Add 2fa authentication #1031

OscBacon · 2019-06-18T15:32:10Z

No description provided.

composer.json

src/core/Directus/Authentication/Exception/Missing2FAPasswordException.php

Related to PR: directus/v8-archive#1031 Also added missing error codes for 109 and 110

src/core/Directus/Authentication/Exception/TFAEnforcedException.php

rijkvanzanten · 2019-06-21T14:40:45Z

Code LGTM.

rijkvanzanten · 2019-06-21T22:08:10Z

@OscBacon Do you mind also writing some docs on how the feature works? 🙂

rijkvanzanten · 2019-06-21T22:13:14Z

Ohh shit, there's 1 huge problem with this PR: you can't login anymore without running the DB upgrade 😨

The API tries to read the 2fa columns, but they don't exist yet. To make them show up, you have to run the migrations, but you can't make it to settings, because the app can't load:

This means that people will be locked out...... can we think of a way to make this somewhat backwards compatible?

@bjgajjar @benhaynes Can we / should we come up with a way for the API to automatically run the database migrations on first load after a pull? If that's too risky, can we come up with a way for the API to let the application know that the database needs to be upgraded? So far, the DB upgrades have only changed non-critical things like default interfaces or field widths, but this one in particular kinda is a breaking change

OscBacon · 2019-06-24T12:25:56Z

Ohh shit, there's 1 huge problem with this PR: you can't login anymore without running the DB upgrade

The API tries to read the 2fa columns, but they don't exist yet. To make them show up, you have to run the migrations, but you can't make it to settings, because the app can't load:

This means that people will be locked out...... can we think of a way to make this somewhat backwards compatible?

@bjgajjar @benhaynes Can we / should we come up with a way for the API to automatically run the database migrations on first load after a pull? If that's too risky, can we come up with a way for the API to let the application know that the database needs to be upgraded? So far, the DB upgrades have only changed non-critical things like default interfaces or field widths, but this one in particular kinda is a breaking change

What about checking if the 2fa columns exist in functions that use 2fa?
That way we can just ignore 2fa capabilities if they aren't present in the database?

Also, I'll work on the docs tomorrow!

binal-7span · 2019-06-24T13:33:20Z

Hey @OscBacon

The code looks okay to me too. But I think instead of adding enforce_2fa in directus_user_roles we need to add it in directus_settings table.

We just need to check that whether the 2FA is enabled at the site level or not. If it enables at site level then the user will get the option to enable it for them self too.

I am not clear with the use case to enable it as a role specific. Can you please highlight it?

Hey @rijkvanzanten

We can resolve this issue in 2 ways.

We can update the DB using migration command.
We have one option Version and Updates in the Admin Setting. From here we can update the build to the latest one as well as migrate the DB too which we need to develop.

rijkvanzanten · 2019-06-24T13:54:53Z

But I think instead of adding enforce_2fa in directus_user_roles we need to add it in directus_settings table

I don't agree. As admin, you might not need / want to enforce 2fa for literally every user. For example, I would enforce 2fa for all admin users, but leave 'regular' content moderator roles as is, so less tech savvy users don't have to use 2FA. This is less of a security issue, as their permissions are severely restricted anyway.

We can update the DB using migration command.
We have one option Version and Updates in the Admin Setting. From here we can update the build to the latest one as well as migrate the DB too which we need to dev

The second one sounds like the best way forward. Have a button in the application (+ endpoint in the API) that will update the API and run the migrations. The only problem we have then is how to update the application. If the application is on the same server as the API, the API can update the app. If it's not, we have a problem

benhaynes · 2019-06-24T13:56:01Z

Hey @bjgajjar — @OscBacon had originally set this to Global (directus_settings) but since our auth tokens are all based on users, you might have some roles that are used to connect to apps/sites/services... and can't have 2fa. So we decided that attaching this to directus_roles would be more granular.

Does that make sense?

binal-7span · 2019-06-25T05:44:44Z

@rijkvanzanten @benhaynes

Okay, Let me clear both the scenarios here.

(1) Add role specific 2FA (directus_user_role)

2FA will be enabled based on the role. If admin enables it only for admin, then only admin will get the option of 2FA in their profile. They can enable/disable from there. Except admin none of any users will get the option for this.

(2) Add 2FA as a site level (directus_settings)

From the global setting; admin will set that the 2FA is enabled/disabled for the the whole site. If it is enabled then all the users(contains all roles) will get the option to enable/disable the 2FA from their profile; otherwise, none of them will able to do so.

I would enforce 2fa for all admin users, but leave 'regular' content moderator roles as is, so less tech-savvy users don't have to use 2FA.

P.S. When admin enables it for a site level it doesn't mean that it will enable for all the system users automatically. User needs to enable it for themselves manually from their profiles. The same flow will go with the role-specific condition. When 2FA enable for any role, then it will not enables 2FA for the users of that role automatically. They need to enable it from their profile only as all the users have their own 2FA secret.

Let me know your thoughts.

rijkvanzanten · 2019-06-25T16:48:39Z

2FA will be enabled based on the role. If admin enables it only for admin, then only admin will get the option of 2FA in their profile. They can enable/disable from there. Except admin none of any users will get the option for this.

No, everyone has the ability to turn on 2FA. The toggle in the role settings is enforcing it. EG the user has to have 2fa enabled.

I think you misunderstood the role / site level 2FA enforcement

OscBacon · 2019-07-11T08:04:48Z

Hey @bjgajjar @benhaynes @rijkvanzanten
We still have the incompatibility issue where if someone doesn't migrate the db, they will run into issues. Do you have a final thought on how to fix this?

rijkvanzanten · 2019-07-11T15:28:12Z

I think we should add a check that either checks availability of this column based on the latest run migration, or based on the existence of the column itself, instead of trying to read it and fail.

Ideally, we can have a way to 'force' the user into a database upgrade on login, but seeing that that's a big new feature, it'll probably take too long to implement to have this wait on that.

binal-7span · 2019-07-12T04:59:49Z

Hey @rijkvanzanten,

I guess now its a time to develop this feature where the user will not able to use neither API nor APP if they have any migration which has been not executed yet. Maybe it will take some time but it will be worth it. As without this feature, we are not able to merge our major functionality which has been built; 2FA.

From the API, one particular status code will be sent along with an error message if there is any migration which is not executed yet.
In the APP, if that status code had returned from API then the user will be redirected to that page from where they can migrate DB. After the migration process has been completed, the user will able to use the APP.

Let me know your thoughts here. So we can start the work :)

OscBacon · 2019-07-12T13:12:07Z

What we could do is that in the Phinx/Migration/Manager.php, there is a way to compare what has already been migrated (versions) to the migrations available (migrations)

Why not use that and make it so that if versions != migrations, we send an error ?

(Full relative path: vendor/robmorgan/phinx/src/Phinx/Migration/Manager.php)

rijkvanzanten · 2019-07-12T14:26:13Z

@bjgajjar You are right. I just didn't know how long it would take!

Lets discuss this further in #1107

benhaynes · 2019-07-12T14:27:46Z

If we're redirecting, then it might be good to have this App page completed:

https://github.com/directus/app/issues/1370

That way they can get more information (beyond just clicking a button). Also, I worry about small migrations causing API downtime — especially for small migrations that wouldn't normally affect the API responses (like removing a field from users). Could we still return API responses like normal, but still have the error message let the user/app know what needs to happen?

Or maybe I'm overthinking it and we should just force them. 🤔

rijkvanzanten · 2019-07-12T14:33:14Z

@benhaynes The API will continue to work as normal*

* Unless the migrations are a breaking change, as is the case with 2FA

Also, lets discuss this in #1107 instead of this unrelated PR

…otp check

… for user

Fixes crash when has2FAEnforced is called on a DB that hasn't been migrated

binal-7span · 2019-08-13T08:06:08Z

src/core/Directus/Services/ItemsService.php

+                                    $params
+                                );
+                                $individual[$columnName] = array_key_exists($columnName, $individual) ? $individual[$columnName]: (isset($relationalCollectionData['data'][$columnName]) ? ((DataTypes::isJson($column->getType()) ? (array) $relationalCollectionData['data'][$columnName] : $relationalCollectionData['data'][$columnName])) : null);
+                            }


This is an unwanted code which may come with conflict. We dont need this. Kindly remove it from this PR.

binal-7span · 2019-08-13T09:39:29Z

@OscBacon

Still, we have one issue here.

When disable the enforce 2FA from the particular role; the 2fa_secret field of directus_users remains the same(Not Null). That's why getting the screen of a passcode after login although admin disables the enforcing for that role.

Kindly set 2fa_secret field of directus_users as null when disable the enforce 2FA from the particular role.

As well as the changes of src/core/Directus/Services/ItemsService.php file are unwanted. You must remove that code as I replaced it already in older PR. Kindly take care when you are taking the pull and resolve any conflicts.

OscBacon · 2019-08-13T11:52:14Z

Hi @bjgajjar,
"enforce" means the user should be forced to use 2fa. The idea is that if 2fa is not enforced, then 2fa is optional for that user. If a user has activated 2fa, shouldn't they keep their 2fa?

@kaushal-im any thoughts on this too?

binal-7span · 2019-08-13T11:55:43Z

If a user has activated 2fa, shouldn't they keep their 2fa?

