Diffusion Phorge (HEAD -> master) History

phorge/src/applications/auth
HEAD -> mastere81eff68e581000b0d14caa…

May 16 2019

18f0f8b029a9 Add support for custom "Wait for Approval" instructions
Author
epriestley
Browse Repository
No Builds
No Audits

Apr 30 2019

648d5ce19076 Set a URI on Auth Messages, so the "Change Details" dialog from the transaction…
Author
epriestley
Browse Repository
No Builds
No Audits

Apr 17 2019

0583f6dc50a8 Some formatting changes for showing auth provider config guidance
Author
Austin McKinley
Browse Repository
No Builds
No Audits

Apr 14 2019

82c46f4b93bd Update "add panel" and "remove panel" Dashboard flows to the new panel storage…
Author
epriestley
Browse Repository
No Builds
No Audits

Apr 10 2019

0f9776fb58e2 Add a workflow and a new config option for locking authentication providers
Author
Austin McKinley
Browse Repository
No Builds
No Audits

Mar 29 2019

02f94cd7d288 Fix an issue with Duo not live-updating properly on login gates
Author
epriestley
Browse Repository
No Builds
No Audits

Mar 5 2019

920ab13cfb86 Correct a possible fatal in the non-CSRF Duo MFA workflow
Author
epriestley
Browse Repository
No Builds
No Audits

Feb 24 2019

01d0fc443afe Fix a typo
Author
Ariel Yang
Browse Repository
No Builds
No Audits

Feb 23 2019

701a9bc339b9 Fix Facebook login on mobile violating CSP after form redirect
Author
epriestley
Browse Repository
No Builds
No Audits

Feb 15 2019

8f8e863613c0 When users follow an email login link but an install does not use passwords…
Author
epriestley
Browse Repository
No Builds
No Audits

2ca316d652d8 When users confirm Duo MFA in the mobile app, live-update the UI
Author
epriestley
Browse Repository
No Builds
No Audits

Feb 14 2019

5892c7898603 Replace all "setQueryParam()" calls with "remove/replaceQueryParam()"
Author
epriestley
Browse Repository
No Builds
No Audits

241f06c9ffc6 Clean up final `setQueryParams()` callsites
Author
epriestley
Browse Repository
No Builds
No Audits

4c124201623a Replace "URI->setQueryParams()" after initialization with a constructor argument
Author
epriestley
Browse Repository
No Builds
No Audits

Feb 12 2019

5a89da12e293 When users have no password on their account, guide them through the "reset…
Author
epriestley
Browse Repository
No Builds
No Audits

3f35c0068ad1 Allow users to register with non-registration providers if they are invited to…
Author
epriestley
Browse Repository
No Builds
No Audits

d22495a820c6 Make external link/refresh use provider IDs, switch external account MFA to one…
Author
epriestley
Browse Repository
No Builds
No Audits

e5ee656fff0c Make external account unlinking use account IDs, not "providerType +…
Author
epriestley
Browse Repository
No Builds
No Audits

541d794c13df Give ExternalAccount a providerConfigPHID, tying it to a particular provider
Author
epriestley
Browse Repository
No Builds
No Audits

55c18bc90041 During first-time setup, create an administrator account with no authentication…
Author
epriestley
Browse Repository
No Builds
No Audits

1fd69f788cee Replace "getQueryParams()" callsites in Phabricator
Author
epriestley
Browse Repository
No Builds
No Audits

Feb 7 2019

a4bab60ad0ae Don't show "registration might be too open" warnings unless an auth provider…
Author
epriestley
Browse Repository
No Builds
No Audits

949afb02fd19 On login forms, autofocus the "username" field
Author
epriestley
Browse Repository
No Builds
No Audits

f0364eef8af2 Remove weird integration between Legalpad and the ExternalAccount table
Author
epriestley
Browse Repository
No Builds
No Audits

9f5e6bee9037 Make the default behavior of getApplicationTransactionCommentObject() "return…
Author
epriestley
Browse Repository
No Builds
No Audits

f2236eb061a6 Autofocus form control for adding TOTP codes
Author
Austin McKinley
Browse Repository
No Builds
No Audits

Feb 6 2019

fc3b90e1d1b1 Allow users to unlink their last external account with a warning, instead of…
Author
epriestley
Browse Repository
No Builds
No Audits

d6f691cf5d5d In "External Accounts", replace hard-to-find tiny "link" icon with a nice…
Author
epriestley
Browse Repository
No Builds
No Audits

Feb 5 2019

9632c704c69d Always allow users to login via email link, even if an install does not use…
Author
epriestley
Browse Repository
No Builds
No Audits

99e5ef84fc25 Remove obsolete "PhabricatorAuthLoginHandler"
Author
epriestley
Browse Repository
No Builds
No Audits

4fcb38a2a94c Move the Auth Provider edit flow toward a more modern layout
Author
epriestley
Browse Repository
No Builds
No Audits

8c8d56dc5636 Replace "Add Auth Provider" radio buttons with a more modern "click to select"…
Author
epriestley
Browse Repository
No Builds
No Audits

