Allow admin to create users without password by sending mail automatic… by skjnldsv · Pull Request #8856 · nextcloud/server

skjnldsv · 2018-03-16T14:34:00Z

…ally

Required by #8824

MorrisJobke · 2018-03-16T20:55:16Z

apps/provisioning_api/lib/Controller/UsersController.php

+				throw new OCSException('To send a password link to the user an email address is required.', 108);
+			}
+
+			$password = $this->secureRandom->generate(30);


30?!? Don't overcomplicate things 😅

But... that is only 1532495540865888858358347027150309183618739122183602176 possibilities!

X)
Do we want to be secure or not!!?? :D

codecov · 2018-03-17T11:33:20Z

Codecov Report

Merging #8856 into master will decrease coverage by 45.02%.
The diff coverage is 0%.

@@             Coverage Diff              @@
##             master   #8856       +/-   ##
============================================
- Coverage     51.88%   6.85%   -45.03%     
- Complexity    25269   25273        +4     
============================================
  Files          1603    1603               
  Lines         94878   94899       +21     
  Branches       1388    1388               
============================================
- Hits          49229    6508    -42721     
- Misses        45649   88391    +42742

Impacted Files	Coverage Δ	Complexity Δ
...rovisioning_api/lib/Controller/UsersController.php	`0% <0%> (-77.21%)`	`138 <15> (+4)`
...c/AppFramework/Http/EmptyContentSecurityPolicy.php	`0% <0%> (-100%)`	`45% <0%> (ø)`
lib/private/Group/Database.php	`0% <0%> (-100%)`	`26% <0%> (ø)`
lib/private/BackgroundJob/QueuedJob.php	`0% <0%> (-100%)`	`1% <0%> (ø)`
.../Exceptions/EncryptionHeaderKeyExistsException.php	`0% <0%> (-100%)`	`1% <0%> (ø)`
lib/private/Route/CachingRouter.php	`0% <0%> (-100%)`	`3% <0%> (ø)`
lib/private/Files/AppData/Factory.php	`0% <0%> (-100%)`	`2% <0%> (ø)`
lib/private/TagManager.php	`0% <0%> (-100%)`	`4% <0%> (ø)`
lib/private/Support/CrashReport/Registry.php	`0% <0%> (-100%)`	`3% <0%> (ø)`
apps/files_sharing/lib/External/MountProvider.php	`0% <0%> (-100%)`	`4% <0%> (ø)`
... and 864 more

rullzer · 2018-03-19T08:49:19Z

apps/provisioning_api/lib/Controller/UsersController.php

+
+			$password = $this->secureRandom->generate(10);
+			// Make sure we pass the password_policy
+			$password .= $this->secureRandom->generate(2, '$!.,;:-~+*[]{}()');


well this is only 'kind of' true. We don't know if this will pass the password policy test because we don't know what it is set to.

Nothing you can fix here. But still

I used old code, so I'm to blame here :D
To be fair, the goal is to create a secure password that no one will know about since the user will receive a mail to reset it. I suggest we remove the special char part and only use a 15 length generation.

Then this might fail hard when using the password_policy app ;) But like I said fine by me. Lets do this for now.

nickvergessen · 2018-03-22T09:57:07Z

apps/provisioning_api/lib/Controller/UsersController.php

 	 * @throws OCSException
 	 */
-	public function addUser(string $userid, string $password, array $groups = []): DataResponse {
+	public function addUser(string $userid, string $password = '', $email='', array $groups = []): DataResponse {


string $email = ''

…ally Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>

skjnldsv · 2018-03-23T07:00:48Z

I think the failure is unrelated!

skjnldsv added 3. to review Waiting for reviews feature: users and groups labels Mar 16, 2018

skjnldsv added this to the Nextcloud 14 milestone Mar 16, 2018

skjnldsv self-assigned this Mar 16, 2018

skjnldsv requested review from MorrisJobke, nickvergessen, rullzer and schiessle March 16, 2018 14:34