Agree with you here :) Yeah that's not an issue! I'll remove unwanted code and will merge the PR :)

kaushal-im · 2019-08-13T12:26:29Z

@OscBacon Seems perfect. Thanks for your contribution ❤

OscBacon · 2019-08-13T12:29:30Z

Thanks @kaushal-im, glad it all came together! 😊

* Issue Fix #1180 (#1183) * Issue fix #1191 (#1192) * Issue fix #1196 (#1197) * Add 2fa authentication (#1031) * Parent + Nested validation changes (#1138) * Add migration schema for 2FA Secret user field * Add 2fa_secret field to FieldsSeeder * Create Missing 2FA Password Exception * Add googleauthenticator dependency * Add getter for User's 2FA secret * Check for otp param in login request, and login with it * Add enforce_2fa parameter to directus_settings * Create Utils endpoint and service method to generate 2fa secret * Add enforce_2fa field to roles * Add enforce_2fa field to FieldsSeeder * Change Missing2FAPasswordException error code to 111 * Change 2FA Library * Change 2fa_secret interface in FieldsSeeder * Created exception for invalid otp * Changed findUserWithCredentials to through an InvalidOTPException on otp check * Created new exception if 2fa is enforced but not enabled by user * Added function to check if 2fa is enforced for a user * Check in AuthenticationMiddleware whether 2fa is enforced and enabled for user * Add optional needs2FA field to auth token and on token refresh * Catch error if enforce_2fa column doesn't exist Fixes crash when has2FAEnforced is called on a DB that hasn't been migrated * Use relative positions for target path array to check user edit * Fix unset on payload_arr instead of payload * Change 2FA activation on login to use activate2FA endpoint * Update ItemsService.php * Issue Fix #1194 (#1195) * Issue Fix #1194 * Update comment * Valildation issue of O2M/M2O at insertion (#1198) * Fox #1201 (#1202) * Fix #1203 (#1204) * Update collections() method in types.php (#1184) There are cases when $type is not a string but an object that inherits from ObjectType. In that situation array_key_exists failing because it should get only integers or strings as a first parameter. So in order to avoid that the 'name' property of the object is used as a key. * Improve YouTube Embed Provider (#1210) Adds in detection and parsing for youtu.be shorthand URLs. * Add check for environment on bootstrap (#1215) * Fix #1186 [Create new error code for invalid login entity] (#1218) * Fix #1217 (Changing password over the CLI doesn't work) (#1220) * Feature/audio video upload (#1214) * added file meta data for audio/video * updates as per PR feedback * Fix #1207 [Permission denied issue when using translation interface] (#1221) * Bump version to v2.5.0

* Issue Fix #1180 (#1183) * Issue fix #1191 (#1192) * Issue fix #1196 (#1197) * Add 2fa authentication (#1031) * Parent + Nested validation changes (#1138) * Add migration schema for 2FA Secret user field * Add 2fa_secret field to FieldsSeeder * Create Missing 2FA Password Exception * Add googleauthenticator dependency * Add getter for User's 2FA secret * Check for otp param in login request, and login with it * Add enforce_2fa parameter to directus_settings * Create Utils endpoint and service method to generate 2fa secret * Add enforce_2fa field to roles * Add enforce_2fa field to FieldsSeeder * Change Missing2FAPasswordException error code to 111 * Change 2FA Library * Change 2fa_secret interface in FieldsSeeder * Created exception for invalid otp * Changed findUserWithCredentials to through an InvalidOTPException on otp check * Created new exception if 2fa is enforced but not enabled by user * Added function to check if 2fa is enforced for a user * Check in AuthenticationMiddleware whether 2fa is enforced and enabled for user * Add optional needs2FA field to auth token and on token refresh * Catch error if enforce_2fa column doesn't exist Fixes crash when has2FAEnforced is called on a DB that hasn't been migrated * Use relative positions for target path array to check user edit * Fix unset on payload_arr instead of payload * Change 2FA activation on login to use activate2FA endpoint * Update ItemsService.php * Issue Fix #1194 (#1195) * Issue Fix #1194 * Update comment * Valildation issue of O2M/M2O at insertion (#1198) * Fox #1201 (#1202) * Fix #1203 (#1204) * Update collections() method in types.php (#1184) There are cases when $type is not a string but an object that inherits from ObjectType. In that situation array_key_exists failing because it should get only integers or strings as a first parameter. So in order to avoid that the 'name' property of the object is used as a key. * Improve YouTube Embed Provider (#1210) Adds in detection and parsing for youtu.be shorthand URLs. * Add check for environment on bootstrap (#1215) * Fix #1186 [Create new error code for invalid login entity] (#1218) * Fix #1217 (Changing password over the CLI doesn't work) (#1220) * Feature/audio video upload (#1214) * added file meta data for audio/video * updates as per PR feedback * Fix #1207 [Permission denied issue when using translation interface] (#1221) * Fix for smtp send mail issue #1205 (#1223) * Fix for smtp send mail issue #1205 Missing additional config settings #1205 * Update Schema.php * Fix 1232[Auth token is not refreshed] (#1233) * Change Authencation Error code to 114 from 109 (#1231) * Fix issue while update item. (#1224) * #1227 : Ignore all the alias fields except file interface (#1240) * Fix #1224 [Deletion of m2o/o2m field error for enabled cache] (#1241) * Fix 845 (#1244) * Change namespace for PHPUnit. * Removing old tests. * Fix #1238 [PDF support for Embedded URL] (#1245) * Fix #1238[PDF support for Embedded URL] * Add array support * Update comment * Update Files.php * Fix #1243[Dynamic charset for DB] (#1246) * Fix #1249[saveData: height is set to width] (#1251) * Fix #2017[Renaming `Public` role gives `unauthorized` error on API calls] (#1253) * Revert "Fix #2017[Renaming `Public` role gives `unauthorized` error on API calls] (#1253)" (#1254) This reverts commit 7fe9056. * FIX/core/Directus/Files.php: return $height instead of $width (#1250) * Fix #1255 [Add support of batch Create/Update/Delete for user] (#1257) * Fix #1255 [Support batch create/update/delete for user] * Add exception * Fix directus/app#2017 (#1256) * Fix #2017[Renaming `Public` role gives `unauthorized` error on API calls] * src * Remove unwanted file from use * Fix #729 [Can't properly query nested fields on Files field] (#1260) * #1216 : Solved issue in O2M relationship of table itself (#1259) * Fix #1209 [M2M relation with directus_collections cant be saved] (#1261) * Fix #1209[M2M relation with directus_collections cant be saved] * Implement condition on update * Define variable * Fix #1209[M2M relation with directus_collections cant be saved] * 🙆🏻‍♂️ * Fix #1266 (#1267) * Fix Warning: Cannot use a scalar value as an array in /src/core/Directus/Config/StatusMapping.php on line 103 (#1268) * Fix Notice: Undefined variable: filterFields in src/core/Directus/Database/TableGateway/RelationalTableGateway.php on line 2125 (#1270) * Fix #1237 (#1265) * Project name fix (#1272) * Adds support for environment variables in CLI (#1276) * Cleans up some unused/deprecated files in the repository (#1277) * Fix #1248 [API cannot go into deeper on user data] (#1282) * Add proper exit codes for CLI (#1281) * Fix cache.enabled not respected in cache service (#1273) This fixes an issue where cache.enabled is false but caching is still working. * Add CLI cache:clear (#1274) * Fix #1284[Broken user related fields] (#1287) * Fix #1279 [wysiwyg-full - add image - Call to a member function isOneToMany() on null] (#1288) * fixed bug with incorrect height (#1293) * Bump version

