{"action":"created","issue":{"url":"https://api.github.com/repos/owncloud/core/issues/25172","repository_url":"https://api.github.com/repos/owncloud/core","labels_url":"https://api.github.com/repos/owncloud/core/issues/25172/labels{/name}","comments_url":"https://api.github.com/repos/owncloud/core/issues/25172/comments","events_url":"https://api.github.com/repos/owncloud/core/issues/25172/events","html_url":"https://github.com/owncloud/core/pull/25172","id":160873509,"number":25172,"title":"Token login validation","user":{"login":"ChristophWurst","id":1374172,"avatar_url":"https://avatars.githubusercontent.com/u/1374172?v=3","gravatar_id":"","url":"https://api.github.com/users/ChristophWurst","html_url":"https://github.com/ChristophWurst","followers_url":"https://api.github.com/users/ChristophWurst/followers","following_url":"https://api.github.com/users/ChristophWurst/following{/other_user}","gists_url":"https://api.github.com/users/ChristophWurst/gists{/gist_id}","starred_url":"https://api.github.com/users/ChristophWurst/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ChristophWurst/subscriptions","organizations_url":"https://api.github.com/users/ChristophWurst/orgs","repos_url":"https://api.github.com/users/ChristophWurst/repos","events_url":"https://api.github.com/users/ChristophWurst/events{/privacy}","received_events_url":"https://api.github.com/users/ChristophWurst/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/owncloud/core/labels/4%20-%20To%20release","name":"4 - To release","color":"ededed"},{"url":"https://api.github.com/repos/owncloud/core/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/owncloud/core/labels/security","name":"security","color":"e11d21"},{"url":"https://api.github.com/repos/owncloud/core/labels/sev1-critical","name":"sev1-critical","color":"fc2929"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/owncloud/core/milestones/62","html_url":"https://github.com/owncloud/core/milestones/9.1-current","labels_url":"https://api.github.com/repos/owncloud/core/milestones/62/labels","id":1322460,"number":62,"title":"9.1-current","description":"","creator":{"login":"MorrisJobke","id":245432,"avatar_url":"https://avatars.githubusercontent.com/u/245432?v=3","gravatar_id":"","url":"https://api.github.com/users/MorrisJobke","html_url":"https://github.com/MorrisJobke","followers_url":"https://api.github.com/users/MorrisJobke/followers","following_url":"https://api.github.com/users/MorrisJobke/following{/other_user}","gists_url":"https://api.github.com/users/MorrisJobke/gists{/gist_id}","starred_url":"https://api.github.com/users/MorrisJobke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MorrisJobke/subscriptions","organizations_url":"https://api.github.com/users/MorrisJobke/orgs","repos_url":"https://api.github.com/users/MorrisJobke/repos","events_url":"https://api.github.com/users/MorrisJobke/events{/privacy}","received_events_url":"https://api.github.com/users/MorrisJobke/received_events","type":"User","site_admin":false},"open_issues":307,"closed_issues":1158,"state":"open","created_at":"2015-09-24T16:30:14Z","updated_at":"2016-06-22T16:04:03Z","due_on":null,"closed_at":null},"comments":13,"created_at":"2016-06-17T12:04:26Z","updated_at":"2016-06-22T16:37:38Z","closed_at":"2016-06-22T11:58:56Z","pull_request":{"url":"https://api.github.com/repos/owncloud/core/pulls/25172","html_url":"https://github.com/owncloud/core/pull/25172","diff_url":"https://github.com/owncloud/core/pull/25172.diff","patch_url":"https://github.com/owncloud/core/pull/25172.patch"},"body":"The current token auth implementation does not validate the login password for requests that use an app password. Hence only session tokens were checked and invalidated in case the login password changes. Additionally, the login hook was not triggered for pure token auth.\r\n\r\nTo debounce password checks against the user backend for session-less clients, the time of the last check is now stored in the token itself instead of a session value.\r\n\r\nTODO:\r\n- [x] thorough manual testing\r\n- [x] fix/adjust/extend user session unit tests\r\n\r\nTESTED\r\n- [x] password-authenticated clients with cookie support\r\n- [x] token-authenticated clients with cookie support\r\n- [x] password-authenticated clients without cookie support\r\n- [x] token-authenticated clients without cookie support\r\n- [x] browser sessions\r\n- [x] password change invalidates browser sessions\r\n- [x] disabling a user invalidates the session token\r\n- [x] password checks are performed only once per five minutes\r\n- [x] oc desktop client with token\r\n- [x] oc desktop client with password\r\n- [x] password auth is blocked when 2fa is enabled\r\n- [x] OCS 'logout required' :hankey: \r\n- [x] 'pure' token auth with http token header"},"comment":{"url":"https://api.github.com/repos/owncloud/core/issues/comments/227802327","html_url":"https://github.com/owncloud/core/pull/25172#issuecomment-227802327","issue_url":"https://api.github.com/repos/owncloud/core/issues/25172","id":227802327,"user":{"login":"mcastroSG","id":18436398,"avatar_url":"https://avatars.githubusercontent.com/u/18436398?v=3","gravatar_id":"","url":"https://api.github.com/users/mcastroSG","html_url":"https://github.com/mcastroSG","followers_url":"https://api.github.com/users/mcastroSG/followers","following_url":"https://api.github.com/users/mcastroSG/following{/other_user}","gists_url":"https://api.github.com/users/mcastroSG/gists{/gist_id}","starred_url":"https://api.github.com/users/mcastroSG/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mcastroSG/subscriptions","organizations_url":"https://api.github.com/users/mcastroSG/orgs","repos_url":"https://api.github.com/users/mcastroSG/repos","events_url":"https://api.github.com/users/mcastroSG/events{/privacy}","received_events_url":"https://api.github.com/users/mcastroSG/received_events","type":"User","site_admin":false},"created_at":"2016-06-22T16:37:38Z","updated_at":"2016-06-22T16:37:38Z","body":"Hi:\r\n\r\nI´ve made some test with browser and desktop client and seems to be working fine. Change Password revokes any connection (token or password).\r\n\r\n"}}
{"actor":{"display_login":"mcastroSG"}}