Diffusion Phorge (HEAD -> master) History

phorge/src/applications/auth/engine/PhabricatorAuthSessionEngine.php
HEAD -> mastere81eff68e581000b0d14caa…

Oct 23 2024

f3d49f740737 Fix implicitly nullable parameter declarations for PHP 8.4
Author
Andre Klapper
Browse Repository
No Builds
No Audits

Sep 6 2024

123831b53fb7 Drop question mark suffix from optional PHPDoc @param types
Author
Andre Klapper
Browse Repository
No Builds
No Audits

Aug 21 2024

b44b566b1334 Add missing variable names to PHPDoc @param of methods
Author
Andre Klapper
Browse Repository
No Builds
No Audits

Jan 30 2020

12c337098872 When issuing a "no-op" MFA token because no MFA is configured, don't give the…
Author
epriestley
Browse Repository
No Builds
No Audits

Jul 24 2019

32dd13d43421 Modularize user activity log message types
Author
epriestley
Browse Repository
No Builds
No Audits

Jun 18 2019

1dd62f79cedb Fix more "msort()" vs "msortv()" callsites
Author
epriestley
Browse Repository
No Builds
No Audits

Apr 14 2019

82c46f4b93bd Update "add panel" and "remove panel" Dashboard flows to the new panel storage…
Author
epriestley
Browse Repository
No Builds
No Audits

Mar 5 2019

920ab13cfb86 Correct a possible fatal in the non-CSRF Duo MFA workflow
Author
epriestley
Browse Repository
No Builds
No Audits

Jan 28 2019

29b4fad94173 Get rid of "throwResult()" for control flow in MFA factors
Author
epriestley
Browse Repository
No Builds
No Audits

8e5d9c6f0eb5 Allow MFA providers to be deprecated or disabled
Author
epriestley
Browse Repository
No Builds
No Audits

Jan 24 2019

c9ff6ce390d6 Add CSRF to SMS challenges, and pave the way for more MFA types (including Duo)
Author
epriestley
Browse Repository
No Builds
No Audits

Jan 23 2019

e91bc26da685 Don't rate limit users clicking "Wait Patiently" at an MFA gate even if they…
Author
epriestley
Browse Repository
No Builds
No Audits

0fcff782533a Convert user MFA factors to point at configurable "MFA Providers", not raw "MFA…
Author
epriestley
Browse Repository
No Builds
No Audits

Dec 28 2018

918f4ebcd82c Fix a double-prompt for MFA when recovering a password account
Author
epriestley
Browse Repository
No Builds
No Audits

ca39be60914b Make partial sessions expire after 30 minutes, and do not extend them
Author
epriestley
Browse Repository
No Builds
No Audits

ff49d1ef776b Allow "bin/auth recover" to generate a link which forces a full login session
Author
epriestley
Browse Repository
No Builds
No Audits

1c89b3175f1c Improve UI messaging around "one-shot" vs "session upgrade" MFA
Author
epriestley
Browse Repository
No Builds
No Audits

3da9844564cf Tighten some MFA/TOTP parameters to improve resistance to brute force attacks
Author
epriestley
Browse Repository
No Builds
No Audits

Dec 20 2018

b63783c06718 Carry MFA responses which have been "answered" but not "completed" through the…
Author
epriestley
Browse Repository
No Builds
No Audits

ce953ea44790 Explicitly mark MFA challenges as "answered" and "completed"
Author
epriestley
Browse Repository
No Builds
No Audits

Dec 18 2018

46052878b1de Bind MFA challenges to particular workflows, like signing a specific Legalpad…
Author
epriestley
Browse Repository
No Builds
No Audits

Dec 17 2018

b8cbfda07ce6 Track MFA "challenges" so we can bind challenges to sessions and support SMS…
Author
epriestley
Browse Repository
No Builds
No Audits

c731508d748a Require MFA implementations to return a formal result object when validating…
Author
epriestley
Browse Repository
No Builds
No Audits

Dec 13 2018

1d34238dc945 Upgrade sessions digests to HMAC256, retaining compatibility with old digests
Author
epriestley
Browse Repository
No Builds
No Audits

c58506aeaace Give sessions real PHIDs and slightly modernize session queries
Author
epriestley
Browse Repository
No Builds
No Audits

Nov 28 2018

1d0b99e1f834 Allow applications to require a High Security token without doing a session…
Author
epriestley
Browse Repository
No Builds
No Audits