* Issue Fix #1180 (#1183) * Issue fix #1191 (#1192) * Issue fix #1196 (#1197) * Add 2fa authentication (#1031) * Parent + Nested validation changes (#1138) * Add migration schema for 2FA Secret user field * Add 2fa_secret field to FieldsSeeder * Create Missing 2FA Password Exception * Add googleauthenticator dependency * Add getter for User's 2FA secret * Check for otp param in login request, and login with it * Add enforce_2fa parameter to directus_settings * Create Utils endpoint and service method to generate 2fa secret * Add enforce_2fa field to roles * Add enforce_2fa field to FieldsSeeder * Change Missing2FAPasswordException error code to 111 * Change 2FA Library * Change 2fa_secret interface in FieldsSeeder * Created exception for invalid otp * Changed findUserWithCredentials to through an InvalidOTPException on otp check * Created new exception if 2fa is enforced but not enabled by user * Added function to check if 2fa is enforced for a user * Check in AuthenticationMiddleware whether 2fa is enforced and enabled for user * Add optional needs2FA field to auth token and on token refresh * Catch error if enforce_2fa column doesn't exist Fixes crash when has2FAEnforced is called on a DB that hasn't been migrated * Use relative positions for target path array to check user edit * Fix unset on payload_arr instead of payload * Change 2FA activation on login to use activate2FA endpoint * Update ItemsService.php * Issue Fix #1194 (#1195) * Issue Fix #1194 * Update comment * Valildation issue of O2M/M2O at insertion (#1198) * Fox #1201 (#1202) * Fix #1203 (#1204) * Update collections() method in types.php (#1184) There are cases when $type is not a string but an object that inherits from ObjectType. In that situation array_key_exists failing because it should get only integers or strings as a first parameter. So in order to avoid that the 'name' property of the object is used as a key. * Improve YouTube Embed Provider (#1210) Adds in detection and parsing for youtu.be shorthand URLs. * Add check for environment on bootstrap (#1215) * Fix #1186 [Create new error code for invalid login entity] (#1218) * Fix #1217 (Changing password over the CLI doesn't work) (#1220) * Feature/audio video upload (#1214) * added file meta data for audio/video * updates as per PR feedback * Fix #1207 [Permission denied issue when using translation interface] (#1221) * Fix for smtp send mail issue #1205 (#1223) * Fix for smtp send mail issue #1205 Missing additional config settings #1205 * Update Schema.php * Fix 1232[Auth token is not refreshed] (#1233) * Change Authencation Error code to 114 from 109 (#1231) * Fix issue while update item. (#1224) * #1227 : Ignore all the alias fields except file interface (#1240) * Fix #1224 [Deletion of m2o/o2m field error for enabled cache] (#1241) * Fix 845 (#1244) * Change namespace for PHPUnit. * Removing old tests. * Fix #1238 [PDF support for Embedded URL] (#1245) * Fix #1238[PDF support for Embedded URL] * Add array support * Update comment * Update Files.php * Fix #1243[Dynamic charset for DB] (#1246) * Fix #1249[saveData: height is set to width] (#1251) * Fix #2017[Renaming `Public` role gives `unauthorized` error on API calls] (#1253) * Revert "Fix #2017[Renaming `Public` role gives `unauthorized` error on API calls] (#1253)" (#1254) This reverts commit 7fe9056. * FIX/core/Directus/Files.php: return $height instead of $width (#1250) * Fix #1255 [Add support of batch Create/Update/Delete for user] (#1257) * Fix #1255 [Support batch create/update/delete for user] * Add exception * Fix directus/app#2017 (#1256) * Fix #2017[Renaming `Public` role gives `unauthorized` error on API calls] * src * Remove unwanted file from use * Fix #729 [Can't properly query nested fields on Files field] (#1260) * #1216 : Solved issue in O2M relationship of table itself (#1259) * Fix #1209 [M2M relation with directus_collections cant be saved] (#1261) * Fix #1209[M2M relation with directus_collections cant be saved] * Implement condition on update * Define variable * Fix #1209[M2M relation with directus_collections cant be saved] * 🙆🏻‍♂️ * Fix #1266 (#1267) * Fix Warning: Cannot use a scalar value as an array in /src/core/Directus/Config/StatusMapping.php on line 103 (#1268) * Fix Notice: Undefined variable: filterFields in src/core/Directus/Database/TableGateway/RelationalTableGateway.php on line 2125 (#1270) * Fix #1237 (#1265) * Project name fix (#1272) * Adds support for environment variables in CLI (#1276) * Cleans up some unused/deprecated files in the repository (#1277) * Fix #1248 [API cannot go into deeper on user data] (#1282) * Add proper exit codes for CLI (#1281) * Fix cache.enabled not respected in cache service (#1273) This fixes an issue where cache.enabled is false but caching is still working. * Add CLI cache:clear (#1274) * Fix #1284[Broken user related fields] (#1287) * Fix #1279 [wysiwyg-full - add image - Call to a member function isOneToMany() on null] (#1288) * fixed bug with incorrect height (#1293) * Execute migrations automatically (#1296) * Remove middleware for register webhook and add it before registeration of hooks * Need to add middleware for directory dependency * Fix #1302 - Internal server error when selecting/checking a Checkbox Relational field after deleting some of the related items (#1307) * Fix #1308 - Checkbox-relational field issue when unchecking value (#1309) * Fix #1308 - Checkbox-relational field issue when unchecking value * Update RelationalTableGateway.php * Add Aliyun OSS settings to config schema (#1299) * Extend config schema to support PDO options. (#1295) * Extend config schema to support PDO options. * Make driver_options database config setting optional. * Replcae with getQueryParams method of slim (#1313) * Fix Undefined Variable - /src/core/Directus/Console/Common/Setting.php on line 24 (#1314) * Replace with getQueryParams method of slim (#1317) * Fix response data contains json object instead of array (#1318) * Fix #1310[Resolve issue with updatingNestd m2o/o2m/m2m] (#1320) * Fix #1321 [Resolve bug with system date and system user validation] (#1322) * Resolve Authentication token issue after upgrade to 2.6.0 (#1326) * Fix #1329 [Add new fields to / endpoint] (#1332) * Fix #1329 * Fix #1329 [Add new fields to / endpoint] * fix issue #1330 (#1331) * Rename color with project_color key (#1334) * Fix #1333 [Return Unauthorised when public role not have the respected permission] (#1336) * Fix #1333 [Return Unauthorized when public role not have the respected permission * Add comment * Session-based auth flow along with kill functionality (#1280) * Fix #1263[Rethink Auth Flow] * Kill User Session * Add Expiry time * Expire and cookie * Auth Flow - Modify code base * Resolve browser cache remove issue * Remove PHPSESSIONID reset code * Cookie name based on projject name, Merge authentication endpoint * Support of mode in sso * Add seeder into migrations * Remove warning of container * Add required flag for user in fields table from migrations * Add endpoint to fetch the user's session * Update user's session to loggedin user session endpoint * Allow cross origin cookie * Set credentials response header dynamically * Fix empty FK - do not continue if FK is empty, otherwise, it will not display the entry as if it was not saved. (#1342) * Fix #1343 [Update directus_files field type] (#1346) * fix parsing env variables (#1347) * Fix CORS issue for system endpoint (#1352) * Fix #1348 (#1353) * Fix wrong chache naming. (#1354) * Fix issue when deleting a file and saving the item (#1360) * Fix #1359 [Pagination not working] (#1362) * fix readme ( branch to submit PRs "master" -> "develop") (#1365) * Ignore ddev config folder * Fix unaccessible public endpoints (#1367) * Fix CORS origin * for public preflight endpoints (#1369) * add gitpod.io support (#1356) * Add requires2FA flag at / endpoint (#1370) * Set default value if the value is not set (#1373) * CORS issue for public endpoint (#1374) * Fix Warning: Illegal string offset 'field' in src/endpoints/Settings.php on line 89 when query param contains single=1 (#1375) * Fix Warning: Illegal string offset 'field' in src/endpoints/Settings.php on line 89 when query param contains single=1 * Update Settings.php * Resolve undefined class ArrayUtils error * Fetch single sign on providers * style updates (#1382) * Update withHeaders + add note * Fix #1384 [Remove entries from directus_relations on delete the collection] (#1386) * Fix #1381 [Throwing 500 response code on mail sending fail] (#1387) * Fix #1329 [Update the name of variable from settings table] (#1389) * Fix #1329 [Update the name of variable from settings table] * Update comment * Fix the general settings schema upgrade - consider the new installation as well with already existing fields (#1391) * New project flow (#1399) * Replace migrations file from config folder to migrations folder * Return the project list * Remove unwanted code * Projects endpoint * Remove unwanted code * Remove unwanted code * Remove unwanted code * Remove default _ for secretkey and newtimzone function of datetimeutil * Check requirement endpoint (#1398) * Check requirement endpoint * Add endpoint * Update ProjectService.php * Don't verify super admin with hashing * Remove warning of non static method 'createJsonFileContent' for project create * Remove _ as private flas (#1403) * Remove password_verfiy and add equals operator * Fix integrity constraint (#1400) * Update 2FA flow to work with cookies Squashed commit of the following: commit a543c44 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Fri Nov 8 16:20:45 2019 -0500 Use correct response format for 2fa util commit ab06c55 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Fri Nov 8 15:42:35 2019 -0500 Rename activate2FA to activate_2fa and allow `me` for user updates commit 7b429ab Author: Binal Gajjar <binal.gajjar7@gmail.com> Date: Fri Nov 8 22:46:30 2019 +0530 Set NULL if data array is empty commit c5c7bf6 Author: Binal Gajjar <binal.gajjar7@gmail.com> Date: Fri Nov 8 22:37:17 2019 +0530 Remove needs2FA param from authtoken commit 5b4b21a Author: Binal Gajjar <binal.gajjar7@gmail.com> Date: Fri Nov 8 22:35:41 2019 +0530 Throw error if 2FA is not enabled * clearer existing install response * update error message * Fix #1380 [Set default requires2FA flag] (#1388) * Redirect the users to /admin in sso (#1407) * Redirect the users to /admin in sso * 2FA flow for SSO * Remove unwanted file from use statement * Default to UTC timezone on new project installs (when there's no config) * update sso icon colors * Update the size of token field * Update the size of token field * Update the size of static token * Resolve redirection to /admin? Resolve redirection to `/admin?` instead of `/admin` * Add missing 2fa secret column in seeds * Throw exception for SSO (#1411) * Redirect the users to /admin in sso * 2FA flow for SSO * Remove unwanted file from use statement * Throw the exception when 2FA enforced or enabled * Fix 2fa column * Fix 2fa column * Ignore the files which start with _ * Restrict private and _ project from listing (#1415) * Restrict private files from listing * Return the filename instead of projectname from scan funciton * Add a validation of boolean to private flag. * Fix #1395[/server/ping should ignore project] (#1416) * Update error code for unknown project exception * Update FieldsConfig.php (#1413) Without this fix the GrapQL query brings values only in case when the M2M field has exactly the same name as the related collection. It can be ok, but for cases when it's required to have mutliple M2M fields pointing to the same collection, (e.g. there 2 collections - games and tags, and so we need to specify Primary and Secondary tags for each game). So with current implementation we cannot create primaryTags and secondaryTag fields, we should use 'tags' field instead, but its only one, and we need 2. So this fix obtaining fieldName from parameters and using it for relation and not a collection name. * Remove unwanted files (#1421) * V8.0.0 (#1414) * Redirect to correct endpoint for app * Redirect to admin based on relative url (works in sub-folder) * Update request / reset password to be all app based * Add trailing slash to admin redirect * Add project key to reset password * Restrict private and _ project from listing (#1415) * Restrict private files from listing * Return the filename instead of projectname from scan funciton * Add a validation of boolean to private flag. * Add redirect_url param * update settings seeder to contain all default options * public role description * relations alpha order * Fix false positive in sso 2fa block * add enforce_2fa to roles * activity seeder updates icons and widths * seeder for directus files need to check “description” options array format * directus settings seeder updates * Add support for webhooks Squashed commit of the following: commit ce6ffac Merge: 667d960 e0630e8 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Tue Nov 12 11:51:19 2019 -0500 Merge branch 'develop' into webhooks commit 667d960 Merge: be83925 557a83b Author: rijkvanzanten <rijkvanzanten@me.com> Date: Tue Nov 12 11:17:11 2019 -0500 Merge branch 'v8.0.0' into webhooks commit be83925 Merge: f51c51a 41fd0b6 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Tue Nov 12 11:17:07 2019 -0500 Merge branch 'develop' into webhooks commit 557a83b Author: rijkvanzanten <rijkvanzanten@me.com> Date: Tue Nov 12 10:54:13 2019 -0500 Fix false positive in sso 2fa block commit 0989b31 Author: Ben Haynes <ben@rngr.org> Date: Tue Nov 12 10:49:54 2019 -0500 relations alpha order commit 8f15ad6 Author: Ben Haynes <ben@rngr.org> Date: Tue Nov 12 10:49:42 2019 -0500 public role description commit 555ba2f Author: Ben Haynes <ben@rngr.org> Date: Tue Nov 12 10:46:22 2019 -0500 update settings seeder to contain all default options commit 9816a4a Author: Binal Gajjar <binal.gajjar7@gmail.com> Date: Tue Nov 12 20:41:54 2019 +0530 Add redirect_url param commit 3ba3708 Merge: 379457d 0629167 Author: Binal Gajjar <binal.gajjar7@gmail.com> Date: Tue Nov 12 20:30:11 2019 +0530 Merge branch 'v8.0.0' of https://github.com/directus/api into v8.0.0 commit 0629167 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Mon Nov 11 18:33:17 2019 -0500 Add project key to reset password commit 2bcd474 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Mon Nov 11 18:33:05 2019 -0500 Add trailing slash to admin redirect commit 4a0ccf6 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Mon Nov 11 16:13:34 2019 -0500 Update request / reset password to be all app based commit e42fbf9 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Mon Nov 11 16:13:05 2019 -0500 Redirect to admin based on relative url (works in sub-folder) commit 9f24d50 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Mon Nov 11 15:17:59 2019 -0500 Redirect to correct endpoint for app commit f51c51a Author: Binal Gajjar <binal.gajjar7@gmail.com> Date: Fri Nov 8 22:44:15 2019 +0530 Webhook Implementation (#1304) * Webhook implementation * Webhook development * Fix 29 * Register the webhook * Webhook seed transfer into migrations * Update default seeder * Update comment * Update comment * Add Status Field * directus users seeds * remove unused seeder data * missing comma * Added missing comma * settings defaults * setup telemetry and default locale * Remove directus activity seen table (#1422) * Remove directus activity seen * Revert back the activity seen field from upgrades * webhooks seeds * webhooks update * Rename webhook draft->inactive published->active + delete deleted * update webhooks schema migrations * webhooks url placeholder * Use collections interface for collection chooser on webhooks * webhooks info * Don't enforce user.locale to be set * Bump version * hide dividers on browse * nice defaults for webhooks layout * better webhooks layout * Revert "Fix issue when deleting a file and saving the item (#1360)" (#1423) This reverts commit 37ef295. * Revert "Fix the general settings schema upgrade - consider the new installation as well with already existing fields (#1391)" (#1424) This reverts commit 483e065. * Update the current migrations for remove unwanted code and update the icons (#1425)