6f3bd13cf5da Begin adding more guidance to the "One-Time Login" flow
Author
epriestley
Browse Repository
No Builds
No Audits

03eb989fd875 Give Duo MFA a stronger hint if users continue without answering the challenge
Author
epriestley
Browse Repository
No Builds
No Audits

Feb 3 2019

db1e12370629 Fix an issue where Duo validation could incorrectly apply to other factor types
Author
epriestley
Browse Repository
No Builds
No Audits

Jan 30 2019

e9b2d667ee57 Improve handling of "Deny" responses from Duo
Author
epriestley
Browse Repository
No Builds
No Audits

1767b80654fe Replace manual query string construction with "phutil_build_http_querystring()"
Author
epriestley
Browse Repository
No Builds
No Audits

70b474e550b7 Allow MFA enrollment guidance to be customized
Author
epriestley
Browse Repository
No Builds
No Audits

Jan 28 2019

9fd8343704ee Bring Duo MFA upstream
Author
epriestley
Browse Repository
No Builds
No Audits

d8d4efe89e85 Require MFA to edit MFA providers
Author
epriestley
Browse Repository
No Builds
No Audits

29b4fad94173 Get rid of "throwResult()" for control flow in MFA factors
Author
epriestley
Browse Repository
No Builds
No Audits

bce44385e1e3 Add more factor details to the Settings factor list
Author
epriestley
Browse Repository
No Builds
No Audits

8e5d9c6f0eb5 Allow MFA providers to be deprecated or disabled
Author
epriestley
Browse Repository
No Builds
No Audits

Jan 24 2019

c9ff6ce390d6 Add CSRF to SMS challenges, and pave the way for more MFA types (including Duo)
Author
epriestley
Browse Repository
No Builds
No Audits

069160404fe8 Add a Duo API future
Author
epriestley
Browse Repository
No Builds
No Audits

Jan 23 2019

ab2cbbd9f946 Add a "test message" action for contact numbers
Author
epriestley
Browse Repository
No Builds
No Audits

587e9cea19ac Always require MFA to edit contact numbers
Author
epriestley
Browse Repository
No Builds
No Audits

7805b217ad8b Prevent users from editing, disabling, or swapping their primary contact number…
Author
epriestley
Browse Repository
No Builds
No Audits

ada8a56bb7db Implement SMS MFA
Author
epriestley
Browse Repository
No Builds
No Audits

6c11f373965c Add a pre-enroll step for MFA, primarily as a CSRF gate
Author
epriestley
Browse Repository
No Builds
No Audits

f3340c633562 Allow different MFA factor types (SMS, TOTP, Duo, ...) to share "sync" tokens…
Author
epriestley
Browse Repository
No Builds
No Audits

7c1d1c13f4a3 Add a rate limit for enroll attempts when adding new MFA configurations
Author
epriestley
Browse Repository
No Builds
No Audits

e91bc26da685 Don't rate limit users clicking "Wait Patiently" at an MFA gate even if they…
Author
epriestley
Browse Repository
No Builds
No Audits

bb20c136513c Allow MFA factors to provide more guidance text on create workflows
Author
epriestley
Browse Repository
No Builds
No Audits

af71c51f0a0b Give "MetaMTAMail" a "message type" and support SMS
Author
epriestley
Browse Repository
No Builds
No Audits

596435b35e30 Support designating a contact number as "primary"
Author
epriestley
Browse Repository
No Builds
No Audits

12203762b7f0 Allow contact numbers to be enabled and disabled
Author
epriestley
Browse Repository
No Builds
No Audits

c4244aa177b8 Allow users to access some settings at the "Add MFA" account setup roadblock
Author
epriestley
Browse Repository
No Builds
No Audits

f0c6ee48233a Add "Contact Numbers" so we can send users SMS mesages
Author
epriestley
Browse Repository
No Builds
No Audits

aa483738899d Update `bin/auth` MFA commands for the new "MFA Provider" indirection layer
Author
epriestley
Browse Repository
No Builds
No Audits

0fcff782533a Convert user MFA factors to point at configurable "MFA Providers", not raw "MFA…
Author
epriestley
Browse Repository
No Builds
No Audits

Jan 21 2019

6138d5885d23 Update documentation to reflect bin/auth changes
Author
Austin McKinley
Browse Repository
No Builds
No Audits

Jan 18 2019

6bb31de30596 Use the customizable "Welcome Mail" message in welcome mail
Author
epriestley
Browse Repository
No Builds
No Audits

22ad1ff2c5b1 Show the customized "Login" message on the login screen
Author
epriestley
Browse Repository
No Builds
No Audits

2c713b2d25fd Add "Auth Messages" to support customizing onboarding/welcome flows
Author
epriestley
Browse Repository
No Builds
No Audits

310ad7f8f47b Put a hard limit on password login attempts from the same remote address
Author
epriestley
Browse Repository
No Builds
No Audits

Jan 16 2019

a62f334d9503 Add a skeleton for configurable MFA provider types
Author
epriestley
Browse Repository
No Builds
No Audits

Jan 4 2019

1f4cf23455d7 Remove "phabricator.csrf-key" and upgrade CSRF hashing to SHA256
Author
epriestley
Browse Repository
No Builds
No Audits

