follow a redirect
and correctly display the "/" homepage isn't really the point of this test. It should limit its assertion to the presence of a redirect.
See https://travis-ci.org/silverstripe/silverstripe-installer/jobs/246703789
2017-06-27 09:23:37 +12:00
Ingo Schommer
e592bed3e5
Fixed merge error
2017-06-22 23:07:58 +12:00
Damian Mooyman
3873e4ba00
API Refactor bootstrap, request handling
...
See https://github.com/silverstripe/silverstripe-framework/pull/7037
and https://github.com/silverstripe/silverstripe-framework/issues/6681
Squashed commit of the following:
commit 8f65e5653276f95944fa9379834cb4188ce35d827ed4660e7a738f50c4976279d28e5e5c90d53a84f9b2ba47555b59a912b6e2c4a18f635d235e64f3d88d4ed4e4f7946aec3312bd31f936bba97911462a10c2397bd75a8d1d9306364af3c32a278e2953b65c21241bd1d4375c95b220534f06603704165c2f6336a15bfc7188da7da0ae723514ca03395251c66d433977f26ae75c6e001d559662de079c041d
2017-06-22 22:50:45 +12:00
Loz Calver
5d27dccd60
NEW: Add CSRF token to logout action
2017-06-21 15:42:13 +01:00
Damian Mooyman
62d095305b
API Update DefaultAdmin services
...
API Improve validation of authentication process
2017-06-15 15:53:57 +12:00
Simon Erkelens
576eee72dc
Remove DefaultAdmin things from Security and Member into the MemberAuthenticator, unifying and removing duplicate code.
2017-06-15 14:20:29 +12:00
Damian Mooyman
d89bd15330
Move authentication hooks to SapphireTest
2017-06-09 16:25:40 +12:00
Simon Erkelens
082db89550
Feedback from Damian.
...
- Move the success and message to a validationresult
- Fix tests for validationresult return
- We need to clear the session in Test logOut method
- Rename to MemberAuthenticator and CMSMemberAuthenticator for consistency.
- Unify all to getCurrentUser on Security
- ChangePasswordHandler removed from Security
- Update SapphireTest for CMS login/logout
- Get the Member ID correctly, if it's an object.
- Only enable "remember me" when it's allowed.
- Add flag to disable password logging
- Remove Subsites coupling, give it an extension hook to disable itself
- Change cascadeLogInTo to cascadeInTo for the logout method logic naming
- Docblocks
- Basicauth config
2017-06-08 17:50:20 +12:00
Simon Erkelens
2b26cafcff
Separate out the log-out handling.
...
Repairing tests and regressions
Consistently use `Security::getCurrentUser()` and `Security::setCurrentUser()`
Fix for the logout handler to properly logout, some minor wording updates
Remove the login hashes for the member when logging out.
BasicAuth to use `HTTPRequest`
2017-06-07 21:11:58 +12:00
Sam Minnee
f9ea752bae
NEW: Add AuthenticationHandler interface
...
NEW: Add IdentityStore for registering log-in / log-out data
NEW: Add AuthenticationRequestFilter for managing login
NEW: Add Security:setCurrentUser() / Security::getCurrentUser()
NEW: Add FunctionalTest::logOut()
2017-06-07 21:11:55 +12:00
Simon Erkelens
c4194f0ed2
CMS Login Handling
...
Move to canLogin in the authentication check. Protected isLockedOut
Enable login to be called with a different login service (CMSLogin), enabling CMS Log in. Seems the styling and/or output is still broken.
logOut could be managed from the Authenticator instead of the member
2017-06-07 21:11:54 +12:00
Sam Minnee
7af7e6719e
API: Security.authenticators is now a map, not an array
...
Authenticators is now a map of keys -> service names. The key is used
in things such as URL segments. The “default_authenticator” value has
been replaced with the key “default” in this map, although in time a
default authenticator may not be needed.
IX: Refactor login() to avoid code duplication on single/multiple handlers
IX: Refactor LoginHandler to be more amenable to extension
IX: Fixed permissionFailure hack
his LoginHandler is expected to be the starting point for other
custom authenticators so it should be easier to repurpose components
`of it.
IX: Fix database-is-ready checks in tests.
IX: Fixed MemberAuthenticatorTest to match the new API
IX: Update security URLs in MemberTest
2017-06-07 21:11:53 +12:00
Sam Minnee
e226b67d06
Refactoring of authenticators
...
Further down the line, I'm only returning the `Member` on the doLogin, so it's possible for the Handler or Extending Handler to move to a second step.
Also cleaned up some minor typos I ran in to. Nothing major.
This solution works and is manually tested for now. Supports multiple login forms that end up in the correct handler. I haven't gotten past the handler yet, as I've yet to refactor my Yubiauth implementation.