* Issue Fix #1180 (#1183) * Issue fix #1191 (#1192) * Issue fix #1196 (#1197) * Add 2fa authentication (#1031) * Parent + Nested validation changes (#1138) * Add migration schema for 2FA Secret user field * Add 2fa_secret field to FieldsSeeder * Create Missing 2FA Password Exception * Add googleauthenticator dependency * Add getter for User's 2FA secret * Check for otp param in login request, and login with it * Add enforce_2fa parameter to directus_settings * Create Utils endpoint and service method to generate 2fa secret * Add enforce_2fa field to roles * Add enforce_2fa field to FieldsSeeder * Change Missing2FAPasswordException error code to 111 * Change 2FA Library * Change 2fa_secret interface in FieldsSeeder * Created exception for invalid otp * Changed findUserWithCredentials to through an InvalidOTPException on otp check * Created new exception if 2fa is enforced but not enabled by user * Added function to check if 2fa is enforced for a user * Check in AuthenticationMiddleware whether 2fa is enforced and enabled for user * Add optional needs2FA field to auth token and on token refresh * Catch error if enforce_2fa column doesn't exist Fixes crash when has2FAEnforced is called on a DB that hasn't been migrated * Use relative positions for target path array to check user edit * Fix unset on payload_arr instead of payload * Change 2FA activation on login to use activate2FA endpoint * Update ItemsService.php * Issue Fix #1194 (#1195) * Issue Fix #1194 * Update comment * Valildation issue of O2M/M2O at insertion (#1198) * Fox #1201 (#1202) * Fix #1203 (#1204) * Update collections() method in types.php (#1184) There are cases when $type is not a string but an object that inherits from ObjectType. In that situation array_key_exists failing because it should get only integers or strings as a first parameter. So in order to avoid that the 'name' property of the object is used as a key. * Improve YouTube Embed Provider (#1210) Adds in detection and parsing for youtu.be shorthand URLs. * Add check for environment on bootstrap (#1215) * Fix #1186 [Create new error code for invalid login entity] (#1218) * Fix #1217 (Changing password over the CLI doesn't work) (#1220) * Feature/audio video upload (#1214) * added file meta data for audio/video * updates as per PR feedback * Fix #1207 [Permission denied issue when using translation interface] (#1221) * Fix for smtp send mail issue #1205 (#1223) * Fix for smtp send mail issue #1205 Missing additional config settings #1205 * Update Schema.php * Fix 1232[Auth token is not refreshed] (#1233) * Change Authencation Error code to 114 from 109 (#1231) * Fix issue while update item. (#1224) * #1227 : Ignore all the alias fields except file interface (#1240) * Fix #1224 [Deletion of m2o/o2m field error for enabled cache] (#1241) * Fix 845 (#1244) * Change namespace for PHPUnit. * Removing old tests. * Fix #1238 [PDF support for Embedded URL] (#1245) * Fix #1238[PDF support for Embedded URL] * Add array support * Update comment * Update Files.php * Fix #1243[Dynamic charset for DB] (#1246) * Fix #1249[saveData: height is set to width] (#1251) * Fix #2017[Renaming `Public` role gives `unauthorized` error on API calls] (#1253) * Revert "Fix #2017[Renaming `Public` role gives `unauthorized` error on API calls] (#1253)" (#1254) This reverts commit 7fe9056. * FIX/core/Directus/Files.php: return $height instead of $width (#1250) * Fix #1255 [Add support of batch Create/Update/Delete for user] (#1257) * Fix #1255 [Support batch create/update/delete for user] * Add exception * Fix directus/app#2017 (#1256) * Fix #2017[Renaming `Public` role gives `unauthorized` error on API calls] * src * Remove unwanted file from use * Fix #729 [Can't properly query nested fields on Files field] (#1260) * #1216 : Solved issue in O2M relationship of table itself (#1259) * Fix #1209 [M2M relation with directus_collections cant be saved] (#1261) * Fix #1209[M2M relation with directus_collections cant be saved] * Implement condition on update * Define variable * Fix #1209[M2M relation with directus_collections cant be saved] * 🙆🏻‍♂️ * Fix #1266 (#1267) * Fix Warning: Cannot use a scalar value as an array in /src/core/Directus/Config/StatusMapping.php on line 103 (#1268) * Fix Notice: Undefined variable: filterFields in src/core/Directus/Database/TableGateway/RelationalTableGateway.php on line 2125 (#1270) * Fix #1237 (#1265) * Project name fix (#1272) * Adds support for environment variables in CLI (#1276) * Cleans up some unused/deprecated files in the repository (#1277) * Fix #1248 [API cannot go into deeper on user data] (#1282) * Add proper exit codes for CLI (#1281) * Fix cache.enabled not respected in cache service (#1273) This fixes an issue where cache.enabled is false but caching is still working. * Add CLI cache:clear (#1274) * Fix #1284[Broken user related fields] (#1287) * Fix #1279 [wysiwyg-full - add image - Call to a member function isOneToMany() on null] (#1288) * fixed bug with incorrect height (#1293) * Execute migrations automatically (#1296) * Remove middleware for register webhook and add it before registeration of hooks * Need to add middleware for directory dependency * Fix #1302 - Internal server error when selecting/checking a Checkbox Relational field after deleting some of the related items (#1307) * Fix #1308 - Checkbox-relational field issue when unchecking value (#1309) * Fix #1308 - Checkbox-relational field issue when unchecking value * Update RelationalTableGateway.php * Add Aliyun OSS settings to config schema (#1299) * Extend config schema to support PDO options. (#1295) * Extend config schema to support PDO options. * Make driver_options database config setting optional. * Replcae with getQueryParams method of slim (#1313) * Fix Undefined Variable - /src/core/Directus/Console/Common/Setting.php on line 24 (#1314) * Replace with getQueryParams method of slim (#1317) * Fix response data contains json object instead of array (#1318) * Fix #1310[Resolve issue with updatingNestd m2o/o2m/m2m] (#1320) * Fix #1321 [Resolve bug with system date and system user validation] (#1322) * Resolve Authentication token issue after upgrade to 2.6.0 (#1326) * Fix #1329 [Add new fields to / endpoint] (#1332) * Fix #1329 * Fix #1329 [Add new fields to / endpoint] * fix issue #1330 (#1331) * Rename color with project_color key (#1334) * Fix #1333 [Return Unauthorised when public role not have the respected permission] (#1336) * Fix #1333 [Return Unauthorized when public role not have the respected permission * Add comment * Session-based auth flow along with kill functionality (#1280) * Fix #1263[Rethink Auth Flow] * Kill User Session * Add Expiry time * Expire and cookie * Auth Flow - Modify code base * Resolve browser cache remove issue * Remove PHPSESSIONID reset code * Cookie name based on projject name, Merge authentication endpoint * Support of mode in sso * Add seeder into migrations * Remove warning of container * Add required flag for user in fields table from migrations * Add endpoint to fetch the user's session * Update user's session to loggedin user session endpoint * Allow cross origin cookie * Set credentials response header dynamically * Fix empty FK - do not continue if FK is empty, otherwise, it will not display the entry as if it was not saved. (#1342) * Fix #1343 [Update directus_files field type] (#1346) * fix parsing env variables (#1347) * Fix CORS issue for system endpoint (#1352) * Fix #1348 (#1353) * Fix wrong chache naming. (#1354) * Fix issue when deleting a file and saving the item (#1360) * Fix #1359 [Pagination not working] (#1362) * fix readme ( branch to submit PRs "master" -> "develop") (#1365) * Ignore ddev config folder * Fix unaccessible public endpoints (#1367) * Fix CORS origin * for public preflight endpoints (#1369) * add gitpod.io support (#1356) * Add requires2FA flag at / endpoint (#1370) * Set default value if the value is not set (#1373) * CORS issue for public endpoint (#1374) * Fix Warning: Illegal string offset 'field' in src/endpoints/Settings.php on line 89 when query param contains single=1 (#1375) * Fix Warning: Illegal string offset 'field' in src/endpoints/Settings.php on line 89 when query param contains single=1 * Update Settings.php * Resolve undefined class ArrayUtils error * Fetch single sign on providers * style updates (#1382) * Update withHeaders + add note * Fix #1384 [Remove entries from directus_relations on delete the collection] (#1386) * Fix #1381 [Throwing 500 response code on mail sending fail] (#1387) * Fix #1329 [Update the name of variable from settings table] (#1389) * Fix #1329 [Update the name of variable from settings table] * Update comment * Fix the general settings schema upgrade - consider the new installation as well with already existing fields (#1391) * New project flow (#1399) * Replace migrations file from config folder to migrations folder * Return the project list * Remove unwanted code * Projects endpoint * Remove unwanted code * Remove unwanted code * Remove unwanted code * Remove default _ for secretkey and newtimzone function of datetimeutil * Check requirement endpoint (#1398) * Check