Nov 16 2018

49483bdb4823 Use "%P" to protect session key hashes in SessionEngine queries from DarkConsole
Author
epriestley
Browse Repository
No Builds
No Audits

Nov 15 2018

2f10d4adebf9 Continue making application fixes to Phabricator for changes to %Q semantics
Author
epriestley
Browse Repository
No Builds
No Audits

Sep 12 2018

f5e90a363e7a When a user takes actions while in a high security session, note it on the…
Author
epriestley
Browse Repository
No Builds
No Audits

Apr 6 2017

3d816e94dfbe Rename "PhabricatorHash::digest()" to "weakDigest()"
Author
epriestley
Browse Repository
No Builds
No Audits

Nov 17 2016

2befd239a85e Add session and request hooks to PhabricatorAuthSessionEngine
Author
epriestley
Browse Repository
No Builds
No Audits

Jun 7 2016

814fa135b036 Centralize "this is the current user for the request" code
Author
epriestley
Browse Repository
No Builds
No Audits

Jun 5 2016

6f1053c206f1 Convert user profile images into a standard cache
Author
epriestley
Browse Repository
No Builds
No Audits

2b344b2bb500 Make caches misses throw by default intead of inline-generating
Author
epriestley
Browse Repository
No Builds
No Audits

Jun 2 2016

9180f429eb9f Provide a general-purpose, modular user cache for settings and other similar…
Author
epriestley
Browse Repository
No Builds
No Audits

Apr 5 2016

46881c4ce507 Add a session engine extension point
Author
epriestley
Browse Repository
No Builds
No Audits

Mar 16 2016

a837c3d73eaf Make temporary token storage/schema more flexible
Author
epriestley
Browse Repository
No Builds
No Audits

8e3ea4e034eb Use new modular temporary auth token constants in one-time login and password…
Author
epriestley
Browse Repository
No Builds
No Audits

Sep 1 2015

29948eaa5bd2 Use phutil_hashes_are_identical() when comparing hashes in Phabricator
Author
epriestley
Browse Repository
No Builds
No Audits

Jun 3 2015

992c19957760 Add "Mailing List" users
Author
epriestley
Browse Repository
No Builds
No Audits

Feb 12 2015

d39da529ca26 Legalpad - allow for legalpad documents to be required to be signed for using…
Author
Bob Trahan
Browse Repository
No Builds
No Audits

Aug 4 2014

42cf7f6faa10 Make the current session key a component of the CSRF token
Author
epriestley
Browse Repository
No Builds
No Audits

95eeffff7e5d Terminate other sessions on credential changes
Author
epriestley
Browse Repository
No Builds
No Audits

May 22 2014

f1534e6feb6a Make password reset emails use one-time tokens
Author
epriestley
Browse Repository
No Builds
No Audits

May 1 2014

a04e138ae247 Minor cleanup of some session code
Author
epriestley
Browse Repository
No Builds
No Audits

50376aad04d2 Require multiple auth factors to establish web sessions
Author
epriestley
Browse Repository
No Builds
No Audits

Apr 30 2014

23e654ec2bc8 Rate limit multi-factor actions
Author
epriestley
Browse Repository
No Builds
No Audits

Apr 28 2014

a017a8e02b51 Make two-factor auth actually work
Author
epriestley
Browse Repository
No Builds
No Audits

Apr 27 2014

3f5a55fa6e5a Let users review their own account activity logs
Author
epriestley
Browse Repository
No Builds
No Audits

f42ec84d0c6b Add "High Security" mode to support multi-factor auth
Author
epriestley
Browse Repository
No Builds
No Audits

Jan 23 2014

69ddb0ced631 Issue "anonymous" sessions for logged-out users
Author
epriestley
Browse Repository
No Builds
No Audits

Jan 15 2014

2ec45d42a689 Remove session limits and sequencing
Author
epriestley
Browse Repository
No Builds
No Audits

acb141cf52c1 Expire and garbage collect unused sessions
Author
epriestley
Browse Repository
No Builds
No Audits

Jan 14 2014

d392a8f15700 Replace "web" and "conduit" magic session strings with constants
Author
epriestley
Browse Repository
No Builds
No Audits

eef314b70149 Separate session management from PhabricatorUser
Author
epriestley
Browse Repository
No Builds
No Audits