MorrisJobke reviewed Mar 16, 2018

View reviewed changes

skjnldsv force-pushed the ocs-api-new-user-password-email branch from 7559c7d to 73682c2 Compare March 17, 2018 11:33

skjnldsv requested a review from MorrisJobke March 17, 2018 11:33

skjnldsv force-pushed the ocs-api-new-user-password-email branch from 73682c2 to 3bba48d Compare March 17, 2018 11:34

skjnldsv mentioned this pull request Mar 17, 2018

Vue migration: settings #8824

Merged

34 tasks

skjnldsv force-pushed the ocs-api-new-user-password-email branch 5 times, most recently from 47bae0c to c3f9c7e Compare March 19, 2018 07:19

rullzer reviewed Mar 19, 2018

View reviewed changes

rullzer approved these changes Mar 19, 2018

View reviewed changes

nickvergessen approved these changes Mar 22, 2018

View reviewed changes

skjnldsv force-pushed the ocs-api-new-user-password-email branch 2 times, most recently from 02f1087 to bcca3e0 Compare March 22, 2018 13:54

Allow admin to create users withoutpassword by sending mail automatic…

41b690e

…ally Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>

skjnldsv force-pushed the ocs-api-new-user-password-email branch from bcca3e0 to 41b690e Compare March 22, 2018 14:06

skjnldsv added 4. to release Ready to be released and/or waiting for tests to finish and removed 3. to review Waiting for reviews labels Mar 23, 2018

MorrisJobke merged commit 6a31203 into master Mar 23, 2018

MorrisJobke deleted the ocs-api-new-user-password-email branch March 23, 2018 07:17

MorrisJobke mentioned this pull request Apr 4, 2018

Critical changes for developers & admins for Nextcloud 14 #7827

Closed

skjnldsv mentioned this pull request Sep 13, 2018

Missing setting to send welcome mail when creating a user #11172

Closed

acanrpk mentioned this pull request Jan 8, 2019

NextCloud 13+? Bu1k/ProvisioningAPI#1

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Allow admin to create users without password by sending mail automatic…#8856

Allow admin to create users without password by sending mail automatic…#8856
MorrisJobke merged 1 commit intomasterfrom
ocs-api-new-user-password-email

skjnldsv commented Mar 16, 2018 •

edited

Loading

Uh oh!

MorrisJobke Mar 16, 2018

Uh oh!

rullzer Mar 16, 2018

Uh oh!

skjnldsv Mar 17, 2018

Uh oh!

codecov bot commented Mar 17, 2018 •

edited

Loading

Uh oh!

rullzer Mar 19, 2018

Uh oh!

rullzer Mar 19, 2018

Uh oh!

skjnldsv Mar 19, 2018 •

edited

Loading

Uh oh!

rullzer Mar 19, 2018

Uh oh!

nickvergessen Mar 22, 2018

Uh oh!

skjnldsv commented Mar 23, 2018

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

skjnldsv commented Mar 16, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MorrisJobke Mar 16, 2018

Choose a reason for hiding this comment

Uh oh!

rullzer Mar 16, 2018

Choose a reason for hiding this comment

Uh oh!

skjnldsv Mar 17, 2018

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Mar 17, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

rullzer Mar 19, 2018

Choose a reason for hiding this comment

Uh oh!

rullzer Mar 19, 2018

Choose a reason for hiding this comment

Uh oh!

skjnldsv Mar 19, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rullzer Mar 19, 2018

Choose a reason for hiding this comment

Uh oh!

nickvergessen Mar 22, 2018

Choose a reason for hiding this comment

Uh oh!

skjnldsv commented Mar 23, 2018

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

skjnldsv commented Mar 16, 2018 •

edited

Loading

codecov bot commented Mar 17, 2018 •

edited

Loading

skjnldsv Mar 19, 2018 •

edited

Loading