requirement endpoint * Add endpoint * Update ProjectService.php * Don't verify super admin with hashing * Remove warning of non static method 'createJsonFileContent' for project create * Remove _ as private flas (#1403) * Remove password_verfiy and add equals operator * Fix integrity constraint (#1400) * Update 2FA flow to work with cookies Squashed commit of the following: commit a543c44 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Fri Nov 8 16:20:45 2019 -0500 Use correct response format for 2fa util commit ab06c55 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Fri Nov 8 15:42:35 2019 -0500 Rename activate2FA to activate_2fa and allow `me` for user updates commit 7b429ab Author: Binal Gajjar <binal.gajjar7@gmail.com> Date: Fri Nov 8 22:46:30 2019 +0530 Set NULL if data array is empty commit c5c7bf6 Author: Binal Gajjar <binal.gajjar7@gmail.com> Date: Fri Nov 8 22:37:17 2019 +0530 Remove needs2FA param from authtoken commit 5b4b21a Author: Binal Gajjar <binal.gajjar7@gmail.com> Date: Fri Nov 8 22:35:41 2019 +0530 Throw error if 2FA is not enabled * clearer existing install response * update error message * Fix #1380 [Set default requires2FA flag] (#1388) * Redirect the users to /admin in sso (#1407) * Redirect the users to /admin in sso * 2FA flow for SSO * Remove unwanted file from use statement * Default to UTC timezone on new project installs (when there's no config) * update sso icon colors * Update the size of token field * Update the size of token field * Update the size of static token * Resolve redirection to /admin? Resolve redirection to `/admin?` instead of `/admin` * Add missing 2fa secret column in seeds * Throw exception for SSO (#1411) * Redirect the users to /admin in sso * 2FA flow for SSO * Remove unwanted file from use statement * Throw the exception when 2FA enforced or enabled * Fix 2fa column * Fix 2fa column * Ignore the files which start with _ * Restrict private and _ project from listing (#1415) * Restrict private files from listing * Return the filename instead of projectname from scan funciton * Add a validation of boolean to private flag. * Fix #1395[/server/ping should ignore project] (#1416) * Update error code for unknown project exception * Update FieldsConfig.php (#1413) Without this fix the GrapQL query brings values only in case when the M2M field has exactly the same name as the related collection. It can be ok, but for cases when it's required to have mutliple M2M fields pointing to the same collection, (e.g. there 2 collections - games and tags, and so we need to specify Primary and Secondary tags for each game). So with current implementation we cannot create primaryTags and secondaryTag fields, we should use 'tags' field instead, but its only one, and we need 2. So this fix obtaining fieldName from parameters and using it for relation and not a collection name. * Remove unwanted files (#1421) * V8.0.0 (#1414) * Redirect to correct endpoint for app * Redirect to admin based on relative url (works in sub-folder) * Update request / reset password to be all app based * Add trailing slash to admin redirect * Add project key to reset password * Restrict private and _ project from listing (#1415) * Restrict private files from listing * Return the filename instead of projectname from scan funciton * Add a validation of boolean to private flag. * Add redirect_url param * update settings seeder to contain all default options * public role description * relations alpha order * Fix false positive in sso 2fa block * add enforce_2fa to roles * activity seeder updates icons and widths * seeder for directus files need to check “description” options array format * directus settings seeder updates * Add support for webhooks Squashed commit of the following: commit ce6ffac Merge: 667d960 e0630e8 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Tue Nov 12 11:51:19 2019 -0500 Merge branch 'develop' into webhooks commit 667d960 Merge: be83925 557a83b Author: rijkvanzanten <rijkvanzanten@me.com> Date: Tue Nov 12 11:17:11 2019 -0500 Merge branch 'v8.0.0' into webhooks commit be83925 Merge: f51c51a 41fd0b6 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Tue Nov 12 11:17:07 2019 -0500 Merge branch 'develop' into webhooks commit 557a83b Author: rijkvanzanten <rijkvanzanten@me.com> Date: Tue Nov 12 10:54:13 2019 -0500 Fix false positive in sso 2fa block commit 0989b31 Author: Ben Haynes <ben@rngr.org> Date: Tue Nov 12 10:49:54 2019 -0500 relations alpha order commit 8f15ad6 Author: Ben Haynes <ben@rngr.org> Date: Tue Nov 12 10:49:42 2019 -0500 public role description commit 555ba2f Author: Ben Haynes <ben@rngr.org> Date: Tue Nov 12 10:46:22 2019 -0500 update settings seeder to contain all default options commit 9816a4a Author: Binal Gajjar <binal.gajjar7@gmail.com> Date: Tue Nov 12 20:41:54 2019 +0530 Add redirect_url param commit 3ba3708 Merge: 379457d 0629167 Author: Binal Gajjar <binal.gajjar7@gmail.com> Date: Tue Nov 12 20:30:11 2019 +0530 Merge branch 'v8.0.0' of https://github.com/directus/api into v8.0.0 commit 0629167 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Mon Nov 11 18:33:17 2019 -0500 Add project key to reset password commit 2bcd474 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Mon Nov 11 18:33:05 2019 -0500 Add trailing slash to admin redirect commit 4a0ccf6 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Mon Nov 11 16:13:34 2019 -0500 Update request / reset password to be all app based commit e42fbf9 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Mon Nov 11 16:13:05 2019 -0500 Redirect to admin based on relative url (works in sub-folder) commit 9f24d50 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Mon Nov 11 15:17:59 2019 -0500 Redirect to correct endpoint for app commit f51c51a Author: Binal Gajjar <binal.gajjar7@gmail.com> Date: Fri Nov 8 22:44:15 2019 +0530 Webhook Implementation (#1304) * Webhook implementation * Webhook development * Fix 29 * Register the webhook * Webhook seed transfer into migrations * Update default seeder * Update comment * Update comment * Add Status Field * directus users seeds * remove unused seeder data * missing comma * Added missing comma * settings defaults * setup telemetry and default locale * Remove directus activity seen table (#1422) * Remove directus activity seen * Revert back the activity seen field from upgrades * webhooks seeds * webhooks update * Rename webhook draft->inactive published->active + delete deleted * update webhooks schema migrations * webhooks url placeholder * Use collections interface for collection chooser on webhooks * webhooks info * Don't enforce user.locale to be set * Bump version * hide dividers on browse * nice defaults for webhooks layout * better webhooks layout * Revert "Fix issue when deleting a file and saving the item (#1360)" (#1423) This reverts commit 37ef295. * Revert "Fix the general settings schema upgrade - consider the new installation as well with already existing fields (#1391)" (#1424) This reverts commit 483e065. * Update the current migrations for remove unwanted code and update the icons (#1425) * Fix #1429 [Activity datetime is incorrect] (#1430) * add directus user theme field * Update migration files to check if column exist then pnly drop (#1436) * Add DB condition in migration to check whether column exists. * Fix Constant Imagick::ALPHACHANNEL_REMOVE is undefined (#1438) When using Imagick less than version 3.4.4, it will throw error `Constant Imagick::ALPHACHANNEL_REMOVE is undefined`. The const `ALPHACHANNEL_REMOVE` only exist in 3.4.4 as described [here](Imagick/imagick#281). * Add Migration for theme (#1444) * Fix #1442 [Reset password throws email error on inactive user] (#1445) * Add Migration for theme * Fix #1442 [Reset password throws email error on inactive user] * Update syntax for insert * User role m2m to o2m (#1435) * Update role to m2o * Remove debug code * If exist condition * Update migrations/db/seeds/RelationsSeeder.php * Fix #1434 [Clean up /projects /server/projects setup] (#1439) * Fix #1434 * Remove unwanted code * Try catch for response * Remove the superadmin token from payload and place it as a param * Remove admin condition to delete the project * Remove whitespace * Fix #1429 [Convert current timezone to UTC timezone] (#1447) * Fix #1450 (#1451) * Issue fix 1450 * Remove optional from social_providers as it will add a blank string too. * Fix #1417 [Resolve edit permission is required to create a file] (#1452) * Fix #1417 [Resolve edit permission is required to create a file] * Remove unwanted enter from file * Remove unwanted files from git commit * Remove unwanted files from git commit * Revert " Fix #1450 (#1451)" (#1454) This reverts commit 68e1717. * Fix project install * Stop migrations execution for server endpoints (#1453) * Stop migrtions execution for server endpoints * Remove trailing slash from get request * Fix #1449 [Support _ for projectname] (#1455) * Support for redis cluster (#1441) * Add support for redis cluster * Add cache adapter type for rediscluster * Use cache/cache for dev-master (which support RedisCluster) Fix instanciation of RedisCluster * Bump version

