Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

disable login if Nextcloud is running #94

Merged
merged 2 commits into from Jan 14, 2022

Conversation

szaimen
Copy link
Collaborator

@szaimen szaimen commented Dec 30, 2021

This is best reviewed like this: https://github.com/nextcloud/all-in-one/pull/94/files?diff=unified&w=1

Close #3

Signed-off-by: szaimen szaimen@e.mail.de

@szaimen szaimen added 3. to review Waiting for reviews enhancement New feature or request security Security issues labels Dec 30, 2021
@szaimen szaimen added this to the next milestone Dec 30, 2021
@szaimen szaimen added 2. developing Work in progress and removed 3. to review Waiting for reviews labels Dec 30, 2021
@szaimen szaimen force-pushed the enh/3/disable-login-if-nextcloud-is-running branch from 3c3209c to 899ec7a Compare December 30, 2021 14:24
@szaimen szaimen added 3. to review Waiting for reviews and removed 2. developing Work in progress labels Dec 30, 2021
@szaimen szaimen force-pushed the enh/3/disable-login-if-nextcloud-is-running branch from 899ec7a to 127df00 Compare December 30, 2021 16:13
Signed-off-by: szaimen <szaimen@e.mail.de>
@szaimen szaimen force-pushed the enh/3/disable-login-if-nextcloud-is-running branch from 127df00 to 0010a6c Compare January 1, 2022 10:27
Copy link
Member

@juliushaertl juliushaertl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't this also be blocked then in the actual login controller? Otherwise it would just be the form that is hidden.

https://github.com/nextcloud/all-in-one/blob/enh/3/disable-login-if-nextcloud-is-running/php/src/Controller/LoginController.php#L21

Would still be good to have a way to manually enable the login as mentioned in #3 to have a way to get back to it if something
went wrong on the Nextcloud side.

@szaimen
Copy link
Collaborator Author

szaimen commented Jan 7, 2022

Thanks for the review, julius :)

Shouldn't this also be blocked then in the actual login controller? Otherwise it would just be the form that is hidden.

Not sure how important that is since it should fail in that case due to the csrf check?
@LukasReschke what is your take on this? :)

Would still be good to have a way to manually enable the login as mentioned in #3 to have a way to get back to it if something
went wrong on the Nextcloud side.

Already implemented. See https://github.com/nextcloud/all-in-one/pull/94/files#diff-e91b468a29aee3ff92547f02d1032086caca43138d1f9c5f693dea700f3e6058R17-R18 :)

Signed-off-by: szaimen <szaimen@e.mail.de>
@szaimen szaimen merged commit 94e5675 into main Jan 14, 2022
@delete-merged-branch delete-merged-branch bot deleted the enh/3/disable-login-if-nextcloud-is-running branch January 14, 2022 11:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3. to review Waiting for reviews enhancement New feature or request security Security issues
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Hardening login process
2 participants