FIX: Corrections to the multi-login-form support.
Importantly, the system provide a URL-space for each handler, e.g.
“Security/login/default” and “Security/login/other”. This is much
cleaner than identifying the active authenticator by a get parameter,
and means that the tabbed interface is only needed on the very first view.
Note that you can test this without a module simply by loading the
default authenticator twice:
SilverStripe\Security\Security:
authenticators:
default: SilverStripe\Security\MemberAuthenticator\Authenticator
other: SilverStripe\Security\MemberAuthenticator\Authenticator
FIX: Refactor delegateToHandler / delegateToHandlers to have less
duplicated code.
2017-06-07 21:11:52 +12:00
Damian Mooyman
fba8e2c245
API Remove Object class
...
API DataObjectSchema::manyManyComponent() return array is now associative array
2017-05-23 13:50:35 +12:00
Damian Mooyman
0b70b008b3
API Implement InheritedPermission calculator ( #6877 )
...
* API Implement InheritedPermission calculator
* API Rename RootPermissions to DefaultPermissionChecker
API Refactor inherited permission fields into InheritedPermissionExtension
API Introduce PermissionChecker interface
2017-05-11 21:07:27 +12:00
Damian Mooyman
942c0257b7
API Upgrade to behat 3
2017-05-05 14:32:07 +12:00
Uncle Cheese
494cbd1875
Ran upgrader for lang files
2017-04-28 14:59:42 +12:00
Simon Erkelens
ff3ad6eb6b
Use Config for authenticator settings
2017-04-22 14:48:56 +12:00
Ingo Schommer
e9693467bf
Fixed tests
2017-04-03 20:04:37 +12:00
Daniel Hensby
ac075eaf0b
Remove TestListener and rely on PHPUnits APIs
2017-03-30 11:46:58 +13:00
Daniel Hensby
0410b4c35e
Respect PHPUnit method visibility
2017-03-24 16:23:03 +13:00
Damian Mooyman
0c41a97a8b
API Refactor Form request handling into FormRequestHandler
...
API Add HasRequestHandler interface
API Refactor Link() and url handling behaviour from Controller into RequestHandler
API RequestHandler classes now must define url_segment to have a default Link()
API Clean up redirectBack()
2017-03-10 15:04:33 +13:00
Damian Mooyman
8444a21cbf
API Upgrade tests to use new Config API
2017-02-27 16:54:01 +13:00
Damian Mooyman
029a8b9586
API Substitute Zend_Currency with NumberFormatter based solution
...
API Substitute Zend_Locale with Locale / NumberFormatter
API Substitute Zend_Date with IntlDateFormatter
API Added DBTIme::Nice12, FormatFromSettings
API Added Short() method to DBDate / DBTime / DBDatetime
API Add Date::getTimestamp()
API Added setSubmittedValue api for FormField
API Add second arg to base FormField::setValue()
API Major refactor of i18n into component data parts
API Implement Resettable interface to reset objects between tests
ENHANCEMENT Changed DBField::create_field return type to `static` to support better type hinting
ENHANCEMENT i18nTextCollector supports __CLASS__
2017-02-09 15:28:59 +13:00
Damian Mooyman
de02a3f733
Restored context parameter to i18n, and added to a “comment” key
...
Rolled pluralisation functionality into the i18n::_t() method
Warnings on missing default can now be turned off
2017-01-25 18:12:40 +13:00
Daniel Hensby
8b4cce435e
Merge branch '3'
2017-01-17 14:17:45 +00:00
Damian Mooyman
7d67c5b9bd
API Allow users to act-as another
2017-01-16 09:04:20 +13:00
Daniel Hensby
faccdef532
Merge pull request #6444 from robbieaverill/feature/add-group-tests
...
TEST Add Group tests for collating family IDs and getting all children
2016-12-29 23:41:31 +00:00
Robbie Averill
b4e183aba5
TEST Add Group tests for collating family IDs and getting all children
2016-12-30 11:27:52 +13:00
Robbie Averill
e8b959864e
TEST Add historical password count test
2016-12-30 00:43:14 +13:00
Damian Mooyman
c2a1e86f5d
Apply PSR2 / Namespace to remaining admin / tests
2016-12-19 16:08:19 +13:00
Damian Mooyman
6e589aac75
API Updates to Form, ValidationResponse, ValidationException
...
API Implement form schema "errors" handling
2016-12-09 14:24:11 +13:00
Sam Minnee
6650561dac
Don't use session and FormSchema to manage server-side React validation responses
2016-12-09 10:27:23 +13:00
Daniel Hensby
1be2e70a2a
Merge branch '3'
2016-11-24 14:18:09 +00:00