* Revert "This was a global solution to a isolated issue" This reverts commit 826ae98. * Revert "focus in alert input (directus#1017)" This reverts commit ebc364d.

* Issue Fix #1180 (#1183) * Issue fix #1191 (#1192) * Issue fix #1196 (#1197) * Add 2fa authentication (#1031) * Parent + Nested validation changes (#1138) * Add migration schema for 2FA Secret user field * Add 2fa_secret field to FieldsSeeder * Create Missing 2FA Password Exception * Add googleauthenticator dependency * Add getter for User's 2FA secret * Check for otp param in login request, and login with it * Add enforce_2fa parameter to directus_settings * Create Utils endpoint and service method to generate 2fa secret * Add enforce_2fa field to roles * Add enforce_2fa field to FieldsSeeder * Change Missing2FAPasswordException error code to 111 * Change 2FA Library * Change 2fa_secret interface in FieldsSeeder * Created exception for invalid otp * Changed findUserWithCredentials to through an InvalidOTPException on otp check * Created new exception if 2fa is enforced but not enabled by user * Added function to check if 2fa is enforced for a user * Check in AuthenticationMiddleware whether 2fa is enforced and enabled for user * Add optional needs2FA field to auth token and on token refresh * Catch error if enforce_2fa column doesn't exist Fixes crash when has2FAEnforced is called on a DB that hasn't been migrated * Use relative positions for target path array to check user edit * Fix unset on payload_arr instead of payload * Change 2FA activation on login to use activate2FA endpoint * Update ItemsService.php * Issue Fix #1194 (#1195) * Issue Fix #1194 * Update comment * Valildation issue of O2M/M2O at insertion (#1198) * Fox #1201 (#1202) * Fix #1203 (#1204) * Update collections() method in types.php (#1184) There are cases when $type is not a string but an object that inherits from ObjectType. In that situation array_key_exists failing because it should get only integers or strings as a first parameter. So in order to avoid that the 'name' property of the object is used as a key. * Improve YouTube Embed Provider (#1210) Adds in detection and parsing for youtu.be shorthand URLs. * Add check for environment on bootstrap (#1215) * Fix #1186 [Create new error code for invalid login entity] (#1218) * Fix #1217 (Changing password over the CLI doesn't work) (#1220) * Feature/audio video upload (#1214) * added file meta data for audio/video * updates as per PR feedback * Fix #1207 [Permission denied issue when using translation interface] (#1221) * Fix for smtp send mail issue #1205 (#1223) * Fix for smtp send mail issue #1205 Missing additional config settings #1205 * Update Schema.php * Fix 1232[Auth token is not refreshed] (#1233) * Change Authencation Error code to 114 from 109 (#1231) * Fix issue while update item. (#1224) * #1227 : Ignore all the alias fields except file interface (#1240) * Fix #1224 [Deletion of m2o/o2m field error for enabled cache] (#1241) * Fix 845 (#1244) * Change namespace for PHPUnit. * Removing old tests. * Fix #1238 [PDF support for Embedded URL] (#1245) * Fix #1238[PDF support for Embedded URL] * Add array support * Update comment * Update Files.php * Fix #1243[Dynamic charset for DB] (#1246) * Fix #1249[saveData: height is set to width] (#1251) * Fix #2017[Renaming `Public` role gives `unauthorized` error on API calls] (#1253) * Revert "Fix #2017[Renaming `Public` role gives `unauthorized` error on API calls] (#1253)" (#1254) This reverts commit 7fe9056. * FIX/core/Directus/Files.php: return $height instead of $width (#1250) * Fix #1255 [Add support of batch Create/Update/Delete for user] (#1257) * Fix #1255 [Support batch create/update/delete for user] * Add exception * Fix directus/app#2017 (#1256) * Fix #2017[Renaming `Public` role gives `unauthorized` error on API calls] * src * Remove unwanted file from use * Fix #729 [Can't properly query nested fields on Files field] (#1260) * #1216 : Solved issue in O2M relationship of table itself (#1259) * Fix #1209 [M2M relation with directus_collections cant be saved] (#1261) * Fix #1209[M2M relation with directus_collections cant be saved] * Implement condition on update * Define variable * Fix #1209[M2M relation with directus_collections cant be saved] * 🙆🏻‍♂️ * Fix #1266 (#1267) * Fix Warning: Cannot use a scalar value as an array in /src/core/Directus/Config/StatusMapping.php on line 103 (#1268) * Fix Notice: Undefined variable: filterFields in src/core/Directus/Database/TableGateway/RelationalTableGateway.php on line 2125 (#1270) * Fix #1237 (#1265) * Project name fix (#1272) * Adds support for environment variables in CLI (#1276) * Cleans up some unused/deprecated files in the repository (#1277) * Fix #1248 [API cannot go into deeper on user data] (#1282) * Add proper exit codes for CLI (#1281) * Fix cache.enabled not respected in cache service (#1273) This fixes an issue where cache.enabled is false but caching is still working. * Add CLI cache:clear (#1274) * Fix #1284[Broken user related fields] (#1287) * Fix #1279 [wysiwyg-full - add image - Call to a member function isOneToMany() on null] (#1288) * fixed bug with incorrect height (#1293) * Execute migrations automatically (#1296) * Remove middleware for register webhook and add it before registeration of hooks * Need to add middleware for directory dependency * Fix #1302 - Internal server error when selecting/checking a Checkbox Relational field after deleting some of the related items (#1307) * Fix #1308 - Checkbox-relational field issue when unchecking value (#1309) * Fix #1308 - Checkbox-relational field issue when unchecking value * Update RelationalTableGateway.php * Add Aliyun OSS settings to config schema (#1299) * Extend config schema to support PDO options. (#1295) * Extend config schema to support PDO options. * Make driver_options database config setting optional. * Replcae with getQueryParams method of slim (#1313) * Fix Undefined Variable - /src/core/Directus/Console/Common/Setting.php on line 24 (#1314) * Replace with getQueryParams method of slim (#1317) * Fix response data contains json object instead of array (#1318) * Fix #1310[Resolve issue with updatingNestd m2o/o2m/m2m] (#1320) * Fix #1321 [Resolve bug with system date and system user validation] (#1322) * Resolve Authentication token issue after upgrade to 2.6.0 (#1326) * Fix #1329 [Add new fields to / endpoint] (#1332) * Fix #1329 * Fix #1329 [Add new fields to / endpoint] * fix issue #1330 (#1331) * Rename color with project_color key (#1334) * Fix #1333 [Return Unauthorised when public role not have the respected permission] (#1336) * Fix #1333 [Return Unauthorized when public role not have the respected permission * Add comment * Session-based auth flow along with kill functionality (#1280) * Fix #1263[Rethink Auth Flow] * Kill User Session * Add Expiry time * Expire and cookie * Auth Flow - Modify code base * Resolve browser cache remove issue * Remove PHPSESSIONID reset code * Cookie name based on projject name, Merge authentication endpoint * Support of mode in sso * Add seeder into migrations * Remove warning of container * Add required flag for user in fields table from migrations * Add endpoint to fetch the user's session * Update user's session to loggedin user session endpoint * Allow cross origin cookie * Set credentials response header dynamically * Fix empty FK - do not continue if FK is empty, otherwise, it will not display the entry as if it was not saved. (#1342) * Fix #1343 [Update directus_files field type] (#1346) * fix parsing env variables (#1347) * Fix CORS issue for system endpoint (#1352) * Fix #1348 (#1353) * Fix wrong chache naming. (#1354) * Fix issue when deleting a file and saving the item (#1360) * Fix #1359 [Pagination not working] (#1362) * fix readme ( branch to submit PRs "master" -> "develop") (#1365) * Ignore ddev config folder * Fix unaccessible public endpoints (#1367) * Fix CORS origin * for public preflight endpoints (#1369) * add gitpod.io support (#1356) * Add requires2FA flag at / endpoint (#1370) * Set default value if the value is not set (#1373) * CORS issue for public endpoint (#1374) * Fix Warning: Illegal string offset 'field' in src/endpoints/Settings.php on line 89 when query param contains single=1 (#1375) * Fix Warning: Illegal string offset 'field' in src/endpoints/Settings.php on line 89 when query param contains single=1 * Update Settings.php * Resolve undefined class ArrayUtils error * Fetch single sign on providers * style updates (#1382) * Update withHeaders + add note * Fix #1384 [Remove entries from directus_relations on delete the collection] (#1386) * Fix #1381 [Throwing 500 response code on mail sending fail] (#1387) * Fix #1329 [Update the name of variable from settings table] (#1389) * Fix #1329 [Update the name of variable from settings table] * Update comment * Fix the general settings schema upgrade - consider the new installation as well with already existing fields (#1391) * New project flow (#1399) * Replace migrations file from config folder to migrations folder * Return the project list * Remove unwanted code * Projects endpoint * Remove unwanted code * Remove unwanted code * Remove unwanted code * Remove default _ for secretkey and newtimzone function of datetimeutil * Check requirement endpoint (#1398) * Check requirement endpoint * Add endpoint * Update ProjectService.php * Don't verify super admin with hashing * Remove warning of non static method 'createJsonFileContent' for project create * Remove _ as private flas (#1403) * Remove password_verfiy and add equals operator * Fix integrity constraint (#1400) * Update 2FA flow to work with cookies Squashed commit of the following: commit a543c44 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Fri Nov 8 16:20:45 2019 -0500 Use correct response format for 2fa util commit ab06c55 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Fri Nov 8 15:42:35 2019 -0500 Rename activate2FA to activate_2fa and allow `me` for user updates commit 7b429ab Author: Binal Gajjar <binal.gajjar7@gmail.com> Date: Fri Nov 8 22:46:30 2019 +0530 Set NULL if data array is empty commit c5c7bf6 Author: Binal Gajjar <binal.gajjar7@gmail.com> Date: Fri Nov 8 22:37:17 2019 +0530 Remove needs2FA param from authtoken commit 5b4b21a Author: Binal Gajjar <binal.gajjar7@gmail.com> Date: Fri Nov 8 22:35:41 2019 +0530 Throw error if 2FA is not enabled * clearer existing install response * update error message * Fix #1380 [Set default requires2FA flag] (#1388) * Redirect the users to /admin in sso (#1407) * Redirect the users to /admin in sso * 2FA flow for SSO * Remove unwanted file from use statement * Default to UTC timezone on new project installs (when there's no config) * update sso icon colors * Update the size of token field * Update the size of token field * Update the size of static token * Resolve redirection to /admin? Resolve redirection to `/admin?