Dec 28 2018

1729e7b46792 Improve UI for "wait" and "answered" MFA challenges
Author
epriestley
Browse Repository
No Builds
No Audits

918f4ebcd82c Fix a double-prompt for MFA when recovering a password account
Author
epriestley
Browse Repository
No Builds
No Audits

ca39be60914b Make partial sessions expire after 30 minutes, and do not extend them
Author
epriestley
Browse Repository
No Builds
No Audits

38c48ae7d048 Remove support for the "TYPE_AUTH_WILLLOGIN" event
Author
epriestley
Browse Repository
No Builds
No Audits

ff49d1ef776b Allow "bin/auth recover" to generate a link which forces a full login session
Author
epriestley
Browse Repository
No Builds
No Audits

1c89b3175f1c Improve UI messaging around "one-shot" vs "session upgrade" MFA
Author
epriestley
Browse Repository
No Builds
No Audits

3da9844564cf Tighten some MFA/TOTP parameters to improve resistance to brute force attacks
Author
epriestley
Browse Repository
No Builds
No Audits

543f2b6bf156 Allow any transaction group to be signed with a one-shot "Sign With MFA" action
Author
epriestley
Browse Repository
No Builds
No Audits

Dec 20 2018

11cf8f05b176 Remove "getApplicationTransactionObject()" from ApplicationTransactionInterface
Author
epriestley
Browse Repository
No Builds
No Audits

937e88c399ab Remove obsolete, no-op implementations of "willRenderTimeline()"
Author
epriestley
Browse Repository
No Builds
No Audits

b63783c06718 Carry MFA responses which have been "answered" but not "completed" through the…
Author
epriestley
Browse Repository
No Builds
No Audits

ce953ea44790 Explicitly mark MFA challenges as "answered" and "completed"
Author
epriestley
Browse Repository
No Builds
No Audits

657f3c380608 When accepting a TOTP response, require it respond explicitly to a specific…
Author
epriestley
Browse Repository
No Builds
No Audits

0673e79d6d96 Simplify and correct some challenge TTL lockout code
Author
epriestley
Browse Repository
No Builds
No Audits

Dec 19 2018

979187132d7b Update accountadmin to use new admin empowerment code
Author
Austin McKinley
Browse Repository
No Builds
No Audits

Dec 18 2018

46052878b1de Bind MFA challenges to particular workflows, like signing a specific Legalpad…
Author
epriestley
Browse Repository
No Builds
No Audits

Dec 17 2018

5e94343c7d1a Add a garbage collector for MFA challenges
Author
epriestley
Browse Repository
No Builds
No Audits

b8cbfda07ce6 Track MFA "challenges" so we can bind challenges to sessions and support SMS…
Author
epriestley
Browse Repository
No Builds
No Audits

c731508d748a Require MFA implementations to return a formal result object when validating…
Author
epriestley
Browse Repository
No Builds
No Audits

Dec 13 2018

080fb1985f29 Upgrade an old "weakDigest()" inside TOTP synchronization code
Author
epriestley
Browse Repository
No Builds
No Audits

1d34238dc945 Upgrade sessions digests to HMAC256, retaining compatibility with old digests
Author
epriestley
Browse Repository
No Builds
No Audits

c58506aeaace Give sessions real PHIDs and slightly modernize session queries
Author
epriestley
Browse Repository
No Builds
No Audits

Nov 28 2018

1d0b99e1f834 Allow applications to require a High Security token without doing a session…
Author
epriestley
Browse Repository
No Builds
No Audits

Nov 16 2018

49483bdb4823 Use "%P" to protect session key hashes in SessionEngine queries from DarkConsole
Author
epriestley
Browse Repository
No Builds
No Audits

Nov 15 2018

2f10d4adebf9 Continue making application fixes to Phabricator for changes to %Q semantics
Author
epriestley
Browse Repository
No Builds
No Audits

98690ee326ce Update many Phabricator queries for new %Q query semantics
Author
epriestley
Browse Repository
No Builds
No Audits

Nov 7 2018

8a4bf386552f Use 160-bit TOTP keys rather than 80-bit TOTP keys
Author
epriestley
Browse Repository
No Builds
No Audits

Nov 6 2018

1f6a4cfffe58 Prevent users from selecting excessively bad passwords based on their username…
Author
epriestley
Browse Repository
No Builds
No Audits

Oct 1 2018

4858d43d1601 Add 'autocomplete="off"' to MFA TOTP inputs
Author
epriestley
Browse Repository
No Builds
No Audits

Sep 12 2018

f5e90a363e7a When a user takes actions while in a high security session, note it on the…
Author
epriestley
Browse Repository
No Builds
No Audits

Aug 16 2018

0ccf1410e057 Give PhabricatorAuthPassword a formal CAN_EDIT policy
Author
epriestley
Browse Repository
No Builds
No Audits

Aug 9 2018

6df278bea84a In "bin/ssh-auth", cache a structure instead of a flat file because paths may…
Author
epriestley
Browse Repository
No Builds
No Audits