` instead of `/admin` * Add missing 2fa secret column in seeds * Throw exception for SSO (#1411) * Redirect the users to /admin in sso * 2FA flow for SSO * Remove unwanted file from use statement * Throw the exception when 2FA enforced or enabled * Fix 2fa column * Fix 2fa column * Ignore the files which start with _ * Restrict private and _ project from listing (#1415) * Restrict private files from listing * Return the filename instead of projectname from scan funciton * Add a validation of boolean to private flag. * Fix #1395[/server/ping should ignore project] (#1416) * Update error code for unknown project exception * Update FieldsConfig.php (#1413) Without this fix the GrapQL query brings values only in case when the M2M field has exactly the same name as the related collection. It can be ok, but for cases when it's required to have mutliple M2M fields pointing to the same collection, (e.g. there 2 collections - games and tags, and so we need to specify Primary and Secondary tags for each game). So with current implementation we cannot create primaryTags and secondaryTag fields, we should use 'tags' field instead, but its only one, and we need 2. So this fix obtaining fieldName from parameters and using it for relation and not a collection name. * Remove unwanted files (#1421) * V8.0.0 (#1414) * Redirect to correct endpoint for app * Redirect to admin based on relative url (works in sub-folder) * Update request / reset password to be all app based * Add trailing slash to admin redirect * Add project key to reset password * Restrict private and _ project from listing (#1415) * Restrict private files from listing * Return the filename instead of projectname from scan funciton * Add a validation of boolean to private flag. * Add redirect_url param * update settings seeder to contain all default options * public role description * relations alpha order * Fix false positive in sso 2fa block * add enforce_2fa to roles * activity seeder updates icons and widths * seeder for directus files need to check “description” options array format * directus settings seeder updates * Add support for webhooks Squashed commit of the following: commit ce6ffac Merge: 667d960 e0630e8 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Tue Nov 12 11:51:19 2019 -0500 Merge branch 'develop' into webhooks commit 667d960 Merge: be83925 557a83b Author: rijkvanzanten <rijkvanzanten@me.com> Date: Tue Nov 12 11:17:11 2019 -0500 Merge branch 'v8.0.0' into webhooks commit be83925 Merge: f51c51a 41fd0b6 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Tue Nov 12 11:17:07 2019 -0500 Merge branch 'develop' into webhooks commit 557a83b Author: rijkvanzanten <rijkvanzanten@me.com> Date: Tue Nov 12 10:54:13 2019 -0500 Fix false positive in sso 2fa block commit 0989b31 Author: Ben Haynes <ben@rngr.org> Date: Tue Nov 12 10:49:54 2019 -0500 relations alpha order commit 8f15ad6 Author: Ben Haynes <ben@rngr.org> Date: Tue Nov 12 10:49:42 2019 -0500 public role description commit 555ba2f Author: Ben Haynes <ben@rngr.org> Date: Tue Nov 12 10:46:22 2019 -0500 update settings seeder to contain all default options commit 9816a4a Author: Binal Gajjar <binal.gajjar7@gmail.com> Date: Tue Nov 12 20:41:54 2019 +0530 Add redirect_url param commit 3ba3708 Merge: 379457d 0629167 Author: Binal Gajjar <binal.gajjar7@gmail.com> Date: Tue Nov 12 20:30:11 2019 +0530 Merge branch 'v8.0.0' of https://github.com/directus/api into v8.0.0 commit 0629167 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Mon Nov 11 18:33:17 2019 -0500 Add project key to reset password commit 2bcd474 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Mon Nov 11 18:33:05 2019 -0500 Add trailing slash to admin redirect commit 4a0ccf6 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Mon Nov 11 16:13:34 2019 -0500 Update request / reset password to be all app based commit e42fbf9 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Mon Nov 11 16:13:05 2019 -0500 Redirect to admin based on relative url (works in sub-folder) commit 9f24d50 Author: rijkvanzanten <rijkvanzanten@me.com> Date: Mon Nov 11 15:17:59 2019 -0500 Redirect to correct endpoint for app commit f51c51a Author: Binal Gajjar <binal.gajjar7@gmail.com> Date: Fri Nov 8 22:44:15 2019 +0530 Webhook Implementation (#1304) * Webhook implementation * Webhook development * Fix 29 * Register the webhook * Webhook seed transfer into migrations * Update default seeder * Update comment * Update comment * Add Status Field * directus users seeds * remove unused seeder data * missing comma * Added missing comma * settings defaults * setup telemetry and default locale * Remove directus activity seen table (#1422) * Remove directus activity seen * Revert back the activity seen field from upgrades * webhooks seeds * webhooks update * Rename webhook draft->inactive published->active + delete deleted * update webhooks schema migrations * webhooks url placeholder * Use collections interface for collection chooser on webhooks * webhooks info * Don't enforce user.locale to be set * Bump version * hide dividers on browse * nice defaults for webhooks layout * better webhooks layout * Revert "Fix issue when deleting a file and saving the item (#1360)" (#1423) This reverts commit 37ef295. * Revert "Fix the general settings schema upgrade - consider the new installation as well with already existing fields (#1391)" (#1424) This reverts commit 483e065. * Update the current migrations for remove unwanted code and update the icons (#1425) * Fix #1429 [Activity datetime is incorrect] (#1430) * add directus user theme field * Update migration files to check if column exist then pnly drop (#1436) * Add DB condition in migration to check whether column exists. * Fix Constant Imagick::ALPHACHANNEL_REMOVE is undefined (#1438) When using Imagick less than version 3.4.4, it will throw error `Constant Imagick::ALPHACHANNEL_REMOVE is undefined`. The const `ALPHACHANNEL_REMOVE` only exist in 3.4.4 as described [here](Imagick/imagick#281). * Add Migration for theme (#1444) * Fix #1442 [Reset password throws email error on inactive user] (#1445) * Add Migration for theme * Fix #1442 [Reset password throws email error on inactive user] * Update syntax for insert * User role m2m to o2m (#1435) * Update role to m2o * Remove debug code * If exist condition * Update migrations/db/seeds/RelationsSeeder.php * Fix #1434 [Clean up /projects /server/projects setup] (#1439) * Fix #1434 * Remove unwanted code * Try catch for response * Remove the superadmin token from payload and place it as a param * Remove admin condition to delete the project * Remove whitespace * Fix #1429 [Convert current timezone to UTC timezone] (#1447) * Fix #1450 (#1451) * Issue fix 1450 * Remove optional from social_providers as it will add a blank string too. * Fix #1417 [Resolve edit permission is required to create a file] (#1452) * Fix #1417 [Resolve edit permission is required to create a file] * Remove unwanted enter from file * Remove unwanted files from git commit * Remove unwanted files from git commit * Revert " Fix #1450 (#1451)" (#1454) This reverts commit 68e1717. * Fix project install * Stop migrations execution for server endpoints (#1453) * Stop migrtions execution for server endpoints * Remove trailing slash from get request * Fix #1449 [Support _ for projectname] (#1455) * Support for redis cluster (#1441) * Add support for redis cluster * Add cache adapter type for rediscluster * Use cache/cache for dev-master (which support RedisCluster) Fix instanciation of RedisCluster * Bump version * Use -1 for undefined error code * Log errors to file on failed sso * Add migrations for using repeater for collection translations * Make the api endpoint /server/projects works with docker environments variables (#1470) * Make the api endpoint /server/projects works with docker environments variables DIRECTUS_USE_ENV=1 * Change default project name to _ * Fix #1450 [Installer creates format issues in config file] (#1472) * Fix #1450 [Installer creates format issues in config file] * Add comma after array * Fix #1427 (#1469) * Adding command line support for new project flow (#1464) * Fix commannd line issues * Add upgrades migrations in cmd installtion * Rename -N to -k and add it to the list of available options * Make the use if the telemetry service configurable (#1420) * Make the telemetry requests configurable * Add new config setting to the schema * Remove telemetry from configuration file * Remove telemetry from configuration file * Remove telemetry from schema * Remove extra comma * Fetch the telemetry from settings table instead of configuration file * Fixed primary key fields Graphql definition (#1418) * Fixed primary key fields Graphql definition The check for primary key fields was wrong so they never are defined as ID. So the Int! definition raises a Graphql validation error on primary key fields: Interface field Node.id expects type ID but ###.id is type Int!. * Code style improvements Used "if" instead ternary operator and removed unnecessary "== true" * Migration changes (#1466) * Migrations folder structure * Change migrations path * Remove unwanted utilities * Remove utilities * Add version in comment section of migrations * Check if the table exists or not * Adding if exist condition for update * Rename the fields migrations * MIgration changes * Remove check for libapache2_mod_php (#1479) The Apache PHP module is needed in order to run PHP from Apache. This information is returned from PHP, so if this module isn't loaded, this whole endpoint wouldn't do anything. If this endpoint works, we already know that libapache2-mod-php is working as expected. (Also, extension_loaded("libapache2-mod-php") never seems to be true. * Rename page->module (#1485) * Don't raise the required error if the field has a default value (#1487) * Replace nav_override with collection / module listing * Fix #1488 (#1489) * Fix #1462 [Authentication API return user object] (#1490) * Fix #1483 [activity_skip doesnt work on delete file] (#1491) * Fix width on wrong value * Fix collection listing not using right options * Update the options based on seeder * Rework the thumbnailer (#1467) * Thumbnail whitelist development * Image and thumbnail URL changes and validations * Assets endpoints in thumbnail * Default thumbnail URL changes and other changes * Removed thumbnail in public * Requested changes in thumbnailer * Remove key from folder name * Provide the support for both keys - system and whitelist * Return all the thumbnail - including system as well as whitelisted * Use the shorthand for width, height, quality and fit * Use the shorthands for params * Update AssetService.php * Update the error message * MIgration changes (#1495) * MIgration changes * Update the sorting ordeR * Render original path as full_url * Use color interface for project color * Update migrations for setings * Fix thumbnailer enabled check + * generation * Cleanup settings migrations * Rename thumbnail_whitelist to asset_whitelist * Fix non-key whitelisted asset * Update migrations * Add contain constraint * Remove hardcoded settings validation * Remove default project based empty folders * Use generated as default thumbnail location * Config updates (#1484) * Migrations folder structure * Change migrations path * Remove unwanted utilities * Remove utilities * Add version in comment section of migrations * Check if the table exists or not * Adding if exist condition for update * Rename the fields migrations * Rename api-sample.php to _example.php * Don't return ignored files * Move env out of app config category * Remove timezone flag from config * Move logger config out of settings key * [WIP] Start on new example config file * Change order + remove comments from config stub * Get rid of unused `feedback` config section * Update example config file * Added missing comma * Added missing comma * Remove migration * Adding support for _ project * Add comment for condition * Update Server.php * Ignore _ prefixed config files everywhere * Make durations readonly * Use tags for ip whitelist * Clear whitespace + set duration to readonly * Fix #1497 [V8 fresh install is broken] * Add migration for migrating advanced wysiwyg to wysiwyg Fixes directus/directus#2465 * Fix deleting file type fields from collection Fixes #1503 * Update the thumbnailer (#1506) * File name changes and thumbnailer changes * Thumbnail related changes * name changes * Fix typo * Thumbnail changes * Combine migration files * Replace the file delete code from basetablegateway to fileservice * Tweak migrations * Set uuid to default field format * Don't change primary key of directus_files * Fix content-disposition header + last modified for originals and thumbnails * Don't return thumbnails if the asset type isn't an image * Set duration to readonly * Don't try reading non-images files with Intervention * Prefer application/pdf over application/acrobat * Update repeater settings for asset whitelist * Fix renaming files * Don't return thumbnail info for svgs * update example config comments * remove leading slash from example * Have migrations (#1509) * Put old migrations back * Upgrade migrations * Various tweaks * Fix private hash requirement flag The API still throw a required error, even though its a generated field * Fix settings * Rework order of migrations * Beautify directus_files Beautify directus_files Beautify directus_files Beautify directus_files Beautify directus_files Beautify directus_files Beautify directus_files Beautify directus_files Beautify directus_files * Remove nav_blacklist, add enforce_2fa * Tweak settings of timeline * Get rid of activity icon * Use system collections in directus activity main view * Handle error : Use of undefined constant ERROR_MESSAGE * Rebuild the 2FA query (#1510) * Redevelop the 2FA query * Dynamic name of table * Fix #1508 [Deleting a file attached to an item deletes the item] (#1512) * Update type of enforce_2fa from array to boolean * Update type of enforce_2fa from array to boolean * Fix #1473 [Remove cookie if token is invalid] (#1513) * Update README.md * Update README.md * Add uploads folder to base structure * Fix _.php config name + remove duplicate code * Also migrate wysiwyg_full * Bump version

rijkvanzanten assigned OscBacon Jun 18, 2019

rijkvanzanten added the enhancement New feature or request label Jun 18, 2019

OscBacon force-pushed the feature/2fa-authentication branch from 2ea0ed6 to 679bad2 Compare June 18, 2019 20:37

rijkvanzanten suggested changes Jun 18, 2019

View reviewed changes

composer.json Outdated Show resolved Hide resolved

src/core/Directus/Authentication/Exception/Missing2FAPasswordException.php Outdated Show resolved Hide resolved

OscBacon force-pushed the feature/2fa-authentication branch from c0d8f16 to a646aa3 Compare June 20, 2019 12:28

OscBacon added a commit to OscBacon/docs that referenced this pull request Jun 20, 2019

Added error codes for 2fa + token error codes

6ab12ff

Related to PR: directus/v8-archive#1031 Also added missing error codes for 109 and 110

rijkvanzanten reviewed Jun 21, 2019

View reviewed changes

src/core/Directus/Authentication/Exception/TFAEnforcedException.php Show resolved Hide resolved

rijkvanzanten changed the title ~~[WIP] Add 2fa authentication~~ Add 2fa authentication Jun 21, 2019

OscBacon force-pushed the feature/2fa-authentication branch from 8137ac8 to 900fb12 Compare July 1, 2019 10:27

rijkvanzanten requested a review from binal-7span July 9, 2019 17:06

rijkvanzanten added this to In progress in v2.2.2 via automation Jul 9, 2019

hemratna mentioned this pull request Jul 15, 2019

[SECURITY] Weak Password Policy #1109

Closed

OscBacon force-pushed the feature/2fa-authentication branch 2 times, most recently from ce5ba2b to 0596e0a Compare July 31, 2019 13:20

Oscar Baracos added 12 commits August 8, 2019 14:45

Add enforce_2fa field to FieldsSeeder

afc8192

Change Missing2FAPasswordException error code to 111

7464ee0

Change 2FA Library

eb20d76

Change 2fa_secret interface in FieldsSeeder

f05ab3e

Created exception for invalid otp

dd60fa1

Changed findUserWithCredentials to through an InvalidOTPException on …

041541d

…otp check

Created new exception if 2fa is enforced but not enabled by user

9676697

Added function to check if 2fa is enforced for a user

c2c8ea2

Check in AuthenticationMiddleware whether 2fa is enforced and enabled…

2ad88f5

… for user

Add optional needs2FA field to auth token and on token refresh

d74323c

Catch error if enforce_2fa column doesn't exist

d5f2bf3

Fixes crash when has2FAEnforced is called on a DB that hasn't been migrated

Use relative positions for target path array to check user edit

f4f7e2f

OscBacon force-pushed the feature/2fa-authentication branch from a23a4a4 to f4f7e2f Compare August 8, 2019 12:45

Oscar Baracos added 2 commits August 8, 2019 15:23

Fix unset on payload_arr instead of payload

8f1a9e9

Change 2FA activation on login to use activate2FA endpoint

46b0f9b

binal-7span reviewed Aug 13, 2019

View reviewed changes

Update ItemsService.php

5a18911

binal-7span merged commit 8bfd3f3 into directus:develop Aug 13, 2019

binal-7span added this to Done in v2.5.0 Aug 13, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add 2fa authentication #1031

Add 2fa authentication #1031

OscBacon commented Jun 18, 2019

rijkvanzanten commented Jun 21, 2019

rijkvanzanten commented Jun 21, 2019

rijkvanzanten commented Jun 21, 2019

OscBacon commented Jun 24, 2019

binal-7span commented Jun 24, 2019

rijkvanzanten commented Jun 24, 2019

benhaynes commented Jun 24, 2019 •

edited

binal-7span commented Jun 25, 2019

rijkvanzanten commented Jun 25, 2019

OscBacon commented Jul 11, 2019

rijkvanzanten commented Jul 11, 2019

binal-7span commented Jul 12, 2019

OscBacon commented Jul 12, 2019 •

edited

rijkvanzanten commented Jul 12, 2019

benhaynes commented Jul 12, 2019

rijkvanzanten commented Jul 12, 2019 •

edited

binal-7span Aug 13, 2019 •

edited

binal-7span commented Aug 13, 2019

OscBacon commented Aug 13, 2019

binal-7span commented Aug 13, 2019 •

edited

kaushal-im commented Aug 13, 2019

OscBacon commented Aug 13, 2019

Add 2fa authentication #1031

Add 2fa authentication #1031

Conversation

OscBacon commented Jun 18, 2019

rijkvanzanten commented Jun 21, 2019

rijkvanzanten commented Jun 21, 2019

rijkvanzanten commented Jun 21, 2019

OscBacon commented Jun 24, 2019

binal-7span commented Jun 24, 2019

rijkvanzanten commented Jun 24, 2019

benhaynes commented Jun 24, 2019 • edited

binal-7span commented Jun 25, 2019

rijkvanzanten commented Jun 25, 2019

OscBacon commented Jul 11, 2019

rijkvanzanten commented Jul 11, 2019

binal-7span commented Jul 12, 2019

OscBacon commented Jul 12, 2019 • edited

rijkvanzanten commented Jul 12, 2019

benhaynes commented Jul 12, 2019

rijkvanzanten commented Jul 12, 2019 • edited

binal-7span Aug 13, 2019 • edited

Choose a reason for hiding this comment

binal-7span commented Aug 13, 2019

OscBacon commented Aug 13, 2019

binal-7span commented Aug 13, 2019 • edited

kaushal-im commented Aug 13, 2019

OscBacon commented Aug 13, 2019

benhaynes commented Jun 24, 2019 •

edited

OscBacon commented Jul 12, 2019 •

edited

rijkvanzanten commented Jul 12, 2019 •

edited

binal-7span Aug 13, 2019 •

edited

binal-7span commented Aug 13, 2019 •

edited